Function at 0x140005620
Capabilities:
Disable system features via registry on windows
Persist via contextmenuhandlers registry key
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov rax, qword [0x14004e040]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [rsp + 0x58]
or edx, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea rdx, str.e_95m
lea rcx, [0x14004f6f0]
call fcn.140007130
mov rcx, rax
lea rdx, str._n_n_n_n_n____________________________________________________n_________________________________________________n_______________________________________________n___________________________________________________n_________________________________________________n________________________________________n_n_n
call fcn.140007130
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov r8d, 0x2d
lea rdx, str._n_____Cleaning_and_boosting_your_computer...
lea rcx, [rsp + 0x30]
call fcn.140007e20
nop
lea rcx, [rsp + 0x30]
call fcn.140003d30
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140005715
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005710
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006018
call fcn.1400138d0
call fcn.140004ab0
lea rcx, str.powercfg.exe__setactive_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c
call fcn.14001c5c4
lea rax, str.SCHTASKS__Change__TN__NvTmMon_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8___Disable
mov qword [rsp + 0x60], rax
lea rax, str.SCHTASKS__Change__TN__NvTmRep_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8___Disable
mov qword [rsp + 0x68], rax
lea rax, str.SCHTASKS__Change__TN__NvTmRepOnLogon_B2FE1952_0186_46C3_BAEC_A80AA35AC5B8___Disable
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
nop
mov rcx, qword [rbx]
call fcn.14001c5c4
test eax, eax
jne 0x140005777
lea rdx, str.Task_disabled_successfully
lea rcx, [0x14004f6f0]
call fcn.140007130
mov rcx, rax
call fcn.1400073e0
add rbx, 8
lea rax, [rsp + 0x78]
cmp rbx, rax
jne 0x140005750
lea rax, str.REG_ADD__HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search___v__AllowCortana___t_REG_DWORD__d_0__f
mov qword [rbp - 0x80], rax
lea rax, str.REG_ADD__HKLMSOFTWAREPoliciesMicrosoftWindowsDataCollection___v__AllowTelemetry___t_REG_DWORD__d_0__f
mov qword [rbp - 0x78], rax
lea rax, str.REG_ADD__HKLMSOFTWAREPoliciesMicrosoftWindowsAppCompat___v__DisableUAR___t_REG_DWORD__d_1__f
mov qword [rbp - 0x70], rax
lea rax, str.REG_ADD__HKLMSOFTWAREPoliciesMicrosoftWindowsAppCompat___v__DisableInventory___t_REG_DWORD__d_1__f
mov qword [rbp - 0x68], rax
lea rax, str.REG_ADD__HKLMSOFTWAREPoliciesMicrosoftWindowsAppCompat___v__AITEnable___t_REG_DWORD__d_0__f
mov qword [rbp - 0x60], rax
lea rax, str.REG_ADD__HKLMSOFTWAREPoliciesMicrosoftSQMClientWindows___v__CEIPEnable___t_REG_DWORD__d_0__f
mov qword [rbp - 0x58], rax
lea rax, str.REG_ADD__HKLMSOFTWAREPoliciesMicrosoftSQMClient___v__CorporateSQMURL___t_REG_SZ__d_127.0.0.1__f
mov qword [rbp - 0x50], rax
lea rax, str.REG_ADD__HKLMSOFTWAREPoliciesMicrosoftMRT___v_DontOfferThroughWUAU__t_REG_DWORD__d_1__f
mov qword [rbp - 0x48], rax
lea rax, str.REG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannelsMicrosoft_Windows_Application_ExperienceSteps_Recorder___v__Enabled___t_REG_DWORD__d_0__f
mov qword [rbp - 0x40], rax
lea rax, str.REG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannelsMicrosoft_Windows_Application_ExperienceProgram_Telemetry___v__Enabled___t_REG_DWORD__d_0__f
mov qword [rbp - 0x38], rax
lea rax, str.REG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannelsMicrosoft_Windows_Application_ExperienceProgram_Inventory___v__Enabled___t_REG_DWORD__d_0__f
mov qword [rbp - 0x30], rax
lea rax, str.REG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannelsMicrosoft_Windows_Application_ExperienceProgram_Compatibility_Troubleshooter___v__Enabled___t_REG_DWORD__d_0__f
mov qword [rbp - 0x28], rax
lea rax, str.REG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannelsMicrosoft_Windows_Application_ExperienceProgram_Compatibility_AssistantTrace___v__Enabled___t_REG_DWORD__d_0__f
mov qword [rbp - 0x20], rax
lea rax, str.REG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannelsMicrosoft_Windows_Application_ExperienceProgram_Compatibility_AssistantCompatibility_Infrastructure_Debug___v__Enabled___t_REG_DWORD__d_0__f
mov qword [rbp - 0x18], rax
lea rax, str.REG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannelsMicrosoft_Windows_Application_ExperienceProgram_Compatibility_AssistantAnalytic___v__Enabled___t_REG_DWORD__d_0__f
mov qword [rbp - 0x10], rax
lea rax, str.REG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionWINEVTChannelsMicrosoft_Windows_Application_ExperienceProgram_Compatibility_Assistant___v__Enabled___t_REG_DWORD__d_0__f
mov qword [rbp - 8], rax
lea rax, str.REG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesDataCollection___v__AllowTelemetry___t_REG_DWORD__d_0__f
mov qword [rbp], rax
lea rax, str.REG_ADD__HKLMSOFTWAREMicrosoftWindowsCurrentVersionDevice_Metadata___v_PreventDeviceMetadataFromNetwork__t_REG_DWORD__d_1__f
mov qword [rbp + 8], rax
lea rax, str.REG_ADD__HKLMCOMPONENTSDerivedDataComponents_amd64_microsoft_windows_c..lemetry.lib.cortana_31bf3856ad364e35_10.0.10240.16384_none_40ba2ec3d03bceb0___v__f_proactive_telemetry_inter_58073761d33f144b___t_REG_DWORD__d_0__f
mov qword [rbp + 0x10], rax
lea rax, str.REG_ADD__HKLMCOMPONENTSDerivedDataComponents_amd64_microsoft_windows_c..lemetry.lib.cortana_31bf3856ad364e35_10.0.10240.16384_none_40ba2ec3d03bceb0___v__f_proactive_telemetry_event_8ac43a41e5030538___t_REG_DWORD__d_0__f
mov qword [rbp + 0x18], rax
lea rax, str.REG_ADD__HKLMCOMPONENTSDerivedDataComponents_amd64_microsoft_windows_c..lemetry.lib.cortana_31bf3856ad364e35_10.0.10240.16384_none_40ba2ec3d03bceb0___v__f_proactive_telemetry.js___t_REG_DWORD__d_0__f
mov qword [rbp + 0x20], rax
lea rax, str.REG_ADD__HKLMCOMPONENTSDerivedDataComponents_amd64_microsoft_windows_c..lemetry.lib.cortana_31bf3856ad364e35_10.0.10240.16384_none_40ba2ec3d03bceb0___v__f_dss_winrt_telemetry.js___t_REG_DWORD__d_0__f
mov qword [rbp + 0x28], rax
lea rax, str.REG_ADD__HKCUSOFTWAREPoliciesMicrosoftInternet_ExplorerMain___v__RunOnceComplete___t_REG_DWORD__d_1__f
mov qword [rbp + 0x30], rax
lea rax, str.REG_ADD__HKCUSOFTWAREMicrosoftWindowsCurrentVersionSearch___v__CortanaEnabled___t_REG_DWORD__d_0__f
mov qword [rbp + 0x38], rax
lea rax, str.SC_config__CscService__start_disabled
mov qword [rbp + 0x40], rax
lea rax, str.SC_config__MapsBroker__start__disabled
mov qword [rbp + 0x48], rax
lea rax, str.SC_config__CertPropSvc__start__disabled
mov qword [rbp + 0x50], rax
lea rax, str.SC_config__wscsvc__start__demand
mov qword [rbp + 0x58], rax
lea rax, str.SC_config__SystemEventsBroker__start__demand
mov qword [rbp + 0x60], rax
lea rax, str.SC_config__tiledatamodelsvc__start__demand
mov qword [rbp + 0x68], rax
lea rax, str.SC_config__WerSvc__start__demand
mov qword [rbp + 0x70], rax
lea rax, str.SC_delete_DiagTrack
mov qword [rbp + 0x78], rax
lea rax, str.SC_delete__diagnosticshub.standardcollector.service_
mov qword [rbp + 0x80], rax
lea rax, str.SC_delete__dmwappushservice_
mov qword [rbp + 0x88], rax
lea rax, str.SC_delete__DPS_
mov qword [rbp + 0x90], rax
lea rax, str.SC_delete__RemoteRegistry_
mov qword [rbp + 0x98], rax
lea rax, str.SC_delete__TrkWks_
mov qword [rbp + 0xa0], rax
lea rax, str.SC_delete__WMPNetworkSvc_
mov qword [rbp + 0xa8], rax
lea rax, str.SC_delete__WSearch_
mov qword [rbp + 0xb0], rax
lea rax, str.SC_delete__SysMain_
mov qword [rbp + 0xb8], rax
lea rax, str.REG_ADD__HKLMSOFTWAREPoliciesMicrosoftWindowsOneDrive___v_DisableFileSyncNGSC__t_REG_DWORD__d_1__f
mov qword [rbp + 0xc0], rax
lea rax, str.TASKKILL__f__im_OneDrive.exe
mov qword [rbp + 0xc8], rax
lea rax, str._SystemRoot_System32OneDriveSetup.exe__uninstall
mov qword [rbp + 0xd0], rax
lea rax, str._SystemRoot_SysWOW64OneDriveSetup.exe__uninstall
mov qword [rbp + 0xd8], rax
lea rax, str.rd___UserProfile_OneDrive___Q__S
mov qword [rbp + 0xe0], rax
lea rax, str.rd___LocalAppData_MicrosoftOneDrive___Q__S
mov qword [rbp + 0xe8], rax
lea rax, str.rd___ProgramData_Microsoft_OneDrive___Q__S
mov qword [rbp + 0xf0], rax
lea rax, str.rd__C:OneDriveTemp___Q__S
mov qword [rbp + 0xf8], rax
lea rax, str.REG_Delete__HKEY_CLASSES_ROOTCLSID018D5C66_4533_4307_9B53_224DE2ED1FE6___f
mov qword [rbp + 0x100], rax
lea rax, str.REG_Delete__HKEY_CLASSES_ROOTWow6432NodeCLSID018D5C66_4533_4307_9B53_224DE2ED1FE6___f
mov qword [rbp + 0x108], rax
lea rax, str.REG_Delete__HKCUSOFTWAREClassesCLSID018D5C66_4533_4307_9B53_224DE2ED1FE6___f__reg:32
mov qword [rbp + 0x110], rax
lea rax, str.REG_Delete__HKCUSOFTWAREClassesCLSID018D5C66_4533_4307_9B53_224DE2ED1FE6___f__reg:64
mov qword [rbp + 0x118], rax
lea rax, str.REG_Delete__HKLMSOFTWAREClassesCLSID018D5C66_4533_4307_9B53_224DE2ED1FE6___f__reg:32
mov qword [rbp + 0x120], rax
lea rax, str.REG_Delete__HKLMSOFTWAREClassesCLSID018D5C66_4533_4307_9B53_224DE2ED1FE6___f__reg:64
mov qword [rbp + 0x128], rax
lea rax, str.REG_Delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerFolderDescriptionsA52BBA46_E9E1_435f_B3D9_28DAA648C0F6___f
mov qword [rbp + 0x130], rax
lea rax, str.REG_Delete__HKLMSOFTWAREPoliciesMicrosoftWindowsOneDrive___v__DisableFileSyncNGSC___f
mov qword [rbp + 0x138], rax
lea rax, str.REG_Delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerFolderDescriptions339719B5_8C47_4894_94C2_D8F77ADD44A6___f
mov qword [rbp + 0x140], rax
lea rax, str.REG_Delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerFolderDescriptions767E6811_49CB_4273_87C2_20F355E1085B___f
mov qword [rbp + 0x148], rax
lea rax, str.REG_Delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerFolderDescriptionsC3F2459E_80D6_45DC_BFEF_1F769F2BE730___f
mov qword [rbp + 0x150], rax
lea rax, str.REG_Delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorerFolderDescriptions24D89E24_2F19_4534_9DDE_6A6671FBB8FE___f
mov qword [rbp + 0x158], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.3DBuilder__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x160], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.BingFinance__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x168], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.BingNews__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x170], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.Getstarted__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x178], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.MicrosoftOfficeHub__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x180], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.MicrosoftSolitaireCollection__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x188], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.Office.OneNote__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x190], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.SkypeApp__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x198], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.WindowsPhone__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x1a0], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.XboxApp__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x1a8], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.ZuneMusic__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x1b0], rax
lea rax, str.PowerShell__Command__Get_AppxProvisionedPackage__Online__Where_Object_DisplayName__eq_Microsoft.ZuneVideo__Remove_AppxProvisionedPackage__Online_
mov qword [rbp + 0x1b8], rax
lea rax, str.PowerShell__Command__Get_AppxPackage_Microsoft__Remove_AppxPackage_
mov qword [rbp + 0x1c0], rax
lea rax, str.PowerShell__Command__Get_AppXProvisionedPackage__online__Remove_AppxProvisionedPackage__online_
mov qword [rbp + 0x1c8], rax
lea rax, str.PowerShell__Command__Get_AppXPackage__Remove_AppxPackage_
mov qword [rbp + 0x1d0], rax
lea rax, str.PowerShell__Command__Get_AppXPackage__User__Remove_AppxPackage_
mov qword [rbp + 0x1d8], rax
lea rax, str.PowerShell__Command__Get_AppxPackage__AllUsers__Remove_AppxPackage_
mov qword [rbp + 0x1e0], rax
lea rax, str.REG_ADD__HKCUControl_PanelAccessibilityStickyKeys___v__Flags___t_REG_SZ__d__506___f
mov qword [rbp + 0x1e8], rax
lea rax, str.REG_ADD__HKCUControl_PanelAccessibilityKeyboard_Response____v__Flags____t_REG_SZ___d__122____f
mov qword [rbp + 0x1f0], rax
lea rbx, [rbp - 0x80]
nop dword [rax + rax]
mov rdi, qword [rbx]
mov rcx, rdi
call fcn.14001c5c4
test eax, eax
jne 0x140005bb5
lea rdx, str.Command_executed_successfully:
lea rcx, [0x14004f6f0]
call fcn.140007130
mov rdx, rdi
mov rcx, rax
call fcn.140007130
mov rcx, rax
call fcn.1400073e0
add rbx, 8
lea rax, [rbp + 0x1f8]
cmp rbx, rax
jne 0x140005b80
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameComputerName__v_ComputerName__t_REG_SZ__d_MEDUSA__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetControlComputerNameActiveComputerName__v_ComputerName__t_REG_SZ__d_MEDUSA__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v_Hostname__t_REG_SZ__d_MEDUSA__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKLMSYSTEMCurrentControlSetServicesTcpipParameters__v__NV_Hostname___t_REG_SZ__d_MEDUSA__f
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.XboxIdentityProvider__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.XboxSpeechToTextOverlay__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.XboxGamingOverlay__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.XboxGameOverlay__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.XboxApp__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.Xbox.TCUI__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.GamingApp__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.BingWeather__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.GetHelp__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.Getstarted__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.Microsoft3DViewer__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.MicrosoftOfficeHub__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.MicrosoftSolitaireCollection__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.MixedReality.Portal__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.MSPaint__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.Office.OneNote__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.People__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.Wallet__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.WindowsFeedbackHub__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.WindowsMaps__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.WindowsSoundRecorder__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.YourPhone__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.ZuneMusic__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.ZuneVideo__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.SkypeApp__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_microsoft.windowscommunicationsapps__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.WindowsCamera__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.OneConnect__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.Messaging__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.BingNews__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.Todos__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_MicrosoftTeams__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.PowerAutomateDesktop__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Clipchamp.Clipchamp__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_MicrosoftCorporationII.MicrosoftFamily__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_MicrosoftCorporationII.QuickAssist__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.PowerShell__Command__Get_AppxPackage__AllUsers_Microsoft.549981C3F5F10__Remove_AppxPackage_
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKLMSOFTWAREPoliciesMicrosoftWindowsWindows_Search__v_AllowCortana__t_REG_DWORD__d_0__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKLMSOFTWAREPoliciesMicrosoftWindowsDataCollection__v_AllowTelemetry__t_REG_DWORD__d_0__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKCUSoftwareMicrosoftWindowsCurrentVersionContentDeliveryManager__v_SilentInstalledAppsEnabled__t_REG_DWORD__d_0__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKCUSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager__v_SystemPaneSuggestionsEnabled__t_REG_DWORD__d_0__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKLMSOFTWAREPoliciesMicrosoftWindowsLocationAndSensors__v_DisableSensors__t_REG_DWORD__d_1__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKCUSoftwareMicrosoftWindowsWindows_Error_Reporting__v_Disabled__t_REG_DWORD__d_1__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKCUSOFTWAREPoliciesMicrosoftEdgeNewTabPage__v_ShowPreviews__t_REG_DWORD__d_0__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKCUSOFTWAREPoliciesMicrosoftEdge__v_ShowIconsInTabs__t_REG_DWORD__d_0__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKLMSOFTWAREMicrosoftWindowsCurrentVersionContentDeliveryManager__v_SubscribedContent_338387Enabled__t_REG_DWORD__d_0__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKCR_shellexContextMenuHandlers__v___d___f
call fcn.14001c5c4
lea rcx, str.powershell__Command__Get_AppxPackage_xbox__Remove_AppxPackage__Confirm:_false_
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKCUSoftwareMicrosoftGameBar__v_AllowAutoGameMode__t_REG_DWORD__d_0__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKCUSoftwareMicrosoftGameBar__v_UseNexusForGameBarEnabled__t_REG_DWORD__d_0__f
call fcn.14001c5c4
lea rcx, str.REG_ADD_HKCUSoftwareMicrosoftGameBar__v_ShowStartupPanel__t_REG_DWORD__d_0__f
call fcn.14001c5c4
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlSession_ManagerMemory_Management
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005edf
mov dword [rsp + 0x5c], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisablePagingExecutive
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.Failed_to_disable_Windows_visual_effects._n
lea rcx, str.Windows_visual_effects_have_been_disabled._n
test eax, eax
cmovne rcx, rdx
call fcn.140001240
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140005eeb
lea rcx, str.Failed_to_open_registry_key_to_disable_Windows_visual_effects._n
call fcn.140001240
mov ecx, 0x96
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.taskkill__f__im_explorer.exe
call fcn.14001c5c4
lea rcx, str.timeout_2__nobreak___nul
call fcn.14001c5c4
lea rcx, str.DEL__F__S__Q__A__LocalAppData_MicrosoftWindowsExplorer_thumbcache_.db
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q__systemdrive_.tmp
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q__systemdrive_._mp
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q__systemdrive_.log
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q__systemdrive_.gid
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q__systemdrive_.chk
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q__systemdrive_.old
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q__systemdrive__recycled.
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q__systemdrive__Recycle.Bin.
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q__windir_.bak
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q__windir_prefetch.
call fcn.14001c5c4
lea rcx, str.rd__s__q__windir__temp__md__windir__temp
call fcn.14001c5c4
lea rcx, str.DEL__f__q__userprofile_cookies.
call fcn.14001c5c4
lea rcx, str.DEL__f__q__userprofile__recent.
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q___userprofile_Local_SettingsTemporary_Internet_Files._
call fcn.14001c5c4
lea rcx, str.DEL__f__s__q___userprofile_Local_SettingsTemp._
call fcn.14001c5c4
lea rcx, str.DEL__f__q__userprofile__recent.
call fcn.14001c5c4
lea rcx, str.timeout_2__nobreak___nul
call fcn.14001c5c4
lea rcx, str.start_explorer.exe
call fcn.14001c5c4
xor eax, eax
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1400138b0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call fcn.14001cac4
int3