Function at 0x180002960
Capabilities:
Create pipe
Get common file path
Get disk size
Get hostname
Get system information on windows
Print debug messages
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
lea rbp, [rsp - 0xc8]
sub rsp, 0x1c8
lea rax, str.SoftwareHaye_CosqNoqotApp
mov dword [rbp - 0x58], 0x1ae
mov qword [rbp - 0x78], rax
lea r9, [rbp + 0xf0]
lea rax, [rsp + 0x60]
mov dword [rbp + 0xf8], 4
mov qword [rbp - 0x80], rax
lea r8, [rbp - 0x78]
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rdx, [rsp + 0x50]
add rax, 0x1ae
mov dword [rbp + 0xe0], 0x20019
mov qword [rbp - 0x60], rax
lea rcx, [rsp + 0x70]
movaps xmm0, xmmword [rbp - 0x60]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
xor edi, edi
lea rax, [rbp + 0xe0]
mov dword [rbp + 0xe8], edi
mov qword [rsp + 0x20], rax
mov dword [rbp + 0xf0], edi
mov qword [rsp + 0x50], 0xffffffff80000001
movdqa xmmword [rsp + 0x70], xmm0
call fcn.18000be90
test eax, eax
jne 0x180002bc0
mov rcx, qword [rsp + 0x60]
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x28], rax
lea rdx, str.LastLoox
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x1c0], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x60]
add rcx, 0x18a
mov dword [rsp + 0x58], 0x18a
mov qword [rsp + 0x50], rcx
mov ebx, eax
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
call fcn.18000c100
test ebx, ebx
mov rbx, qword [rsp + 0x1c0]
jne 0x180002bb1
cmp dword [0x1800d6574], 0x839f3075
jne 0x180002ba1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
lock add dword [rdi], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x48], rdi
xor r9d, r9d
mov qword [rsp + 0x40], rdi
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rdi
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindAtomW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerClearRequest]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindAtomW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
mov eax, dword [rbp + 0xe8]
add rsp, 0x1c8
pop rdi
pop rbp
ret
lea rcx, str.Value_does_not_exist_or_error_reading_value.
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x180002bef
mov rax, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea rcx, [rsp + 0x70]
add rax, 0x285
mov dword [rsp + 0x58], 0x285
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm0
call fcn.18000c330
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x70]
lea rdx, [rbp - 0x60]
lea rcx, [0x180076f58]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x180002c29
mov r9, qword [rbp - 0x70]
lea r8, str.Total_disk_space_on_C:_is__lu_MB.
shr r9, 0x14
lea rcx, [rbp - 0x40]
mov edx, 0x100
call fcn.1800010f0
xor eax, eax
add rsp, 0x1c8
pop rdi
pop rbp
ret