Function at 0x140010820
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x140028050]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rax, [rbp - 0x49]
lea rdx, str.SYSTEMControlSet001Control920DEC42_4CA5_4d1d_9487_67BE645CDDFC
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x3d], 4
mov dword [rbp - 0x41], esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400108b3
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x3d]
lea rdx, str.EnableServiceDebug
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x41]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [rbp - 0x41]
jmp 0x1400108b5
mov ebx, esi
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
jne 0x1400108c5
int3
lea r9, str.17:06:43
lea r8, str.Jan_10_2017
lea rdx, str.Built:__hs__hs_n
lea rcx, [rbp - 0x29]
call fcn.14000d000
lea rcx, [0x14002a810]
xor edx, edx
mov r8d, 0x24ab0
call fcn.140014310
lea rax, [rbp - 0x49]
lea rdx, str.SYSTEMControlSet001Control920DEC42_4CA5_4d1d_9487_67BE645CDDFC
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x3d], 4
mov dword [rbp - 0x41], esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140010959
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x3d]
lea rdx, str.ResumeImgDump
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x41]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [rbp - 0x41]
jmp 0x14001095b
mov ebx, esi
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x14002a8a0]
mov r14d, 1
mov qword [rsp + 0x30], rsi
cmp ebx, r14d
lea rcx, str.._amdacpksd
cmove eax, r14d
mov edx, 0xc0000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x20], 3
mov dword [0x14002a8a0], eax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rdx, str.SYSTEMControlSet001Services_amdacpusrsvc
mov qword [0x14004f308], rax
lea rax, [rbp - 0x49]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rbp - 0x3d], 4
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x41], esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x140010a18
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x3d]
lea rdx, str.OSVersion
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x41]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [rbp - 0x41]
mov edi, eax
jmp 0x140010a1a
mov ebx, esi
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14000d330
cmp edi, 2
jne 0x140010a36
mov r8d, eax
jmp 0x140010ae2
mov edi, eax
cmp ebx, eax
jge 0x140010ae7
cmp qword [0x14004f308], 0xffffffffffffffff
jne 0x140010adf
call fcn.140010690
cmp qword [0x14004f308], 0xffffffffffffffff
movzx ebx, al
jne 0x140010adf
mov ecx, dword [0x1400af330]
cmp ecx, 0xa
jge 0x140010adf
cmp bl, r14b
jne 0x140010adf
inc ecx
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [0x1400af330], ecx
lea rcx, str.._amdacpksd
xor r8d, r8d
mov edx, 0xc0000000
mov dword [rsp + 0x28], 0x40000080
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x14004f308], rax
cmp rax, 0xffffffffffffffff
jne 0x140010adf
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, dword [0x1400af330]
mov rdx, qword [0x14004f308]
lea rcx, str._OnStart:_Device_handle:_0x_x_Error:_0x_x_Re_Try_Count:_0x_x_n
mov r8d, eax
call fcn.14000d100
cmp qword [0x14004f308], 0xffffffffffffffff
je 0x140010a60
mov r8d, edi
call fcn.14000d250
mov rcx, qword [0x14004f308]
cmp rcx, 0xffffffffffffffff
je 0x140010c37
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x3d]
lea r8, [0x14002a814]
mov qword [rsp + 0x30], rax
mov edx, 0x9c412c00
mov r9d, 0x44
mov dword [rsp + 0x28], 0x44
mov qword [rsp + 0x20], r8
mov dword [rbp - 0x3d], esi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [0x14002a814], esi
jbe 0x140010c37
lea r8, [0x1400104f0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x14004f2e8], rax
call fcn.14000e580
test eax, eax
je 0x140010b75
mov dword [0x14002a89c], r14d
mov dword [0x14004f2e4], r14d
mov rcx, qword [0x14004f308]
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x39]
mov qword [rsp + 0x30], rax
lea r8, [0x14004f2e4]
mov edx, 0x9c412c40
mov r9d, 4
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], r8
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, esi
lea rdi, [0x1400af310]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi], rax
test rax, rax
je 0x140010c2c
inc ebx
add rdi, 8
cmp ebx, 3
jb 0x140010bc0
mov rcx, qword [0x14004f308]
mov qword [rsp + 0x38], rsi
lea rax, [rbp - 0x39]
mov qword [rsp + 0x30], rax
lea r8, [0x1400af310]
mov r9d, 0x18
mov edx, 0x9c412800
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140010c2c
lea edx, [rax + 2]
lea rcx, str.acpusrsvc:_OnStart:_REGISTER_USR_SVC_EVENTS:_FAILED
call fcn.14000d030
call fcn.140011240
mov dword [0x14004f2c4], eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140011740
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret