Function at 0x45ac0f
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push 0x13c
mov eax, 0x531db5
call fcn.004e4832
and dword [ebp - 0x1c], 0
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
and dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
call fcn.00459d4f
test al, al
jne 0x45ac45
xor bl, bl
jmp 0x45ae6d
mov edi, 0x5e6290
lea ecx, [ebp - 0x134]
mov esi, str.SOFTWAREClasses_
push edi
mov edx, esi
call fcn.00452403
pop ecx
mov ebx, 0x5aae04
mov byte [ebp - 4], 1
push ebx
lea ecx, [ebp - 0x11c]
call fcn.00426565
push edi
mov edx, str.URL:
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x104]
call fcn.00452403
push edi
mov edx, esi
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xec]
call fcn.00452403
pop ecx
pop ecx
push str.URL_Protocol
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 4
call fcn.00426565
push ebx
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 5
call fcn.00426565
push edi
mov edx, esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x44]
call fcn.00452403
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xa4]
mov edx, eax
mov dword [esp], str._shellopencommand
call fcn.00425085
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
call fcn.00427b8c
push ebx
lea ecx, [ebp - 0x8c]
call fcn.00426565
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
push eax
mov edx, 0x5abaf4
lea ecx, [ebp - 0x5c]
call fcn.00452403
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x74]
mov edx, eax
mov dword [esp], str._______1_
call fcn.00425085
pop ecx
xor ebx, ebx
lea ecx, [ebp - 0x5c]
push ebx
push 1
call fcn.00427b8c
mov byte [ebp - 4], 0xc
mov byte [ebp - 0x138], bl
lea eax, [ebp - 0x5c]
push dword [ebp - 0x138]
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x148], ebx
push eax
lea eax, [ebp - 0x134]
mov dword [ebp - 0x144], ebx
push eax
mov dword [ebp - 0x140], ebx
call fcn.0045d3d7
push fcn.0045aee5
push 3
push 0x48
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 0xe
push eax
call fcn.004e40fb
mov esi, dword [ebp - 0x148]
cmp esi, dword [ebp - 0x144]
je 0x45ae60
lea ebx, [esi + 0x2c]
xor edx, edx
cmp dword [ebx - 0x18], 8
mov dword [ebp - 0x13c], edx
jb 0x45adb4
mov eax, dword [esi]
jmp 0x45adb6
mov eax, esi
push edx
lea ecx, [ebp - 0x13c]
push ecx
push edx
push 0x20006
push edx
push edx
push edx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x45aec3
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x138]
call fcn.0041ffcf
add esp, 4
mov byte [ebp - 4], 0xf
cmp dword [ebx + 0x18], 8
mov eax, dword [ebx + 0x14]
jb 0x45ae01
mov edx, dword [ebx + 4]
jmp 0x45ae04
lea edx, [ebx + 4]
cmp dword [ebx], 8
jb 0x45ae0e
mov ecx, dword [ebx - 0x14]
jmp 0x45ae11
lea ecx, [ebx - 0x14]
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push ecx
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x45ae81
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x138]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
add esi, 0x48
add ebx, 0x48
cmp esi, dword [ebp - 0x144]
jne 0x45ada2
mov bl, 1
lea ecx, [ebp - 0x148]
call fcn.0045cd74
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00427b8c
mov al, bl
call fcn.004e47dc
ret
add esi, 0x18
cmp dword [esi + 0x14], 8
jb 0x45ae8c
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryProtocolHandler
push str._s:_RegSetValueExW_failed_for__hs_with_code__ld
push 1
push 0
call fcn.0043a05d
add esp, 0x18
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push dword [ebp - 0x138]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.DLL_SetLastError]
xor bl, bl
jmp 0x45ae62
cmp dword [esi + 0x14], 8
jb 0x45aecb
mov esi, dword [esi]
push eax
push esi
push str.WriteRegistryProtocolHandler
push str._s:_RegCreateKeyEx_failed_for__hs_with_code__ld
push 1
push 0
call fcn.0043a05d
add esp, 0x18
jmp 0x45aebf