Function at 0x1400eb440
Capabilities:
Get cpu information
Get disk information
Get hostname
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x14012e040]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov r14, rdx
mov qword [rbp - 0x70], rdx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov r13d, select
mov qword [rdx + 0x18], r13
mov byte [rdx], r12b
mov esi, 1
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x48], r12d
lea rdx, [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
mov edi, dword [rsp + 0x48]
shr rdi, 5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov r15d, r12d
mov qword [rbp - 0x78], r12
mov ebx, r12d
test rdi, rdi
je 0x1400eb564
mov rbx, rdi
shl rbx, 5
cmp rbx, 0x1000
jb 0x1400eb524
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400ebbee
call fcn.1400c888c
mov rcx, rax
test rax, rax
je 0x1400ebb9d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
lea r15, [rbx + rax]
mov r12, rax
jmp 0x1400eb541
test rbx, rbx
je 0x1400eb53a
mov rcx, rbx
call fcn.1400c888c
mov r12, rax
lea r15, [rax + rbx]
jmp 0x1400eb541
mov rax, r12
lea r15, [rbx + r12]
mov rbx, r15
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r15
shl rdi, 5
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x80], rbx
jmp 0x1400eb569
mov r12, qword [rsp + 0x78]
lea rdx, [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
test eax, eax
je 0x1400eb6eb
xor edx, edx
mov rcx, r12
cmp r12, rbx
je 0x1400eb5a5
nop dword [rax]
lea eax, [rdx + 1]
cmp dword [rcx + 8], 0
cmovne eax, edx
mov edx, eax
add rcx, 0x20
cmp rcx, rbx
jne 0x1400eb590
lea rcx, [rbp - 0x48]
call fcn.14001acc0
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x1400eb5f8
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x1400eb5d9
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 3
lea rdx, [0x140111c28]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x1400eb618
mov qword [rsp + 0x20], 3
lea r9, [0x140111c28]
mov edx, 3
mov rcx, rdi
call fcn.1400181c0
mov rdi, rax
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], r13
mov byte [rdi], 0
or esi, 4
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x40], esi
lea rdx, [rbp - 0x28]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
mov rcx, r14
call fcn.140015bc0
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400eb6ad
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb6a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb6a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001bba0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400eb6eb
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb6e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb6e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001bba0
mov dword [rsp + 0x54], 0x100
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rsi, 0xffffffffffffffff
test eax, eax
jne 0x1400eb840
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProcessorNameString
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400eb835
lea rax, [rbp + 0x10]
mov rdi, rsi
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400eb774
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x1400eb7bd
lea rax, [rcx + rdi]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0xf
jbe 0x1400eb7a4
mov rax, qword [r14]
lea rbx, [rax + rcx]
mov r8, rdi
lea rdx, [rbp + 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x1400eb7d1
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x10]
mov rdx, rdi
mov rcx, r14
call fcn.1400181c0
mov rcx, qword [r14 + 0x10]
mov r9, qword [r14 + 0x18]
mov rax, r9
sub rax, rcx
cmp rax, 3
jb 0x1400eb818
lea rax, [rcx + 3]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp r9, 0xf
jbe 0x1400eb7f9
mov rax, qword [r14]
lea rbx, [rax + rcx]
mov r8d, 3
lea rdx, [0x140111c28]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x1400eb835
mov qword [rsp + 0x20], 3
lea r9, [0x140111c28]
mov edx, 3
mov rcx, r14
call fcn.1400181c0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], r13
mov byte [rbp - 0x48], 0
mov dword [rsp + 0x58], select
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rax, [rbp - 8]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400eb872
mov r8, rsi
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x48]
call fcn.14003a330
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rbp - 0x38]
sub rax, rsi
cmp rax, 3
jb 0x1400ebbe2
lea rdx, [rbp - 0x48]
mov rdi, qword [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, rdi
mov qword [rsp + 0x70], rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea rax, [rsi + 3]
lea rbx, [rbp - 0x68]
cmp rax, 0xf
jbe 0x1400eb96b
mov r13, rax
or r13, 0xf
cmp r13, rcx
jbe 0x1400eb925
mov r13, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400c888c
test rax, rax
je 0x1400ebb23
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
lea rax, [rsi + 3]
mov rdx, qword [rsp + 0x70]
jmp 0x1400eb967
mov ecx, 0x16
cmp r13, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
cmp rcx, 0x1000
jb 0x1400eb94d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400ebbe8
jmp 0x1400eb8fd
test rcx, rcx
je 0x1400eb965
call fcn.1400c888c
mov rbx, rax
lea rax, [rsi + 3]
mov rdx, qword [rsp + 0x70]
jmp 0x1400eb967
xor ebx, ebx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], r13
mov r8, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x140111c28]
mov word [rsi + rbx], ax
movzx eax, byte [0x140111c2a]
mov byte [rsi + rbx + 2], al
mov byte [rbx + rsi + 3], 0
mov ebx, dword [rsp + 0x4c]
or ebx, 2
mov dword [rsp + 0x40], ebx
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
mov rcx, r14
call fcn.140015bc0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x1400eb9f9
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb9f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400ebb23
call fcn.14001bba0
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x220]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x110]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x38], 0x105
lea rax, [rbp + 0x110]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8d, 0x105
lea rdx, [rbp + 0x220]
lea rcx, [0x140111c94]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1400ebb30
lea r10, [rbp - 0x53]
mov r8d, dword [rsp + 0x50]
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400eba90
lea r9, [rsp + 0x44]
lea r8, [rbp - 0x53]
mov rdx, r10
lea rcx, [rbp - 0x28]
call fcn.1400438f0
or ebx, 0x18
mov dword [rsp + 0x40], ebx
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, r14
call fcn.140015bc0
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400ebb30
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400ebb2a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ebb2a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001bba0
nop
mov rax, qword [rbp - 0x30]
cmp rax, 0xf
jbe 0x1400ebb6f
lea rdx, [rax + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400ebb66
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ebb66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14001bba0
nop
test r12, r12
je 0x1400ebbaf
sub r15, r12
and r15, 0xffffffffffffffe0
mov rax, r12
cmp r15, 0x1000
jb 0x1400ebba4
add r15, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400ebba4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov rcx, r12
call fcn.14001bba0
mov rax, r14
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.1400c8700
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000f830
int3
call fcn.14000f730
nop
call fcn.14000f730
int3