Function at 0x100019e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x478
mov eax, dword [0x10028164]
xor eax, esp
mov dword [esp + 0x474], eax
push esi
mov esi, dword [esp + 0x480]
lea eax, [esp + 0x270]
push edi
push 0x104
push 0
push eax
call fcn.1000c990
push 0x104
lea eax, [esp + 0x388]
push 0
push eax
call fcn.1000c990
push 0x104
lea eax, [esp + 0x18c]
push 0
push eax
call fcn.1000c990
push 0x104
lea eax, [esp + 0x94]
push 0
push eax
call fcn.1000c990
add esp, 0x30
mov dword [esp + 0xc], 0x104
lea ecx, [esi + 4]
push dword [esp + 0x48c]
push dword [esp + 0x48c]
call fcn.10001680
mov edi, eax
test edi, edi
js 0x10001dc7
cmp dword [esi + 0xac], 0
je 0x10001d71
lea eax, [esp + 8]
push eax
push 1
push 0
push str.JNLPFileShellOpenCommand
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
js 0x10001d71
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x278]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
js 0x10001d67
lea eax, [esp + 0x274]
push str.javaws.exe
push eax
call fcn.10013c81
add esp, 8
test eax, eax
jne 0x10001b04
lea eax, [esp + 0x274]
push str.jp2launcher.exe
push eax
call fcn.10013c81
add esp, 8
test eax, eax
je 0x10001d67
push ebx
push ebp
mov byte [eax], 0
lea eax, [esp + 0x27c]
push 0x103
push eax
lea eax, [esp + 0x180]
push eax
call fcn.10013c81
mov ebx, dword [sym.imp.kernel32.dll_lstrlenA]
lea eax, [esp + 0x184]
add esp, 0xc
push eax
call ebx
mov ebp, 0x103
mov ecx, ebp
sub ecx, eax
lea eax, [esp + 0x178]
push ecx
push str.jp2launcher.exe_
push eax
call fcn.10013c81
add esp, 0xc
lea eax, [esp + 0x178]
push eax
call ebx
mov ecx, ebp
sub ecx, eax
lea eax, [esp + 0x178]
push ecx
push str.__securejws
push eax
call fcn.10013c81
add esp, 0xc
lea eax, [esp + 0x74]
push 0
push 0
push 0x104
push eax
push 0xffffffffffffffff
push dword [esi + 0xac]
push 0
push 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov bl, byte [esp + 0x74]
test bl, bl
je 0x10001c60
lea edx, [esp + 0x74]
xor ecx, ecx
lea eax, [edx + 1]
mov dword [esp + 0x18], eax
mov al, byte [edx]
inc edx
test al, al
jne 0x10001bb2
sub edx, dword [esp + 0x18]
nop dword [eax]
cmp bl, 0x22
je 0x10001bcf
cmp bl, 0x27
je 0x10001bcf
cmp bl, 0x5c
jne 0x10001bda
cmp ecx, edx
jge 0x10001bda
mov bl, byte [esp + ecx + 0x75]
inc ecx
jmp 0x10001bc0
lea eax, [esp + 0x74]
push 0x20
push eax
call fcn.10013c81
add esp, 8
test eax, eax
jne 0x10001c26
lea eax, [esp + 0x74]
push 9
push eax
call fcn.10013c81
add esp, 8
test eax, eax
jne 0x10001c26
lea eax, [esp + 0x74]
push 0xd
push eax
call fcn.10013c81
add esp, 8
test eax, eax
jne 0x10001c26
lea eax, [esp + 0x74]
push 0xa
push eax
call fcn.10013c81
add esp, 8
test eax, eax
je 0x10001c2b
mov eax, 1
cmp bl, 0x2d
je 0x10001c60
mov ebx, dword [sym.imp.kernel32.dll_lstrlenA]
test eax, eax
jne 0x10001c66
lea eax, [esp + 0x178]
push eax
call ebx
mov ecx, ebp
sub ecx, eax
lea eax, [esp + 0x74]
push ecx
push eax
lea eax, [esp + 0x180]
push eax
call fcn.10013c81
add esp, 0xc
jmp 0x10001c66
mov ebx, dword [sym.imp.kernel32.dll_lstrlenA]
lea eax, [esp + 0x380]
push eax
call ebx
mov ecx, ebp
sub ecx, eax
lea eax, [esp + 0x27d]
push ecx
push eax
lea eax, [esp + 0x388]
push eax
call fcn.10013c81
add esp, 0xc
lea eax, [esp + 0x380]
push eax
call ebx
sub ebp, eax
lea eax, [esp + 0x380]
push ebp
push str.jp2launcher.exe
push eax
call fcn.10013c81
add esp, 0xc
cmp dword [esi + 0xb0], 0
je 0x10001ccf
push 0
push str.Launch_Command_line
lea eax, [esp + 0x180]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x44
push eax
lea eax, [esp + 0x34]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x198]
movlpd qword [esp + 0x54], xmm0
push eax
lea eax, [esp + 0x3a4]
movlpd qword [esp + 0x60], xmm0
push eax
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
movlpd qword [esp + 0x8c], xmm0
movlpd qword [esp + 0x94], xmm0
call fcn.1000aeb0
add esp, 0x28
test eax, eax
js 0x10001d65
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10001d65
mov ecx, dword [esp + 0x24]
mov ebx, dword [sym.imp.kernel32.dll_CloseHandle]
test ecx, ecx
je 0x10001d62
push ecx
call ebx
mov eax, dword [esp + 0x20]
push eax
call ebx
pop ebp
pop ebx
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x10001db6
push 0
push 0
push 0x104
lea ecx, [esp + 0x78]
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov eax, dword [esi + 0xb4]
test eax, eax
je 0x10001db6
lea eax, [esp + 0x6c]
push str.false
push eax
call fcn.10013c81
add esp, 8
test eax, eax
je 0x10001dc5
cmp dword [esi + 0xb8], 0
jne 0x10001dc5
push esi
call sub.urlmon.dll_HlinkGoBack
mov eax, edi
mov ecx, dword [esp + 0x47c]
pop edi
pop esi
xor ecx, esp
call fcn.1000bc54
add esp, 0x478
ret 0xc