Function at 0x1400210d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0x88
mov rax, qword [0x1400601c8]
xor rax, rsp
mov qword [rbp + 0x3f], rax
call fcn.14000dff0
mov rcx, rax
mov rbx, rax
call fcn.14000d830
test eax, eax
je 0x140021109
mov rax, rbx
jmp 0x1400213e3
lea rcx, str.Windows
mov qword [rsp + 0xa8], rdi
call fcn.14000e380
mov r8, rax
lea rdx, str.name
mov rcx, rbx
call fcn.14000e7e0
lea rcx, str.ntoskrnl.exe
call fcn.140021400
mov rdi, rax
test rax, rax
jne 0x140021157
lea rcx, str.kernel32.dll
call fcn.140021400
mov rdi, rax
test rax, rax
je 0x140021172
lea r9, [rbp + 0x17]
mov rcx, rdi
lea r8, [rbp + 0xf]
lea rdx, [0x14004c68c]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x14002118c
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rbx
call fcn.14000d4f0
call fcn.14000dfe0
jmp 0x1400213db
mov rcx, qword [rbp + 0xf]
lea r8, str._u._u._u._lu
mov qword [rsp + 0xa0], rsi
mov edx, 0x20
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0xb8], r14
mov eax, dword [rcx + 0x18]
and dword [rcx + 0x1c], eax
mov rcx, qword [rbp + 0xf]
mov qword [rsp + 0x80], r15
mov eax, dword [rcx + 8]
mov r15d, eax
movzx r12d, ax
mov eax, dword [rcx + 0xc]
mov esi, eax
movzx r14d, ax
lea rcx, [rbp + 0x1f]
mov dword [rsp + 0x30], r14d
shr esi, 0x10
shr r15d, 0x10
mov dword [rsp + 0x28], esi
mov r9d, r15d
mov dword [rsp + 0x20], r12d
call fcn.140006a80
lea rcx, [rbp + 0x1f]
call fcn.14000e380
mov r8, rax
lea rdx, str.kernel_version
mov rcx, rbx
call fcn.14000e7e0
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor edi, edi
mov dword [rbp + 7], 4
lea rax, [rbp + 7]
mov dword [rbp + 0xb], edi
mov qword [rsp + 0x30], rax
lea r8, str.CurrentMajorVersionNumber
lea rax, [rbp + 0xb]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea r9d, [rdi + 0x10]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea r9d, [rdi + 0x10]
mov dword [rbp + 7], 4
test eax, eax
lea r8, str.CurrentMinorVersionNumber
lea rax, [rbp + 7]
mov rcx, 0xffffffff80000002
cmove r15d, dword [rbp + 0xb]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xb]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea r9d, [rdi + 2]
mov dword [rbp + 7], 0x20
test eax, eax
lea r8, str.CurrentBuild
lea rax, [rbp + 7]
mov rcx, 0xffffffff80000002
cmove r12d, dword [rbp + 0xb]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x1400212fb
xor edx, edx
lea rcx, [rbp + 0x1f]
call fcn.140008b30
cvttsd2si rsi, xmm0
lea rax, [rbp + 7]
mov dword [rbp + 7], 4
mov qword [rsp + 0x30], rax
lea r8, [0x14004c730]
lea rax, [rbp + 0xb]
mov r9d, 0x10
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x28], esi
lea r8, str._u._u._u
test eax, eax
mov dword [rsp + 0x20], r12d
mov r9d, r15d
lea rcx, [rbp + 0x1f]
cmove r14d, dword [rbp + 0xb]
mov edx, 0x20
call fcn.140006a80
lea rcx, [rbp + 0x1f]
call fcn.14000e380
mov r8, rax
lea rdx, str.version
mov rcx, rbx
call fcn.14000e7e0
mov r9d, r14d
lea r8, [0x14004c744]
mov edx, 0x20
lea rcx, [rbp + 0x1f]
call fcn.140006a80
lea rcx, [rbp + 0x1f]
call fcn.14000e380
mov r8, rax
lea rdx, str.build
mov rcx, rbx
call fcn.14000e7e0
mov rcx, rbx
call fcn.14000d5d0
mov r15, qword [rsp + 0x80]
mov rax, rbx
mov r14, qword [rsp + 0xb8]
mov r12, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa0]
mov rdi, qword [rsp + 0xa8]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140043bb0
add rsp, 0x88
pop rbx
pop rbp
ret