Function at 0x140008920
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push rdi
mov eax, 0x1100
call fcn.14007a110
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1110], rbx
mov qword [rsp + 0x1118], rsi
mov rax, qword [0x1400a5de0]
xor rax, rsp
mov qword [rsp + 0x10f8], rax
xor esi, esi
mov rbx, qword [0x1400ae080]
test rbx, rbx
jne 0x140008a20
mov ecx, 0x310
call fcn.1400278b8
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140008a16
call fcn.14002790c
mov rdx, rax
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400089a6
mov ecx, 0x80004005
call fcn.140007e00
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov word [rbx + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x14008a5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14008a5b0]
mov rcx, rbx
call fcn.140008260
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rbx + 0x26c]
mov word [rcx], 0
lea r8, [0x14008a5b8]
mov edx, 0x50
call fcn.140052920
nop
jmp 0x140008a19
mov rbx, rsi
mov qword [0x1400ae080], rbx
lea rdx, str.Running_silent____Disable_SI...
mov rcx, rbx
call fcn.14000d860
mov edx, 0xa
lea rcx, [rsp + 0x50]
call fcn.140027e28
nop
mov word [rsp + 0x90], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x92]
call fcn.140057420
mov edx, 0x104
lea rcx, [rsp + 0x90]
call fcn.140006520
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140008b34
mov byte [rsp + 0xcf0], 0
xor edx, edx
mov r8d, 0x3ff
lea rcx, [rsp + 0xcf1]
call fcn.140057420
mov dword [rsp + 0x44], 0x400
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xcf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SavedProdInstalled
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140008b34
call fcn.14000d730
mov rcx, rax
lea rdx, str.Disable_SI_was_previously_executed.__Aborting...
call fcn.14000d860
nop
lea rcx, [rsp + 0x50]
call fcn.140028028
lea eax, [rdi + 1]
jmp 0x140008da9
call fcn.14000d730
mov rcx, rax
lea r8, str.HKLMRegKeyExists_failed
mov edx, edi
call fcn.14000daa0
mov dword [rsp + 0x20], esi
lea r9, [rsp + 0x50]
lea r8, str.ProdInstalled
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140015710
lea r9, [rsp + 0x50]
lea r8, str.SavedProdInstalled
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140015670
call fcn.140008480
mov word [rsp + 0xae0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xae2]
call fcn.140057420
mov word [rsp + 0x2a0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x2a2]
call fcn.140057420
mov word [rsp + 0xcf0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xcf2]
call fcn.140057420
mov word [rsp + 0x8d0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x8d2]
call fcn.140057420
call fcn.14003a0b8
mov rcx, qword [rax + 8]
mov r8d, 0x104
lea rdx, [rsp + 0x8d0]
mov rcx, qword [rcx + 0x88]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rsp + 0x38]
lea r8, [rsp + 0xcf0]
mov edx, 0x104
lea rcx, [rsp + 0x8d0]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov rdx, qword [rsp + 0x38]
mov word [rdx], 0
mov word [rsp + 0x2a0], 0
lea r8, [rsp + 0xcf0]
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call fcn.140052920
lea r9, [rsp + 0x2a0]
lea r8, str._s..x64
mov edx, 0x104
lea rcx, [rsp + 0xae0]
call fcn.140052ea0
mov word [rsp + 0x6c0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x6c2]
call fcn.140057420
mov edx, 0x104
lea rcx, [rsp + 0x6c0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov word [rsp + 0x4b0], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x4b2]
call fcn.140057420
mov rdi, qword [0x1400ae090]
test rdi, rdi
jne 0x140008d4a
lea ecx, [rdi + 0x30]
call fcn.1400278b8
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140008d40
mov ecx, 0x20
call fcn.1400278b8
nop
test rax, rax
je 0x140008d2e
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rsi
jmp 0x140008d31
mov rax, rsi
mov qword [rdi + 0x28], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x140008d43
mov rdi, rsi
mov qword [0x1400ae090], rdi
mov r9d, 0x104
lea r8, [rsp + 0x4b0]
lea rdx, str.SERVICE_NAME
mov rcx, rdi
call fcn.140012ca0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 1
lea r8, [rsp + 0x6c0]
lea rdx, [rsp + 0xae0]
lea rcx, [rsp + 0x4b0]
call fcn.140016300
call fcn.140006ae0
nop
lea rcx, [rsp + 0x50]
call fcn.140028028
mov eax, 1
mov rcx, qword [rsp + 0x10f8]
xor rcx, rsp
call fcn.1400524a0
lea r11, [rsp + 0x1100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret