Function at 0x415f77
Capabilities:
Get memory capacity

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x1ac
xor ecx, ecx
cmp dword [0x496e94], ecx
jne 0x415f94
or eax, 0xffffffff
jmp 0x416c5a
xor eax, eax
push ebx
or dword [ebp + 0x50], 0xffffffff
push esi
push edi
mov dword [ebp + 0x38], ecx
mov esi, dword [ebp + 0x78]
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp + 0x60], ecx
lea edi, [ebp + 0x64]
stosd dword es:[edi], eax
mov byte [ebp + 0x5f], al
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
mov ax, word [eax]
xor ebx, ebx
cmp dword [ebp + 0x74], 2
mov dword [ebp + 0x24], ecx
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
mov dword [ebp + 0x34], ecx
mov dword [ebp + 0x30], ecx
mov dword [ebp], ebx
mov dword [ebp + 0x10], ecx
mov dword [ebp + 4], ecx
mov dword [ebp + 0x58], ecx
mov dword [ebp + 0xc], ecx
mov word [ebp + 0x1c], ax
mov dword [0x495298], 0xfa0
mov dword [ebp + 0x20], ecx
jne 0x4160bc
push str.__version
push dword [esi + 4]
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x4160c6
mov eax, dword [0x496e98]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x18], ecx
mov dword [ebp + 0x1c], ecx
je 0x416038
lea ecx, [ebp + 0x18]
push ecx
lea ecx, [ebp + 8]
push ecx
call eax
lea ecx, [ebp + 0x28]
call fcn.0042c809
push 0x3f
lea eax, [ebp + 0x28]
push eax
push 1
call fcn.0040e5b9
add esp, 0xc
cmp eax, 2
mov ecx, 0x4837f0
jne 0x41605f
mov ecx, str.NotLoad
cmp eax, 0xffffffff
jne 0x416069
mov ecx, str.CannotControl
movzx eax, byte [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
shrd ecx, eax, 8
shr eax, 8
movsx eax, cx
push eax
movzx eax, byte [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 8]
shrd ecx, eax, 8
shr eax, 8
movsx eax, cx
push eax
mov eax, dword [ebp + 0x7c]
push str._X._X___X._X__s
push dword [eax]
mov dword [ebp + 0x34], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea ecx, [ebp + 0x28]
call fcn.00427365
jmp 0x416c55
cmp dword [ebp + 0x74], 1
jle 0x416728
mov ebx, 0x3e8
xor edi, edi
dec dword [ebp + 0x74]
add esi, 4
push str.__id
push dword [esi]
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x4160ee
or dword [ebp + 0x20], 2
jmp case.0x416312.114
push str.__nbrd
push dword [esi]
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x416109
or dword [ebp + 0x20], 1
jmp case.0x416312.114
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x416125
mov eax, dword [esi]
xor ecx, ecx
cmp word [eax], 0x2d
sete cl
mov eax, ecx
jmp 0x416127
xor eax, eax
cmp eax, edi
je case.0x416312.114
mov eax, dword [esi]
mov cx, word [eax + 2]
movzx eax, cx
cmp eax, 0x6d
jg 0x416306
je 0x4162db
cmp eax, 0x62
jg 0x416263
je 0x4161a3
sub eax, 0x44
je 0x4162af
dec eax
dec eax
je 0x416283
sub eax, 0xc
je 0x4162af
dec eax
je 0x416184
sub eax, 0xe
jne case.0x416312.114
mov dword [ebp + 0x24], 1
jmp case.0x416312.114
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.0046ddc6
push edi
push edi
push dword [esi]
call fcn.0046ddaf
mov dword [ebp + 0x4c], eax
jmp 0x416713
add esi, 4
push str.auto
push dword [esi]
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x4161c4
mov dword [ebp + 4], 1
jmp 0x416716
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x60]
push eax
push str._I64u_c
push dword [esi]
mov dword [ebp + 0x54], edi
call fcn.0046db83
movzx eax, word [ebp + 0x54]
add esp, 0x10
cmp eax, 0x62
jg 0x416752
je 0x41624b
sub eax, edi
je 0x416716
sub eax, 0x47
je 0x41621b
sub eax, 4
je 0x41623c
dec eax
dec eax
je 0x41622d
sub eax, 7
jne 0x4167b1
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x64]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x416221
mov ecx, dword [ebp + 0x64]
mov eax, dword [ebp + 0x60]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp + 0x64], ecx
jmp 0x416230
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x64]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x416242
mov ecx, dword [ebp + 0x64]
mov eax, dword [ebp + 0x60]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x416258
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x64]
shld ecx, eax, 9
shl eax, 9
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], ecx
jmp 0x416716
sub eax, 0x64
je 0x4162af
dec eax
je 0x4162a3
dec eax
je 0x416283
sub eax, 6
jne case.0x416312.114
mov dword [ebp + 0x24], 3
jmp case.0x416312.114
cmp cx, 0x46
jne 0x416290
mov dword [ebp + 0x14], 1
add esi, 4
push dword [esi]
call fcn.0040d003
pop ecx
mov dword [ebp + 0x30], eax
jmp 0x416716
mov dword [ebp + 0x24], 4
jmp case.0x416312.114
cmp cx, 0x44
mov dword [ebp + 0x24], 2
jne 0x4162c3
mov dword [ebp + 0x2c], 1
cmp cx, 0x52
jne case.0x416312.114
xor eax, eax
inc eax
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x34], eax
jmp case.0x416312.114
add esi, 4
mov ecx, dword [esi]
mov ax, word [ecx]
cmp ax, 0x61
mov dword [ebp], ecx
jb 0x416716
cmp ax, 0x7a
ja 0x416716
and ax, 0xffdf
mov word [ecx], ax
jmp 0x416716
sub eax, 0x6e
cmp eax, 0xb
ja case.0x416312.114
jmp dword [eax*4 + 0x416c5f]
mov dword [0x495298], 1
jmp case.0x416312.114
add esi, 4
push str.file
push dword [esi]
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x416346
or byte [ebp + 0x69], 1
jmp 0x416716
push 0x483754
push dword [esi]
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x416361
or byte [ebp + 0x69], 2
jmp 0x416716
push str.proxy
push dword [esi]
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x416716
or byte [ebp + 0x69], 3
jmp 0x416716
mov dword [ebp + 0x28], 1
jmp case.0x416312.114
add esi, 4
push 0x481314
push dword [esi]
jmp 0x4164f8
push 0x483740
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x4163b9
or dword [ebp + 0x58], 1
or dword [ebp + 0x68], 1
jmp 0x4164f1
push 0x483738
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x4163d7
or dword [ebp + 0x58], 1
and dword [ebp + 0x68], 0xfffffffe
jmp 0x4164f1
push 0x483730
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x4163f5
or dword [ebp + 0x58], 2
or dword [ebp + 0x68], 2
jmp 0x4164f1
push 0x483728
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x416413
or dword [ebp + 0x58], 2
and dword [ebp + 0x68], 0xfffffffd
jmp 0x4164f1
push str.saved
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x416431
or byte [ebp + 0x5a], 1
and byte [ebp + 0x6a], 0xfe
jmp 0x4164f1
cmp dword [ebp + 0x24], 1
jne 0x4164f1
push 0x483714
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x41645c
or byte [ebp + 0x69], 0x20
mov dword [ebp + 0x14], 1
jmp 0x4164f1
push str.comm
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x41647a
or byte [ebp + 0x69], 0x10
mov dword [ebp + 0x14], 1
jmp 0x4164f1
push 0x483700
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x416491
or byte [ebp + 0x69], 0x30
jmp 0x4164f1
push 0x4836f8
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x4164a8
or byte [ebp + 0x69], 0x11
jmp 0x4164f1
test byte [ebp + 0x68], 0xf0
jne 0x4164f1
push 0x4836f0
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x4164c5
or dword [ebp + 0x68], 0x10
jmp 0x4164f1
push 0x4836e8
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x4164dc
or dword [ebp + 0x68], 0x20
jmp 0x4164f1
push 0x4836e0
push edi
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x4164f1
or dword [ebp + 0x68], 0x30
push 0x481314
push 0
call fcn.0046dade
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x41639b
dec dword [ebp + 0x74]
jmp case.0x416312.114
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x38]
push eax
add esi, 4
push str._I64i_c
push dword [esi]
mov dword [ebp + 0x54], edi
call fcn.0046db83
movzx eax, word [ebp + 0x54]
add esp, 0x10
cmp eax, 0x54
jg 0x4165c6
je 0x416589
sub eax, edi
je 0x416640
sub eax, 0x25
je 0x416561
sub eax, 0x22
je 0x416598
sub eax, 4
je 0x4165b7
dec eax
dec eax
jne 0x4167b1
mov eax, dword [ebp + 0x38]
jmp 0x4165a8
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
push edi
push dword [ebp - 0x14]
call fcn.0046d9d0
push edi
push 0x64
push edx
push eax
call fcn.0046d850
jmp 0x416628
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp + 0x3c]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x41659e
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x38]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp + 0x3c], ecx
mov ecx, dword [ebp + 0x3c]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp + 0x3c], ecx
jmp 0x4165ba
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp + 0x3c]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x41663a
sub eax, 0x62
je 0x41662d
sub eax, 5
je 0x4165f5
sub eax, 4
je 0x41661b
dec eax
dec eax
je 0x416608
sub eax, 7
jne 0x4167b1
push edi
push ebx
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
call fcn.0046d9d0
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], edx
push edi
push ebx
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
call fcn.0046d9d0
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], edx
push edi
push ebx
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
call fcn.0046d9d0
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], edx
push edi
push ebx
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
call fcn.0046d9d0
mov dword [ebp + 0x3c], edx
jmp 0x41663d
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp + 0x3c]
shld ecx, eax, 9
shl eax, 9
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x38], eax
cmp dword [ebp + 0x3c], edi
jg 0x416716
jl 0x416654
cmp dword [ebp + 0x38], edi
jae 0x416716
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x34]
add dword [ebp + 0x38], eax
adc dword [ebp + 0x3c], edi
js 0x416678
jg 0x416716
cmp dword [ebp + 0x38], edi
jae 0x416716
xor ecx, ecx
cmp ecx, 0x100
mov edi, 0x400
mov esi, 0x100000
mov edx, 0x40000000
jb 0x4167d0
ja 0x41669f
test eax, eax
jb 0x4167d0
mov ebx, 0x4836cc
jmp 0x416800
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.0046ddc6
push edi
push edi
push dword [esi]
call fcn.0046ddaf
mov dword [ebp + 0x48], eax
jmp 0x416713
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.0046ddc6
push edi
push edi
push dword [esi]
call fcn.0046ddaf
mov dword [ebp + 0x44], eax
jmp 0x416713
add esi, 4
mov eax, dword [esi]
mov al, byte [eax]
sub al, 0x30
mov byte [ebp + 0x5f], al
jmp 0x416716
add esi, 4
mov eax, dword [esi]
mov dword [ebp + 0x10], eax
jmp 0x416716
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.0046ddc6
push edi
push edi
push dword [esi]
call fcn.0046ddaf
mov dword [ebp + 0x50], eax
add esp, 0x10
dec dword [ebp + 0x74]
cmp dword [ebp + 0x74], 1
jg 0x4160cd
mov ebx, dword [ebp]
xor ecx, ecx
mov eax, dword [ebp + 0x24]
dec eax
mov dword [ebp + 0x54], ecx
je 0x41695c
dec eax
je 0x41694b
dec eax
je 0x4168fd
dec eax
je 0x4168a9
or eax, 0xffffffff
jmp 0x416c57
sub eax, 0x67
je 0x416778
sub eax, 4
je 0x41679e
dec eax
dec eax
je 0x41678b
sub eax, 7
jne 0x4167b1
push edi
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.0046d9d0
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
push edi
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.0046d9d0
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
push edi
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.0046d9d0
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
push edi
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.0046d9d0
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
movzx eax, word [ebp + 0x54]
push eax
push str.ImDisk:_Unsupported_size_suffix:__wc_n
push 0x495830
call fcn.0046d42d
add esp, 0xc
push 0xa
pop eax
jmp 0x416c57
cmp eax, edx
jb 0x4167db
mov ebx, 0x4836a0
jmp 0x416800
cmp eax, esi
jb 0x4167e6
mov ebx, 0x48369c
jmp 0x416800
cmp eax, edi
jb 0x4167f1
mov ebx, 0x483698
jmp 0x416800
cmp eax, 1
mov ebx, str.byte
je 0x416800
mov ebx, 0x483688
cmp ecx, 0x100
jb 0x416826
ja 0x41680e
test eax, eax
jb 0x416826
test eax, eax
mov dword [ebp + 0x1c], eax
fild dword [ebp + 0x1c]
jge 0x41681e
fadd qword [0x483680]
fmul qword [0x483678]
jmp 0x41688a
cmp eax, edx
jb 0x416842
test eax, eax
mov dword [ebp + 0x1c], eax
fild dword [ebp + 0x1c]
jge 0x41683a
fadd qword [0x483680]
fmul qword [0x483670]
jmp 0x416824
cmp eax, esi
jb 0x41685e
test eax, eax
mov dword [ebp + 0x1c], eax
fild dword [ebp + 0x1c]
jge 0x416856
fadd qword [0x483680]
fmul qword [0x483668]
jmp 0x416824
cmp eax, edi
jb 0x41687a
test eax, eax
mov dword [ebp + 0x1c], eax
fild dword [ebp + 0x1c]
jge 0x416872
fadd qword [0x483680]
fmul qword [0x483660]
jmp 0x416824
test eax, eax
mov dword [ebp + 0x1c], eax
fild dword [ebp + 0x1c]
jge 0x41688a
fadd qword [0x483680]
push ebx
push ecx
push ecx
fstp qword [esp]
push str.ImDisk:_Not_enough_memory__there_is_currently__.4g__s_free_physical_memory._n
push 0x495830
call fcn.0046d42d
add esp, 0x14
push 0xb
jmp 0x4167ca
cmp dword [ebp + 0x58], ecx
je 0x4168c4
push dword [ebp + 0x68]
push dword [ebp + 0x58]
push ebx
push dword [ebp + 0x50]
call fcn.0040e9f9
add esp, 0x10
xor ecx, ecx
jmp 0x4168c7
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x3c], ecx
jl 0x4168e7
jg 0x4168d3
cmp dword [ebp + 0x38], ecx
jbe 0x4168e7
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
push ebx
push dword [ebp + 0x50]
call fcn.0040ec2f
add esp, 0x10
xor ecx, ecx
cmp eax, ecx
jne 0x416c57
cmp dword [ebp + 0x10], ecx
jne 0x416b27
jmp 0x416c57
mov ecx, dword [ebp + 0x7c]
push 0x483608
call fcn.00436622
xor eax, eax
cmp dword [ebp + 0x50], 0xffffffff
sete al
xor ecx, ecx
test ebx, ebx
sete cl
test ecx, eax
je 0x416934
push dword [ebp + 0x1c]
push dword [ebp + 0x7c]
push dword [ebp + 0x28]
call fcn.0040e5b9
add esp, 0xc
jmp 0x416c57
push dword [ebp + 0x20]
push dword [ebp + 0x7c]
push ebx
push dword [ebp + 0x50]
call fcn.0040e6c2
add esp, 0x10
jmp 0x416c57
push dword [ebp + 0x34]
push dword [ebp + 0x2c]
push ebx
push dword [ebp + 0x50]
call fcn.0040e082
jmp 0x416943
cmp dword [ebp + 4], ecx
je 0x416974
cmp dword [ebp + 0x30], 0
je 0x416974
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x30]
call dword [0x496e78]
push 0x480934
push str.CurRamDisk
mov ecx, 0x496eb8
call fcn.0042b2cd
cmp byte [ebp + 0x5f], 0
je 0x416a08
movzx edi, byte [ebp + 0x5f]
mov eax, edi
shl eax, 5
lea esi, [ebp + eax - 0x160]
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x30]
call dword [0x496e7c]
test eax, eax
je 0x4169ed
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, ecx
xor ebx, ebx
or eax, edx
jne 0x4169c7
inc ebx
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x4169d4
xor eax, eax
inc eax
jmp 0x4169d6
xor eax, eax
or eax, ebx
je 0x4169f4
push edi
push str.Error:_Partition__i_is_not_defined._n
push 0x495830
call fcn.0046d42d
add esp, 0xc
push 0xc
jmp 0x4167ca
add dword [ebp + 0x60], ecx
mov eax, dword [esi + 8]
mov ebx, dword [ebp]
adc dword [ebp + 0x64], edx
mov dword [ebp + 0x38], eax
mov eax, dword [esi + 0xc]
jmp 0x416a7e
cmp dword [ebp + 4], 0
je 0x416a81
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x30]
call dword [0x496e7c]
test eax, eax
je 0x416a81
lea eax, [ebp - 0x140]
mov ecx, dword [eax]
xor edx, edx
or ecx, dword [eax + 4]
je 0x416a39
inc edx
mov ecx, dword [eax + 8]
xor esi, esi
or ecx, dword [eax + 0xc]
je 0x416a44
inc esi
mov cl, byte [eax + 0x18]
cmp cl, 5
je 0x416a56
cmp cl, 0xf
je 0x416a56
xor ecx, ecx
inc ecx
jmp 0x416a58
xor ecx, ecx
and ecx, esi
test edx, ecx
jne 0x416a6a
add eax, 0x20
lea ecx, [ebp - 0x40]
cmp eax, ecx
jb 0x416a2f
jmp 0x416a81
mov ecx, dword [eax]
add dword [ebp + 0x60], ecx
mov ecx, dword [eax + 4]
adc dword [ebp + 0x64], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp + 0x38], ecx
mov dword [ebp + 0x3c], eax
mov esi, 0x4975e4
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4835c0
push ebx
call fcn.0046d65c
test eax, eax
pop ecx
pop ecx
jne 0x416aaa
call dword [0x496e6c]
mov word [ebx], ax
mov dword [ebp + 0x54], eax
push ebx
push dword [ebp + 0x14]
lea eax, [ebp + 0x60]
push dword [ebp + 0x30]
push dword [ebp + 0x68]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x50]
push eax
call fcn.0040d8fc
add esp, 0x1c
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x416adc
mov eax, edi
jmp 0x416c57
cmp dword [ebp + 0x28], 0
je 0x416af3
push dword [ebp + 0x50]
push 0x4835bc
call fcn.0046da78
pop ecx
pop ecx
jmp 0x416b21
mov ecx, dword [ebp + 0x30]
test ecx, ecx
jne 0x416aff
mov ecx, str.VM_image
test ebx, ebx
mov eax, str.No_mountpoint
je 0x416b0a
mov eax, ebx
push ecx
push eax
push dword [ebp + 0x50]
push str.Created_device__1_u_:__2_ws______3_ws_
push 0x495810
call fcn.0040d7b9
add esp, 0x14
cmp dword [ebp + 0x10], 0
je 0x416b3a
test ebx, ebx
je 0x416c22
push dword [ebp + 0x10]
push ebx
call fcn.0040ded1
pop ecx
pop ecx
test ebx, ebx
je 0x416c22
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
cmp eax, 2
jne 0x416b5c
xor eax, eax
cmp word [ebx + 2], 0x3a
sete al
jmp 0x416b7d
push ebx
call esi
cmp eax, 3
jne 0x416b7b
lea eax, [ebx + 2]
push 0x482730
push eax
call fcn.0046d65c
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x416b7d
xor eax, eax
test eax, eax
je 0x416c22
movzx esi, word [ebx]
xor eax, eax
mov dword [ebp - 0x14], 0x14
mov dword [ebp - 0x10], 2
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
sub esi, 0x41
inc eax
mov ecx, esi
shl eax, cl
push ebx
push str.CurRamDisk
mov ecx, 0x496eb8
mov dword [ebp - 8], eax
call fcn.0042b2cd
test byte [ebp + 0x20], 1
jne 0x416c22
cmp esi, 0x19
ja 0x416c22
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea eax, [ebp + 0x34]
push eax
push dword [0x495298]
lea eax, [ebp - 0x14]
push 3
push eax
push 0x8000
mov ebx, 0x219
push ebx
mov edi, 0xffff
push edi
call esi
lea eax, [ebp + 0x34]
push eax
push dword [0x495298]
lea eax, [ebp - 0x14]
push 3
push eax
push 0x8000
push ebx
push edi
mov word [ebp - 4], 1
call esi
lea eax, [ebp + 0x34]
push eax
push dword [0x495298]
push 3
push 0
push 7
push ebx
push edi
call esi
mov edi, dword [ebp + 0x54]
test di, di
je 0x416c55
push 0xffffffffffffffff
push 0x483560
lea ecx, [ebp + 0x2c]
call fcn.004365f0
mov esi, dword [ebp + 0x7c]
lea eax, [ebp + 0x2c]
push eax
mov ecx, esi
call fcn.00436650
lea ecx, [ebp + 0x2c]
call fcn.00427365
mov eax, dword [esi]
mov word [eax + 2], di
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret