Function at 0x4119c0
Capabilities:
Delete registry key
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x597f54]
xor eax, ebp
mov dword [ebp + 0x39c], eax
mov ecx, dword [ebp + 0x3ac]
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x70], ecx
mov ecx, dword [ebp + 0x3b0]
push esi
push edi
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp + 0x3b4]
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x80], ecx
mov ecx, dword [ebp + 0x3b8]
lea eax, [ebp + 0x19c]
push eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x68], 1
call ebx
push str.ContentType
lea eax, [ebp + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea eax, [ebp + 0x19c]
push eax
mov esi, SysReAllocString
push esi
call edi
push dword [ebp - 0x78]
push esi
call edi
push dword [ebp - 0x70]
lea eax, [ebp + 0x19c]
push eax
call ebx
push str._shellopencommand
lea eax, [ebp + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp + 0x19c]
push eax
push esi
call edi
lea eax, [ebp + 0x19c]
push 0x5c
push eax
call fcn.004e3860
pop ecx
xor ebx, ebx
pop ecx
mov byte [eax], bl
lea eax, [ebp + 0x19c]
push eax
push esi
call edi
lea eax, [ebp + 0x19c]
push 0x5c
push eax
call fcn.004e3860
pop ecx
pop ecx
mov byte [eax], bl
lea eax, [ebp + 0x19c]
push eax
push esi
call edi
lea eax, [ebp + 0x19c]
push 0x5c
push eax
call fcn.004e3860
pop ecx
pop ecx
mov byte [eax], bl
lea eax, [ebp + 0x19c]
push eax
push esi
call edi
cmp dword [ebp + 0x3bc], ebx
jne 0x411c5a
push ebx
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp - 0x78]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x411b3c
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc eax
push eax
push dword [ebp - 0x70]
push 1
push ebx
push ebx
push dword [ebp - 0x6c]
call edi
test eax, eax
jne 0x411b3c
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x74]
push 1
push ebx
push 0x52fe94
push dword [ebp - 0x6c]
call edi
test eax, eax
mov dword [ebp - 0x68], 1
je 0x411b3f
mov dword [ebp - 0x68], ebx
push dword [ebp - 0x6c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
cmp dword [ebp - 0x68], ebx
je 0x411b91
push ebx
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp - 0x70]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x411b91
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x7c]
push 1
push ebx
push ebx
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [ebp - 0x68], 1
je 0x411b94
mov dword [ebp - 0x68], ebx
push dword [ebp - 0x6c]
call edi
push dword [ebp - 0x70]
lea eax, [ebp + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._shellopencommand
lea eax, [ebp + 0x19c]
push eax
call edi
cmp dword [ebp - 0x68], ebx
je 0x411be7
push ebx
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp + 0x19c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x411be7
xor esi, esi
inc esi
jmp 0x411be9
xor esi, esi
push 0x52fa5c
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x80]
lea eax, [ebp - 0x64]
push eax
call edi
push str.____1_
lea eax, [ebp - 0x64]
push eax
call edi
cmp esi, ebx
je 0x411c36
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x64]
push eax
xor esi, esi
inc esi
push esi
push ebx
push ebx
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov dword [ebp - 0x68], esi
je 0x411c39
mov dword [ebp - 0x68], ebx
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x68], ebx
jne 0x411c5a
push 0x30
push str.Setup
push str.A_file_association_could_not_be_created._Contact_your_system_administrator_for_assistance.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp + 0x39c]
mov eax, dword [ebp - 0x68]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e2867
add ebp, 0x3a0
leave
ret