Function at 0x140001988
Capabilities:
Check os version
Query environment variable
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r12d, r9d
mov r15, r8
mov r13, rdx
call qword [sym.imp.KERNEL32.dll_GetVersion]
call fcn.140001da0
test eax, eax
js 0x140001a17
cmp al, 6
jb 0x140001a17
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.140001da0
test rax, rax
je 0x140001a17
lea rdx, str.HeapSetInformation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call fcn.140001da0
test rax, rax
je 0x140001a17
movabs r10, 0x93b5969b18548370
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [0x1400022d8]
mov ebx, 0x105
or rax, 0xffffffffffffffff
mov ecx, ebx
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x28], ebx
call fcn.140001008
mov ecx, ebx
mov rdi, rax
call fcn.140001008
mov rbx, rax
mov sil, 1
test rdi, rdi
je 0x140001cc2
test rax, rax
je 0x140001cba
lea rcx, str.WLDP.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
call fcn.140001da0
mov r14, rax
test rax, rax
je 0x140001cba
lea rdx, str.WldpGetLockdownPolicy
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call fcn.140001da0
test rax, rax
je 0x140001ad4
xorps xmm0, xmm0
mov dword [rbp - 0x18], 1
movups xmmword [rbp - 0x10], xmm0
mov dword [rbp - 0x14], 5
movabs r10, 0x85fd0f4570d77270
xor r8d, r8d
lea rdx, [rbp - 0x2c]
lea rcx, [rbp - 0x18]
call qword [0x1400022d8]
xor ecx, ecx
test eax, eax
js 0x140001ad4
mov eax, dword [rbp - 0x2c]
and eax, 0x8000001c
movzx esi, sil
cmp eax, 0x80000004
cmovne esi, ecx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.140001da0
xor r14d, r14d
test sil, sil
jne 0x140001cba
lea rax, [rbp - 0x20]
xor r8d, r8d
lea r9d, [r14 + 1]
mov qword [rsp + 0x20], rax
lea rdx, str.clsid25336920_03f9_11cf_8fd0_00aa00686f13InProcServer32
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.140001da0
test eax, eax
jne 0x140001cba
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call fcn.140001da0
test eax, eax
jne 0x140001cba
cmp dword [rbp - 0x30], 2
jne 0x140001b7f
mov r8d, 0x105
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
call fcn.140001da0
test eax, eax
je 0x140001cba
cmp dword [rbp - 0x30], 2
mov rcx, rbx
je 0x140001b82
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
call fcn.140001da0
mov rcx, rdi
mov rsi, rax
call fcn.140001048
mov rcx, rbx
call fcn.140001048
mov rcx, qword [rbp - 0x20]
or rbx, 0xffffffffffffffff
cmp rcx, rbx
je 0x140001bbe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140001da0
mov qword [rbp - 0x20], rbx
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.140001da0
test rax, rax
je 0x140001c6c
lea rdx, str.RegisterApplicationRestart
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call fcn.140001da0
mov rdi, rax
test rax, rax
je 0x140001c6c
mov rcx, rbx
inc rcx
cmp byte [r15 + rcx], r14b
jne 0x140001bfb
lea r14d, [rcx + 1]
mov eax, 2
movsxd rcx, r14d
mul rcx
cmovo rax, rbx
mov rcx, rax
call fcn.140001008
mov rbx, rax
test rax, rax
je 0x140001c6c
mov dword [rsp + 0x28], r14d
or r9d, 0xffffffff
mov r8, r15
mov qword [rsp + 0x20], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
call fcn.140001da0
test eax, eax
jle 0x140001c64
movabs r10, 0xa1603f9b3e506170
xor edx, edx
mov rcx, rbx
mov rax, rdi
call qword [0x1400022d8]
mov rcx, rbx
call fcn.140001048
test rsi, rsi
je 0x140001ccf
lea rdx, str.RunHTMLApplication
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call fcn.140001da0
test rax, rax
je 0x140001ca9
movabs r10, 0x86800fdc1adc2270
mov rcx, qword [rbp + 0x30]
mov r9d, r12d
mov r8, r15
mov rdx, r13
call qword [0x1400022d8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.140001da0
jmp 0x140001ccf
mov rcx, rdi
call fcn.140001048
test rbx, rbx
je 0x140001ccf
mov rcx, rbx
call fcn.140001048
mov rcx, qword [rbp - 0x20]
cmp rcx, 0xffffffffffffffff
je 0x140001ce5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140001da0
lea r11, [rsp + 0x60]
xor eax, eax
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret