Function at 0x8fd240
Capabilities:
Create thread
Persist via run registry key
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb15c10
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x3f24
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 0x3f14], ebx
mov byte [ebp - 0x12c], 0
push 0x103
push 0
lea eax, [ebp - 0x12b]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x234], 0
push 0x103
push 0
lea ecx, [ebp - 0x233]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x444], 0
push 0x103
push 0
lea edx, [ebp - 0x443]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x3f28], 0
mov byte [ebp - 0x239c], 0
push 0xfff
push 0
lea eax, [ebp - 0x239b]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov ecx, 0xd2
mov esi, str._REGISTRYUSERCSIDSoftwareMicrosoftCommand_Processor__REGISTRYUSERCSIDSoftwareMicrosoftInternet_ExplorerMain__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__REGISTRYUSERCSIDSoftwareMicrosoftWindows_NTCurrentVersionWinlogon__REGISTRYUSERCSIDSoftwareMicrosoftWindows_NTCurrentVersionWindows__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionRun__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionRunOnce__REGISTRYUSERCSIDSoftwareVSRevoGroupRevoUninstallerGeneral__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__REGISTRYUSERCSIDSoftwareMicrosoftWindowsCurrentVersionInternet_Settings__REGISTRYUSERCSIDControl_PanelDesktop
lea edi, [ebp - 0x3dcc]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0xcb7
push 0
lea ecx, [ebp - 0x3a83]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 4], 0
push 0xb525d0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp + 8]
push edx
push str.Processing_Current_User_Settings__FW:_u_
lea eax, [ebp - 0x239c]
push eax
call fcn.00a78f30
add esp, 0xc
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x239c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0xb3ddd8
push str.ProtectProxySettings
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8fd3ae
mov eax, dword [0xb3ddd8]
mov esi, str.ProtectProxySettings
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov ebx, dword [ebp - 0x3f14]
cmp dword [0xb3ddd8], 1
jne 0x8fd405
mov byte [ebp - 0x24a4], 0
push 0x103
push edi
lea edx, [ebp - 0x24a3]
push edx
call fcn.00a7ffb0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x24a4]
push eax
push 0xaa1543
mov edx, str.ProtectProxySettingsCustom
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x24a4], 0x30
jne 0x8fd405
mov dword [0xb3ddd8], edi
cmp byte [ebp - 0x3dcc], 0
je 0x8fede1
push 0x80000003
lea eax, [ebp - 0x3f1c]
mov ecx, 1
mov edx, ebx
call fcn.0097f000
add esp, 4
mov esi, eax
push 0x103
push edi
cmp esi, edi
jne 0x8fed85
mov byte [ebp - 0x33c], 0
lea ecx, [ebp - 0x33b]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x3f18], 0x104
mov byte [ebp - 0xa64], 0
push 0x103
push edi
lea edx, [ebp - 0xa63]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x27b4], 0
push 0x207
push edi
lea eax, [ebp - 0x27b3]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x95c], 0
push 0x207
push edi
lea ecx, [ebp - 0x95b]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x3f24], edi
mov dword [ebp - 0x3f10], edi
mov edx, dword [ebp - 0x3f1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x3f10]
push eax
push edi
call fcn.008fc7b0
add esp, 8
cmp dword [0xb56800], edi
je 0x8fd4f2
lea ecx, [ebp - 0x3f10]
push ecx
push 1
call fcn.008fc7b0
add esp, 8
lea edx, [ebp - 0x3f10]
push edx
push edi
mov ecx, ebx
call fcn.008fcac0
add esp, 8
cmp dword [0xb56800], edi
je 0x8fd51f
lea eax, [ebp - 0x3f10]
push eax
push 1
mov ecx, ebx
call fcn.008fcac0
add esp, 8
cmp dword [ebp - 0x3f10], edi
je 0x8fd58a
push str.powershell.exe_powershell_ise.exe_msiexec.exe_wmic.exe
call fcn.0095be10
add esp, 4
lea ecx, [ebp - 0x3f10]
push ecx
push edi
call fcn.008fc7b0
add esp, 8
cmp dword [0xb56800], edi
je 0x8fd55d
lea edx, [ebp - 0x3f10]
push edx
push 1
call fcn.008fc7b0
add esp, 8
lea eax, [ebp - 0x3f10]
push eax
push edi
mov ecx, ebx
call fcn.008fcac0
add esp, 8
cmp dword [0xb56800], edi
je 0x8fd58a
lea ecx, [ebp - 0x3f10]
push ecx
push 1
mov ecx, ebx
call fcn.008fcac0
add esp, 8
push ebx
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea edx, [ebp - 0xa64]
push edx
call fcn.00a78f30
add esp, 0xc
push str.Programs
lea eax, [ebp - 0x3f18]
lea edi, [ebp - 0x33c]
lea ecx, [ebp - 0xa64]
mov edx, 0x80000003
call fcn.0094c020
cmp byte [ebp - 0x33c], 0
jne 0x8fd607
push 2
mov ecx, edi
call fcn.008fb630
add esp, 4
cmp dword [0xbc27fc], 0
je 0x8fd647
mov eax, edi
push eax
push str.CSIDL_PROGRAMS_B____s
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
mov edx, dword [0xbc27fc]
push edx
lea eax, [ebp - 0x239c]
push eax
jmp 0x8fd63a
cmp dword [0xbc27fc], 0
je 0x8fd647
lea ecx, [ebp - 0x33c]
push ecx
push str.CSIDL_PROGRAMS_A____s
lea edx, [ebp - 0x239c]
push edx
call fcn.00a78f30
add esp, 0xc
push 0
mov eax, dword [0xbc27fc]
push eax
lea ecx, [ebp - 0x239c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [str.Administrator], 0
je 0x8fd6e4
push 0
push 0xadb5b8
lea edx, [ebp - 0x33c]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8fd6e4
push str.Administrator
push 0xadb5c8
lea eax, [ebp - 0x3ed4]
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x3ed4]
push ecx
push 0xadb5b8
lea edx, [ebp - 0x33c]
push edx
call fcn.0095e130
add esp, 0xc
cmp dword [0xbc27fc], 0
je 0x8fd6e4
lea eax, [ebp - 0x33c]
push eax
push str.CSIDL_PROGRAMS_C____s
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
mov edx, dword [0xbc27fc]
push edx
lea eax, [ebp - 0x239c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0x3f18], 0x104
push str.Local_AppData
lea eax, [ebp - 0x3f18]
lea edi, [ebp - 0x12c]
lea ecx, [ebp - 0xa64]
mov edx, 0x80000003
call fcn.0094c020
cmp byte [ebp - 0x12c], 0
je 0x8fd768
mov ecx, edi
call fcn.0095a450
test eax, eax
je 0x8fd768
cmp dword [0xbc27fc], 0
je 0x8fd848
mov ecx, edi
push ecx
push str.CSIDL_DESKTOPDIRECTORY_A____s
lea edx, [ebp - 0x239c]
push edx
call fcn.00a78f30
add esp, 0xc
push 0
mov eax, dword [0xbc27fc]
push eax
lea ecx, [ebp - 0x239c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8fd848
push 0x10
lea ecx, [ebp - 0x12c]
call fcn.008fb630
add esp, 4
cmp byte [ebp - 0x12c], 0
je 0x8fd848
lea ecx, [ebp - 0x12c]
call fcn.0095a450
test eax, eax
je 0x8fd848
cmp dword [0xbc27fc], 0
je 0x8fd7d9
lea edx, [ebp - 0x12c]
push edx
push str.CSIDL_DESKTOPDIRECTORY_B____s
lea eax, [ebp - 0x239c]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
mov ecx, dword [0xbc27fc]
push ecx
lea edx, [ebp - 0x239c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0x12c]
call fcn.00960910
call fcn.00968d70
test eax, eax
je 0x8fd82a
lea eax, [ebp - 0x12c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8fd7f4
mov ecx, dword [str...AppDataLocal]
mov dword [eax], ecx
mov edx, dword [0xadb61c]
mov dword [eax + 4], edx
mov ecx, dword [0xadb620]
mov dword [eax + 8], ecx
mov edx, dword [0xadb624]
mov dword [eax + 0xc], edx
mov cl, byte [0xadb628]
mov byte [eax + 0x10], cl
jmp 0x8fd848
lea edi, [ebp - 0x12c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8fd831
mov ecx, 8
mov esi, str...Local_SettingsApplication_Data
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [str.Administrator], 0
je 0x8fd8e5
push 0
push 0xadb5b8
lea edx, [ebp - 0x12c]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8fd8e5
push str.Administrator
push 0xadb5c8
lea eax, [ebp - 0x3ed4]
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x3ed4]
push ecx
push 0xadb5b8
lea edx, [ebp - 0x12c]
push edx
call fcn.0095e130
add esp, 0xc
cmp dword [0xbc27fc], 0
je 0x8fd8e5
lea eax, [ebp - 0x12c]
push eax
push str.CSIDL_DESKTOPDIRECTORY_C____s
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
mov edx, dword [0xbc27fc]
push edx
lea eax, [ebp - 0x239c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x12c], 0
je 0x8fdef4
mov byte [ebp - 0xe74], 0
push 0x207
push 0
lea ecx, [ebp - 0xe73]
push ecx
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x12c]
push edx
lea ecx, [ebp - 0xe74]
call fcn.00a55f20
add esp, 4
cmp byte [ebp - 0xe74], 0
jne 0x8fd946
mov eax, dword [str.Default]
mov dword [ebp - 0xe74], eax
mov ecx, dword [0xadb694]
mov dword [ebp - 0xe70], ecx
jmp 0x8fd95e
push 0x2c
lea edx, [ebp - 0xe74]
push edx
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8fd95e
mov byte [eax], 0
lea ecx, [ebp - 0x12c]
call fcn.00960910
mov byte [0xbd4558], 0
lea eax, [ebp - 0x12c]
push eax
push str._sGoogleDriveuser_default_sync_config.db
push str.C:UsersAdministratorAppDataLocalGoogleDriveuser_default_sync_config.db
call fcn.00a78f30
add esp, 0xc
push 0
push 0
xor edx, edx
mov ecx, str.C:UsersAdministratorAppDataLocalGoogleDriveuser_default_sync_config.db
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8fda87
mov byte [ebp - 0x118c], al
push 0x103
push eax
lea ecx, [ebp - 0x118b]
push ecx
call fcn.00a7ffb0
add esp, 0xc
lea esi, [ebp - 0x118c]
mov edi, 0xbd4558
call fcn.00a50000
cmp byte [0xbd4558], 0
jne 0x8fda0e
mov edx, esi
push edx
push str.C:UsersAdministratorAppDataLocalGoogleDriveuser_default_sync_config.db
push str._CLOUD__Unable_to_get_google_drive_from_sync_config.db___s___Err:_s
lea eax, [ebp - 0x754]
push eax
call fcn.00a78f30
push 0
push 1
lea ecx, [ebp - 0x754]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8fdac6
mov ecx, 0xbd4558
call fcn.0095a450
test eax, eax
jne 0x8fda58
push str.C:UsersAdministratorAppDataLocalGoogleDriveuser_default_sync_config.db
push 0xbd4558
push str._CLOUD__Invalid_google_drive_folder___s__in_sync_config.db___s__
lea edx, [ebp - 0x754]
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x754]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov byte [0xbd4558], 0
jmp 0x8fdac6
mov ecx, 0xbd4558
call fcn.00960910
push 0xbd4558
push str._CLOUD__Google_Drive_Folder:__s
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x239c]
jmp 0x8fdab8
cmp dword [0xbc27fc], 0
je 0x8fdac6
push str.C:UsersAdministratorAppDataLocalGoogleDriveuser_default_sync_config.db
push str._CLOUD__Google_Drive_not_found._Missing___s_
lea eax, [ebp - 0x754]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
mov ecx, dword [0xbc27fc]
push ecx
lea edx, [ebp - 0x754]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov byte [str.C:UsersAdministratorOneDrive_], 0
mov ecx, str.C:UsersAdministratorOneDrive_
mov esi, ebx
call fcn.008fd110
cmp byte [str.C:UsersAdministratorOneDrive_], 0
jne 0x8fdb22
cmp dword [0xbc27fc], 0
je 0x8fdba2
push str._CLOUD__Unable_to_get_OneDrive_Folder_
lea eax, [ebp - 0x239c]
push eax
call fcn.00a78f30
push 0
mov ecx, dword [0xbc27fc]
push ecx
lea edx, [ebp - 0x239c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
jmp 0x8fdba2
mov ecx, str.C:UsersAdministratorOneDrive_
call fcn.0095a450
test eax, eax
jne 0x8fdb67
push str.C:UsersAdministratorOneDrive_
push str._CLOUD__Invalid_OneDrive_folder___s__
lea eax, [ebp - 0x239c]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x239c]
push ecx
push 0xb54ce8
call fcn.008808e0
mov byte [str.C:UsersAdministratorOneDrive_], 0
jmp 0x8fdb9f
mov ecx, str.C:UsersAdministratorOneDrive_
call fcn.00960910
push str.C:UsersAdministratorOneDrive_
push str._CLOUD__OneDrive_Folder:__s
lea edx, [ebp - 0x239c]
push edx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea eax, [ebp - 0x239c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0x12c]
mov edx, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultCache
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8fdbb0
lea ecx, [ebp - 0x12c]
mov edx, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefault
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8fdbc5
lea ecx, [ebp - 0x12c]
mov edx, str.C:UsersAdministratorAppDataLocalMicrosoftInternet_ExplorerDOMStore_
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8fdbe0
lea ecx, [ebp - 0x12c]
mov edx, str.C:UsersAdministratorAppDataLocalPackagesMicrosoft.MicrosoftEdge_8wekyb3d8bbweAC_001MicrosoftEdgeUserDefaultDOMStore_
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8fdbf5
mov edi, str.C:UsersAdministratorAppDataLocalMicrosoftInternet_ExplorerDOMStore_
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8fdc05
mov ecx, 9
mov esi, str.MicrosoftInternet_ExplorerDOMStore_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, str.C:UsersAdministratorAppDataLocalPackagesMicrosoft.MicrosoftEdge_8wekyb3d8bbweAC_001MicrosoftEdgeUserDefaultDOMStore_
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8fdc21
mov ecx, 0x17
mov esi, str.PackagesMicrosoft.MicrosoftEdge_8wekyb3d8bbweAC_001MicrosoftEdgeUserDefaultDOMStore_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, str.C:UsersAdministratorAppDataLocalMicrosoftInternet_ExplorerDOMStore_
call fcn.0095a450
test eax, eax
je 0x8fdc75
push str.C:UsersAdministratorAppDataLocalMicrosoftInternet_ExplorerDOMStore_
push str.IExplore_DOM_Folder:__s
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x239c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, str.C:UsersAdministratorAppDataLocalPackagesMicrosoft.MicrosoftEdge_8wekyb3d8bbweAC_001MicrosoftEdgeUserDefaultDOMStore_
call fcn.0095a450
test eax, eax
je 0x8fdcb4
push str.C:UsersAdministratorAppDataLocalPackagesMicrosoft.MicrosoftEdge_8wekyb3d8bbweAC_001MicrosoftEdgeUserDefaultDOMStore_
push str.Edge_DOM_Folder:__s
lea eax, [ebp - 0x239c]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x239c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edi, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultCache
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8fdcc0
mov ecx, 6
mov esi, str.GoogleChromeUser_Data_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xe74]
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x8fdce0
sub eax, ecx
mov esi, ecx
mov edi, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultCache
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x8fdcf1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultCache
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8fdd10
mov edx, dword [str.Cache]
mov dword [eax], edx
mov cx, word [0xadb8e4]
mov word [eax + 4], cx
mov dl, byte [0xadb8e6]
mov byte [eax + 6], dl
lea edi, [ebp - 0x12c]
dec edi
jmp 0x8fdd40
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8fdd40
mov ecx, 6
mov esi, str.GoogleChromeUser_Data_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xe74]
mov ecx, eax
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x8fdd60
sub eax, ecx
mov esi, ecx
lea edi, [ebp - 0x12c]
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x8fdd72
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x12c]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8fdd90
mov ecx, dword [str.Extensions]
mov dword [eax], ecx
mov edx, dword [0xadb8ec]
mov dword [eax + 4], edx
mov ecx, dword [0xadb8f0]
mov dword [eax + 8], ecx
mov edi, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefault
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8fddb8
mov ecx, 6
mov esi, str.GoogleChromeUser_Data_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xe74]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x8fddd5
sub eax, ecx
mov esi, ecx
mov edi, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefault
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x8fdde6
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x12c]
call fcn.0095a450
test eax, eax
jne 0x8fde34
push 0xaa1543
lea edx, [ebp - 0x12c]
push edx
call fcn.0095ea20
add esp, 8
lea ecx, [ebp - 0x12c]
call fcn.0095a450
test eax, eax
jne 0x8fde34
mov byte [ebp - 0x12c], al
mov ecx, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultCache
call fcn.0095a450
test eax, eax
jne 0x8fde67
push 0xaa1543
push str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultCache
call fcn.0095ea20
add esp, 8
mov ecx, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultCache
call fcn.0095a450
test eax, eax
jne 0x8fde67
mov byte [str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultCache], al
cmp byte [ebp - 0x12c], 0
je 0x8fdef4
lea ecx, [ebp - 0x12c]
mov edx, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultExtensions
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8fde80
mov esi, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultExtensions
call fcn.00960950
mov eax, dword [0xbd4ab0]
push eax
push esi
push str.Chrome_Extensions_Folder:__s__DIA_u_
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
xor ebx, ebx
push ebx
push 1
lea edx, [ebp - 0x239c]
push edx
push 0xb54ce8
call fcn.008808e0
push str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultCache
push str.Chrome_Cache_Folder:__s
lea eax, [ebp - 0x239c]
push eax
call fcn.00a78f30
add esp, 0x2c
push ebx
push 1
lea ecx, [ebp - 0x239c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8fdf1f
push str.Unable_to_get_Extensions_folder_for_Chrome_
lea edx, [ebp - 0x239c]
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x239c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
xor ebx, ebx
mov eax, dword [0xbd0b28]
cmp eax, ebx
je 0x8fdf37
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xbd0b28], ebx
mov eax, dword [0xbd0b2c]
cmp eax, ebx
je 0x8fdf4f
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xbd0b2c], ebx
mov eax, dword [0xbd0b30]
cmp eax, ebx
je 0x8fdf67
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xbd0b30], ebx
mov esi, 0x104
mov dword [ebp - 0x3f18], esi
push str.AppData
lea eax, [ebp - 0x3f18]
lea edi, [ebp - 0x234]
lea ecx, [ebp - 0xa64]
mov edx, 0x80000003
call fcn.0094c020
cmp byte [ebp - 0x234], 0
je 0x8fdfab
mov ecx, edi
call fcn.0095a450
test eax, eax
jne 0x8fe06c
push 0x10
lea ecx, [ebp - 0x234]
call fcn.008fb630
add esp, 4
cmp byte [ebp - 0x234], 0
je 0x8fe06c
lea ecx, [ebp - 0x234]
call fcn.0095a450
test eax, eax
je 0x8fe06c
lea ecx, [ebp - 0x234]
call fcn.00960910
call fcn.00968d70
test eax, eax
lea eax, [ebp - 0x234]
je 0x8fe037
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8fdff6
mov ecx, dword [str...AppDataRoaming]
mov dword [eax], ecx
mov edx, dword [0xadb96c]
mov dword [eax + 4], edx
mov ecx, dword [0xadb970]
mov dword [eax + 8], ecx
mov edx, dword [0xadb974]
mov dword [eax + 0xc], edx
mov cx, word [0xadb978]
mov word [eax + 0x10], cx
mov dl, byte [0xadb97a]
mov byte [eax + 0x12], dl
jmp 0x8fe06c
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8fe038
mov ecx, dword [str...Application_Data]
mov dword [eax], ecx
mov edx, dword [0xadb980]
mov dword [eax + 4], edx
mov ecx, dword [0xadb984]
mov dword [eax + 8], ecx
mov edx, dword [0xadb988]
mov dword [eax + 0xc], edx
mov ecx, dword [0xadb98c]
mov dword [eax + 0x10], ecx
cmp byte [str.Administrator], 0
je 0x8fe0c3
push ebx
push 0xadb5b8
lea edx, [ebp - 0x234]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8fe0c3
push str.Administrator
push 0xadb5c8
lea eax, [ebp - 0x3ed4]
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x3ed4]
push ecx
push 0xadb5b8
lea edx, [ebp - 0x234]
push edx
call fcn.0095e130
add esp, 0xc
cmp dword [0xbc27fc], ebx
je 0x8fe102
lea eax, [ebp - 0x234]
push eax
push str.AppDataRoaming___s
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
add esp, 0xc
push ebx
mov edx, dword [0xbc27fc]
push edx
lea eax, [ebp - 0x239c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0x3f18], esi
