Function at 0x43b050
Capabilities:
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xec
mov esi, dword [esp + 0x100]
mov eax, dword [esp + 0x100]
mov dword [esp + 0x58], 0
mov ebp, dword [esi + 4]
mov eax, dword [eax]
test ebp, ebp
je 0x43b096
mov esi, dword [eax + 0x6c]
lea edx, [esi - 2]
mov esi, dword [esp + 0x100]
xor edx, dword [esi + 0x10]
or edx, dword [esi + 0x14]
sete dl
movzx edx, dl
mov dword [esp + 0x58], edx
movzx ecx, byte [eax + 0x28]
mov eax, 0x10
lea esi, [esp + 0x80]
mov dword [esp], 0
mov dword [esp + 8], esi
lea edx, [esp + 0xb0]
cmp cl, 0x10
mov dword [esp + 0x94], edx
mov dword [esp + 0x88], 0
cmovb ecx, eax
mov eax, 1
mov dword [esp + 0x8c], 0
mov dword [esp + 0x98], 0x435c70
shl eax, cl
mov dword [esp + 4], eax
mov dword [esp + 0x9c], 0x435800
mov dword [esp + 0xa0], 0x435ad0
mov dword [esp + 0xa4], 0x435aa0
mov dword [esp + 0xa8], 0x435510
mov dword [esp + 0xac], 0x435a60
mov dword [esp + 0x80], 0
mov dword [esp + 0x78], eax
mov dword [esp + 0x84], 0
call fcn.00427280
mov edi, edx
mov dword [esp + 0x50], eax
or edi, eax
mov dword [esp + 0x54], edx
je 0x43b210
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0041d490
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
mov esi, eax
call ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x5390a0
mov dword [esp + 4], 0x53ac78
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x80]
test eax, eax
je 0x43b1f6
lea ebx, [esp + 0x80]
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.0041d440
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
add esp, 0xec
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x108]
xor edx, edx
mov ebp, dword [esp + 0x50]
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
shld edx, eax, 5
shl eax, 5
mov byte [esp + 0x4b], 0
mov ebx, ebp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x5c], 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x74], 0
mov dword [esp + 0x4c], 0
nop
lea esi, [esi]
mov eax, dword [esp + 0x68]
mov edx, dword [esp + 0x6c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x2c]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004a0bc0
mov edi, dword [esp + 0x84]
mov esi, eax
test eax, eax
je 0x43b511
test edi, edi
je 0x43b511
add edi, dword [esp + 0x74]
mov ebp, eax
sub edi, eax
mov eax, dword [esp + 0x34]
or eax, ebx
jne 0x43b2c6
cmp edi, 0x1f
jbe 0x43bb35
mov eax, dword [esp + 0x34]
or eax, ebx
jne 0x43b9a0
lea eax, [esp + 0x88]
mov edx, dword [esp + 0x2c]
add ebp, dword [esp + 0x80]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x100]
mov dword [esp], eax
call fcn.00432810
mov ebx, edx
mov dword [esp + 0x60], eax
or ebx, eax
mov dword [esp + 0x64], edx
jne 0x43bb62
mov eax, dword [esp + 0x100]
xor esi, esi
xor edi, edi
mov ecx, dword [eax + 4]
mov ebx, dword [eax]
mov dword [esp + 0x34], ecx
test ecx, ecx
je 0x43b34b
movzx ecx, byte [ebx + 0x28]
mov eax, dword [ebx + 0x58]
xor esi, esi
mov edx, dword [ebx + 0x5c]
shld edx, eax, cl
shl eax, cl
test cl, 0x20
cmovne edx, eax
cmovne eax, esi
mov edi, edx
mov esi, eax
mov edx, dword [esp + 0x88]
mov ecx, dword [esp + 0x8c]
mov dword [esp + 0xb0], ebx
add esi, edx
mov dword [esp + 0x38], edx
lea edx, [esp + 0xb4]
adc edi, ecx
mov dword [esp + 0x3c], ecx
xor eax, eax
mov ecx, 0xb
mov dword [esp + 0x44], edi
mov edi, edx
mov edx, dword [esp + 0x2c]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
mov dword [esp], ebp
mov dword [esp + 0xc], 1
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0xc4], ecx
movzx ecx, byte [esp + 0x4b]
mov dword [esp + 0xcc], eax
mov eax, dword [esp + 0x10c]
mov dword [esp + 0xbc], edx
mov edx, dword [esp + 0x38]
mov dword [esp + 0xd4], eax
lea eax, [esp + 0x94]
mov dword [esp + 0x10], eax
xor eax, eax
test cl, cl
setne al
mov dword [esp + 0x40], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0xc0], edx
mov dword [esp + 4], eax
mov byte [esp + 0xd8], cl
call fcn.004349d0
mov ebx, eax
mov eax, edx
mov dword [esp + 0x34], edx
or eax, ebx
jne 0x43b695
mov esi, dword [esp + 0xc8]
test esi, esi
je 0x43b740
mov edx, dword [esp + 0x10c]
xor edi, edi
test edx, edx
jne 0x43b5c1
mov ebp, ebx
mov dword [esp], 2
mov ebx, dword [fcn.004a1b90]
call ebx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x18], 0x53afbf
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0x5390a0
mov dword [esp + 4], 0x53af80
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x70]
mov dword [esp + 0x60], ebp
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x80]
test eax, eax
je 0x43b4ea
lea ebx, [esp + 0x80]
mov dword [esp], eax
mov dword [esp + 4], ebx
call fcn.0041d440
mov ebx, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x60]
mov eax, ebx
or eax, esi
mov eax, dword [esp + 0x64]
cmovne edi, esi
cmovne eax, ebx
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], eax
jmp 0x43b1f6
mov eax, dword [esp + 0x5c]
or eax, dword [esp + 0x70]
je 0x43b920
mov edi, dword [esp + 0x70]
mov eax, dword [esp + 0x5c]
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0041d490
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
mov esi, eax
call ebx
mov dword [esp + 0x18], esi
mov ebp, dword [esp + 0x2c]
mov esi, edi
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x5390a0
mov dword [esp + 4], 0x53afc0
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], eax
jmp 0x43b4cc
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
call ebx
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x18], 0x53af73
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 8], 0x5390a0
mov dword [esp + 4], 0x53af80
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
cmp byte [ebp], 0
js 0x43b72d
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x110]
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [eax]
mov ebx, eax
mov eax, edx
mov dword [esp + 0x34], edx
and eax, ebx
cmp eax, 0xffffffff
je 0x43bb20
cmp byte [ebp], 0
je 0x43bb20
add dword [esp + 0x28], 0x20
adc dword [esp + 0x2c], 0
add dword [esp + 0x4c], 1
jmp 0x43b270
mov dword [esp + 4], edx
mov dword [esp], ebx
call fcn.0041d490
mov esi, dword [fcn.004a1b90]
mov dword [esp], 2
mov edi, eax
call esi
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x4c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x5390a0
mov dword [esp + 4], 0x53ada4
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call esi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call esi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov ecx, dword [esp + 0x10c]
test ecx, ecx
je 0x43bd4d
cmp byte [ebp], 0
jns 0x43b644
mov byte [esp + 0x4b], 0
jmp 0x43b644
movzx edx, byte [ebp]
test dl, dl
js 0x43b8b0
mov eax, edx
and eax, 0x60
cmp al, 0x20
je 0x43b8d6
mov eax, dword [esp + 0x104]
test eax, eax
je 0x43b7b0
mov eax, dword [esp + 0x104]
mov eax, dword [eax]
test eax, eax
je 0x43b7b0
mov ecx, dword [eax]
test ecx, ecx
je 0x43b7b0
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
shrd esi, edi, 5
sar edi, 5
mov dword [esp + 0x3c], edi
mov edi, dword [ecx + 4]
mov dword [esp + 0x38], esi
cmp edi, esi
jb 0x43b7b0
add esi, 1
test dl, dl
je 0x43b7b0
cmp edi, esi
jae 0x43b7b0
test dl, dl
js 0x43bc92
mov dword [ecx + 4], esi
nop
lea esi, [esi]
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x110]
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [eax]
mov esi, eax
mov eax, edx
mov edi, edx
and eax, esi
cmp eax, 0xffffffff
je 0x43bb20
mov eax, edx
or eax, esi
je 0x43bd98
xor eax, eax
mov dword [esp], esi
cmp eax, esi
mov dword [esp + 4], edx
sbb eax, edx
jge 0x43b8e3
call fcn.0041d490
mov edx, dword [fcn.004a1b90]
mov dword [esp], 2
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], edx
call edx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x5390a0
mov dword [esp + 0x10], ecx
mov dword [esp + 4], 0x53af24
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov edx, dword [esp + 0x38]
mov dword [esp], 2
call edx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov edx, dword [esp + 0x38]
mov dword [esp], 2
call edx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x10c]
test eax, eax
jne 0x43b677
mov eax, dword [esp + 0x70]
mov dword [esp + 0x60], esi
mov dword [esp + 0x64], edi
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x54], eax
jmp 0x43b4cc
test dl, 0x40
je 0x43b9e2
movzx eax, byte [esp + 0x4b]
test al, al
je 0x43bd54
sub eax, 1
mov byte [esp + 0x4b], al
cmp dl, 0x85
jne 0x43b74c
movzx eax, byte [ebp + 1]
mov byte [esp + 0x4b], al
jmp 0x43b759
call fcn.0041d490
mov edx, dword [fcn.004a1b90]
mov dword [esp], 2
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], edx
call edx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x5390a0
mov dword [esp + 0x10], ecx
mov dword [esp + 4], 0x53af4c
jmp 0x43b836
lea eax, [esp + 0x84]
mov edx, dword [esp + 0x2c]
mov ebp, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x78]
sub eax, esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
add eax, esi
mov dword [esp + 4], eax
mov eax, dword [esp + 0x100]
mov dword [esp], eax
call fcn.00432f20
mov edi, eax
mov eax, edx
or eax, edi
je 0x43b9c1
mov ebx, dword [esp + 0x84]
test ebx, ebx
jne 0x43ba94
mov eax, dword [esp + 0x70]
mov dword [esp + 0x70], edi
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x5c], edx
mov dword [esp + 0x54], eax
jmp 0x43b51f
mov eax, dword [esp + 0x70]
mov dword [esp + 0x70], ebx
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x5c], eax
jmp 0x43b51f
mov dword [esp + 0x70], edi
mov dword [esp + 0x5c], edx
mov edi, dword [esp + 0x84]
cmp edi, 0x1f
jbe 0x43bb35
mov dword [esp + 0x74], esi
jmp 0x43b2d2
cmp byte [esp + 0x4b], 0
je 0x43b8cd
mov dword [esp], 2
mov ebx, dword [fcn.004a1b90]
call ebx
movzx edx, byte [esp + 0x4b]
mov dword [esp + 0x14], str.exfat_dir_list_raw
mov dword [esp + 0x10], 0xae4
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], 0x5395a5
mov dword [esp + 8], 0x5395ab
mov dword [esp + 4], str.__s___s:_d___s__Internal_error:_Remaining_secondary_entries_not_zero_at_start_of_primary_directory_entry__Remaining_secondary_entries:__u
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x70]
mov dword [esp + 0x60], 6
mov dword [esp + 0x64], 0
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x54], eax
jmp 0x43b4cc
mov ecx, dword [fcn.004a1b90]
mov dword [esp + 0x38], edx
mov dword [esp], 2
mov dword [esp + 0x34], ecx
call ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x53a805
mov dword [esp + 4], 0x53acb0
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov ecx, dword [esp + 0x34]
mov dword [esp], 2
call ecx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov ecx, dword [esp + 0x34]
mov dword [esp], 2
call ecx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov edx, dword [esp + 0x38]
mov dword [esp + 0x70], edi
mov dword [esp + 0x5c], edx
jmp 0x43b9c9
mov eax, dword [esp + 0x70]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x54], eax
jmp 0x43b4cc
test edi, edi
jne 0x43bc00
mov eax, dword [esp + 0x50]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x54], eax
jmp 0x43b4cc
mov dword [esp + 4], edx
mov edi, eax
mov dword [esp], eax
call fcn.0041d490
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
mov esi, eax
call ebx
mov dword [esp + 0x14], edi
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x5390a0
mov dword [esp + 4], 0x53ad60
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x70]
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x54], eax
jmp 0x43b4cc
mov ebx, dword [fcn.004a1b90]
mov dword [esp], 2
call ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], 0x5390a0
mov dword [esp + 4], str.__s__Internal_error:_Not_enough_bytes_left_in_buffer_for_a_complete_EXFAT_DIR_SLOT._Need:__Iu_bytes__Have:__Iu_bytes
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call ebx
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call ebx
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x70]
mov dword [esp + 0x60], 5
mov dword [esp + 0x64], 0
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x54], eax
jmp 0x43b4cc
mov edx, dword [esp + 0x38]
mov ecx, 1
call fcn.004396c0
mov esi, eax
mov eax, edx
or eax, esi
je 0x43b7b0
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.0041d490
mov edi, dword [fcn.004a1b90]
mov dword [esp], 2
mov dword [esp + 0x7c], eax
call edi
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x14], esi
mov esi, dword [esp + 0x38]
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], esi
mov dword [esp + 8], 0x53a805
mov dword [esp + 4], 0x53aee4
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov dword [esp], 2
call edi
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x5390da
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call edi
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [esp + 0x104]
mov dword [esp], eax
call fcn.00439bb0
jmp 0x43b7b0
mov ebp, ebx
jmp 0x43b4b0
mov dword [esp], 2
mov ebx, dword [fcn.004a1b90]
call ebx
mov dword [esp + 0x14], str.exfat_dir_list_raw
mov dword [esp + 0x10], 0xad8
mov dword [esp + 0xc], 0x5395a5
mov dword [esp + 8], 0x5395ab
mov dword [esp + 4], str.__s___s:_d___s__Internal_error:_Got_secondary_entry_but_remaining_secondary_is_0._This_should_have_been_caught_in_validation.
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x43ba35
mov ebx, esi
mov dword [esp + 0x34], edx
jmp 0x43b677