Function at 0x10001857
Capabilities:
Persist via contextmenuhandlers registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 8]
xor edi, edi
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.Drive_shellexContextMenuHandlersUltraISO
push SysReAllocString
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, edi
mov esi, str.AD392E40_428C_459F_961E_9B147782D099
jne 0x100018d2
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, edi
mov dword [ebp - 4], ecx
jne 0x100018d2
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push 0x1000a6fc
push dword [ebp - 4]
call ebx
cmp dword [ebp - 4], edi
je 0x100018d2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.Folder_shellexContextMenuHandlersUltraISO
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x10001934
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, edi
mov dword [ebp - 4], ecx
jne 0x10001934
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push 0x1000a6fc
push dword [ebp - 4]
call ebx
cmp dword [ebp - 4], edi
je 0x10001934
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.Directory_shellexContextMenuHandlersUltraISO
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x10001996
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, edi
mov dword [ebp - 4], ecx
jne 0x10001996
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push 0x1000a6fc
push dword [ebp - 4]
call ebx
cmp dword [ebp - 4], edi
je 0x10001996
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.UltraISO_shellexContextMenuHandlersISOShell
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x100019f8
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, edi
mov dword [ebp - 4], ecx
jne 0x100019f8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push 0x1000a6fc
push dword [ebp - 4]
call ebx
cmp dword [ebp - 4], edi
je 0x100019f8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.binimage_shellexContextMenuHandlersISOShell
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x10001a51
lea ecx, [ebp - 4]
call fcn.10001e62
mov ecx, dword [ebp - 8]
cmp eax, edi
mov dword [ebp - 4], ecx
jne 0x10001a51
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push 0x1000a6fc
push dword [ebp - 4]
call ebx
lea ecx, [ebp - 4]
call fcn.10001e62
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
jne 0x10001a99
push 2
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 4]
call fcn.10001edd
test eax, eax
je 0x10001a7d
mov esi, 0x80070005
jmp 0x10001aa8
push esi
push 0x100090e8
lea ecx, [ebp - 4]
call fcn.10001ffe
lea ecx, [ebp - 4]
mov esi, eax
call fcn.10001e62
cmp esi, edi
jne 0x10001a76
push edi
push 1
push 0x1000a678
call fcn.100037c4
mov esi, eax
lea ecx, [ebp - 4]
call fcn.10001e62
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret