Function at 0x14000f5b0
Capabilities:
Accept command line arguments
Check mutex on windows
Create thread
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140073058]
xor rax, rsp
mov qword [rbp + 0x40], rax
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x14000f5e8
xor eax, eax
jmp 0x14000fb9c
xor r15d, r15d
mov ebx, r15d
mov dword [rsp + 0x4c], r15d
cmp word [rcx], r15w
jne 0x14000f5fe
mov r14d, r15d
jmp 0x14000f60c
lea rdx, [rsp + 0x4c]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r14, rax
cmp word [rdi], bx
je 0x14000fb8c
mov rdx, rdi
lea rcx, str.Cmd_Line__s_n
call fcn.14000fcd0
lea rdx, str._PnPTask
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000f650
call fcn.14000ffa0
test al, al
jne 0x14000f646
call fcn.140010890
mov ebx, 1
jmp 0x14000fb8c
lea rdx, str._EnableDGPUOffMode
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000f673
call fcn.140013bd0
mov ebx, 1
jmp 0x14000fb8c
lea rdx, str._ADM
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000f85c
lea ebx, [rax + 1]
lea r8, str.Mutex_ADMProcess
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
test rax, rax
je 0x14000fb8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000f854
call fcn.140001ee0
test rax, rax
je 0x14000f846
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
lea rdi, [rsp + 0x30]
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov r8d, dword [rsp + 0x30]
and r8d, 0xffff1f0b
or r8d, 0x100b
lea rdi, [rsp + 0x48]
mov ecx, 4
rep stosb byte [rdi], al
lea r9, [rsp + 0x30]
mov edx, 0x22270c
lea rcx, [rsp + 0x38]
call fcn.14001ec30
test eax, eax
je 0x14000f826
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14000f826
test bl, al
je 0x14000f826
shr eax, 8
movzx edi, al
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000f746
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000f756
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
jne 0x14000f846
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140075d90], rax
test rax, rax
je 0x14000f846
call fcn.140004480
test al, al
je 0x14000f846
call fcn.140001ee0
mov rdi, rax
test rax, rax
je 0x14000f846
mov rcx, rax
call fcn.140025fe0
cmp qword [rdi + 0x18], r15
jne 0x14000f7d0
lea rax, [rdi + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, rdi
lea r8, [0x140025280]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 0x18], rax
mov rcx, rdi
call fcn.140025df0
test al, al
je 0x14000f7e4
mov rcx, rdi
call fcn.140025c30
mov edx, 0xffffffff
mov rcx, qword [0x140075d90]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140075d90]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [0x140075d90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140025ce0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14000fb8c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000f836
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000f846
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14000fb8c
mov rcx, rsi
jmp 0x14000fb86
lea rdx, str._OPSTCHK
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000f9b3
lea ebx, [rax + 1]
call fcn.14000f510
mov rdi, rax
test rax, rax
jne 0x14000f890
mov eax, 0xc8
mov dword [rsi], eax
jmp 0x14000fb8c
xor edx, edx
mov r8d, 0xf0
lea rcx, [rsp + 0x50]
call fcn.14002d0c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000f989
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000f989
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000f989
lea rdx, [0x140076118]
lea rcx, [rsp + 0x50]
call fcn.140004a20
test al, al
jne 0x14000f96c
lea rdx, [0x140076140]
lea rcx, [rsp + 0x50]
call fcn.140004a20
test al, al
je 0x14000f989
mov rcx, rdi
call fcn.14001f1a0
movzx edi, al
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000f99c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000f99c
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000f999
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor dil, dil
mov eax, 0xc8
mov ecx, 0x64
test dil, dil
cmovne eax, ecx
mov dword [rsi], eax
jmp 0x14000fb8c
lea rdx, str._OPSTSTART
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000fa2d
lea ebx, [rax + 1]
lea r8, str.Mutex_OPSTProcess
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
test rax, rax
je 0x14000fb8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000fb83
call fcn.14000f510
test rax, rax
jne 0x14000fa17
mov eax, 0xc8
mov dword [rsi], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14000fb8c
mov rcx, rax
call fcn.14001f730
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14000fb8c
lea rdx, str._HID
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14000fb8c
lea ebx, [rax + 1]
lea r8, str.Mutex_ITSHIDProcess
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
test rax, rax
je 0x14000fb8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000fb83
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x140075e18], rax
test rax, rax
je 0x14000fb78
mov dword [rsp + 0x30], r15d
cmp qword [0x140075e20], r15
jne 0x14000fadb
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
mov r9, qword [0x140075e68]
lea r8, [0x140018060]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140075e20], rax
test rax, rax
je 0x14000fb78
mov dword [rsp + 0x48], r15d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [0x1400183a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rsi, rax
test rax, rax
jne 0x14000fb23
mov rcx, qword [0x140075e20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14000fb8c
mov edx, 0xffffffff
mov rcx, qword [0x140075e18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, 0xffffffff
mov rcx, qword [0x140075e20]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x140075e18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140075e20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
jmp 0x14000fb8c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x14000fb9a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, ebx
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.14002a740
mov rbx, qword [rsp + 0x190]
add rsp, 0x150
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret