Function at 0x140014bd0
Capabilities:
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rsi, rcx
call fcn.140025894
mov rcx, rax
xor edx, edx
test rax, rax
setne dl
test edx, edx
jne 0x140014c13
mov ecx, 0x80004005
call fcn.140007cd0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0xc0], rdi
lea rbp, [rsi + 0x98]
lea rdx, str.__INTERNAL_CLIENT
mov rcx, qword [rbp]
call fcn.14003ad30
test eax, eax
jne 0x140014c64
lea rdx, [rdi - 0x18]
or rbx, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x140014c5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140014e86
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
lea rdi, str.SoftwareSiemensShared_Tools
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SoftwareSiemensShared_Tools
lea rcx, [rsp + 0xc0]
call fcn.140009100
lea r8, [rsi + 0x190]
lea rdx, [0x14005cc80]
lea rcx, [rsp + 0x58]
call fcn.140007ae0
nop
lea r8, str.Clients
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140007a00
nop
mov r13, qword [rax]
movsxd r15, dword [r13 - 0x10]
mov r12, r13
mov rdi, qword [rsp + 0xc0]
sub r12, rdi
sar r12, 1
mov r14d, dword [rdi - 0x10]
lea esi, [r14 + r15]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, esi
or eax, ecx
jge 0x140014d08
mov edx, esi
lea rcx, [rsp + 0xc0]
call fcn.140009290
mov rdi, qword [rsp + 0xc0]
cmp r12, r14
ja 0x140014d11
lea r13, [rdi + r12*2]
mov rdx, r15
add rdx, rdx
lea rcx, [rdi + r14*2]
mov r9, rdx
mov r8, r13
call fcn.14003b8f0
test esi, esi
js 0x140014e7b
cmp esi, dword [rdi - 0xc]
jg 0x140014e7b
mov dword [rdi - 0x10], esi
movsxd rax, esi
mov word [rdi + rax*2], 0
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140014d64
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140014d84
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0xc0]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
or eax, ecx
jge 0x140014db2
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.140009290
mov rdi, qword [rsp + 0xc0]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ecx
lea r9, [0x14005cb94]
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140014e5c
mov word [rsp + 0xb8], ax
mov rax, qword [rbp]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
or eax, ecx
jge 0x140014e1a
xor edx, edx
mov rcx, rbp
call fcn.140009290
mov dword [rsp + 0x28], 2
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140014e5e
mov esi, ebx
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], ebx
add ebx, 0xffffffff
test ebx, ebx
jg 0x140014e77
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
jmp 0x140014e86
mov ecx, 0x80070057
call fcn.140007cd0
nop
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret