Function at 0x4ebaf0
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x53cb65
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0x18]
call dword [0x55a6c4]
mov byte [esp + 0x38], 1
mov edi, dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
push str..wtwExtension
lea eax, [esp + 0x1c]
push str.SoftwareClasses_s
push eax
call edi
mov edx, dword [esp + 0x24]
add esp, 0xc
mov eax, 0xf003f
lea esi, [esp + 0x24]
call fcn.004ec830
test eax, eax
jne 0x4ebd9c
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.wtw.localClass
call ebp
mov esi, dword [esp + 0x24]
inc eax
lea ecx, [eax + eax]
push ecx
push str.wtw.localClass
push 1
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, ebx
je 0x4ebba3
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x24], ebx
push str.wtw.localClass
lea edx, [esp + 0x1c]
push str.SoftwareClasses_sDefaultIcon
push edx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x24]
add esp, 0xc
mov eax, 0xf003f
lea esi, [esp + 0x24]
call fcn.004ec830
test eax, eax
jne 0x4ebd9c
lea ecx, [esp + 0x1c]
call dword [0x55a6c4]
mov byte [esp + 0x38], 2
lea eax, [esp + 0x20]
push eax
call fcn.004e2980
mov byte [esp + 0x3c], 3
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x24]
push str._swtw.exe__300
push edx
call edi
add esp, 0x10
mov byte [esp + 0x38], 2
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, ebx
setne cl
mov esi, eax
cmp ecx, ebx
jne 0x4ebc2f
mov eax, 0x80004005
call fcn.004ec890
push eax
call ebp
inc eax
add eax, eax
push eax
push esi
mov esi, dword [esp + 0x2c]
push 1
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x4ebc57
push esi
call ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x38], 1
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
push str.wtw.localClass
lea ecx, [esp + 0x1c]
push str.SoftwareClasses_sShellOpenCommand
push ecx
call edi
mov edx, dword [esp + 0x24]
add esp, 0xc
mov eax, 0xf003f
lea esi, [esp + 0x24]
call fcn.004ec830
test eax, eax
jne 0x4ebd1d
lea ecx, [esp + 0x1c]
call dword [0x55a6c4]
mov byte [esp + 0x38], 4
lea edx, [esp + 0x20]
push edx
call fcn.004e2980
mov byte [esp + 0x3c], 5
mov eax, dword [eax]
push eax
lea ecx, [esp + 0x24]
push str.__swtw.exe____install____1_
push ecx
call edi
add esp, 0x10
mov byte [esp + 0x38], 4
lea ecx, [esp + 0x20]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov edx, esi
mov esi, dword [esp + 0x1c]
push ebx
push edx
call fcn.004ec7f0
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4ebcf3
push eax
call ebp
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0x38], 1
lea ecx, [esp + 0x1c]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, 0xf003f
mov edx, str.SoftwareClasseswtw.localClass
lea esi, [esp + 0x24]
call fcn.004ec830
test eax, eax
je 0x4ebd5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4ebd31
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov byte [esp + 0x38], bl
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4ebddb
push eax
call ebp
jmp 0x4ebdd7
push ebx
lea eax, [esp + 0x28]
push eax
mov esi, str.WTW_Extension
call fcn.004ec7f0
lea esi, [esp + 0x24]
call fcn.00435a50
mov byte [esp + 0x38], bl
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4ebd98
push eax
call ebp
mov dword [esp + 0x24], ebx
xor eax, eax
jmp 0x4ebddd
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x4ebdb0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov byte [esp + 0x38], bl
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4ebddb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x24], ebx
mov eax, esi
mov dword [esp + 0x28], ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret