Function at 0x40874b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1fc0]
mov eax, 0x2040
call fcn.0040e990
mov eax, dword [0x435248]
xor eax, ebp
mov dword [ebp + 0x1fbc], eax
cmp dword [0x449b8c], 0
push ebx
mov ebx, 0x445300
jne 0x408a68
push esi
push edi
mov edi, 0x800
push edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
pop esi
push esi
push ebx
call fcn.0040fed7
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
movzx ecx, word [eax + 0x445300]
mov word [ebp + eax + 0x17bc], cx
add eax, 2
test cx, cx
jne 0x4087a1
lea eax, [ebp + 0x17bc]
push esi
push eax
call fcn.0040fed7
pop ecx
pop ecx
test eax, eax
je 0x4087df
lea eax, [ebp + 0x17bc]
push esi
push eax
call fcn.0040fed7
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
push 0x432074
push esi
push 0x43208c
push esi
lea eax, [ebp + 0x17bc]
push eax
lea eax, [ebp - 0x44]
push 0x432094
push eax
call fcn.0040f8db
push 0x4320ac
push esi
push 0x4320c4
push esi
lea eax, [ebp + 0x17bc]
push eax
lea eax, [ebp + 0xfbc]
push 0x4320cc
push eax
call fcn.0040f8db
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.0040de05
add esp, 0x40
test eax, eax
jne 0x408858
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xfbc]
push eax
call fcn.0040de05
pop ecx
pop ecx
test eax, eax
jne 0x408858
mov dword [0x449b8c], 1
cmp dword [0x449b8c], 0
jne 0x408a66
push str.11.74.2
push str.SoftwareJavaSoftJava_Web_Start_
push 0x4320f4
mov esi, 0x448b00
push esi
call fcn.0040f8db
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408934
lea eax, [ebp - 0x78]
push eax
push ebx
lea eax, [ebp - 0x80]
push eax
push 0
push str.Home
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408934
push 0x432150
push 0x5c
push ebx
lea eax, [ebp + 0xfbc]
push 0x432164
push eax
call fcn.0040f8db
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xfbc]
push eax
call fcn.0040de05
add esp, 0x1c
test eax, eax
je 0x40892a
call fcn.00407dca
test eax, eax
jne 0x408a5c
lea eax, [ebp + 0x7bc]
push 0x400
push eax
call fcn.0040800c
pop ecx
pop ecx
test eax, eax
je 0x408934
lea eax, [ebp + 0x7bc]
push eax
push 0x432174
push ebx
call fcn.0040f8db
add esp, 0xc
mov dword [0x449b8c], 1
cmp dword [0x449b8c], 0
jne 0x408a66
push edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x432184
push ebx
call fcn.0040ebb7
pop ecx
pop ecx
test eax, eax
je 0x408a27
push str.binjavaws.exe
push ebx
call fcn.0040ebb7
pop ecx
pop ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
movzx ecx, word [eax + 0x445300]
mov word [ebp + eax + 0x17bc], cx
add eax, 2
test cx, cx
jne 0x408974
mov eax, str.jrelib
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408992
lea edi, [ebp + 0x17bc]
sub eax, edx
sub edi, 2
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4089a8
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, str.jre_bin
rep movsb byte es:[edi], byte [esi]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4089cb
sub eax, edx
lea edi, [ebx - 2]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4089db
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x74]
push eax
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.0040de05
pop ecx
pop ecx
test eax, eax
jne 0x408a27
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x17bc]
push eax
call fcn.0040de05
pop ecx
pop ecx
test eax, eax
jne 0x408a27
mov dword [0x449b8c], 1
cmp dword [0x449b8c], 0
jne 0x408a66
lea eax, [ebp + 0x7bc]
push 0x400
push eax
call fcn.0040800c
pop ecx
pop ecx
test eax, eax
je 0x408a66
lea eax, [ebp + 0x7bc]
push eax
push str._s_bin
push ebx
call fcn.0040f8db
add esp, 0xc
mov dword [0x449b8c], 1
pop edi
pop esi
mov ecx, dword [ebp + 0x1fbc]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0040e263
add ebp, 0x1fc0
leave
ret