Function at 0x481650
Capabilities:
Check for time delay via gettickcount
Create thread
Manipulate boot configuration
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6074db
mov eax, dword fs:[0]
push eax
mov eax, 0x17b9c
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x1b73]
push ebx
push eax
mov dword [ebp - 0x17a50], esi
mov dword [ebp - 0x17a8c], edi
mov byte [ebp - 0x1b74], bl
call fcn.005dfd60
push 0x3ff
lea ecx, [ebp - 0x65db]
push ebx
push ecx
mov byte [ebp - 0x65dc], bl
call fcn.005dfd60
push 0x103
lea edx, [ebp - 0x113]
push ebx
push edx
mov dword [ebp - 0x17afc], ebx
mov dword [ebp - 0x17a58], ebx
mov byte [ebp - 0x114], bl
call fcn.005dfd60
push 0x207
lea eax, [ebp - 0xc37]
push ebx
push eax
mov dword [ebp - 0x17a84], ebx
mov dword [ebp - 0x17ad4], ebx
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a64], ebx
mov dword [ebp - 0x17a5c], ebx
mov dword [ebp - 0x17a7c], ebx
mov dword [ebp - 0x17adc], ebx
mov byte [ebp - 0xc38], bl
call fcn.005dfd60
add esp, 0x30
mov dword [ebp - 0x17ad8], ebx
mov dword [ebp - 0x17ae0], ebx
mov dword [ebp - 0x17a74], ebx
cmp dword [0x72bb84], ebx
je 0x481796
lea ecx, [ebp - 0x17a74]
push ecx
push str.ARetPoint
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
test al, al
jne 0x481783
mov edx, dword [ebp - 0x17a74]
push edx
push str.ARetPoint
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
cmp dword [ebp - 0x17a74], 2
je 0x4890c1
mov esi, dword [ebp - 0x17a50]
cmp byte [0x740f58], bl
jne 0x4817d4
xor eax, eax
mov cl, byte [eax + 0x6b08d8]
mov byte [eax + 0x740f58], cl
inc eax
test cl, cl
jne 0x4817a0
push 0x740f58
call fcn.004e24e0
add esp, 4
push str.WinLogon.EXE
push 0x740f58
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, dword [ebp - 0x17a50]
cmp dword [ebp + 0x10], 1
jne 0x48185b
cmp esi, 4
jbe 0x48185b
push 1
push 0x400
lea eax, [ebp - 0x1b74]
push eax
lea ecx, [ebp - 0x65dc]
push ecx
push esi
call fcn.00541ce0
add esp, 0x14
cmp byte [ebp - 0x65dc], bl
je 0x48182b
lea edx, [ebp - 0x65dc]
push 0x740f58
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48182b
mov dword [ebp - 0x17afc], 1
mov ecx, dword [ebp - 0x17a50]
lea eax, [ebp - 0x1b74]
push eax
push ecx
mov byte [ebp - 0x1b74], bl
call fcn.005466d0
mov esi, dword [ebp - 0x17a50]
add esp, 8
cmp esi, dword [0x72bdf0]
jne 0x48185b
mov dword [0x72bdf0], ebx
cmp dword [ebp - 0x17a74], 3
je 0x4890c1
cmp dword [0x685b84], ebx
je 0x4818a7
cmp dword [0x72d24c], ebx
je 0x4818a7
cmp esi, ebx
je 0x4818a7
cmp dword [ebp + 0x10], 1
jne 0x4818a7
push 0x6e8c98
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [ebp - 0x17a50]
push edx
call fcn.00440840
add esp, 4
push 0x6e8c98
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x17a74], 4
je 0x4890c1
cmp dword [0x6ae138], 9
jae 0x4890c1
push 0xfff
lea eax, [ebp - 0x328f]
push ebx
push eax
mov byte [ebp - 0x3290], bl
call fcn.005dfd60
push 0x7ff
lea ecx, [ebp - 0x92b]
push ebx
push ecx
mov dword [ebp - 0x17a54], ebx
mov dword [ebp - 0x17a68], ebx
mov dword [ebp - 0x17ac8], ebx
mov dword [ebp - 0x17acc], ebx
mov dword [ebp - 0x17ab0], ebx
mov byte [ebp - 0x92c], bl
call fcn.005dfd60
push 0x7ff
lea edx, [ebp - 0xce4b]
push ebx
push edx
mov byte [ebp - 0xce4c], bl
call fcn.005dfd60
add esp, 0x24
mov dword [ebp - 0x17a90], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6e9080], eax
cmp dword [0x71de6c], ebx
je 0x481aeb
push 0x103
lea eax, [ebp - 0xa2f]
push ebx
push eax
mov byte [ebp - 0xa30], bl
call fcn.005dfd60
mov eax, dword [ebp + 0x10]
mov edx, dword [0x6369b4]
add esp, 0xc
test al, 1
je 0x4819d7
cmp byte [ebp - 0xa30], bl
je 0x481990
lea edi, [ebp - 0xa30]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x481980
mov dword [edi], edx
mov edi, dword [ebp - 0x17a8c]
lea eax, [ebp - 0xa30]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x481997
mov ecx, dword [str.FLAGS_NOTIFY_REMOVE_PID]
mov dword [eax], ecx
mov ecx, dword [0x6369a0]
mov dword [eax + 4], ecx
mov ecx, dword [0x6369a4]
mov dword [eax + 8], ecx
mov ecx, dword [0x6369a8]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x6369ac]
mov dword [eax + 0x10], ecx
mov ecx, dword [0x6369b0]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp + 0x10]
test al, 2
je 0x481a1e
cmp byte [ebp - 0xa30], bl
je 0x4819fa
lea edi, [ebp - 0xa30]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4819f0
mov dword [edi], edx
lea edi, [ebp - 0xa30]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x481a01
mov eax, dword [ebp + 0x10]
mov ecx, 7
mov esi, str.FLAGS_NOTIFY_NOT_AUTOBYPASS
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x17a8c]
test eax, 0x10000
je 0x481a64
cmp byte [ebp - 0xa30], bl
je 0x481a3e
lea edi, [ebp - 0xa30]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x481a34
mov dword [edi], edx
lea edi, [ebp - 0xa30]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x481a45
mov eax, dword [ebp + 0x10]
mov ecx, 9
mov esi, str.FLAGS_NOTIFY_EXPLICITLY_REQUEST_REPLY
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x17a8c]
cmp byte [ebp - 0xa30], bl
jne 0x481a84
push eax
lea edx, [ebp - 0xa30]
push str.FLAGS_NOTIFY_UNKNOWN__0x_d_
push edx
call fcn.005dfb23
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp - 0x17a50]
lea ecx, [ebp - 0xa30]
cmp edi, ebx
je 0x481abd
cmp word [edi], bx
je 0x481ab3
push edi
push ecx
push eax
push edx
lea eax, [ebp - 0x3290]
push str.___ProcNotify__Pid___ld__dwF___ld___s___Name:_S_
push eax
call fcn.005dfb23
add esp, 0x18
jmp 0x481ad4
push ecx
push eax
push edx
push str.___ProcNotify__Pid___ld__dwF___ld___s___Name:_BLANK__
jmp 0x481ac5
push eax
push ecx
push edx
push str.___ProcNotify__Pid___ld__dwF___ld___s___Name:_NULL__
lea eax, [ebp - 0x3290]
push eax
call fcn.005dfb23
add esp, 0x14
push ebx
push 1
lea ecx, [ebp - 0x3290]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp edi, ebx
je 0x48711f
cmp word [edi], bx
je 0x48711f
cmp dword [ebp - 0x17a50], ebx
je 0x48711f
lea edx, [ebp - 0x17a54]
push edx
push edi
call fcn.004da960
add esp, 8
cmp eax, 1
jne 0x48711f
mov ecx, dword [ebp - 0x17a54]
cmp ecx, ebx
je 0x4886cc
cmp byte [ecx], bl
je 0x48711f
mov eax, dword [ebp - 0x17a74]
mov dword [ebp - 0x17a9c], ebx
mov dword [ebp - 0x17a80], ebx
cmp eax, 5
je 0x4890c1
cmp dword [ebp + 0x10], 1
je 0x481baa
cmp dword [ebp - 0x17a50], 4
jbe 0x481baa
cmp eax, 6
je 0x4890c1
lea eax, [ebp - 0x17ad8]
push eax
push ecx
call fcn.0045cbb0
add esp, 8
cmp dword [ebp - 0x17a74], 7
je 0x4890c1
mov edx, dword [ebp - 0x17a54]
mov eax, dword [ebp - 0x17a50]
lea ecx, [ebp - 0x1b74]
push ecx
push edx
push eax
call fcn.00545880
mov eax, dword [ebp - 0x17a74]
add esp, 0xc
cmp eax, 8
je 0x4890c1
mov ecx, dword [ebp - 0x17a54]
push 0x5c
push ecx
call fcn.005e0a00
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x481bf4
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc esi
push esi
lea edx, [ebp - 0x92c]
push edx
call edi
mov bl, byte [esi]
mov byte [esi], 0
mov eax, dword [ebp - 0x17a54]
push eax
lea ecx, [ebp - 0xce4c]
push ecx
call edi
mov byte [esi], bl
jmp 0x481c08
mov edx, dword [ebp - 0x17a54]
push edx
lea eax, [ebp - 0x92c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x92c]
push 0x2e
push ecx
call fcn.005e0a00
add esp, 8
mov dword [ebp - 0x17a90], eax
test eax, eax
je 0x481c2a
inc eax
mov dword [ebp - 0x17a90], eax
cmp dword [ebp - 0x17a74], 9
je 0x4890c1
mov eax, dword [ebp - 0x17a50]
lea edx, [ebp - 0x17ac8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x481c69
mov ecx, dword [ebp - 0x17ac8]
push ecx
push 0
mov esi, 1
call fcn.0045c3b0
add esp, 8
mov edi, eax
jmp 0x481c71
mov esi, dword [ebp - 0x17acc]
mov edi, esi
cmp dword [ebp - 0x17a74], 0xa
je 0x4890c1
mov edx, dword [ebp - 0x17a50]
push edx
call fcn.004f28b0
mov dword [ebp - 0x17a68], eax
test esi, esi
je 0x481cf0
test edi, edi
jne 0x481cc4
mov ecx, dword [ebp - 0x17ac8]
mov edx, dword [ebp - 0x17a54]
push ecx
push eax
mov eax, dword [ebp - 0x17a50]
push edx
push eax
lea ecx, [ebp - 0x3290]
push str._CPL______d__New_Process_Started___s__ppid:_d___Console:_d_
push ecx
call fcn.005dfb23
add esp, 0x18
jmp 0x481d13
mov edx, dword [ebp - 0x17ac8]
mov ecx, dword [ebp - 0x17a50]
push edx
push eax
mov eax, dword [ebp - 0x17a54]
push eax
push ecx
lea edx, [ebp - 0x3290]
push str._CPL______d__New_Process_Started___s__ppid:_d___RDP:_d_
push edx
call fcn.005dfb23
add esp, 0x18
jmp 0x481d13
mov ecx, dword [ebp - 0x17a50]
push eax
mov eax, dword [ebp - 0x17a54]
push eax
push ecx
lea edx, [ebp - 0x3290]
push str._CPL______d__New_Process_Started___s__ppid:_d__
push edx
call fcn.005dfb23
add esp, 0x14
push 0
push 1
lea eax, [ebp - 0x3290]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [ebp - 0x17a74], 0xb
je 0x4890c1
cmp dword [0x72bb6c], 0
jne 0x48206a
mov eax, dword [0x72dd7c]
mov ebx, 0x200
test ebx, eax
jne 0x481d68
test eax, eax
je 0x48201e
cmp dword [0x73019c], 0
je 0x48201e
lea ecx, [ebp - 0x92c]
push str.chrome.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x481ebd
cmp byte [0x730098], al
je 0x481ebd
push 0x730098
call fcn.004ec720
add esp, 4
test eax, eax
je 0x481ebd
push 0x8000
mov edi, 1
call fcn.005e20e4
mov esi, eax
add esp, 4
test esi, esi
je 0x481e08
push 8
push 0x8000
mov byte [esi], 0
mov edx, dword [ebp - 0x17a50]
push esi
push edx
call fcn.00444fd0
add esp, 0x10
test eax, eax
je 0x481df7
cmp byte [esi], 0
je 0x481df7
push 0
push str._type
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x481df7
xor edi, edi
push esi
call fcn.005e0865
add esp, 4
test edi, edi
je 0x481ebd
push 0
test dword [0x72dd7c], ebx
je 0x481e4e
mov eax, dword [ebp - 0x17a50]
push eax
call fcn.004fd720
add esp, 8
test eax, eax
je 0x481e3c
mov edx, dword [ebp - 0x17a50]
lea ecx, [ebp - 0x17aa0]
push ecx
push 0
push edx
push fcn.004614d0
jmp 0x481e83
lea eax, [ebp - 0x17aa0]
push eax
push 0
push 0
push fcn.004614d0
jmp 0x481e83
mov ecx, dword [ebp - 0x17a50]
push ecx
call fcn.004fd720
add esp, 8
test eax, eax
je 0x481e73
mov eax, dword [ebp - 0x17a50]
lea edx, [ebp - 0x17aa0]
push edx
push 0
push eax
jmp 0x481e7e
lea ecx, [ebp - 0x17aa0]
push ecx
push 0
push 0
push 0x4747e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x17a70], eax
test eax, eax
je 0x481ebd
push 0
test dword [0x72dd7c], ebx
je 0x481ea5
push 0x64
jmp 0x481eaa
push 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lea edx, [ebp - 0x17a70]
push edx
call fcn.004dca10
lea eax, [ebp - 0x92c]
push str.dsNcService.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x481f05
lea ecx, [ebp - 0x92c]
push str.PulseSetupClient.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x481f05
lea edx, [ebp - 0x92c]
push str.dsNetworkConnect.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x481f18
cmp dword [0x72cefc], 0
je 0x481f18
push 2
call fcn.0044dda0
add esp, 4
cmp dword [0x72dd7c], 0
je 0x48201e
cmp dword [0x73019c], 0
je 0x48201e
lea eax, [ebp - 0x92c]
push str.firefox.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48201e
mov ecx, dword [0x72c278]
cmp byte [ecx], al
je 0x48201e
push 0x8000
lea edi, [eax + 1]
call fcn.005e20e4
mov esi, eax
add esp, 4
test esi, esi
je 0x481fb9
push 0x10
push 0x8000
mov byte [esi], 0
mov edx, dword [ebp - 0x17a50]
push esi
push edx
call fcn.00444fd0
add esp, 0x10
test eax, eax
je 0x481fac
cmp byte [esi], 0
je 0x481fac
push 0
push str._contentproc
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x481fac
xor edi, edi
push esi
call fcn.005e0865
add esp, 4
test edi, edi
je 0x48201e
mov eax, dword [ebp - 0x17a50]
push 0
push eax
call fcn.004fd720
add esp, 8
test eax, eax
je 0x481fe0
mov edx, dword [ebp - 0x17a50]
lea ecx, [ebp - 0x17b10]
push ecx
push 0
push edx
jmp 0x481feb
lea eax, [ebp - 0x17b10]
push eax
push 0
push 0
push 0x4747e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x17aec], eax
test eax, eax
je 0x48201e
push 0
push 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lea ecx, [ebp - 0x17aec]
push ecx
call fcn.004dca10
cmp dword [0x7302e0], 0
je 0x48206a
lea edx, [ebp - 0x92c]
push str.chrome.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x482057
lea eax, [ebp - 0x92c]
push str.firefox.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48206a
mov ecx, dword [0x7302e0]
push 4
push 0
push ecx
call fcn.0044bee0
add esp, 0xc
cmp dword [ebp - 0x17a74], 0xc
je 0x4890c1
cmp dword [0x6b07a8], 0
je 0x4821ce
cmp dword [0x72bb6c], 0
jne 0x4821ce
lea edx, [ebp - 0x92c]
push str.WWAHost.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4820e0
lea eax, [ebp - 0x92c]
push str.Solitaire.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4820e0
mov ecx, dword [ebp - 0x17a54]
push 0
push 0x6367a0
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4821ce
push 0x103
lea edx, [ebp - 0x165f]
push 0
push edx
mov byte [ebp - 0x1660], 0
call fcn.005dfd60
lea eax, [ebp - 0x17abc]
push eax
lea ecx, [ebp - 0x1660]
push ecx
mov dword [ebp - 0x17abc], 1
call fcn.0045b620
add esp, 0x14
cmp eax, 1
jne 0x4821ce
cmp dword [ebp - 0x17abc], 0
jne 0x4821ce
cmp byte [ebp - 0x1660], 0
je 0x4821ce
push eax
push 0x61726c
lea edx, [ebp - 0x1660]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
lea eax, [ebp - 0x1660]
push eax
push 0
push 0x45b520
call fcn.005e07ac
mov esi, eax
push 0
push esi
push str.CBD_7d
call fcn.00420720
add esp, 0x18
cmp esi, 0xffffffff
jne 0x4821b2
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
push eax
lea ecx, [ebp - 0x69ec]
push str.Error:_beginthread_x__fails_with_error__d
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x69ec]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x4821d4
cmp byte [ebp - 0x1660], 0
je 0x4821ce
jmp 0x4821c0
call fcn.004e03f0
cmp byte [ebp - 0x1660], 0
jne 0x4821c0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x17a74], 0xd
je 0x4890c1
lea eax, [ebp - 0x92c]
push str.userinit.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x482205
mov dword [0x6e9160], 1
jmp 0x48224b
lea ecx, [ebp - 0x92c]
push str.zwsreg.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x482229
mov dword [0x6e9164], 1
jmp 0x48224b
lea edx, [ebp - 0x92c]
push str.eEmpty.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48224b
mov dword [0x72c260], 1
cmp dword [0x6e916c], 0
jne 0x482261
cmp dword [0x6e9174], 0
je 0x482787
mov esi, dword [ebp - 0x17a68]
mov ecx, dword [ebp - 0x17a50]
mov edx, dword [ebp - 0x17a54]
lea eax, [ebp - 0x17ac4]
push eax
push esi
push ecx
push edx
mov dword [ebp - 0x17ac4], 0
call fcn.0046ab10
add esp, 0x10
test eax, eax
je 0x482787
push 0x3ff
lea eax, [ebp - 0x7c13]
push 0
push eax
mov byte [ebp - 0x7c14], 0
call fcn.005dfd60
push 0xfff
lea ecx, [ebp - 0x14a4b]
push 0
push ecx
mov byte [ebp - 0x14a4c], 0
call fcn.005dfd60
add esp, 0x18
mov edi, 1
cmp esi, 4
jbe 0x4823c2
lea edx, [ebp - 0x92c]
push str.download.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4823c2
mov eax, dword [ebp - 0x17a50]
lea ecx, [ebp - 0x14a4c]
push ecx
lea edx, [ebp - 0x7c14]
push edx
push esi
mov dword [0x72bdf0], eax
call fcn.00515670
cmp byte [ebp - 0x7c14], 0
je 0x48237a
push 0
lea eax, [ebp - 0x7c14]
push str.trayico
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x48237a
cmp dword [0x71de6c], 0
mov ecx, dword [ebp - 0x17a50]
mov dword [0x72bde4], ecx
je 0x4823c2
lea edx, [ebp - 0x7c14]
push edx
lea eax, [ebp - 0x3290]
push str._eScan_Download__Manual_eScan_Update_Download_Detected__P:_s_...
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push 0
push ecx
lea edx, [ebp - 0x3290]
push edx
jmp 0x4823b5
cmp dword [0x71de6c], 0
mov dword [0x72bde4], 0
je 0x4823c2
lea eax, [ebp - 0x7c14]
push eax
lea ecx, [ebp - 0x3290]
push str._eScan_Download__Automatic_eScan_Update_Download_Detected__P:_s_...
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push 0
push edx
lea eax, [ebp - 0x3290]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp dword [0x6b07c4], 0
je 0x4823f2
cmp dword [0x6ae140], 0
je 0x4823f2
cmp dword [0x6b07c8], 0
jne 0x4823f2
mov ecx, dword [ebp - 0x17a50]
push ecx
call fcn.00536420
add esp, 4
mov dword [ebp - 0x17a80], edi
mov eax, dword [ebp - 0x17a50]
cdq
push edx
push eax
push 0
push 0x2000708
call dword [0x6e9118]
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x482508
push 0x103
lea edx, [ebp - 0x1f83]
push 0
push edx
mov byte [ebp - 0x1f84], 0
call fcn.005dfd60
lea eax, [ebp - 0x1f84]
push eax
push esi
call fcn.0044c900
add esp, 0x14
cmp byte [ebp - 0x1f84], 0
jne 0x482465
mov ecx, dword [ebp - 0x17a50]
mov edx, dword [ebp - 0x17a54]
push esi
push ecx
push edx
push str.___Failed_To_Add_New_Process_To_PFACC___s:_u_._Reason:_0x_x
lea eax, [ebp - 0x3290]
push eax
jmp 0x482486
mov edx, dword [ebp - 0x17a50]
mov eax, dword [ebp - 0x17a54]
lea ecx, [ebp - 0x1f84]
push ecx
push edx
push eax
push str.___Failed_To_Add_New_Process_To_PFACC___s:_u_._Reason:__s
lea ecx, [ebp - 0x3290]
push ecx
call fcn.005dfb23
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x3290]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp esi, 0xc0000001
jne 0x482570
lea eax, [ebp - 0x3290]
push str.___Removing_Self_Protection_of_process_as_count_exceeded.
push eax
call fcn.005dfb23
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x3290]
push ecx
push 0x6aec98
call fcn.004311c0
push esi
push 2
push esi
push 0x2000501
call dword [0x6e9118]
push esi
push 2
push esi
push 0x2000601
call dword [0x6e9118]
add esp, 0x38
mov dword [0x6e9174], esi
mov dword [0x6e916c], esi
jmp 0x482570
lea edx, [ebp - 0x92c]
push str.test2.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x482531
mov eax, dword [ebp - 0x17a50]
push 0
push eax
call fcn.005438d0
add esp, 8
push 0
call fcn.00540450
mov ecx, dword [ebp - 0x17a50]
mov edx, dword [ebp - 0x17a54]
push eax
push ecx
push edx
lea eax, [ebp - 0x3290]
push str.___New_Process_Added_To_PFACC___s:_u___PidC___u_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x3290]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
mov eax, dword [ebp - 0x17a50]
cdq
push edx
push eax
push 0
push 0x2000702
call dword [0x6e9118]
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x482626
push 0x103
lea edx, [ebp - 0x2087]
push 0
push edx
mov byte [ebp - 0x2088], 0
call fcn.005dfd60
lea eax, [ebp - 0x2088]
push eax
push esi
call fcn.0044c900
add esp, 0x14
cmp byte [ebp - 0x2088], 0
jne 0x4825e3
mov ecx, dword [ebp - 0x17a50]
mov edx, dword [ebp - 0x17a54]
push esi
push ecx
push edx
push str.___Failed_To_Add_New_Process_To_PRACC___s:_d_._Reason:_0x_x
lea eax, [ebp - 0x3290]
push eax
jmp 0x482604
mov edx, dword [ebp - 0x17a50]
mov eax, dword [ebp - 0x17a54]
lea ecx, [ebp - 0x2088]
push ecx
push edx
push eax
push str.___Failed_To_Add_New_Process_To_PRACC___s:_d_._Reason:__s
lea ecx, [ebp - 0x3290]
push ecx
call fcn.005dfb23
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x3290]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x48265d
mov eax, dword [ebp - 0x17a50]
mov ecx, dword [ebp - 0x17a54]
push eax
push ecx
lea edx, [ebp - 0x3290]
push str.___New_Process_Added_To_PRACC___s:_d_
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x3290]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
cmp dword [ebp - 0x17a50], 0
jbe 0x48278d
cmp dword [0x68619c], 2
jne 0x48274c
mov ecx, dword [0x686194]
dec ecx
cmp ecx, 0x61
ja 0x48274c
lea edx, [ebp - 0x92c]
push str.mwavscan.
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4826bb
lea eax, [ebp - 0x92c]
push str.mexe.com
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x48274c
mov ecx, dword [0x686194]
mov edx, dword [ebp - 0x17a50]
mov eax, dword [ebp - 0x17a54]
push ecx
push edx
push eax
lea ecx, [ebp - 0x3290]
push str.___Limit_CPU_For_this_process___s:_u__to__u__
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x3290]
push edx
push 0x6aec98
call fcn.004311c0
mov eax, dword [ebp - 0x17a50]
push eax
push 0
push 0x45c380
call fcn.005e07ac
mov esi, eax
push 0
push esi
push str.CBD_7eP
call fcn.00420720
add esp, 0x3c
cmp esi, 0xffffffff
jne 0x48274c
call ebx
push eax
lea ecx, [ebp - 0x61dc]
push str.Error:_beginthread_y__fails_with_error__d
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x61dc]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp dword [ebp - 0x17ac4], 0
jne 0x48278d
push 0x103
lea eax, [ebp - 0x47c3]
push 0
push eax
mov byte [ebp - 0x47c4], 0
call fcn.005dfd60
mov edx, dword [ebp - 0x17a50]
lea ecx, [ebp - 0x47c4]
push ecx
push edx
call fcn.00543930
add esp, 0x14
jmp 0x48278d
mov edi, dword [ebp - 0x17a9c]
cmp dword [ebp - 0x17a74], 0xe
je 0x4890c1
cmp byte [ebp - 0x92c], 0
je 0x4870b5
lea eax, [ebp - 0x92c]
xor esi, esi
push str.SetupHost.exe
push eax
mov dword [ebp - 0x17ac4], esi
mov dword [ebp - 0x17abc], esi
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x483351
mov ecx, dword [ebp - 0x17a54]
push esi
push str._Windows.BT
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x483351
call fcn.004d9930
test eax, eax
jne 0x48380a
push 0x103
lea edx, [ebp - 0x155b]
push esi
push edx
mov dword [ebp - 0x17ae4], 0xffffffff
mov byte [ebp - 0x155c], al
call fcn.005dfd60
add esp, 0xc
push str.WinOSValueA
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
lea eax, [ebp - 0x17ae4]
push eax
push str.WinOSValueB
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
call fcn.004f79d0
test eax, eax
je 0x482863
lea ebx, [esi + 5]
push str.Windows_10_or_above
jmp 0x4828a5
call fcn.004f78e0
test eax, eax
je 0x48287f
push str.Windows_Blue__8.1_
lea edx, [ebp - 0x155c]
mov ebx, 4
push edx
jmp 0x4828ac
call fcn.004d9950
test eax, eax
je 0x48289b
push 0x636438
lea eax, [ebp - 0x155c]
mov ebx, 2
push eax
jmp 0x4828ac
mov ebx, 1
push str.Windows_7_or_below
lea ecx, [ebp - 0x155c]
push ecx
call fcn.005dfb23
mov eax, dword [ebp - 0x17ae4]
add esp, 8
cmp eax, 0xffffffff
je 0x482da6
cmp eax, ebx
je 0x483337
lea edx, [ebp - 0x155c]
push edx
lea eax, [ebp - 0x3ab0]
push str._UPGR__OS_Upgrade_Finished__New_OS___s_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x3ab0]
push ecx
push 0x6aec98
call fcn.004311c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x1c
push 0x6af4b8
lea edx, [ebp - 0x1048]
push edx
call esi
lea eax, [ebp - 0x1048]
push eax
call fcn.004e24e0
add esp, 4
push 0x6af4b8
lea ecx, [ebp - 0xe40]
push ecx
call esi
lea edx, [ebp - 0xe40]
push edx
call fcn.004e24e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
cmp dword [0x6b079c], 0
je 0x482966
push str.procobsrvesx.s_s
lea eax, [ebp - 0x1048]
push eax
call edi
push str.procobsrvesx.sys
lea ecx, [ebp - 0xe40]
push ecx
jmp 0x482980
push str.procobsrves.s_s
lea edx, [ebp - 0x1048]
push edx
call edi
push str.procobsrves.sys
lea eax, [ebp - 0xe40]
push eax
call edi
push 0
push 0
push 0
lea ecx, [ebp - 0x1048]
push 0
push ecx
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x4829c1
lea edx, [ebp - 0xe40]
push edx
call fcn.004e0670
push 0
lea eax, [ebp - 0xe40]
push eax
lea ecx, [ebp - 0x1048]
push ecx
call fcn.004eca90
add esp, 0x10
push 0x6af4b8
lea edx, [ebp - 0x1048]
push edx
call esi
lea eax, [ebp - 0x1048]
push eax
call fcn.004e24e0
lea eax, [ebp - 0x1048]
add esp, 4
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4829e5
mov ecx, dword [str.vdb32_avpmapp.e_e]
mov edx, dword [0x6363a0]
mov dword [eax], ecx
mov ecx, dword [0x6363a4]
mov dword [eax + 4], edx
mov edx, dword [0x6363a8]
mov dword [eax + 8], ecx
mov cx, word [0x6363ac]
mov dword [eax + 0xc], edx
push 0x6af4b8
lea edx, [ebp - 0xe40]
push edx
mov word [eax + 0x10], cx
call esi
lea eax, [ebp - 0xe40]
push eax
call fcn.004e24e0
lea eax, [ebp - 0xe40]
add esp, 4
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x482a40
mov ecx, dword [str.vdb32_avpmapp.exe]
mov edx, dword [0x63638c]
mov dword [eax], ecx
mov ecx, dword [0x636390]
mov dword [eax + 4], edx
mov edx, dword [0x636394]
push 0
push 0
mov dword [eax + 8], ecx
mov cx, word [0x636398]
mov dword [eax + 0xc], edx
push 0
lea edx, [ebp - 0x1048]
push 0
push edx
mov word [eax + 0x10], cx
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x482ab5
lea eax, [ebp - 0xe40]
push eax
call fcn.004e0670
push 0
lea ecx, [ebp - 0xe40]
push ecx
lea edx, [ebp - 0x1048]
push edx
call fcn.004eca90
add esp, 0x10
push 0x6af4b8
lea eax, [ebp - 0x1048]
push eax
call esi
lea ecx, [ebp - 0x1048]
push ecx
call fcn.004e24e0
lea eax, [ebp - 0x1048]
add esp, 4
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x482ae0
mov edx, dword [str.vdb64_avpmapp.e_e]
mov ecx, dword [0x636378]
mov dword [eax], edx
mov edx, dword [0x63637c]
mov dword [eax + 4], ecx
mov ecx, dword [0x636380]
mov dword [eax + 8], edx
mov dx, word [0x636384]
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], dx
push 0x6af4b8
lea eax, [ebp - 0xe40]
push eax
call esi
lea ecx, [ebp - 0xe40]
push ecx
call fcn.004e24e0
lea eax, [ebp - 0xe40]
add esp, 4
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x482b40
mov edx, dword [str.vdb64_avpmapp.exe]
mov ecx, dword [0x636364]
mov dword [eax], edx
mov edx, dword [0x636368]
mov dword [eax + 4], ecx
mov ecx, dword [0x63636c]
push 0
mov dword [eax + 8], edx
mov dx, word [0x636370]
push 0
mov dword [eax + 0xc], ecx
push 0
mov word [eax + 0x10], dx
lea eax, [ebp - 0x1048]
push 0
push eax
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x482bb5
lea ecx, [ebp - 0xe40]
push ecx
call fcn.004e0670
push 0
lea edx, [ebp - 0xe40]
push edx
lea eax, [ebp - 0x1048]
push eax
call fcn.004eca90
add esp, 0x10
push 0x6af4b8
lea ecx, [ebp - 0x1048]
push ecx
call esi
lea edx, [ebp - 0x1048]
push edx
call fcn.004e24e0
lea eax, [ebp - 0x1048]
add esp, 4
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x482be0
mov ecx, dword [str.vista_avpmapp.e_e]
mov edx, dword [0x636350]
mov dword [eax], ecx
mov ecx, dword [0x636354]
mov dword [eax + 4], edx
mov edx, dword [0x636358]
mov dword [eax + 8], ecx
mov cx, word [0x63635c]
mov dword [eax + 0xc], edx
push 0x6af4b8
lea edx, [ebp - 0xe40]
push edx
mov word [eax + 0x10], cx
call esi
lea eax, [ebp - 0xe40]
push eax
call fcn.004e24e0
lea eax, [ebp - 0xe40]
add esp, 4
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x482c40
mov ecx, dword [str.vista_avpmapp.exe]
mov edx, dword [0x63633c]
mov dword [eax], ecx
mov ecx, dword [0x636340]
mov dword [eax + 4], edx
mov edx, dword [0x636344]
push 0
push 0
mov dword [eax + 8], ecx
mov cx, word [0x636348]
mov dword [eax + 0xc], edx
push 0
lea edx, [ebp - 0x1048]
push 0
push edx
mov word [eax + 0x10], cx
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x482cb5
lea eax, [ebp - 0xe40]
push eax
call fcn.004e0670
push 0
lea ecx, [ebp - 0xe40]
push ecx
lea edx, [ebp - 0x1048]
push edx
call fcn.004eca90
add esp, 0x10
push 0x6af4b8
lea eax, [ebp - 0x1a70]
push eax
call esi
lea ecx, [ebp - 0x1a70]
push ecx
call fcn.004e24e0
add esp, 4
push str.templateeConceal.reg
lea edx, [ebp - 0x1a70]
push edx
call edi
push 0
push 0
push 0
lea eax, [ebp - 0x1a70]
push 0
push eax
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x482d71
xor edi, edi
mov dword [ebp - 0x17ae8], edi
call fcn.004d96c0
test eax, eax
je 0x482d21
lea ecx, [ebp - 0x17ae8]
push ecx
call fcn.004f77e0
add esp, 4
mov edi, eax
lea edx, [ebp - 0x1a70]
push edx
lea eax, [ebp - 0x3ab0]
push str.regedit.exe__S___s_
push eax
call fcn.005dfb23
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x3ab0]
push 0
push ecx
call fcn.00506de0
add esp, 0x28
mov esi, eax
test edi, edi
je 0x482d69
mov edx, dword [ebp - 0x17ae8]
push edx
call fcn.004f7860
add esp, 4
push esi
push str._UPGR__Successfully_imported_eConceal_key___u_
jmp 0x482d7d
lea edx, [ebp - 0x1a70]
push edx
push str._UPGR__Unable_to_find__s__Not_importing_eConceal_key.
lea eax, [ebp - 0x3ab0]
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x3ab0]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x483337
cmp ebx, 5
jae 0x48330f
lea edx, [ebp - 0x155c]
push edx
lea eax, [ebp - 0x1d7c]
push str._UPGR__OS_Upgrade_Detected__Curr_OS___s_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x1d7c]
push ecx
push 0x6aec98
call fcn.004311c0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x1c
push 0x6af4b8
lea edx, [ebp - 0x1250]
push edx
call esi
lea eax, [ebp - 0x1250]
push eax
call fcn.004e24e0
add esp, 4
push 0x6af4b8
lea ecx, [ebp - 0x1458]
push ecx
call esi
lea edx, [ebp - 0x1458]
push edx
call fcn.004e24e0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
cmp dword [0x6b079c], 0
je 0x482e4a
push str.procobsrvesx.sys
lea eax, [ebp - 0x1250]
push eax
call edi
push str.procobsrvesx.s_s
lea ecx, [ebp - 0x1458]
push ecx
jmp 0x482e64
push str.procobsrves.sys
lea edx, [ebp - 0x1250]
push edx
call edi
push str.procobsrves.s_s
lea eax, [ebp - 0x1458]
push eax
call edi
push 0
push 0
push 0
lea ecx, [ebp - 0x1250]
push 0
push ecx
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x482ea5
lea edx, [ebp - 0x1458]
push edx
call fcn.004e0670
push 0
lea eax, [ebp - 0x1458]
push eax
lea ecx, [ebp - 0x1250]
push ecx
call fcn.004eca90
add esp, 0x10
push 0x6af4b8
lea edx, [ebp - 0x1250]
push edx
call esi
lea eax, [ebp - 0x1250]
push eax
call fcn.004e24e0
lea eax, [ebp - 0x1250]
add esp, 4
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x482ed0
mov ecx, dword [str.vdb32_avpmapp.exe]
mov edx, dword [0x63638c]
mov dword [eax], ecx
mov ecx, dword [0x636390]
mov dword [eax + 4], edx
mov edx, dword [0x636394]
mov dword [eax + 8], ecx
mov cx, word [0x636398]
mov dword [eax + 0xc], edx
push 0x6af4b8
lea edx, [ebp - 0x1458]
push edx
mov word [eax + 0x10], cx
call esi
lea eax, [ebp - 0x1458]
push eax
call fcn.004e24e0
lea eax, [ebp - 0x1458]
add esp, 4
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x482f30
mov ecx, dword [str.vdb32_avpmapp.e_e]
mov edx, dword [0x6363a0]
mov dword [eax], ecx
mov ecx, dword [0x6363a4]
mov dword [eax + 4], edx
mov edx, dword [0x6363a8]
push 0
push 0
mov dword [eax + 8], ecx
mov cx, word [0x6363ac]
mov dword [eax + 0xc], edx
push 0
lea edx, [ebp - 0x1250]
push 0
push edx
mov word [eax + 0x10], cx
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x482fa5
lea eax, [ebp - 0x1458]
push eax
call fcn.004e0670
push 0
lea ecx, [ebp - 0x1458]
push ecx
lea edx, [ebp - 0x1250]
push edx
call fcn.004eca90
add esp, 0x10
push 0x6af4b8
lea eax, [ebp - 0x1250]
push eax
call esi
lea ecx, [ebp - 0x1250]
push ecx
call fcn.004e24e0
lea eax, [ebp - 0x1250]
add esp, 4
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x482fd0
mov edx, dword [str.vdb64_avpmapp.exe]
mov ecx, dword [0x636364]
mov dword [eax], edx
mov edx, dword [0x636368]
mov dword [eax + 4], ecx
mov ecx, dword [0x63636c]
mov dword [eax + 8], edx
mov dx, word [0x636370]
mov dword [eax + 0xc], ecx
mov word [eax + 0x10], dx
push 0x6af4b8
lea eax, [ebp - 0x1458]
push eax
call esi
lea ecx, [ebp - 0x1458]
push ecx
call fcn.004e24e0
lea eax, [ebp - 0x1458]
add esp, 4
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x483030
mov edx, dword [str.vdb64_avpmapp.e_e]
mov ecx, dword [0x636378]
mov dword [eax], edx
mov edx, dword [0x63637c]
mov dword [eax + 4], ecx
mov ecx, dword [0x636380]
push 0
mov dword [eax + 8], edx
mov dx, word [0x636384]
push 0
mov dword [eax + 0xc], ecx
push 0
mov word [eax + 0x10], dx
lea eax, [ebp - 0x1250]
push 0
push eax
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x4830a5
lea ecx, [ebp - 0x1458]
push ecx
call fcn.004e0670
push 0
lea edx, [ebp - 0x1458]
push edx
lea eax, [ebp - 0x1250]
push eax
call fcn.004eca90
add esp, 0x10
push 0x6af4b8
lea ecx, [ebp - 0x1250]
push ecx
call esi
lea edx, [ebp - 0x1250]
push edx
call fcn.004e24e0
lea eax, [ebp - 0x1250]
add esp, 4
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4830d0
mov ecx, dword [str.vista_avpmapp.exe]
mov edx, dword [0x63633c]
mov dword [eax], ecx
mov ecx, dword [0x636340]
mov dword [eax + 4], edx
mov edx, dword [0x636344]
mov dword [eax + 8], ecx
mov cx, word [0x636348]
mov dword [eax + 0xc], edx
push 0x6af4b8
lea edx, [ebp - 0x1458]
push edx
mov word [eax + 0x10], cx
call esi
lea eax, [ebp - 0x1458]
push eax
call fcn.004e24e0
lea eax, [ebp - 0x1458]
add esp, 4
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x483130
mov ecx, dword [str.vista_avpmapp.e_e]
mov edx, dword [0x636350]
mov dword [eax], ecx
mov ecx, dword [0x636354]
mov dword [eax + 4], edx
mov edx, dword [0x636358]
push 0
push 0
mov dword [eax + 8], ecx
mov cx, word [0x63635c]
mov dword [eax + 0xc], edx
push 0
lea edx, [ebp - 0x1250]
push 0
push edx
mov word [eax + 0x10], cx
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x4831a5
lea eax, [ebp - 0x1458]
push eax
call fcn.004e0670
push 0
lea ecx, [ebp - 0x1458]
push ecx
lea edx, [ebp - 0x1250]
push edx
call fcn.004eca90
add esp, 0x10
push 0x6af4b8
lea eax, [ebp - 0x2290]
push eax
call esi
lea ecx, [ebp - 0x2290]
push ecx
call fcn.004e24e0
add esp, 4
push str.templateeConceal.reg
lea edx, [ebp - 0x2290]
push edx
call edi
lea eax, [ebp - 0x44b8]
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceseconceal
push eax
call fcn.005dfb23
lea ecx, [ebp - 0x17b14]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetServiceseconceal
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x1c
test eax, eax
jne 0x4832dc
mov edx, dword [ebp - 0x17b14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x17af0], esi
call fcn.004d96c0
test eax, eax
je 0x483235
lea eax, [ebp - 0x17af0]
push eax
call fcn.004f77e0
add esp, 4
mov esi, eax
lea ecx, [ebp - 0x44b8]
push ecx
lea edx, [ebp - 0x2290]
push edx
lea eax, [ebp - 0x1d7c]
push str.regedit.exe__S__E___s___s
push eax
call fcn.005dfb23
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x1d7c]
push 0
push ecx
call fcn.00506de0
add esp, 0x2c
mov edi, eax
test esi, esi
je 0x483284
mov edx, dword [ebp - 0x17af0]
push edx
call fcn.004f7860
add esp, 4
push 0
push 0
push 0
lea eax, [ebp - 0x2290]
push 0
push eax
call fcn.004ec5a0
add esp, 0x14
push edi
test eax, eax
jne 0x4832ae
push str._UPGR__Successfully_exported_eConceal_RegKey___u_
lea ecx, [ebp - 0x1d7c]
push ecx
jmp 0x4832ba
push str._UPGR__Not_exported_eConceal_RegKey___u_
lea edx, [ebp - 0x1d7c]
push edx
call fcn.005dfb23
add esp, 0xc
push 0
push 1
lea eax, [ebp - 0x1d7c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x483337
push eax
lea ecx, [ebp - 0x44b8]
push ecx
lea edx, [ebp - 0x1d7c]
push str._UPGR__Unable_to_open_key__s__Err:__u
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x1d7c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x483337
lea ecx, [ebp - 0x1d7c]
push str._UPGR__OS_Detected_as_Win_10__Not_renaming_files.
push ecx
call fcn.005dfb23
push esi
push 1
lea edx, [ebp - 0x1d7c]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
push ebx
push str.WinOSValueB
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004f48a0
jmp 0x48380a
mov eax, dword [ebp - 0x17a54]
push esi
push str.Office
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x48361c
lea ecx, [ebp - 0x92c]
push str.Winword.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x483423
lea edx, [ebp - 0x92c]
push str.Outlook.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x483423
lea eax, [ebp - 0x92c]
push str.mspub.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x483423
lea ecx, [ebp - 0x92c]
push str.excel.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x483423
lea edx, [ebp - 0x92c]
push str.msaccess.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x483423
lea eax, [ebp - 0x92c]
push str.Frontpg.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x483423
lea ecx, [ebp - 0x92c]
push str.Powerpnt.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48361c
lea edx, [ebp - 0x17af8]
push edx
push str.NoOutlookInject
push str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x17af8], esi
call fcn.004d5820
cmp dword [ebp - 0x17af8], esi
jne 0x48380a
cmp dword [0x686280], esi
je 0x4837da
lea eax, [ebp - 0x17a98]
push eax
push str.Inject
push str.SOFTWAREMicroWorldDeviceControl
mov edi, 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x17a98], esi
mov dword [ebp - 0x17a94], edi
mov dword [ebp - 0x17aa4], esi
call fcn.004d5820
lea ecx, [ebp - 0x17a94]
push ecx
push str.AttachmentsAllowed
push str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
lea edx, [ebp - 0x17aa4]
push edx
push str.CopyPasteDisabled
push str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
push 0x75ffe4
push str.INJECT_DEBUG
push str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x17a98], esi
jne 0x4834f9
cmp dword [ebp - 0x17a94], edi
jne 0x4834f9
cmp dword [ebp - 0x17aa4], esi
je 0x48380a
cmp dword [0x72bb6c], esi
jne 0x48380a
mov eax, dword [ebp - 0x17a50]
push eax
lea ecx, [ebp - 0x6dfc]
push str.DT__d_MUTEX
push ecx
mov dword [ebp - 0x17aa8], esi
call fcn.005dfb23
lea edx, [ebp - 0x6dfc]
push edx
lea eax, [ebp - 0x17aa8]
push esi
push eax
call fcn.005093e0
add esp, 0x18
test eax, eax
je 0x4837ae
cmp dword [ebp - 0x17aa8], esi
je 0x4837ae
call ebx
lea ecx, [ebp - 0x17aa8]
push ecx
mov esi, eax
call fcn.004e33b0
add esp, 4
cmp esi, 0xb7
je 0x483790
mov edx, dword [0x75ffe4]
mov eax, dword [ebp - 0x17aa4]
mov ecx, dword [ebp - 0x17a94]
push edx
mov edx, dword [ebp - 0x17a98]
push eax
mov eax, dword [ebp - 0x17a50]
push ecx
mov ecx, dword [ebp - 0x17a54]
push edx
push eax
push ecx
lea edx, [ebp - 0x3290]
push str.___Injecting_our_DataTheft_DLL:___s:_d__Inj:_u__AttAllow:_u__CoPast:_u__iDeb:_d_
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x3290]
push eax
push 0x6aec98
call fcn.004311c0
mov ecx, dword [ebp - 0x17a50]
push ecx
push 0
push 0x554930
call fcn.005e07ac
mov esi, eax
push 0
push esi
push str.CBD_7e
call fcn.00420720
add esp, 0x48
cmp esi, 0xffffffff
jne 0x48380a
call ebx
push eax
lea edx, [ebp - 0x68e8]
push str.Error:_beginthread_y__fails_with_error__d
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x68e8]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x48380a
lea eax, [ebp - 0x92c]
push str.chrome.exe
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x483660
lea ecx, [ebp - 0x17b00]
push ecx
push str.NoChromeInject
push str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x17b00], esi
call fcn.004d5820
cmp dword [ebp - 0x17b00], esi
jmp 0x48344a
lea edx, [ebp - 0x92c]
push str.MicrosoftEdgeCP.exe
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x483450
lea eax, [ebp - 0x92c]
push str.MicrosoftEdge.exe
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x483450
cmp dword [0x6aa81c], 0xe
jb 0x48380a
cmp dword [0x72d008], esi
jne 0x48380a
cmp edi, esi
jne 0x48373d
mov ecx, dword [ebp - 0x17a54]
push 0x6b07d0
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x483450
lea edx, [ebp - 0x17af4]
push edx
push str.CopyPasteDisabled
push str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x17af4], esi
call fcn.004d5820
lea eax, [ebp - 0x92c]
push 0x618e20
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x483450
cmp dword [ebp - 0x17af4], esi
je 0x48380a
push 1
lea ecx, [ebp - 0x92c]
push esi
push ecx
call fcn.005d1c40
add esp, 0xc
test eax, eax
je 0x48380a
jmp 0x483450
cmp dword [0x686280], esi
je 0x48380a
cmp dword [0x71de6c], esi
je 0x48380a
mov edx, dword [ebp - 0x17a50]
mov eax, dword [ebp - 0x17a54]
push edx
push eax
lea ecx, [ebp - 0x3290]
push str.___NOT_Injecting_DataTheft_DLL_into___s:_d__as_self_protection_disabled_for_this_process.
push ecx
call fcn.005dfb23
push esi
push 1
lea edx, [ebp - 0x3290]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x48380a
lea ecx, [ebp - 0x3290]
push str.___NOT_Injecting_DataTheft_DLL_as_Mutex_is_already_used_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x3290]
push edx
jmp 0x4837fd
call ebx
push eax
lea eax, [ebp - 0x3290]
push str.___NOT_Injecting_DataTheft_DLL_as_MutexCreation_failed__lastErr:_d
push eax
call fcn.005dfb23
push esi
push edi
lea ecx, [ebp - 0x3290]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x48380a
cmp dword [0x71de6c], esi
je 0x48380a
lea edx, [ebp - 0x3290]
push str.___NOT_Injecting_DataTheft_DLL_as_DLP_is_not_enabled_
push edx
call fcn.005dfb23
push esi
push 1
lea eax, [ebp - 0x3290]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x18
lea ecx, [ebp - 0x92c]
push str.scanremv.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48388a
lea edx, [ebp - 0x92c]
push str.esremove.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48388a
lea eax, [ebp - 0x92c]
push str.unins
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x483902
mov ecx, dword [ebp - 0x17a54]
push 0x6af4b8
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x48388a
mov edx, dword [ebp - 0x17a54]
push 0x6af6c0
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x483902
cmp byte [0x740e50], 0
jne 0x4838d9
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x6af8c8
push 0x104
push 0x740e50
push str.No_Action
push 0x61d148
push str.Prompt
call esi
push 0x6af8c8
push 0x104
push 0x740d48
push str.eScan_Uninstallation_Started
push 0x61d188
push 0x614348
call esi
mov eax, dword [ebp - 0x17a54]
push 0
push eax
push 0x740e50
push 0x740d48
push 0x60c810
push 0
push str.eScan_Monitor
push 0x300
call fcn.00513910
lea ecx, [ebp - 0x92c]
push str.iexplore.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x483924
push 2
call fcn.004fed90
add esp, 4
lea edx, [ebp - 0x92c]
push str.wlmail.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x483adc
push 0x3ff
push eax
mov byte [ebp - 0x42b0], al
lea eax, [ebp - 0x42af]
push eax
call fcn.005dfd60
push 0
push 0x400
lea ecx, [ebp - 0x42b0]
push ecx
push 0x60c81c
push str.SpecialFolderPath
push 0x60c810
call fcn.004efe40
add esp, 0x24
cmp byte [ebp - 0x42b0], 0
je 0x483adc
lea edx, [ebp - 0x42b0]
push 0
push edx
call fcn.004e8c10
add esp, 8
test eax, eax
je 0x483adc
push 0x3ff
lea eax, [ebp - 0x8c13]
push 0
push eax
mov byte [ebp - 0x8c14], 0
call fcn.005dfd60
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x8c14]
push ecx
lea edx, [ebp - 0x42b0]
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
cmp byte [ebp - 0x8c14], 0
je 0x483a33
lea ecx, [ebp - 0x42b0]
lea eax, [ebp - 0x8c14]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x483a10
test dl, dl
je 0x483a0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x483a10
add eax, 2
add ecx, 2
test dl, dl
jne 0x4839f0
xor eax, eax
jmp 0x483a15
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x483a33
xor eax, eax
jmp 0x483a20
mov cl, byte [ebp + eax - 0x8c14]
mov byte [ebp + eax - 0x42b0], cl
inc eax
test cl, cl
jne 0x483a20
lea eax, [ebp - 0x42b0]
push eax
call fcn.004e2520
lea edi, [ebp - 0x42b0]
add esp, 4
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x483a50
mov ecx, 7
mov esi, str.econceal_firewall_rules.xml
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 0
lea ecx, [ebp - 0x42b0]
push 0
push ecx
movsb byte es:[edi], byte [esi]
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x483adc
lea edx, [ebp - 0x42b0]
push 1
push edx
call fcn.004e53d0
add esp, 8
test eax, eax
je 0x483adc
push 1
push 1
call fcn.0042ddf0
lea eax, [ebp - 0x42b0]
push 0
push eax
call fcn.004e53d0
lea ecx, [ebp - 0x42b0]
push ecx
lea edx, [ebp - 0xae2c]
push str._FWRULE__ICMP_Rule_Modified_in__s
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0xae2c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x2c
cmp dword [0x686078], 0
je 0x483ba7
mov ecx, dword [ebp - 0x17a54]
push 0
push str.IObit
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x483ba7
push 0x207
lea edx, [ebp - 0x60d7]
push 0
push edx
mov byte [ebp - 0x60d8], 0
call fcn.005dfd60
mov ecx, dword [0x635e44]
mov edx, dword [0x635e48]
mov eax, dword [str.IOBit_Blocked]
mov dword [ebp - 0x110], ecx
mov ecx, dword [ebp - 0x17a54]
push ecx
mov dword [ebp - 0x10c], edx
mov esi, 1
mov dword [ebp - 0x114], eax
mov ax, word [0x635e4c]
lea edx, [ebp - 0x60d8]
push str._CPL__Force_Terminating_IOBit_Process:__s
push edx
mov dword [ebp - 0x17a60], esi
mov dword [ebp - 0x17a58], esi
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], esi
mov word [ebp - 0x108], ax
call fcn.005dfb23
push 0
push esi
lea eax, [ebp - 0x60d8]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x28
jmp 0x4870b5
cmp dword [0x68607c], 0
je 0x483c63
mov ecx, dword [ebp - 0x17a54]
push 0
push str.ilockmsg.exe
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x483c63
cmp dword [ebp - 0x17ad8], 0x14000
jae 0x483c63
push 0x207
lea edx, [ebp - 0x67e3]
push 0
push edx
mov byte [ebp - 0x67e4], 0
call fcn.005dfd60
mov eax, dword [ebp - 0x17a54]
push eax
lea ecx, [ebp - 0x67e4]
mov esi, 1
push str._CPL__Force_Terminating_ILockMsg_Process:__s
push ecx
mov dword [ebp - 0x17a60], esi
mov dword [ebp - 0x17a58], esi
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 2
mov byte [ebp - 0x114], 0
call fcn.005dfb23
push 0
push esi
lea edx, [ebp - 0x67e4]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
mov dword [ebp - 0x17ae0], esi
jmp 0x4870b5
mov eax, dword [ebp - 0x17a54]
push 0
push str.PCHunter
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x483d2f
push 0x207
lea ecx, [ebp - 0x5ecf]
push 0
push ecx
mov byte [ebp - 0x5ed0], 0
call fcn.005dfd60
mov ecx, dword [0x635dcc]
mov edx, dword [str.PCHunter_Blocked]
mov eax, dword [0x635dc8]
mov dword [ebp - 0x114], edx
mov edx, dword [0x635dd0]
mov dword [ebp - 0x10c], ecx
mov ecx, dword [ebp - 0x17a54]
push ecx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x110], eax
mov al, byte [0x635dd4]
lea edx, [ebp - 0x5ed0]
mov esi, 1
push str._CPL__Force_Terminating_PCHunter_Process:__s
push edx
mov dword [ebp - 0x17a60], esi
mov dword [ebp - 0x17a58], esi
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 4
mov byte [ebp - 0x104], al
call fcn.005dfb23
push 0
push esi
lea eax, [ebp - 0x5ed0]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x28
jmp 0x4870b5
mov ecx, dword [ebp - 0x17a54]
push 0
push str.Powertool
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x483dfd
push 0x207
lea edx, [ebp - 0x6cf7]
push 0
push edx
mov byte [ebp - 0x6cf8], 0
call fcn.005dfd60
mov edx, dword [0x635d7c]
mov eax, dword [str.Powertool_Blocked]
mov ecx, dword [0x635d78]
mov dword [ebp - 0x114], eax
mov eax, dword [0x635d80]
mov dword [ebp - 0x10c], edx
mov edx, dword [ebp - 0x17a54]
push edx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x110], ecx
mov cx, word [0x635d84]
lea eax, [ebp - 0x6cf8]
mov esi, 1
push str._CPL__Force_Terminating_Powertool_Process:__s
push eax
mov dword [ebp - 0x17a60], esi
mov dword [ebp - 0x17a58], esi
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 4
mov word [ebp - 0x104], cx
call fcn.005dfb23
push 0
push esi
lea ecx, [ebp - 0x6cf8]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
jmp 0x4870b5
cmp dword [0x68628c], 0
je 0x4840d9
push 0x207
lea edx, [ebp - 0x38a7]
push 0
push edx
mov byte [ebp - 0x38a8], 0
call fcn.005dfd60
mov eax, dword [ebp - 0x17a54]
push 0
push str.IObit_Uninstaller
push eax
call fcn.004f5880
add esp, 0x18
cmp eax, 0xffffffff
je 0x483eb5
lea ecx, [ebp - 0x92c]
push str.unins000.exe
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4840d9
mov esi, str.Uninstaller_Blocked_A_
mov dword [ebp - 0x17a64], 5
mov edx, dword [ebp - 0x17a54]
mov eax, 1
push edx
mov dword [ebp - 0x17a58], eax
mov dword [ebp - 0x17a60], eax
mov ecx, 5
lea edi, [ebp - 0x114]
push str._CPL__Force_Terminating_Uninstaller_Process:__s
lea eax, [ebp - 0x38a8]
rep movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x17a5c], 0x710
movsb byte es:[edi], byte [esi]
call fcn.005dfb23
add esp, 0xc
jmp 0x483fe8
cmp byte [ebp - 0xce4c], 0
je 0x484008
lea ecx, [ebp - 0xce4c]
push str.TuRes.dll
push ecx
call fcn.004ec4e0
add esp, 8
test eax, eax
jne 0x484008
lea edx, [ebp - 0x92c]
push str.unins000.exe
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484008
mov ecx, dword [ebp - 0x17a54]
lea eax, [ebp - 0x17a78]
push eax
push ecx
mov dword [ebp - 0x17a78], 0
call fcn.004f1610
mov ecx, dword [ebp - 0x17a78]
test ecx, ecx
je 0x4840d9
cmp byte [ecx], 0
je 0x483f99
push eax
push str.GAVRILA
push ecx
call fcn.004f5ad0
add esp, 0xc
cmp eax, 0xffffffff
je 0x483f93
mov edx, dword [ebp - 0x17a54]
mov ecx, 5
mov esi, str.Uninstaller_Blocked_E_
lea edi, [ebp - 0x114]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
push edx
movsw word es:[edi], word [esi]
mov dword [ebp - 0x17a60], eax
mov dword [ebp - 0x17a58], eax
lea eax, [ebp - 0x38a8]
push str._CPL__Force_Terminating_Uninstaller_Process:__s
push eax
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 5
call fcn.005dfb23
add esp, 0xc
mov ecx, dword [ebp - 0x17a78]
push ecx
call fcn.005e0865
push 0
push 0
lea ecx, [ebp - 0xce4c]
push str.Tu.
push ecx
call fcn.00517250
mov eax, dword [ebp - 0x17a68]
add esp, 0x14
test eax, eax
jne 0x483fd3
mov edx, dword [ebp - 0x17a50]
push edx
call fcn.004f28b0
mov dword [ebp - 0x17a68], eax
push 0
push eax
call fcn.0050fb00
cmp dword [ebp - 0x17a58], 0
je 0x4840d9
push 0
push 1
lea edx, [ebp - 0x38a8]
push edx
push 0x6aec98
call fcn.004311c0
mov ebx, dword [ebp - 0x17a58]
jmp 0x484b9c
mov eax, dword [ebp - 0x17a54]
push 0
push str.Revo_Uninstaller
push eax
call fcn.004f5880
add esp, 0xc
lea ecx, [ebp - 0x92c]
cmp eax, 0xffffffff
je 0x484053
push str.uninst.exe
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4840d9
mov esi, str.Uninstaller_Blocked_B_
mov dword [ebp - 0x17a64], 6
jmp 0x483e6a
push str.RevoUn.exe
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4841e9
lea edx, [ebp - 0x92c]
push str.RevoUPort.exe
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4841e9
mov eax, dword [ebp - 0x17a54]
push 0
push str.WiseProgram
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4841a4
mov ecx, dword [ebp - 0x17a54]
push 0
push str.WiseDelete
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4841a4
mov edx, dword [ebp - 0x17a54]
mov eax, dword [ebp - 0x17a50]
push edx
push eax
call fcn.0045c7a0
add esp, 8
cmp dword [0x686288], 0
jbe 0x484363
lea eax, [ebp - 0x92c]
push str.ntvdm.exe
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x484363
push 0x3ff
push eax
lea ecx, [ebp - 0x8413]
push ecx
mov byte [ebp - 0x8414], al
call fcn.005dfd60
push 0xfff
lea edx, [ebp - 0xde4b]
push 0
push edx
mov byte [ebp - 0xde4c], 0
call fcn.005dfd60
mov esi, dword [ebp - 0x17a68]
add esp, 0x18
cmp dword [0x686288], 2
jne 0x48422e
mov eax, dword [str.NTVDM_Blocked]
mov ecx, dword [0x635cc0]
mov edx, dword [0x635cc4]
mov dword [ebp - 0x114], eax
mov ax, word [0x635cc8]
mov ebx, 1
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edx
mov word [ebp - 0x108], ax
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 9
jmp 0x484323
mov ecx, 5
mov esi, str.Uninstaller_Blocked_D_
lea edi, [ebp - 0x114]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x17a54]
push ecx
mov eax, 1
push str._CPL__Force_Terminating_Wise_Uninstaller_Process:__s
lea edx, [ebp - 0x38a8]
mov dword [ebp - 0x17a60], eax
mov dword [ebp - 0x17a58], eax
mov dword [ebp - 0x17a64], 8
push edx
jmp 0x483e9b
mov eax, 1
mov dword [ebp - 0x17a60], eax
mov dword [ebp - 0x17a58], eax
mov eax, dword [ebp - 0x17a54]
mov ecx, 5
mov esi, str.Uninstaller_Blocked_C_
lea edi, [ebp - 0x114]
push eax
rep movsd dword es:[edi], dword [esi]
push str._CPL__Force_Terminating_Revo_Uninstaller_Process:__s
lea ecx, [ebp - 0x38a8]
mov dword [ebp - 0x17a64], 7
push ecx
jmp 0x483e9b
test esi, esi
jne 0x484246
mov ecx, dword [ebp - 0x17a50]
push ecx
call fcn.004f28b0
mov esi, eax
mov dword [ebp - 0x17a68], esi
cmp esi, 4
jbe 0x48425f
lea edx, [ebp - 0xde4c]
push edx
lea eax, [ebp - 0x8414]
push eax
push esi
call fcn.00515670
push 0
lea ecx, [ebp - 0x8414]
push str.lsass
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4842db
mov edx, dword [str.NTVDM_Blocked_A_]
mov eax, dword [0x635c0c]
mov ecx, dword [0x635c10]
mov dword [ebp - 0x114], edx
mov edx, dword [0x635c14]
mov dword [ebp - 0x110], eax
mov al, byte [0x635c18]
mov ebx, 1
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov byte [ebp - 0x104], al
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0xa
jmp 0x484323
mov eax, dword [ebp - 0x17a54]
lea ecx, [ebp - 0xde4c]
push ecx
lea edx, [ebp - 0x8414]
push edx
push eax
lea ecx, [ebp - 0xc64c]
push str._CPL__NOT_Terminating_NTVDM:__s_as_Parent_is__s___s_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0xc64c]
push edx
push 0x6aec98
call fcn.004311c0
mov ebx, dword [ebp - 0x17a58]
add esp, 0x24
test ebx, ebx
je 0x484377
mov edx, dword [ebp - 0x17a54]
lea eax, [ebp - 0xde4c]
push eax
lea ecx, [ebp - 0x8414]
push ecx
push edx
lea eax, [ebp - 0x921c]
push str._CPL__Force_Terminating_NTVDM:__s__Parent:__s___s_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x921c]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x24
jmp 0x48436f
mov ebx, dword [ebp - 0x17a58]
mov esi, dword [ebp - 0x17a68]
test ebx, ebx
jne 0x4870b5
cmp dword [0x7302d8], 0
mov edi, 1
je 0x4844b2
lea edx, [ebp - 0x92c]
push str.MicrosoftEdgeCP.exe
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4843b9
lea eax, [ebp - 0x92c]
push str.MicrosoftEdge.exe
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x48440c
mov ecx, dword [str.Edge_Blocked]
mov edx, dword [0x635b90]
mov eax, dword [0x635b94]
mov dword [ebp - 0x114], ecx
mov cl, byte [0x635b98]
mov ebx, edi
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], cl
mov dword [ebp - 0x17a60], edi
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0xb
jmp 0x484414
test ebx, ebx
je 0x4844ba
push 0x3ff
lea edx, [ebp - 0x9a1b]
push 0
push edx
mov byte [ebp - 0x9a1c], 0
call fcn.005dfd60
push 0xfff
lea eax, [ebp - 0x15a4b]
push 0
push eax
mov byte [ebp - 0x15a4c], 0
call fcn.005dfd60
add esp, 0x18
test esi, esi
jne 0x484463
mov ecx, dword [ebp - 0x17a50]
push ecx
call fcn.004f28b0
mov esi, eax
mov dword [ebp - 0x17a68], esi
cmp esi, 4
jbe 0x48447c
lea edx, [ebp - 0x15a4c]
push edx
lea eax, [ebp - 0x9a1c]
push eax
push esi
call fcn.00515670
mov edx, dword [ebp - 0x17a54]
lea ecx, [ebp - 0x9a1c]
push ecx
push edx
lea eax, [ebp - 0xb034]
push str._CPL__Force_Terminating_Edge_Browser_App:__s__Parent:__s
push eax
call fcn.005dfb23
push 0
push edi
lea ecx, [ebp - 0xb034]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
test ebx, ebx
jne 0x4870b5
mov eax, dword [ebp - 0x17ad8]
lea edx, [eax - 0x69f51]
cmp edx, 0x2af6
ja 0x4846ef
cmp eax, 0x6c500
je 0x4844eb
cmp eax, 0x6c000
je 0x4844eb
cmp eax, 0x6a358
jne 0x484577
lea eax, [ebp - 0x92c]
push str.esremove.
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484880
lea ecx, [ebp - 0x92c]
push str.escan_del.
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484880
lea edx, [ebp - 0x92c]
push str.escan_rem.
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484880
lea eax, [ebp - 0x92c]
push str.escandel.
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484880
lea ecx, [ebp - 0x92c]
push str.escanrem.
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484880
mov edx, dword [ebp - 0x17a54]
push 2
push edx
mov dword [ebp - 0x17a88], 0
call fcn.0046df40
mov esi, eax
add esp, 8
test esi, esi
jne 0x484645
mov ecx, dword [ebp - 0x17a54]
lea eax, [ebp - 0x17a88]
push eax
push ecx
call fcn.004f1610
mov ecx, dword [ebp - 0x17a88]
test ecx, ecx
je 0x484645
cmp byte [ecx], 0
je 0x48463c
push eax
push str.esremove
push ecx
call fcn.004f5ad0
add esp, 0xc
cmp eax, 0xffffffff
je 0x484636
mov edx, dword [str.ESRem_Blocked_A_]
mov eax, dword [0x635b04]
mov ecx, dword [0x635b08]
mov dword [ebp - 0x114], edx
mov edx, dword [0x635b0c]
mov dword [ebp - 0x110], eax
mov al, byte [0x635b10]
mov ebx, edi
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov byte [ebp - 0x104], al
mov dword [ebp - 0x17a60], edi
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0xe
mov ecx, dword [ebp - 0x17a88]
push ecx
call fcn.005e0865
add esp, 4
test ebx, ebx
je 0x4848d8
push 0x3ff
lea edx, [ebp - 0x961b]
push 0
push edx
mov byte [ebp - 0x961c], 0
call fcn.005dfd60
push 0xfff
lea eax, [ebp - 0x17a4b]
push 0
push eax
mov byte [ebp - 0x17a4c], 0
call fcn.005dfd60
mov eax, dword [ebp - 0x17a68]
add esp, 0x18
test eax, eax
jne 0x4846a0
mov ecx, dword [ebp - 0x17a50]
push ecx
call fcn.004f28b0
mov dword [ebp - 0x17a68], eax
cmp eax, 4
jbe 0x4846b9
lea edx, [ebp - 0x17a4c]
push edx
lea ecx, [ebp - 0x961c]
push ecx
push eax
call fcn.00515670
mov eax, dword [ebp - 0x17a54]
lea edx, [ebp - 0x961c]
push edx
push eax
lea ecx, [ebp - 0xbc44]
push str._CPL__Force_Terminating_ESREMOVE_App:__s__Parent:__s
push ecx
call fcn.005dfb23
push 0
push edi
lea edx, [ebp - 0xbc44]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
test ebx, ebx
jne 0x4870b5
lea ecx, [ebp - 0x92c]
push str.regedit.
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484773
lea edx, [ebp - 0x92c]
push str.regedt32.
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484773
lea eax, [ebp - 0x92c]
push str.cmd.
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484773
lea ecx, [ebp - 0x92c]
push str.powershell.
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484773
lea edx, [ebp - 0x92c]
push str.SystemSettingsAdminFlows.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x484b9f
cmp dword [0x7302d4], 0
je 0x4848fe
cmp dword [0x7302d0], 0
je 0x4848f5
lea eax, [ebp - 0x92c]
push str.regedit.
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4847d9
lea ecx, [ebp - 0x92c]
push str.regedt32.
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4847d9
lea edx, [ebp - 0x92c]
push str.cmd.
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4848f5
push 0x3ff
lea eax, [ebp - 0xb433]
push 0
push eax
mov byte [ebp - 0xb434], 0
call fcn.005dfd60
push 0xfff
lea ecx, [ebp - 0x16a4b]
push 0
push ecx
mov byte [ebp - 0x16a4c], 0
call fcn.005dfd60
mov eax, dword [ebp - 0x17a68]
add esp, 0x18
test eax, eax
jne 0x48482c
mov edx, dword [ebp - 0x17a50]
push edx
call fcn.004f28b0
mov dword [ebp - 0x17a68], eax
cmp eax, 4
jbe 0x484845
lea ecx, [ebp - 0x16a4c]
push ecx
lea edx, [ebp - 0xb434]
push edx
push eax
call fcn.00515670
lea eax, [ebp - 0xb434]
push eax
lea ecx, [ebp - 0x92c]
push ecx
lea edx, [ebp - 0x11a4c]
push str._CPL__Allowing_App:__s__Parent:__s
push edx
call fcn.005dfb23
push 0
push edi
lea eax, [ebp - 0x11a4c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x484b9f
mov ecx, dword [str.ESRem_Blocked]
mov edx, dword [0x635a4c]
mov eax, dword [0x635a50]
mov dword [ebp - 0x114], ecx
mov cx, word [0x635a54]
mov ebx, edi
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], eax
mov word [ebp - 0x108], cx
mov dword [ebp - 0x17a60], edi
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0xd
jmp 0x48464d
test esi, esi
jne 0x4846f7
mov eax, dword [ebp - 0x17a54]
push edi
push eax
call fcn.0046df40
add esp, 8
jmp 0x4846f7
cmp dword [0x7302d4], 0
jne 0x48490b
cmp dword [0x7302b0], 0
je 0x484b9f
push 0x3ff
lea ecx, [ebp - 0x3eaf]
push 0
push ecx
mov byte [ebp - 0x3eb0], 0
call fcn.005dfd60
push 0xfff
lea edx, [ebp - 0x13a4b]
push 0
push edx
mov byte [ebp - 0x13a4c], 0
call fcn.005dfd60
mov eax, dword [ebp - 0x17a68]
add esp, 0x18
test eax, eax
jne 0x48495e
mov eax, dword [ebp - 0x17a50]
push eax
call fcn.004f28b0
mov dword [ebp - 0x17a68], eax
cmp eax, 4
jbe 0x484977
lea ecx, [ebp - 0x13a4c]
push ecx
lea edx, [ebp - 0x3eb0]
push edx
push eax
call fcn.00515670
lea eax, [ebp - 0x3eb0]
push str.cmd.
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484a2b
lea ecx, [ebp - 0x3eb0]
push str.taskmgr.
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484a2b
lea edx, [ebp - 0x3eb0]
push str.sqlservr.
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484a2b
lea eax, [ebp - 0x3eb0]
push str.w3wp.
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484a2b
lea ecx, [ebp - 0x3eb0]
push str.taskhost.
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484a2b
lea edx, [ebp - 0x3eb0]
push str.explorer.
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484a2b
lea eax, [ebp - 0x3eb0]
push str.runas.
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x484b66
cmp dword [0x7302b0], 0
je 0x484a49
lea ecx, [ebp - 0x3eb0]
push ecx
push str.RestrictedEnvironment:_Date_Time_Modification_Disabled__ParentApp:_s_
lea edx, [ebp - 0xc38]
push edx
jmp 0x484a5c
lea eax, [ebp - 0x3eb0]
push eax
push str.Date_Time_Modification_Disabled__ParentApp:_s_
lea ecx, [ebp - 0xc38]
push ecx
call fcn.005dfb23
mov eax, dword [0x635984]
mov edx, dword [str.Control_Blocked]
mov ecx, dword [0x635988]
add esp, 0xc
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x114], edx
mov edx, dword [0x63598c]
lea eax, [ebp - 0x92c]
push str.regedit.
mov ebx, edi
push eax
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a60], edi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484b47
lea ecx, [ebp - 0x92c]
push str.regedt32.
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x484b47
lea edx, [ebp - 0x92c]
push str.cmd.
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x484b0c
lea ecx, [ebp - 0x3eb0]
push ecx
lea edx, [ebp - 0x92c]
push edx
mov dword [ebp - 0x17a5c], 0x709
push str._CPL__App:__s__Parent:__s__TERMINATING_
jmp 0x484b79
lea eax, [ebp - 0x92c]
push str.powershell.
push eax
call fcn.004dd6e0
add esp, 8
neg eax
sbb eax, eax
lea ecx, [ebp - 0x3eb0]
push ecx
and eax, 2
lea edx, [ebp - 0x92c]
add eax, 0x70a
push edx
mov dword [ebp - 0x17a5c], eax
push str._CPL__App:__s__Parent:__s__TERMINATING_
jmp 0x484b79
lea ecx, [ebp - 0x3eb0]
push ecx
lea edx, [ebp - 0x92c]
push edx
mov dword [ebp - 0x17a5c], 0x708
push str._CPL__App:__s__Parent:__s__TERMINATING_
jmp 0x484b79
lea ecx, [ebp - 0x3eb0]
push ecx
lea edx, [ebp - 0x92c]
push edx
push str._CPL__App:__s__Parent:__s
lea eax, [ebp - 0x12a4c]
push eax
call fcn.005dfb23
add esp, 0x10
push 0
push edi
lea ecx, [ebp - 0x12a4c]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
test ebx, ebx
jne 0x4870b5
cmp dword [0x7302a4], ebx
jne 0x484e52
mov edx, dword [ebp - 0x17a54]
push ebx
push str.System32_
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x484e52
mov eax, dword [ebp - 0x17a54]
push ebx
push str.SysWow64_
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x484e52
lea ecx, [ebp - 0x92c]
push str.netsh.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea edx, [ebp - 0x92c]
push str.powershell.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea eax, [ebp - 0x92c]
push str.sc.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea ecx, [ebp - 0x92c]
push str.wmic.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea edx, [ebp - 0x92c]
push str.schtasks.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea eax, [ebp - 0x92c]
push str.cmd.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
cmp dword [0x686080], ebx
je 0x484cd7
lea ecx, [ebp - 0x92c]
push 0x635908
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea edx, [ebp - 0x92c]
push 0x6358fc
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea eax, [ebp - 0x92c]
push str.killproc.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea ecx, [ebp - 0x92c]
push str.regsvr32.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea edx, [ebp - 0x92c]
push str.msconfig.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea eax, [ebp - 0x92c]
push str.bcdedit.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea ecx, [ebp - 0x92c]
push str.msiexec.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea edx, [ebp - 0x92c]
push str.avpmapp.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea eax, [ebp - 0x92c]
push 0x616bc0
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea ecx, [ebp - 0x92c]
push str.drvinst.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea edx, [ebp - 0x92c]
push str.BitLockerWizardElev.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea eax, [ebp - 0x92c]
push str.Manage_bde.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea ecx, [ebp - 0x92c]
push str.adb.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
lea edx, [ebp - 0x92c]
push str.tor.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484e52
mov eax, dword [ebp - 0x17a54]
push 0
push str.Tor_
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x484e52
lea ecx, [ebp - 0x92c]
push str.rundll32.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485f4e
push 0x8000
call fcn.005e20e4
mov edi, eax
add esp, 4
mov dword [ebp - 0x17a88], edi
test edi, edi
je 0x485f4e
push 9
push 0x8000
mov byte [edi], 0
mov edx, dword [ebp - 0x17a50]
push edi
push edx
call fcn.00444fd0
add esp, 0x10
test eax, eax
je 0x485e1a
cmp byte [edi], 0
je 0x485e1a
push 0xfff
lea eax, [ebp - 0x57c3]
push 0
push eax
mov byte [ebp - 0x57c4], 0
call fcn.005dfd60
push 0x13ff
lea ecx, [ebp - 0xfa4b]
push 0
push ecx
mov byte [ebp - 0xfa4c], 0
call fcn.005dfd60
push 0xffe
lea edx, [ebp - 0x57c4]
push edi
push edx
call fcn.004d5c40
add esp, 0x24
cmp dword [0x686284], 0
mov esi, 0x20
je 0x484fae
cmp byte [ebp - 0x57c4], 0
je 0x484fae
push 0
lea eax, [ebp - 0x57c4]
push str.Shadow
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x484f38
push 0
lea ecx, [ebp - 0x57c4]
push str.Delete
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x484f6e
push 0
lea edx, [ebp - 0x57c4]
push str.shadowstorage
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x484fae
push 0
lea eax, [ebp - 0x57c4]
push str.resize
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x484fae
mov ecx, dword [str.VSSAdmin_Blocked]
mov edx, dword [0x63586c]
mov eax, dword [0x635870]
mov dword [ebp - 0x114], ecx
mov ecx, dword [0x635874]
mov dword [ebp - 0x110], edx
mov dl, byte [0x635878]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], ecx
mov byte [ebp - 0x104], dl
jmp 0x485046
cmp dword [0x686080], 0
je 0x485067
lea eax, [ebp - 0x92c]
push 0x635908
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x484fef
lea ecx, [ebp - 0x92c]
push 0x6358fc
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485067
push 0
lea edx, [ebp - 0x57c4]
push str._Add
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x485067
mov eax, dword [str.NetCmd_Blocked]
mov ecx, dword [0x635854]
mov edx, dword [0x635858]
mov dword [ebp - 0x114], eax
mov ax, word [0x63585c]
mov dword [ebp - 0x110], ecx
mov cl, byte [0x63585e]
mov dword [ebp - 0x10c], edx
mov word [ebp - 0x108], ax
mov byte [ebp - 0x106], cl
mov ebx, 1
mov dword [ebp - 0x17a64], esi
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a60], ebx
lea edx, [ebp - 0x92c]
push str.powershell.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4859dd
lea eax, [ebp - 0x92c]
push str.schtasks.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4859dd
lea ecx, [ebp - 0x92c]
push str.regsvr32.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4859dd
lea edx, [ebp - 0x92c]
push str.wmic.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4850f9
cmp byte [ebp - 0x57c4], al
je 0x4850f9
push eax
lea eax, [ebp - 0x57c4]
push str.CREATE
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4859dd
lea ecx, [ebp - 0x92c]
push str.cmd.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4859dd
lea edx, [ebp - 0x92c]
push str.msiexec.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48534e
lea eax, [ebp - 0x57c4]
push esi
push eax
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4851be
cmp dword [0x7302b0], 0
je 0x485161
lea ecx, [ebp - 0x57c4]
push ecx
call fcn.0045c9c0
add esp, 4
test eax, eax
jne 0x4851be
push 0
lea edx, [ebp - 0x57c4]
push 0x627bb8
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x48534e
push 0
lea eax, [ebp - 0x57c4]
push 0x635844
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x48534e
push 0
lea ecx, [ebp - 0x57c4]
push str.http:
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x48534e
lea edx, [ebp - 0x57c4]
push esi
push edx
call fcn.005e0940
add esp, 8
test eax, eax
jne 0x485273
lea eax, [ebp - 0x92c]
push eax
lea ecx, [ebp - 0x8814]
push str._CPL___s_started_without_CmdLine_Param._Will_check_for_Miner_Activity...
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x8814]
push edx
push 0x6aec98
call fcn.004311c0
mov eax, dword [ebp - 0x17a50]
push eax
push 0
push 0x45efd0
call fcn.005e07ac
push 0
push eax
push str.CBD_7mPP
call fcn.00420720
add esp, 0x34
test ebx, ebx
je 0x485dd5
mov edi, dword [ebp - 0x17a88]
lea ecx, [ebp - 0x57c4]
push ecx
lea edx, [ebp - 0xfa4c]
push str._CPL__TERMINATE__CmdLine:__s
push edx
mov dword [ebp - 0x17a84], 1
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0xfa4c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x485f3d
cmp dword [0x7302b0], 0
je 0x48528a
lea ecx, [ebp - 0x92c]
push ecx
push str._CPL___s_started_with_restricted_parameter__Not_allowed_in_Restricted_Environment...
jmp 0x4852a9
lea eax, [ebp - 0x57c4]
push eax
call fcn.005d9a20
add esp, 4
test eax, eax
jne 0x485226
lea ecx, [ebp - 0x92c]
push ecx
push str._CPL___s_started_with_suspected_miner_activity_parameter__Blocked_Now_
lea edx, [ebp - 0x8814]
push edx
call fcn.005dfb23
add esp, 0xc
cmp byte [ebp - 0x8814], 0
je 0x485226
push 0
mov ebx, 1
push ebx
lea eax, [ebp - 0x8814]
push eax
push 0x6aec98
call fcn.004311c0
mov ecx, dword [str.Control_Blocked_A_]
mov edx, dword [0x635710]
mov eax, dword [0x635714]
mov dword [ebp - 0x114], ecx
mov ecx, dword [0x635718]
mov dword [ebp - 0x110], edx
mov dx, word [0x63571c]
mov dword [ebp - 0x10c], eax
mov al, byte [0x63571e]
add esp, 0x10
mov dword [ebp - 0x108], ecx
mov word [ebp - 0x104], dx
mov byte [ebp - 0x102], al
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x11
jmp 0x485234
lea ecx, [ebp - 0x92c]
push str.avpmapp.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x485924
lea edx, [ebp - 0x92c]
push 0x616bc0
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x485924
lea eax, [ebp - 0x92c]
push str.secapp.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x485924
cmp dword [0x7302dc], 0
je 0x48545e
lea ecx, [ebp - 0x92c]
push str.Manage_bde.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4853f7
lea edx, [ebp - 0x92c]
push str.BitLockerWizardElev.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4853f7
lea eax, [ebp - 0x92c]
push str.BitLockerWizard.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48545e
mov ecx, dword [str.Bitlocker_Blocked]
mov edx, dword [0x6356e8]
mov eax, dword [0x6356ec]
mov dword [ebp - 0x114], ecx
mov ecx, dword [0x6356f0]
mov dword [ebp - 0x110], edx
mov dx, word [0x6356f4]
mov ebx, 1
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], ecx
mov word [ebp - 0x104], dx
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x1b
jmp 0x485234
cmp dword [0x7302b8], 0
je 0x48550b
lea eax, [ebp - 0x92c]
push str.drvinst.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48550b
call fcn.0045c560
test eax, eax
jne 0x485226
push eax
lea ecx, [ebp - 0x57c4]
push str.USB_
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x485226
mov edx, dword [str.DrvInst_Blocked]
mov eax, dword [0x6356d0]
mov ecx, dword [0x6356d4]
mov dword [ebp - 0x114], edx
mov edx, dword [0x6356d8]
mov ebx, 1
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x12
jmp 0x485234
lea eax, [ebp - 0x92c]
push str.rundll32.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4855a3
push 1
push edi
call fcn.0045cc40
add esp, 8
test eax, eax
je 0x485226
mov ecx, dword [str.RunDLL32_Blocked]
mov edx, dword [0x6356bc]
mov eax, dword [0x6356c0]
mov dword [ebp - 0x114], ecx
mov ecx, dword [0x6356c4]
mov dword [ebp - 0x110], edx
mov dl, byte [0x6356c8]
mov ebx, 1
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], ecx
mov byte [ebp - 0x104], dl
mov dword [ebp - 0x17a60], 1
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x13
jmp 0x485234
mov eax, dword [0x7302bc]
mov esi, 1
cmp eax, esi
je 0x4855ba
cmp eax, 0xb
jne 0x4856d4
lea eax, [ebp - 0x92c]
push str.msconfig.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485634
mov ecx, dword [str.MSConfig_Blocked]
mov edx, dword [0x6356a8]
mov eax, dword [0x6356ac]
mov dword [ebp - 0x114], ecx
mov ecx, dword [0x6356b0]
mov dword [ebp - 0x110], edx
mov dl, byte [0x6356b4]
mov ebx, esi
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], ecx
mov byte [ebp - 0x104], dl
mov dword [ebp - 0x17a60], esi
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x1c
jmp 0x485234
cmp dword [0x7302bc], 0xb
jne 0x4856d4
lea eax, [ebp - 0x92c]
push str.bcdedit.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4856d4
mov ecx, dword [ebp - 0x17a50]
push ecx
call fcn.004f28b0
mov esi, eax
mov dword [ebp - 0x17a68], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, esi
je 0x485226
mov edx, dword [str.BCDEdit_Blocked]
mov eax, dword [0x635698]
mov ecx, dword [0x63569c]
mov dword [ebp - 0x114], edx
mov edx, dword [0x6356a0]
mov ebx, 1
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x15
jmp 0x485234
cmp dword [0x686284], 0
je 0x4857dc
lea eax, [ebp - 0x92c]
push str.bcdedit.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4857dc
cmp byte [ebp - 0x57c4], al
je 0x4857dc
push eax
lea ecx, [ebp - 0x57c4]
push str._set
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4857dc
push 0
lea edx, [ebp - 0x57c4]
push str.recoveryenabled
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4857dc
push 0
lea eax, [ebp - 0x57c4]
push 0x635678
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4857dc
mov ecx, dword [ebp - 0x17a50]
push ecx
call fcn.004f28b0
mov esi, eax
mov dword [ebp - 0x17a68], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, esi
je 0x485226
mov edx, dword [str.BCDEdit_Blocked]
mov eax, dword [0x635698]
mov ecx, dword [0x63569c]
mov dword [ebp - 0x114], edx
mov edx, dword [0x6356a0]
mov ebx, 1
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x22
jmp 0x485234
cmp dword [0x7302c0], 0
je 0x485847
lea eax, [ebp - 0x92c]
push str.adb.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485847
mov ecx, dword [str.ADB_Blocked]
mov edx, dword [0x635670]
mov eax, dword [0x635674]
mov ebx, esi
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x17a60], esi
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x14
jmp 0x485234
cmp dword [0x7302c8], 0
je 0x485226
lea ecx, [ebp - 0x92c]
push str.netsh.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485226
push eax
lea edx, [ebp - 0x57c4]
push str.wlan
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x485226
push 0
lea eax, [ebp - 0x57c4]
push 0x620c24
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x485226
push 0
lea ecx, [ebp - 0x57c4]
push str.hostednetwork
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x485226
mov edx, dword [str.NetSh_Blocked]
mov eax, dword [0x635648]
mov ecx, dword [0x63564c]
mov dword [ebp - 0x114], edx
mov dx, word [0x635650]
mov ebx, esi
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
mov word [ebp - 0x108], dx
mov dword [ebp - 0x17a60], esi
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x16
jmp 0x485234
push 0
lea eax, [ebp - 0x57c4]
push str._launch
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x485226
lea ecx, [ebp - 0x92c]
push str.secapp.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485971
lea edx, [ebp - 0x17aac]
push edx
push eax
mov eax, dword [ebp - 0x17a50]
push eax
push 0x4611c0
jmp 0x4859b4
lea ecx, [ebp - 0x92c]
push str.avpmapp.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48599f
lea edx, [ebp - 0x17aac]
push edx
push eax
mov eax, dword [ebp - 0x17a50]
push eax
push 0x461290
jmp 0x4859b4
mov edx, dword [ebp - 0x17a50]
lea ecx, [ebp - 0x17aac]
push ecx
push 0
push edx
push 0x461360
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x17a84], eax
test eax, eax
je 0x485226
lea eax, [ebp - 0x17a84]
push eax
call fcn.004dca10
jmp 0x485226
xor edi, edi
cmp dword [0x7302a8], edi
je 0x485a1e
lea ecx, [ebp - 0x92c]
push str.powershell.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x485a19
push edi
lea edx, [ebp - 0x57c4]
push str.powershell
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x485a1e
mov edi, 1
lea eax, [ebp - 0x57c4]
push eax
call fcn.005da810
mov esi, eax
add esp, 4
test esi, esi
jne 0x485af6
cmp dword [0x7302dc], eax
je 0x485a5d
push eax
lea ecx, [ebp - 0x57c4]
push str.BitLocker
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x485af1
cmp dword [0x686080], 0
je 0x485af6
push 0
lea edx, [ebp - 0x57c4]
push str._Add
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x485af6
push 0
lea eax, [ebp - 0x57c4]
push str._net
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x485af1
push 0
lea ecx, [ebp - 0x57c4]
push 0x635908
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x485af1
push 0
lea edx, [ebp - 0x57c4]
push str._net1
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x485af1
push 0
lea eax, [ebp - 0x57c4]
push 0x6358fc
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x485af6
mov esi, 1
cmp dword [0x71de6c], 0
je 0x485b43
push 0x103
lea ecx, [ebp - 0x369f]
push 0
push ecx
mov byte [ebp - 0x36a0], 0
call fcn.005dfd60
push esi
lea edx, [ebp - 0x36a0]
push str._PSInf_A____u
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x36a0]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x28
test edi, edi
jne 0x485d1a
test esi, esi
je 0x485d1a
lea ecx, [ebp - 0x92c]
push str.powershell.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485bb8
mov edx, dword [str.PowerShell_Blocked]
mov eax, dword [0x635600]
mov ecx, dword [0x635604]
mov dword [ebp - 0x114], edx
mov edx, dword [0x635608]
mov dword [ebp - 0x110], eax
mov ax, word [0x63560c]
mov dword [ebp - 0x10c], ecx
mov cl, byte [0x63560e]
mov dword [ebp - 0x108], edx
mov word [ebp - 0x104], ax
mov byte [ebp - 0x102], cl
jmp 0x485cea
lea edx, [ebp - 0x92c]
push str.schtasks.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485c0f
mov eax, dword [str.SchTasks_Blocked]
mov ecx, dword [0x6355ec]
mov edx, dword [0x6355f0]
mov dword [ebp - 0x114], eax
mov eax, dword [0x6355f4]
mov dword [ebp - 0x110], ecx
mov cl, byte [0x6355f8]
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], eax
mov byte [ebp - 0x104], cl
jmp 0x485cea
lea edx, [ebp - 0x92c]
push str.regsvr32.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485c66
mov eax, dword [str.RegSvr32_Blocked]
mov ecx, dword [0x6355d8]
mov edx, dword [0x6355dc]
mov dword [ebp - 0x114], eax
mov eax, dword [0x6355e0]
mov dword [ebp - 0x110], ecx
mov cl, byte [0x6355e4]
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], eax
mov byte [ebp - 0x104], cl
jmp 0x485cea
lea edx, [ebp - 0x92c]
push str.cmd.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485ca3
mov eax, dword [str.Cmd_Blocked]
mov ecx, dword [0x6355cc]
mov edx, dword [0x6355d0]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edx
jmp 0x485cea
lea eax, [ebp - 0x92c]
push str.wmic.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485cea
mov ecx, dword [str.WMIC_Blocked]
mov edx, dword [0x6355bc]
mov eax, dword [0x6355c0]
mov dword [ebp - 0x114], ecx
mov cl, byte [0x6355c4]
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], cl
mov ebx, 1
mov dword [ebp - 0x17ad4], ebx
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0xf
jmp 0x48522e
lea edx, [ebp - 0x92c]
push str.regsvr32.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485226
push eax
lea eax, [ebp - 0x57c4]
push 0x6355b4
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x485226
lea ecx, [ebp - 0x57c4]
push ecx
call fcn.005d9a20
add esp, 4
test eax, eax
jne 0x485226
mov edx, dword [str.RegSvr32_Blocked]
mov eax, dword [0x6355d8]
mov ecx, dword [0x6355dc]
mov ebx, 1
mov dword [ebp - 0x114], edx
mov edx, dword [0x6355e0]
mov dword [ebp - 0x110], eax
mov al, byte [0x6355e4]
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov byte [ebp - 0x104], al
mov dword [ebp - 0x17ad4], ebx
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x10
jmp 0x48522e
lea ecx, [ebp - 0x57c4]
push ecx
lea edx, [ebp - 0xfa4c]
push str._CPL__CmdLine:__s
push edx
mov dword [ebp - 0x17a84], 1
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0xfa4c]
push eax
push 0x6aec98
call fcn.004311c0
mov edi, dword [ebp - 0x17a88]
add esp, 0x1c
jmp 0x485f3d
lea ecx, [ebp - 0x92c]
push str.msiexec.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485e87
lea edx, [ebp - 0x92c]
push edx
lea eax, [ebp - 0xe24c]
push str._CPL__GCMDFAIL____s_started_possibly_without_CmdLine_Param._Will_check_for_Miner_Activity...
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0xe24c]
push ecx
push 0x6aec98
call fcn.004311c0
mov edx, dword [ebp - 0x17a50]
push edx
push 0
push 0x45efd0
call fcn.005e07ac
push 0
push eax
push str.CBD_7mPP
call fcn.00420720
add esp, 0x34
jmp 0x485f3d
cmp dword [0x7302dc], 0
je 0x485f3d
lea eax, [ebp - 0x92c]
push str.Manage_bde.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x485edc
lea ecx, [ebp - 0x92c]
push str.BitLockerWizardElev.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x485edc
lea edx, [ebp - 0x92c]
push str.BitLockerWizard.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x485f3d
mov eax, dword [str.Bitlocker_Blocked]
mov ecx, dword [0x6356e8]
mov edx, dword [0x6356ec]
mov dword [ebp - 0x114], eax
mov eax, dword [0x6356f0]
mov dword [ebp - 0x110], ecx
mov cx, word [0x6356f4]
mov ebx, 1
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], eax
mov word [ebp - 0x104], cx
mov dword [ebp - 0x17a60], ebx
mov dword [ebp - 0x17a58], ebx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x1f
push edi
call fcn.005e0865
add esp, 4
test ebx, ebx
jne 0x4870b5
lea edx, [ebp - 0x92c]
push str.tor.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x486011
mov eax, dword [ebp - 0x17a54]
push 0
push str.Tor_
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x486011
cmp dword [0x72fe84], 0
je 0x48608c
lea ecx, [ebp - 0x92c]
push str.SnippingTool.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x485fca
lea edx, [ebp - 0x92c]
push str.Screensketch.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48608c
mov eax, dword [str.Snipper_Blocked]
mov ecx, dword [0x635508]
mov edx, dword [0x63550c]
mov dword [ebp - 0x114], eax
mov eax, dword [0x635510]
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x17
jmp 0x4870a4
lea ecx, [ebp - 0x17ac0]
push ecx
push str.BlockTor
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x17ac0], 0
call fcn.004d5820
cmp dword [0x7302b0], 0
movzx eax, al
jne 0x486050
cmp eax, 1
jne 0x48608c
cmp dword [ebp - 0x17ac0], 0
je 0x48608c
mov edx, dword [str.TOR_Blocked]
mov eax, dword [0x6354f0]
mov ecx, dword [0x6354f4]
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x17
jmp 0x4870a4
lea edx, [ebp - 0x92c]
push str.svchost.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4860a9
lea ebx, [eax + 1]
jmp 0x4860d1
lea eax, [ebp - 0x92c]
push str.dllhost.exe
push eax
call fcn.004dd620
mov ebx, dword [ebp - 0x17ac4]
add esp, 8
test eax, eax
jne 0x4860d1
mov dword [ebp - 0x17abc], 1
cmp dword [0x7302c4], 1
jne 0x486212
lea ecx, [ebp - 0x92c]
push str.control.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48612a
lea edx, [ebp - 0x92c]
push str.SystemSettings.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48612a
lea eax, [ebp - 0x92c]
push str.SystemSettingsAdminFlows.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x486212
xor edi, edi
push 0x8000
mov dword [ebp - 0x17ab8], edi
call fcn.005e20e4
mov esi, eax
add esp, 4
test esi, esi
je 0x486196
push 0xe
push 0x8000
mov byte [esi], 0
mov ecx, dword [ebp - 0x17a50]
push esi
push ecx
call fcn.00444fd0
add esp, 0x10
test eax, eax
je 0x48617c
cmp byte [esi], 0
je 0x48617c
push 1
lea edx, [ebp - 0x17ab8]
push edx
push esi
call fcn.0044c510
add esp, 0xc
mov edi, eax
push esi
call fcn.005e0865
add esp, 4
cmp dword [ebp - 0x17ab8], 0
je 0x486196
test edi, edi
je 0x486212
lea eax, [ebp - 0x92c]
push eax
lea ecx, [ebp - 0xc38]
push str.Control_Panel_Blocked:_Exec_Accessed_via__s
push ecx
call fcn.005dfb23
mov edx, dword [str.Control_Blocked_D_]
mov eax, dword [0x635490]
mov ecx, dword [0x635494]
mov dword [ebp - 0x114], edx
mov edx, dword [0x635498]
mov dword [ebp - 0x110], eax
mov ax, word [0x63549c]
mov dword [ebp - 0x10c], ecx
mov cl, byte [0x63549e]
add esp, 0xc
mov dword [ebp - 0x108], edx
mov word [ebp - 0x104], ax
mov byte [ebp - 0x102], cl
mov dword [ebp - 0x17a5c], 0x711
mov dword [ebp - 0x17a64], 0x18
jmp 0x4870a4
lea edx, [ebp - 0x92c]
push str.control.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4862bb
push 8
lea eax, [ebp - 0x92c]
push str.rundll32
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4862bb
lea ecx, [ebp - 0x92c]
push str.netsh.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4862bb
lea edx, [ebp - 0x92c]
push str.mmc.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4862bb
push 7
lea eax, [ebp - 0x92c]
push str.regedit
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4862bb
lea ecx, [ebp - 0x92c]
push str.SystemSettings.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4862bb
cmp dword [ebp - 0x17abc], 0
jne 0x4862bb
test ebx, ebx
je 0x486c34
push 0x8000
call fcn.005e20e4
mov esi, eax
add esp, 4
test esi, esi
je 0x486cd8
push 0xa
push 0x8000
mov byte [esi], 0
mov edx, dword [ebp - 0x17a50]
push esi
push edx
