Function at 0x45acfa
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push 0x13c
mov eax, 0x531f87
call fcn.004e49d2
and dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
and dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
call fcn.00459e3a
test al, al
jne 0x45ad30
xor bl, bl
jmp 0x45af58
mov edi, 0x5ea290
lea ecx, [ebp - 0x134]
mov esi, str.SOFTWAREClasses_
push edi
mov edx, esi
call fcn.004524ee
pop ecx
mov ebx, 0x5aeae4
mov byte [ebp - 4], 1
push ebx
lea ecx, [ebp - 0x11c]
call fcn.00426582
push edi
mov edx, str.URL:
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x104]
call fcn.004524ee
push edi
mov edx, esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xec]
call fcn.004524ee
pop ecx
pop ecx
push str.URL_Protocol
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 4
call fcn.00426582
push ebx
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 5
call fcn.00426582
push edi
mov edx, esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x44]
call fcn.004524ee
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xa4]
mov edx, eax
mov dword [esp], str._shellopencommand
call fcn.004250a2
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
call fcn.00427ba9
push ebx
lea ecx, [ebp - 0x8c]
call fcn.00426582
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
push eax
mov edx, 0x5af82c
lea ecx, [ebp - 0x5c]
call fcn.004524ee
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x74]
mov edx, eax
mov dword [esp], str._______1_
call fcn.004250a2
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0x5c]
push ebx
push 1
call fcn.00427ba9
mov byte [ebp - 4], 0xc
mov byte [ebp - 0x138], bl
lea eax, [ebp - 0x5c]
push dword [ebp - 0x138]
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x148], ebx
push eax
lea eax, [ebp - 0x134]
mov dword [ebp - 0x144], ebx
push eax
mov dword [ebp - 0x140], ebx
call fcn.0045d561
push fcn.0045afd0
push 3
push 0x48
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 0xe
push eax
call fcn.004e42b8
mov esi, dword [ebp - 0x148]
cmp esi, dword [ebp - 0x144]
je 0x45af4b
lea ebx, [esi + 0x2c]
xor edx, edx
cmp dword [ebx - 0x18], 8
mov dword [ebp - 0x13c], edx
jb 0x45ae9f
mov eax, dword [esi]
jmp 0x45aea1
mov eax, esi
push edx
lea ecx, [ebp - 0x13c]
push ecx
push edx
push 0x20006
push edx
push edx
push edx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x45afae
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x138]
call fcn.0041ffcf
add esp, 4
mov byte [ebp - 4], 0xf
cmp dword [ebx + 0x18], 8
mov eax, dword [ebx + 0x14]
jb 0x45aeec
mov edx, dword [ebx + 4]
jmp 0x45aeef
lea edx, [ebx + 4]
cmp dword [ebx], 8
jb 0x45aef9
mov ecx, dword [ebx - 0x14]
jmp 0x45aefc
lea ecx, [ebx - 0x14]
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push ecx
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x45af6c
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x138]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
add esi, 0x48
add ebx, 0x48
cmp esi, dword [ebp - 0x144]
jne 0x45ae8d
mov bl, 1
lea ecx, [ebp - 0x148]
call fcn.0045cefe
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00427ba9
mov al, bl
call fcn.004e497c
ret
add esi, 0x18
cmp dword [esi + 0x14], 8
jb 0x45af77
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryProtocolHandler
push str._s:_RegSetValueExW_failed_for__hs_with_code__ld
push 1
push 0
call fcn.0043a0a0
add esp, 0x18
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x138]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor bl, bl
jmp 0x45af4d
cmp dword [esi + 0x14], 8
jb 0x45afb6
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryProtocolHandler
push str._s:_RegCreateKeyEx_failed_for__hs_with_code__ld
push 1
push 0
call fcn.0043a0a0
add esp, 0x18
jmp 0x45afaa