Function at 0x403a9d
Capabilities:
Get file size
Query environment variable
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov esi, dword [0x40abf5]
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
movzx ecx, byte [esi]
mov dword [0x40abd4], ecx
inc esi
test ecx, 2
je 0x403adc
call fcn.00404f20
or eax, eax
jne 0x403adc
jmp 0x403dc9
mov eax, dword [0x40abf5]
push 0x200
push 0x40a4ba
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x40a4ba
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x403b68
call sub.kernel32.dll_GetLastError
cmp eax, 0x20
jne 0x403b3c
push 0x11
push dword [0x40abf5]
push str.The_target_is_running___r_nClose_it__then_hit_OK.
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 2
jne 0x403b3a
jmp 0x403dc6
jmp 0x403af1
push 0x40a4ba
push 0x40a6ba
call sub.kernel32.dll_lstrcpyA
push 0x40a6ba
call fcn.00404338
mov eax, 0x40a6ba
cmp byte [eax], 0
je 0x403b63
jmp 0x403ae1
jmp 0x403dc6
mov dword [0x40ab5a], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x409582], eax
push eax
push 0
call sub.kernel32.dll_GlobalAlloc
mov dword [0x40ab5e], eax
mov edi, eax
push 0
push 0x40abe0
push dword [0x409582]
push edi
push dword [0x40ab5a]
call sub.kernel32.dll_ReadFile
or eax, eax
jne 0x403bb4
cmp dword [0x40abe0], 0
jne 0x403bb4
jmp 0x403dc3
cmp dword [0x40903f], 0
je 0x403bff
push 0x40a4ba
push 0x40a2ba
call sub.kernel32.dll_lstrcpyA
push str..BAK
push 0x40a2ba
call sub.kernel32.dll_lstrcatA
push 0x40a2ba
call fcn.00405230
or eax, eax
jne 0x403bff
push dword [0x409582]
push dword [0x40ab5e]
push 0x40a2ba
call fcn.00405264
movzx ecx, byte [esi]
mov dword [0x40abd0], ecx
inc esi
jmp 0x403d5c
mov dword [0x40abe4], esi
movzx eax, word [esi]
add esi, 4
cmp ax, 0xffff
je 0x403c25
shl ax, 1
add esi, eax
movzx edi, byte [esi]
inc esi
movzx eax, byte [esi]
inc esi
or eax, eax
je 0x403c52
mov dl, al
and al, 0x3f
mov dword [0x40abbe], eax
shr dl, 6
push edx
and dl, 1
mov byte [0x40abc7], dl
pop edx
shr dl, 1
mov byte [0x40abc6], dl
jmp 0x403c5c
mov dword [0x40abbe], 0
mov eax, esi
add esi, edi
mov ebx, esi
cmp dword [0x40abbe], 0
je 0x403d0a
add esi, edi
push eax
push ebx
movsx edx, byte [esi]
inc esi
push edx
mov dword [0x40abba], esi
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
mov dword [0x40abb6], esi
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
pushal
push 0
push 0x404e5d
push dword [0x409474]
push 0x76c
push dword [0x409470]
call sub.user32.dll_DialogBoxParamA
popal
lea ecx, [0x40a8ba]
cmp byte [0x40abc6], 0
je 0x403cfd
push dword [0x40abbe]
push 0x40a4ba
push dword [0x40abbe]
push 0x40a8ba
push 1
push 0
call sub.kernel32.dll_MultiByteToWideChar
lea ecx, [0x40a4ba]
mov eax, dword [0x40abbe]
shl eax, 1
add ecx, eax
mov word [ecx], 0
lea ecx, [0x40a4ba]
pop edx
pop ebx
pop eax
sub esi, edi
push esi
mov esi, 0
jmp 0x403d16
add esi, edi
mov ecx, esi
add esi, edi
mov edx, 0
push esi
push edx
push dword [0x40abe4]
push dword [0x409582]
push edi
push esi
push ecx
push ebx
push eax
push dword [0x40ab5e]
call section..text
pop esi
add esi, edi
mov ecx, dword [0x40abe4]
mov cx, word [ecx]
or eax, eax
je 0x403d4e
cmp cx, 0xffff
je 0x403d50
cmp cx, ax
je 0x403d50
jmp 0x403dc3
dec dword [0x40abd0]
mov ecx, dword [0x40abd0]
cmp ecx, 0
ja 0x403c0e
push 0
push 0
push 0
push dword [0x40ab5a]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x40abe0
push dword [0x409582]
push dword [0x40ab5e]
push dword [0x40ab5a]
call sub.kernel32.dll_WriteFile
or eax, eax
jne 0x403d9a
jmp 0x403dc3
push dword [0x40ab5a]
call sub.kernel32.dll_FlushFileBuffers
push dword [0x40ab5a]
call sub.kernel32.dll_CloseHandle
or eax, eax
jne 0x403db6
jmp 0x403dc3
push dword [0x40ab5e]
call sub.kernel32.dll_GlobalFree
jmp 0x403dcc
inc dword [ebp - 4]
inc dword [ebp - 4]
inc dword [ebp - 4]
test dword [0x40abd4], 2
je 0x403ddd
call fcn.00404f4b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret