Function at 0x6d1c1ad0
Capabilities:
Delete registry value
Get common file path
Get file version info
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x27d4]
mov eax, 0x2854
call fcn.6d1c9470
mov eax, dword [0x6d1d54cc]
xor eax, ebp
mov dword [ebp + 0x27d0], eax
mov edx, dword [ebp + 0x27e4]
mov ecx, dword [ebp + 0x27e0]
push ebx
mov eax, dword [ebp + 0x27dc]
push esi
mov esi, dword [ebp + 0x27e8]
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edi, [ebp + 0x7d0]
push edi
push esi
push edx
push ecx
push eax
call fcn.6d1bdea0
add esp, 0x28
push 0x800
lea eax, [ebp + 0xfd0]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.kernel32.dll_lstrlenA]
push str.10.0.0
mov dword [ebp - 0x40], str.DEPLOY_VERSION
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jg 0x6d1c1b8e
lea eax, [esi + esi]
call fcn.6d1c9410
mov edi, esp
cmp edi, ebx
je 0x6d1c1b88
push esi
push edi
push 0xffffffffffffffff
push str.10.0.0
push ebx
xor ecx, ecx
push 3
mov word [edi], cx
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [sym.imp.kernel32.dll_lstrlenA]
jmp 0x6d1c1b90
mov edi, dword [sym.imp.kernel32.dll_lstrlenA]
xor eax, eax
push ebx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.6d1b2ff0
lea edx, [ebp - 0x40]
push edx
push 1
test eax, eax
je 0x6d1c1bb3
push 0x68
jmp 0x6d1c1bb5
push 0x66
push 0x6d1d5650
call fcn.6d1b8520
mov esi, dword [sym.imp.ole32.dll_CoUninitialize]
xor ecx, ecx
test eax, eax
sets cl
mov dword [ebp - 0x54], ecx
call esi
cmp dword [ebp - 0x54], ebx
jne 0x6d1c1d60
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
push 1
push 0x92
push 0x6d1d5650
call fcn.6d1b8520
call esi
call fcn.6d1bf810
test eax, eax
je 0x6d1c1e50
push 0x800
lea edx, [ebp + 0x1fd0]
push edx
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
push str.msjava.dll
lea eax, [ebp + 0x1fd0]
push eax
call dword [sym.imp.kernel32.dll_lstrcatA]
lea ecx, [ebp - 0x30]
push ecx
push 0x800
push ebx
lea edx, [ebp + 0x1fd0]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x6d1c1d67
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x54]
push ecx
push 0x6d1cbb50
lea edx, [ebp - 0x30]
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x6d1c1e50
mov ecx, dword [ebp - 0x54]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
movzx edx, ax
push edx
shr eax, 0x10
push eax
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
lea ecx, [ebp + 0x17d0]
push str._d__d__d__d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push str.Microsoft_VM
mov dword [ebp - 0x50], str.DEFAULTVM
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d1c1cad
xor eax, eax
jmp 0x6d1c1cc5
lea eax, [esi + esi]
call fcn.6d1c9410
mov eax, esp
push 3
push esi
push str.Microsoft_VM
push eax
call fcn.6d1b1d20
lea edx, [ebp + 0x1fd0]
push edx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], str.REG_MODULE
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d1c1ce7
xor eax, eax
jmp 0x6d1c1d01
lea eax, [esi + esi]
call fcn.6d1c9410
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x1fd0]
push ecx
push eax
call fcn.6d1b1d20
lea edx, [ebp + 0x17d0]
push edx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], str.MSVM_VERSION
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d1c1d23
xor eax, eax
jmp 0x6d1c1d3d
lea eax, [esi + esi]
call fcn.6d1c9410
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x17d0]
push ecx
push eax
call fcn.6d1b1d20
lea edx, [ebp - 0x50]
push edx
push 1
push 0x7e
push 0x6d1d5650
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call fcn.6d1b8520
test eax, eax
jns 0x6d1c1e50
xor eax, eax
jmp 0x6d1c1f5c
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
call fcn.6d1b2d40
test eax, eax
mov eax, dword [ebp - 0x78]
jne 0x6d1c1e89
push 0x20019
push str.Microsoft
push eax
lea ecx, [ebp - 0x3c]
call fcn.6d1b2d40
test eax, eax
je 0x6d1c1deb
lea ecx, [ebp - 0x6c]
call fcn.6d1b31a0
lea ecx, [ebp - 0x60]
call fcn.6d1b31a0
lea ecx, [ebp - 0x3c]
call fcn.6d1b31a0
lea ecx, [ebp - 0x78]
call fcn.6d1b31a0
xor eax, eax
jmp 0x6d1c1f5c
mov ecx, dword [ebp - 0x3c]
push 0x20019
push str.Active_Setup
push ecx
lea ecx, [ebp - 0x60]
call fcn.6d1b2d40
lea ecx, [ebp - 0x6c]
test eax, eax
jne 0x6d1c1dc7
mov edx, dword [ebp - 0x60]
push 0x20019
push str.Installed_Components
push edx
call fcn.6d1b2d40
lea ecx, [ebp - 0x6c]
test eax, eax
jne 0x6d1c1dc7
push str.08B0E5C0_4FCB_11CF_AAA5_00401C608500
call fcn.6d1b4e00
lea ecx, [ebp - 0x6c]
test eax, eax
jne 0x6d1c1dc7
call fcn.6d1b31a0
lea ecx, [ebp - 0x60]
call fcn.6d1b31a0
lea ecx, [ebp - 0x3c]
call fcn.6d1b31a0
lea ecx, [ebp - 0x78]
call fcn.6d1b31a0
push 0x20019
push str.SOFTWARE
push SysReAllocString
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
call fcn.6d1b2d40
test eax, eax
je 0x6d1c1e9b
mov eax, dword [ebp - 0x60]
cmp eax, ebx
je 0x6d1c1e94
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x6d1c1f5c
mov esi, dword [ebp - 0x60]
push 0x20019
push str.Microsoft
push esi
lea ecx, [ebp - 0x3c]
call fcn.6d1b2d40
test eax, eax
mov eax, dword [ebp - 0x3c]
je 0x6d1c1ed3
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x6d1c1ec5
push eax
call edi
cmp esi, ebx
je 0x6d1c1ecc
push esi
call edi
xor eax, eax
jmp 0x6d1c1f5c
push 0x2001f
push str.Java_VM
push eax
lea ecx, [ebp - 0x6c]
call fcn.6d1b2d40
mov esi, dword [ebp - 0x6c]
test eax, eax
jne 0x6d1c1f36
lea ecx, [ebp - 0x7c]
push ecx
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x6d1cd110
push esi
mov dword [ebp - 0x7c], 4
mov dword [ebp - 0x54], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x54], ebx
je 0x6d1c1f36
push 4
lea ecx, [ebp - 0x54]
push ecx
push 3
push ebx
push str.EnableJavaConsole
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x6d1cd110
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x6d1c1f43
push esi
call edi
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x6d1c1f4d
push eax
call edi
mov eax, dword [ebp - 0x60]
cmp eax, ebx
je 0x6d1c1f57
push eax
call edi
mov eax, 1
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x27d0]
xor ecx, ebp
call fcn.6d1c932c
lea esp, [ebp + 0x27d4]
pop ebp
ret