Function at 0x409980
Capabilities:
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6cc
mov eax, dword [0x429280]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x6cc], eax
xor eax, eax
push 0x18e
push eax
mov word [ebp - 0x324], ax
lea eax, [ebp - 0x322]
push eax
mov dword [ebp - 0x6c8], ebx
call fcn.00416d70
xor eax, eax
push 0x18e
push eax
mov word [ebp - 0x4b4], ax
lea eax, [ebp - 0x4b2]
push eax
call fcn.00416d70
xor eax, eax
push 0x18e
push eax
mov word [ebp - 0x194], ax
lea eax, [ebp - 0x192]
push eax
call fcn.00416d70
add esp, 0x24
lea eax, [ebp - 0x324]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push eax
call esi
push ebx
lea eax, [ebp - 0x194]
push eax
call esi
lea eax, [ebp - 0x6c0]
push eax
lea eax, [ebp - 0x6c4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x324]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x409a88
lea eax, [ebp - 0x194]
push eax
call ebx
add eax, eax
push eax
lea eax, [ebp - 0x194]
push eax
push 1
push 0
lea eax, [ebp - 0x4b4]
push eax
push dword [ebp - 0x6c4]
call edi
push dword [ebp - 0x6c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x190
lea eax, [ebp - 0x324]
push 0
push eax
call fcn.00416d70
add esp, 0xc
lea eax, [ebp - 0x324]
push dword [ebp - 0x6c8]
push eax
call esi
push str._shellopencommand
lea eax, [ebp - 0x324]
push eax
call esi
push 0x190
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.00416d70
add esp, 0xc
lea eax, [ebp - 0x194]
push 0x426884
push eax
call esi
push dword [ebp - 0x6cc]
lea eax, [ebp - 0x194]
push eax
call esi
push 0x426884
lea eax, [ebp - 0x194]
push eax
call esi
push 0x426888
lea eax, [ebp - 0x194]
push eax
call esi
lea eax, [ebp - 0x6c0]
push eax
lea eax, [ebp - 0x6c4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x324]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409b6d
lea eax, [ebp - 0x194]
push eax
call ebx
add eax, eax
push eax
lea eax, [ebp - 0x194]
push eax
push 1
push 0
lea eax, [ebp - 0x4b4]
push eax
push dword [ebp - 0x6c4]
call edi
push dword [ebp - 0x6c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x190
lea eax, [ebp - 0x324]
push 0
push eax
call fcn.00416d70
add esp, 0xc
lea eax, [ebp - 0x324]
push dword [ebp - 0x6c8]
push eax
call esi
push str.DefaultIcon
lea eax, [ebp - 0x324]
push eax
call esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x6bc], ax
lea eax, [ebp - 0x6ba]
push eax
call fcn.00416d70
add esp, 0xc
lea eax, [ebp - 0x6bc]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str._shell32.dll
lea eax, [ebp - 0x6bc]
push eax
call esi
push 0x190
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.00416d70
add esp, 0xc
lea eax, [ebp - 0x6bc]
push eax
lea eax, [ebp - 0x194]
push eax
call esi
push str.__154
lea eax, [ebp - 0x194]
push eax
call esi
lea eax, [ebp - 0x6c0]
push eax
lea eax, [ebp - 0x6c8]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x324]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x409c75
lea eax, [ebp - 0x194]
push eax
call ebx
add eax, eax
push eax
lea eax, [ebp - 0x194]
push eax
push 1
push 0
lea eax, [ebp - 0x4b4]
push eax
push dword [ebp - 0x6c8]
call edi
push dword [ebp - 0x6c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041050e
mov esp, ebp
pop ebp
ret 0xc