Function at 0x4254e0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae09a
mov eax, dword fs:[0]
push eax
sub esp, 0x3d0
mov eax, dword [0x4e23d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1a
xor eax, eax
mov dword [ebp - 0x200], 0
push str.DisableWindowsUpdateAccess
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x31
xor eax, eax
mov dword [ebp - 4], 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 1
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 1
push eax
lea eax, [ebp - 0x1f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0x1e4]
add esp, 0x18
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x4255ea
mov ecx, dword [ebp - 0x1f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4255e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428442
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x42564e
mov ecx, dword [ebp - 0x210]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425644
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428447
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 0xc
xor eax, eax
mov dword [ebp - 0x200], 0
push str.NoAutoUpdate
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x34
xor eax, eax
mov dword [ebp - 4], 2
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 3
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 1
push eax
lea eax, [ebp - 0x1f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0x1e4]
add esp, 0x18
mov byte [ebp - 4], 2
cmp edx, 8
jb 0x42572b
mov ecx, dword [ebp - 0x1f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425721
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42844c
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x42578f
mov ecx, dword [ebp - 0x210]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425785
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428451
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 0xf
xor eax, eax
mov dword [ebp - 0x200], 0
push str.NoWindowsUpdate
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x3b
xor eax, eax
mov dword [ebp - 4], 4
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 5
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 1
push eax
lea eax, [ebp - 0x1f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0x1e4]
add esp, 0x18
mov byte [ebp - 4], 4
cmp edx, 8
jb 0x42586c
mov ecx, dword [ebp - 0x1f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425862
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428456
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x4258d0
mov ecx, dword [ebp - 0x210]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4258c6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42845b
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 0x10
xor eax, eax
mov dword [ebp - 0x200], 0
push str.DisableOSUpgrade
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x31
xor eax, eax
mov dword [ebp - 4], 6
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 7
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 1
push eax
lea eax, [ebp - 0x1f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0x1e4]
add esp, 0x18
mov byte [ebp - 4], 6
cmp edx, 8
jb 0x4259ad
mov ecx, dword [ebp - 0x1f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4259a3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428460
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x425a11
mov ecx, dword [ebp - 0x210]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425a07
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428465
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 0xc
xor eax, eax
mov dword [ebp - 0x200], 0
push str.WindowsStore
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x1b
xor eax, eax
mov dword [ebp - 4], 8
push str.SOFTWAREPoliciesMicrosoft
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 9
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 1
push eax
lea eax, [ebp - 0x1f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0x1e4]
add esp, 0x18
mov byte [ebp - 4], 8
cmp edx, 8
jb 0x425aee
mov ecx, dword [ebp - 0x1f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425ae4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42846a
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x425b52
mov ecx, dword [ebp - 0x210]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425b48
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42846f
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 9
xor eax, eax
mov dword [ebp - 0x200], 0
push str.OSUpgrade
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x37
xor eax, eax
mov dword [ebp - 4], 0xa
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0xb
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 0
push eax
lea eax, [ebp - 0x1f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0x1e4]
add esp, 0x18
mov byte [ebp - 4], 0xa
cmp edx, 8
jb 0x425c2f
mov ecx, dword [ebp - 0x1f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425c25
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428474
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x425c93
mov ecx, dword [ebp - 0x210]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425c89
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428479
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 0x13
xor eax, eax
mov dword [ebp - 0x200], 0
push str.ReservationsAllowed
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x37
xor eax, eax
mov dword [ebp - 4], 0xc
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdate
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0xd
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 0
push eax
lea eax, [ebp - 0x1f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0x1e4]
add esp, 0x18
mov byte [ebp - 4], 0xc
cmp edx, 8
jb 0x425d70
mov ecx, dword [ebp - 0x1f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425d66
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42847e
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x425dd4
mov ecx, dword [ebp - 0x210]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425dca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428483
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 0x2c
xor eax, eax
mov dword [ebp - 0x200], 0
push str.DoNotConnectToWindowsUpdateInternetLocations
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x31
xor eax, eax
mov dword [ebp - 4], 0xe
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0xf
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 1
push eax
lea eax, [ebp - 0x1f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0x1e4]
add esp, 0x18
mov byte [ebp - 4], 0xe
cmp edx, 8
jb 0x425eb1
mov ecx, dword [ebp - 0x1f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425ea7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428488
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x425f15
mov ecx, dword [ebp - 0x210]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425f0b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x42848d
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 0xb
xor eax, eax
mov dword [ebp - 0x200], 0
push str.UseWUServer
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x34
xor eax, eax
mov dword [ebp - 4], 0x10
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x11
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 1
push eax
lea eax, [ebp - 0x1f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
mov edx, dword [ebp - 0x1e4]
add esp, 0x18
mov byte [ebp - 4], 0x10
cmp edx, 8
jb 0x425ff2
mov ecx, dword [ebp - 0x1f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x425fe8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428492
push edx
push ecx
call fcn.0045bfb6
add esp, 8
mov edx, dword [ebp - 0x1fc]
xor eax, eax
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x426056
mov ecx, dword [ebp - 0x210]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42604c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x428497
push edx
push ecx
call fcn.0045bfb6
add esp, 8
push 0x1c
xor eax, eax
mov dword [ebp - 0x1e8], 0
push str.localserver.localdomain.wsus
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 8
xor eax, eax
mov dword [ebp - 4], 0x12
push str.WUServer
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
push 0x34
xor eax, eax
mov byte [ebp - 4], 0x13
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
mov eax, dword [ebp - 0x1e8]
mov byte [ebp - 4], 0x14
test eax, eax
jne 0x426100
push eax
push eax
jmp 0x426118
cmp dword [ebp - 0x1e4], 8
lea ecx, [ebp - 0x1f8]
cmovae ecx, dword [ebp - 0x1f8]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x1c
xor eax, eax
mov dword [ebp - 0x1e8], 0
push str.localserver.localdomain.wsus
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 0xe
xor eax, eax
mov dword [ebp - 4], 0x15
push str.WUStatusServer
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x34
xor eax, eax
mov byte [ebp - 4], 0x16
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
mov eax, dword [ebp - 0x1e8]
mov byte [ebp - 4], 0x17
test eax, eax
jne 0x426207
push eax
push eax
jmp 0x42621f
cmp dword [ebp - 0x1e4], 8
lea ecx, [ebp - 0x1f8]
cmovae ecx, dword [ebp - 0x1f8]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x1c
xor eax, eax
mov dword [ebp - 0x1e8], 0
push str.localserver.localdomain.wsus
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 0x19
xor eax, eax
mov dword [ebp - 4], 0x18
push str.UpdateServiceUrlAlternate
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x34
xor eax, eax
mov byte [ebp - 4], 0x19
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
mov eax, dword [ebp - 0x1e8]
mov byte [ebp - 4], 0x1a
test eax, eax
jne 0x42630e
push eax
push eax
jmp 0x426326
cmp dword [ebp - 0x1e4], 8
lea ecx, [ebp - 0x1f8]
cmovae ecx, dword [ebp - 0x1f8]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x12
xor eax, eax
mov dword [ebp - 0x200], 0
push str.TrayIconVisibility
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x2c
xor eax, eax
mov dword [ebp - 4], 0x1b
push str.SOFTWAREMicrosoftWindowsUpdateUXSettings
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x1c
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 0
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 5
xor eax, eax
mov dword [ebp - 0x200], 0
push str.Start
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x2a
xor eax, eax
mov dword [ebp - 4], 0x1d
push str.SystemCurrentControlSetServiceswuauserv
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x1e
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 2
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x2e
xor eax, eax
mov dword [ebp - 0x1e8], 0
push str._SystemRoot__system32_svchost.exe__k_wusvcs__p
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 9
xor eax, eax
mov dword [ebp - 4], 0x1f
push str.ImagePath
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x2a
xor eax, eax
mov byte [ebp - 4], 0x20
push str.SystemCurrentControlSetServiceswuauserv
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
mov eax, dword [ebp - 0x1e8]
mov byte [ebp - 4], 0x21
test eax, eax
jne 0x426581
push eax
push eax
jmp 0x426599
cmp dword [ebp - 0x1e4], 8
lea ecx, [ebp - 0x1f8]
cmovae ecx, dword [ebp - 0x1f8]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 5
xor eax, eax
mov dword [ebp - 0x200], 0
push str.Start
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x2f
xor eax, eax
mov dword [ebp - 4], 0x22
push str.SystemCurrentControlSetServicesPushToInstall
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x23
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 3
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 5
xor eax, eax
mov dword [ebp - 0x200], 0
push str.Start
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x32
xor eax, eax
mov dword [ebp - 4], 0x24
push str.SystemCurrentControlSetServicesTrustedInstaller
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x25
push eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x3dc], 3
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 1
xor eax, eax
mov dword [ebp - 0x1e8], 0
push 0x4b9210
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 8
xor eax, eax
mov dword [ebp - 4], 0x26
push 0x4b9214
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x57
xor eax, eax
mov byte [ebp - 4], 0x27
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsWaaSMedic.exe
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
mov eax, dword [ebp - 0x1e8]
mov byte [ebp - 4], 0x28
test eax, eax
jne 0x4267f4
push eax
push eax
jmp 0x42680c
cmp dword [ebp - 0x1e4], 8
lea ecx, [ebp - 0x1f8]
cmovae ecx, dword [ebp - 0x1f8]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 1
xor eax, eax
mov dword [ebp - 0x1e8], 0
push 0x4b9210
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 8
xor eax, eax
mov dword [ebp - 4], 0x29
push 0x4b9214
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x5c
xor eax, eax
mov byte [ebp - 4], 0x2a
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsWaasMedicAgent.exe
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
mov eax, dword [ebp - 0x1e8]
mov byte [ebp - 4], 0x2b
test eax, eax
jne 0x4268fb
push eax
push eax
jmp 0x426913
cmp dword [ebp - 0x1e4], 8
lea ecx, [ebp - 0x1f8]
cmovae ecx, dword [ebp - 0x1f8]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 1
xor eax, eax
mov dword [ebp - 0x1e8], 0
push 0x4b9210
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 8
xor eax, eax
mov dword [ebp - 4], 0x2c
push 0x4b9214
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x5e
xor eax, eax
mov byte [ebp - 4], 0x2d
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsWindows10Upgrade.exe
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
mov eax, dword [ebp - 0x1e8]
mov byte [ebp - 4], 0x2e
test eax, eax
jne 0x426a02
push eax
push eax
jmp 0x426a1a
cmp dword [ebp - 0x1e4], 8
lea ecx, [ebp - 0x1f8]
cmovae ecx, dword [ebp - 0x1f8]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 1
xor eax, eax
mov dword [ebp - 0x1e8], 0
push 0x4b9210
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], 7
mov word [ebp - 0x1f8], ax
call fcn.0040db90
push 8
xor eax, eax
mov dword [ebp - 4], 0x2f
push 0x4b9214
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x1fc], 7
mov word [ebp - 0x210], ax
call fcn.0040db90
push 0x62
xor eax, eax
mov byte [ebp - 4], 0x30
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsWindows10UpgraderApp.exe
