Function at 0x1400616f0
Capabilities:
Get system firmware table
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
cmp byte [reloc.WS2_32.dll_accept], 0
lea rdi, [0x1401076e8]
je 0x140061b75
xor r15d, r15d
mov dword [rsp + 0x50], 0x30
lea r9, [0x1400aeb78]
mov qword [rsp + 0x58], r15
lea r8, str.SOFTWARE_s
mov edx, 0x100
lea rcx, [rbp - 0x60]
xor r12b, r12b
call fcn.140030660
lea r13, str.volatile
mov edx, 0x100
lea r9, [rbp - 0x60]
mov qword [rsp + 0x20], r13
lea r8, str._s_s
lea rcx, [rbp + 0xa0]
call fcn.140030660
lea rax, [rsp + 0x60]
mov r9d, 0x20219
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xa0]
mov rcx, 0xffffffff80000002
call fcn.1400286d0
test eax, eax
jne 0x140061815
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x80]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.UUIDHost
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140061815
mov eax, dword [rsp + 0x50]
dec eax
mov byte [reloc.WS2_32.dll_accept], r15b
cmp eax, 0x30
jae 0x140061ba8
mov byte [rax + rdi], r15b
jmp 0x140061b75
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
mov r14, r15
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov ebx, eax
mov rsi, 0xffffffffffffffff
test eax, eax
je 0x14006195c
mov ecx, ebx
call fcn.140020af0
mov r9d, ebx
mov r8, rax
xor edx, edx
mov ecx, 0x52534d42
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
test eax, eax
je 0x14006194c
cmp eax, ebx
ja 0x14006194c
mov ecx, dword [r13 + 4]
lea rdi, [r13 + 8]
add rdi, rcx
lea rbx, [r13 + 8]
mov r15d, esi
cmp rbx, rdi
jae 0x1400618ef
mov eax, r15d
dec r15d
test eax, eax
je 0x1400618ec
cmp byte [rbx], 1
jne 0x1400618c8
cmp byte [rbx + 1], 0x18
jb 0x1400618c8
lea rax, [rdi - 0x18]
cmp rbx, rax
ja 0x1400618c8
movzx edx, byte [rbx + 8]
lea rcx, [rbx + 8]
mov eax, 1
nop dword [rax + rax]
cmp byte [rcx + rax], dl
jne 0x1400618c0
inc rax
cmp rax, 0x10
jl 0x1400618b0
jmp 0x1400618c8
call fcn.1400615e0
mov r14, rax
movzx eax, byte [rbx + 1]
add rbx, 2
add rbx, rax
cmp rbx, rdi
jae 0x1400618ef
cmp byte [rbx - 2], 0
jne 0x1400618e4
cmp byte [rbx - 1], 0
je 0x140061880
inc rbx
cmp rbx, rdi
jb 0x1400618d8
cmp rbx, rdi
je 0x140061900
test r14, r14
jne 0x140061923
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140061905
test r14, r14
jne 0x140061923
cmp byte [0x140107678], 0
jne 0x140061942
lea rcx, str.UUID:_SMBIOS_UUID_could_not_be_located._n
mov byte [0x140107678], 1
call fcn.14001bf60
jmp 0x140061942
cmp byte [0x140107679], 0
jne 0x140061942
mov rdx, r14
mov byte [0x140107679], 1
lea rcx, str.UUID:_SMBIOS_UUID_is_reported_as__s._n
call fcn.14001bf60
lea rdi, [0x1401076e8]
xor r15d, r15d
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r13, str.volatile
mov qword [rsp + 0x58], r14
test r14, r14
jne 0x140061a4a
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
xor r8d, r8d
lea rdx, [rsp + 0x58]
xor ecx, ecx
mov ebx, eax
call fcn.140061cf0
test ebx, ebx
js 0x14006198d
call qword [sym.imp.ole32.dll_CoUninitialize]
mov r14, qword [rsp + 0x58]
mov r12b, 1
test r14, r14
jne 0x140061a4a
lea rcx, str.UUID:_Failed_to_obtain_host_UUID_n
call fcn.14001bf60
cmp byte [reloc.WS2_32.dll_accept], r14b
lea rdi, [0x140107680]
je 0x140061b75
lea rax, [rsp + 0x70]
mov dword [rsp + 0x6c], 1
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x68], 0x2f
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140061a05
lea rdi, [0x14007c3c5]
jmp 0x140061b75
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x6c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, str.MachineGuid
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400619f9
mov byte [reloc.WS2_32.dll_accept], bl
jmp 0x140061b75
mov rdx, r14
lea rcx, [rbp - 0x78]
call fcn.1400614a0
test al, al
je 0x140061a87
lea rcx, [rbp - 0x78]
call fcn.1400615e0
mov rbx, rax
test rax, rax
je 0x140061a87
mov r8d, 0x30
mov rdx, rax
mov rcx, rdi
call fcn.140030740
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140061a9a
mov rdx, qword [rsp + 0x58]
mov r8d, 0x30
mov rcx, rdi
call fcn.140030740
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov byte [reloc.WS2_32.dll_accept], 0
test r12b, r12b
je 0x140061b75
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x78]
mov qword [rsp + 0x38], rax
lea rdx, [rbp - 0x60]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], 0x20206
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r15d
call fcn.140028600
test eax, eax
jne 0x140061b75
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], r15
mov rdx, r13
mov dword [rsp + 0x28], 0x20206
mov dword [rsp + 0x20], 1
call fcn.140028600
test eax, eax
jne 0x140061b6a
nop
inc rsi
cmp byte [rdi + rsi], 0
jne 0x140061b30
mov rcx, qword [rsp + 0x60]
lea rdx, str.UUIDHost
inc esi
mov r9d, 1
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14006a480
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14006a624
int3