Function at 0x6e9164c0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x1fc
test byte [0x6e928c98], 8
jne 0x6e9164f0
or edx, dword [edi + 0xc]
mov ebx, 1
jne 0x6e916535
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], eax
mov eax, str.__p___d__n
mov ebx, 1
mov dword [esp + 0xc], eax
mov eax, str.CRYPT_RegFlushStore
mov dword [esp + 8], eax
mov eax, 0x6e928c98
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov dword [esp], 3
mov dword [ebp - 0x1bc], edx
call fcn.6e915430
mov edx, dword [ebp - 0x1bc]
or edx, dword [edi + 0xc]
je 0x6e9164e1
mov eax, dword [0x6e928d4c]
xor esi, esi
mov dword [ebp - 0x1b0], eax
mov eax, dword [0x6e928d48]
mov dword [ebp - 0x1ac], eax
mov eax, dword [0x6e928d44]
mov dword [ebp - 0x1a8], eax
lea eax, [edi + 0x28]
mov dword [ebp - 0x1a4], eax
lea eax, [edi + 0x30]
mov dword [ebp - 0x1a0], eax
lea eax, [edi + 0x38]
mov dword [ebp - 0x19c], eax
lea eax, [ebp - 0x196]
shr eax, 0x10
mov dword [ebp - 0x1c0], eax
mov eax, edi
mov edi, esi
mov esi, eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x1b4]
mov ecx, 0xf003f
mov dword [esp + 0x1c], eax
xor eax, eax
xor ebx, ebx
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [edi*4 + 0x6e935208]
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 4], eax
mov eax, dword [esi + 8]
mov dword [esp], eax
call sub.advapi32.dll_RegCreateKeyExW
sub esp, 0x24
test eax, eax
jne 0x6e916650
mov eax, dword [ebp + edi*4 - 0x1a4]
mov dword [ebp - 0x1bc], eax
test eax, eax
jne 0x6e916670
mov eax, dword [esi + 4]
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp + edi*4 - 0x1b0]
inc edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1b4]
mov dword [esp], eax
call fcn.6e916280
mov ebx, eax
mov eax, dword [ebp - 0x1b4]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
test ebx, ebx
je 0x6e9164e1
cmp edi, 2
jbe 0x6e916588
test ebx, ebx
je 0x6e9164e1
mov dword [esi + 0xc], 0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], eax
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + 0x10]
mov dword [esp], eax
mov dword [ebp - 0x1c8], eax
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x1bc]
mov eax, dword [ecx]
sub esp, 4
mov edx, dword [eax]
lea ebx, [eax - 0x14]
sub edx, 0x14
cmp ecx, eax
je 0x6e9168fc
mov dword [ebp - 0x1cc], edi
mov edi, edx
mov dword [ebp - 0x1d0], esi
jmp 0x6e91670e
lea eax, [ebp - 0x196]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x1b4]
mov dword [esp], eax
call sub.advapi32.dll_RegDeleteKeyW
sub esp, 8
test eax, 0xfffffffd
je 0x6e9166dc
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], eax
mov eax, dword [ebx + 0x18]
mov edx, dword [ebx + 0x14]
mov dword [edx + 4], eax
mov edx, dword [ebx + 0x14]
mov dword [eax], edx
mov dword [esp], ebx
mov ebx, edi
call sym.crypt32.dll_CryptMemFree
mov eax, dword [edi + 0x14]
lea edx, [edi + 0x14]
sub eax, 0x14
sub esp, 4
cmp dword [ebp - 0x1bc], edx
je 0x6e9168f0
mov edi, eax
lea edx, [ebp - 0x196]
mov eax, ebx
call fcn.6e9152d0
test byte [0x6e928c98], 8
je 0x6e9166b0
mov eax, dword [ebp - 0x1c0]
test eax, eax
je 0x6e916918
mov eax, 0xffffffff
mov dword [esp + 4], eax
lea eax, [ebp - 0x196]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x6e916950
cmp word [ebp - 0x196], 0
je 0x6e916960
lea esi, [esi]
lea edi, [edi]
mov ecx, eax
cmp word [ebp + ecx*2 - 0x194], 0
lea eax, [eax + 1]
jne 0x6e916770
mov dword [ebp - 0x1c4], ebx
lea esi, [ebp - 0x196]
mov edx, 0x224c
mov word [ebp - 0x144], dx
lea edx, [ebp - 0x142]
jmp 0x6e9167d8
cmp eax, 9
je 0x6e916878
cmp eax, 0xa
jne 0x6e916817
mov word [edx], 0x6e5c
add edx, 2
lea esi, [esi]
lea edi, [edi]
lea eax, [ecx - 1]
test ecx, ecx
jle 0x6e916888
lea ecx, [ebp - 0x22]
cmp edx, ecx
ja 0x6e916888
mov ecx, eax
movzx eax, word [esi]
add esi, 2
cmp eax, 0xd
je 0x6e916800
jbe 0x6e9167a0
cmp eax, 0x22
je 0x6e916868
cmp eax, 0x5c
lea esi, [esi]
jne 0x6e91680a
mov word [edx], 0x5c5c
add edx, 2
jmp 0x6e9167c0
mov word [edx], 0x725c
add edx, 2
jmp 0x6e9167c0
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x6e916940
mov byte [edx], 0x5c
mov ebx, eax
add edx, 5
shr ebx, 0xc
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [edx - 4], bl
mov ebx, eax
shr ebx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [edx - 3], bl
mov ebx, eax
and eax, 0xf
shr ebx, 4
movzx eax, byte [eax + str.0123456789abcdefCRYPT_RegWriteToReg]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [edx - 1], al
mov byte [edx - 2], bl
jmp 0x6e9167c0
mov word [edx], 0x225c
add edx, 2
jmp 0x6e9167c0
mov word [edx], 0x745c
add edx, 2
jmp 0x6e9167c0
mov byte [edx], 0x22
test eax, eax
mov ebx, dword [ebp - 0x1c4]
jle 0x6e916979
mov word [edx + 1], 0x2e2e
lea eax, [edx + 4]
mov byte [edx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x144]
mov dword [esp], eax
call fcn.6e9257e0
mov dword [esp + 0x10], eax
mov eax, 0x6e9352b0
mov esi, str.Removing__s_n
mov dword [esp + 8], eax
mov eax, 0x6e928c98
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.6e915430
jmp 0x6e9166b0
mov edi, dword [ebp - 0x1cc]
mov esi, dword [ebp - 0x1d0]
mov eax, dword [ebp - 0x1c8]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
sub esp, 4
jmp 0x6e9165eb
mov dword [esp], 0x6e93502e
lea eax, [ebp - 0x196]
mov dword [ebp - 0x1c4], eax
movzx eax, word [ebp - 0x1c4]
mov dword [esp + 4], eax
call fcn.6e9156e0
jmp 0x6e9168b7
mov byte [edx], al
inc edx
jmp 0x6e9167c0
mov eax, 0x6e935034
jmp 0x6e9168b7
mov byte [ebp - 0x142], 0x22
lea edx, [ebp - 0x142]
mov eax, 0x224c
mov word [ebp - 0x144], ax
lea eax, [edx + 1]
jmp 0x6e9168a6