Function at 0x428de0
Capabilities:
Get cpu information
Get memory capacity
Get system information on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0x6673c0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, ecx
call fcn.00428d60
test al, al
jne 0x428e0e
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004510dc
mov esp, ebp
pop ebp
ret
push ebx
xor eax, eax
mov dword [ebp - 0x220], 0
push esi
mov dword [ebp - 0x22c], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x218]
movq qword [edi + 0x12fc], xmm0
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x21c], 0
push eax
lea eax, [ebp - 0x210]
mov dword [edi + 0x12cc], 1
push eax
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
push 0
call fcn.004283e0
mov eax, dword [ebp - 0x20c]
mov esi, dword [ebp - 0x214]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x218]
push 0x74
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2d0]
push 0
push eax
call fcn.00452360
movq xmm0, qword [ebp - 0x14]
lea eax, [ebp - 0x2dc]
add esp, 0xc
movq qword [ebp - 0x2dc], xmm0
mov dword [ebp - 0x2d4], esi
mov ecx, str.GenuineIntel
nop dword [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x428ee0
test dl, dl
je 0x428edc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x428ee0
add eax, 2
add ecx, 2
test dl, dl
jne 0x428ec0
xor eax, eax
jmp 0x428ee5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x428eee
lea ebx, [eax + 1]
jmp 0x428f2f
mov ecx, str.AuthenticAMD
lea eax, [ebp - 0x2dc]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x428f20
test dl, dl
je 0x428f1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x428f20
add eax, 2
add ecx, 2
test dl, dl
jne 0x428f00
xor eax, eax
jmp 0x428f25
sbb eax, eax
or eax, 1
xor ebx, ebx
test eax, eax
setne bl
add ebx, 2
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push closesocket
call fcn.004283e0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x228], eax
cmp eax, 0x80000000
jbe 0x428f9e
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push closesocket
call fcn.004283e0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
call fcn.004283e0
mov esi, dword [ebp - 0x20c]
mov edx, esi
mov ecx, dword [ebp - 0x218]
mov eax, esi
shr eax, 4
and eax, 0xf
shr edx, 8
mov dword [ebp - 0x234], eax
and edx, 0xf
mov eax, esi
mov dword [ebp - 0x238], ecx
and eax, 0xf
mov dword [ebp - 0x224], edx
mov dword [ebp - 0xc], eax
test ecx, 0x800000
je 0x429008
mov byte [edi + 0x12fc], 1
test ecx, 0x2000000
je 0x429017
mov byte [edi + 0x12fe], 1
test ecx, 0x4000000
je 0x429026
mov byte [edi + 0x12ff], 1
mov eax, dword [ebp - 0x214]
test al, 1
je 0x429037
mov byte [edi + 0x1300], 1
test al, 0x40
je 0x429042
mov byte [edi + 0x1301], 1
test ecx, 0x10000000
je 0x429076
cmp ebx, 1
jne 0x429076
mov eax, dword [ebp - 0x210]
shr eax, 0x10
movzx eax, al
cmp edx, 0xf
jne 0x42906e
mov dword [ebp - 0x21c], eax
mov byte [edi + 0x1303], bl
jmp 0x4290c7
mov dword [edi + 0x12cc], eax
jmp 0x4290c7
mov dword [ebp - 0x21c], 0
cmp ebx, 2
jne 0x4290c2
cmp dword [ebp - 0x228], 0x80000008
jb 0x42910b
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push htons
call fcn.004283e0
movzx eax, byte [ebp - 0x214]
jmp 0x4290fe
cmp ebx, 1
jne 0x42910b
cmp dword [ebp - 0x230], 4
jb 0x42910b
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 4
call fcn.004283e0
mov eax, dword [ebp - 0x20c]
shr eax, 0x1a
mov edx, dword [ebp - 0x224]
inc eax
mov dword [edi + 0x12cc], eax
mov ecx, dword [edi + 0x12cc]
cmp ecx, 2
jne 0x42911f
mov byte [edi + 0x1302], 1
jmp 0x429121
jl 0x429136
mov eax, dword [ebp - 0x21c]
cmp ebx, 1
jne 0x42913c
cmp edx, 0xf
jne 0x42913c
cdq
idiv ecx
jmp 0x42913c
mov eax, dword [ebp - 0x21c]
cmp eax, 1
jg 0x429148
mov byte [edi + 0x1303], 0
mov eax, esi
shr esi, 0x10
shr eax, 0x14
and esi, 0xf
movzx eax, al
cmp ebx, 1
je 0x42917e
mov ecx, dword [ebp - 0x22c]
mov eax, ecx
shr eax, 0x14
mov esi, ecx
movzx ebx, al
mov eax, ecx
shr esi, 0x10
and esi, 0xf
and eax, 0xf
mov dword [ebp - 0x220], eax
jmp 0x429180
mov ebx, eax
push 0x80
lea eax, [edi + 0x124c]
push 0
push eax
call fcn.00452360
add esp, 0xc
cmp dword [ebp - 0x230], 3
jb 0x429235
test dword [ebp - 0x238], 0x40000
je 0x429235
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
call fcn.004283e0
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
push eax
push 3
call fcn.004283e0
mov ecx, dword [ebp - 0x214]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x218]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp - 0x20c]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [edi + 0x124c]
push ecx
push str._04X__04X__04X__04X__04X__04X
push eax
call fcn.0040674a
add esp, 0x20
mov eax, dword [ebp - 0x224]
mov dword [edi + 0x12d8], eax
mov eax, dword [ebp - 0x234]
mov dword [edi + 0x12e0], eax
mov eax, dword [ebp - 0xc]
push 0x80
mov dword [edi + 0x12e4], esi
lea esi, [edi + 0x11cc]
mov dword [edi + 0x12e8], eax
mov eax, dword [ebp - 0x220]
push 0
push esi
mov dword [edi + 0x12dc], ebx
mov dword [edi + 0x12ec], eax
call fcn.00452360
push 0x90
xor ebx, ebx
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.00452360
add esp, 0x18
mov dword [ebp - 0x208], 0x94
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x1f8], 2
jne 0x42934b
lea eax, [ebp - 0x220]
push eax
push 0x20019
push ebx
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x42934b
push 0x100
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00452360
add esp, 0xc
mov dword [ebp - 0xc], 0x100
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
push str.ProcessorNameString
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42933b
lea eax, [ebp - 0x114]
push eax
push 0x47d720
push esi
call fcn.0040674a
add esp, 0xc
mov ebx, 1
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x429359
push 0x48c270
push esi
call fcn.0040674a
add esp, 8
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x12c]
mov dword [edi + 0x12f0], eax
lea eax, [ebp - 0x174]
push eax
mov dword [ebp - 0x174], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov ecx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x168]
shrd ecx, eax, 0xa
push str.GetPhysicallyInstalledSystemMemory
push str.kernel32.dll
mov dword [edi + 0x12f4], ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
pop ebx
test eax, eax
je 0x4293da
lea ecx, [ebp - 0x10]
xorps xmm0, xmm0
push ecx
movlpd qword [ebp - 0x10], xmm0
call eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
shrd edx, eax, 0xa
mov dword [edi + 0x12f8], edx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x248]
mov ecx, edi
mov dword [edi + 0x12d0], eax
call fcn.00428430
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.004510dc
mov esp, ebp
pop ebp
ret