Function at 0x62d370
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x23
push 0
push 0
dec ecx
jne 0x62d379
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x80], ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x30], eax
mov ecx, 0xa
lea eax, [ebp - 0x28]
mov edx, dword [0x4012b8]
call fcn.0040bf08
xor eax, eax
push ebp
push 0x62e49d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x62e4c0
call fcn.00618e98
lea eax, [ebp - 0xac]
call fcn.005c745c
mov eax, dword [ebp - 0xac]
call fcn.00424020
mov byte [ebp - 0x81], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x82], 0
xor eax, eax
mov dword [ebp - 0x88], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dl, 1
mov eax, dword [0x60f824]
call fcn.00408414
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x62e41b
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x60f824]
call fcn.00408414
mov dword [ebp - 0x88], eax
mov dl, 1
mov eax, dword [0x60f824]
call fcn.00408414
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x60f824]
call fcn.00408414
mov dword [ebp - 0x40], eax
mov dl, 1
mov eax, dword [0x60f824]
call fcn.00408414
mov dword [ebp - 0x38], eax
mov dl, 1
mov eax, dword [0x60f824]
call fcn.00408414
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x80], 0
je 0x62d487
mov dl, 1
mov eax, dword [0x60f824]
call fcn.00408414
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x8c], eax
mov ecx, eax
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0x29], 0
je 0x62d867
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x62d867
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x80
jne 0x62d84c
xor eax, eax
push ebp
push 0x62d7f6
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062d31c
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x62d50e
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.00613448
inc eax
jne 0x62d7b7
mov bl, 1
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 1
je 0x62d525
xor ebx, ebx
jmp 0x62d52f
test esi, 2
je 0x62d52f
mov bl, 2
mov dword [ebp - 0xa8], 1
test esi, 8
je 0x62d54d
mov dword [ebp - 0xa8], 7
jmp 0x62d571
test esi, 0x10
je 0x62d561
mov dword [ebp - 0xa8], 3
jmp 0x62d571
test esi, 0x40
je 0x62d571
xor eax, eax
mov dword [ebp - 0xa8], eax
test esi, 4
jne 0x62d69b
lea eax, [ebp - 0xb0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62e518
call fcn.0040b4c8
mov eax, dword [ebp - 0xb0]
call fcn.00618e98
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x62d5cb
cmp dword [ebp - 0x24], 0
je 0x62d5cb
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x62e554
call fcn.0040b4c8
mov eax, dword [ebp - 0xb4]
call fcn.00618e98
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x62d5f4
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060f35c
test al, al
je 0x62d68c
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x62c450
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.00611dd4
test al, al
jne 0x62d659
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62e594
call fcn.0061911c
mov byte [ebp - 0x81], 0
jmp 0x62d7a1
cmp bl, 1
jne 0x62d7a1
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62e5d8
call fcn.0061911c
jmp 0x62d7a1
mov eax, 0x62e610
call fcn.00618e98
jmp 0x62d7a1
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62e658
call fcn.0040b4c8
mov eax, dword [ebp - 0xc0]
call fcn.00618e98
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x62d6e9
cmp dword [ebp - 0x24], 0
je 0x62d6e9
lea eax, [ebp - 0xc4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x62e6a0
call fcn.0040b4c8
mov eax, dword [ebp - 0xc4]
call fcn.00618e98
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x62d705
mov eax, dword [ebp - 0x28]
call fcn.005c6894
test al, al
je 0x62d797
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
jne 0x62d713
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x62c450
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.006120a0
test al, al
jne 0x62d76b
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62e6ec
call fcn.0061911c
mov byte [ebp - 0x81], 0
jmp 0x62d7a1
cmp bl, 1
jne 0x62d7a1
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62e5d8
call fcn.0061911c
jmp 0x62d7a1
mov eax, 0x62e730
call fcn.00618e98
cmp dword [ebp - 0x1c], 0
je 0x62d7ec
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.00613354
jmp 0x62d7ec
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62e78c
call fcn.0061911c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62d822
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.0062c2d0
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x62d85a
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x62d4c6
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x62daac
mov byte [ebp - 0x91], 0
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x82
jne 0x62da5e
mov byte [ebp - 0x91], 1
xor eax, eax
push ebp
push 0x62da32
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062d31c
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x62d8d1
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x62da21
cmp byte [ebp - 0x29], 0
jne 0x62d8dd
cmp dword [ebp - 0x24], 0
jne 0x62d8e1
xor eax, eax
jmp 0x62d8e3
mov al, 1
mov byte [ebp - 0x92], al
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x62d918
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x28]
call fcn.0062cb30
mov byte [ebp - 0x93], al
jmp 0x62d91f
mov byte [ebp - 0x93], 0
test bl, bl
je 0x62d971
cmp byte [ebp - 0x93], 0
je 0x62da28
cmp byte [ebp - 0x92], 0
jne 0x62d971
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060f35c
test al, al
je 0x62d971
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x62d971
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x62da28
mov byte [ebp - 0x91], 0
cmp byte [ebp - 0x92], 0
jne 0x62d9c5
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je 0x62d9a4
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0062cc38
pop ecx
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x40
je 0x62d9c5
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0062cec8
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
je 0x62da0b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0x11
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62e7e4
call fcn.0061911c
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x20
setne cl
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.00612da8
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x10
je 0x62da28
mov eax, dword [ebp - 0x18]
call fcn.0062d0dc
jmp 0x62da28
mov byte [ebp - 0x91], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62da5e
cmp byte [ebp - 0x91], 0
je 0x62da91
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.0062c2d0
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x62da9f
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x62d880
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x62e33d
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062d31c
pop ecx
xor eax, eax
push ebp
push 0x62e2dc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
cmp eax, 0x85
jg 0x62db48
je 0x62de27
cmp eax, 0x81
jg 0x62db2a
je 0x62dbbd
dec eax
je 0x62db79
add eax, 0xfffffff1
sub eax, 2
jb case.0x62db56.140
sub eax, 0xe
je case.0x62db56.140
sub eax, 0x60
je case.0x62db56.140
jmp case.default.0x62db56
sub eax, 0x82
je 0x62dc79
dec eax
je case.0x62db56.140
dec eax
je 0x62dd9d
jmp case.default.0x62db56
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x62db56
jmp dword [eax*4 + 0x62db5d]
lea eax, [ebp - 0xdc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62e820
call fcn.0040b4c8
mov edx, dword [ebp - 0xdc]
lea ecx, [ebp - 0xd8]
mov ax, 0xea
call fcn.005d0270
mov ecx, dword [ebp - 0xd8]
mov dl, 1
mov eax, dword [0x41ba8c]
call fcn.00429008
call fcn.004098c4
jmp case.0x62db56.140
cmp byte [ebp - 0x29], 0
jne 0x62dbd3
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne case.0x62db56.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
setne al
push eax
push 0
push 0x62c34c
push 0x62c358
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne al
mov edx, dword [ebp - 0x28]
call fcn.00610a30
test al, al
je case.0x62db56.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
je case.0x62db56.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je case.0x62db56.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 5
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x28]
call fcn.005c5378
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x3c]
call fcn.006133a8
jmp case.0x62db56.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
cmp byte [ebp - 0x29], 0
jne 0x62dc90
cmp dword [ebp - 0x74], 0
jne 0x62dc9b
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
cmp byte [ebp - 0x29], 0
jne 0x62dcad
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x62dd17
cmp byte [ebp - 0x29], 0
jne 0x62dcc3
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
jne case.0x62db56.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.0062c5cc
pop ecx
test al, al
jne case.0x62db56.140
mov byte [ebp - 0x81], 0
jmp case.0x62db56.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
je 0x62dd38
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x28]
call fcn.0062cb30
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040b660
je case.0x62db56.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.0062c5cc
pop ecx
test al, al
jne case.0x62db56.140
mov byte [ebp - 0x81], 0
jmp case.0x62db56.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x20]
call fcn.0040a5f0
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xf0], eax
mov byte [ebp - 0xec], 0x11
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 0x74]
call fcn.0062d2d8
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe8], eax
mov byte [ebp - 0xe4], 0x11
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62e84c
call fcn.0061911c
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
call fcn.005c6cd4
jmp case.0x62db56.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
je 0x62de5c
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.005c6b78
test al, al
je case.0x62db56.140
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 0x74]
call fcn.0062d2d8
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62e8b0
call fcn.0061911c
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.005c6d20
jmp case.0x62db56.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.0062c040
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0xa0]
call fcn.0060fd00
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62e8fc
call fcn.0061911c
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7ad4
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x62db56.140
sub eax, 2
je case.0x62db56.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62e944
call fcn.0061911c
mov byte [ebp - 0x81], 0
jmp case.0x62db56.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.0062c040
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 0xa0]
call fcn.0060fd00
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62e97c
call fcn.0061911c
push 0
push 2
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7a14
test eax, eax
jne case.0x62db56.140
push 2
push 0x6d00c0
push 1
push 0
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x62e064
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62e9cc
call fcn.0061911c
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x62db56.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.0062c040
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 0xa0]
call fcn.0060fd00
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62ea10
call fcn.0061911c
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7c58
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x91
jne 0x62e10d
mov eax, 0x62ea64
call fcn.00618e98
jmp case.0x62db56.140
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x62db56.140
sub eax, 2
je case.0x62db56.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62e944
call fcn.0061911c
mov byte [ebp - 0x81], 0
jmp case.0x62db56.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.0062c040
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 0xa0]
call fcn.0060fd00
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62eaac
call fcn.0061911c
push 0
push 3
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7a14
test eax, eax
jne case.0x62db56.140
mov edx, esi
mov eax, dword [ebp - 0xa4]
call fcn.005c7954
test al, al
je 0x62e248
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x62e248
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62eafc
call fcn.0061911c
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x62db56.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x28]
call fcn.0062cb30
jmp case.0x62db56.140
mov byte [ebp - 0x82], 1
jmp case.0x62db56.140
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62eb40
call fcn.004244f8
mov edx, dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
mov ax, 0xea
call fcn.005d0270
mov ecx, dword [ebp - 0x114]
mov dl, 1
mov eax, dword [0x41ba8c]
call fcn.00429008
call fcn.004098c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62e308
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.0062c2d0
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x90], 0
jne 0x62dac5
cmp byte [ebp - 0x82], 0
je 0x62e356
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x30]
test byte [eax + 0x1d], 0x10
je 0x62e364
call fcn.00613088
cmp dword [ebp - 0x80], 0
je 0x62e374
call dword [ebp - 0x80]
push ebp
call fcn.0062d244
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62e425
mov eax, dword [ebp - 0x48]
call fcn.00408444
mov eax, dword [ebp - 0x34]
call fcn.00408444
mov eax, dword [ebp - 0x38]
call fcn.00408444
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x62e3f7
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x11c]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.0061342c
mov eax, dword [ebp - 0x11c]
call fcn.005c6880
test al, al
je 0x62e3f3
push 0
lea ecx, [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.0061342c
mov eax, dword [ebp - 0x120]
call fcn.0040b278
push eax
push 0x1005
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x62e3a7
mov eax, dword [ebp - 0x40]
call fcn.00408444
mov eax, dword [ebp - 0x44]
call fcn.00408444
mov eax, dword [ebp - 0x88]
call fcn.00408444
mov eax, dword [ebp - 0x3c]
call fcn.00408444
ret