Function at 0x4032f0
Capabilities:
Get file attributes
Hide graphical window
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [0x41a844], 0
mov dword [0x41a848], 0
mov dword [0x41a84c], 0
mov dword [0x41a850], 0
mov dword [0x41a854], 0
mov eax, 0x41a858
mov edx, eax
mov ecx, 0x50
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x41a8a8], 0
mov eax, 0x41a8ac
mov edx, eax
mov ecx, 0x104
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
mov dword [0x41a9b0], 0
mov dword [0x41a9b4], 0
push 0
push 0
push 0
push 0
push 0x104
push 0x41a8ac
push 0x41a858
mov eax, dword [ebp + 8]
push eax
call fcn.00405bd5
add esp, 0x20
test eax, eax
je 0x4033a1
push 0x15
call fcn.00404b70
pop ecx
push 0x41a8ac
mov eax, dword [ebp + 0xc]
push eax
push str._s_s
push 0x41d370
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
cmp dword [0x41dff4], 0
je 0x4033de
push 0x41cb70
mov eax, dword [ebp + 8]
push eax
call fcn.00406347
add esp, 8
mov dword [0x41a854], eax
jmp 0x4033ed
mov eax, dword [ebp + 8]
push eax
call fcn.0040632f
pop ecx
mov dword [0x41a854], eax
cmp dword [0x41a854], 0
je 0x4033fe
push 0x16
call fcn.00404b70
pop ecx
push 0
push 0x41d370
push 0x104
push 0x41d370
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameA]
test eax, eax
jne 0x403421
push 0x17
call fcn.00404b70
pop ecx
cmp dword [0x41e000], 0
je 0x4034f5
push 0x41d370
call fcn.00401a20
pop ecx
test eax, eax
je 0x4034f5
push 1
push 0x41d370
call fcn.00401300
add esp, 8
mov dword [ebp - 4], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401790
add esp, 0x28
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.00401260
add esp, 8
test eax, eax
je 0x4034f5
cmp dword [0x41e000], 1
jne 0x4034da
push 0
push 0
push 0x20080
mov eax, 0x90c00a04
push eax
push 0x49
push 0xaf
push 0
push 0
mov eax, dword [0x41dfec]
push eax
push str.Confirm_File_Replace.
push 0x4048a0
call fcn.00401ce0
add esp, 0x2c
cmp dword [0x41dfa0], 0
jne 0x4034f5
mov eax, dword [0x41a874]
add dword [0x41dff0], eax
xor eax, eax
jmp 0x403833
cmp dword [0x41e000], 2
jne 0x4034f5
mov eax, dword [0x41a874]
add dword [0x41dff0], eax
xor eax, eax
jmp 0x403833
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push 0x41d370
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x41a84c], eax
cmp eax, 0xffffffff
jne 0x40361e
push 0x41d370
call fcn.004016b0
pop ecx
mov dword [0x41a9b4], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x5c
call fcn.00401790
add esp, 0x28
push 0
push 0
push eax
mov eax, dword [0x41a9b4]
push eax
call fcn.004018b0
add esp, 0x10
mov dword [0x41a9b0], eax
mov eax, dword [0x41a9b4]
mov dword [ebp - 4], eax
mov edx, eax
or eax, 0xffffffff
inc eax
cmp byte [edx + eax], 0
jne 0x403573
mov edx, dword [0x41a9b0]
sub eax, edx
mov dword [0x41a9b0], eax
mov eax, dword [ebp - 4]
push eax
call fcn.004016b0
pop ecx
mov edx, dword [0x41a9b0]
push edx
push eax
call fcn.004012b0
add esp, 8
mov dword [0x41a9b4], eax
push eax
call fcn.00401a20
pop ecx
test eax, eax
jne 0x4035d0
mov eax, dword [0x41a9b4]
push eax
call fcn.004043a0
pop ecx
mov eax, dword [0x41a9b4]
push eax
push 0x41e008
call fcn.00401140
add esp, 8
push 0x41d370
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0x10
je 0x403630
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push 0x41d370
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov dword [0x41a84c], eax
cmp eax, 0xffffffff
jne 0x403630
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 3
je 0x403630
push 0x18
call fcn.00404b70
pop ecx
jmp 0x403630
push 0x41d370
push 0x41e008
call fcn.00401140
add esp, 8
push 4
push 0x1000
push 0xf4240
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [0x41a8a8], eax
jmp 0x4037c6
push 0xf4240
mov eax, dword [0x41a8a8]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.0040637b
add esp, 0xc
mov dword [0x41a854], eax
cmp dword [0x41a854], 0
jle 0x403799
push 0
push 0x41a850
mov eax, dword [0x41a854]
push eax
mov eax, dword [0x41a8a8]
push eax
mov eax, dword [0x41a84c]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x4036a2
push 0x19
call fcn.00404b70
pop ecx
cmp dword [0x41dffc], 0
je 0x4037bd
push 0
push 0
push 0
mov eax, dword [0x41dfec]
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
push 5
mov eax, dword [0x41dfec]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x41a850]
add dword [0x41dff0], eax
push 0
mov eax, dword [0x41dff0]
mov dword [ebp - 4], eax
mov eax, dword [0x41e004]
mov edx, 0xa3d70a3d
mul edx
add eax, 0xa3d70a3d
adc edx, 0
shr edx, 6
mov ecx, edx
mov eax, dword [ebp - 4]
xor edx, edx
div ecx
push eax
push 0x402
mov eax, dword [0x41dfdc]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x41dff0]
mov dword [ebp - 8], eax
mov eax, dword [0x41e004]
mov edx, 0xa3d70a3d
mul edx
add eax, 0xa3d70a3d
adc edx, 0
shr edx, 6
mov ecx, edx
mov eax, dword [ebp - 8]
xor edx, edx
div ecx
mov edx, eax
shr edx, 1
push edx
fild dword [esp]
add esp, 4
fmul qword [0x4106a8]
and eax, 1
push eax
fild dword [esp]
add esp, 4
faddp st(1)
sub esp, 8
fstp qword [esp]
call fcn.00401740
add esp, 8
push 0x4106b0
push eax
push 2
call fcn.004017f0
add esp, 0xc
push eax
mov eax, dword [0x41dfe4]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov eax, dword [0x41dfec]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00401b30
jmp 0x4037bd
cmp dword [0x41a854], 0
jge 0x4037bd
cmp dword [0x41dff4], 0
jne 0x4037b5
push 0x1a
call fcn.00404b70
pop ecx
jmp 0x4037bd
push 0x1b
call fcn.00404b70
pop ecx
cmp dword [0x41a854], 0
jle 0x4037cb
jmp 0x40364e
push 0x41a844
push 0
movzx eax, word [0x41a868]
push eax
call dword [sym.imp.KERNEL32.DLL_DosDateTimeToFileTime]
push 0x41a844
push 0x41a844
call dword [sym.imp.KERNEL32.DLL_LocalFileTimeToFileTime]
push 0x41a844
push 0
push 0
mov eax, dword [0x41a84c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileTime]
mov eax, dword [0x41a84c]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push 0x4000
push 0
mov eax, dword [0x41a8a8]
push eax
call dword [sym.imp.KERNEL32.DLL_VirtualFree]
mov eax, dword [ebp + 8]
push eax
call fcn.00406744
pop ecx
mov eax, dword [0x41a854]
mov esp, ebp
pop ebp
ret