Function at 0x404420
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x46a040]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x74
push eax
push ecx
mov ecx, 0x4630b0
mov dword [esp + 0x1c], str.MicrosoftWindowsStart_MenuProgramsSystem_Informer.lnk
call fcn.00411d00
mov edi, eax
or esi, 0xffffffff
test edi, edi
je 0x4044a8
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.004107a0
test eax, eax
js 0x404494
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, ds:[edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4044a8
call fcn.00405d40
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x68
push eax
push ecx
mov ecx, 0x4630b0
mov dword [esp + 0x1c], str.MicrosoftWindowsStart_MenuProgramsPE_Viewer.lnk
call fcn.00411d00
mov edi, eax
test edi, edi
je 0x404510
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.004107a0
test eax, eax
js 0x4044fe
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [edi - 8]
mov eax, esi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x404510
call fcn.00405d40
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x28
push eax
push ecx
mov ecx, 0x46aaa0
mov dword [esp + 0x1c], str.System_Informer.lnk
call fcn.00411d00
mov edi, eax
test edi, edi
je 0x404576
mov edx, dword [edi + 4]
push ecx
push 0x5040
push 1
push 7
push 0x80
push 0
push 0x10000
lea ecx, [esp + 0x28]
call fcn.004107a0
test eax, eax
js 0x404566
push dword [esp + 0xc]
call dword [sym.imp.ntdll.dll_NtClose]
lea ecx, [edi - 8]
lock xadd dword [ecx + 4], esi
dec esi
jne 0x404576
call fcn.00405d40
push ecx
push 0x46aab8
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410600
test eax, eax
js 0x4045a6
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword ds:[esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push ecx
push 0x46aab0
push 0xfffffffffffffffd
mov edx, 0x10000
lea ecx, [esp + 0x2c]
call fcn.00410600
lea esp, [esp]
test eax, eax
js 0x4045d8
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
push dword [esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
push ecx
push 0x46aac0
push 0xfffffffffffffff7
mov edx, 0x2001f
lea ecx, [esp + 0x2c]
call fcn.00410600
test eax, eax
js 0x404726
mov ebx, dword [esp + 0x20]
xor edi, edi
push 0x100
push 4
push dword [0x46bcf4]
mov dword [esp + 0x18], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
cmp eax, 0x8000001a
je 0x40470b
cmp eax, 0x80000005
je 0x404647
nop
cmp eax, 0xc0000023
jne 0x40467e
push esi
push 0
push dword [0x46bcf4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [esp + 0xc]
push 4
push dword [0x46bcf4]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
mov edi, edi
test eax, eax
js 0x40470b
cmp dword [esi + 4], 1
jne 0x4046e6
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov edx, 0x46acf4
mov eax, dword [esi + 8]
add eax, esi
push 1
mov dword [esp + 0x20], eax
call fcn.00406960
cmp eax, 0xffffffff
je 0x4046e6
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x14]
mov word [esp + 0x10], dx
mov dword [esp + 0x14], ecx
lea eax, [edx + 2]
mov word [esp + 0x12], ax
cmp edx, 0xfffe
ja 0x4046e6
lea eax, ds:[esp + 0x10]
push eax
push ebx
lfence
call dword [sym.imp.ntdll.dll_NtDeleteValueKey]
lea eax, [esp + 0xc]
inc edi
push eax
lfence
push dword [esp + 0x10]
push esi
push 1
push edi
push ebx
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
mov edi, edi
cmp eax, 0x8000001a
jne 0x404638
push esi
push 0
push dword [0x46bcf4]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword ds:[esp + 0x20]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00420226
mov esp, ebp
pop ebp
ret