Function at 0x1400035e0
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x1d8]
sub rsp, 0x2d0
mov rax, qword [0x14001b060]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor edx, edx
lea rcx, str.IEEtwProxyStub.dll
mov r8d, 0x200
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
test rax, rax
jne 0x140003659
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
mov edi, 0x80070000
or ebx, edi
lea rdx, str.Failed_to_load_IEEtwProxyStub.dll_with_HResult
test eax, eax
lea rcx, str.ERROR:__s:_0x_08x_n
cmovle ebx, eax
mov r8d, ebx
call fcn.1400082e4
jmp 0x1400036c2
lea rdx, str.DllRegisterServer
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov edi, 0x80070000
test rax, rax
jne 0x140003692
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
lea rdx, str.Failed_to_load_IEEtwProxyStub.dll_with_HResult
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
jmp 0x1400036ad
mov rcx, rax
call qword [fcn.140001900]
call rbx
mov ebx, eax
test eax, eax
jns 0x1400036b9
mov r8d, eax
lea rdx, str.Failed_to_register_IEEtwProxyStub.dll_with_HResult
lea rcx, str.ERROR:__s:_0x_08x_n
call fcn.1400082e4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
js 0x1400039fc
mov r8d, 0x27
lea rdx, [rsp + 0x60]
lea rcx, [0x140016168]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
test eax, eax
jne 0x1400036fe
lea rdx, str.Failed_during_a_call_to_StringFromGUID
lea rcx, str.ERROR:__s
call fcn.1400082e4
mov ebx, 0x80004005
test ebx, ebx
js 0x1400039fc
mov esi, 0x104
lea r8, str.CLSID_
mov edx, esi
lea rcx, [rbp - 0x50]
call fcn.140001f74
mov ebx, eax
test eax, eax
js 0x1400039e1
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x1400039e1
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rbp - 0x50]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000000
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000381c
mov rcx, qword [rsp + 0x50]
lea rax, str.Internet_Explorer_ETW_Collector_Service
mov dword [rsp + 0x28], 0x50
lea rdx, [0x140016ec0]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400037f2
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x4e
lea rdx, str.AppID
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000380f
lea rcx, str.ERROR:_Failed_to_set_AppID_value_under_key__s__error:_0x_08x_n
jmp 0x1400037f9
lea rcx, str.ERROR:_Failed_to_set_Default_value_under_key__s__error:_0x_08x_n
movzx ebx, ax
lea rdx, [rbp - 0x50]
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.1400082e4
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003839
movzx ebx, ax
lea rdx, [rbp - 0x50]
or ebx, edi
lea rcx, str.ERROR:_Failed_to_create_registry_key__s__error:_0x_08x_n
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.1400082e4
test ebx, ebx
js 0x1400039e1
lea r8, str.AppID_
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.140001f74
mov ebx, eax
test eax, eax
js 0x1400039e1
lea r8, [rsp + 0x60]
lea rcx, [rbp - 0x50]
call fcn.140001ea0
mov ebx, eax
test eax, eax
js 0x1400039e1
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rbp - 0x50]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000000
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400039c0
mov rcx, qword [rsp + 0x50]
lea rax, str.IEEtwCollectorService
mov dword [rsp + 0x28], 0x2c
lea rdx, str.LocalService
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400039b7
mov rcx, qword [rsp + 0x50]
lea rax, [0x14001c220]
mov esi, 0x90
lea rdx, str.AccessPermission
mov dword [rsp + 0x28], esi
mov r9d, 3
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400039ae
mov rcx, qword [rsp + 0x50]
lea rax, [0x14001c190]
mov dword [rsp + 0x28], esi
lea rdx, str.LaunchPermission
mov r9d, 3
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400039a5
mov rcx, qword [rsp + 0x50]
lea r9d, [rax + 4]
lea rax, [rsp + 0x5c]
mov dword [rsp + 0x28], r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AuthenticationLevel
mov dword [rsp + 0x5c], 2
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140003997
lea rcx, str.ERROR:_Failed_to_set_AuthenticationLevel_value_under_key__s__error:_0x_08x_n
jmp 0x1400039c7
lea rcx, str.SUCCESS:_The_service_was_installed_successfully_n
call fcn.1400082e4
jmp 0x1400039dd
lea rcx, str.ERROR:_Failed_to_set_LaunchPermission_value_under_key__s__error:_0x_08x_n
jmp 0x1400039c7
lea rcx, str.ERROR:_Failed_to_set_AccessPermission_value_under_key__s__error:_0x_08x_n
jmp 0x1400039c7
lea rcx, str.ERROR:_Failed_to_set_LocalService_value_under_key__s__error:_0x_08x_n
jmp 0x1400039c7
lea rcx, str.ERROR:_Failed_to_create_registry_key__s__error:_0x_08x_n
movzx ebx, ax
lea rdx, [rbp - 0x50]
or ebx, edi
test eax, eax
cmovle ebx, eax
mov r8d, ebx
call fcn.1400082e4
test ebx, ebx
jns 0x1400039fc
mov r8d, ebx
lea rdx, str.Failed_while_setting_up_registry_with_HResult
lea rcx, str.ERROR:__s:_0x_08x_n
call fcn.1400082e4
call fcn.140003a2c
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140007df0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret