Function at 0x40c830
Capabilities:
Get common file path
Get file size
Parse pe header
Read file on windows
Resolve function by parsing pe exports
Write file on windows

Disassembly:
mov eax, dword [esp + 0x14]
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x24]
xor ebx, ebx
push 0x5c
push edi
mov dword [0x429d80], eax
mov dword [0x427f1c], ebx
mov dword [0x4281bc], ebx
mov dword [0x4290d0], ebx
mov dword [0x42808c], esi
call fcn.004137d0
add esp, 8
test eax, eax
jne 0x40c895
mov ecx, dword [esp + 0x20]
or esi, 1
push esi
push 0x191
push edi
push 0x7d1
push ecx
call fcn.004062d0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0x5c
push edi
call fcn.004137d0
inc eax
mov edx, 0x428260
add esp, 8
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40c8a8
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40c8f8
mov edx, dword [esp + 0x20]
or esi, 3
push esi
push 0x192
push 0x428260
push 0x7d9
push edx
call fcn.004062d0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x428f28], eax
cmp eax, 0xffffffff
jne 0x40c93a
or esi, 3
push esi
push 0x193
push 0x428260
push 0x7da
mov eax, dword [esp + 0x30]
push eax
call fcn.004062d0
add esp, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
add eax, 0x9c4000
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x428374], eax
cmp eax, ebx
jne 0x40c967
mov ecx, dword [esp + 0x20]
or esi, 2
push esi
push 0x194
push ebx
push 0x7d8
push ecx
jmp 0x40c922
mov edx, dword [0x428f28]
add edx, 0x9c4000
push eax
mov dword [0x428fac], edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [0x4290cc], eax
cmp eax, ebx
jne 0x40c99a
or esi, 2
push esi
push 0x195
push ebx
push 0x7d6
jmp 0x40c91d
mov edx, dword [0x428f28]
push ebx
lea ecx, [esp + 0x14]
push ecx
push edx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40c9fd
mov eax, dword [esp + 0x20]
or esi, 3
push esi
push 0x196
push 0x428260
push 0x7db
push eax
call fcn.004062d0
mov ecx, dword [0x428374]
add esp, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [0x428374]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4290cc]
cmp byte [eax], 0x4d
jne 0x40d413
cmp byte [eax + 1], 0x5a
jne 0x40d413
mov ebx, dword [0x428f28]
cmp dword [eax + 0x3c], ebx
jbe 0x40ca40
or esi, 1
push esi
push 0x198
push 0x428260
push 0x7d3
jmp 0x40d426
mov edi, dword [eax + 0x3c]
add edi, eax
mov dword [0x429208], edi
cmp byte [edi], 0x50
jne 0x40d3f9
cmp byte [edi + 1], 0x45
jne 0x40d3f9
cmp byte [edi + 2], 0
jne 0x40d3f9
cmp byte [edi + 3], 0
jne 0x40d3f9
test byte [edi + 0x17], 0x20
je 0x40ca95
mov ecx, dword [esp + 0x24]
or esi, 1
push esi
push 0x19a
push 0x428260
push 0x7dc
push ecx
jmp 0x40d42b
push ebx
push str.Ng_VkcNv_O
push eax
call fcn.00402ef0
add esp, 0xc
cmp eax, 0xffffffff
je 0x40cac6
mov edx, dword [esp + 0x24]
or esi, 1
push esi
push 0x19b
push 0x428260
push 0x7dd
push edx
jmp 0x40d42b
lea edx, [edi + 4]
add edi, 0x18
mov dword [0x429d8c], edx
mov dword [0x427f0c], edi
movzx eax, word [edx + 0x10]
add eax, edi
mov dword [0x4292e4], eax
movzx ecx, word [edx + 2]
xor ebp, ebp
test ecx, ecx
jle 0x40cb03
add eax, 0x14
mov edi, dword [eax]
cmp edi, ebp
jb 0x40cafb
mov ebp, dword [eax - 4]
add ebp, edi
add eax, 0x28
sub ecx, 1
jne 0x40caf0
xor eax, eax
mov dword [esp + 0x34], eax
mov dword [0x429200], eax
cmp ebp, ebx
jae 0x40cc32
push 0x427f80
sub ebx, ebp
push 0x101
mov dword [esp + 0x40], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, 0x427f80
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40cb32
mov ecx, dword [str.CM_tempfile]
mov edx, dword [0x423154]
push 0
push 0x80
push 2
push 0
mov dword [eax], ecx
mov ecx, dword [0x423158]
push 0
mov dword [eax + 4], edx
mov dl, byte [0x42315c]
push 0xc0000000
mov dword [eax + 8], ecx
push 0x427f80
mov byte [eax + 0xc], dl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40cb96
or esi, 2
push esi
push 0x1be
push 0
push 0x7df
jmp 0x40d426
mov edx, dword [0x4290cc]
mov ebx, dword [esp + 0x38]
push 0
lea ecx, [esp + 0x14]
push ecx
push ebx
add edx, ebp
push edx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x10], ebx
je 0x40cbcd
or esi, 2
push esi
push 0x1bf
push 0
push 0x7e0
jmp 0x40d426
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x428f28]
mov ecx, dword [0x4290cc]
cmp byte [ecx + eax - 8], 0x48
mov edx, 1
mov dword [esp + 0x34], edx
jne 0x40cc2c
cmp byte [ecx + eax - 7], 0x54
jne 0x40cc2c
cmp byte [ecx + eax - 6], 0x4d
jne 0x40cc2c
cmp byte [ecx + eax - 5], 0x4c
jne 0x40cc2c
cmp byte [ecx + eax - 4], 0x32
jne 0x40cc2c
cmp byte [ecx + eax - 3], 0x41
jne 0x40cc2c
cmp byte [ecx + eax - 2], 0x50
jne 0x40cc2c
cmp byte [ecx + eax - 1], 0x50
jne 0x40cc2c
mov dword [0x429200], edx
mov dword [0x428f28], ebp
mov edx, dword [0x429d8c]
or ebx, 0xffffffff
xor ecx, ecx
mov dword [0x428250], ebx
xor eax, eax
cmp cx, word [edx + 2]
jae 0x40cc73
mov edi, dword [0x4292e4]
add edi, 0x14
mov edi, edi
mov ecx, dword [edi]
cmp ecx, ebx
jae 0x40cc67
test ecx, ecx
je 0x40cc67
mov ebx, ecx
mov dword [0x428250], ebx
mov dword [0x4281bc], eax
movzx ecx, word [edx + 2]
inc eax
add edi, 0x28
cmp eax, ecx
jl 0x40cc50
movzx eax, word [edx + 2]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
add edx, edx
sub edx, dword [0x4290cc]
push 0x429274
add edx, dword [0x4292e4]
mov dword [0x428088], edx
call fcn.00402f50
mov ecx, dword [0x429274]
add esp, 4
cmp byte [ecx], 0x4d
jne 0x40d3d0
cmp byte [ecx + 1], 0x5a
jne 0x40d3d0
mov eax, dword [ecx + 0x3c]
add eax, ecx
mov dword [0x427f24], eax
cmp byte [eax], 0x50
jne 0x40d3bc
cmp byte [eax + 1], 0x45
jne 0x40d3bc
cmp byte [eax + 2], 0
jne 0x40d3bc
cmp byte [eax + 3], 0
jne 0x40d3bc
mov edx, dword [0x428250]
sub edx, dword [0x428088]
lea ecx, [eax + 4]
add eax, 0x18
mov dword [0x428084], ecx
mov dword [0x4291a0], eax
movzx ecx, word [ecx + 0x10]
add ecx, eax
mov dword [0x4281b0], ecx
cmp edx, 0xc8
jae 0x40cd3a
mov eax, dword [0x4281bc]
mov ecx, dword [esp + 0x24]
push 0xc8
push eax
push ecx
call fcn.004085b0
add esp, 0xc
test eax, eax
je 0x40d3ea
mov eax, dword [0x429d8c]
mov ebx, dword [0x427f1c]
xor edx, edx
xor ebp, ebp
xor edi, edi
cmp dx, word [eax + 2]
jae 0x40cd93
mov ecx, dword [0x4292e4]
add ecx, 0x10
lea ebx, [ebx]
mov edx, dword [ecx - 8]
mov eax, dword [ecx]
cmp edx, eax
jae 0x40cd6b
mov edx, eax
mov eax, dword [ecx - 4]
add eax, edx
mov dword [0x427f18], eax
cmp eax, ebx
jbe 0x40cd81
mov ebx, eax
mov dword [0x427f1c], ebx
mov edx, dword [0x429d8c]
movzx eax, word [edx + 2]
inc edi
add ecx, 0x28
cmp edi, eax
jl 0x40cd60
mov edi, dword [0x427f0c]
mov ecx, dword [edi + 0x20]
lea eax, [ebx + ecx - 1]
xor edx, edx
div ecx
mov edx, dword [esp + 0x24]
push ebp
push edx
mov dword [0x427f1c], eax
mov ecx, dword [edi + 0x20]
imul ecx, eax
mov dword [0x427f1c], ecx
call fcn.00407960
add esp, 8
test eax, eax
je 0x40d3ea
mov ebx, dword [esp + 0x24]
push 1
push ebx
call fcn.00407960
add esp, 8
test eax, eax
je 0x40d3ea
push 2
push ebx
call fcn.00407960
add esp, 8
test eax, eax
je 0x40d3ea
movzx eax, word [0x427f20]
mov ecx, dword [0x4292e4]
lea eax, [eax + eax*4]
mov edi, dword [ecx + eax*8 + 0x14]
add edi, dword [0x4290cc]
push 0x8000
push str.Ng_VkcNv_O
push edi
mov dword [0x428fa8], edi
call fcn.00402ef0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40ce3f
push esi
push 0x1a4
push ebp
push 0x7d6
push ebx
jmp 0x40d3e2
lea edi, [edi + eax + 0xa]
mov eax, dword [0x427f0c]
mov dword [0x428370], edi
mov dword [0x429214], edi
mov edx, dword [eax + 0x10]
xor ecx, ecx
add edx, dword [eax + 0x18]
adc ecx, dword [eax + 0x1c]
mov dword [edi], edx
mov edx, dword [0x429214]
mov dword [edx + 4], ecx
mov eax, dword [0x4291a0]
mov ecx, dword [eax + 0x10]
sub ecx, dword [0x428f40]
mov edx, dword [0x427f0c]
add ecx, dword [0x428f44]
mov dword [edx + 0x10], ecx
mov eax, dword [0x427f0c]
mov ecx, dword [eax + 0x18]
mov edx, dword [0x428370]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0x1c]
mov ecx, dword [0x428370]
mov dword [ecx + 0xc], eax
mov edx, dword [0x427f0c]
mov eax, dword [edx + 0x78]
mov ecx, dword [0x428370]
mov dword [ecx + 0x10], eax
mov edx, dword [0x428370]
mov dword [edx + 0x14], ebp
mov eax, dword [0x427f0c]
mov ecx, dword [eax + 0x7c]
mov edx, dword [0x428370]
mov dword [edx + 0x18], ecx
mov eax, dword [0x427f0c]
mov ecx, dword [eax + 0x98]
mov edx, dword [0x428370]
mov dword [edx + 0x24], ecx
mov eax, dword [0x428370]
mov dword [eax + 0x28], ebp
mov ecx, dword [0x427f0c]
mov edx, dword [ecx + 0x9c]
mov eax, dword [0x428370]
mov dword [eax + 0x2c], edx
mov ecx, dword [0x429d8c]
movzx eax, word [ecx + 2]
lea edx, [eax + eax*4]
mov eax, dword [0x4292e4]
mov ecx, dword [eax + edx*8 - 0x1c]
mov edx, dword [0x428370]
mov dword [edx + 0x1c], ecx
mov eax, dword [0x428370]
mov dword [eax + 0x20], ebp
mov ecx, dword [0x428370]
mov al, byte [esp + 0x3c]
mov dword [ecx + 0x3c], 0x7fffffff
mov edx, dword [0x428370]
mov byte [edx + 0x40], al
mov ecx, dword [0x428370]
mov edx, dword [esp + 0x40]
mov dword [ecx + 0x45], edx
mov eax, dword [0x428370]
cmp dword [eax + 0x2c], ebp
jbe 0x40cf5f
mov byte [0x427461], 1
mov ecx, dword [0x427f0c]
mov dword [ecx + 0xcc], ebp
mov edx, dword [0x427f0c]
mov dword [edx + 0xc8], ebp
mov eax, dword [0x427f0c]
mov dword [eax + 0xd4], ebp
mov ecx, dword [0x427f0c]
push ebx
mov dword [ecx + 0xd0], ebp
call fcn.00402af0
add esp, 4
test eax, eax
je 0x40d3ea
push ebx
call fcn.00407fb0
add esp, 4
test eax, eax
je 0x40d3ea
push 4
push ebx
call fcn.00407960
add esp, 8
test eax, eax
je 0x40d3ea
push ebx
call fcn.00407c70
add esp, 4
test eax, eax
je 0x40d3ea
mov edx, dword [0x427f0c]
mov dword [edx + 0xa4], ebp
mov eax, dword [0x427f0c]
mov dword [eax + 0xa0], ebp
mov ecx, dword [0x427f0c]
mov dword [ecx + 0xc4], ebp
mov edx, dword [0x427f0c]
mov dword [edx + 0xc0], ebp
mov eax, dword [0x427f0c]
mov ecx, 0xfeff
and word [eax + 0x46], cx
mov eax, dword [0x427f0c]
mov edx, 0xffbf
and word [eax + 0x46], dx
mov eax, dword [0x427f0c]
mov ecx, 0xfbff
and word [eax + 0x46], cx
movzx eax, word [0x427f20]
lea edx, [eax + eax*4]
mov eax, dword [0x4292e4]
mov eax, dword [eax + edx*8 + 0x14]
add eax, dword [0x4290cc]
push 0x8000
push str.Ng_VkcNv_O
push eax
mov dword [0x428fa8], eax
call fcn.00402ef0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40d075
push esi
push 0x1a5
push ebp
push 0x7d6
push ebx
jmp 0x40d3e2
push ebx
call fcn.00408bf0
add esp, 4
test eax, eax
je 0x40d44d
mov eax, dword [0x4281c8]
shr eax, 0x11
mov ecx, 1
mov dword [0x4290d0], ecx
cmp eax, ebp
jbe 0x40d0ac
lea ecx, [ecx]
add ecx, ecx
shr eax, 1
jne 0x40d0a0
mov dword [0x4290d0], ecx
mov edx, dword [0x428370]
mov dword [edx + 0x41], ecx
mov eax, dword [0x429214]
add eax, 0xfffffe74
push esi
push ebx
mov dword [0x4290c4], eax
call fcn.00408800
add esp, 8
test eax, eax
je 0x40d433
mov ecx, dword [0x429d8c]
movzx eax, word [ecx + 2]
mov ebp, dword [esp + 0x2c]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea edx, [eax + eax*4]
mov eax, dword [0x427f0c]
add edx, edx
push 0x80
add edx, edx
push 2
add edx, edx
sub edx, dword [0x4290cc]
push 0
add edx, dword [0x4292e4]
push 0
push 0xc0000000
push ebp
mov dword [eax + 0x3c], edx
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x40d149
mov ecx, dword [esp + 0x24]
or esi, 3
push esi
push 0x1a8
push ebp
push 0x7d9
push ecx
call fcn.004062d0
add esp, 0x14
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [0x428f28]
mov ecx, dword [0x4290cc]
push 0
lea edx, [esp + 0x18]
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d18e
or esi, 3
push esi
push 0x1a9
mov edx, dword [esp + 0x2c]
push ebp
push 0x7d7
push edx
call fcn.004062d0
add esp, 0x14
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
cmp dword [esp + 0x34], 0
je 0x40d277
push 0x2800
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x428258], eax
test eax, eax
jne 0x40d1c3
or esi, 2
push esi
push 0x1c0
push eax
push 0x7e1
jmp 0x40d426
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push 0x427f80
call ebx
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x40d1fd
mov ecx, dword [esp + 0x24]
or esi, 2
push esi
push 0x1be
push 0
push 0x7df
push ecx
jmp 0x40d42b
mov eax, dword [esp + 0x38]
test eax, eax
jbe 0x40d259
lea edx, [eax - 1]
mov eax, 0xcccccccd
mul edx
mov ebx, edx
shr ebx, 0xd
inc ebx
jmp 0x40d220
mov ecx, dword [0x428258]
push 0
lea eax, [esp + 0x1c]
push eax
push 0x2800
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x18]
mov ecx, dword [0x428258]
push 0
lea edx, [esp + 0x14]
push edx
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub ebx, 1
jne 0x40d220
mov edx, dword [0x428258]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, dword [esp + 0x2c]
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x427f0c]
add eax, 0x40
push eax
lea ecx, [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.imagehlp.dll_MapFileAndCheckSumA]
test eax, eax
je 0x40d2cc
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esp + 0x24]
or esi, 2
push esi
push 0x1bb
push 0
push 0x7d6
push edx
call fcn.004062d0
add esp, 0x14
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebp
call ebx
mov edi, eax
cmp edi, 0xffffffff
jne 0x40d312
mov eax, dword [esp + 0x24]
or esi, 3
push esi
push 0x1aa
push 0x428260
push 0x7d9
push eax
call fcn.004062d0
add esp, 0x14
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov ecx, dword [0x427f0c]
sub ecx, dword [0x4290cc]
push 0
push 0
add ecx, 0x40
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40d35c
mov edx, dword [esp + 0x24]
or esi, 3
push esi
push 0x1ab
push 0x428260
push 0x7de
push edx
call fcn.004062d0
add esp, 0x14
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
mov ecx, dword [0x427f0c]
push 0
lea eax, [esp + 0x18]
push eax
push 4
add ecx, 0x40
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d388
or esi, 3
push esi
push 0x1ac
jmp 0x40d171
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x428374]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [0x428374]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x10
ret
mov edx, dword [esp + 0x24]
push esi
push 0x1a3
push 0
push 0x7d6
push edx
jmp 0x40d3e2
mov eax, dword [esp + 0x24]
push esi
push 0x1a2
push 0
push 0x7d6
push eax
call fcn.004062d0
add esp, 0x14
mov ecx, dword [0x429274]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40d433
mov edx, dword [esp + 0x24]
or esi, 1
push esi
push 0x199
push 0x428260
push 0x7d4
push edx
jmp 0x40d42b
or esi, 1
push esi
push 0x197
push 0x428260
push 0x7d2
mov eax, dword [esp + 0x34]
push eax
call fcn.004062d0
add esp, 0x14
mov ecx, dword [0x428374]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edx, dword [0x428374]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret