Function at 0x140029620
Capabilities:
Get cpu information
Get hostname
Get memory capacity
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, reloc.MFC42.dll_CDialogTemplate::CDialogTemplate
sub rsp, 0x220
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x110], rax
xor edx, edx
mov r8d, operator>>
mov rbx, rcx
call sub.msvcrt.dll_memset
mov r13d, 2
lea rdx, [rsp + 0x38]
lea r12d, [r13 + 0xe]
lea rcx, [rbx + 0xc]
xor r14d, r14d
mov dword [rbx], 0x20002
mov dword [rbx + 4], 0x2580
mov dword [rsp + 0x38], r12d
mov word [rbx + 8], r14w
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rdi, [0x140002e48]
test eax, eax
jne 0x1400296b4
lea rcx, [rbx + 0xc]
mov r8d, r12d
mov rdx, rdi
call fcn.140027e84
lea rdx, [rsp + 0x38]
lea rcx, [rbx + 0x2c]
mov r15d, 0x104
mov dword [rsp + 0x38], r15d
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1400296f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [0x140007a54]
mov r8d, r15d
cmp eax, 0x4dd
cmove rdi, rcx
lea rcx, [rbx + 0x2c]
mov rdx, rdi
call fcn.140027e84
mov edi, 0x9c
lea rcx, [rbp - 0x40]
xor edx, edx
mov r8d, edi
call sub.msvcrt.dll_memset
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x14002973a
lea rcx, [rbp - 0x40]
mov r8d, edi
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x94
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [rbp - 0x3c]
mov r15d, 0x80
lea rcx, [rbx + 0x27c]
mov dword [rbx + 0x264], eax
mov eax, dword [rbp - 0x38]
lea rdx, [rbp - 0x2c]
mov dword [rbx + 0x268], eax
mov eax, dword [rbp - 0x34]
mov r8d, r15d
mov dword [rbx + reloc.MFC42.dll_CControlBar::CControlBar], eax
mov eax, dword [rbp - 0x30]
mov byte [rbp + 0x53], r14b
mov dword [rbx + 0x270], eax
movzx eax, word [rbp + 0x54]
mov word [rbx + 0x274], ax
movzx eax, word [rbp + 0x56]
mov word [rbx + 0x276], ax
movzx eax, word [rbp + 0x58]
mov word [rbx + 0x278], ax
movzx eax, byte [rbp + 0x5a]
mov word [rbx + 0x27a], ax
call fcn.140027e84
lea ecx, [r15 - 0x2a]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1400297ba
or word [rbx + 0xa], r12w
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r12d, 0x20
test eax, eax
je 0x1400297d4
or word [rbx + 0xa], r12w
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1400297e8
or word [rbx + 0xa], 0x40
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1400297fc
or word [rbx + 0xa], r15w
mov rax, qword [0x140049448]
test rax, rax
je 0x14002982a
movzx r9d, word [rbp + 0x56]
movzx r8d, word [rbp + 0x54]
mov edx, dword [rbp - 0x38]
mov ecx, dword [rbp - 0x3c]
lea rdi, [rbx + 0x1c]
mov qword [rsp + 0x20], rdi
call rax
test eax, eax
jne 0x14002982a
mov dword [rdi], r14d
lea rax, [rsp + 0x40]
mov esi, 1
lea rdx, [0x140007a58]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, esi
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140029956
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea rdi, [rbx + 0x160]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rdx, [0x140007a88]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x34], r15d
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400298ad
cmp dword [rsp + 0x30], esi
jne 0x1400298ad
mov byte [rbx + 0x1df], r14b
jmp 0x1400298b0
mov byte [rdi], r14b
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea rdi, [rbx + 0x1e0]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rdx, [0x140007a98]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x34], r15d
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400298fd
cmp dword [rsp + 0x30], esi
jne 0x1400298fd
mov byte [rbx + 0x25f], r14b
jmp 0x140029900
mov byte [rdi], r14b
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea rdi, [rbx + 0x260]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rdx, [0x140007aac]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x34], 4
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140029948
cmp dword [rsp + 0x30], 4
je 0x14002994b
mov dword [rdi], r14d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x30]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp byte [0x14004961d], r14b
movzx eax, word [rsp + 0x50]
mov dword [rbx + 0x130], eax
mov eax, dword [rsp + 0x54]
mov dword [rbx + 0x134], eax
mov rax, qword [rsp + 0x58]
mov qword [rbx + 0x138], rax
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0x140], rax
mov rax, qword [rsp + 0x68]
mov qword [rbx + reloc.MFC42.dll_CDialogTemplate::CDialogTemplate], rax
mov eax, dword [rsp + 0x70]
mov dword [rbx + 0x150], eax
mov eax, dword [rsp + 0x74]
mov dword [rbx + 0x154], eax
mov eax, dword [rsp + 0x78]
mov dword [rbx + 0x158], eax
movzx eax, word [rsp + 0x7c]
mov word [rbx + 0x15c], ax
movzx eax, word [rsp + 0x7e]
mov word [rbx + 0x15e], ax
je 0x1400299ed
or word [rbx + 0xa], si
or word [rbx + 0xa], r13w
mov edi, 0x38
lea rcx, [rbp - 0x80]
mov r8d, edi
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [rbp - 0x80]
mov dword [rbp - 0x80], edi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [rbp - 0x7c]
lea r8d, [rdi + 0x74]
mov dword [rbx + 0x2fc], eax
mov rax, qword [rbp - 0x78]
lea rcx, [rbp + 0x60]
mov qword [rbx + 0x300], rax
mov rax, qword [rbp - 0x70]
xor edx, edx
mov qword [rbx + 0x308], rax
mov rax, qword [rbp - 0x68]
mov qword [rbx + 0x310], rax
mov rax, qword [rbp - 0x60]
mov qword [rbx + 0x318], rax
mov rax, qword [rbp - 0x58]
mov qword [rbx + 0x320], rax
mov rax, qword [rbp - 0x50]
mov qword [rbx + 0x328], rax
call sub.msvcrt.dll_memset
lea rcx, [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea rcx, [rbx + 0x330]
mov r8, r12
cmp eax, r13d
jne 0x140029a9d
lea rdx, [rbp + 0xb8]
call qword [sym.imp.msvcrt.dll_wcstombs]
mov ecx, dword [rbp + 0x60]
add ecx, dword [rbp + 0x108]
jmp 0x140029ab0
lea rdx, [rbp + 0x64]
call qword [sym.imp.msvcrt.dll_wcstombs]
mov ecx, dword [rbp + 0x60]
add ecx, dword [rbp + 0xb4]
mov dword [rbx + 0x350], ecx
lea rcx, [rsp + 0x48]
mov byte [rbx + 0x34f], r14b
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rdx, [rbx + reloc.MFC42.dll_COleVariant::operator]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [rbx + 0x35c], ax
mov rcx, qword [rbp + 0x110]
xor rcx, rsp
call fcn.14003f730
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret