Function at 0x10002901
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x290
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push ebp
push esi
mov esi, ecx
push edi
test esi, esi
je 0x10002967
cmp dword [esi + 4], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
je 0x1000292f
push dword [esi + 4]
call edi
mov ecx, eax
call fcn.1000350d
cmp dword [esi + 0xc], 0
je 0x10002941
push dword [esi + 0xc]
call edi
mov ecx, eax
call fcn.1000350d
cmp dword [esi + 8], 0
je 0x10002953
push dword [esi + 8]
call edi
mov ecx, eax
call fcn.1000350d
cmp dword [esi + 0x10], 0
je 0x10002974
push dword [esi + 0x10]
call edi
mov ecx, eax
call fcn.1000350d
jmp 0x10002974
push str.Time
push dword [0x10026bc4]
call ebx
mov edi, 0x20a
lea eax, [esp + 0x94]
push edi
push eax
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
push eax
lea eax, [esp + 0x98]
mov dword [esp + 0x18], 1
push eax
lea eax, [esp + 0x1c]
mov ebp, str.URLC
push eax
push 0
mov eax, str.URLN
cmovne eax, ebp
push eax
push dword [0x10026bc4]
call edi
test eax, eax
je 0x10002aa6
push 0x68
pop eax
push 0x74
mov word [esp + 0x20], ax
pop eax
push 0x70
mov word [esp + 0x22], ax
mov word [esp + 0x24], ax
pop eax
push 0x3a
mov word [esp + 0x26], ax
pop eax
push 0x2f
mov word [esp + 0x28], ax
pop eax
push 0x31
mov word [esp + 0x2a], ax
mov word [esp + 0x2c], ax
pop eax
push 0x39
mov word [esp + 0x2e], ax
pop eax
push 0x33
pop edx
push 0x2e
pop ecx
push 0x32
pop ebp
push 0x31
mov word [esp + 0x30], ax
mov word [esp + 0x38], ax
pop eax
push 0x30
mov word [esp + 0x3c], ax
pop eax
push 0x2f
mov word [esp + 0x44], ax
mov word [esp + 0x34], cx
mov word [esp + 0x3a], cx
mov word [esp + 0x40], cx
pop ecx
push 0x61
pop eax
push 0x70
mov word [esp + 0x4a], ax
pop eax
mov word [esp + 0x48], ax
push 0x69
pop eax
mov word [esp + 0x4a], ax
xor eax, eax
mov word [esp + 0x4e], ax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x98]
mov word [esp + 0x32], dx
push 0x100201b0
push eax
mov word [esp + 0x3e], bp
mov word [esp + 0x46], dx
mov word [esp + 0x4a], bp
mov word [esp + 0x4e], bp
mov word [esp + 0x50], cx
mov word [esp + 0x58], cx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [esp + 0x10], eax
mov ebp, str.URLC
test esi, esi
je 0x10002b51
lea eax, [esp + 0x58]
push eax
lea edx, [esp + 0x20]
lea ecx, [esp + 0x98]
call fcn.10003520
pop ecx
test eax, eax
je 0x10002b9a
xor eax, eax
push 4
pop ecx
cmp dword [esp + 0x28], ecx
mov dword [esp + 0x10], ecx
sete al
mov dword [esp + 0x14], ecx
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x30]
and dword [esp + 0x18], 0
mov dword [esi], eax
mov eax, dword [esp + 0x48]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x68]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x84]
mov dword [esi + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push str.Next
push dword [0x10026bc4]
call edi
mov ecx, dword [esp + 0x18]
test eax, eax
push 0xc
pop edx
cmovne ecx, edx
mov edi, 0xfe
cmp ecx, edi
movzx eax, cl
cmova eax, edi
test ecx, ecx
movzx eax, al
cmovne edx, eax
mov byte [esi + 0x18], dl
jmp 0x10002b9a
lea eax, [esp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
lea eax, [esp + 0x98]
push eax
push 1
push 0
push ebp
push dword [0x10026bc4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push str.URLN
push dword [0x10026bc4]
call ebx
push str.Next
push dword [0x10026bc4]
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x290
ret