Function at 0x1400d2bb0
Capabilities:
Check if file exists
Create directory
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa60
mov qword [rsp + 0x9b8], 0xfffffffffffffffe
mov rax, qword [0x1402a25c0]
xor rax, rsp
mov qword [rsp + 0xa58], rax
call fcn.1400e0950
test eax, eax
jne 0x1400d2beb
xor eax, eax
jmp 0x1400d3835
call fcn.1400e0a00
cmp eax, 0xffffffff
je 0x1400d2bfc
xor eax, eax
jmp 0x1400d3835
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0xff
lea rcx, [rsp + 0x40]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, qword [rsp + 0xa70]
call fcn.14007358c
xor ecx, ecx
call fcn.140093458
test eax, eax
jne 0x1400d2c48
mov r8d, 0xffffffff
xor edx, edx
mov ecx, 0x67
call fcn.1400f0ec0
xor eax, eax
jmp 0x1400d3835
xor ecx, ecx
call fcn.140094304
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [rsp + 0xa70]
mov rax, qword [rax + 0x90]
movzx eax, word [rax]
test eax, eax
jne 0x1400d2ce1
lea rax, [rsp + 0x940]
mov qword [rsp + 0x948], rax
lea rcx, [rsp + 0x950]
call fcn.140001000
mov qword [rsp + 0x9c0], rax
mov rax, qword [rsp + 0x9c0]
mov qword [rsp + 0x9c8], rax
lea r8, [0x140212988]
mov rdx, qword [rsp + 0x9c8]
mov rcx, qword [rsp + 0x948]
call fcn.1400010b0
mov qword [rsp + 0x9d0], rax
mov rcx, qword [rsp + 0x9d0]
call fcn.1401b8070
nop
lea rcx, [rsp + 0x950]
call fcn.140001470
call fcn.140187de0
test eax, eax
jne 0x1400d2cf1
xor eax, eax
jmp 0x1400d3835
lea rdx, [0x140212998]
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa17c
test eax, eax
jne 0x1400d2d2b
xor r8d, r8d
mov edx, 0x40
lea rcx, str._uninstall:_uninstall_program_r_n_start:_start_service_r_n_stop:_stop_service_r_n_restart:_restart_service_r_n_update:_update_xml_data
call fcn.1400ef150
xor eax, eax
jmp 0x1400d3835
lea rdx, str._uninstall
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa17c
test eax, eax
jne 0x1400d2ee0
call fcn.140186d30
xor edx, edx
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0xa0]
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0xf0], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7e7
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [0x1403ade90]
call fcn.1400d4030
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d6440
mov dword [rsp + 0xe8], 0
lea rcx, [0x1403adbe0]
call fcn.140012bb0
test eax, eax
jne 0x1400d2dea
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xe8]
add eax, 1
mov dword [rsp + 0xe8], eax
cmp dword [rsp + 0xe8], 5
jl 0x1400d2de8
jmp 0x1400d2dea
jmp 0x1400d2db0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8033
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d5e50
test rax, rax
je 0x1400d2e2d
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x89
call fcn.1400f0ec0
cmp eax, 6
jne 0x1400d2e2b
jmp 0x1400d2e2d
jmp 0x1400d2dea
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d5e50
lea rcx, [0x1403adbe0]
call fcn.1400d57a0
lea rcx, [0x1403ade90]
call fcn.1400d39b0
call fcn.1400ec070
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [0x140212ac0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d2ebc
call fcn.140010a50
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1403adbe0]
call fcn.140051f40
test eax, eax
je 0x1400d2ed9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400d2ebc
xor eax, eax
jmp 0x1400d3835
lea rcx, [0x140212b20]
call fcn.1400a81f4
mov r8, rax
lea rdx, str._restart
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400a938c
test eax, eax
jne 0x1400d2fe6
lea rcx, [0x1403ade90]
call fcn.1400d4030
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d6440
mov dword [rsp + 0xf8], 0
lea rcx, [0x1403adbe0]
call fcn.140012bb0
test eax, eax
jne 0x1400d2f71
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xf8]
add eax, 1
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0xf8], 5
jl 0x1400d2f6f
jmp 0x1400d2f71
jmp 0x1400d2f37
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d5e50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d5e50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403adbe0]
call fcn.1400d57a0
lea rcx, [0x1403ade90]
call fcn.1400d39b0
xor eax, eax
jmp 0x1400d3835
lea rdx, str._start
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa17c
test eax, eax
jne 0x1400d30b2
lea rcx, [0x1403ade90]
call fcn.1400d4030
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d6440
mov dword [rsp + 0xfc], 0
lea rcx, [0x1403adbe0]
call fcn.140012bb0
test eax, eax
jne 0x1400d3068
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xfc]
add eax, 1
mov dword [rsp + 0xfc], eax
cmp dword [rsp + 0xfc], 5
jl 0x1400d3066
jmp 0x1400d3068
jmp 0x1400d302e
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d5e50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403adbe0]
call fcn.1400d57a0
lea rcx, [0x1403ade90]
call fcn.1400d39b0
xor eax, eax
jmp 0x1400d3835
lea rdx, str._stop
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa17c
test eax, eax
jne 0x1400d317e
lea rcx, [0x1403ade90]
call fcn.1400d4030
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d6440
mov dword [rsp + 0x100], 0
lea rcx, [0x1403adbe0]
call fcn.140012bb0
test eax, eax
jne 0x1400d3134
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x100]
add eax, 1
mov dword [rsp + 0x100], eax
cmp dword [rsp + 0x100], 5
jl 0x1400d3132
jmp 0x1400d3134
jmp 0x1400d30fa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d5e50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403adbe0]
call fcn.1400d57a0
lea rcx, [0x1403ade90]
call fcn.1400d39b0
xor eax, eax
jmp 0x1400d3835
lea rdx, [0x140212b70]
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa17c
test eax, eax
jne 0x1400d324a
lea rcx, [0x1403ade90]
call fcn.1400d4030
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d6440
mov dword [rsp + 0x104], 0
lea rcx, [0x1403adbe0]
call fcn.140012bb0
test eax, eax
jne 0x1400d3200
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x104]
add eax, 1
mov dword [rsp + 0x104], eax
cmp dword [rsp + 0x104], 5
jl 0x1400d31fe
jmp 0x1400d3200
jmp 0x1400d31c6
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x803d
xor edx, edx
lea rcx, [0x1403adbe0]
call fcn.1400d5e50
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403adbe0]
call fcn.1400d57a0
lea rcx, [0x1403ade90]
call fcn.1400d39b0
xor eax, eax
jmp 0x1400d3835
call fcn.140052100
movzx eax, al
test eax, eax
je 0x1400d3276
call fcn.140010e00
lea rdx, str._install
mov rcx, qword [rax + 0x90]
call fcn.1400aa17c
test eax, eax
jne 0x1400d3770
lea rcx, [rsp + 0x110]
call fcn.1400053a0
nop
mov r9d, 0x2001f
lea r8, str.SYSTEMCurrentControlSetControlCrashControl
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x110]
call fcn.140005560
test eax, eax
jne 0x1400d3325
mov r8d, 1
lea rdx, [0x140212c00]
lea rcx, [rsp + 0x110]
call fcn.1400058e0
mov r8d, 3
lea rdx, str.CrashDumpEnabled
lea rcx, [rsp + 0x110]
call fcn.1400058e0
mov r8d, 1
lea rdx, str.LogEvent
lea rcx, [rsp + 0x110]
call fcn.1400058e0
mov r9d, 2
lea r8, str._SystemRoot_Minidump
lea rdx, [0x140212c90]
lea rcx, [rsp + 0x110]
call fcn.140005940
lea rcx, [rsp + 0x110]
call fcn.140005430
call fcn.140010a50
mov rdx, rax
lea rcx, [rsp + 0x960]
call fcn.140002090
mov qword [rsp + 0x9d8], rax
mov rax, qword [rsp + 0x9d8]
mov qword [rsp + 0x9e0], rax
mov r8, qword [rsp + 0x9e0]
lea rdx, str.SoftwareMicrosoftWindowsWindows_Error_ReportingLocalDumps_
lea rcx, [rsp + 0x968]
call fcn.140006c30
mov qword [rsp + 0x9e8], rax
mov rax, qword [rsp + 0x9e8]
mov qword [rsp + 0x9f0], rax
lea r8, str..exe
mov rdx, qword [rsp + 0x9f0]
lea rcx, [rsp + 0x970]
call fcn.1400010b0
mov qword [rsp + 0x9f8], rax
mov rcx, qword [rsp + 0x9f8]
call fcn.1400012c0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x110]
call fcn.140005480
test eax, eax
jne 0x1400d3404
mov dword [rsp + 0xa00], 1
jmp 0x1400d340f
mov dword [rsp + 0xa00], 0
movzx eax, byte [rsp + 0xa00]
mov byte [rsp + 0x958], al
lea rcx, [rsp + 0x970]
call fcn.140001470
nop
lea rcx, [rsp + 0x968]
call fcn.140001470
nop
lea rcx, [rsp + 0x960]
call fcn.140001470
movzx edx, byte [rsp + 0x958]
test edx, edx
je 0x1400d3639
mov r8d, 1
lea rdx, str.DumpType
lea rcx, [rsp + 0x110]
call fcn.1400058e0
lea rcx, [rsp + 0x978]
call fcn.140001000
mov qword [rsp + 0xa08], rax
mov rax, qword [rsp + 0xa08]
mov qword [rsp + 0xa10], rax
lea r8, [0x140212d58]
mov rdx, qword [rsp + 0xa10]
lea rcx, [rsp + 0x980]
call fcn.1400010b0
mov qword [rsp + 0xa18], rax
mov rcx, qword [rsp + 0xa18]
call fcn.1400012c0
mov r9d, 2
mov r8, rax
lea rdx, str.DumpFolder
lea rcx, [rsp + 0x110]
call fcn.140005940
lea rcx, [rsp + 0x980]
call fcn.140001470
nop
lea rcx, [rsp + 0x978]
call fcn.140001470
lea rcx, [rsp + 0x110]
call fcn.140005430
lea rcx, [rsp + 0x990]
call fcn.140001000
mov qword [rsp + 0xa20], rax
mov rax, qword [rsp + 0xa20]
mov qword [rsp + 0xa28], rax
lea r8, [0x140212d80]
mov rdx, qword [rsp + 0xa28]
lea rcx, [rsp + 0x998]
call fcn.1400010b0
mov qword [rsp + 0xa30], rax
mov rcx, qword [rsp + 0xa30]
call fcn.1400012c0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d357c
mov dword [rsp + 0xa38], 1
jmp 0x1400d3587
mov dword [rsp + 0xa38], 0
movzx eax, byte [rsp + 0xa38]
mov byte [rsp + 0x988], al
lea rcx, [rsp + 0x998]
call fcn.140001470
nop
lea rcx, [rsp + 0x990]
call fcn.140001470
movzx edx, byte [rsp + 0x988]
test edx, edx
je 0x1400d3639
lea rcx, [rsp + 0x9a0]
call fcn.140001000
mov qword [rsp + 0xa40], rax
mov rax, qword [rsp + 0xa40]
mov qword [rsp + 0xa48], rax
lea r8, str.dump
mov rdx, qword [rsp + 0xa48]
lea rcx, [rsp + 0x9a8]
call fcn.1400010b0
mov qword [rsp + 0xa50], rax
mov rcx, qword [rsp + 0xa50]
call fcn.1400012c0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x9a8]
call fcn.140001470
nop
lea rcx, [rsp + 0x9a0]
call fcn.140001470
call fcn.140185010
mov dword [rsp + 0x108], eax
cmp dword [rsp + 0x108], 0
je 0x1400d3763
call fcn.1400ec070
call fcn.1400ec140
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d3736
xor eax, eax
mov word [rsp + 0x130], ax
lea rdi, [rsp + 0x132]
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov eax, 0x22
mov word [rsp + 0x130], ax
lea rdx, [rsp + 0x132]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x140212e00]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov edi, eax
shl rdi, 1
call fcn.140010a50
mov rdx, rax
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140186d60
test eax, eax
jne 0x1400d3763
mov dword [rsp + 0x9b0], 0
lea rcx, [rsp + 0x110]
call fcn.1400053d0
mov eax, dword [rsp + 0x9b0]
jmp 0x1400d3835
lea rcx, [rsp + 0x110]
call fcn.1400053d0
lea rcx, [0x1403adbe0]
call fcn.140051f40
lea rdx, str._service
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa17c
test eax, eax
jne 0x1400d37ac
call fcn.140185000
call fcn.1400ec580
xor eax, eax
jmp 0x1400d3835
call fcn.14000f720
lea r8, [rsp + 0x50]
lea rdx, str.32770
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassInfoW]
mov rax, qword [rsp + 0xa70]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x50]
call fcn.140080668
lea rcx, [rsp + 0xa0]
call fcn.140074128
nop
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa70]
call fcn.14007318c
mov ecx, dword [rsp + 0xa8]
call fcn.1400d5050
mov dword [rsp + 0x9b4], 1
lea rcx, [rsp + 0xa0]
call fcn.1400741f4
mov eax, dword [rsp + 0x9b4]
mov rcx, qword [rsp + 0xa58]
xor rcx, rsp
call fcn.1400a8040
add rsp, 0xa60
pop rdi
ret