Function at 0x14020b020
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x2c0
mov rax, qword [0x140303f40]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rcx, str._tOS:
call fcn.14001c390
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x11c
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0x11c
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
cmp qword [rsp + 0x78], 0
je 0x14020b0d5
lea rcx, [rsp + 0x90]
call qword [rsp + 0x78]
mov dword [rsp + 0x44], eax
cmp qword [rsp + 0x78], 0
je 0x14020b0e4
cmp dword [rsp + 0x44], 0
je 0x14020b0f6
lea rcx, str.Windows__Unknown_Version_
call fcn.14001c390
nop
jmp 0x14020b566
cmp qword [rsp + 0x80], 0
je 0x14020b137
movzx eax, word [rsp + 0x1a6]
movzx ecx, word [rsp + 0x1a4]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x94]
call qword [rsp + 0x80]
nop
xor eax, eax
test eax, eax
je 0x14020b1e6
mov edx, dword [rsp + 0x94]
lea rcx, str.dwMajorVersion:_____u_n
call fcn.14001c390
mov edx, dword [rsp + 0x98]
lea rcx, str.dwMinorVersion:_____u_n
call fcn.14001c390
mov edx, dword [rsp + 0x9c]
lea rcx, str.dwBuildNumber:______u_n
call fcn.14001c390
mov edx, dword [rsp + 0xa0]
lea rcx, str.dwPlatformId:_______u_n
call fcn.14001c390
movzx eax, word [rsp + 0x1a4]
mov edx, eax
lea rcx, str.wServicePackMajor:__u_n
call fcn.14001c390
movzx eax, word [rsp + 0x1a6]
mov edx, eax
lea rcx, str.wServicePackMinor:__u_n
call fcn.14001c390
movzx eax, word [rsp + 0x1a8]
mov edx, eax
lea rcx, str.wSuiteMask:_________u_n
call fcn.14001c390
movzx eax, byte [rsp + 0x1aa]
mov edx, eax
lea rcx, str.wProductType:_______u_n
call fcn.14001c390
nop
lea rcx, str.Windows
call fcn.14001c390
nop
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 5
je 0x14020b41a
cmp dword [rsp + 0x4c], 6
je 0x14020b2d4
cmp dword [rsp + 0x4c], 0xa
je 0x14020b220
jmp 0x14020b467
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x6c], al
cmp byte [rsp + 0x6c], 1
je 0x14020b235
jmp 0x14020b26a
cmp dword [rsp + 0x9c], 0x55f0
jae 0x14020b251
lea rcx, [0x1402e6804]
call fcn.14001c390
nop
jmp 0x14020b25e
lea rcx, [0x1402e6808]
call fcn.14001c390
nop
mov ecx, dword [rsp + 0x40]
call fcn.14020aad0
nop
jmp 0x14020b2cf
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x3839
je 0x14020b295
cmp dword [rsp + 0x50], 0x4563
je 0x14020b2a4
cmp dword [rsp + 0x50], 0x4f7c
je 0x14020b2b3
jmp 0x14020b2c2
lea rcx, str.2016_Server
call fcn.14001c390
nop
jmp 0x14020b2cf
lea rcx, str.2019_Server
call fcn.14001c390
nop
jmp 0x14020b2cf
lea rcx, str.2022_Server
call fcn.14001c390
nop
jmp 0x14020b2cf
lea rcx, str.Unknown_Server
call fcn.14001c390
nop
jmp 0x14020b467
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x14020b308
cmp dword [rsp + 0x48], 1
je 0x14020b34e
cmp dword [rsp + 0x48], 2
je 0x14020b394
cmp dword [rsp + 0x48], 3
je 0x14020b3d7
jmp 0x14020b418
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x5c], al
cmp byte [rsp + 0x5c], 1
je 0x14020b324
cmp byte [rsp + 0x5c], 3
je 0x14020b33c
jmp 0x14020b349
lea rcx, str.Windows_Vista
call fcn.14001c390
mov ecx, dword [rsp + 0x40]
call fcn.14020aad0
nop
jmp 0x14020b349
lea rcx, str.Windows_Server_2008
call fcn.14001c390
nop
jmp 0x14020b418
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x60], al
cmp byte [rsp + 0x60], 1
je 0x14020b36a
cmp byte [rsp + 0x60], 3
je 0x14020b382
jmp 0x14020b38f
lea rcx, str.Windows_7
call fcn.14001c390
mov ecx, dword [rsp + 0x40]
call fcn.14020aad0
nop
jmp 0x14020b38f
lea rcx, str.Windows_Server_2008_R2
call fcn.14001c390
nop
jmp 0x14020b418
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x64], al
cmp byte [rsp + 0x64], 1
je 0x14020b3b0
cmp byte [rsp + 0x64], 3
je 0x14020b3c8
jmp 0x14020b3d5
lea rcx, str.Windows_8
call fcn.14001c390
mov ecx, dword [rsp + 0x40]
call fcn.14020aad0
nop
jmp 0x14020b3d5
lea rcx, str.Windows_Server_2012
call fcn.14001c390
nop
jmp 0x14020b418
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x68], al
cmp byte [rsp + 0x68], 1
je 0x14020b3f3
cmp byte [rsp + 0x68], 3
je 0x14020b40b
jmp 0x14020b418
lea rcx, str.Windows_8.1
call fcn.14001c390
mov ecx, dword [rsp + 0x40]
call fcn.14020aad0
nop
jmp 0x14020b418
lea rcx, str.Windows_Server_2012_R2
call fcn.14001c390
nop
jmp 0x14020b467
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x14020b43c
cmp dword [rsp + 0x54], 1
je 0x14020b44b
cmp dword [rsp + 0x54], 2
je 0x14020b45a
jmp 0x14020b467
lea rcx, str.Windows_2000
call fcn.14001c390
nop
jmp 0x14020b467
lea rcx, str.Windows_XP
call fcn.14001c390
nop
jmp 0x14020b467
lea rcx, str.Windows_Server_2003
call fcn.14001c390
nop
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x58], 0x100
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.DisplayVersion
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14020b4e0
lea rdx, [rsp + 0x1b0]
lea rcx, str.__version:__s_
call fcn.14001c390
nop
mov edx, dword [rsp + 0x9c]
lea rcx, str.__build__u
call fcn.14001c390
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [0x1402e6984]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14020b559
mov edx, dword [rsp + 0x70]
lea rcx, [0x1402e6988]
call fcn.14001c390
nop
lea rcx, [0x1402a76f8]
call fcn.14001c390
nop
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140254b90
add rsp, 0x2c0
pop rdi
ret