Function at 0x461700
Capabilities:
Delete registry key
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x56800c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov ebx, ecx
push 0
push eax
call fcn.004bef30
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x20c]
call fcn.0041ce70
mov edi, eax
test edi, edi
je 0x4619e5
push esi
push 0
mov edx, str.SoftwareClasses.pdf
mov ecx, ebx
call fcn.00416c00
mov esi, eax
push 0
mov dword [ebp - 0x21c], esi
call fcn.004bf8aa
add esp, 8
test esi, esi
je 0x4617a0
mov edx, 0x4ef17c
mov ecx, esi
call fcn.00419570
test al, al
jne 0x4617a0
push esi
push str.previous.pdf
mov edx, str.SoftwareClassesSumatraPDF
mov ecx, ebx
call fcn.00416cc0
add esp, 8
mov ecx, str.PDF_Document
call fcn.00489000
mov edx, eax
test edx, edx
je 0x4617c6
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4617b5
sub ecx, esi
sar ecx, 1
jmp 0x4617c8
xor ecx, ecx
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.SoftwareClassesSumatraPDF
push ebx
call esi
push 0
mov edx, 0x4f5474
mov ecx, edi
call fcn.00419a10
mov edx, eax
add esp, 4
mov dword [ebp - 0x218], edx
test edx, edx
je 0x461825
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x214], eax
jmp 0x461810
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x461810
sub ecx, dword [ebp - 0x214]
sar ecx, 1
jmp 0x461827
xor ecx, ecx
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.SoftwareClassesSumatraPDFDefaultIcon
push ebx
call esi
push dword [ebp - 0x218]
call fcn.004bf8aa
add esp, 4
push 0xa
push str.open
push 1
push 0
push str.SoftwareClassesSumatraPDF_shell
push ebx
call esi
push edi
push str.__s_____1____
call fcn.00419f30
mov esi, eax
add esp, 8
test esi, esi
je 0x461887
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x461876
sub ecx, edx
sar ecx, 1
jmp 0x461889
xor ecx, ecx
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push str.SoftwareClassesSumatraPDF_shellopencommand
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
push edi
push str.__s___print_to_default____1_
sete byte [ebp - 0x20d]
call fcn.00419f30
push esi
mov dword [ebp - 0x214], eax
call fcn.004bf8aa
mov edx, dword [ebp - 0x214]
add esp, 0xc
test edx, edx
je 0x4618e5
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4618d4
sub ecx, esi
sar ecx, 1
jmp 0x4618e7
xor ecx, ecx
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.SoftwareClassesSumatraPDF_shellprintcommand
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push edi
push str.__s___print_to____2_____1_
call fcn.00419f30
mov esi, eax
mov eax, dword [ebp - 0x214]
push eax
call fcn.004bf8aa
add esp, 0xc
test esi, esi
je 0x461936
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x461925
sub ecx, edx
sar ecx, 1
jmp 0x461938
xor ecx, ecx
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push str.SoftwareClassesSumatraPDF_shellprinttocommand
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp byte [ebp - 0x20d], 0
je 0x4619d0
push 0x16
push 0x4ef17c
push 1
push 0
push str.SoftwareClasses.pdf
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 2
push 0x4ef194
push 1
push 0x4ef17c
push str.SoftwareClasses.pdfOpenWithProgids
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp ebx, 0x80000001
jne 0x4619d0
push 0x4ef17c
push str.Progid
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
mov ecx, ebx
call fcn.00416cc0
add esp, 8
push str.Application
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdf
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov ecx, ebx
call fcn.00416d10
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.pdfUserChoice
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push esi
call fcn.004bf8aa
push dword [ebp - 0x21c]
call fcn.004bf8aa
add esp, 8
pop esi
push edi
call fcn.004bf8aa
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop ebx
call fcn.004bcb15
mov esp, ebp
pop ebp
ret