Function at 0x402b86
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x425018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402bc8
push 0x800
mov ecx, esi
call dword [0x41c248]
call esi
xor esi, esi
lea ecx, [ebp - 8]
push edi
mov dword [ebp - 8], esi
call fcn.00403060
mov dword [ebp - 0x58], esi
call fcn.0040132b
push eax
lea ecx, [ebp - 0x58]
call fcn.00403531
push str.async
mov edi, 0x422460
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.0040162b
add esp, 0xc
lea edx, [ebp - 0x58]
lea ecx, [ebp - 8]
call fcn.0040179e
mov ecx, dword [ebp - 0x58]
mov bl, al
add ecx, 0xfffffff0
call fcn.00401302
test bl, bl
je 0x402c2c
lea ecx, [ebp - 8]
call fcn.00402ad2
mov esi, dword [ebp - 8]
mov edi, eax
jmp 0x402daa
call fcn.00401822
mov bl, al
mov byte [ebp - 0xc], bl
test bl, bl
je 0x402c44
call fcn.00402925
call fcn.004029c3
mov dword [ebp - 0x58], esi
call fcn.0040132b
push eax
lea ecx, [ebp - 0x58]
call fcn.00403531
push str.asyncupdate
lea eax, [ebp - 0x58]
push edi
push eax
call fcn.0040162b
add esp, 0xc
lea edx, [ebp - 0x58]
lea ecx, [ebp - 8]
call fcn.0040179e
mov ecx, dword [ebp - 0x58]
mov bh, al
add ecx, 0xfffffff0
call fcn.00401302
test bh, bh
je 0x402c88
and dword [ebp - 0x58], esi
jmp 0x402ca0
mov edx, 0x41eb0
mov ecx, str.WUUpdateCheckTimeout
call fcn.00403aed
mov esi, eax
mov dword [ebp - 0x58], 0x80040751
xor edx, edx
mov ecx, str.WUInstallTimeout
test bl, bl
sete dl
dec edx
and edx, 0xffcda560
add edx, 0x36ee80
call fcn.00403aed
mov edx, eax
test bl, bl
je 0x402cd3
test bh, bh
je 0x402cd3
mov eax, 0xea60
cmp edx, eax
jbe 0x402cd3
mov edx, eax
push 7
pop ecx
push dword [ebp - 0x58]
xor eax, eax
lea edi, [ebp - 0x28]
push dword [ebp - 0xc]
rep stosd dword es:[edi], eax
push esi
push edx
lea ecx, [ebp - 0x28]
call fcn.00403b32
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, dword [ebp - 8]
mov dword [ebp - 0xc], eax
test eax, eax
js 0x402d11
push ecx
call fcn.00401583
pop ecx
test al, al
jne 0x402d1f
mov eax, 0x80040703
mov ecx, eax
lfence
call fcn.00402857
mov edi, eax
jmp 0x402d9a
push 0x2c
lea eax, [ebp - 0x54]
push 0
push eax
call fcn.00408a40
add esp, 0xc
lea ecx, [ebp - 0x54]
push esi
push dword [ebp + 8]
call fcn.00401977
lea ecx, [ebp - 0x54]
call fcn.00401a1a
mov edi, eax
test bl, bl
je 0x402d92
cmp edi, 0x8004090d
jne 0x402d55
xor edi, edi
jmp 0x402d5f
test bh, bh
jne 0x402d51
mov edi, eax
test eax, eax
jne 0x402d92
lea eax, [ebp - 0x58]
push eax
push 2
push 0
push 0x4224f4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402d92
push str.WindowsUpdateAttempts
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x54]
call fcn.004019d4
lea ecx, [ebp - 0xc]
call fcn.00402ee0
lea ecx, [ebp - 0x28]
call fcn.00403c18
lea ecx, [esi - 0x10]
call fcn.00401302
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408525
leave
ret 0x10