Function at 0x6d2d6650
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x130
mov eax, dword [0x6d2e54cc]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x134]
push ebx
push esi
xor ebx, ebx
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
xor esi, esi
mov dword [esp + 0x14], ebx
call fcn.6d2c2d40
test eax, eax
je 0x6d2d66e1
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x6d2d66c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x130
ret
push ebp
mov ebp, dword [esp + 0x10]
push 0x20019
push str.JavaSoft
push ebp
lea ecx, [esp + 0x28]
call fcn.6d2c2d40
test eax, eax
je 0x6d2d6730
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x6d2d670f
push eax
call esi
cmp ebp, ebx
je 0x6d2d6716
push ebp
call esi
pop ebp
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.6d2d932c
add esp, 0x130
ret
push edi
mov edi, dword [esp + 0x20]
push 0x20019
push str.Java_Runtime_Environment
push edi
lea ecx, [esp + 0x38]
call fcn.6d2c2d40
test eax, eax
je 0x6d2d6773
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x6d2d675e
push eax
call esi
cmp edi, ebx
je 0x6d2d6765
push edi
call esi
cmp ebp, ebx
je 0x6d2d676c
push ebp
call esi
xor eax, eax
jmp 0x6d2d6877
mov edi, dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x80
lea ecx, [esp + 0x40]
push ecx
push ebx
push edi
mov byte [esp + 0xcc], bl
call ebp
test eax, eax
jne 0x6d2d6850
lea ebx, [ebx]
lea edx, [esp + 0xbc]
push edx
lea eax, [esp + 0x40]
push eax
inc esi
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
jle 0x6d2d6819
mov ecx, str.10.0.0
lea eax, [esp + 0x3c]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x6d2d67e1
cmp dl, bl
je 0x6d2d67dd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x6d2d67e1
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x6d2d67c1
xor eax, eax
jmp 0x6d2d67e6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x6d2d6819
lea eax, [esp + 0x3c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x6d2d67f1
sub eax, edx
cmp eax, 3
jbe 0x6d2d6819
xor eax, eax
mov cl, byte [esp + eax + 0x3c]
mov byte [esp + eax + 0xbc], cl
inc eax
cmp cl, bl
jne 0x6d2d6801
mov dword [esp + 0x10], 1
push 0x80
lea ecx, [esp + 0x40]
push ecx
push esi
push edi
call ebp
test eax, eax
je 0x6d2d67a0
cmp dword [esp + 0x10], ebx
je 0x6d2d6850
mov eax, dword [esp + 0x38]
lea edx, [esp + 0xbc]
push edx
push 0x6d2dcc48
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x6d2d685d
push edi
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebx
je 0x6d2d6868
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x6d2d6873
push eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x13c]
pop edi
pop ebp
pop esi
pop ebx
xor ecx, esp
call fcn.6d2d932c
add esp, 0x130
ret