Function at 0x14001ccc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1d0
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
movzx esi, dl
mov rbx, rcx
mov r12b, 1
mov qword [r11 - 0x158], 7
xor ebp, ebp
mov qword [r11 - 0x160], rbp
mov word [rsp + 0x88], bp
xor edx, edx
mov r8d, 0x254
lea rcx, [0x1400d3740]
call fcn.1400719a0
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetNativeSystemInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
movzx eax, word [rbx + 0x118]
mov word [0x1400d398c], ax
lea ecx, [rbp + 0x57]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14001cd90
or dword [0x1400d3990], 1
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14001cda6
or dword [0x1400d3990], 2
mov ecx, 0x56
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14001cdbc
or dword [0x1400d3990], 4
test rdi, rdi
je 0x14001cdc8
lea rcx, [rsp + 0x48]
call rdi
movzx eax, word [rsp + 0x48]
test eax, eax
je 0x14001ce10
cmp eax, 6
je 0x14001cdfd
cmp eax, 9
je 0x14001cdea
mov dword [0x1400d3744], ebp
mov byte [0x1400d3748], 0
jmp 0x14001ce21
mov dword [0x1400d3744], 2
mov byte [0x1400d3748], 1
jmp 0x14001ce21
mov dword [0x1400d3744], 8
mov byte [0x1400d3748], 1
jmp 0x14001ce21
mov dword [0x1400d3744], 1
mov byte [0x1400d3748], 0
movzx eax, word [rbx + 0x118]
cmp eax, 0x10
je 0x14001ce3d
cmp eax, 0x100
je 0x14001ce3d
mov byte [0x1400d374a], 0
jmp 0x14001ce44
mov byte [0x1400d374a], 1
mov eax, dword [rbx + 4]
mov dword [0x1400d3754], eax
mov eax, dword [rbx + 8]
mov dword [0x1400d3758], eax
mov eax, dword [rbx + 0xc]
mov dword [0x1400d375c], eax
lea r9, [rbx + 0x14]
lea r8, [0x1400ae27c]
mov edx, 0x80
lea rcx, [0x1400d388c]
call fcn.140066ef4
mov edx, dword [rbx + 0x10]
test edx, edx
je 0x14001dbc1
sub edx, 1
je 0x14001da04
cmp edx, 1
je 0x14001ceea
mov eax, dword [rbx + 8]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 4]
lea r8, str.Unknow_Windows_operative_sistem___d____d_
mov edx, 0x96
lea rcx, [0x1400d3760]
call fcn.140066ef4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400d3760]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x1400d3760]
lea rcx, [rsp + 0x80]
call fcn.140001870
xor r12b, r12b
jmp 0x14001dbec
mov r9d, dword [rbx + 4]
mov r14d, 0x400
mov r13d, 0x200
cmp r9d, 6
jne 0x14001cf06
cmp dword [rbx + 8], 4
ja 0x14001cf18
cmp r9d, 0xa
jne 0x14001cf12
cmp dword [rbx + 8], 0
ja 0x14001cf18
cmp r9d, 0xa
jbe 0x14001cf75
mov dword [0x1400d3740], 0x80000000
mov eax, dword [rbx + 8]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 4]
lea r8, str.Unknow_Windows_operative_sistem___d____d_
mov edx, 0x96
lea rcx, [0x1400d3760]
call fcn.140066ef4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400d3760]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x1400d3760]
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
cmp r9d, 6
jne 0x14001cf81
cmp dword [rbx + 8], 4
je 0x14001cf8d
cmp r9d, 0xa
jne 0x14001cfe8
cmp dword [rbx + 8], 0
jne 0x14001cfe8
cmp byte [rbx + 0x11a], 1
jne 0x14001cfbf
mov dword [0x1400d3740], 0x10000
mov r8d, reloc.Cabinet.dll_FDICreate
lea rdx, str.Microsoft_Windows_10
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
mov dword [0x1400d3740], 0x20000
mov r8d, 0x1b
lea rdx, str.Microsoft_Windows_10_Server
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
cmp r9d, 6
jne 0x14001d04d
cmp dword [rbx + 8], 3
jne 0x14001d04d
cmp byte [rbx + 0x11a], 1
jne 0x14001d024
mov dword [0x1400d3740], 0x4000
lea r8d, [r9 + 0xf]
lea rdx, str.Microsoft_Windows_8.1
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
mov dword [0x1400d3740], 0x8000
mov r8d, reloc.Cabinet.dll_FDICopy
lea rdx, str.Windows_Server_2012_R2
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
cmp r9d, 6
jne 0x14001d0b2
cmp dword [rbx + 8], 2
jne 0x14001d0b2
cmp byte [rbx + 0x11a], 1
jne 0x14001d089
mov dword [0x1400d3740], 0x1000
lea r8d, [r9 + 0xd]
lea rdx, str.Microsoft_Windows_8
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
mov dword [0x1400d3740], 0x2000
mov r8d, FDIDestroy
lea rdx, str.Windows_Server_2012
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
cmp r9d, 6
jne 0x14001d114
cmp dword [rbx + 8], 1
jne 0x14001d114
cmp byte [rbx + 0x11a], 1
jne 0x14001d0eb
mov dword [0x1400d3740], r14d
lea r8d, [r9 + 0xd]
lea rdx, str.Microsoft_Windows_7
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
mov dword [0x1400d3740], 0x800
mov r8d, 0x18
lea rdx, str.Windows_Server_2008__R2_
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
cmp r9d, 6
jne 0x14001d176
cmp dword [rbx + 8], 0
jne 0x14001d176
cmp byte [rbx + 0x11a], 1
jne 0x14001d150
mov dword [0x1400d3740], 0x100
lea r8d, [r9 + 0x11]
lea rdx, str.Microsoft_Windows_Vista
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
mov dword [0x1400d3740], r13d
mov r8d, FDIDestroy
lea rdx, str.Windows_Server_2008
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
cmp r9d, 5
jne 0x14001d224
cmp dword [rbx + 8], 2
jne 0x14001d224
lea ecx, [r9 + 0x54]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x14001d1c1
mov dword [0x1400d3740], 0x80
mov r8d, 0x22
lea rdx, str.Microsoft_Windows_Server_2003__R2_
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
cmp word [rsp + 0x48], 9
jne 0x14001d1fb
cmp byte [rbx + 0x11a], 1
jne 0x14001d1fb
mov dword [0x1400d3740], 0x40
mov r8d, 0x20
lea rdx, str.Microsoft_Windows_XP_x64_Edition
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
mov dword [0x1400d3740], 0x80
mov r8d, 0x1d
lea rdx, str.Microsoft_Windows_Server_2003
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
cmp r9d, 5
jne 0x14001d257
cmp dword [rbx + 8], 1
jne 0x14001d257
mov dword [0x1400d3740], 0x40
lea r8d, [r9 + 0xf]
lea rdx, str.Microsoft_Windows_XP
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
cmp r9d, 5
jne 0x14001d287
cmp dword [rbx + 8], 0
jne 0x14001d287
mov dword [0x1400d3740], 0x20
lea r8d, [r9 + 0x11]
lea rdx, str.Microsoft_Windows_2000
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
cmp r9d, 4
ja 0x14001d2b3
mov dword [0x1400d3740], 0x10
mov r8d, reloc.Cabinet.dll_FDICreate
lea rdx, str.Microsoft_Windows_NT
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001d2fd
mov eax, dword [rbx + 8]
mov dword [rsp + 0x20], eax
lea r8, str.Unknow_operative_sistem___d____d_
mov edx, 0x96
lea rcx, [0x1400d3760]
call fcn.140066ef4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400d3760]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x1400d3760]
lea rcx, [rsp + 0x80]
call fcn.140001870
test sil, sil
je 0x14001d9d2
movzx eax, byte [rbx + 0x11a]
mov byte [0x1400d3750], al
cmp byte [rbx + 0x11a], 1
jne 0x14001d474
mov byte [0x1400d3749], 0
cmp dword [rbx + 4], 4
jne 0x14001d34c
mov r8d, FDICreate
lea rdx, str._Workstation_4.0
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d424
mov eax, dword [0x1400d3990]
test al, 2
je 0x14001d375
mov r8d, FDICreate
lea rdx, str._Starter_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d424
cmp dword [0x1400d3740], 0x40
jne 0x14001d3c1
test al, 1
je 0x14001d3a1
mov r8d, 0xd
lea rdx, str._Media_Center
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d424
test al, 4
je 0x14001d3c1
mov r8d, FDICreate
lea rdx, str._TabletPC_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d424
movzx eax, word [rbx + 0x118]
test r13w, ax
je 0x14001d3ea
mov r8d, 0xd
lea rdx, str._Home_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d424
test al, 0x40
je 0x14001d40a
mov r8d, 9
lea rdx, str._Embedded
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d424
mov r8d, 0xd
lea rdx, str._Professional
lea rcx, [rsp + 0x80]
call fcn.14000a130
movzx r9d, word [rbx + 0x118]
lea r8, str.__Suite_0x_x_
mov edx, 0x96
lea rcx, [0x1400d3760]
call fcn.140066ef4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400d3760]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x1400d3760]
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d87d
movzx eax, byte [rbx + 0x11a]
cmp al, 3
je 0x14001d609
cmp al, 2
je 0x14001d609
mov dword [rsp + 0x30], 0x50
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlProductOptions
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14001d87d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProductType
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001d500
cmp dword [rsp + 0x30], 0x50
jbe 0x14001d87d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0xb0]
lea rcx, str.WINNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14001d544
mov byte [0x1400d3749], al
lea r8d, [rax + 0xc]
lea rdx, str._Workstation
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d5b6
lea rdx, [rsp + 0xb0]
lea rcx, str.LANMANNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14001d57e
mov byte [0x1400d3749], 1
lea r8d, [rax + 7]
lea rdx, str._Server
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d5b6
lea rdx, [rsp + 0xb0]
lea rcx, str.SERVERNT
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14001d5b6
mov byte [0x1400d3749], 1
lea r8d, [rax + 0x10]
lea rdx, str._Advanced_Server
lea rcx, [rsp + 0x80]
call fcn.14000a130
mov eax, dword [rbx + 8]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 4]
lea r8, str.__d._d
mov edx, 0x96
lea rcx, [0x1400d3760]
call fcn.140066ef4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400d3760]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x1400d3760]
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d87d
mov byte [0x1400d3749], 1
mov eax, dword [rbx + 4]
cmp eax, 5
jne 0x14001d785
cmp dword [rbx + 8], 2
jne 0x14001d785
mov rax, qword [rsp + 0x48]
cmp ax, 6
jne 0x14001d682
movzx eax, word [rbx + 0x118]
test al, al
jns 0x14001d65b
mov r8d, 0x2e
lea rdx, str.__Datacenter_Edition_for_Itanium_based_Systems
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
test al, 2
je 0x14001d832
mov r8d, 0x2e
lea rdx, str.__Enterprise_Edition_for_Itanium_based_Systems
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
cmp ax, 9
jne 0x14001d6f4
movzx eax, word [rbx + 0x118]
test al, al
jns 0x14001d6b2
mov r8d, 0x18
lea rdx, str.__Datacenter_x64_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
test al, 2
je 0x14001d6d5
mov r8d, 0x18
lea rdx, str.__Enterprise_x64_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
mov r8d, reloc.Cabinet.dll_FDICopy
lea rdx, str.__Standard_x64_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
movzx eax, word [rbx + 0x118]
test al, al
jns 0x14001d71e
mov r8d, reloc.Cabinet.dll_FDICreate
lea rdx, str.__Datacenter_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
test al, 2
je 0x14001d741
mov r8d, reloc.Cabinet.dll_FDICreate
lea rdx, str.__Enterprise_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
cmp ax, r14w
jne 0x14001d766
mov r8d, 0xd
lea rdx, str.__Web_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
mov r8d, FDIDestroy
lea rdx, str.__Standard_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
cmp eax, 5
jne 0x14001d7f3
cmp dword [rbx + 8], 0
jne 0x14001d7f3
movzx eax, word [rbx + 0x118]
test al, al
jns 0x14001d7b7
mov r8d, FDIDestroy
lea rdx, str._Datacenter_Server
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
test al, 2
je 0x14001d7d7
mov r8d, FDICreate
lea rdx, str._Advanced_Server
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
mov r8d, 7
lea rdx, str._Server
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
test byte [rbx + 0x118], 2
je 0x14001d818
mov r8d, 0x1f
lea rdx, str._Server_4.0__Enterprise_Edition
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d832
mov r8d, 0xb
lea rdx, str._Server_4.0
lea rcx, [rsp + 0x80]
call fcn.14000a130
movzx r9d, word [rbx + 0x118]
lea r8, str.__Suite_0x_x_
mov edx, 0x96
