Function at 0x140024c44
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, reloc.MurocApi.dll_Ordinal_352
sub rsp, 0x260
mov rax, qword [0x14009b3d0]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov rbx, rcx
mov ecx, 7
call fcn.14002c0a8
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea rsi, [0x1400a3f00]
mov r9d, 0x64
mov rdi, rax
lea rdx, [0x14009b080]
lea rax, [0x140071380]
mov r8, rbx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.14001ff58
movzx ecx, word [0x140072a54]
mov r14d, 1
mov word [rsp + 0x30], cx
mov cl, byte [0x140072a56]
mov byte [rsp + 0x32], cl
mov rcx, rdi
mov dword [0x1400a4278], r14d
jmp 0x140024d26
lea rdx, str.UnregServer
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140024e70
lea rdx, str.RegServer
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140024e60
lea rdx, str.Service
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140024e5b
mov rcx, rbx
lea rdx, [rsp + 0x30]
call fcn.14001f404
mov rbx, rax
test rax, rax
jne 0x140024cdb
lea rcx, [rbp - 0x30]
call qword [sym.imp.PsRegApi.dll_public:_void___cdecl_CRegApi::constructor_void____ptr64]
mov edi, 0x20019
lea r8, str.AppID
mov r9d, edi
lea rcx, [rbp - 0x30]
mov rdx, 0xffffffff80000000
call qword [sym.imp.PsRegApi.dll_public:_long_int___cdecl_CRegApi::OpenKey_struct_HKEY______ptr64__char_const____ptr64__unsigned_long_int____ptr64]
mov ebx, eax
test eax, eax
jne 0x140024e28
lea rcx, [rsp + 0x60]
call qword [sym.imp.PsRegApi.dll_public:_void___cdecl_CRegApi::constructor_void____ptr64]
lea rcx, [rbp - 0x30]
call qword [sym.imp.PsRegApi.dll_public:_struct_HKEY______ptr64___cdecl_CRegApi::operator_struct_HKEY______ptr64_void_const___ptr64]
mov r9d, edi
lea r8, str.E7DCA9D7_1577_45DA_BF99_8BD6184ACF99
mov rdx, rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.PsRegApi.dll_public:_long_int___cdecl_CRegApi::OpenKey_struct_HKEY______ptr64__char_const____ptr64__unsigned_long_int____ptr64]
mov ebx, eax
test eax, eax
jne 0x140024e1d
lea r9, [rsp + 0x34]
mov dword [rsp + 0x34], Ordinal_266
lea r8, [rbp + 0x40]
lea rdx, str.LocalService
lea rcx, [rsp + 0x60]
call qword [sym.imp.PsRegApi.dll_public:_long_int___cdecl_CRegApi::QueryValue_char_const____ptr64__char____ptr64__unsigned_long_int____ptr64____ptr64]
xor ecx, ecx
test eax, eax
lea rax, [0x1400a3f50]
mov qword [rsp + 0x38], rax
lea rax, [0x140024c30]
cmove ecx, r14d
mov qword [rsp + 0x40], rax
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
mov dword [0x1400a4278], ecx
test ecx, ecx
je 0x140024e0f
lea rcx, [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
neg eax
sbb ecx, ecx
and dword [0x1400a4278], ecx
jne 0x140024e17
mov rcx, rsi
call fcn.140022da8
mov ebx, dword [0x1400a4264]
lea rcx, [rsp + 0x60]
call qword [sym.imp.PsRegApi.dll_public_virtual:_void___cdecl_CRegApi::destructor_void____ptr64]
lea rcx, [rbp - 0x30]
call qword [sym.imp.PsRegApi.dll_public_virtual:_void___cdecl_CRegApi::destructor_void____ptr64]
mov eax, ebx
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.14005d930
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov r8d, r14d
jmp 0x140024e63
xor r8d, r8d
mov edx, r14d
mov rcx, rsi
call fcn.140021bfc
jmp 0x140024e34
mov rcx, rsi
call fcn.140023d4c
jmp 0x140024e34