Function at 0x14000e720
Capabilities:
Get file size
Get hostname
Query or enumerate registry value
Write file on windows

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x430
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rbp + 0x428], rbx
mov qword [rbp + 0x430], rsi
mov qword [rbp + 0x438], rdi
mov rax, qword [0x140030030]
xor rax, rbp
mov qword [rbp + 0x3e0], rax
mov rsi, rcx
mov qword [rbp + 0x28], rcx
lea rax, [0x140024fe8]
mov qword [rcx], rax
lea rax, [0x140025000]
mov qword [rcx], rax
xor r13d, r13d
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r13d
mov qword [rbp + 0x20], r13
mov r9d, 0x20019
lea r8, str.SOFTWAREDigitalPersonaTracing
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x10]
call fcn.140010800
test eax, eax
je 0x14000e7d6
call fcn.1400107f0
test al, al
je 0x14000e7d6
mov r9d, 0x20219
lea r8, str.SOFTWAREDigitalPersonaTracing
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x10]
call fcn.140010800
nop
lea rdx, [rsi + 0x10]
lea rcx, [rbp + 0x10]
call fcn.14000f6a0
test al, al
jne 0x14000e7f9
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x14000ed63
jmp 0x14000ed59
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [rbp], r13d
mov ebx, 4
mov r12, qword [rbp + 0x10]
test r12, r12
je 0x14000e850
mov dword [rbp + 4], ebx
lea rax, [rbp + 4]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 8]
xor r8d, r8d
lea rdx, str.NewFileAlways
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000e850
cmp dword [rbp + 8], ebx
jne 0x14000e850
cmp dword [rbp], eax
seta al
jmp 0x14000e852
mov al, 1
mov r14d, 2
test al, al
cmovne ebx, r14d
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x8000080
mov dword [rsp + 0x20], ebx
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 1]
lea rcx, [rsi + 0x10]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsi + 8], rax
cmp rax, 0xffffffffffffffff
je 0x14000ed51
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor edx, edx
test eax, eax
jne 0x14000ebbd
mov byte [rbp + 0x50], al
mov r8d, 0x167
lea rcx, [rbp + 0x51]
call fcn.140014ee0
mov dword [rbp], r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp]
lea r8d, [r14 + 6]
lea rdx, str.trace3_r_n
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rax, str.17:16:42
mov qword [rsp + 0x28], rax
lea rax, str.Dec__7_2018
mov qword [rsp + 0x20], rax
lea r9, str.Compiled:__s__s_r_n
or rdi, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x168
lea rcx, [rbp + 0x50]
call fcn.140014d30
lea rax, [rbp + 0x50]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000e920
mov qword [rsp + 0x20], r13
lea r9, [rbp]
lea rdx, [rbp + 0x50]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [rbp + 0x1c0], 0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x1c1]
call fcn.140014ee0
mov dword [rbp + 4], 0x105
call fcn.14000fd10
mov rcx, rax
mov r8d, 0x105
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, str.File_location:__s_r_n
mov r8, rdi
mov edx, 0x168
lea rcx, [rbp + 0x50]
call fcn.140014d30
lea rax, [rbp + 0x50]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000e9b0
mov qword [rsp + 0x20], r13
lea r9, [rbp]
lea rdx, [rbp + 0x50]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call fcn.1400119e0
mov byte [rbp + 0x2d0], 0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x2d1]
call fcn.140014ee0
mov dword [rbp + 4], 0x104
lea rdx, [rbp + 4]
lea rcx, [rbp + 0x2d0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
lea r9, str.Machine_name:__s_r_n
mov r8, rdi
mov edx, 0x168
lea rcx, [rbp + 0x50]
call fcn.140014d30
movzx eax, word [0x1400250ec]
mov word [rbp + 0x1b5], ax
movzx eax, byte [0x1400250ee]
mov byte [rbp + 0x1b7], al
lea rax, [rbp + 0x50]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x14000ea52
mov qword [rsp + 0x20], r13
lea r9, [rbp]
lea rdx, [rbp + 0x50]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [section..data]
mov qword [rsp + 0x20], rax
lea r9, str.Trace_Ver:__s_r_n
mov r8, rdi
mov edx, 0x168
lea rcx, [rbp + 0x50]
call fcn.140014d30
lea rax, [rbp + 0x50]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14000eaa0
mov qword [rsp + 0x20], r13
lea r9, [rbp]
lea rdx, [rbp + 0x50]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call fcn.140011970
test al, al
jne 0x14000eaed
mov qword [rsp + 0x20], r13
lea r9, [rbp]
mov r8d, 0x16
lea rdx, str.FileVersion:_UNKNOWN_r_n
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call fcn.140011c70
test eax, eax
jne 0x14000eb17
mov qword [rsp + 0x20], r13
lea r9, [rbp]
lea r8d, [rax + 0x1b]
lea rdx, str.No_U.are.U_products_found_r_n
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
call fcn.1400104c0
lea rcx, str.installation:_LOCAL_r_n
lea r8, str.installation:_NETWORK_r_n
test eax, eax
cmovne r8, rcx
mov r9, rdi
mov edx, 0x168
lea rcx, [rbp + 0x50]
call fcn.140014358
lea rax, [rbp + 0x50]
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000eb50
mov qword [rsp + 0x20], r13
lea r9, [rbp]
lea rdx, [rbp + 0x50]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call fcn.1400115b0
mov r9, rdi
lea r8, [0x140025168]
mov edx, 0x168
lea rcx, [rbp + 0x50]
call fcn.140014358
lea rax, [rbp + 0x50]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000eb95
mov r8, rdi
mov qword [rsp + 0x20], r13
lea r9, [rbp]
lea rdx, [rbp + 0x50]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x14000ed51
mov r9d, r14d
xor r8d, r8d
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov word [rbp + 0x38], r13w
xor eax, eax
mov qword [rbp + 0x3a], rax
mov dword [rbp + 0x42], eax
mov word [rbp + 0x46], ax
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov byte [rbp + 0x1c0], 0
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x1c1]
call fcn.140014ee0
movzx eax, word [rbp + 0x38]
movzx ecx, word [rbp + 0x3e]
movzx edx, word [rbp + 0x3a]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea r9, str._02u__02u__02u
or rdi, 0xffffffffffffffff
mov r8, rdi
mov edx, 0x105
lea rcx, [rbp + 0x1c0]
call fcn.140014d30
mov rbx, r13
mov qword [rbp + 8], rbx
lea rcx, [rbp + 0x1c0]
mov rax, rdi
nop dword [rax]
lea rax, [rax + 1]
cmp byte [rcx + rax], 0
jne 0x14000ec50
lea r15, [rax + 7]
cmp r15, 0x400
ja 0x14000ec99
mov rcx, r15
call fcn.140011ed0
test al, al
je 0x14000ec99
lea rax, [r15 + 0xf]
cmp rax, r15
ja 0x14000ec86
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140014e80
sub rsp, rax
lea r14, [rsp + 0x40]
jmp 0x14000ecca
mov rax, rdi
sub rax, r15
cmp rax, 0x10
jb 0x14000ed46
lea rcx, [r15 + 0x10]
call fcn.140012b48
test rax, rax
jne 0x14000ecbc
mov r14, r13
jmp 0x14000ecca
mov qword [rax], r13
mov rbx, rax
mov qword [rbp + 8], rax
lea r14, [rax + 0x10]
test r14, r14
je 0x14000ed1d
mov byte [r14 + 4], 0x4e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [r14], eax
lea rax, [rbp + 0x1c0]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000ece4
mov word [r14 + 5], di
test di, di
je 0x14000ed0b
lea rcx, [r14 + 7]
movzx r8d, di
lea rdx, [rbp + 0x1c0]
call fcn.140013df0
xor r9d, r9d
mov r8, r15
mov rdx, r14
mov rcx, rsi
call fcn.140011530
nop
test rbx, rbx
je 0x14000ed51
nop dword [rax]
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 8], rbx
call fcn.140012b08
test rbx, rbx
jne 0x14000ed30
jmp 0x14000ed51
mov ecx, 0x80070216
call fcn.14000d5a0
nop
test r12, r12
je 0x14000ed63
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r13d
mov rax, rsi
mov rcx, qword [rbp + 0x3e0]
xor rcx, rbp
call fcn.140013760
mov rbx, qword [rbp + 0x428]
mov rsi, qword [rbp + 0x430]
mov rdi, qword [rbp + 0x438]
lea rsp, [rbp + 0x3f0]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret