Function at 0x140016c30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14005b0e8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov eax, dword [0x140040568]
mov rsi, rcx
mov rcx, qword [0x1417bba30]
xor edi, edi
movsd xmm0, qword [str._SP65535.65535]
mov dword [rbp - 0x18], eax
movzx eax, word [0x14004056c]
mov word [rbp - 0x14], ax
movzx eax, byte [0x14004056e]
mov byte [rbp - 0x12], al
movzx eax, word [rcx + 0x18e]
movsd qword [rbp - 0x20], xmm0
test ax, ax
je 0x140016cc3
movzx r9d, word [rcx + 0x18c]
lea r8, str._SP_u._u
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x20], eax
lea edx, [rdi + 0xf]
call fcn.1400022d0
mov rcx, qword [0x1417bba30]
jmp 0x140016cf4
movzx eax, word [rcx + 0x18c]
test ax, ax
je 0x140016cf0
mov r9d, eax
lea r8, str._SP_u
mov edx, 0xf
lea rcx, [rbp - 0x20]
call fcn.1400022d0
mov rcx, qword [0x1417bba30]
jmp 0x140016cf4
mov byte [rbp - 0x20], dil
lea rdx, [rcx + 0x198]
add rcx, 0x78
call fcn.140016790
lea rcx, [rbp - 0x20]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
lea r9, str.Windows__s_s
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea rdx, [0x140040598]
call fcn.140011be0
mov rcx, qword [0x1417bba30]
lea r9, str._lu._lu._lu
xor r8d, r8d
lea rdx, str.Build_Number
mov eax, dword [rcx + 0x84]
mov dword [rsp + 0x30], eax
mov eax, dword [rcx + 0x80]
mov dword [rsp + 0x28], eax
mov eax, dword [rcx + 0x7c]
mov rcx, rsi
mov dword [rsp + 0x20], eax
call fcn.140011be0
lea rax, [rbp - 0x38]
mov dword [rbp - 0x30], edi
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016df1
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov dword [rbp - 0x2c], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400405b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
mov ebx, dword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [0x14003e574]
mov dword [rsp + 0x20], ebx
mov r8d, 0x200
lea rdx, [0x14004061c]
mov rcx, rsi
call fcn.140011be0
lea rax, [rbp - 0x40]
mov qword [rbp - 0x40], rdi
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp - 0x30], edi
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov rbx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016ebd
mov rcx, qword [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x28]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x140040620]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016ebd
mov eax, dword [rbp - 0x30]
test eax, eax
je 0x140016ebd
mov ecx, eax
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140016ebd
mov rcx, qword [rbp - 0x40]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x28]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x140040620]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016ebd
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140004890
mov r8, rax
lea rdx, str.Edition
xor r9d, r9d
mov rcx, rsi
call fcn.1400118b0
jmp 0x140016ed1
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x140016ecc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140016eda
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
lea rax, [rbp - 0x38]
mov dword [rbp - 0x30], edi
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016f45
mov rcx, qword [rbp - 0x38]
lea rax, [rbp - 0x2c]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x40]
lea rax, [rbp - 0x30]
mov dword [rbp - 0x2c], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.InstallDate
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x38]
mov edi, dword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.140004710
mov r8, rax
lea rdx, str.Install_Date
xor r9d, r9d
mov rcx, rsi
call fcn.1400118b0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140029990
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret