Function at 0x140011480
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1400c24b8]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor ebp, ebp
lea rdx, [rsp + 0x40]
mov r8d, 0xf003f
mov qword [rsp + 0x40], rbp
lea rcx, str.SoftwareNVIDIA_CorporationGlobal_nView
mov edi, 0x80000
call fcn.14004fc60
test eax, eax
jne 0x14001151f
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], ebp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SharedMemorySize
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011514
mov edi, dword [rsp + 0x30]
shl edi, 0xa
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x2b0], rbx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x2b8], r14
mov dword [rsp + 0x30], ebp
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
call fcn.140067170
lea r9, str.nView_Shared_Memory
mov dword [rsp + 0x20], 0x4f52
lea r8, str._s__d
mov edx, 0x208
lea rcx, [rsp + 0x80]
call fcn.140004da0
lea rax, [rsp + 0x30]
mov r9d, edi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.1400112a0
mov rsi, rax
test rax, rax
je 0x140011684
mov rax, qword [0x1400ca5a0]
mov ebx, dword [rsp + 0x70]
test rax, rax
jne 0x1400115f6
mov r14d, 0x80000000
nop dword [rax]
cmp rbx, r14
jae 0x14001163e
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov edx, 0xf001f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov ecx, dword [rsp + 0x70]
add rbx, rcx
mov qword [0x1400ca5a0], rax
test rax, rax
je 0x1400115c0
cmp dword [rsp + 0x30], ebp
jne 0x1400116c0
test rax, rax
je 0x1400116c0
mov rax, qword [0x1400ca5a8]
mov ecx, edi
and ecx, 0xffffff
bts rcx, 0x18
mov dword [rax + 0x9218], edi
mov rdx, qword [0x1400ca5a0]
mov rax, qword [rdx]
and rax, 0xffffffffff000000
or rcx, rax
mov qword [rdx], rcx
jmp 0x1400116c0
test rax, rax
jne 0x1400115f6
call fcn.14004e890
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewSharedDataMemoryManager.cpp
lea rax, str.Failed_to_map_shared_heap_memory.
mov edx, 2
mov qword [rsp + 0x28], rax
lea r8, str.ShareHeapMemoryWithProcess
mov dword [rsp + 0x20], 0xd2
call fcn.14004f020
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400116c3
call fcn.14004e890
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewSharedDataMemoryManager.cpp
lea rax, str.Failed_to_create_shared_heap_memory.
mov edx, 2
mov qword [rsp + 0x28], rax
lea r8, str.ShareHeapMemoryWithProcess
mov dword [rsp + 0x20], 0xf0
call fcn.14004f020
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov r14, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140064920
lea r11, [rsp + 0x2a0]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret