Function at 0x1400395bc
Capabilities:
Check os version
Create thread
Initialize winsock library
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3420]
mov eax, 0x3520
call fcn.14005ba50
sub rsp, rax
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x3558], rbx
mov qword [rsp + 0x3560], rdi
mov rax, qword [0x1400d9180]
xor rax, rsp
mov qword [rbp + 0x3410], rax
mov r12, rcx
mov edi, 4
xor r13d, r13d
cmp dword [0x1400db7f8], r13d
je 0x14003961f
mov edx, edi
call fcn.14002f31c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1400dbf34], eax
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x68], r13
mov r14d, 1
mov r8d, r14d
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.14003dd54
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
or edx, 0xffffffff
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov eax, r13d
mov rbx, qword [0x1400dbf08]
test rbx, rbx
je 0x1400396be
cmp qword [rbx], r13
je 0x1400396be
test eax, eax
jne 0x1400396cf
mov r8d, r14d
mov edx, edi
mov rcx, rbx
call fcn.14003a44c
add rbx, 0x48
cmp qword [rbx], r13
jne 0x1400396a0
test eax, eax
jne 0x1400396cf
mov r8d, r14d
mov edx, edi
lea rcx, [0x1400e7450]
call fcn.14003a870
mov ebx, VarUI4FromDisp
mov r8d, ebx
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.14005bab0
mov dword [rbp - 0x10], ebx
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r11d, dword [rbp - 0xc]
cmp r11d, 5
ja 0x140039701
jne 0x14003970c
cmp dword [rbp - 8], r14d
jb 0x140039731
mov dword [0x1400dbc48], r14d
cmp r11d, 5
jbe 0x140039731
lea rcx, [rbp + 0x1b60]
call fcn.140026df4
call fcn.140026f24
mov ecx, dword [0x1400dbc4c]
test eax, eax
cmovne ecx, r14d
mov dword [0x1400dbc4c], ecx
mov rax, qword [0x1400e73f8]
mov qword [0x1400dbe68], rax
mov word [0x1400dba00], r13w
mov qword [rsp + 0x60], r13
mov dword [rsp + 0x68], r13d
mov qword [rsp + 0x70], r13
mov r15d, 0x20019
mov r9d, r15d
lea r8, [0x1400a6480]
mov rbx, 0xffffffff80000002
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003a60c
test eax, eax
je 0x140039787
lea rcx, str.Bluetooth_Service::install_key_is_not_prepared_n
jmp 0x1400397b7
mov dword [rsp + 0x50], 0x104
lea r9, [rsp + 0x50]
lea r8, [0x1400dba00]
lea rdx, [0x14009a078]
lea rcx, [rsp + 0x60]
call fcn.14003a6e4
test eax, eax
je 0x1400397bc
lea rcx, str.Bluetooth_Service::install_path_is_not_prepared_n
call fcn.1400300fc
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400397d1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r13
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x5c], r14d
mov r9d, r15d
lea r8, str.SoftwareWidcommBTConfigGeneral
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003a60c
test eax, eax
jne 0x1400398a7
mov dword [rsp + 0x50], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.ShowHardwareInstallWindow
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x140039844
cmp dword [rsp + 0x58], edi
jne 0x140039858
mov r11d, r13d
mov eax, dword [0x1400d8b98]
test r11d, r11d
cmove eax, dword [rsp + 0x54]
mov dword [0x1400d8b98], eax
mov dword [rsp + 0x58], edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.StartLogging
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test rbx, rbx
je 0x14003989b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r13
mov dword [rsp + 0x68], r13d
mov rbx, 0xffffffff80000002
mov r9d, r15d
lea r8, str.SoftwareWidcommBTConfigDebug
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.14003a60c
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x1400399b3
mov dword [rsp + 0x58], edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.LogIPAddr
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x14003990b
cmp dword [rsp + 0x50], edi
jne 0x14003991f
mov r11d, r13d
mov eax, dword [0x1400dbc50]
test r11d, r11d
cmove eax, dword [rsp + 0x54]
mov dword [0x1400dbc50], eax
mov dword [rsp + 0x54], 0x104
lea r9, [rsp + 0x54]
lea r8, [0x1400dbc60]
lea rdx, str.LogFileName
lea rcx, [rsp + 0x60]
call fcn.14003a6e4
mov dword [rsp + 0x58], edi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.LogDebug
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x140039984
cmp dword [rsp + 0x50], edi
jne 0x140039998
mov r11d, r13d
mov eax, dword [0x1400dbc54]
test r11d, r11d
cmove eax, dword [rsp + 0x54]
mov dword [0x1400dbc54], eax
test rbx, rbx
je 0x1400399ae
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, r13
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0x68], r13d
mov r15d, 2
cmp dword [0x1400dbc50], r13d
je 0x140039a49
mov ecx, r15d
lea rdx, [rbp + 0x110]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400399ee
test rbx, rbx
je 0x1400399e9
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140039c97
xor r8d, r8d
mov edx, r15d
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [0x1400d8ba0], rax
cmp rax, 0xffffffffffffffff
jne 0x140039a1e
test rbx, rbx
je 0x140039a19
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140039c97
mov edi, sendto
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.14005bab0
mov qword [rbp - 0x20], r15
mov r8d, edi
lea rdx, [rbp - 0x20]
mov rcx, qword [0x1400d8ba0]
call qword [sym.imp.WS2_32.dll_bind]
lea rcx, str.Service_started
call fcn.1400300fc
call fcn.14003943c
mov rcx, r12
call fcn.14003374c
call fcn.1400331ac
test al, al
je 0x140039a70
call fcn.14003338c
mov edx, dword [rsp + 0x5c]
lea rcx, str.Reg_Query_for_StartLogging___d_n
call fcn.1400300fc
cmp dword [rsp + 0x5c], r14d
jne 0x140039aa7
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x1400340cc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x140039aae
xor ecx, ecx
call fcn.14002f52c
cmp dword [0x1400dbc4c], r13d
jne 0x140039ae0
mov cl, r14b
call fcn.1400081d0
test eax, eax
je 0x140039adb
lea rcx, [0x14003738c]
call fcn.140006e20
lea rcx, [0x14003752c]
call fcn.140004780
call fcn.1400366dc
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1400dbc30], rax
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14003895c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1400dbc38], rax
mov dword [rbp - 0x60], r13d
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x14005068c]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdi, rax
lea rcx, str.Thread_created
call fcn.1400300fc
jmp 0x140039b62
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140039b58
call fcn.14000d890
mov edx, 0xfa
lea rcx, [0x1400dbeb9]
call fcn.140045dc4
lea rcx, str.Bluetooth_Service::Service_stopping..._n
call fcn.1400300fc
call fcn.140046b60
mov rcx, qword [0x1400dbc30]
test rcx, rcx
je 0x140039bb1
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov r14d, 0x4e20
mov rcx, qword [0x1400dbc38]
test rcx, rcx
je 0x140039be0
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x1400dbc38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x1400dbc38], r13
test rdi, rdi
je 0x140039bfa
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1400dbc4c], r13d
jne 0x140039c16
xor ecx, ecx
call fcn.140006e20
xor ecx, ecx
call fcn.140004780
call fcn.140006150
xor ecx, ecx
call fcn.140033e9c
lea rcx, [rbp + 0x2b0]
call fcn.140026df4
lea rcx, [rbp + 0x2b0]
call fcn.140022d94
test eax, eax
jne 0x140039c6d
cmp dword [rbp + 0x1b48], r15d
jne 0x140039c6d
mov edx, r15d
lea rcx, str.CServiceModule::Run:_m_dwUninstall_d
call fcn.1400300fc
lea rcx, [rbp - 0x20]
call fcn.140054500
nop
mov rcx, rax
call fcn.1400575d0
nop
lea rcx, [rbp - 0x20]
call fcn.140058670
lea rcx, [0x1400dbec0]
call fcn.14003b728
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, r12
call fcn.1400338fc
nop
test rbx, rbx
je 0x140039c97
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x78]
call fcn.14005c32c
mov rcx, qword [rbp - 0x80]
call fcn.14005c1e4
mov rcx, qword [rbp - 0x78]
call fcn.14005c1e4
mov rcx, qword [rbp - 0x70]
call fcn.14005c1e4
mov rcx, qword [rbp - 0x68]
call fcn.14005c1e4
mov rcx, qword [rbp + 0x3410]
xor rcx, rsp
call fcn.14005ba20
lea r11, [rsp + 0x3520]
mov rbx, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret