Function at 0x140013d90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x140047650]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, r8
mov ebx, 0xff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r8d, 0x52
lea r9, str.Notifu_process__d_starting__http:__www.paralint.com_projects_notifu___n
lea ecx, [r8 - 0x50]
lea rdx, str.notifu.cpp
mov dword [rsp + 0x20], eax
call fcn.140014b60
mov r8d, 0x53
lea rax, str.Sun_Sep_29_19:58:03_2019
lea r9, str._s_build_n
lea rdx, str.notifu.cpp
lea ecx, [r8 - 0x51]
mov qword [rsp + 0x20], rax
call fcn.140014b60
lea rcx, [0x14004b0a0]
call fcn.140006690
xor r14d, r14d
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
cmp word [rdi], r14w
jne 0x140013e3f
mov r8d, r14d
jmp 0x140013e4d
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], r14w
jne 0x140013e43
lea rcx, [rbp - 9]
mov rdx, rdi
call fcn.1400073b0
lea rdx, [rbp - 9]
lea rcx, [0x14004b0a0]
call fcn.140010c00
cmp qword [rbp + 0xf], 8
jb 0x140013e79
mov rcx, qword [rbp - 9]
call fcn.14001ac88
test byte [0x14004b3f8], 1
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
je 0x140013fee
lea r8, [rbp - 9]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140013f46
mov rcx, qword [rbp - 9]
lea rax, [rbp - 0x79]
lea rdx, str.EnableBalloonTips
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x79], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140013f46
cmp qword [0x14004b0d0], r14
jbe 0x140014018
lea rdx, str.Balloon_tips_were_enabled_in_the_registry._n_nThe_key_EnableBalloonTips1_was_added_under_HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea rcx, [rbp - 9]
mov r8d, 0x98
mov ebx, r14d
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
call fcn.1400073b0
lea rdx, [rbp - 9]
call fcn.140012ef0
cmp qword [rbp + 0xf], 8
jb 0x1400142ec
mov rcx, qword [rbp - 9]
call fcn.14001ac88
jmp 0x1400142ec
lea rdx, str.Unable_to_enable_balloon_tips_in_the_registry._n_nPlease_add_EnableBalloonTips1_under_HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea rcx, [rbp - 9]
mov r8d, 0x95
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
call fcn.1400073b0
call fcn.140012e30
test al, al
je 0x140013f9a
cmp qword [rbp + 0xf], 8
lea rdx, [rbp - 9]
lea rcx, [0x1400498d0]
cmovae rdx, qword [rbp - 9]
call fcn.14000bcc0
mov rcx, rax
call fcn.1400134f0
jmp 0x140013fdc
lea rcx, [rbp + 0x17]
call fcn.1400123b0
cmp qword [rax + 0x18], 8
jb 0x140013fad
mov rax, qword [rax]
cmp qword [rbp + 0xf], 8
lea rdx, [rbp - 9]
mov r9d, 0x10000
cmovae rdx, qword [rbp - 9]
mov r8, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp qword [rbp + 0x2f], 8
jb 0x140013fdc
mov rcx, qword [rbp + 0x17]
call fcn.14001ac88
cmp qword [rbp + 0xf], 8
jb 0x140014018
mov rcx, qword [rbp - 9]
call fcn.14001ac88
jmp 0x140014018
test byte [0x14004b588], 1
je 0x140014018
mov rcx, qword [0x14004b6e8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x14004b6e0]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test byte [0x14004b5d8], 1
je 0x14001403f
lea r8, str.BSD_3_Clause
lea rdx, str.Copyright__c__2019__Solutions_Paralint_inc._nAll_rights_reserved._n_nRedistribution_and_use_in_source_and_binary_forms__with_or_without_modification__are_permitted_provided_that_the_following_conditions_are_met:_n__Redistributions_of_source_code_must_retain_the_above_copyright_notice__this_list_of_conditions_and_the_following_disclaimer._n__Redistributions_in_binary_form_must_reproduce_the_above_copyright_notice__this_list_of_conditions_and_the_following_disclaimer_in_the_documentation_and_or_other_materials_provided_with_the_distribution._n__Neither_the_name_of_the__organization__nor_the_names_of_its_contributors_may_be_used_to_endorse_or_promote_products_derived_from_this_software_without_specific_prior_written_permission._n_nTHIS_SOFTWARE_IS_PROVIDED_BY_THE_COPYRIGHT_HOLDERS_AND_CONTRIBUTORS__AS_IS__AND_ANY_EXPRESS_OR_IMPLIED_WARRANTIES__INCLUDING__BUT_NOT_LIMITED_TO__THE_IMPLIED_WARRANTIES_OF_MERCHANTABILITY_AND_FITNESS_FOR_A_PARTICULAR_PURPOSE_ARE_DISCLAIMED._IN_NO_EVENT_SHALL__COPYRIGHT_HOLDER__BE_LIABLE_FOR_ANY_DIRECT__INDIRECT__INCIDENTAL__SPECIAL__EXEMPLARY__OR_CONSEQUENTIAL_DAMAGES__INCLUDING__BUT_NOT_LIMITED_TO__PROCUREMENT_OF_SUBSTITUTE_GOODS_OR_SERVICES__LOSS_OF_USE__DATA__OR_PROFITS__OR_BUSINESS_INTERRUPTION__HOWEVER_CAUSED_AND_ON_ANY_THEORY_OF_LIABILITY__WHETHER_IN_CONTRACT__STRICT_LIABILITY__OR_TORT__INCLUDING_NEGLIGENCE_OR_OTHERWISE__ARISING_IN_ANY_WAY_OUT_OF_THE_USE_OF_THIS_SOFTWARE__EVEN_IF_ADVISED_OF_THE_POSSIBILITY_OF_SUCH_DAMAGE.
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400142ec
lea rcx, [0x14004b0a0]
call fcn.140012fa0
test al, al
je 0x1400142e7
xor ecx, ecx
mov qword [rsp + 0x110], rsi
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, [rbp - 0x69]
lea rcx, [0x14004b0a0]
mov qword [rbp - 0x41], 7
mov qword [rbp - 0x49], r14
mov word [rbp - 0x59], r14w
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x39], r14w
call fcn.140006a50
test byte [0x14004b538], 1
je 0x1400140bd
mov ecx, 0x18
call fcn.14001b67c
test rax, rax
je 0x14001411d
mov edx, dword [rbp - 0x69]
mov rcx, rax
call fcn.1400146d0
mov rdi, rax
jmp 0x140014120
mov ecx, 0x20
call fcn.14001b67c
mov rdi, rax
test rax, rax
je 0x14001411d
mov ebx, dword [rbp - 0x69]
mov r8d, 0x51
lea rax, [0x14003e048]
lea r9, str.Timeout_value_set_at__d_milliseconds_n
lea rdx, str.QueryContinue.cpp
lea ecx, [r8 - 0x4f]
mov qword [rdi], rax
mov dword [rdi + 8], r14d
mov dword [rdi + 0x10], r14d
mov dword [rsp + 0x20], ebx
call fcn.140014b60
mov dword [rdi + 8], ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0xc], eax
lea rax, [0x14003e208]
mov qword [rdi], rax
jmp 0x140014120
mov rdi, r14
mov rdx, qword [0x14004b6d8]
mov rcx, qword [0x14004b6e0]
lea rax, [0x14003e638]
xor r9d, r9d
or r8d, 0xffffffff
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0xff
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
test eax, eax
jne 0x140014168
mov rcx, qword [0x14004b6e0]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [0x14004b090], 1
lea r8, [rbp - 9]
lea rcx, [rbp - 0x69]
mov rdx, rdi
call fcn.140014330
cmp byte [0x14004b090], r14b
mov esi, eax
je 0x14001419e
mov rcx, qword [0x14004b6d8]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov byte [0x14004b090], r14b
mov rcx, qword [0x14004b6d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x14004b6e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.USER32.dll_DestroyIcon]
mov ebx, dword [rbp - 1]
cmp ebx, 0xff
jne 0x140014293
cmp esi, 0x80004002
je 0x140014250
cmp esi, 0x80040154
je 0x140014250
cmp esi, 0x800704c7
je 0x140014249
test esi, esi
je 0x140014242
cmp esi, 1
jne 0x140014293
mov rcx, rdi
call fcn.140014830
test al, al
je 0x14001420a
lea ebx, [rsi + 1]
jmp 0x140014293
cmp dword [rdi + 0x10], 0x403e8
jne 0x14001421a
mov ebx, 8
jmp 0x140014293
lea r9, str.Unknown_reason_for_exiting__0x_08X__n
lea rdx, str.notifu.cpp
mov r8d, 0xa3
mov ecx, 3
mov dword [rsp + 0x20], 1
call fcn.140014b60
jmp 0x140014293
mov ebx, 3
jmp 0x140014293
mov ebx, 4
jmp 0x140014293
mov ebx, 5
lea rdx, str.IUserNotification_is_not_supported_on_this_version_of_Windows.
lea rcx, [rbp + 0x17]
lea r8d, [rbx + 0x39]
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r14
mov word [rbp + 0x17], r14w
call fcn.1400073b0
lea rdx, [rbp + 0x17]
call fcn.140012ef0
cmp qword [rbp + 0x2f], 8
jb 0x140014293
mov rcx, qword [rbp + 0x17]
call fcn.14001ac88
mov rsi, qword [rsp + 0x110]
test rdi, rdi
je 0x1400142ae
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax + 0x20]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp qword [rbp - 0x21], 8
jb 0x1400142c4
mov rcx, qword [rbp - 0x39]
call fcn.14001ac88
cmp qword [rbp - 0x41], 8
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x39], r14w
jb 0x1400142ec
mov rcx, qword [rbp - 0x59]
call fcn.14001ac88
jmp 0x1400142ec
mov ebx, 1
lea r9, str.Returning__d_n
lea rdx, str.notifu.cpp
mov r8d, 0xb8
mov ecx, 2
mov dword [rsp + 0x20], ebx
call fcn.140014b60
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14001aca0
mov rbx, qword [rsp + 0x118]
add rsp, 0xf0
pop r14
pop rdi
pop rbp
ret