Function at 0x140041b74
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, rcx
lea r8, str.SoftwareMicrosoftWindows_Defender
xor r15d, r15d
lea rcx, [rbp + 0x50]
mov r9d, 0x2001f
mov qword [rbp + 0x50], r15
mov rdx, 0xffffffff80000002
call fcn.1400f4538
lea r13, [0x140162280]
mov r14d, eax
test eax, eax
jns 0x140041bd2
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140041dd3
jmp 0x140041dcd
mov rbx, qword [rbp + 0x50]
lea rsi, str.DisableAntiSpyware
mov rdx, rsi
mov dword [rbp + 0x48], r15d
mov rcx, rbx
lea r8, [rbp + 0x48]
call fcn.1400f4470
lea r8, [rbp + 0x48]
mov rdx, rsi
mov rcx, rbx
call fcn.1400f4470
mov r14d, eax
test eax, eax
jns 0x140041c19
cmp eax, 0x80070002
jne 0x140041dc5
mov eax, r15d
mov dword [rbp + 0x48], eax
jmp 0x140041c1c
mov eax, dword [rbp + 0x48]
mov rcx, qword [0x140162280]
cmp rcx, r13
je 0x140041c4d
test byte [rcx + 0x1c], 4
je 0x140041c4d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401178d8]
mov edx, 0x12
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.140044764
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x140041ca2
lea rax, [rbp + 0x50]
mov dword [rbp + 0x50], r15d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.1400f47ec
mov r14d, eax
test eax, eax
js 0x140041dc5
mov rcx, qword [0x140162280]
cmp rcx, r13
je 0x140041ca2
test byte [rcx + 0x1c], 2
je 0x140041ca2
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401178d8]
mov edx, 0x13
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.140044764
test rbx, rbx
je 0x140041cb3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov rdx, qword [rdi]
lea r12, str.WinDefend
mov r8, r12
mov qword [rbp + 0x50], r15
mov r9d, 0x17
lea rcx, [rbp + 0x50]
call fcn.1400f2994
mov r14d, eax
test eax, eax
jns 0x140041cec
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140041dc5
jmp 0x140041dbf
mov rdi, qword [rbp + 0x50]
lea rcx, [rbp + 0x58]
mov rdx, rdi
mov qword [rbp + 0x58], r15
call fcn.1400f3124
mov r14d, eax
test eax, eax
jns 0x140041d19
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140041db7
jmp 0x140041dad
mov rsi, qword [rbp + 0x58]
mov r9d, dword [rsi + 4]
lea eax, [r9 - 2]
cmp eax, 1
jbe 0x140041d9a
mov rcx, qword [0x140162280]
cmp rcx, r13
je 0x140041d56
test byte [rcx + 0x1c], 2
je 0x140041d56
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401178d8]
mov edx, 0x14
mov qword [rsp + 0x20], r12
call fcn.1400444c8
mov qword [rsp + 0x50], r15
mov r9d, 1
mov qword [rsp + 0x48], r15
or edx, 0xffffffff
mov qword [rsp + 0x40], r15
mov rcx, rdi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140041d9a
call fcn.1400f259c
jmp 0x140041da7
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400f2c40
mov r14d, eax
mov rcx, rsi
mov edx, 0x40
call fcn.140030c60
test rdi, rdi
je 0x140041dc5
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140041dd3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x140162280]
cmp rcx, r13
je 0x140041dfd
test byte [rcx + 0x1c], 4
je 0x140041dfd
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401178d8]
mov edx, 0x15
mov r9d, r14d
call fcn.140044450
mov rbx, qword [rsp + 0xa0]
mov eax, r14d
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret