Function at 0x409cd0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4432bb
mov eax, dword fs:[0]
push eax
sub esp, 0xa34
mov eax, dword [0x4513e0]
xor eax, esp
mov dword [esp + 0xa30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4513e0]
xor eax, esp
push eax
lea eax, [esp + 0xa48]
mov dword fs:[0], eax
xor ebp, ebp
mov edi, ecx
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], ebp
mov word [esp + 0x24], bp
mov eax, str.SoftwareIntelCIM
mov dword [esp + 0xa50], ebp
xor ebx, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x409d31
sub eax, edx
sar eax, 1
push eax
push str.SoftwareIntelCIM
lea esi, [esp + 0x28]
call fcn.004035b0
push 0xa
push str.Uninstall
mov ecx, esi
call fcn.00403430
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x409d6c
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebp
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x248]
push eax
mov eax, dword [esp + 0x20]
push ebp
push ebp
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x50]
push edx
push ebx
push eax
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x3c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, ebp
jne 0x409ddd
mov ecx, dword [esp + 0x1c]
shr ecx, 1
mov word [esp + ecx*2 + 0x244], bp
push edi
lea edx, [esp + 0x248]
lea ecx, [esp + 0x40]
call fcn.00409fb0
add ebx, 1
cmp esi, ebp
je 0x409d83
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push eax
push edi
call fcn.00419e70
mov edx, str.dump
call fcn.004051c0
test eax, eax
je 0x409e1b
mov ecx, str.dump
call fcn.00405260
mov edx, eax
mov ecx, edi
call fcn.00414aa0
mov ecx, dword [edi + 4]
mov ebx, dword [ecx]
mov ebp, edi
test ebp, ebp
mov esi, dword [edi + 4]
je 0x409e2d
cmp ebp, edi
je 0x409e32
call fcn.00429e93
cmp ebx, esi
je 0x409f2a
test ebp, ebp
jne 0x409e43
call fcn.00429e93
cmp ebx, dword [ebp + 4]
jne 0x409e4d
call fcn.00429e93
mov eax, dword [ebx + 8]
lea esi, [ebx + 8]
add eax, 0xffffffff
cmp eax, 0xb
ja case.0x409e5f.2
jmp dword [eax*4 + 0x409f78]
cmp ebx, dword [ebp + 4]
jne 0x409e70
call fcn.00429e93
push edi
mov ecx, esi
call fcn.00412080
jmp case.0x409e5f.2
cmp ebx, dword [ebp + 4]
jne 0x409e87
call fcn.00429e93
push edi
mov ecx, esi
call fcn.00412440
jmp case.0x409e5f.2
cmp ebx, dword [ebp + 4]
jne 0x409e9e
call fcn.00429e93
mov ecx, esi
call fcn.00412620
jmp case.0x409e5f.2
cmp ebx, dword [ebp + 4]
jne 0x409eb1
call fcn.00429e93
push edi
mov ecx, esi
call fcn.00412cb0
jmp case.0x409e5f.2
cmp ebx, dword [ebp + 4]
jne 0x409ec5
call fcn.00429e93
push edi
mov ecx, esi
call fcn.00413010
jmp case.0x409e5f.2
cmp ebx, dword [ebp + 4]
jne 0x409ed9
call fcn.00429e93
mov ecx, esi
call fcn.00413500
jmp case.0x409e5f.2
cmp ebx, dword [ebp + 4]
jne 0x409eec
call fcn.00429e93
call fcn.00410920
jmp case.0x409e5f.2
cmp ebx, dword [ebp + 4]
jne 0x409efd
call fcn.00429e93
push edi
mov eax, esi
call fcn.004136a0
jmp case.0x409e5f.2
cmp ebx, dword [ebp + 4]
jne 0x409f11
call fcn.00429e93
push edi
mov ecx, esi
call fcn.00413760
cmp ebx, dword [ebp + 4]
jne 0x409f23
call fcn.00429e93
mov ebx, dword [ebx]
jmp 0x409e22
push str.SoftwareIntelCIM
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x38], 8
jb 0x409f4e
mov edx, dword [esp + 0x24]
push edx
call fcn.00429d64
add esp, 4
mov ecx, dword [esp + 0xa48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa30]
xor ecx, esp
call fcn.004289ca
add esp, 0xa40
ret