Function at 0x411ce0
Capabilities:
Get cpu information
Get memory capacity
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0x4bf370]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call fcn.00411c60
test al, al
jne 0x411d0e
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret
push ebx
xor eax, eax
mov dword [ebp - 0x220], 0
push esi
mov dword [ebp - 0x22c], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x218]
movq qword [edi + 0x12fc], xmm0
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x21c], 0
push eax
lea eax, [ebp - 0x210]
mov dword [edi + 0x12cc], 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
push 0
call fcn.004112e0
mov eax, dword [ebp - 0x20c]
mov esi, dword [ebp - 0x214]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x218]
push 0x74
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2d0]
push 0
push eax
call fcn.00440690
movq xmm0, qword [ebp - 0x14]
lea eax, [ebp - 0x2dc]
add esp, 0xc
movq qword [ebp - 0x2dc], xmm0
mov dword [ebp - 0x2d4], esi
mov ecx, str.GenuineIntel
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411de0
test dl, dl
je 0x411ddc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411de0
add eax, 2
add ecx, 2
test dl, dl
jne 0x411dc0
xor eax, eax
jmp 0x411de5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x411dee
lea ebx, [eax + 1]
jmp 0x411e2f
mov ecx, str.AuthenticAMD
lea eax, [ebp - 0x2dc]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x411e20
test dl, dl
je 0x411e1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x411e20
add eax, 2
add ecx, 2
test dl, dl
jne 0x411e00
xor eax, eax
jmp 0x411e25
sbb eax, eax
or eax, 1
xor ebx, ebx
test eax, eax
setne bl
add ebx, 2
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push closesocket
call fcn.004112e0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x228], eax
cmp eax, 0x80000000
jbe 0x411e9e
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push closesocket
call fcn.004112e0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
call fcn.004112e0
mov esi, dword [ebp - 0x20c]
mov edx, esi
mov ecx, dword [ebp - 0x218]
mov eax, esi
shr eax, 4
and eax, 0xf
shr edx, 8
mov dword [ebp - 0x234], eax
and edx, 0xf
mov eax, esi
mov dword [ebp - 0x238], ecx
and eax, 0xf
mov dword [ebp - 0x224], edx
mov dword [ebp - 0xc], eax
test ecx, 0x800000
je 0x411f08
mov byte [edi + 0x12fc], 1
test ecx, 0x2000000
je 0x411f17
mov byte [edi + 0x12fe], 1
test ecx, 0x4000000
je 0x411f26
mov byte [edi + 0x12ff], 1
mov eax, dword [ebp - 0x214]
test al, 1
je 0x411f37
mov byte [edi + 0x1300], 1
test al, 0x40
je 0x411f42
mov byte [edi + 0x1301], 1
test ecx, 0x10000000
je 0x411f76
cmp ebx, 1
jne 0x411f76
mov eax, dword [ebp - 0x210]
shr eax, 0x10
movzx eax, al
cmp edx, 0xf
jne 0x411f6e
mov dword [ebp - 0x21c], eax
mov byte [edi + 0x1303], bl
jmp 0x411fc7
mov dword [edi + 0x12cc], eax
jmp 0x411fc7
mov dword [ebp - 0x21c], 0
cmp ebx, 2
jne 0x411fc2
cmp dword [ebp - 0x228], 0x80000008
jb 0x41200b
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push ioctlsocket
call fcn.004112e0
movzx eax, byte [ebp - 0x214]
jmp 0x411ffe
cmp ebx, 1
jne 0x41200b
cmp dword [ebp - 0x230], 4
jb 0x41200b
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 4
call fcn.004112e0
mov eax, dword [ebp - 0x20c]
shr eax, 0x1a
mov edx, dword [ebp - 0x224]
inc eax
mov dword [edi + 0x12cc], eax
mov ecx, dword [edi + 0x12cc]
cmp ecx, 2
jne 0x41201f
mov byte [edi + 0x1302], 1
jmp 0x412021
jl 0x412036
mov eax, dword [ebp - 0x21c]
cmp ebx, 1
jne 0x41203c
cmp edx, 0xf
jne 0x41203c
cdq
idiv ecx
jmp 0x41203c
mov eax, dword [ebp - 0x21c]
cmp eax, 1
jg 0x412048
mov byte [edi + 0x1303], 0
mov eax, esi
shr esi, 0x10
shr eax, 0x14
and esi, 0xf
movzx eax, al
cmp ebx, 1
je 0x41207e
mov ecx, dword [ebp - 0x22c]
mov eax, ecx
shr eax, 0x14
mov esi, ecx
movzx ebx, al
mov eax, ecx
shr esi, 0x10
and esi, 0xf
and eax, 0xf
mov dword [ebp - 0x220], eax
jmp 0x412080
mov ebx, eax
push 0x80
lea eax, [edi + 0x124c]
push 0
push eax
call fcn.00440690
add esp, 0xc
cmp dword [ebp - 0x230], 3
jb 0x412135
test dword [ebp - 0x238], 0x40000
je 0x412135
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
call fcn.004112e0
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push eax
push 3
call fcn.004112e0
mov ecx, dword [ebp - 0x214]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x218]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x20c]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [edi + 0x124c]
push ecx
push str._04X__04X__04X__04X__04X__04X
push eax
call fcn.00406660
add esp, 0x20
mov eax, dword [ebp - 0x224]
mov dword [edi + 0x12d8], eax
mov eax, dword [ebp - 0x234]
mov dword [edi + 0x12e0], eax
mov eax, dword [ebp - 0xc]
push 0x80
mov dword [edi + 0x12e4], esi
lea esi, [edi + 0x11cc]
mov dword [edi + 0x12e8], eax
mov eax, dword [ebp - 0x220]
push 0
push esi
mov dword [edi + 0x12dc], ebx
mov dword [edi + 0x12ec], eax
call fcn.00440690
push 0x90
xor ebx, ebx
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.00440690
add esp, 0x18
mov dword [ebp - 0x208], 0x94
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x1f8], 2
jne 0x41224b
lea eax, [ebp - 0x220]
push eax
push 0x20019
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41224b
push 0x100
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00440690
add esp, 0xc
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
push str.ProcessorNameString
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41223b
lea eax, [ebp - 0x114]
push eax
push 0x49efac
push esi
call fcn.00406660
add esp, 0xc
mov ebx, 1
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x412259
push 0x46e4ac
push esi
call fcn.00406660
add esp, 8
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x12c]
mov dword [edi + 0x12f0], eax
lea eax, [ebp - 0x174]
push eax
mov dword [ebp - 0x174], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x168]
shrd ecx, eax, 0xa
push str.GetPhysicallyInstalledSystemMemory
push str.kernel32.dll
mov dword [edi + 0x12f4], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
pop ebx
test eax, eax
je 0x4122da
lea ecx, [ebp - 0x10]
xorps xmm0, xmm0
push ecx
movlpd qword [ebp - 0x10], xmm0
call eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
shrd edx, eax, 0xa
mov dword [edi + 0x12f8], edx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x248]
mov ecx, edi
mov dword [edi + 0x12d0], eax
call fcn.00411330
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.0043ef0f
mov esp, ebp
pop ebp
ret