Function at 0x45a8d4
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push 0x13c
mov eax, 0x531abf
call fcn.004e4550
and dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
and dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
call fcn.00459a14
test al, al
jne 0x45a90a
xor bl, bl
jmp 0x45ab32
mov edi, 0x5e9290
lea ecx, [ebp - 0x134]
mov esi, str.SOFTWAREClasses_
push edi
mov edx, esi
call fcn.004520c8
pop ecx
mov ebx, 0x5ad5fc
mov byte [ebp - 4], 1
push ebx
lea ecx, [ebp - 0x11c]
call fcn.004261d3
push edi
mov edx, str.URL:
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x104]
call fcn.004520c8
push edi
mov edx, esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xec]
call fcn.004520c8
pop ecx
pop ecx
push str.URL_Protocol
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 4
call fcn.004261d3
push ebx
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 5
call fcn.004261d3
push edi
mov edx, esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x44]
call fcn.004520c8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xa4]
mov edx, eax
mov dword [esp], str._shellopencommand
call fcn.00424cf3
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
call fcn.004277fa
push ebx
lea ecx, [ebp - 0x8c]
call fcn.004261d3
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
push eax
mov edx, 0x5ae2ec
lea ecx, [ebp - 0x5c]
call fcn.004520c8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x74]
mov edx, eax
mov dword [esp], str._______1_
call fcn.00424cf3
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0x5c]
push ebx
push 1
call fcn.004277fa
mov byte [ebp - 4], 0xc
mov byte [ebp - 0x138], bl
lea eax, [ebp - 0x5c]
push dword [ebp - 0x138]
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x148], ebx
push eax
lea eax, [ebp - 0x134]
mov dword [ebp - 0x144], ebx
push eax
mov dword [ebp - 0x140], ebx
call fcn.0045d110
push fcn.0045abaa
push 3
push 0x48
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 0xe
push eax
call fcn.004e3e36
mov esi, dword [ebp - 0x148]
cmp esi, dword [ebp - 0x144]
je 0x45ab25
lea ebx, [esi + 0x2c]
xor edx, edx
cmp dword [ebx - 0x18], 8
mov dword [ebp - 0x13c], edx
jb 0x45aa79
mov eax, dword [esi]
jmp 0x45aa7b
mov eax, esi
push edx
lea ecx, [ebp - 0x13c]
push ecx
push edx
push 0x20006
push edx
push edx
push edx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x45ab88
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x138]
call fcn.0041fc3f
add esp, 4
mov byte [ebp - 4], 0xf
cmp dword [ebx + 0x18], 8
mov eax, dword [ebx + 0x14]
jb 0x45aac6
mov edx, dword [ebx + 4]
jmp 0x45aac9
lea edx, [ebx + 4]
cmp dword [ebx], 8
jb 0x45aad3
mov ecx, dword [ebx - 0x14]
jmp 0x45aad6
lea ecx, [ebx - 0x14]
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push ecx
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x45ab46
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x138]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
add esi, 0x48
add ebx, 0x48
cmp esi, dword [ebp - 0x144]
jne 0x45aa67
mov bl, 1
lea ecx, [ebp - 0x148]
call fcn.0045caad
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004277fa
mov al, bl
call fcn.004e44fa
ret
add esi, 0x18
cmp dword [esi + 0x14], 8
jb 0x45ab51
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryProtocolHandler
push str._s:_RegSetValueExW_failed_for__hs_with_code__ld
push 1
push 0
call fcn.00439ccd
add esp, 0x18
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x138]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor bl, bl
jmp 0x45ab27
cmp dword [esi + 0x14], 8
jb 0x45ab90
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryProtocolHandler
push str._s:_RegCreateKeyEx_failed_for__hs_with_code__ld
push 1
push 0
call fcn.00439ccd
add esp, 0x18
jmp 0x45ab84