Function at 0x14001b6b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0xf0], rax
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x40], 0x80
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b715
xor eax, eax
jmp 0x14001b9e1
mov eax, dword [rsp + 0x58]
xor r8d, r8d
mov ebx, dword [rsp + 0x54]
mov r9d, 1
shl rbx, 0x10
mov rcx, 0xffffffff80000002
or rbx, rax
lea rax, [rsp + 0x48]
shl rbx, 0x20
cmp dword [rsp + 0x60], 2
mov qword [rsp + 0x20], rax
jne 0x14001b7d0
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b9de
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b9cd
cmp dword [rsp + 0x3c], 1
jne 0x14001b9cd
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtol]
nop dword [rax + rax]
mov ecx, eax
shl rcx, 0x10
add rbx, rcx
mov dword [rsp + 0x40], eax
jmp 0x14001b9cd
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b9de
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.VersionNumber
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b9cd
cmp dword [rsp + 0x3c], 1
jne 0x14001b9cd
and dword [rsp + 0x30], eax
lea edx, [rax + 0x2e]
and dword [rsp + 0x34], eax
lea rcx, [rbp + 0x70]
and dword [rsp + 0x38], eax
xor ebx, ebx
and dword [rsp + 0x44], eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x14001b912
inc ebx
lea rcx, [rax + 2]
mov edx, 0x2e
mov edi, ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14001b85f
sub edi, 1
je 0x14001b909
sub edi, 1
je 0x14001b8e0
cmp edi, 1
je 0x14001b8ad
test ebx, ebx
je 0x14001b912
lea rcx, [rbp + 0x70]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rsp + 0x38], eax
jmp 0x14001b98d
lea rdx, str._lu._lu._lu._lu
lea rcx, [rbp + 0x70]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call fcn.1400025b4
jmp 0x14001b98d
lea rdx, str._lu._lu._lu
lea rcx, [rbp + 0x70]
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
call fcn.1400025b4
jmp 0x14001b98d
lea rdx, str._lu._lu
jmp 0x14001b97a
mov edi, 0x2c
lea rcx, [rbp + 0x70]
jmp 0x14001b923
inc ebx
lea rcx, [rax + 2]
mov edx, edi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14001b91d
sub ebx, 1
je 0x14001b973
lea rcx, [rbp + 0x70]
sub ebx, 1
je 0x14001b967
cmp ebx, 1
je 0x14001b95b
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
jmp 0x14001b98d
lea rdx, str._lu__lu__lu__lu
jmp 0x14001b8b8
lea rdx, str._lu__lu__lu
jmp 0x14001b8eb
lea rdx, str._lu__lu
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x70]
call fcn.1400025b4
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x44]
shl eax, 0x10
add ecx, eax
mov eax, dword [rsp + 0x38]
mov ebx, ecx
and rbx, 0xffffffffffff0000
shl eax, 0x10
add edx, eax
movzx eax, cx
or rbx, rax
mov ecx, edx
shl rbx, 0x10
shr rcx, 0x10
or rbx, rcx
movzx ecx, dx
shl rbx, 0x10
or rbx, rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov rax, rbx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret