Function at 0x300577c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [0x3002dd90]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
push ebx
push esi
mov ebx, ecx
je 0x30057822
mov eax, dword [ebx + 0x64]
push 0
push 0x10000004
push 0x490002
push eax
call dword [sym.imp.MSO.dll_Ordinal_7321]
mov esi, eax
test esi, 0x1000
je 0x30057818
push 1
push 0x3003fa48
call dword [sym.imp.MSO.dll_Ordinal_1612]
and esi, 0xffffefff
cmp esi, 6
je 0x3005782d
jmp 0x3005798f
push 0x19f7
call dword [sym.imp.MSO.dll_Ordinal_6788]
call dword [sym.imp.MSO.dll_Ordinal_9170]
test eax, eax
jne 0x30057865
call dword [sym.imp.MSO.dll_Ordinal_9450]
test eax, eax
jne 0x30057865
mov ecx, dword [ebx + 0x64]
push eax
push 0x10
push 0x490006
push ecx
call dword [sym.imp.MSO.dll_Ordinal_7321]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30001d24
mov esp, ebp
pop ebp
ret 4
mov ecx, ebx
call fcn.30056a8f
test al, al
je 0x3005798f
push edi
call dword [sym.imp.ONMain.DLL_public:_static_class_MsoCF::CLangConfig____stdcall_MsoCF::CLangConfig::Instance_void_]
mov esi, dword [eax + 0x18]
mov edi, dword [sym.imp.MSO.dll_Ordinal_6281]
push 0x19
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
push esi
push 0xd0003
call edi
test eax, eax
je 0x3005797b
push 0x19
push 0
push 0
push 0
push esi
push 0xd0004
call edi
test eax, eax
je 0x3005797b
cmp word [ebp - 0x20c], 0x22
mov eax, 0x300579bc
jne 0x300578d0
mov eax, 0x300579b4
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea edx, [ebp - 0x620]
push edx
mov edx, 0x106
call fcn.3005565e
add esp, 0xc
push 0x1c3f
call dword [sym.imp.MSO.dll_Ordinal_6788]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x300579a4
call dword [sym.imp.MSO.dll_Ordinal_6330]
test eax, eax
je 0x30057933
push 5
push 0
lea ecx, [ebp - 0x620]
push ecx
lea edx, [ebp - 0x414]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x3005798e
call dword [sym.imp.MSO.dll_Ordinal_9170]
test eax, eax
push 0x10
mov ecx, ebx
je 0x3005795e
push 0x490005
call fcn.30055893
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30001d24
mov esp, ebp
pop ebp
ret 4
push 0x490004
call fcn.30055893
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.30001d24
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebx + 0x64]
push 0
push 0x10
push 0x490003
push eax
call dword [sym.imp.MSO.dll_Ordinal_7321]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.30001d24
mov esp, ebp
pop ebp
ret 4

Function at 0x300580f4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
push edi
mov dword [ebp - 4], ecx
jne 0x3005810f
push 0x80004005
call fcn.30057e4f
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
push esi
call ebx
add eax, 1
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x30058117
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
push edi
push eax
mov eax, dword [edx]
push 7
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8