Function at 0x435130
Capabilities:
Check os version
Delete registry key
Delete registry value
Persist via contextmenuhandlers registry key
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20dc
call fcn.00464ee0
mov eax, dword [0x5c24ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x20b8], ecx
mov dword [ebp - 0x20dc], 0
mov ecx, 0x1e
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
lea edi, [ebp - 0x22c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x4e
push 0
lea eax, [ebp - 0x1b2]
push eax
call fcn.00485370
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x3bc], cx
push 0xc6
push 0
lea edx, [ebp - 0x3ba]
push edx
call fcn.00485370
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2f4], ax
push 0xc6
push 0
lea ecx, [ebp - 0x2f2]
push ecx
call fcn.00485370
add esp, 0xc
xor edx, edx
mov word [ebp - 0x484], dx
push 0xc6
push 0
lea eax, [ebp - 0x482]
push eax
call fcn.00485370
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x7a4], cx
push 0x18e
push 0
lea edx, [ebp - 0x7a2]
push edx
call fcn.00485370
add esp, 0xc
xor eax, eax
mov word [ebp - 0xac4], ax
push 0x18e
push 0
lea ecx, [ebp - 0xac2]
push ecx
call fcn.00485370
add esp, 0xc
xor edx, edx
mov word [ebp - 0x1f9c], dx
push 0x7ce
push 0
lea eax, [ebp - 0x1f9a]
push eax
call fcn.00485370
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0xc54], cx
push 0x18e
push 0
lea edx, [ebp - 0xc52]
push edx
call fcn.00485370
add esp, 0xc
xor eax, eax
mov word [ebp - 0x934], ax
push 0x18e
push 0
lea ecx, [ebp - 0x932]
push ecx
call fcn.00485370
add esp, 0xc
xor edx, edx
mov word [ebp - 0xde4], dx
push 0x18e
push 0
lea eax, [ebp - 0xde2]
push eax
call fcn.00485370
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x124], cx
push 0xfe
push 0
lea edx, [ebp - 0x122]
push edx
call fcn.00485370
add esp, 0xc
xor eax, eax
mov word [ebp - 0x614], ax
push 0x18e
push 0
lea ecx, [ebp - 0x612]
push ecx
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x20b4], 0
xor edx, edx
mov word [ebp - 0x13bc], dx
push 0xfe
push 0
lea eax, [ebp - 0x13ba]
push eax
call fcn.00485370
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x5624bc
lea eax, [ebp - 0x124]
push eax
call fcn.00434b60
add esp, 0x10
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x3bc]
push edx
call fcn.0048dcd9
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x3bc]
push ecx
call fcn.0048ee96
add esp, 8
push 0x5624c8
lea edx, [ebp - 0x3bc]
push edx
call fcn.0048ee96
add esp, 8
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.0048dcd9
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x2f4]
push eax
call fcn.0048ee96
add esp, 8
push str.UserChoice
lea ecx, [ebp - 0x2f4]
push ecx
call fcn.0048ee96
add esp, 8
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x484]
push eax
call fcn.0048dcd9
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x484]
push edx
call fcn.0048ee96
add esp, 8
push str.OpenWithList
lea eax, [ebp - 0x484]
push eax
call fcn.0048ee96
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x22c]
push edx
call fcn.0048ee96
add esp, 8
mov eax, dword [ebp - 0x20b8]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x7a4]
push edx
call fcn.0048dcd9
add esp, 8
push 0x562520
lea eax, [ebp - 0x7a4]
push eax
call fcn.0048ee96
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x7a4]
push edx
call fcn.0048ee96
add esp, 8
lea eax, [ebp - 0x7a4]
push eax
lea ecx, [ebp - 0xac4]
push ecx
call fcn.0048dcd9
add esp, 8
push str.OpenWithProgids
lea edx, [ebp - 0xac4]
push edx
call fcn.0048ee96
add esp, 8
mov eax, dword [ebp - 0x20b8]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x614]
push edx
call fcn.0048dcd9
add esp, 8
push 0x56256c
lea eax, [ebp - 0x614]
push eax
call fcn.0048ee96
add esp, 8
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x614]
push edx
call fcn.0048ee96
add esp, 8
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x1f9c]
push ecx
call fcn.0048dcd9
add esp, 8
push str.DefaultIcon
lea edx, [ebp - 0x1f9c]
push edx
call fcn.0048ee96
add esp, 8
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0xc54]
push ecx
call fcn.0048dcd9
add esp, 8
push str._shellopencommand
lea edx, [ebp - 0xc54]
push edx
call fcn.0048ee96
add esp, 8
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x934]
push ecx
call fcn.0048dcd9
add esp, 8
push str._shellexContextMenuHandlers_
lea edx, [ebp - 0x934]
push edx
call fcn.0048ee96
add esp, 8
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0xde4]
push ecx
call fcn.0048dcd9
add esp, 8
push str._shellexDropHandler
lea edx, [ebp - 0xde4]
push edx
call fcn.0048ee96
add esp, 8
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x435be8
xor ecx, ecx
mov word [ebp - 0x10b4], cx
push 0xc6
push 0
lea edx, [ebp - 0x10b2]
push edx
call fcn.00485370
add esp, 0xc
mov eax, dword [ebp + 0x20]
push eax
lea ecx, [ebp - 0x934]
push ecx
call fcn.0048ee96
add esp, 8
lea edx, [ebp - 0x124]
push edx
push 0x562640
lea eax, [ebp - 0x2f4]
push eax
push reloc.WS2_32.dll_accept
mov ecx, dword [ebp - 0x20b8]
call fcn.004361d0
movzx ecx, al
test ecx, ecx
je 0x4356c9
push 0
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x3bc]
push eax
push reloc.WS2_32.dll_accept
mov ecx, dword [ebp - 0x20b8]
call fcn.004362d0
movzx ecx, al
test ecx, ecx
je 0x4356c9
lea edx, [ebp - 0x124]
push edx
push 0x562650
lea eax, [ebp - 0x7a4]
push eax
push reloc.WS2_32.dll_closesocket
mov ecx, dword [ebp - 0x20b8]
call fcn.004361d0
movzx ecx, al
test ecx, ecx
je 0x4356c9
push 0
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0xac4]
push eax
push reloc.WS2_32.dll_closesocket
mov ecx, dword [ebp - 0x20b8]
call fcn.004362d0
movzx ecx, al
test ecx, ecx
je 0x4356c9
mov edx, dword [ebp + 0x14]
push edx
push 0x562654
lea eax, [ebp - 0x1f9c]
push eax
push reloc.WS2_32.dll_closesocket
mov ecx, dword [ebp - 0x20b8]
call fcn.004361d0
movzx ecx, al
test ecx, ecx
je 0x4356c9
mov edx, dword [ebp + 0x10]
push edx
push 0x562658
lea eax, [ebp - 0xc54]
push eax
push reloc.WS2_32.dll_closesocket
mov ecx, dword [ebp - 0x20b8]
call fcn.004361d0
movzx ecx, al
test ecx, ecx
je 0x4356c9
push 0
push 0
lea edx, [ebp - 0x934]
push edx
push reloc.WS2_32.dll_closesocket
mov ecx, dword [ebp - 0x20b8]
call fcn.004362d0
movzx eax, al
test eax, eax
je 0x4356c9
mov ecx, dword [ebp + 0x20]
push ecx
push 0x56265c
lea edx, [ebp - 0xde4]
push edx
push reloc.WS2_32.dll_closesocket
mov ecx, dword [ebp - 0x20b8]
call fcn.004361d0
movzx eax, al
test eax, eax
je 0x4356c9
mov ecx, dword [ebp + 0x28]
mov byte [ecx], 0
jmp 0x435dd5
mov edx, dword [ebp + 0x28]
mov byte [edx], 1
lea eax, [ebp - 0x2f4]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x3bc]
push ecx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea edx, [ebp - 0x484]
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x22c]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x22c]
push ecx
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [ebp - 0x20c4], 1
mov dword [ebp - 0x20bc], 0
lea edx, [ebp - 0x20bc]
push edx
push 0
lea eax, [ebp - 0x20c4]
push eax
push 0x562660
mov ecx, dword [ebp + 8]
push ecx
push connect
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x20d4], eax
cmp dword [ebp - 0x20d4], 0
jne 0x4357d0
mov edx, dword [ebp - 0x20bc]
push edx
call fcn.0048dd00
add esp, 4
mov dword [ebp - 0x20b4], eax
mov eax, dword [ebp - 0x20bc]
push eax
push 0
mov ecx, dword [ebp - 0x20b4]
push ecx
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x20c4], 1
lea edx, [ebp - 0x20bc]
push edx
mov eax, dword [ebp - 0x20b4]
push eax
lea ecx, [ebp - 0x20c4]
push ecx
push 0x562664
mov edx, dword [ebp + 8]
push edx
push connect
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x20b4], 0
je 0x435878
mov eax, dword [ebp - 0x20b4]
push eax
call fcn.00488e51
add esp, 4
test eax, eax
jbe 0x435878
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x20b4]
push edx
call fcn.0048efc8
add esp, 8
test eax, eax
je 0x435878
xor eax, eax
mov word [ebp - 0x15c4], ax
push 0x206
push 0
lea ecx, [ebp - 0x15c2]
push ecx
call fcn.00485370
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
push 0x562668
lea eax, [ebp - 0x15c4]
push eax
call fcn.00434b60
add esp, 0xc
mov ecx, dword [ebp - 0x20b4]
push ecx
call fcn.00488e51
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp - 0x20b4]
push eax
push 1
lea ecx, [ebp - 0x15c4]
push ecx
mov edx, dword [ebp + 8]
push edx
push connect
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x124]
push eax
call fcn.00488e51
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x124]
push edx
push 1
push 0x56267c
lea eax, [ebp - 0x7a4]
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0
push 0
push 0
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0xac4]
push edx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp + 0x14]
push eax
call fcn.00488e51
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
push 0x562680
lea eax, [ebp - 0x1f9c]
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00488e51
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0x562684
lea ecx, [ebp - 0xc54]
push ecx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0
push 0
push 1
push 0
lea edx, [ebp - 0x934]
push edx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp + 0x20]
push eax
call fcn.00488e51
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x20]
push edx
push 1
push 0x562688
lea eax, [ebp - 0xde4]
push eax
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0
push 0
push 0
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x3bc]
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x124]
push eax
call fcn.00488e51
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x124]
push edx
push 1
push str.ProgId
lea eax, [ebp - 0x2f4]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x20b0], 0
push 0x110
push 0
lea ecx, [ebp - 0x20ac]
push ecx
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x20b0], 0x114
lea edx, [ebp - 0x20b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x20ac], 6
jb 0x435ba6
cmp dword [ebp - 0x20a8], 2
jb 0x435ba6
mov byte [ebp - 0x24], 0
xor eax, eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
xor ecx, ecx
mov word [ebp - 0x164], cx
push 0x3e
push 0
lea edx, [ebp - 0x162]
push edx
call fcn.00485370
add esp, 0xc
xor eax, eax
mov word [ebp - 0x17cc], ax
push 0x206
push 0
lea ecx, [ebp - 0x17ca]
push ecx
call fcn.00485370
add esp, 0xc
xor edx, edx
mov word [ebp - 0x12bc], dx
push 0x206
push 0
lea eax, [ebp - 0x12ba]
push eax
call fcn.00485370
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x12bc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
lea edx, [ebp - 0x12bc]
push edx
call fcn.0042f540
add esp, 8
xor ecx, ecx
mov word [eax + 2], cx
push 0x56269c
lea edx, [ebp - 0x12bc]
push edx
push 0x5626ac
lea eax, [ebp - 0x17cc]
push eax
call fcn.00434b60
add esp, 0x10
lea ecx, [ebp - 0x17cc]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x20cc], eax
cmp dword [ebp - 0x20cc], 0
je 0x435b40
push str.HashAssociation
mov edx, dword [ebp - 0x20cc]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x20d0], eax
cmp dword [ebp - 0x20d0], 0
je 0x435b31
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x20d0]
add esp, 0xc
jmp 0x435b3e
push str.file_exts_registration_load_hash_association_dll_function_failed.
call fcn.0047416c
add esp, 4
jmp 0x435b4d
push str.file_exts_registration_load_hash_association_dll_failed.
call fcn.0047416c
add esp, 4
lea eax, [ebp - 0x24]
push eax
call fcn.00489270
add esp, 4
test eax, eax
jbe 0x435ba4
lea ecx, [ebp - 0x164]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.0046f9f4
add esp, 8
lea eax, [ebp - 0x124]
push eax
call fcn.00488e51
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x164]
push edx
push 1
push str.Hash
lea eax, [ebp - 0x2f4]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x435be3
cmp dword [ebp - 0x20ac], 6
jae 0x435be3
lea ecx, [ebp - 0x124]
push ecx
call fcn.00488e51
add esp, 4
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x124]
push eax
push 1
push 0x5627cc
lea ecx, [ebp - 0x22c]
push ecx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x435db3
lea edx, [ebp - 0x2f4]
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x3bc]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x484]
push ecx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea edx, [ebp - 0x22c]
push edx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x22c]
push eax
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea ecx, [ebp - 0x124]
push ecx
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [ebp - 0x20c8], 1
mov dword [ebp - 0x20c0], 0
xor edx, edx
mov word [ebp - 0xfec], dx
push 0x206
push 0
lea eax, [ebp - 0xfea]
push eax
call fcn.00485370
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
push str._sBackup
lea edx, [ebp - 0xfec]
push edx
call fcn.00434b60
add esp, 0xc
lea eax, [ebp - 0x20c0]
push eax
push 0
lea ecx, [ebp - 0x20c8]
push ecx
lea edx, [ebp - 0xfec]
push edx
mov eax, dword [ebp + 8]
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x20d8], eax
cmp dword [ebp - 0x20d8], 0
jne 0x435d36
mov ecx, dword [ebp - 0x20c0]
push ecx
call fcn.0048dd00
add esp, 4
mov dword [ebp - 0x20b4], eax
mov edx, dword [ebp - 0x20c0]
push edx
push 0
mov eax, dword [ebp - 0x20b4]
push eax
call fcn.00485370
add esp, 0xc
mov dword [ebp - 0x20c8], 1
lea ecx, [ebp - 0x20c0]
push ecx
mov edx, dword [ebp - 0x20b4]
push edx
lea eax, [ebp - 0x20c8]
push eax
lea ecx, [ebp - 0xfec]
push ecx
mov edx, dword [ebp + 8]
push edx
push connect
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [ebp - 0x20b4], 0
je 0x435db3
mov eax, dword [ebp - 0x20b4]
push eax
call fcn.00488e51
add esp, 4
test eax, eax
jbe 0x435db3
lea ecx, [ebp - 0x124]
push ecx
mov edx, dword [ebp - 0x20b4]
push edx
call fcn.0048efc8
add esp, 8
test eax, eax
je 0x435d9d
mov eax, dword [ebp - 0x20b4]
push eax
call fcn.00488e51
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp - 0x20b4]
push edx
push 1
push 0x5627e4
mov eax, dword [ebp + 8]
push eax
push connect
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea ecx, [ebp - 0xfec]
push ecx
mov edx, dword [ebp + 8]
push edx
push connect
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp dword [ebp - 0x20b4], 0
je 0x435dd5
mov eax, dword [ebp - 0x20b4]
push eax
call fcn.0048dcfb
add esp, 4
mov dword [ebp - 0x20b4], 0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00464e95
mov esp, ebp
pop ebp
ret 0x24