Function at 0x8c6a90
Capabilities:
Create thread
Persist via appinit_dlls registry key
Persist via run registry key
Persist via winlogon helper dll registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a98
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0xfff
mov edi, edx
lea edx, [ebp - 0x2843]
push ebx
push edx
mov dword [ebp - 0x3a5c], eax
mov dword [ebp - 0x3a64], ecx
mov byte [ebp - 0x2844], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x7ff
lea eax, [ebp - 0x1443]
push ebx
mov esi, 1
push eax
mov dword [ebp - 0x3a54], ebx
mov dword [ebp - 0x3a68], ebx
mov dword [ebp - 0x3a74], ebx
mov dword [ebp - 0x3a78], ebx
mov dword [ebp - 0x3a94], esi
mov byte [ebp - 0x1444], bl
call fcn.00a7ffb0
mov eax, dword [0xc11a94]
add esp, 0xc
test al, 1
jne 0x8c6b45
or eax, esi
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityATs_
cmp byte [str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityATs_], bl
je 0x8c6b39
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6b33
sub ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityATs_
mov dword [0xc11a90], ecx
test al, 2
jne 0x8c6b72
or eax, 2
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
cmp byte [str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_], bl
je 0x8c6b66
mov edi, edi
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6b60
sub ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
mov dword [0xc11a8c], ecx
test al, 4
jne 0x8c6ba2
or eax, 4
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
cmp byte [str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_], bl
je 0x8c6b96
jmp 0x8c6b90
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6b90
sub ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
mov dword [0xc11a88], ecx
test al, 8
jne 0x8c6bd2
or eax, 8
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRun_
cmp byte [str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRun_], bl
je 0x8c6bc6
jmp 0x8c6bc0
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6bc0
sub ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRun_
mov dword [0xc11a84], ecx
test al, 0x10
jne 0x8c6c02
or eax, 0x10
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce_
cmp byte [str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce_], bl
je 0x8c6bf6
jmp 0x8c6bf0
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6bf0
sub ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce_
mov dword [0xc11a80], ecx
test al, 0x20
jne 0x8c6c32
or eax, 0x20
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
cmp byte [str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun_], bl
je 0x8c6c26
jmp 0x8c6c20
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6c20
sub ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov dword [0xc11a7c], ecx
test al, 0x40
jne 0x8c6c62
or eax, 0x40
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup_
cmp byte [str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup_], bl
je 0x8c6c56
jmp 0x8c6c50
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6c50
sub ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup_
mov dword [0xc11a78], ecx
test al, al
js 0x8c6c92
or eax, 0x80
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler_
cmp byte [str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler_], bl
je 0x8c6c86
lea ecx, [ecx]
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6c80
sub ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler_
mov dword [0xc11a74], ecx
test eax, 0x100
jne 0x8c6cc2
or eax, 0x100
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks_
cmp byte [str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks_], bl
je 0x8c6cb6
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6cb0
sub ecx, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks_
mov dword [0xc11a70], ecx
test eax, 0x200
jne 0x8c6cf2
or eax, 0x200
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYMACHINESOFTWAREIObitUninstaller_
cmp byte [str.REGISTRYMACHINESOFTWAREIObitUninstaller_], bl
je 0x8c6ce6
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6ce0
sub ecx, str.REGISTRYMACHINESOFTWAREIObitUninstaller_
mov dword [str._WYYRD_Q], ecx
test eax, 0x400
jne 0x8c6d1a
or eax, 0x400
mov dword [0xc11a94], eax
mov ecx, str.REGISTRYUSER_
add ecx, esi
cmp byte [ecx], bl
jne 0x8c6d08
sub ecx, str.REGISTRYUSER_
mov dword [0xc11a68], ecx
test eax, 0x800
jne 0x8c6d48
or eax, 0x800
mov dword [0xc11a94], eax
mov eax, str.REGISTRYMACHINESYSTEMControlSet001Services_
cmp byte [str.REGISTRYMACHINESYSTEMControlSet001Services_], bl
je 0x8c6d3e
add eax, esi
cmp byte [eax], bl
jne 0x8c6d38
sub eax, str.REGISTRYMACHINESYSTEMControlSet001Services_
mov dword [0xc11a64], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0xb8da58], eax
cmp dword [0xbf31e4], ebx
jne 0x8c6e85
lea ecx, [ebp - 0x3a90]
push ecx
push str.Current
mov ecx, str.SYSTEMSelect
mov edx, 0x80000002
mov dword [ebp - 0x3a90], esi
mov dword [0xbf31e4], esi
call fcn.0094c0d0
mov edx, dword [ebp - 0x3a90]
push edx
push str.ControlSet_03d
push str.ControlSet001
call fcn.00a78f30
add esp, 0xc
mov eax, 0xacb244
mov ecx, str.ControlSet001
call fcn.0094c330
test eax, eax
je 0x8c6e85
push str.ControlSet001
push 0xacb244
push str.REGISTRYMACHINESYSTEMControlSet001ControlSafeBootAlternateShell
call fcn.0095e130
add esp, 0xc
push str.ControlSet001
push 0xacb244
push str.REGISTRYMACHINESYSTEMControlSet001ControlSession_ManagerBootExecute
call fcn.0095e130
add esp, 0xc
push str.ControlSet001
push 0xacb244
push str.REGISTRYMACHINESYSTEMControlSet001ControlSession_ManagerPendingFileRenameOperations
call fcn.0095e130
add esp, 0xc
push str.ControlSet001
push 0xacb244
push str.REGISTRYMACHINESYSTEMControlSet001ControlSession_ManagerPendingFileRenameOperations2
call fcn.0095e130
add esp, 0xc
push str.ControlSet001
push 0xacb244
push str.REGISTRYMACHINESYSTEMControlSet001ControlLsaSecurity_Packages
call fcn.0095e130
add esp, 0xc
push str.ControlSet001
push 0xacb244
push str.REGISTRYMACHINESYSTEMControlSet001Services_
call fcn.0095e130
add esp, 0xc
push str.ControlSet001
push 0xacb244
push str.REGISTRYMACHINESYSTEMControlSet001ControlLsaNotification_Packages
call fcn.0095e130
add esp, 0xc
push str.ControlSet001
push 0xacb244
push str.REGISTRYMACHINESYSTEMControlSet001ControlLsaAuthentication_Packages
call fcn.0095e130
add esp, 0xc
push str.ControlSet001
push 0xacb244
push str.REGISTRYMACHINESYSTEMControlSet001ControlServiceControlManagerExtension
call fcn.0095e130
add esp, 0xc
cmp dword [0xb8db08], ebx
jne 0x8c6ea0
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
cmp edi, ebx
je 0x8ca959
push edi
lea ebx, [ebp - 0x3a54]
call fcn.00970520
add esp, 4
cmp eax, 1
jne 0x8ca79c
mov edi, dword [ebp - 0x3a54]
xor esi, esi
cmp edi, esi
je 0x8ca959
cmp byte [edi], 0
je 0x8ca79c
push 0x207
lea eax, [ebp - 0xc43]
push esi
push eax
mov byte [ebp - 0xc44], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea ecx, [ebp - 0x364b]
push esi
push ecx
mov byte [ebp - 0x364c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0x324b]
push esi
push edx
mov byte [ebp - 0x324c], 0
call fcn.00a7ffb0
add esp, 0xc
push esi
lea edx, [ebp - 0xc44]
mov ecx, edi
mov dword [ebp - 0x3a50], 1
mov dword [ebp - 0x3a58], esi
mov dword [ebp - 0x3a90], esi
mov dword [ebp - 0x3a6c], esi
mov dword [ebp - 0x3a70], esi
mov dword [ebp - 0x3a60], esi
call fcn.008ff7e0
add esp, 4
push str.ControlSet001
lea eax, [ebp - 0x364c]
push str.SYSTEM_s_
push eax
call fcn.00a78f30
add esp, 0xc
push str.SYSTEMCurrentControlSet_
lea ecx, [ebp - 0x364c]
push ecx
lea edx, [ebp - 0xc44]
push edx
call fcn.0095e130
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, 1
je 0x8c71fc
cmp eax, 2
je 0x8c71fc
cmp eax, 4
jne 0x8c70dc
mov ebx, dword [ebp - 0x3a64]
cmp ebx, esi
je 0x8c70dc
cmp dword [0xbc27fc], esi
je 0x8c7791
mov eax, dword [0xabd688]
mov ecx, dword [0xabd68c]
push 0x207
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [ebp - 0x32b]
push esi
push edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x32c], al
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x433]
push esi
push eax
mov byte [ebp - 0x434], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x743]
push esi
push ecx
mov byte [ebp - 0x744], 0
call fcn.00a7ffb0
mov edi, dword [ebp - 0x3a5c]
add esp, 0xc
cmp edi, 4
jne 0x8c7070
mov edx, dword [0xabd858]
mov ax, word [0xabd85c]
mov cl, byte [0xabd85e]
mov dword [ebp - 0x32c], edx
mov word [ebp - 0x328], ax
mov byte [ebp - 0x326], cl
jmp 0x8c7098
push esi
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x434]
push eax
push 0x208
lea ecx, [ebp - 0x744]
push ecx
lea edx, [ebp - 0x32c]
push edx
push edi
call fcn.009bb790
add esp, 0x1c
mov eax, dword [ebx]
push eax
push edi
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0xc44]
push edx
lea eax, [ebp - 0x2844]
push str.___REG__RegScan_Create_Modify_for__s___s:_u___DW:0x_x_
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
push esi
push ecx
lea edx, [ebp - 0x2844]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x28
jmp 0x8c7791
cmp dword [0xbc27fc], esi
je 0x8c7791
push esi
push str.ControlNsi_
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c7791
mov eax, dword [0xabd688]
mov ecx, dword [0xabd68c]
push 0x207
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [ebp - 0x32b]
push esi
push edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x32c], al
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x433]
push esi
push eax
mov byte [ebp - 0x434], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x743]
push esi
push ecx
mov byte [ebp - 0x744], 0
call fcn.00a7ffb0
mov edi, dword [ebp - 0x3a5c]
add esp, 0xc
cmp edi, 4
jne 0x8c719e
mov edx, dword [0xabd858]
mov ax, word [0xabd85c]
mov cl, byte [0xabd85e]
mov dword [ebp - 0x32c], edx
mov word [ebp - 0x328], ax
mov byte [ebp - 0x326], cl
jmp 0x8c71c6
push esi
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x434]
push eax
push 0x208
lea ecx, [ebp - 0x744]
push ecx
lea edx, [ebp - 0x32c]
push edx
push edi
call fcn.009bb790
add esp, 0x1c
push edi
lea eax, [ebp - 0x32c]
push eax
lea ecx, [ebp - 0xc44]
push ecx
lea edx, [ebp - 0x2844]
push str.___REG__RegScan_Create_Modify_for__s___s:_u_
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0x14
push esi
push eax
lea ecx, [ebp - 0x2844]
push ecx
jmp 0x8c7784
mov eax, dword [ebp - 0x3a64]
cmp eax, esi
je 0x8c7647
push eax
lea ebx, [ebp - 0x3a68]
call fcn.00970520
add esp, 4
cmp dword [ebp - 0x3a68], esi
je 0x8c7647
mov edx, dword [ebp - 0x3a68]
cmp byte [edx], 0
je 0x8c7647
push 0
lea eax, [ebp - 0xc44]
push str.enum_
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c7647
push 0
lea ecx, [ebp - 0xc44]
push 0xacb284
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c7647
push 0
lea edx, [ebp - 0xc44]
push str.Control_
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c7647
mov eax, dword [0xabd688]
mov ecx, dword [0xabd68c]
xor ebx, ebx
push 0x207
mov dword [ebp - 0x18], eax
xor eax, eax
lea edx, [ebp - 0x32b]
push ebx
push edx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x32c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x743]
push ebx
push eax
mov byte [ebp - 0x744], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x154b]
push ebx
push ecx
mov byte [ebp - 0x154c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea edx, [ebp - 0x2c43]
push ebx
mov esi, 1
push edx
mov dword [ebp - 0x3a7c], esi
mov dword [ebp - 0x3a84], ebx
mov dword [ebp - 0x3a88], ebx
mov byte [ebp - 0x2c44], bl
call fcn.00a7ffb0
add esp, 0xc
lea eax, [ebp - 0xc44]
push 0x5c
push eax
call fcn.00a7aa50
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x8c7349
mov byte [edi], 0x2f
cmp byte [str.No_Action], bl
jne 0x8c7375
push 0xb55918
push 0x104
push str.No_Action
push 0xab3780
push 0xab91c4
push str.Prompt
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, str.HKLMSYSTEMCurrentControlSetServices
lea ecx, [ebp - 0xc44]
call fcn.0094c3e0
test eax, eax
jne 0x8c73f3
cmp edi, ebx
je 0x8c73e3
push str._ImagePath
push edi
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x8c73e3
push 0x103
lea ecx, [ebp - 0x433]
push ebx
push ecx
mov dword [ebp - 0x3a84], esi
mov byte [ebp - 0x434], bl
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x32c]
lea ecx, [ebp - 0x434]
call fcn.009ac0d0
cmp byte [ebp - 0x32c], bl
jne 0x8c73ed
xor esi, esi
mov dword [ebp - 0x3a7c], esi
jmp 0x8c73fb
xor esi, esi
mov dword [ebp - 0x3a7c], esi
jmp 0x8c73f3
mov dword [ebp - 0x3a88], esi
cmp byte [ebp - 0x32c], bl
jne 0x8c7459
cmp dword [ebp - 0x3a5c], 4
jne 0x8c742b
mov edx, dword [0xabd858]
mov ax, word [0xabd85c]
mov cl, byte [0xabd85e]
mov dword [ebp - 0x32c], edx
mov word [ebp - 0x328], ax
mov byte [ebp - 0x326], cl
jmp 0x8c7459
push ebx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x744]
push eax
mov eax, dword [ebp - 0x3a5c]
push 0x208
lea ecx, [ebp - 0x154c]
push ecx
lea edx, [ebp - 0x32c]
push edx
push eax
call fcn.009bb790
add esp, 0x1c
cmp dword [ebp - 0x3a84], ebx
je 0x8c7563
cmp esi, ebx
je 0x8c75b9
push 0x207
lea ecx, [ebp - 0x533]
push ebx
push ecx
mov byte [ebp - 0x534], bl
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x32c]
push 0x3a
push edx
xor esi, esi
mov dword [ebp - 0x3a8c], ebx
mov dword [ebp - 0x3a84], ebx
call fcn.00a7aa50
add esp, 8
cmp eax, ebx
je 0x8c74b7
inc eax
push eax
call fcn.00a7907a
add esp, 4
mov esi, eax
lea eax, [ebp - 0xc44]
push 0x5c
push eax
mov byte [edi], bl
call fcn.00a7aa50
inc eax
lea edx, [ebp - 0x534]
add esp, 8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x8c74d3
mov byte [edi], 0x2f
push 4
push str.eScan_Monitor
lea ebx, [ebp - 0x3a84]
lea edi, [ebp - 0x3a8c]
mov ecx, esi
call fcn.008c4180
mov ecx, dword [ebp - 0x3a68]
push ecx
lea edx, [ebp - 0x534]
push edx
lea eax, [ebp - 0x2c44]
push str.ServiceName:__s___ImagePath:__s_
push eax
call fcn.00a78f30
mov ecx, dword [ebp - 0x3a84]
mov edx, dword [ebp - 0x3a8c]
add esp, 0x18
push 0
push 0
push 0
push ecx
push edx
push 0
lea eax, [ebp - 0x32c]
push eax
push str.No_Action
lea ecx, [ebp - 0x2c44]
push ecx
push 0xaa154c
push 0
push 0x6d9
mov ecx, str.eScan_Monitor
call fcn.00982e00
mov esi, dword [ebp - 0x3a7c]
jmp 0x8c75c5
cmp esi, ebx
je 0x8c75b9
mov edx, dword [ebp - 0x3a68]
push edx
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0x2c44]
push str.RegName:__s___Value:__s_
push ecx
call fcn.00a78f30
add esp, 0x10
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x32c]
push edx
push str.No_Action
lea eax, [ebp - 0x2c44]
push eax
push 0xaa154c
push ebx
push 0x6da
mov ecx, str.eScan_Monitor
call fcn.00982e00
jmp 0x8c75c7
cmp dword [0xbc27fc], ebx
je 0x8c7791
xor ebx, ebx
push esi
cmp dword [ebp - 0x3a88], ebx
je 0x8c7608
mov ecx, dword [ebp - 0x3a68]
push ecx
lea edx, [ebp - 0x32c]
push edx
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0x2844]
push str.___REG__RegScan_Create_Modify_for__s___s___SZ:__s__Evnt:_u_
push ecx
call fcn.00a78f30
add esp, 0x18
push ebx
push 1
lea ecx, [ebp - 0x2844]
push ecx
jmp 0x8c7784
mov edx, dword [ebp - 0x3a68]
mov eax, dword [ebp - 0x3a5c]
push edx
push eax
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0xc44]
push edx
lea eax, [ebp - 0x2844]
push str.___REG__RegScan_Create_Modify_for__s___s:_u___SZ:__s__Evnt:_u_
push eax
call fcn.00a78f30
add esp, 0x1c
push ebx
push 1
lea ecx, [ebp - 0x2844]
push ecx
jmp 0x8c7784
mov edi, dword [ebp - 0x3a68]
cmp dword [0xbc27fc], esi
je 0x8c7791
mov eax, dword [0xabd68c]
mov edx, dword [0xabd688]
mov dword [ebp - 0x14], eax
xor eax, eax
push 0x207
push eax
lea ecx, [ebp - 0x32b]
push ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x32c], al
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x433]
push 0
push edx
mov byte [ebp - 0x434], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x743]
push 0
push eax
mov byte [ebp - 0x744], 0
call fcn.00a7ffb0
mov esi, dword [ebp - 0x3a5c]
add esp, 0xc
cmp esi, 4
jne 0x8c76f9
mov ecx, dword [0xabd858]
mov dx, word [0xabd85c]
mov al, byte [0xabd85e]
mov dword [ebp - 0x32c], ecx
mov word [ebp - 0x328], dx
mov byte [ebp - 0x326], al
jmp 0x8c7722
push 0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x434]
push edx
push 0x208
lea eax, [ebp - 0x744]
push eax
lea ecx, [ebp - 0x32c]
push ecx
push esi
call fcn.009bb790
add esp, 0x1c
test edi, edi
je 0x8c7751
cmp byte [edi], 0
je 0x8c7751
push edi
push esi
lea edx, [ebp - 0x32c]
push edx
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0x2844]
push str.___REG__RegScan_Create_Modify_for__s___s:_u___SZ:__s_
push ecx
call fcn.00a78f30
add esp, 0x18
jmp 0x8c7774
push esi
lea edx, [ebp - 0x32c]
push edx
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0x2844]
push str.___REG__RegScan_Create_Modify_for__s___s:_u___SZ:_NULL_Blank_
push ecx
call fcn.00a78f30
add esp, 0x14
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x2844]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp dword [0xb8db0c], 0
mov ebx, 1
je 0x8ca353
mov ecx, dword [0xc11a88]
mov edi, dword [ebp - 0x3a54]
push ecx
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects_
call fcn.008c6490
add esp, 4
test eax, eax
jne 0x8c78ca
mov edx, dword [ebp - 0x3a5c]
push ebx
push eax
push edx
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a70], ebx
mov dword [ebp - 0x3a6c], ebx
call fcn.008c5870
add esp, 0xc
mov dword [ebp - 0x3a50], eax
test eax, eax
jne 0x8ca38e
mov ecx, 7
mov esi, str._WINDIR__system32_regsvr32.exe
lea edi, [ebp - 0x434]
rep movsd dword es:[edi], dword [esi]
push 0xe5
movsw word es:[edi], word [esi]
push eax
lea eax, [ebp - 0x415]
push eax
movsb byte es:[edi], byte [esi]
call fcn.00a7ffb0
add esp, 0xc
push ebx
lea ecx, [ebp - 0x434]
push ecx
call fcn.00977760
lea eax, [ebp - 0x434]
lea ecx, [ebp - 0x1444]
call fcn.0094c330
test eax, eax
jne 0x8c786a
mov eax, dword [ebp - 0x3a60]
cmp eax, 4
jbe 0x8c786a
push eax
lea ecx, [ebp - 0x1444]
lea ebx, [ebp - 0x324c]
call fcn.0097b130
mov ebx, 1
push 0
lea edx, [ebp - 0x1444]
push ebx
push edx
call fcn.008c5820
add esp, 0xc
test eax, eax
je 0x8ca38e
mov eax, dword [ebp - 0x3a5c]
mov esi, dword [ebp - 0x3a54]
push ebx
push eax
push ebx
push esi
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x1444]
call fcn.008c4290
add esp, 0x10
test eax, eax
je 0x8ca38e
push esi
call fcn.008c6540
add esp, 4
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a74], ebx
jmp 0x8ca38e
mov ecx, dword [0xc11a68]
mov edi, dword [ebp - 0x3a54]
push ecx
push str.REGISTRYUSER_
push edi
call fcn.00a891c8
add esp, 0xc
test eax, eax
jne 0x8c8835
mov ecx, dword [0xc11a94]
test ecx, 0x1000
jne 0x8c7926
or ecx, 0x1000
cmp byte [str.SoftwareMicrosoftWindowsCurrentVersionRun_], 0
mov dword [0xc11a94], ecx
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun_
je 0x8c791c
add eax, ebx
cmp byte [eax], 0
jne 0x8c7915
sub eax, str.SoftwareMicrosoftWindowsCurrentVersionRun_
mov dword [0xc11a60], eax
test ecx, 0x2000
jne 0x8c7959
or ecx, 0x2000
cmp byte [str.SoftwareMicrosoftWindowsCurrentVersionRunOnce_], 0
mov dword [0xc11a94], ecx
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce_
je 0x8c794f
add eax, ebx
cmp byte [eax], 0
jne 0x8c7948
sub eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce_
mov dword [0xc11a5c], eax
test ecx, 0x4000
jne 0x8c7991
or ecx, 0x4000
cmp byte [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_], 0
mov dword [0xc11a94], ecx
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
je 0x8c7987
jmp 0x8c7980
add eax, ebx
cmp byte [eax], 0
jne 0x8c7980
sub eax, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
mov dword [0xc11a58], eax
test ecx, 0x8000
jne 0x8c79c4
or ecx, 0x8000
cmp byte [str.SoftwareVSRevoGroupRevoUninstallerGeneral_], 0
mov dword [0xc11a94], ecx
mov eax, str.SoftwareVSRevoGroupRevoUninstallerGeneral_
je 0x8c79ba
add eax, ebx
cmp byte [eax], 0
jne 0x8c79b3
sub eax, str.SoftwareVSRevoGroupRevoUninstallerGeneral_
mov dword [str.__2.0], eax
mov edx, dword [0xc11a68]
mov eax, dword [ebp - 0x3a54]
add eax, edx
push 0x5c
push eax
call fcn.00a7a2c0
mov esi, eax
xor edi, edi
add esp, 8
cmp esi, edi
je 0x8ca38e
add esi, ebx
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsProxyServer
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8c7b0b
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x8c7a0f
cmp eax, 2
jne 0x8ca38e
push 0x103
lea ecx, [ebp - 0x63b]
push edi
push ecx
mov byte [ebp - 0x63c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x123]
push edi
push edx
mov byte [ebp - 0x124], 0
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x3a6c], ebx
cmp dword [0xb3ddd8], edi
je 0x8ca38e
mov ecx, dword [ebp - 0x3a68]
cmp ecx, edi
je 0x8ca38e
cmp byte [ecx], 0
je 0x8ca38e
lea eax, [ebp - 0x124]
push eax
lea ebx, [ebp - 0x63c]
call fcn.008f7a20
add esp, 4
lea eax, [ebp - 0x124]
mov edi, ebx
call fcn.008f7eb0
mov edi, eax
lea ecx, [ebp - 0x124]
mov edx, ebx
push ecx
lea eax, [ebp - 0x2844]
push edx
test edi, edi
je 0x8c7aaf
push str.___REG__Proxy_Settings___s:_s__are_FINE.
jmp 0x8c7ab4
push str.___REG__Proxy_Settings___s:_s__seems_SUSPICIOUS.
push eax
call fcn.00a78f30
add esp, 0x10
push 0
mov esi, 1
push esi
lea ecx, [ebp - 0x2844]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
test edi, edi
jne 0x8ca2d4
mov edx, dword [ebp - 0x3a5c]
xor ecx, ecx
mov dword [ebp - 0x3a70], esi
mov dword [ebp - 0x3a58], esi
mov dword [ebp - 0x3a50], edi
call fcn.0097ceb0
mov dword [ebp - 0x3a60], eax
jmp 0x8ca38e
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsAutoConfigURL
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8c7b98
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x8c7b2b
cmp eax, 2
jne 0x8ca38e
mov dword [ebp - 0x3a6c], ebx
cmp dword [0xb3ddd8], edi
je 0x8ca38e
cmp dword [ebp - 0x3a68], edi
je 0x8ca38e
mov edx, dword [ebp - 0x3a68]
cmp byte [edx], 0
je 0x8ca38e
mov ecx, edx
call fcn.009245b0
test eax, eax
jne 0x8c7b8d
mov edx, dword [ebp - 0x3a5c]
xor ecx, ecx
mov dword [ebp - 0x3a70], ebx
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a50], edi
call fcn.0097ceb0
mov dword [ebp - 0x3a60], eax
jmp 0x8ca38e
mov dword [ebp - 0x3a50], ebx
jmp 0x8ca38e
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemShell
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8c87b8
mov eax, str.SoftwareMicrosoftCommand_ProcessorAutoRun
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8c87b8
mov eax, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonShell
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8c87b8
mov eax, str.SoftwareMicrosoftWindows_NTCurrentVersionWindowsLoad
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8c87b8
mov eax, str.SoftwareMicrosoftWindows_NTCurrentVersionWindowsRun
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8c87b8
mov eax, dword [0xc11a58]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
push esi
call fcn.00a891c8
add esp, 0xc
test eax, eax
je 0x8c87b8
mov ecx, dword [str.__2.0]
push ecx
push str.SoftwareVSRevoGroupRevoUninstallerGeneral_
push esi
call fcn.00a891c8
add esp, 0xc
test eax, eax
jne 0x8c7c54
mov dword [ebp - 0x3a70], ebx
mov dword [ebp - 0x3a50], edi
mov dword [ebp - 0x3a6c], ebx
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a74], ebx
jmp 0x8ca38e
mov edx, dword [0xc11a60]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionRun_
push esi
call fcn.00a891c8
add esp, 0xc
test eax, eax
je 0x8c815e
mov eax, dword [0xc11a5c]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce_
push esi
call fcn.00a891c8
add esp, 0xc
test eax, eax
je 0x8c815e
mov eax, str.Control_PanelDesktopSCRNSAVE.EXE
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8c815e
mov eax, str.SoftwareMicrosoftInternet_ExplorerMainApplicationTileImmersiveActivation
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8c8135
mov eax, str.SoftwareMicrosoftInternet_ExplorerMainAssociationActivationMode
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8c8135
mov eax, str.SoftwareMicrosoftInternet_ExplorerMainStart_Page
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8c7d48
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3a70], ebx
cmp eax, ebx
je 0x8c7cef
cmp eax, 2
jne 0x8ca38e
mov esi, dword [ebp - 0x3a5c]
push 4
push edi
push esi
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a6c], ebx
call fcn.008c5870
add esp, 0xc
mov dword [ebp - 0x3a50], eax
cmp eax, edi
jne 0x8ca38e
push edi
lea ecx, [ebp - 0x1444]
push 4
push ecx
call fcn.008c5820
add esp, 0xc
test eax, eax
je 0x8ca38e
mov edx, dword [ebp - 0x3a54]
push 6
push esi
push ebx
push edx
jmp 0x8c7dc3
mov eax, str.SoftwareMicrosoftInternet_ExplorerMainSecondary_Start_Pages
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8c7df0
cmp dword [ebp + 0xc], 7
mov dword [ebp - 0x3a70], ebx
jne 0x8ca38e
mov esi, dword [ebp - 0x3a5c]
push 5
push edi
push esi
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a6c], ebx
call fcn.008c5870
add esp, 0xc
mov dword [ebp - 0x3a50], eax
cmp eax, edi
jne 0x8ca38e
push edi
lea eax, [ebp - 0x1444]
push 5
push eax
call fcn.008c5820
add esp, 0xc
test eax, eax
je 0x8ca38e
mov ecx, dword [ebp - 0x3a54]
push 7
push esi
push ebx
push ecx
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x1444]
call fcn.008c4290
add esp, 0x10
test eax, eax
je 0x8ca38e
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a74], ebx
jmp 0x8ca38e
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x8c7e14
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x8ca38e
cmp dword [ebp + 0xc], 4
mov dword [ebp - 0x3a70], ebx
jne 0x8ca38e
mov edx, dword [ebp - 0x3a5c]
push 6
push edi
push edx
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a6c], ebx
call fcn.008c5870
add esp, 0xc
mov dword [ebp - 0x3a50], eax
cmp eax, edi
jne 0x8ca38e
mov esi, dword [ebp - 0x3a60]
cmp esi, 4
jbe 0x8c94d2
push 0x103
lea eax, [ebp - 0x123]
push 0
push eax
mov byte [ebp - 0x124], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x154b]
push 0
push ecx
mov byte [ebp - 0x154c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x433]
push 0
push edx
mov byte [ebp - 0x434], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x743]
push 0
push eax
mov byte [ebp - 0x744], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x22b]
push 0
push ecx
mov byte [ebp - 0x22c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x63b]
push 0
push edx
mov byte [ebp - 0x63c], 0
call fcn.00a7ffb0
add esp, 0xc
xor eax, eax
jmp 0x8c7f20
mov cl, byte [eax + 0xb56938]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x8c7f20
lea ecx, [ebp - 0x124]
call fcn.00960910
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x124]
mov byte [ebp + eax - 0x154c], cl
inc eax
test cl, cl
jne 0x8c7f40
xor eax, eax
jmp 0x8c7f60
mov cl, byte [ebp + eax - 0x124]
mov byte [ebp + eax - 0x434], cl
inc eax
test cl, cl
jne 0x8c7f60
xor eax, eax
jmp 0x8c7f80
mov cl, byte [ebp + eax - 0x124]
mov byte [ebp + eax - 0x744], cl
inc eax
test cl, cl
jne 0x8c7f80
lea eax, [ebp - 0x124]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8c7fa0
mov ecx, dword [str.taskhost.exe]
mov edx, dword [0xacb634]
mov dword [eax], ecx
mov ecx, dword [0xacb638]
mov dword [eax + 4], edx
mov dl, byte [0xacb63c]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x154c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8c7fd2
mov ecx, dword [str.gpscript.exe]
mov edx, dword [0xacb644]
mov dword [eax], ecx
mov ecx, dword [0xacb648]
mov dword [eax + 4], edx
mov dl, byte [0xacb64c]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x434]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8c8004
mov ecx, dword [str.svchost.exe]
mov edx, dword [0xac9e3c]
mov dword [eax], ecx
mov ecx, dword [0xac9e40]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea eax, [ebp - 0x744]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8c8030
mov edx, dword [str.services.exe]
mov ecx, dword [0xacaa80]
mov dword [eax], edx
mov edx, dword [0xacaa84]
mov dword [eax + 4], ecx
mov cl, byte [0xacaa88]
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
push esi
lea ecx, [ebp - 0x63c]
lea ebx, [ebp - 0x22c]
call fcn.0097b130
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x63c]
call fcn.0094c330
test eax, eax
jne 0x8c8097
lea eax, [ebp - 0x154c]
lea ecx, [ebp - 0x1444]
call fcn.0094c330
test eax, eax
je 0x8c80c9
lea eax, [ebp - 0x744]
lea ecx, [ebp - 0x63c]
call fcn.0094c330
test eax, eax
jne 0x8c94d2
lea eax, [ebp - 0x434]
lea ecx, [ebp - 0x1444]
call fcn.0094c330
test eax, eax
jne 0x8c94d2
mov dword [ebp - 0x3a50], 1
cmp dword [0xbc27fc], edi
je 0x8ca38e
mov eax, dword [ebp - 0x3a60]
lea edx, [ebp - 0x63c]
push edx
mov edx, dword [ebp - 0x3a5c]
push eax
lea ecx, [ebp - 0x1444]
push ecx
push edx
push str._REG__AuthorizedProcess_A___PID:__u___s___PPid:__u___s__
push 0xffffffffffffffff
lea eax, [ebp - 0x2844]
push 0x1000
push eax
call fcn.00a78fcb
mov ecx, dword [0xbc27fc]
push 0
push ecx
lea edx, [ebp - 0x2844]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
jmp 0x8ca38e
cmp dword [0xb567e8], edi
jne 0x8ca38e
mov dword [ebp - 0x3a70], ebx
mov dword [ebp - 0x3a6c], ebx
mov dword [ebp - 0x3a50], edi
mov dword [ebp - 0x3a58], ebx
jmp 0x8ca38e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3a70], ebx
cmp eax, ebx
je 0x8c8174
cmp eax, 2
jne 0x8ca38e
mov eax, dword [ebp - 0x3a5c]
push 3
push edi
push eax
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a6c], ebx
call fcn.008c5870
mov esi, dword [ebp - 0x3a68]
add esp, 0xc
mov dword [ebp - 0x3a50], eax
cmp eax, edi
je 0x8c8236
cmp esi, edi
je 0x8c8329
cmp byte [esi], 0
je 0x8c8236
push 0x5c
push esi
call fcn.00a7aa50
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x8c81d1
inc ebx
jmp 0x8c81d3
mov ebx, esi
push 0x2e
push ebx
call fcn.00a7aa50
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x8c8236
mov eax, 0xacaa98
call fcn.0094c330
test eax, eax
jne 0x8c8236
push eax
push str..exe.lnk
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c8230
push 0
push str..com.lnk
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c8230
push 0
push str..scr.lnk
push ebx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8236
mov dword [ebp - 0x3a50], edi
test esi, esi
je 0x8c8324
cmp byte [esi], 0
je 0x8c8324
mov ebx, esi
call fcn.00a66600
test eax, eax
je 0x8c8291
push esi
push str._REG__B__Blocking_Value_Write_of___s__as_it_is_in_Suspicious_Folder
push 0xffffffffffffffff
lea ecx, [ebp - 0x2844]
push 0x1000
push ecx
mov dword [ebp - 0x3a50], edi
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x2844]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edi, 1
cmp byte [esi], 0
je 0x8c82e1
mov ecx, esi
call fcn.008c6900
test eax, eax
je 0x8c82e1
push esi
push str._REG__B1__Blocking_Value_Write_of___s__as_it_is_a_Suspicious_Entry
push 0xffffffffffffffff
lea eax, [ebp - 0x2844]
push 0x1000
push eax
mov dword [ebp - 0x3a50], 0
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x2844]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8c82e5
test edi, edi
je 0x8c8324
mov edx, dword [ebp - 0x3a54]
push 0x29
push 0
mov edi, 1
push edi
push edx
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x1444]
call fcn.008c4290
add esp, 0x10
mov ebx, edi
test eax, eax
je 0x8c8329
mov dword [ebp - 0x3a90], edi
mov dword [ebp - 0x3a58], edi
mov dword [ebp - 0x3a74], edi
jmp 0x8c8329
mov ebx, 1
cmp dword [ebp - 0x3a50], 0
jne 0x8ca38e
push 0x207
lea eax, [ebp - 0x533]
push 0
push eax
mov byte [ebp - 0x534], 0
call fcn.00a7ffb0
xor edi, edi
add esp, 0xc
mov dword [ebp - 0x3a64], edi
test esi, esi
je 0x8c837b
push esi
push 0xaa1544
push 0xffffffffffffffff
lea ecx, [ebp - 0x534]
push 0x208
push ecx
call fcn.00a78fcb
add esp, 0x14
lea ecx, [ebp - 0x534]
call fcn.009619b0
call fcn.00968b30
test eax, eax
jne 0x8c83c4
lea edx, [ebp - 0x3a80]
push edx
lea eax, [ebp - 0x534]
push 2
push eax
call fcn.008c5820
add esp, 0xc
test eax, eax
je 0x8c83af
mov edi, ebx
jmp 0x8c83bc
xor ecx, ecx
cmp dword [ebp - 0x3a80], ecx
sete cl
mov edi, ecx
test eax, eax
jne 0x8c8542
push 0
lea edx, [ebp - 0x534]
push 0xacb5d4
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c83fe
push 0
lea eax, [ebp - 0x534]
push str.wscript
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c84c4
push 0
push str.start
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8448
push 0
push 0xacb5e8
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8448
push 0
push str.exit
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8448
mov dword [ebp - 0x3a64], ebx
jmp 0x8c8511
push 0
push str.wscript
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8492
push 0
push 0xacb5e8
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8492
push 0
push 0xacb5f4
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8492
mov dword [ebp - 0x3a64], ebx
jmp 0x8c8511
push 0
push str.start_WSCRIPT
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8509
push 0
push 0xacb608
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8509
mov dword [ebp - 0x3a64], ebx
jmp 0x8c8511
push 0
lea ecx, [ebp - 0x534]
push str.regsvr32.exe
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8509
push 0
push 0xacb60c
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c8509
push 0
push 0xacb614
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8511
test edi, edi
je 0x8ca38e
push 0
lea eax, [ebp - 0x1444]
push 3
push eax
call fcn.008c5820
add esp, 0xc
test eax, eax
je 0x8c8647
mov ecx, dword [ebp - 0x3a5c]
mov edx, dword [ebp - 0x3a54]
push 5
push ecx
push ebx
push edx
jmp 0x8c7dc3
cmp eax, 2
jne 0x8c862e
mov edx, dword [ebp - 0x3a54]
push eax
push 0
push ebx
push edx
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x1444]
call fcn.008c4290
add esp, 0x10
test eax, eax
je 0x8ca38e
lea eax, [ebp - 0x534]
call fcn.0094dd20
lea eax, [ebp - 0x534]
push 0x2e
push eax
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
je 0x8c85a5
lea eax, [ebp - 0x534]
mov byte [esi], 0
call fcn.0094dd20
mov byte [esi], 0x2e
push 0x103
push 0
lea ecx, [ebp - 0x123]
push ecx
mov byte [ebp - 0x124], 0
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x124]
lea edx, [ebp - 0x534]
call fcn.009597a0
cmp byte [ebp - 0x124], 0
je 0x8c7ddf
xor ecx, ecx
lea edi, [ebp - 0x124]
call fcn.0095a6d0
test eax, eax
je 0x8c7ddf
mov edi, 0xaabc14
lea ecx, [ebp - 0x124]
call fcn.00959ba0
test eax, eax
je 0x8c7ddf
lea esi, [ebp - 0x124]
call fcn.00960950
call fcn.0095c080
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a74], ebx
jmp 0x8ca38e
cmp eax, 4
jne 0x8c8509
mov edx, dword [ebp - 0x3a54]
push eax
push 0
push ebx
push edx
jmp 0x8c7dc3
cmp dword [ebp - 0x3a64], ebx
jne 0x8ca38e
push 0
lea eax, [ebp - 0x1444]
push str.wscript.exe
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8ca38e
mov esi, dword [ebp - 0x3a60]
cmp esi, 4
jbe 0x8ca38e
push 0x103
lea ecx, [ebp - 0x22b]
push 0
push ecx
mov byte [ebp - 0x22c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x123]
push 0
push edx
mov byte [ebp - 0x124], 0
call fcn.00a7ffb0
add esp, 0xc
push esi
lea ecx, [ebp - 0x124]
lea ebx, [ebp - 0x22c]
call fcn.0097b130
cmp dword [0xbc27fc], 0
je 0x8c870e
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x2844]
push str._REG__dwParent:__s
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [ebp - 0x2844]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x124], 0
je 0x8c8745
push 0
lea ecx, [ebp - 0x124]
push 0x33
push ecx
call fcn.008c5820
add esp, 0xc
test eax, eax
jne 0x8c873c
cmp byte [ebp - 0x124], al
jne 0x8ca38e
jmp 0x8c8745
cmp byte [ebp - 0x124], 0
jne 0x8c8770
mov edx, dword [ebp - 0x3a5c]
mov eax, dword [ebp - 0x3a54]
push 0x34
push edx
push 1
push eax
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x1444]
call fcn.008c4290
add esp, 0x10
jmp 0x8c9b73
mov ecx, dword [ebp - 0x3a54]
push 0x35
push esi
push 1
push ecx
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x124]
call fcn.008c4290
add esp, 0x10
xor ecx, ecx
jmp 0x8c87a0
mov dl, byte [ebp + ecx - 0x124]
mov byte [ebp + ecx - 0x1444], dl
inc ecx
test dl, dl
jne 0x8c87a0
jmp 0x8c9b73
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3a70], ebx
cmp eax, ebx
je 0x8c87ce
cmp eax, 2
jne 0x8ca38e
mov edx, dword [ebp - 0x3a5c]
push 2
push edi
push edx
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a6c], ebx
call fcn.008c5870
add esp, 0xc
mov dword [ebp - 0x3a50], eax
cmp eax, edi
je 0x8c88f5
mov ebx, dword [ebp - 0x3a68]
cmp ebx, edi
je 0x8ca38e
cmp byte [ebx], 0
je 0x8ca38e
call fcn.00a66600
test eax, eax
je 0x8ca38e
push ebx
mov dword [ebp - 0x3a50], edi
push str._REG__A__Blocking_Value_Write_of___s__as_it_is_in_Suspicious_Folder
jmp 0x8c88c2
mov eax, str.REGISTRYMACHINESYSTEMControlSet001ControlSafeBootAlternateShell
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x8c8900
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3a70], ebx
cmp eax, ebx
je 0x8c885f
cmp eax, 2
jne 0x8ca38e
mov edx, dword [ebp - 0x3a5c]
push 0x1c
push 0
push edx
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a6c], ebx
call fcn.008c5870
add esp, 0xc
mov dword [ebp - 0x3a50], eax
test eax, eax
je 0x8c88f5
mov ebx, dword [ebp - 0x3a68]
test ebx, ebx
je 0x8ca38e
cmp byte [ebx], 0
je 0x8ca38e
call fcn.00a66600
test eax, eax
je 0x8ca38e
push ebx
mov dword [ebp - 0x3a50], 0
push str._REG__D__Blocking_Value_Write_of___s__as_it_is_in_Suspicious_Folder
push 0xffffffffffffffff
lea eax, [ebp - 0x2844]
push 0x1000
push eax
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea ecx, [ebp - 0x2844]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ebx, 1
mov dword [ebp - 0x3a58], ebx
jmp 0x8ca38e
mov eax, str.REGISTRYMACHINESYSTEMControlSet001ControlSession_ManagerBootExecute
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8ca2ea
mov eax, str.REGISTRYMACHINESYSTEMControlSet001ControlSession_ManagerPendingFileRenameOperations
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8ca2ea
mov eax, str.REGISTRYMACHINESYSTEMControlSet001ControlSession_ManagerPendingFileRenameOperations2
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8ca2ea
mov eax, str.REGISTRYMACHINESYSTEMControlSet001ControlLsaSecurity_Packages
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8ca252
mov eax, str.REGISTRYMACHINESYSTEMControlSet001ControlLsaNotification_Packages
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8ca252
mov eax, str.REGISTRYMACHINESYSTEMControlSet001ControlLsaAuthentication_Packages
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x8ca252
mov edx, dword [0xc11a64]
push edx
push str.REGISTRYMACHINESYSTEMControlSet001Services_
push edi
call fcn.00a891c8
add esp, 0xc
test eax, eax
jne 0x8c905b
push 0x207
mov byte [ebp - 0x534], al
xor edi, edi
lea eax, [ebp - 0x533]
push edi
push eax
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x164b]
push edi
push ecx
mov byte [ebp - 0x164c], 0
call fcn.00a7ffb0
mov edx, dword [0xc11a64]
mov eax, dword [ebp - 0x3a54]
add eax, edx
lea edx, [ebp - 0x534]
add esp, 0xc
mov dword [ebp - 0x3a70], ebx
mov dword [ebp - 0x3a6c], ebx
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, ebx
test cl, cl
jne 0x8c89f0
lea ecx, [ebp - 0x534]
push 0x5c
push ecx
call fcn.00a7a2c0
add esp, 8
cmp eax, edi
je 0x8ca38e
lea ecx, [eax + 1]
lea esi, [ebp - 0x164c]
sub esi, ecx
nop
mov dl, byte [ecx]
mov byte [esi + ecx], dl
add ecx, ebx
test dl, dl
jne 0x8c8a20
mov byte [eax], dl
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x534]
mov byte [ebp + eax - 0x32c], cl
add eax, ebx
test cl, cl
jne 0x8c8a30
cmp byte [ebp - 0x32c], cl
je 0x8ca38e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3a7c], edi
cmp eax, ebx
je 0x8c8a62
cmp eax, 2
jne 0x8c8a68
mov dword [ebp - 0x3a7c], ebx
lea edx, [ebp - 0x32c]
push edx
mov esi, str.IPZ_IPZ2
call fcn.0098d400
test eax, eax
je 0x8c8aea
lea eax, [ebp - 0x32c]
push eax
lea ecx, [ebp - 0x534]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.00a78f30
add esp, 0xc
lea edx, [ebp - 0x534]
push edx
lea eax, [ebp - 0x32c]
push eax
lea ecx, [ebp - 0x844]
push str._MALSERV__Blocking_Creation_of_Malware_Service:__s__HKLM_s_
push ecx
call fcn.00a78f30
push edi
push ebx
lea edx, [ebp - 0x844]
push edx
push 0xb54ce8
call fcn.008808e0
lea eax, [ebp - 0x32c]
push eax
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a50], edi
call fcn.008c6800
add esp, 0x24
jmp 0x8ca38e
cmp dword [0xb3b47c], edi
je 0x8c8c10
push edi
lea ecx, [ebp - 0x32c]
push str.processhacker
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8b7d
lea edx, [ebp - 0x32c]
push edx
lea eax, [ebp - 0x534]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x534]
push ecx
lea edx, [ebp - 0x32c]
push edx
lea eax, [ebp - 0x844]
push str._MALSERV__Blocking_Creation_of_ProcessHacker_Service:__s__HKLM_s_
push eax
call fcn.00a78f30
push edi
push ebx
lea ecx, [ebp - 0x844]
push ecx
push 0xb54ce8
call fcn.008808e0
lea edx, [ebp - 0x32c]
push edx
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a50], edi
call fcn.008c6800
add esp, 0x24
jmp 0x8ca38e
cmp dword [0xb3b47c], edi
je 0x8c8c10
push edi
lea eax, [ebp - 0x32c]
push str.PSEXESVC
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8c10
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0x534]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.00a78f30
add esp, 0xc
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0x844]
push str._MALSERV__Blocking_Creation_of_PSExec_Service:__s__HKLM_s_
push edx
call fcn.00a78f30
push edi
push ebx
lea eax, [ebp - 0x844]
push eax
push 0xb54ce8
call fcn.008808e0
lea ecx, [ebp - 0x32c]
push ecx
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a50], edi
call fcn.008c6800
add esp, 0x24
jmp 0x8ca38e
cmp dword [0xb3dc70], edi
je 0x8c8cc8
push edi
lea edx, [ebp - 0x32c]
push str.IOBit
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c8c5b
cmp dword [ebp - 0x3a7c], edi
je 0x8c8cc8
mov eax, dword [ebp - 0x3a64]
push str.Iobit
push eax
call fcn.0095c9e0
add esp, 8
cmp eax, 0xffffffff
je 0x8c8cc8
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0x534]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.00a78f30
add esp, 0xc
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0x844]
push str._MALSERV__Blocking_Creation_of_IOBit_Service:__s__HKLM_s_
push edx
call fcn.00a78f30
push edi
push ebx
lea eax, [ebp - 0x844]
push eax
push 0xb54ce8
call fcn.008808e0
lea ecx, [ebp - 0x32c]
push ecx
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a50], edi
call fcn.008c6800
add esp, 0x24
jmp 0x8ca38e
cmp dword [0xb3dc74], edi
je 0x8c8e81
push edi
lea edx, [ebp - 0x32c]
push str.sysdiag
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8d5b
lea eax, [ebp - 0x32c]
push eax
lea ecx, [ebp - 0x534]
push str.SYSTEMCurrentControlSetServices_s
push ecx
call fcn.00a78f30
add esp, 0xc
lea edx, [ebp - 0x534]
push edx
lea eax, [ebp - 0x32c]
push eax
lea ecx, [ebp - 0x844]
push str._MALSERV__Blocking_Creation_of_HRSWord_Service:__s__HKLM_s_
push ecx
call fcn.00a78f30
push edi
push ebx
lea edx, [ebp - 0x844]
push edx
push 0xb54ce8
call fcn.008808e0
lea eax, [ebp - 0x32c]
push eax
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a50], edi
call fcn.008c6800
add esp, 0x24
jmp 0x8ca38e
cmp dword [0xb3dc74], edi
je 0x8c8e81
push edi
lea ecx, [ebp - 0x32c]
push str.pchunter
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8dee
lea edx, [ebp - 0x32c]
push edx
lea eax, [ebp - 0x534]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.00a78f30
add esp, 0xc
lea ecx, [ebp - 0x534]
push ecx
lea edx, [ebp - 0x32c]
push edx
lea eax, [ebp - 0x844]
push str._MALSERV__Blocking_Creation_of_PCHunter_Service:__s__HKLM_s_
push eax
call fcn.00a78f30
push edi
push ebx
lea ecx, [ebp - 0x844]
push ecx
push 0xb54ce8
call fcn.008808e0
lea edx, [ebp - 0x32c]
push edx
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a50], edi
call fcn.008c6800
add esp, 0x24
jmp 0x8ca38e
cmp dword [0xb3dc74], edi
je 0x8c8e81
push edi
lea eax, [ebp - 0x32c]
push str.kevp
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c8e81
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0x534]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.00a78f30
add esp, 0xc
lea eax, [ebp - 0x534]
push eax
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0x844]
push str._MALSERV__Blocking_Creation_of_Powertool_Service:__s__HKLM_s_
push edx
call fcn.00a78f30
push edi
push ebx
lea eax, [ebp - 0x844]
push eax
push 0xb54ce8
call fcn.008808e0
lea ecx, [ebp - 0x32c]
push ecx
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a50], edi
call fcn.008c6800
add esp, 0x24
jmp 0x8ca38e
cmp dword [ebp - 0x3a7c], edi
je 0x8ca38e
lea edx, [ebp - 0x164c]
push str.ImagePath
push edx
call fcn.00a88f66
add esp, 8
test eax, eax
jne 0x8ca38e
mov eax, dword [ebp - 0x3a64]
push eax
lea ecx, [ebp - 0x3044]
push 0xaa8700
push ecx
call fcn.00a78f30
lea edx, [ebp - 0x3044]
add esp, 0xc
push edx
call fcn.0095ad70
add esp, 4
cmp byte [ebp - 0x3044], 0x22
jne 0x8c8f0c
lea eax, [ebp - 0x3043]
push 0x22
push eax
call fcn.00a7a2c0
add esp, 8
mov byte [ebp - 0x3044], 0x20
cmp eax, edi
je 0x8c8efb
mov byte [eax], 0
lea ecx, [ebp - 0x3044]
push ecx
call fcn.0095ad70
add esp, 4
jmp 0x8c8f24
lea edx, [ebp - 0x3044]
push 0x20
push edx
call fcn.00a7a2c0
add esp, 8
cmp eax, edi
je 0x8c8f24
mov byte [eax], 0
push ebx
lea eax, [ebp - 0x3044]
push eax
call fcn.00977760
lea ecx, [ebp - 0x3044]
push 0x5c
push ecx
call fcn.00a7aa50
mov esi, eax
add esp, 8
cmp esi, edi
je 0x8ca38e
lea edx, [ebp - 0x3044]
push edx
add esi, ebx
push esi
lea ecx, [ebp - 0x3a64]
mov dword [ebp - 0x3a64], edi
mov dword [ebp - 0x3a88], edi
call fcn.00a691a0
add esp, 8
mov dword [ebp - 0x3a80], eax
cmp dword [ebp - 0x3a64], edi
jne 0x8c8f9d
cmp dword [0xb3dea4], edi
je 0x8c8f9d
lea eax, [ebp - 0x3044]
push eax
mov ecx, esi
call fcn.00a65ff0
add esp, 4
mov dword [ebp - 0x3a88], eax
cmp dword [ebp - 0x3a80], edi
je 0x8c8fad
cmp dword [ebp - 0x3a64], edi
jne 0x8c8fb9
cmp dword [ebp - 0x3a88], edi
je 0x8ca38e
lea ecx, [ebp - 0x32c]
push ecx
lea edx, [ebp - 0x534]
push str.SYSTEMCurrentControlSetServices_s
push edx
call fcn.00a78f30
add esp, 0xc
cmp dword [ebp - 0x3a64], edi
je 0x8c8fff
lea eax, [ebp - 0x3044]
push eax
lea ecx, [ebp - 0x534]
push ecx
lea edx, [ebp - 0x32c]
push edx
push str._SUSPSERV__Blocking_Creation_of_Service:__s__HKLM_s__as_ImagePath_refers_to_Sensitive_OS_File:__s
lea eax, [ebp - 0x844]
push eax
jmp 0x8c9020
lea ecx, [ebp - 0x3044]
push ecx
lea edx, [ebp - 0x534]
push edx
lea eax, [ebp - 0x32c]
push eax
push str._SUSPSERV__Blocking_Creation_of_Service:__s__HKLM_s__as_ImagePath_refers_to_file_in_DataFolder_Path:__s
lea ecx, [ebp - 0x844]
push ecx
call fcn.00a78f30
add esp, 0x14
push edi
push ebx
lea edx, [ebp - 0x844]
push edx
push 0xb54ce8
call fcn.008808e0
lea eax, [ebp - 0x32c]
push eax
mov dword [ebp - 0x3a58], ebx
mov dword [ebp - 0x3a50], edi
call fcn.008c6800
add esp, 0x14
jmp 0x8ca38e
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools
mov ebx, edi
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr
call fcn.008c63f0
test eax, eax
je 0x8c9b91
test byte [0xbd4aa8], 1
je 0x8c909c
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoControlPanel
call fcn.008c63f0
test eax, eax
je 0x8c9b91
cmp dword [0xbd0530], 0
je 0x8c90d4
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesProgramsNoProgramsCPL
mov ebx, edi
call fcn.008c63f0
test eax, eax
je 0x8c9b91
cmp dword [0xbd0530], 0
je 0x8c90d4
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerSettingsPageVisibility
call fcn.008c63f0
test eax, eax
je 0x8c9b91
cmp dword [0xbd4ad8], 0
je 0x8c90f1
mov esi, str.REGISTRYMACHINESOFTWAREPoliciesGoogleChromeURLBlacklist10018
mov ebx, edi
call fcn.008c63f0
test eax, eax
je 0x8c9b91
cmp dword [0xbd4aac], 0
je 0x8c910e
mov esi, str.REGISTRYMACHINESoftwarePoliciesMicrosoftWindowsNetwork_ConnectionsNC_ShowSharedAccessUI
mov ebx, edi
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov esi, str.REGISTRYMACHINESOFTWAREPoliciesGoogleChromeQuicAllowed
mov ebx, edi
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov esi, str.REGISTRYMACHINESOFTWAREClassesexefile_shellopencommand_
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov esi, str.REGISTRYMACHINESOFTWAREClasseshttp_shellopenddeexec_
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov esi, str.REGISTRYMACHINESOFTWAREClassesPROTOCOLSFilter_text_htmlCLSID
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionBITSIGDSearcherDLL
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindows_NTCurrentVersionWinlogonShell
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov ebx, dword [ebp - 0x3a54]
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftRpcExtensionsRemoteRpcDll
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftCommand_ProcessorAutoRun
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov eax, str.REGISTRYMACHINESYSTEMControlSet001ControlServiceControlManagerExtension
mov ecx, ebx
call fcn.0094c330
test eax, eax
je 0x8c9b91
mov ecx, dword [0xc11a90]
push ecx
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityATs_
mov edi, ebx
call fcn.008c6490
add esp, 4
test eax, eax
je 0x8c9b91
mov edx, dword [0xc11a78]
push edx
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup_
call fcn.008c6490
add esp, 4
test eax, eax
je 0x8c9b91
mov eax, dword [0xc11a74]
push eax
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler_
call fcn.008c6490
add esp, 4
test eax, eax
je 0x8c9b91
mov ecx, dword [0xc11a70]
push ecx
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks_
call fcn.008c6490
add esp, 4
test eax, eax
je 0x8c9b91
call fcn.00968bc0
test eax, eax
je 0x8c9246
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionWindowsAppInit_DLLs
call fcn.008c63f0
test eax, eax
je 0x8c9b91
mov edx, dword [str._WYYRD_Q]
mov edi, dword [ebp - 0x3a54]
push edx
mov esi, str.REGISTRYMACHINESOFTWAREIObitUninstaller_
call fcn.008c6490
add esp, 4
test eax, eax
jne 0x8c9290
mov eax, 1
mov dword [ebp - 0x3a70], eax
mov dword [ebp - 0x3a50], 0
mov dword [ebp - 0x3a6c], eax
mov dword [ebp - 0x3a58], eax
mov dword [ebp - 0x3a74], eax
jmp 0x8ca38e
mov eax, dword [0xc11a84]
push eax
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRun_
call fcn.008c6490
add esp, 4
test eax, eax
je 0x8c9585
mov ecx, dword [0xc11a7c]
push ecx
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun_
call fcn.008c6490
add esp, 4
test eax, eax
je 0x8c9585
mov edx, dword [0xc11a80]
push edx
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOnce_
call fcn.008c6490
add esp, 4
test eax, eax
je 0x8c9585
mov eax, dword [0xc11a8c]
push eax
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
call fcn.008c6490
add esp, 4
test eax, eax
jne 0x8ca38e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3a70], 1
cmp eax, 1
je 0x8c9319
cmp eax, 2
jne 0x8ca38e
mov ecx, dword [0xc11a8c]
mov edx, dword [ebp - 0x3a54]
lea esi, [ecx + edx]
mov dword [ebp - 0x3a6c], 1
test esi, esi
je 0x8ca38e
push 0x5c
push esi
call fcn.00a7a2c0
mov edi, eax
add esp, 8
test edi, edi
je 0x8ca38e
inc edi
mov eax, str.Debugger
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x8c94e1
mov dword [ebp - 0x3a64], eax
lea eax, [ebp - 0x3a64]
push eax
push str.sethc.exe_Utilman.exe_DisplaySwitch.exe_osk.exe_dllhost.exe
mov bl, 0x2c
lea edi, [ebp - 0x22c]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x3a64], 0xffffffff
je 0x8c93ca
nop
lea eax, [ebp - 0x22c]
mov ecx, esi
call fcn.0094c3e0
test eax, eax
je 0x8c9454
lea ecx, [ebp - 0x3a64]
push ecx
push str.sethc.exe_Utilman.exe_DisplaySwitch.exe_osk.exe_dllhost.exe
mov bl, 0x2c
lea edi, [ebp - 0x22c]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x3a64], 0xffffffff
jne 0x8c9390
mov edi, dword [ebp - 0x3a5c]
push 0xc
push 0
mov esi, 1
push edi
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a6c], esi
call fcn.008c5870
add esp, 0xc
mov dword [ebp - 0x3a50], eax
test eax, eax
jne 0x8ca38e
push eax
lea edx, [ebp - 0x1444]
push 8
push edx
call fcn.008c5820
add esp, 0xc
test eax, eax
je 0x8ca38e
mov eax, dword [ebp - 0x3a54]
push 0xb
push edi
push esi
push eax
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x1444]
call fcn.008c4290
add esp, 0x10
test eax, eax
je 0x8ca38e
mov dword [ebp - 0x3a58], esi
mov dword [ebp - 0x3a74], esi
jmp 0x8ca38e
mov eax, dword [ebp - 0x3a54]
lea edx, [ebp - 0x534]
sub edx, eax
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x8c9462
push 0xaa1543
lea ecx, [ebp - 0x534]
push str.REGISTRYMACHINE_
push ecx
call fcn.0095e130
add esp, 0xc
lea edx, [ebp - 0x534]
push 0x5c
push edx
call fcn.00a7aa50
add esp, 8
test eax, eax
je 0x8c94c8
mov byte [eax], 0
push 0x80000002
xor eax, eax
lea edi, [ebp - 0x534]
call fcn.0095fbe0
call fcn.00968110
test eax, eax
je 0x8c94c8
mov eax, edi
push eax
push 0x80000002
call fcn.0095fa40
add esp, 8
mov dword [ebp - 0x3a50], 0
mov dword [ebp - 0x3a58], 1
jmp 0x8ca38e
mov eax, str.VerifierDlls
mov ecx, edi
call fcn.0094c330
test eax, eax
jne 0x8ca38e
call 0x9aa790
test eax, eax
je 0x8ca38e
lea edx, [ebp - 0x32c]
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x8c9510
lea ecx, [ebp - 0x32c]
push 0x5c
push ecx
call fcn.00a7a2c0
add esp, 8
test eax, eax
je 0x8c9532
mov byte [eax], 0
mov eax, 1
lea edx, [ebp - 0x32c]
push edx
mov dword [ebp - 0x3a6c], eax
mov dword [ebp - 0x3a58], eax
mov dword [ebp - 0x3a74], eax
lea eax, [ebp - 0x534]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_s
push eax
mov dword [ebp - 0x3a50], 0
call fcn.00a78f30
add esp, 0xc
push 0x80000002
xor eax, eax
lea edi, [ebp - 0x534]
call fcn.0095fbe0
jmp 0x8ca38e
mov eax, dword [ebp + 0xc]
mov ebx, 1
mov dword [ebp - 0x3a70], ebx
cmp eax, ebx
je 0x8c95a0
cmp eax, 2
jne 0x8ca38e
mov ecx, dword [ebp - 0x3a5c]
push 0xb
push 0
push ecx
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a80], 0
mov dword [ebp - 0x3a6c], ebx
call fcn.008c5870
mov esi, dword [ebp - 0x3a68]
add esp, 0xc
mov dword [ebp - 0x3a50], eax
test eax, eax
je 0x8c9669
test esi, esi
je 0x8c9768
push 0x5c
push esi
call fcn.00a7aa50
mov edi, eax
add esp, 8
test edi, edi
je 0x8c9600
add edi, ebx
jmp 0x8c9602
mov edi, esi
push 0x2e
push edi
call fcn.00a7aa50
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x8c9669
mov eax, 0xacaa98
call fcn.0094c330
test eax, eax
jne 0x8c9669
push eax
push str..exe.lnk
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c965f
push 0
push str..com.lnk
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c965f
push 0
push str..scr.lnk
push edi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c9669
mov dword [ebp - 0x3a50], 0
test esi, esi
je 0x8c9768
cmp byte [esi], 0
je 0x8c9768
mov ebx, esi
call fcn.00a66600
test eax, eax
je 0x8c96ca
push esi
push str._REG__C__Blocking_Value_Write_of___s__as_it_is_in_Suspicious_Folder
push 0xffffffffffffffff
lea edx, [ebp - 0x2844]
push 0x1000
push edx
mov dword [ebp - 0x3a50], 0
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea eax, [ebp - 0x2844]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov edi, 1
jmp 0x8c96d0
mov edi, dword [ebp - 0x3a80]
cmp byte [esi], 0
je 0x8c9720
mov ecx, esi
call fcn.008c6900
test eax, eax
je 0x8c9720
push esi
push str._REG__C1__Blocking_Value_Write_of___s__as_it_is_a_Suspicious_Entry
push 0xffffffffffffffff
lea ecx, [ebp - 0x2844]
push 0x1000
push ecx
mov dword [ebp - 0x3a50], 0
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0x2844]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
jmp 0x8c9724
test edi, edi
je 0x8c9763
mov eax, dword [ebp - 0x3a54]
push 0x2a
push 0
mov edi, 1
push edi
push eax
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x1444]
call fcn.008c4290
add esp, 0x10
mov ebx, edi
test eax, eax
je 0x8c9768
mov dword [ebp - 0x3a90], edi
mov dword [ebp - 0x3a58], edi
mov dword [ebp - 0x3a74], edi
jmp 0x8c9768
mov ebx, 1
cmp dword [ebp - 0x3a50], 0
jne 0x8ca38e
push 0x207
lea ecx, [ebp - 0x533]
push 0
push ecx
mov byte [ebp - 0x534], 0
call fcn.00a7ffb0
xor edi, edi
add esp, 0xc
mov dword [ebp - 0x3a64], edi
test esi, esi
je 0x8c97ba
push esi
push 0xaa1544
push 0xffffffffffffffff
lea edx, [ebp - 0x534]
push 0x208
push edx
call fcn.00a78fcb
add esp, 0x14
lea ecx, [ebp - 0x534]
call fcn.009619b0
call fcn.00968b30
test eax, eax
jne 0x8c9803
lea eax, [ebp - 0x3a80]
push eax
lea ecx, [ebp - 0x534]
push 6
push ecx
call fcn.008c5820
add esp, 0xc
test eax, eax
je 0x8c97ee
mov edi, ebx
jmp 0x8c97fb
xor edx, edx
cmp dword [ebp - 0x3a80], edx
sete dl
mov edi, edx
test eax, eax
jne 0x8c9981
push 0
lea eax, [ebp - 0x534]
push 0xacb5d4
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c983d
push 0
lea ecx, [ebp - 0x534]
push str.wscript
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c9903
push 0
push str.start
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c9887
push 0
push 0xacb5e8
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c9887
push 0
push str.exit
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c9887
mov dword [ebp - 0x3a64], ebx
jmp 0x8c9950
push 0
push str.wscript
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c98d1
push 0
push 0xacb5e8
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c98d1
push 0
push 0xacb5f4
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c98d1
mov dword [ebp - 0x3a64], ebx
jmp 0x8c9950
push 0
push str.start_WSCRIPT
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c9948
push 0
push 0xacb608
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c9948
mov dword [ebp - 0x3a64], ebx
jmp 0x8c9950
push 0
lea edx, [ebp - 0x534]
push str.regsvr32.exe
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c9948
push 0
push 0xacb60c
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x8c9948
push 0
push 0xacb614
push esi
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8c9950
test edi, edi
je 0x8ca38e
push 0
lea ecx, [ebp - 0x1444]
push 7
push ecx
call fcn.008c5820
add esp, 0xc
test eax, eax
je 0x8c9a0e
mov edx, dword [ebp - 0x3a5c]
mov eax, dword [ebp - 0x3a54]
push 0xa
push edx
push ebx
push eax
jmp 0x8c7dc3
cmp eax, 2
jne 0x8c99f4
mov eax, dword [ebp - 0x3a54]
push 8
push 0
push ebx
push eax
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x1444]
call fcn.008c4290
add esp, 0x10
test eax, eax
je 0x8ca38e
lea eax, [ebp - 0x534]
call fcn.0094dd20
lea ecx, [ebp - 0x534]
push 0x2e
push ecx
call fcn.00a7aa50
mov esi, eax
add esp, 8
test esi, esi
je 0x8c99e1
lea eax, [ebp - 0x534]
mov byte [esi], 0
call fcn.0094dd20
mov byte [esi], 0x2e
push 0x103
push 0
lea edx, [ebp - 0x123]
push edx
jmp 0x8c85b3
cmp eax, 4
jne 0x8c9948
mov eax, dword [ebp - 0x3a54]
push 9
push 0
push ebx
push eax
jmp 0x8c7dc3
cmp dword [ebp - 0x3a64], ebx
jne 0x8ca38e
push 0
lea ecx, [ebp - 0x1444]
push str.wscript.exe
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x8ca38e
mov esi, dword [ebp - 0x3a60]
cmp esi, 4
jbe 0x8ca38e
push 0x103
lea edx, [ebp - 0x22b]
push 0
push edx
mov byte [ebp - 0x22c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x123]
push 0
push eax
mov byte [ebp - 0x124], 0
call fcn.00a7ffb0
add esp, 0xc
push esi
lea ecx, [ebp - 0x124]
lea ebx, [ebp - 0x22c]
call fcn.0097b130
cmp dword [0xbc27fc], 0
je 0x8c9ad4
lea ecx, [ebp - 0x124]
push ecx
lea edx, [ebp - 0x2844]
push str._REG__dwParent:__s
push edx
call fcn.00a78f30
mov eax, dword [0xbc27fc]
add esp, 0xc
push 0
push eax
lea ecx, [ebp - 0x2844]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
cmp byte [ebp - 0x124], 0
je 0x8c9b0b
push 0
lea edx, [ebp - 0x124]
push 0x36
push edx
call fcn.008c5820
add esp, 0xc
test eax, eax
jne 0x8c9b02
cmp byte [ebp - 0x124], al
jne 0x8ca38e
jmp 0x8c9b0b
cmp byte [ebp - 0x124], 0
jne 0x8c9b33
mov eax, dword [ebp - 0x3a5c]
mov ecx, dword [ebp - 0x3a54]
push 0x37
push eax
push 1
push ecx
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x1444]
call fcn.008c4290
add esp, 0x10
jmp 0x8c9b73
mov edx, dword [ebp - 0x3a54]
push 0x38
push esi
push 1
push edx
lea edx, [ebp - 0x3a78]
lea ecx, [ebp - 0x124]
call fcn.008c4290
add esp, 0x10
xor ecx, ecx
jmp 0x8c9b60
mov dl, byte [ebp + ecx - 0x124]
mov byte [ebp + ecx - 0x1444], dl
inc ecx
test dl, dl
jne 0x8c9b60
test eax, eax
je 0x8ca38e
mov eax, 1
mov dword [ebp - 0x3a58], eax
mov dword [ebp - 0x3a74], eax
jmp 0x8ca38e
mov ebx, dword [ebp - 0x3a54]
xor eax, eax
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindows_NTCurrentVersionWinlogonShell
mov dword [ebp - 0x3a8c], eax
mov dword [ebp - 0x3a84], eax
mov dword [ebp - 0x3a7c], eax
mov dword [ebp - 0x3a88], eax
mov dword [ebp - 0x3a70], 1
call fcn.008c63f0
mov ebx, 1
test eax, eax
jne 0x8c9bd4
mov dword [ebp - 0x3a88], ebx
mov eax, dword [0xc11a74]
mov edi, dword [ebp - 0x3a54]
push eax
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler_
call fcn.008c6490
add esp, 4
test eax, eax
jne 0x8c9bf9
mov dword [ebp - 0x3a8c], ebx
jmp 0x8c9c1d
mov ecx, dword [0xc11a78]
mov edi, dword [ebp - 0x3a54]
push ecx
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup_
call fcn.008c6490
add esp, 4
test eax, eax
jne 0x8c9c1d
mov dword [ebp - 0x3a84], ebx
mov ebx, dword [ebp - 0x3a54]
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableRegistryTools
call fcn.008c63f0
test eax, eax
je 0x8c9cb4
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystemDisableTaskMgr
call fcn.008c63f0
test eax, eax
je 0x8c9cb4
mov esi, str.REGISTRYMACHINESoftwarePoliciesMicrosoftWindowsNetwork_ConnectionsNC_ShowSharedAccessUI
call fcn.008c63f0
test eax, eax
je 0x8c9cb4
mov esi, str.REGISTRYMACHINESOFTWAREPoliciesGoogleChromeQuicAllowed
call fcn.008c63f0
test eax, eax
je 0x8c9cb4
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerNoControlPanel
call fcn.008c63f0
test eax, eax
je 0x8c9cb4
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesProgramsNoProgramsCPL
call fcn.008c63f0
test eax, eax
je 0x8c9cb4
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x8c9c8c
cmp eax, 2
jne 0x8ca38e
mov esi, str.REGISTRYMACHINESOFTWAREPoliciesGoogleChromeURLBlacklist10018
call fcn.008c63f0
test eax, eax
je 0x8c9ca8
mov esi, str.REGISTRYMACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerSettingsPageVisibility
call fcn.008c63f0
test eax, eax
jne 0x8c9cc8
mov dword [ebp - 0x3a7c], 1
jmp 0x8c9cc8
cmp dword [ebp + 0xc], 4
mov dword [ebp - 0x3a7c], 1
jne 0x8ca38e
xor eax, eax
mov dword [ebp - 0x3a80], eax
cmp dword [ebp - 0x3a8c], eax
je 0x8c9cde
lea eax, [ebp - 0x3a80]
mov edi, dword [ebp - 0x3a5c]
push 0xa
push eax
push edi
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a6c], 1
call fcn.008c5870
add esp, 0xc
cmp dword [ebp - 0x3a88], 0
mov esi, eax
mov dword [ebp - 0x3a50], esi
je 0x8c9d84
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x8c9d24
cmp eax, 2
jne 0x8c9d84
test esi, esi
je 0x8c9d84
mov ebx, dword [ebp - 0x3a68]
test ebx, ebx
je 0x8c9d84
cmp byte [ebx], 0
je 0x8c9d84
call fcn.00a66600
test eax, eax
je 0x8c9d84
push ebx
push str._REG__E__Blocking_Value_Write_of___s__as_it_is_in_Suspicious_Folder
push 0xffffffffffffffff
lea edx, [ebp - 0x2844]
push 0x1000
push edx
mov dword [ebp - 0x3a50], 0
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea eax, [ebp - 0x2844]
push eax
push 0xb54ce8
call fcn.008808e0
mov esi, dword [ebp - 0x3a50]
add esp, 0x10
cmp dword [ebp - 0x3a8c], 0
je 0x8c9e0c
test esi, esi
jne 0x8c9e0c
push 0x103
lea ecx, [ebp - 0x63b]
push esi
push ecx
mov byte [ebp - 0x63c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x433]
push esi
push edx
mov byte [ebp - 0x434], 0
call fcn.00a7ffb0
mov eax, dword [ebp - 0x3a80]
add esp, 0xc
cmp eax, 4
jbe 0x8ca18f
push eax
lea ecx, [ebp - 0x434]
lea ebx, [ebp - 0x63c]
call fcn.0097b130
mov eax, str.wow64sup.exe
mov ecx, ebx
call fcn.0094c330
test eax, eax
jne 0x8ca18f
mov dword [ebp - 0x3a50], 1
mov esi, dword [ebp - 0x3a60]
cmp dword [ebp - 0x3a84], 0
jne 0x8c9e28
cmp dword [ebp - 0x3a7c], 0
je 0x8ca0e9
cmp dword [ebp - 0x3a50], 0
jne 0x8ca0e9
cmp esi, 4
jbe 0x8ca0e9
push 0x103
lea eax, [ebp - 0x123]
push 0
push eax
mov byte [ebp - 0x124], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x433]
push 0
push ecx
mov byte [ebp - 0x434], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x154b]
push 0
push edx
mov byte [ebp - 0x154c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x743]
push 0
push eax
mov byte [ebp - 0x744], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x22b]
push 0
push ecx
mov byte [ebp - 0x22c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [ebp - 0x63b]
push 0
push edx
mov byte [ebp - 0x63c], 0
call fcn.00a7ffb0
add esp, 0xc
xor eax, eax
mov edi, edi
mov cl, byte [eax + 0xb56938]
mov byte [ebp + eax - 0x124], cl
inc eax
test cl, cl
jne 0x8c9ef0
lea ecx, [ebp - 0x124]
call fcn.00960910
xor eax, eax
nop
mov cl, byte [ebp + eax - 0x124]
mov byte [ebp + eax - 0x434], cl
inc eax
test cl, cl
jne 0x8c9f10
xor eax, eax
jmp 0x8c9f30
mov cl, byte [ebp + eax - 0x124]
mov byte [ebp + eax - 0x154c], cl
inc eax
test cl, cl
jne 0x8c9f30
xor eax, eax
jmp 0x8c9f50
mov cl, byte [ebp + eax - 0x124]
mov byte [ebp + eax - 0x744], cl
inc eax
test cl, cl
jne 0x8c9f50
lea eax, [ebp - 0x124]
dec eax
lea ebx, [ebx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8c9f70
mov ecx, dword [str.taskhost.exe]
mov edx, dword [0xacb634]
mov dword [eax], ecx
mov ecx, dword [0xacb638]
mov dword [eax + 4], edx
mov dl, byte [0xacb63c]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x434]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8c9fa2
mov ecx, dword [str.gpscript.exe]
mov edx, dword [0xacb644]
mov dword [eax], ecx
mov ecx, dword [0xacb648]
mov dword [eax + 4], edx
mov dl, byte [0xacb64c]
mov dword [eax + 8], ecx
mov byte [eax + 0xc], dl
lea eax, [ebp - 0x154c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8c9fd4
mov ecx, dword [str.svchost.exe]
mov edx, dword [0xac9e3c]
mov dword [eax], ecx
mov ecx, dword [0xac9e40]
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
lea eax, [ebp - 0x744]
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x8ca000
mov edx, dword [str.services.exe]
mov ecx, dword [0xacaa80]
mov dword [eax], edx
mov edx, dword [0xacaa84]
mov dword [eax + 4], ecx
mov cl, byte [0xacaa88]
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
push esi
lea ecx, [ebp - 0x63c]
lea ebx, [ebp - 0x22c]
call fcn.0097b130
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x63c]
call fcn.0094c330
test eax, eax
jne 0x8ca067
lea eax, [ebp - 0x434]
lea ecx, [ebp - 0x1444]
call fcn.0094c330
test eax, eax
je 0x8ca091
lea eax, [ebp - 0x744]
lea ecx, [ebp - 0x63c]
call fcn.0094c330
test eax, eax
jne 0x8ca0e9
lea eax, [ebp - 0x154c]
lea ecx, [ebp - 0x1444]
call fcn.0094c330
test eax, eax
jne 0x8ca0e9
cmp dword [0xbc27fc], 0
mov dword [ebp - 0x3a50], 1
je 0x8ca0e9
lea edx, [ebp - 0x63c]
push edx
push esi
lea eax, [ebp - 0x1444]
push eax
push edi
push str._REG__AuthorizedProcess_B___PID:__u___s___PPid:__u___s__
push 0xffffffffffffffff
lea ecx, [ebp - 0x2844]
push 0x1000
push ecx
call fcn.00a78fcb
mov edx, dword [0xbc27fc]
push 0
push edx
lea eax, [ebp - 0x2844]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x30
cmp dword [0xb54194], 0
je 0x8ca14a
cmp dword [ebp - 0x3a50], 0
jne 0x8ca14a
cmp dword [ebp - 0x3a8c], 0
jne 0x8ca10d
cmp dword [ebp - 0x3a84], 0
je 0x8ca14a
lea ecx, [ebp - 0xc44]
push ecx
lea edx, [ebp - 0x32c]
push str.Allowing_Modifications_to__s_as_it_is_SMB_Corp_Edition...
push edx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea eax, [ebp - 0x32c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0x3a50], 1
cmp dword [ebp - 0x3a7c], 0
je 0x8ca1d3
mov ebx, dword [ebp - 0x3a54]
mov esi, str.REGISTRYMACHINESOFTWAREPoliciesGoogleChromeQuicAllowed
call fcn.008c63f0
test eax, eax
jne 0x8ca1d3
cmp dword [ebp + 0xc], 4
jne 0x8ca1d3
mov eax, dword [ebp - 0x3a64]
test eax, eax
je 0x8ca1d3
cmp dword [eax], 0
jne 0x8ca1d3
mov dword [ebp - 0x3a50], 1
jmp 0x8ca38e
mov esi, dword [ebp - 0x3a60]
cmp esi, 4
jbe 0x8c9e12
push esi
lea ecx, [ebp - 0x434]
lea ebx, [ebp - 0x63c]
call fcn.0097b130
mov eax, str.wow64sup.exe
mov ecx, ebx
call fcn.0094c330
test eax, eax
jne 0x8c9e12
mov dword [ebp - 0x3a50], 1
jmp 0x8c9e12
cmp dword [ebp - 0x3a50], 0
jne 0x8ca38e
mov ecx, dword [0xc11a90]
mov edi, dword [ebp - 0x3a54]
push ecx
mov esi, str.REGISTRYMACHINESOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityATs_
call fcn.008c6490
add esp, 4
test eax, eax
jne 0x8c94d2
mov edx, dword [0xc11a90]
lea eax, [edx + edi]
test eax, eax
je 0x8ca38e
push 0x5c
push eax
call fcn.00a7a2c0
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x8ca38e
add ecx, 1
je 0x8ca38e
mov eax, str.StartExe
call fcn.0094c330
test eax, eax
jne 0x8ca38e
mov dword [ebp - 0x3a58], 1
jmp 0x8ca38e
cmp dword [ebp + 0xc], 7
mov dword [ebp - 0x3a70], ebx
jne 0x8ca38e
mov eax, dword [ebp - 0x3a5c]
push 8
push 0
mov esi, 1
push eax
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a6c], esi
call fcn.008c5870
add esp, 0xc
mov dword [ebp - 0x3a50], eax
test eax, eax
jne 0x8ca38e
cmp dword [0xb54194], eax
je 0x8ca2df
lea ecx, [ebp - 0xc44]
push ecx
lea edx, [ebp - 0x32c]
push str.Allowing_Modifications_to__s_as_it_is_SMB_Corp_Edition...
push edx
call fcn.00a78f30
add esp, 0xc
push 0
push esi
lea eax, [ebp - 0x32c]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov dword [ebp - 0x3a50], esi
jmp 0x8ca38e
mov dword [ebp - 0x3a58], esi
jmp 0x8ca38e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3a70], ebx
cmp eax, 7
je 0x8ca30a
cmp eax, ebx
je 0x8ca30a
cmp eax, 2
jne 0x8ca38e
mov ebx, 1
mov ecx, dword [ebp - 0x3a5c]
push 7
push 0
push ecx
lea edx, [ebp - 0x1444]
lea ecx, [ebp - 0x3a60]
mov dword [ebp - 0x3a6c], ebx
call fcn.008c5870
add esp, 0xc
mov dword [ebp - 0x3a50], eax
test eax, eax
jne 0x8ca38e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x3a64]
push edi
call fcn.008c34e0
add esp, 4
mov dword [ebp - 0x3a58], eax
jmp 0x8ca38e
cmp dword [0xbf33f4], 0
jne 0x8ca79c
lea edx, [ebp - 0x2844]
push str._REG__Not_Processing_Registry_Create_Modify_as_Registry_SELF_PROTECTION_is_disabled_
push edx
mov dword [0xbf33f4], ebx
call fcn.00a78f30
push 0
push ebx
lea eax, [ebp - 0x2844]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x18
cmp dword [0xb8db0c], 0
je 0x8ca79c
cmp dword [ebp - 0x3a70], 1
jne 0x8ca79c
cmp dword [ebp - 0x3a6c], 1
jne 0x8ca75e
cmp dword [ebp - 0x3a50], 0
jne 0x8ca55a
cmp dword [ebp - 0x3a58], 0
je 0x8ca79c
push 0x3ff
lea ecx, [ebp - 0xa3b]
push 0
push ecx
mov byte [ebp - 0xa3c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea edx, [ebp - 0x2c43]
push 0
push edx
mov byte [ebp - 0x2c44], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x533]
push 0
push eax
mov byte [ebp - 0x534], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [ebp - 0x32b]
push 0
push ecx
mov byte [ebp - 0x32c], 0
call fcn.00a7ffb0
mov esi, dword [ebp - 0x3a60]
mov edi, dword [ebp - 0x3a5c]
add esp, 0xc
test esi, esi
jne 0x8ca464
xor ecx, ecx
mov edx, edi
call fcn.0097ceb0
mov dword [ebp - 0x3a60], eax
mov esi, eax
cmp esi, 4
jbe 0x8ca47b
push esi
lea ecx, [ebp - 0x2c44]
lea ebx, [ebp - 0x32c]
call fcn.0097b130
cmp edi, 4
jbe 0x8ca492
push edi
lea ecx, [ebp - 0xa3c]
lea ebx, [ebp - 0x534]
call fcn.0097b130
xor ebx, ebx
cmp dword [ebp - 0x3a90], ebx
jne 0x8ca50c
cmp byte [ebp - 0xa3c], bl
je 0x8ca4bc
push ebx
lea edx, [ebp - 0xa3c]
mov ecx, str.SoftwareMicroworldDeviceControlWhiteListApp
call fcn.009d7a00
add esp, 4
test eax, eax
je 0x8ca50c
push esi
lea edx, [ebp - 0x2c44]
push edx
push edi
lea eax, [ebp - 0xa3c]
push eax
lea ecx, [ebp - 0xc44]
push ecx
lea edx, [ebp - 0x2844]
push str.___REG__A__NOT_Blocking_Create_Modify_for__s._WHL_Process___s:_u___Parent___s:_u_
push edx
call fcn.00a78f30
add esp, 0x1c
push ebx
push 1
lea eax, [ebp - 0x2844]
push eax
push 0xb54ce8
call fcn.008808e0
mov dword [ebp - 0x3a78], ebx
mov dword [ebp - 0x3a74], ebx
jmp 0x8ca799
push esi
lea ecx, [ebp - 0x2c44]
push ecx
push edi
lea edx, [ebp - 0xa3c]
push edx
lea eax, [ebp - 0xc44]
push eax
lea ecx, [ebp - 0x2844]
push str.___REG__Blocking_Create_Modify_for__s._Process___s:_u___Parent___s:_u_
push ecx
call fcn.00a78f30
add esp, 0x1c
push ebx
push 1
lea edx, [ebp - 0x2844]
push edx
push 0xb54ce8
call fcn.008808e0
mov dword [ebp - 0x3a94], 0xa
jmp 0x8ca799
cmp dword [0xbc27fc], 0
je 0x8ca79c
push 0x3ff
lea eax, [ebp - 0xa3b]
push 0
push eax
mov byte [ebp - 0xa3c], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea ecx, [ebp - 0x1843]
push 0
push ecx
mov byte [ebp - 0x1844], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [ebp - 0x533]
push 0
push edx
mov byte [ebp - 0x534], 0
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea eax, [ebp - 0x32b]
push 0
push eax
mov byte [ebp - 0x32c], 0
call fcn.00a7ffb0
mov esi, dword [ebp - 0x3a60]
mov edi, dword [ebp - 0x3a5c]
add esp, 0xc
test esi, esi
jne 0x8ca5fc
xor ecx, ecx
mov edx, edi
call fcn.0097ceb0
mov dword [ebp - 0x3a60], eax
mov esi, eax
cmp esi, 4
jbe 0x8ca613
push esi
lea ecx, [ebp - 0x1844]
lea ebx, [ebp - 0x32c]
call fcn.0097b130
cmp edi, 4
jbe 0x8ca62a
push edi
lea ecx, [ebp - 0xa3c]
lea ebx, [ebp - 0x534]
call fcn.0097b130
lea ecx, [ebp - 0x364c]
push ecx
push edi
call fcn.009b7830
add esp, 8
cmp eax, 3
jne 0x8ca68b
cmp byte [ebp - 0xa3c], 0
je 0x8ca679
lea edx, [ebp - 0xa3c]
push edx
push edi
lea eax, [ebp - 0x2844]
push str._REG__Requestor_Pid___u:_s__is_authorized.
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x10
push 0
push ecx
lea edx, [ebp - 0x2844]
push edx
jmp 0x8ca78f
push edi
push str._REG__Requestor_Pid___u__is_authorized.
lea ecx, [ebp - 0x2844]
push ecx
jmp 0x8ca744
cmp byte [ebp - 0xa3c], 0
je 0x8ca700
cmp byte [ebp - 0x1844], 0
lea edx, [ebp - 0xa3c]
push edx
push edi
je 0x8ca6d6
lea eax, [ebp - 0x1844]
push eax
push esi
lea ecx, [ebp - 0x2844]
push str._REG__Parent___u:_s__of_Requestor_Pid___u:_s__is_authorized.
push ecx
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x18
push 0
push ecx
lea edx, [ebp - 0x2844]
push edx
jmp 0x8ca78f
push esi
lea eax, [ebp - 0x2844]
push str._REG__Parent___u__of_Requestor_Pid___u:_s__is_authorized.
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [ebp - 0x2844]
push edx
jmp 0x8ca78f
cmp byte [ebp - 0x1844], 0
push edi
je 0x8ca738
lea ecx, [ebp - 0x1844]
push ecx
push esi
lea edx, [ebp - 0x2844]
push str._REG__Parent___u:_s__of_Requestor_Pid___u__is_authorized.
push edx
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0x14
push 0
push ecx
lea edx, [ebp - 0x2844]
push edx
jmp 0x8ca78f
push str._REG__Requestor_Pid___u__is_authorized.
lea eax, [ebp - 0x2844]
push eax
call fcn.00a78f30
mov ecx, dword [0xbc27fc]
add esp, 0xc
push 0
push ecx
lea edx, [ebp - 0x2844]
push edx
jmp 0x8ca78f
cmp dword [0xbc27fc], 0
je 0x8ca79c
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2844]
push str._REG__Unsupported_Data_Type:__u
push ecx
call fcn.00a78f30
mov edx, dword [0xbc27fc]
add esp, 0xc
push 0
push edx
lea eax, [ebp - 0x2844]
push eax
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [ebp - 0x3a54]
test eax, eax
je 0x8ca7af
push eax
call fcn.00a78fec
add esp, 4
mov eax, dword [ebp - 0x3a68]
test eax, eax
je 0x8ca7c2
push eax
call fcn.00a78fec
add esp, 4
cmp dword [ebp - 0x3a74], 0
je 0x8ca8ea
cmp byte [ebp - 0x1444], 0
je 0x8ca878
push 0x7ff
lea ecx, [ebp - 0x3a4b]
push 0
push ecx
mov byte [ebp - 0x3a4c], 0
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x1444]
push 0x5c
push edx
call fcn.00a7aa50
add esp, 8
test eax, eax
je 0x8ca811
inc eax
jmp 0x8ca817
lea eax, [ebp - 0x1444]
cmp byte [eax], 0
je 0x8ca878
push eax
lea eax, [ebp - 0x3a4c]
push str._REG__Blocking__s
push eax
call fcn.00a78f30
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push 0xaa1543
mov edx, str.BlockNotify
mov ecx, 0xaa154c
call fcn.00958d30
add esp, 0xc
cmp byte [ebp - 0x22c], 0x30
je 0x8ca878
lea edx, [ebp - 0x3a4c]
push edx
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorRegMsg
mov edx, str.Message
mov ecx, 0x80000002
call fcn.0094bd00
mov eax, dword [ebp - 0x3a5c]
push eax
push 0
push 0x8c5d00
call fcn.00a791b2
add esp, 0xc
mov esi, eax
push str.CBD_7c
xor ebx, ebx
call fcn.0085df20
add esp, 4
cmp esi, 0xffffffff
jne 0x8ca959
push 0x103
lea ecx, [ebp - 0x433]
push ebx
push ecx
mov byte [ebp - 0x434], bl
call fcn.00a7ffb0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x434]
push str.Error:_beginthread_w__fails_with_error__d
push edx
call fcn.00a78f30
add esp, 0xc
push ebx
push 1
lea eax, [ebp - 0x434]
push eax
jmp 0x8ca94c
cmp dword [ebp - 0x3a78], 0
je 0x8ca959
mov esi, dword [ebp - 0x3a5c]
push esi
mov ecx, 1
call fcn.0098c0a0
add esp, 4
push esi
test eax, eax
je 0x8ca92d
lea ecx, [ebp - 0x2844]
push str._REG__Process_Resume_1___d_
push ecx
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x2844]
push edx
jmp 0x8ca94c
lea eax, [ebp - 0x2844]
push str._REG__Process_Resume_failed_1___d_
push eax
call fcn.00a78f30
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x2844]
push ecx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x3a94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret