Function at 0x1400d4fb0
Capabilities:
Check if file exists
Create directory
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa60
mov qword [rsp + 0x9b8], 0xfffffffffffffffe
mov rax, qword [0x1402bd5c0]
xor rax, rsp
mov qword [rsp + 0xa58], rax
call fcn.1400e0f70
test eax, eax
jne 0x1400d4feb
xor eax, eax
jmp 0x1400d5c35
call fcn.1400e1020
cmp eax, 0xffffffff
je 0x1400d4ffc
xor eax, eax
jmp 0x1400d5c35
mov dword [rsp + 0x40], 8
mov dword [rsp + 0x44], 0xff
lea rcx, [rsp + 0x40]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov rcx, qword [rsp + 0xa70]
call fcn.140074d4c
xor ecx, ecx
call fcn.140094ae8
test eax, eax
jne 0x1400d5048
mov r8d, 0xffffffff
xor edx, edx
mov ecx, 0x67
call fcn.1400f2960
xor eax, eax
jmp 0x1400d5c35
xor ecx, ecx
call fcn.140095994
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
mov rax, qword [rsp + 0xa70]
mov rax, qword [rax + 0x90]
movzx eax, word [rax]
test eax, eax
jne 0x1400d50e1
lea rax, [rsp + 0x940]
mov qword [rsp + 0x948], rax
lea rcx, [rsp + 0x950]
call fcn.140001000
mov qword [rsp + 0x9c0], rax
mov rax, qword [rsp + 0x9c0]
mov qword [rsp + 0x9c8], rax
lea r8, [0x140228928]
mov rdx, qword [rsp + 0x9c8]
mov rcx, qword [rsp + 0x948]
call fcn.1400010b0
mov qword [rsp + 0x9d0], rax
mov rcx, qword [rsp + 0x9d0]
call fcn.1401cb5a0
nop
lea rcx, [rsp + 0x950]
call fcn.140007060
call fcn.140192970
test eax, eax
jne 0x1400d50f1
xor eax, eax
jmp 0x1400d5c35
lea rdx, [0x140228938]
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400ab9f8
test eax, eax
jne 0x1400d512b
xor r8d, r8d
mov edx, 0x40
lea rcx, str._uninstall:_uninstall_program_r_n_start:_start_service_r_n_stop:_stop_service_r_n_restart:_restart_service_r_n_update:_update_xml_data
call fcn.1400f0bf0
xor eax, eax
jmp 0x1400d5c35
lea rdx, str._uninstall
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400ab9f8
test eax, eax
jne 0x1400d52e0
call fcn.1401911c0
xor edx, edx
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0xa0]
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0xf0], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7e7
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [0x1403c8f00]
call fcn.1400d6430
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8840
mov dword [rsp + 0xe8], 0
lea rcx, [0x1403c8c50]
call fcn.140011300
test eax, eax
jne 0x1400d51ea
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xe8]
add eax, 1
mov dword [rsp + 0xe8], eax
cmp dword [rsp + 0xe8], 5
jl 0x1400d51e8
jmp 0x1400d51ea
jmp 0x1400d51b0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8033
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
test rax, rax
je 0x1400d522d
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x89
call fcn.1400f2960
cmp eax, 6
jne 0x1400d522b
jmp 0x1400d522d
jmp 0x1400d51ea
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
lea rcx, [0x1403c8c50]
call fcn.1400d7ba0
lea rcx, [0x1403c8f00]
call fcn.1400d5db0
call fcn.1400ec690
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [0x140228a60]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d52bc
call fcn.14000f0b0
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1403c8c50]
call fcn.140051f90
test eax, eax
je 0x1400d52d9
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400d52bc
xor eax, eax
jmp 0x1400d5c35
lea rcx, [0x140228ac0]
call fcn.1400a99d4
mov r8, rax
lea rdx, str._restart
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400aab6c
test eax, eax
jne 0x1400d53e6
lea rcx, [0x1403c8f00]
call fcn.1400d6430
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8840
mov dword [rsp + 0xf8], 0
lea rcx, [0x1403c8c50]
call fcn.140011300
test eax, eax
jne 0x1400d5371
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xf8]
add eax, 1
mov dword [rsp + 0xf8], eax
cmp dword [rsp + 0xf8], 5
jl 0x1400d536f
jmp 0x1400d5371
jmp 0x1400d5337
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403c8c50]
call fcn.1400d7ba0
lea rcx, [0x1403c8f00]
call fcn.1400d5db0
xor eax, eax
jmp 0x1400d5c35
lea rdx, str._start
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400ab9f8
test eax, eax
jne 0x1400d54b2
lea rcx, [0x1403c8f00]
call fcn.1400d6430
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8840
mov dword [rsp + 0xfc], 0
lea rcx, [0x1403c8c50]
call fcn.140011300
test eax, eax
jne 0x1400d5468
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0xfc]
add eax, 1
mov dword [rsp + 0xfc], eax
cmp dword [rsp + 0xfc], 5
jl 0x1400d5466
jmp 0x1400d5468
jmp 0x1400d542e
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403c8c50]
call fcn.1400d7ba0
lea rcx, [0x1403c8f00]
call fcn.1400d5db0
xor eax, eax
jmp 0x1400d5c35
lea rdx, str._stop
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400ab9f8
test eax, eax
jne 0x1400d557e
lea rcx, [0x1403c8f00]
call fcn.1400d6430
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8840
mov dword [rsp + 0x100], 0
lea rcx, [0x1403c8c50]
call fcn.140011300
test eax, eax
jne 0x1400d5534
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x100]
add eax, 1
mov dword [rsp + 0x100], eax
cmp dword [rsp + 0x100], 5
jl 0x1400d5532
jmp 0x1400d5534
jmp 0x1400d54fa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403c8c50]
call fcn.1400d7ba0
lea rcx, [0x1403c8f00]
call fcn.1400d5db0
xor eax, eax
jmp 0x1400d5c35
lea rdx, [0x140228b10]
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400ab9f8
test eax, eax
jne 0x1400d564a
lea rcx, [0x1403c8f00]
call fcn.1400d6430
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8840
mov dword [rsp + 0x104], 0
lea rcx, [0x1403c8c50]
call fcn.140011300
test eax, eax
jne 0x1400d5600
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rsp + 0x104]
add eax, 1
mov dword [rsp + 0x104], eax
cmp dword [rsp + 0x104], 5
jl 0x1400d55fe
jmp 0x1400d5600
jmp 0x1400d55c6
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x803d
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x1403c8c50]
call fcn.1400d7ba0
lea rcx, [0x1403c8f00]
call fcn.1400d5db0
xor eax, eax
jmp 0x1400d5c35
call fcn.140052150
movzx eax, al
test eax, eax
je 0x1400d5676
call fcn.14000f460
lea rdx, str._install
mov rcx, qword [rax + 0x90]
call fcn.1400ab9f8
test eax, eax
jne 0x1400d5b70
lea rcx, [rsp + 0x110]
call fcn.1400054b0
nop
mov r9d, 0x2001f
lea r8, str.SYSTEMCurrentControlSetControlCrashControl
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x110]
call fcn.140005670
test eax, eax
jne 0x1400d5725
mov r8d, 1
lea rdx, [0x140228ba0]
lea rcx, [rsp + 0x110]
call fcn.1400059f0
mov r8d, 3
lea rdx, str.CrashDumpEnabled
lea rcx, [rsp + 0x110]
call fcn.1400059f0
mov r8d, 1
lea rdx, str.LogEvent
lea rcx, [rsp + 0x110]
call fcn.1400059f0
mov r9d, 2
lea r8, str._SystemRoot_Minidump
lea rdx, [0x140228c30]
lea rcx, [rsp + 0x110]
call fcn.140005a50
lea rcx, [rsp + 0x110]
call fcn.140005540
call fcn.14000f0b0
mov rdx, rax
lea rcx, [rsp + 0x960]
call fcn.140002050
mov qword [rsp + 0x9d8], rax
mov rax, qword [rsp + 0x9d8]
mov qword [rsp + 0x9e0], rax
mov r8, qword [rsp + 0x9e0]
lea rdx, str.SoftwareMicrosoftWindowsWindows_Error_ReportingLocalDumps_
lea rcx, [rsp + 0x968]
call fcn.140006d10
mov qword [rsp + 0x9e8], rax
mov rax, qword [rsp + 0x9e8]
mov qword [rsp + 0x9f0], rax
lea r8, str..exe
mov rdx, qword [rsp + 0x9f0]
lea rcx, [rsp + 0x970]
call fcn.1400010b0
mov qword [rsp + 0x9f8], rax
mov rcx, qword [rsp + 0x9f8]
call fcn.140050200
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x110]
call fcn.140005590
test eax, eax
jne 0x1400d5804
mov dword [rsp + 0xa00], 1
jmp 0x1400d580f
mov dword [rsp + 0xa00], 0
movzx eax, byte [rsp + 0xa00]
mov byte [rsp + 0x958], al
lea rcx, [rsp + 0x970]
call fcn.140007060
nop
lea rcx, [rsp + 0x968]
call fcn.140007060
nop
lea rcx, [rsp + 0x960]
call fcn.140007060
movzx edx, byte [rsp + 0x958]
test edx, edx
je 0x1400d5a39
mov r8d, 1
lea rdx, str.DumpType
lea rcx, [rsp + 0x110]
call fcn.1400059f0
lea rcx, [rsp + 0x978]
call fcn.140001000
mov qword [rsp + 0xa08], rax
mov rax, qword [rsp + 0xa08]
mov qword [rsp + 0xa10], rax
lea r8, [0x140228cf8]
mov rdx, qword [rsp + 0xa10]
lea rcx, [rsp + 0x980]
call fcn.1400010b0
mov qword [rsp + 0xa18], rax
mov rcx, qword [rsp + 0xa18]
call fcn.140050200
mov r9d, 2
mov r8, rax
lea rdx, str.DumpFolder
lea rcx, [rsp + 0x110]
call fcn.140005a50
lea rcx, [rsp + 0x980]
call fcn.140007060
nop
lea rcx, [rsp + 0x978]
call fcn.140007060
lea rcx, [rsp + 0x110]
call fcn.140005540
lea rcx, [rsp + 0x990]
call fcn.140001000
mov qword [rsp + 0xa20], rax
mov rax, qword [rsp + 0xa20]
mov qword [rsp + 0xa28], rax
lea r8, [0x140228d20]
mov rdx, qword [rsp + 0xa28]
lea rcx, [rsp + 0x998]
call fcn.1400010b0
mov qword [rsp + 0xa30], rax
mov rcx, qword [rsp + 0xa30]
call fcn.140050200
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400d597c
mov dword [rsp + 0xa38], 1
jmp 0x1400d5987
mov dword [rsp + 0xa38], 0
movzx eax, byte [rsp + 0xa38]
mov byte [rsp + 0x988], al
lea rcx, [rsp + 0x998]
call fcn.140007060
nop
lea rcx, [rsp + 0x990]
call fcn.140007060
movzx edx, byte [rsp + 0x988]
test edx, edx
je 0x1400d5a39
lea rcx, [rsp + 0x9a0]
call fcn.140001000
mov qword [rsp + 0xa40], rax
mov rax, qword [rsp + 0xa40]
mov qword [rsp + 0xa48], rax
lea r8, str.dump
mov rdx, qword [rsp + 0xa48]
lea rcx, [rsp + 0x9a8]
call fcn.1400010b0
mov qword [rsp + 0xa50], rax
mov rcx, qword [rsp + 0xa50]
call fcn.140050200
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rsp + 0x9a8]
call fcn.140007060
nop
lea rcx, [rsp + 0x9a0]
call fcn.140007060
call fcn.14018f4a0
mov dword [rsp + 0x108], eax
cmp dword [rsp + 0x108], 0
je 0x1400d5b63
call fcn.1400ec690
call fcn.1400ec760
lea rax, [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400d5b36
xor eax, eax
mov word [rsp + 0x130], ax
lea rdi, [rsp + 0x132]
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov eax, 0x22
mov word [rsp + 0x130], ax
lea rdx, [rsp + 0x132]
mov r8d, 0x400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x140228da0]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov edi, eax
shl rdi, 1
call fcn.14000f0b0
mov rdx, rax
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1401911f0
test eax, eax
jne 0x1400d5b63
mov dword [rsp + 0x9b0], 0
lea rcx, [rsp + 0x110]
call fcn.1400054e0
mov eax, dword [rsp + 0x9b0]
jmp 0x1400d5c35
lea rcx, [rsp + 0x110]
call fcn.1400054e0
lea rcx, [0x1403c8c50]
call fcn.140051f90
lea rdx, str._service
mov rcx, qword [rsp + 0xa70]
mov rcx, qword [rcx + 0x90]
call fcn.1400ab9f8
test eax, eax
jne 0x1400d5bac
call fcn.14018f490
call fcn.1400ecba0
xor eax, eax
jmp 0x1400d5c35
call fcn.14000dda0
lea r8, [rsp + 0x50]
lea rdx, str.32770
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClassInfoW]
mov rax, qword [rsp + 0xa70]
mov rax, qword [rax + 0xa0]
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x50]
call fcn.140081e1c
lea rcx, [rsp + 0xa0]
call fcn.1400758e8
nop
lea rdx, [rsp + 0xa0]
mov rcx, qword [rsp + 0xa70]
call fcn.140074954
mov ecx, dword [rsp + 0xa8]
call fcn.1400d7450
mov dword [rsp + 0x9b4], 1
lea rcx, [rsp + 0xa0]
call fcn.1400759b4
mov eax, dword [rsp + 0x9b4]
mov rcx, qword [rsp + 0xa58]
xor rcx, rsp
call fcn.1400a9820
add rsp, 0xa60
pop rdi
ret