Function at 0x460d40
Capabilities:
Check os version
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbc7f
mov eax, dword fs:[0]
push eax
sub esp, 0x458
mov eax, dword [0x5603e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x460], eax
cmp dword [ebp + 8], ebx
je 0x461174
xor esi, esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
push ebx
mov dword [ebp - 4], ebx
call fcn.0043b220
add esp, 4
lea ecx, [ebp - 0x464]
push ecx
lea edx, [ebp - 0x45c]
push edx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str..mobi
push eax
mov dword [ebp - 0x45c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x460ddb
mov esi, dword [ebp - 0x45c]
mov dword [ebp - 0x458], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x4c79ac
push esi
call edi
push 0x4db740
push esi
call edi
cmp esi, ebx
je 0x460e04
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x454], ebx
call fcn.00433290
lea ecx, [ebp - 0x464]
push ecx
lea edx, [ebp - 0x45c]
push edx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SoftwareClasses.mobi
push eax
mov dword [ebp - 0x45c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x460e4d
cmp esi, ebx
je 0x460e47
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x45c]
push 0x4c79ac
push esi
call edi
push 0x4db740
push esi
call edi
cmp esi, ebx
je 0x460e68
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
push 0x2001f
push str..mobi
push ebx
mov dword [ebp - 4], 1
call fcn.0043b220
add esp, 4
push eax
lea ecx, [ebp - 0x458]
call fcn.00412570
test eax, eax
je 0x460ec0
lea eax, [ebp - 0x458]
push eax
push str..mobi
push ebx
call fcn.0043b220
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.application_mobi
call edi
mov edx, dword [ebp - 0x458]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [eax + eax + 2]
push ecx
push str.application_mobi
push 1
push ebx
push 0x4c79ac
push edx
call esi
push str.application_mobi
call edi
mov ecx, dword [ebp - 0x458]
lea eax, [eax + eax + 2]
push eax
push str.application_mobi
push 1
push ebx
push 0x4db740
push ecx
call esi
mov eax, dword [ebp - 0x458]
cmp eax, ebx
je 0x460f27
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x458], ebx
push 0x2001f
push str.SoftwareClasses.mobi
mov dword [ebp - 0x454], ebx
call fcn.00433290
push eax
lea ecx, [ebp - 0x458]
call fcn.00412570
test eax, eax
je 0x460f64
lea edx, [ebp - 0x458]
push edx
push str.SoftwareClasses.mobi
call fcn.00433290
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test byte [0x56122c], 1
jne 0x460f9c
or dword [0x56122c], 1
push 0x110
push ebx
push 0x56111c
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x561118
mov dword [0x561118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x56111c], 6
jae 0x460fd6
mov eax, dword [ebp - 0x460]
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
je 0x460ff8
push eax
call edi
mov ecx, dword [ebp - 0x460]
mov edx, dword [ebp - 0x458]
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x4c79ac
push edx
jmp 0x460ff6
push str.application_mobi
call edi
mov ecx, dword [ebp - 0x458]
lea eax, [eax + eax + 2]
push eax
push str.application_mobi
push 1
push ebx
push 0x4c79ac
push ecx
call esi
push str.application_mobi
call edi
lea edx, [eax + eax + 2]
mov eax, dword [ebp - 0x458]
push edx
push str.application_mobi
push 1
push ebx
push 0x4db740
push eax
call esi
mov eax, dword [ebp - 0x458]
cmp eax, ebx
je 0x46102b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
mov eax, dword [ebp - 0x460]
xor ecx, ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x434], 7
mov dword [ebp - 0x438], ebx
mov word [ebp - 0x448], cx
lea edx, [eax + 2]
jmp 0x461070
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x461070
sub eax, edx
mov edx, dword [ebp - 0x460]
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x448]
call fcn.00405660
push str.DefaultIcon
lea eax, [ebp - 0x448]
push eax
lea ecx, [ebp - 0x42c]
push ecx
mov byte [ebp - 4], 3
call fcn.0040ca00
add esp, 0xc
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 4
jb 0x4610c5
mov edx, dword [eax]
mov dword [ebp - 0x45c], edx
jmp 0x4610cb
mov dword [ebp - 0x45c], eax
push ebx
call fcn.0043b220
add esp, 4
lea ecx, [ebp - 0x45c]
push ecx
mov ecx, dword [ebp - 0x45c]
lea edx, [ebp - 0x464]
push edx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push ecx
push eax
mov dword [ebp - 0x464], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x46110d
mov esi, dword [ebp - 0x464]
xor eax, eax
cmp eax, ebx
setne byte [ebp - 0x449]
cmp dword [ebp - 0x418], 8
jb 0x46112c
mov edx, dword [ebp - 0x42c]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
cmp dword [ebp - 0x434], 8
mov dword [ebp - 0x418], 7
mov dword [ebp - 0x41c], ebx
mov word [ebp - 0x42c], ax
mov byte [ebp - 4], 2
jb 0x461161
mov ecx, dword [ebp - 0x448]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [ebp - 0x449], bl
je 0x46117b
cmp esi, ebx
je 0x461174
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4614ff
push 0x104
lea edx, [ebp - 0x218]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.wpsofficeicon.dll
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x4dd0ac
lea edx, [ebp - 0x218]
push 0x104
push edx
call dword [sym.imp.MSVCR100.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call edi
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x218]
push edx
push 1
push ebx
push 0x4c79ac
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, ebx
je 0x4611f6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
mov esi, dword [ebp - 0x460]
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push esi
push ebx
mov dword [ebp - 4], 5
call fcn.0043b220
add esp, 4
push eax
lea ecx, [ebp - 0x458]
call fcn.004174b0
test eax, eax
je 0x461250
mov eax, dword [ebp - 0x458]
cmp eax, ebx
je 0x461249
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4614ff
push str.MOBI
call edi
mov edi, dword [ebp - 0x458]
lea eax, [eax + eax + 2]
push eax
push str.MOBI
push 1
push ebx
push 0x4c79ac
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp edi, ebx
je 0x461281
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
push esi
lea ecx, [ebp - 0x448]
mov dword [ebp - 4], 6
call fcn.00405cd0
push str._shellopen
push eax
lea ecx, [ebp - 0x42c]
push ecx
mov byte [ebp - 4], 7
call fcn.0040ca00
add esp, 0xc
mov edi, 8
mov byte [ebp - 4], 8
cmp dword [eax + 0x14], edi
jb 0x4612cf
mov eax, dword [eax]
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push eax
push ebx
call fcn.0043b220
add esp, 4
push eax
lea ecx, [ebp - 0x458]
call fcn.004174b0
test eax, eax
setne byte [ebp - 0x449]
cmp dword [ebp - 0x418], edi
jb 0x46130e
mov edx, dword [ebp - 0x42c]
push edx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
mov dword [ebp - 0x418], 7
mov dword [ebp - 0x41c], ebx
mov word [ebp - 0x42c], ax
mov byte [ebp - 4], 6
cmp dword [ebp - 0x434], edi
jb 0x461342
mov ecx, dword [ebp - 0x448]
push ecx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [ebp - 0x449], bl
jne 0x461238
push 1
push 0x4dd06c
push str.FriendlyAppName
lea ecx, [ebp - 0x458]
call fcn.004176b0
mov eax, dword [ebp - 0x458]
cmp eax, ebx
je 0x461376
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
push esi
lea ecx, [ebp - 0x448]
mov dword [ebp - 4], 9
call fcn.00405cd0
push str._shellopencommand
push eax
lea edx, [ebp - 0x42c]
push edx
mov byte [ebp - 4], 0xa
call fcn.0040ca00
add esp, 0xc
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x14], edi
jb 0x4613bf
mov eax, dword [eax]
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push eax
push ebx
call fcn.0043b220
add esp, 4
push eax
lea ecx, [ebp - 0x458]
call fcn.004174b0
test eax, eax
lea ecx, [ebp - 0x42c]
setne byte [ebp - 0x449]
call fcn.004a9f30
lea ecx, [ebp - 0x448]
mov byte [ebp - 4], 9
call fcn.004a9f30
cmp byte [ebp - 0x449], bl
je 0x46141b
lea ecx, [ebp - 0x458]
call fcn.00414440
xor eax, eax
jmp 0x4614ff
push 0x200
lea eax, [ebp - 0x410]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x410]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push 0x4c7da0
lea edx, [ebp - 0x410]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.SHLWAPI.dll_PathQuoteSpacesW]
push str.__prometheus__pdf___1_
lea ecx, [ebp - 0x410]
push 0x200
push ecx
call dword [sym.imp.MSVCR100.dll_wcscat_s]
add esp, 0xc
push 1
lea edx, [ebp - 0x410]
push edx
push 0x4c79ac
lea ecx, [ebp - 0x458]
call fcn.004176b0
lea ecx, [ebp - 0x458]
call fcn.00414440
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], ebx
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push str..mobiOpenWithProgids
push ebx
mov dword [ebp - 4], 0xc
call fcn.0043b220
add esp, 4
push eax
lea ecx, [ebp - 0x458]
call fcn.004174b0
lea ecx, [ebp - 0x458]
test eax, eax
jne 0x46140f
push 1
push 0x4c79ac
push esi
call fcn.004176b0
lea ecx, [ebp - 0x458]
call fcn.00414440
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b12f6
mov esp, ebp
pop ebp
ret