Function at 0x140082df0
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x450
mov rax, qword [0x14016adb0]
xor rax, rsp
mov qword [rsp + 0x440], rax
test rcx, rcx
mov rbx, r8
mov rsi, rcx
jne 0x140082e21
xor eax, eax
jmp 0x1400836ce
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8d, 0x11c
mov qword [rsp + 0x468], rdi
call fcn.1400fce30
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov edi, eax
jne 0x140082e6f
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1400835ba
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetNativeSystemInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140082e9a
lea rcx, [rsp + 0x40]
call rax
jmp 0x140082ea5
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
test rbx, rbx
je 0x140082eb4
movzx eax, word [rsp + 0x184]
mov dword [rbx], eax
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x140083693
sub eax, 1
je 0x1400835c1
sub eax, 1
jne 0x1400836ac
cmp dword [rsp + 0x74], 6
jne 0x140082f2c
cmp dword [rsp + 0x78], eax
jne 0x140083017
cmp byte [rsp + 0x18a], 1
jne 0x140082f0e
lea r8, str.Windows_Vista
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
jmp 0x140083017
lea r8, str.Windows_Server__Longhorn_
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
jmp 0x140083017
cmp dword [rsp + 0x74], 5
jne 0x140082ff7
cmp dword [rsp + 0x78], 2
jne 0x140082fb3
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x140082f6b
lea r8, str.Windows_Server_2003__R2_
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
jmp 0x140083017
cmp byte [rsp + 0x18a], 1
jne 0x140082f98
cmp word [rsp + 0x40], 9
jne 0x140082f98
lea r8, str.Windows_XP_Professional_x64_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
jmp 0x140083017
lea r8, str.Windows_Server_2003
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
jmp 0x140083017
cmp dword [rsp + 0x78], 1
jne 0x140082fd5
lea r8, str.Windows_XP
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
jmp 0x140083017
cmp dword [rsp + 0x78], 0
jne 0x140083017
lea r8, str.Windows_2000
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
jmp 0x140083017
cmp dword [rsp + 0x74], 4
ja 0x140083017
lea r8, str.Windows_NT
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
test edi, edi
je 0x140083492
movzx eax, byte [rsp + 0x18a]
cmp al, 1
jne 0x14008335e
cmp dword [rsp + 0x74], 6
jne 0x14008331b
cmp dword [rsp + 0x78], 0
jne 0x14008331b
lea rcx, str.kernel32.dll
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.GetProductInfo
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx r9d, word [rsp + 0x186]
movzx r8d, word [rsp + 0x184]
mov edx, dword [rsp + 0x78]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x74]
call rax
test eax, eax
je 0x1400836ac
mov eax, dword [rsp + 0x30]
add eax, 0xffffffff
cmp eax, 0x18
ja case.default.0x1400830b9
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x836f0]
add rcx, rdx
jmp rcx
lea r8, str._Business_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Cluster_Server_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Server_Datacenter_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Enterprise_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Server_Enterprise_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Home_Basic_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Home_Premium_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Home_Server_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Server_for_Small_Business_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Small_Business_Server
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Small_Business_Server_Premium_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Server_Standard_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Starter_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Storage_Server_Enterprise_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Storage_Server_Express_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Storage_Server_Standard_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Storage_Server_Workgroup_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Ultimate_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp case.default.0x1400830b9
lea r8, str._Web_Server_Edition
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
movzx eax, word [rsp + 0x184]
cmp ax, 1
jb 0x1400836ac
lea r8, [rsp + 0x190]
lea rdx, str._s_SP_d
lea rcx, [rsp + 0x190]
movzx r9d, ax
call fcn.14001e4d0
jmp 0x1400836ac
cmp word [rsp + 0x40], 9
je 0x1400836ac
cmp dword [rsp + 0x74], 4
jne 0x14008333a
lea r8, str._Workstation_4.0
jmp 0x1400835a3
bt word [rsp + 0x188], 9
jae 0x140083352
lea r8, str._Home_Edition
jmp 0x1400835a3
lea r8, str._Professional
jmp 0x1400835a3
cmp al, 3
je 0x14008336a
cmp al, 2
jne 0x1400836ac
cmp dword [rsp + 0x74], 5
jne 0x140083470
cmp dword [rsp + 0x78], 2
jne 0x14008343d
movzx eax, word [rsp + 0x40]
cmp ax, 6
jne 0x1400833b7
movzx eax, byte [rsp + 0x188]
test al, al
jns 0x1400833a3
lea r8, str._Datacenter_Edition_for_Itanium_based_Systems
jmp 0x1400835a3
test al, 2
je 0x1400836ac
lea r8, str._Enterprise_Edition_for_Itanium_based_Systems
jmp 0x1400835a3
cmp ax, 9
jne 0x1400833f1
movzx eax, byte [rsp + 0x188]
test al, al
jns 0x1400833d5
lea r8, str._Datacenter_x64_Edition
jmp 0x1400835a3
test al, 2
je 0x1400833e5
lea r8, str._Enterprise_x64_Edition
jmp 0x1400835a3
lea r8, str._Standard_x64_Edition
jmp 0x1400835a3
movzx eax, byte [rsp + 0x188]
test al, al
jns 0x140083409
lea r8, str._Datacenter_Edition
jmp 0x1400835a3
test al, 2
je 0x140083419
lea r8, str._Enterprise_Edition
jmp 0x1400835a3
cmp word [rsp + 0x188], 0x400
jne 0x140083431
lea r8, str._Web_Edition
jmp 0x1400835a3
lea r8, str._Standard_Edition
jmp 0x1400835a3
cmp dword [rsp + 0x78], 0
jne 0x140083470
movzx eax, byte [rsp + 0x188]
test al, al
jns 0x14008345c
lea r8, str._Datacenter_Server
jmp 0x1400835a3
test al, 2
jne 0x14008359c
lea r8, str._Server
jmp 0x1400835a3
test byte [rsp + 0x188], 2
je 0x140083486
lea r8, str._Server_4.0__Enterprise_Edition
jmp 0x1400835a3
lea r8, str._Server_4.0
jmp 0x1400835a3
lea rax, [rsp + 0x38]
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov r9d, 1
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], LoadRegTypeLib
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400835ba
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, str.ProductType
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3a0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400835ba
cmp dword [rsp + 0x30], 0xa0
ja 0x1400835ba
lea rdx, [rsp + 0x3a0]
lea rcx, str.WINNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14008354d
lea r8, str._Workstation
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
lea rdx, [rsp + 0x3a0]
lea rcx, str.LANMANNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14008357f
lea r8, str._Server
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
lea rdx, [rsp + 0x3a0]
lea rcx, str.SERVERNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400836ac
lea r8, str._Advanced_Server
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
jmp 0x1400836ac
xor eax, eax
jmp 0x1400836c6
cmp dword [rsp + 0x74], 4
jne 0x1400836ac
mov eax, dword [rsp + 0x78]
test eax, eax
jne 0x14008362c
lea r8, str.Windows_95
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
movzx r11d, word [rsp + 0x86]
cmp r11w, 0x43
je 0x140083604
cmp r11w, 0x42
jne 0x14008361d
lea r8, str._OSR2
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
cmp dword [rsp + 0x74], 4
jne 0x1400836ac
mov eax, dword [rsp + 0x78]
cmp eax, 0xa
jne 0x140083685
lea r8, str.Windows_98
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
movzx r11d, word [rsp + 0x86]
cmp r11w, 0x41
je 0x140083661
cmp r11w, 0x42
jne 0x14008367a
lea r8, [0x14013af68]
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400fb090
cmp dword [rsp + 0x74], 4
jne 0x1400836ac
mov eax, dword [rsp + 0x78]
cmp eax, 0x5a
jne 0x1400836ac
lea r8, str.Windows_Millennium_Edition
jmp 0x14008369a
lea r8, str.Microsoft_Win32s
lea rcx, [rsp + 0x190]
mov edx, 0x104
call fcn.1400f9e00
lea r8, [rsp + 0x190]
mov edx, 0x104
mov rcx, rsi
call fcn.1400f9e00
mov eax, 1
mov rdi, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400f9790
mov rbx, qword [rsp + 0x478]
add rsp, 0x450
pop rsi
ret