Function at 0x407f40
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
sub esp, 0x208
mov dword [ebp - 0x10], eax
mov esi, edx
mov eax, dword [0x45d580]
push eax
push 0x44318f
lea eax, [ebp - 0x214]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
test eax, eax
je 0x407f9d
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ecx
pop ebp
ret
mov edx, dword [0x45d580]
push edx
push 0x4431a8
lea eax, [ebp - 0x214]
push eax
call fcn.0042c8a0
add esp, 0xc
test esi, esi
je 0x408259
mov edx, esi
mov edi, edx
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc ecx
push ecx
push edx
push 1
push 0
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov esi, dword [ebp - 0x14]
push esi
mov edi, dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push edi
push 0x4431b0
lea eax, [ebp - 0x214]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
test eax, eax
jne 0x407f93
mov eax, dword [0x45d580]
push eax
push 0x4431c4
lea eax, [ebp - 0x214]
push eax
call fcn.0042c8a0
add esp, 0xc
lea edi, [ebp - 0x214]
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc ecx
push ecx
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
push 0xfa
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
test eax, eax
je 0x40824c
mov esi, dword [0x45d580]
push esi
push 0x4431cc
lea eax, [ebp - 0x214]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
test eax, eax
jne 0x40812a
push ebx
lea eax, [ebp - 0x114]
push eax
push 0x4431f1
lea eax, [ebp - 0x214]
push eax
call fcn.0042c8a0
add esp, 0x10
lea edi, [ebp - 0x214]
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc ecx
push ecx
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0
mov edi, dword [ebp - 0x14]
push edi
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov edx, dword [0x45d580]
push edx
push 0x4431f7
lea eax, [ebp - 0x214]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
test eax, eax
jne 0x4081bb
mov ecx, dword [0x45d580]
push ecx
push 0x44321b
lea eax, [ebp - 0x214]
push eax
call fcn.0042c8a0
add esp, 0xc
lea edi, [ebp - 0x214]
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc ecx
push ecx
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov edi, dword [0x45d580]
push edi
push 0x443228
lea eax, [ebp - 0x214]
push eax
call fcn.0042c8a0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 2
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
test eax, eax
jne 0x40824c
lea eax, [ebp - 0x114]
push eax
push 0x443254
lea eax, [ebp - 0x214]
push eax
call fcn.0042c8a0
add esp, 0xc
lea edi, [ebp - 0x214]
sub ecx, ecx
dec ecx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
inc ecx
push ecx
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ecx
pop ebp
ret
lea edx, [ebp - 0x214]
jmp 0x407fc2