Function at 0x401c3c
Capabilities:
Get memory capacity
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
mov eax, 0x50f644
push ebx
push esi
push edi
mov edi, 0x54f9fc
mov esi, 0x50f420
call fcn.004e1410
xor ebx, ebx
push 0xa0
call fcn.004d7228
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x401c90
mov word [ebp - 0x18], 0x24
push 0
lea edx, [esi + 0x56]
push edx
mov ecx, dword [ebp - 4]
push ecx
call fcn.00412424
add esp, 0xc
mov word [ebp - 0x18], 0xc
mov ecx, dword [ebp - 4]
jmp 0x401c93
mov ecx, dword [ebp - 4]
mov dword [edi], ecx
mov eax, dword [edi]
push eax
call fcn.004124fc
pop ecx
lea edx, [esi + 0x9c]
push edx
lea ecx, [esi + 0x90]
push ecx
lea eax, [esi + 0x87]
push eax
lea edx, [esi + 0x62]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004125e8
add esp, 0x14
lea eax, [esi + 0xa5]
push 0x51fbb8
push eax
mov edx, dword [edi]
push edx
call fcn.004125e8
add esp, 0xc
cmp dword [0x51fcbc], 3
jne 0x401cea
lea ecx, [esi + 0xc5]
jmp 0x401cf0
lea ecx, [esi + 0xcb]
push ecx
lea eax, [esi + 0xaf]
push eax
mov edx, dword [edi]
push edx
call fcn.004125e8
add esp, 0xc
mov ecx, dword [0x51fcc0]
push ecx
lea eax, [esi + 0xd0]
push eax
mov edx, dword [edi]
push edx
call fcn.004125e8
add esp, 0xc
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], 0x40
push ecx
call sub.KERNEL32.DLL_GlobalMemoryStatusEx
push dword [ebp - 0x6c]
push dword [ebp - 0x70]
lea edx, [esi + 0xe6]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004125e8
add esp, 0x10
lea edx, [esi + 0x100]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push edx
mov ecx, dword [edi]
push ecx
call fcn.004125e8
add esp, 0x10
cmp dword [0x51fce0], 0
jne 0x401e0d
mov dword [ebp - 0x2c], 0xbb8
lea eax, [ebp - 0x30]
push eax
mov edx, dword [0x51fcd8]
mov ecx, dword [edx + 0x60]
push ecx
push reloc.WS2_32.DLL_bind
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x401dee
mov dword [ebp - 0x38], 4
mov eax, dword [0x51fcd8]
lea ecx, [esi + 0x11a]
mov edx, dword [eax + 0x64]
push edx
push ecx
mov eax, dword [edi]
push eax
call fcn.004125e8
add esp, 0xc
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 0x34]
push edx
push ecx
push eax
push 0
mov edx, dword [0x51fcd8]
mov ecx, dword [edx + 0x64]
push ecx
mov eax, dword [ebp - 0x30]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x401de5
mov edx, dword [ebp - 0x2c]
shl edx, 3
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
lea edx, [edx + edx*4]
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x30]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x2c]
lea edx, [esi + 0x123]
push eax
push edx
mov ecx, dword [edi]
push ecx
call fcn.004125e8
add esp, 0xc
mov eax, dword [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_Sleep
push 0
mov edx, dword [edi]
push edx
call fcn.004126fc
add esp, 8
mov ecx, dword [0x51fce0]
push ecx
mov eax, dword [edi]
push eax
call fcn.00412718
add esp, 8
cmp dword [0x51fce0], 0
je 0x401e3a
jmp 0x401f92
call fcn.0040f5b0
mov dword [0x51fce0], eax
mov edx, dword [0x51fce0]
push edx
mov ecx, dword [edi]
push ecx
call fcn.00412718
add esp, 8
cmp dword [0x51fce0], 0
je 0x401e64
jmp 0x401f92
call fcn.00404714
push 0x5dc
mov eax, dword [edi]
push eax
call fcn.004126fc
add esp, 8
mov edx, dword [0x51fcd8]
mov ecx, dword [edx + 0x68]
push ecx
push 0
push 0x100002
call sub.KERNEL32.DLL_OpenEventA
mov dword [0x5202b0], eax
cmp dword [0x5202b0], 0
jne 0x401ea2
jmp 0x401f92
push 0x640
mov eax, dword [edi]
push eax
call fcn.004126fc
add esp, 8
mov edx, dword [0x51fcd8]
mov ecx, dword [edx + 0x6c]
push ecx
push 0
push 0x100002
call sub.KERNEL32.DLL_OpenEventA
mov dword [0x5202b4], eax
cmp dword [0x5202b0], 0
jne 0x401edb
jmp 0x401f92
push 0x6a4
mov eax, dword [edi]
push eax
call fcn.004126fc
add esp, 8
mov dl, 1
mov eax, dword [0x50f988]
call fcn.00401fcc
mov ebx, eax
mov dword [0x51fba4], ebx
mov dl, 2
mov eax, ebx
call fcn.0042f6b8
mov eax, dword [0x51fba4]
call fcn.0042ff98
push 0x708
mov edx, dword [edi]
push edx
call fcn.004126fc
add esp, 8
mov dl, 1
mov eax, dword [0x50f914]
call fcn.00402020
mov ebx, eax
mov dword [0x51fba8], ebx
mov dl, 2
mov eax, ebx
call fcn.0042f6b8
mov eax, dword [0x51fba8]
call fcn.0042ff98
push 0x76c
mov edx, dword [edi]
push edx
call fcn.004126fc
add esp, 8
call fcn.00401860
mov ecx, dword [sym.PhantosysServerService.exe__PhantosysSService]
mov dl, 1
mov eax, dword [ecx]
mov eax, dword [eax + 0xf8]
call fcn.004a5958
mov byte [0x510daa], 1
mov ecx, dword [0x54fa04]
cmp dword [ecx + 4], 0
je 0x401f90
push 0x5dc
call sub.KERNEL32.DLL_Sleep
mov bl, 1
lea eax, [esi + 0x133]
push eax
mov edx, dword [edi]
push edx
call fcn.004125e8
add esp, 8
push 3
mov ecx, dword [edi]
push ecx
call fcn.004124c8
add esp, 8
push 1
call fcn.0040b418
pop ecx
mov eax, ebx
mov edx, dword [ebp - 0x28]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret