Function at 0x14000f6f4
Capabilities:
Get geographical location
Get memory capacity
Get session user name

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xc80]
sub rsp, 0xd80
mov rax, qword [0x140046010]
xor rax, rsp
mov qword [rbp + 0xc70], rax
mov r15, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x48], r12d
lea rcx, [rbp + 0x258]
call fcn.140005604
nop
mov rcx, qword [r15 + 0x10]
lea r13d, [r12 + 0x18]
sub rcx, r13
call fcn.140001ea0
lea rbx, [rax + 0x18]
mov qword [rbp + 0x1c8], rbx
lea r8, [0x14003eb00]
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp - 0x58]
call fcn.140003b78
nop
lea rdx, [rbx - 0x18]
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14000f798
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140010ff4
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r12
lea rcx, [rbp + 0x2c0]
call fcn.140014d0c
nop
mov qword [rsp + 0x58], r12
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140010fff
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x14001100a
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp - 0x60], rax
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140011015
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp - 0x18], rax
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140011020
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x270], r12d
lea r9, str.DescXML
lea r8, str.DetailDlg
mov rdx, qword [rdi + 0x18]
lea rcx, [rbp + 0x218]
call fcn.1400033a8
nop
mov rdx, rax
lea rcx, [rbp + 0x268]
call fcn.140004164
nop
mov rdx, qword [rbp + 0x218]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14000f8da
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
lea rdx, str.crashrpt.xml
mov rax, rsi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x14000f8e4
mov r8d, eax
lea rcx, [rbp + 0x258]
call fcn.1400020f4
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x260]
call fcn.140004164
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x278]
call fcn.140004164
lea rdx, [rbp + 0x258]
mov rcx, r15
call fcn.140005fac
lea rdx, [rbp + 0x548]
lea rcx, [rbp + 0x2c0]
call fcn.140016674
mov rbx, rax
lea rcx, [rax + 0x18]
lea rdx, str.xml_version_1.0__encoding_UTF_8_
call fcn.14001308c
mov rdx, rbx
lea rcx, [rbp + 0x2c0]
call fcn.140013a30
lea rdx, [0x14003f020]
lea rcx, [rbp + 0x2c0]
call fcn.140014fc8
mov r14, rax
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.140013a30
mov r8d, 0x57b
lea rdx, [0x14003fdb4]
lea rcx, [rbp - 0x60]
call fcn.1400047d8
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp + 0x110]
call fcn.140004c80
mov rbx, rax
test r14, r14
je 0x14000f9c7
mov rcx, qword [r14]
mov rax, qword [rcx + 8]
mov rcx, r14
call qword [case.0x14001405b.0]
jmp 0x14000f9ca
mov rax, r12
mov r8, rbx
lea rdx, str.version
mov rcx, rax
call fcn.1400054e8
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x40], rax
mov rcx, qword [r15 + 0x18]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xe0], rax
lea rdx, str.CrashGUID
lea rcx, [rbp + 0x220]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xe0]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x40], rax
mov rcx, qword [r15 + 0x20]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xe8], rax
lea rdx, str.AppName
lea rcx, [rbp + 0x228]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xe8]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x40], rax
mov rcx, qword [r15 + 0x28]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xf8], rax
lea rdx, str.AppVersion
lea rcx, [rbp + 0x240]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xf8]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp + 0x100]
mov qword [rsp + 0x40], rax
mov rcx, qword [r15 + 0x30]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x100], rax
lea rdx, str.ImageName
lea rcx, [rbp + 0x248]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x100]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp + 0x108]
mov qword [rsp + 0x40], rax
mov rcx, qword [r15 + 0x98]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x108], rax
lea rdx, str.OperatingSystem
lea rcx, [rbp + 0x250]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x108]
mov rdx, rax
call fcn.14000f5f4
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x14001102b
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp - 0x70], rax
xor edx, edx
mov r8d, 0x344
lea rcx, [rbp + 0x614]
call fcn.140018cb0
mov dword [rbp + 0x610], 0x348
mov ebx, r12d
xor r9d, r9d
lea r8, [rbp + 0x610]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
je 0x14000fc05
test byte [rbp + 0x754], 8
jne 0x14000fbfe
test byte [rbp + 0x754], 1
je 0x14000fbfe
test ebx, ebx
jle 0x14000fbd7
mov r8d, 2
lea rdx, [0x14003e83c]
lea rcx, [rbp - 0x70]
call fcn.1400046c4
lea rcx, [rbp + 0x654]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14000fbe1
mov r8d, eax
lea rdx, [rbp + 0x654]
lea rcx, [rbp - 0x70]
call fcn.1400046c4
inc ebx
cmp ebx, 0x10
jl 0x14000fb93
lea rax, [rbp - 0x50]
mov qword [rsp + 0x40], rax
mov rcx, qword [rbp - 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rbp + 0x238], rcx
call fcn.140001ea0
add rax, 0x18
mov qword [rbp - 0x50], rax
lea rdx, str.DispalyDevice
lea rcx, [rbp + 0x128]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp - 0x50]
mov rdx, rax
call fcn.14000f5f4
xor edx, edx
mov r8d, 0x202
lea rcx, [rbp + 0xa60]
call fcn.140018cb0
mov dword [rbp - 0x78], 0x101
lea rdx, [rbp - 0x78]
lea rcx, [rbp + 0xa60]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [rbp + 0x130]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0xa60]
lea rcx, [rbp + 0x130]
call fcn.1400041e8
mov rbx, rax
lea rdx, str.User
lea rcx, [rbp + 0x138]
call fcn.1400041e8
nop
mov r9, r14
mov r8, rbx
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp - 0x48]
mov qword [rsp + 0x40], rax
mov rcx, qword [r15 + 0x58]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rdx, [0x14003fe70]
lea rcx, [rbp + 0x140]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp - 0x48]
mov rdx, rax
call fcn.14000f5f4
mov eax, dword [rdi + 0x128]
cmp eax, 0xd
jne 0x14000fdc2
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140011036
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp - 0x40], rax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x960]
call fcn.140018cb0
movsd xmm2, qword [r15 + 0x60]
movq r8, xmm2
lea rdx, [0x14003f5f4]
lea rcx, [rbp + 0x960]
call fcn.1400129e0
lea r8, [rbp + 0x960]
lea rdx, [0x14003e958]
lea rcx, [rbp - 0x40]
call fcn.1400047d8
lea rax, [rbp - 0x38]
mov qword [rsp + 0x40], rax
mov rbx, qword [rbp - 0x40]
lea rcx, [rbx - 0x18]
call fcn.140001ea0
add rax, 0x18
mov qword [rbp - 0x38], rax
lea rdx, str.CPUUsage
lea rcx, [rbp + 0x148]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp - 0x38]
mov rdx, rax
call fcn.14000f5f4
nop
jmp 0x14000fe69
cmp eax, 4
jne 0x14000fe8b
mov dword [rsp + 0x60], r12d
mov qword [rbp - 0x30], r12
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x60]
mov ecx, dword [rdi + 0x118]
call fcn.1400032fc
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140011041
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp - 0x28], rax
mov r9, qword [rbp - 0x30]
mov r8d, dword [rsp + 0x60]
lea rdx, str._d____p
lea rcx, [rbp - 0x28]
call fcn.1400047d8
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov rbx, qword [rbp - 0x28]
lea rcx, [rbx - 0x18]
call fcn.140001ea0
add rax, 0x18
mov qword [rbp - 0x20], rax
lea rdx, str.VMUsage
lea rcx, [rbp + 0x150]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp - 0x20]
mov rdx, rax
call fcn.14000f5f4
nop
mov eax, esi
lock xadd dword [rbx - 8], eax
add eax, esi
test eax, eax
jg 0x14000fe8b
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
mov r8d, dword [r15 + 0xa0]
lea rdx, [0x14003fdb4]
lea rcx, [rbp - 0x18]
call fcn.1400047d8
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp - 0x18]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x40], rcx
call fcn.140001ea0
add rax, 0x18
mov qword [rbp - 0x10], rax
lea rdx, str.OSIs64Bit
lea rcx, [rbp + 0x158]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp - 0x10]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov rcx, qword [r15 + 0xa8]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp - 8], rax
lea rdx, str.GeoLocation
lea rcx, [rbp + 0x160]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp - 8]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp]
mov qword [rsp + 0x20], rax
mov rcx, qword [r15 + 0x50]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp], rax
lea rdx, str.SystemTimeUTC
lea rcx, [rbp + 0x168]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp]
mov rdx, rax
call fcn.14000f5f4
mov r8, qword [r15 + 0x68]
test r8, r8
je 0x1400100a5
lea rdx, str.0x_I64x
lea rcx, [rsp + 0x68]
call fcn.1400047d8
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 8], rax
lea rdx, str.ExceptionAddress
lea rcx, [rbp + 0x170]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 8]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov rcx, qword [r15 + 0x70]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x10], rax
lea rdx, str.ExceptionModule
lea rcx, [rbp + 0x178]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x10]
mov rdx, rax
call fcn.14000f5f4
mov r8, qword [r15 + 0x80]
lea rdx, str.0x_I64x
lea rcx, [rsp + 0x68]
call fcn.1400047d8
lea rax, [rbp + 0x18]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x18], rax
lea rdx, str.ExceptionModuleBase
lea rcx, [rbp + 0x180]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x18]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp + 0x20]
mov qword [rsp + 0x20], rax
mov rcx, qword [r15 + 0x78]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x20], rax
lea rdx, str.ExceptionModuleVersion
lea rcx, [rbp + 0x188]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x20]
mov rdx, rax
call fcn.14000f5f4
mov r8d, dword [rdi + 0x128]
lea rdx, [0x14003fdb4]
lea rcx, [rbp + 0x28]
call fcn.1400047d8
lea rax, [rbp + 0x30]
mov qword [rsp + 0x30], rax
mov rcx, qword [rbp + 0x28]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x20], rcx
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x30], rax
lea rdx, str.ExceptionType
lea rcx, [rbp + 0x190]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x30]
mov rdx, rax
call fcn.14000f5f4
mov eax, dword [rdi + 0x128]
test eax, eax
jne 0x140010194
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140011057
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp + 0x38], rax
mov r8d, dword [rdi + 0x12c]
lea rdx, str.0x_x
lea rcx, [rbp + 0x38]
call fcn.1400047d8
lea rax, [rbp + 0x40]
mov qword [rsp + 0x30], rax
mov rbx, qword [rbp + 0x38]
lea rcx, [rbx - 0x18]
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x40], rax
lea rdx, str.ExceptionCode
lea rcx, [rbp + 0x198]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x40]
mov rdx, rax
call fcn.14000f5f4
nop
jmp 0x140010372
cmp eax, 8
jne 0x140010221
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140011057
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp + 0x48], rax
mov r8d, dword [rdi + 0x130]
lea rdx, [0x14003fdb4]
lea rcx, [rbp + 0x48]
call fcn.1400047d8
lea rax, [rbp + 0x50]
mov qword [rsp + 0x30], rax
mov rbx, qword [rbp + 0x48]
lea rcx, [rbx - 0x18]
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x50], rax
lea rdx, str.FPESubcode
lea rcx, [rbp + 0x1a0]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x50]
mov rdx, rax
call fcn.14000f5f4
nop
jmp 0x140010372
cmp eax, 6
jne 0x140010394
lea rax, [rbp + 0x58]
mov qword [rsp + 0x30], rax
mov rcx, qword [rdi + 0x138]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x58], rax
lea rdx, str.InvParamExpression
lea rcx, [rbp + 0x1a8]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x58]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp + 0x60]
mov qword [rsp + 0x30], rax
mov rcx, qword [rdi + 0x140]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x60], rax
lea rdx, str.InvParamFunction
lea rcx, [rbp + 0x1b0]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x60]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp + 0x68]
mov qword [rsp + 0x30], rax
mov rcx, qword [rdi + 0x148]
sub rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x68], rax
lea rdx, str.InvParamFile
lea rcx, [rbp + 0x1b8]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x68]
mov rdx, rax
call fcn.14000f5f4
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x14001104c
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp + 0x70], rax
mov r8d, dword [rdi + 0x150]
lea rdx, [0x14003fdb4]
lea rcx, [rbp + 0x70]
call fcn.1400047d8
lea rax, [rbp + 0x78]
mov qword [rsp + 0x30], rax
mov rbx, qword [rbp + 0x70]
lea rcx, [rbx - 0x18]
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x78], rax
lea rdx, str.InvParamLine
lea rcx, [rbp + 0x1c0]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x78]
mov rdx, rax
call fcn.14000f5f4
nop
mov eax, esi
lock xadd dword [rbx - 8], eax
add eax, esi
test eax, eax
jg 0x140010394
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140011057
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp + 0x80], rax
mov r8d, dword [r15 + 0x88]
lea rdx, [0x14003fdb4]
lea rcx, [rbp + 0x80]
call fcn.1400047d8
lea rax, [rbp + 0x88]
mov qword [rsp + 0x30], rax
mov r13, qword [rbp + 0x80]
add r13, 0xffffffffffffffe8
mov qword [rbp + 0xf0], r13
mov rcx, r13
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x88], rax
lea rdx, str.GUIResourceCount
lea rcx, [rbp + 0x230]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x88]
mov rdx, rax
call fcn.14000f5f4
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140011062
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp + 0x90], rax
mov r8d, dword [r15 + 0x8c]
lea rdx, [0x14003fdb4]
lea rcx, [rbp + 0x90]
call fcn.1400047d8
lea rax, [rbp + 0x98]
mov qword [rsp + 0x28], rax
mov rcx, qword [rbp + 0x90]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x30], rcx
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0x98], rax
lea rdx, str.OpenHandleCount
lea rcx, [rbp + 0x1d0]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0x98]
mov rdx, rax
call fcn.14000f5f4
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
mov rcx, qword [r15 + 0x90]
sub rcx, 0x18
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xa0], rax
lea rdx, str.MemoryUsageKbytes
lea rcx, [rbp + 0x1d8]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xa0]
mov rdx, rax
call fcn.14000f5f4
mov dword [rbp + 0x5d0], 0x40
lea rcx, [rbp + 0x5d0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x14001106d
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov r8d, dword [rbp + 0x5d4]
lea rdx, [0x14003fdb4]
lea rcx, [rsp + 0x38]
call fcn.1400047d8
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xa8], rax
lea rdx, str.MemoryLoad
lea rcx, [rbp + 0x1e0]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xa8]
mov rdx, rax
call fcn.14000f5f4
mov r8, qword [rbp + 0x5d8]
add r8, 0xfffff
shr r8, 0x14
lea rdx, [0x14003fdb4]
lea rcx, [rsp + 0x38]
call fcn.1400047d8
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xb0], rax
lea rdx, str.TotalPhysicalMemory
lea rcx, [rbp + 0x1e8]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xb0]
mov rdx, rax
call fcn.14000f5f4
mov r8, qword [rbp + 0x5e0]
add r8, 0xfffff
shr r8, 0x14
lea rdx, [0x14003fdb4]
lea rcx, [rsp + 0x38]
call fcn.1400047d8
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xb8], rax
lea rdx, str.AvailablePhysicalMemory
lea rcx, [rbp + 0x1f0]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xb8]
mov rdx, rax
call fcn.14000f5f4
mov r8, qword [rbp + 0x5e8]
add r8, 0xfffff
shr r8, 0x14
lea rdx, [0x14003fdb4]
lea rcx, [rsp + 0x38]
call fcn.1400047d8
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xc0], rax
lea rdx, str.TotalPageFile
lea rcx, [rbp + 0x1f8]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xc0]
mov rdx, rax
call fcn.14000f5f4
mov r8, qword [rbp + 0x5f0]
add r8, 0xfffff
shr r8, 0x14
lea rdx, [0x14003fdb4]
lea rcx, [rsp + 0x38]
call fcn.1400047d8
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xc8], rax
lea rdx, str.AvailablePageFile
lea rcx, [rbp + 0x200]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xc8]
mov rdx, rax
call fcn.14000f5f4
mov r8, qword [rbp + 0x5f8]
add r8, 0xfffff
shr r8, 0x14
lea rdx, [0x14003fdb4]
lea rcx, [rsp + 0x38]
call fcn.1400047d8
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xd0], rax
lea rdx, str.TotalVirtualMemory
lea rcx, [rbp + 0x208]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xd0]
mov rdx, rax
call fcn.14000f5f4
mov r8, qword [rbp + 0x600]
add r8, 0xfffff
shr r8, 0x14
lea rdx, [0x14003fdb4]
lea rcx, [rsp + 0x38]
call fcn.1400047d8
lea rax, [rbp + 0xd8]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x38]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x28], rcx
call fcn.140001ea0
add rax, 0x18
mov qword [rbp + 0xd8], rax
lea rdx, str.AvailableVirtualMemory
lea rcx, [rbp + 0x210]
call fcn.1400041e8
nop
mov r9, r14
lea r8, [rbp + 0xd8]
mov rdx, rax
call fcn.14000f5f4
lea rdx, str.CustomProps
lea rcx, [rbp + 0x2c0]
call fcn.140014fc8
mov rsi, rax
mov rdx, rax
mov rcx, r14
call fcn.140013a30
xor ebx, ebx
cmp dword [r15 + 0xe8], ebx
jle 0x140010a76
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140011083
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rsp + 0x78], rax
call fcn.1400016e0
mov rcx, rax
test rax, rax
je 0x140011078
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x14001405b.0]
add rax, 0x18
mov qword [rbp - 0x68], rax
lea rcx, [rsp + 0x78]
call fcn.140001e20
lea rcx, [rbp - 0x68]
call fcn.140001e20
test r12d, r12d
js 0x14001095d
cmp r12d, dword [r15 + 0xe8]
jge 0x14001095d
mov rax, qword [r15 + 0xe0]
mov rax, qword [rax]
test r12d, r12d
jle 0x14001093f
mov r8d, r12d
mov rcx, qword [rax + 0x10]
cmp byte [rcx + 0x19], bl
je 0x140010920
mov rcx, qword [rax + 8]
jmp 0x140010916
cmp rax, qword [rcx + 0x10]
jne 0x14001091b
mov rax, rcx
mov rcx, qword [rcx + 8]
cmp byte [rcx + 0x19], bl
je 0x140010909
mov rax, rcx
jmp 0x140010939
mov rax, rcx
mov rdx, qword [rcx]
cmp byte [rdx + 0x19], bl
jne 0x140010939
mov rax, rdx
mov rcx, qword [rdx]
mov rdx, rcx
cmp byte [rcx + 0x19], bl
je 0x14001092b
sub r8, 1
jne 0x1400108fa
lea rbx, [rax + 0x20]
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140004164
lea rdx, [rbx + 8]
lea rcx, [rbp - 0x68]
call fcn.140004164
lea rdx, str.Prop
lea rcx, [rbp + 0x2c0]
call fcn.140014fc8
mov rbx, rax
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp + 0x110]
call fcn.140004c80
mov rdi, rax
test rbx, rbx
je 0x14001099e
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
mov rcx, rbx
call qword [case.0x14001405b.0]
jmp 0x1400109a0
xor eax, eax
mov r8, rdi
lea rdx, str.name
mov rcx, rax
call fcn.1400054e8
mov rdi, qword [rbp - 0x68]
mov rdx, rdi
lea rcx, [rbp + 0x110]
call fcn.140004c80
mov qword [rsp + 0x50], rax
test rbx, rbx
je 0x1400109e1
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
mov rcx, rbx
call qword [case.0x14001405b.0]
jmp 0x1400109e3
xor eax, eax
mov r8, qword [rsp + 0x50]
lea rdx, str.value
mov rcx, rax
call fcn.1400054e8
test rsi, rsi
je 0x140010a0e
mov rax, qword [rsi]
mov rcx, rsi
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
jmp 0x140010a10
xor eax, eax
mov rdx, rbx
mov rcx, rax
call fcn.140013a30
nop
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
xor ebx, ebx
sub eax, 1
jg 0x140010a40
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140010a66
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
inc r12d
cmp r12d, dword [r15 + 0xe8]
jl 0x14001087a
lea rdx, str.FileList
lea rcx, [rbp + 0x2c0]
call fcn.140014fc8
mov rdi, rax
mov rdx, rax
mov rcx, r14
call fcn.140013a30
xor r12d, r12d
mov r14d, r12d
cmp dword [r15 + 0xc8], r12d
jle 0x140010c09
xor r13d, r13d
mov edx, r14d
mov rcx, r15
call fcn.140005f38
mov rsi, rax
lea rdx, str.FileItem
lea rcx, [rbp + 0x2c0]
call fcn.140014fc8
mov rbx, rax
mov rdx, qword [rsi + 8]
lea rcx, [rbp + 0x110]
call fcn.140004c80
mov r12, rax
test rbx, rbx
je 0x140010afb
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
mov rcx, rbx
call qword [case.0x14001405b.0]
jmp 0x140010afe
mov rax, r13
mov r8, r12
lea rdx, str.name
mov rcx, rax
call fcn.1400054e8
mov rdx, qword [rsi + 0x10]
lea rcx, [rbp + 0x110]
call fcn.140004c80
mov r12, rax
test rbx, rbx
je 0x140010b3a
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
mov rcx, rbx
call qword [case.0x14001405b.0]
jmp 0x140010b3d
mov rax, r13
mov r8, r12
lea rdx, str.description
mov rcx, rax
call fcn.1400054e8
cmp dword [rsi + 0x1c], r13d
je 0x140010b85
test rbx, rbx
je 0x140010b6c
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
jmp 0x140010b6f
mov rax, r13
lea r8, [0x14003f00c]
lea rdx, str.optional
mov rcx, rax
call fcn.1400054e8
mov rdx, qword [rsi + 0x20]
cmp dword [rdx - 0x10], r13d
je 0x140010bca
lea rcx, [rbp + 0x110]
call fcn.140004c80
mov rsi, rax
test rbx, rbx
je 0x140010bb5
mov rcx, qword [rbx]
mov rax, qword [rcx + 8]
mov rcx, rbx
call qword [case.0x14001405b.0]
jmp 0x140010bb8
mov rax, r13
mov r8, rsi
lea rdx, str.error
mov rcx, rax
call fcn.1400054e8
test rdi, rdi
je 0x140010be1
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
jmp 0x140010be4
mov rax, r13
mov rdx, rbx
mov rcx, rax
call fcn.140013a30
inc r14d
cmp r14d, dword [r15 + 0xc8]
jl 0x140010aad
mov r13, qword [rbp + 0xf0]
xor r12d, r12d
lea r8, [0x14003f084]
mov rdx, qword [rbp - 0x58]
lea rcx, [rsp + 0x58]
call fcn.1400215b0
mov rdx, qword [rsp + 0x58]
test rdx, rdx
jne 0x140010c58
lea rdx, str.Error_opening_file_for_writing
or r14, 0xffffffffffffffff
mov rax, r14
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140010c36
mov r8d, eax
lea rcx, [rsp + 0x70]
call fcn.1400020f4
mov rcx, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x48]
jmp 0x140010ccb
mov byte [rbp + 0x328], 1
lea rcx, [rbp + 0x2c0]
call fcn.140015118
test eax, eax
jne 0x140010cac
mov rax, qword [rbp + 0x348]
cmp qword [rbp + 0x340], rax
jne 0x140010c88
lea rax, [0x14003e878]
jmp 0x140010c94
lea rcx, [rbp + 0x338]
call fcn.140013274
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400040a4
mov rcx, qword [rsp + 0x58]
mov ebx, dword [rsp + 0x48]
jmp 0x140010cc7
mov rcx, qword [rsp + 0x58]
call fcn.14002168c
mov rcx, r12
mov qword [rsp + 0x58], rcx
mov ebx, 1
mov dword [rsp + 0x48], ebx
or r14, 0xffffffffffffffff
test rcx, rcx
je 0x140010cd5
call fcn.14002168c
test ebx, ebx
jne 0x140010e1a
mov rdx, qword [rbp + 0x258]
lea rcx, [rbp - 0x80]
call fcn.1400041e8
nop
add r15, 0xc0
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x2a0]
mov rcx, r15
call fcn.14000a49c
mov rbx, qword [rbp + 0x2b0]
cmp byte [rbx + 0x19], r12b
jne 0x140010d56
mov rdx, qword [rbx + 0x20]
test rdx, rdx
je 0x14001108e
mov rax, qword [rbp - 0x80]
mov rcx, rax
sub rdx, rax
movzx r8d, word [rcx]
cmp r8w, word [rcx + rdx]
jne 0x140010d46
add rcx, 2
test r8w, r8w
jne 0x140010d2c
mov ecx, r12d
jmp 0x140010d4b
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x140010de5
movabs rax, 0x333333333333333
cmp qword [r15 + 8], rax
je 0x140010fee
mov rsi, qword [r15]
mov qword [rbp + 0x280], r15
mov qword [rbp + 0x288], r12
mov ecx, 0x50
call fcn.140016c58
mov rdi, rax
mov qword [rbp + 0x288], rax
mov rcx, qword [rbp - 0x80]
add rcx, 0xffffffffffffffe8
call fcn.140001ea0
add rax, 0x18
mov qword [rdi + 0x20], rax
lea rcx, [rdi + 0x28]
call fcn.140005604
mov qword [rdi], rsi
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
and word [rdi + 0x18], 0
movups xmm0, xmmword [rbp + 0x2a0]
movdqu xmmword [rbp + 0x290], xmm0
mov r8, rdi
lea rdx, [rbp + 0x290]
mov rcx, r15
call fcn.140002274
mov rbx, rax
mov rax, qword [rbp - 0x80]
lea rdx, [rax - 0x18]
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
add ecx, r14d
test ecx, ecx
jg 0x140010e08
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14001405b.0]
lea rcx, [rbx + 0x48]
lea rdx, [rsp + 0x70]
call fcn.140004164
mov ebx, dword [rsp + 0x48]
mov eax, r14d
mov rdx, qword [rsp + 0x28]
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140010e3f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
nop
mov eax, r14d
mov rdx, qword [rsp + 0x30]
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140010e64
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
nop
mov eax, r14d
lock xadd dword [r13 + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140010e89
mov rcx, qword [r13]
mov rax, qword [rcx]
mov rdx, r13
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
nop
mov eax, r14d
mov rdx, qword [rbp + 0x238]
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140010eb0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
nop
mov eax, r14d
mov rdx, qword [rsp + 0x20]
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140010ed5
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
nop
mov eax, r14d
mov rdx, qword [rsp + 0x40]
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140010efa
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140010f22
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140010f4b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
nop
lea rcx, [rbp + 0x2c0]
call fcn.140014ec4
nop
lea rcx, [rbp + 0x110]
call fcn.140002ad0
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140010f8e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14001405b.0]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x140010fb6
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14001405b.0]
nop
lea rcx, [rbp + 0x258]
call fcn.140008038
mov eax, ebx
mov rcx, qword [rbp + 0xc70]
xor rcx, rsp
call fcn.1400169c0
mov rbx, qword [rsp + 0xdd0]
add rsp, 0xd80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140001ad0
nop
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
int3
mov ecx, 0x80004005
call fcn.140001558
int3
mov ecx, 0x80004005
call fcn.140001558
int3
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
nop
mov ecx, 0x80004005
call fcn.140001558
int3