Function at 0x140017fa4
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov qword [rbp + 0x1f], 0xfffffffffffffffe
mov rsi, rcx
xor r14d, r14d
mov dword [rbp + 0x6f], r14d
lea rax, [rbp + 0x6f]
mov qword [rbp - 0x21], rax
lea rax, str.StartList::SaveSettings
mov qword [rbp - 0x19], rax
lea r12, [0x14002a0c8]
cmp qword [0x14002a0c8], r12
je 0x140017ffa
lea rcx, [rbp - 0x21]
call fcn.14001d0e4
nop
call fcn.140015f1c
or r15, 0xffffffffffffffff
test al, al
je 0x1400181bf
mov rax, qword [0x14002a6e0]
lea rcx, [0x14002a6e0]
mov rax, qword [rax + 0x18]
call qword [0x1400200f0]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rdx, [rsi + 0x60]
lea rcx, [rbp - 0x39]
call fcn.14001865c
mov rdi, r14
mov qword [rbp - 0x11], r14
mov qword [rbp - 9], r14
mov qword [rbp - 1], r14
call fcn.140018f54
mov r9d, 0x20006
xor r8d, r8d
test eax, eax
je 0x140018084
mov qword [rbp + 0x77], r14
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibility
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400180b4
mov rdi, qword [rbp + 0x77]
jmp 0x1400180ad
mov qword [rbp + 0x7f], r14
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityOOBE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400180b4
mov rdi, qword [rbp + 0x7f]
mov qword [rbp - 0x11], rdi
mov eax, r14d
mov rbx, qword [rbp - 0x39]
test eax, eax
je 0x14001810e
movzx r8d, ax
or r8d, 0x80070000
test eax, eax
cmovle r8d, eax
mov dword [rbp + 0x6f], r8d
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x14001818d
test byte [rcx + 0x1c], 8
je 0x14001818d
mov edx, 0x12
mov dword [rsp + 0x20], r8d
lea r9, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibilityOOBE
lea r8, [0x140021f20]
mov rcx, qword [rcx + 0x10]
call fcn.140013b98
jmp 0x14001818d
test rbx, rbx
je 0x140018381
mov rax, r15
inc rax
cmp word [rbx + rax*2], r14w
jne 0x14001811a
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.SettingConfiguration
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140018162
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rbp + 0x6f], ecx
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x14001818d
test byte [rcx + 0x1c], 0x10
je 0x14001818d
mov edx, 0x13
mov r9, rbx
lea r8, [0x140021f20]
mov rcx, qword [rcx + 0x10]
call fcn.140001a48
nop
test rdi, rdi
je 0x14001819c
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400181bf
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400200f0]
call fcn.140018f54
test eax, eax
je 0x140018356
mov rax, qword [0x14002a6e0]
lea rcx, [0x14002a6e0]
mov rax, qword [rax + 0x18]
call qword [0x1400200f0]
add rax, 0x18
mov qword [rbp - 0x29], rax
call fcn.140015f1c
lea rcx, [rsi + 0x30]
test al, al
cmovne rsi, rcx
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.14001865c
mov rdi, r14
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], r14
mov qword [rbp - 0x31], r14
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibility
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test eax, eax
jne 0x140018251
mov ecx, r14d
mov rdi, qword [rbp - 0x31]
mov qword [rbp + 7], rdi
mov rbx, qword [rbp - 0x29]
test ecx, ecx
je 0x1400182a5
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov dword [rbp + 0x6f], eax
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x140018324
test byte [rcx + 0x1c], 8
je 0x140018324
mov edx, 0x14
mov dword [rsp + 0x20], eax
lea r9, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibility
lea r8, [0x140021f20]
mov rcx, qword [rcx + 0x10]
call fcn.140013b98
jmp 0x140018324
test rbx, rbx
je 0x140018376
mov rax, r15
inc rax
cmp word [rbx + rax*2], r14w
jne 0x1400182b1
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Configuration
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1400182f9
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov dword [rbp + 0x6f], ecx
mov rcx, qword [0x14002a0c8]
cmp rcx, r12
je 0x140018324
test byte [rcx + 0x1c], 0x10
je 0x140018324
mov edx, 0x15
mov r9, rbx
lea r8, [0x140021f20]
mov rcx, qword [rcx + 0x10]
call fcn.140001a48
nop
test rdi, rdi
je 0x140018333
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140018356
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1400200f0]
mov ebx, dword [rbp + 0x6f]
lea rcx, [rbp - 0x21]
call fcn.14001d124
mov eax, ebx
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400017a4
nop
mov ecx, 0x80004005
call fcn.1400017a4
int3