Function at 0x40b7b0
Capabilities:
Contain obfuscated stackstrings
Get geographical location
Get memory capacity

Disassembly:
push 0x5d8
mov eax, 0x414d03
call fcn.0041383d
mov edi, ecx
mov dword [ebp - 0x3a8], edi
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x3ac], ebx
xor esi, esi
call fcn.00404663
lea eax, [ebp - 0x3c4]
mov dword [ebp - 4], esi
push eax
mov ecx, ebx
call fcn.00404a08
push 0x417034
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3ec]
call fcn.0040344c
pop ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x3c4]
lea ecx, [ecx - 0x10]
call fcn.00401582
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3e0]
call fcn.00401b54
mov dword [ebp - 0x3f8], esi
mov dword [ebp - 0x3f4], esi
mov dword [ebp - 0x3f0], esi
push ecx
push ecx
lea ecx, [ebp - 0x5e4]
call fcn.00410060
mov byte [ebp - 4], 6
mov dword [ebp - 0x3d4], esi
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3dc]
call fcn.00401b54
mov byte [ebp - 4], 7
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3d8]
call fcn.00401b54
mov byte [ebp - 4], 8
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3fc]
call fcn.00401b54
mov byte [ebp - 4], 9
call fcn.004015a8
push eax
lea ecx, [ebp - 0x400]
call fcn.00401b54
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x3c4]
mov edx, dword [edi + 0x10]
push str.DescXML
push str.DetailDlg
mov dword [ebp - 0x414], esi
call fcn.00402ca1
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 0xb
call fcn.00403895
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x3c4]
lea ecx, [ecx - 0x10]
call fcn.00401582
push str.crashrpt.xml
lea ecx, [ebp - 0x420]
call fcn.00401a67
lea eax, [ebp - 0x3ec]
push eax
lea ecx, [ebp - 0x41c]
call fcn.00403895
lea eax, [ebp - 0x3e0]
push eax
lea ecx, [ebp - 0x40c]
call fcn.00403895
lea eax, [ebp - 0x420]
push eax
push eax
lea ecx, [ebx + 0x78]
call fcn.00406eef
mov ecx, eax
call fcn.00404b19
push esi
lea ecx, [ebp - 0x5e4]
call fcn.00410530
push eax
lea ecx, [ebp - 0x5e4]
call fcn.0040ec80
push 0x4174fc
lea ecx, [ebp - 0x5e4]
call fcn.004104d0
mov ebx, eax
lea ecx, [ebp - 0x5e4]
push ebx
mov dword [ebp - 0x3c0], ebx
call fcn.0040ec80
push 0x57b
lea eax, [ebp - 0x3d8]
push 0x418130
push eax
call fcn.00403c4c
mov edi, dword [ebp - 0x3d8]
lea ecx, [ebp - 0x3f8]
add esp, 0xc
push edi
call fcn.00403fac
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x3c4], ebx
mov esi, eax
call fcn.00404623
push str.version
mov ecx, eax
call fcn.0040f850
push ecx
push esi
lea ecx, [eax + 0x10]
call fcn.0040e180
push ebx
push ecx
mov ecx, dword [ebp - 0x3ac]
mov esi, esp
mov dword [ebp - 0x3a0], esi
mov dword [ebp - 0x3cc], esp
mov ecx, dword [ecx + 0xc]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xc
push str.CrashGUID
call fcn.00403932
mov byte [ebp - 4], 0xa
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3cc], esp
push 0x10
mov dword [ebp - 0x3a0], esi
mov ecx, dword [eax + 0x10]
pop edi
sub ecx, edi
call fcn.00401bcc
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xd
push str.AppName
call fcn.00403932
mov byte [ebp - 4], 0xa
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3cc], esp
mov dword [ebp - 0x3a0], esi
mov ecx, dword [eax + 0x14]
sub ecx, edi
call fcn.00401bcc
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xe
push str.AppVersion
call fcn.00403932
mov byte [ebp - 4], 0xa
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3cc], esp
mov dword [ebp - 0x3a0], esi
mov ecx, dword [eax + 0x18]
sub ecx, edi
call fcn.00401bcc
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0xf
push str.ImageName
call fcn.00403932
mov byte [ebp - 4], 0xa
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3cc], esp
mov dword [ebp - 0x3a0], esi
mov ecx, dword [eax + 0x5c]
sub ecx, edi
call fcn.00401bcc
add eax, edi
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x10
push str.OperatingSystem
call fcn.00403932
mov byte [ebp - 4], 0xa
call fcn.0040b71f
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3e8]
call fcn.00401b54
push 0x344
xor esi, esi
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x398]
push esi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x39c], 0x348
mov edi, esi
push esi
lea eax, [ebp - 0x39c]
push eax
push edi
push esi
call dword [sym.imp.USER32.dll_EnumDisplayDevicesW]
test eax, eax
je 0x40bb87
test byte [ebp - 0x258], 8
jne 0x40bb81
test byte [ebp - 0x258], 1
je 0x40bb81
test edi, edi
jle 0x40bb6f
push 0x416d9c
lea ecx, [ebp - 0x3e8]
call fcn.00403802
lea eax, [ebp - 0x358]
push eax
lea ecx, [ebp - 0x3e8]
call fcn.00403802
inc edi
cmp edi, 0x10
jl 0x40bb35
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3cc], esp
mov dword [ebp - 0x3a0], esi
mov eax, dword [ebp - 0x3e8]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x408], eax
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x12
push str.DispalyDevice
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3cc], esp
mov dword [ebp - 0x3a0], esi
mov ecx, dword [eax + 0x2c]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x13
push 0x4181cc
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
mov ecx, dword [ebp - 0x3a8]
mov eax, dword [ecx + 0xdc]
cmp eax, 0xd
jne 0x40bcc5
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3bc]
call fcn.00401b54
push pe_nt_image_headers32
lea eax, [ebp - 0x154]
mov byte [ebp - 4], 0x14
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp - 0x3ac]
movsd xmm0, qword [eax + 0x30]
lea eax, [ebp - 0x154]
movsd qword [esp + 4], xmm0
mov dword [esp], 0x4179c0
push eax
call fcn.0040dbb5
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x3bc]
push 0x416ea0
push eax
call fcn.00403c4c
add esp, 0x1c
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3cc], esp
mov dword [ebp - 0x3a0], esi
mov ebx, dword [ebp - 0x3bc]
lea ecx, [ebx - 0x10]
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x15
push str.CPUUsage
call fcn.00403932
mov byte [ebp - 4], 0x14
jmp 0x40bd62
cmp eax, 4
jne 0x40bd79
mov ecx, dword [ecx + 0xd0]
lea edx, [ebp - 0x3d0]
xor eax, eax
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3bc], eax
lea eax, [ebp - 0x3bc]
push eax
call fcn.00402c31
pop ecx
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00401b54
mov byte [ebp - 4], 0x16
lea eax, [ebp - 0x3b8]
push dword [ebp - 0x3bc]
push dword [ebp - 0x3d0]
push str._d____p
push eax
call fcn.00403c4c
add esp, 0x10
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3cc], esp
mov dword [ebp - 0x3a0], esi
mov ebx, dword [ebp - 0x3b8]
lea ecx, [ebx - 0x10]
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x17
push str.VMUsage
call fcn.00403932
mov byte [ebp - 4], 0x16
call fcn.0040b71f
lea ecx, [ebx - 0x10]
mov byte [ebp - 4], 0x11
call fcn.00401582
mov ebx, dword [ebp - 0x3c0]
mov eax, dword [ebp - 0x3ac]
mov edi, 0x418130
push dword [eax + 0x60]
lea eax, [ebp - 0x3fc]
push edi
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a0], esp
mov dword [ebp - 0x3cc], esi
mov eax, dword [ebp - 0x3fc]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x3cc], eax
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x18
push str.OSIs64Bit
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a0], esp
mov dword [ebp - 0x3a4], esi
mov ecx, dword [eax + 0x64]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x19
push str.GeoLocation
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a0], esp
mov dword [ebp - 0x3a4], esi
mov ecx, dword [eax + 0x28]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1a
push str.SystemTimeUTC
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x3c]
mov eax, ecx
or eax, edx
je 0x40bfb3
push edx
push ecx
mov edi, str.0x_I64x
lea eax, [ebp - 0x3dc]
push edi
push eax
call fcn.00403c4c
add esp, 0x10
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a0], esp
mov dword [ebp - 0x3a4], esi
mov ecx, dword [ebp - 0x3dc]
add ecx, 0xfffffff0
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1b
push str.ExceptionAddress
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push ebx
push ecx
mov dword [ebp - 0x3a0], esp
mov ebx, esp
push ecx
mov esi, esp
mov dword [ebp - 0x3a4], esi
mov ecx, dword [eax + 0x40]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
mov ecx, ebx
mov dword [esi], eax
call fcn.00402dc2
mov ecx, esp
mov byte [ebp - 4], 0x1c
push str.ExceptionModule
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push dword [eax + 0x4c]
push dword [eax + 0x48]
lea eax, [ebp - 0x3dc]
push edi
push eax
call fcn.00403c4c
mov ebx, dword [ebp - 0x3c0]
add esp, 0x10
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a0], esp
mov dword [ebp - 0x3a4], esi
mov ecx, dword [ebp - 0x3dc]
add ecx, 0xfffffff0
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1d
push str.ExceptionModuleBase
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a0], esp
mov dword [ebp - 0x3a4], esi
mov ecx, dword [eax + 0x44]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1e
push str.ExceptionModuleVersion
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
mov edi, 0x418130
mov ecx, dword [ebp - 0x3a8]
lea eax, [ebp - 0x400]
push dword [ecx + 0xdc]
push edi
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a4], esp
mov dword [ebp - 0x3a0], esi
mov eax, dword [ebp - 0x400]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x3a0], eax
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x1f
push str.ExceptionType
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
mov esi, dword [ebp - 0x3a8]
mov eax, dword [esi + 0xdc]
test eax, eax
jne 0x40c090
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00401b54
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x3b8]
push dword [esi + 0xe0]
push str.0x_x
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a4], esp
mov dword [ebp - 0x3b4], esi
mov ebx, dword [ebp - 0x3b8]
lea ecx, [ebx - 0x10]
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x21
push str.ExceptionCode
call fcn.00403932
mov byte [ebp - 4], 0x20
jmp 0x40c238
cmp eax, 8
jne 0x40c0fd
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00401b54
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x3b8]
push dword [esi + 0xe4]
push edi
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a4], esp
mov dword [ebp - 0x3b4], esi
mov ebx, dword [ebp - 0x3b8]
lea ecx, [ebx - 0x10]
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x23
push str.FPESubcode
call fcn.00403932
mov byte [ebp - 4], 0x22
jmp 0x40c238
cmp eax, 6
jne 0x40c24f
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a4], esp
mov dword [ebp - 0x3b4], esi
mov ecx, dword [ebp - 0x3a8]
mov ecx, dword [ecx + 0xe8]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x24
push str.InvParamExpression
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a4], esp
mov dword [ebp - 0x3b4], esi
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [eax + 0xec]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x25
push str.InvParamFunction
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a4], esp
mov dword [ebp - 0x3b4], esi
mov eax, dword [ebp - 0x3a8]
mov ecx, dword [eax + 0xf0]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x26
push str.InvParamFile
call fcn.00403932
mov byte [ebp - 4], 0x11
call fcn.0040b71f
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00401b54
mov byte [ebp - 4], 0x27
mov eax, dword [ebp - 0x3a8]
push dword [eax + 0xf4]
lea eax, [ebp - 0x3b8]
push edi
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3a4], esp
mov dword [ebp - 0x3b4], esi
mov ebx, dword [ebp - 0x3b8]
lea ecx, [ebx - 0x10]
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x28
push str.InvParamLine
call fcn.00403932
mov byte [ebp - 4], 0x27
call fcn.0040b71f
lea ecx, [ebx - 0x10]
mov byte [ebp - 4], 0x11
call fcn.00401582
mov ebx, dword [ebp - 0x3c0]
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3b8]
call fcn.00401b54
mov eax, dword [ebp - 0x3ac]
mov byte [ebp - 4], 0x29
push dword [eax + 0x50]
lea eax, [ebp - 0x3b8]
push edi
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3b4], esp
mov dword [ebp - 0x3a4], esi
mov eax, dword [ebp - 0x3b8]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x3a4], eax
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x2a
push str.GUIResourceCount
call fcn.00403932
mov byte [ebp - 4], 0x29
call fcn.0040b71f
call fcn.004015a8
push eax
lea ecx, [ebp - 0x404]
call fcn.00401b54
mov eax, dword [ebp - 0x3ac]
mov byte [ebp - 4], 0x2b
push dword [eax + 0x54]
lea eax, [ebp - 0x404]
push edi
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3c8], esp
mov dword [ebp - 0x3b4], esi
mov eax, dword [ebp - 0x404]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x3b4], eax
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x2c
push str.OpenHandleCount
call fcn.00403932
mov byte [ebp - 4], 0x2b
call fcn.0040b71f
mov eax, dword [ebp - 0x3ac]
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3c8], esp
mov dword [ebp - 0x3b0], esi
mov ecx, dword [eax + 0x58]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov byte [ebp - 4], 0x2d
mov ecx, esp
push str.MemoryUsageKbytes
call fcn.00403932
mov byte [ebp - 4], 0x2b
call fcn.0040b71f
lea eax, [ebp - 0x54]
mov dword [ebp - 0x54], 0x40
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3a8]
call fcn.00401b54
mov byte [ebp - 4], 0x2e
lea eax, [ebp - 0x3a8]
push dword [ebp - 0x50]
push edi
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3c8], esp
mov dword [ebp - 0x3b0], esi
mov ecx, dword [ebp - 0x3a8]
add ecx, 0xfffffff0
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x2f
push str.MemoryLoad
call fcn.00403932
mov byte [ebp - 4], 0x2e
call fcn.0040b71f
mov ecx, dword [ebp - 0x4c]
mov edi, 0xfffff
mov eax, dword [ebp - 0x48]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x3a8]
push ecx
push 0x418130
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3c8], esp
mov dword [ebp - 0x3b0], esi
mov ecx, dword [ebp - 0x3a8]
add ecx, 0xfffffff0
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x30
push str.TotalPhysicalMemory
call fcn.00403932
mov byte [ebp - 4], 0x2e
call fcn.0040b71f
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x3a8]
push ecx
push 0x418130
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3c8], esp
mov dword [ebp - 0x3b0], esi
mov ecx, dword [ebp - 0x3a8]
add ecx, 0xfffffff0
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x31
push str.AvailablePhysicalMemory
call fcn.00403932
mov byte [ebp - 4], 0x2e
call fcn.0040b71f
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x3a8]
push ecx
push 0x418130
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3c8], esp
mov dword [ebp - 0x3b0], esi
mov ecx, dword [ebp - 0x3a8]
add ecx, 0xfffffff0
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x32
push str.TotalPageFile
call fcn.00403932
mov byte [ebp - 4], 0x2e
call fcn.0040b71f
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x3a8]
push ecx
push 0x418130
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3c8], esp
mov dword [ebp - 0x3b0], esi
mov ecx, dword [ebp - 0x3a8]
add ecx, 0xfffffff0
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x33
push str.AvailablePageFile
call fcn.00403932
mov byte [ebp - 4], 0x2e
call fcn.0040b71f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
push ecx
push 0x418130
lea eax, [ebp - 0x3a8]
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3c8], esp
mov dword [ebp - 0x3b0], esi
mov ecx, dword [ebp - 0x3a8]
add ecx, 0xfffffff0
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x34
push str.TotalVirtualMemory
call fcn.00403932
mov byte [ebp - 4], 0x2e
call fcn.0040b71f
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
add ecx, edi
adc eax, 0
shrd ecx, eax, 0x14
lea eax, [ebp - 0x3a8]
push ecx
push 0x418130
push eax
call fcn.00403c4c
add esp, 0xc
push ebx
push ecx
mov esi, esp
mov dword [ebp - 0x3b0], esp
mov dword [ebp - 0x3c8], esi
mov eax, dword [ebp - 0x3a8]
add eax, 0xfffffff0
mov ecx, eax
mov dword [ebp - 0x3c8], eax
call fcn.00401bcc
add eax, 0x10
mov dword [esi], eax
push ecx
mov ecx, esp
mov byte [ebp - 4], 0x35
push str.AvailableVirtualMemory
call fcn.00403932
mov byte [ebp - 4], 0x2e
call fcn.0040b71f
push str.CustomProps
lea ecx, [ebp - 0x5e4]
call fcn.004104d0
push eax
mov ecx, ebx
mov dword [ebp - 0x3b0], eax
call fcn.0040ec80
mov esi, dword [ebp - 0x3ac]
xor eax, eax
mov edi, dword [ebp - 0x3d8]
mov dword [ebp - 0x3bc], eax
cmp dword [esi + 0x8c], eax
jle 0x40c79a
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3d0]
call fcn.00401b54
mov byte [ebp - 4], 0x36
call fcn.004015a8
push eax
lea ecx, [ebp - 0x3e4]
call fcn.00401b54
lea eax, [ebp - 0x3e4]
mov byte [ebp - 4], 0x37
push eax
lea eax, [ebp - 0x3d0]
mov ecx, esi
push eax
push dword [ebp - 0x3bc]
call fcn.00404b61
push str.Prop
lea ecx, [ebp - 0x5e4]
call fcn.004104d0
push dword [ebp - 0x3d0]
mov edi, eax
lea ecx, [ebp - 0x3f8]
mov dword [ebp - 0x3c4], edi
call fcn.00403fac
lea ecx, [ebp - 0x3c4]
mov esi, eax
call fcn.00404623
push str.name
mov ecx, eax
call fcn.0040f850
push ecx
push esi
lea ecx, [eax + 0x10]
call fcn.0040e180
mov esi, dword [ebp - 0x3e4]
lea ecx, [ebp - 0x3f8]
push esi
call fcn.00403fac
lea ecx, [ebp - 0x3c4]
mov ebx, eax
call fcn.00404623
push str.value
mov ecx, eax
call fcn.0040f850
push ecx
push ebx
lea ecx, [eax + 0x10]
call fcn.0040e180
lea ecx, [ebp - 0x3b0]
call fcn.00404623
push edi
mov ecx, eax
call fcn.0040ec80
lea ecx, [esi - 0x10]
call fcn.00401582
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x3d0]
lea ecx, [ecx - 0x10]
call fcn.00401582
mov eax, dword [ebp - 0x3bc]
mov esi, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3bc], eax
cmp eax, dword [esi + 0x8c]
jl 0x40c67c
mov edi, dword [ebp - 0x3d8]
mov ebx, dword [ebp - 0x3c0]
push str.FileList
lea ecx, [ebp - 0x5e4]
call fcn.004104d0
push eax
mov ecx, ebx
mov dword [ebp - 0x3e4], eax
call fcn.0040ec80
xor ebx, ebx
mov eax, ebx
mov dword [ebp - 0x3c4], eax
cmp dword [esi + 0x7c], ebx
jle 0x40c939
xor edi, edi
push eax
mov ecx, esi
call fcn.00404a22
push str.FileItem
lea ecx, [ebp - 0x5e4]
mov dword [ebp - 0x3bc], eax
call fcn.004104d0
push ecx
mov ebx, esp
mov esi, eax
mov dword [ebp - 0x3d0], ebx
mov ecx, dword [ebp - 0x3bc]
mov dword [ebp - 0x3c0], esi
mov ecx, dword [ecx + 4]
sub ecx, 0x10
call fcn.00401bcc
add eax, 0x10
lea ecx, [ebp - 0x3b0]
mov dword [ebx], eax
call fcn.00402dc2
pop ecx
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x3f8]
push dword [eax]
call fcn.00403fac
lea ecx, [ebp - 0x3c0]
mov ebx, eax
call fcn.00404623
push str.name
mov ecx, eax
call fcn.0040f850
push ecx
push ebx
lea ecx, [eax + 0x10]
call fcn.0040e180
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x3b0]
lea ecx, [ecx - 0x10]
call fcn.00401582
mov eax, dword [ebp - 0x3bc]
lea ecx, [ebp - 0x3f8]
push dword [eax + 8]
call fcn.00403fac
lea ecx, [ebp - 0x3c0]
mov ebx, eax
call fcn.00404623
push str.description
mov ecx, eax
call fcn.0040f850
push ecx
push ebx
lea ecx, [eax + 0x10]
call fcn.0040e180
mov ebx, dword [ebp - 0x3bc]
cmp dword [ebx + 0x10], edi
je 0x40c8cb
lea ecx, [ebp - 0x3c0]
call fcn.00404623
push str.optional
mov ecx, eax
call fcn.0040f850
push ecx
push 0x4174e8
lea ecx, [eax + 0x10]
call fcn.0040e180
mov eax, dword [ebx + 0x14]
cmp dword [eax - 0xc], edi
je 0x40c902
push eax
lea ecx, [ebp - 0x3f8]
call fcn.00403fac
lea ecx, [ebp - 0x3c0]
mov ebx, eax
call fcn.00404623
push str.error
mov ecx, eax
call fcn.0040f850
push ecx
push ebx
lea ecx, [eax + 0x10]
call fcn.0040e180
lea ecx, [ebp - 0x3e4]
call fcn.00404623
push esi
mov ecx, eax
call fcn.0040ec80
mov eax, dword [ebp - 0x3c4]
mov esi, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3c4], eax
cmp eax, dword [esi + 0x7c]
jl 0x40c7cd
mov edi, dword [ebp - 0x3d8]
xor ebx, ebx
push 0x417550
push dword [ebp - 0x3ec]
lea eax, [ebp - 0x3d4]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
cmp dword [ebp - 0x3d4], 0
jne 0x40c975
push str.Error_opening_file_for_writing
lea ecx, [ebp - 0x3e0]
call fcn.00401a67
mov eax, dword [ebp - 0x3d4]
jmp 0x40c9d8
push ecx
push dword [ebp - 0x3d4]
lea ecx, [ebp - 0x5e4]
mov byte [ebp - 0x5b0], 1
call fcn.00410650
test eax, eax
jne 0x40c9c0
mov eax, dword [ebp - 0x5a0]
cmp eax, dword [ebp - 0x59c]
jne 0x40c9a7
mov eax, 0x416dd0
jmp 0x40c9b2
lea ecx, [ebp - 0x5a4]
call fcn.0040e370
push eax
lea ecx, [ebp - 0x3e0]
call fcn.0040383d
jmp 0x40c96d
push dword [ebp - 0x3d4]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, ebx
xor ebx, ebx
pop ecx
mov dword [ebp - 0x3d4], eax
inc ebx
test eax, eax
je 0x40c9e4
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
test ebx, ebx
jne 0x40ca04
lea eax, [ebp - 0x3e0]
mov ecx, esi
push eax
push dword [ebp - 0x420]
call fcn.00404a5b
lea ecx, [eax + 0x14]
call fcn.00403895
mov ecx, dword [ebp - 0x3c8]
call fcn.00401582
mov ecx, dword [ebp - 0x3b4]
call fcn.00401582
mov ecx, dword [ebp - 0x3a4]
call fcn.00401582
mov ecx, dword [ebp - 0x408]
call fcn.00401582
mov ecx, dword [ebp - 0x3a0]
call fcn.00401582
mov ecx, dword [ebp - 0x3cc]
call fcn.00401582
lea ecx, [edi - 0x10]
call fcn.00401582
mov ecx, dword [ebp - 0x3dc]
lea ecx, [ecx - 0x10]
call fcn.00401582
lea ecx, [ebp - 0x5e4]
call fcn.004102c0
lea ecx, [ebp - 0x3f8]
call fcn.004026cd
mov ecx, dword [ebp - 0x3e0]
add ecx, 0xfffffff0
call fcn.00401582
mov ecx, dword [ebp - 0x3ec]
add ecx, 0xfffffff0
call fcn.00401582
lea ecx, [ebp - 0x420]
call fcn.0040628d
mov eax, ebx
call fcn.004137ec
ret 4