Function at 0x14000f804
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14000f81d
sub rsp, 0x28
call fcn.140088500
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.140088570
add rsp, 0x10
mov r15, qword [rsp + 0x80]
and r15, r15
jne 0x14000f93b
push qword [rsp + 0x28]
movabs rcx, str.0419
pop rdx
call fcn.1400883c0
or rax, rax
jne 0x14000f896
push qword [rsp + 0x28]
movabs rcx, 0x1400fae48
pop rdx
call fcn.1400883c0
or rax, rax
jne 0x14000f896
jmp 0x14000f89f
mov rax, 1
jmp 0x14000f8a2
xor rax, rax
and rax, rax
jne 0x14000f8c2
push qword [rsp + 0x28]
movabs rcx, 0x1400fae42
pop rdx
call fcn.1400883c0
or rax, rax
jne 0x14000f8c2
jmp 0x14000f8cb
mov rax, 1
jmp 0x14000f8ce
xor rax, rax
and rax, rax
je 0x14000f8e9
movabs rdx, 0x140102d40
lea rcx, [rsp + 0x50]
call fcn.140088130
jmp 0x14000f8fd
movabs rdx, str.Disabling_Defender_in_this_version_of_the_program_requires_a_system_restart._Perform_Defender_Switch__
lea rcx, [rsp + 0x50]
call fcn.140088130
push qword [rsp + 0x88]
push reloc.WS2_32.dll_gethostbyname
push qword [rsp + 0x60]
movabs rax, str.Defender_Tools
push rax
pop rcx
pop rdx
pop r8
pop r9
call fcn.14000d4a1
mov qword [rsp + 0x58], rax
mov r15, qword [rsp + 0x58]
cmp r15, 7
jne 0x14000f93b
xor rax, rax
jmp 0x1400105ac
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140085210
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.1400882e0
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
push 0xc8
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140085210
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.1400882e0
push 0xc8
mov rax, qword [rsp + 0x38]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITECTURE
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push 0xc8
mov rax, qword [rsp + 0x40]
mov rax, rax
push rax
movabs rax, str.PROCESSOR_ARCHITEW6432
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
push qword [rsp + 0x30]
movabs rcx, str.AMD64
pop rdx
call fcn.1400883c0
or rax, rax
jne 0x14000fa39
push qword [rsp + 0x38]
movabs rcx, str.AMD64
pop rdx
call fcn.1400883c0
or rax, rax
jne 0x14000fa39
jmp 0x14000fa42
mov rax, 1
jmp 0x14000fa45
xor rax, rax
and rax, rax
je 0x14000fa60
movabs rdx, 0x140100370
lea rcx, [rsp + 0x40]
call fcn.140088130
jmp 0x14000fa74
movabs rdx, 0x14010233c
lea rcx, [rsp + 0x40]
call fcn.140088130
call fcn.1400169ba
and rax, rax
je 0x14000fabd
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140069c90
add rsp, 0x28
lea rcx, [rsp + 0x50]
pop rdx
call fcn.1400882e0
jmp 0x14000fb37
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
push rcx
sub rsp, 0x20
call fcn.140088220
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140056df8
add rsp, 0x20
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140069b78
add rsp, 0x28
lea rcx, [rsp + 0x50]
pop rdx
call fcn.1400882e0
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.140088220
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
movabs rcx, str.loader.exe
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140069c40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.140088220
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
movabs rcx, str.Disable.cmd
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140069c40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.140088220
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
movabs rcx, str.Enable.cmd
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140069c40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
push qword [rsp + 0x40]
movabs rcx, 0x140100370
pop rdx
call fcn.1400883c0
or rax, rax
je 0x14000fda5
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
movabs rcx, str.loader.exe
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
call fcn.140088480
push WSAStartup
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006aa40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
and rax, rax
je 0x14000fda0
movabs rbp, str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
mov r15, rbp
movabs rbp, 0x140127c2a
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x140127c2a
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006ad70
push WSAStartup
pop rcx
call fcn.14006a6d0
jmp 0x14000fe74
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
movabs rcx, str.loader.exe
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
call fcn.140088480
push WSAStartup
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006aa40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
and rax, rax
je 0x14000fe74
movabs rbp, 0x140127c2a
mov r15, rbp
movabs rbp, 0x14010802a
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14010802a
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006ad70
push WSAStartup
pop rcx
call fcn.14006a6d0
mov r15, qword [rsp + 0x80]
and r15, r15
jne 0x1400100cd
mov r15, qword [0x14026a2c4]
and r15, r15
jne 0x14000ff7d
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
movabs rcx, str.Disable.cmd
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
call fcn.140088480
push WSAStartup
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006aa40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
and rax, rax
je 0x14000ff78
movabs rbp, 0x14014f694
mov r15, rbp
movabs rbp, str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
sub r15, rbp
mov rax, r15
push rax
movabs rbp, str.TasklistFind__I__MsMpEng.exe__goto_START_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_StopService_r_nwmic_Process_Where__NameSecurityHealthService.exeor_NameSecurityHealthSystray.exeor_Namesmartscreen.exeor_NameMpCmdRun.exe__Delete_r_nwmic_Service_Where_NameSecurityHealthService_Delete_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Disabled_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__t_REG_SZ__d_Off__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__t_REG_SZ__d_hide:windowsdefender__f_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_1__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_1__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer___v_SettingsPageVisibility__f_r_nreg_delete__HKLMSOFTWAREMicrosoftWindowsCurrentVersionExplorer___v_SmartScreenEnabled__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_DefenderFeatures___v_TamperProtection__t_REG_DWORD__d_5__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun___v_SecurityHealth__t_REG_EXPAND_SZ__d__systemroot__system32SecurityHealthSystray.exe__f_r_nfor___A_in__WinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv__do_wmic_Path_Win32_BaseService.Name__A_Call_ChangeStartMode_Automatic_r_nsc_Create_SecurityHealthService_BinPath_systemroot__system32SecurityHealthService.exe_StartAuto_r_nsc_Start_WinDefend_r_nstart__systemroot__system32SecurityHealthSystray.exe_r_nreg_add__HKLMSOFTWAREPoliciesMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiSpyware__t_REG_DWORD__d_0__f_r_nreg_add__HKLMSOFTWAREMicrosoftWindows_Defender___v_DisableAntiVirus__t_REG_DWORD__d_0__f_r_n_r_nRP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen_r_nSP__HKLM:SOFTWAREMicrosoftWindows_DefenderFeatures__TamperProtection__V_5_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility_r_nRD_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth__PropertyType_ExpandString__V__env:SystemRoot_system32SecurityHealthSystray.exe_r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_2_r_n_ShellNew_Object__ComObject___WScript.Shell___r_n_Shortcut_Shell.CreateShortcut___env:ProgramDataMicrosoftWindowsStart_MenuProgramsDefender_Switch.lnk___r_n_Shortcut.IconLocation__env:SystemRootSystem32SecurityHealthSSO.dll_10__r_n_Shortcut.Save___r_n_Reflection.Assembly_::LoadWithPartialName_System.Windows.Forms___Windows.Forms.MessageBox_::show_Windows_Defender_Enabled___Need_Reboot_Defender_Switch_0_64__r_nWinDefend_Sense_WdBoot_WdFilter_WdNisSvc_WdNisDrv_Security_wscsvc_SP_HKLM:SYSTEMCurrentControlSetServices___Start__V_4_r_nNew_ItemProperty_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer_SettingsPageVisibility__PropertyType_String__V_hide:windowsdefender_r_nHKLM:SOFTWAREMicrosoftWindowsCurrentVersionNotificationsSettingsWindows.SystemToast.SecurityAndMaintenance_NI____SP____Enabled__V_0_r_nSP_HKLM:SOFTWAREPoliciesMicrosoftWindowsSystem_EnableSmartScreen__V_0_r_nRP_HKLM:SOFTWAREMicrosoftWindowsCurrentVersionRun_SecurityHealth_r_n_ShellNew_Object__
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006ad70
push WSAStartup
pop rcx
call fcn.14006a6d0
movabs rdx, str._U:T__P:E__ShowWindowMode:Hide__Wait_Disable.cmd
lea rcx, [rsp + 0x60]
call fcn.140088130
jmp 0x1400100c8
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
movabs rcx, str.Disable.ps1
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
call fcn.140088480
push WSAStartup
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006aa40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
and rax, rax
je 0x1400100c8
movabs rbp, 0x1401502ed
mov r15, rbp
movabs rbp, 0x14014fefc
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14014fefc
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006ad70
push WSAStartup
pop rcx
call fcn.14006a6d0
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
movabs rcx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.140088220
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140069c90
add rsp, 0x20
pop rax
movabs rcx, str.Disable.ps1_
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
lea rcx, [rsp + 0x68]
pop rdx
call fcn.1400882e0
jmp 0x140010310
mov r15, qword [0x14026a2c4]
and r15, r15
jne 0x1400101c5
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
movabs rcx, str.Enable.cmd
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
call fcn.140088480
push WSAStartup
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006aa40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
and rax, rax
je 0x1400101c0
movabs rbp, 0x14014faba
mov r15, rbp
movabs rbp, 0x14014f694
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14014f694
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006ad70
push WSAStartup
pop rcx
call fcn.14006a6d0
movabs rdx, str._U:T__P:E__ShowWindowMode:Hide__Wait_Enable.cmd
lea rcx, [rsp + 0x60]
call fcn.140088130
jmp 0x140010310
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
movabs rcx, str.Enable.ps1
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
call fcn.140088480
push WSAStartup
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.14006aa40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
and rax, rax
je 0x140010310
movabs rbp, 0x1401502ed
mov r15, rbp
movabs rbp, 0x14014fefc
sub r15, rbp
mov rax, r15
push rax
movabs rbp, 0x14014fefc
mov rax, rbp
push rax
push WSAStartup
pop rcx
pop rdx
pop r8
call fcn.14006ad70
push WSAStartup
pop rcx
call fcn.14006a6d0
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
movabs rcx, str._U:T__P:E__ShowWindowMode:Hide__Wait_powershell.exe__ExecutionPolicy_bypass__File__
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
push rcx
sub rsp, 0x20
call fcn.140088220
add rsp, 0x20
pop rcx
push rax
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
pop rcx
sub rsp, 0x20
call fcn.140069c90
add rsp, 0x20
pop rax
movabs rcx, str.Enable.ps1_
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
lea rcx, [rsp + 0x68]
pop rdx
call fcn.1400882e0
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
mov rcx, qword [rsp + 0x58]
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
movabs rcx, str.loader.exe
sub rsp, 0x28
call fcn.140088270
add rsp, 0x28
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
sub rsp, 0x20
call fcn.1400698f0
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
mov r15, rax
and r15, r15
jle 0x140010423
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 3
push qword [rsp + 0x60]
push qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
push rcx
sub rsp, 0x20
call fcn.140088220
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
movabs rcx, str.loader.exe
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140056f24
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.140088220
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
movabs rcx, str.loader.exe
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140069c40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.140088220
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
movabs rcx, str.Disable.cmd
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140069c40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
push rcx
sub rsp, 0x28
call fcn.140088220
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 2
mov rcx, qword [rsp + 0x60]
push rcx
sub rsp, 0x20
call fcn.140088220
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
movabs rcx, str.Enable.cmd
sub rsp, 0x20
call fcn.140088270
add rsp, 0x20
push rax
call fcn.140088450
mov rdx, rax
pop rax
add qword [rsp], rdx
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140069c40
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140036118
add rsp, 0x28
pop rax
mov rax, 1
jmp 0x1400105ac
push rax
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.140088610
add rsp, 0x28
mov rcx, qword [rsp + 0x50]
sub rsp, 0x28
call fcn.140088610
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140088610
add rsp, 0x28
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.140088610
add rsp, 0x28
mov rcx, qword [rsp + 0x68]
sub rsp, 0x28
call fcn.140088610
add rsp, 0x28
mov rcx, qword [rsp + 0x58]
sub rsp, 0x28
call fcn.140088610
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.140088610
add rsp, 0x28
pop rax
add rsp, 0x68
pop r15
pop rbp
ret