Function at 0x407c20
Capabilities:
Execute command
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x724
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x720], eax
mov cx, word [0x40d97c]
mov dl, byte [0x40d97e]
mov word [esp + 8], cx
push ebx
push esi
push edi
mov eax, 0xa
mov word [esp + 0x10], ax
mov eax, dword [str.System:_CPS1]
mov dword [esp + 0x11c], eax
movzx eax, byte [0x40d9f0]
mov byte [esp + 0x16], dl
mov edx, dword [0x40d9ec]
mov byte [esp + 0x128], al
movzx eax, word [0x40d9fc]
mov ecx, 0xc
mov esi, str.__________________________________________________
lea edi, [esp + 0x12c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x40d9e8]
mov dword [esp + 0x120], ecx
mov ecx, dword [str.RomName:]
mov dword [esp + 0x124], edx
mov edx, dword [0x40d9f8]
mov dword [esp + 0x110], ecx
mov ecx, dword [str.Game:]
mov word [esp + 0x118], ax
movzx eax, byte [0x40da06]
mov dword [esp + 0x114], edx
mov dx, word [0x40da04]
mov dword [esp + 0xe4], ecx
mov ecx, dword [str.Parent:]
mov word [esp + 0xe8], dx
mov edx, dword [0x40da0c]
mov byte [esp + 0xea], al
movzx eax, byte [0x40da10]
mov dword [esp + 0xec], ecx
mov ecx, dword [str.Drivers_:]
mov dword [esp + 0xf0], edx
mov edx, dword [0x40da18]
mov dword [esp + 0x104], ecx
movzx ecx, byte [0x40da1e]
mov byte [esp + 0xf4], al
movzx eax, word [0x40da1c]
mov dword [esp + 0x108], edx
mov edx, dword [str._System_]
mov byte [esp + 0x10e], cl
movzx ecx, byte [0x40da28]
push 0xbc
movsw word es:[edi], word [esi]
mov dword [esp + 0xfc], edx
mov word [esp + 0x110], ax
mov eax, dword [0x40da24]
lea edx, [esp + 0x24]
push 0
push edx
movsb byte es:[edi], byte [esi]
mov dword [esp + 0x108], eax
mov byte [esp + 0x10c], cl
mov dword [esp + 0x24], 0x53a960
call sub.MSVCR90.dll_memset
push 0x40d548
push str.Cps1RomData.Dat
call dword [sym.imp.MSVCR90.dll_fopen]
mov ebx, eax
call fcn.00408200
push str.Save_Cps1_RomData_..._n_n
mov dword [esp + 0x34], eax
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 0x18
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ebx, [ebx]
mov ecx, dword [esp + 0x18]
mov edx, dword [0x438028]
push 0
push 0xbc
lea eax, [esp + 0x28]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [esp + 0x3c], 1
jne 0x408188
push 0x100
lea eax, [esp + 0x164]
push 0
push eax
call sub.MSVCR90.dll_memset
push 0x100
lea ecx, [esp + 0x270]
push 0
push ecx
call sub.MSVCR90.dll_memset
push 0x100
lea edx, [esp + 0x37c]
push 0
push edx
call sub.MSVCR90.dll_memset
lea eax, [esp + 0x150]
add esp, 0x24
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407e42
mov esi, dword [sym.imp.MSVCR90.dll_fwrite]
sub eax, edx
push ebx
push eax
lea eax, [esp + 0x134]
push 1
push eax
call esi
lea eax, [esp + 0x24]
add esp, 0x10
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407e70
push ebx
sub eax, edi
push eax
lea ecx, [esp + 0x1c]
push 1
push ecx
call esi
lea eax, [esp + 0x12c]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407e91
push ebx
sub eax, edi
push eax
lea edx, [esp + 0x124]
push 1
push edx
call esi
lea eax, [esp + 0x20]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407eb2
sub eax, edi
push ebx
push eax
lea eax, [esp + 0x18]
push 1
push eax
call esi
lea eax, [esp + 0x120]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407ed3
push ebx
sub eax, edi
push eax
lea ecx, [esp + 0x118]
push 1
push ecx
call esi
mov eax, dword [esp + 0x34]
add esp, 0x10
lea ecx, [esp + 0x260]
call fcn.00401080
lea eax, [esp + 0x260]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407f07
push ebx
sub eax, edi
push eax
lea edx, [esp + 0x268]
push 1
push edx
call esi
lea eax, [esp + 0x20]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407f28
sub eax, edi
push ebx
push eax
lea eax, [esp + 0x18]
push 1
push eax
call esi
lea eax, [esp + 0xf4]
add esp, 0x10
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407f50
push ebx
sub eax, edi
push eax
lea ecx, [esp + 0xec]
push 1
push ecx
call esi
mov eax, dword [esp + 0x30]
add esp, 0x10
lea ecx, [esp + 0x160]
call fcn.00401080
lea eax, [esp + 0x160]
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407f84
push ebx
sub eax, edi
push eax
lea edx, [esp + 0x168]
push 1
push edx
call esi
lea eax, [esp + 0x20]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407fa5
sub eax, edi
push ebx
push eax
lea eax, [esp + 0x18]
push 1
push eax
call esi
mov edi, dword [sym.imp.MSVCR90.dll_printf]
lea ecx, [esp + 0xf4]
push ecx
call edi
lea edx, [esp + 0x174]
push edx
call edi
push 0x40d970
call edi
add esp, 0x1c
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x28], 0
je 0x408068
lea eax, [esp + 0xec]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x407ff6
sub eax, edx
push ebx
push eax
lea eax, [esp + 0xf4]
push 1
push eax
call esi
mov eax, dword [esp + 0x38]
add esp, 0x10
lea ecx, [esp + 0x360]
call fcn.00401080
lea eax, [esp + 0x360]
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408030
push ebx
sub eax, edi
push eax
lea ecx, [esp + 0x368]
push 1
push ecx
call esi
lea eax, [esp + 0x20]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408051
sub eax, edx
push ebx
push eax
lea edx, [esp + 0x18]
push 1
push edx
call esi
add esp, 0x10
lea eax, [esp + 0x10]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408070
sub eax, edx
push ebx
push eax
lea eax, [esp + 0x18]
push 1
push eax
call esi
mov ecx, dword [esp + 0x2c]
push ecx
lea edx, [esp + 0x34]
push edx
mov edi, ebx
call fcn.00407790
push 0x211
lea eax, [esp + 0x52c]
push 0
mov ecx, 0x2c
lea esi, [esp + 0x4c]
lea edi, [esp + 0x480]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.MSVCR90.dll_memset
add esp, 0x24
lea edx, [esp + 0x510]
lea ecx, [esp + 0x460]
call fcn.00407710
lea eax, [esp + 0xf8]
lea esi, [eax + 1]
jmp 0x4080e0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4080e0
sub eax, esi
mov esi, dword [sym.imp.MSVCR90.dll_fwrite]
push ebx
push eax
lea ecx, [esp + 0x100]
push 1
push ecx
call esi
lea eax, [esp + 0x20]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408107
push ebx
sub eax, edi
push eax
lea edx, [esp + 0x18]
push 1
push edx
call esi
lea eax, [esp + 0x114]
add esp, 0x10
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408128
sub eax, edi
push ebx
push eax
lea eax, [esp + 0x10c]
push 1
push eax
call esi
lea eax, [esp + 0x520]
add esp, 0x10
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408150
push ebx
sub eax, edi
push eax
lea ecx, [esp + 0x518]
push 1
push ecx
call esi
lea eax, [esp + 0x24]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408171
sub eax, edx
push ebx
push eax
lea edx, [esp + 0x1c]
push 1
push edx
call esi
add esp, 0x10
add dword [esp + 0x18], 0xbc
cmp dword [esp + 0x20], 0
jne 0x407dd0
lea eax, [esp + 0x12c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4081a5
sub eax, edx
push ebx
push eax
lea eax, [esp + 0x134]
push 1
push eax
call dword [sym.imp.MSVCR90.dll_fwrite]
push ebx
call dword [sym.imp.MSVCR90.dll_fclose]
mov esi, dword [sym.imp.MSVCR90.dll_printf]
push 0x40d970
call esi
push str.Cps1RomData.Dat_n_n
call esi
push str.pause
call dword [sym.imp.MSVCR90.dll_system]
mov ecx, dword [esp + 0x74c]
add esp, 0x20
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004098be
mov esp, ebp
pop ebp
ret