Function at 0x140002e50
Capabilities:
Get hostname
Get memory capacity
Initialize winsock library
Query or enumerate registry key
Query or enumerate registry value
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x808
lea rbp, [rsp + 0x5f0]
mov qword [rsp + 0x850], rcx
mov dword [rsp + 0x858], edx
mov rcx, rbp
lea rdx, [0x14001a3d0]
mov qword [rsp + 0x860], r8
mov dword [rsp + 0x868], r9d
mov byte [rsp + 0x80], 0
call sub.msvcrt.dll_wcscpy
lea rdx, [rsp + 0x240]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x1400031c0
lea rcx, [0x14001a3d8]
call fcn.140006e10
xor r8d, r8d
mov rdi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, 0x108
mov r12, rax
lea rax, [rsp + 0x70]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdx, r12
call rdi
test eax, eax
je 0x1400030c8
mov rcx, r12
xor ebx, ebx
call fcn.140006ea0
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x140002f2c
mov rbx, qword [rsp + 0xa8]
shr rbx, 0x14
mov qword [rsp + 0x38], 0
mov r8, rbp
xor edx, edx
mov rsi, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [rsp + 0x30], 0
mov r9d, 0xffffffff
mov ecx, 0xfde9
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rsi
mov edi, eax
test eax, eax
je 0x1400030c0
movsxd rcx, eax
call fcn.140005de0
mov r13, rax
test rax, rax
je 0x1400030c0
mov r9d, 0xffffffff
mov r8, rbp
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call rsi
mov ecx, 0x800
call fcn.140005de0
mov r12, rax
test rax, rax
je 0x14000309f
mov rax, qword [rsp + 0x850]
lea r14, [rsp + 0x80]
mov rcx, r14
mov eax, dword [rax]
mov dword [r12 + 4], eax
mov rax, qword [rsp + 0x850]
mov eax, dword [rax + 4]
mov dword [r12 + 8], eax
movabs rax, 0x100000002
mov qword [r12 + 0xc], rax
mov eax, dword [rsp + 0x858]
mov dword [r12 + 0x14], eax
call sub.msvcrt.dll_strlen
mov rdx, r14
lea rcx, [r12 + 0x2c]
mov r8d, eax
call fcn.140001590
mov rcx, r13
mov dword [r12 + 0x18], 0x2c
mov dword [r12 + 0x1c], eax
add eax, 3
and eax, 0xfffffffc
lea esi, [rax + 0x2c]
call sub.msvcrt.dll_strlen
mov ecx, esi
mov rdx, r13
add rcx, r12
mov r8d, eax
call fcn.140001590
mov dword [r12 + 0x20], esi
lea rcx, [r12 + 4]
xor r8d, r8d
mov dword [r12 + 0x24], eax
add eax, 3
and eax, 0xfffffffc
mov dword [r12 + 0x28], ebx
lea edx, [rax + rsi]
mov dword [rsp + 0x6c], edx
sub edx, 4
call fcn.140001f50
mov dword [r12], eax
mov eax, dword [rsp + 0x868]
test eax, eax
jne 0x140003248
mov rax, qword [rsp + 0x870]
mov edx, dword [rsp + 0x6c]
mov dword [rax], edx
mov rcx, r13
call fcn.140005e40
mov rax, r12
add rsp, 0x808
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r12d, r12d
jmp 0x1400030a7
lea rcx, [0x14001a440]
xor ebx, ebx
lea r14, [rsp + 0x68]
call fcn.140006e10
lea rdx, [rsp + 0x6c]
mov qword [rsp + 0x58], r12
mov r13, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov qword [rsp + 0x50], rax
lea rsi, [rsp + 0x3e0]
lea r15, [rsp + 0x78]
mov r12, rax
mov qword [rsp + 0x48], rdx
jmp 0x140003113
add ebx, 1
mov dword [rsp + 0x68], 0x104
mov r9, r14
mov r8, rsi
mov edx, ebx
mov qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r13
test eax, eax
jne 0x1400031f0
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov rcx, qword [rsp + 0x70]
mov rdx, rsi
mov r9d, 0x101
call rdi
test eax, eax
jne 0x140003110
mov rax, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x6c], 0x104
mov rcx, qword [rsp + 0x78]
mov rdx, r12
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003290
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140003110
lea r12, [rsp + 0xe0]
mov edx, 0x50
mov rcx, r12
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x140003210
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x140002ebc
mov r12, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.140006ea0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140002ef9
mov rcx, r12
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x1400031db
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x1400031db
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
lea rcx, [rsp + 0x80]
mov rdx, rax
call sub.msvcrt.dll_strcpy
jmp 0x1400031db
mov rcx, qword [rsp + 0x860]
lea r14, [rsp + 0x130]
call sub.msvcrt.dll_strlen
mov rdx, qword [rsp + 0x860]
mov rcx, r14
mov r8, rax
call fcn.140006220
mov r9d, dword [rsp + 0x6c]
mov r8, r12
mov rdx, r12
mov rcx, r14
call fcn.140006350
jmp 0x140003091
mov eax, dword [rsp + 0x6c]
mov r12, qword [rsp + 0x58]
mov byte [rbp + rax], 0
mov eax, dword [rsp + 0x6c]
mov byte [rbp + rax + 1], 0
jmp 0x1400031f5