Function at 0x8f43f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb158c8
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0xc9f8
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0xc9e4], ebx
mov byte [ebp - 0x140], bl
push 0x103
push ebx
lea eax, [ebp - 0x13f]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 4], ebx
call fcn.008f3f30
call fcn.008f40b0
cmp eax, ebx
je 0x8f72c1
mov edi, dword [0xbd0510]
mov dword [ebp - 0xc980], edi
cmp edi, ebx
je 0x8f72c1
cmp dword [edi], ebx
je 0x8f72c1
mov byte [ebp - 0x348], 0
push 0x207
push ebx
lea ecx, [ebp - 0x347]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x22e0], 0
push 0x207
push ebx
lea edx, [ebp - 0x22df]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x1ac8], 0
push 0x207
push ebx
lea eax, [ebp - 0x1ac7]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0xc97c], ebx
mov byte [ebp - 0x550], 0
push 0x207
push ebx
lea ecx, [ebp - 0x54f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x758], 0
push 0x207
push ebx
lea edx, [ebp - 0x757]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0xc990], ebx
mov byte [ebp - 0x17b8], 0
push 0x207
push ebx
lea eax, [ebp - 0x17b7]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x24e8], 0
push 0x207
push ebx
lea ecx, [ebp - 0x24e7]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0xc9c4], ebx
mov byte [ebp - 0xd80], 0
push 0x103
push ebx
lea edx, [ebp - 0xd7f]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0xca0c], ebx
mov byte [ebp - 0x38], 0
xor eax, eax
mov dword [ebp - 0x37], eax
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov word [ebp - 0x2b], ax
mov byte [ebp - 0x29], al
mov dword [ebp - 0xc984], ebx
mov eax, dword [edi]
cmp byte [eax], 0x3a
jne 0x8f45a0
inc eax
mov dword [ebp - 0xc99c], eax
cmp eax, ebx
je 0x8f45e1
push eax
lea ecx, [ebp - 0x22e0]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea edx, [ebp - 0x22e0]
push edx
call fcn.00977760
push 0x208
lea ebx, [ebp - 0x348]
lea esi, [ebp - 0x22e0]
call fcn.00957fa0
add esp, 4
xor ebx, ebx
push 0x5c
lea eax, [ebp - 0x348]
push eax
call fcn.00a7aa50
add esp, 8
mov esi, eax
cmp esi, ebx
je 0x8f461e
inc esi
mov dword [ebp - 0xc988], esi
mov bl, byte [esi]
mov byte [esi], 0
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x1ac8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [esi], bl
xor ebx, ebx
jmp 0x8f462c
lea eax, [ebp - 0x348]
mov dword [ebp - 0xc988], eax
mov esi, eax
mov edx, dword [edi + 0xc]
call fcn.0097cea0
mov dword [ebp - 0xc97c], eax
cmp eax, 4
jbe 0x8f465e
cmp byte [ebp - 0x550], 0
jne 0x8f465e
mov ecx, eax
push ecx
lea ecx, [ebp - 0x758]
lea ebx, [ebp - 0x550]
call fcn.0097b130
xor ebx, ebx
mov byte [ebp - 0x8978], 0
push 0xfff
push ebx
lea edx, [ebp - 0x8977]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov byte [ebp - 0x1f], al
cmp byte [ebp - 0x38], al
jne 0x8f46b1
lea eax, [ebp - 0xca0c]
push eax
lea ecx, [ebp - 0xc9c4]
push ecx
mov edx, dword [edi + 0xc]
push edx
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0xd80]
call fcn.009b8130
add esp, 0xc
cmp dword [0xb56800], ebx
je 0x8f46ef
mov dword [ebp - 0xc9cc], ebx
lea eax, [ebp - 0xc9cc]
push eax
mov ecx, dword [edi + 0xc]
push ecx
call fcn.00968090
add esp, 8
test eax, eax
je 0x8f46ef
mov edx, dword [ebp - 0xc9cc]
neg edx
sbb edx, edx
and edx, 0x20300
add edx, 0x323378
mov dword [ebp - 0x28], edx
mov eax, dword [edi + 0xc]
lea ecx, [ebp - 0xd80]
mov edx, dword [ebp - 0xc9c4]
push ecx
push edx
lea ecx, [ebp - 0x38]
mov edx, dword [ebp - 0xc97c]
push ecx
push edx
lea ecx, [ebp - 0x348]
push eax
push ecx
cmp byte [ebp - 0x28], 0
jne 0x8f4730
push eax
push str._CPL______d__Existing_Process___s:_u__ppid:_u____s:_d___s_
lea edx, [ebp - 0x8978]
push edx
call fcn.00a78f30
add esp, 0x24
jmp 0x8f4749
lea edx, [ebp - 0x28]
push edx
push eax
push str._CPL______d__Existing_Process__s___s:_u__ppid:_u____s:_d___s_
lea eax, [ebp - 0x8978]
push eax
call fcn.00a78f30
add esp, 0x28
push ebx
push 1
lea ecx, [ebp - 0x8978]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp esi, ebx
je 0x8f72af
cmp byte [esi], 0
je 0x8f489a
mov eax, str.SHAREit.Service.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f47a5
mov eax, str.SHAREit.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f47a5
mov eax, str.SHAREit.Updater.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f489a
mov dword [ebp - 0xc9dc], ebx
mov dword [ebp - 0xc9f4], ebx
mov eax, 1
mov dword [ebp - 0xca00], eax
mov dword [ebp - 0xc9ec], eax
lea edx, [ebp - 0xc9dc]
push edx
push str.BlockFileTxferOverIM
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
lea eax, [ebp - 0xc9f4]
push eax
push str.BlockFileTxferOverIMBk
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
lea ecx, [ebp - 0xca00]
push ecx
push str.AttachmentsAllowed
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
lea edx, [ebp - 0xc9ec]
push edx
push str.AttachmentsAllowedBk
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0xca00], ebx
je 0x8f484e
cmp dword [ebp - 0xc9dc], ebx
jne 0x8f484e
cmp dword [ebp - 0xc9ec], ebx
je 0x8f484e
cmp dword [ebp - 0xc9f4], ebx
je 0x8f489a
mov eax, dword [edi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str._INJ__Terminating_App____s:_u
lea edx, [ebp - 0x960]
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0x960]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
push ebx
mov edi, dword [edi + 0xc]
call fcn.0097a830
mov dword [ebp - 0xc984], 1
mov edi, dword [ebp - 0xc980]
cmp esi, ebx
je 0x8f72af
cmp byte [esi], 0
je 0x8f72af
mov ecx, esi
call fcn.0094c3d0
cmp eax, 0x207
jae 0x8f72af
mov byte [ebp - 0x1298], 0
push 0x40f
push 0
lea ecx, [ebp - 0x1297]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x18c0], 0
push 0x103
push 0
lea edx, [ebp - 0x18bf]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0xc9d0], 0
push esi
lea eax, [ebp - 0x3518]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [edi + 0xc], 4
jbe 0x8f49a6
mov byte [ebp - 0x960], 0
push 0x207
push 0
lea ecx, [ebp - 0x95f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push 0x7e
lea edx, [ebp - 0x348]
push edx
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8f496c
push 0x208
lea ebx, [ebp - 0x960]
lea esi, [ebp - 0x348]
call fcn.00957fa0
add esp, 4
mov esi, dword [ebp - 0xc988]
jmp 0x8f4982
lea ecx, [ebp - 0x348]
lea edx, [ebp - 0x960]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x8f4978
push 1
push 0
push 0
lea eax, [ebp - 0x18c0]
push eax
lea ecx, [ebp - 0x960]
push ecx
mov edx, dword [edi + 0xc]
push edx
xor edx, edx
xor ecx, ecx
call fcn.009ba450
add esp, 0x18
push 0x2e
lea eax, [ebp - 0x3518]
push eax
call fcn.00a7aa50
add esp, 8
mov ebx, eax
cmp dword [edi + 0xc], 0
jbe 0x8f72af
mov dword [ebp - 0xc9ac], 0
mov eax, str.dsNcService.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f49fd
mov eax, str.PulseSetupClient.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f49fd
mov eax, str.dsNetworkConnect.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f4a16
cmp dword [0xbd17ac], 0
je 0x8f4a16
mov esi, 2
call fcn.008abf40
mov esi, dword [ebp - 0xc988]
test ebx, ebx
je 0x8f4a43
mov eax, 0xad8680
mov ecx, ebx
call fcn.0094c330
test eax, eax
jne 0x8f4a43
lea ecx, [ebp - 0x348]
call fcn.008aed80
test eax, eax
je 0x8f4a43
mov dword [ebp - 0xc9ac], 1
push 0
xor esi, esi
lea ecx, [ebp - 0x348]
call fcn.008bb630
add esp, 4
test eax, eax
jne 0x8f4b76
push eax
mov ecx, dword [ebp - 0xc988]
call fcn.008bb630
add esp, 4
lea ebx, [esi + 1]
test eax, eax
jne 0x8f4b7b
cmp dword [0xb8db2c], ebx
jne 0x8f4a97
mov eax, str.InetInfo.exe
mov ecx, dword [ebp - 0xc988]
call fcn.0094c330
test eax, eax
je 0x8f4b7b
cmp dword [ebp - 0xc9ac], ebx
jne 0x8f4c49
mov eax, str.SBDDesktop.exe
mov ecx, dword [ebp - 0xc988]
call fcn.0094c330
test eax, eax
je 0x8f4c1e
lea edi, [ebp - 0x348]
mov esi, dword [ebp - 0xc988]
call fcn.008ccba0
test eax, eax
jne 0x8f4c18
mov eax, str.wget.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f4afe
push eax
push str.wgwin_
mov ecx, edi
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f4c18
cmp dword [0xb8db2c], 1
jne 0x8f4b1b
mov eax, str.InetInfo.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f4c18
mov esi, dword [ebp - 0xc980]
mov edx, dword [esi + 0xc]
push 0
push edx
push 0
push 0x2000700
call dword [0xb8dac4]
add esp, 0x10
mov edi, eax
test edi, edi
jl 0x8f4b86
mov eax, dword [esi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str.___Process___s:_d__Registered_For_FSBP__4_
lea edx, [ebp - 0x1298]
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x1298]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8f6780
mov ebx, 1
mov dword [ebp - 0xc9ac], ebx
jmp 0x8f4aa3
mov byte [ebp - 0xc78], 0
push 0x103
push 0
lea ecx, [ebp - 0xc77]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push edi
lea edx, [ebp - 0xc78]
call fcn.008aaa40
add esp, 4
cmp byte [ebp - 0xc78], 0
jne 0x8f4bd5
push edi
mov edx, dword [esi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str.___Process___s:_d__Registration_For_FSBP_Failed__4___Error_Returned:_0x_x
lea ecx, [ebp - 0x1298]
push ecx
jmp 0x8f4bf3
lea edx, [ebp - 0xc78]
push edx
mov eax, dword [esi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str.___Process___s:_d__Registration_For_FSBP_Failed__4___Error_Returned:__s
lea edx, [ebp - 0x1298]
push edx
call fcn.00a78f30
add esp, 0x14
push 0
push 1
lea eax, [ebp - 0x1298]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8f6780
mov edi, dword [ebp - 0xc980]
push 0
push 5
mov esi, dword [edi + 0xc]
lea ebx, [ebp - 0x348]
call fcn.008cab40
push 0
push 1
push 0
push 0x2000fa1
call dword [0xb8dac4]
add esp, 0x18
jmp 0x8f6786
mov eax, str.svchost.exe
mov esi, dword [ebp - 0xc988]
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f4e26
push 0x8000
call fcn.00a7a155
add esp, 4
mov ebx, eax
mov dword [ebp - 0xc98c], ebx
test ebx, ebx
je 0x8f6786
mov byte [ebx], 0
mov ecx, dword [edi + 0xc]
push ecx
mov ecx, ebx
call fcn.0097b4b0
cmp byte [ebx], 0
je 0x8f4ce9
push 0
push str.LocalSystemNetworkRestricted
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f4cbd
push 0
push str.netsvcs
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f4ce9
push 0
push 7
mov esi, dword [edi + 0xc]
lea ebx, [ebp - 0x348]
call fcn.008cab40
push 0
push 1
push 0
push 0x2000fa1
call dword [0xb8dac4]
add esp, 0x18
mov ebx, dword [ebp - 0xc98c]
push ebx
call fcn.00a78fec
add esp, 4
cmp dword [0xb3deb0], 0
je 0x8f6786
mov esi, dword [ebp - 0xc97c]
test esi, esi
jne 0x8f4d19
mov edx, dword [edi + 0xc]
call fcn.0097cea0
mov dword [ebp - 0xc97c], eax
mov esi, eax
cmp esi, 4
jbe 0x8f4d39
cmp byte [ebp - 0x550], 0
jne 0x8f4d39
push esi
lea ecx, [ebp - 0x758]
lea ebx, [ebp - 0x550]
call fcn.0097b130
lea eax, [ebp - 0x758]
lea edi, [ebp - 0x550]
call fcn.008cdd50
test eax, eax
jne 0x8f6780
mov byte [ebp - 0x28e8], al
push 0x3ff
push eax
lea edx, [ebp - 0x28e7]
push edx
call fcn.00a7ffb0
add esp, 0xc
cmp byte [ebp - 0x550], 0
je 0x8f4dac
push esi
lea eax, [ebp - 0x758]
push eax
mov ecx, dword [ebp - 0xc980]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0xc988]
push eax
push str._CPL__MEM__TERM__Process___s:_u__run_by_Parent___s:_u_._Blocking_current_process_
push 0xffffffffffffffff
push 0x400
lea ecx, [ebp - 0x28e8]
push ecx
call fcn.00a78fcb
add esp, 0x20
jmp 0x8f4dd8
mov edx, dword [ebp - 0xc980]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0xc988]
push ecx
push str._CPL__MEM__TERM__Process___s:_u__run_by_Parent__NON_EXISTENT_._Blocking_current_process_
push 0xffffffffffffffff
push 0x400
lea edx, [ebp - 0x28e8]
push edx
call fcn.00a78fcb
add esp, 0x18
push 0
push 1
lea eax, [ebp - 0x28e8]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xc984], 1
mov ecx, 6
mov esi, str._ST__SVCHost_EXE_Blocked
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x140]
mov ecx, dword [ebp - 0xc980]
mov esi, dword [ecx + 0xc]
call fcn.008c4130
jmp 0x8f6780
cmp dword [0xb3dea4], 0
je 0x8f4eb6
lea edx, [ebp - 0x348]
push edx
mov ecx, esi
call fcn.00a65ff0
add esp, 4
test eax, eax
je 0x8f4eb6
mov eax, dword [edi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str._CPL__MEM__TERM__Force_Terminating_ProgramData_Users_EXE:__s:_u
push 0xffffffffffffffff
push 0x208
lea edx, [ebp - 0x4968]
push edx
call fcn.00a78fcb
push 0
push ebx
lea eax, [ebp - 0x4968]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], ebx
mov ecx, 8
mov esi, str._ST__ProgramData_Users_EXE_Blocked
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x140]
mov ecx, dword [ebp - 0xc980]
mov esi, dword [ecx + 0xc]
call fcn.008c4130
jmp 0x8f6780
cmp dword [0xb3dea0], 0
je 0x8f4f91
push 0
push str.IObit_Uninstaller
lea edx, [ebp - 0x348]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f4f91
mov eax, str.unins000.exe
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8f4f91
mov eax, dword [edi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str._CPL__MEM__TERM__Force_Terminating_Uninstaller:__s:_u
push 0xffffffffffffffff
push 0x208
lea edx, [ebp - 0x3928]
push edx
call fcn.00a78fcb
push 0
push ebx
lea eax, [ebp - 0x3928]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], ebx
mov ecx, dword [str._ST__IOBit_Blocked]
mov dword [ebp - 0x140], ecx
mov edx, dword [0xad88f0]
mov dword [ebp - 0x13c], edx
mov eax, dword [0xad88f4]
mov dword [ebp - 0x138], eax
mov ecx, dword [0xad88f8]
mov dword [ebp - 0x134], ecx
mov dx, word [0xad88fc]
mov word [ebp - 0x130], dx
mov al, byte [0xad88fe]
mov byte [ebp - 0x12e], al
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
jmp 0x8f6786
cmp dword [0xb3de80], 0
je 0x8f5064
test byte [0xbd4aa4], 4
je 0x8f5064
mov eax, str.rdpclip.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f5064
mov dword [ebp - 0xc9b8], ebx
lea ecx, [ebp - 0xc9b8]
push ecx
push str.CopyPasteDisabledBlockRDPC
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8f5003
mov eax, dword [ebp - 0xc9b8]
mov esi, str.CopyPasteDisabledBlockRDPC
mov ebx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov ecx, 0x80000002
call fcn.0094be90
mov ebx, 1
cmp dword [ebp - 0xc9b8], ebx
jne 0x8f6786
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM__Force_Terminating_RDPClip_Process:__s:_u
push 0xffffffffffffffff
push 0x208
lea ecx, [ebp - 0x5178]
push ecx
call fcn.00a78fcb
push 0
push ebx
lea edx, [ebp - 0x5178]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
xor eax, eax
mov esi, dword [edi + 0xc]
call fcn.008c4130
mov dword [ebp - 0xc984], ebx
mov dword [0xbd1adc], ebx
jmp 0x8f6786
cmp dword [0xb3de28], 0
je 0x8f5076
cmp dword [0xbd4a90], 0
je 0x8f509e
mov eax, str.fsquirt.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f6723
mov eax, str.obexsrv.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f6723
xor ebx, ebx
cmp dword [0xb3dea0], ebx
je 0x8f51f3
cmp byte [ebp - 0x1ac8], bl
je 0x8f51f3
mov edi, str.TuRes.dll
lea ecx, [ebp - 0x1ac8]
call fcn.00959ba0
test eax, eax
jne 0x8f51ed
mov eax, str.unins000.exe
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8f51ed
mov dword [ebp - 0xc9b0], ebx
lea ecx, [ebp - 0xc9b0]
lea edx, [ebp - 0x348]
call fcn.00978190
mov edi, dword [ebp - 0xc9b0]
cmp edi, ebx
je 0x8f6780
cmp byte [edi], bl
je 0x8f5193
mov ecx, str.GAVRILA
mov edx, edi
call fcn.0095ce20
cmp eax, 0xffffffff
je 0x8f5193
mov ebx, dword [ebp - 0xc980]
mov eax, dword [ebx + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str._CPL__MEM__TERM__Force_Terminating_Uninstaller:__s:_u
push 0xffffffffffffffff
push 0x208
lea edx, [ebp - 0x960]
push edx
call fcn.00a78fcb
push 0
push 1
lea eax, [ebp - 0x960]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov ecx, 7
mov esi, str._ST__TotalUninstall_Blocked
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x140]
mov esi, dword [ebx + 0xc]
call fcn.008c4130
mov edi, dword [ebp - 0xc9b0]
push edi
call fcn.00a78fec
add esp, 4
push 0
mov ecx, str.Tu.
lea ebx, [ebp - 0x1ac8]
call fcn.0095eb80
add esp, 4
cmp dword [ebp - 0xc97c], 0
jne 0x8f51ce
mov ecx, dword [ebp - 0xc980]
mov edx, dword [ecx + 0xc]
call fcn.0097cea0
mov dword [ebp - 0xc97c], eax
cmp dword [ebp - 0xc97c], 4
jbe 0x8f6780
push 0
mov edi, dword [ebp - 0xc97c]
call fcn.0097a830
jmp 0x8f6780
mov edi, dword [ebp - 0xc980]
cmp dword [0xb3dc70], ebx
je 0x8f52bd
push ebx
push str.IObit
lea edx, [ebp - 0x348]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f52bd
mov eax, dword [edi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str._CPL__MEM__TERM__Force_Terminating_IOBit_Process:__s:_u
push 0xffffffffffffffff
push 0x208
lea edx, [ebp - 0x3d38]
push edx
call fcn.00a78fcb
push 0
push 1
lea eax, [ebp - 0x3d38]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov ecx, dword [str._ST__IOBit_Blocked_A_]
mov dword [ebp - 0x140], ecx
mov edx, dword [0xad8a0c]
mov dword [ebp - 0x13c], edx
mov eax, dword [0xad8a10]
mov dword [ebp - 0x138], eax
mov ecx, dword [0xad8a14]
mov dword [ebp - 0x134], ecx
mov edx, dword [0xad8a18]
mov dword [ebp - 0x130], edx
mov ax, word [0xad8a1c]
mov word [ebp - 0x12c], ax
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
jmp 0x8f6786
cmp dword [0xb3d5bc], ebx
je 0x8f5353
push ebx
push str.advanced_port_scanner
lea ecx, [ebp - 0x348]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f5353
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM__Force_Terminating_PortScanner_Process:__s:_u
push 0xffffffffffffffff
push 0x208
lea ecx, [ebp - 0x4f70]
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x4f70]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov ecx, 7
mov esi, str._ST__PortScanner_Blocked_A_
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x140]
mov ecx, dword [ebp - 0xc980]
mov esi, dword [ecx + 0xc]
call fcn.008c4130
jmp 0x8f6780
cmp dword [0xb3dc74], ebx
je 0x8f544f
push ebx
push str.hrsword
lea edx, [ebp - 0x348]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f53b1
push ebx
push str.usysdiag
lea eax, [ebp - 0x348]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f53b1
push ebx
push str.sysdiag_gui
lea ecx, [ebp - 0x348]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f544f
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM__Force_Terminating_HRSWord_Process:__s:_u
push 0xffffffffffffffff
push 0x208
lea ecx, [ebp - 0x4148]
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x4148]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov eax, dword [str._ST__HRSWord_Blocked_A_]
mov dword [ebp - 0x140], eax
mov ecx, dword [0xad8abc]
mov dword [ebp - 0x13c], ecx
mov edx, dword [0xad8ac0]
mov dword [ebp - 0x138], edx
mov eax, dword [0xad8ac4]
mov dword [ebp - 0x134], eax
mov ecx, dword [0xad8ac8]
mov dword [ebp - 0x130], ecx
mov edx, dword [0xad8acc]
mov dword [ebp - 0x12c], edx
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
jmp 0x8f6786
cmp dword [0xb3dc78], ebx
je 0x8f54f9
push ebx
push str.ilockmsg.exe
lea eax, [ebp - 0x348]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f54f9
push ebx
push ebx
lea edx, [ebp - 0xc9d0]
lea ecx, [ebp - 0x348]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8f54f9
cmp dword [ebp - 0xc9d0], 0x14000
jae 0x8f54f9
mov ecx, dword [edi + 0xc]
push ecx
lea edx, [ebp - 0x348]
push edx
push str._CPL__MEM__TERM__Force_Terminating_ILockMsg_Process:__s:_u
push 0xffffffffffffffff
push 0x208
lea eax, [ebp - 0x4558]
push eax
call fcn.00a78fcb
push 0
push 1
lea ecx, [ebp - 0x4558]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
xor eax, eax
mov esi, dword [edi + 0xc]
call fcn.008c4130
mov dword [ebp - 0xc984], 1
mov byte [ebp - 0x140], bl
jmp 0x8f6786
cmp dword [0xb3dea0], ebx
je 0x8f5771
push ebx
push str.WiseProgram
lea edx, [ebp - 0x348]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f553d
push ebx
push str.WiseDelete
lea eax, [ebp - 0x348]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f55d1
mov ecx, dword [edi + 0xc]
push ecx
lea edx, [ebp - 0x348]
push edx
push str._CPL__MEM__TERM__Force_Terminating_WiseProgram_Uninstaller_Process:__s:_u
push 0xffffffffffffffff
push 0x208
lea eax, [ebp - 0x2af0]
push eax
call fcn.00a78fcb
push 0
push 1
lea ecx, [ebp - 0x2af0]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov edx, dword [str._ST__Wise_Blocked]
mov dword [ebp - 0x140], edx
mov eax, dword [0xad8b60]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0xad8b64]
mov dword [ebp - 0x138], ecx
mov edx, dword [0xad8b68]
mov dword [ebp - 0x134], edx
mov ax, word [0xad8b6c]
mov word [ebp - 0x130], ax
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
jmp 0x8f6786
cmp dword [0xb3dea0], ebx
je 0x8f5771
push ebx
push str.Revo_Uninstaller
lea ecx, [ebp - 0x348]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f56a3
mov eax, str.uninst.exe
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8f56a3
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM__Force_Terminating_Uninstaller:__s:_u
push 0xffffffffffffffff
push 0x208
lea ecx, [ebp - 0x4760]
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x4760]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov eax, dword [str._ST__Revo_Blocked]
mov dword [ebp - 0x140], eax
mov ecx, dword [0xad8b74]
mov dword [ebp - 0x13c], ecx
mov edx, dword [0xad8b78]
mov dword [ebp - 0x138], edx
mov eax, dword [0xad8b7c]
mov dword [ebp - 0x134], eax
mov cx, word [0xad8b80]
mov word [ebp - 0x130], cx
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
jmp 0x8f6786
cmp dword [0xb3dea0], ebx
je 0x8f5771
mov eax, str.RevoUn.exe
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8f56d3
mov eax, str.RevoUPort.exe
mov ecx, esi
call fcn.0094c3e0
test eax, eax
jne 0x8f5771
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM__Force_Terminating_Uninstaller:__s:_u
push 0xffffffffffffffff
push 0x208
lea ecx, [ebp - 0x3108]
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x3108]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov eax, dword [str._ST__Revo_Blocked_B_]
mov dword [ebp - 0x140], eax
mov ecx, dword [0xad8b88]
mov dword [ebp - 0x13c], ecx
mov edx, dword [0xad8b8c]
mov dword [ebp - 0x138], edx
mov eax, dword [0xad8b90]
mov dword [ebp - 0x134], eax
mov ecx, dword [0xad8b94]
mov dword [ebp - 0x130], ecx
mov dl, byte [0xad8b98]
mov byte [ebp - 0x12c], dl
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
jmp 0x8f6786
cmp dword [0xbd4aa0], ebx
je 0x8f5824
mov eax, str.adb.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f5824
mov eax, dword [edi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str._CPL__MEM__TERM__Force_Terminating_ADB:__s:_u
push 0xffffffffffffffff
push 0x208
lea edx, [ebp - 0x3310]
push edx
call fcn.00a78fcb
push 0
push 1
lea eax, [ebp - 0x3310]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov ecx, dword [str._ST__ADB_Blocked]
mov dword [ebp - 0x140], ecx
mov edx, dword [0xad8bd0]
mov dword [ebp - 0x13c], edx
mov eax, dword [0xad8bd4]
mov dword [ebp - 0x138], eax
mov ecx, dword [0xad8bd8]
mov dword [ebp - 0x134], ecx
mov dl, byte [0xad8bdc]
mov byte [ebp - 0x130], dl
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
jmp 0x8f6786
mov eax, str.msconfig.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f5925
mov dword [ebp - 0xc9b4], ebx
lea eax, [ebp - 0xc9b4]
push eax
push str.BlockMSConfig
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
movzx eax, al
cmp dword [0xbd4a90], ebx
je 0x8f5870
mov dword [ebp - 0xc9b4], 1
jmp 0x8f5879
cmp eax, 1
jne 0x8f6786
cmp dword [ebp - 0xc9b4], ebx
je 0x8f6786
mov ecx, dword [edi + 0xc]
push ecx
lea edx, [ebp - 0x348]
push edx
push str._CPL__MEM__TERM__Force_Terminating_MSConfig:__s:_u
push 0xffffffffffffffff
push 0x208
lea eax, [ebp - 0x2cf8]
push eax
call fcn.00a78fcb
push 0
push 1
lea ecx, [ebp - 0x2cf8]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov edx, dword [str._ST__MSConfig_Blocked]
mov dword [ebp - 0x140], edx
mov eax, dword [0xad8c18]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0xad8c1c]
mov dword [ebp - 0x138], ecx
mov edx, dword [0xad8c20]
mov dword [ebp - 0x134], edx
mov eax, dword [0xad8c24]
mov dword [ebp - 0x130], eax
mov cx, word [0xad8c28]
mov word [ebp - 0x12c], cx
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
jmp 0x8f6786
mov eax, str.rundll32.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f5abe
push 0x8000
call fcn.00a7a155
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x8f6786
mov byte [ebx], 0
mov edx, dword [edi + 0xc]
push edx
mov ecx, ebx
call fcn.0097b4b0
mov esi, eax
mov ecx, ebx
call fcn.0094c3d0
mov dword [ebp - 0xc98c], eax
cmp eax, 0x800
jae 0x8f59b1
push ebx
push esi
mov eax, dword [edi + 0xc]
push eax
mov ecx, dword [ebp - 0xc988]
push ecx
push str._CPL__MEM___s:_u_found_started_with_Res:_u__CmdLine_Process___s_
push 0xffffffffffffffff
push 0x1000
lea edx, [ebp - 0x7178]
push edx
call fcn.00a78fcb
push 0
push 1
lea eax, [ebp - 0x7178]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
cmp byte [ebx], 0
je 0x8f5ab0
cmp dword [ebp - 0xc98c], 0x800
jae 0x8f5ab0
mov byte [ebp - 0x7178], 0
push 6
push 0x1000
lea ecx, [ebp - 0x7178]
push ecx
push 1
mov esi, ebx
call fcn.00a66bf0
add esp, 0x10
push ebx
test eax, eax
je 0x8f5a6d
push str._CPL__MEM__TERM__CmdLine_Process___s_
push 0xffffffffffffffff
push 0x1000
lea edx, [ebp - 0x7178]
push edx
call fcn.00a78fcb
add esp, 0x14
mov dword [ebp - 0xc984], 1
mov eax, dword [str._ST__RunDLL32_Blocked]
mov dword [ebp - 0x140], eax
mov ecx, dword [0xad8ca0]
mov dword [ebp - 0x13c], ecx
mov edx, dword [0xad8ca4]
mov dword [ebp - 0x138], edx
mov eax, dword [0xad8ca8]
mov dword [ebp - 0x134], eax
mov ecx, dword [0xad8cac]
mov dword [ebp - 0x130], ecx
mov dx, word [0xad8cb0]
mov word [ebp - 0x12c], dx
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
jmp 0x8f5a88
push str._CPL__MEM__RunDLL32:_Approved_CmdLine_Process___s_
push 0xffffffffffffffff
push 0x1000
lea eax, [ebp - 0x7178]
push eax
call fcn.00a78fcb
add esp, 0x14
cmp byte [ebp - 0x7178], 0
je 0x8f5ab0
lea esi, [ebp - 0x7178]
call fcn.009b7360
push 0
push 1
mov ecx, esi
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push ebx
call fcn.00a78fec
add esp, 4
jmp 0x8f6786
cmp dword [0xbd0530], ebx
je 0x8f5bd9
mov eax, str.control.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f5afe
mov eax, str.SystemSettings.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f5afe
mov eax, str.SystemSettingsAdminFlows.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f5bd9
push 0x8000
call fcn.00a7a155
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x8f6786
mov byte [ebx], 0
mov edx, dword [edi + 0xc]
push edx
mov ecx, ebx
call fcn.0097b4b0
cmp byte [ebx], 0
je 0x8f5bcb
push 0
push str.appwiz.cpl
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f5bcb
push ebx
push str._CPL__MEM__TERM__CmdLine_Process___s_
push 0xffffffffffffffff
push 0x1000
lea eax, [ebp - 0xb978]
push eax
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0xb978]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xc984], 1
mov edx, dword [str._ST__AppWiz_Blocked]
mov dword [ebp - 0x140], edx
mov eax, dword [0xad8cec]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0xad8cf0]
mov dword [ebp - 0x138], ecx
mov edx, dword [0xad8cf4]
mov dword [ebp - 0x134], edx
mov eax, dword [0xad8cf8]
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
push ebx
call fcn.00a78fec
add esp, 4
jmp 0x8f6786
cmp dword [0xb3de9c], ebx
jbe 0x8f5ddf
mov eax, str.ntvdm.exe
mov ecx, esi
call fcn.0094c3e0
test eax, eax
jne 0x8f5ddf
mov esi, dword [ebp - 0xc97c]
cmp dword [0xb3de9c], 2
jne 0x8f5cfc
mov ecx, dword [str._ST__NTVDM_Blocked]
mov dword [ebp - 0x140], ecx
mov edx, dword [0xad8d00]
mov dword [ebp - 0x13c], edx
mov eax, dword [0xad8d04]
mov dword [ebp - 0x138], eax
mov ecx, dword [0xad8d08]
mov dword [ebp - 0x134], ecx
mov dx, word [0xad8d0c]
mov word [ebp - 0x130], dx
mov al, byte [0xad8d0e]
mov byte [ebp - 0x12e], al
push esi
lea ecx, [ebp - 0x758]
push ecx
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM__Force_Terminating_NTVDM:__s:_u__Parent:__s:_u
push 0xffffffffffffffff
push 0x208
lea ecx, [ebp - 0x3720]
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x3720]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
mov dword [ebp - 0xc984], 1
mov eax, dword [str._ST__NTVDM_Blocked_C_]
mov dword [ebp - 0x140], eax
mov ecx, dword [0xad8da8]
mov dword [ebp - 0x13c], ecx
mov edx, dword [0xad8dac]
mov dword [ebp - 0x138], edx
mov eax, dword [0xad8db0]
mov dword [ebp - 0x134], eax
mov ecx, dword [0xad8db4]
mov dword [ebp - 0x130], ecx
mov dx, word [0xad8db8]
mov word [ebp - 0x12c], dx
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
jmp 0x8f6786
test esi, esi
jne 0x8f5d10
mov edx, dword [edi + 0xc]
call fcn.0097cea0
mov dword [ebp - 0xc97c], eax
mov esi, eax
cmp esi, 4
jbe 0x8f5d2f
cmp byte [ebp - 0x550], bl
jne 0x8f5d2f
push esi
lea ecx, [ebp - 0x758]
lea ebx, [ebp - 0x550]
call fcn.0097b130
push 0
push str.lsass
lea ecx, [ebp - 0x550]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f5d97
mov edx, dword [str._ST__NTVDM_Blocked_B_]
mov dword [ebp - 0x140], edx
mov eax, dword [0xad8d14]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0xad8d18]
mov dword [ebp - 0x138], ecx
mov edx, dword [0xad8d1c]
mov dword [ebp - 0x134], edx
mov eax, dword [0xad8d20]
mov dword [ebp - 0x130], eax
mov cx, word [0xad8d24]
mov word [ebp - 0x12c], cx
jmp 0x8f5c54
push esi
lea edx, [ebp - 0x758]
push edx
mov eax, dword [edi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str._CPL__MEM__NOT_Terminating_NTVDM:__s:_u_as_Parent_is__s:_u
push 0xffffffffffffffff
push 0x208
lea edx, [ebp - 0x2f00]
push edx
call fcn.00a78fcb
push 0
push 1
lea eax, [ebp - 0x2f00]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
jmp 0x8f6786
mov eax, str.MsMpEng.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f5e84
call fcn.00968d70
test eax, eax
je 0x8f5e84
mov eax, dword [edi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str._CPL__MEM___s:_d_Found_Running__Re_registering_our_process_with_WSC...
push 0xffffffffffffffff
push 0x208
lea edx, [ebp - 0x3b30]
push edx
call fcn.00a78fcb
push 0
push 1
lea eax, [ebp - 0x3b30]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov esi, str.AVRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0095f910
mov esi, str.ASRegisteredWithWsc
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0095f910
mov esi, 4
call fcn.0086cbc0
push 0x226
call dword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call 0x9cd630
jmp 0x8f6786
mov eax, 0xacb1bc
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f60af
mov eax, str.powershell_ise.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f60af
mov eax, 0xacb1cc
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f60af
mov eax, str.mshta.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f60af
mov eax, 0xacaea4
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8f60af
mov eax, str.msiexec.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8f6098
push 0x8000
call fcn.00a7a155
add esp, 4
mov ebx, eax
mov dword [ebp - 0xc98c], ebx
test ebx, ebx
je 0x8f6786
mov byte [ebx], 0
mov ecx, dword [edi + 0xc]
push ecx
mov ecx, ebx
call fcn.0097b4b0
test eax, eax
je 0x8f600c
cmp byte [ebx], 0
je 0x8f600c
push 0x20
push ebx
call fcn.00a7a2c0
add esp, 8
test eax, eax
jne 0x8f5f9b
mov edx, dword [ebp - 0xc988]
push edx
push str._CPL__MEM___s_started_without_CmdLine_Param._Will_check_for_Miner_Activity...
push 0xffffffffffffffff
push 0x1000
lea eax, [ebp - 0xa978]
push eax
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0xa978]
push ecx
push 0xb54ce8
call fcn.008808e0
mov edx, dword [edi + 0xc]
push edx
push 0
push 0x8edc40
call fcn.00a791b2
add esp, 0x1c
push str.CBD_7mPP_Mem
jmp 0x8f6078
push 0x7fe
push ebx
lea eax, [ebp - 0x7978]
push eax
call fcn.00a7a620
add esp, 0xc
cmp byte [ebp - 0x717b], 0
je 0x8f5fc0
mov byte [ebp - 0x717a], 0
lea ecx, [ebp - 0x7978]
push ecx
mov edx, dword [ebp - 0xc988]
push edx
push str._CPL__MEM___s_started_with_CmdLine_Process___s_
push 0xffffffffffffffff
push 0x1000
lea eax, [ebp - 0xa978]
push eax
call fcn.00a78fcb
push 0
push 1
lea ecx, [ebp - 0xa978]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
push ebx
call fcn.00a78fec
add esp, 4
jmp 0x8f6786
mov byte [ebp - 0x4d68], 0
push 0x3ff
push 0
lea edx, [ebp - 0x4d67]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov eax, dword [ebp - 0xc988]
push eax
push str._CPL__MEM__GCMDFAIL____s_started_possibly_without_CmdLine_Param._Will_check_for_Miner_Activity...
push 0xffffffffffffffff
push 0x400
lea ecx, [ebp - 0x4d68]
push ecx
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x4d68]
push edx
push 0xb54ce8
call fcn.008808e0
mov eax, dword [edi + 0xc]
push eax
push 0
push 0x8edc40
call fcn.00a791b2
add esp, 0x1c
push str.CBD_7mPP_Mem1
xor ebx, ebx
mov esi, eax
call fcn.0085df20
mov ebx, dword [ebp - 0xc98c]
add esp, 4
push ebx
call fcn.00a78fec
add esp, 4
jmp 0x8f6786
mov ecx, dword [edi + 0xc]
push ecx
lea ecx, [ebp - 0x348]
call fcn.008cc040
add esp, 4
jmp 0x8f6786
push 0x8000
call fcn.00a7a155
add esp, 4
mov ebx, eax
mov dword [ebp - 0xc994], ebx
test ebx, ebx
je 0x8f6786
mov byte [ebx], 0
mov edx, dword [edi + 0xc]
push edx
mov ecx, ebx
call fcn.0097b4b0
mov dword [ebp - 0xc9bc], eax
mov ecx, ebx
call fcn.0094c3d0
mov dword [ebp - 0xc98c], eax
xor esi, esi
mov dword [ebp - 0xc9f0], esi
mov dword [ebp - 0xc9c8], esi
xor eax, eax
mov dword [ebp - 0xc9d8], eax
mov dword [ebp - 0xc998], eax
mov dword [ebp - 0xc9a4], eax
mov dword [ebp - 0xc9a0], eax
mov dword [ebp - 0xc9f8], eax
mov eax, 0xacb1bc
mov ecx, dword [ebp - 0xc988]
call fcn.0094c330
test eax, eax
je 0x8f615c
mov eax, str.powershell_ise.exe
mov ecx, dword [ebp - 0xc988]
call fcn.0094c330
test eax, eax
je 0x8f615c
cmp byte [ebx], 0
je 0x8f6166
push esi
push str.powershell
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f6166
mov dword [ebp - 0xc9a4], 1
cmp dword [0xbd4a88], 0
je 0x8f6182
cmp dword [ebp - 0xc9a4], 0
je 0x8f6182
mov dword [ebp - 0xc9f0], 1
cmp byte [ebx], 0
je 0x8f62ec
cmp dword [0xbc27fc], 0
je 0x8f61da
mov ecx, ebx
call fcn.0094c3d0
add eax, 0x104
push eax
call fcn.00a7a155
add esp, 4
mov esi, eax
test esi, esi
je 0x8f61da
push ebx
push str._CHK_PSF__B__CmdLine_Process___s_
push esi
call fcn.00a78f30
add esp, 0xc
push 0
mov eax, dword [0xbc27fc]
push eax
push esi
push 0xb54ce8
call fcn.008808e0
push esi
call fcn.00a78fec
add esp, 0x14
lea ecx, [ebp - 0xc9d8]
push ecx
mov eax, ebx
call fcn.00a68d00
add esp, 4
mov esi, eax
mov dword [ebp - 0xc9c8], esi
test esi, esi
jne 0x8f6225
cmp dword [ebp - 0xc9a4], eax
je 0x8f6225
cmp dword [0xbd4a8c], eax
jne 0x8f6225
push eax
push str.SCM_Event
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f6225
mov dword [ebp - 0xc998], 1
cmp dword [0xbc27fc], 0
je 0x8f62ec
mov byte [ebp - 0x15b0], 0
push 0x103
push 0
lea edx, [ebp - 0x15af]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov eax, dword [ebp - 0xc9d8]
push eax
mov ecx, dword [ebp - 0xc998]
push ecx
push esi
push str._CHK_PSF__Result:_u__PSInf_Scm:_u__FP:_u
lea edx, [ebp - 0x15b0]
push edx
call fcn.00a78f30
add esp, 0x14
push 0
mov eax, dword [0xbc27fc]
push eax
lea ecx, [ebp - 0x15b0]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xbc27fc], 0
je 0x8f62ec
mov byte [ebp - 0x13a0], 0
push 0x103
push 0
lea edx, [ebp - 0x139f]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov eax, dword [ebp - 0xc998]
push eax
push esi
push str._PSInf_B____u__PSInf_Scm___u
push 0xffffffffffffffff
push 0x104
lea ecx, [ebp - 0x13a0]
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x13a0]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
test esi, esi
jne 0x8f650a
cmp dword [ebp - 0xc998], esi
jne 0x8f650a
mov ebx, dword [ebp - 0xc97c]
test ebx, ebx
jne 0x8f631a
mov edx, dword [edi + 0xc]
call fcn.0097cea0
mov dword [ebp - 0xc97c], eax
mov ebx, eax
cmp ebx, 4
jbe 0x8f6346
cmp byte [ebp - 0x550], 0
jne 0x8f6346
mov eax, dword [ebp - 0xc97c]
push eax
lea ecx, [ebp - 0x758]
lea ebx, [ebp - 0x550]
call fcn.0097b130
mov ebx, dword [ebp - 0xc97c]
cmp dword [ebp - 0xc990], 0
jne 0x8f6391
cmp ebx, 4
jbe 0x8f6361
mov edx, ebx
call fcn.0097cea0
mov dword [ebp - 0xc990], eax
cmp dword [ebp - 0xc990], 4
jbe 0x8f6391
cmp byte [ebp - 0x17b8], 0
jne 0x8f639e
mov ecx, dword [ebp - 0xc990]
push ecx
lea ecx, [ebp - 0x24e8]
lea ebx, [ebp - 0x17b8]
call fcn.0097b130
mov ebx, dword [ebp - 0xc97c]
cmp byte [ebp - 0x17b8], 0
je 0x8f6461
cmp dword [0xbd4ae0], 0
jne 0x8f6461
mov eax, str.wmiprvse.exe
lea ecx, [ebp - 0x17b8]
call fcn.0094c330
test eax, eax
jne 0x8f6461
mov esi, 1
mov dword [ebp - 0xc9c8], esi
push ebx
lea edx, [ebp - 0x550]
push edx
mov eax, dword [edi + 0xc]
push eax
mov ecx, dword [ebp - 0xc988]
push ecx
push str._CPL__MEM__TERM__Process___s:_u__run_by_Parent___s:_u_._Blocking_both_current_and_parent_process.
push 0xffffffffffffffff
push 0x1000
lea edx, [ebp - 0xc978]
push edx
call fcn.00a78fcb
push 0
push esi
lea eax, [ebp - 0xc978]
push eax
push 0xb54ce8
call fcn.008808e0
mov dword [ebp - 0xc9a0], esi
mov ecx, dword [ebp - 0xc990]
push ecx
lea edx, [ebp - 0x17b8]
push edx
push ebx
lea eax, [ebp - 0x550]
push eax
push str._CPL__MEM__TERM__Process___s:_u__run_by_Parent___s:_u_._Blocking_both_parent_and_parent_to_parent_process.
push 0xffffffffffffffff
push 0x1000
lea ecx, [ebp - 0xc978]
push ecx
call fcn.00a78fcb
add esp, 0x50
push 0
push esi
lea edx, [ebp - 0xc978]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0xc9f8], esi
cmp byte [ebp - 0x550], 0
je 0x8f6510
cmp dword [ebp - 0xc9a0], 0
jne 0x8f6510
cmp dword [0xbd4ae0], 0
jne 0x8f6510
mov eax, str.wmiprvse.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
je 0x8f64b0
mov eax, str.spoolsv.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
jne 0x8f6510
mov esi, 2
mov dword [ebp - 0xc9c8], esi
push ebx
lea eax, [ebp - 0x550]
push eax
mov ecx, dword [edi + 0xc]
push ecx
mov edx, dword [ebp - 0xc988]
push edx
push str._CPL__MEM__TERM__Process___s:_u__run_by_Parent___s:_u_._Blocking_both_current_and_parent_process.
push 0xffffffffffffffff
push 0x1000
lea eax, [ebp - 0x9978]
push eax
call fcn.00a78fcb
push 0
push 1
lea ecx, [ebp - 0x9978]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
mov dword [ebp - 0xc9a0], 1
jmp 0x8f6510
mov ebx, dword [ebp - 0xc97c]
cmp dword [ebp - 0xc9f0], 0
jne 0x8f66be
test esi, esi
jne 0x8f652d
cmp dword [ebp - 0xc998], esi
je 0x8f66be
cmp dword [ebp - 0xc98c], 0x800
jae 0x8f6596
mov edx, dword [ebp - 0xc994]
cmp byte [edx], 0
je 0x8f6564
mov eax, edx
push eax
push str._CPL__MEM__TERM__CmdLine_Process___s_
push 0xffffffffffffffff
push 0x1000
lea ecx, [ebp - 0x6178]
push ecx
call fcn.00a78fcb
add esp, 0x14
jmp 0x8f657f
push str._CPL__MEM__TERM__CmdLine_Process__BLANK_
push 0xffffffffffffffff
push 0x1000
lea edx, [ebp - 0x6178]
push edx
call fcn.00a78fcb
add esp, 0x10
lea esi, [ebp - 0x6178]
call fcn.009b7360
push 0
push 1
mov eax, esi
push eax
jmp 0x8f6618
mov ecx, dword [ebp - 0xc98c]
push ecx
push str._CPL__MEM__TERM__CmdLine_Process__see_next_line_as_length_is__d_
push 0xffffffffffffffff
push 0x1000
lea edx, [ebp - 0x6178]
push edx
call fcn.00a78fcb
add esp, 0x14
lea esi, [ebp - 0x6178]
call fcn.009b7360
push 0
push 1
mov eax, esi
push eax
push 0xb54ce8
call fcn.008808e0
push 0x1000
push 0
mov ecx, esi
push ecx
call fcn.00a7ffb0
add esp, 0x1c
push 0x800
mov edx, dword [ebp - 0xc994]
push edx
mov eax, esi
push eax
call fcn.00a7a620
add esp, 0xc
cmp byte [ebp - 0x5979], 0
je 0x8f660d
mov byte [ebp - 0x5978], 0
push 0
push 1
lea ecx, [ebp - 0x6178]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edx, dword [str._ST__PowerShell_Blocked]
mov dword [ebp - 0x140], edx
mov eax, dword [0xad8fe0]
mov dword [ebp - 0x13c], eax
mov ecx, dword [0xad8fe4]
mov dword [ebp - 0x138], ecx
mov edx, dword [0xad8fe8]
mov dword [ebp - 0x134], edx
mov eax, dword [0xad8fec]
mov dword [ebp - 0x130], eax
mov ecx, dword [0xad8ff0]
mov dword [ebp - 0x12c], ecx
lea eax, [ebp - 0x140]
mov esi, dword [edi + 0xc]
call fcn.008c4130
cmp dword [ebp - 0xc9a0], 0
je 0x8f6691
push 0
mov edi, ebx
call fcn.0097a830
mov edi, dword [ebp - 0xc980]
cmp dword [ebp - 0xc9f8], 0
je 0x8f66ad
push 0
mov edi, dword [ebp - 0xc990]
call fcn.0097a830
mov edi, dword [ebp - 0xc980]
mov eax, 1
mov dword [ebp - 0xc9e4], eax
mov dword [ebp - 0xc984], eax
cmp dword [ebp - 0xc98c], 0x800
jae 0x8f6712
mov edx, dword [ebp - 0xc994]
push edx
mov eax, dword [ebp - 0xc9bc]
push eax
mov ecx, dword [ebp - 0xc988]
push ecx
push str._CPL__MEM___s_started_with_Res:_u__CmdLine_Process___s_
push 0xffffffffffffffff
push 0x1000
lea edx, [ebp - 0x6178]
push edx
call fcn.00a78fcb
add esp, 0x1c
push 0
push 1
lea eax, [ebp - 0x6178]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [ebp - 0xc994]
push ecx
call fcn.00a78fec
add esp, 4
jmp 0x8f6786
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM__Force_Terminating_Bluetooth_FileTransfer_Process:__s:_u
push 0xffffffffffffffff
push 0x208
lea ecx, [ebp - 0x3f40]
push ecx
call fcn.00a78fcb
push 0
push ebx
lea edx, [ebp - 0x3f40]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
xor eax, eax
mov esi, dword [edi + 0xc]
call fcn.008c4130
mov dword [ebp - 0xc984], ebx
mov ecx, 9
mov esi, str._ST__Bluetooth_File_Transfer_Blocked
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0xc980]
cmp dword [ebp - 0xc984], 0
jne 0x8f6ec1
cmp dword [0xbd0648], 0
je 0x8f6948
mov byte [ebp - 0xe88], 0
push 0x103
push 0
lea eax, [ebp - 0xe87]
push eax
call fcn.00a7ffb0
add esp, 0xc
xor esi, esi
mov dword [ebp - 0xc9fc], esi
mov byte [ebp - 0x1bd0], 0
push 0x103
push esi
lea ecx, [ebp - 0x1bcf]
push ecx
call fcn.00a7ffb0
add esp, 0xc
cmp byte [ebp - 0x348], 0x5c
jne 0x8f6815
cmp byte [ebp - 0x347], 0x5c
jne 0x8f6815
push esi
push esi
push esi
lea edx, [ebp - 0x1bd0]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8f6815
mov esi, 1
mov dword [ebp - 0xc9fc], esi
lea edx, [ebp - 0xe88]
push edx
lea ecx, [ebp - 0x348]
call 0x9e3850
add esp, 4
cmp esi, 1
jne 0x8f683f
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov dword [ebp - 0xc9fc], 0
cmp byte [ebp - 0xe88], 0
je 0x8f6948
mov ebx, dword [0xbd064c]
mov eax, dword [0xbd0648]
mov dword [ebp - 0xc9bc], eax
lea ecx, [ebp - 0xe88]
push ecx
call fcn.00903e40
add esp, 4
test eax, eax
je 0x8f68e2
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM__SHA2__SHA256_Hash_Blocked___Force_Terminating_File:__s:_u
push 0xffffffffffffffff
push 0x208
lea ecx, [ebp - 0x4350]
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x4350]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov ecx, 6
mov esi, str._ST__SHA256_Hash_Blocked
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x140]
mov ecx, dword [ebp - 0xc980]
mov esi, dword [ecx + 0xc]
call fcn.008c4130
mov edi, dword [ebp - 0xc980]
mov esi, dword [0xbd064c]
cmp ebx, esi
jne 0x8f68fa
mov edx, dword [ebp - 0xc9bc]
cmp edx, dword [0xbd0648]
je 0x8f6948
mov byte [ebp - 0x14a8], 0
push 0x103
push 0
lea eax, [ebp - 0x14a7]
push eax
call fcn.00a7ffb0
add esp, 0xc
push esi
mov ecx, dword [0xbd0648]
push ecx
push str._SHA2__D__SHA256Chk:_u__ItemCount:_u
lea edx, [ebp - 0x14a8]
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x14a8]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0xc984], 0
jne 0x8f6ec1
xor ebx, ebx
cmp dword [0xb3de90], ebx
jne 0x8f6980
cmp dword [0xbd4acc], ebx
je 0x8f6ec1
mov eax, dword [0xbd0af0]
test eax, eax
je 0x8f6ec1
cmp byte [eax], bl
je 0x8f6ec1
mov dword [ebp - 0xc9c0], ebx
mov dword [ebp - 0xc9d4], ebx
mov dword [ebp - 0xc9a8], ebx
mov dword [ebp - 0xca08], ebx
mov dword [ebp - 0xca04], ebx
cmp dword [ebp - 0xc97c], ebx
jne 0x8f69b4
mov edx, dword [edi + 0xc]
call fcn.0097cea0
mov dword [ebp - 0xc97c], eax
cmp dword [ebp - 0xc97c], 4
jbe 0x8f69e4
cmp byte [ebp - 0x550], 0
jne 0x8f69f1
mov ecx, dword [ebp - 0xc97c]
push ecx
lea ecx, [ebp - 0x758]
lea ebx, [ebp - 0x550]
call fcn.0097b130
mov ebx, dword [ebp - 0xc9a8]
cmp byte [ebp - 0x550], 0
je 0x8f6ec1
push 0
push str.Office
lea edx, [ebp - 0x758]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f6af3
mov eax, str.Winword.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
je 0x8f6ae4
mov eax, str.mspub.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
je 0x8f6ae4
mov eax, str.excel.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
je 0x8f6ae4
mov eax, str.msaccess.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
je 0x8f6ae4
mov eax, str.Frontpg.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
je 0x8f6ae4
mov eax, str.visio.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
je 0x8f6ae4
mov eax, str.EQNEDT32.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
je 0x8f6ae4
mov eax, str.fltldr.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
je 0x8f6ae4
mov eax, str.OneNote.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
je 0x8f6ae4
mov eax, str.Powerpnt.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
jne 0x8f6af3
mov dword [ebp - 0xc9c0], 1
jmp 0x8f6c0f
push 0
push 0xacee28
lea eax, [ebp - 0x758]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f6b31
mov eax, str.EQNEDT32.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
jne 0x8f6b31
mov dword [ebp - 0xc9c0], 1
jmp 0x8f6c0f
push 0
push str.Adobe
lea ecx, [ebp - 0x758]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f6b67
push 0
push str.Acrobat
lea edx, [ebp - 0x758]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f6b8a
mov eax, str.acrord32.exe
lea ecx, [ebp - 0x550]
call fcn.0094c330
test eax, eax
jne 0x8f6b8a
mov dword [ebp - 0xc9d4], 1
jmp 0x8f6c0f
cmp dword [0xbd4acc], 0
je 0x8f6bd7
mov esi, dword [0xbd0af0]
test esi, esi
je 0x8f6bd7
cmp byte [esi], 0
je 0x8f6bd7
lea eax, [ebp - 0x550]
push eax
call fcn.0098d400
test eax, eax
je 0x8f6bd7
push str.conhost.exe
mov ecx, dword [ebp - 0xc988]
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8f6c07
mov ebx, 1
mov dword [ebp - 0xc9a8], ebx
jmp 0x8f6c07
mov edx, dword [edi + 0xc]
push edx
lea edi, [ebp - 0xc9a8]
lea edx, [ebp - 0x550]
mov eax, dword [ebp - 0xc988]
mov ecx, dword [ebp - 0xc97c]
call fcn.008f4380
add esp, 4
mov ebx, dword [ebp - 0xc9a8]
mov edi, dword [ebp - 0xc980]
test ebx, ebx
je 0x8f6ec1
push 0
push str.Office
lea eax, [ebp - 0x348]
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f6c39
mov dword [ebp - 0xca08], 1
jmp 0x8f6ec1
push 0
push str.Adobe
lea ecx, [ebp - 0x348]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8f6c6f
push 0
push str.Acrobat
lea edx, [ebp - 0x348]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8f6c7e
mov dword [ebp - 0xca04], 1
jmp 0x8f6ec1
push 5
push 1
lea eax, [ebp - 0x550]
push eax
lea ecx, [ebp - 0x758]
push ecx
mov edx, dword [ebp - 0xc988]
lea ecx, [ebp - 0x348]
call fcn.008cde60
add esp, 0x10
test eax, eax
jne 0x8f6ec1
mov byte [ebp - 0x20d8], al
push 0x3ff
push eax
lea edx, [ebp - 0x20d7]
push edx
call fcn.00a7ffb0
add esp, 0xc
cmp dword [ebp - 0xc9c0], 0
je 0x8f6d4e
mov ecx, 8
mov esi, str._ST__MSOffice_Child_EXE_Blocked
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc984], 1
lea eax, [ebp - 0x140]
mov edi, dword [ebp - 0xc980]
mov esi, dword [edi + 0xc]
call fcn.008c4130
mov eax, dword [ebp - 0xc97c]
push eax
lea ecx, [ebp - 0x758]
push ecx
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM____MSO_Child_Process___s:_u__run_by_Parent___s:_u_._Blocking_current_process.
push 0xffffffffffffffff
push 0x400
lea ecx, [ebp - 0x20d8]
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x20d8]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
jmp 0x8f6ebb
cmp dword [ebp - 0xc9d4], 0
je 0x8f6dd6
mov ecx, 7
mov esi, str._ST__Adobe_Child_EXE_Blocked
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0xc984], 1
lea eax, [ebp - 0x140]
mov edi, dword [ebp - 0xc980]
mov esi, dword [edi + 0xc]
call fcn.008c4130
mov eax, dword [ebp - 0xc97c]
push eax
lea ecx, [ebp - 0x758]
push ecx
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM____Adobe_Child_Process___s:_u__run_by_Parent___s:_u_._Blocking_current_process.
push 0xffffffffffffffff
push 0x400
lea ecx, [ebp - 0x20d8]
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x20d8]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
jmp 0x8f6ebb
test ebx, ebx
je 0x8f6ec1
cmp ebx, 1
jne 0x8f6e3a
mov ecx, 7
mov esi, str._ST__Custom_Child_EXE_Blocked
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 0xc97c]
push eax
lea ecx, [ebp - 0x758]
push ecx
mov edx, dword [ebp - 0xc980]
mov eax, dword [edx + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push str._CPL__MEM__TERM____Custom_Child_Process___s:_u__run_by_Parent___s:_u_._Blocking_current_process.
push 0xffffffffffffffff
push 0x400
lea edx, [ebp - 0x20d8]
push edx
call fcn.00a78fcb
push 0
push ebx
lea eax, [ebp - 0x20d8]
push eax
jmp 0x8f6e90
mov ecx, 6
mov esi, str._ST__WebShell_EXE_Blocked
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, dword [ebp - 0xc97c]
push ecx
lea edx, [ebp - 0x758]
push edx
mov eax, dword [ebp - 0xc980]
mov ecx, dword [eax + 0xc]
push ecx
lea edx, [ebp - 0x348]
push edx
push str._CPL__MEM__TERM____WebShell_Process___s:_u__run_by_Parent___s:_u_._Blocking_current_process.
push 0xffffffffffffffff
push 0x400
lea eax, [ebp - 0x20d8]
push eax
call fcn.00a78fcb
push 0
push 1
lea ecx, [ebp - 0x20d8]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
mov dword [ebp - 0xc984], 1
lea eax, [ebp - 0x140]
mov edx, dword [ebp - 0xc980]
mov esi, dword [edx + 0xc]
call fcn.008c4130
mov edi, dword [ebp - 0xc980]
mov dword [ebp - 0xc9e0], 0
mov esi, dword [ebp - 0xc984]
test esi, esi
jne 0x8f6f87
cmp dword [0xb3dea8], esi
je 0x8f6f83
lea eax, [ebp - 0x348]
push eax
mov ecx, dword [ebp - 0xc988]
push ecx
lea ecx, [ebp - 0xc9e0]
call fcn.00a691a0
add esp, 8
test eax, eax
je 0x8f6f83
cmp dword [ebp - 0xc9e0], esi
je 0x8f6f83
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push str._CPL__MEM__TERM__Force_Terminating_Sensitive_File:__s:_u
push 0xffffffffffffffff
push 0x208
lea ecx, [ebp - 0x960]
push ecx
call fcn.00a78fcb
push esi
push 1
lea edx, [ebp - 0x960]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov dword [ebp - 0xc984], 1
mov ecx, 9
mov esi, str._ST__Sensitive_OS_Execution_Blocked
lea edi, [ebp - 0x140]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x140]
mov ecx, dword [ebp - 0xc980]
mov esi, dword [ecx + 0xc]
call fcn.008c4130
mov edi, dword [ebp - 0xc980]
mov esi, dword [ebp - 0xc984]
test esi, esi
je 0x8f6fa7
mov eax, dword [edi + 0xc]
call fcn.00981220
test eax, eax
je 0x8f6f9f
mov dword [ebp - 0xc984], 0
jmp 0x8f6fa7
test esi, esi
jne 0x8f72af
cmp dword [0xb8db04], 0
jne 0x8f6fbd
cmp dword [0xb8db0c], 0
je 0x8f72af
mov dword [ebp - 0xc9e8], 0
cmp dword [ebp - 0xc97c], 0
jne 0x8f6fde
mov edx, dword [edi + 0xc]
call fcn.0097cea0
mov dword [ebp - 0xc97c], eax
mov edx, dword [ebp - 0xc97c]
push edx
mov eax, dword [edi + 0xc]
push eax
lea ebx, [ebp - 0xc9e8]
mov ecx, dword [ebp - 0xc99c]
call fcn.008c1d40
add esp, 8
mov esi, eax
test esi, esi
je 0x8f72af
mov ecx, dword [edi + 0xc]
push 0
push ecx
push 0
push 0x2000708
call dword [0xb8dac4]
add esp, 0x10
mov ebx, eax
test ebx, ebx
jl 0x8f7079
mov edx, dword [edi + 0xc]
push edx
call fcn.009b76f0
add esp, 4
call fcn.009b7930
push eax
mov ebx, dword [ebp - 0xc97c]
push ebx
mov eax, dword [edi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push esi
push str.____u__Process___s:_u__ppid:_u___Registered_For_PFACC__4___PidC___u_
lea edx, [ebp - 0x1298]
push edx
call fcn.00a78f30
add esp, 0x1c
push 0
push 1
lea eax, [ebp - 0x1298]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8f7178
mov byte [ebp - 0xb70], 0
push 0x103
push 0
lea ecx, [ebp - 0xb6f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
push ebx
lea edx, [ebp - 0xb70]
call fcn.008aaa40
add esp, 4
cmp byte [ebp - 0xb70], 0
jne 0x8f70d0
push ebx
mov edx, dword [ebp - 0xc97c]
push edx
mov eax, dword [edi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push esi
push str.____u__Process___s:_u__ppid:_u___Registration_For_PFACC_Failed__4___Error_Returned:_0x_x
lea edx, [ebp - 0x1298]
push edx
jmp 0x8f70f6
lea eax, [ebp - 0xb70]
push eax
mov ecx, dword [ebp - 0xc97c]
push ecx
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push esi
push str.____u__Process___s:_u__ppid:_u___Registration_For_PFACC_Failed__4___Error_Returned:__s
lea ecx, [ebp - 0x1298]
push ecx
call fcn.00a78f30
add esp, 0x1c
push 0
push 1
lea edx, [ebp - 0x1298]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp ebx, 0xc0000001
jne 0x8f7172
push str.___Removing_Self_Protection_of_process_as_count_exceeded__4_.
lea eax, [ebp - 0x1298]
push eax
call fcn.00a78f30
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x1298]
push ecx
push 0xb54ce8
call fcn.008808e0
push ebx
push 2
push ebx
push 0x2000501
call dword [0xb8dac4]
push ebx
push 2
push ebx
push 0x2000601
call dword [0xb8dac4]
add esp, 0x38
mov dword [0xb8db0c], ebx
mov dword [0xb8db04], ebx
mov ebx, dword [ebp - 0xc97c]
mov edx, dword [edi + 0xc]
push 0
push edx
push 0
push 0x2000702
call dword [0xb8dac4]
add esp, 0x10
mov dword [ebp - 0xc98c], eax
test eax, eax
jl 0x8f71d3
push ebx
mov eax, dword [edi + 0xc]
push eax
lea ecx, [ebp - 0x348]
push ecx
push esi
push str.____u__Process___s:_d__ppid:_d___Registered_For_PRACC__4_
lea edx, [ebp - 0x1298]
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x1298]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
jmp 0x8f7270
mov byte [ebp - 0xa68], 0
push 0x103
push 0
lea ecx, [ebp - 0xa67]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov edx, dword [ebp - 0xc98c]
push edx
lea edx, [ebp - 0xa68]
call fcn.008aaa40
add esp, 4
cmp byte [ebp - 0xa68], 0
jne 0x8f7230
mov eax, dword [ebp - 0xc98c]
push eax
push ebx
mov ecx, dword [edi + 0xc]
push ecx
lea edx, [ebp - 0x348]
push edx
push esi
push str.____u__Process___s:_d__ppid:_d___Registration_For_PRACC_Failed__4___Error_Returned:_0x_x
lea eax, [ebp - 0x1298]
push eax
jmp 0x8f7250
lea ecx, [ebp - 0xa68]
push ecx
push ebx
mov edx, dword [edi + 0xc]
push edx
lea eax, [ebp - 0x348]
push eax
push esi
push str.____u__Process___s:_d__ppid:_d___Registration_For_PRACC_Failed__4___Error_Returned:__s
lea ecx, [ebp - 0x1298]
push ecx
call fcn.00a78f30
add esp, 0x1c
push 0
push 1
lea edx, [ebp - 0x1298]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [edi + 0xc], 0
jbe 0x8f72af
cmp dword [ebp - 0xc9e8], 0
jne 0x8f72af
mov byte [ebp - 0x1cd8], 0
push 0x103
push 0
lea eax, [ebp - 0x1cd7]
push eax
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x1cd8]
push ecx
mov edx, dword [edi + 0xc]
push edx
call fcn.009b79f0
add esp, 8
mov eax, dword [edi + 0x18]
mov dword [ebp - 0xc980], eax
mov edi, eax
xor ebx, ebx
jmp 0x8f4474
cmp dword [0xbd0510], ebx
je 0x8f72e2
push 0xbd0510
call fcn.009658c0
add esp, 4
mov dword [0xbd0510], ebx
mov dword [0xbd0b1c], ebx
cmp dword [ebp - 0xc9e4], ebx
je 0x8f7329
mov esi, str.RunMSA1
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0095f910
push 4
call fcn.0086b3b0
add esp, 4
jmp 0x8f7329
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret