Function at 0x62ac10
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x23
push 0
push 0
dec ecx
jne 0x62ac19
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x80], ecx
mov byte [ebp - 0x29], dl
mov dword [ebp - 0x30], eax
mov ecx, 0xa
lea eax, [ebp - 0x28]
mov edx, dword [0x4012b8]
call fcn.0040bf08
xor eax, eax
push ebp
push 0x62bd3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x62bd60
call fcn.0061674c
lea eax, [ebp - 0xac]
call fcn.005c74a8
mov eax, dword [ebp - 0xac]
call fcn.00424038
mov byte [ebp - 0x81], 1
mov eax, dword [ebp - 0x30]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x82], 0
xor eax, eax
mov dword [ebp - 0x88], eax
xor eax, eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov dword [ebp - 0x48], eax
mov dl, 1
mov eax, dword [0x60cdf8]
call fcn.00408414
mov dword [ebp - 0x3c], eax
xor edx, edx
push ebp
push 0x62bcbb
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, dword [0x60cdf8]
call fcn.00408414
mov dword [ebp - 0x88], eax
mov dl, 1
mov eax, dword [0x60cdf8]
call fcn.00408414
mov dword [ebp - 0x44], eax
mov dl, 1
mov eax, dword [0x60cdf8]
call fcn.00408414
mov dword [ebp - 0x40], eax
mov dl, 1
mov eax, dword [0x60cdf8]
call fcn.00408414
mov dword [ebp - 0x38], eax
mov dl, 1
mov eax, dword [0x60cdf8]
call fcn.00408414
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x80], 0
je 0x62ad27
mov dl, 1
mov eax, dword [0x60cdf8]
call fcn.00408414
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x8c], eax
mov ecx, eax
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 0x29], 0
je 0x62b107
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x62b107
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x80
jne 0x62b0ec
xor eax, eax
push ebp
push 0x62b096
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062abbc
pop ecx
cmp dword [ebp - 0x1c], 0
je 0x62adae
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.00610cfc
inc eax
jne 0x62b057
mov bl, 1
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 1
je 0x62adc5
xor ebx, ebx
jmp 0x62adcf
test esi, 2
je 0x62adcf
mov bl, 2
mov dword [ebp - 0xa8], 1
test esi, 8
je 0x62aded
mov dword [ebp - 0xa8], 7
jmp 0x62ae11
test esi, 0x10
je 0x62ae01
mov dword [ebp - 0xa8], 3
jmp 0x62ae11
test esi, 0x40
je 0x62ae11
xor eax, eax
mov dword [ebp - 0xa8], eax
test esi, 4
jne 0x62af3b
lea eax, [ebp - 0xb0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62bdb8
call fcn.0040b4c8
mov eax, dword [ebp - 0xb0]
call fcn.0061674c
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x62ae6b
cmp dword [ebp - 0x24], 0
je 0x62ae6b
lea eax, [ebp - 0xb4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x62bdf4
call fcn.0040b4c8
mov eax, dword [ebp - 0xb4]
call fcn.0061674c
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x62ae94
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060c930
test al, al
je 0x62af2c
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x629cf0
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
call fcn.0060f688
test al, al
jne 0x62aef9
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62be34
call fcn.006169d0
mov byte [ebp - 0x81], 0
jmp 0x62b041
cmp bl, 1
jne 0x62b041
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62be78
call fcn.006169d0
jmp 0x62b041
mov eax, 0x62beb0
call fcn.0061674c
jmp 0x62b041
lea eax, [ebp - 0xc0]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62bef8
call fcn.0040b4c8
mov eax, dword [ebp - 0xc0]
call fcn.0061674c
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x62af89
cmp dword [ebp - 0x24], 0
je 0x62af89
lea eax, [ebp - 0xc4]
mov ecx, dword [ebp - 0x24]
mov edx, 0x62bf40
call fcn.0040b4c8
mov eax, dword [ebp - 0xc4]
call fcn.0061674c
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
je 0x62afa5
mov eax, dword [ebp - 0x28]
call fcn.005c68ac
test al, al
je 0x62b037
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
jne 0x62afb3
xor ebx, ebx
mov eax, dword [ebp - 0x20]
push eax
push ebx
mov eax, dword [ebp - 0xa8]
push eax
push 0x629cf0
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.0060f954
test al, al
jne 0x62b00b
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62bf8c
call fcn.006169d0
mov byte [ebp - 0x81], 0
jmp 0x62b041
cmp bl, 1
jne 0x62b041
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62be78
call fcn.006169d0
jmp 0x62b041
mov eax, 0x62bfd0
call fcn.0061674c
cmp dword [ebp - 0x1c], 0
je 0x62b08c
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
call fcn.00610c08
jmp 0x62b08c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62c02c
call fcn.006169d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62b0c2
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.00629b70
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x62b0fa
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x62ad66
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x62b34c
mov byte [ebp - 0x91], 0
mov eax, dword [ebp - 0x90]
cmp word [eax + 0x10], 0x82
jne 0x62b2fe
mov byte [ebp - 0x91], 1
xor eax, eax
push ebp
push 0x62b2d2
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062abbc
pop ecx
cmp byte [ebp - 0x29], 0
jne 0x62b171
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x62b2c1
cmp byte [ebp - 0x29], 0
jne 0x62b17d
cmp dword [ebp - 0x24], 0
jne 0x62b181
xor eax, eax
jmp 0x62b183
mov al, 1
mov byte [ebp - 0x92], al
mov eax, dword [ebp - 0x90]
mov esi, dword [eax + 8]
test esi, 8
setne bl
test bl, bl
je 0x62b1b8
test esi, 0x400
setne dl
mov eax, dword [ebp - 0x28]
call fcn.0062a3d0
mov byte [ebp - 0x93], al
jmp 0x62b1bf
mov byte [ebp - 0x93], 0
test bl, bl
je 0x62b211
cmp byte [ebp - 0x93], 0
je 0x62b2c8
cmp byte [ebp - 0x92], 0
jne 0x62b211
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060c930
test al, al
je 0x62b211
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 2
jne 0x62b211
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x62b2c8
mov byte [ebp - 0x91], 0
cmp byte [ebp - 0x92], 0
jne 0x62b265
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je 0x62b244
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0062a4d8
pop ecx
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x40
je 0x62b265
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x28]
call fcn.0062a768
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
je 0x62b2ab
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0x11
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62c084
call fcn.006169d0
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x20
setne cl
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
call fcn.0061065c
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 0x10
je 0x62b2c8
mov eax, dword [ebp - 0x18]
call fcn.0062a97c
jmp 0x62b2c8
mov byte [ebp - 0x91], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62b2fe
cmp byte [ebp - 0x91], 0
je 0x62b331
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.00629b70
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x62b33f
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jne 0x62b120
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x62bbdd
push ebp
mov eax, dword [ebp - 0x90]
call fcn.0062abbc
pop ecx
xor eax, eax
push ebp
push 0x62bb7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
cmp eax, 0x85
jg 0x62b3e8
je 0x62b6c7
cmp eax, 0x81
jg 0x62b3ca
je 0x62b45d
dec eax
je 0x62b419
add eax, 0xfffffff1
sub eax, 2
jb case.0x62b3f6.140
sub eax, 0xe
je case.0x62b3f6.140
sub eax, 0x60
je case.0x62b3f6.140
jmp case.default.0x62b3f6
sub eax, 0x82
je 0x62b519
dec eax
je case.0x62b3f6.140
dec eax
je 0x62b63d
jmp case.default.0x62b3f6
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x62b3f6
jmp dword [eax*4 + 0x62b3fd]
lea eax, [ebp - 0xdc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x62c0c0
call fcn.0040b4c8
mov edx, dword [ebp - 0xdc]
lea ecx, [ebp - 0xd8]
mov ax, 0xea
call fcn.005cd844
mov ecx, dword [ebp - 0xd8]
mov dl, 1
mov eax, dword [0x41baa4]
call fcn.00429020
call fcn.004098c4
jmp case.0x62b3f6.140
cmp byte [ebp - 0x29], 0
jne 0x62b473
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne case.0x62b3f6.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 4
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
setne al
push eax
push 0
push 0x629bec
push 0x629bf8
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne al
mov edx, dword [ebp - 0x28]
call fcn.0060e2e4
test al, al
je case.0x62b3f6.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
je case.0x62b3f6.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x10
je case.0x62b3f6.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 5
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xe0]
mov eax, dword [ebp - 0x28]
call fcn.005c5390
mov edx, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x3c]
call fcn.00610c5c
jmp case.0x62b3f6.140
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
cmp byte [ebp - 0x29], 0
jne 0x62b530
cmp dword [ebp - 0x74], 0
jne 0x62b53b
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
cmp byte [ebp - 0x29], 0
jne 0x62b54d
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
jne 0x62b5b7
cmp byte [ebp - 0x29], 0
jne 0x62b563
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 2
jne case.0x62b3f6.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.00629e6c
pop ecx
test al, al
jne case.0x62b3f6.140
mov byte [ebp - 0x81], 0
jmp case.0x62b3f6.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 8
je 0x62b5d8
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 4
setne dl
mov eax, dword [ebp - 0x28]
call fcn.0062a3d0
mov eax, dword [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040b660
je case.0x62b3f6.140
push ebp
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x80
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 1
setne al
push eax
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 0x20
setne cl
mov eax, dword [ebp - 0x90]
test byte [eax + 9], 8
setne dl
mov eax, dword [ebp - 0x74]
call fcn.00629e6c
pop ecx
test al, al
jne case.0x62b3f6.140
mov byte [ebp - 0x81], 0
jmp case.0x62b3f6.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x20]
call fcn.0040a5f0
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xf0], eax
mov byte [ebp - 0xec], 0x11
lea edx, [ebp - 0xfc]
mov eax, dword [ebp - 0x74]
call fcn.0062ab78
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0xe8], eax
mov byte [ebp - 0xe4], 0x11
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62c0ec
call fcn.006169d0
mov ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x78]
call fcn.005c6cec
jmp case.0x62b3f6.140
lea eax, [ebp - 0x78]
mov edx, dword [ebp - 0x24]
call fcn.0040a5f0
lea eax, [ebp - 0x74]
mov edx, dword [ebp - 0x28]
call fcn.0040a5f0
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
je 0x62b6fc
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.005c6b90
test al, al
je case.0x62b3f6.140
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
lea edx, [ebp - 0x100]
mov eax, dword [ebp - 0x74]
call fcn.0062ab78
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0xc8], 0x11
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62c150
call fcn.006169d0
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
call fcn.005c6d38
jmp case.0x62b3f6.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.006298e0
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x104]
mov eax, dword [ebp - 0xa0]
call fcn.0060d2d4
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62c19c
call fcn.006169d0
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7b20
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x62b3f6.140
sub eax, 2
je case.0x62b3f6.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62c1e4
call fcn.006169d0
mov byte [ebp - 0x81], 0
jmp case.0x62b3f6.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.006298e0
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 0xa0]
call fcn.0060d2d4
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62c21c
call fcn.006169d0
push 0
push 2
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7a60
test eax, eax
jne case.0x62b3f6.140
push 2
push 0x6ce0c0
push 1
push 0
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x62b904
