Function at 0x14000aa00
Capabilities:
Check os version
Get system information on windows
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2f8
mov rax, qword [0x14010a040]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
mov eax, dword [0x14011b538]
mov ecx, dword [0x1401188d0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000aa74
lea rsi, [0x14011b530]
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.14005e230
mov rax, rsi
add rsp, 0x2f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x14011b538]
call fcn.14005c764
cmp dword [0x14011b538], 0xffffffff
jne 0x14000aa46
lea rsi, [rsp + 0x1c8]
mov r8d, 0x118
mov rcx, rsi
xor edx, edx
call fcn.140090270
mov dword [rsi - 4], 0x11c
lea rsi, [rsp + 0x1c4]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
lea rdi, [rsp + 0x3c]
mov dword [rdi], 0
mov ecx, dword [rsi + 4]
mov edx, dword [rsi + 8]
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x88
call fcn.14005c69c
mov rsi, rax
mov r13, rax
mov r15d, dword [rdi]
mov eax, dword [0x14011b580]
mov ecx, dword [0x1401188d0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14000ab55
lea rcx, [0x14011b580]
call fcn.14005c764
cmp dword [0x14011b580], 0xffffffff
jne 0x14000ab55
xorps xmm0, xmm0
movups xmmword [0x14011b570], xmm0
movups xmmword [0x14011b560], xmm0
movups xmmword [0x14011b550], xmm0
lea rcx, [0x14011b550]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
lea rcx, [0x14011b580]
call fcn.14005c6f8
mov dword [r13], 0
xorps xmm0, xmm0
movups xmmword [r13 + 0x20], xmm0
movups xmmword [r13 + 0x30], xmm0
movups xmmword [r13 + 0x40], xmm0
movabs rax, 0x300000004
mov qword [r13 + 0x60], rax
movups xmmword [r13 + 0x68], xmm0
xor r14d, r14d
mov qword [r13 + 0x78], r14
mov dword [r13 + 0x80], r15d
mov eax, dword [rsp + 0x1c8]
mov dword [r13 + 4], eax
mov eax, dword [rsp + 0x1cc]
mov dword [r13 + 8], eax
mov eax, dword [rsp + 0x1d0]
mov dword [r13 + 0xc], eax
mov qword [rsp + 0xa0], r14
movaps xmmword [rsp + 0x90], xmm0
movabs rax, 0xaaaaaaaa00000000
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x68], r14
lea rax, [rsp + 0x40]
mov qword [rax], r14
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000acc2
mov rcx, qword [rsp + 0x58]
test rcx, rcx
jne 0x14000afcf
lea r9, [rsp + 0x40]
mov rcx, qword [r9]
mov qword [rsp + 0x58], rcx
xor r14d, r14d
mov dword [rsp + 0x60], r14d
mov eax, 4
mov dword [r9], eax
lea rdx, [rsp + 0x70]
mov dword [rdx], eax
lea rax, [rsp + 0x2e0]
mov dword [rax], r14d
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rax
lea rdx, [0x1400f78ba]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ac8b
mov eax, dword [rsp + 0x40]
add eax, 0xfffffffd
xor r14d, r14d
cmp dword [rsp + 0x70], 4
mov ecx, 0
jne 0x14000ac84
mov ecx, dword [rsp + 0x2e0]
cmp eax, 2
cmovb r14d, ecx
lea rdx, str.DisplayVersion
lea rcx, [rsp + 0x58]
lea rdi, [rsp + 0x90]
mov r8, rdi
call fcn.14000b6b0
movsx rax, byte [rdi + 0x17]
test rax, rax
jns 0x14000acb9
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x14000b057
lea r12, [rsi + 0x20]
add rsi, 0x38
lea rbx, [rsp + 0x90]
movsx rcx, byte [rbx + 0x17]
test rcx, rcx
cmovs rcx, qword [rbx + 8]
mov rax, qword [rbx]
cmovns rax, rbx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
test rcx, rcx
js 0x14000b5e5
sete cl
test rax, rax
setne al
or al, cl
je 0x14000b5e5
lea rdi, [rsp + 0x40]
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.140057ac0
mov rbp, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x2e0], rax
mov rax, qword [rdi + 0xf]
mov qword [rsp + 0x2e7], rax
mov dil, byte [rdi + 0x17]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000ad5c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x60], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x68], 0
test rcx, rcx
jne 0x14000b041
cmp byte [rsp + 0xa7], 0
js 0x14000afda
mov dword [r13 + 0x10], r14d
cmp byte [r13 + 0x37], 0
js 0x14000afec
mov qword [r13 + 0x20], rbp
mov rax, qword [rsp + 0x2e0]
mov rcx, qword [rsp + 0x2e7]
mov qword [r13 + 0x28], rax
mov qword [r13 + 0x2f], rcx
mov byte [r13 + 0x37], dil
mov edi, dword [r13 + 0xc]
mov ebp, dword [r13 + 4]
mov eax, 0x16
cmp ebp, 0xa
jne 0x14000b27d
cmp edi, 0x5866
ja 0x14000af9d
cmp edi, 0x585c
ja 0x14000afa7
cmp edi, 0x55ef
ja 0x14000ae15
cmp edi, 0x4f7b
ja 0x14000afb1
cmp edi, 0x4a64
ja 0x14000afbb
je 0x14000afc5
mov eax, 0x12
cmp edi, 0x4a62
jbe 0x14000b1dd
mov dword [r13], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
mov eax, dword [0x14011b548]
mov ecx, dword [0x1401188d0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jle 0x14000ae88
lea rcx, [0x14011b548]
call fcn.14005c764
cmp dword [0x14011b548], 0xffffffff
jne 0x14000ae88
lea rcx, [0x1400ee5d6]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.IsWow64Process2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14011b540], rax
lea rcx, [0x14011b548]
call fcn.14005c6f8
mov rax, qword [0x14011b540]
test rax, rax
je 0x14000b075
xor ecx, ecx
lea rdx, [rsp + 0x90]
mov word [rdx], cx
lea r8, [rsp + 0x58]
mov word [r8], cx
mov rcx, rdi
call qword [0x1400ff3b8]
test eax, eax
je 0x14000aeee
movzx eax, word [rsp + 0x90]
test eax, eax
jne 0x14000b007
mov dword [r13 + 0x60], eax
movzx eax, word [rsp + 0x58]
xor ecx, ecx
cmp eax, 0x8664
setne cl
inc ecx
xor edx, edx
cmp eax, 0xaa64
cmovne edx, ecx
mov dword [r13 + 0x64], edx
lea rcx, [rsp + 0x1d8]
movzx eax, word [rcx + 0x100]
mov dword [r13 + 0x18], eax
movzx eax, word [rcx + 0x102]
mov dword [r13 + 0x1c], eax
lea rdi, [rsp + 0x58]
mov qword [rdi], rcx
call fcn.14005cc4c
mov qword [rdi + 8], rax
lea rcx, [rsp + 0x90]
mov rdx, rdi
call fcn.140057ac0
cmp byte [r13 + 0x4f], 0
js 0x14000affa
mov rax, qword [rsp + 0xa0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsi], xmm0
mov eax, dword [0x14011b570]
mov dword [r13 + 0x50], eax
mov eax, dword [0x14011b578]
mov qword [r13 + 0x58], rax
mov eax, dword [rsp + 0x1c8]
cmp eax, 0xa
jne 0x14000b175
cmp r15d, 4
jne 0x14000b0be
mov dword [r13 + 0x14], 3
mov qword [0x14011b530], r13
lea rcx, [0x14011b538]
call fcn.14005c6f8
jmp 0x14000aa46
mov eax, 0x18
jmp 0x14000ae15
mov eax, 0x17
jmp 0x14000ae15
mov eax, 0x15
jmp 0x14000ae15
mov eax, 0x14
jmp 0x14000ae15
mov eax, 0x13
jmp 0x14000ae15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000ac1a
mov rcx, qword [rsp + 0x90]
call fcn.14005c694
jmp 0x14000ad81
mov rcx, qword [r12]
call fcn.14005c694
jmp 0x14000ad90
mov rcx, qword [rsi]
call fcn.14005c694
jmp 0x14000af38
lea ecx, [rax - 0x1c0]
cmp ecx, 4
ja 0x14000b01c
mov edx, 0x15
bt edx, ecx
jb 0x14000b037
cmp eax, 0x14c
jne 0x14000b02d
mov eax, 1
jmp 0x14000aecb
mov eax, 3
jmp 0x14000aecb
mov eax, 2
jmp 0x14000aecb
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [0x1400ff3b8]
jmp 0x14000ad73
lea rdx, str.ReleaseId
lea rcx, [rsp + 0x58]
lea r8, [rsp + 0x90]
call fcn.14000b6b0
jmp 0x14000acc2
lea rdx, [rsp + 0x90]
mov dword [rdx], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x14000aeee
cmp dword [rsp + 0x90], 0
je 0x14000b0b1
movabs rax, 0x100000001
mov qword [r13 + 0x60], rax
jmp 0x14000aeee
mov dword [r13 + 0x60], 0
jmp 0x14000aeee
cmp r15d, 0x30
ja 0x14000b102
mov eax, r15d
mov ecx, 0x206f780
bt rcx, rax
jae 0x14000b0df
mov dword [r13 + 0x14], 2
jmp 0x14000af85
mov ecx, 0x8010040
bt rcx, rax
jb 0x14000af7d
movabs rcx, 0x1000000000002
bt rcx, rax
jb 0x14000b1d0
lea eax, [r15 - 0x46]
cmp eax, 0x3c
ja 0x14000b13c
movabs rcx, 0x1980000000004005
bt rcx, rax
jb 0x14000af7d
movabs rcx, 0x18000000000000
bt rcx, rax
jae 0x14000b13c
mov dword [r13 + 0x14], 4
jmp 0x14000af85
add r15d, 0xffffff74
cmp r15d, 0x33
ja 0x14000b183
movabs rax, 0x9000000000003
bt rax, r15
jb 0x14000af7d
mov eax, 0x3000000
bt rax, r15
jae 0x14000b183
mov dword [r13 + 0x14], 5
jmp 0x14000af85
cmp eax, 5
je 0x14000b190
cmp eax, 6
je 0x14000af73
mov dword [r13 + 0x14], 0
jmp 0x14000af85
mov eax, dword [rsp + 0x1cc]
cmp eax, 1
je 0x14000b1c6
cmp eax, 2
jne 0x14000b183
cmp byte [rsp + 0x2de], 1
jne 0x14000b1b5
cmp word [0x14011b550], 9
je 0x14000b1d0
cmp word [rsp + 0x2dc], 0
jns 0x14000b0d2
jmp 0x14000b183
test byte [rsp + 0x2dd], 2
jne 0x14000b183
mov dword [r13 + 0x14], 1
jmp 0x14000af85
mov eax, 0x11
je 0x14000ae15
mov eax, 0x10
cmp edi, 0x4a60
ja 0x14000ae15
mov eax, 0xf
cmp edi, 0x47ba
ja 0x14000ae15
mov eax, 0xe
je 0x14000ae15
mov eax, 0xd
cmp edi, 0x4562
ja 0x14000ae15
mov eax, 0xc
cmp edi, 0x42ed
ja 0x14000ae15
mov eax, 0xb
cmp edi, 0x3faa
ja 0x14000ae15
mov eax, 0xa
cmp edi, 0x3ad6
ja 0x14000ae15
mov eax, 9
cmp edi, 0x3838
ja 0x14000ae15
cmp edi, 0x295a
mov eax, 7
sbb eax, 0xffffffff
jmp 0x14000ae15
cmp ebp, 0xb
je 0x14000ae15
mov r14d, dword [r13 + 8]
cmp ebp, 7
jae 0x14000b2cf
cmp ebp, 6
jne 0x14000b2a9
lea ecx, [r14 + 3]
cmp r14d, 3
mov eax, 6
cmovb eax, ecx
jmp 0x14000ae15
cmp ebp, 5
setne cl
test r14d, r14d
sete dl
xor eax, eax
or dl, cl
jne 0x14000ae15
xor eax, eax
cmp r14d, 1
setne al
inc eax
jmp 0x14000ae15
mov ecx, 2
call fcn.14003cdf0
test al, al
je 0x14000b370
lea rdx, str....._basewinwindows_version.cc
lea rcx, [rsp + 0x90]
mov r8d, 0x1b6
mov r9d, 2
call fcn.1400af020
lea rcx, [rsp + 0xa0]
lea rdx, str.Unsupported_version:
mov r8d, 0x15
call fcn.14005bae0
mov rcx, rax
mov edx, ebp
call fcn.14000de20
lea r12, [0x1400edd7a]
mov r8d, 1
mov rcx, rax
mov rdx, r12
call fcn.14005bae0
mov rcx, rax
mov edx, r14d
call fcn.14000de20
mov r8d, 1
mov rcx, rax
mov rdx, r12
call fcn.14005bae0
mov rcx, rax
mov edx, edi
call fcn.14000de20
lea rcx, [rsp + 0x90]
call fcn.1400af370
movabs r12, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x2e0], r12
mov rcx, rbx
mov edx, ebp
call fcn.140002190
movsx rax, byte [rsp + 0xa7]
test rax, rax
jns 0x14000b3aa
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rax
test rax, rax
js 0x14000b5e5
sete al
test rbx, rbx
setne cl
or cl, al
je 0x14000b5e5
mov eax, dword [0x14011b590]
mov ecx, dword [0x1401188d0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000b5e7
mov rdx, qword [0x14011b588]
lea rcx, [rsp + 0x2e0]
lea r8, [rsp + 0x58]
call fcn.140001f50
cmp byte [rsp + 0xa7], 0
jns 0x14000b423
mov rcx, qword [rsp + 0x90]
call fcn.14005c694
mov qword [rsp + 0x88], r12
lea rbx, [rsp + 0x90]
mov rcx, rbx
mov edx, r14d
call fcn.140002190
movsx rax, byte [rbx + 0x17]
test rax, rax
jns 0x14000b458
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rax
test rax, rax
js 0x14000b5e5
sete al
test rbx, rbx
setne cl
or cl, al
je 0x14000b5e5
mov eax, dword [0x14011b5a0]
mov ecx, dword [0x1401188d0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000b629
mov rdx, qword [0x14011b598]
lea rcx, [rsp + 0x88]
lea r8, [rsp + 0x40]
call fcn.140001f50
cmp byte [rsp + 0xa7], 0
jns 0x14000b4d1
mov rcx, qword [rsp + 0x90]
call fcn.14005c694
mov qword [rsp + 0x80], r12
lea rbx, [rsp + 0x90]
mov rcx, rbx
mov edx, edi
call fcn.140002190
movsx rax, byte [rbx + 0x17]
test rax, rax
jns 0x14000b505
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rax
test rax, rax
js 0x14000b5e5
sete al
test rbx, rbx
setne cl
or cl, al
je 0x14000b5e5
mov eax, dword [0x14011b5b0]
mov ecx, dword [0x1401188d0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000b66b
mov rdx, qword [0x14011b5a8]
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0x70]
call fcn.140001f50
cmp byte [rsp + 0xa7], 0
jns 0x14000b57e
mov rcx, qword [rsp + 0x90]
call fcn.14005c694
lea rdx, str.MajorMinorBuildToVersion
lea r8, str....._basewinwindows_version.cc
lea rdi, [rsp + 0x90]
mov rcx, rdi
mov r9d, 0x1bc
call fcn.140052d50
movabs rdx, 0x141dd76000
mov rcx, rdi
call fcn.140090cc0
lea rcx, [rsp + 0x80]
call fcn.140001f10
lea rcx, [rsp + 0x88]
call fcn.140001f10
lea rcx, [rsp + 0x2e0]
call fcn.140001f10
mov eax, 0x19
jmp 0x14000ae15
ud2
lea rcx, [0x14011b590]
call fcn.14005c764
cmp dword [0x14011b590], 0xffffffff
jne 0x14000b3f3
lea rcx, str.WindowsVersion_major
mov edx, 0x20
call fcn.14003c6c0
mov qword [0x14011b588], rax
lea rcx, [0x14011b590]
call fcn.14005c6f8
jmp 0x14000b3f3
lea rcx, [0x14011b5a0]
call fcn.14005c764
cmp dword [0x14011b5a0], 0xffffffff
jne 0x14000b4a1
lea rcx, str.WindowsVersion_minor
mov edx, 0x20
call fcn.14003c6c0
mov qword [0x14011b598], rax
lea rcx, [0x14011b5a0]
call fcn.14005c6f8
jmp 0x14000b4a1
lea rcx, [0x14011b5b0]
call fcn.14005c764
cmp dword [0x14011b5b0], 0xffffffff
jne 0x14000b54e
lea rcx, str.WindowsVersion_build
mov edx, 0x20
call fcn.14003c6c0
mov qword [0x14011b5a8], rax
lea rcx, [0x14011b5b0]
call fcn.14005c6f8
jmp 0x14000b54e