Function at 0x409700
Capabilities:
Parse pe header
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x4522d0]
xor eax, esp
mov dword [esp + 0x120], eax
push ebx
push esi
push edi
push 0xff
xor esi, esi
lea eax, [esp + 0x2d]
push esi
push eax
mov byte [esp + 0x34], 0
call fcn.00415c90
add esp, 0xc
cmp dword [0x461af4], esi
mov dword [esp + 0x10], esi
jne 0x409790
push str.Please_Load_a_nanomites_file_to_continue__n
push 0x4610a8
call fcn.00415641
add esp, 8
push 0x1040
push 0x448c20
push 0x4610a8
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x4535f8]
push esi
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00415a83
mov esp, ebp
pop ebp
ret
cmp dword [0x461afc], esi
jne 0x4097e5
push str.Please_Load_a_nanomites_log_file_to_continue__n
push 0x4610a8
call fcn.00415641
add esp, 8
push 0x1040
push 0x448c20
push 0x4610a8
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0x4535f8]
push esi
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00415a83
mov esp, ebp
pop ebp
ret
push 0x4603b0
call fcn.00403640
add esp, 4
test eax, eax
je 0x40a016
mov ecx, dword [0x45fb58]
mov eax, dword [0x45fbac]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x462620
push esi
push 0x1007
push ecx
mov dword [0x462634], 0x44976c
mov dword [0x462624], eax
call edi
add dword [0x45fbac], 1
push esi
push 0x80
push 3
push esi
push 3
push 0xc0000000
push 0x4603b0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40989c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4603b0
push str.Could_not_open_saved_dump_file:__s_nCreateFile_error__d_n
push 0x4610a8
call fcn.00415641
add esp, 0x10
push 0x1010
push 0x448c14
push 0x4610a8
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00415a83
mov esp, ebp
pop ebp
ret
mov edx, dword [0x452114]
push 4
push 0x3000
push edx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp eax, esi
mov dword [0x460f84], eax
jne 0x4098fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.VirtualAlloc_error__d_nDumping_PE_header_information
push 0x4610a8
call fcn.00415641
push 0x4610a8
call fcn.00403960
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00415a83
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x452114]
push esi
push 0x460f1c
push ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x460f84]
mov dword [0x462730], eax
mov dword [0x45bb04], eax
mov edx, dword [eax + 0x3c]
lea ecx, [edx + eax + 4]
mov dword [0x453610], ecx
mov edx, dword [eax + 0x3c]
lea ecx, [edx + eax + 0x18]
mov dword [0x4535a4], ecx
mov edx, dword [eax + 0x3c]
lea edx, [edx + eax + 0xf8]
mov dword [0x453618], edx
cmp word [eax], 0x5a4d
je 0x40998a
push str.IMAGE_DOS_SIGNATURE_nunrecognized_file_format_n
push 0x4610a8
call fcn.00415641
push 0x4610a8
call fcn.00403960
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00415a83
mov esp, ebp
pop ebp
ret
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx], 0x4550
je 0x4099d0
push str.IMAGE_NT_SIGNATURE_nNot_a_valid_PE_file_n
push 0x4610a8
call fcn.00415641
push 0x4610a8
call fcn.00403960
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00415a83
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 0x1c]
mov dword [0x462718], eax
mov eax, dword [0x461af4]
cmp eax, esi
mov dword [esp + 0x14], esi
jle 0x409ef4
mov dword [esp + 0x18], 0x4628bc
mov ecx, dword [0x4619dc]
lea edx, [esi + ecx]
push edx
lea eax, [esp + 0x24]
push eax
mov ecx, 0x4628bc
call fcn.00414400
mov ecx, dword [eax]
mov dword [0x4628c8], ecx
mov edx, dword [eax + 4]
mov eax, dword [0x4628c0]
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x4628c8
mov dword [0x4628cc], edx
mov dword [esp + 0x20], eax
call fcn.00413e90
test al, al
jne 0x409af6
push 0x100
lea edx, [esp + 0x2c]
push 0
push edx
call fcn.00415c90
push 0x338
push 0
push 0x461b58
call fcn.00415c90
mov eax, dword [0x453618]
mov ecx, dword [eax + 0x10]
add ecx, dword [eax + 0x14]
add esp, 0x18
mov dword [0x4535bc], ecx
mov edx, dword [eax + 8]
add edx, dword [eax + 0xc]
mov ecx, dword [0x4619dc]
mov dword [0x45fb1c], edx
mov edx, dword [esi + ecx]
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 0x14]
sub edx, dword [0x462718]
push 0
push 0
lea ecx, [edx + eax - 2]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0x460f1c
push 0x100
lea edx, [esp + 0x34]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, byte [esp + 0x28]
cmp al, 0x84
jne 0x409ace
mov al, byte [esp + 0x29]
cmp al, 0xc0
je 0x409af6
cmp al, 0xdb
jmp 0x409af0
cmp al, 0x85
jne 0x409ecf
mov al, byte [esp + 0x29]
cmp al, 0xc0
je 0x409af6
cmp al, 0xdb
je 0x409af6
cmp al, 0xc9
je 0x409af6
cmp al, 0xd2
je 0x409af6
cmp al, 0xff
je 0x409af6
cmp al, 0xf6
jne 0x409ecf
push 0x100
push 0
push 0x461e90
call fcn.00415c90
push 0x100
push 0
push 0x461f90
call fcn.00415c90
xor eax, eax
push 0x100
push eax
push 0x453648
mov dword [0x462090], eax
mov dword [0x462094], eax
mov dword [0x462098], eax
mov dword [0x46209c], eax
call fcn.00415c90
mov eax, dword [0x4619dc]
mov eax, dword [esi + eax + 0xc]
add eax, 0xfffffffe
add esp, 0x24
cmp eax, 0x16
ja case.default.0x409b56
jmp dword [eax*4 + 0x40a034]
push 0x449854
push 0x449858
jmp 0x409c93
push 0x44985c
push 0x449860
jmp 0x409c93
push 0x449864
push 0x449868
jmp 0x409c93
push 0x44986c
push 0x449870
jmp 0x409c93
push 0x449874
push 0x449878
jmp 0x409c93
push 0x44987c
push 0x449884
jmp 0x409c93
push 0x449888
push 0x449890
jmp 0x409c93
push 0x449894
push 0x449898
jmp 0x409c93
push 0x44989c
push 0x4498a0
jmp 0x409c93
push 0x4498a4
push 0x4498a8
jmp 0x409c93
push 0x4498ac
push 0x4498b0
jmp 0x409c93
push 0x4498b4
push 0x4498b8
jmp 0x409c93
push 0x4498bc
push 0x4498c0
jmp 0x409c93
push 0x4498c4
push 0x4498c8
jmp 0x409c93
push 0x4498cc
push 0x4498d0
jmp 0x409c93
push 0x4498d4
push 0x4498d8
jmp 0x409c93
push 0x4498dc
push 0x4498e0
jmp 0x409c93
push 0x4498e4
push 0x4498e8
jmp 0x409c93
push 0x4498ec
push 0x4498f0
jmp 0x409c93
push 0x4498f4
push 0x4498f8
jmp 0x409c93
push 0x4498fc
push 0x449900
jmp 0x409c93
push 0x449904
push 0x449908
jmp 0x409c93
push 0x44990c
push 0x449910
push 0x461e90
call fcn.00415641
add esp, 0xc
mov ecx, dword [0x4619dc]
mov edx, dword [esi + ecx + 4]
push edx
push 0x449914
push 0x461f90
call fcn.00415641
push 0x461f90
push 0x461e90
push 0x449918
push 0x462090
call fcn.00415641
push 0x30
push 0
push 0x461b28
call fcn.00415c90
mov eax, dword [0x4619dc]
add esp, 0x28
push 0x4620a0
push 0
push 0
mov dword [0x461b24], 0x462090
mov dword [0x4535c4], 0
mov ecx, dword [esi + eax]
push 0x461b28
push ecx
push 0x462090
call dword [sym.imp.disasm.dll__Assemble_24]
test eax, eax
mov dword [0x4535c4], eax
jg 0x409e8a
push 0x50
push 0
push 0x45fbb0
call fcn.00415c90
push 0x4620a0
push 0x449920
push 0x45fbb0
call fcn.00415641
mov eax, dword [0x45fb58]
mov edx, dword [0x45fbac]
add esp, 0x18
push 0x462620
push 0
push 0x1007
push eax
mov dword [0x462634], 0x45fbb0
mov dword [0x462624], edx
call edi
add dword [0x45fbac], 1
push 0x50
push 0
push 0x45fbb0
call fcn.00415c90
mov ecx, dword [0x4619dc]
mov edx, dword [esi + ecx]
push edx
push 0x44992c
push 0x45fbb0
call fcn.00415641
mov ecx, dword [0x45fb58]
mov eax, dword [0x45fbac]
add esp, 0x18
push 0x462620
push 0
push 0x1007
push ecx
mov dword [0x462634], 0x45fbb0
mov dword [0x462624], eax
call edi
add dword [0x45fbac], 1
push 0x50
push 0
push 0x45fbb0
call fcn.00415c90
push 0x461e90
push 0x44993c
push 0x45fbb0
call fcn.00415641
mov eax, dword [0x45fb58]
mov edx, dword [0x45fbac]
add esp, 0x18
push 0x462620
push 0
push 0x1007
push eax
mov dword [0x462634], 0x45fbb0
mov dword [0x462624], edx
call edi
add dword [0x45fbac], 1
push 0x50
push 0
push 0x45fbb0
call fcn.00415c90
mov ecx, dword [0x4619dc]
mov edx, dword [esi + ecx + 4]
push edx
push 0x44994c
push 0x45fbb0
call fcn.00415641
mov ecx, dword [0x45fb58]
mov eax, dword [0x45fbac]
add esp, 0x18
push 0x462620
push 0
push 0x1007
push ecx
mov dword [0x462634], 0x45fbb0
mov dword [0x462624], eax
call edi
add dword [0x45fbac], 1
jmp 0x409ecf
mov edx, dword [0x4619dc]
mov eax, dword [0x453618]
mov ecx, dword [esi + edx]
sub ecx, dword [eax + 0xc]
push 0
add ecx, dword [eax + 0x14]
push 0
sub ecx, dword [0x462718]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [0x4535c4]
push 0
push 0x460f20
push edx
push 0x461b28
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
add dword [esp + 0x10], 1
mov ecx, dword [esp + 0x14]
mov eax, dword [0x461af4]
add ecx, 1
add esi, 0x10
cmp ecx, eax
mov dword [0x46164c], 0
mov dword [esp + 0x14], ecx
jl 0x4099f1
push 0xa
push 0x4612a8
push eax
call fcn.004231b8
push 0x4612a8
push 0x44995c
mov esi, 0x45fbb0
push esi
call fcn.00415641
mov ecx, dword [0x45fb58]
mov eax, dword [0x45fbac]
add esp, 0x18
push 0x462620
push 0
push 0x1007
push ecx
mov dword [0x462634], esi
mov dword [0x462624], eax
call edi
mov edx, dword [esp + 0x10]
add dword [0x45fbac], 1
push 0xa
push 0x4612a8
push edx
call fcn.004231b8
push 0x4612a8
push 0x449974
push esi
call fcn.00415641
mov ecx, dword [0x45fb58]
mov eax, dword [0x45fbac]
add esp, 0x18
push 0x462620
push 0
push 0x1007
push ecx
mov dword [0x462634], esi
mov dword [0x462624], eax
call edi
mov eax, dword [0x45fbac]
mov edx, dword [0x45fb58]
push 0x462620
push 0
add eax, 1
push 0x1007
push edx
mov dword [0x45fbac], eax
mov dword [0x462634], 0x449988
mov dword [0x462624], eax
call edi
add dword [0x45fbac], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4628c4], 0
je 0x409fe0
mov ecx, 0x4628bc
call fcn.004143d0
mov eax, dword [0x4619dc]
test eax, eax
je 0x409ffc
push eax
call fcn.00415d0a
add esp, 4
mov dword [0x4619dc], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, esp
call fcn.00415a83
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
pop edi
mov dword [0x4603b0], esi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00415a83
mov esp, ebp
pop ebp
ret