Function at 0x4110ca
Capabilities:
Persist via explorer tools registry key
Set registry value

Disassembly:
push 0x5c
mov eax, 0x554a32
call fcn.00527be2
mov esi, ecx
mov dword [ebp - 4], 6
mov dword [ebp - 0x58], 0x2001f
call fcn.00411604
xor ebx, ebx
cmp eax, ebx
je 0x411104
neg esi
sbb esi, esi
and esi, 0xffffff00
add esi, 0x2021f
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x2c]
push str.CLSID_
push eax
lea edi, [ebp + 0x24]
mov byte [ebp - 4], 8
call fcn.0040ae78
pop ecx
pop ecx
mov byte [ebp - 4], 9
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x41113d
lea eax, [ebp - 0x2c]
push ebx
push ebx
push dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
push ebx
push ebx
push eax
push SysReAllocString
call fcn.0041b373
cmp eax, ebx
jne 0x411355
cmp dword [ebp + 0x1c], 8
mov eax, dword [ebp + 8]
jae 0x411166
lea eax, [ebp + 8]
push 1
push eax
push ebx
lea ecx, [ebp - 0x54]
call fcn.0041b2d9
cmp dword [ebp + 0x1c], 8
mov ebx, eax
mov eax, dword [ebp + 8]
jae 0x411180
lea eax, [ebp + 8]
push 1
push eax
push str.InfoTip
lea ecx, [ebp - 0x54]
call fcn.0041b2d9
or ebx, eax
cmp dword [ebp + 0x54], 8
mov eax, dword [ebp + 0x40]
jae 0x41119e
lea eax, [ebp + 0x40]
xor esi, esi
push esi
push eax
push str.DefaultIcon
lea eax, [ebp - 0x54]
call fcn.0041b283
mov edi, 0x585d54
push edi
push edi
or ebx, eax
push str.Shell
lea eax, [ebp - 0x54]
call fcn.0041b283
or ebx, eax
cmp dword [ebp + 0xa4], 1
jae 0x4111e5
push 6
pop eax
mov ecx, 0x587044
lea esi, [ebp + 0x94]
call fcn.00409cec
xor esi, esi
cmp dword [ebp + 0xa8], 8
mov eax, dword [ebp + 0x94]
jae 0x4111fa
lea eax, [ebp + 0x94]
push edi
push eax
push str.Shellopen
lea eax, [ebp - 0x54]
call fcn.0041b283
or ebx, eax
cmp dword [ebp + 0x70], 8
mov eax, dword [ebp + 0x5c]
jae 0x411217
lea eax, [ebp + 0x5c]
push edi
push eax
push str.Shellopencommand
lea eax, [ebp - 0x54]
call fcn.0041b283
or ebx, eax
cmp dword [ebp + 0x88], esi
jbe 0x411294
cmp dword [ebp + 0xc0], 1
jae 0x41124e
push 6
pop eax
mov ecx, 0x587094
lea esi, [ebp + 0xb0]
call fcn.00409cec
xor esi, esi
cmp dword [ebp + 0xc4], 8
mov eax, dword [ebp + 0xb0]
jae 0x411263
lea eax, [ebp + 0xb0]
push edi
push eax
push str.Shell_setting
lea eax, [ebp - 0x54]
call fcn.0041b283
or ebx, eax
cmp dword [ebp + 0x8c], 8
mov eax, dword [ebp + 0x78]
jae 0x411283
lea eax, [ebp + 0x78]
push edi
push eax
push str.Shell_settingcommand
lea eax, [ebp - 0x54]
call fcn.0041b283
or ebx, eax
cmp ebx, esi
jne 0x411355
push esi
push esi
push dword [ebp - 0x58]
lea ecx, [ebp - 0x64]
push esi
push esi
push str.ShellFolder
push dword [ebp - 0x54]
call fcn.0041b373
cmp eax, esi
jne 0x411355
push 4
lea eax, [ebp - 0x68]
push eax
push 4
push esi
push str.Attributes
push dword [ebp - 0x64]
mov dword [ebp - 0x68], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
jne 0x411355
lea ecx, [ebp - 0x64]
call fcn.0041b3db
lea ecx, [ebp - 0x54]
call fcn.0041b3db
lea eax, [ebp - 0x48]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace_
push eax
lea edi, [ebp + 0x24]
call fcn.0040ae78
pop ecx
pop ecx
mov ebx, eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
call fcn.00409383
push 1
xor edi, edi
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 9
call fcn.00409659
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x411326
lea eax, [ebp - 0x2c]
xor esi, esi
push esi
push esi
push dword [ebp - 0x58]
lea ecx, [ebp - 0x54]
push esi
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041b373
push 1
push 0x585d54
push esi
lea ecx, [ebp - 0x54]
call fcn.0041b2d9
lea ecx, [ebp - 0x54]
call fcn.0041b3db
push 1
xor edi, edi
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 8
call fcn.00409659
lea ecx, [ebp - 0x64]
call fcn.0041b3db
lea ecx, [ebp - 0x54]
call fcn.0041b3db
xor ebx, ebx
inc ebx
push ebx
lea esi, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.00409659
push ebx
lea esi, [ebp + 0x24]
mov byte [ebp - 4], 4
call fcn.00409659
push ebx
lea esi, [ebp + 0x40]
mov byte [ebp - 4], 3
call fcn.00409659
push ebx
lea esi, [ebp + 0x5c]
mov byte [ebp - 4], 2
call fcn.00409659
push ebx
lea esi, [ebp + 0x78]
mov byte [ebp - 4], bl
call fcn.00409659
push ebx
lea esi, [ebp + 0x94]
mov byte [ebp - 4], 0
call fcn.00409659
or dword [ebp - 4], 0xffffffff
push ebx
lea esi, [ebp + 0xb0]
call fcn.00409659
xor eax, eax
call fcn.00527c65
ret 0xc4