Function at 0x40141b
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2004]
mov eax, 0x2004
call fcn.00407360
push 0xffffffffffffffff
push 0x4087ef
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x412014]
xor eax, ebp
mov dword [ebp + 0x2000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
xor ebx, ebx
push ebx
call esi
or eax, 1
push eax
call esi
call fcn.004044c7
neg eax
mov dword [ebp - 0x44], ebx
push 4
sbb edx, edx
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
inc eax
mov dword [ebp - 0x14], ebx
neg edx
mov dword [ebp - 0x40], ebx
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x28], eax
pop ebx
cmp dword [ebp + 0x200c], eax
jle 0x40193d
mov ecx, dword [ebp + 0x2010]
mov esi, dword [ecx + eax*4]
mov ecx, str._new
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4014e0
test dx, dx
je 0x4014dc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4014e0
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4014bc
xor eax, eax
jmp 0x4014e5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4014f5
mov dword [ebp - 0x18], 1
jmp 0x4017bf
mov ecx, str._old
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401520
test dx, dx
je 0x40151c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401520
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4014fc
xor eax, eax
jmp 0x401525
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40153c
call fcn.004044c7
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
jmp 0x4017bf
mov ecx, str._high
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401567
test dx, dx
je 0x401563
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401567
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x401543
xor eax, eax
jmp 0x40156c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40157c
mov dword [ebp - 0x44], 1
jmp 0x4017bf
mov ecx, str._jpisetup
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4015a7
test dx, dx
je 0x4015a3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4015a7
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x401583
xor eax, eax
jmp 0x4015ac
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4015bc
mov dword [ebp - 0x38], 1
jmp 0x4017bf
mov ecx, str._settreatas
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4015e7
test dx, dx
je 0x4015e3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4015e7
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4015c3
xor eax, eax
jmp 0x4015ec
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4015fc
mov dword [ebp - 0x34], 1
jmp 0x4017bf
mov ecx, str._fullreg
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401627
test dx, dx
je 0x401623
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401627
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x401603
xor eax, eax
jmp 0x40162c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40163c
mov dword [ebp - 0x14], 1
jmp 0x4017bf
mov ecx, str._regdeploy
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401667
test dx, dx
je 0x401663
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401667
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x401643
xor eax, eax
jmp 0x40166c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40167c
mov dword [ebp - 0x40], 1
jmp 0x4017bf
mov ecx, str._register
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4016a7
test dx, dx
je 0x4016a3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4016a7
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x401683
xor eax, eax
jmp 0x4016ac
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4016bc
mov dword [ebp - 0x24], 1
jmp 0x4017bf
mov ecx, str._disablewebjava
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4016e7
test dx, dx
je 0x4016e3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4016e7
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4016c3
xor eax, eax
jmp 0x4016ec
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4016fc
mov dword [ebp - 0x1c], 1
jmp 0x4017bf
mov ecx, str._forceinstall
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401727
test dx, dx
je 0x401723
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401727
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x401703
xor eax, eax
jmp 0x40172c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40173c
mov dword [ebp - 0x2c], 1
jmp 0x4017bf
mov ecx, str._nohint
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401767
test dx, dx
je 0x401763
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401767
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x401743
xor eax, eax
jmp 0x40176c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401779
mov dword [ebp - 0x3c], 1
jmp 0x4017bf
mov eax, str._doHKCUSSVSetup
mov cx, word [esi]
cmp cx, word [eax]
jne 0x4017a2
test cx, cx
je 0x40179e
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x4017a2
add esi, ebx
add eax, ebx
test cx, cx
jne 0x40177e
xor eax, eax
jmp 0x4017a7
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401841
xor edi, edi
inc edi
cmp dword [ebp + 0x200c], 2
jne 0x401841
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, dword [ebp + 0x200c]
jl 0x4014ac
test edi, edi
je 0x40193d
lea eax, [ebp - 0x1c]
xor edi, edi
push eax
push 0x20019
push edi
xor ebx, ebx
push str.SOFTWAREOracleJavaDeploy
inc ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401841
push 0x1000
lea eax, [ebp]
mov dword [ebp - 0x14], 0x800
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x38]
push eax
push edi
push str.deployment.home.bin.ssvagent
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x1c]
test eax, eax
je 0x401867
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2000]
xor ecx, ebp
call fcn.0040728f
add ebp, 0x2004
leave
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x24]
call fcn.004020a5
push 0x409698
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
call fcn.0040205a
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x24]
call fcn.0040217b
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x4018a5
call fcn.00403b54
mov esi, dword [ebp - 0x24]
mov byte [ebp - 4], 2
test esi, esi
je 0x4018b4
mov eax, dword [esi]
jmp 0x4018b6
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - 0x30], edi
test edi, edi
je 0x401916
push 0x4096a4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4018e8
push 0
push 0
call eax
xor ebx, ebx
test eax, eax
pop ecx
setne bl
pop ecx
mov dword [ebp - 0x18], ebx
push 0x4096c4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40190b
push 0
push 0
call eax
pop ecx
pop ecx
test ebx, ebx
je 0x401928
test eax, eax
je 0x401928
xor ebx, ebx
inc ebx
test edi, edi
je 0x401916
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
je 0x401921
mov ecx, esi
call fcn.00403b54
mov eax, ebx
jmp 0x401844
xor ebx, ebx
jmp 0x40190b
push 0x1000
xor edi, edi
lea eax, [ebp + 0x1000]
push 0
inc edi
push eax
mov dword [ebp - 0x20], edi
call sub.VCRUNTIME140.dll_memset
push 0x800
lea eax, [ebp + 0x1000]
push eax
push edi
push 0
call fcn.0040507f
add esp, 0x1c
test eax, eax
je 0x401841
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp - 0x28]
call fcn.004020a5
push str.deploy.dll
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], ebx
call fcn.004020a5
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x28]
call fcn.0040217b
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], bl
test ecx, ecx
je 0x4019b3
call fcn.00403b54
mov esi, dword [ebp - 0x28]
test esi, esi
je 0x4019be
mov eax, dword [esi]
jmp 0x4019c0
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
jne 0x4019e1
test esi, esi
je 0x401841
mov ecx, esi
call fcn.00403b54
jmp 0x401841
cmp dword [ebp - 0x1c], 0
je 0x401a78
push str.UnregisterDeployEx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401a4b
xor ecx, ecx
mov dword [ebp - 0x78], 0x34
xorps xmm0, xmm0
mov dword [ebp - 0x74], 4
mov dword [ebp - 0x68], ecx
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x6c], 2
mov dword [ebp - 0x64], 1
push ecx
cmp dword [ebp - 0x3c], ecx
jne 0x401a35
lea ecx, [ebp - 0x78]
push ecx
call eax
pop ecx
pop ecx
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
jne 0x401ae6
test esi, esi
je 0x401841
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x401841
mov ecx, esi
call fcn.00404343
push 0xc
push esi
call fcn.00406e25
pop ecx
pop ecx
jmp 0x401841
cmp dword [ebp - 0x40], 0
jne 0x401a88
cmp dword [ebp - 0x24], 0
je 0x401b0d
push str.RegisterDeployEx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401a4b
cmp dword [ebp - 0x2c], 0
je 0x401ad1
xor ecx, ecx
mov dword [ebp - 0x78], 0x34
xor edx, edx
mov dword [ebp - 0x68], ecx
push ecx
mov dword [ebp - 0x50], ecx
inc edx
mov dword [ebp - 0x4c], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x48], ecx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], 4
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x64], edx
push ecx
jmp 0x401ad5
push 0
push 0
call eax
pop ecx
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x24], 0
jne 0x401b0d
test esi, esi
je 0x401b06
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x401b06
mov ecx, esi
call fcn.00404343
push 0xc
push esi
call fcn.00406e25
pop ecx
pop ecx
xor eax, eax
jmp 0x401844
push 0x400
lea eax, [ebp + 0x1000]
push eax
push 1
push 0
call fcn.0040507f
add esp, 0x10
cmp eax, 1
jne 0x401e3d
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004020a5
cmp dword [ebp - 0x18], 0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 6
je 0x401b5a
push str.jp2ssv.dll
call fcn.004020a5
mov byte [ebp - 4], 7
jmp 0x401b68
push str._ssv.dll
call fcn.004020a5
mov byte [ebp - 4], 8
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040217b
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x401b80
call fcn.00403b54
mov edi, dword [ebp - 0x1c]
mov byte [ebp - 4], 9
test edi, edi
je 0x401b8f
mov eax, dword [edi]
jmp 0x401b91
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x30], ebx
test ebx, ebx
je 0x401cff
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x44], 0
je 0x401d4d
cmp dword [ebp - 0x34], 0
jne 0x401bbf
cmp dword [ebp - 0x24], 0
je 0x401c20
push str.UpdateTreatAsKey
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401be3
test edi, edi
je 0x401a4b
mov ecx, edi
call fcn.00403b54
jmp 0x401a4b
call eax
cmp dword [ebp - 0x24], 0
jne 0x401c20
or ebx, 0xffffffff
test edi, edi
je 0x401c0d
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x401c0d
mov ecx, edi
call fcn.00404343
push 0xc
push edi
call fcn.00406e25
pop ecx
pop ecx
test esi, esi
je 0x401b06
lock xadd dword [esi + 8], ebx
dec ebx
jmp 0x401af3
push 0x4097c4
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401c42
push 0
call eax
pop ecx
test eax, eax
je 0x401c42
mov dword [ebp - 0x34], 1
jmp 0x401c46
and dword [ebp - 0x34], 0
call fcn.00404655
test eax, eax
jne 0x401c54
cmp dword [ebp - 0x34], eax
je 0x401c70
push 0x4097e0
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401dc3
push 0
push 1
call eax
pop ecx
pop ecx
cmp dword [ebp - 0x18], 0
jne 0x401c90
push str.IsSSVEnabledInMozilla
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401dc3
call eax
test eax, eax
je 0x401ca6
push str.RemoveAllMozillaJavaPlugins
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401dc3
call eax
cmp dword [ebp - 0x38], 0
je 0x401cf4
xor eax, eax
cmp dword [ebp - 0x18], 1
sete al
push eax
call fcn.00401132
pop ecx
test eax, eax
jne 0x401dc3
cmp dword [ebp - 0x14], eax
jne 0x401cd0
push 0x409860
jmp 0x401cd5
push 0x409884
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401dc3
push 0
push 0
call eax
pop ecx
pop ecx
test eax, eax
je 0x401dc3
cmp dword [ebp - 0x18], 0
je 0x401d3e
call fcn.0040131d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
test ebx, ebx
je 0x401d10
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x401e3a
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x401d36
mov ecx, edi
call fcn.00404343
push 0xc
push edi
call fcn.00406e25
pop ecx
pop ecx
mov edi, dword [ebp - 0x20]
jmp 0x401e40
lea eax, [ebp + 0x1000]
push eax
call fcn.00401333
pop ecx
jmp 0x401cff
push str.RegKeyBranchNeedsUpdating
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401dc3
push 0
call eax
pop ecx
push str.CheckMozJavaPlugins
push ebx
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401dc3
cmp dword [ebp - 0x14], 0
jne 0x401db3
call eax
test eax, eax
jne 0x401db3
push str.RedirectAllStaticVersionKeys
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401dc3
push 0
push 0
call eax
pop ecx
pop ecx
push str.RedirectSelectedStaticVersionKeys
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401dc3
push 0
push 0
call eax
pop ecx
pop ecx
jmp 0x401e0b
push str.RunBrokerProcess
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401df8
or ebx, 0xffffffff
test edi, edi
je 0x401de5
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x401de5
mov ecx, edi
call fcn.00404343
push 0xc
push edi
call fcn.00406e25
pop ecx
pop ecx
test esi, esi
je 0x401841
lock xadd dword [esi + 8], ebx
dec ebx
jmp 0x401a5c
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
push ecx
call eax
add esp, 0x1c
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
jmp 0x401d02
mov edi, dword [ebp - 0x20]
or ebx, 0xffffffff
test esi, esi
je 0x401e5d
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x401e5d
mov ecx, esi
call fcn.00404343
push 0xc
push esi
call fcn.00406e25
pop ecx
pop ecx
mov eax, edi
jmp 0x401844