Function at 0x4a70cc
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0059fbd0
push ebx
push esi
push edi
push dword [ebp + 8]
lea edi, [ebp - 0x82c]
call fcn.004a6803
call fcn.004a5dca
test al, al
mov eax, edi
push eax
push dword [ebp + 8]
push str.CapabilitiesFileAssociations
je 0x4a7119
call fcn.00457ac7
push 0x5bc6b8
push str.ApplicationDescription
push str.Capabilities
call fcn.00457ac7
jmp 0x4a7132
call fcn.00457b57
push 0x5bc6b8
push str.ApplicationDescription
push str.Capabilities
call fcn.00457b57
call fcn.004a5dca
neg al
sbb eax, eax
neg eax
add eax, 0x80000001
mov dword [ebp - 4], eax
call fcn.004012e4
test al, al
je 0x4a7165
push str.SoftwareNCH_SoftwareSwitchCapabilities
push 0x5b0844
push str.SoftwareRegisteredApplications
push dword [ebp - 4]
call fcn.00446aee
lea eax, [ebp - 0x82c]
push eax
mov ebx, str.SoftwareClasses_s
push ebx
mov esi, 0x104
lea edi, [ebp - 0x624]
call fcn.004a9039
push dword [ebp + 8]
lea eax, [ebp - 0xc3c]
push ebx
push eax
call fcn.00401000
add esp, 0x14
push 0x5b07d8
xor ebx, ebx
push ebx
lea eax, [ebp - 0xc3c]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xa34]
call fcn.00401132
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
jne 0x4a7218
cmp word [ebp - 0xa34], bx
jne 0x4a71dc
mov eax, dword [ebp + 8]
add eax, 2
push eax
push str._sfile
lea edi, [ebp - 0xa34]
call fcn.004a9039
pop ecx
pop ecx
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xe44]
push str.SoftwareClasses_s
push eax
call fcn.00401000
add esp, 0xc
push 0x5b07d8
push ebx
lea eax, [ebp - 0xe44]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x104c]
call fcn.00401132
lea eax, [ebp - 0x104c]
push eax
push ebx
lea eax, [ebp - 0x624]
push eax
push dword [ebp - 4]
call fcn.00446aee
lea eax, [ebp - 0x624]
push eax
push str._sDefaultIcon
lea edi, [ebp - 0x214]
call fcn.004a9039
push dword [ebp + 0x14]
lea edi, [ebp - 0x41c]
push dword [ebp + 0x10]
push 0x5e81ec
call fcn.004a9039
add esp, 0x14
mov eax, edi
push eax
push ebx
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.00446aee
lea eax, [ebp - 0x624]
push eax
push str._s_shell
lea edi, [ebp - 0x214]
call fcn.004a9039
pop ecx
pop ecx
push str.Open
push ebx
mov eax, edi
push eax
push dword [ebp - 4]
call fcn.00446aee
lea eax, [ebp - 0x624]
push eax
push str._s_shellopencommand
call fcn.004a9039
push dword [ebp + 0x10]
lea edi, [ebp - 0x41c]
push str.__s_____L_
call fcn.004a9039
add esp, 0x10
mov eax, edi
push eax
push ebx
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.00446aee
mov eax, edi
push eax
push ebx
push str.SoftwareClassesApplications_switch.exe_shellopencommand
push dword [ebp - 4]
call fcn.00446aee
push str.Open
push ebx
push str.SoftwareClassesApplications_switch.exe_shell
push dword [ebp - 4]
call fcn.00446aee
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x5e81ec
call fcn.004a9039
add esp, 0xc
mov eax, edi
push eax
push ebx
push str.SoftwareClassesApplications_switch.exeDefaultIcon
push dword [ebp - 4]
call fcn.00446aee
push 0x5bc6b8
push ebx
push str.SoftwareClassesApplications_switch.exe
push dword [ebp - 4]
call fcn.00446aee
push dword [ebp + 8]
push str.SoftwareClasses_sOpenWithProgIds
lea edi, [ebp - 0x214]
call fcn.004a9039
pop ecx
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
mov eax, edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4a737b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x82c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 0x10