Function at 0x140084bf0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
mov eax, 0x1020
call fcn.14011c260
sub rsp, rax
mov rax, qword [0x14016adb0]
xor rax, rsp
mov qword [rsp + 0x1000], rax
test rcx, rcx
mov rbp, rcx
jne 0x140084c20
xor eax, eax
jmp 0x1400851df
lea rdx, [rsp + 0x9d0]
lea rcx, str.VDeck.via
call fcn.1400849c0
test eax, eax
je 0x140084c19
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x1010], r12
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x9d0]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8, [0x14013b188]
lea rdx, [rsp + 0x6b0]
lea rcx, [rsp + 0x50]
call fcn.1400fb860
mov r8, qword [rsp + 0x50]
test r8, r8
je 0x140084cb9
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.1400fb8d0
test rax, rax
jne 0x140084cc0
mov rcx, qword [rsp + 0x50]
call fcn.1400fb3d0
xor eax, eax
jmp 0x1400851d7
mov qword [rsp + 0x1038], rbx
mov qword [rsp + 0x1040], rsi
mov qword [rsp + 0x1018], rdi
cmp byte [rsp + 0x60], 0x5b
je 0x140084d0c
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.1400fb8d0
test rax, rax
jne 0x140084cd8
mov rcx, qword [rsp + 0x50]
call fcn.1400fb3d0
mov eax, 1
jmp 0x1400851bf
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
mov edx, r12d
mov rsi, r12
not rcx
sub rcx, 1
je 0x140084cd8
cmp byte [rsp + rsi + 0x60], 0x5d
je 0x140084d3f
add edx, 1
add rsi, 1
mov eax, edx
cmp rax, rcx
jb 0x140084d28
jmp 0x140084cd8
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x390]
lea rdx, [rsp + 0x61]
call fcn.1400fd180
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov byte [rsp + rsi + 0x38f], r12b
call fcn.1400fb8d0
test rax, rax
je 0x140084cd8
nop
nop
movzx eax, byte [rsp + 0x60]
cmp al, 0x3b
je 0x140085191
cmp al, 0x5b
je 0x140084cd8
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x60]
repne scasb al, byte [rdi]
mov edx, r12d
mov rsi, r12
not rcx
sub rcx, 1
mov rbx, rcx
je 0x140085191
cmp byte [rsp + rsi + 0x60], 0x3d
je 0x140084dd2
add edx, 1
add rsi, 1
mov eax, edx
cmp rax, rcx
jb 0x140084db8
jmp 0x140085191
mov edi, edx
mov r8d, edx
lea rcx, [rsp + 0x280]
lea rdx, [rsp + 0x60]
call fcn.1400fd180
mov r8, rbx
lea rdx, [rsp + rdi + 0x61]
lea rcx, [rsp + 0x170]
sub r8, rdi
mov byte [rsp + rsi + 0x280], r12b
call fcn.1400fd180
or rcx, 0xffffffffffffffff
xor eax, eax
sub rbx, rsi
lea rdi, [rsp + 0x390]
repne scasb al, byte [rdi]
mov byte [rsp + rbx + 0x170], r12b
not rcx
sub rcx, 1
test ecx, ecx
mov rax, rcx
jle 0x140084e5c
cmp byte [rsp + 0x390], 0x20
jne 0x140084e5c
test eax, eax
movsxd rcx, eax
jle 0x140084e55
lea rdi, [rsp + 0x390]
lea rsi, [rsp + 0x391]
rep movsb byte [rdi], byte [rsi]
sub eax, 1
test eax, eax
jg 0x140084e32
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x390]
repne scasb al, byte [rdi]
not rcx
lea edx, [rcx - 2]
lea r8, [rcx - 1]
test edx, edx
movsxd rax, edx
js 0x140084eb4
nop
cmp byte [rsp + rax + 0x390], 0x20
lea rdi, [rsp + rax + 0x390]
jne 0x140084eb4
movsxd rcx, r8d
cmp rax, rcx
jge 0x140084ea7
lea rsi, [rsp + rax + 0x391]
sub rcx, rax
rep movsb byte [rdi], byte [rsi]
sub r8d, 1
sub rax, 1
sub edx, 1
jns 0x140084e80
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x280]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
mov rax, rcx
jle 0x140084efc
cmp byte [rsp + 0x280], 0x20
jne 0x140084efc
test eax, eax
movsxd rcx, eax
jle 0x140084ef5
lea rdi, [rsp + 0x280]
lea rsi, [rsp + 0x281]
rep movsb byte [rdi], byte [rsi]
sub eax, 1
test eax, eax
jg 0x140084ed2
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x280]
repne scasb al, byte [rdi]
not rcx
lea edx, [rcx - 2]
lea r8, [rcx - 1]
test edx, edx
movsxd rax, edx
js 0x140084f54
nop
cmp byte [rsp + rax + 0x280], 0x20
lea rdi, [rsp + rax + 0x280]
jne 0x140084f54
movsxd rcx, r8d
cmp rax, rcx
jge 0x140084f47
lea rsi, [rsp + rax + 0x281]
sub rcx, rax
rep movsb byte [rdi], byte [rsi]
sub r8d, 1
sub rax, 1
sub edx, 1
jns 0x140084f20
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x170]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
mov rax, rcx
jle 0x140084f9c
cmp byte [rsp + 0x170], 0x20
jne 0x140084f9c
test eax, eax
movsxd rcx, eax
jle 0x140084f95
lea rdi, [rsp + 0x170]
lea rsi, [rsp + 0x171]
rep movsb byte [rdi], byte [rsi]
sub eax, 1
test eax, eax
jg 0x140084f72
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x170]
repne scasb al, byte [rdi]
not rcx
lea edx, [rcx - 2]
lea r8, [rcx - 1]
test edx, edx
movsxd rax, edx
js 0x140084ff4
nop
cmp byte [rsp + rax + 0x170], 0x20
lea rdi, [rsp + rax + 0x170]
jne 0x140084ff4
movsxd rcx, r8d
cmp rax, rcx
jge 0x140084fe7
lea rsi, [rsp + rax + 0x171]
sub rcx, rax
rep movsb byte [rdi], byte [rsi]
sub r8d, 1
sub rax, 1
sub edx, 1
jns 0x140084fc0
lea rax, [rsp + 0xbe0]
lea r8, [rsp + 0x390]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0xdf0]
lea r8, [rsp + 0x280]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x4a0]
lea r8, [rsp + 0x170]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rsp + 0xbe0]
lea r8, str.SYSTEMCurrentControlSetServicesVIA_HD_Audio_Codec_DefaultVDeckINI
lea rdx, str._s_s_s_
lea rcx, [rsp + 0x7c0]
mov r9, rbp
mov qword [rsp + 0x20], rax
call fcn.14001e4d0
lea rdx, [rsp + 0x58]
mov r9d, 0x20006
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x7c0]
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140085114
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x58]
lea r9, str.REG_SZ
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea rdx, [rsp + 0x7c0]
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400851b3
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x4a0]
repne scasw ax, word [rdi]
not rcx
cmp word [rsp + rcx*2 + 0x49c], 0xa
jne 0x14008513b
mov word [rsp + rcx*2 + 0x49c], ax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x4a0]
lea rdx, [rsp + 0xdf0]
repne scasw ax, word [rdi]
lea rax, [rsp + 0x4a0]
mov r9d, 1
not rcx
xor r8d, r8d
sub rcx, 1
add ecx, ecx
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400851b3
mov r8, qword [rsp + 0x50]
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.1400fb8d0
test rax, rax
jne 0x140084d80
jmp 0x140084cd8
mov rcx, qword [rsp + 0x50]
call fcn.1400fb3d0
xor eax, eax
mov rdi, qword [rsp + 0x1018]
mov rsi, qword [rsp + 0x1040]
mov rbx, qword [rsp + 0x1038]
mov r12, qword [rsp + 0x1010]
mov rcx, qword [rsp + 0x1000]
xor rcx, rsp
call fcn.1400f9790
add rsp, 0x1020
pop rbp
ret