Function at 0x14008c300
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, reloc.mfc110u.dll_Ordinal_1656
sub rsp, 0x750
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rbp + 0x640], rax
mov r15, rcx
xor r13d, r13d
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x60], r13
mov qword [rbp + 0x38], 7
mov qword [rbp + 0x30], r13
mov word [rbp + 0x20], r13w
lea r8d, [r13 + 0x2a]
lea rdx, str.SoftwareSIEMENSLicenseManagementBundles
lea rcx, [rbp + 0x20]
call fcn.140003310
nop
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae rdx, qword [rbp + 0x20]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008c964
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
lea rax, [rbp - 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14008c93a
mov word [rbp + 0x240], r13w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp + 0x242]
call sub.MSVCR110.dll_memset
mov r12d, r13d
cmp dword [rsp + 0x78], r13d
jbe 0x14008c93a
or rdi, 0xffffffffffffffff
mov dword [rbp - 0x78], 0x100
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x78]
lea r8, [rbp + 0x40]
mov edx, r12d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14008c925
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, [rbp + 0x40]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008c925
mov dword [rbp - 0x80], 0x200
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x6c]
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008c4ea
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r13
mov qword [rsp + 0x60], rcx
jmp 0x14008c92a
lea r8, [rbp + 0x240]
mov edx, 0x100
lea rcx, [rbp + 0x440]
call qword [sym.imp.MSVCR110.dll_wcscpy_s]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.Master
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008c91b
cmp dword [rsp + 0x7c], 4
jne 0x14008c91b
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, str.Master
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x70], 0
je 0x14008c4d2
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
lea rax, [rbp - 0x74]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x64]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14008c4d2
mov r14d, r13d
cmp dword [rsp + 0x74], r13d
jbe 0x14008c831
nop dword [rax]
mov eax, dword [rbp - 0x74]
inc eax
mov dword [rbp - 0x7c], eax
mov ecx, eax
add rcx, rcx
call qword [sym.imp.MSVCR110.dll_malloc]
mov rbx, rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
lea rax, [rbp - 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x7c]
mov r8, rbx
mov edx, r14d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14008c63e
test rbx, rbx
je 0x14008c823
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_free]
jmp 0x14008c823
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], r13
mov word [rbp - 0x20], r13w
cmp word [rbx], 0
jne 0x14008c65a
mov r8, r13
jmp 0x14008c66b
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x14008c660
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140003310
nop
mov rcx, rbx
call qword [sym.imp.MSVCR110.dll_free]
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
lea rdx, str.Description
call qword [sym.imp.MSVCR110.dll__wcsicmp]
test eax, eax
je 0x14008c80d
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
lea rdx, str.Family
call qword [sym.imp.MSVCR110.dll__wcsicmp]
test eax, eax
je 0x14008c80d
lea rcx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rcx, qword [rbp - 0x20]
lea rdx, str.Version
call qword [sym.imp.MSVCR110.dll__wcsicmp]
test eax, eax
je 0x14008c80d
mov rax, qword [r15]
mov r8, qword [rax]
mov rdi, qword [rbp - 8]
mov rsi, qword [rbp - 0x20]
cmp r8, rax
je 0x14008c7fd
mov rbx, qword [rbp - 0x10]
nop word [rax + rax]
lea rdx, [r8 + 0x20]
lea r9, [rbp - 0x20]
cmp rdi, 8
cmovae r9, rsi
mov r11, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x14008c72e
mov rdx, qword [rdx]
mov r10, rbx
cmp r11, rbx
cmovb r10, r11
test r10, r10
jmp 0x14008c76c
movzx ecx, word [r9]
cmp word [rdx], cx
jne 0x14008c756
add rdx, 2
add r9, 2
dec r10
jmp 0x14008c76c
mov r10d, 1
cmp word [rdx], cx
mov rdx, 0xffffffffffffffff
cmovb r10d, edx
jmp 0x14008c775
jne 0x14008c740
or rdx, 0xffffffffffffffff
mov r10d, r13d
movsxd rcx, r10d
test r10d, r10d
jne 0x14008c78f
cmp r11, rbx
jae 0x14008c786
mov ecx, edx
jmp 0x14008c78f
mov ecx, r13d
cmp r11, rbx
setne cl
test ecx, ecx
je 0x14008c7e9
cmp byte [r8 + 0x19], 0
jne 0x14008c7de
mov rcx, qword [r8 + 0x10]
cmp byte [rcx + 0x19], 0
jne 0x14008c7be
mov r8, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
jne 0x14008c7de
mov r8, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x14008c7b0
jmp 0x14008c7de
mov rcx, qword [r8 + 8]
cmp byte [rcx + 0x19], 0
jne 0x14008c7db
cmp r8, qword [rcx + 0x10]
jne 0x14008c7db
mov r8, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], 0
je 0x14008c7c8
mov r8, rcx
cmp r8, rax
jne 0x14008c710
jmp 0x14008c7fd
lea rdx, [rbp - 0x40]
mov rcx, r15
call fcn.1400933e0
mov rdi, qword [rbp - 8]
mov rsi, qword [rbp - 0x20]
cmp rdi, 8
jb 0x14008c81f
mov rcx, rsi
call sub.mfc110u.dll_Ordinal_1482
jmp 0x14008c81f
cmp qword [rbp - 8], 8
jb 0x14008c823
mov rcx, qword [rbp - 0x20]
call sub.mfc110u.dll_Ordinal_1482
jmp 0x14008c823
or rdi, 0xffffffffffffffff
inc r14d
cmp r14d, dword [rsp + 0x74]
jb 0x14008c5e0
mov qword [rbp - 8], 7
mov qword [rbp - 0x10], r13
mov word [rbp - 0x20], r13w
cmp word [rbp + 0x40], 0
jne 0x14008c84e
mov r8, r13
jmp 0x14008c860
lea rax, [rbp + 0x40]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x14008c855
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140003310
nop
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], r13
mov word [rbp], r13w
cmp word [rbp + 0x440], 0
jne 0x14008c88e
mov r8, r13
jmp 0x14008c8ab
lea rax, [rbp + 0x440]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14008c8a0
lea rdx, [rbp + 0x440]
lea rcx, [rbp]
call fcn.140003310
nop
movzx eax, byte [0x140122948]
mov byte [rsp + 0x20], al
lea r9, [rbp - 0x20]
xor r8d, r8d
lea rdx, [rbp - 0x38]
mov rcx, r15
call fcn.14008b5d0
nop
cmp qword [rbp + 0x18], 8
jb 0x14008c8eb
mov rcx, qword [rbp]
call sub.mfc110u.dll_Ordinal_1482
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], r13
mov word [rbp], r13w
cmp qword [rbp - 8], 8
jb 0x14008c90c
mov rcx, qword [rbp - 0x20]
call sub.mfc110u.dll_Ordinal_1482
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14008c92a
jmp 0x14008c4d7
mov dword [rsp + 0x70], r13d
jmp 0x14008c4d2
mov rcx, qword [rsp + 0x60]
inc r12d
cmp r12d, dword [rsp + 0x78]
jb 0x14008c431
jmp 0x14008c93f
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14008c94f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], r13
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14008c964
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], r13
cmp qword [rbp + 0x38], 8
jb 0x14008c974
mov rcx, qword [rbp + 0x20]
call sub.mfc110u.dll_Ordinal_1482
xor eax, eax
mov rcx, qword [rbp + 0x640]
xor rcx, rsp
call fcn.1400bb310
lea r11, [rsp + 0x750]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret