Function at 0x1000118d0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xb0
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x78]
call qword [sym.imp.USER32.dll_GetWindowPlacement]
xor ebx, ebx
cmp eax, ebx
je 0x100011b63
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0xc8]
lea rdx, [0x100006250]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0xc8], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x100011bab
lea edi, [rbx + 0x28]
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8, rdi
call sub.msvcrt.dll_memset
lea edx, [rbx + 2]
lea rcx, [rsp + 0x94]
mov dword [rsp + 0x50], edi
call qword [sym.imp.USER32.dll_MonitorFromRect]
lea edi, [rbx + 4]
cmp rax, rbx
je 0x100011a53
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetMonitorInfoW]
cmp eax, ebx
je 0x100011a0e
mov eax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0xc8]
mov r9d, edi
sub eax, dword [rsp + 0x54]
xor r8d, r8d
mov dword [rsp + 0x28], edi
cdq
xor eax, edx
sub eax, edx
lea rdx, [0x100006d38]
mov dword [rsp + 0xc0], eax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [rsp + 0x58]
sub eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0xc8]
mov r9d, edi
cdq
xor r8d, r8d
mov dword [rsp + 0x28], edi
xor eax, edx
sub eax, edx
lea rdx, [0x100006d58]
mov dword [rsp + 0xc0], eax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100011a53
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r10, qword [0x100025288]
lea rcx, [0x100025288]
cmp r10, rcx
je 0x100011a53
test byte [r10 + 0x1c], dil
je 0x100011a53
mov rcx, qword [r10 + 0x10]
movzx r9d, ax
lea r8, [0x100006330]
or r9d, 0x80070000
cmp eax, ebx
mov edx, 0x11
cmovle r9d, eax
call fcn.100009850
mov eax, dword [rsp + 0x64]
cmp eax, dword [rsp + 0x54]
je 0x100011a63
sub eax, dword [rsp + 0x54]
mov ebx, eax
mov ecx, dword [rsp + 0x94]
lea rax, [rsp + 0xc0]
lea rdx, [0x100006d78]
add ecx, ebx
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0xc0], ecx
mov rcx, qword [rsp + 0xc8]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11d, dword [rsp + 0x98]
mov rcx, qword [rsp + 0xc8]
lea rax, [rsp + 0xc0]
lea rdx, [0x100006da0]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0xc0], r11d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11d, dword [rsp + 0x9c]
mov rcx, qword [rsp + 0xc8]
lea rax, [rsp + 0xc0]
lea rdx, [0x100006dc0]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0xc0], r11d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r11d, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0xc8]
lea rax, [rsp + 0xc0]
lea rdx, [0x100006de8]
mov r9d, edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0xc0], r11d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100011bab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r10, qword [0x100025288]
lea rcx, [0x100025288]
cmp r10, rcx
je 0x100011bab
mov edi, 4
test byte [r10 + 0x1c], dil
je 0x100011bab
mov rcx, qword [r10 + 0x10]
movzx r9d, ax
lea edx, [rdi + 0xe]
or r9d, 0x80070000
cmp eax, ebx
lea r8, [0x100006330]
cmovle r9d, eax
call fcn.100009850
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
ret