Function at 0x140031350
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor esi, esi
mov r13, rcx
mov dword [rsp + 0x44], esi
mov r8d, 0x100
mov qword [rcx + 0x48], rdx
mov r12d, esi
xor edx, edx
mov qword [rbp + 0x60], 0x11c
lea rcx, [rbp + 0x74]
mov qword [rbp + 0x68], rsi
mov dword [rbp + 0x70], esi
call fcn.140083680
mov r8b, 1
mov dword [rbp + 0x174], esi
mov edx, 0x80
mov dword [rbp + 0x178], 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 0x80
lea rcx, [rbp + 0x60]
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
lea r9d, [rsi + 1]
mov byte [rsp + 0x40], sil
test eax, eax
mov dword [rsp + 0x50], esi
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
sete al
xor r8d, r8d
mov byte [r13 + 0x5c], al
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003152e
mov rbx, qword [rsp + 0x58]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x44]
mov dword [rsp + 0x48], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CurrentMajorVersionNumber
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031520
cmp dword [rsp + 0x4c], 4
jne 0x140031520
mov eax, dword [rsp + 0x44]
lea r9, [rsp + 0x4c]
mov rcx, qword [rsp + 0x58]
lea rdx, str.CurrentMinorVersionNumber
mov dword [r13 + 0x50], eax
xor r8d, r8d
lea rax, [rsp + 0x44]
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031520
cmp dword [rsp + 0x4c], 4
jne 0x140031520
mov eax, dword [rsp + 0x48]
lea r8, [r13 + 0x58]
mov rcx, qword [rsp + 0x58]
mov dword [r13 + 0x54], eax
call fcn.1400310d0
test al, al
je 0x140031520
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x44], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x1400c8308]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140031520
cmp dword [rsp + 0x4c], 4
jne 0x140031520
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
mov byte [rsp + 0x40], 1
test rbx, rbx
je 0x14003152e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rax, str.kernel32.dll
movups xmmword [rsp + 0x60], xmm0
mov rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], si
jne 0x140031544
movabs r14, 0x7ffffffffffffffe
mov qword [rsp + 0x2c8], r15
cmp rdi, r14
ja 0x140031c7a
mov ecx, 0xa
cmp rdi, 8
jae 0x1400315ad
lea rbx, [rdi + rdi]
mov qword [rsp + 0x70], rdi
mov r8, rbx
mov qword [rsp + 0x78], 7
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140082e70
mov word [rsp + rbx + 0x60], si
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x70]
mov r15, qword [rsp + 0x60]
jmp 0x140031602
mov rsi, rdi
or rsi, 7
cmp rsi, r14
jbe 0x1400315be
mov rsi, r14
jmp 0x1400315c5
cmp rsi, rcx
cmovb rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x60]
call fcn.14000dc20
lea rbx, [rdi + rdi]
mov qword [rsp + 0x60], rax
mov r8, rbx
mov qword [rsp + 0x70], rdi
lea rdx, str.kernel32.dll
mov qword [rsp + 0x78], rsi
mov rcx, rax
mov r15, rax
call fcn.140082e70
xor eax, eax
mov word [rbx + r15], ax
cmp rsi, 8
mov qword [rbp - 0x70], rax
lea rbx, [rsp + 0x60]
xorps xmm0, xmm0
cmovae rbx, r15
movups xmmword [rbp - 0x80], xmm0
cmp rdi, r14
ja 0x140031c7a
cmp rdi, 8
jae 0x140031640
mov r9d, 7
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], r9
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x80], xmm0
jmp 0x140031698
mov rax, rdi
mov qword [rbp - 0x68], 7
or rax, 7
cmp rax, r14
ja 0x140031664
mov r14, rax
cmp rax, 0xa
mov eax, 0xa
cmovb r14, rax
lea rdx, [r14 + 1]
lea rcx, [rbp - 0x80]
call fcn.14000dc20
lea r8, [rdi*2 + 2]
mov qword [rbp - 0x80], rax
mov rdx, rbx
mov qword [rbp - 0x70], rdi
mov rcx, rax
mov qword [rbp - 0x68], r14
call fcn.140082e70
mov r9, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x70]
mov r10, qword [rbp - 0x80]
lea r8, [rbp - 0x80]
cmp r9, 8
cmovae r8, r10
xor r14d, r14d
test rdi, rdi
je 0x140031735
mov edx, r14d
mov rax, rdi
mov rcx, r8
cmp word [r8], dx
je 0x1400316d5
cmp rax, 1
je 0x1400316d8
add rcx, 2
dec rax
cmp word [rcx], dx
jne 0x1400316c3
mov rdx, rcx
test rdx, rdx
je 0x140031735
sub rdx, r8
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x140031735
cmp rdi, rdx
jb 0x140031c80
mov rax, rdi
mov r11, 0xffffffffffffffff
sub rax, rdx
cmp rax, 0xffffffffffffffff
cmovb r11, rax
cmp r9, 8
lea rax, [rbp - 0x80]
cmovae rax, r10
sub rdi, r11
mov r8, rdi
sub r8, rdx
lea rcx, [rax + rdx*2]
lea rdx, [rcx + r11*2]
lea r8, [r8*2 + 2]
call fcn.140082e70
mov qword [rbp - 0x70], rdi
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.1400783e0
mov rdx, qword [rbp - 0x68]
movzx ebx, al
cmp rdx, 8
jb 0x140031785
mov rcx, qword [rbp - 0x80]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031780
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c86
call fcn.1400809f0
movdqa xmm0, xmmword [0x1400cd300]
mov word [rbp - 0x80], r14w
movdqu xmmword [rbp - 0x70], xmm0
cmp rsi, 8
jb 0x1400317d2
lea rdx, [rsi*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400317ca
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c86
mov rcx, r15
call fcn.1400809f0
test bl, bl
je 0x140031c41
mov edx, dword [rbp + 0x3c]
lea rcx, [rbp]
call fcn.140030e20
mov eax, dword [rbp + 0x40]
and eax, 0x40004
mov qword [rbp - 0x48], 0xf
cmp eax, 0x40004
jne 0x14003182b
xorps xmm0, xmm0
mov eax, 0xa
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
movsd xmm0, qword [str.Windows_NT]
movzx eax, word [0x1400c8218]
movsd qword [rbp - 0x60], xmm0
mov word [rbp - 0x58], ax
mov byte [rbp - 0x56], r12b
jmp 0x14003185b
mov rax, qword [str.Unknown]
movdqa xmm0, xmmword [0x1400cd300]
mov dword [rbp - 0x60], eax
movzx eax, word [0x1400c8294]
mov word [rbp - 0x5c], ax
movzx eax, byte [0x1400c8296]
mov byte [rbp - 0x5a], al
movdqu xmmword [rbp - 0x58], xmm0
mov byte [rbp - 0x59], r12b
cmp byte [rsp + 0x40], r12b
jne 0x140031886
mov ecx, dword [rbp + 0x28]
mov eax, ecx
shr eax, 0x10
mov dword [r13 + 0x50], eax
movzx eax, cx
mov ecx, dword [rbp + 0x2c]
mov dword [r13 + 0x54], eax
mov eax, ecx
shr eax, 0x10
mov dword [r13 + 0x58], eax
movzx eax, cx
jmp 0x14003188a
mov eax, dword [rsp + 0x50]
mov r8d, eax
lea rdx, [0x1400c833c]
lea rcx, [rbp + 0x20]
lea rsi, [r13 + 0x28]
call fcn.140012b10
mov rdx, rax
mov rcx, rsi
call fcn.140009050
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x1400318e7
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400318e2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c8c
call fcn.1400809f0
mov rbx, qword [rbp + 0x10]
mov rdi, qword [rbp + 0x18]
test rbx, rbx
jne 0x140031900
lea rdx, [0x1400c2073]
jmp 0x140031a3b
cmp rdi, 0x10
mov qword [rbp - 0x30], 2
lea r9, [rbp]
mov qword [rbp - 0x28], 0xf
cmovae r9, qword [rbp]
xorps xmm0, xmm0
mov eax, 0x2820
movups xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x40], ax
mov byte [rbp - 0x3e], r12b
cmp rbx, 0xd
ja 0x140031959
lea rax, [rbx + 2]
mov r8, rbx
mov rdx, r9
mov qword [rbp - 0x30], rax
lea rcx, [rbp - 0x3e]
call fcn.140082e70
lea rax, [rbp - 0x40]
mov byte [rbp + rbx - 0x3e], r12b
jmp 0x14003196e
mov rdx, rbx
mov qword [rsp + 0x20], rbx
lea rcx, [rbp - 0x40]
call fcn.140006aa0
mov rdi, qword [rbp + 0x18]
mov qword [rsp + 0x70], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
mov rax, rdx
sub rax, rcx
cmp rax, 1
jb 0x1400319db
lea rax, [rcx + 1]
cmp rdx, 0x10
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmovae rax, qword [rsp + 0x60]
mov word [rax + rcx], 0x29
lea rax, [rsp + 0x60]
jmp 0x1400319fa
lea r9, [0x1400c2c20]
mov qword [rsp + 0x20], 1
mov edx, 1
lea rcx, [rsp + 0x60]
call fcn.140006aa0
xorps xmm0, xmm0
lea rdx, [rbp - 0x20]
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov byte [rax], r12b
mov r12d, 7
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
cmp qword [rsi + 0x18], 0x10
jb 0x140031a45
mov rsi, qword [rsi]
mov ecx, dword [r13 + 0x54]
lea r8, [rbp - 0x60]
mov eax, dword [r13 + 0x58]
cmp qword [rbp - 0x48], 0x10
mov r9d, dword [r13 + 0x50]
cmovae r8, qword [rbp - 0x60]
mov qword [rsp + 0x38], rdx
lea rdx, str._s__u._u._u._s_s
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rcx, [rbp + 0x20]
call fcn.140012b10
mov rdx, rax
lea rcx, [r13 + 8]
call fcn.140009050
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140031ac8
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031ac3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c92
call fcn.1400809f0
movdqa xmm0, xmmword [0x1400cd310]
mov byte [rbp + 0x20], 0
movdqu xmmword [rbp + 0x30], xmm0
test r12b, 4
je 0x140031b2b
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140031b1a
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031b15
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c92
call fcn.1400809f0
movdqa xmm0, xmmword [0x1400cd310]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
test r12b, 2
je 0x140031b81
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140031b6e
mov rcx, qword [rsp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031b69
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c92
call fcn.1400809f0
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
test r12b, 1
je 0x140031bc2
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140031bc2
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031bbd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c92
call fcn.1400809f0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x140031bfd
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031bf8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c74
call fcn.1400809f0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
cmp rdi, 0x10
jb 0x140031c41
mov rcx, qword [rbp]
lea rdx, [rdi + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031c3c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031c74
call fcn.1400809f0
mov r15, qword [rsp + 0x2c8]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.1400809d0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
call fcn.140087b78
int3
call fcn.140001c80
int3
call fcn.1400090e0
int3
call fcn.140087b78
int3
call fcn.140087b78
int3
call fcn.140087b78
int3