Function at 0x418d80
Capabilities:
Delete registry value

Disassembly:
push ebx
mov ebx, esp
add esp, 0xffffff28
push edi
push esi
push ebp
mov ebp, ecx
push 1
lea ecx, [ebx - 0xd8]
call fcn.00406150
mov dword [eax + 0x60], 0x64
add eax, 0x10
push str.UpdateRegistry__
push eax
call fcn.00404170
push eax
call fcn.00405590
sub esp, 0xfffffff4
lea ecx, [ebx - 0x70]
call fcn.0040c2b0
lea eax, [ebx - 0x70]
push eax
mov dword [ebx - 0x70], 0x4313b0
call fcn.0041aa80
sub esp, 0xfffffffc
push 0x20019
xor edi, edi
push str.AppID
push SysReAllocString
lea ecx, [ebx - 0xc]
mov dword [ebx - 0xc], edi
mov dword [ebx - 8], edi
mov dword [ebx - 4], edi
call fcn.0040d000
mov esi, eax
cmp esi, edi
je 0x418e19
mov eax, dword [ebx - 0xc]
mov dword [ebp + 0x250], esi
cmp eax, edi
je 0x418e10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop ebp
pop esi
pop edi
mov esp, ebx
pop ebx
ret
mov esi, dword [ebx - 0xc]
push 0x20019
push str.11AC3232_E7D7_49CD_ABFE_501700100B3A
push esi
mov dword [ebx - 0x18], edi
lea ecx, [ebx - 0x18]
mov dword [ebx - 0x14], edi
mov dword [ebx - 0x10], edi
call fcn.0040d000
lea ecx, [ebx - 0xd8]
push 1
or eax, eax
jne 0x418ea6
call fcn.00406150
mov dword [eax + 0x60], 0x64
add eax, 0x10
push str.Registry_is_up_to_date
push eax
call fcn.00404170
push eax
call fcn.00405590
add esp, 0xc
lea ecx, [ebx - 0x70]
call fcn.0040c2b0
lea ecx, [ebx - 0x70]
push ecx
mov dword [ebx - 0x70], 0x4313b0
call fcn.0041aa80
mov eax, dword [ebx - 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 0xfffffffc
cmp eax, edi
je 0x418e92
push eax
call ebp
cmp esi, edi
je 0x4190e1
push esi
call ebp
xor eax, eax
pop ebp
pop esi
pop edi
mov esp, ebx
pop ebx
ret
call fcn.00406150
mov dword [eax + 0x60], 0xa
sub eax, 0xfffffff0
push str.Registry_update_needed
push eax
call fcn.00404170
push eax
call fcn.00405590
sub esp, 0xfffffff4
lea ecx, [ebx - 0x70]
call fcn.0040c2b0
lea edx, [ebx - 0x70]
push edx
mov dword [ebx - 0x70], 0x4313b0
call fcn.0041aa80
mov ecx, dword [0x43f30c]
sub esp, 0xfffffffc
lea eax, [ebx - 0x28]
push eax
push 1
push 0x65
push ecx
mov dword [ebx - 0x28], 0x433660
mov dword [ebx - 0x24], 0x4333d8
mov dword [ebx - 0x20], edi
mov dword [ebx - 0x1c], edi
call fcn.00410450
mov esi, eax
cmp esi, edi
jge 0x418f35
mov eax, dword [ebx - 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x418f22
push eax
call ebp
mov eax, dword [ebx - 0xc]
cmp eax, edi
je 0x418f2c
push eax
call ebp
mov eax, esi
pop ebp
pop esi
pop edi
mov esp, ebx
pop ebx
ret
mov eax, dword [ebx - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x418f48
push eax
call esi
mov dword [ebx - 0xc], edi
push 0x20006
push str.AppID
lea ecx, [ebx - 0xc]
push SysReAllocString
mov dword [ebx - 8], edi
call fcn.0040d000
cmp eax, edi
je 0x418f8e
push eax
call fcn.0040cd00
mov ebp, eax
mov eax, dword [ebx - 0x18]
add esp, 4
cmp eax, edi
je 0x418f7b
push eax
call esi
mov eax, dword [ebx - 0xc]
cmp eax, edi
je 0x418f85
push eax
call esi
mov eax, ebp
pop ebp
pop esi
pop edi
mov esp, ebx
pop ebx
ret
mov edx, dword [ebx - 0xc]
push edi
push edi
push 0x2001f
push edi
push edi
push str.11AC3232_E7D7_49CD_ABFE_501700100B3A
lea ecx, [ebx - 0x18]
push edx
call fcn.0040cf60
mov esi, eax
cmp esi, edi
je 0x418fce
lea ecx, [ebx - 0x18]
call fcn.0040da90
lea ecx, [ebx - 0xc]
call fcn.0040da90
push esi
call fcn.0040cd00
sub esp, 0xfffffffc
pop ebp
pop esi
pop edi
mov esp, ebx
pop ebx
ret
mov eax, dword [ebx - 0x18]
push str.LocalService
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 1
lea ecx, [ebx - 0xd8]
call fcn.00406150
lea esi, [ebp + 0x40]
push esi
mov dword [eax + 0x60], 0xa
add eax, 0x10
push str.LocalService_:
push eax
call fcn.00404170
add esp, 8
push eax
call fcn.0040a620
push eax
call fcn.00405590
sub esp, 0xfffffff4
lea ecx, [ebx - 0xd8]
call fcn.00401a20
push 1
push esi
push str.LocalService
lea ecx, [ebx - 0x18]
call fcn.0040d0d0
mov ecx, dword [ebx - 0x18]
push ecx
call fcn.00418000
add esp, 4
push 1
lea ecx, [ebx - 0xd8]
call fcn.00406150
mov dword [eax + 0x60], 0xa
sub eax, 0xfffffff0
push str.Registering_Server
push eax
call fcn.00404170
push eax
call fcn.00405590
sub esp, 0xfffffff4
lea ecx, [ebx - 0xd8]
call fcn.00401a20
push edi
push 1
mov ecx, ebp
call fcn.00417bf0
mov esi, eax
cmp esi, edi
jge 0x41909b
lea ecx, [ebx - 0x18]
call fcn.0040da90
lea ecx, [ebx - 0xc]
call fcn.0040da90
mov eax, esi
pop ebp
pop esi
pop edi
mov esp, ebx
pop ebx
ret
lea ecx, [ebx - 0xd8]
push 1
call fcn.00406150
mov dword [eax + 0x60], 0x64
sub eax, 0xfffffff0
push str.UpdateRegistry___done
push eax
call fcn.00404170
push eax
call fcn.00405590
sub esp, 0xfffffff4
lea ecx, [ebx - 0xd8]
call fcn.00401a20
lea ecx, [ebx - 0x18]
call fcn.0040da90
lea ecx, [ebx - 0xc]
call fcn.0040da90
xor eax, eax
pop ebp
pop esi
pop edi
mov esp, ebx
pop ebx
ret