Function at 0x140005c00
Capabilities:
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0xaa0]
sub rsp, 0xba0
mov rax, qword [0x1402388b0]
xor rax, rsp
mov qword [rbp + 0xa90], rax
mov rbx, rcx
mov esi, 2
call fcn.14000820c
mov qword [rax + 0x18], rbx
mov r14d, dword [0x1402489b4]
mov rdi, qword [0x1402489c0]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
call fcn.140006cbc
mov rcx, rax
test rax, rax
je 0x140006547
mov rax, qword [rax]
mov qword [rsp + 0xbd0], r12
mov qword [rsp + 0xbd8], r13
mov qword [rsp + 0xbe0], r15
call qword [rax + 0x18]
movzx ecx, word [rsp + 0x6e]
movzx edx, word [rsp + 0x6a]
movzx r10d, word [rsp + 0x74]
movzx r9d, word [rsp + 0x72]
movzx r8d, word [rsp + 0x70]
add rax, 0x18
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x68]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
lea rdx, str._n_t__Logging_started_at:__ld:_ld:_ld_on__ld__ld__ld__n
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], r10d
call fcn.140006620
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140006670
mov r12, qword [rbx - 0x18]
lea rdx, [rbx - 0x18]
xor r13d, r13d
or r15, 0xffffffffffffffff
cmp dword [rdx + 8], r13d
je 0x140005d2b
cmp dword [rdx + 0x10], r13d
jge 0x140005d08
cmp dword [rbx - 0xc], r13d
jl 0x140006552
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x140005d2b
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140005d18
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x20]
call fcn.1400025b0
lea rcx, [rbp + 0x88]
call fcn.140002730
lea rcx, [rbp + 0x130]
call fcn.1400028b0
lea rcx, [rbp + 0x1d8]
call fcn.140002a30
mov byte [rbp + 0x280], r13b
cmp r14d, esi
jge 0x140005d75
lea rcx, str.Invalid_command_line_arguments_count.
call fcn.140006670
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
nop dword [rax]
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140005d80
lea rdx, str._InstallWordAddin
call fcn.1401780b4
test eax, eax
jne 0x140005dcc
cmp r14d, 3
jne 0x140005db4
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x140005db4
movzx r8d, al
jmp 0x140005db7
xor r8b, r8b
lea rcx, [rbp - 0x20]
mov edx, 1
call fcn.140003860
mov esi, eax
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140005dd3
lea rdx, str._UninstallWordAddin
call fcn.1401780b4
test eax, eax
jne 0x140005e1f
cmp r14d, 3
jne 0x140005e07
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x140005e07
movzx r8d, al
jmp 0x140005e0a
xor r8b, r8b
lea rcx, [rbp - 0x20]
mov edx, 1
call fcn.140003ba0
mov esi, eax
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140005e26
lea rdx, str._InstallOutlookAddin
call fcn.1401780b4
test eax, eax
jne 0x1400060b8
cmp r14d, 3
jne 0x140005e5d
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x140005e5d
movzx edi, al
jmp 0x140005e60
xor dil, dil
mov esi, 4
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x58], r13
mov edx, esi
call fcn.140003d60
cmp eax, 1
je 0x1400063f5
lea rdx, [rsp + 0x78]
lea rcx, [rbp + 0x1d8]
call fcn.1400034c0
cmp byte [rbp + 0x280], r13b
mov eax, 0x20006
mov r14d, 0x20206
lea rbx, [rsp + 0x78]
lea rcx, [rbp + 0x292]
cmove r14d, eax
cmp qword [rbp - 0x70], 8
mov r8d, 0x7fe
cmovae rbx, qword [rsp + 0x78]
xor edx, edx
mov word [rbp + 0x290], r13w
call fcn.1401793b0
lea r8, str.Try_to_create_Key:__s
lea rcx, [rbp + 0x290]
mov r9, rbx
mov edx, 0x400
call fcn.140178534
lea rcx, [rbp + 0x290]
call fcn.140006670
test dil, dil
je 0x140005f12
lea rcx, str.In_HKEY_LOCAL_MACHINE
call fcn.140006670
mov rcx, 0xffffffff80000002
jmp 0x140005f25
lea rcx, str.In_HKEY_CURRENT_USER
call fcn.140006670
mov rcx, 0xffffffff80000001
cmp qword [rbp - 0x70], 8
mov qword [rsp + 0x40], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rdx, [rsp + 0x78]
cmovae rdx, qword [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r13d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14000608d
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x1d8]
mov dword [rsp + 0x60], 3
call fcn.140003580
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x1d8]
call fcn.1400035c0
mov eax, dword [rbp - 0x38]
cmp qword [rbp - 0x30], 8
lea ecx, [rax*2 + 2]
mov eax, dword [rbp - 0x58]
lea rdx, str.FriendlyName
lea ebx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x48]
mov r9d, 1
cmovae rax, qword [rbp - 0x48]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000603e
cmp qword [rbp - 0x50], 8
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x68]
cmovae rax, qword [rbp - 0x68]
lea rdx, str.Description
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000603e
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea rdx, str.LoadBehavior
mov r9d, esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14000603e
lea esi, [rax + 5]
jmp 0x14000604f
lea rcx, str.Error_create_values:_FriendlyName_Description_LoadBehavior
mov esi, 3
call fcn.140006670
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp - 0x50], 8
jb 0x14000606a
mov rcx, qword [rbp - 0x68]
call fcn.14000682c
cmp qword [rbp - 0x30], 8
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r13
mov word [rbp - 0x68], r13w
jb 0x14000609e
mov rcx, qword [rbp - 0x48]
call fcn.14000682c
jmp 0x14000609e
lea rcx, str.Error_create_key
mov esi, 3
call fcn.140006670
cmp qword [rbp - 0x70], 8
jb 0x1400063f5
mov rcx, qword [rsp + 0x78]
call fcn.14000682c
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
nop
inc r8
cmp word [rcx + r8*2], r13w
jne 0x1400060c0
lea rdx, str._UninstallOutlookAddin
call fcn.1401780b4
test eax, eax
jne 0x14000610c
cmp r14d, 3
jne 0x1400060f4
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x1400060f4
movzx r8d, al
jmp 0x1400060f7
xor r8b, r8b
lea rcx, [rbp - 0x20]
mov edx, 4
call fcn.140003ba0
mov esi, eax
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140006113
lea rdx, str._InstallExcelAddin
call fcn.1401780b4
test eax, eax
jne 0x14000616c
cmp r14d, 3
jne 0x140006157
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x140006157
lea rcx, [rbp - 0x20]
movzx r8d, al
mov edx, esi
call fcn.140003860
mov esi, eax
jmp 0x1400063f5
lea rcx, [rbp - 0x20]
xor r8b, r8b
mov edx, esi
call fcn.140003860
mov esi, eax
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140006173
lea rdx, str._UninstallExcelAddin
call fcn.1401780b4
test eax, eax
jne 0x1400061cc
cmp r14d, 3
jne 0x1400061b7
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x1400061b7
lea rcx, [rbp - 0x20]
movzx r8d, al
mov edx, esi
call fcn.140003ba0
mov esi, eax
jmp 0x1400063f5
lea rcx, [rbp - 0x20]
xor r8b, r8b
mov edx, esi
call fcn.140003ba0
mov esi, eax
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r13w
jne 0x1400061d3
lea rdx, str._InstallPowerPointAddin
call fcn.1401780b4
test eax, eax
jne 0x14000621f
cmp r14d, 3
jne 0x140006207
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x140006207
movzx r8d, al
jmp 0x14000620a
xor r8b, r8b
lea rcx, [rbp - 0x20]
mov edx, 3
call fcn.140003860
mov esi, eax
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140006226
lea rdx, str._UninstallPowerPointAddin
call fcn.1401780b4
test eax, eax
jne 0x140006272
cmp r14d, 3
jne 0x14000625a
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x14000625a
movzx r8d, al
jmp 0x14000625d
xor r8b, r8b
lea rcx, [rbp - 0x20]
mov edx, 3
call fcn.140003ba0
mov esi, eax
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
nop dword [rax]
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140006280
lea rdx, str._CheckWordAddin
call fcn.1401780b4
test eax, eax
jne 0x1400062cc
cmp r14d, 3
jne 0x1400062b4
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x1400062b4
movzx r8d, al
jmp 0x1400062b7
xor r8b, r8b
lea rcx, [rbp - 0x20]
mov edx, 1
call fcn.140003600
mov esi, eax
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r13w
jne 0x1400062d3
lea rdx, str._CheckExcelAddin
call fcn.1401780b4
test eax, eax
jne 0x14000632c
cmp r14d, 3
jne 0x140006317
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x140006317
lea rcx, [rbp - 0x20]
movzx r8d, al
mov edx, esi
call fcn.140003600
mov esi, eax
jmp 0x1400063f5
lea rcx, [rbp - 0x20]
xor r8b, r8b
mov edx, esi
call fcn.140003600
mov esi, eax
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140006333
lea rdx, str._CheckPowerPointAddin
call fcn.1401780b4
test eax, eax
jne 0x14000637c
cmp r14d, 3
jne 0x140006367
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x140006367
movzx r8d, al
jmp 0x14000636a
xor r8b, r8b
lea rcx, [rbp - 0x20]
mov edx, 3
call fcn.140003600
mov esi, eax
jmp 0x1400063f5
mov rcx, qword [rdi + 8]
mov r8, r15
inc r8
cmp word [rcx + r8*2], r13w
jne 0x140006383
lea rdx, str._CheckOutlookAddin
call fcn.1401780b4
test eax, eax
jne 0x1400063cc
cmp r14d, 3
jne 0x1400063b7
mov rcx, qword [rdi + 0x10]
call fcn.140177650
cmp eax, 1
jne 0x1400063b7
movzx r8d, al
jmp 0x1400063ba
xor r8b, r8b
lea rcx, [rbp - 0x20]
mov edx, 4
call fcn.140003600
mov esi, eax
jmp 0x1400063f5
mov r8, qword [rdi + 8]
lea rdx, str.Unknow_command_line_key:__s
lea rcx, [rsp + 0x50]
call fcn.140006620
mov rcx, qword [rsp + 0x50]
call fcn.140006670
lea rcx, [rsp + 0x50]
call fcn.1400058b0
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x6e]
movzx edx, word [rsp + 0x6a]
movzx eax, word [rsp + 0x68]
movzx r10d, word [rsp + 0x74]
movzx r9d, word [rsp + 0x72]
movzx r8d, word [rsp + 0x70]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
lea rcx, [rsp + 0x50]
lea rdx, str._n_t__Logging_endeded_at:__ld:_ld:_ld_on__ld__ld__ld__n
mov dword [rsp + 0x20], r10d
call fcn.140006620
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140006670
mov rdi, qword [rbx - 0x18]
cmp dword [rbx - 0x10], r13d
lea rdx, [rbx - 0x18]
je 0x14000649a
cmp dword [rdx + 0x10], r13d
jge 0x140006478
cmp dword [rbx - 0xc], r13d
jl 0x14000655d
mov dword [rbx - 0x10], r13d
mov word [rbx], r13w
jmp 0x14000649a
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140006488
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
lea rax, vtable.CConstantsAccessorOutlook.0
lea rcx, [rbp + 0x1d8]
mov qword [rbp + 0x1d8], rax
call fcn.1400024d0
lea rax, vtable.CConstantsAccessorPP.0
lea rcx, [rbp + 0x130]
mov qword [rbp + 0x130], rax
call fcn.1400024d0
lea rax, vtable.CConstantsAccessorExcel.0
lea rcx, [rbp + 0x88]
mov qword [rbp + 0x88], rax
call fcn.1400024d0
lea rax, vtable.CConstantsAccessorWord.0
lea rcx, [rbp - 0x20]
mov qword [rbp - 0x20], rax
call fcn.1400024d0
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140006510
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r13, qword [rsp + 0xbd8]
mov r12, qword [rsp + 0xbd0]
mov r15, qword [rsp + 0xbe0]
mov eax, esi
mov rcx, qword [rbp + 0xa90]
xor rcx, rsp
call fcn.140176ca0
add rsp, 0xba0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140005b90
int3
mov ecx, 0x80070057
call fcn.140005b90
int3
mov ecx, 0x80070057
call fcn.140005b90
int3