Function at 0x4145e0
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x44001a
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
push ebx
push ebp
push esi
push edi
mov eax, dword [0x456ea4]
xor eax, esp
push eax
lea eax, [esp + 0xd4]
mov dword fs:[0], eax
mov edi, ecx
call fcn.0040ee00
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax + 0x68]
lea esi, [edi + 0x1c]
push 0x444b44
push 9
push esi
call ecx
mov ebx, dword [esp + 0xf0]
add esp, 0xc
test ebx, ebx
jne 0x414647
mov edx, dword [esi]
mov eax, dword [edx + 0x68]
push str._Install_section:
push 8
push esi
call eax
add esp, 0xc
lea ecx, [esp + 0x38]
call fcn.00415060
lea ecx, [esp + 0x38]
push ecx
push ebx
mov ecx, edi
mov dword [esp + 0xe4], 0
call fcn.00410af0
mov ebp, eax
test ebp, ebp
jle 0x414af8
mov edx, dword [edi + 0x38]
push edx
sub esp, 0x9c
lea ebx, [edi + 0x70]
mov ecx, esp
mov dword [esp + 0xc8], esp
push ebx
call fcn.0040cbd0
sub esp, 0x9c
lea eax, [esp + 0x174]
mov ecx, esp
mov dword [esp + 0x168], esp
push eax
mov byte [esp + 0x21c], 1
call fcn.0040cbd0
mov ecx, edi
mov byte [esp + 0x218], 0
call fcn.0040c6f0
test eax, eax
je 0x41471a
mov ecx, dword [esi]
mov edx, dword [ecx + 0x68]
push str.__Component_still_installed.
push 8
push esi
call edx
mov eax, dword [esi]
mov ecx, dword [eax + 0x68]
push str.Cancel_Installation____
push 0
push esi
call ecx
mov edx, dword [esi]
mov eax, dword [edx + 0x68]
push str.RestoreClients...
push 8
push esi
call eax
add esp, 0x24
mov ecx, edi
call fcn.0040dcb0
lea ecx, [esp + 0x38]
mov dword [esp + 0xdc], 0xffffffff
call fcn.00415110
mov eax, 0x3e8
jmp 0x414efd
push ebx
lea ecx, [esp + 0x3c]
call fcn.00415010
test al, al
jne 0x4147b7
cmp dword [edi + 0x3c], 0
je 0x4147b7
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x40]
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x68]
push edx
push eax
push str.Newer_installed_release_of_component_found:_You
push 0xa
push esi
call ecx
mov edx, dword [esi]
mov eax, dword [edx + 0x68]
push str.Component_will_be_installed_without_overwriting:_Only_new_client_entries_will_be_noted.
push 0xa
push esi
call eax
add esp, 0x20
cmp ebp, 2
je 0x414769
test ebp, ebp
jge 0x41477b
push 0x22
lea ecx, [edi + 0x114]
push str._REINSTALLALL_REINSTALLMODEvemus
call fcn.00406540
cmp ebp, 1
jne 0x414df7
lea eax, [edi + 0x70]
push eax
lea ecx, [esp + 0x3c]
call fcn.00414fc0
test al, al
je 0x414df7
call fcn.0041890e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x414b15
push 0x80004005
call fcn.00406210
push ebx
lea ecx, [esp + 0x3c]
call fcn.00414f20
test al, al
je 0x4147df
mov edx, dword [edi + 0x78]
mov eax, dword [esp + 0x40]
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x68]
push edx
push eax
push str._Wrong_here____But_older_component_release_installed___Installed:__s___Wanted_to_install_now:__s
push 1
push esi
call ecx
jmp 0x41482d
push ebx
lea ecx, [esp + 0x3c]
call fcn.00415010
test al, al
je 0x414807
mov eax, dword [edi + 0x78]
mov ecx, dword [esp + 0x40]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push eax
push ecx
push str.Equal_component_release_installed:__s___actual_release_of_this_setup:__s
push 0xa
push esi
call edx
jmp 0x41482d
push ebx
lea ecx, [esp + 0x3c]
call fcn.00414f70
test al, al
je 0x414830
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x40]
mov eax, dword [esi]
mov eax, dword [eax + 0x68]
push ecx
push edx
push str.Newer_component_release_installed:__s___actual_release_of_this_setup:__s
push 0xa
push esi
call eax
add esp, 0x14
mov ecx, dword [esi]
mov edx, dword [ecx + 0x68]
push str.Installation_skipped_without_starting_Windows_Installer:_Only_new_client_entries_will_be_noted._OK.
push 8
push esi
call edx
mov eax, dword [esi]
mov ecx, dword [eax + 0x68]
push 0x444b44
push 9
push esi
call ecx
mov edx, dword [edi + 4]
mov edx, dword [edx + 0x18]
lea ebp, [edi + 4]
add esp, 0x18
lea eax, [esp + 0x24]
push eax
mov ecx, ebp
call edx
mov ebx, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
mov byte [esp + 0xe0], 2
call edx
mov ebx, dword [ebx]
mov eax, dword [eax]
push ebx
push eax
call fcn.004262f5
add esp, 8
test eax, eax
mov eax, dword [esp + 0x20]
setne bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4148ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0xdc], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4148d6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test bl, bl
je 0x4148ed
mov ecx, dword [ebp]
mov edx, dword [ecx + 0x68]
push str.Installation_skipped_without_starting_Windows_Installer:_Only_new_client_entries_will_be_noted._OK.
push 8
push ebp
call edx
add esp, 0xc
mov ecx, edi
call fcn.0040f280
push 0x44a28c
mov ecx, edi
call fcn.0040f020
call fcn.0041890e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41491a
push 0x80004005
call fcn.00406210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push str.SOFTWARESiemensShared_ToolsCompSetup
lea ecx, [esp + 0x20]
mov byte [esp + 0xe0], 3
call fcn.00406960
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx - 8]
mov eax, 1
sub eax, dword [edx - 4]
mov bl, 4
or ecx, eax
mov byte [esp + 0xdc], bl
jge 0x41496b
push 0
lea ecx, [esp + 0x20]
call fcn.00407500
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x414a86
push 0x4486cc
lea ecx, [esp + 0x18]
call fcn.00406a30
mov edx, dword [esp + 0x14]
mov eax, dword [edx - 0xc]
lea eax, [eax + eax + 2]
push eax
push 0
lea ecx, [esp + 0x1c]
call fcn.00406ab0
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
push 1
push 0
push str.Restart
push ecx
call esi
lea edx, [edi + 0x10c]
push edx
lea ecx, [esp + 0x18]
call fcn.00407040
mov eax, dword [esp + 0x14]
mov eax, dword [eax - 0xc]
lea ecx, [eax + eax + 2]
push ecx
push 0
lea ecx, [esp + 0x1c]
call fcn.00406ab0
mov edx, dword [esp + 0x1c]
push eax
push 1
push 0
push str.ComponentEntry
push edx
call esi
lea eax, [edi + 0x118]
push eax
lea ecx, [edi + 0x138]
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.00405eb0
add esp, 0xc
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0xe0], 5
call fcn.00407040
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0xdc], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414a53
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx - 0xc]
lea edx, [eax + eax + 2]
push edx
push 0
lea ecx, [esp + 0x1c]
call fcn.00406ab0
push eax
mov eax, dword [esp + 0x20]
push 1
push 0
push str.LogFile
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.0040d5a0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0xdc], 3
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x414ab5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0xdc], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414add
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x38]
mov dword [esp + 0xdc], 0xffffffff
call fcn.00415110
xor eax, eax
jmp 0x414efd
jne 0x414760
mov ecx, dword [esi]
mov edx, dword [ecx + 0x68]
push str.Component_not__already_and_or_no_longer__installed:_Will_install_it...
push 0xa
push esi
call edx
add esp, 0xc
jmp 0x414df7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0xdc], 6
call fcn.0041890e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x414b47
push 0x80004005
call fcn.00406210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x24], eax
mov byte [esp + 0xdc], 7
call fcn.0041890e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x414b79
push 0x80004005
call fcn.00406210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x18], ebx
push str.SoftwareSiemensShared_Tools
lea ecx, [esp + 0x18]
mov byte [esp + 0xe0], 8
mov dword [esp + 0x24], 0x800
call fcn.00406a30
lea ecx, [edi + 0x10c]
push ecx
lea edx, [esp + 0x30]
push 0x442694
push edx
call fcn.00406010
add esp, 0xc
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0xe4], 9
call fcn.00406540
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0xdc], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414c00
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x442694
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00405f60
push 0x445a30
push eax
lea eax, [esp + 0x40]
push eax
mov byte [esp + 0xf4], 0xa
call fcn.00405f60
add esp, 0x18
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0xe0], 0xb
call fcn.00407040
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0xdc], 0xa
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414c69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0xdc], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414c91
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebp, dword [esp + 0x14]
mov ecx, dword [ebp - 8]
mov eax, 1
sub eax, dword [ebp - 4]
or ecx, eax
jge 0x414cb3
push 0
lea ecx, [esp + 0x18]
call fcn.00407500
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push 0
push ebp
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x414d86
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x20]
push edx
push eax
lea ecx, [esp + 0x20]
call fcn.00406ae0
mov edx, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x3c]
push ecx
push 0
push str.UninstallString
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x414d77
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
call fcn.00406b40
lea ecx, [esp + 0x18]
call fcn.0040c2a0
mov ebx, dword [esp + 0x18]
cmp dword [ebx - 0xc], 0
jl 0x414d7b
push str.msiexec
push ebx
call fcn.00426386
add esp, 8
test eax, eax
je 0x414d7b
sub eax, ebx
sar eax, 1
cmp eax, 0xffffffff
jle 0x414d7b
mov ecx, dword [esi]
mov edx, dword [ecx + 0x68]
push ebp
push str.MSI_entries_not_correct._Delete_home_key:__s
push 1
push esi
call edx
mov eax, dword [esp + 0x34]
add esp, 0x10
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push ebp
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x414d7b
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebx - 0x10]
mov byte [esp + 0xdc], 7
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x414daa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0xdc], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414dd2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
add ebp, 0xfffffff0
mov byte [esp + 0xdc], 0
lea ecx, [ebp + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414df7
mov ecx, dword [ebp]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebp
call edx
mov eax, dword [esp + 0xe4]
push eax
mov ecx, edi
call fcn.00413330
mov ebp, eax
test ebp, ebp
je 0x414e1f
mov ecx, dword [esi]
mov edx, dword [ecx + 0x68]
push ebp
push str._Installation_ended_NOT_normally._Return_code:__d
push 1
push esi
call edx
add esp, 0x10
push str.SOFTWARESiemensShared_ToolsCompSetup
lea ecx, [esp + 0x34]
call fcn.00406960
lea eax, [edi + 0x10c]
push eax
lea ecx, [esp + 0x2c]
push 0x442694
mov bl, 0xc
push ecx
mov byte [esp + 0xe8], bl
call fcn.00406010
add esp, 0xc
mov eax, dword [eax]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xe4], 0xd
call fcn.00406540
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0xdc], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x414e8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, dword [esp + 0xe4]
test esi, esi
je 0x414eb8
mov ecx, edi
call fcn.0040e8f0
push esi
mov ecx, edi
call fcn.0040cda0
mov ecx, edi
call fcn.0040dcb0
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0xdc], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x414ee7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x38]
mov dword [esp + 0xdc], 0xffffffff
call fcn.00415110
mov eax, ebp
mov ecx, dword [esp + 0xd4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xcc
ret 4