Function at 0x403c90
Capabilities:
Connect network resource
Create thread
Get hostname
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x420021
mov eax, dword fs:[0]
push eax
sub esp, 0xa94
mov eax, dword [0x431c38]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0xc]
xor eax, eax
push esi
push dword [ebp + 8]
mov dword [ebp - 0xa1c], 0
xor edi, edi
mov dword [ebp - 0x974], eax
mov dword [ebp - 0x95c], eax
mov dword [ebp - 0x94c], 0xffffffff
mov byte [ebp - 0x921], al
mov dword [ebp - 0x9b0], eax
mov dword [ebp - 0x954], eax
mov dword [ebp - 0x950], eax
call fcn.00403200
add esp, 8
test al, al
je 0x4060ee
cmp byte [0x43265a], 0
jne 0x403d2c
lea eax, [ebp + 8]
push esi
push eax
call fcn.00402610
add esp, 8
jmp 0x403d3a
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x958], eax
push esi
lea eax, [ebp + 8]
push eax
push 0x427fe0
call fcn.00401730
add esp, 0xc
test eax, eax
jne 0x403d62
push str.Eula_declined._n_n
call fcn.00401d80
add esp, 4
jmp 0x4060ee
lea eax, [ebp - 0x994]
mov dword [ebp - 0x994], 0x104
push eax
lea eax, [ebp - 0x118]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp byte [0x432662], 0
je 0x403e84
cmp byte [0x432663], 0
jne 0x403e12
push str.Password:
call fcn.00401d80
push 1
call fcn.0040a4ba
push eax
call fcn.00410b8b
add esp, 0xc
xor esi, esi
call fcn.00410643
mov cl, al
cmp cl, 0xd
je 0x403dee
cmp dword [0x431c34], 0x10
mov eax, 0x431c20
cmovae eax, dword [0x431c20]
mov byte [eax + esi], cl
inc esi
cmp esi, 0x17
jb 0x403dc6
cmp dword [0x431c34], 0x10
mov eax, 0x431c20
push 0x4277d8
cmovae eax, dword [0x431c20]
mov byte [eax + esi], 0
call fcn.00401d80
add esp, 4
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
push eax
lea eax, [ebp - 0x320]
push str._sADMIN_
push eax
call fcn.004027f0
add esp, 0xc
mov dword [ebp - 0x900], edi
lea eax, [ebp - 0x320]
mov dword [ebp - 0x8f4], edi
mov dword [ebp - 0x8f0], eax
lea eax, [ebp - 0x904]
mov dword [ebp - 0x8e8], edi
push 0
push 0x431c08
push 0x431c20
push eax
call sub.MPR.dll_WNetAddConnection2A
xor edx, edx
mov ecx, 1
test eax, eax
cmove edx, ecx
mov dword [ebp - 0x95c], edx
jmp 0x403e86
xor edx, edx
cmp byte [0x43265a], 0
mov dword [ebp - 0xa4c], edx
je 0x403f1f
lea eax, [ebp - 0x8e4]
push eax
push dword [ebp - 0x958]
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
movzx eax, word [ebp - 0x8da]
movsx ecx, word [ebp - 0x8e2]
mov word [ebp - 0x944], ax
movzx eax, word [ebp - 0x8d8]
mov word [ebp - 0x942], ax
lea eax, [ebp - 0x994]
mov esi, dword [ebp - 0x944]
push eax
movsx eax, word [ebp - 0x8e4]
imul ecx, eax
push esi
push ecx
push 0x20
push dword [ebp - 0x958]
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
cmp byte [0x43265a], 0
je 0x403f25
push 1
push fcn.00403000
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push 0
push 0
push 0x403a50
call fcn.004113ce
add esp, 0xc
jmp 0x403f25
mov esi, dword [ebp - 0x944]
mov ecx, dword [ebp - 0xa20]
mov al, byte [0x43265a]
mov dword [ebp - 0x9e4], ecx
mov ecx, dword [ebp - 0xa24]
mov dword [ebp - 4], 0
mov dword [ebp - 0x9e0], ecx
test al, al
je 0x403f5a
push esi
push dword [ebp - 0x958]
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
lea ecx, [ebp - 0x9c4]
call fcn.00402830
lea eax, [ebp - 0x9c4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x97c]
call fcn.00406310
lea eax, [ebp - 0x9c4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x988]
call fcn.00406310
lea eax, [ebp - 0x9c4]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x97c]
push eax
lea ecx, [ebp - 0xa90]
call fcn.00402b90
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x988]
push eax
lea ecx, [ebp - 0xaa0]
call fcn.00402b90
cmp dword [ebp - 0x94c], 0xffffffff
jne 0x404119
cmp byte [0x432661], 0
je 0x403ff4
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
jmp 0x403ff6
xor eax, eax
push str.processor
push eax
lea ecx, [ebp - 0x97c]
call fcn.00406370
test eax, eax
jne 0x404076
cmp byte [0x432661], al
je 0x404028
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
jmp 0x40402e
lea eax, [ebp - 0x118]
push eax
push str.Failed_to_take_process_snapshot_on__s._n
call fcn.00401d80
push str.Make_sure_that_the_Remote_Registry_service_is_running_on_the_remote_system__that_you_have_nfirewall_ports_allow_RPC_access__and_your_account_has_read_access_the_following_key_on_the_remote_system:_n
call fcn.00401d80
push str.HKLMSoftwareMicrosoftWindows_NTCurrentVersionPerflib_n_n
call fcn.00401d80
add esp, 0x10
lea ecx, [ebp - 0x988]
call fcn.00406330
lea ecx, [ebp - 0x97c]
call fcn.00406330
lea ecx, [ebp - 0x9c4]
call fcn.004029b0
jmp 0x4060ee
push str.processor
lea ecx, [ebp - 0xa90]
call fcn.00402bb0
mov esi, eax
test esi, esi
jne 0x4040cc
cmp byte [0x432661], al
je 0x4040a9
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
jmp 0x4040af
lea eax, [ebp - 0x118]
push eax
push str.Processor_performance_object_not_found_on__s_n
call fcn.00401d80
push str.Try_running_Exctrlst_from_microsoft.com_to_repair_the_performance_counters._n_n
call fcn.00401d80
add esp, 0xc
jmp 0x4042f7
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x94c], eax
call fcn.004061d0
nop
test eax, eax
je 0x404119
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, eax
call fcn.00402b50
test eax, eax
je 0x404158
lea eax, [ebp - 0x21c]
push str._Total
push eax
call fcn.004102b7
add esp, 8
test eax, eax
jne 0x404158
dec dword [ebp - 0x94c]
lea eax, [ebp - 0x96c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x9f4]
push eax
lea eax, [ebp - 0x96c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
cmp byte [0x432661], 0
je 0x404164
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
jmp 0x404166
mov ecx, esi
call fcn.00406270
jmp 0x4040e0
xor eax, eax
push str.process
push eax
lea ecx, [ebp - 0x97c]
call fcn.00406370
test eax, eax
jne 0x4041c2
cmp byte [0x432661], al
je 0x4041a9
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
push eax
push str.Failed_to_take_process_snapshot_on__s_n_n
call fcn.00401d80
add esp, 8
jmp 0x404050
lea eax, [ebp - 0x118]
push eax
push str.Failed_to_take_process_snapshot_on__s_n_n
call fcn.00401d80
add esp, 8
jmp 0x404050
push str.process
lea ecx, [ebp - 0xa90]
call fcn.00402bb0
mov esi, eax
mov dword [ebp - 0x970], esi
test esi, esi
jne 0x40421e
cmp byte [0x432661], al
je 0x4041fb
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
jmp 0x404201
lea eax, [ebp - 0x118]
push eax
push str.Process_performance_object_not_found_on__s_n
call fcn.00401d80
push str.Run_Exctrlst_from_the_Windows_Resource_Kit_to_repair_the_performance_counters._n_n
call fcn.00401d80
add esp, 0xc
jmp 0x4042f7
cmp byte [0x432656], 0
jne 0x404234
cmp byte [0x432654], 0
je 0x404341
cmp byte [0x432661], 0
je 0x404252
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
jmp 0x404254
xor eax, eax
push str.thread
push eax
lea ecx, [ebp - 0x988]
call fcn.00406370
test eax, eax
jne 0x4042b0
cmp byte [0x432661], al
je 0x404297
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
push eax
push str.Failed_to_take_thread_snapshot_on__s_n_n
call fcn.00401d80
add esp, 8
jmp 0x404050
lea eax, [ebp - 0x118]
push eax
push str.Failed_to_take_thread_snapshot_on__s_n_n
call fcn.00401d80
add esp, 8
jmp 0x404050
push str.thread
lea ecx, [ebp - 0xaa0]
call fcn.00402bb0
mov dword [ebp - 0xa18], eax
test eax, eax
jne 0x404341
cmp byte [0x432661], al
je 0x4042e7
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
jmp 0x4042e9
xor eax, eax
push eax
push str.Thread_performance_object_not_found_on__s_n_n
call fcn.00401d80
add esp, 8
cmp dword [ebp - 0x95c], 0
je 0x404050
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
push eax
lea eax, [ebp - 0x320]
push str._sADMIN_
push eax
call fcn.004027f0
add esp, 0xc
lea eax, [ebp - 0x320]
push 1
push 0
push eax
call sub.MPR.dll_WNetCancelConnection2A
jmp 0x404050
cmp byte [0x43265a], 0
mov byte [0x4310c8], 0
je 0x4043be
lea eax, [ebp - 0x914]
push eax
lea eax, [ebp - 0x9f4]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x40
lea eax, [ebp - 0x3a0]
push eax
push 0
lea eax, [ebp - 0x914]
push eax
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatA]
push 0x40
lea eax, [ebp - 0x360]
push eax
push 0
lea eax, [ebp - 0x914]
push eax
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x360]
push eax
push str._s__s
call fcn.00401d80
add esp, 0xc
cmp byte [0x432654], 0
je 0x404409
cmp byte [0x432661], 0
je 0x4043f3
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
push eax
push str.Process_and_thread_information_for__s:_n_n
call fcn.00401d80
jmp 0x4044cf
lea eax, [ebp - 0x118]
push eax
push str.Process_and_thread_information_for__s:_n_n
call fcn.00401d80
jmp 0x4044cf
cmp byte [0x432656], 0
je 0x404454
cmp byte [0x432661], 0
je 0x40443e
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
push eax
push str.Thread_detail_for__s:_n_n
call fcn.00401d80
jmp 0x4044cf
lea eax, [ebp - 0x118]
push eax
push str.Thread_detail_for__s:_n_n
call fcn.00401d80
jmp 0x4044cf
cmp byte [0x432657], 0
je 0x404499
cmp byte [0x432661], 0
je 0x404486
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
push eax
push str.Process_memory_detail_for__s:_n_n
call fcn.00401d80
jmp 0x4044cf
lea eax, [ebp - 0x118]
push eax
push str.Process_memory_detail_for__s:_n_n
call fcn.00401d80
jmp 0x4044cf
cmp byte [0x432661], 0
je 0x4044b7
cmp dword [0x431c04], 0x10
mov eax, 0x431bf0
cmovae eax, dword [0x431bf0]
jmp 0x4044bd
lea eax, [ebp - 0x118]
push eax
push str.Process_information_for__s:_n_n
call fcn.00401d80
mov byte [0x4310c8], 1
mov eax, dword [ebp - 0x950]
add esp, 8
test eax, eax
je 0x4044e5
push eax
call fcn.0040a07b
add esp, 4
mov eax, dword [esi]
mov dword [ebp - 0x950], edi
mov edi, dword [ebp - 0x954]
mov dword [ebp - 0x990], edi
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x954], eax
shl eax, 6
push eax
call fcn.0040a096
add esp, 4
mov dword [ebp - 0x91c], eax
mov ecx, esi
mov dword [ebp - 0x918], 0
mov dword [ebp - 0x98c], 0
call fcn.004061d0
mov edi, eax
mov dword [ebp - 0x920], edi
test edi, edi
je 0x404926
xorps xmm0, xmm0
mov ecx, edi
push str.ID_Process
movlpd qword [ebp - 0x934], xmm0
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x404581
push 0
lea eax, [ebp - 0x934]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x404581
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x404590
push str.ID_Process
push str.Couldnt_get__s_n
call fcn.00401d80
add esp, 8
cmp byte [0x43265a], 0
je 0x4047d2
xorps xmm0, xmm0
mov ecx, edi
push str.__Processor_Time
movlpd qword [ebp - 0x9ec], xmm0
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x4045e2
push 0
lea eax, [ebp - 0x9ec]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x4045e2
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x4045f1
push str.__Processor_Time
push str.Couldnt_get__s_n
call fcn.00401d80
add esp, 8
xorps xmm0, xmm0
mov ecx, edi
movlpd qword [ebp - 0x964], xmm0
push str.Page_File_Bytes
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x404636
push 0
lea eax, [ebp - 0x964]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x404636
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x404645
push str.Page_File_Bytes
push str.Couldnt_get__s_n
call fcn.00401d80
add esp, 8
cmp byte [0x43265a], 0
je 0x404790
cmp byte [ebp - 0x921], 0
je 0x404790
mov esi, dword [ebp - 0x918]
xor edi, edi
mov edx, dword [ebp - 0x91c]
xorps xmm0, xmm0
shl esi, 6
mov dword [ebp - 0x948], esi
movsd qword [esi + edx + 8], xmm0
cmp dword [ebp - 0x990], edi
jbe 0x4046bb
mov eax, dword [ebp - 0x950]
mov ecx, dword [ebp - 0x930]
add eax, 0x30
mov edx, dword [ebp - 0x934]
nop
cmp edx, dword [eax]
jne 0x4046a9
cmp ecx, dword [eax + 4]
je 0x4046c6
inc edi
add eax, 0x40
cmp edi, dword [ebp - 0x990]
jb 0x4046a0
mov edx, dword [ebp - 0x91c]
mov edi, dword [ebp - 0x920]
jmp 0x4047a8
mov eax, dword [ebp - 0x950]
mov ecx, dword [ebp - 0x9ec]
mov edx, dword [ebp - 0x9e8]
mov esi, dword [ebp - 0x9f0]
shl edi, 6
sub ecx, dword [edi + eax + 0x10]
sbb edx, dword [edi + eax + 0x14]
mov edi, dword [ebp - 0x9f4]
sub edi, dword [ebp - 0x9e0]
sbb esi, dword [ebp - 0x9e4]
call fcn.00407080
mulsd xmm0, qword [0x4287c0]
mov edx, esi
mov ecx, edi
movsd qword [ebp - 0x93c], xmm0
call fcn.00407080
movsd xmm1, qword [ebp - 0x93c]
divsd xmm1, xmm0
mov eax, dword [ebp - 0x94c]
mov esi, dword [ebp - 0x948]
mov edx, dword [ebp - 0x91c]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4287d0]
divsd xmm1, xmm0
movsd xmm0, qword [0x4287c0]
comisd xmm1, xmm0
movsd qword [esi + edx + 8], xmm1
jbe 0x40476c
movsd qword [esi + edx + 8], xmm0
movaps xmm1, xmm0
mov eax, dword [ebp - 0x934]
or eax, dword [ebp - 0x930]
je 0x4046bb
mov edi, dword [ebp - 0x920]
cvttsd2si eax, xmm1
add dword [ebp - 0x98c], eax
jmp 0x4047a8
mov esi, dword [ebp - 0x918]
xorps xmm0, xmm0
mov edx, dword [ebp - 0x91c]
shl esi, 6
movsd qword [esi + edx + 8], xmm0
mov eax, dword [ebp - 0x964]
mov ecx, dword [ebp - 0x960]
mov dword [esi + edx + 0x18], eax
mov dword [esi + edx + 0x1c], ecx
mov eax, dword [ebp - 0x9ec]
mov ecx, dword [ebp - 0x9e8]
mov dword [esi + edx + 0x10], eax
mov dword [esi + edx + 0x14], ecx
jmp 0x4047e1
mov esi, dword [ebp - 0x918]
mov edx, dword [ebp - 0x91c]
shl esi, 6
cmp byte [0x43265b], 0
je 0x4048e9
lea eax, [esi + edx]
mov ecx, edi
mov dword [eax + 0x28], 0
push str.Creating_Process_ID
mov dword [eax + 0x2c], 0
call fcn.00402a80
mov edi, eax
test edi, edi
je 0x406153
mov eax, dword [ebp - 0x91c]
mov ecx, edi
add eax, 0x28
push 0
add eax, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x406153
mov ecx, edi
call fcn.00402cb0
push 0x10
push edi
call fcn.00406bfa
mov ecx, dword [ebp - 0x920]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x92c], xmm0
push str.Elapsed_Time
call fcn.00402a80
mov edi, eax
test edi, edi
je 0x40488a
push 0
lea eax, [ebp - 0x92c]
mov ecx, edi
push eax
call fcn.00402cd0
test eax, eax
je 0x40488a
mov ecx, edi
call fcn.00402cb0
push 0x10
push edi
call fcn.00406bfa
jmp 0x404899
push str.Elapsed_Time
push str.Couldnt_get__s_n
call fcn.00401d80
mov edi, dword [ebp - 0x92c]
add esp, 8
mov edx, dword [ebp - 0x928]
mov eax, edi
or eax, edx
je 0x4048ca
mov ecx, dword [ebp - 0x968]
cmp edx, ecx
jg 0x4048ca
mov eax, dword [ebp - 0x96c]
jl 0x4048c4
cmp edi, eax
ja 0x4048ca
sub eax, edi
sbb ecx, edx
jmp 0x4048cf
or eax, 0xffffffff
or ecx, eax
mov edx, dword [ebp - 0x91c]
mov dword [ebp - 0x92c], eax
mov dword [ebp - 0x928], ecx
mov dword [esi + edx + 0x20], eax
mov dword [esi + edx + 0x24], ecx
mov eax, dword [ebp - 0x934]
mov ecx, dword [ebp - 0x930]
inc dword [ebp - 0x918]
mov dword [esi + edx + 0x30], eax
mov eax, dword [ebp - 0x920]
mov dword [esi + edx + 0x34], ecx
mov dword [esi + edx], eax
mov esi, dword [ebp - 0x970]
mov ecx, esi
call fcn.00406270
mov edi, eax
mov dword [ebp - 0x920], eax
jmp 0x404537
cmp byte [0x43265a], 0
mov al, byte [0x43265b]
jne 0x40493c
test al, al
je 0x404a6c
mov edi, dword [ebp - 0x954]
dec edi
mov dword [ebp - 0x920], edi
test al, al
je 0x404a45
test edi, edi
je 0x404a29
mov eax, dword [ebp - 0x91c]
mov dword [ebp - 0x918], edi
lea ecx, [eax + 0x20]
mov dword [ebp - 0x948], ecx
lea edx, [eax + 0x30]
mov dword [edx + 8], 0
xor esi, esi
nop word [eax + eax]
mov eax, dword [edx]
lea edi, [ecx - 0x20]
or eax, dword [edx + 4]
je 0x4049ab
mov eax, dword [ecx + 0x10]
cmp eax, dword [edx - 8]
jne 0x4049ab
mov eax, dword [ecx + 0x14]
cmp eax, dword [edx - 4]
jne 0x4049ab
mov eax, dword [ecx + 4]
cmp eax, dword [edx - 0xc]
ja 0x4049bb
jb 0x4049ab
mov eax, dword [ecx]
cmp eax, dword [edx - 0x10]
jae 0x4049bb
mov edi, dword [ebp - 0x920]
inc esi
add ecx, 0x40
cmp esi, edi
jb 0x404980
jmp 0x4049c4
mov dword [edx + 8], edi
mov edi, dword [ebp - 0x920]
mov ecx, 0xffffffd0
mov eax, edx
cmp dword [ecx + eax + 0x38], 0
jne 0x4049e2
mov dword [ecx + eax + 0x28], 0xffffffff
mov dword [ecx + eax + 0x2c], 0xffffffff
mov ecx, dword [ebp - 0x948]
add edx, 0x40
sub dword [ebp - 0x918], 1
jne 0x404971
mov edx, dword [ebp - 0x91c]
mov esi, edi
add edx, 0x38
mov eax, dword [edx]
xor ecx, ecx
test eax, eax
je 0x404a18
nop dword [eax + eax]
mov eax, dword [eax + 0x38]
inc ecx
test eax, eax
jne 0x404a10
mov dword [edx - 0x34], ecx
add edx, 0x40
sub esi, 1
jne 0x404a03
mov esi, dword [ebp - 0x970]
mov eax, dword [ebp - 0x91c]
push 0x403780
push 0x40
push edi
mov dword [0x432664], eax
mov dword [0x432668], edi
push eax
jmp 0x404a64
cmp byte [0x432657], 0
mov eax, 0x402fe0
mov edx, dword [ebp - 0x91c]
mov ecx, 0x4031e0
cmovne eax, ecx
push eax
push 0x40
push edi
push edx
call fcn.00412070
add esp, 0x10
mov eax, dword [ebp - 0x9f4]
xor ecx, ecx
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0x9f0]
mov byte [ebp - 0x921], 1
mov dword [ebp - 0x9e4], eax
mov eax, dword [esi]
mov dword [ebp - 0x948], ecx
mov eax, dword [eax + 0x28]
dec eax
cmp ecx, eax
jae 0x405ec3
mov edi, ecx
mov ecx, dword [ebp - 0x91c]
shl edi, 6
cmp dword [ebp - 0x950], 0
mov esi, dword [edi + ecx]
mov dword [ebp - 0x918], esi
je 0x404aed
mov eax, dword [edi + ecx + 0x30]
or eax, dword [edi + ecx + 0x34]
jne 0x404aed
mov edx, dword [ebp - 0x98c]
cmp edx, 0x64
jge 0x404ae4
mov eax, 0x64
sub eax, edx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
jmp 0x404ae7
xorps xmm0, xmm0
movsd qword [edi + ecx + 8], xmm0
push 0x104
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.00402b50
test eax, eax
je 0x405eb1
lea eax, [ebp - 0x21c]
push str._Total
push eax
call fcn.004102b7
add esp, 8
test eax, eax
je 0x405eb1
movzx eax, byte [ebp - 0x211]
xor ecx, ecx
cmp byte [0x432655], cl
xorps xmm0, xmm0
push str.ID_Process
cmovne eax, ecx
movlpd qword [ebp - 0x934], xmm0
mov ecx, esi
mov byte [ebp - 0x211], al
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x404b7e
push 0
lea eax, [ebp - 0x934]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x404b7e
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x404b8d
push str.ID_Process
push str.Couldnt_get__s_n
call fcn.00401d80
add esp, 8
cmp byte [0x432658], 0
je 0x404c39
cmp byte [0x432659], 0
jne 0x404c27
cmp byte [0x432660], 0
jne 0x404bf4
cmp dword [0x431bec], 0x10
mov eax, 0x431bd8
push dword [0x431be8]
cmovae eax, dword [0x431bd8]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004125d2
add esp, 0xc
test eax, eax
jne 0x405eb1
cmp byte [0x432659], al
jne 0x404c27
cmp byte [0x432660], al
je 0x404c39
cmp dword [0x431bec], 0x10
mov eax, 0x431bd8
cmovae eax, dword [0x431bd8]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.004102b7
add esp, 8
test eax, eax
jne 0x405eb1
cmp byte [0x432659], al
je 0x404c39
mov eax, dword [ebp - 0x934]
cmp eax, dword [0x43265c]
jne 0x405eb1
cmp dword [ebp - 0x974], 0
je 0x404c65
cmp byte [0x432654], 0
jne 0x404c65
cmp byte [0x432657], 0
je 0x404d73
cmp byte [0x432656], 0
je 0x404d73
cmp byte [0x432657], 0
jne 0x404d29
cmp byte [0x432654], 0
jne 0x404d29
cmp byte [0x432656], 0
jne 0x404d73
cmp byte [0x4310c8], 0
je 0x404d73
cmp byte [0x43265b], 0
mov eax, 0x4283f8
mov ecx, 0x42843c
je 0x404cec
cmp byte [0x43265a], 0
push str.Priv
push 0x4283f4
push 0x4283fc
push 0x428434
push 0x428438
cmove eax, ecx
push eax
push 0x428400
push str.Name
push str.__30s__5s__3s__3s__4s__7s__7s__7s_n
call fcn.00401d80
add esp, 0x24
jmp 0x404d73
cmp byte [0x43265a], 0
push str.Elapsed_Time
push str.CPU_Time
push str.Priv
push 0x428434
push 0x428438
cmove eax, ecx
push eax
push 0x428400
push str.Name
push str.__17s__5s__3s__3s__4s__6s__15s__15s_n
call fcn.00401d80
add esp, 0x24
jmp 0x404d73
cmp byte [0x43265a], 0
mov ecx, 0x4283fc
push str.Page
push str.NonP
push str.Faults
push str.Priv_Pk
push str.Priv
push 0x4283f4
mov eax, 0x4283f8
cmove eax, ecx
push eax
push 0x428400
push str.Name
push str.__17s__5s__7s__7s__7s__7s__8s__6s__4s_n
call fcn.00401d80
add esp, 0x28
cmp byte [0x432656], 0
mov dword [ebp - 0x974], 1
je 0x404d9c
cmp byte [0x432657], 0
jne 0x404d9c
cmp byte [0x432654], 0
je 0x405286
mov ecx, dword [ebp - 0x918]
xorps xmm0, xmm0
push str.Working_Set
movlpd qword [ebp - 0x9cc], xmm0
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x404de2
push 0
lea eax, [ebp - 0x9cc]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x404de2
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x404df1
push str.Working_Set
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x9d4], xmm0
push str.__User_Time
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x404e3a
push 0
lea eax, [ebp - 0x9d4]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x404e3a
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x404e49
push str.__User_Time
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x9dc], xmm0
push str.__Privileged_Time
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x404e92
push 0
lea eax, [ebp - 0x9dc]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x404e92
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x404ea1
push str.__Privileged_Time
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x92c], xmm0
push str.Elapsed_Time
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x404eea
push 0
lea eax, [ebp - 0x92c]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x404eea
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x404ef9
push str.Elapsed_Time
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0xa38], xmm0
push str.Handle_Count
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x404f42
push 0
lea eax, [ebp - 0xa38]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x404f42
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x404f51
push str.Handle_Count
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0xa30], xmm0
push str.Priority_Base
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x404f9a
push 0
lea eax, [ebp - 0xa30]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x404f9a
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x404fa9
push str.Priority_Base
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x964], xmm0
push str.Page_File_Bytes
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x404ff2
push 0
lea eax, [ebp - 0x964]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x404ff2
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x405001
push str.Page_File_Bytes
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0xa0c], xmm0
push str.Page_File_Bytes_Peak
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x40504a
push 0
lea eax, [ebp - 0xa0c]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x40504a
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x405059
push str.Page_File_Bytes_Peak
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0xa80], xmm0
push str.Working_Set_Peak
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x4050a2
push 0
lea eax, [ebp - 0xa80]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x4050a2
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x4050b1
push str.Working_Set_Peak
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x9b8], xmm0
push str.Virtual_Bytes
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x4050fa
push 0
lea eax, [ebp - 0x9b8]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x4050fa
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x405109
push str.Virtual_Bytes
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0xa40], xmm0
push str.Thread_Count
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x405152
push 0
lea eax, [ebp - 0xa40]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x405152
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x405161
push str.Thread_Count
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0xa04], xmm0
push str.Pool_Nonpaged_Bytes
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x4051aa
push 0
lea eax, [ebp - 0xa04]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x4051aa
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x4051b9
push str.Pool_Nonpaged_Bytes
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0x9fc], xmm0
push str.Pool_Paged_Bytes
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x405202
push 0
lea eax, [ebp - 0x9fc]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x405202
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x405211
push str.Pool_Paged_Bytes
push str.Couldnt_get__s_n
call fcn.00401d80
mov ecx, dword [ebp - 0x918]
add esp, 8
xorps xmm0, xmm0
movlpd qword [ebp - 0xa14], xmm0
push str.Page_Faults_sec
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x40525a
push 0
lea eax, [ebp - 0xa14]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x40525a
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x405269
push str.Page_Faults_sec
push str.Couldnt_get__s_n
call fcn.00401d80
add esp, 8
cmp byte [0x432657], 0
jne 0x405735
cmp byte [0x432654], 0
jne 0x405735
cmp byte [0x432656], 0
jne 0x4058ee
mov esi, dword [ebp - 0x92c]
mov eax, esi
mov edx, dword [ebp - 0x928]
or eax, edx
je 0x4052c1
mov ecx, dword [ebp - 0x968]
cmp edx, ecx
jg 0x4052c1
mov eax, dword [ebp - 0x96c]
jl 0x4052bb
cmp esi, eax
ja 0x4052c1
sub eax, esi
sbb ecx, edx
jmp 0x4052d8
xorps xmm0, xmm0
movlpd qword [ebp - 0x93c], xmm0
mov ecx, dword [ebp - 0x938]
mov eax, dword [ebp - 0x93c]
mov dword [ebp - 0x92c], eax
lea eax, [ebp - 0x5a8]
push eax
lea eax, [ebp - 0x92c]
mov dword [ebp - 0x928], ecx
push eax
call fcn.00403700
mov ecx, dword [ebp - 0x9dc]
add ecx, dword [ebp - 0x9d4]
mov eax, dword [ebp - 0x9d8]
adc eax, dword [ebp - 0x9d0]
mov dword [ebp - 0xa70], eax
lea eax, [ebp - 0x8b4]
push eax
lea eax, [ebp - 0xa74]
mov dword [ebp - 0xa74], ecx
push eax
call fcn.00403700
add esp, 0x10
cmp byte [0x43265b], 0
je 0x4055be
mov esi, dword [ebp - 0x91c]
lea eax, [ebp - 0x8fc]
push dword [edi + esi + 4]
push eax
call fcn.00403050
add esp, 8
mov eax, dword [ebp - 0x964]
mov ecx, dword [ebp - 0x9b8]
shr eax, 0xa
mov dword [ebp - 0x9a8], eax
mov eax, dword [ebp - 0x9cc]
shr eax, 0xa
mov dword [ebp - 0x9a4], eax
mov eax, dword [ebp - 0x9b4]
shrd ecx, eax, 0xa
mov byte [ebp - 4], 4
shr eax, 0xa
cmp byte [0x43265a], 0
mov dword [ebp - 0x9a0], eax
mov eax, dword [ebp - 0xa40]
mov dword [ebp - 0x99c], ecx
mov dword [ebp - 0x998], eax
je 0x4053b5
movsd xmm0, qword [edi + esi + 8]
jmp 0x4053cf
mov eax, dword [ebp - 0xa30]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4287d0]
mov ecx, dword [ebp - 0x8ec]
lea esi, [ebp - 0x21c]
movsd qword [ebp - 0x93c], xmm0
lea edx, [esi + 1]
mov dword [ebp - 0x980], ecx
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4053f0
mov eax, 0x7fffffff
sub esi, edx
sub eax, ecx
cmp eax, esi
jb 0x406195
cmp dword [ebp - 0x8e8], 0x10
lea eax, [ebp - 0x8fc]
mov edi, 0xf
mov dword [ebp - 0x8bc], 0
cmovae eax, dword [ebp - 0x8fc]
xorps xmm0, xmm0
add ecx, esi
mov dword [ebp - 0x9ac], eax
mov dword [ebp - 0x8b8], 0
lea eax, [ebp - 0x8cc]
mov dword [ebp - 0x940], ecx
mov dword [ebp - 0x920], eax
movups xmmword [ebp - 0x8cc], xmm0
cmp ecx, edi
jbe 0x40549d
mov edi, ecx
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x405471
mov edi, 0x7fffffff
jmp 0x40547c
cmp edi, 0x16
mov eax, 0x16
cmovb edi, eax
lea eax, [edi + 1]
push eax
lea ecx, [ebp - 0x8cc]
call fcn.00403ab0
mov ecx, dword [ebp - 0x940]
mov dword [ebp - 0x920], eax
mov dword [ebp - 0x8cc], eax
push dword [ebp - 0x980]
mov dword [ebp - 0x8bc], ecx
push dword [ebp - 0x9ac]
mov dword [ebp - 0x8b8], edi
push eax
call fcn.00407d40
mov eax, dword [ebp - 0x980]
lea ecx, [ebp - 0x21c]
mov edi, dword [ebp - 0x920]
add eax, edi
push esi
push ecx
push eax
call fcn.00407d40
push dword [ebp - 0x9a8]
mov eax, dword [ebp - 0x940]
lea ecx, [ebp - 0x8cc]
push dword [ebp - 0x9a4]
or dword [ebp - 0xa1c], 1
push dword [ebp - 0x9a0]
mov byte [edi + eax], 0
push dword [ebp - 0x99c]
cvttsd2si eax, qword [ebp - 0x93c]
cmp dword [ebp - 0x8b8], 0x10
cmovae ecx, dword [ebp - 0x8cc]
push dword [ebp - 0xa38]
push dword [ebp - 0x998]
push eax
push dword [ebp - 0x934]
push ecx
push str.__30s__5d__3d__3d__4d__7llu__7d__7d_n
call fcn.00401d80
mov ecx, dword [ebp - 0x8b8]
add esp, 0x40
cmp ecx, 0x10
jb 0x405577
mov edx, dword [ebp - 0x8cc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40556d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40619a
push ecx
push edx
call fcn.00406bfa
add esp, 8
mov ecx, dword [ebp - 0x8e8]
mov byte [ebp - 4], 3
cmp ecx, 0x10
jb 0x405632
mov edx, dword [ebp - 0x8fc]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x4055af
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40619f
push ecx
push edx
call fcn.00406bfa
add esp, 8
jmp 0x405632
mov ecx, dword [ebp - 0x964]
shr ecx, 0xa
cmp byte [0x43265a], 0
je 0x4055de
mov edx, dword [ebp - 0x91c]
movsd xmm0, qword [edi + edx + 8]
jmp 0x4055f8
mov eax, dword [ebp - 0xa30]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x4287d0]
lea eax, [ebp - 0x5a8]
push eax
lea eax, [ebp - 0x8b4]
push eax
push ecx
push dword [ebp - 0xa38]
cvttsd2si eax, xmm0
push dword [ebp - 0xa40]
push eax
push dword [ebp - 0x934]
lea eax, [ebp - 0x21c]
push eax
push str.__17s__5d__3d__3d__4d__6d__15s__15s_n
call fcn.00401d80
add esp, 0x24
cmp byte [0x432654], 0
je 0x4058d8
push str.Page
push str.NonP
push str.Faults
push str.Priv_Pk
push str.Priv
push 0x4283f4
push 0x4283fc
push 0x42785d
push 0x42785d
push str.__11s__4s__7s__7s__7s__7s__8s__4s__4s_n
call fcn.00401d80
add esp, 0x28
push 0
push 0x400
push dword [ebp - 0x9f8]
push dword [ebp - 0x9fc]
call fcn.00406e60
push edx
push eax
push 0
push 0x400
push dword [ebp - 0xa00]
push dword [ebp - 0xa04]
call fcn.00406e60
push edx
push eax
push dword [ebp - 0xa10]
push dword [ebp - 0xa14]
push 0
push 0x400
push dword [ebp - 0xa08]
push dword [ebp - 0xa0c]
call fcn.00406e60
push edx
push eax
push 0
push 0x400
push dword [ebp - 0x960]
push dword [ebp - 0x964]
call fcn.00406e60
push edx
push eax
push 0
push 0x400
push dword [ebp - 0x9c8]
push dword [ebp - 0x9cc]
call fcn.00406e60
push edx
push eax
push 0
push 0x400
push dword [ebp - 0x9b4]
push dword [ebp - 0x9b8]
call fcn.00406e60
push edx
push eax
push 0x42785d
push 0x42785d
push str.__11s__4s__7llu__7I64d__7I64d__7I64d__8I64d__4I64d__4I64d_n
jmp 0x4058d0
push 0
push 0x400
push dword [ebp - 0x9f8]
push dword [ebp - 0x9fc]
call fcn.00406e60
push 0
push 0x400
push dword [ebp - 0xa00]
mov dword [ebp - 0x99c], eax
push dword [ebp - 0xa04]
mov dword [ebp - 0x998], edx
call fcn.00406e60
push 0
push 0x400
push dword [ebp - 0xa08]
mov dword [ebp - 0x9a4], eax
push dword [ebp - 0xa0c]
mov dword [ebp - 0x9a0], edx
call fcn.00406e60
push 0
push 0x400
push dword [ebp - 0x960]
mov dword [ebp - 0x9ac], eax
push dword [ebp - 0x964]
mov dword [ebp - 0x9a8], edx
call fcn.00406e60
push 0
push 0x400
push dword [ebp - 0x9c8]
mov dword [ebp - 0x980], eax
push dword [ebp - 0x9cc]
mov dword [ebp - 0x940], edx
call fcn.00406e60
cmp byte [0x43265a], 0
mov dword [ebp - 0xa28], eax
mov dword [ebp - 0x920], edx
je 0x405800
mov edx, dword [ebp - 0x91c]
movsd xmm1, qword [edi + edx + 8]
jmp 0x405822
push 0
push 0x400
push dword [ebp - 0x9b4]
push dword [ebp - 0x9b8]
call fcn.00406e60
mov ecx, eax
call fcn.00407080
movaps xmm1, xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x93c], xmm0
movsd xmm0, qword [0x4287c8]
comisd xmm1, xmm0
jb 0x40585c
subsd xmm1, xmm0
comisd xmm0, xmm1
jbe 0x40585c
mov esi, dword [ebp - 0x93c]
mov edi, dword [ebp - 0x938]
add esi, 0
adc edi, 0x80000000
jmp 0x405868
mov edi, dword [ebp - 0x938]
mov esi, dword [ebp - 0x93c]
movaps xmm0, xmm1
call fcn.00406fd0
push dword [ebp - 0x998]
add eax, esi
push dword [ebp - 0x99c]
adc edx, edi
push dword [ebp - 0x9a0]
push dword [ebp - 0x9a4]
push dword [ebp - 0xa10]
push dword [ebp - 0xa14]
push dword [ebp - 0x9a8]
push dword [ebp - 0x9ac]
push dword [ebp - 0x940]
push dword [ebp - 0x980]
push dword [ebp - 0x920]
push dword [ebp - 0xa28]
push edx
push eax
push dword [ebp - 0x934]
lea eax, [ebp - 0x21c]
push eax
push str.__17s__5d__7llu__7I64d__7I64d__7I64d__8I64d__6I64d__4I64d_n
call fcn.00401d80
add esp, 0x44
cmp byte [0x432656], 0
jne 0x4058ee
cmp byte [0x432654], 0
je 0x405e9c
mov ecx, dword [ebp - 0xa18]
mov byte [ebp - 0x922], 1
call fcn.004061d0
mov edi, eax
mov dword [ebp - 0x940], edi
test edi, edi
je 0x405e86
xorps xmm0, xmm0
mov ecx, edi
push str.ID_Process
movlpd qword [ebp - 0xa54], xmm0
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x405952
push 0
lea eax, [ebp - 0xa54]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x405952
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x405961
push str.ID_Process
push str.Couldnt_get__s_n
call fcn.00401d80
mov eax, dword [ebp - 0xa54]
add esp, 8
cmp eax, dword [ebp - 0x934]
jne 0x405e63
push 0x104
lea eax, [ebp - 0x320]
mov ecx, edi
push eax
call fcn.00402b50
test eax, eax
je 0x405e63
lea eax, [ebp - 0x320]
push str._Total
push eax
call fcn.004102b7
add esp, 8
test eax, eax
je 0x405e63
xorps xmm0, xmm0
mov ecx, edi
push str.__User_Time
movlpd qword [ebp - 0x9d4], xmm0
call fcn.00402a80
mov esi, eax
test esi, esi
je 0x4059ef
push 0
lea eax, [ebp - 0x9d4]
mov ecx, esi
push eax
call fcn.00402cd0
test eax, eax
je 0x4059ef
mov ecx, esi
call fcn.00402cb0
push 0x10
push esi
call fcn.00406bfa
jmp 0x4059fe
push str.__User_Time
push str.Couldnt_get__s_n
invalid
invalid