Function at 0x4013a4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00401ac0
test esi, esi
jne 0x4013da
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00401bac
jmp 0x4013f8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004012b8
mov edi, eax
test esi, esi
je 0x4013f8
cmp dword [ebx], 0
je 0x4013f8
dec esi
jmp 0x4013e1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4037ec
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40386a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40
push 0x3000
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00401cac
mov eax, dword [ebp - 8]
call fcn.00401d50
inc eax
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00401cac
mov eax, dword [ebp - 0xc]
call fcn.00401d50
inc eax
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_WriteProcessMemory
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403871
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00401ae4
ret

Function at 0x40387c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
mov ebx, eax
push 0x40
push 0x3000
push esi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
push esp
push esi
push ebp
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
mov eax, edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4038ac
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040387c
mov esi, eax
mov eax, edi
call fcn.004037dc
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.0040387c
lea edx, [ebp - 0xc]
push edx
push 0
push esi
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
cmp byte [ebp + 8], 0
je 0x403912
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_ReadProcessMemory
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x403c98
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x403ca7
or edx, 0x200
test eax, 0x20000000
je 0x403cdb
test eax, 0x40000000
je 0x403cc6
test eax, 0x80000000
je 0x403cc1
or edx, 0x40
jmp 0x403d02
or edx, 0x20
jmp 0x403d02
test eax, 0x80000000
je 0x403cd5
or edx, 0x80
jmp 0x403d02
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x403cf3
test eax, 0x80000000
je 0x403cee
or edx, 4
jmp 0x403d02
or edx, 2
jmp 0x403d02
test eax, 0x80000000
je 0x403cff
or edx, 8
jmp 0x403d02
or edx, 1
mov eax, edx
ret