Function at 0x10060ac
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x45c
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x101203c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x454], ecx
xor esi, esi
lea ecx, [ebp - 0x450]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push esi
inc ebx
push eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x42c], 0x104
call edi
cmp eax, esi
mov dword [ebp - 0x430], ebx
jne 0x1006321
mov ebx, 0x1001468
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.ntdll.dll_RtlGUIDFromString]
cmp eax, esi
jge 0x100615f
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x10017b0
jmp 0x1006196
lea eax, [ebp - 0x428]
push eax
call fcn.01004d3c
or eax, 0x2001f
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10061a3
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1001760
call fcn.01004cb9
add esp, 0xc
jmp 0x10062e3
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x434]
push eax
push esi
push ebx
push dword [ebp - 0x428]
mov dword [ebp - 0x42c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10061dd
cmp dword [ebp - 0x434], 3
je 0x1006249
mov ecx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x450]
push ecx
push eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x20c]
push eax
push 0x1001724
mov dword [ebp - 0x438], ecx
call fcn.01004cb9
add esp, 0x10
push 8
lea eax, [ebp - 0x43c]
push eax
push 3
push esi
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
je 0x1006249
push eax
push dword [ebp - 0x438]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x43c]
push eax
push 0x10016b0
call fcn.01004cb9
add esp, 0x14
lea eax, [ebp - 0x414]
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x434]
push eax
push esi
push 0x1001690
push dword [ebp - 0x428]
mov dword [ebp - 0x42c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1006293
cmp dword [ebp - 0x434], 1
je 0x10062ae
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1001638
call fcn.01004cb9
add esp, 0xc
mov dword [ebp - 0x444], esi
push dword [ebp - 0x444]
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x454]
call fcn.01005dce
test eax, eax
je 0x100633e
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x428], esi
lea eax, [ebp - 0x450]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x430]
mov dword [ebp - 0x42c], 0x104
push dword [ebp - 0x448]
call edi
inc dword [ebp - 0x430]
cmp eax, esi
je 0x1006124
cmp eax, 0x103
je 0x1006344
push eax
push dword [ebp - 0x430]
push 0x10015d0
call fcn.01004cb9
add esp, 0xc
jmp 0x1006344
mov dword [ebp - 0x440], esi
cmp dword [ebp - 0x428], esi
pop edi
pop esi
pop ebx
je 0x100635b
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x440]
call fcn.01007b7f
leave
ret 8