Function at 0x14000a384
Capabilities:
Check os version
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x14002e008]
xor rax, rsp
mov qword [rbp + 0x90], rax
xor r8d, r8d
mov r14d, ecx
test ecx, ecx
je 0x14000a64d
and qword [rsp + 0x40], r8
lea rax, [rsp + 0x50]
lea rdx, [0x1400016f0]
mov qword [rsp + 0x38], rax
and qword [rsp + 0x30], r8
xor r9d, r9d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000a423
mov r8, qword [rsp + 0x50]
lea rdx, [0x140001760]
xor r9d, r9d
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140009704
mov ecx, 0x20000001
xor ebx, ebx
call qword [sym.imp.iertutil.dll_Ordinal_791]
test al, al
jne 0x14000a44d
mov ecx, 0x20000002
call qword [sym.imp.iertutil.dll_Ordinal_791]
test al, al
jne 0x14000a44d
mov sil, 1
jmp 0x14000a450
xor sil, sil
xor edi, edi
xor eax, eax
shl rax, 5
lea rcx, [0x1400047d0]
mov dl, sil
add rcx, rax
call fcn.14000f024
test eax, eax
jns 0x14000a473
test ebx, ebx
cmovns ebx, eax
inc edi
movsxd rax, edi
cmp rax, 0x17
jb 0x14000a454
call fcn.140009ddc
call qword [sym.imp.SHELL32.dll_SHFlushSFCache]
call fcn.140012324
cmp eax, 3
jne 0x14000a4a2
cmp byte [0x14002ed48], 0
jne 0x14000a557
xor eax, eax
cmp eax, 2
jne 0x14000a557
and qword [rsp + 0x50], 0
lea rcx, [rsp + 0x50]
call fcn.140014dac
mov rbx, qword [rsp + 0x50]
test eax, eax
js 0x14000a53d
and qword [rsp + 0x50], 0
mov rcx, qword [rbx + 0x28]
lea rdx, [rsp + 0x50]
call fcn.1400198d4
test eax, eax
js 0x14000a51e
mov rdx, qword [rsp + 0x50]
lea rax, [0x140012b40]
lea r9, [0x140001d60]
mov qword [0x14002ec40], rax
lea rax, [0x140012b00]
lea r8, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x60], 0x80004005
mov qword [0x14002ec38], rax
call fcn.140012db0
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14000a53d
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call qword [0x140031ba0]
mov rcx, rdi
call rsi
test rbx, rbx
je 0x14000a557
mov rax, qword [rbx]
mov rdi, qword [rax + 0x10]
mov rcx, rdi
call qword [0x140031ba0]
mov rcx, rbx
call rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__time64]
mov edi, 8
lea r9, [rsp + 0x50]
lea rdx, [0x140001d68]
lea rcx, [0x140001d80]
lea r8d, [rdi + 3]
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
call qword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
mov ebx, 0x114
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, ebx
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14000a66a
cmp dword [rsp + 0x74], 6
ja 0x14000a5d3
jne 0x14000a66a
cmp dword [rsp + 0x78], 1
jb 0x14000a66a
and dword [rsp + 0x20], 0
lea rdx, [0x140001dd8]
mov r8d, r14d
call fcn.1400097b4
lea rdx, [0x1400015d8]
mov r8d, r14d
mov dword [rsp + 0x20], 0xd
call fcn.1400097b4
mov ecx, r14d
call fcn.140009aec
cmp dword [rsp + 0x74], 6
ja 0x14000a616
jne 0x14000a66a
cmp dword [rsp + 0x78], 2
jb 0x14000a66a
lea rax, [rsp + 0x58]
lea rdx, [0x140001880]
mov r9d, 0x60000
mov r8d, edi
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000a66a
mov rcx, qword [rsp + 0x58]
call fcn.14000f8fc
jmp 0x14000a66a
and dword [rsp + 0x20], 0
lea rdx, [0x140001dd8]
call fcn.1400097b4
xor ecx, ecx
call fcn.140009aec
call fcn.140009908
test r14d, r14d
je 0x14000a674
call fcn.140009cb4
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.14002ad70
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret