Function at 0x140016670
Capabilities:
Check os version
Get common file path
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x390], rbx
mov rax, qword [0x140064d98]
xor rax, rsp
mov qword [rbp + 0x270], rax
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x14001713d
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp + 0xf0]
call fcn.14002d420
mov edx, 0x40
lea rcx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x40]
call fcn.140001e10
nop
mov r9d, 1
lea r8, [0x14006309c]
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.1400095b0
nop
lea rcx, [rsp + 0x40]
call fcn.140001e70
lea rcx, [rbp - 0x80]
call fcn.140005da0
mov rdx, rax
mov r8, 0xffffffffffffffff
lea rcx, [0x14006d6fc]
call fcn.14000adf0
mov r8, 0xffffffffffffffff
lea rdx, [rbp + 0xf0]
lea rcx, [0x14006d67c]
call fcn.140003790
mov edx, 0x15
lea rcx, [0x14006bfd8]
call fcn.14000b480
mov rcx, rax
call fcn.140005d80
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006bef8], rax
test rax, rax
je 0x14001679b
lea r8, [0x14006e794]
lea rdx, [0x14006e790]
lea rcx, [0x14006e78c]
call rax
xor ebx, ebx
mov word [0x14006e796], bx
mov eax, dword [0x14006e794]
mov dword [rsp + 0x28], eax
mov eax, dword [0x14006e790]
mov dword [rsp + 0x20], eax
mov r9d, dword [0x14006e78c]
lea r8, str._lu._lu._lu
lea rdx, [rbx - 1]
lea rcx, [0x14006c374]
call fcn.14000aa60
mov qword [rsp + 0x68], rbx
mov dword [rsp + 0x70], 8
mov dword [rsp + 0x78], 4
lea edx, [rbx + 0x5b]
lea rcx, [0x14006bf80]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
mov rdx, rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140016869
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [0x14006e798]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, [0x14004f620]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140016909
lea rdx, [0x14006d67c]
lea rcx, [rbp - 0x80]
call fcn.140001ee0
lea rdx, str._ntoskrnl.exe
lea rcx, [rbp - 0x80]
call fcn.140001fd0
lea rcx, [rbp - 0x80]
call fcn.140011550
cmp eax, 1
je 0x1400168e5
lea rdx, [0x14006d67c]
lea rcx, [rbp - 0x80]
call fcn.140001ee0
lea rdx, str._ntkrnlpa.exe
lea rcx, [rbp - 0x80]
call fcn.140001fd0
lea rcx, [rbp - 0x80]
call fcn.140011550
cmp eax, 1
je 0x1400168e5
lea rdx, [0x14006d67c]
lea rcx, [rbp - 0x80]
call fcn.140001ee0
lea rdx, str.Kernel32.dll
lea rcx, [rbp - 0x80]
call fcn.140001fd0
lea rax, [0x14006e798]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140010100
inc dword [0x14006e81c]
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp - 0x2c]
call fcn.14002d420
mov dword [rbp - 0x30], 0x11c
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [0x14006e78c], 9
jbe 0x140016965
lea rcx, [0x14006d980]
cmp dword [0x14006e794], 0x55ef
jbe 0x140016959
lea rdx, str.Windows_11
jmp 0x1400169fc
lea rdx, str.Windows_10
jmp 0x1400169fc
cmp dword [0x14006e78c], 6
jne 0x140016efd
cmp dword [0x14006e790], ebx
jne 0x14001699d
lea rcx, [0x14006d980]
cmp byte [rbp + 0xea], 1
lea rdx, str.Windows_Vista
je 0x140016998
lea rdx, str.Windows_Server_2008
call fcn.140001ee0
cmp dword [0x14006e790], 1
jne 0x1400169c9
lea rcx, [0x14006d980]
cmp byte [rbp + 0xea], 1
lea rdx, str.Windows_7
je 0x1400169c4
lea rdx, str.Windows_Server_2008_R2
call fcn.140001ee0
cmp dword [0x14006e790], 2
jne 0x1400169e5
lea rdx, str.Windows_8
lea rcx, [0x14006d980]
call fcn.140001ee0
cmp dword [0x14006e790], 3
jne 0x140016a01
lea rdx, str.Windows_8.1
lea rcx, [0x14006d980]
call fcn.140001ee0
cmp dword [0x14006e78c], 5
jbe 0x140017134
mov dword [rsp + 0x74], ebx
lea rcx, str.Kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetProductInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14006beb8], rax
test rax, rax
je 0x140017134
lea rcx, [rsp + 0x74]
mov qword [rsp + 0x20], rcx
mov r9d, dword [0x14006e798]
mov r8d, dword [0x14006e794]
mov edx, dword [0x14006e790]
mov ecx, dword [0x14006e78c]
call rax
mov eax, dword [rsp + 0x74]
dec eax
cmp eax, 0xbe
ja case.0x140016a8f.16
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x171f8]
mov ecx, dword [rdx + rax*4 + 0x17160]
add rcx, rdx
jmp rcx
lea rdx, str.Ultimate
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Professional
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Home_Premium
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Home_Basic
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Enterprise
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Business
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Starter
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Cluster_Server
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Datacenter
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Datacenter_Edition__core_installation_
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Enterprise_Edition__core_installation_
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Enterprise_Edition_for_Itanium_based_Systems
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Small_Business_Server
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Small_Business_Server_Premium
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Standard
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Standard_Edition__core_installation_
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Web_Server
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051db8]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Home_Basic_N
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051de8]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051df8]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Storage_Server_2008_R2_Essentials
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.Hyper___V_Server
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051e90]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051ea0]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.IoT_Core
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, str.IoT
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051ef0]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051ef8]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051f08]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051f18]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051f28]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051f38]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051f50]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051f68]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051f88]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
lea rdx, [0x140051fa0]
lea rcx, [0x14006d980]
call fcn.140001fd0
jmp 0x140017134
mov qword [rsp + 0x60], rbx
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x170]
call fcn.14002d420
mov dword [rsp + 0x70], 0x100
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140017134
lea edx, [rax + 0x3c]
lea rcx, [0x14006bf80]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x170]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140016eed
lea rdx, [rbp + 0x170]
lea rcx, [0x14006d980]
call fcn.140001ee0
cmp dword [0x14006e78c], 9
jbe 0x140016eed
cmp dword [0x14006e794], 0x55ef
jbe 0x140016eed
lea r9, str.Windows_11
lea r8, str.Windows_10
lea rdx, [0x14006d980]
lea rcx, [rbp - 0x60]
call fcn.140009990
lea rcx, [rbp - 0x60]
call fcn.140001e70
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140017134
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [0x14006e78c], 5
jne 0x140017082
cmp dword [0x14006e790], 2
jne 0x140017082
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140016f53
lea rdx, str.Windows_Server_2003_R2
jmp 0x140016f9e
movzx eax, word [rbp + 0xe8]
mov ecx, 0x2000
test cx, ax
je 0x140016f6d
lea rdx, str.Windows_Storage_Server_2003
jmp 0x140016f9e
mov ecx, 0x8000
test cx, ax
je 0x140016f80
lea rdx, str.Windows_Home_Server
jmp 0x140016f9e
cmp byte [rbp + 0xea], 1
jne 0x140016f97
cmp word [rbp - 0x60], 9
lea rdx, str.Windows_Professional
je 0x140016f9e
lea rdx, str.Windows_Server_2003
lea rcx, [0x14006d980]
call fcn.140001ee0
cmp byte [rbp + 0xea], 1
je 0x140017082
mov rax, qword [rbp - 0x60]
cmp ax, 6
jne 0x140016fec
movzx eax, byte [rbp + 0xe8]
test al, al
jns 0x140016fd8
lea rdx, str.Windows_Datacenter_Edition_for_Itanium_based_Systems
jmp 0x140017076
test al, 2
je 0x140017082
lea rdx, str.Windows_Enterprise_Edition_for_Itanium_based_Systems
jmp 0x140017076
cmp ax, 9
jne 0x140017023
movzx eax, byte [rbp + 0xe8]
test al, al
jns 0x140017006
lea rdx, str.Windows_Datacenter_x64
jmp 0x140017076
lea rcx, [0x14006d980]
test al, 2
je 0x14001701a
lea rdx, str.Windows_Enterprise_x64
jmp 0x14001707d
lea rdx, str.Windows_Standard_x64
jmp 0x14001707d
movzx ecx, word [rbp + 0xe8]
mov eax, 0x4000
test ax, cx
je 0x14001703d
lea rdx, str.Windows_Compute_Cluster
jmp 0x140017076
movzx eax, byte [rbp + 0xe8]
test al, al
jns 0x140017051
lea rdx, str.Windows_Datacenter
jmp 0x140017076
test al, 2
je 0x14001705e
lea rdx, str.Windows_Enterprise
jmp 0x140017076
mov eax, 0x400
test ax, cx
lea rdx, str.Windows_Web
jne 0x140017076
lea rdx, str.Windows_Standard
lea rcx, [0x14006d980]
call fcn.140001ee0
cmp dword [rbp - 0x2c], 5
jne 0x140017134
mov eax, dword [rbp - 0x28]
cmp eax, 1
jne 0x1400170d8
lea rdx, str.Windows_XP
lea rcx, [0x14006d980]
call fcn.140001ee0
mov eax, 0x200
lea rcx, [0x14006d980]
test word [rbp + 0xe8], ax
lea rdx, str.Windows_Home
jne 0x1400170ca
lea rdx, str.Windows_Professional
call fcn.140001ee0
cmp dword [rbp - 0x2c], 5
jne 0x140017134
mov eax, dword [rbp - 0x28]
test eax, eax
jne 0x140017134
lea rdx, str.Windows_2000
lea rcx, [0x14006d980]
call fcn.140001ee0
cmp byte [rbp + 0xea], 1
jne 0x140017101
lea rdx, str.Windows_Professional
jmp 0x140017127
movzx eax, byte [rbp + 0xe8]
test al, al
jns 0x140017115
lea rdx, str.Windows_Datacenter_Server
jmp 0x140017127
test al, 2
lea rdx, str.Windows_Advanced_Server
jne 0x140017127
lea rdx, str.Windows_Server
lea rcx, [0x14006d980]
call fcn.140001ee0
nop
lea rcx, [rbp - 0x80]
call fcn.140001e70
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.14002ba20
mov rbx, qword [rsp + 0x390]
add rsp, 0x380
pop rbp
ret