Function at 0x474390
Capabilities:
Persist via com hijack
Persist via default file association registry key
Persist via explorer tools registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x479f30
mov eax, dword fs:[0]
push eax
sub esp, 0x7ac
mov eax, dword [0x49d7a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x7b8], ecx
mov eax, dword [0x48aeb4]
mov dword [ebp - 0x668], eax
mov ecx, dword [0x48aeb8]
mov dword [ebp - 0x664], ecx
mov edx, dword [0x48aebc]
mov dword [ebp - 0x660], edx
mov ecx, 0xb
mov esi, 0x48aec0
lea edi, [ebp - 0x454]
rep movsd dword es:[edi], dword [esi]
push 0x40
lea eax, [ebp - 0x7a4]
push eax
push 0x48bd10
call dword [sym.imp.ole32.dll_StringFromGUID2]
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x48aeec
push 0x4a247c
lea edx, [ebp - 0x718]
push edx
call fcn.00401e30
add esp, 0xc
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x724]
call fcn.00405650
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x718]
push eax
push str._s_0
lea ecx, [ebp - 0x724]
push ecx
call fcn.00401850
add esp, 0xc
lea ecx, [ebp - 0x720]
call fcn.00405650
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x718]
push edx
push str.__s___CommonStart_showtype1_pingbackid22_
lea eax, [ebp - 0x720]
push eax
call fcn.00401850
add esp, 0xc
mov dword [ebp - 0x10], 0x1104
mov dword [ebp - 0x714], SysReAllocString
mov dword [ebp - 0x710], 0x48af70
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 0x70c], ecx
mov dword [ebp - 0x708], 0
lea edx, [ebp - 0x668]
mov dword [ebp - 0x704], edx
mov dword [ebp - 0x700], 1
mov dword [ebp - 0x6fc], SysReAllocString
mov dword [ebp - 0x6f8], str.SoftwareClassesCLSID_s
lea eax, [ebp - 0x7a4]
mov dword [ebp - 0x6f4], eax
mov dword [ebp - 0x6f0], str.InfoTip
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x6ec], ecx
mov dword [ebp - 0x6e8], 1
mov dword [ebp - 0x6e4], SysReAllocString
mov dword [ebp - 0x6e0], 0x48afe8
lea edx, [ebp - 0x7a4]
mov dword [ebp - 0x6dc], edx
mov dword [ebp - 0x6d8], 0
mov dword [ebp - 0x6d4], 0x48b03c
mov dword [ebp - 0x6d0], 1
mov dword [ebp - 0x6cc], SysReAllocString
mov dword [ebp - 0x6c8], str.SoftwareClassesCLSID_sInprocServer32
lea eax, [ebp - 0x7a4]
mov dword [ebp - 0x6c4], eax
mov dword [ebp - 0x6c0], str.ThreadingModel
mov dword [ebp - 0x6bc], 0x48b0bc
mov dword [ebp - 0x6b8], 1
mov dword [ebp - 0x6b4], SysReAllocString
mov dword [ebp - 0x6b0], str.SoftwareClassesCLSID_sDefaultIcon
lea ecx, [ebp - 0x7a4]
mov dword [ebp - 0x6ac], ecx
mov dword [ebp - 0x6a8], 0
lea ecx, [ebp - 0x724]
call fcn.004047c0
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], 1
mov dword [ebp - 0x69c], SysReAllocString
mov dword [ebp - 0x698], str.SoftwareClassesCLSID_sShellOpenCommand
lea edx, [ebp - 0x7a4]
mov dword [ebp - 0x694], edx
mov dword [ebp - 0x690], 0
lea ecx, [ebp - 0x720]
call fcn.004047c0
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], 1
mov dword [ebp - 0x684], SysReAllocString
mov dword [ebp - 0x680], str.SoftwareClassesCLSID_sShellFolder
lea eax, [ebp - 0x7a4]
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x678], str.Attributes
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x674], ecx
mov dword [ebp - 0x670], 4
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x71c], 0
mov dword [ebp - 0x7a8], 0
jmp 0x47468d
mov edx, dword [ebp - 0x7a8]
add edx, 1
mov dword [ebp - 0x7a8], edx
cmp dword [ebp - 0x71c], 0
jl 0x47484a
cmp dword [ebp - 0x7a8], 7
jae 0x47484a
mov eax, dword [ebp - 0x7a8]
imul eax, eax, 0x18
mov ecx, dword [ebp + eax - 0x70c]
push ecx
mov edx, dword [ebp - 0x7a8]
imul edx, edx, 0x18
mov eax, dword [ebp + edx - 0x710]
push eax
push 0x104
lea ecx, [ebp - 0x65c]
push ecx
call fcn.00404740
add esp, 0x10
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 0
jl 0x474845
push 0
lea edx, [ebp - 0x428]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [ebp - 0x65c]
push eax
mov ecx, dword [ebp - 0x7a8]
imul ecx, ecx, 0x18
mov edx, dword [ebp + ecx - 0x714]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x7ac], eax
cmp dword [ebp - 0x7ac], 0
jne 0x47483b
mov eax, dword [ebp - 0x7a8]
imul eax, eax, 0x18
cmp dword [ebp + eax - 0x700], 1
jne 0x4747d5
lea ecx, [ebp - 0x21c]
push ecx
mov edx, dword [ebp - 0x7a8]
imul edx, edx, 0x18
mov eax, dword [ebp + edx - 0x704]
push eax
push 0x104
lea ecx, [ebp - 0x424]
push ecx
call fcn.00404740
add esp, 0x10
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 0
jl 0x4747d3
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x424]
push ecx
mov edx, dword [ebp - 0x7a8]
imul edx, edx, 0x18
mov eax, dword [ebp + edx - 0x700]
push eax
push 0
mov ecx, dword [ebp - 0x7a8]
imul ecx, ecx, 0x18
mov edx, dword [ebp + ecx - 0x708]
push edx
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x47482c
mov ecx, dword [ebp - 0x7a8]
imul ecx, ecx, 0x18
cmp dword [ebp + ecx - 0x700], 4
jne 0x47482c
push 4
mov edx, dword [ebp - 0x7a8]
imul edx, edx, 0x18
mov eax, dword [ebp + edx - 0x704]
push eax
mov ecx, dword [ebp - 0x7a8]
imul ecx, ecx, 0x18
mov edx, dword [ebp + ecx - 0x700]
push edx
push 0
mov eax, dword [ebp - 0x7a8]
imul eax, eax, 0x18
mov ecx, dword [ebp + eax - 0x708]
push ecx
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x428]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x474845
mov dword [ebp - 0x71c], 0x80040201
jmp 0x47467e
cmp dword [ebp - 0x71c], 0
jl 0x474933
mov dword [ebp - 0x71c], 0x80040201
lea ecx, [ebp - 0x7a4]
push ecx
push 0x48b1f8
push 0x104
lea edx, [ebp - 0x65c]
push edx
call fcn.00404740
add esp, 0x10
test eax, eax
jl 0x474933
push 0
lea eax, [ebp - 0x428]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [ebp - 0x65c]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x7b0], eax
cmp dword [ebp - 0x7b0], 0
jne 0x474933
lea edx, [ebp - 0x668]
push edx
push 0x104
lea eax, [ebp - 0x424]
push eax
call fcn.004046f0
mov dword [ebp - 0x71c], eax
cmp dword [ebp - 0x71c], 0
jl 0x474933
lea ecx, [ebp - 0x424]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x424]
push eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x428]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x7b0], eax
mov edx, dword [ebp - 0x428]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x11
mov ecx, dword [ebp - 0x7b8]
call fcn.00474070
cmp dword [ebp - 0x71c], 0
jge 0x474947
mov ecx, dword [ebp - 0x7b8]
call fcn.00474280
mov eax, dword [ebp - 0x71c]
mov dword [ebp - 0x7b4], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x720]
call fcn.00405670
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x724]
call fcn.00405670
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x718]
call fcn.00405670
mov eax, dword [ebp - 0x7b4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0043bd9a
mov esp, ebp
pop ebp
ret