Function at 0x1400d2bc0
Capabilities:
Check if file exists
Create directory
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa60
mov qword [rsp + 0x9b8], 0xfffffffffffffffe
mov rax, qword [0x1402a15c0]
xor rax, rsp
mov qword [rsp + 0xa58], rax
call fcn.1400e09c0
test eax, eax
jne 0x1400d2bfb
xor eax, eax
jmp 0x1400d3845
call fcn.1400e0a70
cmp eax, 0xffffffff
je 0x1400d2c0c
xor eax, eax
jmp 0x1400d3845
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0xff
lea rcx, [rsp + 0x40]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, qword [rsp + 0xa70]
call fcn.140073564
xor ecx, ecx
call fcn.1400932d4
test eax, eax
jne 0x1400d2c58
mov r8d, 0xffffffff
xor edx, edx
mov ecx, 0x67
call fcn.1400f0f30
xor eax, eax
jmp 0x1400d3845
xor ecx, ecx
call fcn.140094180
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [rsp + 0xa70]
mov rax, qword [rax + 0x90]
movzx eax, word [rax]
test eax, eax
jne 0x1400d2cf1
lea rax, [rsp + 0x940]
mov qword [rsp + 0x948], rax
lea rcx, [rsp + 0x950]
call fcn.140001000
mov qword [rsp + 0x9c0], rax
mov rax, qword [rsp + 0x9c0]
mov qword [rsp + 0x9c8], rax
lea r8, [0x140211988]
mov rdx, qword [rsp + 0x9c8]
mov rcx, qword [rsp + 0x948]
call fcn.1400010b0
mov qword [rsp + 0x9d0], rax
mov rcx, qword [rsp + 0x9d0]
call fcn.1401b70d0
nop
lea rcx, [rsp + 0x950]
call fcn.140001490
call fcn.140187e70
test eax, eax
jne 0x1400d2d01
xor eax, eax
jmp 0x1400d3845
lea rdx, [0x140211998]
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa18c
test eax, eax
jne 0x1400d2d3b
xor r8d, r8d
mov edx, 0x40
lea rcx, str._uninstall:_uninstall_program_r_n_start:_start_service_r_n_stop:_stop_service_r_n_restart:_restart_service_r_n_update:_update_xml_data
call fcn.1400ef1c0
xor eax, eax
jmp 0x1400d3845
lea rdx, str._uninstall
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa18c
test eax, eax
jne 0x1400d2ef0
call fcn.140186dc0
xor edx, edx
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0xa0]
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0xf0], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7e7
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [0x1403ace90]
call fcn.1400d4040
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d6450
mov dword [rsp + 0xe8], 0
lea rcx, [0x1403acbe0]
call fcn.1400122c0
test eax, eax
jne 0x1400d2dfa
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xe8]
add eax, 1
mov dword [rsp + 0xe8], eax
cmp dword [rsp + 0xe8], 5
jl 0x1400d2df8
jmp 0x1400d2dfa
jmp 0x1400d2dc0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8033
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
test rax, rax
je 0x1400d2e3d
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x89
call fcn.1400f0f30
cmp eax, 6
jne 0x1400d2e3b
jmp 0x1400d2e3d
jmp 0x1400d2dfa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
lea rcx, [0x1403acbe0]
call fcn.1400d57b0
lea rcx, [0x1403ace90]
call fcn.1400d39c0
call fcn.1400ec0e0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [0x140211ac0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d2ecc
call fcn.140010180
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1403acbe0]
call fcn.140051eb0
test eax, eax
je 0x1400d2ee9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400d2ecc
xor eax, eax
jmp 0x1400d3845
lea rcx, [0x140211b20]
call fcn.1400a8204
mov r8, rax
lea rdx, str._restart
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400a939c
test eax, eax
jne 0x1400d2ff6
lea rcx, [0x1403ace90]
call fcn.1400d4040
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d6450
mov dword [rsp + 0xf8], 0
lea rcx, [0x1403acbe0]
call fcn.1400122c0
test eax, eax
jne 0x1400d2f81
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xf8]
add eax, 1
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0xf8], 5
jl 0x1400d2f7f
jmp 0x1400d2f81
jmp 0x1400d2f47
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403acbe0]
call fcn.1400d57b0
lea rcx, [0x1403ace90]
call fcn.1400d39c0
xor eax, eax
jmp 0x1400d3845
lea rdx, str._start
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa18c
test eax, eax
jne 0x1400d30c2
lea rcx, [0x1403ace90]
call fcn.1400d4040
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d6450
mov dword [rsp + 0xfc], 0
lea rcx, [0x1403acbe0]
call fcn.1400122c0
test eax, eax
jne 0x1400d3078
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xfc]
add eax, 1
mov dword [rsp + 0xfc], eax
cmp dword [rsp + 0xfc], 5
jl 0x1400d3076
jmp 0x1400d3078
jmp 0x1400d303e
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403acbe0]
call fcn.1400d57b0
lea rcx, [0x1403ace90]
call fcn.1400d39c0
xor eax, eax
jmp 0x1400d3845
lea rdx, str._stop
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa18c
test eax, eax
jne 0x1400d318e
lea rcx, [0x1403ace90]
call fcn.1400d4040
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d6450
mov dword [rsp + 0x100], 0
lea rcx, [0x1403acbe0]
call fcn.1400122c0
test eax, eax
jne 0x1400d3144
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x100]
add eax, 1
mov dword [rsp + 0x100], eax
cmp dword [rsp + 0x100], 5
jl 0x1400d3142
jmp 0x1400d3144
jmp 0x1400d310a
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403acbe0]
call fcn.1400d57b0
lea rcx, [0x1403ace90]
call fcn.1400d39c0
xor eax, eax
jmp 0x1400d3845
lea rdx, [0x140211b70]
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa18c
test eax, eax
jne 0x1400d325a
lea rcx, [0x1403ace90]
call fcn.1400d4040
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d6450
mov dword [rsp + 0x104], 0
lea rcx, [0x1403acbe0]
call fcn.1400122c0
test eax, eax
jne 0x1400d3210
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x104]
add eax, 1
mov dword [rsp + 0x104], eax
cmp dword [rsp + 0x104], 5
jl 0x1400d320e
jmp 0x1400d3210
jmp 0x1400d31d6
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x803d
xor edx, edx
lea rcx, [0x1403acbe0]
call fcn.1400d5e60
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403acbe0]
call fcn.1400d57b0
lea rcx, [0x1403ace90]
call fcn.1400d39c0
xor eax, eax
jmp 0x1400d3845
call fcn.140052070
movzx eax, al
test eax, eax
je 0x1400d3286
call fcn.140010510
lea rdx, str._install
mov rcx, qword [rax + 0x90]
call fcn.1400aa18c
test eax, eax
jne 0x1400d3780
lea rcx, [rsp + 0x110]
call fcn.1400053e0
nop
mov r9d, 0x2001f
lea r8, str.SYSTEMCurrentControlSetControlCrashControl
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x110]
call fcn.1400055a0
test eax, eax
jne 0x1400d3335
mov r8d, 1
lea rdx, [0x140211c00]
lea rcx, [rsp + 0x110]
call fcn.140005920
mov r8d, 3
lea rdx, str.CrashDumpEnabled
lea rcx, [rsp + 0x110]
call fcn.140005920
mov r8d, 1
lea rdx, str.LogEvent
lea rcx, [rsp + 0x110]
call fcn.140005920
mov r9d, 2
lea r8, str._SystemRoot_Minidump
lea rdx, [0x140211c90]
lea rcx, [rsp + 0x110]
call fcn.140005980
lea rcx, [rsp + 0x110]
call fcn.140005470
call fcn.140010180
mov rdx, rax
lea rcx, [rsp + 0x960]
call fcn.1400020d0
mov qword [rsp + 0x9d8], rax
mov rax, qword [rsp + 0x9d8]
mov qword [rsp + 0x9e0], rax
mov r8, qword [rsp + 0x9e0]
lea rdx, str.SoftwareMicrosoftWindowsWindows_Error_ReportingLocalDumps_
lea rcx, [rsp + 0x968]
call fcn.140006c90
mov qword [rsp + 0x9e8], rax
mov rax, qword [rsp + 0x9e8]
mov qword [rsp + 0x9f0], rax
lea r8, str..exe
mov rdx, qword [rsp + 0x9f0]
lea rcx, [rsp + 0x970]
call fcn.1400010b0
mov qword [rsp + 0x9f8], rax
mov rcx, qword [rsp + 0x9f8]
call fcn.140023510
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x110]
call fcn.1400054c0
test eax, eax
jne 0x1400d3414
mov dword [rsp + 0xa00], 1
jmp 0x1400d341f
mov dword [rsp + 0xa00], 0
movzx eax, byte [rsp + 0xa00]
mov byte [rsp + 0x958], al
lea rcx, [rsp + 0x970]
call fcn.140001490
nop
lea rcx, [rsp + 0x968]
call fcn.140001490
nop
lea rcx, [rsp + 0x960]
call fcn.140001490
movzx edx, byte [rsp + 0x958]
test edx, edx
je 0x1400d3649
mov r8d, 1
lea rdx, str.DumpType
lea rcx, [rsp + 0x110]
call fcn.140005920
lea rcx, [rsp + 0x978]
call fcn.140001000
mov qword [rsp + 0xa08], rax
mov rax, qword [rsp + 0xa08]
mov qword [rsp + 0xa10], rax
lea r8, [0x140211d58]
mov rdx, qword [rsp + 0xa10]
lea rcx, [rsp + 0x980]
call fcn.1400010b0
mov qword [rsp + 0xa18], rax
mov rcx, qword [rsp + 0xa18]
call fcn.140023510
mov r9d, 2
mov r8, rax
lea rdx, str.DumpFolder
lea rcx, [rsp + 0x110]
call fcn.140005980
lea rcx, [rsp + 0x980]
call fcn.140001490
nop
lea rcx, [rsp + 0x978]
call fcn.140001490
lea rcx, [rsp + 0x110]
call fcn.140005470
lea rcx, [rsp + 0x990]
call fcn.140001000
mov qword [rsp + 0xa20], rax
mov rax, qword [rsp + 0xa20]
mov qword [rsp + 0xa28], rax
lea r8, [0x140211d80]
mov rdx, qword [rsp + 0xa28]
lea rcx, [rsp + 0x998]
call fcn.1400010b0
mov qword [rsp + 0xa30], rax
mov rcx, qword [rsp + 0xa30]
call fcn.140023510
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d358c
mov dword [rsp + 0xa38], 1
jmp 0x1400d3597
mov dword [rsp + 0xa38], 0
movzx eax, byte [rsp + 0xa38]
mov byte [rsp + 0x988], al
lea rcx, [rsp + 0x998]
call fcn.140001490
nop
lea rcx, [rsp + 0x990]
call fcn.140001490
movzx edx, byte [rsp + 0x988]
test edx, edx
je 0x1400d3649
lea rcx, [rsp + 0x9a0]
call fcn.140001000
mov qword [rsp + 0xa40], rax
mov rax, qword [rsp + 0xa40]
mov qword [rsp + 0xa48], rax
lea r8, str.dump
mov rdx, qword [rsp + 0xa48]
lea rcx, [rsp + 0x9a8]
call fcn.1400010b0
mov qword [rsp + 0xa50], rax
mov rcx, qword [rsp + 0xa50]
call fcn.140023510
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x9a8]
call fcn.140001490
nop
lea rcx, [rsp + 0x9a0]
call fcn.140001490
call fcn.1401850e0
mov dword [rsp + 0x108], eax
cmp dword [rsp + 0x108], 0
je 0x1400d3773
call fcn.1400ec0e0
call fcn.1400ec1b0
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d3746
xor eax, eax
mov word [rsp + 0x130], ax
lea rdi, [rsp + 0x132]
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov eax, 0x22
mov word [rsp + 0x130], ax
lea rdx, [rsp + 0x132]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x140211e00]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov edi, eax
shl rdi, 1
call fcn.140010180
mov rdx, rax
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140186df0
test eax, eax
jne 0x1400d3773
mov dword [rsp + 0x9b0], 0
lea rcx, [rsp + 0x110]
call fcn.140005410
mov eax, dword [rsp + 0x9b0]
jmp 0x1400d3845
lea rcx, [rsp + 0x110]
call fcn.140005410
lea rcx, [0x1403acbe0]
call fcn.140051eb0
lea rdx, str._service
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa18c
test eax, eax
jne 0x1400d37bc
call fcn.1401850d0
call fcn.1400ec5f0
xor eax, eax
jmp 0x1400d3845
call fcn.14000edf0
lea r8, [rsp + 0x50]
lea rdx, str.32770
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassInfoW]
mov rax, qword [rsp + 0xa70]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x50]
call fcn.140080638
lea rcx, [rsp + 0xa0]
call fcn.140074100
nop
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa70]
call fcn.140073164
mov ecx, dword [rsp + 0xa8]
call fcn.1400d5060
mov dword [rsp + 0x9b4], 1
lea rcx, [rsp + 0xa0]
call fcn.1400741cc
mov eax, dword [rsp + 0x9b4]
mov rcx, qword [rsp + 0xa58]
xor rcx, rsp
call fcn.1400a8050
add rsp, 0xa60
pop rdi
ret