Function at 0x5008f0
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
mov ecx, dword [0x5a1afc]
sub esp, 0x4f4
push 0x104
lea eax, [esp + 0x3f4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x589ba4]
test eax, eax
je 0x500951
mov edx, 0x5747a0
mov ecx, str.DisplayName
call fcn.0052d920
lea edx, [esp + 0x3f0]
push edx
lea eax, [esp + 0xc]
push str.__s___uninstall
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 8]
mov ecx, str.UninstallString
call fcn.0052d920
mov eax, dword [0x589c68]
test eax, eax
jne 0x50096b
call fcn.0052da40
mov eax, 1
add esp, 0x4f4
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0x10]
push ecx
push str..cha
push bind
call edi
test eax, eax
je 0x500997
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4f4
ret
mov eax, dword [0x57b108]
mov edx, dword [str.ChatFile]
mov cl, byte [0x57b10c]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
mov byte [esp + 0x20], cl
lea edx, [eax + 1]
jmp 0x5009c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5009c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x575c80
push eax
call ebx
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x50098a
lea edx, [esp + 0x10]
push edx
push str..chat
push bind
call edi
test eax, eax
jne 0x50098a
mov eax, dword [str.ChatFile]
mov dl, byte [0x57b10c]
mov ecx, dword [0x57b108]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x20], dl
mov dword [esp + 0x1c], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500a34
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0x575c80
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebp
test esi, esi
jne 0x50098a
mov eax, dword [str.ChatFile]
mov ecx, dword [0x57b108]
mov dl, byte [0x57b10c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x1c]
push ecx
push bind
mov byte [esp + 0x2c], dl
call edi
test eax, eax
jne 0x50098a
mov eax, dword [0x57b0fc]
mov edx, dword [str.Chat_File]
mov cx, word [0x57b100]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
mov word [esp + 0x20], cx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500ac0
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x575c80
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x50098a
mov ecx, 5
mov esi, str.ChatFileDefaultIcon
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x50098a
lea ecx, [esp + 0x400]
push ecx
lea edx, [esp + 0x1c]
push 0x575840
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500b40
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0x575c80
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebp
test esi, esi
jne 0x50098a
mov ecx, 7
mov esi, str.ChatFileShellopencommand
lea edi, [esp + 0x18]
lea eax, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x1c]
push ecx
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x50098a
lea edx, [esp + 0x400]
push edx
lea eax, [esp + 0x1c]
push str.__s___noconnect
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500bc0
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0x575c80
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call ebp
test esi, esi
jne 0x50098a
mov ecx, 7
mov esi, str.ChatFileShellopenddeexec
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x50098a
mov ax, word [0x57b088]
mov cl, byte [0x57b08a]
mov word [esp + 0x18], ax
lea eax, [esp + 0x18]
mov byte [esp + 0x1a], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500c38
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x575c80
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x50098a
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, 0xa
mov esi, str.ChatFileShellopenddeexecApplication
lea edi, [esp + 0x20]
push bind
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x50098a
mov cl, byte [eax + 0x589930]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x500c94
mov al, byte [esp + 0x18]
test al, al
jne 0x500cbf
mov ecx, dword [0x5747a0]
mov dl, byte [0x5747a4]
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500cc6
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0x575c80
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebp
test esi, esi
jne 0x50098a
mov ecx, 8
mov esi, str.ChatFileShellopenddeexecifexec
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x10]
push eax
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x1c]
push ecx
push bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x50098a
mov al, byte [0x57b08a]
mov dx, word [0x57b088]
mov byte [esp + 0x1a], al
lea eax, [esp + 0x18]
mov word [esp + 0x18], dx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500d41
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0x575c80
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call ebp
test esi, esi
jne 0x50098a
mov ecx, 8
mov esi, str.ChatFileShellopenddeexecTopic
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push bind
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x50098a
mov eax, dword [str.Connect]
mov ecx, dword [0x57b00c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], ecx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500dc0
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x575c80
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x50098a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push esi
push 0x20006
push esi
push 0x575c80
push esi
push str.SoftwareClassesirc
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x50098a
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x18]
push str.URL:IRC_Protocol
push ecx
call edi
lea eax, [esp + 0x20]
add esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500e40
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x50098a
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 3
push eax
push str.EditFlags
push edx
mov dword [esp + 0x2c], 2
call esi
test eax, eax
jne 0x50098a
lea eax, [esp + 0x18]
push 0x575c80
push eax
call edi
lea eax, [esp + 0x20]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500ea7
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push str.URL_Protocol
push edx
call esi
test eax, eax
jne 0x50098a
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0x575c80
push 0
push str.SoftwareClassesircDefaultIcon
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x50098a
lea eax, [esp + 0x400]
push eax
lea ecx, [esp + 0x1c]
push 0x575840
push ecx
call edi
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500f22
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x50098a
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0x575c80
push 0
push str.SoftwareClassesircShellopencommand
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x50098a
lea ecx, [esp + 0x400]
push ecx
lea edx, [esp + 0x1c]
push str.__s___noconnect
push edx
call edi
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x500fa0
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
jne 0x50098a
mov edx, dword [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0x575c80
push 0
push str.SoftwareClassesircShellopenddeexec
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x50098a
mov al, byte [0x57b08a]
mov dx, word [0x57b088]
mov byte [esp + 0x1a], al
lea eax, [esp + 0x18]
mov word [esp + 0x18], dx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x501016
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x50098a
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0x575c80
push 0
push str.SoftwareClassesircShellopenddeexecApplication
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x50098a
mov cl, byte [eax + 0x589930]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x501070
mov al, byte [esp + 0x18]
test al, al
jne 0x50109a
mov eax, dword [0x5747a0]
mov cl, byte [0x5747a4]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5010a1
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x50098a
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0x575c80
push 0
push str.SoftwareClassesircShellopenddeexecifexec
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x50098a
mov dl, byte [0x57b08a]
mov cx, word [0x57b088]
lea eax, [esp + 0x18]
mov byte [esp + 0x1a], dl
mov word [esp + 0x18], cx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x501118
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
jne 0x50098a
mov edx, dword [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0x575c80
push 0
push str.SoftwareClassesircShellopenddeexecTopic
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x50098a
mov eax, dword [0x57b00c]
mov edx, dword [str.Connect]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x501190
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x50098a
mov eax, dword [esp + 0x10]
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4f4
ret