Function at 0x6d69327b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x27b0]
mov eax, 0x2830
call fcn.6d6a89f0
mov eax, dword [0x6d6e05c8]
xor eax, ebp
mov dword [ebp + 0x27ac], eax
mov eax, dword [ebp + 0x27b8]
mov ecx, dword [eax]
push ebx
xor ebx, ebx
mov byte [ecx], bl
mov ecx, dword [eax + 4]
mov byte [ecx], bl
push 0x6d6d3210
mov dword [ebp - 0x68], eax
mov word [eax + 8], bx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x6d693523
push edi
mov edi, 0x800
push edi
lea ecx, [ebp + 0x17ac]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x17ac]
push str.jvm.dll
push eax
call fcn.6d6a8cf0
pop ecx
pop ecx
test eax, eax
je 0x6d693522
push edi
lea eax, [ebp + 0xfac]
push eax
lea eax, [ebp + 0x17ac]
push eax
call dword [sym.imp.kernel32.dll_GetLongPathNameA]
lea eax, [ebp + 0xfac]
push 0x6d6d3220
push eax
call fcn.6d6a8cf0
pop ecx
pop ecx
test eax, eax
je 0x6d693337
lea eax, [ebp + 0xfac]
push str._bin
push eax
call fcn.6d6a8cf0
pop ecx
pop ecx
mov byte [eax], bl
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push ebx
push 0x6d6d3230
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d693522
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + 0x1fac]
push eax
push ebx
push dword [ebp - 0x5c]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x6d693519
push esi
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x58], ebx
jbe 0x6d6934c4
cmp byte [ebp + eax + 0x1fac], 0x2e
jne 0x6d6933a1
inc ecx
cmp ecx, 1
jg 0x6d6933b0
inc eax
cmp eax, dword [ebp - 0x58]
jb 0x6d693391
cmp ecx, 1
jle 0x6d6934c4
push 0x6d6d325c
lea eax, [ebp + 0x1fac]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
js 0x6d6934c4
lea eax, [ebp + 0x1fac]
push eax
call fcn.6d697031
pop ecx
test al, al
je 0x6d6934c4
lea eax, [ebp + 0x1fac]
push eax
push 0x6d6d3264
lea eax, [ebp - 0x54]
push 0x6d6d3290
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x64]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x54]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d6934c4
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x7ac]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x6d6d3298
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d6934bb
lea eax, [ebp + 0x7ac]
push eax
call fcn.6d6c1900
pop ecx
cmp eax, ebx
je 0x6d6934bb
lea ecx, [ebp - 0x74]
push ecx
push eax
call fcn.6d6c1900
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1fac]
push eax
call fcn.6d6c1900
add esp, 0x10
lea esi, [ebp + 0x7ac]
lea eax, [ebp + 0xfac]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x6d69349a
cmp cl, bl
je 0x6d693496
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x6d69349a
add eax, 2
add esi, 2
cmp cl, bl
jne 0x6d69347a
xor eax, eax
jmp 0x6d69349f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x6d6934bb
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
call fcn.6d696fdc
add esp, 0x10
test eax, eax
je 0x6d6934ef
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x60]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + 0x1fac]
push eax
push dword [ebp - 0x60]
mov dword [ebp - 0x58], edi
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x6d693381
jmp 0x6d693518
mov esi, dword [ebp - 0x68]
lea eax, [ebp + 0x1fac]
push eax
push edi
push dword [esi]
call fcn.6d6c1900
lea eax, [ebp + 0x7ac]
push eax
push edi
push dword [esi + 4]
call fcn.6d6c1900
add esp, 0x18
mov byte [esi + 9], 1
pop esi
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp + 0x27ac]
xor ecx, ebp
pop ebx
call fcn.6d6a886c
add ebp, 0x27b0
leave
ret