Function at 0x140001545
Capabilities:
Disable windows defender features via registry on windows
Execute command
Set registry value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
call dbg.__main
call sym.is_admin
xor eax, 1
test al, al
je 0x14000158d
mov r9d, 0x30
lea r8, str.Insufficient_Privileges
lea rax, str.Please_run_again_with_administrator_privileges.
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_MessageBoxA]
call rax
mov eax, 0
jmp 0x140001896
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
mov r8d, 0
lea rax, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
je 0x1400015de
lea rax, str.____failed_to_open_registry._n
mov rcx, rax
call sym.printf
call sym.getchar
mov eax, 0
jmp 0x140001896
mov dword [rbp - 0xc], 1
mov rax, qword [rbp - 8]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableAntiSpyware
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x14000163b
lea rax, str.____failed_to_write_to_registry._n
mov rcx, rax
call sym.printf
call sym.getchar
mov eax, 0
jmp 0x140001896
mov rax, qword [rbp - 8]
mov qword [rsp + 0x40], 0
lea rdx, [rbp - 0x18]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rdx, str.Real_Time_Protection
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call rax
test eax, eax
je 0x1400016ab
lea rax, str.____failed_to_create_new_key._n
mov rcx, rax
call sym.printf
call sym.getchar
mov eax, 0
jmp 0x140001896
mov rax, qword [rbp - 0x18]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableRealtimeMonitoring
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x140001709
lea rax, str.____failed_to_write_to_registry._n
mov rcx, rax
call sym.printf
call sym.getchar
mov eax, 0
jmp 0x140001896
mov rax, qword [rbp - 8]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableBehaviorMonitoring
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x14000175f
lea rax, str.____failed_to_write_to_registry._n
mov rcx, rax
call sym.printf
call sym.getchar
mov eax, 0
jmp 0x140001896
mov rax, qword [rbp - 8]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableOnAccessProtection
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x1400017b5
lea rax, str.____failed_to_write_to_registry._n
mov rcx, rax
call sym.printf
call sym.getchar
mov eax, 0
jmp 0x140001896
mov rax, qword [rbp - 8]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableScanOnRealtimeEnable
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x14000180b
lea rax, str.____failed_to_write_to_registry._n
mov rcx, rax
call sym.printf
call sym.getchar
mov eax, 0
jmp 0x140001896
mov rax, qword [rbp - 8]
mov dword [rsp + 0x28], 4
lea rdx, [rbp - 0xc]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, 0
lea rdx, str.DisableIOAVProtection
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
test eax, eax
je 0x14000185e
lea rax, str.____failed_to_write_to_registry._n
mov rcx, rax
call sym.printf
call sym.getchar
mov eax, 0
jmp 0x140001896
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, str.___registry_values_written_npress_any_key_to_restart_to_apply_them._n
mov rcx, rax
call sym.printf
call sym.getchar
lea rax, str.C:WindowsSystem32_shutdown__s__t_0
mov rcx, rax
call sym.system
mov eax, 1
add rsp, 0x70
pop rbp
ret