Function at 0x14004fd00
Capabilities:
Get memory capacity
Query or enumerate registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x7b0
mov rax, qword [0x14042d950]
xor rax, rsp
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_1952], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x421]
lea r8d, [rdx + 0x7f]
mov byte [rsp + Ordinal_1062], 0
call sub.ntdll.dll_memset
xor edx, edx
lea rcx, [rsp + 0x3a1]
lea r8d, [rdx + 0x7f]
mov byte [rsp + 0x3a0], 0
call sub.ntdll.dll_memset
xor eax, eax
lea rcx, [rsp + 0x4a1]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0xb0], 0
mov dword [rsp + 0xb1], eax
mov word [rsp + 0xb5], ax
mov byte [rsp + 0xb7], al
mov byte [rsp + Ordinal_1189], al
call sub.ntdll.dll_memset
xor eax, eax
lea rcx, [rsp + 0x5a1]
xor edx, edx
mov r8d, Ordinal_512
mov byte [rsp + 0xb8], 0
mov qword [rsp + 0xb9], rax
mov qword [rsp + 0xc1], rax
mov qword [rsp + 0xc9], rax
mov dword [rsp + 0xd1], eax
mov word [rsp + 0xd5], ax
mov byte [rsp + 0xd7], al
mov byte [rsp + 0x58], al
mov word [rsp + 0x59], ax
mov byte [rsp + 0x5b], al
mov byte [rsp + 0x160], al
mov qword [rsp + 0x161], rax
mov qword [rsp + 0x169], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_369], rax
mov qword [rsp + 0x179], rax
mov qword [rsp + 0x181], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_393], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_401], rax
mov dword [rsp + 0x199], eax
mov word [rsp + 0x19d], ax
mov byte [rsp + 0x19f], al
mov byte [rsp + 0xe0], al
mov qword [rsp + 0xe1], rax
mov qword [rsp + 0xe9], rax
mov qword [rsp + 0xf1], rax
mov qword [rsp + 0xf9], rax
mov qword [rsp + 0x101], rax
mov qword [rsp + reloc.MFC80U.DLL_Ordinal_265], rax
mov qword [rsp + 0x111], rax
mov dword [rsp + 0x119], eax
mov word [rsp + reloc.MFC80U.DLL_Ordinal_285], ax
mov byte [rsp + 0x11f], al
mov byte [rsp + 0x120], al
mov qword [rsp + 0x121], rax
mov qword [rsp + 0x129], rax
mov qword [rsp + 0x131], rax
mov qword [rsp + 0x139], rax
mov qword [rsp + 0x141], rax
mov qword [rsp + 0x149], rax
mov qword [rsp + 0x151], rax
mov dword [rsp + 0x159], eax
mov word [rsp + 0x15d], ax
mov byte [rsp + 0x15f], al
mov byte [rsp + 0x5a0], al
call sub.ntdll.dll_memset
lea rdx, [rsp + 0x5a0]
mov r8d, reloc.MFC80U.DLL_Ordinal_512
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x50]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
xor esi, esi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140050502
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x420]
lea rdx, str.ProductName
xor r8d, r8d
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x44], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x48]
lea rdx, str.CSDVersion
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3a0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 0x80
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
lea rdx, [0x1402e0e30]
xor r8d, r8d
mov dword [rsp + 0x44], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4a0]
lea r9, [rsp + 0x48]
lea rdx, str.SystemRoot
xor r8d, r8d
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x50]
lea rdx, str.SystemCurrentControlSetControlSession_ManagerEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140050502
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb8]
lea rdx, str.PROCESSOR_ARCHITECTURE
xor r8d, r8d
mov qword [rsp + 0x7c8], rdi
mov dword [rsp + 0x44], 0x20
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x48]
lea rdx, str.NUMBER_OF_PROCESSORS
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x44], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [rsp + 0x6c]
movzx ecx, word [rsp + 0x68]
movzx eax, word [rsp + 0x6a]
movzx edi, word [rsp + 0x66]
movzx r9d, word [rsp + 0x62]
movzx r8d, word [rsp + 0x60]
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rdx, str._d__d__d__d:_d:_d
lea rcx, [rsp + 0x160]
mov dword [rsp + 0x20], edi
call qword [sym.imp.ntdll.dll_sprintf]
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov r8, qword [rsp + 0x78]
lea rdx, str.Total_Memory:__d_MB
lea rcx, [rsp + 0xe0]
shr r8, 0x14
call qword [sym.imp.ntdll.dll_sprintf]
mov r8, qword [rsp + 0x80]
lea rdx, str.Available_Memory:__d_MB
lea rcx, [rsp + 0x120]
shr r8, 0x14
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, str._System_Information__r_n
lea r9, [rsp + 0x40]
lea rdx, str._System_Information__r_n
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea rcx, [rsp + 0x1a1]
xor edx, edx
mov r8d, Ordinal_512
mov byte [rsp + 0x1a0], sil
call sub.ntdll.dll_memset
lea r8, [rsp + 0x5a0]
lea rdx, str.Module_Path:__s_r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1a0]
xor eax, eax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0x420]
lea rdx, str.Product_Name:__s_r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1a0]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x1a0]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0x3a0]
lea rdx, str.Service_Package:__s_r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1a0]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x1a0]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0xb0]
lea rdx, str.OS_Version:__s_r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1a0]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x1a0]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0xe0]
lea rdx, [0x1402e0cac]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1a0]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x1a0]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0x120]
lea rdx, [0x1402e0cac]
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1a0]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x1a0]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0x4a0]
lea rdx, str.System_Root:__s_r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntdll.dll_sprintf]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1a0]
lea r9, [rsp + 0x40]
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x1a0]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0xb8]
lea rdx, str.Processor_Architecture:__s_r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1a0]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x1a0]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0x58]
lea rdx, str.Processor_Number:__s_r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1a0]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x1a0]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r8, [rsp + 0x160]
lea rdx, str.Current_Time:__s_r_n
lea rcx, [rsp + 0x1a0]
call qword [sym.imp.ntdll.dll_sprintf]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x1a0]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x1a0]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1402e0c00]
lea r9, [rsp + 0x40]
lea rdx, [0x1402e0c00]
repne scasb al, byte [rdi]
mov qword [rsp + 0x20], rsi
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdi, qword [rsp + 0x7c8]
mov rcx, qword [rsp + reloc.MFC80U.DLL_Ordinal_1952]
xor rcx, rsp
call fcn.140161080
mov rbx, qword [rsp + 0x7d0]
add rsp, 0x7b0
pop rsi
ret