Function at 0x1400175e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x100]
sub rsp, 0x200
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0xf0], rax
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x40], 0x80
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14001763a
xor eax, eax
jmp 0x1400178a2
mov eax, dword [rsp + 0x58]
xor r8d, r8d
mov ebx, dword [rsp + 0x54]
mov r9d, 1
shl rbx, 0x10
mov rcx, 0xffffffff80000002
or rbx, rax
lea rax, [rsp + 0x48]
shl rbx, 0x20
cmp dword [rsp + 0x60], 2
mov qword [rsp + 0x20], rax
jne 0x1400176df
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001789f
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.CurrentBuildNumber
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017894
cmp dword [rsp + 0x3c], 1
jne 0x140017894
lea rcx, [rbp + 0x70]
call qword [sym.imp.msvcrt.dll__wtol]
mov ecx, eax
shl rcx, 0x10
add rbx, rcx
mov dword [rsp + 0x40], eax
jmp 0x140017894
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001789f
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x3c]
lea rax, [rbp + 0x70]
xor r8d, r8d
lea rdx, str.VersionNumber
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140017894
cmp dword [rsp + 0x3c], 1
jne 0x140017894
and dword [rsp + 0x30], eax
lea rcx, [rbp + 0x70]
and dword [rsp + 0x34], eax
and dword [rsp + 0x38], eax
and dword [rsp + 0x44], eax
xor ebx, ebx
jmp 0x140017752
inc ebx
lea rcx, [rax + 2]
mov edx, 0x2e
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14001774c
mov ecx, ebx
sub ecx, 1
je 0x140017839
sub ecx, 1
je 0x140017812
cmp ecx, 1
lea rcx, [rbp + 0x70]
je 0x1400177e5
test ebx, ebx
je 0x140017798
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x38], eax
jmp 0x140017854
inc ebx
lea rcx, [rax + 2]
mov edx, 0x2c
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x140017792
lea rcx, [rbp + 0x70]
sub ebx, 1
je 0x1400177dc
sub ebx, 1
je 0x1400177d3
cmp ebx, 1
je 0x1400177ca
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x30], eax
jmp 0x140017854
lea rdx, str._lu__lu__lu__lu
jmp 0x1400177ec
lea rdx, str._lu__lu__lu
jmp 0x14001781d
lea rdx, str._lu__lu
jmp 0x140017844
lea rdx, str._lu._lu._lu._lu
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_swscanf]
jmp 0x140017854
lea rdx, str._lu._lu._lu
lea rcx, [rbp + 0x70]
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
call qword [sym.imp.msvcrt.dll_swscanf]
jmp 0x140017854
lea rdx, str._lu._lu
lea rcx, [rbp + 0x70]
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_swscanf]
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x44]
shl eax, 0x10
add ecx, eax
mov eax, dword [rsp + 0x38]
mov ebx, ecx
and rbx, 0xffffffffffff0000
shl eax, 0x10
add edx, eax
movzx eax, cx
or rbx, rax
mov ecx, edx
shl rbx, 0x10
shr rcx, 0x10
or rbx, rcx
movzx ecx, dx
shl rbx, 0x10
or rbx, rcx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0x210]
add rsp, 0x200
pop rbp
ret