Function at 0x4400c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x268
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x264], eax
push esi
push edi
push 0x200
push 0x525960
push 0x525940
push 0x1c
call sym.SystemInformer.exe_Ordinal_1325
push dword [0x633a5c]
mov dword [0x6360cc], eax
push 0xc
call sym.SystemInformer.exe_Ordinal_1240
push 0x10
mov esi, eax
push 4
push dword [0x633a74]
mov dword [esi], 0
mov dword [esi + 4], 4
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [esi + 8], eax
mov dword [0x6360c8], esi
call fcn.004c2da0
test byte [0x63300c], 1
nop dword [eax + eax]
jne 0x440390
mov eax, dword [0x633010]
test eax, eax
je 0x44015e
push 0
push 0x63303c
push dword [eax + 4]
call sym.SystemInformer.exe_Ordinal_1655
mov esi, dword [0x63303c]
or edi, 0xffffffff
test esi, esi
je 0x440174
cmp dword [esi], 0
jne 0x4401ef
call fcn.004f8060
mov esi, eax
test esi, esi
je 0x4401e9
push 0x62e420
push esi
call sym.SystemInformer.exe_Ordinal_1298
lea edx, [esp + 0x30]
mov dword [esp + 0x10], eax
mov ecx, eax
call fcn.0051c2c0
test eax, eax
jns 0x4401c7
nop dword [eax]
cmp eax, 0xc0000043
je 0x4401c7
cmp eax, 0xc0000022
je 0x4401c7
mov ecx, dword [esp + 0x10]
mov eax, edi
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4401d7
nop
call fcn.004fe0c0
jmp 0x4401d7
mov eax, dword [esp + 0x10]
mov dword [0x63303c], eax
mov byte [0x632eb5], 1
lea ecx, [esi - 8]
mov eax, edi
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4401e9
call fcn.004fe0c0
mov esi, dword [0x63303c]
test esi, esi
je 0x4401fc
cmp dword [esi], 0
jne 0x4402bd
xorps xmm0, xmm0
mov dword [esp + 0x20], 0x38
movlpd qword [esp + 0x18], xmm0
lea eax, [esp + 0x60]
mov dword [esp + 0x1c], eax
mov esi, 0x208
lea eax, [esp + 0x10]
mov dword [esp + 0x24], str.SystemInformer_settings.xml
push eax
push 0x104
lea eax, [esp + 0x68]
mov dword [esp + 0x20], esi
push eax
mov eax, dword [0x63085c]
shr eax, 1
push eax
push dword [0x630860]
push 0
call dword [sym.imp.ntdll.dll_RtlQueryEnvironmentVariable]
test eax, eax
jns 0x440276
lea eax, [esp + 0x10]
shr esi, 1
push eax
push esi
lea eax, [esp + 0x68]
push eax
mov eax, dword [0x63084c]
shr eax, 1
push eax
push dword [0x630850]
push 0
call dword [sym.imp.ntdll.dll_RtlQueryEnvironmentVariable]
test eax, eax
js 0x4402b5
mov eax, dword [esp + 0x10]
add eax, eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
call sym.SystemInformer.exe_Ordinal_1483
mov dword [esp + 0x10], eax
test eax, eax
je 0x4402b5
lea ecx, [esp + 0x20]
push ecx
push eax
call sym.SystemInformer.exe_Ordinal_1298
mov ecx, dword [esp + 0x10]
mov esi, eax
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], edi
dec edi
jne 0x4402b7
call fcn.004fe0c0
jmp 0x4402b7
xor esi, esi
mov dword [0x63303c], esi
nop dword [eax]
test esi, esi
je 0x440390
cmp dword [esi], 0
je 0x440390
push esi
call sym.SystemInformer.exe_Ordinal_1890
nop word [eax + eax]
cmp eax, 0xc0000102
jne 0x440390
push str.If_you_select_No__the_settings_system_will_not_function_properly.
push str.System_Informers_settings_file_is_corrupt._Do_you_want_to_reset_it_
push 0xffff
push 6
push 0
call sym.SystemInformer.exe_Ordinal_1699
add esp, 0x14
cmp eax, 6
jne 0x44037b
mov eax, dword [0x60792c]
movups xmm0, xmmword [str._settings___settings_]
push 0x60
push 4
push 5
push 0x80
mov dword [esp + 0x50], eax
mov ax, word [0x607930]
push 0x120116
push dword [0x63303c]
mov word [esp + 0x5c], ax
lea eax, [esp + 0x28]
push eax
movups xmmword [esp + 0x4c], xmm0
call sym.SystemInformer.exe_Ordinal_1467
test eax, eax
js 0x440390
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x30]
push 0
push 0
push 0x15
push eax
lea eax, [esp + 0x38]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ntdll.dll_NtWriteFile]
push esi
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x440390
push dword [0x63303c]
call sym.SystemInformer.exe_Ordinal_1244
mov dword [0x63303c], 0
call sym.SystemInformer.exe_Ordinal_1910
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x1a
push eax
mov dword [esp + 0x18], str.EnablePlugins
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
mov dword [esp + 0x10], 0x16
lea eax, [esp + 0x10]
mov dword [esp + 0x14], str.MaxSizeUnit
push eax
setne byte [0x632eb4]
call sym.SystemInformer.exe_Ordinal_1886
mov dword [0x6314c0], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x20
mov dword [esp + 0x18], str.MaxPrecisionUnit
call sym.SystemInformer.exe_Ordinal_1886
movss xmm0, dword [0x62450c]
xor edx, edx
movss xmm1, dword [0x624534]
movzx eax, ax
mov word [0x6314bc], ax
mov dword [0x6314b8], 0x3f800000
cmp eax, 8
jb 0x44045d
lea ecx, [eax - 8]
shr ecx, 3
inc ecx
lea edx, [ecx*8]
nop dword [eax]
divss xmm0, xmm1
divss xmm0, xmm1
divss xmm0, xmm1
divss xmm0, xmm1
divss xmm0, xmm1
divss xmm0, xmm1
divss xmm0, xmm1
divss xmm0, xmm1
sub ecx, 1
jne 0x440430
movss dword [0x6314b8], xmm0
nop dword [eax]
cmp edx, eax
jae 0x440477
sub eax, edx
divss xmm0, xmm1
sub eax, 1
jne 0x440466
movss dword [0x6314b8], xmm0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x20
push eax
mov dword [esp + 0x18], str.EnableWindowText
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
mov dword [esp + 0x10], 0x24
lea eax, [esp + 0x10]
mov dword [esp + 0x14], str.EnableThemeSupport
push eax
setne byte [0x63659c]
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
setne byte [0x6330fd]
cmp dword [0x62db64], 0x72
jb 0x4404ed
lea eax, ds:[esp + 0x10]
mov dword [esp + 0x10], 0x32
push eax
mov dword [esp + 0x18], str.EnableThemeAcrylicSupport
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x4404ed
mov al, 1
jmp 0x4404ef
xor al, al
mov byte [0x6330fe], al
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x28
mov dword [esp + 0x18], str.TreeListBorderEnable
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
mov dword [esp + 0x10], 0x28
lea eax, [esp + 0x10]
mov dword [esp + 0x14], str.EnableDeferredLayout
push eax
setne byte [0x6330ff]
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
mov dword [esp + 0x10], 0x28
lea eax, [esp + 0x10]
mov dword [esp + 0x14], str.EnableServiceNonPoll
push eax
setne byte [0x63659e]
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
mov dword [esp + 0x10], 0x34
lea eax, [esp + 0x10]
mov dword [esp + 0x14], str.EnableServiceNonPollNotify
push eax
setne byte [0x6330fc]
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
mov dword [esp + 0x10], 0x28
lea eax, [esp + 0x10]
mov dword [esp + 0x14], str.NonPollFlushInterval
push eax
setne byte [0x632ebf]
call sym.SystemInformer.exe_Ordinal_1886
mov dword [0x62db18], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x12
mov dword [esp + 0x18], str.KsiEnable
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x44060a
test byte [0x63300c], 8
jne 0x44060a
mov al, byte [0x63402a]
test al, al
jne 0x4405fd
push 0
push 4
lea eax, [esp + 0x18]
push eax
push 0x1a
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x4405f6
cmp dword [esp + 0x10], 0
setne byte [0x634029]
mov byte [0x63402a], 1
cmp byte [0x634029], 0
jne 0x44060a
mov al, 1
jmp 0x44060c
xor al, al
mov byte [0x63659d], al
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x22
mov dword [esp + 0x18], str.KsiEnableWarnings
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
mov dword [esp + 0x10], 0x28
lea eax, [esp + 0x10]
mov dword [esp + 0x14], str.SampleCountAutomatic
push eax
setne byte [0x63659f]
call sym.SystemInformer.exe_Ordinal_1886
test eax, eax
je 0x440685
push 0x4e
call dword [sym.imp.USER32.dll_GetSystemMetrics]
inc eax
mov dword [esp + 0x10], 0x16
cdq
mov ecx, 0x1000
sub eax, edx
mov dword [esp + 0x14], str.SampleCount
sar eax, 1
cmp eax, ecx
cmova eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
call sym.SystemInformer.exe_Ordinal_1904
mov eax, dword [0x633038]
test eax, eax
je 0x440714
cmp dword [eax], 0
je 0x440714
push 0
push 0x62e430
push eax
call sym.SystemInformer.exe_Ordinal_1351
push 0
test al, al
jne 0x4406fa
push 0x62e428
push dword [0x633038]
call sym.SystemInformer.exe_Ordinal_1351
nop
test al, al
je 0x4406c8
push 1
jmp 0x4406fa
push 0
push 0x62e408
push dword [0x633038]
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x4406e2
push 2
jmp 0x4406fa
push 0
push 0x62e410
push dword [0x633038]
call sym.SystemInformer.exe_Ordinal_1351
test al, al
je 0x440714
push 3
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x1c
push eax
mov dword [esp + 0x1c], str.ReleaseChannel
call sym.SystemInformer.exe_Ordinal_1904
mov ecx, dword ds:[esp + 0x26c]
pop edi
pop esi
xor ecx, esp
call fcn.00583f7f
mov esp, ebp
pop ebp
ret