Function at 0x180005ce0
Capabilities:
Get system information on windows

Disassembly:
mov r11, rsp
sub rsp, 0x98
mov qword [r11 + 0x10], rbp
mov qword [r11 - 8], rdi
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x20], r14
mov r12, rdx
lea rax, [r11 + 0x18]
mov rbp, rcx
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
xor r14d, r14d
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [r11 - 0x28], r15
mov qword [r11 + 0x18], r14
mov qword [r11 - 0x78], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r15d, 0x7ffffffe
lea rdi, [0x180000000]
test eax, eax
jne 0x18000617b
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xa0], rbx
lea rdx, str.ProductName
mov qword [rsp + 0xb8], rsi
mov r9, r12
mov r8, rbp
mov qword [rsp + 0x80], r13
mov r13, qword [rbp]
call fcn.1800039b0
test al, al
je 0x180005e24
mov r10, qword [rbp]
mov r9, qword [r12]
test r10, r10
jne 0x180005d99
test r9, r9
jne 0x180005e27
cmp r9, 0x7fffffff
ja 0x180005e27
test r9, r9
jne 0x180005dba
test r10, r10
je 0x180005e27
mov qword [rbp], r10
mov qword [r12], r9
jmp 0x180005e27
mov r11, r15
mov rcx, r9
mov r8, r10
mov ebx, r14d
mov rdx, r14
sub r11, r9
nop dword [rax]
lea rax, [r11 + rcx]
test rax, rax
je 0x180005df5
movzx eax, byte [rdx + rdi + 0x31b20]
test al, al
je 0x180005df5
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x180005dd0
jmp 0x180005dfa
test rcx, rcx
jne 0x180005e05
dec r8
mov ebx, 0x8007007a
dec rdx
add r10, rdx
sub r9, rdx
mov byte [r8], r14b
test ebx, ebx
jns 0x180005e1a
cmp ebx, 0x8007007a
jne 0x180005e27
mov qword [rbp], r10
mov qword [r12], r9
jmp 0x180005e27
mov r13, r14
mov rcx, qword [rsp + 0xb0]
lea rdx, str.CSDVersion
mov r9, r12
mov r8, rbp
call fcn.1800039b0
test al, al
je 0x180005ed4
mov r10, qword [rbp]
mov r9, qword [r12]
test r10, r10
jne 0x180005e5b
test r9, r9
jne 0x180005ed4
cmp r9, 0x7fffffff
ja 0x180005ed4
test r9, r9
jne 0x180005e70
test r10, r10
je 0x180005ed4
jmp 0x180005ecc
mov r11, r15
mov rcx, r9
mov r8, r10
mov ebx, r14d
mov rdx, r14
sub r11, r9
lea rax, [r11 + rcx]
test rax, rax
je 0x180005ea7
movzx eax, byte [rdx + rdi + 0x31b20]
test al, al
je 0x180005ea7
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x180005e82
jmp 0x180005eac
test rcx, rcx
jne 0x180005eb7
dec r8
mov ebx, 0x8007007a
dec rdx
add r10, rdx
sub r9, rdx
mov byte [r8], r14b
test ebx, ebx
jns 0x180005ecc
cmp ebx, 0x8007007a
jne 0x180005ed4
mov qword [rbp], r10
mov qword [r12], r9
mov rcx, qword [rsp + 0xb0]
lea rdx, str.DisplayVersion
mov r9, r12
mov r8, rbp
call fcn.1800039b0
test al, al
jne 0x180005f14
mov rcx, qword [rsp + 0xb0]
lea rdx, str.ReleaseId
mov r9, r12
mov r8, rbp
call fcn.1800039b0
test al, al
je 0x180005fa2
mov r10, qword [rbp]
mov r9, qword [r12]
test r10, r10
jne 0x180005f26
test r9, r9
jne 0x180005fa2
cmp r9, 0x7fffffff
ja 0x180005fa2
test r9, r9
jne 0x180005f3b
test r10, r10
je 0x180005fa2
jmp 0x180005f9a
mov r11, r15
mov rcx, r9
mov r8, r10
mov ebx, r14d
mov rdx, r14
sub r11, r9
nop dword [rax]
lea rax, [r11 + rcx]
test rax, rax
je 0x180005f75
movzx eax, byte [rdx + rdi + 0x31b20]
test al, al
je 0x180005f75
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x180005f50
jmp 0x180005f7a
test rcx, rcx
jne 0x180005f85
dec r8
mov ebx, 0x8007007a
dec rdx
add r10, rdx
sub r9, rdx
mov byte [r8], r14b
test ebx, ebx
jns 0x180005f9a
cmp ebx, 0x8007007a
jne 0x180005fa2
mov qword [rbp], r10
mov qword [r12], r9
mov rsi, qword [rbp]
mov rbx, qword [r12]
test rsi, rsi
jne 0x180005fb8
test rbx, rbx
jne 0x180006049
cmp rbx, 0x7fffffff
ja 0x180006049
mov rcx, rsi
mov rax, rbx
test rbx, rbx
jne 0x180005fd7
test rsi, rsi
je 0x180006049
jmp 0x180006041
mov r9, r15
mov rcx, rbx
mov r8, rsi
mov r10d, r14d
mov rdx, r14
sub r9, rbx
nop dword [rax]
lea rax, [r9 + rcx]
test rax, rax
je 0x180006015
movzx eax, byte [rdx + rdi + 0x31ca0]
test al, al
je 0x180006015
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x180005ff0
jmp 0x18000601a
test rcx, rcx
jne 0x180006026
dec r8
mov r10d, 0x8007007a
dec rdx
mov rax, rbx
mov byte [r8], r14b
lea rcx, [rdx + rsi]
sub rax, rdx
test r10d, r10d
jns 0x180006041
cmp r10d, 0x8007007a
jne 0x180006049
mov qword [rbp], rcx
mov qword [r12], rax
mov rcx, qword [rsp + 0xb0]
mov rdi, qword [rbp]
lea rdx, str.CurrentBuildNumber
mov r9, r12
mov r8, rbp
call fcn.1800039b0
test al, al
je 0x180006154
test r13, r13
je 0x1800060a9
mov rax, qword [rbp]
sub rax, r13
cmp rax, 0xa
jl 0x1800060a9
cmp byte [r13 + 8], 0x31
jne 0x1800060a9
cmp byte [r13 + 9], 0x30
jne 0x1800060a9
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 0xa]
call fcn.180015e8c
cmp eax, 0x55f0
jl 0x1800060a9
mov byte [r13 + 9], 0x31
mov r10, qword [rbp]
mov r9, qword [r12]
test r10, r10
jne 0x1800060bf
test r9, r9
jne 0x18000615c
cmp r9, 0x7fffffff
ja 0x18000615c
test r9, r9
jne 0x1800060e4
test r10, r10
je 0x18000615c
mov qword [rbp], r10
mov qword [r12], r9
jmp 0x18000615c
mov r11, r15
mov rcx, r9
mov r8, r10
mov ebx, r14d
mov rdx, r14
lea rdi, [0x180000000]
sub r11, r9
nop dword [rax]
lea rax, [r11 + rcx]
test rax, rax
je 0x180006125
movzx eax, byte [rdx + rdi + 0x31c80]
test al, al
je 0x180006125
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x180006100
jmp 0x18000612a
test rcx, rcx
jne 0x180006135
dec r8
mov ebx, 0x8007007a
dec rdx
add r10, rdx
sub r9, rdx
mov byte [r8], r14b
test ebx, ebx
jns 0x18000614a
cmp ebx, 0x8007007a
jne 0x180006163
mov qword [rbp], r10
mov qword [r12], r9
jmp 0x18000615c
mov qword [rbp], rsi
mov qword [r12], rbx
lea rdi, [0x180000000]
mov rsi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xa0]
mov r13, qword [rsp + 0x80]
xor edx, edx
lea rcx, [rsp + 0x44]
mov dword [rsp + 0x40], r14d
lea r8d, [rdx + 0x2c]
call fcn.1800149c0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx r11d, word [rsp + 0x40]
test r11d, r11d
je 0x180006248
cmp r11d, 9
je 0x1800061e1
mov rdx, qword [r12]
mov rcx, qword [rbp]
mov dword [rsp + 0x30], r11d
lea rax, str.Arch_i
mov r9, r12
mov r8, rbp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
call fcn.180004b40
jmp 0x1800062d6
mov r10, qword [rbp]
mov r9, qword [r12]
test r10, r10
jne 0x1800061f7
test r9, r9
jne 0x1800062d6
cmp r9, 0x7fffffff
ja 0x1800062d6
test r9, r9
jne 0x180006217
test r10, r10
je 0x1800062d6
jmp 0x1800062ce
mov rcx, r9
mov r8, r10
mov rdx, r14
sub r15, r9
lea rax, [rcx + r15]
test rax, rax
je 0x1800062a5
movzx eax, byte [rdx + rdi + 0x31c70]
test al, al
je 0x1800062a5
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x180006223
jmp 0x1800062aa
mov r10, qword [rbp]
mov r9, qword [r12]
test r10, r10
jne 0x18000625e
test r9, r9
jne 0x1800062d6
cmp r9, 0x7fffffff
ja 0x1800062d6
test r9, r9
jne 0x180006273
test r10, r10
je 0x1800062d6
jmp 0x1800062ce
mov rcx, r9
mov r8, r10
mov rdx, r14
sub r15, r9
nop
lea rax, [r15 + rcx]
test rax, rax
je 0x1800062a5
movzx eax, byte [rdx + rdi + 0x31c6c]
test al, al
je 0x1800062a5
mov byte [r8], al
inc r8
inc rdx
dec rcx
jne 0x180006280
jmp 0x1800062aa
test rcx, rcx
jne 0x1800062b6
dec r8
mov r14d, 0x8007007a
dec rdx
add r10, rdx
sub r9, rdx
mov byte [r8], 0
test r14d, r14d
jns 0x1800062ce
cmp r14d, 0x8007007a
jne 0x1800062d6
mov qword [rbp], r10
mov qword [r12], r9
mov rcx, qword [rsp + 0xb0]
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xa8]
test rcx, rcx
je 0x18000630b
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x98
ret