Function at 0x40ad19
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
mov edx, 9
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40ad21
call fcn.004644e0
mov edx, dword [esp + 0x3c]
lea ecx, [esp]
call fcn.00423000
push dword [esp]
mov edx, str.0419
pop ecx
call fcn.00423720
jne 0x40ad61
push dword [esp]
mov edx, 0x4befc6
pop ecx
call fcn.00423720
jne 0x40ad61
jmp 0x40ad68
mov eax, 1
jmp 0x40ad6a
xor eax, eax
and eax, eax
jne 0x40ad80
push dword [esp]
mov edx, 0x4befc0
pop ecx
call fcn.00423720
jne 0x40ad80
jmp 0x40ad87
mov eax, 1
jmp 0x40ad89
xor eax, eax
and eax, eax
je 0x40ad9d
mov edx, 0x4ca4f8
lea ecx, [esp + 0x18]
call fcn.00423008
jmp 0x40adab
mov edx, str.Disabling_and_enabling_Defender_in_this_version_of_the_program_requires_a_system_reboot._Perform_a_Defender_switchover__
lea ecx, [esp + 0x18]
call fcn.00423008
push dword [esp + 0x38]
push 0x34
push dword [esp + 0x20]
mov eax, str.Defender_Tools
push eax
call fcn.00409860
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
cmp ebx, 7
jne 0x40add7
xor eax, eax
jmp 0x40b69b
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0xc8
call fcn.00461d60
lea eax, [esp + 8]
push eax
call fcn.004643e0
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0xc8
call fcn.00461d60
lea eax, [esp + 0xc]
push eax
call fcn.004643e0
push 0xc8
mov eax, dword [esp + 8]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov eax, dword [esp + 0xc]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [esp + 4]
mov edx, str.AMD64
pop ecx
call fcn.00423720
jne 0x40ae6d
push dword [esp + 8]
mov edx, str.AMD64
pop ecx
call fcn.00423720
jne 0x40ae6d
jmp 0x40ae74
mov eax, 1
jmp 0x40ae76
xor eax, eax
and eax, eax
je 0x40ae8a
mov edx, 0x4c44ce
lea ecx, [esp + 0xc]
call fcn.00423008
jmp 0x40ae98
mov edx, 0x4c6520
lea ecx, [esp + 0xc]
call fcn.00423008
call fcn.0040f5ab
and eax, eax
je 0x40aec2
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
call fcn.0044cb28
lea eax, [esp + 0x14]
push eax
call fcn.004643e0
jmp 0x40aefe
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
call fcn.0043f577
call fcn.00423772
add dword [esp], edx
call fcn.0044ca5d
lea eax, [esp + 0x14]
push eax
call fcn.004643e0
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.loader.exe
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0044cadc
call fcn.00423790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.Disable.cmd
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0044cadc
call fcn.00423790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.Enable.cmd
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0044cadc
call fcn.00423790
push dword [esp + 0xc]
mov edx, 0x4c44ce
pop ecx
call fcn.00423720
je 0x40b034
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.loader.exe
push edx
call fcn.00464380
call fcn.00464470
push 0x6f
call fcn.00423772
add dword [esp + 4], edx
call fcn.0044d6d0
call fcn.00423790
and eax, eax
je 0x40b032
mov ebp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe____SystemRoot_System32_smartscreen.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender_
mov ebx, ebp
mov ebp, 0x4e5b56
sub ebx, ebp
push ebx
mov ebp, 0x4e5b56
push ebp
push 0x6f
call fcn.0044d920
push 0x6f
call fcn.0044d3d0
jmp 0x40b0a3
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.loader.exe
push edx
call fcn.00464380
call fcn.00464470
push 0x6f
call fcn.00423772
add dword [esp + 4], edx
call fcn.0044d6d0
call fcn.00423790
and eax, eax
je 0x40b0a3
mov ebp, 0x4e5b56
mov ebx, ebp
mov ebp, 0x4cc1de
sub ebx, ebp
push ebx
mov ebp, 0x4cc1de
push ebp
push 0x6f
call fcn.0044d920
push 0x6f
call fcn.0044d3d0
mov ebx, dword [esp + 0x34]
and ebx, ebx
jne 0x40b21d
mov ebx, dword [0x62c5d0]
and ebx, ebx
jne 0x40b16b
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.Disable.cmd
push edx
call fcn.00464380
call fcn.00464470
push 0x6f
call fcn.00423772
add dword [esp + 4], edx
call fcn.0044d6d0
call fcn.00423790
and eax, eax
je 0x40b166
mov ebp, 0x511f8b
mov ebx, ebp
mov ebp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe____SystemRoot_System32_smartscreen.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender_
sub ebx, ebp
push ebx
mov ebp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe____SystemRoot_System32_smartscreen.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender_
push ebp
push 0x6f
call fcn.0044d920
push 0x6f
call fcn.0044d3d0
push edx
call main
pop edx
push eax
mov edx, str._EXEFilename__Disable.cmd___WaitProcess_1__StartDirectory__
push edx
call fcn.00464380
mov edx, dword [esp + 0x14]
push edx
call fcn.00464380
mov edx, str.___WindowState_0__RunAs_8__Run
push edx
call fcn.00464380
lea eax, [esp + 0x24]
push eax
call fcn.004643e0
mov dword [esp + 0x14], 1
jmp 0x40b218
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.Disable.ps1
push edx
call fcn.00464380
call fcn.00464470
push 0x6f
call fcn.00423772
add dword [esp + 4], edx
call fcn.0044d6d0
call fcn.00423790
and eax, eax
je 0x40b218
mov ebp, 0x513b45
mov ebx, ebp
mov ebp, 0x513754
sub ebx, ebp
push ebx
mov ebp, 0x513754
push ebp
push 0x6f
call fcn.0044d920
push 0x6f
call fcn.0044d3d0
push edx
call main
pop edx
push eax
mov edx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
push edx
call fcn.00464380
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
call fcn.0044cb28
pop eax
mov edx, str.Disable.ps1_
push edx
call fcn.00464380
lea eax, [esp + 0x24]
push eax
call fcn.004643e0
jmp 0x40b386
mov ebx, dword [0x62c5d0]
and ebx, ebx
jne 0x40b2d9
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.Enable.cmd
push edx
call fcn.00464380
call fcn.00464470
push 0x6f
call fcn.00423772
add dword [esp + 4], edx
call fcn.0044d6d0
call fcn.00423790
and eax, eax
je 0x40b2d4
mov ebp, 0x513312
mov ebx, ebp
mov ebp, 0x511f8b
sub ebx, ebp
push ebx
mov ebp, 0x511f8b
push ebp
push 0x6f
call fcn.0044d920
push 0x6f
call fcn.0044d3d0
push edx
call main
pop edx
push eax
mov edx, str._EXEFilename__Enable.cmd___WaitProcess_1__StartDirectory__
push edx
call fcn.00464380
mov edx, dword [esp + 0x14]
push edx
call fcn.00464380
mov edx, str.___WindowState_0__RunAs_8__Run
push edx
call fcn.00464380
lea eax, [esp + 0x24]
push eax
call fcn.004643e0
mov dword [esp + 0x14], 0
jmp 0x40b386
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.Enable.ps1
push edx
call fcn.00464380
call fcn.00464470
push 0x6f
call fcn.00423772
add dword [esp + 4], edx
call fcn.0044d6d0
call fcn.00423790
and eax, eax
je 0x40b386
mov ebp, 0x513b45
mov ebx, ebp
mov ebp, 0x513754
sub ebx, ebp
push ebx
mov ebp, 0x513754
push ebp
push 0x6f
call fcn.0044d920
push 0x6f
call fcn.0044d3d0
push edx
call main
pop edx
push eax
mov edx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
push edx
call fcn.00464380
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
call fcn.0044cb28
pop eax
mov edx, str.Enable.ps1_
push edx
call fcn.00464380
lea eax, [esp + 0x24]
push eax
call fcn.004643e0
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.loader.exe
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0044c906
call fcn.00423790
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40b3d1
jl 0x40b3cd
cmp ebx, 0
ja 0x40b3d1
xor eax, eax
jmp 0x40b3d6
mov eax, 1
or eax, eax
je 0x40b5de
push edx
call main
pop edx
push eax
push 3
push dword [esp + 0x18]
push dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.loader.exe
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0043f616
call fcn.00423790
mov ebx, dword [esp + 0x14]
and ebx, ebx
jle 0x40b478
push 0x7d0
call fcn.0044aba5
push edx
call main
pop edx
push eax
push 3
push dword [esp + 0x18]
push dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.loader.exe
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0043f616
call fcn.00423790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.loader.exe
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0044cadc
call fcn.00423790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.Disable.cmd
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0044cadc
call fcn.00423790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.Enable.cmd
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0044cadc
call fcn.00423790
push dword [esp]
mov edx, str.0419
pop ecx
call fcn.00423720
jne 0x40b54e
push dword [esp]
mov edx, 0x4befc6
pop ecx
call fcn.00423720
jne 0x40b54e
jmp 0x40b555
mov eax, 1
jmp 0x40b557
xor eax, eax
and eax, eax
jne 0x40b56d
push dword [esp]
mov edx, 0x4befc0
pop ecx
call fcn.00423720
jne 0x40b56d
jmp 0x40b574
mov eax, 1
jmp 0x40b576
xor eax, eax
and eax, eax
je 0x40b58a
mov edx, 0x4c110e
lea ecx, [esp + 0x18]
call fcn.00423008
jmp 0x40b598
mov edx, str.You_must_restart_the_computer_to_complete_the_operation._Perform_a_reboot_now__
lea ecx, [esp + 0x18]
call fcn.00423008
push dword [esp + 0x38]
push 0x34
push dword [esp + 0x20]
mov eax, str.Defender_Tools
push eax
call fcn.00409860
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
cmp ebx, 6
jne 0x40b5de
push 2
mov eax, 0x4bd050
push eax
mov eax, str._r__f__t_0
push eax
mov eax, str.shutdown.exe
push eax
call fcn.0043f616
jmp 0x40820c
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.loader.exe
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0044cadc
call fcn.00423790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.Disable.cmd
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0044cadc
call fcn.00423790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00464380
mov edx, str.Enable.cmd
push edx
call fcn.00464380
call fcn.00423772
add dword [esp], edx
call fcn.0044cadc
call fcn.00423790
mov eax, 1
jmp 0x40b69b
push dword [esp]
call fcn.00464570
push dword [esp + 0x10]
call fcn.00464570
push dword [esp + 8]
call fcn.00464570
push dword [esp + 0xc]
call fcn.00464570
push dword [esp + 0x20]
call fcn.00464570
push dword [esp + 0x18]
call fcn.00464570
push dword [esp + 4]
call fcn.00464570
add esp, 0x24
pop edi
pop ebx
pop ebp
ret 0xc