Function at 0x4416c0
Capabilities:
Delete registry value
Disable system features via registry on windows
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push edi
push 0
push 0
push 0xf0
push 0x2879
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
push 0x80000002
je 0x441746
call esi
test eax, eax
jne 0x4417ad
push 0x4b3aa0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4417a7
call esi
test eax, eax
jne 0x4417ad
push 0x7fe
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x18]
push str.regs
push 0x4e6040
push str._s_s_blank.ico_0
push 0x400
push eax
call fcn.0040a420
add esp, 0x14
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0x4b3aa0
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
push 0
push 0xf0
push 0x287a
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.piffile
push 0x80000000
je 0x441804
call esi
test eax, eax
jne 0x44181f
push eax
push eax
push 1
push eax
push str.IsShortcut
push dword [esp + 0x24]
call ebx
jmp 0x441819
call esi
test eax, eax
jne 0x44181f
push str.IsShortcut
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.Control_PanelDesktop
push 0x80000001
call esi
test eax, eax
jne 0x44187e
push eax
push eax
push 0xf0
push 0x287c
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.PaintDesktopVersion
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call esi
test eax, eax
jne 0x4418dd
push eax
push eax
push 0xf0
push 0x287d
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.NoDesktop
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call esi
test eax, eax
jne 0x44193c
push eax
push eax
push 0xf0
push 0x287e
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.NoActiveDesktop
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
call esi
test eax, eax
jne 0x44199b
push eax
push eax
push 0xf0
push 0x287f
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.ShowInfoTip
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
push 0
push 0xf0
push 0x2880
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.Control_PanelDesktopWindowMetrics
push 0x80000001
je 0x4419f7
call esi
test eax, eax
jne 0x441a12
push 5
push 0x4b39b4
push 1
push eax
push str.Shell_Icon_BPP
push dword [esp + 0x24]
call ebx
jmp 0x441a0c
call esi
test eax, eax
jne 0x441a12
push str.Shell_Icon_BPP
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.Control_PanelKeyboard
push 0x80000001
call esi
test eax, eax
jne 0x441a78
push eax
push eax
push 0xf0
push 0x2881
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
test eax, eax
je 0x441a5e
push 0x4b35b4
jmp 0x441a63
push 0x4b3320
push 1
push 0
push str.InitialKeyboardIndicators
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
push 0
push 0xf0
push 0x297c
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str..DefaultSoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000003
je 0x441b13
call esi
test eax, eax
jne 0x441ad8
push 4
push 0x4b94b4
push 3
push eax
push str.Link
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
call esi
test eax, eax
jne 0x441b67
push 4
push 0x4b94b4
push 3
push eax
push str.Link
push dword [esp + 0x24]
call ebx
jmp 0x441b61
call esi
test eax, eax
jne 0x441b2e
push str.Link
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
call esi
test eax, eax
jne 0x441b67
push str.Link
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call edi
push 0
push 0
push 0xf0
push 0x287b
push dword [0x4e6030]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.CLSID20D04FE0_3AEA_1069_A2D8_08002B30309D
push 0x80000000
je 0x441bc3
call esi
test eax, eax
jne 0x441bde
push 0x21
push str._USERNAME__on__COMPUTERNAME_
push 2
push eax
push str.LocalizedString
push dword [esp + 0x24]
call ebx
jmp 0x441bd8
call esi
test eax, eax
jne 0x441bde
push str.LocalizedString
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call edi
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x814
ret