Function at 0x410dc0
Capabilities:
Delete registry key
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x46fed3
mov eax, dword fs:[0]
push eax
mov eax, 0x1048
call fcn.00454090
mov eax, dword [0x4a3dc0]
xor eax, esp
mov dword [esp + 0x1044], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a3dc0]
xor eax, esp
push eax
lea eax, [esp + 0x105c]
mov dword fs:[0], eax
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
mov edi, 0xf
xor ebx, ebx
or ebp, 0xffffffff
lea esi, [edi + 1]
test al, al
je 0x410e83
call fcn.00434cf0
push 0x20
push str.DeleteJABFilesAndKeys_Start_
lea ecx, [esp + 0x28]
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004042b0
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
push 0x47aecc
push 0xe5
push 0x47af10
push 1
mov dword [esp + 0x1078], ebx
call fcn.00434dd0
mov dword [esp + 0x1064], ebp
cmp dword [esp + 0x34], esi
jb 0x410e83
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004533ae
add esp, 4
push 0x7ff
lea edx, [esp + 0x85d]
push ebx
push edx
mov byte [esp + 0x864], bl
call fcn.004547c0
push 0x7ff
lea eax, [esp + 0x69]
push ebx
push eax
mov byte [esp + 0x70], bl
call fcn.004547c0
add esp, 0x18
push 0x400
lea ecx, [esp + 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 1
call fcn.00438770
add esp, 4
mov dword [esp + 0x18], eax
call fcn.00438750
push 1
test eax, eax
je 0x411095
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x410f5a
call fcn.00434cf0
push 0x2b
push str.DeleteJABFilesAndKeys__Installer_is_32_bit
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004042b0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push 0x47af80
push 0xf0
push 0x47af98
push 1
mov dword [esp + 0x1078], 1
call fcn.00434dd0
mov dword [esp + 0x1064], ebp
cmp dword [esp + 0x34], esi
jb 0x410f5a
mov eax, dword [esp + 0x20]
push eax
call fcn.004533ae
add esp, 4
call fcn.00433a00
push 1
test al, al
je 0x410fff
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x410fe2
call fcn.00434cf0
push 0x24
push str.DeleteJABFilesAndKeys__OS_is_64_bit
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004042b0
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
push 0x47b030
push 0xf4
push 0x47b048
push 1
mov dword [esp + 0x1078], 2
call fcn.00434dd0
mov dword [esp + 0x1064], ebp
cmp dword [esp + 0x34], esi
jb 0x410fe2
mov edx, dword [esp + 0x20]
push edx
call fcn.004533ae
add esp, 4
lea eax, [esp + 0x58]
push eax
push str._sWindowsAccessBridge_32.dll
push ebp
push 0x800
lea ecx, [esp + 0x868]
push ecx
jmp 0x411126
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x411078
call fcn.00434cf0
push 0x25
push str.DeleteJABFilesAndKeys___OS_is_32_bit
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004042b0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push 0x47b100
push 0xfb
push 0x47b118
push 1
mov dword [esp + 0x1078], 3
call fcn.00434dd0
mov dword [esp + 0x1064], ebp
cmp dword [esp + 0x34], esi
jb 0x411078
mov eax, dword [esp + 0x20]
push eax
call fcn.004533ae
add esp, 4
lea ecx, [esp + 0x58]
push ecx
push str._sWindowsAccessBridge.dll
push ebp
push 0x800
lea edx, [esp + 0x868]
push edx
jmp 0x411126
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x41110e
call fcn.00434cf0
push 0x39
push str.DeleteJABFilesAndKeys___OS_is_64_bit__Installer_is_64_bit
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004042b0
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push 0x47b1e0
push 0x102
push 0x47b1f8
push 1
mov dword [esp + 0x1078], 4
call fcn.00434dd0
mov dword [esp + 0x1064], ebp
cmp dword [esp + 0x34], esi
jb 0x41110e
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004533ae
add esp, 4
lea edx, [esp + 0x58]
push edx
push str._sWindowsAccessBridge_64.dll
push ebp
push 0x800
lea eax, [esp + 0x868]
push eax
call fcn.00454e68
lea ecx, [esp + 0x86c]
add esp, 0x14
push ecx
call fcn.00419ed0
add esp, 4
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x4111b9
call fcn.00434cf0
push 0x2b
push str.DeleteJABFilesAndKeys__remove_the_registry
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004042b0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push 0x47b2b4
push 0x10a
push 0x47b338
push 1
mov dword [esp + 0x1078], 5
call fcn.00434dd0
mov dword [esp + 0x1064], ebp
cmp dword [esp + 0x34], esi
jb 0x4111b9
mov eax, dword [esp + 0x20]
push eax
call fcn.004533ae
add esp, 4
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push edx
push ebx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityATs
push 0x80000002
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x411253
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x41124c
call fcn.00434cf0
push 0x48
push str.DeleteJABFilesAndKeys__ERROR___could_open_the_registry_with_RegOpenKeyEx
lea ecx, [esp + 0x28]
mov ebp, eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004042b0
lea eax, [esp + 0x20]
push eax
push 0x47b3f4
push 0x10e
push 0x47b440
push 1
mov ecx, ebp
mov dword [esp + 0x1078], 6
call fcn.00434dd0
cmp dword [esp + 0x34], esi
jb 0x41124c
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004533ae
add esp, 4
xor eax, eax
jmp 0x41145f
call fcn.00433a00
push 1
test al, al
je 0x4113d1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x4112db
call fcn.00434cf0
push 0x29
push str.DeleteJABFilesAndKeys___RegDeleteKeyEx_
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0x38], ebx
mov byte [esp + 0x28], bl
call fcn.004042b0
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
push 0x47b4b0
push 0x113
push 0x47b4c8
push 1
mov dword [esp + 0x1078], 7
call fcn.00434dd0
mov dword [esp + 0x1064], ebp
cmp dword [esp + 0x34], esi
jb 0x4112db
mov eax, dword [esp + 0x20]
push eax
call fcn.004533ae
add esp, 4
push str.AdvAPI32.dll
call fcn.00438a30
mov esi, eax
add esp, 4
cmp esi, ebx
jne 0x41132b
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x41144f
push str.DeleteJABFilesAndKeys___RegDeleteKeyEx_could_not_load_advapi32.dll
push 0x47b58c
push 0x116
push 0x47b600
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.004053c0
jmp 0x41144f
push str.RegDeleteKeyExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4a5a80], eax
push 1
cmp eax, ebx
jne 0x411380
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x4113c8
push str.DeleteJABFilesAndKeys___RegDeleteKeyEx_could_not_GetProcAddress
push 0x47b6b0
push 0x11a
push 0x47b6c8
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.004053c0
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x41144f
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x4113b2
push str.DeleteJABFilesAndKeys__calling__RegDeleteKeyEx
push 0x47b738
push 0x11c
push 0x47b750
push 1
call fcn.00434cf0
mov ecx, eax
call fcn.004053c0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
push ebx
push ecx
push 0x47b5d4
push edx
call dword [0x4a5a80]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x41144f
call fcn.00434cf0
mov ecx, eax
call fcn.00434d00
test al, al
je 0x41143f
call fcn.00434cf0
push 0x23
push str.DeleteJABFilesAndKeys__RegDeleteKey
lea ecx, [esp + 0x44]
mov ebp, eax
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
mov byte [esp + 0x44], bl
call fcn.004042b0
lea eax, [esp + 0x3c]
push eax
push str.DeleteJABFilesAndKeys
push 0x122
push 0x47b7d8
push 1
mov ecx, ebp
mov dword [esp + 0x1078], 8
call fcn.00434dd0
cmp dword [esp + 0x50], esi
jb 0x41143f
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.004533ae
add esp, 4
mov edx, dword [esp + 0x1c]
push str.Oracle_JavaAccessBridge
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x105c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1044]
xor ecx, esp
call fcn.0045407e
add esp, 0x1054
ret