Function at 0x13fb81ea0
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x140]
sub rsp, 0x240
mov rax, qword [0x13fb933b8]
xor rax, rsp
mov qword [rbp + 0x130], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x118
xor ebx, ebx
call sub.vcruntime140.dll_memset
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x11c
call qword [sym.imp.kernel32.dll_GetVersionExW]
test eax, eax
je 0x13fb821c3
cmp dword [rsp + 0x60], 2
jne 0x13fb821c3
mov r8d, dword [rsp + 0x54]
mov r9d, dword [rsp + 0x58]
cmp r8d, 0xa
jne 0x13fb821a7
test r9d, r9d
jne 0x13fb821a7
cmp byte [rbp + 0x6a], 1
mov dword [rsp + 0x40], ebx
jne 0x13fb81f46
movsd xmm0, qword [0x13fb88a10]
movsd qword [rdi], xmm0
mov eax, dword [0x13fb88a18]
mov dword [rdi + 8], eax
jmp 0x13fb81f63
movups xmm0, xmmword [0x13fb88a20]
movups xmmword [rdi], xmm0
mov eax, dword [0x13fb88a30]
mov dword [rdi + 0x10], eax
movzx eax, byte [0x13fb88a34]
mov byte [rdi + 0x14], al
movzx r9d, word [rbp + 0x66]
lea rax, [rsp + 0x40]
movzx r8d, word [rbp + 0x64]
xor edx, edx
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0xa]
call qword [sym.imp.kernel32.dll_GetProductInfo]
mov ecx, dword [rsp + 0x40]
lea rdx, [rbp + 0x70]
call fcn.13fb82330
mov r8, rax
lea rcx, [rdi - 1]
cmp byte [rcx + 1], bl
lea rcx, [rcx + 1]
jne 0x13fb81f96
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x13fb81fb0
lea rax, [rsp + 0x38]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x13fb88a38]
mov rcx, 0xffffffff80000002
call qword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
je 0x13fb81ff2
mov qword [rsp + 0x38], rbx
jmp 0x13fb8206f
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x13fb8206f
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0xc0
mov qword [rsp + 0x28], rax
lea rdx, [0x13fb88a68]
lea rax, [rbp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x13fb8206a
lea rdx, [rbp + 0x70]
lea rcx, [0x13fb88a78]
call fcn.13fb82590
mov r8d, dword [rsp + 0x30]
lea rdx, [rbp + 0x70]
mov rcx, rdi
call sub.ucrtbase.dll_strncat
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x13fb82056
movzx eax, word [0x13fb88a88]
mov word [rcx], ax
mov rbx, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x5c]
test r8d, r8d
je 0x13fb820fd
lea rdx, [0x13fb88a8c]
lea rcx, [rbp + 0x70]
call fcn.13fb829d0
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x13fb82091
mov eax, dword [0x13fb88a90]
mov dword [rcx], eax
movzx eax, word [0x13fb88a94]
mov word [rcx + 4], ax
movzx eax, byte [0x13fb88a96]
mov byte [rcx + 6], al
lea rcx, [rdi - 1]
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x13fb820c0
lea r8, [rbp + 0x70]
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x13fb820d0
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x13fb820e4
movzx eax, word [0x13fb88a88]
mov rbx, qword [rsp + 0x38]
mov word [rcx], ax
test rbx, rbx
je 0x13fb821a2
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0xc0
mov qword [rsp + 0x28], rax
lea rdx, [0x13fb88a98]
lea rax, [rbp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x13fb82197
lea rdx, [rbp + 0x70]
lea rcx, [0x13fb88aa8]
call fcn.13fb82590
lea rcx, [rdi - 1]
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x13fb82150
movzx eax, word [0x13fb88ab8]
lea rdx, [rbp + 0x70]
mov r8d, dword [rsp + 0x30]
mov word [rcx], ax
movzx eax, byte [0x13fb88aba]
mov byte [rcx + 2], al
mov rcx, rdi
call sub.ucrtbase.dll_strncat
lea rcx, [rdi - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x13fb82183
movzx eax, word [0x13fb88abc]
mov word [rcx], ax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.advapi32.dll_RegCloseKey]
mov rax, rdi
jmp 0x13fb821c6
lea rdx, [0x13fb88ac0]
mov dword [rsp + 0x20], 2
mov rcx, rdi
call fcn.13fb829d0
mov rax, rdi
jmp 0x13fb821c6
mov rax, rbx
mov rcx, qword [rbp + 0x130]
xor rcx, rsp
call fcn.13fb87030
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret