Function at 0x4028ae
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4028b6
call fcn.00426350
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.0040c000
push dword [esp]
mov edx, str.0419
pop ecx
call fcn.0040c970
jne 0x4028f6
push dword [esp]
mov edx, 0x472aa6
pop ecx
call fcn.0040c970
jne 0x4028f6
jmp 0x4028fd
mov eax, 1
jmp 0x4028ff
xor eax, eax
and eax, eax
jne 0x402915
push dword [esp]
mov edx, 0x472aa0
pop ecx
call fcn.0040c970
jne 0x402915
jmp 0x40291c
mov eax, 1
jmp 0x40291e
xor eax, eax
and eax, eax
je 0x402932
mov edx, 0x475b42
lea ecx, [esp + 0x14]
call fcn.0040c008
jmp 0x402940
mov edx, str.Disabling_and_enabling_Defender_in_this_version_of_the_program_requires_a_system_reboot._Perform_a_Defender_switchover__
lea ecx, [esp + 0x14]
call fcn.0040c008
push dword [esp + 0x34]
push 0x34
push dword [esp + 0x1c]
mov eax, str.Defender_Tools
push eax
call fcn.00402705
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
cmp ebx, 7
jne 0x40296c
xor eax, eax
jmp 0x403111
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0xc8
call fcn.00423a90
lea eax, [esp + 8]
push eax
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push 0xc8
call fcn.00423a90
lea eax, [esp + 0xc]
push eax
call fcn.004261f0
push 0xc8
mov eax, dword [esp + 8]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov eax, dword [esp + 0xc]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [esp + 4]
mov edx, str.AMD64
pop ecx
call fcn.0040c970
jne 0x402a02
push dword [esp + 8]
mov edx, str.AMD64
pop ecx
call fcn.0040c970
jne 0x402a02
jmp 0x402a09
mov eax, 1
jmp 0x402a0b
xor eax, eax
and eax, eax
je 0x402a1f
mov edx, 0x4740dc
lea ecx, [esp + 0xc]
call fcn.0040c008
jmp 0x402a2d
mov edx, 0x4749f6
lea ecx, [esp + 0xc]
call fcn.0040c008
call fcn.00403fc3
and eax, eax
je 0x402a57
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
call fcn.0041a7d5
lea eax, [esp + 0x14]
push eax
call fcn.004261f0
jmp 0x402a93
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
call fcn.0040d82b
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a838
lea eax, [esp + 0x14]
push eax
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.loader.exe
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a8b7
call fcn.0040c9e0
push edx
call fcn.004261b0
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.Disable.cmd
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a8b7
call fcn.0040c9e0
push edx
call fcn.004261b0
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.Enable.cmd
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a8b7
call fcn.0040c9e0
push dword [esp + 0xc]
mov edx, 0x4740dc
pop ecx
call fcn.0040c970
je 0x402bc9
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.loader.exe
push edx
call fcn.00426280
call fcn.004262e0
push 0x6f
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0041b470
call fcn.0040c9e0
and eax, eax
je 0x402bc7
mov ebp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableOnAccessProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableRealtimeMonitoring___t_REG_DWORD
mov ebx, ebp
mov ebp, 0x48ff0e
sub ebx, ebp
push ebx
mov ebp, 0x48ff0e
push ebp
push 0x6f
call fcn.0041b890
push 0x6f
call fcn.0041b180
jmp 0x402c38
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.loader.exe
push edx
call fcn.00426280
call fcn.004262e0
push 0x6f
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0041b470
call fcn.0040c9e0
and eax, eax
je 0x402c38
mov ebp, 0x48ff0e
mov ebx, ebp
mov ebp, 0x476596
sub ebx, ebp
push ebx
mov ebp, 0x476596
push ebp
push 0x6f
call fcn.0041b890
push 0x6f
call fcn.0041b180
mov ebx, dword [esp + 0x30]
and ebx, ebx
jne 0x402daa
mov ebx, dword [0x5064b4]
and ebx, ebx
jne 0x402cf8
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.Disable.cmd
push edx
call fcn.00426280
call fcn.004262e0
push 0x6f
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0041b470
call fcn.0040c9e0
and eax, eax
je 0x402cf3
mov ebp, 0x4bc0b0
mov ebx, ebp
mov ebp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableOnAccessProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableRealtimeMonitoring___t_REG_DWORD
sub ebx, ebp
push ebx
mov ebp, str._Echo_off_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_LEQ_7601_goto_:WIN7_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9200_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_EQU_9600_goto_:WIN8_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_10240_goto_:WIN10_r_n_r_n:WIN7_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindows_DefenderMP_Scheduled_Scan___Disable_r_n_r_ngoto_:END_r_n_r_n:WIN8_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdBoot___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisDrv___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWdNisSvc___v__Start___t_REG_DWORD__d__0x4___f_r_nReg.exe_add__HKLMSYSTEMCurrentControlSetServicesWinDefend___v__Start___t_REG_DWORD__d__0x4___f_r_n_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cache_Maintenance___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Cleanup___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Scheduled_Scan___Disable_r_nSCHTASKS.exe__Change__TN__MicrosoftWindowsWindows_DefenderWindows_Defender_Verification___Disable_r_n_r_nfor___i_in___r_n___ProgramFiles_Windows_DefenderMsMpEng.exe__r_n__do___r_n_takeown.exe__f___i__a_r_n_icacls.exe___i__reset_r_n_icacls.exe___i__inheritance:r_r_n__r_n_r_ngoto_:END_r_n_r_n:WIN10_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderFeatures___v__TamperProtection___t_REG_DWORD__d__0x0___f_r_nfor__f__tokens6_delims__._____G_in__ver__do_if___G_GEQ_22621_Reg.exe_add__HKLMSYSTEMCurrentControlSetControlCIPolicy___v__VerifiedAndReputablePolicyState___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_Defender___v__PUAProtection___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREMicrosoftWindows_DefenderMpEngine___v__MpEnablePus___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__AllowFastServiceStartup___t_REG_DWORD__d__0x0___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v__ServiceKeepAlive___t_REG_DWORD__d__0x0___f_r_nReg.exe_query__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___nul_2_1__Reg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___f__Reg.exe_delete__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderPolicy_Manager___ve__f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableBehaviorMonitoring___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableIOAVProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableOnAccessProtection___t_REG_DWORD__d__0x1___f_r_nReg.exe_add__HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_Time_Protection___v__DisableRealtimeMonitoring___t_REG_DWORD
push ebp
push 0x6f
call fcn.0041b890
push 0x6f
call fcn.0041b180
push edx
call fcn.004261b0
pop edx
push eax
mov edx, str._EXEFilename__Disable.cmd___WaitProcess_1__StartDirectory__
push edx
call fcn.00426280
mov edx, dword [esp + 0x14]
push edx
call fcn.00426280
mov edx, str.___WindowState_0__RunAs_8__Run
push edx
call fcn.00426280
lea eax, [esp + 0x20]
push eax
call fcn.004261f0
jmp 0x402da5
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.Disable.ps1
push edx
call fcn.00426280
call fcn.004262e0
push 0x6f
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0041b470
call fcn.0040c9e0
and eax, eax
je 0x402da5
mov ebp, 0x4bda09
mov ebx, ebp
mov ebp, 0x4bd618
sub ebx, ebp
push ebx
mov ebp, 0x4bd618
push ebp
push 0x6f
call fcn.0041b890
push 0x6f
call fcn.0041b180
push edx
call fcn.004261b0
pop edx
push eax
mov edx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
push edx
call fcn.00426280
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
call fcn.0041a7d5
pop eax
mov edx, str.Disable.ps1_
push edx
call fcn.00426280
lea eax, [esp + 0x20]
push eax
call fcn.004261f0
jmp 0x402f0b
mov ebx, dword [0x5064b4]
and ebx, ebx
jne 0x402e5e
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.Enable.cmd
push edx
call fcn.00426280
call fcn.004262e0
push 0x6f
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0041b470
call fcn.0040c9e0
and eax, eax
je 0x402e59
mov ebp, 0x4bd1d6
mov ebx, ebp
mov ebp, 0x4bc0b0
sub ebx, ebp
push ebx
mov ebp, 0x4bc0b0
push ebp
push 0x6f
call fcn.0041b890
push 0x6f
call fcn.0041b180
push edx
call fcn.004261b0
pop edx
push eax
mov edx, 0x47285c
push edx
call fcn.00426280
mov edx, dword [esp + 0x14]
push edx
call fcn.00426280
mov edx, str.___WindowState_0__RunAs_8__Run
push edx
call fcn.00426280
lea eax, [esp + 0x20]
push eax
call fcn.004261f0
jmp 0x402f0b
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.Enable.ps1
push edx
call fcn.00426280
call fcn.004262e0
push 0x6f
call fcn.0040c9c2
add dword [esp + 4], edx
call fcn.0041b470
call fcn.0040c9e0
and eax, eax
je 0x402f0b
mov ebp, 0x4bda09
mov ebx, ebp
mov ebp, 0x4bd618
sub ebx, ebp
push ebx
mov ebp, 0x4bd618
push ebp
push 0x6f
call fcn.0041b890
push 0x6f
call fcn.0041b180
push edx
call fcn.004261b0
pop edx
push eax
mov edx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
push edx
call fcn.00426280
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.004261b0
pop edx
push eax
call fcn.0041a7d5
pop eax
mov edx, str.Enable.ps1_
push edx
call fcn.00426280
lea eax, [esp + 0x20]
push eax
call fcn.004261f0
push edx
call fcn.004261b0
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.loader.exe
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a66e
call fcn.0040c9e0
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x402f56
jl 0x402f52
cmp ebx, 0
ja 0x402f56
xor eax, eax
jmp 0x402f5b
mov eax, 1
or eax, eax
je 0x403054
push edx
call fcn.004261b0
pop edx
push eax
push 3
push dword [esp + 0x18]
push dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.loader.exe
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0040d8ca
call fcn.0040c9e0
push dword [esp]
mov edx, str.0419
pop ecx
call fcn.0040c970
jne 0x402fc9
push dword [esp]
mov edx, 0x472aa6
pop ecx
call fcn.0040c970
jne 0x402fc9
jmp 0x402fd0
mov eax, 1
jmp 0x402fd2
xor eax, eax
and eax, eax
jne 0x402fe8
push dword [esp]
mov edx, 0x472aa0
pop ecx
call fcn.0040c970
jne 0x402fe8
jmp 0x402fef
mov eax, 1
jmp 0x402ff1
xor eax, eax
and eax, eax
je 0x403005
mov edx, 0x473346
lea ecx, [esp + 0x14]
call fcn.0040c008
jmp 0x403013
mov edx, str.You_must_restart_the_computer_to_complete_the_operation._Perform_a_reboot_now__
lea ecx, [esp + 0x14]
call fcn.0040c008
push dword [esp + 0x34]
push 0x34
push dword [esp + 0x1c]
mov eax, str.Defender_Tools
push eax
call fcn.00402705
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
cmp ebx, 6
jne 0x403054
push 3
mov eax, 0x472028
push eax
mov eax, str._r__f__t_0
push eax
mov eax, str.shutdown.exe
push eax
call fcn.0040d8ca
push edx
call fcn.004261b0
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.loader.exe
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a8b7
call fcn.0040c9e0
push edx
call fcn.004261b0
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.Disable.cmd
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a8b7
call fcn.0040c9e0
push edx
call fcn.004261b0
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call fcn.004261b0
pop edx
push eax
push edx
call fcn.00426280
mov edx, str.Enable.cmd
push edx
call fcn.00426280
call fcn.0040c9c2
add dword [esp], edx
call fcn.0041a8b7
call fcn.0040c9e0
mov eax, 1
jmp 0x403111
push dword [esp]
call fcn.004263b0
push dword [esp + 0x10]
call fcn.004263b0
push dword [esp + 8]
call fcn.004263b0
push dword [esp + 0xc]
call fcn.004263b0
push dword [esp + 0x1c]
call fcn.004263b0
push dword [esp + 0x14]
call fcn.004263b0
push dword [esp + 4]
call fcn.004263b0
add esp, 0x20
pop edi
pop ebx
pop ebp
ret 0xc