Function at 0x100010c0
Capabilities:
Persist via contextmenuhandlers registry key
Set registry value

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
call fcn.100041d5
push eax
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_AFX_MAINTAIN_STATE2::AFX_MAINTAIN_STATE2
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x14]
push eax
call fcn.10002930
add esp, 4
test eax, eax
jne 0x10001111
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], edx
mov eax, 0x80040200
pop ebx
add esp, 0x30
ret
mov eax, dword [str.EPPShell.dll]
lea ecx, [esp + 0x14]
push eax
push 0x5c
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 0x24]
push eax
push ecx
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::Left
lea edx, [esp + 0x20]
push eax
push edx
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString
xor esi, esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], esi
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [str.InProcServer32]
lea ecx, [esp + 0x34]
push eax
call sub.MFC42.DLL_CString::CString_2
mov ecx, dword [str.509FE1AF_ADD5_49EC_BC55_7CF81FD16E78]
push eax
push 0x1000c128
push ecx
lea ecx, [esp + 0x3c]
call sub.MFC42.DLL_CString::CString_2
mov edx, dword [str.CLSID]
push eax
push 0x1000c128
push edx
lea ecx, [esp + 0x40]
call sub.MFC42.DLL_CString::CString_2
push eax
lea eax, [esp + 0x3c]
push eax
call sub.MFC42.DLL_operator
lea ecx, [esp + 0x30]
push eax
push ecx
call sub.MFC42.DLL_operator_1
lea edx, [esp + 0x24]
push eax
push edx
call sub.MFC42.DLL_operator
push eax
lea eax, [esp + 0x28]
push eax
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x24]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x24], esi
push esi
mov eax, dword [esp + 0x24]
push 0xf003f
push esi
push esi
push esi
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x10001258
lea ecx, [esp + 0x10]
call fcn.10001450
mov ecx, dword [esp + 0x1c]
cmp eax, esi
mov dword [esp + 0x10], ecx
je 0x1000126f
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
call fcn.10001450
jmp 0x1000130f
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edi, eax
call ebp
inc eax
mov ecx, dword [esp + 0x10]
push eax
push edi
push 1
push esi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x100012bc
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x100012a9
push eax
call edi
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x1000130f
jmp 0x10001308
mov eax, dword [str.Apartment]
mov edi, dword [str.ThreadingModel]
push eax
mov ebx, eax
call ebp
inc eax
mov ecx, dword [esp + 0x10]
push eax
push ebx
push 1
push esi
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x10001330
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x100012f7
push eax
call edi
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x1000130f
push eax
call edi
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
pop edi
pop esi
mov dword [edx + 4], eax
pop ebp
mov eax, 0x80040200
pop ebx
add esp, 0x30
ret
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x10001341
push eax
call ebx
mov dword [esp + 0x10], esi
mov eax, dword [str._shellexContextMenuHandlersEPPShellEx]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
push edx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push 0x80000000
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, esi
jne 0x10001386
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, esi
je 0x1000137a
push ecx
call ebx
mov ecx, dword [esp + 0x1c]
cmp eax, esi
mov dword [esp + 0x10], ecx
je 0x10001399
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x100013e0
jmp 0x100013d9
mov eax, dword [str.509FE1AF_ADD5_49EC_BC55_7CF81FD16E78]
push eax
mov edi, eax
call ebp
inc eax
mov ecx, dword [esp + 0x10]
push eax
push edi
push 1
push esi
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov eax, dword [esp + 0x10]
je 0x10001401
cmp eax, esi
je 0x100013c8
push eax
call ebx
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x100013e0
push eax
call ebx
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
pop edi
pop esi
mov dword [edx + 4], eax
pop ebp
mov eax, 0x80040201
pop ebx
add esp, 0x30
ret
cmp eax, esi
je 0x1000140c
push eax
call ebx
mov dword [esp + 0x10], esi
push esi
push esi
push esi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x10001432
push eax
call ebx
mov dword [esp + 0x10], esi
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], edx
xor eax, eax
pop ebx
add esp, 0x30
ret