What I have found so far using Process Monitor is that Mobile Hotspot is managed by the icssvc service and SSID and password are stored as binary data under registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\icssvc\Settings\PrivateConnectionSettings.