Function at 0x404680
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x46d040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x74
push eax
push ecx
mov ecx, 0x46540c
mov dword [esp + 0x1c], str.MicrosoftWindowsStart_MenuProgramsSystem_Informer.lnk
call fcn.00411ec0
mov edi, eax
or esi, 0xffffffff
test edi, edi
je 0x404708
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.00410800
test eax, eax
js 0x4046f4
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, ds:[edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404708
call fcn.004060e0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x68
push eax
push ecx
mov ecx, 0x46540c
mov dword [esp + 0x1c], str.MicrosoftWindowsStart_MenuProgramsPE_Viewer.lnk
call fcn.00411ec0
mov edi, eax
test edi, edi
je 0x404770
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.00410800
test eax, eax
js 0x40475e
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404770
call fcn.004060e0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x28
push eax
push ecx
mov ecx, 0x46da90
mov dword [esp + 0x1c], str.System_Informer.lnk
call fcn.00411ec0
mov edi, eax
test edi, edi
je 0x4047d6
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.00410800
test eax, eax
js 0x4047c6
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x4047d6
call fcn.004060e0
push ecx
push 0x46dac8
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410660
test eax, eax
js 0x404806
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword ds:[esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push ecx
push 0x46daa0
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410660
nop dword [eax]
test eax, eax
js 0x404838
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push ecx
push 0x46dad0
push 0xfffffffffffffff7
mov edx, 0x2001f
lea ecx, [esp + 0x2c]
call fcn.00410660
test eax, eax
js 0x404986
mov ebx, dword [esp + 0x20]
xor edi, edi
push 0x100
push 4
push dword [0x46ecc0]
mov dword [esp + 0x18], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push 0x100
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
cmp eax, 0x8000001a
je 0x40496b
nop dword [eax]
cmp eax, 0x80000005
je 0x4048ae
cmp eax, 0xc0000023
jne 0x4048e6
push esi
push 0
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0xc]
push 4
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
test eax, eax
js 0x40496b
cmp dword [esi + 4], 1
jne 0x404947
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov edx, 0x46dd00
mov eax, dword [esi + 8]
add eax, esi
push 1
mov dword [esp + 0x20], eax
call fcn.00406d20
cmp eax, 0xffffffff
je 0x404947
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x14]
mov word [esp + 0x10], dx
mov dword [esp + 0x14], ecx
lea eax, [edx + 2]
mov word [esp + 0x12], ax
cmp edx, 0xfffe
ja 0x404947
lea eax, [esp + 0x10]
push eax
push ebx
lfence
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
lea eax, [esp + 0xc]
inc edi
push eax
lfence
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
nop
cmp eax, 0x8000001a
jne 0x4048a0
push esi
push 0
push dword [0x46ecc0]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword ds:[esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421733
mov esp, ebp
pop ebp
ret