Function at 0x1400eaf90
Capabilities:
Get cpu information
Get disk information
Get hostname
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x14012c040]
xor rax, rsp
mov qword [rbp + 0x330], rax
mov r14, rdx
mov qword [rbp - 0x70], rdx
xor r12d, r12d
mov dword [rsp + 0x40], r12d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov r13d, select
mov qword [rdx + 0x18], r13
mov byte [rdx], r12b
mov esi, 1
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x48], r12d
lea rdx, [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
mov edi, dword [rsp + 0x48]
shr rdi, 5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
mov r15d, r12d
mov qword [rbp - 0x78], r12
mov ebx, r12d
test rdi, rdi
je 0x1400eb0b4
mov rbx, rdi
shl rbx, 5
cmp rbx, 0x1000
jb 0x1400eb074
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400eb73e
call fcn.1400c883c
mov rcx, rax
test rax, rax
je 0x1400eb6ed
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
lea r15, [rbx + rax]
mov r12, rax
jmp 0x1400eb091
test rbx, rbx
je 0x1400eb08a
mov rcx, rbx
call fcn.1400c883c
mov r12, rax
lea r15, [rax + rbx]
jmp 0x1400eb091
mov rax, r12
lea r15, [rbx + r12]
mov rbx, r15
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r15
shl rdi, 5
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov qword [rbp - 0x80], rbx
jmp 0x1400eb0b9
mov r12, qword [rsp + 0x78]
lea rdx, [rsp + 0x48]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
test eax, eax
je 0x1400eb23b
xor edx, edx
mov rcx, r12
cmp r12, rbx
je 0x1400eb0f5
nop dword [rax]
lea eax, [rdx + 1]
cmp dword [rcx + 8], 0
cmovne eax, edx
mov edx, eax
add rcx, 0x20
cmp rcx, rbx
jne 0x1400eb0e0
lea rcx, [rbp - 0x48]
call fcn.14001ac80
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 3
jb 0x1400eb148
lea rax, [rcx + 3]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x1400eb129
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 3
lea rdx, [0x140110c28]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x1400eb168
mov qword [rsp + 0x20], 3
lea r9, [0x140110c28]
mov edx, 3
mov rcx, rdi
call fcn.140018180
mov rdi, rax
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], r13
mov byte [rdi], 0
or esi, 4
mov dword [rsp + 0x4c], esi
mov dword [rsp + 0x40], esi
lea rdx, [rbp - 0x28]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
mov rcx, r14
call fcn.140015b80
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400eb1fd
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb1f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb1f7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001bb60
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400eb23b
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb236
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb236
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001bb60
mov dword [rsp + 0x54], 0x100
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memset
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rsi, 0xffffffffffffffff
test eax, eax
jne 0x1400eb390
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProcessorNameString
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400eb385
lea rax, [rbp + 0x10]
mov rdi, rsi
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400eb2c4
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x1400eb30d
lea rax, [rcx + rdi]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0xf
jbe 0x1400eb2f4
mov rax, qword [r14]
lea rbx, [rax + rcx]
mov r8, rdi
lea rdx, [rbp + 0x10]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x1400eb321
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x10]
mov rdx, rdi
mov rcx, r14
call fcn.140018180
mov rcx, qword [r14 + 0x10]
mov r9, qword [r14 + 0x18]
mov rax, r9
sub rax, rcx
cmp rax, 3
jb 0x1400eb368
lea rax, [rcx + 3]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp r9, 0xf
jbe 0x1400eb349
mov rax, qword [r14]
lea rbx, [rax + rcx]
mov r8d, 3
lea rdx, [0x140110c28]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 3], 0
jmp 0x1400eb385
mov qword [rsp + 0x20], 3
lea r9, [0x140110c28]
mov edx, 3
mov rcx, r14
call fcn.140018180
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], 0
mov qword [rbp - 0x30], r13
mov byte [rbp - 0x48], 0
mov dword [rsp + 0x58], select
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 8]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rax, [rbp - 8]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400eb3c2
mov r8, rsi
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x48]
call fcn.14003a390
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rbp - 0x38]
sub rax, rsi
cmp rax, 3
jb 0x1400eb732
lea rdx, [rbp - 0x48]
mov rdi, qword [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, rdi
mov qword [rsp + 0x70], rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x58], xmm1
lea rax, [rsi + 3]
lea rbx, [rbp - 0x68]
cmp rax, 0xf
jbe 0x1400eb4bb
mov r13, rax
or r13, 0xf
cmp r13, rcx
jbe 0x1400eb475
mov r13, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400c883c
test rax, rax
je 0x1400eb673
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
lea rax, [rsi + 3]
mov rdx, qword [rsp + 0x70]
jmp 0x1400eb4b7
mov ecx, 0x16
cmp r13, rcx
cmovb r13, rcx
lea rcx, [r13 + 1]
cmp rcx, 0x1000
jb 0x1400eb49d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400eb738
jmp 0x1400eb44d
test rcx, rcx
je 0x1400eb4b5
call fcn.1400c883c
mov rbx, rax
lea rax, [rsi + 3]
mov rdx, qword [rsp + 0x70]
jmp 0x1400eb4b7
xor ebx, ebx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], r13
mov r8, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x140110c28]
mov word [rsi + rbx], ax
movzx eax, byte [0x140110c2a]
mov byte [rsi + rbx + 2], al
mov byte [rbx + rsi + 3], 0
mov ebx, dword [rsp + 0x4c]
or ebx, 2
mov dword [rsp + 0x40], ebx
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rdx, qword [rbp - 0x68]
mov r8, qword [rbp - 0x58]
mov rcx, r14
call fcn.140015b80
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x1400eb549
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb544
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400eb673
call fcn.14001bb60
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x220]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x105
lea rcx, [rbp + 0x110]
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x38], 0x105
lea rax, [rbp + 0x110]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
mov r8d, 0x105
lea rdx, [rbp + 0x220]
lea rcx, [0x140110cac]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1400eb680
lea r10, [rbp - 0x53]
mov r8d, dword [rsp + 0x50]
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400eb5e0
lea r9, [rsp + 0x44]
lea r8, [rbp - 0x53]
mov rdx, r10
lea rcx, [rbp - 0x28]
call fcn.140043950
or ebx, 0x18
mov dword [rsp + 0x40], ebx
lea rdx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
cmova rdx, qword [rbp - 0x28]
mov r8, qword [rbp - 0x18]
mov rcx, r14
call fcn.140015b80
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400eb680
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400eb67a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb67a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001bb60
nop
mov rax, qword [rbp - 0x30]
cmp rax, 0xf
jbe 0x1400eb6bf
lea rdx, [rax + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400eb6b6
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb6b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14001bb60
nop
test r12, r12
je 0x1400eb6ff
sub r15, r12
and r15, 0xffffffffffffffe0
mov rax, r12
cmp r15, 0x1000
jb 0x1400eb6f4
add r15, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400eb6f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, r15
mov rcx, r12
call fcn.14001bb60
mov rax, r14
mov rcx, qword [rbp + 0x330]
xor rcx, rsp
call fcn.1400c86b0
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14000f7f0
int3
call fcn.14000f6f0
nop
call fcn.14000f6f0
int3