Function at 0x14000dab0
Capabilities:
Connect to wmi namespace via wbemlocator
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
xor edx, edx
mov r8d, 0x800
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x14000db2d
lea rdx, str.wine_get_version
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
test rax, rax
je 0x14000db27
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r9, 0xffffffffffffffff
lea r8, str.Wine_Adapter
mov edx, 0x1ff
mov rcx, rbx
call fcn.14003c5c8
mov al, 1
jmp 0x14000de36
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [rbp + 0x38], 0x3fe
xor eax, eax
mov dword [rbx], eax
xor r15d, r15d
mov qword [rbp - 0x18], r15
mov dword [rbp + 0x40], r15d
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000dbad
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x40]
xor r8d, r8d
lea rdx, str.VideoAdapters
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14000dbad
cmp word [rbx], r15w
jne 0x14000db20
mov rdi, rbx
xor eax, eax
mov ecx, 0x100
rep stosd dword [rdi], eax
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdi, 0xffffffffffffffff
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x14000dc03
cmp eax, 0x80010119
jne 0x14000dd5e
mov qword [rbp - 0x20], r15
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [0x140150ed0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140150ee0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000dd5e
mov rax, qword [rbp - 0x20]
test rax, rax
je 0x14000dd5e
mov qword [rbp + 0x48], r15
mov rax, qword [rax]
mov r14, qword [rax + 0x18]
mov ecx, 0x18
call fcn.14002eee8
mov rsi, rax
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14000dc86
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.ROOTCIMV2
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14000de55
jmp 0x14000dc89
mov rsi, r15
mov qword [rbp - 0x10], rsi
test rsi, rsi
je 0x14000de4a
lea rax, [rbp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, qword [rbp - 0x20]
call r14
mov r14d, eax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
cmp ecx, 1
jne 0x14000dd02
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000dce3
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r15
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14000dcf5
call fcn.14002ec58
mov qword [rsi + 8], r15
mov edx, 0x18
mov rcx, rsi
call fcn.14002ec58
test r14d, r14d
js 0x14000dd54
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14000dd54
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xa]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x14000dd4a
mov rdx, qword [rbp + 0x48]
mov rcx, rbx
call fcn.14000d510
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x14000dd61
test rax, rax
je 0x14000dd89
lea rcx, [rbx + rax*2]
cmp word [rcx - 2], 0x7c
jne 0x14000dd89
sub rax, 1
lea rcx, [rbx + rax*2]
mov word [rcx], r15w
jne 0x14000dd74
lea rdx, [0x1401c1418]
mov rcx, rbx
call fcn.140030c6c
test rax, rax
je 0x14000ddc0
nop dword [rax]
mov word [rax], 0x2c
lea rdx, [0x1401c1418]
mov rcx, rbx
call fcn.140030c6c
test rax, rax
jne 0x14000dda0
nop dword [rax]
lea rdi, [rdi + 1]
cmp word [rbx + rdi*2], 0
jne 0x14000ddc0
lea edi, [rdi*2 + 2]
test edi, edi
je 0x14000de2f
mov qword [rbp + 0x40], r15
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20106
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000de2f
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rbx
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.VideoAdapters
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rbx], 0
setne al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140025800
nop
mov ecx, 0x8007000e
call fcn.140025800
int3