Function at 0x140004c50
Capabilities:
Set registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x220
mov rax, qword [0x140046040]
xor rax, rsp
mov qword [rsp + 0x210], rax
xor esi, esi
mov eax, esi
movsxd r8, ecx
test ecx, ecx
jle 0x140004ca1
nop
mov rcx, qword [rdx + rax*8]
cmp byte [rcx], 0x2d
jne 0x140004c99
cmp byte [rcx + 1], 0x73
jne 0x140004c99
cmp byte [rcx + 2], sil
je 0x140004d53
inc rax
cmp rax, r8
jl 0x140004c80
xor dil, dil
mov byte [rsp + 0x51], dil
mov ebx, esi
mov qword [rsp + 0xe0], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140004d15
mov dword [rsp + 0xf0], 4
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [rsp + 0xe8]
lea edx, [r9 + 0x10]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
cmovne ebx, dword [rsp + 0xe8]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x140004d28
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140004d5b
lea rcx, str.Must_run_as_admin__n
call fcn.140001170
test dil, dil
jne 0x140004d49
lea rcx, str.pause
call fcn.1400165f0
mov eax, 1
jmp 0x14000526e
mov dil, 1
jmp 0x140004ca4
mov dword [rsp + 0xf0], esi
mov qword [rsp + 0xe8], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0xe0]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000518d
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140004dcb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000518d
mov edx, dword [rsp + 0xf0]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0xf0]
mov r8, rbx
mov edx, 1
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14000518d
test rbx, rbx
je 0x14000518d
lea rdx, [rsp + 0xe8]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
test eax, eax
je 0x14000518d
mov rdx, qword [rsp + 0xe8]
lea rcx, str.S_1_5_18
call fcn.140016778
test eax, eax
jne 0x140005184
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
lea r8d, [rax + 0xf]
lea rdx, str.smartscreen.exe
lea rcx, [rsp + 0x58]
call fcn.140004100
lea rcx, [rsp + 0x58]
call fcn.140005a50
mov r8d, eax
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test rbx, rbx
je 0x140004eac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov r8d, 9
lea rdx, str.WinDefend
lea rcx, [rsp + 0x58]
call fcn.140004100
lea rdx, [rsp + 0x58]
call fcn.1400022d0
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20106
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_DefenderFeatures
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140004f40
mov r8d, eax
lea rdx, str.SOFTWAREMicrosoftWindows_DefenderFeatures
lea rcx, str.Could_not_find_or_create__ls_error__d_n
call fcn.1400052a0
jmp 0x140004faa
mov dword [rsp + 0xe8], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TamperProtection
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140004faa
call fcn.140003620
mov rbx, rax
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
add rcx, rax
mov dl, 0xa
call fcn.140004780
movzx edx, al
mov rcx, rbx
call fcn.1400045d0
mov rcx, rbx
call fcn.140004470
mov ecx, 0x60
call fcn.140008f78
mov rbx, rax
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
lea rax, [rsp + 0x58]
mov qword [rsp + 0xe8], rax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov r8d, 3
lea rdx, [0x14003b5a8]
lea rcx, [rsp + 0x58]
call fcn.140004100
nop
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xf0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xb8], rsi
mov r8d, 0x11
lea rdx, str.MSFT_MpPreference
lea rcx, [rsp + 0xa0]
call fcn.140004100
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xd8], rsi
mov r8d, 0x1f
lea rdx, str.RootMicrosoftWindowsDefender
lea rcx, [rsp + 0xc0]
call fcn.140004100
nop
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0xc0]
mov rcx, rbx
call fcn.140005d40
mov rbx, rax
mov edx, dword [rax]
test edx, edx
je 0x1400050c7
lea rcx, str.Error_has_occured:__d_n
call fcn.140001170
mov rcx, rbx
call fcn.140002f90
mov al, 1
jmp 0x140005126
mov byte [rsp + 0x50], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x80], xmm0
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
mov r8d, 0x19
lea rdx, str.DisableRealtimeMonitoring
lea rcx, [rsp + 0x80]
call fcn.140004100
lea r9, [rsp + 0x50]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.140003cc0
mov rcx, rbx
call fcn.140002f90
cmp byte [rsp + 0x50], 0
sete al
lea rdx, str.Windows_defender_is_currently_ACTIVE_n
lea rcx, str.Windows_defender_is_currently_OFF_n
test al, al
cmovne rcx, rdx
call fcn.140001170
call fcn.140002680
test al, al
je 0x140005156
call fcn.1400025a0
lea rcx, str.Disabled_windows_defender__n
jmp 0x14000515d
lea rcx, str.Failed_to_disable_defender..._n
call fcn.140001170
nop
jmp 0x14000516a
test dil, dil
jne 0x14000526c
lea rcx, str.pause
call fcn.1400165f0
jmp 0x14000526c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
lea rcx, str.Restarting_with_privileges_n
call fcn.140001170
mov r8d, pe_nt_image_headers64
lea rdx, [rsp + 0x110]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x110]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], sil
jne 0x1400051d3
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x58]
call fcn.140004100
nop
lea rax, [0x14003fb74]
lea rdx, [0x14003afb0]
test dil, dil
cmovne rdx, rax
inc rbx
cmp byte [rdx + rbx], 0
jne 0x140005204
mov r8, rbx
lea rcx, [rsp + 0x58]
call fcn.140003290
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.140003170
mov rcx, rax
call fcn.1400054a0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000526c
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005267
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005293
call fcn.140008f70
xor eax, eax
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.140008f50
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.140014410
int3