Function at 0x4ec9d0
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x53cb13
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5c403c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], edi
lea ecx, [esp + 0x10]
call dword [0x55a6c4]
mov byte [esp + 0x30], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x14]
push str.SoftwareClasses_s
push edx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov eax, 0xf003f
lea esi, [esp + 0x1c]
call fcn.004ec830
test eax, eax
jne 0x4ecc22
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.wtw.uriClass
call ebx
mov esi, dword [esp + 0x1c]
inc eax
add eax, eax
push eax
push str.wtw.uriClass
push 1
push edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call edi
test eax, eax
jne 0x4ecaaf
push 0x55ae9c
call ebx
inc eax
lea ecx, [eax + eax]
push ecx
push 0x55ae9c
push 1
push 0
push str.URL_Protocol
push esi
call edi
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.EditFlags
push esi
mov dword [esp + 0x2c], 2
call edi
test esi, esi
je 0x4ecac2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], 0
push str._shellopencommand
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], 0
call dword [0x55a294]
mov edx, dword [esp + 0x10]
mov eax, 0xf003f
lea esi, [esp + 0x1c]
call fcn.004ec830
test eax, eax
jne 0x4ecba7
lea ecx, [esp + 0x14]
call dword [0x55a6c4]
mov byte [esp + 0x30], 2
lea eax, [esp + 0x18]
push eax
call fcn.004e2980
mov byte [esp + 0x34], 3
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x1c]
push str.__swtw.exe____url____1_
push edx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0x10
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, dword [esp + 0x14]
xor ecx, ecx
test eax, eax
setne cl
mov esi, eax
test ecx, ecx
jne 0x4ecb51
mov eax, 0x80004005
call fcn.004ec890
push eax
call ebx
inc eax
add eax, eax
push eax
push esi
mov esi, dword [esp + 0x24]
push 1
push 0
push 0
push esi
call edi
test esi, esi
je 0x4ecb79
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x30], 1
lea ecx, [esp + 0x14]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov eax, 0xf003f
mov edx, str.SoftwareClasseswtw.uriClass
lea esi, [esp + 0x1c]
call fcn.004ec830
test eax, eax
je 0x4ecbb1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
jmp 0x4ecc28
push str.WTW_URI_Handler_Class
call ebx
mov esi, dword [esp + 0x1c]
inc eax
lea ecx, [eax + eax]
push ecx
push str.WTW_URI_Handler_Class
push 1
xor ebx, ebx
push ebx
push ebx
push esi
call edi
cmp esi, ebx
je 0x4ecbe0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], ebx
mov byte [esp + 0x30], bl
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [esp + 0x30], 0xffffffff
cmp esi, ebx
je 0x4ecc09
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x4ecc36
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov byte [esp + 0x30], 0
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x4ecc62
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret