Function at 0x41cd10
Capabilities:
Persist via contextmenuhandlers registry key
Persist via default file association registry key
Persist via filter handlers registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c50e
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x47c], edi
mov dword [ebp - 0x428], 7
mov dword [ebp - 0x42c], ebx
mov word [ebp - 0x43c], ax
lea ecx, [ebp - 0x478]
push ecx
push 0x20019
push ebx
push str.SoftwareClasses.exe
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x478]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41cdfe
push 1
push 0x473064
mov esi, str.exefile
mov ecx, str.SoftwareClasses.exe
call fcn.00419a40
push str.___HKLMSoftwareClasses.exe_did_not_exist_and_was_recreated__r_n_r_n
push edi
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41cddf
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41cddf
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41cdfe
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41cdf7
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, str.098f2470_bae0_11cd_b579_08002b30bfeb
mov ecx, str.SoftwareClasses.exePersistentHandler
call fcn.00419a40
push 1
push str.Content_Type
mov esi, str.application_x_msdownload
mov ecx, str.SoftwareClasses.exe
call fcn.00419a40
add esp, 0x10
mov ecx, 0x473064
mov ebx, str.SoftwareClasses.exe
mov edx, 0x80000002
lea esi, [ebp - 0x458]
call fcn.00419920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 1
call fcn.00401560
xor ebx, ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x444], 8
jb 0x41ce74
mov edx, dword [ebp - 0x458]
push edx
call fcn.0044e60d
add esp, 4
push 1
push str.SoftwareClasses.exe
mov edi, str.exefile
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41cf69
push 0x478f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
mov ecx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClasses.exe_____has_been_changed_to
push ecx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41cef0
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41cef0
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41cf0f
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41cf08
or eax, 4
push ebx
push eax
call fcn.00402d10
mov edx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClasses.exe_____was_reset_to_exefile__r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41cf4a
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41cf4a
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41cf69
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41cf62
or eax, 4
push ebx
push eax
call fcn.00402d10
mov edx, str.SoftwareClasses.exe_shell
lea ecx, [ebp - 0x420]
call fcn.00419630
lea edx, [ebp - 0x420]
push edx
push 0x80000002
call fcn.00419680
add esp, 8
test eax, eax
je 0x41cfeb
mov eax, dword [ebp - 0x47c]
push str.___HKLMSoftwareClasses.exe_shell_found_and_deleted__r_n_r_n
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41cfcc
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41cfcc
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41cfeb
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41cfe4
or eax, 4
push ebx
push eax
call fcn.00402d10
mov edx, str.SoftwareClasses.exeDefaultIcon
lea ecx, [ebp - 0x420]
call fcn.00419630
lea edx, [ebp - 0x420]
push edx
push 0x80000002
call fcn.00419680
add esp, 8
test eax, eax
je 0x41d06d
mov eax, dword [ebp - 0x47c]
push str.___HKLMSoftwareClasses.exeDefaultIcon_found_and_deleted__r_n_r_n
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d04e
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d04e
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41d06d
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41d066
or eax, 4
push ebx
push eax
call fcn.00402d10
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push str.SoftwareClassesexefile
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41d144
push 1
push 0x473064
mov esi, str.__1___
mov ecx, str.SoftwareClassesexefile_shellopencommand
call fcn.00419a40
push 1
push str.IsolatedCommand
mov ecx, str.SoftwareClassesexefile_shellopencommand
call fcn.00419a40
push 1
push 0x473064
mov ecx, str.SoftwareClassesexefile_shell_runascommand
call fcn.00419a40
push 1
push str.IsolatedCommand
mov ecx, str.SoftwareClassesexefile_shell_runascommand
call fcn.00419a40
mov ecx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClassesexefile_did_not_exist_and_was_recreated__r_n_r_n
push ecx
call fcn.00414730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 0x28
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d125
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d125
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41d144
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41d13d
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, str.Application
mov ecx, str.SoftwareClassesexefile
call fcn.00419a40
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 8
push ebx
lea edx, [ebp - 0x478]
push edx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push str.SoftwareClassesexefile
push 0x80000002
mov dword [ebp - 0x488], 0x738
mov dword [ebp - 0x490], ebx
call esi
cmp eax, ebx
jne 0x41d1c5
mov ecx, dword [ebp - 0x478]
push 4
lea eax, [ebp - 0x488]
push eax
push 3
push ebx
push str.EditFlags
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41d1d4
mov edx, dword [ebp - 0x478]
push edx
jmp 0x41d1d2
mov eax, dword [ebp - 0x478]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push ebx
lea ecx, [ebp - 0x478]
push ecx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push str.SoftwareClassesexefile_shellopen
push 0x80000002
call esi
cmp eax, ebx
jne 0x41d220
mov eax, dword [ebp - 0x478]
push 4
lea edx, [ebp - 0x490]
push edx
push 3
push ebx
push str.EditFlags
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41d229
mov ecx, dword [ebp - 0x478]
push ecx
jmp 0x41d227
mov edx, dword [ebp - 0x478]
push edx
call edi
push 2
push str.FriendlyTypeName
mov esi, str.__SystemRoot_System32_shell32.dll__10156
mov ecx, str.SoftwareClassesexefile
call fcn.00419a40
push 1
push 0x473064
mov esi, 0x4793c8
mov ecx, str.SoftwareClassesexefileDefaultIcon
call fcn.00419a40
push 1
push str.HasLUAShield
mov esi, 0x473064
mov ecx, str.SoftwareClassesexefile_shell_runas
call fcn.00419a40
push 1
push str.DelegateExecute
mov esi, str.ea72d00e_4960_42fa_ba92_7792a7944c1d
mov ecx, str.SoftwareClassesexefile_shell_runasusercommand
call fcn.00419a40
push 1
push 0x473064
mov esi, str._shell32.dll__50944
mov ecx, str.SoftwareClassesexefile_shell_runasuser
call fcn.00419a40
push 1
push str.Extended
mov esi, 0x473064
mov ecx, str.SoftwareClassesexefile_shell_runasuser
call fcn.00419a40
push 1
push str.SuppressionPolicyEx
mov esi, str.F211AA05_D4DF_4370_A2A0_9F19C09756A7
mov ecx, str.SoftwareClassesexefile_shell_runasuser
call fcn.00419a40
push 1
push 0x473064
mov esi, str.Compatibility
mov ecx, str.SoftwareClassesexefile_shellexContextMenuHandlers
call fcn.00419a40
add esp, 0x40
push 1
push 0x473064
mov esi, str.1d27f844_3a1f_4410_85ac_14651078412d
mov ecx, str.SoftwareClassesexefile_shellexContextMenuHandlersCompatibility
call fcn.00419a40
push 1
push 0x473064
mov esi, str.86C86720_42A0_1069_A2E8_08002B30309D
mov ecx, str.SoftwareClassesexefile_shellexDropHandler
call fcn.00419a40
push 1
push 0x473064
mov esi, str.513D916F_2A8E_4F51_AEAB_0CBC76FB1AF8
mov ecx, str.SoftwareClassesexefile_shellexPropertySheetHandlersShimLayer_Property_Page
call fcn.00419a40
push 1
push str.SoftwareClassesexefile_shellopencommand
mov edi, str.__1___
mov esi, 0x473064
call fcn.004197e0
add esp, 0x20
test eax, eax
je 0x41d395
mov eax, dword [ebp - 0x47c]
push str.___HKLMSoftwareClassesexefile_shellopencommand_____was_changed._It_was_reset_to___1_____r_n_r_n
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d376
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d376
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41d395
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41d38e
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push str.SoftwareClassesexefile_shellopencommand
mov edi, str.__1___
mov esi, str.IsolatedCommand
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41d40c
mov edx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClassesexefile_shellopencommandIsolatedCommand_was_changed._It_was_reset_to___1_____r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d3ed
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d3ed
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41d40c
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41d405
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push str.SoftwareClassesexefile_shell_runascommand
mov edi, str.__1___
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41d483
mov edx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClassesexefile_shell_runascommand_____was_changed._It_was_reset_to___1_____r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d464
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d464
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41d483
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41d47c
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push str.SoftwareClassesexefile_shell_runascommand
mov edi, str.__1___
mov esi, str.IsolatedCommand
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41d4fa
mov edx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClassesexefile_shell_runascommandIsolatedCommand_was_changed._It_was_reset_to___1_____r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d4db
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d4db
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41d4fa
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41d4f3
or eax, 4
push ebx
push eax
call fcn.00402d10
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push str.SOFTWAREClasses.exe
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x41d7a1
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x41d549
lea eax, [ebp - 0x43c]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x473064
mov ebx, str.SOFTWAREClasses.exe
mov edx, 0x80000001
lea esi, [ebp - 0x474]
call fcn.00419920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 2
call fcn.00401560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], 8
jb 0x41d594
mov edx, dword [ebp - 0x474]
push edx
call fcn.0044e60d
add esp, 4
mov ebx, dword [ebp - 0x47c]
push 0x478f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
push str.___HKCUSOFTWAREClasses.exe_____exists_and_is_set_to
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d5ef
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d5ef
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41d610
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41d608
or eax, 4
push 0
push eax
call fcn.00402d10
mov edx, str.SOFTWAREClasses.exe
lea ecx, [ebp - 0x420]
call fcn.00419630
lea edx, [ebp - 0x420]
push edx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41d68e
push str.___HKCUSOFTWAREClasses.exe_has_been_deleted__r_n
push ebx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d66d
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d66d
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41d68e
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41d686
or eax, 4
push 0
push eax
call fcn.00402d10
push 0x11
xor edx, edx
push str.SOFTWAREClasses_
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], dx
call fcn.00401740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 3
call fcn.00411f30
cmp dword [ebp - 0x444], 8
mov edx, dword [ebp - 0x458]
jae 0x41d6ec
lea edx, [ebp - 0x458]
lea ecx, [ebp - 0x420]
call fcn.00419630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41d783
push str._has_been_deleted__r_n_r_n
push ecx
lea edx, [ebp - 0x43c]
push edx
push ecx
push str.___HKCUSOFTWAREClasses_
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d764
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d764
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41d783
or edi, dword [ecx + 0xc]
cmp dword [ecx + 0x38], 0
jne 0x41d77b
or edi, 4
push 0
push edi
call fcn.00402d10
mov byte [ebp - 4], 0
cmp dword [ebp - 0x444], 8
jb 0x41d79f
mov edx, dword [ebp - 0x458]
push edx
call fcn.0044e60d
add esp, 4
xor ebx, ebx
lea eax, [ebp - 0x478]
push eax
push 0x20019
push ebx
push str.SoftwareClasses.bat
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x478]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41d841
push 1
push 0x473064
mov esi, str.batfile
mov ecx, str.SoftwareClasses.bat
call fcn.00419a40
mov edx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClasses.bat_did_not_exist_and_was_recreated__r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d822
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d822
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41d841
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41d83a
or eax, 4
push ebx
push eax
call fcn.00402d10
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x41d85c
lea eax, [ebp - 0x43c]
xor edx, edx
mov word [eax], dx
mov ecx, 0x473064
mov ebx, str.SoftwareClasses.bat
mov edx, 0x80000002
lea esi, [ebp - 0x474]
call fcn.00419920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 4
call fcn.00401560
xor ebx, ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x460], 8
jb 0x41d8a8
mov eax, dword [ebp - 0x474]
push eax
call fcn.0044e60d
add esp, 4
push 1
push str.SoftwareClasses.bat
mov edi, str.batfile
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41d99d
mov edx, dword [ebp - 0x47c]
push 0x478f50
push ecx
lea ecx, [ebp - 0x43c]
push ecx
push ecx
push str.___HKLMSoftwareClasses.bat_____was_changed_to
push edx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d924
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d924
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41d943
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41d93c
or eax, 4
push ebx
push eax
call fcn.00402d10
mov edx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClasses.bat_____was_reset_to_batfile__r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41d97e
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41d97e
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41d99d
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41d996
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, str.5e941d80_bf96_11cd_b579_08002b30bfeb
mov ecx, str.SoftwareClasses.batPersistentHandler_
call fcn.00419a40
add esp, 8
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push str.SoftwareClasses_batfile
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41da9c
push 2
push 0x473064
mov esi, str._SystemRoot_System32NOTEPAD.EXE__1
mov ecx, str.SoftwareClasses_batfile_shelleditcommand
call fcn.00419a40
push 1
push 0x473064
mov esi, str.__1___
mov ecx, str.SoftwareClasses_batfile_shellopencommand
call fcn.00419a40
push 2
push 0x473064
mov esi, str._SystemRoot_System32NOTEPAD.EXE__p__1
mov ecx, str.SoftwareClasses_batfile_shellprintcommand
call fcn.00419a40
push 2
push 0x473064
mov esi, str._SystemRoot_System32cmd.exe__C___1___
mov ecx, str.SoftwareClasses_batfile_shell_runascommand
call fcn.00419a40
mov ecx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClasses.bat_did_not_exist_and_was_recreated__r_n_r_n
push ecx
call fcn.00414730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 0x28
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41da7d
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41da7d
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41da9c
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41da95
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, str.Windows_Batch_File
mov ecx, str.SoftwareClasses_batfile
call fcn.00419a40
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 8
push ebx
lea edx, [ebp - 0x478]
push edx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push str.SoftwareClasses_batfile
push 0x80000002
mov dword [ebp - 0x48c], 0x430
mov dword [ebp - 0x484], ebx
call esi
cmp eax, ebx
jne 0x41db1d
mov ecx, dword [ebp - 0x478]
push 4
lea eax, [ebp - 0x48c]
push eax
push 3
push ebx
push str.EditFlags
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41db2c
mov edx, dword [ebp - 0x478]
push edx
jmp 0x41db2a
mov eax, dword [ebp - 0x478]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push ebx
lea ecx, [ebp - 0x478]
push ecx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push str.SoftwareClasses_batfile_shellopen
push 0x80000002
call esi
cmp eax, ebx
jne 0x41db78
mov eax, dword [ebp - 0x478]
push 4
lea edx, [ebp - 0x484]
push edx
push 3
push ebx
push str.EditFlags
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41db81
mov ecx, dword [ebp - 0x478]
push ecx
jmp 0x41db7f
mov edx, dword [ebp - 0x478]
push edx
call edi
push 2
push str.FriendlyTypeName
mov esi, str.__SystemRoot_System32_acppage.dll__6002
mov ecx, str.SoftwareClasses_batfile
call fcn.00419a40
push 2
push str.SoftwareClasses_batfile_shelleditcommand
mov edi, str._SystemRoot_System32NOTEPAD.EXE__1
mov esi, 0x473064
call fcn.004197e0
add esp, 0x10
test eax, eax
je 0x41dc0e
mov eax, dword [ebp - 0x47c]
push str.___HKLM_batfile_shelleditcommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41dbef
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41dbef
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41dc0e
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41dc07
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push str.SoftwareClasses_batfile_shellopencommand
mov edi, str.__1___
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41dc85
mov edx, dword [ebp - 0x47c]
push str.___HKLM_batfile_shellopencommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41dc66
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41dc66
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41dc85
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41dc7e
or eax, 4
push ebx
push eax
call fcn.00402d10
push 2
push str.SoftwareClasses_batfile_shellprintcommand
mov edi, str._SystemRoot_System32NOTEPAD.EXE__p__1
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41dcfc
mov edx, dword [ebp - 0x47c]
push str.___HKLM_batfile_shellprintcommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41dcdd
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41dcdd
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41dcfc
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41dcf5
or eax, 4
push ebx
push eax
call fcn.00402d10
push 2
push str.SoftwareClasses_batfile_shell_runascommand
mov edi, str._SystemRoot_System32cmd.exe__C___1___
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41dd73
mov edx, dword [ebp - 0x47c]
push str.___HKLM_batfile_shellprintcommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41dd54
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41dd54
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41dd73
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41dd6c
or eax, 4
push ebx
push eax
call fcn.00402d10
push 2
push 0x473064
mov esi, str._SystemRoot_System32imageres.dll__68
mov ecx, str.SoftwareClasses_batfileDefaultIcon
call fcn.00419a40
push 1
push str.HasLUAShield
mov esi, 0x473064
mov ecx, str.SoftwareClasses_batfile_shell_runas
call fcn.00419a40
push 1
push str.DelegateExecute
mov esi, str.ea72d00e_4960_42fa_ba92_7792a7944c1d
