Function at 0x1030dc0
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1039004]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov eax, dword [ebx]
push esi
xor esi, esi
cmp eax, 5
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x210], edx
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x218], esi
je 0x1030e4f
shl eax, 6
add eax, 0x1018110
cmp edi, esi
jne 0x1030e1d
mov eax, dword [eax + 0x1c]
mov dword [edx], eax
jmp 0x1031152
mov ecx, dword [eax + 0x1c]
cmp ecx, dword [edx]
jbe 0x1030e3c
pop edi
pop esi
mov eax, 0xea
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 0xc
push ecx
mov ecx, dword [eax + 0x18]
push ecx
push edi
call sub.MSVCR80.dll_memcpy
add esp, 0xc
jmp 0x1031152
cmp dword [ebp + 0x10], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x224], esi
je 0x1030ebf
lea edx, [ebp - 0x208]
push edx
call fcn.0102fb20
mov esi, eax
test esi, esi
jne 0x103110b
mov esi, dword [ebp - 0x208]
mov eax, dword [esi]
xor ecx, ecx
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
mov dword [ebp - 0x218], eax
jne 0x1030eab
mov esi, 8
jmp 0x103110b
mov ecx, dword [esi]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
xor esi, esi
mov eax, dword [ebx + 4]
lea edx, [ebp - 0x214]
push edx
mov edx, dword [ebx + 0x408]
or eax, 8
push eax
push esi
lea ecx, [ebx + 8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x103110b
xor ebx, ebx
test edi, edi
jne 0x1030ef9
mov eax, dword [ebp - 0x210]
mov dword [eax], ebx
jmp 0x1030f03
mov ecx, dword [ebp - 0x210]
mov ebx, dword [ecx]
shr ebx, 1
mov ecx, dword [ebp - 0x214]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x204]
push eax
push 0
push ecx
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x20c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x10310b1
call fcn.010247e0
push eax
push 2
lea edx, [ebp - 0x204]
push edx
push 0x101a524
call dword [sym.imp.MSVCR80.dll__wcsnicmp_l]
add esp, 0x10
test eax, eax
jne 0x103106a
cmp dword [ebp + 0x10], eax
je 0x1030fe6
call fcn.010247e0
push eax
lea eax, [ebp - 0x204]
push 0x1001684
push eax
call dword [sym.imp.MSVCR80.dll__wcsicmp_l]
add esp, 0xc
test eax, eax
je 0x1030fe6
lea ecx, [ebp - 0x22c]
push ecx
mov ecx, dword [ebp - 0x218]
lea edx, [ebp - 0x228]
push edx
mov edx, dword [ebp - 0x208]
lea eax, [ebp - 0x220]
push eax
push ecx
mov ecx, dword [ebp - 0x230]
push edx
lea eax, [ebp - 0x204]
push eax
call fcn.0102eb10
mov esi, eax
test esi, esi
jne 0x103110b
mov ecx, dword [ebp - 0x228]
cmp ecx, dword [ebp - 0x22c]
je 0x1030fe6
mov dword [ebp - 0x224], 1
test edi, edi
jne 0x103101e
mov ecx, dword [ebp - 0x20c]
lea eax, [ecx + 1]
cmp eax, ecx
jb 0x1031106
cmp eax, 0x7fffffff
ja 0x1031106
mov edx, dword [ebp - 0x210]
mov eax, dword [edx]
lea ecx, [eax + ecx*2 + 2]
cmp ecx, eax
jb 0x1031106
mov dword [edx], ecx
jmp 0x103106a
test ebx, ebx
je 0x10310c4
lea edx, [ebp - 0x204]
push edx
mov word [edi + ebx*2 - 2], 0
call fcn.010247e0
push eax
push 0x1018490
lea eax, [ebx - 1]
push eax
push edi
call dword [sym.imp.MSVCR80.dll__snwprintf_l]
add esp, 0x14
test eax, eax
jl 0x10310c4
mov ecx, dword [ebp - 0x20c]
cmp eax, ecx
jne 0x1031106
or edx, 0xffffffff
sub edx, ecx
add ebx, edx
lea edi, [edi + ecx*2 + 2]
mov eax, dword [ebp - 0x21c]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
add eax, 1
lea edx, [ebp - 0x204]
push edx
push eax
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x214]
push eax
mov dword [ebp - 0x20c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x1030f46
test edi, edi
jne 0x10310c0
mov eax, dword [ebp - 0x210]
add dword [eax], 2
jmp 0x10310d0
test ebx, ebx
ja 0x10310cb
mov esi, 0xea
jmp 0x103110b
mov word [edi], 0
cmp esi, 0x103
jne 0x10310dc
xor esi, esi
jmp 0x10310e0
test esi, esi
jne 0x103110b
cmp dword [ebp + 0x10], 0
je 0x103110b
mov ecx, dword [ebp - 0x220]
mov edx, dword [ebp - 0x208]
cmp ecx, dword [edx]
jne 0x10310ff
cmp dword [ebp - 0x224], 0
je 0x103110b
mov esi, 0x456
jmp 0x103110b
mov esi, 0xd
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x103111c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x208]
test edi, edi
je 0x103113f
mov eax, dword [edi + 4]
test eax, eax
je 0x1031136
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [ebp - 0x218]
test eax, eax
je 0x1031152
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01029f27
mov esp, ebp
pop ebp
ret 0xc