Function at 0x1060830
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
cmp eax, esi
je 0x106089e
cmp eax, 2
jne 0x1060908
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x1060892
cmp dword [ebp + 0xc], 7
jne 0x1060878
push eax
call fcn.0105cbe6
add eax, eax
jmp 0x106088d
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x106087b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
jmp 0x10608b0
push 2
push 0x1005838
jmp 0x1060a17
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x10608ad
xor eax, eax
jmp 0x1060a6b
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x10608ba
push 0x20
pop eax
mov dword [ebp - 4], eax
mov ecx, eax
and ecx, 1
lea ebx, [ecx + eax + 2]
push ebx
call fcn.0105c544
mov esi, eax
test esi, esi
je 0x1060961
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov byte [ebx + esi - 1], 0
mov byte [ebx + esi - 2], 0
test byte [ebp - 4], 1
je 0x10608fb
mov byte [ebx + esi - 3], 0
test eax, eax
je 0x10609b2
cmp eax, 2
je 0x1060913
push eax
push 0x1005658
jmp 0x1060a17
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x10609a6
cmp dword [ebp + 0xc], 7
push edi
jne 0x1060993
call fcn.0105cbe6
add eax, eax
push eax
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10609b2
push eax
push dword [ebp + 0x10]
push 0x1005610
call fcn.01062f95
add esp, 0xc
push esi
call fcn.0105c5dc
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x1060971
and dword [edi], 0
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x10608a6
cmp dword [ebp + 0xc], 7
jne 0x1060a23
push ebx
call fcn.0105cbe6
add eax, eax
jmp 0x1060a3a
push ebx
push esi
call fcn.0101eb14
test eax, eax
jge 0x1060937
push eax
push 0x10057fc
jmp 0x1060a17
push 0x10057a8
call fcn.01062f95
jmp 0x1060a1d
cmp dword [ebp + 0xc], 2
jne 0x10609f5
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x1060961
lea eax, [ebx + ebx + 2]
push eax
mov dword [ebp - 4], eax
call fcn.0105c544
mov dword [ebp + 0x10], eax
test eax, eax
je 0x1060961
push ebx
push eax
push esi
call edi
test eax, eax
je 0x1060a03
cmp eax, ebx
jg 0x1060a03
push esi
call fcn.0105c5dc
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x1060a69
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x1060a69
push dword [ebp + 0x10]
call fcn.0105c5dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1005750
call fcn.01062f95
pop ecx
pop ecx
jmp 0x1060961
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1060a28
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 4], eax
call fcn.0105c544
mov esi, eax
test esi, esi
je 0x10608a6
cmp dword [ebp + 0xc], 7
jne 0x1060a72
push dword [ebp - 4]
push ebx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x1060a69
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
push ebx
push dword [ebp - 4]
push esi
call fcn.0101eb14
test eax, eax
jge 0x1060a60
push eax
push 0x1005710
call fcn.01062f95
pop ecx
pop ecx
push esi
call fcn.0105c5dc
jmp 0x10608a6