Function at 0x406e0d
Capabilities:
Get memory capacity
Read .ini file

Disassembly:
sub esp, 0x228
mov eax, dword [0x421c40]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
push ebp
mov ebp, dword [esp + 0x234]
push esi
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x423158
mov dword [0x423158], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor ebx, ebx
push ebx
push str.ProgMan
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push ebx
push str.SHELLDLL_DefView
push ebx
push eax
call esi
push ebx
push str.SysListView32
push ebx
push eax
call esi
push 0x104
mov esi, 0x422418
mov dword [0x4237ac], eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
sub eax, esi
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x407202
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
xor ecx, ecx
push esi
push 0x422e40
mov word [eax + 0x422418], cx
call edi
push esi
push 0x422828
call edi
push esi
push 0x422a30
call edi
push esi
push 0x422c38
call edi
push esi
mov ebx, 0x422620
push ebx
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.Langdefault.lng
push ebx
call esi
push str._ramsaverpro.ini
push 0x422418
call esi
push 0x422418
call fcn.004035a8
mov dword [esp], str._ramsaverpro.exe
push 0x422828
call esi
push str._ramsavercp.exe
push 0x422a30
call esi
push str.help_
push 0x422c38
call esi
push ebx
push 0x104
lea eax, [esp + 0x34]
push eax
push 0
push 0x417a00
push str.LANGUAGE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x2c]
push eax
push 0x422c38
call esi
call fcn.004040e6
call fcn.00404114
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x422418
push 0
push str.TrayIconView
push str.Options
call ebx
push 0x418114
mov dword [0x423048], eax
call fcn.00403ef3
pop ecx
push eax
push 0x423050
call edi
mov dword [0x4231ac], ebp
call fcn.00404255
test eax, eax
je 0x4070ce
push 0x2710
push dword [0x4231ac]
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edi, eax
call fcn.004036a4
mov dword [0x42356c], eax
test eax, eax
je 0x4070ce
call fcn.00403a90
push 0x3b8
push 0
push 0x4231b4
call fcn.004081e0
push str.RAM_Saver_Pro
push 0x418138
push 0x64
push 0x4231c8
mov dword [0x4231b0], 0x3bc
call fcn.0040723c
add esp, 0x1c
push 0x64
pop esi
sub esi, dword [0x42315c]
push 0
push 0xffa80
push dword [0x42316c]
push dword [0x423168]
call fcn.00407520
push 0x417a80
push esi
push eax
push 0x418114
call fcn.00403ef3
pop ecx
push eax
push 0x64
push 0x4232d0
call fcn.0040723c
mov eax, dword [0x42356c]
add esp, 0x18
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x4231b4], eax
mov dword [0x4231b8], 1
push 0
push 0x32
mov dword [0x4231bc], 0x17
mov dword [0x4231c0], 0x410
call esi
push eax
push 0x31
call esi
push eax
xor esi, esi
inc esi
push esi
push 0xbb8
push ebp
call dword [sym.imp.USER32.dll_LoadImageW]
mov ebp, 0x422418
mov dword [0x4231c4], eax
push ebp
push 3
push str.SetNotify
push 0x417950
call ebx
test eax, eax
je 0x4070eb
cmp eax, 3
jne 0x4070bc
push ebp
push 0x41794c
push str.SetNotify
push 0x417950
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x4231b0
xor ebp, ebp
push ebp
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
jne 0x4070ed
xor eax, eax
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00407258
add esp, 0x228
ret 0x10
xor ebp, ebp
mov dword [0x4231bc], 7
call fcn.004030a5
call fcn.00406749
call fcn.00406725
call fcn.004066de
push ebp
push 0x3e8
push esi
push dword [0x42356c]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.0040662c
call fcn.004050f7
call fcn.00405405
test eax, eax
jne 0x407175
push ebp
push 0x406831
push dword [0x42356c]
push str.DLGG
push dword [0x4231ac]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x40716d
push esi
push dword [0x42356c]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
call esi
push 2
push dword [0x42356c]
call esi
jmp 0x407192
mov dword [0x42304c], esi
jmp 0x407192
push 0x41794c
push str.rvsmr
mov dword [0x42304c], esi
call fcn.00406dac
pop ecx
pop ecx
mov dword [0x423150], esi
push 0x422418
push ebp
push str.RamStart
push 0x417950
call ebx
test eax, eax
je 0x4071b4
push dword [0x42356c]
call fcn.00403b67
pop ecx
call fcn.004055a5
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
jmp 0x4071eb
lea eax, [esp + 0x10]
push eax
push edi
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x4071eb
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebp
push ebp
push ebp
lea eax, [esp + 0x1c]
push eax
call esi
test eax, eax
jne 0x4071c1
mov eax, dword [esp + 0x18]
jmp 0x4070d0
call fcn.00407389
int3