Function at 0x14000afb0
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x550
mov rax, qword [0x140082090]
xor rax, rsp
mov qword [rsp + 0x540], rax
mov rdi, rdx
movsxd rsi, ecx
xor r14d, r14d
xor edx, edx
mov r8d, 0x198
lea rcx, [rsp + 0x3a0]
call fcn.1400294c0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea r8d, [r14 + 5]
lea rdx, str.1.0.1
lea rcx, [rsp + 0x60]
call fcn.140015ff0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
lea r8d, [r14 + 0x12]
lea rdx, str.no_defender_loader
lea rcx, [rsp + 0x38]
call fcn.140015ff0
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x3a0]
call fcn.140006c70
nop
lea r12, str.__disable
mov rdx, r12
lea rcx, [rsp + 0x3a0]
call fcn.1400152f0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], r14
mov qword [rsp + 0x1d8], r14
lea r8d, [r14 + 0x1d]
lea rdx, str.disable_the_no_defender_stuff
lea rcx, [rsp + 0x1c0]
call fcn.140015ff0
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.140004bf0
mov rbx, rax
mov byte [rsp + 0x30], r14b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140013dd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0x80], 1
lea rax, vtable.type_info.0
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.140004c70
lea r15, str.__name
mov rdx, r15
lea rcx, [rsp + 0x3a0]
call fcn.1400152f0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1b0], r14
mov qword [rsp + 0x1b8], r14
lea r8d, [r14 + 7]
lea rdx, str.av_name
lea rcx, [rsp + 0x1a0]
call fcn.140015ff0
lea rdx, [rsp + 0x1a0]
mov rcx, rbx
call fcn.140004bf0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1d0], xmm1
lea r8d, [r14 + 0x1d]
lea rdx, str.github.com_es3n1n_no_defender
lea rcx, [rsp + 0x1c0]
call fcn.140015ff0
nop
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.140013c00
mov qword [rax + 0x1b0], 1
mov qword [rax + 0x1b8], 1
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 0x10
jb 0x14000b21b
inc rdx
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b216
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b978
call fcn.140026f60
movdqa xmm0, xmmword [0x140078990]
movdqu xmmword [rsp + 0x1d0], xmm0
mov byte [rsp + 0x1c0], 0
lea r8, [rdi + rsi*8]
mov rdx, rdi
lea rcx, [rsp + 0x1a0]
call fcn.1400148d0
nop
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x3a0]
call fcn.140007350
nop
lea rcx, [rsp + 0x1a0]
call fcn.14000fd10
mov qword [rsp + 0x190], r15
mov qword [rsp + 0x198], 6
cmp byte [rsp + 0x468], 0
je 0x14000b97e
movaps xmm0, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0x190], xmm0
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x3a0]
call fcn.140007770
mov rbx, qword [rax + 0x198]
cmp rbx, qword [rax + 0x1a0]
je 0x14000b305
test rbx, rbx
je 0x14000b9a6
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x14000b9a6
add rcx, 8
lea rdx, [0x140083098]
call fcn.140028b74
test eax, eax
jne 0x14000b9a6
mov rdx, rbx
lea rcx, [rsp + 0x1e0]
call fcn.14000e4a0
jmp 0x14000b357
cmp qword [rax + 0xa0], 0
je 0x14000bb14
lea rbx, [rax + 0x68]
test rbx, rbx
je 0x14000bb0f
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x14000bb0f
add rcx, 8
lea rdx, [0x140083098]
call fcn.140028b74
test eax, eax
jne 0x14000bb0f
mov rdx, rbx
lea rcx, [rsp + 0x1e0]
call fcn.14000e4a0
nop
cmp qword [rsp + 0x1f0], 0x80
ja 0x14000b9ac
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x201], xmm0
movups xmmword [rsp + 0x211], xmm0
movups xmmword [rsp + 0x221], xmm0
movups xmmword [rsp + 0x231], xmm0
movups xmmword [rsp + 0x241], xmm0
movups xmmword [rsp + 0x251], xmm0
movups xmmword [rsp + 0x261], xmm0
movups xmmword [rsp + 0x271], xmm0
mov byte [rsp + 0x281], al
mov qword [rsp + 0x190], r12
mov qword [rsp + 0x198], 9
cmp byte [rsp + 0x468], al
je 0x14000b9ff
movaps xmm0, xmmword [rsp + 0x190]
movdqa xmmword [rsp + 0x190], xmm0
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x3a0]
call fcn.140007770
mov rbx, qword [rax + 0x198]
cmp rbx, qword [rax + 0x1a0]
je 0x14000b43d
test rbx, rbx
je 0x14000ba27
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x14000ba27
add rcx, 8
lea rdx, [0x1400831a8]
call fcn.140028b74
test eax, eax
jne 0x14000ba27
jmp 0x14000b47e
cmp qword [rax + 0xa0], 0
je 0x14000bab8
lea rbx, [rax + 0x68]
test rbx, rbx
je 0x14000bab3
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x14000bab3
add rcx, 8
lea rdx, [0x1400831a8]
call fcn.140028b74
test eax, eax
jne 0x14000bab3
cmp byte [rbx], 1
sete byte [rsp + 0x200]
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 0x10
cmovae rdx, qword [rsp + 0x1e0]
lea rcx, [rsp + 0x1e0]
cmovae rcx, qword [rsp + 0x1e0]
mov r8, qword [rsp + 0x1f0]
add r8, rcx
sub r8, rdx
lea rcx, [rsp + 0x201]
call fcn.140028e20
lea rdx, str._saving_the_ctx..
lea rcx, [0x140083de0]
call fcn.140013750
mov rcx, rax
call fcn.140014c40
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x290]
call fcn.1400294c0
lea rcx, [rsp + 0x38]
call fcn.14000a230
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000b514
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x290]
call fcn.14000fae0
mov rax, qword [rsp + 0x290]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x290], rbx
mov rax, qword [rsp + 0x290]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x28c], edx
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14000b595
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b590
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ba2d
call fcn.140026f60
movdqa xmm0, xmmword [0x140078990]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x290]
call fcn.14000dbe0
nop
mov rax, qword [rsp + 0x290]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x290], rbx
mov rax, qword [rsp + 0x290]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x28c], edx
lea rcx, [rsp + 0x298]
call fcn.14000cac0
mov rax, qword [rsp + 0x290]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x290], rax
mov rax, qword [rsp + 0x290]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x28c], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x338], rax
lea rcx, [rsp + 0x338]
call fcn.140026500
nop
lea rdx, str._setting_the_registry_keys_up
lea rcx, [0x140083de0]
call fcn.140013750
mov rcx, rax
call fcn.140014c40
call fcn.14000a4c0
lea rax, str.SeLoadDriverPrivilege
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 0x15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1b0], r14
mov ecx, 0x10
call fcn.140026f68
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], rax
lea rbx, [rax + 0x10]
mov qword [rsp + 0x1b0], rbx
mov r8d, 0x10
lea rdx, [rsp + 0x190]
mov rcx, rax
call fcn.140028e20
mov qword [rsp + 0x1a8], rbx
lea rcx, [rsp + 0x1a0]
call fcn.140004800
test al, al
je 0x14000ba33
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rcx, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x190], rcx
mov qword [rsp + 0x198], rax
lea rcx, [rsp + 0x190]
call fcn.14000a830
cmp byte [rsp + 0x200], 1
jne 0x14000b82e
lea rdx, str._removing_the_service
lea rcx, [0x140083de0]
call fcn.140013750
mov rcx, rax
call fcn.140014c40
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1a0], xmm0
mov qword [rsp + 0x1b0], rax
mov r8d, 0xf01ff
lea rdx, str.wsc_proxy
mov rbx, qword [rsp + 0x198]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rcx, rax
test rax, rax
jne 0x14000b7a2
mov byte [rsp + 0x1b0], al
mov rcx, qword [rsp + 0x1a8]
jmp 0x14000b7c2
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], rcx
mov al, 1
mov byte [rsp + 0x1b0], al
test al, al
je 0x14000ba5c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], rax
mov dword [rsp + 0x1d8], eax
lea r8, [rsp + 0x1c0]
lea edx, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0x1a8]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14000ba84
cmp byte [rsp + 0x1b0], 0
je 0x14000b836
mov rcx, qword [rsp + 0x1a8]
test rcx, rcx
je 0x14000b82c
call qword [rsp + 0x1a0]
nop
jmp 0x14000b836
mov rbx, qword [rsp + 0x198]
lea rdx, str._done__thanks_for_using_the_no_defender_project_
lea rcx, [0x140083de0]
call fcn.140013750
mov rcx, rax
call fcn.140014c40
mov rcx, rax
call fcn.140014c40
lea rdx, str._please_dont_forget_to_leave_a_star_at_https:__github.com_es3n1n_no_defender
lea rcx, [0x140083de0]
call fcn.140013750
mov rcx, rax
call fcn.140014c40
cmp byte [rsp + 0x200], 0
jne 0x14000b8cf
lea rdx, str._please_dont_remove_any_files_from_this_folder__otherwise_no_defender_wouldnt_be_activated_after_the_reboot_
lea rcx, [0x140083de0]
call fcn.140013750
mov rcx, rax
call fcn.140014c40
lea rdx, str._if_you_wish_to_change_the_folder__please_de_activate_no_defender__change_the_folder_and_activate_it_again
lea rcx, [0x140083de0]
call fcn.140013750
mov rcx, rax
call fcn.140014c40
lea rdx, str._to_de_activate_the_no_defender_please_run_no_defender.exe___disable
lea rcx, [0x140083de0]
call fcn.140013750
mov rcx, rax
call fcn.140014c40
call fcn.14000d190
nop
test rbx, rbx
je 0x14000b8e5
mov rcx, rbx
call qword [rsp + 0x190]
nop
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 0x10
jb 0x14000b928
inc rdx
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b923
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000baad
call fcn.140026f60
movdqa xmm0, xmmword [0x140078990]
movdqu xmmword [rsp + 0x1f0], xmm0
mov byte [rsp + 0x1e0], 0
lea rcx, [rsp + 0x3a0]
call fcn.14000bb80
xor eax, eax
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.140026f40
mov rbx, qword [rsp + 0x590]
add rsp, 0x550
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.140031cf4
int3
lea rdx, str.Nothing_parsed__no_arguments_are_available.
lea rcx, [rsp + 0xc8]
call fcn.140002d30
lea rdx, [0x140080450]
lea rcx, [rsp + 0xc8]
call fcn.140028d28
call fcn.1400049c0
nop
lea rax, str.Max_name_length_is__characters
mov qword [rsp + 0x190], rax
mov qword [rsp + 0x198], 0x20
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x38]
call fcn.1400154d0
nop
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.140002da0
lea rdx, [0x140080490]
lea rcx, [rsp + 0xe0]
call fcn.140028d28
nop
lea rdx, str.Nothing_parsed__no_arguments_are_available.
lea rcx, [rsp + 0xf8]
call fcn.140002d30
lea rdx, [0x140080450]
lea rcx, [rsp + 0xf8]
call fcn.140028d28
call fcn.1400049c0
nop
call fcn.140031cf4
nop
lea rdx, str.unable_to_acquire_privileges
lea rcx, [rsp + 0x110]
call fcn.140002e10
lea rdx, [0x140080490]
lea rcx, [rsp + 0x110]
call fcn.140028d28
nop
lea rdx, str.unable_to_open_wsc_proxy
lea rcx, [rsp + 0x128]
call fcn.140002e10
lea rdx, [0x140080490]
lea rcx, [rsp + 0x128]
call fcn.140028d28
lea rdx, str.unable_to_remove_wsc_proxy
lea rcx, [rsp + 0x140]
call fcn.140002e10
lea rdx, [0x140080490]
lea rcx, [rsp + 0x140]
call fcn.140028d28
nop
call fcn.140031cf4
nop
call fcn.1400049c0
mov rcx, rax
call fcn.140019900
mov r8, rax
lea rdx, str.No_value_provided_for_
lea rcx, [rsp + 0x38]
call fcn.140013a10
nop
lea r8, [0x140073fc4]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400134f0
nop
mov rdx, rax
lea rcx, [rsp + 0x158]
call fcn.140002cc0
lea rdx, [0x140080450]
lea rcx, [rsp + 0x158]
call fcn.140028d28
nop
call fcn.1400049c0
mov rcx, rax
call fcn.140019900
mov r8, rax
lea rdx, str.No_value_provided_for_
lea rcx, [rsp + 0x1c0]
call fcn.140013a10
nop
lea r8, [0x140073fc4]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400134f0
nop
mov rdx, rax
lea rcx, [rsp + 0x170]
call fcn.140002cc0
lea rdx, [0x140080450]
lea rcx, [rsp + 0x170]
call fcn.140028d28
int3