Function at 0x140005c50
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbp
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov rax, qword [rcx + 0x10]
mov rdx, qword [rcx + 0x20]
mov qword [rbp - 8], 0
mov rbx, rcx
lea r8, [rbp - 8]
mov rcx, qword [rax]
call qword [sym.imp.advapi32.dll_RegCreateKeyW]
mov r12d, eax
test eax, eax
je 0x140005ca0
mov rcx, qword [rbp - 8]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, r12d
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop rbp
ret
mov r8, qword [rbx + 0x88]
mov rcx, qword [rbp - 8]
lea rdx, str.DisplayName
call sym.reg_set_string_value
mov r12d, eax
test eax, eax
jne 0x140005c86
mov r8, qword [rbx + 0x60]
mov rcx, qword [rbp - 8]
lea rdx, str.ImagePath
call sym.reg_set_string_value
mov r12d, eax
test eax, eax
jne 0x140005c86
mov r8, qword [rbx + 0x68]
mov rcx, qword [rbp - 8]
lea rdx, str.Group
call sym.reg_set_string_value
mov r12d, eax
test eax, eax
jne 0x140005c86
mov r8, qword [rbx + 0x80]
mov rcx, qword [rbp - 8]
lea rdx, str.ObjectName
call sym.reg_set_string_value
mov r12d, eax
test eax, eax
jne 0x140005c86
mov r8, qword [rbx + 0x98]
mov rcx, qword [rbp - 8]
lea rdx, str.Description
call sym.reg_set_string_value
mov r12d, eax
test eax, eax
jne 0x140005c86
mov r8, qword [rbx + 0xa0]
mov rcx, qword [rbp - 8]
lea rdx, str.DependOnService
call sym.reg_set_multisz_value
mov r12d, eax
test eax, eax
jne 0x140005c86
mov r8, qword [rbx + 0xa8]
mov rcx, qword [rbp - 8]
lea rdx, str.DependOnGroup
call sym.reg_set_multisz_value
mov r12d, eax
test eax, eax
jne 0x140005c86
lea rax, [rbx + 0x54]
mov rcx, qword [rbp - 8]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov rsi, qword [sym.imp.advapi32.dll_RegSetValueExW]
mov r9d, 4
lea rdx, str.Start
call rsi
mov r12d, eax
test eax, eax
jne 0x140005c86
lea rax, [rbx + 0x58]
mov rcx, qword [rbp - 8]
mov r9d, 4
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.ErrorControl
call rsi
mov r12d, eax
test eax, eax
jne 0x140005c86
lea rax, [rbx + 0x50]
mov rcx, qword [rbp - 8]
mov r9d, 4
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Type
call rsi
mov r12d, eax
test eax, eax
jne 0x140005c86
lea rdi, [rbx + 0x90]
mov rcx, qword [rbp - 8]
mov r9d, 4
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea rdx, str.PreshutdownTimeout
call rsi
mov r12d, eax
test eax, eax
jne 0x140005c86
mov dword [rsp + 0x28], 4
mov rcx, qword [rbp - 8]
xor r8d, r8d
mov r9d, 4
mov qword [rsp + 0x20], rdi
lea rdx, str.PreshutdownTimeout
call rsi
mov r12d, eax
test eax, eax
jne 0x140005c86
cmp dword [rbx + 0xc4], 0
jne 0x140005edc
cmp dword [rbx + 0x70], 0
mov rcx, qword [rbp - 8]
je 0x140005eca
add rbx, 0x70
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14001bf50]
call rsi
mov r12d, eax
test r12d, 0xfffffffd
mov eax, 0
cmove r12d, eax
jmp 0x140005c86
lea rdx, [0x14001bf50]
call qword [sym.imp.advapi32.dll_RegDeleteValueW]
mov r12d, eax
jmp 0x140005eb5
lea rax, [rbp - 0xc]
mov dword [rbp - 0xc], 1
mov rcx, qword [rbp - 8]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov r9d, 4
lea rdx, str.WOW64
mov qword [rsp + 0x20], rax
call rsi
mov r12d, eax
test eax, eax
je 0x140005e85
jmp 0x140005c86