Function at 0x140041ab4
Capabilities:
Modify service

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rdi, rcx
lea r8, str.SoftwareMicrosoftWindows_Defender
xor r15d, r15d
lea rcx, [rbp + 0x50]
mov r9d, 0x2001f
mov qword [rbp + 0x50], r15
mov rdx, 0xffffffff80000002
call fcn.1400fd49c
lea r13, [0x14016d280]
mov r14d, eax
test eax, eax
jns 0x140041b12
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140041d13
jmp 0x140041d0d
mov rbx, qword [rbp + 0x50]
lea rsi, str.DisableAntiSpyware
mov rdx, rsi
mov dword [rbp + 0x48], r15d
mov rcx, rbx
lea r8, [rbp + 0x48]
call fcn.1400fd3d4
lea r8, [rbp + 0x48]
mov rdx, rsi
mov rcx, rbx
call fcn.1400fd3d4
mov r14d, eax
test eax, eax
jns 0x140041b59
cmp eax, 0x80070002
jne 0x140041d05
mov eax, r15d
mov dword [rbp + 0x48], eax
jmp 0x140041b5c
mov eax, dword [rbp + 0x48]
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x140041b8d
test byte [rcx + 0x1c], 4
je 0x140041b8d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140120ad8]
mov edx, 0x12
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.140044694
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x140041be2
lea rax, [rbp + 0x50]
mov dword [rbp + 0x50], r15d
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.1400fd6cc
mov r14d, eax
test eax, eax
js 0x140041d05
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x140041be2
test byte [rcx + 0x1c], 2
je 0x140041be2
mov rcx, qword [rcx + 0x10]
lea r8, [0x140120ad8]
mov edx, 0x13
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.140044694
test rbx, rbx
je 0x140041bf3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r15
mov rdx, qword [rdi]
lea r12, str.WinDefend
mov r8, r12
mov qword [rbp + 0x50], r15
mov r9d, 0x17
lea rcx, [rbp + 0x50]
call fcn.1400fb8f4
mov r14d, eax
test eax, eax
jns 0x140041c2c
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140041d05
jmp 0x140041cff
mov rdi, qword [rbp + 0x50]
lea rcx, [rbp + 0x58]
mov rdx, rdi
mov qword [rbp + 0x58], r15
call fcn.1400fc084
mov r14d, eax
test eax, eax
jns 0x140041c59
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x140041cf7
jmp 0x140041ced
mov rsi, qword [rbp + 0x58]
mov r9d, dword [rsi + 4]
lea eax, [r9 - 2]
cmp eax, 1
jbe 0x140041cda
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x140041c96
test byte [rcx + 0x1c], 2
je 0x140041c96
mov rcx, qword [rcx + 0x10]
lea r8, [0x140120ad8]
mov edx, 0x14
mov qword [rsp + 0x20], r12
call fcn.1400443f8
mov qword [rsp + 0x50], r15
mov r9d, 1
mov qword [rsp + 0x48], r15
or edx, 0xffffffff
mov qword [rsp + 0x40], r15
mov rcx, rdi
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea r8d, [r9 + 2]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
jne 0x140041cda
call fcn.1400fb4fc
jmp 0x140041ce7
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400fbba0
mov r14d, eax
mov rcx, rsi
mov edx, 0x40
call fcn.140030ba0
test rdi, rdi
je 0x140041d05
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
test rbx, rbx
je 0x140041d13
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [0x14016d280]
cmp rcx, r13
je 0x140041d3d
test byte [rcx + 0x1c], 4
je 0x140041d3d
mov rcx, qword [rcx + 0x10]
lea r8, [0x140120ad8]
mov edx, 0x15
mov r9d, r14d
call fcn.140044380
mov rbx, qword [rsp + 0xa0]
mov eax, r14d
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret