Function at 0x426613
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
push esi
push edi
lea eax, [ebp - 0x20]
push eax
push 0x4bddf0
mov edi, str.NTDLL.DLL
push edi
xor esi, esi
push str.RtlCreateUnicodeString
mov dword [ebp - 0x20], esi
call fcn.00438bfe
lea eax, [ebp - 0x20]
push eax
push 0x4bddf4
push edi
push str.RtlFreeUnicodeString
call fcn.00438bfe
xor eax, eax
mov word [ebp - 8], si
lea edi, [ebp - 6]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 0x28]
and eax, 0x10
add esp, 0x20
cmp dword [0x4bdc84], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], eax
jne 0x42667b
push 3
pop eax
jmp 0x426bf7
cmp eax, esi
mov ecx, dword [ebp + 0x20]
je 0x42669c
cmp ecx, esi
je 0x42669c
mov ax, word [ecx]
cmp ax, 0x41
jb 0x42669c
cmp ax, 0x5a
ja 0x42669c
or ax, 0x20
mov word [ecx], ax
push ebx
push str.DeviceImDiskCtl
lea eax, [ebp - 8]
push eax
call dword [0x4bdc84]
mov edi, 0xc0000000
push edi
lea eax, [ebp - 8]
push eax
call dword [0x4bdf4c]
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x4266f4
call ebx
cmp eax, 2
jne 0x426bbf
push str.ImDisk
call dword [0x4bdf5c]
test eax, eax
je 0x426bce
push esi
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
lea eax, [ebp - 8]
push eax
call dword [0x4bdf4c]
cmp eax, 0xffffffff
mov dword [ebp + 0x28], eax
je 0x4266c4
push eax
call fcn.00411a53
test eax, eax
pop ecx
jne 0x42670f
push 5
pop esi
jmp 0x4269d1
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0x14]
xor ecx, ecx
and eax, 0xf000
and esi, 0xf00
cmp eax, 0x1000
sete cl
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
mov eax, ecx
xor ecx, ecx
cmp esi, 0x100
sete cl
xor edx, edx
test esi, esi
sete dl
or ecx, edx
test eax, ecx
je 0x426911
push str.DeviceAWEAlloc
lea eax, [ebp - 0x18]
push eax
call dword [0x4bdc84]
jmp 0x426784
call ebx
cmp eax, 2
jne 0x4267b6
push str.AWEAlloc
call dword [0x4bdf5c]
test eax, eax
je 0x4268c6
push str.AWEAlloc_driver_was_loaded_into_the_kernel.
call fcn.004903bd
pop ecx
lea eax, [ebp - 0x18]
push edi
push eax
call dword [0x4bdf4c]
mov esi, eax
cmp esi, 0xffffffff
je 0x42675f
push 0
push 0x4bddf8
push str.NTDLL.DLL
push str.NtClose
call fcn.00438bfe
add esp, 0x10
push esi
call dword [0x4bddf8]
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
xor esi, esi
cmp dword [ebp + 0x18], esi
jne 0x4269b4
push esi
lea eax, [ebp - 8]
push eax
call dword [0x4bdc84]
movzx eax, word [ebp - 8]
lea eax, [eax + eax + 0x38]
push eax
lea ecx, [ebp - 0x1c]
call fcn.0043d373
movzx eax, word [ebp - 8]
mov ebx, dword [ebp - 0x1c]
add eax, 0x38
push eax
push 0
push ebx
call fcn.0048f7a0
mov esi, dword [ebp + 0x20]
add esp, 0xc
test esi, esi
je 0x42682f
cmp dword [ebp - 0x28], 0
jne 0x42682f
push esi
call edi
cmp eax, 2
jne 0x426815
cmp word [esi + 2], 0x3a
je 0x426828
cmp eax, 3
jne 0x42682f
cmp word [esi + 2], 0x3a
jne 0x42682f
cmp word [esi + 4], 0x5c
jne 0x42682f
mov ax, word [esi]
mov word [ebx + 0x2c], ax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
push 6
lea edi, [ebx + 8]
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
mov dword [ebx + 0x20], ecx
mov eax, dword [eax + 4]
mov dword [ebx + 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 0x28], eax
mov ax, word [ebp - 8]
mov word [ebx + 0x2e], ax
cmp word [ebp - 8], 0
je 0x426882
movzx eax, word [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebx + 0x30]
push eax
call fcn.00490080
add esp, 0xc
lea eax, [ebp - 8]
push eax
call dword [0x4bddf4]
movzx eax, word [ebx + 0x2e]
xor esi, esi
push esi
lea ecx, [ebp - 0x24]
push ecx
add eax, 0x38
push eax
push ebx
push eax
push ebx
push 0x8372e004
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
jne 0x426af0
push str.Error_creating_virtual_disk:
call fcn.00411a02
pop ecx
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 3
pop esi
jmp 0x426bb2
call ebx
cmp eax, 2
jb 0x42690a
cmp eax, 3
jbe 0x4268f8
cmp eax, 0x422
je 0x4268ec
cmp eax, 0x424
jne 0x42690a
push 0x4bc870
push str.The_AWEAlloc_driver_is_not_installed._r_nPlease_re_install_ImDisk._r_n
jmp 0x426902
push 0x4bc870
push str.The_AWEAlloc_driver_is_disabled._r_n
jmp 0x426902
push 0x4bc870
push str.Cannot_load_AWEAlloc_driver._r_nPlease_re_install_ImDisk._r_n
call fcn.00490008
pop ecx
jmp 0x426988
push str.Error_loading_AWEAlloc_driver:
jmp 0x426983
xor ecx, ecx
cmp dword [ebp - 0xc], 0x2000
sete cl
or ecx, eax
xor eax, eax
cmp esi, 0x300
sete al
test eax, ecx
je 0x4267b6
mov edi, dword [sym.imp.KERNEL32.DLL_WaitNamedPipeW]
push 0
mov esi, str..PIPEImDskSvc
push esi
call edi
test eax, eax
jne 0x4267b6
call ebx
cmp eax, 2
jne 0x4267b6
push str.ImDskSvc
call dword [0x4bdf5c]
test eax, eax
jne 0x4269a6
call ebx
cmp eax, 2
jb 0x42697e
cmp eax, 3
jbe 0x426989
cmp eax, 0x422
je 0x426989
cmp eax, 0x424
je 0x426989
push str.Error_starting_ImDisk_Virtual_Disk_Driver_Helper_Service:
call fcn.00411a02
pop ecx
push 7
jmp 0x426709
call ebx
cmp eax, 2
jne 0x4267b6
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push 0
push esi
call edi
test eax, eax
je 0x426990
jmp 0x4267b6
cmp dword [ebp + 0x1c], esi
je 0x4269e1
push dword [ebp + 0x18]
lea eax, [ebp - 8]
push eax
call dword [0x4bddf0]
test eax, eax
jne 0x4267d2
or esi, 0xffffffff
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, esi
jmp 0x426bf6
xor eax, eax
cmp dword [ebp - 0xc], 0x3000
push esi
sete al
xor ecx, ecx
cmp dword [ebp - 0x10], 0x300
sete cl
test ecx, eax
je 0x426ab7
push 0x80
push 3
push esi
push 1
push esi
push str._Global
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 0x10], eax
call ebx
dec eax
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], str.BaseNamedObjects_
sete cl
test ecx, eax
jne 0x426a3f
mov dword [ebp - 0xc], str.BaseNamedObjectsGlobal_
cmp dword [ebp - 0x10], 0xffffffff
je 0x426a4e
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0xc]
call edi
push dword [ebp + 0x18]
mov ebx, eax
call edi
lea eax, [eax + ebx + 2]
push eax
lea ecx, [ebp - 0x14]
call fcn.0043d49b
mov ebx, dword [ebp - 0x14]
cmp ebx, esi
jne 0x426a87
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea ecx, [ebp - 0x14]
call fcn.00437960
or eax, 0xffffffff
jmp 0x426bf6
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push dword [ebp + 0x18]
push ebx
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
push ebx
lea eax, [ebp - 8]
push eax
call dword [0x4bddf0]
test eax, eax
je 0x426a6e
lea ecx, [ebp - 0x14]
call fcn.00437960
jmp 0x4267d2
push 0x4bddec
push str.NTDLL.DLL
push str.RtlDosPathNameToNtPathName_U
call fcn.00438bfe
add esp, 0x10
push esi
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
call dword [0x4bddec]
test eax, eax
jne 0x4267d2
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x426a7f
push dword [ebp + 0x28]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edi, dword [ebp + 0x20]
cmp edi, esi
mov eax, dword [ebx]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
je 0x426b9f
push dword [ebx]
lea eax, [ebp - 0x230]
push str.DeviceImDisk_u
push 0x103
push eax
mov word [ebp - 0x230], si
call fcn.0048ff98
add esp, 0x10
cmp word [ebx + 0x2c], si
mov word [ebp - 0x2a], si
lea eax, [ebp - 0x230]
jne 0x426b91
push eax
push edi
call dword [0x4bdf60]
test eax, eax
jne 0x426b9f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
dec eax
je 0x426b8c
sub eax, 0x56
je 0x426b8c
sub eax, 0x3a
je 0x426b8c
sub eax, 0x7a
je 0x426b8c
sub eax, 0x101b
je 0x426b8c
dec eax
dec eax
je 0x426b79
push str.Error_creating_mount_point:
call fcn.00411a02
pop ecx
jmp 0x426b8c
push edi
push str.Invalid_mount_point_path:__1_ws__n
push 0x4bc870
call fcn.004119a6
add esp, 0xc
mov word [edi], si
jmp 0x426b9f
push esi
push 1
push esi
push edi
push eax
call fcn.0044909a
add esp, 0x14
cmp dword [ebp + 0x24], esi
je 0x426bb2
push dword [ebp + 0x24]
push edi
push dword [ebx]
call fcn.0041be5d
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00437960
jmp 0x4269da
push str.Error_controlling_the_ImDisk_Virtual_Disk_Driver:
call fcn.00411a02
pop ecx
push 6
jmp 0x426bf5
call ebx
cmp eax, 2
jb 0x426be8
cmp eax, 3
jbe 0x426bf3
cmp eax, 0x422
je 0x426bf3
cmp eax, 0x424
je 0x426bf3
push str.Error_loading_ImDisk_Virtual_Disk_Driver:
call fcn.00411a02
pop ecx
push 4
pop eax
pop ebx
pop edi
pop esi
leave
ret