Function at 0x4780b0
Capabilities:
Check for time delay via gettickcount
Create thread
Delete registry value
Link many functions at runtime
Persist via windows service
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670b30
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x3444
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3404], eax
xor esi, esi
mov byte [ebp - 0x24ac], 0
push 0x103
push esi
lea ecx, [ebp - 0x24ab]
push ecx
call fcn.005dfd60
mov dword [ebp - 0x33d4], 0x80004005
mov byte [ebp - 0x530], 0
push 0x40f
push esi
lea edx, [ebp - 0x52f]
push edx
call fcn.005dfd60
mov byte [ebp - 0x120], 0
push 0x103
push esi
lea eax, [ebp - 0x11f]
push eax
call fcn.005dfd60
mov dword [ebp - 0x3410], esi
mov dword [ebp - 0x3420], esi
mov dword [ebp - 0x3424], esi
mov dword [ebp - 0x3448], esi
mov dword [ebp - 0x3434], esi
mov byte [ebp - 0xb48], 0
push 0x103
push esi
lea ecx, [ebp - 0xb47]
push ecx
call fcn.005dfd60
add esp, 0x30
mov dword [ebp - 0x344c], 0x104
mov dword [0x6b0760], esi
push 0x685bd0
push str.BdThreadCountEx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4781e0
call fcn.004d9b00
neg eax
sbb eax, eax
and eax, 3
add eax, 7
mov dword [0x685bd0], eax
push eax
push str.BdThreadCountEx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea edx, [ebp - 0x33cc]
push edx
push str.BdThreadCount
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x478213
push str.BdThreadCount
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d58d0
lea eax, [ebp - 0x33cc]
push eax
push str.BdThreadCountX
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x478246
push str.BdThreadCountX
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d58d0
lea ecx, [ebp - 0x33cc]
push ecx
push str.BdThreadCountY
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x478279
push str.BdThreadCountY
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d58d0
lea edx, [ebp - 0x33cc]
push edx
push str.BdThreadCountZ
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x4782ac
push str.BdThreadCountZ
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d58d0
mov eax, dword [0x685bd0]
cmp eax, esi
jbe 0x4782ba
cmp eax, 0xa
jbe 0x4782c4
mov dword [0x685bd0], 0xa
push 0x6e8ba8
call fcn.004da7f0
push 0x6e8cc8
call fcn.004da7f0
push 0x6e8ce4
call fcn.004da7f0
push 0x6e8b8c
call fcn.004da7f0
push 0x6e8b74
call fcn.004da7f0
push 0x6e8d08
call fcn.004da7f0
push 0x6e8e18
call fcn.004da7f0
push 0x6e8c3c
call fcn.004da7f0
push 0x6e8b58
call fcn.004da7f0
push 0x6e8c54
call fcn.004da7f0
push 0x6e8cb0
call fcn.004da7f0
push 0x6e8c0c
call fcn.004da7f0
push 0x6e8b40
call fcn.004da7f0
push 0x6e8c24
call fcn.004da7f0
push 0x6e8e30
call fcn.004da7f0
push 0x6e8c98
call fcn.004da7f0
add esp, 0x40
push 0x6e8e48
call fcn.004da7f0
push 0x6e8c70
call fcn.004da7f0
push 0x6e8bc0
call fcn.004da7f0
add esp, 0xc
cmp dword [0x72bb6c], esi
je 0x47839c
cmp dword [0x72bb70], esi
je 0x478457
cmp dword [ebp + 0xc], esi
je 0x478457
push esi
push esi
push 0x445a20
call fcn.005e07ac
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4783ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_5__fails_with_error__d
lea eax, [ebp - 0x1980]
push eax
call fcn.005dfb23
push esi
mov ebx, 1
push ebx
lea ecx, [ebp - 0x1980]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x478402
push esi
push eax
push str.CBD_5f
call fcn.00420720
add esp, 0xc
mov ebx, 1
push esi
push esi
push 0x445b20
call fcn.005e07ac
add esp, 0xc
cmp eax, 0xffffffff
jne 0x478446
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_6__fails_with_error__d
lea edx, [ebp - 0x1b88]
push edx
call fcn.005dfb23
push esi
push ebx
lea eax, [ebp - 0x1b88]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x478468
push esi
push eax
push str.CBD_5g
call fcn.00420720
add esp, 0xc
jmp 0x478468
mov ebx, 1
mov dword [0x73297c], ebx
mov dword [0x732874], ebx
xor eax, eax
mov dword [0x6e8bdc], eax
mov dword [0x6e8be0], eax
mov dword [0x6e8be4], eax
mov dword [0x6e8be8], eax
mov dword [0x6e8bec], eax
mov dword [0x6e8bf0], eax
mov dword [0x6e8bf4], eax
mov dword [0x6e8bf8], eax
mov dword [0x6e8bfc], eax
mov dword [0x6e8c00], eax
mov dword [0x6e8c04], eax
cmp dword [0x685bd0], esi
jbe 0x4784c8
mov edi, 0x6e8d28
mov edi, edi
push edi
call fcn.004da7f0
add esp, 4
add esi, ebx
add edi, 0x18
cmp esi, dword [0x685bd0]
jb 0x4784b0
xor esi, esi
cmp dword [0x6ae138], esi
jbe 0x4784d6
mov dword [0x71de6c], ebx
mov dword [ebp - 0x3420], esi
mov dword [ebp - 0x3424], esi
push esi
push esi
lea ecx, [ebp - 0x3434]
push ecx
push esi
push esi
push esi
lea edx, [ebp - 0x3448]
push edx
push esi
lea eax, [ebp - 0x3424]
push eax
push esi
lea ecx, [ebp - 0x3420]
push ecx
call fcn.004d9f10
add esp, 0x2c
call fcn.0041bc80
call fcn.004d9870
mov dword [0x685b84], eax
cmp byte [0x6e9268], 0
jne 0x478587
push 0x6ae888
push 0x60c800
push 0x6e9268
call fcn.005dfb23
push esi
push 0x6e9268
call fcn.004e8c10
add esp, 0x14
cmp eax, ebx
jne 0x478575
mov eax, 0x6e9268
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x478551
mov edx, dword [str.avpMCfg.klr]
mov dword [eax], edx
mov ecx, dword [0x633b2c]
mov dword [eax + 4], ecx
mov edx, dword [0x633b30]
mov dword [eax + 8], edx
jmp 0x478587
push str.avpMCfg.klr
push 0x6e9268
call fcn.005dfb23
add esp, 8
cmp byte [0x6af8c8], 0
jne 0x4785a7
push 0x6af4b8
push str._sVistaeScanMon.lan
push 0x6af8c8
call fcn.005dfb23
add esp, 0xc
cmp byte [0x72bcc0], 0
jne 0x4785e1
push 0x6af4b8
push str._sMWAVSCAN.COM
push 0x72bcc0
call fcn.005dfb23
push ebx
push esi
push esi
push esi
push esi
push 0x72bcc0
call fcn.004e8950
add esp, 0x24
test eax, eax
je 0x4785e1
mov byte [0x72bcc0], 0
mov dword [ebp - 0x33cc], esi
lea eax, [ebp - 0x33cc]
push eax
push str.MonitorPrintJobs
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x33cc], esi
je 0x47860f
call fcn.0052b0c0
push str.avc3
call fcn.005110b0
mov dword [0x72d008], eax
call fcn.00431000
mov dword [0x72d004], eax
push 0x686200
push str.DeviceControlEnabled
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x6862d8
push str.AVCEnabled
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push esi
call fcn.004f7bd0
add esp, 4
mov dword [0x732740], eax
cmp eax, esi
jne 0x478674
mov dword [0x732748], esi
jmp 0x47868d
push 0x732748
push str.BlockEternalBlue
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x6e8d00
push str.SecurityMode
push str.SOFTWAREMicroWorldeConcealeConceal_FirewallCommon
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push esi
push 0x104
lea ecx, [ebp - 0x120]
push ecx
push 0x615678
push str.EPSEnabled
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [ebp - 0x120], 0x30
jne 0x4786d9
mov dword [0x6862e0], esi
push 0
push 0x104
lea edx, [ebp - 0x120]
push edx
push 0x60cf3c
push str.Consctl_enable
push 0x60c810
call fcn.004edfd0
add esp, 0x18
mov bl, 0x31
cmp byte [ebp - 0x120], bl
jne 0x478712
mov dword [0x732750], 1
push 0x72d35c
push str.ReadProtect
push str.SYSTEMCurrentControlSetServices_avdiskCDKey
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x72d56c
push str.WriteProtect
push str.SYSTEMCurrentControlSetServices_avdiskCDKey
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x47875f
mov eax, dword [0x72d56c]
cmp eax, 1
je 0x478756
test eax, eax
jne 0x47875f
push eax
call fcn.005d1b00
add esp, 4
cmp dword [0x72d35c], 1
jne 0x478772
mov dword [0x686208], 0
push 0x686220
push str.WebcamAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x686210
push str.USBTetheringAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x72d574
push str.PassType
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x686228
push str.BluetoothAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x686238
push str.WifiAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov esi, 0x800
mov dword [ebp - 0x33e4], esi
lea eax, [ebp - 0x33e4]
push eax
push 0x72ed80
push str.WifiSSIDAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
push 0x686230
push str.PrintersAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov dword [ebp - 0x33e4], esi
lea ecx, [ebp - 0x33e4]
push ecx
push 0x72dd80
push str.PrinterNamesAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
mov dword [ebp - 0x33e4], 0x3ff
lea edx, [ebp - 0x33e4]
push edx
push 0x72d578
push str.DeviceId
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
push 0x686240
push str.SDCardAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x686248
push str.Start
push str.SYSTEMCurrentControlSetServicesUsbStor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x686250
push str.CompositeUSBAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x686258
push str.ImagingDevicesAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x686260
push str.USBModemAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x686268
push str.USBOnTerminalClientsAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x686270
push str.WhiteListingAllowedWhenUSBPortsBlocked
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
call fcn.00551d80
mov dword [0x6862f8], eax
push 0x6afef0
push 0x208
push 0x730318
push 0x60c81c
push str.HTTPHost
push 0x60da74
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
push 0x730318
push 0x730520
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
cmp dword [0x6ae144], 0
je 0x4789e4
cmp dword [0x6b0768], 0
je 0x4789e4
mov byte [ebp - 0xf58], 0
push 0x103
push 0
lea eax, [ebp - 0xf57]
push eax
call fcn.005dfd60
add esp, 0xc
push 0x6afef0
push 0x104
lea ecx, [ebp - 0xf58]
push ecx
push 0x60c81c
push str.IPOnly
push 0x60da74
call esi
cmp byte [ebp - 0xf58], bl
jne 0x4789e4
push str.IPONLY_A
push 0x6aec98
push 0x6afef0
call fcn.0052c3f0
add esp, 0xc
push 0x6afef0
push 0x1000
push 0x730728
push 0x60c81c
push str.Servers
push 0x60da74
call esi
push 0x730728
push 0x731728
call edi
mov eax, dword [0x6b0554]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x478a44
push str.AddConnectNotify
push eax
call edi
mov dword [0x7330f8], eax
push str.CancelConnectNotify
mov edx, dword [0x6b0554]
push edx
call edi
mov dword [0x7330fc], eax
mov eax, dword [0x6b0554]
cmp dword [0x6ae144], 0
je 0x478bc7
cmp dword [0x72bb6c], 0
je 0x478a70
cmp dword [0x72bb70], 0
jne 0x478a70
test byte [0x6b0538], 1
je 0x478bc7
test eax, eax
je 0x478b45
push str.SendFileToAgent
push eax
call edi
mov dword [0x762364], eax
test eax, eax
je 0x478b2f
push str.SendFileToAgentEx
mov eax, dword [0x6b0554]
push eax
call edi
mov dword [0x76246c], eax
test eax, eax
jne 0x478ab8
push eax
push 1
push str._SECSERVER__Unable_to_get_ProcAddress_of_SendFileToAgentEx__Possibly_old_DNSLIB.DLL_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x762354
push str.GroupDebug
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x478af0
mov ecx, dword [0x762354]
push ecx
push str.GroupDebug
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov eax, dword [0x71de6c]
test eax, eax
je 0x478b0e
push 0
push eax
push str._SECSERVER__Starting_to_init_xSendFileToAgent__...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0
push 0
push 0
push 0
call dword [0x762364]
mov eax, dword [0x71de6c]
test eax, eax
je 0x478b45
push 0
push eax
push str._SECSERVER__Finished_xSendFileToAgent__...
jmp 0x478b38
push 0
push 1
push str._SECSERVER__Unable_to_get_ProcAddress_of_SendFileToAgent__Possibly_old_DNSLIB.DLL_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
push 0x6afef0
call fcn.00421480
add esp, 4
push 0x6afef0
push 0x40
push 0x686298
push 0x6181b4
push str.SecServer
push 0x60da74
call esi
push 0
push 0
push 0x44af50
call fcn.005e07ac
add esp, 0xc
cmp eax, 0xffffffff
jne 0x478bb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_v1AX__fails_with_error__d
lea edx, [ebp - 0x1674]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x1674]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x478bc7
push 0
push eax
push str.CBD_5h
call fcn.00420720
add esp, 0xc
push 0x732728
push 0x732730
push 0x6862e8
push 0x6afff8
call fcn.004ef5b0
xor esi, esi
cmp dword [0x6b079c], esi
jne 0x478c22
push esi
push 0x104
lea ecx, [ebp - 0x120]
push ecx
push 0x60cf3c
push str.SuspAppDetectEnabled
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [ebp - 0x120], bl
jne 0x478c28
mov dword [0x732738], 1
jmp 0x478c28
mov dword [0x732738], esi
cmp dword [0x6b07b8], esi
jne 0x478c5a
push 0x6e8d04
push 0x6e8bd8
push 0x6e8b70
push 0x6862f0
push 0x6afff8
call fcn.00514560
call fcn.00443700
mov dword [0x732758], eax
jmp 0x478c7a
mov dword [0x6862f0], esi
mov dword [0x6e8b70], esi
mov dword [0x6e8bd8], 4
mov dword [0x6e8d04], 1
push 2
call fcn.004fed90
push 0x104
push 0x732878
call fcn.004ebf90
add esp, 0xc
push 0x732878
push 0x732980
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call ebx
push 0x732980
call fcn.004e24e0
add esp, 4
push str.assembly_
push 0x732980
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
push 0x6b08d8
push 0x732a88
call ebx
push 0x732a88
call fcn.004e24e0
add esp, 4
push str.wdi_
push 0x732a88
call esi
push 0x6b08d8
push 0x732b90
call ebx
push 0x732b90
call fcn.004e24e0
add esp, 4
push str.LogFiles_
push 0x732b90
call esi
push 0x6b08d8
push 0x732c98
call ebx
push 0x732c98
call fcn.004e24e0
add esp, 4
push str.wfp_
push 0x732c98
call esi
push 0x732878
push 0x732da0
call ebx
push 0x732da0
call fcn.004e24e0
add esp, 4
push str.ResCache_
push 0x732da0
call esi
push 0x732878
push 0x732ea8
call ebx
push 0x732ea8
call fcn.004e24e0
add esp, 4
push str.PolicyDefinitions_
push 0x732ea8
call esi
push 0x732878
push 0x732fb0
call ebx
push 0x732fb0
call fcn.004e24e0
add esp, 4
push 0x6157e0
push 0x732fb0
call esi
call fcn.005dc980
push 0
push 0x732da0
call fcn.004e8c10
add esp, 8
cmp eax, 1
je 0x478dc2
mov byte [0x732da0], 0
mov edx, dword [0x686200]
mov dword [0x686204], edx
mov eax, dword [0x6862f8]
mov dword [0x6862fc], eax
mov ecx, dword [0x732740]
mov dword [0x732744], ecx
mov edx, dword [0x732748]
mov dword [0x73274c], edx
mov eax, dword [0x686208]
mov dword [0x68620c], eax
mov ecx, dword [0x72d35c]
mov dword [0x72d568], ecx
mov edx, dword [0x72d56c]
mov dword [0x72d570], edx
mov eax, dword [0x686220]
mov dword [0x686224], eax
mov ecx, dword [0x686210]
mov dword [0x686214], ecx
mov edx, dword [0x72d574]
mov dword [0x72dd78], edx
mov eax, dword [0x686228]
mov dword [0x68622c], eax
mov ecx, dword [0x686238]
mov dword [0x68623c], ecx
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x72ed80]
mov byte [eax + 0x72f580], cl
inc eax
test cl, cl
jne 0x478e50
mov edx, dword [0x686230]
mov dword [0x686234], edx
xor eax, eax
nop
mov cl, byte [eax + 0x72dd80]
mov byte [eax + 0x72e580], cl
inc eax
test cl, cl
jne 0x478e70
xor eax, eax
mov cl, byte [eax + 0x72d578]
mov byte [eax + 0x72d978], cl
inc eax
test cl, cl
jne 0x478e83
mov eax, dword [0x686240]
mov dword [0x686244], eax
mov ecx, dword [0x686248]
mov dword [0x68624c], ecx
mov edx, dword [0x686250]
mov dword [0x686254], edx
mov eax, dword [0x686258]
mov dword [0x68625c], eax
mov ecx, dword [0x686260]
mov dword [0x686264], ecx
mov edx, dword [0x686268]
mov dword [0x68626c], edx
mov eax, dword [0x686270]
mov dword [0x686274], eax
mov ecx, dword [0x6862d8]
mov dword [0x6862dc], ecx
mov edx, dword [0x6862e0]
mov dword [0x6862e4], edx
mov eax, dword [0x732750]
mov dword [0x732754], eax
mov ecx, dword [0x6e8d00]
mov dword [0x6e8c88], ecx
mov edx, dword [0x732728]
mov dword [0x73272c], edx
mov eax, dword [0x732738]
mov dword [0x73273c], eax
mov ecx, dword [0x6862e8]
mov dword [0x6862ec], ecx
mov edx, dword [0x732730]
mov dword [0x732734], edx
mov eax, dword [0x6862f0]
mov dword [0x6862f4], eax
mov ecx, dword [0x6e8b70]
mov dword [0x6e8cfc], ecx
mov edx, dword [0x6e8bd8]
mov dword [0x6e8c8c], edx
mov eax, dword [0x6e8d04]
mov dword [0x6e8d20], eax
mov ecx, dword [0x732758]
mov dword [0x73275c], ecx
push str.NetshIPChanged
push 0x60d9ec
push connect
call fcn.004e9430
push 0x69bacc
push str.IPChangeAllowed
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x478fea
mov edx, dword [0x69bacc]
push edx
push str.IPChangeAllowed
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 1
push 0
push 0
push 0
push 0
push 0x75f148
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x478fea
push 0x75f148
call fcn.004e0670
add esp, 4
push 0x69bbd4
push str.ProtectInterfaces
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479021
mov eax, dword [0x69bbd4]
push eax
push str.ProtectInterfaces
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov eax, dword [0x69bacc]
test eax, eax
jne 0x479036
mov dword [0x69bacc], 2
jmp 0x479045
cmp eax, 3
jne 0x479045
mov dword [0x69bacc], 0
cmp dword [0x72bb6c], 0
je 0x479060
cmp dword [0x72bb70], 0
jne 0x479060
test byte [0x6b0538], 2
je 0x4790d2
push 0
push 0
push 0x468340
call fcn.005e07ac
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4790b2
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str.Error:_beginthread_7__fails_with_error__d
lea ecx, [ebp - 0x1c8c]
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x1c8c]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4790d8
push 0
push eax
push str.CBD_5j
call fcn.00420720
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4790d8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x72bb6c], 0
je 0x4790f7
cmp dword [0x72bb70], 0
jne 0x4790f7
test byte [0x6b0538], 4
je 0x4791c5
push 0
push 0
push fcn.00551cb0
call fcn.005e07ac
add esp, 0xc
cmp eax, 0xffffffff
jne 0x47913b
call esi
push eax
push str.Error:_beginthread_8__fails_with_error__d
lea eax, [ebp - 0x1d90]
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x1d90]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x479155
mov dword [0x72bcbc], 1
push 0
push eax
push str.CBD_5k
call fcn.00420720
add esp, 0xc
cmp dword [0x75f144], 0
jne 0x4791c5
cmp dword [0x686278], 0
jbe 0x4791c5
push 0
push 0
push 0x54ee30
call fcn.005e07ac
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4791ab
call esi
push eax
push str.Error:_beginthread_8xx__fails_with_error__d
lea edx, [ebp - 0x23a8]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x23a8]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x4791c5
mov dword [0x75f144], 1
push 0
push eax
push str.CBD_5k_8xx
call fcn.00420720
add esp, 0xc
cmp dword [0x6ae144], 0
jne 0x4791db
test byte [0x6e91c4], 0x80
je 0x47928a
cmp dword [0x72bb6c], 0
je 0x4791f1
cmp dword [0x72bb74], 0
je 0x47928a
mov eax, dword [0x6b0554]
test eax, eax
je 0x479207
push str.SendCachedEvents
push eax
call edi
mov dword [0x6b07bc], eax
cmp dword [0x6b07bc], 0
je 0x47928a
cmp dword [0x6b07c0], 0
jne 0x47928a
mov dword [0x6b07c0], 1
push 0
push 1
push str._EVCACHE__Invoking_Cache_Events_Thread...
push 0x6aec98
call fcn.004311c0
push 0
push 0
push 0x417870
call fcn.005e07ac
add esp, 0x1c
cmp eax, 0xffffffff
jne 0x47927a
call esi
push eax
push str.Error:_beginthread_9__fails_with_error__d
lea ecx, [ebp - 0x1f98]
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x1f98]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x47928a
push 0
push eax
push str.CBD_5m
call fcn.00420720
add esp, 0xc
cmp dword [0x6ae144], 0
jne 0x4792ab
test byte [0x6e91c4], 0x80
jne 0x4792ab
mov dword [0x75f24c], 1
jmp 0x47933a
cmp dword [0x72bb6c], 0
je 0x4792c9
cmp dword [0x72bb74], 0
jne 0x4792c9
mov dword [0x75f24c], 1
jmp 0x47933a
cmp dword [0x67d7c4], 0
je 0x479330
xor edi, edi
push edi
push edi
push fcn.00467e50
call fcn.005e07ac
add esp, 0xc
cmp eax, 0xffffffff
jne 0x47931f
mov dword [0x75f24c], 1
call esi
push eax
push str.Error:_beginthread_a__fails_with_error__d
lea eax, [ebp - 0x27b8]
push eax
call fcn.005dfb23
push edi
push 1
lea ecx, [ebp - 0x27b8]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x47933c
push edi
push eax
push str.CBD_5n
call fcn.00420720
add esp, 0xc
jmp 0x47933c
push 0
call fcn.00467e50
add esp, 4
xor edi, edi
mov dword [ebp - 0x3408], edi
lea edx, [ebp - 0x3408]
push edx
call fcn.004d89c0
add esp, 4
mov eax, dword [ebp - 0x3408]
shr eax, 0xa
shr eax, 1
mov ecx, dword [0x685bd0]
shr ecx, 1
xor edx, edx
div ecx
cmp eax, 0x20
jbe 0x479379
mov dword [0x6861dc], 0x20
jmp 0x4793c0
cmp eax, 0x18
jbe 0x47938a
mov dword [0x6861dc], 0x18
jmp 0x4793c0
cmp eax, 0x10
jbe 0x47939b
mov dword [0x6861dc], 0x10
jmp 0x4793c0
cmp eax, 8
jbe 0x4793ac
mov dword [0x6861dc], 8
jmp 0x4793c0
mov edx, 4
cmp edx, eax
sbb eax, eax
and eax, 2
add eax, 2
mov dword [0x6861dc], eax
mov dword [0x7302d0], edi
push 0x7302d0
push str.DisableDateTimeModificationAllowRegCmd
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4793fe
mov ecx, dword [0x7302d0]
push ecx
push str.DisableDateTimeModificationAllowRegCmd
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov esi, 1
mov dword [0x686284], esi
push 0x686284
push str.BlockVSSAdmin
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479441
mov edx, dword [0x686284]
push edx
push str.BlockVSSAdmin
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x7302dc
push str.BlockBitLockerEx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov dword [0x7302d8], edi
push 0x7302d8
push str.BlockEdgeBrowser
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479497
mov eax, dword [0x7302d8]
push eax
push str.BlockEdgeBrowser
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x72bcb4], edi
push 0x72bcb4
push str.SecurityPatchEvent
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4794d5
mov ecx, dword [0x72bcb4]
push ecx
push str.SecurityPatchEvent
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x686288], esi
push 0x686288
push str.BlockNTVDM
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479513
mov edx, dword [0x686288]
push edx
push str.BlockNTVDM
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302e4], edi
push 0x7302e4
push str.BlockChromeSettingsResetOnUnload
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479550
mov eax, dword [0x7302e4]
push eax
push str.BlockChromeSettingsResetOnUnload
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302e0], edi
push 0x7302e0
push str.BlockChromeSettings
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47958e
mov ecx, dword [0x7302e0]
push ecx
push str.BlockChromeSettings
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push esi
push edi
mov edx, dword [0x7302e0]
push edx
call fcn.0044bee0
add esp, 0xc
mov dword [0x68628c], esi
push 0x68628c
push str.BlockUninstallers
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4795dc
mov eax, dword [0x68628c]
push eax
push str.BlockUninstallers
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302d4], edi
push 0x7302d4
push str.DisableDateTimeModification
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47961a
mov ecx, dword [0x7302d4]
push ecx
push str.DisableDateTimeModification
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x686290], esi
push 0x686290
push str.SVCHostWhiteListingEnabled
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479658
mov edx, dword [0x686290]
push edx
push str.SVCHostWhiteListingEnabled
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x72bdec
push str.AutoDownloadUpdatesOnRestart
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47969a
xor eax, eax
cmp dword [0x6ae144], edi
sete al
mov dword [0x72bdec], eax
push eax
push str.AutoDownloadUpdatesOnRestart
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x73019c], edi
push 0x73019c
push str.DeleteBrowserCacheOnBrowserStart
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4796d7
mov eax, dword [0x73019c]
push eax
push str.DeleteBrowserCacheOnBrowserStart
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x730094], edi
push 0x730094
push str.ScanGZWithoutExtension
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479715
mov ecx, dword [0x730094]
push ecx
push str.ScanGZWithoutExtension
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x72ff8c], edi
push 0x72ff8c
push str.BlockGMail
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479753
mov edx, dword [0x72ff8c]
push edx
push str.BlockGMail
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
call fcn.004f79d0
test eax, eax
je 0x47989f
mov dword [ebp - 0x33ec], edi
lea eax, [ebp - 0x33ec]
push eax
push str.GMSet
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x479791
cmp dword [ebp - 0x33ec], edi
jne 0x47989f
mov dword [ebp - 0x33e0], edi
mov dword [ebp - 0x33ec], esi
push esi
push str.GMSet
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push str.SOFTWAREPoliciesMicrosoftMicrosoftEdgeRecovery
lea ecx, [ebp - 0x1368]
push ecx
call ebx
lea edx, [ebp - 0x33e0]
push edx
push str.AutoRecover
lea eax, [ebp - 0x1368]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov ebx, 2
test al, al
je 0x4797ee
cmp dword [ebp - 0x33e0], ebx
je 0x479805
push ebx
push str.AutoRecover
lea ecx, [ebp - 0x1368]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
call fcn.004d96c0
test eax, eax
je 0x47989f
push esi
lea edx, [ebp - 0x33f4]
push edx
lea eax, [ebp - 0x1368]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004faef0
add esp, 0x10
test eax, eax
jne 0x47989f
mov dword [ebp - 0x3430], 4
lea ecx, [ebp - 0x3430]
push ecx
lea edx, [ebp - 0x33e0]
push edx
push edi
push edi
push str.AutoRecover
mov eax, dword [ebp - 0x33f4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x47986a
cmp dword [ebp - 0x33e0], ebx
je 0x47988e
mov dword [ebp - 0x33e0], ebx
push 4
lea ecx, [ebp - 0x33e0]
push ecx
push 4
push edi
push str.AutoRecover
mov edx, dword [ebp - 0x33f4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x33f4]
push eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
jmp 0x4798a5
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [0x6ae144], esi
je 0x4798fa
push 0x686278
push str.DiskFreeSpaceBelowPercentWarn
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4798e7
mov ecx, dword [0x686278]
push ecx
push str.DiskFreeSpaceBelowPercentWarn
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov eax, 0x64
cmp dword [0x686278], eax
jb 0x4798fa
sub dword [0x686278], eax
call fcn.004d9950
test eax, eax
je 0x47990a
call fcn.0044c210
jmp 0x479923
push 0x72fe84
push str.PrintScreenDisabled
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
mov dword [0x72dd7c], esi
push 0x72dd7c
push str.DeleteBrowserCache
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479961
mov edx, dword [0x72dd7c]
push edx
push str.DeleteBrowserCache
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [ebp - 0x343c], 0x103
lea eax, [ebp - 0x343c]
push eax
push 0x72bba0
push str.UnzipPassword
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
test al, al
jne 0x4799a8
push 0x72bba0
push str.UnzipPassword
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
mov edi, 1
mov dword [ebp - 0x3414], edi
lea ecx, [ebp - 0x3414]
push ecx
push str.DisableFWDriverOnPause
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x4799ed
mov edx, dword [ebp - 0x3414]
push edx
push str.DisableFWDriverOnPause
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x68627c], edi
push 0x68627c
push str.LogRotate
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479a2a
mov eax, dword [0x68627c]
push eax
push str.LogRotate
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x686280], edi
push 0x686280
push str.DLPEnabled
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479a68
mov ecx, dword [0x686280]
push ecx
push str.DLPEnabled
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302b8], esi
push 0x7302b8
push str.BlockDriverInstall
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479aa6
mov edx, dword [0x7302b8]
push edx
push str.BlockDriverInstall
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
call fcn.004d9b00
test eax, eax
je 0x479b39
mov dword [0x7302c8], esi
push 0x7302c8
push str.BlockHotspot
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479af0
mov eax, dword [0x7302c8]
push eax
push str.BlockHotspot
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push esi
mov ecx, dword [0x7302c8]
push ecx
call fcn.004456b0
add esp, 8
cmp dword [0x7302c8], esi
je 0x479b39
cmp dword [0x72bdd0], esi
jne 0x479b39
push esi
push esi
push 0x448e80
call fcn.005e07ac
add esp, 0xc
cmp eax, 0xffffffff
je 0x479b2a
mov dword [0x72bdd0], edi
push esi
push eax
push str.POL_5d
call fcn.00420720
add esp, 0xc
mov dword [0x7302bc], esi
push 0x7302bc
push str.BlockSafeMode
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479b77
mov edx, dword [0x7302bc]
push edx
push str.BlockSafeMode
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov eax, dword [0x7302bc]
cmp eax, 0xa
je 0x479ba2
cmp eax, 0xb
je 0x479ba2
push str.UseAlternateShell
push str.SYSTEMCurrentControlSetControlSafeBootOption
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
mov eax, dword [0x7302bc]
push eax
jmp 0x479bb2
call fcn.004d9b00
test eax, eax
je 0x479bba
mov ecx, dword [0x7302bc]
push ecx
call fcn.0044c140
add esp, 4
mov dword [0x7302b0], esi
push 0x7302b0
push str.RestrictedEnvironment
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479bf8
mov edx, dword [0x7302b0]
push edx
push str.RestrictedEnvironment
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302b4], esi
push 0x7302b4
push str.RestrictedEnvironmentExclusions
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479c35
mov eax, dword [0x7302b4]
push eax
push str.RestrictedEnvironmentExclusions
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302ac], esi
push 0x7302ac
push str.IgnoreScmEvent
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479c73
mov ecx, dword [0x7302ac]
push ecx
push str.IgnoreScmEvent
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302a8], esi
push 0x7302a8
push str.IgnorePowerShell
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479cb1
mov edx, dword [0x7302a8]
push edx
push str.IgnorePowerShell
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302a4], esi
push 0x7302a4
push str.LogProcessCmdLine
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479cee
mov eax, dword [0x7302a4]
push eax
push str.LogProcessCmdLine
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x7302b0], esi
je 0x479cfc
mov dword [0x7302a4], edi
mov dword [0x7302c0], esi
push 0x7302c0
push str.BlockADB
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479d3a
mov ecx, dword [0x7302c0]
push ecx
push str.BlockADB
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x7302b0], esi
je 0x479d48
mov dword [0x7302c0], edi
mov dword [0x7302c4], esi
push 0x7302c4
push str.BlockControlPanel
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479d86
mov edx, dword [0x7302c4]
push edx
push str.BlockControlPanel
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
xor ecx, ecx
mov eax, dword [0x7302c4]
cmp eax, esi
jne 0x479daf
cmp dword [0x7302b0], esi
je 0x479daf
cmp dword [0x7302b4], esi
je 0x479da8
lea eax, [ecx + 2]
mov ecx, edi
jmp 0x479daa
mov eax, edi
mov dword [0x7302c4], eax
test al, 2
jne 0x479dc2
push eax
call fcn.00445860
add esp, 4
test eax, eax
jne 0x479dd3
jmp 0x479dec
cmp ecx, esi
je 0x479dec
push esi
call fcn.00445860
add esp, 4
test eax, eax
je 0x479dec
push esi
push esi
push esi
call fcn.004ac210
test eax, eax
jne 0x479dec
push 0x618e20
call fcn.0050c680
add esp, 4
mov dword [0x7302ec], esi
push 0x7302ec
push str.BlockMMC
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479e29
mov eax, dword [0x7302ec]
push eax
push str.BlockMMC
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302f0], esi
push 0x7302f0
push str.BlockGPEdit
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479e67
mov ecx, dword [0x7302f0]
push ecx
push str.BlockGPEdit
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302e8], esi
push 0x7302e8
push str.DisableDevMgmt
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479ea5
mov edx, dword [0x7302e8]
push edx
push str.DisableDevMgmt
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302cc], esi
push 0x7302cc
push str.DisableAddOnAndExtensions
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479ee4
mov eax, dword [0x7302cc]
push eax
push str.DisableAddOnAndExtensions
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
jmp 0x479ef1
cmp dword [0x7302cc], esi
jne 0x479ef1
call fcn.00461e80
mov dword [0x7302f4], esi
push 0x7302f4
push str.DLLCacheDisable
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479f2f
mov ecx, dword [0x7302f4]
push ecx
push str.DLLCacheDisable
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov dword [0x7302f8], esi
push 0x7302f8
push str.SystemVolumeInformationScanEnabled
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479f6d
mov edx, dword [0x7302f8]
push edx
push str.SystemVolumeInformationScanEnabled
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x686294
push str.DWReplaceOnlyIfFileFoundInfected
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x479fa4
mov eax, dword [0x686294]
push eax
push str.DWReplaceOnlyIfFileFoundInfected
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [0x6861d0], 0xffffffff
jne 0x479fb7
call fcn.004a6b00
mov dword [0x6861d0], eax
lea ecx, [ebp - 0x33cc]
push ecx
push str.BlockUSBAutorunInf
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x479fea
push str.BlockUSBAutorunInf
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d58d0
lea edx, [ebp - 0x33cc]
push edx
push str.BlockUSBAutorunInfX
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x47a01d
push str.BlockUSBAutorunInfX
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d58d0
push 0x685b98
push str.BlockUSBAutorunInfEx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a04c
call fcn.004d99e0
neg eax
sbb eax, eax
inc eax
mov dword [0x685b98], eax
push eax
jmp 0x47a064
cmp dword [0x685b98], esi
je 0x47a078
call fcn.004d99e0
test eax, eax
je 0x47a078
mov dword [0x685b98], esi
push esi
push str.BlockUSBAutorunInfEx
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x72d24c
push str.PrefetchScan
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a0ba
xor eax, eax
cmp dword [0x6ae144], esi
sete al
mov dword [0x72d24c], eax
push eax
push str.PrefetchScan
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x68608c
push str.Cldbq
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a0f1
mov eax, dword [0x68608c]
push eax
push str.Cldbq
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x686194
push str.LimitCPUPercentODS
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a129
mov ecx, dword [0x686194]
push ecx
push str.LimitCPUPercentODS
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x68619c
push str.LimitCPUForODS
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a161
mov edx, dword [0x68619c]
push edx
push str.LimitCPUForODS
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x6861a0
push str.PostFile
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x6861a4
push str.CheckConnectedUsers
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a1b1
mov eax, dword [0x6861a4]
push eax
push str.CheckConnectedUsers
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x72be08
push str.CloudScanExtA
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a1e9
mov dword [0x72be08], esi
push esi
push str.CloudScanExtA
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x72be04
push str.LogScanTimes
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a221
mov dword [0x72be04], esi
push esi
push str.LogScanTimes
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x6861c4
push str.BlockSuspiciousEMailAttachments
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a259
mov dword [0x6861c4], edi
push edi
push str.BlockSuspiciousEMailAttachments
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x6861c8
push str.BlockSuspiciousDOCAttachments
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a291
mov dword [0x6861c8], edi
push edi
push str.BlockSuspiciousDOCAttachments
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x6861cc
push str.MonitorStartupTasksFolder
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a2c9
mov dword [0x6861cc], edi
push edi
push str.MonitorStartupTasksFolder
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x72be00
push str.BlockAllProxyPorts
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a301
mov dword [0x72be00], esi
push esi
push str.BlockAllProxyPorts
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
mov esi, 0x104
mov dword [ebp - 0x3400], esi
lea ecx, [ebp - 0x3400]
push ecx
push 0x72be10
push str.ProxyPortsAllowedA
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
test al, al
jne 0x47a360
mov ecx, 6
mov esi, str.1080_5865_8080_8580_8888
mov edi, 0x72be10
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x72be10
push str.ProxyPortsAllowedA
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
mov esi, 0x104
mov edi, 0x208
push str.ProxyPortsAllowed
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d58d0
mov dword [ebp - 0x3400], esi
lea edx, [ebp - 0x3400]
push edx
push 0x72bf18
push str.ProxyIPsAllowed
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
test al, al
jne 0x47a3bc
push 0x72bf18
push str.ProxyIPsAllowed
push str.SOFTWAREMicroWorldeScan_for_WindowsMwMonitor
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
push 0x72be0c
push str.ProxyLocalHostAllowed
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a3f9
mov dword [0x72be0c], 0
push 0
push str.ProxyLocalHostAllowed
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x72bdf8
push str.SmartScan
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a436
mov dword [0x72bdf8], 0
push 0
push str.SmartScan
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x6861c0
push str.MemScan
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a473
mov dword [0x6861c0], 1
push 1
push str.MemScan
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x72bdfc
push str.LNKCheck
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a4b0
mov dword [0x72bdfc], 0
push 0
push str.LNKCheck
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x72bdf4
push str.BstProc
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a505
mov dword [0x72bdf4], 0
push str.BstProc
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d58d0
mov eax, dword [0x72bdf4]
push eax
push str.BstProc
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea ecx, [ebp - 0x33cc]
push ecx
push str.MD5Log
push 0x60d9ec
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a544
mov dword [ebp - 0x33cc], 0
push 0
push str.MD5Log
push 0x60d9ec
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea edx, [ebp - 0x33cc]
push edx
push str.DoNotSetSecurityStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a583
mov dword [ebp - 0x33cc], 0
push 0
push str.DoNotSetSecurityStatus
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea eax, [ebp - 0x33cc]
push eax
push str.USBOnTerminalClientsAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a5c2
mov dword [ebp - 0x33cc], 1
push 1
push str.USBOnTerminalClientsAllowed
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea ecx, [ebp - 0x33cc]
push ecx
push str.USBOnTerminalClients_UnmountInvisibleVolumes
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a601
mov dword [ebp - 0x33cc], 1
push 1
push str.USBOnTerminalClients_UnmountInvisibleVolumes
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea edx, [ebp - 0x33cc]
push edx
push str.WhiteListingAllowedWhenUSBPortsBlocked
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a640
mov dword [ebp - 0x33cc], 1
push 1
push str.WhiteListingAllowedWhenUSBPortsBlocked
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push 0x686308
push str.WinLogonPFAInstances
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a691
mov dword [0x686308], 0xa
push 0xa
push str.WinLogonPFAInstances
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
push str.WinLogonPFAInstances
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d58d0
cmp dword [0x686308], 0
ja 0x47a6a4
mov dword [0x686308], 1
push 0x6861fc
push str.RestartConsctlOnDevCtrlChanges
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a6e1
mov dword [0x6861fc], 1
push 1
push str.RestartConsctlOnDevCtrlChanges
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea eax, [ebp - 0x33cc]
push eax
push str.AttentionTimeInSec
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
je 0x47a709
cmp dword [ebp - 0x33cc], 0xa
jne 0x47a729
push 0x14
push str.AttentionTimeInSec
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x33cc], 0x14
call fcn.004f48a0
lea ecx, [ebp - 0x33cc]
push ecx
push str.ProtectEBackup
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x47a768