Function at 0x479a80
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5cae20
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xa8
mov eax, dword [0x66e5c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x9c], esi
mov edi, ecx
mov dword [ebp - 4], 2
xorps xmm0, xmm0
movups xmmword [ebp - 0x38], xmm0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x38]
push eax
push ecx
push esi
mov edx, edi
mov ecx, closesocket
call fcn.00479990
add esp, 0xc
test al, al
jne 0x479b9b
lea eax, [ebp - 0x38]
mov edx, edi
push eax
push ecx
push esi
mov ecx, closesocket
call fcn.00479990
add esp, 0xc
test al, al
jne 0x479b9b
mov dword [ebp - 4], 4
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x479b79
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x479b6f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
add esp, 8
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov dword [ebp - 4], 0xffffffff
xor al, al
jmp 0x47a690
cmp dword [ebp - 0x28], 0
jne 0x479c04
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x479b79
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x479bd8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
xor eax, eax
mov dword [ebp - 0x28], 0
add esp, 8
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov dword [ebp - 4], 0xffffffff
xor al, al
jmp 0x47a690
mov dword [ebp - 0x80], 0
mov byte [ebp - 4], 8
xorps xmm0, xmm0
movups xmmword [ebp - 0x50], xmm0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov byte [ebp - 4], 6
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
mov byte [ebp - 4], 9
mov eax, esi
cmp dword [esi + 0x14], 7
jbe 0x479c4a
mov eax, dword [esi]
push eax
lea eax, [ebp - 0x50]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_s
push eax
call fcn.0045f9d0
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x3c], 7
lea ecx, [ebp - 0x80]
lea eax, [ebp - 0x50]
cmova eax, dword [ebp - 0x50]
push 0
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push eax
push closesocket
call esi
test eax, eax
je 0x479d49
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x3c]
cmp ecx, 7
jbe 0x479cce
mov edx, dword [ebp - 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x479cc4
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
add esp, 8
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
mov dword [ebp - 4], 0xb
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x479b79
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x479d1d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
xor eax, eax
mov dword [ebp - 0x28], 0
add esp, 8
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov dword [ebp - 4], 0xffffffff
xor al, al
jmp 0x47a690
mov eax, dword [ebp - 0x80]
test eax, eax
jne 0x479e0d
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x3c]
cmp ecx, 7
jbe 0x479d92
mov edx, dword [ebp - 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x479d88
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
add esp, 8
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x479b79
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x479de1
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
xor eax, eax
mov dword [ebp - 0x28], 0
add esp, 8
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov dword [ebp - 4], 0xffffffff
xor al, al
jmp 0x47a690
push 0
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x84], 0
push ecx
push 0
push 2
push 0
push 0
push 0
push 0x656210
push eax
call esi
push 0
mov dword [ebp - 0xa0], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
push eax
push 0
push 0x60000
push 0
push 0
push 0
push 0x656210
push dword [ebp - 0x80]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call esi
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x7c], 0
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
test eax, eax
je 0x479f7d
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x479f7d
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], 0
push ecx
push 0
push 0
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x479ee1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x479ee1
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x479f7d
push dword [ebp - 0x78]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x88], esi
test esi, esi
jne 0x479f03
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x479f7d
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x78]
push esi
push 1
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x479f26
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
jmp 0x479f7b
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov esi, eax
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x88]
push dword [ecx]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CopySid]
push dword [ebp - 0x7c]
test eax, eax
jne 0x479f6f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x88]
call edi
push dword [ebp - 0x18]
call edi
mov dword [ebp - 0x18], 0
jmp 0x479f7d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x88]
call edi
mov byte [ebp - 4], 0xe
mov esi, dword [ebp - 0xa0]
cmp esi, 5
jne 0x47a17a
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], 0
push eax
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 4
push 4
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x47a064
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x479fcb
push dword [ebp - 0x78]
call edi
jmp 0x47a064
push 2
push 0xc
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x54], 0
push ecx
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x5c], xmm0
call dword [sym.imp.ADVAPI32.dll_GetAclInformation]
test eax, eax
jne 0x479ff4
push dword [ebp - 0x78]
call edi
jmp 0x47a064
mov esi, dword [ebp - 0x5c]
sub esi, 1
js 0x47a059
nop dword [eax]
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0
push eax
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
je 0x47a054
mov eax, dword [ebp - 0x88]
cmp byte [eax], 1
jne 0x47a054
cmp dword [eax + 4], 2
jne 0x47a054
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
test eax, eax
je 0x47a054
push 0
push dword [ebp - 0x1c]
push 0
push 0
push 4
push 4
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_SetSecurityInfo]
sub esi, 1
jns 0x47a000
push dword [ebp - 0x78]
call edi
mov esi, dword [ebp - 0xa0]
push 0
lea eax, [ebp - 0x84]
push eax
push 0
push 2
push 0
push 0
push 0
push 0x656210
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x47a17a
lea ecx, [ebp - 0x20]
call fcn.00479490
push dword [ebp - 0x80]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov byte [ebp - 4], 9
push dword [ebp - 0x20]
call esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x47a0c1
push eax
call edi
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x3c]
cmp ecx, 7
jbe 0x47a0ff
mov edx, dword [ebp - 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x47a0f5
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
add esp, 8
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
mov dword [ebp - 4], 0x10
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x479b79
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x47a14e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
xor eax, eax
mov dword [ebp - 0x28], 0
add esp, 8
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov dword [ebp - 4], 0xffffffff
xor al, al
jmp 0x47a690
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 7
lea ecx, [eax*2 + 2]
push ecx
lea eax, [ebp - 0x38]
cmova eax, dword [ebp - 0x38]
push eax
push 1
push 0
push str.ProgId
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x47a2a8
cmp esi, 5
jne 0x47a1bb
lea ecx, [ebp - 0x20]
call fcn.00479490
push dword [ebp - 0x80]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x84]
call esi
mov byte [ebp - 4], 9
push dword [ebp - 0x20]
call esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x47a1ef
push eax
call edi
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x3c]
cmp ecx, 7
jbe 0x47a22d
mov edx, dword [ebp - 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x47a223
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
add esp, 8
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
mov dword [ebp - 4], 0x12
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x479b79
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x47a27c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
xor eax, eax
mov dword [ebp - 0x28], 0
add esp, 8
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov dword [ebp - 4], 0xffffffff
xor al, al
jmp 0x47a690
mov esi, dword [ebp - 0x9c]
lea eax, [ebp - 0x38]
push esi
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.0047ed70
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0x60], 7
lea ecx, [eax*2 + 2]
push ecx
lea eax, [ebp - 0x74]
cmova eax, dword [ebp - 0x74]
push eax
push 1
push 0
push str.Hash
push dword [ebp - 0x84]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete byte [ebp - 0x89]
cmp dword [ebp - 0xa0], 5
jne 0x47a306
lea ecx, [ebp - 0x20]
call fcn.00479490
push dword [ebp - 0x80]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x84]
call edi
mov eax, dword [0x679694]
test al, 1
jne 0x47a40e
or eax, 1
mov dword [0x679694], eax
mov byte [ebp - 4], 0x14
push 0x4c
push 0
push 0x679648
call fcn.004ce740
add esp, 0xc
mov dword [ebp - 0x9c], 0x679648
xorps xmm0, xmm0
mov dword [0x679648], 0
mov dword [0x67964c], 0
mov dword [0x679650], 0
push 2
push 0x679648
movups xmmword [0x679654], xmm0
mov dword [0x67966c], 0
movq qword [0x679664], xmm0
mov dword [0x679670], 0
mov dword [0x679674], 0
call fcn.0048c6fa
mov byte [ebp - 4], 0x16
mov dword [0x679678], 0
mov dword [0x67967c], 0
mov dword [0x679680], 0
mov byte [ebp - 4], 0x17
mov dword [0x679684], 0
mov dword [0x679688], 0
mov dword [0x67968c], 0
mov byte [ebp - 4], 0x18
mov dword [0x679690], 0
mov byte [ebp - 4], 0x14
push 0x5d3d80
call fcn.004c4268
add esp, 0xc
mov byte [ebp - 4], 0x13
push esi
lea ecx, [ebp - 0xb8]
call fcn.0044e890
mov byte [ebp - 4], 0x19
lea edi, [ebp - 0xb8]
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x98], 0
sub ecx, edi
mov dword [ebp - 0x94], 0
mov eax, 0x2aaaaaab
mov dword [ebp - 0x90], 0
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x47a4ea
cmp eax, 0xaaaaaaa
ja 0x47a6ae
push eax
lea ecx, [ebp - 0x98]
call fcn.0047a740
lea eax, [ebp - 0x98]
mov dword [ebp - 0x9c], eax
mov byte [ebp - 4], 0x1a
xorps xmm0, xmm0
mov esi, dword [ebp - 0x98]
movq qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x54], eax
mov byte [ebp - 4], 0x1b
lea eax, [ebp - 0xa0]
cmp edi, eax
je 0x47a4cf
push edi
mov ecx, esi
call fcn.0044e890
add esi, 0x18
lea eax, [ebp - 0xa0]
add edi, 0x18
mov dword [ebp - 0x58], esi
cmp edi, eax
jne 0x47a4b4
mov dword [ebp - 0x5c], esi
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x9c], 0
mov byte [ebp - 4], 0x19
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x98]
push eax
mov ecx, 0x679648
call fcn.0047a7e0
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x98]
test ecx, ecx
je 0x47a592
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x94]
push ecx
call fcn.0044ef60
mov ecx, dword [ebp - 0x90]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x98]
add esp, 0xc
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x47a56a
mov esi, dword [eax - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b3
push ecx
push esi
call fcn.004c427d
add esp, 8
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0xb8]
push fcn.0044e770
push 1
push 0x18
push eax
call fcn.004c3f17
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x74]
call fcn.0044e770
mov byte [ebp - 4], 9
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], 0
test eax, eax
je 0x47a5e0
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 0x1e
mov ecx, dword [ebp - 0x3c]
cmp ecx, 7
jbe 0x47a61e
mov edx, dword [ebp - 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x47a614
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
add esp, 8
xor eax, eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 7
mov word [ebp - 0x50], ax
mov dword [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x24]
cmp ecx, 7
jbe 0x47a66f
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x47a665
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a6b8
push ecx
push edx
call fcn.004c427d
add esp, 8
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x89]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004c3ed9
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0044f290
call fcn.004d85ca
call fcn.004d85ca
int3