Function at 0x140010bb4
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x180
mov rax, qword [0x14006bbc0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rsi, [0x1400972f0]
mov rdi, rax
lea rax, [0x140058478]
lea rdx, [0x1400972a0]
mov r9d, 0x64
mov r8, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.14000b274
movzx ecx, word [0x140058e04]
mov al, byte [0x140058e06]
lea rdx, [rsp + 0x30]
mov r12d, 1
mov word [rdx], cx
mov byte [rdx + 2], al
mov rcx, rdi
mov dword [0x140097468], r12d
jmp 0x140010cba
lea rdx, str.UnregServer
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140010e11
lea rdx, str.RegServer
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140010e01
lea rdx, str.Service
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140010dfc
lea rdx, str.Start
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140010dd0
lea rdx, str.Stop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140010db6
mov rcx, rbx
lea rdx, [rsp + 0x30]
call fcn.14000b210
mov rbx, rax
test rax, rax
jne 0x140010c3f
and qword [rsp + 0x38], 0
lea rax, [rsp + 0x38]
mov edi, 0x20019
lea rdx, str.AppID
mov r9d, edi
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140010e64
mov rbx, qword [rsp + 0x38]
and dword [rsp + 0x50], eax
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
lea rdx, str.46B003F9_4C3F_46A7_BA61_E8BCE22BFFCD
mov rcx, rbx
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test eax, eax
jne 0x140010e54
mov rdi, qword [rsp + 0x40]
and dword [rsp + 0x50], eax
lea r9, [rsp + 0x34]
lea r8, str.LocalService
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x34], 0x104
call fcn.14000a9e0
xor edx, edx
test eax, eax
mov rcx, rsi
cmove edx, r12d
mov dword [0x140097468], edx
call fcn.140010aa8
mov esi, dword [0x140097454]
test rdi, rdi
je 0x140010da1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140010daf
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x140010e64
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
js 0x140010df8
mov rcx, rsi
call fcn.14000b61c
jmp 0x140010de8
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
test eax, eax
js 0x140010df8
mov rcx, rsi
call fcn.14000b774
mov ecx, 0x80004005
test eax, eax
cmove ebx, ecx
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
jmp 0x140010e64
mov r8d, r12d
jmp 0x140010e04
xor r8d, r8d
mov edx, r12d
mov rcx, rsi
call fcn.140010890
jmp 0x140010e64
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x140010e64
mov rax, qword [0x1400972f0]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x64]
mov rcx, rsi
call qword [rax + 0x40]
mov rcx, rsi
call fcn.14000b51c
xor r8d, r8d
mov edx, r12d
mov rcx, rsi
call fcn.1400107d8
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
jmp 0x140010e64
test rbx, rbx
je 0x140010e62
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.140025570
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret