Function at 0x14003f7ac
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x14008d310]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r14, r9
mov r12, qword [rbp + 0x7f]
mov r15, qword [rbp + 0x77]
xor edi, edi
test rdx, rdx
je 0x14003fc2e
test r9, r9
je 0x14003fc2e
test r15, r15
je 0x14003fc2e
test r12, r12
je 0x14003fc2e
test cl, cl
jne 0x14003f93f
mov byte [r12], dil
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x14003fc77
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x31], rax
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x14003fc69
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x29], rbx
lea rcx, [rbp - 0x31]
call fcn.140003970
mov r8d, 0x700c
mov rdx, r15
lea rcx, [rbp - 0x31]
call fcn.14000c72c
test eax, eax
jne 0x14003f878
lea rdx, [rbx - 0x18]
jmp 0x14003f89f
lea rcx, [rbp - 0x29]
call fcn.140003970
mov r8d, 0x700d
mov rdx, r15
lea rcx, [rbp - 0x29]
call fcn.14000c72c
test eax, eax
jne 0x14003f8e1
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003f8b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003f8d7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x80070490
jmp 0x14003fc33
mov r9d, 0x30
mov r8, qword [rbp - 0x31]
mov rbx, qword [rbp - 0x29]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
lea rdx, [rbx - 0x18]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003f918
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003fc2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003fc2a
lea rcx, [rbp - 1]
call fcn.140002cec
nop
mov rax, qword [rbp - 1]
movzx ebx, word [rax]
sub ebx, 0x31
jne 0x14003f95e
movzx ebx, word [rax + 2]
movzx ecx, di
sub ebx, ecx
lea rdx, [rax - 0x18]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003f97b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
jne 0x14003f989
mov eax, 0x8000ffff
jmp 0x14003fc33
mov byte [r12], dil
mov rdx, r14
call fcn.14003f600
mov r14d, eax
test eax, eax
js 0x14003fbd8
cmp eax, 1
jne 0x14003f9ae
mov byte [r12], al
jmp 0x14003fc2a
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x14003fc77
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x14003fc5b
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x21], rbx
lea rcx, [rbp - 0x39]
call fcn.140003970
mov r8d, 0x700c
mov rdx, r15
lea rcx, [rbp - 0x39]
call fcn.14000c72c
test eax, eax
jne 0x14003fa4f
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003fa26
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003fa44
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14d, 0x80070490
jmp 0x14003fbd8
lea rcx, [rbp - 0x21]
call fcn.140003970
mov r8d, 0x700e
mov rdx, r15
lea rcx, [rbp - 0x21]
call fcn.14000c72c
test eax, eax
jne 0x14003fa78
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
jmp 0x14003fa0f
mov r9d, VarBstrCmp
mov r8, qword [rbp - 0x39]
mov rbx, qword [rbp - 0x21]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x14003fbf0
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
mov qword [rbp - 0x11], rdi
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftVisualStudio17.0
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003fad8
mov r15, qword [rbp - 0x11]
jmp 0x14003faf5
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
mov r15, rdi
test r14d, r14d
js 0x14003fb9e
lea rdx, [rbp - 9]
lea rcx, [rbp + 7]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
test eax, eax
jne 0x14003fb37
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
test r15, r15
je 0x14003fb2c
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14d, r14d
jns 0x14003fbeb
jmp 0x14003fb9e
mov eax, dword [rbp - 5]
mov dword [rbp - 0x15], eax
mov eax, dword [rbp - 9]
mov dword [rbp - 0x19], eax
mov rax, qword [rbp - 0x19]
mov qword [rbp - 0x19], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, SafeArrayDestroy
xor r8d, r8d
lea rdx, str.SetupMessageTimestamp
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14003fbdd
movzx r14d, ax
or r14d, 0x80070000
test eax, eax
cmovle r14d, eax
test r14d, r14d
jns 0x14003fbdd
test r15, r15
je 0x14003fb9e
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003fbb9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x14003fbd8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r14d
jmp 0x14003fc33
test r15, r15
je 0x14003fbeb
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [r12], 1
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14003fc0b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
add ecx, esi
test ecx, ecx
jg 0x14003fc2a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, edi
jmp 0x14003fc33
mov eax, 0x80070057
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140001020
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400312f0
nop
jmp 0x14003fc68
nop
mov ecx, 0x80004005
call fcn.1400312f0
nop
jmp 0x14003fc76
nop
mov ecx, 0x80004005
call fcn.1400312f0
int3