Function at 0x429c28
Capabilities:
Get memory capacity

Disassembly:
mov eax, 0x4e4f42
call fcn.004afe60
sub esp, 0x1ac
xor ecx, ecx
cmp dword [0x51913c], ecx
jne 0x429c4a
or eax, 0xffffffff
jmp 0x42a94e
xor eax, eax
push ebx
or dword [ebp - 0x28], 0xffffffff
push esi
push edi
mov dword [ebp - 0x40], ecx
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp - 0x18], ecx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
mov byte [ebp - 0x19], al
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ax, word [eax]
xor ebx, ebx
cmp dword [ebp + 8], 2
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x70], ecx
mov word [ebp - 0x58], ax
mov dword [0x515300], 0xfa0
mov dword [ebp - 0x60], ecx
jne 0x429d79
push str.__version
push dword [esi + 4]
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x429d83
mov eax, dword [0x519140]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
je 0x429cee
lea ecx, [ebp - 0x5c]
push ecx
lea ecx, [ebp - 0x74]
push ecx
call eax
lea ecx, [ebp - 0x50]
call fcn.00446250
push 0x3f
lea eax, [ebp - 0x50]
push eax
push 1
mov dword [ebp - 4], esi
call fcn.00421cdc
add esp, 0xc
cmp eax, 2
mov ecx, 0x4f1ff8
jne 0x429d18
mov ecx, str.NotLoad
cmp eax, 0xffffffff
jne 0x429d22
mov ecx, str.CannotControl
movzx eax, byte [ebp - 0x5c]
push ecx
mov ecx, dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x58]
shrd ecx, eax, 8
shr eax, 8
movsx eax, cx
push eax
movzx eax, byte [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0x74]
shrd ecx, eax, 8
shr eax, 8
movsx eax, cx
push eax
mov eax, dword [ebp + 0x10]
push str._X._X___X._X__s
push dword [eax]
mov dword [ebp - 0x48], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
or dword [ebp - 4], 0xffffffff
add esp, 0x1c
lea ecx, [ebp - 0x50]
call fcn.0043f290
jmp 0x42a949
cmp dword [ebp + 8], 1
jle 0x42a3f1
mov ebx, 0x3e8
xor edi, edi
dec dword [ebp + 8]
add esi, 4
push str.__id
push dword [esi]
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x429dab
or dword [ebp - 0x60], 2
jmp case.0x429fcf.114
push str.__nbrd
push dword [esi]
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x429dc6
or dword [ebp - 0x60], 1
jmp case.0x429fcf.114
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x429de2
mov eax, dword [esi]
xor ecx, ecx
cmp word [eax], 0x2d
sete cl
mov eax, ecx
jmp 0x429de4
xor eax, eax
cmp eax, edi
je case.0x429fcf.114
mov eax, dword [esi]
mov cx, word [eax + 2]
movzx eax, cx
cmp eax, 0x6d
jg 0x429fc3
je 0x429f98
cmp eax, 0x62
jg 0x429f20
je 0x429e60
sub eax, 0x44
je 0x429f6c
dec eax
dec eax
je 0x429f40
sub eax, 0xc
je 0x429f6c
dec eax
je 0x429e41
sub eax, 0xe
jne case.0x429fcf.114
mov dword [ebp - 0x54], 1
jmp case.0x429fcf.114
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.004ae7ae
push edi
push edi
push dword [esi]
call fcn.004b0c8f
mov dword [ebp - 0x2c], eax
jmp 0x42a3dc
add esi, 4
push str.auto
push dword [esi]
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x429e81
mov dword [ebp - 0x48], 1
jmp 0x42a3df
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
push str._I64u_c
push dword [esi]
mov dword [ebp - 0x24], edi
call fcn.004b0a63
movzx eax, word [ebp - 0x24]
add esp, 0x10
cmp eax, 0x62
jg 0x42a41b
je 0x429f08
sub eax, edi
je 0x42a3df
sub eax, 0x47
je 0x429ed8
sub eax, 4
je 0x429ef9
dec eax
dec eax
je 0x429eea
sub eax, 7
jne 0x42a47a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x429ede
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp - 0x14], ecx
jmp 0x429eed
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x429eff
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x429f15
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
shld ecx, eax, 9
shl eax, 9
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jmp 0x42a3df
sub eax, 0x64
je 0x429f6c
dec eax
je 0x429f60
dec eax
je 0x429f40
sub eax, 6
jne case.0x429fcf.114
mov dword [ebp - 0x54], 3
jmp case.0x429fcf.114
cmp cx, 0x46
jne 0x429f4d
mov dword [ebp - 0x68], 1
add esi, 4
push dword [esi]
call fcn.0042063d
pop ecx
mov dword [ebp - 0x44], eax
jmp 0x42a3df
mov dword [ebp - 0x54], 4
jmp case.0x429fcf.114
cmp cx, 0x44
mov dword [ebp - 0x54], 2
jne 0x429f80
mov dword [ebp - 0x4c], 1
cmp cx, 0x52
jne case.0x429fcf.114
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x64], eax
jmp case.0x429fcf.114
add esi, 4
mov ecx, dword [esi]
mov ax, word [ecx]
cmp ax, 0x61
mov dword [ebp - 0x78], ecx
jb 0x42a3df
cmp ax, 0x7a
ja 0x42a3df
and ax, 0xffdf
mov word [ecx], ax
jmp 0x42a3df
sub eax, 0x6e
cmp eax, 0xb
ja case.0x429fcf.114
jmp dword [eax*4 + 0x42a95a]
mov dword [0x515300], 1
jmp case.0x429fcf.114
add esi, 4
push str.file
push dword [esi]
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a003
or byte [ebp - 0xf], 1
jmp 0x42a3df
push 0x4f1f5c
push dword [esi]
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a01e
or byte [ebp - 0xf], 2
jmp 0x42a3df
push str.proxy
push dword [esi]
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a3df
or byte [ebp - 0xf], 3
jmp 0x42a3df
mov dword [ebp - 0x50], 1
jmp case.0x429fcf.114
add esi, 4
push 0x4efb54
push dword [esi]
jmp 0x42a1b5
push 0x4f1f48
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a076
or dword [ebp - 0x20], 1
or dword [ebp - 0x10], 1
jmp 0x42a1ae
push 0x4f1f40
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a094
or dword [ebp - 0x20], 1
and dword [ebp - 0x10], 0xfffffffe
jmp 0x42a1ae
push 0x4f1f38
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a0b2
or dword [ebp - 0x20], 2
or dword [ebp - 0x10], 2
jmp 0x42a1ae
push 0x4f1f30
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a0d0
or dword [ebp - 0x20], 2
and dword [ebp - 0x10], 0xfffffffd
jmp 0x42a1ae
push str.saved
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a0ee
or byte [ebp - 0x1e], 1
and byte [ebp - 0xe], 0xfe
jmp 0x42a1ae
cmp dword [ebp - 0x54], 1
jne 0x42a1ae
push 0x4f1f1c
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a119
or byte [ebp - 0xf], 0x20
mov dword [ebp - 0x68], 1
jmp 0x42a1ae
push str.comm
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a137
or byte [ebp - 0xf], 0x10
mov dword [ebp - 0x68], 1
jmp 0x42a1ae
push 0x4f1f08
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a14e
or byte [ebp - 0xf], 0x30
jmp 0x42a1ae
push 0x4f1f00
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a165
or byte [ebp - 0xf], 0x11
jmp 0x42a1ae
test byte [ebp - 0x10], 0xf0
jne 0x42a1ae
push 0x4f1ef8
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a182
or dword [ebp - 0x10], 0x10
jmp 0x42a1ae
push 0x4f1ef0
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a199
or dword [ebp - 0x10], 0x20
jmp 0x42a1ae
push 0x4f1ee8
push edi
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a1ae
or dword [ebp - 0x10], 0x30
push 0x4efb54
push 0
call fcn.004b09be
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x42a058
dec dword [ebp + 8]
jmp case.0x429fcf.114
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x40]
push eax
add esi, 4
push str._I64i_c
