Function at 0x140201310
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x2c0
mov rax, qword [0x1402efec0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rcx, str._tOS:
call fcn.14001c2b0
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x11c
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0x11c
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
cmp qword [rsp + 0x78], 0
je 0x1402013c5
lea rcx, [rsp + 0x90]
call qword [rsp + 0x78]
mov dword [rsp + 0x44], eax
cmp qword [rsp + 0x78], 0
je 0x1402013d4
cmp dword [rsp + 0x44], 0
je 0x1402013e6
lea rcx, str.Windows__Unknown_Version_
call fcn.14001c2b0
nop
jmp 0x140201856
cmp qword [rsp + 0x80], 0
je 0x140201427
movzx eax, word [rsp + 0x1a6]
movzx ecx, word [rsp + 0x1a4]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x94]
call qword [rsp + 0x80]
nop
xor eax, eax
test eax, eax
je 0x1402014d6
mov edx, dword [rsp + 0x94]
lea rcx, str.dwMajorVersion:_____u_n
call fcn.14001c2b0
mov edx, dword [rsp + 0x98]
lea rcx, str.dwMinorVersion:_____u_n
call fcn.14001c2b0
mov edx, dword [rsp + 0x9c]
lea rcx, str.dwBuildNumber:______u_n
call fcn.14001c2b0
mov edx, dword [rsp + 0xa0]
lea rcx, str.dwPlatformId:_______u_n
call fcn.14001c2b0
movzx eax, word [rsp + 0x1a4]
mov edx, eax
lea rcx, str.wServicePackMajor:__u_n
call fcn.14001c2b0
movzx eax, word [rsp + 0x1a6]
mov edx, eax
lea rcx, str.wServicePackMinor:__u_n
call fcn.14001c2b0
movzx eax, word [rsp + 0x1a8]
mov edx, eax
lea rcx, str.wSuiteMask:_________u_n
call fcn.14001c2b0
movzx eax, byte [rsp + 0x1aa]
mov edx, eax
lea rcx, str.wProductType:_______u_n
call fcn.14001c2b0
nop
lea rcx, str.Windows
call fcn.14001c2b0
nop
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 5
je 0x14020170a
cmp dword [rsp + 0x4c], 6
je 0x1402015c4
cmp dword [rsp + 0x4c], 0xa
je 0x140201510
jmp 0x140201757
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x6c], al
cmp byte [rsp + 0x6c], 1
je 0x140201525
jmp 0x14020155a
cmp dword [rsp + 0x9c], 0x55f0
jae 0x140201541
lea rcx, [0x1402d3dc4]
call fcn.14001c2b0
nop
jmp 0x14020154e
lea rcx, [0x1402d3dc8]
call fcn.14001c2b0
nop
mov ecx, dword [rsp + 0x40]
call fcn.140200dc0
nop
jmp 0x1402015bf
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x3839
je 0x140201585
cmp dword [rsp + 0x50], 0x4563
je 0x140201594
cmp dword [rsp + 0x50], 0x4f7c
je 0x1402015a3
jmp 0x1402015b2
lea rcx, str.2016_Server
call fcn.14001c2b0
nop
jmp 0x1402015bf
lea rcx, str.2019_Server
call fcn.14001c2b0
nop
jmp 0x1402015bf
lea rcx, str.2022_Server
call fcn.14001c2b0
nop
jmp 0x1402015bf
lea rcx, str.Unknown_Server
call fcn.14001c2b0
nop
jmp 0x140201757
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x1402015f8
cmp dword [rsp + 0x48], 1
je 0x14020163e
cmp dword [rsp + 0x48], 2
je 0x140201684
cmp dword [rsp + 0x48], 3
je 0x1402016c7
jmp 0x140201708
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x5c], al
cmp byte [rsp + 0x5c], 1
je 0x140201614
cmp byte [rsp + 0x5c], 3
je 0x14020162c
jmp 0x140201639
lea rcx, str.Windows_Vista
call fcn.14001c2b0
mov ecx, dword [rsp + 0x40]
call fcn.140200dc0
nop
jmp 0x140201639
lea rcx, str.Windows_Server_2008
call fcn.14001c2b0
nop
jmp 0x140201708
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x60], al
cmp byte [rsp + 0x60], 1
je 0x14020165a
cmp byte [rsp + 0x60], 3
je 0x140201672
jmp 0x14020167f
lea rcx, str.Windows_7
call fcn.14001c2b0
mov ecx, dword [rsp + 0x40]
call fcn.140200dc0
nop
jmp 0x14020167f
lea rcx, str.Windows_Server_2008_R2
call fcn.14001c2b0
nop
jmp 0x140201708
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x64], al
cmp byte [rsp + 0x64], 1
je 0x1402016a0
cmp byte [rsp + 0x64], 3
je 0x1402016b8
jmp 0x1402016c5
lea rcx, str.Windows_8
call fcn.14001c2b0
mov ecx, dword [rsp + 0x40]
call fcn.140200dc0
nop
jmp 0x1402016c5
lea rcx, str.Windows_Server_2012
call fcn.14001c2b0
nop
jmp 0x140201708
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x68], al
cmp byte [rsp + 0x68], 1
je 0x1402016e3
cmp byte [rsp + 0x68], 3
je 0x1402016fb
jmp 0x140201708
lea rcx, str.Windows_8.1
call fcn.14001c2b0
mov ecx, dword [rsp + 0x40]
call fcn.140200dc0
nop
jmp 0x140201708
lea rcx, str.Windows_Server_2012_R2
call fcn.14001c2b0
nop
jmp 0x140201757
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x14020172c
cmp dword [rsp + 0x54], 1
je 0x14020173b
cmp dword [rsp + 0x54], 2
je 0x14020174a
jmp 0x140201757
lea rcx, str.Windows_2000
call fcn.14001c2b0
nop
jmp 0x140201757
lea rcx, str.Windows_XP
call fcn.14001c2b0
nop
jmp 0x140201757
lea rcx, str.Windows_Server_2003
call fcn.14001c2b0
nop
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x58], pe_nt_image_headers64
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.DisplayVersion
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1402017d0
lea rdx, [rsp + 0x1b0]
lea rcx, str.__version:__s_
call fcn.14001c2b0
nop
mov edx, dword [rsp + 0x9c]
lea rcx, str.__build__u
call fcn.14001c2b0
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [0x1402d3f44]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x140201849
mov edx, dword [rsp + 0x70]
lea rcx, [0x1402d3f48]
call fcn.14001c2b0
nop
lea rcx, [0x140295968]
call fcn.14001c2b0
nop
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140248280
add rsp, 0x2c0
pop rdi
ret