Function at 0x4286c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae41f
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x4e23d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 5
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.Start
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
push 0x2e
xor eax, eax
mov dword [ebp - 4], 0
push str.SystemCurrentControlSetServicesWaaSMedicSvc
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 1
push eax
push 4
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x134], 3
push eax
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0xec]
add esp, 0x18
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x4287ca
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4287c0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a4fc
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x42882e
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428824
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a501
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 5
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.Start
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
push 0x2f
xor eax, eax
mov dword [ebp - 4], 2
push str.SystemCurrentControlSetServicesPushToInstall
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 3
push eax
push 4
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x134], 3
push eax
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0xec]
add esp, 0x18
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x42890b
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428901
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a506
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x42896f
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428965
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a50b
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 5
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.Start
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
push 0x32
xor eax, eax
mov dword [ebp - 4], 4
push str.SystemCurrentControlSetServicesTrustedInstaller
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 5
push eax
push 4
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x134], 3
push eax
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0xec]
add esp, 0x18
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x428a4c
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428a42
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a510
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x428ab0
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428aa6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a515
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 5
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.Start
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
push 0x2a
xor eax, eax
mov dword [ebp - 4], 6
push str.SystemCurrentControlSetServiceswuauserv
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 7
push eax
push 4
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x134], 2
push eax
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0xec]
add esp, 0x18
mov byte [ebp - 4], 6
cmp edx, 8
jb 0x428b8d
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428b83
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a51a
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x428bf1
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428be7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a51f
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 5
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.Start
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
push 0x27
xor eax, eax
mov dword [ebp - 4], 8
push str.SystemCurrentControlSetServicesDoSvc
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 9
push eax
push 4
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x134], 2
push eax
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0xec]
add esp, 0x18
mov byte [ebp - 4], 8
cmp edx, 8
jb 0x428cce
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428cc4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a524
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x428d32
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428d28
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a529
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 5
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.Start
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
push 0x28
xor eax, eax
mov dword [ebp - 4], 0xa
push str.SystemCurrentControlSetServicesUsoSvc
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 0xb
push eax
push 4
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x134], 2
push eax
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0xec]
add esp, 0x18
mov byte [ebp - 4], 0xa
cmp edx, 8
jb 0x428e0f
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428e05
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a52e
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x428e73
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428e69
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a533
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 5
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.Start
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
push 0x26
xor eax, eax
mov dword [ebp - 4], 0xc
push str.SystemCurrentControlSetServicesBITS
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 0xd
push eax
push 4
lea eax, [ebp - 0xe8]
mov dword [ebp - 0x134], 3
push eax
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0xec]
add esp, 0x18
mov byte [ebp - 4], 0xc
cmp edx, 8
jb 0x428f50
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428f46
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a538
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x428fb4
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x428faa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a53d
push edx
push ecx
call fcn.0045bfb6
add esp, 8
movups xmm0, xmmword [str._SystemRoot__system32_svchost.exe__k_netsvcs__p]
push 9
xor eax, eax
mov dword [ebp - 0xd8], 0
movups xmmword [ebp - 0x70], xmm0
push str.ImagePath
movups xmm0, xmmword [0x4ba888]
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
movups xmmword [ebp - 0x60], xmm0
movups xmm0, xmmword [0x4ba898]
movups xmmword [ebp - 0x50], xmm0
movups xmm0, xmmword [0x4ba8a8]
movups xmmword [ebp - 0x40], xmm0
movups xmm0, xmmword [0x4ba8b8]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [0x4ba8c8]
movups xmmword [ebp - 0x20], xmm0
call fcn.0040db90
push 0x2a
xor eax, eax
mov dword [ebp - 4], 0xe
push str.SystemCurrentControlSetServiceswuauserv
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0xc0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 0xf
push eax
push 2
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0xec]
add esp, 0x18
mov byte [ebp - 4], 0xe
cmp edx, 8
jb 0x4290c9
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4290bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a542
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x42912d
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x429123
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a547
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov ecx, 0x17
mov dword [ebp - 0xd8], 0
mov esi, str._SystemRoot__system32_svchost.exe__k_wusvcs__p
mov dword [ebp - 0xd4], 7
lea edi, [ebp - 0xd0]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
push 9
push str.ImagePath
lea ecx, [ebp - 0xe8]
mov word [ebp - 0xe8], ax
movsw word es:[edi], word [esi]
call fcn.0040db90
push 0x2e
xor eax, eax
mov dword [ebp - 4], 0x10
push str.SystemCurrentControlSetServicesWaaSMedicSvc
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0xbc
lea eax, [ebp - 0xd0]
mov byte [ebp - 4], 0x11
push eax
push 2
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0xec]
add esp, 0x18
mov byte [ebp - 4], 0x10
cmp edx, 8
jb 0x429217
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42920d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a54c
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x42927b
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x429271
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a551
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 0x1a
xor eax, eax
mov dword [ebp - 0xd8], 0
push str.DisableWindowsUpdateAccess
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
push 0x31
xor eax, eax
mov dword [ebp - 4], 0x12
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
lea eax, [ebp - 0xe8]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x100]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
mov edx, dword [ebp - 0xec]
add esp, 0xc
mov byte [ebp - 4], 0x12
cmp edx, 8
jb 0x429343
mov ecx, dword [ebp - 0x100]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x429339
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a556
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0xd4]
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x4293a7
mov ecx, dword [ebp - 0xe8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42939d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42a55b
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 0xc
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.NoAutoUpdate
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x34
xor eax, eax
mov dword [ebp - 4], 0x14
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x15
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0xf
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.NoWindowsUpdate
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x3b
xor eax, eax
mov dword [ebp - 4], 0x16
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x10
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.DisableOSUpgrade
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
xor eax, eax
mov dword [ebp - 4], 0x18
push 0x31
mov dword [ebp - 0xd8], 0
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0xc
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.WindowsStore
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x1b
xor eax, eax
mov dword [ebp - 4], 0x1a
push str.SOFTWAREPoliciesMicrosoft
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x1b
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 9
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.OSUpgrade
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x37
xor eax, eax
mov dword [ebp - 4], 0x1c
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x1d
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
push 0x13
xor eax, eax
lea ecx, [ebp - 0x100]
push str.ReservationsAllowed
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x37
xor eax, eax
mov dword [ebp - 4], 0x1e
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x1f
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0xf
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.SvOfferDeclined
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x2c
xor eax, eax
mov dword [ebp - 4], 0x20
push str.SOFTWAREMicrosoftWindowsUpdateUXSettings
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x21
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x2c
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.DoNotConnectToWindowsUpdateInternetLocations
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x31
xor eax, eax
mov dword [ebp - 4], 0x22
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x23
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0xb
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.UseWUServer
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x34
xor eax, eax
mov dword [ebp - 4], 0x24
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x25
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 8
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.WUServer
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x31
xor eax, eax
mov dword [ebp - 4], 0x26
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x27
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
xor eax, eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
push 0xe
push str.WUStatusServer
lea ecx, [ebp - 0x100]
call fcn.0040db90
push 0x31
xor eax, eax
mov dword [ebp - 4], 0x28
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x29
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x19
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.UpdateServiceUrlAlternate
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x31
xor eax, eax
mov dword [ebp - 4], 0x2a
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x2b
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x12
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.TrayIconVisibility
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x2c
xor eax, eax
mov dword [ebp - 4], 0x2c
push str.SOFTWAREMicrosoftWindowsUpdateUXSettings
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
mov byte [ebp - 4], 0x2d
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 7
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.WubLock
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x2f
xor eax, eax
mov dword [ebp - 4], 0x2e
push str.SystemCurrentControlSetServicesPushToInstall
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x2f
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 7
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.WubLock
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x32
xor eax, eax
mov dword [ebp - 4], 0x30
push str.SystemCurrentControlSetServicesTrustedInstaller
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x31
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
xor eax, eax
mov dword [ebp - 0xf0], 0
push 0xd
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
push str.WubBlockLists
lea ecx, [ebp - 0x100]
call fcn.0040db90
push 0x49
xor eax, eax
mov dword [ebp - 4], 0x32
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x33
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 7
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.WubLock
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x2b
xor eax, eax
mov dword [ebp - 4], 0x34
push str.SystemCurrentControlSetServiceswuauserv_
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x35
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 7
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.WubLock
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x27
xor eax, eax
mov dword [ebp - 4], 0x36
push str.SystemCurrentControlSetServicesDoSvc
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x37
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 7
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.WubLock
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x2e
xor eax, eax
mov dword [ebp - 4], 0x38
push str.SystemCurrentControlSetServicesWaaSMedicSvc
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x39
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 7
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.WubLock
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x28
xor eax, eax
mov dword [ebp - 4], 0x3a
push str.SystemCurrentControlSetServicesUsoSvc
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x3b
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 7
xor eax, eax
mov dword [ebp - 0xf0], 0
push str.WubLock
lea ecx, [ebp - 0x100]
mov dword [ebp - 0xec], 7
mov word [ebp - 0x100], ax
call fcn.0040db90
push 0x26
xor eax, eax
mov dword [ebp - 4], 0x3c
push str.SystemCurrentControlSetServicesBITS
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0x100]
mov byte [ebp - 4], 0x3d
push eax
lea eax, [ebp - 0xe8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00425390
add esp, 0xc
lea ecx, [ebp - 0xe8]
call fcn.00405b80
lea ecx, [ebp - 0x100]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x50
xor eax, eax
mov dword [ebp - 0xd8], 0
push str._change__tn__MicrosoftWindowsWindowsUpdateRefresh_Group_Policy_Cache___enable
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x3e
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push 0x45
xor eax, eax
mov dword [ebp - 0xd8], 0
push str._change__tn__MicrosoftWindowsWindowsUpdateScheduled_Start___enable
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0xd4], 7
mov word [ebp - 0xe8], ax
call fcn.0040db90
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x3f
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsWindowsUpdate_sihpostreboot___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x40
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorBackup_Scan___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x41
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorMaintenance_Install___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x42
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorMusUx_UpdateInterval___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x43
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorReboot_AC___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x44
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorReboot_Battery___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x45
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorReport_policies___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x46
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorSchedule_Scan___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x47
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorSchedule_Scan_Static_Task___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x48
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorUniversal_Orchestrator_Start___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x49
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorUpdateModelTask___enable
lea ecx, [ebp - 0xe8]
call fcn.00419f20
lea eax, [ebp - 0xe8]
mov dword [ebp - 4], 0x4a
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorUSO_UxBroker___enable
lea ecx, [ebp - 0x118]
call fcn.00419f20
lea eax, [ebp - 0x118]
mov dword [ebp - 4], 0x4b
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsWaaSMedicPerformRemediation___enable
lea ecx, [ebp - 0x130]
call fcn.00419f20
lea eax, [ebp - 0x130]
mov dword [ebp - 4], 0x4c
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.00405b80
push 1
sub esp, 0x18
mov ecx, esp
push str.dosvc
call fcn.00419f20
call fcn.0042bc40
add esp, 0x1c
push 1
sub esp, 0x18
mov ecx, esp
push str.WaaSMedicSvc
call fcn.00419f20
call fcn.0042bc40
add esp, 0x1c
push 1
sub esp, 0x18
mov ecx, esp
push str.UsoSvc
call fcn.00419f20
call fcn.0042bc40
add esp, 0x1c
push 1
sub esp, 0x18
mov ecx, esp
push str.BITS
call fcn.00419f20
call fcn.0042bc40
add esp, 0x1c
push 1
sub esp, 0x18
mov ecx, esp
push str.wuauserv
call fcn.00419f20
call fcn.0042bc40
add esp, 0x1c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045c263
mov esp, ebp
pop ebp
ret
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
int3