Function at 0x10028bb0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
push eax
call fcn.10017470
mov esi, dword [esp + 0x1c]
add esp, 4
mov dword [esp + 0x14], esi
test esi, esi
je 0x10028bd4
lock inc dword [esi + 8]
push 0xc
call fcn.10031690
mov edi, eax
add esp, 4
test edi, edi
je 0x10028c00
push str._ssvagent.exe
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call fcn.10031690
mov dword [edi], eax
jmp 0x10028c02
xor edi, edi
mov dword [esp + 0x18], edi
test edi, edi
je 0x10028fc6
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
call fcn.10003700
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
jne 0x10028c60
mov eax, dword [edi]
test eax, eax
je 0x10028c3e
push eax
call ebp
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x10028c55
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.10031690
add esp, 8
push 0xc
call fcn.10031690
mov edi, eax
add esp, 4
test edi, edi
je 0x10028c8c
push 0x10042c8c
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call fcn.10031690
mov dword [edi], eax
jmp 0x10028c8e
xor edi, edi
mov dword [esp + 0x10], edi
test edi, edi
je 0x10028fc6
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
push 0xc
call fcn.10031690
mov edi, eax
add esp, 4
test edi, edi
je 0x10028cd4
push 0x10042c8c
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call fcn.10031690
mov dword [edi], eax
jmp 0x10028cd6
xor edi, edi
mov dword [esp + 0x18], edi
test edi, edi
je 0x10028fc6
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x10028d2b
mov eax, dword [edi]
test eax, eax
je 0x10028d09
push eax
call ebp
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x10028d20
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.10031690
add esp, 8
push 0xc
call fcn.10031690
mov edi, eax
add esp, 4
test edi, edi
je 0x10028d57
push str.__doHKCUSSVSetup
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call fcn.10031690
mov dword [edi], eax
jmp 0x10028d59
xor edi, edi
mov dword [esp + 0x18], edi
test edi, edi
je 0x10028fc6
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x10028dae
mov eax, dword [edi]
test eax, eax
je 0x10028d8c
push eax
call ebp
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x10028da3
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.10031690
add esp, 8
push 0xc
call fcn.10031690
mov edi, eax
add esp, 4
test edi, edi
je 0x10028dda
push str.doHKCUSSVSetup___cmd:
mov dword [edi + 4], 0
mov dword [edi + 8], 1
call fcn.10031690
mov dword [edi], eax
jmp 0x10028ddc
xor edi, edi
mov dword [esp + 0x18], edi
test edi, edi
je 0x10028fc6
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.10003700
mov edi, dword [esp + 0x18]
test edi, edi
je 0x10028e02
mov eax, dword [edi]
jmp 0x10028e06
xor eax, eax
xor edi, edi
push eax
call fcn.10003ca0
add esp, 4
test edi, edi
je 0x10028e4e
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x10028e4e
mov eax, dword [edi]
test eax, eax
je 0x10028e2c
push eax
call ebp
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x10028e43
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.10031690
add esp, 8
push 0x2001f
push dword [esp + 0x30]
push str.deployment.home.bin.ssvagent
push str.SOFTWAREOracleJavaDeploy
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10016530
mov edi, dword [esp + 0x24]
add esp, 0x14
test edi, edi
je 0x10028e7a
mov ecx, dword [edi]
jmp 0x10028e7c
xor ecx, ecx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10028e88
mov eax, dword [eax]
jmp 0x10028e8a
xor eax, eax
push ecx
push eax
call fcn.1001fc60
add esp, 8
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
push 2
push str.SOFTWAREOracleJavaDeploy
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10003a10
test eax, eax
je 0x10028eda
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10028efb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10028efb
mov ebp, dword [esp + 0x1c]
push str.deployment.home.bin.ssvagent
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test ebp, ebp
je 0x10028ef5
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test edi, edi
je 0x10028f3a
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x10028f3a
mov eax, dword [edi]
test eax, eax
je 0x10028f18
push eax
call ebp
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x10028f2f
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.10031690
add esp, 8
mov edi, dword [esp + 0x14]
test edi, edi
je 0x10028f7d
mov eax, ebx
lock xadd dword [edi + 8], eax
dec eax
jne 0x10028f7d
mov eax, dword [edi]
test eax, eax
je 0x10028f5b
push eax
call ebp
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x10028f72
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.10031690
add esp, 8
test esi, esi
je 0x10028fba
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x10028fba
mov eax, dword [esi]
test eax, eax
je 0x10028f98
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10028faf
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
push 0x8007000e
call fcn.10031690
int3