Function at 0x140023060
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1400db748]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov r14d, 0x200
lea rdx, [0x14007c3c5]
mov r8d, r14d
lea rcx, [rbp + 0x70]
call fcn.140030740
mov r8d, 0x80
lea rdx, [0x14007c3c5]
lea rcx, [rbp - 0x10]
call fcn.140030740
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x98
mov ebx, 0x1869f
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, eax
test eax, eax
jne 0x14002310f
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1400238e1
mov ecx, dword [rsp + 0x60]
mov esi, 2
test ecx, ecx
je 0x1400239e0
sub ecx, 1
je 0x1400238e8
cmp ecx, 1
jne 0x1400239f3
mov edx, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x58]
cmp edx, 6
ja 0x14002322a
jne 0x1400231b1
cmp ecx, 4
ja 0x1400231ed
jne 0x140023161
xor ebx, ebx
cmp byte [rbp - 0x16], 1
setne bl
add ebx, 0x18
jmp 0x140023207
lea eax, [rcx - 2]
cmp eax, 1
ja 0x14002317a
xor ebx, ebx
cmp byte [rbp - 0x16], 1
setne bl
add ebx, 0x16
jmp 0x1400231fc
cmp ecx, 1
jne 0x14002319c
xor ebx, ebx
lea rdx, [rbp + 0x70]
cmp byte [rbp - 0x16], cl
lea rcx, [rbp - 0x10]
setne bl
add ebx, 0x14
call fcn.140024160
jmp 0x1400233b4
test ecx, ecx
jne 0x1400231fc
xor ebx, ebx
cmp byte [rbp - 0x16], 1
setne bl
add ebx, 0x12
jmp 0x14002327f
cmp edx, 5
jne 0x1400231e3
mov ecx, dword [rsp + 0x58]
cmp ecx, esi
jb 0x1400231c6
lea ebx, [rdx + 8]
jmp 0x14002329b
cmp ecx, 1
jne 0x1400231d3
lea ebx, [rcx + 8]
jmp 0x1400232c3
test ecx, ecx
jne 0x14002329b
lea ebx, [rcx + 5]
jmp 0x1400232e6
cmp edx, 4
ja 0x1400231ed
mov ebx, 4
cmp edx, 6
ja 0x140023324
jne 0x140023296
cmp ecx, 4
ja 0x14002334a
jne 0x140023244
mov edx, dword [rsp + 0x5c]
lea rax, [rbp + 0x70]
lea r9, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r8d, ebx
mov ecx, 4
call fcn.140024060
jmp 0x1400233b4
cmp edx, 0xa
jne 0x1400231ed
test ecx, ecx
jne 0x1400231ed
xor ebx, ebx
cmp byte [rbp - 0x16], 1
setne bl
add ebx, 0x18
jmp 0x14002332d
lea eax, [rcx - 2]
cmp eax, 1
ja 0x140023260
lea r9, [rbp + 0x70]
mov edx, ebx
lea r8, [rbp - 0x10]
call fcn.140024390
jmp 0x1400233b4
cmp ecx, 1
jne 0x140023277
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x10]
call fcn.140024160
jmp 0x1400233b4
test ecx, ecx
jne 0x140023305
lea r8, [rbp + 0x70]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140023b60
jmp 0x1400233b4
cmp edx, 5
jne 0x140023305
cmp ecx, esi
jne 0x1400232be
mov r8, r14
lea rdx, str.Windows_2003
lea rcx, [rbp + 0x70]
call fcn.140030740
lea rdx, str.win2003
jmp 0x1400233a5
cmp ecx, 1
jne 0x1400232e2
mov r8, r14
lea rdx, str.Windows_XP
lea rcx, [rbp + 0x70]
call fcn.140030740
lea rdx, str.winXP
jmp 0x1400233a5
test ecx, ecx
jne 0x140023305
mov r8, r14
lea rdx, str.Windows_2000
lea rcx, [rbp + 0x70]
call fcn.140030740
lea rdx, str.win2000
jmp 0x1400233a5
mov r8, r14
lea rdx, str.Windows_NT
lea rcx, [rbp + 0x70]
call fcn.140030740
lea rdx, str.winNT
jmp 0x1400233a5
