Function at 0x140001d0c
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
jmp 0x140032300
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x6f0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov rax, qword [0x14007c860]
xor rax, rsp
mov qword [rsp + 0x6e8], rax
mov rsi, r8
xor ebx, ebx
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rbx
lea edx, [rbx + 0xa]
mov r8d, 0x201
lea rcx, [r11 - 0x548]
call fcn.140003337
cmp qword [rax + 0x18], 0x10
jb 0x14003235f
mov rax, qword [rax]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp qword [rsp + 0x1d8], 0x10
jb 0x14003239c
mov rcx, qword [rsp + 0x1c0]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
test edi, edi
jne 0x1400328b2
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.PowerT
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140032408
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x140032408
cmp dword [rsp + 0x30], 3
jne 0x140032408
cmp dword [rsp + 0x38], 4
jne 0x140032408
cmp eax, 0x346b4c7f
sete byte [0x14007ca61]
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.TraceToDebugOut
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, 1
test eax, eax
jne 0x140032463
movzx eax, byte [0x14007ca60]
cmp dword [rsp + 0x34], ebx
cmovne eax, edi
mov byte [0x14007ca60], al
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x38], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.AssertsToDebugOut
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400324b9
movzx eax, byte [0x14007ca62]
cmp dword [rsp + 0x34], ebx
cmovne eax, edi
mov byte [0x14007ca62], al
mov byte [rsp + 0x2e0], bl
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0x2e1]
call sub.MSVCR110.dll_memset
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x38], 0x400
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.TraceFileName
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400328b2
cmp byte [rsp + 0x2e0], bl
je 0x1400328b2
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rax, [0x1400607e8]
mov qword [rsp + 0x60], rax
lea rax, [0x1400607f8]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xf8]
call qword [sym.imp.MSVCP110.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x48], edi
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP110.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea r15, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + rcx + 0x60], r15
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP110.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0xe0], rbx
mov dword [rsp + 0xe8], ebx
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x70]
call fcn.140003ae4
mov rcx, rax
lea rdx, [0x140060718]
call fcn.140003ae4
mov rdi, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, 2
lea rcx, [rsp + 0x160]
call qword [sym.imp.MSVCP110.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rcx, qword [rdi]
movsxd rcx, dword [rcx + 4]
add rcx, rdi
mov rdx, qword [rax + 8]
call qword [rax]
movzx edx, word [rsp + 0x192]
mov rcx, rdi
call qword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rcx, rax
lea rdx, [0x140060718]
call fcn.140003ae4
mov rdi, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, 2
lea rcx, [rsp + 0x170]
call qword [sym.imp.MSVCP110.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rcx, qword [rdi]
movsxd rcx, dword [rcx + 4]
add rcx, rdi
mov rdx, qword [rax + 8]
call qword [rax]
movzx edx, word [rsp + 0x196]
mov rcx, rdi
call qword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rcx, rax
lea rdx, [0x140060718]
call fcn.140003ae4
mov rcx, rax
movzx edx, word [rsp + 0x190]
call qword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rcx, rax
lea rdx, str._at_
call fcn.140003ae4
mov rdi, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, 2
lea rcx, [rsp + 0x180]
call qword [sym.imp.MSVCP110.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rcx, qword [rdi]
movsxd rcx, dword [rcx + 4]
add rcx, rdi
mov rdx, qword [rax + 8]
call qword [rax]
movzx edx, word [rsp + 0x198]
mov rcx, rdi
call qword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rdi, rax
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
mov byte [rdx + rax + 0x58], 0x30
mov edx, 2
lea rcx, [rsp + 0x1c0]
call qword [sym.imp.MSVCP110.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rcx, qword [rdi]
movsxd rcx, dword [rcx + 4]
add rcx, rdi
mov rdx, qword [rax + 8]
call qword [rax]
movzx edx, word [rsp + 0x19a]
mov rcx, rdi
call qword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
lea rdx, str._touchservice_
lea rcx, [rsp + 0x70]
call fcn.140003ae4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
lea rdx, str.pid_
lea rcx, [rsp + 0x70]
call fcn.140003ae4
mov rcx, rax
mov edx, edi
call qword [sym.imp.MSVCP110.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str..txt
call fcn.140003ae4
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x60]
call fcn.14000173f
mov r14, rax
lea rdi, [0x14007c370]
cmp rdi, rax
je 0x1400327cd
cmp qword [0x14007c388], 0x10
jb 0x1400327a9
mov rcx, qword [0x14007c370]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [0x14007c388], 0xf
mov qword [0x14007c380], rbx
mov byte [0x14007c370], 0
mov rdx, r14
mov rcx, rdi
call fcn.140002667
cmp qword [rsp + 0x1d8], 0x10
jb 0x1400327e5
mov rcx, qword [rsp + 0x1c0]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov rdx, rdi
cmp qword [0x14007c388], 0x10
cmovae rdx, qword [0x14007c370]
mov r9d, 0x40
lea r8d, [r9 - 0x36]
lea rcx, [0x14007ca78]
call fcn.140001aaf
xor r8d, r8d
test rax, rax
mov rax, qword [0x14007ca70]
movsxd rcx, dword [rax + 4]
lea rax, [0x14007ca70]
jne 0x140032837
add rcx, rax
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP110.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
jmp 0x140032842
add rcx, rax
xor edx, edx
call qword [sym.imp.MSVCP110.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
cmp byte [0x14007ca60], 0
je 0x14003286b
cmp qword [0x14007c388], 0x10
cmovae rdi, qword [0x14007c370]
mov rdx, rdi
lea rcx, str.Sending_trace_to_file__s_n
call fcn.1400031a2
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x60], r15
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x78]
call fcn.1400010e6
lea rcx, [rsp + 0x80]
call qword [sym.imp.MSVCP110.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rsp + 0xf8]
call qword [sym.imp.MSVCP110.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
cmp byte [0x14007ca60], 0
je 0x1400328c7
lea rcx, str.Service___Enter_Main_n
call fcn.1400031a2
mov qword [rsp + 0x1b8], 0xf
mov qword [rsp + 0x1b0], rbx
mov byte [rsp + 0x1a0], 0
cmp byte [rsi], 0
je 0x1400328f9
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rsi + rbx], 0
jne 0x1400328f0
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x1a0]
call fcn.1400017d0
nop
lea rsi, [rsp + 0x1a0]
mov rcx, qword [rsp + 0x1a0]
mov r8, qword [rsp + 0x1b8]
cmp r8, 0x10
cmovae rsi, rcx
lea rbx, [rsp + 0x1a0]
cmovae rbx, rcx
mov rdx, qword [rsp + 0x1b0]
add rbx, rdx
lea rdi, [rsp + 0x1a0]
cmp r8, 0x10
cmovae rdi, rcx
cmp rdi, rbx
je 0x14003298c
sub rsi, rdi
nop dword [rax]
movsx ecx, byte [rdi]
call qword [sym.imp.MSVCR110.dll_tolower]
mov byte [rdi + rsi], al
inc rdi
cmp rdi, rbx
jne 0x140032960
mov r8, qword [rsp + 0x1b8]
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x1a0]
test rdx, rdx
jne 0x1400329de
cmp byte [0x14007ca60], dl
je 0x1400329af
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rdx, rax
lea rcx, str.Service____s_n
call fcn.1400031a2
nop
lea rcx, [rsp + 0x1e0]
call fcn.140003797
nop
lea rcx, [rsp + 0x1e0]
call fcn.140002905
nop
lea rcx, [rsp + 0x1e0]
call fcn.140003463
nop
jmp 0x140032a9f
cmp byte [0x14007ca60], 0
je 0x140032a03
lea rdx, [rsp + 0x1a0]
cmp r8, 0x10
cmovae rdx, rcx
lea rcx, str.Service___cmdline___s_n
call fcn.1400031a2
mov r9d, 3
xor r8d, r8d
lea rdx, [0x140065aec]
lea rcx, [rsp + 0x1a0]
call fcn.140002f0e
cmp rax, 0xffffffffffffffff
je 0x140032a4e
mov cl, 1
call fcn.1400031d9
mov ebx, eax
cmp qword [rsp + 0x1b8], 0x10
jb 0x140032a47
mov rcx, qword [rsp + 0x1a0]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, ebx
jmp 0x140032acf
mov r9d, 2
xor r8d, r8d
lea rdx, [0x140065af0]
lea rcx, [rsp + 0x1a0]
call fcn.140002f0e
cmp rax, 0xffffffffffffffff
je 0x140032a75
xor ecx, ecx
jmp 0x140032a28
mov r9d, 2
xor r8d, r8d
lea rdx, [0x140065af4]
lea rcx, [rsp + 0x1a0]
call fcn.140002f0e
cmp rax, 0xffffffffffffffff
je 0x140032a9f
call fcn.14000277f
jmp 0x140032a2d
cmp byte [0x14007ca60], 0
je 0x140032ab5
lea rcx, str.Service___Exiting_Main_n
call fcn.1400031a2
nop
cmp qword [rsp + 0x1b8], 0x10
jb 0x140032acd
mov rcx, qword [rsp + 0x1a0]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
xor eax, eax
mov rcx, qword [rsp + 0x6e8]
xor rcx, rsp
call fcn.140052d40
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop r14
pop rdi
ret