Function at 0x7d230340
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [0x7d2b730c]
sub esp, 0x30
push ebx
push ebp
push esi
push edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d230356
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 0x100]
push eax
call fcn.7d221505
mov ebx, eax
mov eax, 0x22
mov word [ebx], ax
lea esi, [ebx + 2]
mov edx, dword [0x7d2b7320]
movzx ecx, word [edx]
lea edx, [edx + 2]
mov word [esi], cx
lea esi, [esi + 2]
test cx, cx
jne 0x7d230385
lea edi, [ebx - 2]
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x7d2303a0
mov ecx, 0xd
mov esi, str.Start.exe__open_with___1_
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
movsw word es:[edi], word [esi]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x7d2303c0
push dword [0x7d2b60b0]
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x24]
push eax
call esi
lea eax, [esp + 0x20]
mov dword [esp + 0x28], 0x18
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 0x20019
lea eax, [esp + 0x24]
mov dword [esp + 0x34], 0
push eax
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call dword [sym.imp.ntdll.dll_NtOpenKey]
test eax, eax
jne 0x7d2306fe
push str.SOFTWAREClasses
lea eax, [esp + 0x24]
push eax
call esi
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 0xf003f
lea eax, [esp + 0x1c]
mov dword [esp + 0x30], 0x18
push eax
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call fcn.7d2211a4
mov edi, dword [sym.imp.ntdll.dll_NtClose]
test eax, eax
jne 0x7d2306f8
push str.Undecided_shellopencommand
lea eax, [esp + 0x24]
push eax
call esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 0xf003f
lea eax, [esp + 0x18]
mov dword [esp + 0x30], 0x18
push eax
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call fcn.7d2211a4
mov ebp, dword [sym.imp.ntdll.dll_NtSetValueKey]
test eax, eax
jne 0x7d230533
push 0x7d2990cc
lea eax, [esp + 0x24]
push eax
call esi
push dword [esp + 0x18]
lea eax, [esp + 0x24]
push ebx
push 1
push 0
push eax
push dword [esp + 0x24]
call ebp
push str.DelegateExecute
lea eax, [esp + 0x24]
push eax
call esi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [esp + 0x10]
call edi
push str.Unknown_shellOpencommand
lea eax, [esp + 0x24]
push eax
call esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 0xf003f
lea eax, [esp + 0x18]
mov dword [esp + 0x30], 0x18
push eax
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call fcn.7d2211a4
test eax, eax
jne 0x7d2305c8
push 0x7d2990cc
lea eax, [esp + 0x24]
push eax
call esi
push dword [esp + 0x18]
lea eax, [esp + 0x24]
push ebx
push 1
push 0
push eax
push dword [esp + 0x24]
call ebp
push str.DelegateExecute
lea eax, [esp + 0x24]
push eax
call esi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [esp + 0x10]
call edi
push str.Unknown_shellopenascommand
lea eax, [esp + 0x24]
push eax
call esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 0xf003f
lea eax, [esp + 0x18]
mov dword [esp + 0x30], 0x18
push eax
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call fcn.7d2211a4
test eax, eax
jne 0x7d23065d
push 0x7d2990cc
lea eax, [esp + 0x24]
push eax
call esi
push dword [esp + 0x18]
lea eax, [esp + 0x24]
push ebx
push 1
push 0
push eax
push dword [esp + 0x24]
call ebp
push str.DelegateExecute
lea eax, [esp + 0x24]
push eax
call esi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [esp + 0x10]
call edi
push str.Unknown_shellOpenWithSetDefaultOncommand
lea eax, [esp + 0x24]
push eax
call esi
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x28]
push eax
push 0xf003f
lea eax, [esp + 0x18]
mov dword [esp + 0x30], 0x18
push eax
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
call fcn.7d2211a4
test eax, eax
jne 0x7d2306f2
push 0x7d2990cc
lea eax, [esp + 0x24]
push eax
call esi
push dword [esp + 0x18]
lea eax, [esp + 0x24]
push ebx
push 1
push 0
push eax
push dword [esp + 0x24]
call ebp
push str.DelegateExecute
lea eax, [esp + 0x24]
push eax
call esi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
push dword [esp + 0x10]
call edi
push dword [esp + 0x14]
call edi
push dword [esp + 0x1c]
call edi
push ebx
call fcn.7d221537
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret