Function at 0x14008e180
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa80]
sub rsp, 0xb80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xbd0], rbx
mov rax, qword [0x140121ef0]
xor rax, rsp
mov qword [rbp + 0xa70], rax
mov r14, rdx
mov r15, rcx
mov qword [rbp - 0x58], 7
xor r12d, r12d
mov qword [rbp - 0x60], r12
mov word [rbp - 0x70], r12w
lea rcx, [rbp - 0x70]
test r8b, r8b
je 0x14008e1ee
lea r8d, [r12 + 0x2b]
lea rdx, str.SoftwareSIEMENSLicenseManagementBundles_
jmp 0x14008e1fb
mov r8d, 0x2c
lea rdx, str.SoftwareSIEMENSLicenseManagementLicenses_
call fcn.140003310
lea rcx, [rbp - 0x30]
call fcn.1400ad700
nop
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
mov ecx, 7
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x80], r12
mov word [rsp + 0x70], r12w
mov rax, qword [r14]
mov rbx, qword [rax]
cmp rax, rbx
je 0x14008e950
or r13, 0xffffffffffffffff
nop dword [rax]
lea rcx, [rbp - 0x30]
call fcn.1400ae4b0
lea rsi, [rbx + 0x20]
mov r8, rsi
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x50]
call fcn.14004c8e0
mov rdi, rax
lea rax, [rsp + 0x50]
cmp rax, rdi
je 0x14008e2f0
cmp qword [rsp + 0x68], 8
jb 0x14008e28c
mov rcx, qword [rsp + 0x50]
call sub.mfc110u.dll_Ordinal_1482
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
cmp qword [rdi + 0x18], 8
jae 0x14008e2c3
mov r8, qword [rdi + 0x10]
inc r8
je 0x14008e2ce
add r8, r8
mov rdx, rdi
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCR110.dll_memmove]
jmp 0x14008e2ce
mov rax, qword [rdi]
mov qword [rsp + 0x50], rax
mov qword [rdi], r12
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x60], rax
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x68], rax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r12
mov word [rdi], r12w
cmp qword [rbp - 0x38], 8
jb 0x14008e300
mov rcx, qword [rbp - 0x50]
call sub.mfc110u.dll_Ordinal_1482
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rdx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14008e39b
cmp byte [rbx + 0x19], 0
jne 0x14008e943
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14008e371
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14008e943
nop dword [rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14008e360
jmp 0x14008e943
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14008e393
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x14008e393
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14008e380
mov rbx, rax
jmp 0x14008e943
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Description
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008e44f
cmp dword [rsp + 0x3c], 0x800
jae 0x14008e44f
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], r12
cmp byte [rbx + 0x19], 0
jne 0x14008e943
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14008e421
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14008e943
nop word [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14008e410
jmp 0x14008e943
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14008e393
nop
cmp rbx, qword [rax + 0x10]
jne 0x14008e393
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14008e430
mov rbx, rax
jmp 0x14008e943
cmp dword [rsp + 0x38], 1
jne 0x14008e515
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Description
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008e500
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], r12
cmp byte [rbx + 0x19], 0
jne 0x14008e943
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14008e4d3
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14008e943
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14008e4c2
jmp 0x14008e943
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14008e393
cmp rbx, qword [rax + 0x10]
jne 0x14008e393
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14008e4e1
mov rbx, rax
jmp 0x14008e943
lea r8, [rbp + 0x270]
mov edx, 2
lea rcx, [rbp - 0x30]
call fcn.1400b1030
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Family
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008e5bf
cmp dword [rsp + 0x3c], 0x800
jae 0x14008e5bf
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], r12
cmp byte [rbx + 0x19], 0
jne 0x14008e943
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14008e591
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14008e943
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14008e580
jmp 0x14008e943
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14008e393
nop
cmp rbx, qword [rax + 0x10]
jne 0x14008e393
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14008e5a0
mov rbx, rax
jmp 0x14008e943
cmp dword [rsp + 0x38], 1
jne 0x14008e685
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Family
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008e670
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], r12
cmp byte [rbx + 0x19], 0
jne 0x14008e943
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14008e643
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14008e943
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14008e632
jmp 0x14008e943
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14008e393
cmp rbx, qword [rax + 0x10]
jne 0x14008e393
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14008e651
mov rbx, rax
jmp 0x14008e943
lea r8, [rbp + 0x270]
mov edx, 3
lea rcx, [rbp - 0x30]
call fcn.1400b1030
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008e72f
cmp dword [rsp + 0x3c], 0x800
jae 0x14008e72f
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], r12
cmp byte [rbx + 0x19], 0
jne 0x14008e943
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14008e701
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14008e943
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14008e6f0
jmp 0x14008e943
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14008e393
nop
cmp rbx, qword [rax + 0x10]
jne 0x14008e393
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14008e710
mov rbx, rax
jmp 0x14008e943
cmp dword [rsp + 0x38], 1
jne 0x14008e81c
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14008e7e0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], r12
cmp byte [rbx + 0x19], 0
jne 0x14008e943
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x14008e7b3
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x14008e943
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14008e7a2
jmp 0x14008e943
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14008e393
cmp rbx, qword [rax + 0x10]
jne 0x14008e393
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14008e7c1
mov rbx, rax
jmp 0x14008e943
cmp word [rbp + 0x270], 0
jne 0x14008e7ef
mov r8, r12
jmp 0x14008e80b
lea rax, [rbp + 0x270]
mov r8, r13
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14008e800
lea rdx, [rbp + 0x270]
lea rcx, [rsp + 0x70]
call fcn.140003310
lea rcx, [rsi + 0x20]
mov r9, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 8
jb 0x14008e82e
mov rcx, qword [rcx]
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov r8, r9
mov r10, qword [rbp - 0x80]
cmp r10, r9
cmovb r8, r10
test r8, r8
jmp 0x14008e875
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x14008e866
add rdx, 2
add rcx, 2
dec r8
jmp 0x14008e875
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r13d
jmp 0x14008e87a
jne 0x14008e851
mov r8d, r12d
movsxd rax, r8d
test r8d, r8d
jne 0x14008e88d
cmp r10, r9
jb 0x14008e891
mov eax, r12d
setne al
test eax, eax
je 0x14008e8af
lea r8, [rbx + 0x40]
cmp qword [r8 + 0x18], 8
jb 0x14008e89f
mov r8, qword [r8]
lea rdx, str.EDITION
lea rcx, [rbp - 0x30]
call fcn.1400b0e20
cmp qword [rsi + 0x18], 8
jb 0x14008e8b9
mov rsi, qword [rsi]
mov r8, rsi
mov edx, 6
lea rcx, [rbp - 0x30]
call fcn.1400b1030
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
lea rcx, [rbp + 0x260]
call fcn.140089c10
lea r8, [rbp + 0x260]
mov edx, 4
lea rcx, [rbp - 0x30]
call fcn.1400b1030
mov edx, 0xa
lea r8d, [rdx + 6]
lea rcx, [rbp - 0x30]
call fcn.1400b0f60
lea rdx, [r15 + 0x400]
xor r8d, r8d
lea rcx, [rbp - 0x30]
call fcn.1400ae750
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x30], r12
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.1400933e0
mov rbx, qword [rax]
cmp qword [r14], rbx
jne 0x14008e250
mov rcx, qword [rbp - 0x78]
cmp rcx, 8
jb 0x14008e960
mov rcx, qword [rsp + 0x70]
call sub.mfc110u.dll_Ordinal_1482
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], r12
mov word [rsp + 0x70], r12w
cmp qword [rsp + 0x68], 8
jb 0x14008e984
mov rcx, qword [rsp + 0x50]
call sub.mfc110u.dll_Ordinal_1482
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r12
mov word [rsp + 0x50], r12w
lea rcx, [rbp - 0x30]
call fcn.1400ad920
nop
cmp qword [rbp - 0x58], 8
jb 0x14008e9b2
mov rcx, qword [rbp - 0x70]
call sub.mfc110u.dll_Ordinal_1482
xor eax, eax
mov rcx, qword [rbp + 0xa70]
xor rcx, rsp
call fcn.1400bb310
mov rbx, qword [rsp + 0xbd0]
add rsp, 0xb80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret