Function at 0x140055364
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value
Read .ini file
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x300
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea rax, vtable.CSysInfo.0
xor edx, edx
mov rdi, rcx
mov qword [rcx], rax
lea r8d, [rdx + 0x2c]
add rcx, 8
call fcn.14005bb90
xor edx, edx
lea rcx, [rdi + 0x34]
lea r8d, [rdx + 0x58]
call fcn.14005bb90
xor edx, edx
lea rcx, [rdi + 0x8c]
lea r8d, [rdx + 0x18]
call fcn.14005bb90
and dword [rdi + 0xa4], 0
and dword [rdi + 0xa8], 0
mov ebx, 0x11c
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8, rbx
call fcn.14005bb90
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0xb0], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ebp, 5
lea r15d, [rbp - 4]
test eax, eax
je 0x14005571c
mov eax, dword [rsp + 0xb8]
mov r9d, dword [rsp + 0xb4]
lea r12, str.CSysInfo::CSysInfo
lea r8, str.Version___1_lu_._2_lu__n
mov rdx, r12
mov ecx, ebp
mov dword [rsp + 0x20], eax
call fcn.140009480
movzx r11d, word [rsp + 0x1c6]
movzx r9d, word [rsp + 0x1c4]
lea r8, str.SPVersion___1_lu_._2_lu__n
mov rdx, r12
mov ecx, ebp
mov dword [rsp + 0x20], r11d
call fcn.140009480
mov r8d, dword [rsp + 0xb4]
lea rbp, str.ijinst.debug.ini
lea rbx, str.SysInfo
lea rdx, str.MajorVersion
mov r9, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r8d, dword [rsp + 0xb8]
lea rdx, str.MinorVersion
mov r9, rbp
mov rcx, rbx
mov dword [rsp + 0xb4], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx r8d, word [rsp + 0x1c4]
lea rdx, str.SPMajorVersion
mov r9, rbp
mov rcx, rbx
mov dword [rsp + 0xb8], eax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
movzx r8d, word [rsp + 0x1c6]
lea rdx, str.SPMinorVersion
mov r9, rbp
mov rcx, rbx
mov word [rsp + 0x1c4], ax
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r9d, dword [rsp + 0xb4]
lea ebp, [r15 + 4]
mov word [rsp + 0x1c6], ax
mov eax, dword [rsp + 0xb8]
lea r8, str.Version_patched____1_lu_._2_lu__n
mov rdx, r12
mov ecx, ebp
mov dword [rsp + 0x20], eax
call fcn.140009480
movzx r11d, word [rsp + 0x1c6]
movzx r9d, word [rsp + 0x1c4]
lea r8, str.SPVersion_patched____1_lu_._2_lu__n
mov rdx, r12
mov ecx, ebp
mov dword [rsp + 0x20], r11d
call fcn.140009480
mov r11d, dword [rsp + 0xb4]
cmp r11d, 6
jbe 0x1400555d5
mov eax, dword [rsp + 0xb8]
mov dword [rdi + 0xa4], r11d
mov dword [rdi + 0x34], r15d
mov dword [rdi + 0xa8], eax
movzx eax, word [rsp + 0x1c4]
mov dword [rdi + 0x60], r15d
mov word [rdi + 0x88], ax
movzx eax, word [rsp + 0x1c6]
mov dword [rdi + 0x64], r15d
mov dword [rdi + 0x68], r15d
mov dword [rdi + 0x6c], r15d
mov dword [rdi + 0x70], r15d
mov word [rdi + 0x8a], ax
mov dword [rdi + 0x74], r15d
mov dword [rdi + 0x78], r15d
mov dword [rdi + 0x7c], r15d
mov dword [rdi + 0x80], r15d
mov dword [rdi + 0x58], r15d
mov dword [rdi + 0x84], r15d
jmp 0x14005584e
jne 0x1400556b2
movzx eax, word [rsp + 0x1c4]
mov ecx, dword [rsp + 0xb8]
mov dword [rdi + 0xa4], 6
mov word [rdi + 0x88], ax
movzx eax, word [rsp + 0x1c6]
mov dword [rdi + 0xa8], ecx
mov dword [rdi + 0x34], r15d
mov dword [rdi + 0x60], r15d
mov dword [rdi + 0x64], r15d
mov word [rdi + 0x8a], ax
mov dword [rdi + 0x68], r15d
mov dword [rdi + 0x6c], r15d
test ecx, ecx
je 0x140055692
sub ecx, r15d
mov dword [rdi + 0x70], r15d
mov dword [rdi + 0x74], r15d
je 0x140055672
mov dword [rdi + 0x78], r15d
mov dword [rdi + 0x7c], r15d
cmp ecx, r15d
je 0x140055659
mov dword [rdi + 0x58], r15d
mov dword [rdi + 0x84], r15d
mov dword [rdi + 0x80], r15d
jmp 0x14005584e
cmp byte [rsp + 0x1ca], r15b
jne 0x14005566c
mov dword [rdi + 0x58], r15d
jmp 0x14005584e
mov dword [rdi + 0x5c], r15d
jmp 0x14005564d
cmp byte [rsp + 0x1ca], r15b
jne 0x140055685
mov dword [rdi + 0x50], r15d
jmp 0x14005584e
mov dword [rdi + 0x54], r15d
mov dword [rdi + 0x78], r15d
jmp 0x14005584e
cmp byte [rsp + 0x1ca], r15b
jne 0x1400556a5
mov dword [rdi + 0x48], r15d
jmp 0x14005584e
mov dword [rdi + 0x4c], r15d
mov dword [rdi + 0x70], r15d
jmp 0x14005584e
cmp r11d, ebp
jne 0x14005571c
movzx eax, word [rsp + 0x1c4]
mov ecx, dword [rsp + 0xb8]
mov dword [rdi + 0xa4], ebp
mov word [rdi + 0x88], ax
movzx eax, word [rsp + 0x1c6]
mov dword [rdi + 0xa8], ecx
mov dword [rdi + 0x34], r15d
mov dword [rdi + 0x60], r15d
mov word [rdi + 0x8a], ax
test ecx, ecx
je 0x140055713
sub ecx, r15d
mov dword [rdi + 0x64], r15d
je 0x14005570a
mov dword [rdi + 0x44], r15d
mov dword [rdi + 0x68], r15d
jmp 0x14005584e
mov dword [rdi + 0x40], r15d
jmp 0x14005584e
mov dword [rdi + 0x3c], r15d
jmp 0x14005584e
mov ebx, 0x114
lea rcx, [rsp + 0x1d0]
xor edx, edx
mov r8, rbx
call fcn.14005bb90
lea rcx, [rsp + 0x1d0]
mov dword [rsp + 0x1d0], ebx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14005584e
mov eax, dword [rsp + 0x1e0]
mov ecx, dword [rsp + 0x1d4]
mov edx, dword [rsp + 0x1d8]
sub eax, r15d
mov dword [rdi + 0xa4], ecx
mov dword [rdi + 0xa8], edx
je 0x1400557d3
cmp eax, r15d
jne 0x14005584e
mov dword [rdi + 0x34], r15d
cmp ecx, 4
jne 0x14005584e
lea edx, [rcx + 0x7c]
lea rcx, [rsp + 0x1e4]
mov dword [rdi + 0x38], r15d
call fcn.14005ca00
lea rcx, str.Service_Pack_6a
mov edx, 0x10
mov rbx, rax
call fcn.14005ca00
cmp rbx, rax
jb 0x14005584e
lea rcx, [rsp + 0x1fe]
call fcn.14005da70
mov word [rdi + 0x88], ax
jmp 0x14005584e
movzx ecx, word [rsp + 0x1e6]
mov dword [rdi + 8], r15d
sub ecx, 0x41
je 0x140055800
sub ecx, r15d
je 0x1400557fa
cmp ecx, r15d
je 0x1400557f4
mov dword [rdi + 0x30], r15d
jmp 0x140055804
mov dword [rdi + 0x2c], r15d
jmp 0x140055804
mov dword [rdi + 0x28], r15d
jmp 0x140055804
mov dword [rdi + 0x24], r15d
test edx, edx
je 0x14005584a
cmp edx, 0xa
je 0x140055824
cmp edx, 0x5a
jne 0x14005584e
mov dword [rdi + 0x14], r15d
mov dword [rdi + 0x18], r15d
mov dword [rdi + 0x1c], r15d
mov dword [rdi + 0x20], r15d
jmp 0x14005584e
mov eax, dword [rsp + 0x1dc]
shr eax, 0x10
cmp al, 0xa
je 0x140055836
cmp al, 0x5a
jmp 0x140055810
cmp dword [rdi + 0x24], 0
mov dword [rdi + 0x10], r15d
mov dword [rdi + 0x18], r15d
je 0x14005584e
mov dword [rdi + 0x1c], r15d
jmp 0x14005584e
mov dword [rdi + 0xc], r15d
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400558a3
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetNativeSystemInfo
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
test r12, r12
je 0x1400558a3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rdi + 0x8c]
mov rcx, rax
call r12
cmp dword [rdi + 0x8c], 0
mov ebx, 0x30
je 0x1400558ee
lea rcx, [rsp + 0x48]
mov r8, rbx
xor edx, edx
call fcn.14005bb90
test rbp, rbp
je 0x1400558ee
lea rcx, [rsp + 0x48]
call rbp
movzx r11d, word [rsp + 0x48]
cmp r11d, 6
je 0x1400558e7
cmp r11d, 9
jne 0x1400558ee
mov dword [rdi + 0x9c], r15d
jmp 0x1400558ee
mov dword [rdi + 0xa0], r15d
lea rcx, [rsp + 0x78]
mov r8, rbx
xor edx, edx
mov dword [rdi + 0x90], r15d
call fcn.14005bb90
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx r11d, word [rsp + 0x78]
xor ebp, ebp
cmp r11d, 6
je 0x140055934
cmp r11d, 9
je 0x14005592b
mov dword [rdi + 0x90], ebp
jmp 0x14005593b
mov dword [rdi + 0x94], r15d
jmp 0x14005593b
mov dword [rdi + 0x98], r15d
lea rbx, [rdi + 0xac]
mov r12d, 0x200
xor edx, edx
mov rcx, rbx
mov r8, r12
call fcn.14005bb90
cmp dword [rdi + 8], ebp
je 0x140055963
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
jmp 0x14005596f
cmp dword [rdi + 0x34], ebp
je 0x1400559cc
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x1400559cc
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [0x140078138]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rdi + 0x90], ebp
jne 0x1400559dc
cmp dword [rdi + 0x8c], ebp
je 0x140055a04
cmp byte [rsp + 0x1ca], r15b
jne 0x140055a04
cmp dword [rsp + 0xb4], 5
jne 0x140055a04
cmp dword [rsp + 0xb8], 2
jne 0x140055a04
mov dword [rdi + 0x40], r15d
mov dword [rdi + 0x44], ebp
mov dword [rdi + 0x68], ebp
mov rax, rdi
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.14005bad0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret