Function at 0x527a70
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x68b740]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x27c], ecx
mov ecx, dword [ebp - 0x27c]
call fcn.00527790
cmp eax, 1
jne 0x527a9e
jmp 0x527f9b
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x228], 0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x228]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x63b958
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x22c], eax
xor edx, edx
je 0x527af2
mov eax, dword [ebp - 0x230]
mov dword [0], eax
cmp dword [ebp - 0x22c], 0
jne 0x527b43
mov dword [ebp - 0x234], 0
cmp dword [ebp - 0x114], 0
je 0x527b2b
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x114], 0
mov edx, dword [ebp - 0x234]
mov dword [ebp - 0x22c], edx
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x114], eax
xor ecx, ecx
jne 0x527b43
mov edx, 0x646d70
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x238], edx
jne 0x527b64
push 0x80004005
call fcn.00527fb0
xor eax, eax
jne 0x527b47
push 0x646d70
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push 0x646d70
push 1
push 0
push 0
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x23c], 0
cmp dword [ebp - 0x114], 0
je 0x527bbf
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x240], 0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x240]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x646d70
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x244], eax
xor edx, edx
je 0x527c09
mov eax, dword [ebp - 0x248]
mov dword [0], eax
cmp dword [ebp - 0x244], 0
jne 0x527c5a
mov dword [ebp - 0x24c], 0
cmp dword [ebp - 0x114], 0
je 0x527c42
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x114], 0
mov edx, dword [ebp - 0x24c]
mov dword [ebp - 0x244], edx
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x114], eax
xor ecx, ecx
jne 0x527c5a
mov edx, 0x646d58
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x250], edx
jne 0x527c7b
push 0x80004005
call fcn.00527fb0
xor eax, eax
jne 0x527c5e
push 0x646d58
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push 0x646d58
push 1
push 0
push 0
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x254], 0
cmp dword [ebp - 0x114], 0
je 0x527cd6
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
mov byte [ebp - 0x220], 0
push 0x103
push 0
lea ecx, [ebp - 0x21f]
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea edx, [ebp - 0x110]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x220]
push ecx
call sub.MSVCR80.dll_strcpy
add esp, 8
lea edx, [ebp - 0x220]
push edx
call sub.MSVCR80.dll_strlen
add esp, 4
sub eax, 1
mov dword [ebp - 0x224], eax
jmp 0x527d63
mov eax, dword [ebp - 0x224]
sub eax, 1
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jle 0x527d91
mov ecx, dword [ebp - 0x224]
movsx edx, byte [ebp + ecx - 0x220]
cmp edx, 0x5c
jne 0x527d8f
mov eax, dword [ebp - 0x224]
mov byte [ebp + eax - 0x21f], 0
jmp 0x527d91
jmp 0x527d54
push 0x646d40
lea ecx, [ebp - 0x220]
push ecx
push 0x63e278
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x10
mov dword [ebp - 0x258], 0
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x258]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x646d28
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x25c], eax
xor edx, edx
je 0x527dfc
mov eax, dword [ebp - 0x260]
mov dword [0], eax
cmp dword [ebp - 0x25c], 0
jne 0x527e22
lea ecx, [ebp - 0x114]
call fcn.00527fe0
mov dword [ebp - 0x25c], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x114], ecx
xor edx, edx
jne 0x527e22
lea eax, [ebp - 0x220]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x264], eax
jne 0x527e44
push 0x80004005
call fcn.00527fb0
xor ecx, ecx
jne 0x527e26
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea eax, [ebp - 0x220]
push eax
push 1
push 0
push 0
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x268], 0
cmp dword [ebp - 0x114], 0
je 0x527ea3
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x26c], 0
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x26c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x646d0c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x270], eax
xor edx, edx
je 0x527eed
mov eax, dword [ebp - 0x274]
mov dword [0], eax
cmp dword [ebp - 0x270], 0
jne 0x527f13
lea ecx, [ebp - 0x114]
call fcn.00527fe0
mov dword [ebp - 0x270], eax
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x114], ecx
push 0x646d08
lea edx, [ebp - 0x110]
push edx
push 0x63e278
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x10
xor ecx, ecx
jne 0x527f34
lea edx, [ebp - 0x110]
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x278], edx
jne 0x527f56
push 0x80004005
call fcn.00527fb0
xor eax, eax
jne 0x527f38
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea edx, [ebp - 0x110]
push edx
push 1
push 0
push 0
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x114]
call fcn.00527fe0
lea ecx, [ebp - 0x114]
call fcn.00527fe0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00612c78
mov esp, ebp
pop ebp
ret