Function at 0x140001680
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x278
mov qword [rsp + 0x258], 0xfffffffffffffffe
mov rax, qword [0x1400666f0]
xor rax, rsp
mov qword [rsp + 0x268], rax
mov dword [rsp + 0x250], 0
lea rcx, [rsp + 0x160]
call fcn.1400073d0
nop
mov r8d, 0x11c
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140029a10
mov dword [rsp + 0x40], 0x11c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14000174a
mov dword [rsp + 0x40], 0x114
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14000174a
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x280]
call fcn.140007400
mov eax, dword [rsp + 0x250]
or eax, 1
mov dword [rsp + 0x250], eax
lea rcx, [rsp + 0x160]
call fcn.1400074f0
mov rax, qword [rsp + 0x280]
jmp 0x140001e7e
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x260], eax
cmp dword [rsp + 0x260], 0
je 0x140001e2f
cmp dword [rsp + 0x260], 1
je 0x140001d81
cmp dword [rsp + 0x260], 2
je 0x140001780
jmp 0x140001e43
cmp dword [rsp + 0x44], 5
jne 0x1400017ac
cmp dword [rsp + 0x48], 2
jne 0x1400017ac
lea rdx, str.Microsoft_Windows_Server_2003_family_
lea rcx, [rsp + 0x160]
call fcn.140007540
mov dword [0x140068480], 1
cmp dword [rsp + 0x44], 5
jne 0x1400017d8
cmp dword [rsp + 0x48], 1
jne 0x1400017d8
lea rdx, str.Microsoft_Windows_XP
lea rcx, [rsp + 0x160]
call fcn.140007540
mov dword [0x140068480], 1
cmp dword [rsp + 0x44], 5
jne 0x140001804
cmp dword [rsp + 0x48], 0
jne 0x140001804
lea rdx, str.Microsoft_Windows_2000
lea rcx, [rsp + 0x160]
call fcn.140007540
mov dword [0x140068480], 1
cmp dword [rsp + 0x44], 4
ja 0x14000181f
lea rdx, str.Microsoft_Windows_NT
lea rcx, [rsp + 0x160]
call fcn.140007540
cmp dword [rsp + 0x30], 0
je 0x1400019f3
movzx eax, byte [rsp + 0x15a]
cmp eax, 1
jne 0x140001894
cmp dword [rsp + 0x44], 4
jne 0x140001854
lea rdx, str.Workstation_4.0
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x14000188f
movzx eax, word [rsp + 0x158]
and eax, 0x200
test eax, eax
je 0x14000187b
lea rdx, str.Home_Edition
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x14000188f
lea rdx, str.Professional
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x1400019ee
movzx eax, byte [rsp + 0x15a]
cmp eax, 3
jne 0x1400019ee
cmp dword [rsp + 0x44], 5
jne 0x140001945
cmp dword [rsp + 0x48], 2
jne 0x140001945
movzx eax, word [rsp + 0x158]
and eax, 0x80
test eax, eax
je 0x1400018e2
lea rdx, str.Datacenter_Edition
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x140001940
movzx eax, word [rsp + 0x158]
and eax, 2
test eax, eax
je 0x140001907
lea rdx, str.Enterprise_Edition
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x140001940
movzx eax, word [rsp + 0x158]
cmp eax, 0x400
jne 0x14000192c
lea rdx, str.Web_Edition
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x140001940
lea rdx, str.Standard_Edition
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x1400019ee
cmp dword [rsp + 0x44], 5
jne 0x1400019b5
cmp dword [rsp + 0x48], 0
jne 0x1400019b5
movzx eax, word [rsp + 0x158]
and eax, 0x80
test eax, eax
je 0x14000197a
lea rdx, str.Datacenter_Server
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x1400019b3
movzx eax, word [rsp + 0x158]
and eax, 2
test eax, eax
je 0x14000199f
lea rdx, str.Advanced_Server
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x1400019b3
lea rdx, str.Server
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x1400019ee
movzx eax, word [rsp + 0x158]
and eax, 2
test eax, eax
je 0x1400019da
lea rdx, str.Server_4.0__Enterprise_Edition
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x1400019ee
lea rdx, str.Server_4.0
lea rcx, [rsp + 0x160]
call fcn.140005e30
jmp 0x140001bf5
mov dword [rsp + 0x218], 0x50
lea rax, [rsp + 0x210]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x21c], eax
cmp dword [rsp + 0x21c], 0
je 0x140001a79
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x280]
call fcn.140007400
mov eax, dword [rsp + 0x250]
or eax, 1
mov dword [rsp + 0x250], eax
lea rcx, [rsp + 0x160]
call fcn.1400074f0
mov rax, qword [rsp + 0x280]
jmp 0x140001e7e
lea rax, [rsp + 0x218]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProductType
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x21c], eax
cmp dword [rsp + 0x21c], 0
jne 0x140001ac9
cmp dword [rsp + 0x218], 0x50
jbe 0x140001b09
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x280]
call fcn.140007400
mov eax, dword [rsp + 0x250]
or eax, 1
mov dword [rsp + 0x250], eax
lea rcx, [rsp + 0x160]
call fcn.1400074f0
mov rax, qword [rsp + 0x280]
jmp 0x140001e7e
mov rcx, qword [rsp + 0x210]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x170]
lea rcx, str.WINNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140001b44
lea rdx, str.Workstation
lea rcx, [rsp + 0x160]
call fcn.140005e30
lea rdx, [rsp + 0x170]
lea rcx, str.LANMANNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140001b71
lea rdx, str.Server
lea rcx, [rsp + 0x160]
call fcn.140005e30
lea rdx, [rsp + 0x170]
lea rcx, str.SERVERNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140001b9e
lea rdx, str.Advanced_Server
lea rcx, [rsp + 0x160]
call fcn.140005e30
lea rcx, [rsp + 0x220]
call fcn.1400073d0
nop
mov r9d, dword [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, str._d._d
lea rcx, [rsp + 0x220]
call fcn.140009820
lea rcx, [rsp + 0x220]
call fcn.140007570
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.140005e30
nop
lea rcx, [rsp + 0x220]
call fcn.1400074f0
cmp dword [rsp + 0x44], 4
jne 0x140001d1e
lea rdx, str.Service_Pack_6
lea rcx, [rsp + 0x54]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140001d1e
lea rax, [rsp + 0x228]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x230], eax
cmp dword [rsp + 0x230], 0
jne 0x140001cb0
lea rcx, [rsp + 0x238]
call fcn.1400073d0
nop
mov r8d, dword [rsp + 0x4c]
and r8d, 0xffff
lea rdx, str.Service_Pack_6a__Build__d_
lea rcx, [rsp + 0x238]
call fcn.140009820
lea rcx, [rsp + 0x238]
call fcn.140007570
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.140005e30
nop
lea rcx, [rsp + 0x238]
call fcn.1400074f0
jmp 0x140001d0e
lea rcx, [rsp + 0x240]
call fcn.1400073d0
nop
mov r9d, dword [rsp + 0x4c]
and r9d, 0xffff
lea r8, [rsp + 0x54]
lea rdx, str._s__Build__d_
lea rcx, [rsp + 0x240]
call fcn.140009820
lea rcx, [rsp + 0x240]
call fcn.140007570
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.140005e30
nop
lea rcx, [rsp + 0x240]
call fcn.1400074f0
mov rcx, qword [rsp + 0x228]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140001d7c
lea rcx, [rsp + 0x248]
call fcn.1400073d0
nop
mov r9d, dword [rsp + 0x4c]
and r9d, 0xffff
lea r8, [rsp + 0x54]
lea rdx, str._s__Build__d_
lea rcx, [rsp + 0x248]
call fcn.140009820
lea rcx, [rsp + 0x248]
call fcn.140007570
mov rdx, rax
lea rcx, [rsp + 0x160]
call fcn.140005e30
nop
lea rcx, [rsp + 0x248]
call fcn.1400074f0
jmp 0x140001e43
cmp dword [rsp + 0x44], 4
jne 0x140001dcb
cmp dword [rsp + 0x48], 0
jne 0x140001dcb
lea rdx, str.Microsoft_Windows_95
lea rcx, [rsp + 0x160]
call fcn.140007540
movzx eax, word [rsp + 0x56]
cmp eax, 0x43
je 0x140001db7
movzx eax, word [rsp + 0x56]
cmp eax, 0x42
jne 0x140001dcb
lea rdx, str.OSR2
lea rcx, [rsp + 0x160]
call fcn.140005e30
cmp dword [rsp + 0x44], 4
jne 0x140001e0b
cmp dword [rsp + 0x48], 0xa
jne 0x140001e0b
lea rdx, str.Microsoft_Windows_98
lea rcx, [rsp + 0x160]
call fcn.140007540
movzx eax, word [rsp + 0x56]
cmp eax, 0x41
jne 0x140001e0b
lea rdx, [0x14004f090]
lea rcx, [rsp + 0x160]
call fcn.140005e30
cmp dword [rsp + 0x44], 4
jne 0x140001e2d
cmp dword [rsp + 0x48], 0x5a
jne 0x140001e2d
lea rdx, str.Microsoft_Windows_Millennium_Edition_n
lea rcx, [rsp + 0x160]
call fcn.140007540
jmp 0x140001e43
lea rdx, str.Microsoft_Win32s_n
lea rcx, [rsp + 0x160]
call fcn.140007540
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0x280]
call fcn.140007400
mov eax, dword [rsp + 0x250]
or eax, 1
mov dword [rsp + 0x250], eax
lea rcx, [rsp + 0x160]
call fcn.1400074f0
mov rax, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x268]
xor rcx, rsp
call fcn.140029b10
add rsp, 0x278
ret