Function at 0x6d1c6650
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x130
mov eax, dword [0x6d1d54cc]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x134]
push ebx
push esi
xor ebx, ebx
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
xor esi, esi
mov dword [esp + 0x14], ebx
call fcn.6d1b2d40
test eax, eax
je 0x6d1c66e1
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x6d1c66c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x130
ret
push ebp
mov ebp, dword [esp + 0x10]
push 0x20019
push str.JavaSoft
push ebp
lea ecx, [esp + 0x28]
call fcn.6d1b2d40
test eax, eax
je 0x6d1c6730
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x6d1c670f
push eax
call esi
cmp ebp, ebx
je 0x6d1c6716
push ebp
call esi
pop ebp
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x130
ret
push edi
mov edi, dword [esp + 0x20]
push 0x20019
push str.Java_Runtime_Environment
push edi
lea ecx, [esp + 0x38]
call fcn.6d1b2d40
test eax, eax
je 0x6d1c6773
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x6d1c675e
push eax
call esi
cmp edi, ebx
je 0x6d1c6765
push edi
call esi
cmp ebp, ebx
je 0x6d1c676c
push ebp
call esi
xor eax, eax
jmp 0x6d1c6877
mov edi, dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x80
lea ecx, [esp + 0x40]
push ecx
push ebx
push edi
mov byte [esp + 0xcc], bl
call ebp
test eax, eax
jne 0x6d1c6850
lea ebx, [ebx]
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0x40]
push eax
inc esi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jle 0x6d1c6819
mov ecx, str.10.0.0
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x6d1c67e1
cmp dl, bl
je 0x6d1c67dd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x6d1c67e1
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x6d1c67c1
xor eax, eax
jmp 0x6d1c67e6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x6d1c6819
lea eax, [esp + 0x3c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6d1c67f1
sub eax, edx
cmp eax, 3
jbe 0x6d1c6819
xor eax, eax
mov cl, byte [esp + eax + 0x3c]
mov byte [esp + eax + 0xbc], cl
inc eax
cmp cl, bl
jne 0x6d1c6801
mov dword [esp + 0x10], 1
push 0x80
lea ecx, [esp + 0x40]
push ecx
push esi
push edi
call ebp
test eax, eax
je 0x6d1c67a0
cmp dword [esp + 0x10], ebx
je 0x6d1c6850
mov eax, dword [esp + 0x38]
lea edx, [esp + 0xbc]
push edx
push 0x6d1ccc48
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x6d1c685d
push edi
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x6d1c6868
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x6d1c6873
push eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x13c]
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.6d1c932c
add esp, 0x130
ret