Function at 0x403327
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7a8
mov eax, dword [0x420108]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
mov dword [ebp - 0x6a8], eax
lea eax, [ebp - 0x21a]
push ebx
push eax
mov dword [ebp - 0x69c], ebx
mov word [ebp - 0x21c], bx
call fcn.0040a690
add esp, 0xc
push 0x104
lea eax, [ebp - 0x21c]
push eax
push ebx
mov dword [ebp - 0x698], ebx
mov dword [ebp - 0x6a4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x40339c
mov dword [ebp - 0x69c], 1
jmp 0x403608
push 0x41bed4
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x698]
push eax
call fcn.00408d2b
add esp, 0xc
test eax, eax
je 0x4033ca
mov dword [ebp - 0x69c], 2
jmp 0x403608
push 0x3e
lea eax, [ebp - 0x66a]
push ebx
push eax
mov word [ebp - 0x66c], bx
call fcn.0040a690
push dword [ebp - 0x698]
lea eax, [ebp - 0x66c]
push 1
push 0x40
push eax
call fcn.0040af16
add esp, 0x1c
cmp word [ebp - 0x66c], 0x5a4d
je 0x403413
mov dword [ebp - 0x69c], 3
jmp 0x403608
push ebx
push dword [ebp - 0x630]
push dword [ebp - 0x698]
call fcn.0040b15f
push 0xf4
lea eax, [ebp - 0x7a0]
push ebx
push eax
mov dword [ebp - 0x7a4], ebx
call fcn.0040a690
push dword [ebp - 0x698]
lea eax, [ebp - 0x7a4]
push 1
push 0xf8
push eax
call fcn.0040af16
add esp, 0x28
cmp dword [ebp - 0x7a4], 0x4550
jne 0x403404
movzx esi, word [ebp - 0x79e]
cmp esi, ebx
mov dword [ebp - 0x6a0], ebx
jle 0x4034e1
push dword [ebp - 0x698]
lea eax, [ebp - 0x694]
push 1
push 0x28
push eax
call fcn.0040af16
xor eax, eax
mov byte [ebp - 0x14], bl
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 8
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040aad0
lea eax, [ebp - 0x14]
push eax
push str.existed_section_name:_s_n
call fcn.0040abf4
lea eax, [ebp - 0x14]
push str..dypatch
push eax
call fcn.0041121a
add esp, 0x2c
test eax, eax
je 0x4034d9
inc dword [ebp - 0x6a0]
cmp dword [ebp - 0x6a0], esi
jl 0x403476
cmp dword [ebp - 0x6a0], esi
jl 0x4034f0
mov dword [ebp - 0x69c], 4
jmp 0x403608
push ebx
push dword [ebp - 0x680]
push dword [ebp - 0x698]
call fcn.0040b15f
push dword [ebp - 0x698]
xor eax, eax
mov byte [ebp - 0x62c], bl
lea edi, [ebp - 0x62b]
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x624]
stosd dword es:[edi], eax
push 1
stosd dword es:[edi], eax
lea eax, [ebp - 0x62c]
push 0x10
push eax
call fcn.0040af16
push 8
lea eax, [ebp - 0x62c]
push str.DYUPD_01
push eax
call fcn.0040aa12
add esp, 0x28
test eax, eax
jne 0x403558
mov edi, dword [ebp - 0x624]
cmp edi, ebx
jg 0x403567
mov dword [ebp - 0x69c], 5
jmp 0x403608
mov esi, 0x400
cmp edi, esi
mov dword [ebp - 0x6a0], edi
jle 0x403578
mov edi, esi
push 0x41bef8
push dword [ebp - 0x6a8]
lea eax, [ebp - 0x6a4]
push eax
call fcn.00408d2b
add esp, 0xc
test eax, eax
jne 0x4033bb
cmp edi, ebx
jle 0x4035f6
push dword [ebp - 0x698]
lea eax, [ebp - 0x61c]
push edi
push 1
push eax
call fcn.0040af16
add esp, 0x10
cmp eax, ebx
je 0x4035f6
mov edi, dword [ebp - 0x6a0]
mov ecx, edi
sub ecx, eax
js 0x4035f6
push dword [ebp - 0x6a4]
push eax
lea eax, [ebp - 0x61c]
push 1
push eax
call fcn.0040b04b
sub edi, eax
add esp, 0x10
cmp edi, esi
mov dword [ebp - 0x6a0], edi
jle 0x4035ee
mov edi, esi
jmp 0x40359e
cmp dword [ebp - 0x6a0], ebx
jg 0x40359e
cmp dword [ebp - 0x6a0], ebx
je 0x403608
mov dword [ebp - 0x69c], 6
cmp dword [ebp - 0x698], ebx
je 0x40361c
push dword [ebp - 0x698]
call fcn.0040a2ed
pop ecx
cmp dword [ebp - 0x6a4], ebx
je 0x403630
push dword [ebp - 0x6a4]
call fcn.0040a2ed
pop ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x69c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408643
leave
ret