Function at 0x1400701b0
Capabilities:
Get hostname
Get memory capacity
Get session user name
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xb30
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov rax, qword [0x140198190]
xor rax, rsp
mov qword [rsp + 0xb00], rax
mov r15, rcx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
cmp qword [0x14019afb0], rbx
jne 0x140070d8b
mov dword [rsp + 0x48], 0x100
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x6f0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov dword [rsp + 0x4c], 0x100
lea rdx, [rsp + 0x4c]
lea rcx, [rsp + 0x8f0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov dword [rsp + 0x34], ntohl
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x14017a930]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x270], xmm0
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x288], rbx
lea rax, [rsp + 0x2d0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x1400702d0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x270]
call fcn.1400099b0
nop
mov dword [rsp + 0x54], ntohl
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], 0x104
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
lea rdx, str.CurrentBuild
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x250], xmm0
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x268], rbx
lea rax, [rsp + 0x4e0]
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140070383
lea rdx, [rsp + 0x4e0]
lea rcx, [rsp + 0x250]
call fcn.1400099b0
nop
mov dword [rsp + 0x30], ntohl
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x34], 0x104
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
mov qword [rsp + 0x240], rbx
mov qword [rsp + 0x248], rbx
lea rax, [rsp + 0x2d0]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140070434
mov r8, rdi
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x230]
call fcn.1400099b0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x210], xmm0
movdqa xmm1, xmmword [0x14017cee0]
movdqu xmmword [rsp + 0x220], xmm1
mov byte [rsp + 0x210], 0
movups xmmword [rsp + 0x190], xmm0
movdqu xmmword [rsp + 0x1a0], xmm1
mov byte [rsp + 0x190], 0
lea rcx, [rsp + 0x190]
call fcn.140072ff0
movups xmm6, xmmword [rsp + 0x190]
movups xmmword [rsp + 0x1b0], xmm6
movups xmm7, xmmword [rsp + 0x1a0]
movups xmmword [rsp + 0x1c0], xmm7
movdqa xmm0, xmmword [0x14017cee0]
movdqu xmmword [rsp + 0x1a0], xmm0
mov byte [rsp + 0x190], 0
lea rcx, [rsp + 0x190]
call fcn.140008ae0
nop
lea rdx, [rsp + 0x1b0]
movq rcx, xmm6
movdqa xmm0, xmm7
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, rcx
movq r8, xmm7
lea rcx, [rsp + 0x210]
call fcn.140008e10
nop
lea rcx, [rsp + 0x1b0]
call fcn.140008ae0
nop
jmp 0x140070535
xorps xmm0, xmm0
movups xmmword [rsp + 0x1f0], xmm0
movdqa xmm1, xmmword [0x14017cee0]
movdqu xmmword [rsp + 0x200], xmm1
mov byte [rsp + 0x1f0], 0
movups xmmword [rsp + 0x190], xmm0
movdqu xmmword [rsp + 0x1a0], xmm1
mov byte [rsp + 0x190], 0
lea rcx, [rsp + 0x190]
call fcn.140072a10
movups xmm6, xmmword [rsp + 0x190]
movups xmmword [rsp + 0x1b0], xmm6
movups xmm7, xmmword [rsp + 0x1a0]
movups xmmword [rsp + 0x1c0], xmm7
movdqa xmm0, xmmword [0x14017cee0]
movdqu xmmword [rsp + 0x1a0], xmm0
mov byte [rsp + 0x190], 0
lea rcx, [rsp + 0x190]
call fcn.140008ae0
nop
lea rdx, [rsp + 0x1b0]
movq rcx, xmm6
movdqa xmm0, xmm7
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, rcx
movq r8, xmm7
lea rcx, [rsp + 0x1f0]
call fcn.140008e10
nop
lea rcx, [rsp + 0x1b0]
call fcn.140008ae0
nop
jmp 0x140070613
lea rcx, [rsp + 0x90]
call fcn.1400070a0
nop
lea rcx, [rsp + 0x2d0]
call fcn.140007ca0
nop
mov dword [rsp + 0x290], 0x40
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdx, qword [rsp + 0x298]
shr rdx, 0x14
lea rcx, [rsp + 0x2e0]
call fcn.140071d80
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x2e8]
call fcn.140008910
nop
lea rcx, [rsp + 0x2d0]
call fcn.1400039a0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea r10, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r10, qword [rsp + 0x60]
add r10, qword [rsp + 0x70]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1a0], xmm1
cmp rdx, r10
jne 0x1400706e9
movdqa xmm0, xmmword [0x14017ced0]
movdqu xmmword [rsp + 0x1a0], xmm0
mov word [rsp + 0x190], bx
jmp 0x140070700
mov r9, r10
sub r9, rdx
mov r8, r10
lea rcx, [rsp + 0x190]
call fcn.14004f180
nop
lea rcx, [rsp + 0x60]
call fcn.140008ae0
nop
lea rdx, [rsp + 0x6f0]
lea rcx, [rsp + 0xa0]
call fcn.140009320
mov rcx, rax
lea rdx, [0x140179ab4]
call fcn.140009320
mov rcx, rax
lea rdx, [rsp + 0x8f0]
call fcn.140009320
mov rcx, rax
lea rdx, [0x140179ab4]
call fcn.140009320
lea rdx, [rsp + 0x270]
cmp qword [rsp + 0x288], 8
cmovae rdx, qword [rsp + 0x270]
mov r8, qword [rsp + 0x280]
mov rcx, rax
call fcn.14000a580
lea rdx, [0x140179ab4]
mov rcx, rax
call fcn.140009320
lea rdx, [rsp + 0x250]
cmp qword [rsp + 0x268], 8
cmovae rdx, qword [rsp + 0x250]
mov r8, qword [rsp + 0x260]
mov rcx, rax
call fcn.14000a580
lea rdx, [0x140179ab4]
mov rcx, rax
call fcn.140009320
mov rdi, rax
lea r10, [rsp + 0x210]
cmp qword [rsp + 0x228], 0x10
cmovae r10, qword [rsp + 0x210]
add r10, qword [rsp + 0x220]
lea rdx, [rsp + 0x210]
cmp qword [rsp + 0x228], 0x10
cmovae rdx, qword [rsp + 0x210]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1c0], xmm1
cmp rdx, r10
jne 0x140070836
movdqa xmm0, xmmword [0x14017ced0]
movdqu xmmword [rsp + 0x1c0], xmm0
mov word [rsp + 0x1b0], bx
jmp 0x14007084d
mov r9, r10
sub r9, rdx
mov r8, r10
lea rcx, [rsp + 0x1b0]
call fcn.14004f180
nop
lea rdx, [rsp + 0x1b0]
cmp qword [rsp + 0x1c8], 8
cmovae rdx, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x1c0]
mov rcx, rdi
call fcn.14000a580
lea rdx, [0x140179ab4]
mov rcx, rax
call fcn.140009320
mov rdi, rax
lea r10, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 0x10
cmovae r10, qword [rsp + 0x1f0]
add r10, qword [rsp + 0x200]
lea rdx, [rsp + 0x1f0]
cmp qword [rsp + 0x208], 0x10
cmovae rdx, qword [rsp + 0x1f0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x1e0], xmm1
cmp rdx, r10
jne 0x1400708fc
movdqa xmm0, xmmword [0x14017ced0]
movdqu xmmword [rsp + 0x1e0], xmm0
mov word [rsp + 0x1d0], bx
jmp 0x140070913
mov r9, r10
sub r9, rdx
mov r8, r10
lea rcx, [rsp + 0x1d0]
call fcn.14004f180
nop
lea rdx, [rsp + 0x1d0]
cmp qword [rsp + 0x1e8], 8
cmovae rdx, qword [rsp + 0x1d0]
mov r8, qword [rsp + 0x1e0]
mov rcx, rdi
call fcn.14000a580
lea rdx, [0x140179ab4]
mov rcx, rax
call fcn.140009320
lea rdx, [rsp + 0x230]
cmp qword [rsp + 0x248], 8
cmovae rdx, qword [rsp + 0x230]
mov r8, qword [rsp + 0x240]
mov rcx, rax
call fcn.14000a580
lea rdx, [0x140179ab4]
mov rcx, rax
call fcn.140009320
lea rdx, [rsp + 0x190]
cmp qword [rsp + 0x1a8], 8
cmovae rdx, qword [rsp + 0x190]
mov r8, qword [rsp + 0x1a0]
mov rcx, rax
call fcn.14000a580
nop
mov rdx, qword [rsp + 0x1e8]
cmp rdx, 8
jb 0x1400709f8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400709f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070dd3
call fcn.14010f640
movdqa xmm0, xmmword [0x14017ced0]
movdqu xmmword [rsp + 0x1e0], xmm0
mov word [rsp + 0x1d0], bx
mov rdx, qword [rsp + 0x1c8]
cmp rdx, 8
jb 0x140070a59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070a54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070dd9
call fcn.14010f640
movdqa xmm0, xmmword [0x14017ced0]
movdqu xmmword [rsp + 0x1c0], xmm0
mov word [rsp + 0x1b0], bx
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 8
jb 0x140070aba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070ab5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070ddf
call fcn.14010f640
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0xa8]
call fcn.140008770
lea rdx, [rsp + 0x190]
lea r14, [0x14019afa0]
mov rcx, r14
call fcn.14004b590
lea rcx, [rsp + 0x190]
call fcn.1400089c0
mov rax, qword [0x14019afb0]
cmp qword [reloc.WS2_32.dll_getsockopt], 8
jb 0x140070b15
mov rcx, qword [0x14019afa0]
lea rsi, [rcx + rax*2]
lea rdi, [rcx + rax*2]
jmp 0x140070b20
lea rdi, [r14 + rax*2]
lea rsi, [r14 + rax*2]
mov rcx, r14
mov r8d, Ordinal_41
mov rdx, rsi
call fcn.1400f08f0
mov rdx, rax
cmp rax, rsi
je 0x140070b59
add rax, 2
cmp rax, rsi
je 0x140070b59
nop
movzx ecx, word [rax]
cmp cx, 0x26
je 0x140070b50
mov word [rdx], cx
add rdx, 2
add rax, 2
cmp rax, rsi
jne 0x140070b40
sub rdi, rdx
sar rdi, 1
mov rsi, qword [0x14019afb0]
mov rax, rsi
cmp qword [reloc.WS2_32.dll_getsockopt], 8
jb 0x140070b7f
mov rcx, qword [0x14019afa0]
sub rdx, rcx
jmp 0x140070b85
sub rdx, r14
mov rcx, r14
sar rdx, 1
sub rax, rdx
cmp rax, rdi
cmovb rdi, rax
lea rcx, [rcx + rdx*2]
sub rsi, rdi
mov r8, rsi
sub r8, rdx
lea r8, [r8*2 + 2]
lea rdx, [rcx + rdi*2]
call fcn.140111970
mov qword [0x14019afb0], rsi
lea rcx, [rsp + 0x90]
call fcn.140003d50
nop
mov rdx, qword [rsp + 0x208]
cmp rdx, 0x10
jb 0x140070c08
inc rdx
mov rcx, qword [rsp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070c03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070de5
call fcn.14010f640
movdqa xmm0, xmmword [0x14017cee0]
movdqu xmmword [rsp + 0x200], xmm0
mov byte [rsp + 0x1f0], 0
mov rdx, qword [rsp + 0x228]
cmp rdx, 0x10
jb 0x140070c64
inc rdx
mov rcx, qword [rsp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070c5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070deb
call fcn.14010f640
movdqa xmm0, xmmword [0x14017cee0]
movdqu xmmword [rsp + 0x220], xmm0
mov byte [rsp + 0x210], 0
mov rdx, qword [rsp + 0x248]
cmp rdx, 8
jb 0x140070cc5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070cc0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070df1
call fcn.14010f640
mov qword [rsp + 0x240], rbx
mov qword [rsp + 0x248], 7
mov word [rsp + 0x230], bx
mov rdx, qword [rsp + 0x268]
cmp rdx, 8
jb 0x140070d29
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070d24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070df7
call fcn.14010f640
mov qword [rsp + 0x260], rbx
mov qword [rsp + 0x268], 7
mov word [rsp + 0x250], bx
mov rdx, qword [rsp + 0x288]
cmp rdx, 8
jb 0x140070d92
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140070d84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140070dfd
call fcn.14010f640
jmp 0x140070d92
lea r14, [0x14019afa0]
mov rdx, r14
mov rcx, r15
call fcn.140007f90
mov rax, r15
mov rcx, qword [rsp + 0xb00]
xor rcx, rsp
call fcn.14010f620
lea r11, [rsp + 0xb30]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.140118cb4
nop
call fcn.140118cb4
nop
call fcn.140118cb4
nop
call fcn.140118cb4
nop
call fcn.140118cb4
nop
call fcn.140118cb4
nop
call fcn.140118cb4
nop
call fcn.140118cb4
int3