Function at 0x6e90f010
Capabilities:
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
sub esp, 0x58
test byte [0x6e928bf8], 8
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov esi, dword [ecx]
mov edx, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov ebx, dword [ecx + 0xc]
jne 0x6e90f0c0
test ebx, ebx
je 0x6e90f11c
lea ecx, [ebp - 0x1c]
mov eax, esi
call fcn.6e90c480
test eax, eax
mov esi, eax
jne 0x6e90f078
mov ecx, dword [ebp - 0x10]
mov eax, esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [ebp - 0x1c]
call fcn.6e90bcf0
mov edx, ebx
mov dword [ebp - 0x2c], eax
call fcn.6e90bda0
test eax, eax
je 0x6e90f130
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x50
xor esi, esi
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym.crypt32.dll_CryptMemFree
mov eax, dword [ebp - 0x1c]
sub esp, 4
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x6e90f05c
mov dword [ebp - 0x2c], edx
mov eax, ebx
call fcn.6e90c150
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, edx
call fcn.6e90bf80
mov ecx, dword [ebp - 0x30]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], esi
mov dword [esp], 3
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov eax, str.__x___s___d___s__n
mov dword [esp + 0xc], eax
mov eax, str.CryptRegisterDefaultOIDFunction
mov dword [esp + 8], eax
mov eax, 0x6e928bf8
mov dword [esp + 4], eax
call fcn.6e90be90
test ebx, ebx
mov edx, dword [ebp - 0x2c]
jne 0x6e90f04c
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x80070057
xor esi, esi
jmp 0x6e90f05c
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x6e90f230
mov eax, dword [ebp - 0x2c]
call fcn.6e90be30
cmp word [ebx], 0
mov esi, eax
je 0x6e90f391
mov eax, ebx
jmp 0x6e90f160
add eax, 2
cmp word [eax], 0
jne 0x6e90f160
sub eax, ebx
sar eax, 1
lea eax, [esi + eax + 1]
add eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp], eax
call sym.crypt32.dll_CryptMemRealloc
mov dword [ebp - 0x2c], eax
sub esp, 8
test eax, eax
je 0x6e90f348
cmp edi, 0xffffffff
je 0x6e90f385
test edi, edi
je 0x6e90f3ca
cmp word [eax], 0
mov edi, eax
je 0x6e90f1c2
lea esi, [esi]
add edi, 2
cmp word [edi], 0
jne 0x6e90f1b0
add edi, 2
cmp word [edi], 0
jne 0x6e90f1b0
mov edx, dword [ebp - 0x2c]
mov eax, edi
sub eax, edx
sar eax, 1
sub esi, eax
mov eax, ebx
add esi, esi
cmp word [ebx], 0
je 0x6e90f3a2
nop
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6e90f1e0
sub eax, ebx
add eax, 2
mov dword [esp + 8], esi
add eax, edi
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_memmove]
cmp word [ebx], 0
je 0x6e90f3ac
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6e90f210
sub eax, ebx
lea ecx, [eax + 2]
cmp ecx, 8
mov esi, ebx
jae 0x6e90f30c
rep movsb byte es:[edi], byte [esi]
jmp 0x6e90f2b7
cmp word [ebx], 0
je 0x6e90f398
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6e90f240
sub eax, ebx
add eax, 4
mov dword [esp], eax
call sym.crypt32.dll_CryptMemAlloc
mov dword [ebp - 0x2c], eax
sub esp, 4
test eax, eax
je 0x6e90f348
cmp word [ebx], 0
je 0x6e90f3b6
mov eax, ebx
add eax, 2
cmp word [eax], 0
jne 0x6e90f270
sub eax, ebx
lea ecx, [eax + 2]
mov eax, dword [ebp - 0x2c]
cmp ecx, 8
mov esi, ebx
mov edi, eax
jae 0x6e90f356
rep movsb byte es:[edi], byte [esi]
cmp word [ebx], 0
je 0x6e90f3c0
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x6e90f2a0
sub eax, ebx
add eax, 2
mov ebx, dword [ebp - 0x2c]
mov word [ebx + eax], 0
mov ebx, dword [ebp - 0x2c]
mov esi, 0x6e931260
mov eax, ebx
call fcn.6e90be30
mov ecx, 7
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
add eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
test eax, eax
je 0x6e90f2ff
mov edx, dword fs:[0x18]
mov dword [edx + 0x34], eax
test eax, eax
sete al
movzx esi, al
jmp 0x6e90f0a1
test edi, 1
jne 0x6e90f409
test edi, 2
jne 0x6e90f3f4
test edi, 4
je 0x6e90f229
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
rep movsb byte es:[edi], byte [esi]
jmp 0x6e90f2b7
mov dword [ebp - 0x2c], 0
xor esi, esi
jmp 0x6e90f0a1
test al, 1
jne 0x6e90f3e4
test edi, 2
jne 0x6e90f3d2
test edi, 4
je 0x6e90f28e
mov eax, dword [esi]
add edi, 4
add esi, 4
sub ecx, 4
mov dword [edi - 4], eax
jmp 0x6e90f28e
mov eax, dword [ebp - 0x2c]
lea edi, [eax + esi*2 - 2]
jmp 0x6e90f1c2
xor eax, eax
jmp 0x6e90f16d
mov eax, 4
jmp 0x6e90f24e
mov eax, 2
jmp 0x6e90f1ee
mov ecx, 2
jmp 0x6e90f21e
mov ecx, 2
jmp 0x6e90f27e
mov eax, 2
jmp 0x6e90f2ae
mov edi, dword [ebp - 0x2c]
jmp 0x6e90f1c2
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x6e90f366
movzx eax, byte [ebx]
inc edi
dec ecx
lea esi, [ebx + 1]
mov byte [edi - 1], al
jmp 0x6e90f35e
movzx eax, word [esi]
add edi, 2
add esi, 2
sub ecx, 2
mov word [edi - 2], ax
jmp 0x6e90f324
movzx eax, byte [ebx]
inc edi
inc esi
dec ecx
mov byte [edi - 1], al
jmp 0x6e90f318