Function at 0x401ec0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x838
push ebx
push ebp
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x121]
mov byte [esp + 0x120], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x225]
mov byte [esp + 0x224], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x42d]
mov byte [esp + 0x42c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x635]
mov byte [esp + 0x634], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x531]
mov byte [esp + 0x530], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x120]
push 0x104
xor ebp, ebp
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 0x120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
js 0x401f9d
mov al, 0x5c
cmp byte [esp + ecx + 0x120], al
je 0x401f9d
dec ecx
jns 0x401f91
cmp ecx, ebp
jl 0x401fbb
inc ecx
lea esi, [esp + 0x120]
mov edx, ecx
lea edi, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x42c]
push eax
push ecx
call esi
lea edx, [esp + 0x1c]
lea eax, [esp + 0x634]
push edx
push eax
call esi
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x530]
push ecx
push edx
call esi
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x224]
push eax
push ecx
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x42c]
push str.Kis.dll
push edx
call esi
lea eax, [esp + 0x634]
push 0x407110
push eax
call esi
lea ecx, [esp + 0x224]
push str.DataKis.dll
push ecx
call esi
lea edx, [esp + 0x530]
push str.Data1.bat
push edx
call esi
lea eax, [esp + 0x7c0]
push 2
lea ecx, [esp + 0x228]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_OpenFile]
mov edi, eax
push ebp
cmp edi, 0xffffffff
mov dword [esp + 0x14], edi
jne 0x402089
push str.Error
push 0x4070dc
push ebp
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x838
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 1]
push edx
call fcn.004021e0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push ebp
push eax
push ebx
push esi
mov dword [esi], ebp
push edi
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test ebx, ebx
jl 0x4020e9
mov al, 0x46
cmp byte [esi + ebp], al
jne 0x4020e4
cmp byte [esi + ebp + 1], al
jne 0x4020e4
cmp byte [esi + ebp + 2], al
jne 0x4020e4
cmp byte [esi + ebp + 3], al
jne 0x4020e4
cmp byte [esi + ebp + 4], al
jne 0x4020e4
cmp byte [esi + ebp + 5], al
jne 0x4020e4
cmp byte [esi + ebp + 6], al
je 0x4020e9
inc ebp
cmp ebp, ebx
jle 0x4020bb
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x329]
mov byte [esp + 0x328], 0
rep stosd dword es:[edi], eax
mov edx, dword [0x4095bc]
lea ecx, [esp + 0x328]
stosw word es:[edi], ax
push ecx
push edx
stosb byte es:[edi], al
call fcn.00401e90
add esp, 8
lea eax, [esp + 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4021c6
xor ecx, ecx
test eax, eax
jle 0x40214c
lea edi, [esi + ebp]
mov dl, byte [esp + ecx + 0x328]
add dl, 3
mov byte [edi + ecx], dl
inc ecx
cmp ecx, eax
jl 0x40213a
cmp eax, 0x3c
jge 0x402171
mov ecx, 0x3c
sub ecx, eax
add eax, ebp
test ecx, ecx
jle 0x402171
mov edx, ecx
lea edi, [eax + esi]
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x738]
push 0x1002
lea ecx, [esp + 0x430]
push eax
push ecx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_OpenFile]
lea edx, [esp + 0x18]
push 0
push edx
mov edi, eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call esi
mov eax, dword [esp + 0x10]
push eax
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x838
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x838
ret