Function at 0x6d7a327b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x27b0]
mov eax, 0x2830
call fcn.6d7b89f0
mov eax, dword [0x6d7f05c8]
xor eax, ebp
mov dword [ebp + 0x27ac], eax
mov eax, dword [ebp + 0x27b8]
mov ecx, dword [eax]
push ebx
xor ebx, ebx
mov byte [ecx], bl
mov ecx, dword [eax + 4]
mov byte [ecx], bl
push 0x6d7e3210
mov dword [ebp - 0x68], eax
mov word [eax + 8], bx
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x6d7a3523
push edi
mov edi, 0x800
push edi
lea ecx, [ebp + 0x17ac]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x17ac]
push str.jvm.dll
push eax
call fcn.6d7b8cf0
pop ecx
pop ecx
test eax, eax
je 0x6d7a3522
push edi
lea eax, [ebp + 0xfac]
push eax
lea eax, [ebp + 0x17ac]
push eax
call dword [sym.imp.kernel32.dll_GetLongPathNameA]
lea eax, [ebp + 0xfac]
push 0x6d7e3220
push eax
call fcn.6d7b8cf0
pop ecx
pop ecx
test eax, eax
je 0x6d7a3337
lea eax, [ebp + 0xfac]
push str._bin
push eax
call fcn.6d7b8cf0
pop ecx
pop ecx
mov byte [eax], bl
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push ebx
push 0x6d7e3230
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d7a3522
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + 0x1fac]
push eax
push ebx
push dword [ebp - 0x5c]
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x6d7a3519
push esi
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x58], ebx
jbe 0x6d7a34c4
cmp byte [ebp + eax + 0x1fac], 0x2e
jne 0x6d7a33a1
inc ecx
cmp ecx, 1
jg 0x6d7a33b0
inc eax
cmp eax, dword [ebp - 0x58]
jb 0x6d7a3391
cmp ecx, 1
jle 0x6d7a34c4
push 0x6d7e325c
lea eax, [ebp + 0x1fac]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
js 0x6d7a34c4
lea eax, [ebp + 0x1fac]
push eax
call fcn.6d7a7031
pop ecx
test al, al
je 0x6d7a34c4
lea eax, [ebp + 0x1fac]
push eax
push 0x6d7e3264
lea eax, [ebp - 0x54]
push 0x6d7e3290
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x64]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x54]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d7a34c4
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x7ac]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x6d7e3298
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6d7a34bb
lea eax, [ebp + 0x7ac]
push eax
call fcn.6d7b404c
pop ecx
cmp eax, ebx
je 0x6d7a34bb
lea ecx, [ebp - 0x74]
push ecx
push eax
call fcn.6d7b404c
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x1fac]
push eax
call fcn.6d7b404c
add esp, 0x10
lea esi, [ebp + 0x7ac]
lea eax, [ebp + 0xfac]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x6d7a349a
cmp cl, bl
je 0x6d7a3496
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x6d7a349a
add eax, 2
add esi, 2
cmp cl, bl
jne 0x6d7a347a
xor eax, eax
jmp 0x6d7a349f
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x6d7a34bb
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push dword [ebp - 0x70]
push dword [ebp - 0x74]
call fcn.6d7a6fdc
add esp, 0x10
test eax, eax
je 0x6d7a34ef
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x60]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp + 0x1fac]
push eax
push dword [ebp - 0x60]
mov dword [ebp - 0x58], edi
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x6d7a3381
jmp 0x6d7a3518
mov esi, dword [ebp - 0x68]
lea eax, [ebp + 0x1fac]
push eax
push edi
push dword [esi]
call fcn.6d7b404c
lea eax, [ebp + 0x7ac]
push eax
push edi
push dword [esi + 4]
call fcn.6d7b404c
add esp, 0x18
mov byte [esi + 9], 1
pop esi
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp + 0x27ac]
xor ecx, ebp
pop ebx
call fcn.6d7b886c
add ebp, 0x27b0
leave
ret