Function at 0x401460
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0x518
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push eax
push str.HardwareDescriptionSystemCentralProcessor0
push 0x80000002
call edi
lea ecx, [esp + 0x328]
push str.Genuine_Alpha
push ecx
call fcn.0040678f
add esp, 8
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x328]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
mov ebp, 0x100
push str.VendorIdentifier
push edx
mov dword [esp + 0x30], ebp
call esi
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
push str.SystemCurrentControlSetControlSession_ManagerEnvironment
push 0x80000002
call edi
lea edx, [esp + 0x228]
push 0x40fb70
push edx
call fcn.0040678f
add esp, 8
lea eax, [esp + 0x18]
lea ecx, [esp + 0x228]
lea edx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push 0
push str.PROCESSOR_LEVEL
push eax
mov dword [esp + 0x30], ebp
call esi
lea ecx, [esp + 0x128]
push str..2.3
push ecx
call fcn.0040678f
add esp, 8
lea edx, [esp + 0x18]
lea eax, [esp + 0x128]
lea ecx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x14]
push eax
push ecx
push 0
push str.PROCESSOR_REVISION
push edx
mov dword [esp + 0x30], ebp
call esi
mov al, 0x2e
mov byte [esp + 0x128], al
mov byte [esp + 0x12a], al
mov eax, dword [esp + 0x10]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push 0x80000002
call edi
lea edx, [esp + 0x18]
lea eax, [esp + 0x428]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
push 0
push str.CurrentBuildNumber
push edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], 0x50a
call esi
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x428]
push eax
push 0x40fafc
push ecx
call fcn.0040675b
mov edx, dword [esp + 0x1c]
add esp, 0xc
push edx
call ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040672c
add esp, 4
call fcn.00406739
xor edx, edx
mov ecx, 0xa
div ecx
mov eax, dword [0x42ba8c]
test eax, eax
mov ebx, edx
je 0x401c82
xor edi, edi
mov esi, dword [eax]
call fcn.00406739
xor edx, edx
div esi
mov eax, dword [0x42ba8c]
lea ecx, [edx + edx*8]
shl ecx, 3
sub ecx, edx
lea ebp, [eax + ecx*4 + 4]
mov dword [esp + 0x14], ebp
cmp dword [ebp + 8], 0x80000000
jae 0x401626
inc edi
cmp edi, esi
jb 0x4015f8
call fcn.00406739
cdq
mov ecx, 0x2710
idiv ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x42ba80]
mov esi, edx
add esi, ecx
cmp eax, 4
mov dword [esp + 0x24], esi
jbe 0x401853
cmp dword [esp + 0x1c], 0xa28
jl 0x401786
lea edx, [esp + 0x28]
push str._nA_problem_has_been_detected_and_Windows_has_been_shut_down_to_prevent_damage_n
push edx
call fcn.0040678f
lea eax, [esp + 0x30]
push eax
push 2
call fcn.00403300
add esp, 0x10
lea ecx, [esp + 0x28]
push str.to_your_computer._n_n
push ecx
call fcn.0040678f
lea edx, [esp + 0x30]
push edx
push 2
call fcn.00403300
mov eax, ebx
add esp, 0x10
shl eax, 6
add eax, str.IRQL_NOT_LESS_OR_EQUAL
lea ecx, [esp + 0x28]
push eax
push 0x40fa94
push ecx
call fcn.0040678f
lea edx, [esp + 0x34]
push edx
push 2
call fcn.00403300
mov al, byte [0x40e2d8]
add esp, 0x14
test al, al
je 0x401713
mov edi, 0x40e2d8
mov ebp, edi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
push 2
call fcn.00403300
mov al, byte [ebp + 0x50]
add ebp, 0x50
add esp, 8
mov edi, ebp
test al, al
jne 0x4016cf
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
mov edx, dword [ebx*4 + 0x40e030]
push esi
push edx
lea eax, [esp + 0x30]
push str._STOP:_0x_08X__0x00000000_0x_08X_0x00000008_0xC00000000__n_n_n
push eax
call fcn.0040678f
lea ecx, [esp + 0x38]
push ecx
push 2
call fcn.00403300
add esp, 0x18
call fcn.00406739
and eax, 0x80ffffff
jns 0x40174d
dec eax
or eax, 0xff000000
inc eax
mov edx, dword [ebp + 8]
add eax, 0x36b00000
push eax
xor eax, eax
mov ax, word [ebp + 0x1a]
push edx
push esi
lea edx, [esp + 0x34]
lea ecx, [eax + ebp + 0x1c]
push ecx
push str.__13s___Address__08X_base_at__08X__DateStamp__8X_n
push edx
call fcn.0040678f
lea eax, [esp + 0x40]
push eax
push 2
call fcn.00403300
add esp, 0x20
jmp 0x401e3e
mov ecx, dword [ebx*4 + 0x40e030]
push esi
push ecx
lea edx, [esp + 0x30]
push str._n_STOP:_0x_08X__0x00000000_0x_08X_0x00000008_0xC00000000__n
push edx
call fcn.0040678f
lea eax, [esp + 0x38]
push eax
push 0
call fcn.00403300
xor ecx, ecx
add esp, 0x18
mov cx, word [ebp + 0x1a]
lea edx, [ecx + ebp + 0x1c]
push edx
call fcn.00406739
and eax, 0x80ffffff
jns 0x4017cb
dec eax
or eax, 0xff000000
inc eax
add eax, 0x36b00000
lea ecx, [esp + 0x2c]
push eax
mov eax, dword [ebp + 8]
shl ebx, 6
push eax
add ebx, str.IRQL_NOT_LESS_OR_EQUAL
push esi
push ebx
push str._s_n_n_Address__08X_base_at__08X__DateStamp__8X____s_n
push ecx
call fcn.0040678f
lea edx, [esp + 0x44]
push edx
push 0
call fcn.00403300
mov al, byte [0x40e828]
add esp, 0x24
test al, al
je 0x401e3e
mov edi, 0x40e828
mov ebx, edi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
push 0
call fcn.00403300
mov al, byte [ebx + 0x50]
add ebx, 0x50
add esp, 8
mov edi, ebx
test al, al
jne 0x401812
jmp 0x401e3e
mov edx, dword [ebx*4 + 0x40e030]
push esi
push edx
lea eax, [esp + 0x30]
push str._n_STOP:_0x_08X__0x00000000_0x_08X_0x00000008_0xC00000000__n
push eax
call fcn.0040678f
lea ecx, [esp + 0x38]
push ecx
call fcn.00404b10
mov ecx, dword [ebp + 8]
xor edx, edx
mov dx, word [ebp + 0x1a]
add esp, 0x14
shl ebx, 6
lea eax, [edx + ebp + 0x1c]
lea edx, [esp + 0x28]
push eax
lea ebx, [ebx + str.IRQL_NOT_LESS_OR_EQUAL]
push ecx
push esi
push ebx
push str._s_Address__08x_has_base_at__08x____s_n_n_n
push edx
mov dword [esp + 0x2c], ebx
call fcn.0040678f
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x18
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, 3
cmp ecx, 0x50
jb 0x4018f1
mov ax, word [ebp + 0x1a]
mov edx, dword [ebp + 8]
lea ecx, [eax + ebp + 0x1c]
mov eax, dword [esp + 0x14]
push ecx
push edx
push esi
push eax
lea ecx, [esp + 0x38]
push str._s_n_Address__08x_has_base_at__08x____s_n_n
push ecx
call fcn.0040678f
mov dword [esp + 0x2c], 4
add esp, 0x18
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
call fcn.00404b10
mov eax, dword [esp + 0x20]
add esp, 4
lea ecx, [esp + 0x128]
lea edx, [esp + 0x228]
push eax
push ecx
lea eax, [esp + 0x330]
push edx
push eax
lea ecx, [esp + 0x38]
push str.CPUID:_s__s_s_irql:1f__SYSVER:_0xf_07x_n_n
push ecx
call fcn.0040678f
lea edx, [esp + 0x40]
push edx
call fcn.00404b10
push str.Dll_Base_DateStmp___Name_______________Dll_Base_DateStmp___Name
add ebx, 2
call fcn.00404b10
mov eax, dword [0x42ba8c]
add esp, 0x20
xor esi, esi
mov ecx, dword [eax]
test ecx, ecx
jle 0x401ae8
lea edx, [esi + esi*8]
shl edx, 3
sub edx, esi
mov edi, dword [eax + edx*4 + 0xc]
lea edx, [eax + edx*4 + 0xc]
cmp edi, 0x80000000
jae 0x401986
cmp esi, ecx
jge 0x401988
mov edi, dword [edx + 0x11c]
add edx, 0x11c
inc esi
cmp edi, 0x80000000
jb 0x40196d
cmp esi, ecx
je 0x401ada
lea edi, [esi + esi*8]
xor ecx, ecx
shl edi, 3
sub edi, esi
inc ebx
shl edi, 2
mov dword [esp + 0x14], ebx
mov cx, word [edi + eax + 0x1e]
add ecx, edi
lea edx, [ecx + eax + 0x20]
push edx
call fcn.00406739
cdq
mov ecx, 0x186a0
idiv ecx
lea ecx, [esp + 0x2c]
add edx, 0x33100000
push edx
mov edx, dword [0x42ba8c]
mov eax, dword [edi + edx + 0xc]
push eax
push str._n_08x__08x____s
push ecx
call fcn.0040678f
lea edx, [esp + 0x3c]
push edx
call fcn.00404b10
add esp, 0x18
mov edx, dword [0x42ba8c]
inc esi
lea eax, [esi + esi*8]
shl eax, 3
sub eax, esi
mov ecx, dword [edx + eax*4 + 0xc]
lea eax, [edx + eax*4 + 0xc]
cmp ecx, 0x80000000
jae 0x401a20
mov ecx, dword [edx]
cmp esi, ecx
jge 0x401a20
mov edi, dword [eax + 0x11c]
add eax, 0x11c
inc esi
cmp edi, 0x80000000
jb 0x401a08
cmp esi, dword [edx]
je 0x401ada
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, 0x28
sub eax, ecx
test eax, eax
jle 0x401a70
push 0x40f8cc
call fcn.00404b10
add esp, 4
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
inc ebx
mov edx, 0x28
repne scasb al, byte es:[edi]
not ecx
dec ecx
sub edx, ecx
cmp ebx, edx
jl 0x401a43
mov edx, dword [0x42ba8c]
lea edi, [esi + esi*8]
xor eax, eax
shl edi, 3
sub edi, esi
shl edi, 2
mov ax, word [edi + edx + 0x1e]
add eax, edi
lea ecx, [eax + edx + 0x20]
push ecx
call fcn.00406739
cdq
mov ecx, 0xf4240
idiv ecx
lea ecx, [esp + 0x2c]
add edx, 0x33100000
push edx
mov edx, dword [0x42ba8c]
mov eax, dword [edi + edx + 0xc]
push eax
push str._08x__08x____s
push ecx
call fcn.0040678f
lea edx, [esp + 0x3c]
push edx
call fcn.00404b10
mov eax, dword [0x42ba8c]
mov ebx, dword [esp + 0x2c]
add esp, 0x18
inc esi
mov ecx, dword [eax]
cmp esi, ecx
jl 0x401955
jmp 0x401ae8
push 0x40f6cc
call fcn.00404b10
add esp, 4
inc ebx
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
push str._nAddress__dword_dump___Build___d______________________________Name_n
push ecx
call fcn.0040678f
lea edx, [esp + 0x34]
push edx
call fcn.00404b10
add esp, 0x10
call fcn.00406739
cdq
mov ecx, 0xbb8
idiv ecx
mov edi, edx
xor edx, edx
mov dx, word [ebp + 0x1a]
sub edi, 0x7fe60000
lea eax, [edx + ebp + 0x1c]
push eax
call fcn.00406739
cdq
mov ecx, 0xf4240
idiv ecx
sub edx, 0x7fe00000
push edx
call fcn.00406739
cdq
mov ecx, 0x4c4b40
idiv ecx
sub edx, 0xffd0000
push edx
call fcn.00406739
cdq
mov ecx, 0x3e8
idiv ecx
add edx, 0x123
push edx
call fcn.00406739
cdq
mov ecx, 0x3e8
idiv ecx
mov eax, dword [esp + 0x34]
sub edx, 0x7fee0000
push edx
push eax
push eax
push edi
lea edx, [esp + 0x48]
push str._08x__08x__08x__08x__08x__08x__08x____s_n
push edx
call fcn.0040678f
lea eax, [esp + 0x50]
push eax
call fcn.00404b10
add ebx, 3
add esp, 0x2c
cmp ebx, 0x24
jge 0x401bb8
call fcn.00406739
mov ecx, 0x24
cdq
sub ecx, ebx
idiv ecx
add edx, 4
jmp 0x401bd0
cmp ebx, 0x28
jl 0x401bc1
xor edx, edx
jmp 0x401bd0
call fcn.00406739
mov ecx, 0x28
cdq
sub ecx, ebx
idiv ecx
test edx, edx
jle 0x401e3e
mov ebx, edx
call fcn.00406739
and eax, 0x8000003f
jns 0x401beb
dec eax
or eax, 0xffffffc0
inc eax
lea edi, [edi + eax + 0x18]
call fcn.00406739
cdq
mov ecx, 0x186a0
idiv ecx
mov esi, edx
mov edx, dword [0x42ba8c]
add esi, dword [edx + 0xc]
call fcn.00406739
cdq
mov ecx, 0x989680
idiv ecx
sub edx, 0x7fe00000
push edx
call fcn.00406739
cdq
mov ecx, 0x4c4b40
idiv ecx
sub edx, 0xffd0000
push edx
call fcn.00406739
cdq
mov ecx, 0xf4240
idiv ecx
sub edx, 0x7fc00000
push edx
call fcn.00406739
cdq
mov ecx, 0x3e8
idiv ecx
sub edx, 0x7fee0000
push edx
push esi
push esi
push edi
lea edx, [esp + 0x44]
push str._08x__08x__08x__08x__08x__08x__08x___ntoskrnl.exe_n
push edx
call fcn.0040678f
lea eax, [esp + 0x4c]
push eax
call fcn.00404b10
add esp, 0x28
dec ebx
jne 0x401bda
jmp 0x401e3e
cmp dword [0x42ba80], 4
jbe 0x401d74
call fcn.00406739
mov esi, eax
and esi, 0x8fffffff
jns 0x401ca6
dec esi
or esi, 0xf0000000
inc esi
mov ecx, dword [ebx*4 + 0x40e030]
sub esi, 0x7ff00000
push esi
push ecx
lea edx, [esp + 0x30]
push str._n_STOP:_0x_08X__0x00000000_0x_08X_0x00000008_0xC00000000__n
push edx
call fcn.0040678f
lea eax, [esp + 0x38]
push eax
push 0
call fcn.00403300
add esp, 0x18
push str.ntoskrnl.exe
call fcn.00406739
and eax, 0x80ffffff
jns 0x401ceb
dec eax
or eax, 0xff000000
inc eax
add eax, 0x36b00000
lea ecx, [esp + 0x2c]
shl ebx, 6
push eax
push 0x80100000
add ebx, str.IRQL_NOT_LESS_OR_EQUAL
push esi
push ebx
push str._s_n_n_Address__08X_base_at__08X__DateStamp__8X____s_n
push ecx
call fcn.0040678f
lea edx, [esp + 0x44]
push edx
push 0
call fcn.00403300
mov al, byte [0x40e828]
add esp, 0x24
test al, al
je 0x401e3e
mov edi, 0x40e828
mov ebx, edi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
push 0
call fcn.00403300
mov al, byte [ebx + 0x50]
add ebx, 0x50
add esp, 8
mov edi, ebx
test al, al
jne 0x401d33
jmp 0x401e3e
mov edx, dword [ebx*4 + 0x40e030]
lea eax, [esp + 0x28]
push edx
push str._n_STOP_0x_08X:__0x00000000_0xF000208F_0x00000008_0xC00000000__n
push eax
call fcn.0040678f
lea ecx, [esp + 0x34]
push ecx
call fcn.00404b10
shl ebx, 6
add ebx, str.IRQL_NOT_LESS_OR_EQUAL
push ebx
call fcn.00404b10
push 0x40f7c0
call fcn.00404b10
mov edx, dword [esp + 0x34]
add esp, 0x18
lea eax, [esp + 0x128]
lea ecx, [esp + 0x228]
push edx
push eax
lea edx, [esp + 0x330]
push ecx
push edx
lea eax, [esp + 0x38]
push str.CPUID:_s__s_s_irql:1f_SYSVER:_0xf_07x_n_n
push eax
call fcn.0040678f
lea ecx, [esp + 0x40]
push ecx
call fcn.00404b10
mov al, byte [str.Dll_Base_DateStmp___Name________________Dll_Base_DateStmp___Name]
add esp, 0x1c
test al, al
je 0x401e3e
mov edi, str.Dll_Base_DateStmp___Name________________Dll_Base_DateStmp___Name
mov ebx, edi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x28]
push ecx
call fcn.00404b10
push 0x40f6cc
call fcn.00404b10
mov al, byte [ebx + 0x50]
add ebx, 0x50
add esp, 8
mov edi, ebx
test al, al
jne 0x401dfa
mov eax, dword [0x42ba80]
pop edi
pop esi
pop ebp
cmp eax, 5
pop ebx
jae 0x401e59
push str._nRestart_and_set_the_recovery_options_in_the_system_control_panel_nor_the__CRASHDEBUG_system_start_option._If_this_message_reappears__ncontact_sysinternals_at_http:__www.sysinternals.com.
call fcn.00404b10
add esp, 4
add esp, 0x518
ret