Function at 0x568160
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa38
mov qword [rsp + 0x100], 0xfffffffffffffffe
mov r14, rcx
xor r13d, r13d
mov dword [rsp + 0xa80], r13d
lea edi, [r13 + 0x48]
mov dword [rsp + 0x300], edi
lea rcx, str.psapi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.GetProcessMemoryInfo
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov r8d, edi
lea rdx, [rsp + 0x300]
call rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa98]
lea r8, [rsp + 0x110]
lea rdx, [rsp + 0x108]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ebx, dword [rsp + 0xa9c]
shl rbx, 0x20
mov eax, dword [rsp + 0xa98]
or rbx, rax
mov edi, dword [rsp + 0xa4]
shl rdi, 0x20
mov eax, dword [rsp + 0xa0]
or rdi, rax
call fcn.0058ddec
mov edx, eax
lea rcx, [rsp + 0x298]
call fcn.0058a338
mov r12, rax
mov rdx, qword [0x00862cb8]
cmp byte [rdx + 0x30a7], r13b
jne 0x56826c
mov rcx, qword [rdx + 0xb8]
cmp rcx, r13
je 0x56826c
mov edx, 0x227
call fcn.0040a51c
jmp 0x568272
mov eax, dword [rdx + 0x2cc0]
mov edx, eax
lea rcx, [rsp + 0x238]
call fcn.0058a338
mov rbp, rax
mov rdx, qword [0x00862cb8]
cmp byte [rdx + 0x3242], r13b
jne 0x5682ac
mov rcx, qword [rdx + 0xb8]
cmp rcx, r13
je 0x5682ac
mov edx, 0x3c2
call fcn.004713d8
jmp 0x5682b3
mov rax, qword [rdx + 0x2e70]
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.0058a0c8
mov rsi, rax
mov rdx, qword [0x00862cb8]
cmp byte [rdx + 0x3243], r13b
jne 0x5682ee
mov rcx, qword [rdx + 0xb8]
cmp rcx, r13
je 0x5682ee
mov edx, 0x3c3
call fcn.004713d8
jmp 0x5682f5
mov rax, qword [rdx + 0x2e78]
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.0058a0c8
mov r13, rax
mov rdx, qword [0x008ba238]
lea rcx, [rsp + 0x148]
call fcn.0058a0c8
mov r15, rax
mov rdx, qword [0x008ba230]
lea rcx, [rsp + 0x3b0]
call fcn.0058a0c8
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0x340]
lea rcx, [rsp + 0x268]
call fcn.0058a0c8
mov qword [rsp + 0xc0], rax
mov rdx, qword [rsp + 0x338]
lea rcx, [rsp + 0x350]
call fcn.0058a0c8
mov qword [rsp + 0xd8], rax
mov rdx, qword [rsp + 0x308]
lea rcx, [rsp + 0x208]
call fcn.0058a0c8
mov qword [rsp + 0xd0], rax
mov rdx, qword [rsp + 0x310]
lea rcx, [rsp + 0x380]
call fcn.0058a0c8
mov qword [rsp + 0xa8], rax
lea rcx, [rdi + rbx]
movabs rbx, 0xd6bf94d5e57a42bd
mov rax, rbx
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rcx, rdx
shr rcx, 0x3f
add rdx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x3e0]
call fcn.004d18b4
nop
mov rdx, rax
lea rcx, [rsp + 0x1a8]
call fcn.00402190
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rcx, qword [rsp + 0xe0]
sub rcx, qword [0x00865fd0]
mov rax, rbx
imul rcx
add rdx, rcx
sar rdx, 0x17
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rcx, [rsp + 0x118]
call fcn.0058a338
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x2c8]
call fcn.004ade38
mov qword [rsp + 0xc8], rax
xor r9d, r9d
lea r8, [0x0079f440]
mov edx, 0x100
lea rcx, [rsp + 0x430]
call fcn.006a52b0
lea rdx, [rsp + 0xa90]
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, [rsp + 0x430]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
cmp eax, edi
je 0x5684ad
xorps xmm0, xmm0
jmp 0x568522
mov dword [rsp + 0xa80], 4
lea rax, [rsp + 0xa80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MHz
mov rcx, qword [rsp + 0xa90]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
je 0x568504
mov rcx, qword [rsp + 0xa90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
jmp 0x568522
mov rcx, qword [rsp + 0xa90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [rsp + 0xa88]
pxor xmm0, xmm0
cvtsi2ss xmm0, rdx
xor eax, eax
xor ecx, ecx
cpuid
lea r10, [0x008bb670]
cmp eax, edi
jne 0x56853f
mov byte [0x008bb670], dil
jmp 0x5685c0
mov dword [0x008bb670], ebx
mov dword [0x008bb674], ecx
mov dword [0x008bb678], edx
mov byte [0x008bb67c], dil
mov eax, 0x80000000
xor ecx, ecx
cpuid
mov dword [rsp + 0xf4], ebx
mov dword [rsp + 0xf8], ecx
mov dword [rsp + 0xfc], edx
cmp eax, 0x80000004
jb 0x5685c0
mov r9d, edi
mov r8, r10
lea eax, [r9 - 0x7ffffffe]
xor ecx, ecx
cpuid
mov dword [r8], eax
mov dword [r8 + 4], ebx
mov dword [r8 + 8], ecx
mov dword [r8 + 0xc], edx
inc r9d
add r8, 0x10
cmp r9d, 3
jl 0x568583
mov eax, gethostbyaddr
cmp byte [rax + r10], 0x20
jne 0x5685c0
mov byte [rax + r10], dil
sub rax, 1
jns 0x5685af
mov rax, qword [r12 + 0x28]
mov rcx, qword [rbp + 0x28]
mov rdx, qword [rsi + 0x28]
mov rbx, qword [r13 + 0x28]
mov r8, qword [r15 + 0x28]
mov r9, qword [rsp + 0xe8]
mov r9, qword [r9 + 0x28]
mov r10, qword [rsp + 0xc0]
mov r10, qword [r10 + 0x28]
mov r11, qword [rsp + 0xd8]
mov r11, qword [r11 + 0x28]
mov rdi, qword [rsp + 0xd0]
mov rdi, qword [rdi + 0x28]
mov rsi, qword [rsp + 0xa8]
mov rsi, qword [rsi + 0x28]
mov rbp, qword [rsp + 0xb0]
mov rbp, qword [rbp + 0x28]
mov r12, qword [rsp + 0xb8]
mov r12, qword [r12 + 0x28]
mov r13, qword [rsp + 0xc8]
mov r13, qword [r13 + 0x28]
unpcklps xmm0, xmm0
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x90], xmm0
lea r15, [0x008bb670]
mov qword [rsp + 0x88], r15
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x70], rdx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r10
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r13
lea r9, [0x00799fb4]
lea r8, str._r_n___greylink__s_Compiled_on:__s____r_n___Uptime:__s___Cpu_time:__s____r_n___Memory_usage__peak_:__s___s_____r_n___Virtual_memory_usage__peak_:__s___s_____r_n___Downloaded:__s____Uploaded:__s____r_n___Total_download:__s____Total_upload:__s____r_n___Summary_uptime:__s____r_n___System_Uptime:__s___r_n___CPU_Type:__s___r_n___CPU_Clock:__f_MHz___
mov edx, 0x400
lea rcx, [rsp + 0x630]
call fcn.006a5670
lea rdx, [rsp + 0x2c8]
mov rcx, qword [rsp + 0x2f0]
cmp rcx, rdx
je 0x5686fc
test rcx, rcx
je 0x5686f5
mov rdx, qword [rsp + 0x2c8]
sub rdx, rcx
mov ebx, 0x100
cmp rdx, rbx
jbe 0x5686ee
call fcn.006a4944
jmp 0x568701
call fcn.006a3610
jmp 0x568701
mov ebx, 0x100
jmp 0x568701
mov ebx, 0x100
lea rax, [rsp + 0x118]
mov rcx, qword [rsp + 0x140]
cmp rcx, rax
je 0x568738
test rcx, rcx
je 0x568738
mov rdx, qword [rsp + 0x118]
sub rdx, rcx
cmp rdx, rbx
jbe 0x568732
call fcn.006a4944
jmp 0x568738
call fcn.006a3610
nop
lea rax, [rsp + 0x1a8]
mov rcx, qword [rsp + 0x1d0]
cmp rcx, rax
je 0x56876f
test rcx, rcx
je 0x56876f
mov rdx, qword [rsp + 0x1a8]
sub rdx, rcx
cmp rdx, rbx
jbe 0x568769
call fcn.006a4944
jmp 0x56876f
call fcn.006a3610
nop
lea rax, [rsp + 0x3e0]
mov rcx, qword [rsp + 0x428]
cmp rcx, rax
je 0x5687ad
test rcx, rcx
je 0x5687ad
mov rax, qword [rsp + 0x3e0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, rbx
jbe 0x5687a7
call fcn.006a4944
jmp 0x5687ad
call fcn.006a3610
nop
lea rax, [rsp + 0x380]
mov rcx, qword [rsp + 0x3a8]
cmp rcx, rax
je 0x5687e4
test rcx, rcx
je 0x5687e4
mov rdx, qword [rsp + 0x380]
sub rdx, rcx
cmp rdx, rbx
jbe 0x5687de
call fcn.006a4944
jmp 0x5687e4
call fcn.006a3610
nop
lea rax, [rsp + 0x208]
mov rcx, qword [rsp + 0x230]
cmp rcx, rax
je 0x56881b
test rcx, rcx
je 0x56881b
mov rdx, qword [rsp + 0x208]
sub rdx, rcx
cmp rdx, rbx
jbe 0x568815
call fcn.006a4944
jmp 0x56881b
call fcn.006a3610
nop
lea rax, [rsp + 0x350]
mov rcx, qword [rsp + 0x378]
cmp rcx, rax
je 0x568852
test rcx, rcx
je 0x568852
mov rdx, qword [rsp + 0x350]
sub rdx, rcx
cmp rdx, rbx
jbe 0x56884c
call fcn.006a4944
jmp 0x568852
call fcn.006a3610
nop
lea rax, [rsp + 0x268]
mov rcx, qword [rsp + 0x290]
cmp rcx, rax
je 0x568889
test rcx, rcx
je 0x568889
mov rdx, qword [rsp + 0x268]
sub rdx, rcx
cmp rdx, rbx
jbe 0x568883
call fcn.006a4944
jmp 0x568889
call fcn.006a3610
nop
lea rax, [rsp + 0x3b0]
mov rcx, qword [rsp + 0x3d8]
cmp rcx, rax
je 0x5688c0
test rcx, rcx
je 0x5688c0
mov rdx, qword [rsp + 0x3b0]
sub rdx, rcx
cmp rdx, rbx
jbe 0x5688ba
call fcn.006a4944
jmp 0x5688c0
call fcn.006a3610
nop
lea rax, [rsp + 0x148]
mov rcx, qword [rsp + 0x170]
cmp rcx, rax
je 0x5688f7
test rcx, rcx
je 0x5688f7
mov rdx, qword [rsp + 0x148]
sub rdx, rcx
cmp rdx, rbx
jbe 0x5688f1
call fcn.006a4944
jmp 0x5688f7
call fcn.006a3610
nop
lea rax, [rsp + 0x178]
mov rcx, qword [rsp + 0x1a0]
cmp rcx, rax
je 0x56892e
test rcx, rcx
je 0x56892e
mov rdx, qword [rsp + 0x178]
sub rdx, rcx
cmp rdx, rbx
jbe 0x568928
call fcn.006a4944
jmp 0x56892e
call fcn.006a3610
nop
lea rax, [rsp + 0x1d8]
mov rcx, qword [rsp + 0x200]
cmp rcx, rax
je 0x568965
test rcx, rcx
je 0x568965
mov rdx, qword [rsp + 0x1d8]
sub rdx, rcx
cmp rdx, rbx
jbe 0x56895f
call fcn.006a4944
jmp 0x568965
call fcn.006a3610
nop
lea rax, [rsp + 0x238]
mov rcx, qword [rsp + 0x260]
cmp rcx, rax
je 0x56899c
test rcx, rcx
je 0x56899c
mov rdx, qword [rsp + 0x238]
sub rdx, rcx
cmp rdx, rbx
jbe 0x568996
call fcn.006a4944
jmp 0x56899c
call fcn.006a3610
nop
lea rax, [rsp + 0x298]
mov rcx, qword [rsp + 0x2c0]
cmp rcx, rax
je 0x5689d2
test rcx, rcx
je 0x5689d2
mov rdx, qword [rsp + 0x298]
sub rdx, rcx
cmp rdx, rbx
jbe 0x5689cd
call fcn.006a4944
jmp 0x5689d2
call fcn.006a3610
lea r8, [rsp + 0xa80]
lea rdx, [rsp + 0x630]
mov rcx, r14
call fcn.004021a8
mov rax, r14
add rsp, 0xa38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret