Function at 0x407c00
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
mov dword [esp], 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
add eax, 1
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x407dee
mov ebp, eax
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
xor edi, edi
mov dword [esp + 4], ebp
jmp 0x407c5b
add edi, 1
test ebp, ebp
je 0x407dd9
cmp byte [ebp], 0
je 0x407dd9
mov esi, ebp
push 0x2c
push ebp
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
mov dword [esp], eax
xor ebx, ebx
mov ebp, 0
test eax, eax
je 0x407c88
mov byte [eax], 0
add eax, 1
mov ebp, eax
push 0x3d
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
test eax, eax
je 0x407c9f
mov byte [eax], 0
add eax, 1
mov ebx, eax
push str.device
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x407d20
push str.size
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x407d70
push str.fast_commit_size
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x407d90
push str.location
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x407dbe
push str.v1_superblock
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x407c50
mov eax, dword [0x48e234]
or byte [eax], 1
jmp 0x407c53
push 0
push ebx
push 0
call fcn.0040dd60
add esp, 0xc
mov ecx, dword [0x48e22c]
mov dword [ecx], eax
test eax, eax
jne 0x407c53
test ebx, ebx
je 0x407c50
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push ebx
push str._nCould_not_find_journal_device_matching__s_n
push eax
call fcn.00407be0
add esp, 0xc
jmp 0x407c50
test ebx, ebx
je 0x407c50
push 0
lea eax, [esp + 4]
push eax
push ebx
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov ecx, dword [0x48e238]
jmp 0x407dae
test ebx, ebx
je 0x407c50
push 0
lea eax, [esp + 4]
push eax
push ebx
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov ecx, dword [0x48e230]
mov dword [ecx], eax
mov eax, dword [esp]
cmp byte [eax], 1
sbb edi, 0xffffffff
jmp 0x407c53
test ebx, ebx
je 0x407c50
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
add esp, 4
mov dword [0x4b73a4], eax
jmp 0x407c53
test edi, edi
jne 0x407e12
push dword [esp + 4]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x33
push str.Couldnt_allocate_memory_to_parse_journal_options__n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x14a
push str._nBad_journal_options_specified._n_nJournal_options_are_separated_by_commas__and_may_take_an_argument_which_n_tis_set_off_by_an_equals____sign._n_nValid_journal_options_are:_n_tsize_journal_size_in_megabytes__n_tdevice_journal_device__n_tlocation_journal_location__n_nThe_journal_size_must_be_between_1024_and_10240000_filesystem_blocks._n_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push dword [esp + 4]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]
nop