[chunky]

I'd be rather careful with this approach.

The szHwProfileGuid cannot be reliably used to obtain a unique HWID for a system, as the intended functionality is different. This GUID uniquely identifies each hardware profile on a system - not the system itself. Since Windows permits users to create and delete hardware profiles however they like, the szHwProfileGuid is dynamic and does not serve as a persistent or system-wide identifier as it can change at any time or may not even be unique at all.

Check out the documentation of the HW_PROFILE_INFO structure to learn more.

A more sophisticated approach would be to query the UUIDs or other data of the individual hardware components themselves and then calculate a hash on the server side that serves as a unique identifier so an attacker wouldn't know what data exactly needs to be spoofed.