Function at 0x407030
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push eax
push 0x20006
push 0
push str.CLSID
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x407061
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push 0x431f78
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov edi, eax
call esi
test edi, edi
je 0x4070a7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push str.Virtual_Expander_Shell_Extension
call fcn.004121f6
add esp, 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x14]
push edx
push str.Virtual_Expander_Shell_Extension
push 1
push 0
push 0
push eax
call edi
test eax, eax
je 0x4070e6
mov ecx, dword [esp + 0x14]
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.InProcServer32
push ecx
call ebp
test eax, eax
je 0x40711e
mov edx, dword [esp + 0x14]
push edx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x43200c
call fcn.004121f6
mov ecx, dword [esp + 0x14]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x43200c
push 2
push 0
push 0
push ecx
call edi
test eax, eax
je 0x40715e
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x10]
push 0x14
push str.Apartment
push 1
push 0
push str.ThreadingModel
push ecx
call edi
mov edx, dword [esp + 0x10]
mov ebx, eax
push edx
call esi
test ebx, ebx
je 0x407193
mov eax, dword [esp + 0x14]
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push edx
push 0
push 0x20006
push 0
push 0
push 0
push str.ProgID
push eax
call ebp
mov ecx, dword [esp + 0x14]
mov ebx, eax
push ecx
call esi
test ebx, ebx
je 0x4071cd
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x432078
call fcn.004121f6
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push 0x432078
push 1
push 0
push 0
push eax
call edi
mov ecx, dword [esp + 0x10]
mov ebx, eax
push ecx
call esi
test ebx, ebx
je 0x407208
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea edx, [esp + 0x10]
push edx
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x407232
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x432078
call fcn.004121f6
mov ecx, dword [esp + 0x14]
add esp, 4
lea eax, [eax + eax + 2]
push eax
push 0x432078
push 1
push 0
push 0x431f78
push ecx
call edi
mov edx, dword [esp + 0x10]
mov ebx, eax
push edx
call esi
test ebx, ebx
je 0x407270
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 0x10]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40729a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
lea ecx, [esp + 0x18]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0x20006
push 0
push 0
push 0
push str.ShellIconOverlayIdentifiersVirtualExpanderFile.1
push eax
call ebp
mov ecx, dword [esp + 0x10]
mov ebx, eax
push ecx
call esi
test ebx, ebx
je 0x4072d4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push 0x431f78
call fcn.004121f6
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x14]
push edx
push 0x431f78
push 1
push 0
push 0
push eax
call edi
mov ecx, dword [esp + 0x14]
mov edi, eax
push ecx
call esi
test edi, edi
je 0x40730f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.SHELL32.dll_SHLoadNonloadedIconOverlayIdentifiers]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret