Function at 0x1400345f0
Capabilities:
Disable system features via registry on windows
Execute command
Persist via windows service
Schedule task via schtasks
Self delete
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
lea r8, [rbp + 0x10]
mov edx, 0x30
movaps xmmword [rsp + 0x30], xmm7
mov dword [rbp + 0x10], 0x43960000
mov dword [rbp + 0x14], 0x43e08000
call fcn.14000a2e0
lea rcx, str.Explorer
call fcn.140030fc0
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x42c80000
lea rcx, str.Kill
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x14003465a
lea rcx, str.taskkill__f__im_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movss xmm6, dword [0x140042d88]
xorps xmm0, xmm0
movaps xmm1, xmm6
call fcn.140012c90
lea rcx, str.Open
mov dword [rbp + 0x10], 0x42c80000
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x14003469c
lea rcx, str.taskkill__f__im_explorer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [0x140049770]
movss xmm7, dword [0x140042cd8]
mov rdx, qword [rax + 0x4008]
cmp byte [rdx + 0xc3], 0
jne 0x1400346e6
mov r8d, dword [rdx + 0x1c4]
mov eax, r8d
neg eax
sbb ecx, ecx
add ecx, 2
cmp qword [rdx + 0x1b8], 0
je 0x1400346de
neg r8d
sbb ecx, ecx
add ecx, 6
movaps xmm1, xmm7
call fcn.140032bd0
lea rcx, str.Temporary_Files
call fcn.140030fc0
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x42c80000
lea rcx, str.Clean
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x140034755
lea rcx, str.DEL__S__Q___TMP_._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__S__Q___TEMP_._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__S__Q___WINDIR_Temp._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__S__Q___USERPROFILE_Local_SettingsTemp._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.DEL__S__Q___LOCALAPPDATA_Temp._
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [0x140049770]
mov rdx, qword [rax + 0x4008]
cmp byte [rdx + 0xc3], 0
jne 0x140034797
mov r8d, dword [rdx + 0x1c4]
mov eax, r8d
neg eax
sbb ecx, ecx
add ecx, 2
cmp qword [rdx + 0x1b8], 0
je 0x14003478f
neg r8d
sbb ecx, ecx
add ecx, 6
movaps xmm1, xmm7
call fcn.140032bd0
lea rcx, str.GameBar
call fcn.140030fc0
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x42c80000
lea rcx, str.Kill
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x1400347df
lea rcx, str.taskkill__f__im_GameBar.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.taskkill__f__im_GameBarFTServer.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rax, qword [0x140049770]
mov rdx, qword [rax + 0x4008]
cmp byte [rdx + 0xc3], 0
jne 0x140034821
mov r8d, dword [rdx + 0x1c4]
mov eax, r8d
neg eax
sbb ecx, ecx
add ecx, 2
cmp qword [rdx + 0x1b8], 0
je 0x140034819
neg r8d
sbb ecx, ecx
add ecx, 6
movaps xmm1, xmm7
call fcn.140032bd0
lea rcx, str.Sticky_Keys__Teclas_De_Aderencia
call fcn.140030fc0
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x42c80000
lea rcx, [0x14003dfdc]
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x140034884
lea rax, [0x140042904]
mov dword [rsp + 0x28], 4
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8, str.Flags
mov rcx, 0xffffffff80000001
lea rdx, str.Control_PanelAccessibilityStickyKeys
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140012c90
lea rcx, [0x140042908]
mov dword [rbp + 0x10], 0x42c80000
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x1400348e6
lea rax, [0x14004290c]
mov dword [rsp + 0x28], 4
mov r9d, 1
mov qword [rsp + 0x20], rax
lea r8, str.Flags
mov rcx, 0xffffffff80000001
lea rdx, str.Control_PanelAccessibilityStickyKeys
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rax, qword [0x140049770]
mov rdx, qword [rax + 0x4008]
cmp byte [rdx + 0xc3], 0
jne 0x140034928
mov r8d, dword [rdx + 0x1c4]
mov eax, r8d
neg eax
sbb ecx, ecx
add ecx, 2
cmp qword [rdx + 0x1b8], 0
je 0x140034920
neg r8d
sbb ecx, ecx
add ecx, 6
movaps xmm1, xmm7
call fcn.140032bd0
lea rcx, str.Disable
call fcn.140030fc0
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x43160000
lea rcx, str.Nvidia_Telemetry
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x140034a03
lea rcx, str.if_exist___ProgramFiles_NVIDIA_CorporationInstaller2InstallerCoreNVI2.DLL___rundll32___PROGRAMFILES_NVIDIA_CorporationInstaller2InstallerCoreNVI2.DLL__UninstallPackage_NvTelemetryContainer_rundll32___PROGRAMFILES_NVIDIA_CorporationInstaller2InstallerCoreNVI2.DLL__UninstallPackage_NvTelemetry_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.del__s__SystemRoot_System32DriverStoreFileRepositoryNvTelemetry.dll
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___ProgramFiles_x86__NVIDIA_CorporationNvTelemetry__2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.rmdir__s__q___ProgramFiles_NVIDIA_CorporationNvTelemetry__2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWARENVIDIA_CorporationNvControlPanel2Client___v__OptInOrOutPreference___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWARENVIDIA_CorporationGlobalFTS___v__EnableRID44231___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWARENVIDIA_CorporationGlobalFTS___v__EnableRID64640___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWARENVIDIA_CorporationGlobalFTS___v__EnableRID66610___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServices_nvlddmkmGlobalStartup___v__SendTelemetryData___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.PowerShell__ExecutionPolicy_Unrestricted__Command___serviceName__NvTelemetryContainer__Write_Host__Disabling_service:___serviceName_.________1._Skip_if_service_does_not_exist_____service__Get_Service__Name__serviceName__ErrorAction_SilentlyContinue__if___service____Write_Host__Service___serviceName__could_not_be_not_found__no_need_to_disable_it.___Exit_0_________2._Stop_if_running____if___service.Status__eq__System.ServiceProcess.ServiceControllerStatus_::Running____Write_Host_____serviceName__is_running__stopping_it.___try___Stop_Service__Name___serviceName___Force__ErrorAction_Stop__Write_Host__Stopped___serviceName__successfully.____catch___Write_Warning__Could_not_stop___serviceName___it_will_be_stopped_after_reboot:_________else___Write_Host_____serviceName__is_not_running__no_need_to_stop.__________3._Skip_if_already_disabled_____startupType___service.StartType___Does_not_work_before_.NET_4.6.1____if___startupType_____startupType___Get_WmiObject__Query__Select_StartMode_From_Win32_Service_Where_Name_serviceName___ErrorAction_Ignore_.StartMode__if___startupType_____startupType___Get_WmiObject__Class_Win32_Service__Property_StartMode__Filter__Name_serviceName___ErrorAction_Ignore_.StartMode______if__startupType__eq_Disabled____Write_Host___serviceName_is_already_disabled__no_further_action_is_needed__________4._Disable_service____try___Set_Service__Name___serviceName___StartupType_Disabled__Confirm:_false__ErrorAction_Stop__Write_Host__Disabled___serviceName__successfully.____catch___Write_Error__Could_not_disable___serviceName_:_______
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__TN_NvTmMon_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8__DISABLE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__TN_NvTmRep_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8__DISABLE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__TN_NvTmRepOnLogon_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8__DISABLE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140012c90
lea rcx, str.Cortana
mov dword [rbp + 0x10], 0x42c80000
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x140034b1e
lea rcx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__AllowCortana___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftPolicyManagerdefaultExperienceAllowCortana___v__value___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__AllowCloudSearch___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__AllowCortanaAboveLock___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionSearch___v__CortanaConsent___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSearch___v__CanCortanaBeEnabled___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionSearch___v__CortanaEnabled___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSearch___v__CortanaEnabled___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add_HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced__v__ShowCortanaButton___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionSearch___v__CortanaInAmbientMode___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSearch___v__HistoryViewEnabled___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSearch___v__DeviceHistoryEnabled___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwareMicrosoftSpeech_OneCorePreferences___v__VoiceActivationOn___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwareMicrosoftSpeech_OneCorePreferences___v__VoiceActivationDefaultOn___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionSearch___v__VoiceShortcut___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwareMicrosoftSpeech_OneCorePreferences___v__VoiceActivationEnableAboveLockscreen___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwareMicrosoftSpeech_OneCorePreferences___v__ModelDownloadAllowed___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionOOBE___v__DisableVoice___t_REG_DWORD__d_1__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x43160000
lea rcx, str.Microsoft_Office
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x140034c7c
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice15.0OutlookOptionsMail___v__EnableLogging___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice16.0OutlookOptionsMail___v__EnableLogging___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice15.0OutlookOptionsCalendar___v__EnableCalendarLogging___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice16.0OutlookOptionsCalendar___v__EnableCalendarLogging___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice15.0WordOptions___v__EnableLogging___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice16.0WordOptions___v__EnableLogging___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREPoliciesMicrosoftOffice15.0OSM___v__EnableLogging___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREPoliciesMicrosoftOffice16.0OSM___v__EnableLogging___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREPoliciesMicrosoftOffice15.0OSM___v__EnableUpload___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREPoliciesMicrosoftOffice16.0OSM___v__EnableUpload___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOfficeCommonClientTelemetry___v__DisableTelemetry___t_REG_DWORD__d_1__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice16.0CommonClientTelemetry___v__DisableTelemetry___t_REG_DWORD__d_1__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOfficeCommonClientTelemetry___v__VerboseLogging___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice16.0CommonClientTelemetry___v__VerboseLogging___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice15.0Common___v__QMEnable___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice16.0Common___v__QMEnable___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice15.0CommonFeedback___v__Enabled___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSOFTWAREMicrosoftOffice16.0CommonFeedback___v__Enabled___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__TN__MicrosoftOfficeOfficeTelemetryAgentFallBack___DISABLE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__TN__MicrosoftOfficeOfficeTelemetryAgentFallBack2016___DISABLE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__TN__MicrosoftOfficeOfficeTelemetryAgentLogOn___DISABLE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__TN__MicrosoftOfficeOfficeTelemetryAgentLogOn2016___DISABLE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__TN__MicrosoftOfficeOffice_15_Subscription_Heartbeat___DISABLE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.schtasks__change__TN__MicrosoftOfficeOffice_16_Subscription_Heartbeat___DISABLE
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140012c90
lea rcx, str.Xbox_Live
mov dword [rbp + 0x10], 0x42c80000
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x140034cd0
lea rcx, str.PowerShell__ExecutionPolicy_Unrestricted__Command___serviceName__XblAuthManager__Write_Host_Disabling_service:__serviceName.___service__Get_Service__Name__serviceName__ErrorAction_SilentlyContinue__if___service____Write_Host_Service__serviceName_could_not_be_not_found__no_need_to_disable_it.__Exit_0____if___service.Status__eq__System.ServiceProcess.ServiceControllerStatus_::Running____Write_Host__serviceName_is_running__stopping_it.__try___Stop_Service__Name__serviceName__Force__ErrorAction_Stop__Write_Host_Stopped__serviceName_successfully.___catch___Write_Warning_Could_not_stop__serviceName__it_will_be_stopped_after_reboot:________else___Write_Host__serviceName_is_not_running__no_need_to_stop._____startupType___service.StartType__if__startupType__eq_Disabled____Write_Host__serviceName_is_already_disabled__no_further_action_is_needed____try___Set_Service__Name__serviceName__StartupType_Disabled__Confirm:_false__ErrorAction_Stop__Write_Host_Disabled__serviceName_successfully.___catch___Write_Error_Could_not_disable__serviceName:______
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.PowerShell__ExecutionPolicy_Unrestricted__Command___serviceName__XblGameSave__Write_Host_Disabling_service:__serviceName.___service__Get_Service__Name__serviceName__ErrorAction_SilentlyContinue__if___service____Write_Host_Service__serviceName_could_not_be_not_found__no_need_to_disable_it.__Exit_0____if___service.Status__eq__System.ServiceProcess.ServiceControllerStatus_::Running____Write_Host__serviceName_is_running__stopping_it.__try___Stop_Service__Name__serviceName__Force__ErrorAction_Stop__Write_Host_Stopped__serviceName_successfully.___catch___Write_Warning_Could_not_stop__serviceName__it_will_be_stopped_after_reboot:________else___Write_Host__serviceName_is_not_running__no_need_to_stop._____startupType___service.StartType__if__startupType__eq_Disabled____Write_Host__serviceName_is_already_disabled__no_further_action_is_needed____try___Set_Service__Name__serviceName__StartupType_Disabled__Confirm:_false__ErrorAction_Stop__Write_Host_Disabled__serviceName_successfully.___catch___Write_Error_Could_not_disable__serviceName:______
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.PowerShell__ExecutionPolicy_Unrestricted__Command___serviceName__XboxNetApiSvc__Write_Host_Disabling_service:__serviceName.___service__Get_Service__Name__serviceName__ErrorAction_SilentlyContinue__if___service____Write_Host_Service__serviceName_could_not_be_not_found__no_need_to_disable_it.__Exit_0____if___service.Status__eq__System.ServiceProcess.ServiceControllerStatus_::Running____Write_Host__serviceName_is_running__stopping_it.__try___Stop_Service__Name__serviceName__Force__ErrorAction_Stop__Write_Host_Stopped__serviceName_successfully.___catch___Write_Warning_Could_not_stop__serviceName__it_will_be_stopped_after_reboot:________else___Write_Host__serviceName_is_not_running__no_need_to_stop._____startupType___service.StartType__if__startupType__eq_Disabled____Write_Host__serviceName_is_already_disabled__no_further_action_is_needed____try___Set_Service__Name__serviceName__StartupType_Disabled__Confirm:_false__ErrorAction_Stop__Write_Host_Disabled__serviceName_successfully.___catch___Write_Error_Could_not_disable__serviceName:______
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x43160000
lea rcx, str.CCleaner_Monitoring
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x140034d92
lea rcx, str.reg_add__HKCUSoftwarePiriformCCleaner___v__Monitoring___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwarePiriformCCleaner___v__HelpImproveCCleaner___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwarePiriformCCleaner___v__SystemMonitoring___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwarePiriformCCleaner___v__UpdateAuto___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwarePiriformCCleaner___v__UpdateCheck___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKCUSoftwarePiriformCCleaner___v__CheckTrialOffer___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePiriformCCleaner___v___Cfg_HealthCheck___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePiriformCCleaner___v___Cfg_QuickClean___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePiriformCCleaner___v___Cfg_QuickCleanIpm___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePiriformCCleaner___v___Cfg_GetIpmForTrial___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePiriformCCleaner___v___Cfg_SoftwareUpdater___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSoftwarePiriformCCleaner___v___Cfg_SoftwareUpdaterIpm___t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140012c90
lea rcx, str.Updates
mov dword [rbp + 0x10], 0x42c80000
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x140034e1a
lea rcx, str.PowerShell__ExecutionPolicy_Unrestricted__Command___serviceName__wuauserv__Write_Host__Disabling_service:___serviceName_.____service__Get_Service__Name__serviceName__ErrorAction_SilentlyContinue__if___service____Write_Host__Service___serviceName__could_not_be_not_found__no_need_to_disable_it.___Exit_0____if___service.Status__eq__System.ServiceProcess.ServiceControllerStatus_::Running____Write_Host____serviceName__is_running__stopping_it.___try___Stop_Service__Name___serviceName___Force__ErrorAction_Stop__Write_Host__Stopped___serviceName__successfully.____catch___Write_Warning__Could_not_stop___serviceName____it_will_be_stopped_after_reboot:_________else___Write_Host____serviceName__is_not_running__no_need_to_stop.______startupType___service.StartType__if___startupType_____startupType___Get_WmiObject__Query__Select_StartMode_From_Win32_Service_Where_Name_serviceName___ErrorAction_Ignore_.StartMode__if___startupType_____startupType___Get_WmiObject__Class_Win32_Service__Property_StartMode__Filter__Name_serviceName___ErrorAction_Ignore_.StartMode______if__startupType__eq_Disabled____Write_Host___serviceName_is_already_disabled__no_further_action_is_needed_____try___Set_Service__Name___serviceName___StartupType_Disabled__Confirm:_false__ErrorAction_Stop__Write_Host__Disabled___serviceName__successfully.____catch___Write_Error__Could_not_disable___serviceName_:_______
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.PowerShell__ExecutionPolicy_Unrestricted__Command___serviceName__UsoSvc__Write_Host__Disabling_service:___serviceName_.____service__Get_Service__Name__serviceName__ErrorAction_SilentlyContinue__if___service____Write_Host__Service___serviceName__could_not_be_not_found__no_need_to_disable_it.___Exit_0____if___service.Status__eq__System.ServiceProcess.ServiceControllerStatus_::Running____Write_Host____serviceName__is_running__stopping_it.___try___Stop_Service__Name___serviceName___Force__ErrorAction_Stop__Write_Host__Stopped___serviceName__successfully.____catch___Write_Warning__Could_not_stop___serviceName____it_will_be_stopped_after_reboot:_________else___Write_Host____serviceName__is_not_running__no_need_to_stop.______startupType___service.StartType__if___startupType_____startupType___Get_WmiObject__Query__Select_StartMode_From_Win32_Service_Where_Name_serviceName___ErrorAction_Ignore_.StartMode__if___startupType_____startupType___Get_WmiObject__Class_Win32_Service__Property_StartMode__Filter__Name_serviceName___ErrorAction_Ignore_.StartMode______if__startupType__eq_Disabled____Write_Host___serviceName_is_already_disabled__no_further_action_is_needed_____try___Set_Service__Name___serviceName___StartupType_Disabled__Confirm:_false__ErrorAction_Stop__Write_Host__Disabled___serviceName__successfully.____catch___Write_Error__Could_not_disable___serviceName_:_______
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.PowerShell__ExecutionPolicy_Unrestricted__Command___serviceQuery__WaaSMedicSvc___service__Get_Service__Name__serviceQuery__ErrorAction_SilentlyContinue__if___service____Write_Host__Service_query___serviceQuery__did_not_yield_any_results__no_need_to_disable_it.___Exit_0_____serviceName___service.Name__Write_Host__Disabling_service:___serviceName_.___if___service.Status__eq__System.ServiceProcess.ServiceControllerStatus_::Running____Write_Host____serviceName__is_running__trying_to_stop_it.___try___Stop_Service__Name___serviceName___Force__ErrorAction_Stop__Write_Host__Stopped___serviceName__successfully.____catch___Write_Warning__Could_not_stop___serviceName____it_will_be_stopped_after_reboot:_________else___Write_Host____serviceName__is_not_running__no_need_to_stop.______registryKey___HKLM:SYSTEMCurrentControlSetServices_serviceName___if___Test_Path__registryKey_____Write_Host____registryKey__is_not_found_in_registry__cannot_enable_it.___Exit_0____if____Get_ItemProperty__Path___registryKey__.Start__eq_4____Write_Host____serviceName__is_already_disabled_from_start__no_further_action_is_needed.___Exit_0____try___Set_ItemProperty__registryKey__Name_Start__Value_4__Force__ErrorAction_Stop__Write_Host__Disabled___serviceName__successfully.____catch___Write_Error__Could_not_disable___serviceName_:_______
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU___v__NoAutoUpdate___t__REG_DWORD___d__1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU___v__AUOptions___t__REG_DWORD___d__2___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU___v__ScheduledInstallDay___f_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_delete__HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU___v__ScheduledInstallTime___f_2_nul
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, [rbp + 0x10]
mov dword [rbp + 0x10], 0x43160000
lea rcx, str.Windows_Defender
mov dword [rbp + 0x14], 0x41c80000
call fcn.140031a20
test al, al
je 0x140034e49
lea rcx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender____v__DisableAntiSpyware____t_REG_DWORD___d_1___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14000a4f0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.140012c90
lea r8, [rbp + 0x10]
mov dword [rbp + 0x10], 0x43960000
mov edx, 0x33
mov dword [rbp + 0x14], 0x43e08000
call fcn.14000a2e0
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rbp
jmp fcn.14000a4f0