Function at 0x140002bd4
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x508
mov dword [rsp + 0x290], 0
mov dword [rsp + 0x4b0], 0
mov r8d, 0x40
xor edx, edx
lea rcx, [rsp + 0x250]
call fcn.14002e760
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.14002e760
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.14002e760
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x518]
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002c7f
mov dword [rsp + 0x290], 0xffffffff
jmp 0x140002edb
mov eax, dword [rsp + 0x548]
mov dword [rsp + 0x4e8], eax
cmp dword [rsp + 0x4e8], 0
je 0x140002cb8
cmp dword [rsp + 0x4e8], 1
je 0x140002d88
cmp dword [rsp + 0x4e8], 2
je 0x140002e24
jmp 0x140002edb
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4ec], eax
cmp dword [rsp + 0x4ec], 0
jbe 0x140002d83
cmp dword [rsp + 0x4ec], 2
jbe 0x140002ce3
jmp 0x140002d83
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002d6e
lea rcx, [rsp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x4d8]
lea r8, [rsp + 0x40]
lea rdx, str._s__d
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x140002d83
lea rdx, [0x14004fcc0]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140002edb
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4f0], eax
cmp dword [rsp + 0x4f0], 0
jbe 0x140002e1f
cmp dword [rsp + 0x4f0], 2
jbe 0x140002dac
jmp 0x140002e1f
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002e0a
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x140002e1f
lea rdx, [0x14004fcd0]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140002edb
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4f4], eax
cmp dword [rsp + 0x4f4], 0
jbe 0x140002edb
cmp dword [rsp + 0x4f4], 2
jbe 0x140002e4f
jmp 0x140002edb
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002ed0
lea rdx, [0x14004fa2c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140002eb0
mov dword [rsp + 0x290], 0xffffffff
jmp 0x140002edb
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x140002edb
mov dword [rsp + 0x290], 0
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x290]
add rsp, 0x508
ret