call fcn.00444fd0
mov ecx, esi
add esp, 0x10
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4862f1
sub ecx, edi
test eax, eax
je 0x486bc5
cmp byte [esi], dl
je 0x486bf0
cmp ecx, 0x800
jae 0x486bf0
xor edi, edi
cmp dword [0x7302d4], edi
jne 0x486331
cmp dword [0x7302b0], edi
jne 0x486331
cmp dword [0x7302c4], 1
jne 0x486363
push 0
push str.timedate.cpl
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x486a7c
push 0
push str.immersivecontrolpanel
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x486a7c
mov eax, dword [0x69bacc]
test eax, eax
je 0x486375
cmp eax, 2
jne 0x4863f1
push 0
push str.ncpa.cpl
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x486988
push 0
push str.netconnections
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x486988
mov eax, 0x44b8d0
test eax, eax
jne 0x4863c8
push eax
push str.06622D85_6856_4460_8DE1_A81921B41C4B
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x486988
lea ecx, [ebp - 0x92c]
push str.netsh.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4863f1
push esi
call fcn.0045c900
add esp, 4
test eax, eax
jne 0x486988
cmp dword [0x7302b0], 0
jne 0x486407
cmp dword [0x7302c4], 1
jne 0x48652f
push 2
push 0
push esi
call fcn.0044c510
add esp, 0xc
test eax, eax
je 0x48652f
push 0
push str.ncpa.cpl
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x486449
lea edx, [ebp - 0x92c]
push edx
push str.RestrictedEnvironment:_Network_Modification_Disabled__ncpa.cpl_Accessed_via__s_
lea eax, [ebp - 0xc38]
push eax
jmp 0x4864d3
push 0
push str.powercfg.cpl
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x48646c
lea ecx, [ebp - 0x92c]
push ecx
push str.RestrictedEnvironment:_Power_Config_Modification_Disabled__powercfg.cpl_Accessed_via__s_
jmp 0x4864cc
push 0
push str.appwiz.cpl
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x486496
lea eax, [ebp - 0x92c]
push eax
push str.RestrictedEnvironment:_App_Uninstall_Modify_Disabled__appwiz.cpl_Accessed_via__s_
lea ecx, [ebp - 0xc38]
push ecx
jmp 0x4864d3
push 0
push str..cpl
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4864c0
lea edx, [ebp - 0x92c]
push edx
push str.RestrictedEnvironment:_CPL_Disabled__CPL_Accessed_via__s_
lea eax, [ebp - 0xc38]
push eax
jmp 0x4864d3
lea ecx, [ebp - 0x92c]
push ecx
push str.RestrictedEnvironment:_CPL_Disabled__Exec_Accessed_via__s_
lea edx, [ebp - 0xc38]
push edx
call fcn.005dfb23
mov eax, dword [str.Control_Blocked_F_]
mov ecx, dword [0x6352a8]
mov edx, dword [0x6352ac]
mov dword [ebp - 0x114], eax
mov eax, dword [0x6352b0]
mov dword [ebp - 0x110], ecx
mov cx, word [0x6352b4]
mov dword [ebp - 0x10c], edx
mov dl, byte [0x6352b6]
mov dword [ebp - 0x108], eax
mov word [ebp - 0x104], cx
mov byte [ebp - 0x102], dl
mov dword [ebp - 0x17a5c], 0x711
jmp 0x486b49
cmp dword [0x7302ec], 0
je 0x4865f2
lea eax, [ebp - 0x92c]
push str.mmc.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4865f2
push 0x207
push eax
lea ecx, [ebp - 0x7003]
push ecx
mov byte [ebp - 0x7004], al
call fcn.005dfd60
mov edx, dword [str.MMC_Blocked]
mov eax, dword [0x63529c]
mov ecx, dword [0x6352a0]
mov dword [ebp - 0x114], edx
mov edx, dword [ebp - 0x17a54]
push edx
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x7004]
mov edi, 1
push str._CPL__Force_Terminating_MMC_Process:__s
push eax
mov dword [ebp - 0x17a60], edi
mov dword [ebp - 0x17a58], edi
mov dword [ebp - 0x17a5c], 0x710
mov dword [ebp - 0x17a64], 0x1d
mov dword [ebp - 0x10c], ecx
call fcn.005dfb23
push 0
push edi
lea ecx, [ebp - 0x7004]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x28
push esi
push str._CPL__CmdLine:__s__TERMINATING_
jmp 0x486bfa
cmp dword [0x7302f0], 0
jne 0x486616
cmp dword [0x7302e8], 0
jne 0x486616
cmp dword [0x7302b0], 0
jne 0x486616
cmp dword [0x7302c4], 1
jne 0x48667a
push 0
push str.devmgmt
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4867f2
push 0
push str.compmgmt
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4867f2
push 0
push str.diskmgmt
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4867f2
push 0
push str.gpedit
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4867f2
test ebx, ebx
je 0x486b99
push 0
push str.__k
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4867c9
push 0x3ff
lea edx, [ebp - 0x7813]
push 0
push edx
mov dword [ebp - 0x17a6c], 0
mov byte [ebp - 0x7814], 0
call fcn.005dfd60
lea eax, [ebp - 0x17a6c]
push eax
lea ecx, [ebp - 0x7814]
push ecx
push esi
call fcn.004e1960
add esp, 0x18
cmp dword [ebp - 0x17a6c], 0xffffffff
je 0x4866f6
lea edx, [ebp - 0x17a6c]
push edx
lea eax, [ebp - 0x7814]
push eax
push esi
call fcn.004e1960
add esp, 0xc
cmp dword [ebp - 0x17a6c], 0xffffffff
mov byte [ebp - 0x7814], 0
je 0x4867c9
lea ecx, [ebp - 0x17a6c]
push ecx
lea edx, [ebp - 0x7814]
push edx
push esi
call fcn.004e1960
add esp, 0xc
cmp byte [ebp - 0x7814], 0
je 0x4867c9
mov edx, dword [str.SDRSVC_RPCSS_NetworkServiceNetworkRestricted_NetworkService_dot3svc_eapsvcs_LocalServiceAndNoImpersonation_rpcss_LocalService_imgsvc_DcomLaunch_HTTPFilter_termsvcs_bthsvcs]
push 1
push 0
push 0x2c
lea eax, [ebp - 0x17a6c]
push eax
lea ecx, [ebp - 0x43b4]
push ecx
push edx
mov dword [ebp - 0x17a6c], 0
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x17a6c], 0xffffffff
je 0x4867b6
jmp 0x486770
lea eax, [ebp - 0x7814]
push eax
lea ecx, [ebp - 0x43b4]
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4867eb
mov ecx, dword [str.SDRSVC_RPCSS_NetworkServiceNetworkRestricted_NetworkService_dot3svc_eapsvcs_LocalServiceAndNoImpersonation_rpcss_LocalService_imgsvc_DcomLaunch_HTTPFilter_termsvcs_bthsvcs]
push 1
push 0
push 0x2c
lea edx, [ebp - 0x17a6c]
push edx
lea eax, [ebp - 0x43b4]
push eax
push ecx
call fcn.004e1380
add esp, 0x18
cmp dword [ebp - 0x17a6c], 0xffffffff
jne 0x486770
cmp dword [0x686290], 0
je 0x4867c9
mov dword [ebp - 0x17a7c], 1
test ebx, ebx
je 0x486b99
push esi
test edi, edi
je 0x486b68
push str._CPL__PD__CmdLine:__s
lea ecx, [ebp - 0xac24]
push ecx
jmp 0x486b74
mov edi, 1
jmp 0x4867c9
cmp dword [0x7302b0], 0
mov edi, 1
jne 0x486896
cmp dword [0x7302c4], edi
je 0x486896
cmp dword [0x7302e8], 0
je 0x486843
push 0
push str.devmgmt
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x486905
push str.Device_Computer_Modification_Disabled__devmgmt.msc_Accessed_
lea edx, [ebp - 0xc38]
push edx
jmp 0x4868fd
cmp dword [0x7302f0], 0
je 0x486905
push 0
push str.gpedit
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x486876
push str.Device_Computer_Modification_Disabled__gpedit.msc_Accessed_
lea eax, [ebp - 0xc38]
push eax
jmp 0x4868fd
push 0
push str.compmgmt
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x486905
push str.Device_Computer_Modification_Disabled__compmgmt.msc_Accessed_
jmp 0x4868f6
push 0
push str.devmgmt
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4868b9
push str.Device_Computer_Modification_Disabled__devmgmt.msc_Accessed_
lea edx, [ebp - 0xc38]
push edx
jmp 0x4868fd
push 0
push str.compmgmt
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4868dc
push str.Device_Computer_Modification_Disabled__compmgmt.msc_Accessed_
lea eax, [ebp - 0xc38]
push eax
jmp 0x4868fd
push 0
push str.diskmgmt
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x486905
push str.Device_Computer_Modification_Disabled__diskmgmt.msc_Accessed_
lea ecx, [ebp - 0xc38]
push ecx
call fcn.005dfb23
add esp, 8
mov edx, dword [str.Control_Blocked_G_]
mov eax, dword [0x6350fc]
mov ecx, dword [0x635100]
push 0
mov dword [ebp - 0x114], edx
mov edx, dword [0x635104]
mov dword [ebp - 0x110], eax
mov ax, word [0x635108]
mov dword [ebp - 0x10c], ecx
mov cl, byte [0x63510a]
push str.compmgmt
push esi
mov dword [ebp - 0x108], edx
mov word [ebp - 0x104], ax
mov byte [ebp - 0x102], cl
mov dword [ebp - 0x17a58], edi
mov dword [ebp - 0x17a60], edi
call fcn.004f5880
add esp, 0xc
xor edx, edx
cmp eax, 0xffffffff
setne dl
push esi
push str._CPL__CmdLine:__s__TERMINATING_
add edx, 0x70d
mov dword [ebp - 0x17a5c], edx
jmp 0x486bfa
lea eax, [ebp - 0x17ab4]
push eax
push str.BlockNCPA
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x17ab4], 1
call fcn.004d5820
cmp dword [ebp - 0x17ab4], 0
je 0x4867c9
mov eax, dword [0x6350e0]
mov ecx, dword [str.IPChange_Blocked]
mov edx, dword [0x6350dc]
mov dword [ebp - 0x114], ecx
mov ecx, dword [0x6350e4]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x92c]
push eax
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x110], edx
mov dl, byte [0x6350e8]
lea ecx, [ebp - 0xc38]
push str.IPChangeNotAllowed:_Network_Modification_Disabled__ncpa.cpl_Accessed_via__s_
push ecx
mov byte [ebp - 0x104], dl
call fcn.005dfb23
push 0x207
lea edx, [ebp - 0x730f]
mov edi, 1
push 0
push edx
mov dword [ebp - 0x17a58], edi
mov dword [ebp - 0x17a60], edi
mov dword [ebp - 0x17a5c], 0x711
mov byte [ebp - 0x7310], 0
call fcn.005dfd60
mov eax, dword [ebp - 0x17a54]
push eax
lea ecx, [ebp - 0x7310]
push str._CPL__Force_Terminating_Process:__s__IP_Change_Not_Allowed_
push ecx
call fcn.005dfb23
push 0
push edi
lea edx, [ebp - 0x7310]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x34
push esi
push str._CPL__CmdLine:__s__TERMINATING_
jmp 0x486bfa
cmp dword [0x7302b0], 0
push 0
push str.timedate.cpl
push esi
je 0x486abd
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x486aa8
lea eax, [ebp - 0x92c]
push eax
push str.RestrictedEnvironment:_Date_Time_Modification_Disabled__timedate.cpl_Accessed_via__s_
jmp 0x486aeb
lea edx, [ebp - 0x92c]
push edx
push str.RestrictedEnvironment:_Date_Time_Modification_Disabled__immersivecontrolpanel_Accessed_via__s_
lea eax, [ebp - 0xc38]
push eax
jmp 0x486af2
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x486adf
lea ecx, [ebp - 0x92c]
push ecx
push str.Date_Time_Modification_Disabled__timedate.cpl_Accessed_via__s_
lea edx, [ebp - 0xc38]
push edx
jmp 0x486af2
lea eax, [ebp - 0x92c]
push eax
push str.Date_Time_Modification_Disabled__immersivecontrolpanel_Accessed_via__s_
lea ecx, [ebp - 0xc38]
push ecx
call fcn.005dfb23
mov edx, dword [str.Control_Blocked_E_]
mov eax, dword [0x634ef8]
mov ecx, dword [0x634efc]
mov dword [ebp - 0x114], edx
mov edx, dword [0x634f00]
mov dword [ebp - 0x110], eax
mov ax, word [0x634f04]
mov dword [ebp - 0x10c], ecx
mov cl, byte [0x634f06]
mov dword [ebp - 0x108], edx
mov word [ebp - 0x104], ax
mov byte [ebp - 0x102], cl
mov dword [ebp - 0x17a5c], 0x70c
add esp, 0xc
mov eax, 1
push esi
mov dword [ebp - 0x17a60], eax
mov dword [ebp - 0x17a58], eax
push str._CPL__CmdLine:__s__TERMINATING_
jmp 0x486bfa
push str._CPL__NO_PD__CmdLine:__s
lea edx, [ebp - 0xac24]
push edx
call fcn.005dfb23
add esp, 0xc
push 0
push 1
lea eax, [ebp - 0xac24]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x486c1e
cmp dword [ebp - 0x17a84], 0
jne 0x486c1e
push esi
lea ecx, [ebp - 0xac24]
push str._CPL__CmdLine:__s
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0xac24]
push edx
jmp 0x486c11
lea eax, [ebp - 0xac24]
push str._CPL__GetProcessCmdLine_Failed_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0xac24]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
jmp 0x486c1e
test ecx, ecx
jbe 0x486c1e
push ecx
push str._CPL__GetProcessCmdLine_Success_but_CmdLineLen_very_large___u__
lea edx, [ebp - 0xac24]
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0xac24]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push esi
call fcn.005e0865
add esp, 4
cmp dword [ebp - 0x17a58], 0
jne 0x4870b5
lea eax, [ebp - 0x92c]
push str.escanpro.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x486c6a
push 8
lea ecx, [ebp - 0x92c]
push str.mwavscan
push ecx
call fcn.004dd670
add esp, 0xc
test eax, eax
jne 0x486fee
push 0x8000
call fcn.005e20e4
mov edi, eax
xor ebx, ebx
add esp, 4
cmp edi, ebx
je 0x486ff0
push 0xb
push 0x8000
mov byte [edi], bl
mov edx, dword [ebp - 0x17a50]
push edi
push edx
call fcn.00444fd0
add esp, 0x10
cmp eax, ebx
je 0x486f46
cmp byte [edi], bl
je 0x486fe3
push ebx
push str._pbx
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x486d06
push edi
mov dword [ebp - 0x17ab0], 1
call fcn.005e0865
add esp, 4
jmp 0x486ff0
lea ecx, [ebp - 0xac24]
push str._CPL__Malloc_Failed_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0xac24]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x18
jmp 0x486c34
push ebx
push str._job
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x486d74
push ebx
push str._Sched
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x486d74
lea eax, [ebp - 0x17a9c]
push eax
push str.CancelScanDisabled
push str.SoftwareMicroWorldDeviceControl
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x17a9c], ebx
call fcn.004d5820
cmp dword [ebp - 0x17a9c], 1
jne 0x486fe3
push ebx
push str.USBCTRL
push edi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x486fe3
lea ecx, [ebp - 0x17a8c]
push ecx
mov dword [ebp - 0x17a8c], ebx
call fcn.004efe60
add esp, 4
test eax, eax
je 0x486e49
mov eax, dword [ebp - 0x17a8c]
cmp eax, ebx
je 0x486e3d
cmp eax, 0xffffffff
je 0x486e3d
mov edx, dword [ebp - 0x17a50]
push ebx
push edx
call fcn.005415e0
add esp, 8
cmp eax, 2
je 0x486e3d
mov eax, dword [ebp - 0x17a50]
mov ecx, dword [ebp - 0x17a54]
push eax
push ecx
lea edx, [ebp - 0x3290]
push str.___Adding_to_Protected_List___s:_d_
push edx
mov dword [ebp - 0x17b04], ebx
call fcn.005dfb23
push ebx
push 1
lea eax, [ebp - 0x3290]
push eax
push 0x6aec98
call fcn.004311c0
mov eax, dword [ebp - 0x17a8c]
add esp, 0x20
push ebx
lea ecx, [ebp - 0x17b04]
push ecx
push ebx
push ebx
push 4
lea edx, [ebp - 0x17a50]
push edx
push 0x22e028
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 0x17a50]
push ebx
push ecx
call fcn.00543990
add esp, 8
push 0x7330b8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [ebp - 0x17a8c]
push edx
call fcn.004dca10
cmp dword [ebp - 0x17a50], ebx
jbe 0x486fe3
cmp dword [0x68619c], ebx
je 0x486fe3
mov eax, dword [0x686194]
dec eax
cmp eax, 0x61
ja 0x486fe3
lea ecx, [ebp - 0x92c]
push str.mwavscan.
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x486ea4
lea edx, [ebp - 0x92c]
push str.mexe.com
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x486fe3
mov eax, dword [0x686194]
mov ecx, dword [ebp - 0x17a50]
mov edx, dword [ebp - 0x17a54]
push eax
push ecx
push edx
lea eax, [ebp - 0x3290]
push str.___Limit_CPU_For_this_JOB_process___s:_u__to__u__
push eax
call fcn.005dfb23
push ebx
push 1
lea ecx, [ebp - 0x3290]
push ecx
push 0x6aec98
call fcn.004311c0
mov edx, dword [ebp - 0x17a50]
push edx
push ebx
push 0x45c380
call fcn.005e07ac
mov esi, eax
push ebx
push esi
push str.CBD_7ePX
call fcn.00420720
add esp, 0x3c
cmp esi, 0xffffffff
jne 0x486fe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x7414]
push str.Error:_beginthread_y__fails_with_error__d
push eax
call fcn.005dfb23
push ebx
push 1
lea ecx, [ebp - 0x7414]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push edi
call fcn.005e0865
add esp, 4
jmp 0x486ff0
cmp dword [0x72bb6c], ebx
jne 0x486fe3
mov edx, dword [ebp - 0x17a50]
push edx
lea eax, [ebp - 0x120]
push 0x60cf18
push eax
call fcn.005dfb23
lea ecx, [ebp - 0x120]
push ecx
push ebx
push 0x445040
call fcn.005e07ac
mov esi, eax
push ebx
push esi
push str.CBD_7f
call fcn.00420720
add esp, 0x24
cmp esi, 0xffffffff
jne 0x486fcc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x5cc8]
push str.Error:_beginthread_z__fails_with_error__d
push edx
call fcn.005dfb23
push ebx
push 1
lea eax, [ebp - 0x5cc8]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
push edi
call fcn.005e0865
add esp, 4
jmp 0x486ff0
cmp byte [ebp - 0x120], 0
je 0x486fe3
call fcn.004e03f0
cmp byte [ebp - 0x120], 0
jne 0x486fd5
push edi
call fcn.005e0865
add esp, 4
jmp 0x486ff0
xor ebx, ebx
cmp dword [0x7302b0], ebx
je 0x4870b5
push 0x103
xor esi, esi
lea ecx, [ebp - 0x46bf]
push esi
push ecx
mov byte [ebp - 0x46c0], 0
call fcn.005dfd60
mov eax, dword [ebp - 0x17a54]
add esp, 0xc
cmp byte [eax], 0x5c
jne 0x487040
cmp byte [eax + 1], 0x5c
jne 0x487040
push esi
lea edx, [ebp - 0x46c0]
push edx
push esi
call fcn.00504d70
test eax, eax
jne 0x487040
lea esi, [eax + 1]
mov eax, dword [ebp - 0x17a54]
push eax
call fcn.004454b0
add esp, 4
mov edi, eax
cmp esi, 1
jne 0x48705c
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp edi, 3
jb 0x4870b5
mov ecx, dword [str.Zone_Blocked]
mov edx, dword [0x634db0]
mov eax, dword [0x634db4]
mov dword [ebp - 0x114], ecx
mov cl, byte [0x634db8]
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], cl
mov dword [ebp - 0x17a5c], 0x712
mov dword [ebp - 0x17a64], 0x19
mov eax, 1
mov dword [ebp - 0x17a58], eax
mov dword [ebp - 0x17a60], eax
cmp dword [ebp - 0x17a74], 0xf
je 0x4890c1
cmp dword [ebp - 0x17a80], 0
jne 0x487112
cmp dword [ebp - 0x17a58], 0
jne 0x4886cc
cmp dword [0x6b07c4], 0
je 0x48711f
cmp dword [0x6ae140], 0
je 0x48711f
cmp dword [0x6b07c8], 0
jne 0x48711f
mov edx, dword [ebp - 0x17a54]
mov eax, dword [ebp - 0x17a68]
mov ecx, dword [ebp - 0x17a50]
push edx
push eax
push ecx
call fcn.00536570
add esp, 0xc
jmp 0x48711f
cmp dword [ebp - 0x17a58], 0
jne 0x4886cc
mov eax, dword [ebp - 0x17a54]
test eax, eax
je 0x4886cc
cmp byte [eax], 0
je 0x4886cc
mov eax, dword [ebp - 0x17a50]
test eax, eax
je 0x4886cc
cmp dword [ebp - 0x17ab0], 0
jne 0x4886cc
cmp dword [ebp + 0x10], 1
mov dword [ebp - 0x17a78], 0
je 0x4886dc
push 0x3ff
xor ebx, ebx
lea edx, [ebp - 0x8013]
push ebx
push edx
mov byte [ebp - 0x8014], 0
call fcn.005dfd60
push 0x103
lea eax, [ebp - 0x1867]
push ebx
push eax
mov dword [ebp - 0x17ab4], ebx
mov dword [ebp - 0x17a6c], ebx
mov dword [ebp - 0x17aa0], ebx
mov dword [ebp - 0x17a80], ebx
mov dword [ebp - 0x17a9c], ebx
mov dword [ebp - 0x17ab8], ebx
mov dword [ebp - 0x17ac0], ebx
mov dword [ebp - 0x17aac], ebx
mov dword [ebp - 0x17a98], ebx
mov dword [ebp - 0x17a94], ebx
mov dword [ebp - 0x17aa8], ebx
mov dword [ebp - 0x17aa4], ebx
mov dword [ebp - 0x17a70], ebx
mov byte [ebp - 0x1868], bl
call fcn.005dfd60
mov ecx, dword [ebp - 0x17a54]
push 0x5c
push ecx
mov dword [ebp - 0x17ab0], ebx
mov dword [ebp - 0x17a84], ebx
xor esi, esi
call fcn.005e0a00
mov edi, eax
add esp, 0x20
cmp edi, ebx
je 0x487243
mov byte [edi], 0
mov edx, dword [ebp - 0x17a54]
push 0x5c
push edx
call fcn.005e0a00
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x48723b
mov byte [esi], bl
mov eax, dword [ebp - 0x17a54]
push 0x5c
push eax
call fcn.005e0a00
add esp, 8
mov byte [esi], 0x5c
mov byte [edi], 0x5c
cmp esi, ebx
je 0x487243
inc esi
lea ecx, [ebp - 0x92c]
push str.setup.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4872c5
cmp esi, ebx
je 0x4872c5
mov al, byte [esi]
cmp al, 0x7b
jne 0x4872b1
lea edi, [ebp - 0xba3c]
mov byte [ebp - 0xba3c], al
mov ecx, 1
lea eax, [esi + 1]
sub edi, esi
jmp 0x487280
mov dl, byte [eax]
cmp dl, 0x5c
je 0x487294
mov byte [edi + eax], dl
inc ecx
inc eax
cmp ecx, 0x3fe
jbe 0x487280
lea edx, [ebp - 0xba3c]
push edx
mov byte [ebp + ecx - 0xba3c], 0
call fcn.004dd7c0
add esp, 4
test eax, eax
je 0x4872c5
jmp 0x4872bb
cmp al, 0x37
jne 0x4872c5
cmp byte [esi + 1], 0x7a
jne 0x4872c5
mov dword [ebp - 0x17a84], 1
lea eax, [ebp - 0x92c]
push str.wget.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x487304
mov ecx, dword [ebp - 0x17a54]
push ebx
push str.wgwin_
push ecx
call fcn.004f5880
add esp, 0xc
mov edi, 1
cmp eax, 0xffffffff
je 0x487309
mov dword [ebp - 0x17a80], edi
jmp 0x487309
mov edi, 1
mov edx, dword [ebp - 0x17a54]
push ebx
push str.is_
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4873b5
mov eax, dword [ebp - 0x17a54]
push ebx
push str..tmp_
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4873b5
cmp dword [ebp - 0x17a90], ebx
je 0x4873b5
lea ecx, [ebp - 0x92c]
push str.VSCodeSetup
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4873aa
lea edx, [ebp - 0x92c]
push str.gimp
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4873aa
lea eax, [ebp - 0x92c]
push str.vcredist
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4873aa
lea ecx, [ebp - 0x92c]
push 0x2d
push ecx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x487c2e
mov dword [ebp - 0x17a9c], edi
jmp 0x487c2e
lea edx, [ebp - 0x92c]
push str.avperf
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4873f2
mov eax, dword [ebp - 0x17a54]
push ebx
push str._avperf
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4873f2
mov dword [ebp - 0x17ab4], edi
jmp 0x487c28
mov ecx, dword [ebp - 0x17a54]
push 0x6b08d8
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x48745d
lea edx, [ebp - 0x92c]
push str.Vmms.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487452
lea eax, [ebp - 0x92c]
push str.Vmwp.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487452
lea ecx, [ebp - 0x92c]
push str.Vmsp.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48745d
mov dword [ebp - 0x17ac0], edi
jmp 0x487c2e
lea edx, [ebp - 0x92c]
push str.msiexec.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4875f5
mov eax, dword [ebp - 0x17a54]
push 0x6b08d8
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4874b9
cmp dword [0x6b079c], ebx
je 0x4875f5
mov ecx, dword [ebp - 0x17a54]
push 0x6b09e0
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4875f5
mov ecx, dword [ebp - 0x17a50]
lea edx, [ebp - 0x17ab0]
push edx
lea eax, [ebp - 0x1868]
push eax
push ecx
mov dword [ebp - 0x17ab8], edi
mov dword [ebp - 0x17a6c], edi
mov dword [ebp - 0x17ab0], 0x104
call fcn.004e4940
cmp byte [ebp - 0x1868], 0
je 0x487587
push 0x103
lea edx, [ebp - 0x3393]
push ebx
push edx
mov byte [ebp - 0x3394], 0
call fcn.005dfd60
add esp, 0xc
cmp dword [0x71de6c], ebx
je 0x48754e
lea eax, [ebp - 0x1868]
push eax
lea ecx, [ebp - 0x3290]
push str.___MSIExec_User:___s_
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push ebx
push edx
lea eax, [ebp - 0x3290]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
lea ecx, [ebp - 0x1868]
push ecx
call fcn.004e4310
lea edx, [ebp - 0x3394]
push edx
call fcn.004fd220
add esp, 8
lea eax, [ebp - 0x3394]
push eax
lea ecx, [ebp - 0x1868]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x487587
mov dword [ebp - 0x17a6c], ebx
cmp dword [0x72bdf4], ebx
je 0x487c2e
push 0x8000
call fcn.005e20e4
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x487c2e
push 0xd
push 0x8000
mov byte [esi], 0
mov edx, dword [ebp - 0x17a50]
push esi
push edx
call fcn.00444fd0
add esp, 0x10
test eax, eax
je 0x4875e1
cmp byte [esi], 0
je 0x4875e7
push ebx
push 0x634d2c
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4875e7
mov dword [ebp - 0x17a78], edi
push esi
call fcn.005e0865
add esp, 4
jmp 0x487c2e
lea eax, [ebp - 0x92c]
push str.mscorsvw.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48763d
lea ecx, [ebp - 0x92c]
push str.ngentask.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48763d
lea edx, [ebp - 0x92c]
push str.ngen.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x487682
mov eax, dword [ebp - 0x17a54]
push ebx
push str.Microsoft.NET_
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x487682
mov edx, dword [ebp - 0x17a54]
lea ecx, [ebp - 0x8014]
push ecx
push edx
call fcn.00500b70
add esp, 8
test eax, eax
je 0x487682
mov dword [ebp - 0x17aac], edi
mov dword [ebp - 0x17a78], edi
jmp 0x487c28
mov eax, dword [ebp - 0x17a54]
push ebx
push str.Autodesk_
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4876b6
mov ecx, dword [ebp - 0x17a54]
push ebx
push str.Autodesk_Shared_
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4876db
mov eax, dword [ebp - 0x17a54]
lea edx, [ebp - 0x8014]
push edx
push eax
call fcn.00500b70
add esp, 8
test eax, eax
je 0x4876db
mov dword [ebp - 0x17a98], edi
jmp 0x487c2e
cmp dword [0x6b07a0], ebx
je 0x487708
mov ecx, dword [ebp - 0x17a54]
push ebx
push str.Cluster_
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x487708
mov dword [ebp - 0x17a94], edi
jmp 0x487c2e
mov edx, dword [ebp - 0x17a54]
push ebx
push str.COBOL
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x48775d
lea eax, [ebp - 0x92c]
push str.cblcored.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487752
lea ecx, [ebp - 0x92c]
push str.runw.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x48775d
mov dword [ebp - 0x17aa4], edi
jmp 0x487c2e
mov edx, dword [ebp - 0x17a54]
push ebx
push str.Futuremark_
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4879e6
lea eax, [ebp - 0x92c]
push str.FMSIScan.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea ecx, [ebp - 0x92c]
push str.WebBrowser.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea edx, [ebp - 0x92c]
push str.DX10.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea eax, [ebp - 0x92c]
push str.MFFastXcode.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea ecx, [ebp - 0x92c]
push str.PCMark7.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea edx, [ebp - 0x92c]
push str.FMSISvc.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea eax, [ebp - 0x92c]
push str.PCMark7Manager.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea ecx, [ebp - 0x92c]
push str.MFPlayback.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea edx, [ebp - 0x92c]
push str.StorageTracePlayback.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea eax, [ebp - 0x92c]
push str.Firefly.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea ecx, [ebp - 0x92c]
push str.WICImage.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea edx, [ebp - 0x92c]
push str.CNGCrypto.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea eax, [ebp - 0x92c]
push str.dxinfo.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea ecx, [ebp - 0x92c]
push str.PCMark8Manager.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea edx, [ebp - 0x92c]
push str.FlushFileCache.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea eax, [ebp - 0x92c]
push str.WordProcessing.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea ecx, [ebp - 0x92c]
push str.PhotoEditing.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea edx, [ebp - 0x92c]
push str.MFVideoChat.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea eax, [ebp - 0x92c]
push str.PCMark8.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea ecx, [ebp - 0x92c]
push str.Browsing.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea edx, [ebp - 0x92c]
push str.TextEditing.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x4879cf
lea eax, [ebp - 0x92c]
push str.ListOpenCLDevices.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x4879e6
mov dword [ebp - 0x17aa8], edi
mov dword [0x72c258], edi
mov dword [ebp - 0x17a78], edi
jmp 0x487c28
mov ecx, dword [ebp - 0x17a54]
push ebx
push str.Office
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x487ae4
lea edx, [ebp - 0x92c]
push str.Winword.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea eax, [ebp - 0x92c]
push str.Outlook.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea ecx, [ebp - 0x92c]
push str.mspub.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea edx, [ebp - 0x92c]
push str.excel.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea eax, [ebp - 0x92c]
push str.msaccess.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea ecx, [ebp - 0x92c]
push str.Frontpg.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea edx, [ebp - 0x92c]
push str.Powerpnt.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea eax, [ebp - 0x92c]
push str.acrord32.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
mov ecx, dword [ebp - 0x17a54]
push ebx
push 0x634b04
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x487c2e
lea edx, [ebp - 0x92c]
push str.sbase.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea eax, [ebp - 0x92c]
push str.scalc.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea ecx, [ebp - 0x92c]
push str.sdraw.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea edx, [ebp - 0x92c]
push str.simpress.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea eax, [ebp - 0x92c]
push str.smath.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea ecx, [ebp - 0x92c]
push str.soffice.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea edx, [ebp - 0x92c]
push str.sweb.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea eax, [ebp - 0x92c]
push str.swriter.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea ecx, [ebp - 0x92c]
push str.unopkg.exe
push ecx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea edx, [ebp - 0x92c]
push str.unopkg.bin
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x487c22
lea eax, [ebp - 0x92c]
push str.soffice.bin
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x487c2e
mov dword [ebp - 0x17a70], edi
mov dword [ebp - 0x17a6c], edi
cmp dword [ebp - 0x17a80], ebx
jne 0x48837f
cmp dword [ebp - 0x17a9c], ebx
jne 0x48837f
cmp dword [ebp - 0x17a84], ebx
jne 0x48837f
cmp dword [ebp - 0x17ab4], ebx
jne 0x48837f
cmp dword [ebp - 0x17ab8], ebx
jne 0x48837f
cmp dword [ebp - 0x17ac0], ebx
jne 0x48837f
mov eax, dword [ebp - 0x17aac]
cmp eax, ebx
jne 0x4882e1
cmp dword [ebp - 0x17a98], ebx
jne 0x4882e1
cmp dword [ebp - 0x17a94], ebx
jne 0x4882e1
cmp dword [ebp - 0x17aa4], ebx
jne 0x4882e1
cmp dword [ebp - 0x17aa8], ebx
jne 0x4882e1
cmp dword [ebp - 0x17a70], ebx
jne 0x48837f
cmp dword [ebp - 0x17a7c], ebx
jne 0x48837f
mov ecx, dword [ebp - 0x17a54]
push ebx
push ecx
push ebx
call fcn.00469a90
add esp, 0xc
test eax, eax
jne 0x488325
push ebx
lea edx, [ebp - 0x92c]
push edx
push ebx
call fcn.00469a90
add esp, 0xc
test eax, eax
jne 0x488325
mov eax, dword [ebp - 0x17a54]
push ebx
push eax
lea ecx, [ebp - 0x92c]
push ecx
call fcn.00450170
add esp, 0xc
cmp eax, edi
je 0x488325
cmp dword [0x6e9198], edi
jne 0x487d41
lea edx, [ebp - 0x92c]
push str.InetInfo.exe
push edx
call fcn.004dd620
add esp, 8
test eax, eax
je 0x488325
cmp dword [0x6e9154], edi
jne 0x487fd0
push 0x3ff
lea eax, [ebp - 0x9013]
push ebx
push eax
mov byte [ebp - 0x9014], 0
call fcn.005dfd60
push 0xfff
lea ecx, [ebp - 0x10a4b]
push ebx
push ecx
mov byte [ebp - 0x10a4c], 0
call fcn.005dfd60
add esp, 0x18
lea ecx, [ebp - 0x17ba8]
call fcn.004f29c0
mov eax, dword [ebp - 0x17a68]
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x487dac
mov edx, dword [ebp - 0x17a50]
push edx
call fcn.004f28b0
mov dword [ebp - 0x17a68], eax
cmp eax, 4
jbe 0x487dc5
lea ecx, [ebp - 0x10a4c]
push ecx
lea edx, [ebp - 0x9014]
push edx
push eax
call fcn.00515670
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
cmp dword [ebp - 0x17a68], 4
mov dword [0x6e9080], eax
jbe 0x487fb1
nop
cmp byte [ebp - 0x10a4c], 0
je 0x487fb1
cmp dword [ebp - 0x17a68], 0xffffffff
je 0x487fb1
mov eax, dword [ebp - 0x17a68]
push eax
lea ecx, [ebp - 0x12c]
push 0x60cf18
push ecx
xor edi, edi
call fcn.005dfb23
add esp, 0xc
push 1
push edi
lea edx, [ebp - 0x12c]
push edx
lea ecx, [ebp - 0x17ba8]
call fcn.004f2b40
test eax, eax
je 0x487fb1
mov ecx, dword [ebp - 0x17a68]
lea eax, [ebp - 0xe64c]
push eax
push ecx
call fcn.00541670
add esp, 8
cmp eax, 2
jne 0x487e9c
mov eax, dword [ebp - 0x17a50]
lea edx, [ebp - 0xe64c]
push edx
push eax
call fcn.00541670
add esp, 8
cmp eax, 2
je 0x487e9c
mov ecx, dword [ebp - 0x17a50]
mov edx, dword [ebp - 0x17a54]
push 1
push 2
push ecx
push edx
call fcn.0045b2a0
add esp, 0x10
mov dword [ebp - 0x17aa0], 1
cmp eax, 1
je 0x487fb1
mov edi, 1
call ebx
mov dword [0x6e9080], eax
push 0
lea eax, [ebp - 0x10a4c]
push eax
push 0
call fcn.00469a90
push 0
lea ecx, [ebp - 0x9014]
push ecx
push 0
mov esi, eax
call fcn.00469a90
add esp, 0x18
cmp esi, 2
je 0x487f27
cmp eax, 2
je 0x487f27
test edi, edi
jne 0x487f27
mov edx, dword [ebp - 0x17a68]
push edx
mov byte [ebp - 0x9014], 0
mov byte [ebp - 0x10a4c], 0
call fcn.004f28b0
mov dword [ebp - 0x17a68], eax
cmp eax, 4
jbe 0x487fb1
cmp eax, 0xffffffff
je 0x487de0
mov edx, dword [ebp - 0x17a68]
lea eax, [ebp - 0x10a4c]
push eax
lea ecx, [ebp - 0x9014]
push ecx
push edx
call fcn.00515670
jmp 0x487de0
mov eax, dword [ebp - 0x17a50]
push 0
push eax
push 0
push 0x2000700
call dword [0x6e9118]
add esp, 0x10
mov dword [ebp - 0x17aa0], 1
test eax, eax
jl 0x487f7a
mov ecx, dword [ebp - 0x17a50]
mov edx, dword [ebp - 0x17a54]
push ecx
push edx
lea eax, [ebp - 0x3290]
push str.___Process___s:_d__Registered_For_FSBP__2_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x3290]
push ecx
jmp 0x487fa4
mov edx, dword [ebp - 0x17a50]
mov eax, dword [ebp - 0x17a54]
push edx
push eax
lea ecx, [ebp - 0x3290]
push str.___Process___s:_d__Registration_For_FSBP_Failed__2_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x3290]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
lea ecx, [ebp - 0x17ba8]
mov dword [ebp - 4], 0xffffffff
call fcn.00503fb0
cmp dword [ebp - 0x17aa0], 0
jne 0x4886a6
xor ebx, ebx
push 0x103
lea edx, [ebp - 0x196b]
push ebx
push edx
mov dword [ebp - 0x17a80], ebx
mov byte [ebp - 0x196c], bl
call fcn.005dfd60
lea eax, [ebp - 0x92c]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488000
sub eax, edx
mov esi, eax
mov eax, dword [ebp - 0x17a54]
cmp byte [eax], 0x5c
jne 0x488038
cmp byte [eax + 1], 0x5c
jne 0x488038
push ebx
lea eax, [ebp - 0x196c]
push eax
push ebx
call fcn.00504d70
test eax, eax
jne 0x488038
mov dword [ebp - 0x17a80], 1
mov ecx, dword [ebp - 0x17a54]
push ecx
call fcn.004e8b10
mov edi, eax
add esp, 4
mov dword [ebp - 0x17a70], edi
cmp edi, 0xf00000
ja 0x4881e5
cmp edi, 0xe00000
jbe 0x48807f
lea edx, [ebp - 0x92c]
push str.jre_
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4881e5
cmp edi, 0xc00000
jbe 0x4880a3
lea eax, [ebp - 0x92c]
push str.opera_
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4881e5
lea ecx, [edi - 0xf4241]
cmp ecx, 0x7a11e
ja 0x488123
lea edx, [ebp - 0x92c]
push 0x634a04
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x488123
cmp esi, 0xa
je 0x4880d3
cmp esi, 0xe
jne 0x488123
mov eax, dword [ebp - 0x92a]
push eax
call fcn.004da320
add esp, 4
test eax, eax
je 0x488123
mov ecx, dword [ebp - 0x929]
push ecx
call fcn.004da320
add esp, 4
test eax, eax
je 0x488123
mov edx, dword [ebp - 0x928]
push edx
call fcn.004da320
add esp, 4
test eax, eax
je 0x488123
mov eax, dword [ebp - 0x927]
push eax
call fcn.004da320
add esp, 4
test eax, eax
jne 0x4881e5
cmp edi, 0xb71b00
jbe 0x488147
lea ecx, [ebp - 0x92c]
push str.MusicBee
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4881e5
cmp edi, 0x299999
jbe 0x488181
lea edx, [ebp - 0x92c]
push str.npp.
push edx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x488181
push ebx
lea eax, [ebp - 0x92c]
push str.install
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4881e5
cmp edi, 0x3d0900
jbe 0x4881bd
push ebx
lea ecx, [ebp - 0x92c]
push str.install
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4881e5
push ebx
lea edx, [ebp - 0x92c]
push str.setup
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4881e5
cmp edi, 0xc00000
jbe 0x488697
lea eax, [ebp - 0x92c]
push str.install_
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x488697
push 0x7ff
lea ecx, [ebp - 0xc443]
push ebx
push ecx
mov dword [ebp - 0x17a7c], ebx
mov dword [ebp - 0x17b0c], ebx
mov byte [ebp - 0xc444], 0
call fcn.005dfd60
add esp, 0xc
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x92c]
mov byte [ebp + eax - 0xc444], cl
inc eax
test cl, cl
jne 0x488210
lea edx, [ebp - 0xc444]
push 0x2e
push edx
call fcn.005e0a00
add esp, 8
cmp eax, ebx
je 0x488504
mov byte [eax], 0
mov al, byte [ebp - 0xc444]
xor esi, esi
test al, al
je 0x488504
movsx eax, al
push eax
call fcn.005e1802
add esp, 4
test eax, eax
jne 0x488276
mov ecx, dword [ebp - 0xc444]
push ecx
call fcn.004da320
add esp, 4
test eax, eax
je 0x488504
cmp byte [ebp - 0xc444], 0
je 0x488504
lea edi, [ebp - 0xc444]
lea esp, [esp]
movsx edx, byte [edi]
push edx
call fcn.005e1802
add esp, 4
test eax, eax
jne 0x4884de
movzx eax, byte [edi]
push eax
call fcn.004da320
add esp, 4
test eax, eax
jne 0x4884de
test esi, esi
jne 0x4884ea
mov al, byte [edi]
cmp al, 0x2e
je 0x4882ce
cmp al, 0x5f
je 0x4882ce
cmp al, 0x2d
jne 0x4882cf
inc ebx
cmp al, 0x2e
jne 0x4884c8
mov esi, 1
jmp 0x4884e0
cmp dword [ebp - 0x17a70], ebx
jne 0x48837f
cmp eax, ebx
jne 0x48837f
cmp dword [ebp - 0x17a98], ebx
jne 0x48837f
cmp dword [ebp - 0x17a94], ebx
jne 0x48837f
cmp dword [ebp - 0x17aa4], ebx
jne 0x48837f
cmp dword [ebp - 0x17aa8], ebx
jne 0x48837f
cmp dword [ebp - 0x17a7c], ebx
jne 0x48837f
lea eax, [ebp - 0x92c]
push str.SBDDesktop.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
je 0x48837f
mov ecx, dword [ebp - 0x17a54]
push ecx
lea edx, [ebp - 0x92c]
push edx
call fcn.0045ca70
add esp, 8
test eax, eax
jne 0x48837f
cmp dword [0x6e9198], edi
jne 0x488437
lea eax, [ebp - 0x92c]
push str.InetInfo.exe
push eax
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x488437
mov ecx, dword [ebp - 0x17a6c]
mov edx, dword [ebp - 0x17a50]
mov eax, dword [ebp - 0x17a54]
push ecx
push 1
push edx
push eax
call fcn.0045b2a0
add esp, 0x10
mov edi, eax
cmp dword [ebp - 0x17a70], ebx
je 0x48842d
mov ecx, dword [ebp - 0x17a50]
lea edx, [ebp - 0x17a7c]
push edx
push ebx
push 0x46dee0
mov dword [ebp - 0x17a7c], ecx
call fcn.005e07ac
mov esi, eax
push ebx
push esi
push str.CBD_7g
call fcn.00420720
add esp, 0x18
cmp esi, 0xffffffff
jne 0x488411
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x6af0]
push str.Error:_beginthread_a1__fails_with_error__d
push eax
call fcn.005dfb23
push ebx
push 1
lea ecx, [ebp - 0x6af0]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
jmp 0x48842d
cmp dword [ebp - 0x17a7c], ebx
je 0x48842d
lea esp, [esp]
call fcn.004e03f0
cmp dword [ebp - 0x17a7c], ebx
jne 0x488420
cmp edi, ebx
jne 0x4886a6
xor ebx, ebx
mov edx, dword [ebp - 0x17a50]
push ebx
push edx
push ebx
push 0x2000700
call dword [0x6e9118]
add esp, 0x10
test eax, eax
jl 0x48848d
mov eax, dword [ebp - 0x17a50]
mov ecx, dword [ebp - 0x17a54]
push eax
push ecx
lea edx, [ebp - 0x3290]
push str.___Process___s:_d__Registered_For_FSBP__1_
push edx
call fcn.005dfb23
push ebx
push 1
lea eax, [ebp - 0x3290]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x4886a6
mov ecx, dword [ebp - 0x17a50]
mov edx, dword [ebp - 0x17a54]
push ecx
push edx
lea eax, [ebp - 0x3290]
push str.___Process___s:_d__Registration_For_FSBP_Failed__1_
push eax
call fcn.005dfb23
push ebx
push 1
lea ecx, [ebp - 0x3290]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
jmp 0x4886a6
cmp al, 0x5f
jne 0x4884d3
mov esi, 1
jmp 0x4884e0
cmp al, 0x2d
jne 0x4884e0
mov esi, 1
jmp 0x4884e0
xor esi, esi
inc edi
cmp byte [edi], 0
jne 0x488290
cmp ebx, 3
jb 0x488504
mov esi, dword [ebp - 0x17a70]
mov dword [ebp - 0x17a7c], 1
jmp 0x4885f0
lea ecx, [ebp - 0x92c]
push str.vlc_
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x488546
push eax
lea edx, [ebp - 0x92c]
push str._win32.exe
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x488546
mov esi, dword [ebp - 0x17a70]
mov eax, 1
jmp 0x4885f6
lea eax, [ebp - 0x92c]
push 0x634a04
push eax
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x48856e
mov esi, dword [ebp - 0x17a70]
mov eax, 1
jmp 0x4885f6
lea ecx, [ebp - 0x92c]
push str.MusicBee
push ecx
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x4885a8
lea edx, [ebp - 0x92c]
push 0x5f
push edx
call fcn.005e0940
add esp, 8
test eax, eax
je 0x4885a8
mov esi, dword [ebp - 0x17a70]
mov eax, 1
jmp 0x4885f6
mov esi, dword [ebp - 0x17a70]
cmp esi, 0x2000000
jbe 0x4885f0
mov eax, dword [ebp - 0x17a54]
push 0
push str.ProgramData_
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4885f0
mov edx, dword [ebp - 0x17a54]
lea ecx, [ebp - 0x17b0c]
push ecx
push edx
call fcn.0045be60
add esp, 8
test eax, eax
mov eax, 1
je 0x4885f6
mov eax, dword [ebp - 0x17a7c]
mov byte [ebp - 0x8014], 0
test eax, eax
jne 0x488638
mov ecx, dword [ebp - 0x17a54]
lea eax, [ebp - 0x8014]
push eax
push ecx
call fcn.00500b70
add esp, 8
test eax, eax
je 0x488697
mov edx, dword [ebp - 0x17a50]
mov eax, dword [ebp - 0x17a54]
shr esi, 0x14
push esi
push edx
push eax
push str.___Process___s:_d__Size:_u_Mb__Signed__Not_Verified____ForceBypass.
jmp 0x48864f
mov edx, dword [ebp - 0x17a50]
mov eax, dword [ebp - 0x17a54]
shr esi, 0x14
push esi
push edx
push eax
push str.___Process___s:_d__Size:_u_Mb__ForceBypass.
lea ecx, [ebp - 0x196c]
push ecx
call fcn.005dfb23
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x196c]
push edx
push 0x6aec98
call fcn.004311c0
mov eax, dword [ebp - 0x17a50]
mov ecx, dword [ebp - 0x17a54]
push 1
push 4
push eax
push ecx
call fcn.0045b2a0
add esp, 0x20
mov dword [ebp - 0x17a78], 1
cmp dword [ebp - 0x17a80], 1
jne 0x4886a6
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [0x72bdf4], 0
je 0x4886cc
cmp dword [ebp - 0x17a78], 0
je 0x4886cc
mov edx, dword [ebp - 0x17a50]
push 0x8000
push edx
call fcn.004e4cb0
add esp, 8
cmp dword [ebp + 0x10], 1
jne 0x488afb
mov eax, dword [ebp - 0x17a50]
xor edi, edi
cmp eax, edi
je 0x488b62
cmp byte [ebp - 0x65dc], 0
je 0x48873a
lea ecx, [ebp - 0x65dc]
push ecx
push eax
lea edx, [ebp - 0x3290]
push str._CPL______d____s__Process_Terminated
push edx
call fcn.005dfb23
add esp, 0x10
call fcn.004d9930
test eax, eax
je 0x48874f
push edi
lea eax, [ebp - 0x65dc]
push str.Clusterclussvc.exe
push eax
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x48874f
mov dword [ebp - 0x17adc], 1
jmp 0x48874f
push eax
lea ecx, [ebp - 0x3290]
push str._CPL______d__Process_Terminated
push ecx
call fcn.005dfb23
add esp, 0xc
push edi
push 1
lea edx, [ebp - 0x3290]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [0x6b07c4], edi
je 0x48878d
cmp dword [0x6ae140], edi
je 0x48878d
cmp dword [0x6b07c8], edi
jne 0x48878d
mov eax, dword [ebp - 0x17a50]
push eax
call fcn.00538170
add esp, 4
mov ecx, dword [0x7330b8]
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test ecx, ecx
jle 0x488830
lea edx, [ebp - 0x17a68]
push edx
mov dword [ebp - 0x17a68], edi
call fcn.004efe60
add esp, 4
test eax, eax
je 0x488830
mov eax, dword [ebp - 0x17a68]
cmp eax, edi
je 0x488824
cmp eax, 0xffffffff
je 0x488824
mov eax, dword [ebp - 0x17a50]
push edi
push eax
call fcn.005415e0
add esp, 8
cmp eax, 2
jne 0x488824
mov eax, dword [ebp - 0x17a68]
push edi
lea ecx, [ebp - 0x17b08]
push ecx
push edi
push edi
push 4
lea edx, [ebp - 0x17a50]
push edx
push 0x22e02c
push eax
mov dword [ebp - 0x17b08], edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 0x17a50]
push edi
push ecx
call fcn.00544c40
add esp, 8
push 0x7330b8
call ebx
lea edx, [ebp - 0x17a68]
push edx
call fcn.004dca10
mov eax, dword [ebp - 0x17a50]
push 1
push eax
call fcn.0045b150
mov ecx, dword [ebp - 0x17a50]
push edi
push ecx
push edi
push 0x2000701
call dword [0x6e9118]
mov esi, eax
add esp, 0x18
cmp esi, edi
jl 0x48888c
cmp dword [0x71de6c], edi
je 0x4888c8
mov edx, dword [ebp - 0x17a50]
push edx
lea eax, [ebp - 0x3290]
push str.___Process_Id___d__De_Registered_From_FSBP
push eax
call fcn.005dfb23
mov ecx, dword [0x71de6c]
push edi
push ecx
lea edx, [ebp - 0x3290]
push edx
jmp 0x4888bb
cmp dword [0x71de6c], edi
je 0x4888c8
mov eax, dword [ebp - 0x17a50]
push eax
lea ecx, [ebp - 0x3290]
push str.___Process_Id___d__De_Registration_For_FSBP_Failed
push ecx
call fcn.005dfb23
mov edx, dword [0x71de6c]
push edi
push edx
lea eax, [ebp - 0x3290]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
cmp dword [0x6e916c], edi
jne 0x4888dc
cmp dword [0x6e9174], edi
je 0x488afb
mov edi, dword [ebp - 0x17a50]
test edi, edi
jbe 0x488afb
push 0x103
lea ecx, [ebp - 0x359b]
push 0
push ecx
mov byte [ebp - 0x359c], 0
call fcn.005dfd60
lea edx, [ebp - 0x359c]
push edx
push edi
call fcn.00541550
add esp, 0x14
cmp eax, 2
jne 0x488afb
mov eax, dword [ebp - 0x17a50]
cdq
push edx
push eax
push 0
push 0x2000709
call dword [0x6e9118]
mov edi, eax
add esp, 0x10
test edi, edi
jge 0x4889b8
push 0x103
lea eax, [ebp - 0x1e7f]
push 0
push eax
mov byte [ebp - 0x1e80], 0
call fcn.005dfd60
lea ecx, [ebp - 0x1e80]
push ecx
push edi
call fcn.0044c900
mov edx, dword [ebp - 0x17a50]
add esp, 0x14
cmp byte [ebp - 0x1e80], 0
lea eax, [ebp - 0x3290]
jne 0x488988
push esi
push edx
push str.___Failed_To_Remove_New_Process_From_PFACC___u_._Reason:_0x_x
jmp 0x488995
lea ecx, [ebp - 0x1e80]
push ecx
push edx
push str.___Failed_To_Remove_New_Process_From_PFACC___u_._Reason:__s
push eax
call fcn.005dfb23
add esp, 0x10
push 0
push 1
lea ecx, [ebp - 0x3290]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x488a1a
mov edx, dword [ebp - 0x17a50]
push 0
push edx
call fcn.00544ab0
add esp, 8
cmp dword [ebp - 0x17afc], 0
je 0x4889e2
mov eax, dword [0x7330c8]
test eax, eax
jle 0x4889e2
push 0x7330c8
call ebx
push 0
call fcn.00540450
mov ecx, dword [ebp - 0x17a50]
push eax
push ecx
lea edx, [ebp - 0x3290]
push str.___Process_Id_Successfully_Removed_From_PFACC___u___PidC___u_
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x3290]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x24
mov eax, dword [ebp - 0x17a50]
cdq
push edx
push eax
push 0
push 0x2000703
call dword [0x6e9118]
mov edi, eax
add esp, 0x10
test edi, edi
jge 0x488ab5
push 0x103
lea ecx, [ebp - 0x218b]
push 0
push ecx
mov byte [ebp - 0x218c], 0
call fcn.005dfd60
lea edx, [ebp - 0x218c]
push edx
push edi
call fcn.0044c900
mov eax, dword [ebp - 0x17a50]
add esp, 0x14
cmp byte [ebp - 0x218c], 0
lea ecx, [ebp - 0x3290]
jne 0x488a85
push esi
push eax
push str.___Failed_To_Remove_New_Process_From_PRACC___d_._Reason:_0x_x
jmp 0x488a92
lea edx, [ebp - 0x218c]
push edx
push eax
push str.___Failed_To_Remove_New_Process_From_PRACC___d_._Reason:__s
push ecx
call fcn.005dfb23
add esp, 0x10
push 0
push 1
lea edx, [ebp - 0x3290]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
jmp 0x488ae5
mov eax, dword [ebp - 0x17a50]
push eax
lea ecx, [ebp - 0x3290]
push str.___Process_Id_Successfully_Removed_From_PRACC___d_
push ecx
call fcn.005dfb23
push 0
push 1
lea edx, [ebp - 0x3290]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x1c
mov ecx, dword [ebp - 0x17a50]
lea eax, [ebp - 0x359c]
push eax
push ecx
call fcn.00544bf0
add esp, 8
mov ecx, dword [ebp - 0x17a50]
test ecx, ecx
je 0x488b62
cmp dword [0x71de6c], 0
je 0x488b62
mov eax, dword [ebp - 0x17a54]
test eax, eax
je 0x488b35
cmp byte [eax], 0
je 0x488b35
push ecx
push eax
lea edx, [ebp - 0x3290]
push str.___ProcNotify_ProcEnd___s:_d_
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x488b4a
push ecx
lea eax, [ebp - 0x3290]
push str.___ProcNotify_ProcEnd___d_
push eax
call fcn.005dfb23
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x3290]
push ecx
push 0x6aec98
call fcn.004311c0
add esp, 0x10
xor esi, esi
cmp dword [ebp - 0x17a58], esi
je 0x488ff0
push 0x3ff
lea edx, [ebp - 0x5bc3]
push esi
push edx
mov byte [ebp - 0x5bc4], 0
call fcn.005dfd60
mov eax, dword [ebp - 0x17a54]
add esp, 0xc
cmp byte [ebp - 0x114], 0
jne 0x488be1
cmp eax, esi
je 0x488bbd
cmp byte [eax], 0
je 0x488bbd
mov ecx, dword [ebp - 0x17a64]
mov edx, dword [ebp - 0x17a50]
push ecx
push edx
push eax
push str._CPL__Force_Terminating_Process__s__PID:_u__FW:_u_
jmp 0x488c30
mov ecx, dword [ebp - 0x17a64]
mov edx, dword [ebp - 0x17a50]
push ecx
push edx
lea eax, [ebp - 0x5bc4]
push str._CPL__Force_Terminating_Process__PID:_u__FW:_u_
push eax
call fcn.005dfb23
add esp, 0x10
jmp 0x488c3f
cmp eax, esi
je 0x488c16
cmp byte [eax], 0
je 0x488c16
mov ecx, dword [ebp - 0x17a64]
push ecx
mov ecx, dword [ebp - 0x17a50]
lea edx, [ebp - 0x114]
push edx
push ecx
push eax
lea edx, [ebp - 0x5bc4]
push str._CPL__Force_Terminating_Process__s__PID:_u____s__FW:_u_
push edx
call fcn.005dfb23
add esp, 0x18
jmp 0x488c3f
mov eax, dword [ebp - 0x17a64]
mov edx, dword [ebp - 0x17a50]
push eax
lea ecx, [ebp - 0x114]
push ecx
push edx
push str._CPL__Force_Terminating_Process__PID:_u____s__FW:_u_
lea eax, [ebp - 0x5bc4]
push eax
call fcn.005dfb23
add esp, 0x14
push esi
push 1
lea ecx, [ebp - 0x5bc4]
push ecx
push 0x6aec98
call fcn.004311c0
mov edx, dword [ebp - 0x17a50]
add esp, 0x10
push esi
push edx
call fcn.0050fb00
cmp dword [ebp - 0x17ae0], esi
je 0x488e6d
mov eax, dword [ebp - 0x17a54]
cmp eax, esi
je 0x488e6d
cmp byte [eax], 0
je 0x488e6d
cmp byte [0x72c4b0], 0
je 0x488e6d
push esi
push esi
push esi
push esi
push 0x72c4b0
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x488e6d
push 0x6e8c3c
mov dword [ebp - 0x17a80], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x17a54]
push esi
push esi
push esi
lea eax, [ebp - 0x17a80]
push eax
push ecx
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x488e62
cmp dword [ebp - 0x17a80], 0x14000
jae 0x488e62
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push 1
push esi
push str.inlock.exe_ilockmsg.exe
push eax
call fcn.0052d190
mov eax, dword [ebp - 0x17a54]
lea edx, [ebp - 0x1764]
add esp, 0x14
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x488d15
lea eax, [ebp - 0x1764]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x488d28
sub eax, edx
lea edx, [ebp - 0x1764]
push edx
mov byte [ebp + eax - 0x1765], 0x5f
call fcn.00507760
mov eax, dword [ebp - 0x17a54]
push eax
call fcn.004e8400
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
lea ebx, [ebx]
mov edx, dword [ebp - 0x17a54]
push 0
lea ecx, [ebp - 0x1764]
push ecx
push edx
call fcn.004eca90
add esp, 0xc
cmp eax, 1
je 0x488dfd
push 0x103
lea eax, [ebp - 0x3497]
push 0
push eax
mov byte [ebp - 0x3498], 0
call fcn.005dfd60
lea ecx, [ebp - 0x3498]
push 0x104
push ecx
call fcn.004d8c20
mov ecx, dword [ebp - 0x17a54]
lea edx, [ebp - 0x3498]
push edx
lea eax, [ebp - 0x1764]
push eax
push ecx
lea edx, [ebp - 0xb63c]
push str._IMSG__B_Failed_to_move___s__to___s____s
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0xb63c]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x38
push 0xc8
call edi
inc esi
cmp esi, 5
jl 0x488d60
jmp 0x488e62
lea ecx, [ebp - 0x1764]
push ecx
push str.LockMsgFN
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
mov edx, dword [ebp - 0x17a54]
push 0
push edx
push 0x72c4b0
call fcn.004edd70
mov ecx, dword [ebp - 0x17a54]
lea eax, [ebp - 0x1764]
push eax
push ecx
lea edx, [ebp - 0x9c24]
push str._IMSG__B_Successfully_moved___s__to___s_
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x9c24]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x2c
push 0x6e8c3c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x17ad4], 0
je 0x488e8f
push str.RunMSA1
push 0x6111b8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
call fcn.00418f40
cmp byte [ebp - 0x114], 0
je 0x488ee1
push 0
push 0x104
lea ecx, [ebp - 0x7108]
push ecx
push 0x60c81c
push str.BlockNotify
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [ebp - 0x7108], 0x30
je 0x488ee1
lea edx, [ebp - 0x114]
push edx
push str.Message
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorRegMsg
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
xor esi, esi
cmp dword [ebp - 0x17a60], esi
je 0x488ff2
mov edi, dword [ebp - 0x17a5c]
cmp edi, esi
jbe 0x488ff2
cmp byte [0x740c40], 0
jne 0x488f2a
push 0x6af8c8
push 0x104
push 0x740c40
push str.Application_Terminated
push 0x6344d4
push 0x614348
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0xc38], 0
je 0x488f69
mov eax, dword [ebp - 0x17a50]
push eax
lea ecx, [ebp - 0xc38]
push ecx
lea edx, [ebp - 0x5bc4]
push str._CPL__CPL_Description__s__PID:_u_
push edx
call fcn.005dfb23
push esi
push 1
lea eax, [ebp - 0x5bc4]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov eax, dword [ebp - 0x17a54]
cmp eax, esi
je 0x488f91
cmp byte [eax], 0
je 0x488f91
cmp byte [ebp - 0xc38], 0
push esi
push eax
push 0x740c40
je 0x488fe9
lea ecx, [ebp - 0xc38]
push ecx
jmp 0x488fc9
mov edx, dword [ebp - 0x17a50]
push edx
lea eax, [ebp - 0x45bc]
push str.Process_PID:_u
push eax
call fcn.005dfb23
add esp, 0xc
cmp byte [ebp - 0xc38], 0
push esi
je 0x488fdd
lea ecx, [ebp - 0x45bc]
push ecx
push 0x740c40
lea edx, [ebp - 0xc38]
push edx
push 0x60c810
push 3
push str.eScan_Monitor
push edi
call fcn.00513910
jmp 0x488ff2
lea eax, [ebp - 0x45bc]
push eax
push 0x740c40
push 0x740c40
jmp 0x488fc9
xor esi, esi
mov eax, dword [ebp - 0x17a54]
cmp eax, esi
je 0x48900b
push eax
call fcn.005e0865
add esp, 4
mov dword [ebp - 0x17a54], esi
cmp dword [ebp - 0x17adc], esi
je 0x4890c1
lea ecx, [ebp - 0x17ad0]
push ecx
push str.UnloadMonIfClusterDown
push 0x60d814
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x17ad0], esi
call fcn.004d5820
cmp dword [ebp - 0x17ad0], esi
je 0x4890c1
push esi
push 1
push str.Unloading_Monitor_as_Cluster_Service_Terminated...
push 0x6aec98
mov dword [ebp - 0x17a90], esi
call fcn.004311c0
push 1
call fcn.004f0440
push 0x683cb0
call fcn.004eae00
add esp, 0x18
mov dword [ebp - 0x17a90], eax
cmp eax, esi
je 0x4890c1
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
call edi
lea edx, [ebp - 0x17a90]
push edx
call fcn.004dca10
push str.ExitEscanMon
mov dword [ebp - 0x17a90], esi
mov dword [ebp - 0x17acc], esi
call fcn.004eae00
add esp, 4
mov dword [ebp - 0x17acc], eax
cmp eax, esi
je 0x4890c1
push eax
call edi
lea eax, [ebp - 0x17acc]
push eax
call fcn.004dca10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret