Function at 0x300049e2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x30001954]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
mov dword [ebp - 0x42c], ecx
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x41c], ecx
mov dword [ebp - 0x40c], edi
mov dword [ebp - 0x408], edi
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x434], 0x200
call fcn.30001e29
test eax, eax
jne 0x30004a66
push esi
call fcn.30001e29
test eax, eax
je 0x30004a70
mov ebx, 0x80070057
jmp 0x30004d08
lea eax, [ebp - 0x408]
push eax
push edi
push esi
call fcn.3000487d
test eax, eax
jl 0x30004ac4
mov eax, dword [ebp - 0x408]
add eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, edi
mov dword [ebp - 0x40c], eax
je 0x30004ac4
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x40c]
push esi
call fcn.3000487d
test eax, eax
jge 0x30004ac4
push dword [ebp - 0x40c]
call fcn.300034d6
mov dword [ebp - 0x40c], edi
mov eax, dword [ebp - 0x40c]
xor ebx, ebx
cmp eax, edi
mov dword [ebp - 0x408], eax
jne 0x30004adc
mov dword [ebp - 0x408], esi
push dword [ebp - 0x41c]
call fcn.30001e29
test eax, eax
jne 0x30004c11
lea eax, [ebp - 0x420]
push eax
mov esi, 0x20019
push esi
push edi
push dword [ebp - 0x408]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.300019ec
mov ebx, eax
cmp ebx, edi
jl 0x30004d08
lea eax, [ebp - 0x428]
push eax
push esi
push dword [0x30007084]
push dword [ebp - 0x420]
call fcn.30001e44
mov ebx, eax
cmp ebx, edi
jl 0x30004d08
lea eax, [ebp - 0x424]
push eax
push esi
push dword [ebp - 0x41c]
push dword [ebp - 0x428]
call fcn.30001e44
mov ebx, eax
cmp ebx, edi
jl 0x30004d08
lea eax, [ebp - 0x414]
push eax
push esi
push dword [0x30007088]
push dword [ebp - 0x424]
call fcn.30001e44
mov ebx, eax
cmp ebx, edi
jl 0x30004d08
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x410]
push eax
push edi
push dword [ebp - 0x414]
call fcn.300039db
mov ebx, eax
cmp ebx, edi
mov eax, 0x80070002
jge 0x30004bb5
cmp ebx, eax
jne 0x30004d08
cmp ebx, eax
je 0x30004bd5
cmp ebx, edi
jl 0x30004c11
push dword [ebp - 0x410]
call fcn.300039c4
test eax, eax
je 0x30004bd5
cmp dword [ebp - 0x418], 2
ja 0x30004c11
lea eax, [ebp - 0x418]
push eax
push edi
lea eax, [ebp - 0x410]
push eax
push dword [0x3000709c]
push dword [ebp - 0x414]
call fcn.300039db
mov ebx, eax
cmp ebx, edi
jl 0x30004d08
cmp dword [ebp - 0x418], edi
ja 0x30004c11
mov ebx, 0x80004005
jmp 0x30004d08
mov esi, dword [ebp - 0x42c]
push esi
call fcn.30001e29
test eax, eax
jne 0x30004c51
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x41c]
mov dword [ebp - 0x410], edi
push dword [ebp - 0x408]
call fcn.300044a8
mov ebx, eax
cmp ebx, edi
jl 0x30004c51
cmp dword [ebp - 0x410], edi
je 0x30004c51
cmp esi, edi
jne 0x30004c9b
mov esi, dword [ebp - 0x430]
push 3
push esi
call dword [sym.imp.SHLWAPI.dll_UrlIsW]
test eax, eax
je 0x30004c9b
push 0x400
lea eax, [ebp - 0x404]
push edi
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathCreateFromUrlW]
test eax, eax
jl 0x30004c99
lea esi, [ebp - 0x404]
xor ebx, ebx
push 0x3c
lea eax, [ebp - 0x470]
push edi
push eax
call sub.MSVCR80.dll_memset
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x448], eax
add esp, 0xc
lea eax, [ebp - 0x470]
push eax
mov dword [ebp - 0x470], 0x3c
mov dword [ebp - 0x46c], 0x101
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x454], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x30004d08
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.300019ec
mov ebx, eax
push dword [ebp - 0x40c]
call fcn.300034d6
lea eax, [ebp - 0x420]
push eax
call fcn.30001e65
lea eax, [ebp - 0x428]
push eax
call fcn.30001e65
lea eax, [ebp - 0x424]
push eax
call fcn.30001e65
lea eax, [ebp - 0x414]
push eax
call fcn.30001e65
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.300050fe
leave
ret 0x10