Function at 0x403746
Capabilities:
Get file size
Query environment variable
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov esi, dword [0x40abf5]
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
mov eax, dword [esi]
mov dword [0x40abdc], eax
add esi, 4
movzx ecx, byte [esi]
mov dword [0x40abd4], ecx
inc esi
test ecx, 2
je 0x40378f
call fcn.00404f20
or eax, eax
jne 0x40378f
jmp 0x403a81
mov eax, dword [0x40abf5]
push 0x200
push 0x40a4ba
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x40a4ba
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x40381b
call sub.kernel32.dll_GetLastError
cmp eax, 0x20
jne 0x4037ef
push 0x11
push dword [0x40abf5]
push str.The_target_is_running___r_nClose_it__then_hit_OK.
push 0
call sub.user32.dll_MessageBoxA
cmp eax, 2
jne 0x4037ed
jmp 0x403a7e
jmp 0x4037a4
push 0x40a4ba
push 0x40a6ba
call sub.kernel32.dll_lstrcpyA
push 0x40a6ba
call fcn.00404338
mov eax, 0x40a6ba
cmp byte [eax], 0
je 0x403816
jmp 0x403794
jmp 0x403a7e
mov dword [0x40ab5a], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x409582], eax
cmp eax, dword [0x40abdc]
jae 0x40383a
mov eax, dword [0x40abdc]
push eax
push 0
call sub.kernel32.dll_GlobalAlloc
mov dword [0x40ab5e], eax
mov edi, eax
push 0
push 0x40abe0
push dword [0x409582]
push edi
push dword [0x40ab5a]
call sub.kernel32.dll_ReadFile
or eax, eax
jne 0x403874
cmp dword [0x40abe0], 0
jne 0x403874
jmp 0x403a7e
cmp dword [0x40903f], 0
je 0x4038bf
push 0x40a4ba
push 0x40a2ba
call sub.kernel32.dll_lstrcpyA
push str..BAK
push 0x40a2ba
call sub.kernel32.dll_lstrcatA
push 0x40a2ba
call fcn.00405230
or eax, eax
jne 0x4038bf
push dword [0x409582]
push dword [0x40ab5e]
push 0x40a2ba
call fcn.00405264
movzx ecx, word [esi]
mov dword [0x40abd0], ecx
add esi, 2
jmp 0x403a14
mov ebx, dword [esi]
add esi, 4
xchg bl, bh
rol ebx, 0x10
xchg bl, bh
test ebx, 0x80000000
je 0x4039c9
sub ebx, 0x80000000
mov edi, ebx
movzx eax, byte [esi]
inc esi
mov dl, al
and al, 0x3f
mov dword [0x40abbe], eax
shr dl, 6
push edx
and dl, 1
mov byte [0x40abc7], dl
pop edx
shr dl, 1
mov byte [0x40abc6], dl
mov dword [0x40abba], esi
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
mov dword [0x40abb6], esi
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
pushal
push 0
push 0x404e5d
push dword [0x409474]
push 0x76c
push dword [0x409470]
call sub.user32.dll_DialogBoxParamA
popal
lea ebx, [0x40a8ba]
cmp byte [0x40abc6], 0
je 0x403998
push dword [0x40abbe]
push 0x40a4ba
push dword [0x40abbe]
push 0x40a8ba
push 1
push 0
call sub.kernel32.dll_MultiByteToWideChar
lea ecx, [0x40a4ba]
mov eax, dword [0x40abbe]
shl eax, 1
add ecx, eax
mov word [ecx], 0
lea ebx, [0x40a4ba]
mov edx, dword [0x40ab5e]
xor ecx, ecx
inc dword [0x40abbe]
cmp byte [0x40abc6], 0
je 0x4039b5
shl dword [0x40abbe], 1
jmp 0x4039bf
mov al, byte [ebx]
mov byte [edi + edx], al
inc ebx
inc edx
inc ecx
cmp ecx, dword [0x40abbe]
jb 0x4039b7
jmp 0x403a08
mov edi, dword [0x40ab5e]
mov al, byte [esi]
inc esi
cmp al, 2
jne 0x4039e9
mov al, byte [esi]
mov ah, byte [ebx + edi]
add esi, 2
cmp ah, al
je 0x403a08
jmp 0x403a7b
cmp al, 1
jne 0x4039f6
inc esi
mov ah, byte [esi]
mov byte [ebx + edi], ah
inc esi
jmp 0x403a08
mov al, byte [esi]
mov ah, byte [ebx + edi]
inc esi
cmp ah, al
je 0x403a02
jmp 0x403a7b
mov ah, byte [esi]
mov byte [ebx + edi], ah
inc esi
dec dword [0x40abd0]
mov ecx, dword [0x40abd0]
cmp ecx, 0
ja 0x4038d0
push 0
push 0
push 0
push dword [0x40ab5a]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x40abe0
push dword [0x40abdc]
push dword [0x40ab5e]
push dword [0x40ab5a]
call sub.kernel32.dll_WriteFile
or eax, eax
jne 0x403a52
jmp 0x403a7b
push dword [0x40ab5a]
call sub.kernel32.dll_FlushFileBuffers
push dword [0x40ab5a]
call sub.kernel32.dll_CloseHandle
or eax, eax
jne 0x403a6e
jmp 0x403a7b
push dword [0x40ab5e]
call sub.kernel32.dll_GlobalFree
jmp 0x403a84
inc dword [ebp - 4]
inc dword [ebp - 4]
inc dword [ebp - 4]
test dword [0x40abd4], 2
je 0x403a95
call fcn.00404f4b
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret