Function at 0x140084d90
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
push rbp
push rdi
sub rsp, 0x4d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xca
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1401a7008]
xor rax, rbp
mov qword [rbp + 0x498], rax
lea rcx, [0x1401b9255]
call fcn.14007a304
mov byte [rbp + 0x2c4], 0
lea r8, str.SoftwareWestern_Systems_Oy_adWISEPipe_Service_x64_
mov edx, 0x100
lea rcx, [rbp + 0xb0]
call fcn.140078801
lea r8, [0x1401aab30]
mov edx, 0x100
lea rcx, [rbp + 0xb0]
call fcn.1400785d6
lea r8, str.Titanium_Service
mov edx, 0x100
lea rcx, [rbp + 0xb0]
call fcn.1400785d6
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, [rbp + 0xb0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
je 0x140084e9e
lea rax, [0x1401aab30]
mov qword [rbp + 0x2e8], rax
lea r9, [rbp + 0x2e8]
xor r8d, r8d
mov edx, 0xc002403d
lea rcx, [rbp + 0xb0]
call fcn.14007907b
movzx eax, al
test eax, eax
je 0x140084e92
lea rdx, [rbp + 0xb0]
mov ecx, 0xc0054023
call fcn.14007826b
mov al, 1
jmp 0x140085069
mov dword [rbp + 0x24], 0x200
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
lea rax, [0x1401aa7f0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x64]
xor r8d, r8d
lea rdx, str.WorkingDirectory
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jne 0x140084ef8
cmp dword [rbp + 0x64], 1
jne 0x140084ef8
lea rcx, [0x1401aa7f0]
call fcn.14007737a
test rax, rax
jne 0x140084f30
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc002403f
lea rcx, [rbp + 0xb0]
call fcn.14007907b
movzx eax, al
test eax, eax
je 0x140084f27
lea rdx, [rbp + 0xb0]
mov ecx, 0xc0054023
call fcn.14007826b
mov byte [rbp + 0x2c4], 1
jmp 0x140084f89
lea rcx, [0x1401aa7f0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x140084f89
lea rax, [0x1401aa7f0]
mov qword [rbp + 0x308], rax
lea r9, [rbp + 0x308]
xor r8d, r8d
mov edx, 0xc002403e
lea rcx, [rbp + 0xb0]
call fcn.14007907b
movzx eax, al
test eax, eax
je 0x140084f82
lea rdx, [rbp + 0xb0]
mov ecx, 0xc0054023
call fcn.14007826b
mov byte [rbp + 0x2c4], 1
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rbp + 0x2c4]
test eax, eax
je 0x140084faa
movzx eax, byte [rbp + 0x2c4]
jmp 0x140085069
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SoftwareWestern_Systems_Oy_adWISEAuthorization
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
je 0x140085012
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0014001
lea rcx, [rbp + 0xb0]
call fcn.14007907b
movzx eax, al
test eax, eax
je 0x14008500e
lea rdx, [rbp + 0xb0]
mov ecx, 0xc0054023
call fcn.14007826b
mov al, 1
jmp 0x140085069
mov rcx, qword [rbp + 8]
call fcn.14007a6fb
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x140085058
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rbp + 0x44]
lea rcx, [rbp + 0xb0]
call fcn.14007907b
movzx eax, al
test eax, eax
je 0x140085051
lea rdx, [rbp + 0xb0]
mov ecx, 0xc0054023
call fcn.14007826b
mov byte [rbp + 0x2c4], 1
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rbp + 0x2c4]
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1401727e0]
call fcn.140079a35
mov rax, rdi
mov rcx, qword [rbp + 0x498]
xor rcx, rbp
call fcn.140078919
lea rsp, [rbp + 0x4a8]
pop rdi
pop rbp
ret