Function at 0x10063e10
Capabilities:
Delete registry key
Persist via default file association registry key
Print debug messages
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x920
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push str.SoftwareClasses_s
push eax
mov edi, str.None._First_operations_failed.
call fcn.10076ec0
movzx ebx, byte [ebp + 0x10]
add esp, 0xc
mov eax, dword [ebp - 8]
xor ebx, 1
sub ebx, 0x7fffffff
mov dword [ebp - 4], 0
test eax, eax
mov dword [ebp - 0xc], 0
mov esi, 0x1024cb86
mov ecx, esi
cmovne ecx, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100640be
push dword [ebp + 8]
mov dword [ebp + 0x10], eax
mov edi, str.Created_steam_key_in_HKCROOT
lea eax, [ebp + 0x10]
push str.URL:_s_protocol
push eax
call fcn.10076ec0
mov edx, dword [ebp + 0x10]
add esp, 0xc
test edx, edx
jne 0x10063eb5
lea ecx, [edx + 1]
mov edx, esi
jmp 0x10063ecb
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x10], eax
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063ec0
sub ecx, dword [ebp - 0x10]
inc ecx
push ecx
push edx
push 1
push 0
push 0x1024cb86
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100640ad
push eax
push 0x1024cb86
push 1
push eax
push str.URL_Protocol
push dword [ebp - 4]
mov edi, str.Created_default_value_for_URL:
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100640ad
push dword [ebp - 4]
mov edi, str.Created_empty_URL_Protocol_value
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, esi
test eax, eax
mov dword [ebp - 4], 0
cmovne ecx, eax
lea eax, [ebp - 0x120]
push ecx
push str._sDefaultIcon
push 0x104
push eax
call fcn.100bb550
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x120]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100640ad
push 0xc
lea eax, [ebp - 0x1c]
mov edi, str.Created_default_icon_key
push eax
push dword [ebp + 0xc]
call fcn.100ba320
push 0x800
lea eax, [ebp - 0x920]
push eax
push dword [ebp + 0xc]
call fcn.100ba390
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x920]
push eax
push str._s._s
push 0x800
push eax
call fcn.100bb550
lea ecx, [ebp - 0x920]
add esp, 0x2c
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10063fc0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x920]
push eax
push 1
push 0
push 0x1024cb86
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100640ad
push dword [ebp - 4]
mov edi, str.Created_default_icon_value
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov ecx, esi
test eax, eax
mov dword [ebp - 4], 0
cmovne ecx, eax
lea eax, [ebp - 0x120]
push ecx
push str._sShellOpenCommand
push 0x104
push eax
call fcn.100bb550
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x120]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100640ad
push dword [ebp + 0xc]
lea eax, [ebp - 0x920]
mov edi, str.Created_Shell_Open_key
push str.__s________1_
push 0x800
push eax
call fcn.100bb550
lea eax, [ebp - 0x920]
push eax
push 0x1024cb86
push dword [ebp - 4]
call fcn.10064600
add esp, 0x1c
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100640a8
call fcn.100ad570
push esi
push dword [ebp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
mov ecx, eax
call edx
mov bl, 1
jmp 0x100640e5
mov esi, 0x1024cb86
call fcn.100ad570
push 0
push dword [ebp + 0x10]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
mov eax, dword [ebp - 4]
test eax, eax
je 0x100640cc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
test eax, eax
cmovne esi, eax
push esi
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor bl, bl
call fcn.100ad570
push 0
push dword [ebp - 8]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x1c]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret