Function at 0x54e4c3
Capabilities:
Check for time delay via gettickcount
Get memory capacity
Link many functions at runtime

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x50c
mov dword [esp + 0x60], 0
mov dword [esp + 0x120], 0x94
lea eax, [esp + 0x120]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
push eax
mov dword [esp], str.ADVAPI32.DLL
call sub.KERNEL32.dll_LoadLibraryA
push edx
mov ebx, eax
mov dword [esp], 0x610375
call sub.KERNEL32.dll_LoadLibraryA
push ecx
mov ebp, eax
mov dword [esp], str.NETAPI32.DLL
call sub.KERNEL32.dll_LoadLibraryA
push esi
mov esi, eax
test eax, eax
je 0x54e50b
mov dword [esp + 4], str.NetStatisticsGet
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
mov dword [esp + 4], str.NetApiBufferFree
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x28], eax
test edi, edi
je 0x54e502
test eax, eax
je 0x54e502
lea edx, [esp + 0x68]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LanmanWorkstation
mov dword [esp], 0
mov dword [esp + 0x20], edx
call edi
sub esp, 0x14
test eax, eax
mov edx, dword [esp + 0x20]
je 0x54ebd0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LanmanServer
mov dword [esp], 0
call edi
sub esp, 0x14
test eax, eax
je 0x54ec10
mov dword [esp], esi
call sub.KERNEL32.dll_FreeLibrary
push ecx
test ebx, ebx
je 0x54eb80
mov dword [esp + 4], str.CryptAcquireContextW
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov esi, eax
mov dword [esp + 4], str.CryptGenRandom
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
mov dword [esp + 4], str.CryptReleaseContext
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x2c], eax
test esi, esi
je 0x54eb60
test edi, edi
je 0x54eb60
test eax, eax
je 0x54eb60
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [esp + 0x60]
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
jne 0x54ec50
mov dword [esp + 0x30], 0
lea eax, [esp + 0xe0]
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x16
mov dword [esp + 8], str.Intel_Hardware_Cryptographic_Service_Provider
mov dword [esp + 4], 0
lea eax, [esp + 0x60]
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
jne 0x54ee00
mov dword [esp], ebx
call sub.KERNEL32.dll_FreeLibrary
push edx
cmp dword [esp + 0x130], 2
je 0x54eb40
mov dword [esp], str.USER32.DLL
call sub.KERNEL32.dll_LoadLibraryA
push edi
mov ebx, eax
test eax, eax
je 0x54eb4d
mov dword [esp + 4], str.GetForegroundWindow
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 4], str.GetCursorInfo
mov dword [esp], ebx
mov dword [esp + 0x20], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov esi, eax
mov dword [esp + 4], str.GetQueueStatus
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
mov edx, dword [esp + 0x20]
test edx, edx
je 0x54e688
call edx
mov dword [esp + 0x68], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 4
lea eax, [esp + 0x68]
mov dword [esp], eax
call fcn.004bef50
test esi, esi
je 0x54e6c2
cmp dword [esp + 0x130], 2
je 0x54ee40
mov dword [esp + 0x8c], 0x14
lea edx, [esp + 0x8c]
mov dword [esp], edx
mov dword [esp + 0x20], edx
call esi
push esi
test eax, eax
mov edx, dword [esp + 0x20]
jne 0x54ee60
test edi, edi
je 0x54edf0
mov dword [esp], 0xbf
call edi
push esi
mov dword [esp + 0x64], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x3ff00000
mov dword [esp + 4], 4
lea eax, [esp + 0x64]
mov dword [esp + 0x2c], eax
mov dword [esp], eax
call fcn.004bef50
mov dword [esp], ebx
call sub.KERNEL32.dll_FreeLibrary
push ecx
test ebp, ebp
je 0x54ea89
mov dword [esp + 4], 0x6104c4
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
mov dword [esp + 4], str.CloseToolhelp32Snapshot
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x58], eax
mov dword [esp + 4], str.Heap32First
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x34], eax
mov dword [esp + 4], str.Heap32Next
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov esi, eax
mov dword [esp + 4], str.Heap32ListFirst
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov ebx, eax
mov dword [esp + 4], str.Heap32ListNext
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x38], eax
mov dword [esp + 4], str.Process32First
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x40], eax
mov dword [esp + 4], str.Process32Next
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x44], eax
mov dword [esp + 4], str.Thread32First
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x48], eax
mov dword [esp + 4], str.Thread32Next
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x4c], eax
mov dword [esp + 4], 0x610563
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x50], eax
mov dword [esp + 4], 0x610571
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x54], eax
test edi, edi
je 0x54ea80
mov edx, dword [esp + 0x34]
test edx, edx
je 0x54ea80
test esi, esi
je 0x54ea80
test ebx, ebx
je 0x54ea80
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x54ea80
mov edx, dword [esp + 0x40]
test edx, edx
je 0x54ea80
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x54ea80
mov edx, dword [esp + 0x48]
test edx, edx
je 0x54ea80
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x54ea80
mov edx, dword [esp + 0x50]
test edx, edx
je 0x54ea80
test eax, eax
je 0x54ea80
mov dword [esp + 4], 0
mov dword [esp], 0xf
call edi
sub esp, 8
mov dword [esp + 0x3c], eax
inc eax
je 0x54ea80
lea eax, [esp + 0x7c]
mov dword [esp + 0x24], eax
mov ecx, 4
xor eax, eax
mov edi, dword [esp + 0x24]
rep stosd dword es:[edi], eax
mov dword [esp + 0x7c], 0x10
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x54efba
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x7c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x54eca0
lea edi, [esp + 0xbc]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40080000
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
lea eax, [esp + 0x7c]
mov dword [esp], eax
call fcn.004bef50
mov dword [esp + 0xbc], 0x24
mov eax, dword [esp + 0x84]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [esp + 0x34]
sub esp, 0xc
test eax, eax
je 0x54e9a0
mov ebx, 0x50
jmp 0x54e973
dec ebx
je 0x54e9a0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40140000
mov eax, dword [esp + 0xbc]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004bef50
mov dword [esp], edi
call esi
push edx
test eax, eax
jne 0x54e970
lea eax, [esp + 0x7c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x38]
sub esp, 8
test eax, eax
je 0x54eca0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x54e910
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [esp + 0x5c]
cmp eax, 0x3e7
jbe 0x54e910
mov dword [esp + 0x1b4], 0x128
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x5c], eax
jmp 0x54ecb7
mov dword [esp + 0x30], ebp
mov ebp, dword [esp + 0x5c]
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x3c]
mov esi, esi
lea edi, [edi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40220000
mov eax, dword [esp + 0x2dc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bef50
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
je 0x54ea51
call sub.KERNEL32.dll_GetTickCount
sub eax, ebp
cmp eax, 0x3e7
jbe 0x54ea10
mov ebp, dword [esp + 0x30]
lea esi, [esi]
lea edi, [edi]
mov eax, dword [esp + 0x58]
test eax, eax
je 0x54f03e
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x58]
push eax
nop
lea esi, [esi]
mov dword [esp], ebp
call sub.KERNEL32.dll_FreeLibrary
push eax
mov eax, dword [0x5a1c60]
test eax, eax
jne 0x54eba0
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x6c], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 4
lea eax, [esp + 0x6c]
mov dword [esp], eax
call fcn.004bef50
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalMemoryStatus
push eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x3ff00000
mov dword [esp + 4], 0x20
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.004bef50
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [esp + 0x64], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x3ff00000
mov dword [esp + 4], 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.004bef50
mov eax, 1
add esp, 0x50c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004d2650
test eax, eax
je 0x54e5fe
lea eax, [esp + 0x64]
mov dword [esp + 0x2c], eax
jmp 0x54e709
mov dword [esp + 0x30], 0
lea eax, [esp + 0xe0]
mov dword [esp + 0x28], eax
jmp 0x54e5e7
mov dword [esp + 0x30], 0
lea eax, [esp + 0xe0]
mov dword [esp + 0x28], eax
jmp 0x54e5f0
lea ebx, [esp + 0x70]
mov dword [esp], ebx
call sub.KERNEL32.dll_QueryPerformanceCounter
push ebp
test eax, eax
jne 0x54ee90
mov dword [0x5a1c60], 0
jmp 0x54ea96
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40468000
mov dword [esp + 4], 0xd8
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.004bef50
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call dword [esp + 0x28]
push eax
mov edx, dword [esp + 0x20]
jmp 0x54e4d2
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40310000
mov dword [esp + 4], 0x44
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.004bef50
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call dword [esp + 0x28]
push eax
jmp 0x54e502
lea eax, [esp + 0xe0]
mov dword [esp + 0x28], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
jne 0x54ef33
mov dword [esp + 0x30], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [esp + 0x2c]
sub esp, 8
jmp 0x54e5b3
mov dword [esp + 0x1b4], 0x128
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x54e9e9
lea ebx, [esp + 0x1b4]
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x40]
sub esp, 8
test eax, eax
jne 0x54eed0
mov dword [esp + 0xa0], 0x1c
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x54f030
lea ebx, [esp + 0xa0]
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x48]
sub esp, 8
test eax, eax
je 0x54ef95
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x54f050
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x3c]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40180000
mov eax, dword [esp + 0xa0]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bef50
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
jne 0x54ed30
mov dword [esp + 0x2dc], 0x224
lea ebx, [esp + 0x2dc]
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x50]
sub esp, 8
test eax, eax
je 0x54ea60
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x54e9f7
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x3c]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40220000
mov eax, dword [esp + 0x2dc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bef50
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
jne 0x54edb0
jmp 0x54ea60
lea eax, [esp + 0x64]
mov dword [esp + 0x2c], eax
jmp 0x54e700
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
jne 0x54ef64
mov dword [esp + 4], 0
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [esp + 0x2c]
sub esp, 8
jmp 0x54e5e7
cmp dword [esp + 0x124], 4
jbe 0x54e6c2
jmp 0x54e69a
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40000000
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004bef50
jmp 0x54e6c2
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 8
mov dword [esp], ebx
call fcn.004bef50
mov edi, dword [0x5a1c60]
test edi, edi
jne 0x54eac3
jmp 0x54ea96
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x54efc8
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40220000
mov eax, dword [esp + 0x1b4]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bef50
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
jne 0x54eef0
mov dword [esp + 0xa0], 0x1c
jmp 0x54ecef
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x40
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.004bef50
mov dword [esp + 0x30], 1
jmp 0x54ec83
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40500000
mov dword [esp + 4], 0x40
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.004bef50
mov dword [esp + 0x30], 1
jmp 0x54ee24
mov dword [esp + 0x2dc], 0x224
mov edx, dword [esp + 0x30]
test edx, edx
je 0x54ed6e
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x5c], eax
jmp 0x54ed6e
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x5c], eax
jmp 0x54e8e3
mov dword [esp + 0x34], ebp
mov ebp, dword [esp + 0x5c]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
nop
lea esi, [esi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40220000
mov eax, dword [esp + 0x1b4]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bef50
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
je 0x54f021
call sub.KERNEL32.dll_GetTickCount
sub eax, ebp
cmp eax, 0x3e7
jbe 0x54efe0
mov ebp, dword [esp + 0x34]
mov dword [esp + 0xa0], 0x1c
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x5c], eax
jmp 0x54ecef
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
jmp 0x54ea80
mov dword [esp + 0x34], ebp
mov ebp, dword [esp + 0x5c]
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x3c]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40180000
mov eax, dword [esp + 0xa0]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bef50
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
je 0x54f0a1
call sub.KERNEL32.dll_GetTickCount
sub eax, ebp
cmp eax, 0x3e7
jbe 0x54f060
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x2dc], 0x224
jmp 0x54efac