Function at 0x140019310
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r14
lea rbp, [rax - 0x3d8]
sub rsp, 0x4c0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x140064d98]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov edx, 0x52
lea rcx, [0x14006de90]
call fcn.14000b480
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140007b70
nop
mov r12d, 1
cmp dword [0x14006e78c], 5
jle 0x14001946d
lea edx, [r12 + 0x11]
lea rcx, [0x14006bfd8]
call fcn.14000b480
mov rcx, rax
call fcn.140005d80
mov rbx, rax
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006bf20], rax
test rax, rax
je 0x140019698
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call rax
mov edi, eax
cmp eax, 0x10
jbe 0x14001942a
lea ecx, [rax + 2]
mov esi, ecx
call fcn.140002ff0
mov rbx, rax
test rax, rax
je 0x1400193f9
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.14002d420
jmp 0x1400193fb
xor ebx, ebx
mov rax, qword [0x14006bf20]
mov r9d, edi
mov r8, rbx
xor edx, edx
mov ecx, 0x52534d42
call rax
cmp eax, 0x10
jbe 0x140019422
lea rcx, [rbx + 8]
mov edx, dword [rbx + 4]
call fcn.14000c840
mov rcx, rbx
call fcn.14002ba80
mov rax, qword [0x14006bf20]
mov r9d, edi
xor r8d, r8d
mov edx, 0x324d5054
mov ecx, 0x41435049
call rax
test eax, eax
je 0x140019698
mov edx, 0x53
lea rcx, [0x14006de90]
call fcn.14000b480
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14000b3f0
jmp 0x140019698
call fcn.1400115e0
mov dword [0x14006e718], r12d
xor esi, esi
cmp dword [0x14006e71c], r12d
jne 0x1400195b4
mov ecx, 0x10000
call fcn.140002ff0
mov rbx, rax
test rax, rax
je 0x1400194ac
xor edx, edx
mov r8d, 0x10000
mov rcx, rax
call fcn.14002d420
jmp 0x1400194ae
xor ebx, ebx
mov r9d, r12d
mov r8d, 0x10000
mov rdx, rbx
mov ecx, 0xf0000
call fcn.1400047e0
test eax, eax
je 0x1400195b4
xor r14d, r14d
xor edi, edi
mov rcx, rbx
xor eax, eax
movzx edx, byte [0x140050f78]
mov r8d, dword [str._DMI_]
cmp dword [rcx], r8d
jne 0x1400194ee
cmp byte [rcx + 4], dl
je 0x1400194fe
add rcx, 0x10
add eax, 0x10
cmp eax, 0x10000
jge 0x14001953f
jmp 0x1400194e4
movzx r14d, byte [rcx + 0xb]
shl r14d, 0x18
movzx eax, byte [rcx + 0xa]
shl eax, 0x10
add r14d, eax
movzx eax, byte [rcx + 9]
shl eax, 8
add r14d, eax
movzx eax, byte [rcx + 8]
add r14d, eax
movzx edi, byte [rcx + 7]
shl edi, 8
movzx eax, byte [rcx + 6]
or edi, eax
mov edx, 0xf
call fcn.14000b800
test eax, eax
cmovne esi, r12d
mov rcx, rbx
call fcn.14002ba80
test esi, esi
je 0x1400195b4
lea eax, [rdi + 8]
mov esi, eax
mov ecx, eax
call fcn.140002ff0
mov rbx, rax
test rax, rax
je 0x14001956e
mov r8d, esi
xor edx, edx
mov rcx, rax
call fcn.14002d420
jmp 0x140019570
xor ebx, ebx
mov ecx, r14d
mov r9d, r12d
mov r8d, edi
lea rdx, [rbx + 8]
call fcn.1400047e0
test eax, eax
je 0x1400195a2
mov byte [rbx + 4], dil
shr edi, 8
mov byte [rbx + 5], dil
mov edx, dword [rbx + 4]
lea rcx, [rbx + 8]
call fcn.14000c840
mov edi, r12d
jmp 0x1400195a4
xor edi, edi
mov rcx, rbx
call fcn.14002ba80
test edi, edi
jne 0x140019698
mov qword [rsp + 0x58], 0
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x50]
call fcn.14002d420
lea rax, str.ServicesmssmbiosData
mov qword [rsp + 0x20], rax
lea r9, [0x14006cf9c]
lea r8, [0x1400458a0]
mov rdx, 0xffffffffffffffff
lea rcx, [rbp - 0x50]
call fcn.14000a910
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140019698
mov ecx, 0x10000
call fcn.140002ff0
mov rbx, rax
test rax, rax
je 0x140019644
xor edx, edx
mov r8d, 0x10000
mov rcx, rax
call fcn.14002d420
jmp 0x140019646
xor ebx, ebx
mov dword [rsp + 0x68], 0x10000
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SMBiosData
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140019685
lea rcx, [rbx + 8]
mov edx, dword [rbx + 4]
call fcn.14000c840
mov rcx, rbx
call fcn.14002ba80
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x70]
call fcn.140001e50
nop
mov edx, 0x13
lea rcx, [0x14006bfd8]
call fcn.14000b480
mov rcx, rax
call fcn.140005d80
mov rbx, rax
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006be50], rax
call fcn.14000c310
call fcn.14001bbd0
test eax, eax
jne 0x140019714
xor r9d, r9d
xor r8d, r8d
lea rdx, str.00000000_0000_0000_0000_000000000000
lea rcx, [0x140044950]
call qword [0x14006be50]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
jmp 0x140019717
cmp eax, 2
jne 0x1400198a9
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x50]
call fcn.14002d420
mov dword [rsp + 0x58], 0x100
mov edx, 0x200
lea rcx, [rbp - 0x50]
call fcn.140009b50
mov rbx, qword [0x14006be50]
test rbx, rbx
je 0x140019877
mov edx, 0x4c
lea rcx, [0x14006bf80]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
mov r9d, dword [rsp + 0x58]
lea r8, [rbp - 0x50]
lea rdx, str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
mov rcx, rax
call rbx
test eax, eax
jne 0x140019877
mov qword [rsp + 0x60], 0
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1b0]
call fcn.14002d420
mov edx, 0x5e
lea rcx, [0x14006bf80]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
mov qword [rsp + 0x20], rax
lea r9, [0x14006cf9c]
lea r8, [0x1400458a0]
mov rdx, 0xffffffffffffffff
lea rcx, [rbp + 0x1b0]
call fcn.14000a910
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1b0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140019877
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x58], 8
lea edx, [rax + 0x4a]
lea rcx, [0x14006bf80]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001986c
cmp dword [rsp + 0x68], 1
jne 0x14001986c
mov word [rbp - 0x50], r12w
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x14006de90]
cmp word [rbp - 0x50], 0
je 0x1400198a2
mov edx, 0x4a
call fcn.14000b480
mov rdx, rax
lea r8, [rbp - 0x70]
lea rcx, [rsp + 0x30]
call fcn.140001730
jmp 0x1400198be
mov edx, 0x4b
jmp 0x14001988a
lea r8, [rbp - 0x70]
lea rdx, str.Legacy
lea rcx, [rsp + 0x30]
call fcn.140009d70
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140001e90
lea rcx, [rsp + 0x30]
call fcn.140001e70
lea rcx, [rsp + 0x70]
call fcn.140005da0
mov rdx, rax
mov r8, 0xffffffffffffffff
lea rcx, [0x14006c474]
call fcn.14000add0
nop
lea rcx, [rsp + 0x70]
call fcn.140001e70
nop
lea rcx, [rbp - 0x70]
call fcn.140001e70
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.14002ba20
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret