Function at 0x140001360
Capabilities:
Access peb ldr_data
Get kernel32 base address
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov ecx, 0x40
call fcn.140004cb0
lea rcx, [0x140024758]
mov qword [0x14002a0a0], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtQuerySystemInformation
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [0x14002a0a0]
lea rcx, [0x140024758]
mov qword [rdx + 8], rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtWriteVirtualMemory
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x14002a0a0]
mov qword [rcx + 0x10], rax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [0x14002a0a0]
mov qword [rax], rcx
lea rsi, [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor ebp, ebp
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], ebp
mov r9, rsi
mov dword [rsp + 0x20], ebp
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140001678
mov rsi, qword [0x14002a0a0]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
lea r9, [rsi + 0x20]
mov rcx, rax
mov dword [rsp + 0x28], ebp
mov r8, rdi
mov dword [rsp + 0x20], ebp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x140001678
mov rdx, qword [0x14002a0a0]
mov rdx, qword [rdx + 0x18]
call fcn.140001200
mov rdx, qword [0x14002a0a0]
mov qword [rdx + 0x28], rax
mov rdx, qword [rdx + 0x20]
call fcn.140001200
mov rcx, qword [0x14002a0a0]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov r9d, 0x2000000
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rcx + 0x30], rax
lea rax, [rsp + 0x40]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001530
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x4c], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x140024730]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [0x14002a0a0]
mov rax, qword [rdx]
movzx ecx, word [rax + 0x120]
cmp ecx, 0x4a61
ja 0x140001618
je 0x140001641
cmp ecx, 0x3ad7
ja 0x1400015d7
je 0x140001586
sub ecx, 0x1db0
je 0x1400015bc
sub ecx, 1
je 0x1400015bc
sub ecx, 0x63f
je 0x1400015a1
sub ecx, 0x190
je 0x1400015a1
cmp ecx, 0x12b9
jne 0x14000169f
mov dword [0x14002a08c], 0x358
mov eax, 1
mov dword [rdx + 0x38], 0x232
jmp 0x14000167a
mov dword [0x14002a08c], 0x348
mov eax, 1
mov dword [rdx + 0x38], 0x232
jmp 0x14000167a
mov dword [rdx + 0x38], 0x1f6
mov eax, 1
mov dword [0x14002a08c], 0x208
jmp 0x14000167a
sub ecx, 0x3fab
je 0x140001586
sub ecx, 0x343
je 0x140001586
sub ecx, 0x275
je 0x140001586
sub ecx, 0x257
je 0x140001600
cmp ecx, 1
jne 0x14000169f
mov dword [0x14002a08c], 0x360
mov eax, 1
mov dword [rdx + 0x38], 0x232
jmp 0x14000167a
cmp ecx, 0x55f0
ja 0x140001659
je 0x140001641
sub ecx, 0x4a62
je 0x140001641
sub ecx, 1
je 0x140001641
sub ecx, 1
je 0x140001641
sub ecx, 1
je 0x140001641
cmp ecx, 0x517
jne 0x14000169f
mov dword [0x14002a08c], 0x4b8
mov eax, 1
mov dword [rdx + 0x38], 0x232
jmp 0x14000167a
sub ecx, 0x585d
je 0x140001641
sub ecx, 0xa
je 0x140001641
sub ecx, 0x9b9
je 0x140001641
cmp ecx, 0x116
jne 0x14000169f
jmp 0x140001641
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004c90
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
lea rcx, str.not_support_now_..._contact_with_dev_to_suport_it_n
call fcn.140001010
mov ecx, 1
call fcn.140008540
int3