Function at 0x140050180
Capabilities:
Set registry value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov ebx, edx
mov rdi, rcx
xor ebp, ebp
mov qword [rcx + 0x58], rbp
mov qword [rcx + 0x30], rbp
mov qword [rcx + 0x60], rbp
test edx, edx
je 0x14005030f
add rcx, 0xb0
xor r8d, r8d
lea rdx, [0x140129a38]
call fcn.140002120
mov dword [rdi + 0x14], 2
mov dword [rdi + 0x28], ebp
mov qword [rdi + 0x18], rbp
lea rdx, [rdi + 0x10]
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov edx, ebx
mov rcx, rdi
call fcn.1400512e0
mov ebx, eax
mov dword [rdi + 0x24], ebp
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi + 0x1c], eax
mov dword [rdi + 0x28], ebp
mov dword [rdi + 0x1c], ebp
mov dword [rdi + 0x28], ebp
mov eax, 0x85
lea ecx, [rbp + 5]
lea rdx, [rdi + 0x10]
test ebx, ebx
jne 0x140050240
mov dword [rdi + 0x14], 1
cmp byte [rdi + 0x140], bpl
cmovne eax, ecx
mov dword [rdi + 0x18], eax
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
xor eax, eax
jmp 0x1400503cc
mov dword [rdi + 0x14], 4
cmp byte [rdi + 0x140], bpl
cmovne eax, ecx
mov dword [rdi + 0x18], eax
mov rcx, qword [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
lea rcx, [rdi + 0x250]
mov rdx, qword [rdi + 8]
call fcn.14004cd90
mov qword [rsp + 0x58], 0xffffffff80000002
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14012c150]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1400502c0
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.MTPI
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14005030a
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
jmp 0x1400503b2
xor edx, edx
call fcn.1400512e0
mov qword [rsp + 0x58], 0xffffffff80000001
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14012c150]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140050368
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.UMTPI
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400503b2
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400503c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], rbp
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret