Function at 0x407840
Capabilities:
Access peb ldr_data
Get common file path
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ecx, 0x16
xor eax, eax
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x470]
push ebx
mov edi, esi
sub esp, 0x4cc
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x218]
movzx edx, word [eax + 0x41a730]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x407863
cmp word [ebp - 0x218], 0
je 0x407b9f
mov eax, edi
lea esi, [esi]
lea edi, [edi]
add eax, 2
cmp word [eax], 0
jne 0x407890
cmp eax, edi
ja 0x4078b2
jmp 0x407b9f
cmp dx, 0x5c
je 0x4078be
cmp dx, 0x2f
je 0x4078f0
cmp eax, edi
jbe 0x4078f0
sub eax, 2
movzx edx, word [eax]
cmp dx, 0x2e
jne 0x4078a2
cmp dx, 0x2e
jne 0x4078f0
xor edx, edx
cmp eax, edi
mov word [eax], dx
ja 0x4078d6
jmp 0x407b9f
cmp eax, edi
jbe 0x4078f0
sub eax, 2
movzx edx, word [eax]
cmp dx, 0x5c
setne bl
cmp dx, 0x2f
setne cl
test bl, cl
jne 0x4078d2
nop
cmp dx, 0x5c
je 0x4079a0
cmp dx, 0x2f
mov ecx, eax
je 0x4079a0
xor eax, eax
lea ebx, [ebp - 0x418]
jmp 0x407914
movzx edx, word [ecx + eax]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x407910
mov dword [esp + 4], edi
mov dword [esp], 0x100
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov eax, dword [0x41a4d8]
sub esp, 8
mov dword [ebp - 0x470], 0x58
mov dword [ebp - 0x464], global_wszIdlFiles
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x450], 0x100
mov dword [ebp - 0x444], edi
mov dword [ebp - 0x46c], eax
mov eax, dword [0x41a4dc]
mov dword [ebp - 0x43c], 0x806
mov dword [ebp - 0x434], global_wszDefaultExt
mov dword [esp], esi
mov dword [ebp - 0x468], eax
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
sub esp, 4
test eax, eax
jne 0x4079b0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
movzx edx, word [eax + 2]
lea ecx, [eax + 2]
jmp 0x407906
mov eax, dword [0x41a724]
mov esi, dword [sym.imp.user32.dll_SendMessageW]
mov dword [esp + 0xc], 0xffff0000
mov dword [esp + 8], 4
mov dword [esp + 4], 0x110a
mov dword [esp], eax
call esi
lea edx, [ebp - 0x498]
mov dword [ebp - 0x4ac], eax
mov ecx, 0xa
xor eax, eax
sub esp, 0x10
mov edi, edx
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x4ac]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x113e
mov dword [ebp - 0x494], eax
mov eax, dword [0x41a724]
mov dword [esp], eax
call esi
sub esp, 0x10
mov esi, dword [ebp - 0x474]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x40000000
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_CreateFileW]
sub esp, 0x1c
cmp eax, 0xffffffff
mov dword [ebp - 0x4ac], eax
je 0x407bb3
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [esi + 0x204]
mov ecx, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
mov dword [ebp - 0x4b0], ecx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call ecx
sub esp, 0x20
mov ebx, eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov edi, eax
mov ecx, dword [ebp - 0x4b0]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x204]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call ecx
lea eax, [ebp - 0x49c]
sub esp, 0x20
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x4ac]
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x407b98
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [ebp - 0x4ac]
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_CloseHandle]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call dbg.ShowLastError
jmp 0x407b5a
xor eax, eax
lea ebx, [ebp - 0x418]
mov word [ebp - 0x418], ax
jmp 0x407920
call dbg.ShowLastError
jmp 0x407998