Function at 0x4145d0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x451166
mov eax, dword fs:[0]
push eax
sub esp, 0xa54
mov eax, dword [0x4663e0]
xor eax, esp
mov dword [esp + 0xa50], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4663e0]
xor eax, esp
push eax
lea eax, [esp + 0xa68]
mov dword fs:[0], eax
xor ebp, ebp
mov ebx, ecx
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], bp
mov eax, str.SoftwareIntelIRST
mov dword [esp + 0xa70], ebp
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x414630
sub eax, edx
sar eax, 1
push eax
push str.SoftwareIntelIRST
lea esi, [esp + 0x48]
call fcn.00404160
push 0xa
push str.Uninstall
mov ecx, esi
call fcn.00403fe0
cmp dword [esp + 0x58], 8
mov eax, dword [esp + 0x44]
jae 0x41466b
lea eax, [esp + 0x44]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebp
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x414690
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x268]
push eax
mov eax, dword [esp + 0x20]
push 0
push 0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x70]
push edx
push ebp
push eax
mov dword [esp + 0x3c], 0x104
mov dword [esp + 0x40], 0x400
call edi
mov esi, eax
test esi, esi
jne 0x4146e8
mov ecx, dword [esp + 0x20]
shr ecx, 1
mov word [esp + ecx*2 + 0x264], ax
push ebx
lea edx, [esp + 0x268]
lea ecx, [esp + 0x60]
call fcn.00414930
add ebp, 1
test esi, esi
je 0x414690
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
push eax
push ebx
call fcn.00424430
mov edx, str.dump
call fcn.00401e70
test eax, eax
je 0x414726
mov ecx, str.dump
call fcn.00401f10
mov edx, eax
mov ecx, ebx
call fcn.00420e00
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov ebp, eax
lea ecx, [ecx]
test ebx, ebx
mov esi, dword [ebx + 4]
je 0x41473b
cmp ebx, ebx
je 0x414740
call fcn.00439049
cmp ebp, esi
je 0x4148ad
test ebx, ebx
jne 0x414751
call fcn.00439049
cmp ebp, dword [ebx + 4]
jne 0x41475b
call fcn.00439049
lea ecx, [esp + 0x24]
push ecx
lea esi, [ebp + 8]
push esi
mov ecx, 0x458578
call fcn.00412330
mov ecx, eax
mov byte [esp + 0xa70], 1
mov eax, dword [ecx + 0x14]
push str.ignore
mov edi, 6
call fcn.004052b0
test eax, eax
sete dl
mov byte [esp + 0xa70], 0
cmp dword [esp + 0x3c], 8
mov byte [ebx + 0x3d], dl
jb 0x4147ae
mov eax, dword [esp + 0x28]
push eax
call fcn.00439059
add esp, 4
cmp ebp, dword [ebx + 4]
jne 0x4147b8
call fcn.00439049
mov eax, dword [esi]
add eax, 0xffffffff
cmp eax, 0xb
ja case.0x4147c6.2
jmp dword [eax*4 + 0x4148fc]
cmp ebp, dword [ebx + 4]
jne 0x4147d7
call fcn.00439049
push ebx
mov ecx, esi
call fcn.0041dc10
jmp case.0x4147c6.2
cmp ebp, dword [ebx + 4]
jne 0x4147ee
call fcn.00439049
push ebx
mov ecx, esi
call fcn.0041e010
jmp case.0x4147c6.2
cmp ebp, dword [ebx + 4]
jne 0x414805
call fcn.00439049
mov ecx, esi
call fcn.0041e360
jmp case.0x4147c6.2
cmp ebp, dword [ebx + 4]
jne 0x41481b
call fcn.00439049
push ebx
mov ecx, esi
call fcn.0041e9f0
jmp case.0x4147c6.2
cmp ebp, dword [ebx + 4]
jne 0x41482f
call fcn.00439049
push ebx
mov ecx, esi
call fcn.0041ed50
jmp case.0x4147c6.2
cmp ebp, dword [ebx + 4]
jne 0x414843
call fcn.00439049
mov ecx, esi
mov edi, ebx
call fcn.0041f240
jmp case.0x4147c6.2
cmp ebp, dword [ebx + 4]
jne 0x414858
call fcn.00439049
push ebx
mov ecx, esi
call fcn.0041f3e0
jmp case.0x4147c6.2
cmp ebp, dword [ebx + 4]
jne 0x41486c
call fcn.00439049
mov edi, ebx
call fcn.0041c0e0
jmp case.0x4147c6.2
cmp ebp, dword [ebx + 4]
jne 0x41487f
call fcn.00439049
push ebx
mov eax, esi
call fcn.0041f860
jmp case.0x4147c6.2
cmp ebp, dword [ebx + 4]
jne 0x414893
call fcn.00439049
push ebx
mov ecx, esi
call fcn.0041f920
cmp ebp, dword [ebx + 4]
jne 0x4148a5
call fcn.00439049
mov ebp, dword [ebp]
jmp 0x414730
push str.SoftwareIntelIRST
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x58], 8
jb 0x4148d1
mov ecx, dword [esp + 0x44]
push ecx
call fcn.00439059
add esp, 4
mov ecx, dword [esp + 0xa68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa50]
xor ecx, esp
call fcn.0043782a
add esp, 0xa60
ret