Function at 0x62062e51
Capabilities:
Check if file exists
Copy file
Delete file
Get file attributes
Link many functions at runtime
Move file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8bc
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.62062df9
test eax, eax
jne 0x620632e9
push esi
push edi
push 0x104
lea eax, [ebp - 0x424]
push eax
call dword [ebp + 8]
test eax, eax
je 0x620632de
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x320]
push eax
call esi
test eax, eax
je 0x620632de
push dword [0x6206a008]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x320]
push eax
call edi
test eax, eax
je 0x620632de
push dword [ebp + 0xc]
lea eax, [ebp - 0x8bc]
push eax
call esi
test eax, eax
je 0x620632de
push dword [0x6206a004]
lea eax, [ebp - 0x8bc]
push eax
call edi
test eax, eax
je 0x620632de
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x7b8]
push eax
call esi
test eax, eax
je 0x620632de
push dword [0x6206a018]
lea eax, [ebp - 0x7b8]
push eax
call edi
test eax, eax
je 0x620632de
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x5b0]
push eax
call esi
test eax, eax
je 0x620632de
push dword [0x6206a01c]
lea eax, [ebp - 0x5b0]
push eax
call edi
test eax, eax
je 0x620632de
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x21c]
push eax
call esi
test eax, eax
je 0x620632de
push dword [0x6206a014]
lea eax, [ebp - 0x21c]
push eax
call edi
test eax, eax
je 0x620632de
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x6b4]
push eax
call esi
test eax, eax
je 0x620632de
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
je 0x620630bd
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x620630bd
push 0x620613d4
push edi
mov dword [ebp - 4], 2
call esi
inc ebx
test eax, eax
je 0x62062fe4
mov dword [ebp - 4], ebx
push 0x620613c4
push edi
call esi
test eax, eax
je 0x62062ff7
mov dword [ebp - 4], 3
push 0x620613ac
push edi
call esi
test eax, eax
je 0x6206300a
mov dword [ebp - 4], 4
push 0x620613a0
push edi
call esi
test eax, eax
je 0x62063019
mov dword [ebp - 0x10], ebx
push 0x62061394
push edi
call esi
test eax, eax
je 0x62063028
mov dword [ebp - 0xc], ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [ebp - 4]
cmp edi, 3
je 0x6206303c
cmp edi, 4
jne 0x62063076
push dword [edi*4 + section..data]
lea eax, [ebp - 0x6b4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
je 0x620632de
push 0
lea eax, [ebp - 0x6b4]
push eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x620632de
cmp edi, 2
jne 0x620630bd
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x21c]
push eax
call esi
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x620632de
lea eax, [ebp - 0x7b8]
push eax
call esi
lea eax, [ebp - 0x5b0]
push eax
call esi
jmp 0x62063288
mov ebx, dword [sym.imp.KERNEL32.dll_OpenFile]
push 0x4000
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x7b8]
push eax
call ebx
cmp eax, 0xffffffff
je 0x62063106
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x7b8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x620632de
and byte [ebp - 0x118], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x62061360
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x620631c1
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x62061354
push dword [ebp + 8]
mov dword [ebp + 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x620631b1
cmp dword [ebp - 0x14], 1
jne 0x620631b1
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x6206133c
lea eax, [ebp - 0x118]
push eax
call edi
call fcn.6206237f
test eax, eax
mov eax, 0x62061338
jne 0x62063197
mov eax, 0x6206132c
push eax
lea eax, [ebp - 0x118]
push eax
call edi
push 0x62061180
lea eax, [ebp - 0x118]
push eax
call edi
jmp 0x620631b8
and byte [ebp - 0x118], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x118], 0
je 0x62063249
push 0x4000
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x118]
push eax
call ebx
cmp eax, 0xffffffff
je 0x62063249
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x62063208
push 0x620613d4
push edi
call esi
test eax, eax
je 0x62063208
xor esi, esi
inc esi
jmp 0x6206320a
xor esi, esi
test edi, edi
je 0x62063215
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
jne 0x62063249
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x62063249
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x620632e7
push 0x4000
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x5b0]
push eax
call ebx
cmp eax, 0xffffffff
je 0x62063288
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x5b0]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
je 0x620632de
push 0
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x8bc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x620632de
cmp dword [ebp - 4], 3
jne 0x620632bf
lea eax, [ebp - 0x6b4]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x62061324
call fcn.62062d08
cmp dword [ebp - 4], 4
jne 0x620632e7
lea eax, [ebp - 0x6b4]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x62061310
call fcn.62062d08
jmp 0x620632e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
pop edi
pop esi
mov eax, dword [ebp - 8]
pop ebx
leave
ret 8