Function at 0x10013120
Capabilities:
Query or enumerate registry key
Resolve function by parsing pe exports
Set registry value

Disassembly:
mov eax, 0x506c
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x5068], eax
mov eax, dword [esp + 0x5074]
push ebx
mov ebx, dword [esp + 0x5074]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x507c]
push ebp
mov ebp, dword [esp + 0x5088]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x5084]
push esi
mov dword [esp + 0x60], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x5094]
mov word [esp + 0x78], ax
lea eax, [esp + 0x78]
push edi
push eax
call fcn.10011a00
add esp, 8
test eax, eax
je 0x1001357e
lea ecx, [esp + 0x78]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10013196
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [esp + ecx*2 + 0x76], 0x5c
je 0x100131c7
push 0x1003e9cc
lea eax, [esp + 0x7c]
push 0x800
push eax
call esi
add esp, 0xc
push str.plugins_
lea eax, [esp + 0x7c]
push 0x800
push eax
call esi
push 0
push dword [esp + 0x50a8]
lea eax, [esp + 0x8c]
push 0
push eax
call fcn.100146b0
add esp, 0x1c
test eax, eax
je 0x1001357e
push ebx
lea ecx, [esp + 0x18]
call fcn.100060b0
cmp edi, 2
je 0x1001327b
mov esi, dword [esp + 0x14]
test esi, esi
je 0x10013216
mov eax, dword [esi]
jmp 0x10013218
xor eax, eax
mov ecx, dword [esp + 0x5098]
push ecx
lea ecx, [esp + 0x7c]
push ecx
push eax
call fcn.10011770
add esp, 0xc
mov edi, eax
test esi, esi
je 0x10013274
or ecx, 0xffffffff
lock xadd dword [esi + 8], ecx
dec ecx
jne 0x10013274
mov ecx, dword [esi]
test ecx, ecx
je 0x10013252
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10013269
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1002f9d0
add esp, 8
mov eax, edi
jmp 0x10013580
push 1
push 0
lea eax, [esp + 0x80]
push 0
push eax
call fcn.100146b0
add esp, 0x10
test eax, eax
jne 0x100132c6
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001357e
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x1001357e
mov eax, dword [esi]
test eax, eax
je 0x1001355c
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10013556
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.100060b0
mov eax, dword [eax]
test eax, eax
je 0x10013322
mov ebx, dword [eax]
jmp 0x10013324
xor ebx, ebx
push dword [esp + 0x64]
lea ecx, [esp + 0x4c]
call fcn.100060b0
mov eax, dword [eax]
test eax, eax
je 0x1001333b
mov edi, dword [eax]
jmp 0x1001333d
xor edi, edi
push dword [esp + 0x68]
lea ecx, [esp + 0x48]
call fcn.100060b0
mov esi, dword [eax]
test esi, esi
je 0x10013354
mov esi, dword [esi]
jmp 0x10013356
xor esi, esi
push dword [esp + 0x18]
lea ecx, [esp + 0x44]
call fcn.100060b0
mov eax, dword [eax]
test eax, eax
je 0x1001336d
mov eax, dword [eax]
jmp 0x1001336f
xor eax, eax
push 0
push 0
push 0
lea ecx, [esp + 0x4084]
push ecx
push 0
lea ecx, [esp + 0x308c]
push ecx
push ebx
push edi
push esi
push eax
call fcn.10011f50
mov esi, dword [esp + 0x68]
add esp, 0x28
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
or edi, 0xffffffff
test esi, esi
je 0x100133eb
mov eax, edi
lock xadd dword [esi + 8], eax
dec eax
jne 0x100133e3
test esi, esi
je 0x100133e3
mov eax, dword [esi]
test eax, eax
je 0x100133c1
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100133d8
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1002f9d0
add esp, 8
mov dword [esp + 0x40], 0
mov esi, dword [esp + 0x44]
test esi, esi
je 0x1001343a
mov eax, edi
lock xadd dword [esi + 8], eax
dec eax
jne 0x10013432
test esi, esi
je 0x10013432
mov eax, dword [esi]
test eax, eax
je 0x10013410
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10013427
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1002f9d0
add esp, 8
mov dword [esp + 0x44], 0
mov esi, dword [esp + 0x48]
test esi, esi
je 0x10013489
mov eax, edi
lock xadd dword [esi + 8], eax
dec eax
jne 0x10013481
test esi, esi
je 0x10013481
mov eax, dword [esi]
test eax, eax
je 0x1001345f
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10013476
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1002f9d0
add esp, 8
mov dword [esp + 0x48], 0
mov esi, dword [esp + 0x10]
test esi, esi
je 0x100134d0
mov eax, edi
lock xadd dword [esi + 8], eax
dec eax
jne 0x100134d0
test esi, esi
je 0x100134d0
mov eax, dword [esi]
test eax, eax
je 0x100134ae
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100134c5
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1002f9d0
add esp, 8
push 0xf003f
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x40]
call fcn.10003a10
test eax, eax
jne 0x10013522
push 0xf003f
push str.JavaSoft
push dword [esp + 0x3c]
lea ecx, [esp + 0x34]
call fcn.10003a10
lea ecx, [esp + 0x1c]
test eax, eax
jne 0x10013526
push 0xf003f
push str.Java_Runtime_Environment
push dword [esp + 0x30]
call fcn.10003a10
test eax, eax
je 0x10013599
lea ecx, [esp + 0x1c]
call fcn.100036e0
lea ecx, [esp + 0x28]
call fcn.100036e0
lea ecx, [esp + 0x34]
call fcn.100036e0
mov esi, dword [esp + 0x14]
test esi, esi
je 0x1001357e
lock xadd dword [esi + 8], edi
dec edi
jne 0x1001357e
mov eax, dword [esi]
test eax, eax
je 0x1001355c
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10013573
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1002f9d0
add esp, 8
xor eax, eax
mov ecx, dword [esp + 0x5078]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x506c
ret
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x78]
mov dword [esp + 0x78], 0
mov dword [esp + 0x7c], 0
xor ebx, ebx
mov dword [esp + 0x80], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
call fcn.10003a10
test eax, eax
je 0x1001361a
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x100136f7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100136f7
mov esi, dword [esp + 0x6c]
lea ecx, [esp + 0x58]
push 0x2001f
push str.JavaSoft
push esi
call fcn.10003a10
test eax, eax
je 0x10013641
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100136e5
push 0x2001f
push str.Java_Runtime_Environment
push dword [esp + 0x60]
lea ecx, [esp + 0x58]
call fcn.10003a10
test eax, eax
jne 0x100136d4
push 0x400
mov word [esp + 0x207c], ax
lea eax, [esp + 0x107c]
push eax
push 0
push dword [esp + 0x58]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x100136d4
lea eax, [esp + 0x2078]
inc ebx
push eax
lea eax, [esp + 0x107c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jle 0x100136b8
lea eax, [esp + 0x1078]
push eax
lea eax, [esp + 0x207c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push 0x400
lea eax, [esp + 0x107c]
push eax
push ebx
push dword [esp + 0x58]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10013681
mov eax, dword [esp + 0x4c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x100136e5
push eax
call ebx
mov eax, dword [esp + 0x58]
test eax, eax
je 0x100136f0
push eax
call ebx
test esi, esi
je 0x100136f7
push esi
call ebx
lea eax, [esp + 0x4078]
push 0x10041768
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
js 0x1001375a
lea ecx, [esp + 0x3078]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10013720
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [esp + 0x307c]
push eax
push 1
push 0
push str.BrowserJavaVersion
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10013522
cmp dword [esp + 0x5098], 0
mov esi, dword [esp + 0x14]
je 0x1001377b
test esi, esi
je 0x10013770
mov eax, dword [esi]
jmp 0x10013772
xor eax, eax
push eax
call sym.deploy.dll_RegJavaConsole
add esp, 4
lea ecx, [esp + 0x1c]
call fcn.100036e0
lea ecx, [esp + 0x28]
call fcn.100036e0
lea ecx, [esp + 0x34]
call fcn.100036e0
test esi, esi
je 0x100137d3
lock xadd dword [esi + 8], edi
dec edi
jne 0x100137d3
mov eax, dword [esi]
test eax, eax
je 0x100137b1
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100137c8
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1002f9d0
add esp, 8
mov eax, 1
jmp 0x10013580