Function at 0x43127d
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4e94b6
call fcn.004b48a0
sub esp, 0x230
and dword [ebp - 0x2c], 0
push esi
push edi
lea eax, [ebp - 0x2c]
push eax
push 0x51d164
mov esi, str.NTDLL.DLL
push esi
push str.RtlCreateUnicodeString
call fcn.00444a50
lea eax, [ebp - 0x2c]
push eax
push 0x51d168
push esi
push str.RtlFreeUnicodeString
call fcn.00444a50
mov eax, dword [ebp + 0x28]
and eax, 0x10
mov dword [ebp - 0x30], eax
mov eax, dword [0x51d13c]
add esp, 0x20
test eax, eax
jne 0x4312dd
push 3
pop eax
jmp 0x43184c
push ebx
push str.DeviceImDiskCtl
lea ecx, [ebp - 0x18]
push ecx
call eax
mov esi, 0xc0000000
push esi
lea eax, [ebp - 0x18]
push eax
call dword [0x51d278]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x431332
call ebx
cmp eax, 2
jne 0x431814
push str.ImDisk
call dword [0x51d288]
test eax, eax
je 0x431823
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
lea eax, [ebp - 0x18]
push eax
call dword [0x51d278]
cmp eax, 0xffffffff
mov dword [ebp + 0x28], eax
je 0x431301
push eax
call fcn.00422acb
test eax, eax
pop ecx
jne 0x43134d
push 5
pop esi
jmp 0x431615
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0x14]
xor ecx, ecx
and eax, 0xf000
and edi, 0xf00
cmp eax, 0x1000
sete cl
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], edi
mov eax, ecx
xor ecx, ecx
cmp edi, 0x100
sete cl
xor edx, edx
test edi, edi
sete dl
or ecx, edx
test eax, ecx
je 0x431555
push str.DeviceAWEAlloc
lea eax, [ebp - 0x24]
push eax
call dword [0x51d13c]
jmp 0x4313c2
call ebx
cmp eax, 2
jne 0x4313f4
push str.AWEAlloc
call dword [0x51d288]
test eax, eax
je 0x43150a
push str.AWEAlloc_driver_was_loaded_into_the_kernel.
call fcn.004b5559
pop ecx
lea eax, [ebp - 0x24]
push esi
push eax
call dword [0x51d278]
mov edi, eax
cmp edi, 0xffffffff
je 0x43139d
push 0
push 0x51d16c
push str.NTDLL.DLL
push str.NtClose
call fcn.00444a50
add esp, 0x10
push edi
call dword [0x51d16c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
cmp dword [ebp + 0x18], edi
jne 0x4315f8
push edi
lea eax, [ebp - 0x18]
push eax
call dword [0x51d13c]
movzx eax, word [ebp - 0x18]
lea eax, [eax + eax + 0x38]
push eax
lea ecx, [ebp - 0x28]
call fcn.004492b0
movzx eax, word [ebp - 0x18]
mov ebx, dword [ebp - 0x28]
add eax, 0x38
push eax
push edi
push ebx
mov dword [ebp - 4], 1
call fcn.004b4840
add esp, 0xc
cmp dword [ebp + 0x20], edi
je 0x431473
cmp dword [ebp - 0x30], edi
jne 0x431473
mov edi, dword [ebp + 0x20]
push edi
call esi
cmp eax, 2
jne 0x431459
cmp word [edi + 2], 0x3a
je 0x43146c
cmp eax, 3
jne 0x431473
cmp word [edi + 2], 0x3a
jne 0x431473
cmp word [edi + 4], 0x5c
jne 0x431473
mov ax, word [edi]
mov word [ebx + 0x2c], ax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
push 6
lea edi, [ebx + 8]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
mov dword [ebx + 0x20], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x28], eax
mov ax, word [ebp - 0x18]
mov word [ebx + 0x2e], ax
cmp word [ebp - 0x18], 0
je 0x4314c6
movzx eax, word [ebp - 0x18]
push eax
push dword [ebp - 0x14]
lea eax, [ebx + 0x30]
push eax
call fcn.004b4dd0
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
call dword [0x51d168]
movzx eax, word [ebx + 0x2e]
xor esi, esi
push esi
lea ecx, [ebp - 0x34]
push ecx
add eax, 0x38
push eax
push ebx
push eax
push ebx
push 0x8372e004
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x43173f
push str.Error_creating_virtual_disk:
call fcn.00422a7a
pop ecx
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 3
pop esi
jmp 0x431803
call ebx
cmp eax, 2
jb 0x43154e
cmp eax, 3
jbe 0x43153c
cmp eax, 0x422
je 0x431530
cmp eax, 0x424
jne 0x43154e
push 0x51abb0
push str.The_AWEAlloc_driver_is_not_installed._r_nPlease_re_install_ImDisk._r_n
jmp 0x431546
push 0x51abb0
push str.The_AWEAlloc_driver_is_disabled._r_n
jmp 0x431546
push 0x51abb0
push str.Cannot_load_AWEAlloc_driver._r_nPlease_re_install_ImDisk._r_n
call fcn.004b54e8
pop ecx
jmp 0x4315cc
push str.Error_loading_AWEAlloc_driver:
jmp 0x4315c7
xor ecx, ecx
cmp dword [ebp - 0x10], 0x2000
sete cl
or ecx, eax
xor eax, eax
cmp edi, 0x300
sete al
test eax, ecx
je 0x4313f4
mov esi, dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
push 0
mov edi, str..PIPEImDskSvc
push edi
call esi
test eax, eax
jne 0x4313f4
call ebx
cmp eax, 2
jne 0x4313f4
push str.ImDskSvc
call dword [0x51d288]
test eax, eax
jne 0x4315ea
call ebx
cmp eax, 2
jb 0x4315c2
cmp eax, 3
jbe 0x4315cd
cmp eax, 0x422
je 0x4315cd
cmp eax, 0x424
je 0x4315cd
push str.Error_starting_ImDisk_Virtual_Disk_Driver_Helper_Service:
call fcn.00422a7a
pop ecx
push 7
jmp 0x431347
call ebx
cmp eax, 2
jne 0x4313f4
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push edi
call esi
test eax, eax
je 0x4315d4
jmp 0x4313f4
cmp dword [ebp + 0x1c], edi
je 0x431625
push dword [ebp + 0x18]
lea eax, [ebp - 0x18]
push eax
call dword [0x51d164]
test eax, eax
jne 0x431410
or esi, 0xffffffff
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x43184b
xor eax, eax
cmp dword [ebp - 0x10], 0x3000
push edi
sete al
xor ecx, ecx
cmp dword [ebp - 0x1c], 0x300
sete cl
test ecx, eax
je 0x431706
push 0x80
push 3
push edi
push 1
push edi
push str._Global
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
call ebx
dec eax
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x10], str.BaseNamedObjects_
sete cl
test ecx, eax
jne 0x431683
mov dword [ebp - 0x10], str.BaseNamedObjectsGlobal_
cmp dword [ebp - 0x1c], 0xffffffff
je 0x431692
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0x18]
call esi
push dword [ebp - 0x10]
mov ebx, eax
call esi
lea eax, [eax + ebx + 2]
push eax
lea ecx, [ebp - 0x20]
call fcn.004494b0
mov ebx, dword [ebp - 0x20]
cmp ebx, edi
mov dword [ebp - 4], edi
jne 0x4316d2
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443880
or eax, 0xffffffff
jmp 0x43184b
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [ebp - 0x18]
push eax
call dword [0x51d164]
test eax, eax
je 0x4316b5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00443880
jmp 0x431410
push 0x51d160
push str.NTDLL.DLL
push str.RtlDosPathNameToNtPathName_U
call fcn.00444a50
add esp, 0x10
push edi
push edi
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x18]
call dword [0x51d160]
test eax, eax
jne 0x431410
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4316ca
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 0x20]
cmp edi, esi
mov eax, dword [ebx]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
je 0x4317f0
push dword [ebx]
lea eax, [ebp - 0x23c]
push str.DeviceImDisk_u
push 0x103
push eax
call fcn.004b5478
add esp, 0x10
cmp word [ebx + 0x2c], si
lea eax, [ebp - 0x23c]
push eax
mov word [ebp - 0x36], si
push edi
jne 0x4317d9
call dword [0x51d28c]
test eax, eax
jne 0x4317f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
je 0x4317d4
sub eax, 0x56
je 0x4317d4
sub eax, 0x3a
je 0x4317d4
sub eax, 0x7a
je 0x4317d4
sub eax, 0x101b
je 0x4317d4
dec eax
dec eax
je 0x4317c1
push str.Error_creating_mount_point:
call fcn.00422a7a
pop ecx
jmp 0x4317d4
push edi
push str.Invalid_mount_point_path:__1_ws__n
push 0x51abb0
call fcn.00422a1e
add esp, 0xc
mov word [edi], si
jmp 0x4317f0
push 1
call dword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
test eax, eax
jne 0x4317f0
push str.Error_creating_mount_point:
call fcn.00422a7a
pop ecx
cmp dword [ebp + 0x24], esi
je 0x431803
push dword [ebp + 0x24]
push edi
push dword [ebx]
call fcn.0042b108
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00443880
jmp 0x43161e
push str.Error_controlling_the_ImDisk_Virtual_Disk_Driver:
call fcn.00422a7a
pop ecx
push 6
jmp 0x43184a
call ebx
cmp eax, 2
jb 0x43183d
cmp eax, 3
jbe 0x431848
cmp eax, 0x422
je 0x431848
cmp eax, 0x424
je 0x431848
push str.Error_loading_ImDisk_Virtual_Disk_Driver:
call fcn.00422a7a
pop ecx
push 4
pop eax
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret