Function at 0x14018bd10
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x1402a76c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rdi, rcx
lea rdx, str.COsVersionInfo::CheckCoreEdition
lea rcx, [rsp + 0x40]
call fcn.14001abe0
nop
lea rbp, [0x1402a8360]
lea rsi, [0x1402bbdb0]
mov rcx, qword [0x1402a8360]
cmp rcx, rbp
je 0x14018bd96
test byte [rcx + 0x1c], 1
je 0x14018bd96
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [0x140267968]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
xor ebx, ebx
lea edx, [rbx + 2]
lea ecx, [rbx + 6]
call fcn.140069da0
test al, al
je 0x14018bf6e
call fcn.14018cde0
test al, al
je 0x14018bf6e
mov rcx, qword [0x1402a8360]
cmp rcx, rbp
je 0x14018bdf0
test byte [rcx + 0x1c], 4
je 0x14018bdf0
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
lea edx, [rbx + 0xd]
lea r8, [0x140267968]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionServerServerLevels
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne case.0x14018c044.15
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ServerCoreExtended
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x14018be4f
lea ebx, [rax - 1]
jmp 0x14018be79
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.NanoServer
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, 1
test eax, eax
cmove ebx, ecx
test rdi, rdi
je case.0x14018c044.15
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [0x1402a8360]
mov cl, 1
mov byte [rsp + 0x48], cl
cmp rax, rbp
je 0x14018bed6
test byte [rax + 0x1c], cl
je 0x14018bed6
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, reloc.WSOCK32.dll_recv
mov dword [rsp + 0x20], ebx
lea r8, [0x140267968]
mov rcx, qword [rax + 0x10]
call fcn.140001b40
movzx ecx, byte [rsp + 0x48]
mov rax, qword [0x1402a8360]
lea rdx, vtable.WppTrace.0
mov qword [rsp + 0x40], rdx
test cl, cl
jne 0x14018bf2f
cmp rax, rbp
je 0x14018bf2f
test byte [rax + 0x1c], 1
je 0x14018bf2f
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
cmp qword [0x1402bbdc8], 8
cmovae rsi, qword [0x1402bbdb0]
mov edx, 0xa
mov qword [rsp + 0x20], rcx
mov r9, rsi
lea r8, [0x140252818]
mov rcx, qword [rax + 0x10]
call fcn.140006c90
lea rcx, [rsp + 0x70]
call fcn.1400048a0
lea rcx, [rsp + 0x50]
call fcn.1400048a0
mov eax, ebx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401e2900
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
xor edx, edx
lea ecx, [rdx + 6]
call fcn.140069da0
test al, al
je case.0x14018c044.15
cmp dword [rdi + 0x5c], ebx
je case.0x14018c044.15
mov rcx, qword [0x1402a8360]
cmp rcx, rbp
je 0x14018bfc3
test byte [rcx + 0x1c], 4
je 0x14018bfc3
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, recv
lea r8, [0x140267968]
mov rcx, qword [rcx + 0x10]
call fcn.140001ad0
mov dword [rsp + 0x30], ebx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.0x14018c044.15
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.0x14018c044.15
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov edx, 0xffffffff
mov ecx, edx
mov r9d, edx
mov r8d, edx
call qword [case.0x1400136d6.0]
test eax, eax
je case.0x14018c044.15
mov eax, dword [rsp + 0x30]
add eax, 0xfffffff4
cmp eax, 0x1d
ja case.0x14018c044.15
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x18c09c]
mov ecx, dword [rdx + rax*4 + 0x18c094]
add rcx, rdx
jmp rcx
mov rax, qword [0x1402a8360]
cmp rax, rbp
je 0x14018c087
test byte [rax + 0x1c], 4
je 0x14018c087
mov r9, rsi
cmp qword [0x1402bbdc8], 8
cmovae r9, qword [0x1402bbdb0]
mov edx, send
lea r8, [0x140267968]
mov rcx, qword [rax + 0x10]
call fcn.140001ad0
mov rax, qword [0x1402a8360]
mov ebx, 1
jmp 0x14018be8e