Function at 0x140055630
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x14030b918]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r14, rdx
mov qword [rsp + 0x50], rdx
xor esi, esi
mov qword [r11 - 0x78], rsi
mov qword [r11 - 0x68], rsi
mov ebx, 7
mov qword [rsp + 0x48], rbx
mov qword [r11 - 0x60], rbx
mov word [r11 - 0x78], si
mov qword [r11 - 0x98], rsi
mov qword [r11 - 0x80], rbx
mov qword [r11 - 0xb8], rsi
mov qword [r11 - 0xa8], rsi
mov qword [r11 - 0xa0], rbx
mov word [rsp + 0x160], si
mov qword [r11 - 0x88], rsi
mov word [rsp + 0x180], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_bios
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055e7d
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BIOSVendor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055e72
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov r15, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVendor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 3
jne 0x1400557c1
mov r8d, dword [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
mov r9b, 1
mov edx, esi
lea eax, [r8 - 1]
test eax, eax
jle 0x1400557c1
mov rcx, r15
cmp word [rcx], 0
jne 0x1400557ae
movzx eax, word [rcx + 2]
test ax, ax
je 0x1400557ae
mov word [rcx], ax
mov word [rcx + 2], si
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140055790
test r9b, r9b
je 0x140055780
mov rbx, r12
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x1400557c4
mov r14, qword [rsp + 0x198]
cmp rbx, r14
ja 0x14005581d
lea rdi, [rsp + 0x180]
cmp r14, 8
cmovae rdi, qword [rsp + 0x180]
mov qword [rsp + 0x190], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.1402160f0
mov word [rbx + rdi], si
movabs r13, 0x7ffffffffffffffe
jmp 0x14005593a
movabs r13, 0x7ffffffffffffffe
cmp rbx, r13
ja 0x1400561ad
mov rsi, rbx
or rsi, 7
cmp rsi, r13
ja 0x14005584d
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x140055860
mov rsi, r13
movabs rdx, 0x7fffffffffffffff
lea rcx, [rdx + rdx]
jmp 0x14005588e
lea rax, [r14 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400561b3
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400558ba
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400561b8
mov rcx, rax
call fcn.14007490c
test rax, rax
je 0x1400561bd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400558cb
test rcx, rcx
je 0x1400558c9
call fcn.14007490c
mov rdi, rax
jmp 0x1400558cb
xor edi, edi
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.1402160f0
xor esi, esi
mov word [rbx + rdi], si
cmp r14, 8
jb 0x140055932
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005592d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400561c2
call fcn.14000410c
mov qword [rsp + 0x180], rdi
movabs rdi, 0x7fffffffffffffff
mov rcx, r15
call fcn.140074954
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x170], rsi
lea rax, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rax, qword [rsp + 0x160]
mov word [rax], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_bios
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055d02
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055cf7
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov r15, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 3
jne 0x140055a71
mov r8d, dword [rsp + 0x30]
mov r9b, 1
mov edx, esi
lea eax, [r8 - 1]
test eax, eax
jle 0x140055a71
mov rcx, r15
cmp word [rcx], 0
jne 0x140055a5e
movzx eax, word [rcx + 2]
test ax, ax
je 0x140055a5e
mov word [rcx], ax
mov word [rcx + 2], si
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140055a40
test r9b, r9b
je 0x140055a30
mov rbx, r12
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x140055a74
mov r14, qword [rsp + 0x178]
cmp rbx, r14
ja 0x140055ac3
lea rdi, [rsp + 0x160]
cmp r14, 8
cmovae rdi, qword [rsp + 0x160]
mov qword [rsp + 0x170], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.1402160f0
mov word [rdi + rbx], si
jmp 0x140055bcb
cmp rbx, r13
ja 0x1400561c8
mov rsi, rbx
or rsi, 7
cmp rsi, r13
jbe 0x140055ae1
mov rsi, r13
lea rcx, [rdi + rdi]
jmp 0x140055b1f
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x140055afb
mov rsi, r13
lea rcx, [rdi + rdi]
jmp 0x140055b1f
lea rax, [r14 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, rdi
ja 0x1400561cd
add rcx, rcx
cmp rcx, 0x1000
jb 0x140055b4b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400561d2
mov rcx, rax
call fcn.14007490c
test rax, rax
je 0x1400561d7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140055b5c
test rcx, rcx
je 0x140055b5a
call fcn.14007490c
mov rdi, rax
jmp 0x140055b5c
xor edi, edi
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.1402160f0
xor esi, esi
mov word [rdi + rbx], si
cmp r14, 8
jb 0x140055bc3
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055bbe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400561dc
call fcn.14000410c
mov qword [rsp + 0x160], rdi
mov rcx, r15
call fcn.140074954
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.140018c90
nop
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rdx, qword [rsp + 0x180]
mov r8, qword [rsp + 0x190]
lea rcx, [rsp + 0x70]
call fcn.140016460
lea rdx, [0x1402b9af8]
mov rcx, rax
call fcn.1400161a0
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x170]
mov rcx, rax
call fcn.140016460
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x78]
call fcn.140019860
lea rdx, [rsp + 0x1c0]
cmp qword [rsp + 0x1d8], 8
cmovae rdx, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x50]
lea rcx, [r14 + 0x18]
test rdx, rdx
jne 0x140055c8c
mov eax, esi
jmp 0x140055c9a
mov rax, r12
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140055c90
mov r8d, eax
call fcn.140002aa8
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 8
jb 0x140055ceb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055ce5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400561e2
call fcn.14000410c
nop
lea rcx, [rsp + 0x60]
call fcn.140018b80
jmp 0x140055d07
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
movabs rdi, 0x7fffffffffffffff
mov qword [rsp + 0x1b0], rsi
mov word [rsp + 0x1a0], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055faf
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055fa4
mov edx, dword [rsp + 0x30]
inc edx
mov eax, 2
mul rdx
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov rsi, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r15d, r15d
cmp dword [rsp + 0x40], 3
jne 0x140055e23
mov r8d, dword [rsp + 0x30]
nop dword [rax]
mov r9b, 1
mov edx, r15d
lea eax, [r8 - 1]
test eax, eax
jle 0x140055e23
mov rcx, rsi
cmp word [rcx], r15w
jne 0x140055e10
movzx eax, word [rcx + 2]
test ax, ax
je 0x140055e10
mov word [rcx], ax
mov word [rcx + 2], r15w
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140055df1
test r9b, r9b
je 0x140055de0
mov rbx, r12
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140055e26
cmp rbx, 7
ja 0x140055e93
mov qword [rsp + 0x1b0], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x1a0]
call fcn.1402160f0
mov word [rsp + rbx + 0x1a0], r15w
mov r13, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1a0]
jmp 0x140055f42
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, 0xffffffffffffffff
movabs r13, 0x7ffffffffffffffe
jmp 0x140055d0c
cmp rbx, r13
ja 0x1400561e8
mov rax, rbx
or rax, 7
cmp rax, r13
jbe 0x140055eae
lea rcx, [rdi + rdi]
jmp 0x140055ed6
mov r13, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
cmp rcx, rdi
ja 0x1400561ed
add rcx, rcx
cmp rcx, 0x1000
jb 0x140055f02
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400561f2
mov rcx, rax
call fcn.14007490c
test rax, rax
je 0x1400561f7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140055f14
test rcx, rcx
je 0x140055f11
call fcn.14007490c
mov rdi, rax
jmp 0x140055f14
mov rdi, r15
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x1b8], r13
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.1402160f0
mov word [rdi + rbx], r15w
mov qword [rsp + 0x1a0], rdi
mov rcx, rsi
call fcn.140074954
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x1a0]
cmp r13, 8
cmovae rdx, rdi
lea rcx, [r14 + 0x28]
test rdx, rdx
jne 0x140055f85
xor esi, esi
mov r12d, esi
mov r8d, esi
call fcn.140002aa8
mov rbx, qword [rsp + 0x1b8]
jmp 0x140055faf
inc r12
cmp word [rdx + r12*2], 0
jne 0x140055f85
xor esi, esi
mov r8d, r12d
call fcn.140002aa8
mov rbx, qword [rsp + 0x1b8]
jmp 0x140055faf
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSecureBootState
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005605b
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
jne 0x140056055
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x44], 0
seta dl
mov r8b, 1
jmp 0x140056060
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor dl, dl
xor r8b, r8b
mov ecx, 0x48
mov eax, 0x58
mov r9, r14
mov byte [r14 + rcx], r8b
mov byte [r14 + rax], dl
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x1400560bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400560b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400561fd
call fcn.14000410c
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], si
mov rdx, qword [rsp + 0x198]
cmp rdx, 8
jb 0x140056121
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005611c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056203
call fcn.14000410c
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 7
mov word [rsp + 0x180], si
cmp rbx, 8
jb 0x14005617e
lea rdx, [rbx*2 + 2]
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056178
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056209
call fcn.14000410c
nop
mov al, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140211970
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400069a0
nop
call fcn.140006194
call fcn.140006194
call fcn.14021a9ac
call fcn.14021a9ac
int3
call fcn.1400069a0
call fcn.140006194
call fcn.140006194
call fcn.14021a9ac
call fcn.14021a9ac
nop
call fcn.14021a9ac
nop
call fcn.1400069a0
call fcn.140006194
call fcn.140006194
call fcn.14021a9ac
nop
call fcn.14021a9ac
nop
call fcn.14021a9ac
nop
call fcn.14021a9ac
int3