Function at 0x1060e30
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
xor esi, esi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x28], ecx
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
call fcn.010607b0
cmp dword [ebp - 0x1c], esi
je 0x10611bc
cmp dword [ebp - 0x14], esi
je 0x10611bc
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 3
push esi
push esi
push esi
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, esi
jne 0x10611bc
cmp dword [ebp + 0x10], esi
je 0x106119c
cmp dword [ebp - 4], esi
jne 0x1060ee5
cmp dword [ebp - 0x18], esi
jne 0x1060ee5
push 2
push 0x1001e44
push 1
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10611ad
mov ebx, dword [ebp - 0x24]
mov eax, ebx
shr eax, 1
not eax
and eax, 1
jne 0x1060f0b
push esi
push esi
push esi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10611b0
mov eax, 0x10003
cmp ebx, eax
ja 0x1060f63
je 0x1060f2f
mov eax, ebx
dec eax
je 0x1060f4d
dec eax
dec eax
je 0x1060f4d
sub eax, 5
je 0x1060fa9
sub eax, 0xfff9
jne 0x1060f7f
cmp dword [ebp - 4], esi
je 0x10611b0
push dword [ebp - 4]
call fcn.01056149
mov dword [ebp + 8], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
jmp 0x1060ed3
cmp dword [ebp - 0x18], esi
je 0x10611b0
push dword [ebp - 0x20]
push dword [ebp - 0x18]
push 3
jmp 0x1060ed3
mov eax, ebx
sub eax, 0x20000
je 0x1061174
dec eax
dec eax
je 0x1061174
sub eax, 0x20006
je 0x1060fa9
cmp dword [ebp - 4], esi
je 0x10611b0
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1060f8e
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 4]
jmp 0x1060ed1
cmp dword [ebp - 4], esi
je 0x10611b0
push 7
pop edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
test ebx, 0x40000
je 0x10610e9
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10610e9
cmp dword [ebp - 0x24], edi
jne 0x10610e9
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1060ff4
mov ecx, dword [ebp - 0x20]
sub eax, edx
shr ecx, 1
sar eax, 1
lea edi, [ecx + eax + 3]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
pop ecx
mov dword [ebp + 8], ebx
cmp ebx, esi
jne 0x1061037
mov dword [ebp - 0x10], 0xe
jmp 0x10610e4
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10610da
mov ebx, dword [ebp + 8]
jmp 0x1061081
push dword [ebp - 4]
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x10610b6
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x106106f
sub eax, edx
sar eax, 1
lea ebx, [ebx + eax*2 + 2]
xor eax, eax
cmp ax, word [ebx]
jne 0x106105a
push dword [ebp - 4]
lea eax, [edi - 1]
push eax
push ebx
call fcn.01035811
test eax, eax
jl 0x10610d5
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x106109f
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
jmp 0x10610e4
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10610bc
sub eax, edx
sar eax, 1
mov ecx, 0xffffffff
sub ecx, eax
add edi, ecx
jmp 0x10610e4
push dword [ebp + 8]
jmp 0x10610db
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov dword [ebp + 8], esi
pop ecx
cmp dword [ebp + 8], esi
jne 0x106114b
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10610ef
sub eax, edx
sar eax, 1
lea edi, [eax + 2]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
pop ecx
mov dword [ebp + 8], ebx
cmp ebx, esi
je 0x10611b0
push dword [ebp - 4]
lea eax, [edi - 1]
push eax
push ebx
call fcn.01035811
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1061136
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [ebx + eax*2 + 2], cx
lea eax, [edi + edi]
push eax
push dword [ebp + 8]
push 7
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp + 8], esi
je 0x10611b0
push dword [ebp + 8]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x10611b0
cmp dword [ebp - 4], esi
je 0x10611b0
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x106117f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 4]
push 2
jmp 0x1060ed3
cmp dword [ebp - 8], esi
je 0x10611b0
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
jne 0x10611e2
cmp dword [ebp - 8], esi
jne 0x10611e2
cmp dword [ebp - 4], esi
jne 0x10611e2
cmp dword [ebp - 0x14], esi
je 0x10611e2
cmp dword [ebp - 0x1c], esi
je 0x10611e2
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call fcn.010578fb
cmp edi, esi
je 0x106120f
cmp ebx, esi
jne 0x10611f3
cmp edi, 2
jne 0x10611f3
xor edi, edi
jmp 0x1061218
push edi
push 0x100cea0
push 2
call fcn.01055c69
mov ecx, dword [ebp - 0x28]
add esp, 0xc
push ebx
push dword [ebp + 0xc]
call fcn.0106087e
mov eax, 0x100c948
cmp ebx, esi
jne 0x106121d
mov eax, 0x100c958
push edi
push dword [ebp + 0xc]
push eax
push 0x100ce74
push 4
call fcn.01055c69
add esp, 0x14
cmp dword [ebp - 0x18], esi
je 0x106123f
push dword [ebp - 0x18]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x14], esi
je 0x106124d
push dword [ebp - 0x14]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp dword [ebp - 8], esi
je 0x106125b
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp dword [ebp - 4], esi
je 0x1061269
push dword [ebp - 4]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp edi, esi
jle 0x1061279
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc