Function at 0x402218
Capabilities:
Get cpu information
Get hostname
Get memory capacity
Get system information on windows
Query or enumerate registry value

Disassembly:
push rbp
push rdi
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x430], rcx
lea rax, [rbp + 0x3d0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call rax
mov dword [rbp + 0x390], 0x40
lea rax, [rbp + 0x390]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call rax
movabs rax, 0x206e776f6e6b6e55
mov edx, 0x534f
mov qword [rbp + 0x310], rax
mov qword [rbp + 0x318], rdx
lea rdx, [rbp + 0x320]
mov eax, 0
mov ecx, 0xe
mov rdi, rdx
rep stosq qword [rdi], rax
lea rax, [rbp + 0x310]
mov edx, pe_nt_image_headers64
mov rcx, rax
call sym.get_os_name
mov dword [rbp + 0x20c], 0x100
lea rdx, [rbp + 0x20c]
lea rax, [rbp + 0x210]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call rax
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x6f737365636f7250
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rdx
mov qword [rbp + 0x110], 0x72
mov qword [rbp + 0x118], 0
lea rdx, [rbp + 0x120]
mov eax, 0
mov ecx, 0x1c
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x20c], 0x100
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x4023a9
mov rax, qword [rbp + 0xf8]
lea rdx, [rbp + 0x20c]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x100]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.ProcessorNameString
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
movabs rax, 0x206e776f6e6b6e55
movabs rdx, 0x6c65646f4d
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rdx, rbp
mov eax, 0
mov ecx, 0x1e
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x20c], 0x100
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov r8d, 0
lea rdx, str.HARDWAREDESCRIPTIONSystemBIOS
mov rcx, 0xffffffff80000002
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
jne 0x402463
mov rax, qword [rbp + 0xf8]
lea rdx, [rbp + 0x20c]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0
mov r8d, 0
lea rdx, str.SystemProductName
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call rax
mov rax, qword [rbp + 0xf8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
call sym.IsRunningAsAdmin
test eax, eax
je 0x402475
lea rax, str.true
jmp 0x40247c
lea rax, str.false
mov qword [rbp + 0x408], rax
movzx eax, word [rbp + 0x3d0]
cmp ax, 9
jne 0x402499
lea rax, [0x004064ed]
jmp 0x4024a0
lea rax, [0x004064f1]
mov rdx, qword [rbp + 0x398]
shr rdx, 0x14
mov r8, rdx
mov ecx, dword [rbp + 0x3f0]
lea rdx, str.7033760840
mov qword [rsp + 0x68], rdx
mov rdx, qword [rbp + 0x408]
mov qword [rsp + 0x60], rdx
lea rdx, [0x0040624b]
mov qword [rsp + 0x58], rdx
lea rdx, [0x004065ff]
mov qword [rsp + 0x50], rdx
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x48], rdx
lea rdx, [rbp + 0x100]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x310]
mov qword [rsp + 0x38], rdx
lea rdx, [rbp + 0x210]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
lea rax, str.Windows
mov qword [rsp + 0x20], rax
mov r9, r8
mov r8d, ecx
lea rdx, str._n___cpuCores_:___u___n___totalMemory_:___llu_MB___n___platform_:___s___n___arch_:___s___n___model_:___s___n___osVersion_:___s___n___processorName_:___s___n___systemModel_:___s___n___configuration_:___s___n___filename_:___s___n___admin_:___s___n___token_:___s__n
mov rcx, qword [rbp + 0x430]
call sym.sprintf
mov rdx, qword [rbp + 0x430]
lea rcx, str.System_Info_JSON:_n_s_n
call sym.printf
nop
add rsp, 0x498
pop rdi
pop rbp
ret