Function at 0x100008b48
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6c8
mov qword [rsp + 0xc8], 0xfffffffffffffffe
mov rax, qword [0x100024390]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov rbx, r9
mov qword [rsp + 0x90], r8
mov r14, rdx
mov qword [rsp + 0x80], rcx
mov rax, qword [rsp + 0x730]
mov qword [rsp + 0x78], rax
mov rdi, qword [rsp + 0x738]
mov qword [rsp + 0x88], rdi
mov r13, qword [rsp + 0x740]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x58], rcx
xor eax, eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x40], eax
mov rbp, rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov r15, rax
mov qword [rsp + 0x48], rax
mov r12, rcx
mov rsi, rax
mov dword [rsp + 0x50], eax
xor edx, edx
mov r8d, 0x140
lea rcx, [rsp + 0x250]
call fcn.100017eb0
mov dword [rsp + 0x250], 0x140
xor eax, eax
cmp qword [rsp + 0x80], rax
je 0x100009269
cmp r14, rax
je 0x100009269
cmp qword [rsp + 0x90], rax
je 0x100009269
cmp rbx, rax
je 0x100009269
cmp qword [rsp + 0x78], rax
je 0x100009269
cmp rdi, rax
je 0x100009269
cmp r13, rax
je 0x100009269
mov edi, 0x11c
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x130]
call fcn.100017eb0
mov dword [rsp + 0x130], edi
lea rcx, [rsp + 0x130]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x100008ca6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x100003738]
lea ecx, [rsi + 4]
call fcn.100006e7c
mov eax, 0x80004005
jmp 0x10000926e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea r11, [rsp + 0x58]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x100003770]
mov rbx, 0xffffffff80000002
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100008d86
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1000037d0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100008d16
mov edi, 0x80004005
jmp 0x100009225
mov ecx, dword [rsp + 0x40]
inc ecx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1000118f0
mov rbp, rax
test rax, rax
jne 0x100008d49
mov edi, 0x8007000e
jmp 0x1000091da
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1000037d0]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100008d8f
mov edi, 0x80004005
jmp 0x1000091da
or rax, 0xffffffffffffffff
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, [0x1000037e8]
lea rdx, [0x100003810]
mov rcx, rbx
call fcn.1000088e4
lea r11, [rsp + 0x40]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x70]
lea r8, [0x100003878]
lea rdx, [0x100003810]
mov rcx, rbx
call fcn.1000088e4
lea r11, [rsp + 0x40]
mov qword [rsp + 0x20], r11
lea r9, [rsp + 0x48]
lea r8, [0x1000038a0]
lea rdx, [0x1000038c0]
mov rcx, rbx
call fcn.1000088e4
mov edi, eax
mov r9d, 0x12
xor r8d, r8d
xor edx, edx
lea rcx, [0x100003438]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov rbx, rax
or rax, 0xffffffffffffffff
cmp rbx, rax
jne 0x100008e4d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x100003910]
mov ecx, 4
call fcn.100006e7c
mov edi, 0x80004005
mov r15, qword [rsp + 0x48]
jmp 0x1000091b0
mov dword [rsp + 0x110], 0x20
mov dword [rsp + 0x390], 0x320
mov dword [rsp + 0x54], r15d
lea r8, [rsp + 0x110]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
cmp eax, r15d
je 0x10000905e
mov dword [rsp + 0x258], 0x4000000
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x110]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsA]
cmp eax, r15d
je 0x10000904f
mov r8d, 2
lea rdx, [rsp + 0x110]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
cmp eax, r15d
je 0x100009040
lea rax, [rsp + 0x390]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, [rsp + 0x110]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoA]
cmp eax, r15d
je 0x100009017
mov ecx, 0x320
call fcn.10001199c
mov qword [rsp + 0x98], rax
cmp rax, r15
je 0x100009008
mov rcx, rax
lea rdx, [rsp + 0x390]
mov r8d, 0x320
call fcn.1000148a0
mov r15, qword [r14 + 8]
lea r9, [rsp + 0x98]
mov r8, qword [r15 + 8]
mov rdx, r15
mov rcx, r14
call fcn.10000de3c
mov rdx, qword [r14 + 0x10]
movabs rcx, 0x1fffffffffffffff
sub rcx, rdx
cmp rcx, 1
jb 0x100008fa7
lea rcx, [rdx + 1]
mov qword [r14 + 0x10], rcx
mov qword [r15 + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
mov r15d, dword [rsp + 0x54]
inc r15d
mov dword [rsp + 0x54], r15d
lea r8, [rsp + 0x110]
mov edx, r15d
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
xor r15d, r15d
cmp eax, r15d
jne 0x100008e84
jmp 0x10000905e
mov qword [rsp + 0xc0], 0xf
and qword [rsp + 0xb8], rsi
mov byte [rsp + 0xa8], sil
mov r8d, 0x10
lea rdx, [0x100004270]
lea rcx, [rsp + 0xa0]
call fcn.10000da18
nop
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xd0]
call fcn.100006c98
lea rdx, [0x1000221c8]
lea rcx, [rsp + 0xd0]
call fcn.100012738
nop
mov edi, 0x8007000e
mov r15, qword [rsp + 0x48]
jmp 0x1000091b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, [0x100003970]
mov ecx, 4
call fcn.100006e7c
mov edi, 0x80004005
mov r15, qword [rsp + 0x48]
jmp 0x1000091b0
mov edi, 0x80004005
mov r15, qword [rsp + 0x48]
jmp 0x1000091b0
mov edi, 0x80004005
mov r15, qword [rsp + 0x48]
jmp 0x1000091b0
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], 1
xor r9d, r9d
lea r8d, [r9 + 1]
lea rdx, [rsp + 0x110]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x10000909e
mov edi, 0x80004005
mov r15, qword [rsp + 0x48]
jmp 0x1000091b0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 8
xor r8d, r8d
lea rdx, [0x1000039a0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, 2
jne 0x1000090e0
mov rcx, qword [rsp + 0x88]
mov dword [rcx], r15d
jmp 0x10000916f
cmp eax, 0xea
je 0x1000090fb
cmp eax, r15d
je 0x1000090fb
mov edi, 0x80004005
mov r15, qword [rsp + 0x48]
jmp 0x1000091b0
mov ecx, dword [rsp + 0x50]
call fcn.1000118f0
mov rsi, rax
cmp rax, r15
jne 0x10000911b
mov edi, 0x8007000e
mov r15, qword [rsp + 0x48]
jmp 0x1000091b0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov r9d, 8
xor r8d, r8d
lea rdx, [0x1000039a0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, r15d
je 0x100009159
mov edi, 0x80004005
mov r15, qword [rsp + 0x48]
jmp 0x1000091b0
mov eax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x88]
mov dword [rcx], eax
mov rax, qword [rsp + 0x78]
mov qword [rax], rsi
mov rcx, qword [rsp + 0x80]
lea rdx, [rsp + 0x130]
mov r8d, 0x9c
call fcn.1000148a0
mov rax, qword [rsp + 0x90]
mov qword [rax], rbp
mov rax, qword [rsp + 0x68]
mov qword [r13], rax
mov rax, qword [rsp + 0x70]
mov qword [r13 + 8], rax
mov r15, qword [rsp + 0x48]
mov qword [r13 + 0x10], r15
cmp rbx, 0xffffffffffffffff
je 0x1000091d6
mov r8d, 2
lea rdx, [rsp + 0x110]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDriverInfoList]
mov rcx, rbx
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
test edi, edi
jns 0x100009243
test rbp, rbp
je 0x1000091e7
mov rcx, rbp
call fcn.100011990
test rsi, rsi
je 0x1000091f4
mov rcx, rsi
call fcn.100011990
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x100009206
mov rcx, rax
call fcn.100011990
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x100009218
mov rcx, rax
call fcn.100011990
test r15, r15
je 0x100009225
mov rcx, r15
call fcn.100011990
mov rax, qword [r14 + 8]
mov rbx, qword [rax]
cmp rbx, rax
je 0x100009243
mov rcx, qword [rbx + 0x10]
call fcn.100011990
mov rbx, qword [rbx]
cmp rbx, qword [r14 + 8]
jne 0x100009231
mov rcx, qword [rsp + 0x58]
or rbx, 0xffffffffffffffff
cmp rcx, rbx
je 0x100009257
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r12, rbx
je 0x100009265
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x10000926e
mov eax, 0x80070057
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.100011c90
add rsp, 0x6c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret