Function at 0x1400143c0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
call fcn.140025894
mov rdx, rax
xor esi, esi
mov ecx, esi
test rax, rax
setne cl
test ecx, ecx
jne 0x1400143f2
mov ecx, 0x80004005
call fcn.140007cd0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
lea rdi, str.SOFTWARESiemensShared_ToolsCompSetup
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SOFTWARESiemensShared_ToolsCompSetup
lea rcx, [rsp + 0x70]
call fcn.140009100
mov rdi, qword [rsp + 0x70]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
or eax, ecx
jge 0x140014454
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140009290
mov rdi, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400144c0
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
or eax, ecx
jge 0x14001449b
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140009290
mov rdi, qword [rsp + 0x70]
lea r8, [rsp + 0x68]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400144c0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 1
sub edx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
or eax, edx
jge 0x1400144e0
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.140009290
mov rdi, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014666
call fcn.140025894
mov rcx, rax
test rax, rax
setne sil
test esi, esi
jne 0x140014529
mov ecx, 0x80004005
call fcn.140007cd0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x78], rdi
lea rdx, [0x140063a48]
test rdx, 0xffffffffffff0000
jne 0x14001456e
movzx esi, dx
mov ecx, esi
call fcn.140025880
test rax, rax
je 0x14001458f
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400087e0
mov rdi, qword [rsp + 0x78]
jmp 0x14001458f
xor eax, eax
mov rcx, rbx
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x78]
call fcn.140009100
mov rdi, qword [rsp + 0x78]
mov esi, dword [rdi - 0x10]
mov eax, 1
sub eax, dword [rdi - 8]
or eax, dword [rdi - 0xc]
jge 0x1400145b0
xor edx, edx
lea rcx, [rsp + 0x78]
call fcn.140009290
mov rdi, qword [rsp + 0x78]
lea eax, [rsi + 1]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, str.SetupSucceeded
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rdx, str.MsiReturn
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.Restart
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.ComponentEntry
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.LogFile
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.AppResult
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rdi - 0x18]
mov ecx, ebx
lock xadd dword [rdx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x140014661
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x70]
jmp 0x140014666
mov rdi, qword [rsp + 0x70]
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x14001467f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret