Function at 0x4046a0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x46e040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x74
push eax
push ecx
mov ecx, 0x46640c
mov dword [esp + 0x1c], str.MicrosoftWindowsStart_MenuProgramsSystem_Informer.lnk
call fcn.00411fa0
mov edi, eax
or esi, 0xffffffff
test edi, edi
je 0x404728
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.004108e0
test eax, eax
js 0x404714
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, ds:[edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404728
call fcn.00406180
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x68
push eax
push ecx
mov ecx, 0x46640c
mov dword [esp + 0x1c], str.MicrosoftWindowsStart_MenuProgramsPE_Viewer.lnk
call fcn.00411fa0
mov edi, eax
test edi, edi
je 0x404790
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.004108e0
test eax, eax
js 0x40477e
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404790
call fcn.00406180
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x28
push eax
push ecx
mov ecx, 0x46ea90
mov dword [esp + 0x1c], str.System_Informer.lnk
call fcn.00411fa0
mov edi, eax
test edi, edi
je 0x4047f6
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.004108e0
test eax, eax
js 0x4047e6
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4047f6
call fcn.00406180
push ecx
push 0x46eac8
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410740
test eax, eax
js 0x404826
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword ds:[esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push ecx
push 0x46eaa0
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410740
nop dword [eax]
test eax, eax
js 0x404858
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push ecx
push 0x46ead0
push 0xfffffffffffffff7
mov edx, 0x2001f
lea ecx, [esp + 0x2c]
call fcn.00410740
test eax, eax
js 0x4049a6
mov ebx, dword [esp + 0x20]
xor edi, edi
push 0x100
push 4
push dword [0x46fcc0]
mov dword [esp + 0x18], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x100
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
cmp eax, 0x8000001a
je 0x40498b
nop dword [eax]
cmp eax, 0x80000005
je 0x4048ce
cmp eax, 0xc0000023
jne 0x404906
push esi
push 0
push dword [0x46fcc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0xc]
push 4
push dword [0x46fcc0]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
test eax, eax
js 0x40498b
cmp dword [esi + 4], 1
jne 0x404967
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov edx, 0x46ed00
mov eax, dword [esi + 8]
add eax, esi
push 1
mov dword [esp + 0x20], eax
call fcn.00406dc0
cmp eax, 0xffffffff
je 0x404967
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x14]
mov word [esp + 0x10], dx
mov dword [esp + 0x14], ecx
lea eax, [edx + 2]
mov word [esp + 0x12], ax
cmp edx, 0xfffe
ja 0x404967
lea eax, [esp + 0x10]
push eax
push ebx
lfence
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
lea eax, [esp + 0xc]
inc edi
push eax
lfence
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop
cmp eax, 0x8000001a
jne 0x4048c0
push esi
push 0
push dword [0x46fcc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword ds:[esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004218f3
mov esp, ebp
pop ebp
ret