Function at 0x407920
Capabilities:
Copy file
Create directory
Encode data using xor
Get common file path
Get disk information
Get memory capacity
Hide graphical window
Read .ini file

Disassembly:
mov eax, 0x1a6c
call fcn.00408620
mov eax, dword [0x422c40]
xor eax, esp
mov dword [esp + 0x1a68], eax
mov eax, dword [esp + 0x1a70]
push ebx
mov dword [esp + 4], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x424158
mov dword [0x424158], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push str.ProgMan
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push str.SHELLDLL_DefView
push 0
push eax
call ebx
push 0
push str.SysListView32
push 0
push eax
call ebx
push 0x104
push 0x423418
push 0
mov dword [0x4247b0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0
push 0x423418
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
sub eax, 0x423418
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x408257
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
xor ecx, ecx
push esi
push edi
push 0x423418
push 0x423e40
mov word [eax + 0x423418], cx
call ebp
push 0x423418
push 0x423828
call ebp
push 0x423418
push 0x423a30
call ebp
push 0x423418
push 0x423c38
call ebp
push 0x423418
push 0x423620
call ebp
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.Langdefault.lng
push 0x423620
call esi
push str._ramsaverpro.ini
push 0x423418
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x423418
push 0x418944
push str.TEST
push str.TEST
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x423418
push 0
push str.TEST
push str.TEST
call edi
test eax, eax
je 0x407a83
push 0x423418
push 0x418924
push str.TEST
push str.TEST
call ebx
jmp 0x407b23
xor eax, eax
push 0x206
push eax
mov word [esp + 0x78], ax
lea eax, [esp + 0x7a]
push eax
call fcn.004091f0
add esp, 0xc
lea eax, [esp + 0x70]
push eax
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x407b23
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x70]
push str.WinTools
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x70]
push 0
push eax
call esi
push str.RAMSaverPro
lea eax, [esp + 0x74]
push eax
call edi
push 0
lea eax, [esp + 0x74]
push eax
call esi
push str._ramsaverpro.ini
lea eax, [esp + 0x74]
push eax
call edi
push 1
lea eax, [esp + 0x74]
push eax
push 0x423418
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esp + 0x70]
push eax
push 0x423418
call ebp
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str._ramsaverpro.exe
push 0x423828
call esi
push str._ramsavercp.exe
push 0x423a30
call esi
push str.help_
push 0x423c38
call esi
push 0x423620
push 0x104
lea eax, [esp + 0x1078]
push eax
push 0
push 0x4189e4
push str.LANGUAGE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x1070]
push eax
push 0x423c38
call esi
push 0x423418
push 0
push str.Noicons
push str.OPTIONS
call edi
test eax, eax
jne 0x407b95
push 5
jmp 0x407b97
push 0
push dword [0x4247b0]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00404640
push 0x423418
push 0
push str.TrayIconView
push str.Options
call edi
push 0x4190f8
mov dword [0x424048], eax
call fcn.004044b0
add esp, 4
push eax
push 0x424050
call ebp
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
push 0x7f00
push 0
mov dword [0x4241ac], eax
movlpd qword [esp + 0x50], xmm0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x68], 0
mov dword [esp + 0x48], 0xb
mov dword [esp + 0x4c], 0x404880
mov dword [esp + 0x58], eax
mov dword [esp + 0x64], 6
mov dword [esp + 0x6c], str.RamSaverProWndClass
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x408253
push 0
push str.RamSaverProWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x407c69
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.RamSaverProWndClass
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
jne 0x408253
push 0x2710
push dword [0x4241ac]
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0
push dword [0x4241ac]
mov dword [esp + 0x28], eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0x16cf0000
push str.RamSaverPro
push str.RamSaverProWndClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x42456c], eax
test eax, eax
je 0x408253
push 0x423418
push 0
push 0x4189f4
push str.Options
call edi
mov dword [0x424154], eax
cmp eax, 2
jne 0x407d48
push 0x424158
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [0x424164], 0
ja 0x407d28
cmp dword [0x424160], 0x3fef2000
jae 0x407d28
push 0x423418
mov dword [0x424154], 0
push 0x418924
jmp 0x407d3c
push 0x423418
mov dword [0x424154], 1
push 0x418944
push 0x4189f4
push str.OPTIONS
call ebx
push 0x3b8
push 0
push 0x4241b4
call fcn.004091f0
push str.RAM_Saver_Pro
push 0x41911c
push 0x64
push 0x4241c8
mov dword [0x4241b0], 0x3bc
call fcn.00408280
mov eax, 0x64
mov ebx, 0x34ca257d
sub eax, dword [0x42415c]
mov ebp, 0x802c0f25
mov dword [esp + 0x30], eax
add esp, 0x1c
mov eax, dword [0x424168]
mul ebx
push 0x418a64
mov dword [esp + 0x1c], eax
mov esi, edx
mov eax, dword [0x424168]
mul ebp
push dword [esp + 0x18]
mov edi, eax
mov ebp, edx
mov eax, dword [0x42416c]
mul ebx
mov ecx, eax
mov ebx, edx
mov eax, dword [0x42416c]
mov edx, 0x802c0f25
mul edx
add ecx, esi
mov dword [esp + 0x20], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [esp + 0x20]
adc ebp, 0
xor eax, eax
add ebx, ebp
adc eax, eax
add ecx, ebx
adc edx, eax
shrd ecx, edx, 0x13
push ecx
push 0x4190f8
call fcn.004044b0
add esp, 4
push eax
push 0x64
push 0x4242d0
call fcn.00408280
mov eax, dword [0x42456c]
add esp, 0x18
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x4241b4], eax
mov dword [0x4241b8], 1
push 0
push 0x32
mov dword [0x4241bc], 0x17
mov dword [0x4241c0], 0x410
call esi
push eax
push 0x31
call esi
push eax
mov eax, dword [esp + 0x1c]
push 1
push 0xbb8
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x423418
push 3
push str.SetNotify
push str.OPTIONS
mov dword [0x4241c4], eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
je 0x407eaf
cmp eax, 3
jne 0x407e9a
push 0x423418
push 0x418924
push str.SetNotify
push str.OPTIONS
call esi
push 0x4241b0
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
je 0x408253
mov dword [0x4241bc], 7
call fcn.00402f60
call fcn.00407200
call fcn.00407140
call fcn.004070e0
push 0
push 0x3e8
push 1
push dword [0x42456c]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00407000
push 0x423418
push 0
push 0x4194b0
push str.OPTIONS
call edi
test eax, eax
jne 0x408014
push 0x7fe
push eax
mov word [esp + 0x878], ax
lea eax, [esp + 0x87a]
push eax
call fcn.004091f0
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x84], ax
lea eax, [esp + 0x86]
push eax
call fcn.004091f0
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x1298], ax
lea eax, [esp + 0x129a]
push eax
call fcn.004091f0
add esp, 0x24
lea eax, [esp + 0x18]
push 0
push 0
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
push 0x400
lea eax, [esp + 0x1290]
push eax
push 0x4194b8
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push dword [esp + 0x14]
lea eax, [esp + 0x874]
push 0x4194c0
push 0x400
push eax
call fcn.00408280
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x80]
add esp, 0x10
push 0x423418
push 0x400
push eax
push 0x4188b4
push str.Trash
push str.SYSFILES
call ebx
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x874]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x40801a
push 0x423418
push 0x4188b4
push str.Temp
push str.SYSFILES
call esi
push 0x423418
lea eax, [esp + 0x874]
push eax
push str.Trash
push str.SYSFILES
call esi
jmp 0x40801a
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push str.rvsmr
call fcn.00404530
add esp, 8
test eax, eax
je 0x408088
push 0x423418
push str.37474384
push str.Data
push str.OPTIONS
call esi
push 0
push 0x4072c0
push dword [0x42456c]
push str.DLGG
push dword [0x4241ac]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x4081a5
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 1
push dword [0x42456c]
call esi
push 2
push dword [0x42456c]
call esi
jmp 0x4081af
xor eax, eax
push 0x98
push eax
mov word [esp + 0x78], ax
lea eax, [esp + 0x7a]
push eax
call fcn.004091f0
add esp, 0xc
lea eax, [esp + 0x70]
push 0x423418
push 0x4d
push eax
push 0x4188b4
push str.Temp
push str.SYSFILES
call ebx
test eax, eax
je 0x408043
mov ax, word [esp + 0x70]
lea ecx, [esp + 0x70]
test ax, ax
je 0x4080e8
movzx edx, ax
xor edx, 1
lea ecx, [ecx + 2]
mov word [ecx - 2], dx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x4080d4
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x70]
push eax
call esi
cmp eax, 0x14
jl 0x408043
xor eax, eax
push 0x206
push eax
mov word [esp + 0x878], ax
lea eax, [esp + 0x87a]
push eax
call fcn.004091f0
add esp, 0xc
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x874]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x70]
push eax
call esi
sub eax, 0x10
lea esi, [eax + eax]
lea eax, [esp + 0x70]
add eax, esi
push eax
call fcn.00405c00
add esp, 4
mov ebx, eax
cmp esi, 0x208
jae 0x40825c
xor eax, eax
mov word [esp + esi + 0x870], ax
lea eax, [esp + 0x870]
push eax
call fcn.0040b10e
add esp, 4
cmp ebx, eax
jne 0x408043
push 0x418924
push str.rvsmr
mov dword [0x42404c], 1
call fcn.004078b0
add esp, 8
mov dword [0x424150], 1
jmp 0x4081af
mov dword [0x42404c], 1
push 0x423418
push 0
push str.RamStart
push str.OPTIONS
call edi
test eax, eax
je 0x4081d4
push dword [0x42456c]
call fcn.00403f70
add esp, 4
call fcn.00405e80
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x24]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x408234
mov ebp, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x2c]
call ebp
test eax, eax
jne 0x408223
lea eax, [esp + 0x24]
push eax
call edi
lea eax, [esp + 0x24]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
call esi
test eax, eax
jne 0x408202
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1a78]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004082ae
add esp, 0x1a6c
ret 0x10
xor eax, eax
jmp 0x408238
call fcn.004083df
call fcn.004083df
int3