Function at 0x14000bb50
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xd0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140069040]
xor rax, rsp
mov qword [rbp + 7], rax
mov rbx, rcx
mov qword [rbp - 0x39], rcx
xor r12d, r12d
mov qword [rbp - 0x29], r12
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosData
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r8d, r8d
test eax, eax
je 0x14000bbe6
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
lea rdx, [0x14005dcff]
mov rcx, rbx
call fcn.140041830
jmp 0x14000c162
mov dword [rbp - 1], r12d
mov dword [rbp - 0x2d], r12d
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 1]
lea rdx, str.SMBiosData
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000bc68
mov eax, dword [rbp - 0x2d]
test eax, eax
je 0x14000bc68
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r13, rax
mov qword [rbp - 0x41], rax
mov rcx, qword [rbp - 0x29]
test rax, rax
je 0x14000bc6c
lea rax, [rbp - 0x2d]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 1]
xor r8d, r8d
lea rdx, str.SMBiosData
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14000bc97
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
xor r8d, r8d
lea rdx, [0x14005dcff]
mov rcx, rbx
call fcn.140041830
jmp 0x14000c162
mov eax, dword [rbp - 0x2d]
mov esi, eax
test eax, eax
je 0x14000bcbb
mov rdi, r13
movzx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rdi], al
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x14000bca3
mov eax, dword [rbp - 0x2d]
mov r14d, eax
sub r14, 0xc
mov rsi, r13
mov rdi, r13
neg rdi
nop dword [rax + rax]
mov r8d, 0xc
lea rdx, str.INNOTEK_GMBH
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000bcf9
inc rsi
lea rax, [rsi + rdi]
cmp rax, r14
jbe 0x14000bcd0
mov rsi, r12
mov r15d, dword [rbp - 0x2d]
sub r15, 0xa
mov r14, r13
nop dword [rax]
nop dword [rax + rax]
mov r8d, 0xa
lea rdx, str.VIRTUALBOX
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000bd39
inc r14
lea rax, [rdi + r14]
cmp rax, r15
jbe 0x14000bd10
mov r14, r12
mov r12d, dword [rbp - 0x2d]
sub r12, 0x10
mov r15, r13
nop dword [rax]
nop dword [rax + rax]
mov r8d, 0x10
lea rdx, str.SUN_MICROSYSTEMS
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000bd79
inc r15
lea rax, [rdi + r15]
cmp rax, r12
jbe 0x14000bd50
xor r15d, r15d
mov r12d, dword [rbp - 0x2d]
sub r12, 7
nop dword [rax]
nop word [rax + rax]
mov r8d, 7
lea rdx, str.VBOXVER
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000bdb9
inc r13
lea rax, [rdi + r13]
cmp rax, r12
jbe 0x14000bd90
xor r13d, r13d
mov eax, dword [rbp - 0x2d]
sub rax, 0xf
mov qword [rbp - 0x39], rax
mov r12, qword [rbp - 0x41]
nop dword [rax + rax]
mov r8d, 0xf
lea rdx, str.VIRTUAL_MACHINE
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14000bdfa
inc r12
lea rax, [rdi + r12]
cmp rax, qword [rbp - 0x39]
jbe 0x14000bdd0
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
xor r8d, r8d
lea rdx, [0x14005dcff]
lea rcx, [rbp - 0x21]
call fcn.140041830
nop
xor dil, dil
test rsi, rsi
jne 0x14000be47
test r14, r14
jne 0x14000be47
test r15, r15
jne 0x14000be47
test r13, r13
jne 0x14000be47
test r12, r12
jne 0x14000be47
movdqu xmm6, xmmword [rbp - 0x11]
movups xmm7, xmmword [rbp - 0x21]
jmp 0x14000c0df
mov byte [rbp - 0x69], 1
mov rdi, 0xffffffffffffffff
test rsi, rsi
je 0x14000bed4
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x14000be70
mov rdx, rsi
lea rcx, [rbp - 0x61]
call fcn.140041830
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14000bec1
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bebc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c0b1
call fcn.1400594f0
movups xmm7, xmmword [rbp - 0x61]
movups xmmword [rbp - 0x21], xmm7
movups xmm6, xmmword [rbp - 0x51]
movdqu xmmword [rbp - 0x11], xmm6
jmp 0x14000bedd
movdqu xmm6, xmmword [rbp - 0x11]
movups xmm7, xmmword [rbp - 0x21]
test r14, r14
je 0x14000bf56
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
mov r8, rdi
inc r8
cmp byte [r14 + r8], 0
jne 0x14000bef4
mov rdx, r14
lea rcx, [rbp - 0x61]
call fcn.140041830
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14000bf45
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bf40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c0b1
call fcn.1400594f0
movups xmm7, xmmword [rbp - 0x61]
movups xmmword [rbp - 0x21], xmm7
movups xmm6, xmmword [rbp - 0x51]
movdqu xmmword [rbp - 0x11], xmm6
test r15, r15
je 0x14000bfd2
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [r15 + r8], 0
jne 0x14000bf70
mov rdx, r15
lea rcx, [rbp - 0x61]
call fcn.140041830
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14000bfc1
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bfbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c0b1
call fcn.1400594f0
movups xmm7, xmmword [rbp - 0x61]
movups xmmword [rbp - 0x21], xmm7
movups xmm6, xmmword [rbp - 0x51]
movdqu xmmword [rbp - 0x11], xmm6
test r13, r13
je 0x14000c04e
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [r8 + r13], 0
jne 0x14000bff0
mov rdx, r13
lea rcx, [rbp - 0x61]
call fcn.140041830
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14000c03d
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c038
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c0b1
call fcn.1400594f0
movups xmm7, xmmword [rbp - 0x61]
movups xmmword [rbp - 0x21], xmm7
movups xmm6, xmmword [rbp - 0x51]
movdqu xmmword [rbp - 0x11], xmm6
test r12, r12
je 0x14000c0db
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x51], xmm1
inc rdi
cmp byte [r12 + rdi], 0
jne 0x14000c066
mov r8, rdi
mov rdx, r12
lea rcx, [rbp - 0x61]
call fcn.140041830
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14000c0bd
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c0b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c0b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400594f0
movups xmm7, xmmword [rbp - 0x61]
movups xmm6, xmmword [rbp - 0x51]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c0f8
movzx edi, byte [rbp - 0x69]
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
je 0x14000c101
movups xmmword [rbx], xmm7
movups xmmword [rbx + 0x10], xmm6
jmp 0x14000c162
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
xor r8d, r8d
lea rdx, [0x14005dcff]
mov rcx, rbx
call fcn.140041830
nop
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x14000c162
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c15d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c15d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400594f0
mov rax, rbx
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1400594d0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret