Function at 0x426b41
Capabilities:
Get memory capacity

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x1b0
xor ecx, ecx
cmp dword [0x4bdf60], ecx
jne 0x426b5e
or eax, 0xffffffff
jmp 0x427cd8
xor eax, eax
push ebx
mov ebx, dword [ebp + 0x74]
or dword [ebp + 0x54], 0xffffffff
push esi
push edi
mov dword [ebp + 0x30], ecx
mov esi, dword [ebp + 0x78]
lea edi, [ebp + 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp ebx, 2
mov dword [ebp + 0x5c], ecx
lea edi, [ebp + 0x60]
stosd dword es:[edi], eax
mov byte [ebp + 0x5b], al
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
mov ax, word [eax]
mov dword [ebp + 0x64], ecx
mov dword [ebp + 0x68], ecx
mov dword [ebp], ecx
mov dword [ebp - 4], ecx
mov dword [ebp + 0x2c], ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x48], ecx
mov dword [ebp + 0x10], ecx
mov dword [ebp + 4], ecx
mov dword [ebp + 0x50], ecx
mov dword [ebp + 0x1c], ecx
mov word [ebp + 0x18], ax
mov dword [ebp + 0x4c], ecx
mov dword [ebp + 8], 0xfa0
jne 0x426c94
push 0x4a8df0
push dword [esi + 4]
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x426c9d
mov eax, dword [0x4bdf64]
xor edi, edi
cmp eax, edi
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x24], edi
je 0x426bff
lea ecx, [ebp + 0x20]
push ecx
lea ecx, [ebp + 0x14]
push ecx
call eax
lea ecx, [ebp + 0x2c]
call fcn.0043d3a5
push 0x3f
lea eax, [ebp + 0x2c]
push eax
push 1
call fcn.00411ad0
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
add esp, 0xc
cmp eax, 2
mov esi, 0x4a8de8
jne 0x426c2e
mov esi, str.NotLoad
jmp 0x426c49
cmp eax, 0xffffffff
jne 0x426c3a
mov esi, str.CannotControl
jmp 0x426c49
cmp ecx, edi
ja 0x426c49
jb 0x426c44
cmp edx, edi
ja 0x426c49
mov esi, str.NotInstall
movzx eax, dl
shrd edx, ecx, 8
push esi
push eax
movsx eax, dx
push eax
movzx eax, byte [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x18]
shr ecx, 8
mov ecx, dword [ebp + 0x14]
shrd ecx, eax, 8
shr eax, 8
movsx eax, cx
push eax
mov eax, dword [ebp + 0x7c]
push str._X._02X___X._X__s
push dword [eax]
mov dword [ebp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea ecx, [ebp + 0x2c]
call fcn.00437884
xor eax, eax
jmp 0x427cd5
cmp ebx, 1
jle 0x4278e0
xor edi, edi
add esi, 4
push str.__id
push dword [esi]
dec ebx
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x426cbe
or dword [ebp + 0x4c], 2
jmp 0x427725
push 0x4a8d60
push dword [esi]
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x426cd9
or dword [ebp + 0x4c], 1
jmp 0x427725
push str.__remove
push dword [esi]
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x426cf4
or dword [ebp + 0x4c], 4
jmp 0x427725
push 0x4a8d44
push dword [esi]
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x426d12
mov dword [ebp + 0x64], 5
jmp 0x427725
push str.__hide
push dword [esi]
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x426d2d
or dword [ebp + 0x4c], 0x10
jmp 0x427725
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x426d49
mov eax, dword [esi]
xor ecx, ecx
cmp word [eax], 0x2d
sete cl
mov eax, ecx
jmp 0x426d4b
xor eax, eax
cmp eax, edi
je case.0x426ff3.114
mov eax, dword [esi]
mov cx, word [eax + 2]
movzx eax, cx
cmp eax, 0x6d
jg 0x426fe7
je 0x426fac
cmp eax, 0x62
jg 0x426ef6
je 0x426e00
sub eax, 0x44
je 0x426f77
dec eax
dec eax
je 0x426f1f
sub eax, 0xc
je 0x426f77
dec eax
je 0x426db5
sub eax, 0xe
jne case.0x426ff3.114
cmp dword [ebp + 0x64], edi
jne case.0x426ff3.114
mov dword [ebp + 0x64], 1
jmp 0x427725
xor eax, eax
cmp dword [ebp + 0x44], edi
setne al
xor ecx, ecx
cmp dword [ebp + 0x64], 1
setne cl
or eax, ecx
xor ecx, ecx
cmp ebx, 2
setl cl
or eax, ecx
jne case.0x426ff3.114
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.004906b6
test eax, eax
pop ecx
je case.0x426ff3.114
push edi
push edi
push dword [esi]
call fcn.0049069f
mov dword [ebp + 0x44], eax
jmp 0x427721
mov eax, dword [ebp + 0x5c]
or eax, dword [ebp + 0x60]
je 0x426e0d
xor eax, eax
inc eax
jmp 0x426e0f
xor eax, eax
xor ecx, ecx
cmp dword [ebp + 4], edi
setne cl
xor edx, edx
cmp dword [ebp + 0x64], 1
setne dl
or ecx, edx
xor edx, edx
cmp ebx, 2
setl dl
or ecx, edx
or ecx, eax
jne case.0x426ff3.114
add esi, 4
push 0x4a8d28
push dword [esi]
call fcn.0048fcec
pop ecx
xor edi, edi
test eax, eax
pop ecx
jne 0x426e57
mov dword [ebp + 4], 1
jmp 0x427724
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x5c]
push eax
push str._I64u_c
push dword [esi]
mov dword [ebp + 0x24], edi
call fcn.00490473
movzx eax, word [ebp + 0x24]
add esp, 0x10
cmp eax, 0x62
jg 0x427779
je 0x426ede
sub eax, edi
je 0x427724
sub eax, 0x47
je 0x426eae
sub eax, 4
je 0x426ecf
dec eax
dec eax
je 0x426ec0
sub eax, 7
jne 0x4277e8
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x60]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x426eb4
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebp + 0x5c]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp + 0x60], ecx
jmp 0x426ec3
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x60]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x426ed5
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebp + 0x5c]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x426eeb
mov eax, dword [ebp + 0x5c]
mov ecx, dword [ebp + 0x60]
shld ecx, eax, 9
shl eax, 9
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x60], ecx
jmp 0x427724
sub eax, 0x64
je 0x426f77
dec eax
je 0x426f62
dec eax
je 0x426f1f
sub eax, 6
jne case.0x426ff3.114
cmp dword [ebp + 0x64], edi
jne case.0x426ff3.114
mov dword [ebp + 0x64], 3
jmp 0x427725
xor eax, eax
cmp dword [ebp + 0x28], edi
setne al
xor edx, edx
cmp dword [ebp + 0x64], 1
setne dl
or eax, edx
xor edx, edx
cmp ebx, 2
setl dl
or eax, edx
jne case.0x426ff3.114
cmp cx, 0x46
jne 0x426f4f
mov dword [ebp], 1
add esi, 4
push dword [esi]
call fcn.004110a0
pop ecx
mov dword [ebp + 0x28], eax
jmp 0x4276cb
cmp dword [ebp + 0x64], edi
jne case.0x426ff3.114
mov dword [ebp + 0x64], 4
jmp 0x427725
cmp dword [ebp + 0x64], edi
jne case.0x426ff3.114
cmp cx, 0x44
mov dword [ebp + 0x64], 2
jne 0x426f94
mov dword [ebp + 0x2c], 1
cmp cx, 0x52
jne 0x427725
xor eax, eax
inc eax
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0xc], eax
jmp 0x427725
xor eax, eax
cmp dword [ebp + 0x54], 0xffffffff
setne al
xor ecx, ecx
cmp dword [ebp + 0x64], 1
setne cl
and eax, ecx
xor ecx, ecx
cmp dword [ebp + 0x48], edi
setne cl
or eax, ecx
xor ecx, ecx
cmp ebx, 2
setl cl
or eax, ecx
jne case.0x426ff3.114
add esi, 4
mov eax, dword [esi]
mov dword [ebp + 0x48], eax
jmp 0x427724
sub eax, 0x6e
cmp eax, 0xb
ja case.0x426ff3.114
jmp dword [eax*4 + 0x427cdd]
mov dword [ebp + 8], 1
jmp 0x427725
mov eax, dword [ebp + 0x68]
and eax, 0xf00
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp dword [ebp + 0x64], 1
setne cl
or eax, ecx
xor ecx, ecx
cmp ebx, 2
setl cl
or eax, ecx
jne case.0x426ff3.114
add esi, 4
push str.file
push dword [esi]
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x42704d
or byte [ebp + 0x69], 1
jmp 0x427724
push 0x4a8d04
push dword [esi]
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427068
or byte [ebp + 0x69], 2
jmp 0x427724
push str.proxy
push dword [esi]
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne case.0x426ff3.114
or byte [ebp + 0x69], 3
jmp 0x427724
mov dword [ebp - 4], 1
jmp 0x427725
xor eax, eax
cmp dword [ebp + 0x64], 4
setne al
xor ecx, ecx
cmp dword [ebp + 0x64], 1
setne cl
and eax, ecx
xor ecx, ecx
cmp ebx, 2
setl cl
or eax, ecx
jne case.0x426ff3.114
add esi, 4
push 0x4a4928
push dword [esi]
jmp 0x427378
push 0x4a8cf0
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x4270ee
test byte [ebp + 0x50], 1
jne case.0x426ff3.114
or dword [ebp + 0x50], 1
or dword [ebp + 0x68], 1
jmp 0x427371
push 0x4a8ce8
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427116
test byte [ebp + 0x50], 1
jne case.0x426ff3.114
or dword [ebp + 0x50], 1
and dword [ebp + 0x68], 0xfffffffe
jmp 0x427371
push 0x4a8ce0
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x42713e
test byte [ebp + 0x50], 2
jne case.0x426ff3.114
or dword [ebp + 0x50], 2
or dword [ebp + 0x68], 2
jmp 0x427371
push 0x4a8cd8
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427166
test byte [ebp + 0x50], 2
jne case.0x426ff3.114
or dword [ebp + 0x50], 2
and dword [ebp + 0x68], 0xfffffffd
jmp 0x427371
push str.saved
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427192
cmp dword [ebp + 0x64], 4
jne case.0x426ff3.114
or byte [ebp + 0x52], 1
and byte [ebp + 0x6a], 0xfe
or dword [ebp + 0x4c], 8
jmp 0x427371
cmp dword [ebp + 0x64], 1
jne case.0x426ff3.114
push 0x4a8cc4
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x4271e7
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x68]
and eax, 0xf000
neg eax
sbb eax, eax
and ecx, 0xf00
xor edx, edx
neg eax
cmp ecx, 0x300
setne dl
or eax, edx
jne case.0x426ff3.114
or byte [ebp + 0x69], 0x20
mov dword [ebp], 1
jmp 0x427371
push str.comm
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427232
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x68]
and eax, 0xf000
neg eax
sbb eax, eax
and ecx, 0xf00
xor edx, edx
neg eax
cmp ecx, 0x300
setne dl
or eax, edx
jne case.0x426ff3.114
or byte [ebp + 0x69], 0x10
mov dword [ebp], 1
jmp 0x427371
push 0x4a8cb0
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427276
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x68]
and eax, 0xf000
neg eax
sbb eax, eax
and ecx, 0xf00
xor edx, edx
neg eax
cmp ecx, 0x300
setne dl
or eax, edx
jne case.0x426ff3.114
or byte [ebp + 0x69], 0x30
jmp 0x427371
push 0x4a8ca8
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x4272c1
mov eax, dword [ebp + 0x68]
and eax, 0xf00
xor ecx, ecx
cmp eax, 0x100
setne cl
xor edx, edx
test eax, eax
mov eax, dword [ebp + 0x68]
setne dl
and eax, 0xf000
and ecx, edx
neg eax
sbb eax, eax
neg eax
or ecx, eax
jne case.0x426ff3.114
or byte [ebp + 0x69], 0x11
jmp 0x427371
push 0x4a8ca0
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427309
mov eax, dword [ebp + 0x68]
and eax, 0xf00
xor ecx, ecx
cmp eax, 0x100
setne cl
xor edx, edx
test eax, eax
mov eax, dword [ebp + 0x68]
setne dl
and eax, 0xf000
and ecx, edx
neg eax
sbb eax, eax
neg eax
or ecx, eax
jne case.0x426ff3.114
or byte [ebp + 0x69], 0x21
jmp 0x427371
push str.shared
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427320
or byte [ebp + 0x6a], 2
jmp 0x427371
test byte [ebp + 0x68], 0xf0
jne case.0x426ff3.114
push 0x4a8c88
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427341
or dword [ebp + 0x68], 0x10
jmp 0x427371
push 0x4a8c80
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427358
or dword [ebp + 0x68], 0x20
jmp 0x427371
push 0x4a8c78
push edi
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne case.0x426ff3.114
or dword [ebp + 0x68], 0x30
push 0x4a4928
push 0
call fcn.004903ce
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x4270c6
jmp 0x4276cb
mov eax, dword [ebp + 0x30]
or eax, dword [ebp + 0x34]
je 0x42739b
xor eax, eax
inc eax
jmp 0x42739d
xor eax, eax
xor ecx, ecx
cmp dword [ebp + 0x64], 4
setne cl
xor edx, edx
cmp dword [ebp + 0x64], 1
setne dl
and ecx, edx
xor edx, edx
cmp ebx, 2
setl dl
or ecx, edx
or ecx, eax
jne case.0x426ff3.114
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x30]
push eax
add esi, 4
push str._I64i_c
push dword [esi]
xor edi, edi
mov dword [ebp + 0x24], edi
call fcn.00490473
movzx eax, word [ebp + 0x24]
add esp, 0x10
cmp eax, 0x54
jg 0x4274b0
je 0x427470
sub eax, edi
je 0x42753a
sub eax, 0x25
je 0x427419
sub eax, 0x22
je 0x42747f
sub eax, 4
je 0x42749e
dec eax
dec eax
jne 0x4277e8
mov eax, dword [ebp + 0x30]
jmp 0x42748f
cmp dword [ebp + 0x34], edi
jg 0x42742a
jl 0x427425
cmp dword [ebp + 0x30], edi
ja 0x42742a
xor ecx, ecx
inc ecx
jmp 0x42742c
xor ecx, ecx
cmp dword [ebp + 0x34], edi
jl 0x42743e
jg 0x427439
cmp dword [ebp + 0x30], 0x64
jb 0x42743e
xor eax, eax
inc eax
jmp 0x427440
xor eax, eax
or eax, ecx
jne case.0x426ff3.114
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push edi
push dword [ebp - 0x18]
call fcn.0048f820
push edi
push 0x64
push edx
push eax
call fcn.0048f770
jmp 0x427522
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x34]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x427485
mov ecx, dword [ebp + 0x34]
mov eax, dword [ebp + 0x30]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 0x34]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp + 0x34], ecx
jmp 0x4274a1
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x34]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x427534
sub eax, 0x62
je 0x427527
sub eax, 5
je 0x4274e3
sub eax, 4
je 0x427511
dec eax
dec eax
je 0x4274fa
sub eax, 7
jne 0x4277e8
push edi
push 0x3e8
push dword [ebp + 0x34]
push dword [ebp + 0x30]
call fcn.0048f820
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], edx
push edi
push 0x3e8
push dword [ebp + 0x34]
push dword [ebp + 0x30]
call fcn.0048f820
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], edx
push edi
push 0x3e8
push dword [ebp + 0x34]
push dword [ebp + 0x30]
call fcn.0048f820
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x34], edx
push edi
push 0x3e8
push dword [ebp + 0x34]
push dword [ebp + 0x30]
call fcn.0048f820
mov dword [ebp + 0x34], edx
jmp 0x427537
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x34]
shld ecx, eax, 9
shl eax, 9
mov dword [ebp + 0x34], ecx
mov dword [ebp + 0x30], eax
cmp dword [ebp + 0x34], edi
jg 0x427724
jl 0x42754e
cmp dword [ebp + 0x30], edi
jae 0x427724
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x38]
add dword [ebp + 0x30], eax
adc dword [ebp + 0x34], edi
js 0x427572
jg 0x427724
cmp dword [ebp + 0x30], edi
jae 0x427724
xor ecx, ecx
cmp ecx, 0x100
mov edi, 0x400
mov esi, 0x100000
mov edx, 0x40000000
jb 0x427807
ja 0x427599
test eax, eax
jb 0x427807
mov ebx, 0x4a8c64
jmp 0x427837
xor eax, eax
cmp dword [ebp + 0x40], edi
setne al
xor ecx, ecx
cmp dword [ebp + 0x64], 1
setne cl
or eax, ecx
xor ecx, ecx
cmp ebx, 2
setl cl
or eax, ecx
jne case.0x426ff3.114
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.004906b6
test eax, eax
pop ecx
je case.0x426ff3.114
push edi
push edi
push dword [esi]
call fcn.0049069f
mov dword [ebp + 0x40], eax
jmp 0x427721
xor eax, eax
cmp dword [ebp + 0x3c], edi
setne al
xor ecx, ecx
cmp dword [ebp + 0x64], 1
setne cl
or eax, ecx
xor ecx, ecx
cmp ebx, 2
setl cl
or eax, ecx
jne case.0x426ff3.114
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.004906b6
test eax, eax
pop ecx
je case.0x426ff3.114
push edi
push edi
push dword [esi]
call fcn.0049069f
mov dword [ebp + 0x3c], eax
jmp 0x427721
xor eax, eax
cmp byte [ebp + 0x5b], al
setne al
xor ecx, ecx
cmp dword [ebp + 0x64], 1
setne cl
or eax, ecx
xor ecx, ecx
cmp ebx, 2
setl cl
or eax, ecx
jne case.0x426ff3.114
xor edx, edx
add esi, 4
mov eax, dword [esi]
xor ecx, ecx
mov cx, word [eax]
mov dx, 0x38
cmp dx, cx
sbb edx, edx
neg edx
cmp cx, 0x31
sbb ecx, ecx
neg ecx
or edx, ecx
jne case.0x426ff3.114
cmp word [eax + 2], di
jne case.0x426ff3.114
mov al, byte [eax]
sub al, 0x30
mov byte [ebp + 0x5b], al
jmp 0x427724
xor eax, eax
inc eax
cmp dword [ebp + 0x64], eax
je 0x4276a7
cmp dword [ebp + 0x64], 4
jne 0x4276a9
xor eax, eax
xor ecx, ecx
cmp dword [ebp + 0x10], edi
setne cl
xor edx, edx
cmp ebx, 2
setl dl
or ecx, edx
or ecx, eax
jne case.0x426ff3.114
add esi, 4
mov eax, dword [esi]
mov dword [ebp + 0x10], eax
dec ebx
xor edi, edi
jmp 0x427725
xor eax, eax
cmp dword [ebp + 0x48], edi
setne al
xor ecx, ecx
cmp dword [ebp + 0x64], 1
setne cl
and eax, ecx
xor ecx, ecx
cmp dword [ebp + 0x54], 0xffffffff
setne cl
or eax, ecx
xor ecx, ecx
cmp ebx, 2
setl cl
or eax, ecx
jne case.0x426ff3.114
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.004906b6
test eax, eax
pop ecx
je case.0x426ff3.114
push edi
push edi
push dword [esi]
call fcn.0049069f
mov dword [ebp + 0x54], eax
add esp, 0xc
dec ebx
cmp ebx, 1
jg 0x426c9f
cmp dword [ebp + 0x64], 5
jne 0x4278e0
mov eax, dword [ebp + 0x4c]
shr eax, 2
xor ecx, ecx
inc ecx
not eax
and eax, ecx
test byte [ebp + 0x4c], cl
je 0x42774d
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 0x48]
test ecx, ecx
je case.0x426ff3.114
mov cx, word [ecx]
test cx, cx
je case.0x426ff3.114
push dword [ebp + 8]
push eax
movzx eax, cx
push eax
call fcn.0041184d
add esp, 0xc
jmp case.0x426ff3.114
sub eax, 0x67
je 0x4277a3
sub eax, 4
je 0x4277d1
dec eax
dec eax
je 0x4277ba
sub eax, 7
jne 0x4277e8
push edi
push 0x3e8
push dword [ebp + 0x60]
push dword [ebp + 0x5c]
call fcn.0048f820
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x60], edx
push edi
push 0x3e8
push dword [ebp + 0x60]
push dword [ebp + 0x5c]
call fcn.0048f820
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x60], edx
push edi
push 0x3e8
push dword [ebp + 0x60]
push dword [ebp + 0x5c]
call fcn.0048f820
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x60], edx
push edi
push 0x3e8
push dword [ebp + 0x60]
push dword [ebp + 0x5c]
call fcn.0048f820
mov dword [ebp + 0x5c], eax
mov dword [ebp + 0x60], edx
movzx eax, word [ebp + 0x24]
push eax
push str.ImDisk:_Unsupported_size_suffix:__wc_n
push 0x4bc870
call fcn.0048fb2d
add esp, 0xc
push 0xa
pop eax
jmp 0x427cd5
cmp eax, edx
jb 0x427812
mov ebx, 0x4a8c38
jmp 0x427837
cmp eax, esi
jb 0x42781d
mov ebx, 0x4a8c34
jmp 0x427837
cmp eax, edi
jb 0x427828
mov ebx, 0x4a8c30
jmp 0x427837
cmp eax, 1
mov ebx, str.byte
je 0x427837
mov ebx, 0x4a8c20
cmp ecx, 0x100
jb 0x42785d
ja 0x427845
test eax, eax
jb 0x42785d
test eax, eax
mov dword [ebp + 0x18], eax
fild dword [ebp + 0x18]
jge 0x427855
fadd qword [0x4a8c18]
fmul qword [0x4a8c10]
jmp 0x4278c1
cmp eax, edx
jb 0x427879
test eax, eax
mov dword [ebp + 0x18], eax
fild dword [ebp + 0x18]
jge 0x427871
fadd qword [0x4a8c18]
fmul qword [0x4a8c08]
jmp 0x42785b
cmp eax, esi
jb 0x427895
test eax, eax
mov dword [ebp + 0x18], eax
fild dword [ebp + 0x18]
jge 0x42788d
fadd qword [0x4a8c18]
fmul qword [0x4a8c00]
jmp 0x42785b
cmp eax, edi
jb 0x4278b1
test eax, eax
mov dword [ebp + 0x18], eax
fild dword [ebp + 0x18]
jge 0x4278a9
fadd qword [0x4a8c18]
fmul qword [0x4a8bf8]
jmp 0x42785b
test eax, eax
mov dword [ebp + 0x18], eax
fild dword [ebp + 0x18]
jge 0x4278c1
fadd qword [0x4a8c18]
push ebx
push ecx
push ecx
fstp qword [esp]
push str.ImDisk:_Not_enough_memory__there_is_currently__.4g__s_free_physical_memory._n
push 0x4bc870
call fcn.0048fb2d
add esp, 0x14
push 0xb
jmp 0x427801
mov eax, dword [ebp + 0x64]
xor edi, edi
xor ecx, ecx
dec eax
mov dword [ebp + 0x24], edi
je 0x427a1b
dec eax
je 0x4279e0
dec eax
je 0x42798f
dec eax
jne case.0x426ff3.114
xor eax, eax
cmp dword [ebp + 0x54], 0xffffffff
sete al
xor edx, edx
cmp dword [ebp + 0x48], ecx
sete dl
test edx, eax
jne case.0x426ff3.114
cmp dword [ebp + 0x50], ecx
je 0x42793d
push dword [ebp + 0x68]
push dword [ebp + 0x50]
push dword [ebp + 0x48]
push dword [ebp + 0x54]
call fcn.00412012
add esp, 0x10
mov dword [ebp + 0x1c], eax
xor ecx, ecx
cmp dword [ebp + 0x34], ecx
jl 0x427962
jg 0x427949
cmp dword [ebp + 0x30], ecx
jbe 0x427962
push dword [ebp + 0x34]
push dword [ebp + 0x30]
push dword [ebp + 0x48]
push dword [ebp + 0x54]
call fcn.00412248
add esp, 0x10
mov dword [ebp + 0x1c], eax
xor ecx, ecx
mov eax, dword [ebp + 0x1c]
cmp eax, ecx
jne 0x427cd5
cmp dword [ebp + 0x10], ecx
je 0x427cd5
push dword [ebp + 0x10]
push dword [ebp + 0x48]
push dword [ebp + 0x54]
call fcn.0041bdd3
mov ebx, dword [ebp + 0x48]
add esp, 0xc
jmp 0x427bf2
mov ecx, dword [ebp + 0x7c]
push 0x4a74e8
call fcn.004457ae
xor eax, eax
cmp dword [ebp + 0x54], 0xffffffff
sete al
xor ecx, ecx
cmp dword [ebp + 0x48], ecx
sete cl
test ecx, eax
je 0x4279c7
push dword [ebp + 0x18]
push dword [ebp + 0x7c]
push dword [ebp - 4]
call fcn.00411ad0
add esp, 0xc
jmp 0x427cd5
push dword [ebp + 0x4c]
push dword [ebp + 0x7c]
push dword [ebp + 0x48]
push dword [ebp + 0x54]
call fcn.00411c8a
add esp, 0x10
jmp 0x427cd5
xor eax, eax
cmp dword [ebp + 0x48], ecx
sete al
xor ecx, ecx
or eax, dword [ebp + 0xc]
cmp dword [ebp + 0x54], 0xffffffff
sete cl
test ecx, eax
jne case.0x426ff3.114
push dword [ebp + 0x4c]
push dword [ebp + 8]
push dword [ebp + 0xc]
push dword [ebp + 0x2c]
push dword [ebp + 0x48]
push dword [ebp + 0x54]
call fcn.0041c0aa
add esp, 0x18
jmp 0x427cd5
cmp dword [ebp + 4], ecx
je 0x427a37
cmp dword [ebp + 0x28], 0
je case.0x426ff3.114
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x28]
call dword [0x4bdf44]
push 0x4a39d4
push str.CurRamDisk
mov ecx, 0x4bdfa0
call fcn.0043cc80
cmp byte [ebp + 0x5b], 0
je 0x427acb
movzx edi, byte [ebp + 0x5b]
mov eax, edi
shl eax, 5
lea esi, [ebp + eax - 0x164]
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x44]
push dword [ebp + 0x28]
call dword [0x4bdf48]
test eax, eax
je 0x427ab0
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, ecx
xor ebx, ebx
or eax, edx
jne 0x427a8a
inc ebx
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x427a97
xor eax, eax
inc eax
jmp 0x427a99
xor eax, eax
or eax, ebx
je 0x427ab7
push edi
push str.Error:_Partition__i_is_not_defined._n
push 0x4bc870
call fcn.0048fb2d
add esp, 0xc
push 0xc
jmp 0x427801
add dword [ebp + 0x5c], ecx
mov eax, dword [esi + 8]
mov edi, dword [ebp + 0x24]
adc dword [ebp + 0x60], edx
mov dword [ebp + 0x30], eax
mov eax, dword [esi + 0xc]
jmp 0x427b41
cmp dword [ebp + 4], 0
je 0x427b44
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x44]
push dword [ebp + 0x28]
call dword [0x4bdf48]
test eax, eax
je 0x427b44
lea eax, [ebp - 0x144]
mov ecx, dword [eax]
xor edx, edx
or ecx, dword [eax + 4]
je 0x427afc
inc edx
mov ecx, dword [eax + 8]
xor esi, esi
or ecx, dword [eax + 0xc]
je 0x427b07
inc esi
mov cl, byte [eax + 0x18]
cmp cl, 5
je 0x427b19
cmp cl, 0xf
je 0x427b19
xor ecx, ecx
inc ecx
jmp 0x427b1b
xor ecx, ecx
and ecx, esi
test edx, ecx
jne 0x427b2d
add eax, 0x20
lea ecx, [ebp - 0x44]
cmp eax, ecx
jb 0x427af2
jmp 0x427b44
mov ecx, dword [eax]
add dword [ebp + 0x5c], ecx
mov ecx, dword [eax + 4]
adc dword [ebp + 0x60], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp + 0x30], ecx
mov dword [ebp + 0x34], eax
mov esi, 0x4beb4c
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [ebp + 0x48]
test ebx, ebx
je 0x427b73
push 0x4a8b5c
push ebx
call fcn.0048fcec
test eax, eax
pop ecx
pop ecx
jne 0x427b73
call dword [0x4bdf34]
mov word [ebx], ax
mov edi, eax
push dword [ebp + 0x4c]
lea eax, [ebp + 0x5c]
push dword [ebp + 0x10]
push ebx
push dword [ebp]
push dword [ebp + 0x28]
push dword [ebp + 0x68]
push eax
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x54]
push eax
call fcn.00426559
add esp, 0x24
push esi
mov dword [ebp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp + 0x1c], 0
jne 0x427bf2
cmp dword [ebp - 4], 0
je 0x427bc4
push dword [ebp + 0x54]
push str._1_u_
push 0x4bc850
call fcn.0041190c
add esp, 0xc
jmp 0x427bf2
mov ecx, dword [ebp + 0x28]
test ecx, ecx
jne 0x427bd0
mov ecx, str.VM_image
test ebx, ebx
mov eax, str.No_mountpoint
je 0x427bdb
mov eax, ebx
push ecx
push eax
push dword [ebp + 0x54]
push str.Created_device__1_u_:__2_ws______3_ws_
push 0x4bc850
call fcn.0041190c
add esp, 0x14
test ebx, ebx
je 0x427c5c
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
cmp eax, 2
jne 0x427c10
xor eax, eax
cmp word [ebx + 2], 0x3a
sete al
jmp 0x427c31
push ebx
call esi
cmp eax, 3
jne 0x427c2f
lea eax, [ebx + 2]
push 0x4a673c
push eax
call fcn.0048fcec
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x427c31
xor eax, eax
test eax, eax
je 0x427c5c
push ebx
push str.CurRamDisk
mov ecx, 0x4bdfa0
call fcn.0043cc80
test byte [ebp + 0x4c], 1
jne 0x427c5c
push dword [ebp + 8]
movzx eax, word [ebx]
push 1
push eax
call fcn.0041184d
add esp, 0xc
test di, di
je 0x427c94
cmp dword [ebp - 4], 0
jne 0x427c94
push 0xffffffffffffffff
push 0x4a8af8
lea ecx, [ebp + 0x2c]
call fcn.0044577c
mov esi, dword [ebp + 0x7c]
lea eax, [ebp + 0x2c]
push eax
mov ecx, esi
call fcn.004457dc
lea ecx, [ebp + 0x2c]
call fcn.00437884
mov eax, dword [esi]
mov word [eax + 2], di
jmp 0x427cd2
mov esi, dword [ebp + 0x7c]
push 0x42
mov ecx, esi
call fcn.0043d3ea
test di, di
mov eax, dword [esi]
mov word [eax], 0x2a
je 0x427cb7
cmp dword [ebp + 0x54], 0
mov eax, str._d__c:
jge 0x427cbc
mov eax, 0x4a4078
movzx ecx, di
push ecx
push dword [ebp + 0x54]
push eax
mov eax, dword [esi]
inc eax
inc eax
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp + 0x1c]
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret