Function at 0x140001cd0
Capabilities:
Check mutex on windows
Create thread
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14000f028]
xor rax, rsp
mov qword [rbp - 8], rax
xor r12d, r12d
mov dword [rbp - 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14000a730]
lea rcx, [rbp - 0x20]
call qword [sym.imp.CFGMGR32.dll_CM_Get_Device_Interface_List_SizeW]
test eax, eax
je 0x140001d44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14000a6b8]
lea rcx, str.CM_Get_Device_Interface_List_Size_failed_for__s_driver._Error_code__0x_08X
call fcn.140007d50
jmp 0x140001dd5
mov eax, dword [rbp - 0x20]
cmp eax, 1
ja 0x140001d61
lea rdx, [0x14000a6b8]
lea rcx, str.Could_not_find_device_path_for__s_driver
call fcn.140007e70
jmp 0x140001dd5
mov rcx, rax
mov eax, 2
mul rcx
mov rdi, rax
mov rax, 0xffffffffffffffff
cmovo rdi, rax
mov rcx, rdi
call fcn.140008a84
mov rbx, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], r12d
mov r9d, dword [rbp - 0x20]
mov r8, rbx
xor edx, edx
lea rcx, [0x14000a730]
call qword [sym.imp.CFGMGR32.dll_CM_Get_Device_Interface_ListW]
test eax, eax
je 0x140001e13
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14000a6b8]
lea rcx, str.CM_Get_Device_Interface_List_failed_for__s_driver._Error_code__0x_08X
call fcn.140007d50
mov rcx, rbx
call fcn.14000858c
lea rcx, str.main:_could_not_get_PMF_handle
call fcn.140007d50
mov eax, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140008530
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
test rbx, rbx
je 0x140001dd5
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001e63
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x14000a6b8]
lea rcx, str.getDeviceHandle:_CreateFile__s__error_code__0x_08X
jmp 0x140001dc8
mov rcx, rbx
call fcn.14000858c
test rsi, rsi
je 0x140001dd5
mov dword [rbp - 0x30], r12d
mov dword [rbp - 0x28], 4
mov dword [0x14000fa88], 1
mov dword [0x14000fa8c], 1
mov dword [0x14000fa90], 1
mov dword [0x14000fa94], 1
mov dword [0x14000fa98], 1
mov qword [rbp - 0x38], r12
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesAMDPMFServiceFeatures
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x140002026
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 0x10
lea r8, str.EnableLogging
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140001f28
mov eax, dword [rbp - 0x30]
mov dword [0x14000fa88], eax
mov byte [0x14000fa7c], 1
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 0x10
lea r8, str.MonitorBrightness
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140001f65
mov eax, dword [rbp - 0x30]
mov dword [0x14000fa8c], eax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 0x10
lea r8, str.EventBased
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140001fa2
mov eax, dword [rbp - 0x30]
mov dword [0x14000fa90], eax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 0x10
lea r8, str.ForegroundWindowChange
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140001fdf
mov eax, dword [rbp - 0x30]
mov dword [0x14000fa94], eax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 0x10
lea r8, str.IdleActivity
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x14000201c
mov eax, dword [rbp - 0x30]
mov dword [0x14000fa98], eax
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov r14, rax
test rax, rax
jne 0x140002055
lea rcx, str.main:_CreateEvent
call fcn.140007d50
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140001de6
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9, r14
lea r8, [0x140002450]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r12
mov qword [rbp - 0x20], r12
mov eax, dword [0x14000fa90]
test eax, eax
je 0x1400020e3
mov ecx, 0xc0
call fcn.140008550
mov rbx, rax
mov qword [rbp - 0x38], rax
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.140007f80
lea rax, vtable.PmfEventAgent.0
mov qword [rbx], rax
mov qword [rbx + 0x98], rsi
mov qword [rbx + 0xa0], r12
mov qword [rbx + 0xa8], r12
mov qword [rbx + 0xb0], r12
mov qword [rbx + 0xb8], r12
mov qword [rbp - 0x18], rbx
mov eax, dword [0x14000fa98]
test eax, eax
je 0x14000217b
mov ecx, 0xe0
call fcn.140008550
mov rbx, rax
mov qword [rbp - 0x38], rax
xor edx, edx
mov r8d, 0xe0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call fcn.140007f80
nop
lea rax, vtable.IdleTrackingAgent.0
mov qword [rbx], rax
mov qword [rbx + 0x98], rsi
lea rcx, [rbx + 0xa0]
call fcn.140003c90
nop
mov qword [rbp - 0x10], rbx
cmp qword [rbx + 0x50], 0
jne 0x140002167
lea r9, [rbx + 0x58]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
lea r8, [0x140008190]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x50], rax
mov byte [rbp - 0x40], 1
lea rdx, [rbp - 0x40]
lea rcx, [rbx + 0xa0]
call fcn.140002860
mov eax, dword [0x14000fa94]
test eax, eax
je 0x1400022e7
mov ecx, 0x170
call fcn.140008550
mov rdi, rax
mov qword [rbp - 0x38], rax
xor edx, edx
mov r8d, 0x170
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rdi
call fcn.140007f80
nop
lea rax, vtable.WindowTrackingAgent.0
mov qword [rdi], rax
mov qword [rdi + 0x98], rsi
mov qword [rdi + 0xa0], r12
mov dword [rdi + 0xa8], r12d
lea rsi, [rdi + 0xb0]
mov qword [rbp - 0x28], rsi
lea rax, vtable.Channel_struct_WindowTrackingAgent::TrackAppMessage_.0
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rbp - 0x28], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x20], r12
mov ecx, 0x10
call fcn.140008550
mov qword [rax + 8], r12
mov qword [rbx], rax
mov qword [rax], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x38], rax
lea rsi, [rdi + 0xf0]
mov qword [rbp - 0x28], rsi
lea rax, vtable.Channel_struct_HWND______ptr64_.0
mov qword [rsi], rax
lea rbx, [rsi + 8]
mov qword [rbp - 0x28], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
mov qword [rbx + 0x20], r12
mov ecx, 0x10
call fcn.140008550
mov qword [rax + 8], r12
mov qword [rbx], rax
mov qword [rax], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rsi + 0x30], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi + 0x38], rax
lea rcx, [rdi + 0x130]
call fcn.140003c90
mov qword [0x14000faa8], rdi
mov qword [rbp - 0x20], rdi
cmp qword [rdi + 0x50], 0
jne 0x1400022eb
lea r9, [rdi + 0x58]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
lea r8, [0x140008190]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x50], rax
jmp 0x1400022eb
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
test rbx, rbx
setne r15b
mov rsi, qword [rbp - 0x10]
test rbx, rbx
je 0x140002351
test rsi, rsi
je 0x14000230b
mov qword [rbx + 0xb0], rsi
test rdi, rdi
je 0x140002317
mov qword [rbx + 0xb8], rdi
cmp qword [rbx + 0x50], 0
jne 0x140002351
lea r9, [rbx + 0x58]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
lea r8, [0x140008190]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x50], rax
mov edx, 0xffffffff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x140002364
mov edx, 0xffffffff
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test r15b, r15b
je 0x140002397
lea rcx, [rbx + 8]
mov byte [rbp - 0x40], 1
lea rdx, [rbp - 0x40]
call fcn.140002860
mov rcx, qword [rbx + 0x50]
test rcx, rcx
je 0x140002397
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x50], r12
test rsi, rsi
je 0x1400023cf
lea rcx, [rsi + 8]
mov byte [rbp - 0x40], 1
lea rdx, [rbp - 0x40]
call fcn.140002860
mov rcx, qword [rsi + 0x50]
test rcx, rcx
je 0x1400023cf
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsi + 0x50], r12
test rdi, rdi
je 0x140002407
lea rcx, [rdi + 8]
mov byte [rbp - 0x40], 1
lea rdx, [rbp - 0x40]
call fcn.140002860
mov rcx, qword [rdi + 0x50]
test rcx, rcx
je 0x140002407
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x50], r12
test rdi, rdi
je 0x14000241a
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
test rsi, rsi
je 0x14000242d
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
test rbx, rbx
je 0x14000243f
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
xor eax, eax
jmp 0x140001de6