Function at 0x140007ba0
Capabilities:
Get common file path
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x970
mov rbx, rcx
lea rdx, [rax + 8]
add rcx, 0xc78
mov dword [rax + 8], 0x104
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.kernel32
xor esi, esi
mov rdi, rax
mov dword [rsp + 0x980], esi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007c0f
lea rdx, [rsp + 0x980]
mov rcx, rdi
call rax
cmp dword [rsp + 0x980], esi
mov eax, 0x20119
mov r9d, 0x20019
cmovne r9d, eax
lea rax, [rsp + 0x988]
lea rdx, str.Software
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140007d1a
lea rcx, [rsp + 0x31]
xor edx, edx
mov r8d, 0x105
mov byte [rsp + 0x30], sil
call sub.msvcrt.dll_memset
cmp byte [0x140030080], sil
lea rdi, [0x140030080]
jne 0x140007c8c
mov edx, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [0x140030188], eax
mov rcx, rsi
nop
movzx eax, byte [rcx + rdi]
add rcx, 1
test al, al
mov byte [rsp + rcx + 0x2f], al
jne 0x140007c90
mov rdi, qword [rsp + 0x988]
lea r8, [rsp + 0x30]
xor r9d, r9d
mov rdx, rdi
mov rcx, rbx
call fcn.1400066e0
lea r11, [rsp + 0x980]
lea rdx, str.Wow6432Node
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rdi
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140007d0c
mov rdx, qword [rsp + 0x980]
lea r9d, [rax + 1]
lea r8, [rsp + 0x30]
mov rcx, rbx
call fcn.1400066e0
mov rcx, qword [rsp + 0x980]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x988]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x571]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x570], sil
call sub.msvcrt.dll_memset
lea rcx, [0x140027da0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.EnumSystemFirmwareTables
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.GetSystemFirmwareTable
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140007ea3
lea r8, [rsp + 0x570]
mov r9d, 0x400
mov edx, 0x4d44534d
mov ecx, 0x41435049
call rax
cmp eax, 0x38
jbe 0x140007ea3
movzx eax, byte [rsp + 0x5a8]
cmp al, 0x61
jb 0x140007da3
cmp al, 0x7a
jbe 0x140007dbb
cmp al, 0x41
jb 0x140007dab
cmp al, 0x5a
jbe 0x140007dbb
cmp al, 0x30
jb 0x140007ea3
cmp al, 0x39
ja 0x140007ea3
lea rax, [0x140029610]
lea rcx, [rsp + 0x148]
xor edx, edx
mov r8d, 0x428
mov word [rsp + 0x148], si
mov word [rsp + 0x14a], si
mov qword [rsp + 0x140], rax
mov dword [rsp + 0x14c], esi
call sub.msvcrt.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x5a8]
repne scasb al, byte [rdi]
mov esi, 0x7f
lea rdx, [rsp + 0x5a8]
not rcx
sub rcx, 1
cmp ecx, 0x80
cmovge ecx, esi
movsxd rdi, ecx
lea rcx, [rsp + 0x252]
mov r8, rdi
call sub.msvcrt.dll_memcpy
lea rcx, [0x14002fed0]
mov edx, 0x7d1
mov byte [rsp + rdi + 0x252], 0
call fcn.14001bf40
or rcx, 0xffffffffffffffff
mov rdx, rax
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp ecx, 0x80
cmovge ecx, esi
movsxd rdi, ecx
lea rcx, [rsp + 0x150]
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov byte [rsp + rdi + 0x150], 0
lea rdx, [rsp + 0x140]
mov rcx, rbx
mov dword [rsp + 0x56c], 1
call fcn.140016c40
xor edx, edx
mov rcx, rbx
call fcn.140004be0
lea r11, [rsp + 0x970]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret