Function at 0x180011a70
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x180
mov rax, qword [0x18010db20]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor eax, eax
xor edi, edi
mov rbx, rcx
lea rcx, [rsp + 0xbc]
lea r8d, [rdi + 0x2c]
xor edx, edx
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x48], 4
mov dword [rsp + 0x4c], 4
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x78], edi
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x80], eax
mov dword [rsp + 0x84], eax
mov dword [rsp + 0x88], eax
mov dword [rsp + 0x8c], eax
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x98], edi
mov dword [rsp + 0x9c], eax
mov dword [rsp + 0xa0], eax
mov dword [rsp + 0xa4], eax
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0xac], eax
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0xb8], edi
call fcn.180037390
lea r11, [rsp + 0x50]
lea rdx, str.SYSTEMCurrentControlSet_serviceskbdssvc
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movsxd rcx, eax
test eax, eax
jne 0x180011bb6
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, str.Status
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rcx, eax
test eax, eax
je 0x180011be8
cmp rcx, 2
je 0x180011bf5
test eax, eax
jne 0x180011bb6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
bt ecx, 0x1d
jae 0x180011bd2
test ecx, ecx
jle 0x180011d56
movzx ecx, cx
or ecx, 0xa0070000
jmp 0x180011d56
test ecx, ecx
jle 0x180011d56
movzx ecx, cx
or ecx, 0x80070000
jmp 0x180011d56
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x180011bfc
cmp eax, 1
je 0x180011bfc
mov dword [rbx + 0x58], 1
cmp dword [rbx + 0x58], edi
jne 0x180011d54
lea rdx, [rsp + 0x78]
lea rcx, str.kbdhid
call fcn.180024750
lea rdx, [rsp + 0x98]
lea rcx, str.hidusb
call fcn.180024750
cmp dword [rsp + 0x7c], 4
jne 0x180011c3b
cmp dword [rsp + 0x9c], 4
je 0x180011c5a
lea rdx, [rsp + 0x58]
lea rcx, str.i8042prt
call fcn.180024750
cmp dword [rsp + 0x5c], 4
je 0x180011c5a
mov dword [rbx + 0x58], 1
cmp dword [rbx + 0x58], edi
jne 0x180011d54
lea rcx, [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx r11d, word [rsp + 0xb8]
test r11w, r11w
je 0x180011c8e
cmp r11w, 9
je 0x180011c8e
mov dword [rbx + 0x58], 1
cmp dword [rbx + 0x58], edi
jne 0x180011d54
xor edx, edx
lea rcx, [rsp + 0xf2]
mov qword [rsp + 0x38], rdi
lea r8d, [rdx + 0x7e]
mov word [rsp + 0xf0], di
call fcn.180037390
lea r8, [rsp + 0x38]
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], pe_nt_image_headers64
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180011d41
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
lea rdx, str.SystemFamily
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180011d36
lea rdx, str.Surface
lea rcx, [rsp + 0xf0]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
je 0x180011d36
mov dword [rbx + 0x58], 1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx + 0x58], edi
jne 0x180011d54
mov rcx, rbx
call fcn.180011d80
mov ecx, eax
test eax, eax
js 0x180011d56
mov ecx, edi
mov eax, ecx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180037360
mov rbx, qword [rsp + 0x198]
add rsp, 0x180
pop rdi
ret