Function at 0x1007453
Capabilities:
Delete registry key
Persist via default file association registry key
Set registry value

Disassembly:
push 0x230
mov eax, 0x1020caf
call fcn.0101d9df
mov esi, ecx
lea ecx, [ebp - 0x22c]
call sub.MFC42u.dll_CString::CString
xor ebx, ebx
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], ebx
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 2
call sub.MFC42u.dll_CString::CString
xor eax, eax
push 0x208
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov byte [ebp - 4], 3
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x23c]
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 4
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 5
call sub.MFC42u.dll_CString::CString
push ebx
mov ecx, esi
mov byte [ebp - 4], 6
call sub.MFC42u.dll_CWinApp::RegisterShellFileTypes
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 8]
push 0x105
lea ecx, [ebp - 0x21c]
push ecx
push eax
call fcn.0101e0dd
test eax, eax
je 0x1007565
push str.__P___1_
lea eax, [ebp - 0x21c]
push eax
mov edi, 0x1001f58
lea eax, [ebp - 0x22c]
push edi
push eax
call sub.MFC42u.dll_CString::Format
push str.___1_
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x228]
push edi
push eax
call sub.MFC42u.dll_CString::Format
push 0x1001cb0
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x230]
push edi
push eax
call sub.MFC42u.dll_CString::Format
add esp, 0x30
mov ecx, esi
call sub.MFC42u.dll_CWinApp::GetFirstDocTemplatePosition
mov dword [ebp - 0x238], eax
cmp eax, ebx
je 0x1007696
lea eax, [ebp - 0x238]
push eax
mov ecx, esi
call sub.MFC42u.dll_CWinApp::GetNextDocTemplate
mov esi, eax
mov eax, dword [esi]
push 5
lea ecx, [ebp - 0x224]
push ecx
mov ecx, esi
call dword [eax + 0x6c]
test eax, eax
je 0x1007696
mov eax, dword [ebp - 0x224]
cmp dword [eax - 8], ebx
je 0x1007696
mov eax, dword [esi]
push 6
lea ecx, [ebp - 0x234]
push ecx
mov ecx, esi
call dword [eax + 0x6c]
test eax, eax
jne 0x10075d7
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x234]
call fcn.0101c0f6
push dword [ebp - 0x224]
lea eax, [ebp - 0x220]
push str._s_shellopencommand
push eax
call sub.MFC42u.dll_CString::Format
mov eax, dword [ebp - 0x228]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
add esp, 0xc
push dword [eax - 8]
mov esi, 0x80000000
push eax
push 1
push dword [ebp - 0x220]
push esi
call edi
push dword [ebp - 0x224]
lea eax, [ebp - 0x220]
push str._s_shellprintcommand
push eax
call sub.MFC42u.dll_CString::Format
mov eax, dword [ebp - 0x22c]
add esp, 0xc
push dword [eax - 8]
push eax
push 1
push dword [ebp - 0x220]
push esi
call edi
push dword [ebp - 0x224]
lea eax, [ebp - 0x220]
push str._sDefaultIcon
push eax
call sub.MFC42u.dll_CString::Format
mov eax, dword [ebp - 0x230]
add esp, 0xc
push dword [eax - 8]
push eax
push 1
push dword [ebp - 0x220]
push esi
call edi
push dword [ebp - 0x224]
lea eax, [ebp - 0x220]
push str._s_shellopenddeexec
push eax
call sub.MFC42u.dll_CString::Format
add esp, 0xc
push dword [ebp - 0x220]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 5
call fcn.0101bfe2
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 4
call fcn.0101bfe2
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 3
call fcn.0101bfe2
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 2
call fcn.0101bfe2
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.0101bfe2
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], bl
call fcn.0101bfe2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x22c]
call fcn.0101bfe2
call fcn.0101da71
ret