Function at 0x1400d3f50
Capabilities:
Check if file exists
Create directory
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa60
mov qword [rsp + 0x9b8], 0xfffffffffffffffe
mov rax, qword [0x1402aa5c0]
xor rax, rsp
mov qword [rsp + 0xa58], rax
call fcn.1400dfec0
test eax, eax
jne 0x1400d3f8b
xor eax, eax
jmp 0x1400d4bca
call fcn.1400dff70
cmp eax, 0xffffffff
je 0x1400d3f9c
xor eax, eax
jmp 0x1400d4bca
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0xff
lea rcx, [rsp + 0x40]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, qword [rsp + 0xa70]
call fcn.140073d0c
xor ecx, ecx
call fcn.140093a54
test eax, eax
jne 0x1400d3fe8
mov r8d, 0xffffffff
xor edx, edx
mov ecx, 0x67
call fcn.1400f16c0
xor eax, eax
jmp 0x1400d4bca
xor ecx, ecx
call fcn.140094904
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [rsp + 0xa70]
mov rax, qword [rax + 0x90]
movzx eax, word [rax]
test eax, eax
jne 0x1400d4081
lea rax, [rsp + 0x940]
mov qword [rsp + 0x948], rax
lea rcx, [rsp + 0x950]
call fcn.140001000
mov qword [rsp + 0x9c0], rax
mov rax, qword [rsp + 0x9c0]
mov qword [rsp + 0x9c8], rax
lea r8, [0x140218638]
mov rdx, qword [rsp + 0x9c8]
mov rcx, qword [rsp + 0x948]
call fcn.1400010b0
mov qword [rsp + 0x9d0], rax
mov rcx, qword [rsp + 0x9d0]
call fcn.1401bedc0
nop
lea rcx, [rsp + 0x950]
call fcn.140001490
call fcn.14018d440
test eax, eax
jne 0x1400d4091
xor eax, eax
jmp 0x1400d4bca
lea rdx, [0x140218648]
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa794
test eax, eax
jne 0x1400d40cb
xor r8d, r8d
mov edx, 0x40
lea rcx, str._uninstall:_uninstall_program_r_n_start:_start_service_r_n_stop:_stop_service_r_n_restart:_restart_service_r_n_update:_update_xml_data
call fcn.1400ef950
xor eax, eax
jmp 0x1400d4bca
lea rdx, str._uninstall
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa794
test eax, eax
jne 0x1400d4280
call fcn.14018bc90
xor edx, edx
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0xa0]
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0xf0], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7e7
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [0x1403b5ec0]
call fcn.1400d53d0
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d77e0
mov dword [rsp + 0xe8], 0
lea rcx, [0x1403b5c10]
call fcn.14000f770
test eax, eax
jne 0x1400d418a
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xe8]
add eax, 1
mov dword [rsp + 0xe8], eax
cmp dword [rsp + 0xe8], 5
jl 0x1400d4188
jmp 0x1400d418a
jmp 0x1400d4150
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8033
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d71f0
test rax, rax
je 0x1400d41cd
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x89
call fcn.1400f16c0
cmp eax, 6
jne 0x1400d41cb
jmp 0x1400d41cd
jmp 0x1400d418a
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d71f0
lea rcx, [0x1403b5c10]
call fcn.1400d6b40
lea rcx, [0x1403b5ec0]
call fcn.1400d4d50
call fcn.1400eb430
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [0x140218770]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d425c
call fcn.14000e2c0
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1403b5c10]
call fcn.140050c90
test eax, eax
je 0x1400d4279
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400d425c
xor eax, eax
jmp 0x1400d4bca
lea rcx, [0x1402187d0]
call fcn.1400a8944
mov r8, rax
lea rdx, str._restart
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400ab814
test eax, eax
jne 0x1400d437b
lea rcx, [0x1403b5ec0]
call fcn.1400d53d0
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d77e0
mov dword [rsp + 0xf8], 0
lea rcx, [0x1403b5c10]
call fcn.14000f770
test eax, eax
jne 0x1400d4311
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xf8]
add eax, 1
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0xf8], 5
jl 0x1400d430f
jmp 0x1400d4311
jmp 0x1400d42d7
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d71f0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d71f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403b5c10]
call fcn.1400d6b40
lea rcx, [0x1403b5ec0]
call fcn.1400d4d50
xor eax, eax
jmp 0x1400d4bca
lea rdx, str._start
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa794
test eax, eax
jne 0x1400d4447
lea rcx, [0x1403b5ec0]
call fcn.1400d53d0
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d77e0
mov dword [rsp + 0xfc], 0
lea rcx, [0x1403b5c10]
call fcn.14000f770
test eax, eax
jne 0x1400d43fd
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xfc]
add eax, 1
mov dword [rsp + 0xfc], eax
cmp dword [rsp + 0xfc], 5
jl 0x1400d43fb
jmp 0x1400d43fd
jmp 0x1400d43c3
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d71f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403b5c10]
call fcn.1400d6b40
lea rcx, [0x1403b5ec0]
call fcn.1400d4d50
xor eax, eax
jmp 0x1400d4bca
lea rdx, str._stop
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa794
test eax, eax
jne 0x1400d4513
lea rcx, [0x1403b5ec0]
call fcn.1400d53d0
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d77e0
mov dword [rsp + 0x100], 0
lea rcx, [0x1403b5c10]
call fcn.14000f770
test eax, eax
jne 0x1400d44c9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x100]
add eax, 1
mov dword [rsp + 0x100], eax
cmp dword [rsp + 0x100], 5
jl 0x1400d44c7
jmp 0x1400d44c9
jmp 0x1400d448f
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d71f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403b5c10]
call fcn.1400d6b40
lea rcx, [0x1403b5ec0]
call fcn.1400d4d50
xor eax, eax
jmp 0x1400d4bca
lea rdx, [0x140218820]
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa794
test eax, eax
jne 0x1400d45df
lea rcx, [0x1403b5ec0]
call fcn.1400d53d0
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d77e0
mov dword [rsp + 0x104], 0
lea rcx, [0x1403b5c10]
call fcn.14000f770
test eax, eax
jne 0x1400d4595
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x104]
add eax, 1
mov dword [rsp + 0x104], eax
cmp dword [rsp + 0x104], 5
jl 0x1400d4593
jmp 0x1400d4595
jmp 0x1400d455b
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x803d
xor edx, edx
lea rcx, [0x1403b5c10]
call fcn.1400d71f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403b5c10]
call fcn.1400d6b40
lea rcx, [0x1403b5ec0]
call fcn.1400d4d50
xor eax, eax
jmp 0x1400d4bca
call fcn.140050e50
movzx eax, al
test eax, eax
je 0x1400d460b
call fcn.14000e620
lea rdx, str._install
mov rcx, qword [rax + 0x90]
call fcn.1400aa794
test eax, eax
jne 0x1400d4b05
lea rcx, [rsp + 0x110]
call fcn.140005560
nop
mov r9d, 0x2001f
lea r8, str.SYSTEMCurrentControlSetControlCrashControl
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x110]
call fcn.140005720
test eax, eax
jne 0x1400d46ba
mov r8d, 1
lea rdx, [0x1402188b0]
lea rcx, [rsp + 0x110]
call fcn.140005aa0
mov r8d, 3
lea rdx, str.CrashDumpEnabled
lea rcx, [rsp + 0x110]
call fcn.140005aa0
mov r8d, 1
lea rdx, str.LogEvent
lea rcx, [rsp + 0x110]
call fcn.140005aa0
mov r9d, 2
lea r8, str._SystemRoot_Minidump
lea rdx, [0x140218940]
lea rcx, [rsp + 0x110]
call fcn.140005b00
lea rcx, [rsp + 0x110]
call fcn.1400055f0
call fcn.14000e2c0
mov rdx, rax
lea rcx, [rsp + 0x960]
call fcn.140002100
mov qword [rsp + 0x9d8], rax
mov rax, qword [rsp + 0x9d8]
mov qword [rsp + 0x9e0], rax
mov r8, qword [rsp + 0x9e0]
lea rdx, str.SoftwareMicrosoftWindowsWindows_Error_ReportingLocalDumps_
lea rcx, [rsp + 0x968]
call fcn.140006c90
mov qword [rsp + 0x9e8], rax
mov rax, qword [rsp + 0x9e8]
mov qword [rsp + 0x9f0], rax
lea r8, str..exe
mov rdx, qword [rsp + 0x9f0]
lea rcx, [rsp + 0x970]
call fcn.1400010b0
mov qword [rsp + 0x9f8], rax
mov rcx, qword [rsp + 0x9f8]
call fcn.14000f8f0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x110]
call fcn.140005640
test eax, eax
jne 0x1400d4799
mov dword [rsp + 0xa00], 1
jmp 0x1400d47a4
mov dword [rsp + 0xa00], 0
movzx eax, byte [rsp + 0xa00]
mov byte [rsp + 0x958], al
lea rcx, [rsp + 0x970]
call fcn.140001490
nop
lea rcx, [rsp + 0x968]
call fcn.140001490
nop
lea rcx, [rsp + 0x960]
call fcn.140001490
movzx edx, byte [rsp + 0x958]
test edx, edx
je 0x1400d49ce
mov r8d, 1
lea rdx, str.DumpType
lea rcx, [rsp + 0x110]
call fcn.140005aa0
lea rcx, [rsp + 0x978]
call fcn.140001000
mov qword [rsp + 0xa08], rax
mov rax, qword [rsp + 0xa08]
mov qword [rsp + 0xa10], rax
lea r8, [0x140218a08]
mov rdx, qword [rsp + 0xa10]
lea rcx, [rsp + 0x980]
call fcn.1400010b0
mov qword [rsp + 0xa18], rax
mov rcx, qword [rsp + 0xa18]
call fcn.14000f8f0
mov r9d, 2
mov r8, rax
lea rdx, str.DumpFolder
lea rcx, [rsp + 0x110]
call fcn.140005b00
lea rcx, [rsp + 0x980]
call fcn.140001490
nop
lea rcx, [rsp + 0x978]
call fcn.140001490
lea rcx, [rsp + 0x110]
call fcn.1400055f0
lea rcx, [rsp + 0x990]
call fcn.140001000
mov qword [rsp + 0xa20], rax
mov rax, qword [rsp + 0xa20]
mov qword [rsp + 0xa28], rax
lea r8, [0x140218a30]
mov rdx, qword [rsp + 0xa28]
lea rcx, [rsp + 0x998]
call fcn.1400010b0
mov qword [rsp + 0xa30], rax
mov rcx, qword [rsp + 0xa30]
call fcn.14000f8f0
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d4911
mov dword [rsp + 0xa38], 1
jmp 0x1400d491c
mov dword [rsp + 0xa38], 0
movzx eax, byte [rsp + 0xa38]
mov byte [rsp + 0x988], al
lea rcx, [rsp + 0x998]
call fcn.140001490
nop
lea rcx, [rsp + 0x990]
call fcn.140001490
movzx edx, byte [rsp + 0x988]
test edx, edx
je 0x1400d49ce
lea rcx, [rsp + 0x9a0]
call fcn.140001000
mov qword [rsp + 0xa40], rax
mov rax, qword [rsp + 0xa40]
mov qword [rsp + 0xa48], rax
lea r8, str.dump
mov rdx, qword [rsp + 0xa48]
lea rcx, [rsp + 0x9a8]
call fcn.1400010b0
mov qword [rsp + 0xa50], rax
mov rcx, qword [rsp + 0xa50]
call fcn.14000f8f0
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x9a8]
call fcn.140001490
nop
lea rcx, [rsp + 0x9a0]
call fcn.140001490
call fcn.14018a8e0
mov dword [rsp + 0x108], eax
cmp dword [rsp + 0x108], 0
je 0x1400d4af8
call fcn.1400eb430
call fcn.1400eb500
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d4acb
xor eax, eax
mov word [rsp + 0x130], ax
lea rdi, [rsp + 0x132]
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov eax, 0x22
mov word [rsp + 0x130], ax
lea rdx, [rsp + 0x132]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x140218ab0]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov edi, eax
shl rdi, 1
call fcn.14000e2c0
mov rdx, rax
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14018bcc0
test eax, eax
jne 0x1400d4af8
mov dword [rsp + 0x9b0], 0
lea rcx, [rsp + 0x110]
call fcn.140005590
mov eax, dword [rsp + 0x9b0]
jmp 0x1400d4bca
lea rcx, [rsp + 0x110]
call fcn.140005590
lea rcx, [0x1403b5c10]
call fcn.140050c90
lea rdx, str._service
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aa794
test eax, eax
jne 0x1400d4b41
call fcn.14018a8d0
call fcn.1400eb940
xor eax, eax
jmp 0x1400d4bca
call fcn.14000cf20
lea r8, [rsp + 0x50]
lea rdx, str.32770
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassInfoW]
mov rax, qword [rsp + 0xa70]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x50]
call fcn.140080de0
lea rcx, [rsp + 0xa0]
call fcn.1400748a8
nop
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa70]
call fcn.140073914
mov ecx, dword [rsp + 0xa8]
call fcn.1400d63f0
mov dword [rsp + 0x9b4], 1
lea rcx, [rsp + 0xa0]
call fcn.140074974
mov eax, dword [rsp + 0x9b4]
mov rcx, qword [rsp + 0xa58]
xor rcx, rsp
call fcn.1400a8790
add rsp, 0xa60
pop rdi
ret