Function at 0x102ed10
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1039004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
push edi
lea edx, [eax + 4]
mov dword [ebp - 0x41c], eax
mov eax, dword [eax]
lea esi, [ebp - 0x410]
push esi
or eax, 0xa
push eax
xor edi, edi
push edi
push edx
push ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x414], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x102efcb
mov eax, dword [ebp - 0x410]
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x204]
push edx
push ebx
push eax
mov dword [ebp - 0x40c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x102ede1
lea ecx, [ecx]
mov ecx, dword [ebp - 0x40c]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x204]
push eax
lea edi, [edi + ecx*2 + 2]
mov ecx, dword [ebp - 0x410]
add ebx, 1
push ebx
push ecx
mov dword [ebp - 0x40c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x102eda0
add edi, 2
cmp esi, 0x103
je 0x102edf4
test esi, esi
jne 0x102efca
xor ecx, ecx
lea eax, [edi + 1]
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
mov dword [ebp - 0x414], eax
jne 0x102ee26
mov esi, 0xe
jmp 0x102efca
mov edx, dword [ebp - 0x410]
push 0
push 0
push 0
shr edi, 1
push 0
mov ebx, edi
mov edi, eax
lea eax, [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x204]
push ecx
push 0
push edx
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x40c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x102eef7
nop
lea eax, [ebp - 0x204]
push eax
mov word [edi + ebx*2 - 2], 0
call fcn.010247e0
push eax
push 0x1018490
lea ecx, [ebx - 1]
push ecx
push edi
call dword [sym.imp.MSVCR80.dll__snwprintf_l]
add esp, 0x14
test eax, eax
jl 0x102efc5
mov eax, dword [ebp - 0x40c]
push 0
push 0
push 0
or edx, 0xffffffff
sub edx, eax
push 0
lea edi, [edi + eax*2 + 2]
mov eax, dword [ebp - 0x418]
lea ecx, [ebp - 0x40c]
push ecx
add ebx, edx
add eax, 1
lea edx, [ebp - 0x204]
push edx
push eax
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x410]
push eax
mov dword [ebp - 0x40c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x102ee70
test ebx, ebx
jbe 0x102efc5
cmp esi, 0x103
mov word [edi], 0
jne 0x102ef10
xor esi, esi
jmp 0x102ef18
test esi, esi
jne 0x102efca
mov edi, dword [ebp - 0x414]
cmp word [edi], 0
je 0x102efca
jmp 0x102ef30
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax]
push edi
add eax, 4
xor esi, esi
push eax
mov dword [ebp - 0x408], ecx
mov word [ebp - 0x206], si
call fcn.010247e0
push eax
push 0x1018498
lea edx, [ebp - 0x404]
push 0xff
push edx
call dword [sym.imp.MSVCR80.dll__snwprintf_l]
add esp, 0x18
test eax, eax
jge 0x102ef75
mov esi, 0x6f
test esi, esi
jne 0x102efca
mov ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x408]
push eax
push ecx
call fcn.0102ed10
mov edx, dword [ebp - 0x408]
mov eax, dword [ebp - 0x410]
push edx
push edi
push eax
call fcn.0102d5c0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x102efa5
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x102ef30
jmp 0x102efca
mov esi, 0xea
pop ebx
mov eax, dword [ebp - 0x410]
test eax, eax
je 0x102efdc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x414]
test eax, eax
je 0x102efef
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8