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62c26c
call fcn.006169d0
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x62b3f6.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.006298e0
mov ebx, dword [ebp - 0x70]
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 0xa0]
call fcn.0060d2d4
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0xd4], eax
mov byte [ebp - 0xd0], 0x11
mov dword [ebp - 0xcc], ebx
mov byte [ebp - 0xc8], 0xa
lea edx, [ebp - 0xd4]
mov ecx, 1
mov eax, 0x62c2b0
call fcn.006169d0
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7ca4
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x91
jne 0x62b9ad
mov eax, 0x62c304
call fcn.0061674c
jmp case.0x62b3f6.140
mov eax, dword [ebp - 0x98]
test eax, eax
je case.0x62b3f6.140
sub eax, 2
je case.0x62b3f6.140
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62c1e4
call fcn.006169d0
mov byte [ebp - 0x81], 0
jmp case.0x62b3f6.140
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x99]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + 8]
call fcn.006298e0
mov ebx, dword [ebp - 0x70]
mov esi, dword [ebp - 0x6c]
lea edx, [ebp - 0x110]
mov eax, dword [ebp - 0xa0]
call fcn.0060d2d4
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0xf8], eax
mov byte [ebp - 0xf4], 0x11
mov dword [ebp - 0xf0], ebx
mov byte [ebp - 0xec], 0xa
mov dword [ebp - 0xe8], esi
mov byte [ebp - 0xe4], 0xa
lea edx, [ebp - 0xf8]
mov ecx, 2
mov eax, 0x62c34c
call fcn.006169d0
push 0
push 3
lea eax, [ebp - 0xa4]
push eax
movzx eax, byte [ebp - 0x99]
mov ecx, ebx
mov edx, dword [ebp - 0xa0]
call fcn.005c7a60
test eax, eax
jne case.0x62b3f6.140
mov edx, esi
mov eax, dword [ebp - 0xa4]
call fcn.005c79a0
test al, al
je 0x62bae8
push esi
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegDeleteValueW
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x62bae8
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62c39c
call fcn.006169d0
mov byte [ebp - 0x81], 0
mov eax, dword [ebp - 0xa4]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x62b3f6.140
mov eax, dword [ebp - 0x90]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x28]
call fcn.0062a3d0
jmp case.0x62b3f6.140
mov byte [ebp - 0x82], 1
jmp case.0x62b3f6.140
lea eax, [ebp - 0x118]
push eax
mov eax, dword [ebp - 0x90]
movzx eax, word [eax + 0x10]
mov dword [ebp - 0xbc], eax
mov byte [ebp - 0xb8], 0
lea edx, [ebp - 0xbc]
xor ecx, ecx
mov eax, 0x62c3e0
call fcn.00424510
mov edx, dword [ebp - 0x118]
lea ecx, [ebp - 0x114]
mov ax, 0xea
call fcn.005cd844
mov ecx, dword [ebp - 0x114]
mov dl, 1
mov eax, dword [0x41baa4]
call fcn.00429020
call fcn.004098c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62bba8
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x30]
call fcn.00629b70
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x30]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x90], 0
jne 0x62b365
cmp byte [ebp - 0x82], 0
je 0x62bbf6
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 0x30]
test byte [eax + 0x1d], 0x10
je 0x62bc04
call fcn.0061093c
cmp dword [ebp - 0x80], 0
je 0x62bc14
call dword [ebp - 0x80]
push ebp
call fcn.0062aae4
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62bcc5
mov eax, dword [ebp - 0x48]
call fcn.00408444
mov eax, dword [ebp - 0x34]
call fcn.00408444
mov eax, dword [ebp - 0x38]
call fcn.00408444
mov eax, dword [ebp - 0x3c]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x62bc97
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x11c]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.00610ce0
mov eax, dword [ebp - 0x11c]
call fcn.005c6898
test al, al
je 0x62bc93
push 0
lea ecx, [ebp - 0x120]
mov edx, ebx
mov eax, dword [ebp - 0x3c]
call fcn.00610ce0
mov eax, dword [ebp - 0x120]
call fcn.0040b278
push eax
push 0x1005
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x62bc47
mov eax, dword [ebp - 0x40]
call fcn.00408444
mov eax, dword [ebp - 0x44]
call fcn.00408444
mov eax, dword [ebp - 0x88]
call fcn.00408444
mov eax, dword [ebp - 0x3c]
call fcn.00408444
ret