cmp edx, 0xa
jne 0x14002334a
test ecx, ecx
jne 0x14002334a
mov edx, dword [rsp + 0x5c]
lea rax, [rbp + 0x70]
lea r9, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r8d, ebx
xor ecx, ecx
call fcn.140024060
jmp 0x1400233b4
mov dword [rsp + 0x28], ecx
lea r9, str.Windows_Unknown
mov dword [rsp + 0x20], edx
lea r8, str._s_Version__d._d
mov rdx, r14
lea rcx, [rbp + 0x70]
call fcn.140030680
call fcn.1400247e0
lea rcx, [rbp + 0x70]
mov r8, r14
cmp eax, 0x40
jne 0x140023392
lea rdx, str.__64_bit
call fcn.1400306c0
lea rdx, str.windowsUnknown_64
jmp 0x1400233a5
lea rdx, str.__32_bit
call fcn.1400306c0
lea rdx, str.windowsUnknown
mov r8d, 0x80
lea rcx, [rbp - 0x10]
call fcn.140030740
test edi, edi
je 0x14002368e
movzx eax, byte [rbp - 0x16]
cmp al, 1
jne 0x1400234ca
cmp dword [rsp + 0x54], 4
jne 0x1400233f3
mov r8, r14
lea rdx, [0x1400847e8]
lea rcx, [rbp + 0x70]
mov ebx, 4
call fcn.1400306c0
lea rdx, str.Workstation_4.0
jmp 0x1400237fa
cmp dword [rsp + 0x54], 5
jne 0x140023806
mov eax, dword [rsp + 0x58]
cmp eax, esi
jne 0x140023437
mov r8, r14
lea rdx, str.Windows_XP_Professional_x64_Edition
lea rcx, [rbp + 0x70]
mov ebx, listen
call fcn.140030740
lea r8d, [rbx + 0x74]
lea rdx, str.winXPPro_64
lea rcx, [rbp - 0x10]
call fcn.140030740
jmp 0x140023806
cmp eax, 1
jne 0x140023493
movzx ebx, word [rbp - 0x18]
lea rax, str.Windows_XP_Professional
and bx, r14w
lea rdx, str.Windows_XP_Home_Edition
mov r8, r14
lea rcx, [rbp + 0x70]
cmove rdx, rax
call fcn.140030740
lea rax, str.winXPPro
test bx, bx
lea rdx, str.winXPHome
mov r8d, 0x80
cmove rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140030740
neg bx
sbb ebx, ebx
add ebx, 0xb
jmp 0x140023806
test eax, eax
jne 0x140023897
mov r8, r14
lea rdx, str.Windows_2000_Professional
lea rcx, [rbp + 0x70]
lea ebx, [rax + 6]
call fcn.140030740
lea r8d, [rbx + 0x7a]
lea rdx, str.win2000Pro
lea rcx, [rbp - 0x10]
call fcn.140030740
jmp 0x140023806
sub al, sil
cmp al, 1
ja 0x140023806
cmp dword [rsp + 0x54], 5
jne 0x140023806
mov eax, dword [rsp + 0x58]
cmp eax, esi
jne 0x1400235f4
movzx eax, byte [rbp - 0x18]
mov ebx, reloc.WS2_32.dll_ntohs
test al, al
jns 0x140023511
mov ebx, select
lea rdi, str.winNetDatacenter
lea rdx, str.Windows_Server_2003_Datacenter_Edition
jmp 0x1400235a8
test sil, al
je 0x14002352b
mov ebx, reloc.WS2_32.dll_recv
lea rdi, str.winNetEnterprise
lea rdx, str.Windows_Server_2003_Enterprise_Edition
jmp 0x1400235a8
movzx ecx, word [rbp - 0x18]
mov edx, 0x400
test dx, cx
je 0x14002354e
mov ebx, select
lea rdi, str.winNetWeb
lea rdx, str.Windows_Server_2003_Web_Edition
jmp 0x1400235a8
mov edx, 0x4000
test dx, cx
je 0x140023568
lea rdi, str.winNetComputeCluster
lea rdx, str.Windows_Server_2003_Compute_Cluster_Edition
jmp 0x1400235a8
mov edx, 0x2000
test dx, cx
je 0x140023582
lea rdi, str.winNetStorageSvr
lea rdx, str.Windows_Storage_Server_2003
jmp 0x1400235a8
test al, 1
je 0x14002359a
test al, 0x20
je 0x14002359a
lea rdi, str.winNetBusiness
lea rdx, str.Windows_Server_2003_Small_Business
jmp 0x1400235a8
lea rdi, str.winNetStandard
lea rdx, str.Windows_Server_2003_Standard_Edition
mov r8, r14
lea rcx, [rbp + 0x70]
call fcn.140030740
mov r8d, 0x80
lea rcx, [rbp - 0x10]
mov rdx, rdi
call fcn.140030740
call fcn.1400247e0
cmp eax, 0x40
jne 0x140023806
lea r8d, [rax + 0x40]
lea rdx, [0x140087168]
lea rcx, [rbp - 0x10]
call fcn.1400306c0
lea rdx, str.__64_bit_
jmp 0x1400237fa
test eax, eax
jne 0x140023897
movzx eax, byte [rbp - 0x18]
lea rcx, [rbp + 0x70]
mov r8, r14
test al, al
jns 0x140023635
lea rdx, str.Windows_2000_Data_Center_Server
mov ebx, 7
call fcn.140030740
lea r8d, [rbx + 0x79]
lea rdx, str.win2000DataCentServ
lea rcx, [rbp - 0x10]
call fcn.140030740
jmp 0x140023806
test sil, al
je 0x140023664
lea rdx, str.Windows_2000_Advanced_Server
mov ebx, 8
call fcn.140030740
lea r8d, [rbx + 0x78]
lea rdx, str.win2000AdvServ
lea rcx, [rbp - 0x10]
call fcn.140030740
jmp 0x140023806
lea rdx, str.Windows_2000_Server
mov ebx, 7
call fcn.140030740
lea r8d, [rbx + 0x79]
lea rdx, str.win2000Serv
lea rcx, [rbp - 0x10]
call fcn.140030740
jmp 0x140023806
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], 0xc8
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400238e1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.ProductType
lea rax, [rbp + 0x2e0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400238e1
cmp dword [rsp + 0x30], 0x64
ja 0x1400238e1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
lea rdx, str.WINNT
lea r8, [rbp + 0x2e0]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140023755
cmp rcx, 6
jne 0x140023721
mov r8, r14
lea rdx, [0x1400847e8]
lea rcx, [rbp + 0x70]
call fcn.1400306c0
lea rdx, str.Workstation
jmp 0x1400237fa
mov rdx, 0xffffffffffffffff
lea r8, str.LANMANNT
mov rcx, rdx
lea r9, [rbp + 0x2e0]
nop dword [rax]
movzx eax, word [r8 + rcx*2 + 2]
cmp ax, word [r9 + rcx*2 + 2]
jne 0x140023793
add rcx, rsi
cmp rcx, 9
je 0x1400237c4
movzx eax, word [r8 + rcx*2]
cmp ax, word [r9 + rcx*2]
je 0x140023770
lea rcx, str.SERVERNT
lea r8, [rbp + 0x2e0]
movzx eax, word [rcx + rdx*2 + 2]
cmp ax, word [r8 + rdx*2 + 2]
jne 0x140023806
add rdx, rsi
cmp rdx, 9
je 0x1400237e0
movzx eax, word [rcx + rdx*2]
cmp ax, word [r8 + rdx*2]
je 0x1400237a1
jmp 0x140023806
mov r8, r14
lea rdx, [0x1400847e8]
lea rcx, [rbp + 0x70]
call fcn.1400306c0
lea rdx, str.Server
jmp 0x1400237fa
mov r8, r14
lea rdx, [0x1400847e8]
lea rcx, [rbp + 0x70]
call fcn.1400306c0
lea rdx, str.Advanced_Server
mov r8, r14
lea rcx, [rbp + 0x70]
call fcn.1400306c0
cmp dword [rsp + 0x54], 4
jne 0x140023897
lea rdx, str.Service_Pack_6
lea rcx, [rsp + 0x64]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140023897
lea rax, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
mov rcx, 0xffffffff80000002
call fcn.1400286d0
movzx ecx, word [rsp + 0x5c]
test eax, eax
lea rax, str.Service_Pack_6a
je 0x140023862
lea rax, [rsp + 0x64]
mov dword [rsp + 0x28], ecx
lea r9, [0x1400847e8]
lea rcx, [rbp + 0x270]
mov qword [rsp + 0x20], rax
lea r8, str._s_s__Build__d_
mov edx, 0x64
call fcn.140030680
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400238c9
movzx eax, word [rsp + 0x5c]
lea r9, [0x1400847e8]
mov dword [rsp + 0x28], eax
lea r8, str._s_s__Build__d_
lea rax, [rsp + 0x64]
mov edx, 0x64
lea rcx, [rbp + 0x270]
mov qword [rsp + 0x20], rax
call fcn.140030680
mov r8, r14
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x70]
call fcn.1400306c0
jmp 0x1400239f3
xor al, al
jmp 0x140023ac2
cmp dword [rsp + 0x54], 4
jne 0x1400239f3
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x14002394c
mov r8, r14
lea rdx, str.Windows_95
lea rcx, [rbp + 0x70]
lea ebx, [rax + 1]
call fcn.140030740
lea r8d, [rbx + 0x7f]
lea rdx, str.win95
lea rcx, [rbp - 0x10]
call fcn.140030740
movzx eax, byte [rsp + 0x65]
sub al, 0x42
cmp al, bl
ja 0x1400239a9
mov r8, r14
lea rdx, [0x1400847e8]
lea rcx, [rbp + 0x70]
call fcn.1400306c0
lea rdx, str.OSR2
jmp 0x14002399d
cmp eax, 0xa
jne 0x1400239b4
mov r8, r14
lea rdx, str.Windows_98
lea rcx, [rbp + 0x70]
mov ebx, esi
call fcn.140030740
mov r8d, 0x80
lea rdx, str.win98
lea rcx, [rbp - 0x10]
call fcn.140030740
cmp byte [rsp + 0x65], 0x41
jne 0x1400239a9
mov r8, r14
lea rdx, [0x1400847e8]
lea rcx, [rbp + 0x70]
call fcn.1400306c0
lea rdx, [0x140087394]
mov r8, r14
lea rcx, [rbp + 0x70]
call fcn.1400306c0
cmp dword [rsp + 0x54], 4
jne 0x1400239f3
mov eax, dword [rsp + 0x58]
cmp eax, 0x5a
jne 0x1400239f3
mov r8, r14
lea rdx, str.Windows_Me
lea rcx, [rbp + 0x70]
lea ebx, [rax - 0x57]
call fcn.140030740
lea r8d, [rbx + 0x7d]
lea rdx, str.winMe
lea rcx, [rbp - 0x10]
jmp 0x1400239ee
mov r8, r14
lea rdx, str.Windows_32s
lea rcx, [rbp + 0x70]
call fcn.140030740
lea eax, [rbx - 1]
cmp eax, 0x18
ja case.default.0x140023a0e
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x23af0]
add rcx, rdx
jmp rcx
mov esi, 1
jmp case.0x140023a0e.2
mov esi, 3
jmp case.0x140023a0e.2
mov esi, 4
jmp case.0x140023a0e.2
mov esi, 5
jmp case.0x140023a0e.2
mov esi, 6
jmp case.0x140023a0e.2
mov esi, 7
jmp case.0x140023a0e.2
mov esi, 8
jmp case.0x140023a0e.2
mov esi, 9
jmp case.0x140023a0e.2
mov esi, 0xa
jmp case.0x140023a0e.2
mov esi, listen
jmp case.0x140023a0e.2
mov esi, 0x1869f
nop dword [rax + rax]
mov eax, 1
xchg dword [0x140105200], eax
test eax, eax
jne case.0x140023a0e.2
movzx eax, byte [0x14010528c]
test al, al
jne 0x140023ab6
mov r8d, 0x80
mov dword [0x1401051f8], esi
lea rdx, [rbp - 0x10]
mov dword [0x1401051fc], ebx
lea rcx, [0x140108620]
call fcn.140030740
mov r8, r14
lea rdx, [rbp + 0x70]
lea rcx, [0x140108420]
call fcn.140030740
mov byte [0x14010528c], 1
mov dword [0x140105200], 0
mov al, 1
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.14006a480
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret