Function at 0x40262c
Capabilities:
Enumerate pe sections
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1540
call fcn.004075b0
push esi
push edi
xor edi, edi
mov ecx, 0x40a0a0
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.004031de
mov ecx, dword [0x40a074]
mov eax, dword [0x40a070]
mov esi, dword [ebp + 0xc]
sub ecx, eax
sar ecx, 4
mov dword [ebp - 0x24], edi
je 0x402cfa
push ebx
mov dword [ebp - 0x1c], edi
mov ebx, dword [ebp - 0x1c]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [0x40a0b8]
lea edi, [ebx + eax]
mov eax, dword [0x40a090]
add ebx, eax
cmp byte [esi], 0
jne 0x4026bc
mov ecx, dword [0x40a084]
mov eax, dword [0x40a080]
sub ecx, eax
test ecx, 0xfffffff0
je 0x4026bc
mov eax, dword [eax]
and byte [ebp - 0x14], 0
push 0x409064
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x4026c0
and byte [ebp + 0xf], 0
jmp 0x4026c4
mov byte [ebp - 0x14], 1
mov byte [ebp + 0xf], 1
cmp byte [esi + 0x13], 0
jne 0x402718
push dword [ebp - 0xc]
call fcn.0040710c
test al, al
pop ecx
jne 0x4026f9
mov eax, dword [ebp - 0xc]
mov ecx, 0x40a0d8
cmp eax, ecx
je 0x4026ed
push dword [eax + 4]
push dword [eax]
call fcn.00401586
mov dword [ebp - 8], 0x63
jmp 0x402cb3
cmp byte [esi + 0x13], 0
jne 0x402718
push dword [ebp - 0xc]
call fcn.00407123
test al, al
pop ecx
jne 0x402718
mov dword [ebp - 8], 1
jmp 0x402cb3
lea eax, [ebp - 0x25]
push eax
push 0x40a0f0
lea ecx, [ebp - 0x48]
call fcn.00401559
push 0x44
lea eax, [ebp - 0x17c]
push 0
push eax
call sub.MSVCRT.dll_memset
push 0x10
lea eax, [ebp - 0x38]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
push 0x10
lea eax, [ebp - 0x1d]
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x17c], 0x44
call fcn.004014b5
mov eax, dword [ebp - 0x84]
and word [eax], 0
lea eax, [ebp - 0x88]
push eax
push 0
push dword [ebp - 0xc]
lea eax, [ebp - 0xd8]
push eax
call fcn.00407030
add esp, 0x10
mov eax, 0x4098dc
push eax
push dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.00403434
add esp, 0xc
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00401648
lea ecx, [ebp - 0x48]
add esp, 0xc
cmp eax, ecx
je 0x4027c6
push dword [eax + 4]
lea ecx, [ebp - 0x48]
push dword [eax]
call fcn.00401586
lea ecx, [ebp - 0xe8]
call fcn.0040144a
lea ecx, [ebp - 0x128]
call fcn.0040144a
cmp byte [esi + 0xf], 0
je 0x40283d
push dword [ebp - 0x88]
lea eax, [ebp - 0x37c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x37c]
push eax
call dword [sym.imp.MSVCRT.dll__wcslwr]
lea eax, [ebp - 0x37c]
mov dword [esp], 0x4098d4
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x40283d
push 0x4098cc
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea eax, [eax*2 + 0x4098cc]
push eax
push 0x4098cc
lea ecx, [ebp - 0x48]
call fcn.004019a6
mov eax, dword [edi + 4]
sub eax, dword [edi]
test eax, 0xfffffffe
je 0x402876
push edi
lea eax, [ebp - 0x118]
push 0x4098c8
push eax
call fcn.00403434
add esp, 0xc
push dword [eax + 4]
lea ecx, [ebp - 0x48]
push dword [eax]
call fcn.004019a6
lea ecx, [ebp - 0x118]
call fcn.0040144a
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
test eax, 0xfffffffe
je 0x4028af
push ebx
lea eax, [ebp - 0x138]
push 0x4098c8
push eax
call fcn.00403434
add esp, 0xc
push dword [eax + 4]
