Function at 0x10004c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1030
call fcn.100184a0
mov eax, dword [0x1003e030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x1000
lea eax, [ebp - 0x1004]
mov ebx, 0x57
push 0
push eax
call fcn.10019c70
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x10041d60], 0
mov edi, eax
mov dword [ebp - 0x1030], edi
jne 0x10004c95
mov ebx, 0x15
jmp 0x10004e94
cmp dword [0x10042188], 1
push esi
jne 0x10004d36
lea eax, [ebp - 0x102c]
xor esi, esi
push eax
push 0x20019
push esi
push 0x1003914c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x102c], esi
mov dword [ebp - 0x100c], esi
mov dword [ebp - 0x1008], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004d1a
mov eax, dword [ebp - 0x102c]
test eax, eax
je 0x10004d2f
lea ecx, [ebp - 0x1008]
mov dword [ebp - 0x1008], 4
push ecx
lea ecx, [ebp - 0x100c]
push ecx
push esi
push esi
push 0x10035c00
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004d1a
mov eax, 1
cmp dword [ebp - 0x100c], eax
cmove esi, eax
mov eax, dword [ebp - 0x102c]
test eax, eax
je 0x10004d2b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10004d36
xor ebx, ebx
jmp 0x10004e93
xorps xmm0, xmm0
mov dword [ebp - 0x1010], 0
movq qword [ebp - 0x1018], xmm0
movups xmmword [ebp - 0x1028], xmm0
mov dword [ebp - 0x1018], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1014], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x1010], eax
lea eax, [ebp - 0x1028]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [ebp - 0x1018]
movzx eax, word [ebp - 0x101a]
push dword [ebp - 0x1010]
push dword [ebp - 0x1014]
push eax
movzx eax, word [ebp - 0x101c]
push eax
movzx eax, word [ebp - 0x101e]
push eax
movzx eax, word [ebp - 0x1020]
push eax
movzx eax, word [ebp - 0x1022]
push eax
movzx eax, word [ebp - 0x1026]
push eax
movzx eax, word [ebp - 0x1028]
push eax
push str.__04d__02d__02d__02d:_02d:_02d._03d__p_u__t_u__e0x_x_
lea eax, [ebp - 0x1004]
push 0x800
push eax
call fcn.10001870
add esp, 0x34
test eax, eax
js 0x10004e93
mov ecx, 0x800
lea eax, [ebp - 0x1004]
cmp word [eax], 0
je 0x10004e01
add eax, 2
sub ecx, 1
jne 0x10004df3
mov edi, 0x800
mov esi, ecx
mov eax, edi
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x10004e8d
cmp esi, edi
jae 0x10004e8d
lea eax, [ebp + 0xc]
mov edx, 0x7fd
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x1004]
sub edx, esi
lea ecx, [ecx + esi*2]
call fcn.10002360
mov ecx, edi
lea eax, [ebp - 0x1004]
nop
cmp word [eax], 0
je 0x10004e4e
add eax, 2
sub ecx, 1
jne 0x10004e40
test ecx, ecx
je 0x10004e80
mov edx, ecx
lea eax, [ecx - 0x800]
neg edx
push ecx
sbb edx, edx
and edx, eax
lea eax, [ebp - 0x1004]
add edx, edi
sub edi, ecx
push 0x10039020
push ecx
add edi, edi
neg ecx
sbb ecx, ecx
and ecx, edi
add ecx, eax
call fcn.10001900
lea ecx, [ebp - 0x1004]
call fcn.10004eb0
mov ebx, eax
mov edi, dword [ebp - 0x1030]
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.10018459
mov esp, ebp
pop ebp
ret