Function at 0x40cbf0
Capabilities:
Authenticate hmac
Check for time delay via gettickcount
Check mutex and terminate process on windows
Check mutex on windows
Check os version
Create a process with modified i/o handles and window
Create process on windows
Create process suspended
Create thread
Encode data using base64
Get file attributes
Get hostname
Get session user name
Persist via windows service
Resolve function by parsing pe exports
Set registry value
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x4a1d60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
mov eax, 0xa8f4
call fcn.004929f0
push ebx
push esi
push edi
lea eax, [esp + 0x3f8]
push eax
mov byte [esp + 0x55], 1
call fcn.0040c070
xor ebx, ebx
mov dword [esp + 0xa93c], ebx
mov edx, dword [0x4c41fc]
mov eax, dword [edx + 0xc]
mov ecx, 0x4c41fc
call eax
add eax, 0x10
mov dword [esp + 0x60], eax
mov byte [esp + 0xa93c], 1
mov edx, dword [0x4c41fc]
mov eax, dword [edx + 0xc]
mov ecx, 0x4c41fc
call eax
add eax, 0x10
mov dword [esp + 0xac], eax
lea ecx, [esp + 0x1e8]
push ecx
mov byte [esp + 0xa940], 2
call fcn.0045f0b0
lea edi, [esp + 0x4c8]
mov byte [esp + 0xa93c], 3
call fcn.00459f40
push str.CioloLicensing_constructor
mov dword [esp + 0x178], ebx
call fcn.004261a0
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 4
push str.Global8B4FD00F_7024_4E00_AE31_221432C02D75
push ebx
push 1
push ebx
mov word [esp + 0x228], bx
call esi
push str.Global4E1A77C6_10EA_4E4B_8B3B_A3FA51BDD75B
push ebx
push 1
push ebx
mov dword [esp + 0x230], eax
call esi
push str.CioloLicensing_constructor_end
mov dword [esp + 0x220], eax
call fcn.004261a0
add esp, 4
mov byte [esp + 0xa93c], 5
mov edx, dword [0x4c41fc]
mov eax, dword [edx + 0xc]
or esi, 0xffffffff
mov ecx, 0x4c41fc
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0x108], esi
mov dword [esp + 0xcc], esi
mov dword [esp + 0xb0], esi
mov dword [esp + 0x120], ebx
mov byte [esp + 0x53], bl
mov byte [esp + 0x45], bl
call eax
add eax, 0x10
mov dword [esp + 0x4c], eax
mov eax, 0x32
lea ebx, [esp + 0x460]
mov dword [esp + 0xe4], eax
mov dword [esp + 0xec], eax
call fcn.00426c10
lea edi, [esp + 0x49c]
mov byte [esp + 0xa93c], 7
call fcn.00459f40
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x47c], eax
mov dword [esp + 0x480], eax
mov dword [esp + 0x484], eax
mov dword [esp + 0x488], eax
mov dword [esp + 0x48c], eax
mov dword [esp + 0x490], eax
mov dword [esp + 0x494], eax
mov dword [esp + 0x498], eax
mov byte [esp + 0xa93c], 8
movzx eax, byte [0x4c86d0]
mov ecx, dword [0x4c7dd0]
mov edx, dword [0x4c41fc]
neg eax
sbb eax, eax
and eax, dword [0x4c86e0]
mov dword [esp + 0xb4], ecx
mov dword [esp + 0x114], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x4c41fc
mov dword [esp + 0xd0], ebx
mov dword [esp + 0x11c], ebx
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov byte [esp + 0xa93c], 9
mov edx, dword [0x4c41fc]
mov eax, dword [edx + 0xc]
mov ecx, 0x4c41fc
call eax
add eax, 0x10
mov dword [esp + 0x48], eax
mov byte [esp + 0xa93c], 0xa
mov edx, dword [0x4c41fc]
mov eax, dword [edx + 0xc]
mov ecx, 0x4c41fc
call eax
add eax, 0x10
mov dword [esp + 0xf4], eax
lea ecx, [esp + 0x4a70]
push ecx
mov dword [esp + 0x4a74], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x4a74], 5
jae 0x40d023
mov byte [esp + 0xa93c], 0xa
mov eax, dword [esp + 0xf4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
mov ecx, esi
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ce92
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xa93c], 9
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
mov edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ceb9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xa93c], 8
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], esi
dec esi
test esi, esi
jg 0x40cede
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [esp + 0x460]
call fcn.0045db30
mov byte [esp + 0xa93c], 5
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cf12
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x218]
call fcn.0045bec0
lea eax, [esp + 0x4c8]
call fcn.00459fd0
mov eax, dword [esp + 0x1ec]
cmp eax, ebx
je 0x40cf3c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x1e8]
cmp eax, ebx
je 0x40cf4e
push eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea ebx, [esp + 0x1e8]
call fcn.0045ef80
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x1a4], ecx
mov byte [esp + 0xa93c], 0xc
mov eax, dword [esp + 0x1f4]
mov ecx, dword [eax]
push eax
push ecx
lea esi, [esp + 0x1a4]
lea eax, [esp + 0x1f8]
call fcn.0045fd10
mov edx, dword [esp + 0x1f4]
push edx
call fcn.00472958
mov byte [esp + 0xa940], 1
mov eax, dword [esp + 0xb0]
add eax, 0xfffffff0
add esp, 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cfc9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xa93c], 0
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cff1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x3f8]
push ecx
mov dword [esp + 0xa940], 0xffffffff
call fcn.0040c200
mov eax, 1
mov ecx, dword [esp + 0xa934]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call edi
mov dword [0x4c6008], eax
lea eax, [esp + 0x2b0]
push eax
lea ecx, [esp + 0x9904]
xor edx, edx
push ecx
mov word [esp + 0x9908], dx
mov dword [esp + 0x2b8], 0x800
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x44
lea edx, [esp + 0x694]
push ebx
push edx
call fcn.00479dd0
add esp, 0xc
mov dword [esp + 0x690], 0x44
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x1c0], ebx
lea eax, [esp + 0x50b0]
push eax
mov byte [esp + 0xa940], 0xd
call fcn.00436470
lea ecx, [esp + 0xa08]
push ecx
mov byte [esp + 0xa940], 0xe
call fcn.0043ee80
mov byte [esp + 0xa93c], 0xf
xor eax, eax
lea edx, [esp + 0xa08]
mov dword [0x4c7d58], edx
mov dword [esp + 0x248], eax
mov dword [esp + 0x24c], eax
mov dword [esp + 0x250], eax
mov dword [esp + 0x254], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov byte [esp + 0x52], bl
call edi
call fcn.00402930
call fcn.00402620
push 1
lea eax, [esp + 0x39c]
push eax
call fcn.0045c210
push ebx
lea ecx, [esp + 0x37c]
push ecx
mov byte [esp + 0xa944], 0x10
call fcn.0045c210
lea ecx, [esp + 0x398]
mov byte [esp + 0xa93c], 0x11
call fcn.0045c4b0
test al, al
jne 0x40d161
push str.WARNING:_could_not_load__hash_cache_from_disk
call fcn.004261a0
add esp, 4
lea ecx, [esp + 0x378]
call fcn.0045c4b0
test al, al
jne 0x40d17e
push str.WARNING:_could_not_load___hash_cache_from_disk
call fcn.004261a0
add esp, 4
push 0x2b
push str.The_quick_brown_fox_jumps_over_the_lazy_dog
lea ecx, [esp + 0x55c]
mov dword [esp + 0x558], 0x4afff4
mov dword [esp + 0x570], 0xf
mov dword [esp + 0x56c], ebx
mov byte [esp + 0x55c], bl
call fcn.00403b70
mov byte [esp + 0xa93c], 0x12
push 1
mov dword [esp + 0x554], 0x4b001c
call fcn.00473e79
add esp, 4
cmp eax, ebx
je 0x40d1e1
mov byte [eax], bl
mov dword [esp + 0x570], eax
jmp 0x40d1e8
mov dword [esp + 0x570], ebx
push str.Loading_dats...
mov byte [esp + 0xa940], 0x13
call fcn.004261a0
add esp, 4
push 0x40e
lea eax, [esp + 0x4b8e]
xor edx, edx
push ebx
push eax
mov word [esp + 0x4b94], dx
call fcn.00479dd0
add esp, 0xc
push 0x207
lea ecx, [esp + 0x4b8c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40d27c
lea eax, [esp + 0x4b88]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x40d246
sub eax, edx
sar eax, 1
dec eax
cmp eax, ebx
jle 0x40d27c
lea ebx, [ebx]
cmp word [esp + eax*2 + 0x4b88], 0x5c
je 0x40d272
dec eax
cmp eax, ebx
jg 0x40d260
jmp 0x40d27c
xor edx, edx
mov word [esp + eax*2 + 0x4b88], dx
mov eax, dword [0x4c41fc]
mov edx, dword [eax + 0xc]
mov ecx, 0x4c41fc
call edx
add eax, 0x10
mov dword [esp + 0x5c], eax
push str.iolopge.dll
lea eax, [esp + 0x4b8c]
push eax
push 0x4aade0
lea edi, [esp + 0x68]
mov byte [esp + 0xa948], 0x14
call fcn.004020e0
mov ecx, dword [esp + 0x68]
add esp, 0xc
push ecx
mov byte [esp + 0x36], bl
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
jne 0x40d2df
mov edx, dword [esp + 0x5c]
push edx
push str.ERROR:_DLL__s_Doesnt_exist
call fcn.004261a0
add esp, 8
jmp 0x40d341
mov esi, dword [esp + 0x5c]
push esi
push str.ERROR:_DLL__s_does_exist__trying
call fcn.004261a0
add esp, 8
push str.GVRMGR1
push esi
push 0x4c8710
call fcn.00404760
test eax, eax
jns 0x40d30a
mov byte [esp + 0x32], 1
push str.GVRMGR2
push esi
push 0x4cb990
call fcn.00404760
test eax, eax
jns 0x40d323
mov byte [esp + 0x32], 1
push str.GVRMGR3
push esi
push 0x4cb8a8
call fcn.00404760
test eax, eax
js 0x40d341
cmp byte [esp + 0x32], bl
je 0x40d3ca
push str.Loading_DAT_files__DLL_load_failed_
call fcn.004261a0
add esp, 4
push str.GvrMgr1.dat
lea eax, [esp + 0x4b8c]
push eax
push 0x4aade0
lea edi, [esp + 0x68]
call fcn.004020e0
mov eax, dword [esp + 0x68]
add esp, 0xc
push 0x4c8710
call fcn.004044f0
push str.GvrMgr2.dat
lea ecx, [esp + 0x4b8c]
push ecx
push 0x4aade0
call fcn.004020e0
mov eax, dword [esp + 0x68]
add esp, 0xc
push 0x4cb990
call fcn.004044f0
push str.GvrMgr3.dat
lea edx, [esp + 0x4b8c]
push edx
push 0x4aade0
call fcn.004020e0
mov eax, dword [esp + 0x68]
add esp, 0xc
push 0x4cb8a8
call fcn.004044f0
lea eax, [esp + 0x3f8]
push eax
call fcn.00438900
lea edi, [esp + 0x3f8]
call fcn.00438dd0
cmp al, 1
jne 0x40d3ee
push str.Successfully_loaded_profiles
jmp 0x40d3f3
push str.ERROR_loading_profiles
call fcn.004261a0
add esp, 4
lea ecx, [esp + 0x4f98]
push ecx
mov dword [esp + 0x4f9c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1ac], ebx
mov dword [esp + 0x1b0], ebx
push ebx
push ebx
push ebx
push ebx
mov byte [esp + 0xa94c], 0x15
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0xec
mov dword [0x4c7d74], eax
call fcn.00473e79
add esp, 4
mov dword [esp + 0x19c], eax
mov byte [esp + 0xa93c], 0x16
cmp eax, ebx
je 0x40d470
mov edi, eax
call fcn.0040b810
mov dword [esp + 0x118], eax
jmp 0x40d477
mov dword [esp + 0x118], ebx
push 0xd0
mov byte [esp + 0xa940], 0x15
call fcn.00473e79
add esp, 4
mov dword [esp + 0x19c], eax
mov byte [esp + 0xa93c], 0x17
cmp eax, ebx
je 0x40d4ae
push eax
call fcn.004256c0
mov dword [esp + 0x14c], eax
jmp 0x40d4b5
mov dword [esp + 0x14c], ebx
mov edx, dword [esp + 0x14c]
mov byte [esp + 0xa93c], 0x15
mov eax, dword [edx + 0xb4]
mov edi, dword [sym.imp.ole32.dll_CoInitializeEx]
push ebx
push ebx
mov dword [esp + 0x2ac], eax
call edi
mov esi, dword [0x4c7dd0]
lea ecx, [esp + 0x2b8]
push ecx
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServicesProcessGovernor
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d519
push esi
lea ecx, [esp + 0x2bc]
call fcn.00464360
cmp al, bl
mov eax, str.Globalplre99A12
jne 0x40d51e
mov eax, str.Localplre99A12
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4c7d78], eax
cmp eax, ebx
jne 0x40d53e
push str.ERROR_Opening_creating_process_restraint_event.
call fcn.004261a0
add esp, 4
push 0x4c74c8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4cb834]
cmp dword [eax - 0xc], ebx
jne 0x40d58f
push 0x104
lea edx, [esp + 0x3f7c]
push edx
call fcn.0044c6d0
test al, al
je 0x40d5ca
lea eax, [esp + 0x3f78]
push eax
push str.Found_global_configuration_file_override__s
call fcn.004261a0
add esp, 8
lea ecx, [esp + 0xa08]
push ecx
lea edx, [esp + 0x3f7c]
jmp 0x40d5c5
push eax
push str.pg:_Setting_config_file_to:__s
call fcn.004261a0
mov edx, dword [0x4cb834]
add esp, 8
cmp dword [edx - 4], 1
jle 0x40d5bd
mov edx, dword [edx - 0xc]
push edx
push 0x4cb834
call fcn.00401ff0
mov edx, dword [0x4cb834]
lea eax, [esp + 0xa08]
push eax
call fcn.0044a150
mov eax, dword [0x4cb830]
xor ecx, ecx
mov word [esp + 0x3f78], cx
cmp dword [eax - 0xc], ebx
jne 0x40d61b
lea esi, [esp + 0x3f78]
call fcn.0044ca80
test al, al
je 0x40d650
mov edx, esi
push edx
push str.Found_global_log_override__s
call fcn.004261a0
add esp, 8
mov eax, esi
push eax
lea ecx, [esp + 0xa0c]
push ecx
call fcn.00449570
mov edx, esi
push edx
lea eax, [esp + 0x5114]
push eax
jmp 0x40d64b
push eax
push str.Log_folder_command_line_parameter_given__s
call fcn.004261a0
mov ecx, dword [0x4cb830]
add esp, 8
push ecx
lea edx, [esp + 0xa0c]
push edx
call fcn.00449570
mov eax, dword [0x4cb830]
push eax
lea ecx, [esp + 0x5114]
push ecx
call fcn.00449570
push 0x4c74c8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push ebx
call edi
mov esi, dword [0x4c7dd0]
lea edx, [esp + 0x284]
push edx
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetServicesProcessGovernor
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d853
push esi
lea ecx, [esp + 0x288]
call fcn.00464360
cmp al, bl
je 0x40d853
mov esi, dword [sym.imp.KERNEL32.dll_CreateMutexW]
push str.GlobalioloGovernorMuteEx
push 1
push ebx
mov byte [0x4c7d61], 1
call esi
mov dword [esp + 0x124], eax
cmp eax, ebx
jne 0x40d6d3
push str.LocalioloGovernorMuteEx
push 1
push ebx
call esi
mov dword [esp + 0x124], eax
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.GlobalioloGovernorExitEvent
push ebx
push 1
push ebx
call esi
mov dword [esp + 0x110], eax
cmp eax, ebx
jne 0x40dbba
push str.LocalioloGovernorExitEvent
push ebx
push 1
push ebx
call esi
mov dword [esp + 0x110], eax
cmp eax, ebx
jne 0x40dbba
lea esi, [esp + 0x1a8]
call fcn.004164e0
mov byte [esp + 0xa93c], 0x13
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d741
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x550]
call fcn.00420d90
lea ecx, [esp + 0x378]
push ecx
mov byte [esp + 0xa940], 0x10
call fcn.00413cd0
lea edx, [esp + 0x398]
push edx
mov byte [esp + 0xa940], 0xf
call fcn.00413cd0
lea eax, [esp + 0xa08]
push eax
mov byte [esp + 0xa940], 0xe
call fcn.0043f5d0
lea ecx, [esp + 0x50b0]
push ecx
mov byte [esp + 0xa940], 0xd
call fcn.004365b0
lea esi, [esp + 0x1b8]
call fcn.004163f0
lea eax, [esp + 0xf4]
call fcn.00401ea0
lea eax, [esp + 0x48]
call fcn.00401ea0
lea eax, [esp + 0x28]
call fcn.00401ea0
lea esi, [esp + 0x460]
call fcn.0045db30
lea eax, [esp + 0x4c]
call fcn.00401ea0
lea eax, [esp + 0x218]
call fcn.0045bec0
lea eax, [esp + 0x4c8]
call fcn.00459fd0
lea ecx, [esp + 0x1e8]
mov byte [esp + 0xa93c], 2
call fcn.0045f210
lea eax, [esp + 0xac]
call fcn.00401ea0
lea eax, [esp + 0x60]
call fcn.00401ea0
lea edx, [esp + 0x3f8]
push edx
mov dword [esp + 0xa940], 0xffffffff
call fcn.0040c200
mov eax, 2
mov ecx, dword [esp + 0xa934]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.LocalioloGovernorMuteEx
push 1
push ebx
mov byte [0x4c7d61], bl
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esp + 0x124], eax
cmp eax, ebx
jne 0x40da75
lea esi, [esp + 0x1a8]
call fcn.004164e0
mov byte [esp + 0xa93c], 0x13
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d8aa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x550]
call fcn.00420d90
lea ecx, [esp + 0x378]
push ecx
mov byte [esp + 0xa940], 0x10
call fcn.00413cd0
lea edx, [esp + 0x398]
push edx
mov byte [esp + 0xa940], 0xf
call fcn.00413cd0
lea eax, [esp + 0xa08]
push eax
mov byte [esp + 0xa940], 0xe
call fcn.0043f5d0
lea ecx, [esp + 0x50b0]
push ecx
mov byte [esp + 0xa940], 0xd
call fcn.004365b0
lea esi, [esp + 0x1b8]
call fcn.004163f0
mov byte [esp + 0xa93c], 0xa
mov eax, dword [esp + 0xf4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40d941
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xa93c], 9
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d969
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xa93c], 8
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d991
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [esp + 0x460]
call fcn.0045db30
mov byte [esp + 0xa93c], 5
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d9c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x218]
call fcn.0045bec0
lea eax, [esp + 0x4c8]
call fcn.00459fd0
lea ecx, [esp + 0x1e8]
mov byte [esp + 0xa93c], 2
call fcn.0045f210
mov byte [esp + 0xa93c], 1
mov eax, dword [esp + 0xac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40da1c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xa93c], bl
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40da43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x3f8]
push ecx
mov dword [esp + 0xa940], 0xffffffff
call fcn.0040c200
mov eax, 2
mov ecx, dword [esp + 0xa934]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.LocalioloGovernorExitEvent
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x110], eax
cmp eax, ebx
jne 0x40dbba
lea esi, [esp + 0x1a8]
call fcn.004164e0
lea eax, [esp + 0x5c]
call fcn.00401ea0
lea ecx, [esp + 0x550]
call fcn.00420d90
lea edx, [esp + 0x378]
push edx
mov byte [esp + 0xa940], 0x10
call fcn.00413cd0
lea eax, [esp + 0x398]
push eax
mov byte [esp + 0xa940], 0xf
call fcn.00413cd0
lea ecx, [esp + 0xa08]
push ecx
mov byte [esp + 0xa940], 0xe
call fcn.0043f5d0
lea edx, [esp + 0x50b0]
push edx
mov byte [esp + 0xa940], 0xd
call fcn.004365b0
lea esi, [esp + 0x1b8]
call fcn.004163f0
lea eax, [esp + 0xf4]
call fcn.00401ea0
lea eax, [esp + 0x48]
call fcn.00401ea0
lea eax, [esp + 0x28]
call fcn.00401ea0
lea esi, [esp + 0x460]
call fcn.0045db30
lea eax, [esp + 0x4c]
call fcn.00401ea0
lea eax, [esp + 0x218]
call fcn.0045bec0
lea eax, [esp + 0x4c8]
call fcn.00459fd0
lea ecx, [esp + 0x1e8]
mov byte [esp + 0xa93c], 2
call fcn.0045f210
lea eax, [esp + 0xac]
call fcn.00401ea0
lea eax, [esp + 0x60]
call fcn.00401ea0
lea eax, [esp + 0x3f8]
push eax
mov dword [esp + 0xa940], 0xffffffff
call fcn.0040c200
mov eax, 3
mov ecx, dword [esp + 0xa934]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x110]
mov edx, dword [esp + 0x124]
mov dword [0x4c7d5c], ecx
mov dword [0x4c7d70], edx
call fcn.004524f0
lea ecx, [esp + 0xa08]
call fcn.004441c0
mov cl, byte [esp + 0x3aa4]
mov al, byte [esp + 0x3a60]
mov edx, dword [esp + 0x3a34]
mov byte [esp + 0x85f9], cl
lea ecx, [esp + 0x50b0]
mov byte [esp + 0x85f8], al
mov dword [esp + 0x194], edx
call fcn.00436f80
lea esi, [esp + 0x50b0]
call fcn.00436390
lea eax, [esp + 0xa4]
push eax
push ebx
push ebx
push 0x401260
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4c7d1c], eax
cmp byte [0x4c7dca], bl
jne 0x40dc50
call fcn.0042de30
cmp byte [0x4c7dcb], bl
jne 0x40dcb0
push SysReAllocString
push ebx
push ebx
mov byte [0x4c7d60], bl
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
je 0x40dc94
mov ebx, eax
call fcn.004348d0
test al, al
je 0x40dc92
lea ecx, [esp + 0xa08]
mov byte [esp + 0x3a8a], 0
call fcn.00440360
xor ebx, ebx
jmp 0x40dcb7
xor ebx, ebx
mov ecx, str.TermService
call fcn.00434a70
test al, al
jne 0x40dcb7
push 1
mov ecx, str.TermService
call fcn.004347a0
jmp 0x40dcb7
mov byte [0x4c7d60], 1
push str.Initializing_keep_running_vectors_...
call fcn.004261a0
add esp, 4
mov dword [esp + 0x300], ebx
mov dword [esp + 0x304], ebx
mov dword [esp + 0x308], ebx
mov dword [esp + 0x310], ebx
mov dword [esp + 0x314], ebx
mov dword [esp + 0x318], ebx
mov dword [esp + 0x320], ebx
mov dword [esp + 0x324], ebx
mov dword [esp + 0x328], ebx
mov dword [esp + 0x330], ebx
mov dword [esp + 0x334], ebx
lea ecx, [esp + 0xa08]
push ecx
lea edx, [esp + 0x304]
push edx
mov byte [esp + 0xa944], 0x18
call fcn.004063a0
lea eax, [esp + 0xa08]
mov byte [esp + 0x33], bl
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
call fcn.004143f0
mov dword [0x4c7d6c], eax
lea eax, [esp + 0xa08]
push eax
lea ecx, [esp + 0x4c]
call fcn.0044a200
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0xb4]
push ecx
push 0x133
mov ebx, 0x2ff
lea esi, [esp + 0x8a08]
call fcn.004341a0
add esp, 4
push eax
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
cmp byte [esp + 0x3aa2], 0
jne 0x40ddcf
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x3c
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x3c]
xor ecx, ecx
call fcn.004366a0
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [esp + 0x188], 0
test esi, esi
je 0x40de3f
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edi, eax
lea eax, [esp + 0x188]
push eax
push edi
call esi
cmp dword [esp + 0x188], 0
je 0x40de38
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0
lea ecx, [esp + 0x50c0]
push ecx
mov edx, str.WARNING:_This_is_the_32_bit_edition_of_the_process_governor._It_is_recommended_that_you_use_a_64_bit_build_of_the_governor_on_this_system_
xor ecx, ecx
call fcn.004366a0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x2b4]
push eax
lea ecx, [esp + 0x804]
xor edx, edx
push ecx
mov dword [esp + 0x2bc], 0x101
mov word [esp + 0x808], dx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x40de99
cmp word [esp + 0x800], 0
je 0x40de99
lea ecx, [esp + 0x800]
call fcn.0042f490
test al, al
je 0x40de92
mov bl, 1
push str.System_context_by_user_name
jmp 0x40deef
push str.pg._Standard_context
jmp 0x40deed
cmp byte [0x4c7dca], 0
jne 0x40dea7
call fcn.0042de30
xor eax, eax
cmp byte [0x4c7dcb], al
je 0x40ded1
movzx ecx, word [eax + str.System]
mov word [esp + eax + 0x800], cx
add eax, 2
test cx, cx
jne 0x40deb1
mov bl, 1
push str.Running_in_system_context
jmp 0x40deef
movzx ecx, word [eax + str.System]
mov word [esp + eax + 0x800], cx
add eax, 2
test cx, cx
jne 0x40ded1
push str.Running_in_a_non_system_user_context
xor bl, bl
call fcn.004261a0
add esp, 4
cmp byte [esp + 0x3a8a], 0
je 0x40df0e
test bl, bl
jne 0x40df0e
lea eax, [esp + 0x800]
jmp 0x40df2e
mov edx, dword [esp + 0xb4]
push 0xfa
mov ebx, 0x2ff
lea esi, [esp + 0x9304]
call fcn.004341a0
add esp, 4
mov edx, dword [esp + 0xb4]
push eax
push 0x148
mov ebx, 0x2ff
lea esi, [esp + 0x8a08]
call fcn.004341a0
add esp, 4
push eax
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
cmp byte [esp + 0x3aa2], 0
jne 0x40df89
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x3d
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x3c]
xor ecx, ecx
call fcn.004366a0
mov al, byte [0x4cb970]
mov byte [esp + 0x6f], al
test al, al
je 0x40e0dd
lea esi, [esp + 0x670]
call fcn.00427140
call fcn.00401bb0
test al, al
je 0x40e039
lea eax, [esp + 0x25c]
push eax
call fcn.00401c60
test al, al
je 0x40e039
call fcn.00401db0
cmp byte [0x4cb970], 0
je 0x40e039
lea ecx, [esp + 0x25c]
push ecx
push 0
call dword [0x4c7d90]
test eax, eax
jne 0x40e039
cmp byte [esp + 0x3aa2], al
jne 0x40e039
cmp byte [esp + 0x3aa5], al
je 0x40e039
mov edx, dword [esp + 0xb4]
push eax
push 0x222
lea esi, [esp + 0x9308]
call fcn.004341a0
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x3e
lea edx, [esp + 0x50c0]
push edx
mov edx, esi
xor ecx, ecx
call fcn.004366a0
xor eax, eax
mov dword [esp + 0x25c], eax
mov dword [esp + 0x260], eax
mov dword [esp + 0x264], eax
mov dword [esp + 0x268], eax
lea eax, [esp + 0x25c]
push eax
call fcn.00427290
test al, al
je 0x40e0dd
cmp byte [0x4cb970], 0
je 0x40e0dd
lea ecx, [esp + 0x25c]
push ecx
push 0
call dword [0x4c7d90]
test eax, eax
jne 0x40e0dd
cmp byte [esp + 0x3aa2], al
jne 0x40e0dd
cmp byte [esp + 0x3aa5], al
je 0x40e0dd
mov edx, dword [esp + 0xb4]
push eax
push 0x222
mov ebx, 0x2ff
lea esi, [esp + 0x9308]
call fcn.004341a0
add esp, 4
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x3e
lea edx, [esp + 0x50c0]
push edx
mov edx, esi
xor ecx, ecx
call fcn.004366a0
call fcn.0040c680
push str.GlobalProcessLasso_ProBalanceEvent
mov dword [0x4c7d64], eax
or eax, 0xffffffff
push 0
mov dword [esp + 0x70], eax
mov dword [esp + 0x15c], eax
mov al, byte [esp + 0x3a29]
push 0
push 0
mov dword [esp + 0xd0], 0
mov byte [esp + 0x81], al
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push str.Starting_main_loop
mov dword [esp + 0x2f0], eax
call fcn.004261a0
add esp, 4
lea ecx, [esp + 0x46]
push ecx
lea edx, [esp + 0x5e8]
push edx
call fcn.004176d0
mov byte [esp + 0xa93c], 0x19
cmp byte [0x4c7d63], 0
jne 0x4137a1
lea eax, [esp + 0x28e]
push eax
lea ecx, [esp + 0x4f8]
push ecx
call fcn.004176d0
mov byte [esp + 0xa93c], 0x1a
cmp byte [esp + 0x219], 1
mov byte [esp + 0x6e], 0
jne 0x40e18d
mov byte [esp + 0x5a], 1
jmp 0x40e1d3
push str.Double_checking_entitlement_0
call fcn.004261a0
mov eax, dword [esp + 0x224]
add esp, 4
test eax, eax
je 0x40e1c1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40e1c1
mov byte [esp + 0x219], 1
mov byte [esp + 0x5a], 1
jmp 0x40e1d3
push str.ERROR:_No_entitlement_for_ProBalance__Feature_disabled_
call fcn.004261a0
add esp, 4
mov byte [esp + 0x5a], 0
mov edi, dword [esp + 0x194]
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [esp + 0x110]
lea edx, [esp + 0x2dc]
push edx
xor ebx, ebx
push esi
mov dword [esp + 0x2e4], ebx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x40e214
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x413732
lea esi, [esp + 0xa08]
call fcn.0044b6a0
test al, al
jne 0x40e27c
cmp dword [esp + 0x3a0c], ebx
jne 0x40e246
push str.LocalioloGovernorConfigChange
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esp + 0x3a0c], eax
cmp eax, ebx
je 0x40e24f
cmp byte [esp + 0x3a6a], bl
je 0x40e26c
cmp dword [esp + 0x120], 0x258
jb 0x40e26c
lea esi, [esp + 0xa08]
call fcn.004497f0
test al, al
jne 0x40e27c
inc dword [esp + 0x120]
mov byte [esp + 0x5b], bl
jmp 0x40e381
push str.file_system_change_notification_event_in_configuration_folder
call fcn.004261a0
add esp, 4
lea ecx, [esp + 0xa08]
call fcn.004441c0
mov al, byte [esp + 0x3a60]
mov cl, byte [esp + 0x3aa4]
lea esi, [esp + 0x5e4]
mov byte [esp + 0x85f8], al
mov byte [esp + 0x85f9], cl
mov byte [esp + 0x5b], 1
call fcn.00416780
mov eax, dword [esp + 0x3a34]
cmp edi, eax
je 0x40e32c
mov edx, dword [esp + 0xb4]
push eax
push 0x3a9
mov ebx, 0x2ff
lea esi, [esp + 0x8a08]
call fcn.004341a0
add esp, 4
push eax
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x50
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x3c]
xor ecx, ecx
call fcn.004366a0
mov eax, dword [esp + 0x3a34]
mov dword [esp + 0x194], eax
lea ecx, [esp + 0xa08]
push ecx
lea edx, [esp + 0x304]
push edx
call fcn.004063a0
cmp byte [esp + 0x71], 0
je 0x40e367
cmp byte [esp + 0x3a21], 0
jne 0x40e367
lea eax, [esp + 0x50b0]
push eax
mov byte [esp + 0x75], 1
call fcn.0040c480
add esp, 4
lea eax, [esp + 0xa08]
call fcn.004143f0
xor ebx, ebx
mov dword [0x4c7d6c], eax
mov dword [esp + 0x120], ebx
cmp byte [esp + 0x3ab7], 0
je 0x40e570
cmp byte [esp + 0x53], 0
jne 0x40e47b
cmp byte [0x4c7d61], 0
je 0x40e3d3
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x3f
lea ecx, [esp + 0x50c0]
push ecx
mov edx, str.ERROR___Energy_Saver_disabled__Governor_as_Service_incompatible
xor ecx, ecx
call fcn.004366a0
mov byte [esp + 0x3ab7], 0
jmp 0x40e6be
cmp byte [esp + 0x3ab5], 0
je 0x40e468
lea edx, [esp + 0x3af4]
push edx
push 0x4cb970
lea ebx, [esp + 0x130]
call fcn.004276a0
test al, al
je 0x40e468
cmp byte [0x4cb970], 0
jne 0x40e40b
xor bl, bl
jmp 0x40e420
lea eax, [esp + 0x128]
push eax
push 0
call dword [0x4c7d90]
test eax, eax
sete bl
lea ecx, [esp + 0x48]
call fcn.00427410
mov ecx, dword [esp + 0x48]
mov edx, dword [0x4c8694]
push ecx
push edx
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
test bl, bl
je 0x40e468
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esp + 0x2c]
push eax
push 0x4ab2fc
push 0x3f
lea eax, [esp + 0x50c0]
push eax
xor ecx, ecx
call fcn.004366a0
cmp byte [esp + 0x3ab7], 0
mov byte [esp + 0x53], 1
je 0x40e6bc
cmp byte [esp + 0x6f], 0
je 0x40e6bc
xor ebx, ebx
cmp dword [esp + 0x3abc], ebx
je 0x40e6bc
lea ecx, [esp + 0x3ac0]
call fcn.0042eda0
test al, al
jne 0x40e6bc
cmp byte [esp + 0x3aba], bl
je 0x40e4c6
mov ecx, dword [esp + 0x90]
or ecx, dword [esp + 0x94]
jne 0x40e6be
lea edx, [esp + 0x298]
push edx
mov dword [esp + 0x29c], 8
mov dword [esp + 0x2a0], ebx
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x40e6be
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x29c]
cmp eax, ecx
jbe 0x40e6be
sub eax, ecx
mov ecx, dword [esp + 0x3abc]
imul ecx, ecx, 0x3e8
cmp byte [esp + 0x52], bl
jne 0x40e72c
cmp eax, ecx
jb 0x40e6be
mov edx, dword [esp + 0x88]
or edx, dword [esp + 0x8c]
jne 0x40e6be
cmp byte [0x4cb970], bl
je 0x40e54c
lea esi, [esp + 0x348]
call fcn.00427140
cmp byte [esp + 0x3ab5], bl
je 0x40e585
lea eax, [esp + 0x3af4]
push eax
push 0x4cb970
lea ebx, [esp + 0x130]
call fcn.004276a0
jmp 0x40e5bd
cmp byte [esp + 0x53], 0
je 0x40e6bc
mov byte [esp + 0x53], 0
jmp 0x40e6be
mov ecx, dword [esp + 0x348]
mov edx, dword [esp + 0x34c]
mov eax, dword [esp + 0x350]
mov dword [esp + 0x128], ecx
mov ecx, dword [esp + 0x354]
mov dword [esp + 0x12c], edx
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], ecx
mov eax, 0x10
xor ecx, ecx
jmp 0x40e5d0
mov edx, dword [esp + ecx + 0x348]
cmp edx, dword [esp + ecx + 0x3ac0]
jne 0x40e5f0
sub eax, 4
add ecx, 4
cmp eax, 4
jae 0x40e5d0
jmp 0x40e6b7
lea eax, [esp + 0x128]
push eax
call fcn.00401a60
cmp byte [0x4cb970], 0
je 0x40e626
lea ecx, [esp + 0x3ac0]
push ecx
push 0
call dword [0x4c7d90]
test eax, eax
jne 0x40e626
lea ebx, [esp + 0x4c8]
call fcn.0045a6d0
cmp byte [esp + 0x3aa2], 0
jne 0x40e69d
cmp byte [esp + 0x3ab8], 0
je 0x40e69d
lea edx, [esp + 0x3ac0]
push edx
push 0x4cb970
lea eax, [esp + 0x50]
call fcn.00426e70
test al, al
jne 0x40e662
mov edx, str.Unknown
lea edi, [esp + 0x48]
call fcn.00402c40
mov eax, dword [esp + 0x48]
mov ecx, dword [0x4c8694]
push eax
push ecx
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x3f
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x3c]
xor ecx, ecx
call fcn.004366a0
lea eax, [esp + 0x618]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [esp + 0x1e8]
call fcn.0045f6c0
mov byte [esp + 0x52], 1
xor ebx, ebx
cmp byte [esp + 0x51], 0
jne 0x40e6d0
cmp byte [esp + 0x5b], 0
je 0x40e86e
cmp byte [esp + 0x3ae1], 0
je 0x40e80c
cmp dword [esp + 0xd0], ebx
jne 0x40e86e
push str.Starting_iolo_auto_memory_mechanic_thread_...
call fcn.004261a0
add esp, 4
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea edx, [esp + 0x3d8]
push edx
push ebx
push eax
push 0x41e1b0
push ebx
push ebx
mov dword [esp + 0x134], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esp + 0xd0], eax
jmp 0x40e86e
cmp eax, ecx
ja 0x40e6be
mov byte [esp + 0x52], bl
cmp byte [0x4cb970], bl
je 0x40e74b
lea edx, [esp + 0x128]
push edx
push ebx
call dword [0x4c7d90]
call fcn.00401db0
cmp byte [esp + 0x3aa2], bl
jne 0x40e7e7
cmp byte [esp + 0x3ab8], bl
je 0x40e7e7
lea eax, [esp + 0x128]
push eax
push 0x4cb970
lea eax, [esp + 0x50]
call fcn.00426e70
test al, al
jne 0x40e792
mov edx, str.Unknown
lea edi, [esp + 0x48]
call fcn.00402c40
mov ecx, dword [esp + 0x48]
mov edx, dword [0x4c8694]
push ecx
push edx
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esp + 0x2c]
push eax
push 0x4ab2fc
push 0x3f
lea eax, [esp + 0x50c0]
push eax
xor ecx, ecx
call fcn.004366a0
lea ecx, [esp + 0x620]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [esp + 0x1e8]
call fcn.0045f720
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
jmp 0x40e6be
cmp dword [esp + 0xd0], ebx
je 0x40e86e
mov edi, dword [esp + 0x11c]
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, dword [esp + 0xd0]
push 0x2ee
call fcn.00425530
add esp, 4
cmp eax, 0x102
jne 0x40e860
push str.Forcing_thread_termination___mem_mechanic_thread
call fcn.004261a0
add esp, 4
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.00425660
mov dword [esp + 0xd0], ebx
mov esi, edi
call fcn.00425660
mov dword [esp + 0x11c], ebx
mov esi, dword [esp + 0xcc]
or edi, 0xffffffff
cmp esi, edi
je 0x40e8ce
cmp esi, ebx
je 0x40e8ce
cmp byte [esp + 0x3a77], 0
jne 0x40e8ce
push str.undoing_last_foreground_process_boost
call fcn.004261a0
add esp, 4
push esi
push ebx
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x40e8ba
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.00425660
jmp 0x40e8c7
push str.undoing_last_forreground_process_boost__process_terminated__
call fcn.004261a0
add esp, 4
mov dword [esp + 0xcc], edi
mov esi, dword [esp + 0xb0]
cmp esi, edi
je 0x40e945
cmp esi, ebx
je 0x40e945
cmp byte [esp + 0x3a7c], 0
jne 0x40e945
push str.undoing_last_foreground_thread_boost
call fcn.004261a0
add esp, 4
push esi
push ebx
push 0x20
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, ebx
je 0x40e931
push str.Restoring_foreground_thread_priority_to_original.
call fcn.004261a0
add esp, 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x40e92a
push str.Error_restoring_thread_priority__process_terminated__.
call fcn.004261a0
add esp, 4
call fcn.00425660
jmp 0x40e93e
push str.pg.error:_undoing_last_foreground_thread_boost__thread_terminated__
call fcn.004261a0
add esp, 4
mov dword [esp + 0xb0], edi
cmp byte [esp + 0x3a21], 0
mov byte [esp + 0x72], 0
jne 0x40e96c
cmp byte [esp + 0x3a77], 0
jne 0x40e96c
cmp byte [esp + 0x3a7c], 0
je 0x40e9e7
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [esp + 0xc0], eax
cmp eax, dword [esp + 0x108]
je 0x40e9e7
cmp eax, ebx
je 0x40e9e7
push str.new_foreground_window_detected
call fcn.004261a0
mov esi, dword [esp + 0xc4]
add esp, 4
lea eax, [esp + 0x68]
push eax
push esi
mov dword [esp + 0x70], ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [esp + 0x154], eax
cmp eax, ebx
je 0x40e9da
mov ecx, dword [esp + 0x68]
cmp ecx, ebx
je 0x40e9da
push ecx
push eax
push str.Resolved_foreground_to_TID_PID_0x_x_0x_x
call fcn.004261a0
add esp, 0xc
mov byte [esp + 0x72], 1
mov dword [esp + 0x108], esi
jmp 0x40e9e7
push str.ERROR:_Unexpected_return_frmo_GetWindowThreadProcessId
call fcn.004261a0
add esp, 4
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], ebx
call fcn.0045b050
lea esi, [esp + 0x60]
mov byte [esp + 0x32], 0
call fcn.00402b20
mov eax, dword [0x4c8708]
cmp dword [0x4cbb68], eax
je 0x40ea31
push eax
push str.Managing__d_processes_...
call fcn.004261a0
mov edx, dword [0x4c8708]
add esp, 8
mov dword [0x4cbb68], edx
mov esi, dword [esp + 0x24]
cmp esi, ebx
je 0x40f61c
jmp 0x40ea44
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 0x484]
mov dword [esp + 0x144], eax
lea ebx, [esp + 0x144]
lea eax, [esp + 0x2c0]
mov dword [esp + 0x34], 0
call fcn.00416350
mov eax, dword [esp + 0x2c0]
cmp eax, dword [0x4c8704]
je 0x40ea89
mov ecx, dword [eax + 0x10]
mov edi, dword [ecx + 0xc]
test edi, edi
jne 0x40f5e3
mov esi, dword [esi + 0x484]
mov edi, dword [esp + 0x5e8]
lea edx, [esp + 0x2d8]
push edx
lea ebx, [esp + 0x44]
lea eax, [esp + 0x5e8]
mov dword [esp + 0x44], esi
call fcn.004177c0
cmp dword [esp + 0x2d8], edi
je 0x40ead5
mov eax, ebx
lea edi, [esp + 0x4f4]
call fcn.00416690
mov esi, dword [esp + 0x24]
mov byte [eax], 1
jmp 0x40f5f3
cmp esi, 8
ja 0x40eae1
mov byte [esp + 0x1f], 0
jmp 0x40eaee
mov eax, dword [esp + 0x24]
call fcn.00458d40
mov byte [esp + 0x1f], al
mov esi, dword [esp + 0x24]
call fcn.00459700
mov esi, eax
lea eax, [esp + 0xd4]
push eax
mov ecx, esi
mov dword [esp + 0x24], esi
call fcn.00402ba0
lea edi, [esp + 0xd4]
mov byte [esp + 0xa93c], 0x1b
call fcn.00403810
test esi, esi
je 0x40eb39
cmp byte [esp + 0x3a79], 0
je 0x40eb3e
mov eax, esi
call fcn.0045df40
test al, al
je 0x40eb3e
mov byte [esp + 0x1f], 0
xor ecx, ecx
lea esi, [esp + 0x150]
mov word [esp + 0x4670], cx
call fcn.00401e80
lea esi, [esp + 0x18c]
call fcn.00401e80
cmp byte [esp + 0x1f], 0
mov byte [esp + 0xa93c], 0x1d
je 0x40ec01
mov edx, esi
push edx
lea eax, [esp + 0x154]
push eax
mov eax, dword [esp + 0x2c]
call fcn.00456f90
test al, al
je 0x40ebc1
mov esi, dword [esp + 0x150]
push esi
push str.Got_username_via_token__s
call fcn.004261a0
lea edx, [esp + 0x4678]
add esp, 8
mov bl, 1
mov eax, esi
sub edx, esi
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x40ebb0
jmp 0x40ebe4
push str.Could_not_get_user_name__trying_WTS_...
call fcn.004261a0
mov ecx, dword [esp + 0x44]
add esp, 4
lea eax, [esp + 0x4670]
call fcn.0042d860
mov bl, al
test bl, bl
je 0x40ebef
cmp word [esp + 0x4670], 0
jne 0x40ec20
mov ecx, dword [esp + 0x40]
push ecx
push str.Failed_to_get_username_for_PID__u
call fcn.004261a0
add esp, 8
mov eax, dword [0x4c86b4]
lea edx, [esp + 0x4670]
xor bl, bl
sub edx, eax
movzx ecx, word [eax]
mov word [eax + edx], cx
add eax, 2
test cx, cx
jne 0x40ec11
cmp byte [esp + 0x3a8a], 0
je 0x40ec58
lea edx, [esp + 0x4670]
push edx
lea eax, [esp + 0x804]
push eax
call fcn.00473ffc
add esp, 8
test eax, eax
jne 0x40ec80
mov ecx, dword [esp + 0x20]
push ecx
push str.pg:_POSITIVE_manage_on__s__match_username_
call fcn.004261a0
add esp, 8
cmp byte [esp + 0x1f], 0
je 0x40ec9f
mov ecx, dword [esp + 0x24]
call fcn.004567c0
test eax, eax
jne 0x40ecbf
push str.pg:_Not_managing_this_process_due_to_insufficient_access__no_filename_
call fcn.004261a0
add esp, 4
mov byte [esp + 0x1f], 0
jmp 0x40ecbf
test bl, bl
jne 0x40ee26
mov edx, dword [esp + 0x20]
push edx
push str.pg:_NEGATIVE_manage_on__s__no_username_
call fcn.004261a0
add esp, 8
mov byte [esp + 0x1f], 0
push str.pg:_Adding_to_rolling_ignore_cache
call fcn.004261a0
add esp, 4
lea eax, [esp + 0x40]
lea edi, [esp + 0x4f4]
call fcn.00416690
mov byte [eax], 1
lea esi, [esp + 0x74]
call fcn.00401e80
mov dword [esp + 0x240], 0xf
mov dword [esp + 0x23c], 0
mov byte [esp + 0x22c], 0
cmp byte [esp + 0x1f], 0
mov byte [esp + 0xa93c], 0x1f
je 0x40f111
mov edi, dword [esp + 0x24]
mov esi, edi
call fcn.00456a40
mov ecx, edi
mov esi, eax
call fcn.004567c0
mov ebx, eax
mov dword [esp + 0x34], ebx
test ebx, ebx
jne 0x40ed30
push str.WARNING_Empty_pathname
call fcn.004261a0
mov dword [esp + 0x38], 0x4aab50
mov ebx, dword [esp + 0x38]
add esp, 4
mov edi, dword [esp + 0x20]
push edi
lea edx, [esp + 0x78]
mov ecx, esi
call fcn.0042dae0
mov ecx, dword [esp + 0x78]
add esp, 4
push ecx
push edi
push str._s_actualized_to__s
call fcn.004261a0
mov ecx, dword [esp + 0xe0]
add esp, 0xc
lea esi, [esp + 0x3ef4]
call fcn.00403870
sub esp, 0x1c
mov byte [esp + 0xa958], 0x20
mov eax, dword [eax]
mov ecx, esp
mov dword [esp + 0xc0], esp
push eax
call fcn.004036e0
lea edx, [esp + 0x644]
push edx
lea ecx, [esp + 0x570]
call fcn.0040bff0
mov edi, eax
lea esi, [esp + 0x22c]
mov byte [esp + 0xa93c], 0x21
call fcn.00404b20
lea ecx, [esp + 0x628]
call fcn.00403720
lea ecx, [esp + 0x3ef4]
mov byte [esp + 0xa93c], 0x1f
call fcn.00403890
sub esp, 0x1c
mov eax, esi
mov esi, esp
mov dword [esp + 0xc0], esp
call fcn.004152c0
lea eax, [esp + 0x394]
push eax
call fcn.0045c350
test al, al
je 0x40ee35
cmp dword [esp + 0x240], 0x10
mov eax, dword [esp + 0x22c]
jae 0x40ee0b
lea eax, [esp + 0x22c]
mov ecx, dword [esp + 0xd4]
push eax
push ecx
push str.gvr_matched____1__cache_exclusion__s__S
call fcn.004261a0
add esp, 0xc
jmp 0x40f115
mov eax, dword [esp + 0x20]
push eax
push str.pg:_NEGATIVE_manage_on__s__wrong_username_
jmp 0x40ec92
sub esp, 0x1c
lea eax, [esp + 0x248]
mov esi, esp
mov dword [esp + 0xc0], esp
call fcn.004152c0
lea edx, [esp + 0x3b4]
push edx
call fcn.0045c350
test al, al
je 0x40eeb4
cmp dword [esp + 0x240], 0x10
mov eax, dword [esp + 0x22c]
jae 0x40ee76
lea eax, [esp + 0x22c]
push eax
mov eax, dword [esp + 0xd8]
push eax
push str.gvr_matched____2__cache_exclusion__s__S
call fcn.004261a0
add esp, 0xc
lea eax, [esp + 0x40]
lea edi, [esp + 0x4f4]
call fcn.00416690
mov ecx, dword [esp + 0x24]
mov byte [eax], 1
mov byte [esp + 0x1f], 0
mov byte [ecx + 0x476], 1
jmp 0x40f115
lea esi, [esp + 0xbc]
call fcn.00401e80
lea esi, [esp + 0xfc]
call fcn.00401e80
push str.ApplicationCompany
push ebx
lea ecx, [esp + 0xc4]
mov byte [esp + 0xa944], 0x23
call fcn.00407cd0
mov esi, dword [esp + 0xbc]
cmp al, 1
jne 0x40ef0f
push 0x4c8710
mov ecx, esi
call fcn.004043e0
cmp al, 1
jne 0x40ef0f
push esi
push str.Excluding_based_on_MUI_cache_of_vendor_name__s
call fcn.004261a0
add esp, 8
mov esi, dword [esp + 0x34]
push str.FriendlyAppName
push esi
lea ecx, [esp + 0x104]
call fcn.00407cd0
mov ebx, dword [esp + 0xfc]
cmp al, 1
jne 0x40ef4e
push 0x4cb990
mov ecx, ebx
call fcn.004043e0
cmp al, 1
jne 0x40ef4e
push ebx
push str.Excluding_based_on_MUI_cache_of_app_name__s
call fcn.004261a0
add esp, 8
lea edx, [esp + 0x758]
push edx
call fcn.00413d70
mov byte [esp + 0xa93c], 0x24
mov edi, dword [esp + 0xbc]
cmp dword [edi - 0xc], 0
je 0x40ef7a
cmp dword [ebx - 0xc], 0
jne 0x40f037
push str.Vendor_or_App_Name_not_in_MUI_cache__and_this_process_not_in_result_cache__so_must_read_version_block_from_process_module
call fcn.004261a0
add esp, 4
push esi
lea ecx, [esp + 0x75c]
call fcn.004030b0
cmp al, 1
jne 0x40f02a
push str.Loaded_version_block_
call fcn.004261a0
add esp, 4
cmp dword [edi - 0xc], 0
jne 0x40efe5
lea esi, [esp + 0x2a0]
lea eax, [esp + 0x758]
call fcn.00403620
lea edi, [esp + 0xbc]
mov byte [esp + 0xa93c], 0x25
call fcn.00406b40
mov eax, esi
mov byte [esp + 0xa93c], 0x24
call fcn.00401ea0
cmp dword [ebx - 0xc], 0
jne 0x40f037
lea esi, [esp + 0x2c8]
lea eax, [esp + 0x758]
call fcn.004035f0
lea edi, [esp + 0xfc]
mov byte [esp + 0xa93c], 0x26
call fcn.00406b40
mov eax, esi
mov byte [esp + 0xa93c], 0x24
call fcn.00401ea0
mov ebx, dword [esp + 0xfc]
jmp 0x40f037
push str.Could_not_load_version_block_
call fcn.004261a0
add esp, 4
lea eax, [esp + 0x22c]
push eax
call fcn.004043b0
test al, al
jne 0x40f0a2
mov ecx, dword [esp + 0xbc]
push 0x4c8710
call fcn.004043e0
test al, al
jne 0x40f0a2
push 0x4cb990
mov ecx, ebx
call fcn.004043e0
test al, al
jne 0x40f0a2
mov ecx, dword [esp + 0x20]
push ecx
push str.NEGATIVE_match__s_to_hash
call fcn.004261a0
sub esp, 0x14
lea eax, [esp + 0x248]
mov esi, esp
mov dword [esp + 0xc0], esp
call fcn.004152c0
lea esi, [esp + 0x394]
call fcn.0045c2e0
jmp 0x40f0e5
mov edx, dword [esp + 0x20]
push edx
push str.POSITIVE_match__s_to_hash
call fcn.004261a0
sub esp, 0x14
lea eax, [esp + 0x248]
mov esi, esp
mov dword [esp + 0xc0], esp
call fcn.004152c0
lea esi, [esp + 0x3b4]
call fcn.0045c2e0
mov eax, dword [esp + 0x24]
mov byte [esp + 0x1f], 0
mov byte [eax + 0x476], 1
lea eax, [esp + 0x758]
call fcn.00413e90
lea eax, [esp + 0xfc]
call fcn.00401ea0
lea eax, [esp + 0xbc]
mov byte [esp + 0xa93c], 0x1f
call fcn.00401ea0
mov ebx, dword [esp + 0x34]
mov esi, dword [esp + 0x24]
mov byte [esp + 0x2c], 0
call fcn.00459700
cmp byte [esp + 0x1f], 0
push eax
je 0x40f580
mov ecx, dword [esp + 0x44]
push ecx
push str.new_process_to_manage___d__s
call fcn.004261a0
add esp, 0xc
cmp byte [esp + 0x3aa2], 0
jne 0x40f2be
cmp byte [esp + 0x3a6e], 0
je 0x40f2be
cmp byte [esp + 0x51], 0
jne 0x40f2be
push str.pg:_Process_needs_log_entry_emitted_on_creation_..
call fcn.004261a0
add esp, 4
test ebx, ebx
je 0x40f2be
cmp word [ebx], 0
je 0x40f2be
call fcn.00456a40
mov edx, str.UNKNOWN_PARENT__beyond_scope__
lea edi, [esp + 0x28]
call fcn.00402c40
mov eax, esi
call fcn.00459c60
mov edi, eax
mov dword [esp + 0x144], edi
cmp edi, 0xffffffff
je 0x40f28d
cmp dword [0x4c8708], 0
je 0x40f28d
lea esi, [esp + 0x148]
call fcn.00401e80
mov byte [esp + 0xa93c], 0x27
lea ebx, [esp + 0x2a8]
lea eax, [esp + 0x2e8]
mov dword [esp + 0x2a8], edi
call fcn.00416350
mov eax, dword [esp + 0x2e8]
cmp eax, dword [0x4c8704]
je 0x40f241
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
test ecx, ecx
jne 0x40f209
lea ecx, [eax + 0x6c]
mov edx, ecx
lea edi, [esp + 0x148]
call fcn.00402c40
mov eax, dword [esp + 0x148]
cmp dword [eax - 0xc], 0
je 0x40f253
mov edx, dword [esp + 0x144]
push edx
push eax
mov eax, dword [0x4c865c]
push eax
lea edi, [esp + 0x34]
call fcn.004020e0
add esp, 0xc
jmp 0x40f253
push edi
push str.Parent_PID__d
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
mov edx, str.__PATH:
lea eax, [esp + 0x28]
call fcn.00415360
mov ecx, dword [esp + 0x24]
call fcn.004567c0
mov edx, eax
lea eax, [esp + 0x28]
call fcn.00415360
lea eax, [esp + 0x148]
mov byte [esp + 0xa93c], 0x1f
call fcn.00401ea0
mov esi, dword [esp + 0x24]
call fcn.00456a40
mov ecx, dword [esi + 0x484]
push eax
push ecx
lea esi, [esp + 0x7c]
call fcn.00402b80
push eax
push 1
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x3c]
lea ecx, [esp + 0x4684]
call fcn.004366a0
cmp byte [esp + 0x3a86], 0
je 0x40f4e6
push str.new_process__checking_for_instance_count_limit_...
call fcn.004261a0
mov ecx, dword [esp + 0x3d1c]
mov eax, dword [esp + 0x3d18]
sub ecx, eax
sar ecx, 2
add esp, 4
mov dword [esp + 0x64], 0
test ecx, ecx
je 0x40f4e6
mov edx, dword [esp + 0x64]
lea esi, [esp + 0x74]
lea edi, [eax + edx*4]
call fcn.00402b80
push eax
mov esi, edi
call fcn.00402b80
push eax
call fcn.0042bc30
add esp, 8
test al, al
je 0x40f4b7
mov eax, dword [esp + 0x3d24]
mov ecx, dword [esp + 0x64]
mov ebx, dword [eax + ecx*4]
mov eax, dword [0x4c8704]
mov esi, dword [eax]
xor edi, edi
mov dword [esp + 0x54], esi
cmp esi, eax
je 0x40f3b5
cmp edi, ebx
jg 0x40f3bd
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40f355
lea ecx, [eax + 0x6c]
lea edx, [esp + 0x4670]
push edx
push ecx
call fcn.00473ffc
add esp, 8
test eax, eax
je 0x40f374
cmp byte [esp + 0x3aa3], 0
je 0x40f3a0
mov esi, dword [esi + 0x10]
mov eax, dword [esi]
test eax, eax
jne 0x40f380
lea eax, [esi + 0x6c]
mov ecx, dword [esp + 0x74]
push ecx
push eax
call fcn.00473ffc
add esp, 8
test eax, eax
jne 0x40f3a0
push str.found_an_existing_instance_in_same_session..
call fcn.004261a0
add esp, 4
inc edi
lea eax, [esp + 0x54]
call fcn.004184b0
mov esi, dword [esp + 0x54]
cmp esi, dword [0x4c8704]
jne 0x40f344
cmp edi, ebx
jl 0x40f4b7
push str.found_excessive_instances__as_configured__of_process__terminating_
call fcn.004261a0
mov esi, dword [esp + 0x28]
add esp, 4
push 0
call fcn.00457530
cmp byte [esp + 0x3a76], 0
je 0x40f4b7
cmp byte [esp + 0x3aa2], 0
jne 0x40f4b7
test al, al
je 0x40f484
mov edi, dword [0x4c85b0]
mov byte [esp + 0x2c], 1
call fcn.00456a40
mov edx, dword [esp + 0x40]
push eax
push edx
lea esi, [esp + 0x7c]
call fcn.00402b80
push eax
push 7
lea eax, [esp + 0x50c0]
push eax
mov edx, edi
lea ecx, [esp + 0x4684]
call fcn.004366a0
cmp byte [esp + 0x3a82], 0
je 0x40f4b7
call fcn.00402b80
mov edx, dword [esp + 0xb4]
push eax
push 0x2c7
mov ebx, 0x2ff
lea esi, [esp + 0x8a08]
call fcn.004341a0
add esp, 4
push eax
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
mov esi, edi
call fcn.00402b80
mov eax, dword [esp + 0x24]
call fcn.004588e0
jmp 0x40f4b7
mov edi, dword [0x4c8594]
call fcn.00456a40
mov ecx, dword [esp + 0x40]
push eax
push ecx
lea esi, [esp + 0x7c]
call fcn.00402b80
push eax
push 8
lea edx, [esp + 0x50c0]
push edx
mov edx, edi
lea ecx, [esp + 0x4684]
call fcn.004366a0
mov edx, dword [esp + 0x3d18]
mov eax, dword [esp + 0x3d14]
mov ecx, dword [esp + 0x64]
sub edx, eax
inc ecx
sar edx, 2
mov dword [esp + 0x64], ecx
cmp ecx, edx
jb 0x40f2fc
cmp byte [esp + 0x2c], 0
jne 0x40f59c
push str.new_process__no_termination__adding_to_list
call fcn.004261a0
mov eax, dword [esp + 0x24]
add esp, 4
push 0x90
push eax
push str.pg:_Adding_new_process__s_to_list__size_of_link_will_be_0x_x
call fcn.004261a0
add esp, 0xc
push 0x90
call fcn.00473e79
add esp, 4
test eax, eax
je 0x40f524
call fcn.0040b9c0
mov ebx, eax
jmp 0x40f526
xor ebx, ebx
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x74]
mov esi, ebx
mov dword [ebx + 0xc], ecx
call fcn.0040bb20
mov esi, dword [esp + 0x34]
mov edi, ebx
call fcn.0040bbf0
lea esi, [esp + 0x4670]
call fcn.0040bc70
mov eax, dword [esp + 0x40]
push eax
lea esi, [esp + 0x78]
mov dword [ebx + 0x10], eax
call fcn.00402b80
push eax
push str.pg.Adding:_Process__s__u
call fcn.004261a0
add esp, 0xc
lea eax, [esp + 0x40]
call fcn.00415ff0
mov dword [eax], ebx
mov byte [esp + 0x32], 1
jmp 0x40f594
push str.pg:_Ignored_process__s
call fcn.004261a0
add esp, 8
mov eax, esi
call fcn.00413f90
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x22c]
call fcn.00403720
lea eax, [esp + 0x74]
call fcn.00401ea0
lea eax, [esp + 0x18c]
call fcn.00401ea0
lea eax, [esp + 0x150]
call fcn.00401ea0
lea eax, [esp + 0xd4]
mov byte [esp + 0xa93c], 0x1a
call fcn.00401ea0
mov esi, dword [esp + 0x24]
jmp 0x40f5f3
mov eax, dword [esi + 0x438]
test eax, eax
je 0x40f5f3
push eax
call fcn.00458640
lea edx, [esp + 0x24]
mov edi, esi
mov esi, dword [esp + 0x118]
push edx
call fcn.0045b1e0
cmp dword [esp + 0x24], 0
jne 0x40ea40
test edi, edi
je 0x40f61c
mov eax, edi
call fcn.00413f90
lea eax, [esp + 0x5e4]
push eax
lea ecx, [esp + 0x4f8]
call fcn.00418830
cmp byte [esp + 0x51], 0
jne 0x40f63e
cmp byte [esp + 0x32], 0
je 0x40f645
mov byte [0x4cb8a4], 1
xor eax, eax
mov byte [esp + 0x51], 0
mov dword [esp + 0x200], eax
mov dword [esp + 0x204], eax
mov dword [esp + 0x208], eax
mov esi, dword [esp + 0x14c]
lea ecx, [esp + 0x2ac]
push ecx
mov byte [esp + 0xa940], 0x28
call fcn.00425840
mov ecx, dword [0x4c8704]
mov eax, dword [ecx]
mov byte [esp + 0x73], 0
mov byte [esp + 0x7b], 0
mov byte [esp + 0x70], 0
mov dword [esp + 0x13c], eax
cmp eax, ecx
je 0x40ff55
mov edi, dword [eax + 0x10]
mov eax, dword [edi]
mov edx, dword [edi + 0xc]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edx
test eax, eax
jne 0x40f6ba
lea eax, [edi + 0x6c]
lea esi, [esp + 0x140]
mov dword [esp + 0x40], eax
call fcn.00401e80
mov byte [esp + 0xa93c], 0x29
mov eax, dword [edi + 0xc]
call fcn.00459c60
mov dword [esp + 0x84], eax
lea ebx, [esp + 0x84]
lea eax, [esp + 0x2d0]
call fcn.00416350
mov eax, dword [esp + 0x2d0]
cmp eax, dword [0x4c8704]
je 0x40f721
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
test ecx, ecx
jne 0x40f70f
lea ecx, [eax + 0x6c]
mov edx, ecx
lea edi, [esp + 0x140]
call fcn.00402c40
mov edi, dword [esp + 0x20]
lea esi, [esp + 0xe8]
call fcn.00401e80
mov byte [esp + 0xa93c], 0x2a
cmp byte [esp + 0x3ab6], 0
je 0x40f7c8
mov edx, dword [esp + 0x140]
mov ecx, esi
mov esi, dword [esp + 0x40]
push ecx
push edx
push esi
lea ecx, [esp + 0x404]
call fcn.00438510
test al, al
je 0x40f7c8
mov ebx, dword [esp + 0xe8]
push ebx
lea eax, [esp + 0xa0c]
call fcn.004526e0
test al, al
jne 0x40f78c
push esi
push ebx
push str.Profile__s_is_disabled__not_invoking_per_trigger_at__s
call fcn.004261a0
add esp, 0xc
jmp 0x40f7c8
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0xec]
call fcn.00415980
add esp, 4
test al, al
je 0x40f7c8
lea eax, [esp + 0xe8]
lea edi, [esp + 0x60]
call fcn.00406b40
mov edx, dword [esp + 0x40]
lea edi, [esp + 0xac]
call fcn.00402c40
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
call fcn.00456ee0
test al, al
jne 0x4100c6
mov eax, dword [edi]
test eax, eax
jne 0x40f7e2
lea eax, [edi + 0x6c]
mov ecx, dword [edi + 0x10]
push eax
push ecx
push str.pg:_cleaning_up_terminated_process__d__s
call fcn.004261a0
add esp, 0xc
cmp byte [edi + 0x3c], 0
je 0x40f948
cmp byte [esp + 0x3a73], 0
je 0x40f86a
cmp byte [esp + 0x3a6d], 0
je 0x40f86a
cmp byte [esp + 0x3aa2], 0
jne 0x40f86a
mov eax, dword [edi]
mov edx, dword [0x4c85e4]
mov dword [esp + 0x84], edx
test eax, eax
jne 0x40f832
lea eax, [edi + 0x6c]
mov ebx, dword [edi + 8]
mov dword [esp + 0x54], eax
test ebx, ebx
jne 0x40f840
lea ebx, [edi + 0x6c]
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
mov edx, dword [esp + 0x90]
push 0x21
lea eax, [esp + 0x50c0]
push eax
mov ecx, ebx
call fcn.004366a0
mov esi, dword [esp + 0xb8]
test esi, esi
je 0x40f934
cmp byte [esp + 0x45], 0
je 0x40f934
mov ecx, dword [esp + 0x4c]
cmp dword [ecx - 0xc], 0
mov byte [esp + 0x45], 0
je 0x40f92c
cmp esi, 1
jne 0x40f92c
mov edx, dword [esp + 0xe4]
push edx
push 0x4cb970
lea ecx, [esp + 0x54]
call fcn.00427ba0
mov eax, dword [esp + 0xec]
push eax
push 0x4cb970
lea ecx, [esp + 0x54]
call fcn.00427c70
call fcn.00427ee0
cmp byte [esp + 0x3aa7], 0
je 0x40f92c
cmp byte [esp + 0x3aa2], 0
jne 0x40f92c
push 0
test al, al
jne 0x40f909
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [0x4c86c4]
push eax
push 0x4ab2fc
push 0x26
lea ecx, [esp + 0x50c0]
push ecx
jmp 0x40f925
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
lea edx, [esp + 0x50bc]
push 0x25
push edx
mov edx, dword [0x4c86bc]
xor ecx, ecx
call fcn.004366a0
dec esi
mov dword [esp + 0xb8], esi
lea eax, [esp + 0x50b0]
push eax
push 0
mov ecx, edi
call fcn.0040c7f0
add esp, 8
cmp byte [edi + 0x45], 0
jne 0x40f95e
cmp byte [edi + 0x47], 0
jne 0x40f95e
cmp byte [edi + 0x46], 0
je 0x40fa19
dec dword [0x4c7d68]
jne 0x40f9bc
cmp byte [esp + 0x3aa2], 0
jne 0x40fa19
mov eax, dword [edi]
mov ecx, dword [0x4c8640]
mov dword [esp + 0x84], ecx
test eax, eax
je 0x40f98d
mov dword [esp + 0x54], eax
jmp 0x40f994
lea edx, [edi + 0x6c]
mov dword [esp + 0x54], edx
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x40f99e
lea ebx, [edi + 0x6c]
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov ecx, dword [esp + 0x54]
push eax
mov eax, dword [edi + 0x10]
push eax
push ecx
push 0x11
lea edx, [esp + 0x50c0]
push edx
jmp 0x40fa0b
cmp byte [esp + 0x3aa2], 0
jne 0x40fa19
mov eax, dword [0x4c8674]
mov dword [esp + 0x84], eax
mov eax, dword [edi]
test eax, eax
je 0x40f9de
mov dword [esp + 0x54], eax
jmp 0x40f9e5
lea ecx, [edi + 0x6c]
mov dword [esp + 0x54], ecx
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x40f9ef
lea ebx, [edi + 0x6c]
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov edx, dword [edi + 0x10]
push eax
mov eax, dword [esp + 0x58]
push edx
push eax
push 0x12
lea ecx, [esp + 0x50c0]
push ecx
mov edx, dword [esp + 0x98]
mov ecx, ebx
call fcn.004366a0
cmp byte [edi + 0x6a], 0
je 0x40fa48
cmp dword [esp + 0x8c], 0
jl 0x40fa48
jg 0x40fa35
cmp dword [esp + 0x88], 0
jbe 0x40fa48
or ebx, 0xffffffff
add dword [esp + 0x88], ebx
adc dword [esp + 0x8c], ebx
jmp 0x40fa4b
or ebx, 0xffffffff
cmp byte [edi + 0x43], 0
je 0x40fb31
push str.Gaming_process_ended_1
call fcn.004261a0
mov esi, dword [esp + 0x98]
add esp, 4
test esi, esi
jl 0x40fa8b
jg 0x40fa79
cmp dword [esp + 0x90], 0
jbe 0x40fa8b
add dword [esp + 0x90], ebx
adc esi, ebx
mov dword [esp + 0x94], esi
jmp 0x40fa98
push str.WARNING:_Auto_gaming_mode_process_count_incorrect
call fcn.004261a0
add esp, 4
cmp dword [esp + 0x90], 0
jne 0x40fb31
test esi, esi
jne 0x40fb31
push str.Gaming_count_now_zero__disabling_gaming_mode
call fcn.004261a0
add esp, 4
lea edi, [esp + 0x460]
call fcn.0045dcc0
call fcn.00407fb0
cmp byte [esp + 0x3aa2], 0
mov edi, dword [esp + 0x20]
mov byte [esp + 0x33], 0
jne 0x40fb31
mov eax, dword [edi]
mov edx, dword [0x4c85d0]
mov dword [esp + 0x84], edx
test eax, eax
jne 0x40faf5
lea eax, [edi + 0x6c]
mov ebx, dword [edi + 8]
mov dword [esp + 0x54], eax
test ebx, ebx
jne 0x40fb03
lea ebx, [edi + 0x6c]
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x54]
push eax
push ecx
push edx
mov edx, dword [esp + 0x90]
push 0x1a
lea eax, [esp + 0x50c0]
push eax
mov ecx, ebx
call fcn.004366a0
mov edi, dword [esp + 0x20]
cmp byte [edi + 0x50], 0
je 0x40fc88
dec dword [esp + 0xc4]
jne 0x40fb49
call fcn.004025c0
cmp byte [0x4cb970], 0
je 0x40fb66
lea ecx, [esp + 0x248]
push ecx
push 0
call dword [0x4c7d90]
test eax, eax
je 0x40fbc7
cmp byte [esp + 0x3aa2], 0
jne 0x40fc4e
cmp byte [esp + 0x3aa5], 0
je 0x40fc4e
mov eax, dword [edi]
test eax, eax
je 0x40fb8e
mov dword [esp + 0x54], eax
jmp 0x40fb95
lea edx, [edi + 0x6c]
mov dword [esp + 0x54], edx
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x40fb9f
lea ebx, [edi + 0x6c]
push 0
mov esi, 0x4c85fc
call fcn.00402b80
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x58]
push ecx
push edx
lea ecx, [esp + 0x50bc]
push 0x1f
push ecx
mov edx, eax
mov ecx, ebx
jmp 0x40fc49
lea edx, [esp + 0x248]
push edx
push 0x4cb970
lea eax, [esp + 0x50]
call fcn.00426e70
test al, al
jne 0x40fbef
mov edx, str._UNKNOWN_
lea edi, [esp + 0x48]
call fcn.00402c40
mov eax, dword [esp + 0x48]
mov ecx, dword [0x4c85dc]
push eax
push ecx
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
cmp byte [esp + 0x3aa2], 0
jne 0x40fc4e
cmp byte [esp + 0x3aa5], 0
je 0x40fc4e
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, ecx
test ecx, ecx
jne 0x40fc2a
lea edx, [eax + 0x6c]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40fc34
lea ecx, [eax + 0x6c]
mov eax, dword [eax + 0x10]
push 0
push eax
push edx
lea edx, [esp + 0x50bc]
push 0x1e
push edx
mov edx, dword [esp + 0x3c]
call fcn.004366a0
mov ecx, dword [0x4c8704]
mov eax, dword [ecx]
mov dword [esp + 0x38], eax
cmp eax, ecx
je 0x40fc7c
mov edi, edi
mov eax, dword [eax + 0x10]
mov byte [eax + 0x50], 0
lea eax, [esp + 0x38]
call fcn.004184b0
mov eax, dword [esp + 0x38]
cmp eax, dword [0x4c8704]
jne 0x40fc60
lea esi, [esp + 0xa08]
call fcn.0044b740
cmp byte [esp + 0x3aa2], 0
jne 0x40ff03
cmp byte [esp + 0x3a74], 0
je 0x40ff03
xor eax, eax
lea ecx, [esp + 0x158]
mov dword [esp + 0x1c8], eax
mov dword [esp + 0x1cc], eax
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], eax
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov eax, dword [esp + 0x20]
mov esi, dword [eax + 0xc]
push ecx
lea edx, [esp + 0x1cc]
push edx
lea edi, [esp + 0x1d8]
lea ebx, [esp + 0x1e8]
call fcn.004591e0
mov esi, dword [esp + 0x158]
mov edi, dword [esp + 0x15c]
xor ebx, ebx
cmp esi, ebx
jne 0x40fd4a
cmp edi, ebx
jne 0x40fd4a
lea ecx, [esp + 0x338]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov esi, dword [esp + 0x338]
mov edi, dword [esp + 0x33c]
mov dword [esp + 0x158], esi
mov dword [esp + 0x15c], edi
mov ecx, dword [esp + 0x1cc]
cmp edi, ecx
jb 0x40fd7a
mov eax, dword [esp + 0x1c8]
ja 0x40fd62
cmp esi, eax
jb 0x40fd7a
sub esi, eax
sbb edi, ecx
mov edx, esi
or edx, edi
mov dword [esp + 0x1d8], esi
mov dword [esp + 0x1dc], edi
jne 0x40fd8f
mov esi, 1
xor edi, edi
mov dword [esp + 0x1d8], esi
mov dword [esp + 0x1dc], edi
mov eax, dword [esp + 0x1d0]
add eax, dword [esp + 0x1e0]
mov ecx, dword [esp + 0x1d4]
adc ecx, dword [esp + 0x1e4]
push ebx
push 0x64
push ecx
push eax
call fcn.00492bc0
mov dword [esp + 0x340], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [esp + 0x344], edx
fild qword [esp + 0x340]
mov edx, dword [esp + 0x114]
and eax, 0x80000000
push edi
mov dword [esp + 0x3c8], eax
mov dword [esp + 0x3c4], ebx
fild qword [esp + 0x3c4]
push esi
push ebx
push edx
fchs
faddp st(1)
call fcn.00492bc0
mov dword [esp + 0x370], eax
mov eax, edx
and eax, 0x80000000
and edx, 0x7fffffff
mov dword [esp + 0x3bc], eax
mov dword [esp + 0x374], edx
fild qword [esp + 0x370]
mov dword [esp + 0x3b8], ebx
fild qword [esp + 0x3b8]
fchs
faddp st(1)
fdivp st(1)
fstp dword [esp + 0x34]
fld dword [esp + 0x34]
fld qword [0x4ba780]
fmul st(1), st(0)
fxch st(1)
fstp dword [esp + 0x34]
fld dword [esp + 0x34]
fnstcw word [esp + 0x34]
movzx eax, word [esp + 0x34]
or eax, 0xc00
mov dword [esp + 0x180], eax
fldcw word [esp + 0x180]
fistp qword [esp + 0x180]
mov eax, dword [esp + 0x180]
fldcw word [esp + 0x34]
fild dword [esp + 0x180]
test eax, eax
jns 0x40fe96
fadd dword [0x4ba790]
fdivrp st(1)
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x1dc]
push edx
fstp dword [esp + 0x188]
call fcn.00408240
fld dword [esp + 0x188]
mov eax, dword [esp + 0x50]
fstp qword [esp]
mov ecx, dword [0x4c8698]
push eax
push ecx
lea edi, [esp + 0x38]
call fcn.004020e0
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
add esp, 0x10
cmp eax, ebx
jne 0x40fee0
lea eax, [edx + 0x6c]
mov ecx, dword [edx + 8]
cmp ecx, ebx
jne 0x40feea
lea ecx, [edx + 0x6c]
mov edx, dword [edx + 0x10]
push ebx
push edx
mov edx, dword [esp + 0x30]
push eax
push 0x4d
lea eax, [esp + 0x50c0]
push eax
call fcn.004366a0
lea eax, [esp + 0x13c]
lea edi, [esp + 0x1b8]
call fcn.00416440
lea eax, [esp + 0xe8]
call fcn.00401ea0
lea eax, [esp + 0x140]
mov byte [esp + 0xa93c], 0x28
call fcn.00401ea0
lea eax, [esp + 0x13c]
call fcn.004184b0
mov eax, dword [esp + 0x13c]
cmp eax, dword [0x4c8704]
jne 0x40f6a3
test byte [0x4cbbd0], 1
jne 0x40ff7c
or dword [0x4cbbd0], 1
mov esi, 0x4cbba8
call fcn.00401e80
push 0x4a44b0
call fcn.00472a86
add esp, 4
lea eax, [esp + 0x3f8]
call fcn.0043a150
cmp al, 1
jne 0x413055
push str.The_user_has_invoked_a_new_EnergyBooster_profile__or_left_the_current_one_
call fcn.004261a0
add esp, 4
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0x418a]
push eax
mov word [esp + 0x418c], dx
call fcn.00479dd0
add esp, 0xc
lea esi, [esp + 0xc8]
call fcn.00401e80
lea edx, [esp + 0x2bc]
push edx
push 0x101
xor ecx, ecx
push ecx
push str.SoftwareioloGovernor
mov byte [esp + 0xa94c], 0x36
push reloc.OLEAUT32.dll_SysReAllocString
mov word [esp + 0x4194], cx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412f89
push str.ManualEngageProfile
lea esi, [esp + 0x2c0]
mov eax, 0x100
lea edx, [esp + 0x4184]
call fcn.004267e0
cmp al, 1
jne 0x412f89
cmp word [esp + 0x4180], 0
je 0x412f89
lea eax, [esp + 0x4180]
push eax
push str.User_induced_profile__s
call fcn.004261a0
add esp, 8
lea esi, [esp + 0xc8]
call fcn.00439cc0
test al, al
je 0x4100a3
lea ecx, [esp + 0x3f8]
push ecx
call fcn.00438900
mov edx, dword [esp + 0xc8]
push edx
push str.Leaving_EnergyBooster_Profile__s._energyboooster
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [esp + 0x2c]
push eax
push 0x4ab2fc
push 0x57
lea eax, [esp + 0x50c0]
push eax
xor ecx, ecx
call fcn.004366a0
push 0
lea ecx, [esp + 0x4184]
push ecx
lea edx, [esp + 0x400]
push edx
call fcn.00438720
mov byte [0x4cbb6c], 1
jmp 0x413041
mov eax, dword [edi + 4]
mov ecx, eax
test eax, eax
jne 0x4100d2
lea ecx, [edi + 0x6c]
test ecx, ecx
je 0x4100e7
test eax, eax
jne 0x4100dd
lea eax, [edi + 0x6c]
cmp word [eax], 0
jne 0x410203
movzx eax, word [edi + 0x6e]
cmp eax, 5
jae 0x410203
mov ecx, dword [edi + 0xc]
inc eax
mov word [edi + 0x6e], ax
call fcn.004567c0
mov esi, eax
call fcn.0040bbf0
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 4]
test eax, eax
jne 0x410116
lea eax, [ecx + 0x6c]
cmp word [eax], 0
jne 0x410127
cmp word [ecx + 0x6e], 5
jb 0x4101ff
cmp byte [esp + 0x3a6e], 0
je 0x4101ff
cmp byte [esp + 0x3aa2], 0
jne 0x4101ff
mov esi, dword [esp + 0x24]
call fcn.00456a40
mov edi, dword [esp + 0x20]
mov eax, dword [edi + 0xc]
call fcn.00459c60
mov esi, eax
cmp esi, 0xffffffff
je 0x4101be
cmp dword [0x4c8708], 0
je 0x4101be
mov edx, str.UNKNOWN_PARENT__beyond_scope__
lea edi, [esp + 0x28]
call fcn.00402c40
lea ebx, [esp + 0x3c]
lea eax, [esp + 0x288]
mov dword [esp + 0x3c], esi
call fcn.00416350
mov eax, dword [esp + 0x288]
cmp eax, dword [0x4c8704]
je 0x4101ba
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
test ecx, ecx
jne 0x4101a5
lea ecx, [eax + 0x6c]
push esi
push ecx
mov ecx, dword [0x4c865c]
push ecx
lea edi, [esp + 0x34]
call fcn.004020e0
add esp, 0xc
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov ebx, eax
test eax, eax
jne 0x4101c9
lea ebx, [edi + 0x6c]
mov eax, dword [edi + 8]
test eax, eax
je 0x4101d4
mov edi, eax
jmp 0x4101d7
add edi, 0x6c
mov esi, dword [esp + 0x24]
call fcn.00456a40
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [edx + 0x10]
mov edx, dword [esp + 0x2c]
push eax
push ebx
push 1
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, edi
call fcn.004366a0
mov edi, dword [esp + 0x20]
mov eax, dword [edi + 4]
mov ecx, eax
test eax, eax
jne 0x41020f
lea ecx, [edi + 0x6c]
mov eax, dword [edi]
test eax, eax
jne 0x410218
lea eax, [edi + 0x6c]
push ecx
push eax
lea ebx, [esp + 0x308]
call fcn.004068f0
cmp byte [esp + 0x73], 0
jne 0x4104ad
mov eax, dword [esp + 0x68]
cmp dword [edi + 0x10], eax
jne 0x4104ad
cmp byte [esp + 0x72], 0
je 0x4104ad
cmp dword [esp + 0xc0], 0
je 0x4104ad
cmp byte [esp + 0x3a77], 0
mov byte [esp + 0x73], 1
je 0x4104ad
mov esi, dword [esp + 0xcc]
cmp eax, esi
je 0x4104ad
push str.boosting_foreground_process
call fcn.004261a0
add esp, 4
cmp esi, 0xffffffff
je 0x4102d8
test esi, esi
je 0x4102d8
push str.undoing_last_foreground_process_boost
call fcn.004261a0
add esp, 4
push esi
push 0
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x4102c0
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.00425660
jmp 0x4102cd
push str.undoing_last_forreground_process_boost__process_terminated__
call fcn.004261a0
add esp, 4
mov dword [esp + 0xcc], 0xffffffff
mov eax, dword [edi + 8]
mov ecx, eax
test eax, eax
jne 0x4102e4
lea ecx, [edi + 0x6c]
mov eax, dword [edi]
test eax, eax
jne 0x4102ed
lea eax, [edi + 0x6c]
push ecx
push eax
lea edx, [esp + 0xa10]
push edx
call fcn.00449d40
test al, al
jne 0x4104ad
mov eax, dword [esp + 0x68]
push eax
push 0
push 0x600
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x410382
push esi
call dword [sym.imp.KERNEL32.dll_GetPriorityClass]
cmp eax, 0x20
jne 0x41036e
push str.pg:_boosting_foreground_process
call fcn.004261a0
mov ecx, dword [esp + 0xc4]
mov edx, dword [esp + 0x6c]
add esp, 4
push str.Setting_priority_class_of_foreground_window.
mov dword [esp + 0x10c], ecx
mov dword [esp + 0xd0], edx
call fcn.004261a0
add esp, 4
push 0x8000
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
call fcn.00425660
jmp 0x41038f
push str.skipping_foreground_process_boost_due_to_non_normal_priority_class
call fcn.004261a0
add esp, 4
call fcn.00425660
jmp 0x41038f
push str.boosting_new_foreground_process__process_terminated__
call fcn.004261a0
add esp, 4
cmp byte [esp + 0x3a7c], 0
je 0x4104ad
mov eax, dword [esp + 0xb0]
cmp dword [esp + 0x154], eax
je 0x4104ad
mov esi, eax
cmp esi, 0xffffffff
je 0x410420
test esi, esi
je 0x410420
push str.pg:_undoing_last_foreground_thread_boost
call fcn.004261a0
add esp, 4
push esi
push 0
push 0x20
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x410408
push str.pg:_restoring_foreground_thread_priority_to_original.
call fcn.004261a0
add esp, 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x410401
push str.pg:_Error_restoring_thread_priority.
call fcn.004261a0
add esp, 4
call fcn.00425660
jmp 0x410415
push str.pg.error:_undoing_last_foreground_thread_boost__thread_terminated__
call fcn.004261a0
add esp, 4
mov dword [esp + 0xb0], 0xffffffff
mov ebx, dword [esp + 0x154]
push ebx
push 0
push 0x60
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x4104a0
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
test eax, eax
jne 0x410486
mov ecx, dword [esp + 0xc0]
push str.setting_thread_priority_of_foreground_window_backing_thread
mov dword [esp + 0x10c], ecx
mov dword [esp + 0xb4], ebx
call fcn.004261a0
add esp, 4
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x410499
push str.ERROR_setting_thread_priority.
call fcn.004261a0
add esp, 4
call fcn.00425660
jmp 0x4104ad
push SysReAllocString
push eax
push str.skipping_foreground_thread_boost__non_normal_priority__thread___d_pri__err:__d_
call fcn.004261a0
add esp, 0xc
call fcn.00425660
jmp 0x4104ad
push str.error_opening_foreground_thread.
call fcn.004261a0
add esp, 4
cmp byte [esp + 0x5b], 0
jne 0x4104ca
cmp byte [esp + 0x32], 0
jne 0x4104ca
cmp byte [esp + 0x3a81], 0
mov byte [esp + 0x1f], 0
je 0x4104cf
mov byte [esp + 0x1f], 1
cmp byte [edi + 0x3f], 0
je 0x4104eb
mov bl, byte [esp + 0x1f]
test bl, bl
je 0x41087a
cmp byte [edi + 0x68], 0
jne 0x410876
lea edx, [esp + 0x3c24]
push edx
mov byte [edi + 0x3f], 1
mov byte [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea esi, [esp + 0x28]
call fcn.00402b20
lea esi, [esp + 0xe0]
call fcn.00401e80
lea esi, [esp + 0xf8]
call fcn.00401e80
mov byte [esp + 0xa93c], 0x2c
mov ecx, dword [esp + 0x3ce8]
mov eax, dword [esp + 0x3ce4]
sub ecx, eax
sar ecx, 2
mov dword [esp + 0x34], 0
test ecx, ecx
je 0x41073b
mov edi, edi
mov edx, dword [esp + 0x34]
push ecx
lea eax, [eax + edx*4]
mov esi, esp
lea ebx, [esp + 0xfc]
mov dword [esp + 0xa8], esp
call fcn.00403770
mov ecx, ebx
lea ebx, [esp + 0xe4]
call fcn.0042f630
mov esi, dword [esp + 0xe4]
add esp, 4
cmp dword [esi - 0xc], 0
je 0x4105a0
push esi
mov ecx, edi
call fcn.0040bd00
push eax
call fcn.0042bc30
add esp, 8
test al, al
je 0x4105da
mov ecx, edi
call fcn.0040bce0
mov ebx, dword [esp + 0xf8]
push eax
push ebx
call fcn.0042bc30
add esp, 8
test al, al
jne 0x410603
cmp byte [esp + 0x3a89], al
je 0x4105da
mov ecx, edi
call fcn.0040bcf0
push eax
push ebx
call fcn.0042bc30
add esp, 8
test al, al
jne 0x410603
mov edx, dword [esp + 0x3ce8]
mov eax, dword [esp + 0x3ce4]
mov ecx, dword [esp + 0x34]
sub edx, eax
inc ecx
sar edx, 2
mov dword [esp + 0x34], ecx
cmp ecx, edx
jb 0x410550
jmp 0x41073b
push ebx
push esi
push str.pg.INFO:_disallowed_process___action_to_be_taken__s_and__s
call fcn.004261a0
mov eax, dword [esp + 0x3cf0]
mov ecx, dword [esp + 0x40]
add esp, 0xc
lea eax, [eax + ecx*4]
lea edi, [esp + 0x28]
call fcn.00406b40
push str.pg._Found_disallowed_process_....
mov byte [esp + 0x30], 1
call fcn.004261a0
mov edx, dword [esp + 0x3cdc]
mov eax, dword [esp + 0x3cd8]
sub edx, eax
sar edx, 2
add esp, 4
mov dword [esp + 0x34], 0
test edx, edx
je 0x410737
mov ecx, dword [esp + 0x34]
push ecx
lea eax, [eax + ecx*4]
mov esi, esp
lea ebx, [esp + 0xfc]
lea edi, [esp + 0xe4]
mov dword [esp + 0xa8], esp
call fcn.00403770
mov ecx, ebx
mov ebx, edi
call fcn.0042f630
mov edi, dword [esp + 0xfc]
mov esi, dword [esp + 0xe4]
add esp, 4
push edi
push esi
push str.pg._alowed_spliced_to__s_and__s
call fcn.004261a0
mov ebx, dword [esp + 0x2c]
add esp, 0xc
cmp dword [esi - 0xc], 0
je 0x4106ca
push esi
mov ecx, ebx
call fcn.0040bd00
push eax
call fcn.0042bc30
add esp, 8
test al, al
je 0x4106fd
mov ecx, ebx
call fcn.0040bce0
push eax
push edi
call fcn.0042bc30
add esp, 8
test al, al
jne 0x410723
cmp byte [esp + 0x3a89], al
je 0x4106fd
mov ecx, ebx
call fcn.0040bcf0
push eax
push edi
call fcn.0042bc30
add esp, 8
test al, al
jne 0x410723
mov edx, dword [esp + 0x3cd8]
mov eax, dword [esp + 0x3cd4]
mov ecx, dword [esp + 0x34]
sub edx, eax
inc ecx
sar edx, 2
mov dword [esp + 0x34], ecx
cmp ecx, edx
jb 0x41065e
jmp 0x410737
push edi
push esi
push str.pg._over_ridden_by_allowed_list
call fcn.004261a0
add esp, 0xc
mov byte [esp + 0x2c], 0
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x3c24]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp byte [esp + 0x2c], 0
je 0x410852
push str.Terminating_disallowed_process_....
call fcn.004261a0
mov esi, dword [esp + 0x28]
add esp, 4
push 1
call fcn.00457530
cmp byte [esp + 0x3a6f], 0
mov ecx, dword [esi + 0x484]
mov byte [esp + 0x46], al
mov dword [esp + 0x38], ecx
je 0x410852
cmp byte [esp + 0x3aa2], 0
jne 0x410852
mov eax, 0x4c860c
lea esi, [esp + 0x10c]
call fcn.00403770
mov byte [esp + 0xa93c], 0x2d
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx - 0xc]
push eax
push ecx
mov ebx, esi
call fcn.00418c50
cmp byte [esp + 0x46], 0
je 0x410805
mov eax, dword [edi + 8]
mov byte [edi + 0x68], 1
mov ebx, eax
test eax, eax
jne 0x4107d6
lea ebx, [edi + 0x6c]
mov esi, dword [esp + 0x24]
call fcn.00456a40
mov edx, dword [esp + 0x38]
push eax
push edx
call fcn.00459700
mov edx, dword [esp + 0x114]
push eax
push 4
lea eax, [esp + 0x50c0]
push eax
mov ecx, ebx
call fcn.004366a0
jmp 0x410846
cmp byte [edi + 0x53], 0
jne 0x410846
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x410815
lea ebx, [edi + 0x6c]
mov esi, dword [esp + 0x24]
call fcn.00456a40
mov ecx, dword [esp + 0x38]
push eax
push ecx
call fcn.00459700
push eax
push 5
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x120]
mov ecx, ebx
call fcn.004366a0
mov byte [edi + 0x53], 1
lea eax, [esp + 0x10c]
call fcn.00401ea0
lea eax, [esp + 0xf8]
call fcn.00401ea0
lea eax, [esp + 0xe0]
mov byte [esp + 0xa93c], 0x2a
call fcn.00401ea0
mov bl, byte [esp + 0x1f]
test bl, bl
jne 0x410895
cmp byte [esp + 0x32], 0
jne 0x410895
cmp byte [edi + 0x69], 0
jne 0x41091b
cmp byte [edi + 0x68], 0
jne 0x41091b
mov eax, dword [edi + 8]
mov byte [edi + 0x69], 1
test eax, eax
jne 0x4108a3
lea eax, [edi + 0x6c]
mov ecx, dword [edi]
test ecx, ecx
jne 0x4108ac
lea ecx, [edi + 0x6c]
push eax
push ecx
lea eax, [esp + 0xa10]
push eax
call fcn.00451b80
test al, al
je 0x4108db
cmp byte [edi + 0x6a], 0
jne 0x41091b
add dword [esp + 0x88], 1
mov byte [edi + 0x6a], 1
adc dword [esp + 0x8c], 0
jmp 0x41091b
cmp byte [edi + 0x6a], 0
je 0x41091b
cmp dword [esp + 0x8c], 0
mov byte [edi + 0x6a], 0
jl 0x41090e
jg 0x4108fb
cmp dword [esp + 0x88], 0
jbe 0x41090e
or eax, 0xffffffff
add dword [esp + 0x88], eax
adc dword [esp + 0x8c], eax
jmp 0x41091b
push str.pg.WARNING:_Auto_gaming_mode_process_count_incorrect
call fcn.004261a0
add esp, 4
test bl, bl
jne 0x410937
cmp byte [esp + 0x32], bl
jne 0x410937
cmp byte [edi + 0x4e], bl
jne 0x410abb
cmp byte [edi + 0x68], bl
jne 0x410abb
mov eax, dword [edi + 4]
mov byte [edi + 0x4e], 1
test eax, eax
je 0x410946
mov edi, eax
jmp 0x410949
add edi, 0x6c
lea eax, [esp + 0xa08]
call fcn.0044f7d0
test al, al
je 0x410a03
mov ecx, dword [esp + 0x20]
cmp byte [ecx + 0x43], 0
jne 0x410ab7
add dword [esp + 0x90], 1
mov ebx, ecx
mov byte [ebx + 0x43], 1
adc dword [esp + 0x94], 0
cmp byte [esp + 0x33], 0
jne 0x4109f9
push str.pg:_High_Perf_mode_turned_on
call fcn.004261a0
add esp, 4
lea edi, [esp + 0x460]
call fcn.0045db90
call fcn.00407f90
cmp byte [esp + 0x3aa2], 0
jne 0x4109f9
mov eax, dword [ebx]
test eax, eax
je 0x4109c0
mov dword [esp + 0x38], eax
jmp 0x4109c7
lea edx, [ebx + 0x6c]
mov dword [esp + 0x38], edx
mov edi, dword [ebx + 8]
test edi, edi
jne 0x4109d1
lea edi, [ebx + 0x6c]
push 0
mov esi, 0x4c85c8
call fcn.00402b80
mov ecx, dword [ebx + 0x10]
mov edx, dword [esp + 0x3c]
push ecx
push edx
push 0x19
lea ecx, [esp + 0x50c0]
push ecx
mov edx, eax
mov ecx, edi
call fcn.004366a0
mov byte [esp + 0x33], 1
jmp 0x410ab7
mov edx, dword [esp + 0x20]
cmp byte [edx + 0x43], 0
je 0x410ab7
mov esi, dword [esp + 0x94]
mov eax, edx
mov byte [eax + 0x43], 0
test esi, esi
jl 0x410a42
jg 0x410a2e
cmp dword [esp + 0x90], 0
jbe 0x410a42
add dword [esp + 0x90], 0xffffffff
adc esi, 0xffffffff
mov dword [esp + 0x94], esi
jmp 0x410a4f
push str.pg.WARNING:_Auto_gaming_mode_process_count_incorrect
call fcn.004261a0
add esp, 4
mov ecx, dword [esp + 0x90]
or ecx, esi
jne 0x410ab7
call fcn.00407fb0
cmp byte [esp + 0x3aa2], 0
mov byte [esp + 0x33], 0
jne 0x410ab7
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
test eax, eax
je 0x410a7e
mov dword [esp + 0x38], eax
jmp 0x410a85
lea edx, [edi + 0x6c]
mov dword [esp + 0x38], edx
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x410a8f
lea ebx, [edi + 0x6c]
push 0
mov esi, 0x4c85d0
call fcn.00402b80
mov ecx, dword [edi + 0x10]
mov edx, dword [esp + 0x3c]
push ecx
push edx
push 0x1a
lea ecx, [esp + 0x50c0]
push ecx
mov edx, eax
mov ecx, ebx
call fcn.004366a0
mov edi, dword [esp + 0x20]
cmp byte [esp + 0x6f], 0
je 0x410c59
cmp byte [esp + 0x32], 0
jne 0x410ad8
cmp byte [esp + 0x1f], 0
je 0x410ebd
mov ecx, dword [edi + 0xc]
call fcn.004567c0
mov ecx, dword [edi]
test ecx, ecx
jne 0x410ae9
lea ecx, [edi + 0x6c]
lea edx, [esp + 0x270]
push edx
push eax
push ecx
lea ebx, [esp + 0xa14]
call fcn.00451560
mov byte [edi + 0x4f], al
test al, al
je 0x410c59
cmp byte [edi + 0x50], 0
jne 0x410b3c
cmp dword [esp + 0xc4], 0
jne 0x410b3c
cmp byte [0x4cb970], 0
je 0x410b2f
lea esi, [esp + 0x248]
call fcn.00427140
lea eax, [esp + 0x248]
push eax
call fcn.00402550
lea eax, [edi + 0x58]
lea esi, [esp + 0x270]
mov edx, 0x10
mov ecx, eax
sub esi, eax
nop
mov ebx, dword [ecx + esi]
cmp ebx, dword [ecx]
jne 0x410b6c
sub edx, 4
add ecx, 4
cmp edx, 4
jae 0x410b50
cmp byte [edi + 0x50], 0
jne 0x410c59
cmp byte [edi + 0x50], 0
jne 0x410b79
inc dword [esp + 0xc4]
mov ecx, dword [esp + 0x270]
mov edx, dword [esp + 0x274]
mov dword [eax], ecx
mov ecx, dword [esp + 0x278]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x27c]
mov dword [eax + 8], ecx
mov byte [edi + 0x50], 1
mov dword [eax + 0xc], edx
cmp byte [0x4cb970], 0
je 0x410d42
lea eax, [esp + 0x270]
push eax
push 0
call dword [0x4c7d90]
test eax, eax
jne 0x410d42
lea ecx, [esp + 0x270]
push ecx
push 0x4cb970
lea eax, [esp + 0x30]
call fcn.00426e70
test al, al
jne 0x410bf1
mov edx, str._UNKNOWN_
lea edi, [esp + 0x28]
call fcn.00402c40
mov edi, dword [0x4c85f4]
lea esi, [esp + 0x28]
call fcn.00402b80
push eax
push edi
lea edi, [esp + 0x50]
call fcn.004020e0
add esp, 8
cmp byte [esp + 0x3aa2], 0
jne 0x410c55
cmp byte [esp + 0x3aa5], 0
je 0x410c55
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
mov edx, ecx
test ecx, ecx
jne 0x410c31
lea edx, [eax + 0x6c]
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x410c3b
lea ecx, [eax + 0x6c]
mov eax, dword [eax + 0x10]
push 0
push eax
push edx
push 0x1c
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x5c]
call fcn.004366a0
mov edi, dword [esp + 0x20]
cmp byte [esp + 0x1f], 0
jne 0x410c75
cmp byte [esp + 0x32], 0
je 0x410ebd
cmp byte [edi + 0x68], 0
jne 0x410ebd
cmp byte [esp + 0x70], 0
jne 0x410c81
mov byte [esp + 0x70], 1
mov ebx, dword [edi]
test ebx, ebx
jne 0x410c8a
lea ebx, [edi + 0x6c]
lea edi, [esp + 0xa08]
call fcn.00450080
mov esi, dword [esp + 0x20]
mov byte [esp + 0x46], al
mov eax, dword [esi]
test eax, eax
jne 0x410ca7
lea eax, [esi + 0x6c]
mov ebx, eax
lea edi, [esp + 0xa08]
call fcn.0044feb0
mov byte [esp + 0x2c], al
mov eax, dword [esi]
test eax, eax
jne 0x410cc2
lea eax, [esi + 0x6c]
mov ebx, eax
lea edi, [esp + 0xa08]
call fcn.00450250
mov bl, byte [esp + 0x46]
xor ecx, ecx
mov byte [esp + 0x34], al
cmp bl, cl
jne 0x410e36
cmp byte [esp + 0x2c], cl
jne 0x410e36
cmp al, cl
jne 0x410e36
cmp byte [esi + 0x45], cl
jne 0x410d06
cmp byte [esi + 0x46], cl
je 0x410eb9
mov esi, dword [esp + 0x20]
dec dword [0x4c7d68]
mov word [esi + 0x45], 0
mov byte [esi + 0x47], cl
jne 0x410dd3
cmp byte [esp + 0x3aa2], cl
jne 0x410eb9
mov edi, dword [esp + 0x20]
mov eax, dword [edi]
mov ecx, dword [0x4c8640]
mov dword [esp + 0x3c], ecx
test eax, eax
je 0x410d96
mov dword [esp + 0x38], eax
jmp 0x410d9d
cmp byte [edi + 0x52], 0
jne 0x410c59
cmp byte [esp + 0x3aa2], 0
jne 0x410d8d
cmp byte [esp + 0x3aa5], 0
je 0x410d8d
mov eax, dword [edi]
test eax, eax
jne 0x410d69
lea eax, [edi + 0x6c]
mov ecx, dword [edi + 8]
test ecx, ecx
jne 0x410d73
lea ecx, [edi + 0x6c]
mov edx, dword [edi + 0x10]
push 0
push edx
mov edx, dword [esp + 0x50]
push eax
push 0x1d
lea eax, [esp + 0x50c0]
push eax
call fcn.004366a0
mov byte [edi + 0x52], 1
jmp 0x410c59
lea edx, [edi + 0x6c]
mov dword [esp + 0x38], edx
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x410da7
lea ebx, [edi + 0x6c]
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov ecx, dword [esp + 0x38]
push eax
mov eax, dword [edi + 0x10]
push eax
push ecx
push 0x11
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x50]
mov ecx, ebx
call fcn.004366a0
jmp 0x410eb9
cmp byte [esp + 0x3aa2], cl
jne 0x410eb9
mov eax, dword [0x4c8674]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [edi]
test eax, eax
je 0x410df9
mov dword [esp + 0x38], eax
jmp 0x410e00
lea ecx, [edi + 0x6c]
mov dword [esp + 0x38], ecx
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x410e0a
lea ebx, [edi + 0x6c]
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov edx, dword [edi + 0x10]
push eax
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x44]
push eax
push 0x12
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, ebx
call fcn.004366a0
jmp 0x410eb9
cmp byte [esi + 0x45], cl
jne 0x410eac
cmp byte [esi + 0x46], cl
jne 0x410eac
cmp byte [esi + 0x47], cl
jne 0x410eac
inc dword [0x4c7d68]
cmp byte [esp + 0x3aa2], cl
jne 0x410eac
mov eax, dword [esi]
mov edx, dword [0x4c85b4]
mov dword [esp + 0x3c], edx
cmp eax, ecx
jne 0x410e6b
lea eax, [esi + 0x6c]
mov edi, dword [esi + 8]
mov dword [esp + 0x38], eax
cmp edi, ecx
jne 0x410e79
lea edi, [esi + 0x6c]
mov esi, dword [esi + 0xc]
call fcn.00456a40
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + 0x10]
push eax
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x44]
push eax
push 0x10
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, edi
call fcn.004366a0
mov esi, dword [esp + 0x20]
mov al, byte [esp + 0x34]
mov dl, byte [esp + 0x2c]
mov byte [esi + 0x45], bl
mov byte [esi + 0x46], dl
mov byte [esi + 0x47], al
mov edi, dword [esp + 0x20]
cmp byte [esp + 0x7b], 0
jne 0x410ef1
cmp byte [edi + 0x68], 0
jne 0x410ef1
cmp byte [edi + 0x45], 0
je 0x410ed4
push 3
jmp 0x410eeb
cmp byte [edi + 0x46], 0
je 0x410ee3
mov byte [esp + 0x7b], 1
push 2
jmp 0x410eeb
cmp byte [edi + 0x47], 0
je 0x410ef1
push 1
call dword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
cmp byte [esp + 0x1f], 0
je 0x411016
cmp byte [edi + 0x68], 0
jne 0x411016
mov eax, dword [edi]
xor ebx, ebx
cmp eax, ebx
jne 0x410f11
lea eax, [edi + 0x6c]
call fcn.0045c070
test al, al
je 0x410f44
mov eax, dword [edi]
cmp eax, ebx
je 0x410f24
mov edi, eax
jmp 0x410f27
add edi, 0x6c
push edi
lea edi, [esp + 0xa0c]
call fcn.00451040
mov edi, dword [esp + 0x20]
test al, al
jne 0x410f44
mov eax, edi
mov byte [eax + 0x40], 1
jmp 0x410f7d
mov eax, dword [edi + 4]
mov edx, eax
cmp eax, ebx
jne 0x410f50
lea edx, [edi + 0x6c]
mov eax, dword [edi + 8]
mov ecx, eax
cmp eax, ebx
jne 0x410f5c
lea ecx, [edi + 0x6c]
mov eax, dword [edi]
cmp eax, ebx
jne 0x410f65
lea eax, [edi + 0x6c]
push edx
push ecx
push eax
lea ecx, [esp + 0xa14]
push ecx
call fcn.004499a0
test al, al
je 0x410f7d
mov byte [edi + 0x40], 1
cmp byte [edi + 0x3c], bl
je 0x411018
cmp byte [edi + 0x40], bl
je 0x411018
mov edx, dword [edi + 0x30]
or edx, dword [edi + 0x34]
mov esi, dword [esp + 0x24]
je 0x410fc1
mov eax, esi
call fcn.00458be0
cmp eax, dword [edi + 0x28]
jne 0x410fbb
cmp edx, dword [edi + 0x2c]
jne 0x410fbb
mov eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x30]
push eax
push ecx
mov eax, esi
call fcn.00458c60
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
cmp byte [edi + 0x3d], bl
je 0x411011
mov eax, esi
call fcn.00457130
cmp eax, dword [edi + 0x24]
jne 0x410fea
mov edi, dword [edi + 0x20]
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x3d4]
push edx
call fcn.00457190
mov edi, dword [esp + 0x20]
movzx eax, byte [edi + 0x48]
mov edi, dword [esp + 0x24]
push eax
call fcn.00457ae0
mov esi, dword [esp + 0x20]
mov eax, dword [esi + 0x70]
cmp eax, 0xffffffff
je 0x41100a
push eax
call fcn.00459830
mov edi, dword [esp + 0x20]
mov byte [esi + 0x3d], bl
mov byte [edi + 0x3c], bl
jmp 0x411018
xor ebx, ebx
cmp byte [esp + 0x3a21], 0
mov dword [esp + 0x64], ebx
jne 0x411036
lea eax, [esp + 0x3d04]
call fcn.00415a30
test eax, eax
je 0x411044
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x64]
push ecx
call fcn.00456ec0
cmp byte [esp + 0x1f], 0
jne 0x411057
cmp byte [edi + 0x41], 0
jne 0x4111e6
xor ebx, ebx
mov byte [edi + 0x41], 1
mov edx, dword [esp + 0x3da8]
mov eax, dword [esp + 0x3da4]
sub edx, eax
sar edx, 2
mov dword [esp + 0x34], ebx
test edx, edx
je 0x4111e6
lea ebx, [ebx]
mov ecx, dword [esp + 0x34]
lea esi, [eax + ecx*4]
mov ecx, edi
call fcn.0040bce0
push eax
call fcn.00402b80
push eax
call fcn.0042bc30
add esp, 8
test al, al
jne 0x4110da
cmp byte [esp + 0x3a89], al
je 0x4111c2
mov edx, dword [esp + 0x3da4]
mov eax, dword [esp + 0x34]
mov ecx, edi
lea esi, [edx + eax*4]
call fcn.0040bcf0
push eax
call fcn.00402b80
push eax
call fcn.0042bc30
add esp, 8
test al, al
je 0x4111c2
mov ecx, dword [edi + 0x10]
push ecx
push str.pg.DefaultAffinity:_Found_match_for_default_affintiy_in_PID__u
call fcn.004261a0
mov edx, dword [esp + 0x3dbc]
mov eax, dword [esp + 0x3c]
mov ebx, dword [edx + eax*8]
push 0x100
lea ecx, [esp + 0x890c]
push ecx
xor esi, esi
push esi
push ebx
call fcn.0042bf10
mov eax, dword [esp + 0x3c]
add esp, 0x18
call fcn.00458be0
cmp eax, ebx
jne 0x411124
cmp edx, esi
je 0x4111c2
lea esi, [esp + 0x164]
call fcn.00401e80
xor eax, eax
push eax
push ebx
mov byte [esp + 0xa944], 0x2e
call fcn.0042c010
add esp, 8
test ebx, ebx
je 0x4111ae
xor eax, eax
push eax
mov eax, dword [esp + 0x28]
push ebx
call fcn.00458c60
test al, al
je 0x4111ae
push str.pg._set_default_affinity_mask.
call fcn.004261a0
add esp, 4
cmp byte [esp + 0x3a75], 0
je 0x4111ae
cmp byte [esp + 0x3aa2], 0
jne 0x4111ae
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov edx, dword [edi + 0x10]
push eax
push edx
mov ecx, edi
call fcn.0040bce0
push eax
mov ecx, edi
call fcn.0040bd00
mov edx, dword [esp + 0x170]
push 0x15
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, eax
call fcn.004366a0
lea eax, [esp + 0x164]
mov byte [esp + 0xa93c], 0x2a
call fcn.00401ea0
mov edx, dword [esp + 0x3da8]
mov eax, dword [esp + 0x3da4]
mov ecx, dword [esp + 0x34]
sub edx, eax
inc ecx
sar edx, 2
mov dword [esp + 0x34], ecx
cmp ecx, edx
jb 0x411080
cmp byte [edi + 0x3e], 0
je 0x411201
cmp byte [esp + 0x1f], 0
je 0x41142a
cmp byte [edi + 0x68], 0
jne 0x41142a
mov byte [edi + 0x3e], 1
mov ecx, dword [esp + 0x3d88]
mov eax, dword [esp + 0x3d84]
sub ecx, eax
xor ebx, ebx
sar ecx, 2
mov dword [esp + 0x34], ebx
test ecx, ecx
je 0x411378
mov ecx, edi
lea esi, [eax + ebx*4]
call fcn.0040bce0
push eax
call fcn.00402b80
push eax
call fcn.0042bc30
add esp, 8
test al, al
jne 0x411278
cmp byte [esp + 0x3a89], al
je 0x411358
mov edx, dword [esp + 0x3d84]
mov ecx, edi
lea esi, [edx + ebx*4]
call fcn.0040bcf0
push eax
call fcn.00402b80
push eax
call fcn.0042bc30
add esp, 8
test al, al
je 0x411358
mov eax, dword [esp + 0x24]
call fcn.00457130
mov ecx, dword [esp + 0x3d94]
cmp eax, dword [ecx + ebx*4]
lea esi, [ebx*4]
je 0x411358
push str.pg:_found_default_priority_class__change_required..
call fcn.004261a0
mov eax, dword [esp + 0x3d98]
mov edi, dword [eax + esi]
mov eax, dword [esp + 0x28]
add esp, 4
lea edx, [esp + 0x3dc]
push edx
call fcn.00457190
cmp byte [esp + 0x3a71], 0
je 0x411354
cmp byte [esp + 0x3aa2], 0
jne 0x411354
mov ecx, dword [esp + 0x3d94]
mov esi, dword [ecx + esi]
call fcn.0043e440
lea edx, [esp + 0x198]
push edx
mov ecx, eax
call fcn.00402ba0
mov edi, dword [esp + 0x20]
mov byte [esp + 0xa93c], 0x2f
mov esi, dword [edi + 0xc]
mov ebx, dword [esp + 0x198]
call fcn.00456a40
push eax
mov eax, dword [edi + 0x10]
push eax
mov ecx, edi
call fcn.0040bce0
push eax
mov ecx, edi
call fcn.0040bd00
push 0x16
lea ecx, [esp + 0x50c0]
push ecx
mov edx, ebx
mov ecx, eax
call fcn.004366a0
lea eax, [esp + 0x198]
mov byte [esp + 0xa93c], 0x2a
call fcn.00401ea0
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x3d88]
mov eax, dword [esp + 0x3d84]
sub edx, eax
inc ebx
sar edx, 2
mov dword [esp + 0x34], ebx
cmp ebx, edx
jb 0x411226
mov eax, dword [edi]
test eax, eax
jne 0x411381
lea eax, [edi + 0x6c]
mov ebx, eax
lea edi, [esp + 0xa08]
call fcn.00451680
test al, al
je 0x411426
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
call fcn.00457ca0
test al, al
je 0x411426
mov ecx, dword [esp + 0x20]
cmp byte [ecx + 0x68], 0
jne 0x411426
mov edx, ecx
mov edi, dword [edx + 0xc]
push 0
call fcn.00457ae0
cmp byte [esp + 0x3a71], 0
je 0x411426
cmp byte [esp + 0x3aa2], 0
jne 0x411426
mov eax, dword [0x4c8598]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [edi]
test eax, eax
je 0x4113ee
mov dword [esp + 0x38], eax
jmp 0x4113f5
lea ecx, [edi + 0x6c]
mov dword [esp + 0x38], ecx
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x4113ff
lea ebx, [edi + 0x6c]
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov edx, dword [edi + 0x10]
push eax
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x44]
push eax
push 0x4c
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, ebx
call fcn.004366a0
mov edi, dword [esp + 0x20]
call fcn.0042ded0
test al, al
je 0x41164f
cmp byte [edi + 0x4c], 0
je 0x41145c
cmp byte [esp + 0x1f], 0
jne 0x41145c
cmp byte [esp + 0x3a81], 0
je 0x411562
cmp byte [edi + 0x68], 0
jne 0x411562
mov eax, dword [edi + 4]
mov byte [edi + 0x4c], 1
test eax, eax
jne 0x41146a
lea eax, [edi + 0x6c]
mov ecx, dword [edi]
test ecx, ecx
je 0x411474
mov edi, ecx
jmp 0x411477
add edi, 0x6c
push eax
push edi
lea edi, [esp + 0xa10]
call fcn.00452020
mov edi, eax
mov dword [esp + 0x3c], edi
test edi, edi
js 0x41155e
mov ebx, dword [esp + 0x20]
mov esi, dword [ebx + 0xc]
call fcn.00459c30
mov esi, eax
cmp esi, edi
je 0x41155e
push edi
mov edi, dword [ebx + 0xc]
call fcn.00459bb0
lea edi, [esp + 0x28]
test al, al
je 0x41150c
mov edx, dword [esp + 0x3c]
push edx
push 0x4acf38
call fcn.004020e0
mov eax, dword [ebx]
add esp, 8
test eax, eax
jne 0x4114d5
lea eax, [ebx + 0x6c]
mov edi, dword [ebx + 8]
mov dword [esp + 0x38], eax
test edi, edi
jne 0x4114e3
lea edi, [ebx + 0x6c]
mov esi, dword [ebx + 0xc]
call fcn.00456a40
push eax
lea esi, [esp + 0x2c]
call fcn.00402b80
mov ecx, dword [ebx + 0x10]
mov edx, dword [esp + 0x3c]
push ecx
push edx
push 0x35
lea ecx, [esp + 0x50c0]
push ecx
mov edx, eax
jmp 0x411557
push esi
push 0x4acf38
call fcn.004020e0
mov eax, dword [ebx]
add esp, 8
test eax, eax
je 0x411526
mov dword [esp + 0x38], eax
jmp 0x41152d
lea edx, [ebx + 0x6c]
mov dword [esp + 0x38], edx
mov edi, dword [ebx + 8]
test edi, edi
jne 0x411537
lea edi, [ebx + 0x6c]
mov esi, dword [ebx + 0xc]
call fcn.00456a40
mov ecx, dword [esp + 0x38]
push eax
mov eax, dword [ebx + 0x10]
push eax
push ecx
lea edx, [esp + 0x50bc]
push 0x36
push edx
mov edx, dword [esp + 0x3c]
mov ecx, edi
call fcn.004366a0
mov edi, dword [esp + 0x20]
cmp byte [edi + 0x4b], 0
je 0x41157d
cmp byte [esp + 0x1f], 0
jne 0x41157d
cmp byte [esp + 0x3a81], 0
je 0x41164f
mov eax, dword [edi + 4]
mov byte [edi + 0x4b], 1
test eax, eax
jne 0x41158b
lea eax, [edi + 0x6c]
mov ecx, dword [edi]
test ecx, ecx
je 0x411595
mov edi, ecx
jmp 0x411598
add edi, 0x6c
push eax
push edi
lea edi, [esp + 0xa10]
call fcn.0044b990
mov esi, eax
cmp esi, 0x822
je 0x41164b
mov ecx, dword [esp + 0x20]
mov edi, dword [ecx + 0xc]
lea eax, [esp + 0x290]
push eax
call fcn.004597f0
cmp dword [esp + 0x290], esi
je 0x41164b
mov edx, dword [esp + 0x20]
mov edi, dword [edx + 0xc]
push esi
call fcn.00459830
test al, al
je 0x41164b
cmp byte [esp + 0x3a72], 0
je 0x41164b
cmp byte [esp + 0x3aa2], 0
jne 0x41164b
mov eax, dword [0x4c8668]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x3c], eax
mov eax, dword [edi]
test eax, eax
je 0x411613
mov dword [esp + 0x38], eax
jmp 0x41161a
lea ecx, [edi + 0x6c]
mov dword [esp + 0x38], ecx
mov ebx, dword [edi + 8]
test ebx, ebx
jne 0x411624
lea ebx, [edi + 0x6c]
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov edx, dword [edi + 0x10]
push eax
mov eax, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x44]
push eax
push 0x37
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, ebx
call fcn.004366a0
mov edi, dword [esp + 0x20]
mov bl, byte [edi + 0x4a]
mov esi, dword [esp + 0x3a08]
test bl, bl
je 0x411688
cmp dword [0x4c6004], esi
jne 0x411678
lea eax, [edi + 0x80]
call fcn.00415b20
test eax, eax
je 0x4121db
test bl, bl
je 0x411688
cmp dword [0x4c6004], esi
je 0x4117aa
lea ebx, [edi + 0x80]
push ebx
call fcn.00415c70
lea eax, [esp + 0x520]
call fcn.0040b5b0
mov byte [esp + 0xa93c], 0x30
mov ecx, edi
mov dword [esp + 0xa8], 0xffffffff
call fcn.0040bd00
push eax
lea edx, [esp + 0xac]
push edx
lea eax, [esp + 0x528]
push eax
mov ecx, edi
call fcn.0040bce0
push eax
lea ecx, [esp + 0xa18]
push ecx
call fcn.00450a20
test al, al
je 0x411796
mov eax, ebx
mov byte [esp + 0x2c], 0
call fcn.00415b20
test eax, eax
je 0x411722
mov ecx, dword [ebx]
mov esi, eax
lea esp, [esp]
lea eax, [esp + 0x520]
call fcn.00450ef0
test al, al
je 0x411715
mov byte [esp + 0x2c], 1
add ecx, 0x50
dec esi
jne 0x411700
cmp byte [esp + 0x2c], 0
jne 0x41175a
lea esi, [esp + 0x6d8]
call fcn.0040b9a0
lea edi, [esp + 0x520]
mov byte [esp + 0xa93c], 0x31
call fcn.00413fc0
mov ecx, esi
call fcn.00415b50
mov byte [esp + 0xa93c], 0x30
call fcn.0040b610
mov edi, dword [esp + 0x20]
lea esi, [esp + 0x520]
call fcn.0040b690
mov ecx, edi
call fcn.0040bd00
push eax
lea edx, [esp + 0xac]
push edx
mov eax, esi
push eax
mov ecx, edi
call fcn.0040bce0
push eax
lea ecx, [esp + 0xa18]
push ecx
call fcn.00450a20
test al, al
jne 0x4116e8
lea esi, [esp + 0x520]
mov byte [esp + 0xa93c], 0x2a
call fcn.0040b610
mov esi, dword [edi + 0x80]
mov byte [edi + 0x4a], 1
mov dword [esp + 0x40], esi
cmp esi, dword [edi + 0x84]
jae 0x4121db
cmp dword [esi + 8], 6
je 0x4121db
cmp dword [esi + 0xc], 0
mov byte [esp + 0x2c], 0
jne 0x411860
cmp byte [esp + 0x3a7d], 0
mov eax, dword [esi + 0x10]
je 0x41181c
xor edx, edx
div dword [esp + 0x2a4]
cmp dword [esp + 0x64], eax
jbe 0x411807
cmp dword [esi + 0x2c], 1
je 0x411a07
cmp dword [esp + 0x64], eax
jae 0x4121b8
cmp dword [esi + 0x2c], 2
jne 0x4121b8
jmp 0x411a07
mov ecx, dword [esp + 0x64]
cmp ecx, eax
jbe 0x41183e
cmp dword [esi + 0x2c], 1
jne 0x41183c
push str.Watchdog.TRIGGER___Process_has_exceeded_watchdog_threshold_...
call fcn.004261a0
add esp, 4
jmp 0x411a07
cmp ecx, eax
jae 0x4121b8
cmp dword [esi + 0x2c], 2
jne 0x4121b8
push str.Watchdog.TRIGGER___Process_is_now_less_than_watchdog_threshold_...
call fcn.004261a0
add esp, 4
jmp 0x411a07
mov edx, dword [edi + 0xc]
push edx
lea ecx, [esp + 0x3cc]
lea ebx, [esp + 0x16c]
lea edi, [esp + 0x17c]
call fcn.00458150
xor ecx, ecx
test eax, eax
je 0x4118ae
mov dword [esp + 0x178], ecx
mov dword [esp + 0x17c], ecx
mov dword [esp + 0x168], ecx
mov dword [esp + 0x16c], ecx
mov dword [esp + 0x3c8], ecx
mov dword [esp + 0x3cc], ecx
mov edi, dword [esi + 0x10]
mov eax, dword [esi + 0x20]
xor esi, esi
shld esi, edi, 0x14
mov dword [esp + 0x3b4], esi
mov esi, eax
shl edi, 0x14
xor ebx, ebx
xor edx, edx
or esi, ecx
jne 0x411915
mov ebx, dword [esp + 0x178]
mov edx, dword [esp + 0x17c]
mov eax, dword [esp + 0x3b4]
cmp edx, eax
ja 0x4119d3
jb 0x4118f5
cmp ebx, edi
jae 0x4119d3
mov esi, dword [esp + 0x40]
cmp dword [esi + 0x2c], 2
jne 0x4119d7
push str.Watchdog.TRIGGER___Process_is_now_less_than_watchdog_threshold_...
call fcn.004261a0
add esp, 4
jmp 0x411a03
cmp eax, 1
jne 0x41192e
test ecx, ecx
jne 0x41192e
mov ebx, dword [esp + 0x168]
mov edx, dword [esp + 0x16c]
jmp 0x4118dc
cmp eax, 3
jne 0x4118dc
test ecx, ecx
jne 0x4118dc
mov eax, dword [esp + 0x16c]
mov ebx, dword [esp + 0x3b4]
cmp eax, ebx
ja 0x411965
jb 0x411954
cmp dword [esp + 0x168], edi
jae 0x411965
mov esi, dword [esp + 0x40]
cmp dword [esi + 0x2c], 2
jne 0x411969
push str.Watchdog.TRIGGER___Process_is_now_less_than_watchdog_threshold_...
jmp 0x41197d
mov esi, dword [esp + 0x40]
cmp eax, ebx
jb 0x41198a
ja 0x411978
cmp dword [esp + 0x168], edi
jbe 0x41198a
push str.Watchdog.TRIGGER___Process_has_exceeded_watchdog_threshold_...
call fcn.004261a0
mov byte [esp + 0x30], 1
add esp, 4
mov eax, dword [esp + 0x17c]
cmp eax, ebx
ja 0x4119c4
jb 0x4119a0
cmp dword [esp + 0x178], edi
jae 0x4119b5
cmp dword [esi + 0x2c], 2
jne 0x4119b5
push str.Watchdog.TRIGGER___Process_is_now_less_than_watchdog_threshold_...
call fcn.004261a0
add esp, 4
jmp 0x411a03
cmp eax, ebx
jb 0x4119f8
ja 0x4119c4
cmp dword [esp + 0x178], edi
jbe 0x4119f8
push str.Watchdog.TRIGGER___Process_has_exceeded_watchdog_threshold_...
call fcn.004261a0
add esp, 4
jmp 0x411a03
mov esi, dword [esp + 0x40]
cmp edx, eax
jb 0x4121b4
ja 0x4119e9
cmp ebx, edi
jbe 0x4121b4
push str.Watchdog.TRIGGER___Process_has_exceeded_watchdog_threshold_...
call fcn.004261a0
add esp, 4
jmp 0x411a03
cmp byte [esp + 0x2c], 0
je 0x4121b4
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ecx, dword [esi + 0x30]
or ecx, dword [esi + 0x34]
jne 0x411a40
push str.First_occurance_of_watchdog_over_quota
call fcn.004261a0
mov ecx, dword [esp + 0x9c]
mov eax, dword [esp + 0xa0]
add esp, 4
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
jmp 0x411a4e
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x98]
sub ecx, dword [esi + 0x30]
push 0
sbb eax, dword [esi + 0x34]
push 0x2710
push eax
push ecx
call fcn.0049c660
mov dword [esp + 0x9c], edx
mov edx, dword [esi + 0x14]
push edx
push eax
push str.Watchdog_time_current_is__u___time_to_act_is__u
mov dword [esp + 0xa4], eax
call fcn.004261a0
mov ecx, dword [esi + 0x14]
xor eax, eax
add esp, 0xc
cmp dword [esp + 0x9c], eax
jb 0x4121c8
ja 0x411aa5
mov eax, dword [esp + 0x98]
cmp eax, ecx
jb 0x4121c8
mov esi, dword [esi + 0xc]
dec esi
je 0x411acf
push str.pg.watchdog:_Evaluated_for_CPU_overload_in_progress
call fcn.004261a0
add esp, 4
mov esi, 0x4c86c0
call fcn.00402b80
mov dword [esp + 0xa8], 0x4aab4c
jmp 0x411ae4
mov esi, 0x4c86c8
call fcn.00402b80
mov dword [esp + 0xa8], 0x4ad0f8
lea esi, [esp + 0x104]
mov edi, eax
call fcn.00401e80
mov byte [esp + 0xa93c], 0x32
mov ebx, dword [esp + 0x40]
mov ecx, dword [esp + 0xa8]
mov eax, 0x10624dd3
mul dword [ebx + 0x14]
mov eax, dword [0x4c86a8]
shr edx, 6
push edx
mov edx, dword [ebx + 0x10]
push edi
push ecx
push edx
push eax
mov edi, esi
call fcn.004020e0
mov eax, dword [ebx + 8]
add esp, 0x14
test eax, eax
jne 0x411bf4
cmp byte [ebx + 0x48], al
jne 0x411bf4
push str.pg.watchdog:_Terminating_process
call fcn.004261a0
mov edi, dword [esp + 0x24]
mov byte [ebx + 0x48], 1
mov edx, dword [edi + 0xc]
mov eax, dword [edx + 0x484]
add esp, 4
lea ecx, [esp + 0x200]
push ecx
push eax
call fcn.00434f20
test al, al
je 0x411bb2
lea eax, [esp + 0x200]
call fcn.00416880
test eax, eax
je 0x411bbc
mov edi, dword [esp + 0x200]
mov ebx, eax
push 1
mov esi, edi
call fcn.00402b80
mov ecx, eax
call fcn.00434650
test al, al
jne 0x411ba6
mov ecx, dword [esp + 0x20]
mov esi, dword [ecx + 0xc]
push 1
call fcn.00457530
add edi, 0x2c
dec ebx
jne 0x411b84
mov edi, dword [esp + 0x20]
jmp 0x411bbc
mov esi, dword [edi + 0xc]
push 1
call fcn.00457530
cmp byte [esp + 0x3aa2], 0
jne 0x412196
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov edx, dword [edi + 0x10]
push eax
push edx
mov ecx, edi
call fcn.0040bce0
push eax
mov ecx, edi
call fcn.0040bd00
mov edx, dword [esp + 0x110]
push 9
jmp 0x412187
cmp eax, 1
jne 0x411d75
cmp byte [ebx + 0x48], 0
jne 0x411d75
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 0xc]
call fcn.004567c0
mov dword [esp + 0x3c], eax
test eax, eax
je 0x412196
cmp word [eax], 0
je 0x412196
mov byte [ebx + 0x48], 1
mov ebx, dword [esp + 0x20]
mov esi, dword [ebx + 0xc]
call fcn.00456a40
lea esi, [esp + 0x138]
mov edi, eax
call fcn.00401e80
mov edx, edi
mov byte [esp + 0xa93c], 0x33
call fcn.0042e4c0
lea esi, [esp + 0x644]
call fcn.00414160
mov byte [esp + 0xa93c], 0x34
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx + 0x484]
lea eax, [esp + 0x200]
push eax
push edx
call fcn.00434f20
test al, al
je 0x411ce4
lea eax, [esp + 0x200]
call fcn.00416880
test eax, eax
je 0x411ccd
mov edi, dword [esp + 0x200]
mov dword [esp + 0xa8], eax
push 1
mov esi, edi
call fcn.00402b80
mov ecx, eax
call fcn.00434650
test al, al
jne 0x411cc1
mov esi, dword [ebx + 0xc]
push 1
call fcn.00457530
add edi, 0x2c
dec dword [esp + 0xa8]
jne 0x411ca3
lea esi, [esp + 0x644]
call fcn.00402b80
push 1
mov ecx, eax
call fcn.004347a0
jmp 0x411d16
push str.pg.WARNING:_Process_couldnt_terminate_in_first_try.._trying_again_with_direct_Terminate..
call fcn.004261a0
mov esi, dword [ebx + 0xc]
add esp, 4
push 1
call fcn.00457530
lea esi, [esp + 0x138]
call fcn.00402b80
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, eax
call fcn.0042d3b0
add esp, 4
test al, al
je 0x411d58
cmp byte [esp + 0x3aa2], 0
jne 0x411d58
mov esi, dword [ebx + 0xc]
call fcn.00456a40
mov edx, dword [ebx + 0x10]
push eax
push edx
mov ecx, ebx
call fcn.0040bce0
push eax
mov ecx, ebx
call fcn.0040bd00
mov edx, dword [esp + 0x110]
push 0xa
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, eax
call fcn.004366a0
lea esi, [esp + 0x644]
call fcn.00414190
lea eax, [esp + 0x138]
call fcn.00401ea0
jmp 0x412196
cmp eax, 2
jne 0x411e28
cmp byte [ebx + 0x48], 0
jne 0x411e28
mov edx, dword [esp + 0x20]
mov byte [ebx + 0x48], 1
mov eax, dword [edx + 0xc]
call fcn.00458be0
mov esi, dword [ebx + 0x18]
mov edi, dword [ebx + 0x1c]
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], edx
cmp esi, 0xfffffffe
jne 0x411db7
cmp edi, 0xffffffff
jne 0x411db7
call fcn.00414540
mov esi, eax
xor edi, edi
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0xc]
push edi
push esi
call fcn.00458c60
test al, al
je 0x412196
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x9c]
push edi
push esi
lea esi, [esp + 0x30]
mov dword [ebx + 0x38], ecx
mov dword [ebx + 0x3c], edx
call fcn.0042c010
add esp, 8
cmp byte [esp + 0x3aa2], 0
jne 0x412196
mov edi, dword [esp + 0x20]
mov esi, dword [edi + 0xc]
call fcn.00456a40
push eax
mov eax, dword [edi + 0x10]
push eax
mov ecx, edi
call fcn.0040bce0
push eax
mov ecx, edi
call fcn.0040bd00
mov edx, dword [esp + 0x34]
push 0xb
jmp 0x412187
cmp eax, 3
jne 0x411e9c
cmp byte [ebx + 0x48], 0
jne 0x411e9c
mov edx, dword [esp + 0x20]
mov byte [ebx + 0x48], 1
mov eax, dword [edx + 0xc]
call fcn.00458b50
test al, al
je 0x412196
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x9c]
mov dword [ebx + 0x38], eax
mov dword [ebx + 0x3c], ecx
cmp byte [esp + 0x3aa2], 0
jne 0x412196
mov edi, dword [esp + 0x20]
mov esi, dword [edi + 0xc]
mov ebx, dword [0x4c8608]
call fcn.00456a40
mov edx, dword [edi + 0x10]
push eax
push edx
mov ecx, edi
call fcn.0040bce0
push eax
mov ecx, edi
call fcn.0040bd00
push 0xc
mov edx, ebx
jmp 0x412187
cmp eax, 4
jne 0x411f35
cmp byte [ebx + 0x48], 0
jne 0x411f35
mov eax, dword [esp + 0x20]
mov edi, dword [ebx + 0x18]
lea edx, [esp + 0xf0]
mov byte [ebx + 0x48], 1
mov eax, dword [eax + 0xc]
push edx
mov dword [esp + 0xf4], 0
call fcn.00457190
test eax, eax
jne 0x412196
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x9c]
mov dword [ebx + 0x38], ecx
mov dword [ebx + 0x3c], edx
cmp byte [esp + 0x3aa2], al
jne 0x412196
mov esi, dword [esp + 0xf0]
call fcn.0043e440
mov edi, dword [esp + 0x20]
mov esi, dword [edi + 0xc]
mov ebx, eax
call fcn.00456a40
push eax
mov eax, dword [edi + 0x10]
push eax
mov ecx, edi
call fcn.0040bce0
push eax
mov ecx, edi
call fcn.0040bd00
push 0xd
mov edx, ebx
jmp 0x412187
cmp eax, 5
jne 0x411fb9
cmp byte [ebx + 0x48], 0
jne 0x411fb9
mov edx, dword [ebx + 0x18]
mov eax, dword [esp + 0x20]
mov byte [ebx + 0x48], 1
mov edi, dword [eax + 0xc]
push edx
call fcn.00459830
test al, al
je 0x412196
mov ecx, dword [esp + 0x98]
mov edx, dword [esp + 0x9c]
mov dword [ebx + 0x38], ecx
mov dword [ebx + 0x3c], edx
cmp byte [esp + 0x3aa2], 0
jne 0x412196
mov edi, dword [esp + 0x20]
mov esi, dword [edi + 0xc]
call fcn.00456a40
mov esi, dword [ebx + 0x18]
push eax
call fcn.0043e660
mov esi, eax
mov eax, dword [edi + 0x10]
push eax
mov ecx, edi
call fcn.0040bce0
push eax
mov ecx, edi
call fcn.0040bd00
push 0xe
mov edx, esi
jmp 0x412187
cmp eax, 8
jne 0x412140
cmp byte [ebx + 0x48], 0
jne 0x412140
lea esi, [esp + 0x80]
mov byte [ebx + 0x48], 1
call fcn.00401e80
mov byte [esp + 0xa93c], 0x35
mov edx, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
push edx
push eax
push str.__s___s
mov edi, esi
call fcn.004020e0
mov edi, dword [esp + 0x2c]
mov edx, dword [edi + 0x10]
add esp, 0xc
push 0xa
lea ecx, [esp + 0x72c]
push ecx
push edx
call fcn.0047425d
add esp, 0xc
lea eax, [esp + 0x728]
push eax
push 0x4ad278
mov ecx, esi
push ecx
call fcn.00415530
mov ecx, edi
call fcn.0040bce0
push eax
push 0x4ad280
mov edx, esi
push edx
call fcn.00415530
mov ecx, edi
call fcn.0040bcf0
push eax
push 0x4ad288
mov eax, esi
push eax
call fcn.00415530
mov ecx, edi
call fcn.0040bd00
push eax
push 0x4ad290
mov ecx, esi
push ecx
call fcn.00415530
xor eax, eax
lea edx, [esp + 0x2f0]
push edx
mov dword [esp + 0x2f4], eax
mov dword [esp + 0x2f8], eax
mov dword [esp + 0x2fc], eax
mov dword [esp + 0x300], eax
lea eax, [esp + 0x694]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
call fcn.00402b80
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [esp + 0x2f0], 0
push 0x4ad298
jne 0x4120f7
mov ecx, dword [edi + 0x10]
push ecx
mov ecx, edi
call fcn.0040bce0
push eax
mov ecx, edi
call fcn.0040bd00
push 0x4f
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x94]
mov ecx, eax
call fcn.004366a0
mov eax, esi
call fcn.00401ea0
jmp 0x412196
mov eax, dword [edi + 0x10]
push eax
mov ecx, edi
call fcn.0040bce0
push eax
mov ecx, edi
call fcn.0040bd00
mov edx, dword [esp + 0x8c]
push 0x4e
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, eax
call fcn.004366a0
mov edx, dword [esp + 0x2f0]
push 0x20
push edx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea eax, [esp + 0x80]
call fcn.00401ea0
jmp 0x412196
cmp eax, 7
jne 0x412196
cmp byte [ebx + 0x48], 0
jne 0x412196
mov eax, dword [esp + 0x98]
mov ecx, dword [esp + 0x9c]
mov esi, dword [esp + 0x20]
mov dword [ebx + 0x3c], ecx
mov byte [ebx + 0x48], 1
mov dword [ebx + 0x38], eax
mov edx, dword [esi + 0x10]
push 0x4ad298
push edx
mov ecx, esi
call fcn.0040bce0
push eax
mov ecx, esi
call fcn.0040bd00
mov edx, dword [0x4c85e0]
push 0xf
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, eax
call fcn.004366a0
lea eax, [esp + 0x104]
mov byte [esp + 0xa93c], 0x2a
call fcn.00401ea0
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x20]
jmp 0x4121c8
mov edi, dword [esp + 0x20]
mov edx, dword [esi + 0x30]
or edx, dword [esi + 0x34]
je 0x4121c8
xor eax, eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
add esi, 0x50
mov dword [esp + 0x40], esi
cmp esi, dword [edi + 0x84]
jb 0x4117c4
cmp byte [esp + 0x3a21], 0
je 0x40ff16
cmp byte [esp + 0x5a], 1
jne 0x40ff16
xor al, al
mov byte [esp + 0x1f], al
mov byte [esp + 0x46], al
cmp byte [edi + 0x40], al
jne 0x40ff16
cmp byte [edi + 0x43], al
jne 0x40ff16
mov eax, dword [esp + 0x2ac]
cmp eax, dword [esp + 0x3a40]
jl 0x412bf5
mov ecx, dword [esp + 0x64]
cmp ecx, dword [esp + 0x3a24]
jb 0x412bf5
push str.pg.ooc:_total_CPU_quota_exceeded
call fcn.004261a0
add esp, 4
mov eax, 0x200
lea ebx, [esp + 0x4470]
mov edi, 0x4ad2e4
call fcn.00460bf0
push eax
push 0x4ad3c0
call fcn.00473ffc
add esp, 8
test eax, eax
jne 0x41374b
mov esi, dword [esp + 0x20]
cmp byte [esi + 0x14], al
jne 0x4124b4
cmp byte [esi + 0x3c], al
jne 0x4124aa
cmp byte [esi + 0x40], al
jne 0x4124aa
mov eax, dword [esi]
test eax, eax
je 0x41229b
mov edi, eax
mov dword [esp + 0x40], eax
jmp 0x4122a2
lea edi, [esi + 0x6c]
mov dword [esp + 0x40], edi
mov edx, dword [0x4c6008]
cmp edx, dword [esi + 0x10]
je 0x4123ef
mov eax, edi
call fcn.0045c070
test al, al
je 0x4122d7
push edi
lea edi, [esp + 0xa0c]
call fcn.00451040
test al, al
jne 0x4122d7
push str.pg.ooc:_hard_coded_exclusion
jmp 0x4123e7
cmp byte [esp + 0x3a7a], 0
jne 0x4123c1
cmp byte [esp + 0x3a8c], 0
jne 0x4123c1
cmp byte [esp + 0x33], 0
jne 0x4123c1
mov eax, 0x200
lea ebx, [esp + 0x4470]
mov edi, 0x4ad2e4
call fcn.00460bf0
push eax
mov eax, dword [esp + 0x44]
push eax
call fcn.00473ffc
add esp, 8
test eax, eax
je 0x4123ae
mov eax, 0x200
mov edi, 0x4ad30c
call fcn.00460bf0
mov ecx, dword [esp + 0x40]
push eax
push ecx
call fcn.00473ffc
add esp, 8
test eax, eax
je 0x4123ae
mov eax, 0x200
mov edi, 0x4ad338
call fcn.00460bf0
mov edx, dword [esp + 0x40]
push eax
push edx
call fcn.00473ffc
add esp, 8
test eax, eax
je 0x4123ae
mov eax, 0x200
mov edi, 0x4ad35c
call fcn.00460bf0
push eax
mov eax, dword [esp + 0x44]
push eax
call fcn.00473ffc
add esp, 8
test eax, eax
je 0x4123ae
mov eax, 0x200
mov edi, 0x4ad388
call fcn.00460bf0
mov ecx, dword [esp + 0x40]
push eax
push ecx
call fcn.00473ffc
add esp, 8
test eax, eax
jne 0x4123f3
push str.pg.ooc:_Special_firefox_handling
call fcn.004261a0
add esp, 4
mov byte [esi + 0x42], 1
jmp 0x4123f3
mov edi, dword [esp + 0x24]
mov eax, edi
call fcn.00458d90
test al, al
jne 0x4123e2
mov eax, edi
call fcn.00459b00
mov ecx, eax
call fcn.0042f490
test al, al
je 0x4123f3
push str.pg.ooc:_service_excluded_per_config
call fcn.004261a0
add esp, 4
mov byte [esi + 0x40], 1
mov ecx, esi
call fcn.0040bcf0
push eax
mov ecx, esi
call fcn.0040bd00
mov edx, dword [esp + 0x44]
push eax
push edx
lea eax, [esp + 0xa14]
push eax
call fcn.004499a0
test al, al
je 0x41242a
push str.pg.ooc:_process_excluded_per_config
call fcn.004261a0
add esp, 4
mov byte [esi + 0x40], 1
cmp byte [esi + 0x40], 0
jne 0x4124aa
push str.pg.ooc:_begin_timing
call fcn.004261a0
mov eax, dword [esp + 0x28]
add esp, 4
lea edi, [esp + 0x258]
call fcn.004570d0
mov eax, dword [esp + 0x258]
cmp eax, 0x40
je 0x4124aa
cmp eax, 0x4000
je 0x4124aa
lea ecx, [esp + 0x210]
push ecx
mov byte [esi + 0x14], 1
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [esp + 0x3a34]
mov ecx, dword [esp + 0x210]
imul eax, eax, 0x2710
cdq
sub ecx, eax
mov eax, dword [esp + 0x214]
sbb eax, edx
mov dword [esp + 0x210], ecx
mov dword [esp + 0x214], eax
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], eax
cmp byte [esi + 0x14], 0
je 0x412bb1
cmp byte [esi + 0x3c], 0
jne 0x412bb7
push str.pg.ooc:_continuing_timing
call fcn.004261a0
add esp, 4
lea edx, [esp + 0x390]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov edx, dword [esp + 0x390]
sub edx, dword [esi + 0x18]
mov ebx, dword [esp + 0x394]
mov eax, dword [esp + 0x68]
sbb ebx, dword [esi + 0x1c]
mov dword [esp + 0x3e0], edx
cmp eax, dword [esi + 0x10]
jne 0x412615
push str.pg.ooc:_is_in_the_foreground
call fcn.004261a0
add esp, 4
cmp byte [esp + 0x3a80], 0
mov byte [esp + 0x2c], 1
jne 0x412bf1
cmp byte [esp + 0x3a8c], 0
jne 0x412bf1
cmp byte [esp + 0x33], 0
jne 0x412bf1
mov esi, dword [esp + 0x20]
push str.pg.ooc:_lowering_process_priority
call fcn.004261a0
xor eax, eax
add esp, 4
cmp byte [esp + 0x2c], al
jne 0x412558
cmp byte [esi + 0x42], al
je 0x41256c
push str.pg.ooc:_Foreground_process_timing_adjustment
call fcn.004261a0
mov eax, dword [esp + 0x3a54]
add esp, 4
mov edi, dword [esp + 0x3a44]
add edi, eax
mov eax, dword [esp + 0x3a34]
cdq
sub eax, edx
sar eax, 1
cdq
xor ecx, ecx
cmp ecx, edx
jg 0x412592
jl 0x41258e
cmp edi, eax
ja 0x412592
sub edi, eax
sbb ecx, edx
test ecx, ecx
jg 0x4125a0
jl 0x41259c
test edi, edi
jae 0x4125a0
xor edi, edi
xor ecx, ecx
push 0
push 0x2710
push ecx
push edi
call fcn.00492bc0
cmp ebx, edx
jb 0x412ba5
ja 0x4125c5
cmp dword [esp + 0x3e0], eax
jb 0x412ba5
push str.pg.ooc:_time_to_restrain
call fcn.004261a0
mov ebx, dword [esp + 0x28]
lea edi, [esi + 0x20]
add esp, 4
mov eax, ebx
mov dword [esp + 0x3c], edi
call fcn.004570d0
mov esi, ebx
call fcn.00457b70
mov esi, dword [esp + 0x20]
mov byte [esi + 0x48], al
cmp byte [esp + 0x3a88], 0
je 0x41262c
push str.pg.ooc:_storing_affinity
call fcn.004261a0
add esp, 4
mov eax, ebx
call fcn.00458be0
mov dword [esi + 0x34], edx
jmp 0x41263e
push str.pg.ooc:_is_NOT_in_the_foreground
call fcn.004261a0
add esp, 4
mov byte [esp + 0x2c], 0
jmp 0x41253e
push str.pg.ooc:_no_affinity_change_indicated
call fcn.004261a0
add esp, 4
xor eax, eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x30], eax
movzx esi, byte [esp + 0x3a7f]
neg esi
sbb esi, esi
and esi, 0xffffc040
xor bl, bl
add esi, 0x4000
cmp byte [esp + 0x3a5c], bl
je 0x4126a3
cmp dword [esp + 0x3a54], 0
je 0x4126a3
lea edx, [esp + 0x358]
push edx
mov dword [esp + 0x35c], 8
call dword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x4126a3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esp + 0x35c]
cmp eax, dword [esp + 0x3a54]
jbe 0x4126a3
mov bl, 1
mov eax, dword [edi]
cmp eax, 0x4000
je 0x412bf1
cmp eax, 0x40
je 0x412bf1
test bl, bl
jne 0x412bf1
cmp byte [esp + 0x3ae0], 0
mov ebx, dword [esp + 0x20]
je 0x41273e
mov eax, dword [ebx + 0xc]
call fcn.00459c60
mov edi, eax
mov eax, dword [esp + 0x68]
push eax
push edi
push str.OptiCore_checking_for_parent_in_foreground._Parent_PID_is__u__foreground_PID_is__u
call fcn.004261a0
add esp, 0xc
cmp edi, dword [esp + 0x68]
jne 0x41273e
push str.Excluding_due_to_parent_being_in_the_foreground_
call fcn.004261a0
mov eax, dword [ebx]
add esp, 4
mov edi, eax
test eax, eax
jne 0x41270e
lea edi, [ebx + 0x6c]
mov esi, dword [ebx + 0xc]
call fcn.00456a40
mov ecx, dword [ebx + 0x10]
push eax
push ecx
push edi
mov ecx, ebx
call fcn.0040bd00
push 0x30
lea edx, [esp + 0x50c0]
push edx
mov edx, str.Skipped_restraint_due_to_experimental_option_1._opticore
mov ecx, eax
call fcn.004366a0
jmp 0x412bf1
lea eax, [esp + 0x50b0]
push eax
push 1
mov ecx, ebx
call fcn.0040c7f0
add esp, 8
cmp byte [esp + 0x3a8f], 0
jne 0x412766
cmp byte [esp + 0x3a7e], 0
je 0x41276f
mov ecx, dword [esp + 0x3c]
cmp dword [ecx], 0x20
jne 0x41279c
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x3f4]
push edx
mov edi, esi
mov byte [ebx + 0x3d], 1
call fcn.00457190
mov edi, dword [esp + 0x24]
lea ebx, [esp + 0x2c]
call fcn.00457a60
mov eax, dword [esp + 0x20]
mov dword [eax + 0x24], esi
mov ebx, eax
cmp byte [0x4c7d60], 0
je 0x4127ec
cmp byte [esp + 0x3a5d], 0
je 0x4127ec
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0xa0]
push ecx
mov dword [esp + 0xa4], 0
call fcn.004597f0
test al, al
je 0x4127db
mov edx, dword [esp + 0xa0]
mov dword [ebx + 0x70], edx
jmp 0x4127e2
mov dword [ebx + 0x70], 0xffffffff
mov edi, dword [ebx + 0xc]
push 0
call fcn.00459830
cmp byte [esp + 0x3a88], 0
je 0x41292a
mov eax, dword [esp + 0x3a90]
or eax, dword [esp + 0x3a94]
jne 0x412a40
cmp byte [esp + 0x3a70], al
jne 0x412a40
cmp byte [esp + 0x3a5f], al
je 0x41292a
mov eax, dword [esp + 0x24]
call fcn.00458be0
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004741d4
add esp, 4
call fcn.004741e6
xor edx, edx
div dword [esp + 0x114]
xor edi, edi
xor esi, esi
lea ecx, [edi + 1]
mov dword [esp + 0x3c], edx
cmp dword [esp + 0x114], esi
jbe 0x412888
mov edx, dword [esp + 0x114]
mov dword [esp + 0xa0], edx
mov eax, ecx
cdq
or edi, eax
or esi, edx
rol ecx, 1
dec dword [esp + 0xa0]
jne 0x412876
mov ecx, dword [esp + 0x3c]
mov eax, 1
shl eax, cl
cdq
xor esi, edx
xor edi, eax
mov eax, dword [esp + 0x24]
push esi
push edi
call fcn.00458c60
test al, al
je 0x41292a
push str.pg.ooc:_affinity_changed
mov dword [ebx + 0x2c], esi
mov dword [ebx + 0x28], edi
call fcn.004261a0
add esp, 4
push 0x180
lea eax, [esp + 0x9004]
push eax
push esi
push edi
call fcn.0042bf10
mov edx, dword [0x4c8614]
lea ecx, [esp + 0x9010]
push ecx
push edx
lea edi, [esp + 0x40]
call fcn.004020e0
add esp, 0x18
cmp byte [esp + 0x3aa2], 0
jne 0x41292a
mov edi, dword [ebx]
test edi, edi
jne 0x412900
lea edi, [ebx + 0x6c]
mov esi, dword [ebx + 0xc]
call fcn.00456a40
push eax
mov eax, dword [ebx + 0x10]
push eax
push edi
mov ecx, ebx
call fcn.0040bd00
mov edx, dword [esp + 0x34]
push 0x27
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, eax
call fcn.004366a0
cmp byte [esp + 0x3ab2], 0
je 0x412aee
cmp byte [esp + 0x45], 0
jne 0x412aee
call fcn.0042ded0
test al, al
je 0x412aee
cmp dword [esp + 0xb8], 0
jne 0x412aee
lea ecx, [esp + 0x4c]
call fcn.00427410
mov edx, dword [esp + 0x4c]
cmp dword [edx - 0xc], 0
je 0x412ae3
lea eax, [esp + 0x4c]
push eax
push 0x4cb970
lea ebx, [esp + 0x688]
call fcn.004276a0
test al, al
je 0x412adf
lea ecx, [esp + 0x4c]
push ecx
lea esi, [esp + 0xe8]
mov byte [esp + 0x49], 1
call fcn.00427d40
lea edx, [esp + 0x4c]
push edx
lea esi, [esp + 0xf0]
call fcn.00427e10
mov ebx, dword [esp + 0xec]
mov edi, dword [esp + 0xe4]
lea eax, [esp + 0x4c]
call fcn.00402720
push 0x64
push 0x4cb970
lea ecx, [esp + 0x54]
call fcn.00427ba0
push 0x64
push 0x4cb970
lea ecx, [esp + 0x54]
call fcn.00427c70
call fcn.00427ee0
cmp byte [esp + 0x3aa7], 0
je 0x412adf
cmp byte [esp + 0x3aa2], 0
jne 0x412adf
push str.pg.ooc:_setting_affinity
call fcn.004261a0
mov eax, dword [esp + 0x28]
add esp, 4
call fcn.00458be0
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], edx
mov edi, dword [esp + 0x3a90]
mov esi, dword [esp + 0x3a94]
cmp edi, 0xfffffffe
jne 0x412a7b
cmp esi, 0xffffffff
jne 0x412a7b
call fcn.00414540
jmp 0x412a91
cmp byte [esp + 0x3a70], 0
je 0x412a95
lea eax, [esp + 0xa08]
call fcn.004144c0
xor esi, esi
mov edi, eax
mov eax, dword [esp + 0x24]
push esi
push edi
call fcn.00458c60
test al, al
jne 0x4128ab
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
jmp 0x41292a
mov ebx, dword [esp + 0x20]
mov dword [esp + 0xb8], 1
mov byte [esp + 0x46], 1
mov byte [esp + 0x6e], 1
mov byte [ebx + 0x3c], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x38], eax
mov eax, dword [ebx + 0xc]
call fcn.00459c90
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x7c], edx
mov byte [ebx + 0x14], 0
cmp byte [esp + 0x3aa2], 0
jne 0x412b92
cmp byte [esp + 0x3a73], 0
je 0x412b92
push str.pg:_emit_log_entry_begin
call fcn.004261a0
add esp, 4
cmp byte [esp + 0x3a8f], 0
jne 0x412b85
mov eax, dword [ebx]
mov edx, dword [0x4c858c]
mov dword [esp + 0x3c], edx
mov edi, eax
test eax, eax
jne 0x412b5b
lea edi, [ebx + 0x6c]
mov esi, dword [ebx + 0xc]
call fcn.00456a40
push eax
mov eax, dword [ebx + 0x10]
push eax
push edi
mov ecx, ebx
call fcn.0040bd00
mov edx, dword [esp + 0x48]
push 0x2c
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, eax
call fcn.004366a0
push str.pg:_emit_log_entry_done
call fcn.004261a0
add esp, 4
call fcn.00414310
lea eax, [esp + 0xa08]
call fcn.00414330
jmp 0x412bf1
push str.pg.ooc:_Not_yet_time_to_restrain...
call fcn.004261a0
jmp 0x412bee
cmp byte [esi + 0x3c], 0
je 0x412bf1
cmp byte [esp + 0x3a80], 0
jne 0x412bd2
cmp byte [esp + 0x3a8c], 0
jne 0x412bd2
cmp byte [esp + 0x33], 0
je 0x412bf1
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 0x10]
cmp eax, dword [esp + 0x68]
jne 0x412bf1
push str.pg.ooc:_restrained_process_is_foreground
call fcn.004261a0
mov byte [esp + 0x23], 1
add esp, 4
mov edi, dword [esp + 0x20]
cmp byte [edi + 0x3c], 0
jne 0x412c11
cmp byte [esp + 0x1f], 0
je 0x40ff16
cmp byte [esp + 0x46], 0
jne 0x40ff16
push str.pg.ooc:_unrestrain
call fcn.004261a0
add esp, 4
mov byte [edi + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x3a48]
mov esi, eax
sub esi, dword [edi + 0x38]
push ecx
push esi
push str.pg.Process_in_restraint__current_is__u_MS_restrained_vs_Minimum_Time_for_Restraint__u_MS
call fcn.004261a0
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x3a58]
add esp, 0xc
cmp edx, dword [esp + 0x3a28]
ja 0x412c60
cmp esi, dword [esp + 0x3a48]
jae 0x412c94
test eax, eax
je 0x412c68
cmp esi, eax
jae 0x412c94
mov ecx, dword [edi + 0x10]
cmp ecx, dword [esp + 0x68]
jne 0x40ff16
cmp byte [esp + 0x3a80], 0
jne 0x412c94
cmp byte [esp + 0x3a8c], 0
jne 0x412c94
cmp byte [esp + 0x33], 0
je 0x40ff16
test eax, eax
je 0x412ca1
mov byte [esp + 0x1f], 1
cmp esi, eax
jae 0x412ca6
mov byte [esp + 0x1f], 0
push str.pg.ooc:_restoring_priority
call fcn.004261a0
mov eax, dword [esp + 0x28]
add esp, 4
mov byte [esp + 0x46], 0
mov byte [esp + 0x2c], 0
call fcn.00457130
cmp eax, dword [edi + 0x24]
jne 0x412ce3
mov edi, dword [edi + 0x20]
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x3ec]
push edx
call fcn.00457190
mov edi, dword [esp + 0x20]
movzx eax, byte [edi + 0x48]
mov edi, dword [esp + 0x24]
push eax
call fcn.00457ae0
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + 0x70]
cmp eax, 0xffffffff
je 0x412d0a
push eax
call fcn.00459830
mov dword [ebx + 0x70], 0xffffffff
mov ecx, dword [ebx + 0x30]
or ecx, dword [ebx + 0x34]
je 0x412d64
push str.pg.ooc:_restoring_affinity
call fcn.004261a0
add esp, 4
mov eax, edi
call fcn.00458be0
cmp eax, dword [ebx + 0x28]
jne 0x412d5c
cmp edx, dword [ebx + 0x2c]
jne 0x412d5c
mov edx, dword [ebx + 0x34]
mov eax, dword [ebx + 0x30]
push edx
push eax
mov eax, edi
call fcn.00458c60
test al, al
je 0x412d4a
mov byte [esp + 0x46], 1
jmp 0x412d5c
push str.pg.ooc.error:_could_not_restore_affinity
call fcn.004261a0
add esp, 4
mov byte [esp + 0x2c], 1
xor eax, eax
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], eax
mov byte [ebx + 0x3c], 0
cmp byte [esp + 0x3aa2], 0
jne 0x412f64
push str.pg:_emit_log_entry_begin
call fcn.004261a0
add esp, 4
cmp byte [esp + 0x46], 0
je 0x412db8
mov eax, dword [ebx]
mov ecx, dword [0x4c85a0]
mov dword [esp + 0x3c], ecx
mov edi, eax
test eax, eax
jne 0x412d9f
lea edi, [ebx + 0x6c]
mov esi, dword [ebx + 0xc]
call fcn.00456a40
mov edx, dword [ebx + 0x10]
push eax
push edx
push edi
mov ecx, ebx
call fcn.0040bd00
push 0x29
jmp 0x412deb
cmp byte [esp + 0x2c], 0
je 0x412dfe
mov eax, dword [ebx]
mov edx, dword [0x4c85a0]
mov dword [esp + 0x3c], edx
mov edi, eax
test eax, eax
jne 0x412dd4
lea edi, [ebx + 0x6c]
mov esi, dword [ebx + 0xc]
call fcn.00456a40
push eax
mov eax, dword [ebx + 0x10]
push eax
push edi
mov ecx, ebx
call fcn.0040bd00
push 0x2a
mov edx, dword [esp + 0x4c]
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, eax
call fcn.004366a0
cmp byte [esp + 0x1f], 0
je 0x412e44
mov eax, dword [ebx]
mov edx, dword [0x4c862c]
mov dword [esp + 0x3c], edx
mov edi, eax
test eax, eax
jne 0x412e1a
lea edi, [ebx + 0x6c]
mov esi, dword [ebx + 0xc]
call fcn.00456a40
push eax
mov eax, dword [ebx + 0x10]
push eax
push edi
mov ecx, ebx
call fcn.0040bd00
mov edx, dword [esp + 0x48]
push 0x23
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, eax
call fcn.004366a0
cmp byte [esp + 0x3a8f], 0
jne 0x412e8d
mov eax, dword [ebx]
mov edx, dword [0x4c85a0]
mov dword [esp + 0x3c], edx
mov edi, eax
test eax, eax
jne 0x412e63
lea edi, [ebx + 0x6c]
mov esi, dword [ebx + 0xc]
call fcn.00456a40
push eax
mov eax, dword [ebx + 0x10]
push eax
push edi
mov ecx, ebx
call fcn.0040bd00
mov edx, dword [esp + 0x48]
push 0x2e
lea ecx, [esp + 0x50c0]
push ecx
mov ecx, eax
call fcn.004366a0
mov esi, dword [esp + 0xb8]
test esi, esi
je 0x412f57
cmp byte [esp + 0x45], 0
je 0x412f57
mov edx, dword [esp + 0x4c]
cmp dword [edx - 0xc], 0
mov byte [esp + 0x45], 0
je 0x412f4f
cmp esi, 1
jne 0x412f4f
mov eax, dword [esp + 0xe4]
push eax
push 0x4cb970
lea ecx, [esp + 0x54]
call fcn.00427ba0
mov ecx, dword [esp + 0xec]
push ecx
push 0x4cb970
lea ecx, [esp + 0x54]
call fcn.00427c70
call fcn.00427ee0
cmp byte [esp + 0x3aa7], 0
je 0x412f4f
cmp byte [esp + 0x3aa2], 0
jne 0x412f4f
push 0
test al, al
jne 0x412f2c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
lea edx, [esp + 0x50bc]
push 0x26
push edx
mov edx, dword [0x4c86c4]
jmp 0x412f48
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [0x4c86bc]
push eax
push 0x4ab2fc
push 0x25
lea eax, [esp + 0x50c0]
push eax
xor ecx, ecx
call fcn.004366a0
dec esi
mov dword [esp + 0xb8], esi
push str.pg:_emit_log_entry_end
call fcn.004261a0
add esp, 4
lea ecx, [esp + 0x50b0]
push ecx
push 0
mov ecx, ebx
call fcn.0040c7f0
add esp, 8
lea eax, [esp + 0xa08]
call fcn.00414390
jmp 0x40ff16
push str.Leaving_EB_profile_per_manual_user_request_...
call fcn.004261a0
add esp, 4
lea esi, [esp + 0xc8]
call fcn.00439cc0
test al, al
je 0x413016
cmp byte [0x4cbb6c], 0
jne 0x412fc1
mov eax, esi
mov edi, 0x4cbba8
call fcn.00406b40
jmp 0x412fcb
mov esi, 0x4cbba8
call fcn.00402b20
lea eax, [esp + 0x3f8]
push eax
call fcn.00438900
mov ecx, dword [esp + 0xc8]
push ecx
push str.Leaving_EnergyBooster_Profile__s._energyboooster
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x57
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x3c]
xor ecx, ecx
call fcn.004366a0
jmp 0x41303a
push str.Gvr:_Manual_leave_indicated__but_were_not_in_a_profile._Cleaning_it_up.
call fcn.004261a0
add esp, 4
lea eax, [esp + 0x3f8]
push eax
call fcn.00438900
mov esi, 0x4cbba8
call fcn.00402b20
mov byte [0x4cbb6c], 0
lea eax, [esp + 0xc8]
mov byte [esp + 0xa93c], 0x28
call fcn.00401ea0
cmp byte [0x4cbb6c], 0
jne 0x41317d
lea ecx, [esp + 0x60]
push ecx
lea eax, [esp + 0x444]
call fcn.00415980
add esp, 4
test al, al
je 0x41317d
mov edi, dword [esp + 0x60]
cmp dword [edi - 0xc], 0
je 0x4130a7
lea eax, [esp + 0x60]
call fcn.00415930
test al, al
je 0x4130a7
push str.Skipping_triggered_profile_entrance_becaues_the_user_manually_left_this_profile
call fcn.004261a0
add esp, 4
jmp 0x41317d
lea esi, [esp + 0xd8]
call fcn.00401e80
push str.EnergyBooster_profile_being_changed_
mov byte [esp + 0xa940], 0x37
call fcn.004261a0
add esp, 4
cmp dword [edi - 0xc], 0
push edi
jne 0x41310b
push str.Leaving_EnergyBooster_profile__s
call fcn.004261a0
add esp, 8
lea edx, [esp + 0x3f8]
push edx
call fcn.00438900
push edi
push str.Leaving_EnergyBooster_Profile__s._energyboooster
mov edi, esi
call fcn.004020e0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x57
jmp 0x413153
push str.Entering_EnergyBooster_profile__s
call fcn.004261a0
mov ecx, dword [esp + 0xb4]
add esp, 8
push ecx
push edi
lea edx, [esp + 0x400]
push edx
call fcn.00438720
push edi
push str.Entering_EnergyBooster_Profile__s._energyboooster
lea edi, [esp + 0xe0]
call fcn.004020e0
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x56
mov edx, dword [esp + 0xe8]
lea eax, [esp + 0x50c0]
push eax
xor ecx, ecx
call fcn.004366a0
lea eax, [esp + 0xd8]
mov byte [esp + 0xa93c], 0x28
call fcn.00401ea0
mov esi, dword [esp + 0x1b8]
mov edi, dword [esp + 0x1bc]
cmp esi, edi
je 0x4131d3
nop
push str.Erasing_a_process_...
call fcn.004261a0
mov ecx, dword [esi]
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0xc]
add esp, 4
test eax, eax
je 0x4131ae
call fcn.00413f90
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x4131bc
call fcn.004141d0
mov eax, dword [esi]
push eax
lea ecx, [esp + 0x3f4]
push ecx
call fcn.004160f0
add esi, 4
cmp esi, edi
jne 0x413190
lea esi, [esp + 0x1b8]
call fcn.004164a0
mov edx, dword [esp + 0x174]
cmp edx, dword [0x4c7d64]
jbe 0x413647
xor eax, eax
mov dword [esp + 0xa0], eax
cmp dword [esp + 0x334], eax
jbe 0x413647
mov edi, dword [esp + 0x310]
mov esi, dword [esp + 0x300]
sub esi, edi
mov dword [esp + 0xf0], edi
mov dword [esp + 0x3c], esi
mov ecx, dword [esp + 0x330]
cmp byte [ecx + eax], 0
jne 0x413628
push str.pg.KeepRunning___Setting_up_process_for_LAUNCH___Giving_it_X_iterations
call fcn.004261a0
lea eax, [esi + edi]
add esp, 4
lea esi, [esp + 0x7c]
call fcn.00403770
mov eax, esi
lea esi, [esp + 0x100]
mov byte [esp + 0xa93c], 0x38
call fcn.00403770
mov byte [esp + 0xa93c], 0x39
mov edx, dword [edi]
mov esi, dword [esp + 0x7c]
push edx
push esi
push str.__s___s
lea edi, [esp + 0x10c]
call fcn.004020e0
mov esi, dword [esi - 0xc]
add esp, 0xc
xor edi, edi
dec esi
js 0x4132c4
nop
mov edi, esi
test esi, esi
js 0x413774
mov ecx, esi
lea eax, [esp + 0x7c]
call fcn.00415320
cmp ax, 0x2f
je 0x4132bf
mov ecx, esi
lea eax, [esp + 0x7c]
call fcn.00415320
cmp ax, 0x5c
je 0x4132bf
dec esi
jns 0x413290
test edi, edi
je 0x4132c4
inc edi
mov ecx, edi
lea esi, [esp + 0x1a0]
lea edx, [esp + 0x7c]
call fcn.00415860
lea esi, [esp + 0xdc]
call fcn.00401e80
mov bl, 0x3b
mov byte [esp + 0xa93c], bl
test edi, edi
je 0x41331d
lea ecx, [esp + 0x7c]
push ecx
lea eax, [edi - 1]
xor ecx, ecx
lea edx, [esp + 0x2c8]
call fcn.00415880
mov edi, esi
mov byte [esp + 0xa93c], 0x3c
call fcn.00406b40
lea eax, [esp + 0x2c4]
jmp 0x413345
xor ecx, ecx
lea esi, [esp + 0x2e4]
lea edx, [esp + 0x7c]
call fcn.00415860
lea edi, [esp + 0xdc]
mov byte [esp + 0xa93c], 0x3d
call fcn.00406b40
mov eax, esi
mov byte [esp + 0xa93c], bl
call fcn.00401ea0
mov edx, dword [esp + 0xdc]
mov eax, dword [esp + 0x1a0]
push edx
push eax
push str.pg:_Restart_procedure_initiated_for_process__s_in_folder__s
call fcn.004261a0
mov ebx, dword [esp + 0x1b4]
mov edi, dword [esp + 0x1b8]
add esp, 0xc
mov byte [esp + 0x46], 0
cmp ebx, edi
jae 0x413588
lea esp, [esp]
lea esi, [ebx + 8]
lea ecx, [esi - 4]
push ecx
mov ecx, dword [esp + 0x80]
call fcn.00406bb0
test eax, eax
jne 0x4133d1
mov ecx, dword [esp + 0x100]
push esi
call fcn.00406bb0
test eax, eax
jne 0x4133d1
cmp dword [ebx], 5
jge 0x4133dd
push str.pg.KeepRunning___Iteration_passed
call fcn.004261a0
add esp, 4
inc dword [ebx]
mov byte [esp + 0x46], 1
add ebx, 0x10
cmp ebx, edi
jb 0x413390
jmp 0x413581
push str.pg:_KeepRunning___Doing_last_minute_check_to_see_if_it_already_exists...
call fcn.004261a0
add esp, 4
lea edi, [esp + 0x4380]
call fcn.0040b810
xor edx, edx
mov byte [esp + 0xa93c], 0x3e
lea esi, [ebx + 4]
mov word [esp + 0x8600], dx
call fcn.00402b80
mov edi, eax
xor eax, eax
mov word [esp + 0x8600], ax
cmp word [edi], ax
je 0x41346f
lea eax, [esp + 0x8600]
call fcn.0042b7d0
test eax, eax
je 0x41346f
push 1
lea ecx, [esp + 0x194]
push ecx
lea edx, [esp + 0x4388]
push edx
lea ecx, [esp + 0x860c]
mov dword [esp + 0x19c], 0
call fcn.0045b390
mov eax, dword [esp + 0x190]
test eax, eax
je 0x41346f
call fcn.00413f90
jmp 0x413559
push str.pg.__KeepRunning___PERFORMING_ACTUAL_LAUNCH___
call fcn.004261a0
mov eax, dword [ebx + 8]
lea esi, [ebx + 8]
add esp, 4
cmp dword [eax - 0xc], 0
jne 0x41348b
lea esi, [ebx + 4]
call fcn.00402b80
mov ecx, dword [ebx + 4]
lea edx, [esp + 0x360]
push edx
mov edi, eax
mov eax, dword [ebx + 0xc]
lea edx, [esp + 0x694]
push edx
push eax
push 0
push 0x208
push 0
push 0
push 0
lea esi, [ebx + 4]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x413524
cmp byte [esp + 0x3aa2], 0
jne 0x4134fa
mov eax, dword [esp + 0x368]
push edi
push eax
call fcn.00402b80
mov edx, dword [0x4c866c]
push eax
push 0x17
lea ecx, [esp + 0x50c0]
push ecx
lea ecx, [esp + 0x814]
call fcn.004366a0
mov edx, dword [esp + 0x360]
push 0x20
push edx
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov esi, dword [esp + 0x360]
call fcn.00425660
mov esi, dword [esp + 0x364]
call fcn.00425660
jmp 0x413559
cmp byte [esp + 0x3aa2], 0
jne 0x413559
mov eax, dword [esp + 0x368]
push edi
push eax
call fcn.00402b80
mov edx, dword [0x4c866c]
push eax
push 0x18
lea ecx, [esp + 0x50c0]
push ecx
lea ecx, [esp + 0x814]
call fcn.004366a0
push ebx
lea ebx, [esp + 0x298]
lea esi, [esp + 0x1ac]
call fcn.00416620
lea eax, [esp + 0x4380]
mov byte [esp + 0xa93c], 0x3b
call fcn.0040b890
cmp byte [esp + 0x46], 0
jne 0x4135e1
push str.pg.KeepRunning___Added_to_pending_launches
call fcn.004261a0
add esp, 4
lea edx, [esp + 0xdc]
push edx
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x84]
push ecx
lea edx, [esp + 0x45c]
push edx
call fcn.0040bde0
lea ecx, [esp + 0x450]
lea ebx, [esp + 0x1a8]
mov byte [esp + 0xa93c], 0x3f
call fcn.00416540
lea esi, [esp + 0x450]
call fcn.004141f0
lea eax, [esp + 0xdc]
call fcn.00401ea0
lea eax, [esp + 0x1a0]
call fcn.00401ea0
lea eax, [esp + 0x100]
call fcn.00401ea0
lea eax, [esp + 0x7c]
mov byte [esp + 0xa93c], 0x28
call fcn.00401ea0
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0xf0]
mov eax, dword [esp + 0xa0]
inc eax
add edi, 4
mov dword [esp + 0xa0], eax
mov dword [esp + 0xf0], edi
cmp eax, dword [esp + 0x334]
jb 0x413223
inc dword [esp + 0x174]
cmp byte [esp + 0x6e], 0
mov eax, dword [esp + 0x3a08]
mov dword [0x4c6004], eax
je 0x41366f
mov ecx, dword [esp + 0x2ec]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [esp + 0x300]
call fcn.00406a10
lea esi, [esp + 0x200]
call fcn.00416840
lea esi, [esp + 0x4f4]
mov byte [esp + 0xa93c], 0x19
call fcn.00416710
cmp byte [0x4c7d63], 0
je 0x40e15a
cmp byte [esp + 0x45], 0
je 0x4137a1
mov edx, dword [esp + 0x4c]
cmp dword [edx - 0xc], 0
je 0x4137a1
mov eax, dword [esp + 0xe4]
push eax
push 0x4cb970
lea ecx, [esp + 0x54]
call fcn.00427ba0
mov ecx, dword [esp + 0xec]
push ecx
push 0x4cb970
lea ecx, [esp + 0x54]
call fcn.00427c70
call fcn.00427ee0
cmp byte [esp + 0x3aa7], 0
je 0x4137a1
cmp byte [esp + 0x3aa2], 0
jne 0x4137a1
push 0
test al, al
jne 0x41377e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
lea edx, [esp + 0x50bc]
push 0x26
push edx
mov edx, dword [0x4c86c4]
jmp 0x41379a
lea esi, [esp + 0x4f4]
mov byte [esp + 0xa93c], 0x19
call fcn.00416710
jmp 0x4136a8
push str.ERROR___CRITICAL___PEHideText_strings_not_encrypted_correctly._Build_error._EXITING_GOVERNOR_...
call fcn.004261a0
add esp, 4
push 0x10
push str.ioloGovernor
push str.ERROR___CRITICAL___PEHideText_strings_not_encrypted_correctly._Build_error._EXITING_GOVERNOR_...
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x80070057
call fcn.004018d0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, dword [0x4c86bc]
push eax
push 0x4ab2fc
push 0x25
lea eax, [esp + 0x50c0]
push eax
xor ecx, ecx
call fcn.004366a0
mov esi, dword [esp + 0x60]
xor ebx, ebx
cmp dword [esi - 0xc], ebx
je 0x4137fb
push esi
push str.Leaving_EnergyBooster_profile__s
call fcn.004261a0
add esp, 8
lea ecx, [esp + 0x3f8]
push ecx
call fcn.00438900
push esi
push str.Leaving_EnergyBooster_Profile__s._energyboooster
lea edi, [esp + 0x30]
call fcn.004020e0
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x4ab2fc
push 0x57
lea edx, [esp + 0x50c0]
push edx
mov edx, dword [esp + 0x3c]
xor ecx, ecx
call fcn.004366a0
lea eax, [esp + 0x398]
push eax
call fcn.0045c760
lea ecx, [esp + 0x378]
push ecx
call fcn.0045c760
mov esi, dword [esp + 0xd0]
cmp esi, ebx
je 0x4138b7
mov edi, dword [esp + 0x11c]
push edi
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea edx, [esp + 0x2e0]
push edx
push esi
mov dword [esp + 0x2e8], ebx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x41385f
push 0xfa
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x413896
push str.Forcing_thread_termination___mem_mechanic_thread
call fcn.004261a0
add esp, 4
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [esp + 0x26c]
push eax
push esi
mov dword [esp + 0x274], ebx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x413896
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x2cc]
push ecx
push edi
mov dword [esp + 0x2d4], ebx
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x4138b7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004011c0
lea esi, [esp + 0x300]
call fcn.00406870
push str.pg:_Exit__now_cleaning_up
call fcn.004261a0
mov eax, dword [esp + 0xd0]
add esp, 4
cmp eax, 0xffffffff
je 0x413926
cmp eax, ebx
je 0x413926
push eax
push ebx
push 0x200
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, ebx
je 0x413926
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
lea edx, [esp + 0x280]
push edx
push esi
mov dword [esp + 0x288], ebx
call edi
test eax, eax
je 0x41392c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41392c
mov edi, dword [sym.imp.KERNEL32.dll_GetHandleInformation]
mov eax, dword [esp + 0xb0]
cmp eax, 0xffffffff
je 0x413982
cmp eax, ebx
je 0x413982
push eax
push ebx
push 0x20
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, ebx
je 0x413982
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test eax, eax
jne 0x413965
push str.pg:_Error_restoring_thread_priority.
call fcn.004261a0
add esp, 4
lea eax, [esp + 0x2d4]
push eax
push esi
mov dword [esp + 0x2dc], ebx
call edi
test eax, eax
je 0x413982
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [esp + 0x52], 0
je 0x4139c0
cmp byte [0x4cb970], 0
je 0x4139a1
lea ecx, [esp + 0x128]
push ecx
push ebx
call dword [0x4c7d90]
call fcn.00401db0
lea edx, [esp + 0x610]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [esp + 0x1e8]
call fcn.0045f720
cmp dword [esp + 0xc4], ebx
je 0x4139e1
cmp byte [0x4cb970], 0
je 0x4139e1
lea eax, [esp + 0x248]
push eax
push ebx
call dword [0x4c7d90]
call fcn.004025c0
call fcn.00402800
lea ecx, [esp + 0x50b0]
push ecx
call fcn.0040c480
mov esi, dword [esp + 0x128]
add esp, 4
cmp esi, ebx
je 0x413a23
lea edx, [esp + 0x1a4]
push edx
push esi
mov dword [esp + 0x1ac], ebx
call edi
test eax, eax
je 0x413a23
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [esp + 0x118]
cmp edi, ebx
je 0x413a35
call fcn.00414250
xor ebx, ebx
lea esi, [esp + 0x5e4]
call fcn.00416710
lea esi, [esp + 0x300]
call fcn.0040bfa0
mov esi, dword [esp + 0x1a8]
cmp esi, ebx
je 0x413a7a
mov eax, dword [esp + 0x294]
mov edi, dword [esp + 0x1ac]
push eax
mov eax, esi
call fcn.0041c270
add esp, 4
push esi
call fcn.00472958
add esp, 4
mov byte [esp + 0xa93c], 0x13
mov eax, dword [esp + 0x5c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413aa2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x570]
push ecx
mov dword [esp + 0x554], 0x4b001c
call fcn.00472958
add esp, 4
cmp dword [esp + 0x568], 0x10
mov dword [esp + 0x550], 0x4afff4
jb 0x413ae2
mov edx, dword [esp + 0x554]
push edx
call fcn.00472958
add esp, 4
lea eax, [esp + 0x378]
mov ebx, 0xf
push eax
mov dword [esp + 0x56c], ebx
mov dword [esp + 0x568], 0
mov byte [esp + 0x558], 0
mov byte [esp + 0xa940], 0x10
call fcn.00413cd0
lea ecx, [esp + 0x398]
push ecx
mov byte [esp + 0xa940], bl
call fcn.00413cd0
lea edx, [esp + 0xa08]
push edx
mov byte [esp + 0xa940], 0xe
call fcn.0043f5d0
lea eax, [esp + 0x50b0]
push eax
mov byte [esp + 0xa940], 0xd
call fcn.004365b0
mov eax, dword [esp + 0x1b8]
test eax, eax
je 0x413b68
push eax
call fcn.00472958
add esp, 4
mov byte [esp + 0xa93c], 0xa
mov eax, dword [esp + 0xf4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413b93
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xa93c], 9
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413bbb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xa93c], 8
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413be3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esi, [esp + 0x460]
call fcn.0045db30
mov byte [esp + 0xa93c], 5
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413c17
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esp + 0x218]
call fcn.0045bec0
lea eax, [esp + 0x4c8]
call fcn.00459fd0
lea ecx, [esp + 0x1e8]
mov byte [esp + 0xa93c], 2
call fcn.0045f210
mov byte [esp + 0xa93c], 1
mov eax, dword [esp + 0xac]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413c6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0xa93c], 0
mov eax, dword [esp + 0x60]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413c96
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x3f8]
push ecx
mov dword [esp + 0xa940], 0xffffffff
call fcn.0040c200
mov ecx, dword [esp + 0xa934]
pop edi
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret