Function at 0x407d80
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
mov dword [esp], 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
inc eax
push eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
test eax, eax
je 0x407f5e
mov ebp, eax
push esi
push eax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
xor edi, edi
mov dword [esp + 4], ebp
jmp 0x407dd9
inc edi
test ebp, ebp
je 0x407f49
cmp byte [ebp], 0
je 0x407f49
mov esi, ebp
push 0x2c
push ebp
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
mov dword [esp], eax
xor ebx, ebx
mov ebp, 0
test eax, eax
je 0x407e04
mov byte [eax], 0
inc eax
mov ebp, eax
push 0x3d
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
test eax, eax
je 0x407e19
mov byte [eax], 0
inc eax
mov ebx, eax
push str.device
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x407e90
push str.size
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x407ee0
push str.fast_commit_size
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x407f00
push str.location
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
je 0x407f2e
push str.v1_superblock
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x407dd0
mov eax, dword [0x48b2e4]
or byte [eax], 1
jmp 0x407dd1
push 0
push ebx
push 0
call fcn.0040a2d0
add esp, 0xc
mov ecx, dword [0x48b2dc]
mov dword [ecx], eax
test eax, eax
jne 0x407dd1
test ebx, ebx
je 0x407dd0
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push ebx
push str._nCould_not_find_journal_device_matching__s_n
push eax
call fcn.00407d60
add esp, 0xc
jmp 0x407dd0
test ebx, ebx
je 0x407dd0
push 0
lea eax, [esp + 4]
push eax
push ebx
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov ecx, dword [0x48b2e8]
jmp 0x407f1e
test ebx, ebx
je 0x407dd0
push 0
lea eax, [esp + 4]
push eax
push ebx
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov ecx, dword [0x48b2e0]
mov dword [ecx], eax
mov eax, dword [esp]
cmp byte [eax], 1
sbb edi, 0xffffffff
jmp 0x407dd1
test ebx, ebx
je 0x407dd0
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
add esp, 4
mov dword [0x4b3334], eax
jmp 0x407dd1
test edi, edi
jne 0x407f82
push dword [esp + 4]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x33
push str.Couldnt_allocate_memory_to_parse_journal_options__n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
push 1
push 0x14a
push str._nBad_journal_options_specified._n_nJournal_options_are_separated_by_commas__and_may_take_an_argument_which_n_tis_set_off_by_an_equals____sign._n_nValid_journal_options_are:_n_tsize_journal_size_in_megabytes__n_tdevice_journal_device__n_tlocation_journal_location__n_nThe_journal_size_must_be_between_1024_and_10240000_filesystem_blocks._n_n
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
push dword [esp + 4]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
push 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop word cs:[eax + eax]