Function at 0x1000be22
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xd4
mov eax, 0x1004f26b
call fcn.1003755a
mov edi, edx
xor esi, esi
mov ebx, ecx
mov dword [ebp - 0xb8], edi
cmp dword [edi + 0x84], esi
jne 0x1000bf6a
cmp dword [ebx + 0x20], 8
jb 0x1000be54
mov eax, dword [ebx + 0xc]
jmp 0x1000be57
lea eax, [ebx + 0xc]
lea ecx, [ebp - 0xc0]
push ecx
lea ecx, [ebp - 0xc4]
push ecx
lea ecx, [ebp - 0xbc]
push ecx
push str.maxIndex
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 0xc0], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1000bea2
cmp dword [ebp - 0xbc], 4
jne 0x1000bea2
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xb4], eax
jmp 0x1000bea8
mov dword [ebp - 0xb4], esi
xor eax, eax
mov word [ebp - 0x94], ax
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0xc8]
push eax
movzx eax, word [ebp - 0xca]
push eax
movzx eax, word [ebp - 0xcc]
push eax
movzx eax, word [ebp - 0xce]
push eax
movzx eax, word [ebp - 0xd2]
push eax
movzx eax, word [ebp - 0xd4]
push eax
push str._04d_02d_02d_02d_02d_02d
lea eax, [ebp - 0x94]
push 0x40
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x24
lea eax, [ebp - 0x94]
push eax
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xe0]
push str._08x__ls
call fcn.1002d119
add esp, 0xc
push 0xffffffffffffffff
push esi
lea ecx, [edi + 0x70]
mov dword [ebp - 4], esi
call fcn.10002131
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea esi, [ebp - 0xe0]
call fcn.100021e2
inc dword [ebp - 0xb4]
cmp dword [ebx + 0x20], 8
jb 0x1000bf56
mov eax, dword [ebx + 0xc]
jmp 0x1000bf59
lea eax, [ebx + 0xc]
push dword [ebp - 0xb4]
push str.maxIndex
push eax
call fcn.1002d1d1
push 8
pop esi
cmp dword [edi + 0x88], esi
jb 0x1000bf7a
mov eax, dword [edi + 0x74]
jmp 0x1000bf7d
lea eax, [edi + 0x74]
cmp dword [ebx + 0x3c], esi
jb 0x1000bf87
mov ebx, dword [ebx + 0x28]
jmp 0x1000bf8a
add ebx, 0x28
push eax
push ebx
push 0x10058584
lea ecx, [ebp - 0xb0]
call fcn.1002d119
add esp, 0xc
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x98], esi
jae 0x1000bfba
lea eax, [ebp - 0xac]
push eax
push str.save_path:_ls
call fcn.1002fd9f
pop ecx
pop ecx
cmp dword [edi + 0x18], esi
jb 0x1000bfd1
mov edi, dword [edi + 4]
jmp 0x1000bfd4
add edi, 4
mov ebx, dword [ebp - 0xac]
cmp dword [ebp - 0x98], esi
jae 0x1000bfe8
lea ebx, [ebp - 0xac]
mov esi, edi
push str.type
mov edi, reloc.WS2_32.dll_bind
call fcn.1002d1f5
mov eax, dword [ebp - 0xb8]
cmp dword [eax + 0x34], 8
jb 0x1000c00a
mov eax, dword [eax + 0x20]
jmp 0x1000c00d
add eax, 0x20
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000c022
lea ebx, [ebp - 0xac]
push str.filePath
mov esi, eax
call fcn.1002d1f5
cmp dword [ebp - 0x98], 8
mov eax, dword [ebp - 0xac]
jae 0x1000c043
lea eax, [ebp - 0xac]
mov esi, dword [ebp - 0xb8]
push dword [esi + 0x8c]
push str.index
push eax
call fcn.1002d1d1
cmp dword [esi + 0x50], 8
jb 0x1000c065
mov esi, dword [esi + 0x3c]
jmp 0x1000c068
add esi, 0x3c
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000c07d
lea ebx, [ebp - 0xac]
push 0x100585dc
call fcn.1002d1f5
mov eax, dword [ebp - 0xb8]
cmp dword [eax + 0x6c], 8
jb 0x1000c098
mov eax, dword [eax + 0x58]
jmp 0x1000c09b
add eax, 0x58
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000c0b0
lea ebx, [ebp - 0xac]
push str.icoCache
mov esi, eax
call fcn.1002d1f5
mov eax, dword [ebp - 0xb8]
cmp dword [eax + 0x88], 8
jb 0x1000c0d0
mov eax, dword [eax + 0x74]
jmp 0x1000c0d3
add eax, 0x74
cmp dword [ebp - 0x98], 8
mov ebx, dword [ebp - 0xac]
jae 0x1000c0e8
lea ebx, [ebp - 0xac]
push str.keyName
mov esi, eax
call fcn.1002d1f5
push 0
push 1
lea esi, [ebp - 0xb0]
call fcn.100021e2
mov al, 1
call fcn.100375dd
ret