Function at 0x420b79
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
mov edx, dword [esp + 0x20]
lea ecx, [esp]
call fcn.00423000
push dword [esp]
mov edx, str..epub
pop ecx
call fcn.004231c0
je 0x420bbf
mov edx, str.ePub_eBook
lea ecx, [esp + 4]
call fcn.00423008
mov edx, 0x478b3c
lea ecx, [esp + 8]
call fcn.00423008
jmp 0x420c97
push dword [esp]
mov edx, str..mobi
pop ecx
call fcn.004231c0
jne 0x420be1
push dword [esp]
mov edx, str..prc
pop ecx
call fcn.004231c0
jne 0x420be1
jmp 0x420be8
mov eax, 1
jmp 0x420bea
xor eax, eax
and eax, eax
je 0x420c0f
mov edx, str.mobi_eBook
lea ecx, [esp + 4]
call fcn.00423008
mov edx, 0x478b42
lea ecx, [esp + 8]
call fcn.00423008
jmp 0x420c97
push dword [esp]
mov edx, str..azw3
pop ecx
call fcn.004231c0
je 0x420c3d
mov edx, str.azw3_eBook
lea ecx, [esp + 4]
call fcn.00423008
mov edx, 0x478b48
lea ecx, [esp + 8]
call fcn.00423008
jmp 0x420c97
push dword [esp]
mov edx, str..azw4
pop ecx
call fcn.004231c0
je 0x420c6b
mov edx, str.azw4_eBook
lea ecx, [esp + 4]
call fcn.00423008
mov edx, 0x478b48
lea ecx, [esp + 8]
call fcn.00423008
jmp 0x420c97
push dword [esp]
mov edx, str..prc
pop ecx
call fcn.004231c0
je 0x420c97
mov edx, str.prc_eBook
lea ecx, [esp + 4]
call fcn.00423008
mov edx, 0x478b42
lea ecx, [esp + 8]
call fcn.00423008
push dword [0x4840ac]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [0x4840ac]
mov edx, str.SoftwareClasses_
push edx
call fcn.0043b540
mov edx, dword [esp + 0x28]
push edx
call fcn.0043b540
add dword [0x4840ac], 2
push 0x80000001
mov edx, dword [0x47ee78]
add dword [esp + 4], edx
call sub.ADVAPI32.DLL_RegCreateKeyExW
pop dword [0x4840ac]
mov ebx, eax
and ebx, ebx
jne 0x420de0
push dword [esp + 4]
call fcn.00439b90
mov ebx, eax
add ebx, 2
push ebx
push dword [esp + 8]
push 1
push 0
mov eax, 0x4750a6
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegSetValueExW
push dword [0x4840ac]
push dword [0x4840ac]
call fcn.00423f65
lea eax, [esp + 0x18]
push eax
call fcn.0043b5a0
push dword [0x4840ac]
push dword [0x4840ac]
mov edx, dword [esp + 0x1c]
push dword [0x4840ac]
push edx
call fcn.0043b540
mov edx, dword [esp + 0x14]
push edx
call fcn.0043b540
mov edx, dword [0x47ee78]
add dword [esp], edx
call fcn.00439b90
pop dword [0x4840ac]
mov ebx, eax
add ebx, 2
push ebx
mov edx, dword [esp + 0x1c]
push dword [0x4840ac]
push edx
call fcn.0043b540
mov edx, dword [esp + 0x14]
push edx
call fcn.0043b540
add dword [0x4840ac], 2
push 1
push 0
mov eax, str.TypeOverlay
push eax
push dword [esp + 0x24]
mov edx, dword [0x47ee78]
add dword [esp + 0x10], edx
call sub.ADVAPI32.DLL_RegSetValueExW
pop dword [0x4840ac]
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
push dword [0x4840ac]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [0x4840ac]
mov edx, str.SoftwareClasses_
push edx
call fcn.0043b540
mov edx, dword [esp + 0x28]
push edx
call fcn.0043b540
mov edx, str._shellopencommand
push edx
call fcn.0043b540
add dword [0x4840ac], 2
push 0x80000001
mov edx, dword [0x47ee78]
add dword [esp + 4], edx
call sub.ADVAPI32.DLL_RegCreateKeyExW
pop dword [0x4840ac]
mov ebx, eax
and ebx, ebx
jne 0x420ec3
push dword [0x4840ac]
mov edx, 0x4751c6
push edx
call fcn.0043b540
push dword [0x4840ac]
push dword [0x4840ac]
call fcn.00423f65
pop eax
mov edx, str.____1_
push edx
call fcn.0043b540
lea eax, [esp + 0x18]
push eax
call fcn.0043b5a0
push dword [esp + 0x14]
call fcn.00439b90
mov ebx, eax
add ebx, 2
push ebx
push dword [esp + 0x18]
push 1
push 0
mov eax, 0x4750a6
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegSetValueExW
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
push dword [0x4840ac]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [0x4840ac]
mov edx, str.SoftwareClasses_
push edx
call fcn.0043b540
mov edx, dword [esp + 0x28]
push edx
call fcn.0043b540
mov edx, str._shell
push edx
call fcn.0043b540
add dword [0x4840ac], 2
push 0x80000001
mov edx, dword [0x47ee78]
add dword [esp + 4], edx
call sub.ADVAPI32.DLL_RegCreateKeyExW
pop dword [0x4840ac]
mov ebx, eax
and ebx, ebx
jne 0x420f66
push 2
mov eax, 0x4750a6
push eax
push 1
push 0
mov eax, 0x4750a6
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegSetValueExW
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
push dword [0x4840ac]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [0x4840ac]
mov edx, str.SoftwareClasses_
push edx
call fcn.0043b540
mov edx, dword [esp + 0x28]
push edx
call fcn.0043b540
mov edx, str.DefaultIcon
push edx
call fcn.0043b540
add dword [0x4840ac], 2
push 0x80000001
mov edx, dword [0x47ee78]
add dword [esp + 4], edx
call sub.ADVAPI32.DLL_RegCreateKeyExW
pop dword [0x4840ac]
mov ebx, eax
and ebx, ebx
jne 0x42108e
push dword [0x4840ac]
push dword [0x4840ac]
call fcn.00423f65
lea eax, [esp + 0x18]
push eax
call fcn.0043b5a0
push dword [0x4840ac]
push dword [0x4840ac]
mov edx, dword [esp + 0x1c]
push dword [0x4840ac]
push edx
call fcn.0043b540
mov edx, dword [esp + 0x14]
push edx
call fcn.0043b540
mov edx, dword [0x47ee78]
add dword [esp], edx
call fcn.00439b90
pop dword [0x4840ac]
mov ebx, eax
add ebx, 2
push ebx
mov edx, dword [esp + 0x1c]
push dword [0x4840ac]
push edx
call fcn.0043b540
mov edx, dword [esp + 0x14]
push edx
call fcn.0043b540
add dword [0x4840ac], 2
push 1
push 0
mov eax, 0x4750a6
push eax
push dword [esp + 0x24]
mov edx, dword [0x47ee78]
add dword [esp + 0x10], edx
call sub.ADVAPI32.DLL_RegSetValueExW
pop dword [0x4840ac]
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
push dword [0x4840ac]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [0x4840ac]
mov edx, str.SoftwareClasses_
push edx
call fcn.0043b540
mov edx, dword [esp + 0x24]
push edx
call fcn.0043b540
add dword [0x4840ac], 2
push 0x80000001
mov edx, dword [0x47ee78]
add dword [esp + 4], edx
call sub.ADVAPI32.DLL_RegCreateKeyExW
pop dword [0x4840ac]
mov ebx, eax
and ebx, ebx
jne 0x42112e
push dword [esp + 4]
call fcn.00439b90
mov ebx, eax
add ebx, 2
push ebx
push dword [esp + 8]
push 1
push 0
mov eax, 0x4750a6
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegSetValueExW
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
push dword [0x4840ac]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [0x4840ac]
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
push edx
call fcn.0043b540
mov edx, dword [esp + 0x24]
push edx
call fcn.0043b540
add dword [0x4840ac], 2
push 0x80000001
mov edx, dword [0x47ee78]
add dword [esp + 4], edx
call sub.ADVAPI32.DLL_RegCreateKeyExW
pop dword [0x4840ac]
mov ebx, eax
and ebx, ebx
jne 0x421252
push dword [0x4840ac]
push dword [0x4840ac]
push dword [0x4840ac]
push dword [0x4840ac]
push dword [0x4840ac]
push dword [0x4840ac]
call fcn.00423f65
mov edx, dword [0x47ee78]
add dword [esp], edx
call fcn.00426db8
mov edx, dword [0x47ee78]
add dword [esp], edx
call fcn.00439b90
pop dword [0x4840ac]
mov ebx, eax
add ebx, 2
push ebx
push dword [0x4840ac]
push dword [0x4840ac]
push dword [0x4840ac]
push dword [0x4840ac]
call fcn.00423f65
mov edx, dword [0x47ee78]
add dword [esp], edx
call fcn.00426db8
add dword [0x4840ac], 2
push 1
push 0
mov eax, str.Application
push eax
push dword [esp + 0x24]
mov edx, dword [0x47ee78]
add dword [esp + 0x10], edx
call sub.ADVAPI32.DLL_RegSetValueExW
pop dword [0x4840ac]
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, str.SoftwareClassesApplicationseBook_Anzeiger.exe_shellopencommand
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExW
mov ebx, eax
and ebx, ebx
jne 0x4212f8
push dword [0x4840ac]
mov edx, 0x4751c6
push edx
call fcn.0043b540
push dword [0x4840ac]
push dword [0x4840ac]
call fcn.00423f65
pop eax
mov edx, str.____1_
push edx
call fcn.0043b540
lea eax, [esp + 0x18]
push eax
call fcn.0043b5a0
push dword [esp + 0x14]
call fcn.00439b90
mov ebx, eax
add ebx, 2
push ebx
push dword [esp + 0x18]
push 1
push 0
mov eax, 0x4750a6
push eax
push dword [esp + 0x20]
call sub.ADVAPI32.DLL_RegSetValueExW
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, str.SoftwareClassesApplicationseBook_Anzeiger.exeDefaultIcon
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExW
mov ebx, eax
and ebx, ebx
jne 0x4213e5
push dword [0x4840ac]
push dword [0x4840ac]
call fcn.00423f65
lea eax, [esp + 0x18]
push eax
call fcn.0043b5a0
push dword [0x4840ac]
push dword [0x4840ac]
mov edx, dword [esp + 0x1c]
push dword [0x4840ac]
push edx
call fcn.0043b540
mov edx, 0x478b36
push edx
call fcn.0043b540
mov edx, dword [0x47ee78]
add dword [esp], edx
call fcn.00439b90
pop dword [0x4840ac]
mov ebx, eax
add ebx, 2
push ebx
mov edx, dword [esp + 0x1c]
push dword [0x4840ac]
push edx
call fcn.0043b540
mov edx, 0x478b36
push edx
call fcn.0043b540
add dword [0x4840ac], 2
push 1
push 0
mov eax, 0x4750a6
push eax
push dword [esp + 0x24]
mov edx, dword [0x47ee78]
add dword [esp + 0x10], edx
call sub.ADVAPI32.DLL_RegSetValueExW
pop dword [0x4840ac]
push dword [esp + 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
xor eax, eax
push dword [esp + 0x14]
call fcn.0043b710
push dword [esp + 8]
call fcn.0043b710
push dword [esp]
call fcn.0043b710
push dword [esp + 4]
call fcn.0043b710
add esp, 0x18
pop ebx
ret 4