Function at 0x5678e8
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x23
push 0
push 0
dec ecx
jne 0x5678f1
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x80], ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x30], eax
mov ecx, 0xa
lea eax, [ebp - 0x28]
mov edx, dword [0x4012b8]
call fcn.0040b3cc
xor eax, eax
push ebp
push 0x568a38
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x568a5c
call fcn.005556dc
lea eax, [ebp - 0xac]
call fcn.0050f74c
mov eax, dword [ebp - 0xac]
call fcn.0041de88
mov byte [ebp - 0x81], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x82], 0
xor eax, eax
mov dword [ebp - 0x88], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dl, 1
mov eax, dword [0x54c610]
call fcn.00407b64
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x5689b6
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x54c610]
call fcn.00407b64
mov dword [ebp - 0x88], eax
mov dl, 1
mov eax, dword [0x54c610]
call fcn.00407b64
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x54c610]
call fcn.00407b64
mov dword [ebp - 0x40], eax
mov dl, 1
mov eax, dword [0x54c610]
call fcn.00407b64
mov dword [ebp - 0x38], eax
mov dl, 1
mov eax, dword [0x54c610]
call fcn.00407b64
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x80], 0
je 0x5679ff
mov dl, 1
mov eax, dword [0x54c610]
call fcn.00407b64
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x8c], eax
mov ecx, eax
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0x29], 0
je 0x567e02
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x567e02
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x80
jne 0x567de7
xor eax, eax
push ebp
push 0x567d91
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.00567894
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x567a86
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.0054fec8
inc eax
jne 0x567d52
mov bl, 1
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 1
je 0x567a9d
xor ebx, ebx
jmp 0x567aa7
test esi, 2
je 0x567aa7
mov bl, 2
mov dword [ebp - 0xa8], 1
test esi, 8
je 0x567ac5
mov dword [ebp - 0xa8], 7
jmp 0x567ae9
test esi, 0x10
je 0x567ad9
mov dword [ebp - 0xa8], 3
jmp 0x567ae9
test esi, 0x40
je 0x567ae9
xor eax, eax
mov dword [ebp - 0xa8], eax
test esi, 4
jne 0x567c36
lea eax, [ebp - 0xb0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x568ab4
call fcn.0040aacc
mov eax, dword [ebp - 0xb0]
call fcn.005556dc
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x567b43
cmp dword [ebp - 0x24], 0
je 0x567b43
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x568af0
call fcn.0040aacc
mov eax, dword [ebp - 0xb4]
call fcn.005556dc
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x567b6c
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x28]
call fcn.0054c148
test al, al
je 0x567c27
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x56696c
call fcn.005556b0
test al, al
je 0x567b92
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 4
jne 0x567b96
xor eax, eax
jmp 0x567b98
mov al, 1
push eax
push 0x566ae8
push 0
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.0054ec48
test al, al
jne 0x567bf4
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x568b30
call fcn.0055594c
mov byte [ebp - 0x81], 0
jmp 0x567d3c
cmp bl, 1
jne 0x567d3c
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x568b74
call fcn.0055594c
jmp 0x567d3c
mov eax, 0x568bac
call fcn.005556dc
jmp 0x567d3c
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x568bf4
call fcn.0040aacc
mov eax, dword [ebp - 0xc0]
call fcn.005556dc
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x567c84
cmp dword [ebp - 0x24], 0
je 0x567c84
lea eax, [ebp - 0xc4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x568c3c
call fcn.0040aacc
mov eax, dword [ebp - 0xc4]
call fcn.005556dc
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x567ca0
mov eax, dword [ebp - 0x28]
call fcn.0050eba4
test al, al
je 0x567d32
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
jne 0x567cae
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x56696c
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.0054ef44
test al, al
jne 0x567d06
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x568c88
call fcn.0055594c
mov byte [ebp - 0x81], 0
jmp 0x567d3c
cmp bl, 1
jne 0x567d3c
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x568b74
call fcn.0055594c
jmp 0x567d3c
mov eax, 0x568ccc
call fcn.005556dc
cmp dword [ebp - 0x1c], 0
je 0x567d87
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.0054fdd4
jmp 0x567d87
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x568d28
call fcn.0055594c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x567dbd
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.005667ec
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x567df5
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x567a3e
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x568047
mov byte [ebp - 0x91], 0
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x82
jne 0x567ff9
mov byte [ebp - 0x91], 1
xor eax, eax
push ebp
push 0x567fcd
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.00567894
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x567e6c
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x567fbc
cmp byte [ebp - 0x29], 0
jne 0x567e78
cmp dword [ebp - 0x24], 0
jne 0x567e7c
xor eax, eax
jmp 0x567e7e
mov al, 1
mov byte [ebp - 0x92], al
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x567eb3
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x28]
call fcn.005670a8
mov byte [ebp - 0x93], al
jmp 0x567eba
mov byte [ebp - 0x93], 0
test bl, bl
je 0x567f0c
cmp byte [ebp - 0x93], 0
je 0x567fc3
cmp byte [ebp - 0x92], 0
jne 0x567f0c
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0054c148
test al, al
je 0x567f0c
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x567f0c
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x567fc3
mov byte [ebp - 0x91], 0
cmp byte [ebp - 0x92], 0
jne 0x567f60
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je 0x567f3f
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.005671b0
pop ecx
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x40
je 0x567f60
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.00567440
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
je 0x567fa6
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0x11
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x568d80
call fcn.0055594c
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x20
setne cl
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.0054f7dc
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x10
je 0x567fc3
mov eax, dword [ebp - 0x18]
call fcn.00567654
jmp 0x567fc3
mov byte [ebp - 0x91], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x567ff9
cmp byte [ebp - 0x91], 0
je 0x56802c
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.005667ec
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x56803a
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x567e1b
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x5688d8
push ebp
mov eax, dword [ebp - 0x90]
call fcn.00567894
pop ecx
xor eax, eax
push ebp
push 0x568877
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
cmp eax, 0x85
jg 0x5680e3
je 0x5683c2
cmp eax, 0x81
jg 0x5680c5
je 0x568158
dec eax
je 0x568114
add eax, 0xfffffff1
sub eax, 2
jb case.0x5680f1.140
sub eax, 0xe
je case.0x5680f1.140
sub eax, 0x60
je case.0x5680f1.140
jmp case.default.0x5680f1
sub eax, 0x82
je 0x568214
dec eax
je case.0x5680f1.140
dec eax
je 0x568338
jmp case.default.0x5680f1
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x5680f1
jmp dword [eax*4 + 0x5680f8]
lea eax, [ebp - 0xdc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x568dbc
call fcn.0040aacc
mov edx, dword [ebp - 0xdc]
lea ecx, [ebp - 0xd8]
mov ax, 0xea
call fcn.00515f84
mov ecx, dword [ebp - 0xd8]
mov dl, 1
mov eax, dword [0x419708]
call fcn.00422c04
call fcn.00408f34
jmp case.0x5680f1.140
cmp byte [ebp - 0x29], 0
jne 0x56816e
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne case.0x5680f1.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
setne al
push eax
push 0
push 0x566868
push 0x566874
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne al
mov edx, dword [ebp - 0x28]
call fcn.0054da24
test al, al
je case.0x5680f1.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
je case.0x5680f1.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je case.0x5680f1.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 5
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x28]
call fcn.0050d404
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x3c]
call fcn.0054fe28
jmp case.0x5680f1.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x24]
call fcn.00409c68
cmp byte [ebp - 0x29], 0
jne 0x56822b
cmp dword [ebp - 0x74], 0
jne 0x568236
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.00409c68
cmp byte [ebp - 0x29], 0
jne 0x568248
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x5682b2
cmp byte [ebp - 0x29], 0
jne 0x56825e
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
jne case.0x5680f1.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.00566b44
pop ecx
test al, al
jne case.0x5680f1.140
mov byte [ebp - 0x81], 0
jmp case.0x5680f1.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
je 0x5682d3
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x28]
call fcn.005670a8
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040ac64
je case.0x5680f1.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.00566b44
pop ecx
test al, al
jne case.0x5680f1.140
mov byte [ebp - 0x81], 0
jmp case.0x5680f1.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.00409c68
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x20]
call fcn.00409c68
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.00409c68
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xf0], eax
mov byte [ebp - 0xec], 0x11
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 0x74]
call fcn.00567850
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe8], eax
mov byte [ebp - 0xe4], 0x11
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x568de8
call fcn.0055594c
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
call fcn.0050efe0
jmp case.0x5680f1.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.00409c68
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.00409c68
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
je 0x5683f7
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.0050ee84
test al, al
je case.0x5680f1.140
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 0x74]
call fcn.00567850
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x568e4c
call fcn.0055594c
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.0050f02c
jmp case.0x5680f1.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.00566560
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0xa0]
call fcn.0054caec
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x568e98
call fcn.0055594c
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.0050fd30
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x5680f1.140
sub eax, 2
je case.0x5680f1.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x568ee0
call fcn.0055594c
mov byte [ebp - 0x81], 0
jmp case.0x5680f1.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.00566560
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 0xa0]
call fcn.0054caec
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x568f18
call fcn.0055594c
push 0
push 2
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.0050fc70
test eax, eax
jne case.0x5680f1.140
push 2
push 0x5db014
push 1
push 0
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x5685ff
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x568f68
call fcn.0055594c
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x5680f1.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.00566560
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 0xa0]
call fcn.0054caec
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x568fac
call fcn.0055594c
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.0050fe7c
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x91
jne 0x5686a8
mov eax, 0x569000
call fcn.005556dc
jmp case.0x5680f1.140
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x5680f1.140
sub eax, 2
je case.0x5680f1.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x568ee0
call fcn.0055594c
mov byte [ebp - 0x81], 0
jmp case.0x5680f1.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.00566560
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 0xa0]
call fcn.0054caec
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x569048
call fcn.0055594c
push 0
push 3
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.0050fc70
test eax, eax
jne case.0x5680f1.140
mov edx, esi
mov eax, dword [ebp - 0xa4]
call fcn.0050fc18
test al, al
je 0x5687e3
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x5687e3
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x569098
call fcn.0055594c
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x5680f1.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x28]
call fcn.005670a8
jmp case.0x5680f1.140
mov byte [ebp - 0x82], 1
jmp case.0x5680f1.140
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x5690dc
call fcn.0041e350
mov edx, dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
mov ax, 0xea
call fcn.00515f84
mov ecx, dword [ebp - 0x114]
mov dl, 1
mov eax, dword [0x419708]
call fcn.00422c04
call fcn.00408f34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5688a3
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.005667ec
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x90], 0
jne 0x568060
cmp byte [ebp - 0x82], 0
je 0x5688f1
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x30]
test byte [eax + 0x1d], 0x10
je 0x5688ff
call fcn.0054fb08
cmp dword [ebp - 0x80], 0
je 0x56890f
call dword [ebp - 0x80]
push ebp
call fcn.005677bc
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5689c0
mov eax, dword [ebp - 0x48]
call fcn.00407b94
mov eax, dword [ebp - 0x34]
call fcn.00407b94
mov eax, dword [ebp - 0x38]
call fcn.00407b94
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x568992
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x11c]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.0054feac
mov eax, dword [ebp - 0x11c]
call fcn.0050eb90
test al, al
je 0x56898e
push 0
lea ecx, [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.0054feac
mov eax, dword [ebp - 0x120]
call fcn.0040a87c
push eax
push 0x1005
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x568942
mov eax, dword [ebp - 0x40]
call fcn.00407b94
mov eax, dword [ebp - 0x44]
call fcn.00407b94
mov eax, dword [ebp - 0x88]
call fcn.00407b94
mov eax, dword [ebp - 0x3c]
call fcn.00407b94
ret