Function at 0x408830
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x43f366
mov eax, dword fs:[0]
push eax
sub esp, 0xa54
mov eax, dword [0x44f3d8]
xor eax, esp
mov dword [esp + 0xa50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44f3d8]
xor eax, esp
push eax
lea eax, [esp + 0xa68]
mov dword fs:[0], eax
xor ebp, ebp
mov ebx, ecx
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], bp
mov eax, str.SoftwareIntelICCS
mov dword [esp + 0xa70], ebp
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x408890
sub eax, edx
sar eax, 1
push eax
push str.SoftwareIntelICCS
lea esi, [esp + 0x48]
call fcn.00404120
push 0xa
push str.Uninstall
mov ecx, esi
call fcn.00403fa0
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x4088cb
lea eax, [esp + 0x44]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebp
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x4088f0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x268]
push eax
mov eax, dword [esp + 0x20]
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x70]
push edx
push ebp
push eax
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x40], 0x400
call edi
mov esi, eax
test esi, esi
jne 0x408948
mov ecx, dword [esp + 0x20]
shr ecx, 1
mov word [esp + ecx*2 + 0x264], ax
push ebx
lea edx, [esp + 0x268]
lea ecx, [esp + 0x60]
call fcn.00408b80
add ebp, 1
test esi, esi
je 0x4088f0
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
push eax
push ebx
call fcn.00419350
mov edx, str.dump
call fcn.00401e60
test eax, eax
je 0x408986
mov ecx, str.dump
call fcn.00401f00
mov edx, eax
mov ecx, ebx
call fcn.004139a0
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ebp, eax
lea ecx, [ecx]
test ebx, ebx
mov esi, dword [ebx + 4]
je 0x40899b
cmp ebx, ebx
je 0x4089a0
call fcn.004281b2
cmp ebp, esi
je 0x408af6
test ebx, ebx
jne 0x4089b1
call fcn.004281b2
cmp ebp, dword [ebx + 4]
jne 0x4089bb
call fcn.004281b2
lea ecx, [esp + 0x24]
push ecx
lea esi, [ebp + 8]
push esi
mov ecx, 0x444d2c
call fcn.00406dd0
mov ecx, eax
mov byte [esp + 0xa70], 1
mov eax, dword [ecx + 0x14]
push str.ignore
mov edi, 6
call fcn.00405280
test eax, eax
sete dl
mov byte [esp + 0xa70], 0
cmp dword [esp + 0x3c], 8
mov byte [ebx + 0x3d], dl
jb 0x408a0e
mov eax, dword [esp + 0x28]
push eax
call fcn.004286d5
add esp, 4
cmp ebp, dword [ebx + 4]
jne 0x408a18
call fcn.004281b2
mov eax, dword [esi]
add eax, 0xffffffff
cmp eax, 0xb
ja case.0x408a26.2
jmp dword [eax*4 + 0x408b44]
cmp ebp, dword [ebx + 4]
jne 0x408a37
call fcn.004281b2
push ebx
mov ecx, esi
call fcn.00410fb0
jmp case.0x408a26.2
cmp ebp, dword [ebx + 4]
jne 0x408a4e
call fcn.004281b2
push ebx
mov ecx, esi
call fcn.00411370
jmp case.0x408a26.2
cmp ebp, dword [ebx + 4]
jne 0x408a65
call fcn.004281b2
mov ecx, esi
call fcn.00411560
jmp case.0x408a26.2
cmp ebp, dword [ebx + 4]
jne 0x408a78
call fcn.004281b2
push ebx
mov ecx, esi
call fcn.00411bc0
jmp case.0x408a26.2
cmp ebp, dword [ebx + 4]
jne 0x408a8c
call fcn.004281b2
push ebx
mov ecx, esi
call fcn.00411f20
jmp case.0x408a26.2
cmp ebp, dword [ebx + 4]
jne 0x408aa0
call fcn.004281b2
mov ecx, esi
mov edi, ebx
call fcn.00412400
jmp case.0x408a26.2
cmp ebp, dword [ebx + 4]
jne 0x408ab5
call fcn.004281b2
mov edi, ebx
call fcn.0040f6a0
jmp case.0x408a26.2
cmp ebp, dword [ebx + 4]
jne 0x408ac8
call fcn.004281b2
push ebx
mov eax, esi
call fcn.004125a0
jmp case.0x408a26.2
cmp ebp, dword [ebx + 4]
jne 0x408adc
call fcn.004281b2
push ebx
mov ecx, esi
call fcn.00412660
cmp ebp, dword [ebx + 4]
jne 0x408aee
call fcn.004281b2
mov ebp, dword [ebp]
jmp 0x408990
push str.SoftwareIntelICCS
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x58], 8
jb 0x408b1a
mov ecx, dword [esp + 0x44]
push ecx
call fcn.004286d5
add esp, 4
mov ecx, dword [esp + 0xa68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa50]
xor ecx, esp
call fcn.00426d9a
add esp, 0xa60
ret