Function at 0x1000a4ee
Capabilities:
Persist via contextmenuhandlers registry key
Set registry value

Disassembly:
push 0x30
mov eax, 0x10022f48
call fcn.1000a8df
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1000a506
call fcn.1000a455
push str.CLSID_
lea ecx, [ebp - 0x24]
call fcn.10001796
and dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push str.C67A2E32_82ED_4DD6_82FE_86D970C8FA07
call fcn.10001b15
mov bl, byte [ebp + 8]
test bl, bl
je 0x1000a5e7
and dword [ebp + 0x10], 0
lea eax, [ebp + 0x10]
push esi
push dword [ebp - 0x24]
push 0x80000000
push eax
call fcn.1000a47b
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x1000a5a7
push 0x10023e60
push eax
lea ecx, [ebp + 0x10]
call fcn.10003cbc
and dword [ebp + 8], edi
lea eax, [ebp + 8]
push esi
push 0x10023f54
push dword [ebp + 0x10]
push eax
call fcn.1000a47b
mov edi, eax
mov dword [ebp - 0x10], edi
test edi, edi
jne 0x1000a59f
mov eax, dword [ebp + 0xc]
lea ecx, [ebp + 8]
push dword [eax]
push edi
call fcn.10003cbc
push str.Apartment
mov edi, eax
lea ecx, [ebp + 8]
push str.ThreadingModel
mov dword [ebp - 0x10], edi
call fcn.10003cbc
lea ecx, [ebp + 8]
call fcn.10003ad1
lea ecx, [ebp + 0x10]
call fcn.10003ad1
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push 0x80000002
push eax
call fcn.1000a47b
test eax, eax
jne 0x1000a5dd
push 0x10023e60
push 0x10023e10
lea ecx, [ebp + 8]
call fcn.10003cbc
lea ecx, [ebp + 8]
call fcn.10003ad1
jmp 0x1000a624
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
call fcn.10001742
push str.InprocServer32
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.10001b15
push esi
push dword [ebp - 0x3c]
call fcn.1000a4d7
push esi
push dword [ebp - 0x24]
call fcn.1000a4d7
push dword [ebp - 0x3c]
mov edi, eax
mov dword [ebp - 0x10], edi
call fcn.1000a8a3
pop ecx
push dword [ebp - 0x24]
or dword [ebp - 4], 0xffffffff
call fcn.1000a8a3
pop ecx
test bl, bl
je 0x1000a744
xor eax, eax
mov dword [ebp - 0x14], 2
mov ecx, 0x10024038
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], ecx
test eax, eax
mov edi, str._shellexDragDropHandlersVZipShell
mov edx, str._shellexContextMenuHandlersVZipShell
cmovne edx, edi
mov edi, ecx
mov dword [ebp - 0x18], edx
xor ebx, ebx
push dword [ebx + 0x1002d010]
lea ecx, [ebp - 0x30]
call fcn.10001796
push dword [ebp - 0x18]
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 2
call fcn.10001b15
cmp byte [edi], 0
push esi
push dword [ebp - 0x30]
je 0x1000a6b7
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push 0x80000000
push eax
call fcn.1000a47b
push 0x10023e10
push 0
lea ecx, [ebp + 8]
call fcn.10003cbc
lea ecx, [ebp + 8]
call fcn.10003ad1
jmp 0x1000a6bc
call fcn.1000a4d7
push dword [ebp - 0x30]
or dword [ebp - 4], 0xffffffff
call fcn.1000a8a3
add ebx, 4
inc edi
pop ecx
cmp ebx, 0x18
jb 0x1000a663
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
inc eax
add ecx, 5
mov dword [ebp + 0x10], eax
sub dword [ebp - 0x14], 1
mov dword [ebp + 0xc], ecx
jne 0x1000a64d
lea ecx, [ebp - 0x3c]
call fcn.10001816
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers_
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 3
call fcn.100018f1
push 0x10023e60
lea ecx, [ebp - 0x3c]
call fcn.10001b64
mov esi, dword [ebp - 0x3c]
mov ebx, 0x10023e10
push ebx
call fcn.1000fd4a
pop ecx
add eax, eax
push eax
push ebx
push 1
push 0
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push dword [ebp - 0x3c]
call fcn.1000a8a3
mov edi, dword [ebp - 0x10]
pop ecx
mov eax, edi
call fcn.1000a8a8
ret 0xc