Function at 0x140010d90
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x140044650]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, r8
mov ebx, 0xff
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov r8d, 0x52
lea r9, str.Notifu_process__d_starting__http:__www.paralint.com_projects_notifu___n
lea ecx, [r8 - 0x50]
lea rdx, str.notifu.cpp
mov dword [rsp + 0x20], eax
call fcn.140011b60
mov r8d, 0x53
lea rax, str.Sun_Sep_29_19:58:03_2019
lea r9, str._s_build_n
lea rdx, str.notifu.cpp
lea ecx, [r8 - 0x51]
mov qword [rsp + 0x20], rax
call fcn.140011b60
lea rcx, [0x1400480a0]
call fcn.140003690
xor r14d, r14d
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
cmp word [rdi], r14w
jne 0x140010e3f
mov r8d, r14d
jmp 0x140010e4d
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], r14w
jne 0x140010e43
lea rcx, [rbp - 9]
mov rdx, rdi
call fcn.1400043b0
lea rdx, [rbp - 9]
lea rcx, [0x1400480a0]
call fcn.14000dc00
cmp qword [rbp + 0xf], 8
jb 0x140010e79
mov rcx, qword [rbp - 9]
call fcn.140017c88
test byte [0x1400483f8], 1
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
je 0x140010fee
lea r8, [rbp - 9]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140010f46
mov rcx, qword [rbp - 9]
lea rax, [rbp - 0x79]
lea rdx, str.EnableBalloonTips
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [rbp - 0x79], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140010f46
cmp qword [0x1400480d0], r14
jbe 0x140011018
lea rdx, str.Balloon_tips_were_enabled_in_the_registry._n_nThe_key_EnableBalloonTips1_was_added_under_HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea rcx, [rbp - 9]
mov r8d, 0x98
mov ebx, r14d
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
call fcn.1400043b0
lea rdx, [rbp - 9]
call fcn.14000fef0
cmp qword [rbp + 0xf], 8
jb 0x1400112ec
mov rcx, qword [rbp - 9]
call fcn.140017c88
jmp 0x1400112ec
lea rdx, str.Unable_to_enable_balloon_tips_in_the_registry._n_nPlease_add_EnableBalloonTips1_under_HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea rcx, [rbp - 9]
mov r8d, 0x95
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r14
mov word [rbp - 9], r14w
call fcn.1400043b0
call fcn.14000fe30
test al, al
je 0x140010f9a
cmp qword [rbp + 0xf], 8
lea rdx, [rbp - 9]
lea rcx, [0x1400468d0]
cmovae rdx, qword [rbp - 9]
call fcn.140008cc0
mov rcx, rax
call fcn.1400104f0
jmp 0x140010fdc
lea rcx, [rbp + 0x17]
call fcn.14000f3b0
cmp qword [rax + 0x18], 8
jb 0x140010fad
mov rax, qword [rax]
cmp qword [rbp + 0xf], 8
lea rdx, [rbp - 9]
mov r9d, 0x10000
cmovae rdx, qword [rbp - 9]
mov r8, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp qword [rbp + 0x2f], 8
jb 0x140010fdc
mov rcx, qword [rbp + 0x17]
call fcn.140017c88
cmp qword [rbp + 0xf], 8
jb 0x140011018
mov rcx, qword [rbp - 9]
call fcn.140017c88
jmp 0x140011018
test byte [0x140048588], 1
je 0x140011018
mov rcx, qword [0x1400486e8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [0x1400486e0]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
test byte [0x1400485d8], 1
je 0x14001103f
lea r8, str.BSD_3_Clause
lea rdx, str.Copyright__c__2019__Solutions_Paralint_inc._nAll_rights_reserved._n_nRedistribution_and_use_in_source_and_binary_forms__with_or_without_modification__are_permitted_provided_that_the_following_conditions_are_met:_n__Redistributions_of_source_code_must_retain_the_above_copyright_notice__this_list_of_conditions_and_the_following_disclaimer._n__Redistributions_in_binary_form_must_reproduce_the_above_copyright_notice__this_list_of_conditions_and_the_following_disclaimer_in_the_documentation_and_or_other_materials_provided_with_the_distribution._n__Neither_the_name_of_the__organization__nor_the_names_of_its_contributors_may_be_used_to_endorse_or_promote_products_derived_from_this_software_without_specific_prior_written_permission._n_nTHIS_SOFTWARE_IS_PROVIDED_BY_THE_COPYRIGHT_HOLDERS_AND_CONTRIBUTORS__AS_IS__AND_ANY_EXPRESS_OR_IMPLIED_WARRANTIES__INCLUDING__BUT_NOT_LIMITED_TO__THE_IMPLIED_WARRANTIES_OF_MERCHANTABILITY_AND_FITNESS_FOR_A_PARTICULAR_PURPOSE_ARE_DISCLAIMED._IN_NO_EVENT_SHALL__COPYRIGHT_HOLDER__BE_LIABLE_FOR_ANY_DIRECT__INDIRECT__INCIDENTAL__SPECIAL__EXEMPLARY__OR_CONSEQUENTIAL_DAMAGES__INCLUDING__BUT_NOT_LIMITED_TO__PROCUREMENT_OF_SUBSTITUTE_GOODS_OR_SERVICES__LOSS_OF_USE__DATA__OR_PROFITS__OR_BUSINESS_INTERRUPTION__HOWEVER_CAUSED_AND_ON_ANY_THEORY_OF_LIABILITY__WHETHER_IN_CONTRACT__STRICT_LIABILITY__OR_TORT__INCLUDING_NEGLIGENCE_OR_OTHERWISE__ARISING_IN_ANY_WAY_OUT_OF_THE_USE_OF_THIS_SOFTWARE__EVEN_IF_ADVISED_OF_THE_POSSIBILITY_OF_SUCH_DAMAGE.
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400112ec
lea rcx, [0x1400480a0]
call fcn.14000ffa0
test al, al
je 0x1400112e7
xor ecx, ecx
mov qword [rsp + 0x110], rsi
call qword [sym.imp.ole32.dll_CoInitialize]
lea rdx, [rbp - 0x69]
lea rcx, [0x1400480a0]
mov qword [rbp - 0x41], 7
mov qword [rbp - 0x49], r14
mov word [rbp - 0x59], r14w
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x39], r14w
call fcn.140003a50
test byte [0x140048538], 1
je 0x1400110bd
mov ecx, 0x18
call fcn.14001867c
test rax, rax
je 0x14001111d
mov edx, dword [rbp - 0x69]
mov rcx, rax
call fcn.1400116d0
mov rdi, rax
jmp 0x140011120
mov ecx, 0x20
call fcn.14001867c
mov rdi, rax
test rax, rax
je 0x14001111d
mov ebx, dword [rbp - 0x69]
mov r8d, 0x51
lea rax, vtable.CQueryContinue.0
lea r9, str.Timeout_value_set_at__d_milliseconds_n
lea rdx, str.QueryContinue.cpp
lea ecx, [r8 - 0x4f]
mov qword [rdi], rax
mov dword [rdi + 8], r14d
mov dword [rdi + 0x10], r14d
mov dword [rsp + 0x20], ebx
call fcn.140011b60
mov dword [rdi + 8], ebx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rdi + 0xc], eax
lea rax, vtable.CQueryContinueOneInstance.0
mov qword [rdi], rax
jmp 0x140011120
mov rdi, r14
mov rdx, qword [0x1400486d8]
mov rcx, qword [0x1400486e0]
lea rax, vtable.CUserNotificationCallback.0
xor r9d, r9d
or r8d, 0xffffffff
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0xff
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
test eax, eax
jne 0x140011168
mov rcx, qword [0x1400486e0]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [0x140048090], 1
lea r8, [rbp - 9]
lea rcx, [rbp - 0x69]
mov rdx, rdi
call fcn.140011330
cmp byte [0x140048090], r14b
mov esi, eax
je 0x14001119e
mov rcx, qword [0x1400486d8]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov byte [0x140048090], r14b
mov rcx, qword [0x1400486d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x1400486e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.USER32.dll_DestroyIcon]
mov ebx, dword [rbp - 1]
cmp ebx, 0xff
jne 0x140011293
cmp esi, 0x80004002
je 0x140011250
cmp esi, 0x80040154
je 0x140011250
cmp esi, 0x800704c7
je 0x140011249
test esi, esi
je 0x140011242
cmp esi, 1
jne 0x140011293
mov rcx, rdi
call fcn.140011830
test al, al
je 0x14001120a
lea ebx, [rsi + 1]
jmp 0x140011293
cmp dword [rdi + 0x10], 0x403e8
jne 0x14001121a
mov ebx, 8
jmp 0x140011293
lea r9, str.Unknown_reason_for_exiting__0x_08X__n
lea rdx, str.notifu.cpp
mov r8d, 0xa3
mov ecx, 3
mov dword [rsp + 0x20], 1
call fcn.140011b60
jmp 0x140011293
mov ebx, 3
jmp 0x140011293
mov ebx, 4
jmp 0x140011293
mov ebx, 5
lea rdx, str.IUserNotification_is_not_supported_on_this_version_of_Windows.
lea rcx, [rbp + 0x17]
lea r8d, [rbx + 0x39]
mov qword [rbp + 0x2f], 7
mov qword [rbp + 0x27], r14
mov word [rbp + 0x17], r14w
call fcn.1400043b0
lea rdx, [rbp + 0x17]
call fcn.14000fef0
cmp qword [rbp + 0x2f], 8
jb 0x140011293
mov rcx, qword [rbp + 0x17]
call fcn.140017c88
mov rsi, qword [rsp + 0x110]
test rdi, rdi
je 0x1400112ae
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax + 0x20]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp qword [rbp - 0x21], 8
jb 0x1400112c4
mov rcx, qword [rbp - 0x39]
call fcn.140017c88
cmp qword [rbp - 0x41], 8
mov qword [rbp - 0x21], 7
mov qword [rbp - 0x29], r14
mov word [rbp - 0x39], r14w
jb 0x1400112ec
mov rcx, qword [rbp - 0x59]
call fcn.140017c88
jmp 0x1400112ec
mov ebx, 1
lea r9, str.Returning__d_n
lea rdx, str.notifu.cpp
mov r8d, 0xb8
mov ecx, 2
mov dword [rsp + 0x20], ebx
call fcn.140011b60
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140017ca0
mov rbx, qword [rsp + 0x118]
add rsp, 0xf0
pop r14
pop rdi
pop rbp
ret