Function at 0x40536c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc30
cmp dword [0x4200c8], 0
push ebx
push esi
push edi
mov ebx, 0x41f4c0
jne 0x405597
push 0x400
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push ebx
call dword [sym.imp.MSVCRT.dll_strrchr]
and byte [eax], 0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x430]
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x5c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x430]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_strrchr]
pop edi
push edi
push eax
call esi
add esp, 0x10
test eax, eax
je 0x4053f2
lea eax, [ebp - 0x430]
push edi
push eax
call esi
and byte [eax], 0
pop ecx
pop ecx
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push str.javaws.jar
push edi
push 0x415b88
lea eax, [ebp - 0x430]
push edi
push eax
lea eax, [ebp - 0x830]
push 0x415b8c
push eax
call esi
push str.deploy.jar
push edi
push 0x415ba4
lea eax, [ebp - 0x430]
push edi
push eax
lea eax, [ebp - 0xc30]
push str._s_c_s_c_s
push eax
call esi
mov edi, dword [sym.imp.MSVCRT.dll__stat]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x830]
push eax
call edi
add esp, 0x40
test eax, eax
jne 0x405471
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc30]
push eax
call edi
pop ecx
test eax, eax
pop ecx
jne 0x405471
mov dword [0x4200c8], 1
cmp dword [0x4200c8], 0
jne 0x405597
push str.1.5.0_11
push str.SoftwareJavaSoftJava_Web_Start_
mov edi, 0x41e880
push 0x415be4
push edi
call esi
add esp, 0x10
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push edi
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4054e1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x400
push eax
lea eax, [ebp - 0xc]
push ebx
push eax
push esi
push str.Home
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4054e1
mov dword [0x4200c8], 1
cmp dword [0x4200c8], esi
jne 0x405597
push 0x400
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.MSVCRT.dll_strstr]
push 0x415bf4
push ebx
call esi
pop ecx
test eax, eax
pop ecx
je 0x405597
push str.binjavaws.exe
push ebx
call esi
and byte [eax], 0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x430]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x430]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov esi, str.jrelib
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov esi, str.jre_bin
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.MSVCRT.dll__stat]
push eax
push ebx
call esi
add esp, 0x10
test eax, eax
jne 0x405597
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x430]
push eax
call esi
pop ecx
test eax, eax
pop ecx
jne 0x405597
mov dword [0x4200c8], 1
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret