Function at 0x406ef0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x44990b
mov eax, dword fs:[0]
push eax
sub esp, 0xa34
mov eax, dword [0x4563c4]
xor eax, esp
mov dword [esp + 0xa30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4563c4]
xor eax, esp
push eax
lea eax, [esp + 0xa48]
mov dword fs:[0], eax
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], edi
mov word [esp + 0x24], di
mov eax, str.SoftwareIntelICCInst
mov dword [esp + 0xa50], edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x406f50
sub eax, edx
sar eax, 1
push eax
push str.SoftwareIntelICCInst
lea esi, [esp + 0x28]
call fcn.004030c0
push 0xa
push str.Uninstall
mov ecx, esi
call fcn.00413ae0
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x406f8b
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x406fb0
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x248]
push eax
mov eax, dword [esp + 0x20]
push 0
push 0
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x50]
push edx
push edi
push eax
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x3c], 0x400
call ebp
mov esi, eax
test esi, esi
jne 0x407009
mov ecx, dword [esp + 0x1c]
shr ecx, 1
lea edx, [esp + 0x3c]
push edx
mov word [esp + ecx*2 + 0x248], ax
push ebx
lea ecx, [esp + 0x24c]
call fcn.004071b0
add edi, 1
test esi, esi
je 0x406fb0
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
push ecx
push ebx
call fcn.00415db0
mov edx, str.dump
call fcn.004015c0
test eax, eax
je 0x407047
mov ecx, str.dump
call fcn.00401690
mov edx, eax
mov ecx, ebx
call fcn.0040fc50
mov edx, dword [ebx + 4]
mov esi, dword [edx]
mov ebp, ebx
mov edi, edi
test ebp, ebp
mov edi, dword [ebx + 4]
je 0x40705b
cmp ebp, ebx
je 0x407060
call fcn.004228be
cmp esi, edi
je 0x40712c
test ebp, ebp
jne 0x407071
call fcn.004228be
cmp esi, dword [ebp + 4]
jne 0x40707b
call fcn.004228be
mov eax, dword [esi + 8]
lea edi, [esi + 8]
add eax, 0xffffffff
cmp eax, 0xa
ja case.0x40708d.2
jmp dword [eax*4 + 0x407178]
cmp esi, dword [ebp + 4]
jne 0x40709e
call fcn.004228be
push edi
mov edi, ebx
call fcn.0040de10
jmp case.0x40708d.2
cmp esi, dword [ebp + 4]
jne 0x4070b2
call fcn.004228be
mov ecx, edi
call fcn.0040dfb0
jmp case.0x40708d.2
cmp esi, dword [ebp + 4]
jne 0x4070c5
call fcn.004228be
mov ecx, edi
call fcn.0040e120
jmp case.0x40708d.2
cmp esi, dword [ebp + 4]
jne 0x4070d8
call fcn.004228be
push edi
call fcn.0040e740
jmp case.0x40708d.2
cmp esi, dword [ebp + 4]
jne 0x4070ea
call fcn.004228be
push ebx
mov ecx, edi
call fcn.0040e900
jmp case.0x40708d.2
cmp esi, dword [ebp + 4]
jne 0x4070fe
call fcn.004228be
mov ecx, edi
mov edi, ebx
call fcn.0040ece0
jmp case.0x40708d.2
cmp esi, dword [ebp + 4]
jne 0x407113
call fcn.004228be
push ebx
mov ecx, edi
call fcn.0040ee40
cmp esi, dword [ebp + 4]
jne 0x407125
call fcn.004228be
mov esi, dword [esi]
jmp 0x407050
push str.SoftwareIntelICCInst
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
cmp dword [esp + 0x38], 8
jb 0x407150
mov eax, dword [esp + 0x24]
push eax
call fcn.00422b32
add esp, 4
mov ecx, dword [esp + 0xa48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xa30]
xor ecx, esp
call fcn.00422b23
add esp, 0xa40
ret