Function at 0x14007c2bc
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb98]
sub rsp, 0xc70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rbp + 0xb60], rax
mov qword [rsp + 0x68], rcx
xor r13d, r13d
mov qword [rsp + 0x78], r13
mov ebx, 0x208
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x740]
call sub.msvcrt.dll_memset
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x950]
call sub.msvcrt.dll_memset
mov r12d, r13d
mov edi, r13d
mov qword [rbp - 0x60], r13
mov ebx, r13d
mov qword [rbp - 0x70], rbx
mov r14d, r13d
mov qword [rbp - 0x58], r13
mov esi, r13d
mov qword [rbp - 0x50], r13
mov r15d, r13d
mov qword [rbp - 0x48], r13
lea rax, str.unknown
mov qword [rbp - 0x68], rax
mov dword [rsp + 0x60], r13d
mov rcx, qword [rsp + 0x68]
call fcn.14007cccc
mov rax, qword [rsp + 0x68]
add rax, 0x28
mov qword [rbp - 0x80], rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x68]
add rax, 0x438
mov qword [rbp - 0x78], rax
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.msvcrt.dll_memset
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 4]
call sub.msvcrt.dll_memset
mov dword [rbp], 0x11c
lea rcx, [rbp]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
nop dword [rax + rax]
test eax, eax
je 0x14007c3f9
lea rdx, [rsp + 0x60]
mov ecx, eax
call fcn.140025c40
mov r13d, dword [rsp + 0x60]
test eax, eax
jne 0x14007c3f9
mov ecx, r13d
call fcn.140025d30
jmp 0x14007cb98
xor eax, eax
cmp byte [rbp + 0x11a], 1
setne al
inc eax
mov rcx, qword [rsp + 0x68]
mov dword [rcx + 0x18], eax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
nop dword [rax + rax]
mov rcx, rax
lea rdx, [0x1400b3028]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
lea rcx, [rbp - 0x38]
test rax, rax
je 0x14007c449
call qword [str.PN_t_]
jmp 0x14007c455
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop dword [rax + rax]
movzx ecx, word [rbp - 0x38]
mov eax, 4
xor edx, edx
test ecx, ecx
je 0x14007c484
cmp ecx, 5
je 0x14007c47d
cmp ecx, 9
je 0x14007c476
cmp ecx, 0xc
cmovne eax, edx
jmp 0x14007c489
mov eax, 2
jmp 0x14007c489
mov eax, 3
jmp 0x14007c489
mov eax, 1
mov rcx, qword [rsp + 0x68]
mov dword [rcx + 0x20], eax
mov dword [rcx + 0x1c], edx
call fcn.14007c244
test eax, eax
je 0x14007c8ce
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
xor ecx, ecx
test eax, eax
jne 0x14007c4d9
mov r13d, ecx
jmp 0x14007c4f3
movzx r13d, ax
or r13d, 0x80070000
test eax, eax
cmovle r13d, eax
test r13d, r13d
jne 0x14007c3ec
mov dword [rsp + 0x74], 0x208
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x950]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.InstallationType
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14007c559
cmp dword [rsp + 0x70], 1
jne 0x14007c559
mov rcx, qword [rsp + 0x68]
add rcx, 0x230
lea r8, [rbp + 0x950]
mov edx, 0x104
call fcn.1400026c0
mov dword [rsp + 0x74], 0x208
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x740]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.EditionId
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov dword [rsp + 0x60], eax
cmp eax, 2
jne 0x14007c63e
mov dword [rsp + 0x74], 0x4f8
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
xor r8d, r8d
lea rdx, str.DigitalProductId4
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov dword [rsp + 0x60], eax
xor ecx, ecx
test eax, eax
jne 0x14007c63e
cmp dword [rsp + 0x70], 3
jne 0x14007c636
cmp dword [rbp + 0x240], 0x4f8
jne 0x14007c636
lea eax, [rcx + 4]
cmp ax, word [rbp + 0x244]
jne 0x14007c636
cmp word [rbp + 0x358], cx
je 0x14007c636
lea r8, [rbp + 0x358]
mov edx, 0x104
lea rcx, [rbp + 0x740]
call fcn.1400026c0
mov dword [rsp + 0x70], 1
jmp 0x14007c63e
mov dword [rsp + 0x60], FDICreate
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14007c65b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
xor ecx, ecx
mov qword [rsp + 0x78], rcx
mov eax, dword [rsp + 0x60]
test eax, eax
jne 0x14007c686
cmp dword [rsp + 0x70], 1
jne 0x14007c684
lea r8, [rbp + 0x740]
mov edx, 0x104
mov rcx, qword [rbp - 0x80]
call fcn.1400026c0
jmp 0x14007c73e
test eax, eax
mov ecx, 0xd
cmovne ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [rbp + 0xb98]
mov qword [rbp - 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r13d, eax
lea r8, str.ConX::Setup::Common::COSInfoHelper::GetHostOSSKUInfo
lea rdx, str._hs:_couldnt_get_host_edition_id
mov ecx, 0x2000005
call fcn.140002df4
mov rcx, rax
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov rax, qword [rbp - 0x80]
mov qword [rsp + 0x38], rax
lea rax, [0x1400b3080]
mov qword [rsp + 0x30], rax
lea rax, str.base_ntsetupconxcommon_setuplib_srcosinfo.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x45d
xor r9d, r9d
mov edx, 0xa4000
call fcn.14007fc40
mov eax, dword [rsp + 0x60]
xor ecx, ecx
test eax, eax
jne 0x14007c724
mov r13d, ecx
jmp 0x14007c73e
movzx r13d, ax
or r13d, 0x80070000
test eax, eax
cmovle r13d, eax
test r13d, r13d
jne 0x14007c3ec
lea rcx, str.winbrand.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
nop dword [rax + rax]
mov r12, rax
test rax, rax
je 0x14007c822
lea rdx, str.BrandingFormatString
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x14007c822
lea rcx, str._WINDOWS_LONG_
call qword [str.PN_t_]
mov qword [rbp - 0x80], rax
test rax, rax
je 0x14007c822
mov r8, rax
mov edx, 0x104
mov rcx, qword [rbp - 0x78]
call fcn.1400026c0
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop dword [rax + rax]
mov r15, qword [rsp + 0x68]
mov qword [rsp + 0x68], rdi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftSysprep
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14007c806
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
jne 0x14007c964
lea rcx, str.Staged_Image
mov qword [rsp + 0x68], rcx
lea eax, [rbx + 1]
jmp 0x14007c975
mov rax, qword [rbp + 0xb98]
mov qword [rbp - 0x78], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r13d, eax
lea r8, str.ConX::Setup::Common::COSInfoHelper::GetHostOSSKUInfo
lea rdx, str._hs:_couldnt_get_host_product_name
mov ecx, 0x2000006
call fcn.140002df4
mov rcx, rax
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], r13d
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x38], rax
lea rax, [0x1400b3080]
mov qword [rsp + 0x30], rax
lea rax, str.base_ntsetupconxcommon_setuplib_srcosinfo.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x481
xor r9d, r9d
mov edx, 0xa4000
call fcn.14007fc40
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jne 0x14007c8b8
mov r13d, 0x80004005
jmp 0x14007c3ec
movzx r13d, ax
or r13d, 0x80070000
test eax, eax
cmovle r13d, eax
jmp 0x14007c3ec
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 0x124]
call sub.msvcrt.dll_memset
mov dword [rbp + 0x120], 0x11c
lea rcx, [rbp + 0x120]
call qword [sym.imp.ntdll.dll_RtlGetVersion]
nop dword [rax + rax]
test eax, eax
js 0x14007c7b7
cmp dword [rbp + 0x124], 5
jne 0x14007c7b7
cmp dword [rbp + 0x128], 1
jb 0x14007c7b7
cmp byte [rbp + 0x11a], 1
jne 0x14007c7b7
mov r15, qword [rsp + 0x68]
lea rcx, [r15 + 0x28]
mov eax, 0x200
mov edx, 0x104
test word [rbp + 0x118], ax
je 0x14007c95b
lea r8, str.HomeEdition
call fcn.1400026c0
jmp 0x14007c7bc
lea r8, str.Professional
jmp 0x14007c951
lea rax, str.Unstaged_Image
mov qword [rsp + 0x68], rax
mov eax, 2
mov dword [r15 + 0x24], eax
mov eax, dword [r15 + 0x20]
cmp eax, 1
jne 0x14007c98b
lea r14, [0x1400a1a00]
jmp 0x14007c9bc
cmp eax, 2
jne 0x14007c999
lea r14, str.amd64
jmp 0x14007c9bc
cmp eax, 3
jne 0x14007c9a7
lea r14, [0x1400a1a08]
jmp 0x14007c9bc
lea r14, str.arm64
cmp eax, 4
lea rax, str.unknown
cmovne r14, rax
lea rcx, str.Server_Workstation
lea rax, str.Client_Workstation
cmp dword [r15 + 0x18], 1
cmovne rax, rcx
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x60]
call fcn.140093374
mov dword [rsp + 0x60], eax
mov rbx, qword [rbp - 0x70]
test eax, eax
js 0x14007ca77
or edi, 0xffffffff
mov dword [rsp + 0x28], edi
lea rax, str.Complete
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, rbx
lea edx, [rdi + 2]
mov esi, 0x409
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x14007ca3b
mov dword [r15 + 0x1c], eax
jmp 0x14007ca71
mov dword [rsp + 0x28], edi
lea rax, str.Core
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, rbx
mov edx, 1
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x14007ca71
mov dword [r15 + 0x1c], 1
mov qword [rbp - 0x68], rbx
jmp 0x14007cae6
mov rsi, qword [rbp + 0xb98]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov r8d, dword [rsp + 0x60]
lea rdx, str.Failed_to_determine_source_edition_type___Error:__0x_X_
mov ecx, 0x2000000
call fcn.140002df4
mov rcx, rax
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
lea rax, [0x1400b3080]
mov qword [rsp + 0x30], rax
lea rax, str.base_ntsetupconxcommon_setuplib_srcosinfo.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x4d7
xor r9d, r9d
mov edx, 0xa4000
call fcn.14007fc40
mov rsi, qword [rbp + 0xb98]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
lea r9, [r15 + 0x230]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
lea rax, [r15 + 0x438]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea r8, [r15 + 0x28]
lea rdx, str.Source_OS:_Host_SKU_Info:_Edition___s__Edition_Type___s__Installation_Type___s__Product_Name___s__Arch___s__StationType___s__Stage_type___s
mov ecx, 0x4000000
call fcn.140002df4
mov rcx, rax
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], edi
mov qword [rsp + 0x38], rsi
lea rax, [0x1400b3080]
mov qword [rsp + 0x30], rax
lea rax, str.base_ntsetupconxcommon_setuplib_srcosinfo.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x4e1
xor r9d, r9d
mov edx, 0xa4000
call fcn.14007fc40
mov rdi, qword [rbp - 0x60]
mov r14, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x50]
mov r15, qword [rbp - 0x48]
mov ecx, r13d
call fcn.140025d50
nop
test r15, r15
je 0x14007cbc7
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, r15
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
nop
xor r15d, r15d
test rsi, rsi
je 0x14007cbf0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
nop
test r14, r14
je 0x14007cc16
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
nop
test rbx, rbx
je 0x14007cc3c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x14007cc62
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
nop
test r12, r12
je 0x14007cc77
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop dword [rax + rax]
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14007cc92
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov qword [rsp + 0x78], r15
mov eax, r13d
mov rcx, qword [rbp + 0xb60]
xor rcx, rsp
call fcn.140094220
lea r11, [rsp + 0xc70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret