Function at 0x40addc
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
mov edx, 8
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40ade4
call fcn.004634e0
mov edx, dword [esp + 0x38]
lea ecx, [esp]
call fcn.00422000
mov ebx, dword [esp + 0x30]
and ebx, ebx
jne 0x40aea6
push dword [esp]
mov edx, str.0419
pop ecx
call fcn.00422720
jne 0x40ae30
push dword [esp]
mov edx, 0x4bde48
pop ecx
call fcn.00422720
jne 0x40ae30
jmp 0x40ae37
mov eax, 1
jmp 0x40ae39
xor eax, eax
and eax, eax
jne 0x40ae4f
push dword [esp]
mov edx, 0x4bde42
pop ecx
call fcn.00422720
jne 0x40ae4f
jmp 0x40ae56
mov eax, 1
jmp 0x40ae58
xor eax, eax
and eax, eax
je 0x40ae6c
mov edx, 0x4c5d72
lea ecx, [esp + 0x14]
call fcn.00422008
jmp 0x40ae7a
mov edx, str.Disabling_Defender_in_this_version_of_the_program_requires_a_system_restart._Perform_Defender_Switch__
lea ecx, [esp + 0x14]
call fcn.00422008
push dword [esp + 0x34]
push 0x34
push dword [esp + 0x1c]
mov eax, str.Defender_Tools
push eax
call fcn.00409923
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
cmp ebx, 7
jne 0x40aea6
xor eax, eax
jmp 0x40b552
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0xc8
call fcn.00460d60
lea eax, [esp + 8]
push eax
call fcn.004633e0
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push 0xc8
call fcn.00460d60
lea eax, [esp + 0xc]
push eax
call fcn.004633e0
push 0xc8
mov eax, dword [esp + 8]
push eax
mov eax, str.PROCESSOR_ARCHITECTURE
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov eax, dword [esp + 0xc]
push eax
mov eax, str.PROCESSOR_ARCHITEW6432
push eax
call sub.KERNEL32.dll_GetEnvironmentVariableW
push dword [esp + 4]
mov edx, str.AMD64
pop ecx
call fcn.00422720
jne 0x40af3c
push dword [esp + 8]
mov edx, str.AMD64
pop ecx
call fcn.00422720
jne 0x40af3c
jmp 0x40af43
mov eax, 1
jmp 0x40af45
xor eax, eax
and eax, eax
je 0x40af59
mov edx, 0x4c33a2
lea ecx, [esp + 0xc]
call fcn.00422008
jmp 0x40af67
mov edx, 0x4c536e
lea ecx, [esp + 0xc]
call fcn.00422008
call fcn.0040f462
and eax, eax
je 0x40af91
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
call fcn.0044bbf7
lea eax, [esp + 0x14]
push eax
call fcn.004633e0
jmp 0x40afcd
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
call fcn.0043e577
call fcn.00422772
add dword [esp], edx
call fcn.0044bb2c
lea eax, [esp + 0x14]
push eax
call fcn.004633e0
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.loader.exe
push edx
call fcn.00463380
call fcn.00422772
add dword [esp], edx
call fcn.0044bbab
call fcn.00422790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.Disable.cmd
push edx
call fcn.00463380
call fcn.00422772
add dword [esp], edx
call fcn.0044bbab
call fcn.00422790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.Enable.cmd
push edx
call fcn.00463380
call fcn.00422772
add dword [esp], edx
call fcn.0044bbab
call fcn.00422790
push dword [esp + 0xc]
mov edx, 0x4c33a2
pop ecx
call fcn.00422720
je 0x40b103
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.loader.exe
push edx
call fcn.00463380
call fcn.00463470
push 0x6f
call fcn.00422772
add dword [esp + 4], edx
call fcn.0044c6d0
call fcn.00422790
and eax, eax
je 0x40b101
mov ebp, str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
mov ebx, ebp
mov ebp, 0x4eabe6
sub ebx, ebp
push ebx
mov ebp, 0x4eabe6
push ebp
push 0x6f
call fcn.0044c920
push 0x6f
call fcn.0044c3d0
jmp 0x40b172
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.loader.exe
push edx
call fcn.00463380
call fcn.00463470
push 0x6f
call fcn.00422772
add dword [esp + 4], edx
call fcn.0044c6d0
call fcn.00422790
and eax, eax
je 0x40b172
mov ebp, 0x4eabe6
mov ebx, ebp
mov ebp, 0x4cafe6
sub ebx, ebp
push ebx
mov ebp, 0x4cafe6
push ebp
push 0x6f
call fcn.0044c920
push 0x6f
call fcn.0044c3d0
mov ebx, dword [esp + 0x30]
and ebx, ebx
jne 0x40b2c0
mov ebx, dword [0x62bd44]
and ebx, ebx
jne 0x40b20e
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.Disable.cmd
push edx
call fcn.00463380
call fcn.00463470
push 0x6f
call fcn.00422772
add dword [esp + 4], edx
call fcn.0044c6d0
call fcn.00422790
and eax, eax
je 0x40b209
mov ebp, 0x512650
mov ebx, ebp
mov ebp, str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
sub ebx, ebp
push ebx
mov ebp, str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
push ebp
push 0x6f
call fcn.0044c920
push 0x6f
call fcn.0044c3d0
mov edx, str._U:T__P:E__ShowWindowMode:Hide__Wait_Disable.cmd
lea ecx, [esp + 0x1c]
call fcn.00422008
jmp 0x40b2bb
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.Disable.ps1
push edx
call fcn.00463380
call fcn.00463470
push 0x6f
call fcn.00422772
add dword [esp + 4], edx
call fcn.0044c6d0
call fcn.00422790
and eax, eax
je 0x40b2bb
mov ebp, 0x5132a9
mov ebx, ebp
mov ebp, 0x512eb8
sub ebx, ebp
push ebx
mov ebp, 0x512eb8
push ebp
push 0x6f
call fcn.0044c920
push 0x6f
call fcn.0044c3d0
push edx
call main
pop edx
push eax
mov edx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
push edx
call fcn.00463380
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
call fcn.0044bbf7
pop eax
mov edx, str.Disable.ps1_
push edx
call fcn.00463380
lea eax, [esp + 0x20]
push eax
call fcn.004633e0
jmp 0x40b3fd
mov ebx, dword [0x62bd44]
and ebx, ebx
jne 0x40b350
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.Enable.cmd
push edx
call fcn.00463380
call fcn.00463470
push 0x6f
call fcn.00422772
add dword [esp + 4], edx
call fcn.0044c6d0
call fcn.00422790
and eax, eax
je 0x40b34b
mov ebp, 0x512a76
mov ebx, ebp
mov ebp, 0x512650
sub ebx, ebp
push ebx
mov ebp, 0x512650
push ebp
push 0x6f
call fcn.0044c920
push 0x6f
call fcn.0044c3d0
mov edx, str._U:T__P:E__ShowWindowMode:Hide__Wait_Enable.cmd
lea ecx, [esp + 0x1c]
call fcn.00422008
jmp 0x40b3fd
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.Enable.ps1
push edx
call fcn.00463380
call fcn.00463470
push 0x6f
call fcn.00422772
add dword [esp + 4], edx
call fcn.0044c6d0
call fcn.00422790
and eax, eax
je 0x40b3fd
mov ebp, 0x5132a9
mov ebx, ebp
mov ebp, 0x512eb8
sub ebx, ebp
push ebx
mov ebp, 0x512eb8
push ebp
push 0x6f
call fcn.0044c920
push 0x6f
call fcn.0044c3d0
push edx
call main
pop edx
push eax
mov edx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
push edx
call fcn.00463380
push edx
call main
pop edx
push eax
push edx
call main
pop edx
push eax
call fcn.0044bbf7
pop eax
mov edx, str.Enable.ps1_
push edx
call fcn.00463380
lea eax, [esp + 0x20]
push eax
call fcn.004633e0
push edx
call main
pop edx
push eax
mov edx, dword [esp + 0x14]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.loader.exe
push edx
call fcn.00463380
call fcn.00422772
add dword [esp], edx
call fcn.0044b906
call fcn.00422790
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40b448
jl 0x40b444
cmp ebx, 0
ja 0x40b448
xor eax, eax
jmp 0x40b44d
mov eax, 1
or eax, eax
je 0x40b495
push edx
call main
pop edx
push eax
push 3
push dword [esp + 0x18]
push dword [esp + 0x28]
mov edx, dword [esp + 0x20]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.loader.exe
push edx
call fcn.00463380
call fcn.00422772
add dword [esp], edx
call fcn.0043e616
call fcn.00422790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.loader.exe
push edx
call fcn.00463380
call fcn.00422772
add dword [esp], edx
call fcn.0044bbab
call fcn.00422790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.Disable.cmd
push edx
call fcn.00463380
call fcn.00422772
add dword [esp], edx
call fcn.0044bbab
call fcn.00422790
push edx
call main
pop edx
push eax
push 2
mov edx, dword [esp + 0x18]
push edx
call main
pop edx
push eax
push edx
call fcn.00463380
mov edx, str.Enable.cmd
push edx
call fcn.00463380
call fcn.00422772
add dword [esp], edx
call fcn.0044bbab
call fcn.00422790
mov eax, 1
jmp 0x40b552
push dword [esp]
call fcn.00463570
push dword [esp + 0x10]
call fcn.00463570
push dword [esp + 8]
call fcn.00463570
push dword [esp + 0xc]
call fcn.00463570
push dword [esp + 0x1c]
call fcn.00463570
push dword [esp + 0x14]
call fcn.00463570
push dword [esp + 4]
call fcn.00463570
add esp, 0x20
pop edi
pop ebx
pop ebp
ret 0xc