Function at 0x140013450
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0xb0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, r9
mov r12, r8
mov rbx, rdx
mov r13, rcx
call fcn.140025894
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x1400134ac
mov ecx, 0x80004005
call fcn.140007cd0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x60], rdi
call fcn.140025894
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x1400134da
mov ecx, 0x80004005
call fcn.140007cd0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa0], rax
mov dword [rbx], 0
mov byte [rsi], 0
mov rdx, qword [r13 + 0x250]
lea rcx, [rdx - 0x18]
lea rsi, [rdi - 0x18]
or rbx, 0xffffffffffffffff
cmp rcx, rsi
je 0x14001355d
cmp dword [rsi + 0x10], 0
jl 0x14001354a
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x14001354a
call fcn.140009350
mov rdi, rax
mov ecx, ebx
lock xadd dword [rsi + 0x10], ecx
add ecx, ebx
test ecx, ecx
jg 0x14001353f
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 0x18
mov qword [rsp + 0x60], rdi
jmp 0x14001355d
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140009100
mov rdi, qword [rsp + 0x60]
mov rdx, qword [r13 + 0xb8]
lea rcx, [rsp + 0x80]
call fcn.140005d30
nop
mov r8, rax
lea rdx, [0x14005cc80]
lea rcx, [rsp + 0xa8]
call fcn.140007ae0
nop
mov r15, qword [rax]
mov edx, dword [r15 - 0x10]
mov dword [rsp + 0x6c], edx
mov r14, r15
sub r14, rdi
sar r14, 1
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x68], eax
lea ebp, [rax + rdx]
mov esi, 1
mov ecx, esi
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebp
or eax, ecx
jge 0x1400135d0
mov edx, ebp
lea rcx, [rsp + 0x60]
call fcn.140009290
mov rdi, qword [rsp + 0x60]
mov edx, dword [rsp + 0x6c]
mov eax, dword [rsp + 0x68]
cmp r14, rax
ja 0x1400135dd
lea r15, [rdi + r14*2]
movsxd rdx, edx
add rdx, rdx
lea rcx, [rdi + rax*2]
mov r9, rdx
mov r8, r15
call fcn.14003b8f0
test ebp, ebp
js 0x140013a60
cmp ebp, dword [rdi - 0xc]
jg 0x140013a60
mov dword [rdi - 0x10], ebp
movsxd rax, ebp
mov word [rdi + rax*2], 0
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140013633
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140013656
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x60]
mov ecx, esi
sub ecx, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
or eax, ecx
jge 0x140013678
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140009290
mov rdx, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, qword [r13 + 0x248]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400136cd
mov rax, qword [rsp + 0x120]
mov byte [rax], 1
lea rcx, [r13 + 0x38]
mov rax, qword [rcx]
lea r8, str._MSI_component_detected__MSI_Productkey_found_
mov edx, 8
call qword [rax + 0xd0]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400136d8
mov rax, qword [rsp + 0x120]
mov byte [rax], 0
xor eax, eax
mov rcx, rbx
lea rdi, str.SoftwareSiemensShared_Tools
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SoftwareSiemensShared_Tools
lea rcx, [rsp + 0x60]
call fcn.140009100
lea r8, [r13 + 0x190]
lea rdx, [0x14005cc80]
lea rcx, [rsp + 0x90]
call fcn.140007ae0
nop
lea r8, str.Clients
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140007a00
nop
mov r15, qword [rax]
mov edx, dword [r15 - 0x10]
mov dword [rsp + 0x68], edx
mov r14, r15
mov rdi, qword [rsp + 0x60]
sub r14, rdi
sar r14, 1
mov eax, dword [rdi - 0x10]
mov dword [rsp + 0x6c], eax
lea ebp, [rax + rdx]
mov ecx, esi
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebp
or eax, ecx
jge 0x140013779
mov edx, ebp
lea rcx, [rsp + 0x60]
call fcn.140009290
mov rdi, qword [rsp + 0x60]
mov edx, dword [rsp + 0x68]
mov eax, dword [rsp + 0x6c]
cmp r14, rax
ja 0x140013786
lea r15, [rdi + r14*2]
movsxd rdx, edx
add rdx, rdx
lea rcx, [rdi + rax*2]
mov r9, rdx
mov r8, r15
call fcn.14003b8f0
test ebp, ebp
js 0x140013a55
cmp ebp, dword [rdi - 0xc]
jg 0x140013a55
mov dword [rdi - 0x10], ebp
movsxd rax, ebp
mov word [rdi + rax*2], 0
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400137dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400137ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x60]
mov ecx, esi
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
or eax, ecx
jge 0x140013821
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140009290
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140013946
xor r15d, r15d
mov dword [rsp + 0x78], r15d
mov rax, qword [r12]
mov ecx, esi
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ecx
jge 0x14001386e
xor edx, edx
mov rcx, r12
call fcn.140009290
lea rbp, [r13 + 0x38]
mov rax, qword [rbp]
mov r9, qword [r12]
lea r8, str._Searching_for____s__
mov edx, 8
mov rcx, rbp
call qword [rax + 0xd0]
mov r11, qword [r12]
mov ecx, esi
sub ecx, dword [r11 - 8]
mov eax, dword [r11 - 0xc]
or eax, ecx
jge 0x1400138ab
xor edx, edx
mov rcx, r12
call fcn.140009290
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x98]
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400138e6
mov r14, qword [rsp + 0x118]
mov byte [r14], 1
jmp 0x1400138ee
mov r14, qword [rsp + 0x118]
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov r13, qword [rsp + 0x108]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140013939
mov dword [r13], r15d
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140013993
mov ecx, esi
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
or eax, ecx
jge 0x140013963
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140009290
mov rdi, qword [rsp + 0x60]
lea rbp, [r13 + 0x38]
mov rax, qword [rbp]
mov r9, rdi
lea r8, str.No_Clients_found_under:__s__
mov edx, 0xa
mov rcx, rbp
call qword [rax + 0xd0]
mov r13, qword [rsp + 0x108]
mov r14, qword [rsp + 0x118]
sub esi, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
or eax, esi
jge 0x1400139ae
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140009290
mov rdi, qword [rsp + 0x60]
mov r10, qword [rbp]
lea rcx, [0x1400604b8]
lea rax, [0x14005fbe4]
cmp byte [r14], 0
cmovne rax, rcx
mov qword [rsp + 0x28], rax
mov eax, dword [r13]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, str.__s_clients:_count_d__I_am_in_Clients_s
mov edx, 8
mov rcx, rbp
call qword [r10 + 0xd0]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140013a13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140013a34
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x140013a51
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140013a6b
mov ecx, 0x80070057
call fcn.140007cd0
nop
mov ecx, 0x80070057
call fcn.140007cd0
nop
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret