Function at 0x1400c0040
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x3c0
mov rax, qword [0x1402be5c8]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [r11 - 0x338], rdi
mov qword [r11 - 0x328], rdi
mov r14d, 7
mov qword [r11 - 0x320], r14
mov word [rsp + 0xa0], di
mov qword [r11 - 0x358], rdi
mov qword [r11 - 0x348], rdi
mov r15d, r14d
mov qword [r11 - 0x340], r14
mov word [rsp + 0x80], di
mov qword [r11 - 0x318], rdi
mov qword [r11 - 0x308], rdi
mov qword [r11 - 0x300], r14
mov word [rsp + 0xc0], di
xor eax, eax
mov qword [rsp + 0x64], rax
mov dword [rsp + 0x6c], eax
mov esi, edi
lea rax, str.VMwareVMware
mov qword [rsp + 0x38], rax
lea rax, str.Microsoft_Hv
mov qword [rsp + 0x40], rax
lea rax, str.KVMKVMKVM
mov qword [rsp + 0x48], rax
lea rax, str.XenVMMXenVMM
mov qword [rsp + 0x50], rax
lea rax, str.AliyunKVM
mov qword [rsp + 0x58], rax
mov eax, 0x40000000
xor ecx, ecx
cpuid
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x68], ecx
mov qword [r11 - 0x2ec], rdi
mov qword [r11 - 0x2e4], rdi
mov qword [r11 - 0x2dc], rdi
mov qword [r11 - 0x2d4], rdi
mov qword [r11 - 0x2cc], rdi
mov qword [r11 - 0x2c4], rdi
mov dword [rsp + 0x11c], edi
movsd xmm0, qword [rsp + 0x64]
movsd qword [rsp + 0xe0], xmm0
mov dword [rsp + 0xe8], edx
mov qword [rsp + 0x78], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x120], xmm0
movups xmmword [rsp + 0x130], xmm0
movups xmmword [rsp + 0x140], xmm0
movups xmmword [rsp + 0x150], xmm0
movups xmmword [rsp + 0x160], xmm0
movups xmmword [rsp + 0x170], xmm0
movups xmmword [rsp + 0x180], xmm0
movups xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x20], MsiGetPropertyW
lea r9, [r11 - 0x2f8]
lea r8d, [rdi + 0x40]
lea rdx, [r11 - 0x2b8]
lea rcx, [rsp + 0x78]
call fcn.1401e97cc
mov r8d, edi
lea r12d, [rdi + 1]
nop dword [rax]
lea rax, [rsp + 0x120]
mov rbx, qword [rsp + r8*8 + 0x38]
sub rbx, rax
movzx edx, word [rax]
movzx ecx, word [rax + rbx]
sub edx, ecx
jne 0x1400c0213
add rax, 2
test ecx, ecx
jne 0x1400c0200
test edx, edx
cmove esi, r12d
inc r8
cmp r8, 5
jl 0x1400c01f0
lea rax, [rsp + 0x120]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x1400c0234
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0xc0]
call fcn.140018360
cmp esi, r12d
jne 0x1400c0583
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x60]
test eax, eax
jne 0x1400c057d
mov word [rsp + 0x1a0], di
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x70], 0x208
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.SystemManufacturer
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c0583
lea rax, [rsp + 0x1a0]
mov r8, rbx
inc r8
cmp word [rax + r8*2], 0
jne 0x1400c02e4
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x80]
call fcn.140018360
lea rdx, [rsp + 0x80]
mov r15, qword [rsp + 0x98]
cmp r15, 8
setae r8b
mov rsi, qword [rsp + 0x80]
cmovae rdx, rsi
lea r9, str.Microsoft_Corporation
mov rcx, rdi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [r9 + rcx*2]
jne 0x1400c0440
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r9 + rcx*2 + 2]
jne 0x1400c0440
add rcx, 2
cmp rcx, 0x16
jne 0x1400c0340
mov word [rsp + 0x1a0], di
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.SystemProductName
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c0570
lea rax, [rsp + 0x1a0]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400c03b3
mov r8, rbx
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0xa0]
call fcn.140018360
lea rdx, [rsp + 0xa0]
mov r14, qword [rsp + 0xb8]
cmp r14, 8
cmovae rdx, qword [rsp + 0xa0]
lea rbx, str.Virtual_Machine
mov rcx, rdi
nop dword [rax]
movzx eax, word [rdx + rcx*2]
cmp ax, word [rbx + rcx*2]
jne 0x1400c0570
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [rbx + rcx*2 + 2]
jne 0x1400c0570
add rcx, 2
cmp rcx, 0x10
jne 0x1400c0400
mov edi, r12d
mov dword [rsp + 0x30], r12d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400c058b
lea rdx, [rsp + 0x80]
test r8b, r8b
cmovne rdx, rsi
mov rcx, rdi
lea r9, [0x14023f2b0]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x1400c048d
cmp rcx, 4
jne 0x1400c0460
mov edi, r12d
mov dword [rsp + 0x30], r12d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400c058b
lea rdx, [rsp + 0x80]
test r8b, r8b
cmovne rdx, rsi
mov rcx, rdi
lea r9, str.QEMU
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x1400c04dd
cmp rcx, 5
jne 0x1400c04b0
mov edi, r12d
mov dword [rsp + 0x30], r12d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400c058b
lea rdx, [rsp + 0x80]
test r8b, r8b
cmovne rdx, rsi
mov rcx, rdi
lea r9, str.Red_Hat
nop word [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x1400c052a
cmp rcx, 8
jne 0x1400c0500
mov edi, r12d
mov dword [rsp + 0x30], r12d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400c058b
lea rdx, [rsp + 0x80]
test r8b, r8b
cmovne rdx, rsi
lea r8, str.VMware__Inc.
movzx ecx, word [rdx + rbx*2 + 2]
movzx eax, word [r8 + rbx*2 + 2]
sub ecx, eax
jne 0x1400c0566
add rbx, 2
cmp rbx, 0xd
je 0x1400c0566
movzx ecx, word [rdx + rbx*2]
movzx eax, word [r8 + rbx*2]
sub ecx, eax
je 0x1400c0540
test ecx, ecx
cmove edi, r12d
mov dword [rsp + 0x30], edi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400c058b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x80]
jmp 0x1400c05a9
mov rdx, qword [rsp + 0xd8]
cmp rdx, 8
jb 0x1400c05f2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c05ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c0696
call fcn.1401a9460
nop
cmp r15, 8
jb 0x1400c062a
lea rdx, [r15*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400c0621
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c069c
mov rcx, rsi
call fcn.1401a9460
nop
cmp r14, 8
jb 0x1400c0666
lea rdx, [r14*2 + 2]
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c0661
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c06a2
call fcn.1401a9460
mov eax, edi
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.1401a9440
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
call fcn.1401e37cc
nop
call fcn.1401e37cc
nop
call fcn.1401e37cc
int3