Function at 0x14000b650
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov r14, rcx
cmp edx, 0xffffde33
je 0x14000b7ad
cmp edx, 0xffffde44
je 0x14000b686
mov eax, 0x80004001
jmp 0x14000b8e5
xor edi, edi
cmp qword [rcx + 0x5b8], rdi
je 0x14000b7a3
mov eax, 0x2008
cmp word [r8], ax
jne 0x14000b7b4
mov rdx, qword [r8 + 8]
lea rcx, [rbp - 0x20]
call fcn.140037900
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x14000b8fa
mov rax, qword [rax]
call qword [rax + 0x18]
mov rcx, qword [r14 + 0x5b8]
add rax, 0x18
mov qword [rbp + 0x38], rax
mov rax, qword [rcx]
call qword [rax + 0x78]
mov rcx, qword [r14 + 0x5b8]
lea rdx, [rbp + 0x38]
xor r8d, r8d
mov r9, qword [rcx]
test al, al
je 0x14000b6fb
call qword [r9 + 0x80]
jmp 0x14000b6ff
call qword [r9 + 0x48]
mov ebx, eax
test eax, eax
js 0x14000b75d
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp + 0x38]
call fcn.140037e88
mov ebx, eax
test eax, eax
js 0x14000b75d
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14000b739
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x20]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14000b7d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000b7d3
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14000b77e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x20]
mov eax, esi
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14000b79c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
jmp 0x14000b8e5
mov eax, 0x80004005
jmp 0x14000b8e5
cmp word [r8], 0xb
je 0x14000b7be
mov eax, 0x80070057
jmp 0x14000b8e5
xor edi, edi
cmp word [r8 + 8], di
mov esi, edi
setne sil
cmp esi, dword [0x14008d510]
jne 0x14000b7da
xor eax, eax
jmp 0x14000b8e5
mov rdx, qword [rcx + 0x80]
lea r8, str.General
lea rcx, [rbp - 0x18]
xor r9d, r9d
mov rbx, rdi
call fcn.140027a40
cmp qword [rbp - 0x18], rdi
jne 0x14000b808
mov r14d, 0x80004003
jmp 0x14000b8b2
mov rdx, qword [rbp - 0x18]
lea rax, [rbp - 0x10]
mov r9d, 0x2001f
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x10], rdi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
movzx r14d, ax
cmove rbx, qword [rbp - 0x10]
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
test r14d, r14d
js 0x14000b8b2
mov dword [rbp + 0x28], esi
test rbx, rbx
jne 0x14000b85c
mov r14d, 0x8000ffff
jmp 0x14000b8b2
mov r9d, 4
lea rax, [rbp + 0x28]
mov dword [rsp + 0x28], r9d
lea rdx, str.IsPerMonitorAware
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx r14d, ax
mov rcx, rbx
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov eax, dword [0x14008d510]
test r14d, r14d
cmovns eax, esi
mov dword [0x14008d510], eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rdi
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14000b8d4
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
test rbx, rbx
je 0x14000b8e2
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r14d
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400312f0
int3