Function at 0x140011c60
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rsp + 0xf0], rbx
mov r15, rcx
call fcn.140025894
mov rcx, rax
xor eax, eax
test rcx, rcx
setne al
test eax, eax
jne 0x140011cac
mov ecx, 0x80004005
call fcn.140007cd0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.140025894
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140011cda
mov ecx, 0x80004005
call fcn.140007cd0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.140025894
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x140011d0b
mov ecx, 0x80004005
call fcn.140007cd0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [r15 + 0x210]
call fcn.140032fc8
xor eax, eax
or r13, 0xffffffffffffffff
mov rcx, r13
lea rdi, str.SoftwareSiemensShared_Tools
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SoftwareSiemensShared_Tools
lea rcx, [rsp + 0x68]
call fcn.140009100
lea r8, [r15 + 0x190]
lea rdx, [0x14005cc80]
lea rcx, [rsp + 0x98]
call fcn.140007ae0
nop
lea r8, str.Clients
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140007a00
nop
mov rbp, qword [rax]
movsxd r14, dword [rbp - 0x10]
mov rsi, rbp
mov rdi, qword [rsp + 0x68]
sub rsi, rdi
sar rsi, 1
mov r12d, dword [rdi - 0x10]
lea ebx, [r12 + r14]
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x140011dc7
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.140009290
mov rdi, qword [rsp + 0x68]
cmp rsi, r12
ja 0x140011dd0
lea rbp, [rdi + rsi*2]
mov rdx, r14
add rdx, rdx
lea rcx, [rdi + r12*2]
mov r9, rdx
mov r8, rbp
call fcn.14003b8f0
test ebx, ebx
js 0x1400123dd
cmp ebx, dword [rdi - 0xc]
jg 0x1400123dd
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
mov word [rdi + rax*2], 0
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140011e27
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140011e4b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsp + 0x68]
mov ecx, 1
sub ecx, dword [rdx - 8]
mov eax, dword [rdx - 0xc]
or eax, ecx
jge 0x140011e70
xor edx, edx
lea rcx, [rsp + 0x68]
call fcn.140009290
mov rdx, qword [rsp + 0x68]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140012376
xor r14d, r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
lea rax, [rsp + 0x100]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x108]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1400120cc
mov eax, dword [rsp + 0x108]
add eax, 1
mov dword [rsp + 0x108], eax
mov edi, dword [rsp + 0x100]
add edi, 1
mov dword [rsp + 0x100], edi
mov esi, r14d
cmp dword [rsp + 0x78], r14d
jbe 0x1400120c5
mov rbx, qword [rsp + 0x70]
nop
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x88], edi
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140011f5d
mov edx, edi
lea rcx, [rsp + 0x70]
call fcn.140009290
mov rbx, qword [rsp + 0x70]
test edi, edi
js 0x1400120ba
cmp edi, dword [rbx - 0xc]
jg 0x1400120ba
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], r14w
movsxd rdi, dword [rsp + 0x7c]
mov r8, qword [rsp + 0x60]
mov ecx, 1
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, edi
or eax, ecx
jge 0x140011fa7
mov edx, edi
lea rcx, [rsp + 0x60]
call fcn.140009290
mov r8, qword [rsp + 0x60]
test edi, edi
js 0x1400120af
cmp edi, dword [r8 - 0xc]
jg 0x1400120af
mov dword [r8 - 0x10], edi
mov rax, qword [rsp + 0x60]
mov word [rax + rdi*2], r14w
lea rax, [rsp + 0x88]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x7c]
mov edx, esi
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14001206f
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x140012013
mov ecx, r14d
jmp 0x140012029
xor eax, eax
mov rcx, r13
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x1400120a4
cmp ecx, dword [rdx - 0xc]
jg 0x1400120a4
mov dword [rdx - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [rsp + 0x60]
mov word [rax + rcx*2], r14w
lea rdx, [rsp + 0x60]
lea rcx, [r15 + 0x210]
call fcn.1400330e4
lea rcx, [r15 + 0x38]
mov rax, qword [rcx]
mov r9, qword [rsp + 0x60]
lea r8, str.Save_Client:__s
mov edx, 0xa
call qword [rax + 0xd0]
jmp 0x140012088
lea rcx, [r15 + 0x38]
mov rax, qword [rcx]
mov r9d, esi
lea r8, str.Save_Client:_EnumValue__d__failed
xor edx, edx
call qword [rax + 0xd0]
add esi, 1
cmp esi, dword [rsp + 0x78]
jae 0x1400120e7
mov edi, dword [rsp + 0x100]
mov eax, dword [rsp + 0x108]
jmp 0x140011f30
mov ecx, 0x80070057
call fcn.140007cd0
int3
mov ecx, 0x80070057
call fcn.140007cd0
int3
mov ecx, 0x80070057
call fcn.140007cd0
int3
mov rbx, qword [rsp + 0x70]
jmp 0x1400120e7
lea rcx, [r15 + 0x38]
mov rax, qword [rcx]
lea r8, str.Save_Clients:_QueryInfoKey_failed
xor edx, edx
call qword [rax + 0xd0]
mov rbx, qword [rsp + 0x70]
cmp byte [rsp + 0xf8], r14b
je 0x140012366
mov r12, qword [r15 + 0x218]
test r12, r12
je 0x140012366
nop
nop
nop
mov rbp, r12
test r12, r12
je 0x140012360
mov r12, qword [r12]
mov rbp, qword [rbp + 0x10]
lea rbx, [rbp - 0x18]
mov rax, qword [rsp + 0x60]
lea rdi, [rax - 0x18]
cmp rbx, rdi
je 0x1400122d9
cmp dword [rdi + 0x10], 0
jl 0x1400121d4
mov rcx, qword [rbx]
cmp rcx, qword [rdi]
jne 0x1400121d4
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x14001216e
cmp rax, qword [rbx]
jne 0x14001216e
mov rsi, rbx
lock add dword [rbx + 0x10], 1
jmp 0x1400121ab
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx + 8]
call qword [rax]
mov rsi, rax
test rax, rax
je 0x140012332
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 8]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
lea r8, [rbx + 0x18]
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.14003b8f0
mov eax, r13d
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400121c6
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x1400122d9
movsxd rbx, dword [rbp - 0x10]
test ebx, ebx
jne 0x140012243
mov rbx, qword [rdi]
cmp dword [rdi + 8], 0
je 0x1400122d9
cmp dword [rdi + 0x10], 0
jge 0x140012211
cmp dword [rax - 0xc], 0
jl 0x140012338
mov dword [rax - 0x10], r14d
mov rax, qword [rsp + 0x60]
mov word [rax], 0
mov rax, qword [rsp + 0x60]
jmp 0x1400122d9
mov eax, r13d
lock xadd dword [rdi + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14001222c
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
jmp 0x1400122d9
test rbp, rbp
je 0x14001234e
mov r14d, dword [rax - 0x10]
mov rsi, rbp
sub rsi, rax
sar rsi, 1
mov edx, 1
sub edx, dword [rdi + 0x10]
mov ecx, dword [rdi + 0xc]
sub ecx, ebx
or ecx, edx
jge 0x14001227b
mov edx, ebx
lea rcx, [rsp + 0x60]
call fcn.140009290
mov rax, qword [rsp + 0x60]
cmp rsi, r14
ja 0x140012298
lea rdi, [rbx + rbx]
lea r8, [rax + rsi*2]
mov r9, rdi
mov rdx, rdi
mov rcx, rax
call fcn.14003aa90
jmp 0x1400122ad
lea rdi, [rbx + rbx]
mov r9, rdi
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call fcn.14003b8f0
test ebx, ebx
js 0x140012343
mov rax, qword [rsp + 0x60]
cmp ebx, dword [rax - 0xc]
jg 0x140012343
mov dword [rax - 0x10], ebx
mov rax, qword [rsp + 0x60]
mov word [rdi + rax], 0
mov rax, qword [rsp + 0x60]
xor r14d, r14d
mov edx, 1
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
or ecx, edx
jge 0x1400122f9
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140009290
mov rax, qword [rsp + 0x60]
mov rdx, rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rcx, [r15 + 0x38]
mov rax, qword [rcx]
mov r9, qword [rsp + 0x60]
lea r8, str.Delete_Client:__s
mov edx, 0xa
call qword [rax + 0xd0]
test r12, r12
je 0x140012359
jmp 0x140012110
call fcn.140009230
int3
mov ecx, 0x80070057
call fcn.140007cd0
int3
mov ecx, 0x80070057
call fcn.140007cd0
int3
mov ecx, 0x80070057
call fcn.140007cd0
int3
mov rbx, qword [rsp + 0x70]
jmp 0x140012366
call fcn.1400254a0
int3
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001237b
mov rbx, qword [rsp + 0x70]
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140012398
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400123ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
add r13d, 0xffffffff
test r13d, r13d
jg 0x1400123e8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400123e8
mov ecx, 0x80070057
call fcn.140007cd0
nop
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret