Function at 0x43eb60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Resolve function by parsing pe exports
Write file on windows

Disassembly:
sub esp, 0xac
mov al, byte [0x51d9c6]
mov edx, ecx
mov byte [esp + 3], al
movzx eax, byte [0x54e52a]
mov dword [esp + 0x38], edx
mov ecx, dword [eax*4 + 0x54ed40]
mov dword [esp + 0x2c], ecx
test ecx, ecx
je 0x43f06d
movzx eax, byte [0x54e52c]
imul eax, eax, 0xd8
cmp dword [eax + ecx + 0xf8], 0
je 0x43f06d
cmp dword [eax + ecx + 0x104], 0
je 0x43f06d
push ebx
push edi
lea ebx, [ecx + 0xdc]
add ebx, eax
push 0x4ddc1c
push edx
mov dword [esp + 0x38], ebx
call fcn.004891f7
mov edi, eax
add esp, 8
test edi, edi
jne 0x43ebf9
push eax
push str.General_I_O_error_during_saving__Is_the_file_in_use_
push str.System_message
push eax
call fcn.00442040
add esp, 0x10
xor al, al
pop edi
pop ebx
add esp, 0xac
ret
mov cl, byte [ebx + 0x25]
shr cl, 4
and cl, 1
cmp byte [esp + 0xb], 0
push ebp
push esi
mov byte [esp + 0x14], cl
je 0x43ec28
mov esi, dword [0x4edf3c]
mov ebp, dword [0x4edf40]
shl esi, cl
add esi, dword [ebx + 0x1c]
sub ebp, dword [0x4edf3c]
jmp 0x43ec2e
mov ebp, dword [ebx + 0x28]
mov esi, dword [ebx + 0x1c]
lea edx, [ecx + 1]
mov dword [esp + 0x4c], 0x46464952
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0x45564157
mov dword [esp + 0x58], 0x20746d66
mov dword [esp + 0x5c], 0x10
mov dword [esp + 0x60], 0x10001
movsx eax, byte [ebx + 0x19]
shl dl, 3
add eax, 0x30
mov dword [esp + 0x1c], esi
mov byte [esp + 0x12], dl
jns 0x43ec7f
movsd xmm0, qword [0x4e2bf8]
jmp 0x43ecc2
cmp eax, 0x77
jl 0x43ec8e
movsd xmm0, qword [0x4e2bf8]
jmp 0x43ecc2
movsx ecx, byte [ebx + 0x18]
inc eax
sar ecx, 3
shl eax, 4
add ecx, eax
cmp byte [0x789f67], 0
je 0x43ecae
movzx eax, word [ecx*2 + 0x4bf5f0]
jmp 0x43ecb6
movzx eax, word [ecx*2 + 0x4c0610]
movzx ecx, ax
call fcn.00432a10
mov dl, byte [esp + 0x12]
addsd xmm0, qword [0x4e2a70]
movzx eax, dl
movzx edx, dl
push edi
push 1
cvttsd2si ecx, xmm0
push 0x2c
mov word [esp + 0x7a], dx
mov dword [esp + 0x7c], 0x61746164
imul eax, ecx
mov dword [esp + 0x70], ecx
mov cl, byte [esp + 0x20]
shr eax, 3
mov dword [esp + 0x74], eax
mov ax, dx
shr ax, 3
mov word [esp + 0x78], ax
mov eax, ebp
shl eax, cl
mov dword [esp + 0x80], eax
lea eax, [esp + 0x58]
push eax
call fcn.0048a02c
push edi
call fcn.00489a43
add esp, 0x14
mov dword [esp + 0x44], eax
cmp byte [esp + 0x12], 0x10
jne 0x43ed3c
push edi
push ebp
push 2
push esi
call fcn.0048a02c
add esp, 0x10
jmp 0x43ed62
xor esi, esi
test ebp, ebp
je 0x43ed62
mov ebx, dword [esp + 0x1c]
movsx eax, byte [esi + ebx]
xor eax, 0x80
push edi
push eax
call fcn.00488db7
inc esi
add esp, 8
cmp esi, ebp
jb 0x43ed46
mov ebx, dword [esp + 0x38]
test byte [esp + 0x74], 1
je 0x43ed74
push edi
push 0
call fcn.00488db7
add esp, 8
cmp byte [esp + 0x13], 0
jne 0x43ef16
test byte [ebx + 0x25], 3
je 0x43ee57
xor edx, edx
mov dword [esp + 0x98], 0
mov eax, 0x3b9aca00
mov dword [esp + 0xb8], 0
div dword [esp + 0x64]
xorps xmm0, xmm0
mov dword [esp + 0x78], 0x6c706d73
mov dword [esp + 0x88], eax
movlpd qword [esp + 0xa8], xmm0
movlpd qword [esp + 0xb0], xmm0
movlpd qword [esp + 0x80], xmm0
movlpd qword [esp + 0x90], xmm0
movlpd qword [esp + 0xa0], xmm0
mov dword [esp + 0x7c], 0x3c
mov dword [esp + 0x8c], 0x3c
mov dword [esp + 0x9c], 1
movzx eax, byte [ebx + 0x25]
and eax, 3
dec eax
mov dword [esp + 0xa8], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp + 0xac], eax
mov ecx, dword [ebx + 0x30]
mov eax, dword [ebx + 0x2c]
dec ecx
push edi
add eax, ecx
push 1
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x80]
push 0x44
push eax
call fcn.0048a02c
add esp, 0x10
test byte [esp + 0x7c], 1
je 0x43ee57
push edi
push 0
call fcn.00488db7
add esp, 8
mov ecx, dword [esp + 0x3c]
xorps xmm0, xmm0
mov dword [esp + 0x34], 0
movlpd qword [esp + 0x2c], xmm0
mov dword [esp + 0x20], 0x61727478
mov dword [esp + 0x24], 0x10
mov dword [esp + 0x28], 0x20
movzx eax, byte [ebx + 0x26]
mov word [esp + 0x2c], ax
movzx eax, byte [ebx + 0x24]
shl ax, 2
mov word [esp + 0x2e], ax
mov eax, 0x40
mov word [esp + 0x30], ax
movzx eax, byte [ecx + 0x6d]
mov byte [esp + 0x34], al
movzx eax, byte [ecx + 0x6e]
mov byte [esp + 0x35], al
movzx eax, byte [ecx + 0x6f]
mov byte [esp + 0x36], al
movzx eax, byte [ecx + 0x70]
push edi
push 1
mov byte [esp + 0x3f], al
lea eax, [esp + 0x28]
push 0x18
push eax
call fcn.0048a02c
add esp, 0x10
test byte [esp + 0x24], 1
je 0x43eee8
push edi
push 0
call fcn.00488db7
add esp, 8
mov ebp, ebx
xor esi, esi
nop dword [eax]
cmp byte [esi + ebx], 0
je 0x43ef08
cmp byte [esi + ebx + 1], 0
je 0x43ef07
add esi, 2
cmp esi, 0x16
jb 0x43eef0
jmp 0x43ef08
inc esi
mov dword [esp + 0x18], 0x22
test esi, esi
je 0x43ef28
jmp 0x43ef20
mov ebp, str.Ranged_data_from_FT2
mov esi, 0x14
mov dword [esp + 0x18], 0x40
push edi
push 1
push 4
push str.LIST
call fcn.0048a02c
push edi
push 1
lea eax, [esp + 0x30]
push 4
push eax
call fcn.0048a02c
push edi
push 1
push 4
push str.INFO
call fcn.0048a02c
add esp, 0x30
test esi, esi
je 0x43efa8
push edi
push 1
lea eax, [esi + 1]
push 4
push str.INAM
mov dword [esp + 0x28], eax
call fcn.0048a02c
push edi
push 1
lea eax, [esp + 0x30]
push 4
push eax
call fcn.0048a02c
push edi
push esi
push 1
push ebp
call fcn.0048a02c
push edi
push 0
call fcn.00488db7
add esp, 0x38
test byte [esp + 0x18], 1
je 0x43efa8
push edi
push 0
call fcn.00488db7
add esp, 8
push edi
push 1
push 4
push str.ISFT
mov dword [esp + 0x28], 0x15
call fcn.0048a02c
push edi
push 1
lea eax, [esp + 0x30]
push 4
push eax
call fcn.0048a02c
push edi
push 0x14
push 1
push 0x4df0dc
call fcn.0048a02c
push edi
push 0
call fcn.00488db7
add esp, 0x38
test byte [esp + 0x18], 1
pop esi
pop ebp
je 0x43effc
push edi
push 0
call fcn.00488db7
add esp, 8
push edi
call fcn.00489a43
push 0
sub eax, 8
push 4
push edi
mov dword [esp + 0x48], eax
call fcn.00489d25
push edi
push 1
lea eax, [esp + 0x50]
push 4
push eax
call fcn.0048a02c
push edi
call fcn.00488f38
add esp, 0x24
test byte [ebx + 0x25], 3
je 0x43f04d
mov eax, dword [ebx + 0x30]
add eax, dword [ebx + 0x2c]
cmp dword [ebx + 0x28], eax
jle 0x43f04d
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
push ebx
call fcn.0043e610
add esp, 4
mov byte [0x54e4e0], 1
mov al, 1
pop edi
mov byte [0x54e620], 0
mov byte [0x54e621], 1
pop ebx
add esp, 0xac
ret
push 0
push str.The_sample_is_empty_
push str.System_message
push 0
call fcn.00442040
add esp, 0x10
xor al, al
add esp, 0xac
ret