Function at 0x140052390
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x468]
sub rsp, 0x540
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1403ad830]
xor rax, rsp
mov qword [rbp + 0x430], rax
mov rbx, rcx
xor r14d, r14d
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
add rcx, 0x18
call fcn.14001f170
mov qword [rbx + 0x40], r14
lea rcx, [rbp + 0x70]
call fcn.14001cac0
nop
xor edx, edx
mov r8d, 0x11c
lea rcx, [rsp + 0x50]
call fcn.140285450
mov dword [rsp + 0x50], 0x11c
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov r12d, eax
test eax, eax
jne 0x14005243a
mov dword [rsp + 0x50], 0x114
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x140052b69
mov ecx, dword [rsp + 0x54]
cmp ecx, 6
jne 0x14005244f
cmp dword [rsp + 0x58], 2
je 0x140052457
jmp 0x140052540
test ecx, ecx
jne 0x140052540
mov rsi, qword gs:[0x30]
test rsi, rsi
je 0x14005253c
mov rsi, qword [rsi + 0x60]
test rsi, rsi
je 0x14005253c
mov ecx, dword [rsi + 0x118]
mov dword [rsp + 0x54], ecx
mov eax, dword [rsi + 0x11c]
mov dword [rsp + 0x58], eax
movzx eax, word [rsi + 0x120]
mov dword [rsp + 0x5c], eax
movzx eax, word [rsi + 0x122]
test ax, ax
je 0x140052530
movzx edi, ax
shr edi, 8
lea rdx, [0x1402d9348]
lea rcx, [rbp + 0x98]
call fcn.14001c950
nop
mov r8d, 0xa
mov edx, edi
lea rcx, [rbp + 0xe8]
call fcn.14001c580
nop
lea rdx, [rbp + 0xe8]
lea rcx, [rbp + 0x98]
call fcn.14001d850
nop
lea rcx, [rbp + 0xe8]
call fcn.14001d440
lea rcx, [rbp + 0x98]
call fcn.14002aa20
lea rdx, [rsp + 0x64]
sub rdx, rax
nop dword [rax + rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140052510
lea rcx, [rbp + 0x98]
call fcn.14001d440
mov ecx, dword [rsp + 0x54]
mov eax, dword [rsi + 0x124]
mov dword [rsp + 0x60], eax
jmp 0x140052540
mov ecx, dword [rsp + 0x54]
mov dword [rbx + 0xc], ecx
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x5c]
mov dword [rbx + 0x14], eax
lea rdx, [0x1402d03c4]
lea rcx, [rbp + 0x138]
call fcn.14001c950
nop
lea rdx, [0x1402d03c4]
lea rcx, [rbp + 0x110]
call fcn.14001c950
nop
mov r8d, 0xa
mov edx, dword [rbx + 0x14]
lea rcx, [rbp + 0x340]
call fcn.14001c580
mov rsi, rax
mov r8d, 0xa
mov edx, dword [rbx + 0x10]
lea rcx, [rbp + 0x318]
call fcn.14001c580
mov rdi, rax
mov r8d, 0xa
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x2f0]
call fcn.14001c580
nop
lea r8, [rbp + 0x110]
mov rdx, rax
lea rcx, [rbp + 0x2c8]
call fcn.14001da00
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.14001da00
nop
lea r8, [rbp + 0x138]
mov rdx, rax
lea rcx, [rbp + 0x278]
call fcn.14001da00
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rbp + 0x250]
call fcn.14001da00
nop
mov rdx, rax
lea rcx, [rbx + 0x18]
call fcn.14001d690
nop
lea rcx, [rbp + 0x250]
call fcn.14001d440
nop
lea rcx, [rbp + 0x278]
call fcn.14001d440
nop
lea rcx, [rbp + 0x2a0]
call fcn.14001d440
nop
lea rcx, [rbp + 0x2c8]
call fcn.14001d440
nop
lea rcx, [rbp + 0x2f0]
call fcn.14001d440
nop
lea rcx, [rbp + 0x318]
call fcn.14001d440
nop
lea rcx, [rbp + 0x340]
call fcn.14001d440
nop
lea rcx, [rbp + 0x110]
call fcn.14001d440
nop
lea rcx, [rbp + 0x138]
call fcn.14001d440
movzx eax, word [rbp + 0x68]
mov dword [rbx + 0x40], eax
movzx eax, byte [rbp + 0x6a]
mov dword [rbx + 0x44], eax
mov eax, dword [rsp + 0x60]
sub eax, 1
je 0x140052b71
cmp eax, 1
jne 0x140052ba1
lea esi, [rax + 0xc]
mov eax, dword [rsp + 0x54]
cmp eax, 6
jne 0x14005271b
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x1400526d7
mov dword [rbx], 8
jmp 0x140052864
cmp eax, 1
jne 0x1400526e7
mov dword [rbx], 9
jmp 0x140052864
cmp eax, 2
jne 0x1400526f7
mov dword [rbx], 0xa
jmp 0x140052864
cmp eax, 3
jne 0x140052707
mov dword [rbx], reloc.WS2_32.dll_inet_addr
jmp 0x140052864
cmp eax, 4
jne 0x140052864
mov dword [rbx], reloc.ODBC32.dll_SQLExecute
jmp 0x140052864
cmp eax, 0xa
jne 0x140052732
cmp dword [rsp + 0x58], 0
jne 0x140052864
mov dword [rbx], esi
jmp 0x140052864
cmp eax, 5
jne 0x140052859
mov eax, dword [rsp + 0x58]
cmp eax, 2
jne 0x140052840
mov dword [rbx], 7
call fcn.14002eae0
test al, al
je 0x140052833
lea rcx, [rbp + 0x370]
call fcn.140052ed0
nop
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
lea rcx, [rbp + 0x160]
call fcn.14001c950
nop
mov dword [rsp + 0x20], 0x20019
mov r9, 0xffffffff80000002
xor r8d, r8d
lea rdx, [rbp + 0x160]
lea rcx, [rbp + 0x370]
call fcn.1400535a0
movzx edi, al
lea rcx, [rbp + 0x160]
call fcn.14001d440
test dil, dil
je 0x140052827
lea rcx, [rbp + 0xc0]
call fcn.14001cac0
nop
lea rdx, [0x1402d2b10]
lea rcx, [rbp + 0x188]
call fcn.14001c950
nop
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x188]
lea rcx, [rbp + 0x370]
call fcn.140053480
nop
lea rcx, [rbp + 0x188]
call fcn.14001d440
lea rdx, str.Microsoft_Windows_XP
lea rcx, [rbp + 0xc0]
call fcn.14001d8d0
test al, al
je 0x14005281a
mov dword [rbx], 6
lea rcx, [rbp + 0xc0]
call fcn.14001d440
nop
lea rcx, [rbp + 0x370]
call fcn.140052f10
mov eax, dword [rsp + 0x54]
cmp eax, 5
jne 0x140052859
mov eax, dword [rsp + 0x58]
cmp eax, 1
jne 0x14005284d
mov dword [rbx], 6
jmp 0x140052864
test eax, eax
jne 0x140052864
mov dword [rbx], 5
jmp 0x140052864
cmp eax, 4
ja 0x140052864
mov dword [rbx], 4
lea rdx, [rsp + 0x64]
lea rcx, [rbp + 0x1b0]
call fcn.14001c950
nop
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x70]
call fcn.14001d690
nop
lea rcx, [rbp + 0x1b0]
call fcn.14001d440
lea rdx, [0x1402d1978]
lea rcx, [rbp + 0x1d8]
call fcn.14001c950
nop
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x70]
call fcn.14002a720
nop
lea rcx, [rbp + 0x1d8]
call fcn.14001d440
lea rdx, str.Service_Pack
lea rcx, [rbp + 0x200]
call fcn.14001c840
nop
xor r8d, r8d
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x70]
call fcn.14001f950
mov edi, eax
lea rcx, [rbp + 0x200]
call fcn.14001d440
test edi, edi
js 0x140052932
lea rdx, [rsp + 0x7e]
lea rcx, [rbp + 0x228]
call fcn.14001c950
nop
lea rcx, [rbp + 0x228]
call fcn.14002a400
lea ecx, [rax - 1]
cmp ecx, 9
ja 0x140052926
mov dword [rbx + 8], eax
lea rcx, [rbp + 0x228]
call fcn.14001d440
test r12d, r12d
je 0x140052a35
movzx eax, byte [rbp + 0x6a]
cmp al, 1
jne 0x14005299f
cmp dword [rsp + 0x54], 4
jne 0x140052956
mov dword [rbx + 4], 1
jmp 0x140052b20
movzx eax, word [rbp + 0x68]
mov ecx, 0x200
test cx, ax
je 0x140052970
mov dword [rbx + 4], 4
jmp 0x140052b15
mov ecx, 0x100
test cx, ax
je 0x14005298b
cmp dword [rbx], 0xb
jne 0x14005298b
mov dword [rbx + 4], 3
jmp 0x140052b15
test byte [rbp + 0x68], 0x40
mov eax, 2
cmovne eax, esi
mov dword [rbx + 4], eax
jmp 0x140052b15
cmp al, 3
jne 0x140052b15
cmp dword [rsp + 0x54], 5
jne 0x140052a20
mov eax, dword [rsp + 0x58]
cmp eax, 2
jne 0x1400529f5
movzx eax, byte [rbp + 0x68]
test al, al
jns 0x1400529cb
mov dword [rbx + 4], 7
jmp 0x140052ba1
test al, 2
je 0x1400529db
mov dword [rbx + 4], 3
jmp 0x140052ba1
mov eax, r14d
mov ecx, 0x400
cmp word [rbp + 0x68], cx
sete al
add eax, 5
mov dword [rbx + 4], eax
jmp 0x140052ba1
test eax, eax
jne 0x140052a20
movzx eax, byte [rbp + 0x68]
test al, al
jns 0x140052a0d
mov dword [rbx + 4], 8
jmp 0x140052ba1
test al, 2
mov eax, r14d
setne al
add eax, 0xb
mov dword [rbx + 4], eax
jmp 0x140052ba1
test byte [rbp + 0x68], 2
mov eax, r14d
setne al
add eax, 9
mov dword [rbx + 4], eax
jmp 0x140052b15
mov dword [rsp + 0x30], 0x50
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140052b69
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProductType
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140052b69
cmp dword [rsp + 0x30], 0x50
ja 0x140052b69
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rbp + 0x3e0]
lea rcx, str.WINNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140052ad7
mov dword [rbx + 4], 1
lea rdx, [rbp + 0x3e0]
lea rcx, str.LANMANNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140052af6
mov dword [rbx + 4], reloc.WS2_32.dll_inet_addr
lea rdx, [rbp + 0x3e0]
lea rcx, str.SERVERNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140052b15
mov dword [rbx + 4], reloc.ODBC32.dll_SQLExecute
cmp dword [rsp + 0x54], 4
jne 0x140052ba1
lea rdx, str.Service_Pack_6
lea rcx, [rsp + 0x64]
call fcn.140299b5c
test eax, eax
jne 0x140052ba1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140052ba1
mov r14d, 0xffffffff
jmp 0x140052ba1
cmp dword [rsp + 0x54], 4
jne 0x140052ba1
mov eax, dword [rsp + 0x58]
test eax, eax
jne 0x140052b88
mov dword [rbx], 1
jmp 0x140052ba1
cmp eax, 0xa
jne 0x140052b96
mov eax, 2
mov dword [rbx], eax
jmp 0x140052ba1
cmp eax, 0x5a
jne 0x140052ba1
mov dword [rbx], 3
lea rcx, [rbp + 0x70]
call fcn.14001d440
mov eax, r14d
mov rcx, qword [rbp + 0x430]
xor rcx, rsp
call fcn.140283120
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret