Function at 0x180005140
Capabilities:
Get cpu information
Get hostname
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rsi, rdx
xor edi, edi
cmp qword [rcx + 0x10], rdi
jne 0x180005186
mov qword [rdx], rdi
mov qword [rdx + 0x10], rdi
mov qword [rdx + 0x18], 0xf
mov byte [rdx], dil
jmp 0x18000556a
mov qword [rsp + 0x70], rdi
mov r12, rdi
mov qword [rbp - 0x80], rdi
mov r14d, 0xf
mov qword [rbp - 0x78], r14
mov byte [rsp + 0x70], r12b
mov dword [rbp + 0x100], 0x10
lea rdx, [rbp + 0x100]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rbx, [r14 - 0x10]
test eax, eax
je 0x1800051f1
lea rax, [rsp + 0x50]
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1800051d0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.1800085e0
mov r12, qword [rbp - 0x80]
mov r14, qword [rbp - 0x78]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], 0xf
mov byte [rsp + 0x50], 0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x100], 0x100
lea rax, [rbp + 0x108]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800052b5
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProcessorNameString
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800052a8
lea rax, [rbp - 0x50]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180005290
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.1800085e0
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r12
cmp rax, 0x16
jb 0x180005588
lea rdx, [rsp + 0x70]
cmp r14, 0x10
setae byte [rbp + 0x100]
mov r13, qword [rsp + 0x70]
cmovae rdx, r13
mov qword [rbp + 0x108], rdx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
lea rax, [r12 + 0x16]
mov r14d, 0xf
lea r15, [rsp + 0x30]
cmp rax, r14
jbe 0x1800053a6
mov r14, rax
or r14, 0xf
cmp r14, rcx
jbe 0x18000535b
mov r14, rcx
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.18004a0a4
test rax, rax
je 0x1800054ca
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
lea rax, [r12 + 0x16]
mov rdx, qword [rbp + 0x108]
jmp 0x1800053a1
mov ecx, 0x16
cmp r14, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x180005383
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000558e
jmp 0x180005330
test rcx, rcx
je 0x18000539e
call fcn.18004a0a4
mov r15, rax
lea rax, [r12 + 0x16]
mov rdx, qword [rbp + 0x108]
jmp 0x1800053a1
mov r15, rdi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r14
mov r8, r12
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str._League_of_Legends.exe]
movups xmmword [r12 + r15], xmm0
mov eax, dword [0x18004fb88]
mov dword [r12 + r15 + 0x10], eax
movzx eax, word [0x18004fb8c]
mov word [r12 + r15 + 0x14], ax
mov byte [r15 + r12 + 0x16], 0
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x70]
call fcn.1800055a0
nop
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rdx, qword [rbp - 0x70]
mov rax, qword [rbp + 0xf0]
cmp qword [rax + 0x18], 0x10
jb 0x180005413
mov rax, qword [rax]
mov rcx, rax
call fcn.18001b210
mov qword [rsi], rdi
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180005430
mov r8, rbx
mov rdx, rax
mov rcx, rsi
call fcn.1800085e0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x180005486
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005481
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005481
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004a468
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1800054d6
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800054d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800054d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004a468
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x18000552a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005524
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005524
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18004a468
nop
cmp byte [rbp + 0x100], 0
je 0x18000556a
mov rdx, qword [rbp - 0x78]
inc rdx
mov rax, r13
cmp rdx, 0x1000
jb 0x180005562
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005562
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r13
call fcn.18004a468
mov rax, rsi
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180003ac0
nop
call fcn.180003a20
int3