Function at 0x4259e6
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x218], ecx
push esi
mov esi, ebx
mov dword [ebp - 0x210], ebx
push edi
mov edi, dword [ebp + 8]
lea edx, [esi + 2]
mov edi, edi
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x425a16
sub esi, edx
sar esi, 1
lea eax, [esi + 0x14]
cmp eax, 0x104
jbe 0x425a48
push 0
push 0x400023db
call fcn.0040c5a2
add esp, 8
mov eax, 1
jmp 0x425c79
mov esi, 0x104
lea ecx, [ebp - 0x20c]
push ebx
mov edx, esi
call fcn.00411040
mov edx, esi
lea eax, [ebp - 0x20c]
lea ecx, [ecx]
cmp word [eax], 0
je 0x425a74
add eax, 2
sub edx, 1
jne 0x425a66
mov eax, esi
mov ecx, edx
sub eax, edx
neg ecx
sbb ecx, ecx
and ecx, eax
test edx, edx
je 0x425ad4
lea eax, [ebp - 0x20c]
lea eax, [eax + ecx*2]
sub esi, ecx
je 0x425acc
mov edx, 0x403a1c
mov ecx, 0x7ffffffe
sub edx, eax
test ecx, ecx
je 0x425ac8
movzx ebx, word [edx + eax]
test bx, bx
mov ebx, dword [ebp - 0x210]
je 0x425ac8
movzx ebx, word [edx + eax]
dec ecx
mov word [eax], bx
add eax, 2
mov ebx, dword [ebp - 0x210]
sub esi, 1
jne 0x425a9d
jmp 0x425acc
test esi, esi
jne 0x425acf
sub eax, 2
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x214]
push eax
push 0x2000000
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x425bdd
test edi, edi
je 0x425bc8
cmp word [edi], 0
je 0x425bc8
lea esi, [ebp - 0x20c]
movzx eax, word [esi]
mov ecx, eax
mov dword [ebp - 0x210], ecx
test ax, ax
je 0x425b4e
mov edx, eax
movzx ecx, dx
mov dword [ebp - 0x210], ecx
cmp dx, 0x5c
je 0x425b4e
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x210], ecx
test ax, ax
jne 0x425b29
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0x2000000
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov dword [ebp - 0x21c], eax
test eax, eax
jne 0x425bad
mov eax, dword [ebp - 0x210]
test ax, ax
je 0x425bdd
push dword [ebp - 0x214]
mov word [esi], ax
add esi, 2
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0x425b17
push ebx
push 1
push 0x400023a5
call fcn.0040c5a2
mov eax, dword [ebp - 0x21c]
add esp, 0xc
jmp 0x425c79
push ebx
push 1
push 0x400023a5
call fcn.0040c5a2
add esp, 0xc
jmp 0x425c77
test edi, edi
je 0x425c47
cmp word [edi], 0
je 0x425c47
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425bec
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 2
push 0
push 0x4024ac
push dword [ebp - 0x214]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x425c2d
push edi
push ebx
push 0x40392c
call fcn.004125d9
jmp 0x425c68
push 0
push esi
call fcn.0040c5a2
push ebx
push 1
push 0x235d
call fcn.0040c5a2
add esp, 0x14
jmp 0x425c6b
push 0
push dword [ebp - 0x214]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x425c6b
push ebx
push 1
push 0x400023a5
call fcn.0040c5a2
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416fd0
mov esp, ebp
pop ebp
ret 4