Function at 0x406fa0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x44945b
mov eax, dword fs:[0]
push eax
sub esp, 0xa34
mov eax, dword [0x4563d0]
xor eax, esp
mov dword [esp + 0xa30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4563d0]
xor eax, esp
push eax
lea eax, [esp + 0xa48]
mov dword fs:[0], eax
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], edi
mov word [esp + 0x24], di
mov eax, str.SoftwareIntelICCInst
mov dword [esp + 0xa50], edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x407000
sub eax, edx
sar eax, 1
push eax
push str.SoftwareIntelICCInst
lea esi, [esp + 0x28]
call fcn.004031d0
push 0xa
push str.Uninstall
mov ecx, esi
call fcn.00413b50
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x40703b
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x407060
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x248]
push eax
mov eax, dword [esp + 0x20]
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x50]
push edx
push edi
push eax
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x3c], 0x400
call ebp
mov esi, eax
test esi, esi
jne 0x4070b9
mov ecx, dword [esp + 0x1c]
shr ecx, 1
lea edx, [esp + 0x3c]
push edx
mov word [esp + ecx*2 + 0x248], ax
push ebx
lea ecx, [esp + 0x24c]
call fcn.00407260
add edi, 1
test esi, esi
je 0x407060
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
push ecx
push ebx
call fcn.00415ec0
mov edx, str.dump
call fcn.004015c0
test eax, eax
je 0x4070f7
mov ecx, str.dump
call fcn.00401690
mov edx, eax
mov ecx, ebx
call fcn.0040fd50
mov edx, dword [ebx + 4]
mov esi, dword [edx]
mov ebp, ebx
mov edi, edi
test ebp, ebp
mov edi, dword [ebx + 4]
je 0x40710b
cmp ebp, ebx
je 0x407110
call fcn.00422ffd
cmp esi, edi
je 0x4071dc
test ebp, ebp
jne 0x407121
call fcn.00422ffd
cmp esi, dword [ebp + 4]
jne 0x40712b
call fcn.00422ffd
mov eax, dword [esi + 8]
lea edi, [esi + 8]
add eax, 0xffffffff
cmp eax, 0xa
ja case.0x40713d.2
jmp dword [eax*4 + 0x407228]
cmp esi, dword [ebp + 4]
jne 0x40714e
call fcn.00422ffd
push edi
mov edi, ebx
call fcn.0040df00
jmp case.0x40713d.2
cmp esi, dword [ebp + 4]
jne 0x407162
call fcn.00422ffd
mov ecx, edi
call fcn.0040e0a0
jmp case.0x40713d.2
cmp esi, dword [ebp + 4]
jne 0x407175
call fcn.00422ffd
mov ecx, edi
call fcn.0040e210
jmp case.0x40713d.2
cmp esi, dword [ebp + 4]
jne 0x407188
call fcn.00422ffd
push edi
call fcn.0040e840
jmp case.0x40713d.2
cmp esi, dword [ebp + 4]
jne 0x40719a
call fcn.00422ffd
push ebx
mov ecx, edi
call fcn.0040ea00
jmp case.0x40713d.2
cmp esi, dword [ebp + 4]
jne 0x4071ae
call fcn.00422ffd
mov ecx, edi
mov edi, ebx
call fcn.0040ede0
jmp case.0x40713d.2
cmp esi, dword [ebp + 4]
jne 0x4071c3
call fcn.00422ffd
push ebx
mov ecx, edi
call fcn.0040ef40
cmp esi, dword [ebp + 4]
jne 0x4071d5
call fcn.00422ffd
mov esi, dword [esi]
jmp 0x407100
push str.SoftwareIntelICCInst
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x38], 8
jb 0x407200
mov eax, dword [esp + 0x24]
push eax
call fcn.00422ece
add esp, 4
mov ecx, dword [esp + 0xa48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa30]
xor ecx, esp
call fcn.00422834
add esp, 0xa40
ret