Function at 0x40b690
Capabilities:
Check for time delay via gettickcount
Check os version
Clear file content
Delete file
Get memory capacity
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Read file via mapping
Set console window title
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1940
call fcn.00408bf0
mov eax, dword [0x413284]
xor eax, ebp
mov dword [ebp - 0x74], eax
xor eax, eax
mov word [ebp - 0x4c0], ax
push 0x206
push 0
lea ecx, [ebp - 0x4be]
push ecx
call fcn.00401c50
add esp, 0xc
xor edx, edx
mov word [ebp - 0x2a8], dx
push 0x206
push 0
lea eax, [ebp - 0x2a6]
push eax
call fcn.00401c50
add esp, 0xc
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x4c8], 0xffffffff
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2ac], 0x1000
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x8c], 0x10
mov ecx, dword [str.0123456789abcdef]
mov dword [ebp - 0x88], ecx
mov edx, dword [0x41170c]
mov dword [ebp - 0x84], edx
mov eax, dword [0x411710]
mov dword [ebp - 0x80], eax
mov ecx, dword [0x411714]
mov dword [ebp - 0x7c], ecx
mov dl, byte [0x411718]
mov byte [ebp - 0x78], dl
cmp dword [ebp - 0x1c], 0
jne 0x40b7af
push str.____mdd_n
call fcn.00401b8b
add esp, 4
push str.____ManTech_Physical_Memory_Dump_Utility_n
call fcn.00401b8b
add esp, 4
push str.____Copyright__C__2008_ManTech_Security__Mission_Assurance_n_n
call fcn.00401b8b
add esp, 4
push str.____This_program_comes_with_ABSOLUTELY_NO_WARRANTY__for_details_use_option___w_n
call fcn.00401b8b
add esp, 4
push str.____This_is_free_software__and_you_are_welcome_to_redistribute_it_n
call fcn.00401b8b
add esp, 4
push str.____under_certain_conditions__use_option___c_for_details._n_n
call fcn.00401b8b
add esp, 4
push 0x114
push 0
push 0x414c98
call fcn.00401c50
add esp, 0xc
mov dword [0x414c98], 0x114
push 0x414c98
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
jne 0x40b802
push str.____ERROR:_Process_must_be_run_with_Administrator_privileges_n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 8
jmp 0x40c0d4
cmp dword [0x414c9c], 5
sbb eax, eax
add eax, 1
mov dword [ebp - 0x18], eax
jne 0x40b833
push str.____ERROR:_This_tool_requires_Windows_2000_or_later_n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 8
jmp 0x40c0d4
push str.qchwvo:
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040cb00
add esp, 0xc
mov byte [ebp - 0x4c1], al
movsx eax, byte [ebp - 0x4c1]
test eax, eax
jl 0x40b960
movsx ecx, byte [ebp - 0x4c1]
mov dword [ebp - 0x18f8], ecx
mov edx, dword [ebp - 0x18f8]
sub edx, 0x63
mov dword [ebp - 0x18f8], edx
cmp dword [ebp - 0x18f8], 0x14
ja case.0x40b893.1
mov eax, dword [ebp - 0x18f8]
movzx ecx, byte [eax + 0x40c144]
jmp dword [ecx*4 + 0x40c12c]
mov dword [ebp - 0x1c], 1
jmp 0x40b95b
push str._n____Redistribution_n
call fcn.00401b8b
add esp, 4
push str.____Please_visit_http:__www.gnu.org_licenses_gpl.html_sections_2_through_7_n
call fcn.00401b8b
add esp, 4
jmp 0x40c0d4
push str._n____Warranty_n
call fcn.00401b8b
add esp, 4
push str.____Please_visit_http:__www.gnu.org_licenses_gpl.html_sections_15_and_16_n
call fcn.00401b8b
add esp, 4
jmp 0x40c0d4
push 0x104
lea edx, [ebp - 0x4c0]
push edx
push 0xffffffffffffffff
mov eax, dword [0x414dac]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x40b93e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____ERROR:_invalid_output_filename___u__n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 0xc
jmp 0x40c0d4
jmp 0x40b95b
mov dword [ebp - 0x2b4], 1
jmp 0x40b95b
call fcn.0040adf0
jmp 0x40c0d4
jmp 0x40b833
movzx ecx, word [ebp - 0x4c0]
test ecx, ecx
jne 0x40b98b
push str.____ERROR:_must_specify_output_filename__use__h_for_usage_n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 8
jmp 0x40c0d4
push 0xf0000020
push 1
push 0
push 0
lea edx, [ebp - 0x6c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x40b9cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____ERROR:_CryptAcquireContext_failed___u__n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 0xc
jmp 0x40c0d4
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0x8003
mov ecx, dword [ebp - 0x6c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40ba0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____ERROR:_CryptCreateHash_failed___u__n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 0xc
jmp 0x40c0d4
lea edx, [ebp - 0x64]
push edx
call fcn.0040b3a0
add esp, 4
test eax, eax
jne 0x40ba3d
push str.____ERROR:_Failed_to_open_PhysicalMemory_section__n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 8
jmp 0x40c0d4
push 0
push 0
push 2
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x4c0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x4c8], eax
cmp dword [ebp - 0x4c8], 0xffffffff
jne 0x40ba96
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x4c0]
push ecx
push str.____ERROR:_Failed_to_open_dump_file___s_____u__n_n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 0x10
jmp 0x40c0d4
mov dword [ebp - 0x60], 0x40
lea edx, [ebp - 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
jne 0x40bad2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____ERROR:_GlobalMemoryStatusEx_failed___u_n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 0xc
jmp 0x40c0d4
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0xc], ecx
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x4c8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
mov edx, dword [ebp - 0x4c8]
push edx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x40bb4c
push str.____ERROR:_Not_enough_room_to_store_memory_dump_n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 8
mov eax, dword [ebp - 0x4c8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x4c8], 0xffffffff
lea ecx, [ebp - 0x4c0]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40c0d4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x4c8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
cmp dword [ebp - 0x1c], 0
jne 0x40bc00
lea edx, [ebp - 0x4c0]
push edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x1900], eax
mov dword [ebp - 0x18fc], ecx
mov edx, dword [ebp - 0x18fc]
mov dword [ebp - 0x1904], edx
and dword [ebp - 0x18fc], 0x7fffffff
fild qword [ebp - 0x1900]
and dword [ebp - 0x1904], 0x80000000
mov dword [ebp - 0x1908], 0
fild qword [ebp - 0x1908]
fchs
faddp st(1)
fdiv qword [0x411e08]
fdiv qword [0x411e08]
sub esp, 8
fstp qword [esp]
push str.____Dumping__.2f_MB_of_physical_memory_to_file__S._n
call fcn.00401b8b
add esp, 0x10
call fcn.0040120b
add eax, 0x20
push eax
call fcn.00401b2f
add esp, 4
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x70], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x4d0], 0
mov dword [ebp - 0x4cc], 0
jmp 0x40bc5e
mov eax, dword [ebp - 0x4d0]
add eax, 0x1000
mov ecx, dword [ebp - 0x4cc]
adc ecx, 0
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4cc], ecx
mov edx, dword [ebp - 0x4cc]
cmp edx, dword [ebp - 0x54]
ja 0x40bf5a
jb 0x40bc7e
mov eax, dword [ebp - 0x4d0]
cmp eax, dword [ebp - 0x58]
jae 0x40bf5a
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp - 0x4d8], ecx
mov byte [ebp - 0x14e8], 0
push 0xfff
push 0
lea edx, [ebp - 0x14e7]
push edx
call fcn.00401c50
add esp, 0xc
mov eax, dword [ebp - 0x4d8]
xor ecx, ecx
add eax, dword [ebp - 0x4d0]
mov edx, dword [ebp - 0x4cc]
adc edx, ecx
mov dword [ebp - 0x1910], eax
mov dword [ebp - 0x190c], edx
mov eax, dword [ebp - 0x190c]
cmp eax, dword [ebp - 0x54]
jb 0x40bcf9
ja 0x40bce1
mov ecx, dword [ebp - 0x1910]
cmp ecx, dword [ebp - 0x58]
jbe 0x40bcf9
mov edx, dword [ebp - 0x58]
sub edx, dword [ebp - 0x4d0]
mov eax, dword [ebp - 0x54]
sbb eax, dword [ebp - 0x4cc]
mov dword [ebp - 0x4d8], edx
mov ecx, dword [ebp - 0x4d0]
mov dword [ebp - 0x4e8], ecx
mov edx, dword [ebp - 0x4cc]
mov dword [ebp - 0x4e4], edx
mov eax, dword [ebp - 0x4d8]
push eax
mov ecx, dword [ebp - 0x4e8]
push ecx
mov edx, dword [ebp - 0x4e4]
push edx
push 4
mov eax, dword [ebp - 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x40bd77
cmp dword [ebp - 0x2b4], 0
je 0x40bd6c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp - 0x4e8]
push ecx
mov edx, dword [ebp - 0x4e4]
push edx
push str.____WARNING:_Failed_to_map_at_offset__.8x__.8x___d_n
call fcn.00401b8b
add esp, 0x10
mov eax, dword [ebp - 0x70]
add eax, 1
mov dword [ebp - 0x70], eax
jmp 0x40bd9d
mov ecx, dword [ebp - 0x4d8]
push ecx
mov edx, dword [ebp - 0x4dc]
push edx
lea eax, [ebp - 0x14e8]
push eax
call fcn.00401640
add esp, 0xc
mov ecx, dword [ebp - 0x68]
add ecx, 1
mov dword [ebp - 0x68], ecx
push 0
lea edx, [ebp - 0x14ec]
push edx
mov eax, dword [ebp - 0x4d8]
push eax
lea ecx, [ebp - 0x14e8]
push ecx
mov edx, dword [ebp - 0x4c8]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x4d4], eax
push 0
mov eax, dword [ebp - 0x4d8]
push eax
lea ecx, [ebp - 0x14e8]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40be0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____ERROR:_CryptHashData_failed___u__n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 0xc
jmp 0x40c0d4
cmp dword [ebp - 0x4dc], 0
je 0x40be22
mov eax, dword [ebp - 0x4dc]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x4d4], 0
jne 0x40be52
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____ERROR:_WriteFile_failed___u_n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 0xc
jmp 0x40c0d4
cmp dword [ebp - 0x1c], 0
jne 0x40bf55
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x2b8]
cmp ecx, 0x1388
jbe 0x40bf55
mov edx, dword [ebp - 4]
mov dword [ebp - 0x2b8], edx
mov eax, dword [ebp - 0x4d0]
mov ecx, dword [ebp - 0x4cc]
mov dword [ebp - 0x1918], eax
mov dword [ebp - 0x1914], ecx
mov edx, dword [ebp - 0x1914]
mov dword [ebp - 0x191c], edx
and dword [ebp - 0x1914], 0x7fffffff
fild qword [ebp - 0x1918]
and dword [ebp - 0x191c], 0x80000000
mov dword [ebp - 0x1920], 0
fild qword [ebp - 0x1920]
fchs
faddp st(1)
fmul qword [0x411e00]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x1928], eax
mov dword [ebp - 0x1924], ecx
mov edx, dword [ebp - 0x1924]
mov dword [ebp - 0x192c], edx
and dword [ebp - 0x1924], 0x7fffffff
fild qword [ebp - 0x1928]
and dword [ebp - 0x192c], 0x80000000
mov dword [ebp - 0x1930], 0
fild qword [ebp - 0x1930]
fchs
faddp st(1)
fdivp st(1)
sub esp, 8
fstp qword [esp]
push str.mdd____3.2f___complete
push 0x400
lea eax, [ebp - 0x18f0]
push eax
call fcn.00401000
add esp, 0x14
lea ecx, [ebp - 0x18f0]
push ecx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
jmp 0x40bc3e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x2b0], eax
push str.mdd___dump_complete
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0
lea edx, [ebp - 0x8c]
push edx
lea eax, [ebp - 0x9c]
push eax
push 2
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x40bfb8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.____ERROR:_CryptGetHashParam_failed___u__n
call fcn.0040120b
add eax, 0x40
push eax
call fcn.0040148e
add esp, 0xc
jmp 0x40c0d4
cmp dword [ebp - 0x1c], 0
jne 0x40c0d4
push 0x411c50
call fcn.00401b8b
add esp, 4
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0x1938], edx
mov dword [ebp - 0x1934], 0
fild qword [ebp - 0x1938]
mov eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x1940], eax
mov dword [ebp - 0x193c], 0
fild qword [ebp - 0x1940]
fdivp st(1)
sub esp, 8
fstp qword [esp]
mov ecx, dword [ebp - 0x68]
push ecx
push str.__u_map_operations_succeeded___3.2f__n
call fcn.00401b8b
add esp, 0x10
mov edx, dword [ebp - 0x70]
push edx
push str.__u_map_operations_failed_n_n
call fcn.00401b8b
add esp, 8
mov eax, dword [ebp - 0x2b0]
sub eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, 0x3e8
div ecx
push eax
push str._took__u_seconds_to_write_n
call fcn.00401b8b
add esp, 8
push str._MD5_is:
call fcn.00401b8b
add esp, 4
mov dword [ebp - 0x18f4], 0
jmp 0x40c076
mov edx, dword [ebp - 0x18f4]
add edx, 1
mov dword [ebp - 0x18f4], edx
mov eax, dword [ebp - 0x18f4]
cmp eax, dword [ebp - 0x8c]
jae 0x40c0c7
mov ecx, dword [ebp - 0x18f4]
movzx edx, byte [ebp + ecx - 0x9c]
and edx, 0xf
movsx eax, byte [ebp + edx - 0x88]
push eax
mov ecx, dword [ebp - 0x18f4]
movzx edx, byte [ebp + ecx - 0x9c]
sar edx, 4
movsx eax, byte [ebp + edx - 0x88]
push eax
push str._c_c
call fcn.00401b8b
add esp, 0xc
jmp 0x40c067
push 0x411cc8
call fcn.00401b8b
add esp, 4
cmp dword [ebp - 0x20], 0
je 0x40c0e4
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x6c], 0
je 0x40c0f6
push 0
mov edx, dword [ebp - 0x6c]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x4c8], 0xffffffff
je 0x40c10c
mov eax, dword [ebp - 0x4c8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x64], 0
je 0x40c11c
mov ecx, dword [ebp - 0x64]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0x74]
xor ecx, ebp
call fcn.004010b1
mov esp, ebp
pop ebp
ret