Function at 0x414750
Capabilities:
Check if file exists
Delete registry key
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x576b00
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x5c4104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 1
call fcn.00406e20
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x41479e
push 0x80004005
call fcn.004071e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4147b3
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4147b5
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov eax, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [eax - 0xc], 0
je 0x41481c
lea edx, [eax - 0x10]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x414884
cmp dword [ecx + 0xc], 0
jl 0x41480e
mov edx, dword [edx]
cmp edx, dword [ecx]
jne 0x41480e
push dword [ebp - 0x28]
call fcn.00405650
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov esi, eax
call fcn.00407070
add esi, 0x10
mov dword [ebp - 0x14], esi
jmp 0x414884
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
push eax
call fcn.00405730
jmp 0x414881
lea ecx, [ebp - 0x28]
call fcn.0040c530
push str.MasterPDF
mov byte [ebp - 4], 3
push dword [eax]
lea eax, [ebp - 0x14]
push str._s_s.exe
push eax
call fcn.0041f560
mov byte [ebp - 4], 2
add esp, 0x10
mov ecx, dword [ebp - 0x28]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414881
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x41487d
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41487d
push 0
push dword [edx + 4]
call ebx
jmp 0x414881
mov ecx, edx
call esi
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414897
mov dword [ebp - 0x28], eax
jmp 0x414e9f
push str.MasterPDF
lea ecx, [ebp - 0x34]
call fcn.00404e80
push str._2d3d
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24]
call fcn.0041bc20
lea eax, [ebp - 0x24]
mov byte [ebp - 4], 5
push eax
mov edx, str.SoftwareClasses_
lea ecx, [ebp - 0x20]
call fcn.0041bb30
add esp, 8
push str.2D_3D_Document
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.00404e80
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x30]
mov edx, eax
lea ebx, [edx + 2]
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4148f0
sub edx, ebx
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00406e20
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x414930
push 0x80004005
call fcn.004071e0
mov eax, dword [edx]
mov ebx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414945
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x414949
mov ecx, edx
call ebx
add eax, 0x10
mov dword [ebp - 0x1c], eax
push esi
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 8
push str._s_2
push eax
call fcn.0041f560
push str.DefaultIcon
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0041bc20
mov ebx, dword [ebp - 0x1c]
add esp, 0x10
mov ecx, ebx
mov edx, dword [eax]
lea eax, [ecx + 2]
mov dword [ebp - 0x28], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414982
sub ecx, dword [ebp - 0x28]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push 0
push edx
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x38]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4149fa
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4149f5
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4149ee
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x4149fa
mov ecx, edx
call dword [ebp - 0x28]
jmp 0x4149fa
mov ecx, edx
call dword [ebp - 0x28]
push str._shell
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0041bc20
add esp, 4
push 8
push str.open
push 1
push 0
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x38]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414a64
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414a60
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414a60
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x414a64
mov ecx, edx
call edi
call fcn.00406e20
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x414a80
push 0x80004005
call fcn.004071e0
mov eax, dword [edx]
mov edi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414a95
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x414a99
mov ecx, edx
call edi
add eax, 0x10
mov dword [ebp - 0x28], eax
push esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 9
push str.__s___2d3d____1____
push eax
call fcn.0041f560
push str._shellopencommand
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x3c]
call fcn.0041bc20
mov edi, dword [ebp - 0x28]
add esp, 0x10
mov ecx, edi
mov edx, dword [eax]
lea eax, [ecx + 2]
mov dword [ebp - 0x38], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414ad2
sub ecx, dword [ebp - 0x38]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push 0
push edx
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x3c]
test eax, eax
sete byte [ebp - 0xd]
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414b51
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414b4c
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x38], edi
mov edi, dword [ebp - 0x28]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414b45
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x414b51
mov ecx, edx
call dword [ebp - 0x38]
jmp 0x414b51
mov ecx, edx
call dword [ebp - 0x38]
cmp byte [ebp - 0xd], 0
jne 0x414b63
mov dword [ebp - 0x28], 0
jmp 0x414c9e
lea eax, [ebp + 8]
mov edx, str.SoftwareClasses_
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041bb30
add esp, 4
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x24]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x3c], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x414b86
sub edx, dword [ebp - 0x3c]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x59f210
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
call fcn.0041bc20
add esp, 4
push 0
push 0x59af0c
push 1
push dword [ebp - 0x24]
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0x3c]
call fcn.00404e00
cmp dword [ebp - 0x18], 0x80000001
jne 0x414c8f
lea eax, [ebp + 8]
mov edx, str.ExplorerFileExts_
push eax
lea ecx, [ebp - 0x18]
call fcn.0041bb30
add esp, 4
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x24]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x3c], ecx
nop dword [eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x414c10
sub edx, dword [ebp - 0x3c]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push str.Progid
push dword [ebp - 0x18]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.Application
push dword [ebp - 0x18]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.UserChoice
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x38]
call fcn.0041bc20
add esp, 4
mov ecx, SysReAllocStringLen
mov eax, dword [eax]
mov edx, eax
mov dword [ebp - 0x3c], eax
call fcn.00411a50
push dword [ebp - 0x3c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [ebp - 0x38]
call fcn.00404e00
lea ecx, [ebp - 0x18]
call fcn.00404e00
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], 1
call fcn.00404e00
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414cf7
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414cf2
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414ceb
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x414cf7
mov ecx, edx
call dword [ebp - 0x3c]
jmp 0x414cf7
mov ecx, edx
call dword [ebp - 0x3c]
mov byte [ebp - 4], 7
add ebx, 0xfffffff0
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x414d39
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414d37
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414d37
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ecx + 4]
call ebx
jmp 0x414d3f
call edx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 6
mov eax, edi
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414d97
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414d91
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414d8a
push 0
push dword [edx + 4]
call ebx
jmp 0x414d97
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x414d97
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
mov byte [ebp - 4], 5
mov eax, edi
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414def
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414de9
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414de2
push 0
push dword [edx + 4]
call ebx
jmp 0x414def
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x414def
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
mov byte [ebp - 4], 4
mov eax, edi
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414e47
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414e41
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414e3a
push 0
push dword [edx + 4]
call ebx
jmp 0x414e47
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x414e47
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
mov byte [ebp - 4], 2
mov eax, edi
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414e9f
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414e99
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414e92
push 0
push dword [edx + 4]
call ebx
jmp 0x414e9f
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x414e9f
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x414edb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414ed9
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414ed9
push 0
push dword [ecx + 4]
call ebx
jmp 0x414edb
call edx
mov byte [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414f1c
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414f18
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414f18
push 0
push dword [edx + 4]
call ebx
jmp 0x414f1c
mov ecx, edx
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x414f5e
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414f5a
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414f5a
push 0
push dword [edx + 4]
call ebx
jmp 0x414f5e
mov ecx, edx
call esi
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret