Function at 0x180046f14
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x81d8]
mov eax, 0x82b0
call fcn.180080c00
sub rsp, rax
mov rax, qword [0x180123100]
xor rax, rsp
mov qword [rbp + 0x81a0], rax
mov rsi, rcx
mov qword [rsp + 0x58], rcx
xor edi, edi
mov dword [rsp + 0x50], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
lea r13d, [rdi + 0xf]
mov qword [rcx + 0x18], r13
mov byte [rcx], dil
mov dword [rsp + 0x50], 1
mov r8d, 0x7fff
lea rdx, [rbp + 0x1a0]
lea rcx, str.PROCESSOR_REVISION
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea rax, [rbp + 0x1a0]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], dil
jne 0x180046fa4
lea rdx, [rbp + 0x1a0]
mov rcx, rsi
call fcn.1800026e0
mov dword [rsp + 0x68], 0x208
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystem
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800471d3
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SystemBiosVersion
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800471c8
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rax, [rbp - 0x70]
inc rbx
cmp word [rax + rbx*2], di
jne 0x18004703a
mov r8, rbx
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x70]
call fcn.18003f9b8
nop
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 7
cmova rcx, qword [rsp + 0x70]
mov rax, qword [rbp - 0x80]
lea r12, [rcx + rax*2]
lea r15, [rsp + 0x70]
cmova r15, qword [rsp + 0x70]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rdi
cmp r15, r12
jne 0x18004709c
mov rax, r13
mov qword [rsp + 0x48], rax
mov byte [rsp + 0x30], dil
jmp 0x18004716b
mov rax, r12
sub rax, r15
sar rax, 1
mov r14, rdi
mov rbx, r13
mov qword [rsp + 0x48], rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x18004720c
cmp rax, r13
jbe 0x18004711b
mov rbx, rax
or rbx, r13
cmp rbx, rcx
jbe 0x1800470e2
mov rbx, rcx
movabs rcx, 0x8000000000000000
jmp 0x1800470fb
mov eax, socket
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180047102
call fcn.180002fac
jmp 0x180047111
test rcx, rcx
je 0x18004710e
call fcn.18007ff28
jmp 0x180047111
mov rax, rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], rbx
lea rcx, [rsp + 0x30]
cmp rbx, r13
cmova rcx, qword [rsp + 0x30]
mov al, byte [r15]
mov byte [r14 + rcx], al
mov r14, qword [rsp + 0x40]
inc r14
mov qword [rsp + 0x40], r14
add r15, 2
cmp r15, r12
je 0x18004714d
mov rbx, qword [rsp + 0x48]
jmp 0x18004711b
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], r13
cmova rax, qword [rsp + 0x30]
mov byte [r14 + rax], dil
mov rax, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
cmp rax, r13
cmova rdx, qword [rsp + 0x30]
mov r8, rdi
mov rcx, rsi
call fcn.1800026e0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r13
jbe 0x1800471be
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800471b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180047206
call fcn.18007ff20
nop
lea rcx, [rsp + 0x70]
call fcn.18003e778
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
mov rcx, qword [rbp + 0x81a0]
xor rcx, rsp
call fcn.18007ff00
lea r11, [rsp + 0x82b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18008a8b4
int3
call fcn.1800018d8
int3