Function at 0x1060470
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
cmp eax, esi
je 0x10604de
cmp eax, 2
jne 0x1060548
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x10604d2
cmp dword [ebp + 0xc], 7
jne 0x10604b8
push eax
call fcn.0105c826
add eax, eax
jmp 0x10604cd
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10604bb
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
jmp 0x10604f0
push 2
push 0x1005838
jmp 0x1060657
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x10604ed
xor eax, eax
jmp 0x10606ab
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x10604fa
push 0x20
pop eax
mov dword [ebp - 4], eax
mov ecx, eax
and ecx, 1
lea ebx, [ecx + eax + 2]
push ebx
call fcn.0105c184
mov esi, eax
test esi, esi
je 0x10605a1
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov byte [ebx + esi - 1], 0
mov byte [ebx + esi - 2], 0
test byte [ebp - 4], 1
je 0x106053b
mov byte [ebx + esi - 3], 0
test eax, eax
je 0x10605f2
cmp eax, 2
je 0x1060553
push eax
push 0x1005658
jmp 0x1060657
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x10605e6
cmp dword [ebp + 0xc], 7
push edi
jne 0x10605d3
call fcn.0105c826
add eax, eax
push eax
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10605f2
push eax
push dword [ebp + 0x10]
push 0x1005610
call fcn.01062c21
add esp, 0xc
push esi
call fcn.0105c21c
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x10605b1
and dword [edi], 0
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x10604e6
cmp dword [ebp + 0xc], 7
jne 0x1060663
push ebx
call fcn.0105c826
add eax, eax
jmp 0x106067a
push ebx
push esi
call fcn.0101e80b
test eax, eax
jge 0x1060577
push eax
push 0x10057fc
jmp 0x1060657
push 0x10057a8
call fcn.01062c21
jmp 0x106065d
cmp dword [ebp + 0xc], 2
jne 0x1060635
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10605a1
lea eax, [ebx + ebx + 2]
push eax
mov dword [ebp - 4], eax
call fcn.0105c184
mov dword [ebp + 0x10], eax
test eax, eax
je 0x10605a1
push ebx
push eax
push esi
call edi
test eax, eax
je 0x1060643
cmp eax, ebx
jg 0x1060643
push esi
call fcn.0105c21c
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x10606a9
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x10606a9
push dword [ebp + 0x10]
call fcn.0105c21c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005750
call fcn.01062c21
pop ecx
pop ecx
jmp 0x10605a1
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1060668
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 4], eax
call fcn.0105c184
mov esi, eax
test esi, esi
je 0x10604e6
cmp dword [ebp + 0xc], 7
jne 0x10606b2
push dword [ebp - 4]
push ebx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x10606a9
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
push ebx
push dword [ebp - 4]
push esi
call fcn.0101e80b
test eax, eax
jge 0x10606a0
push eax
push 0x1005710
call fcn.01062c21
pop ecx
pop ecx
push esi
call fcn.0105c21c
jmp 0x10604e6