Function at 0x511aa0
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x56d8f0
push eax
mov dword fs:[0], esp
sub esp, 0x14
lea eax, [esp + 0xc]
lea ecx, [esp + 4]
push ebx
push esi
push edi
push eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.Storm_shellopencommand
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x511cf1
push eax
lea edx, [esp + 0x18]
push 0x5b4bf8
push edx
call fcn.0044c570
add esp, 0xc
push 0x5c698c
push 0x5c6988
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0
call sub.MFC42.DLL_CString::Replace
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString_3
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push str.__s___play____1_
push ecx
mov byte [esp + 0x34], 1
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [eax - 8]
push ecx
push eax
push 1
push 0
push 0
push edx
call esi
test eax, eax
jne 0x511cd2
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5b48b0
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x511cd2
push str.URL:_Storm_Protocol
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
push ecx
push eax
mov eax, dword [esp + 0x18]
push 1
push 0
push 0
push eax
call esi
test eax, eax
jne 0x511cd2
mov ecx, dword [esp + 0x10]
push eax
push eax
push 1
push eax
push str.URL_Protocol
push ecx
call esi
test eax, eax
jne 0x511cd2
mov edx, dword [esp + 0x10]
push edx
call edi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.StormDefaultIcon
push SysReAllocStringLen
call ebx
test eax, eax
jne 0x511cd2
mov edx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push edx
push str._s__1
push eax
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push 0
push ecx
call esi
test eax, eax
jne 0x511cd2
mov edx, dword [esp + 0x10]
push edx
call edi
lea eax, [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerProtocolExecuteStorm
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x511cd2
lea edx, [esp + 0x1c]
push 4
push edx
push 4
mov dword [esp + 0x28], eax
push eax
mov eax, dword [esp + 0x20]
push str.WarnOnOpen
push eax
call esi
mov ecx, dword [esp + 0x10]
test eax, eax
push ecx
sete bl
call edi
test bl, bl
mov byte [esp + 0x28], 0
lea ecx, [esp + 0xc]
je 0x511cdb
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov byte [esp + 0x28], 0
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x20]
pop edi
pop esi
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret