Function at 0x8ce3e0
Capabilities:
Check for time delay via gettickcount
Create thread
Manipulate boot configuration
Read .ini file
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xa9c0db
mov eax, dword fs:[0]
push eax
mov eax, 0x185cc
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, edx
xor ebx, ebx
push 0x103
lea edx, [ebp - 0x246f]
push ebx
push edx
mov dword [ebp - 0x183b4], eax
mov dword [ebp - 0x18404], ecx
mov dword [ebp - 0x18400], edi
mov byte [ebp - 0x2470], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea eax, [ebp - 0xdef]
push ebx
push eax
mov byte [ebp - 0xdf0], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x7bb7]
push ebx
push ecx
mov byte [ebp - 0x7bb8], bl
call fcn.00a7ffb0
add esp, 0xc
xor eax, eax
push 0x103
lea edx, [ebp - 0x117]
push ebx
push edx
mov byte [ebp - 0x384], bl
mov dword [ebp - 0x383], eax
mov dword [ebp - 0x37f], eax
mov dword [ebp - 0x37b], eax
mov word [ebp - 0x377], ax
mov byte [ebp - 0x375], al
mov dword [ebp - 0x18448], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183ec], ebx
mov dword [ebp - 0x183d4], ebx
mov dword [ebp - 0x183e0], ebx
mov byte [ebp - 0x118], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x5c07]
push ebx
push eax
mov dword [ebp - 0x18434], ebx
mov dword [ebp - 0x1845c], ebx
mov byte [ebp - 0x5c08], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x7dbf]
push ebx
push ecx
mov byte [ebp - 0x7dc0], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0xbe7]
push ebx
push edx
mov dword [ebp - 0x183dc], ebx
mov dword [ebp - 0x18464], ebx
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183cc], ebx
mov dword [ebp - 0x183c4], ebx
mov dword [ebp - 0x18428], ebx
mov dword [ebp - 0x184d0], ebx
mov byte [ebp - 0xbe8], bl
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x183f8], ebx
mov dword [ebp - 0x184dc], ebx
mov dword [ebp - 0x183e8], ebx
mov byte [ebp - 0x4c8], bl
push 0x103
lea eax, [ebp - 0x4c7]
push ebx
push eax
call fcn.00a7ffb0
add esp, 0xc
cmp dword [0xbd050c], ebx
je 0x8ce5e0
lea ecx, [ebp - 0x183e8]
push ecx
push str.ARetPoint
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
test al, al
jne 0x8ce5d3
mov eax, dword [ebp - 0x183e8]
mov esi, str.ARetPoint
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [ebp - 0x183e8], 2
je 0x8dadf7
cmp byte [str.C:WINDOWS_system32WinLogon.EXE], bl
jne 0x8ce61b
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0xb56938]
mov byte [eax + str.C:WINDOWS_system32WinLogon.EXE], cl
inc eax
cmp cl, bl
jne 0x8ce5f0
mov ecx, str.C:WINDOWS_system32WinLogon.EXE
call fcn.00960910
push str.WinLogon.EXE
push str.C:WINDOWS_system32WinLogon.EXE
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp - 0x183b4]
cmp eax, 4
jbe 0x8cea6d
mov esi, 1
cmp dword [ebp + 0xc], esi
jne 0x8cea6d
push ebx
lea edx, [ebp - 0x384]
push edx
lea ecx, [ebp - 0x7bb8]
push ecx
push 0x208
lea edx, [ebp - 0x2470]
push edx
lea ecx, [ebp - 0xdf0]
push ecx
push eax
call fcn.009bb790
add esp, 0x1c
cmp byte [ebp - 0xdf0], bl
je 0x8ce685
mov eax, str.C:WINDOWS_system32WinLogon.EXE
lea ecx, [ebp - 0xdf0]
call fcn.0094c330
test eax, eax
jne 0x8ce685
mov dword [ebp - 0x18448], esi
mov eax, dword [ebp - 0x183b4]
push esi
push ebx
lea edx, [ebp - 0x2470]
push edx
push eax
mov byte [ebp - 0x2470], bl
call fcn.009bb1b0
mov ecx, dword [ebp - 0x183b4]
add esp, 0x10
cmp ecx, dword [0xbd0694]
jne 0x8ce6b7
mov dword [0xbd0694], ebx
cmp byte [ebp - 0xdf0], bl
je 0x8cea6d
push edi
lea ebx, [ebp - 0xdf0]
call fcn.008cccc0
add esp, 4
cmp dword [edi + 0x83c], 0
jne 0x8ce790
mov eax, dword [edi + 0x854]
cmp eax, 1
je 0x8ce790
mov ecx, dword [edi + 0x838]
test ecx, ecx
jne 0x8ce71d
cmp dword [edi + 0x848], ecx
jne 0x8ce71d
cmp dword [edi + 0x84c], ecx
jne 0x8ce71d
cmp dword [edi + 0x850], ecx
jne 0x8ce71d
cmp eax, 2
je 0x8ce71d
cmp dword [edi + 0x840], ecx
je 0x8ce790
cmp dword [0xbc27fc], 0
je 0x8cea6b
mov edx, dword [edi + 0x840]
push edx
mov edx, dword [edi + 0x84c]
push eax
mov eax, dword [edi + 0x850]
push eax
mov eax, dword [edi + 0x848]
push edx
mov edx, dword [ebp - 0x183b4]
push eax
push ecx
lea ecx, [ebp - 0xdf0]
push ecx
push edx
push str._PROC___u____Not_sending_APP_STOPPED_EVENT_for___s___Win:__u___ES:__u___WApp:__u___UApp:__u___Evl:__u___SYS:__u_
push 0xffffffffffffffff
lea eax, [ebp - 0x14670]
push 0x208
push eax
call fcn.00a78fcb
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x14670]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x40
jmp 0x8cea6b
cmp byte [str.Application_Stopped], 0
jne 0x8ce810
push 0xb55918
push 0x104
push str.Application_Stopped
push str.MailDisp_Stopped
push 0xab91c4
push 0xaaec30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.Application
push str.MailDisp
push str.Application_Stopped
call fcn.0095e130
add esp, 0xc
test eax, eax
jne 0x8ce810
mov eax, dword [0xacc9bc]
mov ecx, dword [0xacc9c0]
mov edx, dword [0xacc9c4]
mov dword [str.Application_Stopped], eax
mov eax, dword [0xacc9c8]
mov dword [0xbf3b34], ecx
mov ecx, dword [0xacc9cc]
mov dword [0xbf3b38], edx
mov dword [0xbf3b3c], eax
mov dword [0xbf3b40], ecx
cmp dword [edi + 0x858], 2
jb 0x8cea6b
lea edx, [ebp - 0xdf0]
push 0x5c
push edx
call fcn.00a7aa50
add esp, 8
test eax, eax
je 0x8ce835
inc eax
jmp 0x8ce83b
lea eax, [ebp - 0xdf0]
cmp byte [edi + 0xa68], 0
lea esi, [edi + 0xa68]
mov dword [ebp - 0x183e4], eax
je 0x8ce8a8
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8ce8a8
cmp dword [0xbc27fc], eax
je 0x8cea6b
mov ecx, dword [ebp - 0x183b4]
push esi
push ecx
push str._PROC___u____NOT_SENDING_APP_STOPPED_EVENT___Parent_and_Current_Process_same___s__
push 0xffffffffffffffff
lea edx, [ebp - 0xea00]
push 0x208
push edx
call fcn.00a78fcb
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0xea00]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
jmp 0x8cea6b
push 0x207
lea edx, [ebp - 0x9947]
push 0
push edx
mov byte [ebp - 0x9948], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x932f]
push 0
push eax
mov byte [ebp - 0x9330], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
xor esi, esi
lea ecx, [ebp - 0x880f]
push esi
push ecx
mov byte [ebp - 0x8810], 0
call fcn.00a7ffb0
xor ebx, ebx
add esp, 0xc
cmp byte [ebp - 0xdf0], 0x5c
mov dword [ebp - 0x184d8], ebx
jne 0x8ce934
cmp byte [ebp - 0xdef], 0x5c
jne 0x8ce934
push ebx
push ebx
push ebx
lea edx, [ebp - 0x8810]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8ce934
lea esi, [ebx + 1]
call fcn.00968110
test eax, eax
je 0x8ce94e
lea edx, [ebp - 0x184d8]
push edx
call fcn.009681c0
add esp, 4
mov ebx, eax
push 0
push 0
push 0
lea eax, [ebp - 0x9330]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xdf0]
push ecx
xor edx, edx
lea ecx, [ebp - 0x9948]
call fcn.0096d300
test ebx, ebx
je 0x8ce990
mov edx, dword [ebp - 0x184d8]
push edx
call fcn.00968240
add esp, 4
cmp esi, 1
jne 0x8ce99b
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp byte [ebp - 0x9948], 0
je 0x8ce9ac
lea esi, [ebp - 0x9948]
jmp 0x8ce9c1
cmp byte [ebp - 0x9330], 0
lea esi, [ebp - 0x9330]
jne 0x8ce9c1
mov esi, dword [ebp - 0x183e4]
mov eax, dword [edi + 0x858]
push eax
lea ecx, [edi + 0x964]
push ecx
mov ecx, dword [ebp - 0x183b4]
lea edx, [edi + 0x860]
push edx
lea eax, [ebp - 0xdf0]
push eax
push ecx
lea edx, [ebp - 0xdbf8]
push str.__u___s___s___s___u_
push edx
call fcn.00a78f30
add esp, 0x1c
push esi
push 0xaa154c
push 0
push str.eScan_Monitor
push 0x6d8
xor eax, eax
lea ecx, [ebp - 0xdbf8]
mov edx, str.Application_Stopped
call fcn.00982dd0
cmp dword [0xbc27fc], 0
je 0x8cea6b
mov ecx, dword [ebp - 0x183b4]
lea eax, [ebp - 0xdbf8]
push eax
push esi
push ecx
push str._PROC___u____APP_STOPPED_EVENT_____s____s
push 0xffffffffffffffff
lea edx, [ebp - 0x10838]
push 0x208
push edx
call fcn.00a78fcb
mov eax, dword [0xbc27fc]
add esp, 0x1c
push 0
push eax
lea ecx, [ebp - 0x10838]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor ebx, ebx
cmp dword [ebp - 0x183e8], 3
je 0x8dadf7
cmp dword [0xb38014], ebx
je 0x8ceaad
cmp dword [0xbd1b04], ebx
je 0x8ceaad
cmp dword [ebp - 0x183b4], ebx
je 0x8ceaad
cmp dword [ebp + 0xc], 1
jne 0x8ceaad
call fcn.00896380
mov ecx, dword [ebp - 0x183b4]
call 0x895050
call fcn.00896390
cmp dword [ebp - 0x183e8], 4
je 0x8dadf7
cmp dword [0xb54184], 9
jae 0x8dadf7
push 0xfff
lea edx, [ebp - 0x398f]
push ebx
push edx
mov byte [ebp - 0x3990], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x6cf]
push ebx
push eax
mov dword [ebp - 0x183b8], ebx
mov dword [ebp - 0x183c0], ebx
mov byte [ebp - 0x6d0], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x8d7]
push ebx
push ecx
mov byte [ebp - 0x8d8], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0x1e47]
push ebx
push edx
mov dword [ebp - 0x1841c], ebx
mov byte [ebp - 0x1e48], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x7697]
push ebx
push eax
mov byte [ebp - 0x7698], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x298f]
push ebx
push ecx
mov dword [ebp - 0x18414], ebx
mov byte [ebp - 0x2990], bl
call fcn.00a7ffb0
add esp, 0xc
xor eax, eax
push 0x207
lea edx, [ebp - 0x357]
push ebx
push edx
mov dword [ebp - 0x184f4], ebx
mov byte [ebp - 0x150], bl
mov dword [ebp - 0x14f], eax
mov dword [ebp - 0x14b], eax
mov dword [ebp - 0x147], eax
mov word [ebp - 0x143], ax
mov byte [ebp - 0x141], al
mov dword [ebp - 0x183f0], ebx
mov byte [ebp - 0x358], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x8d27]
push ebx
push eax
mov byte [ebp - 0x8d28], bl
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x18410], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xb8da58], eax
cmp dword [0xbc27fc], ebx
je 0x8cedb3
push 0x103
lea ecx, [ebp - 0x9df]
push ebx
push ecx
mov byte [ebp - 0x9e0], bl
call fcn.00a7ffb0
mov eax, dword [ebp + 0xc]
mov edx, dword [0xaccadc]
add esp, 0xc
test al, 1
je 0x8cec97
cmp byte [ebp - 0x9e0], bl
je 0x8cec50
lea edi, [ebp - 0x9e0]
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x8cec40
mov dword [edi], edx
mov edi, dword [ebp - 0x18400]
lea eax, [ebp - 0x9e0]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x8cec57
mov ecx, dword [str.FLAGS_NOTIFY_REMOVE_PID]
mov dword [eax], ecx
mov ecx, dword [0xaccae4]
mov dword [eax + 4], ecx
mov ecx, dword [0xaccae8]
mov dword [eax + 8], ecx
mov ecx, dword [0xaccaec]
mov dword [eax + 0xc], ecx
mov ecx, dword [0xaccaf0]
mov dword [eax + 0x10], ecx
mov ecx, dword [0xaccaf4]
mov dword [eax + 0x14], ecx
mov eax, dword [ebp + 0xc]
test al, 2
je 0x8cecde
cmp byte [ebp - 0x9e0], bl
je 0x8cecba
lea edi, [ebp - 0x9e0]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x8cecb0
mov dword [edi], edx
lea edi, [ebp - 0x9e0]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x8cecc1
mov eax, dword [ebp + 0xc]
mov ecx, 7
mov esi, str.FLAGS_NOTIFY_NOT_AUTOBYPASS
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x18400]
test eax, 0x10000
je 0x8ced24
cmp byte [ebp - 0x9e0], bl
je 0x8cecfe
lea edi, [ebp - 0x9e0]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x8cecf4
mov dword [edi], edx
lea edi, [ebp - 0x9e0]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x8ced05
mov eax, dword [ebp + 0xc]
mov ecx, 9
mov esi, str.FLAGS_NOTIFY_EXPLICITLY_REQUEST_REPLY
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [ebp - 0x18400]
cmp byte [ebp - 0x9e0], bl
jne 0x8ced44
push eax
lea edx, [ebp - 0x9e0]
push str.FLAGS_NOTIFY_UNKNOWN__0x_d_
push edx
call fcn.00a78f30
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov esi, dword [ebp - 0x18404]
mov edx, dword [ebp - 0x183b4]
lea ecx, [ebp - 0x9e0]
cmp esi, ebx
je 0x8ced83
cmp word [esi], bx
je 0x8ced79
push esi
push ecx
push eax
push edx
lea eax, [ebp - 0x3990]
push str.___ProcNotify__Pid___ld__dwF___ld___s___Name:_S_
push eax
call fcn.00a78f30
add esp, 0x18
jmp 0x8ced9a
push ecx
push eax
push edx
push str.___ProcNotify__Pid___ld__dwF___ld___s___Name:_BLANK__
jmp 0x8ced8b
push eax
push ecx
push edx
push str.___ProcNotify__Pid___ld__dwF___ld___s___Name:_NULL__
lea eax, [ebp - 0x3990]
push eax
call fcn.00a78f30
add esp, 0x14
push ebx
push 1
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8cedb9
mov esi, dword [ebp - 0x18404]
cmp esi, ebx
je 0x8d9cd8
cmp word [esi], bx
je 0x8d9cd8
cmp dword [ebp - 0x183b4], ebx
je 0x8d9cd8
push esi
lea ebx, [ebp - 0x183b8]
call fcn.00970520
add esp, 4
cmp eax, 1
jne 0x8d856a
mov esi, dword [ebp - 0x183b8]
test esi, esi
je 0x8d9cd6
cmp byte [esi], 0
je 0x8d856a
cmp dword [0xbd4764], 0
je 0x8cf1e1
mov eax, dword [ebp - 0x183b4]
cmp eax, 4
jbe 0x8cf1e7
cmp dword [ebp + 0xc], 1
je 0x8cf1e7
cmp dword [edi + 0x83c], 0
mov dword [ebp - 0x18418], eax
jne 0x8cee8f
mov eax, dword [edi + 0x854]
cmp eax, 1
je 0x8cee8f
cmp dword [edi + 0x838], 0
jne 0x8cf1e7
cmp dword [edi + 0x848], 0
jne 0x8cf1e7
cmp dword [edi + 0x84c], 0
jne 0x8cf1e7
cmp dword [edi + 0x850], 0
jne 0x8cf1e7
cmp eax, 2
je 0x8cf1e7
cmp dword [edi + 0x840], 0
jne 0x8cf1e7
cmp byte [0xbf3c38], 0
jne 0x8cef0f
push 0xb55918
push 0x104
push 0xbf3c38
push str.MailDisp_Started
push 0xaccc14
push 0xaaec30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push str.Application
push str.MailDisp
push 0xbf3c38
call fcn.0095e130
add esp, 0xc
test eax, eax
jne 0x8cef0f
mov edx, dword [str.Application_Started]
mov eax, dword [0xaccc1c]
mov ecx, dword [0xaccc20]
mov dword [0xbf3c38], edx
mov edx, dword [0xaccc24]
mov dword [0xbf3c3c], eax
mov eax, dword [0xaccc28]
mov dword [0xbf3c40], ecx
mov dword [0xbf3c44], edx
mov dword [0xbf3c48], eax
mov ebx, dword [ebp - 0x183b8]
push 0x5c
push ebx
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
je 0x8cef2f
inc esi
mov dword [ebp - 0x18404], esi
jmp 0x8cef37
mov esi, ebx
mov dword [ebp - 0x18404], ebx
mov edx, dword [ebp - 0x18418]
xor ecx, ecx
call fcn.0097ceb0
mov dword [edi + 0x85c], eax
cmp eax, 4
jbe 0x8cefc8
push 0x207
lea ecx, [ebp - 0xa35f]
push 0
push ecx
mov byte [ebp - 0xa360], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0xd5ef]
push 0
push edx
mov byte [ebp - 0xd5f0], 0
call fcn.00a7ffb0
mov eax, dword [edi + 0x85c]
add esp, 0xc
push eax
lea ecx, [ebp - 0xd5f0]
lea ebx, [ebp - 0xa360]
call fcn.0097b130
cmp byte [ebp - 0xa360], 0
je 0x8cefc8
mov eax, ebx
push eax
push 0xaa1544
push 0xffffffffffffffff
lea ecx, [edi + 0xa68]
push 0x104
push ecx
call fcn.00a78fcb
add esp, 0x14
cmp byte [edi + 0xa68], 0
lea ebx, [edi + 0xa68]
je 0x8cf032
mov eax, esi
mov ecx, ebx
call fcn.0094c330
test eax, eax
jne 0x8cf032
cmp dword [0xbc27fc], eax
je 0x8cf1e1
mov edx, dword [ebp - 0x183b4]
push ebx
push edx
push str._PROC___u____NOT_SENDING_APP_STARTED_EVENT___Parent_and_Current_Process_same___s__
push 0xffffffffffffffff
lea eax, [ebp - 0xfc28]
push 0x208
push eax
call fcn.00a78fcb
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0xfc28]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
jmp 0x8cf1e1
push 0x207
lea eax, [ebp - 0x9537]
push 0
push eax
mov byte [ebp - 0x9538], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x973f]
push 0
push ecx
mov byte [ebp - 0x9740], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
xor esi, esi
lea edx, [ebp - 0x7fcf]
push esi
push edx
mov byte [ebp - 0x7fd0], 0
call fcn.00a7ffb0
xor ebx, ebx
add esp, 0xc
cmp byte [ebp - 0xdf0], 0x5c
mov dword [ebp - 0x1849c], ebx
jne 0x8cf0be
cmp byte [ebp - 0xdef], 0x5c
jne 0x8cf0be
push ebx
push ebx
push ebx
lea edx, [ebp - 0x7fd0]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8cf0be
lea esi, [ebx + 1]
call fcn.00968110
test eax, eax
je 0x8cf0d8
lea eax, [ebp - 0x1849c]
push eax
call fcn.009681c0
add esp, 4
mov ebx, eax
mov edx, dword [ebp - 0x183b8]
push 0
push 0
push 0
lea ecx, [ebp - 0x9740]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
xor edx, edx
lea ecx, [ebp - 0x9538]
call fcn.0096d300
test ebx, ebx
je 0x8cf11a
mov eax, dword [ebp - 0x1849c]
push eax
call fcn.00968240
add esp, 4
cmp esi, 1
jne 0x8cf125
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp byte [ebp - 0x9538], 0
je 0x8cf136
lea ebx, [ebp - 0x9538]
jmp 0x8cf14b
cmp byte [ebp - 0x9740], 0
lea ebx, [ebp - 0x9740]
jne 0x8cf14b
mov ebx, dword [ebp - 0x18404]
mov edx, dword [ebp - 0x183b4]
lea ecx, [ebp - 0xdf0]
push ecx
push edx
lea eax, [ebp - 0xd3e8]
push str.__u___s_
push eax
call fcn.00a78f30
add esp, 0x10
push ebx
push 0xaa154c
push 0
push str.eScan_Monitor
push 0x6d7
xor eax, eax
lea ecx, [ebp - 0xd3e8]
mov edx, 0xbf3c38
call fcn.00982dd0
cmp dword [0xbc27fc], 0
je 0x8cf1e1
mov edx, dword [ebp - 0x183b4]
lea ecx, [ebp - 0xd3e8]
push ecx
push ebx
push edx
push str._PROC___u____APP_STARTED_EVENT_____s____s
push 0xffffffffffffffff
lea eax, [ebp - 0x13a60]
push 0x208
push eax
call fcn.00a78fcb
mov ecx, dword [0xbc27fc]
add esp, 0x1c
push 0
push ecx
lea edx, [ebp - 0x13a60]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov esi, dword [ebp - 0x183b8]
mov ebx, dword [ebp - 0x183e8]
xor eax, eax
mov dword [ebp - 0x183e4], eax
mov dword [ebp - 0x183d8], eax
mov dword [ebp - 0x1840c], eax
cmp ebx, 5
je 0x8dadf7
cmp dword [ebp + 0xc], 1
mov ecx, dword [edi + 0x834]
mov dword [ebp - 0x18404], ecx
je 0x8cf2e9
cmp dword [ebp - 0x183b4], 4
jbe 0x8cf2e9
push 0x207
push eax
lea edx, [ebp - 0x9b4f]
push edx
mov byte [ebp - 0x9b50], al
call fcn.00a7ffb0
add esp, 0xc
cmp ebx, 6
je 0x8dadf7
lea ebx, [ebp - 0x183f8]
mov ecx, esi
call fcn.008cdc80
cmp dword [ebp - 0x183e8], 7
je 0x8dadf7
push 0x7e
push esi
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8cf295
mov esi, dword [ebp - 0x183b8]
push 0x208
lea ebx, [ebp - 0x9b50]
call fcn.00957fa0
add esp, 4
jmp 0x8cf2aa
lea edx, [ebp - 0x9b50]
mov eax, esi
sub edx, esi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x8cf2a0
push 0
lea eax, [ebp - 0x150]
push eax
lea ecx, [ebp - 0x18414]
push ecx
mov ecx, dword [ebp - 0x183b4]
lea edx, [ebp - 0x2470]
push edx
lea eax, [ebp - 0x9b50]
push eax
push ecx
lea edx, [ebp - 0x184f4]
lea ecx, [ebp - 0x2990]
call fcn.009ba450
mov ebx, dword [ebp - 0x183e8]
add esp, 0x18
cmp ebx, 8
je 0x8dadf7
mov edi, dword [ebp - 0x183b8]
push 0x5c
push edi
call fcn.00a7aa50
mov esi, eax
add esp, 8
lea edx, [ebp - 0x358]
test esi, esi
je 0x8cf339
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc esi
push esi
push edx
call edi
mov eax, dword [ebp - 0x183b8]
mov bl, byte [esi]
push eax
lea ecx, [ebp - 0x8d28]
push ecx
mov byte [esi], 0
call edi
mov edi, dword [ebp - 0x183b8]
mov byte [esi], bl
jmp 0x8cf341
push edi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x358]
push 0x2e
push eax
call fcn.00a7aa50
add esp, 8
mov dword [ebp - 0x18410], eax
test eax, eax
je 0x8cf363
inc eax
mov dword [ebp - 0x18410], eax
cmp dword [ebp + 0xc], 1
je 0x8cf398
cmp dword [ebp - 0x183b4], 4
jbe 0x8cf398
cmp dword [ebp - 0x183f8], 0
jbe 0x8cf398
mov ebx, dword [ebp - 0x183f8]
lea esi, [ebp - 0x4c8]
lea edi, [ebp - 0x358]
call fcn.008ce280
mov edi, dword [ebp - 0x183b8]
xor eax, eax
cmp dword [ebp - 0x183e8], 9
je 0x8dadf9
mov byte [ebp - 0x140], al
mov dword [ebp - 0x13f], eax
mov dword [ebp - 0x13b], eax
mov byte [ebp - 0x137], al
cmp byte [ebp - 0x150], al
jne 0x8cf3f0
mov eax, dword [ebp - 0x183b4]
lea ecx, [ebp - 0x184f4]
push ecx
lea edx, [ebp - 0x18414]
push edx
push eax
lea edx, [ebp - 0x150]
lea ecx, [ebp - 0x2990]
call fcn.009b8130
add esp, 0xc
cmp dword [ebp - 0x183e8], 0xa
je 0x8dadf7
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
cmp dword [0xb56800], 0
mov esi, eax
mov dword [ebp - 0x183c0], esi
je 0x8cf5c9
mov edx, dword [ebp - 0x183b4]
lea ecx, [ebp - 0x184a4]
push ecx
push edx
mov dword [ebp - 0x184a4], 0
call fcn.00968090
add esp, 8
test eax, eax
je 0x8cf5c9
mov eax, dword [ebp - 0x184a4]
neg eax
sbb eax, eax
and eax, 0x20300
add eax, 0x323378
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x18414]
lea edx, [ebp - 0x2990]
push edx
push eax
mov eax, dword [ebp - 0x183b4]
lea ecx, [ebp - 0x150]
push ecx
push esi
push eax
push edi
lea edx, [ebp - 0x140]
push edx
push eax
lea eax, [ebp - 0x3990]
push str._CPL______d__New_Process__s___s:_u__ppid:_u____s:_d___s_
push eax
call fcn.00a78f30
add esp, 0x28
push 0
push 1
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0x183e8], 0xb
je 0x8dadf7
cmp dword [0xbd04f4], 0
jne 0x8cf82c
mov eax, dword [0xbd444c]
mov edi, 0x200
test edi, eax
jne 0x8cf4f0
test eax, eax
je 0x8cf7e9
cmp dword [0xbd4a80], 0
je 0x8cf7e9
mov eax, str.chrome.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8cf691
cmp byte [str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefault], al
je 0x8cf691
mov ecx, str.C:UsersAdministratorAppDataLocalGoogleChromeUser_DataDefault
call fcn.0095a450
test eax, eax
je 0x8cf691
push 0x8000
mov ebx, 1
call fcn.00a7a155
mov esi, eax
add esp, 4
test esi, esi
je 0x8cf58e
mov byte [esi], 0
mov edx, dword [ebp - 0x183b4]
push edx
mov ecx, esi
call fcn.0097b4b0
test eax, eax
jne 0x8cf561
push 8
call fcn.0089abe0
add esp, 4
test eax, eax
je 0x8cf57d
cmp byte [esi], 0
je 0x8cf57d
push 0
push str._type
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8cf57d
xor ebx, ebx
push esi
call fcn.00a78fec
add esp, 4
test ebx, ebx
je 0x8cf691
test dword [0xbd444c], edi
je 0x8cf620
mov eax, dword [ebp - 0x183b4]
push eax
xor ecx, ecx
call fcn.0098c0a0
add esp, 4
test eax, eax
je 0x8cf60e
mov edx, dword [ebp - 0x183b4]
lea ecx, [ebp - 0x18468]
push ecx
push 0
push edx
push 0x8fa600
jmp 0x8cf657
cmp byte [ebp - 0x140], 0
jne 0x8cf461
mov edx, dword [ebp - 0x18414]
lea ecx, [ebp - 0x2990]
push ecx
push edx
lea eax, [ebp - 0x150]
push eax
mov eax, dword [ebp - 0x183b4]
push esi
push eax
push edi
push eax
lea ecx, [ebp - 0x3990]
push str._CPL______d__New_Process___s:_u__ppid:_u____s:_d___s_
push ecx
call fcn.00a78f30
add esp, 0x24
jmp 0x8cf49b
lea eax, [ebp - 0x18468]
push eax
push 0
push 0
push 0x8fa600
jmp 0x8cf657
mov ecx, dword [ebp - 0x183b4]
push ecx
xor ecx, ecx
call fcn.0098c0a0
add esp, 4
test eax, eax
je 0x8cf647
mov eax, dword [ebp - 0x183b4]
lea edx, [ebp - 0x18468]
push edx
push 0
push eax
jmp 0x8cf652
lea ecx, [ebp - 0x18468]
push ecx
push 0
push 0
push 0x8fa9f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x183fc], eax
test eax, eax
je 0x8cf691
push 0
test dword [0xbd444c], edi
je 0x8cf679
push 0x64
jmp 0x8cf67e
push 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lea edx, [ebp - 0x183fc]
push edx
call fcn.00985290
mov eax, str.dsNcService.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8cf6cd
mov eax, str.PulseSetupClient.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8cf6cd
mov eax, str.dsNetworkConnect.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8cf6e0
cmp dword [0xbd17ac], 0
je 0x8cf6e0
mov esi, 2
call fcn.008abf40
cmp dword [0xbd444c], 0
je 0x8cf7e9
cmp dword [0xbd4a80], 0
je 0x8cf7e9
mov eax, str.firefox.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8cf7e9
mov eax, dword [0xbd0b28]
cmp byte [eax], 0
je 0x8cf7e9
push 0x8000
mov ebx, 1
call fcn.00a7a155
mov esi, eax
add esp, 4
test esi, esi
je 0x8cf784
mov byte [esi], 0
mov ecx, dword [ebp - 0x183b4]
push ecx
mov ecx, esi
call fcn.0097b4b0
test eax, eax
jne 0x8cf75b
push 0x10
call fcn.0089abe0
add esp, 4
test eax, eax
je 0x8cf777
cmp byte [esi], 0
je 0x8cf777
push 0
push str._contentproc
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8cf777
xor ebx, ebx
push esi
call fcn.00a78fec
add esp, 4
test ebx, ebx
je 0x8cf7e9
mov edx, dword [ebp - 0x183b4]
push edx
xor ecx, ecx
call fcn.0098c0a0
add esp, 4
test eax, eax
je 0x8cf7ab
mov ecx, dword [ebp - 0x183b4]
lea eax, [ebp - 0x18538]
push eax
push 0
push ecx
jmp 0x8cf7b6
lea edx, [ebp - 0x18538]
push edx
push 0
push 0
push 0x8fa9f0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x18484], eax
test eax, eax
je 0x8cf7e9
push 0
push 0xfa
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
lea eax, [ebp - 0x18484]
push eax
call fcn.00985290
cmp dword [0xbd4ad8], 0
je 0x8cf82c
mov eax, str.chrome.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8cf81a
mov eax, str.firefox.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8cf82c
mov ecx, dword [0xbd4ad8]
push 4
push 0
call fcn.008a3370
add esp, 8
cmp dword [ebp - 0x183e8], 0xc
je 0x8dadf7
cmp dword [0xb5680c], 0
je 0x8cf9a6
cmp dword [0xbd04f4], 0
jne 0x8cf9a6
mov eax, str.WWAHost.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8cf89c
mov eax, str.Solitaire.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8cf89c
mov edi, dword [ebp - 0x183b8]
push 0
push 0xacc4ac
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8cf9ac
jmp 0x8cf8a2
mov edi, dword [ebp - 0x183b8]
push 0x103
lea ecx, [ebp - 0x1a2f]
push 0
push ecx
mov byte [ebp - 0x1a30], 0
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x184ac]
lea ecx, [ebp - 0x1a30]
mov dword [ebp - 0x184ac], 1
call fcn.008caee0
cmp eax, 1
jne 0x8cf9ac
cmp dword [ebp - 0x184ac], 0
jne 0x8cf9ac
cmp byte [ebp - 0x1a30], 0
je 0x8cf9ac
mov esi, str.Enabled
lea ebx, [ebp - 0x1a30]
mov ecx, 0x80000002
call fcn.0094be90
mov edx, ebx
push edx
push 0
push 0x8cadb0
call fcn.00a791b2
add esp, 0xc
mov esi, eax
push str.CBD_7d
xor ebx, ebx
call fcn.0085df20
add esp, 4
cmp esi, 0xffffffff
jne 0x8cf98f
push 0x103
lea eax, [ebp - 0x5d0f]
push ebx
push eax
mov byte [ebp - 0x5d10], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_x__fails_with_error__d
push esi
lea ecx, [ebp - 0x5d10]
push 0x104
push ecx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea edx, [ebp - 0x5d10]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8cf9ac
cmp byte [ebp - 0x1a30], bl
je 0x8cf9ac
call fcn.0094d150
cmp byte [ebp - 0x1a30], bl
jne 0x8cf997
jmp 0x8cf9ac
mov edi, dword [ebp - 0x183b8]
cmp dword [ebp - 0x183e8], 0xd
je 0x8dadf7
mov eax, str.userinit.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8cf9d9
mov dword [0xb8daf8], 1
jmp 0x8cfa17
mov eax, str.zwsreg.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8cf9f9
mov dword [0xb8dafc], 1
jmp 0x8cfa17
mov eax, str.eEmpty.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8cfa17
mov dword [0xbd0b14], 1
cmp dword [0xb8db04], 0
jne 0x8cfa2d
cmp dword [0xb8db0c], 0
je 0x8cff70
mov esi, dword [ebp - 0x183c0]
mov eax, dword [ebp - 0x183b4]
push esi
push eax
lea ebx, [ebp - 0x1844c]
mov ecx, edi
mov dword [ebp - 0x1844c], 0
call fcn.008c1d40
add esp, 8
mov dword [ebp - 0x183d8], eax
test eax, eax
je 0x8cff70
push 0
push str.MicroWorld_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8cfaa1
push 0
push 0xaccdf4
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8cfaa1
mov eax, str.reload.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8cfaab
mov dword [ebp - 0x183e4], 1
cmp esi, 4
jbe 0x8cfba1
mov eax, str.download.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8cfba1
mov ecx, dword [ebp - 0x183b4]
mov dword [0xbd0694], ecx
cmp byte [ebp - 0x6d0], al
jne 0x8cfafb
push esi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
cmp byte [ebp - 0x6d0], 0
je 0x8cfb56
push 0
lea edx, [ebp - 0x6d0]
push str.trayico
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8cfb56
cmp dword [0xbc27fc], 0
mov eax, dword [ebp - 0x183b4]
mov dword [0xbd0688], eax
je 0x8cfba1
lea ecx, [ebp - 0x6d0]
push ecx
lea edx, [ebp - 0x3990]
push str._eScan_Download__Manual_eScan_Update_Download_Detected__P:_s_...
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x3990]
push ecx
jmp 0x8cfb94
cmp dword [0xbc27fc], 0
mov dword [0xbd0688], 0
je 0x8cfba1
lea edx, [ebp - 0x6d0]
push edx
lea eax, [ebp - 0x3990]
push str._eScan_Download__Automatic_eScan_Update_Download_Detected__P:_s_...
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x3990]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb56828], 0
je 0x8cfbd5
cmp dword [0xb54190], 0
je 0x8cfbd5
cmp dword [0xb5682c], 0
jne 0x8cfbd5
mov eax, dword [ebp - 0x183b4]
push eax
call 0x9aa990
add esp, 4
mov dword [ebp - 0x1840c], 1
mov eax, dword [ebp - 0x183b4]
cdq
push edx
push eax
push 0
push 0x2000708
call dword [0xb8dac4]
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x8cfcf4
push 0x103
lea ecx, [ebp - 0x3fb7]
push 0
push ecx
mov byte [ebp - 0x3fb8], 0
call fcn.00a7ffb0
add esp, 0xc
push esi
lea edx, [ebp - 0x3fb8]
call fcn.008aaa40
mov edx, dword [ebp - 0x183b4]
add esp, 4
cmp byte [ebp - 0x3fb8], 0
jne 0x8cfc50
mov ebx, dword [ebp - 0x183d8]
push esi
push edx
push edi
push ebx
lea eax, [ebp - 0x3990]
push str.____u__Failed_To_Add_New_Process_To_PFACC___s:_u_._Reason:_0x_x
push eax
call fcn.00a78f30
jmp 0x8cfc77
mov eax, dword [ebp - 0x183d8]
lea ecx, [ebp - 0x3fb8]
push ecx
push edx
push edi
push eax
lea ecx, [ebp - 0x3990]
push str.____u__Failed_To_Add_New_Process_To_PFACC___s:_u_._Reason:__s
push ecx
call fcn.00a78f30
mov ebx, dword [ebp - 0x183d8]
add esp, 0x18
push 0
push 1
lea edx, [ebp - 0x3990]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp esi, 0xc0000001
jne 0x8cfd65
lea eax, [ebp - 0x3990]
push str.___Removing_Self_Protection_of_process_as_count_exceeded.
push eax
call fcn.00a78f30
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
push esi
push 2
push esi
push 0x2000501
call dword [0xb8dac4]
push esi
push 2
push esi
push 0x2000601
call dword [0xb8dac4]
add esp, 0x38
mov dword [0xb8db0c], esi
mov dword [0xb8db04], esi
jmp 0x8cfd65
mov eax, str.test2.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8cfd17
mov edx, dword [ebp - 0x183b4]
push edx
call fcn.009b76f0
add esp, 4
mov eax, dword [ebp - 0x183e4]
push eax
call fcn.009b7930
mov ecx, dword [ebp - 0x183b4]
mov edx, dword [ebp - 0x183d8]
push eax
push ecx
push edi
push edx
lea eax, [ebp - 0x3990]
push str.____u__New_Process_Added_To_PFACC___s:_u___PidC___u__ESP:_u_
push eax
call fcn.00a78f30
add esp, 0x1c
push 0
push 1
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
mov ebx, dword [ebp - 0x183d8]
add esp, 0x10
mov eax, dword [ebp - 0x183b4]
cdq
push edx
push eax
push 0
push 0x2000702
call dword [0xb8dac4]
mov esi, eax
add esp, 0x10
test esi, esi
jge 0x8cfdf3
push 0x103
lea edx, [ebp - 0x43d7]
push 0
push edx
mov byte [ebp - 0x43d8], 0
call fcn.00a7ffb0
add esp, 0xc
push esi
lea edx, [ebp - 0x43d8]
call fcn.008aaa40
mov eax, dword [ebp - 0x183b4]
add esp, 4
cmp byte [ebp - 0x43d8], 0
lea ecx, [ebp - 0x3990]
jne 0x8cfdd9
push esi
push eax
push edi
push ebx
push str.____u__Failed_To_Add_New_Process_To_PRACC___s:_d_._Reason:_0x_x
push ecx
call fcn.00a78f30
add esp, 0x18
jmp 0x8cfe10
lea edx, [ebp - 0x43d8]
push edx
push eax
push edi
push ebx
push str.____u__Failed_To_Add_New_Process_To_PRACC___s:_d_._Reason:__s
push ecx
call fcn.00a78f30
add esp, 0x18
jmp 0x8cfe10
mov eax, dword [ebp - 0x183b4]
push eax
push edi
push ebx
lea ecx, [ebp - 0x3990]
push str.____u__New_Process_Added_To_PRACC___s:_d_
push ecx
call fcn.00a78f30
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x3990]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0x183b4], 0
jbe 0x8cff70
cmp dword [0xb3dd9c], 2
jne 0x8cff34
mov eax, dword [0xb3dd94]
dec eax
cmp eax, 0x61
ja 0x8cff34
mov eax, str.mwavscan.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8cfe7d
mov eax, str.mexe.com
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8cff34
mov ecx, dword [0xb3dd94]
mov edx, dword [ebp - 0x183b4]
push ecx
push edx
push edi
lea eax, [ebp - 0x3990]
push str.___Limit_CPU_For_this_process___s:_u__to__u__
push eax
call fcn.00a78f30
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
mov edx, dword [ebp - 0x183b4]
push edx
push 0
push 0x8cbcf0
call fcn.00a791b2
add esp, 0x1c
mov esi, eax
push str.CBD_7eP
xor ebx, ebx
call fcn.0085df20
add esp, 4
cmp esi, 0xffffffff
jne 0x8cff34
push 0x103
lea eax, [ebp - 0x6e87]
push ebx
push eax
mov byte [ebp - 0x6e88], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_y__fails_with_error__d
push esi
lea ecx, [ebp - 0x6e88]
push 0x104
push ecx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea edx, [ebp - 0x6e88]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0x1844c], 0
jne 0x8cff70
push 0x103
lea eax, [ebp - 0x85ff]
push 0
push eax
mov byte [ebp - 0x8600], 0
call fcn.00a7ffb0
mov edx, dword [ebp - 0x183b4]
add esp, 0xc
lea ecx, [ebp - 0x8600]
push ecx
push edx
call fcn.009b79f0
add esp, 8
mov ebx, 0xe
mov esi, 1
cmp dword [ebp - 0x183e8], ebx
je 0x8dadf7
cmp byte [ebp - 0x358], 0
je 0x8d8478
xor eax, eax
mov dword [ebp - 0x183d0], eax
mov dword [ebp - 0x18414], eax
mov dword [ebp - 0x1844c], eax
mov eax, str.SetupHost.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d0b36
push eax
push str._Windows.BT
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d0b36
call fcn.00968790
test eax, eax
jne 0x8d1033
push 0x103
push eax
mov byte [ebp - 0x1718], al
lea eax, [ebp - 0x1717]
push eax
mov dword [ebp - 0x184e4], 0xffffffff
call fcn.00a7ffb0
add esp, 0xc
mov esi, str.WinOSValueA
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0095f910
lea ecx, [ebp - 0x184e4]
push ecx
push str.WinOSValueB
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
call fcn.00968930
test eax, eax
je 0x8d004b
lea esi, [ebx - 9]
push str.Windows_10_or_above
jmp 0x8d008d
call fcn.00968840
test eax, eax
je 0x8d0067
push str.Windows_Blue__8.1_
lea eax, [ebp - 0x1718]
mov esi, 4
push eax
jmp 0x8d0094
call fcn.009687b0
test eax, eax
je 0x8d0083
push str.Windows_8
lea ecx, [ebp - 0x1718]
mov esi, 2
push ecx
jmp 0x8d0094
mov esi, 1
push str.Windows_7_or_below
lea edx, [ebp - 0x1718]
push edx
mov dword [ebp - 0x183fc], esi
call fcn.00a78f30
mov eax, dword [ebp - 0x184e4]
add esp, 8
cmp eax, 0xffffffff
je 0x8d05ac
cmp eax, esi
je 0x8d0b12
lea eax, [ebp - 0x1718]
push eax
push str._UPGR__OS_Upgrade_Finished__New_OS___s_
push 0xffffffffffffffff
lea ecx, [ebp - 0x6a70]
push 0x208
push ecx
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x6a70]
push edx
push 0xb54ce8
call fcn.008808e0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x10
push 0xb55508
lea eax, [ebp - 0x1610]
push eax
call ebx
lea ecx, [ebp - 0x1610]
call fcn.00960910
push 0xb55508
lea ecx, [ebp - 0x1200]
push ecx
call ebx
lea ecx, [ebp - 0x1200]
call fcn.00960910
cmp dword [0xb56800], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x8d0158
push str.procobsrvesx.s_s
lea edx, [ebp - 0x1610]
push edx
call esi
push str.procobsrvesx.sys
lea eax, [ebp - 0x1200]
push eax
call esi
jmp 0x8d017a
push str.procobsrves.s_s
lea ecx, [ebp - 0x1610]
push ecx
call esi
push str.procobsrves.sys
lea edx, [ebp - 0x1200]
push edx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0x1610]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d01ba
lea eax, [ebp - 0x1200]
call fcn.0094dd20
lea edi, [ebp - 0x1200]
lea ebx, [ebp - 0x1610]
call fcn.009626c0
mov edi, dword [ebp - 0x183b8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xb55508
lea eax, [ebp - 0x1610]
push eax
call ebx
lea ecx, [ebp - 0x1610]
call fcn.00960910
lea eax, [ebp - 0x1610]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d01e0
mov ecx, dword [str.vdb32_avpmapp.e_e]
mov edx, dword [0xacd1b0]
mov dword [eax], ecx
mov ecx, dword [0xacd1b4]
mov dword [eax + 4], edx
mov edx, dword [0xacd1b8]
mov dword [eax + 8], ecx
mov cx, word [0xacd1bc]
mov dword [eax + 0xc], edx
push 0xb55508
lea edx, [ebp - 0x1200]
push edx
mov word [eax + 0x10], cx
call ebx
lea ecx, [ebp - 0x1200]
call fcn.00960910
lea eax, [ebp - 0x1200]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d0236
mov ecx, dword [str.vdb32_avpmapp.exe]
mov edx, dword [0xacd1c4]
mov dword [eax], ecx
mov ecx, dword [0xacd1c8]
mov dword [eax + 4], edx
mov edx, dword [0xacd1cc]
mov dword [eax + 8], ecx
mov cx, word [0xacd1d0]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0x1610]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d02ac
lea eax, [ebp - 0x1200]
call fcn.0094dd20
lea edi, [ebp - 0x1200]
lea ebx, [ebp - 0x1610]
call fcn.009626c0
mov edi, dword [ebp - 0x183b8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xb55508
lea edx, [ebp - 0x1610]
push edx
call ebx
lea ecx, [ebp - 0x1610]
call fcn.00960910
lea eax, [ebp - 0x1610]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d02d0
mov ecx, dword [str.vdb64_avpmapp.e_e]
mov edx, dword [0xacd1d8]
mov dword [eax], ecx
mov ecx, dword [0xacd1dc]
mov dword [eax + 4], edx
mov edx, dword [0xacd1e0]
mov dword [eax + 8], ecx
mov cx, word [0xacd1e4]
mov dword [eax + 0xc], edx
push 0xb55508
lea edx, [ebp - 0x1200]
push edx
mov word [eax + 0x10], cx
call ebx
lea ecx, [ebp - 0x1200]
call fcn.00960910
lea eax, [ebp - 0x1200]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d0326
mov ecx, dword [str.vdb64_avpmapp.exe]
mov edx, dword [0xacd1ec]
mov dword [eax], ecx
mov ecx, dword [0xacd1f0]
mov dword [eax + 4], edx
mov edx, dword [0xacd1f4]
mov dword [eax + 8], ecx
mov cx, word [0xacd1f8]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0x1610]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d039c
lea eax, [ebp - 0x1200]
call fcn.0094dd20
lea edi, [ebp - 0x1200]
lea ebx, [ebp - 0x1610]
call fcn.009626c0
mov edi, dword [ebp - 0x183b8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xb55508
lea edx, [ebp - 0x1610]
push edx
call ebx
lea ecx, [ebp - 0x1610]
call fcn.00960910
lea eax, [ebp - 0x1610]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d03c0
mov ecx, dword [str.vista_avpmapp.e_e]
mov edx, dword [0xacd200]
mov dword [eax], ecx
mov ecx, dword [0xacd204]
mov dword [eax + 4], edx
mov edx, dword [0xacd208]
mov dword [eax + 8], ecx
mov cx, word [0xacd20c]
mov dword [eax + 0xc], edx
push 0xb55508
lea edx, [ebp - 0x1200]
push edx
mov word [eax + 0x10], cx
call ebx
lea ecx, [ebp - 0x1200]
call fcn.00960910
lea eax, [ebp - 0x1200]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d0416
mov ecx, dword [str.vista_avpmapp.exe]
mov edx, dword [0xacd214]
mov dword [eax], ecx
mov ecx, dword [0xacd218]
mov dword [eax + 4], edx
mov edx, dword [0xacd21c]
mov dword [eax + 8], ecx
mov cx, word [0xacd220]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0x1610]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d048c
lea eax, [ebp - 0x1200]
call fcn.0094dd20
lea edi, [ebp - 0x1200]
lea ebx, [ebp - 0x1610]
call fcn.009626c0
mov edi, dword [ebp - 0x183b8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xb55508
lea edx, [ebp - 0x2368]
push edx
call ebx
lea ecx, [ebp - 0x2368]
call fcn.00960910
push str.templateeConceal.reg
lea eax, [ebp - 0x2368]
push eax
call esi
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0x2368]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d0574
xor esi, esi
mov dword [ebp - 0x184bc], esi
call fcn.00968110
test eax, eax
je 0x8d04f1
lea ecx, [ebp - 0x184bc]
push ecx
call fcn.009681c0
add esp, 4
mov esi, eax
lea edx, [ebp - 0x2368]
push edx
push str.regedit.exe__S___s_
push 0xffffffffffffffff
lea eax, [ebp - 0x6a70]
push 0x208
push eax
call fcn.00a78fcb
add esp, 0x14
push 0
lea ecx, [ebp - 0x6a70]
push 0
push ecx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
call fcn.0095dfe0
add esp, 0xc
mov ebx, eax
test esi, esi
je 0x8d0542
mov edx, dword [ebp - 0x184bc]
push edx
call fcn.00968240
add esp, 4
push ebx
lea eax, [ebp - 0x6a70]
push str._UPGR__Successfully_imported_eConceal_key___u_
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x6a70]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d0b12
lea edx, [ebp - 0x2368]
push edx
lea eax, [ebp - 0x6a70]
push str._UPGR__Unable_to_find__s__Not_importing_eConceal_key.
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x6a70]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d0b12
lea eax, [ebp - 0x3b98]
cmp esi, 5
jae 0x8d0aef
lea edx, [ebp - 0x1718]
push edx
push str._UPGR__OS_Upgrade_Detected__Curr_OS___s_
push 0xffffffffffffffff
push 0x208
push eax
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x3b98]
push ecx
push 0xb54ce8
call fcn.008808e0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 0x10
push 0xb55508
lea edx, [ebp - 0xff8]
push edx
call ebx
lea ecx, [ebp - 0xff8]
call fcn.00960910
push 0xb55508
lea eax, [ebp - 0x1408]
push eax
call ebx
lea ecx, [ebp - 0x1408]
call fcn.00960910
cmp dword [0xb56800], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x8d0654
push str.procobsrvesx.sys
lea ecx, [ebp - 0xff8]
push ecx
call esi
push str.procobsrvesx.s_s
lea edx, [ebp - 0x1408]
push edx
call esi
jmp 0x8d0676
push str.procobsrves.sys
lea eax, [ebp - 0xff8]
push eax
call esi
push str.procobsrves.s_s
lea ecx, [ebp - 0x1408]
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0xff8]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d06b6
lea eax, [ebp - 0x1408]
call fcn.0094dd20
lea edi, [ebp - 0x1408]
lea ebx, [ebp - 0xff8]
call fcn.009626c0
mov edi, dword [ebp - 0x183b8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xb55508
lea edx, [ebp - 0xff8]
push edx
call ebx
lea ecx, [ebp - 0xff8]
call fcn.00960910
lea eax, [ebp - 0xff8]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d06d6
mov ecx, dword [str.vdb32_avpmapp.exe]
mov edx, dword [0xacd1c4]
mov dword [eax], ecx
mov ecx, dword [0xacd1c8]
mov dword [eax + 4], edx
mov edx, dword [0xacd1cc]
mov dword [eax + 8], ecx
mov cx, word [0xacd1d0]
mov dword [eax + 0xc], edx
push 0xb55508
lea edx, [ebp - 0x1408]
push edx
mov word [eax + 0x10], cx
call ebx
lea ecx, [ebp - 0x1408]
call fcn.00960910
lea eax, [ebp - 0x1408]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d0730
mov ecx, dword [str.vdb32_avpmapp.e_e]
mov edx, dword [0xacd1b0]
mov dword [eax], ecx
mov ecx, dword [0xacd1b4]
mov dword [eax + 4], edx
mov edx, dword [0xacd1b8]
mov dword [eax + 8], ecx
mov cx, word [0xacd1bc]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0xff8]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d07a6
lea eax, [ebp - 0x1408]
call fcn.0094dd20
lea edi, [ebp - 0x1408]
lea ebx, [ebp - 0xff8]
call fcn.009626c0
mov edi, dword [ebp - 0x183b8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xb55508
lea edx, [ebp - 0xff8]
push edx
call ebx
lea ecx, [ebp - 0xff8]
call fcn.00960910
lea eax, [ebp - 0xff8]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d07c6
mov ecx, dword [str.vdb64_avpmapp.exe]
mov edx, dword [0xacd1ec]
mov dword [eax], ecx
mov ecx, dword [0xacd1f0]
mov dword [eax + 4], edx
mov edx, dword [0xacd1f4]
mov dword [eax + 8], ecx
mov cx, word [0xacd1f8]
mov dword [eax + 0xc], edx
push 0xb55508
lea edx, [ebp - 0x1408]
push edx
mov word [eax + 0x10], cx
call ebx
lea ecx, [ebp - 0x1408]
call fcn.00960910
lea eax, [ebp - 0x1408]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d0820
mov ecx, dword [str.vdb64_avpmapp.e_e]
mov edx, dword [0xacd1d8]
mov dword [eax], ecx
mov ecx, dword [0xacd1dc]
mov dword [eax + 4], edx
mov edx, dword [0xacd1e0]
mov dword [eax + 8], ecx
mov cx, word [0xacd1e4]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0xff8]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d0896
lea eax, [ebp - 0x1408]
call fcn.0094dd20
lea edi, [ebp - 0x1408]
lea ebx, [ebp - 0xff8]
call fcn.009626c0
mov edi, dword [ebp - 0x183b8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xb55508
lea edx, [ebp - 0xff8]
push edx
call ebx
lea ecx, [ebp - 0xff8]
call fcn.00960910
lea eax, [ebp - 0xff8]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d08b6
mov ecx, dword [str.vista_avpmapp.exe]
mov edx, dword [0xacd214]
mov dword [eax], ecx
mov ecx, dword [0xacd218]
mov dword [eax + 4], edx
mov edx, dword [0xacd21c]
mov dword [eax + 8], ecx
mov cx, word [0xacd220]
mov dword [eax + 0xc], edx
push 0xb55508
lea edx, [ebp - 0x1408]
push edx
mov word [eax + 0x10], cx
call ebx
lea ecx, [ebp - 0x1408]
call fcn.00960910
lea eax, [ebp - 0x1408]
dec eax
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8d0910
mov ecx, dword [str.vista_avpmapp.e_e]
mov edx, dword [0xacd200]
mov dword [eax], ecx
mov ecx, dword [0xacd204]
mov dword [eax + 4], edx
mov edx, dword [0xacd208]
mov dword [eax + 8], ecx
mov cx, word [0xacd20c]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0xff8]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d0986
lea eax, [ebp - 0x1408]
call fcn.0094dd20
lea edi, [ebp - 0x1408]
lea ebx, [ebp - 0xff8]
call fcn.009626c0
mov edi, dword [ebp - 0x183b8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xb55508
lea edx, [ebp - 0x41c8]
push edx
call ebx
lea ecx, [ebp - 0x41c8]
call fcn.00960910
push str.templateeConceal.reg
lea eax, [ebp - 0x41c8]
push eax
call esi
lea ecx, [ebp - 0x79a8]
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceseconceal
push ecx
call fcn.00a78f30
push 0x80000002
lea eax, [ebp - 0x18528]
mov ecx, 1
mov edx, str.SYSTEMCurrentControlSetServiceseconceal
call fcn.0097f000
add esp, 0xc
test eax, eax
jne 0x8d0abc
mov edx, dword [ebp - 0x18528]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x184c0], ebx
call fcn.00968110
test eax, eax
je 0x8d0a12
lea eax, [ebp - 0x184c0]
push eax
call fcn.009681c0
add esp, 4
mov ebx, eax
lea ecx, [ebp - 0x79a8]
push ecx
lea edx, [ebp - 0x41c8]
push edx
push str.regedit.exe__S__E___s___s
push 0xffffffffffffffff
lea eax, [ebp - 0x3b98]
push 0x208
push eax
call fcn.00a78fcb
push 0
lea ecx, [ebp - 0x3b98]
push 0
push ecx
xor eax, eax
xor ecx, ecx
or edx, 0xffffffff
call fcn.0095dfe0
add esp, 0x24
mov esi, eax
test ebx, ebx
je 0x8d0a67
mov edx, dword [ebp - 0x184c0]
push edx
call fcn.00968240
add esp, 4
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0x41c8]
call fcn.0095a0f0
add esp, 8
push esi
test eax, eax
jne 0x8d0a8e
push str._UPGR__Successfully_exported_eConceal_RegKey___u_
lea eax, [ebp - 0x3b98]
push eax
jmp 0x8d0a9a
push str._UPGR__Not_exported_eConceal_RegKey___u_
lea ecx, [ebp - 0x3b98]
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x3b98]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d0b12
push eax
lea eax, [ebp - 0x79a8]
push eax
lea ecx, [ebp - 0x3b98]
push str._UPGR__Unable_to_open_key__s__Err:__u
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x3b98]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8d0b12
push str._UPGR__OS_Detected_as_Win_10__Not_renaming_files.
push eax
call fcn.00a78f30
push 0
push 1
lea ecx, [ebp - 0x3b98]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov eax, dword [ebp - 0x183fc]
mov esi, str.WinOSValueB
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
mov esi, 1
jmp 0x8d1033
push 0
push str.Office
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d0c2b
mov eax, str.Winword.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d0bdf
mov eax, str.Outlook.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d0bdf
mov eax, str.mspub.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d0bdf
mov eax, str.excel.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d0bdf
mov eax, str.msaccess.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d0bdf
mov eax, str.Frontpg.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d0bdf
mov eax, str.Powerpnt.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d0c2b
lea edx, [ebp - 0x18500]
push edx
push str.NoOutlookInject
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
mov dword [ebp - 0x18500], 0
call fcn.0094c0d0
cmp dword [ebp - 0x18500], 0
jne 0x8d1033
cmp dword [0xbd0698], 0
je 0x8d102d
push 0
push esi
push str._INJ__Inj_from_here_1_
jmp 0x8d1020
mov eax, str.conhost.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d0c87
mov dword [ebp - 0x184f8], eax
lea eax, [ebp - 0x184f8]
push eax
push str.NoConHostInject
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [ebp - 0x184f8], 0
jne 0x8d1033
cmp dword [0xbd0698], 0
je 0x8d102d
push 0
push esi
push str._INJ__Inj_from_here_1A_
jmp 0x8d1020
mov eax, str.chrome.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d0ce3
lea ecx, [ebp - 0x184fc]
push ecx
push str.NoChromeInject
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
mov dword [ebp - 0x184fc], eax
call fcn.0094c0d0
cmp dword [ebp - 0x184fc], 0
jne 0x8d1033
cmp dword [0xbd0698], 0
je 0x8d102d
push 0
push esi
push str._INJ__Inj_from_here_2_
jmp 0x8d1020
mov eax, str.MicrosoftEdgeCP.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d0fe1
mov eax, str.MicrosoftEdge.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d0fe1
mov eax, str.Teamviewer_Desktop.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d0fa0
mov eax, str.Teamviewer_Desktop.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d0fa0
cmp dword [0xb1aa3c], ebx
jb 0x8d1033
cmp dword [0xbd18b8], 0
je 0x8d0d65
cmp dword [0xb3debc], 0
jne 0x8d1033
call fcn.009dd2b0
cmp dword [ebp - 0x183d8], 0
jne 0x8d0f51
mov eax, 0xb56830
mov ecx, edi
call fcn.0094c3e0
test eax, eax
jne 0x8d0f37
lea edx, [ebp - 0x1843c]
push edx
push str.CopyPasteDisabled
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
mov dword [ebp - 0x1843c], eax
call fcn.0094c0d0
test byte [ebp - 0x1843c], 1
jne 0x8d0e5d
push 0x103
lea eax, [ebp - 0x81df]
push 0
push eax
mov byte [ebp - 0x81e0], 0
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x81e0]
push ecx
lea ecx, [ebp - 0x184c4]
mov dword [ebp - 0x184c4], 0xffffffff
call fcn.009a4460
test eax, eax
je 0x8d0e5d
mov esi, dword [ebp - 0x184c4]
cmp esi, 1
je 0x8d0e06
cmp esi, 2
jne 0x8d0e5d
push 0x103
lea edx, [ebp - 0x5e17]
push 0
push edx
mov byte [ebp - 0x5e18], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0x1843c]
add esp, 0xc
or eax, 1
push esi
push eax
mov dword [ebp - 0x1843c], eax
lea eax, [ebp - 0x5e18]
push str._INJ__A__Setting_CopyPasteDisabled_Value_to__u_as_SensitiveProtectionStatus_u
push eax
call fcn.00a78f30
push 0
push 1
lea ecx, [ebp - 0x5e18]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov eax, str.explorer.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d0e8c
lea esi, [eax + 1]
cmp dword [0xbd0698], eax
je 0x8d102d
push eax
push esi
push str._INJ__Inj_from_here_5_
jmp 0x8d1020
cmp dword [ebp - 0x1843c], 0
je 0x8d0edb
mov eax, str.rdpclip.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
mov esi, 1
test eax, eax
je 0x8d0ec1
push esi
lea ecx, [ebp - 0x358]
call fcn.00a5c170
add esp, 4
test eax, eax
je 0x8d0ee0
cmp dword [0xbd0698], 0
je 0x8d102d
push 0
push esi
push str._INJ__Inj_from_here_5a_
jmp 0x8d1020
mov esi, 1
cmp dword [0xbd0698], 0
je 0x8d10c0
push 0x103
lea edx, [ebp - 0x6657]
push 0
push edx
mov byte [ebp - 0x6658], 0
call fcn.00a7ffb0
add esp, 0xc
lea eax, [ebp - 0x6658]
push str._INJ__Not_injecting_as_it_is_WINDOWS_Process
push eax
call fcn.00a78f30
push 0
push esi
lea ecx, [ebp - 0x6658]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
jmp 0x8d1033
cmp dword [0xbd0698], 0
je 0x8d102d
push 0
push esi
push str._INJ__Inj_from_here_6_
jmp 0x8d1020
cmp dword [0xb3de80], 0
je 0x8d1033
cmp dword [0xbc27fc], 0
je 0x8d1033
mov edx, dword [ebp - 0x183b4]
push edx
push edi
lea eax, [ebp - 0x3990]
push str.___INJ__NOT_Injecting_DataTheft_DLL_into___s:_d__as_self_protection_disabled_for_this_process.
push eax
call fcn.00a78f30
push 0
push esi
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8d1033
lea edx, [ebp - 0x184ec]
push edx
push str.NoTVInject
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
mov dword [ebp - 0x184ec], 0
call fcn.0094c0d0
cmp dword [ebp - 0x184ec], 0
jne 0x8d1033
cmp dword [0xbd0698], 0
je 0x8d102d
push 0
push esi
push str._INJ__Inj_from_here_4A_
jmp 0x8d1020
lea eax, [ebp - 0x184cc]
push eax
push str.NoEdgeInject
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
mov dword [ebp - 0x184cc], 0
call fcn.0094c0d0
cmp dword [ebp - 0x184cc], 0
jne 0x8d1033
cmp dword [0xbd0698], 0
je 0x8d102d
push 0
push esi
push str._INJ__Inj_from_here_4_
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0x183d0], esi
cmp dword [0xbd0698], 0
je 0x8d109c
push 0x103
lea ecx, [ebp - 0x6027]
push 0
push ecx
mov byte [ebp - 0x6028], 0
call fcn.00a7ffb0
mov edx, dword [0xb567c0]
mov eax, dword [0xb3de80]
mov ecx, dword [ebp - 0x183d0]
add esp, 0xc
push edx
push eax
push ecx
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x6028]
push str._INJ____s__InjectFromHere_Val:_u__DLPEnabled:_u__ZTemp:_u
push eax
call fcn.00a78f30
push 0
push esi
lea ecx, [ebp - 0x6028]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
cmp dword [ebp - 0x183d0], 0
je 0x8d10c0
cmp dword [0xb3de80], 0
je 0x8d1186
cmp dword [0xb567c0], 0
jne 0x8d10c0
call fcn.009dd2b0
cmp dword [0xb3de80], 0
je 0x8d1186
test byte [0xbd4aa4], 4
je 0x8d1186
mov eax, str.rdpclip.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d1186
lea edx, [ebp - 0x18480]
push edx
push str.CopyPasteDisabledBlockRDPC
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
mov dword [ebp - 0x18480], esi
call fcn.0094c0d0
test al, al
jne 0x8d1136
mov eax, dword [ebp - 0x18480]
mov esi, str.CopyPasteDisabledBlockRDPC
mov ebx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov ecx, 0x80000002
call fcn.0094be90
mov esi, 1
cmp dword [ebp - 0x18480], esi
jne 0x8d1186
mov eax, dword [ebp - 0x183b4]
push eax
push edi
push str._CPL__TERM__Force_Terminating_RDPClip_Process:__s:_u
push 0xffffffffffffffff
lea ecx, [ebp - 0x10230]
push 0x208
push ecx
mov dword [0xbd1adc], esi
mov dword [ebp - 0x183bc], esi
call fcn.00a78fcb
push 0
push esi
lea edx, [ebp - 0x10230]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
jmp 0x8d15ed
cmp dword [ebp - 0x183d0], 0
je 0x8d15ed
cmp dword [0xb567c0], 0
jne 0x8d15ed
push 0x103
xor esi, esi
lea eax, [ebp - 0x1927]
push esi
push eax
mov byte [ebp - 0x1928], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x8b1f]
push esi
push ecx
mov byte [ebp - 0x8b20], 0
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x8b20]
push edx
lea ecx, [ebp - 0x18488]
mov dword [ebp - 0x18488], 0xffffffff
call fcn.009a4460
mov edi, dword [ebp - 0x18488]
cmp dword [0xb3de80], esi
jne 0x8d1248
cmp edi, 1
je 0x8d1212
cmp edi, 2
jne 0x8d15bc
push edi
lea eax, [ebp - 0x1928]
push str._INJ__Force_DLPEnabled_to_1_as_SensitiveProtectionStatus_u
push eax
call fcn.00a78f30
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x1928]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [0xb3de80], 1
lea edx, [ebp - 0x18474]
push edx
push str.BlockFileTxferOverIM
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [ebp - 0x18458], esi
mov dword [ebp - 0x18454], 1
mov dword [ebp - 0x18450], esi
mov dword [ebp - 0x18438], esi
mov dword [ebp - 0x18474], esi
call fcn.0094c0d0
lea eax, [ebp - 0x18458]
push eax
push str.Inject
mov ecx, str.SOFTWAREMicroWorldDeviceControl
mov edx, 0x80000002
call fcn.0094c0d0
lea ecx, [ebp - 0x18454]
push ecx
push str.AttachmentsAllowed
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
lea edx, [ebp - 0x18450]
push edx
push str.LogFilesUploaded
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
lea eax, [ebp - 0x18438]
push eax
push str.CopyPasteDisabled
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
push 0xbddc84
push str.INJECT_DEBUG
mov ecx, str.SOFTWAREMicroWorldeScan_for_WindowsDataTheft
mov edx, 0x80000002
call fcn.0094c0d0
mov ecx, dword [ebp - 0x183b8]
push esi
push str.TeamView
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d1329
mov esi, 1
mov ebx, dword [ebp - 0x18438]
test bl, 1
jne 0x8d1378
cmp edi, 1
je 0x8d133e
cmp edi, 2
jne 0x8d1378
push edi
or ebx, 1
push ebx
lea edx, [ebp - 0x1928]
push str._INJ__B__Setting_CopyPasteDisabled_Value_to__u_as_SensitiveProtectionStatus_u
push edx
mov dword [ebp - 0x18438], ebx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x1928]
push eax
push 0xb54ce8
call fcn.008808e0
mov ebx, dword [ebp - 0x18438]
add esp, 0x20
cmp dword [0xbd0698], 0
je 0x8d13f5
push 0x103
lea ecx, [ebp - 0x6b77]
push 0
push ecx
mov byte [ebp - 0x6b78], 0
call fcn.00a7ffb0
mov edx, dword [ebp - 0x18450]
mov eax, dword [ebp - 0x18474]
mov ecx, dword [ebp - 0x18454]
add esp, 0xc
push edx
mov edx, dword [ebp - 0x18458]
push eax
push esi
push ebx
push ecx
push edx
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x6b78]
push str._INJ____s__Inj:_u__AttAll:_u__CPD:_u__IMApp:_u__BlkFT:_u__LFU:_u
push ecx
call fcn.00a78f30
add esp, 0x24
push 0
push 1
lea edx, [ebp - 0x6b78]
push edx
push 0xb54ce8
call fcn.008808e0
mov ebx, dword [ebp - 0x18438]
add esp, 0x10
cmp dword [ebp - 0x18458], 0
jne 0x8d1428
cmp dword [ebp - 0x18450], 0
jne 0x8d1428
cmp dword [ebp - 0x18454], 1
jne 0x8d1428
test ebx, ebx
jne 0x8d1428
test esi, esi
je 0x8d15ed
cmp dword [ebp - 0x18474], ebx
je 0x8d15ed
cmp dword [0xbd04f4], 0
jne 0x8d15ed
mov eax, dword [ebp - 0x183b4]
push eax
lea ecx, [ebp - 0xb8b8]
push str.DT__d_MUTEX
push ecx
mov dword [ebp - 0x18430], 0
call fcn.00a78f30
lea edx, [ebp - 0x18430]
add esp, 0xc
push edx
lea ecx, [ebp - 0xb8b8]
call fcn.00970050
add esp, 4
test eax, eax
je 0x8d1587
cmp dword [ebp - 0x18430], 0
je 0x8d1587
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea edi, [ebp - 0x18430]
mov esi, eax
call fcn.00970020
cmp esi, 0xb7
je 0x8d1569
mov eax, dword [0xbddc84]
mov ecx, dword [ebp - 0x18450]
mov edx, dword [ebp - 0x18438]
push eax
mov eax, dword [ebp - 0x18454]
push ecx
mov ecx, dword [ebp - 0x18458]
push edx
mov edx, dword [ebp - 0x183b4]
push eax
mov eax, dword [ebp - 0x183b8]
push ecx
push edx
push eax
lea ecx, [ebp - 0x3990]
push str.___Injecting_our_DataTheft_DLL:___s:_d__Inj:_u__AttAllow:_u__CoPast:_u__LFU:_u__iDeb:_d_
push ecx
call fcn.00a78f30
add esp, 0x24
push 0
push 1
lea edx, [ebp - 0x3990]
push edx
push 0xb54ce8
call fcn.008808e0
mov eax, dword [ebp - 0x183b4]
push eax
push 0
push 0x9dd590
call fcn.00a791b2
add esp, 0x1c
mov esi, eax
push str.CBD_7e
xor ebx, ebx
call fcn.0085df20
add esp, 4
cmp esi, 0xffffffff
jne 0x8d15ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_y__fails_with_error__d
push esi
lea ecx, [ebp - 0x1928]
push 0x104
push ecx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea edx, [ebp - 0x1928]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d15ed
lea eax, [ebp - 0x3990]
push str.___NOT_Injecting_DataTheft_DLL_as_Mutex_is_already_used_
push eax
call fcn.00a78f30
push 0
push 1
lea ecx, [ebp - 0x3990]
push ecx
jmp 0x8d15e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x3990]
push str.___NOT_Injecting_DataTheft_DLL_as_MutexCreation_failed__lastErr:_d
push edx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea eax, [ebp - 0x3990]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d15ed
cmp dword [0xbc27fc], esi
je 0x8d15ed
lea ecx, [ebp - 0x3990]
push str.___NOT_Injecting_DataTheft_DLL_as_DLP_is_not_enabled_
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x3990]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov eax, str.scanremv.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d1657
mov eax, str.esremove.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d1657
mov eax, str.unins
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
mov esi, dword [ebp - 0x183b8]
test eax, eax
jne 0x8d172d
mov eax, 0xb55508
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8d1657
mov eax, 0xb55710
mov ecx, esi
call fcn.0094c3e0
test eax, eax
jne 0x8d172d
xor eax, eax
mov dword [ebp - 0x18498], eax
mov dword [ebp - 0x18490], eax
cmp byte [0xbf3d40], al
jne 0x8d16b3
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xb55918
push 0x104
push 0xbf3d40
push 0xab3780
push 0xab91c4
push str.Prompt
call esi
push 0xb55918
push 0x104
push 0xbf3e48
push str.eScan_Uninstallation_Started
push 0xab9268
push 0xaaec30
call esi
mov eax, dword [ebp - 0x183b4]
push 5
push 0xbf3e48
push eax
call fcn.009b92c0
mov ecx, dword [ebp - 0x183b4]
add esp, 0xc
push 5
push str.eScan_Monitor
lea ebx, [ebp - 0x18490]
lea edi, [ebp - 0x18498]
call fcn.008c4180
mov ecx, dword [ebp - 0x18490]
mov edx, dword [ebp - 0x18498]
mov eax, dword [ebp - 0x183b8]
add esp, 8
push 0
push 0
push 0
push ecx
push edx
push 0
push eax
push 0xbf3d40
push 0xbf3e48
push 0xaa154c
push 0
push 0x300
mov ecx, str.eScan_Monitor
call fcn.00982e00
mov esi, dword [ebp - 0x183b8]
mov eax, str.iexplore.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d1746
call fcn.0094cce0
mov eax, str.wlmail.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d18dd
push 0x207
push eax
lea ecx, [ebp - 0x204f]
push ecx
mov byte [ebp - 0x2050], al
call fcn.00a7ffb0
add esp, 0xc
push 0x208
lea edx, [ebp - 0x2050]
push edx
push 0xaa1543
mov edx, str.SpecialFolderPath
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x2050], 0
je 0x8d18dd
xor ecx, ecx
lea edi, [ebp - 0x2050]
call fcn.0095a6d0
test eax, eax
je 0x8d18d7
push 0x207
lea eax, [ebp - 0x8a17]
push 0
push eax
mov byte [ebp - 0x8a18], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x8a18]
push ecx
mov edx, edi
push edx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
cmp byte [ebp - 0x8a18], 0
je 0x8d1843
mov ecx, edi
lea eax, [ebp - 0x8a18]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x8d1821
test dl, dl
je 0x8d181d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x8d1821
add eax, 2
add ecx, 2
test dl, dl
jne 0x8d1801
xor eax, eax
jmp 0x8d1826
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x8d1843
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x8a18]
mov byte [ebp + eax - 0x2050], cl
inc eax
test cl, cl
jne 0x8d1830
lea esi, [ebp - 0x2050]
call fcn.00960950
mov edi, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x8d1851
mov ecx, 7
mov esi, str.econceal_firewall_rules.xml
rep movsd dword es:[edi], dword [esi]
push 0
push 0
xor edx, edx
lea ecx, [ebp - 0x2050]
movsb byte es:[edi], byte [esi]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d18d7
push 1
lea esi, [ebp - 0x2050]
call fcn.0098d390
add esp, 4
test eax, eax
je 0x8d18d7
call 0x87fa10
push 0
call fcn.0098d390
add esp, 4
mov eax, esi
push eax
push str._FWRULE__ICMP_Rule_Modified_in__s
push 0xffffffffffffffff
lea ecx, [ebp - 0x10e40]
push 0x208
push ecx
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x10e40]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov esi, dword [ebp - 0x183b8]
cmp dword [ebp - 0x183bc], 0
jne 0x8d1feb
cmp dword [0xb3dc70], 0
je 0x8d19b8
push 0
push str.IObit
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d19b8
push 0x207
lea eax, [ebp - 0xbbc7]
push 0
push eax
mov byte [ebp - 0xbbc8], 0
call fcn.00a7ffb0
mov edx, dword [0xacd9f0]
mov eax, dword [0xacd9f4]
mov ecx, dword [str.IOBit_Blocked]
add esp, 0xc
mov dword [ebp - 0x114], edx
mov edx, dword [ebp - 0x183b4]
push edx
push esi
push str._CPL__TERM__Force_Terminating_IOBit_Process:__s:_u
push 0xffffffffffffffff
mov dword [ebp - 0x110], eax
mov edi, 1
mov dword [ebp - 0x118], ecx
mov cx, word [0xacd9f8]
lea eax, [ebp - 0xbbc8]
push 0x208
push eax
mov dword [ebp - 0x183c8], edi
mov dword [ebp - 0x183bc], edi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], edi
mov word [ebp - 0x10c], cx
call fcn.00a78fcb
push 0
push edi
lea ecx, [ebp - 0xbbc8]
push ecx
push 0xb54ce8
call fcn.008808e0
jmp 0x8d1fe8
cmp dword [0xb3d5bc], 0
je 0x8d1a8f
push 0
push str.advanced_port_scanner
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d1a8f
push 0x207
lea edx, [ebp - 0xad87]
push 0
push edx
mov byte [ebp - 0xad88], 0
call fcn.00a7ffb0
mov edx, dword [0xacda50]
mov eax, dword [str.PortScanner_Blocked]
mov ecx, dword [0xacda4c]
add esp, 0xc
mov dword [ebp - 0x110], edx
mov edx, dword [ebp - 0x183b4]
push edx
push esi
mov dword [ebp - 0x118], eax
mov eax, dword [0xacda54]
push str._CPL__TERM__Force_Terminating_PortScanner_Process:__s:_u
push 0xffffffffffffffff
mov dword [ebp - 0x10c], eax
mov edi, 1
mov dword [ebp - 0x114], ecx
mov ecx, dword [0xacda58]
lea eax, [ebp - 0xad88]
push 0x208
push eax
mov dword [ebp - 0x183c8], edi
mov dword [ebp - 0x183bc], edi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], edi
mov dword [ebp - 0x108], ecx
call fcn.00a78fcb
push 0
push edi
lea ecx, [ebp - 0xad88]
push ecx
push 0xb54ce8
call fcn.008808e0
jmp 0x8d1fe8
cmp dword [0xb3dc78], 0
je 0x8d1b4d
push 0
push str.ilockmsg.exe
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d1b4d
cmp dword [ebp - 0x183f8], 0x14000
jae 0x8d1b4d
push 0x207
lea edx, [ebp - 0xa76f]
push 0
push edx
mov byte [ebp - 0xa770], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0x183b4]
add esp, 0xc
push eax
push esi
push str._CPL__TERM__Force_Terminating_ILockMsg_Process:__s:_u
push 0xffffffffffffffff
lea ecx, [ebp - 0xa770]
mov edi, 1
push 0x208
push ecx
mov dword [ebp - 0x183c8], edi
mov dword [ebp - 0x183bc], edi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 2
mov byte [ebp - 0x118], 0
call fcn.00a78fcb
push 0
push edi
lea edx, [ebp - 0xa770]
push edx
push 0xb54ce8
call fcn.008808e0
mov dword [ebp - 0x184dc], edi
jmp 0x8d1fe8
cmp dword [0xb3dc74], 0
je 0x8d1f30
push 0
push str.PCHunter
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d1c29
push 0x207
lea eax, [ebp - 0xb197]
push 0
push eax
mov byte [ebp - 0xb198], 0
call fcn.00a7ffb0
mov eax, dword [0xacdaf4]
mov ecx, dword [str.PCHunter_Blocked]
mov edx, dword [0xacdaf0]
add esp, 0xc
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x183b4]
push eax
push esi
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xacdaf8]
push str._CPL__TERM__Force_Terminating_PCHunter_Process:__s:_u
push 0xffffffffffffffff
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x114], edx
mov dl, byte [0xacdafc]
lea ecx, [ebp - 0xb198]
mov edi, 1
push 0x208
push ecx
mov dword [ebp - 0x183c8], edi
mov dword [ebp - 0x183bc], edi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 4
mov byte [ebp - 0x108], dl
call fcn.00a78fcb
push 0
push edi
lea edx, [ebp - 0xb198]
push edx
push 0xb54ce8
call fcn.008808e0
jmp 0x8d1fe8
cmp dword [0xb3dc74], 0
je 0x8d1f30
push 0
push str.hrsword
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d1c79
push 0
push str.usysdiag
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d1c79
push 0
push str.sysdiag_gui
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d1d23
push 0x207
lea eax, [ebp - 0xc1cf]
push 0
push eax
mov byte [ebp - 0xc1d0], 0
call fcn.00a7ffb0
mov edx, dword [0xacdb5c]
mov eax, dword [0xacdb60]
mov ecx, dword [str.HRSWord_Blocked]
add esp, 0xc
mov dword [ebp - 0x114], edx
mov edx, dword [ebp - 0x183b4]
push edx
push esi
push str._CPL__TERM__Force_Terminating_HRSWord_Process:__s:_u
push 0xffffffffffffffff
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xacdb64]
lea eax, [ebp - 0xc1d0]
mov edi, 1
push 0x208
push eax
mov dword [ebp - 0x183c8], edi
mov dword [ebp - 0x183bc], edi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 4
mov dword [ebp - 0x10c], ecx
call fcn.00a78fcb
push 0
push edi
lea ecx, [ebp - 0xc1d0]
push ecx
push 0xb54ce8
call fcn.008808e0
jmp 0x8d1fe8
cmp dword [0xb3dc74], 0
je 0x8d1f30
push 0
push str.gmer.
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d1df2
push 0x207
lea edx, [ebp - 0xb5a7]
push 0
push edx
mov byte [ebp - 0xb5a8], 0
call fcn.00a7ffb0
mov ecx, dword [0xacdbac]
mov edx, dword [0xacdbb0]
mov eax, dword [str.GMer_Blocked]
add esp, 0xc
mov dword [ebp - 0x114], ecx
mov ecx, dword [ebp - 0x183b4]
push ecx
push esi
push str._CPL__TERM__Force_Terminating_GMer_Process:__s:_u
push 0xffffffffffffffff
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x118], eax
mov al, byte [0xacdbb4]
lea edx, [ebp - 0xb5a8]
mov edi, 1
push 0x208
push edx
mov dword [ebp - 0x183c8], edi
mov dword [ebp - 0x183bc], edi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x29
mov byte [ebp - 0x10c], al
call fcn.00a78fcb
push 0
push edi
lea eax, [ebp - 0xb5a8]
push eax
push 0xb54ce8
call fcn.008808e0
jmp 0x8d1fe8
cmp dword [0xb3dc74], 0
je 0x8d1f30
mov al, byte [ebp - 0x358]
cmp al, 0x70
je 0x8d1e11
cmp al, 0x50
jne 0x8d1f30
mov eax, str.Powertool.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d1e79
mov eax, str.Powertool32.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d1e79
mov eax, str.Powertool64.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d1e79
mov eax, str.Powertool_64.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d1e79
mov eax, str.Powertool_32.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d1f30
push 0x207
lea ecx, [ebp - 0xa977]
push 0
push ecx
mov byte [ebp - 0xa978], 0
call fcn.00a7ffb0
mov ecx, dword [0xacdc4c]
mov edx, dword [str.Powertool_Blocked]
mov eax, dword [0xacdc48]
add esp, 0xc
mov dword [ebp - 0x110], ecx
mov ecx, dword [ebp - 0x183b4]
push ecx
push esi
mov dword [ebp - 0x118], edx
mov edx, dword [0xacdc50]
push str._CPL__TERM__Force_Terminating_Powertool_Process:__s:_u
push 0xffffffffffffffff
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x114], eax
mov ax, word [0xacdc54]
lea edx, [ebp - 0xa978]
mov edi, 1
push 0x208
push edx
mov dword [ebp - 0x183c8], edi
mov dword [ebp - 0x183bc], edi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x2a
mov word [ebp - 0x108], ax
call fcn.00a78fcb
push 0
push edi
lea eax, [ebp - 0xa978]
push eax
push 0xb54ce8
call fcn.008808e0
jmp 0x8d1fe8
cmp dword [0xb3dea4], 0
je 0x8d1feb
push esi
lea ecx, [ebp - 0x358]
call fcn.00a65ff0
add esp, 4
test eax, eax
je 0x8d1feb
push 0x207
lea ecx, [ebp - 0xab7f]
push 0
push ecx
mov byte [ebp - 0xab80], 0
call fcn.00a7ffb0
mov edx, dword [ebp - 0x183b4]
mov eax, dword [ebp - 0x183b8]
add esp, 0xc
push edx
push eax
push str._CPL__TERM__Force_Terminating_ProgramData_Users_Process:__s:_u
mov ecx, 9
mov esi, str.ProgramData_Users_Execution_Blocked
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
push 0xffffffffffffffff
lea ecx, [ebp - 0xab80]
mov esi, 1
push 0x208
push ecx
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x2c
call fcn.00a78fcb
push 0
push esi
lea edx, [ebp - 0xab80]
push edx
push 0xb54ce8
call fcn.008808e0
mov esi, dword [ebp - 0x183b8]
add esp, 0x28
cmp dword [ebp - 0x183bc], 0
mov dword [ebp - 0x184a0], 0
jne 0x8d8478
cmp dword [0xb3dea8], 0
je 0x8d20d0
lea eax, [ebp - 0x358]
push esi
push eax
lea ecx, [ebp - 0x184a0]
call fcn.00a691a0
add esp, 8
test eax, eax
je 0x8d20d0
cmp dword [ebp - 0x184a0], 0
je 0x8d20d0
push 0x207
lea ecx, [ebp - 0xaf8f]
push 0
push ecx
mov byte [ebp - 0xaf90], 0
call fcn.00a7ffb0
mov edx, dword [ebp - 0x183b4]
mov eax, dword [ebp - 0x183b8]
add esp, 0xc
push edx
push eax
push str._CPL__TERM__Force_Terminating_Sensitive_OS_Process_executed_from_Non_Windows_location:__s:_u
mov ecx, 9
mov esi, str.Sensitive_OS_File_Execution_Blocked
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
push 0xffffffffffffffff
lea ecx, [ebp - 0xaf90]
mov esi, 1
push 0x208
push ecx
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x2d
call fcn.00a78fcb
push 0
push esi
lea edx, [ebp - 0xaf90]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
jmp 0x8d8478
cmp dword [0xb3dea0], 0
je 0x8d23f1
push 0x207
lea eax, [ebp - 0x46e7]
push 0
push eax
mov byte [ebp - 0x46e8], 0
call fcn.00a7ffb0
mov ecx, dword [ebp - 0x183b8]
add esp, 0xc
push 0
push str.IObit_Uninstaller
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d2199
mov eax, str.unins000.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d23f1
mov edx, dword [ebp - 0x183b4]
mov ecx, 5
mov esi, str.Uninstaller_Blocked_A_
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
push edx
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov eax, dword [ebp - 0x183b8]
push eax
push str._CPL__TERM__Force_Terminating_Uninstaller_Process:__s:_u
movsw word es:[edi], word [esi]
push 0xffffffffffffffff
lea ecx, [ebp - 0x46e8]
push 0x208
push ecx
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 5
call fcn.00a78fcb
add esp, 0x18
jmp 0x8d22cc
cmp byte [ebp - 0x8d28], 0
je 0x8d22e9
mov edi, str.TuRes.dll
lea ecx, [ebp - 0x8d28]
call fcn.00959ba0
test eax, eax
jne 0x8d22e9
mov eax, str.unins000.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d22e9
mov edx, dword [ebp - 0x183b8]
lea ecx, [ebp - 0x184a8]
mov dword [ebp - 0x184a8], 0
call fcn.00978190
mov ebx, dword [ebp - 0x184a8]
test ebx, ebx
je 0x8d23f1
cmp byte [ebx], 0
je 0x8d2278
mov ecx, str.GAVRILA
mov edx, ebx
call fcn.0095ce20
cmp eax, 0xffffffff
je 0x8d2278
mov edx, dword [ebp - 0x183b4]
mov ecx, 5
mov esi, str.Uninstaller_Blocked_E_
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
push edx
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov eax, dword [ebp - 0x183b8]
push eax
push str._CPL__TERM__Force_Terminating_Uninstaller_Process:__s:_u
movsw word es:[edi], word [esi]
push 0xffffffffffffffff
lea ecx, [ebp - 0x46e8]
push 0x208
push ecx
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 5
call fcn.00a78fcb
add esp, 0x18
push ebx
call fcn.00a78fec
add esp, 4
push 0
mov ecx, str.Tu.
lea ebx, [ebp - 0x8d28]
call fcn.0095eb80
add esp, 4
cmp dword [ebp - 0x183c0], 0
jne 0x8d22b2
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov edi, dword [ebp - 0x183c0]
push 0
call fcn.0097a830
cmp dword [ebp - 0x183bc], 0
je 0x8d23f1
cmp byte [ebp - 0x46e8], 0
je 0x8d2ecb
push 0
push 1
lea eax, [ebp - 0x46e8]
push eax
jmp 0x8d2ebe
mov esi, dword [ebp - 0x183b8]
push 0
push str.Revo_Uninstaller
push esi
call fcn.0095c8c0
add esp, 0xc
lea ecx, [ebp - 0x358]
cmp eax, 0xffffffff
je 0x8d2384
mov eax, str.uninst.exe
call fcn.0094c3e0
test eax, eax
je 0x8d23f1
mov edx, dword [ebp - 0x183b4]
mov ecx, 5
mov esi, str.Uninstaller_Blocked_B_
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
push edx
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov eax, dword [ebp - 0x183b8]
push eax
push str._CPL__TERM__Force_Terminating_Uninstaller_Process:__s:_u
movsw word es:[edi], word [esi]
push 0xffffffffffffffff
lea ecx, [ebp - 0x46e8]
push 0x208
push ecx
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x3d
call fcn.00a78fcb
add esp, 0x18
jmp 0x8d22cc
mov eax, str.RevoUn.exe
call fcn.0094c3e0
test eax, eax
je 0x8d24ec
mov eax, str.RevoUPort.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d24ec
push 0
push str.WiseProgram
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d2484
push 0
push str.WiseDelete
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d2484
mov edx, dword [ebp - 0x183b4]
push edx
mov ecx, esi
call fcn.008cc040
add esp, 4
cmp dword [0xb3de9c], 0
jbe 0x8d267b
mov eax, str.ntvdm.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d267b
cmp dword [0xb3de9c], 2
mov edi, dword [ebp - 0x183c0]
jne 0x8d252e
mov ecx, dword [str.NTVDM_Blocked]
mov edx, dword [0xacdf50]
mov eax, dword [0xacdf54]
mov dword [ebp - 0x118], ecx
mov cx, word [0xacdf58]
mov ebx, 1
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], eax
mov word [ebp - 0x10c], cx
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 9
jmp 0x8d2636
mov eax, 1
mov ecx, 5
mov esi, str.Uninstaller_Blocked_D_
lea edi, [ebp - 0x118]
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov eax, dword [ebp - 0x183b4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x183b8]
push eax
push ecx
mov dword [ebp - 0x183cc], 8
push str._CPL__TERM__Force_Terminating_Wise_Uninstaller_Process:__s:_u
movsw word es:[edi], word [esi]
push 0xffffffffffffffff
lea edx, [ebp - 0x46e8]
push 0x208
push edx
mov dword [ebp - 0x183c4], 0x710
movsb byte es:[edi], byte [esi]
call fcn.00a78fcb
add esp, 0x18
jmp 0x8d22cc
mov eax, 1
mov ecx, 5
mov esi, str.Uninstaller_Blocked_C_
lea edi, [ebp - 0x118]
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov eax, dword [ebp - 0x183b4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x183b8]
push eax
push ecx
mov dword [ebp - 0x183cc], 7
push str._CPL__TERM__Force_Terminating_Revo_Uninstaller_Process:__s:_u
jmp 0x8d24c4
test edi, edi
jne 0x8d2547
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov edi, eax
cmp edi, 4
jbe 0x8d2567
cmp byte [ebp - 0x6d0], 0
jne 0x8d2567
push edi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
push 0
lea edx, [ebp - 0x6d0]
push str.lsass
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d25e3
mov eax, dword [str.NTVDM_Blocked_A_]
mov ecx, dword [0xacdf68]
mov edx, dword [0xacdf6c]
mov dword [ebp - 0x118], eax
mov eax, dword [0xacdf70]
mov dword [ebp - 0x114], ecx
mov cl, byte [0xacdf74]
mov ebx, 1
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], eax
mov byte [ebp - 0x108], cl
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0xa
jmp 0x8d2636
mov eax, dword [ebp - 0x183b4]
mov ecx, dword [ebp - 0x183b8]
push edi
lea edx, [ebp - 0x8d8]
push edx
push eax
push ecx
push str._CPL__NOT_Terminating_NTVDM:__s:_u_as_Parent_is__s:_u
push 0xffffffffffffffff
lea edx, [ebp - 0x13458]
push 0x208
push edx
call fcn.00a78fcb
push 0
mov ebx, 1
push ebx
lea eax, [ebp - 0x13458]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
cmp dword [ebp - 0x183bc], 0
je 0x8d2693
mov edx, dword [ebp - 0x183b4]
mov eax, dword [ebp - 0x183b8]
push edi
lea ecx, [ebp - 0x8d8]
push ecx
push edx
push eax
push str._CPL__TERM__Force_Terminating_NTVDM:__s:_u__Parent_is__s:_u
push 0xffffffffffffffff
lea ecx, [ebp - 0xec08]
push 0x208
push ecx
call fcn.00a78fcb
push 0
push ebx
lea edx, [ebp - 0xec08]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
cmp dword [ebp - 0x183bc], 0
jne 0x8d8478
mov edi, dword [ebp - 0x183c0]
mov ebx, 1
cmp dword [0xbd4abc], 0
je 0x8d27c5
mov eax, str.MicrosoftEdgeCP.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d26e5
mov eax, str.MicrosoftEdge.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d26e5
cmp dword [0xbd4abc], 2
jne 0x8d2735
mov eax, 0xacdfec
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d2735
mov eax, dword [str.Edge_Blocked]
mov ecx, dword [0xacdffc]
mov edx, dword [0xace000]
mov dword [ebp - 0x118], eax
mov al, byte [0xace004]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], edx
mov byte [ebp - 0x10c], al
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0xb
jmp 0x8d2742
cmp dword [ebp - 0x183bc], 0
je 0x8d27d8
test edi, edi
jne 0x8d275b
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov edi, eax
cmp edi, 4
jbe 0x8d2780
cmp byte [ebp - 0x6d0], 0
jne 0x8d2780
push edi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
mov ebx, 1
mov edx, dword [ebp - 0x183b4]
mov eax, dword [ebp - 0x183b8]
push edi
lea ecx, [ebp - 0x6d0]
push ecx
push edx
push eax
push str._CPL__TERM__Force_Terminating_Edge_Browser_App:__s:_u__Parent:__s:_u
push 0xffffffffffffffff
lea ecx, [ebp - 0xee10]
push 0x208
push ecx
call fcn.00a78fcb
push 0
push ebx
lea edx, [ebp - 0xee10]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
cmp dword [ebp - 0x183bc], 0
jne 0x8d8478
mov edi, dword [ebp - 0x183c0]
mov eax, dword [ebp - 0x183f8]
lea ecx, [eax - 0x69f51]
cmp ecx, 0x2af6
ja 0x8d2a04
cmp eax, 0x6c500
je 0x8d2805
cmp eax, 0x6c000
je 0x8d2805
cmp eax, 0x6a358
jne 0x8d287d
mov eax, str.esremove.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2b66
mov eax, str.escan_del.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2b66
mov eax, str.escan_rem.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2b66
mov eax, str.escandel.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2b66
mov eax, str.escanrem.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2b66
mov esi, dword [ebp - 0x183b8]
push 2
mov dword [ebp - 0x184b0], 0
call fcn.008cbd10
add esp, 4
mov dword [ebp - 0x18418], eax
test eax, eax
jne 0x8d2978
lea ecx, [ebp - 0x184b0]
mov edx, esi
call fcn.00978190
mov ebx, dword [ebp - 0x184b0]
mov esi, eax
test ebx, ebx
je 0x8d2978
test byte [0xc11a40], 1
jne 0x8d28e1
or dword [0xc11a40], 1
mov ecx, str.esremove
call fcn.0094c3d0
mov dword [0xc11a3c], eax
cmp byte [ebx], 0
je 0x8d296f
mov eax, esi
mov ecx, str.esremove
mov edx, ebx
call fcn.0095ce20
cmp eax, 0xffffffff
je 0x8d296f
mov edx, dword [0xc11a3c]
add edx, eax
mov al, byte [edx + ebx]
cmp al, 0x44
je 0x8d296f
cmp al, 0x64
je 0x8d296f
mov eax, dword [str.ESRem_Blocked_A_]
mov ecx, dword [0xace0a0]
mov edx, dword [0xace0a4]
mov dword [ebp - 0x118], eax
mov eax, dword [0xace0a8]
mov dword [ebp - 0x114], ecx
mov cl, byte [0xace0ac]
mov dword [ebp - 0x10c], eax
mov eax, 1
mov dword [ebp - 0x110], edx
mov byte [ebp - 0x108], cl
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0xe
push ebx
call fcn.00a78fec
add esp, 4
cmp dword [ebp - 0x183bc], 0
je 0x8d2bc1
test edi, edi
jne 0x8d299e
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov edi, eax
cmp edi, 4
jbe 0x8d29be
cmp byte [ebp - 0x6d0], 0
jne 0x8d29be
push edi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
mov ecx, dword [ebp - 0x183b4]
mov edx, dword [ebp - 0x183b8]
push edi
lea eax, [ebp - 0x6d0]
push eax
push ecx
push edx
push str._CPL__TERM__Force_Terminating_ESREMOVE_App:__s:_u__Parent:__s:_u
push 0xffffffffffffffff
lea eax, [ebp - 0x11448]
push 0x208
push eax
call fcn.00a78fcb
push 0
push 1
lea ecx, [ebp - 0x11448]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
cmp dword [ebp - 0x183bc], 0
jne 0x8d8478
mov eax, str.regedit.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2a7f
lea edi, [ebp - 0x4c8]
mov esi, str.regedt32.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d2a7f
mov eax, str.cmd.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2a7f
mov eax, str.powershell.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2a7f
mov eax, str.SystemSettingsAdminFlows.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d2ecb
cmp dword [0xbd4ab8], 0
je 0x8d2bec
cmp dword [0xbd4ab4], 0
je 0x8d2be3
mov eax, str.regedit.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2ad9
mov eax, str.regedt32.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2ad9
mov eax, str.cmd.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d2be3
cmp dword [ebp - 0x183c0], 0
jne 0x8d2af5
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov esi, dword [ebp - 0x183c0]
cmp esi, 4
jbe 0x8d2b1b
cmp byte [ebp - 0x6d0], 0
jne 0x8d2b1b
push esi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
mov eax, dword [ebp - 0x183b4]
push esi
lea edx, [ebp - 0x6d0]
push edx
push eax
lea ecx, [ebp - 0x358]
push ecx
push str._CPL__Allowing_App:__s:_u__Parent:__s:_u
push 0xffffffffffffffff
lea edx, [ebp - 0x18270]
push 0x1000
push edx
call fcn.00a78fcb
push 0
push 1
lea eax, [ebp - 0x18270]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
jmp 0x8d2ecb
mov edx, dword [str.ESRem_Blocked]
mov eax, dword [0xace090]
mov ecx, dword [0xace094]
mov dword [ebp - 0x118], edx
mov dx, word [0xace098]
mov dword [ebp - 0x114], eax
mov eax, 1
mov dword [ebp - 0x110], ecx
mov word [ebp - 0x10c], dx
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0xd
jmp 0x8d2985
cmp dword [ebp - 0x18418], 0
jne 0x8d2a11
mov esi, dword [ebp - 0x183b8]
push 1
call fcn.008cbd10
add esp, 4
jmp 0x8d2a11
cmp dword [0xbd4ab8], 0
jne 0x8d2c34
cmp dword [0xbd4a90], 0
jne 0x8d2c34
cmp dword [0xbd0538], 0
je 0x8d2ecb
mov eax, str.regedit.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2c34
lea edi, [ebp - 0x4c8]
mov esi, str.regedt32.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d2ecb
mov esi, dword [ebp - 0x183c0]
test esi, esi
jne 0x8d2c53
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov esi, eax
cmp esi, 4
jbe 0x8d2c73
cmp byte [ebp - 0x6d0], 0
jne 0x8d2c73
push esi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
mov eax, str.cmd.
lea ecx, [ebp - 0x6d0]
call fcn.0094c3e0
test eax, eax
je 0x8d2d07
mov eax, str.taskmgr.
lea ecx, [ebp - 0x6d0]
call fcn.0094c3e0
test eax, eax
je 0x8d2d07
mov eax, str.sqlservr.
lea ecx, [ebp - 0x6d0]
call fcn.0094c3e0
test eax, eax
je 0x8d2d07
mov eax, str.w3wp.
lea ecx, [ebp - 0x6d0]
call fcn.0094c3e0
test eax, eax
je 0x8d2d07
mov eax, str.taskhost.
lea ecx, [ebp - 0x6d0]
call fcn.0094c3e0
test eax, eax
je 0x8d2d07
mov eax, str.explorer.
lea ecx, [ebp - 0x6d0]
call fcn.0094c3e0
test eax, eax
je 0x8d2d07
mov eax, str.runas.
lea ecx, [ebp - 0x6d0]
call fcn.0094c3e0
test eax, eax
jne 0x8d2e82
cmp dword [0xbd4a90], 0
je 0x8d2d25
lea ecx, [ebp - 0x6d0]
push ecx
push str.RestrictedEnvironment:_Date_Time_Modification_Disabled__ParentApp:_s_
lea edx, [ebp - 0xbe8]
push edx
jmp 0x8d2d56
cmp dword [0xbd4ab8], 0
je 0x8d2d43
lea eax, [ebp - 0x6d0]
push eax
push str.Date_Time_Modification_Disabled__ParentApp:_s_
lea ecx, [ebp - 0xbe8]
push ecx
jmp 0x8d2d56
lea edx, [ebp - 0x6d0]
push edx
push str.Regedit_Disabled__ParentApp:_s_
lea eax, [ebp - 0xbe8]
push eax
call fcn.00a78f30
add esp, 0xc
cmp dword [0xbd4ab8], 0
jne 0x8d2da1
cmp dword [0xbd4a90], 0
jne 0x8d2da1
mov ecx, dword [str.Regedit_Blocked]
mov edx, dword [0xace26c]
mov eax, dword [0xace270]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xace274]
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
jmp 0x8d2dd0
mov edx, dword [str.Control_Blocked]
mov eax, dword [0xace25c]
mov ecx, dword [0xace260]
mov dword [ebp - 0x118], edx
mov edx, dword [0xace264]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edx
mov eax, 1
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c8], eax
mov eax, str.regedit.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2e4d
mov eax, str.regedt32.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d2e4d
mov eax, str.cmd.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d2e29
mov dword [ebp - 0x183c4], 0x709
jmp 0x8d2e57
mov eax, str.powershell.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
neg eax
sbb eax, eax
and eax, 2
add eax, 0x70a
mov dword [ebp - 0x183c4], eax
jmp 0x8d2e57
mov dword [ebp - 0x183c4], 0x708
mov ecx, dword [ebp - 0x183b4]
push esi
lea eax, [ebp - 0x6d0]
push eax
push ecx
lea edx, [ebp - 0x358]
push edx
push str._CPL__App:__s:_u__Parent:__s:_u__TERMINATING_
push 0xffffffffffffffff
push 0x1000
lea eax, [ebp - 0x17270]
push eax
jmp 0x8d2eab
mov edx, dword [ebp - 0x183b4]
push esi
lea ecx, [ebp - 0x6d0]
push ecx
push edx
lea eax, [ebp - 0x358]
push eax
push str._CPL__App:__s:_u__Parent:__s:_u
push 0xffffffffffffffff
push 0x1000
lea ecx, [ebp - 0x17270]
push ecx
call fcn.00a78fcb
add esp, 0x20
push 0
push 1
lea edx, [ebp - 0x17270]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0x183bc], 0
jne 0x8d8478
cmp dword [0xbd4a84], 0
jne 0x8d31bf
cmp dword [ebp - 0x183e4], 0
jne 0x8d31bf
cmp dword [ebp - 0x18404], 0
jne 0x8d31bf
lea edi, [ebp - 0x4c8]
mov esi, str.netsh.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov eax, str.secapp.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d31bf
mov eax, 0xacb1bc
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d31bf
mov eax, str.powershell_ise.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d31bf
mov esi, str.sc.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, 0xacb1f8
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, 0xacb1cc
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, str.certutil.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, str.wuauclt.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, str.mshta.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, 0xacaea4
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
cmp dword [0xb3dc7c], 0
je 0x8d3046
mov esi, str.net.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, str.net1.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov eax, str.killproc.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d31bf
lea edi, [ebp - 0x4c8]
mov esi, str.regsvr32.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, str.msconfig.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, str.bcdedit.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, str.wbadmin.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov esi, str.msiexec.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov eax, 0xace358
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d31bf
mov eax, str.econceal.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d31bf
mov esi, str.drvinst.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov eax, str.BitLockerWizardElev.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d31bf
mov eax, str.Manage_bde.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d31bf
mov eax, str.adb.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d31bf
mov esi, str.at.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d31bf
mov eax, str.tor.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d31bf
mov eax, dword [ebp - 0x183b8]
push 0
push str.Tor_
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d31bf
mov esi, str.rundll32.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d55b7
push 0x8000
mov dword [ebp - 0x183d0], 0xffffffff
call fcn.00a7a155
mov ebx, eax
add esp, 4
mov dword [ebp - 0x183d8], ebx
test ebx, ebx
je 0x8d55b7
mov byte [ebx], 0
mov ecx, dword [ebp - 0x183b4]
push ecx
mov ecx, ebx
call fcn.0097b4b0
test eax, eax
jne 0x8d320d
push 9
call fcn.0089abe0
add esp, 4
test eax, eax
je 0x8d5468
cmp byte [ebx], 0
je 0x8d5468
push 0xfff
lea edx, [ebp - 0x56e7]
push 0
push edx
mov byte [ebp - 0x56e8], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x13ff
lea eax, [ebp - 0x15e6f]
push 0
push eax
mov byte [ebp - 0x15e70], 0
call fcn.00a7ffb0
add esp, 0xc
push 0xffe
lea ecx, [ebp - 0x56e8]
push ebx
push ecx
call fcn.00a7a620
add esp, 0xc
cmp byte [ebp - 0x46eb], 0
je 0x8d3275
mov byte [ebp - 0x46ea], 0
cmp dword [0xb3de98], 0
je 0x8d35d2
cmp dword [ebp - 0x18404], 0
je 0x8d35d2
cmp byte [ebp - 0x56e8], 0
je 0x8d35d2
push 0
lea edx, [ebp - 0x56e8]
push str.Shadow
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d32d2
push 0
lea eax, [ebp - 0x56e8]
push str.Delete
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3308
push 0
lea ecx, [ebp - 0x56e8]
push str.shadowstorage
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3342
push 0
lea edx, [ebp - 0x56e8]
push str.resize
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3342
mov ecx, dword [0xace3d0]
mov eax, dword [str.VSSAdmin_Blocked]
mov edx, dword [0xace3d4]
mov dword [ebp - 0x114], ecx
mov cl, byte [0xace3dc]
mov dword [ebp - 0x118], eax
mov eax, dword [0xace3d8]
mov byte [ebp - 0x108], cl
mov dword [ebp - 0x183cc], 0x20
jmp 0x8d33aa
lea edi, [ebp - 0x4c8]
mov esi, str.wbadmin.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d35d2
push eax
lea edx, [ebp - 0x56e8]
push str.Delete
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d35d2
mov eax, dword [str.WBAdmin_Blocked]
mov ecx, dword [0xace3e4]
mov edx, dword [0xace3e8]
mov dword [ebp - 0x118], eax
mov eax, dword [0xace3ec]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x183cc], 0x22
cmp dword [ebp - 0x183c0], 0
mov dword [ebp - 0x10c], eax
mov eax, 1
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x110], edx
jne 0x8d33ed
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov eax, dword [ebp - 0x183c0]
cmp eax, 4
jbe 0x8d3a7f
cmp byte [ebp - 0x6d0], 0
mov dword [ebp - 0x184b8], 0
jne 0x8d3435
push eax
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
cmp byte [ebp - 0x6d0], 0
mov ebx, 1
je 0x8d34d9
jmp 0x8d343a
mov ebx, 1
lea ecx, [ebp - 0x6d0]
push str.explorer.exe
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d34d9
lea edx, [ebp - 0x6d0]
push str.services.exe
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d34d9
lea eax, [ebp - 0x8d8]
lea edi, [ebp - 0x6d0]
call fcn.008cdd50
test eax, eax
jne 0x8d34d9
mov eax, dword [ebp - 0x183c0]
mov edx, dword [ebp - 0x183b4]
push eax
mov ecx, edi
push ecx
push edx
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x5c08]
push str._CPL__VSS_Parent__Process___s:_u__run_by_Parent___s:_u_._Blocking_both_current_and_parent_process.
push ecx
call fcn.00a78f30
add esp, 0x18
lea edx, [ebp - 0x184b8]
lea ecx, [ebp - 0x8d8]
mov dword [ebp - 0x18434], ebx
call fcn.008cb790
test eax, eax
je 0x8d34d9
lea edx, [ebp - 0x8d8]
push edx
call fcn.00a66b00
add esp, 4
mov edx, dword [ebp - 0x183c0]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x1841c], eax
cmp eax, 4
jbe 0x8d3a84
cmp byte [ebp - 0x1e48], 0
jne 0x8d3522
push eax
lea ecx, [ebp - 0x7698]
lea ebx, [ebp - 0x1e48]
call fcn.0097b130
cmp byte [ebp - 0x1e48], 0
mov ebx, 1
je 0x8d3a84
lea ecx, [ebp - 0x1e48]
push str.explorer.exe
push ecx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d3a84
lea edx, [ebp - 0x1e48]
push str.services.exe
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d3a84
lea eax, [ebp - 0x7698]
lea edi, [ebp - 0x1e48]
call fcn.008cdd50
test eax, eax
jne 0x8d3a84
mov eax, dword [ebp - 0x1841c]
mov edx, dword [ebp - 0x183c0]
push eax
mov ecx, edi
push ecx
push edx
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x7dc0]
push str._CPL__VSS_P2P__Process___s:_u__run_by_Parent___s:_u_._Blocking_both_parent_and_parent_to_parent_process.
push ecx
call fcn.00a78f30
add esp, 0x18
lea edx, [ebp - 0x184b8]
lea ecx, [ebp - 0x7698]
mov dword [ebp - 0x1845c], ebx
call fcn.008cb790
test eax, eax
je 0x8d3a84
lea edx, [ebp - 0x7698]
push edx
call fcn.00a66b00
add esp, 4
jmp 0x8d3a84
lea edi, [ebp - 0x4c8]
mov esi, str.wuauclt.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d3720
push eax
lea eax, [ebp - 0x56e8]
push str.UpdateDeploymentProvider
push eax
call fcn.0095c8c0
add esp, 0xc
push 0
lea ecx, [ebp - 0x56e8]
push str.RunHandlerComServer
push ecx
mov esi, eax
call fcn.0095c8c0
add esp, 0xc
mov edi, eax
cmp esi, 0xffffffff
je 0x8d3720
cmp edi, 0xffffffff
je 0x8d3720
mov eax, dword [ebp - 0x183c0]
test eax, eax
jne 0x8d364e
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
cmp eax, 4
jbe 0x8d366e
cmp byte [ebp - 0x6d0], 0
jne 0x8d366e
push eax
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
cmp esi, edi
jl 0x8d3674
mov esi, edi
lea edx, [ebp - 0x6d0]
push str.svchost.exe
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d3720
lea eax, [ebp - 0x6d0]
push str.MoUsoCoreWorker.exe
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d3720
push 0
lea esi, [ebp + esi - 0x56e8]
push str._system32_
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3720
push 0
push str.ClassId
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3720
lea ecx, [ebp - 0x56e8]
push ecx
call fcn.00a68f80
add esp, 4
test eax, eax
jne 0x8d3720
mov edx, dword [str.WUAuclt_Blocked]
mov eax, dword [0xace514]
mov ecx, dword [0xace518]
mov dword [ebp - 0x118], edx
mov edx, dword [0xace51c]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edx
jmp 0x8d37ec
lea edi, [ebp - 0x4c8]
mov esi, str.certutil.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d3a7f
push eax
lea eax, [ebp - 0x56e8]
push str.urlcache
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3818
push 0
lea ecx, [ebp - 0x56e8]
push str.split
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3818
push 0
lea edx, [ebp - 0x56e8]
push 0xace534
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d37b1
push 0
lea eax, [ebp - 0x56e8]
push 0xace538
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3818
mov ecx, dword [str.CertUtil_Blocked]
mov edx, dword [0xace540]
mov eax, dword [0xace544]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xace548]
mov dword [ebp - 0x114], edx
mov dl, byte [0xace54c]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], dl
mov eax, 1
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x23
mov ebx, eax
jmp 0x8d3a84
push 0
lea eax, [ebp - 0x56e8]
push str.decode
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3a7f
lea ecx, [ebp + eax - 0x56e8]
push 0x2e
push ecx
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
je 0x8d3a7f
push 0
push str..SCR
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..PIF
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..VBE
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..VBS
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push 0xace578
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..CPL
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..WSF
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..HTA
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..CMD
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..PS1
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..URL
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..CHM
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..SHTML
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push 0xace5c0
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d39d7
push 0
push str..JSON
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d39d7
push 0
push str..JSP
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3a40
push 0
push 0xace5d4
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..JSE
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..JAR
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push str..LNK
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3a40
push 0
push 0xace5f4
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3a7f
mov edx, dword [str.CertUtil_Blocked]
mov eax, dword [0xace540]
mov ecx, dword [0xace544]
mov dword [ebp - 0x118], edx
mov edx, dword [0xace548]
mov dword [ebp - 0x114], eax
mov al, byte [0xace54c]
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edx
mov byte [ebp - 0x108], al
jmp 0x8d37ec
mov ebx, 1
cmp dword [ebp - 0x183bc], 0
mov dword [ebp - 0x18440], 0
jne 0x8d3bbd
cmp dword [0xb3dc7c], 0
je 0x8d3bbd
lea edi, [ebp - 0x4c8]
mov esi, str.net.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d3ada
mov esi, str.net1.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d3bbd
push 0
lea ecx, [ebp - 0x56e8]
push str._Add
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3b61
push 0
lea edx, [ebp - 0x56e8]
push str._user
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3b2b
push 0
lea eax, [ebp - 0x56e8]
push 0xace60c
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d3b61
push 0
lea ecx, [ebp - 0x56e8]
push str._user
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3bbd
push 0
lea edx, [ebp - 0x56e8]
push str._admin
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3bbd
mov eax, dword [str.NetCmd_Blocked]
mov ecx, dword [0xace620]
mov edx, dword [0xace624]
mov dword [ebp - 0x118], eax
mov ax, word [0xace628]
mov dword [ebp - 0x114], ecx
mov cl, byte [0xace62a]
mov dword [ebp - 0x110], edx
mov word [ebp - 0x10c], ax
mov byte [ebp - 0x10a], cl
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x23
mov eax, 0xacb1bc
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d4a11
mov eax, str.powershell_ise.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d4a11
lea edi, [ebp - 0x4c8]
mov esi, 0xacb1cc
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d4a11
mov esi, str.mshta.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d4a11
mov esi, str.regsvr32.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d4a11
mov eax, str.svchost.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d3c5b
cmp dword [0xb3deb0], eax
jne 0x8d4a11
lea edi, [ebp - 0x4c8]
mov esi, 0xacb1f8
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d3c9b
cmp byte [ebp - 0x56e8], al
je 0x8d3c9b
push eax
lea edx, [ebp - 0x56e8]
push str.CREATE
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d4a11
lea edi, [ebp - 0x4c8]
mov esi, 0xacaea4
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d4a11
mov esi, str.msiexec.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d4026
lea eax, [ebp - 0x56e8]
push 0x20
push eax
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8d3d4f
lea ecx, [ebp - 0x18440]
push ecx
lea esi, [ebp - 0x56e8]
call fcn.008ccaa0
add esp, 4
test eax, eax
jne 0x8d3d4f
push eax
mov edx, esi
push 0xacc450
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d4026
push 0
mov eax, esi
push 0xace970
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d4026
push 0
mov ecx, esi
push str.http:
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d4026
push 0x3ff
lea edx, [ebp - 0x9f4f]
push 0
push edx
mov byte [ebp - 0x9f50], 0
call fcn.00a7ffb0
add esp, 0xc
lea eax, [ebp - 0x56e8]
push 0x20
push eax
call fcn.00a7a2c0
add esp, 8
test eax, eax
jne 0x8d3e6b
mov ecx, dword [ebp - 0x183b4]
push ecx
lea edx, [ebp - 0x358]
push edx
push str._CPL___s:_u_started_without_CmdLine_Param._Will_check_for_Miner_Activity...
push 0xffffffffffffffff
lea eax, [ebp - 0x9f50]
push 0x400
push eax
call fcn.00a78fcb
push 0
push 1
lea ecx, [ebp - 0x9f50]
push ecx
push 0xb54ce8
call fcn.008808e0
mov edx, dword [ebp - 0x183b4]
push edx
push 0
push 0x8edc40
call fcn.00a791b2
add esp, 0x34
push str.CBD_7mPP
xor ebx, ebx
mov esi, eax
call fcn.0085df20
add esp, 4
mov ebx, 1
cmp dword [ebp - 0x183bc], 0
je 0x8d5457
lea ecx, [ebp - 0x56e8]
push ecx
push str._CPL__TERM__CmdLine_Process___s_
push 0xffffffffffffffff
lea edx, [ebp - 0x15e70]
push 0x1400
push edx
mov dword [ebp - 0x183dc], ebx
call fcn.00a78fcb
add esp, 0x14
lea esi, [ebp - 0x15e70]
call fcn.009b7360
push 0
push ebx
mov eax, esi
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ebx, dword [ebp - 0x183d8]
mov esi, 1
mov edi, dword [ebp - 0x183b8]
push ebx
call fcn.00a78fec
add esp, 4
cmp dword [ebp - 0x183bc], 0
jne 0x8d73c4
jmp 0x8d55c2
xor esi, esi
cmp dword [0xbd4a90], esi
jne 0x8d3f15
cmp dword [0xbd0530], esi
jne 0x8d3f2a
lea eax, [ebp - 0x56e8]
push eax
call fcn.00a68f80
mov edi, eax
add esp, 4
test edi, edi
je 0x8d3eee
push 0x3ff
lea ecx, [ebp - 0xf417]
push esi
push ecx
mov byte [ebp - 0xf418], 0
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x56e8]
push edx
push str._CPL__CmdLine_Process___s__seems_to_be_PSFP_E_
push 0xffffffffffffffff
lea eax, [ebp - 0xf418]
push 0x400
push eax
call fcn.00a78fcb
add esp, 0x14
push esi
push ebx
lea ecx, [ebp - 0xf418]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov esi, ebx
test edi, edi
jne 0x8d3f09
mov edx, dword [ebp - 0x183b4]
push edx
lea eax, [ebp - 0x358]
push eax
push str._CPL___s:_u_started_with_suspected_miner_activity_parameter__Blocked_Now_
jmp 0x8d3f46
mov byte [ebp - 0x9f50], 0
jmp 0x8d3dec
mov edx, dword [ebp - 0x183b4]
push edx
lea eax, [ebp - 0x358]
push eax
push str._CPL___s:_u_started_with_restricted_parameter__Not_allowed_in_Restricted_Environment_
jmp 0x8d3f46
cmp dword [ebp - 0x18440], 0
jne 0x8d3f5c
mov edx, dword [ebp - 0x183b4]
push edx
lea eax, [ebp - 0x358]
push eax
push str._CPL___s:_u_started_with_restricted_parameter__Not_allowed_as_Software_Installation_Blocked_
push 0xffffffffffffffff
lea ecx, [ebp - 0x9f50]
push 0x400
push ecx
call fcn.00a78fcb
add esp, 0x18
cmp byte [ebp - 0x9f50], 0
je 0x8d3dec
push 0
push ebx
lea edx, [ebp - 0x9f50]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test esi, esi
je 0x8d3f9b
mov ecx, 6
mov esi, str.MSI_Miner_Activity_Blocked
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x8d4001
cmp dword [0xbd4a90], 0
je 0x8d3fbb
mov ecx, 5
mov esi, str.MSI_Control_Blocked_A_
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
jmp 0x8d4001
mov eax, dword [str.MSI_AppInstall_Block]
mov ecx, dword [0xaceb3c]
mov edx, dword [0xaceb40]
mov dword [ebp - 0x118], eax
mov eax, dword [0xaceb44]
mov dword [ebp - 0x114], ecx
mov ecx, dword [0xaceb48]
mov dword [ebp - 0x110], edx
mov dl, byte [0xaceb4c]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], ecx
mov byte [ebp - 0x104], dl
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x11
jmp 0x8d3df9
mov eax, 0xace358
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d4960
mov eax, str.econceal.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d4960
mov eax, str.secapp.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d4960
cmp dword [0xbd4ac0], 0
je 0x8d4118
mov eax, str.Manage_bde.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d40b7
mov eax, str.BitLockerWizardElev.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d40b7
mov eax, str.BitLockerWizard.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d4118
mov eax, dword [str.Bitlocker_Blocked]
mov ecx, dword [0xaceb70]
mov edx, dword [0xaceb74]
mov dword [ebp - 0x118], eax
mov eax, dword [0xaceb78]
mov dword [ebp - 0x114], ecx
mov cx, word [0xaceb7c]
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], eax
mov word [ebp - 0x108], cx
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x1b
jmp 0x8d3df9
cmp dword [0xbd4a98], 0
je 0x8d41c1
lea edi, [ebp - 0x4c8]
mov esi, str.drvinst.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d41c1
call fcn.008cbdd0
test eax, eax
jne 0x8d3dec
push eax
lea edx, [ebp - 0x56e8]
push str.USB_
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3dec
mov eax, dword [str.DrvInst_Blocked]
mov ecx, dword [0xaceb8c]
mov edx, dword [0xaceb90]
mov dword [ebp - 0x118], eax
mov eax, dword [0xaceb94]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x12
jmp 0x8d3df9
lea edi, [ebp - 0x4c8]
mov esi, str.at.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d4454
mov ecx, dword [ebp - 0x183d8]
cmp byte [ecx], al
je 0x8d3dec
lea edx, [ebp - 0x18400]
xor esi, esi
push edx
lea edi, [ebp - 0x9128]
mov dword [ebp - 0x18400], esi
call fcn.0095c700
add esp, 4
cmp dword [ebp - 0x18400], 0xffffffff
je 0x8d3dec
lea eax, [ebp - 0x9128]
push 0x5c
push eax
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8d42af
push 0x3ff
lea ecx, [ebp - 0xe3f7]
push esi
push ecx
mov dword [ebp - 0x18420], esi
mov byte [ebp - 0xe3f8], 0
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x9128]
push 0x5c
push edx
call fcn.00a7aa50
add esp, 8
cmp eax, esi
je 0x8d4273
add eax, ebx
push eax
lea eax, [ebp - 0xe3f8]
push eax
jmp 0x8d4281
lea ecx, [ebp - 0x9128]
push ecx
lea edx, [ebp - 0xe3f8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x9128]
push eax
lea ecx, [ebp - 0xe3f8]
push ecx
lea ecx, [ebp - 0x18420]
call fcn.00a691a0
add esp, 8
test eax, eax
je 0x8d42af
cmp dword [ebp - 0x18420], esi
jne 0x8d42dc
mov ecx, dword [ebp - 0x183d8]
lea edx, [ebp - 0x18400]
push edx
lea edi, [ebp - 0x9128]
call fcn.0095c700
add esp, 4
cmp dword [ebp - 0x18400], 0xffffffff
jne 0x8d4217
jmp 0x8d3dec
push 0x3ff
lea eax, [ebp - 0xc5cf]
push 0
push eax
mov byte [ebp - 0xc5d0], 0
call fcn.00a7ffb0
mov ecx, dword [ebp - 0x183d8]
add esp, 0xc
push ecx
push str._CPL__AT.EXE:_Schedule_Creation_Blocked___s_
push 0xffffffffffffffff
lea edx, [ebp - 0xc5d0]
push 0x400
push edx
mov dword [ebp - 0x18460], esi
call fcn.00a78fcb
add esp, 0x14
push 0
push ebx
lea eax, [ebp - 0xc5d0]
push eax
push 0xb54ce8
call fcn.008808e0
push 7
lea edi, [ebp - 0x18460]
lea esi, [ebp - 0x9128]
call fcn.008c0210
add esp, 0x14
cmp eax, ebx
jne 0x8d43eb
push 0x103
lea ecx, [ebp - 0x6237]
push 0
push ecx
mov byte [ebp - 0x6238], 0
call fcn.00a7ffb0
add esp, 0xc
mov edx, esi
push edx
lea eax, [ebp - 0xc5d0]
push str._MON__Deleting_suspicious_target_file_AT_A_:__s
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xc5d0]
push ecx
push 0xb54ce8
call fcn.008808e0
mov edx, dword [ebp - 0x183b4]
push edx
call fcn.008dbc10
add esp, 0x14
lea ebx, [ebp - 0x6238]
mov eax, esi
call fcn.008dbbb0
test eax, eax
jne 0x8d43eb
mov eax, ebx
push eax
mov ecx, esi
push ecx
lea edx, [ebp - 0xc5d0]
push str._MON__Failed_to_delete_file_AT_A_:__s___s_
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0xc5d0]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov ecx, dword [str.AT.EXE_Blocked]
mov edx, dword [0xacec28]
mov eax, dword [0xacec2c]
mov dword [ebp - 0x118], ecx
mov cx, word [0xacec30]
mov dword [ebp - 0x114], edx
mov dl, byte [0xacec32]
mov dword [ebp - 0x110], eax
mov eax, 1
mov word [ebp - 0x10c], cx
mov byte [ebp - 0x10a], dl
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x13
mov ebx, eax
jmp 0x8d3df9
lea edi, [ebp - 0x4c8]
mov esi, str.rundll32.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d4555
push 0x3ff
push eax
mov byte [ebp - 0xd1e0], al
lea eax, [ebp - 0xd1df]
push eax
call fcn.00a7ffb0
mov esi, dword [ebp - 0x183d8]
add esp, 0xc
push 5
push 0x400
lea ecx, [ebp - 0xd1e0]
push ecx
push ebx
call fcn.00a66bf0
add esp, 0x10
test eax, eax
je 0x8d450a
mov edx, dword [str.RunDLL32_Blocked]
mov eax, dword [0xacec38]
mov ecx, dword [0xacec3c]
mov dword [ebp - 0x118], edx
mov edx, dword [0xacec40]
mov dword [ebp - 0x114], eax
mov al, byte [0xacec44]
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edx
mov byte [ebp - 0x108], al
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x13
jmp 0x8d452c
push esi
push str._CPL__RunDLL32:_Approved_CmdLine_Process___s_
push 0xffffffffffffffff
lea ecx, [ebp - 0xd1e0]
push 0x400
push ecx
mov dword [ebp - 0x183e0], ebx
call fcn.00a78fcb
add esp, 0x14
cmp byte [ebp - 0xd1e0], 0
je 0x8d3dec
push 0
push ebx
lea edx, [ebp - 0xd1e0]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d3dec
lea edi, [ebp - 0x4c8]
mov esi, str.msconfig.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d461d
mov dword [ebp - 0x1846c], eax
lea eax, [ebp - 0x1846c]
push eax
push str.BlockMSConfig
mov ecx, 0xaa21e4
mov edx, 0x80000002
call fcn.0094c0d0
cmp dword [0xbd4a90], 0
movzx eax, al
je 0x8d45a8
mov dword [ebp - 0x1846c], ebx
jmp 0x8d45bd
cmp eax, ebx
jne 0x8d3dec
cmp dword [ebp - 0x1846c], 0
je 0x8d3dec
mov ecx, dword [str.MSConfig_Blocked]
mov edx, dword [0xacec8c]
mov eax, dword [0xacec90]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xacec94]
mov dword [ebp - 0x114], edx
mov dl, byte [0xacec98]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], dl
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x1c
jmp 0x8d3df9
lea edi, [ebp - 0x4c8]
mov esi, str.bcdedit.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d46bb
mov eax, dword [ebp - 0x183b4]
push eax
call fcn.008f4160
add esp, 4
test eax, eax
je 0x8d46bb
mov ecx, dword [str.BCDEdit_Blocked_A_]
mov edx, dword [0xaceca0]
mov eax, dword [0xaceca4]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xaceca8]
mov dword [ebp - 0x114], edx
mov dx, word [0xacecac]
mov dword [ebp - 0x110], eax
mov al, byte [0xacecae]
mov dword [ebp - 0x10c], ecx
mov word [ebp - 0x108], dx
mov byte [ebp - 0x106], al
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x15
jmp 0x8d3df9
cmp dword [0xb3de98], 0
je 0x8d481f
lea edi, [ebp - 0x4c8]
mov esi, str.bcdedit.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d481f
cmp byte [ebp - 0x56e8], al
je 0x8d481f
push eax
lea ecx, [ebp - 0x56e8]
push str._set
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d481f
push 0
lea edx, [ebp - 0x56e8]
push str.recoveryenabled
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d4746
push 0
lea eax, [ebp - 0x56e8]
push 0xacecc8
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d4784
push 0
lea ecx, [ebp - 0x56e8]
push str.bootstatuspolicy
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d481f
push 0
lea edx, [ebp - 0x56e8]
push str.ignoreallfailures
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d481f
cmp dword [ebp - 0x183c0], 0
jne 0x8d47a0
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp eax, dword [ebp - 0x183c0]
je 0x8d3dec
mov eax, dword [str.BCDEdit_Blocked_B_]
mov ecx, dword [0xacecf8]
mov edx, dword [0xacecfc]
mov dword [ebp - 0x118], eax
mov eax, dword [0xaced00]
mov dword [ebp - 0x114], ecx
mov cx, word [0xaced04]
mov dword [ebp - 0x110], edx
mov dl, byte [0xaced06]
mov dword [ebp - 0x10c], eax
mov word [ebp - 0x108], cx
mov byte [ebp - 0x106], dl
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x22
jmp 0x8d3df9
cmp dword [0xbd4aa0], 0
je 0x8d4884
mov eax, str.adb.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d4884
mov eax, dword [str.ADB_Blocked]
mov ecx, dword [0xaced0c]
mov edx, dword [0xaced10]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x14
jmp 0x8d3df9
cmp dword [0xbd4aac], 0
je 0x8d3dec
lea edi, [ebp - 0x4c8]
mov esi, str.netsh.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d3dec
push eax
lea eax, [ebp - 0x56e8]
push str.wlan
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3dec
push 0
lea ecx, [ebp - 0x56e8]
push 0xabf440
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3dec
push 0
lea edx, [ebp - 0x56e8]
push str.hostednetwork
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3dec
mov eax, dword [str.NetSh_Blocked]
mov ecx, dword [0xaced30]
mov edx, dword [0xaced34]
mov dword [ebp - 0x118], eax
mov ax, word [0xaced38]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], edx
mov word [ebp - 0x10c], ax
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x16
jmp 0x8d3df9
push 0
lea ecx, [ebp - 0x56e8]
push str._launch
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3dec
mov eax, str.secapp.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d49a9
lea edx, [ebp - 0x184c8]
push edx
push eax
mov eax, dword [ebp - 0x183b4]
push eax
push 0x8fa270
jmp 0x8d49e8
mov eax, 0xace358
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d49d3
mov edx, dword [ebp - 0x183b4]
lea ecx, [ebp - 0x184c8]
push ecx
push eax
push edx
push 0x8fa360
jmp 0x8d49e8
mov ecx, dword [ebp - 0x183b4]
lea eax, [ebp - 0x184c8]
push eax
push 0
push ecx
push 0x8fa450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x18408], eax
test eax, eax
je 0x8d3dec
lea edx, [ebp - 0x18408]
push edx
call fcn.00985290
jmp 0x8d3dec
mov esi, dword [ebp - 0x183c0]
xor eax, eax
mov dword [ebp - 0x18420], eax
mov dword [ebp - 0x18444], eax
cmp esi, eax
jne 0x8d4a3e
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov esi, eax
cmp esi, 4
jbe 0x8d4aa0
cmp byte [ebp - 0x6d0], 0
jne 0x8d4a63
push esi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
mov ebx, 1
cmp dword [ebp - 0x1841c], 0
jne 0x8d4aa0
xor ecx, ecx
mov edx, esi
call fcn.0097ceb0
mov dword [ebp - 0x1841c], eax
cmp eax, 4
jbe 0x8d4aa0
cmp byte [ebp - 0x1e48], 0
jne 0x8d4aa0
push eax
lea ecx, [ebp - 0x7698]
lea ebx, [ebp - 0x1e48]
call fcn.0097b130
mov ebx, 1
cmp dword [0xbd4a88], 0
je 0x8d4af2
mov eax, 0xacb1bc
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d4aec
mov eax, str.powershell_ise.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d4aec
push 0
lea ecx, [ebp - 0x56e8]
push str.powershell
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d4af2
mov dword [ebp - 0x18420], ebx
cmp dword [0xbc27fc], 0
je 0x8d4b4b
lea ecx, [ebp - 0x56e8]
call fcn.0094c3d0
add eax, 0x104
push eax
call fcn.00a7a155
mov esi, eax
add esp, 4
test esi, esi
je 0x8d4b4b
lea edx, [ebp - 0x56e8]
push edx
push str._CHK_PSF__A__CmdLine_Process___s_
push esi
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
push esi
push 0xb54ce8
call fcn.008808e0
push esi
call fcn.00a78fec
add esp, 0x14
lea ecx, [ebp - 0x18444]
push ecx
lea eax, [ebp - 0x56e8]
call fcn.00a68d00
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x8d4b8d
cmp dword [0xbd4ac0], eax
je 0x8d4b8d
push eax
lea edx, [ebp - 0x56e8]
push str.BitLocker
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d4b8d
mov ebx, 2
cmp dword [0xbc27fc], 0
je 0x8d4be8
push 0x103
lea eax, [ebp - 0x6867]
push 0
push eax
mov byte [ebp - 0x6868], 0
call fcn.00a7ffb0
mov ecx, dword [ebp - 0x18444]
add esp, 0xc
push ecx
push ebx
lea edx, [ebp - 0x6868]
push str._CHK_PSF__Result:_u__FP:_u
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x6868]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
test ebx, ebx
jne 0x8d504d
cmp byte [ebp - 0x1e48], bl
je 0x8d4d02
cmp dword [0xbd4ae0], ebx
jne 0x8d4d02
lea edi, [ebp - 0x4c8]
mov esi, str.wmiprvse.exe
lea ecx, [ebp - 0x1e48]
call fcn.008ce3a0
test eax, eax
jne 0x8d4d02
lea edx, [ebp - 0x56e8]
push edx
call fcn.00a68f80
add esp, 4
mov dword [ebp - 0x183d0], eax
test eax, eax
je 0x8d4c95
push 0x3ff
lea eax, [ebp - 0xfa1f]
push ebx
push eax
mov byte [ebp - 0xfa20], bl
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x56e8]
push ecx
push str._CPL__CmdLine_Process___s__seems_to_be_PSFP_A_
push 0xffffffffffffffff
lea edx, [ebp - 0xfa20]
push 0x400
push edx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea eax, [ebp - 0xfa20]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d4d02
mov esi, dword [ebp - 0x183c0]
mov edx, dword [ebp - 0x183b4]
push esi
lea ecx, [ebp - 0x6d0]
push ecx
push edx
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x5c08]
push str._CPL__PSInf_AA__Process___s:_u__run_by_Parent___s:_u_._Blocking_both_current_and_parent_process.
push ecx
mov ebx, 4
call fcn.00a78f30
mov edx, dword [ebp - 0x1841c]
push edx
lea eax, [ebp - 0x1e48]
push eax
push esi
lea ecx, [ebp - 0x6d0]
push ecx
lea edx, [ebp - 0x7dc0]
push str._CPL__PSInf_AA__Process___s:_u__run_by_Parent___s:_u_._Blocking_both_parent_and_parent_to_parent_process.
mov edi, 1
push edx
mov dword [ebp - 0x18434], edi
call fcn.00a78f30
add esp, 0x30
mov dword [ebp - 0x1845c], edi
cmp byte [ebp - 0x6d0], 0
je 0x8d4dc9
cmp dword [ebp - 0x18434], 0
jne 0x8d4dc9
cmp dword [0xbd4ae0], 0
jne 0x8d4dc9
lea edi, [ebp - 0x4c8]
mov esi, str.wmiprvse.exe
lea ecx, [ebp - 0x6d0]
call fcn.008ce3a0
test eax, eax
jne 0x8d4e77
cmp dword [ebp - 0x183d0], 0xffffffff
jne 0x8d4d65
lea eax, [ebp - 0x56e8]
push eax
call fcn.00a68f80
add esp, 4
mov dword [ebp - 0x183d0], eax
cmp dword [ebp - 0x183d0], 0
je 0x8d4f23
push 0x3ff
lea ecx, [ebp - 0x10027]
push 0
push ecx
mov byte [ebp - 0x10028], 0
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x56e8]
push edx
push str._CPL__CmdLine_Process___s__seems_to_be_PSFP_B_
push 0xffffffffffffffff
lea eax, [ebp - 0x10028]
push 0x400
push eax
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x10028]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test ebx, ebx
jne 0x8d504d
mov eax, str.svchost.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d4fb4
cmp dword [0xb3deb0], eax
je 0x8d4fb4
lea eax, [ebp - 0x8d8]
lea edi, [ebp - 0x6d0]
call fcn.008cdd50
test eax, eax
jne 0x8d4fb4
push 0x3ff
push eax
mov byte [ebp - 0xe7f8], al
lea eax, [ebp - 0xe7f7]
push eax
call fcn.00a7ffb0
add esp, 0xc
cmp byte [ebp - 0x6d0], 0
mov ebx, 6
je 0x8d4f67
mov ecx, dword [ebp - 0x183c0]
mov eax, dword [ebp - 0x183b4]
push ecx
lea edx, [ebp - 0x8d8]
push edx
push eax
lea ecx, [ebp - 0x358]
push ecx
push str._CPL___s:_u_started_by___s:_u__and_not_services.exe__Not_allowing_execution_
push 0xffffffffffffffff
lea edx, [ebp - 0xe7f8]
push 0x400
push edx
call fcn.00a78fcb
add esp, 0x20
jmp 0x8d4f97
mov eax, str.spoolsv.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
jne 0x8d4dc9
lea edi, [ebp - 0x4c8]
mov esi, str.regsvr32.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d4dc9
cmp dword [ebp - 0x183d0], 0xffffffff
jne 0x8d4ecb
lea edx, [ebp - 0x56e8]
push edx
call fcn.00a68f80
add esp, 4
mov dword [ebp - 0x183d0], eax
cmp dword [ebp - 0x183d0], 0
je 0x8d4f23
push 0x3ff
lea eax, [ebp - 0x1062f]
push 0
push eax
mov byte [ebp - 0x10630], 0
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x56e8]
push ecx
push str._CPL__CmdLine_Process___s__seems_to_be_PSFP_C_
push 0xffffffffffffffff
lea edx, [ebp - 0x10630]
push 0x400
push edx
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea eax, [ebp - 0x10630]
push eax
jmp 0x8d4dbc
mov ecx, dword [ebp - 0x183c0]
mov eax, dword [ebp - 0x183b4]
push ecx
lea edx, [ebp - 0x6d0]
push edx
push eax
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0x5c08]
push str._CPL__PSInf_AA__Process___s:_u__run_by_Parent___s:_u_._Blocking_both_current_and_parent_process.
push edx
mov ebx, 5
call fcn.00a78f30
add esp, 0x18
mov dword [ebp - 0x18434], 1
jmp 0x8d504d
mov eax, dword [ebp - 0x183c0]
mov ecx, dword [ebp - 0x183b4]
push eax
push ecx
lea edx, [ebp - 0x358]
push edx
push str._CPL___s:_u_started_by__NON_EXISTENT_PROCESS:_u__and_not_services.exe__Not_allowing_execution_
push 0xffffffffffffffff
lea eax, [ebp - 0xe7f8]
push 0x400
push eax
call fcn.00a78fcb
add esp, 0x1c
push 0
push 1
lea ecx, [ebp - 0xe7f8]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d504d
cmp dword [0xb3dc7c], 0
je 0x8d504d
push 0
lea edx, [ebp - 0x56e8]
push str._Add
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d504d
push 0
lea eax, [ebp - 0x56e8]
push str._net
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d5048
push 0
lea ecx, [ebp - 0x56e8]
push str.net.exe
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d5048
push 0
lea edx, [ebp - 0x56e8]
push str._net1
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d5048
push 0
lea eax, [ebp - 0x56e8]
push str.net1.exe
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d504d
mov ebx, 7
cmp dword [0xbc27fc], 0
je 0x8d50ad
push 0x103
lea ecx, [ebp - 0x6447]
push 0
push ecx
mov byte [ebp - 0x6448], 0
call fcn.00a7ffb0
add esp, 0xc
push ebx
push str._PSInf_A____u
push 0xffffffffffffffff
lea edx, [ebp - 0x6448]
push 0x104
push edx
call fcn.00a78fcb
add esp, 0x14
push 0
mov esi, 1
push esi
lea eax, [ebp - 0x6448]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d50b2
mov esi, 1
cmp dword [ebp - 0x18420], 0
jne 0x8d5322
test ebx, ebx
je 0x8d5322
mov eax, 0xacb1bc
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d52aa
mov eax, str.powershell_ise.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d52aa
mov eax, str.mshta.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d5141
mov ecx, dword [str.MSHTA_Blocked]
mov edx, dword [0xace8e0]
mov eax, dword [0xace8e4]
mov dword [ebp - 0x118], ecx
mov cx, word [0xace8e8]
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], eax
mov word [ebp - 0x10c], cx
jmp 0x8d52f2
mov eax, 0xacb1cc
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d518e
mov eax, dword [0xace8f0]
mov edx, dword [str.SchTasks_Blocked]
mov ecx, dword [0xace8f4]
mov dword [ebp - 0x114], eax
mov al, byte [0xace8fc]
mov dword [ebp - 0x118], edx
mov edx, dword [0xace8f8]
mov dword [ebp - 0x110], ecx
mov byte [ebp - 0x108], al
jmp 0x8d52ec
mov eax, str.regsvr32.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d51e2
mov ecx, dword [str.RegSvr32_Blocked]
mov edx, dword [0xace904]
mov eax, dword [0xace908]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xace90c]
mov dword [ebp - 0x114], edx
mov dl, byte [0xace910]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
mov byte [ebp - 0x108], dl
jmp 0x8d52f2
mov eax, 0xacaea4
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d521e
mov eax, dword [str.Cmd_Blocked]
mov ecx, dword [0xace918]
mov edx, dword [0xace91c]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], edx
jmp 0x8d52f2
mov eax, 0xacb1f8
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d5265
mov eax, dword [str.WMIC_Blocked]
mov ecx, dword [0xace924]
mov edx, dword [0xace928]
mov dword [ebp - 0x118], eax
mov al, byte [0xace92c]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], edx
mov byte [ebp - 0x10c], al
jmp 0x8d52f2
mov eax, str.svchost.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d52f2
mov ecx, dword [str.SVCHost_Blocked]
mov edx, dword [0xace934]
mov eax, dword [0xace938]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xace93c]
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ecx
jmp 0x8d52f2
mov eax, dword [0xace8cc]
mov ecx, dword [0xace8d0]
mov edx, dword [str.PowerShell_Blocked]
mov dword [ebp - 0x114], eax
mov ax, word [0xace8d8]
mov dword [ebp - 0x110], ecx
mov cl, byte [0xace8da]
mov dword [ebp - 0x118], edx
mov edx, dword [0xace8d4]
mov word [ebp - 0x108], ax
mov byte [ebp - 0x106], cl
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x18464], esi
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0xf
mov ebx, 1
jmp 0x8d3df9
lea edi, [ebp - 0x4c8]
mov esi, str.regsvr32.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d3de7
mov edi, dword [ebp - 0x183d0]
cmp edi, 0xffffffff
jne 0x8d5362
lea edx, [ebp - 0x56e8]
push edx
call fcn.00a68f80
add esp, 4
mov dword [ebp - 0x183d0], eax
mov edi, eax
test edi, edi
je 0x8d53c3
push 0x3ff
lea eax, [ebp - 0x10c37]
push 0
push eax
mov byte [ebp - 0x10c38], 0
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x56e8]
push ecx
push str._CPL__CmdLine_Process___s__seems_to_be_PSFP_D_
push 0xffffffffffffffff
lea edx, [ebp - 0x10c38]
push 0x400
push edx
call fcn.00a78fcb
add esp, 0x14
push 0
mov esi, 1
push esi
lea eax, [ebp - 0x10c38]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d53c8
mov esi, 1
push 0
lea ecx, [ebp - 0x56e8]
push 0xaaa5d4
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d3de7
test edi, edi
jne 0x8d3de7
mov edx, dword [str.RegSvr32_Blocked]
mov eax, dword [0xace904]
mov ecx, dword [0xace908]
mov dword [ebp - 0x118], edx
mov edx, dword [0xace90c]
mov dword [ebp - 0x114], eax
mov al, byte [0xace910]
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edx
mov byte [ebp - 0x108], al
mov dword [ebp - 0x18464], esi
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x10
lea ebx, [edi + 1]
jmp 0x8d3df9
lea ecx, [ebp - 0x56e8]
push ecx
push str._CPL__CmdLine_Process___s_
jmp 0x8d3e05
lea edi, [ebp - 0x4c8]
mov esi, str.msiexec.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d5504
push 0x3ff
push eax
lea ecx, [ebp - 0x1123f]
push ecx
mov byte [ebp - 0x11240], al
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x358]
push edx
push str._CPL__GCMDFAIL____s_started_possibly_without_CmdLine_Param._Will_check_for_Miner_Activity...
push 0xffffffffffffffff
lea eax, [ebp - 0x11240]
push 0x400
push eax
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x11240]
push ecx
push 0xb54ce8
call fcn.008808e0
mov edx, dword [ebp - 0x183b4]
push edx
push 0
push 0x8edc40
call fcn.00a791b2
add esp, 0x1c
push str.CBD_7mPP
xor ebx, ebx
mov esi, eax
call fcn.0085df20
add esp, 4
jmp 0x8d3e3f
cmp dword [0xbd4ac0], 0
je 0x8d3e45
mov eax, str.Manage_bde.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d5551
mov eax, str.BitLockerWizardElev.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d5551
mov eax, str.BitLockerWizard.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d3e45
mov eax, dword [str.Bitlocker_Blocked]
mov ecx, dword [0xaceb70]
mov edx, dword [0xaceb74]
mov dword [ebp - 0x118], eax
mov eax, dword [0xaceb78]
mov dword [ebp - 0x114], ecx
mov cx, word [0xaceb7c]
mov esi, 1
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], eax
mov word [ebp - 0x108], cx
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x1f
jmp 0x8d3e4a
mov edi, dword [ebp - 0x183b8]
mov esi, 1
mov eax, dword [0xbd4ad4]
cmp eax, esi
je 0x8d55ec
cmp eax, 2
jne 0x8d5806
mov eax, str.Outlook.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d5806
push 0
push str.Office
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d56f8
mov eax, str.Winword.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d56f1
mov eax, str.Outlook.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d56f1
mov eax, str.mspub.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d56f1
mov eax, str.excel.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d56f1
mov eax, str.msaccess.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d56f1
mov eax, str.Frontpg.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d56f1
mov eax, str.visio.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d56f1
mov eax, str.EQNEDT32.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d56f1
mov eax, str.fltldr.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d56f1
mov eax, str.OneNote.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d56f1
mov eax, str.Powerpnt.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d56f8
mov esi, 1
jmp 0x8d5748
push 0
push 0xacee14
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d5714
mov esi, 2
jmp 0x8d5748
push 0
push 0xacee28
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d5806
mov eax, str.EQNEDT32.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d5806
lea esi, [eax + 4]
push 0x3ff
lea edx, [ebp - 0x11847]
push 0
push edx
mov byte [ebp - 0x11848], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0x183b4]
add esp, 0xc
push eax
push edi
push esi
push str._CPL__TERM__MSOffice_Process__u_:__s:_u
push 0xffffffffffffffff
lea ecx, [ebp - 0x11848]
push 0x400
push ecx
call fcn.00a78fcb
add esp, 0x1c
push 0
mov esi, 1
push esi
lea edx, [ebp - 0x11848]
push edx
push 0xb54ce8
call fcn.008808e0
mov eax, dword [str.MSOffice_App_Blocked]
mov ecx, dword [0xacee60]
mov edx, dword [0xacee64]
mov dword [ebp - 0x118], eax
mov eax, dword [0xacee68]
mov dword [ebp - 0x114], ecx
mov ecx, dword [0xacee6c]
mov dword [ebp - 0x110], edx
mov dl, byte [0xacee70]
add esp, 0x10
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], ecx
mov byte [ebp - 0x104], dl
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183cc], 0x17
jmp 0x8d73ba
mov eax, str.tor.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d5908
push 0
push str.Tor_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d5908
cmp dword [0xbd486c], 0
je 0x8d59e8
mov eax, str.SnippingTool.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d5870
mov eax, str.Screensketch.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d59e8
push 0x3ff
lea eax, [ebp - 0x11e4f]
push 0
push eax
mov byte [ebp - 0x11e50], 0
call fcn.00a7ffb0
mov ecx, dword [ebp - 0x183b4]
add esp, 0xc
push ecx
push edi
push str._CPL__TERM__Snipper_Process:__s:_u
push 0xffffffffffffffff
lea edx, [ebp - 0x11e50]
push 0x400
push edx
call fcn.00a78fcb
push 0
push esi
lea eax, [ebp - 0x11e50]
push eax
push 0xb54ce8
call fcn.008808e0
mov ecx, dword [str.Snipper_Blocked]
mov edx, dword [0xaceefc]
mov eax, dword [0xacef00]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xacef04]
add esp, 0x28
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183cc], 0x17
jmp 0x8d73b4
lea edx, [ebp - 0x1847c]
push edx
push str.BlockTor
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [ebp - 0x1847c], 0
call fcn.0094c0d0
cmp dword [0xbd4a90], 0
movzx eax, al
je 0x8d5941
mov dword [ebp - 0x1847c], esi
jmp 0x8d5956
cmp eax, esi
jne 0x8d59e8
cmp dword [ebp - 0x1847c], 0
je 0x8d59e8
push 0x3ff
lea eax, [ebp - 0x1324f]
push 0
push eax
mov byte [ebp - 0x13250], 0
call fcn.00a7ffb0
mov ecx, dword [ebp - 0x183b4]
add esp, 0xc
push ecx
push edi
push str._CPL__TERM__TOR_Process:__s:_u
push 0xffffffffffffffff
lea edx, [ebp - 0x13250]
push 0x400
push edx
call fcn.00a78fcb
push 0
push esi
lea eax, [ebp - 0x13250]
push eax
push 0xb54ce8
call fcn.008808e0
mov ecx, dword [str.TOR_Blocked]
mov edx, dword [0xaceea4]
mov eax, dword [0xaceea8]
add esp, 0x28
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183cc], 0x17
jmp 0x8d73ba
mov eax, str.svchost.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d5a04
mov dword [ebp - 0x18414], esi
jmp 0x8d5a1e
mov eax, str.dllhost.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d5a1e
mov dword [ebp - 0x1844c], esi
cmp dword [0xb3de28], 0
je 0x8d5a34
cmp dword [0xbd4a90], 0
je 0x8d5af0
mov eax, str.fsquirt.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d5a60
mov eax, str.obexsrv.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d5af0
push 0x3ff
lea ecx, [ebp - 0x13857]
push 0
push ecx
mov byte [ebp - 0x13858], 0
call fcn.00a7ffb0
mov edx, dword [ebp - 0x183b4]
add esp, 0xc
push edx
push edi
push str._CPL__TERM__Bluetooth_FileTransfer_Process:__s:_u
push 0xffffffffffffffff
lea eax, [ebp - 0x13858]
push 0x400
push eax
call fcn.00a78fcb
push 0
mov ebx, 1
push ebx
lea ecx, [ebp - 0x13858]
push ecx
push 0xb54ce8
call fcn.008808e0
mov ecx, 8
mov esi, str.Bluetooth_File_Transfer_Blocked
lea edi, [ebp - 0x118]
add esp, 0x28
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x183c8], ebx
mov dword [ebp - 0x183bc], ebx
mov dword [ebp - 0x183c4], 0x715
mov dword [ebp - 0x183cc], 0x18
jmp 0x8d73c4
cmp dword [0xb3dc84], 0
je 0x8d5f82
mov eax, str.werfault.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d5f82
push 0x8000
call fcn.00a7a155
mov esi, eax
add esp, 4
mov dword [ebp - 0x18460], esi
test esi, esi
je 0x8d5f82
mov byte [esi], 0
mov edx, dword [ebp - 0x183b4]
push edx
mov ecx, esi
call fcn.0097b4b0
test eax, eax
jne 0x8d5b59
push 0xe
call fcn.0089abe0
add esp, 4
test eax, eax
je 0x8d5f60
cmp byte [esi], 0
je 0x8d5f60
test byte [0xb3dc84], 2
je 0x8d5bd5
push 0
push 0xacef6c
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d5bd5
mov eax, dword [str.Werfault_Blocked]
mov ecx, dword [0xacef74]
mov edx, dword [0xacef78]
mov dword [ebp - 0x118], eax
mov eax, dword [0xacef7c]
mov dword [ebp - 0x114], ecx
mov cl, byte [0xacef80]
mov dword [ebp - 0x10c], eax
mov eax, 1
mov dword [ebp - 0x110], edx
mov byte [ebp - 0x108], cl
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183c4], 0x71e
test byte [0xb3dc84], 1
je 0x8d5f60
push 0
push 0xacef84
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d5c10
push 0
push str.__p
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d5f60
lea esi, [eax + esi + 4]
xor eax, eax
mov byte [ebp - 0x3a4], 0
mov dword [ebp - 0x3a3], eax
mov dword [ebp - 0x39f], eax
mov dword [ebp - 0x39b], eax
mov dword [ebp - 0x397], eax
mov dword [ebp - 0x393], eax
mov dword [ebp - 0x38f], eax
mov dword [ebp - 0x38b], eax
mov word [ebp - 0x387], ax
mov byte [ebp - 0x385], al
mov cl, byte [esi]
test cl, cl
je 0x8d5c7d
lea eax, [ebp - 0x3a3]
mov edx, eax
sub esi, edx
mov dl, cl
sub dl, 0x30
cmp dl, 9
ja 0x8d5c7d
mov byte [eax - 1], cl
mov byte [eax], 0
mov cl, byte [esi + eax + 1]
inc eax
test cl, cl
jne 0x8d5c64
lea eax, [ebp - 0x3a4]
push eax
call fcn.00a79090
mov esi, eax
add esp, 4
cmp esi, 4
jbe 0x8d5f60
cmp dword [0xbf3f4c], esi
je 0x8d5f60
push 0x103
lea ecx, [ebp - 0x83ef]
push 0
push ecx
mov byte [ebp - 0x83f0], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0x2887]
push 0
push edx
mov byte [ebp - 0x2888], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x2577]
push 0
push eax
mov byte [ebp - 0x2578], 0
call fcn.00a7ffb0
xor eax, eax
add esp, 0xc
push eax
lea ecx, [ebp - 0x368]
push ecx
lea edx, [ebp - 0x2578]
push edx
mov dword [ebp - 0x367], eax
mov dword [ebp - 0x363], eax
mov dword [ebp - 0x35f], eax
mov word [ebp - 0x35b], ax
mov byte [ebp - 0x359], al
push 0x208
lea eax, [ebp - 0x83f0]
push eax
lea ecx, [ebp - 0x2888]
push ecx
push esi
mov byte [ebp - 0x368], 0
mov dword [0xbf3f4c], esi
call fcn.009bb790
add esp, 0x1c
cmp byte [ebp - 0x2888], 0
jne 0x8d5df9
push 0x103
lea edx, [ebp - 0x7aaf]
push 0
push edx
mov byte [ebp - 0x7ab0], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x3da7]
push 0
push eax
mov byte [ebp - 0x3da8], 0
call fcn.00a7ffb0
add esp, 0xc
push esi
lea ecx, [ebp - 0x3da8]
lea ebx, [ebp - 0x7ab0]
call fcn.0097b130
cmp byte [ebp - 0x3da8], 0
je 0x8d5dec
xor eax, eax
jmp 0x8d5dc0
mov cl, byte [ebp + eax - 0x3da8]
mov byte [ebp + eax - 0x2888], cl
inc eax
test cl, cl
jne 0x8d5dc0
push 0
push 0
push esi
lea edx, [ebp - 0x368]
lea ecx, [ebp - 0x2578]
call fcn.009b8130
add esp, 0xc
cmp byte [ebp - 0x2888], 0
je 0x8d5f60
lea ecx, [ebp - 0x2888]
push 0x5c
push ecx
call fcn.00a7aa50
mov edi, eax
add esp, 8
test edi, edi
je 0x8d5e13
inc edi
jmp 0x8d5e19
lea edi, [ebp - 0x2888]
mov al, byte [edi]
cmp al, 0x73
je 0x8d5e23
cmp al, 0x53
jne 0x8d5e9c
push str.SearchProtocolHost.exe
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d5e7d
push str.SearchFilterHost.exe
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d5e7d
push str.SearchIndexer.exe
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d5e7d
push str.SearchApp.exe
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d5e7d
push str.SearchUI.exe
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x8d5e9c
push 0
lea edx, [ebp - 0x2888]
push str.System32_
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d5f60
cmp byte [0xbf3f50], 0
jne 0x8d5ec9
push 0xb55918
push 0x104
push 0xbf3f50
push 0xab3780
push 0xab91c4
push str.Prompt
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x368]
push eax
lea ecx, [ebp - 0x2578]
push ecx
push esi
lea edx, [ebp - 0x2888]
push edx
push str._CPL__FAULT___s:_u__USER:_s___PROTO:_s_
push 0xffffffffffffffff
lea eax, [ebp - 0x13e60]
push 0x400
push eax
call fcn.00a78fcb
push 0
push 1
lea ecx, [ebp - 0x13e60]
push ecx
push 0xb54ce8
call fcn.008808e0
lea edx, [ebp - 0x368]
push edx
lea eax, [ebp - 0x2578]
push eax
push esi
lea ecx, [ebp - 0x2888]
push ecx
lea edx, [ebp - 0x13e60]
push str.AppFault____s:_u__USER:_s___PROTO:_s_
push edx
call fcn.00a78f30
add esp, 0x48
lea eax, [ebp - 0x13e60]
push eax
push 0xaa154c
push 0
push str.eScan_Monitor
push 0xd1
xor eax, eax
lea ecx, [ebp - 0x2888]
mov edx, 0xbf3f50
call fcn.00982dd0
mov ecx, dword [ebp - 0x18460]
push ecx
call fcn.00a78fec
add esp, 4
cmp dword [ebp - 0x183bc], 0
jne 0x8d73c4
mov edi, dword [ebp - 0x183b8]
cmp dword [0xbd4aa8], 1
jne 0x8d60cc
mov eax, str.control.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d5fcf
mov eax, str.SystemSettings.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d5fcf
mov eax, str.SystemSettingsAdminFlows.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d60cc
xor ebx, ebx
push 0x8000
mov dword [ebp - 0x183f4], ebx
call fcn.00a7a155
mov esi, eax
add esp, 4
test esi, esi
je 0x8d603f
mov byte [esi], bl
mov edx, dword [ebp - 0x183b4]
push edx
mov ecx, esi
call fcn.0097b4b0
test eax, eax
jne 0x8d600c
push 0xe
call fcn.0089abe0
add esp, 4
test eax, eax
je 0x8d6025
cmp byte [esi], 0
je 0x8d6025
push 1
lea edx, [ebp - 0x183f4]
mov ecx, esi
call fcn.008aa1c0
add esp, 4
mov ebx, eax
push esi
call fcn.00a78fec
add esp, 4
cmp dword [ebp - 0x183f4], 0
je 0x8d603f
test ebx, ebx
je 0x8d60cc
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0xbe8]
push str.Control_Panel_Blocked:_Exec_Accessed_via__s
push ecx
call fcn.00a78f30
mov edx, dword [str.Control_Blocked_D_]
mov eax, dword [0xacf0a4]
mov ecx, dword [0xacf0a8]
mov dword [ebp - 0x118], edx
mov edx, dword [0xacf0ac]
mov dword [ebp - 0x114], eax
mov ax, word [0xacf0b0]
mov dword [ebp - 0x110], ecx
mov cl, byte [0xacf0b2]
mov dword [ebp - 0x10c], edx
mov word [ebp - 0x108], ax
mov byte [ebp - 0x106], cl
mov eax, 1
add esp, 0xc
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x711
mov dword [ebp - 0x183cc], 0x18
jmp 0x8d73c4
cmp dword [0xbd4ad0], 0
je 0x8d626c
mov eax, 0xacb1bc
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d6105
mov eax, str.powershell_ise.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d626c
push 0x3ff
lea edx, [ebp - 0xcbd7]
push 0
push edx
mov ebx, 1
mov byte [ebp - 0xcbd8], 0
call fcn.00a7ffb0
add esp, 0xc
cmp dword [0xbd4ad0], 2
jne 0x8d61c3
push 0x8000
call fcn.00a7a155
mov esi, eax
add esp, 4
test esi, esi
je 0x8d61c3
mov byte [esi], 0
mov eax, dword [ebp - 0x183b4]
push eax
mov ecx, esi
call fcn.0097b4b0
test eax, eax
jne 0x8d616a
push 0xe
call fcn.0089abe0
add esp, 4
test eax, eax
je 0x8d61b2
cmp byte [esi], 0
je 0x8d61b2
push esi
call fcn.00a68f80
add esp, 4
test eax, eax
je 0x8d61b2
push esi
push str._CPL__Powershell_NOT_Blocked_as_CmdLine_part_of_FP:___s_
push 0xffffffffffffffff
lea ecx, [ebp - 0xcbd8]
push 0x400
push ecx
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0xcbd8]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor ebx, ebx
push esi
call fcn.00a78fec
add esp, 4
test ebx, ebx
je 0x8d626c
mov eax, dword [ebp - 0x183b4]
push eax
push edi
push str._CPL__TERM__Blocked_Powershell:__s:_u
push 0xffffffffffffffff
lea ecx, [ebp - 0xcbd8]
push 0x400
push ecx
call fcn.00a78fcb
push 0
mov esi, 1
push esi
lea edx, [ebp - 0xcbd8]
push edx
push 0xb54ce8
call fcn.008808e0
mov eax, dword [str.Powershell_Blocked]
mov ecx, dword [0xacf11c]
mov edx, dword [0xacf120]
mov dword [ebp - 0x118], eax
mov eax, dword [0xacf124]
mov dword [ebp - 0x114], ecx
mov cx, word [0xacf128]
mov dword [ebp - 0x110], edx
mov dl, byte [0xacf12a]
add esp, 0x28
mov dword [ebp - 0x10c], eax
mov word [ebp - 0x108], cx
mov byte [ebp - 0x106], dl
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183c4], 0x70a
mov dword [ebp - 0x183cc], 0x18
jmp 0x8d73c4
cmp dword [0xbd0530], 0
je 0x8d6378
mov eax, str.control.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d62b9
mov eax, str.SystemSettings.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d62b9
mov eax, str.SystemSettingsAdminFlows.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d6378
push 0x8000
xor edi, edi
call fcn.00a7a155
mov esi, eax
add esp, 4
test esi, esi
je 0x8d6378
mov byte [esi], 0
mov eax, dword [ebp - 0x183b4]
push eax
mov ecx, esi
call fcn.0097b4b0
test eax, eax
jne 0x8d62f5
push 0xe
call fcn.0089abe0
add esp, 4
test eax, eax
je 0x8d6314
cmp byte [esi], 0
je 0x8d6314
push 0
push str.appwiz.cpl
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d6314
mov edi, 1
push esi
call fcn.00a78fec
add esp, 4
test edi, edi
je 0x8d6378
lea ecx, [ebp - 0x358]
push ecx
lea edx, [ebp - 0xbe8]
push str.AppWiz_Blocked:_Exec_Accessed_via__s
push edx
call fcn.00a78f30
mov eax, dword [str.Control_Blocked_D1_]
mov ecx, dword [0xacf158]
mov edx, dword [0xacf15c]
mov dword [ebp - 0x118], eax
mov eax, dword [0xacf160]
mov dword [ebp - 0x114], ecx
mov ecx, dword [0xacf164]
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], ecx
jmp 0x8d609f
mov eax, str.control.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d641a
push 8
mov eax, str.rundll32
lea ecx, [ebp - 0x358]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8d641a
lea edi, [ebp - 0x4c8]
mov esi, str.netsh.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d641a
mov esi, str.mmc.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
je 0x8d641a
push 7
mov eax, str.regedit
lea ecx, [ebp - 0x358]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x8d641a
mov eax, str.SystemSettings.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d641a
cmp dword [ebp - 0x1844c], 0
jne 0x8d641a
cmp dword [ebp - 0x18414], 0
je 0x8d6de7
push 0x8000
call fcn.00a7a155
mov ebx, eax
add esp, 4
mov dword [ebp - 0x18408], ebx
test ebx, ebx
je 0x8d6e83
mov byte [ebx], 0
mov edx, dword [ebp - 0x183b4]
push edx
mov ecx, ebx
call fcn.0097b4b0
test eax, eax
jne 0x8d6456
push 0xa
call fcn.0089abe0
add esp, 4
mov ecx, ebx
mov esi, eax
call fcn.0094c3d0
test esi, esi
je 0x8d6d67
cmp byte [ebx], 0
je 0x8d6d99
cmp eax, 0x800
jae 0x8d6d99
cmp dword [0xbd4ab8], 0
mov dword [ebp - 0x183f4], 0
jne 0x8d64a6
cmp dword [0xbd4a90], 0
jne 0x8d64a6
mov esi, 1
cmp dword [0xbd4aa8], esi
jne 0x8d64dd
jmp 0x8d64ab
mov esi, 1
push 0
push str.timedate.cpl
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d6bef
push 0
push str.immersivecontrolpanel
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d6bef
mov eax, dword [0xb2745c]
test eax, eax
je 0x8d64eb
cmp eax, 2
jne 0x8d6567
push 0
push str.ncpa.cpl
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d6af1
push 0
push str.netconnections
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d6af1
mov eax, 0x8a2ca0
test eax, eax
jne 0x8d653e
push eax
push str.06622D85_6856_4460_8DE1_A81921B41C4B
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d6af1
lea edi, [ebp - 0x4c8]
mov esi, str.netsh.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d6567
mov esi, ebx
call fcn.008cc9e0
test eax, eax
jne 0x8d6af1
cmp dword [0xbd4a90], 0
mov edi, 1
jne 0x8d6581
cmp dword [0xbd4aa8], edi
jne 0x8d66b6
push 2
xor edx, edx
mov ecx, ebx
call fcn.008aa1c0
add esp, 4
test eax, eax
je 0x8d66b6
push 0
push str.ncpa.cpl
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d65c4
lea ecx, [ebp - 0x358]
push ecx
push str.RestrictedEnvironment:_Network_Modification_Disabled__ncpa.cpl_Accessed_via__s_
lea edx, [ebp - 0xbe8]
push edx
jmp 0x8d664e
push 0
push str.powercfg.cpl
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d65e7
lea eax, [ebp - 0x358]
push eax
push str.RestrictedEnvironment:_Power_Config_Modification_Disabled__powercfg.cpl_Accessed_via__s_
jmp 0x8d6647
push 0
push str.appwiz.cpl
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d6611
lea edx, [ebp - 0x358]
push edx
push str.RestrictedEnvironment:_App_Uninstall_Modify_Disabled__appwiz.cpl_Accessed_via__s_
lea eax, [ebp - 0xbe8]
push eax
jmp 0x8d664e
push 0
push 0xac3fac
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d663b
lea ecx, [ebp - 0x358]
push ecx
push str.RestrictedEnvironment:_CPL_Disabled__CPL_Accessed_via__s_
lea edx, [ebp - 0xbe8]
push edx
jmp 0x8d664e
lea eax, [ebp - 0x358]
push eax
push str.RestrictedEnvironment:_CPL_Disabled__Exec_Accessed_via__s_
lea ecx, [ebp - 0xbe8]
push ecx
call fcn.00a78f30
mov edx, dword [str.Control_Blocked_F_]
mov eax, dword [0xacf550]
mov ecx, dword [0xacf554]
mov dword [ebp - 0x118], edx
mov edx, dword [0xacf558]
mov dword [ebp - 0x114], eax
mov ax, word [0xacf55c]
mov dword [ebp - 0x110], ecx
mov cl, byte [0xacf55e]
mov dword [ebp - 0x10c], edx
mov word [ebp - 0x108], ax
mov byte [ebp - 0x106], cl
mov dword [ebp - 0x183bc], edi
mov dword [ebp - 0x183c8], edi
mov dword [ebp - 0x183c4], 0x711
jmp 0x8d6ccd
cmp dword [0xbd4af0], 0
je 0x8d678d
lea edi, [ebp - 0x4c8]
mov esi, str.mmc.exe
lea ecx, [ebp - 0x358]
call fcn.008ce3a0
test eax, eax
jne 0x8d6788
push 0x207
push eax
lea edx, [ebp - 0xb39f]
push edx
mov byte [ebp - 0xb3a0], al
call fcn.00a7ffb0
mov eax, dword [str.MMC_Blocked]
mov ecx, dword [0xacf564]
mov edx, dword [0xacf568]
add esp, 0xc
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x183b4]
push eax
mov dword [ebp - 0x114], ecx
mov ecx, dword [ebp - 0x183b8]
push ecx
push str._CPL__TERM__Force_Terminating_MMC_Process:__s:_u
push 0xffffffffffffffff
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xb3a0]
mov esi, 1
push 0x208
push edx
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x1d
call fcn.00a78fcb
push 0
push esi
lea eax, [ebp - 0xb3a0]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov edi, esi
jmp 0x8d6cd0
mov edi, 1
or esi, 0xffffffff
cmp dword [0xbd4af4], 0
jne 0x8d67c9
cmp dword [0xbd4ae4], 0
jne 0x8d67c9
cmp dword [0xbd4ae8], 0
je 0x8d67b4
cmp dword [0xb3deb4], 0
jne 0x8d67c9
cmp dword [0xbd4a90], 0
jne 0x8d67c9
cmp dword [0xbd4aa8], edi
jne 0x8d697e
push 0
push str.gpedit
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, esi
je 0x8d697e
cmp dword [0xbd4a90], 0
jne 0x8d6896
cmp dword [0xbd4aa8], edi
je 0x8d6896
cmp dword [0xbd4ae4], 0
jne 0x8d6860
cmp dword [0xbd4ae8], 0
jne 0x8d6860
cmp dword [0xbd4af4], 0
je 0x8d6902
push 0
push str.gpedit
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, esi
je 0x8d6837
push str.Device_Computer_Modification_Disabled__gpedit.msc_Accessed_
jmp 0x8d68f3
push 0
push str.compmgmt
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, esi
je 0x8d6902
push str.Device_Computer_Modification_Disabled__compmgmt.msc_Accessed_
lea edx, [ebp - 0xbe8]
push edx
jmp 0x8d68fa
push 0
push str.devmgmt
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, esi
je 0x8d6902
cmp dword [0xbd4ae8], 0
je 0x8d688f
push str.Device_Modification_Disabled_as_CD_DVD_Blocked__devmgmt.msc_Accessed_
lea eax, [ebp - 0xbe8]
push eax
jmp 0x8d68fa
push str.Device_Computer_Modification_Disabled__devmgmt.msc_Accessed_
jmp 0x8d68f3
push 0
push str.devmgmt
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, esi
je 0x8d68b8
push str.Device_Computer_Modification_Disabled__devmgmt.msc_Accessed_
lea edx, [ebp - 0xbe8]
push edx
jmp 0x8d68fa
push 0
push str.compmgmt
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, esi
je 0x8d68da
push str.Device_Computer_Modification_Disabled__compmgmt.msc_Accessed_
lea eax, [ebp - 0xbe8]
push eax
jmp 0x8d68fa
push 0
push str.diskmgmt
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, esi
je 0x8d6902
push str.Device_Computer_Modification_Disabled__diskmgmt.msc_Accessed_
lea ecx, [ebp - 0xbe8]
push ecx
call fcn.00a78f30
add esp, 8
mov edx, dword [str.Control_Blocked_G_]
mov eax, dword [0xacf710]
mov ecx, dword [0xacf714]
push 0
mov dword [ebp - 0x118], edx
mov edx, dword [0xacf718]
mov dword [ebp - 0x114], eax
mov ax, word [0xacf71c]
mov dword [ebp - 0x110], ecx
mov cl, byte [0xacf71e]
push str.compmgmt
push ebx
mov dword [ebp - 0x10c], edx
mov word [ebp - 0x108], ax
mov byte [ebp - 0x106], cl
mov dword [ebp - 0x183bc], edi
mov dword [ebp - 0x183c8], edi
call fcn.0095c8c0
xor edx, edx
add esp, 0xc
cmp eax, esi
setne dl
add edx, 0x70d
mov dword [ebp - 0x183c4], edx
jmp 0x8d6cd0
cmp dword [ebp - 0x18414], 0
je 0x8d6d2a
push 0
push str.__k
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, esi
je 0x8d6ab2
push 0x3ff
lea eax, [ebp - 0xbfc7]
push 0
push eax
mov dword [ebp - 0x183d0], 0
mov byte [ebp - 0xbfc8], 0
call fcn.00a7ffb0
lea ecx, [ebp - 0x183d0]
add esp, 0xc
push ecx
lea edi, [ebp - 0xbfc8]
mov ecx, ebx
call fcn.0095c700
add esp, 4
cmp dword [ebp - 0x183d0], esi
je 0x8d69fa
lea edx, [ebp - 0x183d0]
push edx
mov ecx, ebx
call fcn.0095c700
add esp, 4
mov byte [ebp - 0xbfc8], 0
cmp dword [ebp - 0x183d0], esi
je 0x8d6ab2
lea eax, [ebp - 0x183d0]
push eax
lea edi, [ebp - 0xbfc8]
mov ecx, ebx
call fcn.0095c700
add esp, 4
cmp byte [ebp - 0xbfc8], 0
je 0x8d6ab2
lea ecx, [ebp - 0x183d0]
push ecx
push str.SDRSVC_RPCSS_NetworkServiceNetworkRestricted_NetworkService_hpdevmgmt_dot3svc_eapsvcs_LocalServiceAndNoImpersonation_rpcss_LocalService_imgsvc_DcomLaunch_HTTPFilter_termsvcs_bthsvcs
mov bl, 0x2c
lea edi, [ebp - 0x7ec8]
mov dword [ebp - 0x183d0], 0
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x183d0], esi
je 0x8d6a99
nop
lea eax, [ebp - 0xbfc8]
lea ecx, [ebp - 0x7ec8]
call fcn.0094c330
test eax, eax
je 0x8d6ae5
lea edx, [ebp - 0x183d0]
push edx
push str.SDRSVC_RPCSS_NetworkServiceNetworkRestricted_NetworkService_hpdevmgmt_dot3svc_eapsvcs_LocalServiceAndNoImpersonation_rpcss_LocalService_imgsvc_DcomLaunch_HTTPFilter_termsvcs_bthsvcs
mov bl, 0x2c
lea edi, [ebp - 0x7ec8]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x183d0], esi
jne 0x8d6a60
cmp dword [0xb3deac], 0
je 0x8d6aac
mov dword [ebp - 0x18428], 1
mov ebx, dword [ebp - 0x18408]
cmp dword [ebp - 0x18414], 0
je 0x8d6d2a
cmp dword [ebp - 0x183f4], 0
push ebx
je 0x8d6cff
push str._CPL__PD__CmdLine_Process___s_
push 0xffffffffffffffff
push 0x1000
lea edx, [ebp - 0x12e50]
push edx
jmp 0x8d6d12
mov dword [ebp - 0x183f4], 1
jmp 0x8d6aac
lea eax, [ebp - 0x184f0]
push eax
push str.BlockNCPA
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [ebp - 0x184f0], 1
call fcn.0094c0d0
cmp dword [ebp - 0x184f0], 0
je 0x8d6ab2
mov eax, dword [0xacf328]
mov ecx, dword [str.IPChange_Blocked]
mov edx, dword [0xacf324]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xacf32c]
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x358]
push eax
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x114], edx
mov dl, byte [0xacf330]
lea ecx, [ebp - 0xbe8]
push str.IPChangeNotAllowed:_Network_Modification_Disabled__ncpa.cpl_Accessed_via__s_
push ecx
mov byte [ebp - 0x108], dl
call fcn.00a78f30
add esp, 0xc
push 0x207
lea edx, [ebp - 0xb7af]
mov edi, 1
push 0
push edx
mov dword [ebp - 0x183bc], edi
mov dword [ebp - 0x183c8], edi
mov dword [ebp - 0x183c4], 0x711
mov byte [ebp - 0xb7b0], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0x183b4]
mov ecx, dword [ebp - 0x183b8]
add esp, 0xc
push eax
push ecx
push str._CPL__TERM__Force_Terminating_Process:__s:_u__IP_Change_Not_Allowed_
push 0xffffffffffffffff
lea edx, [ebp - 0xb7b0]
push 0x208
push edx
call fcn.00a78fcb
push 0
push edi
lea eax, [ebp - 0xb7b0]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
jmp 0x8d6cd0
cmp dword [0xbd4a90], 0
push 0
push str.timedate.cpl
push ebx
je 0x8d6c30
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d6c1b
lea ecx, [ebp - 0x358]
push ecx
push str.RestrictedEnvironment:_Date_Time_Modification_Disabled__timedate.cpl_Accessed_via__s_
jmp 0x8d6c5e
lea eax, [ebp - 0x358]
push eax
push str.RestrictedEnvironment:_Date_Time_Modification_Disabled__immersivecontrolpanel_Accessed_via__s_
lea ecx, [ebp - 0xbe8]
push ecx
jmp 0x8d6c65
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d6c52
lea edx, [ebp - 0x358]
push edx
push str.Date_Time_Modification_Disabled__timedate.cpl_Accessed_via__s_
lea eax, [ebp - 0xbe8]
push eax
jmp 0x8d6c65
lea ecx, [ebp - 0x358]
push ecx
push str.Date_Time_Modification_Disabled__immersivecontrolpanel_Accessed_via__s_
lea edx, [ebp - 0xbe8]
push edx
call fcn.00a78f30
mov eax, dword [str.Control_Blocked_E_]
mov ecx, dword [0xacf2dc]
mov edx, dword [0xacf2e0]
mov dword [ebp - 0x118], eax
mov eax, dword [0xacf2e4]
mov dword [ebp - 0x114], ecx
mov cx, word [0xacf2e8]
mov dword [ebp - 0x110], edx
mov dl, byte [0xacf2ea]
mov dword [ebp - 0x10c], eax
mov word [ebp - 0x108], cx
mov byte [ebp - 0x106], dl
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183c8], esi
mov dword [ebp - 0x183c4], 0x70c
mov edi, 1
add esp, 0xc
push ebx
push str._CPL__CmdLine_Process___s___TERMINATING_
push 0xffffffffffffffff
lea eax, [ebp - 0x12e50]
push 0x1000
push eax
call fcn.00a78fcb
add esp, 0x14
lea esi, [ebp - 0x12e50]
call fcn.009b7360
push 0
push edi
jmp 0x8d6dbd
push str._CPL__NO_PD__CmdLine_Process___s_
push 0xffffffffffffffff
push 0x1000
lea eax, [ebp - 0x12e50]
push eax
call fcn.00a78fcb
add esp, 0x14
lea esi, [ebp - 0x12e50]
call fcn.009b7360
jmp 0x8d6db9
cmp dword [ebp - 0x183dc], 0
jne 0x8d6dd1
push ebx
push str._CPL__CmdLine_Process___s_
push 0xffffffffffffffff
lea edx, [ebp - 0x12e50]
push 0x1000
push edx
call fcn.00a78fcb
add esp, 0x14
lea esi, [ebp - 0x12e50]
call fcn.009b7360
push 0
push 1
mov eax, esi
push eax
jmp 0x8d6dc4
push str._CPL__GetProcessCmdLine_Failed_
push 0xffffffffffffffff
lea ecx, [ebp - 0x12e50]
push 0x1000
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x12e50]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8d6dd1
test eax, eax
jbe 0x8d6dd1
push eax
push str._CPL__GetProcessCmdLine_Success_but_CmdLineLen_very_large___u__
push 0xffffffffffffffff
lea eax, [ebp - 0x12e50]
push 0x1000
push eax
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x12e50]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push ebx
call fcn.00a78fec
add esp, 4
cmp dword [ebp - 0x183bc], 0
jne 0x8d73c4
mov eax, str.escanpro.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d6e18
push 8
mov eax, str.mwavscan
lea ecx, [ebp - 0x358]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x8d71cc
push 0x8000
call fcn.00a7a155
mov edi, eax
xor ebx, ebx
add esp, 4
cmp edi, ebx
je 0x8d71cc
mov byte [edi], bl
mov ecx, dword [ebp - 0x183b4]
push ecx
mov ecx, edi
call fcn.0097b4b0
cmp eax, ebx
jne 0x8d6e57
push 0xb
call fcn.0089abe0
add esp, 4
cmp eax, ebx
je 0x8d7104
cmp byte [edi], 0
je 0x8d71c3
push ebx
push str._pbx
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d6eb8
mov dword [ebp - 0x183f0], 1
jmp 0x8d71c3
push str._CPL__Malloc_Failed_
push 0xffffffffffffffff
lea edx, [ebp - 0x12e50]
push 0x1000
push edx
call fcn.00a78fcb
push 0
push 1
lea eax, [ebp - 0x12e50]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8d6de7
push ebx
push str._job
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d6f26
push ebx
push str._Sched
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d6f26
lea edx, [ebp - 0x184d4]
push edx
push str.CancelScanDisabled
mov ecx, str.SoftwareMicroWorldDeviceControl
mov edx, 0x80000002
mov dword [ebp - 0x184d4], ebx
call fcn.0094c0d0
cmp dword [ebp - 0x184d4], 1
jne 0x8d71c3
push ebx
push str.USBCTRL
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d71c3
lea esi, [ebp - 0x183dc]
mov dword [ebp - 0x183dc], ebx
call fcn.0095bbc0
test eax, eax
je 0x8d6feb
mov esi, dword [ebp - 0x183dc]
cmp esi, ebx
je 0x8d6fdf
cmp esi, 0xffffffff
je 0x8d6fdf
mov eax, dword [ebp - 0x183b4]
push eax
call fcn.009b7c60
add esp, 4
cmp eax, 2
je 0x8d6fdf
mov ecx, dword [ebp - 0x183b4]
mov edx, dword [ebp - 0x183b8]
push ecx
push edx
lea eax, [ebp - 0x3990]
push str.___Adding_to_Protected_List___s:_d_
push eax
mov dword [ebp - 0x1852c], ebx
call fcn.00a78f30
push ebx
push 1
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
push ebx
lea edx, [ebp - 0x1852c]
push edx
push ebx
push ebx
push 4
lea eax, [ebp - 0x183b4]
push eax
push 0x22e028
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 0x183b4]
push ecx
call fcn.009b7bb0
add esp, 4
push 0xbd62f0
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [ebp - 0x183dc]
push edx
call fcn.00985290
cmp dword [ebp - 0x183b4], ebx
jbe 0x8d71c3
cmp dword [0xb3dd9c], ebx
je 0x8d71c3
mov eax, dword [0xb3dd94]
dec eax
cmp eax, 0x61
ja 0x8d71c3
mov eax, str.mwavscan.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d703e
mov eax, str.mexe.com
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d71c3
mov ecx, dword [0xb3dd94]
mov edx, dword [ebp - 0x183b4]
mov eax, dword [ebp - 0x183b8]
push ecx
push edx
push eax
lea ecx, [ebp - 0x3990]
push str.___Limit_CPU_For_this_JOB_process___s:_u__to__u__
push ecx
call fcn.00a78f30
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x3990]
push edx
push 0xb54ce8
call fcn.008808e0
mov eax, dword [ebp - 0x183b4]
push eax
push 0
push 0x8cbcf0
call fcn.00a791b2
add esp, 0x1c
mov esi, eax
push str.CBD_7ePX
xor ebx, ebx
call fcn.0085df20
add esp, 4
cmp esi, 0xffffffff
jne 0x8d71c3
push 0x103
lea ecx, [ebp - 0x59ff]
push ebx
push ecx
mov byte [ebp - 0x5a00], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_y__fails_with_error__d
push esi
lea edx, [ebp - 0x5a00]
push 0x104
push edx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea eax, [ebp - 0x5a00]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d71c3
cmp dword [0xbd04f4], ebx
jne 0x8d71c3
mov ecx, dword [ebp - 0x183b4]
push ecx
lea edx, [ebp - 0x3b0]
push 0xaa1568
push edx
call fcn.00a78f30
add esp, 0xc
lea eax, [ebp - 0x3b0]
push eax
push 0
push 0x89ac40
call fcn.00a791b2
add esp, 0xc
mov esi, eax
push str.CBD_7f
xor ebx, ebx
call fcn.0085df20
add esp, 4
cmp esi, 0xffffffff
jne 0x8d71ac
push 0x103
lea ecx, [ebp - 0x58f7]
push ebx
push ecx
mov byte [ebp - 0x58f8], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_z__fails_with_error__d
push esi
lea edx, [ebp - 0x58f8]
push 0x104
push edx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea eax, [ebp - 0x58f8]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d71c3
cmp byte [ebp - 0x3b0], 0
je 0x8d71c3
call fcn.0094d150
cmp byte [ebp - 0x3b0], 0
jne 0x8d71b5
push edi
call fcn.00a78fec
add esp, 4
xor esi, esi
cmp dword [0xbd4a90], esi
jne 0x8d71e2
cmp dword [0xbd0530], esi
je 0x8d731b
push 0x103
lea ecx, [ebp - 0x80d7]
push esi
xor ebx, ebx
push ecx
mov byte [ebp - 0x80d8], bl
call fcn.00a7ffb0
mov edi, dword [ebp - 0x183b8]
add esp, 0xc
mov dword [ebp - 0x18504], esi
cmp byte [edi], 0x5c
jne 0x8d7230
cmp byte [edi + 1], 0x5c
jne 0x8d7230
push esi
push esi
push esi
lea edx, [ebp - 0x80d8]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8d7230
lea ebx, [eax + 1]
call fcn.00968110
test eax, eax
je 0x8d724a
lea edx, [ebp - 0x18504]
push edx
call fcn.009681c0
add esp, 4
mov esi, eax
xor edx, edx
mov ecx, edi
call fcn.0094d300
mov edi, eax
mov dword [ebp - 0x183ec], edi
mov dword [ebp - 0x183d4], 1
test esi, esi
je 0x8d7278
mov eax, dword [ebp - 0x18504]
push eax
call fcn.00968240
add esp, 4
cmp ebx, 1
jne 0x8d7283
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp edi, 3
jb 0x8d731b
cmp dword [0xbd4a90], 0
je 0x8d72a9
mov ecx, 7
mov esi, str.Zone_Restricted_Environment
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
jmp 0x8d72f1
mov ecx, dword [str.Zone_AppInstall_Block]
mov edx, dword [0xacf8d4]
mov eax, dword [0xacf8d8]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xacf8dc]
mov dword [ebp - 0x114], edx
mov edx, dword [0xacf8e0]
mov dword [ebp - 0x110], eax
mov ax, word [0xacf8e4]
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov word [ebp - 0x104], ax
mov eax, 1
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x712
mov dword [ebp - 0x183cc], 0x19
jmp 0x8d73c4
mov eax, str.whoami.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d73c4
cmp dword [ebp - 0x183c0], eax
jne 0x8d734e
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
cmp dword [ebp - 0x183c0], 4
jne 0x8d73c4
mov eax, dword [0xacf8fc]
mov edx, dword [0xacf8f8]
mov ecx, dword [str.SYSTEM_WhoAmI_Blocked]
mov dword [ebp - 0x110], eax
mov ax, word [0xacf908]
mov dword [ebp - 0x114], edx
mov edx, dword [0xacf904]
mov word [ebp - 0x104], ax
mov eax, 1
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xacf900]
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183cc], 0x2d
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x183c4], 0x710
cmp dword [ebp - 0x183e0], 0
jne 0x8d7705
cmp dword [ebp - 0x183bc], 0
jne 0x8d8478
cmp dword [0xb3de84], 0
je 0x8d7712
push 0
lea ecx, [ebp - 0x358]
push 0xacf90c
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d7712
mov edx, dword [ebp - 0x183b8]
push edx
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x18518]
mov dword [ebp - 0x18518], 0
call fcn.00a691a0
add esp, 8
test eax, eax
jne 0x8d749c
mov eax, str.netstat.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d749c
mov eax, str.findstr.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d749c
mov eax, str.cscript.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d749c
mov eax, str.wscript.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d749c
mov eax, str.rundll32.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d7712
mov edi, dword [ebp - 0x183c0]
test edi, edi
jne 0x8d74bb
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov edi, eax
cmp edi, 4
jbe 0x8d74db
cmp byte [ebp - 0x6d0], 0
jne 0x8d74e8
push edi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
cmp byte [ebp - 0x6d0], 0
je 0x8d7718
cmp dword [ebp - 0x18434], 0
jne 0x8d7718
mov eax, str.wmiprvse.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7521
mov eax, str.spoolsv.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
jne 0x8d7718
xor ebx, ebx
push 0x3ff
lea ecx, [ebp - 0xdff7]
push ebx
push ecx
mov byte [ebp - 0xdff8], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x8000
call fcn.00a7a155
mov esi, eax
add esp, 4
test esi, esi
je 0x8d7616
mov byte [esi], bl
mov edx, dword [ebp - 0x183b4]
push edx
mov ecx, esi
call fcn.0097b4b0
test eax, eax
jne 0x8d757b
push 0xe
call fcn.0089abe0
add esp, 4
test eax, eax
je 0x8d7605
cmp byte [esi], 0
je 0x8d7605
push esi
call fcn.00a68f80
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x8d7605
mov eax, str.wmiprvse.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
jne 0x8d75bd
push esi
push str._CPL__WMIPRVSE:_Approved_CmdLine_Process___s_
push 0xffffffffffffffff
push 0x400
lea eax, [ebp - 0xdff8]
push eax
jmp 0x8d75e5
mov eax, str.spoolsv.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
jne 0x8d75ed
push esi
push str._CPL__SPOOLSV:_Approved_CmdLine_Process___s_
push 0xffffffffffffffff
push 0x400
lea ecx, [ebp - 0xdff8]
push ecx
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0xdff8]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push esi
call fcn.00a78fec
add esp, 4
test ebx, ebx
jne 0x8d7718
mov ecx, dword [ebp - 0x183b4]
push edi
lea eax, [ebp - 0x6d0]
push eax
push ecx
lea edx, [ebp - 0x358]
push edx
lea eax, [ebp - 0x5c08]
push str._CPL__PSInf_BB__Process___s:_u__run_by_Parent___s:_u_._Blocking_both_current_and_parent_process.
push eax
call fcn.00a78f30
mov esi, 1
add esp, 0x18
mov eax, str.wmiprvse.exe
lea ecx, [ebp - 0x6d0]
mov dword [ebp - 0x18434], esi
call fcn.0094c330
test eax, eax
jne 0x8d7690
mov ecx, 5
mov esi, str.WMIPRVSE_Child_Blocked
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea esi, [eax + 1]
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x1d
jmp 0x8d846c
mov eax, str.spoolsv.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
jne 0x8d76ec
mov ecx, dword [str.SpoolSV_Child_Blocked]
mov edx, dword [0xacfa08]
mov eax, dword [0xacfa0c]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xacfa10]
mov dword [ebp - 0x114], edx
mov edx, dword [0xacfa14]
mov dword [ebp - 0x110], eax
mov ax, word [0xacfa18]
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov word [ebp - 0x104], ax
mov dword [ebp - 0x183c4], 0x710
mov dword [ebp - 0x183cc], 0x1d
jmp 0x8d846c
cmp dword [ebp - 0x183bc], 0
jne 0x8d8478
mov edi, dword [ebp - 0x183c0]
cmp dword [0xbd0648], 0
je 0x8d7940
push 0x103
lea ecx, [ebp - 0x2157]
push 0
push ecx
mov byte [ebp - 0x2158], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
xor esi, esi
lea edx, [ebp - 0x82e7]
push esi
push edx
mov byte [ebp - 0x82e8], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0x183b8]
xor ebx, ebx
add esp, 0xc
mov dword [ebp - 0x1850c], ebx
cmp byte [eax], 0x5c
jne 0x8d7795
mov ecx, eax
cmp byte [ecx + 1], 0x5c
jne 0x8d7795
push ebx
push ebx
push ebx
lea edx, [ebp - 0x82e8]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8d7795
lea esi, [ebx + 1]
call fcn.00968110
test eax, eax
je 0x8d77af
lea edx, [ebp - 0x1850c]
push edx
call fcn.009681c0
add esp, 4
mov ebx, eax
mov ecx, dword [ebp - 0x183b8]
lea eax, [ebp - 0x2158]
push eax
call 0x9e3850
add esp, 4
cmp dword [0xbc27fc], 0
je 0x8d7828
push 0x103
lea ecx, [ebp - 0x5f1f]
push 0
push ecx
mov byte [ebp - 0x5f20], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0x183b8]
add esp, 0xc
lea edx, [ebp - 0x2158]
push edx
push eax
push str._SHA2__FN:__s___SHA2:__s_
push 0xffffffffffffffff
lea ecx, [ebp - 0x5f20]
push 0x104
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x5f20]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
test ebx, ebx
je 0x8d783b
mov eax, dword [ebp - 0x1850c]
push eax
call fcn.00968240
add esp, 4
cmp esi, 1
jne 0x8d7846
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp byte [ebp - 0x2158], 0
je 0x8d7940
mov edi, dword [0xbd064c]
mov ebx, dword [0xbd0648]
lea ecx, [ebp - 0x2158]
push ecx
call fcn.00903e40
add esp, 4
test eax, eax
je 0x8d78d1
mov eax, dword [0xacfa3c]
mov edx, dword [str.SHA256_Hash_Blocked]
mov ecx, dword [0xacfa40]
mov dword [ebp - 0x114], eax
mov eax, dword [0xacfa48]
mov dword [ebp - 0x118], edx
mov edx, dword [0xacfa44]
mov dword [ebp - 0x108], eax
mov eax, 1
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x716
mov dword [ebp - 0x183cc], 0x2d
mov esi, dword [0xbd064c]
cmp edi, esi
mov edi, dword [0xbd0648]
jne 0x8d78e5
cmp ebx, edi
je 0x8d792d
push 0x103
lea ecx, [ebp - 0x612f]
push 0
push ecx
mov byte [ebp - 0x6130], 0
call fcn.00a7ffb0
add esp, 0xc
push esi
push edi
lea edx, [ebp - 0x6130]
push str._SHA2__C__SHA256Chk:_u__ItemCount:_u
push edx
call fcn.00a78f30
push 0
push 1
lea eax, [ebp - 0x6130]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
cmp dword [ebp - 0x183bc], 0
jne 0x8d8478
mov edi, dword [ebp - 0x183c0]
mov esi, dword [ebp - 0x183b8]
xor ebx, ebx
cmp dword [0xb3de90], ebx
jne 0x8d7971
cmp dword [0xbd4acc], ebx
je 0x8d7de0
mov eax, dword [0xbd0af0]
cmp eax, ebx
je 0x8d7de0
cmp byte [eax], bl
je 0x8d7de0
mov dword [ebp - 0x183dc], ebx
mov dword [ebp - 0x183e0], ebx
mov dword [ebp - 0x183e4], ebx
cmp edi, ebx
jne 0x8d799c
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov edi, eax
cmp edi, 4
jbe 0x8d79bc
cmp byte [ebp - 0x6d0], 0
jne 0x8d79cb
push edi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
cmp byte [ebp - 0x6d0], 0
je 0x8d7de0
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x8d8]
push str.Office
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d7acc
mov eax, str.Winword.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7abd
mov eax, str.mspub.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7abd
mov eax, str.excel.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7abd
mov eax, str.msaccess.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7abd
mov eax, str.Frontpg.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7abd
mov eax, str.visio.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7abd
mov eax, str.EQNEDT32.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7abd
mov eax, str.fltldr.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7abd
mov eax, str.OneNote.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7abd
mov eax, str.Powerpnt.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
jne 0x8d7acc
mov dword [ebp - 0x183dc], 1
jmp 0x8d7be3
push ebx
lea edx, [ebp - 0x8d8]
push 0xacee28
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d7b09
mov eax, str.EQNEDT32.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
jne 0x8d7b09
mov dword [ebp - 0x183dc], 1
jmp 0x8d7be3
push ebx
lea eax, [ebp - 0x8d8]
push str.Adobe
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d7b3d
push ebx
lea ecx, [ebp - 0x8d8]
push str.Acrobat
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d7b60
mov eax, str.acrord32.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
jne 0x8d7b60
mov dword [ebp - 0x183e0], 1
jmp 0x8d7be3
cmp dword [0xbd4acc], ebx
je 0x8d7baf
mov esi, dword [0xbd0af0]
test esi, esi
je 0x8d7baf
cmp byte [esi], 0
je 0x8d7baf
lea edx, [ebp - 0x6d0]
push edx
call fcn.0098d400
test eax, eax
je 0x8d7baf
lea eax, [ebp - 0x358]
push str.conhost.exe
push eax
call fcn.00a88f66
add esp, 8
test eax, eax
je 0x8d7dd4
mov dword [ebp - 0x183e4], 1
jmp 0x8d7be3
mov ecx, dword [ebp - 0x183b4]
push ecx
mov ecx, dword [ebp - 0x183c0]
lea edi, [ebp - 0x183e4]
lea edx, [ebp - 0x6d0]
lea eax, [ebp - 0x358]
call fcn.008f4380
add esp, 4
cmp dword [ebp - 0x183e4], 0
je 0x8d7dd4
mov edx, dword [ebp - 0x183b8]
push 0
push str.Office
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d7dd4
mov eax, dword [ebp - 0x183b8]
push 0
push str.Adobe
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d7dd4
mov ecx, dword [ebp - 0x183b8]
push 0
push str.Acrobat
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d7dd4
mov ecx, dword [ebp - 0x183b8]
push 1
push 1
lea edx, [ebp - 0x6d0]
push edx
lea eax, [ebp - 0x8d8]
push eax
lea edx, [ebp - 0x358]
call fcn.008cde60
add esp, 0x10
test eax, eax
jne 0x8d7dd4
cmp dword [ebp - 0x183dc], eax
je 0x8d7cb5
mov ecx, 6
mov esi, str.MSOffice_Child_EXE_Blocked
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 1
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x719
mov dword [ebp - 0x183cc], 0x28
jmp 0x8d8478
cmp dword [ebp - 0x183e0], 0
je 0x8d7d2e
mov eax, dword [0xacfab8]
mov ecx, dword [str.Adobe_Child_EXE_Blocked]
mov edx, dword [0xacfab4]
mov dword [ebp - 0x110], eax
mov eax, dword [0xacfac4]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xacfabc]
mov dword [ebp - 0x114], edx
mov edx, dword [0xacfac0]
mov dword [ebp - 0x104], eax
mov eax, 1
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x718
mov dword [ebp - 0x183cc], 0x29
jmp 0x8d8478
mov ecx, dword [ebp - 0x183e4]
test ecx, ecx
je 0x8d7dd4
mov eax, 1
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183cc], 0x29
cmp ecx, eax
jne 0x8d7d7d
mov ecx, 6
mov esi, str.Custom_Child_EXE_Blocked
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x183c4], 0x71d
jmp 0x8d8478
mov ecx, dword [str.WebShell_EXE_Blocked]
mov edx, dword [0xacfae8]
mov dword [ebp - 0x118], ecx
mov ecx, dword [0xacfaec]
mov dword [ebp - 0x114], edx
mov edx, dword [0xacfaf0]
mov dword [ebp - 0x110], ecx
mov ecx, dword [0xacfaf4]
mov dword [ebp - 0x10c], edx
mov dl, byte [0xacfaf8]
mov dword [ebp - 0x108], ecx
mov byte [ebp - 0x104], dl
mov dword [ebp - 0x183c4], 0x71f
jmp 0x8d8478
mov edi, dword [ebp - 0x183c0]
mov esi, dword [ebp - 0x183b8]
cmp dword [0xb3de88], 0
je 0x8d7f29
test edi, edi
jne 0x8d7e06
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov edi, eax
cmp edi, 4
jbe 0x8d7e26
cmp byte [ebp - 0x6d0], 0
jne 0x8d7e33
push edi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
cmp byte [ebp - 0x6d0], 0
je 0x8d7f29
mov eax, str.wscript.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
je 0x8d7e5f
mov eax, str.cscript.exe
lea ecx, [ebp - 0x6d0]
call fcn.0094c330
test eax, eax
jne 0x8d7f29
cmp dword [ebp - 0x183d4], 0
jne 0x8d7f29
xor edx, edx
mov ecx, esi
call fcn.0094d300
mov dword [ebp - 0x183ec], eax
mov dword [ebp - 0x183d4], 1
cmp eax, 3
jb 0x8d7f29
test edi, edi
jne 0x8d7ea7
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov edi, eax
cmp edi, 4
jbe 0x8d7ec7
cmp byte [ebp - 0x6d0], 0
jne 0x8d7ec7
push edi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
push 2
push 1
lea eax, [ebp - 0x6d0]
push eax
lea ecx, [ebp - 0x8d8]
push ecx
lea edx, [ebp - 0x358]
mov ecx, esi
call fcn.008cde60
add esp, 0x10
test eax, eax
jne 0x8d7f29
mov eax, 1
mov ecx, 8
mov esi, str.WScript_Cloud_Child_EXE_Blocked
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x71c
mov dword [ebp - 0x183cc], 0x2e
jmp 0x8d8478
cmp dword [0xbd4ac4], 0
jne 0x8d7f3f
cmp dword [0xbd4ac8], 0
je 0x8d8248
xor ebx, ebx
push 0x103
lea edx, [ebp - 0x84f7]
push ebx
push edx
mov dword [ebp - 0x183f4], ebx
mov byte [ebp - 0x84f8], bl
call fcn.00a7ffb0
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x18494], ebx
mov byte [ebp - 0x374], bl
mov dword [ebp - 0x373], eax
mov dword [ebp - 0x36f], eax
mov byte [ebp - 0x36b], al
cmp byte [esi], 0x5c
mov dword [ebp - 0x183e0], ebx
mov dword [ebp - 0x183dc], eax
jne 0x8d7fba
cmp byte [esi + 1], 0x5c
jne 0x8d7fba
push eax
push eax
push eax
lea edx, [ebp - 0x84f8]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8d7fba
mov dword [ebp - 0x183f4], 1
call fcn.00968110
test eax, eax
je 0x8d7fd8
lea eax, [ebp - 0x18494]
push eax
call fcn.009681c0
add esp, 4
mov dword [ebp - 0x183e0], eax
cmp dword [0xbd4ac4], 0
je 0x8d7ff9
cmp dword [ebp - 0x183d4], 0
jne 0x8d7ff9
xor edx, edx
mov ecx, esi
call fcn.0094d300
mov dword [ebp - 0x183ec], eax
cmp dword [0xbd4ac8], 0
je 0x8d80ac
mov al, byte [esi]
cmp al, 0x61
jl 0x8d8010
cmp al, 0x7a
jle 0x8d801e
mov cl, al
sub cl, 0x41
cmp cl, 0x19
ja 0x8d80ac
movsx edx, al
push edx
lea eax, [ebp - 0x374]
push str._c:_
push eax
call fcn.00a78f30
add esp, 0xc
lea eax, [ebp - 0x374]
call fcn.00966890
cmp eax, 2
jne 0x8d80ac
push esi
lea ecx, [ebp - 0x3ca0]
push ecx
mov dword [ebp - 0x183dc], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.TMP3344.TMP
lea edx, [ebp - 0x3ca0]
push edx
mov byte [ebp - 0x3c9d], 0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x3ca0]
push 0xaa1578
push eax
call fcn.00a7932f
add esp, 8
test eax, eax
je 0x8d80a7
push eax
call fcn.00a79e9e
add esp, 4
lea eax, [ebp - 0x3ca0]
call fcn.0094dd20
xor ebx, ebx
jmp 0x8d80ac
mov ebx, 1
cmp dword [ebp - 0x183e0], 0
je 0x8d80c4
mov ecx, dword [ebp - 0x18494]
push ecx
call fcn.00968240
add esp, 4
cmp dword [ebp - 0x183f4], 1
jne 0x8d80d3
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
test ebx, ebx
jne 0x8d8248
cmp dword [0xbd4ac4], ebx
je 0x8d80ec
cmp dword [ebp - 0x183ec], 3
jae 0x8d8106
cmp dword [0xbd4ac8], 0
je 0x8d8248
cmp dword [ebp - 0x183dc], 0
je 0x8d8248
test edi, edi
jne 0x8d811f
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov edi, eax
cmp edi, 4
jbe 0x8d813f
cmp byte [ebp - 0x6d0], 0
jne 0x8d813f
push edi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
push 4
push 1
lea edx, [ebp - 0x6d0]
push edx
lea eax, [ebp - 0x8d8]
push eax
lea edx, [ebp - 0x358]
mov ecx, esi
call fcn.008cde60
add esp, 0x10
test eax, eax
jne 0x8d8248
push 0x207
push eax
lea ecx, [ebp - 0xcddf]
push ecx
mov dword [ebp - 0x183e0], eax
mov byte [ebp - 0xcde0], al
call fcn.00a7ffb0
add esp, 0xc
push 0
lea edx, [ebp - 0xcde0]
push edx
push esi
or ecx, 0xffffffff
lea edx, [ebp - 0x183e0]
call fcn.00916ba0
add esp, 0xc
cmp eax, 1
jne 0x8d81b7
cmp dword [ebp - 0x183e0], 0
je 0x8d8248
cmp dword [0xb3de8c], 0
je 0x8d879d
xor edi, edi
push 0x13c
lea eax, [ebp - 0x183ac]
push edi
push eax
mov dword [ebp - 0x18514], edi
mov dword [ebp - 0x183b0], edi
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x183b0]
push edi
push ecx
lea edx, [ebp - 0x18514]
mov ecx, esi
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8d879d
lea ecx, [ebp - 0x183b0]
mov edx, esi
call fcn.0099c250
test eax, eax
je 0x8d8704
push esi
lea edx, [ebp - 0xf018]
push str._WHL__A__Allowing___s__as_it_is_whitelisted
push edx
call fcn.00a78f30
add esp, 0xc
push edi
push 1
lea eax, [ebp - 0xf018]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor edi, edi
cmp dword [0xbd4a90], edi
jne 0x8d825e
cmp dword [0xbd0530], edi
je 0x8d8478
push 0x103
lea edx, [ebp - 0x8707]
push edi
push edx
mov dword [ebp - 0x183f4], edi
mov byte [ebp - 0x8708], 0
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x184b4], edi
mov dword [ebp - 0x18470], edi
cmp byte [esi], 0x5c
mov dword [ebp - 0x183e0], edi
jne 0x8d82be
cmp byte [esi + 1], 0x5c
jne 0x8d82be
push edi
push edi
push edi
lea edx, [ebp - 0x8708]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8d82be
mov dword [ebp - 0x183f4], 1
call fcn.00968110
test eax, eax
je 0x8d82dc
lea eax, [ebp - 0x184b4]
push eax
call fcn.009681c0
add esp, 4
mov dword [ebp - 0x183e0], eax
mov edi, dword [ebp - 0x183b8]
push 0x80
push 3
push 3
push 0x80000000
call fcn.0094db00
add esp, 0x10
mov dword [ebp - 0x18530], eax
cmp eax, 0xffffffff
je 0x8d83de
mov esi, dword [ebp - 0x183f8]
push 0
push esi
push 0
push 2
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x18524], eax
test eax, eax
je 0x8d83d2
push esi
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
je 0x8d83c6
mov ebx, dword [ebp - 0x183b8]
push ebx
push 0
lea ecx, [ebp - 0x18470]
push ecx
push esi
mov ecx, edi
call fcn.00910ee0
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 0x18470]
test edi, edi
je 0x8d83c6
push 0x3ff
lea edx, [ebp - 0x14467]
push 0
push edx
mov byte [ebp - 0x14468], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0x183b4]
add esp, 0xc
push edi
push esi
push eax
push ebx
push str._CPL__Application_Installer___s:_u___fSize:_u__OLType:_u
push 0xffffffffffffffff
lea ecx, [ebp - 0x14468]
push 0x400
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x14468]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
lea eax, [ebp - 0x18524]
push eax
call fcn.00985290
lea ecx, [ebp - 0x18530]
push ecx
call fcn.00985290
cmp dword [ebp - 0x183e0], 0
je 0x8d83f6
mov edx, dword [ebp - 0x184b4]
push edx
call fcn.00968240
add esp, 4
mov esi, 1
cmp dword [ebp - 0x183f4], esi
jne 0x8d8409
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [ebp - 0x18470], 0
je 0x8d8478
mov eax, dword [str.EXE_AppInstall_Block]
mov ecx, dword [0xacfbf8]
mov edx, dword [0xacfbfc]
mov dword [ebp - 0x118], eax
mov eax, dword [0xacfc00]
mov dword [ebp - 0x114], ecx
mov ecx, dword [0xacfc04]
mov dword [ebp - 0x110], edx
mov dl, byte [0xacfc08]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], ecx
mov byte [ebp - 0x104], dl
mov dword [ebp - 0x183c4], 0x713
mov dword [ebp - 0x183cc], 0x19
mov dword [ebp - 0x183bc], esi
mov dword [ebp - 0x183c8], esi
cmp dword [ebp - 0x183e8], 0xf
je 0x8dadf7
cmp dword [ebp - 0x183bc], 0
jne 0x8d9cd6
cmp dword [ebp - 0x1840c], 0
jne 0x8d856a
cmp dword [0xb56828], 0
je 0x8d856a
cmp dword [0xb5682c], 0
jne 0x8d856a
cmp dword [0xb54190], 0
je 0x8d8544
cmp dword [0xbd5790], 0
jne 0x8d84d8
cmp dword [0xbd5794], 0
je 0x8d8528
mov eax, str.dllhost.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d8544
mov eax, str.explorer.exe
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d8544
mov eax, str.powershell.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d8544
mov eax, str.powershell_ise.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d8544
mov eax, dword [ebp - 0x183c0]
mov ecx, dword [ebp - 0x183b4]
push eax
push ecx
mov ecx, dword [ebp - 0x183b8]
call 0x9aab20
add esp, 8
cmp dword [0xb5418c], 0
je 0x8d856a
mov eax, dword [ebp - 0x183b8]
mov ecx, dword [ebp - 0x183b4]
lea edx, [ebp - 0x358]
push edx
push eax
push ecx
call fcn.009a4d90
add esp, 0xc
cmp dword [ebp - 0x183b8], 0
je 0x8d9cd6
mov edx, dword [ebp - 0x183b8]
cmp byte [edx], 0
je 0x8d9cd6
cmp dword [ebp - 0x183b4], 0
je 0x8d9cd6
cmp dword [ebp - 0x183f0], 0
jne 0x8d9cd6
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0x183f8], 0
je 0x8d9ce4
push 0x3ff
xor esi, esi
lea eax, [ebp - 0xd9ef]
push esi
push eax
mov byte [ebp - 0xd9f0], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x1c3f]
push esi
push ecx
mov dword [ebp - 0x183f4], esi
mov dword [ebp - 0x183d0], esi
mov dword [ebp - 0x183fc], esi
mov dword [ebp - 0x1840c], esi
mov dword [ebp - 0x183e0], esi
mov dword [ebp - 0x18444], esi
mov dword [ebp - 0x18420], esi
mov dword [ebp - 0x18440], esi
mov dword [ebp - 0x18408], esi
mov dword [ebp - 0x18430], esi
mov dword [ebp - 0x18400], esi
mov dword [ebp - 0x183e4], esi
mov dword [ebp - 0x183d4], esi
mov byte [ebp - 0x1c40], 0
call fcn.00a7ffb0
mov edi, dword [ebp - 0x183b8]
add esp, 0xc
push 0x5c
push edi
mov dword [ebp - 0x184e0], esi
mov dword [ebp - 0x183dc], esi
call fcn.00a7aa50
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x8d868c
push 0x5c
push edi
mov byte [ebx], 0
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
je 0x8d8684
push 0x5c
push edi
mov byte [esi], 0
call fcn.00a7aa50
add esp, 8
mov byte [esi], 0x5c
mov byte [ebx], 0x5c
test esi, esi
je 0x8d868c
inc esi
mov eax, str.setup.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d883f
test esi, esi
je 0x8d883f
mov al, byte [esi]
cmp al, 0x7b
jne 0x8d882b
lea ebx, [ebp - 0x14a70]
mov byte [ebp - 0x14a70], al
mov ecx, 1
lea eax, [esi + 1]
sub ebx, esi
lea esp, [esp]
mov dl, byte [eax]
cmp dl, 0x5c
je 0x8d86e4
mov byte [ebx + eax], dl
inc ecx
inc eax
cmp ecx, 0x3fe
jbe 0x8d86d0
lea esi, [ebp - 0x14a70]
mov byte [ebp + ecx - 0x14a70], 0
call fcn.0098d6c0
test eax, eax
je 0x8d883f
jmp 0x8d8835
push 0x103
lea ecx, [ebp - 0x3eaf]
push 0
push ecx
mov byte [ebp - 0x18429], 0
mov byte [ebp - 0x18421], 0
mov byte [ebp - 0x3eb0], 0
call fcn.00a7ffb0
add esp, 0xc
push 0
push 0
lea edx, [ebp - 0x3eb0]
push edx
xor ecx, ecx
mov edx, esi
call 0x98eaf0
cmp byte [ebp - 0x3eb0], 0
je 0x8d879d
push esi
lea edx, [ebp - 0x18421]
lea ecx, [ebp - 0x18429]
lea ebx, [ebp - 0x3eb0]
call fcn.0085a270
add esp, 4
lea ecx, [ebp - 0x183b0]
mov edx, esi
call fcn.0099c250
test eax, eax
je 0x8d879d
push esi
lea eax, [ebp - 0x14068]
push str._WHL__B__Allowing___s__as_it_is_whitelisted
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x14068]
push ecx
jmp 0x8d823b
cmp dword [0xbd4ac8], 0
je 0x8d87ec
cmp dword [ebp - 0x183dc], 0
je 0x8d87ec
mov ecx, 6
mov esi, str.Unsigned_USB_EXE_Blocked
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
mov eax, 1
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x717
mov dword [ebp - 0x183cc], 0x2a
jmp 0x8d8478
mov ecx, 6
mov esi, str.Unsigned_Cloud_EXE_Blocked
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, 1
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x183c8], eax
mov dword [ebp - 0x183bc], eax
mov dword [ebp - 0x183c4], 0x71b
mov dword [ebp - 0x183cc], 0x2c
jmp 0x8d8478
cmp al, 0x37
jne 0x8d883f
cmp byte [esi + 1], 0x7a
jne 0x8d883f
mov dword [ebp - 0x183dc], 1
mov eax, str.wget.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d8874
push eax
push str.wgwin_
push edi
call fcn.0095c8c0
add esp, 0xc
mov esi, 1
cmp eax, 0xffffffff
je 0x8d8879
mov dword [ebp - 0x1840c], esi
jmp 0x8d8879
mov esi, 1
push 0
push str.is_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d890c
push 0
push str..tmp_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d890c
cmp dword [ebp - 0x18410], 0
je 0x8d890c
mov eax, str.VSCodeSetup
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d8901
mov eax, str.gimp
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d8901
mov eax, str.vcredist
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d8901
lea edx, [ebp - 0x358]
push 0x2d
push edx
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8d9232
mov dword [ebp - 0x183e0], esi
jmp 0x8d9232
mov eax, str.avperf
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d893f
push eax
push str._avperf
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d893f
mov dword [ebp - 0x183f4], esi
jmp 0x8d922c
mov eax, 0xb56938
mov ecx, edi
call fcn.0094c3e0
test eax, eax
jne 0x8d8996
mov eax, str.Vmms.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d898b
mov eax, str.Vmwp.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d898b
mov eax, str.Vmsp.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d8996
mov dword [ebp - 0x18420], esi
jmp 0x8d9232
mov eax, str.msiexec.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d8ce2
mov eax, 0xb56938
mov ecx, edi
call fcn.0094c3e0
test eax, eax
je 0x8d89df
cmp dword [0xb56800], 0
je 0x8d8ce2
mov eax, 0xb56a40
mov ecx, edi
call fcn.0094c3e0
test eax, eax
jne 0x8d8ce2
push 0x207
lea eax, [ebp - 0xa157]
push 0
push eax
mov dword [ebp - 0x18410], 0
mov dword [ebp - 0x183ec], 0xffffffff
mov byte [ebp - 0xa158], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x8000
call fcn.00a7a155
mov edi, eax
add esp, 4
mov dword [ebp - 0x183f0], edi
test edi, edi
je 0x8d8bac
mov byte [edi], 0
mov ecx, dword [ebp - 0x183b4]
push ecx
mov ecx, edi
call fcn.0097b4b0
test eax, eax
jne 0x8d8a4c
push 0xd
call fcn.0089abe0
add esp, 4
cmp byte [edi], 0
mov dword [ebp - 0x18410], eax
je 0x8d8bac
push 0
push 0xacfc94
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d8bac
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x8d8a80
sub eax, edx
inc eax
push eax
call fcn.00a7a155
mov esi, eax
add esp, 4
test esi, esi
je 0x8d8bac
push esi
lea ebx, [ebp - 0x183d8]
mov ecx, edi
mov dword [ebp - 0x183d8], 0
call fcn.0095c630
add esp, 4
cmp dword [ebp - 0x183d8], 0xffffffff
je 0x8d8b8d
push esi
mov ecx, edi
call fcn.0095c630
add esp, 4
cmp dword [ebp - 0x183d8], 0xffffffff
je 0x8d8b8d
lea ecx, [ecx]
push 0
push 0xacfc98
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d8b11
push esi
lea ebx, [ebp - 0x183d8]
mov ecx, edi
call fcn.0095c630
add esp, 4
cmp dword [ebp - 0x183d8], 0xffffffff
jne 0x8d8ae0
jmp 0x8d8b8d
push 1
push esi
call fcn.00977760
mov ecx, esi
call fcn.0096cfa0
lea ebx, [ebp - 0x183ec]
mov ecx, esi
call fcn.008cdc80
push esi
push 0xaa1544
push 0xffffffffffffffff
lea edx, [ebp - 0xa158]
push 0x208
push edx
call fcn.00a78fcb
add esp, 0x14
cmp dword [0xbc27fc], 0
je 0x8d8b8d
mov eax, dword [ebp - 0x183ec]
push eax
lea ecx, [ebp - 0xa158]
push ecx
lea edx, [ebp - 0x3990]
push str.___MSIName___s___Sz___u_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
push 0
push eax
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
push esi
call fcn.00a78fec
mov eax, dword [ebp - 0x183ec]
add esp, 4
cmp eax, 0xffffffff
je 0x8d8bac
cmp eax, 0xa00000
jbe 0x8d8c8e
mov ecx, dword [ebp - 0x183b4]
mov eax, 1
lea edx, [ebp - 0x184e0]
mov dword [ebp - 0x18444], eax
mov dword [ebp - 0x183d0], eax
push edx
lea eax, [ebp - 0x1c40]
push eax
mov dword [ebp - 0x184e0], 0x104
call fcn.0097d510
cmp byte [ebp - 0x1c40], 0
je 0x8d8c8e
push 0x103
lea ecx, [ebp - 0x633f]
push 0
push ecx
mov byte [ebp - 0x6340], 0
call fcn.00a7ffb0
add esp, 0xc
cmp dword [0xbc27fc], 0
je 0x8d8c58
mov edx, dword [ebp - 0x183ec]
push edx
lea eax, [ebp - 0xa158]
push eax
lea ecx, [ebp - 0x1c40]
push ecx
lea edx, [ebp - 0x3990]
push str.___MSIExec_User:___s___MSI____s:_u
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push 0
push eax
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
lea edi, [ebp - 0x1c40]
call fcn.00979080
lea edi, [ebp - 0x6340]
call fcn.00988be0
mov edx, edi
push edx
lea eax, [ebp - 0x1c40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov edi, dword [ebp - 0x183f0]
test eax, eax
jne 0x8d8c8e
mov dword [ebp - 0x183d0], eax
cmp dword [0xbd069c], 0
je 0x8d8ccc
test edi, edi
je 0x8d9232
cmp dword [ebp - 0x18410], 0
je 0x8d8cc2
cmp byte [edi], 0
je 0x8d8ccc
push 0
push 0xacfc94
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d8ccc
mov dword [ebp - 0x183f8], 1
test edi, edi
je 0x8d9232
push edi
call fcn.00a78fec
add esp, 4
jmp 0x8d9232
mov eax, str.mscorsvw.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d8d1e
mov eax, str.ngentask.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d8d1e
mov eax, str.ngen.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d8d55
push 0
push str.Microsoft.NET_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d8d55
lea eax, [ebp - 0xd9f0]
mov edx, edi
call fcn.009563a0
test eax, eax
je 0x8d8d55
mov dword [ebp - 0x18440], esi
mov dword [ebp - 0x183f8], esi
jmp 0x8d922c
push 0
push str.Autodesk_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d8d7f
push 0
push str.Autodesk_Shared_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d8d9b
lea eax, [ebp - 0xd9f0]
mov edx, edi
call fcn.009563a0
test eax, eax
je 0x8d8d9b
mov dword [ebp - 0x18408], esi
jmp 0x8d9232
cmp dword [0xb56804], 0
je 0x8d8dc4
push 0
push str.Cluster_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d8dc4
mov dword [ebp - 0x18430], esi
jmp 0x8d9232
push 0
push str.COBOL
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d8e0c
mov eax, str.cblcored.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d8e01
mov eax, str.runw.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d8e0c
mov dword [ebp - 0x183e4], esi
jmp 0x8d9232
push 0
push str.Futuremark_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d9030
mov eax, str.FMSIScan.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.WebBrowser.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.DX10.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.MFFastXcode.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.PCMark7.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.FMSISvc.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.PCMark7Manager.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.MFPlayback.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.StorageTracePlayback.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.Firefly.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.WICImage.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.CNGCrypto.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.dxinfo.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.PCMark8Manager.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.FlushFileCache.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.WordProcessing.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.PhotoEditing.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.MFVideoChat.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.PCMark8.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.Browsing.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.TextEditing.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9019
mov eax, str.ListOpenCLDevices.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d9030
mov dword [ebp - 0x18400], esi
mov dword [0xbd0b0c], esi
mov dword [ebp - 0x183f8], esi
jmp 0x8d922c
push 0
push str.Office
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d9121
mov eax, str.Winword.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.Outlook.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.mspub.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.excel.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.msaccess.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.Frontpg.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.OneNote.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.Powerpnt.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.acrord32.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
push 0
push 0xacfeec
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d9232
mov eax, str.sbase.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.scalc.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.sdraw.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.simpress.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.smath.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.soffice.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.sweb.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.swriter.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.unopkg.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.unopkg.bin
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9226
mov eax, str.soffice.bin
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
jne 0x8d9232
mov dword [ebp - 0x183d4], esi
mov dword [ebp - 0x183d0], esi
cmp dword [ebp - 0x1840c], 0
jne 0x8d9986
cmp dword [ebp - 0x183e0], 0
jne 0x8d9986
cmp dword [ebp - 0x183dc], 0
jne 0x8d9986
cmp dword [ebp - 0x183f4], 0
jne 0x8d9986
cmp dword [ebp - 0x18444], 0
jne 0x8d9986
cmp dword [ebp - 0x18420], 0
jne 0x8d9986
mov eax, dword [ebp - 0x18440]
test eax, eax
jne 0x8d9907
cmp dword [ebp - 0x18408], eax
jne 0x8d9907
cmp dword [ebp - 0x18430], eax
jne 0x8d9907
cmp dword [ebp - 0x183e4], eax
jne 0x8d9907
cmp dword [ebp - 0x18400], eax
jne 0x8d9907
cmp dword [ebp - 0x183d4], eax
jne 0x8d9986
cmp dword [ebp - 0x18428], eax
jne 0x8d9986
mov edi, dword [ebp - 0x183b8]
push eax
xor esi, esi
mov ecx, edi
call fcn.008bb630
add esp, 4
test eax, eax
jne 0x8d993c
push eax
lea ecx, [ebp - 0x358]
call fcn.008bb630
add esp, 4
test eax, eax
jne 0x8d993c
mov ecx, edi
lea esi, [ebp - 0x358]
call fcn.008aed80
mov esi, 1
cmp eax, esi
je 0x8d993c
cmp dword [0xb8db2c], esi
jne 0x8d9342
mov eax, str.InetInfo.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d993c
cmp dword [0xb8daec], esi
jne 0x8d9618
push 0x207
lea ecx, [ebp - 0x708f]
push 0
push ecx
mov byte [ebp - 0x7090], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0x6d7f]
push 0
push edx
mov byte [ebp - 0x6d80], 0
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x185d8]
call fcn.0097f770
mov edi, dword [ebp - 0x183c0]
mov dword [ebp - 4], 0
xor eax, eax
jmp 0x8d93b0
mov cl, byte [ebp + eax - 0x6d0]
mov byte [ebp + eax - 0x7090], cl
inc eax
test cl, cl
jne 0x8d93b0
xor eax, eax
jmp 0x8d93d0
mov cl, byte [ebp + eax - 0x8d8]
mov byte [ebp + eax - 0x6d80], cl
inc eax
test cl, cl
jne 0x8d93d0
test edi, edi
jne 0x8d93f6
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov edi, eax
cmp edi, 4
jbe 0x8d9416
cmp byte [ebp - 0x7090], 0
jne 0x8d9416
push edi
lea ecx, [ebp - 0x6d80]
lea ebx, [ebp - 0x7090]
call fcn.0097b130
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xb8da58], eax
cmp edi, 4
jbe 0x8d95f9
lea ebx, [ebx]
cmp byte [ebp - 0x6d80], 0
je 0x8d95f9
cmp edi, 0xffffffff
je 0x8d95f9
push edi
lea eax, [ebp - 0x3bc]
push 0xaa1568
push eax
mov dword [ebp - 0x183f0], 0
call fcn.00a78f30
add esp, 0xc
push 1
push 0
lea ecx, [ebp - 0x3bc]
lea edx, [ebp - 0x185d8]
call fcn.0097faa0
test eax, eax
je 0x8d95f9
lea ecx, [ebp - 0x16270]
push ecx
push edi
call fcn.009b7e10
add esp, 8
cmp eax, 2
jne 0x8d94e7
mov eax, dword [ebp - 0x183b4]
lea edx, [ebp - 0x16270]
push edx
push eax
call fcn.009b7e10
add esp, 8
cmp eax, 2
je 0x8d94e7
mov esi, dword [ebp - 0x183b4]
mov ebx, dword [ebp - 0x183b8]
push 1
push 2
call fcn.008cab40
add esp, 8
mov dword [ebp - 0x183fc], 1
cmp eax, 1
je 0x8d95f9
mov dword [ebp - 0x183f0], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
xor esi, esi
lea ecx, [ebp - 0x6d80]
mov dword [0xb8da58], eax
call fcn.008bb630
add esp, 4
push esi
lea ecx, [ebp - 0x7090]
mov ebx, eax
call fcn.008bb630
add esp, 4
cmp ebx, 2
je 0x8d9569
cmp eax, 2
je 0x8d9569
cmp dword [ebp - 0x183f0], esi
jne 0x8d9569
xor ecx, ecx
mov edx, edi
mov byte [ebp - 0x7090], 0
mov byte [ebp - 0x6d80], 0
call fcn.0097ceb0
mov edi, eax
cmp edi, 4
jbe 0x8d95f9
cmp edi, 0xffffffff
je 0x8d9430
push edi
lea ecx, [ebp - 0x6d80]
lea ebx, [ebp - 0x7090]
call fcn.0097b130
jmp 0x8d9430
mov ecx, dword [ebp - 0x183b4]
push 0
push ecx
push 0
push 0x2000700
call dword [0xb8dac4]
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x183fc], 1
test esi, esi
jl 0x8d95cb
mov edx, dword [ebp - 0x183b4]
mov eax, dword [ebp - 0x183b8]
push edx
push eax
lea ecx, [ebp - 0x3990]
push str.___Process___s:_d__Registered_For_FSBP__2_
push ecx
call fcn.00a78f30
push 0
push 1
lea edx, [ebp - 0x3990]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8d95f9
mov eax, dword [ebp - 0x183b4]
mov ecx, dword [ebp - 0x183b8]
push eax
push ecx
lea edx, [ebp - 0x3990]
push str.___Process___s:_d__Registration_For_FSBP_Failed__2_
push edx
call fcn.00a78f30
push esi
lea esi, [ebp - 0x3990]
call fcn.008ab970
add esp, 0x14
lea ecx, [ebp - 0x185d8]
mov dword [ebp - 4], 0xffffffff
call fcn.0097f840
cmp dword [ebp - 0x183fc], 0
jne 0x8d9cb9
xor ebx, ebx
push 0x103
lea edx, [ebp - 0x267f]
push ebx
push edx
mov dword [ebp - 0x1840c], ebx
mov byte [ebp - 0x2680], bl
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x358]
call fcn.0094c3d0
mov edi, dword [ebp - 0x183b8]
mov dword [ebp - 0x184e8], ebx
cmp byte [edi], 0x5c
mov esi, eax
mov dword [ebp - 0x183f0], ebx
jne 0x8d9686
cmp byte [edi + 1], 0x5c
jne 0x8d9686
push ebx
push ebx
push ebx
lea edx, [ebp - 0x2680]
xor ecx, ecx
call fcn.009873e0
add esp, 0xc
test eax, eax
jne 0x8d9686
mov dword [ebp - 0x1840c], 1
call fcn.00968110
test eax, eax
je 0x8d96a4
lea eax, [ebp - 0x184e8]
push eax
call fcn.009681c0
add esp, 4
mov dword [ebp - 0x183f0], eax
mov ecx, edi
call fcn.0095a310
mov edi, eax
mov dword [ebp - 0x183d4], edi
cmp edi, 0xf00000
ja 0x8d981d
cmp edi, 0xe00000
jbe 0x8d96df
mov eax, str.jre_
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d981d
cmp edi, 0xc00000
jbe 0x8d96ff
mov eax, str.opera_
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d981d
lea ecx, [edi - 0xf4241]
cmp ecx, 0x7a11e
ja 0x8d9767
mov eax, 0xad00ac
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d9767
cmp esi, 0xa
je 0x8d972b
cmp esi, 0xe
jne 0x8d9767
mov al, byte [ebp - 0x356]
cmp al, 0x30
jl 0x8d9767
cmp al, 0x39
jg 0x8d9767
mov al, byte [ebp - 0x355]
cmp al, 0x30
jl 0x8d9767
cmp al, 0x39
jg 0x8d9767
mov al, byte [ebp - 0x354]
cmp al, 0x30
jl 0x8d9767
cmp al, 0x39
jg 0x8d9767
mov al, byte [ebp - 0x353]
cmp al, 0x30
jl 0x8d9767
cmp al, 0x39
jle 0x8d981d
cmp edi, 0xb71b00
jbe 0x8d9787
mov eax, str.MusicBee
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
je 0x8d981d
cmp edi, 0x299999
jbe 0x8d97bd
mov eax, str.npp.
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d97bd
push ebx
lea edx, [ebp - 0x358]
push str.install
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d981d
cmp edi, 0x3d0900
jbe 0x8d97f9
push ebx
lea eax, [ebp - 0x358]
push str.install
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d981d
push ebx
lea ecx, [ebp - 0x358]
push str.setup
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d981d
cmp edi, 0xc00000
jbe 0x8d9c92
mov eax, str.install_
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d9c92
push 0x207
lea edx, [ebp - 0x789f]
push ebx
push edx
mov dword [ebp - 0x183ec], ebx
mov dword [ebp - 0x18520], ebx
mov byte [ebp - 0x78a0], 0
call fcn.00a7ffb0
add esp, 0xc
xor edi, edi
xor eax, eax
lea esp, [esp]
mov cl, byte [ebp + eax - 0x358]
mov byte [ebp + eax - 0x78a0], cl
inc eax
test cl, cl
jne 0x8d9850
lea eax, [ebp - 0x78a0]
push 0x2e
push eax
call fcn.00a7aa50
add esp, 8
cmp eax, ebx
je 0x8d9b26
xor ebx, ebx
mov byte [eax], bl
mov al, byte [ebp - 0x78a0]
test al, al
je 0x8d9b26
movsx eax, al
call fcn.00957a70
test eax, eax
mov al, byte [ebp - 0x78a0]
jne 0x8d98b0
cmp al, 0x30
jl 0x8d9b26
cmp al, 0x39
jg 0x8d9b26
test al, al
je 0x8d9b26
lea esi, [ebp - 0x78a0]
mov edi, edi
movsx eax, byte [esi]
call fcn.00957a70
test eax, eax
jne 0x8d9b00
mov al, byte [esi]
mov cl, al
sub cl, 0x30
cmp cl, 9
jbe 0x8d9b00
test ebx, ebx
jne 0x8d9b0c
cmp al, 0x2e
je 0x8d98f4
cmp al, 0x5f
je 0x8d98f4
cmp al, 0x2d
jne 0x8d98f5
inc edi
cmp al, 0x2e
jne 0x8d9aea
mov ebx, 1
jmp 0x8d9b02
cmp dword [ebp - 0x183d4], 0
jne 0x8d9986
test eax, eax
jne 0x8d9986
cmp dword [ebp - 0x18408], eax
jne 0x8d9986
cmp dword [ebp - 0x18430], eax
jne 0x8d9986
cmp dword [ebp - 0x183e4], eax
jne 0x8d9986
cmp dword [ebp - 0x18400], eax
jne 0x8d9986
cmp dword [ebp - 0x18428], eax
jne 0x8d9986
mov eax, str.SBDDesktop.exe
lea ecx, [ebp - 0x358]
call fcn.0094c330
test eax, eax
je 0x8d9986
mov edi, dword [ebp - 0x183b8]
lea esi, [ebp - 0x358]
call fcn.008ccba0
test eax, eax
jne 0x8d9986
cmp dword [0xb8db2c], 1
jne 0x8d9a5c
mov eax, str.InetInfo.exe
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8d9a5c
mov eax, dword [ebp - 0x183d0]
mov esi, dword [ebp - 0x183b4]
mov ebx, dword [ebp - 0x183b8]
push eax
push 1
call fcn.008cab40
add esp, 8
cmp dword [ebp - 0x183d4], 0
mov edi, eax
je 0x8d9a54
mov ecx, dword [ebp - 0x183b4]
lea edx, [ebp - 0x18478]
push edx
push 0
push 0x8ca980
mov dword [ebp - 0x18478], ecx
call fcn.00a791b2
add esp, 0xc
mov esi, eax
push str.CBD_7g
xor ebx, ebx
call fcn.0085df20
add esp, 4
cmp esi, 0xffffffff
jne 0x8d9a3f
push 0x103
lea eax, [ebp - 0x654f]
push ebx
push eax
mov byte [ebp - 0x6550], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error:_beginthread_a1__fails_with_error__d
push esi
lea ecx, [ebp - 0x6550]
push 0x104
push ecx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea edx, [ebp - 0x6550]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d9a54
cmp dword [ebp - 0x18478], ebx
je 0x8d9a54
call fcn.0094d150
cmp dword [ebp - 0x18478], ebx
jne 0x8d9a47
test edi, edi
jne 0x8d9cb9
mov eax, dword [ebp - 0x183b4]
push 0
push eax
push 0
push 0x2000700
call dword [0xb8dac4]
mov esi, eax
add esp, 0x10
test esi, esi
jl 0x8d9ab7
mov ecx, dword [ebp - 0x183b4]
mov edx, dword [ebp - 0x183b8]
push ecx
push edx
lea eax, [ebp - 0x3990]
push str.___Process___s:_d__Registered_For_FSBP__1_
push eax
call fcn.00a78f30
push 0
push 1
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
jmp 0x8d9cb9
mov edx, dword [ebp - 0x183b4]
mov eax, dword [ebp - 0x183b8]
push edx
push eax
lea ecx, [ebp - 0x3990]
push str.___Process___s:_d__Registration_For_FSBP_Failed__1_
push ecx
call fcn.00a78f30
push esi
lea esi, [ebp - 0x3990]
call fcn.008ab970
add esp, 0x14
jmp 0x8d9cb9
cmp al, 0x5f
jne 0x8d9af5
mov ebx, 1
jmp 0x8d9b02
cmp al, 0x2d
jne 0x8d9b02
mov ebx, 1
jmp 0x8d9b02
xor ebx, ebx
inc esi
cmp byte [esi], 0
jne 0x8d98c0
cmp edi, 3
jb 0x8d9b26
mov esi, dword [ebp - 0x183d4]
mov dword [ebp - 0x183ec], 1
jmp 0x8d9bfa
mov eax, str.vlc_
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d9b64
push eax
lea edx, [ebp - 0x358]
push str._win32.exe
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d9b64
mov esi, dword [ebp - 0x183d4]
mov eax, 1
jmp 0x8d9c00
mov eax, 0xad00ac
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d9b85
mov esi, dword [ebp - 0x183d4]
mov eax, 1
jmp 0x8d9c00
mov eax, str.MusicBee
lea ecx, [ebp - 0x358]
call fcn.0094c3e0
test eax, eax
jne 0x8d9bbb
lea eax, [ebp - 0x358]
push 0x5f
push eax
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8d9bbb
mov esi, dword [ebp - 0x183d4]
mov eax, 1
jmp 0x8d9c00
mov esi, dword [ebp - 0x183d4]
cmp esi, 0x2400000
jbe 0x8d9bfa
mov edi, dword [ebp - 0x183b8]
push 0
push str.ProgramData_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8d9bfa
lea edx, [ebp - 0x18520]
mov ecx, edi
call fcn.008cb790
test eax, eax
mov eax, 1
je 0x8d9c00
mov eax, dword [ebp - 0x183ec]
mov byte [ebp - 0xd9f0], 0
test eax, eax
jne 0x8d9c35
mov edi, dword [ebp - 0x183b8]
lea eax, [ebp - 0xd9f0]
mov edx, edi
call fcn.009563a0
test eax, eax
je 0x8d9c92
mov ecx, dword [ebp - 0x183b4]
shr esi, 0x14
push esi
push ecx
push edi
push str.___Process___s:_d__Size:_u_Mb__Signed__Not_Verified____ForceBypass.
jmp 0x8d9c4c
mov eax, dword [ebp - 0x183b4]
mov ecx, dword [ebp - 0x183b8]
shr esi, 0x14
push esi
push eax
push ecx
push str.___Process___s:_d__Size:_u_Mb__ForceBypass.
lea edx, [ebp - 0x2680]
push edx
call fcn.00a78f30
add esp, 0x14
push 0
push 1
lea eax, [ebp - 0x2680]
push eax
push 0xb54ce8
call fcn.008808e0
mov esi, dword [ebp - 0x183b4]
mov ebx, dword [ebp - 0x183b8]
push 1
push 4
call fcn.008cab40
add esp, 0x18
mov dword [ebp - 0x183f8], 1
cmp dword [ebp - 0x183f0], 0
je 0x8d9caa
mov ecx, dword [ebp - 0x184e8]
push ecx
call fcn.00968240
add esp, 4
cmp dword [ebp - 0x1840c], 1
jne 0x8d9cb9
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
cmp dword [0xbd069c], 0
je 0x8d9cd6
cmp dword [ebp - 0x183f8], 0
je 0x8d9cd6
mov eax, dword [ebp - 0x183b4]
call fcn.00981140
xor ebx, ebx
cmp dword [ebp + 0xc], 1
jne 0x8da497
jmp 0x8d9ce6
xor ebx, ebx
mov eax, dword [ebp - 0x183b4]
cmp eax, ebx
je 0x8da4fb
cmp byte [ebp - 0xdf0], bl
je 0x8d9dca
lea edx, [ebp - 0xdf0]
push 0x5c
push edx
call fcn.00a7aa50
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x8d9d1a
inc esi
jmp 0x8d9d20
lea esi, [ebp - 0xdf0]
mov eax, str.mwavscan.
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8d9d40
mov eax, str.mexe.com
mov ecx, esi
call fcn.0094c3e0
test eax, eax
jne 0x8d9d78
call fcn.00987cf0
cdq
mov ecx, 0x3e8
idiv ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov ebx, 0xaa21e4
mov ecx, 0x80000002
add edx, esi
mov eax, edx
mov esi, str.ZRandTemp
call fcn.0094be90
xor ebx, ebx
mov eax, dword [ebp - 0x183b4]
push eax
lea edx, [ebp - 0xdf0]
push edx
push eax
lea eax, [ebp - 0x3990]
push str._CPL______u____s:_u__Process_Terminated
push eax
call fcn.00a78f30
add esp, 0x14
call fcn.00968790
test eax, eax
je 0x8d9ddf
push ebx
lea ecx, [ebp - 0xdf0]
push str.Clusterclussvc.exe
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8d9ddf
mov dword [ebp - 0x184d0], 1
jmp 0x8d9ddf
push eax
lea edx, [ebp - 0x3990]
push str._CPL______u__Process_Terminated
push edx
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea eax, [ebp - 0x3990]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb56828], ebx
je 0x8d9e34
cmp dword [0xb5682c], ebx
jne 0x8d9e34
cmp dword [0xb54190], ebx
je 0x8d9e1d
mov ecx, dword [ebp - 0x183b4]
push ecx
call 0x9aad60
add esp, 4
cmp dword [0xb5418c], ebx
je 0x8d9e34
mov edx, dword [ebp - 0x183b4]
push edx
call fcn.009a4f30
add esp, 4
mov eax, dword [0xbd62f0]
test eax, eax
jle 0x8d9ec4
lea esi, [ebp - 0x18428]
mov dword [ebp - 0x18428], ebx
call fcn.0095bbc0
test eax, eax
je 0x8d9ec4
mov esi, dword [ebp - 0x18428]
cmp esi, ebx
je 0x8d9eb8
cmp esi, 0xffffffff
je 0x8d9eb8
mov ecx, dword [ebp - 0x183b4]
push ecx
call fcn.009b7c60
add esp, 4
cmp eax, 2
jne 0x8d9eb8
push ebx
lea edx, [ebp - 0x1851c]
push edx
push ebx
push ebx
push 4
lea eax, [ebp - 0x183b4]
push eax
push 0x22e02c
push esi
mov dword [ebp - 0x1851c], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [ebp - 0x183b4]
push ecx
call fcn.009b7c10
add esp, 4
push 0xbd62f0
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea edx, [ebp - 0x18428]
push edx
call fcn.00985290
mov edi, dword [ebp - 0x183b4]
mov ecx, 1
call fcn.008ca9e0
mov eax, dword [ebp - 0x183b4]
push ebx
push eax
push ebx
push 0x2000701
call dword [0xb8dac4]
mov edi, eax
add esp, 0x10
cmp edi, ebx
jl 0x8d9f29
mov ecx, dword [ebp - 0x183b4]
push ecx
lea edx, [ebp - 0x3990]
push str.___Process_Id___d__De_Registered_From_FSBP
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push ebx
push eax
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8d9f53
mov edx, dword [ebp - 0x183b4]
push edx
lea eax, [ebp - 0x3990]
push str.___Process_Id___d__De_Registration_For_FSBP_Failed
push eax
call fcn.00a78f30
add esp, 0xc
push edi
lea esi, [ebp - 0x3990]
call fcn.008ab970
add esp, 4
cmp dword [0xb8db04], ebx
jne 0x8d9f67
cmp dword [0xb8db0c], ebx
je 0x8da198
mov esi, dword [ebp - 0x183b4]
cmp esi, ebx
jbe 0x8da198
push 0x103
lea ecx, [ebp - 0x57ef]
push ebx
push ecx
mov byte [ebp - 0x57f0], bl
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x57f0]
push edx
push esi
call fcn.009b7aa0
add esp, 8
cmp eax, 2
jne 0x8da198
mov eax, dword [ebp - 0x183b4]
cdq
push edx
push eax
push ebx
push 0x2000709
call dword [0xb8dac4]
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x8da03d
push 0x103
lea eax, [ebp - 0x40bf]
push ebx
push eax
mov byte [ebp - 0x40c0], bl
call fcn.00a7ffb0
add esp, 0xc
push esi
lea edx, [ebp - 0x40c0]
call fcn.008aaa40
mov ecx, dword [ebp - 0x183b4]
add esp, 4
lea edx, [ebp - 0x3990]
cmp byte [ebp - 0x40c0], bl
jne 0x8da00e
push edi
push ecx
push str.___Failed_To_Remove_New_Process_From_PFACC___u_._Reason:_0x_x
jmp 0x8da01b
lea eax, [ebp - 0x40c0]
push eax
push ecx
push str.___Failed_To_Remove_New_Process_From_PFACC___u_._Reason:__s
push edx
call fcn.00a78f30
add esp, 0x10
push ebx
push 1
lea eax, [ebp - 0x3990]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8da09e
mov ecx, dword [ebp - 0x183b4]
push ecx
call fcn.009b7750
add esp, 4
cmp dword [ebp - 0x18448], ebx
je 0x8da069
mov edx, dword [0xbd6300]
test edx, edx
jle 0x8da069
push 0xbd6300
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
call fcn.009b7930
push eax
mov eax, dword [ebp - 0x183b4]
push eax
lea ecx, [ebp - 0x3990]
push str.___Process_Id_Successfully_Removed_From_PFACC___u___PidC___u_
push ecx
call fcn.00a78f30
push ebx
push 1
lea edx, [ebp - 0x3990]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x20
mov eax, dword [ebp - 0x183b4]
cdq
push edx
push eax
push ebx
push 0x2000703
call dword [0xb8dac4]
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x8da14f
push 0x103
lea eax, [ebp - 0x42cf]
push ebx
push eax
mov byte [ebp - 0x42d0], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x44df]
push ebx
push ecx
mov byte [ebp - 0x44e0], bl
call fcn.00a7ffb0
add esp, 0xc
push esi
lea edx, [ebp - 0x42d0]
call fcn.008aaa40
mov edx, dword [ebp - 0x183b4]
add esp, 4
lea eax, [ebp - 0x44e0]
cmp byte [ebp - 0x42d0], bl
jne 0x8da131
push edi
push edx
push str.___Failed_To_Remove_New_Process_From_PRACC___d_._Reason:_0x_x
push eax
call fcn.00a78f30
add esp, 0x10
lea ecx, [ebp - 0x44e0]
jmp 0x8da170
lea ecx, [ebp - 0x42d0]
push ecx
push edx
push str.___Failed_To_Remove_New_Process_From_PRACC___d_._Reason:__s
push eax
call fcn.00a78f30
add esp, 0x10
lea ecx, [ebp - 0x44e0]
jmp 0x8da170
mov edx, dword [ebp - 0x183b4]
push edx
lea eax, [ebp - 0x3990]
push str.___Process_Id_Successfully_Removed_From_PRACC___d_
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x3990]
push ebx
push 1
push ecx
push 0xb54ce8
call fcn.008808e0
mov edx, dword [ebp - 0x183b4]
add esp, 0x10
push edx
lea ebx, [ebp - 0x57f0]
call fcn.009b7a50
add esp, 4
xor ebx, ebx
xor edi, edi
mov ecx, 0xad03bc
call fcn.009620b0
test eax, eax
jne 0x8da497
lea eax, [ebp - 0x3990]
push str.___VSS_Service_found_missing_
push eax
call fcn.00a78f30
push ebx
push 1
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
cmp dword [0xbf4054], ebx
jne 0x8da46f
mov dword [ebp - 0x183f0], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xbf4054], eax
xor eax, eax
jmp 0x8da200
mov cl, byte [eax + 0xb55508]
mov byte [ebp + eax - 0x2260], cl
inc eax
cmp cl, bl
jne 0x8da200
lea ecx, [ebp - 0x2260]
call fcn.00960910
lea eax, [ebp - 0x2260]
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x8da224
mov edx, dword [str.Services.reg]
mov ecx, dword [0xad03e4]
mov dword [eax], edx
mov edx, dword [0xad03e8]
mov dword [eax + 4], ecx
mov cl, byte [0xad03ec]
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
push ebx
push ebx
lea edx, [ebp - 0x183f0]
lea ecx, [ebp - 0x2260]
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8da468
cmp dword [ebp - 0x183f0], ebx
jbe 0x8da468
lea ecx, [ebp - 0x1840c]
lea edx, [ebp - 0x2260]
mov dword [ebp - 0x18448], ebx
mov dword [ebp - 0x1840c], ebx
call fcn.00978190
mov esi, dword [ebp - 0x1840c]
cmp esi, ebx
je 0x8da44b
mov cl, byte [esi]
cmp cl, 0xef
jne 0x8da2c8
cmp byte [esi + 1], 0xbb
jne 0x8da2c8
cmp byte [esi + 2], 0xbf
jne 0x8da2c8
dec eax
push eax
lea edx, [esi + 3]
push edx
push esi
call fcn.00a7be50
add esp, 0xc
jmp 0x8da325
cmp cl, 0xff
jne 0x8da399
cmp byte [esi + 1], 0xfe
jne 0x8da399
cmp byte [esi + 3], bl
jne 0x8da399
lea eax, [esi + 2]
mov dword [ebp - 0x18508], ebx
push eax
lea ebx, [ebp - 0x18508]
call fcn.00970520
add esp, 4
test eax, eax
je 0x8da323
mov edi, dword [ebp - 0x18508]
test edi, edi
je 0x8da323
mov edx, esi
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x8da310
push edi
call fcn.00a78fec
add esp, 4
xor ebx, ebx
push ebx
push str.CurrentControlSetServicesVSS_
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8da343
mov dword [ebp - 0x18448], 1
push esi
call fcn.00a78fec
add esp, 4
cmp dword [ebp - 0x18448], ebx
je 0x8da44b
lea ecx, [ebp - 0x3990]
push str.___Importing_services_from_Services.reg...
push ecx
call fcn.00a78f30
push ebx
push 1
lea edx, [ebp - 0x3990]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
lea edi, [ebp - 0x2260]
call fcn.0096ee40
test eax, eax
jne 0x8da3e8
push str.___Failed_to_import_services_from_Services.reg_
jmp 0x8da474
cmp cl, 0xfe
jne 0x8da325
cmp byte [esi + 1], 0xff
jne 0x8da325
cmp byte [esi + 2], bl
jne 0x8da325
add eax, 2
call fcn.00966e40
mov edi, eax
cmp edi, ebx
je 0x8da325
lea ecx, [esi + 2]
call fcn.00906b00
mov eax, esi
mov ecx, edi
sub eax, edi
lea ecx, [ecx]
mov dl, byte [ecx]
mov byte [ecx + eax], dl
inc ecx
cmp dl, bl
jne 0x8da3d0
push edi
call fcn.00a78fec
add esp, 4
jmp 0x8da325
lea edx, [ebp - 0x3990]
push str.___Successfully_imported_services_from_Services.reg.
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0x3990]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
xor edi, edi
mov ecx, 0xad03bc
call fcn.009620b0
cmp eax, 1
jne 0x8da444
mov dword [0xbf4054], ebx
push str.___VSS_Service_found_after_import.
lea ecx, [ebp - 0x3990]
push ecx
call fcn.00a78f30
push ebx
push 1
lea edx, [ebp - 0x3990]
push edx
jmp 0x8da48a
push str.___VSS_Service_found_missing_EVEN_after_importing_
jmp 0x8da474
lea edx, [ebp - 0x3990]
push str.___VSS_Service_absent_in_REG_file__Not_importing_it...
push edx
call fcn.00a78f30
push ebx
push 1
lea eax, [ebp - 0x3990]
push eax
jmp 0x8da48a
push str.___Invalid_size_of_services.reg_
jmp 0x8da42c
push str.___Had_tried_restoring_earlier..._so_not_trying_again_
lea eax, [ebp - 0x3990]
push eax
call fcn.00a78f30
push ebx
push 1
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
mov ecx, dword [ebp - 0x183b4]
cmp ecx, ebx
je 0x8da4fb
cmp dword [0xbc27fc], ebx
je 0x8da4fb
mov eax, dword [ebp - 0x183b8]
cmp eax, ebx
je 0x8da4cf
cmp byte [eax], bl
je 0x8da4cf
push ecx
push eax
lea edx, [ebp - 0x3990]
push str.___ProcNotify_ProcEnd___s:_d_
push edx
call fcn.00a78f30
add esp, 0x10
jmp 0x8da4e4
push ecx
lea eax, [ebp - 0x3990]
push str.___ProcNotify_ProcEnd___d_
push eax
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x3990]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0x183bc], ebx
je 0x8dad44
push 0x3ff
lea edx, [ebp - 0x748f]
push ebx
push edx
mov dword [ebp - 0x18404], ebx
mov dword [ebp - 0x18410], ebx
mov byte [ebp - 0x7490], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x1b37]
push ebx
push eax
mov dword [ebp - 0x183d4], ebx
mov byte [ebp - 0x1b38], bl
call fcn.00a7ffb0
mov ecx, dword [ebp - 0x183b4]
xor eax, eax
add esp, 0xc
push ecx
xor ecx, ecx
mov dword [ebp - 0x1853c], ebx
mov byte [ebp - 0x134], bl
mov dword [ebp - 0x133], eax
mov dword [ebp - 0x12f], eax
mov dword [ebp - 0x12b], eax
mov word [ebp - 0x127], ax
mov byte [ebp - 0x125], al
mov byte [ebp - 0x124], bl
mov dword [ebp - 0x123], eax
mov dword [ebp - 0x11f], eax
mov byte [ebp - 0x11b], al
call fcn.0098c0a0
mov eax, dword [ebp - 0x183b8]
add esp, 4
cmp byte [ebp - 0x118], bl
jne 0x8da60d
cmp eax, ebx
je 0x8da5e2
cmp byte [eax], bl
je 0x8da5e2
mov edx, dword [ebp - 0x183cc]
mov ecx, dword [ebp - 0x183b4]
push edx
push ecx
push eax
push str._CPL__TERM__Force_Terminating_Process__s:_u__FW:_u_
push 0xffffffffffffffff
push 0x400
lea edx, [ebp - 0x7490]
push edx
jmp 0x8da670
mov eax, dword [ebp - 0x183cc]
mov ecx, dword [ebp - 0x183b4]
push eax
push ecx
push str._CPL__TERM__Force_Terminating_Process__PID:_u__FW:_u_
push 0xffffffffffffffff
lea edx, [ebp - 0x7490]
push 0x400
push edx
call fcn.00a78fcb
add esp, 0x18
jmp 0x8da678
cmp eax, ebx
je 0x8da648
cmp byte [eax], bl
je 0x8da648
mov ecx, dword [ebp - 0x183cc]
push ecx
mov ecx, dword [ebp - 0x183b4]
lea edx, [ebp - 0x118]
push edx
push ecx
push eax
push str._CPL__TERM__Force_Terminating_Process__s:_u___s__FW:_u_
push 0xffffffffffffffff
lea edx, [ebp - 0x7490]
push 0x400
push edx
call fcn.00a78fcb
add esp, 0x20
jmp 0x8da678
mov eax, dword [ebp - 0x183cc]
mov edx, dword [ebp - 0x183b4]
push eax
lea ecx, [ebp - 0x118]
push ecx
push edx
push str._CPL__TERM__Force_Terminating_Process__PID:_u____s__FW:_u_
push 0xffffffffffffffff
push 0x400
lea eax, [ebp - 0x7490]
push eax
call fcn.00a78fcb
add esp, 0x1c
mov esi, dword [ebp - 0x183c0]
cmp esi, ebx
jne 0x8da697
mov edx, dword [ebp - 0x183b4]
xor ecx, ecx
call fcn.0097ceb0
mov dword [ebp - 0x183c0], eax
mov esi, eax
cmp esi, 4
jbe 0x8da6b8
cmp byte [ebp - 0x6d0], bl
jne 0x8da6b8
push esi
lea ecx, [ebp - 0x8d8]
lea ebx, [ebp - 0x6d0]
call fcn.0097b130
xor ebx, ebx
cmp byte [ebp - 0x134], bl
jne 0x8da6e9
mov eax, dword [ebp - 0x183b4]
lea ecx, [ebp - 0x1853c]
push ecx
lea edx, [ebp - 0x183d4]
push edx
push eax
lea edx, [ebp - 0x134]
lea ecx, [ebp - 0x1b38]
call fcn.009b8130
add esp, 0xc
cmp dword [0xb56800], ebx
je 0x8da72b
mov edx, dword [ebp - 0x183b4]
lea ecx, [ebp - 0x18510]
push ecx
push edx
mov dword [ebp - 0x18510], ebx
call fcn.00968090
add esp, 8
test eax, eax
je 0x8da72b
mov eax, dword [ebp - 0x18510]
neg eax
sbb eax, eax
and eax, 0x20300
add eax, 0x323378
mov dword [ebp - 0x124], eax
cmp esi, 4
jne 0x8da74d
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0xa568]
push str._s__Parent_SYSTEM:4_
push edx
call fcn.00a78f30
add esp, 0xc
jmp 0x8da795
push esi
cmp byte [ebp - 0x8d8], bl
je 0x8da77a
lea eax, [ebp - 0x8d8]
push eax
lea ecx, [ebp - 0x118]
push ecx
lea edx, [ebp - 0xa568]
push str._s__Parent__s:_u_
push edx
call fcn.00a78f30
add esp, 0x14
jmp 0x8da795
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0xa568]
push str._s__Parent__UnknownProcess_:_u_
push ecx
call fcn.00a78f30
add esp, 0x10
cmp dword [ebp - 0x183c8], ebx
je 0x8da7fa
cmp dword [ebp - 0x183c4], ebx
jbe 0x8da7fa
cmp byte [ebp - 0xbe8], bl
je 0x8da7bf
mov eax, dword [ebp - 0x183b4]
push 0x3d
lea edx, [ebp - 0xbe8]
push edx
push eax
jmp 0x8da7cf
mov edx, dword [ebp - 0x183b4]
push 0x3e
lea ecx, [ebp - 0xa568]
push ecx
push edx
call fcn.009b92c0
mov ecx, dword [ebp - 0x183b4]
add esp, 0xc
push 6
push str.eScan_Monitor
lea ebx, [ebp - 0x18410]
lea edi, [ebp - 0x18404]
call fcn.008c4180
add esp, 8
xor ebx, ebx
mov edi, dword [ebp - 0x183b4]
push ebx
call fcn.0097a830
push ebx
mov edi, eax
push 1
lea eax, [ebp - 0x7490]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp edi, ebx
jne 0x8da839
push ebx
push str.Terminate_Failure__TARes:_u
push 0xffffffffffffffff
push 0x208
lea ecx, [ebp - 0xc7d8]
push ecx
jmp 0x8da84d
push edi
push str.Terminate_Success__TARes:_u
push 0xffffffffffffffff
push 0x208
lea edx, [ebp - 0xc7d8]
push edx
call fcn.00a78fcb
add esp, 0x14
push ebx
push 1
lea eax, [ebp - 0xc7d8]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0x18434], ebx
je 0x8da8a0
cmp esi, 4
jbe 0x8da8a0
push ebx
mov edi, esi
call fcn.0097a830
cmp byte [ebp - 0x5c08], bl
je 0x8da8a0
push ebx
push 1
lea ecx, [ebp - 0x5c08]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0x1845c], ebx
je 0x8da8d8
mov edi, dword [ebp - 0x1841c]
cmp edi, 4
jbe 0x8da8d8
push ebx
call fcn.0097a830
cmp byte [ebp - 0x7dc0], bl
je 0x8da8d8
push ebx
push 1
lea edx, [ebp - 0x7dc0]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [ebp - 0x184dc], ebx
je 0x8daae0
mov edi, dword [ebp - 0x183b8]
cmp edi, ebx
je 0x8daae0
cmp byte [edi], bl
je 0x8daae0
cmp byte [str.C:WINDOWS_system32eEmpty.exe], bl
je 0x8daae0
push ebx
push ebx
xor edx, edx
mov ecx, str.C:WINDOWS_system32eEmpty.exe
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8daae0
push 0xb523f4
mov dword [ebp - 0x18418], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebx
push ebx
lea edx, [ebp - 0x18418]
mov ecx, edi
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x8daad5
cmp dword [ebp - 0x18418], 0x14000
jae 0x8daad5
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, str.inlock.exe_ilockmsg.exe
mov edi, eax
call fcn.0099a3e0
mov eax, dword [ebp - 0x183b8]
lea edx, [ebp - 0x1820]
sub edx, eax
jmp 0x8da980
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
cmp cl, bl
jne 0x8da980
lea ecx, [ebp - 0x1820]
call fcn.0094c3d0
lea ecx, [ebp - 0x1820]
dec ecx
mov byte [eax + ecx], 0x5f
lea eax, [ebp - 0x1820]
call fcn.00962830
mov esi, dword [ebp - 0x183b8]
call fcn.00958480
mov dword [ebp - 0x18418], ebx
mov ebx, dword [ebp - 0x183b8]
lea edi, [ebp - 0x1820]
call fcn.009626c0
cmp eax, 1
je 0x8daa65
push 0x103
lea edx, [ebp - 0x675f]
push 0
push edx
mov byte [ebp - 0x6760], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x104
lea esi, [ebp - 0x6760]
call fcn.00960b00
add esp, 4
mov eax, esi
push eax
mov ecx, edi
push ecx
mov edx, ebx
push edx
push str._IMSG__B_Failed_to_move___s__to___s____s
push 0xffffffffffffffff
lea eax, [ebp - 0xf620]
push 0x208
push eax
call fcn.00a78fcb
add esp, 0x1c
push 0
push 1
lea ecx, [ebp - 0xf620]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x18418]
inc eax
cmp eax, 5
mov dword [ebp - 0x18418], eax
jl 0x8da9bc
jmp 0x8daacd
lea edx, [ebp - 0x1820]
push edx
push 0xaa21e4
mov edx, str.LockMsgFN
mov ecx, 0x80000002
call fcn.0094bd00
mov edi, dword [ebp - 0x183b8]
push 0
mov ebx, str.C:WINDOWS_system32eEmpty.exe
call fcn.00980a90
add esp, 4
lea eax, [ebp - 0x1820]
push eax
push edi
push str._IMSG__B_Successfully_moved___s__to___s_
push 0xffffffffffffffff
lea ecx, [ebp - 0x11a50]
push 0x208
push ecx
call fcn.00a78fcb
push 0
push 1
lea edx, [ebp - 0x11a50]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov esi, dword [ebp - 0x183c0]
xor ebx, ebx
push 0xb523f4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x18464], ebx
je 0x8dab0c
mov esi, str.RunMSA1
mov ecx, str.SOFTWAREMicroWorld
mov edx, 0x80000002
call fcn.0095f910
push 2
call fcn.0086b3b0
mov esi, dword [ebp - 0x183c0]
add esp, 4
cmp byte [ebp - 0x118], bl
je 0x8dab5b
push 0x104
lea eax, [ebp - 0xb9c0]
push eax
push 0xaa1543
mov edx, str.BlockNotify
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0xb9c0], 0x30
je 0x8dab5b
lea ecx, [ebp - 0x118]
push ecx
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorRegMsg
mov edx, str.Message
mov ecx, 0x80000002
call fcn.0094bd00
cmp dword [ebp - 0x183c8], ebx
je 0x8dad44
mov edi, dword [ebp - 0x183c4]
cmp edi, ebx
jbe 0x8dad44
cmp byte [0xbf4058], bl
jne 0x8daba1
push 0xb55918
push 0x104
push 0xbf4058
push str.Application_Terminated
push 0xad07c4
push 0xaaec30
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0xbe8], bl
je 0x8dabe6
mov edx, dword [ebp - 0x183b4]
push edx
lea eax, [ebp - 0xbe8]
push eax
push str._CPL__CPL_Description__s__PID:_u_
push 0xffffffffffffffff
lea ecx, [ebp - 0x7490]
push 0x400
push ecx
call fcn.00a78fcb
push ebx
push 1
lea edx, [ebp - 0x7490]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
mov eax, dword [ebp - 0x183b8]
cmp byte [ebp - 0x124], bl
jne 0x8dac60
cmp eax, ebx
je 0x8dac2a
cmp byte [eax], bl
je 0x8dac2a
mov ecx, dword [ebp - 0x183d4]
lea eax, [ebp - 0x1b38]
push eax
mov eax, dword [ebp - 0x183b4]
push ecx
mov ecx, dword [ebp - 0x183b8]
lea edx, [ebp - 0x134]
push edx
push esi
push eax
push ecx
push str._s:_u__ppid:_u____s:_d___s_
jmp 0x8dacd2
mov ecx, dword [ebp - 0x183d4]
lea eax, [ebp - 0x1b38]
push eax
mov eax, dword [ebp - 0x183b4]
push ecx
lea edx, [ebp - 0x134]
push edx
push esi
push eax
lea ecx, [ebp - 0x7490]
push str._UnknownProcess_:_u__ppid:_u____s:_d___s_
push ecx
call fcn.00a78f30
add esp, 0x1c
jmp 0x8dace1
cmp eax, ebx
je 0x8daca9
cmp byte [eax], bl
je 0x8daca9
mov eax, dword [ebp - 0x183d4]
lea edx, [ebp - 0x1b38]
push edx
push eax
mov eax, dword [ebp - 0x183b4]
lea ecx, [ebp - 0x134]
push ecx
mov ecx, dword [ebp - 0x183b8]
lea edx, [ebp - 0x124]
push edx
push esi
push eax
push ecx
lea edx, [ebp - 0x7490]
push str._s:_u__ppid:_u____s___s:_d___s_
push edx
call fcn.00a78f30
add esp, 0x24
jmp 0x8dace1
mov ecx, dword [ebp - 0x183d4]
lea eax, [ebp - 0x1b38]
push eax
push ecx
mov ecx, dword [ebp - 0x183b4]
lea edx, [ebp - 0x134]
push edx
lea eax, [ebp - 0x124]
push eax
push esi
push ecx
push str._UnknownProcess_:_u__ppid:_u____s___s:_d___s_
lea edx, [ebp - 0x7490]
push edx
call fcn.00a78f30
add esp, 0x20
push ebx
push ebx
push ebx
cmp byte [ebp - 0xbe8], bl
je 0x8dad10
mov eax, dword [ebp - 0x18410]
mov ecx, dword [ebp - 0x18404]
push eax
push ecx
push ebx
lea edx, [ebp - 0x7490]
push edx
push 0xbf4058
lea eax, [ebp - 0xbe8]
push eax
jmp 0x8dad32
mov ecx, dword [ebp - 0x18410]
mov edx, dword [ebp - 0x18404]
push ecx
push edx
push ebx
lea eax, [ebp - 0x7490]
push eax
push 0xbf4058
lea ecx, [ebp - 0xa568]
push ecx
push 0xaa154c
push 3
push edi
mov ecx, str.eScan_Monitor
call fcn.00982e00
mov eax, dword [ebp - 0x183b8]
cmp eax, ebx
je 0x8dad57
push eax
call fcn.00a78fec
add esp, 4
cmp dword [ebp - 0x184d0], ebx
je 0x8dadf7
lea edx, [ebp - 0x1848c]
push edx
push str.UnloadMonIfClusterDown
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [ebp - 0x1848c], ebx
call fcn.0094c0d0
cmp dword [ebp - 0x1848c], ebx
je 0x8dadf7
push ebx
push 1
push str.Unloading_Monitor_as_Cluster_Service_Terminated...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ebx, 1
call fcn.0095bad0
mov ecx, 0xb3bbb8
call fcn.0097ddd0
mov dword [ebp - 0x18534], eax
test eax, eax
je 0x8dadf7
mov esi, dword [sym.imp.KERNEL32.dll_SetEvent]
push eax
call esi
lea eax, [ebp - 0x18534]
push eax
call fcn.00985290
mov ecx, str.ExitEscanMon
call fcn.0097ddd0
mov dword [ebp - 0x18540], eax
test eax, eax
je 0x8dadf7
push eax
call esi
lea ecx, [ebp - 0x18540]
push ecx
call fcn.00985290
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret