Function at 0x1401e0f80
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x2c0
mov rax, qword [0x1402bbe00]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rcx, str._tOS:
call fcn.140010170
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x11c
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0x11c
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
cmp qword [rsp + 0x78], 0
je 0x1401e1035
lea rcx, [rsp + 0x90]
call qword [rsp + 0x78]
mov dword [rsp + 0x44], eax
cmp qword [rsp + 0x78], 0
je 0x1401e1044
cmp dword [rsp + 0x44], 0
je 0x1401e1055
lea rcx, str.Windows__Unknown_Version_
call fcn.140010170
jmp 0x1401e14ad
cmp qword [rsp + 0x80], 0
je 0x1401e1095
movzx eax, word [rsp + 0x1a6]
movzx ecx, word [rsp + 0x1a4]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x94]
call qword [rsp + 0x80]
xor eax, eax
test eax, eax
je 0x1401e1143
mov edx, dword [rsp + 0x94]
lea rcx, str.dwMajorVersion:_____u_n
call fcn.140010170
mov edx, dword [rsp + 0x98]
lea rcx, str.dwMinorVersion:_____u_n
call fcn.140010170
mov edx, dword [rsp + 0x9c]
lea rcx, str.dwBuildNumber:______u_n
call fcn.140010170
mov edx, dword [rsp + 0xa0]
lea rcx, str.dwPlatformId:_______u_n
call fcn.140010170
movzx eax, word [rsp + 0x1a4]
mov edx, eax
lea rcx, str.wServicePackMajor:__u_n
call fcn.140010170
movzx eax, word [rsp + 0x1a6]
mov edx, eax
lea rcx, str.wServicePackMinor:__u_n
call fcn.140010170
movzx eax, word [rsp + 0x1a8]
mov edx, eax
lea rcx, str.wSuiteMask:_________u_n
call fcn.140010170
movzx eax, byte [rsp + 0x1aa]
mov edx, eax
lea rcx, str.wProductType:_______u_n
call fcn.140010170
lea rcx, str.Windows
call fcn.140010170
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 5
je 0x1401e1367
cmp dword [rsp + 0x4c], 6
je 0x1401e1229
cmp dword [rsp + 0x4c], 0xa
je 0x1401e117c
jmp 0x1401e13b1
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x6c], al
cmp byte [rsp + 0x6c], 1
je 0x1401e1191
jmp 0x1401e11c3
cmp dword [rsp + 0x9c], 0x55f0
jae 0x1401e11ac
lea rcx, [0x1402a042c]
call fcn.140010170
jmp 0x1401e11b8
lea rcx, [0x1402a0430]
call fcn.140010170
mov ecx, dword [rsp + 0x40]
call fcn.1401e0a50
jmp 0x1401e1224
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x3839
je 0x1401e11ee
cmp dword [rsp + 0x50], 0x4563
je 0x1401e11fc
cmp dword [rsp + 0x50], 0x4f7c
je 0x1401e120a
jmp 0x1401e1218
lea rcx, str.2016_Server
call fcn.140010170
jmp 0x1401e1224
lea rcx, str.2019_Server
call fcn.140010170
jmp 0x1401e1224
lea rcx, str.2022_Server
call fcn.140010170
jmp 0x1401e1224
lea rcx, str.Unknown_Server
call fcn.140010170
jmp 0x1401e13b1
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x1401e125d
cmp dword [rsp + 0x48], 1
je 0x1401e12a1
cmp dword [rsp + 0x48], 2
je 0x1401e12e5
cmp dword [rsp + 0x48], 3
je 0x1401e1326
jmp 0x1401e1365
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x5c], al
cmp byte [rsp + 0x5c], 1
je 0x1401e1279
cmp byte [rsp + 0x5c], 3
je 0x1401e1290
jmp 0x1401e129c
lea rcx, str.Windows_Vista
call fcn.140010170
mov ecx, dword [rsp + 0x40]
call fcn.1401e0a50
jmp 0x1401e129c
lea rcx, str.Windows_Server_2008
call fcn.140010170
jmp 0x1401e1365
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x60], al
cmp byte [rsp + 0x60], 1
je 0x1401e12bd
cmp byte [rsp + 0x60], 3
je 0x1401e12d4
jmp 0x1401e12e0
lea rcx, str.Windows_7
call fcn.140010170
mov ecx, dword [rsp + 0x40]
call fcn.1401e0a50
jmp 0x1401e12e0
lea rcx, str.Windows_Server_2008_R2
call fcn.140010170
jmp 0x1401e1365
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x64], al
cmp byte [rsp + 0x64], 1
je 0x1401e1301
cmp byte [rsp + 0x64], 3
je 0x1401e1318
jmp 0x1401e1324
lea rcx, str.Windows_8
call fcn.140010170
mov ecx, dword [rsp + 0x40]
call fcn.1401e0a50
jmp 0x1401e1324
lea rcx, str.Windows_Server_2012
call fcn.140010170
jmp 0x1401e1365
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x68], al
cmp byte [rsp + 0x68], 1
je 0x1401e1342
cmp byte [rsp + 0x68], 3
je 0x1401e1359
jmp 0x1401e1365
lea rcx, str.Windows_8.1
call fcn.140010170
mov ecx, dword [rsp + 0x40]
call fcn.1401e0a50
jmp 0x1401e1365
lea rcx, str.Windows_Server_2012_R2
call fcn.140010170
jmp 0x1401e13b1
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x1401e1389
cmp dword [rsp + 0x54], 1
je 0x1401e1397
cmp dword [rsp + 0x54], 2
je 0x1401e13a5
jmp 0x1401e13b1
lea rcx, str.Windows_2000
call fcn.140010170
jmp 0x1401e13b1
lea rcx, str.Windows_XP
call fcn.140010170
jmp 0x1401e13b1
lea rcx, str.Windows_Server_2003
call fcn.140010170
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x58], 0x100
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.DisplayVersion
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1401e1429
lea rdx, [rsp + 0x1b0]
lea rcx, str.__version:__s_
call fcn.140010170
mov edx, dword [rsp + 0x9c]
lea rcx, str.__build__u
call fcn.140010170
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [0x1402a05ac]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x1401e14a1
mov edx, dword [rsp + 0x70]
lea rcx, [0x1402a05b0]
call fcn.140010170
lea rcx, [0x140279840]
call fcn.140010170
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.14022cfc0
add rsp, 0x2c0
pop rdi
ret