Function at 0x407330
Capabilities:
Persist via contextmenuhandlers registry key
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp + 8]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push ecx
push 0
push 0x20006
push 1
push 0
push 0
push str..vem
push SysReAllocStringLen
call ebx
test eax, eax
je 0x40736e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x432078
call fcn.004121f6
add esp, 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push 0x432078
push 1
push 0
push 0
push eax
call edi
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ebp, eax
call esi
test ebp, ebp
je 0x4073b5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0x20006
push 1
push 0
push 0
push str._shellexContextMenuHandlersVirtualExpander
push SysReAllocStringLen
call ebx
test eax, eax
je 0x4073e6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x431f78
call fcn.004121f6
mov edx, dword [esp + 0x14]
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
push 0x431f78
push 1
push 0
push 0
push edx
call edi
mov ebp, eax
mov eax, dword [esp + 0x10]
push eax
call esi
test ebp, ebp
je 0x407421
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0x20006
push 1
push 0
push 0
push 0x432078
push SysReAllocStringLen
call ebx
test eax, eax
je 0x407452
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push str.Virtual_Expander_File
call fcn.004121f6
mov ecx, dword [esp + 0x14]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push str.Virtual_Expander_File
push 1
push 0
push 0
push ecx
call edi
test eax, eax
je 0x40748b
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
push 2
push 0x4416f8
push 1
push 0
push str.NeverShowExt
push eax
call edi
test eax, eax
je 0x4074b7
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x18]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0x20006
push 1
push 0
push 0
push str.CLSID
push ecx
call ebx
test eax, eax
je 0x4074ef
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x431f78
call fcn.004121f6
mov ecx, dword [esp + 0x18]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x431f78
push 1
push 0
push 0
push ecx
call edi
mov edx, dword [esp + 0x14]
mov ebp, eax
push edx
call esi
test ebp, ebp
je 0x407531
mov eax, dword [esp + 0x10]
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0x20006
push 1
push 0
push 0
push str.DefaultIcon
push eax
call ebx
test eax, eax
je 0x407569
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x14]
push 6
push 0x43d408
push 1
push 0
push 0
push edx
call edi
mov ebp, eax
mov eax, dword [esp + 0x14]
push eax
call esi
test ebp, ebp
je 0x40759b
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x18]
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push 0x20006
push 1
push 0
push 0
push str.Shellopencommand
push ecx
call ebx
test eax, eax
je 0x4075d3
mov edx, dword [esp + 0x10]
push edx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push str._SystemRoot__system32VirtualExpanderVirtualExpander.exe__o__1
call fcn.004121f6
mov ecx, dword [esp + 0x18]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push str._SystemRoot__system32VirtualExpanderVirtualExpander.exe__o__1
push 2
push 0
push 0
push ecx
call edi
mov edx, dword [esp + 0x14]
mov ebp, eax
push edx
call esi
test ebp, ebp
je 0x407615
mov eax, dword [esp + 0x10]
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0x20006
push 1
push 0
push 0
push str.ShellEx
push eax
call ebx
mov ecx, dword [esp + 0x10]
mov ebp, eax
push ecx
call esi
test ebp, ebp
je 0x40764f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0x20006
push 1
push 0
push 0
push str.IconHandler
push ecx
call ebx
mov edx, dword [esp + 0x14]
mov ebx, eax
push edx
call esi
test ebx, ebx
je 0x407689
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x431f78
call fcn.004121f6
mov ecx, dword [esp + 0x14]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x431f78
push 1
push 0
push 0
push ecx
call edi
mov edx, dword [esp + 0x10]
mov edi, eax
push edx
call esi
test edi, edi
je 0x4076c4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret