Function at 0x140007ed0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub rsp, 0x188
mov rax, qword [0x14006ee08]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], DllRegisterServer
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [rsp + 0x60], 2
mov dword [rsp + 0x30], 0x80
jne 0x140008023
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov r9d, 0x101
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [0x1400708e4], 0xa
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000820a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
lea rdx, str.CurrentVersion
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400081ff
lea rdx, [rsp + 0xf0]
lea rcx, [0x140054c70]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140007fa9
mov dword [0x1400708e4], 9
jmp 0x1400081ff
lea rdx, [rsp + 0xf0]
lea rcx, [0x140054c6c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140007fd1
mov dword [0x1400708e4], 8
jmp 0x1400081ff
lea rdx, [rsp + 0xf0]
lea rcx, [0x140054c68]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x140007ff9
mov dword [0x1400708e4], 0xb
jmp 0x1400081ff
lea rdx, [rsp + 0xf0]
lea rcx, [0x140054c64]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
xor ecx, ecx
test eax, eax
setne cl
add ecx, 0xc
mov dword [0x1400708e4], ecx
jmp 0x1400081ff
cmp dword [rsp + 0x54], 4
mov dword [0x1400708e4], 1
jb 0x14000810d
cmp dword [rsp + 0x58], 0xa
jb 0x14000810d
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [0x1400708e4], 5
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000820a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
lea rdx, str.VersionNumber
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400081ff
lea rdx, [rsp + 0xf0]
lea rcx, str.4.10.2222
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1400080dd
mov dword [0x1400708e4], 6
jmp 0x1400081ff
lea rdx, [rsp + 0xf0]
lea rcx, str.4.90.3000
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ecx, dword [0x1400708e4]
mov edx, 7
test eax, eax
cmove ecx, edx
mov dword [0x1400708e4], ecx
jmp 0x1400081ff
lea rax, [rsp + 0x38]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000820a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
lea rdx, str.SubVersionNumber
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400081ff
lea rdx, [rsp + 0xf0]
lea rcx, [0x140054be8]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1400081a1
cmp dword [rsp + 0x58], 0xa
jae 0x1400081a1
mov dword [0x1400708e4], 2
jmp 0x1400081ff
lea rdx, [rsp + 0xf0]
lea rcx, [0x140054be4]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1400081cd
cmp dword [rsp + 0x58], 0xa
jae 0x1400081cd
mov dword [0x1400708e4], 3
jmp 0x1400081ff
lea rdx, [rsp + 0xf0]
lea rcx, [0x140054be0]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1400081ff
mov eax, dword [0x1400708e4]
cmp dword [rsp + 0x58], 0xa
mov ecx, 4
cmovb eax, ecx
mov dword [0x1400708e4], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400383f0
add rsp, 0x188
ret