lea rcx, [0x1400d3760]
call fcn.140066ef4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400d3760]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x1400d3760]
lea rcx, [rsp + 0x80]
call fcn.14000a130
cmp dword [rbx + 4], 4
jne 0x14001d971
lea rdx, str.Service_Pack_6
lea rcx, [rbx + 0x14]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14001d971
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionHotfixQ246009
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d915
movzx r9d, word [rbx + 0xc]
lea r8, str._Service_Pack_6a__Build__d_
mov edx, 0x96
lea rcx, [0x1400d3760]
call fcn.140066ef4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400d3760]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x1400d3760]
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001d964
movzx eax, word [rbx + 0xc]
mov dword [rsp + 0x20], eax
lea r9, [rbx + 0x14]
lea r8, str.__s__Build__d_
mov edx, 0x96
lea rcx, [0x1400d3760]
call fcn.140066ef4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400d3760]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x1400d3760]
lea rcx, [rsp + 0x80]
call fcn.14000a130
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001d9c0
movzx eax, word [rbx + 0xc]
mov dword [rsp + 0x20], eax
lea r9, [rbx + 0x14]
lea r8, str.__s__Build__d_
mov edx, 0x96
lea rcx, [0x1400d3760]
call fcn.140066ef4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1400d3760]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x1400d3760]
lea rcx, [rsp + 0x80]
call fcn.14000a130
movzx eax, word [rbx + 0x114]
mov dword [0x1400d374c], eax
jmp 0x14001dbec
mov r8d, 0xd
lea rdx, str.Service_Pack
lea rcx, [rbx + 0x14]
call fcn.140068104
test eax, eax
jne 0x14001dbec
lea rcx, [rbx + 0x2e]
call fcn.14006729c
mov dword [0x1400d374c], eax
jmp 0x14001dbec
mov byte [0x1400d3749], 0
mov eax, dword [rbx + 4]
cmp eax, 4
jne 0x14001da6e
cmp dword [rbx + 8], 0
jne 0x14001da6e
mov dword [0x1400d3740], 2
lea r8d, [rax + 0x10]
lea rdx, str.Microsoft_Windows_95
lea rcx, [rsp + 0x80]
call fcn.140001870
movzx edx, word [rbx + 0x16]
cmp dx, 0x43
je 0x14001da4f
cmp dx, 0x42
jne 0x14001dbec
mov r8d, 5
lea rdx, str._OSR2
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001dbec
cmp eax, 4
jne 0x14001db92
cmp dword [rbx + 8], 0xa
jne 0x14001db92
xor dil, dil
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001db4b
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001db37
cmp dword [rsp + 0x38], 1
jne 0x14001db37
lea rdx, str.Millennium
lea rcx, [rsp + 0xb0]
call fcn.140067318
test rax, rax
je 0x14001db37
mov dword [0x1400d3740], 8
mov r8d, 0x24
lea rdx, str.Microsoft_Windows_Millennium_Edition
lea rcx, [rsp + 0x80]
call fcn.140001870
mov dil, 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
jne 0x14001dbec
mov dword [0x1400d3740], 4
mov r8d, reloc.Cabinet.dll_FDICreate
lea rdx, str.Microsoft_Windows_98
lea rcx, [rsp + 0x80]
call fcn.140001870
cmp word [rbx + 0x16], 0x41
jne 0x14001dbec
mov r8d, 3
lea rdx, [0x1400aeda0]
lea rcx, [rsp + 0x80]
call fcn.14000a130
jmp 0x14001dbec
cmp eax, 4
jne 0x14001dbec
cmp dword [rbx + 8], 0x5a
jne 0x14001dbec
mov dword [0x1400d3740], 8
lea r8d, [rax + 0x20]
lea rdx, str.Microsoft_Windows_Millennium_Edition
lea rcx, [rsp + 0x80]
call fcn.140001870
jmp 0x14001dbec
mov byte [0x1400d3749], 0
mov dword [0x1400d3740], 1
mov r8d, FDICreate
lea rdx, str.Microsoft_Win32s
lea rcx, [rsp + 0x80]
call fcn.140001870
lea r9, [rsp + 0x88]
cmp qword [rsp + 0xa0], 8
cmovae r9, qword [rsp + 0x88]
lea r8, [0x1400ae27c]
mov edx, 0x96
lea rcx, [0x1400d3760]
call fcn.140066ef4
mov byte [0x1400d5081], r12b
cmp qword [rsp + 0xa0], 8
jb 0x14001dc42
mov rcx, qword [rsp + 0x88]
call fcn.140065920
mov al, r12b
jmp 0x14001dc45
mov al, r12b
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140064b70
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret