Function at 0x6d5941f0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x83c
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x838], eax
push esi
push edi
xor edi, edi
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
xor esi, esi
mov dword [esp + 0x18], edi
call fcn.6d593190
test eax, eax
je 0x6d594282
mov eax, dword [esp + 0x10]
cmp eax, edi
je 0x6d594269
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x83c
ret
push ebp
mov ebp, dword [esp + 0x14]
push 0x20019
push str.JavaSoft
push ebp
lea ecx, [esp + 0x2c]
call fcn.6d593190
test eax, eax
je 0x6d5942d1
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x6d5942b0
push eax
call esi
cmp ebp, edi
je 0x6d5942b7
push ebp
call esi
pop ebp
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x83c
ret
push ebx
mov ebx, dword [esp + 0x24]
push 0x20019
push str.Java_Plug_in
push ebx
lea ecx, [esp + 0x3c]
call fcn.6d593190
test eax, eax
je 0x6d594314
mov eax, dword [esp + 0x30]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x6d5942ff
push eax
call esi
cmp ebx, edi
je 0x6d594306
push ebx
call esi
cmp ebp, edi
je 0x6d59430d
push ebp
call esi
xor eax, eax
jmp 0x6d59442b
push 0x400
lea eax, [esp + 0x4c]
push edi
push eax
call sub.MSVCR100.dll_memset
mov ebx, dword [esp + 0x3c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
add esp, 0xc
push 0x400
lea ecx, [esp + 0x4c]
push ecx
push edi
push ebx
call ebp
test eax, eax
jne 0x6d594404
jmp 0x6d594350
mov ecx, dword [esp + 0x850]
inc esi
lea eax, [esp + 0x48]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d594386
cmp dx, di
je 0x6d594382
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d594386
add eax, 4
add ecx, 4
cmp dx, di
jne 0x6d594360
xor eax, eax
jmp 0x6d59438b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x6d5943b6
push 0x400
lea edx, [esp + 0x4c]
push edi
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x400
lea eax, [esp + 0x4c]
push eax
push esi
push ebx
call ebp
test eax, eax
je 0x6d594350
jmp 0x6d594404
push 0x20019
lea ecx, [esp + 0x4c]
push ecx
push ebx
lea ecx, [esp + 0x48]
call fcn.6d593190
test eax, eax
jne 0x6d5943f5
lea edx, [esp + 0x10]
push edx
push str.UseNewJavaPlugin
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], edi
call fcn.6d593210
test eax, eax
jne 0x6d5943f5
cmp dword [esp + 0x10], 1
sete al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
cmp eax, edi
je 0x6d594404
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x6d594411
push ebx
call esi
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x6d59441c
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x6d594427
push eax
call esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x848]
pop ebx
pop ebp
pop edi
pop esi
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x83c
ret