Function at 0x402fed
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b0
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
push dword [esi + 0x214]
call dword [0x416c18]
and byte [ebp - 0x170], 0
and byte [ebp - 0x6c], 0
and byte [ebp - 0x57], 0
and byte [ebp - 0x42], 0
cmp byte [esi + 0x218], 0
je 0x403160
push 0
push str.PagingFiles
push str.SYSTEMCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call fcn.0040deaf
mov esi, eax
add esp, 0x10
test esi, esi
mov dword [ebp - 0xc], esi
je 0x403159
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
add eax, esi
mov dword [ebp - 8], eax
mov edi, esi
cmp byte [esi], 0x20
je 0x40306a
cmp esi, eax
je 0x40306a
inc esi
jmp 0x40305e
and byte [esi], 0
lea eax, [ebp - 0x170]
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [ebp - 0x2b0]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ecx, dword [ebp - 0x294]
mov edi, dword [ebp - 0x290]
mov edx, ecx
xor ebx, ebx
shr edi, 0x14
shl edx, 0xc
or edi, edx
xor edx, edx
shr ecx, 0x14
push eax
or edi, edx
or ebx, ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push ebx
push edi
lea eax, [ebp - 0x6c]
push 0x4117a0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, dword [ebp - 8]
add esp, 0x10
cmp esi, ebx
je 0x403130
inc esi
mov eax, esi
cmp byte [esi], 0x20
je 0x4030db
cmp esi, ebx
je 0x4030db
inc esi
jmp 0x4030cf
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
and byte [esi], 0
push eax
lea eax, [ebp - 0x42]
push eax
call edi
cmp esi, ebx
je 0x403130
inc esi
mov eax, esi
cmp byte [esi], 0x20
je 0x4030fe
cmp esi, ebx
je 0x4030fe
inc esi
jmp 0x4030f2
and byte [esi], 0
push eax
lea eax, [ebp - 0x57]
push eax
call edi
cmp esi, ebx
je 0x403130
lea eax, [ebp - 0x170]
inc esi
push eax
mov eax, dword [ebp - 4]
push 0x7fffffff
push dword [eax + 0x214]
call dword [0x416c04]
mov eax, dword [ebp - 8]
jmp 0x40305c
lea eax, [ebp - 0x170]
push eax
mov eax, dword [ebp - 4]
push 0x7fffffff
push dword [eax + 0x214]
call dword [0x416c04]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
jmp 0x403363
xor al, al
jmp 0x403365
xor edi, edi
push edi
push 0x4000000
push 3
push edi
push 3
push 0x80000000
push str.._vwin32
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4031dc
lea eax, [ebp - 0x170]
push edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2c]
push 0x1c
push eax
lea eax, [ebp - 0x2c]
push 0x1c
push eax
push 1
push esi
mov dword [ebp - 0x20], 0x440d
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], 0x486e
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x2c]
mov ecx, eax
shl ecx, 0x18
shr edx, 8
or ecx, edx
mov esi, ecx
xor ecx, ecx
shr eax, 8
or esi, ecx
or edi, eax
jmp 0x4031e2
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringA]
test eax, eax
jne 0x40329d
push str.system.ini
lea eax, [ebp - 0x170]
push 0x104
push eax
push 0x414444
push str.PagingDrive
push str.386Enh
call ebx
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
test eax, eax
jne 0x40324f
mov ecx, dword [ebp - 4]
call fcn.00402229
mov esi, eax
lea eax, [ebp - 0x170]
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
lea eax, [ebp - 0x170]
push str.Win386.swp
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatA]
lea eax, [ebp - 0x2b0]
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ecx, dword [ebp - 0x294]
mov esi, dword [ebp - 0x290]
mov edx, ecx
xor edi, edi
shr esi, 0x14
shl edx, 0xc
or esi, edx
xor edx, edx
shr ecx, 0x14
push eax
or esi, edx
or edi, ecx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push edi
push esi
lea eax, [ebp - 0x6c]
push 0x4117a0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x42]
mov esi, 0x411770
push str.system.ini
push 0x104
push eax
push esi
push str.MinPagingFileSize
push str.386Enh
call ebx
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcmpA]
lea eax, [ebp - 0x42]
push esi
push eax
call edi
test eax, eax
je 0x403302
lea eax, [ebp - 0x42]
push eax
call fcn.0040e677
pop ecx
shr eax, 0xa
push eax
lea eax, [ebp - 0x42]
push 0x4117a0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.system.ini
lea eax, [ebp - 0x57]
push 0x104
push eax
push esi
push str.MaxPagingFileSize
push str.386Enh
call ebx
lea eax, [ebp - 0x57]
push esi
push eax
call edi
test eax, eax
je 0x403348
lea eax, [ebp - 0x57]
push eax
call fcn.0040e677
pop ecx
shr eax, 0xa
push eax
lea eax, [ebp - 0x57]
push 0x4117a0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x170]
push eax
mov eax, dword [ebp - 4]
push 0x7fffffff
push dword [eax + 0x214]
call dword [0x416c04]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret