Function at 0x46ed00
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov eax, dword [0x62e040]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x1a
push eax
mov dword [esp + 0x20], str.IconTrayGuids
call sym.SystemInformer.exe_PhGetStringRefSetting
mov ebx, eax
mov dword [esp + 0x28], ebx
test ebx, ebx
je 0x46edfc
cmp dword [ebx], 0
je 0x46edfc
mov eax, dword [ebx]
mov esi, 0x637e20
mov ecx, dword [ebx + 4]
mov edi, 0xa
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
nop
cmp dword [esp + 0x10], 0
je 0x46eddf
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x7c
lea eax, [esp + 0x1c]
push eax
call sym.SystemInformer.exe_PhSplitStringRefAtChar
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x46eddf
mov word ds:[esp + 0x20], cx
lea eax, [ecx + 2]
mov word [esp + 0x22], ax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
cmp ecx, 0xfffe
ja 0x46edd9
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.ntdll.dll_RtlGUIDFromString]
test eax, eax
js 0x46edd9
mov eax, dword [esp + 0x2c]
mov dword [esi], eax
mov eax, dword [esp + 0x30]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 0xc], eax
jmp 0x46eddf
push esi
call sym.SystemInformer.exe_PhGenerateGuid
add esi, 0x10
sub edi, 1
jne 0x46ed60
lea ecx, [ebx - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jmp 0x46ef74
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x20], 0x64
push eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x64
call sym.SystemInformer.exe_PhCreateString3
xor ecx, ecx
mov dword [esp + 0x1c], eax
mov esi, 0x637e20
or edi, 0xffffffff
mov dword [eax], 0
mov eax, dword [eax + 4]
lea ebx, [ecx + 0xa]
mov word [eax], cx
push esi
call sym.SystemInformer.exe_PhGenerateGuid
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlStringFromGUID]
test eax, eax
js 0x46eeed
mov eax, dword [esp + 0x10]
test ax, ax
jne 0x46ee6c
call sym.SystemInformer.exe_PhReferenceEmptyString
jmp 0x46ee89
movzx ecx, ax
mov eax, dword [esp + 0x14]
push 0
mov dword [esp + 0x34], eax
lea eax, [esp + 0x30]
push 0
push eax
mov dword [esp + 0x38], ecx
call sym.SystemInformer.exe_PhCreateString3
mov edi, eax
mov eax, dword [esp + 0x14]
test eax, eax
je 0x46eeb8
push eax
mov eax, dword fs:[0x18]
push 0
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
test edi, edi
je 0x46eeea
push dword [edi + 4]
lea eax, [esp + 0x1c]
push 0x607028
push eax
call sym.SystemInformer.exe_PhAppendFormatStringBuilder
lea ecx, ds:[edi - 8]
add esp, 0xc
or edi, 0xffffffff
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x46eeed
call fcn.004fc020
jmp 0x46eeed
or edi, 0xffffffff
add esi, 0x10
sub ebx, 1
jne 0x46ee42
mov esi, dword ds:[esp + 0x1c]
mov ebx, dword [esi]
test ebx, ebx
je 0x46ef36
mov ecx, dword ds:[esi + 4]
mov edx, ebx
and edx, 0xfffffffe
sub edx, 2
add ecx, edx
sub ebx, edx
sub ebx, 2
push ebx
lea eax, [ecx + 2]
push eax
push ecx
call fcn.005823b0
add dword [esi], 0xfffffffe
add esp, 0xc
mov ecx, dword [esi]
xor edx, edx
mov eax, dword [esi + 4]
mov word [ecx + eax], dx
mov eax, dword [esp + 0x28]
test eax, eax
je 0x46ef50
lea ecx, [eax - 8]
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x46ef50
call fcn.004fc020
push esi
lea eax, [esp + 0x30]
mov dword [esp + 0x30], 0x1a
push eax
mov dword [esp + 0x38], str.IconTrayGuids
call sym.SystemInformer.exe_PhSetStringRefSetting
lea ecx, [esi - 8]
lock xadd dword [ecx + 4], edi
dec edi
jne 0x46ef7b
call fcn.004fc020
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005802ef
mov esp, ebp
pop ebp
ret