Function at 0x2eda32c70
Capabilities:
Get hostname
Get memory capacity
Initialize winsock library
Query or enumerate registry key
Query or enumerate registry value
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x808
lea r15, [rsp + 0x5f0]
mov qword [rsp + 0x850], rcx
mov dword [rsp + 0x858], edx
mov rcx, r15
lea rdx, [0x2eda3e420]
mov qword [rsp + 0x860], r8
mov dword [rsp + 0x868], r9d
mov byte [rsp + 0x80], 0
call sub.msvcrt.dll_wcscpy
lea rdx, [rsp + 0x240]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x2eda32f58
lea rcx, [0x2eda3e428]
call fcn.2eda35e40
xor r8d, r8d
mov rdi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, 0x108
mov r12, rax
lea rax, [rsp + 0x70]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdx, r12
call rdi
test eax, eax
je 0x2eda32e70
mov rcx, r12
xor ebx, ebx
call fcn.2eda35ed0
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x2eda32d4c
mov rbx, qword [rsp + 0xa8]
shr rbx, 0x14
mov rcx, r15
xor r12d, r12d
call fcn.2eda32790
mov r13, rax
test rax, rax
je 0x2eda32e57
mov ecx, 0x800
call fcn.2eda34ed0
mov r12, rax
test rax, rax
je 0x2eda32e4f
mov rax, qword [rsp + 0x850]
lea r14, [rsp + 0x80]
mov rcx, r14
mov eax, dword [rax]
mov dword [r12 + 4], eax
mov rax, qword [rsp + 0x850]
mov eax, dword [rax + 4]
mov dword [r12 + 8], eax
movabs rax, 0x100000002
mov qword [r12 + 0xc], rax
mov eax, dword [rsp + 0x858]
mov dword [r12 + 0x14], eax
call sub.msvcrt.dll_strlen
mov rdx, r14
lea rcx, [r12 + 0x2c]
mov r8d, eax
call fcn.2eda31580
mov rcx, r13
mov dword [r12 + 0x18], 0x2c
mov dword [r12 + 0x1c], eax
add eax, 3
and eax, 0xfffffffc
lea esi, [rax + 0x2c]
call sub.msvcrt.dll_strlen
mov ecx, esi
mov rdx, r13
add rcx, r12
mov r8d, eax
call fcn.2eda31580
mov dword [r12 + 0x20], esi
lea rcx, [r12 + 4]
xor r8d, r8d
mov dword [r12 + 0x24], eax
add eax, 3
and eax, 0xfffffffc
mov dword [r12 + 0x28], ebx
lea edx, [rax + rsi]
mov dword [rsp + 0x6c], edx
sub edx, 4
call fcn.2eda32100
mov dword [r12], eax
mov eax, dword [rsp + 0x868]
test eax, eax
jne 0x2eda32fd8
mov rax, qword [rsp + 0x870]
mov edx, dword [rsp + 0x6c]
mov dword [rax], edx
mov rcx, r13
call fcn.2eda34f30
mov rax, r12
add rsp, 0x808
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [0x2eda3e490]
xor ebx, ebx
lea r13, [rsp + 0x68]
call fcn.2eda35e40
lea rdx, [rsp + 0x6c]
mov qword [rsp + 0x58], r12
mov rbp, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov qword [rsp + 0x50], rax
lea rsi, [rsp + 0x3e0]
lea r14, [rsp + 0x78]
mov r12, rax
mov qword [rsp + 0x48], rdx
jmp 0x2eda32eb3
add ebx, 1
mov dword [rsp + 0x68], 0x104
mov r9, r13
mov r8, rsi
mov edx, ebx
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
test eax, eax
jne 0x2eda32f80
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rcx, qword [rsp + 0x70]
mov rdx, rsi
mov r9d, 0x101
call rdi
test eax, eax
jne 0x2eda32eb0
mov rax, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x6c], 0x104
mov rcx, qword [rsp + 0x78]
mov rdx, r12
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x2eda33020
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2eda32eb0
lea r12, [rsp + 0xe0]
mov edx, 0x50
mov rcx, r12
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x2eda32fa0
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x2eda32cdc
mov r12, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.2eda35ed0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2eda32d19
mov rcx, r12
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x2eda32f73
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x2eda32f73
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x80]
mov rdx, rax
call sub.msvcrt.dll_strcpy
jmp 0x2eda32f73
mov rcx, qword [rsp + 0x860]
lea r14, [rsp + 0x130]
call sub.msvcrt.dll_strlen
mov rdx, qword [rsp + 0x860]
mov rcx, r14
mov r8, rax
call fcn.2eda35310
mov r9d, dword [rsp + 0x6c]
mov r8, r12
mov rdx, r12
mov rcx, r14
call fcn.2eda35380
jmp 0x2eda32e41
mov eax, dword [rsp + 0x6c]
mov r12, qword [rsp + 0x58]
mov byte [r15 + rax], 0
mov eax, dword [rsp + 0x6c]
mov byte [r15 + rax + 1], 0
jmp 0x2eda32f85