Function at 0x104e1c0
Capabilities:
Get number of processors
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x1084938
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
push 0
push str.Control_Panel
push SysReAllocStringLen
lea ecx, [esp + 0x30]
call fcn.01016e3e
push 0xffffffffffffff9b
push 0x10a40b8
lea ecx, [esp + 0x18]
mov dword [esp + 0x44], 0
call fcn.010087b8
push 0x104
mov byte [esp + 0x40], 1
call fcn.0105b249
mov ebx, eax
mov ecx, 0x41
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov al, byte [esp + 0x34]
add esp, 4
test al, al
mov dword [esp + 0x14], ebx
mov byte [esp + 0xf], al
je 0x104e424
mov esi, dword [esp + 0x48]
mov ecx, dword [str.originaltheme]
lea eax, [esp + 0x10]
push eax
push esi
push ecx
mov ecx, dword [esp + 0x50]
call fcn.01016f4e
test al, al
je 0x104e2f5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x104e2f5
push 0x109c474
push eax
mov edi, eax
call fcn.0105b710
add esp, 8
lea ecx, [esp + 0x24]
neg eax
sbb eax, eax
neg eax
inc eax
push eax
push edi
push esi
push str.Cursors
call fcn.01016fa1
mov edx, dword [esp + 0x10]
push 0x109c474
push edx
call fcn.0105b710
add esp, 8
test eax, eax
je 0x104e2c9
mov eax, dword [esp + 0x10]
push 0x104
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x104e2c9
push ebx
lea ecx, [esp + 0x14]
call fcn.01008a50
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_LoadCursorFromFileA]
test eax, eax
je 0x104e424
mov edx, dword [esp + 0x4c]
push edx
push eax
call dword [sym.imp.USER32.dll_SetSystemCursor]
cmp eax, 1
sete byte [esp + 0xf]
jmp 0x104e424
push ebp
push esi
push str.Cursors
lea ecx, [esp + 0x30]
call fcn.010170f0
mov eax, dword [esp + 0x54]
mov esi, dword [sym.imp.USER32.dll_LoadCursorA]
and eax, 0xffff
push eax
push 0
call esi
mov ebp, dword [esp + 0x50]
mov ebx, dword [sym.imp.USER32.dll_SetSystemCursor]
test eax, eax
je 0x104e33e
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
test eax, eax
je 0x104e33e
push ebp
push eax
call ebx
cmp eax, 1
sete byte [esp + 0x13]
push 0x401
lea ecx, [esp + 0x20]
call fcn.0100943b
push str.USER32.DLL
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], 2
call fcn.01009731
lea ecx, [esp + 0x1c]
call fcn.0100972d
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x104e411
lea ecx, [ebp - 0x7f01]
mov eax, 0x64
cmp ecx, 0x89
ja case.0x104e394.32524
xor edx, edx
mov dl, byte [ecx + 0x104e4a4]
jmp dword [edx*4 + 0x104e474]
mov eax, 0x6f
jmp case.0x104e394.32524
mov eax, 0x66
jmp case.0x104e394.32524
mov eax, 0x6e
jmp case.0x104e394.32524
mov eax, 0x6c
jmp case.0x104e394.32524
mov eax, 0x6b
jmp case.0x104e394.32524
mov eax, 0x6d
jmp case.0x104e394.32524
mov eax, 0x65
jmp case.0x104e394.32524
mov eax, 0x69
jmp case.0x104e394.32524
mov eax, 0x6a
jmp case.0x104e394.32524
mov eax, 0x67
jmp case.0x104e394.32524
mov eax, 0x68
and eax, 0xffff
push eax
push edi
call esi
test eax, eax
je 0x104e40a
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
test eax, eax
je 0x104e40a
push ebp
push eax
call ebx
cmp eax, 1
sete byte [esp + 0x13]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x40], 1
call fcn.010095e5
mov ebx, dword [esp + 0x18]
pop ebp
push ebx
call fcn.0105ad60
mov eax, dword [esp + 0x14]
add esp, 4
add eax, 0xfffffff4
pop edi
pop esi
mov ecx, dword [eax]
pop ebx
cmp ecx, 0xffffffff
je 0x104e44e
dec ecx
test ecx, ecx
mov dword [eax], ecx
jne 0x104e44e
push eax
call fcn.0105b157
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xffffffff
call fcn.01016e63
mov ecx, dword [esp + 0x28]
mov al, byte [esp + 3]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x10