Function at 0x6d2c35d0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x43c
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
xor ebx, ebx
push esi
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
xor esi, esi
mov dword [esp + 0x18], ebx
call fcn.6d2c2d40
test eax, eax
je 0x6d2c3662
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x6d2c3649
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x43c
ret
push ebp
mov ebp, dword [esp + 0x14]
push 0x20019
push str.JavaSoft
push ebp
lea ecx, [esp + 0x2c]
call fcn.6d2c2d40
test eax, eax
je 0x6d2c36b1
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x6d2c3690
push eax
call esi
cmp ebp, ebx
je 0x6d2c3697
push ebp
call esi
pop ebp
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x43c
ret
push edi
mov edi, dword [esp + 0x24]
push 0x20019
push str.Java_Plug_in
push edi
lea ecx, [esp + 0x3c]
call fcn.6d2c2d40
test eax, eax
je 0x6d2c36f4
mov eax, dword [esp + 0x30]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x6d2c36df
push eax
call esi
cmp edi, ebx
je 0x6d2c36e6
push edi
call esi
cmp ebp, ebx
je 0x6d2c36ed
push ebp
call esi
xor eax, eax
jmp 0x6d2c3805
push 0x400
lea eax, [esp + 0x4c]
push ebx
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [esp + 0x3c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
add esp, 0xc
push 0x400
lea ecx, [esp + 0x4c]
push ecx
push ebx
push edi
call ebp
test eax, eax
jne 0x6d2c37de
jmp 0x6d2c3730
mov ecx, dword [esp + 0x450]
inc esi
lea eax, [esp + 0x48]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x6d2c3760
cmp dl, bl
je 0x6d2c375c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x6d2c3760
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x6d2c3740
xor eax, eax
jmp 0x6d2c3765
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x6d2c3790
push 0x400
lea edx, [esp + 0x4c]
push ebx
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x400
lea eax, [esp + 0x4c]
push eax
push esi
push edi
call ebp
test eax, eax
je 0x6d2c3730
jmp 0x6d2c37de
push 0x20019
lea ecx, [esp + 0x4c]
push ecx
push edi
lea ecx, [esp + 0x48]
call fcn.6d2c2d40
test eax, eax
jne 0x6d2c37cf
push str.UseNewJavaPlugin
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], ebx
call fcn.6d2c2dc0
test eax, eax
jne 0x6d2c37cf
cmp dword [esp + 0x10], 1
sete al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x6d2c37de
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x6d2c37eb
push edi
call esi
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x6d2c37f6
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x6d2c3801
push eax
call esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x448]
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.6d2d932c
add esp, 0x43c
ret