Function at 0x4a6c5a
Capabilities:
Set registry value

Disassembly:
push 0x54
mov eax, 0x694218
call fcn.0056e23b
mov eax, dword [ebp + 8]
and dword [ebp - 0x5c], 0
and dword [ebp - 0x60], 0
push 0x20019
push str.HKEY_LOCAL_MACHINE_X64SOFTWAREClasses
mov dword [ebp - 0x58], eax
call fcn.00567b83
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop ecx
pop ecx
test eax, eax
je 0x4a6dd4
xor edx, edx
lea ecx, [ebp - 0x54]
push edx
push ecx
push edx
push 0xf003f
push edx
push edx
push edx
push 0x6ce0c4
push eax
mov dword [ebp - 0x54], edx
call esi
test eax, eax
jne 0x4a6dd4
xor ecx, ecx
lea eax, [ebp - 0x4c]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x6ce124
push dword [ebp - 0x54]
mov dword [ebp - 0x4c], ecx
call esi
test eax, eax
jne 0x4a6dcf
push dword [ebp - 0x58]
call fcn.00647fd1
pop ecx
add eax, eax
push eax
push dword [ebp - 0x58]
push 1
push 0
push 0
push dword [ebp - 0x4c]
call ebx
lea ecx, [ebp - 0x2c]
call fcn.004173bc
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 1
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.0042810e
pop ecx
pop ecx
xor ecx, ecx
lea eax, [ebp - 0x50]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x6ce158
push dword [ebp - 0x4c]
mov dword [ebp - 0x50], ecx
call esi
test eax, eax
jne 0x4a6d92
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x6ce168
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push 0x6ce17c
push eax
call fcn.0041ccda
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x44]
add esp, 0x10
cmp dword [ebp - 0x30], 8
cmovae ecx, dword [ebp - 0x44]
add eax, eax
push eax
push ecx
push 1
push 0
push 0
push dword [ebp - 0x50]
call ebx
push dword [ebp - 0x50]
call edi
mov dword [ebp - 0x5c], 1
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
add eax, eax
push eax
push ecx
push 1
push 0
push 0x6ce198
push dword [ebp - 0x4c]
call ebx
push dword [ebp - 0x4c]
call edi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0041786a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
push dword [ebp - 0x54]
call edi
push 0x20019
push str.HKEY_LOCAL_MACHINE_X64SOFTWAREClassesDirectory
call fcn.00567b83
pop ecx
pop ecx
test eax, eax
je 0x4a6f25
xor edx, edx
lea ecx, [ebp - 0x50]
push edx
push ecx
push edx
push 0xf003f
push edx
push edx
push edx
push 0x6ce1a4
push eax
mov dword [ebp - 0x50], edx
call esi
test eax, eax
jne 0x4a6f25
xor ecx, ecx
lea eax, [ebp - 0x4c]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x6ce214
push dword [ebp - 0x50]
mov dword [ebp - 0x4c], ecx
call esi
test eax, eax
jne 0x4a6f20
push dword [ebp - 0x58]
call fcn.00647fd1
pop ecx
add eax, eax
push eax
push dword [ebp - 0x58]
push 1
push 0
push 0
push dword [ebp - 0x4c]
call ebx
lea ecx, [ebp - 0x2c]
call fcn.004173bc
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 3
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.0042810e
pop ecx
pop ecx
xor ecx, ecx
lea eax, [ebp - 0x54]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x6ce248
push dword [ebp - 0x4c]
mov dword [ebp - 0x54], ecx
call esi
test eax, eax
jne 0x4a6ee3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push str.Explorer
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x48]
push str._s___s____1_
push eax
call fcn.0041ccda
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x44]
add esp, 0x10
cmp dword [ebp - 0x30], 8
cmovae ecx, dword [ebp - 0x44]
add eax, eax
push eax
push ecx
push 1
push 0
push 0
push dword [ebp - 0x54]
call ebx
push dword [ebp - 0x54]
call edi
mov dword [ebp - 0x60], 1
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
add eax, eax
push eax
push ecx
push 1
push 0
push 0x6ce288
push dword [ebp - 0x4c]
call ebx
push dword [ebp - 0x4c]
call edi
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.0041786a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
push dword [ebp - 0x50]
call edi
cmp dword [ebp - 0x5c], 0
je 0x4a6f3e
cmp dword [ebp - 0x60], 0
je 0x4a6f3e
push 1
call fcn.004a6f46
xor eax, eax
pop ecx
inc eax
jmp 0x4a6f40
xor eax, eax
call fcn.0056e1e5
ret