Function at 0x404ba0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x46b040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov edx, 0x4000
push eax
push ecx
mov ecx, 0x46bab0
call fcn.00412940
test eax, eax
js 0x404c70
mov ecx, dword [ebp - 0x10]
call fcn.004069e0
mov edx, dword [0x46ccf8]
mov ebx, eax
add ebx, ebx
lea esi, [ebx + 0x74]
lea ecx, [esi + 0xa]
call fcn.004060e0
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [ebp - 0xc], edi
push ebx
mov dword [edi], esi
mov dword [edi + 4], ecx
mov word [ecx + esi], ax
push dword [ebp - 0x10]
push dword [edi + 4]
call fcn.00423850
mov edi, dword [edi + 4]
add esp, 0xc
add edi, ebx
mov ecx, 0x1d
mov esi, str.MicrosoftWindowsStart_MenuProgramsSystem_Informer.lnk
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x404c70
mov edx, dword [esi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [ebp - 0xc]
call fcn.00410e60
test eax, eax
js 0x404c5d
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404c70
call fcn.004061c0
lea eax, ds:[ebp - 0x10]
mov edx, 0x4000
push eax
push ecx
mov ecx, 0x46bab0
call fcn.00412940
test eax, eax
js 0x404d2e
mov ecx, dword [ebp - 0x10]
call fcn.004069e0
mov edx, dword [0x46ccf8]
mov ebx, eax
add ebx, ebx
lea esi, [ebx + 0x68]
lea ecx, [esi + 0xa]
call fcn.004060e0
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [ebp - 0xc], edi
push ebx
mov dword [edi], esi
mov dword [edi + 4], ecx
mov word [ecx + esi], ax
push dword [ebp - 0x10]
push dword [edi + 4]
call fcn.00423850
mov edi, dword [edi + 4]
add esp, 0xc
add edi, ebx
mov ecx, 0x1a
mov esi, str.MicrosoftWindowsStart_MenuProgramsPE_Viewer.lnk
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x404d2e
mov edx, dword [esi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [ebp - 0xc]
call fcn.00410e60
test eax, eax
js 0x404d1b
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404d2e
call fcn.004061c0
lea eax, ds:[ebp - 0x10]
mov edx, 0x4000
push eax
push ecx
mov ecx, 0x46baa0
call fcn.00412940
test eax, eax
js 0x404dee
mov ecx, dword [ebp - 0x10]
call fcn.004069e0
mov edx, dword [0x46ccf8]
mov ebx, eax
add ebx, ebx
lea esi, [ebx + 0x28]
lea ecx, [esi + 0xa]
call fcn.004060e0
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [ebp - 0xc], edi
push ebx
mov dword [edi], esi
mov dword [edi + 4], ecx
mov word [ecx + esi], ax
push dword [ebp - 0x10]
push dword [edi + 4]
call fcn.00423850
mov edi, dword [edi + 4]
add esp, 0xc
add edi, ebx
mov ecx, 0xa
mov esi, str.System_Informer.lnk
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x404dee
mov edx, dword [esi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [ebp - 0xc]
call fcn.00410e60
test eax, eax
js 0x404ddb
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404dee
call fcn.004061c0
push ecx
push 0x46bac8
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [ebp - 8]
call fcn.00410cc0
test eax, eax
js 0x404e1b
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00420701
mov esp, ebp
pop ebp
ret