Function at 0x14002beb0
Capabilities:
Create directory
Delete registry value
Disable system features via registry on windows
Get proxy
Persist via image file execution options registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9be0]
mov eax, 0x9ce0
call fcn.1400755f0
sub rsp, rax
mov qword [rbp + 0x18b0], 0xfffffffffffffffe
mov qword [rsp + 0x9d30], rbx
mov rax, qword [0x1400c0140]
xor rax, rsp
mov qword [rbp + 0x9bd0], rax
mov rsi, rdx
xor r13d, r13d
mov ebx, r13d
mov r15d, r13d
mov r12d, r13d
mov r14d, r13d
lea rdx, [rcx + 0x168]
lea r8, str._rkill
lea rcx, [rbp + 0x19b0]
call fcn.140018a10
nop
mov qword [rbp + 0x1950], 7
mov qword [rbp + 0x1948], r13
mov word [rbp + 0x1938], r13w
mov qword [rbp + 0x19f0], 7
mov qword [rbp + 0x19e8], r13
mov word [rbp + 0x19d8], r13w
mov dword [rsp + 0x58], r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [r13 + 4]
test eax, eax
jne 0x14002c945
mov dword [rsp + 0x60], ecx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.ProxyEnable
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002c945
cmp dword [rsp + 0x58], 1
jne 0x14002c945
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r13
mov word [rbp + 0x18c0], r13w
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r13
mov word [rbp + 0x1910], r13w
mov qword [rbp + 0x19a0], 7
mov qword [rbp + 0x1998], r13
mov word [rbp + 0x1988], r13w
lea rdx, str.Active_Proxy_Server_Detected_r_n_r_n
mov rcx, rsi
call fcn.140018560
mov r13, rax
xor eax, eax
mov edi, eax
mov rcx, qword [r13]
movsxd rcx, dword [rcx + 4]
test byte [rcx + r13 + 0x10], 6
jne 0x14002c06a
mov rcx, qword [rcx + r13 + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove edi, eax
mov rax, qword [r13]
movsxd rcx, dword [rax + 4]
add rcx, r13
test edi, edi
je 0x14002c090
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x14002c088
or edx, 4
xor r8d, r8d
call fcn.140003090
lea r9, str.ProxyOverride
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x1960]
call fcn.14001e270
mov rdi, rax
lea rax, [rbp + 0x18c0]
cmp rax, rdi
je 0x14002c14e
cmp qword [rbp + 0x18d8], 8
jb 0x14002c0da
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
mov qword [rbp + 0x18d8], 7
xor r13d, r13d
mov qword [rbp + 0x18d0], r13
mov word [rbp + 0x18c0], r13w
cmp qword [rdi + 0x18], 8
jae 0x14002c119
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rbp + 0x18c0]
call fcn.1400632b0
jmp 0x14002c126
mov rax, qword [rdi]
mov qword [rbp + 0x18c0], rax
mov qword [rdi], r13
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x18d0], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0x18d8], rax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r13
mov word [rdi], r13w
jmp 0x14002c151
xor r13d, r13d
cmp qword [rbp + 0x1978], 8
jb 0x14002c167
mov rcx, qword [rbp + 0x1960]
call fcn.140063290
lea r9, str.ProxyServer
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x1960]
call fcn.14001e270
mov rdi, rax
lea rax, [rbp + 0x1910]
cmp rax, rdi
je 0x14002c220
cmp qword [rbp + 0x1928], 8
jb 0x14002c1b1
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r13
mov word [rbp + 0x1910], r13w
cmp qword [rdi + 0x18], 8
jae 0x14002c1ed
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rbp + 0x1910]
call fcn.1400632b0
jmp 0x14002c1fa
mov rax, qword [rdi]
mov qword [rbp + 0x1910], rax
mov qword [rdi], r13
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x1920], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0x1928], rax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r13
mov word [rdi], r13w
cmp qword [rbp + 0x1978], 8
jb 0x14002c236
mov rcx, qword [rbp + 0x1960]
call fcn.140063290
lea r9, str.AutoConfigURL
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x1960]
call fcn.14001e270
mov rdi, rax
lea rax, [rbp + 0x1988]
cmp rax, rdi
je 0x14002c2ef
cmp qword [rbp + 0x19a0], 8
jb 0x14002c280
mov rcx, qword [rbp + 0x1988]
call fcn.140063290
mov qword [rbp + 0x19a0], 7
mov qword [rbp + 0x1998], r13
mov word [rbp + 0x1988], r13w
cmp qword [rdi + 0x18], 8
jae 0x14002c2bc
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rbp + 0x1988]
call fcn.1400632b0
jmp 0x14002c2c9
mov rax, qword [rdi]
mov qword [rbp + 0x1988], rax
mov qword [rdi], r13
mov rax, qword [rdi + 0x10]
mov qword [rbp + 0x1998], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp + 0x19a0], rax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r13
mov word [rdi], r13w
cmp qword [rbp + 0x1978], 8
jb 0x14002c305
mov rcx, qword [rbp + 0x1960]
call fcn.140063290
mov r8d, 0x50
lea rdx, str._HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_Settings__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r8d, 0x1d
lea rdx, str._ProxyEnable_dword:00000001_n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
lea rdx, [rbp + 0x18e8]
mov qword [rsp + 0x70], rdx
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r13
mov word [rbp + 0x18e8], r13w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x18c0]
lea rcx, [rbp + 0x18e8]
call fcn.1400015e0
nop
mov qword [rbp + 0x1978], 7
mov qword [rbp + 0x1970], r13
mov word [rbp + 0x1960], r13w
mov r8d, 0xd
lea rdx, str.ProxyOverride
lea rcx, [rbp + 0x1960]
call fcn.140001780
nop
lea r8, [rbp + 0x18e8]
lea rdx, [rbp + 0x1960]
lea rcx, [rbp + 0x1a00]
call fcn.140031ea0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1a18], 8
jb 0x14002c3f4
mov rcx, qword [rbp + 0x1a00]
call fcn.140063290
lea rax, [rbp + 0x18e8]
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r13
mov word [rbp + 0x18e8], r13w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x1910]
lea rcx, [rbp + 0x18e8]
call fcn.1400015e0
nop
mov qword [rbp + 0x1978], 7
mov qword [rbp + 0x1970], r13
mov word [rbp + 0x1960], r13w
mov r8d, 0xb
lea rdx, str.ProxyServer
lea rcx, [rbp + 0x1960]
call fcn.140001780
nop
lea r8, [rbp + 0x18e8]
lea rdx, [rbp + 0x1960]
lea rcx, [rbp + 0x1a00]
call fcn.140031ea0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1a18], 8
jb 0x14002c4b1
mov rcx, qword [rbp + 0x1a00]
call fcn.140063290
lea rax, [rbp + 0x18e8]
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r13
mov word [rbp + 0x18e8], r13w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x1988]
lea rcx, [rbp + 0x18e8]
call fcn.1400015e0
nop
mov qword [rbp + 0x1978], 7
mov qword [rbp + 0x1970], r13
mov word [rbp + 0x1960], r13w
mov r8d, 0xd
lea rdx, str.AutoConfigURL
lea rcx, [rbp + 0x1960]
call fcn.140001780
nop
lea r8, [rbp + 0x18e8]
lea rdx, [rbp + 0x1960]
lea rcx, [rbp + 0x1a00]
call fcn.140031ea0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1a18], 8
jb 0x14002c56e
mov rcx, qword [rbp + 0x1a00]
call fcn.140063290
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002c654
mov ecx, 4
mov dword [rsp + 0x28], ecx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, ecx
xor r8d, r8d
lea rdx, str.ProxyEnable
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14002c65f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__Proxy_Disabled._r_n
mov rcx, rsi
call fcn.140018560
mov r13, rax
xor eax, eax
mov edi, eax
mov rcx, qword [r13]
movsxd rcx, dword [rcx + 4]
test byte [rcx + r13 + 0x10], 6
jne 0x14002c62c
mov rcx, qword [rcx + r13 + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove edi, eax
mov rax, qword [r13]
movsxd rcx, dword [rax + 4]
add rcx, r13
test edi, edi
je 0x14002c65f
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x14002c64a
or edx, 4
xor r8d, r8d
call fcn.140003090
jmp 0x14002c65f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002c6a0
lea rdx, str.ProxyOverride
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002c6ab
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__ProxyOverride_value_deleted._r_n
mov rcx, rsi
call fcn.140018560
mov r13, rax
xor eax, eax
mov edi, eax
mov rcx, qword [r13]
movsxd rcx, dword [rcx + 4]
test byte [rcx + r13 + 0x10], 6
jne 0x14002c6e7
mov rcx, qword [rcx + r13 + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove edi, eax
mov rax, qword [r13]
movsxd rcx, dword [rax + 4]
add rcx, r13
test edi, edi
je 0x14002c70d
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x14002c705
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002c74e
lea rdx, str.ProxyServer
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002c759
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__ProxyServer_value_deleted._r_n
mov rcx, rsi
call fcn.140018560
mov r13, rax
xor eax, eax
mov edi, eax
mov rcx, qword [r13]
movsxd rcx, dword [rcx + 4]
test byte [rcx + r13 + 0x10], 6
jne 0x14002c795
mov rcx, qword [rcx + r13 + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove edi, eax
mov rax, qword [r13]
movsxd rcx, dword [rax + 4]
add rcx, r13
test edi, edi
je 0x14002c7bb
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x14002c7b3
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002c7fc
lea rdx, str.AutoConfigURL
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002c807
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__AutoConfigURL_value_deleted._r_n
mov rcx, rsi
call fcn.140018560
mov r13, rax
xor eax, eax
mov edi, eax
mov rcx, qword [r13]
movsxd rcx, dword [rcx + 4]
test byte [rcx + r13 + 0x10], 6
jne 0x14002c843
mov rcx, qword [rcx + r13 + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove edi, eax
mov rax, qword [r13]
movsxd rcx, dword [rax + 4]
add rcx, r13
test edi, edi
je 0x14002c869
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x14002c861
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.__Proxy_settings_were_backed_up_to_Registry_file._r_n_r_n
mov rcx, rsi
call fcn.140018560
mov r13, rax
xor eax, eax
mov edi, eax
mov rcx, qword [r13]
movsxd rcx, dword [rcx + 4]
test byte [rcx + r13 + 0x10], 6
jne 0x14002c8a5
mov rcx, qword [rcx + r13 + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove edi, eax
mov rax, qword [r13]
movsxd rcx, dword [rax + 4]
add rcx, r13
test edi, edi
je 0x14002c8cc
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], 0
jne 0x14002c8c3
or edx, 4
xor r8d, r8d
call fcn.140003090
nop
cmp qword [rbp + 0x19a0], 8
jb 0x14002c8e2
mov rcx, qword [rbp + 0x1988]
call fcn.140063290
mov qword [rbp + 0x19a0], 7
xor r13d, r13d
mov qword [rbp + 0x1998], r13
mov word [rbp + 0x1988], r13w
cmp qword [rbp + 0x1928], 8
jb 0x14002c915
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r13
mov word [rbp + 0x1910], r13w
cmp qword [rbp + 0x18d8], 8
jb 0x14002c945
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
lea rdx, str.Checking_Registry_for_malware_related_settings:_r_n_r_n
mov rcx, rsi
call fcn.140018560
mov r13, rax
xor eax, eax
mov edi, eax
mov rcx, qword [r13]
movsxd rcx, dword [rcx + 4]
test byte [rcx + r13 + 0x10], 6
jne 0x14002c981
mov rcx, qword [rcx + r13 + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove edi, eax
mov rax, qword [r13]
movsxd rcx, dword [rax + 4]
add rcx, r13
test edi, edi
je 0x14002c9a7
or edi, dword [rcx + 0x10]
cmp qword [rcx + 0x48], 0
jne 0x14002c99d
or edi, 4
xor r8d, r8d
mov edx, edi
call fcn.140003090
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002cc19
mov eax, 4
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.DisableCMD
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002cc19
cmp dword [rsp + 0x58], edi
je 0x14002cc19
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwarePoliciesMicrosoftWindowsSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002ca6d
lea rdx, str.DisableCMD
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002ca78
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__System_Policy_Removed:__DisableCMD__HKCU__r_n
mov rcx, rsi
call fcn.140018560
mov rbx, rax
xor r13d, r13d
mov edi, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14002cab4
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove edi, eax
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
test edi, edi
je 0x14002cad8
mov edx, dword [rcx + 0x10]
or edx, edi
cmp qword [rcx + 0x48], r13
jne 0x14002cad0
or edx, 4
xor r8d, r8d
call fcn.140003090
mov r8d, 0x40
lea rdx, str._n_HKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r13
mov word [rbp + 0x18c0], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._DisableCMD_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2744]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002cbb2
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r13
mov word [rbp + 0x18e8], r13w
cmp qword [rbp + 0x1928], 8
jb 0x14002cbe2
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r13
mov word [rbp + 0x1910], r13w
cmp qword [rbp + 0x18d8], 8
jb 0x14002cc12
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
mov ebx, 1
jmp 0x14002cc1c
xor r13d, r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002ce46
mov eax, 4
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.DisableRegistryTools
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002ce46
cmp dword [rsp + 0x58], edi
je 0x14002ce46
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002cce2
lea rdx, str.DisableRegistryTools
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002cced
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__System_Policy_Removed:__DisableRegistryTools__HKCU__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r8d, 0x4f
lea rdx, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r15d, 1
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r13
mov word [rbp + 0x18c0], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._DisableRegistryTools_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2940]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002cde4
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r13
mov word [rbp + 0x18e8], r13w
cmp qword [rbp + 0x1928], 8
jb 0x14002ce14
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r13
mov word [rbp + 0x1910], r13w
cmp qword [rbp + 0x18d8], 8
jb 0x14002ce44
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
inc ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13d, 4
test eax, eax
jne 0x14002d074
mov dword [rsp + 0x60], r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.DisableTaskMgr
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002d074
cmp dword [rsp + 0x58], edi
je 0x14002d074
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002cf0e
lea rdx, str.DisableTaskMgr
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002cf19
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__System_Policy_Removed:__DisableTaskMgr__HKCU__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
test r15d, r15d
jne 0x14002cf4c
lea r8d, [r15 + 0x4f]
lea rdx, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
xor r15d, r15d
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._DisableTaskMgr_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2940]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002d010
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x14002d040
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x14002d070
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
inc ebx
jmp 0x14002d077
xor r15d, r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002d29d
mov dword [rsp + 0x60], r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.NoRun
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002d29d
cmp dword [rsp + 0x58], edi
je 0x14002d29d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002d139
lea rdx, str.NoRun
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002d144
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__Explorer_Policy_Removed:__NoRun__HKCU__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r8d, 0x51
lea rdx, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r12d, 1
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._NoRun_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2940]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002d23b
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x14002d26b
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x14002d29b
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
inc ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002d4c7
mov dword [rsp + 0x60], r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.NoDesktop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002d4c7
cmp dword [rsp + 0x58], edi
je 0x14002d4c7
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002d35f
lea rdx, str.NoDesktop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002d36a
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__Explorer_Policy_Removed:__NoDesktop__HKCU__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
test r12d, r12d
jne 0x14002d3a4
lea r8d, [r12 + 0x51]
lea rdx, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r12d, 1
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._NoDesktop_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2940]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002d465
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x14002d495
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x14002d4c5
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
inc ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002d6f1
mov dword [rsp + 0x60], r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.NoSetActiveDesktop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002d6f1
cmp dword [rsp + 0x58], edi
je 0x14002d6f1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002d589
lea rdx, str.NoSetActiveDesktop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002d594
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__Explorer_Policy_Removed:__NoSetActiveDesktop__HKCU__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
test r12d, r12d
jne 0x14002d5ce
lea r8d, [r12 + 0x51]
lea rdx, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r12d, 1
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._NoSetActiveDesktop_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2940]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002d68f
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x14002d6bf
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x14002d6ef
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
inc ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002d94f
mov dword [rsp + 0x60], r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.DisallowRun
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002d94f
cmp dword [rsp + 0x58], edi
je 0x14002d94f
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002d7b3
lea rdx, str.DisallowRun
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002d7be
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__Explorer_Policy_Removed:__DisallowRun__HKCU__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
test r12d, r12d
jne 0x14002d7f2
lea r8d, [r12 + 0x51]
lea rdx, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._DisallowRun_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2940]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002d8b3
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x14002d8e3
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x14002d913
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
inc ebx
lea rcx, [rbp + 0x1a00]
call fcn.1400313b0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1a18], 8
jb 0x14002d94f
mov rcx, qword [rbp + 0x1a00]
call fcn.140063290
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002db6f
mov dword [rsp + 0x60], r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.HideIcons
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002db6f
cmp dword [rsp + 0x58], edi
je 0x14002db6f
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002da11
lea rdx, str.HideIcons
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002da1c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__Advanced_Explorer_Setting_Removed:__HideIcons__HKCU__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r8d, 0x51
lea rdx, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._HideIcons_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2940]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002db0d
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x14002db3d
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x14002db6d
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
inc ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002dd95
mov dword [rsp + 0x60], r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.NoRun
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002dd95
cmp dword [rsp + 0x58], edi
je 0x14002dd95
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002dc31
lea rdx, str.NoRun
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002dc3c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__Explorer_Policy_Removed:__NoRun__HKLM__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r8d, 0x52
lea rdx, str._n_HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r14d, 1
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._NoRun_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2940]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002dd33
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x14002dd63
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x14002dd93
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
inc ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002dfbe
mov dword [rsp + 0x60], r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.NoDesktop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002dfbe
cmp dword [rsp + 0x58], edi
je 0x14002dfbe
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002de57
lea rdx, str.NoDesktop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002de62
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__Explorer_Policy_Removed:__NoDesktop__HKLM__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
test r14d, r14d
jne 0x14002de9b
lea r8d, [r14 + 0x52]
lea rdx, str._n_HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r14d, 1
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._NoDesktop_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2940]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002df5c
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x14002df8c
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x14002dfbc
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
inc ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002e1e1
mov dword [rsp + 0x60], r13d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.NoSetActiveDesktop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002e1e1
cmp dword [rsp + 0x58], edi
je 0x14002e1e1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002e080
lea rdx, str.NoSetActiveDesktop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14002e08b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.__Explorer_Policy_Removed:__NoSetActiveDesktop__HKLM__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
test r14d, r14d
jne 0x14002e0be
lea r8d, [r14 + 0x52]
lea rdx, str._n_HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer__n
lea rcx, [rbp + 0x1938]
call fcn.140015a00
mov r9d, dword [rsp + 0x58]
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x1a40]
call fcn.140003500
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a40]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._NoSetActiveDesktop_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a2940]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14002e17f
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x14002e1af
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x14002e1df
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
inc ebx
lea rax, str.1.exe
mov qword [rbp - 0x80], rax
lea rax, str.2.exe
mov qword [rbp - 0x78], rax
lea rax, str.aAvgApi.exe
mov qword [rbp - 0x70], rax
lea rax, str.AAWTray.exe
mov qword [rbp - 0x68], rax
lea rax, str.About.exe
mov qword [rbp - 0x60], rax
lea rax, str.ackwin32.exe
mov qword [rbp - 0x58], rax
lea rax, str.adaware.exe
mov qword [rbp - 0x50], rax
lea rax, str.Ad_Aware.exe
mov qword [rbp - 0x48], rax
lea rax, str.advxdwin.exe
mov qword [rbp - 0x40], rax
lea rax, str.AdwarePrj.exe
mov qword [rbp - 0x38], rax
lea rax, str.a.exe
mov qword [rbp - 0x30], rax
lea rax, str.agent.exe
mov qword [rbp - 0x28], rax
lea rax, str.agentsvr.exe
mov qword [rbp - 0x20], rax
lea rax, str.agentw.exe
mov qword [rbp - 0x18], rax
lea rax, str.alertsvc.exe
mov qword [rbp - 0x10], rax
lea rax, str.alevir.exe
mov qword [rbp - 8], rax
lea rax, str.alogserv.exe
mov qword [rbp], rax
lea rax, str.AlphaAV
mov qword [rbp + 8], rax
lea rax, str.AlphaAV.exe
mov qword [rbp + 0x10], rax
lea rax, str.AluSchedulerSvc.exe
mov qword [rbp + 0x18], rax
lea rax, str.amon9x.exe
mov qword [rbp + 0x20], rax
lea rax, str.AntispywarXP2009.exe
mov qword [rbp + 0x28], rax
lea rax, str.anti_trojan.exe
mov qword [rbp + 0x30], rax
lea rax, str.antivirus.exe
mov qword [rbp + 0x38], rax
lea rax, str.AntivirusPlus
mov qword [rbp + 0x40], rax
lea rax, str.AntivirusPlus.exe
mov qword [rbp + 0x48], rax
lea rax, str.AntivirusPro_2010.exe
mov qword [rbp + 0x50], rax
lea rax, str.AntiVirus_Pro.exe
mov qword [rbp + 0x58], rax
lea rax, str.Anti_Virus_Professional.exe
mov qword [rbp + 0x60], rax
lea rax, str.AntivirusXP
mov qword [rbp + 0x68], rax
lea rax, str.AntivirusXP.exe
mov qword [rbp + 0x70], rax
lea rax, str.antivirusxppro2009.exe
mov qword [rbp + 0x78], rax
lea rax, str.ants.exe
mov qword [rbp + 0x80], rax
lea rax, str.apimonitor.exe
mov qword [rbp + 0x88], rax
lea rax, str.aplica32.exe
mov qword [rbp + 0x90], rax
lea rax, str.apvxdwin.exe
mov qword [rbp + 0x98], rax
lea rax, str.arr.exe
mov qword [rbp + 0xa0], rax
lea rax, str.ashAvast.exe
mov qword [rbp + 0xa8], rax
lea rax, str.ashBug.exe
mov qword [rbp + 0xb0], rax
lea rax, str.ashChest.exe
mov qword [rbp + 0xb8], rax
lea rax, str.ashCnsnt.exe
mov qword [rbp + 0xc0], rax
lea rax, str.ashDisp.exe
mov qword [rbp + 0xc8], rax
lea rax, str.ashLogV.exe
mov qword [rbp + 0xd0], rax
lea rax, str.ashMaiSv.exe
mov qword [rbp + 0xd8], rax
lea rax, str.ashPopWz.exe
mov qword [rbp + 0xe0], rax
lea rax, str.ashQuick.exe
mov qword [rbp + 0xe8], rax
lea rax, str.ashServ.exe
mov qword [rbp + 0xf0], rax
lea rax, str.ashSimp2.exe
mov qword [rbp + 0xf8], rax
lea rax, str.ashSimpl.exe
mov qword [rbp + 0x100], rax
lea rax, str.ashSkPcc.exe
mov qword [rbp + 0x108], rax
lea rax, str.ashSkPck.exe
mov qword [rbp + 0x110], rax
lea rax, str.ashUpd.exe
mov qword [rbp + 0x118], rax
lea rax, str.ashWebSv.exe
mov qword [rbp + 0x120], rax
lea rax, str.aswChLic.exe
mov qword [rbp + 0x128], rax
lea rax, str.aswRegSvr.exe
mov qword [rbp + 0x130], rax
lea rax, str.aswRunDll.exe
mov qword [rbp + 0x138], rax
lea rax, str.aswUpdSv.exe
mov qword [rbp + 0x140], rax
lea rax, str.atcon.exe
mov qword [rbp + 0x148], rax
lea rax, str.atguard.exe
mov qword [rbp + 0x150], rax
lea rax, str.atro55en.exe
mov qword [rbp + 0x158], rax
lea rax, str.atupdater.exe
mov qword [rbp + 0x160], rax
lea rax, str.atwatch.exe
mov qword [rbp + 0x168], rax
lea rax, str.au.exe
mov qword [rbp + 0x170], rax
lea rax, str.aupdate.exe
mov qword [rbp + 0x178], rax
lea rax, str.autodown.exe
mov qword [rbp + 0x180], rax
lea rax, str.auto_protect.nav80try.exe
mov qword [rbp + 0x188], rax
lea rax, str.autotrace.exe
mov qword [rbp + 0x190], rax
lea rax, str.autoupdate.exe
mov qword [rbp + 0x198], rax
lea rax, str.av360.exe
mov qword [rbp + 0x1a0], rax
lea rax, str.avadmin.exe
mov qword [rbp + 0x1a8], rax
lea rax, str.avastSvc.exe
mov qword [rbp + 0x1b0], rax
lea rax, str.AvastSvc.exe
mov qword [rbp + 0x1b8], rax
lea rax, str.avastUI.exe
mov qword [rbp + 0x1c0], rax
lea rax, str.AvastUI.exe
mov qword [rbp + 0x1c8], rax
lea rax, str.AVCare.exe
mov qword [rbp + 0x1d0], rax
lea rax, str.avcenter.exe
mov qword [rbp + 0x1d8], rax
lea rax, str.avciman.exe
mov qword [rbp + 0x1e0], rax
lea rax, str.avconfig.exe
mov qword [rbp + 0x1e8], rax
lea rax, str.avconsol.exe
mov qword [rbp + 0x1f0], rax
lea rax, str.ave32.exe
mov qword [rbp + 0x1f8], rax
lea rax, str.AVENGINE.exe
mov qword [rbp + 0x200], rax
lea rax, str.avgcc32.exe
mov qword [rbp + 0x208], rax
lea rax, str.avgchk.exe
mov qword [rbp + 0x210], rax
lea rax, str.avgcmgr.exe
mov qword [rbp + 0x218], rax
lea rax, str.avgcsrvx.exe
mov qword [rbp + 0x220], rax
lea rax, str.avgctrl.exe
mov qword [rbp + 0x228], rax
lea rax, str.avgdumpx.exe
mov qword [rbp + 0x230], rax
lea rax, str.avgemc.exe
mov qword [rbp + 0x238], rax
lea rax, str.avgidsagent.exe
mov qword [rbp + 0x240], rax
lea rax, str.avgiproxy.exe
mov qword [rbp + 0x248], rax
lea rax, str.avgnsx.exe
mov qword [rbp + 0x250], rax
lea rax, str.avgnt.exe
mov qword [rbp + 0x258], rax
lea rax, str.avgrsx.exe
mov qword [rbp + 0x260], rax
lea rax, str.avgscanx.exe
mov qword [rbp + 0x268], rax
lea rax, str.avgserv9.exe
mov qword [rbp + 0x270], rax
lea rax, str.avgserv.exe
mov qword [rbp + 0x278], rax
lea rax, str.avgsrmax.exe
mov qword [rbp + 0x280], rax
lea rax, str.avgtray.exe
mov qword [rbp + 0x288], rax
lea rax, str.avguard.exe
mov qword [rbp + 0x290], rax
lea rax, str.avgui.exe
mov qword [rbp + 0x298], rax
lea rax, str.avgupd.exe
mov qword [rbp + 0x2a0], rax
lea rax, str.avgwdsvc.exe
mov qword [rbp + 0x2a8], rax
lea rax, str.avgw.exe
mov qword [rbp + 0x2b0], rax
lea rax, str.Avira.OE.ServiceHost.exe
mov qword [rbp + 0x2b8], rax
lea rax, str.Avira.OE.Systray.exe
mov qword [rbp + 0x2c0], rax
lea rax, str.avkpop.exe
mov qword [rbp + 0x2c8], rax
lea rax, str.avkserv.exe
mov qword [rbp + 0x2d0], rax
lea rax, str.avkservice.exe
mov qword [rbp + 0x2d8], rax
lea rax, str.avkwctl9.exe
mov qword [rbp + 0x2e0], rax
lea rax, str.avltmain.exe
mov qword [rbp + 0x2e8], rax
lea rax, str.avmailc.exe
mov qword [rbp + 0x2f0], rax
lea rax, str.avmcdlg.exe
mov qword [rbp + 0x2f8], rax
lea rax, str.avnotify.exe
mov qword [rbp + 0x300], rax
lea rax, str.avnt.exe
mov qword [rbp + 0x308], rax
lea rax, str._avp32.exe
mov qword [rbp + 0x310], rax
lea rax, str.avp32.exe
mov qword [rbp + 0x318], rax
lea rax, str._avpcc.exe
mov qword [rbp + 0x320], rax
lea rax, str.avpcc.exe
mov qword [rbp + 0x328], rax
lea rax, str.avpdos32.exe
mov qword [rbp + 0x330], rax
lea rax, str.avp.exe
mov qword [rbp + 0x338], rax
lea rax, str._avpm.exe
mov qword [rbp + 0x340], rax
lea rax, str.avpm.exe
mov qword [rbp + 0x348], rax
lea rax, str.avptc32.exe
mov qword [rbp + 0x350], rax
lea rax, str.avpupd.exe
mov qword [rbp + 0x358], rax
lea rax, str.avsched32.exe
mov qword [rbp + 0x360], rax
lea rax, str.avshadow.exe
mov qword [rbp + 0x368], rax
lea rax, str.avsynmgr.exe
mov qword [rbp + 0x370], rax
lea rax, str.avupgsvc.exe
mov qword [rbp + 0x378], rax
lea rax, str.AVWEBGRD.exe
mov qword [rbp + 0x380], rax
lea rax, str.avwin95.exe
mov qword [rbp + 0x388], rax
lea rax, str.avwin.exe
mov qword [rbp + 0x390], rax
lea rax, str.avwinnt.exe
mov qword [rbp + 0x398], rax
lea rax, str.avwsc.exe
mov qword [rbp + 0x3a0], rax
lea rax, str.avwupd32.exe
mov qword [rbp + 0x3a8], rax
lea rax, str.avwupd.exe
mov qword [rbp + 0x3b0], rax
lea rax, str.avwupsrv.exe
mov qword [rbp + 0x3b8], rax
lea rax, str.avxmonitor9x.exe
mov qword [rbp + 0x3c0], rax
lea rax, str.avxmonitornt.exe
mov qword [rbp + 0x3c8], rax
lea rax, str.avxquar.exe
mov qword [rbp + 0x3d0], rax
lea rax, str.backweb.exe
mov qword [rbp + 0x3d8], rax
lea rax, str.bargains.exe
mov qword [rbp + 0x3e0], rax
lea rax, str.bdagent.exe
mov qword [rbp + 0x3e8], rax
lea rax, str.bdfvcl.exe
mov qword [rbp + 0x3f0], rax
lea rax, str.bdfvwiz.exe
mov qword [rbp + 0x3f8], rax
lea rax, str.BDInProcPatch.exe
mov qword [rbp + 0x400], rax
lea rax, str.bdmcon.exe
mov qword [rbp + 0x408], rax
lea rax, str.BDMsnScan.exe
mov qword [rbp + 0x410], rax
lea rax, str.bd_professional.exe
mov qword [rbp + 0x418], rax
lea rax, str.BDSurvey.exe
mov qword [rbp + 0x420], rax
lea rax, str.beagle.exe
mov qword [rbp + 0x428], rax
lea rax, str.belt.exe
mov qword [rbp + 0x430], rax
lea rax, str.b.exe
mov qword [rbp + 0x438], rax
lea rax, str.bidef.exe
mov qword [rbp + 0x440], rax
lea rax, str.bidserver.exe
mov qword [rbp + 0x448], rax
lea rax, str.bipcpevalsetup.exe
mov qword [rbp + 0x450], rax
lea rax, str.bipcp.exe
mov qword [rbp + 0x458], rax
lea rax, str.bisp.exe
mov qword [rbp + 0x460], rax
lea rax, str.blackd.exe
mov qword [rbp + 0x468], rax
lea rax, str.blackice.exe
mov qword [rbp + 0x470], rax
lea rax, str.blindman.exe
mov qword [rbp + 0x478], rax
lea rax, str.blink.exe
mov qword [rbp + 0x480], rax
lea rax, str.blss.exe
mov qword [rbp + 0x488], rax
lea rax, str.bootconf.exe
mov qword [rbp + 0x490], rax
lea rax, str.bootwarn.exe
mov qword [rbp + 0x498], rax
lea rax, str.borg2.exe
mov qword [rbp + 0x4a0], rax
lea rax, str.bpc.exe
mov qword [rbp + 0x4a8], rax
lea rax, str.brasil.exe
mov qword [rbp + 0x4b0], rax
lea rax, str.brastk.exe
mov qword [rbp + 0x4b8], rax
lea rax, str.brw.exe
mov qword [rbp + 0x4c0], rax
lea rax, str.bs120.exe
mov qword [rbp + 0x4c8], rax
lea rax, str.bspatch.exe
mov qword [rbp + 0x4d0], rax
lea rax, str.bundle.exe
mov qword [rbp + 0x4d8], rax
lea rax, str.bvt.exe
mov qword [rbp + 0x4e0], rax
lea rax, str.calc.exe
mov qword [rbp + 0x4e8], rax
lea rax, str.cavscan.exe
mov qword [rbp + 0x4f0], rax
lea rax, str.ccapp.exe
mov qword [rbp + 0x4f8], rax
lea rax, str.ccevtmgr.exe
mov qword [rbp + 0x500], rax
lea rax, str.ccpxysvc.exe
mov qword [rbp + 0x508], rax
lea rax, str.ccSvcHst.exe
mov qword [rbp + 0x510], rax
lea rax, str.ccuac.exe
mov qword [rbp + 0x518], rax
lea rax, str.cdp.exe
mov qword [rbp + 0x520], rax
lea rax, str.c.exe
mov qword [rbp + 0x528], rax
lea rax, str.cfd.exe
mov qword [rbp + 0x530], rax
lea rax, str.cfgwiz.exe
mov qword [rbp + 0x538], rax
lea rax, str.cfiadmin.exe
mov qword [rbp + 0x540], rax
lea rax, str.cfiaudit.exe
mov qword [rbp + 0x548], rax
lea rax, str.cfinet32.exe
mov qword [rbp + 0x550], rax
lea rax, str.cfinet.exe
mov qword [rbp + 0x558], rax
lea rax, str.cfpconfg.exe
mov qword [rbp + 0x560], rax
lea rax, str.cfp.exe
mov qword [rbp + 0x568], rax
lea rax, str.cfplogvw.exe
mov qword [rbp + 0x570], rax
lea rax, str.cfpupdat.exe
mov qword [rbp + 0x578], rax
lea rax, str.chrome.exe
mov qword [rbp + 0x580], rax
lea rax, str.claw95cf.exe
mov qword [rbp + 0x588], rax
lea rax, str.claw95.exe
mov qword [rbp + 0x590], rax
lea rax, str.cleaner3.exe
mov qword [rbp + 0x598], rax
lea rax, str.cleaner.exe
mov qword [rbp + 0x5a0], rax
lea rax, str.clean.exe
mov qword [rbp + 0x5a8], rax
lea rax, str.cleanIELow.exe
mov qword [rbp + 0x5b0], rax
lea rax, str.cleanpc.exe
mov qword [rbp + 0x5b8], rax
lea rax, str.click.exe
mov qword [rbp + 0x5c0], rax
lea rax, str.cmd32.exe
mov qword [rbp + 0x5c8], rax
lea rax, str.cmdagent.exe
mov qword [rbp + 0x5d0], rax
lea rax, str.cmesys.exe
mov qword [rbp + 0x5d8], rax
lea rax, str.cmgrdian.exe
mov qword [rbp + 0x5e0], rax
lea rax, str.cmon016.exe
mov qword [rbp + 0x5e8], rax
lea rax, str.combofix.exe
mov qword [rbp + 0x5f0], rax
lea rax, str.ComboFix.exe
mov qword [rbp + 0x5f8], rax
lea rax, str.connectionmonitor.exe
mov qword [rbp + 0x600], rax
lea rax, str.control
mov qword [rbp + 0x608], rax
lea rax, str.cpd.exe
mov qword [rbp + 0x610], rax
lea rax, str.cpf9x206.exe
mov qword [rbp + 0x618], rax
lea rax, str.cpfnt206.exe
mov qword [rbp + 0x620], rax
lea rax, str.crashrep.exe
mov qword [rbp + 0x628], rax
lea rax, str.csc.exe
mov qword [rbp + 0x630], rax
lea rax, str.cssconfg.exe
mov qword [rbp + 0x638], rax
lea rax, str.cssupdat.exe
mov qword [rbp + 0x640], rax
lea rax, str.cssurf.exe
mov qword [rbp + 0x648], rax
lea rax, str.ctrl.exe
mov qword [rbp + 0x650], rax
lea rax, str.cv.exe
mov qword [rbp + 0x658], rax
lea rax, str.cwnb181.exe
mov qword [rbp + 0x660], rax
lea rax, str.cwntdwmo.exe
mov qword [rbp + 0x668], rax
lea rax, str.datemanager.exe
mov qword [rbp + 0x670], rax
lea rax, str.dcomx.exe
mov qword [rbp + 0x678], rax
lea rax, str.defalert.exe
mov qword [rbp + 0x680], rax
lea rax, str.defscangui.exe
mov qword [rbp + 0x688], rax
lea rax, str.defwatch.exe
mov qword [rbp + 0x690], rax
lea rax, str.deloeminfs.exe
mov qword [rbp + 0x698], rax
lea rax, str.deputy.exe
mov qword [rbp + 0x6a0], rax
lea rax, str.d.exe
mov qword [rbp + 0x6a8], rax
lea rax, str.divx.exe
mov qword [rbp + 0x6b0], rax
lea rax, str.dllcache.exe
mov qword [rbp + 0x6b8], rax
lea rax, str.dllreg.exe
mov qword [rbp + 0x6c0], rax
lea rax, str.doors.exe
mov qword [rbp + 0x6c8], rax
lea rax, str.dop.exe
mov qword [rbp + 0x6d0], rax
lea rax, str.dpf.exe
mov qword [rbp + 0x6d8], rax
lea rax, str.dpfsetup.exe
mov qword [rbp + 0x6e0], rax
lea rax, str.dpps2.exe
mov qword [rbp + 0x6e8], rax
lea rax, str.driverctrl.exe
mov qword [rbp + 0x6f0], rax
lea rax, str.drwatson.exe
mov qword [rbp + 0x6f8], rax
lea rax, str.drweb32.exe
mov qword [rbp + 0x700], rax
lea rax, str.drwebupw.exe
mov qword [rbp + 0x708], rax
lea rax, str.dssagent.exe
mov qword [rbp + 0x710], rax
lea rax, str.dvp95_0.exe
mov qword [rbp + 0x718], rax
lea rax, str.dvp95.exe
mov qword [rbp + 0x720], rax
lea rax, str.ecengine.exe
mov qword [rbp + 0x728], rax
lea rax, str.efpeadm.exe
mov qword [rbp + 0x730], rax
lea rax, str.egui.exe
mov qword [rbp + 0x738], rax
lea rax, str.emsw.exe
mov qword [rbp + 0x740], rax
lea rax, str.ent.exe
mov qword [rbp + 0x748], rax
lea rax, str.esafe.exe
mov qword [rbp + 0x750], rax
lea rax, str.escanhnt.exe
mov qword [rbp + 0x758], rax
lea rax, str.escanv95.exe
mov qword [rbp + 0x760], rax
lea rax, str.espwatch.exe
mov qword [rbp + 0x768], rax
lea rax, str.ethereal.exe
mov qword [rbp + 0x770], rax
lea rax, str.etrustcipe.exe
mov qword [rbp + 0x778], rax
lea rax, str.evpn.exe
mov qword [rbp + 0x780], rax
lea rax, str.exantivirus_cnet.exe
mov qword [rbp + 0x788], rax
lea rax, str.exe.avxw.exe
mov qword [rbp + 0x790], rax
lea rax, str.expert.exe
mov qword [rbp + 0x798], rax
lea rax, str.explore.exe
mov qword [rbp + 0x7a0], rax
lea rax, str.fact.exe
mov qword [rbp + 0x7a8], rax
lea rax, str.f_agnt95.exe
mov qword [rbp + 0x7b0], rax
lea rax, str.fameh32.exe
mov qword [rbp + 0x7b8], rax
lea rax, str.fast.exe
mov qword [rbp + 0x7c0], rax
lea rax, str.fch32.exe
mov qword [rbp + 0x7c8], rax
lea rax, str.fih32.exe
mov qword [rbp + 0x7d0], rax
lea rax, str.findviru.exe
mov qword [rbp + 0x7d8], rax
lea rax, str.firefox.exe
mov qword [rbp + 0x7e0], rax
lea rax, str.firewall.exe
mov qword [rbp + 0x7e8], rax
lea rax, str.fixcfg.exe
mov qword [rbp + 0x7f0], rax
lea rax, str.fixexec.exe
mov qword [rbp + 0x7f8], rax
lea rax, str.fixfp.exe
mov qword [rbp + 0x800], rax
lea rax, str.fnrb32.exe
mov qword [rbp + 0x808], rax
lea rax, str.f_prot95.exe
mov qword [rbp + 0x810], rax
lea rax, str.f_prot.exe
mov qword [rbp + 0x818], rax
lea rax, str.fprot.exe
mov qword [rbp + 0x820], rax
lea rax, str.fp_win.exe
mov qword [rbp + 0x828], rax
lea rax, str.fp_win_trial.exe
mov qword [rbp + 0x830], rax
lea rax, str.frmwrk32.exe
mov qword [rbp + 0x838], rax
lea rax, str.frw.exe
mov qword [rbp + 0x840], rax
lea rax, str.fsaa.exe
mov qword [rbp + 0x848], rax
lea rax, str.fsav32.exe
mov qword [rbp + 0x850], rax
lea rax, str.fsav530stbyb.exe
mov qword [rbp + 0x858], rax
lea rax, str.fsav530wtbyb.exe
mov qword [rbp + 0x860], rax
lea rax, str.fsav95.exe
mov qword [rbp + 0x868], rax
lea rax, str.fsav.exe
mov qword [rbp + 0x870], rax
lea rax, str.fsgk32.exe
mov qword [rbp + 0x878], rax
lea rax, str.fsm32.exe
mov qword [rbp + 0x880], rax
lea rax, str.fsma32.exe
mov qword [rbp + 0x888], rax
lea rax, str.fsmb32.exe
mov qword [rbp + 0x890], rax
lea rax, str.f_stopw.exe
mov qword [rbp + 0x898], rax
lea rax, str.gator.exe
mov qword [rbp + 0x8a0], rax
lea rax, str.gav.exe
mov qword [rbp + 0x8a8], rax
lea rax, str.gbmenu.exe
mov qword [rbp + 0x8b0], rax
lea rax, str.gbn976rl.exe
mov qword [rbp + 0x8b8], rax
lea rax, str.gbpoll.exe
mov qword [rbp + 0x8c0], rax
lea rax, str.generics.exe
mov qword [rbp + 0x8c8], rax
lea rax, str.gmt.exe
mov qword [rbp + 0x8d0], rax
lea rax, str.guarddog.exe
mov qword [rbp + 0x8d8], rax
lea rax, str.guard.exe
mov qword [rbp + 0x8e0], rax
lea rax, str.guardgui.exe
mov qword [rbp + 0x8e8], rax
lea rax, str.guardxkickoff.exe
mov qword [rbp + 0x8f0], rax
lea rax, str.hacktracersetup.exe
mov qword [rbp + 0x8f8], rax
lea rax, str.hbinst.exe
mov qword [rbp + 0x900], rax
lea rax, str.hbsrv.exe
mov qword [rbp + 0x908], rax
lea rax, str.hijackthis.exe
mov qword [rbp + 0x910], rax
lea rax, str.History.exe
mov qword [rbp + 0x918], rax
lea rax, str.homeav2010.exe
mov qword [rbp + 0x920], rax
lea rax, str.hotactio.exe
mov qword [rbp + 0x928], rax
lea rax, str.hotpatch.exe
mov qword [rbp + 0x930], rax
lea rax, str.htlog.exe
mov qword [rbp + 0x938], rax
lea rax, str.htpatch.exe
mov qword [rbp + 0x940], rax
lea rax, str.hwpe.exe
mov qword [rbp + 0x948], rax
lea rax, str.hxdl.exe
mov qword [rbp + 0x950], rax
lea rax, str.hxiul.exe
mov qword [rbp + 0x958], rax
lea rax, str.iamapp.exe
mov qword [rbp + 0x960], rax
lea rax, str.iamserv.exe
mov qword [rbp + 0x968], rax
lea rax, str.iamstats.exe
mov qword [rbp + 0x970], rax
lea rax, str.ibmasn.exe
mov qword [rbp + 0x978], rax
lea rax, str.ibmavsp.exe
mov qword [rbp + 0x980], rax
lea rax, str.icload95.exe
mov qword [rbp + 0x988], rax
lea rax, str.icloadnt.exe
mov qword [rbp + 0x990], rax
lea rax, str.icmon.exe
mov qword [rbp + 0x998], rax
lea rax, str.icsupp95.exe
mov qword [rbp + 0x9a0], rax
lea rax, str.icsuppnt.exe
mov qword [rbp + 0x9a8], rax
lea rax, str.Identity.exe
mov qword [rbp + 0x9b0], rax
lea rax, str.idle.exe
mov qword [rbp + 0x9b8], rax
lea rax, str.iedll.exe
mov qword [rbp + 0x9c0], rax
lea rax, str.iedriver.exe
mov qword [rbp + 0x9c8], rax
lea rax, str.IEShow.exe
mov qword [rbp + 0x9d0], rax
lea rax, str.iexplore.exe
mov qword [rbp + 0x9d8], rax
lea rax, str.iface.exe
mov qword [rbp + 0x9e0], rax
lea rax, str.ifw2000.exe
mov qword [rbp + 0x9e8], rax
lea rax, str.inetlnfo.exe
mov qword [rbp + 0x9f0], rax
lea rax, str.infus.exe
mov qword [rbp + 0x9f8], rax
lea rax, str.infwin.exe
mov qword [rbp + 0xa00], rax
lea rax, str.init32.exe
mov qword [rbp + 0xa08], rax
lea rax, str.init.exe
mov qword [rbp + 0xa10], rax
lea rax, str.install_1_.exe
mov qword [rbp + 0xa18], rax
lea rax, str.install_2_.exe
mov qword [rbp + 0xa20], rax
lea rax, str.install_3_.exe
mov qword [rbp + 0xa28], rax
lea rax, str.install_4_.exe
mov qword [rbp + 0xa30], rax
lea rax, str.install_5_.exe
mov qword [rbp + 0xa38], rax
lea rax, str.instup.exe
mov qword [rbp + 0xa40], rax
lea rax, str.intdel.exe
mov qword [rbp + 0xa48], rax
lea rax, str.intren.exe
mov qword [rbp + 0xa50], rax
lea rax, str.iomon98.exe
mov qword [rbp + 0xa58], rax
lea rax, str.istsvc.exe
mov qword [rbp + 0xa60], rax
lea rax, str.itunes.exe
mov qword [rbp + 0xa68], rax
lea rax, str.jammer.exe
mov qword [rbp + 0xa70], rax
lea rax, str.jdbgmrg.exe
mov qword [rbp + 0xa78], rax
lea rax, str.jedi.exe
mov qword [rbp + 0xa80], rax
lea rax, str.JsRcGen.exe
mov qword [rbp + 0xa88], rax
lea rax, str.kavlite40eng.exe
mov qword [rbp + 0xa90], rax
lea rax, str.kavpers40eng.exe
mov qword [rbp + 0xa98], rax
lea rax, str.kavpf.exe
mov qword [rbp + 0xaa0], rax
lea rax, str.kazza.exe
mov qword [rbp + 0xaa8], rax
lea rax, str.keenvalue.exe
mov qword [rbp + 0xab0], rax
lea rax, str.kerio_pf_213_en_win.exe
mov qword [rbp + 0xab8], rax
lea rax, str.kerio_wrl_421_en_win.exe
mov qword [rbp + 0xac0], rax
lea rax, str.kerio_wrp_421_en_win.exe
mov qword [rbp + 0xac8], rax
lea rax, str.keyscrambler.exe
mov qword [rbp + 0xad0], rax
lea rax, str.killprocesssetup161.exe
mov qword [rbp + 0xad8], rax
lea rax, str.ldnetmon.exe
mov qword [rbp + 0xae0], rax
lea rax, str.ldpro.exe
mov qword [rbp + 0xae8], rax
lea rax, str.ldpromenu.exe
mov qword [rbp + 0xaf0], rax
lea rax, str.ldscan.exe
mov qword [rbp + 0xaf8], rax
lea rax, str.licmgr.exe
mov qword [rbp + 0xb00], rax
lea rax, str.limewire.exe
mov qword [rbp + 0xb08], rax
lea rax, str.lnetinfo.exe
mov qword [rbp + 0xb10], rax
lea rax, str.loader.exe
mov qword [rbp + 0xb18], rax
lea rax, str.localnet.exe
mov qword [rbp + 0xb20], rax
lea rax, str.lockdown2000.exe
mov qword [rbp + 0xb28], rax
lea rax, str.lockdown.exe
mov qword [rbp + 0xb30], rax
lea rax, str.lookout.exe
mov qword [rbp + 0xb38], rax
lea rax, str.lordpe.exe
mov qword [rbp + 0xb40], rax
lea rax, str.lsetup.exe
mov qword [rbp + 0xb48], rax
lea rax, str.luall.exe
mov qword [rbp + 0xb50], rax
lea rax, str.luau.exe
mov qword [rbp + 0xb58], rax
lea rax, str.lucomserver.exe
mov qword [rbp + 0xb60], rax
lea rax, str.luinit.exe
mov qword [rbp + 0xb68], rax
lea rax, str.luspt.exe
mov qword [rbp + 0xb70], rax
lea rax, str.MalwareRemoval.exe
mov qword [rbp + 0xb78], rax
lea rax, str.mapisvc32.exe
mov qword [rbp + 0xb80], rax
lea rax, str.mbam.exe
mov qword [rbp + 0xb88], rax
lea rax, str.mbamgui.exe
mov qword [rbp + 0xb90], rax
lea rax, str.mbampt.exe
mov qword [rbp + 0xb98], rax
lea rax, str.mbamscheduler.exe
mov qword [rbp + 0xba0], rax
lea rax, str.mbamservice.exe
mov qword [rbp + 0xba8], rax
lea rax, str.mcagent.exe
mov qword [rbp + 0xbb0], rax
lea rax, str.mcmnhdlr.exe
mov qword [rbp + 0xbb8], rax
lea rax, str.mcmpeng.exe
mov qword [rbp + 0xbc0], rax
lea rax, str.mcmscsvc.exe
mov qword [rbp + 0xbc8], rax
lea rax, str.mcnasvc.exe
mov qword [rbp + 0xbd0], rax
lea rax, str.mcproxy.exe
mov qword [rbp + 0xbd8], rax
lea rax, str.McSACore.exe
mov qword [rbp + 0xbe0], rax
lea rax, str.mcshell.exe
mov qword [rbp + 0xbe8], rax
lea rax, str.mcshield.exe
mov qword [rbp + 0xbf0], rax
lea rax, str.mcsysmon.exe
mov qword [rbp + 0xbf8], rax
lea rax, str.mctool.exe
mov qword [rbp + 0xc00], rax
lea rax, str.mcupdate.exe
mov qword [rbp + 0xc08], rax
lea rax, str.mcvsrte.exe
mov qword [rbp + 0xc10], rax
lea rax, str.mcvsshld.exe
mov qword [rbp + 0xc18], rax
lea rax, str.md.exe
mov qword [rbp + 0xc20], rax
lea rax, str.mfin32.exe
mov qword [rbp + 0xc28], rax
lea rax, str.mfw2en.exe
mov qword [rbp + 0xc30], rax
lea rax, str.mfweng3.02d30.exe
mov qword [rbp + 0xc38], rax
lea rax, str.mgavrtcl.exe
mov qword [rbp + 0xc40], rax
lea rax, str.mgavrte.exe
mov qword [rbp + 0xc48], rax
lea rax, str.mghtml.exe
mov qword [rbp + 0xc50], rax
lea rax, str.mgui.exe
mov qword [rbp + 0xc58], rax
lea rax, str.minilog.exe
mov qword [rbp + 0xc60], rax
lea rax, str.mmod.exe
mov qword [rbp + 0xc68], rax
lea rax, str.monitor.exe
mov qword [rbp + 0xc70], rax
lea rax, str.moolive.exe
mov qword [rbp + 0xc78], rax
lea rax, str.mostat.exe
mov qword [rbp + 0xc80], rax
lea rax, str.MpCmdRun.exe
mov qword [rbp + 0xc88], rax
lea rax, str.mpfagent.exe
mov qword [rbp + 0xc90], rax
lea rax, str.mpfservice.exe
mov qword [rbp + 0xc98], rax
lea rax, str.MPFSrv.exe
mov qword [rbp + 0xca0], rax
lea rax, str.mpftray.exe
mov qword [rbp + 0xca8], rax
lea rax, str.mrflux.exe
mov qword [rbp + 0xcb0], rax
lea rax, str.mrt.exe
mov qword [rbp + 0xcb8], rax
lea rax, str.msa.exe
mov qword [rbp + 0xcc0], rax
lea rax, str.msapp.exe
mov qword [rbp + 0xcc8], rax
lea rax, str.MSASCui.exe
mov qword [rbp + 0xcd0], rax
lea rax, str.msbb.exe
mov qword [rbp + 0xcd8], rax
lea rax, str.msblast.exe
mov qword [rbp + 0xce0], rax
lea rax, str.mscache.exe
mov qword [rbp + 0xce8], rax
lea rax, str.msccn32.exe
mov qword [rbp + 0xcf0], rax
lea rax, str.mscman.exe
mov qword [rbp + 0xcf8], rax
lea rax, str.msconfig
mov qword [rbp + 0xd00], rax
lea rax, str.msdm.exe
mov qword [rbp + 0xd08], rax
lea rax, str.msdos.exe
mov qword [rbp + 0xd10], rax
lea rax, str.msiexec16.exe
mov qword [rbp + 0xd18], rax
lea rax, str.mslaugh.exe
mov qword [rbp + 0xd20], rax
lea rax, str.msmgt.exe
mov qword [rbp + 0xd28], rax
lea rax, str.MsMpEng.exe
mov qword [rbp + 0xd30], rax
lea rax, str.msmsgri32.exe
mov qword [rbp + 0xd38], rax
lea rax, str.mspaint.exe
mov qword [rbp + 0xd40], rax
lea rax, str.msseces.exe
mov qword [rbp + 0xd48], rax
lea rax, str.mssmmc32.exe
mov qword [rbp + 0xd50], rax
lea rax, str.mssys.exe
mov qword [rbp + 0xd58], rax
lea rax, str.msvxd.exe
mov qword [rbp + 0xd60], rax
lea rax, str.mu0311ad.exe
mov qword [rbp + 0xd68], rax
lea rax, str.mwatch.exe
mov qword [rbp + 0xd70], rax
lea rax, str.n32scanw.exe
mov qword [rbp + 0xd78], rax
lea rax, str.navap.navapsvc.exe
mov qword [rbp + 0xd80], rax
lea rax, str.navapsvc.exe
mov qword [rbp + 0xd88], rax
lea rax, str.navapw32.exe
mov qword [rbp + 0xd90], rax
lea rax, str.navdx.exe
mov qword [rbp + 0xd98], rax
lea rax, str.nav.exe
mov qword [rbp + 0xda0], rax
lea rax, str.navlu32.exe
mov qword [rbp + 0xda8], rax
lea rax, str.navnt.exe
mov qword [rbp + 0xdb0], rax
lea rax, str.navstub.exe
mov qword [rbp + 0xdb8], rax
lea rax, str.navw32.exe
mov qword [rbp + 0xdc0], rax
lea rax, str.navwnt.exe
mov qword [rbp + 0xdc8], rax
lea rax, str.nc2000.exe
mov qword [rbp + 0xdd0], rax
lea rax, str.ncinst4.exe
mov qword [rbp + 0xdd8], rax
lea rax, str.ndd32.exe
mov qword [rbp + 0xde0], rax
lea rax, str.neomonitor.exe
mov qword [rbp + 0xde8], rax
lea rax, str.neowatchlog.exe
mov qword [rbp + 0xdf0], rax
lea rax, str.netarmor.exe
mov qword [rbp + 0xdf8], rax
lea rax, str.netd32.exe
mov qword [rbp + 0xe00], rax
lea rax, str.netinfo.exe
mov qword [rbp + 0xe08], rax
lea rax, str.netmon.exe
mov qword [rbp + 0xe10], rax
lea rax, str.netscanpro.exe
mov qword [rbp + 0xe18], rax
lea rax, str.netspyhunter_1.2.exe
mov qword [rbp + 0xe20], rax
lea rax, str.netutils.exe
mov qword [rbp + 0xe28], rax
lea rax, str.nisserv.exe
mov qword [rbp + 0xe30], rax
lea rax, str.nisum.exe
mov qword [rbp + 0xe38], rax
lea rax, str.nmain.exe
mov qword [rbp + 0xe40], rax
lea rax, str.nod32.exe
mov qword [rbp + 0xe48], rax
lea rax, str.normist.exe
mov qword [rbp + 0xe50], rax
lea rax, str.norton_internet_secu_3.0_407.exe
mov qword [rbp + 0xe58], rax
lea rax, str.notstart.exe
mov qword [rbp + 0xe60], rax
lea rax, str.npf40_tw_98_nt_me_2k.exe
mov qword [rbp + 0xe68], rax
lea rax, str.npfmessenger.exe
mov qword [rbp + 0xe70], rax
lea rax, str.nprotect.exe
mov qword [rbp + 0xe78], rax
lea rax, str.npscheck.exe
mov qword [rbp + 0xe80], rax
lea rax, str.npssvc.exe
mov qword [rbp + 0xe88], rax
lea rax, str.nsched32.exe
mov qword [rbp + 0xe90], rax
lea rax, str.nssys32.exe
mov qword [rbp + 0xe98], rax
lea rax, str.nstask32.exe
mov qword [rbp + 0xea0], rax
lea rax, str.nsupdate.exe
mov qword [rbp + 0xea8], rax
lea rax, str.nt.exe
mov qword [rbp + 0xeb0], rax
lea rax, str.ntrtscan.exe
mov qword [rbp + 0xeb8], rax
lea rax, str.ntvdm.exe
mov qword [rbp + 0xec0], rax
lea rax, str.ntxconfig.exe
mov qword [rbp + 0xec8], rax
lea rax, str.nui.exe
mov qword [rbp + 0xed0], rax
lea rax, str.nupgrade.exe
mov qword [rbp + 0xed8], rax
lea rax, str.nvarch16.exe
mov qword [rbp + 0xee0], rax
lea rax, str.nvc95.exe
mov qword [rbp + 0xee8], rax
lea rax, str.nvsvc32.exe
mov qword [rbp + 0xef0], rax
lea rax, str.nwinst4.exe
mov qword [rbp + 0xef8], rax
lea rax, str.nwservice.exe
mov qword [rbp + 0xf00], rax
lea rax, str.nwtool16.exe
mov qword [rbp + 0xf08], rax
lea rax, str.OAcat.exe
mov qword [rbp + 0xf10], rax
lea rax, str.OAhlp.exe
mov qword [rbp + 0xf18], rax
lea rax, str.OAReg.exe
mov qword [rbp + 0xf20], rax
lea rax, str.oasrv.exe
mov qword [rbp + 0xf28], rax
lea rax, str.oaui.exe
mov qword [rbp + 0xf30], rax
lea rax, str.oaview.exe
mov qword [rbp + 0xf38], rax
lea rax, str.ODSW.exe
mov qword [rbp + 0xf40], rax
lea rax, str.ollydbg.exe
mov qword [rbp + 0xf48], rax
lea rax, str.onsrvr.exe
mov qword [rbp + 0xf50], rax
lea rax, str.optimize.exe
mov qword [rbp + 0xf58], rax
lea rax, str.ostronet.exe
mov qword [rbp + 0xf60], rax
lea rax, str.otfix.exe
mov qword [rbp + 0xf68], rax
lea rax, str.outpost.exe
mov qword [rbp + 0xf70], rax
lea rax, str.outpostinstall.exe
mov qword [rbp + 0xf78], rax
lea rax, str.outpostproinstall.exe
mov qword [rbp + 0xf80], rax
lea rax, str.ozn695m5.exe
mov qword [rbp + 0xf88], rax
lea rax, str.padmin.exe
mov qword [rbp + 0xf90], rax
lea rax, str.panixk.exe
mov qword [rbp + 0xf98], rax
lea rax, str.patch.exe
mov qword [rbp + 0xfa0], rax
lea rax, str.pavcl.exe
mov qword [rbp + 0xfa8], rax
lea rax, str.pav.exe
mov qword [rbp + 0xfb0], rax
lea rax, str.PavFnSvr.exe
mov qword [rbp + 0xfb8], rax
lea rax, str.pavproxy.exe
mov qword [rbp + 0xfc0], rax
lea rax, str.pavprsrv.exe
mov qword [rbp + 0xfc8], rax
lea rax, str.pavsched.exe
mov qword [rbp + 0xfd0], rax
lea rax, str.pavsrv51.exe
mov qword [rbp + 0xfd8], rax
lea rax, str.pavw.exe
mov qword [rbp + 0xfe0], rax
lea rax, str.PC_Antispyware2010.exe
mov qword [rbp + 0xfe8], rax
lea rax, str.pccwin98.exe
mov qword [rbp + 0xff0], rax
lea rax, str.pc.exe
mov qword [rbp + 0xff8], rax
lea rax, str.pcfwallicon.exe
mov qword [rbp + 0x1000], rax
lea rax, str.pcip10117_0.exe
mov qword [rbp + 0x1008], rax
lea rax, str.pcscan.exe
mov qword [rbp + 0x1010], rax
lea rax, str.pctsAuxs.exe
mov qword [rbp + 0x1018], rax
lea rax, str.pctsGui.exe
mov qword [rbp + 0x1020], rax
lea rax, str.pctsSvc.exe
mov qword [rbp + 0x1028], rax
lea rax, str.pctsTray.exe
mov qword [rbp + 0x1030], rax
lea rax, str.pdfndr.exe
mov qword [rbp + 0x1038], rax
lea rax, str.pdsetup.exe
mov qword [rbp + 0x1040], rax
lea rax, str.PerAvir.exe
mov qword [rbp + 0x1048], rax
lea rax, str.periscope.exe
mov qword [rbp + 0x1050], rax
lea rax, str.persfw.exe
mov qword [rbp + 0x1058], rax
lea rax, str.personalguard
mov qword [rbp + 0x1060], rax
lea rax, str.personalguard.exe
mov qword [rbp + 0x1068], rax
lea rax, str.perswf.exe
mov qword [rbp + 0x1070], rax
lea rax, str.pf2.exe
mov qword [rbp + 0x1078], rax
lea rax, str.pfwadmin.exe
mov qword [rbp + 0x1080], rax
lea rax, str.pgmonitr.exe
mov qword [rbp + 0x1088], rax
lea rax, str.pingscan.exe
mov qword [rbp + 0x1090], rax
lea rax, str.platin.exe
mov qword [rbp + 0x1098], rax
lea rax, str.pop3trap.exe
mov qword [rbp + 0x10a0], rax
lea rax, str.poproxy.exe
mov qword [rbp + 0x10a8], rax
lea rax, str.popscan.exe
mov qword [rbp + 0x10b0], rax
lea rax, str.portdetective.exe
mov qword [rbp + 0x10b8], rax
lea rax, str.portmonitor.exe
mov qword [rbp + 0x10c0], rax
lea rax, str.powerscan.exe
mov qword [rbp + 0x10c8], rax
lea rax, str.ppinupdt.exe
mov qword [rbp + 0x10d0], rax
lea rax, str.pptbc.exe
mov qword [rbp + 0x10d8], rax
lea rax, str.ppvstop.exe
mov qword [rbp + 0x10e0], rax
lea rax, str.prizesurfer.exe
mov qword [rbp + 0x10e8], rax
lea rax, str.prmt.exe
mov qword [rbp + 0x10f0], rax
lea rax, str.prmvr.exe
mov qword [rbp + 0x10f8], rax
lea rax, str.procdump.exe
mov qword [rbp + 0x1100], rax
lea rax, str.processmonitor.exe
mov qword [rbp + 0x1108], rax
lea rax, str.procexplorerv1.0.exe
mov qword [rbp + 0x1110], rax
lea rax, str.programauditor.exe
mov qword [rbp + 0x1118], rax
lea rax, str.proport.exe
mov qword [rbp + 0x1120], rax
lea rax, str.protector.exe
mov qword [rbp + 0x1128], rax
lea rax, str.protectx.exe
mov qword [rbp + 0x1130], rax
lea rax, str.PSANCU.exe
mov qword [rbp + 0x1138], rax
lea rax, str.PSANHost.exe
mov qword [rbp + 0x1140], rax
lea rax, str.PSANToManager.exe
mov qword [rbp + 0x1148], rax
lea rax, str.PsCtrls.exe
mov qword [rbp + 0x1150], rax
lea rax, str.PsImSvc.exe
mov qword [rbp + 0x1158], rax
lea rax, str.PskSvc.exe
mov qword [rbp + 0x1160], rax
lea rax, str.pspf.exe
mov qword [rbp + 0x1168], rax
lea rax, str.PSUNMain.exe
mov qword [rbp + 0x1170], rax
lea rax, str.purge.exe
mov qword [rbp + 0x1178], rax
lea rax, str.qconsole.exe
mov qword [rbp + 0x1180], rax
lea rax, str.qh.exe
mov qword [rbp + 0x1188], rax
lea rax, str.qserver.exe
mov qword [rbp + 0x1190], rax
lea rax, str.QuickHealCleaner.exe
mov qword [rbp + 0x1198], rax
lea rax, str.Quick_Heal.exe
mov qword [rbp + 0x11a0], rax
lea rax, str.rapapp.exe
mov qword [rbp + 0x11a8], rax
lea rax, str.rav7.exe
mov qword [rbp + 0x11b0], rax
lea rax, str.rav7win.exe
mov qword [rbp + 0x11b8], rax
lea rax, str.rav8win32eng.exe
mov qword [rbp + 0x11c0], rax
lea rax, str.ray.exe
mov qword [rbp + 0x11c8], rax
lea rax, str.rb32.exe
mov qword [rbp + 0x11d0], rax
lea rax, str.rcsync.exe
mov qword [rbp + 0x11d8], rax
lea rax, str.realmon.exe
mov qword [rbp + 0x11e0], rax
lea rax, str.reged.exe
mov qword [rbp + 0x11e8], rax
lea rax, str.regedit.exe
mov qword [rbp + 0x11f0], rax
lea rax, str.regedt32.exe
mov qword [rbp + 0x11f8], rax
lea rax, str.rescue32.exe
mov qword [rbp + 0x1200], rax
lea rax, str.rescue.exe
mov qword [rbp + 0x1208], rax
lea rax, [0x1400a73b0]
mov qword [rbp + 0x1210], rax
lea rax, str.rrguard.exe
mov qword [rbp + 0x1218], rax
lea rax, str.rscdwld.exe
mov qword [rbp + 0x1220], rax
lea rax, str.rshell.exe
mov qword [rbp + 0x1228], rax
lea rax, str.rstrui.exe
mov qword [rbp + 0x1230], rax
lea rax, str.rtvscan.exe
mov qword [rbp + 0x1238], rax
lea rax, str.rtvscn95.exe
mov qword [rbp + 0x1240], rax
lea rax, str.rulaunch.exe
mov qword [rbp + 0x1248], rax
lea rax, str.rundll32.exe
mov qword [rbp + 0x1250], rax
lea rax, [0x1400a74a0]
mov qword [rbp + 0x1258], rax
lea rax, str.rwg.exe
mov qword [rbp + 0x1260], rax
lea rax, str.safari.exe
mov qword [rbp + 0x1268], rax
lea rax, str.SafetyKeeper.exe
mov qword [rbp + 0x1270], rax
lea rax, str.safeweb.exe
mov qword [rbp + 0x1278], rax
lea rax, str.sahagent.exe
mov qword [rbp + 0x1280], rax
lea rax, str.SaveArmor.exe
mov qword [rbp + 0x1288], rax
lea rax, str.SaveDefense.exe
mov qword [rbp + 0x1290], rax
lea rax, str.Save.exe
mov qword [rbp + 0x1298], rax
lea rax, str.SaveKeep.exe
mov qword [rbp + 0x12a0], rax
lea rax, str.savenow.exe
mov qword [rbp + 0x12a8], rax
lea rax, str.sbserv.exe
mov qword [rbp + 0x12b0], rax
lea rax, str.scam32.exe
mov qword [rbp + 0x12b8], rax
lea rax, str.scan32.exe
mov qword [rbp + 0x12c0], rax
lea rax, str.scan95.exe
mov qword [rbp + 0x12c8], rax
lea rax, str.scanpm.exe
mov qword [rbp + 0x12d0], rax
lea rax, str.sc.exe
mov qword [rbp + 0x12d8], rax
lea rax, str.scrscan.exe
mov qword [rbp + 0x12e0], rax
lea rax, str.SDFiles.exe
mov qword [rbp + 0x12e8], rax
lea rax, str.SDMain.exe
mov qword [rbp + 0x12f0], rax
lea rax, str.SDWinSec.exe
mov qword [rbp + 0x12f8], rax
lea rax, str.secureveteran.exe
mov qword [rbp + 0x1300], rax
lea rax, str.Secure_Veteran.exe
mov qword [rbp + 0x1308], rax
lea rax, str.Security_Center.exe
mov qword [rbp + 0x1310], rax
lea rax, str.SecurityFighter.exe
mov qword [rbp + 0x1318], rax
lea rax, str.securitysoldier.exe
mov qword [rbp + 0x1320], rax
lea rax, str.serv95.exe
mov qword [rbp + 0x1328], rax
lea rax, str.setloadorder.exe
mov qword [rbp + 0x1330], rax
lea rax, str.setup_flowprotector_us.exe
mov qword [rbp + 0x1338], rax
lea rax, str.setupvameeval.exe
mov qword [rbp + 0x1340], rax
lea rax, str.sgssfw32.exe
mov qword [rbp + 0x1348], rax
lea rax, str.shellspyinstall.exe
mov qword [rbp + 0x1350], rax
lea rax, str.sh.exe
mov qword [rbp + 0x1358], rax
lea rax, str.shield.exe
mov qword [rbp + 0x1360], rax
lea rax, str.shn.exe
mov qword [rbp + 0x1368], rax
lea rax, str.showbehind.exe
mov qword [rbp + 0x1370], rax
lea rax, str.signcheck.exe
mov qword [rbp + 0x1378], rax
lea rax, str.smart.exe
mov qword [rbp + 0x1380], rax
lea rax, str.smartprotector.exe
mov qword [rbp + 0x1388], rax
lea rax, str.smc.exe
mov qword [rbp + 0x1390], rax
lea rax, str.smrtdefp.exe
mov qword [rbp + 0x1398], rax
lea rax, str.sms.exe
mov qword [rbp + 0x13a0], rax
lea rax, str.smss32.exe
mov qword [rbp + 0x13a8], rax
lea rax, str.snetcfg.exe
mov qword [rbp + 0x13b0], rax
lea rax, str.soap.exe
mov qword [rbp + 0x13b8], rax
lea rax, str.sofi.exe
mov qword [rbp + 0x13c0], rax
lea rax, str.SoftSafeness.exe
mov qword [rbp + 0x13c8], rax
lea rax, str.sperm.exe
mov qword [rbp + 0x13d0], rax
lea rax, str.spf.exe
mov qword [rbp + 0x13d8], rax
lea rax, str.sphinx.exe
mov qword [rbp + 0x13e0], rax
lea rax, str.spoler.exe
mov qword [rbp + 0x13e8], rax
lea rax, str.spoolcv.exe
mov qword [rbp + 0x13f0], rax
lea rax, str.spoolsv32.exe
mov qword [rbp + 0x13f8], rax
lea rax, str.spybotsd.exe
mov qword [rbp + 0x1400], rax
lea rax, str.spywarexpguard.exe
mov qword [rbp + 0x1408], rax
lea rax, str.spyxx.exe
mov qword [rbp + 0x1410], rax
lea rax, str.srexe.exe
mov qword [rbp + 0x1418], rax
lea rax, str.srng.exe
mov qword [rbp + 0x1420], rax
lea rax, str.ss3edit.exe
mov qword [rbp + 0x1428], rax
lea rax, str.ssg_4104.exe
mov qword [rbp + 0x1430], rax
lea rax, str.ssgrate.exe
mov qword [rbp + 0x1438], rax
lea rax, str.st2.exe
mov qword [rbp + 0x1440], rax
lea rax, str.start.exe
mov qword [rbp + 0x1448], rax
lea rax, str.stcloader.exe
mov qword [rbp + 0x1450], rax
lea rax, str.supftrl.exe
mov qword [rbp + 0x1458], rax
lea rax, str.supporter5.exe
mov qword [rbp + 0x1460], rax
lea rax, str.support.exe
mov qword [rbp + 0x1468], rax
lea rax, str.svc.exe
mov qword [rbp + 0x1470], rax
lea rax, str.svchostc.exe
mov qword [rbp + 0x1478], rax
lea rax, str.svchosts.exe
mov qword [rbp + 0x1480], rax
lea rax, str.svshost.exe
mov qword [rbp + 0x1488], rax
lea rax, str.sweep95.exe
mov qword [rbp + 0x1490], rax
lea rax, str.sweepnet.sweepsrv.sys.swnetsup.exe
mov qword [rbp + 0x1498], rax
lea rax, str.symlcsvc.exe
mov qword [rbp + 0x14a0], rax
lea rax, str.symproxysvc.exe
mov qword [rbp + 0x14a8], rax
lea rax, str.symtray.exe
mov qword [rbp + 0x14b0], rax
lea rax, str.system32.exe
mov qword [rbp + 0x14b8], rax
lea rax, str.system.exe
mov qword [rbp + 0x14c0], rax
lea rax, str.sysupd.exe
mov qword [rbp + 0x14c8], rax
lea rax, str.tapinstall.exe
mov qword [rbp + 0x14d0], rax
lea rax, str.taskmgr.exe
mov qword [rbp + 0x14d8], rax
lea rax, str.taumon.exe
mov qword [rbp + 0x14e0], rax
lea rax, str.tbscan.exe
mov qword [rbp + 0x14e8], rax
lea rax, str.tca.exe
mov qword [rbp + 0x14f0], rax
lea rax, str.tc.exe
mov qword [rbp + 0x14f8], rax
lea rax, str.tcm.exe
mov qword [rbp + 0x1500], rax
lea rax, str.tds2_98.exe
mov qword [rbp + 0x1508], rax
lea rax, str.tds2_nt.exe
mov qword [rbp + 0x1510], rax
lea rax, str.tds_3.exe
mov qword [rbp + 0x1518], rax
lea rax, str.teekids.exe
mov qword [rbp + 0x1520], rax
lea rax, str.tfak5.exe
mov qword [rbp + 0x1528], rax
lea rax, str.tfak.exe
mov qword [rbp + 0x1530], rax
lea rax, str.tgbob.exe
mov qword [rbp + 0x1538], rax
lea rax, str.titanin.exe
mov qword [rbp + 0x1540], rax
lea rax, str.titaninxp.exe
mov qword [rbp + 0x1548], rax
lea rax, str.TPSrv.exe
mov qword [rbp + 0x1550], rax
lea rax, str.trickler.exe
mov qword [rbp + 0x1558], rax
lea rax, str.trjscan.exe
mov qword [rbp + 0x1560], rax
lea rax, str.trjsetup.exe
mov qword [rbp + 0x1568], rax
lea rax, str.trojantrap3.exe
mov qword [rbp + 0x1570], rax
lea rax, str.TrustWarrior.exe
mov qword [rbp + 0x1578], rax
lea rax, str.tsadbot.exe
mov qword [rbp + 0x1580], rax
lea rax, str.tsc.exe
mov qword [rbp + 0x1588], rax
lea rax, str.tvmd.exe
mov qword [rbp + 0x1590], rax
lea rax, str.tvtmd.exe
mov qword [rbp + 0x1598], rax
lea rax, str.undoboot.exe
mov qword [rbp + 0x15a0], rax
lea rax, str.unhide.exe
mov qword [rbp + 0x15a8], rax
lea rax, str.updat.exe
mov qword [rbp + 0x15b0], rax
lea rax, str.upgrad.exe
mov qword [rbp + 0x15b8], rax
lea rax, str.utpost.exe
mov qword [rbp + 0x15c0], rax
lea rax, str.vbcmserv.exe
mov qword [rbp + 0x15c8], rax
lea rax, str.vbcons.exe
mov qword [rbp + 0x15d0], rax
lea rax, str.vbust.exe
mov qword [rbp + 0x15d8], rax
lea rax, str.vbwin9x.exe
mov qword [rbp + 0x15e0], rax
lea rax, str.vbwinntw.exe
mov qword [rbp + 0x15e8], rax
lea rax, str.vcsetup.exe
mov qword [rbp + 0x15f0], rax
lea rax, str.vet32.exe
mov qword [rbp + 0x15f8], rax
lea rax, str.vet95.exe
mov qword [rbp + 0x1600], rax
lea rax, str.vettray.exe
mov qword [rbp + 0x1608], rax
lea rax, str.vfsetup.exe
mov qword [rbp + 0x1610], rax
lea rax, str.vir_help.exe
mov qword [rbp + 0x1618], rax
lea rax, str.virusmdpersonalfirewall.exe
mov qword [rbp + 0x1620], rax
lea rax, str.virusutilities.exe
mov qword [rbp + 0x1628], rax
lea rax, str.VisthAux.exe
mov qword [rbp + 0x1630], rax
lea rax, str.VisthLic.exe
mov qword [rbp + 0x1638], rax
lea rax, str.VisthUpd.exe
mov qword [rbp + 0x1640], rax
lea rax, str.vnlan300.exe
mov qword [rbp + 0x1648], rax
lea rax, str.vnpc3000.exe
mov qword [rbp + 0x1650], rax
lea rax, str.vpc32.exe
mov qword [rbp + 0x1658], rax
lea rax, str.vpc42.exe
mov qword [rbp + 0x1660], rax
lea rax, str.vpfw30s.exe
mov qword [rbp + 0x1668], rax
lea rax, str.vptray.exe
mov qword [rbp + 0x1670], rax
lea rax, str.vscan40.exe
mov qword [rbp + 0x1678], rax
lea rax, str.vscenu6.02d30.exe
mov qword [rbp + 0x1680], rax
lea rax, str.vsched.exe
mov qword [rbp + 0x1688], rax
lea rax, str.vsecomr.exe
mov qword [rbp + 0x1690], rax
lea rax, str.vshwin32.exe
mov qword [rbp + 0x1698], rax
lea rax, str.vsisetup.exe
mov qword [rbp + 0x16a0], rax
lea rax, str.vsmain.exe
mov qword [rbp + 0x16a8], rax
lea rax, str.vsmon.exe
mov qword [rbp + 0x16b0], rax
lea rax, str.vsstat.exe
mov qword [rbp + 0x16b8], rax
lea rax, str.vswin9xe.exe
mov qword [rbp + 0x16c0], rax
lea rax, str.vswinntse.exe
mov qword [rbp + 0x16c8], rax
lea rax, str.vswinperse.exe
mov qword [rbp + 0x16d0], rax
lea rax, str.w32dsm89.exe
mov qword [rbp + 0x16d8], rax
lea rax, str.W3asbas.exe
mov qword [rbp + 0x16e0], rax
lea rax, str.w9x.exe
mov qword [rbp + 0x16e8], rax
lea rax, str.watchdog.exe
mov qword [rbp + 0x16f0], rax
lea rax, str.webdav.exe
mov qword [rbp + 0x16f8], rax
lea rax, str.WebProxy.exe
mov qword [rbp + 0x1700], rax
lea rax, str.webscanx.exe
mov qword [rbp + 0x1708], rax
lea rax, str.webtrap.exe
mov qword [rbp + 0x1710], rax
lea rax, str.wfindv32.exe
mov qword [rbp + 0x1718], rax
lea rax, str.whoswatchingme.exe
mov qword [rbp + 0x1720], rax
lea rax, str.wimmun32.exe
mov qword [rbp + 0x1728], rax
lea rax, str.win32.exe
mov qword [rbp + 0x1730], rax
lea rax, str.win32us.exe
mov qword [rbp + 0x1738], rax
lea rax, str.winactive.exe
mov qword [rbp + 0x1740], rax
lea rax, str.winav.exe
mov qword [rbp + 0x1748], rax
lea rax, str.win_bugsfix.exe
mov qword [rbp + 0x1750], rax
lea rax, str.windll32.exe
mov qword [rbp + 0x1758], rax
lea rax, str.window.exe
mov qword [rbp + 0x1760], rax
lea rax, str.windows.exe
mov qword [rbp + 0x1768], rax
lea rax, str.windows_Police_Pro.exe
mov qword [rbp + 0x1770], rax
lea rax, str.wininetd.exe
mov qword [rbp + 0x1778], rax
lea rax, str.wininitx.exe
mov qword [rbp + 0x1780], rax
lea rax, str.winlogin.exe
mov qword [rbp + 0x1788], rax
lea rax, str.winmain.exe
mov qword [rbp + 0x1790], rax
lea rax, str.winppr32.exe
mov qword [rbp + 0x1798], rax
lea rax, str.winrecon.exe
mov qword [rbp + 0x17a0], rax
lea rax, str.winservn.exe
mov qword [rbp + 0x17a8], rax
lea rax, str.winssk32.exe
mov qword [rbp + 0x17b0], rax
lea rax, str.winstart001.exe
mov qword [rbp + 0x17b8], rax
lea rax, str.winstart.exe
mov qword [rbp + 0x17c0], rax
lea rax, str.wintsk32.exe
mov qword [rbp + 0x17c8], rax
lea rax, str.winupdate.exe
mov qword [rbp + 0x17d0], rax
lea rax, str.wireshark.exe
mov qword [rbp + 0x17d8], rax
lea rax, str.wkufind.exe
mov qword [rbp + 0x17e0], rax
lea rax, str.wmplayer.exe
mov qword [rbp + 0x17e8], rax
lea rax, str.wnad.exe
mov qword [rbp + 0x17f0], rax
lea rax, str.wnt.exe
mov qword [rbp + 0x17f8], rax
lea rax, str.wordpad.exe
mov qword [rbp + 0x1800], rax
lea rax, str.wradmin.exe
mov qword [rbp + 0x1808], rax
lea rax, str.wrctrl.exe
mov qword [rbp + 0x1810], rax
lea rax, str.wsbgate.exe
mov qword [rbp + 0x1818], rax
lea rax, str.wscfxas.exe
mov qword [rbp + 0x1820], rax
lea rax, str.wscfxav.exe
mov qword [rbp + 0x1828], rax
lea rax, str.wscfxfw.exe
mov qword [rbp + 0x1830], rax
lea rax, str.wsctool.exe
mov qword [rbp + 0x1838], rax
lea rax, str.wupdater.exe
mov qword [rbp + 0x1840], rax
lea rax, str.wupdt.exe
mov qword [rbp + 0x1848], rax
lea rax, str.wyvernworksfirewall.exe
mov qword [rbp + 0x1850], rax
lea rax, str.xp_antispyware.exe
mov qword [rbp + 0x1858], rax
lea rax, str.xpdeluxe.exe
mov qword [rbp + 0x1860], rax
lea rax, str.xpf202en.exe
mov qword [rbp + 0x1868], rax
lea rax, str.zapro.exe
mov qword [rbp + 0x1870], rax
lea rax, str.zapsetup3001.exe
mov qword [rbp + 0x1878], rax
lea rax, str.zatutor.exe
mov qword [rbp + 0x1880], rax
lea rax, str.zlclient.exe
mov qword [rbp + 0x1888], rax
mov qword [rbp + 0x1890], rax
lea rax, str.zonalm2601.exe
mov qword [rbp + 0x1898], rax
lea rax, str.zonealarm.exe
mov qword [rbp + 0x18a0], rax
mov r12, r15
lea r14, [0x1400c8450]
nop word [rax + rax]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
mov edx, 0x3fff
lea rcx, [rbp + 0x1bd0]
call fcn.140063700
mov r13, qword [rbp + r12*8 - 0x80]
mov r8, r13
mov edx, 0x3fff
lea rcx, [rbp + 0x1bd0]
call fcn.140067b74
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1bd0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x70]
test eax, eax
jne 0x1400310af
mov dword [rsp + 0x60], 0x2000
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.Debugger
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400310b5
lea r9, str.Debugger
lea r8, [rbp + 0x1bd0]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x1a00]
call fcn.14001e270
nop
mov rdx, rax
lea rcx, [rbp + 0x19d8]
call fcn.140001540
nop
cmp qword [rbp + 0x1a18], 8
jb 0x140030e71
mov rcx, qword [rbp + 0x1a00]
call fcn.140063290
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1bd0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1bd0]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._n_HKEY_LOCAL_MACHINE_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, [0x1400a8b5c]
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x140030f15
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x140030f45
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x140030f75
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
lea rax, [rbp + 0x18e8]
mov qword [rbp + 0x18b8], rax
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp + 0x19d8]
lea rcx, [rbp + 0x18e8]
call fcn.1400015e0
nop
mov qword [rbp + 0x1978], 7
mov qword [rbp + 0x1970], r15
mov word [rbp + 0x1960], r15w
mov r8d, 8
lea rdx, str.Debugger
lea rcx, [rbp + 0x1960]
call fcn.140001780
nop
lea r8, [rbp + 0x18e8]
lea rdx, [rbp + 0x1960]
lea rcx, [rbp + 0x1a00]
call fcn.140031ea0
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x1938]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1a18], 8
jb 0x140031034
mov rcx, qword [rbp + 0x1a00]
call fcn.140063290
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, [rbp + 0x1bd0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400310aa
lea rdx, str.Debugger
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x1400310aa
lea rdx, [0x1400a8bec]
mov rcx, rsi
call fcn.140018f30
mov rcx, rax
mov rdx, r13
call fcn.140018560
mov rcx, rax
lea rdx, str._debugger.__IFEO_Debugger_Deleted__r_n
call fcn.140018560
mov rcx, rax
call fcn.140003410
inc ebx
jmp 0x1400310b5
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r12
cmp r12, 0x325
jb 0x140030d90
test ebx, ebx
jne 0x1400310e0
lea rdx, [0x1400a8bf0]
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
cmp qword [rbp + 0x1948], 0
je 0x14003130e
lea rcx, [rbp + 0x19b0]
cmp qword [rbp + 0x19c8], 8
cmovae rcx, qword [rbp + 0x19b0]
xor edx, edx
call fcn.14006518c
test eax, eax
je 0x14003112f
lea rcx, [rbp + 0x19b0]
cmp qword [rbp + 0x19c8], 8
cmovae rcx, qword [rbp + 0x19b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ecx, ecx
call fcn.1400663d8
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x1988]
call fcn.1400660bc
lea r9, [rbp + 0x1988]
lea r8, str._m__d__Y__I__M__S
mov edx, 0x3f
lea rcx, [rbp + 0x1a00]
call fcn.140067a50
mov qword [rbp + 0x18d8], 7
mov qword [rbp + 0x18d0], r15
mov word [rbp + 0x18c0], r15w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x1a00]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x1a00]
lea rcx, [rbp + 0x18c0]
call fcn.140001780
nop
lea r8, [rbp + 0x18c0]
lea rdx, str._rkill_
lea rcx, [rbp + 0x1910]
call fcn.140039330
nop
lea r8, str..reg
mov rdx, rax
lea rcx, [rbp + 0x18e8]
call fcn.140018c70
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x19b0]
call fcn.1400158d0
nop
cmp qword [rbp + 0x1900], 8
jb 0x14003120f
mov rcx, qword [rbp + 0x18e8]
call fcn.140063290
mov qword [rbp + 0x1900], 7
mov qword [rbp + 0x18f8], r15
mov word [rbp + 0x18e8], r15w
cmp qword [rbp + 0x1928], 8
jb 0x14003123f
mov rcx, qword [rbp + 0x1910]
call fcn.140063290
mov qword [rbp + 0x1928], 7
mov qword [rbp + 0x1920], r15
mov word [rbp + 0x1910], r15w
cmp qword [rbp + 0x18d8], 8
jb 0x14003126f
mov rcx, qword [rbp + 0x18c0]
call fcn.140063290
lea rdx, [rbp + 0x19b0]
cmp qword [rbp + 0x19c8], 8
cmovae rdx, qword [rbp + 0x19b0]
lea r8, [0x14008da08]
lea rcx, [rsp + 0x68]
call fcn.140064c10
mov rdx, qword [rsp + 0x68]
lea rcx, str.REGEDIT4_n_n
call fcn.140067bfc
lea rcx, [rbp + 0x1938]
cmp qword [rbp + 0x1950], 8
cmovae rcx, qword [rbp + 0x1938]
mov rdx, qword [rsp + 0x68]
call fcn.140067bfc
mov rcx, qword [rsp + 0x68]
call fcn.1400650a4
call fcn.140031af0
lea rdx, str._r_nBackup_Registry_file_created_at:_r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x19b0]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rcx, rax
call fcn.140003410
nop
cmp qword [rbp + 0x19f0], 8
jb 0x140031324
mov rcx, qword [rbp + 0x19d8]
call fcn.140063290
mov qword [rbp + 0x19f0], 7
mov qword [rbp + 0x19e8], r15
mov word [rbp + 0x19d8], r15w
cmp qword [rbp + 0x1950], 8
jb 0x140031354
mov rcx, qword [rbp + 0x1938]
call fcn.140063290
mov qword [rbp + 0x1950], 7
mov qword [rbp + 0x1948], r15
mov word [rbp + 0x1938], r15w
cmp qword [rbp + 0x19c8], 8
jb 0x140031384
mov rcx, qword [rbp + 0x19b0]
call fcn.140063290
mov rcx, qword [rbp + 0x9bd0]
xor rcx, rsp
call fcn.140063080
mov rbx, qword [rsp + 0x9d30]
add rsp, 0x9ce0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret