Function at 0x6d1b35d0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x43c
mov eax, dword [0x6d1d54cc]
xor eax, esp
mov dword [esp + 0x438], eax
push ebx
xor ebx, ebx
push esi
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
xor esi, esi
mov dword [esp + 0x18], ebx
call fcn.6d1b2d40
test eax, eax
je 0x6d1b3662
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x6d1b3649
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x43c
ret
push ebp
mov ebp, dword [esp + 0x14]
push 0x20019
push str.JavaSoft
push ebp
lea ecx, [esp + 0x2c]
call fcn.6d1b2d40
test eax, eax
je 0x6d1b36b1
mov eax, dword [esp + 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x6d1b3690
push eax
call esi
cmp ebp, ebx
je 0x6d1b3697
push ebp
call esi
pop ebp
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x438]
xor ecx, esp
call fcn.6d1c932c
add esp, 0x43c
ret
push edi
mov edi, dword [esp + 0x24]
push 0x20019
push str.Java_Plug_in
push edi
lea ecx, [esp + 0x3c]
call fcn.6d1b2d40
test eax, eax
je 0x6d1b36f4
mov eax, dword [esp + 0x30]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x6d1b36df
push eax
call esi
cmp edi, ebx
je 0x6d1b36e6
push edi
call esi
cmp ebp, ebx
je 0x6d1b36ed
push ebp
call esi
xor eax, eax
jmp 0x6d1b3805
push 0x400
lea eax, [esp + 0x4c]
push ebx
push eax
call sub.MSVCR100.dll_memset
mov edi, dword [esp + 0x3c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
add esp, 0xc
push 0x400
lea ecx, [esp + 0x4c]
push ecx
push ebx
push edi
call ebp
test eax, eax
jne 0x6d1b37de
jmp 0x6d1b3730
mov ecx, dword [esp + 0x450]
inc esi
lea eax, [esp + 0x48]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x6d1b3760
cmp dl, bl
je 0x6d1b375c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x6d1b3760
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x6d1b3740
xor eax, eax
jmp 0x6d1b3765
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x6d1b3790
push 0x400
lea edx, [esp + 0x4c]
push ebx
push edx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x400
lea eax, [esp + 0x4c]
push eax
push esi
push edi
call ebp
test eax, eax
je 0x6d1b3730
jmp 0x6d1b37de
push 0x20019
lea ecx, [esp + 0x4c]
push ecx
push edi
lea ecx, [esp + 0x48]
call fcn.6d1b2d40
test eax, eax
jne 0x6d1b37cf
push str.UseNewJavaPlugin
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], ebx
call fcn.6d1b2dc0
test eax, eax
jne 0x6d1b37cf
cmp dword [esp + 0x10], 1
sete al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
cmp eax, ebx
je 0x6d1b37de
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x6d1b37eb
push edi
call esi
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x6d1b37f6
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x6d1b3801
push eax
call esi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x448]
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.6d1c932c
add esp, 0x43c
ret