Function at 0x414490
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4310d3
mov eax, dword fs:[0]
push eax
mov eax, 0x487c
call fcn.0041ce70
mov eax, dword [0x440440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x4868], edi
lea eax, [edi + 0x3170]
push eax
call fcn.00412c90
push 0x2000
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.0041e7e0
mov eax, dword [0x4441b4]
add esp, 0xc
mov dword [ebp - 0x4820], eax
test eax, eax
jne 0x414504
push 1
call fcn.00402140
add esp, 4
lea eax, [edi + 0x300c]
push 0
push eax
call fcn.004120b0
add esp, 8
mov ecx, edi
call fcn.00413650
test al, al
je 0x414639
xor eax, eax
mov dword [ebp - 0x4818], eax
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
nop dword [eax + eax]
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x481c], eax
lea eax, [ebp - 0x481c]
mov dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.00412ac0
push 9
push str..pl_lock
lea ecx, [ebp - 0x481c]
call fcn.00403c10
mov esi, dword [ebp - 0x481c]
push 0
push 0x106
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
cmp dword [edi + 0x3054], 0xffffffff
jne 0x4145f6
mov dword [edi + 0x3054], 0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4145c8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x4818]
cmp esi, 0x50
jge 0x41461c
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
mov dword [ebp - 0x4818], esi
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
jne 0x414540
jmp 0x41ab8b
mov dword [edi + 0x3054], eax
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x414611
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4818]
cmp eax, 0x50
jl 0x414639
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041cd0c
mov esp, ebp
pop ebp
ret
xorps xmm0, xmm0
mov dword [ebp - 0x483c], 0
movq qword [ebp - 0x4844], xmm0
mov dword [ebp - 0x4844], 0
mov dword [ebp - 0x4840], 0
mov dword [ebp - 0x483c], 0
movq qword [ebp - 0x4838], xmm0
mov dword [ebp - 0x4830], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x4838], 0
mov dword [ebp - 0x4834], 0
mov dword [ebp - 0x4830], 0
movq qword [ebp - 0x482c], xmm0
mov dword [ebp - 0x4824], 0
mov dword [ebp - 0x482c], 0
mov dword [ebp - 0x4828], 0
mov dword [ebp - 0x4824], 0
mov byte [ebp - 4], 3
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x485c], eax
push 0x5d6498
lea eax, [ebp - 0x485c]
mov byte [ebp - 4], 4
push 0x43be74
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x485c]
add esp, 0xc
cmp dword [esi - 4], 1
jle 0x414733
push dword [esi - 0xc]
lea ecx, [ebp - 0x485c]
call fcn.00401ab0
mov esi, dword [ebp - 0x485c]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.Version
push str.Administration
call fcn.004136b0
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x414776
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0x3174]
cmp dword [eax - 4], 1
jle 0x414790
push dword [eax - 0xc]
lea ecx, [edi + 0x3174]
call fcn.00401ab0
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push dword [edi + 0x3174]
push str.ConfigPasswordMD5
push str.Administration
call fcn.004136b0
cmp byte [edi + 0x3079], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov esi, str.true
push eax
lea eax, [ebp - 0x4844]
mov ecx, str.false
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.OocOn
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x314c], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ExcludeChildrenOfForeground
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30a8], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.DisableProBalanceWhenSysIdle
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30ab], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ProBalanceDropOneRandomCore
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30ac], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.DoNotAdjustAffinityIfCustomized
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x3110], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.OocDisableCoreParkingWhileIn
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30ad], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.UseEfficiencyMode
push str.OutOfControlProcessRestraint
call fcn.004136b0
push dword [edi + 0x30a4]
lea eax, [ebp - 0x2010]
push 0x434120
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.DisableProBalanceIfSysIdleThisManyMS
push str.OutOfControlProcessRestraint
call fcn.004136b0
push dword [edi + 0x3090]
lea eax, [ebp - 0x2010]
push 0x43be74
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.TotalProcessorUsageBeforeRestraint
push str.OutOfControlProcessRestraint
call fcn.004136b0
push dword [edi + 0x307c]
lea eax, [ebp - 0x2010]
push 0x434120
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
mov ecx, edi
push eax
lea eax, [ebp - 0x2010]
push eax
push str.PerProcessUsageBeforeRestraint
push str.OutOfControlProcessRestraint
call fcn.004136b0
push dword [edi + 0x3094]
lea eax, [ebp - 0x2010]
push 0x434120
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.TimeOverQuotaBeforeRestraint
push str.OutOfControlProcessRestraint
call fcn.004136b0
push dword [edi + 0x3080]
lea eax, [ebp - 0x2010]
push 0x434120
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.PerProcessUsageForRestore
push str.OutOfControlProcessRestraint
call fcn.004136b0
mov ecx, dword [edi + 0x317c]
lea eax, [edi + 0x317c]
cmp dword [ecx - 4], 1
jle 0x414ace
push dword [ecx - 0xc]
mov ecx, eax
call fcn.00401ab0
lea eax, [edi + 0x317c]
lea ecx, [ebp - 0x482c]
push ecx
lea ecx, [ebp - 0x4838]
push ecx
lea ecx, [ebp - 0x4844]
push ecx
push dword [eax]
mov ecx, edi
push str.PlayOnRestraint
push str.OutOfControlProcessRestraint
call fcn.004136b0
mov ecx, dword [edi + 0x3180]
lea eax, [edi + 0x3180]
cmp dword [ecx - 4], 1
jle 0x414b18
push dword [ecx - 0xc]
mov ecx, eax
call fcn.00401ab0
lea eax, [edi + 0x3180]
lea ecx, [ebp - 0x482c]
push ecx
lea ecx, [ebp - 0x4838]
push ecx
lea ecx, [ebp - 0x4844]
push ecx
push dword [eax]
mov ecx, edi
push str.PlayOnRestore
push str.OutOfControlProcessRestraint
call fcn.004136b0
push dword [edi + 0x3098]
lea eax, [ebp - 0x2010]
push 0x434120
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.MinimumTimeOfRestraint
push str.OutOfControlProcessRestraint
call fcn.004136b0
push dword [edi + 0x309c]
lea eax, [ebp - 0x2010]
push 0x434120
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.MaximumTimeOfRestraint
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30c2], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.TameOnlyNormal
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30c3], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LowerToIdleInsteadOfBelowNormal
push str.OutOfControlProcessRestraint
call fcn.004136b0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
push eax
cmp byte [edi + 0x30be], 0
lea eax, [ebp - 0x4844]
push eax
mov ecx, str.false
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ExcludeServices
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30e4], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.PlaySoundOnRestraint
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30e5], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.PlaySoundOnRestore
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30cb], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.RestrainByAffinity
push str.OutOfControlProcessRestraint
call fcn.004136b0
mov edx, dword [edi + 0x30d8]
xor eax, eax
mov ecx, dword [edi + 0x30dc]
mov word [ebp - 0x2010], ax
mov eax, edx
or eax, ecx
je 0x414d98
cmp edx, 0xfffffffe
jne 0x414d82
cmp ecx, 0xffffffff
jne 0x414d82
push 0x3ff
lea eax, [ebp - 0x4810]
push eax
push 0x339
push dword [ebp - 0x4820]
call fcn.00402440
lea edx, [ebp - 0x2010]
add esp, 0x10
sub edx, eax
nop word [eax + eax]
movzx ecx, word [eax]
lea eax, [eax + 2]
mov word [edx + eax - 2], cx
test cx, cx
jne 0x414d70
jmp 0x414d98
push 0xfff
lea eax, [ebp - 0x2010]
push eax
push ecx
push edx
call fcn.00409d10
add esp, 0x10
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.RestraintAffinity
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30c4], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ExcludeForegroundProcesses2
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30d2], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.DoNotLowerPriorityClass
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30a9], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LowerIOPriorityDuringRestraint
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30aa], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.MatchExclusionsByPathnameToo
push str.OutOfControlProcessRestraint
call fcn.004136b0
cmp byte [edi + 0x30f1], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ChangeTrayIconOnRestraint
push str.OutOfControlProcessRestraint
call fcn.004136b0
lea eax, [edi + 0x3424]
push eax
lea ecx, [ebp - 0x4818]
call fcn.004120d0
mov byte [ebp - 4], 5
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov edi, dword [edi + 0x321c]
mov byte [ebp - 4], 6
mov edi, dword [edi]
mov dword [ebp - 0x481c], edi
mov dword [ebp - 0x4860], edi
cmp byte [edi + 0xd], 0
jne 0x415058
nop dword [eax]
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x4820], esi
mov dword [ebp - 0x485c], eax
movzx eax, word [esi]
test ax, ax
je 0x414fb8
mov esi, dword [ebp - 0x485c]
mov ecx, eax
mov edi, dword [ebp - 0x4820]
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x414f7c
test esi, esi
mov eax, edi
cmovne eax, esi
mov esi, eax
jmp 0x414f7e
xor esi, esi
movzx eax, word [edi + 2]
add edi, 2
mov ecx, eax
test ax, ax
jne 0x414f64
mov edi, dword [ebp - 0x481c]
mov dword [ebp - 0x485c], esi
mov eax, dword [ebp - 0x485c]
mov esi, dword [ebp - 0x4814]
test eax, eax
je 0x414fb8
sub eax, esi
lea ecx, [ebp - 0x4814]
sar eax, 1
push eax
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x414fdf
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov ecx, dword [ebp - 0x4868]
lea eax, [ebp - 0x486c]
push 0x432544
push dword [edi + 0x10]
push eax
call fcn.00412930
mov eax, dword [eax]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 7
push dword [eax - 0xc]
push eax
call fcn.00403c10
mov edx, dword [ebp - 0x486c]
or eax, 0xffffffff
mov byte [ebp - 4], 6
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x415030
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x4860]
call fcn.00406120
mov edi, dword [ebp - 0x4860]
mov dword [ebp - 0x481c], edi
cmp byte [edi + 0xd], 0
jne 0x415058
mov esi, dword [ebp - 0x4814]
jmp 0x414f40
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x415083
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
mov edi, dword [ebp - 0x4868]
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, edi
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push 0x4344f8
push str.OutOfControlProcessRestraint
call fcn.004136b0
mov byte [ebp - 4], 5
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4150cc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x4818]
mov byte [ebp - 4], 3
call fcn.0041bda7
lea eax, [edi + 0x33dc]
push eax
call fcn.004139d0
add esp, 8
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov ecx, dword [edi + 0x33e0]
mov eax, dword [edi + 0x33dc]
mov byte [ebp - 4], 8
mov dword [ebp - 0x486c], ecx
mov dword [ebp - 0x4860], eax
cmp eax, ecx
je 0x4151e4
nop dword [eax]
movzx eax, word [esi]
xor edi, edi
mov dword [ebp - 0x4820], esi
test ax, ax
je 0x415184
mov ecx, eax
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x41515a
test edi, edi
mov eax, esi
cmovne eax, edi
mov edi, eax
jmp 0x41515c
xor edi, edi
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x415142
mov esi, dword [ebp - 0x4814]
test edi, edi
je 0x415184
sub edi, esi
lea ecx, [ebp - 0x4814]
sar edi, 1
push edi
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x4151ab
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov esi, dword [ebp - 0x4860]
lea ecx, [ebp - 0x4814]
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.00403c10
add esi, 4
mov dword [ebp - 0x4860], esi
cmp esi, dword [ebp - 0x486c]
je 0x4151de
mov esi, dword [ebp - 0x4814]
jmp 0x415130
mov edi, dword [ebp - 0x4868]
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x41520f
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.OocHardCodedExclusionOverrides
push str.OutOfControlProcessRestraint
call fcn.004136b0
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x415252
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
lea ecx, [ebp - 0x4855]
cmp byte [edi + 0x30ce], al
push 0
sete al
push eax
push str.ShowProcessIcons
push str.SoftwareProcessLasso
push 0x80000001
call fcn.00408bd0
cmp byte [edi + 0x30c8], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov esi, str.true
push eax
lea eax, [ebp - 0x4844]
mov ecx, str.false
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ClearLogAtExit
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x310c], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowCPUCoreUtilGraphs
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x3109], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowGraphLegend
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x3106], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowGraphCPU
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x3105], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
push eax
push str.ShowGraphResponsiveness
push 0x434598
mov ecx, edi
call fcn.004136b0
cmp byte [edi + 0x3108], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowGraphMemoryLoad
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x3107], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowGraphProBalanceEvents
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x310b], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowGraphSelectedProcessesCPUHistory
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x310d], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ProBalanceCountersOnGraph
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x310e], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowGraphLicenseName
push 0x434598
call fcn.004136b0
lea eax, [ebp - 0x482c]
cmp byte [edi + 0x3113], 0
mov ecx, str.false
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowPowerProfile
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x310a], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.GraphShowTooltips
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x3114], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowCPUUtilityAsPrimary
push 0x434598
call fcn.004136b0
cmp byte [edi + 0x30ea], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.AutomaticUpdate
push str.Advanced
call fcn.004136b0
push dword [edi + 0x304c]
lea eax, [ebp - 0x2010]
push 0x43be74
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.DefaultsLevel
push str.Performance
call fcn.004136b0
push dword [edi + 0x3100]
lea eax, [ebp - 0x2010]
push 0x434120
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.GracefulWaitTimeInMs
push str.Performance
call fcn.004136b0
push dword [edi + 0x3084]
lea eax, [ebp - 0x2010]
push 0x43be74
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.UpdateSpeedGUI
push str.Performance
call fcn.004136b0
push dword [edi + 0x3088]
lea eax, [ebp - 0x2010]
push 0x43be74
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.UpdateSpeedCore
push str.Performance
call fcn.004136b0
cmp byte [edi + 0x3115], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.SamplingEnabled
push str.Sampling
call fcn.004136b0
push dword [edi + 0x3118]
lea eax, [ebp - 0x2010]
push 0x434120
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.SamplingIntervalSeconds
push str.Sampling
mov ecx, edi
call fcn.004136b0
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push dword [edi + 0x311c]
push str.SamplingOutputPath
push str.Sampling
call fcn.004136b0
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push dword [edi + 0x3120]
push str.SamplingIncludePattern
push str.Sampling
call fcn.004136b0
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push dword [edi + 0x3124]
push str.SamplingExcludePattern
push str.Sampling
call fcn.004136b0
cmp byte [edi + 0x30cd], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ManageOnlyCurrentUser
push str.Performance
call fcn.004136b0
cmp byte [edi + 0x30ca], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ExitOnCloseWindow
push str.Performance
call fcn.004136b0
cmp byte [edi + 0x30c7], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.SoundsOff
push str.Performance
call fcn.004136b0
lea eax, [ebp - 0x482c]
cmp byte [edi + 0x33c0], 0
mov ecx, str.false
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.IsConfigWritable
push str.Performance
call fcn.004136b0
cmp byte [edi + 0x30c5], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ForcedMode
push str.Performance
call fcn.004136b0
cmp byte [edi + 0x30bd], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.IgnoreProblematicProcesses
push str.Performance
call fcn.004136b0
cmp byte [edi + 0x30ec], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.IgnoreSuspendedProcesses
push str.Performance
call fcn.004136b0
push dword [edi + 0x315c]
lea eax, [ebp - 0x2010]
push 0x434120
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.SetTimerResolutionAtStartup
push str.Performance
call fcn.004136b0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
push eax
cmp byte [edi + 0x30bb], 0
lea eax, [ebp - 0x4844]
push eax
mov ecx, str.false
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.BoostForegroundProcess
push str.ForegroundBoosting
call fcn.004136b0
push dword [edi + 0x3160]
lea eax, [ebp - 0x2010]
push str.0x_x
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.ForegroundBoostPriorityClass
push str.ForegroundBoosting
call fcn.004136b0
cmp byte [edi + 0x30c0], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.BoostOnlyNormal
push str.ForegroundBoosting
call fcn.004136b0
lea eax, [edi + 0x3250]
push eax
call fcn.004139d0
add esp, 4
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov ecx, dword [edi + 0x3254]
mov eax, dword [edi + 0x3250]
mov byte [ebp - 4], 9
mov dword [ebp - 0x486c], ecx
mov dword [ebp - 0x4860], eax
cmp eax, ecx
je 0x415b44
nop word [eax + eax]
movzx eax, word [esi]
xor edi, edi
mov dword [ebp - 0x4820], esi
test ax, ax
je 0x415ae4
mov ecx, eax
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x415aba
test edi, edi
mov eax, esi
cmovne eax, edi
mov edi, eax
jmp 0x415abc
xor edi, edi
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x415aa2
mov esi, dword [ebp - 0x4814]
test edi, edi
je 0x415ae4
sub edi, esi
lea ecx, [ebp - 0x4814]
sar edi, 1
push edi
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x415b0b
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov esi, dword [ebp - 0x4860]
lea ecx, [ebp - 0x4814]
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.00403c10
add esi, 4
mov dword [ebp - 0x4860], esi
cmp esi, dword [ebp - 0x486c]
je 0x415b3e
mov esi, dword [ebp - 0x4814]
jmp 0x415a90
mov edi, dword [ebp - 0x4868]
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x415b6f
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.ForegroundBoostExclusions
push str.ForegroundBoosting
call fcn.004136b0
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x415bb2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [edi + 0x30bc], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov esi, str.true
push eax
lea eax, [ebp - 0x4844]
mov ecx, str.false
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.UseStaticIcon
push str.SystemTrayIcon
call fcn.004136b0
cmp byte [edi + 0x30bf], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowResponsivnessInTrayInsteadOfProcessorUsage
push str.SystemTrayIcon
call fcn.004136b0
cmp byte [edi + 0x30e6], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogDisable
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30b4], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.IncludeCommandLines
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30ed], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogSmartTrim
push str.Logging
call fcn.004136b0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
cmp byte [edi + 0x30ee], 0
mov ecx, str.false
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogCPULimiter
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30e9], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogEfficiencyMode
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30ef], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogGroupExtender
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30f0], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogCPUSets
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30eb], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogProBalanceParkingChanges
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30b2], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
push eax
push str.LogProcessExecutions
push str.Logging
mov ecx, edi
call fcn.004136b0
cmp byte [edi + 0x30b8], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogProcessTerminations
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30b3], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogProcessesDisallowed
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30b5], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogDefaultPriorityAdjustments
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30b9], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogDefaultAffinityAdjustments
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30b7], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogProBalanceBegin
push str.Logging
call fcn.004136b0
lea eax, [ebp - 0x482c]
push eax
cmp byte [edi + 0x30b1], 0
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
mov ecx, str.false
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogProBalanceEnd
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30ba], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogInstanceLimitTerminations
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x30e8], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.LogPowerProfileChanges
push str.Logging
call fcn.004136b0
cmp byte [edi + 0x314d], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.SmartTrimIsEnabled
push str.MemoryManagement
call fcn.004136b0
cmp byte [edi + 0x314e], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.SmartTrimWorkingSetTrims
push str.MemoryManagement
call fcn.004136b0
cmp byte [edi + 0x314f], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
mov ecx, str.false
cmove eax, ecx
mov ecx, edi
push eax
push str.SmartTrimClearStandbyList
push str.MemoryManagement
call fcn.004136b0
cmp byte [edi + 0x3150], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.SmartTrimClearFileCache
push str.MemoryManagement
call fcn.004136b0
push dword [edi + 0x3154]
lea eax, [ebp - 0x2010]
push 0x434120
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.ClearStandbyFreeRAMThresholdMB
push str.MemoryManagement
call fcn.004136b0
cmp byte [edi + 0x3151], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ClearStandbyOnlyInPerfMode
push str.MemoryManagement
call fcn.004136b0
lea eax, [edi + 0x31bc]
push 0
push eax
call fcn.004120b0
lea eax, [edi + 0x32ec]
push eax
call fcn.004139d0
add esp, 0xc
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov ecx, dword [edi + 0x32f0]
mov eax, dword [edi + 0x32ec]
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x486c], ecx
mov dword [ebp - 0x4860], eax
cmp eax, ecx
je 0x416254
nop
movzx eax, word [esi]
xor edi, edi
mov dword [ebp - 0x4820], esi
test ax, ax
je 0x4161f4
mov ecx, eax
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x4161ca
test edi, edi
mov eax, esi
cmovne eax, edi
mov edi, eax
jmp 0x4161cc
xor edi, edi
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x4161b2
mov esi, dword [ebp - 0x4814]
test edi, edi
je 0x4161f4
sub edi, esi
lea ecx, [ebp - 0x4814]
sar edi, 1
push edi
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x41621b
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov esi, dword [ebp - 0x4860]
lea ecx, [ebp - 0x4814]
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.00403c10
add esi, 4
mov dword [ebp - 0x4860], esi
cmp esi, dword [ebp - 0x486c]
je 0x41624e
mov esi, dword [ebp - 0x4814]
jmp 0x4161a0
mov edi, dword [ebp - 0x4868]
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x41627f
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.SmartTrimExclusions
push str.MemoryManagement
call fcn.004136b0
lea eax, [edi + 0x31bc]
push 0
push eax
call fcn.004120c0
add esp, 8
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4162d3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [edi + 0x30f8]
lea eax, [ebp - 0x2010]
push 0x43be74
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.SmartTrimAutoMinimumRAMLoad
push str.MemoryManagement
call fcn.004136b0
push dword [edi + 0x30fc]
lea eax, [ebp - 0x2010]
push 0x43be74
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.MinimumProcessWSSInMb
push str.MemoryManagement
call fcn.004136b0
push dword [edi + 0x3158]
lea eax, [ebp - 0x2010]
push 0x43be74
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
push eax
push str.SmartTrimIntervalMins
push str.MemoryManagement
call fcn.004136b0
cmp byte [edi + 0x30af], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov esi, str.true
push eax
lea eax, [ebp - 0x4844]
mov ecx, str.false
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.EnableSystemTrayNotification
push str.SysTrayBalloons
call fcn.004136b0
push dword [edi + 0x308c]
lea eax, [ebp - 0x2010]
push 0x43be74
push eax
call fcn.00412520
add esp, 0xc
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
lea eax, [ebp - 0x2010]
mov ecx, edi
push eax
push str.BalloonTipDuration
push str.SysTrayBalloons
call fcn.004136b0
cmp byte [edi + 0x30b0], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ShowBalloonsForOocPriorityRestoration
push str.SysTrayBalloons
call fcn.004136b0
cmp byte [edi + 0x30e7], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.ApplyInstanceCountLimitsToAllUsers
push str.ProcessAllowances
call fcn.004136b0
lea eax, [edi + 0x33f4]
push eax
lea ecx, [ebp - 0x486c]
call fcn.004120d0
lea eax, [edi + 0x3238]
mov byte [ebp - 4], 0xb
push eax
call fcn.004139d0
add esp, 4
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab95
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov eax, dword [edi + 0x3238]
mov ecx, dword [edi + 0x323c]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x4818], eax
mov dword [ebp - 0x4820], ecx
cmp eax, ecx
je 0x416641
or edi, 0xffffffff
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x481c], esi
mov dword [ebp - 0x485c], eax
movzx eax, word [esi]
test ax, ax
je 0x41658d
mov esi, dword [ebp - 0x485c]
mov ecx, eax
nop
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x41654c
mov eax, dword [ebp - 0x481c]
test esi, esi
cmovne eax, esi
mov esi, eax
jmp 0x41654e
xor esi, esi
mov eax, dword [ebp - 0x481c]
add eax, 2
mov dword [ebp - 0x481c], eax
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x416530
mov dword [ebp - 0x485c], esi
mov eax, dword [ebp - 0x485c]
mov esi, dword [ebp - 0x4814]
test eax, eax
je 0x41658d
sub eax, esi
lea ecx, [ebp - 0x4814]
sar eax, 1
push eax
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x4165b4
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [ebp - 0x4818]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.004025a0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x4860], eax
push 0x43253c
push 0x432544
lea ecx, [ebp - 0x4860]
mov byte [ebp - 4], 0xd
call fcn.00408300
mov esi, dword [ebp - 0x4860]
lea ecx, [ebp - 0x4814]
push dword [esi - 0xc]
push esi
call fcn.00403c10
mov byte [ebp - 4], 0xc
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41661a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x4818]
mov esi, dword [ebp - 0x4814]
add ecx, 4
mov dword [ebp - 0x4818], ecx
cmp ecx, dword [ebp - 0x4820]
jne 0x416510
mov edi, dword [ebp - 0x4868]
cmp dword [esi - 4], 1
jle 0x41665b
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.AllowedProcesses
push str.ProcessAllowances
call fcn.004136b0
mov byte [ebp - 4], 0xb
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41669e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x486c]
mov byte [ebp - 4], 3
call fcn.0041bda7
add esp, 4
lea eax, [edi + 0x33f4]
lea ecx, [ebp - 0x486c]
push eax
call fcn.004120d0
lea eax, [edi + 0x3244]
mov byte [ebp - 4], 0xe
push eax
call fcn.004139d0
add esp, 4
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab9f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov eax, dword [edi + 0x3244]
mov ecx, dword [edi + 0x3248]
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x4818], eax
mov dword [ebp - 0x4820], ecx
cmp eax, ecx
je 0x416852
or edi, 0xffffffff
nop dword [eax + eax]
xor eax, eax
mov dword [ebp - 0x481c], esi
mov dword [ebp - 0x485c], eax
movzx eax, word [esi]
test ax, ax
je 0x41679d
mov esi, dword [ebp - 0x485c]
mov ecx, eax
nop
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x41675c
mov eax, dword [ebp - 0x481c]
test esi, esi
cmovne eax, esi
mov esi, eax
jmp 0x41675e
xor esi, esi
mov eax, dword [ebp - 0x481c]
add eax, 2
mov dword [ebp - 0x481c], eax
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x416740
mov dword [ebp - 0x485c], esi
mov eax, dword [ebp - 0x485c]
mov esi, dword [ebp - 0x4814]
test eax, eax
je 0x41679d
sub eax, esi
lea ecx, [ebp - 0x4814]
sar eax, 1
push eax
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x4167c4
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [ebp - 0x4818]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.004025a0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x4860], eax
push 0x43253c
push 0x432544
lea ecx, [ebp - 0x4860]
mov byte [ebp - 4], 0x10
call fcn.00408300
mov esi, dword [ebp - 0x4860]
lea ecx, [ebp - 0x4814]
push dword [esi - 0xc]
push esi
call fcn.00403c10
mov byte [ebp - 4], 0xf
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41682a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x4818]
add ecx, 4
mov dword [ebp - 0x4818], ecx
cmp ecx, dword [ebp - 0x4820]
je 0x41684c
mov esi, dword [ebp - 0x4814]
jmp 0x416720
mov edi, dword [ebp - 0x4868]
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x41687d
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.DisallowedProcesses
push str.ProcessAllowances
call fcn.004136b0
mov byte [ebp - 4], 0xe
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4168c0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x486c]
mov byte [ebp - 4], 3
call fcn.0041bda7
add esp, 4
lea eax, [edi + 0x3280]
lea ecx, [ebp - 0x4818]
push eax
call fcn.004120d0
mov byte [ebp - 4], 0x11
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41aba9
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov ecx, dword [edi + 0x326c]
mov eax, dword [edi + 0x3268]
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x486c], ecx
mov dword [ebp - 0x4860], eax
cmp eax, ecx
je 0x416a79
mov dword [ebp - 0x481c], 0
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x4820], esi
mov dword [ebp - 0x485c], eax
movzx eax, word [esi]
test ax, ax
je 0x4169b4
mov edi, dword [ebp - 0x485c]
mov ecx, eax
nop
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x416978
test edi, edi
mov eax, esi
cmovne eax, edi
mov edi, eax
jmp 0x41697a
xor edi, edi
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x416960
mov esi, dword [ebp - 0x4814]
mov dword [ebp - 0x485c], edi
mov eax, dword [ebp - 0x485c]
mov edi, dword [ebp - 0x4868]
test eax, eax
je 0x4169b4
sub eax, esi
lea ecx, [ebp - 0x4814]
sar eax, 1
push eax
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x4169db
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov esi, dword [ebp - 0x4860]
lea ecx, [ebp - 0x4814]
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.00403c10
push 0x4351e8
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [edi + 0x3274]
lea ecx, [ebp - 0x2010]
add eax, dword [ebp - 0x481c]
push 0xa
push ecx
push dword [eax]
call fcn.004240c7
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x416a2b
xor ecx, ecx
jmp 0x416a49
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x4820], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416a36
sub ecx, dword [ebp - 0x4820]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4814]
call fcn.00403c10
add dword [ebp - 0x481c], 4
add esi, 4
mov dword [ebp - 0x4860], esi
cmp esi, dword [ebp - 0x486c]
je 0x416a79
mov esi, dword [ebp - 0x4814]
jmp 0x416940
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x416aa4
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push 0x4351ec
push str.ProcessAllowances
call fcn.004136b0
mov byte [ebp - 4], 0x11
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x416ae7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x4818]
mov byte [ebp - 4], 3
call fcn.0041bda7
add esp, 4
lea eax, [edi + 0x33f4]
lea ecx, [ebp - 0x486c]
push eax
call fcn.004120d0
mov byte [ebp - 4], 0x13
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41abb3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov byte [ebp - 4], 0x14
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41abbd
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4874], eax
mov eax, dword [edi + 0x33e8]
mov byte [ebp - 4], 0x15
mov edi, dword [eax]
mov dword [ebp - 0x481c], edi
cmp edi, eax
je 0x416d78
lea eax, [edi + 0x10]
push eax
lea ecx, [ebp - 0x4874]
call fcn.004024f0
movups xmm0, xmmword [edi + 0x14]
mov eax, dword [edi + 0x24]
lea ecx, [ebp - 0x481c]
mov dword [ebp - 0x485c], eax
movups xmmword [ebp - 0x4888], xmm0
mov dword [ebp - 0x4878], eax
call fcn.00406120
nop
movzx eax, word [esi]
xor edi, edi
mov dword [ebp - 0x4820], esi
test ax, ax
je 0x416bf4
mov ecx, eax
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x416bca
test edi, edi
mov eax, esi
cmovne eax, edi
mov edi, eax
jmp 0x416bcc
xor edi, edi
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x416bb2
mov esi, dword [ebp - 0x4814]
test edi, edi
je 0x416bf4
sub edi, esi
lea ecx, [ebp - 0x4814]
sar edi, 1
push edi
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x416c1b
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [ebp - 0x4874]
add eax, 0xfffffff0
push eax
call fcn.004025a0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x4860], eax
push 0x43253c
push 0x432544
lea ecx, [ebp - 0x4860]
mov byte [ebp - 4], 0x16
call fcn.00408300
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4818], eax
cmp byte [ebp - 0x4877], 0
mov ecx, 0x59
movss xmm0, dword [ebp - 0x4880]
mov eax, 0x4e
mov edi, dword [ebp - 0x4860]
cmovne eax, ecx
cmp byte [ebp - 0x485c], 0
push eax
mov eax, 0x4e
mov byte [ebp - 4], 0x17
cmovne eax, ecx
push eax
push dword [ebp - 0x487c]
cvtps2pd xmm0, xmm0
sub esp, 8
lea eax, [ebp - 0x4818]
movsd qword [esp], xmm0
push dword [ebp - 0x4884]
push dword [ebp - 0x4888]
push edi
push str._s__d__d__1.2f__d__c__c
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x4818]
lea ecx, [ebp - 0x4814]
add esp, 0x28
push dword [esi - 0xc]
push esi
call fcn.00403c10
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0x16
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x416d0a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x15
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x416d25
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x4868]
mov esi, dword [ebp - 0x481c]
cmp esi, dword [edi + 0x33e8]
je 0x416d7e
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x4874]
call fcn.004024f0
movups xmm0, xmmword [esi + 0x14]
mov eax, dword [esi + 0x24]
lea ecx, [ebp - 0x481c]
mov dword [ebp - 0x485c], eax
movups xmmword [ebp - 0x4888], xmm0
mov dword [ebp - 0x4878], eax
call fcn.00406120
mov esi, dword [ebp - 0x4814]
jmp 0x416ba0
mov edi, dword [ebp - 0x4868]
lea ecx, [ebp - 0x4874]
call fcn.004019b0
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x416db4
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.InstanceManagedCPUAffinities
push str.ProcessAllowances
call fcn.004136b0
mov edx, dword [ebp - 0x4874]
or eax, 0xffffffff
mov byte [ebp - 4], 0x14
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x416dfd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x13
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x416e19
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x486c]
mov byte [ebp - 4], 3
call fcn.0041bda7
lea eax, [edi + 0x318c]
push 0
push eax
call fcn.004120b0
add esp, 0xc
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov ecx, dword [edi + 0x32b4]
mov eax, dword [edi + 0x32b0]
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x486c], ecx
mov dword [ebp - 0x4860], eax
cmp eax, ecx
je 0x416fc9
mov dword [ebp - 0x481c], 0
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x4820], esi
mov dword [ebp - 0x485c], eax
movzx eax, word [esi]
test ax, ax
je 0x416f04
mov edi, dword [ebp - 0x485c]
mov ecx, eax
nop
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x416ec8
test edi, edi
mov eax, esi
cmovne eax, edi
mov edi, eax
jmp 0x416eca
xor edi, edi
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x416eb0
mov esi, dword [ebp - 0x4814]
mov dword [ebp - 0x485c], edi
mov eax, dword [ebp - 0x485c]
mov edi, dword [ebp - 0x4868]
test eax, eax
je 0x416f04
sub eax, esi
lea ecx, [ebp - 0x4814]
sar eax, 1
push eax
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x416f2b
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov esi, dword [ebp - 0x4860]
lea ecx, [ebp - 0x4814]
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.00403c10
push 0x4351e8
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [edi + 0x32bc]
lea ecx, [ebp - 0x2010]
add eax, dword [ebp - 0x481c]
push 0xa
push ecx
push dword [eax]
call fcn.004240c7
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x416f7b
xor ecx, ecx
jmp 0x416f99
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x4820], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416f86
sub ecx, dword [ebp - 0x4820]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4814]
call fcn.00403c10
add dword [ebp - 0x481c], 4
add esi, 4
mov dword [ebp - 0x4860], esi
cmp esi, dword [ebp - 0x486c]
je 0x416fc9
mov esi, dword [ebp - 0x4814]
jmp 0x416e90
lea eax, [edi + 0x318c]
push 0
push eax
call fcn.004120c0
add esp, 8
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x417005
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.ProcessThrottles
push str.ProcessAllowances
call fcn.004136b0
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x417048
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
lea eax, [edi + 0x31a4]
mov byte [ebp - 4], 0x19
push 0
push eax
call fcn.004120b0
mov ecx, dword [edi + 0x32cc]
add esp, 8
mov eax, dword [edi + 0x32c8]
mov dword [ebp - 0x486c], ecx
mov dword [ebp - 0x4860], eax
cmp eax, ecx
je 0x417253
mov dword [ebp - 0x4818], 0
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x4820], esi
mov dword [ebp - 0x485c], eax
movzx eax, word [esi]
test ax, ax
je 0x417124
mov edi, dword [ebp - 0x485c]
mov ecx, eax
nop
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x4170e8
test edi, edi
mov eax, esi
cmovne eax, edi
mov edi, eax
jmp 0x4170ea
xor edi, edi
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x4170d0
mov esi, dword [ebp - 0x4814]
mov dword [ebp - 0x485c], edi
mov eax, dword [ebp - 0x485c]
mov edi, dword [ebp - 0x4868]
test eax, eax
je 0x417124
sub eax, esi
lea ecx, [ebp - 0x4814]
sar eax, 1
push eax
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x41714b
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov esi, dword [ebp - 0x4860]
lea ecx, [ebp - 0x4814]
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.00403c10
push 0x4351e8
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [edi + 0x32d4]
lea ecx, [ebp - 0x2010]
add eax, dword [ebp - 0x4818]
push 0xa
push ecx
push dword [eax]
call fcn.004240c7
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x41719b
xor ecx, ecx
jmp 0x4171b9
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x4820], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4171a6
sub ecx, dword [ebp - 0x4820]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4814]
call fcn.00403c10
push 0x4351e8
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [edi + 0x32e0]
lea ecx, [ebp - 0x2010]
add eax, dword [ebp - 0x4818]
push 0xa
push ecx
push dword [eax]
call fcn.004240c7
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x4171ff
xor ecx, ecx
jmp 0x417223
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x4820], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417210
sub ecx, dword [ebp - 0x4820]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4814]
call fcn.00403c10
add dword [ebp - 0x4818], 4
add esi, 4
mov dword [ebp - 0x4860], esi
cmp esi, dword [ebp - 0x486c]
je 0x417253
mov esi, dword [ebp - 0x4814]
jmp 0x4170b0
lea eax, [edi + 0x31a4]
push 0
push eax
call fcn.004120c0
add esp, 8
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x41728f
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.OneTimeProcessThrottles
push str.ProcessAllowances
call fcn.004136b0
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4172d2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
lea eax, [edi + 0x33f4]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [ebp - 0x486c]
call fcn.004120d0
mov eax, dword [edi + 0x33ac]
mov ecx, dword [edi + 0x33b0]
mov byte [ebp - 4], 0x1b
mov dword [ebp - 0x481c], eax
mov dword [ebp - 0x4820], ecx
cmp eax, ecx
je 0x417443
mov edi, eax
nop dword [eax]
cmp dword [esi - 0xc], 0
je 0x417346
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4818], eax
mov eax, dword [edi]
sub eax, 0x10
mov byte [ebp - 4], 0x1c
push eax
call fcn.004025a0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x4860], eax
push 0x43253c
push 0x432544
lea ecx, [ebp - 0x4860]
mov byte [ebp - 4], 0x1d
call fcn.00408300
push dword [edi + 0x10]
movss xmm0, dword [edi + 4]
lea eax, [ebp - 0x4818]
push dword [edi + 0xc]
mov esi, dword [ebp - 0x4860]
push dword [edi + 8]
cvtps2pd xmm0, xmm0
sub esp, 8
movsd qword [esp], xmm0
push esi
push str._s__1.2f__u__u__u
push eax
call fcn.00402f80
mov edi, dword [ebp - 0x4818]
lea ecx, [ebp - 0x4814]
add esp, 0x20
push dword [edi - 0xc]
push edi
call fcn.00403c10
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0x1c
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x417400
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x1b
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x41741b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x481c]
add edi, 0x14
mov dword [ebp - 0x481c], edi
cmp edi, dword [ebp - 0x4820]
je 0x41743d
mov esi, dword [ebp - 0x4814]
jmp 0x417330
mov edi, dword [ebp - 0x4868]
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x41746e
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.CPULimitRules
push str.ProcessAllowances
call fcn.004136b0
push dword [ebp - 0x486c]
call fcn.0041bda7
add esp, 4
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4174bf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [edi + 0x33f4]
push eax
lea ecx, [ebp - 0x481c]
call fcn.004120d0
mov byte [ebp - 4], 0x1e
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41abc7
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov eax, dword [edi + 0x3230]
mov byte [ebp - 4], 0x1f
mov eax, dword [eax]
mov dword [ebp - 0x4860], eax
cmp byte [eax + 0xd], 0
jne 0x417673
add eax, 0x10
push 0x1000
mov dword [ebp - 0x4820], eax
lea eax, [ebp - 0x3010]
push 0
push eax
call fcn.0041e7e0
add esp, 0xc
cmp dword [esi - 0xc], 0
je 0x417547
push 1
push 0x432544
lea ecx, [ebp - 0x4814]
call fcn.00403c10
mov esi, dword [ebp - 0x4820]
mov eax, esi
cmp dword [esi + 0x14], 7
jbe 0x417557
mov eax, dword [esi]
push 0x432544
push eax
lea eax, [ebp - 0x486c]
mov ecx, edi
push eax
call fcn.00412930
mov eax, dword [eax]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 0x20
push dword [eax - 0xc]
push eax
call fcn.00403c10
mov edx, dword [ebp - 0x486c]
or eax, 0xffffffff
mov byte [ebp - 4], 0x1f
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4175a2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push 0x432544
lea ecx, [ebp - 0x4814]
call fcn.00403c10
mov eax, dword [esi + 0x18]
cmp eax, 0xffffffff
je 0x41760b
push eax
lea eax, [ebp - 0x3010]
push 0x432558
push eax
call fcn.0041b210
lea ecx, [ebp - 0x3010]
add esp, 0xc
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4175e0
sub ecx, edx
lea eax, [ebp - 0x3010]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x4814]
call fcn.00403c10
xor eax, eax
mov word [ebp - 0x3010], ax
push 0x800
lea eax, [ebp - 0x3010]
push eax
push dword [esi + 0x24]
push dword [esi + 0x20]
call fcn.00409d10
lea ecx, [ebp - 0x3010]
add esp, 0x10
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417630
sub ecx, edx
lea eax, [ebp - 0x3010]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x4814]
call fcn.00403c10
lea ecx, [ebp - 0x4860]
call fcn.00406120
mov eax, dword [ebp - 0x4860]
mov esi, dword [ebp - 0x4814]
cmp byte [eax + 0xd], 0
je 0x417510
cmp dword [esi - 4], 1
jle 0x41768d
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.NamedAffinities
push str.ProcessDefaults
call fcn.004136b0
mov byte [ebp - 4], 0x1e
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4176d0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x481c]
mov byte [ebp - 4], 3
call fcn.0041bda7
add esp, 4
lea eax, [edi + 0x33f4]
lea ecx, [ebp - 0x4864]
push eax
call fcn.004120d0
mov byte [ebp - 4], 0x21
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41abd1
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov eax, dword [edi + 0x3394]
mov ecx, dword [edi + 0x3398]
mov byte [ebp - 4], 0x22
mov dword [ebp - 0x481c], eax
mov dword [ebp - 0x4860], ecx
cmp eax, ecx
je 0x4178af
nop dword [eax + eax]
cmp dword [eax + 4], 0xffffffff
je 0x41789e
cmp byte [eax + 8], 0
jne 0x41789e
xor eax, eax
mov dword [ebp - 0x4820], esi
mov dword [ebp - 0x4818], eax
movzx eax, word [esi]
test ax, ax
je 0x4177c6
mov edi, dword [ebp - 0x4818]
mov ecx, eax
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x41778a
test edi, edi
mov eax, esi
cmovne eax, edi
mov edi, eax
jmp 0x41778c
xor edi, edi
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x417772
mov esi, dword [ebp - 0x4814]
test edi, edi
mov dword [ebp - 0x4818], edi
mov edi, dword [ebp - 0x4868]
je 0x4177c6
mov eax, dword [ebp - 0x4818]
lea ecx, [ebp - 0x4814]
sub eax, esi
sar eax, 1
push eax
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x4177ed
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov esi, dword [ebp - 0x481c]
lea eax, [ebp - 0x486c]
push 0x432544
mov ecx, edi
push dword [esi]
push eax
call fcn.00412930
mov eax, dword [eax]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 0x23
push dword [eax - 0xc]
push eax
call fcn.00403c10
mov edx, dword [ebp - 0x486c]
or eax, 0xffffffff
mov byte [ebp - 4], 0x22
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41783f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
push dword [esi + 4]
call fcn.0041bb40
mov edx, eax
add esp, 4
test edx, edx
jne 0x417864
xor ecx, ecx
jmp 0x41787f
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x417870
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4814]
call fcn.00403c10
mov esi, dword [ebp - 0x4814]
mov eax, dword [ebp - 0x481c]
mov ecx, dword [ebp - 0x4860]
add eax, 0xc
mov dword [ebp - 0x481c], eax
cmp eax, ecx
jne 0x417740
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov edi, dword [ebp - 0x4814]
cmp dword [edi - 4], 1
jle 0x4178da
push dword [edi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov edi, dword [ebp - 0x4814]
mov esi, dword [ebp - 0x4868]
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, esi
push eax
lea eax, [ebp - 0x4844]
push eax
push edi
push str.DefaultPriorities
push str.ProcessDefaults
call fcn.004136b0
mov eax, dword [esi + 0x3394]
mov ecx, dword [esi + 0x3398]
mov dword [ebp - 0x4818], eax
mov dword [ebp - 0x481c], ecx
cmp eax, ecx
je 0x4179fe
nop word [eax + eax]
cmp byte [eax + 8], 0
je 0x4179e7
cmp dword [eax + 4], 0xffffffff
jne 0x4179e7
mov esi, dword [eax]
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4860], eax
push esi
lea eax, [ebp - 0x4860]
mov byte [ebp - 4], 0x24
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_sPerfOptions
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x4860]
lea eax, [ebp - 0x485c]
add esp, 0xc
push eax
push 0x20006
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4179b3
push str.CpuPriorityClass
push dword [ebp - 0x485c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x485c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x22
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4179db
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x481c]
mov eax, dword [ebp - 0x4818]
add eax, 0xc
mov dword [ebp - 0x4818], eax
cmp eax, ecx
jne 0x417930
mov esi, dword [ebp - 0x4868]
mov eax, dword [esi + 0x3398]
mov dword [ebp - 0x4818], eax
mov eax, dword [esi + 0x3394]
mov dword [ebp - 0x4820], eax
cmp eax, dword [ebp - 0x4818]
je 0x417ac5
mov edi, eax
mov eax, dword [ebp - 0x4818]
nop word [eax + eax]
cmp byte [edi + 8], 0
je 0x417ab4
cmp dword [edi + 4], 0xffffffff
je 0x417ab4
lea ecx, [ebp - 0x4854]
mov dword [ebp - 0x4854], 0
push ecx
push dword [edi]
lea ecx, [esi + 0x3009]
mov dword [ebp - 0x4850], 0xffffffff
mov dword [ebp - 0x484c], 0xffffffff
mov dword [ebp - 0x4848], 0xffffffff
call fcn.00413130
test al, al
je 0x417a87
mov eax, dword [ebp - 0x4850]
cmp eax, dword [edi + 4]
je 0x417aae
mov eax, dword [edi + 4]
lea ecx, [esi + 0x3009]
mov dword [ebp - 0x4850], eax
lea eax, [ebp - 0x4854]
push eax
push dword [edi]
mov dword [ebp - 0x4854], 1
call fcn.0041ac70
mov eax, dword [ebp - 0x4818]
add edi, 0xc
cmp edi, eax
jne 0x417a30
mov edi, dword [ebp - 0x4814]
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0x21
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x417ae3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x4864]
mov byte [ebp - 4], 3
call fcn.0041bda7
add esi, 0x33f4
push esi
mov dword [ebp - 0x486c], esi
call fcn.0041bd96
add esp, 8
test eax, eax
jne 0x41ab84
mov eax, dword [esi + 0x2c]
add esi, 0x2c
cmp eax, 0x7fffffff
je 0x41ac4c
mov byte [ebp - 4], 0x25
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41abdb
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov eax, dword [ebp - 0x4868]
mov byte [ebp - 4], 0x26
mov ecx, dword [eax + 0x3370]
mov eax, dword [eax + 0x3374]
mov dword [ebp - 0x485c], ecx
mov dword [ebp - 0x4820], eax
cmp ecx, eax
je 0x417d26
nop dword [eax]
mov eax, dword [ecx]
xorps xmm0, xmm0
sub eax, 0x10
movq qword [ebp - 0x4850], xmm0
push eax
mov dword [ebp - 0x4848], 0
call fcn.004025a0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x4850], eax
mov eax, dword [ebp - 0x485c]
mov ecx, dword [eax + 4]
mov al, byte [eax + 8]
mov dword [ebp - 0x4864], ecx
mov dword [ebp - 0x484c], ecx
mov byte [ebp - 0x4848], al
mov byte [ebp - 4], 0x27
cmp ecx, 0xffffffff
je 0x417cea
test al, al
jne 0x417cea
xor eax, eax
mov dword [ebp - 0x481c], esi
mov dword [ebp - 0x4818], eax
movzx eax, word [esi]
test ax, ax
je 0x417c4d
mov esi, dword [ebp - 0x4818]
mov ecx, eax
nop dword [eax]
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x417c0c
mov eax, dword [ebp - 0x481c]
test esi, esi
cmovne eax, esi
mov esi, eax
jmp 0x417c0e
xor esi, esi
mov eax, dword [ebp - 0x481c]
add eax, 2
mov dword [ebp - 0x481c], eax
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x417bf0
mov dword [ebp - 0x4818], esi
test esi, esi
mov esi, dword [ebp - 0x4814]
je 0x417c4d
mov eax, dword [ebp - 0x4818]
lea ecx, [ebp - 0x4814]
sub eax, esi
sar eax, 1
push eax
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x417c74
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [ebp - 0x4850]
add eax, 0xfffffff0
push eax
call fcn.004025a0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x4860], eax
push 0x43253c
push 0x432544
lea ecx, [ebp - 0x4860]
mov byte [ebp - 4], 0x28
call fcn.00408300
push dword [ebp - 0x4864]
mov esi, dword [ebp - 0x4860]
lea eax, [ebp - 0x4814]
push esi
push str._s__d
push eax
call fcn.00409840
add esp, 0x10
mov byte [ebp - 4], 0x27
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x417ce4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x4814]
mov edx, dword [ebp - 0x4850]
mov eax, edi
mov byte [ebp - 4], 0x26
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x417d0b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x485c]
add ecx, 0xc
mov dword [ebp - 0x485c], ecx
cmp ecx, dword [ebp - 0x4820]
jne 0x417b70
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov edi, dword [ebp - 0x4814]
cmp dword [edi - 4], 1
jle 0x417d51
push dword [edi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov edi, dword [ebp - 0x4814]
mov esi, dword [ebp - 0x4868]
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, esi
push eax
lea eax, [ebp - 0x4844]
push eax
push edi
push str.DefaultIOPriorities
push str.ProcessDefaults
call fcn.004136b0
mov eax, dword [esi + 0x3370]
mov ecx, dword [esi + 0x3374]
mov dword [ebp - 0x4818], eax
mov dword [ebp - 0x481c], ecx
cmp eax, ecx
je 0x417e6e
mov esi, ecx
cmp byte [eax + 8], 0
je 0x417e57
cmp dword [eax + 4], 0xffffffff
jne 0x417e57
mov esi, dword [eax]
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4860], eax
push esi
lea eax, [ebp - 0x4860]
mov byte [ebp - 4], 0x29
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_sPerfOptions
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x4860]
lea eax, [ebp - 0x485c]
add esp, 0xc
push eax
push 0x20006
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417e23
push str.IoPriority
push dword [ebp - 0x485c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x485c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x26
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x417e4b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x481c]
mov eax, dword [ebp - 0x4818]
add eax, 0xc
mov dword [ebp - 0x4818], eax
cmp eax, esi
jne 0x417da0
mov esi, dword [ebp - 0x4868]
mov eax, dword [esi + 0x3374]
mov dword [ebp - 0x4818], eax
mov eax, dword [esi + 0x3370]
mov dword [ebp - 0x4864], eax
cmp eax, dword [ebp - 0x4818]
je 0x417f35
mov edi, eax
mov eax, dword [ebp - 0x4818]
nop word [eax + eax]
cmp byte [edi + 8], 0
je 0x417f24
cmp dword [edi + 4], 0xffffffff
je 0x417f24
lea ecx, [ebp - 0x4854]
mov dword [ebp - 0x4854], 0
push ecx
push dword [edi]
lea ecx, [esi + 0x3009]
mov dword [ebp - 0x4850], 0xffffffff
mov dword [ebp - 0x484c], 0xffffffff
mov dword [ebp - 0x4848], 0xffffffff
call fcn.00413130
test al, al
je 0x417ef7
mov eax, dword [ebp - 0x484c]
cmp eax, dword [edi + 4]
je 0x417f1e
mov eax, dword [edi + 4]
lea ecx, [esi + 0x3009]
mov dword [ebp - 0x484c], eax
lea eax, [ebp - 0x4854]
push eax
push dword [edi]
mov dword [ebp - 0x4854], 4
call fcn.0041ac70
mov eax, dword [ebp - 0x4818]
add edi, 0xc
cmp edi, eax
jne 0x417ea0
mov edi, dword [ebp - 0x4814]
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0x25
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x417f53
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esi + 0x33f4]
mov byte [ebp - 4], 3
push eax
call fcn.0041bda7
add esi, 0x33f4
push esi
mov dword [ebp - 0x486c], esi
call fcn.0041bd96
add esp, 8
test eax, eax
jne 0x41ab84
mov eax, dword [esi + 0x2c]
cmp eax, 0x7fffffff
jne 0x417f93
dec eax
add esi, 0x2c
jmp 0x41ac4d
mov byte [ebp - 4], 0x2a
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41abe5
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4814], eax
mov esi, dword [ebp - 0x4868]
mov byte [ebp - 4], 0x2b
mov eax, dword [esi + 0x337c]
mov ecx, dword [esi + 0x3380]
mov dword [ebp - 0x4818], eax
mov dword [ebp - 0x4820], ecx
cmp eax, ecx
je 0x418109
mov esi, eax
mov eax, dword [esi]
xorps xmm0, xmm0
sub eax, 0x10
movq qword [ebp - 0x4850], xmm0
push eax
mov dword [ebp - 0x4848], 0
call fcn.004025a0
mov ecx, dword [esi + 4]
add eax, 0x10
mov dl, byte [esi + 8]
add esp, 4
mov dword [ebp - 0x4850], eax
mov dword [ebp - 0x4864], ecx
mov dword [ebp - 0x484c], ecx
mov byte [ebp - 0x4848], dl
mov byte [ebp - 4], 0x2c
cmp ecx, 0xffffffff
je 0x4180d3
test dl, dl
jne 0x4180d3
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x418057
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [ebp - 0x4850]
add eax, 0xfffffff0
push eax
call fcn.004025a0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x4860], eax
push 0x43253c
push 0x432544
lea ecx, [ebp - 0x4860]
mov byte [ebp - 4], 0x2d
call fcn.00408300
push dword [ebp - 0x4864]
mov esi, dword [ebp - 0x4860]
lea eax, [ebp - 0x4814]
push esi
push str._s__d
push eax
call fcn.00409840
add esp, 0x10
mov byte [ebp - 4], 0x2c
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4180c7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4850]
mov esi, dword [ebp - 0x4818]
lea edx, [eax - 0x10]
mov byte [ebp - 4], 0x2b
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4180ee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xc
mov dword [ebp - 0x4818], esi
cmp esi, dword [ebp - 0x4820]
jne 0x417fe2
mov esi, dword [ebp - 0x4868]
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov edi, dword [ebp - 0x4814]
cmp dword [edi - 4], 1
jle 0x418134
push dword [edi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov edi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, esi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push edi
push str.DefaultMemoryPriorities
push str.ProcessDefaults
call fcn.004136b0
mov eax, dword [esi + 0x337c]
mov ecx, dword [esi + 0x3380]
mov dword [ebp - 0x4818], eax
mov dword [ebp - 0x481c], ecx
cmp eax, ecx
je 0x41824e
mov esi, ecx
nop dword [eax]
cmp byte [eax + 8], 0
je 0x418237
cmp dword [eax + 4], 0xffffffff
jne 0x418237
mov esi, dword [eax]
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4860], eax
push esi
lea eax, [ebp - 0x4860]
mov byte [ebp - 4], 0x2e
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_sPerfOptions
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x4860]
lea eax, [ebp - 0x485c]
add esp, 0xc
push eax
push 0x20006
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418203
push str.PagePriority
push dword [ebp - 0x485c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x485c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x2b
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41822b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x481c]
mov eax, dword [ebp - 0x4818]
add eax, 0xc
mov dword [ebp - 0x4818], eax
cmp eax, esi
jne 0x418180
mov esi, dword [ebp - 0x4868]
mov eax, dword [esi + 0x3380]
mov dword [ebp - 0x4818], eax
mov eax, dword [esi + 0x337c]
mov dword [ebp - 0x4864], eax
cmp eax, dword [ebp - 0x4818]
je 0x418315
mov edi, eax
mov eax, dword [ebp - 0x4818]
nop word [eax + eax]
cmp byte [edi + 8], 0
je 0x418304
cmp dword [edi + 4], 0xffffffff
je 0x418304
lea ecx, [ebp - 0x4854]
mov dword [ebp - 0x4854], 0
push ecx
push dword [edi]
lea ecx, [esi + 0x3009]
mov dword [ebp - 0x4850], 0xffffffff
mov dword [ebp - 0x484c], 0xffffffff
mov dword [ebp - 0x4848], 0xffffffff
call fcn.00413130
test al, al
je 0x4182d7
mov eax, dword [ebp - 0x4848]
cmp eax, dword [edi + 4]
je 0x4182fe
mov eax, dword [edi + 4]
lea ecx, [esi + 0x3009]
mov dword [ebp - 0x4848], eax
lea eax, [ebp - 0x4854]
push eax
push dword [edi]
mov dword [ebp - 0x4854], 8
call fcn.0041ac70
mov eax, dword [ebp - 0x4818]
add edi, 0xc
cmp edi, eax
jne 0x418280
mov edi, dword [ebp - 0x4814]
mov byte [ebp - 4], 0x2a
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x418331
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [esi + 0x33f4]
mov byte [ebp - 4], 3
push eax
call fcn.0041bda7
lea edi, [esi + 0x33f4]
push edi
mov dword [ebp - 0x486c], edi
call fcn.0041bd96
add esp, 8
test eax, eax
jne 0x41ab84
mov eax, dword [edi + 0x2c]
cmp eax, 0x7fffffff
je 0x41ac49
mov byte [ebp - 4], 0x2f
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41abef
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4814], eax
mov ecx, dword [esi + 0x334c]
mov edx, dword [esi + 0x3350]
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x4818], ecx
mov dword [ebp - 0x4820], edx
cmp ecx, edx
je 0x418453
or edi, 0xffffffff
cmp dword [eax - 0xc], 0
je 0x4183d2
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov ecx, dword [ebp - 0x4818]
push 0x432544
push dword [ecx]
lea eax, [ebp - 0x4864]
mov ecx, esi
push eax
call fcn.00412930
mov ecx, dword [ebp - 0x4818]
mov byte [ebp - 4], 0x31
push dword [ecx + 4]
push dword [eax]
lea eax, [ebp - 0x4814]
push str._s__u
push eax
call fcn.00409840
mov edx, dword [ebp - 0x4864]
add esp, 0x10
mov byte [ebp - 4], 0x30
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41842b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x4818]
add ecx, 8
mov dword [ebp - 0x4818], ecx
cmp ecx, dword [ebp - 0x4820]
je 0x41844d
mov eax, dword [ebp - 0x4814]
jmp 0x4183b6
mov edi, dword [ebp - 0x486c]
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x41847e
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
mov ecx, dword [ebp - 0x4868]
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.ThreadPriorityBoosts
push str.ProcessDefaults
call fcn.004136b0
mov byte [ebp - 4], 0x2f
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4184c5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push edi
mov byte [ebp - 4], 3
call fcn.0041bda7
mov edi, dword [ebp - 0x4868]
lea ecx, [ebp - 0x481c]
add esp, 4
lea eax, [edi + 0x33f4]
push eax
call fcn.004120d0
mov byte [ebp - 4], 0x32
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41abf9
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov eax, dword [edi + 0x3388]
mov ecx, dword [edi + 0x338c]
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x485c], eax
mov dword [ebp - 0x486c], ecx
cmp eax, ecx
je 0x418744
push 0x1000
lea eax, [ebp - 0x4010]
push 0
push eax
call fcn.0041e7e0
add esp, 0xc
cmp dword [esi - 0xc], 0
je 0x41855f
push 1
push 0x432544
lea ecx, [ebp - 0x4814]
call fcn.00403c10
mov esi, dword [ebp - 0x485c]
lea eax, [ebp - 0x4864]
push 0x432544
mov ecx, edi
push dword [esi]
push eax
call fcn.00412930
mov eax, dword [eax]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 0x34
push dword [eax - 0xc]
push eax
call fcn.00403c10
mov edx, dword [ebp - 0x4864]
or eax, 0xffffffff
mov byte [ebp - 4], 0x33
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4185b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push 0x432544
lea ecx, [ebp - 0x4814]
call fcn.00403c10
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4860], eax
push dword [esi + 0x18]
lea eax, [ebp - 0x4860]
mov byte [ebp - 4], 0x35
push 0x434120
push eax
call fcn.00402f80
mov esi, dword [ebp - 0x4860]
lea eax, [ebp - 0x4820]
add esp, 0xc
mov ecx, edi
push 0x432544
push esi
push eax
call fcn.00412930
mov eax, dword [eax]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 0x36
push dword [eax - 0xc]
push eax
call fcn.00403c10
mov edx, dword [ebp - 0x4820]
or eax, 0xffffffff
mov byte [ebp - 4], 0x35
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x41864e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push 0x432544
lea ecx, [ebp - 0x4814]
call fcn.00403c10
mov eax, dword [ebp - 0x485c]
mov ecx, dword [eax + 8]
cmp ecx, 0xffffffff
je 0x4186c1
push ecx
lea eax, [ebp - 0x4010]
push 0x432558
push eax
call fcn.0041b210
lea ecx, [ebp - 0x4010]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418690
sub ecx, edx
lea eax, [ebp - 0x4010]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x4814]
call fcn.00403c10
xor eax, eax
mov word [ebp - 0x4010], ax
mov eax, dword [ebp - 0x485c]
push 0x800
lea ecx, [ebp - 0x4010]
push ecx
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.00409d10
lea ecx, [ebp - 0x4010]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4186e4
sub ecx, edx
lea eax, [ebp - 0x4010]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x4814]
call fcn.00403c10
mov byte [ebp - 4], 0x33
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x418722
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x485c]
add eax, 0x20
mov dword [ebp - 0x485c], eax
cmp eax, dword [ebp - 0x486c]
je 0x418744
mov esi, dword [ebp - 0x4814]
jmp 0x418531
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x41876f
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.DefaultAffinitiesEx
push str.ProcessDefaults
call fcn.004136b0
mov byte [ebp - 4], 0x32
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4187b2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x481c]
mov byte [ebp - 4], 3
call fcn.0041bda7
add esp, 4
lea eax, [edi + 0x33f4]
lea ecx, [ebp - 0x486c]
push eax
call fcn.004120d0
mov byte [ebp - 4], 0x37
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ac03
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov ecx, dword [edi + 0x33a0]
mov eax, 1
mov edx, dword [edi + 0x33a4]
mov byte [ebp - 4], 0x38
mov dword [ebp - 0x481c], ecx
mov dword [ebp - 0x4820], edx
cmp ecx, edx
je 0x418a5a
nop dword [eax]
nop word [eax + eax]
mov dword [ebp - 0x4818], 0
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4818], eax
lea eax, [ebp - 0x4818]
mov byte [ebp - 4], 0x39
push eax
mov eax, dword [ebp - 0x481c]
add eax, 4
push eax
call fcn.004099f0
add esp, 8
cmp dword [esi - 0xc], 0
je 0x41888e
push 1
push 0x432544
lea ecx, [ebp - 0x4814]
call fcn.00403c10
mov eax, dword [ebp - 0x481c]
mov ecx, edi
push 0x435448
push dword [eax]
lea eax, [ebp - 0x4864]
push eax
call fcn.00412930
mov eax, dword [eax]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 0x3a
push dword [eax - 0xc]
push eax
call fcn.00403c10
mov edx, dword [ebp - 0x4864]
or eax, 0xffffffff
mov byte [ebp - 4], 0x39
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4188e0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4814]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4188fa
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x418912
call fcn.00401ec0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x485c], eax
push 0x4344f4
lea ecx, [ebp - 0x485c]
mov byte [ebp - 4], 0x3b
call fcn.00401690
test al, al
jne 0x4189c7
push 0
push 0
push 0xffffffffffffffff
push 0x4344f4
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [eax - 1]
mov dword [ebp - 0x4860], edx
test edx, edx
jle 0x4189bc
mov esi, dword [ebp - 0x485c]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x41898f
push edx
lea ecx, [ebp - 0x485c]
call fcn.00401bb0
mov esi, dword [ebp - 0x485c]
mov edx, dword [ebp - 0x4860]
push edx
push esi
push 0xffffffffffffffff
push 0x4344f4
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x4860]
cmp eax, dword [esi - 8]
jg 0x41ac0d
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
jmp 0x4189cd
lea ecx, [ebp - 0x485c]
call fcn.004019b0
mov esi, dword [ebp - 0x485c]
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 0x3c
push esi
call fcn.00403c10
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0x39
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4189fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4818]
lea ecx, [ebp - 0x4814]
push dword [eax - 0xc]
push eax
call fcn.00403c10
mov edx, dword [ebp - 0x4818]
mov eax, esi
mov byte [ebp - 4], 0x38
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418a34
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x481c]
mov esi, dword [ebp - 0x4814]
add eax, 0x10
mov dword [ebp - 0x481c], eax
cmp eax, dword [ebp - 0x4820]
jne 0x418830
mov eax, 1
mov edx, dword [esi - 0xc]
mov dword [ebp - 0x4860], edx
test edx, edx
js 0x41ac0d
mov ecx, eax
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x418a91
push edx
lea ecx, [ebp - 0x4814]
call fcn.00401bb0
mov esi, dword [ebp - 0x4814]
mov edx, dword [ebp - 0x4860]
lea eax, [edx + 1]
push eax
push esi
call fcn.00422ff3
mov eax, dword [ebp - 0x4860]
add esp, 8
cmp eax, dword [esi - 8]
jg 0x41ac0d
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 4], 1
jle 0x418ad0
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.CPUSets
push str.ProcessDefaults
call fcn.004136b0
mov byte [ebp - 4], 0x37
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x418b13
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x486c]
mov byte [ebp - 4], 3
call fcn.0041bda7
lea eax, [edi + 0x31d4]
push 0
push eax
call fcn.004120b0
add esp, 0xc
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov eax, dword [edi + 0x3310]
mov edi, dword [edi + 0x3304]
mov dword [ebp - 0x4860], eax
mov eax, dword [ebp - 0x4868]
mov byte [ebp - 4], 0x3d
mov dword [ebp - 0x485c], edi
cmp edi, dword [eax + 0x3308]
je 0x418e5c
mov dword [ebp - 0x4818], 0
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x4864], esi
mov dword [ebp - 0x481c], eax
movzx eax, word [esi]
test ax, ax
je 0x418c08
mov esi, dword [ebp - 0x481c]
mov ecx, eax
mov edi, dword [ebp - 0x4864]
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x418bcc
test esi, esi
mov eax, edi
cmovne eax, esi
mov esi, eax
jmp 0x418bce
xor esi, esi
movzx eax, word [edi + 2]
add edi, 2
mov ecx, eax
test ax, ax
jne 0x418bb4
mov edi, dword [ebp - 0x485c]
mov dword [ebp - 0x481c], esi
mov eax, dword [ebp - 0x481c]
mov esi, dword [ebp - 0x4814]
test eax, eax
je 0x418c08
sub eax, esi
lea ecx, [ebp - 0x4814]
sar eax, 1
push eax
call fcn.00402f30
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x418c2f
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov esi, dword [ebp - 0x4868]
lea eax, [ebp - 0x4820]
push 0x435448
push dword [edi]
mov ecx, esi
push eax
call fcn.00412930
mov eax, dword [eax]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 0x3e
push dword [eax - 0xc]
push eax
call fcn.00403c10
mov edx, dword [ebp - 0x4820]
or eax, 0xffffffff
mov byte [ebp - 4], 0x3d
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418c81
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x4351e8
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [ebp - 0x4860]
mov ecx, esi
push 0x435448
push dword [eax]
lea eax, [ebp - 0x486c]
push eax
call fcn.00412930
mov eax, dword [eax]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 0x3f
push dword [eax - 0xc]
push eax
call fcn.00403c10
mov edx, dword [ebp - 0x486c]
or eax, 0xffffffff
mov byte [ebp - 4], 0x3d
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418ce3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4814]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x418cfd
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x418d15
call fcn.00401ec0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x485c], eax
push 0x4351e8
lea ecx, [ebp - 0x485c]
mov byte [ebp - 4], 0x40
call fcn.00401690
test al, al
jne 0x418da3
push 0
push 0
push 0xffffffffffffffff
push 0x4351e8
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x485c]
lea esi, [eax - 1]
mov dword [ebp - 0x4864], esi
test esi, esi
jle 0x418d9e
push esi
call fcn.00401c10
push esi
push eax
push 0xffffffffffffffff
push 0x4351e8
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [ebp - 0x485c]
mov eax, dword [ebp - 0x4864]
cmp eax, dword [esi - 8]
jg 0x41ac0d
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
jmp 0x418da9
call fcn.004019b0
mov esi, dword [ebp - 0x485c]
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 0x41
push esi
call fcn.00403c10
mov byte [ebp - 4], 0x3d
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x418dd8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x4868]
lea ecx, [ebp - 0x2010]
push 0xa
push ecx
mov eax, dword [esi + 0x331c]
add eax, dword [ebp - 0x4818]
push dword [eax]
call fcn.004240c7
mov edx, eax
add esp, 0xc
test edx, edx
jne 0x418e07
xor ecx, ecx
jmp 0x418e25
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x4864], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418e12
sub ecx, dword [ebp - 0x4864]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4814]
call fcn.00403c10
add dword [ebp - 0x4818], 4
add edi, 4
add dword [ebp - 0x4860], 4
mov dword [ebp - 0x485c], edi
cmp edi, dword [esi + 0x3308]
je 0x418e5c
mov esi, dword [ebp - 0x4814]
jmp 0x418b90
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x418e87
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
mov edi, dword [ebp - 0x4868]
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, edi
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.KeepRunningProcesses
push str.ProcessDefaults
call fcn.004136b0
lea eax, [edi + 0x31d4]
push 0
push eax
call fcn.004120c0
add esp, 8
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x418ee1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0x33f4
push edi
mov dword [ebp - 0x486c], edi
call fcn.0041bd96
add esp, 4
test eax, eax
jne 0x41ab84
mov eax, dword [edi + 0x2c]
cmp eax, 0x7fffffff
je 0x41ac49
mov byte [ebp - 4], 0x42
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ac17
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x485c], esi
mov eax, dword [ebp - 0x4868]
mov byte [ebp - 4], 0x43
mov ecx, dword [eax + 0x3224]
mov edx, dword [eax + 0x3228]
mov dword [ebp - 0x4860], ecx
mov dword [ebp - 0x4820], edx
cmp ecx, edx
je 0x419008
mov edi, eax
nop dword [eax + eax]
cmp dword [esi - 0xc], 0
je 0x418f78
push 1
push 0x432544
lea ecx, [ebp - 0x485c]
call fcn.00403c10
mov esi, dword [ebp - 0x4860]
lea eax, [ebp - 0x4864]
push 0x435448
mov ecx, edi
push dword [esi]
push eax
call fcn.00412930
mov eax, dword [eax]
lea ecx, [ebp - 0x485c]
mov byte [ebp - 4], 0x44
push dword [eax - 0xc]
push eax
call fcn.00403c10
mov edx, dword [ebp - 0x4864]
or eax, 0xffffffff
mov byte [ebp - 4], 0x43
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x418fca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [esi + 4]
lea eax, [ebp - 0x485c]
push 0x43547c
push eax
call fcn.00409840
add esi, 8
add esp, 0xc
cmp esi, dword [ebp - 0x4820]
mov dword [ebp - 0x4860], esi
mov esi, dword [ebp - 0x485c]
jne 0x418f60
mov edi, dword [ebp - 0x486c]
mov eax, dword [ebp - 0x4868]
lea ecx, [ebp - 0x482c]
push ecx
lea ecx, [ebp - 0x4838]
push ecx
lea ecx, [ebp - 0x4844]
push ecx
push esi
push str.EfficiencyMode
push str.ProcessAllowances
mov ecx, eax
call fcn.004136b0
mov byte [ebp - 4], 0x42
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41904b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push edi
mov byte [ebp - 4], 3
call fcn.0041bda7
mov edi, dword [ebp - 0x4868]
lea eax, [ebp - 0x482c]
add esp, 4
mov esi, str.true
mov ecx, str.false
cmp byte [edi + 0x30cc], 0
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.MatchWildcardsToPathnames
push str.ProcessDefaults
call fcn.004136b0
cmp byte [edi + 0x30c6], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.MatchOnCommandLine
push str.ProcessDefaults
call fcn.004136b0
cmp byte [edi + 0x30c1], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.DivideCPUPercentThresholdsBySystemCPUCount
push str.AdvancedRules
call fcn.004136b0
lea eax, [edi + 0x33f4]
push eax
lea ecx, [ebp - 0x486c]
call fcn.004120d0
mov byte [ebp - 4], 0x45
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ac21
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov edi, dword [edi + 0x33b8]
mov byte [ebp - 4], 0x46
mov edi, dword [edi]
mov dword [ebp - 0x481c], edi
cmp byte [edi + 0xd], 0
mov dword [ebp - 0x4860], edi
jne 0x4194a1
movzx eax, word [esi]
mov dword [ebp - 0x4864], esi
mov dword [ebp - 0x485c], 0
test ax, ax
je 0x41921f
mov esi, dword [ebp - 0x485c]
mov ecx, eax
mov edi, dword [ebp - 0x4864]
nop dword [eax]
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x4191a8
test esi, esi
mov eax, edi
cmovne eax, esi
mov esi, eax
jmp 0x4191aa
xor esi, esi
movzx eax, word [edi + 2]
add edi, 2
mov ecx, eax
test ax, ax
jne 0x419190
mov edi, dword [ebp - 0x4860]
mov dword [ebp - 0x485c], esi
mov edx, dword [ebp - 0x485c]
mov esi, dword [ebp - 0x4814]
test edx, edx
je 0x41921f
sub edx, esi
sar edx, 1
mov dword [ebp - 0x485c], edx
js 0x41ac0d
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x41920d
push edx
lea ecx, [ebp - 0x4814]
call fcn.00401bb0
mov esi, dword [ebp - 0x4814]
mov edx, dword [ebp - 0x485c]
cmp edx, dword [esi - 8]
jg 0x41ac0d
xor eax, eax
mov dword [esi - 0xc], edx
mov word [esi + edx*2], ax
movzx eax, word [esi]
push eax
mov dword [ebp - 0x485c], esi
call fcn.00422e67
add esp, 4
test eax, eax
je 0x419353
nop dword [eax]
movzx eax, word [esi + 2]
add esi, 2
push eax
call fcn.00422e67
add esp, 4
test eax, eax
jne 0x419240
mov dword [ebp - 0x485c], esi
mov esi, dword [ebp - 0x4814]
mov edx, dword [ebp - 0x485c]
cmp edx, esi
je 0x419353
mov eax, dword [esi - 0xc]
sub edx, esi
sar edx, 1
mov dword [ebp - 0x485c], edx
mov dword [ebp - 0x4864], eax
test eax, eax
js 0x41ac0d
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, dword [esi - 0xc]
or eax, ecx
jge 0x4192b8
push dword [ebp - 0x4864]
lea ecx, [ebp - 0x4814]
call fcn.00401bb0
mov esi, dword [ebp - 0x4814]
mov edx, dword [ebp - 0x485c]
lea eax, [esi + edx*2]
mov dword [ebp - 0x4864], eax
mov eax, dword [esi - 0xc]
sub eax, edx
mov dword [ebp - 0x4820], eax
lea ecx, [eax*2 + 2]
test ecx, ecx
je 0x419328
mov edx, dword [ebp - 0x4864]
test edx, edx
jne 0x4192f8
call fcn.00420096
mov dword [eax], 0x16
call fcn.004205b4
mov eax, 0x16
jmp 0x41932a
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
cmp eax, ecx
jae 0x41931d
call fcn.00420096
mov dword [eax], 0x22
call fcn.004205b4
mov eax, 0x22
jmp 0x41932a
push ecx
push edx
push esi
call fcn.0041e260
add esp, 0xc
xor eax, eax
push eax
call fcn.00401a10
mov eax, dword [ebp - 0x4820]
add esp, 4
test eax, eax
js 0x41ac0d
cmp eax, dword [esi - 8]
jg 0x41ac0d
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x419473
mov ecx, dword [esi - 0x10]
test ecx, ecx
je 0x419371
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x419389
call fcn.00401ec0
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x485c], eax
push 0x4344f4
lea ecx, [ebp - 0x485c]
mov byte [ebp - 4], 0x47
call fcn.00401690
test al, al
jne 0x41943e
push 0
push 0
push 0xffffffffffffffff
push 0x4344f4
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edx, [eax - 1]
mov dword [ebp - 0x4860], edx
test edx, edx
jle 0x419433
mov esi, dword [ebp - 0x485c]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x419406
push edx
lea ecx, [ebp - 0x485c]
call fcn.00401bb0
mov esi, dword [ebp - 0x485c]
mov edx, dword [ebp - 0x4860]
push edx
push esi
push 0xffffffffffffffff
push 0x4344f4
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x4860]
cmp eax, dword [esi - 8]
jg 0x41ac0d
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
jmp 0x419444
lea ecx, [ebp - 0x485c]
call fcn.004019b0
mov esi, dword [ebp - 0x485c]
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
mov byte [ebp - 4], 0x48
push esi
call fcn.00403c10
mov byte [ebp - 4], 0x46
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x419473
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0x10]
lea ecx, [ebp - 0x4814]
push dword [eax - 0xc]
push eax
call fcn.00403c10
lea ecx, [ebp - 0x481c]
call fcn.00406120
mov edi, dword [ebp - 0x481c]
mov esi, dword [ebp - 0x4814]
jmp 0x419152
cmp dword [esi - 4], 1
jle 0x4194bb
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
mov edi, dword [ebp - 0x4868]
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, edi
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.ProcessorGroupExtended
push str.AdvancedRules
call fcn.004136b0
mov byte [ebp - 4], 0x45
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x419504
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x486c]
mov byte [ebp - 4], 3
call fcn.0041bda7
add edi, 0x33f4
push edi
mov dword [ebp - 0x4860], edi
call fcn.0041bd96
add esp, 8
test eax, eax
jne 0x41ab84
mov eax, dword [edi + 0x2c]
cmp eax, 0x7fffffff
je 0x41ac49
mov byte [ebp - 4], 0x49
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ac2b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov eax, dword [ebp - 0x4868]
mov byte [ebp - 4], 0x4a
mov ecx, dword [eax + 0x3484]
mov eax, dword [eax + 0x3488]
cmp ecx, eax
mov dword [ebp - 0x481c], ecx
mov dword [ebp - 0x486c], eax
je 0x4197ba
movzx eax, word [esi]
mov dword [ebp - 0x4864], esi
mov dword [ebp - 0x485c], 0
test ax, ax
je 0x41963f
mov edi, dword [ebp - 0x485c]
mov ecx, eax
nop
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x4195c8
test edi, edi
mov eax, esi
cmovne eax, edi
mov edi, eax
jmp 0x4195ca
xor edi, edi
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x4195b0
mov esi, dword [ebp - 0x4814]
mov dword [ebp - 0x485c], edi
mov edx, dword [ebp - 0x485c]
mov edi, dword [ebp - 0x4860]
test edx, edx
je 0x41963f
sub edx, esi
sar edx, 1
mov dword [ebp - 0x485c], edx
js 0x41ac0d
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x41962d
push edx
lea ecx, [ebp - 0x4814]
call fcn.00401bb0
mov esi, dword [ebp - 0x4814]
mov edx, dword [ebp - 0x485c]
cmp edx, dword [esi - 8]
jg 0x41ac0d
xor eax, eax
mov dword [esi - 0xc], edx
mov word [esi + edx*2], ax
movzx eax, word [esi]
push eax
mov dword [ebp - 0x485c], esi
call fcn.00422e67
add esp, 4
test eax, eax
je 0x419773
mov edi, esi
nop dword [eax + eax]
movzx eax, word [edi + 2]
add edi, 2
push eax
call fcn.00422e67
add esp, 4
test eax, eax
jne 0x419660
mov dword [ebp - 0x485c], edi
mov edx, dword [ebp - 0x485c]
mov edi, dword [ebp - 0x4860]
cmp edx, esi
je 0x419773
mov eax, dword [esi - 0xc]
sub edx, esi
sar edx, 1
mov dword [ebp - 0x485c], edx
mov dword [ebp - 0x4864], eax
test eax, eax
js 0x41ac0d
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, dword [esi - 0xc]
or eax, ecx
jge 0x4196d8
push dword [ebp - 0x4864]
lea ecx, [ebp - 0x4814]
call fcn.00401bb0
mov esi, dword [ebp - 0x4814]
mov edx, dword [ebp - 0x485c]
lea eax, [esi + edx*2]
mov dword [ebp - 0x4864], eax
mov eax, dword [esi - 0xc]
sub eax, edx
mov dword [ebp - 0x4820], eax
lea ecx, [eax*2 + 2]
test ecx, ecx
je 0x419748
mov edx, dword [ebp - 0x4864]
test edx, edx
jne 0x419718
call fcn.00420096
mov dword [eax], 0x16
call fcn.004205b4
mov eax, 0x16
jmp 0x41974a
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
cmp eax, ecx
jae 0x41973d
call fcn.00420096
mov dword [eax], 0x22
call fcn.004205b4
mov eax, 0x22
jmp 0x41974a
push ecx
push edx
push esi
call fcn.0041e260
add esp, 0xc
xor eax, eax
push eax
call fcn.00401a10
mov eax, dword [ebp - 0x4820]
add esp, 4
test eax, eax
js 0x41ac0d
cmp eax, dword [esi - 8]
jg 0x41ac0d
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x419789
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov esi, dword [ebp - 0x481c]
lea ecx, [ebp - 0x4814]
mov eax, dword [esi]
push dword [eax - 0xc]
push eax
call fcn.00403c10
add esi, 4
cmp esi, dword [ebp - 0x486c]
mov dword [ebp - 0x481c], esi
mov esi, dword [ebp - 0x4814]
jmp 0x419585
cmp dword [esi - 4], 1
jle 0x4197d4
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
mov ecx, dword [ebp - 0x4868]
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.ProhibitInternetExplorerExceptWhenAny
push str.AdvancedRules
call fcn.004136b0
mov byte [ebp - 4], 0x49
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41981b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push edi
mov byte [ebp - 4], 3
call fcn.0041bda7
mov edi, dword [ebp - 0x4868]
add edi, 0x33f4
push edi
mov dword [ebp - 0x4864], edi
call fcn.0041bd96
add esp, 8
test eax, eax
jne 0x41ab84
mov eax, dword [edi + 0x2c]
cmp eax, 0x7fffffff
je 0x41ac49
mov byte [ebp - 4], 0x4b
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ac35
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4818], esi
mov eax, dword [ebp - 0x4868]
mov byte [ebp - 4], 0x4c
mov dword [ebp - 0x481c], 0
mov ecx, dword [eax + 0x3260]
sub ecx, dword [eax + 0x325c]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x419b43
mov edi, dword [ebp - 0x4868]
xor esi, esi
mov dword [ebp - 0x485c], esi
mov ecx, dword [edi + 0x325c]
add ecx, 0x2c
add ecx, esi
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
jne 0x4198df
push 0
push 0x432414
call fcn.00401840
mov ecx, dword [edi + 0x325c]
add ecx, 0x30
add ecx, esi
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
jne 0x4198fe
push 0
push 0x432414
call fcn.00401840
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4814], eax
mov eax, dword [edi + 0x325c]
mov byte [ebp - 4], 0x4d
mov eax, dword [eax + esi + 0x2c]
sub eax, 0x10
push eax
call fcn.004025a0
lea esi, [eax + 0x10]
mov dword [ebp - 0x4860], esi
mov eax, dword [edi + 0x325c]
mov ecx, dword [ebp - 0x485c]
mov byte [ebp - 4], 0x4e
mov eax, dword [ecx + eax + 0x30]
sub eax, 0x10
push eax
call fcn.004025a0
add esp, 8
lea edi, [eax + 0x10]
mov dword [ebp - 0x486c], edi
cmp dword [esi - 0xc], 0
mov byte [ebp - 4], 0x4f
jne 0x419988
push 1
push 0x43b7f0
lea ecx, [ebp - 0x4860]
call fcn.00401840
mov esi, dword [ebp - 0x4860]
cmp dword [edi - 0xc], 0
jne 0x4199a6
push 1
push 0x43b7f0
lea ecx, [ebp - 0x486c]
call fcn.00401840
mov edi, dword [ebp - 0x486c]
mov eax, dword [ebp - 0x4868]
mov ecx, dword [ebp - 0x485c]
mov eax, dword [eax + 0x325c]
mov eax, dword [ecx + eax]
sub eax, 0x10
push eax
call fcn.004025a0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x4820], eax
push 0x43253c
push 0x432544
lea ecx, [ebp - 0x4820]
mov byte [ebp - 4], 0x50
call fcn.00408300
mov ecx, dword [ebp - 0x485c]
mov eax, dword [ebp - 0x4868]
push 0x43b7f0
push 0x43b7f0
push edi
mov eax, dword [eax + 0x325c]
push esi
mov esi, dword [ebp - 0x4820]
push dword [eax + ecx + 0x34]
movsd xmm0, qword [eax + ecx + 0x10]
push dword [eax + ecx + 0x28]
push dword [eax + ecx + 0x24]
push dword [eax + ecx + 0x20]
push dword [eax + ecx + 0x18]
sub esp, 8
cmp dword [ebp - 0x481c], 0
movsd qword [esp], xmm0
push dword [eax + ecx + 0xc]
push dword [eax + ecx + 8]
mov ecx, 0x432414
mov eax, 0x432544
push esi
cmove eax, ecx
push eax
lea eax, [ebp - 0x4814]
push str._s_s__d__d__.2lf__d__I64u__d__d__s__s__s__s
push eax
call fcn.00402f80
mov eax, dword [ebp - 0x4814]
lea ecx, [ebp - 0x4818]
add esp, 0x44
push dword [eax - 0xc]
push eax
call fcn.00403c10
lea edx, [esi - 0x10]
mov byte [ebp - 4], 0x4f
or esi, 0xffffffff
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419a94
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x4e
add edi, 0xfffffff0
mov eax, esi
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x419aaf
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4860]
mov eax, esi
mov byte [ebp - 4], 0x4d
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419ad0
cmp dword [esi - 4], 1
jle 0x419b5d
push dword [esi - 0xc]
lea ecx, [ebp - 0x4818]
call fcn.00401ab0
mov esi, dword [ebp - 0x4818]
mov ecx, dword [ebp - 0x4868]
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.WatchdogRules2
push str.AdvancedRules
call fcn.004136b0
mov byte [ebp - 4], 0x4b
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x419ba4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push edi
mov byte [ebp - 4], 3
call fcn.0041bda7
mov edi, dword [ebp - 0x4868]
lea eax, [ebp - 0x482c]
add esp, 4
mov esi, str.true
mov ecx, str.false
cmp byte [edi + 0x30cf], 0
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.GamingModeEnabled
push str.GamingMode
call fcn.004136b0
cmp byte [edi + 0x310f], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.GamingChangePowerPlan
push str.GamingMode
call fcn.004136b0
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push dword [edi + 0x3188]
push str.TargetPowerPlan
push str.GamingMode
call fcn.004136b0
cmp byte [edi + 0x3164], 0
lea eax, [ebp - 0x482c]
push eax
lea eax, [ebp - 0x4838]
mov ecx, str.false
push eax
lea eax, [ebp - 0x4844]
push eax
mov eax, esi
cmove eax, ecx
mov ecx, edi
push eax
push str.GamingModeEngageForSteam
push str.GamingMode
call fcn.004136b0
lea eax, [edi + 0x31bc]
push 0
push eax
call fcn.004120b0
lea eax, [edi + 0x32f8]
push eax
call fcn.004139d0
add esp, 0xc
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov eax, dword [edi + 0x32f8]
mov ecx, dword [edi + 0x32fc]
mov byte [ebp - 4], 0x51
mov dword [ebp - 0x4818], eax
mov dword [ebp - 0x4864], ecx
cmp eax, ecx
je 0x419e32
or edi, 0xffffffff
nop dword [eax]
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x4860], esi
mov dword [ebp - 0x481c], eax
movzx eax, word [esi]
test ax, ax
je 0x419d7d
mov esi, dword [ebp - 0x481c]
mov ecx, eax
nop
push ecx
call fcn.00422e67
add esp, 4
test eax, eax
je 0x419d3c
mov eax, dword [ebp - 0x4860]
test esi, esi
cmovne eax, esi
mov esi, eax
jmp 0x419d3e
xor esi, esi
mov eax, dword [ebp - 0x4860]
add eax, 2
mov dword [ebp - 0x4860], eax
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x419d20
mov dword [ebp - 0x481c], esi
mov eax, dword [ebp - 0x481c]
mov esi, dword [ebp - 0x4814]
test eax, eax
je 0x419d7d
lea ecx, [ebp - 0x4814]
call fcn.00402dd0
mov eax, dword [ebp - 0x4814]
cmp dword [eax - 0xc], 0
je 0x419da4
push 0x4344f4
lea ecx, [ebp - 0x4814]
call fcn.00412700
mov eax, dword [ebp - 0x4818]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.004025a0
add eax, 0x10
add esp, 4
mov dword [ebp - 0x4820], eax
push 0x43253c
push 0x432544
lea ecx, [ebp - 0x4820]
mov byte [ebp - 4], 0x52
call fcn.00408300
mov esi, dword [ebp - 0x4820]
lea ecx, [ebp - 0x4814]
push dword [esi - 0xc]
push esi
call fcn.00403c10
mov byte [ebp - 4], 0x51
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x419e0a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x4818]
add ecx, 4
mov dword [ebp - 0x4818], ecx
cmp ecx, dword [ebp - 0x4864]
je 0x419e2c
lea ecx, [ebp - 0x4814]
call fcn.00402ed0
mov esi, dword [ebp - 0x4814]
cmp dword [esi - 4], 1
jle 0x419e5d
push dword [esi - 0xc]
lea ecx, [ebp - 0x4814]
call fcn.00401ab0
mov esi, dword [ebp - 0x4814]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push esi
push str.AutomaticGamingModeProcessPaths
push str.GamingMode
call fcn.004136b0
lea eax, [edi + 0x31bc]
push 0
push eax
call fcn.004120c0
add esp, 8
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x419eb1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x482c]
mov ecx, edi
push eax
lea eax, [ebp - 0x4838]
push eax
lea eax, [ebp - 0x4844]
push eax
push dword [edi + 0x30f4]
push str.StartWithPowerPlan
push str.PowerManagement
call fcn.004136b0
lea eax, [edi + 0x31ec]
push 0
push eax
call fcn.004120b0
lea eax, [edi + 0x3328]
push eax
call fcn.004139d0
add esp, 0xc
call fcn.00401ec0
mov ecx, eax
test ecx, ecx
je 0x41ab8b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x4814], esi
mov eax, dword [edi + 0x332c]
sub eax, dword [edi + 0x3328]
sar eax, 2
mov byte [ebp - 4], 0x53
mov dword [ebp - 0x4820], 0
test eax, eax
je 0x41a17b
push 5
call fcn.0041c356
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80070057
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
push 0x80004005
call fcn.00401fc0
lea esi, [edi + 0x2c]
dec eax
push 6
mov dword [esi], eax
call fcn.0041c356
push 0x80004005
call fcn.00401fc0
int3