Function at 0x14000c980
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140019028]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ecx, ecx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rcx
lea rdx, str.SYSTEMCurrentControlSetServicesAMDPMFServiceFeatures
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000cc30
lea rax, [0x14001205c]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x60], rbx
lea rdx, str.EnableLogging
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000ca21
lea rcx, str.WriteRegistryPreferences___Unable_To_Set_Value
call fcn.14000d390
mov rcx, qword [rsp + 0x50]
lea rbx, [0x140012058]
mov dword [rsp + 0x28], 4
lea rdx, str.MonitorBrightness
mov r9d, 4
mov qword [rsp + 0x20], rbx
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000ca60
lea rcx, str.WriteRegistryPreferences___Unable_To_Set_Value
call fcn.14000d390
mov rcx, qword [rsp + 0x50]
lea rdx, str.EventBased
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000ca98
lea rcx, str.WriteRegistryPreferences___Unable_To_Set_Value
call fcn.14000d390
mov rcx, qword [rsp + 0x50]
lea rdx, str.ForegroundWindowChange
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000cad0
lea rcx, str.WriteRegistryPreferences___Unable_To_Set_Value
call fcn.14000d390
mov rcx, qword [rsp + 0x50]
lea rdx, str.MonitorCount
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000cb08
lea rcx, str.WriteRegistryPreferences___Unable_To_Set_Value
call fcn.14000d390
mov rcx, qword [rsp + 0x50]
lea rdx, str.IdleActivity
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000cb40
lea rcx, str.WriteRegistryPreferences___Unable_To_Set_Value
call fcn.14000d390
mov rcx, qword [rsp + 0x50]
lea rdx, str.PeripheralCount
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000cb78
lea rcx, str.WriteRegistryPreferences___Unable_To_Set_Value
call fcn.14000d390
mov rcx, qword [rsp + 0x50]
lea rdx, str.BatteryStatus
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000cbb0
lea rcx, str.WriteRegistryPreferences___Unable_To_Set_Value
call fcn.14000d390
mov rcx, qword [rsp + 0x50]
lea rdx, str.ProcessQueue
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000cbe8
lea rcx, str.WriteRegistryPreferences___Unable_To_Set_Value
call fcn.14000d390
mov rcx, qword [rsp + 0x50]
lea rdx, str.SensorData
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rbx, qword [rsp + 0x60]
test eax, eax
je 0x14000cc25
lea rcx, str.WriteRegistryPreferences___Unable_To_Set_Value
call fcn.14000d390
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000e120
add rsp, 0x68
ret