Function at 0x6e91b590
Capabilities:
Get file size
Query or enumerate registry key
Read file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x278
mov eax, dword [ecx + 4]
test byte [0x6e928d20], 8
mov edi, dword [ecx]
mov ebx, dword [ecx + 8]
mov dword [ebp - 0x24c], eax
jne 0x6e91b8b0
test ebx, ebx
je 0x6e91b5d0
mov eax, dword [ebp - 0x24c]
or eax, edi
jne 0x6e91b5f0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
xor esi, esi
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [ebx], 0
mov esi, dword [ebp - 0x24c]
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
test esi, esi
je 0x6e91bac0
lea eax, [ebp - 0x228]
mov esi, 1
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], esi
mov esi, dword [ebp - 0x24c]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [sym.imp.kernel32.dll_SetFilePointerEx]
mov dword [esp], esi
mov dword [ebp - 0x258], eax
call eax
xor eax, eax
sub esp, 0x14
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [ebp - 0x240]
xor edx, edx
mov dword [ebp - 0x24c], esi
mov ecx, 4
sub esp, 0x10
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x22c]
mov dword [esp], esi
mov dword [esp + 0x10], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
mov esi, eax
je 0x6e91b990
mov esi, dword [ebp - 0x24c]
mov dword [ebp - 0x250], esi
cmp dword [ebp - 0x240], 3
jbe 0x6e91bc00
test byte [0x6e928d20], 8
jne 0x6e91bc80
cmp word [ebp - 0x22c], 0x5a4d
je 0x6e91bc50
cmp dword [ebp - 0x22c], 0x4643534d
je 0x6e91bed8
cmp byte [ebp - 0x22c], 0x30
je 0x6e91bce0
mov dword [esp], 0x80000002
lea eax, [ebp - 0x23c]
mov esi, 0x20019
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, str.SoftwareMicrosoftCryptographyOIDEncodingType_0CryptSIPDllIsMyFileType_
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
call sub.advapi32.dll_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x6e91b7ce
mov dword [ebp - 0x260], edi
lea edx, [ebp - 0x220]
lea esi, [ebp - 0x238]
mov edi, edx
mov dword [ebp - 0x25c], esi
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 4], eax
mov edx, 0x104
xor ecx, ecx
mov dword [ebp - 0x238], edx
lea edx, [eax + 1]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x254], edx
xor edx, edx
xor esi, esi
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x25c]
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp], eax
call sub.advapi32.dll_RegEnumKeyExW
sub esp, 0x20
test eax, eax
je 0x6e91bd70
mov eax, dword [ebp - 0x23c]
mov edi, dword [ebp - 0x260]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
mov dword [esp], 0x80000002
lea eax, [ebp - 0x23c]
mov esi, 0x20019
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, str.SoftwareMicrosoftCryptographyOIDEncodingType_0CryptSIPDllIsMyFileType2_
mov dword [esp + 0xc], esi
mov dword [esp + 4], eax
call sub.advapi32.dll_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x6e91b892
mov dword [ebp - 0x254], edi
lea edx, [ebp - 0x238]
mov dword [ebp - 0x25c], edx
lea esi, [ebp - 0x220]
mov dword [ebp - 0x260], ebx
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 4], eax
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x18], ebx
lea edi, [eax + 1]
mov ebx, dword [ebp - 0x25c]
mov dword [esp + 0x1c], ecx
mov eax, dword [ebp - 0x23c]
mov edx, 0x104
mov dword [ebp - 0x238], edx
xor ecx, ecx
xor edx, edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp], eax
call sub.advapi32.dll_RegEnumKeyExW
sub esp, 0x20
test eax, eax
je 0x6e91be10
mov eax, dword [ebp - 0x23c]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x800b0003
xor esi, esi
jmp 0x6e91bc0f
test edi, edi
je 0x6e91bc40
mov eax, edi
shr eax, 0x10
je 0x6e91b9e0
mov dword [esp], edi
mov eax, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x6e91bc30
cmp word [edi], 0
je 0x6e91beb0
lea esi, [esi]
mov edx, eax
cmp word [edi + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x6e91b8f0
mov dword [ebp - 0x250], edi
mov ecx, 0x224c
mov esi, edi
mov word [ebp - 0x220], cx
lea ecx, [ebp - 0x21e]
mov dword [ebp - 0x254], ebx
jmp 0x6e91b95b
cmp eax, 9
je 0x6e91ba38
cmp eax, 0xa
jne 0x6e91ba62
mov word [ecx], 0x6e5c
add ecx, 2
lea esi, [esi]
lea ebx, [ebp - 0xfe]
lea eax, [edx - 1]
cmp ecx, ebx
ja 0x6e91bbc0
test edx, edx
jle 0x6e91bbc0
mov edx, eax
movzx eax, word [esi]
add esi, 2
cmp eax, 0xd
je 0x6e91ba48
jbe 0x6e91b920
cmp eax, 0x22
je 0x6e91bab0
cmp eax, 0x5c
jne 0x6e91ba55
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x6e91b940
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x250], eax
xor ebx, ebx
mov ecx, dword [ebp - 0x228]
xor edi, edi
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0x250]
mov dword [esp + 0xc], edi
mov ebx, dword [ebp - 0x224]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov eax, dword [ebp - 0x258]
mov dword [esp + 8], ebx
call eax
mov eax, esi
sub esp, 0x14
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp], 0x6e937522
movzx eax, di
mov dword [esp + 4], eax
call fcn.6e919f10
mov dword [esp + 0x10], eax
mov edx, dword [ebp - 0x24c]
mov eax, str.__s__p__p__n
mov dword [esp + 0xc], eax
mov eax, str.CryptSIPRetrieveSubjectGuid
mov dword [esp + 8], eax
mov eax, 0x6e928d20
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.6e91a370
jmp 0x6e91b5c2
mov word [ecx], 0x745c
add ecx, 2
jmp 0x6e91b940
mov word [ecx], 0x725c
add ecx, 2
jmp 0x6e91b940
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x6e91bc28
mov byte [ecx], 0x5c
mov edi, eax
add ecx, 5
shr edi, 0xc
movzx ebx, byte [edi + str.0123456789abcdefCryptSIPAddProvider]
mov edi, eax
shr edi, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefCryptSIPAddProvider]
mov edi, eax
shr edi, 4
and eax, 0xf
and edi, 0xf
movzx eax, byte [eax + str.0123456789abcdefCryptSIPAddProvider]
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefCryptSIPAddProvider]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x6e91b940
mov word [ecx], 0x225c
add ecx, 2
jmp 0x6e91b940
xor eax, eax
mov edx, 1
mov dword [esp + 0x18], eax
mov eax, pe_nt_image_headers32
mov ecx, 0x80000000
mov dword [esp + 0x14], eax
mov eax, 3
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov dword [ebp - 0x250], eax
sub esp, 0x1c
inc eax
je 0x6e91bf08
lea eax, [ebp - 0x228]
mov esi, 1
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0x10], esi
mov esi, dword [ebp - 0x250]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [sym.imp.kernel32.dll_SetFilePointerEx]
mov dword [esp], esi
mov dword [ebp - 0x258], eax
call eax
xor eax, eax
sub esp, 0x14
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
xor eax, eax
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_SetFilePointer]
lea eax, [ebp - 0x240]
xor edx, edx
mov ecx, 4
sub esp, 0x10
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x22c]
mov dword [esp], esi
mov dword [esp + 0x10], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_ReadFile]
sub esp, 0x14
test eax, eax
mov esi, eax
jne 0x6e91b6ba
mov eax, dword [ebp - 0x250]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, esi
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0xc
test eax, eax
mov edi, dword [ebp - 0x250]
mov byte [ecx], 0x22
mov ebx, dword [ebp - 0x254]
jle 0x6e91bec9
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x220]
mov dword [esp], eax
call fcn.6e9257e0
jmp 0x6e91b9f3
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
xor esi, esi
mov eax, dword [ebp - 0x24c]
test eax, eax
