Function at 0x140017620
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0xf0], rax
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x3c], 0x80
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14001767a
xor eax, eax
jmp 0x1400178ea
mov eax, dword [rsp + 0x58]
xor r8d, r8d
mov ebx, dword [rsp + 0x54]
mov r9d, 1
shl rbx, 0x10
mov rcx, 0xffffffff80000002
or rbx, rax
lea rax, [rsp + 0x48]
shl rbx, 0x20
cmp dword [rsp + 0x60], 2
mov qword [rsp + 0x20], rax
jne 0x14001771f
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400178e7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400178dc
cmp dword [rsp + 0x40], 1
jne 0x1400178dc
lea rcx, [rbp + 0x70]
call qword [sym.imp.msvcrt.dll__wtol]
mov ecx, eax
shl rcx, 0x10
add rbx, rcx
mov dword [rsp + 0x3c], eax
jmp 0x1400178dc
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400178e7
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rbp + 0x70]
mov dword [rsp + 0x3c], 0x80
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.VersionNumber
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400178dc
cmp dword [rsp + 0x40], 1
jne 0x1400178dc
and dword [rsp + 0x30], eax
lea rcx, [rbp + 0x70]
and dword [rsp + 0x34], eax
and dword [rsp + 0x38], eax
and dword [rsp + 0x44], eax
xor ebx, ebx
jmp 0x14001779a
inc ebx
lea rcx, [rax + 2]
mov edx, 0x2e
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x140017794
mov ecx, ebx
sub ecx, 1
je 0x140017881
sub ecx, 1
je 0x14001785a
cmp ecx, 1
lea rcx, [rbp + 0x70]
je 0x14001782d
test ebx, ebx
je 0x1400177e0
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x38], eax
jmp 0x14001789c
inc ebx
lea rcx, [rax + 2]
mov edx, 0x2c
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x1400177da
lea rcx, [rbp + 0x70]
sub ebx, 1
je 0x140017824
sub ebx, 1
je 0x14001781b
cmp ebx, 1
je 0x140017812
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x30], eax
jmp 0x14001789c
lea rdx, str._lu__lu__lu__lu
jmp 0x140017834
lea rdx, str._lu__lu__lu
jmp 0x140017865
lea rdx, str._lu__lu
jmp 0x14001788c
lea rdx, str._lu._lu._lu._lu
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_swscanf]
jmp 0x14001789c
lea rdx, str._lu._lu._lu
lea rcx, [rbp + 0x70]
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
call qword [sym.imp.msvcrt.dll_swscanf]
jmp 0x14001789c
lea rdx, str._lu._lu
lea rcx, [rbp + 0x70]
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_swscanf]
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x44]
shl eax, 0x10
add ecx, eax
mov eax, dword [rsp + 0x38]
mov ebx, ecx
and rbx, 0xffffffffffff0000
shl eax, 0x10
add edx, eax
movzx eax, cx
or rbx, rax
mov ecx, edx
shl rbx, 0x10
shr rcx, 0x10
or rbx, rcx
movzx ecx, dx
shl rbx, 0x10
or rbx, rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0x210]
add rsp, 0x200
pop rbp
ret