Function at 0x426bc0
Capabilities:
Create directory
Delete registry value
Get proxy
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46dd3e
mov eax, dword fs:[0]
push eax
mov eax, 0x8f70
call fcn.00465d50
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push str._rkill
add eax, 0xfc
xor edi, edi
push eax
lea edx, [ebp - 0x8294]
push edx
mov dword [ebp - 0x82c8], ecx
mov dword [ebp - 0x82c4], edi
mov dword [ebp - 0x82b4], edi
mov dword [ebp - 0x82d0], edi
mov dword [ebp - 0x82d4], edi
call fcn.00414c90
add esp, 0xc
mov dword [ebp - 4], edi
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x8224], eax
mov dword [ebp - 0x8228], edi
mov word [ebp - 0x8238], cx
xor edx, edx
mov dword [ebp - 0x829c], eax
mov dword [ebp - 0x82a0], edi
mov word [ebp - 0x82b0], dx
lea eax, [ebp - 0x82b8]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov byte [ebp - 4], 2
push 0x80000001
mov dword [ebp - 0x82bc], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x42734b
lea ecx, [ebp - 0x82c0]
push ecx
mov ecx, dword [ebp - 0x82b8]
lea edx, [ebp - 0x82bc]
push edx
lea eax, [ebp - 0x82cc]
push eax
push edi
push str.ProxyEnable
push ecx
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x82b8]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x42734b
cmp dword [ebp - 0x82bc], 1
jne 0x42734b
mov eax, 7
xor ecx, ecx
mov dword [ebp - 0x81ec], eax
mov dword [ebp - 0x81f0], edi
mov word [ebp - 0x8200], cx
xor edx, edx
mov dword [ebp - 0x8208], eax
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], dx
mov dword [ebp - 0x8264], eax
xor eax, eax
mov dword [ebp - 0x8268], edi
mov word [ebp - 0x8278], ax
mov ecx, dword [ebp - 0x82c8]
push str.Active_Proxy_Server_Detected_r_n_r_n
push ecx
mov byte [ebp - 4], 5
call fcn.00414730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x426d69
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x426d69
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x426d88
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x426d81
or eax, 4
push edi
push eax
call fcn.00402d10
mov ecx, str.ProxyOverride
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov edx, 0x80000001
lea esi, [ebp - 0x8254]
call fcn.00419920
push eax
lea ecx, [ebp - 0x8200]
mov byte [ebp - 4], 6
call fcn.00401560
mov byte [ebp - 4], 5
cmp dword [ebp - 0x8240], 8
jb 0x426dce
mov edx, dword [ebp - 0x8254]
push edx
call fcn.0044e60d
add esp, 4
mov ecx, str.ProxyServer
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov edx, 0x80000001
lea esi, [ebp - 0x8254]
call fcn.00419920
push eax
lea ecx, [ebp - 0x821c]
mov byte [ebp - 4], 7
call fcn.00401560
mov byte [ebp - 4], 5
cmp dword [ebp - 0x8240], 8
jb 0x426e14
mov eax, dword [ebp - 0x8254]
push eax
call fcn.0044e60d
add esp, 4
mov ecx, str.AutoConfigURL
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov edx, 0x80000001
lea esi, [ebp - 0x8254]
call fcn.00419920
push eax
lea ecx, [ebp - 0x8278]
mov byte [ebp - 4], 8
call fcn.00401560
mov bl, 5
mov byte [ebp - 4], bl
cmp dword [ebp - 0x8240], 8
jb 0x426e5b
mov ecx, dword [ebp - 0x8254]
push ecx
call fcn.0044e60d
add esp, 4
push 0x50
mov eax, str._HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet_Settings__n
lea esi, [ebp - 0x8238]
call fcn.00412040
push 0x1d
mov eax, str._ProxyEnable_dword:00000001_n
call fcn.00412040
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x82cc], esp
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x8200]
mov esi, 7
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push eax
mov word [ecx], dx
call fcn.004015e0
sub esp, 0x1c
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x82c0], esp
push 0xd
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push str.ProxyOverride
mov word [ecx], dx
call fcn.00401740
lea eax, [ebp - 0x8254]
push eax
mov byte [ebp - 4], bl
call fcn.0042b940
add esp, 0x3c
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0xa
call fcn.00411f30
mov byte [ebp - 4], bl
cmp dword [ebp - 0x8240], 8
jb 0x426f09
mov ecx, dword [ebp - 0x8254]
push ecx
call fcn.0044e60d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x82cc], esp
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x821c]
mov esi, 7
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push eax
mov word [ecx], dx
call fcn.004015e0
sub esp, 0x1c
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x82c0], esp
push 0xb
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push str.ProxyServer
mov word [ecx], dx
call fcn.00401740
lea eax, [ebp - 0x8254]
push eax
mov byte [ebp - 4], bl
call fcn.0042b940
add esp, 0x3c
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0xc
call fcn.00411f30
mov byte [ebp - 4], bl
cmp dword [ebp - 0x8240], 8
jb 0x426f99
mov ecx, dword [ebp - 0x8254]
push ecx
call fcn.0044e60d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x82cc], esp
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x8278]
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push eax
mov word [ecx], dx
call fcn.004015e0
sub esp, 0x1c
mov byte [ebp - 4], 0xd
mov ecx, esp
mov dword [ebp - 0x82c0], esp
push 0xd
xor edx, edx
mov dword [ecx + 0x14], esi
mov dword [ecx + 0x10], edi
push str.AutoConfigURL
mov word [ecx], dx
call fcn.00401740
lea eax, [ebp - 0x8254]
push eax
mov byte [ebp - 4], bl
call fcn.0042b940
add esp, 0x3c
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0xe
call fcn.00411f30
mov byte [ebp - 4], bl
cmp dword [ebp - 0x8240], 8
jb 0x427024
mov ecx, dword [ebp - 0x8254]
push ecx
call fcn.0044e60d
add esp, 4
push str.ProxyEnable
mov ecx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov edx, 0x80000001
call fcn.00419ac0
add esp, 4
test eax, eax
je 0x427099
mov edx, dword [ebp - 0x82c8]
push str.__Proxy_Disabled._r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x42707a
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x42707a
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x427099
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x427092
or eax, 4
push edi
push eax
call fcn.00402d10
lea edx, [ebp - 0x82b8]
push edx
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4270d0
mov eax, dword [ebp - 0x82b8]
push str.ProxyOverride
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4270dd
mov ecx, dword [ebp - 0x82b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x82c8]
push str.__ProxyOverride_value_deleted._r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x427118
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x427118
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x427137
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x427130
or eax, 4
push edi
push eax
call fcn.00402d10
lea edx, [ebp - 0x82b8]
push edx
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42716e
mov eax, dword [ebp - 0x82b8]
push str.ProxyServer
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x42717b
mov ecx, dword [ebp - 0x82b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x82c8]
push str.__ProxyServer_value_deleted._r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x4271b6
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x4271b6
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x4271d5
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x4271ce
or eax, 4
push edi
push eax
call fcn.00402d10
lea edx, [ebp - 0x82b8]
push edx
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42720c
mov eax, dword [ebp - 0x82b8]
push str.AutoConfigURL
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x427219
mov ecx, dword [ebp - 0x82b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x82c8]
push str.__AutoConfigURL_value_deleted._r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x427254
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x427254
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x427273
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x42726c
or eax, 4
push edi
push eax
call fcn.00402d10
mov edx, dword [ebp - 0x82c8]
push str.__Proxy_settings_were_backed_up_to_Registry_file._r_n_r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x4272ae
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x4272ae
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x4272cd
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x4272c6
or eax, 4
push edi
push eax
call fcn.00402d10
cmp dword [ebp - 0x8264], 8
jb 0x4272e5
mov edx, dword [ebp - 0x8278]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
cmp dword [ebp - 0x8208], 8
mov dword [ebp - 0x8264], 7
mov dword [ebp - 0x8268], edi
mov word [ebp - 0x8278], ax
jb 0x427316
mov ecx, dword [ebp - 0x821c]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x81ec], 8
mov dword [ebp - 0x8208], 7
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], dx
jb 0x42734b
mov eax, dword [ebp - 0x8200]
push eax
call fcn.0044e60d
add esp, 4
mov ecx, dword [ebp - 0x82c8]
push str.Checking_Registry_for_malware_related_settings:_r_n_r_n
push ecx
call fcn.00414730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x427386
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x427386
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x4273a5
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x42739e
or eax, 4
push edi
push eax
call fcn.00402d10
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0x82b8]
push edx
push 0x20019
push edi
push str.SoftwarePoliciesMicrosoftWindowsSystem
push 0x80000001
call ebx
cmp eax, edi
jne 0x427607
lea eax, [ebp - 0x82c0]
push eax
mov eax, dword [ebp - 0x82b8]
lea ecx, [ebp - 0x82bc]
push ecx
lea edx, [ebp - 0x82cc]
push edx
push edi
push str.DisableCMD
push eax
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x82b8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x427607
cmp dword [ebp - 0x82bc], edi
je 0x427607
lea edx, [ebp - 0x82b8]
push edx
push 0xf013f
push edi
push str.SoftwarePoliciesMicrosoftWindowsSystem
push 0x80000001
call ebx
test eax, eax
jne 0x427454
mov eax, dword [ebp - 0x82b8]
push str.DisableCMD
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x427461
mov ecx, dword [ebp - 0x82b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x82c8]
push str.__System_Policy_Removed:__DisableCMD__HKCU__r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x42749c
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x42749c
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x4274bb
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x4274b4
or eax, 4
push edi
push eax
call fcn.00402d10
push 0x40
mov eax, str._n_HKEY_CURRENT_USERSoftwarePoliciesMicrosoftWindowsSystem__n
lea esi, [ebp - 0x8238]
call fcn.00412040
mov edx, dword [ebp - 0x82bc]
push edx
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00403130
add esp, 8
xor eax, eax
mov word [ebp - 0x8200], ax
mov ebx, 7
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x427510
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x1a4]
push ecx
lea ecx, [ebp - 0x8200]
call fcn.00401740
lea edx, [ebp - 0x8200]
push edx
mov edx, str._DisableCMD_
lea esi, [ebp - 0x8278]
mov byte [ebp - 4], 0xf
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486be4
lea edi, [ebp - 0x821c]
mov byte [ebp - 4], 0x10
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x11
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x8208], esi
jb 0x427599
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8264], esi
jb 0x4275c5
mov edx, dword [ebp - 0x8278]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x8264], ebx
mov dword [ebp - 0x8268], edi
mov word [ebp - 0x8278], ax
cmp dword [ebp - 0x81ec], esi
jb 0x4275f5
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x82c4], 1
xor edi, edi
lea edx, [ebp - 0x82b8]
push edx
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
cmp eax, edi
jne 0x427868
lea eax, [ebp - 0x82c0]
push eax
mov eax, dword [ebp - 0x82b8]
lea ecx, [ebp - 0x82bc]
push ecx
lea edx, [ebp - 0x82cc]
push edx
push edi
push str.DisableRegistryTools
push eax
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x82b8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x427868
cmp dword [ebp - 0x82bc], edi
je 0x427868
lea edx, [ebp - 0x82b8]
push edx
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
test eax, eax
jne 0x4276b0
mov eax, dword [ebp - 0x82b8]
push str.DisableRegistryTools
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4276bd
mov ecx, dword [ebp - 0x82b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x82c8]
push str.__System_Policy_Removed:__DisableRegistryTools__HKCU__r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x4276f8
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x4276f8
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x427717
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x427710
or eax, 4
push edi
push eax
call fcn.00402d10
push 0x4f
mov eax, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__n
lea esi, [ebp - 0x8238]
call fcn.00412040
mov edx, dword [ebp - 0x82bc]
push edx
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
mov dword [ebp - 0x82b4], 1
call fcn.00403130
add esp, 8
xor eax, eax
mov word [ebp - 0x8200], ax
mov ebx, 7
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x427775
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x1a4]
push ecx
lea ecx, [ebp - 0x8200]
call fcn.00401740
lea edx, [ebp - 0x8200]
push edx
mov edx, 0x486dcc
lea esi, [ebp - 0x8278]
mov byte [ebp - 4], 0x12
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486dc8
lea edi, [ebp - 0x821c]
mov byte [ebp - 4], 0x13
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x14
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x8208], esi
jb 0x4277fe
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8264], esi
jb 0x42782a
mov edx, dword [ebp - 0x8278]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x8264], ebx
mov dword [ebp - 0x8268], edi
mov word [ebp - 0x8278], ax
cmp dword [ebp - 0x81ec], esi
jb 0x42785a
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
inc dword [ebp - 0x82c4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
lea edx, [ebp - 0x82b8]
push edx
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
cmp eax, edi
jne 0x427ac7
lea eax, [ebp - 0x82c0]
push eax
mov eax, dword [ebp - 0x82b8]
lea ecx, [ebp - 0x82bc]
push ecx
lea edx, [ebp - 0x82cc]
push edx
push edi
push str.DisableTaskMgr
push eax
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x82b8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x427ac7
cmp dword [ebp - 0x82bc], edi
je 0x427ac7
lea edx, [ebp - 0x82b8]
push edx
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
test eax, eax
jne 0x427911
mov eax, dword [ebp - 0x82b8]
push str.DisableTaskMgr
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x42791e
mov ecx, dword [ebp - 0x82b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x82c8]
push str.__System_Policy_Removed:__DisableTaskMgr__HKCU__r_n
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x427959
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x427959
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp ebx, edi
je 0x427978
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], edi
jne 0x427971
or eax, 4
push edi
push eax
call fcn.00402d10
cmp dword [ebp - 0x82b4], edi
jne 0x427992
push 0x4f
mov eax, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem__n
lea esi, [ebp - 0x8238]
call fcn.00412040
mov edx, dword [ebp - 0x82bc]
push edx
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00403130
add esp, 8
xor eax, eax
mov word [ebp - 0x8200], ax
mov ebx, 7
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4279d4
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x1a4]
push ecx
lea ecx, [ebp - 0x8200]
call fcn.00401740
lea edx, [ebp - 0x8200]
push edx
mov edx, str._DisableTaskMgr_
lea esi, [ebp - 0x8278]
mov byte [ebp - 4], 0x15
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486dc8
lea edi, [ebp - 0x821c]
mov byte [ebp - 4], 0x16
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x17
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x8208], esi
jb 0x427a5d
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8264], esi
jb 0x427a89
mov edx, dword [ebp - 0x8278]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x8264], ebx
mov dword [ebp - 0x8268], edi
mov word [ebp - 0x8278], ax
cmp dword [ebp - 0x81ec], esi
jb 0x427ab9
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
inc dword [ebp - 0x82c4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
lea edx, [ebp - 0x82b4]
push edx
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call ebx
cmp eax, edi
jne 0x427cb0
lea eax, [ebp - 0x82c0]
push eax
mov eax, dword [ebp - 0x82b4]
lea ecx, [ebp - 0x82bc]
push ecx
lea edx, [ebp - 0x82cc]
push edx
push edi
push str.NoRun
push eax
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x82b4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x427cb0
cmp dword [ebp - 0x82bc], edi
je 0x427cb0
lea edx, [ebp - 0x82b4]
push edx
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call ebx
test eax, eax
jne 0x427b70
mov eax, dword [ebp - 0x82b4]
push str.NoRun
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x427b7d
mov ecx, dword [ebp - 0x82b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x82c8]
push str.__Explorer_Policy_Removed:__NoRun__HKCU__r_n
push edx
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push 0x51
mov eax, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__n
lea esi, [ebp - 0x8238]
call fcn.00412040
mov eax, dword [ebp - 0x82bc]
push eax
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
mov dword [ebp - 0x82d0], 1
call fcn.00403130
add esp, 8
mov ecx, ebx
push ecx
lea ecx, [ebp - 0x8254]
call fcn.0040ead0
push eax
mov edx, str._NoRun_
lea esi, [ebp - 0x821c]
mov byte [ebp - 4], 0x18
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486dc8
lea edi, [ebp - 0x8200]
mov byte [ebp - 4], 0x19
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x1a
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x81ec], esi
jb 0x427c41
mov edx, dword [ebp - 0x8200]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov ebx, 7
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
mov word [ebp - 0x8200], ax
cmp dword [ebp - 0x8208], esi
jb 0x427c72
mov ecx, dword [ebp - 0x821c]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov byte [ebp - 4], 2
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], dx
cmp dword [ebp - 0x8240], esi
jb 0x427ca2
mov eax, dword [ebp - 0x8254]
push eax
call fcn.0044e60d
add esp, 4
inc dword [ebp - 0x82c4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
lea ecx, [ebp - 0x82b4]
push ecx
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call ebx
cmp eax, edi
jne 0x427ea1
lea edx, [ebp - 0x82c0]
push edx
mov edx, dword [ebp - 0x82b4]
lea eax, [ebp - 0x82bc]
push eax
lea ecx, [ebp - 0x82cc]
push ecx
push edi
push str.NoDesktop
push edx
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x82b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x427ea1
cmp dword [ebp - 0x82bc], edi
je 0x427ea1
lea ecx, [ebp - 0x82b4]
push ecx
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call ebx
test eax, eax
jne 0x427d59
mov edx, dword [ebp - 0x82b4]
push str.NoDesktop
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x427d66
mov eax, dword [ebp - 0x82b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x82c8]
push str.__Explorer_Policy_Removed:__NoDesktop__HKCU__r_n
push ecx
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
cmp dword [ebp - 0x82d0], edi
jne 0x427da4
push 0x51
mov eax, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__n
lea esi, [ebp - 0x8238]
call fcn.00412040
mov dword [ebp - 0x82d0], 1
mov edx, dword [ebp - 0x82bc]
push edx
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00403130
add esp, 8
mov eax, ebx
push eax
lea ecx, [ebp - 0x8254]
call fcn.0040ead0
push eax
mov edx, str._NoDesktop_
lea esi, [ebp - 0x821c]
mov byte [ebp - 4], 0x1b
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486dc8
lea edi, [ebp - 0x8200]
mov byte [ebp - 4], 0x1c
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x1d
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x81ec], esi
jb 0x427e32
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov ebx, 7
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
mov word [ebp - 0x8200], dx
cmp dword [ebp - 0x8208], esi
jb 0x427e63
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8240], esi
jb 0x427e93
mov edx, dword [ebp - 0x8254]
push edx
call fcn.0044e60d
add esp, 4
inc dword [ebp - 0x82c4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
lea eax, [ebp - 0x82b4]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call ebx
cmp eax, edi
jne 0x428091
lea ecx, [ebp - 0x82c0]
push ecx
mov ecx, dword [ebp - 0x82b4]
lea edx, [ebp - 0x82bc]
push edx
lea eax, [ebp - 0x82cc]
push eax
push edi
push str.NoSetActiveDesktop
push ecx
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x82b4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x428091
cmp dword [ebp - 0x82bc], edi
je 0x428091
lea eax, [ebp - 0x82b4]
push eax
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
call ebx
test eax, eax
jne 0x427f4a
mov ecx, dword [ebp - 0x82b4]
push str.NoSetActiveDesktop
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x427f57
mov edx, dword [ebp - 0x82b4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x82c8]
push str.__Explorer_Policy_Removed:__NoSetActiveDesktop__HKCU__r_n
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
cmp dword [ebp - 0x82d0], edi
jne 0x427f94
lea ecx, [ebp - 0x8238]
push ecx
mov eax, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer__n
call fcn.0040eb50
mov dword [ebp - 0x82d0], 1
mov edx, dword [ebp - 0x82bc]
push edx
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00403130
add esp, 8
mov eax, ebx
push eax
lea ecx, [ebp - 0x8254]
call fcn.0040ead0
push eax
mov edx, str._NoSetActiveDesktop_
lea esi, [ebp - 0x821c]
mov byte [ebp - 4], 0x1e
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486dc8
lea edi, [ebp - 0x8200]
mov byte [ebp - 4], 0x1f
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x20
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x81ec], esi
jb 0x428022
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov ebx, 7
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
mov word [ebp - 0x8200], dx
cmp dword [ebp - 0x8208], esi
jb 0x428053
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8240], esi
jb 0x428083
mov edx, dword [ebp - 0x8254]
push edx
call fcn.0044e60d
add esp, 4
inc dword [ebp - 0x82c4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
lea eax, [ebp - 0x82b4]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000001
call ebx
cmp eax, edi
jne 0x4282ae
lea ecx, [ebp - 0x82c0]
push ecx
mov ecx, dword [ebp - 0x82b4]
lea edx, [ebp - 0x82bc]
push edx
lea eax, [ebp - 0x82cc]
push eax
push edi
push str.DisallowRun
push ecx
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x82b4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x4282ae
cmp dword [ebp - 0x82bc], edi
je 0x4282ae
lea eax, [ebp - 0x82b4]
push eax
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42813e
mov ecx, dword [ebp - 0x82b4]
push str.DisallowRun
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x42814b
mov edx, dword [ebp - 0x82b4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x82c8]
push str.__Explorer_Policy_Removed:__DisallowRun__HKCU__r_n
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
cmp dword [ebp - 0x82d0], edi
jne 0x42817e
lea ecx, [ebp - 0x8238]
push ecx
mov eax, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer__n
call fcn.0040eb50
mov edx, dword [ebp - 0x82bc]
push edx
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00403130
add esp, 8
mov eax, ebx
push eax
lea ecx, [ebp - 0x8254]
call fcn.0040ead0
push eax
mov edx, str._DisallowRun_
lea esi, [ebp - 0x821c]
mov byte [ebp - 4], 0x21
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486dc8
lea edi, [ebp - 0x8200]
mov byte [ebp - 4], 0x22
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x23
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x81ec], esi
jb 0x42820c
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov ebx, 7
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
mov word [ebp - 0x8200], dx
cmp dword [ebp - 0x8208], esi
jb 0x42823d
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
mov dword [ebp - 0x8208], ebx
mov bl, 2
xor ecx, ecx
mov byte [ebp - 4], bl
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8240], esi
jb 0x42826e
mov edx, dword [ebp - 0x8254]
push edx
call fcn.0044e60d
add esp, 4
inc dword [ebp - 0x82c4]
lea ecx, [ebp - 0x8254]
call fcn.0042b000
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x24
call fcn.00411f30
mov byte [ebp - 4], bl
cmp dword [ebp - 0x8240], esi
jb 0x4282ac
mov eax, dword [ebp - 0x8254]
push eax
call fcn.0044e60d
add esp, 4
xor edi, edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x82b4]
push ecx
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
call ebx
cmp eax, edi
jne 0x428493
lea edx, [ebp - 0x82c0]
push edx
mov edx, dword [ebp - 0x82b4]
lea eax, [ebp - 0x82bc]
push eax
lea ecx, [ebp - 0x82cc]
push ecx
push edi
push str.HideIcons
push edx
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x82b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x428493
cmp dword [ebp - 0x82bc], edi
je 0x428493
lea ecx, [ebp - 0x82b4]
push ecx
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
call ebx
test eax, eax
jne 0x42835d
mov edx, dword [ebp - 0x82b4]
push str.HideIcons
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x42836a
mov eax, dword [ebp - 0x82b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x82c8]
push str.__Advanced_Explorer_Setting_Removed:__HideIcons__HKCU__r_n
push ecx
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push 0x51
mov eax, str._n_HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced__n
lea esi, [ebp - 0x8238]
call fcn.00412040
mov edx, dword [ebp - 0x82bc]
push edx
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00403130
add esp, 8
mov eax, ebx
push eax
lea ecx, [ebp - 0x8254]
call fcn.0040ead0
push eax
mov edx, str._HideIcons_
lea esi, [ebp - 0x821c]
mov byte [ebp - 4], 0x25
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486dc8
lea edi, [ebp - 0x8200]
mov byte [ebp - 4], 0x26
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x27
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x81ec], esi
jb 0x428424
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov ebx, 7
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
mov word [ebp - 0x8200], dx
cmp dword [ebp - 0x8208], esi
jb 0x428455
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8240], esi
jb 0x428485
mov edx, dword [ebp - 0x8254]
push edx
call fcn.0044e60d
add esp, 4
inc dword [ebp - 0x82c4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
lea eax, [ebp - 0x82b4]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000002
call ebx
cmp eax, edi
jne 0x42867b
lea ecx, [ebp - 0x82c0]
push ecx
mov ecx, dword [ebp - 0x82b4]
lea edx, [ebp - 0x82bc]
push edx
lea eax, [ebp - 0x82cc]
push eax
push edi
push str.NoRun
push ecx
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x82b4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x42867b
cmp dword [ebp - 0x82bc], edi
je 0x42867b
lea eax, [ebp - 0x82b4]
push eax
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x42853c
mov ecx, dword [ebp - 0x82b4]
push str.NoRun
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x428549
mov edx, dword [ebp - 0x82b4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x82c8]
push str.__Explorer_Policy_Removed:__NoRun__HKLM__r_n
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
lea ecx, [ebp - 0x8238]
push ecx
mov eax, str._n_HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer__n
call fcn.0040eb50
mov edx, dword [ebp - 0x82bc]
push edx
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
mov dword [ebp - 0x82d4], 1
call fcn.00403130
add esp, 8
mov eax, ebx
push eax
lea ecx, [ebp - 0x8254]
