Function at 0x14000296c
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, rcx
lea r8, str.SoftwareMicrosoftWindows_Defender
xor r15d, r15d
lea rcx, [rbp + 0x50]
mov r9d, 0x2001f
mov qword [rbp + 0x50], r15
mov rdx, 0xffffffff80000002
call fcn.140039754
lea r13, str.___a_
mov r14d, eax
test eax, eax
jns 0x1400029ca
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140002bcb
jmp 0x140002bc5
mov rbx, qword [rbp + 0x50]
lea rsi, str.DisableAntiSpyware
mov rdx, rsi
mov dword [rbp + 0x48], r15d
mov rcx, rbx
lea r8, [rbp + 0x48]
call fcn.140039dc8
lea r8, [rbp + 0x48]
mov rdx, rsi
mov rcx, rbx
call fcn.140039dc8
mov r14d, eax
test eax, eax
jns 0x140002a11
cmp eax, 0x80070002
jne 0x140002bbd
mov eax, r15d
mov dword [rbp + 0x48], eax
jmp 0x140002a14
mov eax, dword [rbp + 0x48]
mov rcx, qword [str.___a_]
cmp rcx, r13
je 0x140002a45
test byte [rcx + 0x1c], 4
je 0x140002a45
mov rcx, qword [rcx + 0x10]
lea r8, [0x14004b0f8]
mov edx, 0x11
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.14000230c
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x140002a9a
lea rax, [rbp + 0x50]
mov dword [rbp + 0x50], r15d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.140039e90
mov r14d, eax
test eax, eax
js 0x140002bbd
mov rcx, qword [str.___a_]
cmp rcx, r13
je 0x140002a9a
test byte [rcx + 0x1c], 2
je 0x140002a9a
mov rcx, qword [rcx + 0x10]
lea r8, [0x14004b0f8]
mov edx, 0x12
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.140002410
test rbx, rbx
je 0x140002aab
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov rdx, qword [rdi]
lea r12, str.WinDefend
mov r8, r12
mov qword [rbp + 0x50], r15
mov r9d, 0x17
lea rcx, [rbp + 0x50]
call fcn.140038df0
mov r14d, eax
test eax, eax
jns 0x140002ae4
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140002bbd
jmp 0x140002bb7
mov rdi, qword [rbp + 0x50]
lea rcx, [rbp + 0x58]
mov rdx, rdi
mov qword [rbp + 0x58], r15
call fcn.140039070
mov r14d, eax
test eax, eax
jns 0x140002b11
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140002baf
jmp 0x140002ba5
mov rsi, qword [rbp + 0x58]
mov r9d, dword [rsi + 4]
lea eax, [r9 - 2]
cmp eax, 1
jbe 0x140002b92
mov rcx, qword [str.___a_]
cmp rcx, r13
je 0x140002b4e
test byte [rcx + 0x1c], 2
je 0x140002b4e
mov rcx, qword [rcx + 0x10]
lea r8, [0x14004b0f8]
mov edx, 0x13
mov qword [rsp + 0x20], r12
call fcn.1400021e8
mov qword [rsp + 0x50], r15
mov r9d, 1
mov qword [rsp + 0x48], r15
or edx, 0xffffffff
mov qword [rsp + 0x40], r15
mov rcx, rdi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140002b92
call fcn.140038cd4
jmp 0x140002b9f
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400392fc
mov r14d, eax
mov rcx, rsi
mov edx, 0x40
call fcn.140040794
test rdi, rdi
je 0x140002bbd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140002bcb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [str.___a_]
cmp rcx, r13
je 0x140002bf5
test byte [rcx + 0x1c], 4
je 0x140002bf5
mov rcx, qword [rcx + 0x10]
lea r8, [0x14004b0f8]
mov edx, 0x14
mov r9d, r14d
call fcn.140002534
mov rbx, qword [rsp + 0xa0]
mov eax, r14d
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret