Function at 0x10004cc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.10018530
mov eax, dword [0x1003e030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x1000
lea eax, [ebp - 0x1004]
mov ebx, 0x57
push 0
push eax
call fcn.10019d00
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x10041d90], 0
mov edi, eax
mov dword [ebp - 0x1030], edi
jne 0x10004d15
mov ebx, 0x15
jmp 0x10004f14
cmp dword [0x100421b8], 1
push esi
jne 0x10004db6
lea eax, [ebp - 0x102c]
xor esi, esi
push eax
push 0x20019
push esi
push 0x1003914c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x102c], esi
mov dword [ebp - 0x100c], esi
mov dword [ebp - 0x1008], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004d9a
mov eax, dword [ebp - 0x102c]
test eax, eax
je 0x10004daf
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x1008], 4
push ecx
lea ecx, [ebp - 0x100c]
push ecx
push esi
push esi
push 0x10035c00
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004d9a
mov eax, 1
cmp dword [ebp - 0x100c], eax
cmove esi, eax
mov eax, dword [ebp - 0x102c]
test eax, eax
je 0x10004dab
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10004db6
xor ebx, ebx
jmp 0x10004f13
xorps xmm0, xmm0
mov dword [ebp - 0x1010], 0
movq qword [ebp - 0x1018], xmm0
movups xmmword [ebp - 0x1028], xmm0
mov dword [ebp - 0x1018], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1014], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1010], eax
lea eax, [ebp - 0x1028]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [ebp - 0x1018]
movzx eax, word [ebp - 0x101a]
push dword [ebp - 0x1010]
push dword [ebp - 0x1014]
push eax
movzx eax, word [ebp - 0x101c]
push eax
movzx eax, word [ebp - 0x101e]
push eax
movzx eax, word [ebp - 0x1020]
push eax
movzx eax, word [ebp - 0x1022]
push eax
movzx eax, word [ebp - 0x1026]
push eax
movzx eax, word [ebp - 0x1028]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d__p_u__t_u__e0x_x_
lea eax, [ebp - 0x1004]
push 0x800
push eax
call fcn.10001870
add esp, 0x34
test eax, eax
js 0x10004f13
mov ecx, 0x800
lea eax, [ebp - 0x1004]
cmp word [eax], 0
je 0x10004e81
add eax, 2
sub ecx, 1
jne 0x10004e73
mov edi, 0x800
mov esi, ecx
mov eax, edi
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x10004f0d
cmp esi, edi
jae 0x10004f0d
lea eax, [ebp + 0xc]
mov edx, 0x7fd
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x1004]
sub edx, esi
lea ecx, [ecx + esi*2]
call fcn.10002360
mov ecx, edi
lea eax, [ebp - 0x1004]
nop
cmp word [eax], 0
je 0x10004ece
add eax, 2
sub ecx, 1
jne 0x10004ec0
test ecx, ecx
je 0x10004f00
mov edx, ecx
lea eax, [ecx - 0x800]
neg edx
push ecx
sbb edx, edx
and edx, eax
lea eax, [ebp - 0x1004]
add edx, edi
sub edi, ecx
push 0x10039020
push ecx
add edi, edi
neg ecx
sbb ecx, ecx
and ecx, edi
add ecx, eax
call fcn.10001900
lea ecx, [ebp - 0x1004]
call fcn.10004f30
mov ebx, eax
mov edi, dword [ebp - 0x1030]
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.100184e9
mov esp, ebp
pop ebp
ret