Function at 0x14000b110
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x570
mov rax, qword [0x140086070]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov rdi, rdx
movsxd rsi, ecx
xor r14d, r14d
xor edx, edx
mov r8d, 0x198
lea rcx, [rsp + 0x3c0]
call fcn.140028f70
lea rax, [rsp + 0x200]
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x210], r14
mov qword [rsp + 0x218], r14
lea r8d, [r14 + 5]
lea rdx, str.1.0.1
lea rcx, [rsp + 0x200]
call fcn.140016140
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea r8d, [r14 + 0x12]
lea rdx, str.no_defender_loader
lea rcx, [rsp + 0x60]
call fcn.140016140
nop
lea r8, [rsp + 0x200]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x3c0]
call fcn.140006c50
nop
lea r12, str.__disable
mov rdx, r12
lea rcx, [rsp + 0x3c0]
call fcn.1400155b0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], r14
mov qword [rsp + 0x1d8], r14
lea r8d, [r14 + 0x1d]
lea rdx, str.disable_the_no_defender_stuff
lea rcx, [rsp + 0x1c0]
call fcn.140016140
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.140004be0
mov rbx, rax
mov byte [rsp + 0x30], r14b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140014070
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0x80], 1
lea rax, vtable.type_info.0
mov qword [rsp + 0xb8], rax
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.140004c60
lea r15, str.__name
mov rdx, r15
lea rcx, [rsp + 0x3c0]
call fcn.1400155b0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], r14
mov qword [rsp + 0x1d8], r14
lea r8d, [r14 + 7]
lea rdx, str.av_name
lea rcx, [rsp + 0x1c0]
call fcn.140016140
lea rdx, [rsp + 0x1c0]
mov rcx, rbx
call fcn.140004be0
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
lea r8d, [r14 + 0x1d]
lea rdx, str.github.com_es3n1n_no_defender
lea rcx, [rsp + 0x38]
call fcn.140016140
nop
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.140013e90
mov qword [rsp + 0x1b0], 1
mov qword [rsp + 0x1b8], 1
movups xmm0, xmmword [rsp + 0x1b0]
movups xmmword [rax + 0x1b0], xmm0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14000b38c
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b387
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bad0
call fcn.140026a10
lea r8, [rdi + rsi*8]
mov rdx, rdi
lea rcx, [rsp + 0x1c0]
call fcn.140014e10
nop
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x3c0]
call fcn.140007330
nop
lea rcx, [rsp + 0x1c0]
call fcn.14000ff10
mov qword [rsp + 0x1b0], r15
mov qword [rsp + 0x1b8], 6
cmp byte [rsp + 0x488], 0
je 0x14000bad6
movaps xmm0, xmmword [rsp + 0x1b0]
movdqa xmmword [rsp + 0x1b0], xmm0
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x3c0]
call fcn.140007750
mov rbx, qword [rax + 0x198]
cmp rbx, qword [rax + 0x1a0]
je 0x14000b45d
test rbx, rbx
je 0x14000bafe
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x14000bafe
add rcx, 8
lea rdx, [0x1400870a8]
call fcn.140028614
test eax, eax
jne 0x14000bafe
mov rdx, rbx
lea rcx, [rsp + 0x1e0]
call fcn.14000e590
jmp 0x14000b4af
cmp qword [rax + 0xa0], 0
je 0x14000bc6c
lea rbx, [rax + 0x68]
test rbx, rbx
je 0x14000bc67
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x14000bc67
add rcx, 8
lea rdx, [0x1400870a8]
call fcn.140028614
test eax, eax
jne 0x14000bc67
mov rdx, rbx
lea rcx, [rsp + 0x1e0]
call fcn.14000e590
nop
cmp qword [rsp + 0x1f0], 0x80
ja 0x14000bb04
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x221], xmm0
movups xmmword [rsp + 0x231], xmm0
movups xmmword [rsp + 0x241], xmm0
movups xmmword [rsp + 0x251], xmm0
movups xmmword [rsp + 0x261], xmm0
movups xmmword [rsp + 0x271], xmm0
movups xmmword [rsp + 0x281], xmm0
movups xmmword [rsp + 0x291], xmm0
mov byte [rsp + 0x2a1], al
mov qword [rsp + 0x1b0], r12
mov qword [rsp + 0x1b8], 9
cmp byte [rsp + 0x488], al
je 0x14000bb57
movaps xmm0, xmmword [rsp + 0x1b0]
movdqa xmmword [rsp + 0x1b0], xmm0
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x3c0]
call fcn.140007750
mov rbx, qword [rax + 0x198]
cmp rbx, qword [rax + 0x1a0]
je 0x14000b595
test rbx, rbx
je 0x14000bb7f
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x14000bb7f
add rcx, 8
lea rdx, [0x140087180]
call fcn.140028614
test eax, eax
jne 0x14000bb7f
jmp 0x14000b5d6
cmp qword [rax + 0xa0], 0
je 0x14000bc10
lea rbx, [rax + 0x68]
test rbx, rbx
je 0x14000bc0b
mov rcx, qword [rbx + 0x38]
and rcx, 0xfffffffffffffffc
je 0x14000bc0b
add rcx, 8
lea rdx, [0x140087180]
call fcn.140028614
test eax, eax
jne 0x14000bc0b
cmp byte [rbx], 1
sete byte [rsp + 0x220]
lea rdx, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 0x10
cmovae rdx, qword [rsp + 0x1e0]
lea rcx, [rsp + 0x1e0]
cmovae rcx, qword [rsp + 0x1e0]
mov r8, qword [rsp + 0x1f0]
add r8, rcx
sub r8, rdx
lea rcx, [rsp + 0x221]
call fcn.1400288c0
lea rdx, str._saving_the_ctx..
lea rcx, [0x140087da0]
call fcn.1400139e0
mov rcx, rax
call fcn.140014d80
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x2b0]
call fcn.140028f70
lea rcx, [rsp + 0x38]
call fcn.14000a220
nop
cmp qword [rax + 0x18], 0x10
jb 0x14000b66c
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x2b0]
call fcn.14000fce0
mov rax, qword [rsp + 0x2b0]
movsxd rcx, dword [rax + 4]
lea rbx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x2b0], rbx
mov rax, qword [rsp + 0x2b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x2ac], edx
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14000b6ed
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bb85
call fcn.140026a10
movdqa xmm0, xmmword [0x14007d260]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], 0
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x2b0]
call fcn.14000dad0
nop
mov rax, qword [rsp + 0x2b0]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x2b0], rbx
mov rax, qword [rsp + 0x2b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x2ac], edx
lea rcx, [rsp + 0x2b8]
call fcn.14000cc10
mov rax, qword [rsp + 0x2b0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x2b0], rax
mov rax, qword [rsp + 0x2b0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x2ac], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x358], rax
lea rcx, [rsp + 0x358]
call fcn.140025f5c
nop
lea rdx, str._setting_the_registry_keys_up
lea rcx, [0x140087da0]
call fcn.1400139e0
mov rcx, rax
call fcn.140014d80
call fcn.14000a570
lea rax, str.SeLoadDriverPrivilege
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 0x15
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], r14
mov ecx, 0x10
call fcn.140026a18
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1c8], rax
lea rbx, [rax + 0x10]
mov qword [rsp + 0x1d0], rbx
mov r8d, 0x10
lea rdx, [rsp + 0x1b0]
mov rcx, rax
call fcn.1400288c0
mov qword [rsp + 0x1c8], rbx
lea rcx, [rsp + 0x1c0]
call fcn.140004750
test al, al
je 0x14000bb8b
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rcx, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x1b8], rax
lea rcx, [rsp + 0x1b0]
call fcn.14000a8e0
cmp byte [rsp + 0x220], 1
jne 0x14000b986
lea rdx, str._removing_the_service
lea rcx, [0x140087da0]
call fcn.1400139e0
mov rcx, rax
call fcn.140014d80
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1c0], xmm0
mov qword [rsp + 0x1d0], rax
mov r8d, 0xf01ff
lea rdx, str.wsc_proxy
mov rbx, qword [rsp + 0x1b8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rcx, rax
test rax, rax
jne 0x14000b8fa
mov byte [rsp + 0x1d0], al
mov rcx, qword [rsp + 0x1c8]
jmp 0x14000b91a
mov rax, qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1c8], rcx
mov al, 1
mov byte [rsp + 0x1d0], al
test al, al
je 0x14000bbb4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x210], rax
mov dword [rsp + 0x218], eax
lea r8, [rsp + 0x200]
lea edx, [rax + 1]
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, qword [rsp + 0x1c8]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x14000bbdc
cmp byte [rsp + 0x1d0], 0
je 0x14000b98e
mov rcx, qword [rsp + 0x1c8]
test rcx, rcx
je 0x14000b984
call qword [rsp + 0x1c0]
nop
jmp 0x14000b98e
mov rbx, qword [rsp + 0x1b8]
lea rdx, str._done__thanks_for_using_the_no_defender_project_
lea rcx, [0x140087da0]
call fcn.1400139e0
mov rcx, rax
call fcn.140014d80
mov rcx, rax
call fcn.140014d80
lea rdx, str._please_dont_forget_to_leave_a_star_at_https:__github.com_es3n1n_no_defender
lea rcx, [0x140087da0]
call fcn.1400139e0
mov rcx, rax
call fcn.140014d80
cmp byte [rsp + 0x220], 0
jne 0x14000ba27
lea rdx, str._please_dont_remove_any_files_from_this_folder__otherwise_no_defender_wouldnt_be_activated_after_the_reboot_
lea rcx, [0x140087da0]
call fcn.1400139e0
mov rcx, rax
call fcn.140014d80
lea rdx, str._if_you_wish_to_change_the_folder__please_de_activate_no_defender__change_the_folder_and_activate_it_again
lea rcx, [0x140087da0]
call fcn.1400139e0
mov rcx, rax
call fcn.140014d80
lea rdx, str._to_de_activate_the_no_defender_please_run_no_defender.exe___disable
lea rcx, [0x140087da0]
call fcn.1400139e0
mov rcx, rax
call fcn.140014d80
call fcn.14000d2e0
nop
test rbx, rbx
je 0x14000ba3d
mov rcx, rbx
call qword [rsp + 0x1b0]
nop
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 0x10
jb 0x14000ba80
inc rdx
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bc05
call fcn.140026a10
movdqa xmm0, xmmword [0x14007d260]
movdqu xmmword [rsp + 0x1f0], xmm0
mov byte [rsp + 0x1e0], 0
lea rcx, [rsp + 0x3c0]
call fcn.14000bcd0
xor eax, eax
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.1400269f0
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x570
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400317c4
int3
lea rdx, str.Nothing_parsed__no_arguments_are_available.
lea rcx, [rsp + 0xc8]
call fcn.140002d40
lea rdx, [0x140084ce0]
lea rcx, [rsp + 0xc8]
call fcn.1400287c8
call fcn.140004910
nop
lea rax, str.Max_name_length_is__characters
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], 0x20
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x38]
call fcn.140015790
nop
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.140002db0
lea rdx, [0x140084d20]
lea rcx, [rsp + 0xe0]
call fcn.1400287c8
nop
lea rdx, str.Nothing_parsed__no_arguments_are_available.
lea rcx, [rsp + 0xf8]
call fcn.140002d40
lea rdx, [0x140084ce0]
lea rcx, [rsp + 0xf8]
call fcn.1400287c8
call fcn.140004910
nop
call fcn.1400317c4
nop
lea rdx, str.unable_to_acquire_privileges
lea rcx, [rsp + 0x110]
call fcn.140002e20
lea rdx, [0x140084d20]
lea rcx, [rsp + 0x110]
call fcn.1400287c8
nop
lea rdx, str.unable_to_open_wsc_proxy
lea rcx, [rsp + 0x128]
call fcn.140002e20
lea rdx, [0x140084d20]
lea rcx, [rsp + 0x128]
call fcn.1400287c8
lea rdx, str.unable_to_remove_wsc_proxy
lea rcx, [rsp + 0x140]
call fcn.140002e20
lea rdx, [0x140084d20]
lea rcx, [rsp + 0x140]
call fcn.1400287c8
nop
call fcn.1400317c4
nop
call fcn.140004910
mov rcx, rax
call fcn.140019fb0
mov r8, rax
lea rdx, str.No_value_provided_for_
lea rcx, [rsp + 0x38]
call fcn.140013ca0
nop
lea r8, [0x14007a254]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140013780
nop
mov rdx, rax
lea rcx, [rsp + 0x158]
call fcn.140002cd0
lea rdx, [0x140084ce0]
lea rcx, [rsp + 0x158]
call fcn.1400287c8
nop
call fcn.140004910
mov rcx, rax
call fcn.140019fb0
mov r8, rax
lea rdx, str.No_value_provided_for_
lea rcx, [rsp + 0x188]
call fcn.140013ca0
nop
lea r8, [0x14007a254]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140013780
nop
mov rdx, rax
lea rcx, [rsp + 0x170]
call fcn.140002cd0
lea rdx, [0x140084ce0]
lea rcx, [rsp + 0x170]
call fcn.1400287c8
int3