Function at 0x402277
Capabilities:
Persist via app paths registry key
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
push ebx
push esi
push edi
mov edi, 0x40a964
push edi
call fcn.004031a0
xor ebx, ebx
pop ecx
test eax, eax
je 0x40268a
cmp byte [0x40a964], 0x2e
jne 0x40268a
mov esi, 0x40aa68
push esi
call fcn.004031a0
test eax, eax
pop ecx
je 0x40268a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x80000000
call edi
test eax, eax
jne 0x402960
push esi
call fcn.004031a0
pop ecx
inc eax
push eax
push esi
push 1
push ebx
push 0x40ab80
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402960
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push esi
push 0x80000000
call edi
test eax, eax
jne 0x402960
mov al, byte [0x40ab80]
push 0x40
mov byte [ebp - 0x314], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x314]
push 0x40a440
push eax
call fcn.004030b0
lea eax, [ebp - 0x314]
push str..exe
push eax
call fcn.004030c0
lea eax, [ebp - 0x10c]
push 0x40a965
push eax
call fcn.004030b0
lea eax, [ebp - 0x10c]
push 0x40951c
push eax
call fcn.004030c0
lea eax, [ebp - 0x10c]
push eax
call fcn.004031a0
add esp, 0x24
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
push 0x40ab80
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402960
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.004030b0
lea eax, [ebp - 0x10c]
push str.DefaultIcon
push eax
call fcn.004030c0
add esp, 0x10
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x10c]
push ebx
push eax
push 0x80000000
call edi
test eax, eax
jne 0x402960
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x10c]
push 0x40a650
push eax
call fcn.004011ec
lea eax, [ebp - 0x10c]
push 0x409508
push eax
call fcn.004030c0
lea eax, [ebp - 0x10c]
push 0x40ab6c
push eax
call fcn.004030c0
lea eax, [ebp - 0x10c]
push eax
call fcn.004031a0
add esp, 0x20
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
push 0x40ab80
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402960
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.004030b0
lea eax, [ebp - 0x10c]
push str._shellopencommand
push eax
call fcn.004030c0
add esp, 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x10c]
push ebx
push eax
push 0x80000000
call edi
test eax, eax
jne 0x402960
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x10c]
push 0x40a650
push eax
call fcn.004011ec
lea eax, [ebp - 0x10c]
push 0x4094f0
push eax
call fcn.004030c0
lea eax, [ebp - 0x10c]
push eax
call fcn.004031a0
add esp, 0x18
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
push 0x40ab80
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402960
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.004030b0
lea eax, [ebp - 0x10c]
push str._shellprintcommand
push eax
call fcn.004030c0
add esp, 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x10c]
push ebx
push eax
push 0x80000000
call edi
test eax, eax
jne 0x402960
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x10c]
push 0x40a650
push eax
call fcn.004011ec
lea eax, [ebp - 0x10c]
push str.__p__1
push eax
call fcn.004030c0
lea eax, [ebp - 0x10c]
push eax
call fcn.004031a0
add esp, 0x18
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
push 0x40ab80
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402960
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.004030b0
lea eax, [ebp - 0x10c]
push str._shellprinttocommand
push eax
call fcn.004030c0
add esp, 0x10
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x10c]
push ebx
push eax
push 0x80000000
call edi
test eax, eax
jne 0x402960
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x10c]
push 0x40a650
push eax
call fcn.004011ec
lea eax, [ebp - 0x10c]
push str.__p__1
push eax
call fcn.004030c0
lea eax, [ebp - 0x10c]
push eax
call fcn.004031a0
add esp, 0x18
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
push 0x40ab80
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402960
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xd
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
pop ecx
lea edi, [ebp - 0x210]
rep movsd dword es:[edi], dword [esi]
push 0x34
xor eax, eax
pop ecx
lea edi, [ebp - 0x1dc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x210]
push 0x40a440
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004011ec
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x210]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402960
mov esi, 0x409f28
push esi
call fcn.004031a0
pop ecx
inc eax
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push ebx
push str.DisplayName
push dword [ebp - 4]
call esi
test eax, eax
jne 0x402960
lea eax, [ebp - 0x620]
push 0x409e24
push eax
call fcn.004030b0
lea eax, [ebp - 0x620]
push 0x409474
push eax
call fcn.004030c0
lea eax, [ebp - 0x620]
push 0x40a650
push eax
call fcn.004030c0
lea eax, [ebp - 0x620]
push eax
call fcn.004031a0
add esp, 0x1c
inc eax
push eax
lea eax, [ebp - 0x620]
push eax
push 1
push ebx
push str.UninstallString
push dword [ebp - 4]
call esi
test eax, eax
jne 0x402960
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xd
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
pop ecx
lea edi, [ebp - 0x418]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x33
xor eax, eax
pop ecx
lea edi, [ebp - 0x3e3]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, 0x40a440
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.004030c0
lea eax, [ebp - 0x418]
push str..exe
push eax
call fcn.004030c0
add esp, 0x10
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x418]
push ebx
push eax
push 0x80000002
call edi
test eax, eax
jne 0x402960
push esi
lea eax, [ebp - 0x210]
push 0x40a650
push eax
call fcn.004011ec
lea eax, [ebp - 0x210]
push eax
call fcn.004031a0
add esp, 0x10
inc eax
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push ebx
push 0x409424
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402960
lea eax, [ebp - 0x210]
push str..exe
push eax
call fcn.004030c0
lea eax, [ebp - 0x210]
push eax
call fcn.004031a0
add esp, 0xc
inc eax
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push ebx
push 0x40ab80
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x402960
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x40a02c
call fcn.004031a0
test eax, eax
pop ecx
je 0x4028db
push 0x40a02c
lea eax, [ebp - 0x210]
push str.Software
push eax
call fcn.004011ec
lea eax, [ebp - 0x210]
push 0x4091bc
push eax
call fcn.004030c0
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004030c0
lea eax, [ebp - 0x210]
push 0x4091bc
push eax
call fcn.004030c0
add esp, 0x24
jmp 0x402901
push esi
lea eax, [ebp - 0x210]
push str.Software
push eax
call fcn.004011ec
lea eax, [ebp - 0x210]
push 0x4091bc
push eax
call fcn.004030c0
add esp, 0x14
lea eax, [ebp - 0x210]
push 0x409064
push eax
call fcn.004030c0
pop ecx
lea eax, [ebp - 8]
pop ecx
mov esi, 0xf003f
push eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push ebx
push ebx
lea eax, [ebp - 0x210]
push ebx
push eax
push 0x80000002
call edi
test eax, eax
jne 0x402960
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push esi
push ebx
push ebx
lea eax, [ebp - 0x210]
push ebx
push eax
push 0x80000001
call edi
test eax, eax
je 0x402964
xor al, al
jmp 0x40296f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret