Function at 0x1000e61b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xd4
mov eax, 0x1005a566
call fcn.100422ea
mov edi, edx
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0xb8], edi
cmp dword [edi + 0x84], esi
jne 0x1000e763
cmp dword [ebx + 0x20], 8
jb 0x1000e64d
mov eax, dword [ebx + 0xc]
jmp 0x1000e650
lea eax, [ebx + 0xc]
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0xc4]
push ecx
lea ecx, [ebp - 0xbc]
push ecx
push str.maxIndex
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 0xc0], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1000e69b
cmp dword [ebp - 0xbc], 4
jne 0x1000e69b
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xb4], eax
jmp 0x1000e6a1
mov dword [ebp - 0xb4], esi
xor eax, eax
mov word [ebp - 0x94], ax
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xc8]
push eax
movzx eax, word [ebp - 0xca]
push eax
movzx eax, word [ebp - 0xcc]
push eax
movzx eax, word [ebp - 0xce]
push eax
movzx eax, word [ebp - 0xd2]
push eax
movzx eax, word [ebp - 0xd4]
push eax
push str._04d_02d_02d_02d_02d_02d
lea eax, [ebp - 0x94]
push 0x40
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x24
lea eax, [ebp - 0x94]
push eax
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xe0]
push str._08x__ls
call fcn.100347ad
add esp, 0xc
push 0xffffffffffffffff
push esi
lea ecx, [edi + 0x70]
mov dword [ebp - 4], esi
call fcn.100022bf
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea esi, [ebp - 0xe0]
call fcn.10002370
inc dword [ebp - 0xb4]
cmp dword [ebx + 0x20], 8
jb 0x1000e74f
mov eax, dword [ebx + 0xc]
jmp 0x1000e752
lea eax, [ebx + 0xc]
push dword [ebp - 0xb4]
push str.maxIndex
push eax
call fcn.10034865
push 8
pop esi
cmp dword [edi + 0x88], esi
jb 0x1000e773
mov eax, dword [edi + 0x74]
jmp 0x1000e776
lea eax, [edi + 0x74]
cmp dword [ebx + 0x3c], esi
jb 0x1000e780
mov ebx, dword [ebx + 0x28]
jmp 0x1000e783
add ebx, 0x28
push eax
push ebx
push 0x10065bc4
lea ecx, [ebp - 0xb0]
call fcn.100347ad
add esp, 0xc
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x98], esi
jae 0x1000e7b3
lea eax, [ebp - 0xac]
push eax
push str.save_path:_ls
call fcn.10037607
pop ecx
pop ecx
cmp dword [edi + 0x18], esi
jb 0x1000e7ca
mov edi, dword [edi + 4]
jmp 0x1000e7cd
add edi, 4
mov ebx, dword [ebp - 0xac]
cmp dword [ebp - 0x98], esi
jae 0x1000e7e1
lea ebx, [ebp - 0xac]
mov esi, edi
push str.type
mov edi, reloc.WS2_32.dll_bind
call fcn.10034889
mov eax, dword [ebp - 0xb8]
cmp dword [eax + 0x34], 8
jb 0x1000e803
mov eax, dword [eax + 0x20]
jmp 0x1000e806
add eax, 0x20
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000e81b
lea ebx, [ebp - 0xac]
push str.filePath
mov esi, eax
call fcn.10034889
cmp dword [ebp - 0x98], 8
mov eax, dword [ebp - 0xac]
jae 0x1000e83c
lea eax, [ebp - 0xac]
mov esi, dword [ebp - 0xb8]
push dword [esi + 0x8c]
push str.index
push eax
call fcn.10034865
cmp dword [esi + 0x50], 8
jb 0x1000e85e
mov esi, dword [esi + 0x3c]
jmp 0x1000e861
add esi, 0x3c
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000e876
lea ebx, [ebp - 0xac]
push 0x10065c1c
call fcn.10034889
mov eax, dword [ebp - 0xb8]
cmp dword [eax + 0x6c], 8
jb 0x1000e891
mov eax, dword [eax + 0x58]
jmp 0x1000e894
add eax, 0x58
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000e8a9
lea ebx, [ebp - 0xac]
push str.icoCache
mov esi, eax
call fcn.10034889
mov eax, dword [ebp - 0xb8]
cmp dword [eax + 0x88], 8
jb 0x1000e8c9
mov eax, dword [eax + 0x74]
jmp 0x1000e8cc
add eax, 0x74
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000e8e1
lea ebx, [ebp - 0xac]
push str.keyName
mov esi, eax
call fcn.10034889
push 0
push 1
lea esi, [ebp - 0xb0]
call fcn.10002370
mov al, 1
call fcn.1004236d
ret