Function at 0x4013d4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2004]
mov eax, 0x2004
call fcn.00407110
push 0xffffffffffffffff
push 0x4084c3
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x412014]
xor eax, ebp
mov dword [ebp + 0x2000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
call fcn.004043f9
neg eax
sbb edx, edx
xor esi, esi
xor eax, eax
mov dword [ebp - 0x44], esi
inc eax
mov dword [ebp - 0x38], esi
neg edx
mov dword [ebp - 0x34], esi
mov edi, esi
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x20], eax
cmp dword [ebp + 0x200c], eax
jle 0x4018c6
push 4
pop ebx
mov ecx, dword [ebp + 0x2010]
mov esi, dword [ecx + eax*4]
mov ecx, str._new
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40148a
test dx, dx
je 0x401486
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40148a
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x401466
xor eax, eax
jmp 0x40148f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40149f
mov dword [ebp - 0x2c], 1
jmp 0x401769
mov ecx, str._old
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4014ca
test dx, dx
je 0x4014c6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4014ca
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4014a6
xor eax, eax
jmp 0x4014cf
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4014e6
call fcn.004043f9
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
jmp 0x401769
mov ecx, str._high
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401511
test dx, dx
je 0x40150d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401511
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4014ed
xor eax, eax
jmp 0x401516
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401526
mov dword [ebp - 0x44], 1
jmp 0x401769
mov ecx, str._jpisetup
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401551
test dx, dx
je 0x40154d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401551
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x40152d
xor eax, eax
jmp 0x401556
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401566
mov dword [ebp - 0x38], 1
jmp 0x401769
mov ecx, str._settreatas
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401591
test dx, dx
je 0x40158d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401591
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x40156d
xor eax, eax
jmp 0x401596
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4015a6
mov dword [ebp - 0x34], 1
jmp 0x401769
mov ecx, str._fullreg
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4015d1
test dx, dx
je 0x4015cd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4015d1
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4015ad
xor eax, eax
jmp 0x4015d6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4015e6
mov dword [ebp - 0x24], 1
jmp 0x401769
mov ecx, str._regdeploy
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401611
test dx, dx
je 0x40160d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401611
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4015ed
xor eax, eax
jmp 0x401616
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401626
mov dword [ebp - 0x40], 1
jmp 0x401769
mov ecx, str._register
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401651
test dx, dx
je 0x40164d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401651
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x40162d
xor eax, eax
jmp 0x401656
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401666
mov dword [ebp - 0x1c], 1
jmp 0x401769
mov ecx, str._disablewebjava
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401691
test dx, dx
je 0x40168d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401691
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x40166d
xor eax, eax
jmp 0x401696
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4016a6
mov dword [ebp - 0x14], 1
jmp 0x401769
mov ecx, str._forceinstall
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4016d1
test dx, dx
je 0x4016cd
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4016d1
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4016ad
xor eax, eax
jmp 0x4016d6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4016e6
mov dword [ebp - 0x28], 1
jmp 0x401769
mov ecx, str._nohint
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401711
test dx, dx
je 0x40170d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401711
add eax, ebx
add ecx, ebx
test dx, dx
jne 0x4016ed
xor eax, eax
jmp 0x401716
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401723
mov dword [ebp - 0x3c], 1
jmp 0x401769
mov eax, str._doHKCUSSVSetup
mov cx, word [esi]
cmp cx, word [eax]
jne 0x40174c
test cx, cx
je 0x401748
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x40174c
add esi, ebx
add eax, ebx
test cx, cx
jne 0x401728
xor eax, eax
jmp 0x401751
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4017eb
xor edi, edi
inc edi
cmp dword [ebp + 0x200c], 2
jne 0x4017eb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, dword [ebp + 0x200c]
jl 0x401456
test edi, edi
je 0x4018c4
lea ecx, [ebp - 0x14]
xor edi, edi
push ecx
push 0x20019
push edi
xor ebx, ebx
push str.SOFTWAREOracleJavaDeploy
inc ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4017eb
push 0x1000
lea eax, [ebp]
mov dword [ebp - 0x24], 0x800
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x38]
push eax
push edi
push str.deployment.home.bin.ssvagent
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
test eax, eax
je 0x4017f3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x401d1b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00401f8e
push 0x409554
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.00401f43
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402065
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x401831
call fcn.00403a4c
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 4], 2
test esi, esi
je 0x401840
mov eax, dword [esi]
jmp 0x401842
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - 0x30], edi
test edi, edi
je 0x401d0e
push 0x409560
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401878
push 0
push 0
call eax
xor ebx, ebx
test eax, eax
pop ecx
setne bl
pop ecx
mov dword [ebp - 0x18], ebx
push 0x409580
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4018b0
push 0
push 0
call eax
pop ecx
pop ecx
test ebx, ebx
je 0x40189d
test eax, eax
je 0x40189d
xor ebx, ebx
inc ebx
jmp 0x4018b0
xor ebx, ebx
jmp 0x4018b0
test edi, edi
je 0x401d0e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x401d0e
xor esi, esi
push 0x1000
xor ebx, ebx
lea eax, [ebp + 0x1000]
push esi
inc ebx
push eax
mov dword [ebp - 0x18], ebx
call sub.VCRUNTIME140.dll_memset
push 0x800
lea eax, [ebp + 0x1000]
push eax
push ebx
push esi
call fcn.00404f8b
add esp, 0x1c
test eax, eax
je 0x4017eb
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp - 0x20]
call fcn.00401f8e
push str.deploy.dll
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 4
call fcn.00401f8e
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x20]
call fcn.00402065
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], 4
test ecx, ecx
je 0x40193f
call fcn.00403a4c
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x40194a
mov eax, dword [esi]
jmp 0x40194c
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
jne 0x40196d
test esi, esi
je 0x4017eb
mov ecx, esi
call fcn.00403a4c
jmp 0x4017eb
cmp dword [ebp - 0x14], 0
je 0x4019e1
push str.UnregisterDeployEx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401959
xor ecx, ecx
mov dword [ebp - 0x78], 0x34
xorps xmm0, xmm0
mov dword [ebp - 0x74], 4
mov dword [ebp - 0x68], ecx
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x6c], 2
mov dword [ebp - 0x64], 1
push ecx
cmp dword [ebp - 0x3c], ecx
jne 0x4019bd
lea ecx, [ebp - 0x78]
push ecx
call eax
pop ecx
pop ecx
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
je 0x401959
test esi, esi
je 0x4019da
mov ecx, esi
call fcn.00403a4c
xor eax, eax
jmp 0x401d1b
cmp dword [ebp - 0x40], 0
jne 0x4019ed
cmp dword [ebp - 0x1c], 0
je 0x401a4f
push str.RegisterDeployEx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401959
cmp dword [ebp - 0x28], 0
je 0x401a3a
xor edx, edx
mov dword [ebp - 0x78], 0x34
xor ecx, ecx
mov dword [ebp - 0x74], 4
inc ecx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x6c], ecx
xorps xmm0, xmm0
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x78]
push edx
movups xmmword [ebp - 0x60], xmm0
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
push ecx
jmp 0x401a3e
push 0
push 0
call eax
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x1c], 0
je 0x4019cf
push 0x400
lea eax, [ebp + 0x1000]
push eax
push 1
push 0
call fcn.00404f8b
add esp, 0x10
cmp eax, 1
jne 0x401d0e
lea eax, [ebp + 0x1000]
push eax
lea ecx, [ebp - 0x14]
call fcn.00401f8e
cmp dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
je 0x401a9c
push str.jp2ssv.dll
call fcn.00401f8e
mov byte [ebp - 4], 7
jmp 0x401aaa
push str._ssv.dll
call fcn.00401f8e
mov byte [ebp - 4], 8
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402065
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x401ac2
call fcn.00403a4c
mov edi, dword [ebp - 0x14]
mov byte [ebp - 4], 9
test edi, edi
je 0x401ad1
mov eax, dword [edi]
jmp 0x401ad3
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
mov dword [ebp - 0x30], ebx
test ebx, ebx
je 0x401d00
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x44], eax
je 0x401c31
cmp dword [ebp - 0x34], eax
jne 0x401aff
cmp dword [ebp - 0x1c], eax
je 0x401b3f
push str.UpdateTreatAsKey
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x401b23
test edi, edi
je 0x401959
mov ecx, edi
call fcn.00403a4c
jmp 0x401959
call eax
cmp dword [ebp - 0x1c], 0
jne 0x401b3f
test edi, edi
je 0x4019cf
mov ecx, edi
call fcn.00403a4c
jmp 0x4019cf
push 0x40965c
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b61
push 0
call eax
pop ecx
test eax, eax
je 0x401b61
mov dword [ebp - 0x34], 1
jmp 0x401b65
and dword [ebp - 0x34], 0
call fcn.00404588
test eax, eax
jne 0x401b73
cmp dword [ebp - 0x34], eax
je 0x401b8b
push 0x409678
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b0f
push 0
push 1
call eax
pop ecx
pop ecx
cmp dword [ebp - 0x2c], 0
jne 0x401bab
push str.IsSSVEnabledInMozilla
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b0f
call eax
test eax, eax
je 0x401bc1
push str.RemoveAllMozillaJavaPlugins
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b0f
call eax
cmp dword [ebp - 0x38], 0
je 0x401c0f
xor eax, eax
cmp dword [ebp - 0x2c], 1
sete al
push eax
call fcn.00401132
pop ecx
test eax, eax
jne 0x401b0f
cmp dword [ebp - 0x24], eax
jne 0x401beb
push 0x4096d0
jmp 0x401bf0
push 0x4096f4
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b0f
push 0
push 0
call eax
pop ecx
pop ecx
test eax, eax
je 0x401b0f
cmp dword [ebp - 0x2c], 0
je 0x401c1f
call fcn.004012eb
jmp 0x401cf5
lea eax, [ebp + 0x1000]
push eax
call fcn.00401301
pop ecx
jmp 0x401cf5
push str.RegKeyBranchNeedsUpdating
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b0f
push 0
call eax
pop ecx
push str.CheckMozJavaPlugins
push ebx
mov dword [ebp - 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b0f
cmp dword [ebp - 0x24], 0
jne 0x401cb0
call eax
test eax, eax
jne 0x401cb0
push str.RedirectAllStaticVersionKeys
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b0f
push 0
push 0
call eax
pop ecx
pop ecx
push str.RedirectSelectedStaticVersionKeys
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b0f
push 0
push 0
call eax
pop ecx
pop ecx
mov ecx, eax
xor eax, eax
test ecx, ecx
sete al
jmp 0x401cf2
push str.RunBrokerProcess
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401b0f
xor ecx, ecx
push ecx
push ecx
push ecx
push dword [ebp - 0x24]
push 1
push dword [ebp - 0x2c]
push ecx
call eax
add esp, 0x1c
jmp 0x401ca5
mov dword [ebp - 0x18], eax
test ebx, ebx
je 0x401d00
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x401d0b
mov ecx, edi
call fcn.00403a4c
mov ebx, dword [ebp - 0x18]
test esi, esi
je 0x401d19
mov ecx, esi
call fcn.00403a4c
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2000]
xor ecx, ebp
call fcn.00407028
add ebp, 0x2004
leave
ret