Function at 0x14000efbc
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1168]
mov eax, 0x1268
call fcn.140027460
sub rsp, rax
mov rax, qword [0x14003e0a8]
xor rax, rsp
mov qword [rbp + 0x1150], rax
mov r15, rcx
mov r12, r8
mov rsi, rdx
lea rcx, [rbp + 0x592]
xor ebx, ebx
xor edx, edx
mov r8d, 0xbb6
mov rdi, r9
mov word [rbp + 0x590], bx
call fcn.14001dbc0
test r12, r12
je 0x14000f038
lea r8, [rbp + 0x590]
mov r9d, 0x5dc
mov edx, 0x93
mov rcx, r12
call qword [0x1400324f8]
cmp word [rbp + 0x590], bx
jne 0x14000f05c
lea r8, str._ProductName__encountered_a_fatal_error_and_will_exit._r_n_r_nMore_information:_r_n_r_nVersion:__Version__r_nOS:__OS__r_nSource_file:__SourceFile__r_nLine:__SourceFileLine_
lea rcx, [rbp + 0x590]
mov edx, 0xbb8
mov r12, rbx
call fcn.140004074
xor edx, edx
lea rcx, [rbp + 0x142]
mov word [rbp + 0x140], bx
lea r8d, [rdx + 0x3a]
call fcn.14001dbc0
mov r9d, 3
lea r8, str._u._u._u
lea rcx, [rbp + 0x140]
lea edx, [r9 + 0x39]
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 4
call fcn.1400040ec
lea rcx, [rbp - 0x6c]
xor edx, edx
mov r8d, 0x118
call fcn.14001dbc0
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x11c
call qword [0x1400320c0]
xor edx, edx
lea rcx, [rbp + 0x182]
lea r8d, [rdx + 0x62]
mov r13d, ebx
mov r14d, ebx
mov word [rbp + 0x180], bx
call fcn.14001dbc0
lea rax, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rbx
call qword [0x140032018]
test eax, eax
jne 0x14000f294
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea rdx, str.CurrentMajorVersionNumber
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x40], 4
call qword [0x140032010]
test eax, eax
jne 0x14000f1c6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea rdx, str.CurrentMinorVersionNumber
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [0x140032010]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x180]
lea rdx, str.ReleaseId
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x64
mov qword [rsp + 0x20], rax
call qword [0x140032010]
jmp 0x14000f26a
xor edx, edx
lea rcx, [rbp + 0xb2]
mov word [rbp + 0xb0], bx
lea r8d, [rdx + 0x26]
call fcn.14001dbc0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb0]
lea rdx, str.CurrentVersion
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 0x28
mov qword [rsp + 0x20], rax
call qword [0x140032010]
test eax, eax
jne 0x14000f26a
lea edx, [rax + 0x2e]
lea rcx, [rbp + 0xb0]
call fcn.14001ea0c
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x14000f268
mov word [rbx], ax
cmp word [rbx + 2], ax
je 0x14000f268
lea r8d, [rax + 0xa]
lea rcx, [rbp + 0xb0]
xor edx, edx
call fcn.14001da58
mov dword [rsp + 0x48], eax
test eax, eax
je 0x14000f27c
xor edx, edx
lea rcx, [rbx + 2]
lea r8d, [rdx + 0xa]
call fcn.14001da58
mov dword [rsp + 0x44], eax
xor ebx, ebx
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14000f27e
mov r14d, dword [rsp + 0x44]
mov r13d, eax
jmp 0x14000f27e
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
call qword [0x140032008]
mov r11d, dword [rbp - 0x6c]
cmp r13d, r11d
ja 0x14000f2a3
jmp 0x14000f298
mov r11d, dword [rbp - 0x6c]
cmp r13d, r11d
jne 0x14000f2ae
cmp r14d, dword [rbp - 0x68]
jbe 0x14000f2ae
mov r11d, r13d
mov dword [rbp - 0x6c], r13d
mov dword [rbp - 0x68], r14d
cmp r11d, 0xa
jb 0x14000f2d0
lea r9, [rbp + 0x180]
lea r8, str.ver__s
lea rcx, [rbp - 0x5c]
mov edx, 0x100
call fcn.1400040ec
xor eax, eax
lea rcx, [rsp + 0x5c]
xor edx, edx
lea r8d, [rax + 0x2c]
mov word [rbp + 0x100], bx
mov dword [rsp + 0x58], ebx
mov qword [rbp + 0x102], rax
mov qword [rbp + 0x10a], rax
mov word [rbp + 0x112], ax
call fcn.14001dbc0
lea rcx, [rsp + 0x58]
call qword [0x140032178]
movzx r9d, word [rsp + 0x58]
test r9d, r9d
je 0x14000f350
cmp r9d, 6
je 0x14000f347
mov edx, 0x14
lea rcx, [rbp + 0x100]
cmp r9d, 9
je 0x14000f33e
lea r8, [0x1400359f8]
call fcn.1400040ec
jmp 0x14000f368
lea r8, [0x1400359e8]
jmp 0x14000f363
lea r8, [0x1400359f0]
jmp 0x14000f357
lea r8, [0x1400359e0]
lea rcx, [rbp + 0x100]
mov edx, 0x14
call fcn.140004074
mov al, byte [rbp + 0xaa]
cmp al, 3
je 0x14000f376
cmp al, 2
jne 0x14000f378
mov bl, 1
lea rcx, [rbp + 0x1f2]
xor r13d, r13d
xor edx, edx
mov r8d, 0x18e
mov word [rbp + 0x1f0], r13w
call fcn.14001dbc0
mov r9d, dword [rbp - 0x6c]
lea rax, [rbp - 0x5c]
lea r11, [rbp + 0x100]
mov r14d, 0x190
lea r8, str._u._u__s__s
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x68]
lea rcx, [rbp + 0x1f0]
mov edx, r14d
mov dword [rsp + 0x20], eax
call fcn.1400040ec
test bl, bl
je 0x14000f3ed
lea r8, str._Srv
lea rcx, [rbp + 0x1f0]
mov edx, r14d
call fcn.14000728c
lea rcx, [rbp + 0x382]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x380], r13w
call fcn.14001dbc0
mov r8, qword [r15 + 8]
lea rax, [rbp + 0x380]
or r9d, 0xffffffff
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [0x140032170]
xor edx, edx
lea rcx, [rbp + 0x11a]
lea r8d, [rdx + 0x26]
mov word [rbp + 0x118], r13w
call fcn.14001dbc0
mov ecx, dword [r15 + 0x10]
mov r9d, 0xa
lea r8d, [r9 + 0xa]
lea rdx, [rbp + 0x118]
call fcn.14001db94
test rdi, rdi
je 0x14000f474
movzx eax, word [rdi]
neg ax
sbb rcx, rcx
and rdi, rcx
lea rax, str._Version_
test rdi, rdi
lea rdx, [rbp + 0xb0]
mov qword [rbp + 0xb0], rax
lea rax, [rbp + 0x140]
lea rcx, [rbp + 0x590]
mov qword [rbp + 0xb8], rax
lea rax, str._OS_
mov ebx, 0x5dc
mov qword [rbp + 0xc0], rax
lea rax, [rbp + 0x1f0]
mov r9, rsi
mov qword [rbp + 0xc8], rax
lea rax, str._ProductName_
mov r8d, 5
mov qword [rbp + 0xd0], rax
lea rax, [0x140035618]
mov dword [rsp + 0x44], ebx
cmovne rax, rdi
mov qword [rbp + 0xd8], rax
lea rax, str._SourceFile_
mov qword [rbp + 0xe0], rax
lea rax, [rbp + 0x380]
mov qword [rbp + 0xe8], rax
lea rax, str._SourceFileLine_
mov qword [rbp + 0xf0], rax
lea rax, [rbp + 0x118]
mov qword [rbp + 0xf8], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x20], rax
call fcn.140010afc
test r12, r12
je 0x14000f540
test rdi, rdi
jne 0x14000f5a9
lea r8, [0x140035a94]
mov rdx, rbx
mov rcx, rsi
call fcn.140007e38
lea r8, str.Missing_information:
mov rdx, rbx
mov rcx, rsi
call fcn.140007e38
test rdi, rdi
jne 0x14000f592
lea r8, str.AppName
mov rdx, rbx
mov rcx, rsi
call fcn.140007e38
test r12, r12
jne 0x14000f5a9
lea r8, [0x140035a9c]
mov rdx, rbx
mov rcx, rsi
call fcn.140007e38
test r12, r12
jne 0x14000f5a9
lea r8, str.ResDll
mov rdx, rbx
mov rcx, rsi
call fcn.140007e38
mov rcx, qword [rbp + 0x1150]
xor rcx, rsp
call fcn.14001d120
add rsp, 0x1268
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret