Function at 0x30063c76
Capabilities:
Contain obfuscated stackstrings
Persist via default file association registry key
Set registry value

Disassembly:
mov eax, 0x30109ab4
call fcn.300088d4
sub esp, 0x60c
cmp dword [ebp + 0xc], 0
je 0x3006429d
mov dword [ebp - 0x578], 0x30151470
push 0
push 1
push dword [ebp - 0x578]
lea ecx, [ebp - 0x434]
call fcn.3001fae4
and dword [ebp - 4], 0
push 0
push 1
push str.Microsoft_PowerPoint_SlideShow
lea ecx, [ebp - 0x444]
call fcn.3001fae4
mov dword [ebp - 0x57c], eax
mov eax, dword [ebp - 0x57c]
mov dword [ebp - 0x580], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x580]
lea eax, [ebp - 0x434]
push eax
push dword [ebp + 8]
call fcn.30063c1e
add esp, 0xc
and byte [ebp - 4], 0
lea ecx, [ebp - 0x444]
call fcn.3001f90d
mov dword [ebp - 0x14], 0x10000
push 4
lea eax, [ebp - 0x14]
push eax
push 3
push 0
push 0
push 1
push 0x301514bc
lea ecx, [ebp - 0x454]
call fcn.3001fae4
mov dword [ebp - 0x584], eax
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x588], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x588]
call fcn.30008f21
push eax
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x454]
call fcn.3001f90d
push 0
push 1
push str.64818D10_4F9B_11CF_86EA_00AA00B929E8
lea ecx, [ebp - 0x464]
call fcn.3001fae4
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp - 0x58c]
mov dword [ebp - 0x590], eax
mov byte [ebp - 4], 3
push dword [ebp - 0x590]
push 0
push 1
push str.CLSID
lea ecx, [ebp - 0x474]
call fcn.3001fae4
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x594]
mov dword [ebp - 0x598], eax
mov byte [ebp - 4], 4
push dword [ebp - 0x598]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x484]
push eax
call fcn.300164b9
add esp, 0xc
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
mov dword [ebp - 0x5a0], eax
mov byte [ebp - 4], 5
push dword [ebp - 0x5a0]
push dword [ebp + 8]
call fcn.30063c1e
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x484]
call fcn.3001f90d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x474]
call fcn.3001f90d
and byte [ebp - 4], 0
lea ecx, [ebp - 0x464]
call fcn.3001f90d
push 0
push 1
push 0x301514f8
lea ecx, [ebp - 0x494]
call fcn.3001fae4
mov dword [ebp - 0x5a4], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x5a8], eax
mov byte [ebp - 4], 6
push dword [ebp - 0x5a8]
push 0
push 1
push str.Shell
lea ecx, [ebp - 0x4a4]
call fcn.3001fae4
mov dword [ebp - 0x5ac], eax
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x5b0], eax
mov byte [ebp - 4], 7
push dword [ebp - 0x5b0]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.300164b9
add esp, 0xc
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x5b8], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x5b8]
push dword [ebp + 8]
call fcn.30063c1e
add esp, 0xc
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x4b4]
call fcn.3001f90d
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x4a4]
call fcn.3001f90d
and byte [ebp - 4], 0
lea ecx, [ebp - 0x494]
call fcn.3001f90d
push 0
push 1
push str.Show
lea ecx, [ebp - 0x4c4]
call fcn.3001fae4
mov dword [ebp - 0x5bc], eax
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], eax
mov byte [ebp - 4], 9
push dword [ebp - 0x5c0]
push 0
push 1
push str.ShellShow
lea ecx, [ebp - 0x4d4]
call fcn.3001fae4
mov dword [ebp - 0x5c4], eax
mov eax, dword [ebp - 0x5c4]
mov dword [ebp - 0x5c8], eax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x5c8]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x4e4]
push eax
call fcn.300164b9
add esp, 0xc
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x5d0], eax
mov byte [ebp - 4], 0xb
push dword [ebp - 0x5d0]
push dword [ebp + 8]
call fcn.30063c1e
add esp, 0xc
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x4e4]
call fcn.3001f90d
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x4d4]
call fcn.3001f90d
and byte [ebp - 4], 0
lea ecx, [ebp - 0x4c4]
call fcn.3001f90d
push 0
push 1
push str.Open
lea ecx, [ebp - 0x4f4]
call fcn.3001fae4
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x5d8], eax
mov byte [ebp - 4], 0xc
push dword [ebp - 0x5d8]
push 0
push 1
push str.ShellOpen
lea ecx, [ebp - 0x504]
call fcn.3001fae4
mov dword [ebp - 0x5dc], eax
mov eax, dword [ebp - 0x5dc]
mov dword [ebp - 0x5e0], eax
mov byte [ebp - 4], 0xd
push dword [ebp - 0x5e0]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x514]
push eax
call fcn.300164b9
add esp, 0xc
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0x5e8], eax
mov byte [ebp - 4], 0xe
push dword [ebp - 0x5e8]
push dword [ebp + 8]
call fcn.30063c1e
add esp, 0xc
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x514]
call fcn.3001f90d
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x504]
call fcn.3001f90d
and byte [ebp - 4], 0
lea ecx, [ebp - 0x4f4]
call fcn.3001f90d
lea eax, [ebp - 0x424]
mov dword [ebp - 0x10], eax
push 0x1ff
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 1
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x224]
call fcn.3001fae4
mov byte [ebp - 4], 0xf
push 0
push 1
push str.___1_
lea ecx, [ebp - 0x524]
call fcn.3001fae4
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x5f0], eax
mov byte [ebp - 4], 0x10
push dword [ebp - 0x5f0]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.300164b9
add esp, 0xc
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x5f8], eax
mov byte [ebp - 4], 0x11
push dword [ebp - 0x5f8]
lea ecx, [ebp - 0x224]
call fcn.30016390
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x534]
call fcn.3001f90d
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x524]
call fcn.3001f90d
lea eax, [ebp - 0x224]
push eax
push 0
push 1
push str.ShellOpencommand
lea ecx, [ebp - 0x544]
call fcn.3001fae4
mov dword [ebp - 0x5fc], eax
mov eax, dword [ebp - 0x5fc]
mov dword [ebp - 0x600], eax
mov byte [ebp - 4], 0x12
push dword [ebp - 0x600]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x554]
push eax
call fcn.300164b9
add esp, 0xc
mov dword [ebp - 0x604], eax
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x608], eax
mov byte [ebp - 4], 0x13
push dword [ebp - 0x608]
push dword [ebp + 8]
call fcn.30063c1e
add esp, 0xc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x554]
call fcn.3001f90d
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x544]
call fcn.3001f90d
lea eax, [ebp - 0x224]
push eax
push 0
push 1
push str.ShellShowcommand
lea ecx, [ebp - 0x564]
call fcn.3001fae4
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x610], eax
mov byte [ebp - 4], 0x14
push dword [ebp - 0x610]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x574]
push eax
call fcn.300164b9
add esp, 0xc
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x618], eax
mov byte [ebp - 4], 0x15
push dword [ebp - 0x618]
push dword [ebp + 8]
call fcn.30063c1e
add esp, 0xc
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x574]
call fcn.3001f90d
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x564]
call fcn.3001f90d
and byte [ebp - 4], 0
lea ecx, [ebp - 0x224]
call fcn.3001f90d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x434]
call fcn.3001f90d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
mov dword [ebp - 0x578], 0x30151488
jmp 0x30063c9a