Function at 0x40b0c0
Capabilities:
Create thread
Get system information on windows
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x2c8
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov edi, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
cmp eax, 0x4e
je 0x40b3b0
jbe 0x40b120
cmp eax, 0x110
je 0x40b3e0
xor edx, edx
cmp eax, 0x111
jne 0x40b10c
cmp di, 0x3f9
je 0x40b590
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
cmp eax, 2
je 0x40b380
xor edx, edx
cmp eax, 5
jne 0x40b10c
cmp edi, 1
je 0x40b10c
movzx eax, si
shr esi, 0x10
mov dword [ebp - 0x2b8], edx
mov edi, eax
sub edi, dword [0x41189c]
mov dword [0x41189c], eax
mov edx, esi
mov eax, dword [0x411850]
sub edx, dword [0x411898]
mov dword [0x411898], esi
lea esi, [ebp - 0x220]
mov dword [ebp - 0x2a0], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x218]
mov eax, dword [ebp - 0x2a0]
sub esp, 8
add eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x21c]
add ecx, edi
mov dword [esp + 0x14], eax
mov eax, ecx
sub eax, dword [ebp - 0x220]
mov ecx, dword [sym.imp.user32.dll_SetWindowPos]
mov dword [esp + 0x18], 0x216
mov dword [esp + 0x10], eax
mov eax, dword [0x411850]
mov dword [ebp - 0x2ac], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call ecx
mov edx, dword [sym.imp.user32.dll_InvalidateRect]
mov eax, dword [0x411850]
sub esp, 0x1c
mov dword [ebp - 0x2a8], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
mov eax, dword [0x411844]
sub esp, 0xc
mov dword [esp], eax
mov eax, dword [sym.imp.user32.dll_GetClientRect]
mov dword [esp + 4], esi
mov dword [ebp - 0x2b0], eax
call eax
mov ecx, dword [sym.imp.user32.dll_MapWindowPoints]
mov eax, dword [0x411844]
sub esp, 8
mov dword [ebp - 0x2b4], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 2
mov dword [esp], eax
call ecx
mov eax, dword [ebp - 0x2a0]
add eax, dword [ebp - 0x21c]
sub esp, 0x10
add edi, dword [ebp - 0x220]
mov dword [esp + 0xc], eax
mov eax, dword [0x411844]
mov dword [esp + 8], edi
mov edi, dword [ebp - 0x2ac]
mov dword [esp + 0x18], 0x215
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
mov eax, dword [0x411844]
mov edx, dword [ebp - 0x2a8]
sub esp, 0x1c
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
mov eax, dword [0x411854]
mov ecx, dword [ebp - 0x2b0]
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], eax
call ecx
mov eax, dword [0x411854]
mov ecx, dword [ebp - 0x2b4]
sub esp, 8
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 2
mov dword [esp], eax
call ecx
mov eax, dword [ebp - 0x2a0]
add eax, dword [ebp - 0x21c]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x220]
mov dword [esp + 0x18], 0x215
mov dword [esp + 8], eax
mov eax, dword [0x411854]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
mov eax, dword [0x411854]
mov edx, dword [ebp - 0x2a8]
sub esp, 0x1c
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], eax
call edx
mov edx, dword [ebp - 0x2b8]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [0x411848]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
call sym._SaveColumnSettings
lea esp, [ebp - 0x10]
xor edx, edx
pop ecx
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [esi]
cmp eax, dword [0x411850]
je 0x40b5b0
cmp eax, dword [0x41184c]
je 0x40b568
xor edx, edx
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
lea eax, [ebp - 0x220]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.user32.dll_GetClientRect]
mov eax, dword [ebp - 0x218]
sub esp, 8
mov dword [0x41189c], eax
mov eax, dword [ebp - 0x214]
mov dword [esp], ebx
mov dword [0x411898], eax
mov dword [esp + 0x18], 0x215
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x1e
mov dword [esp + 8], 0xf
mov dword [esp + 4], 0
call dword [sym.imp.user32.dll_SetWindowPos]
mov esi, dword [sym.imp.user32.dll_GetDlgItem]
sub esp, 0x1c
mov dword [esp], ebx
mov dword [esp + 4], 0x3fa
call esi
mov edi, dword [sym.imp.user32.dll_SendMessageW]
sub esp, 8
mov dword [0x411850], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x101f
mov dword [esp], eax
call edi
sub esp, 0x10
mov dword [0x41184c], eax
mov dword [esp], ebx
mov dword [esp + 4], 0x3f9
call esi
sub esp, 8
mov dword [0x411844], eax
mov dword [esp], ebx
mov dword [esp + 4], 0x3fd
call esi
mov dword [0x411854], eax
mov eax, dword [0x411850]
sub esp, 8
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], 0x30
mov dword [esp + 4], 0x1036
mov dword [esp], eax
call edi
sub esp, 0x10
call sym._AddColumns
mov eax, dword [0x411850]
mov dword [esp + 8], sym._ProcessListWndProc_16
mov dword [esp + 4], 0xfffffffc
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetWindowLongW]
sub esp, 0xc
mov dword [0x4110f0], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._ProcessPageRefreshThread_4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_CreateThread]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 1
sub esp, 4
lea esp, [ebp - 0x10]
mov eax, edx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [esi + 8]
cmp eax, 0xfffffebf
je 0x40b57d
cmp eax, 0xfffffec9
jne 0x40b3ca
call sym._UpdateColumnDataHints
xor edx, edx
jmp 0x40b3cc
mov dword [ebp - 0x2a0], edx
call sym._ProcessPage_OnEndProcess
mov edx, dword [ebp - 0x2a0]
jmp 0x40b10c
mov edx, dword [esi + 8]
cmp edx, 0xffffff4f
je 0x40b898
cmp edx, 0xfffffffb
jne 0x40b3ca
mov dword [esp + 0xc], 0
mov esi, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1004
mov dword [esp], eax
call esi
mov dword [ebp - 0x2a0], eax
sub esp, 0x10
test eax, eax
je 0x40c0d7
lea edi, [ebp - 0x25c]
xor ebx, ebx
jmp 0x40b619
inc ebx
cmp dword [ebp - 0x2a0], ebx
je 0x40b667
mov eax, dword [0x411850]
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x25c], 8
mov dword [ebp - 0x24c], 2
mov dword [ebp - 0x254], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0
mov dword [esp + 4], 0x104b
mov dword [esp], eax
call esi
sub esp, 0x10
test byte [ebp - 0x250], 2
je 0x40b610
mov eax, dword [0x411850]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1032
mov dword [esp], eax
call esi
sub esp, 0x10
cmp eax, 1
jne 0x40b3ca
mov dword [esp], ebx
call sym._PerfDataGetProcessId
test eax, eax
je 0x40b3ca
mov dword [esp], ebx
lea ebx, [ebp - 0x280]
mov edi, ebx
call sym._PerfDataGetProcessId
mov ecx, 9
mov esi, eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x288]
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetCursorPos]
sub esp, 4
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [0x4117cc]
sub esp, 4
mov dword [esp + 4], 0x90
mov dword [esp], eax
call dword [sym.imp.user32.dll_LoadMenuW]
mov edi, dword [sym.imp.user32.dll_GetSubMenu]
sub esp, 8
mov dword [ebp - 0x2a0], eax
mov dword [esp + 4], 0
mov dword [esp], eax
call edi
sub esp, 8
mov ebx, eax
mov dword [esp + 4], 4
mov dword [esp], eax
call edi
sub esp, 8
mov edi, eax
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_OpenProcess]
sub esp, 0xc
mov dword [ebp - 0x2a8], eax
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetPriorityClass]
mov ecx, dword [ebp - 0x2a8]
sub esp, 4
mov esi, eax
mov dword [esp], ecx
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
cmp dword [ebp - 0x26c], 1
jbe 0x40c19a
cmp esi, 0x100
je 0x40c1bb
ja 0x40c0aa
cmp esi, 0x40
je 0x40c1d0
cmp esi, 0x80
jne 0x40c08c
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x802a
mov dword [esp + 8], 0x802e
mov dword [esp + 4], 0x8029
mov dword [esp], edi
call dword [sym.imp.user32.dll_CheckMenuRadioItem]
sub esp, 0x14
lea eax, [ebp - 0x28c]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x416360
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
sub esp, 0x14
test eax, eax
jne 0x40c0de
lea eax, [ebp - 0x290]
lea esi, [ebp - 0x220]
mov dword [ebp - 0x290], 0x104
xor edi, edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x28c]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Debugger
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x40c169
cmp word [ebp - 0x220], 0
je 0x40c154
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x40b868
sub eax, esi
sar eax, 1
cmp edi, eax
jae 0x40c154
movzx eax, word [esi + edi*2]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_toupper]
mov word [esi + edi*2], ax
inc edi
jmp 0x40b855
test byte [esi + 0xc], 1
je 0x40b3ca
mov ebx, dword [esi + 0x14]
mov edi, dword [esi + 0x10]
mov eax, dword [ebx*4 + 0x411060]
test eax, eax
je 0x40b9d7
cmp eax, 1
je 0x40c060
cmp eax, 2
je 0x40c03e
cmp eax, 3
je 0x40c012
cmp eax, 4
je 0x40bfe6
cmp eax, 5
je 0x40bed8
cmp eax, 6
je 0x40be8a
cmp eax, 7
je 0x40be3c
cmp eax, 8
je 0x40bdee
cmp eax, 9
je 0x40bdb7
cmp eax, 0xa
je 0x40bd80
cmp eax, 0xb
je 0x40bd32
cmp eax, 0xc
je 0x40bce4
cmp eax, 0xd
je 0x40bc96
cmp eax, 0xe
je 0x40bc6a
cmp eax, 0xf
je 0x40bc33
cmp eax, 0x10
je 0x40bbfc
cmp eax, 0x11
je 0x40bbc5
cmp eax, 0x12
je 0x40bb8e
cmp eax, 0x13
je 0x40bb3d
cmp eax, 0x14
je 0x40baec
cmp eax, 0x15
je 0x40ba9b
cmp eax, 0x16
je 0x40ba4a
cmp eax, 0x17
je 0x40b9f9
cmp eax, 0x18
jne 0x40b3ca
lea eax, [ebp - 0x220]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x1f4]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1f8]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
xor edx, edx
jmp 0x40b3cc
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetImageName
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b8b7
lea eax, [ebp - 0x220]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x1fc]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x200]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b982
lea eax, [ebp - 0x220]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x204]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x208]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b97d
lea eax, [ebp - 0x220]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x20c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x210]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b974
lea eax, [ebp - 0x220]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x214]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x218]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b96b
lea eax, [ebp - 0x220]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetIOCounters
mov dword [esp + 0xc], 0xa
mov eax, dword [esi + 0x20]
mov edx, dword [ebp - 0x21c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x220]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__ui64tow]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b962
mov dword [esp], edi
call sym._PerfDataGetGDIObjectCount
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b959
mov dword [esp], edi
call sym._PerfDataGetUSERObjectCount
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b950
mov dword [esp], edi
call sym._PerfDataGetThreadCount
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b947
mov dword [esp], edi
call sym._PerfDataGetHandleCount
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b93e
mov dword [esp], edi
call sym._PerfDataGetBasePriority
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b935
mov dword [esp], edi
call sym._PerfDataGetNonPagedPoolUsagePages
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b92c
mov dword [esp], edi
call sym._PerfDataGetPagedPoolUsagePages
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b923
mov dword [esp], edi
call sym._PerfDataGetVirtualMemorySizeBytes
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b91a
mov dword [esp], edi
call sym._PerfDataGetPageFaultCountDelta
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b911
mov dword [esp], edi
call sym._PerfDataGetPageFaultCount
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x24]
call sym._CommaSeparateNumberString
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b908
mov dword [esp], edi
call sym._PerfDataGetWorkingSetSizeDelta
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b8ff
mov dword [esp], edi
call sym._PerfDataGetPeakWorkingSetSizeBytes
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b8f6
mov dword [esp], edi
call sym._PerfDataGetWorkingSetSizeBytes
mov dword [esp + 4], 0x416428
shr eax, 0xa
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call sym._CommaSeparateNumberString
mov dword [esp + 4], 0x4165b0
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscat]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b8ed
mov dword [esp], edi
call sym._PerfDataGetCPUTime
mov dword [esp + 8], 0x989680
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
call sym.___udivdi3
mov dword [esp + 8], 0xe10
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], edx
call sym.___umoddi3
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], edx
call sym.___umoddi3
mov ecx, dword [ebp - 0x2a4]
mov edx, dword [ebp - 0x2a8]
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov dword [esp + 0x10], eax
call sym.___udivdi3
mov edx, dword [esp + 8]
mov dword [esp + 8], 0xe10
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2a0]
mov dword [ebp - 0x2a8], edx
mov edx, dword [ebp - 0x29c]
mov ecx, dword [esp + 0xc]
mov dword [esp], eax
mov dword [esp + 0xc], 0
mov dword [esp + 4], edx
mov dword [ebp - 0x2a4], ecx
call sym.___udivdi3
mov ecx, dword [ebp - 0x2a4]
mov dword [esp + 4], str._d:_02d:_02d
mov dword [esp + 8], eax
mov dword [esp + 0xc], ecx
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b8e4
mov dword [esp], edi
call sym._PerfDataGetCPUUsage
mov dword [esp + 4], str._02d
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b8db
mov dword [esp], edi
call sym._PerfDataGetSessionId
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b8d2
mov eax, dword [esi + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._PerfDataGetUserName
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b8c9
mov dword [esp], edi
call sym._PerfDataGetProcessId
mov dword [esp + 4], 0x416428
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call dword [sym.imp.user32.dll_wsprintfW]
mov eax, dword [ebx*4 + 0x411060]
jmp 0x40b8c0
cmp esi, 0x20
jne 0x40b7c9
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x802c
jmp 0x40b7ad
cmp esi, 0x4000
je 0x40c1e5
cmp esi, 0x8000
jne 0x40b7c9
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x802b
jmp 0x40b7ad
xor ebx, ebx
jmp 0x40b667
mov dword [esp + 8], 3
mov dword [esp + 4], 0x8027
mov dword [esp], ebx
call dword [sym.imp.user32.dll_EnableMenuItem]
sub esp, 0xc
mov eax, dword [0x4117d0]
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x284]
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x288]
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.user32.dll_TrackPopupMenu]
mov eax, dword [ebp - 0x2a0]
sub esp, 0x1c
mov dword [esp], eax
call dword [sym.imp.user32.dll_DestroyMenu]
xor edx, edx
sub esp, 4
jmp 0x40b3cc
mov dword [esp + 4], str.DRWTSN32
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcsstr]
test eax, eax
je 0x40c185
mov dword [esp + 8], 3
mov dword [esp + 4], 0x8027
mov dword [esp], ebx
call dword [sym.imp.user32.dll_EnableMenuItem]
sub esp, 0xc
mov eax, dword [ebp - 0x28c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push eax
jmp 0x40c0fa
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8028
mov dword [esp], ebx
call dword [sym.imp.user32.dll_RemoveMenu]
sub esp, 0xc
jmp 0x40b776
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x8029
jmp 0x40b7ad
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x802e
jmp 0x40b7ad
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x802d
jmp 0x40b7ad