Function at 0x6e90e300
Capabilities:
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
mov eax, ecx
push ebp
mov ebp, esp
sub esp, 0x78
test byte [0x6e928bf8], 8
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [eax + 0xc]
mov ecx, dword [ecx + 8]
mov edi, dword [eax + 0x10]
jne 0x6e90e488
test ebx, ebx
je 0x6e90e451
test edx, edx
je 0x6e90e460
test ecx, ecx
nop
lea esi, [esi]
je 0x6e90e460
mov eax, esi
call fcn.6e90c3d0
test byte [0x6e928bf8], 8
mov edx, eax
jne 0x6e90e530
test edx, edx
je 0x6e90e56e
mov dword [esp + 4], edx
lea eax, [ebp - 0x1c]
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
mov dword [ebp - 0x2c], edx
call sub.advapi32.dll_RegCreateKeyA
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
mov esi, eax
mov dword [esp], edx
call sym.crypt32.dll_CryptMemFree
sub esp, 4
test esi, esi
jne 0x6e90e510
test edi, edi
mov esi, dword [ebp - 0x1c]
je 0x6e90e3f2
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0x10], edi
mov edi, 1
mov dword [esp], esi
mov dword [esp + 0xc], edi
inc eax
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, 0x6e931479
mov dword [esp + 4], eax
call sub.advapi32.dll_RegSetValueExA
sub esp, 0x18
test eax, eax
mov esi, eax
jne 0x6e90e510
mov esi, dword [ebp - 0x1c]
cmp word [ebx], 0
je 0x6e90e578
mov eax, ebx
nop
add eax, 2
cmp word [eax], 0
jne 0x6e90e400
sub eax, ebx
add eax, 2
mov dword [esp + 0x14], eax
xor edx, edx
mov ecx, 0x6e931260
mov dword [esp + 8], edx
mov eax, 1
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
call sub.advapi32.dll_RegSetValueExW
mov esi, eax
mov eax, dword [ebp - 0x1c]
sub esp, 0x18
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
test esi, esi
jne 0x6e90e51e
mov eax, 1
jmp 0x6e90e46f
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80070057
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x14
mov dword [ebp - 0x38], edx
mov eax, edi
mov dword [ebp - 0x2c], ecx
call fcn.6e90bf80
mov dword [ebp - 0x34], eax
mov eax, ebx
call fcn.6e90c150
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x30], eax
mov eax, ecx
call fcn.6e90bf80
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
mov eax, edx
call fcn.6e90bf80
mov edx, dword [ebp - 0x34]
mov dword [esp + 0x10], esi
mov ecx, dword [ebp - 0x30]
mov dword [esp], 3
mov dword [esp + 0x20], edx
mov edx, dword [ebp - 0x2c]
mov dword [esp + 0x1c], ecx
mov ecx, str.CryptRegisterOIDFunction
mov dword [esp + 0x14], eax
mov eax, 0x6e928bf8
mov dword [esp + 8], ecx
mov dword [esp + 0x18], edx
mov edx, str.__x___s___s___s___s__n
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call fcn.6e90be90
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
jmp 0x6e90e339
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], esi
xor eax, eax
jmp 0x6e90e46f
mov dword [ebp - 0x2c], eax
call fcn.6e90bf80
mov dword [esp], 3
mov dword [esp + 0x10], eax
mov eax, str.Key_name_is__s_n
mov dword [esp + 0xc], eax
mov eax, str.CryptRegisterOIDFunction
mov dword [esp + 8], eax
mov eax, 0x6e928bf8
mov dword [esp + 4], eax
call fcn.6e90be90
mov edx, dword [ebp - 0x2c]
test edx, edx
jne 0x6e90e374
xor eax, eax
jmp 0x6e90e46f
mov eax, 2
jmp 0x6e90e40e