Function at 0x404480
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x46d040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x74
push eax
push ecx
mov ecx, 0x46540c
mov dword [esp + 0x1c], str.MicrosoftWindowsStart_MenuProgramsSystem_Informer.lnk
call fcn.00411b00
mov edi, eax
or esi, 0xffffffff
test edi, edi
je 0x404508
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.004104e0
test eax, eax
js 0x4044f4
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, ds:[edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404508
call fcn.00405dc0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x68
push eax
push ecx
mov ecx, 0x46540c
mov dword [esp + 0x1c], str.MicrosoftWindowsStart_MenuProgramsPE_Viewer.lnk
call fcn.00411b00
mov edi, eax
test edi, edi
je 0x404570
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.004104e0
test eax, eax
js 0x40455e
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404570
call fcn.00405dc0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x28
push eax
push ecx
mov ecx, 0x46da90
mov dword [esp + 0x1c], str.System_Informer.lnk
call fcn.00411b00
mov edi, eax
test edi, edi
je 0x4045d6
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.004104e0
test eax, eax
js 0x4045c6
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4045d6
call fcn.00405dc0
push ecx
push 0x46daa8
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410340
test eax, eax
js 0x404606
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword ds:[esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push ecx
push 0x46daa0
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410340
nop dword [eax]
test eax, eax
js 0x404638
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push ecx
push 0x46dab0
push 0xfffffffffffffff7
mov edx, 0x2001f
lea ecx, [esp + 0x2c]
call fcn.00410340
test eax, eax
js 0x404786
mov ebx, dword [esp + 0x20]
xor edi, edi
push 0x100
push 4
push dword [0x46eca4]
mov dword [esp + 0x18], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x100
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
cmp eax, 0x8000001a
je 0x40476b
nop dword [eax]
cmp eax, 0x80000005
je 0x4046ae
cmp eax, 0xc0000023
jne 0x4046e6
push esi
push 0
push dword [0x46eca4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0xc]
push 4
push dword [0x46eca4]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
test eax, eax
js 0x40476b
cmp dword [esi + 4], 1
jne 0x404747
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov edx, 0x46dce4
mov eax, dword [esi + 8]
add eax, esi
push 1
mov dword [esp + 0x20], eax
call fcn.00406a00
cmp eax, 0xffffffff
je 0x404747
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x14]
mov word [esp + 0x10], dx
mov dword [esp + 0x14], ecx
lea eax, [edx + 2]
mov word [esp + 0x12], ax
cmp edx, 0xfffe
ja 0x404747
lea eax, [esp + 0x10]
push eax
push ebx
lfence
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
lea eax, [esp + 0xc]
inc edi
push eax
lfence
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop
cmp eax, 0x8000001a
jne 0x4046a0
push esi
push 0
push dword [0x46eca4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword ds:[esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421161
mov esp, ebp
pop ebp
ret