Function at 0x10003a90
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0xa3c
mov al, byte [0x1001036c]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x148], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x149]
mov ebx, dword [esp + 0xa50]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
push 0x418
push ebx
mov dword [esp + 0x18], edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, eax
cmp ebp, edi
jne 0x10003ae5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xa3c
ret
mov eax, dword [0x10013af4]
cmp eax, edi
jne 0x10003b09
push 0x7d6
push ebx
call fcn.10002ee0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa3c
ret
xor esi, esi
cmp eax, edi
jbe 0x10003b31
push 0xf000
push esi
push 0x102c
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
shr eax, 0xc
dec eax
jne 0x10003b4c
mov eax, dword [0x10013af4]
inc esi
cmp esi, eax
jb 0x10003b0f
push 0x1fd
push ebx
call fcn.10002ee0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa3c
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], 1
push ecx
push 0xf003f
push edi
push str.SoftwareMicrosoftInternet_ExplorerTypedURLs
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10003b79
cmp dword [esp + 0x10], edi
jne 0x10003b7d
mov dword [esp + 0x14], edi
mov eax, dword [0x10013ad4]
cmp eax, edi
je 0x10003b89
push ebx
call eax
mov dl, byte [0x1001036c]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x24d]
mov byte [esp + 0x24c], dl
mov byte [esp + 0x44], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x45]
mov ebx, 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10003c16
mov ecx, dword [0x10013ae8]
xor eax, eax
test ecx, ecx
jbe 0x10003c16
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea esi, [eax + 1]
lea edx, [esp + 0x148]
push esi
push str.url_d
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snprintf]
mov ecx, dword [esp + 0x20]
add esp, 0x10
lea eax, [esp + 0x148]
push eax
push ecx
call edi
mov ecx, dword [0x10013ae8]
mov eax, esi
cmp eax, ecx
jb 0x10003bdc
mov eax, dword [0x10013af4]
xor esi, esi
test eax, eax
jbe 0x10003d0a
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x24c]
mov dword [esp + 0x24], eax
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x1c]
push eax
push esi
lea edx, [esp + 0x254]
push 0x102d
push ebp
mov dword [esp + 0x44], 0x800
mov dword [esp + 0x40], edx
call edi
push 0xf000
push esi
push 0x102c
push ebp
call edi
shr eax, 0xc
dec eax
mov eax, dword [0x10013ae8]
je 0x10003c9b
cmp esi, eax
jb 0x10003cfc
mov eax, dword [0x10013ae0]
test eax, eax
je 0x10003cfc
mov eax, dword [0x10013ad0]
test eax, eax
je 0x10003cfc
lea ecx, [esp + 0x24c]
push ecx
call eax
jmp 0x10003cfc
cmp esi, eax
jae 0x10003cfc
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10003cfc
push ebx
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x48]
push str.url_d
lea edx, [esp + 0x4c]
push 0x103
push edx
rep stosd dword es:[edi], eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea edi, [esp + 0x24c]
or ecx, 0xffffffff
xor eax, eax
inc ebx
mov edx, dword [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x24c]
push ecx
push eax
push 1
lea ecx, [esp + 0x50]
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x10013af4]
inc esi
cmp esi, eax
jb 0x10003c25
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10003d2f
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x10013ae4]
test eax, eax
je 0x10003d3a
call eax
lea ecx, [esp + 0x18]
push ecx
push 0x3e8
push 2
push 0
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xa3c
ret