Function at 0x100208b
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [0x100400c]
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push esi
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x638], eax
mov byte [ebp - 0x310], al
mov byte [ebp - 0x518], al
mov byte [ebp - 0x20c], al
mov byte [ebp - 0x414], al
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x624]
push eax
mov ebx, 0x1001d04
push ebx
push 0x1001c18
mov esi, 0x104
push 0x80000002
mov dword [ebp - 0x634], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x100236a
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpICA]
push 0x1001bf4
lea eax, [ebp - 0x310]
push eax
call edi
test eax, eax
jne 0x100212f
mov dword [ebp - 0x638], 1
jmp 0x1002145
push 0x1001c04
lea eax, [ebp - 0x310]
push eax
call edi
test eax, eax
jne 0x1002369
and dword [ebp - 0x620], 0
push 0x41
pop ecx
xor eax, eax
xor edx, edx
lea edi, [ebp - 0x108]
rep stosd dword es:[edi], eax
push 0x41
inc edx
cmp dword [ebp - 0x620], eax
pop ecx
lea edi, [ebp - 0x61c]
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x624], edx
rep stosd dword es:[edi], eax
jne 0x100218d
mov dword [ebp - 0x628], 0x1001ce8
lea eax, [ebp - 0x518]
jmp 0x10021b7
cmp dword [ebp - 0x620], edx
jne 0x10021a7
mov dword [ebp - 0x628], 0x1001cf0
lea eax, [ebp - 0x20c]
jmp 0x10021b7
mov dword [ebp - 0x628], 0x1001cf8
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x638], 0
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], esi
mov eax, 0x1001c30
jne 0x10021d6
mov eax, 0x1001c78
push dword [ebp - 0x628]
push eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0100205d
add esp, 0x10
test eax, eax
jl 0x10022b0
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x624]
push eax
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x10022b0
push 0x41
pop ecx
push dword [ebp - 0x628]
lea edi, [ebp - 0x108]
push 0x1001cd0
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0100205d
add esp, 0x10
test eax, eax
mov edi, 0x80000000
jl 0x10022b5
lea eax, [ebp - 0x62c]
push eax
push dword [ebp - 0x630]
lea eax, [ebp - 0x624]
push eax
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x10022b5
push esi
lea eax, [ebp - 0x61c]
push eax
push 1
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x10022b5
inc dword [ebp - 0x620]
cmp dword [ebp - 0x620], 3
jl 0x100214c
jmp 0x1002369
mov edi, 0x80000000
cmp byte [ebp - 0x518], 0
je 0x10022f1
push 0x1001ce8
push 0x1001cd0
lea eax, [ebp - 0x108]
push esi
push eax
jmp section..htext
cmp byte [ebp - 0x20c], 0
je 0x100232d
push 0x1001cf0
push 0x1001cd0
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0100205d
add esp, 0x10
push esi
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
cmp byte [ebp - 0x414], 0
je 0x1002369
push 0x1001cf8
push 0x1001cd0
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0100205d
add esp, 0x10
push esi
lea eax, [ebp - 0x414]
push eax
push 1
push ebx
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01002753
leave
ret