call fcn.0040ead0
push eax
mov edx, str._NoRun_
lea esi, [ebp - 0x821c]
mov byte [ebp - 4], 0x28
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486dc8
lea edi, [ebp - 0x8200]
mov byte [ebp - 4], 0x29
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x2a
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x81ec], esi
jb 0x42860c
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov ebx, 7
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
mov word [ebp - 0x8200], dx
cmp dword [ebp - 0x8208], esi
jb 0x42863d
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8240], esi
jb 0x42866d
mov edx, dword [ebp - 0x8254]
push edx
call fcn.0044e60d
add esp, 4
inc dword [ebp - 0x82c4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
lea eax, [ebp - 0x82b4]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000002
call ebx
cmp eax, edi
jne 0x42886b
lea ecx, [ebp - 0x82c0]
push ecx
mov ecx, dword [ebp - 0x82b4]
lea edx, [ebp - 0x82bc]
push edx
lea eax, [ebp - 0x82cc]
push eax
push edi
push str.NoDesktop
push ecx
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x82b4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x42886b
cmp dword [ebp - 0x82bc], edi
je 0x42886b
lea eax, [ebp - 0x82b4]
push eax
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x428724
mov ecx, dword [ebp - 0x82b4]
push str.NoDesktop
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x428731
mov edx, dword [ebp - 0x82b4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x82c8]
push str.__Explorer_Policy_Removed:__NoDesktop__HKLM__r_n
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
cmp dword [ebp - 0x82d4], edi
jne 0x42876e
lea ecx, [ebp - 0x8238]
push ecx
mov eax, str._n_HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer__n
call fcn.0040eb50
mov dword [ebp - 0x82d4], 1
mov edx, dword [ebp - 0x82bc]
push edx
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00403130
add esp, 8
mov eax, ebx
push eax
lea ecx, [ebp - 0x8254]
call fcn.0040ead0
push eax
mov edx, str._NoDesktop_
lea esi, [ebp - 0x821c]
mov byte [ebp - 4], 0x2b
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486dc8
lea edi, [ebp - 0x8200]
mov byte [ebp - 4], 0x2c
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x2d
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x81ec], esi
jb 0x4287fc
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov ebx, 7
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
mov word [ebp - 0x8200], dx
cmp dword [ebp - 0x8208], esi
jb 0x42882d
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8240], esi
jb 0x42885d
mov edx, dword [ebp - 0x8254]
push edx
call fcn.0044e60d
add esp, 4
inc dword [ebp - 0x82c4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
lea eax, [ebp - 0x82b4]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000002
call ebx
cmp eax, edi
jne 0x428a51
lea ecx, [ebp - 0x82c0]
push ecx
mov ecx, dword [ebp - 0x82b4]
lea edx, [ebp - 0x82bc]
push edx
lea eax, [ebp - 0x82cc]
push eax
push edi
push str.NoSetActiveDesktop
push ecx
mov dword [ebp - 0x82c0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x82b4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x428a51
cmp dword [ebp - 0x82bc], edi
je 0x428a51
lea eax, [ebp - 0x82b4]
push eax
push 0xf013f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x428914
mov ecx, dword [ebp - 0x82b4]
push str.NoSetActiveDesktop
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x428921
mov edx, dword [ebp - 0x82b4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x82c8]
push str.__Explorer_Policy_Removed:__NoSetActiveDesktop__HKLM__r_n
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
cmp dword [ebp - 0x82d4], edi
jne 0x428954
lea ecx, [ebp - 0x8238]
push ecx
mov eax, str._n_HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionpoliciesExplorer__n
call fcn.0040eb50
mov edx, dword [ebp - 0x82bc]
push edx
push 0x473454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00403130
add esp, 8
mov eax, ebx
push eax
lea ecx, [ebp - 0x8254]
call fcn.0040ead0
push eax
mov edx, str._NoSetActiveDesktop_
lea esi, [ebp - 0x821c]
mov byte [ebp - 4], 0x2e
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x486dc8
lea edi, [ebp - 0x8200]
mov byte [ebp - 4], 0x2f
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x30
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x81ec], esi
jb 0x4289e2
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov ebx, 7
mov dword [ebp - 0x81ec], ebx
mov dword [ebp - 0x81f0], edi
mov word [ebp - 0x8200], dx
cmp dword [ebp - 0x8208], esi
jb 0x428a13
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8240], esi
jb 0x428a43
mov edx, dword [ebp - 0x8254]
push edx
call fcn.0044e60d
add esp, 4
inc dword [ebp - 0x82c4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
mov dword [ebp - 0x8f74], str.1.exe
mov dword [ebp - 0x8f70], str.2.exe
mov dword [ebp - 0x8f6c], str.aAvgApi.exe
mov dword [ebp - 0x8f68], str.AAWTray.exe
mov dword [ebp - 0x8f64], str.About.exe
mov dword [ebp - 0x8f60], str.ackwin32.exe
mov dword [ebp - 0x8f5c], str.adaware.exe
mov dword [ebp - 0x8f58], str.Ad_Aware.exe
mov dword [ebp - 0x8f54], str.advxdwin.exe
mov dword [ebp - 0x8f50], str.AdwarePrj.exe
mov dword [ebp - 0x8f4c], str.a.exe
mov dword [ebp - 0x8f48], str.agent.exe
mov dword [ebp - 0x8f44], str.agentsvr.exe
mov dword [ebp - 0x8f40], str.agentw.exe
mov dword [ebp - 0x8f3c], str.alertsvc.exe
mov dword [ebp - 0x8f38], str.alevir.exe
mov dword [ebp - 0x8f34], str.alogserv.exe
mov dword [ebp - 0x8f30], str.AlphaAV
mov dword [ebp - 0x8f2c], str.AlphaAV.exe
mov dword [ebp - 0x8f28], str.AluSchedulerSvc.exe
mov dword [ebp - 0x8f24], str.amon9x.exe
mov dword [ebp - 0x8f20], str.AntispywarXP2009.exe
mov dword [ebp - 0x8f1c], str.anti_trojan.exe
mov dword [ebp - 0x8f18], str.antivirus.exe
mov dword [ebp - 0x8f14], str.AntivirusPlus
mov dword [ebp - 0x8f10], str.AntivirusPlus.exe
mov dword [ebp - 0x8f0c], str.AntivirusPro_2010.exe
mov dword [ebp - 0x8f08], str.AntiVirus_Pro.exe
mov dword [ebp - 0x8f04], str.Anti_Virus_Professional.exe
mov dword [ebp - 0x8f00], str.AntivirusXP
mov dword [ebp - 0x8efc], str.AntivirusXP.exe
mov dword [ebp - 0x8ef8], str.antivirusxppro2009.exe
mov dword [ebp - 0x8ef4], str.ants.exe
mov dword [ebp - 0x8ef0], str.apimonitor.exe
mov dword [ebp - 0x8eec], str.aplica32.exe
mov dword [ebp - 0x8ee8], str.apvxdwin.exe
mov dword [ebp - 0x8ee4], str.arr.exe
mov dword [ebp - 0x8ee0], str.ashAvast.exe
mov dword [ebp - 0x8edc], str.ashBug.exe
mov dword [ebp - 0x8ed8], str.ashChest.exe
mov dword [ebp - 0x8ed4], str.ashCnsnt.exe
mov dword [ebp - 0x8ed0], str.ashDisp.exe
mov dword [ebp - 0x8ecc], str.ashLogV.exe
mov dword [ebp - 0x8ec8], str.ashMaiSv.exe
mov dword [ebp - 0x8ec4], str.ashPopWz.exe
mov dword [ebp - 0x8ec0], str.ashQuick.exe
mov dword [ebp - 0x8ebc], str.ashServ.exe
mov dword [ebp - 0x8eb8], str.ashSimp2.exe
mov dword [ebp - 0x8eb4], str.ashSimpl.exe
mov dword [ebp - 0x8eb0], str.ashSkPcc.exe
mov dword [ebp - 0x8eac], str.ashSkPck.exe
mov dword [ebp - 0x8ea8], str.ashUpd.exe
mov dword [ebp - 0x8ea4], str.ashWebSv.exe
mov dword [ebp - 0x8ea0], str.aswChLic.exe
mov dword [ebp - 0x8e9c], str.aswRegSvr.exe
mov dword [ebp - 0x8e98], str.aswRunDll.exe
mov dword [ebp - 0x8e94], str.aswUpdSv.exe
mov dword [ebp - 0x8e90], str.atcon.exe
mov dword [ebp - 0x8e8c], str.atguard.exe
mov dword [ebp - 0x8e88], str.atro55en.exe
mov dword [ebp - 0x8e84], str.atupdater.exe
mov dword [ebp - 0x8e80], str.atwatch.exe
mov dword [ebp - 0x8e7c], str.au.exe
mov dword [ebp - 0x8e78], str.aupdate.exe
mov dword [ebp - 0x8e74], str.autodown.exe
mov dword [ebp - 0x8e70], str.auto_protect.nav80try.exe
mov dword [ebp - 0x8e6c], str.autotrace.exe
mov dword [ebp - 0x8e68], str.autoupdate.exe
mov dword [ebp - 0x8e64], str.av360.exe
mov dword [ebp - 0x8e60], str.avadmin.exe
mov dword [ebp - 0x8e5c], str.avastSvc.exe
mov dword [ebp - 0x8e58], str.AvastSvc.exe
mov dword [ebp - 0x8e54], str.avastUI.exe
mov dword [ebp - 0x8e50], str.AvastUI.exe
mov dword [ebp - 0x8e4c], str.AVCare.exe
mov dword [ebp - 0x8e48], str.avcenter.exe
mov dword [ebp - 0x8e44], str.avciman.exe
mov dword [ebp - 0x8e40], str.avconfig.exe
mov dword [ebp - 0x8e3c], str.avconsol.exe
mov dword [ebp - 0x8e38], str.ave32.exe
mov dword [ebp - 0x8e34], str.AVENGINE.exe
mov dword [ebp - 0x8e30], str.avgcc32.exe
mov dword [ebp - 0x8e2c], str.avgchk.exe
mov dword [ebp - 0x8e28], str.avgcmgr.exe
mov dword [ebp - 0x8e24], str.avgcsrvx.exe
mov dword [ebp - 0x8e20], str.avgctrl.exe
mov dword [ebp - 0x8e1c], str.avgdumpx.exe
mov dword [ebp - 0x8e18], str.avgemc.exe
mov dword [ebp - 0x8e14], str.avgidsagent.exe
mov dword [ebp - 0x8e10], str.avgiproxy.exe
mov dword [ebp - 0x8e0c], str.avgnsx.exe
mov dword [ebp - 0x8e08], str.avgnt.exe
mov dword [ebp - 0x8e04], str.avgrsx.exe
mov dword [ebp - 0x8e00], str.avgscanx.exe
mov dword [ebp - 0x8dfc], str.avgserv9.exe
mov dword [ebp - 0x8df8], str.avgserv.exe
mov dword [ebp - 0x8df4], str.avgsrmax.exe
mov dword [ebp - 0x8df0], str.avgtray.exe
mov dword [ebp - 0x8dec], str.avguard.exe
mov dword [ebp - 0x8de8], str.avgui.exe
mov dword [ebp - 0x8de4], str.avgupd.exe
mov dword [ebp - 0x8de0], str.avgwdsvc.exe
mov dword [ebp - 0x8ddc], str.avgw.exe
mov dword [ebp - 0x8dd8], str.Avira.OE.ServiceHost.exe
mov dword [ebp - 0x8dd4], str.Avira.OE.Systray.exe
mov dword [ebp - 0x8dd0], str.avkpop.exe
mov dword [ebp - 0x8dcc], str.avkserv.exe
mov dword [ebp - 0x8dc8], str.avkservice.exe
mov dword [ebp - 0x8dc4], str.avkwctl9.exe
mov dword [ebp - 0x8dc0], str.avltmain.exe
mov dword [ebp - 0x8dbc], str.avmailc.exe
mov dword [ebp - 0x8db8], str.avmcdlg.exe
mov dword [ebp - 0x8db4], str.avnotify.exe
mov dword [ebp - 0x8db0], str.avnt.exe
mov dword [ebp - 0x8dac], str._avp32.exe
mov dword [ebp - 0x8da8], str.avp32.exe
mov dword [ebp - 0x8da4], str._avpcc.exe
mov dword [ebp - 0x8da0], str.avpcc.exe
mov dword [ebp - 0x8d9c], str.avpdos32.exe
mov dword [ebp - 0x8d98], str.avp.exe
mov dword [ebp - 0x8d94], str._avpm.exe
mov dword [ebp - 0x8d90], str.avpm.exe
mov dword [ebp - 0x8d8c], str.avptc32.exe
mov dword [ebp - 0x8d88], str.avpupd.exe
mov dword [ebp - 0x8d84], str.avsched32.exe
mov dword [ebp - 0x8d80], str.avshadow.exe
mov dword [ebp - 0x8d7c], str.avsynmgr.exe
mov dword [ebp - 0x8d78], str.avupgsvc.exe
mov dword [ebp - 0x8d74], str.AVWEBGRD.exe
mov dword [ebp - 0x8d70], str.avwin95.exe
mov dword [ebp - 0x8d6c], str.avwin.exe
mov dword [ebp - 0x8d68], str.avwinnt.exe
mov dword [ebp - 0x8d64], str.avwsc.exe
mov dword [ebp - 0x8d60], str.avwupd32.exe
mov dword [ebp - 0x8d5c], str.avwupd.exe
mov dword [ebp - 0x8d58], str.avwupsrv.exe
mov dword [ebp - 0x8d54], str.avxmonitor9x.exe
mov dword [ebp - 0x8d50], str.avxmonitornt.exe
mov dword [ebp - 0x8d4c], str.avxquar.exe
mov dword [ebp - 0x8d48], str.backweb.exe
mov dword [ebp - 0x8d44], str.bargains.exe
mov dword [ebp - 0x8d40], str.bdagent.exe
mov dword [ebp - 0x8d3c], str.bdfvcl.exe
mov dword [ebp - 0x8d38], str.bdfvwiz.exe
mov dword [ebp - 0x8d34], str.BDInProcPatch.exe
mov dword [ebp - 0x8d30], str.bdmcon.exe
mov dword [ebp - 0x8d2c], str.BDMsnScan.exe
mov dword [ebp - 0x8d28], str.bd_professional.exe
mov dword [ebp - 0x8d24], str.BDSurvey.exe
mov dword [ebp - 0x8d20], str.beagle.exe
mov dword [ebp - 0x8d1c], str.belt.exe
mov dword [ebp - 0x8d18], str.b.exe
mov dword [ebp - 0x8d14], str.bidef.exe
mov dword [ebp - 0x8d10], str.bidserver.exe
mov dword [ebp - 0x8d0c], str.bipcpevalsetup.exe
mov dword [ebp - 0x8d08], str.bipcp.exe
mov dword [ebp - 0x8d04], str.bisp.exe
mov dword [ebp - 0x8d00], str.blackd.exe
mov dword [ebp - 0x8cfc], str.blackice.exe
mov dword [ebp - 0x8cf8], str.blindman.exe
mov dword [ebp - 0x8cf4], str.blink.exe
mov dword [ebp - 0x8cf0], str.blss.exe
mov dword [ebp - 0x8cec], str.bootconf.exe
mov dword [ebp - 0x8ce8], str.bootwarn.exe
mov dword [ebp - 0x8ce4], str.borg2.exe
mov dword [ebp - 0x8ce0], str.bpc.exe
mov dword [ebp - 0x8cdc], str.brasil.exe
mov dword [ebp - 0x8cd8], str.brastk.exe
mov dword [ebp - 0x8cd4], str.brw.exe
mov dword [ebp - 0x8cd0], str.bs120.exe
mov dword [ebp - 0x8ccc], str.bspatch.exe
mov dword [ebp - 0x8cc8], str.bundle.exe
mov dword [ebp - 0x8cc4], str.bvt.exe
mov dword [ebp - 0x8cc0], str.calc.exe
mov dword [ebp - 0x8cbc], str.cavscan.exe
mov dword [ebp - 0x8cb8], str.ccapp.exe
mov dword [ebp - 0x8cb4], str.ccevtmgr.exe
mov dword [ebp - 0x8cb0], str.ccpxysvc.exe
mov dword [ebp - 0x8cac], str.ccSvcHst.exe
mov dword [ebp - 0x8ca8], str.ccuac.exe
mov dword [ebp - 0x8ca4], str.cdp.exe
mov dword [ebp - 0x8ca0], str.c.exe
mov dword [ebp - 0x8c9c], str.cfd.exe
mov dword [ebp - 0x8c98], str.cfgwiz.exe
mov dword [ebp - 0x8c94], str.cfiadmin.exe
mov dword [ebp - 0x8c90], str.cfiaudit.exe
mov dword [ebp - 0x8c8c], str.cfinet32.exe
mov dword [ebp - 0x8c88], str.cfinet.exe
mov dword [ebp - 0x8c84], str.cfpconfg.exe
mov dword [ebp - 0x8c80], str.cfp.exe
mov dword [ebp - 0x8c7c], str.cfplogvw.exe
mov dword [ebp - 0x8c78], str.cfpupdat.exe
mov dword [ebp - 0x8c74], str.chrome.exe
mov dword [ebp - 0x8c70], str.claw95cf.exe
mov dword [ebp - 0x8c6c], str.claw95.exe
mov dword [ebp - 0x8c68], str.cleaner3.exe
mov dword [ebp - 0x8c64], str.cleaner.exe
mov dword [ebp - 0x8c60], str.clean.exe
mov dword [ebp - 0x8c5c], str.cleanIELow.exe
mov dword [ebp - 0x8c58], str.cleanpc.exe
mov dword [ebp - 0x8c54], str.click.exe
mov dword [ebp - 0x8c50], str.cmd32.exe
mov dword [ebp - 0x8c4c], str.cmdagent.exe
mov dword [ebp - 0x8c48], str.cmesys.exe
mov dword [ebp - 0x8c44], str.cmgrdian.exe
mov dword [ebp - 0x8c40], str.cmon016.exe
mov dword [ebp - 0x8c3c], str.combofix.exe
mov dword [ebp - 0x8c38], str.ComboFix.exe
mov dword [ebp - 0x8c34], str.connectionmonitor.exe
mov dword [ebp - 0x8c30], str.control
mov dword [ebp - 0x8c2c], str.cpd.exe
mov dword [ebp - 0x8c28], str.cpf9x206.exe
mov dword [ebp - 0x8c24], str.cpfnt206.exe
mov dword [ebp - 0x8c20], str.crashrep.exe
mov dword [ebp - 0x8c1c], str.csc.exe
mov dword [ebp - 0x8c18], str.cssconfg.exe
mov dword [ebp - 0x8c14], str.cssupdat.exe
mov dword [ebp - 0x8c10], str.cssurf.exe
mov dword [ebp - 0x8c0c], str.ctrl.exe
mov dword [ebp - 0x8c08], str.cv.exe
mov dword [ebp - 0x8c04], str.cwnb181.exe
mov dword [ebp - 0x8c00], str.cwntdwmo.exe
mov dword [ebp - 0x8bfc], str.datemanager.exe
mov dword [ebp - 0x8bf8], str.dcomx.exe
mov dword [ebp - 0x8bf4], str.defalert.exe
mov dword [ebp - 0x8bf0], str.defscangui.exe
mov dword [ebp - 0x8bec], str.defwatch.exe
mov dword [ebp - 0x8be8], str.deloeminfs.exe
mov dword [ebp - 0x8be4], str.deputy.exe
mov dword [ebp - 0x8be0], str.d.exe
mov dword [ebp - 0x8bdc], str.divx.exe
mov dword [ebp - 0x8bd8], str.dllcache.exe
mov dword [ebp - 0x8bd4], str.dllreg.exe
mov dword [ebp - 0x8bd0], str.doors.exe
mov dword [ebp - 0x8bcc], str.dop.exe
mov dword [ebp - 0x8bc8], str.dpf.exe
mov dword [ebp - 0x8bc4], str.dpfsetup.exe
mov dword [ebp - 0x8bc0], str.dpps2.exe
mov dword [ebp - 0x8bbc], str.driverctrl.exe
mov dword [ebp - 0x8bb8], str.drwatson.exe
mov dword [ebp - 0x8bb4], str.drweb32.exe
mov dword [ebp - 0x8bb0], str.drwebupw.exe
mov dword [ebp - 0x8bac], str.dssagent.exe
mov dword [ebp - 0x8ba8], str.dvp95_0.exe
mov dword [ebp - 0x8ba4], str.dvp95.exe
mov dword [ebp - 0x8ba0], str.ecengine.exe
mov dword [ebp - 0x8b9c], str.efpeadm.exe
mov dword [ebp - 0x8b98], str.egui.exe
mov dword [ebp - 0x8b94], str.emsw.exe
mov dword [ebp - 0x8b90], str.ent.exe
mov dword [ebp - 0x8b8c], str.esafe.exe
mov dword [ebp - 0x8b88], str.escanhnt.exe
mov dword [ebp - 0x8b84], str.escanv95.exe
mov dword [ebp - 0x8b80], str.espwatch.exe
mov dword [ebp - 0x8b7c], str.ethereal.exe
mov dword [ebp - 0x8b78], str.etrustcipe.exe
mov dword [ebp - 0x8b74], str.evpn.exe
mov dword [ebp - 0x8b70], str.exantivirus_cnet.exe
mov dword [ebp - 0x8b6c], str.exe.avxw.exe
mov dword [ebp - 0x8b68], str.expert.exe
mov dword [ebp - 0x8b64], str.explore.exe
mov dword [ebp - 0x8b60], str.fact.exe
mov dword [ebp - 0x8b5c], str.f_agnt95.exe
mov dword [ebp - 0x8b58], str.fameh32.exe
mov dword [ebp - 0x8b54], str.fast.exe
mov dword [ebp - 0x8b50], str.fch32.exe
mov dword [ebp - 0x8b4c], str.fih32.exe
mov dword [ebp - 0x8b48], str.findviru.exe
mov dword [ebp - 0x8b44], str.firefox.exe
mov dword [ebp - 0x8b40], str.firewall.exe
mov dword [ebp - 0x8b3c], str.fixcfg.exe
mov dword [ebp - 0x8b38], str.fixexec.exe
mov dword [ebp - 0x8b34], str.fixfp.exe
mov dword [ebp - 0x8b30], str.fnrb32.exe
mov dword [ebp - 0x8b2c], str.f_prot95.exe
mov dword [ebp - 0x8b28], str.f_prot.exe
mov dword [ebp - 0x8b24], str.fprot.exe
mov dword [ebp - 0x8b20], str.fp_win.exe
mov dword [ebp - 0x8b1c], str.fp_win_trial.exe
mov dword [ebp - 0x8b18], str.frmwrk32.exe
mov dword [ebp - 0x8b14], str.frw.exe
mov dword [ebp - 0x8b10], str.fsaa.exe
mov dword [ebp - 0x8b0c], str.fsav32.exe
mov dword [ebp - 0x8b08], str.fsav530stbyb.exe
mov dword [ebp - 0x8b04], str.fsav530wtbyb.exe
mov dword [ebp - 0x8b00], str.fsav95.exe
mov dword [ebp - 0x8afc], str.fsav.exe
mov dword [ebp - 0x8af8], str.fsgk32.exe
mov dword [ebp - 0x8af4], str.fsm32.exe
mov dword [ebp - 0x8af0], str.fsma32.exe
mov dword [ebp - 0x8aec], str.fsmb32.exe
mov dword [ebp - 0x8ae8], str.f_stopw.exe
mov dword [ebp - 0x8ae4], str.gator.exe
mov dword [ebp - 0x8ae0], str.gav.exe
mov dword [ebp - 0x8adc], str.gbmenu.exe
mov dword [ebp - 0x8ad8], str.gbn976rl.exe
mov dword [ebp - 0x8ad4], str.gbpoll.exe
mov dword [ebp - 0x8ad0], str.generics.exe
mov dword [ebp - 0x8acc], str.gmt.exe
mov dword [ebp - 0x8ac8], str.guarddog.exe
mov dword [ebp - 0x8ac4], str.guard.exe
mov dword [ebp - 0x8ac0], str.guardgui.exe
mov dword [ebp - 0x8abc], str.guardxkickoff.exe
mov dword [ebp - 0x8ab8], str.hacktracersetup.exe
mov dword [ebp - 0x8ab4], str.hbinst.exe
mov dword [ebp - 0x8ab0], str.hbsrv.exe
mov dword [ebp - 0x8aac], str.hijackthis.exe
mov dword [ebp - 0x8aa8], str.History.exe
mov dword [ebp - 0x8aa4], str.homeav2010.exe
mov dword [ebp - 0x8aa0], str.hotactio.exe
mov dword [ebp - 0x8a9c], str.hotpatch.exe
mov dword [ebp - 0x8a98], str.htlog.exe
mov dword [ebp - 0x8a94], str.htpatch.exe
mov dword [ebp - 0x8a90], str.hwpe.exe
mov dword [ebp - 0x8a8c], str.hxdl.exe
mov dword [ebp - 0x8a88], str.hxiul.exe
mov dword [ebp - 0x8a84], str.iamapp.exe
mov dword [ebp - 0x8a80], str.iamserv.exe
mov dword [ebp - 0x8a7c], str.iamstats.exe
mov dword [ebp - 0x8a78], str.ibmasn.exe
mov dword [ebp - 0x8a74], str.ibmavsp.exe
mov dword [ebp - 0x8a70], str.icload95.exe
mov dword [ebp - 0x8a6c], str.icloadnt.exe
mov dword [ebp - 0x8a68], str.icmon.exe
mov dword [ebp - 0x8a64], str.icsupp95.exe
mov dword [ebp - 0x8a60], str.icsuppnt.exe
mov dword [ebp - 0x8a5c], str.Identity.exe
mov dword [ebp - 0x8a58], str.idle.exe
mov dword [ebp - 0x8a54], str.iedll.exe
mov dword [ebp - 0x8a50], str.iedriver.exe
mov dword [ebp - 0x8a4c], str.IEShow.exe
mov dword [ebp - 0x8a48], str.iexplore.exe
mov dword [ebp - 0x8a44], str.iface.exe
mov dword [ebp - 0x8a40], str.ifw2000.exe
mov dword [ebp - 0x8a3c], str.inetlnfo.exe
mov dword [ebp - 0x8a38], str.infus.exe
mov dword [ebp - 0x8a34], str.infwin.exe
mov dword [ebp - 0x8a30], str.init32.exe
mov dword [ebp - 0x8a2c], str.init.exe
mov dword [ebp - 0x8a28], str.install_1_.exe
mov dword [ebp - 0x8a24], str.install_2_.exe
mov dword [ebp - 0x8a20], str.install_3_.exe
mov dword [ebp - 0x8a1c], str.install_4_.exe
mov dword [ebp - 0x8a18], str.install_5_.exe
mov dword [ebp - 0x8a14], str.instup.exe
mov dword [ebp - 0x8a10], str.intdel.exe
mov dword [ebp - 0x8a0c], str.intren.exe
mov dword [ebp - 0x8a08], str.iomon98.exe
mov dword [ebp - 0x8a04], str.istsvc.exe
mov dword [ebp - 0x8a00], str.itunes.exe
mov dword [ebp - 0x89fc], str.jammer.exe
mov dword [ebp - 0x89f8], str.jdbgmrg.exe
mov dword [ebp - 0x89f4], str.jedi.exe
mov dword [ebp - 0x89f0], str.JsRcGen.exe
mov dword [ebp - 0x89ec], str.kavlite40eng.exe
mov dword [ebp - 0x89e8], str.kavpers40eng.exe
mov dword [ebp - 0x89e4], str.kavpf.exe
mov dword [ebp - 0x89e0], str.kazza.exe
mov dword [ebp - 0x89dc], str.keenvalue.exe
mov dword [ebp - 0x89d8], str.kerio_pf_213_en_win.exe
mov dword [ebp - 0x89d4], str.kerio_wrl_421_en_win.exe
mov dword [ebp - 0x89d0], str.kerio_wrp_421_en_win.exe
mov dword [ebp - 0x89cc], str.keyscrambler.exe
mov dword [ebp - 0x89c8], str.killprocesssetup161.exe
mov dword [ebp - 0x89c4], str.ldnetmon.exe
mov dword [ebp - 0x89c0], str.ldpro.exe
mov dword [ebp - 0x89bc], str.ldpromenu.exe
mov dword [ebp - 0x89b8], str.ldscan.exe
mov dword [ebp - 0x89b4], str.licmgr.exe
mov dword [ebp - 0x89b0], str.limewire.exe
mov dword [ebp - 0x89ac], str.lnetinfo.exe
mov dword [ebp - 0x89a8], str.loader.exe
mov dword [ebp - 0x89a4], str.localnet.exe
mov dword [ebp - 0x89a0], str.lockdown2000.exe
mov dword [ebp - 0x899c], str.lockdown.exe
mov dword [ebp - 0x8998], str.lookout.exe
mov dword [ebp - 0x8994], str.lordpe.exe
mov dword [ebp - 0x8990], str.lsetup.exe
mov dword [ebp - 0x898c], str.luall.exe
mov dword [ebp - 0x8988], str.luau.exe
mov dword [ebp - 0x8984], str.lucomserver.exe
mov dword [ebp - 0x8980], str.luinit.exe
mov dword [ebp - 0x897c], str.luspt.exe
mov dword [ebp - 0x8978], str.MalwareRemoval.exe
mov dword [ebp - 0x8974], str.mapisvc32.exe
mov dword [ebp - 0x8970], str.mbam.exe
mov dword [ebp - 0x896c], str.mbamgui.exe
mov dword [ebp - 0x8968], str.mbampt.exe
mov dword [ebp - 0x8964], str.mbamscheduler.exe
mov dword [ebp - 0x8960], str.mbamservice.exe
mov dword [ebp - 0x895c], str.mcagent.exe
mov dword [ebp - 0x8958], str.mcmnhdlr.exe
mov dword [ebp - 0x8954], str.mcmpeng.exe
mov dword [ebp - 0x8950], str.mcmscsvc.exe
mov dword [ebp - 0x894c], str.mcnasvc.exe
mov dword [ebp - 0x8948], str.mcproxy.exe
mov dword [ebp - 0x8944], str.McSACore.exe
mov dword [ebp - 0x8940], str.mcshell.exe
mov dword [ebp - 0x893c], str.mcshield.exe
mov dword [ebp - 0x8938], str.mcsysmon.exe
mov dword [ebp - 0x8934], str.mctool.exe
mov dword [ebp - 0x8930], str.mcupdate.exe
mov dword [ebp - 0x892c], str.mcvsrte.exe
mov dword [ebp - 0x8928], str.mcvsshld.exe
mov dword [ebp - 0x8924], str.md.exe
mov dword [ebp - 0x8920], str.mfin32.exe
mov dword [ebp - 0x891c], str.mfw2en.exe
mov dword [ebp - 0x8918], str.mfweng3.02d30.exe
mov dword [ebp - 0x8914], str.mgavrtcl.exe
mov dword [ebp - 0x8910], str.mgavrte.exe
mov dword [ebp - 0x890c], str.mghtml.exe
mov dword [ebp - 0x8908], str.mgui.exe
mov dword [ebp - 0x8904], str.minilog.exe
mov dword [ebp - 0x8900], str.mmod.exe
mov dword [ebp - 0x88fc], str.monitor.exe
mov dword [ebp - 0x88f8], str.moolive.exe
mov dword [ebp - 0x88f4], str.mostat.exe
mov dword [ebp - 0x88f0], str.MpCmdRun.exe
mov dword [ebp - 0x88ec], str.mpfagent.exe
mov dword [ebp - 0x88e8], str.mpfservice.exe
mov dword [ebp - 0x88e4], str.MPFSrv.exe
mov dword [ebp - 0x88e0], str.mpftray.exe
mov dword [ebp - 0x88dc], str.mrflux.exe
mov dword [ebp - 0x88d8], str.mrt.exe
mov dword [ebp - 0x88d4], str.msa.exe
mov dword [ebp - 0x88d0], str.msapp.exe
mov dword [ebp - 0x88cc], str.MSASCui.exe
mov dword [ebp - 0x88c8], str.msbb.exe
mov dword [ebp - 0x88c4], str.msblast.exe
mov dword [ebp - 0x88c0], str.mscache.exe
mov dword [ebp - 0x88bc], str.msccn32.exe
mov dword [ebp - 0x88b8], str.mscman.exe
mov dword [ebp - 0x88b4], str.msconfig
mov dword [ebp - 0x88b0], str.msdm.exe
mov dword [ebp - 0x88ac], str.msdos.exe
mov dword [ebp - 0x88a8], str.msiexec16.exe
mov dword [ebp - 0x88a4], str.mslaugh.exe
mov dword [ebp - 0x88a0], str.msmgt.exe
mov dword [ebp - 0x889c], str.MsMpEng.exe
mov dword [ebp - 0x8898], str.msmsgri32.exe
mov dword [ebp - 0x8894], str.mspaint.exe
mov dword [ebp - 0x8890], str.msseces.exe
mov dword [ebp - 0x888c], str.mssmmc32.exe
mov dword [ebp - 0x8888], str.mssys.exe
mov dword [ebp - 0x8884], str.msvxd.exe
mov dword [ebp - 0x8880], str.mu0311ad.exe
mov dword [ebp - 0x887c], str.mwatch.exe
mov dword [ebp - 0x8878], str.n32scanw.exe
mov dword [ebp - 0x8874], str.navap.navapsvc.exe
mov dword [ebp - 0x8870], str.navapsvc.exe
mov dword [ebp - 0x886c], str.navapw32.exe
mov dword [ebp - 0x8868], str.navdx.exe
mov dword [ebp - 0x8864], str.nav.exe
mov dword [ebp - 0x8860], str.navlu32.exe
mov dword [ebp - 0x885c], str.navnt.exe
mov dword [ebp - 0x8858], str.navstub.exe
mov dword [ebp - 0x8854], str.navw32.exe
mov dword [ebp - 0x8850], str.navwnt.exe
mov dword [ebp - 0x884c], str.nc2000.exe
mov dword [ebp - 0x8848], str.ncinst4.exe
mov dword [ebp - 0x8844], str.ndd32.exe
mov dword [ebp - 0x8840], str.neomonitor.exe
mov dword [ebp - 0x883c], str.neowatchlog.exe
mov dword [ebp - 0x8838], str.netarmor.exe
mov dword [ebp - 0x8834], str.netd32.exe
mov dword [ebp - 0x8830], str.netinfo.exe
mov dword [ebp - 0x882c], str.netmon.exe
mov dword [ebp - 0x8828], str.netscanpro.exe
mov dword [ebp - 0x8824], str.netspyhunter_1.2.exe
mov dword [ebp - 0x8820], str.netutils.exe
mov dword [ebp - 0x881c], str.nisserv.exe
mov dword [ebp - 0x8818], str.nisum.exe
mov dword [ebp - 0x8814], str.nmain.exe
mov dword [ebp - 0x8810], str.nod32.exe
mov dword [ebp - 0x880c], str.normist.exe
mov dword [ebp - 0x8808], str.norton_internet_secu_3.0_407.exe
mov dword [ebp - 0x8804], str.notstart.exe
mov dword [ebp - 0x8800], str.npf40_tw_98_nt_me_2k.exe
mov dword [ebp - 0x87fc], str.npfmessenger.exe
mov dword [ebp - 0x87f8], str.nprotect.exe
mov dword [ebp - 0x87f4], str.npscheck.exe
mov dword [ebp - 0x87f0], str.npssvc.exe
mov dword [ebp - 0x87ec], str.nsched32.exe
mov dword [ebp - 0x87e8], str.nssys32.exe
mov dword [ebp - 0x87e4], str.nstask32.exe
mov dword [ebp - 0x87e0], str.nsupdate.exe
mov dword [ebp - 0x87dc], str.nt.exe
mov dword [ebp - 0x87d8], str.ntrtscan.exe
mov dword [ebp - 0x87d4], str.ntvdm.exe
mov dword [ebp - 0x87d0], str.ntxconfig.exe
mov dword [ebp - 0x87cc], str.nui.exe
mov dword [ebp - 0x87c8], str.nupgrade.exe
mov dword [ebp - 0x87c4], str.nvarch16.exe
mov dword [ebp - 0x87c0], str.nvc95.exe
mov dword [ebp - 0x87bc], str.nvsvc32.exe
mov dword [ebp - 0x87b8], str.nwinst4.exe
mov dword [ebp - 0x87b4], str.nwservice.exe
mov dword [ebp - 0x87b0], str.nwtool16.exe
mov dword [ebp - 0x87ac], str.OAcat.exe
mov dword [ebp - 0x87a8], str.OAhlp.exe
mov dword [ebp - 0x87a4], str.OAReg.exe
mov dword [ebp - 0x87a0], str.oasrv.exe
mov dword [ebp - 0x879c], str.oaui.exe
mov dword [ebp - 0x8798], str.oaview.exe
mov dword [ebp - 0x8794], str.ODSW.exe
mov dword [ebp - 0x8790], str.ollydbg.exe
mov dword [ebp - 0x878c], str.onsrvr.exe
mov dword [ebp - 0x8788], str.optimize.exe
mov dword [ebp - 0x8784], str.ostronet.exe
mov dword [ebp - 0x8780], str.otfix.exe
mov dword [ebp - 0x877c], str.outpost.exe
mov dword [ebp - 0x8778], str.outpostinstall.exe
mov dword [ebp - 0x8774], str.outpostproinstall.exe
mov dword [ebp - 0x8770], str.ozn695m5.exe
mov dword [ebp - 0x876c], str.padmin.exe
mov dword [ebp - 0x8768], str.panixk.exe
mov dword [ebp - 0x8764], str.patch.exe
mov dword [ebp - 0x8760], str.pavcl.exe
mov dword [ebp - 0x875c], str.pav.exe
mov dword [ebp - 0x8758], str.PavFnSvr.exe
mov dword [ebp - 0x8754], str.pavproxy.exe
mov dword [ebp - 0x8750], str.pavprsrv.exe
mov dword [ebp - 0x874c], str.pavsched.exe
mov dword [ebp - 0x8748], str.pavsrv51.exe
mov dword [ebp - 0x8744], str.pavw.exe
mov dword [ebp - method.std::basic_filebuf_char__struct_std::char_traits_char__.virtual_28], str.PC_Antispyware2010.exe
mov dword [ebp - 0x873c], str.pccwin98.exe
mov dword [ebp - 0x8738], str.pc.exe
mov dword [ebp - 0x8734], str.pcfwallicon.exe
mov dword [ebp - 0x8730], str.pcip10117_0.exe
mov dword [ebp - 0x872c], str.pcscan.exe
mov dword [ebp - 0x8728], str.pctsAuxs.exe
mov dword [ebp - 0x8724], str.pctsGui.exe
mov dword [ebp - 0x8720], str.pctsSvc.exe
mov dword [ebp - 0x871c], str.pctsTray.exe
mov dword [ebp - 0x8718], str.pdfndr.exe
mov dword [ebp - 0x8714], str.pdsetup.exe
mov dword [ebp - 0x8710], str.PerAvir.exe
mov dword [ebp - 0x870c], str.periscope.exe
mov dword [ebp - 0x8708], str.persfw.exe
mov dword [ebp - 0x8704], str.personalguard
mov dword [ebp - 0x8700], str.personalguard.exe
mov dword [ebp - 0x86fc], str.perswf.exe
mov dword [ebp - 0x86f8], str.pf2.exe
mov dword [ebp - 0x86f4], str.pfwadmin.exe
mov dword [ebp - 0x86f0], str.pgmonitr.exe
mov dword [ebp - 0x86ec], str.pingscan.exe
mov dword [ebp - 0x86e8], str.platin.exe
mov dword [ebp - 0x86e4], str.pop3trap.exe
mov dword [ebp - 0x86e0], str.poproxy.exe
mov dword [ebp - 0x86dc], str.popscan.exe
mov dword [ebp - 0x86d8], str.portdetective.exe
mov dword [ebp - 0x86d4], str.portmonitor.exe
mov dword [ebp - 0x86d0], str.powerscan.exe
mov dword [ebp - 0x86cc], str.ppinupdt.exe
mov dword [ebp - 0x86c8], str.pptbc.exe
mov dword [ebp - 0x86c4], str.ppvstop.exe
mov dword [ebp - 0x86c0], str.prizesurfer.exe
mov dword [ebp - 0x86bc], str.prmt.exe
mov dword [ebp - 0x86b8], str.prmvr.exe
mov dword [ebp - 0x86b4], str.procdump.exe
mov dword [ebp - 0x86b0], str.processmonitor.exe
mov dword [ebp - 0x86ac], str.procexplorerv1.0.exe
mov dword [ebp - 0x86a8], str.programauditor.exe
mov dword [ebp - 0x86a4], str.proport.exe
mov dword [ebp - 0x86a0], str.protector.exe
mov dword [ebp - 0x869c], str.protectx.exe
mov dword [ebp - 0x8698], str.PSANCU.exe
mov dword [ebp - 0x8694], str.PSANHost.exe
mov dword [ebp - 0x8690], str.PSANToManager.exe
mov dword [ebp - 0x868c], str.PsCtrls.exe
mov dword [ebp - 0x8688], str.PsImSvc.exe
mov dword [ebp - 0x8684], str.PskSvc.exe
mov dword [ebp - 0x8680], str.pspf.exe
mov dword [ebp - 0x867c], str.PSUNMain.exe
mov dword [ebp - 0x8678], str.purge.exe
mov dword [ebp - 0x8674], str.qconsole.exe
mov dword [ebp - 0x8670], str.qh.exe
mov dword [ebp - 0x866c], str.qserver.exe
mov dword [ebp - 0x8668], str.QuickHealCleaner.exe
mov dword [ebp - 0x8664], str.Quick_Heal.exe
mov dword [ebp - 0x8660], str.rapapp.exe
mov dword [ebp - 0x865c], str.rav7.exe
mov dword [ebp - 0x8658], str.rav7win.exe
mov dword [ebp - 0x8654], str.rav8win32eng.exe
mov dword [ebp - 0x8650], str.ray.exe
mov dword [ebp - 0x864c], str.rb32.exe
mov dword [ebp - 0x8648], str.rcsync.exe
mov dword [ebp - 0x8644], str.realmon.exe
mov dword [ebp - 0x8640], str.reged.exe
mov dword [ebp - 0x863c], str.regedit.exe
mov dword [ebp - 0x8638], str.regedt32.exe
mov dword [ebp - 0x8634], str.rescue32.exe
mov dword [ebp - 0x8630], str.rescue.exe
mov dword [ebp - 0x862c], str.rkill.exe
mov dword [ebp - 0x8628], str.rrguard.exe
mov dword [ebp - 0x8624], str.rscdwld.exe
mov dword [ebp - 0x8620], str.rshell.exe
mov dword [ebp - 0x861c], str.rstrui.exe
mov dword [ebp - 0x8618], str.rtvscan.exe
mov dword [ebp - 0x8614], str.rtvscn95.exe
mov dword [ebp - 0x8610], str.rulaunch.exe
mov dword [ebp - 0x860c], str.rundll32.exe
mov dword [ebp - 0x8608], 0x48b374
mov dword [ebp - 0x8604], str.rwg.exe
mov dword [ebp - 0x8600], str.safari.exe
mov dword [ebp - 0x85fc], str.SafetyKeeper.exe
mov dword [ebp - 0x85f8], str.safeweb.exe
mov dword [ebp - 0x85f4], str.sahagent.exe
mov dword [ebp - 0x85f0], str.SaveArmor.exe
mov dword [ebp - 0x85ec], str.SaveDefense.exe
mov dword [ebp - 0x85e8], str.Save.exe
mov dword [ebp - 0x85e4], str.SaveKeep.exe
mov dword [ebp - 0x85e0], str.savenow.exe
mov dword [ebp - 0x85dc], str.sbserv.exe
mov dword [ebp - 0x85d8], str.scam32.exe
mov dword [ebp - 0x85d4], str.scan32.exe
mov dword [ebp - 0x85d0], str.scan95.exe
mov dword [ebp - 0x85cc], str.scanpm.exe
mov dword [ebp - 0x85c8], str.sc.exe
mov dword [ebp - 0x85c4], str.scrscan.exe
mov dword [ebp - 0x85c0], str.SDFiles.exe
mov dword [ebp - 0x85bc], str.SDMain.exe
mov dword [ebp - 0x85b8], str.SDWinSec.exe
mov dword [ebp - 0x85b4], str.secureveteran.exe
mov dword [ebp - 0x85b0], str.Secure_Veteran.exe
mov dword [ebp - 0x85ac], str.Security_Center.exe
mov dword [ebp - 0x85a8], str.SecurityFighter.exe
mov dword [ebp - 0x85a4], str.securitysoldier.exe
mov dword [ebp - 0x85a0], str.serv95.exe
mov dword [ebp - 0x859c], str.setloadorder.exe
mov dword [ebp - 0x8598], str.setup_flowprotector_us.exe
mov dword [ebp - 0x8594], str.setupvameeval.exe
mov dword [ebp - 0x8590], str.sgssfw32.exe
mov dword [ebp - 0x858c], str.shellspyinstall.exe
mov dword [ebp - 0x8588], str.sh.exe
mov dword [ebp - 0x8584], str.shield.exe
mov dword [ebp - 0x8580], str.shn.exe
mov dword [ebp - 0x857c], str.showbehind.exe
mov dword [ebp - 0x8578], str.signcheck.exe
mov dword [ebp - 0x8574], str.smart.exe
mov dword [ebp - 0x8570], str.smartprotector.exe
mov dword [ebp - 0x856c], str.smc.exe
mov dword [ebp - 0x8568], str.smrtdefp.exe
mov dword [ebp - 0x8564], str.sms.exe
mov dword [ebp - 0x8560], str.smss32.exe
mov dword [ebp - 0x855c], str.snetcfg.exe
mov dword [ebp - 0x8558], str.soap.exe
mov dword [ebp - 0x8554], str.sofi.exe
mov dword [ebp - 0x8550], str.SoftSafeness.exe
mov dword [ebp - 0x854c], str.sperm.exe
mov dword [ebp - 0x8548], str.spf.exe
mov dword [ebp - 0x8544], str.sphinx.exe
mov dword [ebp - 0x8540], str.spoler.exe
mov dword [ebp - 0x853c], str.spoolcv.exe
mov dword [ebp - 0x8538], str.spoolsv32.exe
mov dword [ebp - 0x8534], str.spybotsd.exe
mov dword [ebp - 0x8530], str.spywarexpguard.exe
mov dword [ebp - 0x852c], str.spyxx.exe
mov dword [ebp - 0x8528], str.srexe.exe
mov dword [ebp - 0x8524], str.srng.exe
mov dword [ebp - 0x8520], str.ss3edit.exe
mov dword [ebp - 0x851c], str.ssg_4104.exe
mov dword [ebp - 0x8518], str.ssgrate.exe
mov dword [ebp - 0x8514], str.st2.exe
mov dword [ebp - 0x8510], str.start.exe
mov dword [ebp - 0x850c], str.stcloader.exe
mov dword [ebp - 0x8508], str.supftrl.exe
mov dword [ebp - 0x8504], str.supporter5.exe
mov dword [ebp - 0x8500], str.support.exe
mov dword [ebp - 0x84fc], str.svc.exe
mov dword [ebp - 0x84f8], str.svchostc.exe
mov dword [ebp - 0x84f4], str.svchosts.exe
mov dword [ebp - 0x84f0], str.svshost.exe
mov dword [ebp - 0x84ec], str.sweep95.exe
mov dword [ebp - 0x84e8], str.sweepnet.sweepsrv.sys.swnetsup.exe
mov dword [ebp - 0x84e4], str.symlcsvc.exe
mov dword [ebp - 0x84e0], str.symproxysvc.exe
mov dword [ebp - 0x84dc], str.symtray.exe
mov dword [ebp - 0x84d8], str.system32.exe
mov dword [ebp - 0x84d4], str.system.exe
mov dword [ebp - 0x84d0], str.sysupd.exe
mov dword [ebp - 0x84cc], str.tapinstall.exe
mov dword [ebp - 0x84c8], str.taskmgr.exe
mov dword [ebp - 0x84c4], str.taumon.exe
mov dword [ebp - 0x84c0], str.tbscan.exe
mov dword [ebp - 0x84bc], str.tca.exe
mov dword [ebp - 0x84b8], str.tc.exe
mov dword [ebp - 0x84b4], str.tcm.exe
mov dword [ebp - 0x84b0], str.tds2_98.exe
mov dword [ebp - 0x84ac], str.tds2_nt.exe
mov dword [ebp - 0x84a8], str.tds_3.exe
mov dword [ebp - 0x84a4], str.teekids.exe
mov dword [ebp - 0x84a0], str.tfak5.exe
mov dword [ebp - 0x849c], str.tfak.exe
mov dword [ebp - 0x8498], str.tgbob.exe
mov dword [ebp - 0x8494], str.titanin.exe
mov dword [ebp - 0x8490], str.titaninxp.exe
mov dword [ebp - 0x848c], str.TPSrv.exe
mov dword [ebp - 0x8488], str.trickler.exe
mov dword [ebp - 0x8484], str.trjscan.exe
mov dword [ebp - 0x8480], str.trjsetup.exe
mov dword [ebp - 0x847c], str.trojantrap3.exe
mov dword [ebp - 0x8478], str.TrustWarrior.exe
mov dword [ebp - 0x8474], str.tsadbot.exe
mov dword [ebp - 0x8470], str.tsc.exe
mov dword [ebp - 0x846c], str.tvmd.exe
mov dword [ebp - 0x8468], str.tvtmd.exe
mov dword [ebp - 0x8464], str.undoboot.exe
mov dword [ebp - 0x8460], str.unhide.exe
mov dword [ebp - 0x845c], str.updat.exe
mov dword [ebp - 0x8458], str.upgrad.exe
mov dword [ebp - 0x8454], str.utpost.exe
mov dword [ebp - 0x8450], str.vbcmserv.exe
mov dword [ebp - 0x844c], str.vbcons.exe
mov dword [ebp - 0x8448], str.vbust.exe
mov dword [ebp - 0x8444], str.vbwin9x.exe
mov dword [ebp - 0x8440], str.vbwinntw.exe
mov dword [ebp - 0x843c], str.vcsetup.exe
mov dword [ebp - 0x8438], str.vet32.exe
mov dword [ebp - 0x8434], str.vet95.exe
mov dword [ebp - 0x8430], str.vettray.exe
mov dword [ebp - 0x842c], str.vfsetup.exe
mov dword [ebp - 0x8428], str.vir_help.exe
mov dword [ebp - 0x8424], str.virusmdpersonalfirewall.exe
mov dword [ebp - 0x8420], str.virusutilities.exe
mov dword [ebp - 0x841c], str.VisthAux.exe
mov dword [ebp - 0x8418], str.VisthLic.exe
mov dword [ebp - 0x8414], str.VisthUpd.exe
mov eax, str.zlclient.exe
xor esi, esi
mov dword [ebp - 0x8410], str.vnlan300.exe
mov dword [ebp - 0x840c], str.vnpc3000.exe
mov dword [ebp - 0x8408], str.vpc32.exe
mov dword [ebp - 0x8404], str.vpc42.exe
mov dword [ebp - 0x8400], str.vpfw30s.exe
mov dword [ebp - 0x83fc], str.vptray.exe
mov dword [ebp - 0x83f8], str.vscan40.exe
mov dword [ebp - 0x83f4], str.vscenu6.02d30.exe
mov dword [ebp - 0x83f0], str.vsched.exe
mov dword [ebp - 0x83ec], str.vsecomr.exe
mov dword [ebp - 0x83e8], str.vshwin32.exe
mov dword [ebp - 0x83e4], str.vsisetup.exe
mov dword [ebp - 0x83e0], str.vsmain.exe
mov dword [ebp - 0x83dc], str.vsmon.exe
mov dword [ebp - 0x83d8], str.vsstat.exe
mov dword [ebp - 0x83d4], str.vswin9xe.exe
mov dword [ebp - 0x83d0], str.vswinntse.exe
mov dword [ebp - 0x83cc], str.vswinperse.exe
mov dword [ebp - 0x83c8], str.w32dsm89.exe
mov dword [ebp - 0x83c4], str.W3asbas.exe
mov dword [ebp - 0x83c0], str.w9x.exe
mov dword [ebp - 0x83bc], str.watchdog.exe
mov dword [ebp - 0x83b8], str.webdav.exe
mov dword [ebp - 0x83b4], str.WebProxy.exe
mov dword [ebp - 0x83b0], str.webscanx.exe
mov dword [ebp - 0x83ac], str.webtrap.exe
mov dword [ebp - 0x83a8], str.wfindv32.exe
mov dword [ebp - 0x83a4], str.whoswatchingme.exe
mov dword [ebp - 0x83a0], str.wimmun32.exe
mov dword [ebp - 0x839c], str.win32.exe
mov dword [ebp - 0x8398], str.win32us.exe
mov dword [ebp - 0x8394], str.winactive.exe
mov dword [ebp - 0x8390], str.winav.exe
mov dword [ebp - 0x838c], str.win_bugsfix.exe
mov dword [ebp - 0x8388], str.windll32.exe
mov dword [ebp - 0x8384], str.window.exe
mov dword [ebp - 0x8380], str.windows.exe
mov dword [ebp - 0x837c], str.windows_Police_Pro.exe
mov dword [ebp - 0x8378], str.wininetd.exe
mov dword [ebp - 0x8374], str.wininitx.exe
mov dword [ebp - 0x8370], str.winlogin.exe
mov dword [ebp - 0x836c], str.winmain.exe
mov dword [ebp - 0x8368], str.winppr32.exe
mov dword [ebp - 0x8364], str.winrecon.exe
mov dword [ebp - 0x8360], str.winservn.exe
mov dword [ebp - 0x835c], str.winssk32.exe
mov dword [ebp - 0x8358], str.winstart001.exe
mov dword [ebp - 0x8354], str.winstart.exe
mov dword [ebp - 0x8350], str.wintsk32.exe
mov dword [ebp - 0x834c], str.winupdate.exe
mov dword [ebp - 0x8348], str.wireshark.exe
mov dword [ebp - 0x8344], str.wkufind.exe
mov dword [ebp - 0x8340], str.wmplayer.exe
mov dword [ebp - 0x833c], str.wnad.exe
mov dword [ebp - 0x8338], str.wnt.exe
mov dword [ebp - 0x8334], str.wordpad.exe
mov dword [ebp - 0x8330], str.wradmin.exe
mov dword [ebp - 0x832c], str.wrctrl.exe
mov dword [ebp - 0x8328], str.wsbgate.exe
mov dword [ebp - 0x8324], str.wscfxas.exe
mov dword [ebp - 0x8320], str.wscfxav.exe
mov dword [ebp - 0x831c], str.wscfxfw.exe
mov dword [ebp - 0x8318], str.wsctool.exe
mov dword [ebp - 0x8314], str.wupdater.exe
mov dword [ebp - 0x8310], str.wupdt.exe
mov dword [ebp - 0x830c], str.wyvernworksfirewall.exe
mov dword [ebp - 0x8308], str.xp_antispyware.exe
mov dword [ebp - 0x8304], str.xpdeluxe.exe
mov dword [ebp - 0x8300], str.xpf202en.exe
mov dword [ebp - 0x82fc], str.zapro.exe
mov dword [ebp - 0x82f8], str.zapsetup3001.exe
mov dword [ebp - 0x82f4], str.zatutor.exe
mov dword [ebp - 0x82f0], eax
mov dword [ebp - 0x82ec], eax
mov dword [ebp - 0x82e8], str.zonalm2601.exe
mov dword [ebp - 0x82e4], str.zonealarm.exe
mov dword [ebp - 0x82d4], esi
jmp 0x42a9d0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
lea eax, [ebp - 0x81e4]
push 0x3fff
push eax
call fcn.0045063b
mov eax, dword [ebp + esi*4 - 0x8f74]
add esp, 0xc
push eax
lea ecx, [ebp - 0x81e4]
push 0x3fff
push ecx
mov dword [ebp - 0x82d0], eax
call fcn.004526b5
add esp, 0xc
lea edx, [ebp - 0x82b4]
push edx
push 0x20019
push edi
lea eax, [ebp - 0x81e4]
push eax
push 0x80000002
call ebx
cmp eax, edi
jne 0x42ac8b
mov eax, dword [ebp - 0x82b4]
lea ecx, [ebp - 0x82c0]
push ecx
push 0x49bf00
lea edx, [ebp - 0x82cc]
push edx
push edi
push str.Debugger
push eax
mov dword [ebp - 0x82c0], 0x2000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x42ace2
mov ecx, str.Debugger
lea ebx, [ebp - 0x81e4]
mov edx, 0x80000002
lea esi, [ebp - 0x8254]
call fcn.00419920
push eax
lea ecx, [ebp - 0x82b0]
mov byte [ebp - 4], 0x31
call fcn.00401560
mov ebx, 8
mov byte [ebp - 4], 2
cmp dword [ebp - 0x8240], ebx
jb 0x42aab1
mov edx, dword [ebp - 0x8254]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov word [ebp - 0x8200], ax
lea eax, [ebp - 0x81e4]
mov dword [ebp - 0x81ec], 7
mov dword [ebp - 0x81f0], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42aad3
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x81e4]
push ecx
lea ecx, [ebp - 0x8200]
call fcn.00401740
lea edx, [ebp - 0x8200]
push edx
mov edx, str._n_HKEY_LOCAL_MACHINE_
lea esi, [ebp - 0x8278]
mov byte [ebp - 4], 0x32
call fcn.004320e0
add esp, 4
push eax
mov eax, 0x48c8bc
lea edi, [ebp - 0x821c]
mov byte [ebp - 4], 0x33
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor esi, esi
push esi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x34
call fcn.00411f30
cmp dword [ebp - 0x8208], ebx
jb 0x42ab57
mov eax, dword [ebp - 0x821c]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov edi, 7
mov dword [ebp - 0x8208], edi
mov dword [ebp - 0x820c], esi
mov word [ebp - 0x821c], cx
cmp dword [ebp - 0x8264], ebx
jb 0x42ab88
mov edx, dword [ebp - 0x8278]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x8264], edi
mov dword [ebp - 0x8268], esi
mov word [ebp - 0x8278], ax
cmp dword [ebp - 0x81ec], ebx
jb 0x42abb8
mov ecx, dword [ebp - 0x8200]
push ecx
call fcn.0044e60d
add esp, 4
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x8f78], esp
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x82b0]
xor edx, edx
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], esi
push eax
mov word [ecx], dx
call fcn.004015e0
sub esp, 0x1c
mov byte [ebp - 4], 0x35
mov ecx, esp
mov dword [ebp - 0x82d8], esp
push ebx
xor edx, edx
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], esi
push str.Debugger
mov word [ecx], dx
call fcn.00401740
lea eax, [ebp - 0x8254]
push eax
mov byte [ebp - 4], 2
call fcn.0042b940
add esp, 0x3c
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x8238]
mov byte [ebp - 4], 0x36
call fcn.00411f30
mov byte [ebp - 4], 2
cmp dword [ebp - 0x8240], ebx
jb 0x42ac43
mov ecx, dword [ebp - 0x8254]
push ecx
call fcn.0044e60d
add esp, 4
lea edx, [ebp - 0x82b8]
push edx
push 0xf013f
push esi
lea eax, [ebp - 0x81e4]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42ac7c
mov ecx, dword [ebp - 0x82b8]
push str.Debugger
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x42ac9a
mov edx, dword [ebp - 0x82b8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42acda
mov ecx, dword [ebp - 0x82b4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42ace2
mov eax, dword [ebp - 0x82d0]
push str._debugger.__IFEO_Debugger_Deleted__r_n
push ecx
push eax
push ecx
mov ecx, dword [ebp - 0x82c8]
push 0x48c93c
push ecx
call fcn.00415080
add esp, 0xc
push eax
call fcn.00414730
add esp, 0xc
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
inc dword [ebp - 0x82c4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
mov esi, dword [ebp - 0x82d4]
inc esi
mov dword [ebp - 0x82d4], esi
cmp esi, 0x325
jb 0x42a9d0
cmp dword [ebp - 0x82c4], edi
jne 0x42ad1d
mov edx, dword [ebp - 0x82c8]
push 0x48c940
push edx
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
cmp dword [ebp - 0x8228], edi
je 0x42af6b
mov eax, dword [ebp - 0x8294]
mov esi, 8
cmp dword [ebp - 0x8280], esi
jae 0x42ad42
lea eax, [ebp - 0x8294]
push edi
push eax
call fcn.004501ef
add esp, 8
test eax, eax
je 0x42ad6c
mov eax, dword [ebp - 0x8294]
cmp dword [ebp - 0x8280], esi
jae 0x42ad64
lea eax, [ebp - 0x8294]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
call fcn.004512d6
mov dword [ebp - 0x82dc], eax
add esp, 4
lea eax, [ebp - 0x82dc]
push eax
lea ecx, [ebp - 0x825c]
push ecx
mov dword [ebp - 0x82d8], edx
call fcn.0045104e
lea edx, [ebp - 0x825c]
push edx
push str._m__d__Y__I__M__S
lea eax, [ebp - 0x1e4]
push 0x3f
push eax
call fcn.004525b9
add esp, 0x18
xor ecx, ecx
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0x81ec], 7
mov dword [ebp - 0x81f0], edi
mov word [ebp - 0x8200], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x42add3
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x1e4]
push edx
lea ecx, [ebp - 0x8200]
call fcn.00401740
lea eax, [ebp - 0x8200]
push eax
mov edx, str._rkill_
lea esi, [ebp - 0x8278]
mov byte [ebp - 4], 0x37
call fcn.004320e0
add esp, 4
push eax
mov eax, str..reg
lea edi, [ebp - 0x821c]
mov byte [ebp - 4], 0x38
call fcn.00414ee0
add esp, 4
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x8294]
mov byte [ebp - 4], 0x39
call fcn.00411f30
mov esi, 8
cmp dword [ebp - 0x8208], esi
jb 0x42ae5c
mov ecx, dword [ebp - 0x821c]
push ecx
call fcn.0044e60d
add esp, 4
xor edx, edx
mov ebx, 7
mov dword [ebp - 0x8208], ebx
mov dword [ebp - 0x820c], edi
mov word [ebp - 0x821c], dx
cmp dword [ebp - 0x8264], esi
jb 0x42ae8d
mov eax, dword [ebp - 0x8278]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x8264], ebx
mov dword [ebp - 0x8268], edi
mov word [ebp - 0x8278], cx
cmp dword [ebp - 0x81ec], esi
jb 0x42aebd
mov edx, dword [ebp - 0x8200]
push edx
call fcn.0044e60d
add esp, 4
mov eax, dword [ebp - 0x8294]
cmp dword [ebp - 0x8280], esi
jae 0x42aed1
lea eax, [ebp - 0x8294]
push 0x472f68
push eax
lea eax, [ebp - 0x82b8]
push eax
call fcn.0044fd24
mov ecx, dword [ebp - 0x82b8]
add esp, 0xc
push ecx
push str.REGEDIT4_n_n
call fcn.0045272a
mov eax, dword [ebp - 0x8238]
add esp, 8
cmp dword [ebp - 0x8224], esi
jae 0x42af0e
lea eax, [ebp - 0x8238]
mov edx, dword [ebp - 0x82b8]
push edx
push eax
call fcn.0045272a
mov eax, dword [ebp - 0x82b8]
push eax
call fcn.004500fc
add esp, 0xc
call fcn.0042b5d0
mov edx, dword [ebp - 0x82c8]
push 0x47325c
push ecx
lea ecx, [ebp - 0x8294]
push ecx
push ecx
push str._r_nBackup_Registry_file_created_at:_r_n
push edx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
xor edi, edi
mov esi, 8
cmp dword [ebp - 0x829c], esi
jb 0x42af87
mov eax, dword [ebp - 0x82b0]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
mov ebx, 7
mov dword [ebp - 0x829c], ebx
mov dword [ebp - 0x82a0], edi
mov word [ebp - 0x82b0], cx
cmp dword [ebp - 0x8224], esi
jb 0x42afb8
mov edx, dword [ebp - 0x8238]
push edx
call fcn.0044e60d
add esp, 4
xor eax, eax
mov dword [ebp - 0x8224], ebx
mov dword [ebp - 0x8228], edi
mov word [ebp - 0x8238], ax
cmp dword [ebp - 0x8280], esi
jb 0x42afe4
mov ecx, dword [ebp - 0x8294]
push ecx
call fcn.0044e60d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044e488
mov esp, ebp
pop ebp
ret