Function at 0x401a36
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push str.NtSuspendProcess
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtResumeProcess
push dword [ebp + 8]
mov dword [0x45f608], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationProcess
push dword [ebp + 8]
mov dword [0x45f60c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationProcess
push dword [ebp + 8]
mov dword [0x45f610], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtQueryInformationThread
push dword [ebp + 8]
mov dword [0x45f614], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtSetInformationThread
push dword [ebp + 8]
mov dword [0x45f618], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlNtStatusToDosError
push dword [ebp + 8]
mov dword [0x45f61c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45f620], eax
mov eax, 0x45f608
pop ebp
ret 4

Function at 0x405d26
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x45d06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xc8
lea eax, [ebp - 0xcc]
mov edi, edx
push 0
push eax
mov ebx, ecx
call fcn.00421350
mov eax, dword [edi]
add esp, 0xc
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x446268]
mov ecx, edi
call esi
push eax
push ebx
push str._s_r_n_s_r_n
lea eax, [ebp - 0xcc]
push 0xffffffffffffffff
push eax
call fcn.00409d9a
add esp, 0x14
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041ebe0
leave
ret

Function at 0x405e3b
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push 0xc
mov eax, 0x44310a
call fcn.0041f670
cmp byte [ecx + 0x6c], 0
mov ebx, dword [ebp + 8]
je 0x405f12
lea edi, [ecx + 0x54]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x405e61
mov eax, dword [edi]
push 0
push 0x80000000
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
cmp esi, 0xffffffff
je 0x405efc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x405ea3
mov edx, 0x40010000
mov ecx, edi
call fcn.00412bed
jmp 0x405edb
cmp dword [edi + 0x14], 8
jb 0x405eab
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x405ece
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.00405534
test eax, eax
jne 0x405ed6
mov eax, dword [ebp - 0x14]
shr eax, 0xa
not al
and eax, 1
cmp eax, 1
jne 0x405efc
push 2
xor edi, edi
push edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
push dword [ebx + 4]
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, 0xffffffff
je 0x405f12
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x405f12
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.0041f61a
ret 4