Function at 0x460726
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x3444]
mov eax, 0x34c4
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp + 0x3440], eax
and dword [ebp - 0x64], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x64]
push eax
mov esi, str.SoftwareMicrosoftInternet_ExplorerIntelliForms
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x460806
mov ebx, 0x1046
push ebx
push eax
mov word [ebp + 0xfe8], ax
lea eax, [ebp + 0xfea]
push eax
call fcn.00596530
mov edi, 0x823
mov dword [ebp - 0x68], edi
jmp 0x4607e0
xor eax, eax
push ebx
push eax
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x5e]
push eax
call fcn.00596530
lea eax, [ebp + 0xfe8]
push eax
push esi
push 0x5dfc14
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.0058f42f
add esp, 0x20
lea eax, [ebp - 0x60]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x4607fd
push 0x1048
push eax
lea eax, [ebp + 0xfe8]
push eax
mov dword [ebp - 0x68], edi
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0xfe8]
push eax
push 0
push dword [ebp - 0x64]
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
test eax, eax
je 0x46078d
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp + 0x3238], ax
lea eax, [ebp + 0x323a]
push esi
push eax
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call fcn.00596530
lea eax, [ebp - 0x64]
push eax
call fcn.0048050b
add esp, 0x10
test eax, eax
je 0x4609a1
mov ecx, dword [ebp - 0x64]
lea ebx, [ebp + 0x3238]
call fcn.004800e5
mov ebx, 0x104
push ebx
lea eax, [ebp + 0x2030]
push str.SoftwareMicrosoftProtected_Storage_System_Provider_
push eax
call fcn.0058fee1
lea eax, [ebp + 0x3238]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x46086d
sub eax, edx
lea edi, [ebp + 0x2030]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x460881
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
lea eax, [ebp + 0x2030]
push eax
lea eax, [ebp + 0x3030]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.0058fee1
lea eax, [ebp + 0x3030]
push eax
lea esi, [ebp - 0x6c]
call fcn.004801ae
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0048023e
add esp, 0x18
mov ebx, 0x80000001
test eax, eax
je 0x460967
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x2030]
push eax
push ebx
call fcn.00480405
add esp, 0x10
lea edi, [ebp + 0x2030]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x4608fd
mov esi, str.Data
movsd dword es:[edi], dword [esi]
push 0
lea eax, [ebp - 0x80]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp + 0x2030]
push eax
push ebx
movsd dword es:[edi], dword [esi]
call fcn.00480405
add esp, 0x10
lea edi, [ebp + 0x2030]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x46092e
push 0x13
pop ecx
push 1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x2030]
push eax
mov esi, str.e161255a_37c3_11d2_bcaa_00c04fd929db
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.00480405
add esp, 0x10
lea eax, [ebp + 0x2030]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor esi, esi
cmp dword [ebp - 0x68], esi
je 0x46097f
push dword [ebp - 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x6c], esi
je 0x4609a1
push 0
push dword [ebp - 0x6c]
lea eax, [ebp + 0x3030]
push eax
push ebx
call fcn.00480405
push dword [ebp - 0x6c]
call fcn.0058f3c4
add esp, 0x14
cmp dword [ebp - 0x64], 0
pop edi
pop esi
pop ebx
je 0x4609bc
push dword [ebp - 0x64]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp + 0x3440]
xor ecx, ebp
call fcn.0058f3cf
add ebp, 0x3444
leave
ret