push str.Local_AppData
lea eax, [ebp - 0x3f18]
lea edi, [ebp - 0x444]
lea ecx, [ebp - 0xa64]
mov edx, 0x80000003
call fcn.0094c020
cmp byte [ebp - 0x444], 0
je 0x8fe141
mov ecx, edi
call fcn.0095a450
test eax, eax
jne 0x8fe1e7
push 0x10
lea ecx, [ebp - 0x444]
call fcn.008fb630
add esp, 4
cmp byte [ebp - 0x444], 0
je 0x8fe1e7
lea ecx, [ebp - 0x444]
call fcn.0095a450
test eax, eax
je 0x8fe1e7
lea ecx, [ebp - 0x444]
call fcn.00960910
call fcn.00968d70
test eax, eax
je 0x8fe1c6
lea eax, [ebp - 0x444]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8fe190
mov ecx, dword [str...AppDataLocal]
mov dword [eax], ecx
mov edx, dword [0xadb61c]
mov dword [eax + 4], edx
mov ecx, dword [0xadb620]
mov dword [eax + 8], ecx
mov edx, dword [0xadb624]
mov dword [eax + 0xc], edx
mov cl, byte [0xadb628]
mov byte [eax + 0x10], cl
jmp 0x8fe1e7
lea edi, [ebp - 0x444]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8fe1d0
mov ecx, 8
mov esi, str...Local_SettingsApplication_Data
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [str.Administrator], 0
je 0x8fe23e
push ebx
push 0xadb5b8
lea edx, [ebp - 0x444]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8fe23e
push str.Administrator
push 0xadb5c8
lea eax, [ebp - 0x3ed4]
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x3ed4]
push ecx
push 0xadb5b8
lea edx, [ebp - 0x444]
push edx
call fcn.0095e130
add esp, 0xc
cmp dword [0xbc27fc], ebx
je 0x8fe27d
lea eax, [ebp - 0x444]
push eax
push str.AppDataLocalFF___s
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
add esp, 0xc
push ebx
mov edx, dword [0xbc27fc]
push edx
lea eax, [ebp - 0x239c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x234], 0
je 0x8fe291
lea ecx, [ebp - 0x234]
call fcn.008fce90
mov eax, dword [0xbd4344]
cmp eax, ebx
jne 0x8fe2ae
lea ecx, [ebp - 0x444]
call fcn.008fce90
mov eax, dword [0xbd4344]
cmp eax, ebx
je 0x8fe2da
push eax
push str._CLOUD__Dropbox_Folder_s_:__s
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea edx, [ebp - 0x239c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x234], 0
je 0x8fe675
lea ecx, [ebp - 0x444]
call fcn.00960910
lea edi, [ebp - 0x444]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8fe300
mov ecx, 6
mov esi, str.MozillaFirefoxProfiles
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x234]
call fcn.00960910
lea edi, [ebp - 0x234]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8fe327
mov ecx, 6
mov esi, str.MozillaFirefoxProfiles
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp dword [0xbc27fc], ebx
je 0x8fe3b2
lea eax, [ebp - 0x234]
push eax
push str.AppDataRoaming_A____s
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
add esp, 0xc
push ebx
mov edx, dword [0xbc27fc]
push edx
lea eax, [ebp - 0x239c]
push eax
push 0xb54ce8
call fcn.008808e0
lea ecx, [ebp - 0x444]
push ecx
push str.AppDataLocalFF_A____s
lea edx, [ebp - 0x239c]
push edx
call fcn.00a78f30
add esp, 0x1c
push ebx
mov eax, dword [0xbc27fc]
push eax
lea ecx, [ebp - 0x239c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0x234]
call fcn.0095a450
test eax, eax
jne 0x8fe3f3
push 0xaa1543
lea edx, [ebp - 0x234]
push edx
call fcn.0095ea20
add esp, 8
lea ecx, [ebp - 0x234]
call fcn.0095a450
test eax, eax
jne 0x8fe675
mov byte [ebp - 0x234], al
jmp 0x8fe675
lea ecx, [ebp - 0x234]
lea edx, [ebp - 0x54c]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8fe400
lea ecx, [ebp - 0x54c]
call fcn.00960910
lea eax, [ebp - 0x54c]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8fe420
mov ecx, dword [0xadba24]
mov dword [eax], ecx
mov edx, dword [0xadba28]
mov dword [eax + 4], edx
mov cx, word [0xadba2c]
mov word [eax + 8], cx
mov dl, byte [0xadba2e]
mov byte [eax + 0xa], dl
mov edi, 1
lea esi, [ebp - 0x3f0c]
lea ecx, [ebp - 0x54c]
call fcn.0094df40
mov dword [ebp - 0x3f10], eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
nop
mov eax, dword [ebp - 0x3f10]
cmp eax, 0xffffffff
je 0x8fe675
test edi, edi
je 0x8fe663
test byte [ebp - 0x3f0c], 0x10
je 0x8fe64b
mov byte [ebp - 0x29bc], 0
mov byte [ebp - 0xc6c], 0
push 0x207
push 0
lea eax, [ebp - 0xc6b]
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x234]
push ecx
lea edx, [ebp - 0x54c]
push edx
call ebx
lea ecx, [ebp - 0x54c]
call fcn.00960910
lea eax, [ebp - 0x3ee0]
push eax
lea ecx, [ebp - 0x54c]
push ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
lea ecx, [ebp - 0x54c]
lea edx, [ebp - 0x29bc]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8fe4f5
lea ecx, [ebp - 0x54c]
call fcn.00960910
lea eax, [ebp - 0x54c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8fe511
mov edx, dword [str.extensions]
mov dword [eax], edx
mov ecx, dword [0xadba34]
mov dword [eax + 4], ecx
mov dx, word [0xadba38]
mov word [eax + 8], dx
mov cl, byte [0xadba3a]
mov byte [eax + 0xa], cl
lea ecx, [ebp - 0x54c]
call fcn.0095a450
test eax, eax
jne 0x8fe576
push 0xaa1543
lea edx, [ebp - 0x54c]
push edx
call fcn.0095ea20
add esp, 8
lea ecx, [ebp - 0x54c]
call fcn.0095a450
test eax, eax
jne 0x8fe576
mov byte [ebp - 0x54c], al
lea eax, [ebp - 0x444]
push eax
lea ecx, [ebp - 0xc6c]
push ecx
call ebx
lea ecx, [ebp - 0xc6c]
call fcn.00960910
lea edx, [ebp - 0x3ee0]
push edx
lea eax, [ebp - 0xc6c]
push eax
call esi
lea ecx, [ebp - 0xc6c]
call fcn.00960910
lea eax, [ebp - 0xc6c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8fe5b3
mov ecx, dword [str.cache2]
mov dword [eax], ecx
mov dx, word [0xadba40]
mov word [eax + 4], dx
mov cl, byte [0xadba42]
mov byte [eax + 6], cl
lea ecx, [ebp - 0xc6c]
call fcn.0095a450
test eax, eax
jne 0x8fe60f
push 0xaa1543
lea edx, [ebp - 0xc6c]
push edx
call fcn.0095ea20
add esp, 8
lea ecx, [ebp - 0xc6c]
call fcn.0095a450
test eax, eax
jne 0x8fe60f
mov byte [ebp - 0xc6c], al
cmp byte [ebp - 0x54c], 0
je 0x8fe62d
push 0
push 0x2c
lea eax, [ebp - 0x54c]
push eax
mov edi, 0xbd0b2c
call fcn.0098d640
cmp byte [ebp - 0xc6c], 0
je 0x8fe64b
push 0
push 0x2c
lea ecx, [ebp - 0xc6c]
push ecx
mov edi, 0xbd0b30
call fcn.0098d640
lea esi, [ebp - 0x3f0c]
mov ecx, dword [ebp - 0x3f10]
call fcn.0094e160
mov edi, eax
jmp 0x8fe470
cmp eax, 0xffffffff
je 0x8fe675
mov edx, dword [ebp - 0x3f10]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [0xbd0b2c]
test eax, eax
je 0x8fe739
cmp byte [eax], 0
je 0x8fe739
push eax
push str.Firefox_Extensions_Folder_s_:__s
lea eax, [ebp - 0x239c]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x239c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [0xbd0b2c]
call fcn.0094c3d0
add eax, 0x20
call fcn.00966e40
mov dword [0xbd0b28], eax
test eax, eax
je 0x8fe6ea
mov ecx, dword [0xbd0b2c]
mov edx, eax
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8fe6e0
mov eax, dword [0xbd0b30]
test eax, eax
je 0x8fe725
cmp byte [eax], 0
je 0x8fe725
push eax
push str.Firefox_Cache_Folder_s_:__s
lea edx, [ebp - 0x239c]
push edx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea eax, [ebp - 0x239c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 7
push 0
mov ecx, dword [0xbd4ad8]
call fcn.008a3370
add esp, 8
jmp 0x8fe762
push str.Unable_to_get_Extensions_folder_for_Firefox_
lea ecx, [ebp - 0x239c]
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x239c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
cmp dword [0xbd444c], 0
je 0x8fe7f0
push 0
push 0
push 0x8fa9f0
call fcn.00a791b2
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x8fe7d9
mov byte [ebp - 0x25ac], 0
push 0x103
push 0
lea eax, [ebp - 0x25ab]
push eax
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_1wclb__fails_with_error__d
lea ecx, [ebp - 0x25ac]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x25ac]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8fe7f0
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.CBD_CLBR4a
xor ebx, ebx
call fcn.0085df20
add esp, 4
xor ebx, ebx
mov dword [ebp - 0x3f2c], ebx
lea eax, [ebp - 0x3f2c]
push eax
push str.Enabled
mov ecx, str.SOFTWAREMicroWorldContentFilteringSchedule
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x3f2c], ebx
je 0x8fe824
push ebx
call 0x8f9170
add esp, 4
cmp byte [ebp - 0x12c], 0
je 0x8fe841
push ebx
push 0x2c
lea ecx, [ebp - 0x12c]
push ecx
mov edi, 0xbd0b2c
call fcn.0098d640
cmp byte [ebp - 0x33c], 0
je 0x8fe9ce
mov dword [ebp - 0x3f30], ebx
lea ecx, [ebp - 0x33c]
call fcn.00960910
push str.Startup
lea edx, [ebp - 0x33c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x33c]
call fcn.0095a450
test eax, eax
jne 0x8fe95c
lea eax, [ebp - 0x33c]
push eax
push str.CurrentUser_Startup_Folder_Absent_A_:___s_
lea ecx, [ebp - 0x29bc]
push ecx
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea edx, [ebp - 0x29bc]
push edx
push 0xb54ce8
call fcn.008808e0
push 0x5c
lea eax, [ebp - 0x33c]
push eax
call fcn.00a7a2c0
add esp, 0x18
cmp eax, ebx
je 0x8fe9ce
push 0x5c
inc eax
push eax
call fcn.00a7a2c0
add esp, 8
cmp eax, ebx
je 0x8fe9ce
push 0x5c
inc eax
push eax
call fcn.00a7a2c0
add esp, 8
cmp eax, ebx
je 0x8fe9ce
inc eax
mov byte [eax], 0
lea edi, [ebp - 0x33c]
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8fe900
mov ecx, 0xf
mov esi, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x33c]
call fcn.0095a450
test eax, eax
jne 0x8fe95c
lea ecx, [ebp - 0x33c]
push ecx
push str.CurrentUser_Startup_Folder_Absent_B_:___s_
lea edx, [ebp - 0xe74]
push edx
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea eax, [ebp - 0xe74]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8fe9ce
mov dword [ebp - 0x3f30], 1
lea ecx, [ebp - 0x33c]
push ecx
push str.CurrentUser_Startup:___s_
lea edx, [ebp - 0x29bc]
push edx
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea eax, [ebp - 0x29bc]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea ecx, [ebp - 0x33c]
call fcn.00960910
push 1
push ebx
lea ecx, [ebp - 0x33c]
mov edx, 0xbe48a8
call fcn.0097faa0
test eax, eax
je 0x8fe9ce
push ebx
push 0x2c
lea ecx, [ebp - 0x33c]
push ecx
mov edi, 0xbd08cc
call fcn.0098d640
cmp dword [0xbc27fc], ebx
je 0x8fea26
mov eax, dword [0xbd08cc]
cmp eax, ebx
je 0x8fe9f6
push eax
push str.FoldersToBeMonitoredForSuspiciousFiles_B_:__s
lea edx, [ebp - 0x239c]
push edx
call fcn.00a78f30
add esp, 0xc
jmp 0x8fea0a
push str.FoldersToBeMonitoredForSuspiciousFiles_B_:_NULL
lea eax, [ebp - 0x239c]
push eax
call fcn.00a78f30
add esp, 8
push ebx
mov ecx, dword [0xbc27fc]
push ecx
lea edx, [ebp - 0x239c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [ebp - 0x3f14]
push eax
push str.REGISTRYUSER_s
lea ecx, [ebp - 0x27b4]
push ecx
call fcn.00a78f30
add esp, 0xc
lea edx, [ebp - 0x27b4]
push edx
push str.REGISTRYUSERCSID
lea eax, [ebp - 0x3dcc]
push eax
call fcn.0095e130
add esp, 0xc
lea ecx, [ebp - 0x3f24]
push ecx
lea edx, [ebp - 0x3dcc]
push edx
mov bl, 0x2c
lea edi, [ebp - 0x95c]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x3f24], 0xffffffff
je 0x8fede1
xor ebx, ebx
mov byte [ebp - 0x2dcc], bl
push 0x40f
push ebx
lea eax, [ebp - 0x2dcb]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x3f20], ebx
mov esi, 1
mov dword [ebp - 0x3f38], esi
lea edx, [ebp - 0x2dcc]
cmp byte [ebp - 0x95c], 0x21
jne 0x8feade
lea ecx, [ebp - 0x95b]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, esi
add edx, esi
cmp al, bl
jne 0x8fead0
jmp 0x8feaf0
lea ecx, [ebp - 0x95c]
mov al, byte [ecx]
mov byte [edx], al
add ecx, esi
add edx, esi
cmp al, bl
jne 0x8feae4
lea ecx, [ebp - 0x2dcc]
call fcn.00960910
cmp dword [0xb3ddd8], ebx
jne 0x8feb36
push ebx
push str.Internet_Settings
lea ecx, [ebp - 0x2dcc]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8feb36
mov dword [ebp - 0x3f38], ebx
lea edx, [ebp - 0x3f24]
push edx
lea eax, [ebp - 0x3dcc]
push eax
jmp 0x8fea6a
cmp esi, ebx
je 0x8fed72
lea ebx, [ebp - 0x3f20]
lea edi, [ebp - 0x2dcc]
call fcn.009704b0
cmp eax, esi
jne 0x8fed72
mov ebx, dword [ebp - 0x3f20]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x8feb62
sub eax, edx
sar eax, 1
lea edi, [eax + eax]
cmp esi, esi
jne 0x8fec8a
xor esi, esi
push esi
push str.Internet_Settings
lea edx, [ebp - 0x95c]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8feba2
mov dword [ebp - 0x3f28], 1
push ebx
push edi
push 0
cmp byte [ebp - 0x95c], 0x21
jne 0x8febbc
push 0x2000206
call dword [0xb8dacc]
jmp 0x8febcc
push 0x2000209
call dword [0xb8dacc]
mov esi, 1
mov edi, eax
add esp, 0x10
cmp dword [0xbc27fc], 0
je 0x8fed5b
test edi, edi
jl 0x8fec2b
test esi, esi
je 0x8febfb
lea eax, [ebp - 0x95c]
push eax
push str._R_Successfully_Added_to_REGMON:__s
lea ecx, [ebp - 0x239c]
push ecx
jmp 0x8fec0e
lea edx, [ebp - 0x95c]
push edx
push str._NR_Successfully_Added_to_REGMON:__s
lea eax, [ebp - 0x239c]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
mov ecx, dword [0xbc27fc]
push ecx
lea edx, [ebp - 0x239c]
push edx
jmp 0x8fed4e
mov byte [ebp - 0xf7c], 0
push 0x103
push 0
lea eax, [ebp - 0xf7b]
push eax
call fcn.00a7ffb0
add esp, 0xc
push edi
lea edx, [ebp - 0xf7c]
call fcn.008aaa40
add esp, 4
lea ecx, [ebp - 0x95c]
lea edx, [ebp - 0x239c]
cmp byte [ebp - 0xf7c], 0
jne 0x8fec78
push edi
push ecx
push str.___Failed_To_add_to_REGMON___s_._Reason:_0x_x
jmp 0x8fed36
lea eax, [ebp - 0xf7c]
push eax
push ecx
push str.___Failed_To_add_to_REGMON___s_._Reason:__s
jmp 0x8fed36
push ebx
push edi
push 0
push 0x2000207
call dword [0xb8dacc]
add esp, 0x10
mov esi, eax
cmp dword [0xbc27fc], 0
je 0x8fed5b
test esi, esi
jl 0x8fecdf
lea edx, [ebp - 0x95c]
push edx
push str.Successfully_Removed_from_REGMON:__s
lea eax, [ebp - 0x239c]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
mov ecx, dword [0xbc27fc]
push ecx
lea edx, [ebp - 0x239c]
push edx
jmp 0x8fed4e
mov byte [ebp - 0x1084], 0
push 0x103
push 0
lea eax, [ebp - 0x1083]
push eax
call fcn.00a7ffb0
add esp, 0xc
push esi
lea edx, [ebp - 0x1084]
call fcn.008aaa40
add esp, 4
lea ecx, [ebp - 0x95c]
lea edx, [ebp - 0x239c]
cmp byte [ebp - 0x1084], 0
jne 0x8fed29
push esi
push ecx
push str.___Failed_To_Remove_from_REGMON___s_._Reason:_0x_x
jmp 0x8fed36
lea eax, [ebp - 0x1084]
push eax
push ecx
push str.___Failed_To_Remove_from_REGMON___s_._Reason:__s
push edx
call fcn.00a78f30
add esp, 0x10
push 0
mov eax, dword [0xbc27fc]
push eax
lea ecx, [ebp - 0x239c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test ebx, ebx
je 0x8fed72
push ebx
call fcn.00a78fec
add esp, 4
mov dword [ebp - 0x3f20], 0
lea edx, [ebp - 0x3f24]
push edx
lea eax, [ebp - 0x3dcc]
push eax
jmp 0x8fea6a
mov byte [ebp - 0x139c], 0
lea ecx, [ebp - 0x139b]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x104
lea esi, [ebp - 0x139c]
call fcn.00960b00
add esp, 4
mov edx, esi
push edx
push ebx
push str.Unable_to_open_HKEY_USERS_s__Reason:__s
lea eax, [ebp - 0x29bc]
push eax
call fcn.00a78f30
push edi
push 1
lea ecx, [ebp - 0x29bc]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov esi, dword [ebp - 0x3f14]
cmp dword [ebp - 0x3f28], 0
je 0x8fee0b
cmp dword [0xb45d94], 0
je 0x8ff0c6
mov ecx, esi
call fcn.008f8000
mov ecx, esi
call fcn.008f81d0
cmp dword [0xb45d94], 0
je 0x8ff0c6
test esi, esi
je 0x8ff0c6
cmp byte [esi], 0
je 0x8ff0c6
mov dword [ebp - 0x3f14], 0
mov byte [ebp - 0x1294], 0
push 0x103
push 0
lea edx, [ebp - 0x1293]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x754], 0
push 0x207
push 0
lea eax, [ebp - 0x753]
push eax
call fcn.00a7ffb0
add esp, 0xc
push esi
push str._sSoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea ecx, [ebp - 0x1294]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0x80000003
lea eax, [ebp - 0x3f14]
mov ecx, 1
lea edx, [ebp - 0x1294]
call fcn.0097f000
add esp, 4
test eax, eax
jne 0x8fef79
mov byte [ebp - 0x754], al
mov edi, 0x208
mov dword [ebp - 0x3f1c], edi
lea edx, [ebp - 0x3f1c]
push edx
lea eax, [ebp - 0x754]
push eax
push 0
push 0
push str.Desktop
mov ecx, dword [ebp - 0x3f14]
push ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
jne 0x8fef0f
cmp byte [ebp - 0x754], al
je 0x8fef0f
lea ecx, [ebp - 0x754]
call fcn.0095a450
test eax, eax
je 0x8fef0f
lea ecx, [ebp - 0x754]
mov edx, str.C:UsersAdministratorDesktop_
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8fef05
mov byte [ebp - 0x754], 0
mov dword [ebp - 0x3f1c], edi
lea edx, [ebp - 0x3f1c]
push edx
lea eax, [ebp - 0x754]
push eax
push 0
push 0
push str.Personal
mov ecx, dword [ebp - 0x3f14]
push ecx
call esi
test eax, eax
jne 0x8fef6c
cmp byte [ebp - 0x754], al
je 0x8fef6c
lea ecx, [ebp - 0x754]
call fcn.0095a450
test eax, eax
je 0x8fef6c
lea ecx, [ebp - 0x754]
mov edx, str.C:UsersAdministratorDocuments_
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8fef62
mov edx, dword [ebp - 0x3f14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [str.Administrator], 0
je 0x8ff041
push 0x5c
push str.Administrator
call fcn.00a7aa50
add esp, 8
mov esi, eax
test esi, esi
je 0x8fef9e
inc esi
jmp 0x8fefa3
mov esi, str.Administrator
cmp byte [str.C:UsersAdministratorDesktop_], 0
jne 0x8feff2
call fcn.00968d70
push esi
test eax, eax
je 0x8fefc5
movsx eax, byte [0xbd5ab0]
push eax
push str._cUsers_sDesktop
jmp 0x8fefd2
movsx ecx, byte [0xbd5ab0]
push ecx
push str._cDocuments_and_Settings_sDesktop
push str.C:UsersAdministratorDesktop_
call fcn.00a78f30
add esp, 0x10
mov ecx, str.C:UsersAdministratorDesktop_
call fcn.0095a450
test eax, eax
jne 0x8feff2
mov byte [str.C:UsersAdministratorDesktop_], al
cmp byte [str.C:UsersAdministratorDocuments_], 0
jne 0x8ff041
call fcn.00968d70
push esi
test eax, eax
je 0x8ff014
movsx edx, byte [0xbd5ab0]
push edx
push str._cUsers_sDocuments
jmp 0x8ff021
movsx eax, byte [0xbd5ab0]
push eax
push str._cDocuments_and_Settings_sMy_Documents
push str.C:UsersAdministratorDocuments_
call fcn.00a78f30
add esp, 0x10
mov ecx, str.C:UsersAdministratorDocuments_
call fcn.0095a450
test eax, eax
jne 0x8ff041
mov byte [str.C:UsersAdministratorDocuments_], al
push str.C:UsersAdministratorDesktop_
push str.CurrentUser_Desktop:___s_
lea ecx, [ebp - 0x27b4]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x27b4]
push edx
push 0xb54ce8
call fcn.008808e0
push str.C:UsersAdministratorDocuments_
push str.CurrentUser_Documents:___s_
lea eax, [ebp - 0x27b4]
push eax
call fcn.00a78f30
add esp, 0x1c
push 0
push 1
lea ecx, [ebp - 0x27b4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [str.C:UsersAdministratorDesktop_], 0
je 0x8ff0b3
mov ecx, str.C:UsersAdministratorDesktop_
call fcn.00960910
cmp byte [str.C:UsersAdministratorDocuments_], 0
je 0x8ff0c6
mov ecx, str.C:UsersAdministratorDocuments_
call fcn.00960910
cmp dword [0xbd4ab0], 1
jne 0x8ff0f5
mov eax, dword [0xbd0b2c]
test eax, eax
je 0x8ff18f
cmp byte [eax], 0
je 0x8ff18f
push 0
push eax
call fcn.009006c0
add esp, 8
jmp 0x8ff18f
cmp byte [str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefaultExtensions], 0
je 0x8ff18f
push 0
push 0
push 0x8fba20
call fcn.00a791b2
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8ff15d
mov byte [ebp - 0x3ed4], 0
push 0x103
push 0
lea edx, [ebp - 0x3ed3]
push edx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_1wCH__fails_with_error__d
lea eax, [ebp - 0x3ed4]
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x3ed4]
push ecx
jmp 0x8ff182
push str.CBD_4Chr
xor ebx, ebx
mov esi, eax
call fcn.0085df20
add esp, 4
jmp 0x8ff18f
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0xb525d0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret