Function at 0x30022860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x81f8
call fcn.3015a930
mov eax, dword [0x30215e88]
xor eax, esp
mov dword [esp + 0x81f4], eax
push esi
push edi
mov dword [0x3026b2d0], 1
mov ecx, 0x30269df8
mov dword [0x3026a854], 0xffffffff
mov dword [0x3026a860], 0xc
mov dword [0x3026a870], 1
mov dword [0x3026a874], 1
mov dword [0x3026b298], 1
mov dword [0x3026b29c], 0
mov dword [0x3026a878], 0
mov dword [0x3026b290], 1
mov dword [0x3026b28c], 1
mov dword [0x3026a86c], 0x1388
mov dword [0x3026a868], 1
mov dword [0x3026b2e8], 1
mov dword [0x3026b310], 1
mov dword [0x3026b2ec], 1
mov dword [0x3026b2cc], 1
mov dword [0x3026d8f8], 0x4000
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 0x30d], al
test al, al
jne 0x30022930
push 0x104
push 0
push 0x3026d1a4
call fcn.3015cdc0
add esp, 0xc
push 0x104
push 0
push 0x3026a104
call fcn.3015cdc0
add esp, 0xc
push 0x208
push 0
push 0x30269bf0
call fcn.3015cdc0
add esp, 0xc
push 0x208
push 0
push 0x30269efc
call fcn.3015cdc0
add esp, 0xc
push 0x208
push 0
push 0x3026a208
call fcn.3015cdc0
add esp, 0xc
push 0x104
push 0
push 0x30269df8
call fcn.3015cdc0
mov edx, dword [0x3026d89c]
add esp, 0xc
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x300229c2
sub ecx, esi
push ecx
push edx
push 0x30269df8
call fcn.301664c0
add esp, 0xc
push 0x30269df8
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
push eax
push 0x30269df8
lea eax, [esp + 0xf8]
push str._s_u.ini
push eax
call fcn.3001e370
lea eax, [esp + 0x100]
push 0x301f71f0
push eax
call fcn.30166354
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x30022acc
push 0x104
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.3015cdc0
add esp, 0xc
call edi
push eax
lea eax, [esp + 0xf4]
push str.C:_u.ini
push eax
call fcn.3001e370
add esp, 0xc
lea eax, [esp + 0xf0]
push 0x301f71f0
push eax
call fcn.30166354
mov esi, eax
add esp, 8
test esi, esi
jne 0x30022acc
push 0x104
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.3015cdc0
add esp, 0xc
lea eax, [esp + 0xf0]
push 0x30269df8
push str._sconfig.ini
push eax
call fcn.3001e370
add esp, 0xc
lea eax, [esp + 0xf0]
push 0x301f71f0
push eax
call fcn.30166354
mov esi, eax
add esp, 8
test esi, esi
jne 0x30022acc
pop edi
pop esi
mov ecx, dword [esp + 0x81f4]
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret
push 0x8000
lea eax, [esp + 0x1fc]
push 0
push eax
call fcn.3015cdc0
add esp, 0xc
test esi, esi
je 0x30022b5b
push esi
lea eax, [esp + 0x1fc]
push 0x8000
push eax
call fcn.301666a7
add esp, 0xc
test eax, eax
je 0x30022b65
lea eax, [esp + 0x1f8]
push 0xd
push eax
call fcn.3015be70
add esp, 8
test eax, eax
je 0x30022b1a
mov byte [eax], 0
lea eax, [esp + 0x1f8]
push 0xa
push eax
call fcn.3015be70
add esp, 8
test eax, eax
je 0x30022b33
mov byte [eax], 0
lea ecx, [esp + 0x1f8]
call fcn.3001f300
push esi
lea eax, [esp + 0x1fc]
push 0x8000
push eax
call fcn.301666a7
add esp, 0xc
test eax, eax
jne 0x30022b01
jmp 0x30022b65
mov dword [0x3026b2b8], 1
cmp dword [0x3026a830], 0
je 0x30022b77
cmp dword [0x3026a834], 0
je 0x30022b7e
mov byte [0x3026a87c], 0
mov ecx, 0x3026a208
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x30022b86
sub ecx, edx
sar ecx, 1
jne 0x30022bdb
push 7
push str.default
push 0x3026a104
call fcn.301664c0
add esp, 0xc
xor ecx, ecx
lea ecx, [ecx]
movsx ax, byte [ecx + 0x3026a104]
mov word [ecx*2 + 0x3026a208], ax
inc ecx
cmp ecx, 0x104
jb 0x30022bb0
push 0x3026a208
push str.Python_path_defaulted_to__ws._n
call fcn.3000a0d0
add esp, 8
test esi, esi
je 0x30022be8
push esi
call fcn.30166490
add esp, 4
cmp dword [0x3026b2e0], 0
je 0x30022ca9
push 0x104
push 0
push 0x3026b31c
mov dword [0x3026b2cc], 0
mov dword [0x3026b2d0], 0
mov dword [0x3026b298], 0
mov dword [0x3026b29c], 0
mov dword [0x3026a878], 0x64
mov dword [0x3026b290], 0
mov dword [0x3026b28c], 0
mov dword [0x3026a868], 0
mov dword [0x3026b2e8], 0
mov dword [0x3026b2ec], 0
mov dword [0x3026b424], 0
mov dword [0x3026b428], 0
mov dword [0x3026b42c], 0
mov dword [0x3026b438], 0
mov dword [0x3026b43c], 0
mov dword [0x3026b440], 0
call fcn.3015cdc0
add esp, 0xc
cmp dword [0x3026dc74], 0xffffffff
jne 0x30022cbc
mov dword [0x3026dc74], 1
cmp dword [0x3026a878], 0
jne 0x30022cde
push 0x64
push str.Dropped_file_limit_defaulting_to__d._n
mov dword [0x3026a878], 0x64
call fcn.3000a0d0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov ecx, edi
call fcn.30050080
test al, al
je 0x30022cfd
mov dword [0x3026ed34], 1
push str.explorer.exe
push dword [0x3026d8ac]
call fcn.3016475e
add esp, 8
test eax, eax
jne 0x30022d36
cmp dword [0x3026b2bc], 1
jne 0x30022d36
push str.Interactive_desktop___injecting_Explorer_Shell_n
mov dword [0x3026b2f0], 1
call fcn.3000a0d0
add esp, 4
jmp 0x30022d40
mov dword [0x3026b2bc], 0
cmp dword [0x3026ed34], 0
jne 0x300233a2
mov esi, dword [0x3026d8a8]
push 0x11
push str.c:program_files_
push esi
call fcn.30164487
add esp, 0xc
test eax, eax
je 0x30022d7f
push 0x17
push str.c:program_files__x86__
push esi
call fcn.30164487
add esp, 0xc
test eax, eax
jne 0x30022f26
mov edx, dword [0x3026d8a8]
mov ecx, edi
call fcn.30004900
cmp eax, 1
jne 0x30022f26
push str.firefox.exe
push dword [0x3026d8ac]
call fcn.3016475e
add esp, 8
test eax, eax
jne 0x30022de6
push str.Firefox_specific_hook_set_enabled._n
mov dword [0x3026b2fc], 1
mov dword [0x3026b290], eax
mov dword [0x3026b28c], eax
mov dword [0x3026b294], eax
mov dword [0x3026a868], eax
mov dword [0x3026b29c], eax
mov dword [0x3026b2e8], eax
mov dword [0x3026a870], eax
call fcn.3000a0d0
add esp, 4
push str.iexplore.exe
push dword [0x3026d8ac]
call fcn.3016475e
add esp, 8
test eax, eax
jne 0x30022e2d
push str.Internet_Explorer_specific_hook_set_enabled._n
mov dword [0x3026b308], 1
mov dword [0x3026b290], eax
mov dword [0x3026a868], eax
mov dword [0x3026a870], eax
mov dword [0x3026b29c], eax
mov dword [0x3026b2e8], eax
call fcn.3000a0d0
add esp, 4
push str.msedge.exe
push dword [0x3026d8ac]
call fcn.3016475e
add esp, 8
test eax, eax
jne 0x30022e74
push str.Edge_specific_hook_set_enabled._n
mov dword [0x3026b304], 1
mov dword [0x3026b290], eax
mov dword [0x3026a868], eax
mov dword [0x3026a870], eax
mov dword [0x3026b2e8], eax
mov dword [0x3026b29c], eax
call fcn.3000a0d0
add esp, 4
push str.chrome.exe
push dword [0x3026d8ac]
call fcn.3016475e
add esp, 8
test eax, eax
jne 0x30022ebb
push str.Chrome_specific_hook_set_enabled._n
mov dword [0x3026b300], 1
mov dword [0x3026b290], eax
mov dword [0x3026a868], eax
mov dword [0x3026a870], eax
mov dword [0x3026b2e8], eax
mov dword [0x3026b29c], eax
call fcn.3000a0d0
add esp, 4
push str.Microsoft_Office
push dword [0x3026d898]
call fcn.3015bc00
add esp, 8
test eax, eax
je 0x300233a2
mov dword [0x3026b2f8], 1
mov dword [0x3026b28c], 0
mov dword [0x3026b294], 0
mov dword [0x3026b290], 0
mov dword [0x3026b29c], 0
mov dword [0x3026b2e8], 0
mov dword [0x3026a870], 0
push str.Microsoft_Office_settings_enabled._n
jmp 0x3002339a
cmp dword [0x3026ed34], 0
jne 0x300233a2
mov esi, dword [0x3026d8a8]
push 0x14
push str.c:windows_system32_
push esi
call fcn.30164487
add esp, 0xc
test eax, eax
je 0x30022f79
push 0x14
push str.c:windows_syswow64_
push esi
call fcn.30164487
add esp, 0xc
test eax, eax
je 0x30022f79
push 0x15
push str.c:windows_sysnative_
push esi
call fcn.30164487
add esp, 0xc
test eax, eax
jne 0x300233a2
mov edx, dword [0x3026d8a8]
mov ecx, edi
call fcn.30004900
cmp eax, 1
jne 0x300233a2
push str.msiexec.exe
push dword [0x3026d8ac]
call fcn.3016475e
add esp, 8
test eax, eax
jne 0x300231e4
mov dword [esp + 0x28], str.NtAllocateVirtualMemory
xor esi, esi
mov dword [esp + 0x2c], str.NtProtectVirtualMemory
mov dword [esp + 0x30], 0x301f90e8
mov dword [esp + 0x34], str.CryptDecodeMessage
mov dword [esp + 0x38], str.CryptDecryptMessage
mov dword [esp + 0x3c], str.NtCreateThreadEx
mov dword [esp + 0x40], str.SetWindowLongPtrA
mov dword [esp + 0x44], str.SetWindowLongPtrW
mov dword [esp + 0x48], str.NtWaitForSingleObject
mov dword [esp + 0x4c], str.NtSetTimer
mov dword [esp + 0x50], str.NtSetTimerEx
mov dword [esp + 0x54], 0x301f9180
mov dword [esp + 0x58], str.RegOpenKeyExW
mov dword [esp + 0x5c], str.RegCreateKeyExA
mov dword [esp + 0x60], str.RegCreateKeyExW
mov dword [esp + 0x64], str.RegDeleteKeyA
mov dword [esp + 0x68], str.RegDeleteKeyW
mov dword [esp + 0x6c], str.RegEnumKeyW
mov dword [esp + 0x70], str.RegEnumKeyExA
mov dword [esp + 0x74], str.RegEnumKeyExW
mov dword [esp + 0x78], str.RegEnumValueA
mov dword [esp + 0x7c], str.RegEnumValueW
mov dword [esp + 0x80], str.RegSetValueExA
mov dword [esp + 0x84], str.RegSetValueExW
mov dword [esp + 0x88], 0x301f924c
mov dword [esp + 0x8c], str.RegQueryValueExW
mov dword [esp + 0x90], str.RegDeleteValueA
mov dword [esp + 0x94], str.RegDeleteValueW
mov dword [esp + 0x98], str.RegQueryInfoKeyA
mov dword [esp + 0x9c], str.RegQueryInfoKeyW
mov dword [esp + 0xa0], 0x301f92bc
mov dword [esp + 0xa4], str.RegNotifyChangeKeyValue
mov dword [esp + 0xa8], str.NtCreateKey
mov dword [esp + 0xac], str.NtOpenKey
mov dword [esp + 0xb0], str.NtOpenKeyEx
mov dword [esp + 0xb4], str.NtRenameKey
mov dword [esp + 0xb8], str.NtReplaceKey
mov dword [esp + 0xbc], str.NtEnumerateKey
mov dword [esp + 0xc0], str.NtEnumerateValueKey
mov dword [esp + 0xc4], str.NtSetValueKey
mov dword [esp + 0xc8], str.NtQueryValueKey
mov dword [esp + 0xcc], str.NtQueryMultipleValueKey
mov dword [esp + 0xd0], str.NtDeleteKey
mov dword [esp + 0xd4], str.NtDeleteValueKey
mov dword [esp + 0xd8], str.NtLoadKey
mov dword [esp + 0xdc], str.NtLoadKey2
mov dword [esp + 0xe0], str.NtLoadKeyEx
mov dword [esp + 0xe4], str.NtQueryKey
mov dword [esp + 0xe8], str.NtSaveKey
mov dword [esp + 0xec], str.NtSaveKeyEx
mov ecx, dword [esp + esi*4 + 0x28]
call fcn.30029b00
test eax, eax
je 0x300231a5
inc esi
cmp esi, 0x32
jb 0x30023190
jmp 0x300231b2
push str.Unable_to_set_hook_exclusion_for_msiexec._n
call fcn.3000a0d0
add esp, 4
mov dword [0x3026a870], 0
mov dword [0x3026b29c], 0
mov dword [0x3026b2e8], 0
mov dword [0x3026b30c], 1
push str.MsiExec_hook_set_enabled_n
jmp 0x3002339a
push str.services.exe
push dword [0x3026d8ac]
call fcn.3016475e
add esp, 8
test eax, eax
jne 0x3002320d
mov ecx, str.C:WindowsSystem32wininit.exe
call fcn.3004d630
test al, al
jne 0x30023336
push str.svchost.exe
push dword [0x3026d8ac]
call fcn.3016475e
add esp, 8
test eax, eax
jne 0x30023268
mov ecx, str.C:WindowsSystem32_services.exe
call fcn.3004d630
test al, al
je 0x30023268
push str._k_DcomLaunch
push dword [0x3026d8a0]
call fcn.3015b97e
add esp, 8
test eax, eax
jne 0x30023336
push str._k_netsvcs
push dword [0x3026d8a0]
call fcn.3015b97e
add esp, 8
test eax, eax
jne 0x30023336
push str.WmiPrvSE.exe
push dword [0x3026d8ac]
call fcn.3016475e
add esp, 8
test eax, eax
jne 0x300232ca
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x30240a4c]
test eax, eax
js 0x300232af
cmp dword [esp + 0xc], 0x18
jne 0x300232af
mov eax, dword [esp + 0x24]
jmp 0x300232b1
xor eax, eax
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x3002331f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.wscript.exe
push dword [0x3026d8ac]
call fcn.3016475e
add esp, 8
test eax, eax
jne 0x300233a2
mov dword [esp + 0x10], str.memcpy
xor esi, esi
mov dword [esp + 0x14], str.LoadResource
mov dword [esp + 0x18], str.LockResource
mov dword [esp + 0x1c], str.SizeofResource
mov ecx, dword [esp + esi*4 + 0x10]
call fcn.30029b00
test eax, eax
je 0x30023388
inc esi
cmp esi, 4
jb 0x30023307
jmp 0x30023395
push str._Embedding
push dword [0x3026d8a0]
call fcn.3015b97e
add esp, 8
test eax, eax
je 0x300232ca
mov dword [0x3026b29c], 0
mov dword [0x3026b2e8], 0
mov dword [0x3026b28c], 0
mov dword [0x3026b294], 0
mov dword [0x3026b290], 0
mov dword [0x3026b2cc], 0
mov dword [0x3026b2f0], 1
call fcn.300409c0
push str.Services_hook_set_enabled_n
jmp 0x3002339a
push str.Unable_to_set_hook_exclusion_for_wscript_n
call fcn.3000a0d0
add esp, 4
push str.wscript_hook_set_enabled_n
call fcn.3000a0d0
add esp, 4
mov ecx, dword [esp + 0x81fc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.30159c2d
mov esp, ebp
pop ebp
ret