Function at 0x1400066e0
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov rax, rsp
push rsi
sub rsp, 0x4f0
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov rbp, rdx
mov qword [rcx + 0x2a0], rdx
mov qword [rax - 0x28], r14
lea rax, [rsp + 0x60]
mov rbx, r8
mov rsi, rcx
lea rdx, str.MicrosoftWindows_NTCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea r12, [0x140027e59]
lea r13, str.DigitalProductId4
test eax, eax
lea r14, str.DigitalProductID
jne 0x140006c31
lea rcx, [rsp + 0x221]
xor edx, edx
mov r8d, 0x81
mov byte [rsp + 0x220], al
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x3c1]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x3c0], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x191]
xor edx, edx
mov r8d, 0x81
mov byte [rsp + 0x190], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x101]
xor edx, edx
mov r8d, 0x81
mov byte [rsp + 0x100], 0
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x500]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
lea r9, [rsp + 0x508]
lea rdx, [0x140029088]
xor r8d, r8d
mov dword [rsp + 0x500], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000681a
mov eax, dword [rsp + 0x500]
add eax, 0xffffffff
mov byte [rsp + rax + 0x100], 0
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x500]
lea r9, [rsp + 0x508]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x220]
lea rdx, str.CSDVersion
xor r8d, r8d
mov dword [rsp + 0x500], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140006872
mov eax, dword [rsp + 0x500]
add eax, 0xffffffff
mov byte [rsp + rax + 0x220], 0
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x500]
lea r9, [rsp + 0x508]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c0]
lea rdx, str.PathName
xor r8d, r8d
mov dword [rsp + 0x500], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400068ca
mov eax, dword [rsp + 0x500]
add eax, 0xffffffff
mov byte [rsp + rax + 0x3c0], 0
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x500]
lea r9, [rsp + 0x508]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x190]
lea rdx, str.CurrentBuildNumber
xor r8d, r8d
mov dword [rsp + 0x500], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140006922
mov eax, dword [rsp + 0x500]
add eax, 0xffffffff
mov byte [rsp + rax + 0x190], 0
cmp byte [rsp + 0x100], 0
jne 0x140006962
lea rcx, [0x14002fed0]
mov edx, 0x7d0
call fcn.14001bf40
lea rdx, [rsp + 0x100]
nop
nop
nop
movzx ecx, byte [rax]
add rdx, 1
add rax, 1
test cl, cl
mov byte [rdx - 1], cl
jne 0x140006950
test rbx, rbx
je 0x140006ad4
mov rax, qword [0x14002fec0]
cmp dword [rax + 0x580], 0
je 0x140006ad4
lea rcx, [rsp + 0x2b1]
xor edx, edx
mov r8d, 0x104
mov qword [rsp + 0x4e8], rdi
mov byte [rsp + 0x2b0], 0
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0x80
mov byte [rsp + 0x70], 0
call sub.msvcrt.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
add rcx, 0xc
cmp rcx, 0x104
jae 0x140006a72
lea rcx, [rsp + 0x2b0]
sub rcx, rbx
nop
nop
nop
movzx eax, byte [rbx]
add rbx, 1
test al, al
mov byte [rcx + rbx - 1], al
jne 0x1400069f0
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x2b0]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
test ecx, ecx
jle 0x140006a42
movsxd rax, ecx
cmp byte [rsp + rax + 0x2af], 0x5c
je 0x140006a42
xor eax, eax
lea rdi, [rsp + 0x2b0]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
movzx eax, word [0x140027f78]
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [rsp + 0x2b0]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.prodspec.ini]
mov qword [rdi - 1], rax
mov eax, dword [0x1400292f0]
mov dword [rdi + 7], eax
movzx eax, byte [0x1400292f4]
mov byte [rdi + 0xb], al
jmp 0x140006a79
mov byte [rsp + 0x2b0], al
lea rax, [rsp + 0x2b0]
lea r9, [rsp + 0x70]
lea rdx, str.Product
mov qword [rsp + 0x28], rax
lea rcx, str.Product_Specification
mov r8, r12
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [rsp + 0x70], 0
mov rdi, qword [rsp + 0x4e8]
je 0x140006ad4
xor ecx, ecx
nop
nop
movzx eax, byte [rsp + rcx + 0x70]
add rcx, 1
test al, al
mov byte [rsp + rcx + 0xff], al
jne 0x140006ac0
mov r8, qword [rsp + 0x60]
lea rax, [rsp + 0x190]
lea r9, str.ProductID
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x220]
lea rdx, [rsp + 0x100]
mov rcx, rsi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x3c0]
mov qword [rsi + 0x2c8], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r8
mov qword [rsi + 0x2d0], 0
call fcn.140004660
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsi + 0x2c8], 0
jne 0x140006b6f
cmp qword [rsi + 0x2d0], 0
jne 0x140006c31
mov rax, qword [0x14002fec0]
cmp dword [rax + 0x590], 0
je 0x140006c31
lea rax, [rsp + 0x60]
lea rdx, str.MicrosoftWindows_NTCurrentVersionDefaultProductKey
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006c31
mov rax, qword [rsi + 0x2c8]
test rax, rax
je 0x140006bc4
mov dword [rax + 0x428], 1
mov r8, qword [rsp + 0x60]
lea rax, [rsp + 0x190]
lea r9, str.ProductID
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x220]
lea rdx, [rsp + 0x100]
mov rcx, rsi
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r8
call fcn.140004660
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x14002fa84], 0
mov rbx, qword [rsp + 0x510]
jne 0x140006c59
lea rcx, [0x14002fa80]
mov dword [0x14002fa80], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x14002fa90], 1
jne 0x140006d84
lea rax, [rsp + 0x60]
lea rdx, str.MicrosoftWindowsCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006d84
lea rcx, [rsp + 0x71]
xor edx, edx
mov r8d, 0x80
mov byte [rsp + 0x70], al
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x500]
lea r9, [rsp + 0x508]
lea rdx, [0x140029088]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x500], 0x80
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140006cf9
mov eax, dword [rsp + 0x500]
add eax, 0xffffffff
mov byte [rsp + rax + 0x70], 0
cmp byte [rsp + 0x70], 0
jne 0x140006d32
lea rcx, [0x14002fed0]
mov edx, 0x7d0
call fcn.14001bf40
lea rdx, [rsp + 0x70]
nop
nop
nop
movzx ecx, byte [rax]
add rdx, 1
add rax, 1
test cl, cl
mov byte [rdx - 1], cl
jne 0x140006d20
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], 1
lea r9, str.ProductID
lea rdx, [rsp + 0x70]
mov rcx, rsi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r8
call fcn.140004660
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
lea rdx, str.MicrosoftInternet_ExplorerRegistration
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006e0c
lea rcx, [0x14002fed0]
mov edx, 0x7e4
call fcn.14001bf40
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], 3
lea r9, str.ProductID
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r8
call fcn.140004660
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x60]
lea rdx, str.MicrosoftExchangeSetup
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006e94
lea rcx, [0x14002fed0]
mov edx, 0x899
call fcn.14001bf40
mov r8, qword [rsp + 0x60]
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov dword [rsp + 0x30], 5
lea r9, str.ProductID
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r8
call fcn.140004660
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rbp
mov rcx, rsi
call fcn.140005480
mov rdx, rbp
mov rcx, rsi
call fcn.1400065a0
mov rdx, rbp
mov rcx, rsi
call fcn.1400062f0
mov rdx, rbp
mov rcx, rsi
call fcn.140005030
lea rax, [rsp + 0x500]
lea rdx, str.Autodesk
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x500], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov r14, qword [rsp + 0x4d0]
mov r13, qword [rsp + 0x4d8]
mov r12, qword [rsp + 0x4e0]
mov rbp, qword [rsp + 0x518]
jne 0x140006f37
mov rdx, qword [rsp + 0x500]
xor r8d, r8d
mov rcx, rsi
call fcn.140002b50
mov rcx, qword [rsp + 0x500]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x4f0
pop rsi
ret