Function at 0x444e90
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4e2388
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push eax
mov ebp, ecx
push 0x51d8fc
push SysReAllocString
mov dword [esp + 0x28], ebp
mov dword [esp + 0x24], 0x104
call edi
xor ebx, ebx
test eax, eax
jne 0x444eff
mov ecx, dword [esp + 0x10]
push 9
push str.htmlfile
push 1
push ebx
push 0x5269d8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0x51d8f4
push SysReAllocString
call edi
test eax, eax
jne 0x444f39
mov ecx, dword [esp + 0x10]
push 9
push str.htmlfile
push 1
push ebx
push 0x5269d8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x138]
mov ecx, ebp
push esi
push str.htmlfile_shell
call fcn.00445930
lea eax, [esp + 0x10]
push eax
push str..url
push SysReAllocString
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
or edi, 0xffffffff
test eax, eax
jne 0x444ff0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
push ebx
push 0x5269d8
push eax
mov dword [esp + 0x30], 0x104
call ebp
mov esi, str.InternetShortcut
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x444fbc
cmp cl, bl
je 0x444fb8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x444fbc
add eax, 2
add esi, 2
cmp cl, bl
jne 0x444f98
xor eax, eax
jmp 0x444fc0
sbb eax, eax
sbb eax, edi
cmp eax, ebx
je 0x444fde
mov eax, dword [esp + 0x10]
push 0x10
push str.InternetShortcut
push 1
push ebx
push 0x5269d8
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x138]
mov ecx, dword [esp + 0x1c]
push esi
push str.InternetShortcut_shell
call fcn.00445930
lea edx, [esp + 0x10]
push edx
push str..mht
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44509d
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
push ecx
push ebx
push ebx
push 0x5269d8
push edx
mov dword [esp + 0x30], 0x104
call ebp
mov esi, str.mhtmlfile
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x445069
cmp cl, bl
je 0x445065
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x445069
add eax, 2
add esi, 2
cmp cl, bl
jne 0x445045
xor eax, eax
jmp 0x44506d
sbb eax, eax
sbb eax, edi
cmp eax, ebx
je 0x44508b
mov eax, dword [esp + 0x10]
push 0xa
push str.mhtmlfile
push 1
push ebx
push 0x5269d8
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x138]
lea edx, [esp + 0x10]
push edx
push str..mhtml
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44513f
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
push ecx
push ebx
push ebx
push 0x5269d8
push edx
mov byte [esp + 0x3c], bl
mov dword [esp + 0x30], 0x104
call ebp
mov esi, str.mhtmlfile
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x44510b
cmp cl, bl
je 0x445107
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x44510b
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4450e7
xor eax, eax
jmp 0x44510f
sbb eax, eax
sbb eax, edi
cmp eax, ebx
je 0x44512d
mov eax, dword [esp + 0x10]
push 0xa
push str.mhtmlfile
push 1
push ebx
push 0x5269d8
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x138]
mov ecx, dword [esp + 0x1c]
push esi
push str.mhtmlfile_shell
call fcn.00445930
mov ecx, dword [esp + 0x1c]
push esi
push str.http_shell
call fcn.00445930
mov ecx, dword [esp + 0x1c]
push esi
push str.https_shell
call fcn.00445930
mov ecx, dword [esp + 0x1c]
push esi
push str.file_shell
call fcn.00445930
mov ecx, dword [esp + 0x1c]
push esi
push str.ftp_shell
call fcn.00445930
cmp esi, ebx
je 0x4452f8
lea edx, [esp + 0x10]
push edx
push 0x51efa4
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x445243
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x24]
push eax
push ecx
push ebx
push ebx
push 0x5269d8
push edx
mov dword [esp + 0x30], 0x104
call ebp
mov esi, str.htmlfile
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4451fc
cmp cl, bl
je 0x4451f8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4451fc
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4451d8
xor eax, eax
jmp 0x445200
sbb eax, eax
sbb eax, edi
cmp eax, ebx
je 0x44521e
mov eax, dword [esp + 0x10]
push 9
push str.htmlfile
push 1
push ebx
push 0x5269d8
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push 0xa
push str.text_html
push 1
push ebx
push str.Content_Type
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push str..shtml
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4452f8
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
push ebx
push 0x5269d8
push eax
mov byte [esp + 0x3c], bl
mov dword [esp + 0x30], 0x104
call ebp
mov esi, str.htmlfile
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4452b1
cmp cl, bl
je 0x4452ad
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4452b1
add eax, 2
add esi, 2
cmp cl, bl
jne 0x44528d
xor eax, eax
jmp 0x4452b5
sbb eax, eax
sbb eax, edi
cmp eax, ebx
je 0x4452d3
mov eax, dword [esp + 0x10]
push 9
push str.htmlfile
push 1
push ebx
push 0x5269d8
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push 0xa
push str.text_html
push 1
push ebx
push str.Content_Type
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
mov esi, 3
cmp dword [eax + 0x258], esi
jl 0x44579c
cmp dword [esp + 0x138], ebx
je 0x445714
push str.GreenBrowser_HTML
push 0x5269d8
push str.SoftwareClassesGB.Association.HTML
push SysReAllocString
call fcn.00417670
add esp, 0x10
lea ecx, [esp + 0x14]
push 0x527028
push 0x51c578
push ecx
call fcn.004c5a90
push str.GreenBrowser.exe____1_
lea edx, [esp + 0x20]
push eax
push edx
mov dword [esp + 0x13c], ebx
call fcn.004c5a1c
mov eax, dword [eax]
mov byte [esp + 0x130], 1
push eax
push 0x5269d8
push str.SoftwareClassesGB.Association.HTMLShellopencommand
push SysReAllocString
call fcn.00417670
add esp, 0x10
lea ecx, [esp + 0x1c]
mov byte [esp + 0x130], bl
call fcn.004c5787
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], edi
call fcn.004c5787
push str.GB.Association.HTML
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push SysReAllocString
call fcn.00417670
push str.GB.Association.HTML
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpsUserChoice
push SysReAllocString
call fcn.00417670
push 0x51ee2c
push 0x5269d8
push str.SOFTWAREClientsStartMenuInternetGreenBrowser
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
push 0x51ee2c
push str.ApplicationDescription
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilities
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
add esp, 0x40
push 0x51ee2c
push str.ApplicationName
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilities
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
add esp, 0x10
lea eax, [esp + 0x14]
push str.GreenBrowser.exe_0
push 0x527028
push eax
call fcn.004c5a1c
mov eax, dword [eax]
mov dword [esp + 0x130], 2
push eax
push str.ApplicationIcon
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilities
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], edi
call fcn.004c5787
push str.GB.Association.HTML
push 0x51d8fc
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilitiesFileAssociations
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
push str.GB.Association.HTML
push 0x51d8f4
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilitiesFileAssociations
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
push str.GB.Association.HTML
push str..mht
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilitiesFileAssociations
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
push str.GB.Association.HTML
push str..mhtm
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilitiesFileAssociations
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
add esp, 0x40
push str.GB.Association.HTML
push str..mhtml
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilitiesFileAssociations
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
push 0x51ee2c
push str.StartmenuInternet
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilitiesStartmenu
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
push str.GB.Association.HTML
push 0x51d888
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilitiesUrlAssociations
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
push str.GB.Association.HTML
push str.https
push str.SOFTWAREClientsStartMenuInternetGreenBrowserCapabilitiesUrlAssociations
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
add esp, 0x40
lea ecx, [esp + 0x14]
push str.GreenBrowser.exe_0
push 0x527028
push ecx
call fcn.004c5a1c
mov eax, dword [eax]
mov dword [esp + 0x130], esi
push eax
push 0x5269d8
push str.SOFTWAREClientsStartMenuInternetGreenBrowserDefaultIcon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], edi
call fcn.004c5787
push str.GreenBrowser.exe
lea edx, [esp + 0x18]
push 0x527028
push edx
call fcn.004c5a1c
mov eax, dword [eax]
mov dword [esp + 0x130], 4
push eax
push str.ReinstallCommand
push str.SOFTWAREClientsStartMenuInternetGreenBrowserInstallInfo
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], edi
call fcn.004c5787
push str.GreenBrowser.exe
lea eax, [esp + 0x18]
push 0x527028
push eax
call fcn.004c5a1c
mov eax, dword [eax]
mov dword [esp + 0x130], 5
push eax
push str.ShowIconsCommand
push str.SOFTWAREClientsStartMenuInternetGreenBrowserInstallInfo
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], edi
call fcn.004c5787
push str.GreenBrowser.exe
lea ecx, [esp + 0x18]
push 0x527028
push ecx
call fcn.004c5a1c
mov eax, dword [eax]
mov dword [esp + 0x130], 6
push eax
push str.HideIconsCommand
push str.SOFTWAREClientsStartMenuInternetGreenBrowserInstallInfo
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
add esp, 0x10
lea ecx, [esp + 0x14]
mov dword [esp + 0x130], edi
call fcn.004c5787
push 1
push 1
push str.IconsVisible
push str.SOFTWAREClientsStartMenuInternetGreenBrowserInstallInfo
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417480
add esp, 0x14
lea edx, [esp + 0x20]
push str.GreenBrowser.exe
push 0x527028
push edx
call fcn.004c5a1c
mov eax, dword [eax]
mov dword [esp + 0x130], 7
push eax
push 0x5269d8
push str.SOFTWAREClientsStartMenuInternetGreenBrowserShellopencommand
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
add esp, 0x10
lea ecx, [esp + 0x20]
mov dword [esp + 0x130], edi
call fcn.004c5787
push str.SoftwareClientsStartMenuInternetGreenBrowserCapabilities
push 0x51cc7c
push str.SOFTWARERegisteredApplications
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417670
push str.htmlfile
push str.Progid
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.htmUserChoice
push SysReAllocString
call fcn.00417670
push str.htmlfile
push str.Progid
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.htmlUserChoice
push SysReAllocString
call fcn.00417670
add esp, 0x30
jmp 0x44579c
push str.SoftwareClassesGB.Association.HTML
push SysReAllocString
call fcn.004176e0
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push SysReAllocString
call fcn.00417780
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpsUserChoice
push SysReAllocString
call fcn.00417780
push str.SOFTWAREClientsStartMenuInternetGreenBrowser
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004176e0
push 0x51cc7c
push str.SOFTWARERegisteredApplications
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417780
push str.Progid
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.htmUserChoice
push SysReAllocString
call fcn.00417780
add esp, 0x40
push str.Progid
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.htmlUserChoice
push SysReAllocString
call fcn.00417780
add esp, 0xc
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x124
ret 4