Function at 0x4089eb
Capabilities:
Delete registry key
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
push edi
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x10]
push 0x426c30
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00403cbc
add esp, 0x10
lea eax, [ebp - 0x108]
mov ebx, SysReAllocString
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
xor ecx, ecx
lea eax, [ebp - 0x210]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
lea eax, [ebp - 0x108]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call ebx
test eax, eax
je 0x408a75
xor eax, eax
inc eax
jmp 0x408cbe
push edi
push str._sFile
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00403cbc
lea eax, [ebp - 0x108]
push eax
call fcn.00411620
add esp, 0x14
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push 0x426a23
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x408aca
push 2
jmp 0x408c90
push dword [ebp - 0x210]
call edi
lea eax, [ebp - 0x108]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
xor ecx, ecx
lea eax, [ebp - 0x210]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
lea eax, [ebp - 0x108]
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x408cbb
push dword [ebp - 0x214]
call fcn.00411620
pop ecx
inc eax
push eax
push dword [ebp - 0x214]
push 1
push 0
push 0x426a23
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x408b41
push 4
jmp 0x408c90
push dword [ebp - 0x210]
call edi
lea eax, [ebp - 0x108]
push eax
push str._sDefaultIcon
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00403cbc
add esp, 0x10
lea eax, [ebp - 0x210]
xor ecx, ecx
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x408cbb
test esi, esi
je 0x408b9a
cmp byte [esi], al
jne 0x408b9f
mov esi, 0x4266e8
push esi
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push str._s__s
push 0x104
push eax
call fcn.00403cbc
lea eax, [ebp - 0x20c]
push eax
call fcn.00411620
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0x18
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x426a23
push dword [ebp - 0x210]
call esi
test eax, eax
jne 0x408b3a
push dword [ebp - 0x210]
call edi
lea eax, [ebp - 0x108]
push eax
push str._s_shellopencommand
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.00403cbc
add esp, 0x10
lea eax, [ebp - 0x210]
xor ecx, ecx
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call ebx
test eax, eax
je 0x408c44
push 5
jmp 0x408cbd
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push str.__s_____1_
push 0x104
push eax
call fcn.00403cbc
lea eax, [ebp - 0x20c]
push eax
call fcn.00411620
add esp, 0x14
xor ebx, ebx
inc eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x426a23
push dword [ebp - 0x210]
call esi
test eax, eax
je 0x408c9d
push 6
pop esi
push dword [ebp - 0x210]
call edi
mov eax, esi
jmp 0x408cbe
push dword [ebp - 0x210]
call edi
push ebx
push ebx
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
xor eax, eax
jmp 0x408cbe
push 3
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d603
leave
ret