Function at 0x40b8d2
Capabilities:
Contain obfuscated stackstrings
Get geographical location
Get memory capacity
Get session user name

Disassembly:
push 0x7e0
mov eax, 0x4135aa
call fcn.00411e39
mov edi, ecx
mov dword [ebp - 0x5b0], edi
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x62c]
mov dword [ebp - 0x5ac], esi
xor ebx, ebx
call fcn.004045f0
lea eax, [ebp - 0x5c4]
mov dword [ebp - 4], ebx
push eax
mov ecx, esi
call fcn.00404984
push 0x415004
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5f0]
call fcn.004033ff
pop ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x5c4]
lea ecx, [ecx - 0x10]
call fcn.00401572
call fcn.00401598
push eax
lea ecx, [ebp - 0x5e8]
call fcn.00401b24
mov dword [ebp - 0x5fc], ebx
mov dword [ebp - 0x5f8], ebx
mov dword [ebp - 0x5f4], ebx
push ecx
push ecx
lea ecx, [ebp - 0x7ec]
call fcn.0040f7ae
mov byte [ebp - 4], 6
mov dword [ebp - 0x5dc], ebx
call fcn.00401598
push eax
lea ecx, [ebp - 0x5e4]
call fcn.00401b24
mov byte [ebp - 4], 7
call fcn.00401598
push eax
lea ecx, [ebp - 0x5e0]
call fcn.00401b24
mov byte [ebp - 4], 8
call fcn.00401598
push eax
lea ecx, [ebp - 0x600]
call fcn.00401b24
mov byte [ebp - 4], 9
call fcn.00401598
push eax
lea ecx, [ebp - 0x604]
call fcn.00401b24
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x5c4]
mov edx, dword [edi + 0x10]
push str.DescXML
push str.DetailDlg
mov dword [ebp - 0x620], ebx
call fcn.00402d20
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x624]
mov byte [ebp - 4], 0xb
call fcn.00403848
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x5c4]
lea ecx, [ecx - 0x10]
call fcn.00401572
push str.crashrpt.xml
lea ecx, [ebp - 0x62c]
call fcn.00401a37
lea eax, [ebp - 0x5f0]
push eax
lea ecx, [ebp - 0x628]
call fcn.00403848
lea eax, [ebp - 0x5e8]
push eax
lea ecx, [ebp - 0x618]
call fcn.00403848
lea eax, [ebp - 0x62c]
push eax
push eax
lea ecx, [esi + 0x78]
call fcn.00406f91
mov ecx, eax
call fcn.00404a95
push ebx
lea ecx, [ebp - 0x7ec]
call fcn.0040facd
push eax
lea ecx, [ebp - 0x7ec]
call fcn.0040ea48
push 0x4154e4
lea ecx, [ebp - 0x7ec]
call fcn.0040fa5e
mov ebx, eax
lea ecx, [ebp - 0x7ec]
push ebx
mov dword [ebp - 0x5cc], ebx
call fcn.0040ea48
push 0x57b
lea eax, [ebp - 0x5e0]
push 0x416128
push eax
call fcn.00403bff
mov edi, dword [ebp - 0x5e0]
lea ecx, [ebp - 0x5fc]
add esp, 0xc
push edi
call fcn.00403f06
push eax
push str.version
lea ecx, [ebp - 0x5c4]
mov dword [ebp - 0x5c4], ebx
call fcn.004045b0
mov ecx, eax
call fcn.00404520
push ebx
push ecx
mov ecx, dword [ebp - 0x5ac]
mov esi, esp
mov dword [ebp - 0x5a8], esi
mov dword [ebp - 0x5c8], esp
mov ecx, dword [ecx + 0xc]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xc
push str.CrashGUID
call fcn.004038e5
mov byte [ebp - 4], 0xa
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ecx, dword [eax + 0x10]
push 0x10
pop edi
sub ecx, edi
call fcn.00401b9c
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xd
push str.AppName
call fcn.004038e5
mov byte [ebp - 4], 0xa
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ecx, dword [eax + 0x14]
sub ecx, edi
call fcn.00401b9c
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xe
push str.AppVersion
call fcn.004038e5
mov byte [ebp - 4], 0xa
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ecx, dword [eax + 0x18]
sub ecx, edi
call fcn.00401b9c
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xf
push str.ImageName
call fcn.004038e5
mov byte [ebp - 4], 0xa
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ecx, dword [eax + 0x5c]
sub ecx, edi
call fcn.00401b9c
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x10
push str.OperatingSystem
call fcn.004038e5
mov byte [ebp - 4], 0xa
call fcn.0040b841
call fcn.00401598
push eax
lea ecx, [ebp - 0x5ec]
call fcn.00401b24
push 0x344
xor esi, esi
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x5a0]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x5a4], 0x348
mov edi, esi
push esi
lea eax, [ebp - 0x5a4]
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
je 0x40bc9e
test byte [ebp - 0x460], 8
jne 0x40bc98
test byte [ebp - 0x460], 1
je 0x40bc98
test edi, edi
je 0x40bc86
push 0x414d6c
lea ecx, [ebp - 0x5ec]
call fcn.004037b5
lea eax, [ebp - 0x560]
push eax
lea ecx, [ebp - 0x5ec]
call fcn.004037b5
inc edi
cmp edi, 0x10
jl 0x40bc4c
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov eax, dword [ebp - 0x5ec]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x614], eax
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x12
push str.DispalyDevice
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
push 0x202
lea eax, [ebp - 0x21c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x610], 0x101
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
push ebx
push ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x5c8], esp
mov ecx, esp
push eax
call fcn.004038e5
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x13
push str.User
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ecx, dword [eax + 0x2c]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x14
push 0x4161d0
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
mov ecx, dword [ebp - 0x5b0]
mov eax, dword [ecx + 0xdc]
cmp eax, 0xd
jne 0x40be40
call fcn.00401598
push eax
lea ecx, [ebp - 0x5d8]
call fcn.00401b24
push pe_nt_image_headers32
lea eax, [ebp - 0x35c]
mov byte [ebp - 4], 0x15
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x5ac]
movsd xmm0, qword [eax + 0x30]
lea eax, [ebp - 0x35c]
movsd qword [esp + 4], xmm0
mov dword [esp], 0x4159b0
push eax
call fcn.0040dcdd
lea eax, [ebp - 0x35c]
push eax
lea eax, [ebp - 0x5d8]
push 0x414e70
push eax
call fcn.00403bff
add esp, 0x1c
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ebx, dword [ebp - 0x5d8]
lea ecx, [ebx - 0x10]
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x16
push str.CPUUsage
call fcn.004038e5
mov byte [ebp - 4], 0x15
jmp 0x40bedd
cmp eax, 4
jne 0x40bef4
mov ecx, dword [ecx + 0xd0]
lea edx, [ebp - 0x5d0]
xor eax, eax
mov dword [ebp - 0x5d0], eax
mov dword [ebp - 0x5d8], eax
lea eax, [ebp - 0x5d8]
push eax
call fcn.00402cb0
pop ecx
call fcn.00401598
push eax
lea ecx, [ebp - 0x5c0]
call fcn.00401b24
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x5c0]
push dword [ebp - 0x5d8]
push dword [ebp - 0x5d0]
push str._d____p
push eax
call fcn.00403bff
add esp, 0x10
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5c8], esp
mov dword [ebp - 0x5a8], esi
mov ebx, dword [ebp - 0x5c0]
lea ecx, [ebx - 0x10]
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x18
push str.VMUsage
call fcn.004038e5
mov byte [ebp - 4], 0x17
call fcn.0040b841
lea ecx, [ebx - 0x10]
mov byte [ebp - 4], 0x11
call fcn.00401572
mov ebx, dword [ebp - 0x5cc]
mov eax, dword [ebp - 0x5ac]
mov edi, 0x416128
push dword [eax + 0x60]
lea eax, [ebp - 0x600]
push edi
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5c8], esi
mov eax, dword [ebp - 0x600]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x5c8], eax
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x19
push str.OSIs64Bit
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [eax + 0x64]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1a
push str.GeoLocation
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [eax + 0x28]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1b
push str.SystemTimeUTC
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x3c]
mov eax, ecx
or eax, edx
je 0x40c11f
push edx
push ecx
mov edi, str.0x_I64x
lea eax, [ebp - 0x5e4]
push edi
push eax
call fcn.00403bff
add esp, 0x10
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [ebp - 0x5e4]
add ecx, 0xfffffff0
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1c
push str.ExceptionAddress
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [eax + 0x40]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1d
push str.ExceptionModule
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push dword [eax + 0x4c]
push dword [eax + 0x48]
lea eax, [ebp - 0x5e4]
push edi
push eax
call fcn.00403bff
add esp, 0x10
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [ebp - 0x5e4]
add ecx, 0xfffffff0
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1e
push str.ExceptionModuleBase
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5a8], esp
mov dword [ebp - 0x5b4], esi
mov ecx, dword [eax + 0x44]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1f
push str.ExceptionModuleVersion
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
mov edi, 0x416128
mov ecx, dword [ebp - 0x5b0]
lea eax, [ebp - 0x604]
push dword [ecx + 0xdc]
push edi
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5a8], esi
mov eax, dword [ebp - 0x604]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x5a8], eax
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x20
push str.ExceptionType
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
mov esi, dword [ebp - 0x5b0]
mov eax, dword [esi + 0xdc]
test eax, eax
jne 0x40c1fc
call fcn.00401598
push eax
lea ecx, [ebp - 0x5c0]
call fcn.00401b24
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x5c0]
push dword [esi + 0xe0]
push str.0x_x
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov ebx, dword [ebp - 0x5c0]
lea ecx, [ebx - 0x10]
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x22
push str.ExceptionCode
call fcn.004038e5
mov byte [ebp - 4], 0x21
jmp 0x40c3a4
cmp eax, 8
jne 0x40c269
call fcn.00401598
push eax
lea ecx, [ebp - 0x5c0]
call fcn.00401b24
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x5c0]
push dword [esi + 0xe4]
push edi
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov ebx, dword [ebp - 0x5c0]
lea ecx, [ebx - 0x10]
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x24
push str.FPESubcode
call fcn.004038e5
mov byte [ebp - 4], 0x23
jmp 0x40c3a4
cmp eax, 6
jne 0x40c3bb
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov ecx, dword [ebp - 0x5b0]
mov ecx, dword [ecx + 0xe8]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x25
push str.InvParamExpression
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov eax, dword [ebp - 0x5b0]
mov ecx, dword [eax + 0xec]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x26
push str.InvParamFunction
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov eax, dword [ebp - 0x5b0]
mov ecx, dword [eax + 0xf0]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x27
push str.InvParamFile
call fcn.004038e5
mov byte [ebp - 4], 0x11
call fcn.0040b841
call fcn.00401598
push eax
lea ecx, [ebp - 0x5c0]
call fcn.00401b24
mov byte [ebp - 4], 0x28
mov eax, dword [ebp - 0x5b0]
push dword [eax + 0xf4]
lea eax, [ebp - 0x5c0]
push edi
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b4], esp
mov dword [ebp - 0x5bc], esi
mov ebx, dword [ebp - 0x5c0]
lea ecx, [ebx - 0x10]
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x29
push str.InvParamLine
call fcn.004038e5
mov byte [ebp - 4], 0x28
call fcn.0040b841
lea ecx, [ebx - 0x10]
mov byte [ebp - 4], 0x11
call fcn.00401572
mov ebx, dword [ebp - 0x5cc]
call fcn.00401598
push eax
lea ecx, [ebp - 0x5c0]
call fcn.00401b24
mov eax, dword [ebp - 0x5ac]
mov byte [ebp - 4], 0x2a
push dword [eax + 0x50]
lea eax, [ebp - 0x5c0]
push edi
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5bc], esp
mov dword [ebp - 0x5b4], esi
mov eax, dword [ebp - 0x5c0]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x5b4], eax
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x2b
push str.GUIResourceCount
call fcn.004038e5
mov byte [ebp - 4], 0x2a
call fcn.0040b841
call fcn.00401598
push eax
lea ecx, [ebp - 0x608]
call fcn.00401b24
mov eax, dword [ebp - 0x5ac]
mov byte [ebp - 4], 0x2c
push dword [eax + 0x54]
lea eax, [ebp - 0x608]
push edi
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5bc], esi
mov eax, dword [ebp - 0x608]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x5bc], eax
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x2d
push str.OpenHandleCount
call fcn.004038e5
mov byte [ebp - 4], 0x2c
call fcn.0040b841
mov eax, dword [ebp - 0x5ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [eax + 0x58]
sub ecx, 0x10
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 0x2e
mov ecx, esp
push str.MemoryUsageKbytes
call fcn.004038e5
mov byte [ebp - 4], 0x2c
call fcn.0040b841
lea eax, [ebp - 0x25c]
mov dword [ebp - 0x25c], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call fcn.00401598
push eax
lea ecx, [ebp - 0x5b0]
call fcn.00401b24
mov byte [ebp - 4], 0x2f
lea eax, [ebp - 0x5b0]
push dword [ebp - 0x258]
push edi
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x30
push str.MemoryLoad
call fcn.004038e5
mov byte [ebp - 4], 0x2f
call fcn.0040b841
mov ecx, dword [ebp - 0x254]
mov edi, 0xfffff
mov eax, dword [ebp - 0x250]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x5b0]
push ecx
push 0x416128
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x31
push str.TotalPhysicalMemory
call fcn.004038e5
mov byte [ebp - 4], 0x2f
call fcn.0040b841
mov ecx, dword [ebp - 0x24c]
mov eax, dword [ebp - 0x248]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x5b0]
push ecx
push 0x416128
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x32
push str.AvailablePhysicalMemory
call fcn.004038e5
mov byte [ebp - 4], 0x2f
call fcn.0040b841
mov ecx, dword [ebp - 0x244]
mov eax, dword [ebp - 0x240]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x5b0]
push ecx
push 0x416128
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x33
push str.TotalPageFile
call fcn.004038e5
mov byte [ebp - 4], 0x2f
call fcn.0040b841
mov ecx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x238]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x5b0]
push ecx
push 0x416128
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x34
push str.AvailablePageFile
call fcn.004038e5
mov byte [ebp - 4], 0x2f
call fcn.0040b841
mov ecx, dword [ebp - 0x234]
mov eax, dword [ebp - 0x230]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
push ecx
push 0x416128
lea eax, [ebp - 0x5b0]
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5d4], esp
mov dword [ebp - 0x5b8], esi
mov ecx, dword [ebp - 0x5b0]
add ecx, 0xfffffff0
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x35
push str.TotalVirtualMemory
call fcn.004038e5
mov byte [ebp - 4], 0x2f
call fcn.0040b841
mov ecx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x228]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x5b0]
push ecx
push 0x416128
push eax
call fcn.00403bff
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x5b8], esp
mov dword [ebp - 0x5d4], esi
mov eax, dword [ebp - 0x5b0]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x5d4], eax
call fcn.00401b9c
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x36
push str.AvailableVirtualMemory
call fcn.004038e5
mov byte [ebp - 4], 0x2f
call fcn.0040b841
push str.CustomProps
lea ecx, [ebp - 0x7ec]
call fcn.0040fa5e
push eax
mov ecx, ebx
mov dword [ebp - 0x5b8], eax
call fcn.0040ea48
mov esi, dword [ebp - 0x5ac]
xor eax, eax
mov edi, dword [ebp - 0x5e0]
mov dword [ebp - 0x5d8], eax
cmp dword [esi + 0x8c], eax
jle 0x40c91f
mov ebx, esi
call fcn.00401598
push eax
lea ecx, [ebp - 0x5d0]
call fcn.00401b24
mov byte [ebp - 4], 0x37
call fcn.00401598
push eax
lea ecx, [ebp - 0x60c]
call fcn.00401b24
lea eax, [ebp - 0x60c]
mov byte [ebp - 4], 0x38
push eax
lea eax, [ebp - 0x5d0]
mov ecx, ebx
push eax
push dword [ebp - 0x5d8]
call fcn.00404add
push str.Prop
lea ecx, [ebp - 0x7ec]
call fcn.0040fa5e
push dword [ebp - 0x5d0]
mov edi, eax
lea ecx, [ebp - 0x5fc]
mov dword [ebp - 0x5c4], edi
call fcn.00403f06
push eax
push str.name
lea ecx, [ebp - 0x5c4]
call fcn.004045b0
mov ecx, eax
call fcn.00404520
mov esi, dword [ebp - 0x60c]
lea ecx, [ebp - 0x5fc]
push esi
call fcn.00403f06
push eax
push str.value
lea ecx, [ebp - 0x5c4]
call fcn.004045b0
mov ecx, eax
call fcn.00404520
lea ecx, [ebp - 0x5b8]
call fcn.004045b0
push edi
mov ecx, eax
call fcn.0040ea48
lea ecx, [esi - 0x10]
call fcn.00401572
mov byte [ebp - 4], 0x2f
mov ecx, dword [ebp - 0x5d0]
lea ecx, [ecx - 0x10]
call fcn.00401572
mov eax, dword [ebp - 0x5d8]
inc eax
mov dword [ebp - 0x5d8], eax
cmp eax, dword [ebx + 0x8c]
jl 0x40c817
mov edi, dword [ebp - 0x5e0]
mov ebx, dword [ebp - 0x5cc]
mov esi, dword [ebp - 0x5ac]
push str.FileList
lea ecx, [ebp - 0x7ec]
call fcn.0040fa5e
push eax
mov ecx, ebx
mov dword [ebp - 0x5b8], eax
call fcn.0040ea48
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0x5c4], ebx
cmp dword [esi + 0x7c], ebx
jle 0x40ca62
mov edi, dword [ebp - 0x5ac]
push eax
mov ecx, edi
call fcn.0040499e
push str.FileItem
lea ecx, [ebp - 0x7ec]
mov dword [ebp - 0x5cc], eax
call fcn.0040fa5e
mov esi, eax
lea ecx, [ebp - 0x5fc]
mov eax, dword [ebp - 0x5cc]
mov dword [ebp - 0x5d0], esi
push dword [eax + 4]
call fcn.00403f06
push eax
push str.name
lea ecx, [ebp - 0x5d0]
call fcn.004045b0
mov ecx, eax
call fcn.00404520
mov eax, dword [ebp - 0x5cc]
lea ecx, [ebp - 0x5fc]
push dword [eax + 8]
call fcn.00403f06
push eax
push str.description
lea ecx, [ebp - 0x5d0]
call fcn.004045b0
mov ecx, eax
call fcn.00404520
mov eax, dword [ebp - 0x5cc]
cmp dword [eax + 0x10], ebx
je 0x40ca01
push 0x4154d0
push str.optional
lea ecx, [ebp - 0x5d0]
call fcn.004045b0
mov ecx, eax
call fcn.00404520
mov eax, dword [ebp - 0x5cc]
mov eax, dword [eax + 0x14]
cmp dword [eax - 0xc], ebx
je 0x40ca2d
push eax
lea ecx, [ebp - 0x5fc]
call fcn.00403f06
push eax
push str.error
lea ecx, [ebp - 0x5d0]
call fcn.004045b0
mov ecx, eax
call fcn.00404520
lea ecx, [ebp - 0x5b8]
call fcn.004045b0
push esi
mov ecx, eax
call fcn.0040ea48
mov eax, dword [ebp - 0x5c4]
inc eax
mov dword [ebp - 0x5c4], eax
cmp eax, dword [edi + 0x7c]
jl 0x40c956
mov edi, dword [ebp - 0x5e0]
mov esi, dword [ebp - 0x5ac]
push 0x415538
push dword [ebp - 0x5f0]
lea eax, [ebp - 0x5dc]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
cmp dword [ebp - 0x5dc], ebx
jne 0x40ca9d
push str.Error_opening_file_for_writing
lea ecx, [ebp - 0x5e8]
call fcn.00401a37
mov eax, dword [ebp - 0x5dc]
jmp 0x40cb00
push ecx
push dword [ebp - 0x5dc]
lea ecx, [ebp - 0x7ec]
mov byte [ebp - 0x7b8], 1
call fcn.0040fbf0
test eax, eax
jne 0x40cae8
mov eax, dword [ebp - 0x7a8]
cmp eax, dword [ebp - 0x7a4]
jne 0x40cacf
mov eax, 0x414da0
jmp 0x40cada
lea ecx, [ebp - 0x7ac]
call fcn.0040e415
push eax
lea ecx, [ebp - 0x5e8]
call fcn.004037f0
jmp 0x40ca95
push dword [ebp - 0x5dc]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
xor ebx, ebx
pop ecx
mov dword [ebp - 0x5dc], eax
inc ebx
test eax, eax
je 0x40cb0c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test ebx, ebx
jne 0x40cb2c
lea eax, [ebp - 0x5e8]
mov ecx, esi
push eax
push dword [ebp - 0x62c]
call fcn.004049d7
lea ecx, [eax + 0x14]
call fcn.00403848
mov ecx, dword [ebp - 0x5d4]
call fcn.00401572
mov ecx, dword [ebp - 0x5bc]
call fcn.00401572
mov ecx, dword [ebp - 0x5b4]
call fcn.00401572
mov ecx, dword [ebp - 0x614]
call fcn.00401572
mov ecx, dword [ebp - 0x5a8]
call fcn.00401572
mov ecx, dword [ebp - 0x5c8]
call fcn.00401572
lea ecx, [edi - 0x10]
call fcn.00401572
mov ecx, dword [ebp - 0x5e4]
lea ecx, [ecx - 0x10]
call fcn.00401572
lea ecx, [ebp - 0x7ec]
call fcn.0040f925
lea ecx, [ebp - 0x5fc]
call fcn.004026cc
mov ecx, dword [ebp - 0x5e8]
add ecx, 0xfffffff0
call fcn.00401572
mov ecx, dword [ebp - 0x5f0]
add ecx, 0xfffffff0
call fcn.00401572
lea ecx, [ebp - 0x62c]
call fcn.0040632f
mov eax, ebx
call fcn.00411de3
ret 4