Function at 0x509590
Capabilities:
Check os version
Get common file path
Persist via default file association registry key
Resolve function by parsing pe exports
Set registry value

Disassembly:
mov eax, 0x16bc
call fcn.006ab750
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x894]
push eax
call fcn.004c4840
push 0x6bc0cc
push str.debut.exe
lea ecx, [esp + 0xcac]
push ecx
lea eax, [esp + 0x8a0]
call fcn.004ad3a0
xor ebx, ebx
cmp dword [str.Crescendo], ebx
mov dword [esp + 0x14], ebx
je 0x50998c
xor esi, esi
mov dword [esp + 0x10], 0x732548
jmp 0x5095f0
cmp byte [esi + 0x732550], bl
jne 0x509968
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push eax
call fcn.00507ce0
test al, al
jne 0x509968
mov ebp, dword [esi + 0x73254c]
push ebp
push str.SoftwareClasses._s
mov esi, 0x104
lea edi, [esp + 0x7c]
call fcn.004af0d0
add esp, 8
lea ecx, [esp + 0x27c]
push ecx
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
cmp word [esp + 0x27c], bx
jne 0x50978d
lea edx, [esp + 0x27c]
push edx
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
cmp word [esp + 0x27c], bx
jne 0x50978d
push ebp
push str.softwaremicrosoftwindowscurrentversionexplorer_fileexts._suserchoice
lea edi, [esp + 0x12c4]
call fcn.004af0d0
add esp, 8
lea eax, [esp + 0x68c]
push eax
push 0x6bc0cc
push str.Progid
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
cmp word [esp + 0x68c], bx
je 0x509758
mov ecx, edi
push str.Applications_
push ecx
call fcn.0069c886
add esp, 8
test eax, eax
jne 0x509968
lea edx, [esp + 0x68c]
push edx
push str.SoftwareClasses_s
lea edi, [esp + 0x10bc]
call fcn.004af0d0
add esp, 8
lea eax, [esp + 0x20]
push eax
push 1
push ebx
mov ecx, edi
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x509719
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x509732
lea ecx, [esp + 0x10b4]
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00496570
test al, al
je 0x509968
xor eax, eax
jmp 0x509740
movzx ecx, word [esp + eax + 0x68c]
mov word [esp + eax + 0x27c], cx
add eax, 2
cmp cx, bx
jne 0x509740
cmp word [esp + 0x27c], bx
jne 0x50978d
push ebp
push str._sfile
mov esi, 0x104
lea edi, [esp + 0x284]
call fcn.004af0d0
add esp, 8
push ebx
push SysReAllocStringLen
mov esi, edi
lea edx, [esp + 0x7c]
call fcn.004af710
lea eax, [esp + 0x27c]
push eax
push str.SoftwareClasses_s
mov esi, 0x104
lea edi, [esp + 0x7c]
call fcn.004af0d0
add esp, 8
lea ecx, [esp + 0xa9c]
push ecx
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
cmp word [esp + 0xa9c], bx
jne 0x509805
lea edx, [esp + 0xa9c]
push edx
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
cmp word [esp + 0xa9c], bx
jne 0x509805
push ebx
push SysReAllocStringLen
mov esi, str.Unhandled_Extension_Handler_Finder
mov edx, edi
call fcn.004af710
lea eax, [esp + 0x74]
push eax
push str._s_shell
mov esi, 0x104
lea edi, [esp + 0x48c]
call fcn.004af0d0
add esp, 8
lea ecx, [esp + 0xa9c]
push ecx
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
cmp word [esp + 0xa9c], bx
jne 0x509968
lea edx, [esp + 0xa9c]
push edx
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
cmp word [esp + 0xa9c], bx
jne 0x509968
lea eax, [esp + 0x74]
push eax
push str._s_shellopen
lea edi, [esp + 0x89c]
call fcn.004af0d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 8
lea ecx, [esp + 0x1c]
push ecx
push 1
push ebx
mov edx, edi
push edx
push SysReAllocStringLen
call esi
test eax, eax
jne 0x5098b8
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x509968
lea ecx, [esp + 0x18]
push ecx
push 1
push ebx
lea edx, [esp + 0x8a0]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x5098e3
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x509968
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edx
lea eax, [esp + 0xca8]
push eax
push str.__s___extfind__s____L_
mov esi, 0x104
lea edi, [esp + 0x14d0]
call fcn.004af0d0
lea ecx, [esp + 0x80]
push ecx
push str._s_shellopencommand
lea edi, [esp + 0x498]
call fcn.004af0d0
add esp, 0x14
push ebx
push SysReAllocStringLen
lea esi, [esp + 0x14cc]
mov edx, edi
call fcn.004af710
lea edx, [esp + 0x74]
push edx
push str._sDefaultIcon
mov esi, 0x104
lea edi, [esp + 0xeb4]
call fcn.004af0d0
add esp, 8
push ebx
push SysReAllocStringLen
mov esi, str._SystemRoot__system32_shell32.dll_19
mov edx, edi
call fcn.004af710
mov esi, dword [esp + 0x14]
add esi, 1
mov dword [esp + 0x14], esi
lea esi, [esi + esi*8]
cmp dword [esi + 0x732548], ebx
lea eax, [esi + 0x732548]
mov dword [esp + 0x10], eax
jne 0x5095f0
push ebx
push str.InstalledByAdmin
mov eax, str.Settings
call fcn.00480fe0
neg al
mov dword [esp + 0x1c], ebx
sbb eax, eax
neg eax
add eax, 0x80000001
cmp dword [str.WavePad], ebx
mov dword [esp + 0x28], eax
je 0x509eb1
mov esi, 0x7325e4
mov dword [esp + 0x14], 0x7325dc
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
push ecx
call fcn.00507ce0
test al, al
jne 0x509e86
cmp dword [esi], ebx
je 0x509e86
mov edx, dword [esp + 0x10]
lea ecx, [edx + 0x7325e4]
mov eax, esi
mov dword [esp + 0x18], ecx
lea esp, [esp]
mov ebp, dword [eax]
push ebp
push str.SoftwareClasses._s
mov esi, 0x104
lea edi, [esp + 0x7c]
call fcn.004af0d0
add esp, 8
lea edx, [esp + 0x27c]
push edx
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
cmp word [esp + 0x27c], bx
jne 0x509be6
lea eax, [esp + 0x27c]
push eax
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
cmp word [esp + 0x27c], bx
jne 0x509be6
push ebp
push str.softwaremicrosoftwindowscurrentversionexplorer_fileexts._suserchoice
lea edi, [esp + 0xeb4]
call fcn.004af0d0
add esp, 8
lea ecx, [esp + 0x484]
push ecx
push 0x6bc0cc
push str.Progid
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
cmp word [esp + 0x484], bx
je 0x509b58
lea edx, [esp + 0x484]
push str.Applications_
push edx
call fcn.0069c886
add esp, 8
test eax, eax
jne 0x509e6f
lea eax, [esp + 0x484]
push eax
push str.SoftwareClasses_s
lea edi, [esp + 0x89c]
call fcn.004af0d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 8
lea ecx, [esp + 0x38]
push ecx
push 1
push ebx
mov edx, edi
push edx
push SysReAllocStringLen
call esi
test eax, eax
jne 0x509b05
mov eax, dword [esp + 0x38]
jmp 0x509b28
lea ecx, [esp + 0x3c]
push ecx
push 1
push ebx
lea edx, [esp + 0x8a0]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x509e6f
mov eax, dword [esp + 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x509b40
movzx ecx, word [esp + eax + 0x484]
mov word [esp + eax + 0x27c], cx
add eax, 2
cmp cx, bx
jne 0x509b40
cmp word [esp + 0x27c], bx
jne 0x509be6
push ebp
push str._sfile
mov esi, 0x104
lea edi, [esp + 0x284]
call fcn.004af0d0
add esp, 8
lea ecx, [esp + 0x6c]
push ecx
lea edx, [esp + 0x30]
push edx
push ebx
push 2
push ebx
push ebx
push ebx
lea eax, [esp + 0x90]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x509be6
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x509bb0
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [esp + 0x2c]
push ecx
lea edx, [esp + 0x280]
push edx
push 1
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
mov eax, dword [edx]
push eax
lea ecx, [esp + 0xca8]
push ecx
push str.__s___extfind__s____L_
mov esi, 0x104
lea edi, [esp + 0x10c0]
call fcn.004af0d0
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x7325e0]
push eax
push ebp
push str.SoftwareClassesSystemFileAssociations._sShell_scommand
lea edi, [esp + 0x8c]
call fcn.004af0d0
add esp, 0x18
lea ecx, [esp + 0x64]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x38]
push edx
push ebx
push 2
push ebx
push ebx
push ebx
mov eax, edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x509c8d
lea eax, [esp + 0x10b4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x509c57
mov ecx, dword [esp + 0x34]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x10b8]
push eax
push 1
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x7325e0]
push ecx
push ebp
push str.SoftwareClassesSystemFileAssociations._sShell_s
lea edi, [esp + 0x80]
call fcn.004af0d0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov esi, dword [eax + 0x7325d8]
add esp, 0xc
push ebx
push edx
mov edx, edi
call fcn.004af710
lea ecx, [esp + 0x27c]
push ecx
push str.SoftwareClasses_sShell
mov esi, 0x104
call fcn.004af0d0
add esp, 8
lea edx, [esp + 0x68c]
push edx
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
cmp word [esp + 0x68c], bx
jne 0x509dcb
lea eax, [esp + 0x68c]
push eax
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
cmp word [esp + 0x68c], bx
jne 0x509dcb
push ebp
lea edi, [esp + 0x44]
mov dword [esp + 0x44], 0x6e0608
mov dword [esp + 0x48], str.docx
mov dword [esp + 0x4c], 0x6e0638
mov dword [esp + 0x50], 0x700a00
mov dword [esp + 0x54], str.xlsx
mov dword [esp + 0x58], 0x6e0600
mov dword [esp + 0x5c], 0x700a14
mov dword [esp + 0x60], str.pptx
mov dword [esp + 0x64], ebx
call fcn.005757b0
test al, al
je 0x509dcb
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x34]
push edx
push ebx
push 2
push ebx
push ebx
push ebx
lea eax, [esp + 0x90]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x509e6f
mov ecx, dword [esp + 0x30]
push 0xa
push 0x6bc0b0
push 1
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x30]
push edx
jmp 0x509e69
lea eax, [esp + 0x27c]
push eax
push str.SoftwareClasses_sDefaultIcon
lea edi, [esp + 0x7c]
call fcn.004af0d0
add esp, 8
lea ecx, [esp + 0x484]
push ecx
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, SysReAllocStringLen
call fcn.004af7e0
cmp word [esp + 0x484], bx
jne 0x509e6f
lea edx, [esp + 0x484]
push edx
push 0x6bc0cc
push ebx
mov ecx, edi
mov edx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004af7e0
cmp word [esp + 0x484], bx
jne 0x509e6f
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push 2
push ebx
push ebx
push ebx
mov edx, edi
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x509e6f
mov eax, dword [esp + 0x24]
push 0x4a
push str._SystemRoot__system32_shell32.dll_19
push 1
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
add eax, 4
cmp dword [eax], ebx
mov dword [esp + 0x18], eax
jne 0x509a00
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
add eax, 1
mov dword [esp + 0x1c], eax
imul eax, eax, 0x5c
mov dword [esp + 0x10], eax
lea eax, [eax + 0x7325dc]
add esi, 0x5c
cmp dword [eax], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], eax
jne 0x5099d0
cmp dword [0x733e60], 0xffffffff
jne 0x509ee5
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
push str.wine_get_unix_file_name
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
neg eax
push esi
mov dword [0x733e60], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x733e60], 1
je 0x509f2f
lea edx, [esp + 0x74]
push edx
mov dword [esp + 0x78], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov al, byte [esp + 0x78]
cmp al, 6
ja 0x509f12
jne 0x509f2f
cmp byte [esp + 0x7c], 1
jbe 0x509f2f
lea esi, [esp + 0xca4]
call fcn.005088b0
call fcn.00401510
test al, al
je 0x509f2f
mov eax, esi
push eax
call fcn.00508b00
lea ecx, [esp + 0xca4]
push ecx
call fcn.00508be0
lea edx, [esp + 0x68c]
push edx
push ebx
push ebx
push 6
push ebx
mov word [esp + 0x6a0], bx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp word [esp + 0x68c], bx
je 0x509f91
push str..lnk
push str.NCH_Software_Download_Site
lea eax, [esp + 0xeb4]
push eax
lea eax, [esp + 0x698]
call fcn.004ad3a0
push str.https:__www.nchsoftware.com_index.html
lea ecx, [esp + 0xeb0]
push ecx
call fcn.004c53e0
mov esi, dword [sym.imp.SHELL32.dll_SHChangeNotify]
push ebx
push ebx
push 0x2000
push 0x8000000
call esi
call fcn.00496830
test al, al
je 0x509fc7
push ebx
push ebx
push ebx
push 0x8000000
call esi
call fcn.00551000
call fcn.005513a0
call fcn.005511e0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x16bc