Function at 0x180004b60
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub rsp, 0x88
mov dword [rsp + 0x5c], 0x2247
mov dword [rsp + 0x4c], 0x1d24
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x58], 0x23b7
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x48], 0x1dab
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x50], 0x20d4
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x60], 0
mov eax, dword [rsp + 0x50]
sub eax, 0xcea
mov dword [rsp + 0x50], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformationEx]
mov eax, dword [rsp + 0x44]
sub eax, 0x434
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x74], 0
mov eax, dword [rsp + 0x44]
add eax, 0xb89
mov dword [rsp + 0x44], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x40]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x180004c79
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
jmp 0x180004c5d
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x54], 0x892
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x4c]
add eax, 0xb78
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x48]
sub eax, 0x1ea4
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x4c]
sub eax, 0x16a2
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x58]
add eax, 0x2354
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x40]
sub eax, 0xdec
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x13c6
mov dword [rsp + 0x40], eax
xor eax, eax
lock inc dword [rax]
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x60]
add eax, 0x1b12
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x44]
add eax, 0x395
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x68], 0
jmp 0x180004d8f
mov eax, dword [rsp + 0x68]
inc eax
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x68], 0xc
jge 0x180004da3
mov eax, dword [rsp + 0x4c]
add eax, 4
mov dword [rsp + 0x4c], eax
jmp 0x180004d85
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
mov eax, dword [rsp + 0x64]
sub eax, 0x2011
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x60]
sub eax, 0x911
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x48]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
test eax, eax
je 0x180004e1d
mov eax, dword [rsp + 0x48]
sub eax, 0xb8e
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x44]
sub eax, 0x1b0c
mov dword [rsp + 0x44], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x44]
add eax, 0x1446
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x4c]
add eax, 0x179f
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x36c
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x40]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
test eax, eax
je 0x180004ee9
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [rsp + 0x40]
add eax, 0x3c2
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
add eax, 0x1a8
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x58]
sub eax, 0xb7d
mov dword [rsp + 0x58], eax
mov dword [rsp + 0x6c], 0
jmp 0x180004f34
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x22
jge 0x180004f48
mov eax, dword [rsp + 0x50]
sub eax, 5
mov dword [rsp + 0x50], eax
jmp 0x180004f2a
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteBoundaryDescriptor]
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x17d
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x54]
add eax, 0x15d
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
mov eax, dword [rsp + 0x50]
add eax, 0x2b1
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x4c]
sub eax, 0xd4c
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x48]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x18000505c
cmp dword [rsp + 0x48], 0
jle 0x18000505c
mov eax, dword [rsp + 0x48]
sub eax, 0xfe7
mov dword [rsp + 0x48], eax
jmp 0x180005069
mov eax, dword [rsp + 0x48]
add eax, 0xfe7
mov dword [rsp + 0x48], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
mov eax, dword [rsp + 0x74]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x2408
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x70], 0
jmp 0x1800050a7
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x16
jge 0x1800050bb
mov eax, dword [rsp + 0x64]
add eax, 8
mov dword [rsp + 0x64], eax
jmp 0x18000509d
mov eax, dword [rsp + 0x44]
sub eax, 0xa2a
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x60]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x74]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
add eax, 0x202e
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x1e56
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x40]
sub eax, 0xfe
mov dword [rsp + 0x40], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov eax, dword [rsp + 0x44]
add eax, 0xd38
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x64]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x18000516c
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
jmp 0x180005150
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x48]
add eax, 0x14c8
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x1877
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x1e59
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x60]
sub eax, 0x1bfe
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x60]
add eax, 0x925
mov dword [rsp + 0x60], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [rsp + 0x4c]
sub eax, 0xe08
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x8d
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
add rsp, 0x88
ret