Function at 0x140006820
Capabilities:
Delete registry value
Set registry value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rax, qword [rcx + 0x10]
mov rdx, qword [rcx + 0x20]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x38]
mov rbx, rcx
mov rcx, qword [rax]
call qword [sym.imp.advapi32.dll_RegCreateKeyW]
test eax, eax
mov r12d, eax
je 0x140006870
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, r12d
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov r8, qword [rbx + 0x88]
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x38]
call fcn.140005c00
test eax, eax
mov r12d, eax
jne 0x140006854
mov r8, qword [rbx + 0x60]
lea rdx, str.ImagePath
mov rcx, qword [rsp + 0x38]
call fcn.140005c00
test eax, eax
mov r12d, eax
jne 0x140006854
mov r8, qword [rbx + 0x68]
lea rdx, str.Group
mov rcx, qword [rsp + 0x38]
call fcn.140005c00
test eax, eax
mov r12d, eax
jne 0x140006854
mov r8, qword [rbx + 0x80]
lea rdx, str.ObjectName
mov rcx, qword [rsp + 0x38]
call fcn.140005c00
test eax, eax
mov r12d, eax
jne 0x140006854
mov r8, qword [rbx + 0x98]
lea rdx, str.Description
mov rcx, qword [rsp + 0x38]
call fcn.140005c00
test eax, eax
mov r12d, eax
jne 0x140006854
mov r8, qword [rbx + 0xa0]
lea rdx, str.DependOnService
mov rcx, qword [rsp + 0x38]
call fcn.140005c70
test eax, eax
mov r12d, eax
jne 0x140006854
mov r8, qword [rbx + 0xa8]
lea rdx, str.DependOnGroup
mov rcx, qword [rsp + 0x38]
call fcn.140005c70
test eax, eax
mov r12d, eax
jne 0x140006854
lea rax, [rbx + 0x54]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], 4
mov rsi, qword [sym.imp.advapi32.dll_RegSetValueExW]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea rdx, str.Start
call rsi
test eax, eax
mov r12d, eax
jne 0x140006854
lea rax, [rbx + 0x58]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
lea rdx, str.ErrorControl
call rsi
test eax, eax
mov r12d, eax
jne 0x140006854
lea rax, [rbx + 0x50]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
lea rdx, str.Type
call rsi
test eax, eax
mov r12d, eax
jne 0x140006854
lea rdi, [rbx + 0x90]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov dword [rsp + 0x28], 4
lea r13, str.PreshutdownTimeout
mov qword [rsp + 0x20], rdi
mov r9d, 4
mov rdx, r13
call rsi
test eax, eax
mov r12d, eax
jne 0x140006854
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rdi
mov rdx, r13
mov dword [rsp + 0x28], 4
mov r9d, 4
call rsi
test eax, eax
mov r12d, eax
jne 0x140006854
cmp dword [rbx + 0xc4], 0
mov rcx, qword [rsp + 0x38]
jne 0x140006ab5
cmp dword [rbx + 0x70], 0
je 0x140006aa3
add rbx, 0x70
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14001c728]
call rsi
mov r12d, eax
xor eax, eax
test r12d, 0xfffffffd
cmove r12d, eax
jmp 0x140006854
lea rdx, [0x14001c728]
call qword [sym.imp.advapi32.dll_RegDeleteValueW]
mov r12d, eax
jmp 0x140006a91
lea rax, [rsp + 0x34]
xor r8d, r8d
mov dword [rsp + 0x34], 1
mov r9d, 4
mov dword [rsp + 0x28], 4
lea rdx, str.WOW64
mov qword [rsp + 0x20], rax
call rsi
test eax, eax
mov r12d, eax
jne 0x140006854
mov rcx, qword [rsp + 0x38]
jmp 0x140006a65