Function at 0x40284f
Capabilities:
Get hostname
Get memory capacity
Initialize winsock library
Query or enumerate registry key
Query or enumerate registry value
Resolve dns

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x7d8
lea r12, [rsp + 0x70]
mov rbx, rcx
mov ebp, edx
mov qword [rsp + 0x830], r8
lea rdx, [0x0040a3d0]
mov rcx, r12
mov dword [rsp + 0x838], r9d
call sub.msvcrt.dll_strcpy
lea rcx, [rsp + 0x5c8]
lea rdx, [0x0040a3d2]
call sub.msvcrt.dll_wcscpy
lea rdx, [rsp + 0x228]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x402903
lea r13, [rsp + 0xd6]
mov edx, 0x50
mov rcx, r13
call qword [sym.imp.WS2_32.dll_gethostname]
inc eax
je 0x4028fd
mov rcx, r13
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x4028fd
mov rax, qword [rax + 0x18]
mov rax, qword [rax]
test rax, rax
je 0x4028fd
mov ecx, dword [rax]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rcx, r12
mov rdx, rax
call sub.msvcrt.dll_strcpy
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, [0x0040a3d4]
call fcn.00405bb0
xor r8d, r8d
mov rsi, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r9d, 0x108
mov r13, rax
lea rax, [rsp + 0x60]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rdx, r13
call rsi
test eax, eax
jne 0x402a4c
lea rcx, [0x0040a435]
xor edi, edi
call fcn.00405bb0
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r14, rax
lea r10, [rsp + 0x3c0]
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x58]
mov edx, edi
mov qword [rsp + 0x48], r10
mov r8, r10
mov dword [rsp + 0x58], 0x104
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call r15
mov r10, qword [rsp + 0x48]
test eax, eax
jne 0x402a39
lea rax, [rsp + 0x68]
xor r8d, r8d
mov rcx, qword [rsp + 0x60]
mov rdx, r10
mov qword [rsp + 0x20], rax
mov r9d, 0x101
call rsi
test eax, eax
jne 0x402a32
lea rax, [rsp + 0x5c]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x68]
lea r10, [rsp + 0x5c8]
mov dword [rsp + 0x5c], 0x104
mov rdx, r14
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r10, qword [rsp + 0x48]
test eax, eax
jne 0x402a27
mov eax, dword [rsp + 0x5c]
mov byte [rax + r10], 0
mov eax, dword [rsp + 0x5c]
mov byte [r10 + rax + 1], 0
jmp 0x402a39
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
jmp 0x402958
mov rcx, r14
call fcn.00405c32
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r13
xor esi, esi
call fcn.00405c32
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x90], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x402a7f
mov rsi, qword [rsp + 0x98]
shr rsi, 0x14
lea rcx, [rsp + 0x5c8]
call fcn.0040230e
mov r13, rax
test rax, rax
je 0x402bba
mov ecx, 0x800
call fcn.00404f00
mov r14, rax
test rax, rax
je 0x402baf
mov eax, dword [rbx]
mov rdi, r12
lea r9, [r14 + 0x2c]
mov rdx, r12
mov dword [r14 + 4], eax
mov eax, dword [rbx + 4]
xor ebx, ebx
mov dword [r14 + 0x14], ebp
or rbp, 0xffffffffffffffff
mov dword [r14 + 8], eax
mov eax, 0x80000001
mov rcx, rbp
add rax, rax
mov qword [r14 + 0xc], rax
mov eax, ebx
repne scasb al, byte [rdi]
mov rdi, r13
not rcx
lea r8d, [rcx - 1]
mov rcx, r9
call fcn.004015b5
mov dword [r14 + 0x18], 0x2c
mov rcx, rbp
mov dword [r14 + 0x1c], eax
add eax, 3
and eax, 0xfffffffc
lea r12d, [rax + 0x2c]
mov eax, ebx
repne scasb al, byte [rdi]
mov eax, r12d
mov rdx, rcx
lea rcx, [r14 + rax]
not rdx
lea r8d, [rdx - 1]
mov rdx, r13
call fcn.004015b5
mov dword [r14 + 0x20], r12d
xor r8d, r8d
lea rcx, [r14 + 4]
mov dword [r14 + 0x24], eax
add eax, 3
and eax, 0xfffffffc
mov dword [r14 + 0x28], esi
lea edx, [rax + r12]
mov dword [rsp + 0x5c], edx
sub edx, 4
call fcn.00401d90
cmp dword [rsp + 0x838], 0
mov dword [r14], eax
je 0x402ba1
mov rdi, qword [rsp + 0x830]
mov eax, ebx
mov rcx, rbp
mov rdx, qword [rsp + 0x830]
lea r12, [rsp + 0x126]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, r12
call fcn.00405270
mov r9d, dword [rsp + 0x5c]
mov r8, r14
mov rdx, r14
mov rcx, r12
call fcn.004052c5
mov rax, qword [rsp + 0x840]
mov edx, dword [rsp + 0x5c]
mov dword [rax], edx
mov rcx, r13
mov r13, r14
call fcn.00404f58
mov rax, r13
add rsp, 0x7d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret