Function at 0x412834
Capabilities:
Check if file exists
Delete registry value
Query or enumerate registry value

Disassembly:
push 0x74
mov eax, 0x489f88
call fcn.0044465a
and dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
mov ebx, str.ruleCleaned
push ebx
mov edi, 0x490a70
push edi
mov esi, reloc.WS2_32.dll_bind
push esi
mov dword [ebp - 0x38], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x412881
cmp dword [ebp - 0x40], 4
jne 0x412881
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
jmp 0x412885
and dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], 1
jne 0x41289b
push str.rule_cleaned_manually_old_version___update_paused
call fcn.0041f771
pop ecx
jmp 0x412b21
jbe 0x4128c8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x38]
cmp eax, 0x36ee80
jae 0x4128b4
push str.rule_cleaned_manually_new_version___update_paused
jmp 0x412890
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.rule_cleaned_expired__restore_to_update
call fcn.0041f771
pop ecx
push str.ruleupt
lea eax, [ebp - 0x30]
push str.Softwareprojonepodlp_
push eax
call fcn.004012e7
add esp, 0xc
xor edi, edi
mov dword [ebp - 4], edi
mov byte [ebp - 0x31], 0
cmp dword [ebp - 0x1c], edi
jne 0x4128ff
push str.local_rule_update_time_empty_
mov byte [ebp - 0x31], 1
call fcn.0041fa04
jmp 0x41299e
lea eax, [ebp - 0x80]
push eax
call fcn.004119e5
pop ecx
xor esi, esi
mov byte [ebp - 4], 1
inc esi
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x38], esi
jb 0x41291e
mov eax, dword [eax + 4]
jmp 0x412921
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41295e
lea eax, [ebp - 0x64]
push eax
call fcn.004119e5
cmp dword [eax + 0x18], 8
pop ecx
mov dword [ebp - 0x38], 3
jb 0x412948
mov eax, dword [eax + 4]
jmp 0x41294b
add eax, 4
push eax
call fcn.0041bb05
cmp edx, edi
ja 0x41295a
cmp eax, 0xa
jb 0x41295e
xor bl, bl
jmp 0x412960
mov bl, 1
test byte [ebp - 0x38], 2
je 0x412974
and dword [ebp - 0x38], 0xfffffffd
push edi
push esi
lea esi, [ebp - 0x64]
call fcn.00403d0d
mov dword [ebp - 4], edi
test byte [ebp - 0x38], 1
je 0x41298c
and dword [ebp - 0x38], 0xfffffffe
push edi
push 1
lea esi, [ebp - 0x80]
call fcn.00403d0d
test bl, bl
je 0x4129a4
push str.rule_error:_no_rule_file_or_file_too_small
mov byte [ebp - 0x31], 1
call fcn.0041fc97
pop ecx
jmp 0x412a24
push edi
push edi
lea eax, [ebp - 0x64]
call fcn.0042a348
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 4], 4
call fcn.004119e5
pop ecx
push 4
mov byte [ebp - 4], 5
pop edi
or dword [ebp - 0x38], edi
cmp dword [eax + 0x18], 8
jb 0x4129d1
mov eax, dword [eax + 4]
jmp 0x4129d4
add eax, 4
lea esi, [ebp - 0x64]
mov ecx, eax
call fcn.00401570
test al, al
je 0x4129ec
cmp byte [ebp - 0x5c], 7
jne 0x4129ec
xor bl, bl
jmp 0x4129ee
mov bl, 1
mov dword [ebp - 4], edi
test byte [ebp - 0x38], 4
je 0x412a03
push 0
push 1
lea esi, [ebp - 0x80]
call fcn.00403d0d
test bl, bl
je 0x412a16
push str.rule_error:_invalid_json
mov byte [ebp - 0x31], 1
call fcn.0041fc97
pop ecx
lea esi, [ebp - 0x64]
mov byte [ebp - 4], 0
call fcn.0042966c
xor edi, edi
lea eax, [ebp - 0x80]
push eax
call fcn.00420d7a
pop ecx
mov byte [ebp - 4], 6
cmp dword [eax + 0x18], 0x10
jb 0x412a3d
mov eax, dword [eax + 4]
jmp 0x412a40
add eax, 4
push 0x7d0
push str.clientRuleUpTime
mov ecx, eax
call fcn.004118ae
push edi
mov esi, eax
push 1
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x3c], esi
mov byte [ebp - 4], 0
call fcn.00403c15
cmp esi, edi
jne 0x412a7a
push str.request_rule_update_time_failed
call fcn.0041fc97
pop ecx
push edi
jmp 0x412b17
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x412a86
lea eax, [ebp - 0x2c]
cmp eax, edi
je 0x412aa2
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x412a96
lea eax, [ebp - 0x2c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x412ab1
push str.rule_changed_on_server
call fcn.0041f771
pop ecx
mov byte [ebp - 0x31], 1
cmp byte [ebp - 0x31], 0
je 0x412ada
call fcn.00412694
test eax, eax
je 0x412ada
push str._DownloadAndPreprocessRule_ok
call fcn.0041f771
pop ecx
mov ebx, str.ruleupt
mov edi, str.Softwareprojonepodlp_
call fcn.0041dce5
lea esi, [ebp - 0x64]
call fcn.0041c850
cmp dword [eax + 0x18], 0x10
jb 0x412aed
mov eax, dword [eax + 4]
jmp 0x412af0
add eax, 4
mov esi, eax
mov ebx, str.rulechktime
mov edi, str.Softwareprojonepodlp_
call fcn.0041dce5
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.00403c15
push dword [ebp - 0x3c]
call fcn.0041f4d9
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.00403c15
call fcn.004446dd
ret