Function at 0x140002be8
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x500
mov dword [rsp + 0x290], 0
mov dword [rsp + 0x4b0], 0
lea rax, [rsp + 0x250]
mov rdi, rax
xor eax, eax
mov ecx, 0x40
rep stosb byte [rdi], al
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x518]
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002c90
mov dword [rsp + 0x290], 0xffffffff
jmp 0x140002eec
mov eax, dword [rsp + 0x548]
mov dword [rsp + 0x4e8], eax
cmp dword [rsp + 0x4e8], 0
je 0x140002cc9
cmp dword [rsp + 0x4e8], 1
je 0x140002d99
cmp dword [rsp + 0x4e8], 2
je 0x140002e35
jmp 0x140002eec
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4ec], eax
cmp dword [rsp + 0x4ec], 0
jbe 0x140002d94
cmp dword [rsp + 0x4ec], 2
jbe 0x140002cf4
jmp 0x140002d94
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002d7f
lea rcx, [rsp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x4d8]
lea r8, [rsp + 0x40]
lea rdx, str._s__d
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x140002d94
lea rdx, [0x140045c60]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140002eec
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4f0], eax
cmp dword [rsp + 0x4f0], 0
jbe 0x140002e30
cmp dword [rsp + 0x4f0], 2
jbe 0x140002dbd
jmp 0x140002e30
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002e1b
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x140002e30
lea rdx, [0x140045c70]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140002eec
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4f4], eax
cmp dword [rsp + 0x4f4], 0
jbe 0x140002eec
cmp dword [rsp + 0x4f4], 2
jbe 0x140002e60
jmp 0x140002eec
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002ee1
lea rdx, [0x1400459cc]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x140002ec1
mov dword [rsp + 0x290], 0xffffffff
jmp 0x140002eec
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x140002eec
mov dword [rsp + 0x290], 0
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x290]
add rsp, 0x500
pop rdi
ret