Function at 0x14004b820
Capabilities:
Create process on windows
Disable system features via registry on windows
Persist via windows service
Schedule task via schtasks
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Starting_windows_optmization...
call fcn.14004eef0
lea rdx, [0x14004f0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor ebx, ebx
lea r9, str.reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionSettingSync___v__SyncPolicy___t_REG_DWORD__d_00000005__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
lea rdx, str.runas
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsPersonalization___v__Enabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsBrowserSettings___v__Enabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsCredentials___v__Enabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsAccessibility___v__Enabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsWindows___v__Enabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdate___v__DoNotConnectToWindowsUpdateInternetLocations___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__AllowCortana___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__AllowCloudSearch___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__AllowCortanaAboveLock___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg_Add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__AllowSearchToUseLocation___t_REG_DWORD__d__0___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__ConnectedSearchUseWeb___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__ConnectedSearchUseWebOverMeteredConnections___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__DisableWebSearch___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Powershell__Command__Get_appxpackage__allusers_Microsoft.549981C3F5F10__Remove_AppxPackage_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v__ShowFrequent___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v__ShowRecent___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v__TelemetrySalt___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoRecentDocsHistory___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun___v__Discord___t_REG_BINARY__d__0300000066AF9C7C5A46D901___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun___v__Spotify___t_REG_BINARY__d__0300000070E93D7B5A46D901___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun___v__Steam___t_REG_BINARY__d__03000000E7766B83316FD901___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg_add__HKLMSoftwarePoliciesMicrosoftWindowsMaps___v__AutoDownloadAndUpdateMapData___t_REG_DWORD__d__0___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
xor ecx, ecx
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSoftwarePoliciesMicrosoftWindowsMaps___v__AllowUntriggeredNetworkTrafficOnSettingsPage___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSoftwarePoliciesMicrosoftWindowsSettingSync___v__DisableSettingSync___t_REG_DWORD__d__2___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSoftwarePoliciesMicrosoftWindowsSettingSync___v__DisableSettingSyncUserOverride___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSoftwarePoliciesMicrosoftWindowsSettingSync___v__DisableSyncOnPaidNetwork___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSoftwarePoliciesMicrosoftFindMyDevice___v__AllowFindMyDevice___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSoftwarePoliciesMicrosoftFindMyDevice___v__LocationSyncEnabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSoftwarePoliciesMicrosoftWindowsWindows_Search___v__ConnectedSearchUseWeb___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSoftwarePoliciesMicrosoftWindowsWindows_Search___v__DisableWebSearch___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSoftwareMicrosoftWindowsCurrentVersionSearch___v__BingSearchEnabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSystemCurrentControlSetControlRemote_Assistance___v__fAllowFullControl___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg_add__HKLMSystemCurrentControlSetControlRemote_Assistance___v__fAllowToGetHelp___t_REG_DWORD__d__0___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKLMSystemCurrentControlSetControlRemote_Assistance___v__fEnableChatControl___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionDevice_Metadata___v__PreventDeviceMetadataFromNetwork___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagercurrentdeviceUpdate___v__ExcludeWUDriversInQualityUpdate___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagerdefaultUpdate___v__ExcludeWUDriversInQualityUpdate___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagerdefaultUpdateExcludeWUDriversInQualityUpdate___v__value___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsUpdateUXSettings___v__ExcludeWUDriversInQualityUpdate___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdate___v__ExcludeWUDriversInQualityUpdate___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionDriverSearching___v__SearchOrderConfig___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__PromptOnSecureDesktop___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__ConsentPromptBehaviorAdmin___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableAutomaticRestartSignOn___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionScheduleMaintenance___v__MaintenanceDisabled___t_REG_DWORD__d__1___f
xor ecx, ecx
lea r8, str.cmd.exe
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsCloudContent___v__DisableWindowsConsumerFeatures___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlSession_ManagerPower___v__HiberbootEnabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetControlPowerPowerThrottling___v__PowerThrottlingOff___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSYSTEMCurrentControlSetServicesAFDParameters___v__FastSendDatagramThreshold___t_REG_DWORD__d__409600___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize___v__EnableTransparency___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_LOCAL_MACHINESOFTWAREMicrosoftPolicyManagerdefaultApplicationManagementAllowGameDVR___v__value___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsGameDVR___v__AllowGameDVR___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSystemGameConfigStore___v__GameDVR_Enabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionGameDVR___v__AppCaptureEnabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftGameBar___v__AllowAutoGameMode___t_REG_DWORD__d_00000001__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftGameBar___v__AutoGameModeEnabled___t_REG_DWORD__d_00000001__f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlGraphicsDrivers___v__HwSchMode___t_REG_DWORD__d_00000002__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftDirectXUserGpuPreferences___v__DirectXUserGlobalSettings___t_REG_SZ__d__VRROptimizeEnable0____f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERControl_PanelAccessibilityMouseKeys___v__Flags___t_REG_SZ__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERControl_PanelAccessibilityStickyKeys___v__Flags___t_REG_SZ__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERControl_PanelAccessibilityKeyboard_Response___v__Flags___t_REG_SZ__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERControl_PanelAccessibilityToggleKeys___v__Flags___t_REG_SZ__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionAdvertisingInfo___v__Enabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERControl_PanelInternationalUser_Profile___v__HttpAcceptLanguageOptOut___t_REG_DWORD__d_00000001__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced___v__Start_TrackProgs___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_338393Enabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_353694Enabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_353696Enabled___t_REG_DWORD__d_00000000__f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
xor ecx, ecx
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftSpeech_OneCoreSettingsOnlineSpeechPrivacy___v__HasAccepted___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftPersonalizationSettings___v__AcceptedPrivacyPolicy___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftInputPersonalization___v__RestrictImplicitInkCollection___t_REG_DWORD__d_00000001__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftInputPersonalization___v__RestrictImplicitTextCollection___t_REG_DWORD__d_00000001__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftInputPersonalizationTrainedDataStore___v__HarvestContacts___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrack___v__ShowedToastAtLevel___t_REG_DWORD__d_00000001__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsDataCollection___v__AllowTelemetry___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionPrivacy___v__TailoredExperiencesWithDiagnosticDataEnabled___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionDiagnosticsDiagTrackEventTranscriptKey___v__EnableEventTranscript___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftSiufRules___v__NumberOfSIUFInPeriod___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftSiufRules___v__PeriodInNanoSeconds___t_REG_SZ__d______f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg_add__HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsSystem___v__PublishUserActivities___t_REG_DWORD__d_00000000__f
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_LOCAL_MACHINESOFTWAREPoliciesMicrosoftWindowsSystem___v__UploadUserActivities___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoreuserNotificationListener___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocation___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStore_appDiagnostics___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoreuserAccountInformation___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionBackgroundAccessApplications___v__GlobalUserDisabled___t_REG_DWORD__d_00000001__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_add__HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionSearch___v__BackgroundAppGlobalToggle___t_REG_DWORD__d_00000000__f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStore_activity___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStore_appDiagnostics___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStore_appointments___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStore_bluetoothSync___v__Value___t_REG_SZ__d__Deny___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStore_broadFileSystemAccess___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorecellularData___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorecellularDataMicrosoft.Win32WebViewHost_cw5n1h2txyewy___v__Value___t_REG_SZ__d__Allow___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorechat___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorecontacts___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoredocumentsLibrary___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoreemail___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoregazeInput___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocation___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorelocationMicrosoft.Win32WebViewHost_cw5n1h2txyewy___v__Value___t_REG_SZ__d__Prompt___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorephoneCall___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorephoneCallHistory___v__Value___t_REG_SZ__d__Deny___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
xor ecx, ecx
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorepicturesLibrary___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStore_radios___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoreuserAccountInformation___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoreuserAccountInformationMicrosoft.AccountsControl_cw5n1h2txyewy___v__Value___t_REG_SZ__d__Prompt___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoreuserDataTasks___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoreuserNotificationListener___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStore_videosLibrary___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcam___v__Value___t_REG_SZ__d__Allow___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg_Add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStorewebcamMicrosoft.Win32WebViewHost_cw5n1h2txyewy___v__Value___t_REG_SZ__d__Allow___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramConsolidator_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.schtasks__change__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramConsolidator___disable
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramBthSQM_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__change__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramBthSQM___disable
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramKernelCeipTask_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__change__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramKernelCeipTask___disable
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramUsbCeip_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__change__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramUsbCeip___disable
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramUploader_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__change__tn__MicrosoftWindowsCustomer_Experience_Improvement_ProgramUploader___disable
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsApplication_ExperienceMicrosoft_Compatibility_Appraiser_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__change__tn__MicrosoftWindowsApplication_ExperienceMicrosoft_Compatibility_Appraiser___disable
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsApplication_ExperienceProgramDataUpdater_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r9, str.schtasks__change__tn__MicrosoftWindowsApplication_ExperienceProgramDataUpdater___disable
xor ecx, ecx
lea r8, str.cmd.exe
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsApplication_ExperienceStartupAppTask_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsShellFamilySafetyMonitor_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__change__tn__MicrosoftWindowsShellFamilySafetyMonitor___disable
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsShellFamilySafetyRefresh_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__change__tn__MicrosoftWindowsShellFamilySafetyRefresh___disable
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsShellFamilySafetyUpload_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__change__tn__MicrosoftWindowsShellFamilySafetyUpload___disable
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.schtasks__end__tn__MicrosoftWindowsMaintenanceWinSAT_
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionScheduleMaintenance___v__MaintenanceDisabled___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionThemesPersonalize___v__EnableTransparency___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionPushNotifications___v__ToastEnabled___t_REG_DWORD__d__0___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettings___v__NOC_GLOBAL_SETTING_ALLOW_NOTIFICATION_SOUND___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettings___v__NOC_GLOBAL_SETTING_ALLOW_CRITICAL_TOASTS_ABOVE_LOCK___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsQuietHours___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingswindows.immersivecontrolpanel_cw5n1h2txyewy_microsoft.windows.immersivecontrolpanel___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.AutoPlay___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.LowDisk___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.Print.Notification___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.WiFiNetworkManager___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREPoliciesMicrosoftWindowsExplorer___v__DisableNotificationCenter___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Feeds___v__EnableFeeds___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoft___v__AllowNewsAndInterests___t_REG_DWORD__d__0___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
xor ecx, ecx
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsSystem___v__EnableActivityFeed___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUControl_PanelInternationalUser_Profile___v__HttpAcceptLanguageOptOut___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionAdvertisingInfo___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSoftwarePoliciesMicrosoftWindowsSystem___v__EnableActivityFeed___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__DisallowShaking___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__EnableBalloonTips___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced___v__ShowSyncProviderNotifications___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionCapabilityAccessManagerConsentStoreuserNotificationListener___v__Value___t_REG_SZ__d__Deny___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSoftwarePoliciesMicrosoftWindowsAdvertisingInfo___v__DisabledByGroupPolicy___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftGameBar___v__AllowAutoGameMode___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftGameBar___v__AutoGameModeEnabled___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagercurrentdeviceSystem___v__AllowExperimentation___t_REG_DWORD__d__0___f
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftPolicyManagerdefaultSystemAllowExperimentation___v__value___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsAccessibility___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsAppSync___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsBrowserSettings___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsCredentials___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsDesktopTheme___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsLanguage___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsPackageState___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsPersonalization___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsStartLayout___v__Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSettingSyncGroupsWindows___v__Enabled___t_REG_DWORD__d__0___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Error_Reporting___v__Disabled___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Error_Reporting___v__DoReport___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Error_Reporting___v__LoggingDisabled___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftPCHealthErrorReporting___v__DoReport___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKLMSOFTWAREMicrosoftWindowsWindows_Error_Reporting___v__Disabled___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SilentInstalledAppsEnabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SystemPaneSuggestionsEnabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced___v__ShowSyncProviderNotifications___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SoftLandingEnabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__RotatingLockScreenEnabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__RotatingLockScreenOverlayEnabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rsp + 0x28], ebx
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_310093Enabled___t_REG_DWORD__d__0___f
mov qword [rsp + 0x20], rbx
lea r8, str.cmd.exe
xor ecx, ecx
lea rdx, str.runas
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_314563Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_338387Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_338388Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_338389Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_338389Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_338393Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager___v__SubscribedContent_353698Enabled___t_REG_DWORD__d__0___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced___v__DisallowShaking___t_REG_DWORD__d__1___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r9, str.Reg.exe_add__HKCUControl_PanelDesktop___v__JPEGImportQuality___t_REG_DWORD__d__256___f
mov dword [rsp + 0x28], ebx
lea r8, str.cmd.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Windows_optimization_completed.
call fcn.14004eef0
lea rdx, [0x14004f0d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rsp + 0x40]
call fcn.140043230
mov rax, qword [rsp + 0x40]
movabs rcx, 0x7fffffffc46535ff
cmp rax, rcx
jge 0x14004d573
add rax, 0x3b9aca00
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14004f210
add rsp, 0x30
pop rbx
ret
movabs rax, 0x7fffffffffffffff
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14004f210
add rsp, 0x30
pop rbx
ret
jmp 0x14004b820