Function at 0x1800054b0
Capabilities:
Delete registry key
Delete registry value
Persist via contextmenuhandlers registry key
Set registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x18002d340]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov ebx, ecx
lea rcx, [rbp + 0x2f]
call fcn.180004e40
nop
mov qword [rbp + 7], 0xf
xor edi, edi
mov qword [rbp - 1], rdi
mov byte [rbp - 0x11], dil
lea r8d, [rdi + 9]
lea rdx, str.SCMenuExt
lea rcx, [rbp - 0x11]
call fcn.180003bf0
nop
mov qword [rbp + 0x27], 0xf
mov qword [rbp + 0x1f], rdi
mov byte [rbp + 0xf], dil
lea r8d, [rdi + 9]
lea rdx, str.Apartment
lea rcx, [rbp + 0xf]
call fcn.180003bf0
nop
mov qword [rbp - 0x19], 0xf
mov qword [rbp - 0x21], rdi
mov byte [rbp - 0x31], dil
lea r8d, [rdi + 6]
lea rdx, str.CLSID_
lea rcx, [rbp - 0x31]
call fcn.180003bf0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rbp - 0x31]
test ebx, ebx
je 0x1800057ab
lea rbx, [0x18002e8a0]
mov rdx, rbx
call fcn.180006be0
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rcx, qword [rbp - 0x11]
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
mov eax, dword [rbp - 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea r8d, [rdi + 6]
lea rdx, str.CLSID_
lea rcx, [rbp - 0x31]
call fcn.180003bf0
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x31]
call fcn.180006be0
lea r8d, [rdi + 0xf]
lea rdx, str.InProcServer32
lea rcx, [rbp - 0x31]
call fcn.180006d10
lea rcx, [rbp + 0x2f]
cmp qword [rbp + 0x47], 0x10
cmovae rcx, qword [rbp + 0x2f]
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
mov eax, dword [rbp + 0x3f]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea rcx, [rbp + 0xf]
cmp qword [rbp + 0x27], 0x10
cmovae rcx, qword [rbp + 0xf]
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
mov eax, dword [rbp + 0x1f]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [rdi + 1]
lea r8, str.ThreadingModel
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea r8d, [rdi + 0x31]
lea rdx, str.DirectoryBackground_shellexContextMenuHandlers_
lea rcx, [rbp - 0x31]
call fcn.180003bf0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.180006be0
mov r8, rbx
cmp qword [0x18002e8b8], 0x10
cmovae r8, qword [0x18002e8a0]
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
mov eax, dword [0x18002e8b0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea r8d, [rdi + 0x4f]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers_
lea rcx, [rbp - 0x31]
call fcn.180003bf0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.180006be0
mov rcx, rbx
cmp qword [0x18002e8b8], 0x10
cmovae rcx, qword [0x18002e8a0]
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
mov eax, dword [0x18002e8b0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea r8d, [rdi + 0x43]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
lea rcx, [rbp - 0x31]
call fcn.180003bf0
lea r9, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae r9, qword [rbp - 0x11]
cmp qword [0x18002e8b8], 0x10
cmovae rbx, qword [0x18002e8a0]
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
mov eax, dword [rbp - 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r9
lea r9d, [rdi + 1]
mov r8, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueA]
jmp 0x18000589c
lea rdx, [0x18002e8a0]
call fcn.180006be0
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov r8d, 0x31
lea rdx, str.DirectoryBackground_shellexContextMenuHandlers_
lea rcx, [rbp - 0x31]
call fcn.180003bf0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.180006be0
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov r8d, 0x4f
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers_
lea rcx, [rbp - 0x31]
call fcn.180003bf0
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x11]
lea rcx, [rbp - 0x31]
call fcn.180006be0
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov r8d, 0x43
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
lea rcx, [rbp - 0x31]
call fcn.180003bf0
lea r8, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae r8, qword [rbp - 0x11]
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rdx, qword [rbp - 0x31]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
nop
cmp qword [rbp - 0x19], 0x10
jb 0x1800058ac
mov rcx, qword [rbp - 0x31]
call fcn.180007828
mov qword [rbp - 0x19], 0xf
mov qword [rbp - 0x21], rdi
mov byte [rbp - 0x31], 0
cmp qword [rbp + 0x27], 0x10
jb 0x1800058cc
mov rcx, qword [rbp + 0xf]
call fcn.180007828
mov qword [rbp + 0x27], 0xf
mov qword [rbp + 0x1f], rdi
mov byte [rbp + 0xf], 0
cmp qword [rbp + 7], 0x10
jb 0x1800058ec
mov rcx, qword [rbp - 0x11]
call fcn.180007828
mov qword [rbp + 7], 0xf
mov qword [rbp - 1], rdi
mov byte [rbp - 0x11], 0
cmp qword [rbp + 0x47], 0x10
jb 0x18000590c
mov rcx, qword [rbp + 0x2f]
call fcn.180007828
mov eax, 1
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.180009870
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret