Function at 0x4677c0
Capabilities:
Get memory capacity
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x488]
push eax
mov dword [ebp - 0x488], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [ebp - 0x47c], 0
ja 0x467a3f
cmp dword [ebp - 0x480], 0xc0000000
ja 0x467a3f
push 0x400
lea ecx, [ebp - 0x408]
push 0
push ecx
mov dword [ebp - 0x444], 7
call fcn.004c5470
add esp, 0xc
lea edx, [ebp - 0x448]
push edx
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x444]
push ecx
push str.PagingFiles
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x448], 0x3ff
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], 0xf
mov dword [ebp - 0x410], 0
mov byte [ebp - 0x420], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x467882
sub eax, edx
push eax
lea edx, [ebp - 0x408]
push edx
lea ecx, [ebp - 0x424]
call fcn.0040b8b0
mov eax, dword [ebp - 0x410]
cmp eax, 2
ja 0x4678d7
cmp dword [ebp - 0x40c], 0x10
jb 0x4678c1
mov eax, dword [ebp - 0x420]
push eax
call fcn.004c097a
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
test eax, eax
ja 0x4678e0
call fcn.004bf6e5
mov ecx, dword [ebp - 0x40c]
mov edx, dword [ebp - 0x420]
mov edi, 0x10
mov eax, edx
cmp ecx, edi
jae 0x4678fd
lea eax, [ebp - 0x420]
cmp byte [eax], 0x3f
jne 0x467926
cmp ecx, edi
jb 0x467a3f
push edx
call fcn.004c097a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
push 1
push 0x522c28
lea ecx, [ebp - 0x424]
push ecx
xor eax, eax
call fcn.0040b9c0
mov esi, eax
cmp esi, 0xffffffff
je 0x467a34
mov ecx, dword [ebp - 0x410]
cmp ecx, esi
jbe 0x46796f
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0x40c], edi
jae 0x467964
lea eax, [ebp - 0x420]
cmp byte [eax + esi], 0x20
jne 0x46796f
inc esi
cmp ecx, esi
ja 0x467950
push esi
lea edx, [ebp - 0x424]
push edx
mov edx, 0x522c28
call fcn.0040a9b0
cmp eax, 0xffffffff
je 0x467a34
sub eax, esi
mov ecx, esi
push eax
lea esi, [ebp - 0x440]
lea edx, [ebp - 0x424]
call fcn.0042b1c0
mov eax, dword [ebp - 0x43c]
cmp dword [ebp - 0x428], edi
jae 0x4679b4
lea eax, [ebp - 0x43c]
push eax
call fcn.004c36f5
mov ecx, eax
add esp, 4
or ecx, edx
je 0x467a29
push 0
push 0x100000
push edx
push eax
call fcn.004c8780
mov ebx, dword [ebp - 0x480]
mov edi, dword [ebp - 0x47c]
mov esi, eax
add esi, ebx
mov ecx, edx
adc ecx, edi
test ecx, ecx
ja 0x467a29
jb 0x4679f3
cmp esi, 0xc0000000
jae 0x467a29
cmp edx, edi
ja 0x467a29
jb 0x4679fd
cmp eax, ebx
jae 0x467a29
lea ecx, [ebp - 0x440]
call fcn.00410e20
lea ecx, [ebp - 0x424]
call fcn.00410e20
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x440]
call fcn.00410e20
lea ecx, [ebp - 0x424]
call fcn.00410e20
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004c0985
mov esp, ebp
pop ebp
ret