Function at 0x407b50
Capabilities:
Copy file
Create directory
Encode data using xor
Get common file path
Get disk information
Get memory capacity
Hide graphical window
Read .ini file

Disassembly:
mov eax, 0x1a84
call fcn.00408920
mov eax, dword [0x422c40]
xor eax, esp
mov dword [esp + 0x1a80], eax
mov eax, dword [esp + 0x1a88]
push ebx
mov dword [esp + 4], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x40
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.004094f0
movups xmm0, xmmword [esp + 0x24]
add esp, 0xc
movups xmmword [0x424258], xmm0
mov dword [0x424258], 0x40
movups xmm0, xmmword [esp + 0x28]
push 0x424258
movups xmmword [0x424268], xmm0
movups xmm0, xmmword [esp + 0x3c]
movups xmmword [0x424278], xmm0
movups xmm0, xmmword [esp + 0x4c]
movups xmmword [0x424288], xmm0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push str.ProgMan
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push str.SHELLDLL_DefView
push 0
push eax
call ebx
push 0
push str.SysListView32
push 0
push eax
call ebx
push 0x104
push 0x423418
push 0
mov dword [0x4248b0], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0
push 0x423418
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
sub eax, 0x423418
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x408565
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
xor ecx, ecx
push esi
push edi
push 0x423418
push 0x423e40
mov word [eax + 0x423418], cx
call ebp
push 0x423418
push 0x423828
call ebp
push 0x423418
push 0x423a30
call ebp
push 0x423418
push 0x423c38
call ebp
push 0x423418
push 0x423620
call ebp
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.Langdefault.lng
push 0x423620
call esi
push str._ramsaverpro.ini
push 0x423418
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x423418
push 0x418954
push str.TEST
push str.TEST
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x423418
push 0
push str.TEST
push str.TEST
call edi
test eax, eax
je 0x407cf4
push 0x423418
push 0x418934
push str.TEST
push str.TEST
call ebx
jmp 0x407db6
xor eax, eax
push 0x206
push eax
mov word [esp + 0x90], ax
lea eax, [esp + 0x92]
push eax
call fcn.004094f0
add esp, 0xc
lea eax, [esp + 0x88]
push eax
push 0
push 0
push 0x801a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x407db6
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x88]
push str.WinTools
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [esp + 0x88]
push 0
push eax
call esi
push str.RAMSaverPro
lea eax, [esp + 0x8c]
push eax
call edi
push 0
lea eax, [esp + 0x8c]
push eax
call esi
push str._ramsaverpro.ini
lea eax, [esp + 0x8c]
push eax
call edi
push 1
lea eax, [esp + 0x8c]
push eax
push 0x423418
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [esp + 0x88]
push eax
push 0x423418
call ebp
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push str._ramsaverpro.exe
push 0x423828
call esi
push str._ramsavercp.exe
push 0x423a30
call esi
push str.help_
push 0x423c38
call esi
push 0x423620
push 0x104
lea eax, [esp + 0x1090]
push eax
push 0
push 0x4189f4
push str.LANGUAGE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x1088]
push eax
push 0x423c38
call esi
push 0x423418
push 0
push str.Noicons
push str.OPTIONS
call edi
test eax, eax
jne 0x407e28
push 5
jmp 0x407e2a
push 0
push dword [0x4248b0]
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00404860
push 0x423418
push 0
push str.TrayIconView
push str.Options
call edi
push 0x41910c
mov dword [0x424048], eax
call fcn.004046d0
add esp, 4
push eax
push 0x424050
call ebp
mov eax, dword [esp + 0x10]
xorps xmm0, xmm0
push 0x7f00
push 0
mov dword [0x4242ac], eax
movlpd qword [esp + 0x34], xmm0
mov dword [esp + 0x40], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x2c], 0xb
mov dword [esp + 0x30], 0x404aa0
mov dword [esp + 0x3c], eax
mov dword [esp + 0x48], 6
mov dword [esp + 0x50], str.RamSaverProWndClass
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x408561
push 0
push str.RamSaverProWndClass
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x407efc
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.RamSaverProWndClass
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
jne 0x408561
push 0x2710
push dword [0x4242ac]
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
push 0
push dword [0x4242ac]
mov dword [esp + 0x28], eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0x16cf0000
push str.RamSaverPro
push str.RamSaverProWndClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x42466c], eax
test eax, eax
je 0x408561
push 0x423418
push 0
push 0x418a04
push str.Options
call edi
mov dword [0x424254], eax
cmp eax, 2
jne 0x40802a
push 0x40
lea eax, [esp + 0x28]
push 0
push eax
call fcn.004094f0
movups xmm0, xmmword [esp + 0x30]
add esp, 0xc
movups xmmword [0x424258], xmm0
mov dword [0x424258], 0x40
movups xmm0, xmmword [esp + 0x34]
push 0x424258
movups xmmword [0x424268], xmm0
movups xmm0, xmmword [esp + 0x48]
movups xmmword [0x424278], xmm0
movups xmm0, xmmword [esp + 0x58]
movups xmmword [0x424288], xmm0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp dword [0x424264], 0
ja 0x40800a
cmp dword [0x424260], 0x3fef2000
jae 0x40800a
push 0x423418
mov dword [0x424254], 0
push 0x418934
jmp 0x40801e
push 0x423418
mov dword [0x424254], 1
push 0x418954
push 0x418a04
push str.OPTIONS
call ebx
push 0x3b8
push 0
push 0x4242b4
call fcn.004094f0
push str.RAM_Saver_Pro
push 0x419130
push 0x64
push 0x4242c8
mov dword [0x4242b0], 0x3bc
call fcn.00408580
mov eax, 0x64
mov ebx, 0x34ca257d
sub eax, dword [0x42425c]
mov ebp, 0x802c0f25
mov dword [esp + 0x30], eax
add esp, 0x1c
mov eax, dword [0x424268]
mul ebx
push 0x418a78
mov dword [esp + 0x1c], eax
mov esi, edx
mov eax, dword [0x424268]
mul ebp
push dword [esp + 0x18]
mov edi, eax
mov ebp, edx
mov eax, dword [0x42426c]
mul ebx
mov ecx, eax
mov ebx, edx
mov eax, dword [0x42426c]
mov edx, 0x802c0f25
mul edx
add ecx, esi
mov dword [esp + 0x20], eax
adc ebx, 0
add edi, ecx
mov ecx, dword [esp + 0x20]
adc ebp, 0
xor eax, eax
add ebx, ebp
adc eax, eax
add ecx, ebx
adc edx, eax
shrd ecx, edx, 0x13
push ecx
push 0x41910c
call fcn.004046d0
add esp, 4
push eax
push 0x64
push 0x4243d0
call fcn.00408580
mov eax, dword [0x42466c]
add esp, 0x18
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [0x4242b4], eax
mov dword [0x4242b8], 1
push 0
push 0x32
mov dword [0x4242bc], 0x17
mov dword [0x4242c0], 0x410
call esi
push eax
push 0x31
call esi
push eax
mov eax, dword [esp + 0x1c]
push 1
push 0xbb8
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x423418
push 3
push str.SetNotify
push str.OPTIONS
mov dword [0x4242c4], eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
je 0x408191
cmp eax, 3
jne 0x40817c
push 0x423418
push 0x418934
push str.SetNotify
push str.OPTIONS
call esi
push 0x4242b0
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
test eax, eax
je 0x408561
mov dword [0x4242bc], 7
call fcn.00403050
call fcn.00407430
call fcn.00407370
call fcn.00407310
push 0
push 0x3e8
push 1
push dword [0x42466c]
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00407220
push 0x423418
push 0
push 0x4194c4
push str.OPTIONS
call edi
test eax, eax
jne 0x4082f9
push 0x7fe
push eax
mov word [esp + 0x890], ax
lea eax, [esp + 0x892]
push eax
call fcn.004094f0
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x9c], ax
lea eax, [esp + 0x9e]
push eax
call fcn.004094f0
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x12b0], ax
lea eax, [esp + 0x12b2]
push eax
call fcn.004094f0
add esp, 0x24
lea eax, [esp + 0x18]
push 0
push 0
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
push 0x400
lea eax, [esp + 0x12a8]
push eax
push 0x4194cc
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push dword [esp + 0x14]
lea eax, [esp + 0x88c]
push 0x4194d4
push 0x400
push eax
call fcn.00408580
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x98]
add esp, 0x10
push 0x423418
push 0x400
push eax
push 0x4188c4
push str.Trash
push str.SYSFILES
call ebx
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x88c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4082ff
push 0x423418
push 0x4188c4
push str.Temp
push str.SYSFILES
call esi
push 0x423418
lea eax, [esp + 0x88c]
push eax
push str.Trash
push str.SYSFILES
call esi
jmp 0x4082ff
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push 0
push str.rvsmr
call fcn.00404750
add esp, 8
test eax, eax
je 0x40836d
push 0x423418
push str.37474384
push str.Data
push str.OPTIONS
call esi
jmp 0x408346
xor eax, eax
je 0x4084ad
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 1
push dword [0x42466c]
call esi
push 2
push dword [0x42466c]
call esi
jmp 0x4084b7
xor eax, eax
push 0x98
push eax
mov word [esp + 0x90], ax
lea eax, [esp + 0x92]
push eax
call fcn.004094f0
add esp, 0xc
lea eax, [esp + 0x88]
push 0x423418
push 0x4d
push eax
push 0x4188c4
push str.Temp
push str.SYSFILES
call ebx
test eax, eax
je 0x408328
mov ax, word [esp + 0x88]
lea ecx, [esp + 0x88]
test ax, ax
je 0x4083e4
movzx edx, ax
nop dword [eax]
xor edx, 1
lea ecx, [ecx + 2]
mov word [ecx - 2], dx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x4083d0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esp + 0x88]
push eax
call esi
cmp eax, 0x14
jl 0x408328
xor eax, eax
push 0x206
push eax
mov word [esp + 0x890], ax
lea eax, [esp + 0x892]
push eax
call fcn.004094f0
add esp, 0xc
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x88c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x88]
push eax
call esi
sub eax, 0x10
lea esi, [eax + eax]
lea eax, [esp + 0x88]
add eax, esi
push eax
call fcn.00405e20
add esp, 4
mov ebx, eax
cmp esi, 0x208
jae 0x40856a
xor eax, eax
mov word [esp + esi + 0x888], ax
lea eax, [esp + 0x888]
push eax
call fcn.0040b40e
add esp, 4
cmp ebx, eax
jne 0x408328
push 0x418934
push str.rvsmr
mov dword [0x42404c], 1
call fcn.00407ae0
add esp, 8
mov dword [0x424250], 1
jmp 0x4084b7
mov dword [0x42404c], 1
push 0x423418
push 0
push str.RamStart
push str.OPTIONS
call edi
test eax, eax
je 0x4084dc
push dword [0x42466c]
call fcn.00404130
add esp, 4
call fcn.004060a0
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x64]
push 0
push 0
push 0
push eax
call esi
test eax, eax
je 0x408542
mov ebp, dword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
nop word [eax + eax]
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x24]
push dword [esp + 0x6c]
call ebp
test eax, eax
jne 0x408531
lea eax, [esp + 0x64]
push eax
call edi
lea eax, [esp + 0x64]
push eax
call ebx
push 0
push 0
push 0
lea eax, [esp + 0x70]
push eax
call esi
test eax, eax
jne 0x408510
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x1a90]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004085ae
add esp, 0x1a84
ret 0x10
xor eax, eax
jmp 0x408546
call fcn.004086df
call fcn.004086df
int3