Function at 0x30021dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x81f8
call fcn.301600d0
mov eax, dword [0x3021be88]
xor eax, esp
mov dword [esp + 0x81f4], eax
push esi
push edi
mov dword [0x30270328], 1
mov ecx, 0x3026ee58
mov dword [0x3026f8b4], 0xffffffff
mov dword [0x3026f8c0], 0xc
mov dword [0x3026f8d0], 1
mov dword [0x3026f8d4], 1
mov dword [0x302702f4], 1
mov dword [0x302702f8], 0
mov dword [0x3026f8d8], 0
mov dword [0x302702ec], 1
mov dword [0x302702e8], 1
mov dword [0x3026f8cc], 0x1388
mov dword [0x3026f8c8], 1
mov dword [0x30270340], 1
mov dword [0x30270368], 1
mov dword [0x30270344], 1
mov dword [0x30270324], 1
mov dword [0x3027255c], 0x4000
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 0x30d], al
test al, al
jne 0x30021e90
push 0x208
push 0
push 0x3026ec50
call fcn.30162560
add esp, 0xc
push 0x618
push 0
push 0x3026ee58
call fcn.30162560
mov edx, dword [0x302724fc]
add esp, 0xc
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x30021ed2
sub ecx, esi
push ecx
push edx
push 0x3026ee58
call fcn.3016bc70
add esp, 0xc
push 0x3026ee58
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
push eax
push 0x3026ee58
lea eax, [esp + 0xf8]
push str._s_u.ini
push eax
call fcn.3001daf0
lea eax, [esp + 0x100]
push 0x301fc178
push eax
call fcn.3016bb02
mov esi, eax
add esp, 0x18
test esi, esi
jne 0x30021fdc
push 0x104
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.30162560
add esp, 0xc
call edi
push eax
lea eax, [esp + 0xf4]
push str.C:_u.ini
push eax
call fcn.3001daf0
add esp, 0xc
lea eax, [esp + 0xf0]
push 0x301fc178
push eax
call fcn.3016bb02
mov esi, eax
add esp, 8
test esi, esi
jne 0x30021fdc
push 0x104
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.30162560
add esp, 0xc
lea eax, [esp + 0xf0]
push 0x3026ee58
push str._sconfig.ini
push eax
call fcn.3001daf0
add esp, 0xc
lea eax, [esp + 0xf0]
push 0x301fc178
push eax
call fcn.3016bb02
mov esi, eax
add esp, 8
test esi, esi
jne 0x30021fdc
pop edi
pop esi
mov ecx, dword [esp + 0x81f4]
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret
push 0x8000
lea eax, [esp + 0x1fc]
push 0
push eax
call fcn.30162560
add esp, 0xc
test esi, esi
je 0x3002206b
push esi
lea eax, [esp + 0x1fc]
push 0x8000
push eax
call fcn.3016be57
add esp, 0xc
test eax, eax
je 0x30022075
lea eax, [esp + 0x1f8]
push 0xd
push eax
call fcn.30161610
add esp, 8
test eax, eax
je 0x3002202a
mov byte [eax], 0
lea eax, [esp + 0x1f8]
push 0xa
push eax
call fcn.30161610
add esp, 8
test eax, eax
je 0x30022043
mov byte [eax], 0
lea ecx, [esp + 0x1f8]
call fcn.3001ea20
push esi
lea eax, [esp + 0x1fc]
push 0x8000
push eax
call fcn.3016be57
add esp, 0xc
test eax, eax
jne 0x30022011
jmp 0x30022075
mov dword [0x30270314], 1
cmp dword [0x3026f890], 0
je 0x30022087
cmp dword [0x3026f894], 0
je 0x3002208e
mov byte [0x3026f8dc], 0
mov ecx, 0x3026f268
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x30022096
sub ecx, edx
sar ecx, 1
jne 0x300220eb
push 7
push str.default
push 0x3026f164
call fcn.3016bc70
add esp, 0xc
xor ecx, ecx
lea ecx, [ecx]
movsx ax, byte [ecx + 0x3026f164]
mov word [ecx*2 + 0x3026f268], ax
inc ecx
cmp ecx, 0x104
jb 0x300220c0
push 0x3026f268
push str.Python_path_defaulted_to__ws._n
call fcn.30009b40
add esp, 8
test esi, esi
je 0x300220f8
push esi
call fcn.3016bc3e
add esp, 4
cmp dword [0x30270338], 0
je 0x300221b9
push 0x104
push 0
push 0x30270374
mov dword [0x30270324], 0
mov dword [0x30270328], 0
mov dword [0x302702f4], 0
mov dword [0x302702f8], 0
mov dword [0x3026f8d8], 0x64
mov dword [0x302702ec], 0
mov dword [0x302702e8], 0
mov dword [0x3026f8c8], 0
mov dword [0x30270340], 0
mov dword [0x30270344], 0
mov dword [0x3027047c], 0
mov dword [0x30270480], 0
mov dword [0x30270484], 0
mov dword [0x302704a4], 0
mov dword [0x302704a8], 0
mov dword [0x302704ac], 0
call fcn.30162560
add esp, 0xc
cmp dword [0x302728d4], 0xffffffff
jne 0x300221cc
mov dword [0x302728d4], 1
cmp dword [0x3026f8d8], 0
jne 0x300221ee
push 0x64
push str.Dropped_file_limit_defaulting_to__d._n
mov dword [0x3026f8d8], 0x64
call fcn.30009b40
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
mov ecx, edi
call fcn.3004ebb0
test al, al
je 0x30022212
mov dword [0x30273994], 1
jmp 0x3002286e
cmp dword [0x30273994], 0
jne 0x3002286e
mov esi, dword [0x30272508]
push 0x11
push str.c:program_files_
push esi
call fcn.3016b3a4
add esp, 0xc
test eax, eax
je 0x30022251
push 0x17
push str.c:program_files__x86__
push esi
call fcn.3016b3a4
add esp, 0xc
test eax, eax
jne 0x300223f8
mov edx, dword [0x30272508]
mov ecx, edi
call fcn.30004370
cmp eax, 1
jne 0x300223f8
push str.firefox.exe
push dword [0x3027250c]
call fcn.30169d90
add esp, 8
test eax, eax
jne 0x300222b8
push str.Firefox_specific_hook_set_enabled._n
mov dword [0x30270354], 1
mov dword [0x302702ec], eax
mov dword [0x302702e8], eax
mov dword [0x302702f0], eax
mov dword [0x3026f8c8], eax
mov dword [0x302702f8], eax
mov dword [0x30270340], eax
mov dword [0x3026f8d0], eax
call fcn.30009b40
add esp, 4
push str.iexplore.exe
push dword [0x3027250c]
call fcn.30169d90
add esp, 8
test eax, eax
jne 0x300222ff
push str.Internet_Explorer_specific_hook_set_enabled._n
mov dword [0x30270360], 1
mov dword [0x302702ec], eax
mov dword [0x3026f8c8], eax
mov dword [0x3026f8d0], eax
mov dword [0x302702f8], eax
mov dword [0x30270340], eax
call fcn.30009b40
add esp, 4
push str.msedge.exe
push dword [0x3027250c]
call fcn.30169d90
add esp, 8
test eax, eax
jne 0x30022346
push str.Edge_specific_hook_set_enabled._n
mov dword [0x3027035c], 1
mov dword [0x302702ec], eax
mov dword [0x3026f8c8], eax
mov dword [0x3026f8d0], eax
mov dword [0x30270340], eax
mov dword [0x302702f8], eax
call fcn.30009b40
add esp, 4
push str.chrome.exe
push dword [0x3027250c]
call fcn.30169d90
add esp, 8
test eax, eax
jne 0x3002238d
push str.Chrome_specific_hook_set_enabled._n
mov dword [0x30270358], 1
mov dword [0x302702ec], eax
mov dword [0x3026f8c8], eax
mov dword [0x3026f8d0], eax
mov dword [0x30270340], eax
mov dword [0x302702f8], eax
call fcn.30009b40
add esp, 4
push str.Microsoft_Office
push dword [0x302724f8]
call fcn.301613a0
add esp, 8
test eax, eax
je 0x3002286e
mov dword [0x30270350], 1
mov dword [0x302702e8], 0
mov dword [0x302702f0], 0
mov dword [0x302702ec], 0
mov dword [0x302702f8], 0
mov dword [0x30270340], 0
mov dword [0x3026f8d0], 0
push str.Microsoft_Office_settings_enabled._n
jmp 0x30022866
cmp dword [0x30273994], 0
jne 0x3002286e
mov esi, dword [0x30272508]
push 0x14
push str.c:windows_system32_
push esi
call fcn.3016b3a4
add esp, 0xc
test eax, eax
je 0x3002244b
push 0x14
push str.c:windows_syswow64_
push esi
call fcn.3016b3a4
add esp, 0xc
test eax, eax
je 0x3002244b
push 0x15
push str.c:windows_sysnative_
push esi
call fcn.3016b3a4
add esp, 0xc
test eax, eax
jne 0x3002286e
mov edx, dword [0x30272508]
mov ecx, edi
call fcn.30004370
cmp eax, 1
jne 0x3002286e
push str.msiexec.exe
push dword [0x3027250c]
call fcn.30169d90
add esp, 8
test eax, eax
jne 0x300226b6
mov dword [esp + 0x28], str.NtAllocateVirtualMemory
xor esi, esi
mov dword [esp + 0x2c], str.NtProtectVirtualMemory
mov dword [esp + 0x30], 0x301fe014
mov dword [esp + 0x34], str.CryptDecodeMessage
mov dword [esp + 0x38], str.CryptDecryptMessage
mov dword [esp + 0x3c], str.NtCreateThreadEx
mov dword [esp + 0x40], str.SetWindowLongPtrA
mov dword [esp + 0x44], str.SetWindowLongPtrW
mov dword [esp + 0x48], str.NtWaitForSingleObject
mov dword [esp + 0x4c], str.NtSetTimer
mov dword [esp + 0x50], str.NtSetTimerEx
mov dword [esp + 0x54], 0x301fe0ac
mov dword [esp + 0x58], str.RegOpenKeyExW
mov dword [esp + 0x5c], str.RegCreateKeyExA
mov dword [esp + 0x60], str.RegCreateKeyExW
mov dword [esp + 0x64], str.RegDeleteKeyA
mov dword [esp + 0x68], str.RegDeleteKeyW
mov dword [esp + 0x6c], str.RegEnumKeyW
mov dword [esp + 0x70], str.RegEnumKeyExA
mov dword [esp + 0x74], str.RegEnumKeyExW
mov dword [esp + 0x78], str.RegEnumValueA
mov dword [esp + 0x7c], str.RegEnumValueW
mov dword [esp + 0x80], str.RegSetValueExA
mov dword [esp + 0x84], str.RegSetValueExW
mov dword [esp + 0x88], 0x301fe178
mov dword [esp + 0x8c], str.RegQueryValueExW
mov dword [esp + 0x90], str.RegDeleteValueA
mov dword [esp + 0x94], str.RegDeleteValueW
mov dword [esp + 0x98], str.RegQueryInfoKeyA
mov dword [esp + 0x9c], str.RegQueryInfoKeyW
mov dword [esp + 0xa0], 0x301fe1e8
mov dword [esp + 0xa4], str.RegNotifyChangeKeyValue
mov dword [esp + 0xa8], str.NtCreateKey
mov dword [esp + 0xac], str.NtOpenKey
mov dword [esp + 0xb0], str.NtOpenKeyEx
mov dword [esp + 0xb4], str.NtRenameKey
mov dword [esp + 0xb8], str.NtReplaceKey
mov dword [esp + 0xbc], str.NtEnumerateKey
mov dword [esp + 0xc0], str.NtEnumerateValueKey
mov dword [esp + 0xc4], str.NtSetValueKey
mov dword [esp + 0xc8], str.NtQueryValueKey
mov dword [esp + 0xcc], str.NtQueryMultipleValueKey
mov dword [esp + 0xd0], str.NtDeleteKey
mov dword [esp + 0xd4], str.NtDeleteValueKey
mov dword [esp + 0xd8], str.NtLoadKey
mov dword [esp + 0xdc], str.NtLoadKey2
mov dword [esp + 0xe0], str.NtLoadKeyEx
mov dword [esp + 0xe4], str.NtQueryKey
mov dword [esp + 0xe8], str.NtSaveKey
mov dword [esp + 0xec], str.NtSaveKeyEx
mov ecx, dword [esp + esi*4 + 0x28]
call fcn.30028d30
test eax, eax
je 0x30022677
inc esi
cmp esi, 0x32
jb 0x30022662
jmp 0x30022684
push str.Unable_to_set_hook_exclusion_for_msiexec._n
call fcn.30009b40
add esp, 4
mov dword [0x3026f8d0], 0
mov dword [0x302702f8], 0
mov dword [0x30270340], 0
mov dword [0x30270364], 1
push str.MsiExec_hook_set_enabled_n
jmp 0x30022866
push str.services.exe
push dword [0x3027250c]
call fcn.30169d90
add esp, 8
test eax, eax
jne 0x300226df
mov ecx, str.C:WindowsSystem32wininit.exe
call fcn.3004c1a0
test al, al
jne 0x3002280c
push str.svchost.exe
push dword [0x3027250c]
call fcn.30169d90
add esp, 8
test eax, eax
jne 0x3002273a
mov ecx, str.C:WindowsSystem32_services.exe
call fcn.3004c1a0
test al, al
je 0x3002273a
push str._k_DcomLaunch
push dword [0x30272500]
call fcn.3016111e
add esp, 8
test eax, eax
jne 0x3002280c
push str._k_netsvcs
push dword [0x30272500]
call fcn.3016111e
add esp, 8
test eax, eax
jne 0x3002280c
push str.WmiPrvSE.exe
push dword [0x3027250c]
call fcn.30169d90
add esp, 8
test eax, eax
jne 0x3002279c
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x18
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x302466f4]
test eax, eax
js 0x30022781
cmp dword [esp + 0xc], 0x18
jne 0x30022781
mov eax, dword [esp + 0x24]
jmp 0x30022783
xor eax, eax
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x300227f5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.wscript.exe
push dword [0x3027250c]
call fcn.30169d90
add esp, 8
test eax, eax
jne 0x3002286e
mov dword [esp + 0x10], str.memcpy
xor esi, esi
mov dword [esp + 0x14], str.LoadResource
mov dword [esp + 0x18], str.LockResource
mov dword [esp + 0x1c], str.SizeofResource
lea esp, [esp]
mov ecx, dword [esp + esi*4 + 0x10]
call fcn.30028d30
test eax, eax
je 0x30022854
inc esi
cmp esi, 4
jb 0x300227e0
jmp 0x30022861
push str._Embedding
push dword [0x30272500]
call fcn.3016111e
add esp, 8
test eax, eax
je 0x3002279c
mov dword [0x302702f8], 0
mov dword [0x30270340], 0
mov dword [0x302702e8], 0
mov dword [0x302702f0], 0
mov dword [0x302702ec], 0
mov dword [0x30270348], 1
call fcn.3003f6c0
push str.Services_hook_set_enabled_n
jmp 0x30022866
push str.Unable_to_set_hook_exclusion_for_wscript_n
call fcn.30009b40
add esp, 4
push str.wscript_hook_set_enabled_n
call fcn.30009b40
add esp, 4
mov ecx, dword [esp + 0x81fc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.3015f3bd
mov esp, ebp
pop ebp
ret