Function at 0x2291527b7
Capabilities:
Get hostname
Get memory capacity
Initialize winsock library
Query or enumerate registry key
Query or enumerate registry value
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x7d8
lea r13, [rsp + 0x70]
mov rbx, rcx
mov r12, r8
mov dword [rsp + 0x828], edx
mov rcx, r13
lea rdx, [0x22915d420]
mov dword [rsp + 0x838], r9d
call sub.msvcrt.dll_strcpy
lea rcx, [rsp + 0x5c8]
lea rdx, [0x22915d422]
call sub.msvcrt.dll_wcscpy
lea rdx, [rsp + 0x228]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x22915286b
lea r14, [rsp + 0xd6]
mov edx, 0x50
mov rcx, r14
call qword [sym.imp.WS2_32.dll_gethostname]
inc eax
je 0x229152865
mov rcx, r14
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x229152865
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x229152865
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rcx, r13
mov rdx, rax
call sub.msvcrt.dll_strcpy
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, [0x22915d424]
call fcn.2291551d0
xor r8d, r8d
mov rsi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, 0x108
mov r14, rax
lea rax, [rsp + 0x60]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdx, r14
call rsi
test eax, eax
jne 0x2291529b3
lea rcx, [0x22915d485]
xor edi, edi
call fcn.2291551d0
mov rbp, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r15, rax
lea r10, [rsp + 0x3c0]
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov edx, edi
mov qword [rsp + 0x48], r10
mov r8, r10
mov dword [rsp + 0x58], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rbp
mov r10, qword [rsp + 0x48]
test eax, eax
jne 0x2291529a0
lea rax, [rsp + 0x68]
xor r8d, r8d
mov rcx, qword [rsp + 0x60]
mov rdx, r10
mov qword [rsp + 0x20], rax
mov r9d, 0x101
call rsi
test eax, eax
jne 0x229152999
lea rax, [rsp + 0x5c]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
lea r10, [rsp + 0x5c8]
mov dword [rsp + 0x5c], 0x104
mov rdx, r15
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r10, qword [rsp + 0x48]
test eax, eax
jne 0x22915298e
mov eax, dword [rsp + 0x5c]
mov byte [rax + r10], 0
mov eax, dword [rsp + 0x5c]
mov byte [r10 + rax + 1], 0
jmp 0x2291529a0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
jmp 0x2291528c0
mov rcx, r15
call fcn.229155252
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r14
xor edi, edi
call fcn.229155252
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x90], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x2291529e6
mov rdi, qword [rsp + 0x98]
shr rdi, 0x14
lea rcx, [rsp + 0x5c8]
call fcn.22915235d
mov r14, rax
test rax, rax
je 0x229152af3
mov ecx, 0x800
call fcn.229154520
mov rsi, rax
test rax, rax
je 0x229152ae8
mov eax, dword [rbx]
mov rcx, r13
mov dword [rsi + 4], eax
mov eax, dword [rbx + 4]
mov dword [rsi + 8], eax
mov eax, 0x80000001
add rax, rax
mov qword [rsi + 0xc], rax
mov eax, dword [rsp + 0x828]
mov dword [rsi + 0x14], eax
call sub.msvcrt.dll_strlen
mov rdx, r13
lea rcx, [rsi + 0x2c]
mov r8d, eax
call fcn.229151483
mov dword [rsi + 0x18], 0x2c
mov rcx, r14
mov dword [rsi + 0x1c], eax
add eax, 3
and eax, 0xfffffffc
lea ebx, [rax + 0x2c]
call sub.msvcrt.dll_strlen
mov ecx, ebx
mov rdx, r14
add rcx, rsi
mov r8d, eax
call fcn.229151483
mov dword [rsi + 0x20], ebx
xor r8d, r8d
lea rcx, [rsi + 4]
mov dword [rsi + 0x24], eax
add eax, 3
and eax, 0xfffffffc
mov dword [rsi + 0x28], edi
lea edx, [rax + rbx]
mov dword [rsp + 0x5c], edx
sub edx, 4
call fcn.229151de0
cmp dword [rsp + 0x838], 0
mov dword [rsi], eax
je 0x229152ada
mov rcx, r12
lea r13, [rsp + 0x126]
call sub.msvcrt.dll_strlen
mov rdx, r12
mov rcx, r13
mov r8, rax
call fcn.229154890
mov r9d, dword [rsp + 0x5c]
mov r8, rsi
mov rdx, rsi
mov rcx, r13
call fcn.2291548e5
mov rax, qword [rsp + 0x840]
mov edx, dword [rsp + 0x5c]
mov dword [rax], edx
mov rcx, r14
mov r14, rsi
call fcn.229154578
mov rax, r14
add rsp, 0x7d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret