Function at 0x54e800
Capabilities:
Check for time delay via gettickcount
Get memory capacity
Link many functions at runtime

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x50c
mov dword [esp + 0x60], 0
mov dword [esp + 0x120], 0x94
lea eax, [esp + 0x120]
mov dword [esp], eax
call sub.KERNEL32.dll_GetVersionExA
push eax
mov dword [esp], str.ADVAPI32.DLL
call sub.KERNEL32.dll_LoadLibraryA
push edx
mov ebx, eax
mov dword [esp], 0x610455
call sub.KERNEL32.dll_LoadLibraryA
push ecx
mov ebp, eax
mov dword [esp], str.NETAPI32.DLL
call sub.KERNEL32.dll_LoadLibraryA
push esi
mov esi, eax
test eax, eax
je 0x54e90b
mov dword [esp + 4], str.NetStatisticsGet
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
mov dword [esp + 4], str.NetApiBufferFree
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x28], eax
test edi, edi
je 0x54e902
test eax, eax
je 0x54e902
lea edx, [esp + 0x68]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LanmanWorkstation
mov dword [esp], 0
mov dword [esp + 0x20], edx
call edi
sub esp, 0x14
test eax, eax
mov edx, dword [esp + 0x20]
je 0x54efd0
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.LanmanServer
mov dword [esp], 0
call edi
sub esp, 0x14
test eax, eax
je 0x54f010
mov dword [esp], esi
call sub.KERNEL32.dll_FreeLibrary
push ecx
test ebx, ebx
je 0x54ef80
mov dword [esp + 4], str.CryptAcquireContextW
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov esi, eax
mov dword [esp + 4], str.CryptGenRandom
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
mov dword [esp + 4], str.CryptReleaseContext
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x2c], eax
test esi, esi
je 0x54ef60
test edi, edi
je 0x54ef60
test eax, eax
je 0x54ef60
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [esp + 0x60]
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
jne 0x54f050
mov dword [esp + 0x30], 0
lea eax, [esp + 0xe0]
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x16
mov dword [esp + 8], str.Intel_Hardware_Cryptographic_Service_Provider
mov dword [esp + 4], 0
lea eax, [esp + 0x60]
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
jne 0x54f200
mov dword [esp], ebx
call sub.KERNEL32.dll_FreeLibrary
push edx
cmp dword [esp + 0x130], 2
je 0x54ef40
mov dword [esp], str.USER32.DLL
call sub.KERNEL32.dll_LoadLibraryA
push edi
mov ebx, eax
test eax, eax
je 0x54ef4d
mov dword [esp + 4], str.GetForegroundWindow
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 4], str.GetCursorInfo
mov dword [esp], ebx
mov dword [esp + 0x20], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov esi, eax
mov dword [esp + 4], str.GetQueueStatus
mov dword [esp], ebx
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
mov edx, dword [esp + 0x20]
test edx, edx
je 0x54ea88
call edx
mov dword [esp + 0x68], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 4
lea eax, [esp + 0x68]
mov dword [esp], eax
call fcn.004bf370
test esi, esi
je 0x54eac2
cmp dword [esp + 0x130], 2
je 0x54f240
mov dword [esp + 0x8c], 0x14
lea edx, [esp + 0x8c]
mov dword [esp], edx
mov dword [esp + 0x20], edx
call esi
push esi
test eax, eax
mov edx, dword [esp + 0x20]
jne 0x54f260
test edi, edi
je 0x54f1f0
mov dword [esp], 0xbf
call edi
push esi
mov dword [esp + 0x64], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x3ff00000
mov dword [esp + 4], 4
lea eax, [esp + 0x64]
mov dword [esp + 0x2c], eax
mov dword [esp], eax
call fcn.004bf370
mov dword [esp], ebx
call sub.KERNEL32.dll_FreeLibrary
push ecx
test ebp, ebp
je 0x54ee89
mov dword [esp + 4], 0x6105a4
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edi, eax
mov dword [esp + 4], str.CloseToolhelp32Snapshot
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x58], eax
mov dword [esp + 4], str.Heap32First
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x34], eax
mov dword [esp + 4], str.Heap32Next
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov esi, eax
mov dword [esp + 4], str.Heap32ListFirst
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov ebx, eax
mov dword [esp + 4], str.Heap32ListNext
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x38], eax
mov dword [esp + 4], str.Process32First
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x40], eax
mov dword [esp + 4], str.Process32Next
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x44], eax
mov dword [esp + 4], str.Thread32First
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x48], eax
mov dword [esp + 4], str.Thread32Next
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x4c], eax
mov dword [esp + 4], 0x610643
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x50], eax
mov dword [esp + 4], 0x610651
mov dword [esp], ebp
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 0x54], eax
test edi, edi
je 0x54ee80
mov edx, dword [esp + 0x34]
test edx, edx
je 0x54ee80
test esi, esi
je 0x54ee80
test ebx, ebx
je 0x54ee80
mov ecx, dword [esp + 0x38]
test ecx, ecx
je 0x54ee80
mov edx, dword [esp + 0x40]
test edx, edx
je 0x54ee80
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x54ee80
mov edx, dword [esp + 0x48]
test edx, edx
je 0x54ee80
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x54ee80
mov edx, dword [esp + 0x50]
test edx, edx
je 0x54ee80
test eax, eax
je 0x54ee80
mov dword [esp + 4], 0
mov dword [esp], 0xf
call edi
sub esp, 8
mov dword [esp + 0x3c], eax
inc eax
je 0x54ee80
lea eax, [esp + 0x7c]
mov dword [esp + 0x24], eax
mov ecx, 4
xor eax, eax
mov edi, dword [esp + 0x24]
rep stosd dword es:[edi], eax
mov dword [esp + 0x7c], 0x10
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x54f3ba
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x7c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call ebx
sub esp, 8
test eax, eax
je 0x54f0a0
lea edi, [esp + 0xbc]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40080000
mov eax, dword [esp + 0x7c]
mov dword [esp + 4], eax
lea eax, [esp + 0x7c]
mov dword [esp], eax
call fcn.004bf370
mov dword [esp + 0xbc], 0x24
mov eax, dword [esp + 0x84]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [esp + 0x34]
sub esp, 0xc
test eax, eax
je 0x54eda0
mov ebx, 0x50
jmp 0x54ed73
dec ebx
je 0x54eda0
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40140000
mov eax, dword [esp + 0xbc]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004bf370
mov dword [esp], edi
call esi
push edx
test eax, eax
jne 0x54ed70
lea eax, [esp + 0x7c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x38]
sub esp, 8
test eax, eax
je 0x54f0a0
mov eax, dword [esp + 0x30]
test eax, eax
je 0x54ed10
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [esp + 0x5c]
cmp eax, 0x3e7
jbe 0x54ed10
mov dword [esp + 0x1b4], 0x128
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x5c], eax
jmp 0x54f0b7
mov dword [esp + 0x30], ebp
mov ebp, dword [esp + 0x5c]
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x3c]
mov esi, esi
lea edi, [edi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40220000
mov eax, dword [esp + 0x2dc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bf370
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
je 0x54ee51
call sub.KERNEL32.dll_GetTickCount
sub eax, ebp
cmp eax, 0x3e7
jbe 0x54ee10
mov ebp, dword [esp + 0x30]
lea esi, [esi]
lea edi, [edi]
mov eax, dword [esp + 0x58]
test eax, eax
je 0x54f43e
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x58]
push eax
nop
lea esi, [esi]
mov dword [esp], ebp
call sub.KERNEL32.dll_FreeLibrary
push eax
mov eax, dword [0x5a1c60]
test eax, eax
jne 0x54efa0
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x6c], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 4
lea eax, [esp + 0x6c]
mov dword [esp], eax
call fcn.004bf370
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call sub.KERNEL32.dll_GlobalMemoryStatus
push eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x3ff00000
mov dword [esp + 4], 0x20
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.004bf370
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [esp + 0x64], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x3ff00000
mov dword [esp + 4], 4
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call fcn.004bf370
mov eax, 1
add esp, 0x50c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.004d2a50
test eax, eax
je 0x54e9fe
lea eax, [esp + 0x64]
mov dword [esp + 0x2c], eax
jmp 0x54eb09
mov dword [esp + 0x30], 0
lea eax, [esp + 0xe0]
mov dword [esp + 0x28], eax
jmp 0x54e9e7
mov dword [esp + 0x30], 0
lea eax, [esp + 0xe0]
mov dword [esp + 0x28], eax
jmp 0x54e9f0
lea ebx, [esp + 0x70]
mov dword [esp], ebx
call sub.KERNEL32.dll_QueryPerformanceCounter
push ebp
test eax, eax
jne 0x54f290
mov dword [0x5a1c60], 0
jmp 0x54ee96
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40468000
mov dword [esp + 4], 0xd8
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.004bf370
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call dword [esp + 0x28]
push eax
mov edx, dword [esp + 0x20]
jmp 0x54e8d2
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40310000
mov dword [esp + 4], 0x44
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call fcn.004bf370
mov eax, dword [esp + 0x68]
mov dword [esp], eax
call dword [esp + 0x28]
push eax
jmp 0x54e902
lea eax, [esp + 0xe0]
mov dword [esp + 0x28], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
jne 0x54f333
mov dword [esp + 0x30], 0
mov dword [esp + 4], 0
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [esp + 0x2c]
sub esp, 8
jmp 0x54e9b3
mov dword [esp + 0x1b4], 0x128
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x54ede9
lea ebx, [esp + 0x1b4]
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x40]
sub esp, 8
test eax, eax
jne 0x54f2d0
mov dword [esp + 0xa0], 0x1c
mov ebx, dword [esp + 0x30]
test ebx, ebx
jne 0x54f430
lea ebx, [esp + 0xa0]
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x48]
sub esp, 8
test eax, eax
je 0x54f395
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x54f450
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x3c]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40180000
mov eax, dword [esp + 0xa0]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bf370
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
jne 0x54f130
mov dword [esp + 0x2dc], 0x224
lea ebx, [esp + 0x2dc]
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x50]
sub esp, 8
test eax, eax
je 0x54ee60
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x54edf7
mov esi, dword [esp + 0x54]
mov edi, dword [esp + 0x3c]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40220000
mov eax, dword [esp + 0x2dc]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bf370
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
jne 0x54f1b0
jmp 0x54ee60
lea eax, [esp + 0x64]
mov dword [esp + 0x2c], eax
jmp 0x54eb00
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x40
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call edi
sub esp, 0xc
test eax, eax
jne 0x54f364
mov dword [esp + 4], 0
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dword [esp + 0x2c]
sub esp, 8
jmp 0x54e9e7
cmp dword [esp + 0x124], 4
jbe 0x54eac2
jmp 0x54ea9a
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40000000
mov eax, dword [esp + 0x8c]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.004bf370
jmp 0x54eac2
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 8
mov dword [esp], ebx
call fcn.004bf370
mov edi, dword [0x5a1c60]
test edi, edi
jne 0x54eec3
jmp 0x54ee96
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x54f3c8
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
lea esi, [esi]
lea edi, [edi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40220000
mov eax, dword [esp + 0x1b4]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bf370
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
jne 0x54f2f0
mov dword [esp + 0xa0], 0x1c
jmp 0x54f0ef
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x40
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.004bf370
mov dword [esp + 0x30], 1
jmp 0x54f083
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40500000
mov dword [esp + 4], 0x40
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call fcn.004bf370
mov dword [esp + 0x30], 1
jmp 0x54f224
mov dword [esp + 0x2dc], 0x224
mov edx, dword [esp + 0x30]
test edx, edx
je 0x54f16e
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x5c], eax
jmp 0x54f16e
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x5c], eax
jmp 0x54ece3
mov dword [esp + 0x34], ebp
mov ebp, dword [esp + 0x5c]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
nop
lea esi, [esi]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40220000
mov eax, dword [esp + 0x1b4]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bf370
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
je 0x54f421
call sub.KERNEL32.dll_GetTickCount
sub eax, ebp
cmp eax, 0x3e7
jbe 0x54f3e0
mov ebp, dword [esp + 0x34]
mov dword [esp + 0xa0], 0x1c
call sub.KERNEL32.dll_GetTickCount
mov dword [esp + 0x5c], eax
jmp 0x54f0ef
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
jmp 0x54ee80
mov dword [esp + 0x34], ebp
mov ebp, dword [esp + 0x5c]
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x3c]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x40180000
mov eax, dword [esp + 0xa0]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004bf370
mov dword [esp + 4], ebx
mov dword [esp], edi
call esi
sub esp, 8
test eax, eax
je 0x54f4a1
call sub.KERNEL32.dll_GetTickCount
sub eax, ebp
cmp eax, 0x3e7
jbe 0x54f460
mov ebp, dword [esp + 0x34]
mov dword [esp + 0x2dc], 0x224
jmp 0x54f3ac