Function at 0x140006ae0
Capabilities:
Get common file path
Set registry value

Disassembly:
push rdi
mov eax, 0x1a80
call fcn.14007a110
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x1a90], rbx
mov qword [rsp + 0x1a98], rsi
mov rax, qword [0x1400a5de0]
xor rax, rsp
mov qword [rsp + 0x1a78], rax
xor ebx, ebx
mov rsi, qword [0x1400ae080]
test rsi, rsi
jne 0x140006be0
mov ecx, 0x310
call fcn.1400278b8
mov rsi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140006bd6
call fcn.14002790c
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x140006b66
mov ecx, 0x80004005
call fcn.140007e00
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov word [rsi + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x14008a5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14008a5b0]
mov rcx, rsi
call fcn.140008260
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x26c]
mov word [rcx], 0
lea r8, [0x14008a5b8]
mov edx, 0x50
call fcn.140052920
nop
jmp 0x140006bd9
mov rsi, rbx
mov qword [0x1400ae080], rsi
lea rdx, str.InstallSIService__
mov rcx, rsi
call fcn.14000d860
mov word [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x52]
call fcn.140057420
mov word [rsp + 0x860], 0
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x862]
call fcn.140057420
mov rdi, qword [0x1400ae090]
test rdi, rdi
jne 0x140006c82
lea ecx, [rdi + 0x30]
call fcn.1400278b8
mov rdi, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140006c78
mov ecx, 0x20
call fcn.1400278b8
nop
test rax, rax
je 0x140006c66
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
jmp 0x140006c69
mov rax, rbx
mov qword [rdi + 0x28], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
jmp 0x140006c7b
mov rdi, rbx
mov qword [0x1400ae090], rdi
mov r9d, 0x104
lea r8, [rsp + 0x860]
lea rdx, str.SERVICE_NAME
mov rcx, rdi
call fcn.140012ca0
mov word [rsp + 0x260], 0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x262]
call fcn.140057420
mov edx, 0x100
lea rcx, [rsp + 0x260]
call fcn.140006520
mov dword [rsp + 0x38], 1
mov rsi, qword [0x1400ae080]
test rsi, rsi
jne 0x140006d9c
mov ecx, 0x310
call fcn.1400278b8
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140006d92
call fcn.14002790c
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x140006d22
mov ecx, 0x80004005
call fcn.140007e00
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov word [rsi + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x14008a5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14008a5b0]
mov rcx, rsi
call fcn.140008260
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x26c]
mov word [rcx], 0
lea r8, [0x14008a5b8]
mov edx, 0x50
call fcn.140052920
nop
jmp 0x140006d95
mov rsi, rbx
mov qword [0x1400ae080], rsi
mov dword [rsp + 0x20], 1
lea r9, str.BlockSISvc
lea r8, [rsp + 0x260]
lea rdx, str.SaveDwordToHKLM__s__s__d
mov rcx, rsi
call fcn.14000d860
mov rsi, qword [0x1400ae080]
test rsi, rsi
jne 0x140006e81
mov ecx, 0x310
call fcn.1400278b8
mov rsi, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140006e77
call fcn.14002790c
mov rcx, rax
test rax, rax
setne bl
test ebx, ebx
jne 0x140006e0a
mov ecx, 0x80004005
call fcn.140007e00
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsi], rax
mov word [rsi + 0x64], 0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x14008a5b0]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x14008a5b0]
mov rcx, rsi
call fcn.140008260
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x30]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rcx, [rsi + 0x26c]
mov word [rcx], 0
lea r8, [0x14008a5b8]
mov edx, 0x50
call fcn.140052920
nop
jmp 0x140006e7a
mov rsi, rbx
mov qword [0x1400ae080], rsi
lea r9, str.BlockSISvc
lea r8, [rsp + 0x260]
lea rdx, str.SaveValueToHKLM__s__s
mov rcx, rsi
call fcn.14000d860
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x30]
call fcn.140014f80
mov rdi, rax
test rax, rax
je 0x140006eef
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.BlockSISvc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140006f08
call fcn.14000d730
mov rcx, rax
lea r8, str.SaveValueToHKLM__RegCreateKeyEx_failed
mov edx, 0x3f3
call fcn.14000daa0
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea r8, [0x140087db8]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400539f0
lea r8, [rsp + 0x860]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400539f0
mov word [rsp + 0xa70], 0
mov word [rsp + 0x460], 0
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x462]
call fcn.140057420
lea r9, str._install
lea r8, [0x14008a8e0]
mov edx, 0x200
lea rcx, [rsp + 0x460]
call fcn.140052ea0
lea r8, [rsp + 0x460]
mov edx, 0x800
lea rcx, [rsp + 0xa70]
call fcn.1400539f0
lea r8, [rsp + 0xa70]
lea rdx, [rsp + 0x50]
mov ecx, 1
call fcn.14000eea0
mov word [rsp + 0xa70], 0
mov word [rsp + 0x460], 0
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x462]
call fcn.140057420
lea r9, str._stop
lea r8, [0x14008a8e0]
mov edx, 0x200
lea rcx, [rsp + 0x460]
call fcn.140052ea0
lea r8, [rsp + 0x460]
mov edx, 0x800
lea rcx, [rsp + 0xa70]
call fcn.1400539f0
lea r8, [rsp + 0xa70]
lea rdx, [rsp + 0x50]
mov ecx, 1
call fcn.14000eea0
mov word [rsp + 0xa70], 0
mov word [rsp + 0x460], 0
xor edx, edx
mov r8d, 0x3fe
lea rcx, [rsp + 0x462]
call fcn.140057420
lea r9, str._start
lea r8, [0x14008a8e0]
mov edx, 0x200
lea rcx, [rsp + 0x460]
call fcn.140052ea0
lea r8, [rsp + 0x460]
mov edx, 0x800
lea rcx, [rsp + 0xa70]
call fcn.1400539f0
lea r8, [rsp + 0xa70]
lea rdx, [rsp + 0x50]
mov ecx, 1
call fcn.14000eea0
mov rcx, qword [rsp + 0x1a78]
xor rcx, rsp
call fcn.1400524a0
lea r11, [rsp + 0x1a80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret