Function at 0x140001100
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov rbx, qword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov rdx, rbx
mov ecx, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x1400014bc
push r13
push r14
push r15
mov eax, 0x2110
call fcn.140008510
sub rsp, rax
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov qword [rsp + 0x2130], rsi
mov qword [rsp + 0x2138], rdi
mov qword [rsp + 0x2140], r12
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rsi, rdx
mov r13d, ecx
call fcn.140004dd0
xor r12d, r12d
test eax, eax
setne r12b
and dword [rsp + 0x70], 0
and dword [rsp + 0x60], 0
and dword [rsp + 0x78], 0
and dword [rsp + 0x50], 0
and dword [rsp + 0x68], 0
xor r15d, r15d
and dword [rsp + 0x80], r15d
and dword [rsp + 0x48], r15d
and dword [rsp + 0x84], r15d
and dword [rsp + 0x40], r15d
lea edi, [r15 + 1]
mov r14d, edi
cmp r13d, edi
jle 0x14000185d
add rsi, 8
lea rdx, str._new
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14000157e
mov r12d, edi
jmp 0x140001694
lea rdx, str._old
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x1400015a4
call fcn.140004dd0
xor r12d, r12d
test eax, eax
setne r12b
jmp 0x140001694
lea rdx, str._high
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x1400015c0
mov dword [rsp + 0x70], edi
jmp 0x140001694
lea rdx, str._jpisetup
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x1400015dc
mov dword [rsp + 0x60], edi
jmp 0x140001694
lea rdx, str._settreatas
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x1400015f8
mov dword [rsp + 0x78], edi
jmp 0x140001694
lea rdx, str._fullreg
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140001614
mov dword [rsp + 0x50], edi
jmp 0x140001694
lea rdx, str._regdeploy
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14000162d
mov dword [rsp + 0x68], edi
jmp 0x140001694
lea rdx, str._register
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140001645
mov r15d, edi
jmp 0x140001694
lea rdx, str._disablewebjava
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140001661
mov dword [rsp + 0x80], edi
jmp 0x140001694
lea rdx, str._forceinstall
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14000167a
mov dword [rsp + 0x48], edi
jmp 0x140001694
lea rdx, str._nohint
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14000169a
mov dword [rsp + 0x84], edi
mov eax, dword [rsp + 0x40]
jmp 0x1400016c1
lea rdx, str._doHKCUSSVSetup
mov rcx, qword [rsi]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
mov eax, edi
jne 0x140001e68
mov dword [rsp + 0x40], eax
cmp r13d, 2
jne 0x140001e68
add r14d, edi
add rsi, 8
cmp r14d, r13d
jl 0x140001563
test eax, eax
je 0x14000185d
mov esi, edi
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREOracleJavaDeploy
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140001711
mov eax, edi
jmp 0x140001e68
mov dword [rsp + 0x50], 0x800
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x1100]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.deployment.home.bin.ssvagent
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x78]
test eax, eax
je 0x140001770
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000170a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x1100]
lea rcx, [rsp + 0x70]
call fcn.1400020a4
nop
lea rdx, [0x14000c560]
lea rcx, [rsp + 0x48]
call fcn.14000202c
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.1400022c4
nop
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400017c5
mov rcx, qword [rax]
jmp 0x1400017c7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140001832
lea rdx, [0x14000c570]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001801
xor edx, edx
xor ecx, ecx
call rax
xor esi, esi
test eax, eax
setne sil
mov dword [rsp + 0x40], esi
lea rdx, [0x14000c590]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001832
xor edx, edx
xor ecx, ecx
call rax
test esi, esi
je 0x14000182c
test eax, eax
je 0x14000182c
mov esi, edi
mov dword [rsp + 0x40], edi
jmp 0x140001832
xor esi, esi
mov dword [rsp + 0x40], esi
jmp 0x14000183d
test r14, r14
je 0x14000184c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x70]
call fcn.140004c80
mov eax, esi
jmp 0x140001e68
mov r14d, edi
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x100]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x800
lea r8, [rsp + 0x100]
mov edx, edi
xor ecx, ecx
call fcn.140005a10
test eax, eax
je 0x14000170a
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x40]
call fcn.1400020a4
nop
lea rdx, str.deploy.dll
lea rcx, [rsp + 0x58]
call fcn.1400020a4
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call fcn.1400022c4
nop
lea rcx, [rsp + 0x58]
call fcn.140004c80
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x1400018e2
mov rcx, qword [rax]
jmp 0x1400018e4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
jne 0x140001901
lea rcx, [rsp + 0x40]
call fcn.140004c80
jmp 0x14000170a
cmp dword [rsp + 0x80], 0
je 0x1400019ac
lea rdx, str.UnregisterDeployEx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400018f2
mov dword [rsp + 0x88], 0x38
mov dword [rsp + 0x8c], 4
and dword [rsp + 0x98], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa0], xmm0
and dword [rsp + 0xb0], 0
and dword [rsp + 0xb4], 0
and qword [rsp + 0xb8], 0
mov dword [rsp + 0x94], 2
mov dword [rsp + 0x9c], edi
xor edx, edx
cmp dword [rsp + 0x84], edx
je 0x140001988
xor ecx, ecx
jmp 0x140001990
lea rcx, [rsp + 0x88]
call rax
mov r14d, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14d, r14d
jne 0x140001a46
jmp 0x1400018f2
cmp dword [rsp + 0x68], 0
jne 0x1400019bc
test r15d, r15d
je 0x140001a4d
lea rdx, str.RegisterDeployEx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400018f2
xor edx, edx
cmp dword [rsp + 0x48], edx
je 0x140001a34
mov dword [rsp + 0xc0], 0x38
mov dword [rsp + 0xc4], 4
and dword [rsp + 0xd0], edx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd8], xmm0
and dword [rsp + 0xe8], edx
and dword [rsp + 0xec], edx
and qword [rsp + 0xf0], rdx
mov dword [rsp + 0xcc], edi
mov dword [rsp + 0xd4], edi
lea rcx, [rsp + 0xc0]
jmp 0x140001a36
xor ecx, ecx
call rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r15d, r15d
jne 0x140001a4d
xor edi, edi
jmp 0x1400018f2
mov r9d, 0x400
lea r8, [rsp + 0x100]
mov edx, edi
xor ecx, ecx
call fcn.140005a10
cmp eax, edi
jne 0x140001e5b
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x48]
call fcn.1400020a4
nop
lea rcx, [rsp + 0x58]
test r12d, r12d
je 0x140001aa8
lea rdx, str.jp2ssv.dll
call fcn.1400020a4
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.1400022c4
nop
jmp 0x140001ac5
lea rdx, str._ssv.dll
call fcn.1400020a4
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.1400022c4
nop
lea rcx, [rsp + 0x58]
call fcn.140004c80
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140001adf
mov rcx, qword [rax]
jmp 0x140001ae1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140001e35
xor r14d, r14d
cmp dword [rsp + 0x70], r14d
je 0x140001cfd
cmp dword [rsp + 0x78], r14d
jne 0x140001b12
test r15d, r15d
je 0x140001b66
lea rdx, str.UpdateTreatAsKey
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001b43
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
call rax
test r15d, r15d
jne 0x140001b66
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
xor eax, eax
jmp 0x140001e68
lea rdx, [0x14000c680]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001b88
xor ecx, ecx
call rax
test eax, eax
je 0x140001b88
mov r15d, edi
jmp 0x140001b8b
xor r15d, r15d
call fcn.140004f98
test eax, eax
jne 0x140001b99
test r15d, r15d
je 0x140001bd0
lea rdx, [0x14000c6a0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001bca
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
xor edx, edx
mov ecx, edi
call rax
test r12d, r12d
jne 0x140001c0c
lea rdx, str.IsSSVEnabledInMozilla
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001c06
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
call rax
test eax, eax
je 0x140001c3f
lea rdx, str.RemoveAllMozillaJavaPlugins
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001c3d
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
call rax
cmp dword [rsp + 0x60], r14d
je 0x140001cdc
xor ecx, ecx
cmp r12d, edi
sete cl
call fcn.140001170
test eax, eax
je 0x140001c77
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
mov rcx, rsi
cmp dword [rsp + 0x50], r14d
lea rdx, [0x14000c700]
je 0x140001c8f
lea rdx, [0x14000c728]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001cb6
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
xor edx, edx
xor ecx, ecx
call rax
test eax, eax
jne 0x140001cdc
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
test r12d, r12d
je 0x140001ceb
call fcn.140001394
jmp 0x140001e35
lea rcx, [rsp + 0x100]
call fcn.1400013c0
jmp 0x140001e35
lea rdx, str.RegKeyBranchNeedsUpdating
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001d2e
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
xor ecx, ecx
call rax
mov r14d, eax
lea rdx, str.CheckMozJavaPlugins
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001d66
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
test r14d, r14d
jne 0x140001de1
call rax
test eax, eax
jne 0x140001de1
lea rdx, str.RedirectAllStaticVersionKeys
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001da2
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
xor edx, edx
xor ecx, ecx
call rax
lea rdx, str.RedirectSelectedStaticVersionKeys
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001dd9
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
xor edx, edx
xor ecx, ecx
call rax
jmp 0x140001e2c
lea rdx, str.RunBrokerProcess
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001e0f
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, edi
jmp 0x140001e68
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, r14d
mov r8d, edi
mov edx, r12d
xor ecx, ecx
call rax
xor r14d, r14d
test eax, eax
sete r14b
jmp 0x140001e41
test rsi, rsi
je 0x140001e50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x48]
call fcn.140004c80
nop
lea rcx, [rsp + 0x40]
call fcn.140004c80
mov eax, r14d
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.140008580
lea r11, [rsp + 0x2110]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret