Function at 0x6d2d10c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3958]
mov eax, 0x39d8
call fcn.6d2d9470
mov eax, dword [0x6d2e54cc]
xor eax, ebp
mov dword [ebp + 0x3954], eax
mov edx, dword [ebp + 0x396c]
mov eax, dword [ebp + 0x3960]
mov ecx, dword [ebp + 0x3968]
push ebx
push esi
mov esi, dword [ebp + 0x3974]
push edi
mov edi, dword [ebp + 0x3970]
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x74], esi
lea esi, [ebp + 0x1154]
push esi
push edi
push edx
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x3964]
push ecx
push eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x48], edx
call fcn.6d2cdea0
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [ebp + 0x3154]
push edi
push ecx
call ebx
mov esi, dword [sym.imp.MSVCR100.dll__stricmp]
push 0x6d2db9cb
push edi
call esi
add esp, 0x38
test eax, eax
je 0x6d2d1172
push 0x6d2dc8e8
push edi
call esi
add esp, 8
test eax, eax
je 0x6d2d1172
push 0x6d2dc8ec
push edi
call esi
add esp, 8
test eax, eax
jne 0x6d2d1183
lea edx, [ebp + 0x3154]
push 0x6d2dc8ec
push edx
call ebx
add esp, 8
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0
call ebx
push 0x79
call fcn.6d2cde30
mov esi, dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
add esp, 4
test eax, eax
je 0x6d2d11b0
movzx ecx, word [eax]
push ecx
add eax, 2
push eax
call esi
mov dword [ebp - 0x40], eax
jmp 0x6d2d11b7
mov dword [ebp - 0x40], 0
push 0
call ebx
push 0x7a
call fcn.6d2cde30
add esp, 4
test eax, eax
je 0x6d2d11da
movzx edx, word [eax]
push edx
add eax, 2
push eax
call esi
mov dword [ebp - 0x38], eax
xor esi, esi
jmp 0x6d2d11df
xor esi, esi
mov dword [ebp - 0x38], esi
push 0x20019
push str.SOFTWARE
push SysReAllocString
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x44], esi
call fcn.6d2c2d40
test eax, eax
je 0x6d2d1237
mov eax, dword [ebp - 0x58]
cmp eax, esi
je 0x6d2d1226
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x38]
push eax
call ebx
mov ecx, dword [ebp - 0x40]
push ecx
call ebx
jmp 0x6d2d1aa1
mov edx, dword [ebp - 0x58]
push 0x20019
push str.Microsoft
push edx
lea ecx, [ebp - 0x64]
call fcn.6d2c2d40
test eax, eax
je 0x6d2d127c
mov eax, dword [ebp - 0x64]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x6d2d1261
push eax
call esi
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x6d2d126b
push eax
call esi
mov eax, dword [ebp - 0x38]
push eax
call ebx
mov ecx, dword [ebp - 0x40]
push ecx
call ebx
jmp 0x6d2d1aa1
mov edx, dword [ebp - 0x64]
push 0x2001f
push str.Java_VM
push edx
lea ecx, [ebp - 0x70]
call fcn.6d2c2d40
mov ebx, dword [ebp - 0x70]
test eax, eax
jne 0x6d2d12d6
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0x80]
push edx
push 0
push str.EnableJavaConsole
push ebx
mov dword [ebp - 0x7c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x44], 0
je 0x6d2d12d6
push 4
lea eax, [ebp - 0x44]
push eax
push 3
push 0
push 0x6d2dd110
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x4c]
mov esi, dword [sym.imp.kernel32.dll_lstrcmpA]
push 0x6d2dd10c
push ecx
call esi
test eax, eax
jg 0x6d2d13db
mov edx, dword [ebp - 0x3c]
push 0x6d2dd108
push edx
call esi
test eax, eax
jns 0x6d2d13db
mov eax, dword [ebp - 0x4c]
push 0x6d2dd10c
push eax
call esi
test eax, eax
jg 0x6d2d13cd
mov ecx, dword [ebp - 0x3c]
push 0x6d2dd104
push ecx
call esi
test eax, eax
jg 0x6d2d13cd
mov edx, dword [ebp - 0x3c]
push 0x6d2dd104
push edx
call esi
test eax, eax
jne 0x6d2d134a
mov eax, dword [ebp - 0x48]
push 0x6d2dd10c
push eax
call esi
test eax, eax
jg 0x6d2d13cd
mov ecx, dword [ebp - 0x3c]
push str.3471
push ecx
call esi
test eax, eax
jg 0x6d2d13bf
mov edx, dword [ebp - 0x3c]
push str.3471
push edx
call esi
test eax, eax
jne 0x6d2d1392
mov eax, dword [ebp - 0x48]
push 0x6d2dd10c
push eax
call esi
test eax, eax
jg 0x6d2d13bf
mov ecx, dword [ebp - 0x48]
push 0x6d2dd10c
push ecx
call esi
test eax, eax
jne 0x6d2d1392
push 0x6d2dd0fc
push edi
call esi
test eax, eax
jns 0x6d2d13bf
lea ecx, [ebp - 0x70]
call fcn.6d2c31a0
lea ecx, [ebp - 0x64]
call fcn.6d2c31a0
lea ecx, [ebp - 0x58]
call fcn.6d2c31a0
mov edx, dword [ebp - 0x38]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edx
call esi
mov eax, dword [ebp - 0x40]
push eax
jmp 0x6d2d1a9f
push str.ActPanel.dll
lea ecx, [ebp + 0x2154]
push ecx
jmp 0x6d2d13e7
push str.regutils.dll
lea edx, [ebp + 0x2154]
push edx
jmp 0x6d2d13e7
push 0x6d2dc264
lea eax, [ebp + 0x2154]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
mov esi, dword [ebp - 0x78]
mov edi, dword [sym.imp.kernel32.dll_lstrlenA]
push esi
call edi
cmp byte [esi + eax - 1], 0x5c
jne 0x6d2d1416
lea ecx, [ebp + 0x2154]
push ecx
push esi
push str._sbin_s
lea edx, [ebp + 0x2954]
push edx
jmp 0x6d2d142a
lea eax, [ebp + 0x2154]
push eax
push esi
push str._s_bin_s
lea ecx, [ebp + 0x2954]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp + 0x2954]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x6d2d1471
push eax
call dword [sym.imp.kernel32.dll_FindClose]
call fcn.6d2c2ed0
test eax, eax
je 0x6d2d14b9
lea eax, [ebp + 0x1154]
push eax
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d1485
xor eax, eax
jmp 0x6d2d149f
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x6d2d1a7b
push ebx
jmp 0x6d2d1a79
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x1154]
push ecx
push eax
call fcn.6d2c1d20
mov edx, dword [ebp - 0x38]
push eax
push edx
lea eax, [ebp + 0x154]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x6d2d1544
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x6d2d14ec
push eax
call dword [sym.imp.kernel32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x6d2d14d3
xor eax, eax
jmp 0x6d2d14ec
lea esi, [eax + eax]
mov eax, esi
call fcn.6d2d9410
mov ecx, dword [ebp - 0x38]
mov eax, esp
push 3
push esi
push ecx
push eax
call fcn.6d2c2c60
lea edx, [ebp + 0x1154]
push edx
push eax
lea eax, [ebp + 0x1954]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp + 0x1954]
push ecx
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d151c
xor eax, eax
jmp 0x6d2d1536
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
lea edx, [ebp + 0x1954]
push edx
push eax
call fcn.6d2c1d20
push eax
lea eax, [ebp + 0x154]
push eax
call dword [sym.imp.kernel32.dll_lstrcpyW]
call fcn.6d2c2ff0
mov ebx, dword [ebp - 0x4c]
test eax, eax
je 0x6d2d16cd
mov dword [ebp + 0x124], str.MAJOR_VERSION
test ebx, ebx
jne 0x6d2d1566
xor eax, eax
jmp 0x6d2d158c
push ebx
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d1578
xor eax, eax
jmp 0x6d2d158c
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.6d2c1d20
mov ebx, dword [ebp - 0x3c]
mov dword [ebp + 0x128], eax
mov dword [ebp + 0x12c], str.MINOR_VERSION
test ebx, ebx
jne 0x6d2d15a7
xor eax, eax
jmp 0x6d2d15cd
push ebx
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d15b9
xor eax, eax
jmp 0x6d2d15cd
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.6d2c1d20
mov ebx, dword [ebp - 0x48]
mov dword [ebp + 0x130], eax
mov dword [ebp + 0x134], str.MICRO_VERSION
test ebx, ebx
jne 0x6d2d15e8
xor eax, eax
jmp 0x6d2d160e
push ebx
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d15fa
xor eax, eax
jmp 0x6d2d160e
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.6d2c1d20
lea ecx, [ebp + 0x3154]
push ecx
mov dword [ebp + 0x138], eax
mov dword [ebp + 0x13c], str.UPDATE_VERSION
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d1636
xor eax, eax
jmp 0x6d2d1650
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
lea edx, [ebp + 0x3154]
push edx
push eax
call fcn.6d2c1d20
mov ebx, dword [ebp - 0x74]
mov dword [ebp + 0x140], eax
mov dword [ebp + 0x144], str.DEPLOY_VERSION
test ebx, ebx
jne 0x6d2d166b
xor eax, eax
jmp 0x6d2d1691
push ebx
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d167d
xor eax, eax
jmp 0x6d2d1691
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.6d2c1d20
xor esi, esi
push esi
mov dword [ebp + 0x148], eax
mov dword [ebp + 0x14c], esi
mov dword [ebp + 0x150], esi
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp + 0x124]
push eax
push 1
push 0x67
push 0x6d2e5650
call fcn.6d2c8520
xor ebx, ebx
test eax, eax
setns bl
jmp 0x6d2d18ae
mov ecx, dword [ebp - 0x40]
lea edx, [ebp + 0x154]
mov dword [ebp + 0x10c], str.IECPL_OPTIONS_CAPTION
mov dword [ebp + 0x110], ecx
mov dword [ebp + 0x114], str.IECPL_OPTIONS_TEXT
mov dword [ebp + 0x118], edx
mov dword [ebp + 0x11c], str.MAJOR_VERSION
test ebx, ebx
jne 0x6d2d1708
xor eax, eax
jmp 0x6d2d172e
push ebx
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d171a
xor eax, eax
jmp 0x6d2d172e
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.6d2c1d20
mov ebx, dword [ebp - 0x3c]
mov dword [ebp + 0x120], eax
mov dword [ebp + 0x124], str.MINOR_VERSION
test ebx, ebx
jne 0x6d2d1749
xor eax, eax
jmp 0x6d2d176f
push ebx
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d175b
xor eax, eax
jmp 0x6d2d176f
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.6d2c1d20
mov ebx, dword [ebp - 0x48]
mov dword [ebp + 0x128], eax
mov dword [ebp + 0x12c], str.MICRO_VERSION
test ebx, ebx
jne 0x6d2d178a
xor eax, eax
jmp 0x6d2d17b0
push ebx
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d179c
xor eax, eax
jmp 0x6d2d17b0
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.6d2c1d20
mov dword [ebp + 0x130], eax
lea eax, [ebp + 0x3154]
push eax
mov dword [ebp + 0x134], str.UPDATE_VERSION
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d17d8
xor eax, eax
jmp 0x6d2d17f2
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x3154]
push ecx
push eax
call fcn.6d2c1d20
mov ebx, dword [ebp - 0x74]
mov dword [ebp + 0x138], eax
mov dword [ebp + 0x13c], str.DEPLOY_VERSION
test ebx, ebx
jne 0x6d2d180d
xor eax, eax
jmp 0x6d2d1833
push ebx
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d181f
xor eax, eax
jmp 0x6d2d1833
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
push ebx
push eax
call fcn.6d2c1d20
lea edx, [ebp + 0x2954]
push edx
mov dword [ebp + 0x140], eax
mov dword [ebp + 0x144], str.REG_MODULE
call edi
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d185b
xor eax, eax
jmp 0x6d2d1875
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
lea ecx, [ebp + 0x2954]
push ecx
push eax
call fcn.6d2c1d20
mov dword [ebp + 0x148], eax
xor eax, eax
push eax
mov dword [ebp + 0x14c], eax
mov dword [ebp + 0x150], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [ebp + 0x10c]
push edx
push 1
push 0x65
push 0x6d2e5650
call fcn.6d2c8520
xor ebx, ebx
test eax, eax
setns bl
xor esi, esi
mov eax, dword [ebp - 0x78]
push eax
call fcn.6d2ce5f0
add esp, 4
test eax, eax
je 0x6d2d191a
cmp dword [ebp + 0x3978], esi
jne 0x6d2d191a
call sym.deploy.dll_UnregJavaConsoleIExplorer
cmp ebx, esi
je 0x6d2d18ef
cmp dword [ebp - 0x44], esi
je 0x6d2d18ef
mov eax, dword [ebp - 0x70]
push 4
lea edx, [ebp - 0x44]
push edx
push 3
push esi
push str.EnableJavaConsole
push eax
mov dword [ebp - 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.6d2cf500
push str.Java__Sun_
mov edi, eax
mov dword [ebp + 0x134], str.DEFAULTVM
call dword [sym.imp.kernel32.dll_lstrlenA]
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d1948
xor eax, eax
jmp 0x6d2d1960
cmp ebx, esi
je 0x6d2d1944
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp + 0x3154]
push ecx
mov ecx, dword [ebp - 0x4c]
push edx
push eax
push ecx
call sym.deploy.dll_RegJavaConsoleIExplorer
add esp, 0x10
test eax, eax
je 0x6d2d1944
mov ebx, 1
jmp 0x6d2d18cf
xor ebx, ebx
jmp 0x6d2d18ef
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
push str.Java__Sun_
push eax
call fcn.6d2c1d20
lea ecx, [ebp + 0x2954]
push ecx
mov dword [ebp + 0x138], eax
mov dword [ebp + 0x13c], str.REG_MODULE
call dword [sym.imp.kernel32.dll_lstrlenA]
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d198c
xor eax, eax
jmp 0x6d2d19a6
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
lea edx, [ebp + 0x2954]
push edx
push eax
call fcn.6d2c1d20
push str.5_0_5000_0
mov dword [ebp + 0x140], eax
mov dword [ebp + 0x144], str.MSVM_VERSION
call dword [sym.imp.kernel32.dll_lstrlenA]
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x6d2d19d0
xor eax, eax
jmp 0x6d2d19e8
lea eax, [esi + esi]
call fcn.6d2d9410
mov eax, esp
push 3
push esi
push str.5_0_5000_0
push eax
call fcn.6d2c1d20
mov dword [ebp + 0x148], eax
xor eax, eax
mov dword [ebp + 0x14c], eax
mov dword [ebp + 0x150], eax
cmp edi, eax
je 0x6d2d1a0e
call fcn.6d2cf810
test eax, eax
jne 0x6d2d1a0e
lea esi, [eax + 1]
jmp 0x6d2d1a2c
lea eax, [ebp + 0x134]
push eax
push 1
push 0x7e
push 0x6d2e5650
call fcn.6d2c8520
xor ecx, ecx
test eax, eax
setns cl
mov esi, ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
je 0x6d2d1a6b
test esi, esi
je 0x6d2d1a6b
lea ecx, [ebp - 0x70]
call fcn.6d2c31a0
lea ecx, [ebp - 0x64]
call fcn.6d2c31a0
lea ecx, [ebp - 0x58]
call fcn.6d2c31a0
mov edx, dword [ebp - 0x38]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push edx
call esi
mov eax, dword [ebp - 0x40]
push eax
call esi
mov eax, 1
jmp 0x6d2d1aa3
mov eax, dword [ebp - 0x70]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x6d2d1a7b
push eax
call esi
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x6d2d1a85
push eax
call esi
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x6d2d1a8f
push eax
call esi
mov ecx, dword [ebp - 0x38]
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ecx
call esi
mov edx, dword [ebp - 0x40]
push edx
call esi
xor eax, eax
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3954]
xor ecx, ebp
call fcn.6d2d932c
lea esp, [ebp + 0x3958]
pop ebp
ret