Function at 0x70dffc0d
Capabilities:
Check os version
Get common file path
Get hostname
Get memory capacity
Query or enumerate registry value

Disassembly:
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x70dff86a
sub eax, edx
sar eax, 1
mov dword [ebp - 0xe67], eax
push ebx
lea eax, [ebp - 0xd94]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
mov ebx, dword [ebp - 0xdcc]
test eax, eax
je 0x70dff8ef
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
test byte [ebp - 0xc50], 1
jne 0x70dff9aa
mov esi, dword [ebp - 0xdac]
push 0x348
lea edx, [ebp - 0xd94]
push 0
inc esi
push edx
mov dword [ebp - 0xdac], esi
call fcn.70df8b33
add esp, 0xc
push 0
lea eax, [ebp - 0xd94]
push eax
push esi
push 0
mov dword [ebp - 0xd94], 0x348
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
jne 0x70dff89f
xor ecx, ecx
mov eax, ebx
mov edx, 0xc
mul edx
seto cl
mov dword [ebp - 0xe6f], ebx
neg ecx
or ecx, eax
push ecx
call fcn.70df39ac
xor edx, edx
add esp, 4
mov dword [ebp - 0xe6b], eax
cmp dword [ebp - 0xe6f], edx
jle 0x70dff95c
xor eax, eax
mov ecx, dword [ebp - 0xdd4]
mov esi, dword [ecx + eax]
mov edi, dword [ebp - 0xe6b]
mov dword [eax + edi], esi
mov esi, dword [eax + ecx + 4]
mov edi, dword [ebp - 0xe6b]
mov dword [eax + edi + 4], esi
mov ecx, dword [ecx + eax + 8]
mov esi, dword [ebp - 0xe6b]
mov dword [eax + esi + 8], ecx
inc edx
add eax, 0xc
cmp edx, dword [ebp - 0xe6f]
jl 0x70dff922
lea edx, [ebp - 0xdac]
push edx
lea eax, [ebp - 0xf24]
push eax
push 0x82
mov eax, 0x70e82b20
mov dword [ebp - 0xdac], 0x70df9424
call fcn.70dff40a
mov ecx, dword [ebp - 0xe34]
push eax
mov dword [ecx], eax
call fcn.70dff511
mov edx, dword [ebp - 0xe38]
mov dword [edx], eax
mov dword [ebp - 0xdc8], 0
xor ebx, ebx
jmp 0x70e00028
push 0
push 0
lea ecx, [ebp - 0xd90]
push ecx
push 0x70dffa30
call dword [sym.imp.GDI32.dll_CreateDCW]
mov esi, eax
push 8
push esi
call edi
push 0xa
push esi
mov dword [ebp - 0xda8], eax
call edi
push 0xc
push esi
mov dword [ebp - 0xda4], eax
call edi
push esi
mov dword [ebp - 0xda0], eax
call dword [sym.imp.GDI32.dll_DeleteDC]
lea eax, [ebx + 1]
cmp eax, dword [ebp - 0xdd0]
jge 0x70e04aa9
mov ecx, dword [ebp - 0xda8]
mov eax, ebx
lea edx, [eax + eax*2]
mov eax, dword [ebp - 0xdd4]
lea eax, [eax + edx*4]
mov edx, dword [ebp - 0xda4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xda0]
inc ebx
mov dword [eax + 4], edx
mov dword [ebp - 0xdcc], ebx
mov dword [eax + 8], ecx
jmp 0x70dff8ac
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x70e6f8f7
mov eax, dword fs:[0]
push eax
sub esp, 0xf20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0xd9c], eax
mov dword [ebp - 0xe34], ecx
mov dword [ebp - 0xe38], esi
mov dword [ebp - 0xdc8], 0x80004005
cmp eax, ebx
je 0x70e00040
cmp esi, ebx
je 0x70e00040
cmp ecx, ebx
je 0x70e00040
push 0xe5
lea eax, [ebp - 0xf24]
push ebx
push eax
call fcn.70df8b33
add esp, 0xc
push 0x11c
lea ecx, [ebp - 0xa4c]
push ebx
push ecx
mov dword [esi], ebx
call fcn.70df8b33
add esp, 0xc
mov dword [ebp - 0xa4c], 0x11c
mov dword [ebp - 0xdac], ebx
mov dword [ebp - 0xdd8], 0x70e00910
mov dword [ebp - 0xdd4], ebx
mov dword [ebp - 4], ebx
push 1
lea esi, [ebp - 0xdd8]
mov dword [ebp - 0xdd0], ebx
mov dword [ebp - 0xdcc], ebx
call fcn.70dff178
push 0x348
lea edx, [ebp - 0xd94]
push ebx
push edx
mov dword [ebp - 4], 1
call fcn.70df8b33
mov esi, 0x70df59dc
add esp, 0xc
mov dword [ebp - 0xd94], 0x348
mov dword [ebp - 0xe08], esi
mov dword [ebp - 0xe04], ebx
mov dword [ebp - 0xe00], ebx
push 0xb
lea edi, [ebp - 0xe08]
mov byte [ebp - 4], 2
call fcn.70df5183
mov dword [ebp - 0xe30], esi
mov dword [ebp - 0xe2c], ebx
mov dword [ebp - 0xe28], ebx
push 0x104
lea edi, [ebp - 0xe30]
mov byte [ebp - 4], 4
call fcn.70df5183
push 0x40
lea eax, [ebp - 0x87c]
push ebx
push eax
mov byte [ebp - 4], 5
call fcn.70df8b33
add esp, 0xc
lea ecx, [ebp - 0xde8]
mov dword [ebp - 0x87c], 0x40
call fcn.70df39c7
lea ecx, [ebp - 0xdf0]
mov byte [ebp - 4], 6
call fcn.70df39c7
lea ecx, [ebp - 0xde0]
mov byte [ebp - 4], 7
call fcn.70df39c7
lea ecx, [ebp - 0xe10]
mov byte [ebp - 4], 8
call fcn.70df39c7
lea ecx, [ebp - 0xe57]
push ecx
mov byte [ebp - 4], 9
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
mov dword [ebp - 0xe1c], eax
lea edx, [ebp - 0xe1c]
push edx
mov dword [ebp - 0xe18], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0xe1c]
mov ecx, dword [ebp - 0xe18]
mov dword [ebp - 0xe4f], eax
xor eax, eax
lea edx, [ebp - 0xe24]
push edx
mov dword [ebp - 0xe4b], ecx
mov dword [ebp - 0xe24], eax
mov dword [ebp - 0xe20], eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov eax, dword [ebp - 0xe24]
mov ecx, dword [ebp - 0xe20]
mov dword [ebp - 0xe47], eax
lea edx, [ebp - 0xef0]
push edx
mov edx, dword [ebp - 0xd9c]
mov dword [ebp - 0xe43], ecx
lea eax, [ebp - 0xef8]
push eax
lea ecx, [ebp - 0xefc]
push ecx
push edx
lea eax, [ebp - 0xf04]
lea ecx, [ebp - 0xf00]
call fcn.70dffba5
push 4
mov dword [ebp - 0xdb4], ebx
call fcn.70df39ac
add esp, 4
cmp eax, ebx
je 0x70e00017
mov dword [eax], 1
mov dword [ebp - 0xdb0], eax
lea eax, [ebp - 0xdb4]
push eax
mov edi, 0x70dffed8
mov byte [ebp - 4], 0xa
call fcn.70df3e38
lea ecx, [ebp - 0xda4]
push ecx
lea edi, [ebp - 0xdb4]
mov byte [ebp - 4], 0xb
call fcn.70df4c1b
push 0x70dfff10
lea edx, [ebp - 0xdbc]
push edx
lea ecx, [ebp - 0xda4]
mov byte [ebp - 4], 0xc
call fcn.70e001ec
mov eax, dword [ebp - 0xdb8]
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push eax
call esi
jmp 0x70e049c9
mov ecx, dword [ebp - 0xda4]
add ecx, 4
push 0x70e7f770
call fcn.70e003da
mov edi, eax
mov dword [ebp - 0xdb8], edi
push edi
lea edx, [ebp - 0xd98]
mov ecx, 0x70dfffa0
mov byte [ebp - 4], 0xd
call fcn.70dff21e
mov eax, dword [ebp - 0xd98]
mov dword [ebp - 0xef4], eax
mov byte [ebp - 4], 0xc
cmp edi, ebx
je 0x70dfff8b
push edi
call fcn.70df62ac
push edi
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xda0]
push ecx
call esi
jmp 0x70e00022
mov edx, dword [ebp - 0xda0]
push edx
call fcn.70df3455
mov eax, dword [ebp - 0xda4]
add esp, 4
push eax
call fcn.70df3455
add esp, 4
lea ecx, [ebp - 0xa4c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
setne al
test al, al
je 0x70e007f3
mov eax, dword [ebp - 0xa44]
mov edx, dword [ebp - 0xa48]
mov ecx, dword [ebp - 0xa40]
mov dword [ebp - 0xebb], eax
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xebf], edx
mov dword [ebp - 0xeb7], ecx
mov dword [ebp - 0xeab], eax
lea esi, [eax + 2]
jmp 0x70e0004a
mov dword [ebp - 0xdb0], ebx
jmp 0x70dffe7b
test eax, eax
je 0x70dfffaa
jmp 0x70dfffc8
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x70e007f3
test eax, eax
je 0x70e00845
jmp 0x70e00863
mov eax, 0x80004005
jmp 0x70e008af
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x70e0004a
movzx ecx, byte [ebp - 0x932]
sub eax, esi
sar eax, 1
mov dword [ebp - 0xeaf], eax
mov dword [ebp - 0xea7], ecx
cmp edx, 6
jb 0x70e000ad
push 0x70e0018c
push 0x70dff55c
mov dword [ebp - 0xd98], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0xa48]
lea edx, [ebp - 0xd98]
push edx
push ebx
push ebx
push ebx
push ecx
call eax
mov edx, dword [ebp - 0xd98]
mov dword [ebp - 0xeb3], edx
mov ecx, dword [ebp - 0xdb4]
add ecx, 4
push 0x70e7f770
call fcn.70e003da
mov edi, eax
mov dword [ebp - 0xdb8], edi
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 0xe
mov eax, dword [edi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x70e0019c
push eax
call esi
test eax, eax
jne 0x70e000f5
push 0x70e0019c
push edi
lea ecx, [ebp - 0xde0]
call fcn.70dffa58
mov eax, dword [ebp - 0xde0]
push ebx
push ebx
lea ecx, [eax + 4]
push ebx
mov dword [ebp - 0xf10], ecx
mov edx, dword [eax]
push ebx
mov dword [ebp - 0xf14], edx
mov eax, dword [edi]
push 0x70e001c0
push eax
call esi
test eax, eax
jne 0x70e0012f
push 0x70e001c0
push edi
lea ecx, [ebp - 0xe10]
call fcn.70dffa58
mov eax, dword [ebp - 0xe10]
lea ecx, [eax + 4]
mov dword [ebp - 0xf08], ecx
mov edx, dword [eax]
push edi
mov dword [ebp - 0xf0c], edx
mov byte [ebp - 4], 0xb
call fcn.70df62ac
push edi
call fcn.70df3455
add esp, 4
lea eax, [ebp - 0xda4]
push eax
lea edi, [ebp - 0xdb4]
call fcn.70df4c1b
push 0x70e001e0
lea ecx, [ebp - 0xdbc]
push ecx
lea ecx, [ebp - 0xda4]
mov byte [ebp - 4], 0xf
call fcn.70e001ec
jmp 0x70e049f4
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0xda4]
add ecx, 4
push 0x70e7f770
call fcn.70e003da
mov edi, eax
mov dword [ebp - 0xdb8], edi
push ebx
push ebx
push ebx
push ebx
mov byte [ebp - 4], 0x11
mov edx, dword [edi]
push 0x70dff578
push edx
call esi
test eax, eax
je 0x70e04a04
mov eax, dword [ebp - 0xde8]
push ebx
push ebx
lea ecx, [eax + 4]
push ebx
mov dword [ebp - 0xf20], ecx
mov edx, dword [eax]
push ebx
mov dword [ebp - 0xf24], edx
mov eax, dword [edi]
push 0x70dff5a0
push eax
call esi
test eax, eax
je 0x70e04a1a
mov eax, dword [ebp - 0xdf0]
lea ecx, [eax + 4]
mov dword [ebp - 0xf18], ecx
mov edx, dword [eax]
push edi
mov dword [ebp - 0xf1c], edx
mov byte [ebp - 4], 0x10
call fcn.70df62ac
push edi
call fcn.70df3455
add esp, 4
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0xda4]
mov byte [ebp - 4], 0xb
call fcn.70df342c
mov edi, dword [ebp - 0xd9c]
push edi
mov eax, 0x103
push ebx
push 0x400
mov dword [ebp - 0xdf8], eax
mov dword [ebp - 0xdfc], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0xd98], eax
cmp eax, ebx
je 0x70e00028
lea ecx, [ebp - 0xdc0]
push ecx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
setne al
test al, al
je 0x70e00028
mov eax, dword [ebp - 0xdc0]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [ebp - 0xdc4]
push edx
push ebx
push ebx
push 1
push eax
call esi
mov ecx, dword [ebp - 0xdc4]
push ecx
call fcn.70df39ac
mov ecx, dword [ebp - 0xdc4]
add esp, 4
lea edx, [ebp - 0xdc4]
push edx
mov edx, dword [ebp - 0xdc0]
push ecx
push eax
push 1
push edx
mov dword [ebp - 0xd9c], eax
call esi
test eax, eax
setne al
test al, al
je 0x70e00028
lea eax, [ebp - 0xf28]
push eax
lea ecx, [ebp - 0xdfc]
push ecx
lea edx, [ebp - 0x42c]
push edx
mov edx, dword [ebp - 0xd9c]
lea eax, [ebp - 0xdf8]
push eax
mov eax, dword [edx]
lea ecx, [ebp - 0x83c]
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
setne al
test al, al
je 0x70e00028
mov edx, dword [ebp - 0xdfc]
mov esi, dword [ebp - 0xe28]
lea eax, [ebp - 0x83c]
mov dword [ebp - 0xeef], edx
mov edx, dword [ebp - 0xe2c]
mov dword [ebp - 0xee3], eax
lea ecx, [ebp - 0x42c]
lea eax, [ebp - 0xdf4]
mov dword [ebp - 0xeeb], ecx
mov ecx, dword [ebp - 0xdf8]
push eax
dec edx
push esi
mov dword [ebp - 0xee7], ecx
mov dword [ebp - 0xdf4], edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
mov ecx, dword [ebp - 0xdf4]
push 0x104
lea edx, [ebp - 0x634]
push edx
mov dword [ebp - 0xedb], esi
mov dword [ebp - 0xedf], ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x104
lea edx, [ebp - 0x224]
lea ecx, [ebp - 0x634]
push edx
mov dword [ebp - 0xed3], ecx
mov dword [ebp - 0xed7], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea ecx, [ebp - 0x224]
mov dword [ebp - 0xecb], ecx
lea edx, [ebp - 0xe08]
mov ecx, edi
mov dword [ebp - 0xecf], eax
call fcn.70dff28c
mov edx, dword [ebp - 0xe00]
mov dword [ebp - 0xdc8], eax
lea eax, [ebp - 0xe08]
push eax
mov dword [ebp - 0xec3], edx
call fcn.70e0079e
lea ecx, [ebp - 0x87c]
push ecx
mov dword [ebp - 0xec7], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
setne al
test al, al
je 0x70e00028
mov edx, dword [ebp - 0x874]
mov eax, dword [ebp - 0x870]
mov ecx, dword [ebp - 0x86c]
mov dword [ebp - 0xe9f], edx
mov edx, dword [ebp - 0x868]
mov dword [ebp - 0xe9b], eax
mov eax, dword [ebp - 0x864]
mov dword [ebp - 0xe97], ecx
mov ecx, dword [ebp - 0x860]
mov dword [ebp - 0xe93], edx
mov edx, dword [ebp - 0x85c]
mov dword [ebp - 0xe8f], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xe8b], ecx
mov ecx, dword [ebp - 0x854]
mov dword [ebp - 0xe87], edx
mov edx, dword [ebp - 0x850]
mov dword [ebp - 0xe83], eax
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 0xe7f], ecx
mov ecx, dword [ebp - 0x848]
mov dword [ebp - 0xe7b], edx
mov dword [ebp - 0xe77], eax
mov dword [ebp - 0xe73], ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
lea edx, [ebp - 0x92c]
push edx
mov dword [ebp - 0xea3], eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 1
ja 0x70e04a5e
mov eax, dword [ebp - 0x92c]
add eax, dword [ebp - 0x8d8]
cdq
mov dword [ebp - 0xe5b], edx
lea edx, [ebp - 0x928]
mov dword [ebp - 0xe5f], eax
mov eax, edx
mov dword [ebp - 0xe63], edx
lea edx, [eax + 2]
jmp 0x70e04a98
mov eax, dword [ebp - 0xd9c]
push eax
call fcn.70df3455
mov eax, dword [ebp - 0xd98]
add esp, 4
cmp eax, ebx
je 0x70e00813
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xdc0]
cmp eax, ebx
je 0x70e00824
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xe6b]
push ecx
call fcn.70df3455
mov byte [ebp - 4], 9
mov edi, dword [ebp - 0xdb0]
add esp, 4
push edi
call esi
jmp 0x70e04ac0
mov ecx, dword [ebp - 0xde4]
push ecx
call fcn.70df3455
mov edx, dword [ebp - 0xde8]
add esp, 4
push edx
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xe28]
push eax
call fcn.70df3455
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xe00]
add esp, 4
push ecx
mov dword [ebp - 0xe08], 0x70df59dc
call fcn.70df3455
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xdd4]
add esp, 4
push edx
call fcn.70df3455
mov eax, dword [ebp - 0xdc8]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.70df25ed
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x70dfff38
mov ecx, dword [ebp - 0xdb8]
push ecx
call fcn.70df3455
mov edx, dword [ebp - 0xdbc]
add esp, 4
push edx
call fcn.70df3455
add esp, 4
jmp 0x70dfff38
lea ecx, [ebp - 0xdbc]
call fcn.70df342c
jmp 0x70e0043c
push 0x70dff578
push edi
lea ecx, [ebp - 0xde8]
call fcn.70dffa58
jmp 0x70e00475
push 0x70dff5a0
push edi
lea ecx, [ebp - 0xdf0]
call fcn.70dffa58
jmp 0x70e004a2
cmp eax, 2
jne 0x70dff87f
mov eax, dword [ebp - 0x92c]
add eax, dword [ebp - 0x884]
cdq
mov dword [ebp - 0xe5b], edx
lea edx, [ebp - 0x8d4]
mov dword [ebp - 0xe5f], eax
mov eax, edx
mov dword [ebp - 0xe63], edx
lea edx, [eax + 2]
lea ebx, [ebx]
jmp 0x70dff86a
mov cx, word [eax]
add eax, 2
cmp cx, bx
je 0x70dff875
jmp 0x70e04a98
push eax
lea esi, [ebp - 0xdd8]
call fcn.70dff178
mov ebx, dword [ebp - 0xdcc]
jmp 0x70dff9f9
test eax, eax
jne 0x70e04adc
push edi
call fcn.70df3455
mov edx, dword [ebp - 0xdb4]
add esp, 4
push edx
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0xe0c]
push eax
call esi
test eax, eax
jne 0x70e04b0b
mov ecx, dword [ebp - 0xe0c]
push ecx
call fcn.70df3455
mov edx, dword [ebp - 0xe10]
add esp, 4
push edx
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xddc]
push eax
call esi
test eax, eax
jne 0x70e04b3a
mov ecx, dword [ebp - 0xddc]
push ecx
call fcn.70df3455
mov edx, dword [ebp - 0xde0]
add esp, 4
push edx
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xdec]
push eax
call esi
test eax, eax
jne 0x70e04b69
mov ecx, dword [ebp - 0xdec]
push ecx
call fcn.70df3455
mov edx, dword [ebp - 0xdf0]
add esp, 4
push edx
call fcn.70df3455
add esp, 4
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xde4]
push eax
call esi
jmp 0x70e00033