Function at 0x140004c40
Capabilities:
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x220
mov rax, qword [0x140044040]
xor rax, rsp
mov qword [rsp + 0x210], rax
xor esi, esi
mov eax, esi
movsxd r8, ecx
test ecx, ecx
jle 0x140004c91
nop
mov rcx, qword [rdx + rax*8]
cmp byte [rcx], 0x2d
jne 0x140004c89
cmp byte [rcx + 1], 0x73
jne 0x140004c89
cmp byte [rcx + 2], sil
je 0x140004d43
inc rax
cmp rax, r8
jl 0x140004c70
xor dil, dil
mov byte [rsp + 0x51], dil
mov ebx, esi
mov qword [rsp + 0xe0], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140004d05
mov dword [rsp + 0xf0], 4
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0xe8]
lea edx, [r9 + 0x10]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x140004d18
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140004d4b
lea rcx, str.Must_run_as_admin__n
call fcn.140001170
test dil, dil
jne 0x140004d39
lea rcx, str.pause
call fcn.140016070
mov eax, 1
jmp 0x14000525e
mov dil, 1
jmp 0x140004c94
mov dword [rsp + 0xf0], esi
mov qword [rsp + 0xe8], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000517d
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140004dbb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000517d
mov edx, dword [rsp + 0xf0]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
mov r8, rbx
mov edx, 1
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000517d
test rbx, rbx
je 0x14000517d
lea rdx, [rsp + 0xe8]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x14000517d
mov rdx, qword [rsp + 0xe8]
lea rcx, str.S_1_5_18
call fcn.1400161f8
test eax, eax
jne 0x140005174
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
lea r8d, [rax + 0xf]
lea rdx, str.smartscreen.exe
lea rcx, [rsp + 0x58]
call fcn.1400040f0
lea rcx, [rsp + 0x58]
call fcn.140005a10
mov r8d, eax
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test rbx, rbx
je 0x140004e9c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov r8d, 9
lea rdx, str.WinDefend
lea rcx, [rsp + 0x58]
call fcn.1400040f0
lea rdx, [rsp + 0x58]
call fcn.1400022d0
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_DefenderFeatures
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140004f30
mov r8d, eax
lea rdx, str.SOFTWAREMicrosoftWindows_DefenderFeatures
lea rcx, str.Could_not_find_or_create__ls_error__d_n
call fcn.140005290
jmp 0x140004f9a
mov dword [rsp + 0xe8], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TamperProtection
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140004f9a
call fcn.140003620
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140004770
movzx edx, al
mov rcx, rbx
call fcn.1400045c0
mov rcx, rbx
call fcn.140004460
mov ecx, 0x60
call fcn.140008eb8
mov rbx, rax
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
lea rax, [rsp + 0x58]
mov qword [rsp + 0xe8], rax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov r8d, 3
lea rdx, [0x1400395a8]
lea rcx, [rsp + 0x58]
call fcn.1400040f0
nop
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xf0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
mov r8d, 0x11
lea rdx, str.MSFT_MpPreference
lea rcx, [rsp + 0xa0]
call fcn.1400040f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rsi
mov r8d, 0x1f
lea rdx, str.RootMicrosoftWindowsDefender
lea rcx, [rsp + 0xc0]
call fcn.1400040f0
nop
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.140005d00
mov rbx, rax
mov edx, dword [rax]
test edx, edx
je 0x1400050b7
lea rcx, str.Error_has_occured:__d_n
call fcn.140001170
mov rcx, rbx
call fcn.140002f90
mov al, 1
jmp 0x140005116
mov byte [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
mov r8d, 0x19
lea rdx, str.DisableRealtimeMonitoring
lea rcx, [rsp + 0x80]
call fcn.1400040f0
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.140003cc0
mov rcx, rbx
call fcn.140002f90
cmp byte [rsp + 0x50], 0
sete al
lea rdx, str.Windows_defender_is_currently_ACTIVE_n
lea rcx, str.Windows_defender_is_currently_OFF_n
test al, al
cmovne rcx, rdx
call fcn.140001170
call fcn.140002680
test al, al
je 0x140005146
call fcn.1400025a0
lea rcx, str.Disabled_windows_defender__n
jmp 0x14000514d
lea rcx, str.Failed_to_disable_defender..._n
call fcn.140001170
nop
jmp 0x14000515a
test dil, dil
jne 0x14000525c
lea rcx, str.pause
call fcn.140016070
jmp 0x14000525c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rcx, str.Restarting_with_privileges_n
call fcn.140001170
mov r8d, 0x100
lea rdx, [rsp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x110]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x1400051c3
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x58]
call fcn.1400040f0
nop
lea rax, [0x14003db74]
lea rdx, [0x140038fb0]
test dil, dil
cmovne rdx, rax
inc rbx
cmp byte [rdx + rbx], 0
jne 0x1400051f4
mov r8, rbx
lea rcx, [rsp + 0x58]
call fcn.140003290
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140003170
mov rcx, rax
call fcn.140005490
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14000525c
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005257
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005283
call fcn.140008eb0
xor eax, eax
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140008e90
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140013e90
int3