Function at 0x140007300
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x2a0
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rsp + 0x290], rax
xor ebp, ebp
lea rdx, [rsp + 0x40]
mov r8d, 0xf003f
mov qword [rsp + 0x40], rbp
lea rcx, str.SoftwareNVIDIA_CorporationGlobal_nView
mov edi, 0x80000
call fcn.140059a80
test eax, eax
jne 0x14000739f
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x38]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x38], ebp
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SharedMemorySize
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140007394
mov edi, dword [rsp + 0x30]
shl edi, 0xa
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x2b0], rbx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x2b8], r14
mov dword [rsp + 0x30], ebp
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x208
call fcn.140070390
lea r9, str.nView_Shared_Memory
mov dword [rsp + 0x20], 0x4fa3
lea r8, str._s__d
mov edx, 0x208
lea rcx, [rsp + 0x80]
call fcn.140007050
lea rax, [rsp + 0x30]
mov r9d, edi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.140007120
mov rsi, rax
test rax, rax
je 0x140007504
mov rax, qword [0x1400d5750]
mov ebx, dword [rsp + 0x70]
test rax, rax
jne 0x140007476
mov r14d, 0x80000000
nop dword [rax]
cmp rbx, r14
jae 0x1400074be
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov edx, 0xf001f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov ecx, dword [rsp + 0x70]
add rbx, rcx
mov qword [0x1400d5750], rax
test rax, rax
je 0x140007440
cmp dword [rsp + 0x30], ebp
jne 0x140007540
test rax, rax
je 0x140007540
mov rax, qword [0x1400d5758]
mov ecx, edi
and ecx, 0xffffff
bts rcx, 0x18
mov dword [rax + 0x90d0], edi
mov rdx, qword [0x1400d5750]
mov rax, qword [rdx]
and rax, 0xffffffffff000000
or rcx, rax
mov qword [rdx], rcx
jmp 0x140007540
test rax, rax
jne 0x140007476
call fcn.1400588c0
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewSharedDataMemoryManager.cpp
lea rax, str.Failed_to_map_shared_heap_memory.
mov edx, 2
mov qword [rsp + 0x28], rax
lea r8, str.ShareHeapMemoryWithProcess
mov dword [rsp + 0x20], 0xd2
call fcn.140058e40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140007543
call fcn.1400588c0
mov rcx, rax
lea r9, str.D:uworkspace_nViewBranchBuilder_sw_nview_v200_nViewSharedDataMemoryManager.cpp
lea rax, str.Failed_to_create_shared_heap_memory.
mov edx, 2
mov qword [rsp + 0x28], rax
lea r8, str.ShareHeapMemoryWithProcess
mov dword [rsp + 0x20], 0xf0
call fcn.140058e40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov r14, qword [rsp + 0x2b8]
mov rbx, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.14006ed70
lea r11, [rsp + 0x2a0]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret