Function at 0x1400014f4
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov rbx, qword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov rdx, rbx
mov ecx, dword [rax]
add rsp, 0x20
pop rbx
jmp 0x1400014f4
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r12
push r13
push r14
push r15
mov eax, 0x2110
call fcn.140008940
sub rsp, rax
mov rax, qword [0x140016018]
xor rax, rsp
mov qword [rsp + 0x2100], rax
mov rbx, rdx
mov r15d, ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov esi, 1
or eax, esi
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
call fcn.140005058
xor r12d, r12d
test eax, eax
setne r12b
and dword [rsp + 0x78], 0
and dword [rsp + 0x68], 0
and dword [rsp + 0x60], 0
and dword [rsp + 0x50], 0
and dword [rsp + 0x70], 0
xor r13d, r13d
and dword [rsp + 0x80], r13d
and dword [rsp + 0x48], r13d
and dword [rsp + 0x84], r13d
and dword [rsp + 0x40], r13d
mov r14d, esi
cmp r15d, esi
jle 0x1400018b4
add rbx, 8
lea rdx, str._new
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x1400015b4
mov r12d, esi
jmp 0x1400016ca
lea rdx, str._old
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x1400015da
call fcn.140005058
xor r12d, r12d
test eax, eax
setne r12b
jmp 0x1400016ca
lea rdx, str._high
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x1400015f6
mov dword [rsp + 0x78], esi
jmp 0x1400016ca
lea rdx, str._jpisetup
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140001612
mov dword [rsp + 0x68], esi
jmp 0x1400016ca
lea rdx, str._settreatas
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14000162e
mov dword [rsp + 0x60], esi
jmp 0x1400016ca
lea rdx, str._fullreg
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14000164a
mov dword [rsp + 0x50], esi
jmp 0x1400016ca
lea rdx, str._regdeploy
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140001663
mov dword [rsp + 0x70], esi
jmp 0x1400016ca
lea rdx, str._register
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14000167b
mov r13d, esi
jmp 0x1400016ca
lea rdx, str._disablewebjava
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140001697
mov dword [rsp + 0x80], esi
jmp 0x1400016ca
lea rdx, str._forceinstall
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x1400016b0
mov dword [rsp + 0x48], esi
jmp 0x1400016ca
lea rdx, str._nohint
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x1400016d0
mov dword [rsp + 0x84], esi
mov eax, dword [rsp + 0x40]
jmp 0x1400016f7
lea rdx, str._doHKCUSSVSetup
mov rcx, qword [rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14000179d
mov eax, esi
mov dword [rsp + 0x40], eax
cmp r15d, 2
jne 0x14000179d
add r14d, esi
add rbx, 8
cmp r14d, r15d
jl 0x140001599
test eax, eax
je 0x1400018b4
mov ebx, esi
mov dword [rsp + 0x40], ebx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREOracleJavaDeploy
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000179d
mov dword [rsp + 0x50], 0x800
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x1100]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.deployment.home.bin.ssvagent
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x78]
test eax, eax
je 0x1400017a4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140001f4a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x1100]
lea rcx, [rsp + 0x60]
call fcn.1400021e4
nop
lea rdx, [0x14000b988]
lea rcx, [rsp + 0x48]
call fcn.140002174
nop
mov ecx, 0x18
call fcn.1400082f0
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400017fa
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14000201c
mov r14, rax
jmp 0x1400017fd
xor r14d, r14d
test r14, r14
je 0x140001f78
lea rcx, [rsp + 0x60]
call fcn.140004e58
mov qword [rsp + 0x60], r14
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140001889
lea rdx, [0x14000b998]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000185c
xor edx, edx
xor ecx, ecx
call rax
xor ebx, ebx
test eax, eax
setne bl
mov dword [rsp + 0x40], ebx
lea rdx, [0x14000b9b8]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001889
xor edx, edx
xor ecx, ecx
call rax
test ebx, ebx
je 0x140001883
test eax, eax
je 0x140001883
mov ebx, esi
jmp 0x140001885
xor ebx, ebx
mov dword [rsp + 0x40], ebx
jmp 0x140001894
test r14, r14
je 0x1400018a3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x60]
call fcn.140004e58
mov eax, ebx
jmp 0x140001f4a
mov r14d, esi
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x100]
call sub.VCRUNTIME140.dll_memset
mov r9d, 0x800
lea r8, [rsp + 0x100]
mov edx, esi
xor ecx, ecx
call fcn.140005cbc
test eax, eax
je 0x14000179d
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x40]
call fcn.1400021e4
nop
lea rdx, str.deploy.dll
lea rcx, [rsp + 0x58]
call fcn.1400021e4
nop
mov r15d, 0x18
mov ecx, r15d
call fcn.1400082f0
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140001942
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14000201c
mov rbx, rax
jmp 0x140001944
xor ebx, ebx
test rbx, rbx
je 0x140001f83
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov qword [rsp + 0x40], rbx
lea rcx, [rsp + 0x58]
call fcn.140004e58
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140001ac2
cmp dword [rsp + 0x80], 0
je 0x140001a2a
lea rdx, str.UnregisterDeployEx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001ac2
mov dword [rsp + 0x90], 0x38
mov dword [rsp + 0x94], 4
and dword [rsp + 0xa0], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xa8], xmm0
and dword [rsp + 0xb8], 0
and dword [rsp + 0xbc], 0
and qword [rsp + 0xc0], 0
mov dword [rsp + 0x9c], 2
mov dword [rsp + 0xa4], esi
xor edx, edx
cmp dword [rsp + 0x84], edx
je 0x140001a06
xor ecx, ecx
jmp 0x140001a0e
lea rcx, [rsp + 0x90]
call rax
mov r14d, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r14d, r14d
jne 0x140001ac0
jmp 0x140001ac2
cmp dword [rsp + 0x70], 0
jne 0x140001a3a
test r13d, r13d
je 0x140001ad1
lea rdx, str.RegisterDeployEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001ac2
xor edx, edx
cmp dword [rsp + 0x48], edx
je 0x140001aae
mov dword [rsp + 0xc8], 0x38
mov dword [rsp + 0xcc], 4
and dword [rsp + 0xd8], edx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xe0], xmm0
and dword [rsp + 0xf0], edx
and dword [rsp + 0xf4], edx
and qword [rsp + 0xf8], rdx
mov dword [rsp + 0xd4], esi
mov dword [rsp + 0xdc], esi
lea rcx, [rsp + 0xc8]
jmp 0x140001ab0
xor ecx, ecx
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test r13d, r13d
jne 0x140001ad1
xor esi, esi
lea rcx, [rsp + 0x40]
call fcn.140004e58
jmp 0x14000179d
mov r9d, 0x400
lea r8, [rsp + 0x100]
mov edx, esi
xor ecx, ecx
call fcn.140005cbc
cmp eax, esi
jne 0x140001f3d
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x48]
call fcn.1400021e4
nop
lea rcx, [rsp + 0x58]
test r12d, r12d
je 0x140001b62
lea rdx, str.jp2ssv.dll
call fcn.1400021e4
nop
mov rcx, r15
call fcn.1400082f0
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140001b46
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14000201c
mov rbx, rax
jmp 0x140001b48
xor ebx, ebx
test rbx, rbx
je 0x140001f8e
lea rcx, [rsp + 0x48]
call fcn.140004e58
mov qword [rsp + 0x48], rbx
jmp 0x140001bb5
lea rdx, str._ssv.dll
call fcn.1400021e4
nop
mov rcx, r15
call fcn.1400082f0
mov qword [rsp + 0x88], rax
test rax, rax
je 0x140001b9b
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.14000201c
mov rbx, rax
jmp 0x140001b9d
xor ebx, ebx
test rbx, rbx
je 0x140001f99
lea rcx, [rsp + 0x48]
call fcn.140004e58
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x58]
call fcn.140004e58
nop
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140001f17
xor r14d, r14d
cmp dword [rsp + 0x78], r14d
je 0x140001ddf
cmp dword [rsp + 0x60], r14d
jne 0x140001bf4
test r13d, r13d
je 0x140001c48
lea rdx, str.UpdateTreatAsKey
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001c25
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
call rax
test r13d, r13d
jne 0x140001c48
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
xor eax, eax
jmp 0x140001f4a
lea rdx, [0x14000bab8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001c6a
xor ecx, ecx
call rax
test eax, eax
je 0x140001c6a
mov r15d, esi
jmp 0x140001c6d
xor r15d, r15d
call fcn.140005228
test eax, eax
jne 0x140001c7b
test r15d, r15d
je 0x140001cb2
lea rdx, [0x14000bad8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001cac
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
xor edx, edx
mov ecx, esi
call rax
test r12d, r12d
jne 0x140001cee
lea rdx, str.IsSSVEnabledInMozilla
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001ce8
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
call rax
test eax, eax
je 0x140001d21
lea rdx, str.RemoveAllMozillaJavaPlugins
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001d1f
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
call rax
cmp dword [rsp + 0x68], r14d
je 0x140001dbe
xor ecx, ecx
cmp r12d, esi
sete cl
call fcn.140001170
test eax, eax
je 0x140001d59
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
mov rcx, rbx
cmp dword [rsp + 0x50], r14d
lea rdx, [0x14000bb38]
je 0x140001d71
lea rdx, [0x14000bb60]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001d98
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
xor edx, edx
xor ecx, ecx
call rax
test eax, eax
jne 0x140001dbe
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
test r12d, r12d
je 0x140001dcd
call fcn.1400013a8
jmp 0x140001f17
lea rcx, [rsp + 0x100]
call fcn.1400013d4
jmp 0x140001f17
lea rdx, str.RegKeyBranchNeedsUpdating
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001e10
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
xor ecx, ecx
call rax
mov r14d, eax
lea rdx, str.CheckMozJavaPlugins
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001e48
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
test r14d, r14d
jne 0x140001ec3
call rax
test eax, eax
jne 0x140001ec3
lea rdx, str.RedirectAllStaticVersionKeys
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001e84
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
xor edx, edx
xor ecx, ecx
call rax
lea rdx, str.RedirectSelectedStaticVersionKeys
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001ebb
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
xor edx, edx
xor ecx, ecx
call rax
jmp 0x140001f0e
lea rdx, str.RunBrokerProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x140001ef1
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, esi
jmp 0x140001f4a
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, r14d
mov r8d, esi
mov edx, r12d
xor ecx, ecx
call rax
xor r14d, r14d
test eax, eax
sete r14b
jmp 0x140001f23
test rbx, rbx
je 0x140001f32
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rsp + 0x48]
call fcn.140004e58
nop
lea rcx, [rsp + 0x40]
call fcn.140004e58
mov eax, r14d
mov rcx, qword [rsp + 0x2100]
xor rcx, rsp
call fcn.1400089a0
lea r11, [rsp + 0x2110]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov ecx, 0x8007000e
call fcn.140009510
nop
mov ecx, 0x8007000e
call fcn.140009510
nop
mov ecx, 0x8007000e
call fcn.140009510
nop
mov ecx, 0x8007000e
call fcn.140009510
int3