jne 0x6e91b99c
jmp 0x6e91bb98
mov byte [ecx], al
inc ecx
jmp 0x6e91b940
mov eax, 0x6e937518
jmp 0x6e91b9f3
mov eax, 0x6e937511
jmp 0x6e91b9f3
mov dword [ebx], 0xc689aab8
mov dword [ebx + 4], 0x11d08e78
mov dword [ebx + 8], 0xc000478c
mov esi, 1
mov dword [ebx + 0xc], 0xee95c24f
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0
jmp 0x6e91bc0f
movzx eax, byte [ebp - 0x229]
mov ecx, str.file_magic__0x_02x_02x_02x_02x_n
mov esi, str.CryptSIPRetrieveSubjectGuid
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp], 3
mov dword [esp + 0x1c], eax
movzx eax, byte [ebp - 0x22a]
mov dword [esp + 0x18], eax
movzx eax, byte [ebp - 0x22b]
mov dword [esp + 0x14], eax
movzx eax, byte [ebp - 0x22c]
mov dword [esp + 0x10], eax
mov eax, 0x6e928d20
mov dword [esp + 4], eax
call fcn.6e91a370
jmp 0x6e91b6d4
mov eax, dword [ebp - 0x250]
xor edx, edx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileSize]
sub esp, 8
mov esi, eax
test byte [0x6e928d20], 8
jne 0x6e91bf3d
movzx eax, byte [ebp - 0x22b]
test al, al
js 0x6e91bf30
movzx edx, al
add edx, 2
cmp edx, esi
je 0x6e91bd55
and al, 0x7f
cmp al, 1
je 0x6e91bf6d
cmp al, 2
jne 0x6e91bd49
movzx eax, word [ebp - 0x22a]
mov edx, eax
movzx eax, ah
shl edx, 8
or eax, edx
movzx eax, ax
add eax, 4
cmp eax, esi
je 0x6e91bd55
cmp esi, 0xffff
jbe 0x6e91b700
mov dword [ebx], 0xde351a43
mov dword [ebx + 4], 0x11d08e59
jmp 0x6e91bc5d
mov dword [esp + 4], edi
lea eax, [ebp - 0x234]
mov dword [esp + 0x10], eax
mov eax, 0x20019
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp], eax
call sub.advapi32.dll_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x6e91b7b7
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.6e919f70
test eax, eax
je 0x6e91bf10
mov dword [esp + 4], ebx
mov edx, dword [ebp - 0x250]
mov dword [esp], edx
call eax
mov esi, eax
mov eax, dword [ebp - 0x230]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebp - 0x234]
sub esp, 4
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
test esi, esi
jne 0x6e91beec
mov eax, dword [ebp - 0x254]
jmp 0x6e91b760
mov dword [esp + 4], esi
lea eax, [ebp - 0x234]
mov dword [esp + 0x10], eax
mov eax, 0x20019
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp], eax
call sub.advapi32.dll_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x6e91b881
mov eax, dword [ebp - 0x234]
lea edx, [ebp - 0x230]
call fcn.6e919f70
test eax, eax
je 0x6e91bf84
mov ebx, dword [ebp - 0x260]
mov dword [esp + 4], ebx
mov ebx, dword [ebp - 0x254]
mov dword [esp], ebx
call eax
mov ebx, eax
mov eax, dword [ebp - 0x230]
sub esp, 8
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [ebp - 0x234]
sub esp, 4
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
test ebx, ebx
jne 0x6e91beea
mov eax, edi
jmp 0x6e91b830
mov byte [ebp - 0x21e], 0x22
lea ecx, [ebp - 0x21e]
mov eax, 0x224c
mov word [ebp - 0x220], ax
lea eax, [ecx + 1]
jmp 0x6e91bbe4
mov dword [ebx], 0xc689aaba
mov dword [ebx + 4], 0x11d08e78
jmp 0x6e91bc5d
mov esi, ebx
mov eax, dword [ebp - 0x23c]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x6e91bc0f
xor esi, esi
jmp 0x6e91b5df
mov eax, dword [ebp - 0x234]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x6e91bdfe
cmp al, 0x80
jne 0x6e91bd20
jmp 0x6e91bd55
mov dword [esp + 0x10], eax
mov eax, str.fileLen___d_n
mov dword [esp + 0xc], eax
mov eax, str.CryptSIPRetrieveSubjectGuid
mov dword [esp + 8], eax
mov eax, 0x6e928d20
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.6e91a370
jmp 0x6e91bd07
movzx eax, byte [ebp - 0x22a]
add eax, 3
cmp eax, esi
jne 0x6e91bd49
jmp 0x6e91bd55
mov eax, dword [ebp - 0x234]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov eax, edi
sub esp, 4
jmp 0x6e91b830