mov ecx, str.SoftwareClasses_batfile_shell_runasusercommand
call fcn.00419a40
push 1
push 0x473064
mov esi, str._shell32.dll__50944
mov ecx, str.SoftwareClasses_batfile_shell_runasuser
call fcn.00419a40
push 1
push str.Extended
mov esi, 0x473064
mov ecx, str.SoftwareClasses_batfile_shell_runasuser
call fcn.00419a40
push 1
push str.SuppressionPolicyEx
mov esi, str.F211AA05_D4DF_4370_A2A0_9F19C09756A7
mov ecx, str.SoftwareClasses_batfile_shell_runasuser
call fcn.00419a40
push 1
push 0x473064
mov esi, str.1531d583_8375_4d3f_b5fb_d23bbd169f22
mov ecx, str.SoftwareClasses_batfile_shellex8895b1c6_b41f_4c1c_a562_0d564250836f
call fcn.00419a40
push 1
push 0x473064
mov esi, str.Compatibility
mov ecx, str.SoftwareClasses_batfile_shellexContextMenuHandlers
call fcn.00419a40
add esp, 0x40
push 1
push 0x473064
mov esi, str.1d27f844_3a1f_4410_85ac_14651078412d
mov ecx, str.SoftwareClasses_batfile_shellexContextMenuHandlersCompatibility
call fcn.00419a40
push 1
push 0x473064
mov esi, str.86C86720_42A0_1069_A2E8_08002B30309D
mov ecx, str.SoftwareClasses_batfile_shellexDropHandler
call fcn.00419a40
push 1
push 0x473064
mov esi, str.513D916F_2A8E_4F51_AEAB_0CBC76FB1AF8
mov ecx, str.SoftwareClasses_batfile_shellexPropertySheetHandlersShimLayer_Property_Page
call fcn.00419a40
add esp, 0x18
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push str.SOFTWAREClasses.bat
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x41e114
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x41deba
lea eax, [ebp - 0x43c]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x473064
mov ebx, str.SOFTWAREClasses.bat
mov edx, 0x80000001
lea esi, [ebp - 0x474]
call fcn.00419920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 5
call fcn.00401560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], 8
jb 0x41df05
mov edx, dword [ebp - 0x474]
push edx
call fcn.0044e60d
add esp, 4
mov ebx, dword [ebp - 0x47c]
push 0x478f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
push str.___HKCUSOFTWAREClasses.bat_____exists_and_is_set_to
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41df60
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41df60
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41df81
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41df79
or eax, 4
push 0
push eax
call fcn.00402d10
mov edx, str.SOFTWAREClasses.bat
lea ecx, [ebp - 0x420]
call fcn.00419630
lea edx, [ebp - 0x420]
push edx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41dfff
push str.___HKCUSOFTWAREClasses.bat_has_been_deleted__r_n
push ebx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41dfde
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41dfde
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41dfff
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41dff7
or eax, 4
push 0
push eax
call fcn.00402d10
push 0x11
xor edx, edx
push str.SOFTWAREClasses_
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], dx
call fcn.00401740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 6
call fcn.00411f30
cmp dword [ebp - 0x444], 8
mov edx, dword [ebp - 0x458]
jae 0x41e05d
lea edx, [ebp - 0x458]
lea ecx, [ebp - 0x420]
call fcn.00419630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41e0f6
push str._has_been_deleted__r_n_r_n
push ecx
lea edx, [ebp - 0x43c]
push edx
push ecx
push str.___HKCUSOFTWAREClasses_
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41e0d5
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41e0d5
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41e0f6
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41e0ee
or eax, 4
push 0
push eax
call fcn.00402d10
mov byte [ebp - 4], 0
cmp dword [ebp - 0x444], 8
jb 0x41e112
mov edx, dword [ebp - 0x458]
push edx
call fcn.0044e60d
add esp, 4
xor ebx, ebx
lea eax, [ebp - 0x478]
push eax
push 0x20019
push ebx
push str.SoftwareClasses.com
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x478]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41e1b4
push 1
push 0x473064
mov esi, str.comfile
mov ecx, str.SoftwareClasses.com
call fcn.00419a40
mov edx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClasses.com_did_not_exist_and_was_recreated__r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41e195
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41e195
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41e1b4
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41e1ad
or eax, 4
push ebx
push eax
call fcn.00402d10
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x41e1cf
lea eax, [ebp - 0x43c]
xor edx, edx
mov word [eax], dx
mov ecx, 0x473064
mov ebx, str.SoftwareClasses.com
mov edx, 0x80000002
lea esi, [ebp - 0x474]
call fcn.00419920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 7
call fcn.00401560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], 8
jb 0x41e21a
mov eax, dword [ebp - 0x474]
push eax
call fcn.0044e60d
add esp, 4
push 1
push str.SoftwareClasses.com
mov edi, str.comfile
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41e30d
mov ebx, dword [ebp - 0x47c]
push 0x478f50
push ecx
lea ecx, [ebp - 0x43c]
push ecx
push ecx
push str.___HKLMSoftwareClasses.com_____has_been_changed_to
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41e296
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41e296
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41e2b7
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41e2af
or eax, 4
push 0
push eax
call fcn.00402d10
push str.___HKLMSoftwareClasses.com_____was_reset_to_comfile__r_n_r_n
push ebx
call fcn.00414730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41e2ec
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41e2ec
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41e30d
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41e305
or eax, 4
push 0
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, str.098f2470_bae0_11cd_b579_08002b30bfeb
mov ecx, str.SoftwareClasses.comPersistentHandler_
call fcn.00419a40
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 8
lea edx, [ebp - 0x478]
push edx
push 0x20019
push 0
push str.SoftwareClassescomfile
push 0x80000002
call ebx
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41e389
push 1
push 0x473064
mov esi, str.__1___
mov ecx, str.SoftwareClassescomfile_shellopencommand
call fcn.00419a40
mov ecx, dword [ebp - 0x47c]
push str.___HKLMSoftwareClassescomfile_did_not_exist_and_was_recreated__r_n_r_n
push ecx
call fcn.00414730
push eax
call fcn.00403070
add esp, 0x14
push 1
push 0x473064
mov esi, str.MS_DOS_Application
mov ecx, str.SoftwareClassescomfile
call fcn.00419a40
lea edx, [ebp - 0x480]
push edx
mov ecx, str.SoftwareClassescomfile
mov dword [ebp - 0x480], 0x30
call fcn.00419b30
add esp, 0xc
push str.EditFlags
mov ecx, str.SoftwareClassescomfile_shellopen
mov edx, 0x80000002
call fcn.00419ac0
add esp, 4
push 2
push str.FriendlyTypeName
mov esi, str.__SystemRoot_System32_shell32.dll__8464
mov ecx, str.SoftwareClassescomfile
call fcn.00419a40
push 2
push 0x473064
mov esi, str._SystemRoot_System32_shell32.dll_2
mov ecx, str.SoftwareClassescomfileDefaultIcon
call fcn.00419a40
push 1
push 0x473064
mov esi, str.86C86720_42A0_1069_A2E8_08002B30309D
mov ecx, str.SoftwareClassescomfile_shellexDropHandler
call fcn.00419a40
push 1
push str.SoftwareClassescomfile_shellopencommand
mov edi, str.__1___
mov esi, 0x473064
call fcn.004197e0
add esp, 0x20
test eax, eax
je 0x41e44d
mov eax, dword [ebp - 0x47c]
push str.___HKLMSoftwareClassescomfile_shellopencommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
lea ecx, [ebp - 0x478]
push ecx
push 0x20019
push 0
push str.SOFTWAREClasses.com
push 0x80000001
call ebx
mov edx, dword [ebp - 0x478]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41e628
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], esi
jae 0x41e499
lea eax, [ebp - 0x43c]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x473064
mov ebx, str.SOFTWAREClasses.com
mov edx, 0x80000001
lea esi, [ebp - 0x474]
call fcn.00419920
mov ebx, 8
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], bl
call fcn.00401560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], ebx
jb 0x41e4e7
mov edx, dword [ebp - 0x474]
push edx
call fcn.0044e60d
add esp, 4
mov esi, dword [ebp - 0x47c]
push 0x478f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
push str.___HKCUSOFTWAREClasses.com_____exists_and_is_set_to
push esi
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
push eax
call fcn.00403070
add esp, 0xc
mov edx, str.SOFTWAREClasses.com
lea ecx, [ebp - 0x420]
call fcn.00419630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41e55d
push str.___HKCUSOFTWAREClasses.com_has_been_deleted__r_n
push esi
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push 0x11
xor edx, edx
push str.SOFTWAREClasses_
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], dx
call fcn.00401740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 9
call fcn.00411f30
mov edx, dword [ebp - 0x458]
cmp dword [ebp - 0x444], ebx
jae 0x41e5ba
lea edx, [ebp - 0x458]
lea ecx, [ebp - 0x420]
call fcn.00419630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41e611
push str._has_been_deleted__r_n_r_n
push ecx
lea edx, [ebp - 0x43c]
push edx
push ecx
push str.___HKCUSOFTWAREClasses_
push esi
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
cmp dword [ebp - 0x444], ebx
jb 0x41e628
mov eax, dword [ebp - 0x458]
push eax
call fcn.0044e60d
add esp, 4
cmp dword [ebp - 0x428], 8
jb 0x41e640
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.0044e60d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044e488
mov esp, ebp
pop ebp
ret