Function at 0x6d1c4b4f
Capabilities:
Create directory
Get common file path
Get session user name
Query or enumerate registry value

Disassembly:
mov eax, 0x6d1c8c09
call fcn.6d1c81f0
sub esp, 0x264
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor ebx, ebx
cmp eax, 0x80000000
jae 0x6d1c4bd2
lea eax, [ebp - 0x24]
push eax
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, eax
cmp esi, ebx
jge 0x6d1c4b9a
push esi
lea ecx, [ebp - 0x20]
call fcn.6d1c19d7
push 0x6d1c90f4
lea eax, [ebp - 0x20]
jmp 0x6d1c4e20
push dword [ebp + 0x14]
push dword [ebp - 0x24]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp esi, ebx
jne 0x6d1c4c23
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x6d1c4c23
push dword [ebp - 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x6d1c4c23
lea eax, [ebp - 0x10]
push eax
xor esi, esi
inc esi
push esi
push ebx
push 0x6d1c13f8
push 0x80000002
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6d1c4c57
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x48]
push eax
push ebx
push 0x6d1c13d4
push dword [ebp - 0x10]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x5c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6d1c4c57
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x1b]
push eax
push dword [ebp + 0x14]
lea ecx, [ebp - 0x34]
call fcn.6d1c325e
push dword [ebp + 0x14]
mov dword [ebp - 4], ebx
call sub.msvcrt.dll_wcslen
mov esi, 0x6d1c1394
push esi
mov edi, eax
call sub.msvcrt.dll_wcslen
lea eax, [edi + eax + 1]
cmp eax, 0x104
pop ecx
pop ecx
jbe 0x6d1c4c61
push 0x80004005
jmp 0x6d1c4b85
mov edi, dword [ebp + 0x14]
push esi
push edi
call sub.msvcrt.dll_wcscat
pop ecx
pop ecx
mov ecx, dword [ebp + 0x1c]
cmp ecx, ebx
je 0x6d1c4c7a
push edi
call fcn.6d1c305d
cmp byte [ebp + 0x18], bl
je 0x6d1c4d36
push 0x6d1c1380
lea ecx, [ebp - 0x34]
call fcn.6d1c3040
mov eax, dword [ebp - 0x30]
cmp eax, ebx
jne 0x6d1c4c9c
mov eax, 0x6d1c1168
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push eax
call esi
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x6d1c4ccb
call edi
cmp eax, 0xb7
je 0x6d1c4ccb
mov eax, dword [ebp - 0x30]
cmp eax, ebx
jne 0x6d1c4cc5
mov eax, 0x6d1c1168
push eax
call fcn.6d1c36c3
push 0x6d1c1364
lea ecx, [ebp - 0x34]
call fcn.6d1c3040
mov eax, dword [ebp - 0x30]
cmp eax, ebx
jne 0x6d1c4ce4
mov eax, 0x6d1c1168
push ebx
push eax
call esi
test eax, eax
jne 0x6d1c4cf5
call edi
cmp eax, 0xb7
jne 0x6d1c4d1f
push 0x6d1c134c
lea ecx, [ebp - 0x34]
call fcn.6d1c3040
mov eax, dword [ebp - 0x30]
cmp eax, ebx
jne 0x6d1c4d0e
mov eax, 0x6d1c1168
push ebx
push eax
call esi
test eax, eax
jne 0x6d1c4d33
call edi
cmp eax, 0xb7
je 0x6d1c4d33
cmp eax, ebx
jle 0x6d1c4d2d
and eax, 0xffff
or eax, 0x80070000
push eax
jmp 0x6d1c4b85
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
cmp eax, ebx
jne 0x6d1c4d5b
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp - 0x270]
push eax
mov dword [ebp + 0x18], 0x101
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea eax, [ebp - 0x270]
mov cl, byte [ebp + 0x1b]
mov byte [ebp - 0x44], cl
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 1
call fcn.6d1c3439
mov al, byte [ebp + 0x1b]
mov byte [ebp - 0x58], al
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 2
call fcn.6d1c3b60
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.6d1c37a6
push 1
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 2
call fcn.6d1c2261
mov esi, dword [ebp - 0x40]
cmp esi, ebx
jne 0x6d1c4dc1
mov esi, 0x6d1c1168
mov eax, dword [ebp - 0x54]
cmp eax, ebx
jne 0x6d1c4dcd
mov eax, 0x6d1c1168
push eax
call sub.msvcrt.dll_wcslen
push esi
mov dword [ebp + 0x18], eax
call sub.msvcrt.dll_wcslen
mov ecx, dword [ebp + 0x18]
push dword [ebp + 0xc]
add ecx, eax
mov dword [ebp + 0x18], ecx
call sub.msvcrt.dll_wcslen
mov ecx, dword [ebp + 0x18]
add ecx, eax
push edi
mov dword [ebp + 0x18], ecx
call sub.msvcrt.dll_wcslen
mov ecx, dword [ebp + 0x18]
lea eax, [ecx + eax + 0xa]
add esp, 0x10
cmp eax, 0x104
jbe 0x6d1c4e26
push 0x80004005
lea ecx, [ebp - 0x6c]
call fcn.6d1c19d7
push 0x6d1c90f4
lea eax, [ebp - 0x6c]
push eax
call sub.msvcrt.dll__CxxThrowException
push 0x6d1c11fc
push edi
call sub.msvcrt.dll_wcscat
mov eax, dword [ebp - 0x40]
cmp eax, ebx
pop ecx
pop ecx
jne 0x6d1c4e3f
mov eax, 0x6d1c1168
push eax
push edi
call sub.msvcrt.dll_wcscat
mov esi, 0x6d1c1344
push esi
push edi
call sub.msvcrt.dll_wcscat
push dword [ebp + 0xc]
push edi
call sub.msvcrt.dll_wcscat
push esi
push edi
call sub.msvcrt.dll_wcscat
mov eax, dword [ebp - 0x54]
add esp, 0x20
cmp eax, ebx
jne 0x6d1c4e71
mov eax, 0x6d1c1168
push eax
push edi
call sub.msvcrt.dll_wcscat
push 0x6d1c1338
push edi
call sub.msvcrt.dll_wcscat
add esp, 0x10
push 1
lea ecx, [ebp - 0x58]
call fcn.6d1c2261
push 1
lea ecx, [ebp - 0x44]
call fcn.6d1c2261
push 1
lea ecx, [ebp - 0x34]
call fcn.6d1c2261
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18