Function at 0x140055080
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x140309918]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r14, rdx
mov qword [rsp + 0x50], rdx
xor esi, esi
mov qword [r11 - 0x78], rsi
mov qword [r11 - 0x68], rsi
mov ebx, 7
mov qword [rsp + 0x48], rbx
mov qword [r11 - 0x60], rbx
mov word [r11 - 0x78], si
mov qword [r11 - 0x98], rsi
mov qword [r11 - 0x80], rbx
mov qword [r11 - 0xb8], rsi
mov qword [r11 - 0xa8], rsi
mov qword [r11 - 0xa0], rbx
mov word [rsp + 0x160], si
mov qword [r11 - 0x88], rsi
mov word [rsp + 0x180], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_bios
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400558cd
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BIOSVendor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400558c2
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov r15, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVendor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 3
jne 0x140055211
mov r8d, dword [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
mov r9b, 1
mov edx, esi
lea eax, [r8 - 1]
test eax, eax
jle 0x140055211
mov rcx, r15
cmp word [rcx], 0
jne 0x1400551fe
movzx eax, word [rcx + 2]
test ax, ax
je 0x1400551fe
mov word [rcx], ax
mov word [rcx + 2], si
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x1400551e0
test r9b, r9b
je 0x1400551d0
mov rbx, r12
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x140055214
mov r14, qword [rsp + 0x198]
cmp rbx, r14
ja 0x14005526d
lea rdi, [rsp + 0x180]
cmp r14, 8
cmovae rdi, qword [rsp + 0x180]
mov qword [rsp + 0x190], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215b40
mov word [rbx + rdi], si
movabs r13, 0x7ffffffffffffffe
jmp 0x14005538a
movabs r13, 0x7ffffffffffffffe
cmp rbx, r13
ja 0x140055bfd
mov rsi, rbx
or rsi, 7
cmp rsi, r13
ja 0x14005529d
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x1400552b0
mov rsi, r13
movabs rdx, 0x7fffffffffffffff
lea rcx, [rdx + rdx]
jmp 0x1400552de
lea rax, [r14 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140055c03
add rcx, rcx
cmp rcx, 0x1000
jb 0x14005530a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140055c08
mov rcx, rax
call fcn.14007435c
test rax, rax
je 0x140055c0d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005531b
test rcx, rcx
je 0x140055319
call fcn.14007435c
mov rdi, rax
jmp 0x14005531b
xor edi, edi
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215b40
xor esi, esi
mov word [rbx + rdi], si
cmp r14, 8
jb 0x140055382
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005537d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055c12
call fcn.14000410c
mov qword [rsp + 0x180], rdi
movabs rdi, 0x7fffffffffffffff
mov rcx, r15
call fcn.1400743a4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x170], rsi
lea rax, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rax, qword [rsp + 0x160]
mov word [rax], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_bios
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055752
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055747
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov r15, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 3
jne 0x1400554c1
mov r8d, dword [rsp + 0x30]
mov r9b, 1
mov edx, esi
lea eax, [r8 - 1]
test eax, eax
jle 0x1400554c1
mov rcx, r15
cmp word [rcx], 0
jne 0x1400554ae
movzx eax, word [rcx + 2]
test ax, ax
je 0x1400554ae
mov word [rcx], ax
mov word [rcx + 2], si
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140055490
test r9b, r9b
je 0x140055480
mov rbx, r12
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x1400554c4
mov r14, qword [rsp + 0x178]
cmp rbx, r14
ja 0x140055513
lea rdi, [rsp + 0x160]
cmp r14, 8
cmovae rdi, qword [rsp + 0x160]
mov qword [rsp + 0x170], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215b40
mov word [rdi + rbx], si
jmp 0x14005561b
cmp rbx, r13
ja 0x140055c18
mov rsi, rbx
or rsi, 7
cmp rsi, r13
jbe 0x140055531
mov rsi, r13
lea rcx, [rdi + rdi]
jmp 0x14005556f
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x14005554b
mov rsi, r13
lea rcx, [rdi + rdi]
jmp 0x14005556f
lea rax, [r14 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, rdi
ja 0x140055c1d
add rcx, rcx
cmp rcx, 0x1000
jb 0x14005559b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140055c22
mov rcx, rax
call fcn.14007435c
test rax, rax
je 0x140055c27
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400555ac
test rcx, rcx
je 0x1400555aa
call fcn.14007435c
mov rdi, rax
jmp 0x1400555ac
xor edi, edi
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215b40
xor esi, esi
mov word [rdi + rbx], si
cmp r14, 8
jb 0x140055613
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005560e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055c2c
call fcn.14000410c
mov qword [rsp + 0x160], rdi
mov rcx, r15
call fcn.1400743a4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.140018c70
nop
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rdx, qword [rsp + 0x180]
mov r8, qword [rsp + 0x190]
lea rcx, [rsp + 0x70]
call fcn.140016440
lea rdx, [0x1402b8b08]
mov rcx, rax
call fcn.140016180
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x170]
mov rcx, rax
call fcn.140016440
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x78]
call fcn.140019840
lea rdx, [rsp + 0x1c0]
cmp qword [rsp + 0x1d8], 8
cmovae rdx, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x50]
lea rcx, [r14 + 0x18]
test rdx, rdx
jne 0x1400556dc
mov eax, esi
jmp 0x1400556ea
mov rax, r12
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400556e0
mov r8d, eax
call fcn.140002aa8
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 8
jb 0x14005573b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055735
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055c32
call fcn.14000410c
nop
lea rcx, [rsp + 0x60]
call fcn.140018b60
jmp 0x140055757
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
movabs rdi, 0x7fffffffffffffff
mov qword [rsp + 0x1b0], rsi
mov word [rsp + 0x1a0], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400559ff
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400559f4
mov edx, dword [rsp + 0x30]
inc edx
mov eax, 2
mul rdx
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov rsi, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r15d, r15d
cmp dword [rsp + 0x40], 3
jne 0x140055873
mov r8d, dword [rsp + 0x30]
nop dword [rax]
mov r9b, 1
mov edx, r15d
lea eax, [r8 - 1]
test eax, eax
jle 0x140055873
mov rcx, rsi
cmp word [rcx], r15w
jne 0x140055860
movzx eax, word [rcx + 2]
test ax, ax
je 0x140055860
mov word [rcx], ax
mov word [rcx + 2], r15w
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140055841
test r9b, r9b
je 0x140055830
mov rbx, r12
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140055876
cmp rbx, 7
ja 0x1400558e3
mov qword [rsp + 0x1b0], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x1a0]
call fcn.140215b40
mov word [rsp + rbx + 0x1a0], r15w
mov r13, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1a0]
jmp 0x140055992
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, 0xffffffffffffffff
movabs r13, 0x7ffffffffffffffe
jmp 0x14005575c
cmp rbx, r13
ja 0x140055c38
mov rax, rbx
or rax, 7
cmp rax, r13
jbe 0x1400558fe
lea rcx, [rdi + rdi]
jmp 0x140055926
mov r13, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
cmp rcx, rdi
ja 0x140055c3d
add rcx, rcx
cmp rcx, 0x1000
jb 0x140055952
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140055c42
mov rcx, rax
call fcn.14007435c
test rax, rax
je 0x140055c47
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140055964
test rcx, rcx
je 0x140055961
call fcn.14007435c
mov rdi, rax
jmp 0x140055964
mov rdi, r15
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x1b8], r13
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140215b40
mov word [rdi + rbx], r15w
mov qword [rsp + 0x1a0], rdi
mov rcx, rsi
call fcn.1400743a4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x1a0]
cmp r13, 8
cmovae rdx, rdi
lea rcx, [r14 + 0x28]
test rdx, rdx
jne 0x1400559d5
xor esi, esi
mov r12d, esi
mov r8d, esi
call fcn.140002aa8
mov rbx, qword [rsp + 0x1b8]
jmp 0x1400559ff
inc r12
cmp word [rdx + r12*2], 0
jne 0x1400559d5
xor esi, esi
mov r8d, r12d
call fcn.140002aa8
mov rbx, qword [rsp + 0x1b8]
jmp 0x1400559ff
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSecureBootState
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055aab
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
jne 0x140055aa5
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x44], 0
seta dl
mov r8b, 1
jmp 0x140055ab0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor dl, dl
xor r8b, r8b
mov ecx, 0x48
mov eax, 0x58
mov r9, r14
mov byte [r14 + rcx], r8b
mov byte [r14 + rax], dl
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x140055b0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055b08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055c4d
call fcn.14000410c
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], si
mov rdx, qword [rsp + 0x198]
cmp rdx, 8
jb 0x140055b71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055b6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055c53
call fcn.14000410c
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 7
mov word [rsp + 0x180], si
cmp rbx, 8
jb 0x140055bce
lea rdx, [rbx*2 + 2]
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055bc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055c59
call fcn.14000410c
nop
mov al, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1402113c0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400069a0
nop
call fcn.140006194
call fcn.140006194
call fcn.14021a3fc
call fcn.14021a3fc
int3
call fcn.1400069a0
call fcn.140006194
call fcn.140006194
call fcn.14021a3fc
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.1400069a0
call fcn.140006194
call fcn.140006194
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
nop
call fcn.14021a3fc
int3