Function at 0x140020c00
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r14
push r15
sub rsp, 0x70
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x14003e010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r14, rcx
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov qword [r11 - 0x50], r15
mov dword [rsp + 0x48], 0x10
call fcn.140001540
mov rcx, rax
test rax, rax
je 0x140020ef2
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140027f5e.0]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [0x140030b18]
lea rcx, [rsp + 0x40]
call fcn.14000ae00
test al, al
jne 0x140020c94
lea rdx, [0x140030b18]
lea rcx, [rsp + 0x40]
call fcn.14000af20
nop
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020d15
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MHz
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020d05
mov r8d, dword [rsp + 0x50]
lea rdx, str._u_MHz
lea rcx, [rsp + 0x40]
call fcn.14000b890
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r15
mov rbx, qword [rsp + 0x40]
mov rsi, rbx
mov rdi, r15
movzx eax, word [rbx]
mov ebp, 1
test ax, ax
je 0x140020da1
nop dword [rax]
movzx ecx, ax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140020d4c
mov rax, rsi
test rdi, rdi
cmovne rax, rdi
mov rdi, rax
jmp 0x140020d4f
mov rdi, r15
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x140020d30
test rdi, rdi
je 0x140020da1
sub rdi, rbx
sar rdi, 1
test edi, edi
js 0x140020efd
mov ecx, ebp
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140020d8d
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.14000b430
mov rbx, qword [rsp + 0x40]
cmp edi, dword [rbx - 0xc]
jg 0x140020f13
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], r15w
mov rdi, rbx
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140020e6b
nop word [rax + rax]
add rdi, 2
movzx ecx, word [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
jne 0x140020dc0
cmp rdi, rbx
je 0x140020e6b
sub rdi, rbx
sar rdi, 1
mov edx, dword [rbx - 0x10]
test edx, edx
js 0x140020f08
sub ebp, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ebp
jge 0x140020e06
lea rcx, [rsp + 0x40]
call fcn.14000b430
mov rbx, qword [rsp + 0x40]
movsxd rax, edi
lea rdx, [rbx + rax*2]
mov ecx, dword [rbx - 0x10]
mov esi, ecx
sub esi, edi
lea eax, [rsi + 1]
movsxd r8, eax
add r8, r8
je 0x140020e4f
test rdx, rdx
jne 0x140020e35
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov dword [rax], 0x16
jmp 0x140020ed6
lea eax, [rcx + 1]
movsxd rcx, eax
add rcx, rcx
cmp rcx, r8
jb 0x140020ec9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
test esi, esi
js 0x140020ee7
cmp esi, dword [rbx - 0xc]
jg 0x140020ee7
mov dword [rbx - 0x10], esi
movsxd rax, esi
mov word [rbx + rax*2], r15w
lea rcx, [rbx - 0x18]
call fcn.14000b250
add rax, 0x18
mov qword [r14], rax
mov ecx, 0xffffffff
lock xadd dword [rbx - 8], ecx
sub ecx, 1
jg 0x140020e9f
mov rcx, qword [rbx - 0x18]
mov r8, qword [rcx]
lea rdx, [rbx - 0x18]
mov rax, qword [r8 + 8]
call qword [case.0x140027f5e.0]
mov rax, r14
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140027890
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
nop
mov dword [rax], 0x22
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo]
mov ecx, 0x80070057
call fcn.140001280
int3
mov ecx, 0x80070057
call fcn.140001280
nop
mov ecx, 0x80004005
call fcn.140001280
nop
mov ecx, 0x80070057
call fcn.140001280
int3
mov ecx, 0x80070057
call fcn.140001280
int3
mov ecx, 0x80070057
call fcn.140001280
int3