Function at 0x10030b70
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x100668d8]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x340], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerSearchScopes
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10030bc8
cmp dword [ebp - 0xc], 0
jne 0x10030bd3
xor ecx, ecx
jne 0x10030bc8
xor eax, eax
jmp 0x10030daf
mov dword [ebp - 8], 0
mov dword [ebp - 8], 0
jmp 0x10030bec
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
push 0x100
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x10030d9c
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x118]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10030c32
cmp dword [ebp - 4], 0
jne 0x10030c34
jmp 0x10030be3
mov ax, word [0x10057424]
mov word [ebp - 0x328], ax
push 0x206
push 0
lea ecx, [ebp - 0x326]
push ecx
call fcn.1003ac40
add esp, 0xc
mov dword [ebp - 0x32c], 0x208
lea edx, [ebp - 0x32c]
push edx
lea eax, [ebp - 0x328]
push eax
lea ecx, [ebp - 0x11c]
push ecx
push 0
push 0x10057428
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10030d87
cmp dword [ebp - 0x11c], 1
jne 0x10030d87
lea eax, [ebp - 0x328]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x340]
call fcn.10030a50
test eax, eax
je 0x10030d87
call fcn.10001fa0
mov dword [ebp - 0x338], eax
lea edx, [ebp - 0x118]
mov dword [ebp - 0x33c], edx
cmp dword [ebp - 0x33c], 0
jne 0x10030ceb
mov dword [ebp - 0x344], 0
jmp 0x10030d5f
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 0x3fffffff
jle 0x10030d19
mov dword [ebp - 0x348], 0
jmp 0x10030d53
mov eax, dword [ebp - 0x330]
shl eax, 1
call fcn.1003a650
mov dword [ebp - 0x34c], esp
mov ecx, dword [ebp - 0x338]
push ecx
mov edx, dword [ebp - 0x330]
push edx
mov eax, dword [ebp - 0x33c]
push eax
mov ecx, dword [ebp - 0x34c]
push ecx
call fcn.10001fb0
mov dword [ebp - 0x348], eax
mov edx, dword [ebp - 0x348]
mov dword [ebp - 0x344], edx
mov eax, dword [ebp - 0x344]
push eax
push 0x208
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.100112d0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], 1
jmp 0x10030d9c
cmp dword [ebp - 4], 0
je 0x10030d97
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10030be3
cmp dword [ebp - 0xc], 0
je 0x10030dac
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
lea esp, [ebp - 0x34c]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1003a5ba
mov esp, ebp
pop ebp
ret 8