Function at 0x14004a2a0
Capabilities:
Disable system features via registry on windows
Disable windows defender features via registry on windows
Encode data using xor
Execute command
Persist via explorer tools registry key
Persist via windows service
Set registry value

Disassembly:
sub rsp, 0x78
movups xmm0, xmmword [str.SWQwO]
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
movups xmm1, xmmword [0x14013b490]
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x14013b4a0]
movsd qword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x40], xmm1
jl 0x14004a410
movdqa xmm0, xmmword [0x14013b970]
lea rdx, [rsp + 0x34]
movdqa xmm4, xmmword [0x14013b8f0]
movdqa xmm3, xmmword [0x14013bca0]
movdqa xmm5, xmmword [str.::::]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x14013b960]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x28
jl 0x14004a320
movaps xmm6, xmmword [rsp + 0x60]
jmp 0x14004a446
lea r8, [rsp + 0x30]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
mul ecx
shr edx, 5
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x31
xor byte [r8 - 1], al
cmp ecx, 0x28
jl 0x14004a420
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x14004a452
cmp qword [0x140153878], 0xf
lea rcx, [0x140153860]
mov r8, qword [0x140153870]
cmova rcx, qword [0x140153860]
cmp r8, rax
jne 0x14004b5f7
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004b5f7
lea rcx, str.Reg.exe_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersionSystemRestore___v__RPSessionInterval___f___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_delete__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersionSystemRestore___v__DisableConfig___f___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSoftwareMicrosoftWindows_NTCurrentVersionSystemRestore___v__SystemRestorePointCreationFrequency___t_REG_DWORD__d_0__f___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell__ExecutionPolicy_Unrestricted__NoProfile_Enable_ComputerRestore__Drive_C:__D:__E:__F:__G:___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.powershell__ExecutionPolicy_Unrestricted__NoProfile_Checkpoint_Computer__Description_Axtralsz_Restore_Point___nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionscsrss.exePerfOptions___v__CpuPriorityClass___t_REG_DWORD__d__3___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionscsrss.exePerfOptions___v__IoPriority___t_REG_DWORD__d__3___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__DelayedAckFrequency___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__DelayedAckTicks___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__CongestionAlgorithm___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__MultihopSets___t_REG_DWORD__d__15___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__FastCopyReceiveThreshold___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__FastSendDatagramThreshold___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__DefaultReceiveWindow___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__DefaultSendWindow___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__FastCopyReceiveThreshold___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__FastSendDatagramThreshold___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__DynamicSendBufferDisable___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__IgnorePushBitOnReceives___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__NonBlockingSendSpecialBuffering___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__DisableRawSecurity___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile___v__SystemResponsiveness___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionDevice_Metadata___v__PreventDeviceMetadataFromNetwork___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagercurrentdeviceUpdate___v__ExcludeWUDriversInQualityUpdate___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagerdefaultUpdate___v__ExcludeWUDriversInQualityUpdate___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagerdefaultUpdateExcludeWUDriversInQualityUpdate___v__value___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsUpdateUXSettings___v__ExcludeWUDriversInQualityUpdate___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdate___v__ExcludeWUDriversInQualityUpdate___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionScheduleMaintenance___v__MaintenanceDisabled___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsCloudContent___v__DisableWindowsConsumerFeatures___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerPower___v__HiberbootEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPowerPowerThrottling___v__PowerThrottlingOff___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__FeatureSettingsOverride___t_REG_DWORD__d__3___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__FeatureSettingsOverrideMask___t_REG_DWORD__d__3___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPriorityControl___v__Win32PrioritySeparation___t_REG_DWORD__d__38___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile___v__NetworkThrottlingIndex___t_REG_DWORD__d__4294967295___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile___v__SystemResponsiveness___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksGames___v__Affinity___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksGames___v__Background_Only___t_REG_SZ__d__False___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksGames___v__Clock_Rate___t_REG_DWORD__d__10000___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksGames___v__GPU_Priority___t_REG_DWORD__d__8___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksGames___v__Priority___t_REG_DWORD__d__6___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksGames___v__Scheduling_Category___t_REG_SZ__d__High___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfileTasksGames___v__SFIO_Priority___t_REG_SZ__d__High___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerMemory_Management___v__DisablePagingExecutive___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_FSEBehaviorMode___t_REG_DWORD__d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_HonorUserFSEBehaviorMode___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_DXGIHonorFSEWindowsCompatible___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_EFSEFeatureFlags___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagerdefaultApplicationManagementAllowGameDVR___v__value___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionThemes___v__ThemeChangesDesktopIcons___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionThemes___v__ThemeChangesMousePointers___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SilentInstalledAppsEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SystemPaneSuggestionsEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced___v__ShowSyncProviderNotifications___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SoftLandingEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__RotatingLockScreenEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__RotatingLockScreenOverlayEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_310093Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_314563Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_338387Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_338388Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_338389Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_338393Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_353698Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__DisallowShaking___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsExplorer___v__NoUseStoreOpenWith___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesAttachments___v__SaveZoneInformation___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdate___v__ExcludeWUDriversInQualityUpdate___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftMRT___v__DontOfferThroughWUAU___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsSystem___v__EnableActivityFeed___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU___v__AUOptions___t_REG_DWORD__d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsWindows_Error_Reporting___v__Disabled___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPower___v__HibernateEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelDesktop___v__MenuShowDelay___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsExplorer___v__NoNewAppAlert___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSystemCurrentControlSetControlCrashControl___v__DisplayParameters___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREPoliciesMicrosoftWindowsExplorer___v__DisableNotificationCenter___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREPoliciesMicrosoftWindowsCurrentVersionPushNotifications___v__NoTileApplicationNotification___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwarePoliciesMicrosoftWindowsExplorer___v__HidePeopleBar___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftShellActionCenterQuick_Actions___v__PinnedQuickActionSlotCount___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionSearch___v__BingSearchEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionSearch___v__AllowSearchToUseLocation___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionSearch___v__CortanaConsent___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorer___v__HoverSelectDesktops___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedPeople___v__TaskbarCapacity___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelDesktop___v__JPEGImportQuality___t_REG_DWORD__d__256___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_delete__HKCUSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagsAllFoldersShell___v__FolderType___t_REG_SZ__d__NotSpecified___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace0DB7E03F_FC29_4DC6_9020_FF41B59E513A___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_delete__HKLMSOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerMyComputerNameSpace0DB7E03F_FC29_4DC6_9020_FF41B59E513A___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCRWOW6432NodeCLSIDF02C1A0D_BE21_4350_88B0_7367FC96EF3CShellFolder___v__Attributes___t_REG_DWORD__d__2962489444___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCRCLSIDF02C1A0D_BE21_4350_88B0_7367FC96EF3CShellFolder___v__Attributes___t_REG_DWORD__d__2962489444___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__Start_TrackDocs___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwarePoliciesMicrosoftWindowsExplorer___v__DisableSearchBoxSuggestions___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCRCLSID018D5C66_4533_4307_9B53_224DE2ED1FE6___v__System.IsPinnedToNameSpaceTree___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesLanmanServerParameters___v__AutoShareWks___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsStore___v__AutoDownload___t_REG_DWORD__d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsDataCollection___v__AllowTelemetry___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v__link___t_REG_BINARY__d__00000000___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMozillaFirefox___v__DisableAppUpdate___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseSensitivity___t_REG_SZ__d__10___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKU.DEFAULTControl_PanelMouse___v__MouseHoverTime___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKU.DEFAULTControl_PanelMouse___v__MouseSpeed___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKU.DEFAULTControl_PanelMouse___v__MouseThreshold1___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKU.DEFAULTControl_PanelMouse___v__MouseThreshold2___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftSiufRules___v__NumberOfSIUFInPeriod___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_delete__HKCUSOFTWAREMicrosoftSiufRules___v__PeriodInNanoSeconds___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityMouseKeys___v__Flags___t_REG_SZ__d__186___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityMouseKeys___v__MaximumSpeed___t_REG_SZ__d__40___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityMouseKeys___v__TimeToMaximumSpeed___t_REG_SZ__d__3000___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesW32TimeParameters___v__Type___t_REG_SZ__d__NoSync___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsDWM___v__AccentColor___t_REG_DWORD__d__4282927692___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAccent___v__AccentColorMenu___t_REG_DWORD__d__4282927692___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAccent___v__StartColorMenu___t_REG_DWORD__d__4281546038___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAccent___v__AccentPalette___t_REG_BINARY__d__9b9a9900848381006d6b6a004c4a4800363533002625240019191900107c1000___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsDWM___v__AccentColor___t_REG_DWORD__d__4282927692___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsDWM___v__ColorizationColor___t_REG_DWORD__d__3293334088___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsDWM___v__ColorizationAfterglow___t_REG_DWORD__d__3293334088___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionThemesPersonalize___v__EnableTransparency___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsSystem___v__EnableSmartScreen___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsSystem___v__EnableActivityFeed___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsSystem___v__PublishUserActivities___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsSystem___v__UploadUserActivities___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsSystem___v__DisableLogonBackgroundImage___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsSystem___v__DisableAcrylicBackgroundOnLogon___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__UseDefaultTile___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__TaskbarBadges___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoStartMenuMorePrograms___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoStartMenuMorePrograms___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsExplorer___v__HideRecentlyAddedApps___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__HideRecentlyAddedApps___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREPoliciesMicrosoftWindowsExplorer___v__DisableNotificationCenter___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindows_NTCurrentVersionWindows___v__LegacyDefaultPrinterMode___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelDesktop___v__MouseWheelRouting___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftTabletTip1.7___v__EnableTextPrediction___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftTabletTip1.7___v__EnablePredictionSpaceInsertion___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftTabletTip1.7___v__EnableDoubleTapSpace___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftShellUSB___v__NotifyOnUsbErrors___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__VirtualDesktopTaskbarFilter___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__VirtualDesktopAltTabFilter___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUKeyboard_LayoutToggle___v__Language_Hotkey___t_REG_SZ__d__3___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUKeyboard_LayoutToggle___v__Hotkey___t_REG_SZ__d__3___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUKeyboard_LayoutToggle___v__Layout_Hotkey___t_REG_SZ__d__3___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftCTFLangBar___v__ShowStatus___t_REG_DWORD__d__3___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftCTFLangBar___v__ExtraIconsOnMinimized___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftCTFLangBar___v__Transparency___t_REG_DWORD__d__255___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftCTFLangBar___v__Label___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerFlyoutMenuSettings___v__ShowSleepOption___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerFlyoutMenuSettings___v__ShowLockOption___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftMultimediaAudio___v__UserDuckingPreference___t_REG_DWORD__d__3___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseSpeed___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseThreshold1___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelMouse___v__MouseThreshold2___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__AppStarting___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__Arrow___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__ContactVisualization___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__Crosshair___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__GestureVisualization___t_REG_DWORD__d__31___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__Hand___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__Help___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__IBeam___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__No___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__NWPen___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__Scheme_Source___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__SizeAll___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__SizeNESW___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__SizeNS___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__SizeNWSE___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__SizeWE___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__UpArrow___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__Wait___t_REG_EXPAND_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___ve__t_REG_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_delete__HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorephoneCall___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlGraphicsDrivers___v__HwSchMode___t_REG_DWORD__d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettings___v__NOC_GLOBAL_SETTING_ALLOW_NOTIFICATION_SOUND___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingswindows.immersivecontrolpanel_cw5n1h2txyewymicrosoft.windows.immersivecontrolpanel___v__Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionPushNotifications___v__ToastEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionPushNotifications___v__LockScreenToastEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettings___v__NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionBluetooth___v__QuickPair___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettings___v__NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS_ABOVE_LOCK___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__ContactVisualization___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__GestureVisualization___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionStorageSenseParametersStoragePolicy___v__04___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionStorageSenseParametersStoragePolicy___v__01___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionStorageSenseParametersStoragePolicy___v__2048___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionStorageSenseParametersStoragePolicy___v__08___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionStorageSenseParametersStoragePolicy___v__256___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionStorageSenseParametersStoragePolicy___v__32___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftInputSettings___v__EnableExpressiveInputEmojiMultipleSelection___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableRealtimeMonitoring___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderSpynet___v__SubmitSamplesConsent___t_REG_DWORD__d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderSpynet___v__SpynetReporting___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftMicrosoftEdgePhishingFilter___v__EnabledV9___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender_Security_CenterSystray___v__HideSystray___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun___v__SecurityHealth___t_REG_BINARY__d__07000000a7c0ae8e3b30d601___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftOneDriveAccountsPersonal___v__ShareNotificationDisabled___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftOneDriveAccountsPersonal___v__MassDeleteNotificationDisabled___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsMitigation___v__UserPreference___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcam___v__Value___t_REG_SZ__d__Allow___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.Microsoft3DViewer_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.MicrosoftEdge_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.Office.OneNote_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.SkypeApp_kzf8qxf38zg5c___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.Win32WebViewHost_cw5n1h2txyewy___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.Windows.Photos_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.WindowsCamera_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.WindowsFeedbackHub_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.WindowsStore_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.XboxGamingOverlay_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamNonPackaged___v__Value___t_REG_SZ__d__Allow___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophone___v__Value___t_REG_SZ__d__Allow___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.549981C3F5F10_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.Microsoft3DViewer_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.MicrosoftEdge_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.MixedReality.Portal_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.Office.OneNote_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.SkypeApp_kzf8qxf38zg5c___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.Win32WebViewHost_cw5n1h2txyewy___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.Windows.Photos_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.WindowsCamera_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.WindowsFeedbackHub_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.WindowsSoundRecorder_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.WindowsStore_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.XboxApp_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneMicrosoft.XboxGamingOverlay_8wekyb3d8bbwe___v__Value___t_REG_SZ__d__Deny___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoremicrophoneNonPackaged___v__Value___t_REG_SZ__d__Allow___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftSpeech_OneCoreSettingsVoiceActivationUserPreferenceForAllApps___v__AgentActivationEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftSpeech_OneCoreSettingsVoiceActivationUserPreferenceForAllApps___v__AgentActivationLastUsed___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSearchSettings___v__SafeSearchMode___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__AllowCloudSearch___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionSearch___v__DeviceHistoryEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelCursors___v__ContactVisualization___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftScreenMagnifier___v__RunningState___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftScreenMagnifier___v__FollowMouse___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftScreenMagnifier___v__FollowFocus___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftScreenMagnifier___v__FollowCaret___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftScreenMagnifier___v__FollowNarrator___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarratorNoRoam___v__WinEnterLaunchEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarratorNarratorHome___v__AutoStart___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarratorNarratorHome___v__MinimizeType___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityStickyKeys___v__Flags___t_REG_SZ__d__506___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityToggleKeys___v__Flags___t_REG_SZ__d__34___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityKeyboard_Response___v__Flags___t_REG_SZ__d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityStickyKeys___v__Flags___t_REG_SZ__d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibility___v__Sound_on_Activation___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibility___v__Warning_Sounds___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarratorNoRoam___v__DuckAudio___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarrator___v__IntonationPause___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarrator___v__ReadHints___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarrator___v__ErrorNotificationType___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarrator___v__PlayAudioCues___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarrator___v__EchoChars___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarrator___v__EchoWords___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarratorNoRoam___v__EchoToggleKeys___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarratorNoRoam___v__EchoModifierKeys___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarrator___v__NarratorCursorHighlight___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftNarrator___v__CoupleNarratorCursorKeyboard___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftNarratorNoRoam___v__ScriptingEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftNarratorNoRoam___v__OnlineServicesEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftGameBar___v__UseNexusForGameBarEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMMaps___v__AutoUpdateEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPushNotifications___v__DatabaseMigrationCompleted___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPushNotifications___v__ToastEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPushNotifications___v__LockScreenToastEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionImmersiveShell___v__TabletMode___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionImmersiveShell___v__SignInMode___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionImmersiveShell___v__ConvertibleSlateModePromptPreference___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__TaskbarAppsVisibleInTabletMode___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__TaskbarAutoHideInTabletMode___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionCDP___v__CdpSessionUserAuthzPolicy___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionCDP___v__NearShareChannelUserAuthzPolicy___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionCDP___v__RomeSdkChannelUserAuthzPolicy___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityHighContrast___v__Flags___t_REG_SZ__d__4218___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityMouseKeys___v__Flags___t_REG_SZ__d__130___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityMouseKeys___v__MaximumSpeed___t_REG_SZ__d__39___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilityMouseKeys___v__TimeToMaximumSpeed___t_REG_SZ__d__3000___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilitySoundSentry___v__Flags___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilitySoundSentry___v__FSTextEffect___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilitySoundSentry___v__TextEffect___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilitySoundSentry___v__WindowsEffect___t_REG_SZ__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilitySlateLaunch___v__ATapp___t_REG_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUControl_PanelAccessibilitySlateLaunch___v__LaunchAT___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsShellAssociationsAppUrlAssociations.maps.windows.comAppXw2ahfj46c0qbns74sb1bad9a5cpw8042UserChoice___v__Hash___t_REG_SZ__d__hkPbFmnwJo___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsShellAssociationsAppUrlAssociations.maps.windows.comAppXw2ahfj46c0qbns74sb1bad9a5cpw8042UserChoice___v__Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsShellAssociationsAppUrlAssociationsmaps.windows.comAppXpmv5ep1jbsan9pzb5ys5a2x5244nckxhUserChoice___v__Hash___t_REG_SZ__d__k0yQGnTObnw___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsShellAssociationsAppUrlAssociationsmaps.windows.comAppXpmv5ep1jbsan9pzb5ys5a2x5244nckxhUserChoice___v__Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlRemote_Assistance___v__fAllowFullControl___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlRemote_Assistance___v__fAllowToGetHelp___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsDWM___v__ColorizationColor___t_REG_DWORD__d__3293334088___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsDWM___v__ColorizationAfterglow___t_REG_DWORD__d__3293334088___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsDWM___v__ColorizationGlassAttribute___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsDWM___v__AccentColor___t_REG_DWORD__d__4282927692___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerAccent___v__AccentPalette___t_REG_BINARY__d__9B9A9900848381006D6B6A004C4A4800363533002625240019191900107C1000___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerAccent___v__StartColorMenu___t_REG_DWORD__d__4281546038___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerAccent___v__AccentColorMenu___t_REG_DWORD__d__4282927692___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSearchSettings___v__IsDeviceSearchHistoryEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftGameBar___v__ShowStartupPanel___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftGameBar___v__GamePanelStartupTipIndex___t_REG_DWORD__d__3___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftGameBar___v__AllowAutoGameMode___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftGameBar___v__AutoGameModeEnabled___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftGameBar___v__UseNexusForGameBarEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_Enabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_FSEBehaviorMode___t_REG_DWORD__d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_FSEBehavior___t_REG_DWORD__d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_HonorUserFSEBehaviorMode___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_DXGIHonorFSEWindowsCompatible___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_EFSEFeatureFlags___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSystemGameConfigStore___v__GameDVR_DSEBehavior___t_REG_DWORD__d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsGameDVR___v__AllowGameDVR___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionGameDVR___v__AppCaptureEnabled___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCRCLSID018D5C66_4533_4307_9B53_224DE2ED1FE6___v__System.IsPinnedToNameSpaceTree___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCRWow6432NodeCLSID018D5C66_4533_4307_9B53_224DE2ED1FE6___v__System.IsPinnedToNameSpaceTree___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKCUSoftwareMicrosoftShellUSB___v__NotifyOnWeakCharger___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__DelayedAckFrequency___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__DelayedAckTicks___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__CongestionAlgorithm___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__MultihopSets___t_REG_DWORD__d__15___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__FastCopyReceiveThreshold___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v__FastSendDatagramThreshold___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__DefaultReceiveWindow___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__DefaultSendWindow___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__FastCopyReceiveThreshold___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__FastSendDatagramThreshold___t_REG_DWORD__d__16384___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__DynamicSendBufferDisable___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__IgnorePushBitOnReceives___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__NonBlockingSendSpecialBuffering___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__DisableRawSecurity___t_REG_DWORD__d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionMultimediaSystemProfile___v__SystemResponsiveness___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMControlSet001ControlSession_ManagerMemory_ManagementPrefetchParameters___v__EnablePrefetcher___t_REG_DWORD__d__0___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipServiceProvider___v__LocalPriority___t_REG_DWORD__d__4___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipServiceProvider___v__HostsPriority___t_REG_DWORD__d__5___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipServiceProvider___v__DnsPriority___t_REG_DWORD__d__6___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesTcpipServiceProvider___v__NetbtPriority___t_REG_DWORD__d__7___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [0x14012d908]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.echo_Tweaking_Successful
add rsp, 0x78
jmp qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.140049e40
int3