Function at 0x631fc143
Capabilities:
Contain obfuscated stackstrings
Delete registry key
Delete registry value
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1458
call fcn.6337fa50
sub esp, eax
call fcn.631fa762
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], str.CoD4X.CallofDuty4X.1
mov dword [ebp - 0x142f], 0x63494f65
mov word [ebp - 0x142b], 0x5f5c
mov byte [ebp - 0x1429], 0
mov dword [ebp - 0xc], 0
jmp 0x631fc1b6
lea edx, [ebp - 0x142f]
mov eax, dword [ebp - 0xc]
add eax, edx
movzx eax, byte [eax]
xor eax, 0x2c
mov ecx, eax
lea edx, [ebp - 0x142f]
mov eax, dword [ebp - 0xc]
add eax, edx
mov byte [eax], cl
add dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 5
jle 0x631fc192
cmp dword [ebp - 0x14], 4
jle 0x631fc7f3
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareClasses.dm_1
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call eax
sub esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x631fc208
mov dword [esp + 4], str.Couldnt_update_the_registry_with_extension_.dm_1
mov dword [esp], 0x10
call fcn.631a9970
jmp 0x631fc7f7
mov dword [ebp - 0x20], 0x400
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0xc28]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x633d6b2b
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x631fc363
lea eax, [ebp - 0x142f]
mov dword [esp + 4], eax
lea eax, [ebp - 0xc28]
mov dword [esp], eax
call sub.msvcr100.dll_strstr
test eax, eax
je 0x631fc363
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call eax
sub esp, 8
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareClasses
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call eax
sub esp, 0xc
test eax, eax
jne 0x631fc363
lea eax, [ebp - 0xc28]
mov dword [esp + 4], eax
mov dword [esp], str._s_shellopencommand
call fcn.631e0ef5
mov edx, eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
lea eax, [ebp - 0xc28]
mov dword [esp + 4], eax
mov dword [esp], str._s_shellopen
call fcn.631e0ef5
mov edx, eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
lea eax, [ebp - 0xc28]
mov dword [esp + 4], eax
mov dword [esp], str._s_shell
call fcn.631e0ef5
mov edx, eax
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0xc28]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call eax
sub esp, 8
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0xc28]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x633d6b2b
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x631fc3b4
movzx eax, byte [ebp - 0xc28]
test al, al
jne 0x631fc46d
mov dword [ebp - 0x20], 0x400
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0xc28]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x633d6b2b
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
jne 0x631fc444
movzx eax, byte [ebp - 0xc28]
test al, al
jne 0x631fc46d
mov dword [esp + 4], str.Couldnt_update_the_registry_with_extension_.dm_1
mov dword [esp], 0x10
call fcn.631a9970
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
jmp 0x631fc7f7
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0xc28]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x633d700c
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x1028]
mov dword [esp], eax
call fcn.631e0da0
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1028]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
call eax
sub esp, 0xc
test eax, eax
jne 0x631fc507
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
lea eax, [ebp - 0xc28]
mov dword [esp], eax
call fcn.631e065e
test eax, eax
jne 0x631fc7f6
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_0
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x828]
mov dword [esp], eax
call fcn.631e0da0
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1028]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call eax
sub esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x631fc570
mov dword [esp + 4], str.Couldnt_update_the_registry_with_extension_.dm_1
mov dword [esp], 0x10
call fcn.631a9970
jmp 0x631fc7f7
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x10], 0x633d68c8
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0xc28]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0xc28]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.CurVer
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
lea eax, [ebp - 0x828]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
lea edx, [eax + 1]
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x828]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x633d7027
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
lea eax, [ebp - 0x1028]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str._s_shellopencommand
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x1428]
mov dword [esp], eax
call fcn.631e0da0
lea eax, [ebp - 0x24]
mov dword [esp + 8], eax
lea eax, [ebp - 0x1428]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
call eax
sub esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x631fc6b2
mov dword [esp + 4], str.Couldnt_update_the_registry_with_extension_.dm_1
mov dword [esp], 0x10
call fcn.631a9970
jmp 0x631fc7f7
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.__s__demo____1__fullpath
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x428]
mov dword [esp], eax
call fcn.631e0da0
mov dword [ebp - 0x20], 0x400
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0xc28]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x633d6b2b
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
jne 0x631fc75e
lea eax, [ebp - 0x428]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
mov dword [esp + 8], eax
lea eax, [ebp - 0x428]
mov dword [esp + 4], eax
lea eax, [ebp - 0xc28]
mov dword [esp], eax
call fcn.631e065e
test eax, eax
jne 0x631fc75e
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
jmp 0x631fc7f7
lea eax, [ebp - 0x428]
mov dword [esp], eax
call sub.msvcr100.dll_strlen
mov edx, eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x428]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x8000000
mov eax, dword [sym.imp.SHELL32.dll_SHChangeNotify]
call eax
sub esp, 0x10
mov dword [esp + 4], str.Updated_demo_file_association_record_n
mov dword [esp], 0x10
call fcn.631a9790
jmp 0x631fc7f7
nop
jmp 0x631fc7f7
nop
leave
ret