Function at 0x4f9620
Capabilities:
Persist via run registry key

Disassembly:
lea r12, [rsp - 0x80]
cmp r12, qword [r14 + 0x10]
jbe 0x4f9a58
push rbp
mov rbp, rsp
sub rsp, 0xf8
movq qword [rsp + 0xf0], xmm15
mov byte [rsp + 0x37], 0
movups xmmword [rsp + 0x58], xmm15
call fcn.004aa520
test rcx, rcx
je 0x4f96ac
movups xmmword [rsp + 0xe0], xmm15
je 0x4f9668
mov rcx, qword [rcx + 8]
mov qword [rsp + 0xe0], rcx
mov qword [rsp + 0xe8], rdi
lea rax, [0x0054194f]
mov ebx, 0x21
lea rcx, [rsp + 0xe0]
mov edi, 1
mov rsi, rdi
call fcn.004adb20
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
add rsp, 0xf8
pop rbp
ret
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rbx
mov eax, 0x80000001
lea rbx, [0x005445f9]
mov ecx, 0x2d
mov edi, 0x20006
call fcn.004ef420
test rbx, rbx
je 0x4f972a
movups xmmword [rsp + 0xe0], xmm15
nop
je 0x4f96e6
mov rbx, qword [rbx + 8]
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0xe8], rcx
lea rax, [0x00541030]
mov ebx, 0x1f
lea rcx, [rsp + 0xe0]
mov edi, 1
mov rsi, rdi
call fcn.004adb20
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
add rsp, 0xf8
pop rbp
ret
mov qword [rsp + 0x38], rax
lea rdx, [0x004f9b40]
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x48]
mov qword [rsp + 0xf0], rdx
mov byte [rsp + 0x37], 1
lea rbx, [0x00538c35]
mov ecx, 5
nop
call fcn.004ef700
test rdi, rdi
je 0x4f9773
mov r8, qword [rsp + 0x40]
xor eax, eax
jmp 0x4f9794
mov r8, qword [rsp + 0x40]
cmp rbx, r8
je 0x4f9782
xor eax, eax
nop
jmp 0x4f9794
mov rcx, rbx
mov rbx, qword [rsp + 0x68]
call fcn.00403380
mov r8, qword [rsp + 0x40]
test al, al
jne 0x4f9935
nop
mov rax, qword [rsp + 0x38]
lea rbx, [0x00538c35]
mov ecx, 5
mov edi, 1
mov rsi, qword [rsp + 0x68]
call fcn.004ef900
nop dword [rax]
test rax, rax
je 0x4f9836
movups xmmword [rsp + 0xe0], xmm15
je 0x4f97d4
mov rax, qword [rax + 8]
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rbx
lea rax, [0x00540a36]
mov ebx, 0x1e
lea rcx, [rsp + 0xe0]
mov edi, 1
mov rsi, rdi
call fcn.004adb20
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov byte [rsp + 0x37], 0
mov rdx, qword [rsp + 0xf0]
mov r8, qword [rdx]
nop
call r8
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0xf8
pop rbp
ret
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
lea rcx, [0x0050af40]
mov qword [rsp + 0x70], rcx
lea rdx, [0x0056d718]
mov qword [rsp + 0x78], rdx
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x40]
call fcn.00464760
lea rcx, [0x0050af40]
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], rax
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
lea rcx, [0x004f9a80]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xc0], 0x21
lea rcx, [0x00541970]
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xd0], 2
mov qword [rsp + 0xd8], 2
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xc8], rcx
mov rax, qword [0x0063e560]
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0xb0]
call fcn.004f1460
movups xmmword [rsp + 0x58], xmm15
mov byte [rsp + 0x37], 0
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rdx]
nop
call rcx
mov rbx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
add rsp, 0xf8
pop rbp
ret
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
lea rcx, [0x0050af40]
mov qword [rsp + 0x90], rcx
lea rdx, [0x0056d718]
mov qword [rsp + 0x98], rdx
mov rax, qword [rsp + 0x68]
mov rbx, r8
call fcn.00464760
lea rcx, [0x0050af40]
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0xa8], rax
movups xmmword [rsp + 0xb0], xmm15
movups xmmword [rsp + 0xc0], xmm15
movups xmmword [rsp + 0xd0], xmm15
lea rcx, [0x004f9ae0]
mov qword [rsp + 0xb0], rcx
mov qword [rsp + 0xc0], 0x26
lea rcx, [0x00542db2]
mov qword [rsp + 0xb8], rcx
mov qword [rsp + 0xd0], 2
mov qword [rsp + 0xd8], 2
lea rcx, [rsp + 0x90]
mov qword [rsp + 0xc8], rcx
mov rax, qword [0x0063e560]
xor ebx, ebx
mov ecx, 2
lea rdi, [rsp + 0xb0]
call fcn.004f1460
movups xmmword [rsp + 0x58], xmm15
mov byte [rsp + 0x37], 0
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rdx]
call rcx
mov rbx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
add rsp, 0xf8
pop rbp
ret
call fcn.0046ebe0
nop dword [rax]
jmp fcn.004f9620