Function at 0x140024c70
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x328
lea rbp, [rsp + 0x80]
mov ecx, 0
call sym.time
mov ecx, eax
call sym.srand
lea rax, [rbp + 0x280]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
mov r8d, 0
lea rax, str.SYSTEMCurrentControlSetControlIDConfigDBHardware_Profiles0001
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
sete al
test al, al
je 0x140024e2c
mov dword [rbp + 0x264], 0x100
mov rax, qword [rbp + 0x280]
lea rdx, [rbp + 0x264]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.HwProfileGuid
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0x280]
lea rdx, str.HwProfileGuid
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call rax
lea rax, [rbp + 0x250]
mov rcx, rax
mov rax, qword [sym.imp.ole32.dll_CoCreateGuid]
call rax
movzx eax, word [rbp + 0x256]
movzx ecx, ax
movzx eax, word [rbp + 0x254]
movzx edx, ax
mov r9d, dword [rbp + 0x250]
lea rax, [rbp - 0x40]
lea r8, [rbp + 0x250]
add r8, 8
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r8, str._x__x__x__x
mov edx, 0x28
mov rcx, rax
call sym.snprintf_char__unsigned_long_long__char_const__::_
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.strlen
mov edx, eax
mov rax, qword [rbp + 0x280]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.HwProfileGuid
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov dword [rbp + 0x264], 0x100
mov rax, qword [rbp + 0x280]
lea rdx, [rbp + 0x264]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0xf0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.HwProfileGuid
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0x280]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
jmp 0x140024e57
lea rax, str._EXCEPTION__HardwareGUID_key_not_found.
mov rdx, rax
mov rax, qword [0x1400e1eb0]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, [rbp + 0x278]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
mov r8d, 0
lea rax, str.SOFTWAREMicrosoftCryptography
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
sete al
test al, al
je 0x140024ff1
mov dword [rbp + 0x24c], 0x100
mov rax, qword [rbp + 0x278]
lea rdx, [rbp + 0x24c]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.MachineGuid
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0x278]
lea rdx, str.MachineGuid
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call rax
lea rax, [rbp + 0x230]
mov rcx, rax
mov rax, qword [sym.imp.ole32.dll_CoCreateGuid]
call rax
movzx eax, word [rbp + 0x236]
movzx ecx, ax
movzx eax, word [rbp + 0x234]
movzx edx, ax
mov r9d, dword [rbp + 0x230]
lea rax, [rbp - 0x40]
lea r8, [rbp + 0x230]
add r8, 8
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r8, str._x__x__x__x
mov edx, 0x28
mov rcx, rax
call sym.snprintf_char__unsigned_long_long__char_const__::_
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.strlen
mov edx, eax
mov rax, qword [rbp + 0x278]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.MachineGuid
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov dword [rbp + 0x24c], 0x100
mov rax, qword [rbp + 0x278]
lea rdx, [rbp + 0x24c]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0xf0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.MachineGuid
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0x278]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
jmp 0x14002501c
lea rax, str._EXCEPTION__MachineGUID_key_not_found.
mov rdx, rax
mov rax, qword [0x1400e1eb0]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, [rbp + 0x270]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
mov r8d, 0
lea rax, str.SOFTWAREMicrosoftSQMClient
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
sete al
test al, al
je 0x1400251b6
mov dword [rbp + 0x22c], 0x100
mov rax, qword [rbp + 0x270]
lea rdx, [rbp + 0x22c]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.MachineId
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0x270]
lea rdx, str.MachineId
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
call rax
lea rax, [rbp + 0x210]
mov rcx, rax
mov rax, qword [sym.imp.ole32.dll_CoCreateGuid]
call rax
movzx eax, word [rbp + 0x216]
movzx ecx, ax
movzx eax, word [rbp + 0x214]
movzx edx, ax
mov r9d, dword [rbp + 0x210]
lea rax, [rbp - 0x40]
lea r8, [rbp + 0x210]
add r8, 8
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r8, str._x__x__x__x
mov edx, 0x28
mov rcx, rax
call sym.snprintf_char__unsigned_long_long__char_const__::_
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.strlen
mov edx, eax
mov rax, qword [rbp + 0x270]
mov dword [rsp + 0x28], edx
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.MachineId
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov dword [rbp + 0x22c], 0x100
mov rax, qword [rbp + 0x270]
lea rdx, [rbp + 0x22c]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0xf0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.MachineId
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0x270]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
jmp 0x1400251e1
lea rax, str._EXCEPTION__MachineId_key_not_found.
mov rdx, rax
mov rax, qword [0x1400e1eb0]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, [rbp + 0x268]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
mov r8d, 0
lea rax, str.SYSTEMCurrentControlSetControlSystemInformation
mov rdx, rax
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
sete al
test al, al
je 0x1400253e2
mov edx, 0x1f
mov ecx, 1
call method.HWID.GenerateRandomNumber_int__int_
mov dword [rbp + 0x29c], eax
mov edx, dword [rbp + 0x29c]
lea rax, [rbp + 0x20d]
mov r8d, edx
lea rdx, str._02d
mov rcx, rax
call sym.sprintf_char__char_const__::_
mov edx, 0xc
mov ecx, 1
call method.HWID.GenerateRandomNumber_int__int_
mov dword [rbp + 0x298], eax
mov edx, dword [rbp + 0x298]
lea rax, [rbp + 0x20a]
mov r8d, edx
lea rdx, str._02d
mov rcx, rax
call sym.sprintf_char__char_const__::_
mov edx, 0x7e7
mov ecx, 0x7c6
call method.HWID.GenerateRandomNumber_int__int_
mov dword [rbp + 0x294], eax
mov edx, dword [rbp + 0x294]
lea rax, [rbp + 0x205]
mov r8d, edx
lea rdx, [0x1400db450]
mov rcx, rax
call sym.sprintf_char__char_const__::_
lea rcx, [rbp + 0x20a]
lea rax, [rbp + 0x1fa]
lea rdx, [rbp + 0x205]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x20d]
mov qword [rsp + 0x20], rdx
mov r9, rcx
lea r8, str._s__s__s
mov edx, 0xb
mov rcx, rax
call sym.snprintf_char__unsigned_long_long__char_const__::_
mov dword [rbp + 0x1f4], 0x100
mov rax, qword [rbp + 0x268]
lea rdx, [rbp + 0x1f4]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.BIOSReleaseDate
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
lea rax, [rbp + 0x1fa]
mov rcx, rax
call sym.strlen
mov edx, eax
mov rax, qword [rbp + 0x268]
mov dword [rsp + 0x28], edx
lea rdx, [rbp + 0x1fa]
mov qword [rsp + 0x20], rdx
mov r9d, 1
mov r8d, 0
lea rdx, str.BIOSReleaseDate
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov dword [rbp + 0x1f4], 0x100
mov rax, qword [rbp + 0x268]
lea rdx, [rbp + 0x1f4]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0xf0]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.BIOSReleaseDate
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0x268]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
jmp 0x14002540d
lea rax, str._EXCEPTION__SystemInformation_key_not_found.
mov rdx, rax
mov rax, qword [0x1400e1eb0]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
lea rax, str._SUCCESS__Machine_GUID_Changed_Successfully
mov rdx, rax
mov rax, qword [0x1400e1eb0]
mov rcx, rax
call method.std::basic_ostream_char__std::char_traits_char____std::operator____std.char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
mov rcx, rax
mov rax, qword [method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char____]
mov rdx, rax
call method.std::ostream.operator___std::ostream____std::ostream__
jmp 0x1400254dd
add rsp, 0x328
pop rbx
pop rbp
ret