Function at 0x1400184f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rbx, rcx
xor r15d, r15d
mov qword [rbp + 0x58], r15
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosdata
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
test eax, eax
je 0x140018564
mov qword [rbx], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r15b
lea rdx, [0x1400b8351]
mov rcx, rbx
call fcn.140007e60
jmp 0x140018828
mov dword [rbp + 0x50], r15d
mov dword [rbp + 0x48], r15d
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x50]
lea rdx, str.SMBiosData
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400185e6
mov eax, dword [rbp + 0x48]
test eax, eax
je 0x1400185e6
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
mov qword [rbp - 0x30], rax
mov rcx, qword [rbp + 0x58]
test rax, rax
je 0x1400185ea
lea rax, [rbp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x50]
xor r8d, r8d
lea rdx, str.SMBiosData
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140018619
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbx], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r15b
xor r8d, r8d
lea rdx, [0x1400b8351]
mov rcx, rbx
call fcn.140007e60
jmp 0x140018828
mov eax, dword [rbp + 0x48]
mov esi, eax
test eax, eax
je 0x14001863d
mov rdi, r14
movzx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
mov byte [rdi], al
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x140018625
mov eax, dword [rbp + 0x48]
mov esi, eax
sub rsi, 0xc
mov r13, r14
mov rdi, r14
neg rdi
nop dword [rax]
mov r8d, recvfrom
lea rdx, str.INNOTEK_GMBH
mov rcx, r13
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x140018679
inc r13
lea rax, [rdi + r13]
cmp rax, rsi
jbe 0x140018650
mov r13, r15
mov esi, dword [rbp + 0x48]
sub rsi, 0xa
mov r12, r14
nop dword [rax]
nop word [rax + rax]
mov r8d, 0xa
lea rdx, str.VIRTUALBOX
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400186b9
inc r12
lea rax, [r12 + rdi]
cmp rax, rsi
jbe 0x140018690
mov r12, r15
mov esi, dword [rbp + 0x48]
sub rsi, 0x10
mov r15, r14
nop dword [rax]
nop word [rax + rax]
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.SUN_MICROSYSTEMS
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x1400186f9
inc r15
lea rax, [r15 + rdi]
cmp rax, rsi
jbe 0x1400186d0
xor r15d, r15d
mov esi, dword [rbp + 0x48]
sub rsi, 7
mov r8d, 7
lea rdx, str.VBOXVER
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x140018729
inc r14
lea rax, [r14 + rdi]
cmp rax, rsi
jbe 0x140018700
xor r14d, r14d
mov eax, dword [rbp + 0x48]
sub rax, 0xf
mov qword [rbp - 0x28], rax
mov rsi, qword [rbp - 0x30]
nop dword [rax + rax]
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.VIRTUAL_MACHINE
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncmp]
test eax, eax
je 0x14001876d
inc rsi
lea rax, [rsi + rdi]
cmp rax, qword [rbp - 0x28]
jbe 0x140018740
xor edi, edi
mov esi, edi
jmp 0x14001876f
xor edi, edi
mov qword [rbp - 0x20], rdi
movdqa xmm0, xmmword [0x1400ce690]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
xor r8d, r8d
lea rdx, [0x1400b8351]
lea rcx, [rbp - 0x20]
call fcn.140007e60
nop
test r13, r13
jne 0x1400187eb
test r12, r12
jne 0x1400187eb
test r15, r15
jne 0x1400187eb
test r14, r14
jne 0x1400187eb
test rsi, rsi
jne 0x1400187eb
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], sil
xor r8d, r8d
lea rdx, [0x1400b8351]
mov rcx, rbx
call fcn.140007e60
jmp 0x14001881f
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x10]
movups xmmword [rbx + 0x10], xmm1
movdqa xmm0, xmmword [0x1400ce690]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x20]
call fcn.140007de0
mov rax, rbx
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret