Function at 0x180004d40
Capabilities:
Get common file path
Get memory capacity

Disassembly:
sub rsp, 0x88
mov dword [rsp + 0x5c], 0x2336
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x48], 0x18b6
mov eax, dword [rsp + 0x48]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x180004d99
mov eax, dword [rsp + 0x48]
add eax, 0xcc8
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x54], 0x111b
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x50], 0xe21
mov dword [rsp + 0x60], 0
mov eax, dword [rsp + 0x60]
sub eax, 0x2054
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x48]
sub eax, 0xe16
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x58], 0x1dab
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x4c], 0xb24
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x4c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x44], 0x1508
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformationEx]
mov dword [rsp + 0x6c], 0
mov eax, dword [rsp + 0x60]
sub eax, 0xec2
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x50]
add eax, 0x1405
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [rsp + 0x40]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x180004ec3
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
jmp 0x180004ea7
mov eax, dword [rsp + 0x58]
add eax, 0x1e4c
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x68]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x5c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x4c]
sub eax, 0x135e
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
sub eax, 0x1303
mov dword [rsp + 0x4c], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x50]
add eax, 0x1a2d
mov dword [rsp + 0x50], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
mov dword [rsp + 0x70], 0
jmp 0x180004f78
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0xf
jge 0x180004f8b
mov eax, dword [rsp + 0x6c]
inc eax
mov dword [rsp + 0x6c], eax
jmp 0x180004f6e
mov eax, dword [rsp + 0x40]
sub eax, 0x1e9
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x54]
add eax, 0xf9
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x64]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x180004fe1
mov eax, dword [rsp + 0x64]
inc eax
mov dword [rsp + 0x64], eax
jmp 0x180004fc5
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x50]
add eax, 0x2123
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x116f
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x1af2
mov dword [rsp + 0x40], eax
xor eax, eax
lock inc dword [rax]
mov eax, dword [rsp + 0x48]
sub eax, 0x1a6b
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x4c]
add eax, 0xcd3
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
add eax, 0x2483
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x4c]
sub eax, 0x1c71
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x5c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
mov eax, dword [rsp + 0x60]
add eax, 0x122f
mov dword [rsp + 0x60], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov eax, dword [rsp + 0x4c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x1800050f2
mov eax, dword [rsp + 0x4c]
inc eax
mov dword [rsp + 0x4c], eax
jmp 0x1800050d6
mov eax, dword [rsp + 0x40]
add eax, 0x2614
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x68]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x54]
sub eax, 0xf26
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x58]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x23bd
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x48]
sub eax, 0x8e2
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [rsp + 0x40]
add eax, 0x1ccd
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x790
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x4c]
add eax, 0x220a
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
add eax, 0x6c7
mov dword [rsp + 0x48], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteBoundaryDescriptor]
mov eax, dword [rsp + 0x50]
mov ecx, dword [rsp + 0x58]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x5c]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
test eax, eax
je 0x1800052b1
mov eax, dword [rsp + 0x5c]
add eax, 0x882
mov dword [rsp + 0x5c], eax
jmp 0x1800052be
mov eax, dword [rsp + 0x5c]
sub eax, 0x882
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x48]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x68]
add eax, 0x19d
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x175f
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x50]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x5c]
add eax, 0x1da3
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x190d
mov dword [rsp + 0x50], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x74], 0
jmp 0x180005340
mov eax, dword [rsp + 0x74]
inc eax
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0x62
jge 0x180005354
mov eax, dword [rsp + 0x6c]
add eax, 6
mov dword [rsp + 0x6c], eax
jmp 0x180005336
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x64]
add eax, 0x61
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
mov eax, dword [rsp + 0x5c]
sub eax, 0x1966
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x64]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x60]
add eax, 0x25f1
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x54]
add eax, 0x16d1
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x60]
add eax, 0x1653
mov dword [rsp + 0x60], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
mov eax, dword [rsp + 0x40]
add eax, 0x161a
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x58]
add eax, 0x1b05
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x4c]
add eax, 0x69e
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x64], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov eax, dword [rsp + 0x68]
sub eax, 0x1c
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x264d
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x60]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x1e88
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x40]
add eax, 0xba0
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x68]
sub eax, 0x24be
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x54]
add eax, 0x1c20
mov dword [rsp + 0x54], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
mov eax, dword [rsp + 0x6c]
mov ecx, dword [rsp + 0x4c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x58]
sub eax, 0x1171
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x50]
sub eax, 0x21eb
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x44]
sub eax, 0x4c2
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
add eax, 0x1043
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
sub eax, 0xd
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x54]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x54], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov eax, dword [rsp + 0x44]
add eax, 0x18e2
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x64]
mov ecx, dword [rsp + 0x50]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x50], eax
add rsp, 0x88
ret