Function at 0x100076f6
Capabilities:
Create process on windows

Disassembly:
push 0x2a4
mov eax, 0x1008c9ed
call fcn.1008bdcf
mov ebx, ecx
mov eax, dword [ebp + 0x10]
lea esi, [ebp + 0x18]
lea edi, [ebp - 0x278]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0x14]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x268], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
mov edi, 0x80004005
mov dword [ebp - 0x234], esi
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x248], esi
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x24c], esi
or dword [ebp - 0x23c], 0xffffffff
xor ecx, ecx
mov eax, dword [ebp + 0xc]
inc ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x228], esi
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x238], esi
test eax, eax
je 0x10007781
mov dword [ebp - 0x240], esi
test al, 0x20
je 0x10007787
mov dword [ebp - 0x240], ecx
mov ecx, ebx
call fcn.100090a0
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x224]
push 8
pop ecx
cmp word [eax], si
jne 0x100077c9
cmp word [ebp - 0x278], cx
jne 0x100080f0
push dword [ebp - 0x270]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x100080f0
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, 0x104
jb 0x100077ec
mov edx, 0xa058
mov ecx, dword [ebp - 0x230]
call fcn.10003530
jmp 0x100080f0
mov ecx, dword [ebp - 0x224]
lea edx, [ebp - 0x228]
call fcn.10003530
test eax, eax
jne 0x100080f0
call fcn.1000aa3d
test eax, eax
js 0x100080da
mov dword [ebp - 0x244], esi
call fcn.10056369
cmp eax, 0x401
je 0x10007831
mov dword [ebp - 0x260], esi
cmp eax, 0x40d
jne 0x1000783b
mov dword [ebp - 0x260], 1
mov eax, dword [ebp - 0x224]
cmp word [eax], si
je 0x10007880
push ecx
push 5
push str.http:
push 5
pop edx
mov ecx, eax
call fcn.10003530
test eax, eax
jne 0x1000787a
push ecx
mov ecx, dword [ebp - 0x224]
push 6
push str.https:
push 6
pop edx
call fcn.10003530
test eax, eax
je 0x100080f0
mov eax, dword [ebp - 0x224]
cmp dword [ebp - 0x240], 0
push 2
pop ecx
je 0x100078a0
cmp dword [ebx + 0x3c], ecx
je 0x100078a0
push eax
call dword [sym.imp.MSOHEV.dll__HevFIsHTMLOrMHTML_4]
test eax, eax
jne 0x100080f0
push 8
pop eax
cmp word [ebp - 0x278], ax
jne 0x100079f1
push dword [ebp - 0x270]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
je 0x100079f1
lea eax, [ebp - 0x25c]
push eax
push ecx
mov ecx, 0x20019
call fcn.1001f746
pop ecx
push eax
push esi
push dword [ebp - 0x270]
push ADsGetObject
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x254], ecx
test eax, eax
jne 0x100079f3
push dword [ebp - 0x270]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x22c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov dword [ebp - 0x250], eax
pop ecx
test eax, eax
je 0x100080f0
push dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x270]
mov edx, eax
call fcn.10003530
push 0x105
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.MSOHEV.dll__WzRegistryProgIDFromDocProgID_12]
push 1
push eax
call dword [sym.imp.MSOHEV.dll__WHeviAppFromProgId_8]
mov dword [ebp - 0x23c], eax
test eax, eax
je 0x100079a4
xor edx, edx
inc edx
cmp eax, edx
je 0x100079a4
cmp eax, 3
je 0x100079a4
push 2
pop ecx
cmp eax, ecx
je 0x100079a4
cmp eax, 4
je 0x100079a4
cmp eax, 5
je 0x100079a4
cmp eax, 6
je 0x100079a4
cmp eax, 7
je 0x100079a4
cmp eax, 8
je 0x100079a4
mov ecx, esi
jmp 0x100079f9
mov eax, dword [ebp - 0x22c]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov ecx, eax
mov dword [ebp - 0x248], ecx
test ecx, ecx
je 0x100080f0
push dword [ebp - 0x22c]
mov edx, ecx
mov ecx, dword [ebp - 0x250]
call fcn.10003530
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x254]
jmp 0x100079f6
mov ecx, esi
or eax, 0xffffffff
xor edx, edx
inc edx
test ecx, ecx
jne 0x10007aac
lea eax, [ebp - 0x244]
push eax
push esi
push edx
push dword [ebp - 0x224]
call dword [sym.imp.MSOHEV.dll__HevFGetProgIDFromFile_16]
test eax, eax
je 0x100080f0
mov eax, dword [ebp - 0x244]
test eax, eax
jle 0x100080f0
inc eax
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x244], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov ecx, eax
mov dword [ebp - 0x248], ecx
test ecx, ecx
je 0x100080f0
lea eax, [ebp - 0x244]
push eax
push ecx
push 1
push dword [ebp - 0x224]
call dword [sym.imp.MSOHEV.dll__HevFGetProgIDFromFile_16]
test eax, eax
je 0x100080f0
cmp dword [ebp - 0x244], 0
jle 0x100080f0
push 0x105
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.MSOHEV.dll__WzRegistryProgIDFromDocProgID_12]
push 1
push eax
call dword [sym.imp.MSOHEV.dll__WHeviAppFromProgId_8]
mov dword [ebp - 0x23c], eax
xor edx, edx
inc edx
push 2
pop ecx
test eax, eax
je 0x10007aec
cmp eax, edx
je 0x10007aec
cmp eax, 3
je 0x10007aec
cmp eax, ecx
je 0x10007aec
cmp eax, 4
je 0x10007aec
cmp eax, 5
je 0x10007aec
cmp eax, 6
je 0x10007aec
cmp eax, 7
je 0x10007aec
cmp eax, 8
je 0x10007aec
mov dword [ebp - 0x22c], esi
mov ecx, esi
mov dword [ebp - 0x238], esi
jmp 0x10007b0a
mov dword [ebp - 0x22c], edx
test eax, eax
je 0x10007afe
cmp eax, edx
je 0x10007afe
cmp eax, ecx
jne 0x10007b04
mov dword [ebp - 0x238], edx
mov ecx, dword [ebp - 0x228]
mov dword [ebp - 0x228], ecx
test ecx, ecx
jne 0x10007b1d
mov ecx, dword [ebx + 0x24]
mov dword [ebp - 0x228], ecx
mov ecx, dword [ebp - 0x224]
cmp word [ecx], si
je 0x10007ee2
push 0x7f02
push esi
mov dword [ebp - 0x2ac], esi
mov dword [ebp - 0x29c], esi
mov dword [ebp - 0x298], esi
mov dword [ebp - 0x294], esi
mov dword [ebp - 0x2b0], 0x10092e3c
mov dword [ebp - 0x290], 0x4b1
mov dword [ebp - 0x288], esi
mov dword [ebp - 0x28c], esi
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
test eax, eax
jne 0x10007c19
cmp dword [ebx + 0x3c], eax
je 0x10007b94
cmp dword [ebx + 0x3c], 3
jne 0x10007c19
mov ecx, dword [ebp - 0x224]
lea edx, [ebp - 0x254]
mov dword [ebp - 0x254], esi
call fcn.10003530
cmp dword [ebp - 0x254], 0
mov ecx, dword [ebp - 0x228]
push 2
pop edx
jbe 0x10007c00
mov dword [ebx + 0x3c], edx
mov eax, dword [ebp + 0xc]
cmp dword [ebx + 0x3c], 1
je 0x10007c24
cmp dword [ebx + 0x3c], edx
je 0x10007c24
test eax, eax
jne 0x10007c24
push dword [ebx + 0x3c]
lea ecx, [ebp - 0x2b0]
push dword [ebx + 0x30]
push dword [ebx + 0x2c]
push dword [ebp - 0x230]
call fcn.10003530
mov edx, eax
mov dword [ebx + 0x20], 1
mov dword [ebp - 0x228], edx
jmp 0x10007cc1
test ecx, ecx
je 0x10007bc0
cmp dword [ebp - 0x238], 0
mov eax, dword [ebp + 0xc]
je 0x10007bc3
mov dword [ebx + 0x3c], 1
jmp 0x10007bc3
mov ecx, dword [ebp - 0x228]
push 2
pop edx
jmp 0x10007bc3
cmp dword [ebx + 0x30], 0
je 0x10007c47
push dword [ebx + 0x30]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, dword [ebp - 0x228]
test eax, eax
push 1
pop eax
cmove ecx, eax
mov dword [ebp - 0x228], ecx
test ecx, ecx
jne 0x10007c8a
push dword [ebp - 0x260]
mov edx, dword [ebx + 0x2c]
push dword [ebx + 0x30]
mov ecx, dword [ebp - 0x230]
call fcn.10003530
test eax, eax
jne 0x10007c84
mov edi, esi
cmp dword [ebp - 0x29c], edi
je 0x100080f0
push dword [ebp - 0x29c]
call fcn.10003530
jmp 0x100080f0
mov ecx, dword [ebp - 0x228]
mov eax, dword [ebp + 0xc]
test al, 2
je 0x10007c9b
mov edx, esi
mov dword [ebp - 0x228], esi
jmp 0x10007cb7
test al, 0x20
jne 0x10007cac
xor eax, eax
mov edx, 0x4b2
inc eax
cmp dword [ebx + 0x3c], eax
jne 0x10007cb1
mov edx, 0x4b1
mov dword [ebp - 0x228], edx
test ecx, ecx
jne 0x10007cc1
xor eax, eax
inc eax
mov dword [ebx + 0x20], eax
mov eax, edx
sub eax, esi
je 0x10007ec2
sub eax, 0x4b1
je 0x10007ebb
sub eax, 1
je 0x10007ce0
sub eax, 6
jne 0x10007c66
cmp dword [ebx + 0x3c], 3
jne 0x10007db4
xor eax, eax
mov ecx, ebx
push esi
cmp edx, 0x4b8
push esi
sete al
push eax
push esi
push dword [ebp - 0x224]
mov dword [ebp - 0x258], eax
call fcn.10003530
test eax, eax
jns 0x10007d25
mov ecx, dword [ebp - 0x230]
mov edx, 0xa049
call fcn.10003530
jmp 0x10007c66
cmp dword [ebp - 0x228], 0x4b8
jne 0x10007d65
lea eax, [ebp - 0x24c]
mov ecx, ebx
push eax
push dword [ebp - 0x224]
call fcn.10008c28
mov edi, eax
test edi, edi
jns 0x10007e8a
push esi
push esi
push esi
push esi
push dword [ebp - 0x224]
mov ecx, ebx
call fcn.10003530
jmp 0x10007c66
cmp dword [ebp - 0x22c], 0
jne 0x10007e8a
mov ecx, dword [ebp - 0x224]
lea edx, [ebp - 0x24c]
call fcn.1000951a
mov edi, eax
test edi, edi
jns 0x10007e8a
cmp dword [ebp - 0x240], 0
je 0x10007da8
mov edx, 0xa04c
mov ecx, dword [ebp - 0x230]
call fcn.10003530
mov edi, esi
cmp dword [ebp - 0x29c], 0
jmp 0x10007c6e
cmp dword [ebp - 0x238], 0
jne 0x10007e8a
push ecx
push dword [ebp - 0x224]
call fcn.10003530
test eax, eax
js 0x10007de5
mov eax, dword [ebp - 0x22c]
xor edx, edx
inc edx
mov dword [ebp - 0x258], edx
jmp 0x10007e93
cmp dword [ebx + 0x28], esi
je 0x10007e7b
cmp dword [ebp + 0xc], 4
jne 0x10007dfb
mov edx, 0xa046
jmp 0x10007d9b
cmp dword [ebp - 0x240], 0
je 0x10007da8
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call ebx
lea edx, [ebp - 0x234]
mov dword [ebp - 0x234], esi
mov ecx, 0xa05a
call fcn.10003530
push esi
call ebx
lea edx, [ebp - 0x238]
mov dword [ebp - 0x238], esi
mov ecx, 0xa04b
call fcn.10003530
push 0x2124
push dword [ebp - 0x234]
push dword [ebp - 0x238]
push dword [ebp - 0x230]
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [ebp - 0x238]
xor edi, edi
cmp eax, 6
mov eax, 0x80004005
cmove edi, eax
call ebx
push dword [ebp - 0x234]
call ebx
jmp 0x10007da8
mov eax, dword [ebp - 0x22c]
test eax, eax
jne 0x10007e90
jmp 0x10007d72
mov eax, dword [ebp - 0x22c]
xor edx, edx
inc edx
cmp dword [ebp - 0x258], 0
jne 0x10007ea0
test eax, eax
jne 0x10007eac
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x224], eax
mov dword [ebp + 0xc], 4
mov dword [ebp - 0x264], edx
jmp 0x10007ec2
mov dword [ebp + 0xc], 0x24
cmp dword [ebp - 0x29c], 0
je 0x10007ed6
push dword [ebp - 0x29c]
call fcn.10003530
mov ecx, dword [ebp - 0x224]
mov eax, dword [ebp - 0x23c]
cmp dword [ebp - 0x22c], 0
je 0x1000806e
cmp eax, 3
jne 0x10007fa9
cmp dword [ebx + 0x34], esi
je 0x10007fb9
push ecx
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x224], esi
call fcn.10003530
mov edi, eax
test edi, edi
jns 0x10007f2a
push dword [ebp - 0x224]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x100080f0
push dword [ebx + 0x34]
lea ecx, [ebp - 0x224]
call fcn.10003530
mov edi, eax
test edi, edi
js 0x10007f19
test byte [ebp + 0xc], 0x20
jne 0x10007f7c
mov eax, dword [ebx + 0x34]
test eax, eax
je 0x10007fa2
cmp word [eax], si
je 0x10007fa2
push 0x100920e8
lea ecx, [ebp - 0x224]
call fcn.10003530
mov edi, eax
test edi, edi
js 0x10007f19
push 0x100920f0
lea ecx, [ebp - 0x224]
call fcn.10003530
mov edi, eax
test edi, edi
js 0x10007f19
push dword [ebp - 0x224]
call dword [sym.imp.MSOHEV.dll__PHevCreateFileInfoFromURL_4]
push dword [ebp - 0x224]
mov dword [ebp - 0x234], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x234]
jmp 0x10007fc6
push 0x100920ec
jmp 0x10007f55
cmp eax, 4
jne 0x10007fb9
cmp dword [ebx + 0x38], 0
je 0x10007fb9
push dword [ebx + 0x38]
jmp 0x10007fba
push ecx
call dword [sym.imp.MSOHEV.dll__PHevCreateFileInfoFromURL_4]
mov dword [ebp - 0x234], eax
test eax, eax
je 0x100080f0
mov ecx, dword [ebp - 0x248]
test ecx, ecx
je 0x100080df
cmp word [ecx], si
je 0x100080df
push esi
push ecx
push eax
call dword [sym.imp.MSOHEV.dll__FHevAddToFileInfo_12]
test eax, eax
je 0x100080df
mov eax, dword [ebp + 0xc]
test al, 0x20
je 0x10008019
mov ecx, dword [ebp - 0x23c]
call fcn.10003530
test eax, eax
jne 0x10008016
mov edi, 0x80004005
jmp 0x100080df
mov eax, dword [ebp + 0xc]
test al, 2
je 0x10008027
xor eax, eax
lea esi, [eax + 1]
jmp 0x100080df
push eax
push dword [ebp - 0x234]
push dword [ebp - 0x23c]
call dword [sym.imp.MSOHEV.dll__FHevActivateApp_12]
test eax, eax
jne 0x100080cf
mov edi, 0x80004005
cmp dword [ebp - 0x240], eax
je 0x100080df
cmp dword [ebx + 0x28], esi
je 0x100080df
mov ecx, dword [ebp - 0x230]
mov edx, 0xa04d
call fcn.10003530
jmp 0x100080df
cmp dword [ebp - 0x264], 0
je 0x100080d3
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 5
push 0x10092158
push esi
push ecx
push str.edit
push esi
call edi
cmp eax, 0x20
ja 0x100080cf
push 5
push 0x10092158
push esi
push dword [ebp - 0x224]
push str.open
push esi
call edi
cmp eax, 0x20
ja 0x100080cb
cmp dword [ebp - 0x240], 0
mov edi, 0x80004005
je 0x100080f0
cmp dword [ebx + 0x28], esi
je 0x100080f0
mov edx, 0xa04d
jmp 0x100077dc
mov edi, esi
jmp 0x100080f0
mov edi, esi
jmp 0x100080df
mov edi, 0x80004005
jmp 0x100080f0
call fcn.10003530
mov ebx, dword [ebp - 0x234]
test ebx, ebx
je 0x100080f0
push ebx
call dword [sym.imp.MSOHEV.dll__HevDestroyFileInfo_4]
cmp dword [ebp - 0x25c], 0
je 0x10008105
push dword [ebp - 0x25c]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0x248]
mov ebx, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test eax, eax
je 0x10008119
push eax
call ebx
pop ecx
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x10008127
push eax
call ebx
pop ecx
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x1000813c
xor ecx, ecx
test edi, edi
sets cl
dec ecx
mov word [eax], cx
push dword [ebp - 0x24c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.1008bd84
ret 0x20