Function at 0x1402c9900
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
xor ebx, ebx
mov dword [rbp + 0x28], ebx
mov edi, ebx
mov qword [rbp - 0x10], rbx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Advanced_Threat_Protection
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1402c9946
mov eax, ebx
mov rdi, qword [rbp - 0x10]
test eax, eax
jne 0x1402c99a8
mov dword [rbp + 0x28], ebx
mov dword [rbp + 0x30], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x38]
xor r8d, r8d
lea rdx, str.ForceDefenderPassiveMode
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1402c99a8
cmp dword [rbp + 0x38], 4
jne 0x1402c99a8
cmp dword [rbp + 0x28], eax
je 0x1402c99a8
test rdi, rdi
je 0x1402c9a49
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
test rdi, rdi
je 0x1402c99b7
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rbp - 0x10], rbx
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesWinDefend
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1402c99eb
mov eax, ebx
mov rbx, qword [rbp - 0x10]
test eax, eax
jne 0x1402c9a53
mov dword [rbp + 0x28], 2
mov dword [rbp + 0x30], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x38]
xor r8d, r8d
lea rdx, str.Start
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1402c9a53
cmp dword [rbp + 0x38], 4
jne 0x1402c9a53
mov eax, dword [rbp + 0x28]
add eax, 0xfffffffd
cmp eax, 1
ja 0x1402c9a53
test rbx, rbx
je 0x1402c9a49
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
test rbx, rbx
je 0x1402c9a61
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x10]
call fcn.1402c9e30
nop
mov rdx, rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::constructor_class_QString_const____ptr64____ptr64]
mov dword [rbp + 0x28], 2
mov r8d, 0xffffffff
lea rdx, str._Windows_Defender_MpCmdRun.exe
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const____ptr64__int_]
nop
mov rdx, rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_class_QString____ptr64___cdecl_QString::append_class_QString_const____ptr64____ptr64]
nop
lea rcx, [rbp + 0x38]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_static_bool___cdecl_QFile::exists_class_QString_const____ptr64_]
movzx ebx, al
lea rcx, [rbp + 0x30]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
movzx eax, bl
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret