Function at 0x410513
Capabilities:
Delete file
Get common file path
Persist via winlogon helper dll registry key
References logon banner

Disassembly:
mov eax, 0x433266
call fcn.004269c8
push ecx
mov eax, 0x18fc
call fcn.00425e20
mov eax, dword [0x44de90]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
push str.Trojan_Ransom.Win32.Taras.a_c_was_detected_n
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edi
call fcn.00425036
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x414]
mov dword [esp], 0x400
push eax
call esi
lea eax, [ebp - 0x414]
push str._fon.bmp
push eax
call fcn.00425610
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push eax
call ebx
push 0x400
lea eax, [ebp - 0x414]
push eax
call esi
lea eax, [ebp - 0x414]
push 0x43d224
push eax
call fcn.00425610
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push eax
call ebx
mov ecx, 0x80000001
mov eax, str.Control_PanelDesktop
lea ebx, [ebp - 0x41c]
xor esi, esi
inc esi
push 4
pop edx
mov dword [ebp - 0x18e0], ebx
lea ebx, [ebp - 0x420]
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x420], 0x30d40
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x424], 3
mov dword [ebp - 0x190c], ecx
mov dword [ebp - 0x1908], eax
mov dword [ebp - 0x1904], str.AutoEndTasks
mov dword [ebp - 0x1900], edi
mov dword [ebp - 0x18fc], esi
mov dword [ebp - 0x18f8], 0x43815c
mov dword [ebp - 0x18f4], ecx
mov dword [ebp - 0x18f0], eax
mov dword [ebp - 0x18ec], str.FontSmoothingType
mov dword [ebp - 0x18e8], edi
mov dword [ebp - 0x18e4], edx
mov dword [ebp - 0x18dc], ecx
mov dword [ebp - 0x18d8], eax
mov dword [ebp - 0x18d4], str.ForegroundLockTimeout
mov dword [ebp - 0x18d0], edi
mov dword [ebp - 0x18cc], edx
mov dword [ebp - 0x18c8], ebx
mov dword [ebp - 0x18c4], ecx
mov dword [ebp - 0x18c0], eax
mov dword [ebp - 0x18bc], str.MenuShowDelay
mov dword [ebp - 0x18b8], edi
mov dword [ebp - 0x18b4], esi
mov dword [ebp - 0x18b0], 0x435190
mov dword [ebp - 0x18ac], ecx
mov dword [ebp - 0x18a8], eax
mov dword [ebp - 0x18a4], str.WaitToKillAppTimeout
mov dword [ebp - 0x18a0], edi
mov dword [ebp - 0x189c], esi
mov dword [ebp - 0x1890], eax
mov eax, 0x4349c5
mov dword [ebp - 0x1888], edi
mov ebx, str.SoftwareMicrosoftInternet_ExplorerDesktopGeneral
mov dword [ebp - 0x1858], edi
mov dword [ebp - 0x1840], edi
mov edi, str.SoftwareMicrosoftInternet_ExplorerMain
mov dword [ebp - 0x1898], str.20000
mov dword [ebp - 0x1894], ecx
mov dword [ebp - 0x188c], str.Wallpaper
mov dword [ebp - 0x1884], esi
mov dword [ebp - 0x1880], eax
mov dword [ebp - 0x187c], ecx
mov dword [ebp - 0x1878], str.SoftwareMicrosoftCommand_Processor
mov dword [ebp - 0x1874], str.AutoRun
mov dword [ebp - 0x1870], esi
mov dword [ebp - 0x186c], esi
mov dword [ebp - 0x1868], eax
mov dword [ebp - 0x1864], ecx
mov dword [ebp - 0x1860], ebx
mov dword [ebp - 0x185c], str.BackupWallpaper
mov dword [ebp - 0x1854], esi
mov dword [ebp - 0x1850], eax
mov dword [ebp - 0x184c], ecx
mov dword [ebp - 0x1848], ebx
mov dword [ebp - 0x1844], str.Wallpaper
mov dword [ebp - 0x183c], esi
mov dword [ebp - 0x1838], eax
mov dword [ebp - 0x1834], ecx
mov dword [ebp - 0x1830], str.SoftwareMicrosoftInternet_Explorer
mov dword [ebp - 0x182c], str.Download_Directory
mov dword [ebp - 0x1828], esi
mov dword [ebp - 0x1824], esi
mov dword [ebp - 0x1820], eax
mov dword [ebp - 0x181c], ecx
mov dword [ebp - 0x1818], edi
mov dword [ebp - 0x1814], str.AllowWindowReuse
mov dword [ebp - 0x1810], esi
mov dword [ebp - 0x180c], edx
mov dword [ebp - 0x1808], eax
mov dword [ebp - 0x1804], ecx
mov dword [ebp - 0x1800], edi
mov dword [ebp - 0x17fc], str.AutoSearch
mov dword [ebp - 0x17f8], esi
mov dword [ebp - 0x17f4], edx
mov dword [ebp - 0x17f0], eax
mov dword [ebp - 0x17ec], ecx
mov dword [ebp - 0x17e8], edi
mov dword [ebp - 0x17e4], str.Enable_AutoImageResize
mov dword [ebp - 0x17e0], esi
mov dword [ebp - 0x17dc], edx
mov dword [ebp - 0x17d8], eax
mov dword [ebp - 0x17d4], ecx
mov dword [ebp - 0x17d0], edi
mov dword [ebp - 0x17cc], str.FavIntelliMenus
mov dword [ebp - 0x17c8], esi
mov dword [ebp - 0x17c4], edx
mov dword [ebp - 0x17c0], eax
mov dword [ebp - 0x17bc], ecx
mov dword [ebp - 0x17b8], edi
mov dword [ebp - 0x17b4], str.FormSuggest_Passwords
mov dword [ebp - 0x17b0], esi
mov dword [ebp - 0x17ac], edx
mov dword [ebp - 0x17a8], eax
mov dword [ebp - 0x17a4], ecx
mov dword [ebp - 0x17a0], edi
mov dword [ebp - 0x179c], str.FormSuggest_PW_Ask
mov dword [ebp - 0x1798], esi
mov dword [ebp - 0x1794], edx
mov dword [ebp - 0x1790], eax
mov dword [ebp - 0x178c], ecx
mov dword [ebp - 0x1788], edi
mov dword [ebp - 0x1784], str.Play_Background_Sounds
mov dword [ebp - 0x1780], esi
mov dword [ebp - 0x177c], edx
mov dword [ebp - 0x1778], eax
mov dword [ebp - 0x1774], ecx
mov dword [ebp - 0x1770], edi
mov dword [ebp - 0x176c], str.Use_FormSuggest
mov dword [ebp - 0x1768], esi
mov dword [ebp - 0x1764], edx
mov edi, str.Show
mov dword [ebp - 0x173c], edi
mov dword [ebp - 0x1724], edi
mov dword [ebp - 0x170c], edi
mov dword [ebp - 0x16f4], edi
mov dword [ebp - 0x16dc], edi
mov dword [ebp - 0x16c4], edi
mov dword [ebp - 0x16ac], edi
mov dword [ebp - 0x1694], edi
mov dword [ebp - 0x167c], edi
mov dword [ebp - 0x1664], edi
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov dword [ebp - 0x1760], eax
mov dword [ebp - 0x175c], ecx
mov dword [ebp - 0x1758], str.SoftwareMicrosoftMediaPlayerPreferences
mov dword [ebp - 0x1754], str.UpgradeCodecPrompt
mov dword [ebp - 0x1750], esi
mov dword [ebp - 0x174c], edx
mov dword [ebp - 0x1748], eax
mov dword [ebp - 0x1744], ecx
mov dword [ebp - 0x1740], str.SoftwareMicrosoftOffice10.0CommonOpen_FindPlacesStandardPlacesDesktop
mov dword [ebp - 0x1738], esi
mov dword [ebp - 0x1734], esi
mov dword [ebp - 0x1730], eax
mov dword [ebp - 0x172c], ecx
mov dword [ebp - 0x1728], str.SoftwareMicrosoftOffice10.0CommonOpen_FindPlacesStandardPlacesFavorites
mov dword [ebp - 0x1720], esi
mov dword [ebp - 0x171c], esi
mov dword [ebp - 0x1718], eax
mov dword [ebp - 0x1714], ecx
mov dword [ebp - 0x1710], str.SoftwareMicrosoftOffice10.0CommonOpen_FindPlacesStandardPlacesMyDocuments
mov dword [ebp - 0x1708], esi
mov dword [ebp - 0x1704], esi
mov dword [ebp - 0x1700], eax
mov dword [ebp - 0x16fc], ecx
mov dword [ebp - 0x16f8], str.SoftwareMicrosoftOffice10.0CommonOpen_FindPlacesStandardPlacesPublishing
mov dword [ebp - 0x16f0], esi
mov dword [ebp - 0x16ec], esi
mov dword [ebp - 0x16e8], eax
mov dword [ebp - 0x16e4], ecx
mov dword [ebp - 0x16e0], str.SoftwareMicrosoftOffice10.0CommonOpen_FindPlacesStandardPlacesRecent
mov dword [ebp - 0x16d8], esi
mov dword [ebp - 0x16d4], esi
mov dword [ebp - 0x16d0], eax
mov dword [ebp - 0x16cc], ecx
mov dword [ebp - 0x16c8], str.SoftwareMicrosoftOffice11.0CommonOpen_FindPlacesStandardPlacesDesktop
mov dword [ebp - 0x16c0], esi
mov dword [ebp - 0x16bc], esi
mov dword [ebp - 0x16b8], eax
mov dword [ebp - 0x16b4], ecx
mov dword [ebp - 0x16b0], str.SoftwareMicrosoftOffice11.0CommonOpen_FindPlacesStandardPlacesMyComputer
mov dword [ebp - 0x16a8], esi
mov dword [ebp - 0x16a4], esi
mov dword [ebp - 0x16a0], eax
mov dword [ebp - 0x169c], ecx
mov dword [ebp - 0x1698], str.SoftwareMicrosoftOffice11.0CommonOpen_FindPlacesStandardPlacesMyDocuments
mov dword [ebp - 0x1690], esi
mov dword [ebp - 0x168c], esi
mov dword [ebp - 0x1688], eax
mov dword [ebp - 0x1684], ecx
mov dword [ebp - 0x1680], str.SoftwareMicrosoftOffice11.0CommonOpen_FindPlacesStandardPlacesPublishing
mov dword [ebp - 0x1678], esi
mov dword [ebp - 0x1674], esi
mov dword [ebp - 0x1670], eax
mov dword [ebp - 0x166c], ecx
mov dword [ebp - 0x1668], str.SoftwareMicrosoftOffice11.0CommonOpen_FindPlacesStandardPlacesRecent
mov dword [ebp - 0x1660], esi
mov dword [ebp - 0x165c], esi
mov dword [ebp - 0x1658], eax
mov dword [ebp - 0x1654], ecx
mov dword [ebp - 0x1650], edi
mov dword [ebp - 0x164c], str.CascadeControlPanel
mov dword [ebp - 0x1648], esi
mov dword [ebp - 0x1644], esi
mov dword [ebp - 0x1640], eax
mov dword [ebp - 0x163c], ecx
mov dword [ebp - 0x1638], edi
mov dword [ebp - 0x1634], str.CascadeMyDocuments
mov dword [ebp - 0x1630], esi
mov dword [ebp - 0x162c], esi
mov dword [ebp - 0x1628], eax
lea ebx, [ebp - 0x41c]
mov dword [ebp - 0x15c8], ebx
lea ebx, [ebp - 0x418]
mov dword [ebp - 0x1624], ecx
mov dword [ebp - 0x1620], edi
mov dword [ebp - 0x161c], str.CascadeMyPictures
mov dword [ebp - 0x1618], esi
mov dword [ebp - 0x1614], esi
mov dword [ebp - 0x1610], eax
mov dword [ebp - 0x160c], ecx
mov dword [ebp - 0x1608], edi
mov dword [ebp - 0x1604], str.CascadeNetworkConnections
mov dword [ebp - 0x1600], esi
mov dword [ebp - 0x15fc], esi
mov dword [ebp - 0x15f8], eax
mov dword [ebp - 0x15f4], ecx
mov dword [ebp - 0x15f0], edi
mov dword [ebp - 0x15ec], str.CascadePrinters
mov dword [ebp - 0x15e8], esi
mov dword [ebp - 0x15e4], esi
mov dword [ebp - 0x15e0], eax
mov dword [ebp - 0x15dc], ecx
mov dword [ebp - 0x15d8], edi
mov dword [ebp - 0x15d4], str.DisableThumbnailCache
mov dword [ebp - 0x15d0], esi
mov dword [ebp - 0x15cc], edx
mov dword [ebp - 0x15c4], ecx
mov dword [ebp - 0x15c0], edi
mov dword [ebp - 0x15bc], str.EnableBalloonTips
mov dword [ebp - 0x15b8], esi
mov dword [ebp - 0x15b4], edx
mov dword [ebp - 0x15b0], ebx
mov dword [ebp - 0x15ac], ecx
mov dword [ebp - 0x15a8], edi
mov dword [ebp - 0x15a4], str.IntelliMenus
mov dword [ebp - 0x15a0], esi
mov dword [ebp - 0x159c], esi
mov dword [ebp - 0x1598], eax
mov dword [ebp - 0x1594], ecx
mov dword [ebp - 0x1590], edi
mov dword [ebp - 0x158c], str.Start_AdminToolsRoot
mov dword [ebp - 0x1588], esi
mov dword [ebp - 0x1584], esi
mov dword [ebp - 0x1580], eax
mov dword [ebp - 0x157c], ecx
mov dword [ebp - 0x1578], edi
mov dword [ebp - 0x1574], str.Start_AutoCascade
mov dword [ebp - 0x1570], esi
mov dword [ebp - 0x156c], esi
mov dword [ebp - 0x1568], eax
mov dword [ebp - 0x1564], ecx
mov dword [ebp - 0x1560], edi
mov dword [ebp - 0x155c], str.Start_EnableDragDrop
mov dword [ebp - 0x1558], esi
mov dword [ebp - 0x1554], esi
mov dword [ebp - 0x1550], eax
mov dword [ebp - 0x154c], ecx
mov dword [ebp - 0x1548], edi
mov dword [ebp - 0x1544], str.Start_LargeIcons
mov dword [ebp - 0x1540], esi
mov dword [ebp - 0x153c], esi
mov dword [ebp - 0x1538], eax
mov dword [ebp - 0x1534], ecx
mov dword [ebp - 0x1530], edi
mov dword [ebp - 0x152c], str.Start_LargeMFUIcons
mov dword [ebp - 0x1528], esi
mov dword [ebp - 0x1524], esi
mov dword [ebp - 0x1520], eax
mov dword [ebp - 0x151c], ecx
mov dword [ebp - 0x1518], edi
mov dword [ebp - 0x1514], str.Start_NotifyNewApps
mov dword [ebp - 0x1510], esi
mov dword [ebp - 0x150c], esi
mov dword [ebp - 0x1508], eax
mov dword [ebp - 0x1504], ecx
mov dword [ebp - 0x1500], edi
mov dword [ebp - 0x14fc], str.Start_ScrollPrograms
mov dword [ebp - 0x14f8], esi
mov dword [ebp - 0x14f4], esi
mov dword [ebp - 0x14f0], eax
mov dword [ebp - 0x14ec], ecx
mov dword [ebp - 0x14e8], edi
mov dword [ebp - 0x14e4], str.Start_ShowControlPanel
mov dword [ebp - 0x14e0], esi
mov dword [ebp - 0x14dc], esi
mov dword [ebp - 0x14d8], eax
mov dword [ebp - 0x14d4], ecx
mov dword [ebp - 0x14d0], edi
mov dword [ebp - 0x14cc], str.Start_ShowHelp
mov dword [ebp - 0x14c8], esi
mov dword [ebp - 0x14c4], esi
mov dword [ebp - 0x14c0], eax
mov dword [ebp - 0x14bc], ecx
mov dword [ebp - 0x14b8], edi
mov dword [ebp - 0x14b4], str.Start_ShowMyComputer
mov dword [ebp - 0x14b0], esi
mov dword [ebp - 0x14ac], esi
mov dword [ebp - 0x14a8], eax
mov dword [ebp - 0x14a4], ecx
mov dword [ebp - 0x14a0], edi
mov dword [ebp - 0x149c], str.Start_ShowMyDocs
mov dword [ebp - 0x1498], esi
mov dword [ebp - 0x1494], esi
mov dword [ebp - 0x1490], eax
mov dword [ebp - 0x148c], ecx
mov dword [ebp - 0x1488], edi
mov dword [ebp - 0x1484], str.Start_ShowMyMusic
mov dword [ebp - 0x1480], esi
mov dword [ebp - 0x147c], esi
mov dword [ebp - 0x1478], eax
mov dword [ebp - 0x1474], ecx
mov dword [ebp - 0x1470], edi
mov dword [ebp - 0x146c], str.Start_ShowMyPics
mov dword [ebp - 0x1468], esi
mov dword [ebp - 0x1464], esi
mov dword [ebp - 0x1460], eax
mov dword [ebp - 0x145c], ecx
mov dword [ebp - 0x1458], edi
mov dword [ebp - 0x1454], str.Start_ShowNetConn
mov dword [ebp - 0x1450], esi
mov dword [ebp - 0x144c], esi
mov dword [ebp - 0x1448], eax
mov dword [ebp - 0x1444], ecx
mov dword [ebp - 0x1440], edi
mov dword [ebp - 0x143c], str.Start_ShowNetPlaces
mov dword [ebp - 0x1438], esi
mov dword [ebp - 0x1434], esi
mov dword [ebp - 0x1430], eax
mov dword [ebp - 0x142c], ecx
mov dword [ebp - 0x1428], edi
mov dword [ebp - 0x1424], str.Start_ShowRecentDocs
mov dword [ebp - 0x1420], esi
mov dword [ebp - 0x141c], esi
mov dword [ebp - 0x1418], eax
mov dword [ebp - 0x1414], ecx
mov dword [ebp - 0x1410], edi
mov dword [ebp - 0x140c], str.Start_ShowRun
mov dword [ebp - 0x1408], esi
mov dword [ebp - 0x1404], esi
mov dword [ebp - 0x1400], eax
mov dword [ebp - 0x13fc], ecx
mov dword [ebp - 0x13f8], edi
mov dword [ebp - 0x13f4], str.Start_ShowSearch
mov dword [ebp - 0x13f0], esi
mov dword [ebp - 0x13ec], esi
mov dword [ebp - 0x13e8], eax
mov dword [ebp - 0x13e4], ecx
mov dword [ebp - 0x13e0], edi
mov dword [ebp - 0x13dc], str.StartMenuAdminTools
mov dword [ebp - 0x13d8], esi
mov dword [ebp - 0x13d4], esi
mov dword [ebp - 0x13d0], eax
mov dword [ebp - 0x13cc], ecx
mov dword [ebp - 0x13c8], edi
mov dword [ebp - 0x13c4], str.StartMenuChange
mov dword [ebp - 0x13c0], esi
mov dword [ebp - 0x13bc], esi
mov dword [ebp - 0x13b8], eax
mov dword [ebp - 0x13b4], ecx
mov dword [ebp - 0x13b0], edi
mov dword [ebp - 0x13ac], str.StartMenuFavorites
mov dword [ebp - 0x13a8], esi
mov dword [ebp - 0x1398], edi
mov dword [ebp - 0x1380], edi
mov dword [ebp - 0x1368], edi
mov dword [ebp - 0x1350], edi
mov dword [ebp - 0x1338], edi
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsClassicStartMenu
mov dword [ebp - 0x1308], edi
mov dword [ebp - 0x12f0], edi
mov dword [ebp - 0x12d8], edi
mov dword [ebp - 0x12c0], edi
mov dword [ebp - 0x12a8], edi
mov edi, ebx
mov dword [ebp - 0x1298], edi
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanel
mov dword [ebp - 0x13a4], esi
mov dword [ebp - 0x13a0], eax
mov dword [ebp - 0x139c], ecx
mov dword [ebp - 0x1394], str.StartMenuLogoff
mov dword [ebp - 0x1390], esi
mov dword [ebp - 0x138c], esi
mov dword [ebp - 0x1388], eax
mov dword [ebp - 0x1384], ecx
mov dword [ebp - 0x137c], str.StartMenuRun
mov dword [ebp - 0x1378], esi
mov dword [ebp - 0x1374], esi
mov dword [ebp - 0x1370], eax
mov dword [ebp - 0x136c], ecx
mov dword [ebp - 0x1364], str.StartMenuScrollPrograms
mov dword [ebp - 0x1360], esi
mov dword [ebp - 0x135c], esi
mov dword [ebp - 0x1358], eax
mov dword [ebp - 0x1354], ecx
mov dword [ebp - 0x134c], str.TaskbarGlomming
mov dword [ebp - 0x1348], esi
mov dword [ebp - 0x1344], edx
mov dword [ebp - 0x1340], eax
mov dword [ebp - 0x133c], ecx
mov dword [ebp - 0x1334], str.TaskbarGroupSize
mov dword [ebp - 0x1330], esi
mov dword [ebp - 0x132c], edx
mov dword [ebp - 0x1328], eax
mov dword [ebp - 0x1324], ecx
mov dword [ebp - 0x1320], str.SoftwareMicrosoftWindowsCurrentVersionExplorerAutoComplete
mov dword [ebp - 0x131c], str.AutoSuggest
mov dword [ebp - 0x1318], esi
mov dword [ebp - 0x1314], esi
mov dword [ebp - 0x1310], eax
mov dword [ebp - 0x130c], ecx
mov dword [ebp - 0x1304], str.208D2C60_3AEA_1069_A2D7_08002B30309D
mov dword [ebp - 0x1300], esi
mov dword [ebp - 0x12fc], edx
mov dword [ebp - 0x12f8], ebx
mov dword [ebp - 0x12f4], ecx
mov dword [ebp - 0x12ec], str.20D04FE0_3AEA_1069_A2D8_08002B30309D
mov dword [ebp - 0x12e8], esi
mov dword [ebp - 0x12e4], edx
mov dword [ebp - 0x12e0], ebx
mov dword [ebp - 0x12dc], ecx
mov dword [ebp - 0x12d4], str.450D8FBA_AD25_11D0_98A8_0800361B1103
mov dword [ebp - 0x12d0], esi
mov dword [ebp - 0x12cc], edx
mov dword [ebp - 0x12c8], ebx
mov dword [ebp - 0x12c4], ecx
mov dword [ebp - 0x12bc], str.645FF040_5081_101B_9F08_00AA002F954E
mov dword [ebp - 0x12b8], esi
mov dword [ebp - 0x12b4], edx
mov dword [ebp - 0x12b0], ebx
mov dword [ebp - 0x12ac], ecx
mov dword [ebp - 0x12a4], str.871C5380_42A0_1069_A2EA_08002B30309D
mov dword [ebp - 0x12a0], esi
mov dword [ebp - 0x129c], edx
mov dword [ebp - 0x1294], ecx
mov dword [ebp - 0x1290], edi
mov dword [ebp - 0x128c], str.208D2C60_3AEA_1069_A2D7_08002B30309D
mov dword [ebp - 0x1288], esi
mov dword [ebp - 0x1284], edx
mov dword [ebp - 0x1280], ebx
mov dword [ebp - 0x127c], ecx
mov dword [ebp - 0x1278], edi
mov dword [ebp - 0x1274], str.20D04FE0_3AEA_1069_A2D8_08002B30309D
mov dword [ebp - 0x1270], esi
mov dword [ebp - 0x1260], edi
mov dword [ebp - 0x1248], edi
mov dword [ebp - 0x1230], edi
mov edi, ebx
mov dword [ebp - 0x1220], edi
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionExplorer
mov dword [ebp - 0x1218], edi
mov dword [ebp - 0x1200], edi
mov edi, str.EnableAutodial
mov dword [ebp - 0x1268], ebx
mov dword [ebp - 0x1250], ebx
mov dword [ebp - 0x1238], ebx
mov dword [ebp - 0x1208], ebx
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov dword [ebp - 0x11e4], edi
mov dword [ebp - 0x11cc], edi
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov dword [ebp - 0x126c], edx
mov dword [ebp - 0x1264], ecx
mov dword [ebp - 0x125c], str.450D8FBA_AD25_11D0_98A8_0800361B1103
mov dword [ebp - 0x1258], esi
mov dword [ebp - 0x1254], edx
mov dword [ebp - 0x124c], ecx
mov dword [ebp - 0x1244], str.645FF040_5081_101B_9F08_00AA002F954E
mov dword [ebp - 0x1240], esi
mov dword [ebp - 0x123c], edx
mov dword [ebp - 0x1234], ecx
mov dword [ebp - 0x122c], str.871C5380_42A0_1069_A2EA_08002B30309D
mov dword [ebp - 0x1228], esi
mov dword [ebp - 0x1224], edx
mov dword [ebp - 0x121c], ecx
mov dword [ebp - 0x1214], str.EnableAutoTray
mov dword [ebp - 0x1210], esi
mov dword [ebp - 0x120c], edx
mov dword [ebp - 0x1204], ecx
mov dword [ebp - 0x11fc], str.link
mov dword [ebp - 0x11f8], esi
mov dword [ebp - 0x11f4], 3
mov dword [ebp - 0x11f0], eax
mov dword [ebp - 0x11ec], ecx
mov dword [ebp - 0x11e8], ebx
mov dword [ebp - 0x11e0], esi
mov dword [ebp - 0x11dc], edx
mov dword [ebp - 0x11d8], eax
mov dword [ebp - 0x11d4], ecx
mov dword [ebp - 0x11d0], ebx
mov dword [ebp - 0x11c8], esi
mov dword [ebp - 0x11c4], edx
mov dword [ebp - 0x11c0], eax
mov dword [ebp - 0x11bc], ecx
mov dword [ebp - 0x11b8], edi
mov dword [ebp - 0x11b4], str.ClassicShell
mov dword [ebp - 0x11b0], esi
mov dword [ebp - 0x11ac], edx
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11a4], ecx
mov dword [ebp - 0x11a0], edi
mov dword [ebp - 0x119c], str.ClearRecentDocsOnExit
mov dword [ebp - 0x1198], esi
mov dword [ebp - 0x1194], edx
mov dword [ebp - 0x1190], eax
mov dword [ebp - 0x118c], ecx
mov dword [ebp - 0x1188], edi
mov dword [ebp - 0x1184], str.DisallowRun
mov dword [ebp - 0x1180], esi
mov dword [ebp - 0x117c], edx
mov dword [ebp - 0x1178], eax
mov dword [ebp - 0x1174], ecx
mov dword [ebp - 0x1170], edi
mov dword [ebp - 0x116c], str.NoRecentDocsHistory
mov dword [ebp - 0x1168], esi
mov dword [ebp - 0x1164], edx
mov dword [ebp - 0x1160], eax
mov dword [ebp - 0x115c], ecx
mov dword [ebp - 0x1158], edi
mov dword [ebp - 0x1154], str.MaxRecentDocs
mov dword [ebp - 0x1150], esi
mov dword [ebp - 0x114c], edx
mov dword [ebp - 0x1148], eax
mov dword [ebp - 0x1144], ecx
mov dword [ebp - 0x1140], edi
mov dword [ebp - 0x113c], str.NoActiveDesktop
mov dword [ebp - 0x1138], esi
mov dword [ebp - 0x1134], edx
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x112c], ecx
mov dword [ebp - 0x1128], edi
mov dword [ebp - 0x1124], str.NoAddPrinter
mov dword [ebp - 0x1120], esi
mov dword [ebp - 0x111c], edx
mov dword [ebp - 0x1118], eax
mov dword [ebp - 0x1114], ecx
mov dword [ebp - 0x1110], edi
mov dword [ebp - 0x110c], str.NoCDBurning
mov dword [ebp - 0x1108], esi
mov dword [ebp - 0x1104], edx
mov dword [ebp - 0x1100], eax
mov dword [ebp - 0x10fc], ecx
mov dword [ebp - 0x10f8], edi
mov dword [ebp - 0x10f4], str.NoChangeStartMenu
mov dword [ebp - 0x10f0], esi
mov dword [ebp - 0x10ec], edx
mov dword [ebp - 0x10e8], eax
mov dword [ebp - 0x10e4], ecx
mov dword [ebp - 0x10e0], edi
mov dword [ebp - 0x10dc], str.NoClose
mov dword [ebp - 0x10d8], esi
mov dword [ebp - 0x10d4], edx
mov dword [ebp - 0x10d0], eax
mov dword [ebp - 0x10cc], ecx
mov dword [ebp - 0x10c8], edi
mov dword [ebp - 0x10c4], str.NoCommonGroups
mov dword [ebp - 0x10c0], esi
mov dword [ebp - 0x10bc], edx
mov dword [ebp - 0x10b8], eax
mov dword [ebp - 0x10b4], ecx
mov dword [ebp - 0x10b0], edi
mov dword [ebp - 0x10ac], str.NoControlPanel
mov dword [ebp - 0x10a8], esi
mov dword [ebp - 0x10a4], edx
mov dword [ebp - 0x10a0], eax
mov dword [ebp - 0x109c], ecx
mov dword [ebp - 0x1098], edi
mov dword [ebp - 0x1094], str.NoDeletePrinter
mov dword [ebp - 0x1090], esi
mov dword [ebp - 0x108c], edx
mov dword [ebp - 0x1088], eax
mov dword [ebp - 0x1084], ecx
mov dword [ebp - 0x1080], edi
mov dword [ebp - 0x107c], str.NoDesktop
mov dword [ebp - 0x1078], esi
mov dword [ebp - 0x1074], edx
mov dword [ebp - 0x1070], eax
mov dword [ebp - 0x106c], ecx
mov dword [ebp - 0x1068], edi
mov dword [ebp - 0x1064], str.NoDrives
mov dword [ebp - 0x1060], esi
mov dword [ebp - 0x105c], edx
mov dword [ebp - 0x1058], eax
mov dword [ebp - 0x1054], ecx
mov dword [ebp - 0x1050], edi
mov dword [ebp - 0x104c], str.NoFileMenu
mov dword [ebp - 0x1048], esi
mov dword [ebp - 0x1044], edx
mov dword [ebp - 0x1040], eax
mov dword [ebp - 0x103c], ecx
mov dword [ebp - 0x1038], edi
mov dword [ebp - 0x1034], str.NoFind
mov dword [ebp - 0x1030], esi
mov dword [ebp - 0x102c], edx
mov dword [ebp - 0x1028], eax
mov dword [ebp - 0x1024], ecx
mov dword [ebp - 0x1020], edi
mov dword [ebp - 0x101c], str.NoInstrumentation
mov dword [ebp - 0x1018], esi
mov dword [ebp - 0x1014], edx
mov dword [ebp - 0x1010], eax
mov dword [ebp - 0x100c], ecx
mov dword [ebp - 0x1008], edi
mov dword [ebp - 0x1004], str.NoLogOff
mov dword [ebp - 0x1000], esi
mov dword [ebp - 0xffc], edx
mov dword [ebp - 0xff8], eax
mov dword [ebp - 0xff4], ecx
mov dword [ebp - 0xff0], edi
mov dword [ebp - 0xfec], str.NoLowDiskSpaceChecks
mov dword [ebp - 0xfe8], esi
mov dword [ebp - 0xfe4], edx
mov dword [ebp - 0xfe0], eax
mov dword [ebp - 0xfdc], ecx
mov dword [ebp - 0xfd8], edi
mov dword [ebp - 0xfd4], str.NoRecentDocsMenu
mov dword [ebp - 0xfd0], esi
mov dword [ebp - 0xfcc], edx
mov dword [ebp - 0xfc8], eax
mov dword [ebp - 0xfc4], ecx
mov dword [ebp - 0xfc0], edi
mov dword [ebp - 0xfbc], str.NoRun
mov dword [ebp - 0xfb8], esi
mov dword [ebp - 0xfb4], edx
mov dword [ebp - 0xfb0], eax
mov dword [ebp - 0xfac], ecx
mov dword [ebp - 0xfa8], edi
mov dword [ebp - 0xfa4], str.NoSaveSettings
mov dword [ebp - 0xfa0], esi
mov dword [ebp - 0xf9c], edx
mov dword [ebp - 0xf98], eax
mov dword [ebp - 0xf94], ecx
mov dword [ebp - 0xf90], edi
mov dword [ebp - 0xf8c], str.NoSetFolders
mov dword [ebp - 0xf88], esi
mov dword [ebp - 0xf84], edx
mov dword [ebp - 0xf80], eax
mov dword [ebp - 0xf7c], ecx
mov dword [ebp - 0xf78], edi
mov dword [ebp - 0xf74], str.NoSetTaskbar
mov dword [ebp - 0xf70], esi
mov dword [ebp - 0xf6c], edx
mov dword [ebp - 0xf68], eax
mov dword [ebp - 0xf64], ecx
mov dword [ebp - 0xf60], edi
mov dword [ebp - 0xf5c], str.NoShellSearchButton
mov dword [ebp - 0xf58], esi
mov dword [ebp - 0xf54], edx
mov dword [ebp - 0xf50], eax
mov dword [ebp - 0xf4c], ecx
mov dword [ebp - 0xf48], edi
mov dword [ebp - 0xf44], str.NoSimpleStartMenu
mov dword [ebp - 0xf40], esi
mov dword [ebp - 0xf3c], edx
mov dword [ebp - 0xf38], eax
mov dword [ebp - 0xf34], ecx
mov dword [ebp - 0xf30], edi
mov dword [ebp - 0xf2c], str.NoSMHelp
mov dword [ebp - 0xf28], esi
mov dword [ebp - 0xf24], edx
mov dword [ebp - 0xf20], eax
mov dword [ebp - 0xf1c], ecx
mov dword [ebp - 0xf18], edi
mov dword [ebp - 0xf14], str.NoStartMenuMFUprogramsList
mov dword [ebp - 0xf10], esi
mov dword [ebp - 0xf0c], edx
mov dword [ebp - 0xf08], eax
mov dword [ebp - 0xf04], ecx
mov dword [ebp - 0xf00], edi
mov dword [ebp - 0xefc], str.NoStartMenuMorePrograms
mov dword [ebp - 0xef8], esi
mov dword [ebp - 0xef4], edx
mov dword [ebp - 0xef0], eax
mov dword [ebp - 0xeec], ecx
mov dword [ebp - 0xee8], edi
mov dword [ebp - 0xee4], str.NoToolbarCustomize
mov dword [ebp - 0xee0], esi
mov dword [ebp - 0xedc], edx
mov dword [ebp - 0xed8], eax
mov dword [ebp - 0xed4], ecx
mov dword [ebp - 0xed0], edi
mov dword [ebp - 0xecc], str.NoTrayContextMenu
mov dword [ebp - 0xec8], esi
mov dword [ebp - 0xec4], edx
mov dword [ebp - 0xec0], eax
mov dword [ebp - 0xebc], ecx
mov dword [ebp - 0xeb8], edi
mov dword [ebp - 0xea0], edi
mov dword [ebp - 0xe88], edi
mov dword [ebp - 0xe70], edi
mov dword [ebp - 0xe58], edi
mov dword [ebp - 0xe40], edi
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRestrictRun
mov dword [ebp - 0xe28], edi
mov dword [ebp - 0xe10], edi
mov dword [ebp - 0xdf8], edi
mov dword [ebp - 0xde0], edi
mov dword [ebp - 0xdc8], edi
mov dword [ebp - 0xdb0], edi
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov dword [ebp - 0xeb4], str.NoTrayItemsDisplay
mov dword [ebp - 0xeb0], esi
mov dword [ebp - 0xeac], edx
mov dword [ebp - 0xea8], eax
mov dword [ebp - 0xea4], ecx
mov dword [ebp - 0xe9c], str.NoUserNameInStartMenu
mov dword [ebp - 0xe98], esi
mov dword [ebp - 0xe94], edx
mov dword [ebp - 0xe90], eax
mov dword [ebp - 0xe8c], ecx
mov dword [ebp - 0xe84], str.NoViewContextMenu
mov dword [ebp - 0xe80], esi
mov dword [ebp - 0xe7c], edx
mov dword [ebp - 0xe78], eax
mov dword [ebp - 0xe74], ecx
mov dword [ebp - 0xe6c], str.NoViewOnDrive
mov dword [ebp - 0xe68], esi
mov dword [ebp - 0xe64], edx
mov dword [ebp - 0xe60], eax
mov dword [ebp - 0xe5c], ecx
mov dword [ebp - 0xe54], 0x43c6c0
mov dword [ebp - 0xe50], esi
mov dword [ebp - 0xe4c], edx
mov dword [ebp - 0xe48], eax
mov dword [ebp - 0xe44], ecx
mov dword [ebp - 0xe3c], str.StartMenuLogoff
mov dword [ebp - 0xe38], esi
mov dword [ebp - 0xe34], edx
mov dword [ebp - 0xe30], eax
mov dword [ebp - 0xe2c], ecx
mov dword [ebp - 0xe24], 0x43815c
mov dword [ebp - 0xe20], esi
mov dword [ebp - 0xe1c], esi
mov dword [ebp - 0xe18], eax
mov dword [ebp - 0xe14], ecx
mov dword [ebp - 0xe0c], 0x43c6bc
mov dword [ebp - 0xe08], esi
mov dword [ebp - 0xe04], esi
mov dword [ebp - 0xe00], eax
mov dword [ebp - 0xdfc], ecx
mov dword [ebp - 0xdf4], 0x43c6b8
mov dword [ebp - 0xdf0], esi
mov dword [ebp - 0xdec], esi
mov dword [ebp - 0xde8], eax
mov dword [ebp - 0xde4], ecx
mov dword [ebp - 0xddc], 0x43c6b4
mov dword [ebp - 0xdd8], esi
mov dword [ebp - 0xdd4], esi
mov dword [ebp - 0xdd0], eax
mov dword [ebp - 0xdcc], ecx
mov dword [ebp - 0xdc4], 0x43c6b0
mov dword [ebp - 0xdc0], esi
mov dword [ebp - 0xdbc], esi
mov dword [ebp - 0xdb8], eax
mov dword [ebp - 0xdb4], ecx
mov dword [ebp - 0xdac], str.54321
mov dword [ebp - 0xda8], esi
mov dword [ebp - 0xda4], esi
mov dword [ebp - 0xda0], eax
mov dword [ebp - 0xd9c], ecx
mov dword [ebp - 0xd98], edi
mov dword [ebp - 0xd94], str.DisableRegistryTools
mov dword [ebp - 0xd90], esi
mov dword [ebp - 0xd8c], edx
mov dword [ebp - 0xd88], eax
mov dword [ebp - 0xd84], ecx
mov dword [ebp - 0xd80], edi
mov dword [ebp - 0xd7c], str.DisableTaskMgr
mov dword [ebp - 0xd68], edi
mov dword [ebp - 0xd50], edi
mov dword [ebp - 0xd38], edi
mov dword [ebp - 0xd20], edi
mov dword [ebp - 0xd08], edi
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesUninstall
mov dword [ebp - 0xd78], esi
mov dword [ebp - 0xd74], edx
mov dword [ebp - 0xd70], eax
mov dword [ebp - 0xd6c], ecx
mov dword [ebp - 0xd64], str.NoDispAppearancePage
mov dword [ebp - 0xd60], esi
mov dword [ebp - 0xd5c], edx
mov dword [ebp - 0xd58], eax
mov dword [ebp - 0xd54], ecx
mov dword [ebp - 0xd4c], str.NoDispBackgroundPage
mov dword [ebp - 0xd48], esi
mov dword [ebp - 0xd44], edx
mov dword [ebp - 0xd40], eax
mov dword [ebp - 0xd3c], ecx
mov dword [ebp - 0xd34], str.NoDispCPL
mov dword [ebp - 0xd30], esi
mov dword [ebp - 0xd2c], edx
mov dword [ebp - 0xd28], eax
mov dword [ebp - 0xd24], ecx
mov dword [ebp - 0xd1c], str.NoDispScrSavPage
mov dword [ebp - 0xd18], esi
mov dword [ebp - 0xd14], edx
mov dword [ebp - 0xd10], eax
mov dword [ebp - 0xd0c], ecx
mov dword [ebp - 0xd04], str.NoDispSettingsPage
mov dword [ebp - 0xd00], esi
mov dword [ebp - 0xcfc], edx
mov dword [ebp - 0xcf8], eax
mov dword [ebp - 0xcf4], ecx
mov dword [ebp - 0xcf0], edi
mov dword [ebp - 0xcec], str.NoAddFromCDorFloppy
mov dword [ebp - 0xce8], esi
mov dword [ebp - 0xce4], edx
mov dword [ebp - 0xce0], eax
mov dword [ebp - 0xcdc], ecx
mov dword [ebp - 0xcd8], edi
mov dword [ebp - 0xcd4], str.NoAddFromInternet
mov dword [ebp - 0xcd0], esi
mov dword [ebp - 0xccc], edx
mov dword [ebp - 0xcc8], eax
mov dword [ebp - 0xcc4], ecx
mov dword [ebp - 0xcc0], edi
mov dword [ebp - 0xcbc], str.NoAddFromNetwork
mov dword [ebp - 0xcb8], esi
mov dword [ebp - 0xcb4], edx
mov dword [ebp - 0xcb0], eax
mov dword [ebp - 0xcac], ecx
mov dword [ebp - 0xca8], edi
mov dword [ebp - 0xca4], str.NoAddPage
mov dword [ebp - 0xca0], esi
mov dword [ebp - 0xc9c], edx
mov dword [ebp - 0xc98], eax
mov dword [ebp - 0xc94], ecx
mov dword [ebp - 0xc90], edi
mov dword [ebp - 0xc8c], str.NoAddRemovePrograms
mov dword [ebp - 0xc88], esi
mov dword [ebp - 0xc84], edx
mov dword [ebp - 0xc80], eax
mov dword [ebp - 0xc7c], ecx
mov dword [ebp - 0xc78], edi
mov dword [ebp - 0xc74], str.NoRemovePage
mov dword [ebp - 0xc70], esi
mov dword [ebp - 0xc6c], edx
mov dword [ebp - 0xc68], eax
mov dword [ebp - 0xc64], ecx
mov dword [ebp - 0xc60], edi
mov dword [ebp - 0xc5c], str.NoSupportInfo
mov dword [ebp - 0xc58], esi
mov dword [ebp - 0xc54], edx
mov dword [ebp - 0xc50], eax
mov dword [ebp - 0xc4c], ecx
mov dword [ebp - 0xc48], edi
mov dword [ebp - 0xc44], str.NoWindowsSetupPage
mov dword [ebp - 0xc40], esi
mov dword [ebp - 0xc3c], edx
mov edi, str.SoftwarePoliciesMicrosoftInternet_ExplorerControl_Panel
mov dword [ebp - 0xc30], edi
mov dword [ebp - 0xc18], edi
mov dword [ebp - 0xc00], edi
mov dword [ebp - 0xbe8], edi
mov dword [ebp - 0xbd0], edi
mov dword [ebp - 0xbb8], edi
mov dword [ebp - 0xba0], edi
mov dword [ebp - 0xb88], edi
mov dword [ebp - 0xb70], edi
mov edi, str.SoftwareXP_TweakerOptions
mov dword [ebp - 0xc38], eax
mov dword [ebp - 0xc34], ecx
mov dword [ebp - 0xc2c], str.Advanced
mov dword [ebp - 0xc28], esi
mov dword [ebp - 0xc24], edx
mov dword [ebp - 0xc20], eax
mov dword [ebp - 0xc1c], ecx
mov dword [ebp - 0xc14], str.AdvancedTab
mov dword [ebp - 0xc10], esi
mov dword [ebp - 0xc0c], edx
mov dword [ebp - 0xc08], eax
mov dword [ebp - 0xc04], ecx
mov dword [ebp - 0xbfc], str.ConnectionsTab
mov dword [ebp - 0xbf8], esi
mov dword [ebp - 0xbf4], edx
mov dword [ebp - 0xbf0], eax
mov dword [ebp - 0xbec], ecx
mov dword [ebp - 0xbe4], str.ContentTab
mov dword [ebp - 0xbe0], esi
mov dword [ebp - 0xbdc], edx
mov dword [ebp - 0xbd8], eax
mov dword [ebp - 0xbd4], ecx
mov dword [ebp - 0xbcc], str.GeneralTab
mov dword [ebp - 0xbc8], esi
mov dword [ebp - 0xbc4], edx
mov dword [ebp - 0xbc0], eax
mov dword [ebp - 0xbbc], ecx
mov dword [ebp - 0xbb4], str.PrivacyTab
mov dword [ebp - 0xbb0], esi
mov dword [ebp - 0xbac], edx
mov dword [ebp - 0xba8], eax
mov dword [ebp - 0xba4], ecx
mov dword [ebp - 0xb9c], str.ProgramsTab
mov dword [ebp - 0xb98], esi
mov dword [ebp - 0xb94], edx
mov dword [ebp - 0xb90], eax
mov dword [ebp - 0xb8c], ecx
mov dword [ebp - 0xb84], str.SecurityTab
mov dword [ebp - 0xb80], esi
mov dword [ebp - 0xb7c], edx
mov dword [ebp - 0xb78], eax
mov dword [ebp - 0xb74], ecx
mov dword [ebp - 0xb6c], str.Settings
mov dword [ebp - 0xb68], esi
mov dword [ebp - 0xb64], edx
mov dword [ebp - 0xb60], eax
mov dword [ebp - 0xb5c], ecx
mov dword [ebp - 0xb58], str.SoftwarePoliciesMicrosoftInternet_ExplorerRestrictions
mov dword [ebp - 0xb54], str.NoBrowserOptions
mov dword [ebp - 0xb50], esi
mov dword [ebp - 0xb4c], edx
mov dword [ebp - 0xb48], eax
mov dword [ebp - 0xb44], ecx
mov dword [ebp - 0xb40], str.SoftwarePoliciesMicrosoftWindowsSystemPower
mov dword [ebp - 0xb3c], str.PromptPasswordOnResume
mov dword [ebp - 0xb38], esi
mov dword [ebp - 0xb34], edx
mov dword [ebp - 0xb30], eax
mov dword [ebp - 0xb2c], ecx
mov dword [ebp - 0xb28], str.SoftwarePoliciesMicrosoftWindowsSystem
mov dword [ebp - 0xb24], str.DisableCMD
mov dword [ebp - 0xb20], esi
mov dword [ebp - 0xb1c], edx
mov dword [ebp - 0xb18], eax
mov dword [ebp - 0xb14], ecx
mov dword [ebp - 0xb10], edi
mov dword [ebp - 0xb0c], str.AlphaTransparent
mov dword [ebp - 0xb08], esi
mov dword [ebp - 0xb04], edx
mov dword [ebp - 0xb00], eax
mov dword [ebp - 0xafc], ecx
mov dword [ebp - 0xaf8], edi
mov dword [ebp - 0xaf4], str.cHeight
mov dword [ebp - 0xaf0], esi
mov dword [ebp - 0xaec], edx
mov dword [ebp - 0xae8], eax
mov dword [ebp - 0xae4], ecx
mov dword [ebp - 0xae0], edi
mov dword [ebp - 0xadc], str.cLeft
mov dword [ebp - 0xad8], esi
mov dword [ebp - 0xad4], edx
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xacc], ecx
mov dword [ebp - 0xac8], edi
mov dword [ebp - 0xac4], str.Consol
mov dword [ebp - 0xac0], esi
mov dword [ebp - 0xabc], edx
mov dword [ebp - 0xab8], eax
mov dword [ebp - 0xab4], ecx
mov dword [ebp - 0xab0], edi
mov dword [ebp - 0xaac], str.ConsolBackGroundColor
mov dword [ebp - 0xaa8], esi
mov dword [ebp - 0xaa4], edx
mov dword [ebp - 0xaa0], eax
mov dword [ebp - 0xa9c], ecx
mov dword [ebp - 0xa98], edi
mov dword [ebp - 0xa94], str.ConsolTextColor
mov dword [ebp - 0xa90], esi
mov dword [ebp - 0xa8c], edx
mov dword [ebp - 0xa88], eax
mov dword [ebp - 0xa84], ecx
mov dword [ebp - 0xa80], edi
mov dword [ebp - 0xa7c], str.ConsolTransparent
mov dword [ebp - 0xa78], esi
mov dword [ebp - 0xa74], edx
mov dword [ebp - 0xa70], eax
mov dword [ebp - 0xa6c], ecx
mov dword [ebp - 0xa68], edi
mov dword [ebp - 0xa64], str.cTop
mov dword [ebp - 0xa60], esi
mov dword [ebp - 0xa5c], edx
mov dword [ebp - 0xa58], eax
mov dword [ebp - 0xa54], ecx
mov dword [ebp - 0xa50], edi
mov dword [ebp - 0xa4c], str.cWidth
mov dword [ebp - 0xa48], esi
mov dword [ebp - 0xa44], edx
mov dword [ebp - 0xa40], eax
mov dword [ebp - 0xa3c], ecx
mov dword [ebp - 0xa38], edi
mov dword [ebp - 0xa34], str.DontSaveLogFile
mov dword [ebp - 0xa30], esi
mov dword [ebp - 0xa2c], edx
mov dword [ebp - 0xa28], eax
mov dword [ebp - 0xa24], ecx
mov dword [ebp - 0xa20], edi
mov dword [ebp - 0xa1c], str.Height
mov dword [ebp - 0xa18], esi
mov dword [ebp - 0xa14], edx
mov dword [ebp - 0xa10], eax
mov dword [ebp - 0xa0c], ecx
mov dword [ebp - 0xa08], edi
mov dword [ebp - 0xa04], str.IntelliMouse
mov dword [ebp - 0xa00], esi
mov dword [ebp - 0x9fc], edx
mov dword [ebp - 0x9f8], eax
mov dword [ebp - 0x9f4], ecx
mov dword [ebp - 0x9f0], edi
mov dword [ebp - 0x9ec], str.Language
mov dword [ebp - 0x9e8], esi
mov dword [ebp - 0x9e4], edx
mov dword [ebp - 0x9e0], eax
mov dword [ebp - 0x9dc], ecx
mov dword [ebp - 0x9d8], edi
mov dword [ebp - 0x9d4], str.Left
mov dword [ebp - 0x9d0], esi
mov dword [ebp - 0x9cc], edx
mov dword [ebp - 0x9c8], eax
mov dword [ebp - 0x9c4], ecx
mov dword [ebp - 0x9c0], edi
mov dword [ebp - 0x9bc], str.LogReadRegistry
mov dword [ebp - 0x9ac], ecx
mov dword [ebp - 0x994], ecx
mov dword [ebp - 0x97c], ecx
mov dword [ebp - 0x964], ecx
mov dword [ebp - 0x94c], ecx
mov dword [ebp - 0x934], ecx
mov dword [ebp - 0x91c], ecx
mov dword [ebp - 0x904], ecx
mov dword [ebp - 0x8ec], ecx
mov dword [ebp - 0x8d4], ecx
inc ecx
mov dword [ebp - 0x9a8], edi
mov dword [ebp - 0x990], edi
mov dword [ebp - 0x978], edi
mov dword [ebp - 0x960], edi
mov dword [ebp - 0x948], edi
mov dword [ebp - 0x930], edi
mov dword [ebp - 0x918], edi
mov dword [ebp - 0x900], edi
mov dword [ebp - 0x8e8], edi
mov dword [ebp - 0x8d0], edi
xor ebx, ebx
mov edi, str.IsShortcut
mov dword [ebp - 0x9b8], esi
mov dword [ebp - 0x9b4], edx
mov dword [ebp - 0x9b0], eax
mov dword [ebp - 0x9a4], str.LogWriteRegistry
mov dword [ebp - 0x9a0], esi
mov dword [ebp - 0x99c], edx
mov dword [ebp - 0x998], eax
mov dword [ebp - 0x98c], str.MinimizeToTray
mov dword [ebp - 0x988], esi
mov dword [ebp - 0x984], edx
mov dword [ebp - 0x980], eax
mov dword [ebp - 0x974], str.NoCancelMessage
mov dword [ebp - 0x970], esi
mov dword [ebp - 0x96c], edx
mov dword [ebp - 0x968], eax
mov dword [ebp - 0x95c], str.NoUseRefreshButton
mov dword [ebp - 0x958], esi
mov dword [ebp - 0x954], edx
mov dword [ebp - 0x950], eax
mov dword [ebp - 0x944], str.SaveConsolPosition
mov dword [ebp - 0x940], esi
mov dword [ebp - 0x93c], edx
mov dword [ebp - 0x938], eax
mov dword [ebp - 0x92c], str.SaveWindowPos
mov dword [ebp - 0x928], esi
mov dword [ebp - 0x924], edx
mov dword [ebp - 0x920], eax
mov dword [ebp - 0x914], str.SaveWindowSize
mov dword [ebp - 0x910], esi
mov dword [ebp - 0x90c], edx
mov dword [ebp - 0x908], eax
mov dword [ebp - 0x8fc], 0x43c3c8
mov dword [ebp - 0x8f8], esi
mov dword [ebp - 0x8f4], edx
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 0x8e4], str.Width
mov dword [ebp - 0x8e0], esi
mov dword [ebp - 0x8dc], edx
mov dword [ebp - 0x8d8], eax
mov dword [ebp - 0x8cc], str.WindowAlphaTransparent
mov dword [ebp - 0x8c8], esi
mov dword [ebp - 0x8c4], edx
mov dword [ebp - 0x8c0], eax
mov dword [ebp - 0x8bc], ecx
mov dword [ebp - 0x8b8], str.SOFTWAREClassesCLSID645FF040_5081_101B_9F08_00AA002F954E
mov dword [ebp - 0x8b4], str.LocalizedString
mov dword [ebp - 0x8b0], ebx
mov dword [ebp - 0x8ac], esi
mov dword [ebp - 0x8a8], str.Recycle_Bin
mov dword [ebp - 0x8a4], ecx
mov dword [ebp - 0x8a0], str.SOFTWAREClasseslnkfile
mov dword [ebp - 0x89c], edi
mov dword [ebp - 0x898], ebx
mov dword [ebp - 0x894], esi
mov dword [ebp - 0x890], eax
mov dword [ebp - 0x88c], ecx
mov dword [ebp - 0x888], str.SOFTWAREClassespiffile
mov dword [ebp - 0x884], edi
and dword [ebp - 0x850], 0
mov edi, str.SOFTWAREMicrosoftPCHealthErrorReporting
mov dword [ebp - 0x880], ebx
mov dword [ebp - 0x870], edi
mov dword [ebp - 0x868], ebx
lea ebx, [ebp - 0x41c]
mov dword [ebp - 0x858], edi
mov edi, ebx
mov dword [ebp - 0x848], edi
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
mov dword [ebp - 0x828], edi
mov dword [ebp - 0x810], edi
mov dword [ebp - 0x7f8], edi
mov dword [ebp - 0x7e0], edi
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionpolicies_systemExplorer
mov dword [ebp - 0x860], ebx
mov ebx, str.DisableLocalMachineRunOnce
mov dword [ebp - 0x7c8], edi
mov dword [ebp - 0x7b0], edi
mov dword [ebp - 0x798], edi
mov dword [ebp - 0x780], edi
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionpolicies_system
mov dword [ebp - 0x87c], esi
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x874], ecx
mov dword [ebp - 0x86c], str.DoReport
mov dword [ebp - 0x864], edx
mov dword [ebp - 0x85c], ecx
mov dword [ebp - 0x854], str.ShowUI
mov dword [ebp - 0x84c], edx
mov dword [ebp - 0x844], ecx
mov dword [ebp - 0x840], str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
mov dword [ebp - 0x83c], str.AlwaysUnloadDLL
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], edx
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x82c], ecx
mov dword [ebp - 0x824], str.DisableCurrentUserRun
mov dword [ebp - 0x820], esi
mov dword [ebp - 0x81c], edx
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], ecx
mov dword [ebp - 0x80c], str.DisableCurrentUserRunOnce
mov dword [ebp - 0x808], esi
mov dword [ebp - 0x804], edx
mov dword [ebp - 0x800], eax
mov dword [ebp - 0x7fc], ecx
mov dword [ebp - 0x7f4], str.DisableLocalMachineRun
mov dword [ebp - 0x7f0], esi
mov dword [ebp - 0x7ec], edx
mov dword [ebp - 0x7e8], eax
mov dword [ebp - 0x7e4], ecx
mov dword [ebp - 0x7dc], ebx
mov dword [ebp - 0x7d8], esi
mov dword [ebp - 0x7d4], edx
mov dword [ebp - 0x7d0], eax
mov dword [ebp - 0x7cc], ecx
mov dword [ebp - 0x7c4], str.DisableCurrentUserRun
mov dword [ebp - 0x7c0], esi
mov dword [ebp - 0x7bc], edx
mov dword [ebp - 0x7b8], eax
mov dword [ebp - 0x7b4], ecx
mov dword [ebp - 0x7ac], str.DisableCurrentUserRunOnce
mov dword [ebp - 0x7a8], esi
mov dword [ebp - 0x7a4], edx
mov dword [ebp - 0x7a0], eax
mov dword [ebp - 0x79c], ecx
mov dword [ebp - 0x794], str.DisableLocalMachineRun
mov dword [ebp - 0x790], esi
mov dword [ebp - 0x78c], edx
mov dword [ebp - 0x788], eax
mov dword [ebp - 0x784], ecx
mov dword [ebp - 0x77c], ebx
mov dword [ebp - 0x778], esi
mov dword [ebp - 0x774], edx
mov dword [ebp - 0x770], eax
mov dword [ebp - 0x76c], ecx
mov dword [ebp - 0x768], edi
mov dword [ebp - 0x764], str.verbosestatus
mov dword [ebp - 0x760], esi
mov dword [ebp - 0x75c], edx
mov dword [ebp - 0x750], edi
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionWindows_UpdateAuto_Update
xor ebx, ebx
mov dword [ebp - 0x738], edi
mov dword [ebp - 0x720], edi
mov edi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov dword [ebp - 0x6e8], ebx
mov dword [ebp - 0x6d8], edi
mov dword [ebp - 0x6c0], edi
mov dword [ebp - 0x6a8], edi
mov dword [ebp - 0x690], edi
mov dword [ebp - 0x688], ebx
mov dword [ebp - 0x678], edi
mov edi, str.SOFTWAREPoliciesMicrosoftMessengerClient
mov dword [ebp - 0x670], ebx
lea ebx, [ebp - 0x41c]
mov dword [ebp - 0x758], eax
mov dword [ebp - 0x754], ecx
mov dword [ebp - 0x74c], str.DisableStatusMessages
mov dword [ebp - 0x748], esi
mov dword [ebp - 0x744], edx
mov dword [ebp - 0x740], eax
mov dword [ebp - 0x73c], ecx
mov dword [ebp - 0x734], str.AUOptions
mov dword [ebp - 0x730], esi
mov dword [ebp - 0x72c], edx
mov dword [ebp - 0x728], eax
mov dword [ebp - 0x724], ecx
mov dword [ebp - 0x71c], str.AUState
mov dword [ebp - 0x718], esi
mov dword [ebp - 0x714], edx
mov dword [ebp - 0x710], eax
mov dword [ebp - 0x70c], ecx
mov dword [ebp - 0x708], str.SOFTWAREMicrosoftWindowsCurrentVersionSetup
mov dword [ebp - 0x704], str.SourcePath
mov dword [ebp - 0x700], esi
mov dword [ebp - 0x6fc], esi
mov dword [ebp - 0x6f8], eax
mov dword [ebp - 0x6f4], ecx
mov dword [ebp - 0x6f0], str.SOFTWAREMicrosoftWindows_NTCurrentVersionAeDebug
mov dword [ebp - 0x6ec], str.Auto
mov dword [ebp - 0x6e4], esi
mov dword [ebp - 0x6e0], 0x43c6bc
mov dword [ebp - 0x6dc], ecx
mov dword [ebp - 0x6d4], str.AutoAdminLogon
mov dword [ebp - 0x6d0], esi
mov dword [ebp - 0x6cc], esi
mov dword [ebp - 0x6c8], eax
mov dword [ebp - 0x6c4], ecx
mov dword [ebp - 0x6bc], str.DefaultPassword
mov dword [ebp - 0x6b8], esi
mov dword [ebp - 0x6b4], esi
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 0x6ac], ecx
mov dword [ebp - 0x6a4], str.ForceAutoLogon
mov dword [ebp - 0x6a0], esi
mov dword [ebp - 0x69c], esi
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x694], ecx
mov dword [ebp - 0x68c], str.LegalNoticeCaption
mov dword [ebp - 0x684], esi
mov dword [ebp - 0x680], eax
mov dword [ebp - 0x67c], ecx
mov dword [ebp - 0x674], str.LegalNoticeText
mov dword [ebp - 0x66c], esi
mov dword [ebp - 0x668], eax
mov dword [ebp - 0x664], ecx
mov dword [ebp - 0x660], edi
mov dword [ebp - 0x65c], str.PreventAutoRun
mov dword [ebp - 0x658], esi
mov dword [ebp - 0x654], edx
mov dword [ebp - 0x650], ebx
mov dword [ebp - 0x64c], ecx
mov dword [ebp - 0x648], edi
mov dword [ebp - 0x644], str.PreventAutoUpdate
mov dword [ebp - 0x640], esi
mov dword [ebp - 0x63c], edx
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x634], ecx
mov dword [ebp - 0x630], edi
mov dword [ebp - 0x62c], str.PreventBackgroundDownload
and dword [ebp - 0x5c8], 0
and dword [ebp - 0x5b0], 0
mov dword [ebp - 0x618], edi
mov edi, ebx
mov dword [ebp - 0x608], edi
mov edi, str.SYSTEMCurrentControlSetControlCrashControl
mov dword [ebp - 0x5d0], edi
mov dword [ebp - 0x5b8], edi
mov dword [ebp - 0x5a0], edi
lea edi, [ebp - 0x418]
mov dword [ebp - 0x620], ebx
lea ebx, [ebp - 0x418]
mov dword [ebp - 0x590], edi
mov dword [ebp - 0x560], edi
mov edi, str.SYSTEMCurrentControlSetControlNlsCodePage
mov dword [ebp - 0x5c0], ebx
mov dword [ebp - 0x5a8], ebx
xor ebx, ebx
mov dword [ebp - 0x558], edi
mov dword [ebp - 0x540], edi
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x624], edx
mov dword [ebp - 0x61c], ecx
mov dword [ebp - 0x614], str.PreventRun
mov dword [ebp - 0x610], esi
mov dword [ebp - 0x60c], edx
mov dword [ebp - 0x604], ecx
mov dword [ebp - 0x600], str.SOFTWAREPoliciesMicrosoftWindows_NTReliability
mov dword [ebp - 0x5fc], str.ShutdownReasonUI
mov dword [ebp - 0x5f8], esi
mov dword [ebp - 0x5f4], edx
mov dword [ebp - 0x5f0], eax
mov dword [ebp - 0x5ec], ecx
mov dword [ebp - 0x5e8], str.SYSTEMCurrentControlSetControlClass4D36E96A_E325_11CE_BFC1_08002BE103180000
mov dword [ebp - 0x5e4], str.EnableUDMA66
mov dword [ebp - 0x5e0], esi
mov dword [ebp - 0x5dc], edx
mov dword [ebp - 0x5d8], eax
mov dword [ebp - 0x5d4], ecx
mov dword [ebp - 0x5cc], str.AutoReboot
mov dword [ebp - 0x5c4], edx
mov dword [ebp - 0x5bc], ecx
mov dword [ebp - 0x5b4], str.CrashDumpEnabled
mov dword [ebp - 0x5ac], edx
mov dword [ebp - 0x5a4], ecx
mov dword [ebp - 0x59c], str.SendAlert
mov dword [ebp - 0x598], ebx
mov dword [ebp - 0x594], edx
mov dword [ebp - 0x58c], ecx
mov dword [ebp - 0x588], str.SYSTEMCurrentControlSetControlFileSystem
mov dword [ebp - 0x584], str.NtfsDisableLastAccessUpdate
mov dword [ebp - 0x580], esi
mov dword [ebp - 0x57c], edx
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x574], ecx
mov dword [ebp - 0x570], str.SYSTEMCurrentControlSetControlLsa
mov dword [ebp - 0x56c], str.restrictanonymous
mov dword [ebp - 0x568], ebx
mov dword [ebp - 0x564], edx
mov dword [ebp - 0x55c], ecx
mov dword [ebp - 0x554], str.1250
mov dword [ebp - 0x550], ebx
mov dword [ebp - 0x54c], esi
mov dword [ebp - 0x548], str.c_1250.nls
mov dword [ebp - 0x544], ecx
mov dword [ebp - 0x53c], 0x43be60
mov dword [ebp - 0x538], ebx
mov dword [ebp - 0x534], esi
mov dword [ebp - 0x530], str.c_1252.nls
mov dword [ebp - 0x52c], ecx
mov dword [ebp - 0x528], str.SYSTEMCurrentControlSetControlSession_Manager
mov dword [ebp - 0x524], str.AutoChkTimeOut
mov dword [ebp - 0x520], esi
mov dword [ebp - 0x51c], edx
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], ecx
mov dword [ebp - 0x510], str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters
mov dword [ebp - 0x50c], str.EnablePrefetcher
mov dword [ebp - 0x508], ebx
mov dword [ebp - 0x504], edx
lea edi, [ebp - 0x424]
push dword [ebp + 8]
mov dword [ebp - 0x500], edi
mov edi, str.SYSTEMCurrentControlSetServiceslanmanserverparameters
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x4e0], edi
mov dword [ebp - 0x4c8], edi
mov edi, str.SYSTEMCurrentControlSetServicesTcpipParameters
lea eax, [ebp - 0x190c]
push 0xdf
push eax
mov dword [ebp - 0x4fc], ecx
mov dword [ebp - 0x4f8], str.SYSTEMCurrentControlSetServicesi8042prtParameters
mov dword [ebp - 0x4f4], str.CrashOnCtrlScroll
mov dword [ebp - 0x4f0], esi
mov dword [ebp - 0x4ec], edx
mov dword [ebp - 0x4e4], ecx
mov dword [ebp - 0x4dc], str.AutoShareServer
mov dword [ebp - 0x4d8], esi
mov dword [ebp - 0x4d4], edx
mov dword [ebp - 0x4cc], ecx
mov dword [ebp - 0x4c4], str.AutoShareWks
mov dword [ebp - 0x4c0], esi
mov dword [ebp - 0x4bc], edx
mov dword [ebp - 0x4b4], ecx
mov dword [ebp - 0x4b0], edi
mov dword [ebp - 0x4ac], str.DefaultTTL
mov dword [ebp - 0x4a8], esi
mov dword [ebp - 0x4a4], edx
mov dword [ebp - 0x49c], ecx
mov dword [ebp - 0x498], edi
mov dword [ebp - 0x494], str.EnablePMTUDiscovery
mov dword [ebp - 0x490], esi
mov dword [ebp - 0x48c], edx
mov dword [ebp - 0x484], ecx
mov dword [ebp - 0x480], edi
mov dword [ebp - 0x47c], 0x43bcdc
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x474], esi
mov dword [ebp - 0x46c], ecx
mov dword [ebp - 0x468], edi
mov dword [ebp - 0x464], str.SackOpts
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x45c], edx
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x44c], str.Tcp1323Opts
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x444], edx
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x434], str.TCPWindowSize
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x42c], esi
call fcn.0040506c
add esp, 0xc
call fcn.00426376
test eax, eax
je 0x412a07
call fcn.004262b5
jmp 0x4129f7
push str._nTo_finalize_removal_of_infection_and_avoid_loosing_of_data_program_will_reboot_your_PC_now._nClose_all_programs_and_choose_Y_to_restart_or_N_to_continue._n.
call fcn.00425036
mov dword [esp], 0x44dc28
call fcn.00426157
pop ecx
call fcn.004262b5
xor ecx, ecx
cmp eax, 0x79
sete cl
xor edx, edx
cmp eax, 0x59
sete dl
or ecx, edx
je 0x412a3c
call fcn.0042095f
mov eax, esi
jmp 0x412a73
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.00425221
pop edi
pop esi
pop ebx
leave
ret