Function at 0x140012430
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x248
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1c0], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [0x140193e30]
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x1400126f9
lea rdx, [0x140193e36]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov rdi, rax
lea rbx, [rbp - 0x40]
mov r8d, 0x11c
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x40], 0x11c
mov rcx, rbx
call rdi
test eax, eax
jne 0x1400127af
mov r13d, dword [rbp - 0x3c]
mov r15d, dword [rbp - 0x38]
mov edi, dword [rbp - 0x34]
movzx eax, word [rbp + 0xd8]
mov word [rbp + 0x1b6], ax
mov r14b, byte [rbp + 0xda]
mov qword [rbp + 0x130], r13
mov qword [rbp + 0x138], r15
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x128], 1
lea rax, [0x140193e70]
mov qword [rbp - 0x40], rax
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionRegOpenKeyExW_HKEY_LOCAL_MACHINE__...__failed
mov qword [rbp - 0x38], rax
mov word [rbp - 0x30], 0
mov dword [rbp - 0x28], 1
lea rcx, [rbp + 0xf8]
lea rdx, [rbp - 0x40]
call fcn.140012fd0
mov qword [rbp + 0x188], 0
mov rdx, qword [rbp + 0x100]
lea rax, [rbp + 0x188]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov qword [rbp + 0x168], rdx
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
mov qword [rbp + 0x110], rdi
jne 0x1400127b8
cmp qword [rbp + 0x188], 0
je 0x1400127b8
cmp r13d, 0xa
sete al
cmp edi, 0x55f0
setae bl
and bl, al
mov eax, ebx
xor al, 1
movzx eax, al
lea rcx, str.EditionIDProductNameRegQueryValueExW_failed
lea rdx, [0x140193f69]
test bl, bl
cmovne rdx, rcx
lea rax, [rdx + rax*2 + 9]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov word [rbp - 0x30], 0
mov dword [rbp - 0x28], 1
lea rcx, [rbp + 0xe0]
lea rdx, [rbp - 0x40]
call fcn.140012fd0
mov r12, r15
mov dword [rbp + 0x1a4], 0
mov dword [rbp + 0x1b8], 0
mov rcx, qword [rbp + 0x188]
mov rdx, qword [rbp + 0xe8]
lea r15, [rbp + 0x1b8]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x1a4]
mov qword [rbp + 0x190], rdx
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
mov byte [rbp + 0x1bf], r14b
test eax, eax
jne 0x140012816
cmp dword [rbp + 0x1a4], 1
jne 0x140012816
mov r14d, dword [rbp + 0x1b8]
test r14d, r14d
je 0x140012816
mov eax, r14d
and eax, 1
jne 0x140012816
mov rax, r14
shr rax, 1
mov qword [rbp + 0x198], rax
mov eax, 2
cmp r14d, 2
jb 0x14001268a
mov rax, qword [rbp + 0x198]
lea rdi, [rax + rax]
mov edx, 2
mov rcx, rdi
call fcn.14000e8e0
test rax, rax
je 0x140012d82
mov rcx, qword [rbp + 0x188]
mov qword [rsp + 0x28], r15
mov qword [rbp + 0x1a8], rax
mov qword [rsp + 0x20], rax
mov rdx, qword [rbp + 0x190]
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
mov rcx, qword [rbp + 0x198]
lea rdx, [rcx + rcx]
test eax, eax
jne 0x140012875
mov eax, dword [rbp + 0x1b8]
cmp rdx, rax
jne 0x140012875
mov r15, r12
mov qword [rbp + 0x118], rdx
cmp r14d, 2
jae 0x1400129a4
xor r8d, r8d
mov rdx, qword [rbp + 0x1a8]
jmp 0x1400129c0
mov rax, qword [0x14026d0e8]
mov rax, qword [rax]
test rax, rax
je 0x1400127af
lea rdx, [0x140193e30]
lea rdi, [rbp + 0x148]
mov r8d, 6
mov rcx, rdi
call fcn.140174940
mov qword [rbp + 0x128], rdi
lea rax, [0x1400133d0]
mov qword [rbp + 0x130], rax
lea rax, [0x140194118]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 2
mov qword [rbp - 0x40], 0
lea rax, [rbp + 0x128]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea r8, str.os_info::imp::winapiC:UsersWesley.cargo_registry_srcgithub.com_1ecc6299db9ec823os_info_3.6.0_srcwindowswinapi.rs
lea rcx, [rbp - 0x40]
mov edx, 1
xor r9d, r9d
call fcn.1400c8440
cmp qword [rbp + 0x148], 0
je 0x1400127af
mov rdx, qword [rbp + 0x150]
test rdx, rdx
je 0x1400127af
mov rcx, qword [rbp + 0x158]
mov r8, rdx
not r8
shr r8, 0x3f
call fcn.14000e8c0
xor ebx, ebx
xor eax, eax
jmp 0x140012bb7
mov rax, qword [0x14026d0e8]
mov rax, qword [rax]
test rax, rax
je 0x1400128b9
lea rax, [0x140193ea0]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x40], 0
lea rax, [0x140193e30]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
lea r8, str.os_info::imp::winapiC:UsersWesley.cargo_registry_srcgithub.com_1ecc6299db9ec823os_info_3.6.0_srcwindowswinapi.rs
lea rcx, [rbp - 0x40]
mov edx, 1
xor r9d, r9d
call fcn.1400c8440
jmp 0x1400128b9
mov rax, qword [0x14026d0e8]
mov rax, qword [rax]
test rax, rax
movzx r14d, byte [rbp + 0x1bf]
je 0x140012895
lea rax, [0x140193f90]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x40], 0
lea rax, [0x140193e30]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0
lea r8, str.os_info::imp::winapiC:UsersWesley.cargo_registry_srcgithub.com_1ecc6299db9ec823os_info_3.6.0_srcwindowswinapi.rs
lea rcx, [rbp - 0x40]
mov edx, 1
xor r9d, r9d
call fcn.1400c8440
jmp 0x140012895
cmp r14d, 2
movzx r14d, byte [rbp + 0x1bf]
jb 0x140012895
mov r8d, 2
mov rcx, qword [rbp + 0x1a8]
call fcn.14000e8c0
mov rdx, qword [rbp + 0xe0]
test rdx, rdx
je 0x1400128b6
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x190]
call fcn.14000e8c0
mov r15, r12
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
je 0x1400128da
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x168]
call fcn.14000e8c0
cmp r13d, 5
je 0x140012975
cmp r13d, 6
je 0x14001292e
cmp r13d, 0xa
jne case.default.0x140012949
test r15d, r15d
jne case.default.0x140012949
cmp r14b, 1
jne 0x140012b0a
cmp dword [rbp + 0x110], 0x55f0
lea rax, [0x1401940e6]
lea r14, [0x1401940f0]
cmovae r14, rax
mov r12d, 0xa
jmp 0x140012b72
cmp r15d, 3
ja case.default.0x140012949
mov eax, r15d
lea rcx, [0x140012f9c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
cmp r14b, 1
mov eax, 0xd
mov r12d, 0x13
cmove r12, rax
lea rax, [0x14019406a]
lea r14, [0x140194057]
cmove r14, rax
jmp 0x140012b72
cmp r15d, 2
je 0x140012a21
cmp r15d, 1
je 0x140012a0f
test r15d, r15d
jne case.default.0x140012949
lea r14, [0x140194041]
mov r12d, 0xc
jmp 0x140012b72
mov rax, qword [rbp + 0x198]
lea r8, [rax - 1]
mov rdx, qword [rbp + 0x1a8]
cmp word [rdx + rax*2 - 2], 0
cmovne r8, rax
lea rcx, [rbp - 0x40]
call fcn.14015f950
lea rcx, [rbp - 0x40]
call fcn.1401678a0
mov r8, rdx
lea rcx, [rbp + 0x148]
mov rdx, rax
call fcn.140167a30
cmp qword [rbp + 0x148], 0
je 0x140012a3a
mov rax, qword [rbp + 0x160]
mov qword [rbp + 0x180], rax
movups xmm0, xmmword [rbp + 0x150]
movaps xmmword [rbp + 0x170], xmm0
jmp 0x140012c2d
lea r14, [0x14019404d]
mov r12d, 0xa
jmp 0x140012b72
mov ecx, 0x59
call sub.user32.dll_GetSystemMetrics
test eax, eax
je 0x140012b19
xor ebx, ebx
jmp 0x140012b9c
mov rdx, qword [rbp + 0x150]
mov rdi, qword [rbp + 0x158]
test rdi, rdi
je 0x140012c05
setns al
js 0x140012d91
mov r12, rdx
movzx edx, al
mov rcx, rdi
mov qword [rbp + 0x120], rdx
call fcn.14000e8b0
test rax, rax
mov rdx, r12
jne 0x140012c0a
mov rcx, rdi
mov rdx, qword [rbp + 0x120]
call fcn.14018fcb0
jmp 0x140012d96
