Function at 0x4043e0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x46b040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov edx, 0x4000
push eax
push ecx
mov ecx, 0x46bab0
call fcn.00412940
test eax, eax
js 0x4044bc
mov ecx, dword [esp + 0xc]
call fcn.004069e0
mov edx, dword [0x46ccf8]
mov ebx, eax
add ebx, ebx
lea esi, [ebx + 0x74]
lea ecx, [esi + 0xa]
call fcn.004060e0
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [esp + 0x10], edi
push ebx
mov dword [edi], esi
mov dword [edi + 4], ecx
mov word [ecx + esi], ax
push dword [esp + 0x10]
push dword [edi + 4]
call fcn.00423850
mov edi, dword [edi + 4]
add esp, 0xc
add edi, ebx
mov ecx, 0x1d
mov esi, str.MicrosoftWindowsStart_MenuProgramsSystem_Informer.lnk
rep movsd dword es:[edi], dword [esi]
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [esp + 0x10]
test esi, esi
je 0x4044bc
mov edx, dword [esi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410e60
test eax, eax
js 0x4044a9
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4044bc
call fcn.004061c0
lea eax, [esp + 0xc]
mov edx, 0x4000
push eax
push ecx
mov ecx, 0x46bab0
call fcn.00412940
test eax, eax
js 0x404588
mov ecx, dword ds:[esp + 0xc]
call fcn.004069e0
mov edx, dword [0x46ccf8]
mov ebx, eax
add ebx, ebx
lea esi, [ebx + 0x68]
lea ecx, [esi + 0xa]
call fcn.004060e0
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [esp + 0x10], edi
push ebx
mov dword [edi], esi
mov dword [edi + 4], ecx
mov word [esi + ecx], ax
push dword [esp + 0x10]
push dword [edi + 4]
call fcn.00423850
mov edi, dword [edi + 4]
add esp, 0xc
add edi, ebx
mov ecx, 0x1a
mov esi, str.MicrosoftWindowsStart_MenuProgramsPE_Viewer.lnk
rep movsd dword es:[edi], dword [esi]
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword ds:[esp + 0x10]
test esi, esi
je 0x404588
mov edx, dword [esi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410e60
test eax, eax
js 0x404574
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, ds:[esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404588
call fcn.004061c0
lea eax, [esp + 0xc]
mov edx, 0x4000
push eax
push ecx
mov ecx, 0x46baa0
call fcn.00412940
lea ecx, [ecx]
test eax, eax
js 0x404651
mov ecx, dword [esp + 0xc]
call fcn.004069e0
mov edx, dword [0x46ccf8]
mov ebx, eax
add ebx, ebx
lea esi, [ebx + 0x28]
lea ecx, [esi + 0xa]
call fcn.004060e0
mov edi, eax
xor eax, eax
lea ecx, [edi + 8]
mov dword [esp + 0x10], edi
push ebx
mov dword [edi], esi
mov dword [edi + 4], ecx
mov word [esi + ecx], ax
push dword [esp + 0x10]
push dword [edi + 4]
call fcn.00423850
mov edi, dword ds:[edi + 4]
add esp, 0xc
add edi, ebx
mov ecx, 0xa
mov esi, str.System_Informer.lnk
rep movsd dword es:[edi], dword [esi]
push dword [esp + 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, dword [esp + 0x10]
test esi, esi
je 0x404651
mov edx, dword [esi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410e60
test eax, eax
js 0x40463e
push dword [esp + 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404651
call fcn.004061c0
push ecx
push 0x46bac8
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410cc0
test eax, eax
js 0x40467f
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push ecx
push 0x46bac0
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410cc0
test eax, eax
js 0x4046b0
push dword ds:[esp + 0x20]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push ecx
push 0x46bad0
push 0xfffffffffffffff7
mov edx, 0x2001f
lea ecx, [esp + 0x2c]
call fcn.00410cc0
test eax, eax
js 0x404806
mov ebx, dword [esp + 0x20]
xor edi, edi
push 0x100
push 4
push dword [0x46cd04]
mov dword [esp + 0x18], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
cmp eax, 0x8000001a
je 0x4047eb
cmp eax, 0x80000005
je 0x40471f
cmp eax, 0xc0000023
jne 0x40475c
push esi
push 0
push dword [0x46cd04]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword ds:[esp + 0xc]
push 4
push dword [0x46cd04]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
lea esp, [esp]
test eax, eax
js 0x4047eb
cmp dword [esi + 4], 1
jne 0x4047c6
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov edx, 0x46bd04
mov eax, dword [esi + 8]
add eax, esi
push 1
mov dword [esp + 0x20], eax
call fcn.00406da0
cmp eax, 0xffffffff
je 0x4047c6
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x14]
mov word [esp + 0x10], dx
mov dword [esp + 0x14], ecx
lea eax, [edx + 2]
mov word [esp + 0x12], ax
cmp edx, 0xfffe
ja 0x4047c6
lea eax, ds:[esp + 0x10]
push eax
push ebx
lfence
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
lea eax, [esp + 0xc]
inc edi
push eax
lfence
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
mov edi, edi
cmp eax, 0x8000001a
jne 0x404711
push esi
push 0
push dword [0x46cd04]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword ds:[esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00420701
mov esp, ebp
pop ebp
ret