Function at 0x140018818
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, rcx
cmp edx, 0xffffde33
je 0x140018975
cmp edx, 0xffffde44
je 0x14001884e
mov eax, 0x80004001
jmp 0x140018aaf
xor edi, edi
cmp qword [rcx + 0x5b8], rdi
je 0x14001896b
mov eax, 0x2008
cmp word [r8], ax
jne 0x14001897c
mov rdx, qword [r8 + 8]
lea rcx, [rbp - 0x20]
call fcn.140015bac
call fcn.140002dfc
mov rcx, rax
test rax, rax
je 0x140018ac4
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x38], rax
mov rcx, qword [r14 + 0x5b8]
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [r14 + 0x5b8]
mov r9, qword [rcx]
xor r8d, r8d
lea rdx, [rbp + 0x38]
test al, al
je 0x1400188c3
call qword [r9 + 0x80]
jmp 0x1400188c7
call qword [r9 + 0x48]
mov ebx, eax
test eax, eax
js 0x140018925
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp + 0x38]
call fcn.140016d70
mov ebx, eax
test eax, eax
js 0x140018925
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140018901
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14001899b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14001899b
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140018946
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140018964
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
jmp 0x140018aaf
mov eax, 0x80004005
jmp 0x140018aaf
cmp word [r8], 0xb
je 0x140018986
mov eax, 0x80070057
jmp 0x140018aaf
xor edi, edi
mov esi, edi
cmp word [r8 + 8], di
setne sil
cmp esi, dword [0x14009192c]
jne 0x1400189a2
xor eax, eax
jmp 0x140018aaf
mov rbx, rdi
xor r9d, r9d
lea r8, [0x140071208]
mov rdx, qword [rcx + 0x80]
lea rcx, [rbp - 0x18]
call fcn.140014f90
cmp qword [rbp - 0x18], rdi
jne 0x1400189d0
mov r14d, 0x80004003
jmp 0x140018a7a
mov qword [rbp - 0x10], rdi
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rbp - 0x18]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
cmove rbx, qword [rbp - 0x10]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
test r14d, r14d
js 0x140018a7a
mov dword [rbp + 0x28], esi
test rbx, rbx
jne 0x140018a24
mov r14d, 0x8000ffff
jmp 0x140018a7a
mov r9d, 4
mov dword [rsp + 0x28], r9d
lea rax, [rbp + 0x28]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.IsPerMonitorAware
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov eax, dword [0x14009192c]
test r14d, r14d
cmovns eax, esi
mov dword [0x14009192c], eax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rdi
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x140018a9d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
test rbx, rbx
je 0x140018aac
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, r14d
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002fa4
int3