Function at 0x105fa06
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x680
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x100c068
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x19
mov esi, 0x100c058
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
push 0x19
mov esi, 0x100bff0
lea edi, [ebp - 0x154]
rep movsd dword es:[edi], dword [esi]
pop ecx
movsw word es:[edi], word [esi]
push 0x18
mov esi, 0x100bf88
lea edi, [ebp - 0xec]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 0x1c
mov esi, 0x100bf28
lea edi, [ebp - 0x88]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 0x21
mov esi, 0x100beb8
lea edi, [ebp - 0x1c4]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x100be30
lea edi, [ebp - 0x24c]
rep movsd dword es:[edi], dword [esi]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
lea eax, [ebp - 0x664]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x88]
push eax
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x664], esi
call ebx
cmp eax, esi
mov dword [ebp - 0x660], eax
jne 0x105fae0
push 3
push 0x10000000
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x664]
call fcn.0105f5d6
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x664], esi
je 0x105faf4
push dword [ebp - 0x664]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x660], esi
mov dword [ebp - 0x668], esi
mov dword [ebp - 0x66c], esi
jne 0x105fdc0
push esi
lea eax, [ebp - 0x66c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x1c4]
push eax
push edi
call ebx
cmp eax, esi
mov dword [ebp - 0x660], eax
jne 0x105fd84
push 3
push 0x20019
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x66c]
call fcn.0105f5d6
cmp eax, esi
mov dword [ebp - 0x660], eax
jne 0x105fd84
lea eax, [ebp - 0x668]
push eax
push 0x109
push esi
lea eax, [ebp - 0x154]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
mov dword [ebp - 0x660], eax
jne 0x105fd84
push dword [ebp - 0x66c]
push dword [ebp - 0x668]
call fcn.0105f7d2
cmp eax, esi
mov dword [ebp - 0x660], eax
jne 0x105fd84
push esi
lea eax, [ebp - 0x670]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x24c]
push eax
push edi
mov dword [ebp - 0x670], esi
mov dword [ebp - 0x664], esi
call ebx
cmp eax, esi
mov dword [ebp - 0x660], eax
jne 0x105fd56
push esi
push 0x20019
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x670]
call fcn.0105f5d6
cmp eax, esi
mov dword [ebp - 0x660], eax
jne 0x105fd56
lea eax, [ebp - 0x664]
push eax
push 0x109
push esi
lea eax, [ebp - 0xec]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x454]
push eax
mov dword [ebp - 0x67c], esi
push esi
jmp 0x105fd33
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x454]
push eax
mov dword [ebp - 0x678], esi
mov dword [ebp - 0x660], esi
call sub.ADVAPI32.dll_ConvertStringSidToSidW
test eax, eax
je 0x105fd1f
push dword [ebp - 0x678]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
lea eax, [ebp - 0x660]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x454]
push eax
push dword [ebp - 0x670]
mov dword [ebp - 0x678], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x105fd0b
push 3
push 0x2001f
lea eax, [ebp - 0x454]
push eax
push dword [ebp - 0x660]
call fcn.0105f5d6
cmp eax, esi
jne 0x105fd0b
push ebx
lea eax, [ebp - 0x65c]
push eax
mov dword [ebp - 0x674], esi
push esi
jmp 0x105fcff
push 4
lea eax, [ebp - 0x680]
push eax
push 4
push esi
lea eax, [ebp - 0x65c]
push eax
push dword [ebp - 0x660]
mov dword [ebp - 0x680], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
inc dword [ebp - 0x674]
push ebx
lea eax, [ebp - 0x65c]
push eax
push dword [ebp - 0x674]
push dword [ebp - 0x668]
call edi
test eax, eax
je 0x105fcc2
cmp dword [ebp - 0x660], esi
je 0x105fd1f
push dword [ebp - 0x660]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x67c]
push ebx
lea eax, [ebp - 0x454]
push eax
push dword [ebp - 0x67c]
push dword [ebp - 0x664]
call edi
cmp eax, esi
mov dword [ebp - 0x660], eax
je 0x105fc33
cmp eax, 0x103
jne 0x105fd56
mov dword [ebp - 0x660], esi
cmp dword [ebp - 0x670], esi
je 0x105fd70
push dword [ebp - 0x670]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x670], esi
cmp dword [ebp - 0x664], esi
je 0x105fd84
push dword [ebp - 0x664]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x668], esi
je 0x105fd9e
push dword [ebp - 0x668]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x668], esi
cmp dword [ebp - 0x66c], esi
je 0x105fdb8
push dword [ebp - 0x66c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x66c], esi
cmp dword [ebp - 0x660], esi
je 0x105fdd0
push dword [ebp - 0x660]
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x105fdd3
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret