Function at 0x408527
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1010
call fcn.0040ff60
mov eax, dword [0x4525e4]
xor eax, esp
mov dword [esp + 0x100c], eax
cmp dword [0x461394], 0
push ebx
push ebp
push esi
push edi
mov ebp, 0x461b98
jne 0x4087dd
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebx, ebx
push 0x800
push ebp
push ebx
call esi
push 0x5c
push ebp
call fcn.00411f5a
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
movzx eax, word [ecx + 0x461b98]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x1a], ax
test ax, ax
jne 0x408575
lea eax, [esp + 0x1c]
push 0x5c
push eax
call fcn.00411f5a
pop ecx
pop ecx
test eax, eax
je 0x4085ae
lea eax, [esp + 0x1c]
push 0x5c
push eax
call fcn.00411f5a
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x1c]
push eax
call fcn.004094b2
xor edx, edx
inc edx
test eax, eax
pop ecx
mov ecx, dword [0x461394]
cmovne ecx, edx
mov dword [0x461394], ecx
test ecx, ecx
jne 0x4087dd
push str.11.281.2
push str.SoftwareJavaSoftJava_Web_Start_
push 0x44f25c
push 0x400
mov edi, 0x462398
push edi
call fcn.004099fb
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408699
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x800
push eax
push ebp
lea eax, [esp + 0x20]
push eax
push ebx
push str.Home
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408699
mov ecx, ebx
movzx eax, word [ecx + 0x461b98]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x1a], ax
test ax, ax
jne 0x40863f
lea eax, [esp + 0x1c]
push 0x5c
push eax
call fcn.00411f5a
pop ecx
pop ecx
test eax, eax
je 0x408678
lea eax, [esp + 0x1c]
push 0x5c
push eax
call fcn.00411f5a
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x1c]
push eax
call fcn.004094b2
pop ecx
mov ecx, dword [0x461394]
test eax, eax
push 1
pop eax
cmovne ecx, eax
mov dword [0x461394], ecx
jmp 0x40869f
mov ecx, dword [0x461394]
test ecx, ecx
jne 0x4087dd
push 0x800
push ebp
push ebx
call esi
push 0x44f274
push ebp
call fcn.00411604
pop ecx
pop ecx
test eax, eax
je 0x408772
push str.binjavaws.exe
push ebp
call fcn.00411604
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
movzx eax, word [ecx + 0x461b98]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x1a], ax
test ax, ax
jne 0x4086d7
mov edx, 0x44f2b4
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x4086f2
lea edi, [esp + 0x1c]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x408706
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, str.jre_bin
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x408727
sub edx, esi
lea edi, [ebp - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, bx
jne 0x408737
mov ecx, edx
lea eax, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004094b2
pop ecx
mov ecx, dword [0x461394]
test eax, eax
push 1
pop ebx
cmovne ecx, ebx
mov dword [0x461394], ecx
jmp 0x40877b
mov ecx, dword [0x461394]
xor ebx, ebx
inc ebx
test ecx, ecx
jne 0x4087dd
mov esi, 0x400
lea eax, [esp + 0x81c]
push esi
push eax
call fcn.00409592
pop ecx
pop ecx
test eax, eax
je 0x4087cf
lea eax, [esp + 0x81c]
push eax
push str._s_bin
push esi
push ebp
call fcn.004099fb
lea eax, [esp + 0x82c]
push eax
call fcn.004094b2
mov ecx, dword [0x461394]
add esp, 0x14
test eax, eax
cmovne ecx, ebx
mov dword [0x461394], ecx
jmp 0x4087d5
mov ecx, dword [0x461394]
test ecx, ecx
jne 0x4087dd
xor eax, eax
jmp 0x4087df
mov eax, ebp
mov ecx, dword [esp + 0x101c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040ff49
add esp, 0x1010
ret