Function at 0x14007bf24
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x290
mov rax, qword [0x1400c5a08]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14, rcx
lea rax, [rsp + 0x68]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x14007c012
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x298]
lea r8, str.pGetHostCSDBuildNumber
mov r9d, esi
lea rdx, str._hs:_Failed_to_open_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersion._Error___d
mov ecx, 0x3000000
mov ebx, eax
call fcn.140002df4
and dword [rsp + 0x50], 0
mov rcx, rax
and qword [rsp + 0x48], 0
lea rax, [0x1400b2dc8]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov edx, 0xa4000
mov qword [rsp + 0x30], rax
lea rax, str.base_ntsetupconxcommon_setuplib_srcosinfo.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x23f
call fcn.14007fc40
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
jmp 0x14007c210
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x64]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x60], 0x206
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CSDBuildNumber
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
and qword [rsp + 0x68], 0
test esi, esi
je 0x14007c189
cmp esi, 2
jne 0x14007c101
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x298]
lea r8, str.pGetHostCSDBuildNumber
lea rdx, str._hs:_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionCSDBuildNumber_does_not_exist._Assume_0
mov ecx, 0x4000000
mov ebx, eax
call fcn.140002df4
and dword [rsp + 0x50], 0
mov rcx, rax
and qword [rsp + 0x48], 0
lea rax, [0x1400b2dc8]
mov dword [rsp + 0x40], ebx
xor r9d, r9d
mov qword [rsp + 0x38], rdi
mov edx, 0xa4000
mov qword [rsp + 0x30], rax
lea rax, str.base_ntsetupconxcommon_setuplib_srcosinfo.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x25a
call fcn.14007fc40
and dword [r14], 0
jmp 0x14007c20b
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x298]
lea r8, str.pGetHostCSDBuildNumber
mov r9d, esi
lea rdx, str._hs:_Failed_to_read_HKLMSOFTWAREMicrosoftWindows_NTCurrentVersionCSDBuildNumber._Error___d
mov ecx, 0x3000000
mov ebx, eax
call fcn.140002df4
and dword [rsp + 0x50], 0
mov rcx, rax
and qword [rsp + 0x48], 0
lea rax, [0x1400b2dc8]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
lea rax, str.base_ntsetupconxcommon_setuplib_srcosinfo.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x263
xor r9d, r9d
mov edx, 0xa4000
call fcn.14007fc40
jmp 0x14007c00b
cmp dword [rsp + 0x64], 1
je 0x14007c1f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov rdi, qword [rsp + 0x298]
lea r8, str.pGetHostCSDBuildNumber
lea rdx, str._hs:_Registry_value_CSDBuildNumber_is_not_the_correct_type__REG_SZ_.
mov ecx, 0x3000000
mov ebx, eax
call fcn.140002df4
and dword [rsp + 0x50], 0
mov rcx, rax
and qword [rsp + 0x48], 0
lea rax, [0x1400b2dc8]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rax
lea rax, str.base_ntsetupconxcommon_setuplib_srcosinfo.cpp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x26e
jmp 0x14007c177
lea rcx, [rsp + 0x70]
call qword [sym.imp.msvcrt.dll__wtoi]
nop dword [rax + rax]
mov dword [r14], eax
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140094220
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret