Function at 0x440b20
Capabilities:
Delete registry value
Disable system features via registry on windows
Set registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x80c], eax
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetDlgItem]
push esi
push edi
push 0
push 0
push 0xf0
push 0x2879
push dword [0x4def88]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
push 0x80000002
je 0x440ba6
call esi
test eax, eax
jne 0x440c0d
push 0x4ad860
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x440c07
call esi
test eax, eax
jne 0x440c0d
push 0x7fe
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.0048e880
add esp, 0xc
lea eax, [esp + 0x18]
push str.regs
push 0x4def98
push str._s_s_blank.ico_0
push 0x400
push eax
call fcn.0040a3c0
add esp, 0x14
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
push 0x4ad860
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
push 0
push 0xf0
push 0x287a
push dword [0x4def88]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.piffile
push 0x80000000
je 0x440c64
call esi
test eax, eax
jne 0x440c7f
push eax
push eax
push 1
push eax
push str.IsShortcut
push dword [esp + 0x24]
call ebx
jmp 0x440c79
call esi
test eax, eax
jne 0x440c7f
push str.IsShortcut
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.Control_PanelDesktop
push 0x80000001
call esi
test eax, eax
jne 0x440cde
push eax
push eax
push 0xf0
push 0x287c
push dword [0x4def88]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.PaintDesktopVersion
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call esi
test eax, eax
jne 0x440d3d
push eax
push eax
push 0xf0
push 0x287d
push dword [0x4def88]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.NoDesktop
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call esi
test eax, eax
jne 0x440d9c
push eax
push eax
push 0xf0
push 0x287e
push dword [0x4def88]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.NoActiveDesktop
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
call esi
test eax, eax
jne 0x440dfb
push eax
push eax
push 0xf0
push 0x287f
push dword [0x4def88]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.ShowInfoTip
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
push 0
push 0xf0
push 0x2880
push dword [0x4def88]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.Control_PanelDesktopWindowMetrics
push 0x80000001
je 0x440e57
call esi
test eax, eax
jne 0x440e72
push 5
push 0x4ad774
push 1
push eax
push str.Shell_Icon_BPP
push dword [esp + 0x24]
call ebx
jmp 0x440e6c
call esi
test eax, eax
jne 0x440e72
push str.Shell_Icon_BPP
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.Control_PanelKeyboard
push 0x80000001
call esi
test eax, eax
jne 0x440ed8
push eax
push eax
push 0xf0
push 0x2881
push dword [0x4def88]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
test eax, eax
je 0x440ebe
push 0x4ad374
jmp 0x440ec3
push 0x4ad0e0
push 1
push 0
push str.InitialKeyboardIndicators
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
push 0
push 0xf0
push 0x297c
push dword [0x4def88]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str..DefaultSoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000003
je 0x440f73
call esi
test eax, eax
jne 0x440f38
push 4
push 0x4b31ac
push 3
push eax
push str.Link
push dword [esp + 0x24]
call ebx
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
call esi
test eax, eax
jne 0x440fc7
push 4
push 0x4b31ac
push 3
push eax
push str.Link
push dword [esp + 0x24]
call ebx
jmp 0x440fc1
call esi
test eax, eax
jne 0x440f8e
push str.Link
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call edi
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
call esi
test eax, eax
jne 0x440fc7
push str.Link
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call edi
push 0
push 0
push 0xf0
push 0x287b
push dword [0x4def88]
call ebp
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
test eax, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.CLSID20D04FE0_3AEA_1069_A2D8_08002B30309D
push 0x80000000
je 0x441023
call esi
test eax, eax
jne 0x44103e
push 0x21
push str._USERNAME__on__COMPUTERNAME_
push 2
push eax
push str.LocalizedString
push dword [esp + 0x24]
call ebx
jmp 0x441038
call esi
test eax, eax
jne 0x44103e
push str.LocalizedString
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
call edi
mov ecx, dword [esp + 0x81c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d925
add esp, 0x814
ret