Function at 0x6e91ad10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x36c
mov dword [ebp - 0x350], ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x6e91afe0
lea esi, [ebp - 0x218]
xor ecx, ecx
lea esi, [esi]
lea edi, [edi]
movzx ebx, word [ecx + str.SoftwareMicrosoftCryptographyOIDEncodingType_0CryptSIPDll]
mov word [esi + ecx], bx
add ecx, 2
test ebx, ebx
jne 0x6e91ad40
cmp word [ebp - 0x218], 0
mov ebx, esi
je 0x6e91ad69
nop
add ebx, 2
cmp word [ebx], 0
jne 0x6e91ad60
xor ecx, ecx
nop
lea esi, [esi]
movzx edi, word [edx + ecx]
mov word [ebx + ecx], di
add ecx, 2
test edi, edi
jne 0x6e91ad70
cmp word [ebp - 0x218], 0
mov edx, esi
je 0x6e91ad99
nop
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x6e91ad90
call fcn.6e91a970
lea ebx, [ebp - 0x344]
test byte [0x6e928d20], 8
jne 0x6e91aeb0
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegCreateKeyW
sub esp, 0xc
test eax, eax
mov ebx, eax
jne 0x6e91ae8d
mov eax, dword [ebp + 8]
cmp word [eax], 0
je 0x6e91afd3
nop
add eax, 2
cmp word [eax], 0
jne 0x6e91ade0
mov edi, dword [ebp + 8]
sub eax, edi
add eax, 2
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 8], ebx
mov ecx, 1
mov esi, str.FuncName
mov dword [esp + 0xc], ecx
mov dword [esp + 4], esi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x344]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
test eax, eax
mov ebx, eax
jne 0x6e91ae8d
mov eax, dword [ebp - 0x350]
cmp word [eax], 0
je 0x6e91b0d8
nop
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6e91ae40
mov edx, dword [ebp - 0x350]
sub eax, edx
add eax, 2
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x350]
mov ebx, 1
mov dword [esp + 0xc], ebx
xor esi, esi
mov edi, 0x6e937500
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x344]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
mov ebx, eax
mov eax, dword [ebp - 0x344]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
shr eax, 0x10
je 0x6e91af90
mov dword [esp], esi
mov eax, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x6e91b0b0
cmp word [ebp - 0x218], 0
je 0x6e91b0ba
lea esi, [esi]
lea edi, [edi]
mov edx, eax
cmp word [esi + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x6e91aef0
mov dword [ebp - 0x34c], esi
mov ecx, 0x224c
mov word [ebp - 0x344], cx
lea ecx, [ebp - 0x342]
jmp 0x6e91af5b
cmp eax, 9
je 0x6e91b058
cmp eax, 0xa
jne 0x6e91b00a
mov word [ecx], 0x6e5c
add ecx, 2
lea esi, [esi]
lea edi, [ebp - 0x222]
lea eax, [edx - 1]
cmp ecx, edi
ja 0x6e91b078
test edx, edx
jle 0x6e91b078
mov edx, eax
add dword [ebp - 0x34c], 2
mov eax, dword [ebp - 0x34c]
movzx eax, word [eax - 2]
cmp eax, 0xd
je 0x6e91aff0
jbe 0x6e91af20
cmp eax, 0x22
je 0x6e91b068
cmp eax, 0x5c
nop
jne 0x6e91affd
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x6e91af40
mov dword [esp], 0x6e937522
movzx eax, si
mov dword [esp + 4], eax
call fcn.6e919f10
mov dword [esp + 0x10], eax
mov eax, str.key_is__s_n
mov dword [esp + 0xc], eax
mov eax, str.CRYPT_SIPWriteFunction
mov dword [esp + 8], eax
mov eax, 0x6e928d20
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.6e91a370
jmp 0x6e91adb1
mov eax, 2
jmp 0x6e91adf1
lea esp, [ebp - 0xc]
xor ebx, ebx
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov word [ecx], 0x725c
add ecx, 2
jmp 0x6e91af40
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x6e91b0a8
mov byte [ecx], 0x5c
mov edi, eax
add ecx, 5
shr edi, 0xc
movzx ebx, byte [edi + str.0123456789abcdefCryptSIPAddProvider]
mov edi, eax
shr edi, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefCryptSIPAddProvider]
mov edi, eax
shr edi, 4
and eax, 0xf
and edi, 0xf
movzx eax, byte [eax + str.0123456789abcdefCryptSIPAddProvider]
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefCryptSIPAddProvider]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x6e91af40
mov word [ecx], 0x745c
add ecx, 2
jmp 0x6e91af40
mov word [ecx], 0x225c
add ecx, 2
jmp 0x6e91af40
mov byte [ecx], 0x22
test eax, eax
jle 0x6e91b0d3
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea ebx, [ebp - 0x344]
mov dword [esp], ebx
call fcn.6e9257e0
jmp 0x6e91afa3
mov byte [ecx], al
inc ecx
jmp 0x6e91af40
mov eax, 0x6e937518
jmp 0x6e91afa3
mov byte [ebp - 0x342], 0x22
lea ecx, [ebp - 0x342]
mov eax, 0x224c
mov word [ebp - 0x344], ax
lea eax, [ecx + 1]
jmp 0x6e91b08c
mov eax, 2
jmp 0x6e91ae54