Function at 0x4dbf80
Capabilities:
Initialize winsock library
Persist via default file association registry key
Set registry value

Disassembly:
sub esp, 0xc68
push ebx
lea eax, [esp + 0x3bc]
push esi
push eax
call fcn.004d2c60
push 0xce8
call fcn.0052b380
xor ebx, ebx
add esp, 8
cmp eax, ebx
je 0x4dbfbe
lea ecx, [esp + 0x3c0]
push ecx
mov ecx, eax
call fcn.004da3b0
mov dword [0x564708], eax
jmp 0x4dbfc4
mov dword [0x564708], ebx
mov esi, dword [esp + 0xc74]
lea edx, [esp + 0x230]
push edx
push 0x202
mov dword [0x56470c], esi
call sub.WSOCK32.dll_WSAStartup
cmp dword [esp + 0xc78], ebx
jne 0x4dbffc
mov ecx, dword [0x564708]
push esi
call fcn.004dbef0
test eax, eax
je 0x4dc01c
mov eax, dword [esp + 0xc7c]
mov ecx, dword [esp + 0xc80]
push eax
push ecx
mov ecx, dword [0x564708]
push esi
call fcn.004dadc0
test eax, eax
jne 0x4dc029
pop esi
xor eax, eax
pop ebx
add esp, 0xc68
ret 0x10
mov edx, dword [0x564708]
cmp dword [edx + 0xc9c], ebx
push ebp
push edi
jne 0x4dc217
push 0x104
lea eax, [esp + 0x138]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [esp + 0x30], 0x22
xor eax, eax
jmp 0x4dc060
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x31], cl
inc eax
cmp cl, bl
jne 0x4dc060
lea edi, [esp + 0x30]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4dc075
mov ecx, dword [str.___1]
mov dl, byte [0x5491f8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [esp + 0x30]
mov dword [edi], ecx
push eax
mov byte [edi + 4], dl
mov dword [esp + 0x14], 0x114
mov byte [esp + 0x23c], bl
call esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push eax
lea ecx, [esp + 0x34]
push ecx
push 1
push str.ShockwaveFlash.ShockwaveFlash_shellopencommand
push 0x80000000
call ebp
xor eax, eax
jmp 0x4dc0d0
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x30], cl
inc eax
cmp cl, bl
jne 0x4dc0d0
lea edi, [esp + 0x30]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4dc0e5
mov edx, dword [str.__608]
mov ax, word [0x5491bc]
push ebx
push 1
lea ecx, [esp + 0x38]
push ecx
mov dword [edi], edx
push str.ShockwaveFlash.ShockwaveFlashDefaultIcon
push 0x80000000
mov word [edi + 4], ax
call fcn.004d9e50
push ebx
push 1
push str.ShockwaveFlash.ShockwaveFlash
push 0x53ebf4
push 0x80000000
call fcn.004d9e50
push ebx
push 1
push str.ShockwaveFlash.ShockwaveFlash
push str..spl
push 0x80000000
call fcn.004d9e50
add esp, 0x3c
mov byte [esp + 0x30], 0x22
xor eax, eax
mov edi, edi
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x31], cl
inc eax
cmp cl, bl
jne 0x4dc150
lea edi, [esp + 0x30]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4dc165
mov edx, dword [str.___1]
mov al, byte [0x5491f8]
lea ecx, [esp + 0x30]
mov dword [edi], edx
push ecx
mov byte [edi + 4], al
mov dword [esp + 0x14], 0x114
mov byte [esp + 0x23c], bl
call esi
push eax
lea edx, [esp + 0x34]
push edx
push 1
push str.FlashVideo.FlashVideo_shellopencommand
push 0x80000000
call ebp
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x134]
mov byte [esp + eax + 0x30], cl
inc eax
cmp cl, bl
jne 0x4dc1b0
lea edi, [esp + 0x30]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4dc1c5
mov eax, dword [str.__202]
mov cx, word [0x549134]
push ebx
push 1
lea edx, [esp + 0x38]
push edx
mov dword [edi], eax
push str.FlashVideo.FlashVideoDefaultIcon
push 0x80000000
mov word [edi + 4], cx
call fcn.004d9e50
push ebx
push 1
push str.FlashVideo.FlashVideo
push str..flv
push 0x80000000
call fcn.004d9e50
mov esi, dword [esp + 0xca4]
add esp, 0x28
push 0x25a
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push ebx
push ebx
mov esi, eax
push ebx
lea eax, [esp + 0x20]
push eax
call edi
test eax, eax
je 0x4dc283
mov ebp, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
nop
mov ecx, dword [0x564708]
cmp dword [ecx + 0xce4], ebx
jne 0x4dc25f
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x14]
push edx
push esi
push eax
call ebp
test eax, eax
jne 0x4dc275
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
lea eax, [esp + 0x20]
push eax
call edi
test eax, eax
jne 0x4dc240
mov esi, dword [0x564708]
cmp esi, ebx
pop edi
pop ebp
je 0x4dc2d6
mov edx, dword [esi + 0x18]
lea ecx, [esi + 0xca8]
push ecx
push edx
call fcn.004d4b90
mov ax, word [esi + 0xca0]
add esp, 8
cmp ax, bx
je 0x4dc2c6
mov ecx, dword [esi + 0xcd8]
movzx edx, ax
push ecx
push edx
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov word [esi + 0xca0], bx
mov ecx, esi
call fcn.004d5460
push esi
call fcn.00439d00
add esp, 4
lea eax, [esp + 0x3c0]
push eax
mov dword [0x564708], ebx
call fcn.004d2a30
add esp, 4
call sub.WSOCK32.dll_WSACleanup
mov eax, dword [esp + 0x14]
pop esi
pop ebx
add esp, 0xc68
ret 0x10