Function at 0x1400554e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x14030a918]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r14, rdx
mov qword [rsp + 0x50], rdx
xor esi, esi
mov qword [r11 - 0x78], rsi
mov qword [r11 - 0x68], rsi
mov ebx, 7
mov qword [rsp + 0x48], rbx
mov qword [r11 - 0x60], rbx
mov word [r11 - 0x78], si
mov qword [r11 - 0x98], rsi
mov qword [r11 - 0x80], rbx
mov qword [r11 - 0xb8], rsi
mov qword [r11 - 0xa8], rsi
mov qword [r11 - 0xa0], rbx
mov word [rsp + 0x160], si
mov qword [r11 - 0x88], rsi
mov word [rsp + 0x180], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_bios
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055d2d
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BIOSVendor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055d22
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov r15, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVendor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 3
jne 0x140055671
mov r8d, dword [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
mov r9b, 1
mov edx, esi
lea eax, [r8 - 1]
test eax, eax
jle 0x140055671
mov rcx, r15
cmp word [rcx], 0
jne 0x14005565e
movzx eax, word [rcx + 2]
test ax, ax
je 0x14005565e
mov word [rcx], ax
mov word [rcx + 2], si
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140055640
test r9b, r9b
je 0x140055630
mov rbx, r12
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x140055674
mov r14, qword [rsp + 0x198]
cmp rbx, r14
ja 0x1400556cd
lea rdi, [rsp + 0x180]
cmp r14, 8
cmovae rdi, qword [rsp + 0x180]
mov qword [rsp + 0x190], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215fa0
mov word [rbx + rdi], si
movabs r13, 0x7ffffffffffffffe
jmp 0x1400557ea
movabs r13, 0x7ffffffffffffffe
cmp rbx, r13
ja 0x14005605d
mov rsi, rbx
or rsi, 7
cmp rsi, r13
ja 0x1400556fd
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x140055710
mov rsi, r13
movabs rdx, 0x7fffffffffffffff
lea rcx, [rdx + rdx]
jmp 0x14005573e
lea rax, [r14 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140056063
add rcx, rcx
cmp rcx, 0x1000
jb 0x14005576a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056068
mov rcx, rax
call fcn.1400747bc
test rax, rax
je 0x14005606d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005577b
test rcx, rcx
je 0x140055779
call fcn.1400747bc
mov rdi, rax
jmp 0x14005577b
xor edi, edi
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215fa0
xor esi, esi
mov word [rbx + rdi], si
cmp r14, 8
jb 0x1400557e2
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400557dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056072
call fcn.14000410c
mov qword [rsp + 0x180], rdi
movabs rdi, 0x7fffffffffffffff
mov rcx, r15
call fcn.140074804
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x170], rsi
lea rax, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rax, qword [rsp + 0x160]
mov word [rax], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_bios
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055bb2
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055ba7
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov r15, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 3
jne 0x140055921
mov r8d, dword [rsp + 0x30]
mov r9b, 1
mov edx, esi
lea eax, [r8 - 1]
test eax, eax
jle 0x140055921
mov rcx, r15
cmp word [rcx], 0
jne 0x14005590e
movzx eax, word [rcx + 2]
test ax, ax
je 0x14005590e
mov word [rcx], ax
mov word [rcx + 2], si
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x1400558f0
test r9b, r9b
je 0x1400558e0
mov rbx, r12
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x140055924
mov r14, qword [rsp + 0x178]
cmp rbx, r14
ja 0x140055973
lea rdi, [rsp + 0x160]
cmp r14, 8
cmovae rdi, qword [rsp + 0x160]
mov qword [rsp + 0x170], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215fa0
mov word [rdi + rbx], si
jmp 0x140055a7b
cmp rbx, r13
ja 0x140056078
mov rsi, rbx
or rsi, 7
cmp rsi, r13
jbe 0x140055991
mov rsi, r13
lea rcx, [rdi + rdi]
jmp 0x1400559cf
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x1400559ab
mov rsi, r13
lea rcx, [rdi + rdi]
jmp 0x1400559cf
lea rax, [r14 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, rdi
ja 0x14005607d
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400559fb
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056082
mov rcx, rax
call fcn.1400747bc
test rax, rax
je 0x140056087
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140055a0c
test rcx, rcx
je 0x140055a0a
call fcn.1400747bc
mov rdi, rax
jmp 0x140055a0c
xor edi, edi
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215fa0
xor esi, esi
mov word [rdi + rbx], si
cmp r14, 8
jb 0x140055a73
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055a6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005608c
call fcn.14000410c
mov qword [rsp + 0x160], rdi
mov rcx, r15
call fcn.140074804
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.140018c90
nop
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rdx, qword [rsp + 0x180]
mov r8, qword [rsp + 0x190]
lea rcx, [rsp + 0x70]
call fcn.140016460
lea rdx, [0x1402b9af8]
mov rcx, rax
call fcn.1400161a0
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x170]
mov rcx, rax
call fcn.140016460
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x78]
call fcn.140019860
lea rdx, [rsp + 0x1c0]
cmp qword [rsp + 0x1d8], 8
cmovae rdx, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x50]
lea rcx, [r14 + 0x18]
test rdx, rdx
jne 0x140055b3c
mov eax, esi
jmp 0x140055b4a
mov rax, r12
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140055b40
mov r8d, eax
call fcn.140002aa8
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 8
jb 0x140055b9b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055b95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056092
call fcn.14000410c
nop
lea rcx, [rsp + 0x60]
call fcn.140018b80
jmp 0x140055bb7
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
movabs rdi, 0x7fffffffffffffff
mov qword [rsp + 0x1b0], rsi
mov word [rsp + 0x1a0], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055e5f
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055e54
mov edx, dword [rsp + 0x30]
inc edx
mov eax, 2
mul rdx
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov rsi, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r15d, r15d
cmp dword [rsp + 0x40], 3
jne 0x140055cd3
mov r8d, dword [rsp + 0x30]
nop dword [rax]
mov r9b, 1
mov edx, r15d
lea eax, [r8 - 1]
test eax, eax
jle 0x140055cd3
mov rcx, rsi
cmp word [rcx], r15w
jne 0x140055cc0
movzx eax, word [rcx + 2]
test ax, ax
je 0x140055cc0
mov word [rcx], ax
mov word [rcx + 2], r15w
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140055ca1
test r9b, r9b
je 0x140055c90
mov rbx, r12
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140055cd6
cmp rbx, 7
ja 0x140055d43
mov qword [rsp + 0x1b0], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x1a0]
call fcn.140215fa0
mov word [rsp + rbx + 0x1a0], r15w
mov r13, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1a0]
jmp 0x140055df2
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, 0xffffffffffffffff
movabs r13, 0x7ffffffffffffffe
jmp 0x140055bbc
cmp rbx, r13
ja 0x140056098
mov rax, rbx
or rax, 7
cmp rax, r13
jbe 0x140055d5e
lea rcx, [rdi + rdi]
jmp 0x140055d86
mov r13, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
cmp rcx, rdi
ja 0x14005609d
add rcx, rcx
cmp rcx, 0x1000
jb 0x140055db2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400560a2
mov rcx, rax
call fcn.1400747bc
test rax, rax
je 0x1400560a7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140055dc4
test rcx, rcx
je 0x140055dc1
call fcn.1400747bc
mov rdi, rax
jmp 0x140055dc4
mov rdi, r15
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x1b8], r13
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140215fa0
mov word [rdi + rbx], r15w
mov qword [rsp + 0x1a0], rdi
mov rcx, rsi
call fcn.140074804
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x1a0]
cmp r13, 8
cmovae rdx, rdi
lea rcx, [r14 + 0x28]
test rdx, rdx
jne 0x140055e35
xor esi, esi
mov r12d, esi
mov r8d, esi
call fcn.140002aa8
mov rbx, qword [rsp + 0x1b8]
jmp 0x140055e5f
inc r12
cmp word [rdx + r12*2], 0
jne 0x140055e35
xor esi, esi
mov r8d, r12d
call fcn.140002aa8
mov rbx, qword [rsp + 0x1b8]
jmp 0x140055e5f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSecureBootState
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055f0b
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
jne 0x140055f05
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x44], 0
seta dl
mov r8b, 1
jmp 0x140055f10
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor dl, dl
xor r8b, r8b
mov ecx, 0x48
mov eax, 0x58
mov r9, r14
mov byte [r14 + rcx], r8b
mov byte [r14 + rax], dl
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x140055f6d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055f68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400560ad
call fcn.14000410c
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], si
mov rdx, qword [rsp + 0x198]
cmp rdx, 8
jb 0x140055fd1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055fcc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400560b3
call fcn.14000410c
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 7
mov word [rsp + 0x180], si
cmp rbx, 8
jb 0x14005602e
lea rdx, [rbx*2 + 2]
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056028
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400560b9
call fcn.14000410c
nop
mov al, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140211820
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400069a0
nop
call fcn.140006194
call fcn.140006194
call fcn.14021a85c
call fcn.14021a85c
int3
call fcn.1400069a0
call fcn.140006194
call fcn.140006194
call fcn.14021a85c
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.1400069a0
call fcn.140006194
call fcn.140006194
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
nop
call fcn.14021a85c
int3