Function at 0x140056a00
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x14030c918]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r14, rdx
mov qword [rsp + 0x50], rdx
xor esi, esi
mov qword [r11 - 0x78], rsi
mov qword [r11 - 0x68], rsi
mov ebx, 7
mov qword [rsp + 0x48], rbx
mov qword [r11 - 0x60], rbx
mov word [r11 - 0x78], si
mov qword [r11 - 0x98], rsi
mov qword [r11 - 0x80], rbx
mov qword [r11 - 0xb8], rsi
mov qword [r11 - 0xa8], rsi
mov qword [r11 - 0xa0], rbx
mov word [rsp + 0x160], si
mov qword [r11 - 0x88], rsi
mov word [rsp + 0x180], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_bios
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005724d
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BIOSVendor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140057242
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov r15, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVendor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 3
jne 0x140056b91
mov r8d, dword [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
mov r9b, 1
mov edx, esi
lea eax, [r8 - 1]
test eax, eax
jle 0x140056b91
mov rcx, r15
cmp word [rcx], 0
jne 0x140056b7e
movzx eax, word [rcx + 2]
test ax, ax
je 0x140056b7e
mov word [rcx], ax
mov word [rcx + 2], si
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140056b60
test r9b, r9b
je 0x140056b50
mov rbx, r12
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x140056b94
mov r14, qword [rsp + 0x198]
cmp rbx, r14
ja 0x140056bed
lea rdi, [rsp + 0x180]
cmp r14, 8
cmovae rdi, qword [rsp + 0x180]
mov qword [rsp + 0x190], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140217710
mov word [rbx + rdi], si
movabs r13, 0x7ffffffffffffffe
jmp 0x140056d0a
movabs r13, 0x7ffffffffffffffe
cmp rbx, r13
ja 0x14005757d
mov rsi, rbx
or rsi, 7
cmp rsi, r13
ja 0x140056c1d
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x140056c30
mov rsi, r13
movabs rdx, 0x7fffffffffffffff
lea rcx, [rdx + rdx]
jmp 0x140056c5e
lea rax, [r14 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140057583
add rcx, rcx
cmp rcx, 0x1000
jb 0x140056c8a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140057588
mov rcx, rax
call fcn.140075f2c
test rax, rax
je 0x14005758d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140056c9b
test rcx, rcx
je 0x140056c99
call fcn.140075f2c
mov rdi, rax
jmp 0x140056c9b
xor edi, edi
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140217710
xor esi, esi
mov word [rbx + rdi], si
cmp r14, 8
jb 0x140056d02
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056cfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140057592
call fcn.14000410c
mov qword [rsp + 0x180], rdi
movabs rdi, 0x7fffffffffffffff
mov rcx, r15
call fcn.140075f74
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x170], rsi
lea rax, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rax, qword [rsp + 0x160]
mov word [rax], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_bios
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400570d2
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400570c7
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov r15, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 3
jne 0x140056e41
mov r8d, dword [rsp + 0x30]
mov r9b, 1
mov edx, esi
lea eax, [r8 - 1]
test eax, eax
jle 0x140056e41
mov rcx, r15
cmp word [rcx], 0
jne 0x140056e2e
movzx eax, word [rcx + 2]
test ax, ax
je 0x140056e2e
mov word [rcx], ax
mov word [rcx + 2], si
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140056e10
test r9b, r9b
je 0x140056e00
mov rbx, r12
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x140056e44
mov r14, qword [rsp + 0x178]
cmp rbx, r14
ja 0x140056e93
lea rdi, [rsp + 0x160]
cmp r14, 8
cmovae rdi, qword [rsp + 0x160]
mov qword [rsp + 0x170], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140217710
mov word [rdi + rbx], si
jmp 0x140056f9b
cmp rbx, r13
ja 0x140057598
mov rsi, rbx
or rsi, 7
cmp rsi, r13
jbe 0x140056eb1
mov rsi, r13
lea rcx, [rdi + rdi]
jmp 0x140056eef
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x140056ecb
mov rsi, r13
lea rcx, [rdi + rdi]
jmp 0x140056eef
lea rax, [r14 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, rdi
ja 0x14005759d
add rcx, rcx
cmp rcx, 0x1000
jb 0x140056f1b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400575a2
mov rcx, rax
call fcn.140075f2c
test rax, rax
je 0x1400575a7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140056f2c
test rcx, rcx
je 0x140056f2a
call fcn.140075f2c
mov rdi, rax
jmp 0x140056f2c
xor edi, edi
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140217710
xor esi, esi
mov word [rdi + rbx], si
cmp r14, 8
jb 0x140056f93
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140056f8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400575ac
call fcn.14000410c
mov qword [rsp + 0x160], rdi
mov rcx, r15
call fcn.140075f74
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.140018c50
nop
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rdx, qword [rsp + 0x180]
mov r8, qword [rsp + 0x190]
lea rcx, [rsp + 0x70]
call fcn.140016420
lea rdx, [0x1402bba88]
mov rcx, rax
call fcn.140016160
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x170]
mov rcx, rax
call fcn.140016420
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x78]
call fcn.140019820
lea rdx, [rsp + 0x1c0]
cmp qword [rsp + 0x1d8], 8
cmovae rdx, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x50]
lea rcx, [r14 + 0x18]
test rdx, rdx
jne 0x14005705c
mov eax, esi
jmp 0x14005706a
mov rax, r12
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140057060
mov r8d, eax
call fcn.140002aa8
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 8
jb 0x1400570bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400570b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400575b2
call fcn.14000410c
nop
lea rcx, [rsp + 0x60]
call fcn.140018b40
jmp 0x1400570d7
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
movabs rdi, 0x7fffffffffffffff
mov qword [rsp + 0x1b0], rsi
mov word [rsp + 0x1a0], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005737f
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140057374
mov edx, dword [rsp + 0x30]
inc edx
mov eax, 2
mul rdx
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov rsi, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r15d, r15d
cmp dword [rsp + 0x40], 3
jne 0x1400571f3
mov r8d, dword [rsp + 0x30]
nop dword [rax]
mov r9b, 1
mov edx, r15d
lea eax, [r8 - 1]
test eax, eax
jle 0x1400571f3
mov rcx, rsi
cmp word [rcx], r15w
jne 0x1400571e0
movzx eax, word [rcx + 2]
test ax, ax
je 0x1400571e0
mov word [rcx], ax
mov word [rcx + 2], r15w
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x1400571c1
test r9b, r9b
je 0x1400571b0
mov rbx, r12
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1400571f6
cmp rbx, 7
ja 0x140057263
mov qword [rsp + 0x1b0], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x1a0]
call fcn.140217710
mov word [rsp + rbx + 0x1a0], r15w
mov r13, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1a0]
jmp 0x140057312
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, 0xffffffffffffffff
movabs r13, 0x7ffffffffffffffe
jmp 0x1400570dc
cmp rbx, r13
ja 0x1400575b8
mov rax, rbx
or rax, 7
cmp rax, r13
jbe 0x14005727e
lea rcx, [rdi + rdi]
jmp 0x1400572a6
mov r13, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
cmp rcx, rdi
ja 0x1400575bd
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400572d2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400575c2
mov rcx, rax
call fcn.140075f2c
test rax, rax
je 0x1400575c7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400572e4
test rcx, rcx
je 0x1400572e1
call fcn.140075f2c
mov rdi, rax
jmp 0x1400572e4
mov rdi, r15
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x1b8], r13
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140217710
mov word [rdi + rbx], r15w
mov qword [rsp + 0x1a0], rdi
mov rcx, rsi
call fcn.140075f74
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x1a0]
cmp r13, 8
cmovae rdx, rdi
lea rcx, [r14 + 0x28]
test rdx, rdx
jne 0x140057355
xor esi, esi
mov r12d, esi
mov r8d, esi
call fcn.140002aa8
mov rbx, qword [rsp + 0x1b8]
jmp 0x14005737f
inc r12
cmp word [rdx + r12*2], 0
jne 0x140057355
xor esi, esi
mov r8d, r12d
call fcn.140002aa8
mov rbx, qword [rsp + 0x1b8]
jmp 0x14005737f
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSecureBootState
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005742b
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
jne 0x140057425
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x44], 0
seta dl
mov r8b, 1
jmp 0x140057430
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor dl, dl
xor r8b, r8b
mov ecx, 0x48
mov eax, 0x58
mov r9, r14
mov byte [r14 + rcx], r8b
mov byte [r14 + rax], dl
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x14005748d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057488
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400575cd
call fcn.14000410c
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], si
mov rdx, qword [rsp + 0x198]
cmp rdx, 8
jb 0x1400574f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400574ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400575d3
call fcn.14000410c
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 7
mov word [rsp + 0x180], si
cmp rbx, 8
jb 0x14005754e
lea rdx, [rbx*2 + 2]
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140057548
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400575d9
call fcn.14000410c
nop
mov al, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140212f90
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400069a0
nop
call fcn.140006194
call fcn.140006194
call fcn.14021bfcc
call fcn.14021bfcc
int3
call fcn.1400069a0
call fcn.140006194
call fcn.140006194
call fcn.14021bfcc
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.1400069a0
call fcn.140006194
call fcn.140006194
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
nop
call fcn.14021bfcc
int3