Function at 0x425340
Capabilities:
Persist via contextmenuhandlers registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab593
mov eax, dword fs:[0]
push eax
sub esp, 0x690
mov eax, dword [0x4d5210]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00459150
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00459150
push 0x4b04e0
push str._shellexContextMenuHandlers_
lea eax, [ebp - 0x420]
push 0x4b0a64
push eax
call fcn.0040a880
push 0x4b04e0
push str._shellexDragDropHandlers_
lea eax, [ebp - 0x628]
push 0x4b0a64
push eax
call fcn.0040a880
add esp, 0x38
mov dword [ebp - 0x69c], 0
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x694], 0
push 1
xor eax, eax
mov dword [ebp - 4], 0
push 0x4b2930
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x62c], 7
mov dword [ebp - 0x630], 0
mov word [ebp - 0x640], ax
call fcn.00407a30
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x69c]
call fcn.00418c40
mov eax, dword [ebp - 0x62c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x425459
inc eax
lea ecx, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
call fcn.00407b30
push 6
xor eax, eax
mov dword [ebp - 0x62c], 7
push 0x4b2934
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x630], 0
mov word [ebp - 0x640], ax
call fcn.00407a30
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x69c]
call fcn.00418c40
mov eax, dword [ebp - 0x62c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4254c0
inc eax
lea ecx, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
call fcn.00407b30
push 9
xor eax, eax
mov dword [ebp - 0x62c], 7
push str.Directory
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x630], 0
mov word [ebp - 0x640], ax
call fcn.00407a30
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x69c]
call fcn.00418c40
mov eax, dword [ebp - 0x62c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x425527
inc eax
lea ecx, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
call fcn.00407b30
push 5
xor eax, eax
mov dword [ebp - 0x62c], 7
push str.Drive
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x630], 0
mov word [ebp - 0x640], ax
call fcn.00407a30
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x69c]
call fcn.00418c40
mov eax, dword [ebp - 0x62c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x42558e
inc eax
lea ecx, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
call fcn.00407b30
push 7
xor eax, eax
mov dword [ebp - 0x62c], 7
push str.lnkfile
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x630], 0
mov word [ebp - 0x640], ax
call fcn.00407a30
lea eax, [ebp - 0x640]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x69c]
call fcn.00418c40
mov eax, dword [ebp - 0x62c]
cmp eax, 8
jb 0x4255f1
inc eax
lea ecx, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
call fcn.00407b30
xor eax, eax
mov dword [ebp - 0x674], 7
mov dword [ebp - 0x678], 0
mov word [ebp - 0x688], ax
push 0x208
push eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 6
push eax
call fcn.00459150
mov esi, dword [ebp - 0x69c]
add esp, 0xc
mov ebx, dword [ebp - 0x698]
cmp esi, ebx
je 0x4259a2
nop dword [eax + eax]
cmp dword [esi + 0x14], 8
jb 0x42564a
mov edx, dword [esi]
jmp 0x42564c
mov edx, esi
xor eax, eax
mov dword [ebp - 0x62c], 7
mov dword [ebp - 0x630], 0
mov word [ebp - 0x640], ax
cmp word [edx], ax
jne 0x425672
xor ecx, ecx
jmp 0x425686
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425677
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x640]
call fcn.00407a30
cmp word [ebp - 0x420], 0
mov byte [ebp - 4], 7
jne 0x4256a5
xor ecx, ecx
jmp 0x4256bf
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4256b0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x640]
call fcn.00409fa0
cmp dword [esi + 0x14], 8
jb 0x4256dc
mov edx, dword [esi]
jmp 0x4256de
mov edx, esi
xor eax, eax
mov dword [ebp - 0x644], 7
mov dword [ebp - 0x648], 0
mov word [ebp - 0x658], ax
cmp word [edx], ax
jne 0x425704
xor ecx, ecx
jmp 0x42571f
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425710
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x658]
call fcn.00407a30
cmp word [ebp - 0x628], 0
mov byte [ebp - 4], 8
jne 0x42573e
xor ecx, ecx
jmp 0x425756
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425747
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x658]
call fcn.00409fa0
cmp dword [ebp - 0x62c], 8
lea ecx, [ebp - 0x68c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push eax
push bind
mov dword [ebp - 0x68c], 0
call edi
test eax, eax
jne 0x425859
push str.5D8D889E_7632_4997_9133_907E494CB570
lea ecx, [ebp - 0x670]
call fcn.004078d0
cmp dword [ebp - 0x65c], 8
lea ecx, [ebp - 0x670]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x670]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4257e0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425800
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x4c94e4
push dword [ebp - 0x68c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x68c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x65c]
cmp eax, 8
jb 0x425859
inc eax
lea ecx, [ebp - 0x670]
push eax
push dword [ebp - 0x670]
call fcn.00407b30
cmp dword [ebp - 0x644], 8
lea ecx, [ebp - 0x690]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x658]
mov dword [ebp - 0x690], 0
cmovae eax, dword [ebp - 0x658]
push 0
push eax
push bind
call edi
test eax, eax
jne 0x42593a
push str.5D8D889E_7632_4997_9133_907E494CB570
lea ecx, [ebp - 0x670]
call fcn.004078d0
cmp dword [ebp - 0x65c], 8
lea ecx, [ebp - 0x670]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x670]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4258c7
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4258e1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x4c94e4
push dword [ebp - 0x690]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x690]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x65c]
cmp eax, 8
jb 0x42593a
inc eax
lea ecx, [ebp - 0x670]
push eax
push dword [ebp - 0x670]
call fcn.00407b30
mov eax, dword [ebp - 0x644]
cmp eax, 8
jb 0x425958
inc eax
lea ecx, [ebp - 0x658]
push eax
push dword [ebp - 0x658]
call fcn.00407b30
xor eax, eax
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
mov eax, dword [ebp - 0x62c]
mov dword [ebp - 0x648], 0
mov byte [ebp - 4], 6
cmp eax, 8
jb 0x425997
inc eax
lea ecx, [ebp - 0x640]
push eax
push dword [ebp - 0x640]
call fcn.00407b30
add esi, 0x18
cmp esi, ebx
jne 0x425640
lea ecx, [ebp - 0x69c]
call fcn.00410850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434840
mov esp, ebp
pop ebp
ret