Function at 0x1000c10a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xd4
mov eax, 0x1004fb43
call fcn.10037d5a
mov edi, edx
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0xb8], edi
cmp dword [edi + 0x84], esi
jne 0x1000c252
cmp dword [ebx + 0x20], 8
jb 0x1000c13c
mov eax, dword [ebx + 0xc]
jmp 0x1000c13f
lea eax, [ebx + 0xc]
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0xc4]
push ecx
lea ecx, [ebp - 0xbc]
push ecx
push str.maxIndex
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 0xc0], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1000c18a
cmp dword [ebp - 0xbc], 4
jne 0x1000c18a
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xb4], eax
jmp 0x1000c190
mov dword [ebp - 0xb4], esi
xor eax, eax
mov word [ebp - 0x94], ax
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xc8]
push eax
movzx eax, word [ebp - 0xca]
push eax
movzx eax, word [ebp - 0xcc]
push eax
movzx eax, word [ebp - 0xce]
push eax
movzx eax, word [ebp - 0xd2]
push eax
movzx eax, word [ebp - 0xd4]
push eax
push str._04d_02d_02d_02d_02d_02d
lea eax, [ebp - 0x94]
push 0x40
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x24
lea eax, [ebp - 0x94]
push eax
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xe0]
push str._08x__ls
call fcn.1002d7c0
add esp, 0xc
push 0xffffffffffffffff
push esi
lea ecx, [edi + 0x70]
mov dword [ebp - 4], esi
call fcn.1000213e
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea esi, [ebp - 0xe0]
call fcn.100021ef
inc dword [ebp - 0xb4]
cmp dword [ebx + 0x20], 8
jb 0x1000c23e
mov eax, dword [ebx + 0xc]
jmp 0x1000c241
lea eax, [ebx + 0xc]
push dword [ebp - 0xb4]
push str.maxIndex
push eax
call fcn.1002d878
push 8
pop esi
cmp dword [edi + 0x88], esi
jb 0x1000c262
mov eax, dword [edi + 0x74]
jmp 0x1000c265
lea eax, [edi + 0x74]
cmp dword [ebx + 0x3c], esi
jb 0x1000c26f
mov ebx, dword [ebx + 0x28]
jmp 0x1000c272
add ebx, 0x28
push eax
push ebx
push 0x1005977c
lea ecx, [ebp - 0xb0]
call fcn.1002d7c0
add esp, 0xc
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x98], esi
jae 0x1000c2a2
lea eax, [ebp - 0xac]
push eax
push str.save_path:_ls
call fcn.1003048c
pop ecx
pop ecx
cmp dword [edi + 0x18], esi
jb 0x1000c2b9
mov edi, dword [edi + 4]
jmp 0x1000c2bc
add edi, 4
mov ebx, dword [ebp - 0xac]
cmp dword [ebp - 0x98], esi
jae 0x1000c2d0
lea ebx, [ebp - 0xac]
mov esi, edi
push str.type
mov edi, reloc.WS2_32.dll_bind
call fcn.1002d89c
mov eax, dword [ebp - 0xb8]
cmp dword [eax + 0x34], 8
jb 0x1000c2f2
mov eax, dword [eax + 0x20]
jmp 0x1000c2f5
add eax, 0x20
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000c30a
lea ebx, [ebp - 0xac]
push str.filePath
mov esi, eax
call fcn.1002d89c
cmp dword [ebp - 0x98], 8
mov eax, dword [ebp - 0xac]
jae 0x1000c32b
lea eax, [ebp - 0xac]
mov esi, dword [ebp - 0xb8]
push dword [esi + 0x8c]
push str.index
push eax
call fcn.1002d878
cmp dword [esi + 0x50], 8
jb 0x1000c34d
mov esi, dword [esi + 0x3c]
jmp 0x1000c350
add esi, 0x3c
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000c365
lea ebx, [ebp - 0xac]
push 0x100597d4
call fcn.1002d89c
mov eax, dword [ebp - 0xb8]
cmp dword [eax + 0x6c], 8
jb 0x1000c380
mov eax, dword [eax + 0x58]
jmp 0x1000c383
add eax, 0x58
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000c398
lea ebx, [ebp - 0xac]
push str.icoCache
mov esi, eax
call fcn.1002d89c
mov eax, dword [ebp - 0xb8]
cmp dword [eax + 0x88], 8
jb 0x1000c3b8
mov eax, dword [eax + 0x74]
jmp 0x1000c3bb
add eax, 0x74
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000c3d0
lea ebx, [ebp - 0xac]
push str.keyName
mov esi, eax
call fcn.1002d89c
push 0
push 1
lea esi, [ebp - 0xb0]
call fcn.100021ef
mov al, 1
call fcn.10037ddd
ret