Function at 0x8a3a80
Capabilities:
Check if file exists
Check os version
Create thread
Delete registry value
Link many functions at runtime
Persist via windows service
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb164e8
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x44c0
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [0xb45d94]
mov dword [ebp - 0x442c], eax
xor esi, esi
mov byte [ebp - 0x2dd0], 0
push 0x103
push esi
lea ecx, [ebp - 0x2dcf]
push ecx
call fcn.00a7ffb0
mov dword [ebp - 0x4414], 0x80004005
mov byte [ebp - 0x530], 0
push 0x40f
push esi
lea edx, [ebp - 0x52f]
push edx
call fcn.00a7ffb0
mov byte [ebp - 0x120], 0
push 0x103
push esi
lea eax, [ebp - 0x11f]
push eax
call fcn.00a7ffb0
mov dword [ebp - 0x4448], esi
mov dword [ebp - 0x44d4], esi
mov dword [ebp - 0x44bc], esi
mov byte [ebp - 0x1368], 0
push 0x103
push esi
lea ecx, [ebp - 0x1367]
push ecx
call fcn.00a7ffb0
add esp, 0x30
mov dword [ebp - 0x44c0], 0x104
mov edi, 1
mov dword [0xbd6588], edi
mov dword [0xb567c0], esi
push 0xb3acec
push str.BdThreadCountEx
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a3bde
cmp dword [0xbfc9d0], esi
jne 0x8a3baf
mov dword [0xbfc9d0], edi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x8a3baf
cmp al, 6
jb 0x8a3baf
mov dword [0xbfc9d4], edi
lea eax, [esi + 0xa]
jmp 0x8a3bc3
cmp dword [0xbfc9d4], esi
je 0x8a3bbe
mov eax, 0xa
jmp 0x8a3bc3
mov eax, 7
mov dword [0xb3acec], eax
mov esi, str.BdThreadCountEx
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor esi, esi
lea edx, [ebp - 0x440c]
push edx
push str.BdThreadCount
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8a3c11
push str.BdThreadCount
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
lea eax, [ebp - 0x440c]
push eax
push str.BdThreadCountX
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8a3c44
push str.BdThreadCountX
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
lea ecx, [ebp - 0x440c]
push ecx
push str.BdThreadCountY
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8a3c77
push str.BdThreadCountY
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
lea edx, [ebp - 0x440c]
push edx
push str.BdThreadCountZ
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8a3caa
push str.BdThreadCountZ
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c180
mov eax, dword [0xb3acec]
cmp eax, esi
jbe 0x8a3cb8
cmp eax, 0xa
jbe 0x8a3cc2
mov dword [0xb3acec], 0xa
push 0x1f40
push 0xb52360
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
test eax, eax
jne 0x8a3ce5
push 0xb52360
call ebx
push 0x1f40
push 0xb52480
call edi
test eax, eax
jne 0x8a3cfc
push 0xb52480
call ebx
push 0x1f40
push 0xb5249c
call edi
test eax, eax
jne 0x8a3d13
push 0xb5249c
call ebx
push 0x1f40
push 0xb52344
call edi
test eax, eax
jne 0x8a3d2a
push 0xb52344
call ebx
push 0x1f40
push 0xb5232c
call edi
test eax, eax
jne 0x8a3d41
push 0xb5232c
call ebx
push 0x1f40
push 0xb524c0
call edi
test eax, eax
jne 0x8a3d58
push 0xb524c0
call ebx
push 0x1f40
push 0xb525d0
call edi
test eax, eax
jne 0x8a3d6f
push 0xb525d0
call ebx
push 0x1f40
push 0xb523f4
call edi
test eax, eax
jne 0x8a3d86
push 0xb523f4
call ebx
push 0x1f40
push 0xb52310
call edi
test eax, eax
jne 0x8a3d9d
push 0xb52310
call ebx
push 0x1f40
push 0xb5240c
call edi
test eax, eax
jne 0x8a3db4
push 0xb5240c
call ebx
push 0x1f40
push 0xb52468
call edi
test eax, eax
jne 0x8a3dcb
push 0xb52468
call ebx
push 0x1f40
push 0xb523c4
call edi
test eax, eax
jne 0x8a3de2
push 0xb523c4
call ebx
push 0x1f40
push 0xb522f8
call edi
test eax, eax
jne 0x8a3df9
push 0xb522f8
call ebx
push 0x1f40
push 0xb523dc
call edi
test eax, eax
jne 0x8a3e10
push 0xb523dc
call ebx
push 0x1f40
push 0xb525e8
call edi
test eax, eax
jne 0x8a3e27
push 0xb525e8
call ebx
push 0x1f40
push 0xb52450
call edi
test eax, eax
jne 0x8a3e3e
push 0xb52450
call ebx
push 0x1f40
push 0xb52600
call edi
test eax, eax
jne 0x8a3e55
push 0xb52600
call ebx
push 0x1f40
push 0xb52428
call edi
test eax, eax
jne 0x8a3e6c
push 0xb52428
call ebx
push 0x1f40
push 0xb52378
call edi
test eax, eax
jne 0x8a3e83
push 0xb52378
call ebx
cmp dword [0xbd04f4], esi
je 0x8a3e97
cmp dword [0xbd04f8], esi
je 0x8a3f8d
cmp dword [ebp - 0x442c], esi
je 0x8a3f8d
push esi
push esi
push 0x89ba40
call fcn.00a791b2
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8a3f04
mov byte [ebp - 0x1a84], 0
push 0x103
push esi
lea eax, [ebp - 0x1a83]
push eax
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_5__fails_with_error__d
lea ecx, [ebp - 0x1a84]
push ecx
call fcn.00a78f30
push esi
push 1
lea edx, [ebp - 0x1a84]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8a3f17
push str.CBD_5f
xor ebx, ebx
mov esi, eax
call fcn.0085df20
add esp, 4
xor esi, esi
push esi
push esi
push 0x89bb40
call fcn.00a791b2
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8a3f78
mov byte [ebp - 0x24ac], 0
push 0x103
push esi
lea eax, [ebp - 0x24ab]
push eax
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_6__fails_with_error__d
lea ecx, [ebp - 0x24ac]
push ecx
call fcn.00a78f30
push esi
push 1
lea edx, [ebp - 0x24ac]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8a3f9c
push str.CBD_5g
xor ebx, ebx
mov esi, eax
call fcn.0085df20
add esp, 4
xor esi, esi
jmp 0x8a3f9c
mov eax, 1
mov dword [0xbd5bb4], eax
mov dword [0xbd5aac], eax
xor eax, eax
mov dword [0xb52394], eax
mov dword [0xb52398], eax
mov dword [0xb5239c], eax
mov dword [0xb523a0], eax
mov dword [0xb523a4], eax
mov dword [0xb523a8], eax
mov dword [0xb523ac], eax
mov dword [0xb523b0], eax
mov dword [0xb523b4], eax
mov dword [0xb523b8], eax
mov dword [0xb523bc], eax
xor ebx, ebx
cmp dword [0xb3acec], esi
jbe 0x8a4005
mov esi, 0xb524e0
push 0x1f40
push esi
call edi
test eax, eax
jne 0x8a3ff7
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
inc ebx
add esi, 0x18
cmp ebx, dword [0xb3acec]
jb 0x8a3fe4
xor esi, esi
cmp dword [0xb54184], esi
jbe 0x8a4017
mov dword [0xbc27fc], 1
mov dword [ebp - 0x449c], esi
mov dword [ebp - 0x44a0], esi
push esi
push esi
lea eax, [ebp - 0x44bc]
push eax
push esi
push esi
lea ecx, [ebp - 0x44d4]
push ecx
push esi
lea edx, [ebp - 0x449c]
push edx
xor ebx, ebx
xor edx, edx
lea ecx, [ebp - 0x44a0]
call fcn.009691d0
add esp, 0x20
call fcn.008705d0
call fcn.009686d0
mov dword [0xb38014], eax
cmp byte [str.C:PROGRA3MICROW1eScanBD_avpMCfg.klr], bl
jne 0x8a40c7
push 0xb548d8
push 0xaa1544
push str.C:PROGRA3MICROW1eScanBD_avpMCfg.klr
call fcn.00a78f30
add esp, 0xc
xor ecx, ecx
mov edi, str.C:PROGRA3MICROW1eScanBD_avpMCfg.klr
call fcn.0095a6d0
cmp eax, 1
jne 0x8a40b5
mov eax, edi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8a4091
mov ecx, dword [str.avpMCfg.klr]
mov dword [eax], ecx
mov edx, dword [0xac29dc]
mov dword [eax + 4], edx
mov ecx, dword [0xac29e0]
mov dword [eax + 8], ecx
jmp 0x8a40c7
push str.avpMCfg.klr
push str.C:PROGRA3MICROW1eScanBD_avpMCfg.klr
call fcn.00a78f30
add esp, 8
cmp byte [0xb55918], 0
jne 0x8a40e7
push 0xb55508
push str._sVistaeScanMon.lan
push 0xb55918
call fcn.00a78f30
add esp, 0xc
mov dword [ebp - 0x440c], ebx
lea edx, [ebp - 0x440c]
push edx
push str.MonitorPrintJobs
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x440c], ebx
je 0x8a4115
call fcn.0099ac90
push 0xb3debc
push str.AVCEnabled
mov ecx, str.SOFTWAREMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
xor edi, edi
mov ecx, str.avc3
call fcn.009620b0
test eax, eax
je 0x8a4179
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
je 0x8a4175
push 1
push str.avc3
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
je 0x8a416e
mov ebx, 1
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
xor ebx, ebx
mov dword [0xbd18b8], eax
cmp eax, ebx
je 0x8a41b1
mov dword [ebp - 0x445c], ebx
lea eax, [ebp - 0x445c]
push eax
push str.ForceInjectViaAvpmapp
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x445c], ebx
je 0x8a41b1
mov dword [0xbd18b8], ebx
call fcn.00a5bee0
mov dword [0xbd18b4], eax
push 0xb3de00
push str.DeviceControlEnabled
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.00a5bee0
test eax, eax
je 0x8a4351
mov ecx, 0xa
mov esi, str.SYSTEMCurrentControlSetServices_avdisk
lea edi, [ebp - 0xd50]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x441c]
push ecx
push 1
push 0
lea edx, [ebp - 0xd50]
push edx
push 0x80000002
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call ebx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x8a423d
lea ecx, [ebp - 0x441c]
push ecx
lea edx, [ebp - 0xd50]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x8a424a
mov eax, dword [ebp - 0x441c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0xb
mov esi, str.SYSTEMCurrentControlSetServices_avdiskCDKey
lea edi, [ebp - 0xd50]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x441c]
push ecx
push 1
push 0
lea edx, [ebp - 0xd50]
push edx
push 0x80000002
call ebx
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x8a42a2
lea ecx, [ebp - 0x441c]
push ecx
lea edx, [ebp - 0xd50]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x8a42af
mov eax, dword [ebp - 0x441c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x444c]
push ecx
push str.DeviceControlEnabled
mov ecx, str.SYSTEMCurrentControlSetServices_avdiskCDKey
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a42e7
mov eax, dword [0xb3de00]
mov esi, str.DeviceControlEnabled
mov ebx, str.SYSTEMCurrentControlSetServices_avdiskCDKey
mov ecx, 0x80000002
call fcn.0094be90
lea edx, [ebp - 0x444c]
push edx
push str.ReadProtect
mov ecx, str.SYSTEMCurrentControlSetServices_avdiskCDKey
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a431c
xor eax, eax
mov esi, str.ReadProtect
mov ebx, str.SYSTEMCurrentControlSetServices_avdiskCDKey
mov ecx, 0x80000002
call fcn.0094be90
lea eax, [ebp - 0x444c]
push eax
push str.WriteProtect
mov ecx, str.SYSTEMCurrentControlSetServices_avdiskCDKey
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a4351
xor eax, eax
mov esi, str.WriteProtect
mov ebx, str.SYSTEMCurrentControlSetServices_avdiskCDKey
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
lea edi, [ebx + 1]
push 0xb3df00
push str.AVCEnabled
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.00969720
mov dword [0xbd5764], eax
cmp eax, ebx
jne 0x8a4385
mov dword [0xbd576c], ebx
jmp 0x8a439e
push 0xbd576c
push str.BlockEternalBlue
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb524b8
push str.SecurityMode
mov ecx, str.SOFTWAREMicroWorldeConcealeConceal_FirewallCommon
mov edx, 0x80000002
call fcn.0094c0d0
push 0x104
lea ecx, [ebp - 0x120]
push ecx
push 0xaae0f8
mov edx, str.EPSEnabled
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x120], 0x30
jne 0x8a43e9
mov dword [0xb3df08], ebx
push 0x104
lea edx, [ebp - 0x120]
push edx
push 0xaa1ac4
mov edx, str.Consctl_enable
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x120], 0x31
jne 0x8a441b
mov dword [0xbd5774], edi
push 0xbd1e18
push str.ReadProtect
mov ecx, str.SYSTEMCurrentControlSetServices_avdiskCDKey
mov edx, 0x80000002
call fcn.0094c0d0
push 0xbd1e20
push str.WriteProtect
mov ecx, str.SYSTEMCurrentControlSetServices_avdiskCDKey
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8a4477
cmp dword [0xb3de00], ebx
je 0x8a4470
cmp dword [0xb3df08], ebx
je 0x8a4470
mov eax, dword [0xbd1e20]
cmp eax, edi
je 0x8a4472
cmp eax, ebx
jne 0x8a4477
jmp 0x8a4472
xor eax, eax
call fcn.00a5c020
cmp dword [0xb3de00], ebx
je 0x8a4707
cmp dword [0xb3df08], ebx
je 0x8a4707
cmp dword [0xbd1e18], ebx
je 0x8a44aa
push edi
mov ecx, 2
call fcn.00876960
add esp, 4
jmp 0x8a49ea
mov dword [ebp - 0x4468], edi
call fcn.00876850
test eax, eax
jne 0x8a49ea
lea eax, [ebp - 0x4468]
push eax
push str.DCLastVal
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x4468], edi
jne 0x8a44f1
mov dword [0xbd4aec], ebx
mov dword [0xbd4ae8], ebx
jmp 0x8a49ea
xor eax, eax
jmp 0x8a4500
mov cl, byte [eax + 0xb55508]
mov byte [ebp + eax - 0x634], cl
add eax, edi
test cl, cl
jne 0x8a4500
cmp byte [ebp - 0x634], cl
je 0x8a454a
lea eax, [ebp - 0x634]
add eax, edi
cmp byte [eax], 0
jne 0x8a4521
lea ecx, [ebp - 0x634]
sub eax, ecx
je 0x8a454a
cmp byte [ebp + eax - 0x635], 0x5c
je 0x8a454a
push 0xaa1564
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.00968110
test eax, eax
lea eax, [ebp - 0x634]
je 0x8a458d
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8a4560
mov ecx, dword [str.devcon64.exe]
mov dword [eax], ecx
mov edx, dword [0xab1394]
mov dword [eax + 4], edx
mov ecx, dword [0xab1398]
mov dword [eax + 8], ecx
mov dl, byte [0xab139c]
mov byte [eax + 0xc], dl
jmp 0x8a45bd
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8a4590
mov ecx, dword [str.devcon.exe]
mov dword [eax], ecx
mov edx, dword [0xab1358]
mov dword [eax + 4], edx
mov cx, word [0xab135c]
mov word [eax + 8], cx
mov dl, byte [0xab135e]
mov byte [eax + 0xa], dl
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x634]
call fcn.0095a0f0
add esp, 8
test eax, eax
je 0x8a462e
call fcn.0086df90
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x634]
call fcn.0095a0f0
add esp, 8
test eax, eax
je 0x8a462e
cmp dword [0xbe69f4], ebx
jne 0x8a49ea
mov dword [0xbe69f4], edi
push 2
push str._DEVC___u__Unable_to_locate_devcon_in_eScan_Folder_
lea eax, [ebp - 0xf58]
push eax
call fcn.00a78f30
push ebx
push edi
lea ecx, [ebp - 0xf58]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8a49ea
push 2
push str._DEVC___u__Enabling_CDROM_Device
lea edx, [ebp - 0xf58]
push edx
call fcn.00a78f30
xor esi, esi
push esi
push 1
lea eax, [ebp - 0xf58]
push eax
push 0xb54ce8
call fcn.008808e0
lea ecx, [ebp - 0x634]
push ecx
push str._s_enable_CDROM
lea edx, [ebp - 0x2fd8]
push edx
call fcn.00a78f30
add esp, 0x28
mov dword [0xbd4aec], esi
mov dword [0xbd4ae8], esi
lea eax, [esi + 1]
mov esi, str.DCLastVal
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor esi, esi
mov dword [ebp - 0x4470], esi
call fcn.00968110
test eax, eax
je 0x8a46b7
lea eax, [ebp - 0x4470]
push eax
call fcn.009681c0
add esp, 4
mov esi, eax
push 2
push 1
lea ecx, [ebp - 0x2fd8]
push ecx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
call fcn.0095dfe0
add esp, 0xc
test esi, esi
je 0x8a46e4
mov edx, dword [ebp - 0x4470]
push edx
call fcn.00968240
add esp, 4
push 2
push str._DEVC___u__Device_Task_Finished.
lea eax, [ebp - 0xf58]
push eax
call fcn.00a78f30
push 0
push 1
lea ecx, [ebp - 0xf58]
push ecx
jmp 0x8a49d6
mov dword [ebp - 0x4478], edi
call fcn.00876850
test eax, eax
jne 0x8a49ea
lea edx, [ebp - 0x4478]
push edx
push str.DCLastVal
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x4478], edi
jne 0x8a474e
mov dword [0xbd4aec], ebx
mov dword [0xbd4ae8], ebx
jmp 0x8a49ea
xor eax, eax
mov cl, byte [eax + 0xb55508]
mov byte [ebp + eax - 0x738], cl
add eax, edi
test cl, cl
jne 0x8a4750
cmp byte [ebp - 0x738], cl
je 0x8a479a
lea eax, [ebp - 0x738]
add eax, edi
cmp byte [eax], 0
jne 0x8a4771
lea ecx, [ebp - 0x738]
sub eax, ecx
je 0x8a479a
cmp byte [ebp + eax - 0x739], 0x5c
je 0x8a479a
push 0xaa1564
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0xb4c310]
cmp eax, 0xffffffff
jne 0x8a47e2
push str.IsWow64Process
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x4480], ebx
cmp esi, ebx
je 0x8a47d7
lea eax, [ebp - 0x4480]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 0x4480]
mov dword [0xb4c310], eax
cmp eax, ebx
lea eax, [ebp - 0x738]
je 0x8a481d
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8a47f0
mov ecx, dword [str.devcon64.exe]
mov dword [eax], ecx
mov edx, dword [0xab1394]
mov dword [eax + 4], edx
mov ecx, dword [0xab1398]
mov dword [eax + 8], ecx
mov dl, byte [0xab139c]
mov byte [eax + 0xc], dl
jmp 0x8a484d
dec eax
mov edi, edi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8a4820
mov ecx, dword [str.devcon.exe]
mov dword [eax], ecx
mov edx, dword [0xab1358]
mov dword [eax + 4], edx
mov cx, word [0xab135c]
mov word [eax + 8], cx
mov dl, byte [0xab135e]
mov byte [eax + 0xa], dl
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x738]
call fcn.0095a0f0
add esp, 8
test eax, eax
je 0x8a48be
call fcn.0086df90
push ebx
push ebx
xor edx, edx
lea ecx, [ebp - 0x738]
call fcn.0095a0f0
add esp, 8
test eax, eax
je 0x8a48be
cmp dword [0xbe69f4], ebx
jne 0x8a49ea
mov dword [0xbe69f4], edi
push 4
push str._DEVC___u__Unable_to_locate_devcon_in_eScan_Folder_
lea eax, [ebp - 0x105c]
push eax
call fcn.00a78f30
push ebx
push edi
lea ecx, [ebp - 0x105c]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8a49ea
push 4
push str._DEVC___u__Enabling_CDROM_Device
lea edx, [ebp - 0x105c]
push edx
call fcn.00a78f30
xor esi, esi
push esi
push 1
lea eax, [ebp - 0x105c]
push eax
push 0xb54ce8
call fcn.008808e0
lea ecx, [ebp - 0x738]
push ecx
push str._s_enable_CDROM
lea edx, [ebp - 0x30dc]
push edx
call fcn.00a78f30
add esp, 0x28
mov dword [0xbd4aec], esi
mov dword [0xbd4ae8], esi
lea eax, [esi + 1]
mov esi, str.DCLastVal
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x4490], ebx
mov eax, dword [0xb4c310]
cmp eax, 0xffffffff
jne 0x8a4977
push str.IsWow64Process
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x4488], ebx
cmp esi, ebx
je 0x8a496c
lea eax, [ebp - 0x4488]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 0x4488]
mov dword [0xb4c310], eax
cmp eax, ebx
je 0x8a498c
lea ecx, [ebp - 0x4490]
push ecx
call fcn.009681c0
add esp, 4
mov edi, eax
push 2
push 1
lea edx, [ebp - 0x30dc]
push edx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
call fcn.0095dfe0
add esp, 0xc
cmp edi, ebx
je 0x8a49b9
mov eax, dword [ebp - 0x4490]
push eax
call fcn.00968240
add esp, 4
push 4
push str._DEVC___u__Device_Task_Finished.
lea ecx, [ebp - 0x105c]
push ecx
call fcn.00a78f30
push ebx
push 1
lea edx, [ebp - 0x105c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
mov edi, 1
xor ebx, ebx
cmp dword [0xbd1e18], edi
jne 0x8a49f8
mov dword [0xb3de08], ebx
push 0xb3de18
push str.WebcamAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb3de10
push str.USBTetheringAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
push 0xbd2238
push str.PassType
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb3de20
push str.BluetoothAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb3de28
push str.BluetoothFileTransfersAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb3de38
push str.WifiAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
mov esi, 0x800
mov dword [ebp - 0x4430], esi
push str.WifiSSIDAllowed
lea eax, [ebp - 0x4430]
mov edi, 0xbd3240
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c020
push 0xb3de30
push str.PrintersAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
mov dword [ebp - 0x4430], esi
push str.PrinterNamesAllowed
lea eax, [ebp - 0x4430]
mov edi, 0xbd2240
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c020
mov dword [ebp - 0x4430], 0x207
push str.DeviceId
lea eax, [ebp - 0x4430]
mov edi, 0xbd1e28
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c020
push 0xb3de40
push str.SDCardAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb3de48
push str.Start
mov ecx, str.SYSTEMCurrentControlSetServicesUsbStor
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb3de50
push str.CompositeUSBAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb3de58
push str.ImagingDevicesAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb3de60
push str.USBModemAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb3de68
push str.USBOnTerminalClientsAllowed
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
push 0xb3de70
push str.WhiteListingAllowedWhenUSBPortsBlocked
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.009d6fc0
mov dword [0xb3df20], eax
push 0xb55f40
push 0x208
push 0xbd4b20
push 0xaa1543
push str.HTTPHost
push str.Config
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call edi
push 0xbd4b20
push str.http:__10.160.61.4:3333
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [0xb54194], ebx
je 0x8a4c72
cmp dword [0xb567cc], ebx
je 0x8a4c72
mov byte [ebp - 0x1c8c], 0
push 0x103
push ebx
lea eax, [ebp - 0x1c8b]
push eax
call fcn.00a7ffb0
add esp, 0xc
push 0xb55f40
push 0x104
lea ecx, [ebp - 0x1c8c]
push ecx
push 0xaa1543
push str.IPOnly
push str.Config
call edi
cmp byte [ebp - 0x1c8c], 0x31
jne 0x8a4c72
push str.IPONLY_A
call fcn.0099be50
add esp, 4
push 0xb55f40
push 0x410
push 0xbd4f30
push 0xaa1543
push str.Servers
push str.Config
call edi
push 0xbd4f30
push str.STORAGE_10.160.61.177_10.160.61.4
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0xb565ac]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x8a4cd6
push str.AddConnectNotify
push eax
call esi
mov dword [0xbd6330], eax
push str.CancelConnectNotify
mov edx, dword [0xb565ac]
push edx
call esi
mov dword [0xbd6334], eax
mov eax, dword [0xb565ac]
cmp dword [0xb54194], ebx
je 0x8a4e80
cmp dword [0xbd04f4], ebx
je 0x8a4cff
cmp dword [0xbd04f8], ebx
jne 0x8a4cff
test byte [0xb56590], 1
je 0x8a4e80
cmp eax, ebx
je 0x8a4dcd
push str.SendFileToAgent
push eax
call esi
mov dword [0xbded9c], eax
cmp eax, ebx
je 0x8a4db8
push str.SendFileToAgentEx
mov eax, dword [0xb565ac]
push eax
call esi
mov dword [0xbdeea4], eax
cmp eax, ebx
jne 0x8a4d47
push ebx
push 1
push str._SECSERVER__Unable_to_get_ProcAddress_of_SendFileToAgentEx__Possibly_old_DNSLIB.DLL_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0xbde56c
push str.GroupDebug
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a4d7f
mov eax, dword [0xbde56c]
mov esi, str.GroupDebug
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8a4d9c
push ebx
push eax
push str._SECSERVER__Starting_to_init_xSendFileToAgent__...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push ebx
push ebx
push ebx
push ebx
call dword [0xbded9c]
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8a4dcd
push ebx
push eax
push str._SECSERVER__Finished_xSendFileToAgent__...
jmp 0x8a4dc0
push ebx
push 1
push str._SECSERVER__Unable_to_get_ProcAddress_of_SendFileToAgent__Possibly_old_DNSLIB.DLL_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
call fcn.008708a0
push 0xb55f40
push 0x40
push 0xb3dec0
push 0xab2680
push str.SecServer
push str.Config
call edi
push ebx
push ebx
push 0x8a1f90
call fcn.00a791b2
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x8a4e52
mov byte [ebp - 0x22a4], 0
push 0x103
push ebx
lea ecx, [ebp - 0x22a3]
push ecx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_v1AX__fails_with_error__d
lea edx, [ebp - 0x22a4]
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0x22a4]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8a4e80
cmp dword [0xb567e0], ebx
je 0x8a4e80
push str.CBD_5h
push str._s__CBD_
lea ecx, [ebp - 0x34ec]
push ecx
call fcn.00a78f30
add esp, 0xc
xor ebx, ebx
lea edi, [ebp - 0x34ec]
call fcn.0085df70
call fcn.0098b8f0
cmp dword [0xb56800], ebx
jne 0x8a4ec5
push 0x104
lea edx, [ebp - 0x120]
push edx
push 0xaa1ac4
mov edx, str.SuspAppDetectEnabled
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x120], 0x31
jne 0x8a4ecb
mov dword [0xbd575c], 1
jmp 0x8a4ecb
mov dword [0xbd575c], ebx
cmp dword [0xb5681c], ebx
jne 0x8a4ee4
call fcn.0098ba30
call fcn.00898590
mov dword [0xbd577c], eax
jmp 0x8a4f04
mov dword [0xb3df18], ebx
mov dword [0xb52328], ebx
mov dword [0xb52390], 4
mov dword [0xb524bc], 1
call fcn.0094cce0
mov edi, 0x104
mov ecx, 0xbd5ab0
call fcn.00958630
push 0xbd5ab0
push 0xbd5bb8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [0xbd5bb8], 0
je 0x8a4f60
mov eax, 0xbd5bb8
inc eax
cmp byte [eax], 0
jne 0x8a4f36
sub eax, 0xbd5bb8
je 0x8a4f60
cmp byte [eax + 0xbd5bb7], 0x5c
je 0x8a4f60
push 0xaa1564
push 0xbd5bb8
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
jmp 0x8a4f66
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.assembly_
push 0xbd5bb8
call esi
push 0xb56938
push 0xbd5cc0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
call edi
cmp byte [0xbd5cc0], 0
je 0x8a4fb4
mov eax, 0xbd5cc0
inc eax
cmp byte [eax], 0
jne 0x8a4f92
sub eax, 0xbd5cc0
je 0x8a4fb4
cmp byte [eax + 0xbd5cbf], 0x5c
je 0x8a4fb4
push 0xaa1564
push 0xbd5cc0
call esi
push str.wdi_
push 0xbd5cc0
call esi
push 0xb56938
push 0xbd5dc8
call edi
cmp byte [0xbd5dc8], 0
je 0x8a5002
mov eax, 0xbd5dc8
lea ebx, [ebx]
inc eax
cmp byte [eax], 0
jne 0x8a4fe0
sub eax, 0xbd5dc8
je 0x8a5002
cmp byte [eax + 0xbd5dc7], 0x5c
je 0x8a5002
push 0xaa1564
push 0xbd5dc8
call esi
push str.LogFiles_
push 0xbd5dc8
call esi
push 0xb56938
push 0xbd5ed0
call edi
cmp byte [0xbd5ed0], 0
je 0x8a504a
mov eax, 0xbd5ed0
inc eax
cmp byte [eax], 0
jne 0x8a5028
sub eax, 0xbd5ed0
je 0x8a504a
cmp byte [eax + 0xbd5ecf], 0x5c
je 0x8a504a
push 0xaa1564
push 0xbd5ed0
call esi
push str.wfp_
push 0xbd5ed0
call esi
push 0xbd5ab0
push 0xbd5fd8
call edi
cmp byte [0xbd5fd8], 0
je 0x8a5092
mov eax, 0xbd5fd8
inc eax
cmp byte [eax], 0
jne 0x8a5070
sub eax, 0xbd5fd8
je 0x8a5092
cmp byte [eax + 0xbd5fd7], 0x5c
je 0x8a5092
push 0xaa1564
push 0xbd5fd8
call esi
push str.ResCache_
push 0xbd5fd8
call esi
push 0xbd5ab0
push 0xbd60e0
call edi
cmp byte [0xbd60e0], 0
je 0x8a50da
mov eax, 0xbd60e0
inc eax
cmp byte [eax], 0
jne 0x8a50b8
sub eax, 0xbd60e0
je 0x8a50da
cmp byte [eax + 0xbd60df], 0x5c
je 0x8a50da
push 0xaa1564
push 0xbd60e0
call esi
push str.PolicyDefinitions_
push 0xbd60e0
call esi
push 0xbd5ab0
push str.C:WINDOWSWIN.INI
call edi
cmp byte [str.C:WINDOWSWIN.INI], 0
je 0x8a5122
mov eax, str.C:WINDOWSWIN.INI
inc eax
cmp byte [eax], 0
jne 0x8a5100
sub eax, str.C:WINDOWSWIN.INI
je 0x8a5122
cmp byte [eax + 0xbd61e7], 0x5c
je 0x8a5122
push 0xaa1564
push str.C:WINDOWSWIN.INI
call esi
push str.WIN.INI
push str.C:WINDOWSWIN.INI
call esi
xor ecx, ecx
mov edi, 0xbd5fd8
call fcn.0095a6d0
cmp eax, 1
je 0x8a5146
mov byte [0xbd5fd8], 0
mov eax, dword [0xb3de00]
mov dword [0xb3de04], eax
mov ecx, dword [0xb3df20]
mov dword [0xb3df24], ecx
mov edx, dword [0xbd5764]
mov dword [0xbd5768], edx
mov eax, dword [0xbd576c]
mov dword [0xbd5770], eax
mov ecx, dword [0xb3de08]
mov dword [0xb3de0c], ecx
mov edx, dword [0xbd1e18]
mov dword [0xbd1e1c], edx
mov eax, dword [0xbd1e20]
mov dword [0xbd1e24], eax
mov ecx, dword [0xb3de18]
mov dword [0xb3de1c], ecx
mov edx, dword [0xb3de10]
mov dword [0xb3de14], edx
mov eax, dword [0xbd2238]
mov dword [0xbd223c], eax
mov ecx, dword [0xb3de20]
mov dword [0xb3de24], ecx
mov edx, dword [0xb3de28]
mov dword [0xb3de2c], edx
mov eax, dword [0xb3de38]
mov dword [0xb3de3c], eax
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0xbd3240]
mov byte [eax + 0xbd3a40], cl
inc eax
test cl, cl
jne 0x8a51e0
mov ecx, dword [0xb3de30]
mov dword [0xb3de34], ecx
xor eax, eax
nop
mov cl, byte [eax + 0xbd2240]
mov byte [eax + 0xbd2a40], cl
inc eax
test cl, cl
jne 0x8a5200
xor eax, eax
mov cl, byte [eax + 0xbd1e28]
mov byte [eax + 0xbd2030], cl
inc eax
test cl, cl
jne 0x8a5213
mov edx, dword [0xb3de40]
mov dword [0xb3de44], edx
mov eax, dword [0xb3de48]
mov dword [0xb3de4c], eax
mov ecx, dword [0xb3de50]
mov dword [0xb3de54], ecx
mov edx, dword [0xb3de58]
mov dword [0xb3de5c], edx
mov eax, dword [0xb3de60]
mov dword [0xb3de64], eax
mov ecx, dword [0xb3de68]
mov dword [0xb3de6c], ecx
mov edx, dword [0xb3de70]
mov dword [0xb3de74], edx
mov eax, dword [0xb3df00]
mov dword [0xb3df04], eax
mov ecx, dword [0xb3df08]
mov dword [0xb3df0c], ecx
mov edx, dword [0xbd5774]
mov dword [0xbd5778], edx
mov eax, dword [0xb524b8]
mov dword [0xb52440], eax
mov ecx, dword [0xbd4b1c]
mov dword [0xbd5750], ecx
mov edx, dword [0xbd575c]
mov dword [0xbd5760], edx
mov eax, dword [0xb3df10]
mov dword [0xb3df14], eax
mov ecx, dword [0xbd5754]
mov dword [0xbd5758], ecx
mov edx, dword [0xb3df18]
mov dword [0xb3df1c], edx
mov eax, dword [0xb52328]
mov dword [0xb524b4], eax
mov ecx, dword [0xb52390]
mov dword [0xb52444], ecx
mov edx, dword [0xb524bc]
mov dword [0xb524d8], edx
mov eax, dword [0xbd577c]
mov dword [0xbd5780], eax
push str.NetshIPChanged
mov ecx, str.SoftwareMicroWorld
mov edx, 0x80000001
call fcn.0094c180
cmp al, 1
je 0x8a533f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x8a533f
push str.NetshIPChanged
call fcn.00989f40
cmp eax, 1
jne 0x8a533f
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xb2745c
push str.IPChangeAllowed
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5396
mov eax, dword [0xb2745c]
mov esi, str.IPChangeAllowed
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
push 1
push 0
xor edx, edx
mov ecx, str.C:PROGRA2eScanNWCONFIG.DAT
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8a5396
mov eax, str.C:PROGRA2eScanNWCONFIG.DAT
call fcn.0094dd20
push 0xb27564
push str.ProtectInterfaces
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a53cc
mov eax, dword [0xb27564]
mov esi, str.ProtectInterfaces
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov eax, dword [0xb2745c]
test eax, eax
jne 0x8a53e1
mov dword [0xb2745c], 2
jmp 0x8a53f0
cmp eax, 3
jne 0x8a53f0
mov dword [0xb2745c], 0
cmp dword [0xbd04f4], 0
je 0x8a540f
cmp dword [0xbd04f8], 0
jne 0x8a540f
test byte [0xb56590], 2
je 0x8a54ad
push 0
push 0
push 0x89c730
call fcn.00a791b2
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x8a5476
mov byte [ebp - 0x1e94], 0
push 0x103
push 0
lea ecx, [ebp - 0x1e93]
push ecx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_7__fails_with_error__d
lea edx, [ebp - 0x1e94]
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x1e94]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8a54a5
cmp dword [0xb567e0], 0
je 0x8a54a5
push str.CBD_5j
push str._s__CBD_
lea ecx, [ebp - 0x32e4]
push ecx
call fcn.00a78f30
add esp, 0xc
xor ebx, ebx
lea edi, [ebp - 0x32e4]
call fcn.0085df70
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0xbd04f4], 0
je 0x8a54cc
cmp dword [0xbd04f8], 0
jne 0x8a54cc
test byte [0xb56590], 4
je 0x8a5626
push 0
push 0
push fcn.009d0350
call fcn.00a791b2
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x8a5533
mov byte [ebp - 0x26b4], 0
push 0x103
push 0
lea edx, [ebp - 0x26b3]
push edx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_8__fails_with_error__d
lea eax, [ebp - 0x26b4]
push eax
call fcn.00a78f30
push 0
push 1
lea ecx, [ebp - 0x26b4]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8a556c
mov dword [0xbd0668], 1
cmp dword [0xb567e0], 0
je 0x8a556c
push str.CBD_5k
push str._s__CBD_
lea edx, [ebp - 0x2ed4]
push edx
call fcn.00a78f30
add esp, 0xc
xor ebx, ebx
lea edi, [ebp - 0x2ed4]
call fcn.0085df70
cmp dword [0xbdd710], 0
jne 0x8a5626
cmp dword [0xb3de78], 0
jbe 0x8a5626
push 0
push 0
push 0x9d00e0
call fcn.00a791b2
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x8a55ed
mov byte [ebp - 0x187c], 0
push 0x103
push 0
lea eax, [ebp - 0x187b]
push eax
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_8xx__fails_with_error__d
lea ecx, [ebp - 0x187c]
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x187c]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8a5626
mov dword [0xbdd710], 1
cmp dword [0xb567e0], 0
je 0x8a5626
push str.CBD_5k_8xx
push str._s__CBD_
lea eax, [ebp - 0x2ac4]
push eax
call fcn.00a78f30
add esp, 0xc
xor ebx, ebx
lea edi, [ebp - 0x2ac4]
call fcn.0085df70
cmp dword [0xb54194], 0
jne 0x8a563c
test byte [0xb8db58], 0x80
je 0x8a5739
cmp dword [0xbd04f4], 0
je 0x8a5652
cmp dword [0xbd04fc], 0
je 0x8a5739
mov eax, dword [0xb565ac]
test eax, eax
je 0x8a566c
push str.SendCachedEvents
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0xb56820], eax
cmp dword [0xb56820], 0
je 0x8a5739
cmp dword [0xb56824], 0
jne 0x8a5739
mov dword [0xb56824], 1
push 0
push 1
push str._EVCACHE__Invoking_Cache_Events_Thread...
push 0xb54ce8
call fcn.008808e0
push 0
push 0
push 0x866cd0
call fcn.00a791b2
add esp, 0x1c
mov esi, eax
cmp esi, 0xffffffff
jne 0x8a570a
mov byte [ebp - 0x1980], 0
push 0x103
push 0
lea ecx, [ebp - 0x197f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_9__fails_with_error__d
lea edx, [ebp - 0x1980]
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x1980]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8a5739
cmp dword [0xb567e0], 0
je 0x8a5739
push str.CBD_5m
push str._s__CBD_
lea ecx, [ebp - 0x2bc8]
push ecx
call fcn.00a78f30
add esp, 0xc
xor ebx, ebx
lea edi, [ebp - 0x2bc8]
call fcn.0085df70
cmp dword [0xb54194], 0
jne 0x8a575a
test byte [0xb8db58], 0x80
jne 0x8a575a
mov dword [0xbdd82c], 1
jmp 0x8a5832
cmp dword [0xbd04f4], 0
je 0x8a577b
cmp dword [0xbd04fc], 0
jne 0x8a577b
mov dword [0xbdd82c], 1
jmp 0x8a5832
push 0
cmp dword [0xb4390c], 0
je 0x8a582a
push 0
push fcn.0089bdb0
call fcn.00a791b2
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
jne 0x8a57f9
mov dword [0xbdd82c], 1
mov byte [ebp - 0x1b88], 0
push 0x103
push 0
lea edx, [ebp - 0x1b87]
push edx
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_a__fails_with_error__d
lea eax, [ebp - 0x1b88]
push eax
call fcn.00a78f30
push 0
push 1
lea ecx, [ebp - 0x1b88]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x1c
jmp 0x8a5832
cmp dword [0xb567e0], 0
je 0x8a5832
push str.CBD_5n
push str._s__CBD_
lea edx, [ebp - 0x2ccc]
push edx
call fcn.00a78f30
add esp, 0xc
xor ebx, ebx
lea edi, [ebp - 0x2ccc]
call fcn.0085df70
jmp 0x8a5832
call fcn.0089bdb0
add esp, 4
xor edi, edi
mov dword [ebp - 0x4484], edi
lea esi, [ebp - 0x4484]
call fcn.0095e560
mov eax, dword [ebp - 0x4484]
shr eax, 0xa
shr eax, 1
mov ecx, dword [0xb3acec]
shr ecx, 1
xor edx, edx
div ecx
cmp eax, 0x20
jbe 0x8a586d
mov dword [0xb3dddc], 0x20
jmp 0x8a58b4
cmp eax, 0x18
jbe 0x8a587e
mov dword [0xb3dddc], 0x18
jmp 0x8a58b4
cmp eax, 0x10
jbe 0x8a588f
mov dword [0xb3dddc], 0x10
jmp 0x8a58b4
cmp eax, 8
jbe 0x8a58a0
mov dword [0xb3dddc], 8
jmp 0x8a58b4
mov edx, 4
cmp edx, eax
sbb eax, eax
and eax, 2
add eax, 2
mov dword [0xb3dddc], eax
mov dword [0xbd4ab4], edi
push 0xbd4ab4
push str.DisableDateTimeModificationAllowRegCmd
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a58f0
mov eax, dword [0xbd4ab4]
mov esi, str.DisableDateTimeModificationAllowRegCmd
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3de98], 1
push 0xb3de98
push str.BlockVSSAdmin
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5930
mov eax, dword [0xb3de98]
mov esi, str.BlockVSSAdmin
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4ad0], 0
push 0xbd4ad0
push str.BlockPowershell
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5970
mov eax, dword [0xbd4ad0]
mov esi, str.BlockPowershell
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4ad4], 0
push 0xbd4ad4
push str.BlockMSOffice
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a59b0
mov eax, dword [0xbd4ad4]
mov esi, str.BlockMSOffice
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3de84], 1
push 0xb3de84
push str.BlockSVAndWMCChild
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a59f0
mov eax, dword [0xb3de84]
mov esi, str.BlockSVAndWMCChild
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4ac4], 0
push 0xbd4ac4
push str.BlockUnsignedExeDownloadedFromInternet
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5a30
mov eax, dword [0xbd4ac4]
mov esi, str.BlockUnsignedExeDownloadedFromInternet
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3de88], 1
push 0xb3de88
push str.BlockWScriptFromRunningDownloadedApps
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5a70
mov eax, dword [0xb3de88]
mov esi, str.BlockWScriptFromRunningDownloadedApps
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4ac8], 0
push 0xbd4ac8
push str.BlockUnsignedExeOnUSB
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5ab0
mov eax, dword [0xbd4ac8]
mov esi, str.BlockUnsignedExeOnUSB
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3de8c], 1
push 0xb3de8c
push str.UnsignedExeCheckWhiteListing
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5af0
mov eax, dword [0xb3de8c]
mov esi, str.UnsignedExeCheckWhiteListing
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3de90], 1
push 0xb3de90
push str.BlockAdobeOfficeChildExe
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5b30
mov eax, dword [0xb3de90]
mov esi, str.BlockAdobeOfficeChildExe
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3de94], 1
push 0xb3de94
push str.BlockWebShell
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5b70
mov eax, dword [0xb3de94]
mov esi, str.BlockWebShell
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4acc], 0
push 0xbd4acc
push str.BlockCustomChildExe
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5bb0
mov eax, dword [0xbd4acc]
mov esi, str.BlockCustomChildExe
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb27354], 1
push 0xb27354
push str.MonitorWinEventLogs
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5bf0
mov eax, dword [0xb27354]
mov esi, str.MonitorWinEventLogs
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbdd4fc], 0
push 0xbdd4fc
push str.WEvtSendLargeEvents
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5c30
mov eax, dword [0xbdd4fc]
mov esi, str.WEvtSendLargeEvents
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
push 0xbd4ac0
push str.BlockBitLockerEx
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
mov dword [0xbd4abc], 0
push 0xbd4abc
push str.BlockEdgeBrowser
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5c89
mov eax, dword [0xbd4abc]
mov esi, str.BlockEdgeBrowser
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd0660], 0
push 0xbd0660
push str.SecurityPatchEvent
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5cc9
mov eax, dword [0xbd0660]
mov esi, str.SecurityPatchEvent
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3de9c], 1
push 0xb3de9c
push str.BlockNTVDM
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5d09
mov eax, dword [0xb3de9c]
mov esi, str.BlockNTVDM
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4adc], 0
push 0xbd4adc
push str.BlockChromeSettingsResetOnUnload
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5d49
mov eax, dword [0xbd4adc]
mov esi, str.BlockChromeSettingsResetOnUnload
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4ad8], 0
push 0xbd4ad8
push str.BlockChromeSettings
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5d89
mov eax, dword [0xbd4ad8]
mov esi, str.BlockChromeSettings
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
push 1
push 0
mov ecx, dword [0xbd4ad8]
call fcn.008a3370
add esp, 8
mov dword [0xb3dea4], 1
push 0xb3dea4
push str.BlockProgramDataExe
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5ddb
mov eax, dword [0xb3dea4]
mov esi, str.BlockProgramDataExe
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3dea8], 1
push 0xb3dea8
push str.BlockSensitiveOSFileExecution
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5e1b
mov eax, dword [0xb3dea8]
mov esi, str.BlockSensitiveOSFileExecution
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3dea0], 1
push 0xb3dea0
push str.BlockUninstallers
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5e5b
mov eax, dword [0xb3dea0]
mov esi, str.BlockUninstallers
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4ab8], 0
push 0xbd4ab8
push str.DisableDateTimeModification
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5e9b
mov eax, dword [0xbd4ab8]
mov esi, str.DisableDateTimeModification
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3deb0], 1
push 0xb3deb0
push str.SVCHostForceParent
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5edb
mov eax, dword [0xb3deb0]
mov esi, str.SVCHostForceParent
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4ae0], 0
push 0xbd4ae0
push str.SpoolSVAllowAnyParent
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5f1b
mov eax, dword [0xbd4ae0]
mov esi, str.SpoolSVAllowAnyParent
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3deac], 1
push 0xb3deac
push str.SVCHostWhiteListingEnabled
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5f5b
mov eax, dword [0xb3deac]
mov esi, str.SVCHostWhiteListingEnabled
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
push 0xbd0690
push str.AutoDownloadUpdatesOnRestart
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5f9c
xor eax, eax
cmp dword [0xb54194], eax
sete al
mov dword [0xbd0690], eax
mov esi, str.AutoDownloadUpdatesOnRestart
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4a80], 0
push 0xbd4a80
push str.DeleteBrowserCacheOnBrowserStart
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a5fdc
mov eax, dword [0xbd4a80]
mov esi, str.DeleteBrowserCacheOnBrowserStart
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4a7c], 0
push 0xbd4a7c
push str.ScanGZWithoutExtension
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a601c
mov eax, dword [0xbd4a7c]
mov esi, str.ScanGZWithoutExtension
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4974], 0
push 0xbd4974
push str.BlockGMail
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a605c
mov eax, dword [0xbd4974]
mov esi, str.BlockGMail
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
call fcn.00968930
test eax, eax
je 0x8a6277
mov dword [ebp - 0x4424], 0
lea ecx, [ebp - 0x4424]
push ecx
push str.GMSet
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8a609f
cmp dword [ebp - 0x4424], 0
jne 0x8a6277
mov dword [ebp - 0x4428], 0
mov eax, 1
mov dword [ebp - 0x4424], eax
mov esi, str.GMSet
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
push str.SOFTWAREPoliciesMicrosoftMicrosoftEdgeRecovery
lea edx, [ebp - 0x1264]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x4428]
push eax
push str.AutoRecover
lea ecx, [ebp - 0x1264]
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
je 0x8a6103
cmp dword [ebp - 0x4428], 2
je 0x8a611d
mov eax, 2
mov esi, str.AutoRecover
lea ebx, [ebp - 0x1264]
mov ecx, 0x80000002
call fcn.0094be90
mov eax, dword [0xb4c310]
cmp eax, 0xffffffff
jne 0x8a6169
push str.IsWow64Process
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x448c], 0
test esi, esi
je 0x8a615e
lea ecx, [ebp - 0x448c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 0x448c]
mov dword [0xb4c310], eax
test eax, eax
je 0x8a6277
cmp eax, 0xffffffff
jne 0x8a61b8
push str.IsWow64Process
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x4450], 0
test esi, esi
je 0x8a61ad
lea edx, [ebp - 0x4450]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [ebp - 0x4450]
mov dword [0xb4c310], eax
test eax, eax
jne 0x8a61de
lea eax, [ebp - 0x4434]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x1264]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x8a61fb
lea edx, [ebp - 0x4434]
push edx
push 0xf013f
lea eax, [ebp - 0x1264]
push eax
push 0x80000002
call fcn.0097eda0
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x8a6277
mov dword [ebp - 0x44a8], 4
lea ecx, [ebp - 0x44a8]
push ecx
lea edx, [ebp - 0x4428]
push edx
push esi
push esi
push str.AutoRecover
mov eax, dword [ebp - 0x4434]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x8a6241
cmp dword [ebp - 0x4428], 2
je 0x8a626a
mov dword [ebp - 0x4428], 2
push 4
lea ecx, [ebp - 0x4428]
push ecx
push 4
push 0
push str.AutoRecover
mov edx, dword [ebp - 0x4434]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x4434]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0xb54194], 0
je 0x8a62c9
push 0xb3de78
push str.DiskFreeSpaceBelowPercentWarn
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a62b6
mov eax, dword [0xb3de78]
mov esi, str.DiskFreeSpaceBelowPercentWarn
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov eax, 0x64
cmp dword [0xb3de78], eax
jb 0x8a62c9
sub dword [0xb3de78], eax
call fcn.009687b0
test eax, eax
je 0x8a62d9
call fcn.008a3740
jmp 0x8a62f2
push 0xbd486c
push str.PrintScreenDisabled
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
mov dword [0xbd465c], 0
push 0xbd465c
push str.OutlookCacheScanExclude
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a6332
mov eax, dword [0xbd465c]
mov esi, str.OutlookCacheScanExclude
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd444c], 0
push 0xbd444c
push str.DeleteBrowserCache
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a6372
mov eax, dword [0xbd444c]
mov esi, str.DeleteBrowserCache
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4554], 0
push 0xbd4554
push str.IgnoreFNOCache
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a63b2
mov eax, dword [0xbd4554]
mov esi, str.IgnoreFNOCache
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4764], 0
push 0xbd4764
push str.SendAppStartEvent
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a63f2
mov eax, dword [0xbd4764]
mov esi, str.SendAppStartEvent
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [ebp - 0x44b0], 0x103
push str.UnzipPassword
lea eax, [ebp - 0x44b0]
mov edi, 0xbd0540
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c020
test al, al
jne 0x8a6434
push edi
push 0xaa21e4
mov edx, str.UnzipPassword
mov ecx, 0x80000002
call fcn.0094bd00
mov dword [ebp - 0x4474], 1
lea ecx, [ebp - 0x4474]
push ecx
push str.DisableFWDriverOnPause
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a6477
mov eax, dword [ebp - 0x4474]
mov esi, str.DisableFWDriverOnPause
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3de7c], 1
push 0xb3de7c
push str.LogRotate
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a64b7
mov eax, dword [0xb3de7c]
mov esi, str.LogRotate
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xb3de80], 1
push 0xb3de80
push str.DLPEnabled
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a64f7
mov eax, dword [0xb3de80]
mov esi, str.DLPEnabled
mov ebx, str.SoftwareMicroWorldDeviceControl
mov ecx, 0x80000002
call fcn.0094be90
mov ecx, str.GoogleChrome
call fcn.0099c630
mov ecx, str.MicrosoftEdge
call fcn.0099c630
mov ecx, str.Vivaldi
call fcn.0099c630
xor esi, esi
mov dword [0xbd0698], esi
push 0xbd0698
push str.DEBUG
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
mov dword [0xbd4aa4], esi
push 0xbd4aa4
push str.CopyPasteDisabled
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a6572
mov eax, dword [0xbd4aa4]
mov esi, str.CopyPasteDisabled
mov ebx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov ecx, 0x80000002
call fcn.0094be90
mov dword [ebp - 0x4458], 1
lea edx, [ebp - 0x4458]
push edx
push str.CopyPasteDisabledBlockRDPC
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a65b5
mov eax, dword [ebp - 0x4458]
mov esi, str.CopyPasteDisabledBlockRDPC
mov ebx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov ecx, 0x80000002
call fcn.0094be90
mov dword [0xbd4a98], 0
push 0xbd4a98
push str.BlockDriverInstall
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a65f5
mov eax, dword [0xbd4a98]
mov esi, str.BlockDriverInstall
mov ebx, str.SoftwareMicroWorldDeviceControl
mov ecx, 0x80000002
call fcn.0094be90
cmp dword [0xbfc9d0], 0
jne 0x8a661f
mov esi, 1
mov dword [0xbfc9d0], esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x8a661f
cmp al, 6
jb 0x8a661f
mov dword [0xbfc9d4], esi
jmp 0x8a662c
cmp dword [0xbfc9d4], 0
je 0x8a66df
mov dword [0xbd4aac], 0
push 0xbd4aac
push str.BlockHotspot
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a666c
mov eax, dword [0xbd4aac]
mov esi, str.BlockHotspot
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov eax, dword [0xbd4aac]
push eax
xor ecx, ecx
call fcn.0089b200
add esp, 4
cmp dword [0xbd4aac], 0
je 0x8a66df
mov dword [0xbd4a9c], 0
push 0xbd4a9c
push str.BlockSafeMode
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8a671f
mov eax, dword [0xbd4a9c]
mov esi, str.BlockSafeMode
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov eax, dword [0xbd4a9c]
cmp eax, 0xa
je 0x8a676a