Function at 0x140032384
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14012a418]
xor rax, rsp
mov qword [rbp - 8], rax
call fcn.140020cf8
mov rcx, rax
mov rbx, rax
call fcn.140020798
test eax, eax
jne 0x140032654
lea rcx, str.Windows
call fcn.140020e34
mov r8, rax
lea rdx, str.name
mov rcx, rbx
call fcn.140021230
lea rcx, str.ntoskrnl.exe
call fcn.140032684
mov rdi, rax
test rax, rax
jne 0x140032412
lea rcx, str.kernel32.dll
call fcn.140032684
mov rdi, rax
test rax, rax
je 0x14003242d
lea r9, [rbp - 0x30]
mov rcx, rdi
lea r8, [rbp - 0x38]
lea rdx, [0x1400f8b90]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x140032447
mov rcx, rdi
call fcn.140021850
mov rcx, rbx
call fcn.1400204a4
call fcn.140020cf0
jmp 0x140032657
mov rcx, qword [rbp - 0x38]
lea r8, str._u._u._u._lu
mov edx, 0x20
mov eax, dword [rcx + 0x18]
and dword [rcx + 0x1c], eax
lea rcx, [rbp - 0x28]
mov rax, qword [rbp - 0x38]
mov r15d, dword [rax + 8]
mov esi, dword [rax + 0xc]
movzx r14d, word [rax + 0xc]
movzx r12d, word [rax + 8]
mov dword [rsp + 0x30], r14d
shr r15d, 0x10
shr esi, 0x10
mov r9d, r15d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r12d
call fcn.14002148c
lea rcx, [rbp - 0x28]
call fcn.140020e34
mov r8, rax
lea rdx, str.kernel_version
mov rcx, rbx
call fcn.140021230
mov rcx, rdi
call fcn.140021850
and dword [rbp - 0x3c], 0
lea rax, [rbp - 0x40]
mov qword [rsp + 0x30], rax
lea r8, str.CurrentMajorVersionNumber
lea rax, [rbp - 0x3c]
mov dword [rbp - 0x40], 4
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
and qword [rsp + 0x20], 0
mov rdi, 0xffffffff80000002
mov r9d, InitCommonControls
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov r9d, InitCommonControls
mov dword [rbp - 0x40], 4
test eax, eax
lea r8, str.CurrentMinorVersionNumber
lea rax, [rbp - 0x40]
mov rcx, rdi
cmove r15d, dword [rbp - 0x3c]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov edi, 0x20
lea r8, str.CurrentBuild
test eax, eax
mov dword [rbp - 0x40], edi
lea rax, [rbp - 0x40]
mov rcx, 0xffffffff80000002
cmove r12d, dword [rbp - 0x3c]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x30], rax
lea r9d, [rdi - 0x1e]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x14003259a
xor edx, edx
lea rcx, [rbp - 0x28]
call fcn.140023444
cvttsd2si rsi, xmm0
lea rax, [rbp - 0x40]
mov dword [rbp - 0x40], 4
mov qword [rsp + 0x30], rax
lea r8, [0x1400fcb00]
lea rax, [rbp - 0x3c]
mov r9d, InitCommonControls
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
and qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x28], esi
lea r8, str._u._u._u
test eax, eax
mov dword [rsp + 0x20], r12d
mov r9d, r15d
lea rcx, [rbp - 0x28]
cmove r14d, dword [rbp - 0x3c]
mov rdx, rdi
call fcn.14002148c
lea rcx, [rbp - 0x28]
call fcn.140020e34
mov r8, rax
lea rdx, str.version
mov rcx, rbx
call fcn.140021230
mov r9d, r14d
lea r8, [0x1400fcb14]
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.14002148c
lea rcx, [rbp - 0x28]
call fcn.140020e34
mov r8, rax
lea rdx, str.build
mov rcx, rbx
call fcn.140021230
mov rcx, rbx
call fcn.1400204cc
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14006b990
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret