Function at 0x401960
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x4fbf50]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x134], ecx
lea ecx, [ebp - 0x128]
push ecx
push eax
push 0x80000000
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4019a8
mov edx, dword [ebp - 0x128]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
sub eax, ecx
inc eax
push eax
push esi
push 1
push 0x4f2adc
push edx
call ebx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x128]
push ecx
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4019f0
mov edx, dword [ebp - 0x128]
sub eax, ecx
inc eax
push eax
push edi
push 1
push 0x4f2adc
push edx
call ebx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.MSVCR100.dll_sprintf]
push esi
lea ecx, [ebp - 0x108]
push str._sDefaultIcon
push ecx
call edi
add esp, 0xc
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x108]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [ebp - 0x130]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401a53
mov edx, dword [ebp - 0x128]
sub eax, ecx
mov ecx, dword [ebp - 0x130]
inc eax
push eax
push ecx
push 1
push 0x4f2adc
push edx
call ebx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea ecx, [ebp - 0x108]
push str._sShell
push ecx
call edi
add esp, 0xc
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 0x108]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [ebp - 0x128]
push 5
push str.Open
push 1
push 0x4f2adc
push ecx
call ebx
mov edx, dword [ebp - 0x128]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x108]
push str._sShellOpen
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 0x108]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [ebp - 0x128]
push 0x11
push 0x4ed538
push 1
push 0x4f2adc
push eax
call ebx
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea edx, [ebp - 0x108]
push str._sShellOpenCommand
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [ebp - 0x134]
push edx
lea eax, [ebp - 0x108]
push str.__s_____1_
push eax
call edi
lea eax, [ebp - 0x108]
add esp, 0xc
lea ecx, [eax + 1]
lea esp, [esp]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401b70
mov edx, dword [ebp - 0x128]
sub eax, ecx
inc eax
push eax
lea ecx, [ebp - 0x108]
push ecx
push 1
push 0x4f2adc
push edx
call ebx
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x12c]
push ecx
lea edx, [ebp - 0x108]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sUserChoice
push edx
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x128]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x108]
push edx
push 0x80000001
call ebx
lea eax, [ebp - 0x128]
push eax
push 0x20006
push 0
lea ecx, [ebp - 0x108]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c9f
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x124], al
mov eax, esi
mov dword [ebp - 0x110], 0xf
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401c30
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x124]
call fcn.00403920
cmp dword [ebp - 0x110], 0x10
mov eax, dword [ebp - 0x124]
jae 0x401c5b
lea eax, [ebp - 0x124]
mov edx, dword [ebp - 0x114]
push edx
push eax
mov eax, dword [ebp - 0x128]
push 1
push 0
push str.Progid
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x128]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x110], 0x10
jb 0x401c9f
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x108]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_s
push ecx
call edi
add esp, 0xc
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x128]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x108]
push ecx
push 0x80000001
call ebx
lea edx, [ebp - 0x128]
push edx
push 0x20006
push 0
lea eax, [ebp - 0x108]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop ebx
test eax, eax
jne 0x401d96
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x124], al
mov eax, esi
mov dword [ebp - 0x110], 0xf
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401d24
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x124]
call fcn.00403920
mov eax, dword [ebp - 0x124]
mov esi, 0x10
cmp dword [ebp - 0x110], esi
jae 0x401d53
lea eax, [ebp - 0x124]
mov ecx, dword [ebp - 0x114]
mov edx, dword [ebp - 0x128]
push ecx
push eax
push 1
push 0
push str.Progid
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x128]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x110], esi
jb 0x401d96
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004b7299
mov esp, ebp
pop ebp
ret