Function at 0x106cc1b
Capabilities:
Delete registry value
Get common file path
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x80c], ecx
mov ecx, dword [ebp + 0x14]
xor esi, esi
xor ebx, ebx
inc ebx
push eax
mov dword [ebp - 0x800], eax
mov dword [ebp - 0x7f8], ecx
mov dword [ebp - 0x7ec], esi
mov dword [ebp - 0x7f0], esi
mov dword [ebp - 0x804], esi
mov edi, ebx
call fcn.01069f4b
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x7ec]
push eax
push 0x2001f
push esi
push dword [ebp - 0x800]
mov dword [ebp - 0x7f4], ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106cfb9
cmp dword [ebp - 0x808], esi
mov dword [ebp - 0x7f0], 0x190
je 0x106ccff
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x100f3dc
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106ccff
cmp dword [ebp - 0x7f4], ebx
jne 0x106ccff
lea eax, [ebp - 0x194]
push 0x100f3cc
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov edi, eax
neg edi
pop ecx
sbb edi, edi
pop ecx
inc edi
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push esi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106cd6c
cmp dword [ebp - 0x7f4], ebx
jne 0x106cd6c
lea eax, [ebp - 0x194]
push eax
call fcn.01068ddd
test eax, eax
je 0x106cd6c
lea eax, [ebp - 0x7fc]
push eax
push dword [ebp - 0x7f8]
lea eax, [ebp - 0x194]
push dword [ebp + 0x10]
mov dword [ebp - 0x7fc], ebx
push eax
call fcn.0106b9cc
jmp 0x106cd72
mov dword [ebp - 0x7fc], esi
cmp edi, esi
je 0x106cd82
cmp dword [ebp - 0x7fc], esi
jne 0x106ce43
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
mov edi, 0x100ebb4
push edi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106ce43
cmp dword [ebp - 0x7f4], ebx
jne 0x106ce43
lea eax, [ebp - 0x194]
push eax
call fcn.01068ddd
test eax, eax
je 0x106ce43
lea eax, [ebp - 0x808]
push eax
push dword [ebp - 0x7f8]
lea eax, [ebp - 0x194]
push dword [ebp + 0x10]
mov dword [ebp - 0x808], ebx
push eax
call fcn.0106b9cc
cmp dword [ebp - 0x808], esi
je 0x106ce43
lea eax, [ebp - 0x194]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x106ce07
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x7fc], ebx
cmp dword [ebp - 0x80c], esi
lea eax, [ebp - 0x194]
je 0x106ce64
push dword [ebp - 0x80c]
push 0xc7
push eax
call fcn.01034c79
jmp 0x106ce7d
push dword [ebp - 0x800]
push 0x100bd84
push 0xc7
push eax
call fcn.01034d76
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x7f8]
lea eax, [ebp - 0x194]
push dword [ebp + 0x10]
push eax
call fcn.0106b9cc
cmp dword [ebp - 0x7fc], esi
jne 0x106cee1
cmp dword [ebp - 0x804], esi
je 0x106cee1
lea eax, [ebp - 0x194]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x106ceb2
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x7fc], ebx
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7fc], esi
jne 0x106cfb9
lea eax, [ebp - 0x7ec]
push eax
push ebx
push esi
push dword [ebp - 0x800]
mov dword [ebp - 0x7f8], ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106cfa9
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x100f3b0
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call edi
test eax, eax
jne 0x106cf5e
mov dword [ebp - 0x7f8], esi
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x100f3a0
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call edi
test eax, eax
jne 0x106cf95
mov dword [ebp - 0x7f8], esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7f8], esi
je 0x106cfb9
push dword [ebp - 0x800]
push SysReAllocString
call fcn.01058684
push 0x103
lea eax, [ebp - 0x7e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x106d1ba
push 0x100f388
mov edi, 0x104
push edi
lea eax, [ebp - 0x7e8]
push eax
call fcn.01034cee
lea eax, [ebp - 0x7e8]
push eax
push edi
lea eax, [ebp - 0x39c]
push eax
push dword [0x107fddc]
push 0x100f374
push 0x100f368
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x106d04a
lea eax, [ebp - 0x39c]
push eax
push dword [0x107fddc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x106d04a
lea eax, [ebp - 0x39c]
push 0x100f34c
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x7f8], esi
je 0x106d050
mov dword [ebp - 0x7f8], ebx
lea eax, [ebp - 0x7e8]
push eax
push edi
lea eax, [ebp - 0x39c]
push eax
push dword [0x107fddc]
push 0x100f334
push 0x100f368
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x106d0b0
lea eax, [ebp - 0x39c]
push eax
push dword [0x107fddc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x106d0b0
lea eax, [ebp - 0x39c]
push 0x100f34c
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x7fc], esi
je 0x106d0b6
mov dword [ebp - 0x7fc], ebx
cmp dword [ebp - 0x7f8], esi
jne 0x106d0ca
cmp dword [ebp - 0x7fc], esi
je 0x106d1ba
mov eax, dword [ebp - 0x800]
add eax, 2
push eax
push 0x103
lea eax, [ebp - 0x39c]
push eax
call fcn.01034c79
mov edi, dword [sym.imp.KERNEL32.dll_GetProfileStringW]
push 0x122
lea eax, [ebp - 0x5e0]
push eax
push dword [0x107fddc]
lea eax, [ebp - 0x39c]
push eax
push 0x100f30c
call edi
test eax, eax
je 0x106d1ba
lea eax, [ebp - 0x5e0]
push eax
push dword [0x107fddc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x106d1ba
push esi
lea eax, [ebp - 0x39c]
push eax
push 0x100f30c
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push 0x122
lea eax, [ebp - 0x5e0]
push eax
push dword [0x107fddc]
lea eax, [ebp - 0x39c]
push eax
push 0x100f2ec
call edi
test eax, eax
je 0x106d1ba
cmp dword [ebp - 0x7f8], esi
je 0x106d187
lea eax, [ebp - 0x5e0]
push eax
push 0x100f374
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x106d1a7
cmp dword [ebp - 0x7fc], esi
je 0x106d1ba
lea eax, [ebp - 0x5e0]
push eax
push 0x100f334
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x106d1ba
push esi
lea eax, [ebp - 0x39c]
push eax
push 0x100f2ec
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push dword [ebp - 0x800]
lea eax, [ebp - 0x39c]
push 0x100f268
push 0x103
push eax
mov dword [ebp - 0x804], ebx
call fcn.01034d76
add esp, 0x10
lea eax, [ebp - 0x7ec]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x39c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106d392
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x100f0e8
push dword [ebp - 0x7ec]
mov edi, 0x244
mov dword [ebp - 0x7f0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106d35c
cmp dword [ebp - 0x7f4], ebx
jne 0x106d35c
lea eax, [ebp - 0x5e0]
push 0x10040f0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x106d35c
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push esi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f4], ebx
mov dword [ebp - 0x7f0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106d35c
cmp dword [ebp - 0x7f4], ebx
jne 0x106d35c
lea eax, [ebp - 0x5e0]
push eax
call fcn.01068ddd
test eax, eax
je 0x106d35c
lea eax, [ebp - 0x5e0]
push 0x100f210
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x106d35c
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
mov dword [ebp - 0x7f0], edi
push esi
mov edi, 0x100ebb4
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106d356
cmp dword [ebp - 0x7f4], ebx
jne 0x106d356
lea eax, [ebp - 0x5e0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x106d31e
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x5e0]
push eax
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x106d35c
mov dword [ebp - 0x804], esi
push 0x100f0e8
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x804], esi
jne 0x106d392
lea eax, [ebp - 0x39c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.01058684
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 0x10