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
mov word [ebp - 0x228], ax
call fcn.0040db90
mov eax, dword [ebp - 0x1e8]
mov byte [ebp - 4], 0x31
test eax, eax
jne 0x426b09
push eax
push eax
jmp 0x426b21
cmp dword [ebp - 0x1e4], 8
lea ecx, [ebp - 0x1f8]
cmovae ecx, dword [ebp - 0x1f8]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x228]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x228]
call fcn.00405b80
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x32
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsUpdateAssistant.exe
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x33
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x34
test eax, eax
jne 0x426bb3
push eax
push eax
jmp 0x426bcb
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x35
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsUsoClient.exe
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x36
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x37
test eax, eax
jne 0x426c5d
push eax
push eax
jmp 0x426c75
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x38
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_remsh.exe
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x39
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x3a
test eax, eax
jne 0x426d07
push eax
push eax
jmp 0x426d1f
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x3b
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsEOSnotify.exe
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x3c
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x3d
test eax, eax
jne 0x426db1
push eax
push eax
jmp 0x426dc9
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x3e
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsSihClient.exe
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x3f
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x40
test eax, eax
jne 0x426e5b
push eax
push eax
jmp 0x426e73
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], 0x41
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsInstallAgent.exe
lea ecx, [ebp - 0x1f8]
mov byte [ebp - 4], 0x42
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x43
test eax, eax
jne 0x426f05
push eax
push eax
jmp 0x426f1d
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x1f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x210]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x44
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsMusNotification.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x45
call fcn.00419f20
mov eax, dword [ebp - 0x200]
mov byte [ebp - 4], 0x46
test eax, eax
jne 0x426faf
push eax
push eax
jmp 0x426fc7
cmp dword [ebp - 0x1fc], 8
lea ecx, [ebp - 0x210]
cmovae ecx, dword [ebp - 0x210]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x47
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsMusNotificationUx.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x48
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x49
test eax, eax
jne 0x427059
push eax
push eax
jmp 0x427071
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x210]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x4a
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsMoNotificationUx.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x4b
call fcn.00419f20
mov eax, dword [ebp - 0x200]
mov byte [ebp - 4], 0x4c
test eax, eax
jne 0x427103
push eax
push eax
jmp 0x42711b
cmp dword [ebp - 0x1fc], 8
lea ecx, [ebp - 0x210]
cmovae ecx, dword [ebp - 0x210]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
mov ecx, 0x73
lea edi, [ebp - 0x1e0]
mov esi, str.WaaSMedic.exe
rep movsd dword es:[edi], dword [esi]
push str.WubBlockLists
lea ecx, [ebp - 0x270]
movsw word es:[edi], word [esi]
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], 0x4d
call fcn.00419f20
push 0x39c
lea eax, [ebp - 0x1e0]
mov byte [ebp - 4], 0x4e
push eax
push 7
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x270]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.Start
lea ecx, [ebp - 0x288]
call fcn.00419f20
push str.SystemCurrentControlSetServiceswuauserv
lea ecx, [ebp - 0x270]
mov dword [ebp - 4], 0x4f
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x50
push eax
push 4
lea eax, [ebp - 0x288]
mov dword [ebp - 0x3dc], 4
push eax
lea eax, [ebp - 0x270]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x270]
call fcn.00405b80
lea ecx, [ebp - 0x288]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.WubLock
lea ecx, [ebp - 0x2a0]
call fcn.00419f20
push str.SystemCurrentControlSetServiceswuauserv
lea ecx, [ebp - 0x288]
mov dword [ebp - 4], 0x51
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x52
push eax
push 4
lea eax, [ebp - 0x2a0]
mov dword [ebp - 0x3dc], 1
push eax
lea eax, [ebp - 0x288]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x288]
call fcn.00405b80
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.Start
lea ecx, [ebp - 0x2b8]
call fcn.00419f20
push str.SystemCurrentControlSetServicesDoSvc
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 4], 0x53
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x54
push eax
push 4
lea eax, [ebp - 0x2b8]
mov dword [ebp - 0x3dc], 4
push eax
lea eax, [ebp - 0x2a0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x2a0]
call fcn.00405b80
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.WubLock
lea ecx, [ebp - 0x2d0]
call fcn.00419f20
push str.SystemCurrentControlSetServicesDoSvc
lea ecx, [ebp - 0x2b8]
mov dword [ebp - 4], 0x55
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x56
push eax
push 4
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x3dc], 1
push eax
lea eax, [ebp - 0x2b8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x2b8]
call fcn.00405b80
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.Start
lea ecx, [ebp - 0x2e8]
call fcn.00419f20
push str.SystemCurrentControlSetServicesWaaSMedicSvc
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 4], 0x57
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x58
push eax
push 4
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x3dc], 4
push eax
lea eax, [ebp - 0x2d0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x2d0]
call fcn.00405b80
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.WubLock
lea ecx, [ebp - 0x300]
call fcn.00419f20
push str.SystemCurrentControlSetServicesWaaSMedicSvc
lea ecx, [ebp - 0x2e8]
mov dword [ebp - 4], 0x59
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x5a
push eax
push 4
lea eax, [ebp - 0x300]
mov dword [ebp - 0x3dc], 1
push eax
lea eax, [ebp - 0x2e8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x2e8]
call fcn.00405b80
lea ecx, [ebp - 0x300]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.Start
lea ecx, [ebp - 0x318]
call fcn.00419f20
push str.SystemCurrentControlSetServicesUsoSvc
lea ecx, [ebp - 0x300]
mov dword [ebp - 4], 0x5b
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x5c
push eax
push 4
lea eax, [ebp - 0x318]
mov dword [ebp - 0x3dc], 3
push eax
lea eax, [ebp - 0x300]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x300]
call fcn.00405b80
lea ecx, [ebp - 0x318]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.Start
lea ecx, [ebp - 0x330]
call fcn.00419f20
push str.SystemCurrentControlSetServicesBITS
lea ecx, [ebp - 0x318]
mov dword [ebp - 4], 0x5d
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x5e
push eax
push 4
lea eax, [ebp - 0x330]
mov dword [ebp - 0x3dc], 3
push eax
lea eax, [ebp - 0x318]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x318]
call fcn.00405b80
lea ecx, [ebp - 0x330]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.Start
lea ecx, [ebp - 0x348]
call fcn.00419f20
push str.SystemCurrentControlSetServicesPushToInstall
lea ecx, [ebp - 0x330]
mov dword [ebp - 4], 0x5f
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x60
push eax
push 4
lea eax, [ebp - 0x348]
mov dword [ebp - 0x3dc], 3
push eax
lea eax, [ebp - 0x330]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x330]
call fcn.00405b80
lea ecx, [ebp - 0x348]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.Start
lea ecx, [ebp - 0x258]
call fcn.00419f20
push str.SystemCurrentControlSetServicesTrustedInstaller
lea ecx, [ebp - 0x348]
mov dword [ebp - 4], 0x61
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x62
push eax
push 4
lea eax, [ebp - 0x258]
mov dword [ebp - 0x3dc], 3
push eax
lea eax, [ebp - 0x348]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x348]
call fcn.00405b80
lea ecx, [ebp - 0x258]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x63
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsWaaSMedic.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x64
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x65
test eax, eax
jne 0x4276e2
push eax
push eax
jmp 0x4276fa
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x210]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x66
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsWaasMedicAgent.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x67
call fcn.00419f20
mov eax, dword [ebp - 0x200]
mov byte [ebp - 4], 0x68
test eax, eax
jne 0x42778c
push eax
push eax
jmp 0x4277a4
cmp dword [ebp - 0x1fc], 8
lea ecx, [ebp - 0x210]
cmovae ecx, dword [ebp - 0x210]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x69
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsWindows10Upgrade.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x6a
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x6b
test eax, eax
jne 0x427836
push eax
push eax
jmp 0x42784e
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x210]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x6c
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsWindows10UpgraderApp.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x6d
call fcn.00419f20
mov eax, dword [ebp - 0x200]
mov byte [ebp - 4], 0x6e
test eax, eax
jne 0x4278e0
push eax
push eax
jmp 0x4278f8
cmp dword [ebp - 0x1fc], 8
lea ecx, [ebp - 0x210]
cmovae ecx, dword [ebp - 0x210]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x6f
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsUpdateAssistant.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x70
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x71
test eax, eax
jne 0x42798a
push eax
push eax
jmp 0x4279a2
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x210]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x72
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsUsoClient.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x73
call fcn.00419f20
mov eax, dword [ebp - 0x200]
mov byte [ebp - 4], 0x74
test eax, eax
jne 0x427a34
push eax
push eax
jmp 0x427a4c
cmp dword [ebp - 0x1fc], 8
lea ecx, [ebp - 0x210]
cmovae ecx, dword [ebp - 0x210]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x75
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_remsh.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x76
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x77
test eax, eax
jne 0x427ade
push eax
push eax
jmp 0x427af6
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x210]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x78
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsEOSnotify.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x79
call fcn.00419f20
mov eax, dword [ebp - 0x200]
mov byte [ebp - 4], 0x7a
test eax, eax
jne 0x427b88
push eax
push eax
jmp 0x427ba0
cmp dword [ebp - 0x1fc], 8
lea ecx, [ebp - 0x210]
cmovae ecx, dword [ebp - 0x210]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x7b
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsSihClient.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x7c
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x7d
test eax, eax
jne 0x427c32
push eax
push eax
jmp 0x427c4a
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x210]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x7e
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsInstallAgent.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x7f
call fcn.00419f20
mov eax, dword [ebp - 0x200]
mov byte [ebp - 4], 0x80
test eax, eax
jne 0x427cdc
push eax
push eax
jmp 0x427cf4
cmp dword [ebp - 0x1fc], 8
lea ecx, [ebp - 0x210]
cmovae ecx, dword [ebp - 0x210]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x81
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsMusNotification.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x82
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x83
test eax, eax
jne 0x427d86
push eax
push eax
jmp 0x427d9e
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x210]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 4], 0x84
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsMusNotificationUx.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x85
call fcn.00419f20
mov eax, dword [ebp - 0x200]
mov byte [ebp - 4], 0x86
test eax, eax
jne 0x427e30
push eax
push eax
jmp 0x427e48
cmp dword [ebp - 0x1fc], 8
lea ecx, [ebp - 0x210]
cmovae ecx, dword [ebp - 0x210]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push 0x4b9210
lea ecx, [ebp - 0x228]
call fcn.00419f20
push 0x4b9214
lea ecx, [ebp - 0x210]
mov dword [ebp - 4], 0x87
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsMoNotificationUx.exe
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 0x88
call fcn.00419f20
mov eax, dword [ebp - 0x218]
mov byte [ebp - 4], 0x89
test eax, eax
jne 0x427eda
push eax
push eax
jmp 0x427ef2
cmp dword [ebp - 0x214], 8
lea ecx, [ebp - 0x228]
cmovae ecx, dword [ebp - 0x228]
add eax, eax
push eax
push ecx
push 1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x240]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00405b80
lea ecx, [ebp - 0x210]
call fcn.00405b80
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.WubBlockLists
lea ecx, [ebp - 0x348]
call fcn.00419f20
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
lea ecx, [ebp - 0x258]
mov dword [ebp - 4], 0x8a
call fcn.00419f20
push 0x39c
lea eax, [ebp - 0x1e0]
mov byte [ebp - 4], 0x8b
push eax
push 7
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x258]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x258]
call fcn.00405b80
lea ecx, [ebp - 0x348]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.Start
lea ecx, [ebp - 0x330]
call fcn.00419f20
push str.SystemCurrentControlSetServicesUsoSvc
lea ecx, [ebp - 0x258]
mov dword [ebp - 4], 0x8c
call fcn.00419f20
push 4
lea eax, [ebp - 0x3dc]
mov byte [ebp - 4], 0x8d
push eax
push 4
lea eax, [ebp - 0x330]
mov dword [ebp - 0x3dc], 3
push eax
lea eax, [ebp - 0x258]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x258]
call fcn.00405b80
lea ecx, [ebp - 0x330]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str.Start
lea ecx, [ebp - 0x318]
call fcn.00419f20
push str.SystemCurrentControlSetServicesBITS
lea ecx, [ebp - 0x258]
mov dword [ebp - 4], 0x8e
call fcn.00419f20
mov byte [ebp - 4], 0x8f
lea eax, [ebp - 0x3dc]
mov dword [ebp - 0x3dc], 3
push 4
push eax
push 4
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x258]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042bae0
add esp, 0x18
lea ecx, [ebp - 0x258]
call fcn.00405b80
lea ecx, [ebp - 0x318]
mov dword [ebp - 4], 0xffffffff
call fcn.00405b80
push str._change__tn__MicrosoftWindowsWindowsUpdateRefresh_Group_Policy_Cache___disable
lea ecx, [ebp - 0x300]
call fcn.00419f20
lea eax, [ebp - 0x300]
mov dword [ebp - 4], 0x90
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x300]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsWindowsUpdateScheduled_Start___disable
lea ecx, [ebp - 0x2e8]
call fcn.00419f20
lea eax, [ebp - 0x2e8]
mov dword [ebp - 4], 0x91
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2e8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorSchedule_Maintenance_Work___disable
lea ecx, [ebp - 0x2d0]
call fcn.00419f20
lea eax, [ebp - 0x2d0]
mov dword [ebp - 4], 0x92
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d0]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorSchedule_Wake_To_Work___disable
lea ecx, [ebp - 0x2b8]
call fcn.00419f20
lea eax, [ebp - 0x2b8]
mov dword [ebp - 4], 0x93
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2b8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorSchedule_Work___disable
lea ecx, [ebp - 0x2a0]
call fcn.00419f20
lea eax, [ebp - 0x2a0]
mov dword [ebp - 4], 0x94
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a0]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorMusUx_LogonUpdateResults___disable
lea ecx, [ebp - 0x288]
call fcn.00419f20
lea eax, [ebp - 0x288]
mov dword [ebp - 4], 0x95
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x288]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorReboot_AC___disable
lea ecx, [ebp - 0x270]
call fcn.00419f20
lea eax, [ebp - 0x270]
mov dword [ebp - 4], 0x96
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorReboot_Battery___disable
lea ecx, [ebp - 0x1f8]
call fcn.00419f20
lea eax, [ebp - 0x1f8]
mov dword [ebp - 4], 0x97
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorReport_policies___disable
lea ecx, [ebp - 0x360]
call fcn.00419f20
lea eax, [ebp - 0x360]
mov dword [ebp - 4], 0x98
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x360]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorSchedule_Scan___disable
lea ecx, [ebp - 0x378]
call fcn.00419f20
lea eax, [ebp - 0x378]
mov dword [ebp - 4], 0x99
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x378]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorSchedule_Scan_Static_Task___disable
lea ecx, [ebp - 0x390]
call fcn.00419f20
lea eax, [ebp - 0x390]
mov dword [ebp - 4], 0x9a
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x390]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorUpdateModelTask___disable
lea ecx, [ebp - 0x3a8]
call fcn.00419f20
lea eax, [ebp - 0x3a8]
mov dword [ebp - 4], 0x9b
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3a8]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsUpdateOrchestratorUSO_UxBroker___disable
lea ecx, [ebp - 0x3c0]
call fcn.00419f20
lea eax, [ebp - 0x3c0]
mov dword [ebp - 4], 0x9c
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c0]
call fcn.00405b80
push str._change__tn__MicrosoftWindowsWaaSMedicPerformRemediation___disable
lea ecx, [ebp - 0x3d8]
call fcn.00419f20
lea eax, [ebp - 0x3d8]
mov dword [ebp - 4], 0x9d
push eax
call fcn.0042b370
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3d8]
call fcn.00405b80
push 0
sub esp, 0x18
mov ecx, esp
push str.wuauserv
call fcn.00419f20
call fcn.0042bc40
add esp, 0x1c
push 0
sub esp, 0x18
mov ecx, esp
push str.dosvc
call fcn.00419f20
call fcn.0042bc40
add esp, 0x1c
push 0
sub esp, 0x18
mov ecx, esp
push str.WaaSMedicSvc
call fcn.00419f20
call fcn.0042bc40
add esp, 0x1c
push 0
sub esp, 0x18
mov ecx, esp
push str.UsoSvc
call fcn.00419f20
call fcn.0042bc40
add esp, 0x1c
push 0
sub esp, 0x18
mov ecx, esp
push str.BITS
call fcn.00419f20
call fcn.0042bc40
add esp, 0x1c
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045c263
mov esp, ebp
pop ebp
ret
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
call fcn.004844a9
int3