Function at 0x6293b0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x23
push 0
push 0
dec ecx
jne 0x6293b9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x80], ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x30], eax
mov ecx, 0xa
lea eax, [ebp - 0x28]
mov edx, dword [0x4012b8]
call fcn.0040bf08
xor eax, eax
push ebp
push 0x62a4dd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x62a500
call fcn.00614eec
lea eax, [ebp - 0xac]
call fcn.005c7728
mov eax, dword [ebp - 0xac]
call fcn.00424020
mov byte [ebp - 0x81], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x82], 0
xor eax, eax
mov dword [ebp - 0x88], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dl, 1
mov eax, dword [0x60b878]
call fcn.00408414
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x62a45b
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x60b878]
call fcn.00408414
mov dword [ebp - 0x88], eax
mov dl, 1
mov eax, dword [0x60b878]
call fcn.00408414
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x60b878]
call fcn.00408414
mov dword [ebp - 0x40], eax
mov dl, 1
mov eax, dword [0x60b878]
call fcn.00408414
mov dword [ebp - 0x38], eax
mov dl, 1
mov eax, dword [0x60b878]
call fcn.00408414
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x80], 0
je 0x6294c7
mov dl, 1
mov eax, dword [0x60b878]
call fcn.00408414
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x8c], eax
mov ecx, eax
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0x29], 0
je 0x6298a7
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x6298a7
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x80
jne 0x62988c
xor eax, eax
push ebp
push 0x629836
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062935c
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x62954e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.0060f49c
inc eax
jne 0x6297f7
mov bl, 1
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 1
je 0x629565
xor ebx, ebx
jmp 0x62956f
test esi, 2
je 0x62956f
mov bl, 2
mov dword [ebp - 0xa8], 1
test esi, 8
je 0x62958d
mov dword [ebp - 0xa8], 7
jmp 0x6295b1
test esi, 0x10
je 0x6295a1
mov dword [ebp - 0xa8], 3
jmp 0x6295b1
test esi, 0x40
je 0x6295b1
xor eax, eax
mov dword [ebp - 0xa8], eax
test esi, 4
jne 0x6296db
lea eax, [ebp - 0xb0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62a558
call fcn.0040b4c8
mov eax, dword [ebp - 0xb0]
call fcn.00614eec
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x62960b
cmp dword [ebp - 0x24], 0
je 0x62960b
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x62a594
call fcn.0040b4c8
mov eax, dword [ebp - 0xb4]
call fcn.00614eec
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x629634
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060b3b0
test al, al
je 0x6296cc
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x628490
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.0060de28
test al, al
jne 0x629699
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62a5d4
call fcn.00615170
mov byte [ebp - 0x81], 0
jmp 0x6297e1
cmp bl, 1
jne 0x6297e1
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62a618
call fcn.00615170
jmp 0x6297e1
mov eax, 0x62a650
call fcn.00614eec
jmp 0x6297e1
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62a698
call fcn.0040b4c8
mov eax, dword [ebp - 0xc0]
call fcn.00614eec
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x629729
cmp dword [ebp - 0x24], 0
je 0x629729
lea eax, [ebp - 0xc4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x62a6e0
call fcn.0040b4c8
mov eax, dword [ebp - 0xc4]
call fcn.00614eec
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x629745
mov eax, dword [ebp - 0x28]
call fcn.005c6b60
test al, al
je 0x6297d7
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
jne 0x629753
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x628490
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.0060e0f4
test al, al
jne 0x6297ab
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62a72c
call fcn.00615170
mov byte [ebp - 0x81], 0
jmp 0x6297e1
cmp bl, 1
jne 0x6297e1
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62a618
call fcn.00615170
jmp 0x6297e1
mov eax, 0x62a770
call fcn.00614eec
cmp dword [ebp - 0x1c], 0
je 0x62982c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.0060f3a8
jmp 0x62982c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62a7cc
call fcn.00615170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x629862
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.00628310
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x62989a
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x629506
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x629aec
mov byte [ebp - 0x91], 0
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x82
jne 0x629a9e
mov byte [ebp - 0x91], 1
xor eax, eax
push ebp
push 0x629a72
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062935c
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x629911
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x629a61
cmp byte [ebp - 0x29], 0
jne 0x62991d
cmp dword [ebp - 0x24], 0
jne 0x629921
xor eax, eax
jmp 0x629923
mov al, 1
mov byte [ebp - 0x92], al
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x629958
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x28]
call fcn.00628b70
mov byte [ebp - 0x93], al
jmp 0x62995f
mov byte [ebp - 0x93], 0
test bl, bl
je 0x6299b1
cmp byte [ebp - 0x93], 0
je 0x629a68
cmp byte [ebp - 0x92], 0
jne 0x6299b1
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060b3b0
test al, al
je 0x6299b1
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x6299b1
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x629a68
mov byte [ebp - 0x91], 0
cmp byte [ebp - 0x92], 0
jne 0x629a05
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je 0x6299e4
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.00628c78
pop ecx
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x40
je 0x629a05
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.00628f08
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
je 0x629a4b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0x11
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62a824
call fcn.00615170
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x20
setne cl
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.0060edfc
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x10
je 0x629a68
mov eax, dword [ebp - 0x18]
call fcn.0062911c
jmp 0x629a68
mov byte [ebp - 0x91], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x629a9e
cmp byte [ebp - 0x91], 0
je 0x629ad1
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.00628310
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x629adf
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x6298c0
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x62a37d
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062935c
pop ecx
xor eax, eax
push ebp
push 0x62a31c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
cmp eax, 0x85
jg 0x629b88
je 0x629e67
cmp eax, 0x81
jg 0x629b6a
je 0x629bfd
dec eax
je 0x629bb9
add eax, 0xfffffff1
sub eax, 2
jb case.0x629b96.140
sub eax, 0xe
je case.0x629b96.140
sub eax, 0x60
je case.0x629b96.140
jmp case.default.0x629b96
sub eax, 0x82
je 0x629cb9
dec eax
je case.0x629b96.140
dec eax
je 0x629ddd
jmp case.default.0x629b96
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x629b96
jmp dword [eax*4 + 0x629b9d]
lea eax, [ebp - 0xdc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62a860
call fcn.0040b4c8
mov edx, dword [ebp - 0xdc]
lea ecx, [ebp - 0xd8]
mov ax, 0xea
call fcn.005cd7d4
mov ecx, dword [ebp - 0xd8]
mov dl, 1
mov eax, dword [0x41ba8c]
call fcn.00429008
call fcn.004098c4
jmp case.0x629b96.140
cmp byte [ebp - 0x29], 0
jne 0x629c13
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne case.0x629b96.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
setne al
push eax
push 0
push 0x62838c
push 0x628398
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060ca84
test al, al
je case.0x629b96.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
je case.0x629b96.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je case.0x629b96.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 5
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x28]
call fcn.005c5644
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x3c]
call fcn.0060f3fc
jmp case.0x629b96.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
cmp byte [ebp - 0x29], 0
jne 0x629cd0
cmp dword [ebp - 0x74], 0
jne 0x629cdb
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
cmp byte [ebp - 0x29], 0
jne 0x629ced
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x629d57
cmp byte [ebp - 0x29], 0
jne 0x629d03
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
jne case.0x629b96.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.0062860c
pop ecx
test al, al
jne case.0x629b96.140
mov byte [ebp - 0x81], 0
jmp case.0x629b96.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
je 0x629d78
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x28]
call fcn.00628b70
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040b660
je case.0x629b96.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.0062860c
pop ecx
test al, al
jne case.0x629b96.140
mov byte [ebp - 0x81], 0
jmp case.0x629b96.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x20]
call fcn.0040a5f0
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xf0], eax
mov byte [ebp - 0xec], 0x11
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 0x74]
call fcn.00629318
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe8], eax
mov byte [ebp - 0xe4], 0x11
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62a88c
call fcn.00615170
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
call fcn.005c6fa0
jmp case.0x629b96.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
je 0x629e9c
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.005c6e44
test al, al
je case.0x629b96.140
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 0x74]
call fcn.00629318
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62a8f0
call fcn.00615170
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.005c6fec
jmp case.0x629b96.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.00628080
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0xa0]
call fcn.0060bd54
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62a93c
call fcn.00615170
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7da0
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x629b96.140
sub eax, 2
je case.0x629b96.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62a984
call fcn.00615170
mov byte [ebp - 0x81], 0
jmp case.0x629b96.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.00628080
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 0xa0]
call fcn.0060bd54
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62a9bc
call fcn.00615170
push 0
push 2
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7ce0
test eax, eax
jne case.0x629b96.140
push 2
push 0x6cc0bc
push 1
push 0
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x62a0a4
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62aa0c
call fcn.00615170
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x629b96.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.00628080
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 0xa0]
call fcn.0060bd54
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62aa50
call fcn.00615170
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7f24
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x91
jne 0x62a14d
mov eax, 0x62aaa4
call fcn.00614eec
jmp case.0x629b96.140
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x629b96.140
sub eax, 2
je case.0x629b96.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62a984
call fcn.00615170
mov byte [ebp - 0x81], 0
jmp case.0x629b96.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.00628080
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 0xa0]
call fcn.0060bd54
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62aaec
call fcn.00615170
push 0
push 3
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7ce0
test eax, eax
jne case.0x629b96.140
mov edx, esi
mov eax, dword [ebp - 0xa4]
call fcn.005c7c20
test al, al
je 0x62a288
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x62a288
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62ab3c
call fcn.00615170
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x629b96.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x28]
call fcn.00628b70
jmp case.0x629b96.140
mov byte [ebp - 0x82], 1
jmp case.0x629b96.140
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62ab80
call fcn.004244f8
mov edx, dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
mov ax, 0xea
call fcn.005cd7d4
mov ecx, dword [ebp - 0x114]
mov dl, 1
mov eax, dword [0x41ba8c]
call fcn.00429008
call fcn.004098c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62a348
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.00628310
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x90], 0
jne 0x629b05
cmp byte [ebp - 0x82], 0
je 0x62a396
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x30]
test byte [eax + 0x1d], 0x10
je 0x62a3a4
call fcn.0060f0dc
cmp dword [ebp - 0x80], 0
je 0x62a3b4
call dword [ebp - 0x80]
push ebp
call fcn.00629284
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62a465
mov eax, dword [ebp - 0x48]
call fcn.00408444
mov eax, dword [ebp - 0x34]
call fcn.00408444
mov eax, dword [ebp - 0x38]
call fcn.00408444
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x62a437
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x11c]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.0060f480
mov eax, dword [ebp - 0x11c]
call fcn.005c6b4c
test al, al
je 0x62a433
push 0
lea ecx, [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.0060f480
mov eax, dword [ebp - 0x120]
call fcn.0040b278
push eax
push 0x1005
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x62a3e7
mov eax, dword [ebp - 0x40]
call fcn.00408444
mov eax, dword [ebp - 0x44]
call fcn.00408444
mov eax, dword [ebp - 0x88]
call fcn.00408444
mov eax, dword [ebp - 0x3c]
call fcn.00408444
ret