Function at 0x1400117b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r14
push rbp
lea rbp, [r11 - 0x28]
sub rsp, 0x120
mov rax, qword [0x140057130]
xor rax, rsp
mov qword [rbp + 0x10], rax
cmp byte [0x140059776], 0
mov rdi, 0xffffffff80000001
lea r14, [rdi + 1]
jne 0x140011bba
lea rax, [rsp + 0x68]
mov qword [r11 + 0x10], rsi
lea rdx, str.SoftwareNVIDIA_CorporationGlobal_nView
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011ac5
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.UseHKLM
xor r8d, r8d
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x74], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011874
cmp dword [rsp + 0x60], esi
je 0x140011874
mov byte [0x140059777], 1
jmp 0x140011881
cmp byte [0x140059777], sil
je 0x140011ab5
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
lea r9, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea rdx, str.HKLMIsWritable
xor r8d, r8d
mov dword [rsp + 0x70], 4
mov dword [rsp + 0x60], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rsi
call fcn.140013070
test eax, eax
je 0x140011ab5
xor edx, edx
lea rcx, [rbp - 0x5c]
mov qword [rsp + 0x130], rbx
lea r8d, [rdx + 0x5c]
mov dword [rbp + 8], esi
mov word [rbp + 0xc], 0x100
mov dword [rbp], esi
mov word [rbp + 4], 0x200
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov qword [rsp + 0x78], rsi
mov rbx, rsi
mov dword [rbp - 0x60], esi
call fcn.1400150f0
lea rax, [rsp + 0x68]
lea rdx, str.SoftwareNVIDIA_CorporationGlobal_nView
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011aad
lea rax, [rbp - 0x78]
lea rcx, [rbp + 8]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
xor r8d, r8d
mov dl, 1
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x140011a80
xor edx, edx
lea rcx, [rbp - 0x60]
lea r8d, [rdx + 0x60]
call fcn.1400150f0
mov rax, qword [rbp - 0x78]
lea rcx, [rbp]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
xor r8d, r8d
mov dl, 1
mov dword [rsp + 0x28], esi
mov dword [rbp - 0x60], 0xf003f
mov dword [rsp + 0x20], esi
mov dword [rbp - 0x5c], 2
mov dword [rbp - 0x58], 3
mov dword [rbp - 0x44], esi
mov dword [rbp - 0x40], 5
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov rdx, qword [rbp - 0x70]
test eax, eax
je 0x140011a0e
mov dword [rbp - 0x30], 0xf003f
mov dword [rbp - 0x2c], 2
mov dword [rbp - 0x28], 3
mov dword [rbp - 0x14], esi
mov dword [rbp - 0x10], 5
mov qword [rbp - 8], rdx
xor r8d, r8d
test rdx, rdx
lea r9, [rsp + 0x78]
lea ecx, [r8 + 2]
lea rdx, [rbp - 0x60]
jne 0x140011a27
lea ecx, [r8 + 1]
call qword [sym.imp.ADVAPI32.dll_SetEntriesInAclW]
test eax, eax
jne 0x140011a80
lea edx, [rax + 0x28]
lea ecx, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140011a80
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov rcx, rbx
test eax, eax
je 0x140011a77
mov r8, qword [rsp + 0x78]
xor r9d, r9d
lea edx, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x140011b15
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, rsi
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140011a8f
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140011a9f
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rbx, rbx
je 0x140011aad
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140011ac5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x140059777], 0
mov rsi, qword [rsp + 0x138]
je 0x140011bb3
lea rax, [rsp + 0x68]
lea rdx, str.SoftwareNVIDIA_CorporationGlobal_nView
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011bac
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140011bb3
mov rcx, qword [rsp + 0x68]
mov r8, rbx
mov edx, 4
call fcn.140013260
test eax, eax
je 0x140011b60
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
lea rdx, str.HKLMIsWritable
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rbp - 0x80]
lea rdx, str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, r14
mov qword [rbp - 0x80], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140011a80
mov rcx, qword [rbp - 0x80]
lea edx, [rax + 4]
mov r8, rbx
call fcn.140013260
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140011a80
mov byte [0x140059777], 0
mov byte [0x140059776], 1
cmp byte [0x140059777], 0
cmovne rdi, r14
mov rax, rdi
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400150c0
lea r11, [rsp + 0x120]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret