Function at 0x401000
Capabilities:
Create process on windows
Get common file path
Get file size
Set current directory

Disassembly:
push str.MRRVMtx_0
push 0
push 0
call sub.kernel32.dll_CreateMutexA
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x401518
push 0x1f400
push 0x40
call sub.kernel32.dll_LocalAlloc
test eax, eax
je 0x401546
mov dword [0x403570], eax
push 0x40368c
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
and dword [0x403584], 0
xor ecx, ecx
mov dword [0x403510], 0x4c
mov dword [0x403514], ecx
mov dword [0x403520], ecx
mov dword [0x403528], ecx
mov dword [0x403530], 0x104
mov dword [0x403534], ecx
mov dword [0x40353c], ecx
mov dword [0x403540], ecx
push 0x8000000
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.Megamari.exe
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4015d0
mov ebp, eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
cmp eax, 0xd2000
jne 0x40152f
push ebp
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x403570]
mov byte [eax], 0
mov dword [0x40352c], eax
mov dword [0x40351c], 0x403165
mov dword [0x403544], 4
push 0x403510
call sub.comdlg32.dll_GetOpenFileNameA
test eax, eax
je 0x40158b
push 0x8000000
push 0x80
push 3
push 0
push 0
push 0x80000000
push dword [0x403570]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x40116b
push 0x8000000
push 0x80
push 1
push 0
push 0
push 0x40000000
push dword [0x403570]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x4015a2
mov byte [0x40356a], 1
mov dword [0x40356c], eax
mov eax, dword [0x403570]
mov dword [eax], 0x3252524d
mov dword [0x403580], 0xffffffff
jmp 0x40119e
mov dword [0x40356c], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
cmp eax, 0x140
jb 0x4015b9
mov dword [0x403580], eax
call 0x4015e7
mov eax, dword [0x403570]
cmp dword [eax], 0x3252524d
jne 0x4015b9
mov byte [0x403790], 0
mov dword [0x40357c], 4
push 0x403190
call sub.kernel32.dll_GetStartupInfoA
xor eax, eax
push 0x4031d4
push 0x403190
push eax
push eax
push 3
push eax
push eax
push eax
push eax
cmp byte [0x403568], 1
je 0x4011dd
push str.Megamari.exe
jmp 0x4011e2
push 0x403588
push 0x40368c
call sub.kernel32.dll_SetCurrentDirectoryA
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x401574
push 0xffffffffffffffff
push 0x4034b0
call sub.kernel32.dll_WaitForDebugEvent
cmp dword [0x4034b0], 5
je 0x401503
cmp dword [0x4034b0], 3
jne 0x401246
xor ecx, ecx
push ecx
mov edx, 0x40355c
push 0
push 1
push 0x40356b
push dword [edx + ecx*4]
push dword [0x4031d4]
call sub.kernel32.dll_WriteProcessMemory
pop ecx
inc ecx
cmp ecx, 3
jb 0x40121d
jmp 0x4014e8
cmp dword [0x4034b0], 1
jne 0x4014e8
cmp dword [0x4034bc], 0x80000003
jne 0x4014b9
cmp byte [0x403790], 0
jne 0x401282
mov byte [0x403790], 1
mov dword [0x4031e4], 0x10003
jmp 0x4014e8
push 0x4031e4
push dword [0x4031d8]
call sub.kernel32.dll_GetThreadContext
mov edx, 0x40355c
xor ecx, ecx
mov eax, dword [edx + ecx*4]
inc eax
cmp dword [0x40329c], eax
je 0x4012b0
inc ecx
cmp cl, 3
jb 0x401299
jmp 0x4014b9
test ecx, ecx
jne 0x401362
mov edx, dword [0x403570]
mov ecx, dword [0x40357c]
cmp byte [0x40356a], 1
je 0x4012fd
mov eax, dword [ecx + edx]
mov dword [0x403294], eax
push ecx
lea ecx, [ecx + edx + 4]
cmp dword [ecx], 0
je 0x4012fa
push 0
push 4
push ecx
push 0x4cddc0
push dword [0x4031d4]
call sub.kernel32.dll_WriteProcessMemory
pop ecx
add ecx, 4
jmp 0x401323
pop ecx
jmp 0x401323
mov eax, dword [0x403294]
mov dword [ecx + edx], eax
push ecx
lea ecx, [ecx + edx + 4]
push 0
push 4
push ecx
push 0x4cddc0
push dword [0x4031d4]
call sub.kernel32.dll_ReadProcessMemory
pop ecx
add ecx, 4
add ecx, 4
mov dword [0x40357c], ecx
sub dword [0x4032a8], 4
push 0
push 4
push 0x403294
push dword [0x4032a8]
push dword [0x4031d4]
call sub.kernel32.dll_WriteProcessMemory
push 0x4031e4
push dword [0x4031d8]
call sub.kernel32.dll_SetThreadContext
jmp 0x4014e8
cmp cl, 2
je 0x401451
mov edx, dword [0x403584]
mov ecx, dword [0x40357c]
add edx, ecx
cmp edx, dword [0x403580]
jae 0x401503
cmp ecx, 0x1f338
jb 0x401399
call 0x4015e7
and dword [0x40357c], 0
mov ecx, dword [0x40357c]
push ecx
mov edx, dword [0x403570]
lea eax, [ecx + edx]
push eax
cmp byte [0x40356a], 1
je 0x4013e3
push 0
push 0x1c
push eax
push 0x4cf5dc
push dword [0x4031d4]
call sub.kernel32.dll_WriteProcessMemory
pop eax
add eax, 0x24
push 0
push 0x24
push eax
push 0x4cf630
push dword [0x4031d4]
call sub.kernel32.dll_WriteProcessMemory
jmp 0x401411
push 0
push 0x1c
push eax
push 0x4cf5dc
push dword [0x4031d4]
call sub.kernel32.dll_ReadProcessMemory
pop eax
add eax, 0x24
push 0
push 0x24
push eax
push 0x4cf630
push dword [0x4031d4]
call sub.kernel32.dll_ReadProcessMemory
pop ecx
add ecx, 0x40
mov dword [0x40357c], ecx
push 0
push 4
push 0x403298
push dword [0x4032a8]
push dword [0x4031d4]
call sub.kernel32.dll_ReadProcessMemory
add dword [0x4032a8], 4
push 0x4031e4
push dword [0x4031d8]
call sub.kernel32.dll_SetThreadContext
jmp 0x4014e8
mov edx, dword [0x403584]
mov ecx, dword [0x40357c]
add edx, ecx
cmp edx, dword [0x403580]
jae 0x401503
mov edx, dword [0x403570]
add edx, ecx
cmp byte [0x40356a], 1
je 0x401499
push 0
push 1
push edx
push 0x4e3489
push dword [0x4031d4]
call sub.kernel32.dll_WriteProcessMemory
inc dword [0x40357c]
jmp 0x40141b
push 0
push 1
push edx
push 0x4e3489
push dword [0x4031d4]
call sub.kernel32.dll_ReadProcessMemory
inc dword [0x40357c]
jmp 0x40141b
push 0x80010001
push dword [0x4034b8]
push dword [0x4034b4]
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x4011f9
push 0x10002
push dword [0x4034b8]
push dword [0x4034b4]
call sub.kernel32.dll_ContinueDebugEvent
jmp 0x4011f9
cmp byte [0x40356a], 1
jne 0x401511
call 0x4015e7
push 0
call sub.kernel32.dll_ExitProcess
push 0
push str.MRRV_is_already_running_in_memory
push 0
push 0
call sub.user32.dll_MessageBoxA
push 1
call sub.kernel32.dll_ExitProcess
push 0
push 0
push str.The_version_of_Megamari.exe_is_not_match_with_MRRV
push 0
call sub.user32.dll_MessageBoxA
push 2
call sub.kernel32.dll_ExitProcess
push 0
push 0
push str.Out_of_memory
push 0
call sub.user32.dll_MessageBoxA
push 3
call sub.kernel32.dll_ExitProcess
push 0
push 0
push str.File_access_denied
push 0
call sub.user32.dll_MessageBoxA
push 4
call sub.kernel32.dll_ExitProcess
push 0
push 0
push str.Failed_to_create_process_for_Megamari
push 0
call sub.user32.dll_MessageBoxA
push 5
call sub.kernel32.dll_ExitProcess
push 0
push 0
push str.Operation_abort
push 0
call sub.user32.dll_MessageBoxA
push 6
call sub.kernel32.dll_ExitProcess
push 0
push 0
push str.Failed_to_create_the_file
push 0
call sub.user32.dll_MessageBoxA
push 7
call sub.kernel32.dll_ExitProcess
push 0
push 0
push str.The_specified_file_is_an_invalid_replay_file_for_MRRV
push 0
call sub.user32.dll_MessageBoxA
push 8
call sub.kernel32.dll_ExitProcess
push 0
push 0
push str.Megamari.exe_has_not_found_or_MRRV_could_not_open_it
push 0
call sub.user32.dll_MessageBoxA
push 9
call sub.kernel32.dll_ExitProcess
mov ecx, dword [0x40357c]
cmp byte [0x40356a], 1
je 0x40164c
add dword [0x403584], ecx
mov eax, dword [0x403580]
sub eax, dword [0x403584]
cmp eax, 0x1f400
jbe 0x401613
mov eax, 0x1f400
push eax
push 0
push 0
push dword [0x403584]
push dword [0x40356c]
call sub.kernel32.dll_SetFilePointer
pop eax
push 0
push 0x403574
push eax
push dword [0x403570]
push dword [0x40356c]
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x40155d
ret
push ecx
push 0
push 0
push dword [0x403584]
push dword [0x40356c]
call sub.kernel32.dll_SetFilePointer
push 0
push 0x403574
push dword [0x40357c]
push dword [0x403570]
push dword [0x40356c]
call sub.kernel32.dll_WriteFile
pop ecx
add dword [0x403584], ecx
test eax, eax
je 0x40155d
ret