Function at 0x10002e04
Capabilities:
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x224
push ebx
push ebp
push esi
push edi
push str.OpenProcessToken
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
xor ebx, ebx
mov ebp, 0x104
push ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x17], bl
call esi
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
je 0x10002e4e
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebp
lea eax, [esp + 0x30]
push ebx
push eax
call fcn.100082d0
push str.explorer.exe
call fcn.10006dd3
add esp, 0x10
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebp, eax
push ebx
mov dword [esp + 0x28], ebp
call esi
test eax, eax
je 0x10002e96
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
cmp ebp, ebx
je 0x1000302b
lea eax, [esp + 0x1c]
push eax
push 0xf01ff
push ebp
call dword [esp + 0x2c]
test eax, eax
je 0x10003021
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
push ebx
call esi
test eax, eax
je 0x10002edb
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
lea eax, [esp + 0x18]
push eax
push 0xf003f
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x10002ff5
push ebx
call esi
test eax, eax
je 0x10002f0f
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
lea eax, [esp + 0x14]
push eax
push 1
push ebx
push str.SoftwareMicrosoftInternet_ExplorerMain
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x10002fef
push ebx
call esi
test eax, eax
je 0x10002f50
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
push eax
push ebx
push ebx
push str.Start_Page
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002f86
mov byte [esp + 0x13], 1
push dword [esp + 0x14]
call ebp
push ebx
call esi
test eax, eax
je 0x10002f96
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xc8
jle 0x10002fc1
push str.too_long_homepage
jmp 0x10002fc6
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x23c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call esi
test eax, eax
je 0x10002fdd
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push dword [esp + 0x18]
call ebp
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push ebx
call esi
test eax, eax
je 0x10003005
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.page
push 0x10009250
push str.no_h
lea eax, [esp + 0x13c]
push str._s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
push ebx
call esi
test eax, eax
je 0x1000305a
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
cmp byte [esp + 0x13], bl
jne 0x10003087
lea eax, [esp + 0x130]
push eax
push dword [esp + 0x23c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call esi
test eax, eax
je 0x10003091
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x10009210
push dword [esp + 0x23c]
call ebp
lea eax, [esp + 0x130]
push eax
push dword [esp + 0x23c]
call ebp
push 0x10009210
push dword [esp + 0x23c]
call ebp
push ebx
call esi
test eax, eax
je 0x100030e0
push ebx
call edi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
push ebx
call edi
push ebx
call esi
lea eax, [esp + 0x130]
push eax
push dword [esp + 0x23c]
call ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x224
ret