Function at 0x646c6c50
Capabilities:
Get hostname
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0xa8
mov dword [ebp - 0x80], 0x248
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x646cf018], 8
jne 0x646c6e30
test esi, esi
je 0x646c6e64
lea edi, [ebp - 0x7c]
xor ecx, ecx
xor edx, edx
xor eax, eax
mov dword [esp], edi
call fcn.646c51b0
cmp eax, 0x6f
mov eax, dword [ebp - 0x80]
jne 0x646c6caa
add eax, dword [ebp - 0x7c]
sub eax, 0x28
mov dword [ebp - 0x80], eax
test ebx, ebx
je 0x646c6e18
cmp dword [esi], eax
jb 0x646c6e18
mov dword [esi], eax
lea esi, [ebp - 0x80]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.ucrtbase.dll_memset
mov edx, dword [sym.imp.kernel32.dll_GetComputerNameExA]
mov dword [ebp - 0x80], 0x84
mov dword [esp + 8], esi
mov dword [ebp - 0x8c], edx
mov dword [esp + 4], ebx
mov dword [esp], 1
call edx
lea eax, [ebx + 0x84]
mov edx, dword [ebp - 0x8c]
mov dword [ebp - 0x80], 0x84
sub esp, 0xc
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 2
call edx
lea edx, [ebx + 0x10c]
lea ecx, [ebx + 0x248]
xor eax, eax
sub esp, 0xc
mov dword [ebp - 0x8c], edx
mov dword [esp], edi
call fcn.646c51b0
mov edx, dword [ebp - 0x8c]
mov dword [ebx + 0x134], 8
mov edi, dword [sym.imp.advapi32.dll_RegOpenKeyExA]
mov dword [ebx + 0x108], edx
lea edx, [ebp - 0x78]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetServicesVxDMSTCP
mov dword [esp], 0x80000002
call edi
lea edx, [ebp - 0x78]
sub esp, 0x14
test eax, eax
jne 0x646c6e90
lea eax, [ebx + 0x138]
mov dword [ebp - 0x80], 0x104
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x78]
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ScopeID
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x78]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
lea eax, [ebp - 0x74]
mov dword [esp + 4], 2
mov dword [esp], eax
call sym.iphlpapi.dll_GetIpStatisticsEx
sub esp, 8
test eax, eax
jne 0x646c6e80
xor edx, edx
cmp dword [ebp - 0x74], 1
sete dl
mov dword [ebx + 0x23c], edx
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esi], eax
lea esp, [ebp - 0x10]
mov eax, 0x6f
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.info__p__size__p_n
mov dword [esp + 8], str.GetNetworkParams
mov dword [esp + 4], 0x646cf018
mov dword [esp], 3
call fcn.646c3090
test esi, esi
jne 0x646c6c88
lea esp, [ebp - 0x10]
mov eax, 0x57
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetServicesNetBTParameters
mov dword [esp], 0x80000002
call edi
sub esp, 0x14
test eax, eax
jne 0x646c6dda
jmp 0x646c6d8f