Function at 0x40d3b7
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1f98]
mov eax, 0x2018
call fcn.0040e990
mov eax, dword [0x435248]
xor eax, ebp
mov dword [ebp + 0x1f94], eax
mov eax, dword [ebp + 0x1fa4]
push ebx
mov ebx, dword [ebp + 0x1fa0]
push esi
push edi
mov dword [ebp - 0x78], eax
xor eax, eax
mov esi, 0xffe
xor edi, edi
push esi
mov word [ebp + 0xf94], ax
lea eax, [ebp + 0xf96]
push edi
push eax
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x7c], 1
call fcn.0040e9c0
xor eax, eax
push esi
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push edi
push eax
call fcn.0040e9c0
push ebx
call fcn.0040f1b1
add esp, 0x1c
cmp eax, edi
je 0x40d44d
push eax
push dword [ebp + 0x1fa8]
push dword [ebp - 0x78]
call fcn.00412455
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jmp 0x40d5ec
call fcn.0040cf3c
test eax, eax
mov eax, dword [str.SOFTWAREAppDataLowSOFTWAREJavaSoftDeploymentProperties]
jne 0x40d460
mov eax, dword [str.SOFTWAREJavaSoftDeploymentProperties]
lea ecx, [ebp - 0x70]
push ecx
mov ebx, 0x20019
push ebx
push edi
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d482
xor eax, eax
jmp 0x40d5ec
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 0x1fa8]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x7c]
push eax
push edi
push dword [ebp - 0x80]
push dword [ebp - 0x70]
call esi
test eax, eax
je 0x40d4b3
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40d5ec
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xf94]
push eax
lea eax, [ebp - 0x7c]
push eax
push edi
push 0x429cd4
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x800
call esi
test eax, eax
je 0x40d4dd
xor edi, edi
inc edi
jmp 0x40d4a3
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x70]
push eax
push ebx
push edi
push str.SOFTWAREOracleJavaDeploy
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d4d8
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
push edi
push str.deployment.modified.timestamp
push dword [ebp - 0x70]
mov ebx, 0x800
mov dword [ebp - 0x74], ebx
call esi
test eax, eax
jne 0x40d4d8
mov dword [ebp - 0x74], ebx
lea ecx, [ebp + 0xf94]
lea eax, [ebp - 0x6c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40d555
cmp dx, di
je 0x40d551
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40d555
add eax, 4
add ecx, 4
cmp dx, di
jne 0x40d52f
xor eax, eax
jmp 0x40d55a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jl 0x40d5e9
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x78]
lea eax, [ebp - 0x7c]
push eax
push edi
push dword [ebp - 0x80]
push dword [ebp - 0x70]
call esi
test eax, eax
jne 0x40d4d8
push dword [ebp - 0x70]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
call fcn.0040cf3c
test eax, eax
mov eax, dword [str.SOFTWAREAppDataLowSOFTWAREJavaSoftDeploymentProperties]
jne 0x40d59c
mov eax, dword [str.SOFTWAREJavaSoftDeploymentProperties]
lea ecx, [ebp - 0x70]
push ecx
push 0x20006
push edi
push eax
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d47b
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push 1
push edi
push dword [ebp - 0x80]
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40d4a3
push dword [ebp - 0x70]
call esi
push dword [ebp - 0x78]
push dword [ebp - 0x80]
call fcn.0040d33e
pop ecx
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x1f94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e263
add ebp, 0x1f98
leave
ret