Function at 0x422c50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48c223
mov eax, dword fs:[0]
push eax
mov eax, 0x100e4
call fcn.0046be90
mov eax, dword [0x4b77c0]
xor eax, esp
mov dword [esp + 0x100e0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4b77c0]
xor eax, esp
push eax
lea eax, [esp + 0x100f8]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
mov ebp, ecx
push eax
mov dword [esp + 0x60], ebp
call fcn.00421a80
mov esi, 0x10
cmp dword [eax + 0x18], esi
jb 0x422cae
mov eax, dword [eax + 4]
jmp 0x422cb1
add eax, 4
movsx ecx, byte [eax]
push ecx
call fcn.0046e17b
add esp, 4
mov bl, al
mov byte [esp + 0x16], bl
cmp dword [esp + 0x34], esi
jb 0x422cd6
mov edx, dword [esp + 0x20]
push edx
call fcn.0046b849
add esp, 4
call sub.SHELL32.dll_IsUserAnAdmin
test eax, eax
jne 0x422cfe
call fcn.004378f0
test eax, eax
je 0x422cfe
call fcn.0041e6d0
mov eax, dword [0x4b9678]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push 1
push eax
call edx
jmp 0x422d08
push 1
call fcn.0043c050
add esp, 4
test eax, eax
setne al
test al, al
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xf8]
push ecx
push str.PagingFiles
push str.SystemCurrentControlSetControlSession_ManagerMemory_Management
sete byte [esp + 0x27]
mov dword [esp + 0x28], 0x10000
call fcn.004508c0
add esp, 0x10
test eax, eax
je 0x422d98
mov eax, dword [esp + 0x18]
cmp eax, 4
jbe 0x422d98
mov esi, 1
lea edx, [eax - 2]
cmp edx, esi
jbe 0x422d93
mov bl, 0x5c
cmp byte [esp + esi + 0xf4], 0x3a
jne 0x422d87
cmp byte [esp + esi + 0xf5], bl
jne 0x422d87
movsx eax, byte [esp + esi + 0xf3]
push eax
call fcn.0046e17b
movsx ecx, byte [esp + 0x1a]
add esp, 4
cmp eax, ecx
jne 0x422da3
mov eax, dword [esp + 0x18]
inc esi
lea edx, [eax - 2]
cmp esi, edx
jb 0x422d56
mov bl, byte [esp + 0x16]
mov esi, 0x10
cmp byte [esp + 0x17], 0
jne 0x422fb0
push str.PAGING_FILE_NOT_ON_SYS_PARTITION
call fcn.0044c960
xor edi, edi
add esp, 4
xor ecx, ecx
mov word [esp + 0x80], cx
mov ebp, 7
mov ecx, eax
mov dword [esp + 0x94], ebp
mov dword [esp + 0x90], edi
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x422dd4
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x84]
call fcn.00403870
push str.LEAKS_OUTSIDE_SYSPART_UNIVERSAL_EXPLANATION
mov dword [esp + 0x10104], edi
call fcn.0044c960
push eax
lea edx, [esp + 0x84]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00403960
push 0x48f6b4
push eax
lea ecx, [esp + 0x78]
push ecx
mov byte [esp + 0x1011c], 1
call fcn.00403960
mov esi, eax
push str.RESTRICT_PAGING_FILES_TO_SYS_PARTITION
mov byte [esp + 0x10120], 2
call fcn.0044c960
push eax
lea edx, [esp + 0x5c]
push esi
push edx
call fcn.00403960
mov esi, 8
add esp, 0x2c
cmp dword [eax + 0x18], esi
jb 0x422e5f
mov eax, dword [eax + 4]
jmp 0x422e62
add eax, 4
push eax
call fcn.00433e90
add esp, 4
cmp eax, 6
sete bl
cmp dword [esp + 0x50], esi
jb 0x422e84
mov eax, dword [esp + 0x3c]
push eax
call fcn.0046b849
add esp, 4
xor ecx, ecx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], edi
mov word [esp + 0x3c], cx
cmp dword [esp + 0x78], esi
jb 0x422ea6
mov edx, dword [esp + 0x64]
push edx
call fcn.0046b849
add esp, 4
xor eax, eax
mov dword [esp + 0x78], ebp
mov dword [esp + 0x74], edi
mov word [esp + 0x64], ax
cmp dword [esp + 0x34], esi
jb 0x422ec8
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0046b849
add esp, 4
xor edx, edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], edi
mov word [esp + 0x20], dx
mov dword [esp + 0x10100], 0xffffffff
cmp dword [esp + 0x94], esi
jb 0x422efb
mov eax, dword [esp + 0x80]
push eax
call fcn.0046b849
add esp, 4
test bl, bl
je 0x422f12
mov ecx, dword [esp + 0x5c]
call fcn.00422480
call fcn.004342b0
call fcn.00430640
push str.PAGING_FILE_NOT_ON_SYS_PARTITION
call fcn.0044c960
add esp, 4
xor ecx, ecx
mov word [esp + 0x20], cx
mov ecx, eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], edi
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x422f33
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.00403870
push str.LEAKS_OUTSIDE_SYSPART_UNIVERSAL_EXPLANATION
mov dword [esp + 0x10104], 3
call fcn.0044c960
push eax
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x6c]
push eax
call fcn.00403960
add esp, 0x10
push 0xffffffffffffffff
xor ecx, ecx
push edi
mov word [esp + 0x4c], cx
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1010c], 4
mov dword [esp + 0x44], vtable.TrueCrypt::ErrorException.0
mov dword [esp + 0x64], ebp
mov dword [esp + 0x60], edi
call fcn.00403770
push 0x4ac164
lea edx, [esp + 0x3c]
push edx
call fcn.0046b8cf
push str.dummy
call fcn.00438120
xor edi, edi
add esp, 4
cmp eax, edi
je 0x423056
movsx eax, byte [eax]
push eax
call fcn.0046e17b
movsx ecx, bl
add esp, 4
cmp eax, ecx
je 0x423056
push str.USER_PROFILE_NOT_ON_SYS_PARTITION
call fcn.0044c960
add esp, 4
push eax
lea ecx, [esp + 0x20]
call fcn.00403ae0
mov esi, eax
push str.LEAKS_OUTSIDE_SYSPART_UNIVERSAL_EXPLANATION
mov dword [esp + 0x10104], 5
call fcn.0044c960
push eax
lea edx, [esp + 0x68]
push esi
push edx
call fcn.00403960
add esp, 0x10
push 0xffffffffffffffff
xor ecx, ecx
push edi
mov word [esp + 0x4c], cx
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x1010c], 6
mov dword [esp + 0x44], vtable.TrueCrypt::ErrorException.0
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], edi
call fcn.00403770
push 0x4ac164
lea edx, [esp + 0x3c]
push edx
call fcn.0046b8cf
lea eax, [esp + 0x1c]
push eax
mov ecx, ebp
call fcn.00421b30
cmp dword [eax + 0x18], esi
jb 0x42306c
mov eax, dword [eax + 4]
jmp 0x42306f
add eax, 4
movsx ecx, byte [eax]
push ecx
call fcn.0046e17b
movsx edx, bl
add esp, 4
cmp eax, edx
setne bl
cmp dword [esp + 0x34], esi
jb 0x423096
mov eax, dword [esp + 0x20]
push eax
call fcn.0046b849
add esp, 4
test bl, bl
je 0x423164
push str.TEMP_NOT_ON_SYS_PARTITION
call fcn.0044c960
add esp, 4
xor ecx, ecx
mov word [esp + 0x9c], cx
mov ebp, 7
mov ecx, eax
mov dword [esp + 0xb0], ebp
mov dword [esp + 0xac], edi
lea esi, [ecx + 2]
lea ecx, [ecx]
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x4230d0
sub ecx, esi
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0xa0]
call fcn.00403870
push str.LEAKS_OUTSIDE_SYSPART_UNIVERSAL_EXPLANATION
mov dword [esp + 0x10104], ebp
call fcn.0044c960
push eax
lea edx, [esp + 0xa0]
push edx
lea eax, [esp + 0xe4]
push eax
call fcn.00403960
add esp, 0x10
push 0xffffffffffffffff
xor ecx, ecx
push edi
mov word [esp + 0xc8], cx
push eax
lea ecx, [esp + 0xc8]
mov byte [esp + 0x1010c], 8
mov dword [esp + 0xc0], vtable.TrueCrypt::ErrorException.0
mov dword [esp + 0xe0], ebp
mov dword [esp + 0xdc], edi
call fcn.00403770
push 0x4ac164
lea edx, [esp + 0xb8]
push edx
call fcn.0046b8cf
mov ecx, dword [esp + 0x100f8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x100e0]
xor ecx, esp
call fcn.0046be7b
add esp, 0x100f0
ret