Function at 0x4026e6
Capabilities:
Get file size
Query environment variable
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov esi, dword [0x40abf5]
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
mov eax, dword [esi]
mov dword [0x40abdc], eax
add esi, 4
movzx ecx, byte [esi]
mov dword [0x40abd4], ecx
inc esi
test ecx, 2
je 0x40272f
call fcn.00403ec1
or eax, eax
jne 0x40272f
jmp 0x402a21
mov eax, dword [0x40abf5]
push 0x200
push 0x40a4ba
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x40a4ba
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4027bb
call sub.kernel32.dll_GetLastError
cmp eax, 0x20
jne 0x40278f
push 0x11
push dword [0x40abf5]
push str.The_target_is_running___r_nClose_it__then_hit_OK.
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 2
jne 0x40278d
jmp 0x402a1e
jmp 0x402744
push 0x40a4ba
push 0x40a6ba
call sub.kernel32.dll_lstrcpyA
push 0x40a6ba
call fcn.004032d9
mov eax, 0x40a6ba
cmp byte [eax], 0
je 0x4027b6
jmp 0x402734
jmp 0x402a1e
mov dword [0x40ab5a], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x409582], eax
cmp eax, dword [0x40abdc]
jae 0x4027da
mov eax, dword [0x40abdc]
push eax
push 0
call sub.kernel32.dll_GlobalAlloc
mov dword [0x40ab5e], eax
mov edi, eax
push 0
push 0x40abe0
push dword [0x409582]
push edi
push dword [0x40ab5a]
call sub.kernel32.dll_ReadFile
or eax, eax
jne 0x402814
cmp dword [0x40abe0], 0
jne 0x402814
jmp 0x402a1e
cmp dword [0x40903f], 0
je 0x40285f
push 0x40a4ba
push 0x40a2ba
call sub.kernel32.dll_lstrcpyA
push str..BAK
push 0x40a2ba
call sub.kernel32.dll_lstrcatA
push 0x40a2ba
call fcn.004041d0
or eax, eax
jne 0x40285f
push dword [0x409582]
push dword [0x40ab5e]
push 0x40a2ba
call fcn.00404204
movzx ecx, word [esi]
mov dword [0x40abd0], ecx
add esi, 2
jmp 0x4029b4
mov ebx, dword [esi]
add esi, 4
xchg bl, bh
rol ebx, 0x10
xchg bl, bh
test ebx, 0x80000000
je 0x402969
sub ebx, 0x80000000
mov edi, ebx
movzx eax, byte [esi]
inc esi
mov dl, al
and al, 0x3f
mov dword [0x40abbe], eax
shr dl, 6
push edx
and dl, 1
mov byte [0x40abc7], dl
pop edx
shr dl, 1
mov byte [0x40abc6], dl
mov dword [0x40abba], esi
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
mov dword [0x40abb6], esi
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
pushal
push 0
push 0x403dfe
push dword [0x409474]
push 0x76c
push dword [0x409470]
call sub.user32.dll_DialogBoxParamA
popal
lea ebx, [0x40a8ba]
cmp byte [0x40abc6], 0
je 0x402938
push dword [0x40abbe]
push 0x40a4ba
push dword [0x40abbe]
push 0x40a8ba
push 1
push 0
call sub.kernel32.dll_MultiByteToWideChar
lea ecx, [0x40a4ba]
mov eax, dword [0x40abbe]
shl eax, 1
add ecx, eax
mov word [ecx], 0
lea ebx, [0x40a4ba]
mov edx, dword [0x40ab5e]
xor ecx, ecx
inc dword [0x40abbe]
cmp byte [0x40abc6], 0
je 0x402955
shl dword [0x40abbe], 1
jmp 0x40295f
mov al, byte [ebx]
mov byte [edi + edx], al
inc ebx
inc edx
inc ecx
cmp ecx, dword [0x40abbe]
jb 0x402957
jmp 0x4029a8
mov edi, dword [0x40ab5e]
mov al, byte [esi]
inc esi
cmp al, 2
jne 0x402989
mov al, byte [esi]
mov ah, byte [ebx + edi]
add esi, 2
cmp ah, al
je 0x4029a8
jmp 0x402a1b
cmp al, 1
jne 0x402996
inc esi
mov ah, byte [esi]
mov byte [ebx + edi], ah
inc esi
jmp 0x4029a8
mov al, byte [esi]
mov ah, byte [ebx + edi]
inc esi
cmp ah, al
je 0x4029a2
jmp 0x402a1b
mov ah, byte [esi]
mov byte [ebx + edi], ah
inc esi
dec dword [0x40abd0]
mov ecx, dword [0x40abd0]
cmp ecx, 0
ja 0x402870
push 0
push 0
push 0
push dword [0x40ab5a]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x40abe0
push dword [0x40abdc]
push dword [0x40ab5e]
push dword [0x40ab5a]
call sub.kernel32.dll_WriteFile
or eax, eax
jne 0x4029f2
jmp 0x402a1b
push dword [0x40ab5a]
call sub.kernel32.dll_FlushFileBuffers
push dword [0x40ab5a]
call sub.kernel32.dll_CloseHandle
or eax, eax
jne 0x402a0e
jmp 0x402a1b
push dword [0x40ab5e]
call sub.kernel32.dll_GlobalFree
jmp 0x402a24
inc dword [ebp - 4]
inc dword [ebp - 4]
inc dword [ebp - 4]
test dword [0x40abd4], 2
je 0x402a35
call fcn.00403eec
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret