Function at 0x46d0a0
Capabilities:
Delete registry key
Delete registry value
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x76c
mov eax, dword [0x535a40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.SoftwareSystems_InternalsProcess_Explorer
push reloc.ACLUI.dll_CreateSecurityPage
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0x4848
push 0
push 0x54af40
call fcn.004c53a0
mov ebx, dword [sym.imp.KERNEL32.dll_MulDiv]
add esp, 0xc
mov dword [0x54af48], 1
push 0x60
push dword [0x53a8c0]
push 0x32
call ebx
push 0x60
push dword [0x53a8c0]
mov dword [0x54af60], eax
push 0x28a
call ebx
push 0x60
push dword [0x53a8bc]
mov dword [0x54af68], eax
push 0x64
call ebx
push 0x60
push dword [0x53a8bc]
mov dword [0x54af5c], eax
push 0x384
call ebx
push 0x60
push dword [0x53a8c0]
mov dword [0x54af64], eax
push 0x96
mov dword [0x54af40], 0x2c
call ebx
push 0x60
push dword [0x53a8bc]
mov dword [0x54af8c], eax
push 0x96
call ebx
push 0x60
push dword [0x53a8c0]
mov dword [0x54af88], eax
push 0x28
mov dword [0x54af6c], 0x2c
call ebx
push 0x60
push dword [0x53a8bc]
mov dword [0x54afb8], eax
push 0x28
call ebx
push 0x60
push dword [0x53a8c0]
mov dword [0x54afb4], eax
push 0x28
mov dword [0x54af98], 0x2c
call ebx
push 0x60
push dword [0x53a8bc]
mov dword [0x54afe4], eax
push 0x28
call ebx
push 0x60
push dword [0x53a8c0]
mov dword [0x54afe0], eax
push 0x28
mov dword [0x54afc4], 0x2c
call ebx
push 0x60
push dword [0x53a8bc]
mov dword [0x54b010], eax
push 0x28
call ebx
mov dword [0x54b00c], eax
mov dword [0x54aff0], 0x2c
mov dword [0x54f6f8], 0xffffffff
mov dword [0x54f704], 0xffffffff
mov dword [0x54f710], 0xffffffff
mov dword [0x54f71c], 0xffffffff
xor esi, esi
mov dword [0x54f728], 0xffffffff
mov dword [0x54f734], 0xffffffff
mov dword [0x54f740], 0xffffffff
mov dword [0x54f74c], 0xffffffff
mov dword [0x54f758], 0xffffffff
mov dword [0x54b2cc], 6
nop word [eax + eax]
movzx eax, word [esi*4 + 0x531664]
push 0x60
push dword [0x53a8bc]
mov dword [ebp + esi*4 - 0x5d4], eax
mov dword [esi*4 + 0x54b390], eax
movzx eax, word [esi*4 + 0x531666]
push eax
call ebx
mov word [esi*2 + 0x54b2d0], ax
inc esi
cmp esi, dword [0x54b2cc]
jl 0x46d260
mov dword [0x54b51c], 2
xor esi, esi
nop word [eax + eax]
movzx eax, word [esi*4 + 0x53167c]
push 0x60
push dword [0x53a8bc]
mov dword [esi*4 + 0x54b62c], eax
movzx eax, word [esi*4 + 0x53167e]
push eax
call ebx
mov word [esi*2 + 0x54b520], ax
inc esi
cmp esi, dword [0x54b51c]
jl 0x46d2b0
mov dword [0x54b5e8], 4
xor esi, esi
nop
movzx eax, word [esi*4 + 0x531684]
push 0x60
push dword [0x53a8bc]
mov dword [esi*4 + 0x54b560], eax
movzx eax, word [esi*4 + 0x531686]
push eax
call ebx
mov word [esi*2 + 0x54b5ec], ax
inc esi
cmp esi, dword [0x54b5e8]
jl 0x46d2f0
lea eax, [ebp - 0x60]
push eax
push 0x5c
push 0x11
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectW]
push 0x48
push dword [0x53a8c0]
mov dword [ebp - 0x50], 0x190
push 8
call ebx
neg eax
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], eax
lea esi, [ebp - 0x60]
mov ecx, 0x17
mov edi, 0x54b048
rep movsd dword es:[edi], dword [esi]
push str.SoftwareSysinternalsProcess_Explorer
call fcn.004c8d00
add esp, 4
mov dword [ebp - 0x76c], eax
lea ecx, [ebp - 0x76c]
push 0x531ab0
call fcn.00450430
mov eax, dword [0x54b048]
test eax, eax
jle 0x46d3a4
push 0x48
push dword [0x53a8c0]
push eax
call ebx
neg eax
mov dword [0x54b048], eax
lea eax, [ebp - 0x75c]
push eax
push str.SoftwareSysinternalsProcess_Explorer
push reloc.ACLUI.dll_CreateSecurityPage
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x46d558
lea eax, [ebp - 0x760]
mov dword [ebp - 0x760], 0x6f8
push eax
lea eax, [ebp - 0x758]
push eax
push 0
push 0
push str.Settings
push dword [ebp - 0x75c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x46d558
mov eax, dword [ebp - 0x758]
add eax, 0xfffffe0b
cmp eax, 0x140
ja 0x46d558
mov edx, dword [ebp - 0x5d8]
xor ecx, ecx
mov esi, 0x7cf
test edx, edx
jle 0x46d47b
nop
mov ax, word [ebp + ecx*2 - 0x6c0]
dec ax
cmp ax, si
ja 0x46d445
mov eax, dword [ebp + ecx*4 - 0x180]
dec eax
cmp eax, 0xa027
ja 0x46d445
inc ecx
cmp ecx, edx
jl 0x46d420
jmp 0x46d47b
xor ecx, ecx
nop word [eax + eax]
mov ax, word [ebp + ecx*2 - 0x6c0]
dec ax
cmp ax, si
ja 0x46d558
mov eax, dword [ebp + ecx*4 - 0x5d4]
dec eax
cmp eax, 0xa027
ja 0x46d558
inc ecx
cmp ecx, edx
jl 0x46d450
mov edx, dword [ebp - 0x554]
xor ecx, ecx
test edx, edx
jle 0x46d4bb
nop word [eax + eax]
mov ax, word [ebp + ecx*2 - 0x640]
dec ax
cmp ax, si
ja 0x46d558
mov eax, dword [ebp + ecx*4 - 0x550]
dec eax
cmp eax, 0xa027
ja 0x46d558
inc ecx
cmp ecx, edx
jl 0x46d490
mov edx, dword [ebp - 0x4d0]
xor ecx, ecx
test edx, edx
jle 0x46d4f3
nop word [eax + eax]
mov ax, word [ebp + ecx*2 - 0x680]
dec ax
cmp ax, si
ja 0x46d558
mov eax, dword [ebp + ecx*4 - 0x4cc]
dec eax
cmp eax, 0xa027
ja 0x46d558
inc ecx
cmp ecx, edx
jl 0x46d4d0
push dword [ebp - 0x760]
lea eax, [ebp - 0x758]
push eax
push 0x54af40
call fcn.00466e20
add esp, 0xc
push str.Settings
push dword [ebp - 0x75c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x75c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x54f274], 0
jne 0x46d53d
mov dword [0x54f274], 0x64
cmp dword [0x54b390], 0
jne 0x46d558
mov ecx, 0x20
lea esi, [ebp - 0x5d4]
mov edi, 0x54b390
rep movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [0x54b2cc], esi
jle 0x46d5c7
mov edi, 0x54b2d0
mov ecx, 0x54b390
nop dword [eax]
cmp dword [ecx], 3
lea eax, [edi + 2]
lea ebx, [ecx + 4]
mov dword [ebp - 0x764], eax
jne 0x46d5ba
mov eax, dword [0x54b2cc]
dec eax
mov dword [0x54b2cc], eax
sub eax, esi
shl eax, 2
push eax
push ebx
push ecx
call fcn.004c4e20
mov eax, dword [0x54b2cc]
sub eax, esi
add eax, eax
push eax
push dword [ebp - 0x764]
push edi
call fcn.004c4e20
mov edi, dword [ebp - 0x764]
add esp, 0x18
jmp 0x46d5bc
mov edi, eax
inc esi
mov ecx, ebx
cmp esi, dword [0x54b2cc]
jl 0x46d570
xor esi, esi
or edi, 0xffffffff
cmp dword [0x54b2cc], esi
jle 0x46d643
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
nop word [eax + eax]
cmp dword [esi*4 + 0x54b390], 4
jne 0x46d5f7
cmp byte [0x54f272], 0
mov edi, esi
jne 0x46d63e
jmp 0x46d635
call fcn.0047d390
test al, al
jne 0x46d635
cmp byte [0x54f272], al
jne 0x46d635
mov eax, dword [esi*4 + 0x54b390]
sub eax, 0x649
cmp eax, 0x1b
ja 0x46d635
push 0x30
push str.Process_Explorer
push str.Note_that_Disk_and_Networking_information_requires_administrative_rights
push 0
mov byte [0x54f272], 1
call ebx
cmp edi, 0xffffffff
jne 0x46d661
inc esi
cmp esi, dword [0x54b2cc]
jl 0x46d5e0
cmp edi, 0xffffffff
jne 0x46d661
mov dword [esi*4 + 0x54b390], 4
mov eax, 0xc8
mov word [esi*2 + 0x54b2d0], ax
inc dword [0x54b2cc]
xor esi, esi
cmp dword [0x54b6b4], esi
jle 0x46d68b
mov edi, 0x54b6b8
push edi
push esi
push 0
call fcn.0046a870
inc esi
add esp, 0xc
add edi, 0x5f4
cmp esi, dword [0x54b6b4]
jl 0x46d670
cmp word [0x54f48e], 0
jne 0x46d6aa
push 0x104
push 0x54f48e
push str._NT_SYMBOL_PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push 0x54b048
call ebx
mov dword [0x54af20], eax
lea edi, [ebp - 0x60]
lea eax, [ebp - 0x60]
mov ecx, 0x17
mov esi, 0x54b048
rep movsd dword es:[edi], dword [esi]
push eax
mov byte [ebp - 0x4b], 1
call ebx
push dword [ebp - 0x76c]
mov dword [0x54af24], eax
call fcn.004c8d5f
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004c34b7
mov esp, ebp
pop ebp
ret