Function at 0x14002a620
Capabilities:
Check os version
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x280
mov rax, qword [0x140075238]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov r11, qword [rsp + 0x2d0]
lea rax, [0x140075050]
mov qword [rsp + 0x2b0], rbp
xor r12d, r12d
mov qword [rsp + 0x278], r14
mov esi, ecx
mov qword [rsp + 0x48], r11
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov edi, r12d
mov qword [rsp + 0x270], r15
mov rbx, r9
mov dword [rsp + 0x30], r8d
mov r13, rdx
cmp esi, dword [rax]
je 0x14002a69b
inc edi
add rax, 0x28
cmp rax, rcx
jl 0x14002a687
jmp 0x14002a93e
cmp edi, 0xffffffff
je 0x14002a93e
mov r15, r12
mov rbp, r12
cmp r11, 0xffffffffffffffff
je 0x14002a6e2
lea rcx, str.Userenv.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
test rax, rax
je 0x14002a6d8
lea rdx, str.ExpandEnvironmentStringsForUserW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
mov r11, qword [rsp + 0x48]
mov r8d, dword [rsp + 0x30]
movsxd rdx, edi
lea r10, [rdx + rdx*4]
lea r14, [r10*8]
lea rdx, [0x140075050]
mov rcx, qword [r14 + rdx + 0x20]
test rcx, rcx
je 0x14002a73f
test r15, r15
je 0x14002a726
mov r9d, r8d
mov rdx, rcx
mov r8, r13
mov rcx, r11
call r15
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x14002a943
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x14002a943
cmp esi, 0x23
jne 0x14002a7ea
xor edx, edx
mov dword [rsp + 0x50], 0x11c
mov r8d, 0x100
mov qword [rsp + 0x5c], r12
lea rcx, [rsp + 0x64]
call fcn.14002f630
xor eax, eax
mov word [rsp + 0x166], r12w
mov r8b, 3
mov dword [rsp + 0x168], eax
lea edx, [rsi - 0x21]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rsi - 0x22]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rsi - 3]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, esi
mov qword [rsp + 0x54], 6
mov r8, rax
mov word [rsp + 0x164], r12w
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea rdx, [0x140075050]
test eax, eax
jne 0x14002a7ea
mov rax, qword [str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders]
mov qword [r14 + rdx + 0x10], rax
mov rax, qword [str.Common_AppData]
mov qword [r14 + rdx + 0x18], rax
mov edi, r12d
mov r12d, dword [rsp + 0x2d8]
test r12d, r12d
jle 0x14002a930
xor eax, eax
mov qword [rsp + 0x38], rax
mov rcx, rbx
test rbx, rbx
jne 0x14002a812
mov rcx, qword [r14 + rdx + 8]
mov rdx, qword [r14 + rdx + 0x10]
lea rax, [rsp + 0x38]
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x14002a8ad
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.14002f630
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140075050]
mov rdx, qword [r14 + rdx + 0x18]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x14002a8a2
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002a893
test rax, rax
jne 0x14002a8e4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x14002a8cf
cmp edi, 5
jbe 0x14002a8cf
test esi, esi
mov eax, 0
cmovne rbx, rax
jmp 0x14002a8d1
xor eax, eax
inc edi
cmp edi, r12d
jge 0x14002a930
lea rdx, [0x140075050]
jmp 0x14002a800
test r15, r15
je 0x14002a900
mov r9d, dword [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov r8, r13
call r15
jmp 0x14002a913
mov r8d, dword [rsp + 0x30]
lea rcx, [rsp + 0x50]
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbp, rbp
je 0x14002a92c
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x14002a943
test rbp, rbp
je 0x14002a93e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 0x80004005
mov r15, qword [rsp + 0x270]
mov r14, qword [rsp + 0x278]
mov rbp, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14002d580
add rsp, 0x280
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret