Function at 0x508030
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
mov ecx, dword [0x5b4310]
sub esp, 0x4f4
push 0x104
lea eax, [esp + 0x3f4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x59bd0c]
test eax, eax
je 0x508091
mov edx, 0x5837f0
mov ecx, str.DisplayName
call fcn.0053a000
lea edx, [esp + 0x3f0]
push edx
lea eax, [esp + 0xc]
push str.__s___uninstall
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 8]
mov ecx, str.UninstallString
call fcn.0053a000
mov eax, dword [0x59bde0]
test eax, eax
jne 0x5080ab
call fcn.0053a120
mov eax, 1
add esp, 0x4f4
ret
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0x10]
push ecx
push str..cha
push bind
call edi
test eax, eax
je 0x5080d7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4f4
ret
mov eax, dword [0x58a3d8]
mov edx, dword [str.ChatFile]
mov cl, byte [0x58a3dc]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
mov byte [esp + 0x20], cl
lea edx, [eax + 1]
jmp 0x508100
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508100
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x584d78
push eax
call ebx
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x5080ca
lea edx, [esp + 0x10]
push edx
push str..chat
push bind
call edi
test eax, eax
jne 0x5080ca
mov eax, dword [str.ChatFile]
mov dl, byte [0x58a3dc]
mov ecx, dword [0x58a3d8]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov byte [esp + 0x20], dl
mov dword [esp + 0x1c], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508174
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0x584d78
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebp
test esi, esi
jne 0x5080ca
mov eax, dword [str.ChatFile]
mov ecx, dword [0x58a3d8]
mov dl, byte [0x58a3dc]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x1c]
push ecx
push bind
mov byte [esp + 0x2c], dl
call edi
test eax, eax
jne 0x5080ca
mov eax, dword [0x58a3cc]
mov edx, dword [str.Chat_File]
mov cx, word [0x58a3d0]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
mov word [esp + 0x20], cx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508200
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x584d78
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x5080ca
mov ecx, 5
mov esi, str.ChatFileDefaultIcon
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
push bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x5080ca
lea ecx, [esp + 0x400]
push ecx
lea edx, [esp + 0x1c]
push 0x5848f4
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508280
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0x584d78
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebp
test esi, esi
jne 0x5080ca
mov ecx, 7
mov esi, str.ChatFileShellopencommand
lea edi, [esp + 0x18]
lea eax, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0x1c]
push ecx
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x5080ca
lea edx, [esp + 0x400]
push edx
lea eax, [esp + 0x1c]
push str.__s___noconnect
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508300
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0x584d78
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call ebp
test esi, esi
jne 0x5080ca
mov ecx, 7
mov esi, str.ChatFileShellopenddeexec
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x5080ca
mov ax, word [0x58a358]
mov cl, byte [0x58a35a]
mov word [esp + 0x18], ax
lea eax, [esp + 0x18]
mov byte [esp + 0x1a], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508378
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x584d78
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x5080ca
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push eax
mov ecx, 0xa
mov esi, str.ChatFileShellopenddeexecApplication
lea edi, [esp + 0x20]
push bind
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x5080ca
mov cl, byte [eax + 0x59b938]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x5083d4
mov al, byte [esp + 0x18]
test al, al
jne 0x5083ff
mov ecx, dword [0x5837f0]
mov dl, byte [0x5837f4]
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508406
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0x584d78
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call ebp
test esi, esi
jne 0x5080ca
mov ecx, 8
mov esi, str.ChatFileShellopenddeexecifexec
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x10]
push eax
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x1c]
push ecx
push bind
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x5080ca
mov al, byte [0x58a35a]
mov dx, word [0x58a358]
mov byte [esp + 0x1a], al
lea eax, [esp + 0x18]
mov word [esp + 0x18], dx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508481
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0x584d78
push edx
call ebx
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call ebp
test esi, esi
jne 0x5080ca
mov ecx, 8
mov esi, str.ChatFileShellopenddeexecTopic
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
push bind
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x5080ca
mov eax, dword [0x58a2d8]
mov ecx, dword [0x58a2dc]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], ecx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508500
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0x584d78
push eax
call ebx
mov ecx, dword [esp + 0x10]
push ecx
mov esi, eax
call ebp
test esi, esi
jne 0x5080ca
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push esi
push 0x20006
push esi
push 0x584d78
push esi
push str.SoftwareClassesirc
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x5080ca
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x18]
push str.URL:IRC_Protocol
push ecx
call edi
lea eax, [esp + 0x20]
add esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508580
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x5080ca
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 3
push eax
push str.EditFlags
push edx
mov dword [esp + 0x2c], 2
call esi
test eax, eax
jne 0x5080ca
lea eax, [esp + 0x18]
push 0x584d78
push eax
call edi
lea eax, [esp + 0x20]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5085e7
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push str.URL_Protocol
push edx
call esi
test eax, eax
jne 0x5080ca
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0x584d78
push 0
push str.SoftwareClassesircDefaultIcon
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x5080ca
lea eax, [esp + 0x400]
push eax
lea ecx, [esp + 0x1c]
push 0x5848f4
push ecx
call edi
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508662
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x5080ca
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0x584d78
push 0
push str.SoftwareClassesircShellopencommand
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x5080ca
lea ecx, [esp + 0x400]
push ecx
lea edx, [esp + 0x1c]
push str.__s___noconnect
push edx
call edi
lea eax, [esp + 0x24]
add esp, 0xc
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5086e0
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
jne 0x5080ca
mov edx, dword [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0x584d78
push 0
push str.SoftwareClassesircShellopenddeexec
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x5080ca
mov al, byte [0x58a35a]
mov dx, word [0x58a358]
mov byte [esp + 0x1a], al
lea eax, [esp + 0x18]
mov word [esp + 0x18], dx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508756
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x5080ca
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0x584d78
push 0
push str.SoftwareClassesircShellopenddeexecApplication
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x5080ca
mov cl, byte [eax + 0x59b938]
mov byte [esp + eax + 0x18], cl
inc eax
test cl, cl
jne 0x5087b0
mov al, byte [esp + 0x18]
test al, al
jne 0x5087da
mov eax, dword [0x5837f0]
mov cl, byte [0x5837f4]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], cl
lea eax, [esp + 0x18]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5087e1
sub eax, edx
inc eax
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1c]
push edx
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x5080ca
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x20006
push 0
push 0x584d78
push 0
push str.SoftwareClassesircShellopenddeexecifexec
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x5080ca
mov dl, byte [0x58a35a]
mov cx, word [0x58a358]
lea eax, [esp + 0x18]
mov byte [esp + 0x1a], dl
mov word [esp + 0x18], cx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x508858
mov ecx, dword [esp + 0x10]
sub eax, edx
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
jne 0x5080ca
mov edx, dword [esp + 0x10]
push edx
call ebp
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x20006
push 0
push 0x584d78
push 0
push str.SoftwareClassesircShellopenddeexecTopic
push reloc.WSOCK32.dll_bind
call ebx
test eax, eax
jne 0x5080ca
mov eax, dword [0x58a2dc]
mov edx, dword [0x58a2d8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5088d0
sub eax, edx
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x5080ca
mov eax, dword [esp + 0x10]
push eax
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x4f4
ret