Function at 0x30004c1f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x30001a14]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov dword [ebp - 0x42c], ecx
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x40c], edi
mov dword [ebp - 0x408], edi
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x434], 0x200
call fcn.30001eeb
test eax, eax
jne 0x30004ca3
push esi
call fcn.30001eeb
test eax, eax
je 0x30004cad
mov ebx, 0x80070057
jmp 0x30004f45
lea eax, [ebp - 0x408]
push eax
push edi
push esi
call fcn.300046d4
test eax, eax
jl 0x30004d01
mov eax, dword [ebp - 0x408]
add eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x40c], eax
cmp eax, edi
je 0x30004d01
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x40c]
push esi
call fcn.300046d4
test eax, eax
jge 0x30004d01
push dword [ebp - 0x40c]
call fcn.3000367a
mov dword [ebp - 0x40c], edi
mov eax, dword [ebp - 0x40c]
xor ebx, ebx
mov dword [ebp - 0x408], eax
cmp eax, edi
jne 0x30004d19
mov dword [ebp - 0x408], esi
push dword [ebp - 0x41c]
call fcn.30001eeb
test eax, eax
jne 0x30004e4e
lea eax, [ebp - 0x420]
push eax
mov esi, 0x20019
push esi
push edi
push dword [ebp - 0x408]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.30001aac
mov ebx, eax
cmp ebx, edi
jl 0x30004f45
lea eax, [ebp - 0x428]
push eax
push esi
push dword [0x30007084]
push dword [ebp - 0x420]
call fcn.30001f06
mov ebx, eax
cmp ebx, edi
jl 0x30004f45
lea eax, [ebp - 0x424]
push eax
push esi
push dword [ebp - 0x41c]
push dword [ebp - 0x428]
call fcn.30001f06
mov ebx, eax
cmp ebx, edi
jl 0x30004f45
lea eax, [ebp - 0x414]
push eax
push esi
push dword [0x30007088]
push dword [ebp - 0x424]
call fcn.30001f06
mov ebx, eax
cmp ebx, edi
jl 0x30004f45
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x410]
push eax
push edi
push dword [ebp - 0x414]
call fcn.30003c54
mov ebx, eax
cmp ebx, edi
mov eax, 0x80070002
jge 0x30004df2
cmp ebx, eax
jne 0x30004f45
cmp ebx, eax
je 0x30004e12
cmp ebx, edi
jl 0x30004e4e
push dword [ebp - 0x410]
call fcn.30003c3d
test eax, eax
je 0x30004e12
cmp dword [ebp - 0x418], 2
ja 0x30004e4e
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x410]
push eax
push dword [0x3000709c]
push dword [ebp - 0x414]
call fcn.30003c54
mov ebx, eax
cmp ebx, edi
jl 0x30004f45
cmp dword [ebp - 0x418], edi
ja 0x30004e4e
mov ebx, 0x80004005
jmp 0x30004f45
mov esi, dword [ebp - 0x42c]
push esi
call fcn.30001eeb
test eax, eax
jne 0x30004e8e
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x41c]
mov dword [ebp - 0x410], edi
push dword [ebp - 0x408]
call fcn.30004848
mov ebx, eax
cmp ebx, edi
jl 0x30004e8e
cmp dword [ebp - 0x410], edi
je 0x30004e8e
cmp esi, edi
jne 0x30004ed8
mov esi, dword [ebp - 0x430]
push 3
push esi
call dword [sym.imp.SHLWAPI.dll_UrlIsW]
test eax, eax
je 0x30004ed8
push 0x400
lea eax, [ebp - 0x404]
push edi
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathCreateFromUrlW]
test eax, eax
jl 0x30004ed6
lea esi, [ebp - 0x404]
xor ebx, ebx
push 0x3c
lea eax, [ebp - 0x470]
push edi
push eax
call sub.MSVCR90.dll_memset
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x448], eax
add esp, 0xc
lea eax, [ebp - 0x470]
push eax
mov dword [ebp - 0x470], 0x3c
mov dword [ebp - 0x46c], 0x101
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x454], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x30004f45
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.30001aac
mov ebx, eax
push dword [ebp - 0x40c]
call fcn.3000367a
lea eax, [ebp - 0x420]
push eax
call fcn.30001f27
lea eax, [ebp - 0x428]
push eax
call fcn.30001f27
lea eax, [ebp - 0x424]
push eax
call fcn.30001f27
lea eax, [ebp - 0x414]
push eax
call fcn.30001f27
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.30005a28
leave
ret 0x10