lea ecx, [ebp - 0x48]
push dword [eax]
call fcn.004019a6
lea ecx, [ebp - 0x138]
call fcn.0040144a
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp byte [ebp + 0xf], 0
jne 0x402ae5
cmp byte [esi + 7], 0
je 0x4028cd
mov edi, dword [ebp - 0xc]
jmp 0x4028eb
or dword [ebp - 4], 1
or dword [ebp - 4], 2
lea eax, [ebp - 0xe]
push eax
push str.JauntePE.exe
lea ecx, [ebp - 0xf8]
call fcn.00401559
mov edi, eax
lea eax, [ebp - 0xf]
push eax
lea ecx, [ebp - 0x68]
call fcn.0040663a
push dword [edi + 4]
lea ecx, [ebp - 0x68]
push dword [edi]
call fcn.004014d1
test byte [ebp - 4], 2
je 0x402919
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp - 0xf8]
call fcn.0040144a
test byte [ebp - 4], 1
je 0x402923
and dword [ebp - 4], 0xfffffffe
cmp byte [esi + 8], 0
je 0x40292e
mov edi, dword [ebp - 0xc]
jmp 0x40294c
or dword [ebp - 4], 4
or dword [ebp - 4], 8
lea eax, [ebp - 0x26]
push eax
push str.JauntePE.exe
lea ecx, [ebp - 0x108]
call fcn.00401559
mov edi, eax
lea eax, [ebp - 0x15]
push eax
lea ecx, [ebp - 0x58]
call fcn.0040663a
push dword [edi + 4]
lea ecx, [ebp - 0x58]
push dword [edi]
call fcn.004014d1
test byte [ebp - 4], 8
je 0x40297a
and dword [ebp - 4], 0xfffffff7
lea ecx, [ebp - 0x108]
call fcn.00403254
test byte [ebp - 4], 4
je 0x402984
and dword [ebp - 4], 0xfffffffb
mov ebx, str._jauntePE.ini
push ebx
lea edi, [esi + 0x24]
push edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0040245d
push str._registry.reg
lea eax, [esi + 0x34]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.0040245d
push ebx
push edi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.0040245d
xor edi, edi
push edi
lea eax, [esi + 0x44]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.0040245d
add esp, 0x40
push edi
lea eax, [ebp - 0xd]
push eax
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x74], edi
call fcn.004016d9
lea eax, [esi + 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
xor eax, eax
mov al, byte [esi + 0x19]
push eax
xor eax, eax
mov al, byte [esi + 0x18]
push eax
xor eax, eax
mov al, byte [esi + 0x17]
push eax
xor eax, eax
mov al, byte [esi + 0x16]
push eax
xor eax, eax
mov al, byte [esi + 0x15]
push eax
xor eax, eax
mov al, byte [esi + 0x14]
push eax
push dword [esi + 0x20]
xor eax, eax
mov al, byte [esi + 0x12]
push dword [esi + 0x1c]
push eax
xor eax, eax
mov al, byte [esi + 0x11]
push eax
xor eax, eax
mov al, byte [esi + 0xe]
push eax
xor eax, eax
mov al, byte [esi + 0xd]
push eax
xor eax, eax
mov al, byte [esi + 0xc]
push eax
xor eax, eax
mov al, byte [esi + 0xb]
push eax
xor eax, eax
mov al, byte [esi + 2]
push eax
xor eax, eax
mov al, byte [esi + 0xa]
push eax
xor eax, eax
mov al, byte [esi + 9]
push eax
xor eax, eax
mov al, byte [esi + 6]
push eax
xor eax, eax
mov al, byte [esi + 5]
push eax
xor eax, eax
mov al, byte [esi + 4]
push eax
xor eax, eax
mov al, byte [esi + 3]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0x1540]
push eax
call fcn.00402d21
add esp, 0x70
lea ecx, [ebp - 0x78]
call fcn.004031e9
lea ecx, [ebp - 0x98]
call fcn.00403254
lea ecx, [ebp - 0xc8]
call fcn.00403254
lea ecx, [ebp - 0xa8]
call fcn.00403254
lea ecx, [ebp - 0xb8]
call fcn.00403254
lea ecx, [ebp - 0x58]
call fcn.00403254
lea ecx, [ebp - 0x68]
call fcn.00403254
cmp byte [esi + 0x13], 0
je 0x402af7
and byte [ebp - 0xd06], 0
jmp 0x402c95
movzx eax, byte [esi + 0x1a]
sub eax, edi
mov byte [ebp - 0xd06], 1
mov edx, 0x4000000
je 0x402b29
dec eax
je 0x402b22
dec eax
je 0x402b1b
dec eax
jne 0x402b2e
mov edx, 0x4000100
jmp 0x402b2e
mov edx, 0x4000080
jmp 0x402b2e
mov edx, 0x4000040
jmp 0x402b2e
mov edx, 0x4000020
mov al, byte [esi + 0x1b]
test al, al
je 0x402b3f
mov dword [ebp - 0x150], 1
movzx eax, al
sub eax, edi
je 0x402b6e
dec eax
je 0x402b65
dec eax
je 0x402b5a
dec eax
jne 0x402b77
mov word [ebp - 0x14c], 3
jmp 0x402b77
mov word [ebp - 0x14c], 6
jmp 0x402b77
mov word [ebp - 0x14c], di
jmp 0x402b77
mov word [ebp - 0x14c], 1
mov cl, byte [esi + 0x10]
neg cl
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
sbb ecx, ecx
and ecx, dword [ebp - 0xd8]
xor ebx, ebx
mov bl, byte [esi + 1]
push ebx
lea ebx, [esi + 0x64]
push ebx
push 0x40a080
push dword [ebp - 0x14]
lea ebx, [ebp - 0x38]
push edi
push ebx
lea ebx, [ebp - 0x17c]
push ebx
push ecx
push edi
push edx
push edi
push edi
push edi
push dword [ebp - 0x48]
push eax
call fcn.00401053
add esp, 0x3c
cmp eax, edi
mov dword [ebp - 8], eax
je 0x402bc9
add dword [ebp - 8], 2
jmp 0x402c74
cmp dword [ebp + 0x10], edi
je 0x402bd5
push dword [ebp - 0x30]
call dword [ebp + 0x10]
pop ecx
cmp byte [ebp + 0xf], 0
je 0x402bf9
cmp byte [ebp - 0x14], 0
jne 0x402c74
cmp dword [ebp - 0x34], edi
je 0x402c82
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x402c74
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x1540]
push eax
mov dword [ebp + 0xc], edi
call fcn.00402fd8
add esp, 0xc
cmp dword [ebp - 0x34], edi
mov ebx, eax
je 0x402c22
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebx, edi
je 0x402c54
lea eax, [ebp + 0xc]
push eax
push ebx
push dword [ebp - 0x38]
lea eax, [ebp - 0x1540]
push eax
call fcn.0040303a
add esp, 0x10
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x402c5b
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x40a0a0
call fcn.004031ad
jmp 0x402c5b
mov dword [ebp - 8], 0x62
cmp dword [ebp + 0xc], edi
je 0x402c69
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, edi
je 0x402c74
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x34], edi
je 0x402c82
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x38], edi
je 0x402c95
cmp dword [ebp - 8], edi
je 0x402c95
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0xd8]
call fcn.00403254
lea ecx, [ebp - 0x88]
call fcn.00403254
lea ecx, [ebp - 0x48]
call fcn.00403254
mov al, byte [esi + 0x13]
cmp al, 1
jbe 0x402cca
cmp al, 2
jb 0x402cd7
cmp dword [ebp - 8], 0x5f
je 0x402cd7
cmp dword [ebp - 8], 0x60
je 0x402cd7
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.004020b7
pop ecx
pop ecx
mov ecx, dword [0x40a074]
mov eax, dword [0x40a070]
inc dword [ebp - 0x24]
add dword [ebp - 0x1c], 0x10
sub ecx, eax
sar ecx, 4
cmp dword [ebp - 0x24], ecx
jb 0x40266d
xor edi, edi
pop ebx
mov al, byte [esi + 0x13]
test al, al
jne 0x402d0a
cmp dword [ebp - 8], edi
je 0x402d16
test al, al
je 0x402d1b
cmp dword [ebp - 8], 0x5f
je 0x402d16
cmp dword [ebp - 8], 0x60
jne 0x402d1b
push 1
pop eax
jmp 0x402d1d
xor eax, eax
pop edi
pop esi
leave
ret