Function at 0x45f040
Capabilities:
Get cpu information
Get memory capacity
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x519100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
mov dword [ebp - 0x64], ebx
cmp dword [0x520588], esi
jne 0x45f074
lea ecx, [esi + 1]
call fcn.0045ee90
mov esi, eax
test esi, esi
jne 0x45f9e8
mov eax, dword [0x520588]
test eax, eax
je 0x45f084
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x52057c]
mov ecx, eax
inc eax
mov dword [0x52057c], eax
test ecx, ecx
jne 0x45f9cd
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x45f1a9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.IsWow64Process2
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
xor eax, eax
mov word [ebp - 8], ax
mov word [ebp - 0x1c], ax
test edi, edi
je 0x45f46c
lea eax, [ebp - 0x1c]
mov ecx, edi
push eax
lea eax, [ebp - 8]
push eax
push ebx
call dword [0x4cc2f8]
call edi
test eax, eax
je 0x45f46c
cmp word [ebp - 8], 0
mov ax, word [ebp - 0x1c]
je 0x45f102
mov word [0x52080c], ax
movzx eax, ax
cmp eax, 0x8664
ja 0x45f457
je 0x45f44d
cmp eax, 0x200
je 0x45f443
cmp eax, 0x284
jne 0x45f133
mov eax, 7
mov word [0x520808], ax
cmp word [0x52080c], 0
je 0x45f14e
push str.Wow64EnableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x52085c], eax
push str.GetLogicalProcessorInformationEx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x520828], eax
test eax, eax
jne 0x45f174
push str.GetLogicalProcessorInformation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x520824], eax
push 0x506efc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x5208b8], 0xf
jl 0x45f1a6
push str.PrefetchVirtualMemory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetCurrentThreadStackLimits
push esi
mov dword [0x520818], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [ebp - 0x64]
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x520814], eax
test eax, eax
je 0x45f369
push 0x506f68
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlInitUnicodeString
push dword [0x520814]
mov dword [0x520858], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtOpenFile
push dword [0x520814]
mov dword [0x520848], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtCreateFile
push dword [0x520814]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtReadFile
push dword [0x520814]
mov dword [0x520850], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtWriteFile
push dword [0x520814]
mov dword [0x52084c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationFile
push dword [0x520814]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationFile
push dword [0x520814]
mov dword [0x520840], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryVirtualMemory
push dword [0x520814]
mov dword [0x520844], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryObject
push dword [0x520814]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryVolumeInformationFile
push dword [0x520814]
mov dword [0x52083c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push dword [0x520814]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationThread
push dword [0x520814]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationThread
push dword [0x520814]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySystemInformation
push dword [0x520814]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryDirectoryFile
push dword [0x520814]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryEaFile
push dword [0x520814]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5070ec
push dword [0x520814]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtFsControlFile
push dword [0x520814]
mov dword [0x520830], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtDeviceIoControlFile
push dword [0x520814]
mov dword [0x52082c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtWaitForSingleObject
push dword [0x520814]
mov dword [0x520838], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x507128
push dword [0x520814]
mov dword [0x520834], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ed614
push 8
call fcn.00485060
mov esi, eax
add esp, 8
test esi, esi
je 0x45f9bc
push 0x18
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00484763
add esp, 4
mov dword [0x51fa20], esi
mov dword [eax], eax
push 0x4ed614
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
push 8
mov dword [esi], eax
call fcn.00485060
mov esi, eax
add esp, 8
test esi, esi
je 0x45f9ab
push 0x120
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00484763
add esp, 4
mov dword [0x51e9dc], esi
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
mov eax, dword [0x520814]
test eax, eax
je 0x45f6be
push str.RtlSetThreadErrorMode
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5207e8], eax
test eax, eax
jne 0x45f420
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5207f4], 0
jne 0x45f4c9
mov eax, dword [0x520814]
test eax, eax
jne 0x45f4ae
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x45f4c3
mov eax, 6
jmp 0x45f12d
mov eax, 9
jmp 0x45f12d
cmp eax, 0xaa64
jne 0x45f133
mov eax, 0xc
jmp 0x45f12d
push 0x506ea0
push esi
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x45f494
lea eax, [ebp - 0xc]
mov ecx, edi
push eax
push ebx
call dword [0x4cc2f8]
call edi
cmp dword [ebp - 0xc], 0
je 0x45f133
mov eax, 0x8664
mov word [0x52080c], ax
jmp 0x45f13d
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5207f4], eax
test eax, eax
jne 0x45f4c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x5207f0], 0
jne 0x45f500
mov eax, dword [0x520814]
test eax, eax
jne 0x45f4e5
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x45f4fa
push str.RtlPcToFileHeader
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5207f0], eax
test eax, eax
jne 0x45f500
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x520814]
test eax, eax
jne 0x45f513
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x45f528
push str.LdrLockLoaderLock
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5205c0], eax
test eax, eax
jne 0x45f52e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x520814]
test eax, eax
jne 0x45f541
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x45f556
push str.LdrUnlockLoaderLock
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5205bc], eax
test eax, eax
jne 0x45f55c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x520814]
test eax, eax
jne 0x45f56f
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x45f584
push str.NtQueryDirectoryFileEx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5207ec], eax
test eax, eax
jne 0x45f58a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x520814]
test eax, eax
jne 0x45f59d
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x45f5b2
push str.NtWow64QueryInformationProcess64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5207fc], eax
test eax, eax
jne 0x45f5b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x520814]
test eax, eax
jne 0x45f5cb
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x45f5e0
push str.NtWow64GetNativeSystemInformation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5207f8], eax
test eax, eax
jne 0x45f5e6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x520814]
test eax, eax
jne 0x45f5f9
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x45f60e
push str.NtWow64QueryVirtualMemory64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x520804], eax
test eax, eax
jne 0x45f614
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [0x520814]
test eax, eax
jne 0x45f627
push 0x7e
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x45f63c
push str.NtWow64ReadVirtualMemory64
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x520800], eax
test eax, eax
jne 0x45f642
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.00460650
test al, al
jne 0x45f681
cmp word [0x520808], 0
jne 0x45f681
mov esi, dword [0x5207f8]
test esi, esi
je 0x45f6be
push 0
push 0xc
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push 1
call dword [0x4cc2f8]
call esi
test eax, eax
jne 0x45f681
mov ax, word [ebp - 0x14]
mov word [0x520808], ax
mov esi, dword [0x5207f8]
test esi, esi
je 0x45f6be
push 0
push 0x2c
lea eax, [ebp - 0x4c]
mov ecx, esi
push eax
push 0
call dword [0x4cc2f8]
call esi
test eax, eax
jne 0x45f6be
mov eax, dword [ebp - 0x2c]
mov dword [0x519bd0], eax
movzx eax, byte [ebp - 0x24]
mov dword [0x519bd4], 0
mov dword [0x519be0], eax
and ebx, 1
mov dword [ebp - 0x64], ebx
jne 0x45f701
cmp word [0x5205ac], 0
mov ecx, 0x5205ac
mov eax, 0x501994
cmovne eax, ecx
sub esp, 0xc
lea ecx, [ebp - 0x40]
push str.aswSP
push 0x10
push ecx
push eax
call fcn.004625a0
add esp, 0x14
mov edx, eax
mov ecx, 0x520810
call fcn.004605a0
add esp, 8
cmp dword [0x519be0], 0
jne 0x45f714
mov dword [0x519be0], 1
sub esp, 8
call fcn.00460710
push 0
push 0x80000002
lea eax, [ebp - 0xc]
xorps xmm0, xmm0
push eax
push 1
mov edx, str.HardwareDescriptionSystemCentralProcessor0
movlpd qword [ebp - 0x20], xmm0
xor ecx, ecx
call fcn.00460250
add esp, 0x18
test eax, eax
jne 0x45f7a3
mov ebx, dword [ebp - 0xc]
xor esi, esi
nop dword [eax]
mov eax, dword [esi + 0x50738c]
test ebx, ebx
je 0x45f790
test eax, eax
je 0x45f790
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], 8
push ecx
lea ecx, [ebp - 0x20]
xor edi, edi
push ecx
push edi
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x45f784
cmp eax, 0xea
jne 0x45f787
mov edi, dword [ebp - 0xc]
test eax, eax
jne 0x45f790
cmp edi, 4
jae 0x45f798
add esi, 4
cmp esi, 0xc
jb 0x45f750
test ebx, ebx
je 0x45f7a3
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x40
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.00486ef0
add esp, 0xc
mov dword [ebp - 0x60], 0x40
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x45f7ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 0x51fa0c
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x45f810
push 0
push 0
push 1
push 0x51fa0c
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [0x51fa00], 0xc
mov dword [0x51fa08], 0
mov dword [0x51fa04], 0x51fa0c
jmp 0x45f816
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 1
push 0x51f1ec
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x45f952
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x10]
mov word [ebp - 0xc], 0x100
push eax
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 2
push 0x800
push 0x51e9e0
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
lea esi, [ebx + 8]
push esi
call fcn.00484c9d
add esp, 4
mov edi, eax
mov dword [ebp - 8], edi
push esi
push 0
push edi
call fcn.00486ef0
add esp, 0xc
mov dword [edi + 4], 0x10000000
mov word [edi], 0x900
lea esi, [ebx + 8]
mov word [edi + 2], si
add edi, 8
push ebx
push dword [ebp - 0x1c]
push edi
call fcn.00486970
mov ecx, dword [ebp - 8]
add esp, 0xc
movzx eax, word [ecx + 2]
push eax
push ecx
push 0xffffffffffffffff
push 2
push 0x51e9e0
call dword [sym.imp.ADVAPI32.dll_AddAce]
mov eax, dword [ebp - 8]
push ebx
mov dword [eax + 4], 0x1f01ff
mov word [eax], 0x200
mov word [eax + 2], si
push dword [ebp - 0x1c]
push edi
call fcn.00486970
mov ebx, dword [ebp - 8]
add esp, 0xc
movzx eax, word [ebx + 2]
push eax
push ebx
push 0xffffffffffffffff
push 2
push 0x51e9e0
call dword [sym.imp.ADVAPI32.dll_AddAce]
push ebx
call fcn.00484967
add esp, 4
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push 0
push 0x51e9e0
push 1
push 0x51f1ec
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [0x51f1e0], 0xc
mov dword [0x51f1e8], 0
mov dword [0x51f1e4], 0x51f1ec
jmp 0x45f958
call dword [sym.imp.KERNEL32.dll_GetLastError]
or dword [0x520580], 2
push 0x18
push 0
mov dword [0x520854], 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x45f9c6
push 0x2000000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
mov dword [0x520854], esi
xor esi, esi
cmp dword [ebp - 0x64], esi
jne 0x45f9d6
push 0x4fe8ec
push esi
call fcn.004a0b96
add esp, 8
jmp 0x45f9d6
mov dword [0x51e9dc], 0
mov esi, 8
jmp 0x45f9d1
mov dword [0x51fa20], 0
mov esi, 8
jmp 0x45f9d1
test esi, esi
je 0x45f9d6
call fcn.0045fa00
mov eax, dword [0x520588]
test eax, eax
je 0x45f9e6
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048471b
mov esp, ebp
pop ebp
ret