Function at 0x1400133b0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1b8
mov rbp, qword [sym.imp.libssp_0.dll___stack_chk_guard]
mov rax, qword [rbp]
mov qword [rsp + 0x1a8], rax
xor eax, eax
mov rsi, rcx
lea rbx, [rsp + 0x80]
mov ecx, 0x23
mov qword [rsp + 0x48], 0
mov rdi, rbx
rep stosq qword [rdi], rax
lea rcx, str.ntdll
mov dword [rsp + 0x80], 0x11c
mov dword [rdi], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400137b0
mov rcx, rbx
call rax
mov rdi, qword [rsp + 0x48]
test rdi, rdi
jne 0x140013690
mov ecx, pe_nt_image_headers64
lea r12, [rsp + 0x50]
mov qword [rsp + 0x50], 0xffffffffffffffff
movzx r13d, byte [rsp + 0x19a]
mov dword [rsp + 0x44], pe_nt_image_headers64
call sym.g_malloc0
mov r8, r12
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140013720
lea r15, [rsp + 0x44]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r15
mov rcx, qword [rsp + 0x50]
lea rdx, [0x14008a5b1]
mov r14, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call r14
cmp eax, 0xea
je 0x1400136a0
test eax, eax
jne 0x14001381c
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x14001369b
mov ecx, 0xa0
call sym.g_malloc0
mov r8d, dword [rsp + 0x88]
mov edx, dword [rsp + 0x84]
lea rcx, str._lu._lu
mov byte [rax + 0x10], 1
mov rsi, rax
call sym.g_strdup_printf
mov byte [rsi], 1
mov edx, dword [rsp + 0x8c]
lea rcx, [0x14008a61d]
mov qword [rsi + 0x18], rax
call sym.g_strdup_printf
mov byte [rsi + 0x20], 1
mov rcx, r12
mov qword [rsi + 8], rax
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx edx, word [rsp + 0x50]
cmp dx, 6
je 0x140013780
ja 0x140013670
test dx, dx
je 0x140013798
cmp dx, 5
jne 0x140013760
lea rcx, [0x14008a628]
call sym.g_strdup
mov qword [rsi + 0x28], rax
lea rcx, str.mswindows
mov byte [rsi + 0x30], 1
call sym.g_strdup
mov byte [rsi + 0x40], 1
lea rcx, str.Microsoft_Windows
mov qword [rsi + 0x38], rax
call sym.g_strdup
mov qword [rsi + 0x58], rbx
movzx r9d, byte [rsp + 0x19a]
lea rbx, [0x14008a51e]
mov qword [rsi + 0x48], rax
mov r8d, dword [rsp + 0x8c]
mov byte [rsi + 0x50], 1
mov edx, dword [rsp + 0x88]
mov byte [rsi + 0x60], 1
mov ecx, dword [rsp + 0x84]
mov dword [rsp + 0x20], 0
call sym.ga_get_win_name.isra.0
mov byte [rsi + 0x70], 1
movzx r9d, byte [rsp + 0x19a]
mov qword [rsi + 0x68], rax
mov r8d, dword [rsp + 0x8c]
mov dword [rsp + 0x20], 1
mov edx, dword [rsp + 0x88]
mov ecx, dword [rsp + 0x84]
call sym.ga_get_win_name.isra.0
cmp r13b, 1
mov byte [rsi + 0x80], 1
mov qword [rsi + 0x78], rax
lea rax, [0x14008a517]
cmovne rbx, rax
mov rcx, rbx
call sym.g_strdup
mov byte [rsi + 0x90], 1
mov rcx, rbx
mov qword [rsi + 0x88], rax
call sym.g_strdup
mov qword [rsi + 0x98], rax
mov rax, qword [rsp + 0x1a8]
sub rax, qword [rbp]
jne 0x140013824
mov rax, rsi
add rsp, 0x1b8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp dx, 9
jne 0x140013760
lea rcx, str.x86_64
call sym.g_strdup
jmp 0x140013569
mov rdx, rdi
mov rcx, rsi
call sym.error_propagate
xor esi, esi
jmp 0x140013647
mov edx, dword [rsp + 0x44]
lea rcx, str.ProductName_longer_than_expected___lu_bytes___retrying
mov dword [rsp + 0x3c], eax
call dbg.slog
mov rcx, rbx
call sym.g_free
mov ecx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x3c]
test ecx, ecx
jne 0x1400137f0
lea rbx, str.failed_to_retrive_ProductName
mov dword [rsp + 0x20], eax
mov rcx, rsi
lea r9, str.ga_get_win_product_name
mov qword [rsp + 0x28], rbx
mov r8d, 0x95b
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_win32_internal
mov rcx, qword [rsp + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x140013709
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
xor esi, esi
call sym.g_free
jmp 0x140013647
lea rdi, str.failed_to_open_registry_key
mov dword [rsp + 0x20], eax
mov rcx, rsi
lea r9, str.ga_get_win_product_name
mov qword [rsp + 0x28], rdi
mov r8d, 0x948
lea rdx, str..._qga_commands_win32.c
xor esi, esi
call dbg.error_setg_win32_internal
mov rcx, rbx
call sym.g_free
jmp 0x140013647
lea rcx, str.unknown_processor_architecture_0x_0x
call dbg.slog
lea rcx, [0x14008a65d]
call sym.g_strdup
jmp 0x140013569
lea rcx, str.ia64
call sym.g_strdup
jmp 0x140013569
lea rcx, [0x14008a631]
call sym.g_strdup
jmp 0x140013569
lea rax, str.Failed_to_get_address_of_RtlGetVersion
lea rcx, [rsp + 0x48]
mov r8d, 0x90c
mov qword [rsp + 0x28], rax
lea rax, str.Guest_agent_command_failed__error_was__s
lea r9, str.ga_get_win_version
mov qword [rsp + 0x20], rax
lea rdx, str..._qga_commands_win32.c
call dbg.error_setg_internal
jmp 0x140013433
call sym.g_malloc0
mov qword [rsp + 0x28], r15
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
mov rbx, rax
lea rdx, [0x14008a5b1]
call r14
jmp 0x1400134c2
mov rdi, rbx
jmp 0x1400136cc
call sym.__stack_chk_fail
nop
nop word [rax + rax]