Function at 0x6d5bd0b0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x230
mov eax, dword [0x6d5e2a5c]
xor eax, esp
mov dword [esp + 0x22c], eax
mov eax, dword [esp + 0x234]
push esi
push edi
xor edi, edi
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
xor esi, esi
mov dword [esp + 0x14], edi
call fcn.6d593190
test eax, eax
je 0x6d5bd141
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x6d5bd128
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x230
ret
push ebp
mov ebp, dword [esp + 0x10]
push 0x20019
push str.JavaSoft
push ebp
lea ecx, [esp + 0x28]
call fcn.6d593190
test eax, eax
je 0x6d5bd190
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x6d5bd16f
push eax
call esi
cmp ebp, edi
je 0x6d5bd176
push ebp
call esi
pop ebp
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x230
ret
push ebx
mov ebx, dword [esp + 0x20]
push 0x20019
push str.Java_Runtime_Environment
push ebx
lea ecx, [esp + 0x38]
call fcn.6d593190
test eax, eax
je 0x6d5bd1d3
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x6d5bd1be
push eax
call esi
cmp ebx, edi
je 0x6d5bd1c5
push ebx
call esi
cmp ebp, edi
je 0x6d5bd1cc
push ebp
call esi
xor eax, eax
jmp 0x6d5bd2fb
mov ebx, dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x80
lea edx, [esp + 0x40]
push edx
push edi
xor ecx, ecx
push ebx
mov word [esp + 0x14c], cx
call ebp
test eax, eax
jne 0x6d5bd2d4
lea ecx, [ecx]
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x40]
push ecx
inc esi
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
jle 0x6d5bd29d
mov ecx, str.11.181.2
lea eax, [esp + 0x3c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x6d5bd24e
cmp dx, di
je 0x6d5bd24a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x6d5bd24e
add eax, 4
add ecx, 4
cmp dx, di
jne 0x6d5bd228
xor eax, eax
jmp 0x6d5bd253
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x6d5bd29d
lea eax, [esp + 0x3c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x6d5bd260
sub eax, edx
sar eax, 1
cmp eax, 3
jbe 0x6d5bd29d
xor eax, eax
jmp 0x6d5bd280
movzx ecx, word [esp + eax + 0x3c]
mov word [esp + eax + 0x13c], cx
add eax, 2
cmp cx, di
jne 0x6d5bd280
mov dword [esp + 0x10], 1
push 0x80
lea edx, [esp + 0x40]
push edx
push esi
push ebx
call ebp
test eax, eax
je 0x6d5bd200
cmp dword [esp + 0x10], edi
je 0x6d5bd2d4
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x13c]
push eax
push 0x6d5cfa40
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x6d5bd2e1
push ebx
call esi
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x6d5bd2ec
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x6d5bd2f7
push eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x23c]
pop ebx
pop ebp
pop edi
pop esi
xor ecx, esp
call fcn.6d5ca6ac
add esp, 0x230
ret