Function at 0x100024a5
Capabilities:
Persist via winlogon helper dll registry key

Disassembly:
sub esp, 0x138
mov eax, dword [0x1001f170]
xor eax, esp
mov dword [esp + 0x134], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [str.:_autorun.inf]
mov ecx, dword [0x10019738]
mov edx, dword [0x1001973c]
mov dword [esp + 0x30], eax
movzx eax, word [0x10019740]
mov word [esp + 0x3c], ax
mov eax, dword [0x10019748]
mov dword [esp + 0x34], ecx
movzx ecx, byte [0x10019742]
mov dword [esp + 0x20], eax
movzx eax, word [0x10019754]
mov byte [esp + 0x3e], cl
mov ecx, dword [0x1001974c]
mov dword [esp + 0x38], edx
mov edx, dword [str.:_autorun.inf.bak]
mov word [esp + 0x2c], ax
mov eax, dword [esp + 0x150]
mov ebp, dword [esp + 0x14c]
mov dword [esp + 0x24], ecx
movzx ecx, byte [0x10019756]
mov dword [esp + 0x1c], edx
mov edx, dword [0x10019750]
dec eax
mov dword [esp + 0x28], edx
mov byte [esp + 0x2e], cl
cmp eax, 0xd
ja case.default.0x100010a2
jmp dword [eax*4 + 0x10002988]
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100010de
mov ecx, dword [esp + 0x14]
push str.NoFolderOptions
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.Hidden
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov edi, 2
push 0x80000001
mov dword [esp + 0x30], edi
call fcn.1000b430
push 4
lea ecx, [esp + 0x34]
push ecx
push 4
push str.HideFileExt
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov esi, 1
push 0x80000001
mov dword [esp + 0x48], esi
call fcn.1000b430
push 4
lea edx, [esp + 0x4c]
push edx
push 4
push str.ShowSuperHidden
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
xor ebx, ebx
push 0x80000001
mov dword [esp + 0x60], ebx
call fcn.1000b430
add esp, 0x48
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.SuperHidden
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
mov dword [esp + 0x30], ebx
call fcn.1000b430
push 4
lea ecx, [esp + 0x34]
push ecx
push 4
push str.CheckedValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
push 0x80000002
mov dword [esp + 0x48], esi
call fcn.1000b430
push 4
lea edx, [esp + 0x4c]
push edx
push 4
push str.DefaultValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
push 0x80000002
mov dword [esp + 0x60], edi
call fcn.1000b430
add esp, 0x48
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.CheckedValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenNOHIDDEN
push 0x80000002
mov dword [esp + 0x30], edi
call fcn.1000b430
push 4
lea ecx, [esp + 0x34]
push ecx
push 4
push str.DefaultValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenNOHIDDEN
push 0x80000002
mov dword [esp + 0x48], edi
call fcn.1000b430
push 4
lea edx, [esp + 0x4c]
mov dword [esp + 0x4c], esi
push edx
push 4
push str.CheckedValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHideFileExt
push 0x80000002
call fcn.1000b430
add esp, 0x48
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.DefaultValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHideFileExt
push 0x80000002
mov dword [esp + 0x30], esi
call fcn.1000b430
push 4
lea ecx, [esp + 0x34]
push ecx
push 4
push str.UncheckedValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHideFileExt
push 0x80000002
mov dword [esp + 0x48], ebx
call fcn.1000b430
push 4
lea edx, [esp + 0x4c]
push edx
push 4
push str.CheckedValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderSuperHidden
push 0x80000002
mov dword [esp + 0x60], ebx
call fcn.1000b430
add esp, 0x48
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.DefaultValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderSuperHidden
push 0x80000002
mov dword [esp + 0x30], ebx
call fcn.1000b430
push 4
lea ecx, [esp + 0x34]
push ecx
push 4
push str.UncheckedValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderSuperHidden
push 0x80000002
mov dword [esp + 0x48], esi
call fcn.1000b430
push str.checkbox
push str.Type
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderSuperHidden
push 0x80000002
call fcn.1000b4a0
add esp, 0x40
xor eax, eax
jmp 0x1000296e
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000131c
mov ecx, dword [esp + 0x14]
push str.NoFolderOptions
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.fRegSetHidden
push str.SOFTWAREBkav
mov esi, 1
push 0x80000002
mov dword [esp + 0x30], esi
call fcn.1000b430
push 4
lea ecx, [esp + 0x34]
push ecx
push 4
push str.CheckedValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
push 0x80000002
mov dword [esp + 0x48], esi
call fcn.1000b430
push 4
lea edx, [esp + 0x4c]
push edx
push 4
push str.DefaultValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
mov edi, 2
push 0x80000002
mov dword [esp + 0x60], edi
call fcn.1000b430
add esp, 0x48
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.CheckedValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenNOHIDDEN
push 0x80000002
mov dword [esp + 0x30], edi
call fcn.1000b430
push 4
lea ecx, [esp + 0x34]
push ecx
push 4
push str.DefaultValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenNOHIDDEN
push 0x80000002
mov dword [esp + 0x48], edi
call fcn.1000b430
push 4
lea edx, [esp + 0x4c]
push edx
push 4
push str.CheckedValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHideFileExt
push 0x80000002
mov dword [esp + 0x60], esi
call fcn.1000b430
add esp, 0x48
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push str.DefaultValue
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHideFileExt
push 0x80000002
mov dword [esp + 0x30], esi
call fcn.1000b430
xor ebx, ebx
jmp 0x1000123d
push str.Explorer.exe
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call fcn.1000b4a0
mov eax, dword [0x100200a0]
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10002967
mov ecx, dword [esp + 0x14]
push str.Shell
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000296e
mov al, byte [ebp + 0x2916]
mov byte [esp + 0x30], al
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push eax
push ebp
call fcn.1000b690
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3c]
push edx
push ebp
call fcn.1000b700
push 4
lea eax, [esp + 0x30]
push eax
push 4
push str.NoDriveTypeAutoRun
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
mov dword [esp + 0x44], 0xdf
call fcn.1000b430
push 4
lea ecx, [esp + 0x48]
push ecx
push 3
push str.NoDriveAutoRun
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
mov dword [esp + 0x5c], 0xffc
call fcn.1000b430
add esp, 0x44
xor eax, eax
jmp 0x1000296e
mov eax, dword [0x100200a0]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push eax
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1000152e
mov ecx, dword [esp + 0x14]
push str.DisableRegistryTools
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push ecx
call ebx
test eax, eax
jne 0x10001558
mov edx, dword [esp + 0x10]
push str.DisableTaskMgr
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push edx
call ebx
test eax, eax
jne 0x10001582
mov eax, dword [esp + 0x14]
push str.DisableCMD
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call ebx
test eax, eax
jne 0x100015ab
mov ecx, dword [esp + 0x10]
push str.NoFolderOptions
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x14]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push ecx
call ebx
test eax, eax
jne 0x100015d5
mov edx, dword [esp + 0x14]
push str.NoLogoff
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push edx
call ebx
test eax, eax
jne 0x100015ff
mov eax, dword [esp + 0x10]
push str.NoClose
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call ebx
test eax, eax
jne 0x10001628
mov ecx, dword [esp + 0x14]
push str.NoControlPanel
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push ecx
call ebx
test eax, eax
jne 0x10001652
mov edx, dword [esp + 0x10]
push str.NoFind
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push edx
call ebx
test eax, eax
jne 0x1000167c
mov eax, dword [esp + 0x14]
push str.NoShellSearchButton
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call ebx
test eax, eax
jne 0x100016a5
mov ecx, dword [esp + 0x10]
push str.NoSearch
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x14]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push ecx
call ebx
test eax, eax
jne 0x100016cf
mov edx, dword [esp + 0x14]
push str.NoControlPanel
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push edx
call ebx
test eax, eax
jne 0x100016f9
mov eax, dword [esp + 0x10]
push str.NoRun
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call ebx
test eax, eax
jne 0x10001722
mov ecx, dword [esp + 0x14]
push str.NoSetTaskbar
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push ecx
call ebx
test eax, eax
jne 0x1000174c
mov edx, dword [esp + 0x10]
push str.NoViewContextMenu
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push edx
call ebx
test eax, eax
jne 0x10001776
mov eax, dword [esp + 0x14]
push str.NoClose
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call ebx
test eax, eax
jne 0x1000179f
mov ecx, dword [esp + 0x10]
push str.NoDrives
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x14]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push ecx
call ebx
test eax, eax
jne 0x100017c9
mov edx, dword [esp + 0x14]
push str.NoWinKeys
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x10]
push ecx
push str.SoftwarePoliciesMicrosoftWindowsSystem
push edx
call ebx
test eax, eax
jne 0x100017f3
mov eax, dword [esp + 0x10]
push str.DisableCMD
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call ebx
test eax, eax
jne 0x1000181b
mov eax, dword [esp + 0x14]
push str.DisableRegistryTools
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call ebx
test eax, eax
jne 0x10001843
mov eax, dword [esp + 0x10]
push str.DisableTaskMgr
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000002
call ebx
test eax, eax
jne 0x1000186b
mov eax, dword [esp + 0x14]
push str.DisableCMD
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x10001893
mov eax, dword [esp + 0x10]
push str.NoFolderOptions
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x100018bb
mov eax, dword [esp + 0x14]
push str.NoLogoff
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x100018e3
mov eax, dword [esp + 0x10]
push str.NoClose
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x1000190b
mov eax, dword [esp + 0x14]
push str.NoControlPanel
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x10001933
mov eax, dword [esp + 0x10]
push str.NoFind
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x1000195b
mov eax, dword [esp + 0x14]
push str.NoShellSearchButton
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x10001983
mov eax, dword [esp + 0x10]
push str.NoSearch
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x100019ab
mov eax, dword [esp + 0x14]
push str.NoControlPanel
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x100019d3
mov eax, dword [esp + 0x10]
push str.NoRun
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x100019fb
mov eax, dword [esp + 0x14]
push str.NoSetTaskbar
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x10001a23
mov eax, dword [esp + 0x10]
push str.NoViewContextMenu
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x10001a4b
mov eax, dword [esp + 0x14]
push str.NoClose
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x10001a73
mov eax, dword [esp + 0x10]
push str.NoDrives
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x10001a9b
mov eax, dword [esp + 0x14]
push str.NoWinKeys
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SoftwarePoliciesMicrosoftWindowsSystem
push 0x80000002
call ebx
test eax, eax
jne 0x10001ac3
mov eax, dword [esp + 0x10]
push str.DisableCMD
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call ebx
test eax, eax
jne 0x10001aec
mov ecx, dword [esp + 0x14]
push str.NoPropertiesMyComputer
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push ecx
call ebx
test eax, eax
jne 0x10001b16
mov edx, dword [esp + 0x10]
push str.NoDesktop
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push edx
call ebx
test eax, eax
jne 0x10001b40
mov eax, dword [esp + 0x14]
push str.NoChangeStartMenu
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x10]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call ebx
test eax, eax
jne 0x10001b69
mov ecx, dword [esp + 0x10]
push str.NoPrinters
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x14]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push ecx
call ebx
test eax, eax
jne 0x10001b93
mov edx, dword [esp + 0x14]
push str.NoAddPrinter
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push edx
call ebx
test eax, eax
jne 0x10001bbd
mov eax, dword [esp + 0x10]
push str.NoDisScrSavPage
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push eax
call ebx
test eax, eax
jne 0x10001be6
mov ecx, dword [esp + 0x14]
push str.NoDispAppearancePage
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push ecx
call ebx
test eax, eax
jne 0x10001c10
mov edx, dword [esp + 0x10]
push str.NoDispSettingsPage
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push edx
call ebx
test eax, eax
jne 0x10001c3a
mov eax, dword [esp + 0x14]
push str.NoPwdPage
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x10001c62
mov eax, dword [esp + 0x10]
push str.NoViewOnDrive
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call ebx
test eax, eax
jne 0x10001c8b
mov ecx, dword [esp + 0x14]
push str.NoViewOnDrive
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREPoliciesMicrosoftWindows_NTSystemRestore
push 0x80000002
call ebx
test eax, eax
jne 0x10001cb3
mov ecx, dword [esp + 0x10]
push str.DisableSR
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x14]
push eax
push str.SOFTWAREPoliciesMicrosoftWindows_NTSystemRestore
push ecx
call ebx
test eax, eax
jne 0x10001cdd
mov edx, dword [esp + 0x14]
push str.DisableSR
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push edx
call ebx
test eax, eax
jne 0x10001d07
mov eax, dword [esp + 0x10]
push str.DisallowRun
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call ebx
test eax, eax
jne 0x10001d30
mov ecx, dword [esp + 0x14]
push str.NoTrayContextMenu
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
lea eax, [esp + 0x10]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x10002967
mov ecx, dword [esp + 0x10]
push str.NoTrayContextMenu
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
xor eax, eax
jmp 0x1000296e
lea eax, [esp + 0x40]
push 0x104
push eax
call fcn.1000b900
add esp, 8
test eax, eax
je 0x10002967
lea eax, [esp + 0x40]
lea edx, [eax + 1]
xor ebx, ebx
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10001d86
sub eax, edx
mov dword [esp + 0x10], eax
dec eax
cmp eax, 0x9f
ja 0x10002967
lea edi, [esp + 0x40]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10001da4
mov ecx, 7
mov esi, str._system32driversetchosts
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x40]
push ecx
push ebp
call fcn.1000b690
mov edx, dword [esp + 0x18]
lea edi, [esp + 0x48]
add esp, 8
mov byte [esp + edx + 0x40], bl
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10001dd3
mov ecx, 6
mov esi, str._systemdriversetchosts
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x40]
push eax
push ebp
movsw word es:[edi], word [esi]
call fcn.1000b690
add esp, 8
xor eax, eax
jmp 0x1000296e
push str.about:blank
push str.Start_Page
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push 0x80000001
call fcn.1000b4a0
push str.about:blank
push str.Start_Page
push str..DEFAULTSoftwareMicrosoftInternet_ExplorerMain
push 0x80000003
call fcn.1000b4a0
mov edx, dword [0x100200a0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
add esp, 0x20
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push edx
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10001e6f
mov eax, dword [esp + 0x10]
push str.Window_Title
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push eax
call esi
test eax, eax
jne 0x10001e98
mov ecx, dword [esp + 0x14]
push str.Default_Page_URL
push ecx
call edi
mov edx, dword [esp + 0x14]
push edx
call ebx
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push ecx
call esi
test eax, eax
jne 0x10001ec2
mov edx, dword [esp + 0x10]
push str.Default_Search_URL
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push edx
call esi
test eax, eax
jne 0x10001eec
mov eax, dword [esp + 0x14]
push str.Search_Bar
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov eax, dword [0x100200a0]
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push eax
call esi
test eax, eax
jne 0x10001f15
mov ecx, dword [esp + 0x10]
push str.Search_Page
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x14]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push ecx
call esi
test eax, eax
jne 0x10001f3f
mov edx, dword [esp + 0x14]
push str.SearchURL
push edx
call edi
mov eax, dword [esp + 0x14]
push eax
call ebx
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push edx
call esi
test eax, eax
jne 0x10001f69
mov eax, dword [esp + 0x10]
push str.Local_Page
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call ebx
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push eax
call esi
test eax, eax
jne 0x10001f92
mov ecx, dword [esp + 0x14]
push str.HomeOldSP
push ecx
call edi
mov edx, dword [esp + 0x14]
push edx
call ebx
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerSearch
push ecx
call esi
test eax, eax
jne 0x10001fbc
mov edx, dword [esp + 0x10]
push str.SearchAssistant
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.SOFTWAREMicrosoftInternet_ExplorerSearch
push edx
call esi
test eax, eax
jne 0x10001fe6
mov eax, dword [esp + 0x14]
push str.CustomizeSearch
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call ebx
mov eax, dword [0x100200a0]
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftInternet_ExplorerSearchURL
push eax
call esi
test eax, eax
jne 0x1000200f
mov ecx, dword [esp + 0x10]
push 0x10019e5c
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
push str.http:__
push 0x10019e5c
push str.SOFTWAREMicrosoftWindowsCurrentVersionURLDefaultPrefix
push 0x80000002
call fcn.1000b4a0
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionURLPrefixes
push 0x80000002
call esi
test eax, eax
jne 0x10002053
mov ecx, dword [esp + 0x10]
push 0x10019e5c
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebx
push 0x10019f0c
push str.PopupMgr
push str.SOFTWAREMicrosoftInternet_ExplorerNew_Windows
push 0x80000002
call fcn.1000b4a0
push str._C:Program_FilesInternet_Exploreriexplore.exe_
push 0x10019e5c
push str.CLSID871C5380_42A0_1069_A2EA_08002B30309D_shellOpenHomePageCommand
push 0x80000000
call fcn.1000b4a0
mov ecx, dword [0x100200a0]
add esp, 0x20
lea eax, [esp + 0x10]
push eax
push str.SoftwarePoliciesMicrosoftInternet_ExplorerControl_Panel
push ecx
call esi
test eax, eax
jne 0x100020b2
mov edx, dword [esp + 0x10]
push str.Homepage
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x40]
push 0x104
push ecx
call fcn.1000b900
add esp, 8
test eax, eax
je 0x10002967
mov dl, byte [esp + 0x40]
xor ebx, ebx
lea edi, [esp + 0x40]
mov byte [esp + 0x41], dl
mov byte [esp + 0x40], 0x22
mov byte [esp + 0x42], bl
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x100020e4
push str.Open_Home_Page
push str.SOFTWAREClassesCLSID871C5380_42A0_1069_A2EA_08002B30309D_shellPage
mov ecx, 0xc
mov esi, str.:Program_FilesInternet_Exploreriexplore.exe_
push 0x80000002
rep movsd dword es:[edi], dword [esi]
call fcn.1000b510
lea eax, [esp + 0x4c]
push eax
push str.SOFTWAREClassesCLSID871C5380_42A0_1069_A2EA_08002B30309D_shellPageCommand
push 0x80000002
call fcn.1000b510
add esp, 0x18
xor eax, eax
jmp 0x1000296e
push str.__1___
push 0x10019e5c
push str.exefile_shellopencommand
push 0x80000000
call fcn.1000b4a0
push str.__1___
push 0x10019e5c
push str.comfile_shellopencommand
push 0x80000000
call fcn.1000b4a0
push str.NOTEPAD.EXE__1
push 0x10019e5c
push str.txtfile_shellopencommand
push 0x80000000
call fcn.1000b4a0
push str.__1___
push 0x10019e5c
push str..com_shellopencommand
push 0x80000000
call fcn.1000b4a0
add esp, 0x40
push str.comfile
push 0x10019e5c
push str..com
push 0x80000000
call fcn.1000b4a0
push str.NOTEPAD.EXE__1
push 0x10019e5c
push str..txt_shellopencommand
push 0x80000000
call fcn.1000b4a0
push str.txtfile
push 0x10019e5c
push str..txt
push 0x80000000
call fcn.1000b4a0
push str.__1___
push 0x10019e5c
push str..exe_shellopencommand
push 0x80000000
call fcn.1000b4a0
add esp, 0x40
push str.exefile
push 0x10019e5c
push str..exe
push 0x80000000
call fcn.1000b4a0
push str.__1___
push 0x10019e5c
push str.batfile_shellopencommand
push 0x80000000
call fcn.1000b4a0
push str.__1___
push 0x10019e5c
push str..bat_shellopencommand
push 0x80000000
call fcn.1000b4a0
push str.batfile
push 0x10019e5c
push str..bat
push 0x80000000
call fcn.1000b4a0
add esp, 0x40
push str.WScript.exe___1___
push 0x10019e5c
push str.vbsfile_shellopencommand
push 0x80000000
call fcn.1000b4a0
push str.WScript.exe___1___
push 0x10019e5c
push str..vbs_shellopencommand
push 0x80000000
call fcn.1000b4a0
push str.vbsfile
push 0x10019e5c
push str..vbs
push 0x80000000
call fcn.1000b4a0
push str.exefile
push str.Progid
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.exe
push 0x80000001
call fcn.1000b4a0
add esp, 0x40
xor eax, eax
jmp 0x1000296e
push str.cmd.exe
push str.AlternateShell
push str.SYSTEMCurrentControlSetControlSafeBoot
push 0x80000002
call fcn.1000b4a0
push str.cmd.exe
push str.AlternateShell
push str.SYSTEMControlSet001ControlSafeBoot
push 0x80000002
call fcn.1000b4a0
push str.cmd.exe
push str.AlternateShell
push str.SOFTWAREMicrosoftWindowsCurrentVersionGroup_Policy_ObjectsLocalUserSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call fcn.1000b4a0
add esp, 0x30
xor eax, eax
jmp 0x1000296e
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push str.EnableFirewall
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile
mov esi, 1
push 0x80000002
mov dword [esp + 0x30], esi
call fcn.1000b430
push 4
lea edx, [esp + 0x34]
push edx
push 4
push str.EnableFirewall
push str.SOFTWAREPoliciesMicrosoftWindowsFirewallDomainProfile
push 0x80000002
mov dword [esp + 0x48], esi
call fcn.1000b430
push 4
lea eax, [esp + 0x4c]
push eax
push 4
push str.FirewallOverride
push str.SOFTWAREMicrosoftSecurity_Center
xor ebx, ebx
push 0x80000002
mov dword [esp + 0x60], ebx
call fcn.1000b430
add esp, 0x48
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push str.FirewallDisableNotify
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
mov dword [esp + 0x30], ebx
call fcn.1000b430
push 4
lea edx, [esp + 0x34]
push edx
push 4
push str.AUOptions
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
push 0x80000002
mov dword [esp + 0x48], 4
call fcn.1000b430
push 4
lea eax, [esp + 0x4c]
push eax
push 4
push str.NoAutoUpdate
push str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
push 0x80000002
mov dword [esp + 0x60], ebx
call fcn.1000b430
add esp, 0x48
push 4
lea ecx, [esp + 0x1c]
push ecx
push 4
push str.UpdatesDisableNotify
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
mov dword [esp + 0x30], ebx
call fcn.1000b430
push 4
lea edx, [esp + 0x34]
push edx
push 4
push str.AntiVirusDisableNotify
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
mov dword [esp + 0x48], ebx
call fcn.1000b430
push 4
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x50], ebx
push 4
push str.AntiVirusOverride
push str.SOFTWAREMicrosoftSecurity_Center
push 0x80000002
call fcn.1000b430
add esp, 0x48
xor eax, eax
jmp 0x1000296e
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10002967
mov edx, dword [esp + 0x10]
push str.Appinit_DLLs
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1000296e
push str.Userinit.exe
push str.Userinit
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call fcn.1000b4a0
add esp, 0x10
xor eax, eax
jmp 0x1000296e
mov edx, dword [0x100200a0]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push edx
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10002504
mov eax, dword [esp + 0x10]
push str.NoDispBackgroundPage
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push eax
call ebx
test eax, eax
jne 0x1000252d
mov ecx, dword [esp + 0x14]
push str.NoDispScrSavPage
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
push str.0_78_152
push str.Background
push str.Control_PanelColors
push 0x80000001
call fcn.1000b4a0
push 0x1001a610
push str.WallpaperStyle
push str.Control_PanelDesktop
push 0x80000001
call fcn.1000b4a0
push 0x1001a63c
push str.TileWallpaper
push str.Control_PanelDesktop
push 0x80000001
call fcn.1000b4a0
push 0x10019e5c
push str.OriginalWallpaper
push str.Control_PanelDesktop
push 0x80000001
call fcn.1000b4a0
add esp, 0x40
push str.C:WINDOWSSystem32logon.scr
push str.SCRNSAVE.EXE
push str.Control_PanelDesktop
push 0x80000001
call fcn.1000b4a0
mov ecx, dword [0x100200a0]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push str.Control_PanelDesktop
push ecx
call ebx
test eax, eax
jne 0x100025da
mov edx, dword [esp + 0x10]
push str.ConvertedWallpaper
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.Control_PanelDesktop
push edx
call ebx
test eax, eax
jne 0x10002604
mov eax, dword [esp + 0x14]
push str.OriginalWallpaper
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x10]
push edx
push str.Control_PanelDesktop
push eax
call ebx
test eax, eax
jne 0x1000262d
mov ecx, dword [esp + 0x10]
push str.Wallpaper
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x14]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push ecx
call ebx
test eax, eax
jne 0x10002657
mov edx, dword [esp + 0x14]
push str.NoSetActiveDesktop
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesActiveDesktop
push edx
call ebx
test eax, eax
jne 0x10002681
mov eax, dword [esp + 0x10]
push str.NoChangingWallpaper
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000002
call ebx
test eax, eax
jne 0x100026a9
mov eax, dword [esp + 0x14]
push str.NoSetActiveDesktop
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesActiveDesktop
push 0x80000002
call ebx
test eax, eax
jne 0x100026d1
mov eax, dword [esp + 0x10]
push str.NoChangingWallpaper
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftInternet_ExplorerDesktopGeneral
push eax
call ebx
test eax, eax
jne 0x100026fa
mov ecx, dword [esp + 0x14]
push str.WallpaperLocalFileTime
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerDesktopGeneral
push ecx
call ebx
test eax, eax
jne 0x10002724
mov edx, dword [esp + 0x10]
push str.WallpaperFileTime
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.SOFTWAREMicrosoftInternet_ExplorerDesktopGeneral
push edx
call ebx
test eax, eax
jne 0x1000274e
mov eax, dword [esp + 0x14]
push str.ComponentsPositioned
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftInternet_ExplorerDesktopGeneral
push eax
call ebx
test eax, eax
jne 0x10002777
mov ecx, dword [esp + 0x10]
push str.TileWallpaper
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x14]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerDesktopGeneral
push ecx
call ebx
test eax, eax
jne 0x100027a1
mov edx, dword [esp + 0x14]
push str.WallpaperStyle
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push edx
call ebx
test eax, eax
jne 0x100027cb
mov eax, dword [esp + 0x10]
push str.NoActiveDesktop
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push eax
call ebx
test eax, eax
jne 0x100027f4
mov ecx, dword [esp + 0x14]
push str.NoDesktop
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push ecx
call ebx
test eax, eax
jne 0x1000281e
mov edx, dword [esp + 0x10]
push str.ClassicShell
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
push edx
call ebx
test eax, eax
jne 0x10002848
mov eax, dword [esp + 0x14]
push str.ForceActiveDesktopOn
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x10]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesActiveDesktop
push eax
call ebx
test eax, eax
jne 0x10002871
mov ecx, dword [esp + 0x10]
push str.NoHTMLWallPaper
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x14]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesActiveDesktop
push ecx
call ebx
test eax, eax
jne 0x1000289b
mov edx, dword [esp + 0x14]
push str.NoEditingComponents
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x10]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesActiveDesktop
push edx
call ebx
test eax, eax
jne 0x100028c5
mov eax, dword [esp + 0x10]
push str.NoDeletingComponents
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x100200a0]
lea edx, [esp + 0x14]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesActiveDesktop
push eax
call ebx
test eax, eax
jne 0x100028ee
mov ecx, dword [esp + 0x14]
push str.NoAddingComponents
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call edi
mov ecx, dword [0x100200a0]
lea eax, [esp + 0x10]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesActiveDesktop
push ecx
call ebx
test eax, eax
jne 0x10002918
mov edx, dword [esp + 0x10]
push str.NoComponents
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call edi
mov edx, dword [0x100200a0]
lea ecx, [esp + 0x14]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push edx
call ebx
test eax, eax
jne 0x10002942
mov eax, dword [esp + 0x14]
push str.Wallpaper
push eax
call esi
mov ecx, dword [esp + 0x14]
push ecx
call edi
push str.logon.scr
push str.SCRNSAVE.EXE
push str.Control_PanelDesktop
push 0x80000001
call fcn.1000b4a0
add esp, 0x10
xor eax, eax
jmp 0x1000296e
call fcn.10008460
xor eax, eax
jmp 0x1000296e
or eax, 0xffffffff
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000bd45
add esp, 0x138
ret