Function at 0x402870
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set current directory
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x434c0c]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x22c], eax
push 0x104
push 0x4368c0
push 0
mov eax, dword [ebp - 0x22c]
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
mov dword [ebp - 0x114], 0x104
jmp 0x4028c2
mov ecx, dword [ebp - 0x114]
sub ecx, 1
mov dword [ebp - 0x114], ecx
cmp dword [ebp - 0x114], 0
jle 0x4028e1
mov edx, dword [ebp - 0x114]
movsx eax, byte [edx + 0x4368c0]
cmp eax, 0x5c
jne 0x4028df
jmp 0x4028e1
jmp 0x4028b3
mov ecx, dword [ebp - 0x114]
push ecx
push 0x4368c0
push 0x436198
call fcn.00413170
add esp, 0xc
push 0x436198
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x118], 0x104
lea edx, [ebp - 0x11c]
push edx
push 1
push 0
push str.SwApp
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4029e9
lea eax, [ebp - 0x11c]
push eax
push str.SwApp
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push 0x104
push str.swrfile
push 1
push 0x42b5a5
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x120], eax
lea edx, [ebp - 0x11c]
push edx
push str..swr
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x120], eax
push 0x104
push str.SwApp
push 1
push 0x42b5a5
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x11c]
push ecx
push str.SwApp
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x120], eax
push 0
push 0
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push str.SwApp
lea edx, [ebp - 0x338]
push edx
call fcn.00405650
add esp, 8
push str._shellopencommand
push 0x14
push str.SwApp
call fcn.00412ff0
add esp, 4
lea eax, [ebp + eax - 0x338]
push eax
call fcn.00412f7a
add esp, 0xc
lea ecx, [ebp - 0x11c]
push ecx
push 1
push 0
lea edx, [ebp - 0x338]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x440]
push ecx
push 0
push 0
push 0x42b5a5
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x4368c0
lea eax, [ebp - 0x228]
push eax
call fcn.00405650
add esp, 8
push str.___1_
push 6
push 0x4368c0
call fcn.00412ff0
add esp, 4
add eax, 0x4368c0
push eax
call fcn.00413108
add esp, 0xc
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x440]
push edx
push 0x4368c0
call fcn.00413080
add esp, 8
test eax, eax
je 0x402b09
lea eax, [ebp - 0x11c]
push eax
push 1
push 0
push str.SwApp
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x104
push 0x4368c0
push 1
push str.shellopencommand
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SwApp
lea eax, [ebp - 0x338]
push eax
call fcn.00405650
add esp, 8
push str.DefaultIcon
push 0xd
push str.SwApp
call fcn.00412ff0
add esp, 4
lea ecx, [ebp + eax - 0x338]
push ecx
call fcn.00412f7a
add esp, 0xc
lea edx, [ebp - 0x11c]
push edx
push 1
push 0
lea eax, [ebp - 0x338]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x118], 0x104
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0x440]
push edx
push 0
push 0
push 0x42b5a5
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.00405650
add esp, 8
push 0x42b55c
push 4
lea eax, [ebp - 0x110]
push eax
call fcn.00412ff0
add esp, 4
lea ecx, [ebp + eax - 0x110]
push ecx
call fcn.00413108
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x440]
push eax
call fcn.00413080
add esp, 8
test eax, eax
je 0x402bf6
lea ecx, [ebp - 0x228]
push ecx
push str..swr
call fcn.00402790
add esp, 8
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004127a7
mov esp, ebp
pop ebp
ret