Function at 0x481c40
Capabilities:
Check for time delay via gettickcount
Get memory capacity
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4dc
lea eax, [ebp - 0x3f8]
mov dword [ebp - 0x490], 0
mov dword [ebp - 0x3f8], 0x94
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [ebp - 0x49c], eax
sub esp, 4
mov dword [esp], str.ADVAPI32.DLL
call eax
sub esp, 4
mov esi, eax
mov dword [esp], str.KERNEL32.DLL
call ebx
sub esp, 4
mov edi, eax
mov dword [esp], str.NETAPI32.DLL
call ebx
sub esp, 4
test eax, eax
mov ebx, eax
je 0x481cff
mov edx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.NetStatisticsGet
mov dword [esp], eax
mov dword [ebp - 0x4a4], edx
call edx
mov edx, dword [ebp - 0x4a4]
sub esp, 8
mov dword [ebp - 0x4a0], eax
mov dword [esp + 4], str.NetApiBufferFree
mov dword [esp], ebx
call edx
sub esp, 8
test eax, eax
mov dword [ebp - 0x4a4], eax
jne 0x482373
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
test esi, esi
mov dword [ebp - 0x4a0], 0
je 0x481df1
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.CryptAcquireContextW
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [ebp - 0x4a4], eax
mov dword [esp + 4], str.CryptGenRandom
mov dword [esp], esi
call ebx
sub esp, 8
mov dword [ebp - 0x4a8], eax
mov dword [esp + 4], str.CryptReleaseContext
mov dword [esp], esi
call ebx
mov ecx, dword [ebp - 0x4a4]
sub esp, 8
test ecx, ecx
mov ebx, eax
je 0x482462
mov eax, dword [ebp - 0x4a8]
test eax, eax
je 0x482462
test ebx, ebx
je 0x481de5
lea eax, [ebp - 0x490]
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call ecx
sub esp, 0x14
test eax, eax
jne 0x482503
lea eax, [ebp - 0x490]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x16
mov dword [esp + 8], str.Intel_Hardware_Cryptographic_Service_Provider
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [ebp - 0x4a4]
sub esp, 0x14
test eax, eax
jne 0x4824b0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
cmp dword [ebp - 0x3e8], 2
je 0x482430
mov dword [esp], str.USER32.DLL
call dword [ebp - 0x49c]
sub esp, 4
test eax, eax
mov ebx, eax
je 0x48243d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.GetForegroundWindow
mov dword [esp], eax
call esi
sub esp, 8
mov dword [ebp - 0x4a4], eax
mov dword [esp + 4], str.GetCursorInfo
mov dword [esp], ebx
call esi
sub esp, 8
mov dword [ebp - 0x49c], eax
mov dword [esp + 4], str.GetQueueStatus
mov dword [esp], ebx
call esi
mov edx, dword [ebp - 0x4a4]
sub esp, 8
test edx, edx
mov esi, eax
je 0x481e8a
call edx
mov dword [esp + 4], 4
mov dword [ebp - 0x23c], eax
fldz
lea eax, [ebp - 0x23c]
fstp qword [esp + 8]
mov dword [esp], eax
call fcn.00433430
mov eax, dword [ebp - 0x49c]
test eax, eax
je 0x481ec5
cmp dword [ebp - 0x3e8], 2
je 0x482450
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x14
mov dword [esp], eax
call dword [ebp - 0x49c]
sub esp, 4
test eax, eax
jne 0x482471
lea eax, [ebp - 0x48c]
test esi, esi
mov dword [ebp - 0x49c], eax
je 0x481f03
mov dword [esp], 0x4bf
call esi
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x49c]
sub esp, 4
fld1
fstp qword [esp + 8]
mov dword [esp + 4], 4
mov dword [esp], eax
call fcn.00433430
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
test edi, edi
je 0x482031
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp + 4], str.CreateToolhelp32Snapshot
mov dword [esp], edi
call ebx
sub esp, 8
mov esi, eax
mov dword [esp + 4], str.CloseToolhelp32Snapshot
mov dword [esp], edi
call ebx
sub esp, 8
mov dword [ebp - 0x4cc], eax
mov dword [esp + 4], str.Heap32First
mov dword [esp], edi
call ebx
sub esp, 8
mov dword [ebp - 0x4a4], eax
mov dword [esp + 4], str.Heap32Next
mov dword [esp], edi
call ebx
sub esp, 8
mov dword [ebp - 0x4a8], eax
mov dword [esp + 4], str.Heap32ListFirst
mov dword [esp], edi
call ebx
sub esp, 8
mov dword [ebp - 0x4b4], eax
mov dword [esp + 4], str.Heap32ListNext
mov dword [esp], edi
call ebx
sub esp, 8
mov dword [ebp - 0x4ac], eax
mov dword [esp + 4], str.Process32First
mov dword [esp], edi
call ebx
sub esp, 8
mov dword [ebp - 0x4c0], eax
mov dword [esp + 4], str.Process32Next
mov dword [esp], edi
call ebx
sub esp, 8
mov dword [ebp - 0x4b0], eax
mov dword [esp + 4], str.Thread32First
mov dword [esp], edi
call ebx
sub esp, 8
mov dword [ebp - 0x4c4], eax
mov dword [esp + 4], str.Thread32Next
mov dword [esp], edi
call ebx
sub esp, 8
mov dword [ebp - 0x4b8], eax
mov dword [esp + 4], str.Module32First
mov dword [esp], edi
call ebx
sub esp, 8
mov dword [ebp - 0x4c8], eax
mov dword [esp + 4], str.Module32Next
mov dword [esp], edi
call ebx
sub esp, 8
test esi, esi
mov dword [ebp - 0x4bc], eax
jne 0x4820a3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
sub esp, 4
call fcn.00481bc0
lea eax, [ebp - 0x23c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea eax, [ebp - 0x23c]
sub esp, 4
fld1
fst qword [esp + 8]
mov dword [esp], eax
mov dword [esp + 4], 0x20
fstp dword [ebp - 0x4a0]
call fcn.00433430
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], 4
mov dword [ebp - 0x48c], eax
mov eax, dword [ebp - 0x49c]
fld dword [ebp - 0x4a0]
fstp qword [esp + 8]
mov dword [esp], eax
call fcn.00433430
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [ebp - 0x4a4]
test ebx, ebx
je 0x482025
mov ecx, dword [ebp - 0x4a8]
test ecx, ecx
je 0x482025
mov edx, dword [ebp - 0x4b4]
test edx, edx
je 0x482025
mov ebx, dword [ebp - 0x4ac]
test ebx, ebx
je 0x482025
mov ecx, dword [ebp - 0x4c0]
test ecx, ecx
je 0x482025
mov edx, dword [ebp - 0x4b0]
test edx, edx
je 0x482025
mov ebx, dword [ebp - 0x4c4]
test ebx, ebx
je 0x482025
mov ecx, dword [ebp - 0x4b8]
test ecx, ecx
je 0x482025
mov edx, dword [ebp - 0x4c8]
test edx, edx
je 0x482025
test eax, eax
je 0x482025
mov dword [esp + 4], 0
mov dword [esp], 0xf
call esi
sub esp, 8
cmp eax, 0xffffffff
mov dword [ebp - 0x4d0], eax
je 0x482025
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x480], 0
mov dword [ebp - 0x47c], 0
test eax, eax
mov dword [ebp - 0x488], 0x10
mov dword [ebp - 0x4d4], 0
jne 0x48275e
lea eax, [ebp - 0x488]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4d0]
mov dword [esp], eax
call dword [ebp - 0x4b4]
sub esp, 8
test eax, eax
je 0x48273b
lea esi, [ebp - 0x45c]
mov dword [ebp - 0x4b4], edi
lea esi, [esi]
mov eax, dword [ebp - 0x488]
fld dword [0x4e3388]
fstp qword [esp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x488]
mov dword [esp], eax
call fcn.00433430
mov eax, dword [ebp - 0x480]
mov dword [ebp - 0x45c], 0x24
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x484]
mov dword [esp + 4], eax
call dword [ebp - 0x4a4]
sub esp, 0xc
test eax, eax
je 0x48224d
mov ebx, 0x50
mov edi, dword [ebp - 0x4a8]
jmp 0x482225
sub ebx, 1
je 0x48224d
mov eax, dword [ebp - 0x45c]
fld dword [0x4e338c]
fstp qword [esp + 8]
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.00433430
mov dword [esp], esi
call edi
sub esp, 4
test eax, eax
jne 0x482220
lea eax, [ebp - 0x488]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4d0]
mov dword [esp], eax
call dword [ebp - 0x4ac]
sub esp, 8
test eax, eax
je 0x482735
mov eax, dword [ebp - 0x4a0]
test eax, eax
je 0x4821c0
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
sub eax, dword [ebp - 0x4d4]
cmp eax, 0x3e7
jbe 0x4821c0
mov edi, dword [ebp - 0x4b4]
mov edx, ebx
mov dword [ebp - 0x364], 0x128
call edx
mov dword [ebp - 0x4d4], eax
mov eax, dword [ebp - 0x4d0]
lea ebx, [ebp - 0x364]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [ebp - 0x4c0]
sub esp, 8
test eax, eax
jne 0x482590
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x478], 0x1c
test eax, eax
jne 0x48277a
mov eax, dword [ebp - 0x4d0]
lea ebx, [ebp - 0x478]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [ebp - 0x4c4]
sub esp, 8
test eax, eax
jne 0x482672
mov ecx, dword [ebp - 0x4a0]
mov dword [ebp - 0x23c], 0x224
test ecx, ecx
jne 0x48276f
lea eax, [ebp - 0x23c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4d0]
mov dword [esp], eax
call dword [ebp - 0x4c8]
sub esp, 8
test eax, eax
jne 0x482620
mov edx, dword [ebp - 0x4cc]
test edx, edx
je 0x482785
mov eax, dword [ebp - 0x4d0]
mov dword [esp], eax
call dword [ebp - 0x4cc]
sub esp, 4
jmp 0x482025
mov eax, dword [ebp - 0x4a0]
test eax, eax
je 0x481cf3
lea eax, [ebp - 0x23c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LanmanWorkstation
mov dword [esp], 0
call dword [ebp - 0x4a0]
sub esp, 0x14
test eax, eax
je 0x482556
lea eax, [ebp - 0x23c]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LanmanServer
mov dword [esp], 0
call dword [ebp - 0x4a0]
sub esp, 0x14
test eax, eax
jne 0x481cf3
mov eax, dword [ebp - 0x23c]
fld dword [0x4e337c]
fstp qword [esp + 8]
mov dword [esp + 4], 0x44
mov dword [esp], eax
call fcn.00433430
mov eax, dword [ebp - 0x23c]
mov dword [esp], eax
call dword [ebp - 0x4a4]
sub esp, 4
jmp 0x481cf3
call fcn.0042a2d0
test eax, eax
je 0x481dfe
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x49c], eax
jmp 0x481f0f
cmp dword [ebp - 0x3f4], 4
jbe 0x481ec5
jmp 0x481ea1
mov dword [ebp - 0x4a0], 0
jmp 0x481de5
mov eax, dword [ebp - 0x23c]
fld dword [0x4e3384]
fstp qword [esp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x23c]
mov dword [esp], eax
call fcn.00433430
lea eax, [ebp - 0x48c]
test esi, esi
mov dword [ebp - 0x49c], eax
jne 0x481ed5
jmp 0x481f03
mov eax, dword [ebp - 0x490]
lea edx, [ebp - 0x438]
mov dword [esp + 8], edx
mov dword [ebp - 0x4a4], edx
mov dword [esp + 4], 0x40
mov dword [esp], eax
call dword [ebp - 0x4a8]
mov edx, dword [ebp - 0x4a4]
sub esp, 0xc
test eax, eax
jne 0x4826e4
mov eax, dword [ebp - 0x490]
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
sub esp, 8
jmp 0x481de5
mov eax, dword [ebp - 0x490]
lea edx, [ebp - 0x438]
mov dword [esp + 8], edx
mov dword [ebp - 0x4ac], edx
mov dword [esp + 4], 0x40
mov dword [esp], eax
call dword [ebp - 0x4a8]
mov edx, dword [ebp - 0x4ac]
sub esp, 0xc
test eax, eax
jne 0x482710
mov eax, dword [ebp - 0x490]
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
sub esp, 8
jmp 0x481dab
mov eax, dword [ebp - 0x23c]
fld dword [0x4e3378]
fstp qword [esp + 8]
mov dword [esp + 4], 0xd8
mov dword [esp], eax
call fcn.00433430
mov eax, dword [ebp - 0x23c]
mov dword [esp], eax
call dword [ebp - 0x4a4]
sub esp, 4
jmp 0x4823bb
mov eax, dword [ebp - 0x364]
fld dword [0x4e3390]
fstp qword [esp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00433430
mov eax, dword [ebp - 0x4d0]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [ebp - 0x4b0]
sub esp, 8
test eax, eax
je 0x4822d6
mov eax, dword [ebp - 0x4a0]
test eax, eax
je 0x482590
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [ebp - 0x4d4]
cmp eax, 0x3e7
jbe 0x482590
mov edx, esi
mov dword [ebp - 0x478], 0x1c
call edx
mov dword [ebp - 0x4d4], eax
jmp 0x4822ee
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x4d4]
cmp eax, 0x3e7
ja 0x48234e
lea esi, [esi]
mov eax, dword [ebp - 0x23c]
fld dword [0x4e3390]
fstp qword [esp + 8]
mov dword [esp + 4], eax
lea eax, [ebp - 0x23c]
mov dword [esp], eax
call fcn.00433430
lea eax, [ebp - 0x23c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x4d0]
mov dword [esp], eax
call dword [ebp - 0x4bc]
sub esp, 8
test eax, eax
je 0x48234e
mov eax, dword [ebp - 0x4a0]
test eax, eax
je 0x482620
jmp 0x482602
mov eax, dword [ebp - 0x478]
fld dword [0x4e3394]
fstp qword [esp + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00433430
mov eax, dword [ebp - 0x4d0]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [ebp - 0x4b8]
sub esp, 8
test eax, eax
je 0x482312
mov esi, dword [ebp - 0x4a0]
test esi, esi
je 0x482672
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
sub eax, dword [ebp - 0x4d4]
cmp eax, 0x3e7
jbe 0x482672
mov edx, esi
mov dword [ebp - 0x23c], 0x224
call edx
mov dword [ebp - 0x4d4], eax
jmp 0x48232a
fld dword [0x4e3380]
fstp qword [esp + 8]
mov dword [esp + 4], 0x40
mov dword [esp], edx
call fcn.00433430
mov dword [ebp - 0x4a0], 1
jmp 0x4824e8
fldz
fstp qword [esp + 8]
mov dword [esp + 4], 0x40
mov dword [esp], edx
call fcn.00433430
mov dword [ebp - 0x4a0], 1
jmp 0x48253b
mov edi, dword [ebp - 0x4b4]
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x364], 0x128
test eax, eax
je 0x4822b2
mov edx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x4822aa
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x4d4], eax
jmp 0x48218c
mov edx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x4826d7
mov edx, dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x4825f5
mov eax, dword [ebp - 0x4d0]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
sub esp, 4
jmp 0x482025