Function at 0x62a5f4
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x23
push 0
push 0
dec ecx
jne 0x62a5fd
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x80], ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x30], eax
mov ecx, 0xa
lea eax, [ebp - 0x28]
mov edx, dword [0x4012b8]
call fcn.0040bf08
xor eax, eax
push ebp
push 0x62b721
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x62b744
call fcn.00616130
lea eax, [ebp - 0xac]
call fcn.005c745c
mov eax, dword [ebp - 0xac]
call fcn.00424020
mov byte [ebp - 0x81], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x82], 0
xor eax, eax
mov dword [ebp - 0x88], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dl, 1
mov eax, dword [0x60cabc]
call fcn.00408414
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x62b69f
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x60cabc]
call fcn.00408414
mov dword [ebp - 0x88], eax
mov dl, 1
mov eax, dword [0x60cabc]
call fcn.00408414
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x60cabc]
call fcn.00408414
mov dword [ebp - 0x40], eax
mov dl, 1
mov eax, dword [0x60cabc]
call fcn.00408414
mov dword [ebp - 0x38], eax
mov dl, 1
mov eax, dword [0x60cabc]
call fcn.00408414
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x80], 0
je 0x62a70b
mov dl, 1
mov eax, dword [0x60cabc]
call fcn.00408414
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x8c], eax
mov ecx, eax
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0x29], 0
je 0x62aaeb
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x62aaeb
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x80
jne 0x62aad0
xor eax, eax
push ebp
push 0x62aa7a
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062a5a0
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x62a792
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.006106e0
inc eax
jne 0x62aa3b
mov bl, 1
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 1
je 0x62a7a9
xor ebx, ebx
jmp 0x62a7b3
test esi, 2
je 0x62a7b3
mov bl, 2
mov dword [ebp - 0xa8], 1
test esi, 8
je 0x62a7d1
mov dword [ebp - 0xa8], 7
jmp 0x62a7f5
test esi, 0x10
je 0x62a7e5
mov dword [ebp - 0xa8], 3
jmp 0x62a7f5
test esi, 0x40
je 0x62a7f5
xor eax, eax
mov dword [ebp - 0xa8], eax
test esi, 4
jne 0x62a91f
lea eax, [ebp - 0xb0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62b79c
call fcn.0040b4c8
mov eax, dword [ebp - 0xb0]
call fcn.00616130
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x62a84f
cmp dword [ebp - 0x24], 0
je 0x62a84f
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x62b7d8
call fcn.0040b4c8
mov eax, dword [ebp - 0xb4]
call fcn.00616130
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x62a878
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060c5f4
test al, al
je 0x62a910
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x6296d4
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.0060f06c
test al, al
jne 0x62a8dd
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62b818
call fcn.006163b4
mov byte [ebp - 0x81], 0
jmp 0x62aa25
cmp bl, 1
jne 0x62aa25
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62b85c
call fcn.006163b4
jmp 0x62aa25
mov eax, 0x62b894
call fcn.00616130
jmp 0x62aa25
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62b8dc
call fcn.0040b4c8
mov eax, dword [ebp - 0xc0]
call fcn.00616130
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x62a96d
cmp dword [ebp - 0x24], 0
je 0x62a96d
lea eax, [ebp - 0xc4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x62b924
call fcn.0040b4c8
mov eax, dword [ebp - 0xc4]
call fcn.00616130
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x62a989
mov eax, dword [ebp - 0x28]
call fcn.005c6894
test al, al
je 0x62aa1b
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
jne 0x62a997
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x6296d4
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.0060f338
test al, al
jne 0x62a9ef
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62b970
call fcn.006163b4
mov byte [ebp - 0x81], 0
jmp 0x62aa25
cmp bl, 1
jne 0x62aa25
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62b85c
call fcn.006163b4
jmp 0x62aa25
mov eax, 0x62b9b4
call fcn.00616130
cmp dword [ebp - 0x1c], 0
je 0x62aa70
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.006105ec
jmp 0x62aa70
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62ba10
call fcn.006163b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62aaa6
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.00629554
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x62aade
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x62a74a
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x62ad30
mov byte [ebp - 0x91], 0
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x82
jne 0x62ace2
mov byte [ebp - 0x91], 1
xor eax, eax
push ebp
push 0x62acb6
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062a5a0
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x62ab55
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x62aca5
cmp byte [ebp - 0x29], 0
jne 0x62ab61
cmp dword [ebp - 0x24], 0
jne 0x62ab65
xor eax, eax
jmp 0x62ab67
mov al, 1
mov byte [ebp - 0x92], al
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x62ab9c
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x28]
call fcn.00629db4
mov byte [ebp - 0x93], al
jmp 0x62aba3
mov byte [ebp - 0x93], 0
test bl, bl
je 0x62abf5
cmp byte [ebp - 0x93], 0
je 0x62acac
cmp byte [ebp - 0x92], 0
jne 0x62abf5
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060c5f4
test al, al
je 0x62abf5
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x62abf5
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x62acac
mov byte [ebp - 0x91], 0
cmp byte [ebp - 0x92], 0
jne 0x62ac49
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je 0x62ac28
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.00629ebc
pop ecx
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x40
je 0x62ac49
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0062a14c
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
je 0x62ac8f
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0x11
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62ba68
call fcn.006163b4
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x20
setne cl
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.00610040
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x10
je 0x62acac
mov eax, dword [ebp - 0x18]
call fcn.0062a360
jmp 0x62acac
mov byte [ebp - 0x91], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62ace2
cmp byte [ebp - 0x91], 0
je 0x62ad15
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.00629554
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x62ad23
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x62ab04
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x62b5c1
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062a5a0
pop ecx
xor eax, eax
push ebp
push 0x62b560
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
cmp eax, 0x85
jg 0x62adcc
je 0x62b0ab
cmp eax, 0x81
jg 0x62adae
je 0x62ae41
dec eax
je 0x62adfd
add eax, 0xfffffff1
sub eax, 2
jb case.0x62adda.140
sub eax, 0xe
je case.0x62adda.140
sub eax, 0x60
je case.0x62adda.140
jmp case.default.0x62adda
sub eax, 0x82
je 0x62aefd
dec eax
je case.0x62adda.140
dec eax
je 0x62b021
jmp case.default.0x62adda
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x62adda
jmp dword [eax*4 + 0x62ade1]
lea eax, [ebp - 0xdc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62baa4
call fcn.0040b4c8
mov edx, dword [ebp - 0xdc]
lea ecx, [ebp - 0xd8]
mov ax, 0xea
call fcn.005cd508
mov ecx, dword [ebp - 0xd8]
mov dl, 1
mov eax, dword [0x41ba8c]
call fcn.00429008
call fcn.004098c4
jmp case.0x62adda.140
cmp byte [ebp - 0x29], 0
jne 0x62ae57
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne case.0x62adda.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
setne al
push eax
push 0
push 0x6295d0
push 0x6295dc
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060dcc8
test al, al
je case.0x62adda.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
je case.0x62adda.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je case.0x62adda.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 5
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x28]
call fcn.005c5378
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x3c]
call fcn.00610640
jmp case.0x62adda.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
cmp byte [ebp - 0x29], 0
jne 0x62af14
cmp dword [ebp - 0x74], 0
jne 0x62af1f
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
cmp byte [ebp - 0x29], 0
jne 0x62af31
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x62af9b
cmp byte [ebp - 0x29], 0
jne 0x62af47
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
jne case.0x62adda.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.00629850
pop ecx
test al, al
jne case.0x62adda.140
mov byte [ebp - 0x81], 0
jmp case.0x62adda.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
je 0x62afbc
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x28]
call fcn.00629db4
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040b660
je case.0x62adda.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.00629850
pop ecx
test al, al
jne case.0x62adda.140
mov byte [ebp - 0x81], 0
jmp case.0x62adda.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x20]
call fcn.0040a5f0
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xf0], eax
mov byte [ebp - 0xec], 0x11
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 0x74]
call fcn.0062a55c
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe8], eax
mov byte [ebp - 0xe4], 0x11
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62bad0
call fcn.006163b4
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
call fcn.005c6cd4
jmp case.0x62adda.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
je 0x62b0e0
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.005c6b78
test al, al
je case.0x62adda.140
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 0x74]
call fcn.0062a55c
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62bb34
call fcn.006163b4
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.005c6d20
jmp case.0x62adda.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.006292c4
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0xa0]
call fcn.0060cf98
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62bb80
call fcn.006163b4
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7ad4
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x62adda.140
sub eax, 2
je case.0x62adda.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62bbc8
call fcn.006163b4
mov byte [ebp - 0x81], 0
jmp case.0x62adda.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.006292c4
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 0xa0]
call fcn.0060cf98
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62bc00
call fcn.006163b4
push 0
push 2
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7a14
test eax, eax
jne case.0x62adda.140
push 2
push 0x6cd0c0
push 1
push 0
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x62b2e8
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62bc50
call fcn.006163b4
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x62adda.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.006292c4
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 0xa0]
call fcn.0060cf98
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62bc94
call fcn.006163b4
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7c58
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x91
jne 0x62b391
mov eax, 0x62bce8
call fcn.00616130
jmp case.0x62adda.140
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x62adda.140
sub eax, 2
je case.0x62adda.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62bbc8
call fcn.006163b4
mov byte [ebp - 0x81], 0
jmp case.0x62adda.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.006292c4
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 0xa0]
call fcn.0060cf98
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62bd30
call fcn.006163b4
push 0
push 3
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7a14
test eax, eax
jne case.0x62adda.140
mov edx, esi
mov eax, dword [ebp - 0xa4]
call fcn.005c7954
test al, al
je 0x62b4cc
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x62b4cc
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62bd80
call fcn.006163b4
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x62adda.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x28]
call fcn.00629db4
jmp case.0x62adda.140
mov byte [ebp - 0x82], 1
jmp case.0x62adda.140
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62bdc4
call fcn.004244f8
mov edx, dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
mov ax, 0xea
call fcn.005cd508
mov ecx, dword [ebp - 0x114]
mov dl, 1
mov eax, dword [0x41ba8c]
call fcn.00429008
call fcn.004098c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62b58c
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.00629554
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x90], 0
jne 0x62ad49
cmp byte [ebp - 0x82], 0
je 0x62b5da
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x30]
test byte [eax + 0x1d], 0x10
je 0x62b5e8
call fcn.00610320
cmp dword [ebp - 0x80], 0
je 0x62b5f8
call dword [ebp - 0x80]
push ebp
call fcn.0062a4c8
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b6a9
mov eax, dword [ebp - 0x48]
call fcn.00408444
mov eax, dword [ebp - 0x34]
call fcn.00408444
mov eax, dword [ebp - 0x38]
call fcn.00408444
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x62b67b
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x11c]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.006106c4
mov eax, dword [ebp - 0x11c]
call fcn.005c6880
test al, al
je 0x62b677
push 0
lea ecx, [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.006106c4
mov eax, dword [ebp - 0x120]
call fcn.0040b278
push eax
push 0x1005
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x62b62b
mov eax, dword [ebp - 0x40]
call fcn.00408444
mov eax, dword [ebp - 0x44]
call fcn.00408444
mov eax, dword [ebp - 0x88]
call fcn.00408444
mov eax, dword [ebp - 0x3c]
call fcn.00408444