push dword [esi]
mov dword [ebp - 0x24], edi
call fcn.004b0a63
movzx eax, word [ebp - 0x24]
add esp, 0x10
cmp eax, 0x54
jg 0x42a289
je 0x42a24c
sub eax, edi
je 0x42a303
sub eax, 0x25
je 0x42a21e
sub eax, 0x22
je 0x42a25b
sub eax, 4
je 0x42a27a
dec eax
dec eax
jne 0x42a47a
mov eax, dword [ebp - 0x40]
jmp 0x42a26b
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push edi
push dword [ebp - 0x8c]
call fcn.004b08b0
push edi
push 0x64
push edx
push eax
call fcn.004b0800
jmp 0x42a2eb
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x42a261
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x3c]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp - 0x3c], ecx
jmp 0x42a27d
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x42a2fd
sub eax, 0x62
je 0x42a2f0
sub eax, 5
je 0x42a2b8
sub eax, 4
je 0x42a2de
dec eax
dec eax
je 0x42a2cb
sub eax, 7
jne 0x42a47a
push edi
push ebx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.004b08b0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push edi
push ebx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.004b08b0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push edi
push ebx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.004b08b0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push edi
push ebx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.004b08b0
mov dword [ebp - 0x3c], edx
jmp 0x42a300
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
shld ecx, eax, 9
shl eax, 9
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x3c], edi
jg 0x42a3df
jl 0x42a317
cmp dword [ebp - 0x40], edi
jae 0x42a3df
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0xac]
add dword [ebp - 0x40], eax
adc dword [ebp - 0x3c], edi
js 0x42a341
jg 0x42a3df
cmp dword [ebp - 0x40], edi
jae 0x42a3df
xor ecx, ecx
cmp ecx, 0x100
mov edi, 0x400
mov esi, 0x100000
mov edx, 0x40000000
jb 0x42a499
ja 0x42a368
test eax, eax
jb 0x42a499
mov ebx, 0x4f1ed4
jmp 0x42a4c9
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.004ae7ae
push edi
push edi
push dword [esi]
call fcn.004b0c8f
mov dword [ebp - 0x30], eax
jmp 0x42a3dc
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.004ae7ae
push edi
push edi
push dword [esi]
call fcn.004b0c8f
mov dword [ebp - 0x34], eax
jmp 0x42a3dc
add esi, 4
mov eax, dword [esi]
mov al, byte [eax]
sub al, 0x30
mov byte [ebp - 0x19], al
jmp 0x42a3df
add esi, 4
mov eax, dword [esi]
mov dword [ebp - 0x6c], eax
jmp 0x42a3df
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.004ae7ae
push edi
push edi
push dword [esi]
call fcn.004b0c8f
mov dword [ebp - 0x28], eax
add esp, 0x10
dec dword [ebp + 8]
cmp dword [ebp + 8], 1
jg 0x429d8a
mov ebx, dword [ebp - 0x78]
xor ecx, ecx
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x24], ecx
je 0x42a625
dec eax
je 0x42a614
dec eax
je 0x42a5c6
dec eax
je 0x42a572
or eax, 0xffffffff
jmp 0x42a94b
sub eax, 0x67
je 0x42a441
sub eax, 4
je 0x42a467
dec eax
dec eax
je 0x42a454
sub eax, 7
jne 0x42a47a
push edi
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004b08b0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push edi
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004b08b0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push edi
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004b08b0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push edi
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call fcn.004b08b0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
movzx eax, word [ebp - 0x24]
push eax
push str.ImDisk:_Unsupported_size_suffix:__wc_n
push 0x516ba0
call fcn.004b0410
add esp, 0xc
push 0xa
pop eax
jmp 0x42a94b
cmp eax, edx
jb 0x42a4a4
mov ebx, 0x4f1ea8
jmp 0x42a4c9
cmp eax, esi
jb 0x42a4af
mov ebx, 0x4f1ea4
jmp 0x42a4c9
cmp eax, edi
jb 0x42a4ba
mov ebx, 0x4f1ea0
jmp 0x42a4c9
cmp eax, 1
mov ebx, str.byte
je 0x42a4c9
mov ebx, 0x4f1e90
cmp ecx, 0x100
jb 0x42a4ef
ja 0x42a4d7
test eax, eax
jb 0x42a4ef
test eax, eax
mov dword [ebp - 0x58], eax
fild dword [ebp - 0x58]
jge 0x42a4e7
fadd qword [0x4ebd30]
fmul qword [0x4f1e88]
jmp 0x42a553
cmp eax, edx
jb 0x42a50b
test eax, eax
mov dword [ebp - 0x58], eax
fild dword [ebp - 0x58]
jge 0x42a503
fadd qword [0x4ebd30]
fmul qword [0x4f1e80]
jmp 0x42a4ed
cmp eax, esi
jb 0x42a527
test eax, eax
mov dword [ebp - 0x58], eax
fild dword [ebp - 0x58]
jge 0x42a51f
fadd qword [0x4ebd30]
fmul qword [0x4f1e78]
jmp 0x42a4ed
cmp eax, edi
jb 0x42a543
test eax, eax
mov dword [ebp - 0x58], eax
fild dword [ebp - 0x58]
jge 0x42a53b
fadd qword [0x4ebd30]
fmul qword [0x4f1e70]
jmp 0x42a4ed
test eax, eax
mov dword [ebp - 0x58], eax
fild dword [ebp - 0x58]
jge 0x42a553
fadd qword [0x4ebd30]
push ebx
push ecx
push ecx
fstp qword [esp]
push str.ImDisk:_Not_enough_memory__there_is_currently__.4g__s_free_physical_memory._n
push 0x516ba0
call fcn.004b0410
add esp, 0x14
push 0xb
jmp 0x42a493
cmp dword [ebp - 0x20], ecx
je 0x42a58d
push dword [ebp - 0x10]
push dword [ebp - 0x20]
push ebx
push dword [ebp - 0x28]
call fcn.0042215e
add esp, 0x10
xor ecx, ecx
jmp 0x42a590
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x3c], ecx
jl 0x42a5b0
jg 0x42a59c
cmp dword [ebp - 0x40], ecx
jbe 0x42a5b0
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push ebx
push dword [ebp - 0x28]
call fcn.00422394
add esp, 0x10
xor ecx, ecx
cmp eax, ecx
jne 0x42a94b
cmp dword [ebp - 0x6c], ecx
jne 0x42a801
jmp 0x42a94b
mov ecx, dword [ebp + 0x10]
push 0x4ec058
call fcn.004574e0
xor eax, eax
cmp dword [ebp - 0x28], 0xffffffff
sete al
xor ecx, ecx
test ebx, ebx
sete cl
test ecx, eax
je 0x42a5fd
push dword [ebp - 0x58]
push dword [ebp + 0x10]
push dword [ebp - 0x50]
call fcn.00421cdc
add esp, 0xc
jmp 0x42a94b
push dword [ebp - 0x60]
push dword [ebp + 0x10]
push ebx
push dword [ebp - 0x28]
call fcn.00421e0e
add esp, 0x10
jmp 0x42a94b
push dword [ebp - 0x64]
push dword [ebp - 0x4c]
push ebx
push dword [ebp - 0x28]
call fcn.00421781
jmp 0x42a60c
cmp dword [ebp - 0x48], ecx
je 0x42a63d
cmp dword [ebp - 0x44], 0
je 0x42a63d
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x44]
call dword [0x519120]
push 0x4ebd38
push str.CurRamDisk
mov ecx, 0x519150
call fcn.00444550
cmp byte [ebp - 0x19], 0
je 0x42a6d1
movzx edi, byte [ebp - 0x19]
mov eax, edi
shl eax, 5
lea esi, [ebp + eax - 0x1d8]
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x44]
call dword [0x519124]
test eax, eax
je 0x42a6b6
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, ecx
xor ebx, ebx
or eax, edx
jne 0x42a690
inc ebx
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x42a69d
xor eax, eax
inc eax
jmp 0x42a69f
xor eax, eax
or eax, ebx
je 0x42a6bd
push edi
push str.Error:_Partition__i_is_not_defined._n
push 0x516ba0
call fcn.004b0410
add esp, 0xc
push 0xc
jmp 0x42a493
add dword [ebp - 0x18], ecx
mov eax, dword [esi + 8]
mov ebx, dword [ebp - 0x78]
adc dword [ebp - 0x14], edx
mov dword [ebp - 0x40], eax
mov eax, dword [esi + 0xc]
jmp 0x42a74a
cmp dword [ebp - 0x48], 0
je 0x42a74d
lea eax, [ebp - 0x1b8]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x44]
call dword [0x519124]
test eax, eax
je 0x42a74d
lea eax, [ebp - 0x1b8]
mov ecx, dword [eax]
xor edx, edx
or ecx, dword [eax + 4]
je 0x42a702
inc edx
mov ecx, dword [eax + 8]
xor esi, esi
or ecx, dword [eax + 0xc]
je 0x42a70d
inc esi
mov cl, byte [eax + 0x18]
cmp cl, 5
je 0x42a71f
cmp cl, 0xf
je 0x42a71f
xor ecx, ecx
inc ecx
jmp 0x42a721
xor ecx, ecx
and ecx, esi
test edx, ecx
jne 0x42a736
add eax, 0x20
lea ecx, [ebp - 0xb8]
cmp eax, ecx
jb 0x42a6f8
jmp 0x42a74d
mov ecx, dword [eax]
add dword [ebp - 0x18], ecx
mov ecx, dword [eax + 4]
adc dword [ebp - 0x14], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], eax
mov esi, 0x5194ec
push esi
mov dword [ebp - 0x58], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x4f1dd4
push ebx
mov dword [ebp - 4], 1
call fcn.004af242
test eax, eax
pop ecx
pop ecx
jne 0x42a780
call dword [0x519114]
mov word [ebx], ax
mov dword [ebp - 0x24], eax
push ebx
push dword [ebp - 0x68]
lea eax, [ebp - 0x18]
push dword [ebp - 0x44]
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00420fbb
or dword [ebp - 4], 0xffffffff
add esp, 0x1c
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x42a7b6
mov eax, edi
jmp 0x42a94b
cmp dword [ebp - 0x50], 0
je 0x42a7cd
push dword [ebp - 0x28]
push 0x4f1dd0
call fcn.004b0958
pop ecx
pop ecx
jmp 0x42a7fb
mov ecx, dword [ebp - 0x44]
test ecx, ecx
jne 0x42a7d9
mov ecx, str.VM_image
test ebx, ebx
mov eax, str.No_mountpoint
je 0x42a7e4
mov eax, ebx
push ecx
push eax
push dword [ebp - 0x28]
push str.Created_device__1_u_:__2_ws______3_ws_
push 0x516b80
call fcn.00420e78
add esp, 0x14
cmp dword [ebp - 0x6c], 0
je 0x42a814
test ebx, ebx
je 0x42a90b
push dword [ebp - 0x6c]
push ebx
call fcn.004215b7
pop ecx
pop ecx
test ebx, ebx
je 0x42a90b
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
cmp eax, 2
jne 0x42a836
xor eax, eax
cmp word [ebx + 2], 0x3a
sete al
jmp 0x42a857
push ebx
call esi
cmp eax, 3
jne 0x42a855
lea eax, [ebx + 2]
push 0x4f0f70
push eax
call fcn.004af242
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x42a857
xor eax, eax
test eax, eax
je 0x42a90b
movzx esi, word [ebx]
xor eax, eax
mov dword [ebp - 0x8c], 0x14
mov dword [ebp - 0x88], 2
lea edi, [ebp - 0x84]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
sub esi, 0x41
inc eax
mov ecx, esi
shl eax, cl
push ebx
push str.CurRamDisk
mov ecx, 0x519150
mov dword [ebp - 0x80], eax
call fcn.00444550
test byte [ebp - 0x60], 1
jne 0x42a90b
cmp esi, 0x19
ja 0x42a90b
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea eax, [ebp - 0x64]
push eax
push dword [0x515300]
lea eax, [ebp - 0x8c]
push 3
push eax
push 0x8000
mov ebx, 0x219
push ebx
mov edi, 0xffff
push edi
call esi
lea eax, [ebp - 0x64]
push eax
push dword [0x515300]
lea eax, [ebp - 0x8c]
push 3
push eax
push 0x8000
push ebx
push edi
mov word [ebp - 0x7c], 1
call esi
lea eax, [ebp - 0x64]
push eax
push dword [0x515300]
push 3
push 0
push 7
push ebx
push edi
call esi
mov edi, dword [ebp - 0x24]
test di, di
je 0x42a949
push 0xffffffffffffffff
push 0x4f1d74
lea ecx, [ebp - 0x4c]
call fcn.00457470
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x4c]
push eax
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.00457540
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.0043f290
mov eax, dword [esi]
mov word [eax + 2], di
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret