Function at 0x462970
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x517074]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
lea edi, [esi + 1]
cmp dword [0x51e3fc], esi
jne 0x4629a3
mov ecx, edi
call fcn.00462890
mov esi, eax
test esi, esi
jne 0x462db6
mov eax, dword [0x51e3fc]
test eax, eax
je 0x4629b3
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x51e400]
mov ecx, eax
inc eax
mov dword [0x51e400], eax
test ecx, ecx
jne 0x462d9b
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x462a6b
push str.IsWow64Process
push esi
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x462a0b
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
mov ecx, edi
call dword [0x4db310]
call edi
mov eax, dword [ebp - 8]
test eax, eax
je 0x462a28
push str.Wow64EnableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51e698], eax
mov eax, dword [ebp - 8]
test eax, eax
push 0x4f46b8
push esi
setne byte [0x51e680]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetTickCount64
push esi
mov dword [0x51e688], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp dword [0x51e6a4], 0xf
jl 0x462a66
push str.PrefetchVirtualMemory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x51e684], eax
mov edi, 1
push str.NTDLL.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [0x51e67c], eax
test eax, eax
je 0x462b6f
push str.RtlNtStatusToDosError
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlInitUnicodeString
push dword [0x51e67c]
mov dword [0x51e3f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtOpenFile
push dword [0x51e67c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtReadFile
push dword [0x51e67c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtWriteFile
push dword [0x51e67c]
mov dword [0x51e694], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationFile
push dword [0x51e67c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationFile
push dword [0x51e67c]
mov dword [0x51e690], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryVirtualMemory
push dword [0x51e67c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryObject
push dword [0x51e67c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryVolumeInformationFile
push dword [0x51e67c]
mov dword [0x51e68c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push dword [0x51e67c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQuerySystemInformation
push dword [0x51e67c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtClose
push dword [0x51e67c]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x51b7e0
push 8
call fcn.0048c540
mov esi, eax
add esp, 8
test esi, esi
je 0x462b9a
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00462f40
mov dword [esi], eax
jmp 0x462b9c
xor esi, esi
mov dword [0x51db98], esi
test esi, esi
jne 0x462bb0
mov esi, 8
jmp 0x462d9f
push 0x51b7e0
push 8
call fcn.0048c540
mov esi, eax
add esp, 8
test esi, esi
je 0x462bdb
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00462f10
mov dword [esi], eax
jmp 0x462bdd
xor esi, esi
mov dword [0x51db9c], esi
test esi, esi
jne 0x462bf1
mov esi, 8
jmp 0x462d9f
cmp dword [0x51e67c], 0
je 0x462d18
push ecx
push 0x51e668
push ecx
mov edx, str.RtlSetThreadErrorMode
call fcn.00465d20
add esp, 0xc
cmp dword [0x51e664], 0
jne 0x462c2f
push ecx
push 0x51e664
push ecx
mov edx, str.RtlGetVersion
call fcn.00465d20
add esp, 0xc
cmp dword [0x51e660], 0
jne 0x462c4c
push ecx
push 0x51e660
push ecx
mov edx, str.RtlPcToFileHeader
call fcn.00465d20
add esp, 0xc
push ecx
push 0x51e65c
push ecx
mov edx, str.LdrLockLoaderLock
call fcn.00465d20
add esp, 8
mov edx, str.LdrUnlockLoaderLock
push 0x51e658
push ecx
call fcn.00465d20
add esp, 8
mov edx, str.NtWow64QueryInformationProcess64
push 0x51e3e8
push ecx
call fcn.00465d20
add esp, 8
mov edx, str.NtWow64GetNativeSystemInformation
push 0x51e674
push ecx
call fcn.00465d20
add esp, 8
mov edx, str.NtWow64QueryVirtualMemory64
push 0x51e670
push ecx
call fcn.00465d20
add esp, 8
mov edx, str.NtWow64ReadVirtualMemory64
push 0x51e66c
push ecx
call fcn.00465d20
mov esi, dword [0x51e674]
add esp, 0xc
test esi, esi
je 0x462d18
push 0
push 0xc
lea eax, [ebp - 0x14]
mov ecx, esi
push eax
push 1
call dword [0x4db310]
call esi
mov esi, dword [0x51e674]
lea eax, [ebp - 0x40]
push 0
push 0x2c
push eax
push 0
mov ecx, esi
call dword [0x4db310]
call esi
test eax, eax
jne 0x462d18
mov eax, dword [ebp - 0x20]
mov dword [0x517aa8], eax
movzx eax, byte [ebp - 0x18]
mov dword [0x517aac], 0
mov dword [0x517ab8], eax
jmp 0x462d1d
mov eax, dword [0x517ab8]
and ebx, 1
jne 0x462d4c
sub esp, 0xc
lea edx, [ebx + 0x10]
lea ecx, [ebp - 0x34]
push str.aswSP
call fcn.004669f0
add esp, 8
mov edx, eax
mov ecx, 0x51e678
call fcn.00466450
mov eax, dword [0x517ab8]
add esp, 8
test eax, eax
cmove eax, edi
sub esp, 8
mov dword [0x517ab8], eax
call fcn.00466d30
add esp, 8
call fcn.00467de0
call fcn.004630d0
call fcn.00463120
or dword [0x51e404], 2
mov ecx, 0x51e69c
call fcn.00466570
mov esi, eax
test esi, esi
jne 0x462d9f
test ebx, ebx
jne 0x462da4
push 0x4ecf24
push ebx
call fcn.004bae5f
add esp, 8
jmp 0x462da4
test esi, esi
je 0x462da4
call fcn.00462dd0
mov eax, dword [0x51e3fc]
test eax, eax
je 0x462db4
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048bc9e
mov esp, ebp
pop ebp
ret