Function at 0x1060e4e
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
xor esi, esi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x28], ecx
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
call fcn.010607ce
cmp dword [ebp - 0x1c], esi
je 0x10611da
cmp dword [ebp - 0x14], esi
je 0x10611da
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 3
push esi
push esi
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, esi
jne 0x10611da
cmp dword [ebp + 0x10], esi
je 0x10611ba
cmp dword [ebp - 4], esi
jne 0x1060f03
cmp dword [ebp - 0x18], esi
jne 0x1060f03
push 2
push 0x1001e44
push 1
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10611cb
mov ebx, dword [ebp - 0x24]
mov eax, ebx
shr eax, 1
not eax
and eax, 1
jne 0x1060f29
push esi
push esi
push esi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10611ce
mov eax, 0x10003
cmp ebx, eax
ja 0x1060f81
je 0x1060f4d
mov eax, ebx
dec eax
je 0x1060f6b
dec eax
dec eax
je 0x1060f6b
sub eax, 5
je 0x1060fc7
sub eax, 0xfff9
jne 0x1060f9d
cmp dword [ebp - 4], esi
je 0x10611ce
push dword [ebp - 4]
call fcn.0105616a
mov dword [ebp + 8], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
jmp 0x1060ef1
cmp dword [ebp - 0x18], esi
je 0x10611ce
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push 3
jmp 0x1060ef1
mov eax, ebx
sub eax, 0x20000
je 0x1061192
dec eax
dec eax
je 0x1061192
sub eax, 0x20006
je 0x1060fc7
cmp dword [ebp - 4], esi
je 0x10611ce
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1060fac
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 4]
jmp 0x1060eef
cmp dword [ebp - 4], esi
je 0x10611ce
push 7
pop edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
test ebx, 0x40000
je 0x1061107
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1061107
cmp dword [ebp - 0x24], edi
jne 0x1061107
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1061012
mov ecx, dword [ebp - 0x20]
sub eax, edx
shr ecx, 1
sar eax, 1
lea edi, [ecx + eax + 3]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
pop ecx
mov dword [ebp + 8], ebx
cmp ebx, esi
jne 0x1061055
mov dword [ebp - 0x10], 0xe
jmp 0x1061102
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10610f8
mov ebx, dword [ebp + 8]
jmp 0x106109f
push dword [ebp - 4]
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x10610d4
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x106108d
sub eax, edx
sar eax, 1
lea ebx, [ebx + eax*2 + 2]
xor eax, eax
cmp ax, word [ebx]
jne 0x1061078
push dword [ebp - 4]
lea eax, [edi - 1]
push eax
push ebx
call fcn.01035831
test eax, eax
jl 0x10610f3
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10610bd
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
jmp 0x1061102
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10610da
sub eax, edx
sar eax, 1
mov ecx, 0xffffffff
sub ecx, eax
add edi, ecx
jmp 0x1061102
push dword [ebp + 8]
jmp 0x10610f9
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov dword [ebp + 8], esi
pop ecx
cmp dword [ebp + 8], esi
jne 0x1061169
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x106110d
sub eax, edx
sar eax, 1
lea edi, [eax + 2]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
pop ecx
mov dword [ebp + 8], ebx
cmp ebx, esi
je 0x10611ce
push dword [ebp - 4]
lea eax, [edi - 1]
push eax
push ebx
call fcn.01035831
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1061154
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
lea eax, [edi + edi]
push eax
push dword [ebp + 8]
push 7
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], esi
je 0x10611ce
push dword [ebp + 8]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x10611ce
cmp dword [ebp - 4], esi
je 0x10611ce
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x106119d
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 4]
push 2
jmp 0x1060ef1
cmp dword [ebp - 8], esi
je 0x10611ce
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
jne 0x1061200
cmp dword [ebp - 8], esi
jne 0x1061200
cmp dword [ebp - 4], esi
jne 0x1061200
cmp dword [ebp - 0x14], esi
je 0x1061200
cmp dword [ebp - 0x1c], esi
je 0x1061200
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.0105791c
cmp edi, esi
je 0x106122d
cmp ebx, esi
jne 0x1061211
cmp edi, 2
jne 0x1061211
xor edi, edi
jmp 0x1061236
push edi
push 0x100cea0
push 2
call fcn.01055c8a
mov ecx, dword [ebp - 0x28]
add esp, 0xc
push ebx
push dword [ebp + 0xc]
call fcn.0106089c
mov eax, 0x100c948
cmp ebx, esi
jne 0x106123b
mov eax, 0x100c958
push edi
push dword [ebp + 0xc]
push eax
push 0x100ce74
push 4
call fcn.01055c8a
add esp, 0x14
cmp dword [ebp - 0x18], esi
je 0x106125d
push dword [ebp - 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x14], esi
je 0x106126b
push dword [ebp - 0x14]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp dword [ebp - 8], esi
je 0x1061279
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp dword [ebp - 4], esi
je 0x1061287
push dword [ebp - 4]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp edi, esi
jle 0x1061297
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc