Function at 0x519460
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
mov ecx, dword [0x5f92e8]
sub esp, 0x4f4
push 0x104
lea eax, [esp + 0x3f4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x5bfd7c]
test eax, eax
je 0x5194ff
lea edx, [esp + 0x3f0]
mov ecx, str.DisplayIcon
call fcn.00553170
mov edx, 0x5a4840
mov ecx, str.DisplayName
call fcn.00553170
mov edx, 0x5eeea1
mov ecx, str.DisplayVersion
call fcn.00553170
mov edx, str.mIRC_Co._Ltd.
mov ecx, str.Publisher
call fcn.00553170
lea edx, [esp + 0x3f0]
push edx
lea eax, [esp + 0xc]
push str.__s___uninstall
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 8]
mov ecx, str.UninstallString
call fcn.00553170
mov edx, str.http:__www.mirc.com
mov ecx, str.URLUpdateInfo
call fcn.00553170
mov eax, dword [0x5bfe80]
test eax, eax
jne 0x519519
call fcn.00553290
mov eax, 1
add esp, 0x4f4
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0x10]
push ecx
push str..cha
push bind
call edi
test eax, eax
je 0x519545
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4f4
ret
mov eax, dword [0x5ac1a8]
mov edx, dword [str.ChatFile]
mov cl, byte [0x5ac1ac]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
mov byte [esp + 0x20], cl
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519570
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x5a5eb4
push eax
call ebx
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x519538
lea edx, [esp + 0x10]
push edx
push str..chat
push bind
call edi
test eax, eax
jne 0x519538
mov eax, dword [str.ChatFile]
mov dl, byte [0x5ac1ac]
mov ecx, dword [0x5ac1a8]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x20], dl
mov dword [esp + 0x1c], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5195e4
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0x5a5eb4
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebp
test esi, esi
jne 0x519538
mov eax, dword [str.ChatFile]
mov ecx, dword [0x5ac1a8]
mov dl, byte [0x5ac1ac]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x1c]
push ecx
push bind
mov byte [esp + 0x2c], dl
call edi
test eax, eax
jne 0x519538
mov eax, dword [0x5ac19c]
mov edx, dword [str.Chat_File]
mov cx, word [0x5ac1a0]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
mov word [esp + 0x20], cx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519670
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x5a5eb4
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x519538
mov ecx, 5
mov esi, str.ChatFileDefaultIcon
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x519538
lea ecx, [esp + 0x400]
push ecx
lea edx, [esp + 0x1c]
push 0x5a5a30
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5196f0
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0x5a5eb4
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebp
test esi, esi
jne 0x519538
mov ecx, 7
mov esi, str.ChatFileShellopencommand
lea edi, [esp + 0x18]
lea eax, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x1c]
push ecx
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x519538
lea edx, [esp + 0x400]
push edx
lea eax, [esp + 0x1c]
push str.__s___noconnect
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519770
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0x5a5eb4
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call ebp
test esi, esi
jne 0x519538
mov ecx, 7
mov esi, str.ChatFileShellopenddeexec
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x519538
mov ax, word [0x5ac128]
mov cl, byte [0x5ac12a]
mov word [esp + 0x18], ax
lea eax, [esp + 0x18]
mov byte [esp + 0x1a], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5197e8
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x5a5eb4
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x519538
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, 0xa
mov esi, str.ChatFileShellopenddeexecApplication
lea edi, [esp + 0x20]
push bind
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x519538
mov cl, byte [eax + 0x5bf990]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x519844
mov al, byte [esp + 0x18]
test al, al
jne 0x51986f
mov ecx, dword [0x5a4840]
mov dl, byte [0x5a4844]
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519876
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0x5a5eb4
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebp
test esi, esi
jne 0x519538
mov ecx, 8
mov esi, str.ChatFileShellopenddeexecifexec
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x10]
push eax
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x1c]
push ecx
push bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x519538
mov al, byte [0x5ac12a]
mov dx, word [0x5ac128]
mov byte [esp + 0x1a], al
lea eax, [esp + 0x18]
mov word [esp + 0x18], dx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5198f1
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0x5a5eb4
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call ebp
test esi, esi
jne 0x519538
mov ecx, 8
mov esi, str.ChatFileShellopenddeexecTopic
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push bind
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x519538
mov eax, dword [str.Connect]
mov ecx, dword [0x5ac0ac]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], ecx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519970
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x5a5eb4
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x519538
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push esi
push 0x20006
push esi
push 0x5a5eb4
push esi
push str.SoftwareClassesirc
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x519538
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x18]
push str.URL:IRC_Protocol
push ecx
call edi
lea eax, [esp + 0x20]
add esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5199f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x519538
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 3
push eax
push str.EditFlags
push edx
mov dword [esp + 0x2c], 2
call esi
test eax, eax
jne 0x519538
lea eax, [esp + 0x18]
push 0x5a5eb4
push eax
call edi
lea eax, [esp + 0x20]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519a57
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push str.URL_Protocol
push edx
call esi
test eax, eax
jne 0x519538
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0x5a5eb4
push 0
push str.SoftwareClassesircDefaultIcon
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x519538
lea eax, [esp + 0x400]
push eax
lea ecx, [esp + 0x1c]
push 0x5a5a30
push ecx
call edi
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519ad2
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x519538
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0x5a5eb4
push 0
push str.SoftwareClassesircShellopencommand
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x519538
lea ecx, [esp + 0x400]
push ecx
lea edx, [esp + 0x1c]
push str.__s___noconnect
push edx
call edi
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519b50
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
jne 0x519538
mov edx, dword [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0x5a5eb4
push 0
push str.SoftwareClassesircShellopenddeexec
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x519538
mov al, byte [0x5ac12a]
mov dx, word [0x5ac128]
mov byte [esp + 0x1a], al
lea eax, [esp + 0x18]
mov word [esp + 0x18], dx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519bc6
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x519538
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0x5a5eb4
push 0
push str.SoftwareClassesircShellopenddeexecApplication
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x519538
mov cl, byte [eax + 0x5bf990]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x519c20
mov al, byte [esp + 0x18]
test al, al
jne 0x519c4a
mov eax, dword [0x5a4840]
mov cl, byte [0x5a4844]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519c51
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x519538
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0x5a5eb4
push 0
push str.SoftwareClassesircShellopenddeexecifexec
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x519538
mov dl, byte [0x5ac12a]
mov cx, word [0x5ac128]
lea eax, [esp + 0x18]
mov byte [esp + 0x1a], dl
mov word [esp + 0x18], cx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519cc8
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
jne 0x519538
mov edx, dword [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0x5a5eb4
push 0
push str.SoftwareClassesircShellopenddeexecTopic
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x519538
mov eax, dword [0x5ac0ac]
mov edx, dword [str.Connect]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x519d40
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x519538
mov eax, dword [esp + 0x10]
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4f4
ret