Function at 0x4013a4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00401ac0
test esi, esi
jne 0x4013da
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00401bac
jmp 0x4013f8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004012b8
mov edi, eax
test esi, esi
je 0x4013f8
cmp dword [ebx], 0
je 0x4013f8
dec esi
jmp 0x4013e1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4037dc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40385a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
push 0x3000
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00401cac
mov eax, dword [ebp - 8]
call fcn.00401d50
inc eax
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00401cac
mov eax, dword [ebp - 0xc]
call fcn.00401d50
inc eax
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_WriteProcessMemory
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403861
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00401ae4
ret

Function at 0x40386c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
mov ebx, eax
push 0x40
push 0x3000
push esi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
push esp
push esi
push ebp
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
mov eax, edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40389c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040386c
mov esi, eax
mov eax, edi
call fcn.004037cc
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.0040386c
lea edx, [ebp - 0xc]
push edx
push 0
push esi
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
cmp byte [ebp + 8], 0
je 0x403902
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_ReadProcessMemory
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x403c88
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x403c97
or edx, 0x200
test eax, 0x20000000
je 0x403ccb
test eax, 0x40000000
je 0x403cb6
test eax, 0x80000000
je 0x403cb1
or edx, 0x40
jmp 0x403cf2
or edx, 0x20
jmp 0x403cf2
test eax, 0x80000000
je 0x403cc5
or edx, 0x80
jmp 0x403cf2
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x403ce3
test eax, 0x80000000
je 0x403cde
or edx, 4
jmp 0x403cf2
or edx, 2
jmp 0x403cf2
test eax, 0x80000000
je 0x403cef
or edx, 8
jmp 0x403cf2
or edx, 1
mov eax, edx
ret