cmp r14b, 1
mov eax, 9
mov r12d, 0x13
cmove r12, rax
lea rax, [0x1401940a9]
lea r14, [0x140194096]
cmove r14, rax
jmp 0x140012b72
cmp r14b, 1
mov eax, 0xb
mov r12d, 0x16
cmove r12, rax
lea rax, [0x1401940c8]
lea r14, [0x1401940b2]
cmove r14, rax
jmp 0x140012b72
cmp r14b, 1
mov eax, 9
mov r12d, 0x16
cmove r12, rax
lea rax, [0x14019408d]
lea r14, [0x140194077]
cmove r14, rax
jmp 0x140012b72
lea r14, [0x1401940d3]
mov r12d, 0x13
jmp 0x140012b72
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call sub.KERNEL32.dll_GetSystemInfo
cmp word [rbp + 0x1b6], 0
js 0x140012d67
cmp r14b, 1
sete al
cmp word [rbp - 0x40], 9
sete cl
and cl, al
movzx eax, cl
mov r12, rax
shl r12, 4
add r12, 0x13
lea rcx, [0x14019400b]
lea r14, [0x14019402e]
test al, al
cmovne r14, rcx
mov edx, 1
mov rcx, r12
call fcn.14000e8b0
test rax, rax
je 0x140012d73
mov rbx, rax
mov rcx, rax
mov rdx, r14
mov r8, r12
call sub.VCRUNTIME140.dll_memcpy
mov rdi, r12
lea rax, [rbp + 0x130]
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x30], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x40], xmm0
mov eax, 1
mov rcx, qword [rbp - 0x30]
mov qword [rsi + 0x18], rcx
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rsi + 8], xmm0
mov byte [rsi + 0x50], 0x25
mov qword [rsi], rax
mov qword [rsi + 0x20], r12
mov qword [rsi + 0x28], rbx
mov qword [rsi + 0x30], rdi
mov rax, qword [rbp - 0x38]
mov qword [rsi + 0x38], rax
mov qword [rsi + 0x40], 0
mov byte [rsi + 0x51], 2
mov rax, rsi
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, 1
mov r12, rax
mov rcx, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], r12
mov qword [rbp + 0x180], rdi
mov rdx, qword [rbp - 0x40]
test rdx, rdx
je 0x140012c49
mov rcx, qword [rbp - 0x38]
mov r8, rdx
not r8
shr r8, 0x3f
call fcn.14000e8c0
test bl, bl
je 0x140012cdb
lea rax, [rbp + 0x170]
mov qword [rbp - 0x50], rax
lea rax, [0x140011a20]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 0
lea rax, str.Windows_11
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rax, [rbp - 0x50]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea rcx, [rbp + 0x148]
lea rdx, [rbp - 0x40]
call fcn.140173db0
mov r12, qword [rbp + 0x148]
mov rbx, qword [rbp + 0x150]
mov rdi, qword [rbp + 0x158]
mov rdx, qword [rbp + 0x170]
test rdx, rdx
je 0x140012cf0
mov rcx, qword [rbp + 0x178]
mov r8, rdx
not r8
shr r8, 0x3f
call fcn.14000e8c0
jmp 0x140012cf0
mov r12, qword [rbp + 0x170]
mov rbx, qword [rbp + 0x178]
mov rdi, qword [rbp + 0x180]
cmp r14d, 2
mov rcx, qword [rbp + 0x1a8]
mov rdx, qword [rbp + 0x118]
jb 0x140012d0f
mov r8d, 2
call fcn.14000e8c0
mov rdx, qword [rbp + 0xe0]
test rdx, rdx
movzx r14d, byte [rbp + 0x1bf]
je 0x140012d38
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x190]
call fcn.14000e8c0
mov rdx, qword [rbp + 0xf8]
test rdx, rdx
je 0x140012d59
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x168]
call fcn.14000e8c0
test rbx, rbx
jne 0x140012b9c
jmp 0x1400128da
lea r14, str.Windows_Home_ServerWindows_XP_Professional_x64_EditionWindows_Server_2003Windows_2000Windows_XPWindows_Server_2008Windows_VistaWindows_Server_2008_R2Windows_7Windows_Server_2012Windows_8Windows_Server_2012_R2Windows_8.1Windows_Server_2016Windows_11Windows_10GetModuleHandleA___failed
jmp 0x140012b11
mov edx, 1
mov rcx, r12
call fcn.14018fcb0
jmp 0x140012d96
mov edx, 2
mov rcx, rdi
call fcn.14018fcb0
jmp 0x140012d96
call fcn.140173890
ud2