Function at 0x140004a20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x14006b3d0]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor eax, eax
lea r8, str.DSDFunctionKeyCtlServiceProc::CheckMinOSBuild
lea rsi, str.DSDFunctionKeyCtlServiceProc.cpp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
lea r14, str.__DSDFunctionKeyCtlServiceProc::CheckMinOSBuild_
lea r15, [0x14004b4ac]
lea rdx, str.ENTER__s
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], r15
mov dword [rbp - 0x80], 0x214
mov dword [rbp - 0x68], 3
call fcn.1400028a0
lea rcx, [rbp - 0x5e]
xor r12d, r12d
xor edx, edx
mov r8d, 0x9e
mov dword [rsp + 0x68], 0xa0
mov dil, 1
mov word [rbp - 0x60], r12w
call fcn.140032580
lea rcx, [rbp + 0x42]
xor edx, edx
mov r8d, 0x9e
mov word [rbp + 0x40], r12w
call fcn.140032580
lea rax, [rsp + 0x68]
lea r9d, [r12 + 2]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
lea r8, str.CurrentBuildNumber
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea r9d, [r12 + 2]
mov ebx, eax
lea rax, [rsp + 0x68]
lea r8, str.CurrentBuild
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x28], rax
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test ebx, ebx
je 0x140004bae
test eax, eax
je 0x140004bae
lea rdx, str.Error_Code:_0x_X
lea rcx, [rsp + 0x40]
mov r8d, 0x80004005
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], 0x220
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], r12d
call fcn.1400028a0
jmp 0x140004c9d
lea r9, [rbp - 0x60]
lea r8, str.szCurrentBuildNumber
lea rdx, str._s___s
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], 0x222
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], 3
call fcn.1400028a0
lea r9, [rbp + 0x40]
lea r8, str.szCurrentBuild
lea rdx, str._s___s
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], 0x223
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], 3
call fcn.1400028a0
mov eax, 0xa
lea rdx, str.Check_Min_OS_build_number_17763
lea rcx, [rsp + 0x40]
mov word [rbp - 0x56], ax
mov word [rbp + 0x4a], ax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], 0x228
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], 3
call fcn.1400028a0
lea rdx, str.17763
lea rcx, [rbp - 0x60]
mov r8d, 5
call fcn.140030a40
test eax, eax
jns 0x140004c9a
lea rdx, str.17763
lea rcx, [rbp + 0x40]
mov r8d, 5
call fcn.140030a40
test eax, eax
jns 0x140004c9a
xor dil, dil
jmp 0x140004c9d
mov dil, 1
lea rax, str.true
lea r9, str.false
test dil, dil
lea r8, str.bIsSupportedByMinOSBuild
lea rdx, str._s___s
lea rcx, [rsp + 0x40]
cmovne r9, rax
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x48], 0x234
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
mov dword [rsp + 0x60], 3
call fcn.1400028a0
mov r8, qword [rsp + 0x70]
lea rdx, str.LEAVE__s
lea rcx, [rsp + 0x78]
call fcn.1400028a0
movzx eax, dil
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.14002f400
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret