Function at 0x140055480
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x14030a918]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov r14, rdx
mov qword [rsp + 0x50], rdx
xor esi, esi
mov qword [r11 - 0x78], rsi
mov qword [r11 - 0x68], rsi
mov ebx, 7
mov qword [rsp + 0x48], rbx
mov qword [r11 - 0x60], rbx
mov word [r11 - 0x78], si
mov qword [r11 - 0x98], rsi
mov qword [r11 - 0x80], rbx
mov qword [r11 - 0xb8], rsi
mov qword [r11 - 0xa8], rsi
mov qword [r11 - 0xa0], rbx
mov word [rsp + 0x160], si
mov qword [r11 - 0x88], rsi
mov word [rsp + 0x180], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_bios
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055ccd
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BIOSVendor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055cc2
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov r15, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVendor
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 3
jne 0x140055611
mov r8d, dword [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
mov r9b, 1
mov edx, esi
lea eax, [r8 - 1]
test eax, eax
jle 0x140055611
mov rcx, r15
cmp word [rcx], 0
jne 0x1400555fe
movzx eax, word [rcx + 2]
test ax, ax
je 0x1400555fe
mov word [rcx], ax
mov word [rcx + 2], si
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x1400555e0
test r9b, r9b
je 0x1400555d0
mov rbx, r12
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x140055614
mov r14, qword [rsp + 0x198]
cmp rbx, r14
ja 0x14005566d
lea rdi, [rsp + 0x180]
cmp r14, 8
cmovae rdi, qword [rsp + 0x180]
mov qword [rsp + 0x190], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215f40
mov word [rbx + rdi], si
movabs r13, 0x7ffffffffffffffe
jmp 0x14005578a
movabs r13, 0x7ffffffffffffffe
cmp rbx, r13
ja 0x140055ffd
mov rsi, rbx
or rsi, 7
cmp rsi, r13
ja 0x14005569d
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x1400556b0
mov rsi, r13
movabs rdx, 0x7fffffffffffffff
lea rcx, [rdx + rdx]
jmp 0x1400556de
lea rax, [r14 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140056003
add rcx, rcx
cmp rcx, 0x1000
jb 0x14005570a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056008
mov rcx, rax
call fcn.14007475c
test rax, rax
je 0x14005600d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14005571b
test rcx, rcx
je 0x140055719
call fcn.14007475c
mov rdi, rax
jmp 0x14005571b
xor edi, edi
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x198], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215f40
xor esi, esi
mov word [rbx + rdi], si
cmp r14, 8
jb 0x140055782
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005577d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056012
call fcn.14000410c
mov qword [rsp + 0x180], rdi
movabs rdi, 0x7fffffffffffffff
mov rcx, r15
call fcn.1400747a4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x170], rsi
lea rax, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rax, qword [rsp + 0x160]
mov word [rax], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_bios
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055b52
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055b47
mov ecx, dword [rsp + 0x30]
inc ecx
mov eax, 2
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov r15, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.BIOSVersion
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x40], 3
jne 0x1400558c1
mov r8d, dword [rsp + 0x30]
mov r9b, 1
mov edx, esi
lea eax, [r8 - 1]
test eax, eax
jle 0x1400558c1
mov rcx, r15
cmp word [rcx], 0
jne 0x1400558ae
movzx eax, word [rcx + 2]
test ax, ax
je 0x1400558ae
mov word [rcx], ax
mov word [rcx + 2], si
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140055890
test r9b, r9b
je 0x140055880
mov rbx, r12
inc rbx
cmp word [r15 + rbx*2], 0
jne 0x1400558c4
mov r14, qword [rsp + 0x178]
cmp rbx, r14
ja 0x140055913
lea rdi, [rsp + 0x160]
cmp r14, 8
cmovae rdi, qword [rsp + 0x160]
mov qword [rsp + 0x170], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215f40
mov word [rdi + rbx], si
jmp 0x140055a1b
cmp rbx, r13
ja 0x140056018
mov rsi, rbx
or rsi, 7
cmp rsi, r13
jbe 0x140055931
mov rsi, r13
lea rcx, [rdi + rdi]
jmp 0x14005596f
mov rcx, r14
shr rcx, 1
mov rax, r13
sub rax, rcx
cmp r14, rax
jbe 0x14005594b
mov rsi, r13
lea rcx, [rdi + rdi]
jmp 0x14005596f
lea rax, [r14 + rcx]
cmp rsi, rax
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, rdi
ja 0x14005601d
add rcx, rcx
cmp rcx, 0x1000
jb 0x14005599b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056022
mov rcx, rax
call fcn.14007475c
test rax, rax
je 0x140056027
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400559ac
test rcx, rcx
je 0x1400559aa
call fcn.14007475c
mov rdi, rax
jmp 0x1400559ac
xor edi, edi
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x178], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.140215f40
xor esi, esi
mov word [rdi + rbx], si
cmp r14, 8
jb 0x140055a13
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055a0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005602c
call fcn.14000410c
mov qword [rsp + 0x160], rdi
mov rcx, r15
call fcn.1400747a4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call fcn.140018c70
nop
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 8
cmovae rdx, qword [rsp + 0x180]
mov r8, qword [rsp + 0x190]
lea rcx, [rsp + 0x70]
call fcn.140016440
lea rdx, [0x1402b9b08]
mov rcx, rax
call fcn.140016180
lea rdx, [rsp + 0x160]
cmp qword [rsp + 0x178], 8
cmovae rdx, qword [rsp + 0x160]
mov r8, qword [rsp + 0x170]
mov rcx, rax
call fcn.140016440
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x78]
call fcn.140019840
lea rdx, [rsp + 0x1c0]
cmp qword [rsp + 0x1d8], 8
cmovae rdx, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x50]
lea rcx, [r14 + 0x18]
test rdx, rdx
jne 0x140055adc
mov eax, esi
jmp 0x140055aea
mov rax, r12
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140055ae0
mov r8d, eax
call fcn.140002aa8
mov rdx, qword [rsp + 0x1d8]
cmp rdx, 8
jb 0x140055b3b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055b35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056032
call fcn.14000410c
nop
lea rcx, [rsp + 0x60]
call fcn.140018b60
jmp 0x140055b57
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
movabs rdi, 0x7fffffffffffffff
mov qword [rsp + 0x1b0], rsi
mov word [rsp + 0x1a0], si
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055dff
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140055df4
mov edx, dword [rsp + 0x30]
inc edx
mov eax, 2
mul rdx
cmovo rax, r12
mov rcx, rax
call fcn.140003e48
mov rsi, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.SystemBiosDate
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r15d, r15d
cmp dword [rsp + 0x40], 3
jne 0x140055c73
mov r8d, dword [rsp + 0x30]
nop dword [rax]
mov r9b, 1
mov edx, r15d
lea eax, [r8 - 1]
test eax, eax
jle 0x140055c73
mov rcx, rsi
cmp word [rcx], r15w
jne 0x140055c60
movzx eax, word [rcx + 2]
test ax, ax
je 0x140055c60
mov word [rcx], ax
mov word [rcx + 2], r15w
xor r9b, r9b
mov r8d, dword [rsp + 0x30]
inc edx
add rcx, 2
lea eax, [r8 - 1]
cmp edx, eax
jl 0x140055c41
test r9b, r9b
je 0x140055c30
mov rbx, r12
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x140055c76
cmp rbx, 7
ja 0x140055ce3
mov qword [rsp + 0x1b0], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x1a0]
call fcn.140215f40
mov word [rsp + rbx + 0x1a0], r15w
mov r13, qword [rsp + 0x1b8]
mov rdi, qword [rsp + 0x1a0]
jmp 0x140055d92
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, 0xffffffffffffffff
movabs r13, 0x7ffffffffffffffe
jmp 0x140055b5c
cmp rbx, r13
ja 0x140056038
mov rax, rbx
or rax, 7
cmp rax, r13
jbe 0x140055cfe
lea rcx, [rdi + rdi]
jmp 0x140055d26
mov r13, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
cmp rcx, rdi
ja 0x14005603d
add rcx, rcx
cmp rcx, 0x1000
jb 0x140055d52
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140056042
mov rcx, rax
call fcn.14007475c
test rax, rax
je 0x140056047
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140055d64
test rcx, rcx
je 0x140055d61
call fcn.14007475c
mov rdi, rax
jmp 0x140055d64
mov rdi, r15
mov qword [rsp + 0x1b0], rbx
mov qword [rsp + 0x1b8], r13
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140215f40
mov word [rdi + rbx], r15w
mov qword [rsp + 0x1a0], rdi
mov rcx, rsi
call fcn.1400747a4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x1a0]
cmp r13, 8
cmovae rdx, rdi
lea rcx, [r14 + 0x28]
test rdx, rdx
jne 0x140055dd5
xor esi, esi
mov r12d, esi
mov r8d, esi
call fcn.140002aa8
mov rbx, qword [rsp + 0x1b8]
jmp 0x140055dff
inc r12
cmp word [rdx + r12*2], 0
jne 0x140055dd5
xor esi, esi
mov r8d, r12d
call fcn.140002aa8
mov rbx, qword [rsp + 0x1b8]
jmp 0x140055dff
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x44], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSecureBootState
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140055eab
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
jne 0x140055ea5
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UEFISecureBootEnabled
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x44], 0
seta dl
mov r8b, 1
jmp 0x140055eb0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor dl, dl
xor r8b, r8b
mov ecx, 0x48
mov eax, 0x58
mov r9, r14
mov byte [r14 + rcx], r8b
mov byte [r14 + rax], dl
mov rdx, qword [rsp + 0x178]
cmp rdx, 8
jb 0x140055f0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055f08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005604d
call fcn.14000410c
mov qword [rsp + 0x170], rsi
mov qword [rsp + 0x178], 7
mov word [rsp + 0x160], si
mov rdx, qword [rsp + 0x198]
cmp rdx, 8
jb 0x140055f71
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055f6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056053
call fcn.14000410c
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], 7
mov word [rsp + 0x180], si
cmp rbx, 8
jb 0x140055fce
lea rdx, [rbx*2 + 2]
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055fc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140056059
call fcn.14000410c
nop
mov al, 1
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1402117c0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1400069a0
nop
call fcn.140006194
call fcn.140006194
call fcn.14021a7fc
call fcn.14021a7fc
int3
call fcn.1400069a0
call fcn.140006194
call fcn.140006194
call fcn.14021a7fc
call fcn.14021a7fc
nop
call fcn.14021a7fc
nop
call fcn.1400069a0
call fcn.140006194
call fcn.140006194
call fcn.14021a7fc
nop
call fcn.14021a7fc
nop
call fcn.14021a7fc
nop
call fcn.14021a7fc
int3