Function at 0x140002b18
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0xc8]
sub rsp, 0x1b0
mov rax, qword [0x1403bbc88]
xor rax, rsp
mov qword [rbp + 0xa0], rax
or dword [section..data], 0xffffffff
lea rdi, str.Windows_Undefined
xor r14d, r14d
mov rcx, rdi
mov ebx, r14d
call fcn.14001ad10
inc rax
mov esi, 0x80
cmp rax, rsi
jae 0x140002b86
mov rcx, rdi
call fcn.14001ad10
lea r8, [rax + 1]
jmp 0x140002b89
mov r8, rsi
lea r15, str.Windows
mov rdx, rdi
mov rcx, r15
call fcn.14000d0e0
mov rcx, rdi
call fcn.14001ad10
inc rax
cmp rax, rsi
jae 0x140002bb8
mov rcx, rdi
call fcn.14001ad10
add rax, r15
jmp 0x140002bbf
lea rax, [0x1403aa08f]
mov r12d, 0x9c
mov byte [rax], r14b
mov r8d, r12d
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.14000d540
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], r12d
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x140002c15
mov r8d, r12d
lea rcx, [rsp + 0x60]
xor edx, edx
call fcn.14000d540
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x14000306c
cmp dword [rsp + 0x70], 2
jne 0x140002e67
cmp dword [rsp + 0x64], 6
mov r15d, 1
ja 0x140002c3e
jne 0x140002ce9
cmp dword [rsp + 0x68], 2
jb 0x140002cf4
mov r8b, r15b
mov edx, 2
xor ecx, ecx
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edi, dword [rsp + 0x64]
mov rsi, rax
jmp 0x140002c85
mov r8, r12
lea rcx, [rbp]
xor edx, edx
call fcn.14000d540
mov r8, rsi
mov dword [rbp], r12d
mov edx, 2
mov dword [rbp + 4], edi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
jne 0x140002c8c
add edi, r15d
cmp edi, 9
jbe 0x140002c57
jmp 0x140002ce9
cmp dword [rsp + 0x64], edi
jae 0x140002c9b
mov dword [rsp + 0x64], edi
mov dword [rsp + 0x68], r14d
mov r8b, r15b
mov edx, r15d
xor ecx, ecx
call qword [sym.imp.ntdll.dll_VerSetConditionMask]
mov edi, dword [rsp + 0x68]
mov rsi, rax
jmp 0x140002cde
mov r8, r12
lea rcx, [rbp]
xor edx, edx
call fcn.14000d540
mov r8, rsi
mov dword [rbp], r12d
mov edx, r15d
mov dword [rbp + 8], edi
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
test eax, eax
jne 0x140002ce5
add edi, r15d
cmp edi, 9
jbe 0x140002cb2
jmp 0x140002ce9
mov dword [rsp + 0x68], edi
cmp dword [rsp + 0x64], 0xf
ja 0x140002e60
cmp dword [rsp + 0x68], 0xf
ja 0x140002e60
cmp byte [rbp - 6], r15b
mov edx, r14d
mov r8d, dword [rsp + 0x64]
setbe dl
shl r8d, 4
or r8d, dword [rsp + 0x68]
mov ecx, r8d
mov dword [section..data], r8d
sub ecx, 0x51
je 0x140002e59
sub ecx, r15d
je 0x140002e2b
sub ecx, 0xe
je 0x140002e1b
sub ecx, r15d
je 0x140002e0b
sub ecx, r15d
je 0x140002dfb
sub ecx, r15d
je 0x140002deb
sub ecx, r15d
je 0x140002ddb
sub ecx, 0x3c
je 0x140002d8b
cmp ecx, 0x10
je 0x140002dcb
lea r15, str.Windows
cmp r8d, 0x51
jge 0x140002d7f
mov dword [section..data], r14d
jmp 0x140002e67
lea rbx, str.12_or_later
jmp 0x140002e67
cmp dword [rsp + 0x6c], 0x4e20
jae 0x140002dc1
cmp dword [rsp + 0x6c], 0x4563
lea rax, str.Server_2016
lea rbx, str.Server_2019
cmovb rbx, rax
lea rax, [0x140385f88]
test edx, edx
cmovne rbx, rax
jmp 0x140002e60
mov dword [section..data], 0xb0
lea rax, [0x140385fac]
lea rbx, str.Server_2022
jmp 0x140002db6
lea rax, str.10__Preview_1_
lea rbx, str.Server_10__Preview_1_
jmp 0x140002db6
lea rax, [0x140385f4c]
lea rbx, str.Server_2012_R2
jmp 0x140002db6
lea rax, [0x140385f38]
lea rbx, str.Server_2012
jmp 0x140002db6
lea rax, [0x140385f24]
lea rbx, str.Server_2008_R2
jmp 0x140002db6
lea rax, str.Vista
lea rbx, str.Server_2008
jmp 0x140002db6
test edx, edx
je 0x140002e38
lea rbx, str.XP_64
jmp 0x140002e60
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
lea rcx, str.Server_2003
lea rbx, str.Server_2003_R2
cmove rbx, rcx
jmp 0x140002e60
lea rbx, [0x140385ee4]
lea r15, str.Windows
movzx r9d, word [rbp - 0xa]
lea rax, [rsp + 0x40]
movzx r8d, word [rbp - 0xc]
mov edx, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
test rbx, rbx
jne 0x140002ecd
cmp dword [rsp + 0x70], 2
lea rax, [0x140385fd4]
lea r9, [0x140385fd8]
cmove r9, rax
lea rdx, str.64_bit
mov eax, dword [rsp + 0x68]
lea r8, str._s__u._u__s
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x64]
mov dword [rsp + 0x20], eax
jmp 0x140002f73
movzx eax, word [rbp - 0xa]
test ax, ax
je 0x140002efa
movzx ecx, word [rbp - 0xc]
lea rdx, str.64_bit
mov qword [rsp + 0x30], rdx
lea r8, str._s_SP_u._u__s
movzx eax, ax
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
jmp 0x140002f70
movzx eax, word [rbp - 0xc]
test ax, ax
je 0x140002f33
lea rdx, str.64_bit
movzx eax, ax
mov qword [rsp + 0x28], rdx
lea r8, str._s_SP_u__s
mov edx, 0x76
mov dword [rsp + 0x20], eax
mov r9, rbx
lea rcx, [0x1403aa018]
call fcn.1400031e0
jmp 0x140002f84
mov ecx, dword [rsp + 0x40]
call fcn.140002308
cmp dword [rsp + 0x40], r14d
lea rdx, [0x14038600c]
lea rcx, [0x1403a5e40]
cmovne rcx, rdx
lea r8, str._s_s_s___s
lea rdx, str.64_bit
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, rbx
mov edx, 0x76
lea rcx, [0x1403aa018]
call fcn.1400031e0
cmp dword [section..data], 0x62
mov eax, dword [rsp + 0x6c]
mov dword [0x1403aa004], eax
mov byte [0x1403aa08d], r14b
jl 0x14000306c
mov eax, 4
mov dword [rsp + 0x44], r14d
mov dword [rsp + 0x4c], eax
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov dword [rsp + 0x48], eax
mov r9d, 0x20019
lea rax, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003018
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x140386050]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r15
call fcn.14001ad10
mov rcx, r15
lea rdi, [rax + r15]
call fcn.14001ad10
mov r9d, dword [0x1403aa004]
mov ebx, 0x7f
sub rbx, rax
mov rcx, rdi
mov eax, dword [rsp + 0x44]
mov rdx, rbx
test eax, eax
je 0x14000305b
lea r8, str.__Build__d._d_
mov dword [rsp + 0x20], eax
call fcn.1400031e0
jmp 0x140003067
lea r8, str.__Build__d_
call fcn.1400031e0
mov byte [rbx + rdi - 1], r14b
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.14000c340
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret