Function at 0x140003530
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x508
mov dword [rsp + 0x290], 0
mov dword [rsp + 0x4b0], 0
mov r8d, 0x40
xor edx, edx
lea rcx, [rsp + 0x250]
call fcn.140056120
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140056120
mov r8d, 0x208
xor edx, edx
lea rcx, [rsp + 0x2a0]
call fcn.140056120
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x518]
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400035db
mov dword [rsp + 0x290], 0xffffffff
jmp 0x140003837
mov eax, dword [rsp + 0x548]
mov dword [rsp + 0x4e8], eax
cmp dword [rsp + 0x4e8], 0
je 0x140003614
cmp dword [rsp + 0x4e8], 1
je 0x1400036e4
cmp dword [rsp + 0x4e8], 2
je 0x140003780
jmp 0x140003837
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4ec], eax
cmp dword [rsp + 0x4ec], 0
jbe 0x1400036df
cmp dword [rsp + 0x4ec], 2
jbe 0x14000363f
jmp 0x1400036df
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400036ca
lea rcx, [rsp + 0x4b8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r9d, dword [rsp + 0x4d8]
lea r8, [rsp + 0x40]
lea rdx, str._s__d
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x1400036df
lea rdx, [0x14008ae30]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140003837
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4f0], eax
cmp dword [rsp + 0x4f0], 0
jbe 0x14000377b
cmp dword [rsp + 0x4f0], 2
jbe 0x140003708
jmp 0x14000377b
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003766
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x14000377b
lea rdx, [0x14008ae40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x140003837
mov eax, dword [rsp + 0x528]
mov dword [rsp + 0x4f4], eax
cmp dword [rsp + 0x4f4], 0
jbe 0x140003837
cmp dword [rsp + 0x4f4], 2
jbe 0x1400037ab
jmp 0x140003837
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x528]
xor r8d, r8d
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000382c
lea rdx, [0x14008ab9c]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x14000380c
mov dword [rsp + 0x290], 0xffffffff
jmp 0x140003837
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x530]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [rsp + 0x290], 1
jmp 0x140003837
mov dword [rsp + 0x290], 0
mov rcx, qword [rsp + 0x510]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x290]
add rsp, 0x508
ret