Function at 0x140002cd0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x508
mov dword [rsp + 0x290], 0
mov dword [rsp + 0x4b0], 0
mov r8d, 0x40
xor edx, edx
lea rcx, [rsp + 0x250]
call fcn.1400335a0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.1400335a0
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.1400335a0
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x518]
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002d7b
mov dword [rsp + 0x290], 0xffffffff
jmp 0x140002fd7
mov eax, dword [rsp + 0x548]
mov dword [rsp + 0x4e8], eax
cmp dword [rsp + 0x4e8], 0
je 0x140002db4
cmp dword [rsp + 0x4e8], 1
je 0x140002e84
cmp dword [rsp + 0x4e8], 2
je 0x140002f20
jmp 0x140002fd7
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4ec], eax
cmp dword [rsp + 0x4ec], 0
jbe 0x140002e7f
cmp dword [rsp + 0x4ec], 2
jbe 0x140002ddf
jmp 0x140002e7f
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002e6a
lea rcx, [rsp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x4d8]
lea r8, [rsp + 0x40]
lea rdx, str._s__d
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x140002e7f
lea rdx, [0x140055cc0]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140002fd7
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4f0], eax
cmp dword [rsp + 0x4f0], 0
jbe 0x140002f1b
cmp dword [rsp + 0x4f0], 2
jbe 0x140002ea8
jmp 0x140002f1b
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002f06
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x140002f1b
lea rdx, [0x140055cd0]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140002fd7
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4f4], eax
cmp dword [rsp + 0x4f4], 0
jbe 0x140002fd7
cmp dword [rsp + 0x4f4], 2
jbe 0x140002f4b
jmp 0x140002fd7
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002fcc
lea rdx, [0x140055a2c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140002fac
mov dword [rsp + 0x290], 0xffffffff
jmp 0x140002fd7
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x140002fd7
mov dword [rsp + 0x290], 0
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x290]
add rsp, 0x508
ret