Function at 0x10004fb4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___HidServ_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___HTTPFilter_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___COMSysApp_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___ClipSrv_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___CiSvc_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Browser_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___BITS_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___AudioSrv_start_AUTO
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___AppMgmt_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___ALG_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Alerter_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___RpcLocator_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___RemoteRegistry_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___RemoteAccess_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___RemoteRegistry_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___RemoteAccess_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___RDSessMgr_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___RasMan_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___RasAuto_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___ProtectedStorage_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___PolicyAgent_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___PlugPlay_start_AUTO
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Ose_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___helpsvc_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Nvsvc_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___FastUserSwitchingCompatibility_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___EventSystem_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Eventlog_start_AUTO
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___ERSvc_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Dnscache_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___dmserver_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___dmadmin_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Dhcp_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___DcomLaunch_start_AUTO
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___CryptSvc_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___VSS_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___UPS_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___upnphost_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___UMWdf_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___TrkWks_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___TlntSvr_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Themes_start_AUTO
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___TermService_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___TapiSrv_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___SysmonLog_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Swprv_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___NtmsSvc_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___NtLmSsp_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Nla_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sfc__purgecache
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_reg_add_HKLMSYSTEMCurrentControlSetControlLsa__v_restrictanonymous__t_REG_DWORD__d_1__f
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_reg_add_HKLMSYSTEMCurrentControlSetControlFileSystem__v_ConfigFileAllocSize__t_REG_DWORD__d_500__f
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_reg_add_HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer__v_AlwaysUnloadDLL__t_REG_DWORD__d_1__f
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_reg_add_HKU.DEFAULTSoftwareMicrosoftWindowsCurrentVersionExplorer__v_Link__t_REG_BINARY__d_00000000__f
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_regsvr32__u__s_zipfldr.dll
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_reg_delete_HKCRSoftwareMicrosoftWindowsCurrentVersionRun__va__f
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_reg_delete_HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun__va__f
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_reg_add_HKLMSYSTEMCurrentControlSetServicesNetBTParameters__v_SMBDeviceEnabled__t_REG_DWORD__d_0__f
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___MSDTC_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__userprofile_Local_SettingsTemp.
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_reg_add_HKLMSOFTWAREMicrosoftOle__v_EnableDCOM__d_N__f
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__userprofile_Local_SettingsTemporary_Internet_Files.
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__q__userprofile__recent.
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_rd__s__q__windir__temp__md__windir__temp
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__windir_prefetch.
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__systemdrive__recycled.
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__userprofile_cookies.
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__windir_.bak
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__systemdrive_.old
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__systemdrive_.gid
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__systemdrive_.chk
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__systemdrive_.log
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__systemdrive_._mp
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__f__s__q__systemdrive_.tmp
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___xmlprov_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___wscsvc_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___WZCSVC_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___wuauserv_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___WmiApSrv_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Wmi_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___WmdmPmSN_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___winmgmt_start_AUTO
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___WebClient_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___W32Time_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Stisvc_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___SSDPSRV_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___srservice_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Spooler_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Spooler_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___ShellHWDetection_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___SharedAccess_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___SENS_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___seclogon_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Schedule_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___SamSs_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___RpcSs_start_AUTO
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Netman_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Netlogon_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___NetDDEdsdm_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___NetDDE_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___MSIServer_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___MSDTC_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___mnmsrvc_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___Messenger_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___LmHosts_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___lanmanworkstation_start_AUTO
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___lanmanserver_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___ImapiService_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___HTTPFilter_start_DEMAND
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_sc_config___HidServ_start_DISABLED
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del__userprofile__
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del_C:Documents_and_SettingsDefault_User_
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_del_C:Documents_and_SettingsAll_Users_
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_reg_delete_HKLMSOFTWAREMicrosoftShared_ToolsMSConfig_startupreg__f
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push reloc.OLEAUT32.dll_SysReAllocString
push 0
push 1
push 0x80000301
push 0
push 1
push reloc.WS2_32.dll_connect
push 0
push str._comspec___c_reg_add_HKLMSOFTWAREMicrosoftRpc__v_DCOM_Protocols__t_REG_MULTI_SZ__d_ncacn_spx0ncacn_nb_nb0ncacn_nb_ipx0__f
push reloc.WS2_32.dll_connect
push 0
push 0x1009be4c
push 0x10030
push 0
push dword [0x1027bc7c]
push 5
mov ebx, 0x1000cb50
call fcn.1000ab48
add esp, 0x40
push 0x10030
push 0
push dword [0x1027bc7c]
push 1
mov ebx, 0x1000ccc0
call fcn.1000ab48
add esp, 0x10
mov ebx, 6
call fcn.10001b45
push 0x80000301
push 0
push 0
push reloc.WS2_32.dll_connect
push 0
push 0x1009d579
push 4
mov ebx, 0x1000c4e0
call fcn.1000ab48
add esp, 0x34
mov esp, ebp
pop ebp
ret