Function at 0x10014980
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x3040
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x303c], eax
mov eax, dword [esp + 0x3044]
push ebx
push ebp
mov ebp, dword [esp + 0x3054]
push esi
mov esi, dword [esp + 0x305c]
push edi
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x3058]
push 0xc
mov dword [esp + 0x14], eax
call fcn.1003c33a
mov edi, eax
add esp, 4
test edi, edi
je 0x10014e10
lea eax, [edi + 8]
mov dword [edi + 4], 0
push esi
mov dword [esp + 0x1c], eax
mov dword [eax], 1
call fcn.1003c33a
push 0xc
mov dword [esp + 0x48], eax
mov dword [edi], eax
call fcn.1003c33a
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10014e10
push ebp
mov dword [ebx + 4], 0
mov dword [ebx + 8], 1
call fcn.1003c33a
push 0xc
mov dword [esp + 0x4c], eax
mov dword [ebx], eax
call fcn.1003c33a
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x10014e10
push dword [esp + 0x10]
mov dword [ebp + 4], 0
mov dword [ebp + 8], 1
call fcn.1003c33a
push 0xc
mov dword [esp + 0x18], eax
mov dword [ebp], eax
call fcn.1003c33a
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
je 0x10014e10
push dword [esp + 0x40]
lea esi, [eax + 8]
mov dword [eax + 4], 0
mov dword [esi], 1
call fcn.1003c33a
mov ecx, dword [esp + 0x10]
push 0
mov dword [ecx], eax
lea ecx, [esp + 0x1050]
push ecx
push 0
push 0
push 0
lea ecx, [esp + 0x2060]
push ecx
push dword [esp + 0x5c]
push dword [esp + 0x64]
push dword [esp + 0x34]
push eax
call fcn.10011f50
or ecx, 0xffffffff
add esp, 0x28
mov eax, ecx
lock xadd dword [esi], eax
dec eax
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
jne 0x10014b0a
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
test eax, eax
je 0x10014adf
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10014af6
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003c33a
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
add esp, 8
or ecx, 0xffffffff
mov eax, ecx
lea edx, [ebp + 8]
lock xadd dword [edx], eax
dec eax
jne 0x10014b4c
mov eax, dword [ebp]
test eax, eax
je 0x10014b27
push eax
call esi
mov dword [ebp], 0
mov eax, dword [ebp + 4]
test eax, eax
je 0x10014b3e
push eax
call fcn.1003b898
add esp, 4
mov dword [ebp + 4], 0
push 0xc
push ebp
call fcn.1003c33a
add esp, 8
or ecx, 0xffffffff
mov eax, ecx
lea edx, [ebx + 8]
lock xadd dword [edx], eax
dec eax
jne 0x10014b8c
mov eax, dword [ebx]
test eax, eax
je 0x10014b67
push eax
call esi
mov dword [ebx], 0
mov eax, dword [ebx + 4]
test eax, eax
je 0x10014b7e
push eax
call fcn.1003b898
add esp, 4
mov dword [ebx + 4], 0
push 0xc
push ebx
call fcn.1003c33a
add esp, 8
or ecx, 0xffffffff
mov eax, dword [esp + 0x18]
lock xadd dword [eax], ecx
dec ecx
jne 0x10014bc8
mov eax, dword [edi]
test eax, eax
je 0x10014ba6
push eax
call esi
mov dword [edi], 0
mov eax, dword [edi + 4]
test eax, eax
je 0x10014bbd
push eax
call fcn.1003b898
add esp, 4
mov dword [edi + 4], 0
push 0xc
push edi
call fcn.1003c33a
add esp, 8
mov eax, dword [esp + 0x3064]
cmp eax, 2
je 0x10014c62
push eax
lea eax, [esp + 0x50]
xor ecx, ecx
push eax
mov word [esp + 0x54], cx
call fcn.10011a00
add esp, 8
test eax, eax
je 0x10014cdd
lea ecx, [esp + 0x4c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10014c00
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
sub ecx, edx
sar ecx, 1
cmp word [esp + ecx*2 + 0x4a], 0x5c
je 0x10014c31
push 0x1003e9cc
lea eax, [esp + 0x50]
push 0x800
push eax
call esi
add esp, 0xc
push str.plugins_
lea eax, [esp + 0x50]
push 0x800
push eax
call esi
push 1
push dword [esp + 0x3078]
lea eax, [esp + 0x1060]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.100146b0
add esp, 0x1c
jmp 0x10014cdf
push 0xf003f
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], 0x1000
call fcn.10003a10
test eax, eax
je 0x10014cf8
mov eax, dword [esp + 0x34]
test eax, eax
je 0x10014cdd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x304c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x3040
ret
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x28]
push 0xf003f
push str.JavaSoft
push esi
call fcn.10003a10
test eax, eax
je 0x10014d2e
mov eax, dword [esp + 0x28]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10014d25
push eax
call edi
test esi, esi
je 0x10014cdd
push esi
call edi
jmp 0x10014cdd
mov edi, dword [esp + 0x28]
lea ecx, [esp + 0x1c]
push 0xf003f
push str.Java_Runtime_Environment
push edi
call fcn.10003a10
test eax, eax
je 0x10014d72
mov eax, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10014d5b
push eax
call ebx
test edi, edi
je 0x10014d62
push edi
call ebx
test esi, esi
je 0x10014cdd
push esi
call ebx
jmp 0x10014cdd
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x50]
push eax
push str.BrowserJavaVersion
lea ecx, [esp + 0x28]
call fcn.10003ac0
mov ebp, dword [esp + 0x1c]
test eax, eax
jne 0x10014ddc
lea eax, [esp + 0x204c]
push eax
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x10014ddc
push str.BrowserJavaVersion
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10014ddc
lea ecx, [esp + 0x1c]
call fcn.100036e0
lea ecx, [esp + 0x28]
call fcn.100036e0
lea ecx, [esp + 0x34]
call fcn.100036e0
jmp 0x10014cdd
cmp dword [esp + 0x3068], 0
je 0x10014deb
call sym.deploy.dll_UnregJavaConsole
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x10014df8
push ebp
call ebx
test edi, edi
je 0x10014dff
push edi
call ebx
test esi, esi
je 0x10014e06
push esi
call ebx
mov eax, 1
jmp 0x10014cdf
push 0x8007000e
call fcn.1003c33a
int3