Function at 0x1400a8e20
Capabilities:
Get memory capacity
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x270
movaps xmmword [rsp + 0x260], xmm6
mov rsi, rcx
mov rax, qword [0x1401fd028]
xor rax, rsp
mov qword [rsp + 0x258], rax
mov qword [rcx + 0x38], rdx
lea rbx, [rsp + 0x134]
xor edi, edi
mov r8d, 0x118
mov rcx, rbx
xor edx, edx
call fcn.14010cff0
mov dword [rbx - 4], 0x11c
mov byte [rbx + 0x116], 1
xor ecx, ecx
mov edx, 0x80
mov r8b, 1
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rsp + 0x130]
mov edx, 0x80
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
sete byte [rsi + 0x4c]
mov dword [rsp + 0xec], 0
movabs r15, 0xaaaaaaaaaaaaaaaa
lea rax, [rsp + 0xe0]
mov qword [rax], r15
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400a8ff0
movaps xmm6, xmmword [0x1401cd260]
lea rbx, [rsp + 0xf0]
movaps xmmword [rbx + 0x20], xmm6
movaps xmmword [rbx + 0x10], xmm6
movaps xmmword [rbx], xmm6
mov dword [rbx + 0x30], 0xaaaaaaaa
lea rax, str.kernel32.dll
lea rdx, [rsp + 0xd0]
mov qword [rdx], rax
mov qword [rdx + 8], 0xc
lea r14, [rsp + 0x130]
mov rcx, r14
call fcn.1400eaf30
mov rcx, r14
mov rdx, rbx
call fcn.1401a8040
mov ebx, eax
mov rcx, r14
call fcn.1400eb080
test bl, bl
jne 0x1400a902c
xorps xmm0, xmm0
lea rcx, [rsp + 0x130]
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x30], xmm0
movaps xmmword [rcx + 0x20], xmm0
movaps xmmword [rcx + 0x10], xmm0
mov dword [rcx], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x1400a8fc9
mov rax, qword [rsp + 0x138]
mov cl, 1
mov byte [rsi + 0x50], cl
mov qword [rsi + 0x58], rax
mov rax, qword [rsp + 0x140]
mov byte [rsi + 0x68], cl
mov qword [rsi + 0x70], rax
mov rax, qword [rsp + 0x148]
mov byte [rsi + 0x80], cl
mov qword [rsi + 0x88], rax
mov rax, qword [rsp + 0x150]
mov byte [rsi + 0x98], cl
mov qword [rsi + 0xa0], rax
mov rcx, qword [rsp + 0x258]
xor rcx, rsp
call fcn.14010aeb0
movaps xmm6, xmmword [rsp + 0x260]
add rsp, 0x270
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rbx, qword [rsp + 0xe0]
lea r8, [rsi + 0x40]
lea rdx, str.CurrentMajorVersionNumber
mov rcx, rbx
call fcn.1401a83d0
test al, al
jne 0x1400a9414
xor edi, edi
test rbx, rbx
je 0x1400a8eed
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400a8eed
mov qword [rsp + 0xc0], r15
movaps xmmword [rsp + 0xb0], xmm6
mov ebx, dword [rsp + 0x10c]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], 0
test bl, 1
je 0x1400a9079
lea rdx, str.Debug_
lea rcx, [rsp + 0x130]
mov r8d, 6
call fcn.1400d9500
test bl, 4
je 0x1400a9098
lea rdx, str.Patched_
lea rcx, [rsp + 0x130]
mov r8d, 8
call fcn.1400d9500
test bl, 2
je 0x1400a90b7
lea rdx, str.Prerelease_
lea rcx, [rsp + 0x130]
mov r8d, 0xb
call fcn.1400d9500
test bl, 8
je 0x1400a90d6
lea rdx, str.Private_
lea rcx, [rsp + 0x130]
mov r8d, 8
call fcn.1400d9500
test bl, 0x20
je 0x1400a90f5
lea rdx, str.Special_
lea rcx, [rsp + 0x130]
mov r8d, 8
call fcn.1400d9500
movzx r9d, byte [rsp + 0x147]
test r9b, r9b
js 0x1400a9109
and r9d, 0x7f
jmp 0x1400a9111
mov r9, qword [rsp + 0x138]
test r9, r9
je 0x1400a9140
dec r9
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x130]
xor r8d, r8d
call fcn.140057250
jmp 0x1400a9177
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0xc0], rax
movaps xmm0, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0xb0], xmm0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], 0
cmp byte [rsp + 0x147], 0
jns 0x1400a918e
mov rcx, qword [rsp + 0x130]
call fcn.1401098c8
lea rbx, [rsp + 0x130]
mov qword [rbx + 0x10], r15
movaps xmmword [rbx], xmm6
mov eax, dword [rsp + 0x110]
not eax
test eax, 0x40004
lea rax, str.Windows_NT
lea rdx, str.Unknown
cmove rdx, rax
mov rcx, rbx
call fcn.140146940
test dil, dil
jne 0x1400a91f9
mov eax, dword [rsp + 0xf8]
mov ecx, eax
shr ecx, 0x10
mov dword [rsi + 0x40], ecx
mov ecx, 0xffff
and eax, ecx
mov dword [rsi + 0x44], eax
mov r8d, dword [rsp + 0xfc]
mov eax, r8d
shr eax, 0x10
mov dword [rsi + 0x48], eax
and r8d, ecx
jmp 0x1400a9201
mov r8d, dword [rsp + 0xec]
lea rdx, [0x1401d74d4]
lea rcx, [rsp + 0x98]
call fcn.1400e2230
lea r15, [rsi + 0x20]
cmp byte [rsi + 0x37], 0
jns 0x1400a9227
mov rcx, qword [r15]
call fcn.1401098c8
mov rax, qword [rsp + 0xa8]
mov qword [r15 + 0x10], rax
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [r15], xmm0
movzx r14d, byte [rsp + 0xc7]
test r14b, r14b
js 0x1400a9253
and r14d, 0x7f
jmp 0x1400a925b
mov r14, qword [rsp + 0xb8]
test r14, r14
jne 0x1400a9367
lea rax, [0x1401d390f]
cmp byte [rsi + 0x37], 0
jns 0x1400a9274
mov r15, qword [r15]
mov ecx, dword [rsi + 0x48]
mov r9d, dword [rsi + 0x40]
mov edx, dword [rsi + 0x44]
cmp byte [rsp + 0x147], 0
jns 0x1400a9290
mov rbx, qword [rsp + 0x130]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str._s__u._u._u._s_s
lea rcx, [rsp + 0x98]
mov r8, rbx
call fcn.1400e2230
lea rdi, [rsi + 8]
cmp byte [rsi + 0x1f], 0
jns 0x1400a92cb
mov rcx, qword [rdi]
call fcn.1401098c8
mov rax, qword [rsp + 0xa8]
mov qword [rdi + 0x10], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rdi], xmm0
mov byte [rsp + 0xaf], al
mov byte [rsp + 0x98], al
test r14, r14
je 0x1400a9330
cmp byte [rsp + 0x97], 0
jns 0x1400a930e
mov rcx, qword [rsp + 0x80]
call fcn.1401098c8
cmp byte [rsp + 0x77], 0
jns 0x1400a931f
mov rcx, qword [rsp + 0x60]
call fcn.1401098c8
cmp byte [rsp + 0x5f], 0
jns 0x1400a9330
mov rcx, qword [rsp + 0x48]
call fcn.1401098c8
cmp byte [rsp + 0x147], 0
jns 0x1400a9347
mov rcx, qword [rsp + 0x130]
call fcn.1401098c8
cmp byte [rsp + 0xc7], 0
jns 0x1400a8f55
mov rcx, qword [rsp + 0xb0]
call fcn.1401098c8
jmp 0x1400a8f55
lea rdx, [0x1401d3973]
lea rdi, [rsp + 0x48]
mov rcx, rdi
call fcn.140146940
lea rdx, [rsp + 0xb0]
movzx eax, byte [rdx + 0x17]
mov r8d, eax
and r8d, 0x7f
test al, al
cmovs r8, qword [rdx + 8]
cmovs rdx, qword [rdx]
mov rcx, rdi
call fcn.1400d9500
movups xmm0, xmmword [rax]
lea rcx, [rsp + 0x60]
movaps xmmword [rcx], xmm0
mov rdx, qword [rax + 0x10]
mov qword [rcx + 0x10], rdx
xor edi, edi
mov qword [rax + 0x10], rdi
xorps xmm6, xmm6
movups xmmword [rax], xmm6
lea rdx, [0x1401d31e4]
mov r8d, 1
call fcn.1400d9500
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x90], rcx
mov qword [rax + 0x10], rdi
movups xmmword [rax], xmm6
cmp byte [rsp + 0x97], 0
jns 0x1400a9407
mov rax, qword [rsp + 0x80]
jmp 0x1400a926b
lea rax, [rsp + 0x80]
jmp 0x1400a926b
lea r8, [rsi + 0x44]
mov rcx, qword [rsp + 0xe0]
lea rdx, str.CurrentMinorVersionNumber
call fcn.1401a83d0
test al, al
je 0x1400a9013
mov rcx, qword [rsp + 0xe0]
mov eax, 0xaaaaaaaa
lea rdx, [rsp + 0xf0]
mov dword [rdx + 7], eax
mov qword [rdx], r15
lea r9, [rsp + 0xb0]
mov dword [r9], eax
lea rax, [rsp + 0x98]
mov dword [rax], 0xa
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rdx, str.CurrentBuildNumber
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400a9013
cmp dword [rsp + 0xb0], 1
jne 0x1400a9013
mov eax, dword [rsp + 0x98]
mov byte [rsp + rax + 0xf0], 0
lea rdi, [rsp + 0x80]
mov dword [rdi], 0xaaaaaaaa
lea r14, [rsp + 0x130]
lea rdx, [rsp + 0xf0]
mov rcx, r14
call fcn.140146940
mov rcx, r14
mov rdx, rdi
call fcn.14009ee50
mov edi, eax
cmp byte [r14 + 0x17], 0
jns 0x1400a94ee
mov rcx, qword [rsp + 0x130]
call fcn.1401098c8
test dil, dil
je 0x1400a9013
mov eax, dword [rsp + 0x80]
mov dword [rsi + 0x48], eax
mov rcx, qword [rsp + 0xe0]
lea rdx, [0x1401e3b0a]
lea r8, [rsp + 0xec]
call fcn.1401a83d0
mov edi, eax
jmp 0x1400a9015