Function at 0x41723a
Capabilities:
Get memory capacity

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x1ac
xor ecx, ecx
cmp dword [0x49aeac], ecx
jne 0x417257
or eax, 0xffffffff
jmp 0x417f1d
xor eax, eax
push ebx
or dword [ebp + 0x50], 0xffffffff
push esi
push edi
mov dword [ebp + 0x38], ecx
mov esi, dword [ebp + 0x78]
lea edi, [ebp + 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [ebp + 0x60], ecx
lea edi, [ebp + 0x64]
stosd dword es:[edi], eax
mov byte [ebp + 0x5f], al
mov eax, dword [ebp + 0x7c]
mov eax, dword [eax]
mov ax, word [eax]
xor ebx, ebx
cmp dword [ebp + 0x74], 2
mov dword [ebp + 0x24], ecx
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x14], ecx
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], ecx
mov dword [ebp + 0x34], ecx
mov dword [ebp + 0x30], ecx
mov dword [ebp], ebx
mov dword [ebp + 0x10], ecx
mov dword [ebp + 4], ecx
mov dword [ebp + 0x58], ecx
mov dword [ebp + 0xc], ecx
mov word [ebp + 0x1c], ax
mov dword [0x499298], 0xfa0
mov dword [ebp + 0x20], ecx
jne 0x41737f
push str.__version
push dword [esi + 4]
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x417389
mov eax, dword [0x49aeb0]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], ecx
mov dword [ebp + 0x18], ecx
mov dword [ebp + 0x1c], ecx
je 0x4172fb
lea ecx, [ebp + 0x18]
push ecx
lea ecx, [ebp + 8]
push ecx
call eax
lea ecx, [ebp + 0x28]
call fcn.0042e1c4
push 0x3f
lea eax, [ebp + 0x28]
push eax
push 1
call fcn.0040f32b
add esp, 0xc
cmp eax, 2
mov ecx, 0x487998
jne 0x417322
mov ecx, str.NotLoad
cmp eax, 0xffffffff
jne 0x41732c
mov ecx, str.CannotControl
movzx eax, byte [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
shrd ecx, eax, 8
shr eax, 8
movsx eax, cx
push eax
movzx eax, byte [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 8]
shrd ecx, eax, 8
shr eax, 8
movsx eax, cx
push eax
mov eax, dword [ebp + 0x7c]
push str._X._X___X._X__s
push dword [eax]
mov dword [ebp + 0x34], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea ecx, [ebp + 0x28]
call fcn.00428a48
jmp 0x417f18
cmp dword [ebp + 0x74], 1
jle 0x4179eb
mov ebx, 0x3e8
xor edi, edi
dec dword [ebp + 0x74]
add esi, 4
push str.__id
push dword [esi]
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x4173b1
or dword [ebp + 0x20], 2
jmp case.0x4175d5.114
push str.__nbrd
push dword [esi]
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x4173cc
or dword [ebp + 0x20], 1
jmp case.0x4175d5.114
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x4173e8
mov eax, dword [esi]
xor ecx, ecx
cmp word [eax], 0x2d
sete cl
mov eax, ecx
jmp 0x4173ea
xor eax, eax
cmp eax, edi
je case.0x4175d5.114
mov eax, dword [esi]
mov cx, word [eax + 2]
movzx eax, cx
cmp eax, 0x6d
jg 0x4175c9
je 0x41759e
cmp eax, 0x62
jg 0x417526
je 0x417466
sub eax, 0x44
je 0x417572
dec eax
dec eax
je 0x417546
sub eax, 0xc
je 0x417572
dec eax
je 0x417447
sub eax, 0xe
jne case.0x4175d5.114
mov dword [ebp + 0x24], 1
jmp case.0x4175d5.114
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.00471756
push edi
push edi
push dword [esi]
call fcn.0047173f
mov dword [ebp + 0x4c], eax
jmp 0x4179d6
add esi, 4
push 0x487920
push dword [esi]
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x417487
mov dword [ebp + 4], 1
jmp 0x4179d9
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x60]
push eax
push str._I64u_c
push dword [esi]
mov dword [ebp + 0x54], edi
call fcn.00471513
movzx eax, word [ebp + 0x54]
add esp, 0x10
cmp eax, 0x62
jg 0x417a15
je 0x41750e
sub eax, edi
je 0x4179d9
sub eax, 0x47
je 0x4174de
sub eax, 4
je 0x4174ff
dec eax
dec eax
je 0x4174f0
sub eax, 7
jne 0x417a74
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x64]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x4174e4
mov ecx, dword [ebp + 0x64]
mov eax, dword [ebp + 0x60]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp + 0x64], ecx
jmp 0x4174f3
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x64]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x417505
mov ecx, dword [ebp + 0x64]
mov eax, dword [ebp + 0x60]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x41751b
mov eax, dword [ebp + 0x60]
mov ecx, dword [ebp + 0x64]
shld ecx, eax, 9
shl eax, 9
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], ecx
jmp 0x4179d9
sub eax, 0x64
je 0x417572
dec eax
je 0x417566
dec eax
je 0x417546
sub eax, 6
jne case.0x4175d5.114
mov dword [ebp + 0x24], 3
jmp case.0x4175d5.114
cmp cx, 0x46
jne 0x417553
mov dword [ebp + 0x14], 1
add esi, 4
push dword [esi]
call fcn.0040dca1
pop ecx
mov dword [ebp + 0x30], eax
jmp 0x4179d9
mov dword [ebp + 0x24], 4
jmp case.0x4175d5.114
cmp cx, 0x44
mov dword [ebp + 0x24], 2
jne 0x417586
mov dword [ebp + 0x2c], 1
cmp cx, 0x52
jne case.0x4175d5.114
xor eax, eax
inc eax
mov dword [ebp + 0x2c], eax
mov dword [ebp + 0x34], eax
jmp case.0x4175d5.114
add esi, 4
mov ecx, dword [esi]
mov ax, word [ecx]
cmp ax, 0x61
mov dword [ebp], ecx
jb 0x4179d9
cmp ax, 0x7a
ja 0x4179d9
and ax, 0xffdf
mov word [ecx], ax
jmp 0x4179d9
sub eax, 0x6e
cmp eax, 0xb
ja case.0x4175d5.114
jmp dword [eax*4 + 0x417f22]
mov dword [0x499298], 1
jmp case.0x4175d5.114
add esi, 4
push 0x487904
push dword [esi]
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x417609
or byte [ebp + 0x69], 1
jmp 0x4179d9
push 0x4878fc
push dword [esi]
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x417624
or byte [ebp + 0x69], 2
jmp 0x4179d9
push str.proxy
push dword [esi]
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x4179d9
or byte [ebp + 0x69], 3
jmp 0x4179d9
mov dword [ebp + 0x28], 1
jmp case.0x4175d5.114
add esi, 4
push 0x4853b8
push dword [esi]
jmp 0x4177bb
push 0x4878e8
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x41767c
or dword [ebp + 0x58], 1
or dword [ebp + 0x68], 1
jmp 0x4177b4
push 0x4878e0
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x41769a
or dword [ebp + 0x58], 1
and dword [ebp + 0x68], 0xfffffffe
jmp 0x4177b4
push 0x4878d8
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x4176b8
or dword [ebp + 0x58], 2
or dword [ebp + 0x68], 2
jmp 0x4177b4
push 0x4878d0
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x4176d6
or dword [ebp + 0x58], 2
and dword [ebp + 0x68], 0xfffffffd
jmp 0x4177b4
push str.saved
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x4176f4
or byte [ebp + 0x5a], 1
and byte [ebp + 0x6a], 0xfe
jmp 0x4177b4
cmp dword [ebp + 0x24], 1
jne 0x4177b4
push 0x4878bc
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x41771f
or byte [ebp + 0x69], 0x20
mov dword [ebp + 0x14], 1
jmp 0x4177b4
push str.comm
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x41773d
or byte [ebp + 0x69], 0x10
mov dword [ebp + 0x14], 1
jmp 0x4177b4
push 0x4878a8
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x417754
or byte [ebp + 0x69], 0x30
jmp 0x4177b4
push 0x4878a0
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x41776b
or byte [ebp + 0x69], 0x11
jmp 0x4177b4
test byte [ebp + 0x68], 0xf0
jne 0x4177b4
push 0x487898
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x417788
or dword [ebp + 0x68], 0x10
jmp 0x4177b4
push 0x487890
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x41779f
or dword [ebp + 0x68], 0x20
jmp 0x4177b4
push 0x487888
push edi
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x4177b4
or dword [ebp + 0x68], 0x30
push 0x4853b8
push 0
call fcn.0047146e
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x41765e
dec dword [ebp + 0x74]
jmp case.0x4175d5.114
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x38]
push eax
add esi, 4
push str._I64i_c
push dword [esi]
mov dword [ebp + 0x54], edi
call fcn.00471513
movzx eax, word [ebp + 0x54]
add esp, 0x10
cmp eax, 0x54
jg 0x417889
je 0x41784c
sub eax, edi
je 0x417903
sub eax, 0x25
je 0x417824
sub eax, 0x22
je 0x41785b
sub eax, 4
je 0x41787a
dec eax
dec eax
jne 0x417a74
mov eax, dword [ebp + 0x38]
jmp 0x41786b
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
push edi
push dword [ebp - 0x14]
call fcn.00471360
push edi
push 0x64
push edx
push eax
call fcn.004711e0
jmp 0x4178eb
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp + 0x3c]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x417861
mov ecx, dword [ebp + 0x3c]
mov eax, dword [ebp + 0x38]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp + 0x3c], ecx
mov ecx, dword [ebp + 0x3c]
shld ecx, eax, 0xa
shl eax, 0xa
mov dword [ebp + 0x3c], ecx
jmp 0x41787d
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp + 0x3c]
shld ecx, eax, 0xa
shl eax, 0xa
jmp 0x4178fd
sub eax, 0x62
je 0x4178f0
sub eax, 5
je 0x4178b8
sub eax, 4
je 0x4178de
dec eax
dec eax
je 0x4178cb
sub eax, 7
jne 0x417a74
push edi
push ebx
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
call fcn.00471360
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], edx
push edi
push ebx
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
call fcn.00471360
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], edx
push edi
push ebx
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
call fcn.00471360
mov dword [ebp + 0x38], eax
mov dword [ebp + 0x3c], edx
push edi
push ebx
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
call fcn.00471360
mov dword [ebp + 0x3c], edx
jmp 0x417900
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp + 0x3c]
shld ecx, eax, 9
shl eax, 9
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x38], eax
cmp dword [ebp + 0x3c], edi
jg 0x4179d9
jl 0x417917
cmp dword [ebp + 0x38], edi
jae 0x4179d9
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 0x34]
add dword [ebp + 0x38], eax
adc dword [ebp + 0x3c], edi
js 0x41793b
jg 0x4179d9
cmp dword [ebp + 0x38], edi
jae 0x4179d9
xor ecx, ecx
cmp ecx, 0x100
mov edi, 0x400
mov esi, 0x100000
mov edx, 0x40000000
jb 0x417a93
ja 0x417962
test eax, eax
jb 0x417a93
mov ebx, 0x487874
jmp 0x417ac3
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.00471756
push edi
push edi
push dword [esi]
call fcn.0047173f
mov dword [ebp + 0x48], eax
jmp 0x4179d6
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.00471756
push edi
push edi
push dword [esi]
call fcn.0047173f
mov dword [ebp + 0x44], eax
jmp 0x4179d6
add esi, 4
mov eax, dword [esi]
mov al, byte [eax]
sub al, 0x30
mov byte [ebp + 0x5f], al
jmp 0x4179d9
add esi, 4
mov eax, dword [esi]
mov dword [ebp + 0x10], eax
jmp 0x4179d9
add esi, 4
mov eax, dword [esi]
movzx eax, word [eax]
push eax
call fcn.00471756
push edi
push edi
push dword [esi]
call fcn.0047173f
mov dword [ebp + 0x50], eax
add esp, 0x10
dec dword [ebp + 0x74]
cmp dword [ebp + 0x74], 1
jg 0x417390
mov ebx, dword [ebp]
xor ecx, ecx
mov eax, dword [ebp + 0x24]
dec eax
mov dword [ebp + 0x54], ecx
je 0x417c1f
dec eax
je 0x417c0e
dec eax
je 0x417bc0
dec eax
je 0x417b6c
or eax, 0xffffffff
jmp 0x417f1a
sub eax, 0x67
je 0x417a3b
sub eax, 4
je 0x417a61
dec eax
dec eax
je 0x417a4e
sub eax, 7
jne 0x417a74
push edi
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00471360
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
push edi
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00471360
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
push edi
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00471360
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
push edi
push ebx
push dword [ebp + 0x64]
push dword [ebp + 0x60]
call fcn.00471360
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x64], edx
movzx eax, word [ebp + 0x54]
push eax
push str.ImDisk:_Unsupported_size_suffix:__wc_n
push 0x499830
call fcn.00470dbd
add esp, 0xc
push 0xa
pop eax
jmp 0x417f1a
cmp eax, edx
jb 0x417a9e
mov ebx, 0x487848
jmp 0x417ac3
cmp eax, esi
jb 0x417aa9
mov ebx, 0x487844
jmp 0x417ac3
cmp eax, edi
jb 0x417ab4
mov ebx, 0x487840
jmp 0x417ac3
cmp eax, 1
mov ebx, str.byte
je 0x417ac3
mov ebx, 0x487830
cmp ecx, 0x100
jb 0x417ae9
ja 0x417ad1
test eax, eax
jb 0x417ae9
test eax, eax
mov dword [ebp + 0x1c], eax
fild dword [ebp + 0x1c]
jge 0x417ae1
fadd qword [0x487828]
fmul qword [0x487820]
jmp 0x417b4d
cmp eax, edx
jb 0x417b05
test eax, eax
mov dword [ebp + 0x1c], eax
fild dword [ebp + 0x1c]
jge 0x417afd
fadd qword [0x487828]
fmul qword [0x487818]
jmp 0x417ae7
cmp eax, esi
jb 0x417b21
test eax, eax
mov dword [ebp + 0x1c], eax
fild dword [ebp + 0x1c]
jge 0x417b19
fadd qword [0x487828]
fmul qword [0x487810]
jmp 0x417ae7
cmp eax, edi
jb 0x417b3d
test eax, eax
mov dword [ebp + 0x1c], eax
fild dword [ebp + 0x1c]
jge 0x417b35
fadd qword [0x487828]
fmul qword [0x487808]
jmp 0x417ae7
test eax, eax
mov dword [ebp + 0x1c], eax
fild dword [ebp + 0x1c]
jge 0x417b4d
fadd qword [0x487828]
push ebx
push ecx
push ecx
fstp qword [esp]
push str.ImDisk:_Not_enough_memory__there_is_currently__.4g__s_free_physical_memory._n
push 0x499830
call fcn.00470dbd
add esp, 0x14
push 0xb
jmp 0x417a8d
cmp dword [ebp + 0x58], ecx
je 0x417b87
push dword [ebp + 0x68]
push dword [ebp + 0x58]
push ebx
push dword [ebp + 0x50]
call fcn.0040f76b
add esp, 0x10
xor ecx, ecx
jmp 0x417b8a
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x3c], ecx
jl 0x417baa
jg 0x417b96
cmp dword [ebp + 0x38], ecx
jbe 0x417baa
push dword [ebp + 0x3c]
push dword [ebp + 0x38]
push ebx
push dword [ebp + 0x50]
call fcn.0040f9a1
add esp, 0x10
xor ecx, ecx
cmp eax, ecx
jne 0x417f1a
cmp dword [ebp + 0x10], ecx
jne 0x417dea
jmp 0x417f1a
mov ecx, dword [ebp + 0x7c]
push 0x4877b4
call fcn.0043a522
xor eax, eax
cmp dword [ebp + 0x50], 0xffffffff
sete al
xor ecx, ecx
test ebx, ebx
sete cl
test ecx, eax
je 0x417bf7
push dword [ebp + 0x1c]
push dword [ebp + 0x7c]
push dword [ebp + 0x28]
call fcn.0040f32b
add esp, 0xc
jmp 0x417f1a
push dword [ebp + 0x20]
push dword [ebp + 0x7c]
push ebx
push dword [ebp + 0x50]
call fcn.0040f434
add esp, 0x10
jmp 0x417f1a
push dword [ebp + 0x34]
push dword [ebp + 0x2c]
push ebx
push dword [ebp + 0x50]
call fcn.0040edf4
jmp 0x417c06
cmp dword [ebp + 4], ecx
je 0x417c37
cmp dword [ebp + 0x30], 0
je 0x417c37
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x30]
call dword [0x49ae90]
push 0x484964
push str.CurRamDisk
mov ecx, 0x49aed0
call fcn.0042cbf7
cmp byte [ebp + 0x5f], 0
je 0x417ccb
movzx edi, byte [ebp + 0x5f]
mov eax, edi
shl eax, 5
lea esi, [ebp + eax - 0x160]
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x30]
call dword [0x49ae94]
test eax, eax
je 0x417cb0
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov eax, ecx
xor ebx, ebx
or eax, edx
jne 0x417c8a
inc ebx
mov eax, dword [esi + 8]
or eax, dword [esi + 0xc]
jne 0x417c97
xor eax, eax
inc eax
jmp 0x417c99
xor eax, eax
or eax, ebx
je 0x417cb7
push edi
push str.Error:_Partition__i_is_not_defined._n
push 0x499830
call fcn.00470dbd
add esp, 0xc
push 0xc
jmp 0x417a8d
add dword [ebp + 0x60], ecx
mov eax, dword [esi + 8]
mov ebx, dword [ebp]
adc dword [ebp + 0x64], edx
mov dword [ebp + 0x38], eax
mov eax, dword [esi + 0xc]
jmp 0x417d41
cmp dword [ebp + 4], 0
je 0x417d44
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x4c]
push dword [ebp + 0x30]
call dword [0x49ae94]
test eax, eax
je 0x417d44
lea eax, [ebp - 0x140]
mov ecx, dword [eax]
xor edx, edx
or ecx, dword [eax + 4]
je 0x417cfc
inc edx
mov ecx, dword [eax + 8]
xor esi, esi
or ecx, dword [eax + 0xc]
je 0x417d07
inc esi
mov cl, byte [eax + 0x18]
cmp cl, 5
je 0x417d19
cmp cl, 0xf
je 0x417d19
xor ecx, ecx
inc ecx
jmp 0x417d1b
xor ecx, ecx
and ecx, esi
test edx, ecx
jne 0x417d2d
add eax, 0x20
lea ecx, [ebp - 0x40]
cmp eax, ecx
jb 0x417cf2
jmp 0x417d44
mov ecx, dword [eax]
add dword [ebp + 0x60], ecx
mov ecx, dword [eax + 4]
adc dword [ebp + 0x64], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp + 0x38], ecx
mov dword [ebp + 0x3c], eax
mov esi, 0x49b604
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x48776c
push ebx
call fcn.00470fec
test eax, eax
pop ecx
pop ecx
jne 0x417d6d
call dword [0x49ae84]
mov word [ebx], ax
mov dword [ebp + 0x54], eax
push ebx
push dword [ebp + 0x14]
lea eax, [ebp + 0x60]
push dword [ebp + 0x30]
push dword [ebp + 0x68]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x50]
push eax
call fcn.0040e66e
add esp, 0x1c
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x417d9f
mov eax, edi
jmp 0x417f1a
cmp dword [ebp + 0x28], 0
je 0x417db6
push dword [ebp + 0x50]
push 0x487768
call fcn.00471408
pop ecx
pop ecx
jmp 0x417de4
mov ecx, dword [ebp + 0x30]
test ecx, ecx
jne 0x417dc2
mov ecx, str.VM_image
test ebx, ebx
mov eax, str.No_mountpoint
je 0x417dcd
mov eax, ebx
push ecx
push eax
push dword [ebp + 0x50]
push str.Created_device__1_u_:__2_ws______3_ws_
push 0x499810
call fcn.0040e52b
add esp, 0x14
cmp dword [ebp + 0x10], 0
je 0x417dfd
test ebx, ebx
je 0x417ee5
push dword [ebp + 0x10]
push ebx
call fcn.0040ec43
pop ecx
pop ecx
test ebx, ebx
je 0x417ee5
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call esi
cmp eax, 2
jne 0x417e1f
xor eax, eax
cmp word [ebx + 2], 0x3a
sete al
jmp 0x417e40
push ebx
call esi
cmp eax, 3
jne 0x417e3e
lea eax, [ebx + 2]
push 0x486818
push eax
call fcn.00470fec
neg eax
pop ecx
sbb eax, eax
pop ecx
inc eax
jmp 0x417e40
xor eax, eax
test eax, eax
je 0x417ee5
movzx esi, word [ebx]
xor eax, eax
mov dword [ebp - 0x14], 0x14
mov dword [ebp - 0x10], 2
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
sub esi, 0x41
inc eax
mov ecx, esi
shl eax, cl
push ebx
push str.CurRamDisk
mov ecx, 0x49aed0
mov dword [ebp - 8], eax
call fcn.0042cbf7
test byte [ebp + 0x20], 1
jne 0x417ee5
cmp esi, 0x19
ja 0x417ee5
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
lea eax, [ebp + 0x34]
push eax
push dword [0x499298]
lea eax, [ebp - 0x14]
push 3
push eax
push 0x8000
mov ebx, 0x219
push ebx
mov edi, 0xffff
push edi
call esi
lea eax, [ebp + 0x34]
push eax
push dword [0x499298]
lea eax, [ebp - 0x14]
push 3
push eax
push 0x8000
push ebx
push edi
mov word [ebp - 4], 1
call esi
lea eax, [ebp + 0x34]
push eax
push dword [0x499298]
push 3
push 0
push 7
push ebx
push edi
call esi
mov edi, dword [ebp + 0x54]
test di, di
je 0x417f18
push 0xffffffffffffffff
push 0x48770c
lea ecx, [ebp + 0x2c]
call fcn.0043a4f0
mov esi, dword [ebp + 0x7c]
lea eax, [ebp + 0x2c]
push eax
mov ecx, esi
call fcn.0043a550
lea ecx, [ebp + 0x2c]
call fcn.00428a48
mov eax, dword [esi]
mov word [eax + 2], di
xor eax, eax
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret