Function at 0x1401a0ea8
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x70
and qword [rbp - 0x38], 0
lea rax, [rbp - 0x40]
xor edi, edi
mov qword [rsp + 0x20], rax
and qword [rbp - 0x28], rdi
mov r14, rdx
xor ebx, ebx
mov qword [rbp - 0x30], rdi
and qword [rbp - 0x40], rbx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion_
lea r9d, [rdi + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401a0f34
xor esi, esi
mov rdi, qword [rbp - 0x40]
and qword [rbp - 0x40], rbx
mov qword [rbp - 0x30], rdi
mov ecx, esi
call fcn.140079c60
lea rcx, [rbp - 0x40]
call fcn.140069f74
mov r12d, 0x8007000d
test esi, esi
jns 0x1401a0f4f
mov ecx, esi
call fcn.140079c40
jmp 0x1401a0ff1
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
je 0x1401a0f02
mov ecx, esi
call fcn.140079c40
jmp 0x1401a0f0e
and dword [rbp + 0x30], ebx
lea rax, [rbp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x40]
lea rdx, str.DigitalProductId4
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1401a0f8d
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x1401a0f28
test rbx, rbx
jne 0x1401a0fcb
mov eax, dword [rbp + 0x30]
test eax, eax
je 0x1401a0fc1
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1401a0f52
mov esi, 0x8007000e
jmp 0x1401a0f28
mov esi, 0x8000ffff
jmp 0x1401a0f28
cmp dword [rbp + 0x40], 3
je 0x1401a0fdc
mov esi, r12d
mov ecx, r12d
jmp 0x1401a0f2a
mov qword [rbp - 0x38], rbx
xor ecx, ecx
call fcn.140079c60
mov eax, dword [rbp + 0x30]
xor esi, esi
mov dword [rbp + 0x48], eax
xor ebx, ebx
mov ecx, esi
call fcn.140079c60
test rbx, rbx
je 0x1401a1011
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rcx, [rbp - 0x28]
call fcn.140069f74
lea rcx, [rbp - 0x30]
call fcn.140069f74
test esi, esi
jns 0x1401a1033
mov ecx, esi
call fcn.140079c40
jmp 0x1401a10ec
mov ecx, 0x4f8
cmp dword [rbp + 0x48], ecx
je 0x1401a1045
mov esi, r12d
mov ecx, r12d
jmp 0x1401a1029
mov rax, qword [rbp - 0x38]
cmp dword [rax], ecx
jne 0x1401a103d
mov ecx, 9
lea edx, [rcx + 0x77]
movups xmm0, xmmword [rax]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r14 + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r14 + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r14 + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r14 + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r14 + 0x60], xmm0
add r14, rdx
movups xmm1, xmmword [rax + 0x70]
add rax, rdx
movups xmmword [r14 - 0x10], xmm1
sub rcx, 1
jne 0x1401a1055
movups xmm0, xmmword [rax]
movups xmmword [r14], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r14 + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r14 + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r14 + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [r14 + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [r14 + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [r14 + 0x60], xmm0
mov rax, qword [rax + 0x70]
mov qword [r14 + 0x70], rax
mov ecx, esi
call fcn.140079c60
and qword [rbp - 0x10], 0
lea rax, [0x14003ca58]
xor r9d, r9d
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x20], 3
lea rdx, [rbp - 0x20]
mov qword [rbp - 8], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
mov rbx, qword [rsp + 0xa8]
mov eax, esi
add rsp, 0x70
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret