Function at 0x61c1ec
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x23
push 0
push 0
dec ecx
jne 0x61c1f5
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x80], ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x30], eax
mov ecx, 0xa
lea eax, [ebp - 0x28]
mov edx, dword [0x4012b8]
call fcn.0040c6cc
xor eax, eax
push ebp
push 0x61d340
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x61d364
call fcn.00607c10
lea eax, [ebp - 0xac]
call fcn.005bc700
mov eax, dword [ebp - 0xac]
call fcn.00425724
mov byte [ebp - 0x81], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x82], 0
xor eax, eax
mov dword [ebp - 0x88], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dl, 1
mov eax, dword [0x5fe6e8]
call fcn.00408b9c
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x61d2bc
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x5fe6e8]
call fcn.00408b9c
mov dword [ebp - 0x88], eax
mov dl, 1
mov eax, dword [0x5fe6e8]
call fcn.00408b9c
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x5fe6e8]
call fcn.00408b9c
mov dword [ebp - 0x40], eax
mov dl, 1
mov eax, dword [0x5fe6e8]
call fcn.00408b9c
mov dword [ebp - 0x38], eax
mov dl, 1
mov eax, dword [0x5fe6e8]
call fcn.00408b9c
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x80], 0
je 0x61c303
mov dl, 1
mov eax, dword [0x5fe6e8]
call fcn.00408b9c
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x8c], eax
mov ecx, eax
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0x29], 0
je 0x61c706
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x61c706
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x80
jne 0x61c6eb
xor eax, eax
push ebp
push 0x61c695
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0061c198
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x61c38a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.006021ac
inc eax
jne 0x61c656
mov bl, 1
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 1
je 0x61c3a1
xor ebx, ebx
jmp 0x61c3ab
test esi, 2
je 0x61c3ab
mov bl, 2
mov dword [ebp - 0xa8], 1
test esi, 8
je 0x61c3c9
mov dword [ebp - 0xa8], 7
jmp 0x61c3ed
test esi, 0x10
je 0x61c3dd
mov dword [ebp - 0xa8], 3
jmp 0x61c3ed
test esi, 0x40
je 0x61c3ed
xor eax, eax
mov dword [ebp - 0xa8], eax
test esi, 4
jne 0x61c53a
lea eax, [ebp - 0xb0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x61d3bc
call fcn.0040bad8
mov eax, dword [ebp - 0xb0]
call fcn.00607c10
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x61c447
cmp dword [ebp - 0x24], 0
je 0x61c447
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x61d3f8
call fcn.0040bad8
mov eax, dword [ebp - 0xb4]
call fcn.00607c10
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x61c470
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x28]
call fcn.005fe208
test al, al
je 0x61c52b
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x61b23c
call fcn.00607be4
test al, al
je 0x61c496
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 4
jne 0x61c49a
xor eax, eax
jmp 0x61c49c
mov al, 1
push eax
push 0x61b3b8
push 0
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.00600ec4
test al, al
jne 0x61c4f8
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x61d438
call fcn.00607e98
mov byte [ebp - 0x81], 0
jmp 0x61c640
cmp bl, 1
jne 0x61c640
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x61d47c
call fcn.00607e98
jmp 0x61c640
mov eax, 0x61d4b4
call fcn.00607c10
jmp 0x61c640
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x61d4fc
call fcn.0040bad8
mov eax, dword [ebp - 0xc0]
call fcn.00607c10
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x61c588
cmp dword [ebp - 0x24], 0
je 0x61c588
lea eax, [ebp - 0xc4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x61d544
call fcn.0040bad8
mov eax, dword [ebp - 0xc4]
call fcn.00607c10
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x61c5a4
mov eax, dword [ebp - 0x28]
call fcn.005bbae4
test al, al
je 0x61c636
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
jne 0x61c5b2
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x61b23c
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.006011f0
test al, al
jne 0x61c60a
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x61d590
call fcn.00607e98
mov byte [ebp - 0x81], 0
jmp 0x61c640
cmp bl, 1
jne 0x61c640
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x61d47c
call fcn.00607e98
jmp 0x61c640
mov eax, 0x61d5d4
call fcn.00607c10
cmp dword [ebp - 0x1c], 0
je 0x61c68b
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.006020bc
jmp 0x61c68b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x61d630
call fcn.00607e98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61c6c1
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.0061b0c4
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x61c6f9
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x61c342
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x61c94b
mov byte [ebp - 0x91], 0
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x82
jne 0x61c8fd
mov byte [ebp - 0x91], 1
xor eax, eax
push ebp
push 0x61c8d1
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0061c198
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x61c770
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x61c8c0
cmp byte [ebp - 0x29], 0
jne 0x61c77c
cmp dword [ebp - 0x24], 0
jne 0x61c780
xor eax, eax
jmp 0x61c782
mov al, 1
mov byte [ebp - 0x92], al
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x61c7b7
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x28]
call fcn.0061b9a0
mov byte [ebp - 0x93], al
jmp 0x61c7be
mov byte [ebp - 0x93], 0
test bl, bl
je 0x61c810
cmp byte [ebp - 0x93], 0
je 0x61c8c7
cmp byte [ebp - 0x92], 0
jne 0x61c810
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.005fe208
test al, al
je 0x61c810
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x61c810
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x61c8c7
mov byte [ebp - 0x91], 0
cmp byte [ebp - 0x92], 0
jne 0x61c864
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je 0x61c843
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0061baa8
pop ecx
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x40
je 0x61c864
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0061bd3c
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
je 0x61c8aa
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0x11
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x61d688
call fcn.00607e98
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x20
setne cl
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.00601aac
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x10
je 0x61c8c7
mov eax, dword [ebp - 0x18]
call fcn.0061bf54
jmp 0x61c8c7
mov byte [ebp - 0x91], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61c8fd
cmp byte [ebp - 0x91], 0
je 0x61c930
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.0061b0c4
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x61c93e
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x61c71f
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x61d1dc
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0061c198
pop ecx
xor eax, eax
push ebp
push 0x61d17b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
cmp eax, 0x85
jg 0x61c9e7
je 0x61ccc6
cmp eax, 0x81
jg 0x61c9c9
je 0x61ca5c
dec eax
je 0x61ca18
add eax, 0xfffffff1
sub eax, 2
jb case.0x61c9f5.140
sub eax, 0xe
je case.0x61c9f5.140
sub eax, 0x60
je case.0x61c9f5.140
jmp case.default.0x61c9f5
sub eax, 0x82
je 0x61cb18
dec eax
je case.0x61c9f5.140
dec eax
je 0x61cc3c
jmp case.default.0x61c9f5
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x61c9f5
jmp dword [eax*4 + 0x61c9fc]
lea eax, [ebp - 0xdc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x61d6c4
call fcn.0040bad8
mov edx, dword [ebp - 0xdc]
lea ecx, [ebp - 0xd8]
mov ax, 0xea
call fcn.005c327c
mov ecx, dword [ebp - 0xd8]
mov dl, 1
mov eax, dword [0x41d190]
call fcn.0042b510
call fcn.00409f64
jmp case.0x61c9f5.140
cmp byte [ebp - 0x29], 0
jne 0x61ca72
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne case.0x61c9f5.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
setne al
push eax
push 0
push 0x61b138
push 0x61b144
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne al
mov edx, dword [ebp - 0x28]
call fcn.005ffb74
test al, al
je case.0x61c9f5.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
je case.0x61c9f5.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je case.0x61c9f5.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 5
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x28]
call fcn.005ba1ac
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x3c]
call fcn.00602110
jmp case.0x61c9f5.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x24]
call fcn.0040aca4
cmp byte [ebp - 0x29], 0
jne 0x61cb2f
cmp dword [ebp - 0x74], 0
jne 0x61cb3a
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040aca4
cmp byte [ebp - 0x29], 0
jne 0x61cb4c
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x61cbb6
cmp byte [ebp - 0x29], 0
jne 0x61cb62
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
jne case.0x61c9f5.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.0061b414
pop ecx
test al, al
jne case.0x61c9f5.140
mov byte [ebp - 0x81], 0
jmp case.0x61c9f5.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
je 0x61cbd7
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x28]
call fcn.0061b9a0
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040bc70
je case.0x61c9f5.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.0061b414
pop ecx
test al, al
jne case.0x61c9f5.140
mov byte [ebp - 0x81], 0
jmp case.0x61c9f5.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.0040aca4
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x20]
call fcn.0040aca4
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040aca4
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xf0], eax
mov byte [ebp - 0xec], 0x11
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 0x74]
call fcn.0061c154
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe8], eax
mov byte [ebp - 0xe4], 0x11
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x61d6f0
call fcn.00607e98
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
call fcn.005bbf2c
jmp case.0x61c9f5.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.0040aca4
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040aca4
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
je 0x61ccfb
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.005bbdcc
test al, al
je case.0x61c9f5.140
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 0x74]
call fcn.0061c154
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x61d754
call fcn.00607e98
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.005bbf78
jmp case.0x61c9f5.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.0061ae30
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0xa0]
call fcn.005febc4
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x61d7a0
call fcn.00607e98
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005bccec
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x61c9f5.140
sub eax, 2
je case.0x61c9f5.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x61d7e8
call fcn.00607e98
mov byte [ebp - 0x81], 0
jmp case.0x61c9f5.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.0061ae30
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 0xa0]
call fcn.005febc4
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x61d820
call fcn.00607e98
push 0
push 2
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005bcc2c
test eax, eax
jne case.0x61c9f5.140
push 2
push 0x6b6bf4
push 1
push 0
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x61cf03
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x61d870
call fcn.00607e98
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x61c9f5.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.0061ae30
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 0xa0]
call fcn.005febc4
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x61d8b4
call fcn.00607e98
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005bce68
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x91
jne 0x61cfac
mov eax, 0x61d908
call fcn.00607c10
jmp case.0x61c9f5.140
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x61c9f5.140
sub eax, 2
je case.0x61c9f5.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x61d7e8
call fcn.00607e98
mov byte [ebp - 0x81], 0
jmp case.0x61c9f5.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.0061ae30
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 0xa0]
call fcn.005febc4
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x61d950
call fcn.00607e98
push 0
push 3
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005bcc2c
test eax, eax
jne case.0x61c9f5.140
mov edx, esi
mov eax, dword [ebp - 0xa4]
call fcn.005bcbd4
test al, al
je 0x61d0e7
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x61d0e7
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x61d9a0
call fcn.00607e98
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x61c9f5.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x28]
call fcn.0061b9a0
jmp case.0x61c9f5.140
mov byte [ebp - 0x82], 1
jmp case.0x61c9f5.140
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x61d9e4
call fcn.00425bfc
mov edx, dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
mov ax, 0xea
call fcn.005c327c
mov ecx, dword [ebp - 0x114]
mov dl, 1
mov eax, dword [0x41d190]
call fcn.0042b510
call fcn.00409f64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x61d1a7
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.0061b0c4
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x90], 0
jne 0x61c964
cmp byte [ebp - 0x82], 0
je 0x61d1f5
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x30]
test byte [eax + 0x1d], 0x10
je 0x61d203
call fcn.00601df0
cmp dword [ebp - 0x80], 0
je 0x61d213
call dword [ebp - 0x80]
push ebp
call fcn.0061c0c0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x61d2c6
mov eax, dword [ebp - 0x48]
call fcn.00408bcc
mov eax, dword [ebp - 0x34]
call fcn.00408bcc
mov eax, dword [ebp - 0x38]
call fcn.00408bcc
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x61d296
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x11c]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.00602190
mov eax, dword [ebp - 0x11c]
call fcn.005bbad0
test al, al
je 0x61d292
push 0
lea ecx, [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.00602190
mov eax, dword [ebp - 0x120]
call fcn.0040b88c
push eax
push 0x1005
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x61d246
mov eax, dword [ebp - 0x40]
call fcn.00408bcc
mov eax, dword [ebp - 0x44]
call fcn.00408bcc
mov eax, dword [ebp - 0x88]
call fcn.00408bcc
mov eax, dword [ebp - 0x3c]
call fcn.00408bcc
pop eax
jmp eax