Function at 0x6dae68f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x3cc
mov eax, dword [0x6daed004]
xor eax, esp
mov dword [esp + 0x3c8], eax
mov eax, dword [esp + 0x3d8]
mov ecx, dword [esp + 0x3e4]
mov dword [esp + 0x14], eax
mov dword [esp + 8], ecx
push ebx
mov ebx, dword [esp + 0x3e0]
push ebp
mov ebp, dword [esp + 0x3e8]
push esi
mov esi, dword [esp + 0x3dc]
test eax, eax
je 0x6dae6bed
test ebx, ebx
je 0x6dae6bed
test ebp, ebp
je 0x6dae6bed
mov eax, dword [esi]
push edi
push str.java_util_HashMap
push esi
mov eax, dword [eax + 0x18]
call eax
mov edi, eax
test edi, edi
je 0x6dae6bec
mov ecx, dword [esi]
push str._Ljava_lang_Object_Ljava_lang_Object__Ljava_lang_Object_
push 0x6dae9b84
push edi
mov ecx, dword [ecx + 0x84]
push esi
call ecx
test eax, eax
je 0x6dae6bec
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x18]
push str._Ljava_lang_Object__Z
mov dword [esp + 0x64], eax
mov eax, dword [esi]
push str.containsKey
push edi
mov dword [esp + 0x40], esi
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebp
mov eax, dword [eax + 0x84]
push esi
call eax
mov dword [esp + 0x4c], eax
test eax, eax
je 0x6dae6bec
mov eax, dword [esi]
push str.java_util_ArrayList
push esi
mov eax, dword [eax + 0x18]
call eax
mov ecx, eax
mov dword [esp + 0x50], ecx
test ecx, ecx
je 0x6dae6bec
mov eax, dword [esi]
push str._I_V
push str._init_
push ecx
mov eax, dword [eax + 0x84]
push esi
call eax
mov dword [esp + 0x54], eax
test eax, eax
je 0x6dae6bec
mov eax, dword [esi]
push str._Ljava_lang_Object__Z
push 0x6dae9bc8
push dword [esp + 0x58]
mov eax, dword [eax + 0x84]
push esi
call eax
mov dword [esp + 0x58], eax
test eax, eax
je 0x6dae6bec
mov eax, dword [esi]
push str.java_lang_String
push esi
mov eax, dword [eax + 0x18]
call eax
mov ecx, eax
test ecx, ecx
je 0x6dae6bec
mov eax, dword [esi]
push str._Ljava_util_Locale__Ljava_lang_String_
push str.toLowerCase
push ecx
mov eax, dword [eax + 0x84]
push esi
call eax
mov dword [esp + 0x5c], eax
test eax, eax
je 0x6dae6bec
push 0
call dword [sym.imp.user32.dll_GetDC]
mov esi, eax
mov dword [esp + 0x64], esi
test esi, esi
je 0x6dae6bec
push 0x5c
lea eax, [esp + 0x6c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov byte [esp + 0x7f], 1
xor eax, eax
mov word [esp + 0x84], ax
push eax
lea eax, [esp + 0x38]
push eax
push 0x6dae6090
lea eax, [esp + 0x74]
push eax
push esi
call dword [sym.imp.gdi32.dll_EnumFontFamiliesExW]
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push 0x6dae9a40
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6dae6be0
push eax
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x3c]
call dword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x6dae6bd6
cmp dword [esp + 0x1c], 0x105
jae 0x6dae6bd6
cmp dword [esp + 0x20], 0x105
jae 0x6dae6bd6
xor esi, esi
cmp dword [esp + 0x14], esi
jbe 0x6dae6bd6
mov ebx, dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov ebp, dword [esp + 0x24]
nop dword [eax]
lea eax, [esp + 0x28]
mov dword [esp + 0x2c], 0x105
push eax
lea eax, [esp + 0xc8]
mov dword [esp + 0x2c], 0x105
push eax
lea eax, [esp + 0x38]
push eax
push 0
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x1e0]
push eax
push esi
push dword [esp + 0x2c]
call dword [sym.imp.advapi32.dll_RegEnumValueW]
test eax, eax
jne 0x6dae6bd6
cmp dword [esp + 0x30], 1
jne 0x6dae6bcb
lea eax, [esp + 0x1cc]
push eax
call fcn.6dae6d50
add esp, 4
test eax, eax
jne 0x6dae6bad
lea eax, [esp + 0xc4]
push 0x2e
push eax
call ebx
add esp, 8
test eax, eax
je 0x6dae6bcb
push str..ttf
push eax
call edi
add esp, 8
test eax, eax
jne 0x6dae6bcb
lea eax, [esp + 0xc4]
push eax
lea eax, [esp + 0x1d0]
push eax
lea eax, [esp + 0x3c]
push ebp
push eax
call fcn.6dae6e70
add esp, 0x10
inc esi
cmp esi, dword [esp + 0x14]
jb 0x6dae6b30
push dword [esp + 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
push dword [esp + 0x64]
push 0
call dword [sym.imp.user32.dll_ReleaseDC]
pop edi
mov ecx, dword [esp + 0x3d4]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.6dae709a
add esp, 0x3cc
ret 0x18