Function at 0x140002cb6
Capabilities:
Get hostname
Get memory capacity
Initialize winsock library
Query or enumerate registry key
Query or enumerate registry value
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x7d8
mov r12, rcx
mov r13d, edx
mov qword [rsp + 0x830], r8
mov dword [rsp + 0x838], r9d
mov byte [rsp + 0x5a0], 0
lea rcx, [rsp + 0x390]
lea rdx, [0x140018500]
call sub.msvcrt.dll_wcscpy
lea rdx, [rsp + 0x1b0]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x140002e94
lea rcx, [0x140018508]
call fcn.140005cd5
mov rsi, rax
lea rax, [rsp + 0x158]
mov qword [rsp + 0x20], rax
mov r9d, 0x108
mov r8d, 0
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140002ef0
mov rcx, rsi
call fcn.140005d5c
mov dword [rsp + 0x350], 0x40
lea rcx, [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edi, 0
test eax, eax
je 0x140002d8c
mov rdi, qword [rsp + 0x358]
shr rdi, 0x14
lea rcx, [rsp + 0x390]
call fcn.14000280d
mov rsi, rax
mov rbx, rax
test rax, rax
je 0x140002e7d
mov ecx, 0x800
call fcn.140004e20
mov rbx, rax
test rax, rax
je 0x140002e75
mov eax, dword [r12]
mov dword [rbx + 4], eax
mov eax, dword [r12 + 4]
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], 2
mov dword [rbx + 0x10], 1
mov dword [rbx + 0x14], r13d
lea rbp, [rsp + 0x5a0]
mov rcx, rbp
call sub.msvcrt.dll_strlen
lea rcx, [rbx + 0x2c]
mov r8d, eax
mov rdx, rbp
call fcn.14000159e
mov dword [rbx + 0x18], 0x2c
mov dword [rbx + 0x1c], eax
add eax, 3
and eax, 0xfffffffc
lea ebp, [rax + 0x2c]
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov ecx, ebp
add rcx, rbx
mov r8d, eax
mov rdx, rsi
call fcn.14000159e
mov dword [rbx + 0x20], ebp
mov dword [rbx + 0x24], eax
mov dword [rbx + 0x28], edi
add eax, 3
and eax, 0xfffffffc
lea edx, [rax + rbp]
mov dword [rsp + 0x148], edx
sub edx, 4
lea rcx, [rbx + 4]
mov r8d, 0
call fcn.1400021d0
mov dword [rbx], eax
cmp dword [rsp + 0x838], 0
jne 0x140003033
mov rax, qword [rsp + 0x840]
mov edx, dword [rsp + 0x148]
mov dword [rax], edx
mov rcx, rsi
call fcn.140004e72
mov rax, rbx
add rsp, 0x7d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x160]
mov edx, 0x50
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x140002eb7
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140002d16
lea rcx, [rsp + 0x160]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x140002eac
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x140002eac
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x5a0]
call sub.msvcrt.dll_strcpy
jmp 0x140002eac
lea rcx, [0x140018570]
call fcn.140005cd5
mov r14, rax
mov ebx, 0
mov rdi, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r15, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x140002f57
mov eax, dword [rsp + 0x148]
mov byte [rsp + rax + 0x390], 0
mov eax, dword [rsp + 0x148]
mov byte [rsp + rax + 0x391], 0
mov rcx, r14
call fcn.140005d5c
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002d56
add ebx, 1
mov dword [rsp + 0x14c], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x14c]
lea r8, [rsp + 0x5c0]
mov edx, ebx
mov rcx, qword [rsp + 0x158]
call rdi
test eax, eax
jne 0x140002f39
lea rdx, [rsp + 0x5c0]
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
mov r8d, 0
mov rcx, qword [rsp + 0x158]
call rbp
test eax, eax
jne 0x140002f54
mov dword [rsp + 0x148], 0x104
lea rax, [rsp + 0x148]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x390]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov rdx, r14
mov rcx, qword [rsp + 0x150]
call r15
test eax, eax
je 0x140002f1b
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002f54
mov rcx, qword [rsp + 0x830]
call sub.msvcrt.dll_strlen
mov r8, rax
lea rdi, [rsp + 0x40]
mov rdx, qword [rsp + 0x830]
mov rcx, rdi
call fcn.140005210
mov r9d, dword [rsp + 0x148]
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
call fcn.14000527c
jmp 0x140002e64