Function at 0x411350
Capabilities:
Enumerate process modules
Get file version info
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x16a0
call fcn.00488190
mov eax, dword [0x4c9890]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x1678], eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x161c], ax
lea eax, [ebp - 0x161a]
push eax
call fcn.004866f0
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call fcn.004866f0
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ebx, eax
push 0x400
lea eax, [ebp - 0x161c]
push eax
push 0
mov dword [ebp - 0x1664], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x161c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push 0x4a7128
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
lea eax, [ebp - 0x804]
push eax
call fcn.004010d0
mov eax, dword [0x4cb014]
add esp, 0x14
test eax, eax
je 0x411427
push 0x409
push 0x400
lea ecx, [ebp - 0x161c]
push ecx
push 0x6a
push eax
call fcn.00412610
add esp, 0x14
jmp 0x411440
push str.UNKNOWN
lea eax, [ebp - 0x161c]
push 0x3ff
push eax
call fcn.00411310
add esp, 0xc
lea eax, [ebp - 0x161c]
push eax
push str._Crash__DownloadParam___s
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
lea eax, [ebp - 0x804]
push eax
call fcn.004010d0
add esp, 0x14
test ebx, ebx
je 0x411495
push 0
push ebx
call dword [sym.imp.USER32.dll_GetGuiResources]
push eax
push str._Crash__GDICount___u
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
add esp, 0x10
jmp 0x4114ae
push str._Crash__GDICount__UNKNOWN
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
add esp, 0xc
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.004010d0
add esp, 4
xorps xmm0, xmm0
push 0x1c
lea eax, [ebp - 0x1694]
xor ebx, ebx
push eax
push ebx
movlpd qword [ebp - 0x166c], xmm0
movq qword [ebp - 0x1694], xmm0
movq qword [ebp - 0x168c], xmm0
movq qword [ebp - 0x1684], xmm0
mov dword [ebp - 0x167c], ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov esi, dword [ebp - 0x1668]
mov edi, dword [ebp - 0x166c]
test eax, eax
je 0x411562
lea esp, [esp]
mov eax, dword [ebp - 0x1688]
add ebx, eax
test dword [ebp - 0x1684], 0x10000
jne 0x411529
add edi, eax
adc esi, 0
push 0x1c
lea eax, [ebp - 0x1694]
xorps xmm0, xmm0
push eax
push ebx
movq qword [ebp - 0x1694], xmm0
movq qword [ebp - 0x168c], xmm0
movq qword [ebp - 0x1684], xmm0
mov dword [ebp - 0x167c], 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x411510
shrd edi, esi, 0x14
sar esi, 0x14
push esi
push edi
push str._Crash__VMSize___I64d_MB
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
lea eax, [ebp - 0x804]
push eax
call fcn.004010d0
push 0x3c
lea eax, [ebp - 0x1658]
push 0
push eax
call fcn.004866f0
add esp, 0x24
lea eax, [ebp - 0x165c]
push eax
mov dword [ebp - 0x165c], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x4115eb
mov ecx, dword [ebp - 0x1654]
mov eax, dword [ebp - 0x1650]
shrd ecx, eax, 0x14
shr eax, 0x14
push eax
push ecx
push str._Crash__RAMSize___I64u_MB
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
add esp, 0x14
jmp 0x411604
push str._Crash__RAMSize__UNKNOWN_MB
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
add esp, 0xc
lea eax, [ebp - 0x804]
push eax
call fcn.004010d0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xe1c], ax
lea eax, [ebp - 0xe1a]
push eax
call fcn.004866f0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xa0c], ax
lea eax, [ebp - 0xa0a]
push eax
call fcn.004866f0
mov edi, dword [ebp - 0x1664]
xor ebx, ebx
add esp, 0x1c
mov dword [ebp - 0x1660], ebx
test edi, edi
je 0x411854
lea eax, [ebp - 0x1660]
push eax
push ebx
push ebx
push edi
call sub.KERNEL32.dll_K32EnumProcessModules
mov eax, dword [ebp - 0x1660]
xor ecx, ecx
shr eax, 2
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048614e
mov esi, dword [ebp - 0x1660]
mov ecx, esi
shr ecx, 2
add esp, 4
xor edx, edx
mov ebx, eax
test ecx, ecx
jle 0x4116c7
jmp 0x4116b0
mov dword [ebx + edx*4], 0
mov esi, dword [ebp - 0x1660]
mov eax, esi
inc edx
shr eax, 2
cmp edx, eax
jl 0x4116b0
lea eax, [ebp - 0x1660]
push eax
push esi
push ebx
push edi
call sub.KERNEL32.dll_K32EnumProcessModules
mov eax, dword [ebp - 0x1660]
shr eax, 2
xor esi, esi
test eax, eax
jle 0x411740
mov eax, dword [ebp - 0x1678]
xorps xmm0, xmm0
mov eax, dword [eax]
mov dword [ebp - 0x16a0], 0
movq qword [ebp - 0x169c], xmm0
mov edi, dword [eax + 0xc]
push 0xc
lea eax, [ebp - 0x16a0]
push eax
push dword [ebx + esi*4]
push dword [ebp - 0x1664]
call sub.KERNEL32.dll_K32GetModuleInformation
mov ecx, dword [ebp - 0x16a0]
cmp ecx, edi
jae 0x411732
mov eax, dword [ebp - 0x169c]
add eax, ecx
cmp eax, edi
ja 0x411747
mov eax, dword [ebp - 0x1660]
inc esi
shr eax, 2
cmp esi, eax
jl 0x4116e5
xor ebx, ebx
jmp 0x411854
push 0x104
lea eax, [ebp - 0xe1c]
push eax
push dword [ebx + esi*4]
sub edi, ecx
push dword [ebp - 0x1664]
mov dword [ebp - 0x1670], edi
call sub.KERNEL32.dll_K32GetModuleBaseNameW
xor eax, eax
push 0x206
push eax
mov word [ebp - 0xc14], ax
lea eax, [ebp - 0xc12]
push eax
call fcn.004866f0
add esp, 0xc
lea eax, [ebp - 0xc14]
push 0x104
push eax
push dword [ebx + esi*4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1664]
push eax
lea eax, [ebp - 0xc14]
push eax
mov dword [ebp - 0x1664], 0
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
test edi, edi
je 0x41184e
push edi
call fcn.0048614e
mov esi, eax
add esp, 4
test esi, esi
je 0x41184e
push esi
push edi
push dword [ebp - 0x1664]
lea eax, [ebp - 0xc14]
push eax
mov dword [ebp - 0x1668], 0
mov dword [ebp - 0x1674], 0
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x1668]
push eax
lea eax, [ebp - 0x1674]
push eax
push 0x4a7124
push esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0x1674]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
movzx eax, cx
push eax
movzx eax, dx
shr ecx, 0x10
push ecx
push eax
shr edx, 0x10
push edx
push str._u._u._u._u
lea eax, [ebp - 0xa0c]
push 0x103
push eax
call fcn.00401690
push esi
call fcn.004866e2
add esp, 0x20
mov ebx, dword [ebp - 0x1670]
lea ecx, [ebp - 0xe1c]
pop edi
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411860
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0xe1c]
mov esi, str.UNKNOWN
cmove eax, esi
push eax
push str._Crash__ModuleName___s
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
lea eax, [ebp - 0x804]
push eax
call fcn.004010d0
lea ecx, [ebp - 0xa0c]
add esp, 0x14
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4118b0
sub ecx, edx
sar ecx, 1
lea eax, [ebp - 0xa0c]
cmove eax, esi
push eax
push str._Crash__ModuleVersion___s
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
lea eax, [ebp - 0x804]
push eax
call fcn.004010d0
push ebx
push str._Crash__Offset__0x_p
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
lea eax, [ebp - 0x804]
push eax
call fcn.004010d0
mov eax, dword [ebp - 0x1678]
add esp, 0x28
pop esi
pop ebx
test eax, eax
je 0x411945
mov eax, dword [eax]
test eax, eax
je 0x411945
mov eax, dword [eax]
test eax, eax
je 0x411945
push eax
push str._Crash__ExceptionCode__0x_X
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
add esp, 0x10
jmp 0x41195e
push str._Crash__ExceptionCode__UNKNOWN
lea eax, [ebp - 0x804]
push 0x3ff
push eax
call fcn.00411310
add esp, 0xc
lea eax, [ebp - 0x804]
push eax
call fcn.004010d0
push 1
call fcn.00401170
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 8
call fcn.00487c50
mov esp, ebp
pop ebp
ret