Function at 0x1400042a0
Capabilities:
Get cpu information
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rbp + 0x370], rax
mov rsi, rcx
xor r12d, r12d
lea rcx, str.Kernel32.dll
mov r14, rdx
mov edi, r12d
mov dword [rsp + 0x48], r12d
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000431e
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x48]
mov rcx, rax
call rbx
cmp dword [rsp + 0x48], r12d
mov eax, 0x100
cmovne edi, eax
cmp byte [0x140030c2a], r12b
jne 0x140004336
lea rcx, str.Querying_information_for__s...
mov rdx, r14
call fcn.140003100
call fcn.140008c34
lea rcx, [rax + 0x30]
call fcn.140008e1c
cmp byte [0x140037128], r12b
jne 0x1400043a6
mov edx, r12d
lea r8, str.qsjpsjuzrvbouvnnbusjy
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [r8 + rax*2], dx
jne 0x140004360
test rax, rax
je 0x14000439f
mov rcx, r12
mov r9d, 0xffff
nop dword [rax + rax]
add word [r8 + rcx*2], r9w
inc edx
or rax, 0xffffffffffffffff
mov ecx, edx
nop dword [rax]
inc rax
cmp word [r8 + rax*2], r12w
jne 0x140004390
cmp rcx, rax
jb 0x140004380
mov byte [0x140037128], 1
mov rcx, r12
lea r15, [0x140000000]
movzx eax, word [rcx + r15 + 0x23dc0]
lea rcx, [rcx + 2]
mov word [rsp + rcx + 0x4e], ax
test ax, ax
jne 0x1400043b0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140003ef0
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x14000442b
call fcn.1400024b0
call fcn.140008c34
lea rdx, str.Unable_to_query_system_information_for__s:_n
lea rcx, [rax + 0x60]
mov r8, r14
call fcn.140008fbc
mov ecx, ebx
call fcn.140003030
mov eax, 1
jmp 0x140004d3f
mov qword [rsp + 0x4d0], r13
mov rcx, r12
lea rdx, [0x140031050]
nop dword [rax]
movzx eax, word [rcx + r15 + 0x23ee8]
lea rcx, [rcx + 2]
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x140004440
mov rcx, r12
lea rbx, [0x140031aa0]
movzx eax, word [rcx + r15 + 0x23ef0]
lea rcx, [rcx + 2]
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x140004461
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rdx, str.CSDVersion
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [0x140031260]
lea r9, [rsp + 0x34]
lea rdx, str.SubVersionNumber
xor r8d, r8d
mov word [0x140031260], r12w
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r13, [0x140031470]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.CurrentBuildNumber
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [0x140031680]
lea r9, [rsp + 0x34]
lea rdx, str.CurrentType
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
lea rdx, str.CurrentVersion
mov qword [rsp + 0x28], rax
lea rax, [0x140031890]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, r12
nop dword [rax]
nop dword [rax + rax]
movzx eax, word [rcx + r15 + 0x23fb0]
lea rcx, [rcx + 2]
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x1400045a0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, [0x140021820]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [0x1400320d0]
lea rdx, str.RegisteredOrganization
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [0x140031ec0]
lea r9, [rsp + 0x34]
lea rdx, str.RegisteredOwner
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
lea rdx, str.SystemRoot
mov qword [rsp + 0x28], rax
lea rax, [0x140031cb0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [0x140032b20], r12w
mov ebx, r12d
nop word [rax + rax]
lea rdx, str.SYSTEMCurrentControlSetControlClass4D36E968_E325_11CE_BFC1_08002BE1031800_02d
lea rcx, [rsp + 0x50]
mov r8d, ebx
call fcn.140007ff8
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400046f2
inc ebx
cmp ebx, 0xa
jb 0x1400046b0
jmp 0x140004735
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [0x140032b20]
lea rdx, str.DriverDesc
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerVersion_Vector
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov word [0x140033150], r12w
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400047a7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [0x140033150]
lea rdx, [0x140024188]
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x14002fa17], r12b
je 0x1400047e6
lea r8, str.SoftwareMicrosoftUpdates
mov edx, edi
mov rcx, rsi
call fcn.140006b40
lea r9, str.SoftwareMicrosoftWindows_NTCurrentVersionHotfix
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call fcn.140006710
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
mov edx, edi
mov rcx, rsi
call fcn.140006930
cmp byte [0x140030c28], r12b
je 0x1400049f9
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140004838
cmp dword [0x14002fa10], r12d
je 0x1400049f9
lea rcx, str._n_s_is_not_supported_on_Nano_Server__please_use_PowerShell_cmdlet_Get_AppxPackage_instead._n
call fcn.140007f24
jmp 0x1400049f9
mov rcx, qword [rsp + 0x38]
lea r8, [rbp + 0x160]
mov r9d, 0x208
