Function at 0x14005cbb0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x1400f80c0]
xor rax, rsp
mov qword [rbp + 0x248], rax
xor edx, edx
mov dword [rsp + 0x60], reloc.WS2_32.dll_sendto
lea rax, str.EnablePrefetcher
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x38], rax
lea rcx, str.SYSTEMCurrentControlSetControlSession_ManagerMemory_ManagementPrefetchParameters
lea rax, str.EnableSuperfetch
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x50], rax
lea rax, str.KeyboardDataQueueSize
mov qword [rsp + 0x68], rax
lea rax, str.SYSTEMCurrentControlSetServiceskbdclassParameters
mov qword [rsp + 0x70], rax
lea rax, str.MouseDataQueueSize
mov qword [rbp - 0x80], rax
lea rax, str.SYSTEMCurrentControlSetServicesmouclassParameters
mov qword [rbp - 0x78], rax
lea rax, str.PowerThrottlingOff
mov qword [rbp - 0x68], rax
lea rax, str.SYSTEMCurrentControlSetControlPowerPowerThrottling
mov qword [rbp - 0x60], rax
lea rax, str.HighPerformance
mov qword [rbp - 0x50], rax
lea rax, str.HighestPerformance
mov qword [rbp - 0x38], rax
lea rax, str.MinimumThrottlePercent
mov qword [rbp - 0x20], rax
lea rax, str.MaximumThrottlePercent
mov qword [rbp - 8], rax
lea rax, str.MaximumPerformancePercent
mov qword [rbp + 0x10], rax
lea rax, str.Class1InitialUnparkCount
mov qword [rbp + 0x28], rax
lea rax, str.InitialUnparkCount
mov qword [rbp + 0x40], rax
lea rax, str.SOFTWAREPoliciesMicrosoftWindows_Defender_Security_CenterNotifications
mov qword [rbp + 0x60], rax
lea rax, str.SoftwarePoliciesMicrosoftWindowsCurrentVersionPushNotifications
mov qword [rbp + 0x78], rax
lea rax, str.DisablePreemption
mov qword [rbp + 0x88], rax
lea rax, str.DisableWriteCombining
mov qword [rbp + 0xa0], rax
lea rax, str.DisableCudaContextPreemption
mov qword [rsp + 0x58], rcx
lea rcx, str.SYSTEMCurrentControlSetControlPower
mov qword [rbp + 0xb8], rax
lea rax, str.SYSTEMCurrentControlSetServicesGpuEnergyDrv
mov qword [rbp - 0x48], rcx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp], rcx
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x48], rcx
lea rcx, [0x1400dac75]
mov qword [rbp + 0xc0], rax
lea rax, str.EnablePreemption
mov qword [rbp + 0x58], rcx
mov qword [rbp + 0x70], rcx
lea rcx, str.SYSTEMCurrentControlSetServices_nvlddmkm
mov qword [rbp + 0xd0], rax
lea rax, str.SYSTEMCurrentControlSetControlGraphicsDriversScheduler
mov dword [rsp + 0x48], edx
mov dword [rsp + 0x78], reloc.WS2_32.dll_sendto
mov dword [rbp - 0x70], 1
mov dword [rbp - 0x58], 1
mov dword [rbp - 0x40], 1
mov dword [rbp - 0x28], edx
mov dword [rbp - 0x10], edx
mov dword [rbp + 8], 0x64
mov dword [rbp + 0x20], 0x64
mov dword [rbp + 0x38], 0x64
mov dword [rbp + 0x50], edx
mov dword [rbp + 0x68], edx
mov dword [rbp + 0x80], 1
mov qword [rbp + 0x90], rcx
mov dword [rbp + 0x98], 1
mov qword [rbp + 0xa8], rcx
mov dword [rbp + 0xb0], 1
mov dword [rbp + 0xc8], edx
mov qword [rbp + 0xd8], rax
lea rcx, str.Start
lea rax, str.PlatformSupportMiracast
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0xe8], rax
lea rax, str.SYSTEMCurrentControlSetControlGraphicsDrivers
mov qword [rbp + 0xf0], rax
lea rax, str.SYSTEMCurrentControlSetServicesWbioSrvc
mov qword [rbp + 0x108], rax
lea rax, str.SYSTEMCurrentControlSetServicesFontCache
mov qword [rbp + 0x120], rax
lea rax, str.SYSTEMCurrentControlSetServicesFontCache3.0.0.0
mov qword [rbp + 0x138], rax
lea rax, str.SYSTEMCurrentControlSetServicesGraphicsPerfSvc
mov qword [rbp + 0x150], rax
lea rax, str.SYSTEMCurrentControlSetServices_stisvc
mov qword [rbp + 0x168], rax
lea rax, str.SYSTEMCurrentControlSetServicesWerSvc
mov qword [rbp + 0x180], rax
lea rax, str.SYSTEMCurrentControlSetServicesPcaSvc
mov qword [rbp + 0x198], rax
lea rax, str.SYSTEMCurrentControlSetServicesWecsvc
mov qword [rbp + 0x1b0], rax
lea rax, str.DisableTaggedEnergyLogging
mov qword [rbp + 0x1c0], rax
lea rax, str.TelemetryMaxApplication
mov qword [rbp + 0x1d8], rax
lea rax, str.TelemetryMaxTagPerApplication
mov qword [rbp + 0x1f0], rax
lea rax, str.EnergyEstimationEnabled
mov qword [rbp + 0x118], rcx
mov qword [rbp + 0x130], rcx
mov qword [rbp + 0x148], rcx
mov qword [rbp + 0x160], rcx
mov qword [rbp + 0x178], rcx
mov qword [rbp + 0x190], rcx
mov qword [rbp + 0x1a8], rcx
lea rcx, str.SYSTEMCurrentControlSetControlPowerEnergyEstimationTaggedEnergy
mov qword [rbp + 0x208], rax
lea rax, str.SYSTEMCurrentControlSetControlPowerEnergyEstimation
mov qword [rbp + 0x1c8], rcx
mov qword [rbp + 0x1e0], rcx
mov qword [rbp + 0x1f8], rcx
mov ecx, 0x2e8
mov qword [rbp + 0x210], rax
mov dword [rbp + 0xe0], edx
mov dword [rbp + 0xf8], 4
mov dword [rbp + 0x110], 4
mov dword [rbp + 0x128], 4
mov dword [rbp + 0x140], 4
mov dword [rbp + 0x158], 4
mov dword [rbp + 0x170], 4
mov dword [rbp + 0x188], 4
mov dword [rbp + 0x1a0], 4
mov dword [rbp + 0x1b8], 1
mov dword [rbp + 0x1d0], edx
mov dword [rbp + 0x1e8], edx
mov dword [rbp + 0x200], 1
call fcn.1400c6144
mov rdi, rax
mov qword [rbp + 0x230], rax
mov r8, rdi
lea rcx, [rax + 0x2e8]
lea rax, [rsp + 0x40]
mov qword [rbp + 0x240], rcx
lea rcx, [rsp + 0x40]
sub r8, rax
nop
mov edx, dword [rcx - 0x10]
lea rcx, [rcx + 0x18]
mov dword [rdi], edx
add rdi, 0x18
mov rax, qword [rcx - 0x20]
lea rdx, [rbp + 0x218]
mov qword [rcx + r8 - 0x10], rax
mov rax, qword [rcx - 0x18]
mov qword [rcx + r8 - 8], rax
lea rax, [rcx - 0x10]
cmp rax, rdx
jne 0x14005cf90
mov rbx, qword [rbp + 0x230]
mov qword [rbp + 0x238], rdi
cmp rbx, rdi
je 0x14005d061
mov qword [rsp + 0x360], rsi
nop
mov eax, dword [rbx]
mov r9d, 2
mov rdx, qword [rbx + 0x10]
xor r8d, r8d
mov rsi, qword [rbx + 8]
mov rcx, 0xffffffff80000002
mov dword [rbp + 0x228], eax
lea rax, [rbp + 0x220]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14005d050
mov rcx, qword [rbp + 0x220]
lea rax, [rbp + 0x228]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x220]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rbx, 0x18
cmp rbx, rdi
jne 0x14005cfe0
mov rsi, qword [rsp + 0x360]
lea rcx, [rbp + 0x230]
call fcn.14005d300
mov rcx, qword [rbp + 0x248]
xor rcx, rsp
call fcn.1400c60f0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret