Function at 0x14020dc00
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x2c0
mov rax, qword [0x140307f80]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
lea rcx, str._tOS:
call fcn.14001c4c0
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0x11c
rep stosb byte [rdi], al
mov dword [rsp + 0x90], 0x11c
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x78], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x40], 0
cmp qword [rsp + 0x78], 0
je 0x14020dcb5
lea rcx, [rsp + 0x90]
call qword [rsp + 0x78]
mov dword [rsp + 0x44], eax
cmp qword [rsp + 0x78], 0
je 0x14020dcc4
cmp dword [rsp + 0x44], 0
je 0x14020dcd6
lea rcx, str.Windows__Unknown_Version_
call fcn.14001c4c0
nop
jmp 0x14020e146
cmp qword [rsp + 0x80], 0
je 0x14020dd17
movzx eax, word [rsp + 0x1a6]
movzx ecx, word [rsp + 0x1a4]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
mov r9d, eax
mov r8d, ecx
mov edx, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x94]
call qword [rsp + 0x80]
nop
xor eax, eax
test eax, eax
je 0x14020ddc6
mov edx, dword [rsp + 0x94]
lea rcx, str.dwMajorVersion:_____u_n
call fcn.14001c4c0
mov edx, dword [rsp + 0x98]
lea rcx, str.dwMinorVersion:_____u_n
call fcn.14001c4c0
mov edx, dword [rsp + 0x9c]
lea rcx, str.dwBuildNumber:______u_n
call fcn.14001c4c0
mov edx, dword [rsp + 0xa0]
lea rcx, str.dwPlatformId:_______u_n
call fcn.14001c4c0
movzx eax, word [rsp + 0x1a4]
mov edx, eax
lea rcx, str.wServicePackMajor:__u_n
call fcn.14001c4c0
movzx eax, word [rsp + 0x1a6]
mov edx, eax
lea rcx, str.wServicePackMinor:__u_n
call fcn.14001c4c0
movzx eax, word [rsp + 0x1a8]
mov edx, eax
lea rcx, str.wSuiteMask:_________u_n
call fcn.14001c4c0
movzx eax, byte [rsp + 0x1aa]
mov edx, eax
lea rcx, str.wProductType:_______u_n
call fcn.14001c4c0
nop
lea rcx, str.Windows
call fcn.14001c4c0
nop
mov eax, dword [rsp + 0x94]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x4c], 5
je 0x14020dffa
cmp dword [rsp + 0x4c], 6
je 0x14020deb4
cmp dword [rsp + 0x4c], 0xa
je 0x14020de00
jmp 0x14020e047
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x6c], al
cmp byte [rsp + 0x6c], 1
je 0x14020de15
jmp 0x14020de4a
cmp dword [rsp + 0x9c], 0x55f0
jae 0x14020de31
lea rcx, [0x1402e9df4]
call fcn.14001c4c0
nop
jmp 0x14020de3e
lea rcx, [0x1402e9df8]
call fcn.14001c4c0
nop
mov ecx, dword [rsp + 0x40]
call fcn.14020d6b0
nop
jmp 0x14020deaf
mov eax, dword [rsp + 0x9c]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0x3839
je 0x14020de75
cmp dword [rsp + 0x50], 0x4563
je 0x14020de84
cmp dword [rsp + 0x50], 0x4f7c
je 0x14020de93
jmp 0x14020dea2
lea rcx, str.2016_Server
call fcn.14001c4c0
nop
jmp 0x14020deaf
lea rcx, str.2019_Server
call fcn.14001c4c0
nop
jmp 0x14020deaf
lea rcx, str.2022_Server
call fcn.14001c4c0
nop
jmp 0x14020deaf
lea rcx, str.Unknown_Server
call fcn.14001c4c0
nop
jmp 0x14020e047
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x14020dee8
cmp dword [rsp + 0x48], 1
je 0x14020df2e
cmp dword [rsp + 0x48], 2
je 0x14020df74
cmp dword [rsp + 0x48], 3
je 0x14020dfb7
jmp 0x14020dff8
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x5c], al
cmp byte [rsp + 0x5c], 1
je 0x14020df04
cmp byte [rsp + 0x5c], 3
je 0x14020df1c
jmp 0x14020df29
lea rcx, str.Windows_Vista
call fcn.14001c4c0
mov ecx, dword [rsp + 0x40]
call fcn.14020d6b0
nop
jmp 0x14020df29
lea rcx, str.Windows_Server_2008
call fcn.14001c4c0
nop
jmp 0x14020dff8
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x60], al
cmp byte [rsp + 0x60], 1
je 0x14020df4a
cmp byte [rsp + 0x60], 3
je 0x14020df62
jmp 0x14020df6f
lea rcx, str.Windows_7
call fcn.14001c4c0
mov ecx, dword [rsp + 0x40]
call fcn.14020d6b0
nop
jmp 0x14020df6f
lea rcx, str.Windows_Server_2008_R2
call fcn.14001c4c0
nop
jmp 0x14020dff8
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x64], al
cmp byte [rsp + 0x64], 1
je 0x14020df90
cmp byte [rsp + 0x64], 3
je 0x14020dfa8
jmp 0x14020dfb5
lea rcx, str.Windows_8
call fcn.14001c4c0
mov ecx, dword [rsp + 0x40]
call fcn.14020d6b0
nop
jmp 0x14020dfb5
lea rcx, str.Windows_Server_2012
call fcn.14001c4c0
nop
jmp 0x14020dff8
movzx eax, byte [rsp + 0x1aa]
mov byte [rsp + 0x68], al
cmp byte [rsp + 0x68], 1
je 0x14020dfd3
cmp byte [rsp + 0x68], 3
je 0x14020dfeb
jmp 0x14020dff8
lea rcx, str.Windows_8.1
call fcn.14001c4c0
mov ecx, dword [rsp + 0x40]
call fcn.14020d6b0
nop
jmp 0x14020dff8
lea rcx, str.Windows_Server_2012_R2
call fcn.14001c4c0
nop
jmp 0x14020e047
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0
je 0x14020e01c
cmp dword [rsp + 0x54], 1
je 0x14020e02b
cmp dword [rsp + 0x54], 2
je 0x14020e03a
jmp 0x14020e047
lea rcx, str.Windows_2000
call fcn.14001c4c0
nop
jmp 0x14020e047
lea rcx, str.Windows_XP
call fcn.14001c4c0
nop
jmp 0x14020e047
lea rcx, str.Windows_Server_2003
call fcn.14001c4c0
nop
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x58], pe_nt_image_headers64
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 2
lea r8, str.DisplayVersion
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14020e0c0
lea rdx, [rsp + 0x1b0]
lea rcx, str.__version:__s_
call fcn.14001c4c0
nop
mov edx, dword [rsp + 0x9c]
lea rcx, str.__build__u
call fcn.14001c4c0
mov dword [rsp + 0x58], 4
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x10
lea r8, [0x1402e9f74]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14020e139
mov edx, dword [rsp + 0x70]
lea rcx, [0x1402e9f78]
call fcn.14001c4c0
nop
lea rcx, [0x1402aa700]
call fcn.14001c4c0
nop
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140257e70
add rsp, 0x2c0
pop rdi
ret