Function at 0x1400040e8
Capabilities:
Accept command line arguments
Delete registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor r9d, r9d
mov rsi, rcx
xor r8d, r8d
lea r15d, [r9 + 1]
xor ecx, ecx
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rax, [rsp + 0x40]
xor r14d, r14d
lea rdx, str.SoftwareDebugehSched.exe
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdi, r14
mov qword [rsp + 0x40], r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x140006c22
lea rdx, str.ehSched::__tWinMain_starting
mov ecx, 8
call 0x1400b0000
xor edx, edx
lea rcx, [rsp + 0x4c]
lea r8d, [rdx + 0x2c]
call sub.msvcrt.dll_memset
lea rax, [0x140014510]
mov qword [rsp + 0x58], r14
movdqu xmm5, xmmword [0x140014500]
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x68], rax
movdqu xmmword [rsp + 0x48], xmm5
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, 0x80
lea edx, [rbp - 0x78]
mov rcx, rax
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
cmp rax, r14
je 0x140006c77
mov r8, rbp
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
jmp 0x1400041e6
cmp rbx, r14
je 0x140006c7f
lea rcx, [rbx + 0x30]
lea rdx, [rsp + 0x48]
mov r8d, 0x30
call sub.msvcrt.dll_memcpy
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x68], r14
mov byte [rbx + 0x70], r14b
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x20], r14
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x28], r14
lea r9, str.Starting_event_trace_in_ehSched.exe
mov r8d, 0x55000001
mov edx, r15d
mov rcx, rbx
mov qword [0x14001d338], rbx
call fcn.140004b98
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rbx, [0x14001d050]
mov rsi, rax
cmp rbx, 0xffffffffffffffff
je 0x14000427e
mov qword [0x14001d448], rbx
cmp qword [0x14001d050], r14
je 0x14000427e
mov cl, r15b
call qword [rbx + 0x40]
add rbx, 0x48
cmp qword [rbx], r14
jne 0x14000426f
mov rbx, qword [0x14001d2d0]
mov rax, qword [0x14001d2d8]
jmp 0x14000428e
cmp rbx, rax
jb 0x140006c87
lea r12, [0x14001d4a8]
lea r9, str.ehSched
mov r8d, 0x100
mov rcx, r12
sub r9, r12
mov rdx, r8
lea rax, [rdx - 0xf8]
cmp rax, r14
je 0x1400042d7
movzx eax, word [rcx + r9]
cmp ax, r14w
je 0x1400042d7
mov word [rcx], ax
add rcx, 2
sub rdx, r15
jne 0x1400042b4
cmp rdx, r14
je 0x140006ca5
mov word [rcx], r14w
lea rdx, [0x140014650]
lea rcx, [0x14001d6a8]
sub rdx, rcx
lea rax, [r8 - 0xe1]
cmp rax, r14
je 0x140004317
movzx eax, word [rcx + rdx]
cmp ax, r14w
je 0x140004317
mov word [rcx], ax
add rcx, 2
sub r8, r15
jne 0x1400042f5
cmp r8, r14
je 0x140006cae
mov eax, dword [0x140014ac8]
mov word [rcx], r14w
lea rcx, [rsp + 0x78]
mov dword [rcx], eax
movzx eax, word [0x140014acc]
lea rdx, [rsp + 0x78]
mov word [rcx + 4], ax
mov rcx, rsi
mov qword [0x14001d4a0], r14
mov dword [0x14001d484], 0x10
mov dword [0x14001d488], r15d
mov dword [0x14001d48c], 0x45
mov dword [0x14001d490], r14d
mov dword [0x14001d498], r14d
mov dword [0x14001d49c], r14d
mov dword [0x14001d494], r14d
mov dword [0x14001d8f4], r14d
mov qword [0x14001d8e8], r14
mov qword [0x14001d8e0], r14
mov dword [0x14001d8f0], r14d
mov dword [0x14001d480], r15d
call fcn.140003e10
mov r13, rax
cmp rax, r14
jne 0x140006cb7
call fcn.140004a4c
cmp eax, r14d
je 0x140006f39
lea rax, [rsp + 0x38]
lea rdx, str.AppID
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r14d
jne 0x140006cd8
mov rsi, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.FA018B44_5E9F_4875_B127_5085A1B02ABD
mov r9d, r15d
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r14d
jne 0x14000702f
mov rbp, qword [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x80]
lea rdx, str.LocalService
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x48], rbp
call fcn.1400035a0
mov ecx, r14d
cmp eax, r14d
lea rax, [0x140003258]
mov qword [rsp + 0x48], r12
cmove ecx, r15d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x60], r14
mov dword [0x14001d480], ecx
mov qword [rsp + 0x50], rax
cmp ecx, r14d
je 0x140006f7f
lea rcx, [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
nop
jmp 0x140006f6a
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [0x14001d008]
lea rdx, str.DbgLevel
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp rdi, r14
je 0x14000416c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r14
jmp 0x14000416c
mov rbx, r14
jmp 0x1400041e6
mov rbx, r14
jmp 0x14000422a
mov rdx, qword [rbx]
cmp rdx, r14
je 0x140006c9c
mov cl, r15b
call qword [rdx + 0x40]
mov rax, qword [0x14001d2d8]
add rbx, 8
jmp 0x14000428e
sub rcx, 2
jmp 0x1400042e0
sub rcx, 2
jmp 0x140004320
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, r14d
mov ebx, eax
jge 0x140006d25
lea rdx, str.ehSched::_Failed_to_CoInitialize__0x_x
mov r8d, eax
mov ecx, r15d
call fcn.1400016b0
lea rcx, [0x14001d400]
call fcn.14000c360
cmp rdi, r14
je 0x140006cf2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140001710
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rdx, str.UnregServer
mov r8d, 0xb
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r14d
jne 0x140006ea4
mov rax, qword [0x14001d400]
xor r9d, r9d
lea rcx, [0x14001d400]
lea edx, [r9 + 0x64]
xor r8d, r8d
mov ebx, r14d
call qword [rax + 0x40]
cmp eax, r14d
mov esi, eax
jge 0x140006d7d
lea rdx, str.CServiceModule::UnregisterServer:_Failed_to_UpdateRegistryFromResource_0x_x
mov r8d, eax
mov ecx, r15d
call fcn.1400016b0
mov ebx, esi
lea rcx, [0x14001d400]
call fcn.1400096d4
mov rbp, qword [0x14001d448]
cmp eax, r14d
cmovl ebx, eax
cmp rbp, r14
je 0x140006dd0
jmp 0x140006dca
call qword [rbp + 0x38]
mov rcx, qword [rbp]
xor r8d, r8d
mov rdx, rax
call fcn.14000c440
cmp eax, r14d
mov esi, eax
jl 0x140006e3f
xor ecx, ecx
call qword [rbp + 8]
cmp eax, r14d
mov esi, eax
jl 0x140006e3f
add rbp, 0x48
cmp qword [rbp], r14
jne 0x140006d9d
mov rax, qword [0x14001e0b0]
cmp rax, r14
je 0x140006de5
call rax
cmp eax, r14d
mov esi, eax
jl 0x140006e3a
mov rbp, qword [0x14001d2d0]
mov rax, qword [0x14001d2d8]
mov esi, r14d
jmp 0x140006e35
mov r12, qword [rbp]
cmp r12, r14
je 0x140006e31
call qword [r12 + 0x38]
mov rcx, qword [r12]
xor r8d, r8d
mov rdx, rax
call fcn.14000c440
cmp eax, r14d
mov esi, eax
jl 0x140006e3a
xor ecx, ecx
call qword [r12 + 8]
cmp eax, r14d
mov esi, eax
jl 0x140006e3a
mov rax, qword [0x14001d2d8]
add rbp, 8
cmp rbp, rax
jb 0x140006df8
cmp esi, r14d
jge 0x140006e53
lea rdx, str.CServiceModule::UnregisterServer:_Failed_to_UnregisterServer_0x_x
mov r8d, esi
mov ecx, r15d
call fcn.1400016b0
mov ebx, esi
lea rdx, str.SYSTEMCurrentControlSetServicesEventLogApplicationehSched
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, r14d
je 0x140006e93
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CServiceModule::UnregisterServer:_Failed_to_UpdateRegistryFromResource_0x_x
mov ecx, r15d
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
mov r8d, ebx
call fcn.1400016b0
cmp ebx, r14d
jge 0x140006f09
mov r8d, ebx
lea rdx, str.ehSched::_Failed_to_UnregisterServer__0x_x
jmp 0x140006f01
lea rdx, str.RegServer
mov r8d, 9
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r14d
jne 0x140006ec4
xor r8d, r8d
jmp 0x140006ee2
lea rdx, str.Service
mov r8d, 7
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wcsnicmp]
cmp eax, r14d
jne 0x140006f09
mov r8d, r15d
lea rcx, [0x14001d400]
xor edx, edx
call fcn.140008bf4
cmp eax, r14d
mov ebx, eax
jge 0x140006f09
lea rdx, str.ehSched::_Failed_to_RegisterServer__0x_x
mov r8d, eax
mov ecx, r15d
call fcn.1400016b0
lea rdx, [rsp + 0x78]
mov rcx, r13
call fcn.140003e10
mov r13, rax
cmp rax, r14
jne 0x140006d25
lea rcx, [0x14001d400]
call fcn.14000c360
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x140006ce4
lea rdx, str.ehSched::_Not_allowed_to_start__exiting
mov ecx, r15d
call fcn.1400016b0
lea rcx, [0x14001d400]
call fcn.14000c360
cmp rdi, r14
je 0x140006f62
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
or eax, 0xffffffff
jmp 0x140006cf4
neg eax
sbb ecx, ecx
and ecx, dword [0x14001d480]
mov dword [0x14001d480], ecx
cmp ecx, r14d
jne 0x140006f8b
lea rcx, [0x14001d400]
call fcn.140001010
mov rcx, qword [0x14001d338]
lea r9, str.End_event_trace_in_ehSched.exe
mov r8d, 0x55000002
mov edx, r15d
call fcn.140004b98
mov rbx, qword [0x14001d338]
cmp rbx, r14
je 0x140006ff3
mov rax, qword [rbx + 0x20]
cmp rax, r14
je 0x140006fc6
mov rcx, qword [rbx + 0x68]
call rax
mov qword [rbx + 0x68], r14
cmp byte [rbx + 0x70], r14b
je 0x140006fdf
mov rcx, qword [rbx + 0x78]
cmp rcx, r14
je 0x140006fdf
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rbx + 0x78], r14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, str.ehSched::__tWinMain_terminating
mov ecx, 8
call fcn.1400016b0
mov ebx, dword [0x14001d490]
cmp rbp, r14
je 0x140007018
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp rsi, r14
je 0x140006ce4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140006ce4
lea rcx, [0x14001d400]
call fcn.14000c360
jmp 0x140007018