Function at 0x46d460
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1a
push eax
mov dword [esp + 0x1c], str.IconTrayGuids
call sym.SystemInformer.exe_PhGetStringRefSetting
mov ebx, eax
mov dword [esp + 0x24], ebx
test ebx, ebx
je 0x46d55c
cmp dword [ebx], 0
je 0x46d55c
mov eax, dword [ebx]
mov esi, 0x636580
mov ecx, dword [ebx + 4]
mov edi, 0xa
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
nop
cmp dword [esp + 0xc], 0
je 0x46d53f
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x18]
push eax
push 0x7c
lea eax, [esp + 0x18]
push eax
call sym.SystemInformer.exe_PhSplitStringRefAtChar
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x46d53f
mov word ds:[esp + 0x1c], cx
lea eax, [ecx + 2]
mov word [esp + 0x1e], ax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
cmp ecx, 0xfffe
ja 0x46d539
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ntdll.dll_RtlGUIDFromString]
test eax, eax
js 0x46d539
mov eax, dword [esp + 0x2c]
mov dword [esi], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0xc], eax
jmp 0x46d53f
push esi
call sym.SystemInformer.exe_PhGenerateGuid
add esi, 0x10
sub edi, 1
jne 0x46d4c0
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jmp 0x46d6d4
push 0
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x1c], 0x64
push eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0x64
call sym.SystemInformer.exe_PhCreateString3
xor ecx, ecx
mov dword [esp + 0x18], eax
mov esi, 0x636580
or edi, 0xffffffff
mov dword [eax], 0
mov eax, dword [eax + 4]
lea ebx, [ecx + 0xa]
mov word [eax], cx
push esi
call sym.SystemInformer.exe_PhGenerateGuid
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
js 0x46d64d
mov eax, dword [esp + 0xc]
test ax, ax
jne 0x46d5cc
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x46d5e9
movzx ecx, ax
mov eax, dword [esp + 0x10]
push 0
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
push 0
push eax
mov dword [esp + 0x38], ecx
call sym.SystemInformer.exe_PhCreateString3
cmp dword [esp + 0x10], 0
mov edi, eax
je 0x46d61a
mov eax, dword fs:[0x18]
push dword [esp + 0x10]
push 0
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
test edi, edi
je 0x46d64a
push dword [edi + 4]
lea eax, [esp + 0x18]
push 0x606ad0
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
lea ecx, [edi - 8]
add esp, 0xc
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x46d64d
call fcn.004fbfa0
jmp 0x46d64d
or edi, 0xffffffff
add esi, 0x10
sub ebx, 1
jne 0x46d5a2
mov esi, dword ds:[esp + 0x18]
mov ebx, dword [esi]
test ebx, ebx
je 0x46d696
mov ecx, dword ds:[esi + 4]
mov edx, ebx
and edx, 0xfffffffe
sub edx, 2
add ecx, edx
sub ebx, edx
sub ebx, 2
push ebx
lea eax, [ecx + 2]
push eax
push ecx
call fcn.005831c0
add dword [esi], 0xfffffffe
add esp, 0xc
mov ecx, dword [esi]
xor edx, edx
mov eax, dword [esi + 4]
mov word [ecx + eax], dx
mov eax, dword [esp + 0x24]
test eax, eax
je 0x46d6b0
lea ecx, [eax - 8]
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x46d6b0
call fcn.004fbfa0
push esi
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x1a
push eax
mov dword [esp + 0x30], str.IconTrayGuids
call sym.SystemInformer.exe_PhSetStringRefSetting
lea ecx, [esi - 8]
lock xadd dword [ecx + 4], edi
dec edi
jne 0x46d6db
call fcn.004fbfa0
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057fcaf
mov esp, ebp
pop ebp
ret