Function at 0x140008840
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x88
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x68], rax
movsx ebx, dl
movzx esi, r8b
movzx ebp, r9b
mov rdx, rcx
xor r14d, r14d
lea rcx, str.Windows11Bypass_for___s___C:_Check:_u_NRO:_u
mov r9d, esi
mov r8d, ebx
mov dword [rsp + 0x60], 1
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x20], ebp
call fcn.140005180
movzx edx, bl
call fcn.1400086f0
test eax, eax
je 0x140008b92
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x78], r15
lea r15, str.SUCCESS
lea rdi, str.FAILED
test sil, sil
je 0x140008a7f
lea rax, [rsp + 0x64]
lea rdx, str.SystemSetup
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
test eax, eax
je 0x140008952
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, ebx
lea rcx, str.Failed_to_create_reg_key_SystemSetup__u__u
mov edx, eax
call fcn.140005180
mov eax, 1
mov rdi, qword [rsp + 0x80]
mov r15, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000d130
add rsp, 0x88
pop r14
pop rsi
pop rbp
pop rbx
ret
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x64]
lea rdx, str.LabConfig
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
test eax, eax
je 0x1400089ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, ebx
lea rcx, str.Failed_to_create_LabConfig_reg___u__u
mov edx, eax
jmp 0x140008921
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
lea rdx, str.BypassRAMCheck
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
lea rax, [rsp + 0x60]
lea rdx, str.BypassTPMCheck
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
add ebx, eax
lea rax, [rsp + 0x60]
lea rdx, str.BypassSecureBootCheck
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
add ebx, eax
lea rax, [rsp + 0x60]
lea rdx, str.BypassCPUCheck
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rdx, rdi
add ebx, eax
lea rcx, str.Create_bypass_check_registry__s__u
cmove rdx, r15
mov r8d, ebx
call fcn.140005180
test bpl, bpl
je 0x140008b8a
lea rax, [rsp + 0x64]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
test eax, eax
je 0x140008ae5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, ebx
lea rcx, str.Failed_to_create_reg_key_SOFTWAREMicrosoftWindowsCurrentVersionOOBE__u__u
mov edx, eax
jmp 0x140008921
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x64]
lea rdx, str.OOBE
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
xor r8d, r8d
mov dword [rsp + 0x28], 7
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, eax
test eax, eax
je 0x140008b40
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, ebx
lea rcx, str.Failed_to_create_OOBE_reg___u__u
mov edx, eax
jmp 0x140008921
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
lea rdx, str.BypassNRO
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, str.Create_BypassNRO_registry__s__u
test eax, eax
mov r8d, eax
cmove rdi, r15
mov rdx, rdi
call fcn.140005180
call fcn.140004e40
mov eax, r14d
jmp 0x14000892b
mov eax, 1
jmp 0x140008938