Function at 0x420f60
Capabilities:
Delete registry key
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x9c48d0]
xor eax, esp
mov dword [esp + 0x214], eax
push ebp
push 0x104
lea ecx, [esp + 0x14]
xor eax, eax
push ecx
push eax
mov word [esp + 0x1c], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor edx, edx
lea eax, [esp + 0x10]
mov word [esp + 0x216], dx
call fcn.00455200
mov ebp, eax
mov dword [esp + 8], ebp
test ebp, ebp
jne 0x420fc9
push eax
call fcn.00658a01
add esp, 4
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.0065865c
add esp, 0x218
ret
push edi
push 0
push str.SoftwareClasses.pdf
push esi
call fcn.00450f30
mov edi, eax
push 0
mov dword [esp + 0x20], edi
call fcn.00658a01
add esp, 0x10
test edi, edi
je 0x421010
mov ecx, 0x9233f0
mov eax, edi
call fcn.00457970
test al, al
jne 0x421010
push str.previous.pdf
push str.SoftwareClassesSumatraPDF
push esi
mov edx, edi
call fcn.00450ff0
add esp, 0xc
mov eax, str.PDF_Document
call fcn.0044a3e0
test eax, eax
je 0x421034
mov ecx, eax
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x421023
sub ecx, edi
sar ecx, 1
jmp 0x421036
xor ecx, ecx
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push 0
push str.SoftwareClassesSumatraPDF
push esi
call edi
push 0x923408
push 0x9264e4
push ebp
push str._s_s_s
call fcn.00458200
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x421081
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421070
sub eax, edx
sar eax, 1
jmp 0x421083
xor eax, eax
lea edx, [eax + eax + 2]
push edx
push ebx
push 1
push 0
push str.SoftwareClassesSumatraPDFDefaultIcon
push esi
call edi
push ebx
call fcn.00658a01
add esp, 4
push 0xa
push str.open
push 1
push 0
push str.SoftwareClassesSumatraPDF_shell
push esi
call edi
push ebp
push str.__s_____1____
call fcn.00458200
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x4210e1
lea edx, [eax + 2]
jmp 0x4210d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4210d0
sub eax, edx
sar eax, 1
jmp 0x4210e3
xor eax, eax
lea eax, [eax + eax + 2]
push eax
push ebp
push 1
push 0
push str.SoftwareClassesSumatraPDF_shellopencommand
push esi
call edi
mov ecx, dword [esp + 0x10]
push ecx
test eax, eax
push str.__s___print_to_default____1_
sete byte [esp + 0x17]
call fcn.00458200
push ebp
mov ebx, eax
call fcn.00658a01
add esp, 0xc
test ebx, ebx
je 0x421131
mov eax, ebx
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421120
sub eax, edx
sar eax, 1
jmp 0x421133
xor eax, eax
lea edx, [eax + eax + 2]
push edx
push ebx
push 1
push 0
push str.SoftwareClassesSumatraPDF_shellprintcommand
push esi
call edi
mov eax, dword [esp + 0x10]
push eax
push str.__s___print_to____2_____1_
call fcn.00458200
push ebx
mov ebp, eax
call fcn.00658a01
add esp, 0xc
pop ebx
test ebp, ebp
je 0x421181
mov eax, ebp
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421170
sub eax, edx
sar eax, 1
jmp 0x421183
xor eax, eax
lea ecx, [eax + eax + 2]
push ecx
push ebp
push 1
push 0
push str.SoftwareClassesSumatraPDF_shellprinttocommand
push esi
call edi
cmp byte [esp + 0xb], 0
je 0x421209
push 0x16
push 0x9233f0
push 1
push 0
push str.SoftwareClasses.pdf
push esi
call edi
push 2
push 0x923408
push 1
push 0x9233f0
push str.SoftwareClasses.pdfOpenWithProgids
push esi
call edi
cmp esi, 0x80000001
jne 0x421209
push str.Progid
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
push esi
mov edx, 0x9233f0
call fcn.00450ff0
add esp, 0xc
push str.Application
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, esi
call fcn.00451040
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push ebp
call fcn.00658a01
mov edx, dword [esp + 0x14]
push edx
call fcn.00658a01
mov eax, dword [esp + 0x14]
push eax
call fcn.00658a01
mov ecx, dword [esp + 0x228]
add esp, 0xc
pop edi
pop ebp
xor ecx, esp
call fcn.0065865c
add esp, 0x218
ret