Function at 0x46f2b0
Capabilities:
Get cpu information
Get memory capacity
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x54d104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
mov dword [ebp - 0x64], ebx
lea edi, [esi + 1]
cmp dword [0x5549c0], esi
jne 0x46f2e6
mov ecx, edi
call fcn.0046f100
mov esi, eax
test esi, esi
jne 0x46fc4c
mov eax, dword [0x5549c0]
test eax, eax
je 0x46f2f6
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x5549c4]
mov ecx, eax
inc eax
mov dword [0x5549c4], eax
test ecx, ecx
jne 0x46fc31
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x46f487
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process2
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor eax, eax
mov word [ebp - 0x1c], ax
mov word [ebp - 8], ax
test edi, edi
je 0x46f3cf
lea eax, [ebp - 8]
mov ecx, edi
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [0x4f933c]
call edi
test eax, eax
je 0x46f3cf
cmp word [ebp - 0x1c], 0
movzx edx, word [0x554c5c]
movzx eax, word [ebp - 8]
cmovne edx, eax
movzx eax, word [ebp - 8]
mov word [0x554c5c], dx
cmp eax, 0x8664
ja 0x46f3bb
je 0x46f3ae
cmp eax, 0x200
je 0x46f3a1
cmp eax, 0x284
jne 0x46f411
mov eax, 7
mov word [0x554c58], ax
jmp 0x46f411
mov eax, 6
mov word [0x554c58], ax
jmp 0x46f411
mov eax, 9
mov word [0x554c58], ax
jmp 0x46f411
cmp eax, 0xaa64
jne 0x46f411
mov eax, 0xc
mov word [0x554c58], ax
jmp 0x46f411
push 0x5341a0
push esi
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x46f3f7
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
push ebx
call dword [0x4f933c]
call edi
cmp dword [ebp - 0xc], 0
je 0x46f40a
mov eax, 0x8664
mov word [0x554c5c], ax
jmp 0x46f416
mov dx, word [0x554c5c]
test dx, dx
je 0x46f427
push str.Wow64EnableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c94], eax
push str.GetLogicalProcessorInformationEx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c60], eax
test eax, eax
jne 0x46f44d
push str.GetLogicalProcessorInformation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c70], eax
push 0x5341fc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x554d00], 0xf
jl 0x46f47f
push str.PrefetchVirtualMemory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetCurrentThreadStackLimits
push esi
mov dword [0x554c64], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [ebp - 0x64]
mov edi, 1
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x554c44], eax
test eax, eax
je 0x46f647
push 0x534268
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlInitUnicodeString
push dword [0x554c44]
mov dword [0x554c90], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtOpenFile
push dword [0x554c44]
mov dword [0x554c98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateFile
push dword [0x554c44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtReadFile
push dword [0x554c44]
mov dword [0x554c88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtWriteFile
push dword [0x554c44]
mov dword [0x554c84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationFile
push dword [0x554c44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationFile
push dword [0x554c44]
mov dword [0x554c8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryVirtualMemory
push dword [0x554c44]
mov dword [0x554c7c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryObject
push dword [0x554c44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryVolumeInformationFile
push dword [0x554c44]
mov dword [0x554c80], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push dword [0x554c44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationThread
push dword [0x554c44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationThread
push dword [0x554c44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySystemInformation
push dword [0x554c44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryDirectoryFile
push dword [0x554c44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryEaFile
push dword [0x554c44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5343ec
push dword [0x554c44]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtFsControlFile
push dword [0x554c44]
mov dword [0x554c78], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtDeviceIoControlFile
push dword [0x554c44]
mov dword [0x554c74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtWaitForSingleObject
push dword [0x554c44]
mov dword [0x554c6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x534428
push dword [0x554c44]
mov dword [0x554c68], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ff25c
push 8
call fcn.004b0100
mov esi, eax
add esp, 8
test esi, esi
je 0x46fc20
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004af3f1
add esp, 4
mov dword [0x553ed8], esi
mov dword [eax], eax
push 0x4ff25c
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
push 8
mov dword [esi], eax
call fcn.004b0100
mov esi, eax
add esp, 8
test esi, esi
je 0x46fc0f
push 0x120
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004af3f1
add esp, 4
mov dword [0x552e94], esi
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword [0x554c44]
test eax, eax
je 0x46f928
push str.RtlSetThreadErrorMode
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c38], eax
test eax, eax
jne 0x46f6fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x554c24], 0
jne 0x46f735
mov eax, dword [0x554c44]
test eax, eax
jne 0x46f71a
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46f72f
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c24], eax
test eax, eax
jne 0x46f735
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x554c20], 0
jne 0x46f76c
mov eax, dword [0x554c44]
test eax, eax
jne 0x46f751
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46f766
push str.RtlPcToFileHeader
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c20], eax
test eax, eax
jne 0x46f76c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x554c44]
test eax, eax
jne 0x46f77f
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46f794
push str.LdrLockLoaderLock
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c2c], eax
test eax, eax
jne 0x46f79a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x554c44]
test eax, eax
jne 0x46f7ad
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46f7c2
push str.LdrUnlockLoaderLock
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c28], eax
test eax, eax
jne 0x46f7c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x554c44]
test eax, eax
jne 0x46f7db
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46f7f0
push str.NtQueryDirectoryFileEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c3c], eax
test eax, eax
jne 0x46f7f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x554c44]
test eax, eax
jne 0x46f809
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46f81e
push str.NtWow64QueryInformationProcess64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c4c], eax
test eax, eax
jne 0x46f824
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x554c44]
test eax, eax
jne 0x46f837
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46f84c
push str.NtWow64GetNativeSystemInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c48], eax
test eax, eax
jne 0x46f852
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x554c44]
test eax, eax
jne 0x46f865
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46f87a
push str.NtWow64QueryVirtualMemory64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c34], eax
test eax, eax
jne 0x46f880
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x554c44]
test eax, eax
jne 0x46f893
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46f8a8
push str.NtWow64ReadVirtualMemory64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x554c30], eax
test eax, eax
jne 0x46f8ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, dword [0x554c48]
test esi, esi
je 0x46f928
cmp word [0x554c58], 0
jne 0x46f8f3
push 0
push 0xc
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push 1
call dword [0x4f933c]
call esi
movzx edx, word [0x554c58]
test eax, eax
movzx ecx, word [ebp - 0x14]
mov esi, dword [0x554c48]
cmove edx, ecx
mov word [0x554c58], dx
push 0
push 0x2c
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
push 0
call dword [0x4f933c]
call esi
test eax, eax
jne 0x46f928
mov eax, dword [ebp - 0x2c]
mov dword [0x54dbb8], eax
movzx eax, byte [ebp - 0x24]
mov dword [0x54dbbc], 0
mov dword [0x54dbc4], eax
jmp 0x46f92d
mov eax, dword [0x54dbc4]
and ebx, 1
mov dword [ebp - 0x64], ebx
jne 0x46f975
cmp word [0x554c10], 0
mov ecx, 0x554c10
mov eax, 0x52d9b8
cmovne eax, ecx
sub esp, 0xc
lea ecx, [ebp - 0x40]
push str.aswSP
push 0x10
push ecx
push eax
call fcn.00472b00
add esp, 0x14
mov edx, eax
mov ecx, 0x554c40
call fcn.00470bd0
mov eax, dword [0x54dbc4]
add esp, 8
test eax, eax
cmove eax, edi
sub esp, 8
mov dword [0x54dbc4], eax
call fcn.00470c80
push 0
push 0x80000002
lea eax, [ebp - 0xc]
xorps xmm0, xmm0
push eax
push 1
mov edx, str.HardwareDescriptionSystemCentralProcessor0
movlpd qword [ebp - 0x20], xmm0
xor ecx, ecx
call fcn.00470880
add esp, 0x18
test eax, eax
jne 0x46fa07
mov ebx, dword [ebp - 0xc]
xor esi, esi
mov eax, dword [esi + 0x5346b4]
test ebx, ebx
je 0x46f9f4
test eax, eax
je 0x46f9f4
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 8
push ecx
lea ecx, [ebp - 0x20]
xor edi, edi
push ecx
push edi
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x46f9e8
cmp eax, 0xea
jne 0x46f9eb
mov edi, dword [ebp - 0xc]
test eax, eax
jne 0x46f9f4
cmp edi, 4
jae 0x46f9fc
add esi, 4
cmp esi, 0xc
jb 0x46f9b4
test ebx, ebx
je 0x46fa07
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x40
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.004b23a0
add esp, 0xc
mov dword [ebp - 0x60], 0x40
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x46fa32
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 0x553ec4
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x46fa74
push 0
push 0
push 1
push 0x553ec4
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [0x553eb8], 0xc
mov dword [0x553ec0], 0
mov dword [0x553ebc], 0x553ec4
jmp 0x46fa7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 0x5536a4
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x46fbb6
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x100
push eax
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 2
push 0x800
push 0x552e98
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea esi, [ebx + 8]
push esi
call fcn.004af42f
add esp, 4
mov edi, eax
mov dword [ebp - 8], edi
push esi
push 0
push edi
call fcn.004b23a0
add esp, 0xc
mov dword [edi + 4], 0x10000000
mov word [edi], 0x900
lea esi, [ebx + 8]
mov word [edi + 2], si
add edi, 8
push ebx
push dword [ebp - 0x1c]
push edi
call fcn.004b1e20
mov ecx, dword [ebp - 8]
add esp, 0xc
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push 0x552e98
call dword [sym.imp.ADVAPI32.dll_AddAce]
mov eax, dword [ebp - 8]
push ebx
mov dword [eax + 4], 0x1f01ff
mov word [eax], 0x200
mov word [eax + 2], si
push dword [ebp - 0x1c]
push edi
call fcn.004b1e20
mov ebx, dword [ebp - 8]
add esp, 0xc
movzx eax, word [ebx + 2]
push eax
push ebx
push 0xffffffffffffffff
push 2
push 0x552e98
call dword [sym.imp.ADVAPI32.dll_AddAce]
push ebx
call fcn.004af421
add esp, 4
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push 0
push 0x552e98
push 1
push 0x5536a4
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [0x553698], 0xc
mov dword [0x5536a0], 0
mov dword [0x55369c], 0x5536a4
jmp 0x46fbbc
call dword [sym.imp.KERNEL32.dll_GetLastError]
or dword [0x5549c8], 2
push 0x18
push 0
mov dword [0x554c9c], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x46fc2a
push 0x2000000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov dword [0x554c9c], esi
xor esi, esi
cmp dword [ebp - 0x64], esi
jne 0x46fc3a
push 0x529f54
push esi
call fcn.004c8f3a
add esp, 8
jmp 0x46fc3a
mov dword [0x552e94], 0
mov esi, 8
jmp 0x46fc35
mov dword [0x553ed8], 0
mov esi, 8
jmp 0x46fc35
test esi, esi
je 0x46fc3a
call fcn.0046fc60
mov eax, dword [0x5549c0]
test eax, eax
je 0x46fc4a
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004af3ab
mov esp, ebp
pop ebp
ret