Function at 0x40afb0
Capabilities:
Create thread
Get system information on windows
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x2b4
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov edi, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
cmp eax, 0x4e
je 0x40b2a0
jbe 0x40b010
cmp eax, 0x110
je 0x40b2d0
xor edx, edx
cmp eax, 0x111
jne 0x40affc
cmp di, 0x3f9
je 0x40b480
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
cmp eax, 2
je 0x40b270
xor edx, edx
cmp eax, 5
jne 0x40affc
cmp edi, 1
je 0x40affc
movzx eax, si
shr esi, 0x10
mov dword [ebp - 0x2a8], edx
mov edi, eax
sub edi, dword [0x41189c]
mov dword [0x41189c], eax
mov edx, esi
mov eax, dword [0x411850]
sub edx, dword [0x411898]
mov dword [0x411898], esi
lea esi, [ebp - 0x218]
mov dword [ebp - 0x290], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x210]
mov eax, dword [ebp - 0x290]
sub esp, 8
add eax, dword [ebp - 0x20c]
sub eax, dword [ebp - 0x214]
add ecx, edi
mov dword [esp + 0x14], eax
mov eax, ecx
sub eax, dword [ebp - 0x218]
mov ecx, dword [sym.imp.user32.dll_SetWindowPos]
mov dword [esp + 0x18], 0x216
mov dword [esp + 0x10], eax
mov eax, dword [0x411850]
mov dword [ebp - 0x29c], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call ecx
mov edx, dword [sym.imp.user32.dll_InvalidateRect]
mov eax, dword [0x411850]
sub esp, 0x1c
mov dword [ebp - 0x298], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
mov eax, dword [0x411844]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [sym.imp.user32.dll_GetClientRect]
mov dword [esp + 4], esi
mov dword [ebp - 0x2a0], eax
call eax
mov ecx, dword [sym.imp.user32.dll_MapWindowPoints]
mov eax, dword [0x411844]
sub esp, 8
mov dword [ebp - 0x2a4], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 2
mov dword [esp], eax
call ecx
mov eax, dword [ebp - 0x290]
add eax, dword [ebp - 0x214]
sub esp, 0x10
add edi, dword [ebp - 0x218]
mov dword [esp + 0xc], eax
mov eax, dword [0x411844]
mov dword [esp + 8], edi
mov edi, dword [ebp - 0x29c]
mov dword [esp + 0x18], 0x215
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
mov eax, dword [0x411844]
mov edx, dword [ebp - 0x298]
sub esp, 0x1c
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
mov eax, dword [0x411854]
mov ecx, dword [ebp - 0x2a0]
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], eax
call ecx
mov eax, dword [0x411854]
mov ecx, dword [ebp - 0x2a4]
sub esp, 8
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 2
mov dword [esp], eax
call ecx
mov eax, dword [ebp - 0x290]
add eax, dword [ebp - 0x214]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x218]
mov dword [esp + 0x18], 0x215
mov dword [esp + 8], eax
mov eax, dword [0x411854]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
mov eax, dword [0x411854]
mov edx, dword [ebp - 0x298]
sub esp, 0x1c
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
mov edx, dword [ebp - 0x2a8]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [0x411848]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
call sym._SaveColumnSettings
lea esp, [ebp - 0x10]
xor edx, edx
pop ecx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [esi]
cmp eax, dword [0x411850]
je 0x40b4a0
cmp eax, dword [0x41184c]
je 0x40b458
xor edx, edx
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea eax, [ebp - 0x218]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.user32.dll_GetClientRect]
mov eax, dword [ebp - 0x210]
sub esp, 8
mov dword [0x41189c], eax
mov eax, dword [ebp - 0x20c]
mov dword [esp], ebx
mov dword [0x411898], eax
mov dword [esp + 0x18], 0x215
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x1e
mov dword [esp + 8], 0xf
mov dword [esp + 4], 0
call dword [sym.imp.user32.dll_SetWindowPos]
mov esi, dword [sym.imp.user32.dll_GetDlgItem]
sub esp, 0x1c
mov dword [esp], ebx
mov dword [esp + 4], 0x3fa
call esi
mov edi, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 8
mov dword [0x411850], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x101f
mov dword [esp], eax
call edi
sub esp, 0x10
mov dword [0x41184c], eax
mov dword [esp], ebx
mov dword [esp + 4], 0x3f9
call esi
sub esp, 8
mov dword [0x411844], eax
mov dword [esp], ebx
mov dword [esp + 4], 0x3fd
call esi
mov dword [0x411854], eax
mov eax, dword [0x411850]
sub esp, 8
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], 0x30
mov dword [esp + 4], 0x1036
mov dword [esp], eax
call edi
sub esp, 0x10
call sym._AddColumns
mov eax, dword [0x411850]
mov dword [esp + 8], sym._ProcessListWndProc_16
mov dword [esp + 4], 0xfffffffc
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetWindowLongW]
sub esp, 0xc
mov dword [0x4110f0], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._ProcessPageRefreshThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 1
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [esi + 8]
cmp eax, 0xfffffebf
je 0x40b46d
cmp eax, 0xfffffec9
jne 0x40b2ba
call sym._UpdateColumnDataHints
xor edx, edx
jmp 0x40b2bc
mov dword [ebp - 0x290], edx
call sym._ProcessPage_OnEndProcess
mov edx, dword [ebp - 0x290]
jmp 0x40affc
mov edx, dword [esi + 8]
cmp edx, 0xffffff4f
je 0x40b788
cmp edx, 0xfffffffb
jne 0x40b2ba
mov dword [esp + 0xc], 0
mov esi, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call esi
mov dword [ebp - 0x290], eax
sub esp, 0x10
test eax, eax
je 0x40bfc7
lea edi, [ebp - 0x254]
xor ebx, ebx
jmp 0x40b509
inc ebx
cmp dword [ebp - 0x290], ebx
je 0x40b557
mov eax, dword [0x411850]
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x254], 8
mov dword [ebp - 0x244], 2
mov dword [ebp - 0x24c], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], eax
call esi
sub esp, 0x10
test byte [ebp - 0x248], 2
je 0x40b500
mov eax, dword [0x411850]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1032
mov dword [esp], eax
call esi
sub esp, 0x10
cmp eax, 1
jne 0x40b2ba
mov dword [esp], ebx
call sym._PerfDataGetProcessId
test eax, eax
je 0x40b2ba
mov dword [esp], ebx
lea ebx, [ebp - 0x278]
mov edi, ebx
call sym._PerfDataGetProcessId
mov ecx, 9
mov esi, eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x280]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetCursorPos]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [0x4117cc]
sub esp, 4
mov dword [esp + 4], 0x90
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadMenuW]
mov edi, dword [sym.imp.user32.dll_GetSubMenu]
sub esp, 8
mov dword [ebp - 0x290], eax
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
sub esp, 8
mov ebx, eax
mov dword [esp + 4], 4
mov dword [esp], eax
call edi
sub esp, 8
mov edi, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_OpenProcess]
sub esp, 0xc
mov dword [ebp - 0x298], eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetPriorityClass]
mov ecx, dword [ebp - 0x298]
sub esp, 4
mov esi, eax
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
cmp dword [ebp - 0x264], 1
jbe 0x40c08a
cmp esi, 0x100
je 0x40c0ab
ja 0x40bf9a
cmp esi, 0x40
je 0x40c0c0
cmp esi, 0x80
jne 0x40bf7c
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x802a
mov dword [esp + 8], 0x802e
mov dword [esp + 4], 0x8029
mov dword [esp], edi
call dword [sym.imp.user32.dll_CheckMenuRadioItem]
sub esp, 0x14
lea eax, [ebp - 0x284]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x416360
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x40bfce
lea eax, [ebp - 0x288]
lea esi, [ebp - 0x218]
mov dword [ebp - 0x288], 0x104
xor edi, edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x284]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Debugger
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40c059
cmp word [ebp - 0x218], 0
je 0x40c044
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x40b758
sub eax, esi
sar eax, 1
cmp edi, eax
jae 0x40c044
movzx eax, word [esi + edi*2]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_toupper]
mov word [esi + edi*2], ax
inc edi
jmp 0x40b745
test byte [esi + 0xc], 1
je 0x40b2ba
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x10]
mov eax, dword [ebx*4 + 0x411060]
test eax, eax
je 0x40b8c7
cmp eax, 1
je 0x40bf50
cmp eax, 2
je 0x40bf2e
cmp eax, 3
je 0x40bf02
cmp eax, 4
je 0x40bed6
cmp eax, 5
je 0x40bdc8
cmp eax, 6
je 0x40bd7a
cmp eax, 7
je 0x40bd2c
cmp eax, 8
je 0x40bcde
cmp eax, 9
je 0x40bca7
cmp eax, 0xa
je 0x40bc70
cmp eax, 0xb
je 0x40bc22
cmp eax, 0xc
je 0x40bbd4
cmp eax, 0xd
je 0x40bb86
cmp eax, 0xe
je 0x40bb5a
cmp eax, 0xf
je 0x40bb23
cmp eax, 0x10
je 0x40baec
cmp eax, 0x11
je 0x40bab5
cmp eax, 0x12
je 0x40ba7e
cmp eax, 0x13
je 0x40ba2d
cmp eax, 0x14
je 0x40b9dc
cmp eax, 0x15
je 0x40b98b
cmp eax, 0x16
je 0x40b93a
cmp eax, 0x17
je 0x40b8e9
cmp eax, 0x18
jne 0x40b2ba
lea eax, [ebp - 0x218]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x1ec]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1f0]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
xor edx, edx
jmp 0x40b2bc
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetImageName
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b7a7
lea eax, [ebp - 0x218]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x1f4]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1f8]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b872
lea eax, [ebp - 0x218]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x1fc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b86d
lea eax, [ebp - 0x218]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x204]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x208]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b864
lea eax, [ebp - 0x218]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x20c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x210]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b85b
lea eax, [ebp - 0x218]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x214]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x218]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b852
mov dword [esp], edi
call sym._PerfDataGetGDIObjectCount
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b849
mov dword [esp], edi
call sym._PerfDataGetUSERObjectCount
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b840
mov dword [esp], edi
call sym._PerfDataGetThreadCount
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b837
mov dword [esp], edi
call sym._PerfDataGetHandleCount
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b82e
mov dword [esp], edi
call sym._PerfDataGetBasePriority
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b825
mov dword [esp], edi
call sym._PerfDataGetNonPagedPoolUsagePages
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b81c
mov dword [esp], edi
call sym._PerfDataGetPagedPoolUsagePages
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b813
mov dword [esp], edi
call sym._PerfDataGetVirtualMemorySizeBytes
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b80a
mov dword [esp], edi
call sym._PerfDataGetPageFaultCountDelta
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b801
mov dword [esp], edi
call sym._PerfDataGetPageFaultCount
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b7f8
mov dword [esp], edi
call sym._PerfDataGetWorkingSetSizeDelta
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b7ef
mov dword [esp], edi
call sym._PerfDataGetPeakWorkingSetSizeBytes
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b7e6
mov dword [esp], edi
call sym._PerfDataGetWorkingSetSizeBytes
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b7dd
mov dword [esp], edi
call sym._PerfDataGetCPUTime
mov dword [esp + 8], 0x989680
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call sym.___udivdi3
mov dword [esp + 8], 0xe10
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], edx
call sym.___umoddi3
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x294], edx
call sym.___umoddi3
mov ecx, dword [ebp - 0x294]
mov edx, dword [ebp - 0x298]
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], eax
call sym.___udivdi3
mov edx, dword [esp + 8]
mov dword [esp + 8], 0xe10
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x298], edx
mov edx, dword [ebp - 0x28c]
mov ecx, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 4], edx
mov dword [ebp - 0x294], ecx
call sym.___udivdi3
mov ecx, dword [ebp - 0x294]
mov dword [esp + 4], str._d:_02d:_02d
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b7d4
mov dword [esp], edi
call sym._PerfDataGetCPUUsage
mov dword [esp + 4], str._02d
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b7cb
mov dword [esp], edi
call sym._PerfDataGetSessionId
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b7c2
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetUserName
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b7b9
mov dword [esp], edi
call sym._PerfDataGetProcessId
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b7b0
cmp esi, 0x20
jne 0x40b6b9
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x802c
jmp 0x40b69d
cmp esi, 0x4000
je 0x40c0d5
cmp esi, 0x8000
jne 0x40b6b9
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x802b
jmp 0x40b69d
xor ebx, ebx
jmp 0x40b557
mov dword [esp + 8], 3
mov dword [esp + 4], 0x8027
mov dword [esp], ebx
call dword [sym.imp.user32.dll_EnableMenuItem]
sub esp, 0xc
mov eax, dword [0x4117d0]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x27c]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x280]
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_TrackPopupMenu]
mov eax, dword [ebp - 0x290]
sub esp, 0x1c
mov dword [esp], eax
call dword [sym.imp.user32.dll_DestroyMenu]
xor edx, edx
sub esp, 4
jmp 0x40b2bc
mov dword [esp + 4], str.DRWTSN32
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcsstr]
test eax, eax
je 0x40c075
mov dword [esp + 8], 3
mov dword [esp + 4], 0x8027
mov dword [esp], ebx
call dword [sym.imp.user32.dll_EnableMenuItem]
sub esp, 0xc
mov eax, dword [ebp - 0x284]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push eax
jmp 0x40bfea
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8028
mov dword [esp], ebx
call dword [sym.imp.user32.dll_RemoveMenu]
sub esp, 0xc
jmp 0x40b666
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x8029
jmp 0x40b69d
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x802e
jmp 0x40b69d
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x802d
jmp 0x40b69d