Function at 0x140012e41
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140012e5a
sub rsp, 0x28
call fcn.1400928f0
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400929c0
add rsp, 0x10
mov r15, qword [rsp + 0x80]
and r15, r15
jne 0x140012f78
push qword [rsp + 0x28]
movabs rcx, str.0419
pop rdx
call fcn.140092760
or rax, rax
jne 0x140012ed3
push qword [rsp + 0x28]
movabs rcx, 0x140105120
pop rdx
call fcn.140092760
or rax, rax
jne 0x140012ed3
jmp 0x140012edc
mov rax, 1
jmp 0x140012edf
xor rax, rax
and rax, rax
jne 0x140012eff
push qword [rsp + 0x28]
movabs rcx, 0x14010511a
pop rdx
call fcn.140092760
or rax, rax
jne 0x140012eff
jmp 0x140012f08
mov rax, 1
jmp 0x140012f0b
xor rax, rax
and rax, rax
je 0x140012f26
movabs rdx, 0x14010e514
lea rcx, [rsp + 0x48]
call fcn.1400924d0
jmp 0x140012f3a
movabs rdx, str.Disabling_Defender_in_this_version_of_the_program_requires_a_system_restart._Perform_Defender_Switch__
lea rcx, [rsp + 0x48]
call fcn.1400924d0
push qword [rsp + 0x88]
push reloc.WS2_32.dll_gethostbyname
push qword [rsp + 0x58]
movabs rax, str.Defender_Tools
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.140010772
mov qword [rsp + 0x50], rax
mov r15, qword [rsp + 0x50]
cmp r15, 7
jne 0x140012f78
xor rax, rax
jmp 0x14001396e
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14008f5b0
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.140092680
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14008f5b0
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140092680
push 0xc8
mov rax, qword [rsp + 0x38]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push 0xc8
mov rax, qword [rsp + 0x40]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.DLL_GetEnvironmentVariableW
push qword [rsp + 0x30]
movabs rcx, str.AMD64
pop rdx
call fcn.140092760
or rax, rax
jne 0x140013076
push qword [rsp + 0x38]
movabs rcx, str.AMD64
pop rdx
call fcn.140092760
or rax, rax
jne 0x140013076
jmp 0x14001307f
mov rax, 1
jmp 0x140013082
xor rax, rax
and rax, rax
je 0x14001309d
movabs rdx, 0x14010b4ec
lea rcx, [rsp + 0x40]
call fcn.1400924d0
jmp 0x1400130b1
movabs rdx, 0x14010da7a
lea rcx, [rsp + 0x40]
call fcn.1400924d0
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x20
movabs rcx, str.loader.exe
sub rsp, 0x20
call fcn.140092610
add rsp, 0x20
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400740c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
push qword [rsp + 0x40]
movabs rcx, 0x14010b4ec
pop rdx
call fcn.140092760
or rax, rax
je 0x14001323d
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x28
movabs rcx, str.loader.exe
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
push WSAStartup
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140074f20
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
and rax, rax
je 0x140013238
movabs rbp, str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
mov r15, rbp
movabs rbp, 0x140133a12
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140133a12
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.140075260
push WSAStartup
pop rcx
call fcn.140074bb0
jmp 0x14001331c
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x28
movabs rcx, str.loader.exe
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
push WSAStartup
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140074f20
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
and rax, rax
je 0x14001331c
movabs rbp, 0x140133a12
mov r15, rbp
movabs rbp, 0x140113e12
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140113e12
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.140075260
push WSAStartup
pop rcx
call fcn.140074bb0
mov r15, qword [rsp + 0x80]
and r15, r15
jne 0x140013595
mov r15, qword [0x140319ebc]
and r15, r15
jne 0x140013435
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x28
movabs rcx, str.Disable.cmd
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
push WSAStartup
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140074f20
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
and rax, rax
je 0x140013430
movabs rbp, 0x14015b47c
mov r15, rbp
movabs rbp, str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
sub r15, rbp
mov rax, r15
push rax
movabs rbp, str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.140075260
push WSAStartup
pop rcx
call fcn.140074bb0
movabs rdx, str._U:T__P:E__ShowWindowMode:Hide__Wait_Disable.cmd
lea rcx, [rsp + 0x58]
call fcn.1400924d0
jmp 0x140013590
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x28
movabs rcx, str.Disable.ps1
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
push WSAStartup
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140074f20
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
and rax, rax
je 0x140013590
movabs rbp, 0x14015c0d5
mov r15, rbp
movabs rbp, 0x14015bce4
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14015bce4
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.140075260
push WSAStartup
pop rcx
call fcn.140074bb0
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x20
pop rax
movabs rcx, str.Disable.ps1_
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
lea rcx, [rsp + 0x60]
pop rdx
call fcn.140092680
jmp 0x1400137f8
mov r15, qword [0x140319ebc]
and r15, r15
jne 0x14001369d
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x28
movabs rcx, str.Enable.cmd
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
push WSAStartup
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140074f20
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
and rax, rax
je 0x140013698
movabs rbp, 0x14015b8a2
mov r15, rbp
movabs rbp, 0x14015b47c
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14015b47c
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.140075260
push WSAStartup
pop rcx
call fcn.140074bb0
movabs rdx, str._U:T__P:E__ShowWindowMode:Hide__Wait_Enable.cmd
lea rcx, [rsp + 0x58]
call fcn.1400924d0
jmp 0x1400137f8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x28
movabs rcx, str.Enable.ps1
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
call fcn.140092820
push WSAStartup
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140074f20
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
and rax, rax
je 0x1400137f8
movabs rbp, 0x14015c0d5
mov r15, rbp
movabs rbp, 0x14015bce4
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14015bce4
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.140075260
push WSAStartup
pop rcx
call fcn.140074bb0
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
movabs rcx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x20
pop rax
movabs rcx, str.Enable.ps1_
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
lea rcx, [rsp + 0x60]
pop rdx
call fcn.140092680
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x28
movabs rcx, str.loader.exe
sub rsp, 0x28
call fcn.140092610
add rsp, 0x28
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.140073d70
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140013962
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x20
call fcn.140092820
push qword [rsp + 0x78]
push rcx
sub rsp, 0x20
call fcn.1400925c0
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.1400925c0
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140074588
add rsp, 0x20
movabs rcx, str.loader.exe
sub rsp, 0x20
call fcn.140092610
add rsp, 0x20
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp], rdx
push rax
call fcn.1400927f0
mov rdx, rax
pop rax
add qword [rsp + 0x10], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400626b4
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140041f24
add rsp, 0x28
pop rax
mov rax, 1
jmp 0x14001396e
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140092990
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140092990
add rsp, 0x28
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.140092990
add rsp, 0x28
mov rcx, qword [rsp + 0x60]
sub rsp, 0x28
call fcn.140092990
add rsp, 0x28
mov rcx, qword [rsp + 0x50]
sub rsp, 0x28
call fcn.140092990
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140092990
add rsp, 0x28
pop rax
add rsp, 0x68
pop r15
pop rbp
ret