Function at 0x2c9912bd6
Capabilities:
Get hostname
Get memory capacity
Initialize winsock library
Query or enumerate registry key
Query or enumerate registry value
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x7d8
mov r12, rcx
mov r13d, edx
mov qword [rsp + 0x830], r8
mov dword [rsp + 0x838], r9d
mov byte [rsp + 0x5a0], 0
lea rcx, [rsp + 0x390]
lea rdx, [0x2c991e500]
call sub.msvcrt.dll_wcscpy
lea rdx, [rsp + 0x1b0]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x2c9912db4
lea rcx, [0x2c991e508]
call fcn.2c9915bf5
mov rsi, rax
lea rax, [rsp + 0x158]
mov qword [rsp + 0x20], rax
mov r9d, 0x108
mov r8d, 0
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x2c9912e10
mov rcx, rsi
call fcn.2c9915c7c
mov dword [rsp + 0x350], 0x40
lea rcx, [rsp + 0x350]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov edi, 0
test eax, eax
je 0x2c9912cac
mov rdi, qword [rsp + 0x358]
shr rdi, 0x14
lea rcx, [rsp + 0x390]
call fcn.2c991272d
mov rsi, rax
mov rbx, rax
test rax, rax
je 0x2c9912d9d
mov ecx, 0x800
call fcn.2c9914d40
mov rbx, rax
test rax, rax
je 0x2c9912d95
mov eax, dword [r12]
mov dword [rbx + 4], eax
mov eax, dword [r12 + 4]
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], 2
mov dword [rbx + 0x10], 1
mov dword [rbx + 0x14], r13d
lea rbp, [rsp + 0x5a0]
mov rcx, rbp
call sub.msvcrt.dll_strlen
lea rcx, [rbx + 0x2c]
mov r8d, eax
mov rdx, rbp
call fcn.2c99114be
mov dword [rbx + 0x18], 0x2c
mov dword [rbx + 0x1c], eax
add eax, 3
and eax, 0xfffffffc
lea ebp, [rax + 0x2c]
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov ecx, ebp
add rcx, rbx
mov r8d, eax
mov rdx, rsi
call fcn.2c99114be
mov dword [rbx + 0x20], ebp
mov dword [rbx + 0x24], eax
mov dword [rbx + 0x28], edi
add eax, 3
and eax, 0xfffffffc
lea edx, [rax + rbp]
mov dword [rsp + 0x148], edx
sub edx, 4
lea rcx, [rbx + 4]
mov r8d, 0
call fcn.2c99120f0
mov dword [rbx], eax
cmp dword [rsp + 0x838], 0
jne 0x2c9912f53
mov rax, qword [rsp + 0x840]
mov edx, dword [rsp + 0x148]
mov dword [rax], edx
mov rcx, rsi
call fcn.2c9914d92
mov rax, rbx
add rsp, 0x7d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x160]
mov edx, 0x50
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x2c9912dd7
call qword [sym.imp.WS2_32.dll_WSACleanup]
jmp 0x2c9912c36
lea rcx, [rsp + 0x160]
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x2c9912dcc
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x2c9912dcc
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x5a0]
call sub.msvcrt.dll_strcpy
jmp 0x2c9912dcc
lea rcx, [0x2c991e570]
call fcn.2c9915bf5
mov r14, rax
mov ebx, 0
mov rdi, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r15, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x2c9912e77
mov eax, dword [rsp + 0x148]
mov byte [rsp + rax + 0x390], 0
mov eax, dword [rsp + 0x148]
mov byte [rsp + rax + 0x391], 0
mov rcx, r14
call fcn.2c9915c7c
mov rcx, qword [rsp + 0x158]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2c9912c76
add ebx, 1
mov dword [rsp + 0x14c], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x14c]
lea r8, [rsp + 0x5c0]
mov edx, ebx
mov rcx, qword [rsp + 0x158]
call rdi
test eax, eax
jne 0x2c9912e59
lea rdx, [rsp + 0x5c0]
lea rax, [rsp + 0x150]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
mov r8d, 0
mov rcx, qword [rsp + 0x158]
call rbp
test eax, eax
jne 0x2c9912e74
mov dword [rsp + 0x148], 0x104
lea rax, [rsp + 0x148]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x390]
mov qword [rsp + 0x20], rax
mov r9d, 0
mov r8d, 0
mov rdx, r14
mov rcx, qword [rsp + 0x150]
call r15
test eax, eax
je 0x2c9912e3b
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x2c9912e74
mov rcx, qword [rsp + 0x830]
call sub.msvcrt.dll_strlen
mov r8, rax
lea rdi, [rsp + 0x40]
mov rdx, qword [rsp + 0x830]
mov rcx, rdi
call fcn.2c9915130
mov r9d, dword [rsp + 0x148]
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
call fcn.2c991519c
jmp 0x2c9912d84