Function at 0x180007570
Capabilities:
Get memory capacity
Identify system language via api
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x3f]
sub rsp, 0xa8
xor edi, edi
cmp dword [0x1800d0678], 0xaf067be0
jne 0x180007739
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceInitialize]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
call qword [sym.imp.USER32.dll_GetFocus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowContextHelpId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapValidate]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800e6738]
call qword [sym.imp.USER32.dll_OemToCharBuffW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadMenuW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareFileTime]
mov qword [rsp + 0x38], rdi
lea rax, [0x1800e6758]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x1800e6778]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenDesktopW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessVersion]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassLongW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeConnect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommMask]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov dword [rbp + 0x6f], edi
mov dword [rbp + 0x67], edi
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1800e6718]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x180007a40
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x6f]
xor r8d, r8d
lea rdx, [0x1800e67b0]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180007870
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rax, 0x12a
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], 0x12a
mov eax, dword [rbp - 0x1d]
mov dword [rbp - 0x1d], eax
xor eax, eax
mov word [rbp - 0x19], ax
mov byte [rbp - 0x17], al
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], rdi
lea ecx, [rax + 0x10]
call fcn.18004cdc8
mov qword [rax + 8], rdi
mov qword [rbp - 0x11], rax
lea rcx, [rbp - 0x11]
mov qword [rax], rcx
mov word [rbp + 0x1f], di
mov qword [rbp + 0x25], rdi
mov qword [rbp + 0x2d], rdi
xor eax, eax
mov word [rbp + 0x22], ax
mov byte [rbp + 0x24], al
mov word [rbp + 0x25], ax
mov byte [rbp + 0x27], al
mov word [rbp + 0x28], ax
mov byte [rbp + 0x2a], al
mov word [rbp + 0x2b], ax
mov byte [rbp + 0x2d], al
mov word [rbp + 0x2e], ax
mov byte [rbp + 0x30], al
mov word [rbp + 0x31], ax
mov byte [rbp + 0x33], al
mov dword [rbp - 0x15], edi
mov dword [rbp + 0x1b], edi
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.18000ff80
nop
lea rcx, [rbp - 0x11]
call fcn.180011d40
mov rcx, qword [rbp - 0x11]
mov qword [rbp - 0x11], rdi
mov edx, 0x10
call fcn.18004ccdc
mov al, 1
add rsp, 0xa8
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r8d, 0xffff34b5
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180007880
mov esi, 0x1f143
mov ebx, 0xffff9796
sub ebx, r8d
add r8d, 0x4f79
mov ecx, 0xffffe7a7
nop dword [rax]
nop word [rax + rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x1800078c0
mov r9d, 0x1a64
sub r9d, r8d
sub r9d, ecx
lea r11d, [rcx*2 - 0x261a]
lea r10d, [r8 + r11]
lea edx, [rbx - 0x2b294]
mov eax, edx
sub eax, r9d
add eax, 0x17ea
lea r8d, [rdx + rcx]
add r11d, eax
lea r9d, [r9*2 - 0xc24]
add r11d, r8d
lea edx, [r10 - 0x2552]
lea ebx, [rsi + r9]
mov r10d, edx
sub r10d, r11d
add r10d, r8d
lea r8d, [r10 + rdx]
add r8d, r9d
lea eax, [rdx + r11]
cmp eax, 0xfff962ec
jne 0x180007a4e
cmp r10d, 0x24534
jne 0x180007a4e
cmp ebx, 0x34235
jne 0x180007a4e
cmp r11d, 0xfffa5ad6
jne 0x180007a4e
cmp r8d, 0x29e3c
jne 0x180007a4e
cmp ecx, 0xffffe7a9
jne 0x180007a4e
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rax, 0x123
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], 0x123
mov eax, dword [rbp - 0x1d]
mov dword [rbp - 0x1d], eax
xor eax, eax
mov word [rbp - 0x19], ax
mov byte [rbp - 0x17], al
mov qword [rbp - 0x11], rdi
mov qword [rbp - 9], rdi
mov qword [rbp - 1], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], rdi
lea ecx, [rax + 0x10]
call fcn.18004cdc8
mov qword [rax + 8], rdi
mov qword [rbp - 0x11], rax
lea rcx, [rbp - 0x11]
mov qword [rax], rcx
mov word [rbp + 0x1f], di
mov qword [rbp + 0x25], rdi
mov qword [rbp + 0x2d], rdi
xor eax, eax
mov word [rbp + 0x22], ax
mov byte [rbp + 0x24], al
mov word [rbp + 0x25], ax
mov byte [rbp + 0x27], al
mov word [rbp + 0x28], ax
mov byte [rbp + 0x2a], al
mov word [rbp + 0x2b], ax
mov byte [rbp + 0x2d], al
mov word [rbp + 0x2e], ax
mov byte [rbp + 0x30], al
mov word [rbp + 0x31], ax
mov byte [rbp + 0x33], al
mov dword [rbp - 0x15], edi
mov dword [rbp + 0x1b], edi
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.18000ff80
nop
lea rcx, [rbp - 0x11]
call fcn.180011d40
mov rcx, qword [rbp - 0x11]
mov qword [rbp - 0x11], rdi
mov edx, 0x10
call fcn.18004ccdc
xor al, al
add rsp, 0xa8
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]