Function at 0x1401eb0c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x2c0
mov rax, qword [0x1402caec0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rcx, str._tOS:
call fcn.1400112c0
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x11c
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0x11c
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
cmp qword [rsp + 0x78], 0
je 0x1401eb175
lea rcx, [rsp + 0x90]
call qword [rsp + 0x78]
mov dword [rsp + 0x44], eax
cmp qword [rsp + 0x78], 0
je 0x1401eb184
cmp dword [rsp + 0x44], 0
je 0x1401eb195
lea rcx, str.Windows__Unknown_Version_
call fcn.1400112c0
jmp 0x1401eb5ed
cmp qword [rsp + 0x80], 0
je 0x1401eb1d5
movzx eax, word [rsp + 0x1a6]
movzx ecx, word [rsp + 0x1a4]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x94]
call qword [rsp + 0x80]
xor eax, eax
test eax, eax
je 0x1401eb283
mov edx, dword [rsp + 0x94]
lea rcx, str.dwMajorVersion:_____u_n
call fcn.1400112c0
mov edx, dword [rsp + 0x98]
lea rcx, str.dwMinorVersion:_____u_n
call fcn.1400112c0
mov edx, dword [rsp + 0x9c]
lea rcx, str.dwBuildNumber:______u_n
call fcn.1400112c0
mov edx, dword [rsp + 0xa0]
lea rcx, str.dwPlatformId:_______u_n
call fcn.1400112c0
movzx eax, word [rsp + 0x1a4]
mov edx, eax
lea rcx, str.wServicePackMajor:__u_n
call fcn.1400112c0
movzx eax, word [rsp + 0x1a6]
mov edx, eax
lea rcx, str.wServicePackMinor:__u_n
call fcn.1400112c0
movzx eax, word [rsp + 0x1a8]
mov edx, eax
lea rcx, str.wSuiteMask:_________u_n
call fcn.1400112c0
movzx eax, byte [rsp + 0x1aa]
mov edx, eax
lea rcx, str.wProductType:_______u_n
call fcn.1400112c0
lea rcx, str.Windows
call fcn.1400112c0
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 5
je 0x1401eb4a7
cmp dword [rsp + 0x4c], 6
je 0x1401eb369
cmp dword [rsp + 0x4c], 0xa
je 0x1401eb2bc
jmp 0x1401eb4f1
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x6c], al
cmp byte [rsp + 0x6c], 1
je 0x1401eb2d1
jmp 0x1401eb303
cmp dword [rsp + 0x9c], 0x55f0
jae 0x1401eb2ec
lea rcx, [0x1402ae234]
call fcn.1400112c0
jmp 0x1401eb2f8
lea rcx, [0x1402ae238]
call fcn.1400112c0
mov ecx, dword [rsp + 0x40]
call fcn.1401eab90
jmp 0x1401eb364
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x3839
je 0x1401eb32e
cmp dword [rsp + 0x50], 0x4563
je 0x1401eb33c
cmp dword [rsp + 0x50], 0x4f7c
je 0x1401eb34a
jmp 0x1401eb358
lea rcx, str.2016_Server
call fcn.1400112c0
jmp 0x1401eb364
lea rcx, str.2019_Server
call fcn.1400112c0
jmp 0x1401eb364
lea rcx, str.2022_Server
call fcn.1400112c0
jmp 0x1401eb364
lea rcx, str.Unknown_Server
call fcn.1400112c0
jmp 0x1401eb4f1
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x1401eb39d
cmp dword [rsp + 0x48], 1
je 0x1401eb3e1
cmp dword [rsp + 0x48], 2
je 0x1401eb425
cmp dword [rsp + 0x48], 3
je 0x1401eb466
jmp 0x1401eb4a5
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x5c], al
cmp byte [rsp + 0x5c], 1
je 0x1401eb3b9
cmp byte [rsp + 0x5c], 3
je 0x1401eb3d0
jmp 0x1401eb3dc
lea rcx, str.Windows_Vista
call fcn.1400112c0
mov ecx, dword [rsp + 0x40]
call fcn.1401eab90
jmp 0x1401eb3dc
lea rcx, str.Windows_Server_2008
call fcn.1400112c0
jmp 0x1401eb4a5
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x60], al
cmp byte [rsp + 0x60], 1
je 0x1401eb3fd
cmp byte [rsp + 0x60], 3
je 0x1401eb414
jmp 0x1401eb420
lea rcx, str.Windows_7
call fcn.1400112c0
mov ecx, dword [rsp + 0x40]
call fcn.1401eab90
jmp 0x1401eb420
lea rcx, str.Windows_Server_2008_R2
call fcn.1400112c0
jmp 0x1401eb4a5
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x64], al
cmp byte [rsp + 0x64], 1
je 0x1401eb441
cmp byte [rsp + 0x64], 3
je 0x1401eb458
jmp 0x1401eb464
lea rcx, str.Windows_8
call fcn.1400112c0
mov ecx, dword [rsp + 0x40]
call fcn.1401eab90
jmp 0x1401eb464
lea rcx, str.Windows_Server_2012
call fcn.1400112c0
jmp 0x1401eb4a5
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x68], al
cmp byte [rsp + 0x68], 1
je 0x1401eb482
cmp byte [rsp + 0x68], 3
je 0x1401eb499
jmp 0x1401eb4a5
lea rcx, str.Windows_8.1
call fcn.1400112c0
mov ecx, dword [rsp + 0x40]
call fcn.1401eab90
jmp 0x1401eb4a5
lea rcx, str.Windows_Server_2012_R2
call fcn.1400112c0
jmp 0x1401eb4f1
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x1401eb4c9
cmp dword [rsp + 0x54], 1
je 0x1401eb4d7
cmp dword [rsp + 0x54], 2
je 0x1401eb4e5
jmp 0x1401eb4f1
lea rcx, str.Windows_2000
call fcn.1400112c0
jmp 0x1401eb4f1
lea rcx, str.Windows_XP
call fcn.1400112c0
jmp 0x1401eb4f1
lea rcx, str.Windows_Server_2003
call fcn.1400112c0
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x58], pe_nt_image_headers64
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.DisplayVersion
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1401eb569
lea rdx, [rsp + 0x1b0]
lea rcx, str.__version:__s_
call fcn.1400112c0
mov edx, dword [rsp + 0x9c]
lea rcx, str.__build__u
call fcn.1400112c0
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [0x1402ae3b4]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1401eb5e1
mov edx, dword [rsp + 0x70]
lea rcx, [0x1402ae3b8]
call fcn.1400112c0
lea rcx, [0x1402858d0]
call fcn.1400112c0
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140238130
add rsp, 0x2c0
pop rdi
ret