Function at 0x401050
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended
Get file size
Parse pe header
Read file via mapping
Resume thread
Suspend thread
Terminate process
Use process replacement

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x22
mov dword [0x408690], 0
je 0x401079
lea esp, [esp]
mov cl, byte [eax + 1]
inc eax
cmp cl, 0x22
jne 0x401070
push ebx
push ebp
push esi
push edi
inc eax
push 0
mov dword [0x408550], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, dword [eax + 0x3c]
mov esi, dword [0x408690]
add edx, eax
mov dword [0x4084dc], eax
movzx eax, word [edx + 6]
cmp esi, eax
lea ecx, [edx + 0xf8]
mov dword [0x4084d8], edx
mov dword [0x4084d4], ecx
jae 0x40112f
mov edi, dword [str..PATCH]
sub eax, esi
mov ebp, eax
mov eax, dword [0x408688]
add esi, ebp
mov dword [0x408690], esi
lea esp, [esp]
movzx ebx, byte [ecx]
movsx esi, byte [edi]
cmp ebx, esi
jne 0x40111c
movsx esi, byte [edi + 1]
movzx ebx, byte [ecx + 1]
cmp ebx, esi
jne 0x40111c
movsx esi, byte [edi + 2]
movzx ebx, byte [ecx + 2]
cmp ebx, esi
jne 0x40111c
movsx esi, byte [edi + 3]
movzx ebx, byte [ecx + 3]
cmp ebx, esi
jne 0x40111c
movsx esi, byte [edi + 4]
movzx ebx, byte [ecx + 4]
cmp ebx, esi
jne 0x40111c
movsx esi, byte [edi + 5]
movzx ebx, byte [ecx + 5]
cmp ebx, esi
jne 0x40111c
mov eax, dword [edx + 0x34]
add eax, dword [ecx + 0xc]
add ecx, 0x28
dec ebp
jne 0x4010d0
mov dword [0x4084d4], ecx
mov dword [0x408688], eax
jmp 0x401134
mov eax, dword [0x408688]
test eax, eax
jne 0x401157
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.Where_is_my_.PATCH_section_
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
mov ecx, dword [eax]
push 0
push 0
push 3
push 0
mov ebp, 1
push ebp
mov dword [0x408684], eax
add eax, 4
push 0x80000000
push eax
mov dword [0x408670], ecx
mov dword [0x408688], eax
mov dword [0x408674], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x40854c], eax
jne 0x4011bb
mov edi, dword [0x408674]
dec edi
lea edx, [edi + 1]
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4011a0
mov ecx, 8
mov esi, str.:_not_found_in_current_directory.
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jmp 0x4019e7
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov ecx, dword [0x408688]
mov eax, ecx
lea esp, [esp]
mov dl, byte [eax]
inc eax
inc ecx
test dl, dl
jne 0x4011d0
mov edx, dword [ecx]
add ecx, 4
mov dword [0x40866c], edx
mov dword [0x408668], ecx
mov eax, ecx
jmp 0x4011f0
mov dl, byte [eax]
inc eax
inc ecx
test dl, dl
mov byte [0x408678], dl
jne 0x4011f0
mov dword [0x40867c], eax
mov eax, 0xcccccccd
mul dword [ecx]
mov eax, dword [ecx + 4]
add ecx, 4
mov dword [0x408684], ecx
shr edx, 3
cmp eax, ebp
mov dword [0x408660], eax
sete al
add ecx, 4
mov dword [0x408688], ecx
mov byte [0x40865d], al
xor eax, eax
push 0x4084e0
mov ecx, 0x11
mov edi, 0x4084f0
rep stosd dword es:[edi], eax
mov eax, dword [0x408674]
xor ecx, ecx
push 0x4084f0
mov dword [0x4084e0], ecx
mov dword [0x4084e4], ecx
mov dword [0x4084e8], ecx
push ecx
push ecx
push 0x24
push ecx
push ecx
mov dword [0x408664], edx
mov edx, dword [0x408550]
push ecx
push edx
push eax
mov dword [0x4084ec], ecx
mov dword [0x4084f0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4012b0
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.Process_creation_error.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
cmp dword [0x40866c], ebp
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
je 0x40131d
mov ecx, dword [0x4084e4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x40866c]
sub eax, 2
mov dword [0x40868c], ebp
je 0x40137a
dec eax
jne 0x401306
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push ebp
call edi
dec dword [0x408664]
je 0x401355
mov edx, dword [0x408668]
push edx
push 0
push 0
push 0
call esi
test eax, eax
je 0x4012e8
mov ecx, dword [0x4084e4]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [0x40868c], 0
mov eax, dword [0x408688]
mov byte [0x40865c], 1
lea esp, [esp]
mov ecx, dword [eax]
mov dword [0x408684], eax
add eax, 4
cmp ecx, 3
mov dword [0x4084c8], ecx
mov dword [0x408688], eax
ja case.default.0x40134e
jmp dword [ecx*4 + 0x401a9c]
call fcn.00401020
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.Timeout:
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
push ebp
call edi
dec dword [0x408664]
je 0x4013a2
mov eax, dword [0x408668]
push 0
push eax
push 0
push 0
call esi
test eax, eax
je 0x401380
jmp 0x401306
call fcn.00401020
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.Timeout.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
movzx edx, word [eax]
push edx
mov dword [0x408680], eax
call edi
mov eax, dword [0x408688]
add eax, 2
mov dword [0x408688], eax
jmp case.0x40134e.0
mov eax, dword [0x4084e4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [0x40868c], 1
jmp 0x401818
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
mov dl, byte [eax + 1]
setne cl
push 0
push 0x80
push 3
mov byte [0x4084b8], dl
movzx edx, dl
mov dword [0x408538], ecx
lea ecx, [eax + 1]
inc ecx
push 0
mov dword [0x4084c0], ecx
add ecx, edx
push 1
mov dword [0x40867c], ecx
mov dword [0x4084c4], ecx
mov ecx, dword [0x408674]
push 0x80000000
lea eax, [eax + edx*2 + 2]
push ecx
mov dword [0x408688], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
test eax, eax
mov dword [0x40854c], eax
je 0x40183c
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [0x40854c]
push 0
push 0
push 0
push 2
push 0
push edx
mov dword [0x408544], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [0x408548], eax
je 0x401861
push 0
push 0
push 0
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [0x408540], eax
je 0x40188f
mov eax, dword [0x408548]
push eax
call ebx
mov ecx, dword [0x40854c]
push ecx
call ebx
mov edi, dword [0x408540]
cmp word [edi], 0x5a4d
mov dword [0x4084dc], edi
jne 0x4018c5
mov ebp, dword [edi + 0x3c]
mov eax, dword [ebp + edi]
add ebp, edi
cmp eax, 0x4550
mov dword [0x4084d8], ebp
jne 0x4018f7
movzx ecx, byte [0x4084b8]
xor eax, eax
test ecx, ecx
jbe 0x401522
mov esi, dword [0x4084c0]
sub esi, 0x408558
mov dl, byte [eax + esi + 0x408558]
mov byte [eax + 0x408558], dl
inc eax
cmp eax, ecx
jb 0x401510
mov edx, dword [0x408544]
xor ecx, ecx
xor eax, eax
mov dword [0x408534], eax
mov esi, edi
jmp 0x401540
movzx edi, byte [0x4084b8]
jmp 0x401550
mov bl, byte [esi]
cmp bl, byte [ecx + 0x408558]
jne 0x40155d
inc ecx
jmp 0x40155f
xor ecx, ecx
inc eax
inc esi
cmp ecx, edi
mov dword [0x40853c], ecx
mov dword [0x408690], eax
mov dword [0x40867c], esi
je 0x4015c5
cmp eax, edx
jb 0x401550
mov eax, dword [0x408540]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x408534]
test eax, eax
jne 0x401818
mov al, byte [0x40865d]
test al, al
jne 0x401818
call fcn.00401020
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.SR:_Wrong_version.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
cmp eax, edx
jae 0x40157a
sub eax, edi
mov edx, eax
cmp edx, dword [ebp + 0x54]
mov dword [0x408534], 1
mov byte [0x40865c], 0
jae 0x4015e8
mov eax, dword [ebp + 0x34]
jmp 0x40161d
mov eax, dword [ebp + 0x10c]
cmp edx, eax
lea ecx, [ebp + 0xf8]
jb 0x401607
mov eax, dword [ecx + 0x4c]
add ecx, 0x28
test eax, eax
je 0x401607
cmp edx, dword [ecx + 0x14]
jae 0x4015f8
mov eax, dword [ebp + 0x34]
mov ebx, dword [ecx - 0x14]
mov esi, dword [ecx - 0x1c]
sub ecx, 0x28
sub eax, ebx
mov dword [0x4084d4], ecx
add eax, esi
push 0x4084b0
push 4
add eax, edx
push edi
push eax
mov eax, dword [0x4084e0]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movzx esi, byte [0x4084b8]
mov ecx, dword [0x408690]
mov eax, dword [0x4084d8]
mov edx, dword [eax + 0x54]
sub ecx, esi
cmp ecx, edx
jae 0x401654
mov eax, dword [eax + 0x34]
jmp 0x401689
mov edi, dword [eax + 0x10c]
cmp ecx, edi
lea edx, [eax + 0xf8]
jb 0x401673
mov edi, dword [edx + 0x4c]
add edx, 0x28
test edi, edi
je 0x401673
cmp ecx, dword [edx + 0x14]
jae 0x401664
mov eax, dword [eax + 0x34]
mov ebx, dword [edx - 0x14]
mov edi, dword [edx - 0x1c]
sub edx, 0x28
sub eax, ebx
mov dword [0x4084d4], edx
add eax, edi
mov edx, dword [0x4084e0]
push 0x4084d0
add eax, ecx
mov ecx, dword [0x4084c4]
push esi
push ecx
push eax
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401929
mov eax, dword [0x408690]
mov edx, dword [0x408544]
cmp eax, edx
jae 0x40157a
mov ecx, dword [0x408538]
test ecx, ecx
je 0x40157a
mov ebp, dword [0x4084d8]
mov esi, dword [0x40867c]
xor ecx, ecx
jmp 0x401540
mov cl, byte [eax]
mov byte [0x4084b8], cl
movzx ecx, cl
lea edx, [eax + ecx*2 + 1]
inc eax
mov dword [0x4084c0], eax
add eax, ecx
mov dword [0x40867c], eax
mov dword [0x4084c4], eax
mov eax, dword [0x408670]
mov dword [0x408688], edx
mov dword [0x408658], eax
mov dword [0x4084b4], 0
lea ecx, [ecx]
mov edx, dword [0x4084e0]
push 0x4084cc
push ecx
mov ecx, dword [0x4084c8]
push 0x408558
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x40195a
mov eax, dword [0x4084c0]
mov bl, byte [eax]
mov dl, byte [0x4084b8]
xor esi, esi
cmp bl, byte [0x408558]
mov dword [0x4084bc], 0x408558
movzx ecx, dl
jne 0x401780
mov edi, 0x408558
sub edi, eax
cmp esi, ecx
jge 0x401782
mov bl, byte [eax + 1]
inc esi
inc eax
cmp bl, byte [edi + eax]
je 0x401772
cmp esi, ecx
je 0x4017b0
dec dword [0x408658]
je 0x401797
mov eax, dword [0x4084b4]
test eax, eax
je 0x401720
jmp 0x4017ba
mov al, byte [0x40865d]
test al, al
je 0x4019a0
mov dword [0x4084b4], 1
jmp 0x401818
mov dword [0x4084b4], 1
mov eax, dword [0x408658]
test eax, eax
je 0x401818
mov ecx, dword [0x4084c8]
push 0x4084b0
movzx eax, dl
mov edx, dword [0x4084e0]
push 4
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
movzx eax, byte [0x4084b8]
mov ecx, dword [0x4084c4]
mov edx, dword [0x4084c8]
push 0x4084d0
push eax
mov eax, dword [0x4084e0]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x401a03
mov byte [0x40865c], 0
mov eax, dword [0x408688]
mov ecx, dword [0x4084c8]
test ecx, ecx
je 0x401a28
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401330
call fcn.00401020
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.SR:_Target_file_mapping_error__1_.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.SR:_Target_file_mapping_error__2_.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x40854c]
push ecx
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.SR:_Target_file_mapping_error__3_.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0x408548]
push edx
call ebx
mov eax, dword [0x40854c]
push eax
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.SR:_Error___invalid_PE_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x408540]
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.SR:_Error___invalid_PE_file.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [0x408540]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.SR:_Process_memory_writing_error.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x408540]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
mov ecx, dword [0x4084e0]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x4084e0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x4084e4]
push eax
call esi
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.Process_memory_reading_error.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
mov ecx, dword [0x4084e0]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edx, dword [0x4084e0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x4084e4]
push eax
call esi
mov edi, dword [0x408674]
dec edi
lea edx, [edi + 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4019d0
mov ecx, 6
mov esi, str.:_wrong_version_or_packed.
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 0x40010
push str.PMaker_Process_Patcher_2.0
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
call fcn.00401020
push 0x40010
push str.PMaker_Process_Patcher_2.0
push str.Process_memory_writing_error.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
mov al, byte [0x40865c]
test al, al
je 0x401a65
call fcn.00401020
mov edi, dword [0x408674]
dec edi
lea eax, [edi + 1]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401a40
mov ecx, 0xc
mov esi, str.:_wrong_version_or_packed__all_bytes_are_missing_.
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00401000
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
mov eax, dword [0x40868c]
test eax, eax
jne 0x401a7b
mov ecx, dword [0x4084e4]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, dword [0x4084e0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x4084e4]
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10