Function at 0x401081
Capabilities:
Accept command line arguments
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, 0x64
lea ecx, [esp]
mov dword [ebp - 0xc], edi
mov ax, 0x90
lea edx, [esp]
lea edi, [esp]
mov edx, dword [ebp]
mov esi, edx
lea eax, [ebp]
mov esi, eax
mov esi, edx
mov edi, 4
lea esi, [esp]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp]
lea edx, [esp]
lea esi, [ebp - 0x14]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov edx, 0x52
mov edi, dword [ebp]
lea ecx, [esp]
mov di, 4
mov edi, dword [ebp - 4]
lea edi, [esp]
mov esi, edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], edx
lea esi, [ebp]
lea eax, [ebp]
lea edi, [ebp - 8]
mov eax, edx
mov edx, 0x40
mov edi, dword [ebp]
mov esi, ecx
mov dword [ebp - 0xc], edx
mov edx, dword [esp]
lea ecx, [ebp]
mov ecx, 0x29
mov edi, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
lea esi, [ebp - 8]
mov edi, 4
mov ecx, pe_nt_image_headers32
and dword [ebp - 0x14], 0xff00ff
or dword [ebp - 4], 0xffff
mov ecx, 0x10
cmp ecx, dword [ebp - 4]
jne 0x40113e
mov edx, dword [ebp - 4]
sub dword [ebp - 0x14], 0x40
test edx, edx
jbe 0x401142
mov dx, 0x45
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edi, [esp]
mov eax, dword [ebp]
mov dword [ebp - 4], ecx
mov esi, dword [ebp]
mov ecx, 0x85
mov esi, dword [esp]
mov eax, edx
mov edi, dword [esp]
mov edi, dword [esp]
lea edx, [esp]
lea ecx, [esp]
mov edx, dword [ebp]
lea edx, [esp]
mov eax, dword [ebp - 4]
mov edx, 0x40
mov dword [ebp - 4], edi
mov edi, eax
mov edi, dword [ebp - 8]
lea edx, [esp]
mov edx, 0x40
lea edi, [ebp - 8]
lea eax, [ebp - 0x10]
mov eax, 0x61
lea eax, [esp]
mov dword [ebp - 0x14], eax
lea eax, [ebp]
lea edx, [esp]
mov esi, edi
lea edx, [esp]
lea esi, [ebp - 0x14]
lea ecx, [ebp - 8]
lea esi, [esp]
mov dword [ebp - 8], eax
mov dword [ebp - 8], esi
mov edi, dword [ebp - 0x10]
mov eax, esi
lea ecx, [ebp - 0x10]
lea edx, [ebp]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp]
mov esi, dword [esp]
mov edi, ecx
lea edi, [ebp]
push 4
push 0x8000
push 0x200
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
lea edi, [ebp]
mov dx, 1
mov di, 0xc
lea ecx, [ebp - 4]
lea eax, [ebp]
mov dword [ebp - 8], esi
lea esi, [ebp]
lea edx, [esp]
mov edi, 1
lea ecx, [esp]
mov eax, dword [esp]
lea esi, [ebp]
mov ecx, 4
mov edi, dword [ebp - 0xc]
lea ecx, [ebp]
lea edi, [ebp]
lea esi, [ebp - 4]
mov edi, eax
lea edi, [ebp]
mov dword [ebp - 0x10], edx
mov edi, ecx
mov dword [ebp - 0x10], edx
mov eax, 0x20
lea eax, [ebp - 8]
mov edi, dword [ebp - 4]
mov dword [ebp - 0x14], esi
mov ecx, eax
mov di, 0x4c
mov ecx, dword [esp]
mov cx, 0x40
lea eax, [esp]
mov edi, dword [ebp]
lea eax, [ebp - 0xc]
lea edi, [esp]
mov edx, 4
lea esi, [esp]
mov edx, dword [ebp]
mov dword [ebp - 0xc], edx
lea ecx, [esp]
mov ecx, dword [ebp]
push 8
push 0x2000
push 0x900
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ax, 0x7b
mov esi, edi
lea edi, [ebp]
lea eax, [esp]
mov edi, dword [ebp]
mov dword [ebp - 4], edx
lea ecx, [ebp]
mov esi, edi
mov edi, dword [esp]
lea edi, [ebp - 0x10]
lea ecx, [esp]
mov edi, 4
mov dword [ebp - 0x14], edi
lea ecx, [esp]
mov edi, ecx
mov edi, esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
lea edi, [esp]
mov eax, esi
mov edx, dword [ebp]
lea edi, [esp]
lea edi, [esp]
mov edi, 0x40
mov edx, dword [esp]
mov eax, dword [esp]
mov di, 0x10
mov esi, dword [ebp]
mov edx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
lea edi, [ebp]
lea edi, [ebp]
lea edi, [ebp]
lea edi, [ebp - 4]
mov dword [ebp - 0xc], edi
mov edi, dword [esp]
mov dx, 1
mov eax, dword [ebp]
xor edx, edx
mov cx, 0x30
xor ecx, ecx
and dword [ebp - 0x10], 0xff00ff
call fcn.00401480
sub edx, edx
mov eax, 0x200
lea eax, [ebp - 8]
xor dword [ebp - 0x14], 0xff00ff
mov dword [ebp - 0xc], 0x31
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edi, [ebp - 0x14]
lea edi, [ebp]
mov edi, dword [ebp]
mov dx, 8
mov edi, dword [esp]
lea eax, [ebp - 0xc]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0xc], edi
mov edi, 0xcd
mov dword [ebp - 0xc], edi
mov esi, 0x80
lea esi, [ebp]
mov edi, dword [ebp]
mov edi, dword [esp]
mov edx, 0x23
mov ecx, dword [esp]
mov esi, dword [esp]
mov ecx, esi
mov edi, dword [ebp]
mov edi, dword [ebp - 4]
lea eax, [ebp]
mov edi, dword [ebp]
mov edi, dword [ebp]
mov edi, 0x33
lea esi, [esp]
mov ecx, dword [ebp - 8]
mov eax, edi
mov eax, dword [ebp]
lea esi, [ebp]
mov edi, eax
mov eax, dword [ebp - 0x14]
mov esi, dword [esp]
mov edi, dword [ebp - 0x10]
mov edi, edx
mov edx, dword [ebp]
lea edx, [ebp]
mov ax, 1
mov eax, 0x40
lea esi, [ebp - 8]
push 8
push 0x8000
push 0xc00
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov dword [ebp - 0xc], edi
mov ecx, dword [esp]
lea edi, [ebp]
mov esi, dword [ebp]
mov esi, dword [ebp - 0xc]
mov eax, dword [esp]
lea edx, [ebp]
lea esi, [esp]
mov di, 0xa
mov eax, dword [ebp - 0x10]
mov edi, dword [esp]
lea esi, [ebp]
lea ecx, [esp]
mov eax, 8
mov di, 2
mov eax, dword [esp]
mov edx, dword [esp]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ax, 0x60
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov dword [ebp - 0x10], edi
mov eax, dword [esp]
mov esi, edi
mov dword [ebp - 0x10], edx
mov eax, edi
mov si, 0x80
lea edi, [ebp]
mov di, 0x6c
mov ecx, edx
mov ecx, esi
lea edi, [ebp]
lea ecx, [ebp - 4]
mov edi, edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp]
lea edi, [esp]
mov esi, dword [ebp]
lea edi, [ebp - 0x14]
mov edi, dword [ebp]
lea ecx, [esp]
xor edx, edx
xor eax, eax
call fcn.004037e9
mov eax, 0x64
or dword [ebp - 8], 0xffffff
mov eax, 0x2c
add dword [ebp - 8], 0x80
xor dword [ebp - 8], 0xffffff
cmp dword [ebp - 4], eax
ja 0x401478
mov ecx, 0
or dword [ebp - 4], 0xffffff
mov dword [ebp - 8], 0x80
leave
ret