Function at 0x1400084e0
Capabilities:
Persist via run registry key

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov ebx, edx
call fcn.140025170
mov rsi, rax
test rax, rax
je 0x140008793
mov qword [rbp - 0x48], rdx
call fcn.14001c730
movzx eax, byte [rax]
mov dil, 2
cmp eax, 1
mov qword [rbp - 0x50], rsi
je 0x140008546
test eax, eax
jne 0x140008560
call fcn.14001c710
lea rdx, [0x14001f060]
mov rcx, rax
call fcn.14003b400
call fcn.14001c730
mov byte [rax], 1
call fcn.14001c710
test rax, rax
je 0x140008560
movzx edi, byte [rax + 0x4c]
movzx ecx, byte [rax + 0x4d]
mov word [rax + 0x4c], 0x8001
jmp 0x140008560
mov byte [rbp + 0x2f], dil
mov byte [rbp + 0x2d], dil
mov byte [rbp + 0x2e], cl
test bl, bl
jne 0x1400087a5
call fcn.14000f400
mov qword [rbp - 0x20], rax
mov byte [rbp - 0x10], 0
lea rax, [rbp - 0x20]
mov qword [rbp - 0x18], rax
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x18]
call fcn.14000b220
cmp byte [rbp + 0x18], 0
jne 0x1400087e7
mov rsi, qword [rbp + 0x20]
mov rcx, rsi
call fcn.14000f730
test al, al
je 0x1400085b7
mov rcx, rsi
call fcn.14000fbd0
lea rax, [0x1400501a0]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 1
lea rax, [0x1400500f8]
mov qword [rbp - 8], rax
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
lea rcx, [rbp - 0x18]
call fcn.140033340
mov ecx, 7
mov edx, 0xbbdf5c
call fcn.1400314a0
mov qword [rbp - 0x28], 0xffffffff80000001
mov dword [rsp + 0x20], 0x2001f
lea r8, [0x1400501b0]
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 0x28]
mov r9d, 0x2d
call fcn.140006d70
cmp qword [rbp - 0x18], 0
jne 0x140008803
mov rax, qword [rbp - 0x10]
mov qword [rbp - 0x38], rax
lea r8, [0x1400501f8]
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 0x38]
mov r9d, 0xa
call fcn.140006e80
mov rdx, qword [rbp - 0x18]
movabs rsi, 0x8000000000000000
cmp rdx, rsi
jne 0x140008753
lea rcx, [rbp - 0x10]
call fcn.140004fb0
lea rcx, [rbp - 0x18]
call fcn.140032050
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x30], rax
cmp rax, rsi
je 0x140008838
mov rdx, qword [rbp - 0x10]
mov r8, qword [rbp - 8]
mov qword [rsp + 0x20], 0x24
lea r9, [0x140050220]
lea rcx, [rbp - 0x18]
mov qword [rbp - 0x40], rdx
call fcn.140039230
cmp qword [rbp - 0x18], 0
jne 0x14000886d
lea r8, [0x1400501b0]
lea rcx, [rbp - 0x18]
lea rdx, [rbp - 0x28]
mov r9d, 0x2d
call fcn.140006c40
cmp byte [rbp - 0x10], 0
je 0x14000889f
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
lea rdx, [0x140050220]
lea rcx, [rbp - 0x18]
mov r8d, 0x24
call fcn.140032070
cmp qword [rbp - 0x18], 0
jne 0x1400088d1
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 8]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], rcx
lea rdx, [0x1400501f8]
lea rcx, [rbp - 0x20]
lea r9, [rbp + 0x18]
mov r8d, 0xa
call fcn.140007160
test rax, rax
jne 0x1400088df
lea rcx, [rbp - 0x20]
call fcn.14002e660
mov rdx, qword [rbp - 0x30]
test rdx, rdx
je 0x140008767
mov r8d, 1
mov rcx, qword [rbp - 0x40]
jmp 0x140008762
test rdx, rdx
je 0x140008767
mov rcx, qword [rbp - 0x10]
mov r8d, 1
call fcn.14000bc20
lea rcx, [rbp - 0x38]
call fcn.14002e660
lea rcx, [rbp - 0x28]
call fcn.14002e660
cmp byte [rbp + 0x2f], 2
je 0x140008788
lea rcx, [rbp + 0x2d]
call fcn.140012280
mov rcx, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x50]
call qword [rsi + 0x18]
test rsi, rsi
sete al
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop rbp
ret
movzx eax, bl
cmp eax, 1
jne 0x1400087ca
lea rcx, [0x1400502c0]
lea r8, [0x1400502a8]
mov edx, 0x23
call fcn.14004e080
jmp 0x14000890b
lea rcx, [0x1400502f0]
lea r8, [0x1400502a8]
mov edx, 0x22
call fcn.14004e080
jmp 0x14000890b
movzx eax, byte [rbp + 0x19]
mov byte [rbp - 0x18], al
lea rdx, [0x140050180]
lea rcx, [rbp - 0x18]
call fcn.14004ad60
jmp 0x14000890b
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x18], rax
lea rax, [0x1400501e0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400500f8]
lea r9, fcn.140004fb0
lea r8, [rbp + 0x18]
mov edx, 0x2b
call fcn.14004e450
jmp 0x14000890b
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x18], rax
lea rax, [0x140050208]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400500f8]
lea r9, fcn.140004fb0
lea r8, [rbp + 0x18]
mov edx, 0x2b
call fcn.14004e450
jmp 0x14000890b
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0x18], rax
lea rax, [0x140050248]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400500f8]
lea r9, fcn.140004fb0
lea r8, [rbp + 0x18]
mov edx, 0x2b
call fcn.14004e450
jmp 0x14000890b
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x18], rax
lea rax, [0x140050260]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400500f8]
lea r9, fcn.140004fb0
lea r8, [rbp + 0x18]
mov edx, 0x2b
call fcn.14004e450
jmp 0x14000890b
lea rcx, [0x140050278]
call fcn.14004df20
jmp 0x14000890b
mov qword [rbp - 0x18], rax
lea rax, [0x140050290]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400500f8]
lea r9, fcn.140004fb0
lea r8, [rbp - 0x18]
mov edx, 0x2b
call fcn.14004e450
ud2