Function at 0x40ae87
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40ae8f
call fcn.00465f10
mov edx, dword [esp + 0x3c]
lea ecx, [esp]
call fcn.00423000
push dword [esp]
mov edx, str.0419
pop ecx
call fcn.00423660
jne 0x40aecf
push dword [esp]
mov edx, 0x500fcc
pop ecx
call fcn.00423660
jne 0x40aecf
jmp 0x40aed6
mov eax, 1
jmp 0x40aed8
xor eax, eax
and eax, eax
jne 0x40aeee
push dword [esp]
mov edx, 0x500fc6
pop ecx
call fcn.00423660
jne 0x40aeee
jmp 0x40aef5
mov eax, 1
jmp 0x40aef7
xor eax, eax
and eax, eax
je 0x40af0b
mov edx, 0x50c660
lea ecx, [esp + 0x18]
call fcn.00423008
jmp 0x40af19
mov edx, str.Disabling_and_enabling_Defender_in_this_version_of_the_program_requires_a_system_reboot._Perform_a_Defender_switchover__
lea ecx, [esp + 0x18]
call fcn.00423008
push dword [esp + 0x38]
push 0x34
push dword [esp + 0x20]
mov eax, str.Defender_Tools
push eax
call fcn.004099ce
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
cmp ebx, 7
jne 0x40af45
xor eax, eax
jmp 0x40b809
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
push 0xc8
call fcn.00463790
lea eax, [esp + 8]
push eax
call fcn.00465e10
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
push 0xc8
call fcn.00463790
lea eax, [esp + 0xc]
push eax
call fcn.00465e10
push 0xc8
mov eax, dword [esp + 8]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov eax, dword [esp + 0xc]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [esp + 4]
mov edx, str.AMD64
pop ecx
call fcn.00423660
jne 0x40afdb
push dword [esp + 8]
mov edx, str.AMD64
pop ecx
call fcn.00423660
jne 0x40afdb
jmp 0x40afe2
mov eax, 1
jmp 0x40afe4
xor eax, eax
and eax, eax
je 0x40aff8
mov edx, 0x5065be
lea ecx, [esp + 0xc]
call fcn.00423008
jmp 0x40b006
mov edx, 0x508622
lea ecx, [esp + 0xc]
call fcn.00423008
call fcn.0040fdc6
and eax, eax
je 0x40b030
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
call fcn.0044da46
lea eax, [esp + 0x14]
push eax
call fcn.00465e10
jmp 0x40b06c
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
call fcn.0043f547
call fcn.004236b2
add dword [esp], edx
call fcn.0044d97b
lea eax, [esp + 0x14]
push eax
call fcn.00465e10
push edx
call fcn.00465d70
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.loader.exe
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0044d9fa
call fcn.004236d0
push edx
call fcn.00465d70
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.Disable.cmd
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0044d9fa
call fcn.004236d0
push edx
call fcn.00465d70
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.Enable.cmd
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0044d9fa
call fcn.004236d0
push dword [esp + 0xc]
mov edx, 0x5065be
pop ecx
call fcn.00423660
je 0x40b1a2
push edx
call fcn.00465d70
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.loader.exe
push edx
call fcn.00465db0
call fcn.00465ea0
push 0x6f
call fcn.004236b2
add dword [esp + 4], edx
call fcn.0044e500
call fcn.004236d0
and eax, eax
je 0x40b1a0
mov ebp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe____SystemRoot_System32_smartscreen.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender_
mov ebx, ebp
mov ebp, 0x527ce2
sub ebx, ebp
push ebx
mov ebp, 0x527ce2
push ebp
push 0x6f
call fcn.0044e750
push 0x6f
call fcn.0044e210
jmp 0x40b211
push edx
call fcn.00465d70
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.loader.exe
push edx
call fcn.00465db0
call fcn.00465ea0
push 0x6f
call fcn.004236b2
add dword [esp + 4], edx
call fcn.0044e500
call fcn.004236d0
and eax, eax
je 0x40b211
mov ebp, 0x527ce2
mov ebx, ebp
mov ebp, 0x50e36a
sub ebx, ebp
push ebx
mov ebp, 0x50e36a
push ebp
push 0x6f
call fcn.0044e750
push 0x6f
call fcn.0044e210
mov ebx, dword [esp + 0x34]
and ebx, ebx
jne 0x40b38b
mov ebx, dword [0x671960]
and ebx, ebx
jne 0x40b2d9
push edx
call fcn.00465d70
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.Disable.cmd
push edx
call fcn.00465db0
call fcn.00465ea0
push 0x6f
call fcn.004236b2
add dword [esp + 4], edx
call fcn.0044e500
call fcn.004236d0
and eax, eax
je 0x40b2d4
mov ebp, 0x554117
mov ebx, ebp
mov ebp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe____SystemRoot_System32_smartscreen.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender_
sub ebx, ebp
push ebx
mov ebp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe____SystemRoot_System32_smartscreen.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender_
push ebp
push 0x6f
call fcn.0044e750
push 0x6f
call fcn.0044e210
push edx
call fcn.00465d70
pop edx
push eax
mov edx, str._EXEFilename__Disable.cmd___WaitProcess_1__StartDirectory__
push edx
call fcn.00465db0
mov edx, dword [esp + 0x14]
push edx
call fcn.00465db0
mov edx, str.___WindowState_0__RunAs_8__Run
push edx
call fcn.00465db0
lea eax, [esp + 0x24]
push eax
call fcn.00465e10
mov dword [esp + 0x14], 1
jmp 0x40b386
push edx
call fcn.00465d70
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.Disable.ps1
push edx
call fcn.00465db0
call fcn.00465ea0
push 0x6f
call fcn.004236b2
add dword [esp + 4], edx
call fcn.0044e500
call fcn.004236d0
and eax, eax
je 0x40b386
mov ebp, 0x555cd1
mov ebx, ebp
mov ebp, 0x5558e0
sub ebx, ebp
push ebx
mov ebp, 0x5558e0
push ebp
push 0x6f
call fcn.0044e750
push 0x6f
call fcn.0044e210
push edx
call fcn.00465d70
pop edx
push eax
mov edx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
push edx
call fcn.00465db0
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
call fcn.0044da46
pop eax
mov edx, str.Disable.ps1_
push edx
call fcn.00465db0
lea eax, [esp + 0x24]
push eax
call fcn.00465e10
jmp 0x40b4f4
mov ebx, dword [0x671960]
and ebx, ebx
jne 0x40b447
push edx
call fcn.00465d70
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.Enable.cmd
push edx
call fcn.00465db0
call fcn.00465ea0
push 0x6f
call fcn.004236b2
add dword [esp + 4], edx
call fcn.0044e500
call fcn.004236d0
and eax, eax
je 0x40b442
mov ebp, 0x55549e
mov ebx, ebp
mov ebp, 0x554117
sub ebx, ebp
push ebx
mov ebp, 0x554117
push ebp
push 0x6f
call fcn.0044e750
push 0x6f
call fcn.0044e210
push edx
call fcn.00465d70
pop edx
push eax
mov edx, str._EXEFilename__Enable.cmd___WaitProcess_1__StartDirectory__
push edx
call fcn.00465db0
mov edx, dword [esp + 0x14]
push edx
call fcn.00465db0
mov edx, str.___WindowState_0__RunAs_8__Run
push edx
call fcn.00465db0
lea eax, [esp + 0x24]
push eax
call fcn.00465e10
mov dword [esp + 0x14], 0
jmp 0x40b4f4
push edx
call fcn.00465d70
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.Enable.ps1
push edx
call fcn.00465db0
call fcn.00465ea0
push 0x6f
call fcn.004236b2
add dword [esp + 4], edx
call fcn.0044e500
call fcn.004236d0
and eax, eax
je 0x40b4f4
mov ebp, 0x555cd1
mov ebx, ebp
mov ebp, 0x5558e0
sub ebx, ebp
push ebx
mov ebp, 0x5558e0
push ebp
push 0x6f
call fcn.0044e750
push 0x6f
call fcn.0044e210
push edx
call fcn.00465d70
pop edx
push eax
mov edx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
push edx
call fcn.00465db0
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465d70
pop edx
push eax
call fcn.0044da46
pop eax
mov edx, str.Enable.ps1_
push edx
call fcn.00465db0
lea eax, [esp + 0x24]
push eax
call fcn.00465e10
push edx
call fcn.00465d70
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.loader.exe
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0044d755
call fcn.004236d0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40b53f
jl 0x40b53b
cmp ebx, 0
ja 0x40b53f
xor eax, eax
jmp 0x40b544
mov eax, 1
or eax, eax
je 0x40b74c
push edx
call fcn.00465d70
pop edx
push eax
push 3
push dword [esp + 0x18]
push dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.loader.exe
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0043f5fe
call fcn.004236d0
mov ebx, dword [esp + 0x14]
and ebx, ebx
jle 0x40b5e6
push 0x7d0
call fcn.0044b9a2
push edx
call fcn.00465d70
pop edx
push eax
push 3
push dword [esp + 0x18]
push dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.loader.exe
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0043f5fe
call fcn.004236d0
push edx
call fcn.00465d70
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.loader.exe
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0044d9fa
call fcn.004236d0
push edx
call fcn.00465d70
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.Disable.cmd
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0044d9fa
call fcn.004236d0
push edx
call fcn.00465d70
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.Enable.cmd
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0044d9fa
call fcn.004236d0
push dword [esp]
mov edx, str.0419
pop ecx
call fcn.00423660
jne 0x40b6bc
push dword [esp]
mov edx, 0x500fcc
pop ecx
call fcn.00423660
jne 0x40b6bc
jmp 0x40b6c3
mov eax, 1
jmp 0x40b6c5
xor eax, eax
and eax, eax
jne 0x40b6db
push dword [esp]
mov edx, 0x500fc6
pop ecx
call fcn.00423660
jne 0x40b6db
jmp 0x40b6e2
mov eax, 1
jmp 0x40b6e4
xor eax, eax
and eax, eax
je 0x40b6f8
mov edx, 0x5031b8
lea ecx, [esp + 0x18]
call fcn.00423008
jmp 0x40b706
mov edx, str.You_must_restart_the_computer_to_complete_the_operation._Perform_a_reboot_now__
lea ecx, [esp + 0x18]
call fcn.00423008
push dword [esp + 0x38]
push 0x34
push dword [esp + 0x20]
mov eax, str.Defender_Tools
push eax
call fcn.004099ce
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
cmp ebx, 6
jne 0x40b74c
push 2
mov eax, 0x4ff050
push eax
mov eax, str._r__f__t_0
push eax
mov eax, str.shutdown.exe
push eax
call fcn.0043f5fe
jmp 0x408375
push edx
call fcn.00465d70
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.loader.exe
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0044d9fa
call fcn.004236d0
push edx
call fcn.00465d70
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.Disable.cmd
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0044d9fa
call fcn.004236d0
push edx
call fcn.00465d70
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.00465d70
pop edx
push eax
push edx
call fcn.00465db0
mov edx, str.Enable.cmd
push edx
call fcn.00465db0
call fcn.004236b2
add dword [esp], edx
call fcn.0044d9fa
call fcn.004236d0
mov eax, 1
jmp 0x40b809
push dword [esp]
call fcn.00465fa0
push dword [esp + 0x10]
call fcn.00465fa0
push dword [esp + 8]
call fcn.00465fa0
push dword [esp + 0xc]
call fcn.00465fa0
push dword [esp + 0x20]
call fcn.00465fa0
push dword [esp + 0x18]
call fcn.00465fa0
push dword [esp + 4]
call fcn.00465fa0
add esp, 0x24
pop edi
pop ebx
pop ebp
ret 0xc