Function at 0x1400dd5a0
Capabilities:
Check os version
Delete registry value
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0xa0], rax
mov r15d, r9d
mov r14, r8
mov r12, rcx
xor sil, sil
lea rcx, [0x14018ed50]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea r8, str.Procexp32bitServerEvent
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_OpenEventW]
test rax, rax
jne 0x1400dd63c
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareSysinternalsProcess_Explorer
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400dd645
lea rdx, str.OriginalPath
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400dd645
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor r13d, r13d
mov dword [0x1401896c8], r13d
cmp al, 0xa
jb 0x1400dd665
mov dword [0x1401896c8], 5
jmp 0x1400dd6ab
cmp al, 6
jb 0x1400dd6ab
movzx eax, ax
shr eax, 8
test eax, eax
je 0x1400dd6a1
sub eax, 1
je 0x1400dd695
cmp eax, 1
je 0x1400dd689
mov dword [0x1401896c8], 4
jmp 0x1400dd6ab
mov dword [0x1401896c8], 3
jmp 0x1400dd6ab
mov dword [0x1401896c8], 2
jmp 0x1400dd6ab
mov dword [0x1401896c8], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov r9d, r13d
mov dword [rsp + 0x30], r13d
mov qword [0x14018ed20], r14
mov qword [rbp - 0x60], r14
cmp word [r14], r13w
je 0x1400dd768
nop dword [rax]
mov r8d, r13d
mov rdx, r13
movsxd rax, r9d
mov rcx, qword [rbp + rax*8 - 0x60]
movzx eax, word [rcx]
test ax, ax
je 0x1400dd718
cmp ax, 0x20
je 0x1400dd70b
inc r8d
inc rdx
movzx eax, word [rcx + rdx*2]
test ax, ax
jne 0x1400dd6f6
test rdx, rdx
je 0x1400dd718
inc r9d
mov dword [rsp + 0x30], r9d
lea eax, [r9 - 1]
movsxd rcx, eax
mov rax, qword [rbp + rcx*8 - 0x60]
cmp word [rax + rdx*2], r13w
je 0x1400dd768
mov word [rax + rdx*2], r13w
movsxd r9, dword [rsp + 0x30]
lea eax, [r9 - 1]
cdqe
movsxd rdx, r8d
mov rax, qword [rbp + rax*8 - 0x60]
add rax, 2
lea rdx, [rax + rdx*2]
mov qword [rbp + r9*8 - 0x60], rdx
cmp r9d, 0x20
je 0x1400dd768
movzx eax, word [rdx]
cmp ax, 0x20
je 0x1400dd6e0
test ax, ax
jne 0x1400dd6e0
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x30]
lea rcx, [0x14011f590]
call fcn.14005e740
test eax, eax
je 0x1400dd96a
mov ebx, r13d
cmp dword [rsp + 0x30], r13d
jle 0x1400dd999
lea rdi, [rbp - 0x60]
nop word [rax + rax]
mov rcx, qword [rdi]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rcx + rdx*2], r13w
jne 0x1400dd7b0
inc rdx
call fcn.1400e926c
mov r8, qword [rdi]
movzx eax, word [r8]
sub ax, 0x2d
mov ecx, 0xfffd
test cx, ax
jne 0x1400dd918
movzx ecx, word [r8 + 2]
sub ecx, 0x45
je 0x1400dd89c
sub ecx, 0xb
je 0x1400dd82d
sub ecx, 2
je 0x1400dd8f6
sub ecx, 1
je 0x1400dd810
cmp ecx, 1
jne 0x1400dd8b9
mov byte [0x14018ed18], cl
jmp 0x1400dd8a8
cmp word [r8 + 4], 0x3a
jne 0x1400dd8ef
lea rcx, [r8 + 6]
call fcn.1400f7970
mov dword [0x14016fa34], eax
jmp 0x1400dd8a8
cmp word [r8 + 4], 0x3a
jne 0x1400dd8ef
movzx eax, word [r8 + 6]
cmp ax, 0x48
je 0x1400dd8a8
cmp ax, 0x4c
je 0x1400dd886
cmp ax, 0x4e
je 0x1400dd870
cmp ax, 0x52
jne 0x1400dd8ef
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x100
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x1400dd8a8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x1400dd8a8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x40
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
jmp 0x1400dd8a8
cmp dword [0x1401896c8], 1
jl 0x1400dd8ef
mov sil, 1
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x30]
jge 0x1400dd92c
jmp 0x1400dd7a0
mov r9d, 0x40
lea r8, [0x14011f590]
xor ecx, ecx
cmp dword [0x1401896c8], 1
lea rdx, str.Usage:_Process_Explorer___e____t____p:_rhl_____s:_PID___n_n_e_tRequest_UAC_elevation_n_t_tStart_minimized_in_the_tray_n_p_tRun_at_priority:_realtime__r___high__h___normal__n__or_low__l__n_s_tSelect_the_specified_process_n
jge 0x1400dd8df
lea rdx, str.Usage:_Process_Explorer___t____p:_rhl_____s:_PID___n_n_t_tStart_minimized_in_the_tray_n_p_tRun_at_priority:_realtime__r___high__h___normal__n__or_low__l__n_s_tSelect_the_specified_process_n
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 0xffffffff
jmp 0x1400dd96f
call fcn.1400dd560
jmp 0x1400dd96f
movsxd rax, ebx
mov rcx, qword [rbp + rax*8 - 0x60]
cmp word [rcx + 4], 0x54
jne 0x1400dd8ef
xor r8d, r8d
xor edx, edx
xor r9d, r9d
xor ecx, ecx
call fcn.14009d860
xor eax, eax
jmp 0x1400dd96f
lea rdx, str.TASKMGR
mov rcx, r8
call fcn.1400e3cd4
test rax, rax
je 0x1400dd8ef
test sil, sil
je 0x1400dd999
call fcn.14008f340
test al, al
jne 0x1400dd999
xor r8d, r8d
mov edx, r15d
mov rcx, r14
call fcn.14008df10
test eax, eax
je 0x1400ddd7c
cmp eax, 0x4c7
je 0x1400dd96a
mov rdx, qword [0x14018ec78]
lea rcx, str.Error_elevating
call fcn.1400c56e0
mov eax, 1
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1400e17a0
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x38], 8
mov dword [rsp + 0x3c], 0x407
lea rcx, [rsp + 0x38]
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
xor r9d, r9d
mov r8, qword [0x1401896c0]
xor edx, edx
lea rcx, [0x1401a9580]
call fcn.1400da380
lea r14, vtable.WTL::CMessageLoop.0
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rbp - 0x78], xmm0
mov rsi, qword [0x140179560]
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401a95d8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
mov ecx, dword [rbx + 0x10]
inc ecx
movsxd rdx, ecx
mov r8d, 4
mov rcx, qword [rbx]
call fcn.1400fbac0
test rax, rax
je 0x1400dda85
mov qword [rbx], rax
mov eax, dword [rbx + 0x10]
inc eax
movsxd rdx, eax
mov r8d, 8
mov rcx, qword [rbx + 8]
call fcn.1400fbac0
test rax, rax
je 0x1400dda85
mov qword [rbx + 8], rax
movsxd rdx, dword [rbx + 0x10]
mov rax, qword [rbx]
lea rcx, [rax + rdx*4]
test rcx, rcx
je 0x1400dda6d
mov dword [rcx], edi
mov rax, qword [rbx + 8]
lea rcx, [rax + rdx*8]
test rcx, rcx
je 0x1400dda82
lea rax, [rsp + 0x40]
mov qword [rcx], rax
inc dword [rbx + 0x10]
lea rcx, [rsi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.140050810
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, rax
mov rcx, rbx
call fcn.1400517b0
mov edx, r15d
mov rcx, r12
call fcn.140073c30
test eax, eax
je 0x1400ddd4f
mov ebx, r13d
mov edi, 1
test edi, edi
je 0x1400ddb04
nop word [rax + rax]
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x1400ddb04
mov rax, qword [rsp + 0x40]
mov edx, ebx
inc ebx
lea rcx, [rsp + 0x40]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
test eax, eax
jne 0x1400ddad0
mov edi, r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_GetMessageW]
cmp eax, 0xffffffff
je 0x1400ddac3
test eax, eax
je 0x1400ddb6b
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x1400ddb4c
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x68]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x40]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
je 0x1400ddac3
jmp 0x1400ddabb
mov rdi, qword [0x140179560]
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401a95d8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8d, r13d
movsxd rcx, dword [rbx + 0x10]
test ecx, ecx
jle 0x1400ddbc6
mov r9, rcx
mov rdx, r13
mov rcx, qword [rbx]
nop dword [rax]
cmp dword [rcx], eax
je 0x1400ddbb5
inc r8d
inc rdx
add rcx, 4
cmp rdx, r9
jl 0x1400ddba0
jmp 0x1400ddbc6
cmp r8d, 0xffffffff
je 0x1400ddbc6
mov edx, r8d
mov rcx, rbx
call fcn.1400dc4e0
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, qword [0x140179560]
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401a95e0]
test rbx, rbx
je 0x1400ddc2c
cmp dword [rbx + 8], r13d
jle 0x1400ddc06
mov rcx, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov rbx, qword [0x1401a95e0]
test rbx, rbx
je 0x1400ddc2c
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400ddc1b
call fcn.1400e825c
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rbx
call fcn.1400e0fb8
mov qword [0x1401a95e0], r13
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [0x1401a95d8]
test rbx, rbx
je 0x1400ddc7d
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400ddc59
call fcn.1400e825c
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400ddc6b
call fcn.1400e825c
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], r13d
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400e0fb8
nop
mov rbx, qword [0x1401a95c8]
test rbx, rbx
je 0x1400ddcb5
cmp qword [rbx], 0
je 0x1400ddcb5
nop
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400ddc9f
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov qword [rbx + 0x20], r13
mov rax, qword [rbx + 0x40]
xor ecx, ecx
call rax
add rbx, 0x48
cmp qword [rbx], 0
jne 0x1400ddc90
mov rbx, qword [0x140173280]
mov rcx, qword [0x140173288]
cmp rbx, rcx
jae 0x1400ddce8
mov rax, qword [rbx]
test rax, rax
je 0x1400ddcdf
mov rax, qword [rax + 0x38]
xor ecx, ecx
call rax
mov rcx, qword [0x140173288]
add rbx, 8
cmp rbx, rcx
jb 0x1400ddcc8
cmp dword [0x1401a9588], 0
je 0x1400ddd4f
mov rdi, qword [0x1401a9590]
test rdi, rdi
je 0x1400ddd29
nop dword [rax]
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
call rax
mov rbx, qword [rdi + 0x10]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rdi
call fcn.1400e0fb8
mov rdi, rbx
test rbx, rbx
jne 0x1400ddd00
mov qword [0x1401a9590], r13
mov rcx, qword [0x1401a95c0]
test rcx, rcx
je 0x1400ddd3b
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [0x1401a9598]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [0x1401a9588], r13d
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400ddd68
call fcn.1400e825c
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400ddd7c
call fcn.1400e825c
xor eax, eax
jmp 0x1400dd96f