Function at 0x14000b5b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140080040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rbx, rcx
mov qword [rbp - 0x11], rcx
xor r15d, r15d
mov dword [rbp - 0x29], r15d
mov qword [rbp - 1], r15
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServicesmssmbiosdata
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
test eax, eax
je 0x14000b64d
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
lea rdx, [0x14006af10]
mov rcx, rbx
call fcn.1400266e0
nop
mov dword [rbp - 0x29], 1
jmp 0x14000b969
mov dword [rbp + 7], r15d
mov dword [rbp - 9], r15d
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp + 7]
lea rdx, str.SMBiosData
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000b6cf
mov eax, dword [rbp - 9]
test eax, eax
je 0x14000b6cf
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r14, rax
mov qword [rbp - 0x21], rax
mov rcx, qword [rbp - 1]
test rax, rax
je 0x14000b6d3
lea rax, [rbp - 9]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 7]
xor r8d, r8d
lea rdx, str.SMBiosData
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000b708
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
xor r8d, r8d
lea rdx, [0x14006af10]
mov rcx, rbx
call fcn.1400266e0
nop
mov dword [rbp - 0x29], 1
jmp 0x14000b969
mov eax, dword [rbp - 9]
mov esi, eax
test eax, eax
je 0x14000b72b
mov rdi, r14
movzx ecx, byte [rdi]
call fcn.140044218
mov byte [rdi], al
lea rdi, [rdi + 1]
sub rsi, 1
jne 0x14000b714
mov eax, dword [rbp - 9]
mov esi, eax
sub rsi, 0xc
mov r13, r14
mov rdi, r14
neg rdi
nop word [rax + rax]
mov r8d, 0xc
lea rdx, str.INNOTEK_GMBH
mov rcx, r13
call fcn.140059400
test eax, eax
je 0x14000b768
inc r13
lea rax, [rdi + r13]
cmp rax, rsi
jbe 0x14000b740
mov r13, r15
mov esi, dword [rbp - 9]
sub rsi, 0xa
mov r12, r14
nop dword [rax]
nop word [rax + rax]
mov r8d, 0xa
lea rdx, str.VIRTUALBOX
mov rcx, r12
call fcn.140059400
test eax, eax
je 0x14000b7a8
inc r12
lea rax, [rdi + r12]
cmp rax, rsi
jbe 0x14000b780
mov r12, r15
mov esi, dword [rbp - 9]
sub rsi, 0x10
mov r15, r14
nop dword [rax]
nop word [rax + rax]
mov r8d, 0x10
lea rdx, str.SUN_MICROSYSTEMS
mov rcx, r15
call fcn.140059400
test eax, eax
je 0x14000b7e8
inc r15
lea rax, [rdi + r15]
cmp rax, rsi
jbe 0x14000b7c0
xor r15d, r15d
mov esi, dword [rbp - 9]
sub rsi, 7
nop
mov r8d, 7
lea rdx, str.VBOXVER
mov rcx, r14
call fcn.140059400
test eax, eax
je 0x14000b818
inc r14
lea rax, [rdi + r14]
cmp rax, rsi
jbe 0x14000b7f0
xor r14d, r14d
mov eax, dword [rbp - 9]
sub rax, 0xf
mov qword [rbp - 0x19], rax
mov rsi, qword [rbp - 0x21]
nop word [rax + rax]
mov r8d, 0xf
lea rdx, str.VIRTUAL_MACHINE
mov rcx, rsi
call fcn.140059400
test eax, eax
je 0x14000b85c
inc rsi
lea rax, [rdi + rsi]
cmp rax, qword [rbp - 0x19]
jbe 0x14000b830
xor edi, edi
mov esi, edi
jmp 0x14000b85e
xor edi, edi
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xf], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1f], xmm1
xor r8d, r8d
lea rdx, [0x14006af10]
lea rcx, [rbp + 0xf]
call fcn.1400266e0
nop
test r13, r13
jne 0x14000b923
test r12, r12
jne 0x14000b923
test r15, r15
jne 0x14000b923
test r14, r14
jne 0x14000b923
test rsi, rsi
jne 0x14000b923
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
xor r8d, r8d
lea rdx, [0x14006af10]
mov rcx, rbx
call fcn.1400266e0
mov dword [rbp - 0x29], 1
mov rdx, qword [rbp + 0x27]
cmp rdx, 0xf
jbe 0x14000b958
inc rdx
mov rcx, qword [rbp + 0xf]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b91c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b99c
call fcn.140038c50
jmp 0x14000b958
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
vmovups ymm0, ymmword [rbp + 0xf]
vmovups ymmword [rbx], ymm0
vmovdqu xmm1, xmmword [0x1400723f0]
vmovdqu xmmword [rbp + 0x1f], xmm1
mov byte [rbp + 0xf], 0
mov dword [rbp - 0x29], 1
vmovdqu xmm0, xmmword [0x1400723f0]
mov byte [rbp + 0xf], 0
vmovdqu xmmword [rbp + 0x1f], xmm0
mov rax, rbx
vzeroupper
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140038c30
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14004538c
int3