Function at 0x140004320
Capabilities:
Disable firewall features via registry on windows
Disable system features via registry on windows
Disable system restore features via registry on windows
Disable windows defender features via registry on windows
Persist via windows service
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x230]
sub rsp, 0x330
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x380], rbx
mov rax, qword [0x1400c0140]
xor rax, rsp
mov qword [rbp + 0x220], rax
mov qword [rsp + 0x68], rdx
mov qword [rbp - 0x70], rcx
xor r12d, r12d
mov r14d, r12d
mov dword [rsp + 0x58], r12d
mov dword [rsp + 0x50], r12d
mov r13d, r12d
mov r15d, r12d
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], r12
mov word [rbp - 0x38], r12w
mov qword [rbp + 8], 7
mov qword [rbp], r12
mov word [rbp - 0x10], r12w
xor r8d, r8d
lea rdx, [0x14008db30]
lea rcx, [rbp - 0x10]
call fcn.140001780
nop
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r12
mov word [rbp - 0x60], r12w
xor r8d, r8d
lea rdx, [0x14008db30]
lea rcx, [rbp - 0x60]
call fcn.140001780
nop
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], r12
mov word [rbp + 0x18], r12w
xor r8d, r8d
lea rdx, [0x14008db30]
lea rcx, [rbp + 0x18]
call fcn.140001780
nop
mov qword [rbp + 0x58], 7
mov qword [rbp + 0x50], r12
mov word [rbp + 0x40], r12w
lea r8d, [r12 + 1]
lea rdx, [0x14008dcf0]
lea rcx, [rbp + 0x40]
call fcn.140001780
nop
lea r9, str.Shell
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x68]
call fcn.14001e270
mov rbx, rax
lea rax, [rbp - 0x10]
cmp rax, rbx
je 0x1400044b6
cmp qword [rbp + 8], 8
jb 0x14000445c
mov rcx, qword [rbp - 0x10]
call fcn.140063290
mov qword [rbp + 8], 7
mov qword [rbp], r12
mov word [rbp - 0x10], r12w
cmp qword [rbx + 0x18], 8
jae 0x14000448c
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp - 0x10]
call fcn.1400632b0
jmp 0x140004496
mov rax, qword [rbx]
mov qword [rbp - 0x10], rax
mov qword [rbx], r12
mov rax, qword [rbx + 0x10]
mov qword [rbp], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp + 8], rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
cmp qword [rbp + 0x80], 8
jb 0x1400044c9
mov rcx, qword [rbp + 0x68]
call fcn.140063290
or rsi, 0xffffffffffffffff
cmp qword [rbp], 0
je 0x140004927
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x60]
call fcn.1400015e0
lea r14d, [rsi + 2]
mov r10, qword [rbp + 0x50]
mov r11, qword [rbp - 0x50]
nop word [rax + rax]
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rbx, qword [rbp + 0x40]
test r10, r10
jne 0x14000451b
mov rdi, r12
jmp 0x1400045ec
test r11, r11
je 0x1400047c6
cmp r10, r11
ja 0x1400047c6
sub r11, r10
inc r11
lea r9, [rbp - 0x60]
mov rsi, qword [rbp - 0x60]
mov r12, qword [rbp - 0x48]
cmp r12, 8
cmovae r9, rsi
nop word [rax + rax]
mov rax, r11
mov rdi, r9
test r11, r11
je 0x1400047c3
movzx ecx, word [rbx]
cmp word [rdi], cx
je 0x140004576
add rdi, 2
dec rax
je 0x1400047c3
jmp 0x140004562
test rdi, rdi
je 0x1400047c3
mov rcx, r10
mov rdx, rbx
mov r8, rdi
test r10, r10
je 0x1400045cd
movzx eax, word [rdx]
cmp word [r8], ax
jne 0x1400045a3
add r8, 2
add rdx, 2
dec rcx
jmp 0x14000458b
mov ecx, r14d
cmp word [r8], ax
mov rax, 0xffffffffffffffff
cmovb ecx, eax
test ecx, ecx
je 0x1400045cd
mov rcx, rdi
sub rcx, r9
sar rcx, 1
sub rax, rcx
add r11, rax
lea r9, [rdi + 2]
jmp 0x140004550
lea rax, [rbp - 0x60]
cmp r12, 8
cmovae rax, rsi
sub rdi, rax
sar rdi, 1
xor r12d, r12d
cmp rdi, 0xffffffffffffffff
je 0x1400047c6
mov r9, rdi
xor r8d, r8d
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.140011820
mov rbx, rax
lea rax, [rbp - 0x38]
cmp rax, rbx
je 0x140004675
cmp qword [rbp - 0x20], 8
jb 0x14000461b
mov rcx, qword [rbp - 0x38]
call fcn.140063290
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], r12
mov word [rbp - 0x38], r12w
cmp qword [rbx + 0x18], 8
jae 0x14000464b
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp - 0x38]
call fcn.1400632b0
jmp 0x140004655
mov rax, qword [rbx]
mov qword [rbp - 0x38], rax
mov qword [rbx], r12
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x28], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x20], rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
cmp qword [rbp + 0x80], 8
jb 0x140004688
mov rcx, qword [rbp + 0x68]
call fcn.140063290
call fcn.1400420e8
mov rbx, rax
mov qword [rbp - 0x80], rax
call fcn.140041f78
mov rsi, rax
xor edx, edx
lea rcx, [rbp - 0x78]
call fcn.140041dec
mov rax, qword [rsi + 8]
cmp rax, 0xffffffffffffffff
jae 0x1400046b8
inc rax
mov qword [rsi + 8], rax
lea rcx, [rbp - 0x78]
call fcn.140041e1c
nop
mov qword [rsp + 0x70], rbx
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.140041dec
mov rax, qword [rbx + 8]
cmp rax, 0xffffffffffffffff
jae 0x1400046e4
inc rax
mov qword [rbx + 8], rax
lea rcx, [rsp + 0x78]
call fcn.140041e1c
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x38]
call fcn.14001aa10
test al, al
sete r12b
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140041dec
mov rax, qword [rbx + 8]
test rax, rax
je 0x140004724
cmp rax, 0xffffffffffffffff
jae 0x140004724
dec rax
mov qword [rbx + 8], rax
xor esi, esi
cmp qword [rbx + 8], rsi
cmove rsi, rbx
lea rcx, [rsp + 0x60]
call fcn.140041e1c
test rsi, rsi
je 0x140004748
mov rax, qword [rsi]
mov edx, r14d
mov rcx, rsi
call qword [rax]
test r12b, r12b
cmovne r13d, r14d
mov r10, qword [rbp + 0x50]
lea rbx, [r10 + rdi]
mov r11, qword [rbp - 0x50]
cmp r11, rbx
cmovb rbx, r11
test rbx, rbx
mov r12d, 0
je 0x140004500
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x48]
cmp rax, 8
cmovae rdx, rcx
lea r9, [rbp - 0x60]
cmovae r9, rcx
sub r11, rbx
lea r8, [r11 + r11]
lea rdx, [rdx + rbx*2]
mov rcx, r9
call fcn.1400632b0
mov r11, qword [rbp - 0x50]
sub r11, rbx
mov qword [rbp - 0x50], r11
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rax, qword [rbp - 0x60]
mov word [rax + r11*2], r12w
jmp 0x1400044ef
xor r12d, r12d
call fcn.1400420e8
mov rbx, rax
mov qword [rbp - 0x80], rax
call fcn.140041f78
mov rdi, rax
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140041dec
mov rax, qword [rdi + 8]
cmp rax, 0xffffffffffffffff
mov r14d, dword [rsp + 0x58]
jae 0x1400047fc
inc rax
mov qword [rdi + 8], rax
lea rcx, [rsp + 0x60]
call fcn.140041e1c
nop
mov qword [rsp + 0x70], rbx
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140041dec
mov rax, qword [rbx + 8]
cmp rax, 0xffffffffffffffff
jae 0x140004829
inc rax
mov qword [rbx + 8], rax
lea rcx, [rsp + 0x58]
call fcn.140041e1c
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x60]
call fcn.14001aa10
test al, al
sete sil
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140041dec
mov rax, qword [rbx + 8]
test rax, rax
je 0x140004869
cmp rax, 0xffffffffffffffff
jae 0x140004869
dec rax
mov qword [rbx + 8], rax
mov rdi, r12
cmp qword [rbx + 8], 0
cmove rdi, rbx
lea rcx, [rsp + 0x58]
call fcn.140041e1c
test rdi, rdi
je 0x140004891
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
test sil, sil
jne 0x1400048a0
cmp r13d, 1
jne 0x140004a16
lea rdx, str._r_n__Modified_HKLM...Winlogon:__Shell___
mov r13, qword [rsp + 0x68]
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x10]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x1400048f9
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x140004a1b
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14000491a
or edx, 4
xor r8d, r8d
call fcn.140003090
jmp 0x140004a1b
lea rdx, str._r_n__Empty_HKLM...Winlogon:__Shell___Value_reset_to_explorer.exe_r_n
mov r13, qword [rsp + 0x68]
mov rcx, r13
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x140004965
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14000498a
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140004982
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140004a09
mov edx, 0x1000
lea rbx, [0x14008de90]
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Shell
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140004a1f
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140004a1f
mov r13, qword [rsp + 0x68]
or rsi, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [0x14008db30]
lea rcx, [rbp - 0x60]
call fcn.140001780
xor r8d, r8d
lea rdx, [0x14008db30]
lea rcx, [rbp - 0x38]
call fcn.140001780
lea r9, str.Shell
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, 0xffffffff80000001
lea rcx, [rbp + 0x68]
call fcn.14001e270
mov rbx, rax
lea rax, [rbp + 0x18]
cmp rax, rbx
je 0x140004ad9
cmp qword [rbp + 0x30], 8
jb 0x140004a7f
mov rcx, qword [rbp + 0x18]
call fcn.140063290
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], r12
mov word [rbp + 0x18], r12w
cmp qword [rbx + 0x18], 8
jae 0x140004aaf
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp + 0x18]
call fcn.1400632b0
jmp 0x140004ab9
mov rax, qword [rbx]
mov qword [rbp + 0x18], rax
mov qword [rbx], r12
mov rax, qword [rbx + 0x10]
mov qword [rbp + 0x28], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp + 0x30], rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
cmp qword [rbp + 0x80], 8
jb 0x140004aec
mov rcx, qword [rbp + 0x68]
call fcn.140063290
cmp qword [rbp + 0x28], 0
je 0x140004f37
mov r9, rsi
xor r8d, r8d
lea rdx, [rbp + 0x18]
lea rcx, [rbp - 0x60]
call fcn.1400015e0
mov r13d, 1
mov r10, qword [rbp + 0x50]
mov r11, qword [rbp - 0x50]
nop dword [rax + rax]
lea rbx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rbx, qword [rbp + 0x40]
test r10, r10
jne 0x140004b3b
mov rdi, r12
jmp 0x140004c0c
test r11, r11
je 0x140004de8
cmp r10, r11
ja 0x140004de8
sub r11, r10
inc r11
lea r9, [rbp - 0x60]
mov rsi, qword [rbp - 0x60]
mov r12, qword [rbp - 0x48]
cmp r12, 8
cmovae r9, rsi
nop word [rax + rax]
mov rax, r11
mov rdi, r9
test r11, r11
je 0x140004de5
movzx ecx, word [rbx]
cmp word [rdi], cx
je 0x140004b96
add rdi, 2
dec rax
je 0x140004de5
jmp 0x140004b82
test rdi, rdi
je 0x140004de5
mov rcx, r10
mov rdx, rbx
mov r8, rdi
test r10, r10
je 0x140004bed
movzx eax, word [rdx]
cmp word [r8], ax
jne 0x140004bc3
add r8, 2
add rdx, 2
dec rcx
jmp 0x140004bab
mov ecx, r13d
cmp word [r8], ax
mov rax, 0xffffffffffffffff
cmovb ecx, eax
test ecx, ecx
je 0x140004bed
mov rcx, rdi
sub rcx, r9
sar rcx, 1
sub rax, rcx
add r11, rax
lea r9, [rdi + 2]
jmp 0x140004b70
lea rax, [rbp - 0x60]
cmp r12, 8
cmovae rax, rsi
sub rdi, rax
sar rdi, 1
xor r12d, r12d
cmp rdi, 0xffffffffffffffff
je 0x140004de8
mov r9, rdi
xor r8d, r8d
lea rdx, [rbp + 0x68]
lea rcx, [rbp - 0x60]
call fcn.140011820
mov rbx, rax
lea rax, [rbp - 0x38]
cmp rax, rbx
je 0x140004c95
cmp qword [rbp - 0x20], 8
jb 0x140004c3b
mov rcx, qword [rbp - 0x38]
call fcn.140063290
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], r12
mov word [rbp - 0x38], r12w
cmp qword [rbx + 0x18], 8
jae 0x140004c6b
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp - 0x38]
call fcn.1400632b0
jmp 0x140004c75
mov rax, qword [rbx]
mov qword [rbp - 0x38], rax
mov qword [rbx], r12
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x28], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x20], rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
cmp qword [rbp + 0x80], 8
jb 0x140004ca8
mov rcx, qword [rbp + 0x68]
call fcn.140063290
call fcn.1400420e8
mov rbx, rax
mov qword [rbp - 0x80], rax
call fcn.140041f78
mov rsi, rax
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140041dec
mov rax, qword [rsi + 8]
cmp rax, 0xffffffffffffffff
jae 0x140004cd9
inc rax
mov qword [rsi + 8], rax
lea rcx, [rsp + 0x58]
call fcn.140041e1c
nop
mov qword [rsp + 0x70], rbx
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140041dec
mov rax, qword [rbx + 8]
cmp rax, 0xffffffffffffffff
jae 0x140004d06
inc rax
mov qword [rbx + 8], rax
lea rcx, [rsp + 0x60]
call fcn.140041e1c
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x38]
call fcn.14001aa10
test al, al
sete r12b
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.140041dec
mov rax, qword [rbx + 8]
test rax, rax
je 0x140004d46
cmp rax, 0xffffffffffffffff
jae 0x140004d46
dec rax
mov qword [rbx + 8], rax
xor esi, esi
cmp qword [rbx + 8], rsi
cmove rsi, rbx
lea rcx, [rsp + 0x78]
call fcn.140041e1c
test rsi, rsi
je 0x140004d6a
mov rax, qword [rsi]
mov edx, r13d
mov rcx, rsi
call qword [rax]
test r12b, r12b
cmovne r15d, r13d
mov r10, qword [rbp + 0x50]
lea rbx, [r10 + rdi]
mov r11, qword [rbp - 0x50]
cmp r11, rbx
cmovb rbx, r11
test rbx, rbx
mov r12d, 0
je 0x140004b20
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x48]
cmp rax, 8
cmovae rdx, rcx
lea r9, [rbp - 0x60]
cmovae r9, rcx
sub r11, rbx
lea r8, [r11 + r11]
lea rdx, [rdx + rbx*2]
mov rcx, r9
call fcn.1400632b0
mov r11, qword [rbp - 0x50]
sub r11, rbx
mov qword [rbp - 0x50], r11
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rax, qword [rbp - 0x60]
mov word [rax + r11*2], r12w
jmp 0x140004b10
xor r12d, r12d
call fcn.1400420e8
mov rbx, rax
mov qword [rbp - 0x80], rax
call fcn.140041f78
mov rdi, rax
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140041dec
mov rax, qword [rdi + 8]
cmp rax, 0xffffffffffffffff
mov r13, qword [rsp + 0x68]
jae 0x140004e1e
inc rax
mov qword [rdi + 8], rax
lea rcx, [rsp + 0x58]
call fcn.140041e1c
nop
mov qword [rsp + 0x70], rbx
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140041dec
mov rax, qword [rbx + 8]
cmp rax, 0xffffffffffffffff
jae 0x140004e4b
inc rax
mov qword [rbx + 8], rax
lea rcx, [rsp + 0x60]
call fcn.140041e1c
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x60]
call fcn.14001aa10
test al, al
sete sil
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140041dec
mov rax, qword [rbx + 8]
test rax, rax
je 0x140004e8b
cmp rax, 0xffffffffffffffff
jae 0x140004e8b
dec rax
mov qword [rbx + 8], rax
mov rdi, r12
cmp qword [rbx + 8], 0
cmove rdi, rbx
lea rcx, [rsp + 0x58]
call fcn.140041e1c
test rdi, rdi
je 0x140004eb3
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
test sil, sil
jne 0x140004ebe
cmp r15d, 1
jne 0x140004f37
lea rdx, str._r_n__Modified_HKCU...Winlogon:__Shell___
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x18]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x140004f12
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x140004f37
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140004f2f
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 4
test eax, eax
jne 0x140005054
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.NoAutoUpdate
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140005054
mov r9d, dword [rsp + 0x50]
test r9d, r9d
je 0x140005054
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x90]
call fcn.140003500
lea rdx, str._r_n__Windows_Automatic_Updates_Disabled_r_n_r_n____HKLMSOFTWAREPoliciesMicrosoftWindowsWindowsUpdateAU__r_n____NoAutoUpdate__
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x90]
call fcn.140018560
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x14000502a
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
cmove ebx, esi
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14000504e
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140005046
or edx, esi
xor r8d, r8d
call fcn.140003090
mov r14d, 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_NTSystemRestore
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000516a
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.DisableConfig
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14000516a
mov r9d, dword [rsp + 0x50]
test r9d, r9d
je 0x14000516a
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x90]
call fcn.140003500
lea rdx, str._r_n__System_Restore_Disabled_r_n_r_n____HKLMSOFTWAREPoliciesMicrosoftWindows_NTSystemRestore__r_n____DisableConfig__
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x90]
call fcn.140018560
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x140005142
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
cmove ebx, esi
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x140005167
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14000515f
or edx, 4
xor r8d, r8d
call fcn.140003090
inc r14d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_NTSystemRestore
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005280
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.DisableSR
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140005280
mov r9d, dword [rsp + 0x50]
test r9d, r9d
je 0x140005280
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x90]
call fcn.140003500
lea rdx, str._r_n__System_Restore_Disabled_r_n_r_n____HKLMSOFTWAREPoliciesMicrosoftWindows_NTSystemRestore__r_n____DisableSR__
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x90]
call fcn.140018560
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x140005258
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
cmove ebx, esi
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14000527d
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140005275
or edx, 4
xor r8d, r8d
call fcn.140003090
inc r14d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005396
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.DisableSR
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140005396
mov r9d, dword [rsp + 0x50]
test r9d, r9d
je 0x140005396
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x90]
call fcn.140003500
lea rdx, str._r_n__System_Restore_Disabled_r_n_r_n____HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionSystemRestore__r_n____DisableSR__
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x90]
call fcn.140018560
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x14000536e
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
cmove ebx, esi
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x140005393
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14000538b
or edx, 4
xor r8d, r8d
call fcn.140003090
inc r14d
mov rcx, qword [rbp - 0x70]
call fcn.14000f740
test eax, eax
jne 0x1400054bd
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400054bd
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400054bd
mov r9d, dword [rsp + 0x50]
test r9d, r9d
je 0x1400054bd
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x90]
call fcn.140003500
lea rdx, str._r_n__Windows_Defender_Disabled_r_n_r_n____HKLMSOFTWAREMicrosoftWindows_Defender__r_n____DisableAntiSpyware__
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x90]
call fcn.140018560
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x140005495
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
cmove ebx, esi
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x1400054ba
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x1400054b2
or edx, 4
xor r8d, r8d
call fcn.140003090
inc r14d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400055d3
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.DisableAntiSpyware
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400055d3
mov r9d, dword [rsp + 0x50]
test r9d, r9d
je 0x1400055d3
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x90]
call fcn.140003500
lea rdx, str._r_n__Windows_Defender_Disabled_r_n_r_n____HKLMSOFTWAREPoliciesMicrosoftWindows_Defender__r_n____DisableAntiSpyware__
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x90]
call fcn.140018560
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x1400055ab
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
cmove ebx, esi
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x1400055d0
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x1400055c8
or edx, 4
xor r8d, r8d
call fcn.140003090
inc r14d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_DefenderReal_time_Protection
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400056e9
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.DisableRealtimeMonitoring
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400056e9
mov r9d, dword [rsp + 0x50]
test r9d, r9d
je 0x1400056e9
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x90]
call fcn.140003500
lea rdx, str._r_n__Windows_Defender_Real_Time_Protection_Disabled_r_n_r_n____HKLMSOFTWAREPoliciesMicrosoftWindows_DefenderReal_time_Protection__r_n____DisableRealtimeMonitoring__
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x90]
call fcn.140018560
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x1400056c1
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
cmove ebx, esi
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x1400056e6
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x1400056de
or edx, 4
xor r8d, r8d
call fcn.140003090
inc r14d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREPoliciesMicrosoftWindowsFirewallStandardProfile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400057fe
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.EnableFirewall
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400057fe
cmp dword [rsp + 0x50], ebx
jne 0x1400057fe
xor r9d, r9d
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x90]
call fcn.140003500
lea rdx, str._r_n__Windows_Firewall_Disabled_r_n_r_n____HKLMSOFTWAREPoliciesMicrosoftWindowsFirewallStandardProfile__r_n____EnableFirewall__
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x90]
call fcn.140018560
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x1400057d6
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
cmove ebx, esi
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x1400057fb
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x1400057f3
or edx, 4
xor r8d, r8d
call fcn.140003090
inc r14d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140005913
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.EnableFirewall
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140005913
cmp dword [rsp + 0x50], ebx
jne 0x140005913
xor r9d, r9d
lea r8, str.dword:_08x
mov edx, 0x190
lea rcx, [rbp + 0x90]
call fcn.140003500
lea rdx, str._r_n__Windows_Firewall_Disabled_r_n_r_n____HKLMSYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfile__r_n____EnableFirewall__
mov rcx, r13
call fcn.140018560
mov rcx, rax
lea rdx, [rbp + 0x90]
call fcn.140018560
mov rcx, rax
lea rdx, [0x14008dd90]
call fcn.140018560
mov rdi, rax
mov ebx, r12d
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
test byte [rcx + rdi + 0x10], 6
jne 0x1400058eb
mov rcx, qword [rcx + rdi + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x68]
cmp eax, 0xffffffff
cmove ebx, esi
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x140005910
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140005908
or edx, 4
xor r8d, r8d
call fcn.140003090
inc r14d
cmp qword [rbp + 0x58], 8
jb 0x140005923
mov rcx, qword [rbp + 0x40]
call fcn.140063290
mov qword [rbp + 0x58], 7
mov qword [rbp + 0x50], r12
mov word [rbp + 0x40], r12w
cmp qword [rbp + 0x30], 8
jb 0x140005944
mov rcx, qword [rbp + 0x18]
call fcn.140063290
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], r12
mov word [rbp + 0x18], r12w
cmp qword [rbp - 0x48], 8
jb 0x140005965
mov rcx, qword [rbp - 0x60]
call fcn.140063290
mov qword [rbp - 0x48], 7
mov qword [rbp - 0x50], r12
mov word [rbp - 0x60], r12w
cmp qword [rbp + 8], 8
jb 0x140005986
mov rcx, qword [rbp - 0x10]
call fcn.140063290
mov qword [rbp + 8], 7
mov qword [rbp], r12
mov word [rbp - 0x10], r12w
cmp qword [rbp - 0x20], 8
jb 0x1400059a7
mov rcx, qword [rbp - 0x38]
call fcn.140063290
mov eax, r14d
mov rcx, qword [rbp + 0x220]
xor rcx, rsp
call fcn.140063080
mov rbx, qword [rsp + 0x380]
add rsp, 0x330
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret