Function at 0x14000f94c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push rbp
push r15
mov rax, 0xa
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14000f965
sub rsp, 0x28
call fcn.14008b7f0
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.14008b860
add rsp, 0x10
push qword [rsp + 0x28]
movabs rcx, str.0419
pop rdx
call fcn.14008b6b0
or rax, rax
jne 0x14000f9cd
push qword [rsp + 0x28]
movabs rcx, 0x140150fcc
pop rdx
call fcn.14008b6b0
or rax, rax
jne 0x14000f9cd
jmp 0x14000f9d6
mov rax, 1
jmp 0x14000f9d9
xor rax, rax
and rax, rax
jne 0x14000f9f9
push qword [rsp + 0x28]
movabs rcx, 0x140150fc6
pop rdx
call fcn.14008b6b0
or rax, rax
jne 0x14000f9f9
jmp 0x14000fa02
mov rax, 1
jmp 0x14000fa05
xor rax, rax
and rax, rax
je 0x14000fa20
movabs rdx, 0x14015c62e
lea rcx, [rsp + 0x58]
call fcn.14008b420
jmp 0x14000fa34
movabs rdx, str.Disabling_and_enabling_Defender_in_this_version_of_the_program_requires_a_system_reboot._Perform_a_Defender_switchover__
lea rcx, [rsp + 0x58]
call fcn.14008b420
push qword [rsp + 0x98]
push reloc.WS2_32.dll_gethostbyname
push qword [rsp + 0x68]
movabs rax, str.Defender_Tools
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000d5e9
mov qword [rsp + 0x60], rax
mov r15, qword [rsp + 0x60]
cmp r15, 7
jne 0x14000fa72
xor rax, rax
jmp 0x140010ab6
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400884f0
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.14008b5d0
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400884f0
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.14008b5d0
push 0xc8
mov rax, qword [rsp + 0x38]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [rsp + 0x40]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push qword [rsp + 0x30]
movabs rcx, str.AMD64
pop rdx
call fcn.14008b6b0
or rax, rax
jne 0x14000fb70
push qword [rsp + 0x38]
movabs rcx, str.AMD64
pop rdx
call fcn.14008b6b0
or rax, rax
jne 0x14000fb70
jmp 0x14000fb79
mov rax, 1
jmp 0x14000fb7c
xor rax, rax
and rax, rax
je 0x14000fb97
movabs rdx, 0x14015658c
lea rcx, [rsp + 0x40]
call fcn.14008b420
jmp 0x14000fbab
movabs rdx, 0x1401585f0
lea rcx, [rsp + 0x40]
call fcn.14008b420
call fcn.1400179c3
and rax, rax
je 0x14000fbf4
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.14006c044
add rsp, 0x28
lea rcx, [rsp + 0x50]
pop rdx
call fcn.14008b5d0
jmp 0x14000fc6e
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140057dd8
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006bf2c
add rsp, 0x28
lea rcx, [rsp + 0x50]
pop rdx
call fcn.14008b5d0
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.loader.exe
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006bff4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.Disable.cmd
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006bff4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.Enable.cmd
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006bff4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
push qword [rsp + 0x40]
movabs rcx, 0x14015658c
pop rdx
call fcn.14008b6b0
or rax, rax
je 0x14000fedc
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
movabs rcx, str.loader.exe
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
call fcn.14008b770
push WSAStartup
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006cdc0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
and rax, rax
je 0x14000fed7
movabs rbp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe____SystemRoot_System32_smartscreen.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender_
mov r15, rbp
movabs rbp, 0x140177d22
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140177d22
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006d0f0
push WSAStartup
pop rcx
call fcn.14006ca50
jmp 0x14000ffab
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
movabs rcx, str.loader.exe
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
call fcn.14008b770
push WSAStartup
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006cdc0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
and rax, rax
je 0x14000ffab
movabs rbp, 0x140177d22
mov r15, rbp
movabs rbp, 0x14015e3aa
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14015e3aa
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006d0f0
push WSAStartup
pop rcx
call fcn.14006ca50
mov r15, qword [rsp + 0x90]
and r15, r15
jne 0x140010258
mov r15, qword [0x1402c3364]
and r15, r15
jne 0x140010108
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
movabs rcx, str.Disable.cmd
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
call fcn.14008b770
push WSAStartup
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006cdc0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
and rax, rax
je 0x140010103
movabs rbp, 0x1401a4157
mov r15, rbp
movabs rbp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe____SystemRoot_System32_smartscreen.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender_
sub r15, rbp
mov rax, r15
push rax
movabs rbp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe____SystemRoot_System32_smartscreen.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender_
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006d0f0
push WSAStartup
pop rcx
call fcn.14006ca50
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
movabs rcx, str._EXEFilename__Disable.cmd___WaitProcess_1__StartDirectory__
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
mov rcx, qword [rsp + 0x50]
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
movabs rcx, str.___WindowState_0__RunAs_8__Run
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
lea rcx, [rsp + 0x70]
pop rdx
call fcn.14008b5d0
mov qword [rsp + 0x50], 1
jmp 0x140010253
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
movabs rcx, str.Disable.ps1
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
call fcn.14008b770
push WSAStartup
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006cdc0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
and rax, rax
je 0x140010253
movabs rbp, 0x1401a5d11
mov r15, rbp
movabs rbp, 0x1401a5920
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1401a5920
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006d0f0
push WSAStartup
pop rcx
call fcn.14006ca50
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
movabs rcx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.14006c044
add rsp, 0x20
pop rax
movabs rcx, str.Disable.ps1_
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
lea rcx, [rsp + 0x70]
pop rdx
call fcn.14008b5d0
jmp 0x1400104ef
mov r15, qword [0x1402c3364]
and r15, r15
jne 0x1400103a4
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
movabs rcx, str.Enable.cmd
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
call fcn.14008b770
push WSAStartup
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006cdc0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
and rax, rax
je 0x14001039f
movabs rbp, 0x1401a54de
mov r15, rbp
movabs rbp, 0x1401a4157
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1401a4157
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006d0f0
push WSAStartup
pop rcx
call fcn.14006ca50
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
movabs rcx, str._EXEFilename__Enable.cmd___WaitProcess_1__StartDirectory__
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
mov rcx, qword [rsp + 0x50]
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
movabs rcx, str.___WindowState_0__RunAs_8__Run
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
lea rcx, [rsp + 0x70]
pop rdx
call fcn.14008b5d0
mov qword [rsp + 0x50], 0
jmp 0x1400104ef
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
movabs rcx, str.Enable.ps1
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
call fcn.14008b770
push WSAStartup
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006cdc0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
and rax, rax
je 0x1400104ef
movabs rbp, 0x1401a5d11
mov r15, rbp
movabs rbp, 0x1401a5920
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x1401a5920
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006d0f0
push WSAStartup
pop rcx
call fcn.14006ca50
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
movabs rcx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.14006c044
add rsp, 0x20
pop rax
movabs rcx, str.Enable.ps1_
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
lea rcx, [rsp + 0x70]
pop rdx
call fcn.14008b5d0
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
movabs rcx, str.loader.exe
sub rsp, 0x28
call fcn.14008b560
add rsp, 0x28
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.14006bca4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x14001092d
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
push qword [rsp + 0x60]
push qword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.loader.exe
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140057f04
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
mov r15, qword [rsp + 0x50]
and r15, r15
jle 0x1400106a9
push 0x7d0
pop rcx
call fcn.140069758
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
push qword [rsp + 0x60]
push qword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.loader.exe
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140057f04
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.loader.exe
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006bff4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.Disable.cmd
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006bff4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.Enable.cmd
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006bff4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
push qword [rsp + 0x28]
movabs rcx, str.0419
pop rdx
call fcn.14008b6b0
or rax, rax
jne 0x14001085a
push qword [rsp + 0x28]
movabs rcx, 0x140150fcc
pop rdx
call fcn.14008b6b0
or rax, rax
jne 0x14001085a
jmp 0x140010863
mov rax, 1
jmp 0x140010866
xor rax, rax
and rax, rax
jne 0x140010886
push qword [rsp + 0x28]
movabs rcx, 0x140150fc6
pop rdx
call fcn.14008b6b0
or rax, rax
jne 0x140010886
jmp 0x14001088f
mov rax, 1
jmp 0x140010892
xor rax, rax
and rax, rax
je 0x1400108ad
movabs rdx, 0x14015319c
lea rcx, [rsp + 0x58]
call fcn.14008b420
jmp 0x1400108c1
movabs rdx, str.You_must_restart_the_computer_to_complete_the_operation._Perform_a_reboot_now__
lea rcx, [rsp + 0x58]
call fcn.14008b420
push qword [rsp + 0x98]
push reloc.WS2_32.dll_gethostbyname
push qword [rsp + 0x68]
movabs rax, str.Defender_Tools
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000d5e9
mov qword [rsp + 0x60], rax
mov r15, qword [rsp + 0x60]
cmp r15, 6
jne 0x14001092d
push 2
movabs rax, 0x14014f050
push rax
movabs rax, str._r__f__t_0
push rax
movabs rax, str.shutdown.exe
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.140057f04
jmp 0x14000b3ee
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.loader.exe
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006bff4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.Disable.cmd
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006bff4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.14008b510
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.14008b510
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
movabs rcx, str.Enable.cmd
sub rsp, 0x20
call fcn.14008b560
add rsp, 0x20
push rax
call fcn.14008b740
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006bff4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140037050
add rsp, 0x28
pop rax
mov rax, 1
jmp 0x140010ab6
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.14008b900
add rsp, 0x28
mov rcx, qword [rsp + 0x50]
sub rsp, 0x28
call fcn.14008b900
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.14008b900
add rsp, 0x28
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.14008b900
add rsp, 0x28
mov rcx, qword [rsp + 0x70]
sub rsp, 0x28
call fcn.14008b900
add rsp, 0x28
mov rcx, qword [rsp + 0x60]
sub rsp, 0x28
call fcn.14008b900
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.14008b900
add rsp, 0x28
pop rax
add rsp, 0x78
pop r15
pop rbp
ret