Function at 0x4ad220fc
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x4ad2e1c8]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r13, rcx
xor eax, eax
or rbp, 0xffffffffffffffff
mov rdi, rdx
lea r15d, [rax + 1]
mov rsi, rdx
mov rcx, rbp
mov rbx, r8
lea r8, str.ShellOpenCommand
repne scasw ax, word [rdi]
mov rdi, r8
mov r9d, 0x104
not rcx
sub rcx, r15
mov rdx, rcx
mov rcx, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, r15
lea rdx, [rdx + rcx + 1]
cmp rdx, r9
jbe 0x4ad22184
xor edx, edx
mov ecx, 0x400023db
call fcn.4ad0b8b0
mov eax, r15d
jmp 0x4ad22360
lea rax, [rsp + 0x60]
mov rdi, rsi
mov rdx, r9
sub rdi, rax
xor r14d, r14d
lea rcx, [rsp + 0x60]
lea rax, [rdx + 0x7ffffefa]
cmp rax, r14
je 0x4ad221bc
movzx eax, word [rdi + rcx]
cmp ax, r14w
je 0x4ad221bc
mov word [rcx], ax
add rcx, 2
sub rdx, r15
jne 0x4ad2219a
cmp rdx, r14
jne 0x4ad221c5
sub rcx, 2
mov word [rcx], r14w
lea rcx, [rsp + 0x60]
mov rdx, r9
call fcn.4ad01ac0
lea rdx, [rsp + 0x50]
mov r9d, 0x2000000
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r14d
je 0x4ad222c0
cmp rbx, r14
je 0x4ad222a7
cmp word [rbx], r14w
je 0x4ad222a7
lea rdi, [rsp + 0x60]
jmp 0x4ad22226
cmp word [rdi], 0x5c
je 0x4ad2222c
add rdi, 2
cmp word [rdi], r14w
jne 0x4ad2221c
movzx ebp, word [rdi]
lea rax, [rsp + 0x58]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov rcx, r13
mov dword [rsp + 0x28], 0x2000000
mov word [rdi], r14w
mov dword [rsp + 0x20], r14d
call qword [sym.imp.KERNEL32.dll_RegCreateKeyExW]
mov r12d, eax
cmp eax, r14d
jne 0x4ad2228f
cmp bp, r14w
je 0x4ad222bc
mov rcx, qword [rsp + 0x50]
mov word [rdi], bp
add rdi, 2
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
jmp 0x4ad22226
mov r8, rsi
mov edx, r15d
mov ecx, 0x400023a5
call fcn.4ad0b8b0
mov eax, r12d
jmp 0x4ad22360
mov r8, rsi
mov edx, r15d
mov ecx, 0x400023a5
call fcn.4ad0b8b0
jmp 0x4ad2235e
or rbp, 0xffffffffffffffff
cmp rbx, r14
je 0x4ad2232f
cmp word [rbx], r14w
je 0x4ad2232f
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
lea rdx, [0x4ad29778]
mov r9d, 2
not rcx
xor r8d, r8d
sub rcx, r15
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_RegSetValueExW]
mov edi, eax
cmp eax, r14d
jne 0x4ad2231f
lea rcx, str._s_s_r_n
mov r8, rbx
mov rdx, rsi
call fcn.4ad05fc4
jmp 0x4ad22353
xor edx, edx
mov ecx, eax
call fcn.4ad0b8b0
mov ecx, 0x235d
jmp 0x4ad22348
mov rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_RegDeleteValueW]
mov edi, eax
cmp eax, r14d
je 0x4ad22353
mov ecx, 0x400023a5
mov r8, rsi
mov edx, r15d
call fcn.4ad0b8b0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.4ad01000
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret