Function at 0x4148c0
Capabilities:
Check if file exists
Delete registry key
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57b900
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x5ca104]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 3
call fcn.00406e20
xor edx, edx
mov ecx, eax
test ecx, ecx
setne dl
test edx, edx
jne 0x414911
push 0x80004005
call fcn.004071e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414926
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x414928
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov byte [ebp - 4], 4
or edi, 0xffffffff
mov eax, dword [ebp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [eax - 0xc], 0
je 0x41498f
lea edx, [eax - 0x10]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], ecx
cmp edx, ecx
je 0x4149f7
cmp dword [ecx + 0xc], 0
jl 0x414981
mov edx, dword [edx]
cmp edx, dword [ecx]
jne 0x414981
push dword [ebp - 0x28]
call fcn.00405650
mov ecx, dword [ebp - 0x1c]
add esp, 4
mov esi, eax
call fcn.00407070
add esi, 0x10
mov dword [ebp - 0x14], esi
jmp 0x4149f7
push dword [eax - 0xc]
lea ecx, [ebp - 0x14]
push eax
call fcn.00405730
jmp 0x4149f4
lea ecx, [ebp - 0x28]
call fcn.0040c540
push str.MasterPDF
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x14]
push str._s_s.exe
push eax
call fcn.00420660
mov byte [ebp - 4], 4
add esp, 0x10
mov ecx, dword [ebp - 0x28]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4149f4
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4149f0
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4149f0
push 0
push dword [edx + 4]
call ebx
jmp 0x4149f4
mov ecx, edx
call esi
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414a0a
mov dword [ebp - 0x28], eax
jmp 0x415027
push str.MasterPDF
lea ecx, [ebp - 0x30]
call fcn.00404e80
push 0x5a517c
lea edx, [ebp - 0x30]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x34]
call fcn.0041c840
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 7
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004048b0
add esp, 0x10
mov byte [ebp - 4], 9
mov eax, edi
mov ecx, dword [ebp - 0x34]
add ecx, 0xfffffff0
mov dword [ebp - 0x28], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414a98
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414a92
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x28]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414a8b
push 0
push dword [edx + 4]
call ebx
jmp 0x414a98
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x414a98
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
lea eax, [ebp - 0x24]
mov edx, str.SoftwareClasses_
push eax
lea ecx, [ebp - 0x20]
call fcn.0041c750
add esp, 4
mov byte [ebp - 4], 0xa
mov eax, dword [ebp + 0x10]
mov edx, eax
lea ebx, [edx + 2]
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x414ac0
sub edx, ebx
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00406e20
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x414b00
push 0x80004005
call fcn.004071e0
mov eax, dword [edx]
mov ebx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414b15
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x414b19
mov ecx, edx
call ebx
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x1c]
push dword [ebp - 0x38]
push esi
push str._s__d
push eax
call fcn.00420660
push str.DefaultIcon
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x28]
call fcn.0041c840
mov ebx, dword [ebp - 0x1c]
add esp, 0x14
mov ecx, ebx
mov edx, dword [eax]
lea eax, [ecx + 2]
mov dword [ebp - 0x38], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414b55
sub ecx, dword [ebp - 0x38]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push 0
push edx
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x28]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414bcd
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414bc8
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414bc1
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x414bcd
mov ecx, edx
call dword [ebp - 0x38]
jmp 0x414bcd
mov ecx, edx
call dword [ebp - 0x38]
push str._shell
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0041c840
add esp, 4
push 8
push str.open
push 1
push 0
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x38]
mov eax, edi
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414c37
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414c33
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414c33
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x414c37
mov ecx, edx
call edi
call fcn.00406e20
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x414c53
push 0x80004005
call fcn.004071e0
mov eax, dword [edx]
mov edi, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414c68
lock inc dword [edx + 0x14]
lea eax, [edx + 8]
jmp 0x414c6c
mov ecx, edx
call edi
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x28]
push dword [ebp + 0xc]
push esi
push str.__s____s____1____
push eax
call fcn.00420660
push str._shellopencommand
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x3c]
call fcn.0041c840
mov edi, dword [ebp - 0x28]
add esp, 0x14
mov ecx, edi
mov edx, dword [eax]
lea eax, [ecx + 2]
mov dword [ebp - 0x38], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x414cb0
sub ecx, dword [ebp - 0x38]
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push 0
push edx
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 0x3c]
test eax, eax
sete byte [ebp - 0xd]
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414d2f
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414d2a
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov edi, dword [eax + 4]
mov dword [ebp - 0x38], edi
mov edi, dword [ebp - 0x28]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414d23
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x414d2f
mov ecx, edx
call dword [ebp - 0x38]
jmp 0x414d2f
mov ecx, edx
call dword [ebp - 0x38]
cmp byte [ebp - 0xd], 0
jne 0x414d41
mov dword [ebp - 0x28], 0
jmp 0x414e7e
lea eax, [ebp + 8]
mov edx, str.SoftwareClasses_
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041c750
add esp, 4
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x24]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x3c], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x414d64
sub edx, dword [ebp - 0x3c]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x5a5180
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x3c]
call fcn.0041c840
add esp, 4
push 0
push 0x5a0e3c
push 1
push dword [ebp - 0x24]
push dword [eax]
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0x3c]
call fcn.00404e00
cmp dword [ebp - 0x18], 0x80000001
jne 0x414e6f
lea eax, [ebp + 8]
mov edx, str.ExplorerFileExts_
push eax
lea ecx, [ebp - 0x18]
call fcn.0041c750
add esp, 4
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x24]
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x3c], ecx
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x414df0
sub edx, dword [ebp - 0x3c]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push str.Progid
push dword [ebp - 0x18]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push str.Application
push dword [ebp - 0x18]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.UserChoice
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x38]
call fcn.0041c840
add esp, 4
mov ecx, SysReAllocStringLen
mov eax, dword [eax]
mov edx, eax
mov dword [ebp - 0x3c], eax
call fcn.00412480
push dword [ebp - 0x3c]
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [ebp - 0x38]
call fcn.00404e00
lea ecx, [ebp - 0x18]
call fcn.00404e00
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x28], 1
call fcn.00404e00
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0xb
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414ed7
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414ed2
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ebx, dword [eax + 4]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp - 0x1c]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414ecb
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x414ed7
mov ecx, edx
call dword [ebp - 0x3c]
jmp 0x414ed7
mov ecx, edx
call dword [ebp - 0x3c]
mov byte [ebp - 4], 0xa
add ebx, 0xfffffff0
mov eax, edi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x414f19
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414f17
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414f17
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [ecx + 4]
call ebx
jmp 0x414f1f
call edx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 9
mov eax, edi
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414f77
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x1c], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414f71
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414f6a
push 0
push dword [edx + 4]
call ebx
jmp 0x414f77
mov ecx, edx
call dword [ebp - 0x1c]
jmp 0x414f77
push ecx
mov ecx, edx
call dword [ebp - 0x1c]
mov byte [ebp - 4], 6
mov eax, edi
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x414fcf
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x34], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x414fc9
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x414fc2
push 0
push dword [edx + 4]
call ebx
jmp 0x414fcf
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x414fcf
push ecx
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 4
mov eax, edi
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x415027
mov edx, dword [ecx]
mov eax, dword [edx]
mov edx, dword [eax + 4]
mov dword [ebp - 0x34], edx
mov edx, dword [ecx]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415021
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x3c]
push ecx
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x41501a
push 0
push dword [edx + 4]
call ebx
jmp 0x415027
mov ecx, edx
call dword [ebp - 0x34]
jmp 0x415027
push ecx
mov ecx, edx
call dword [ebp - 0x34]
mov byte [ebp - 4], 3
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x415063
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415061
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x415061
push 0
push dword [ecx + 4]
call ebx
jmp 0x415063
call edx
mov byte [ebp - 4], 2
mov eax, edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4150a4
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4150a0
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4150a0
push 0
push dword [edx + 4]
call ebx
jmp 0x4150a4
mov ecx, edx
call esi
mov byte [ebp - 4], 1
mov eax, edi
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x4150e5
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4150e1
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x4150e1
push 0
push dword [edx + 4]
call ebx
jmp 0x4150e5
mov ecx, edx
call esi
mov byte [ebp - 4], 0
mov eax, edi
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x415126
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415122
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x415122
push 0
push dword [edx + 4]
call ebx
jmp 0x415126
mov ecx, edx
call esi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x14]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], edi
dec edi
test edi, edi
jg 0x415168
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x415164
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x415164
push 0
push dword [edx + 4]
call ebx
jmp 0x415168
mov ecx, edx
call esi
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret