Function at 0x40b912
Capabilities:
Contain obfuscated stackstrings
Get geographical location
Get memory capacity
Get session user name

Disassembly:
push 0x7e0
mov eax, 0x4135ea
call fcn.00411e79
mov edi, ecx
mov dword [ebp - 0x5b0], edi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x62c]
mov dword [ebp - 0x5ac], esi
xor ebx, ebx
call fcn.00404630
lea eax, [ebp - 0x5c4]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.004049c4
push 0x415014
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5f0]
call fcn.0040343f
pop ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x5c4]
lea ecx, [ecx - 0x10]
call fcn.004015b2
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00401b64
mov dword [ebp - 0x5fc], ebx
mov dword [ebp - 0x5f8], ebx
mov dword [ebp - 0x5f4], ebx
push ecx
push ecx
lea ecx, [ebp - 0x7ec]
call fcn.0040f7ee
mov byte [ebp - 4], 6
mov dword [ebp - 0x5dc], ebx
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5e4]
call fcn.00401b64
mov byte [ebp - 4], 7
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5e0]
call fcn.00401b64
mov byte [ebp - 4], 8
call fcn.004015d8
push eax
lea ecx, [ebp - 0x600]
call fcn.00401b64
mov byte [ebp - 4], 9
call fcn.004015d8
push eax
lea ecx, [ebp - 0x604]
call fcn.00401b64
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x5c4]
mov edx, dword [edi + 0x10]
push str.DescXML
push str.DetailDlg
mov dword [ebp - 0x620], ebx
call fcn.00402d60
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x624]
mov byte [ebp - 4], 0xb
call fcn.00403888
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x5c4]
lea ecx, [ecx - 0x10]
call fcn.004015b2
push str.crashrpt.xml
lea ecx, [ebp - 0x62c]
call fcn.00401a77
lea eax, [ebp - 0x5f0]
push eax
lea ecx, [ebp - 0x628]
call fcn.00403888
lea eax, [ebp - 0x5e8]
push eax
lea ecx, [ebp - 0x618]
call fcn.00403888
lea eax, [ebp - 0x62c]
push eax
push eax
lea ecx, [esi + 0x78]
call fcn.00406fce
mov ecx, eax
call fcn.00404ad5
push ebx
lea ecx, [ebp - 0x7ec]
call fcn.0040fb0d
push eax
lea ecx, [ebp - 0x7ec]
call fcn.0040ea88
push 0x4154f4
lea ecx, [ebp - 0x7ec]
call fcn.0040fa9e
mov ebx, eax
lea ecx, [ebp - 0x7ec]
push ebx
mov dword [ebp - 0x5cc], ebx
call fcn.0040ea88
push 0x57b
lea eax, [ebp - 0x5e0]
push 0x416138
push eax
call fcn.00403c3f
mov edi, dword [ebp - 0x5e0]
lea ecx, [ebp - 0x5fc]
add esp, 0xc
push edi
call fcn.00403f46
push eax
push str.version
lea ecx, [ebp - 0x5c4]
mov dword [ebp - 0x5c4], ebx
call fcn.004045f0
mov ecx, eax
call fcn.00404560
push ebx
push ecx
mov ecx, dword [ebp - 0x5ac]
mov esi, esp
mov dword [ebp - 0x5a8], esi
mov dword [ebp - 0x5c8], esp
mov ecx, dword [ecx + 0xc]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xc
push str.CrashGUID
call fcn.00403925
mov byte [ebp - 4], 0xa
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ecx, dword [eax + 0x10]
push 0x10
pop edi
sub ecx, edi
call fcn.00401bdc
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xd
push str.AppName
call fcn.00403925
mov byte [ebp - 4], 0xa
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ecx, dword [eax + 0x14]
sub ecx, edi
call fcn.00401bdc
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xe
push str.AppVersion
call fcn.00403925
mov byte [ebp - 4], 0xa
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ecx, dword [eax + 0x18]
sub ecx, edi
call fcn.00401bdc
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xf
push str.ImageName
call fcn.00403925
mov byte [ebp - 4], 0xa
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ecx, dword [eax + 0x5c]
sub ecx, edi
call fcn.00401bdc
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x10
push str.OperatingSystem
call fcn.00403925
mov byte [ebp - 4], 0xa
call fcn.0040b881
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5ec]
call fcn.00401b64
push 0x344
xor esi, esi
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x5a0]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x5a4], 0x348
mov edi, esi
push esi
lea eax, [ebp - 0x5a4]
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
je 0x40bcde
test byte [ebp - 0x460], 8
jne 0x40bcd8
test byte [ebp - 0x460], 1
je 0x40bcd8
test edi, edi
je 0x40bcc6
push 0x414d7c
lea ecx, [ebp - 0x5ec]
call fcn.004037f5
lea eax, [ebp - 0x560]
push eax
lea ecx, [ebp - 0x5ec]
call fcn.004037f5
inc edi
cmp edi, 0x10
jl 0x40bc8c
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov eax, dword [ebp - 0x5ec]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x614], eax
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x12
push str.DispalyDevice
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
push 0x202
lea eax, [ebp - 0x21c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x610], 0x101
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push ebx
push ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x5c8], esp
mov ecx, esp
push eax
call fcn.00403925
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x13
push str.User
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ecx, dword [eax + 0x2c]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x14
push 0x4161e0
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
mov ecx, dword [ebp - 0x5b0]
mov eax, dword [ecx + 0xdc]
cmp eax, 0xd
jne 0x40be80
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5d8]
call fcn.00401b64
push pe_nt_image_headers32
lea eax, [ebp - 0x35c]
mov byte [ebp - 4], 0x15
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x5ac]
movsd xmm0, qword [eax + 0x30]
lea eax, [ebp - 0x35c]
movsd qword [esp + 4], xmm0
mov dword [esp], 0x4159c0
push eax
call fcn.0040dd1d
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x5d8]
push 0x414e80
push eax
call fcn.00403c3f
add esp, 0x1c
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ebx, dword [ebp - 0x5d8]
lea ecx, [ebx - 0x10]
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x16
push str.CPUUsage
call fcn.00403925
mov byte [ebp - 4], 0x15
jmp 0x40bf1d
cmp eax, 4
jne 0x40bf34
mov ecx, dword [ecx + 0xd0]
lea edx, [ebp - 0x5d0]
xor eax, eax
mov dword [ebp - 0x5d0], eax
mov dword [ebp - 0x5d8], eax
lea eax, [ebp - 0x5d8]
push eax
call fcn.00402cf0
pop ecx
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5c0]
call fcn.00401b64
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x5c0]
push dword [ebp - 0x5d8]
push dword [ebp - 0x5d0]
push str._d____p
push eax
call fcn.00403c3f
add esp, 0x10
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ebx, dword [ebp - 0x5c0]
lea ecx, [ebx - 0x10]
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x18
push str.VMUsage
call fcn.00403925
mov byte [ebp - 4], 0x17
call fcn.0040b881
lea ecx, [ebx - 0x10]
mov byte [ebp - 4], 0x11
call fcn.004015b2
mov ebx, dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x5ac]
mov edi, 0x416138
push dword [eax + 0x60]
lea eax, [ebp - 0x600]
push edi
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5c8], esi
mov eax, dword [ebp - 0x600]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x5c8], eax
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x19
push str.OSIs64Bit
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [eax + 0x64]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1a
push str.GeoLocation
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [eax + 0x28]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1b
push str.SystemTimeUTC
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x3c]
mov eax, ecx
or eax, edx
je 0x40c15f
push edx
push ecx
mov edi, str.0x_I64x
lea eax, [ebp - 0x5e4]
push edi
push eax
call fcn.00403c3f
add esp, 0x10
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [ebp - 0x5e4]
add ecx, 0xfffffff0
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1c
push str.ExceptionAddress
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [eax + 0x40]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1d
push str.ExceptionModule
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push dword [eax + 0x4c]
push dword [eax + 0x48]
lea eax, [ebp - 0x5e4]
push edi
push eax
call fcn.00403c3f
add esp, 0x10
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [ebp - 0x5e4]
add ecx, 0xfffffff0
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1e
push str.ExceptionModuleBase
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [eax + 0x44]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1f
push str.ExceptionModuleVersion
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
mov edi, 0x416138
mov ecx, dword [ebp - 0x5b0]
lea eax, [ebp - 0x604]
push dword [ecx + 0xdc]
push edi
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5a8], esi
mov eax, dword [ebp - 0x604]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x5a8], eax
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x20
push str.ExceptionType
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
mov esi, dword [ebp - 0x5b0]
mov eax, dword [esi + 0xdc]
test eax, eax
jne 0x40c23c
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5c0]
call fcn.00401b64
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x5c0]
push dword [esi + 0xe0]
push str.0x_x
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov ebx, dword [ebp - 0x5c0]
lea ecx, [ebx - 0x10]
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x22
push str.ExceptionCode
call fcn.00403925
mov byte [ebp - 4], 0x21
jmp 0x40c3e4
cmp eax, 8
jne 0x40c2a9
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5c0]
call fcn.00401b64
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x5c0]
push dword [esi + 0xe4]
push edi
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov ebx, dword [ebp - 0x5c0]
lea ecx, [ebx - 0x10]
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x24
push str.FPESubcode
call fcn.00403925
mov byte [ebp - 4], 0x23
jmp 0x40c3e4
cmp eax, 6
jne 0x40c3fb
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov ecx, dword [ebp - 0x5b0]
mov ecx, dword [ecx + 0xe8]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x25
push str.InvParamExpression
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov eax, dword [ebp - 0x5b0]
mov ecx, dword [eax + 0xec]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x26
push str.InvParamFunction
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov eax, dword [ebp - 0x5b0]
mov ecx, dword [eax + 0xf0]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x27
push str.InvParamFile
call fcn.00403925
mov byte [ebp - 4], 0x11
call fcn.0040b881
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5c0]
call fcn.00401b64
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x5b0]
push dword [eax + 0xf4]
lea eax, [ebp - 0x5c0]
push edi
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov ebx, dword [ebp - 0x5c0]
lea ecx, [ebx - 0x10]
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x29
push str.InvParamLine
call fcn.00403925
mov byte [ebp - 4], 0x28
call fcn.0040b881
lea ecx, [ebx - 0x10]
mov byte [ebp - 4], 0x11
call fcn.004015b2
mov ebx, dword [ebp - 0x5cc]
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5c0]
call fcn.00401b64
mov eax, dword [ebp - 0x5ac]
mov byte [ebp - 4], 0x2a
push dword [eax + 0x50]
lea eax, [ebp - 0x5c0]
push edi
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5bc], esp
mov dword [ebp - 0x5b4], esi
mov eax, dword [ebp - 0x5c0]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x5b4], eax
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x2b
push str.GUIResourceCount
call fcn.00403925
mov byte [ebp - 4], 0x2a
call fcn.0040b881
call fcn.004015d8
push eax
lea ecx, [ebp - 0x608]
call fcn.00401b64
mov eax, dword [ebp - 0x5ac]
mov byte [ebp - 4], 0x2c
push dword [eax + 0x54]
lea eax, [ebp - 0x608]
push edi
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5bc], esi
mov eax, dword [ebp - 0x608]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x5bc], eax
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x2d
push str.OpenHandleCount
call fcn.00403925
mov byte [ebp - 4], 0x2c
call fcn.0040b881
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [eax + 0x58]
sub ecx, 0x10
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 0x2e
mov ecx, esp
push str.MemoryUsageKbytes
call fcn.00403925
mov byte [ebp - 4], 0x2c
call fcn.0040b881
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x25c], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5b0]
call fcn.00401b64
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x5b0]
push dword [ebp - 0x258]
push edi
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x30
push str.MemoryLoad
call fcn.00403925
mov byte [ebp - 4], 0x2f
call fcn.0040b881
mov ecx, dword [ebp - 0x254]
mov edi, 0xfffff
mov eax, dword [ebp - 0x250]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x5b0]
push ecx
push 0x416138
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x31
push str.TotalPhysicalMemory
call fcn.00403925
mov byte [ebp - 4], 0x2f
call fcn.0040b881
mov ecx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x248]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x5b0]
push ecx
push 0x416138
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x32
push str.AvailablePhysicalMemory
call fcn.00403925
mov byte [ebp - 4], 0x2f
call fcn.0040b881
mov ecx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x5b0]
push ecx
push 0x416138
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x33
push str.TotalPageFile
call fcn.00403925
mov byte [ebp - 4], 0x2f
call fcn.0040b881
mov ecx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x238]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x5b0]
push ecx
push 0x416138
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x34
push str.AvailablePageFile
call fcn.00403925
mov byte [ebp - 4], 0x2f
call fcn.0040b881
mov ecx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x230]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
push ecx
push 0x416138
lea eax, [ebp - 0x5b0]
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x35
push str.TotalVirtualMemory
call fcn.00403925
mov byte [ebp - 4], 0x2f
call fcn.0040b881
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x228]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x5b0]
push ecx
push 0x416138
push eax
call fcn.00403c3f
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b8], esp
mov dword [ebp - 0x5d4], esi
mov eax, dword [ebp - 0x5b0]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x5d4], eax
call fcn.00401bdc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x36
push str.AvailableVirtualMemory
call fcn.00403925
mov byte [ebp - 4], 0x2f
call fcn.0040b881
push str.CustomProps
lea ecx, [ebp - 0x7ec]
call fcn.0040fa9e
push eax
mov ecx, ebx
mov dword [ebp - 0x5b8], eax
call fcn.0040ea88
mov esi, dword [ebp - 0x5ac]
xor eax, eax
mov edi, dword [ebp - 0x5e0]
mov dword [ebp - 0x5d8], eax
cmp dword [esi + 0x8c], eax
jle 0x40c95f
mov ebx, esi
call fcn.004015d8
push eax
lea ecx, [ebp - 0x5d0]
call fcn.00401b64
mov byte [ebp - 4], 0x37
call fcn.004015d8
push eax
lea ecx, [ebp - 0x60c]
call fcn.00401b64
lea eax, [ebp - 0x60c]
mov byte [ebp - 4], 0x38
push eax
lea eax, [ebp - 0x5d0]
mov ecx, ebx
push eax
push dword [ebp - 0x5d8]
call fcn.00404b1d
push str.Prop
lea ecx, [ebp - 0x7ec]
call fcn.0040fa9e
push dword [ebp - 0x5d0]
mov edi, eax
lea ecx, [ebp - 0x5fc]
mov dword [ebp - 0x5c4], edi
call fcn.00403f46
push eax
push str.name
lea ecx, [ebp - 0x5c4]
call fcn.004045f0
mov ecx, eax
call fcn.00404560
mov esi, dword [ebp - 0x60c]
lea ecx, [ebp - 0x5fc]
push esi
call fcn.00403f46
push eax
push str.value
lea ecx, [ebp - 0x5c4]
call fcn.004045f0
mov ecx, eax
call fcn.00404560
lea ecx, [ebp - 0x5b8]
call fcn.004045f0
push edi
mov ecx, eax
call fcn.0040ea88
lea ecx, [esi - 0x10]
call fcn.004015b2
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x5d0]
lea ecx, [ecx - 0x10]
call fcn.004015b2
mov eax, dword [ebp - 0x5d8]
inc eax
mov dword [ebp - 0x5d8], eax
cmp eax, dword [ebx + 0x8c]
jl 0x40c857
mov edi, dword [ebp - 0x5e0]
mov ebx, dword [ebp - 0x5cc]
mov esi, dword [ebp - 0x5ac]
push str.FileList
lea ecx, [ebp - 0x7ec]
call fcn.0040fa9e
push eax
mov ecx, ebx
mov dword [ebp - 0x5b8], eax
call fcn.0040ea88
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0x5c4], ebx
cmp dword [esi + 0x7c], ebx
jle 0x40caa2
mov edi, dword [ebp - 0x5ac]
push eax
mov ecx, edi
call fcn.004049de
push str.FileItem
lea ecx, [ebp - 0x7ec]
mov dword [ebp - 0x5cc], eax
call fcn.0040fa9e
mov esi, eax
lea ecx, [ebp - 0x5fc]
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x5d0], esi
push dword [eax + 4]
call fcn.00403f46
push eax
push str.name
lea ecx, [ebp - 0x5d0]
call fcn.004045f0
mov ecx, eax
call fcn.00404560
mov eax, dword [ebp - 0x5cc]
lea ecx, [ebp - 0x5fc]
push dword [eax + 8]
call fcn.00403f46
push eax
push str.description
lea ecx, [ebp - 0x5d0]
call fcn.004045f0
mov ecx, eax
call fcn.00404560
mov eax, dword [ebp - 0x5cc]
cmp dword [eax + 0x10], ebx
je 0x40ca41
push 0x4154e0
push str.optional
lea ecx, [ebp - 0x5d0]
call fcn.004045f0
mov ecx, eax
call fcn.00404560
mov eax, dword [ebp - 0x5cc]
mov eax, dword [eax + 0x14]
cmp dword [eax - 0xc], ebx
je 0x40ca6d
push eax
lea ecx, [ebp - 0x5fc]
call fcn.00403f46
push eax
push str.error
lea ecx, [ebp - 0x5d0]
call fcn.004045f0
mov ecx, eax
call fcn.00404560
lea ecx, [ebp - 0x5b8]
call fcn.004045f0
push esi
mov ecx, eax
call fcn.0040ea88
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp eax, dword [edi + 0x7c]
jl 0x40c996
mov edi, dword [ebp - 0x5e0]
mov esi, dword [ebp - 0x5ac]
push 0x415548
push dword [ebp - 0x5f0]
lea eax, [ebp - 0x5dc]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
cmp dword [ebp - 0x5dc], ebx
jne 0x40cadd
push str.Error_opening_file_for_writing
lea ecx, [ebp - 0x5e8]
call fcn.00401a77
mov eax, dword [ebp - 0x5dc]
jmp 0x40cb40
push ecx
push dword [ebp - 0x5dc]
lea ecx, [ebp - 0x7ec]
mov byte [ebp - 0x7b8], 1
call fcn.0040fc30
test eax, eax
jne 0x40cb28
mov eax, dword [ebp - 0x7a8]
cmp eax, dword [ebp - 0x7a4]
jne 0x40cb0f
mov eax, 0x414db0
jmp 0x40cb1a
lea ecx, [ebp - 0x7ac]
call fcn.0040e455
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00403830
jmp 0x40cad5
push dword [ebp - 0x5dc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
xor ebx, ebx
pop ecx
mov dword [ebp - 0x5dc], eax
inc ebx
test eax, eax
je 0x40cb4c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test ebx, ebx
jne 0x40cb6c
lea eax, [ebp - 0x5e8]
mov ecx, esi
push eax
push dword [ebp - 0x62c]
call fcn.00404a17
lea ecx, [eax + 0x14]
call fcn.00403888
mov ecx, dword [ebp - 0x5d4]
call fcn.004015b2
mov ecx, dword [ebp - 0x5bc]
call fcn.004015b2
mov ecx, dword [ebp - 0x5b4]
call fcn.004015b2
mov ecx, dword [ebp - 0x614]
call fcn.004015b2
mov ecx, dword [ebp - 0x5a8]
call fcn.004015b2
mov ecx, dword [ebp - 0x5c8]
call fcn.004015b2
lea ecx, [edi - 0x10]
call fcn.004015b2
mov ecx, dword [ebp - 0x5e4]
lea ecx, [ecx - 0x10]
call fcn.004015b2
lea ecx, [ebp - 0x7ec]
call fcn.0040f965
lea ecx, [ebp - 0x5fc]
call fcn.0040270c
mov ecx, dword [ebp - 0x5e8]
add ecx, 0xfffffff0
call fcn.004015b2
mov ecx, dword [ebp - 0x5f0]
add ecx, 0xfffffff0
call fcn.004015b2
lea ecx, [ebp - 0x62c]
call fcn.0040636c
mov eax, ebx
call fcn.00411e23
ret 4