Function at 0x140069c10
Capabilities:
Get common file path
Get hostname
Get user security identifier
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xbb0
mov rax, qword [0x1400e6480]
xor rax, rsp
mov qword [rsp + 0xba0], rax
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x48], 0
mov dword [rsp + 0x7c], 0x104
mov qword [rsp + 0x60], 0
mov dword [rsp + 0x68], 0x44
movzx eax, word [0x1400e878c]
mov word [rsp + 0x98], ax
lea rax, [rsp + 0x9a]
mov rdi, rax
xor eax, eax
mov ecx, 0x1e
rep stosb byte [rdi], al
mov dword [rsp + 0x44], shutdown
mov dword [rsp + 0x40], 0
call fcn.1400826c8
mov dword [rax], 0
call fcn.14006a2f0
test eax, eax
je 0x140069cc5
xor eax, eax
jmp 0x14006a128
cmp qword [rsp + 0xbc0], 0
je 0x140069d49
mov rcx, qword [rsp + 0xbc0]
call fcn.1400881ac
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140069d15
call fcn.1400826c8
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
mov r8, qword [rsp + 0xbc0]
lea rdx, [0x1400e4f58]
lea rcx, str._s_failed_to_duplicate__s
call fcn.140002d00
jmp 0x14006a0fa
lea rdx, [0x1400e4f04]
mov rcx, qword [rsp + 0x48]
call fcn.140076e78
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x80], 0
je 0x140069d49
mov eax, 0x5c
mov rcx, qword [rsp + 0x80]
mov word [rcx], ax
cmp qword [rsp + 0xbc8], 0
je 0x140069d71
mov r8, qword [rsp + 0xbc8]
lea rdx, [rsp + 0xe0]
mov ecx, 0x44
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_CopySid]
jmp 0x140069ddc
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xe0]
mov rdx, qword [rsp + 0x48]
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountNameW]
test eax, eax
jne 0x140069ddc
call fcn.1400826c8
mov dword [rax], 2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1400e4f88]
lea rcx, str._s:_LookupAccountName___failed:__d.
call fcn.140002df0
jmp 0x14006a0fa
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xe0]
call sub.api_ms_win_security_sddl_l1_1_0.dll_ConvertSidToStringSidW
test eax, eax
jne 0x140069e13
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.14006b550
mov dword [rsp + 0x6c], eax
call fcn.1400826c8
mov ecx, dword [rsp + 0x6c]
mov dword [rax], ecx
jmp 0x14006a0fa
mov dword [rsp + 0x70], 0x101
mov dword [rsp + 0x44], shutdown
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x360]
lea rdx, [rsp + 0xe0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_security_lsalookup_l2_1_0.dll_LookupAccountSidW]
test eax, eax
jne 0x140069ea2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ecx, eax
call fcn.14006b550
mov dword [rsp + 0x74], eax
call fcn.1400826c8
mov ecx, dword [rsp + 0x74]
mov dword [rax], ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r8d, eax
lea rdx, [0x1400e4fc0]
lea rcx, str._s:_LookupAccountSid___failed:__d.
call fcn.140002df0
jmp 0x14006a0fa
cmp dword [rsp + 0x40], 1
je 0x140069ed1
call fcn.1400826c8
mov dword [rax], 2
mov r8d, dword [rsp + 0x40]
lea rdx, str.get_passwd
lea rcx, str._s:_Invalid_account_type:__d.
call fcn.140002e50
jmp 0x14006a0fa
mov dword [rsp + 0x78], shutdown
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xb8]
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_GetComputerNameW]
test eax, eax
jne 0x140069ef5
jmp 0x14006a0fa
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x98]
call fcn.140084d84
test eax, eax
jne 0x140069f2a
lea r8, [rsp + 0x360]
mov edx, 0x111
lea rcx, [rsp + 0x130]
call fcn.1400856f4
jmp 0x140069f58
lea rax, [rsp + 0x360]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
lea r8, str._s_s
mov edx, 0x111
lea rcx, [rsp + 0x130]
call fcn.140054bc0
mov r9, qword [rsp + 0x58]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList_ls
mov edx, 0x104
lea rcx, [rsp + 0x990]
call fcn.140054bc0
cmp eax, 0xffffffff
je 0x14006a018
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20101
xor r8d, r8d
lea rdx, [rsp + 0x990]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006a018
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x570]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ProfileImagePath
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a018
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x570]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
cmp eax, 0x104
ja 0x14006a018
mov r8d, 0x104
lea rdx, [rsp + 0x780]
lea rcx, [rsp + 0x570]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x14006a053
mov edx, 0x104
lea rcx, [rsp + 0x780]
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x14006a053
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400e50e8]
call fcn.140002e50
call fcn.1400826c8
mov dword [rax], 0x83
jmp 0x14006a0fa
lea rax, [rsp + 0x130]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], 0xffffffffffffffff
inc qword [rsp + 0x50]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
cmp word [rax + rcx*2], 0
jne 0x14006a06c
mov rax, qword [rsp + 0x50]
inc rax
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.140085698
lea rcx, [rsp + 0x130]
call fcn.14005f430
mov qword [0x1400e8790], rax
cmp qword [0x1400e8790], 0
je 0x14006a0d9
lea rcx, [rsp + 0x780]
call fcn.14005f430
mov qword [0x1400e87b0], rax
cmp qword [0x1400e87b0], 0
jne 0x14006a0eb
call fcn.140069bc0
call fcn.1400826c8
mov dword [rax], reloc.WS2_32.dll_inet_ntoa
jmp 0x14006a0fa
lea rax, [0x1400e8790]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x58], 0
je 0x14006a10d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
cmp qword [rsp + 0x60], 0
je 0x14006a120
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xba0]
xor rcx, rsp
call fcn.1400758f0
add rsp, 0xbb0
pop rdi
ret