Function at 0x6b9ddc
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ba0ec
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6b9e9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x50600c]
call fcn.00507158
mov ebx, eax
mov edx, 0x80000001
mov eax, ebx
call fcn.00507240
mov cl, 1
mov edx, 0x6ba108
mov eax, ebx
call fcn.00507398
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x490]
cmp byte [eax + 0x44], 0
je 0x6b9e78
push 0x6ba170
lea edx, [ebp - 0xc]
mov eax, dword [0x6d8488]
mov eax, dword [eax]
call fcn.00600ed8
push dword [ebp - 0xc]
push 0x6ba180
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040b5b8
mov ecx, dword [ebp - 8]
mov edx, 0x6ba198
mov eax, ebx
call fcn.00507cf4
jmp 0x6b9e84
mov edx, 0x6ba198
mov eax, ebx
call fcn.00507880
mov eax, ebx
call fcn.00507210
mov eax, ebx
call fcn.0040874c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6b9ea6
xor eax, eax
push ebp
push 0x6ba0c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x6ba1b8
mov edx, dword [0x6ffeec]
mov eax, dword [ebp - 4]
call fcn.006516a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4e8]
movzx ecx, byte [eax + 0x44]
mov edx, 0x6ba1e0
mov eax, dword [0x6ffeec]
call fcn.00508018
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3dc]
mov edx, dword [eax]
call dword [edx + 0x130]
mov ecx, eax
mov edx, 0x6ba1fc
mov eax, dword [0x6ffeec]
call fcn.00507fd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3d8]
mov edx, dword [eax]
call dword [edx + 0x130]
mov ecx, eax
mov edx, 0x6ba21c
mov eax, dword [0x6ffeec]
call fcn.00507fd4
mov ecx, dword [0x6ffedc]
mov edx, 0x6ba240
mov eax, dword [0x6ffeec]
call fcn.00507cf4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x458]
cmp byte [eax + 0x44], 0
je 0x6b9f5e
xor ecx, ecx
mov edx, 0x6ba264
mov eax, dword [0x6ffeec]
call fcn.00507fd4
jmp 0x6b9f97
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x478]
cmp byte [eax + 0x44], 0
je 0x6b9f83
mov ecx, 1
mov edx, 0x6ba264
mov eax, dword [0x6ffeec]
call fcn.00507fd4
jmp 0x6b9f97
mov ecx, 2
mov edx, 0x6ba264
mov eax, dword [0x6ffeec]
call fcn.00507fd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x43c]
cmp byte [eax + 0x44], 0
je 0x6b9fb9
xor ecx, ecx
mov edx, 0x6ba284
mov eax, dword [0x6ffeec]
call fcn.00507fd4
jmp 0x6ba017
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x440]
cmp byte [eax + 0x44], 0
je 0x6b9fde
mov ecx, 1
mov edx, 0x6ba284
mov eax, dword [0x6ffeec]
call fcn.00507fd4
jmp 0x6ba017
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x44c]
cmp byte [eax + 0x44], 0
je 0x6ba003
mov ecx, 2
mov edx, 0x6ba284
mov eax, dword [0x6ffeec]
call fcn.00507fd4
jmp 0x6ba017
mov ecx, 3
mov edx, 0x6ba284
mov eax, dword [0x6ffeec]
call fcn.00507fd4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x498]
movzx ecx, byte [eax + 0x44]
mov edx, 0x6ba2a0
mov eax, dword [0x6ffeec]
call fcn.00508018
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48c]
movzx ecx, byte [eax + 0x44]
mov edx, 0x6ba2c0
mov eax, dword [0x6ffeec]
call fcn.00508018
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x490]
movzx ecx, byte [eax + 0x44]
mov edx, 0x6ba2dc
mov eax, dword [0x6ffeec]
call fcn.00508018
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x494]
movzx ecx, byte [eax + 0x44]
mov edx, 0x6ba300
mov eax, dword [0x6ffeec]
call fcn.00508018
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3f0]
cmp byte [eax + 0x44], 0
je 0x6ba0a9
xor ecx, ecx
mov edx, 0x6ba31c
mov eax, dword [0x6ffeec]
call fcn.00507fd4
jmp 0x6ba0bd
mov ecx, 1
mov edx, 0x6ba31c
mov eax, dword [0x6ffeec]
call fcn.00507fd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6ba0d1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ba0f3
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040a68c
ret