xor edx, edx
mov edi, r12d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1400049f9
nop dword [rax]
mov rcx, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x160]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400049d5
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, str.DisplayName
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400049ca
lea ecx, [rax + 0x18]
call fcn.140007da8
mov rbx, rax
mov qword [rax + 0x10], r12
mov qword [rax + 8], r12
mov ecx, dword [rsp + 0x30]
add rcx, 2
call fcn.140007da8
lea rcx, [rsp + 0x30]
lea rdx, str.DisplayName
mov qword [rsp + 0x28], rcx
mov qword [rbx], rax
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.DisplayVersion
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000496c
mov ecx, dword [rsp + 0x30]
add rcx, 2
call fcn.140007da8
lea rcx, [rsp + 0x30]
lea rdx, str.DisplayVersion
mov qword [rsp + 0x28], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14000496c
mov rcx, qword [rbx + 8]
call fcn.140007d68
mov qword [rbx + 8], r12
mov r9, qword [0x140031eb8]
test r9, r9
je 0x1400049c3
mov r11, qword [rbx]
mov r10, r12
nop
mov rax, qword [r9]
mov r8, r11
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400049a4
add rax, 2
test ecx, ecx
jne 0x140004990
test edx, edx
jns 0x1400049b4
mov r10, r9
mov r9, qword [r9 + 0x10]
test r9, r9
jne 0x140004980
mov qword [rbx + 0x10], r9
test r10, r10
je 0x1400049c3
mov qword [r10 + 0x10], rbx
jmp 0x1400049ca
mov qword [0x140031eb8], rbx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
inc edi
lea r8, [rbp + 0x160]
mov edx, edi
mov r9d, 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x140004860
lea rax, [rsp + 0x38]
lea rdx, str.SystemCurrentControlSetControlSession_ManagerEnvironment
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x140004ad2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [0x1400324f0]
lea rdx, str.number_of_processors
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rbx, [0x140032700]
lea r9, [rsp + 0x34]
lea rdx, str.processor_identifier
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
call fcn.1400055a0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
lea rdx, str.SystemCurrentControlSetControlProductOptions
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x140004b00
call fcn.1400024b0
call fcn.140008c34
lea rdx, str.Unable_to_query_system_information_for__s:_n
lea rcx, [rax + 0x60]
mov r8, r14
call fcn.140008fbc
mov ecx, ebx
call fcn.140003030
mov eax, 1
jmp 0x140004d37
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [0x140032d30]
lea rdx, str.ProductType
xor r8d, r8d
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rbx, [0x140032f40]
lea rdx, [0x140022d30]
mov rcx, rbx
call fcn.140007ff8
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.ProductSuite
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x30]
mov ecx, r12d
shr rdx, 1
dec rdx
je 0x140004bac
mov rax, r12
mov r8d, 0x20
cmp word [rbx + rax*2], r12w
jne 0x140004ba3
mov word [rbx + rax*2], r8w
inc ecx
mov eax, ecx
cmp rax, rdx
jb 0x140004b97
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
lea rdx, str.HardwareDescriptionSystemCentralProcessor0
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
lea rdx, str.MHz
mov qword [rsp + 0x28], rax
lea rax, [0x140031258]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rbx, [0x140032910]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rdx, str.ProcessorNameString
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], 0x208
mov word [0x140032910], r12w
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, rbx
call fcn.140006f80
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x140024648]
mov rcx, rbx
call fcn.14000a4d4
test rax, rax
je 0x140004c8e
cmp word [rax], 0x20
je 0x140004c8a
nop
sub rax, 2
cmp word [rax], 0x20
jne 0x140004c80
mov word [rax], r12w
mov rcx, rsi
call fcn.140004d60
mov rcx, r13
mov qword [0x140031888], rax
call fcn.14000a954
cmp eax, 0x893
jle 0x140004cd9
lea r8, [0x1400320c8]
lea rdx, [0x14003167d]
mov rcx, r14
call fcn.140005210
movzx ecx, byte [0x14003167c]
mov edx, 1
test al, al
cmove ecx, edx
mov byte [0x14003167c], cl
cmp byte [0x140030c29], r12b
je 0x140004d19
lea rdx, [0x140030a20]
mov rcx, r14
mov dword [0x140033360], r12d
call fcn.140007808
test eax, eax
je 0x140004d0d
lea rdx, [0x140033360]
mov rcx, r14
call fcn.140006dc0
jmp 0x140004d19
lea rcx, [0x140033360]
call fcn.140003de0
mov rcx, r14
call fcn.140005430
cmp byte [0x140030c2a], r12b
mov byte [0x140030c2b], al
jne 0x140004d35
call fcn.1400024b0
xor eax, eax
mov r13, qword [rsp + 0x4d0]
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.140008390
add rsp, 0x480
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret