; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : B8D2B9DA8B365CCF2F3E871B3AF46DEA ; File Name : u:\work\b8d2b9da8b365ccf2f3e871b3af46dea_orig.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 60000 ; Section 1. (virtual address 00001000) ; Virtual size : 0000458C ( 17804.) ; Section size in file : 00004600 ( 17920.) ; Offset to raw data for section: 00000400 ; Flags 60000020: Text Executable Readable ; Alignment : default ; OS type : MS Windows ; Application type: ; Application type: Executable DLL 32bit .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Execute CODE segment para public 'CODE' use32 assume cs:CODE ;org 61000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing ; [00000006 BYTES: COLLAPSED FUNCTION GetStdHandle. PRESS KEYPAD "+" TO EXPAND] align 4 loc_61008: ; DATA XREF: System::__linkproc__ StartExe(System::PackageInfoTable *,System::TLibModule *)o ; System::initialization(void)+14o jmp ds:RaiseException ; --------------------------------------------------------------------------- align 10h loc_61010: ; DATA XREF: System::__linkproc__ StartExe(System::PackageInfoTable *,System::TLibModule *)+Ao ; System::initialization(void)+1Eo jmp ds:RtlUnwind ; --------------------------------------------------------------------------- align 4 ; [00000006 BYTES: COLLAPSED FUNCTION UnhandledExceptionFilter. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION WriteFile. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION ExitProcess. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION MessageBoxA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION FreeLibrary. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetCommandLineA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetLocaleInfoA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetStartupInfoA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetThreadLocale. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION RegCloseKey. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION RegOpenKeyExA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION RegQueryValueExA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetCurrentThreadId. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetVersion. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000022 BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LocalAlloc. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LocalFree. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION VirtualAlloc. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION VirtualFree. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION InitializeCriticalSection. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION EnterCriticalSection. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LeaveCriticalSection. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION DeleteCriticalSection. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000084 BYTES: COLLAPSED FUNCTION System::_16449. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_61170 proc near ; CODE XREF: System::_16463+34p ; System::_16463+3Ep ... mov [eax], eax mov [eax+4], eax retn sub_61170 endp ; --------------------------------------------------------------------------- align 4 ; [0000005C BYTES: COLLAPSED FUNCTION System::_16451. PRESS KEYPAD "+" TO EXPAND] ; [00000032 BYTES: COLLAPSED FUNCTION System::_16452. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000085 BYTES: COLLAPSED FUNCTION System::_16453. PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000C3 BYTES: COLLAPSED FUNCTION System::_16454. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000063 BYTES: COLLAPSED FUNCTION unknown_libname_2. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000077 BYTES: COLLAPSED FUNCTION unknown_libname_3. PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000C6 BYTES: COLLAPSED FUNCTION System::_16457. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000BF BYTES: COLLAPSED FUNCTION System::_16458. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000BA BYTES: COLLAPSED FUNCTION System::_16459. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000A6 BYTES: COLLAPSED FUNCTION System::_16460. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000143 BYTES: COLLAPSED FUNCTION System::_16461. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000092 BYTES: COLLAPSED FUNCTION System::_16462. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000D7 BYTES: COLLAPSED FUNCTION System::_16463. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000FF BYTES: COLLAPSED FUNCTION System::_16464. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000091 BYTES: COLLAPSED FUNCTION System::_16465. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000042 BYTES: COLLAPSED FUNCTION System::_16466. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000003C BYTES: COLLAPSED FUNCTION System::_16467. PRESS KEYPAD "+" TO EXPAND] ; [00000022 BYTES: COLLAPSED FUNCTION unknown_libname_4. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000028 BYTES: COLLAPSED FUNCTION unknown_libname_5. PRESS KEYPAD "+" TO EXPAND] ; [00000078 BYTES: COLLAPSED FUNCTION System::_16470. PRESS KEYPAD "+" TO EXPAND] ; [0000003D BYTES: COLLAPSED FUNCTION System::_16471. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000BC BYTES: COLLAPSED FUNCTION System::_16472. PRESS KEYPAD "+" TO EXPAND] ; [000000F7 BYTES: COLLAPSED FUNCTION System::_16473. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000004A BYTES: COLLAPSED FUNCTION unknown_libname_6. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000089 BYTES: COLLAPSED FUNCTION unknown_libname_7. PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000002B BYTES: COLLAPSED FUNCTION unknown_libname_8. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000031 BYTES: COLLAPSED FUNCTION unknown_libname_9. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000035 BYTES: COLLAPSED FUNCTION System::_16478. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000148 BYTES: COLLAPSED FUNCTION System::_16479. PRESS KEYPAD "+" TO EXPAND] ; [000001AB BYTES: COLLAPSED FUNCTION System::SysGetMem(int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [000001D6 BYTES: COLLAPSED FUNCTION System::SysFreeMem(void *). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000203 BYTES: COLLAPSED FUNCTION System::_16482. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000C9 BYTES: COLLAPSED FUNCTION System::SysReallocMem(void *,int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002D BYTES: COLLAPSED FUNCTION System::__linkproc__ GetMem(int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000020 BYTES: COLLAPSED FUNCTION System::__linkproc__ FreeMem(void *). PRESS KEYPAD "+" TO EXPAND] ; [0000004D BYTES: COLLAPSED FUNCTION System::__linkproc__ ReallocMem(void *&,int). PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_62844 proc near ; CODE XREF: unknown_libname_10+42p ; unknown_libname_24+97p mov ds:dword_66004, edx call sub_632C8 sub_62844 endp ; --------------------------------------------------------------------------- retn ; [00000047 BYTES: COLLAPSED FUNCTION unknown_libname_10. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- pop esi pop ebx retn ; --------------------------------------------------------------------------- align 4 ; [0000000B BYTES: COLLAPSED FUNCTION System::Error(System::TRuntimeError). PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; [00000010 BYTES: COLLAPSED FUNCTION unknown_libname_11. PRESS KEYPAD "+" TO EXPAND] ; [00000040 BYTES: COLLAPSED FUNCTION System::Move(void *,void *,int). PRESS KEYPAD "+" TO EXPAND] ; [00000056 BYTES: COLLAPSED FUNCTION System::__linkproc__ Close(System::TTextRec &). PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000D1 BYTES: COLLAPSED FUNCTION System::__linkproc__ ValLong(System::AnsiString,int &). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetKeyboardType. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002F BYTES: COLLAPSED FUNCTION unknown_libname_12. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000097 BYTES: COLLAPSED FUNCTION unknown_libname_13. PRESS KEYPAD "+" TO EXPAND] align 4 ; char SubKey[] SubKey db 'SOFTWARE\Borland\Delphi\RTL',0 ; DATA XREF: unknown_libname_13+18o ; char ValueName[] ValueName db 'FPUMaskValue',0 ; DATA XREF: unknown_libname_13+4Co align 10h ; [0000000A BYTES: COLLAPSED FUNCTION unknown_libname_14. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000000C BYTES: COLLAPSED FUNCTION System::TObject::Free(void). PRESS KEYPAD "+" TO EXPAND] ; [0000001B BYTES: COLLAPSED FUNCTION unknown_libname_15. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000021 BYTES: COLLAPSED FUNCTION unknown_libname_16. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000015 BYTES: COLLAPSED CHUNK OF FUNCTION unknown_libname_18. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000011 BYTES: COLLAPSED FUNCTION unknown_libname_18. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000001E BYTES: COLLAPSED FUNCTION unknown_libname_19. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000027 BYTES: COLLAPSED FUNCTION unknown_libname_20. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000001C BYTES: COLLAPSED FUNCTION unknown_libname_21. PRESS KEYPAD "+" TO EXPAND] ; [0000001E BYTES: COLLAPSED FUNCTION unknown_libname_22. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000012A BYTES: COLLAPSED FUNCTION System::__linkproc__ HandleAnyException(void). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000036 BYTES: COLLAPSED CHUNK OF FUNCTION System::_16463. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000051 BYTES: COLLAPSED FUNCTION System::__linkproc__ RaiseAgain(void). PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000002F BYTES: COLLAPSED FUNCTION System::__linkproc__ DoneExcept(void). PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; [00000015 BYTES: COLLAPSED FUNCTION System::__linkproc__ TryFinallyExit(void). PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; [0000009C BYTES: COLLAPSED FUNCTION unknown_libname_24. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- pop ebp retn 4 ; --------------------------------------------------------------------------- unknown_libname_25: ; DATA XREF: unknown_libname_26+Do mov eax, [esp+4] ; BDS 2005-2006 and Delphi6-7 Visual Component Library test dword ptr [eax+4], 6 jnz loc_62F62 cmp ds:byte_66010, 0 ja short loc_62EF1 lea eax, [esp+4] push eax call UnhandledExceptionFilter ; UnhandledExceptionFilter cmp eax, 0 jz short loc_62F62 loc_62EF1: ; CODE XREF: CODE:00062EE0j mov eax, [esp+4] cld call unknown_libname_14 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov edx, [esp+8] push 0 push eax push offset loc_62F0E push edx call ds:dword_67014 loc_62F0E: ; DATA XREF: CODE:00062F02o mov ebx, [esp+4] cmp dword ptr [ebx], 0EEDFADEh mov edx, [ebx+14h] mov eax, [ebx+18h] jz short loc_62F3D mov edx, ds:dword_6700C test edx, edx jz unknown_libname_24 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov eax, ebx call edx ; dword_6700C test eax, eax jz unknown_libname_24 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov edx, [ebx+0Ch] loc_62F3D: ; CODE XREF: CODE:00062F1Ej call unknown_libname_22 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov ecx, ds:dword_67004 test ecx, ecx jz short loc_62F4E call ecx ; dword_67004 loc_62F4E: ; CODE XREF: CODE:00062F4Aj mov ecx, [esp+4] mov eax, 0D9h mov edx, [ecx+14h] mov [esp], edx jmp sub_632D4 ; --------------------------------------------------------------------------- loc_62F62: ; CODE XREF: CODE:00062ED3j ; CODE:00062EEFj xor eax, eax retn ; --------------------------------------------------------------------------- align 4 ; [0000001D BYTES: COLLAPSED FUNCTION unknown_libname_26. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000028 BYTES: COLLAPSED FUNCTION unknown_libname_27. PRESS KEYPAD "+" TO EXPAND] ; [00000070 BYTES: COLLAPSED FUNCTION System::_16720. PRESS KEYPAD "+" TO EXPAND] ; [00000070 BYTES: COLLAPSED FUNCTION System::_16722. PRESS KEYPAD "+" TO EXPAND] ; [00000040 BYTES: COLLAPSED FUNCTION System::__linkproc__ StartExe(System::PackageInfoTable *,System::TLibModule *). PRESS KEYPAD "+" TO EXPAND] ; [0000005A BYTES: COLLAPSED FUNCTION unknown_libname_28. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002D BYTES: COLLAPSED FUNCTION unknown_libname_29. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; [0000007F BYTES: COLLAPSED FUNCTION unknown_libname_30. PRESS KEYPAD "+" TO EXPAND] align 4 _str___ dd 0FFFFFFFFh ; _top ; DATA XREF: unknown_libname_30+4Do dd 2 ; Len db 0Dh,0Ah,0 ; Text align 4 ; [000000DA BYTES: COLLAPSED FUNCTION System::__linkproc__ Halt0(void). PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- pop edx pop ebp pop edi pop esi pop ebx retn ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_632C8 proc near ; CODE XREF: sub_62844+6p sub_632D4+6j mov ds:uExitCode, eax call @System@@Halt0$qqrv ; System::__linkproc__ Halt0(void) sub_632C8 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_632D4 proc near ; CODE XREF: CODE:00062F5Dj ; unknown_libname_37+1Ap ... pop ds:dword_66004 jmp sub_632C8 sub_632D4 endp ; sp-analysis failed ; --------------------------------------------------------------------------- retn ; [00000023 BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrClr(void *). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002F BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrArrayClr(void *,int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000043 BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrAsg(void *,void *). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002B BYTES: COLLAPSED FUNCTION System::__linkproc__ NewAnsiString(int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002E BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrFromPCharLen(System::AnsiString &,char *,int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000000F BYTES: COLLAPSED FUNCTION unknown_libname_31. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000017 BYTES: COLLAPSED FUNCTION unknown_libname_32. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_633FC proc near ; CODE XREF: sub_63AD8+Fp sub_63BF4+Cp ... test eax, eax jz short locret_63403 mov eax, [eax-4] locret_63403: ; CODE XREF: sub_633FC+2j retn sub_633FC endp ; [00000044 BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrCat(void). PRESS KEYPAD "+" TO EXPAND] ; [000000A2 BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrCmp(void). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000000F BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrAddRef(void *). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000000C BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrToPChar(System::AnsiString). PRESS KEYPAD "+" TO EXPAND] ; [00000041 BYTES: COLLAPSED FUNCTION unknown_libname_33. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000005 BYTES: COLLAPSED FUNCTION j_unknown_libname_33. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; [00000045 BYTES: COLLAPSED FUNCTION unknown_libname_34. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000062 BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrSetLength(void). PRESS KEYPAD "+" TO EXPAND] align 10h loc_63600: ; DATA XREF: System::initialization(void)+2Fo mov al, 11h jmp @System@Error$qqr20System@TRuntimeError ; System::Error(System::TRuntimeError) ; --------------------------------------------------------------------------- retn ; [0000005A BYTES: COLLAPSED FUNCTION unknown_libname_35. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000000E BYTES: COLLAPSED FUNCTION System::RegisterModule(System::TLibModule *). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000084 BYTES: COLLAPSED FUNCTION System::UnregisterModule(System::TLibModule *). PRESS KEYPAD "+" TO EXPAND] ; [00000074 BYTES: COLLAPSED FUNCTION unknown_libname_36. PRESS KEYPAD "+" TO EXPAND] ; [00000053 BYTES: COLLAPSED FUNCTION System::Finalization(void). PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000D3 BYTES: COLLAPSED FUNCTION System::initialization(void). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetModuleHandleA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LocalAlloc_0. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION TlsGetValue. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION TlsSetValue. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; int __fastcall sub_638B4(SIZE_T uBytes) sub_638B4 proc near ; CODE XREF: unknown_libname_37+21p push eax ; uBytes push 40h ; uFlags call LocalAlloc_0 retn sub_638B4 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_638C0 proc near ; CODE XREF: unknown_libname_37+1p mov eax, 8 retn sub_638C0 endp ; --------------------------------------------------------------------------- align 4 ; [00000044 BYTES: COLLAPSED FUNCTION unknown_libname_37. PRESS KEYPAD "+" TO EXPAND] ; [00000040 BYTES: COLLAPSED FUNCTION Sysinit::__linkproc__ GetTls(void). PRESS KEYPAD "+" TO EXPAND] ; [0000000B BYTES: COLLAPSED FUNCTION unknown_libname_38. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000041 BYTES: COLLAPSED FUNCTION Sysinit::__linkproc__ InitExe(void *). PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_6399C proc near ; DATA XREF: CODE:00065470o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_639C1 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_67654 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_639C8 loc_639C0: ; CODE XREF: sub_6399C+2Aj retn ; --------------------------------------------------------------------------- loc_639C1: ; DATA XREF: sub_6399C+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_639C0 ; --------------------------------------------------------------------------- loc_639C8: ; CODE XREF: sub_6399C:loc_639C0j ; DATA XREF: sub_6399C+1Fo pop ebp retn sub_6399C endp ; --------------------------------------------------------------------------- align 4 loc_639CC: ; DATA XREF: CODE:off_6546Co sub ds:dword_67654, 1 retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_639D4 proc near ; DATA XREF: CODE:00065480o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_639F9 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_6765C xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63A00 loc_639F8: ; CODE XREF: sub_639D4+2Aj retn ; --------------------------------------------------------------------------- loc_639F9: ; DATA XREF: sub_639D4+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_639F8 ; --------------------------------------------------------------------------- loc_63A00: ; CODE XREF: sub_639D4:loc_639F8j ; DATA XREF: sub_639D4+1Fo pop ebp retn sub_639D4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_63A04 proc near ; DATA XREF: CODE:0006547Co sub ds:dword_6765C, 1 retn sub_63A04 endp ; [00000006 BYTES: COLLAPSED FUNCTION SetThreadToken. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION FlushViewOfFile. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetComputerNameA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetFileTime. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetLastError. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetModuleFileNameA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetProcAddress. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LoadLibraryA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION ResetEvent. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION SetEvent. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION SetTapeParameters. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION MessageBoxA_0. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63A6C proc near ; DATA XREF: CODE:00065488o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_63A91 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_67660 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63A98 loc_63A90: ; CODE XREF: sub_63A6C+2Aj retn ; --------------------------------------------------------------------------- loc_63A91: ; DATA XREF: sub_63A6C+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_63A90 ; --------------------------------------------------------------------------- loc_63A98: ; CODE XREF: sub_63A6C:loc_63A90j ; DATA XREF: sub_63A6C+1Fo pop ebp retn sub_63A6C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_63A9C proc near ; DATA XREF: CODE:00065484o sub ds:dword_67660, 1 retn sub_63A9C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63AA4 proc near ; CODE XREF: sub_63B64+7p ; sub_647F4+7Ep ... var_9 = byte ptr -9 var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF4h mov [ebp+var_9], cl mov [ebp+var_8], edx mov [ebp+var_4], eax mov ecx, [ebp+var_4] nop push esi nop mov esi, [ebp+var_8] nop loc_63ABD: ; CODE XREF: sub_63AA4+29j nop db 3Eh mov al, [ecx] nop mov al, [ebp+var_9] nop db 3Eh mov [ecx], al nop inc ecx nop dec esi jnz short loc_63ABD nop pop esi mov esp, ebp pop ebp retn sub_63AA4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_63AD8 proc near ; CODE XREF: sub_63C30+15p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_17 = byte ptr -17h var_14 = dword ptr -14h push ebx push esi push edi push ebp add esp, 0FFFFFFF4h mov [esp+1Ch+var_1C], edx mov edi, eax mov eax, [esp+1Ch+var_1C] call sub_633FC mov [esp+1Ch+var_14], eax mov byte ptr [edi+100h], 0 mov byte ptr [edi+101h], 0 xor edx, edx mov eax, edi loc_63B02: ; CODE XREF: sub_63AD8+30j mov [eax], dl inc edx inc eax test dl, dl jnz short loc_63B02 xor eax, eax xor esi, esi mov dl, 0 mov ecx, edi loc_63B12: ; CODE XREF: sub_63AD8+82j cmp esi, [esp+1Ch+var_14] jge short loc_63B24 mov ebx, [esp+1Ch+var_1C] mov bl, [ebx+esi] mov [esp+1Ch+var_17], bl jmp short loc_63B29 ; --------------------------------------------------------------------------- loc_63B24: ; CODE XREF: sub_63AD8+3Ej mov [esp+1Ch+var_17], 0 loc_63B29: ; CODE XREF: sub_63AD8+4Aj inc esi cmp esi, [esp+1Ch+var_14] jl short loc_63B32 xor esi, esi loc_63B32: ; CODE XREF: sub_63AD8+56j mov bl, [ecx] add bl, [esp+1Ch+var_17] add al, bl mov bl, [ecx] mov [esp+1Ch+var_18], bl xor ebx, ebx mov bl, al mov bl, [edi+ebx] mov [ecx], bl xor ebx, ebx mov bl, al lea ebp, [edi+ebx] mov bl, [esp+1Ch+var_18] mov [ebp+0], bl inc ecx dec dl jnz short loc_63B12 add esp, 0Ch pop ebp pop edi pop esi pop ebx retn sub_63AD8 endp ; =============== S U B R O U T I N E ======================================= sub_63B64 proc near ; CODE XREF: sub_63C30+4Ap xor ecx, ecx mov edx, 102h call sub_63AA4 retn sub_63B64 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63B74 proc near ; CODE XREF: sub_63BF4+31p var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx push ebx push esi push edi mov ebx, [ebp+arg_0] dec ebx test ebx, ebx jl short loc_63BEA inc ebx mov [ebp+var_4], ebx mov esi, edx loc_63B89: ; CODE XREF: sub_63B74+74j inc byte ptr [eax+100h] xor edx, edx mov dl, [eax+100h] mov dl, [eax+edx] add [eax+101h], dl xor ebx, ebx mov bl, [eax+101h] mov bl, [eax+ebx] push ebx xor ebx, ebx mov bl, [eax+100h] lea edi, [eax+ebx] pop ebx mov [edi], bl xor ebx, ebx mov bl, [eax+101h] mov [eax+ebx], dl xor ebx, ebx mov bl, [eax+100h] add dl, [eax+ebx] and edx, 0FFh mov dl, [eax+edx] xor dl, [esi] and edx, 0FFh mov [ecx], dl inc ecx inc esi dec [ebp+var_4] jnz short loc_63B89 loc_63BEA: ; CODE XREF: sub_63B74+Dj pop edi pop esi pop ebx pop ecx pop ebp retn 4 sub_63B74 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_63BF4 proc near ; CODE XREF: sub_63C30+32p push ebx push esi push edi push ebp mov edi, ecx mov esi, edx mov ebp, eax mov eax, esi call sub_633FC mov ebx, eax mov eax, edi mov edx, ebx call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) push ebx mov eax, edi call j_unknown_libname_33 push eax mov eax, esi call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) mov edx, eax mov eax, ebp pop ecx call sub_63B74 pop ebp pop edi pop esi pop ebx retn sub_63BF4 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63C30 proc near ; CODE XREF: sub_63DC0+37p ; sub_63DC0+5Fp ... var_102 = byte ptr -102h push ebp mov ebp, esp add esp, 0FFFFFEFCh push ebx push esi mov esi, ecx mov ebx, eax lea eax, [ebp+var_102] call sub_63AD8 xor eax, eax push ebp push offset loc_63C80 push dword ptr fs:[eax] mov fs:[eax], esp mov ecx, esi lea eax, [ebp+var_102] mov edx, ebx call sub_63BF4 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63C87 loc_63C74: ; CODE XREF: sub_63C30+55j lea eax, [ebp+var_102] call sub_63B64 retn ; --------------------------------------------------------------------------- loc_63C80: ; DATA XREF: sub_63C30+1Do jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_63C74 ; --------------------------------------------------------------------------- loc_63C87: ; CODE XREF: sub_63C30+4Fj ; DATA XREF: sub_63C30+3Fo pop esi pop ebx mov esp, ebp pop ebp retn sub_63C30 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63C90 proc near ; DATA XREF: CODE:00065490o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_63CB5 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_67664 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63CBC loc_63CB4: ; CODE XREF: sub_63C90+2Aj retn ; --------------------------------------------------------------------------- loc_63CB5: ; DATA XREF: sub_63C90+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_63CB4 ; --------------------------------------------------------------------------- loc_63CBC: ; CODE XREF: sub_63C90:loc_63CB4j ; DATA XREF: sub_63C90+1Fo pop ebp retn sub_63C90 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_63CC0 proc near ; DATA XREF: CODE:0006548Co sub ds:dword_67664, 1 retn sub_63CC0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63CC8 proc near ; DATA XREF: CODE:00065498o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_63CED push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_67668 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63CF4 loc_63CEC: ; CODE XREF: sub_63CC8+2Aj retn ; --------------------------------------------------------------------------- loc_63CED: ; DATA XREF: sub_63CC8+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_63CEC ; --------------------------------------------------------------------------- loc_63CF4: ; CODE XREF: sub_63CC8:loc_63CECj ; DATA XREF: sub_63CC8+1Fo pop ebp retn sub_63CC8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_63CF8 proc near ; DATA XREF: CODE:00065494o sub ds:dword_67668, 1 retn sub_63CF8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63D00 proc near ; CODE XREF: sub_63D8C+Ap var_C = dword ptr -0Ch var_5 = byte ptr -5 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF4h push ebx push esi push edi xor ecx, ecx mov [ebp+var_C], ecx mov esi, edx mov [ebp+var_4], eax mov eax, [ebp+var_4] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) xor eax, eax push ebp push offset loc_63D7E push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+var_4] call sub_633FC mov ebx, eax test ebx, ebx jle short loc_63D60 mov edi, 1 loc_63D3C: ; CODE XREF: sub_63D00+5Ej mov eax, [ebp+var_4] mov al, [eax+edi-1] mov [ebp+var_5], al lea eax, [ebp+var_C] mov dl, [ebp+var_5] dec edx call unknown_libname_31 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov edx, [ebp+var_C] mov eax, esi call @System@@LStrCat$qqrv ; System::__linkproc__ LStrCat(void) inc edi dec ebx jnz short loc_63D3C loc_63D60: ; CODE XREF: sub_63D00+35j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63D85 loc_63D6D: ; CODE XREF: sub_63D00+83j lea eax, [ebp+var_C] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) lea eax, [ebp+var_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_63D7E: ; DATA XREF: sub_63D00+1Eo jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_63D6D ; --------------------------------------------------------------------------- loc_63D85: ; CODE XREF: sub_63D00+7Dj ; DATA XREF: sub_63D00+68o pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_63D00 endp ; =============== S U B R O U T I N E ======================================= sub_63D8C proc near ; CODE XREF: sub_63DC0+27p ; sub_63DC0+4Fp ... push ebx mov ebx, eax mov edx, ebx mov eax, offset _str_0i__JkX7_zb6A8@.Text call sub_63D00 pop ebx retn sub_63D8C endp ; --------------------------------------------------------------------------- align 10h _str_0i__JkX7_zb6A8@ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63D8C+5o dd 23 ; Len db '0i][JkX7[zb6A8@o1&=vur]',0; Text ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63DC0 proc near ; CODE XREF: CODE:loc_6553Ep var_100 = dword ptr -100h var_FC = dword ptr -0FCh var_F8 = dword ptr -0F8h var_F4 = dword ptr -0F4h var_F0 = dword ptr -0F0h var_EC = dword ptr -0ECh var_E8 = dword ptr -0E8h var_E4 = dword ptr -0E4h var_E0 = dword ptr -0E0h var_DC = dword ptr -0DCh var_D8 = dword ptr -0D8h var_D4 = dword ptr -0D4h var_D0 = dword ptr -0D0h var_CC = dword ptr -0CCh var_C8 = dword ptr -0C8h var_C4 = dword ptr -0C4h var_C0 = dword ptr -0C0h var_BC = dword ptr -0BCh var_B8 = dword ptr -0B8h var_B4 = dword ptr -0B4h var_B0 = dword ptr -0B0h var_AC = dword ptr -0ACh var_A8 = dword ptr -0A8h var_A4 = dword ptr -0A4h var_A0 = dword ptr -0A0h var_9C = dword ptr -9Ch var_98 = dword ptr -98h var_94 = dword ptr -94h var_90 = dword ptr -90h var_8C = dword ptr -8Ch var_88 = dword ptr -88h var_84 = dword ptr -84h var_80 = dword ptr -80h var_7C = dword ptr -7Ch var_78 = dword ptr -78h var_74 = dword ptr -74h var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 hModule = dword ptr -4 push ebp mov ebp, esp mov ecx, 20h loc_63DC8: ; CODE XREF: sub_63DC0+Dj push 0 push 0 dec ecx jnz short loc_63DC8 push ebx push esi mov esi, offset dword_67688 xor eax, eax push ebp push offset loc_643EB push dword ptr fs:[eax] mov fs:[eax], esp lea eax, [ebp+var_10] call sub_63D8C mov edx, [ebp+var_10] lea ecx, [ebp+var_C] mov eax, offset _str_e____8__V_2_.Text call sub_63C30 mov eax, [ebp+var_C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax ; lpLibFileName call LoadLibraryA ; LoadLibraryA mov ebx, eax lea eax, [ebp+var_18] call sub_63D8C mov edx, [ebp+var_18] lea ecx, [ebp+var_14] mov eax, offset _str_o_______V_2_.Text call sub_63C30 mov eax, [ebp+var_14] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax ; lpLibFileName call LoadLibraryA ; LoadLibraryA mov [ebp+var_8], eax lea eax, [ebp+var_20] call sub_63D8C mov edx, [ebp+var_20] lea ecx, [ebp+var_1C] mov eax, offset _str______z_u_.Text call sub_63C30 mov eax, [ebp+var_1C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax ; lpLibFileName call LoadLibraryA ; LoadLibraryA mov [ebp+hModule], eax lea eax, [ebp+var_28] call sub_63D8C mov edx, [ebp+var_28] lea ecx, [ebp+var_24] mov eax, offset _str_I______X_____h.Text call sub_63C30 mov eax, [ebp+var_24] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax ; lpProcName push ebx ; hModule call GetProcAddress ; GetProcAddress mov [esi], eax lea eax, [ebp+var_30] call sub_63D8C mov edx, [ebp+var_30] lea ecx, [ebp+var_2C] mov eax, offset _str_X____5_I_____oH.Text call sub_63C30 mov eax, [ebp+var_2C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_6768C, eax lea eax, [ebp+var_38] call sub_63D8C mov edx, [ebp+var_38] lea ecx, [ebp+var_34] mov eax, offset _str______1_q__?_.Text call sub_63C30 mov eax, [ebp+var_34] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_6766C, eax lea eax, [ebp+var_40] call sub_63D8C mov edx, [ebp+var_40] lea ecx, [ebp+var_3C] mov eax, offset _str________x__1___u.Text call sub_63C30 mov eax, [ebp+var_3C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67670, eax lea eax, [ebp+var_48] call sub_63D8C mov edx, [ebp+var_48] lea ecx, [ebp+var_44] mov eax, offset _str________z_____vb.Text call sub_63C30 mov eax, [ebp+var_44] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67678, eax lea eax, [ebp+var_50] call sub_63D8C mov edx, [ebp+var_50] lea ecx, [ebp+var_4C] mov eax, offset _str_I______x__1___u.Text call sub_63C30 mov eax, [ebp+var_4C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_6767C, eax lea eax, [ebp+var_58] call sub_63D8C mov edx, [ebp+var_58] lea ecx, [ebp+var_54] mov eax, offset _str_M____1_k_____Z.Text call sub_63C30 mov eax, [ebp+var_54] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67680, eax lea eax, [ebp+var_60] call sub_63D8C mov edx, [ebp+var_60] lea ecx, [ebp+var_5C] mov eax, offset _str_Y______v_______.Text call sub_63C30 mov eax, [ebp+var_5C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67684, eax lea eax, [ebp+var_68] call sub_63D8C mov edx, [ebp+var_68] lea ecx, [ebp+var_64] mov eax, offset _str_X____5_X__1__c.Text call sub_63C30 mov eax, [ebp+var_64] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67674, eax lea eax, [ebp+var_70] call sub_63D8C mov edx, [ebp+var_70] lea ecx, [ebp+var_6C] mov eax, offset dword_64530 call sub_63C30 mov eax, [ebp+var_6C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+hModule] push eax call dword ptr [esi] mov ds:dword_67690, eax lea eax, [ebp+var_78] call sub_63D8C mov edx, [ebp+var_78] lea ecx, [ebp+var_74] mov eax, offset _str_Z______m_______.Text call sub_63C30 mov eax, [ebp+var_74] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676AC, eax lea eax, [ebp+var_80] call sub_63D8C mov edx, [ebp+var_80] mov eax, offset _str________x__1___u.Text lea ecx, [ebp+var_7C] call sub_63C30 mov eax, [ebp+var_7C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67670, eax lea eax, [ebp+var_88] call sub_63D8C mov edx, [ebp+var_88] lea ecx, [ebp+var_84] mov eax, offset _str______7_t_____Yx.Text call sub_63C30 mov eax, [ebp+var_84] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax ; lpProcName mov eax, [ebp+hModule] push eax ; hModule call GetProcAddress ; GetProcAddress mov ds:dword_676C8, eax lea eax, [ebp+var_90] call sub_63D8C mov edx, [ebp+var_90] lea ecx, [ebp+var_8C] mov eax, offset _str_H____1_v_____.Text call sub_63C30 mov eax, [ebp+var_8C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67694, eax lea eax, [ebp+var_98] call sub_63D8C mov edx, [ebp+var_98] lea ecx, [ebp+var_94] mov eax, offset _str_B____1_v____.Text call sub_63C30 mov eax, [ebp+var_94] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67698, eax lea eax, [ebp+var_A0] call sub_63D8C mov edx, [ebp+var_A0] lea ecx, [ebp+var_9C] mov eax, offset _str_B____1_v_____0.Text call sub_63C30 mov eax, [ebp+var_9C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_6769C, eax lea eax, [ebp+var_A8] call sub_63D8C mov edx, [ebp+var_A8] lea ecx, [ebp+var_A4] mov eax, offset _str______2________.Text call sub_63C30 mov eax, [ebp+var_A4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676A0, eax lea eax, [ebp+var_B0] call sub_63D8C mov edx, [ebp+var_B0] lea ecx, [ebp+var_AC] mov eax, offset _str_K______z___.Text call sub_63C30 mov eax, [ebp+var_AC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676B4, eax lea eax, [ebp+var_B8] call sub_63D8C mov edx, [ebp+var_B8] lea ecx, [ebp+var_B4] mov eax, offset _str_H____1_v____.Text call sub_63C30 mov eax, [ebp+var_B4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676B0, eax lea eax, [ebp+var_C0] call sub_63D8C mov edx, [ebp+var_C0] lea ecx, [ebp+var_BC] mov eax, offset _str_H______k___.Text call sub_63C30 mov eax, [ebp+var_BC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676A8, eax lea eax, [ebp+var_C8] call sub_63D8C mov edx, [ebp+var_C8] lea ecx, [ebp+var_C4] mov eax, offset _str_I____8_X_____ny.Text call sub_63C30 mov eax, [ebp+var_C4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676B8, eax lea eax, [ebp+var_D0] call sub_63D8C mov edx, [ebp+var_D0] lea ecx, [ebp+var_CC] mov eax, offset _str_I____1_W____.Text call sub_63C30 mov eax, [ebp+var_CC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax call dword ptr [esi] mov ds:dword_676BC, eax lea eax, [ebp+var_D8] call sub_63D8C mov edx, [ebp+var_D8] lea ecx, [ebp+var_D4] mov eax, offset _str_I____9_l_____vh.Text call sub_63C30 mov eax, [ebp+var_D4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax call dword ptr [esi] mov ds:dword_676C4, eax lea eax, [ebp+var_E0] call sub_63D8C mov edx, [ebp+var_E0] lea ecx, [ebp+var_DC] mov eax, offset _str_I____0_u__?__wh.Text call sub_63C30 mov eax, [ebp+var_DC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676C0, eax lea eax, [ebp+var_E8] call sub_63D8C mov edx, [ebp+var_E8] lea ecx, [ebp+var_E4] mov eax, offset _str_K____1_v_____z_.Text call sub_63C30 mov eax, [ebp+var_E4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676A4, eax lea eax, [ebp+var_F0] call sub_63D8C mov edx, [ebp+var_F0] lea ecx, [ebp+var_EC] mov eax, offset _str______1_R___.Text call sub_63C30 mov eax, [ebp+var_EC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax call dword ptr [esi] mov ds:dword_676CC, eax lea eax, [ebp+var_F8] call sub_63D8C mov edx, [ebp+var_F8] lea ecx, [ebp+var_F4] mov eax, offset _str______1____2___u.Text call sub_63C30 mov eax, [ebp+var_F4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax call dword ptr [esi] mov ds:dword_676D0, eax lea eax, [ebp+var_100] call sub_63D8C mov edx, [ebp+var_100] lea ecx, [ebp+var_FC] mov eax, offset _str_________3__.Text call sub_63C30 mov eax, [ebp+var_FC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax call dword ptr [esi] mov ds:dword_676D4, eax push ebx call ds:dword_676A8 mov eax, [ebp+var_8] push eax call ds:dword_676A8 mov eax, [ebp+hModule] push eax call ds:dword_676A8 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_643F2 loc_643DA: ; CODE XREF: sub_63DC0+630j lea eax, [ebp+var_100] mov edx, 3Eh call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_643EB: ; DATA XREF: sub_63DC0+19o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_643DA ; --------------------------------------------------------------------------- loc_643F2: ; CODE XREF: sub_63DC0+62Aj ; DATA XREF: sub_63DC0+615o pop esi pop ebx mov esp, ebp pop ebp retn sub_63DC0 endp ; --------------------------------------------------------------------------- _str_e____8__V_2_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+32o dd 12 ; Len db 'e8+V2#',0 ; Text align 10h _str_o_______V_2_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+5Ao dd 12 ; Len db 'o=+V2#',0 ; Text align 4 _str______z_u_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+83o dd 9 ; Len db '`zu',14h,0 ; Text align 4 _str_I______X_____h dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+ACo dd 14 ; Len db 'I;X',1Ch,',*h',0; Text align 4 _str_X____5_I_____oH dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+D5o dd 16 ; Len db 'X5I',0Ah ; Text db '**oH)',0 ; Text align 10h _str______1_q__?_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+FEo dd 12 ; Len db '\1q',0Ah ; Text db '?+',0 ; Text align 4 _str________x__1___u dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+127o ; sub_63DC0+26Fo dd 16 ; Len db ']&x',1Ch,'1!~u%',0; Text align 4 _str________z_____vb dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+150o dd 17 ; Len db '\&z',1Dh,'-',2,'vb#',0; Text align 10h _str_I______x__1___u dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+179o dd 16 ; Len db 'I&x',1Ch,'1!~u%',0; Text align 4 _str_M____1_k_____Z dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+1A2o dd 14 ; Len db 'M1k',17h,';<Z',0; Text align 4 ; str_Y______v_____ _str_Y______v_______ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+1CBo dd 18 ; Len db 'Y',4,'v',1Bh,'-<~`>k',0; Text align 10h _str_X____5_X__1__c dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+1F4o dd 14 ; Len db 'X5X',14h,'1,c',0; Text align 4 dd 0FFFFFFFFh, 14h dword_64530 dd 8ADBF854h, 4F9935F4h, 29C311h, 326848CAh, 14DC7B93h ; DATA XREF: sub_63DC0+21Do dd 0 _str_Z______m_______ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+249o dd 16 ; Len db 'Z:m',1Dh,', ~~"',0; Text align 4 _str______7_t_____Yx dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+2A4o dd 19 ; Len db '\7t',8,';<Yx7w',0; Text _str_H____1_v_____ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+2DFo dd 13 ; Len db 'H1v',0Dh,'=*',0; Text align 4 _str_B____1_v____ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+314o dd 12 ; Len db 'B1v',0Dh,'=*',0; Text align 10h _str_B____1_v_____0 dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+349o dd 12 ; Len db 'B1v',0Dh,'=*',0; Text align 4 _str______2________ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+37Eo dd 14 ; Len db ']2|',0Bh,'+=~',0; Text align 10h _str_K______z___ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+3B3o dd 11 ; Len db 'K&z',1Dh,'-',0; Text _str_H____1_v____ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+3E8o dd 12 ; Len db 'H1v',0Dh,'=*',0; Text align 4 _str_H______k___ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+41Do dd 11 ; Len db 'H=k',19h,'',27h,0; Text _str_I____8_X_____ny dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+452o dd 18 ; Len db 'I8X',0Ch,',&ny4S',0; Text align 4 _str_I____1_W____ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+487o dd 12 ; Len db 'I1W',19h,';',0Eh,0; Text align 4 ; _l_____vh::str_I__(void) _str_I____9_l_____vh dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+4BFo dd 16 ; Len db 'I9l',0Ch,',',1,'vh',10h,0; Text align 10h _str_I____0_u__?__wh dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+4F7o dd 16 ; Len db 'I0u',1Dh,'?!wh',10h,0; Text align 4 _str_K____1_v_____z_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+52Co dd 18 ; Len db 'K1v',0Dh,'=*z`4S',0; Text align 4 _str______1_R___ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+561o dd 11 ; Len db '\1R',1Dh,'',1Fh,0; Text _str______1____2___u dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+599o dd 16 ; Len db '\1`.2:^u',10h,0; Text align 4 _str_________3__ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+5D1o dd 11 ; Len db '\;|3',27h,0 ; Text ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_646EC proc near ; DATA XREF: CODE:000654A0o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_64711 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_676D8 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64718 loc_64710: ; CODE XREF: sub_646EC+2Aj retn ; --------------------------------------------------------------------------- loc_64711: ; DATA XREF: sub_646EC+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64710 ; --------------------------------------------------------------------------- loc_64718: ; CODE XREF: sub_646EC:loc_64710j ; DATA XREF: sub_646EC+1Fo pop ebp retn sub_646EC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_6471C proc near ; DATA XREF: CODE:0006549Co sub ds:dword_676D8, 1 retn sub_6471C endp ; [0000000A BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrLen(System::AnsiString). PRESS KEYPAD "+" TO EXPAND] align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64730 proc near ; CODE XREF: sub_65320+96p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx push esi push edi mov esi, [ebp+arg_0] mov eax, [ebp+arg_4] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) xor eax, eax push ebp push offset loc_647E1 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+arg_4] call @System@@LStrLen$qqrx17System@AnsiString ; System::__linkproc__ LStrLen(System::AnsiString) mov ebx, eax cmp ebx, 4 jbe short loc_647C4 lea eax, [ebp+arg_4] call j_unknown_libname_33 mov edi, eax mov edx, [edi] mov eax, esi call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) cmp dword ptr [edi], 80000h jbe short loc_64785 mov [ebp+var_8], 2 jmp short loc_6478C ; --------------------------------------------------------------------------- loc_64785: ; CODE XREF: sub_64730+4Aj mov [ebp+var_8], 102h loc_6478C: ; CODE XREF: sub_64730+53j lea eax, [ebp+var_4] push eax sub ebx, 4 push ebx lea eax, [ebp+arg_4] call j_unknown_libname_33 add eax, 4 push eax mov eax, [edi] push eax mov eax, esi call j_unknown_libname_33 push eax mov eax, [ebp+var_8] push eax mov eax, ds:off_660E4 mov eax, [eax] call eax mov eax, esi mov edx, [ebp+var_4] call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) jmp short loc_647CB ; --------------------------------------------------------------------------- loc_647C4: ; CODE XREF: sub_64730+2Fj mov eax, esi call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) loc_647CB: ; CODE XREF: sub_64730+92j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_647E8 loc_647D8: ; CODE XREF: sub_64730+B6j lea eax, [ebp+arg_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_647E1: ; DATA XREF: sub_64730+17o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_647D8 ; --------------------------------------------------------------------------- loc_647E8: ; CODE XREF: sub_64730+B0j ; DATA XREF: sub_64730+A3o pop edi pop esi pop ebx pop ecx pop ecx pop ebp retn 8 sub_64730 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_647F4 proc near ; CODE XREF: sub_65320+A3p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_1 = byte ptr -1 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp add esp, 0FFFFFFF4h push ebx push esi push edi xor eax, eax mov [ebp+var_C], eax mov esi, [ebp+arg_0] mov eax, [ebp+arg_4] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) xor eax, eax push ebp push offset loc_648B7 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, esi call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) mov eax, [ebp+arg_4] call @System@@LStrLen$qqrx17System@AnsiString ; System::__linkproc__ LStrLen(System::AnsiString) mov [ebp+var_8], eax mov ebx, 1 cmp ebx, [ebp+var_8] ja short loc_64899 loc_64837: ; CODE XREF: sub_647F4+A3j mov eax, [ebp+arg_4] mov al, [eax+ebx-1] test al, al jnz short loc_6487A mov eax, [ebp+arg_4] mov al, [eax+ebx] mov [ebp+var_1], al mov eax, [esi] call @System@@LStrLen$qqrx17System@AnsiString ; System::__linkproc__ LStrLen(System::AnsiString) mov edi, eax xor edx, edx mov dl, [ebp+var_1] add edx, edi mov eax, esi call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) mov eax, esi call j_unknown_libname_33 add eax, edi xor edx, edx mov dl, [ebp+var_1] xor ecx, ecx call sub_63AA4 inc ebx jmp short loc_64893 ; --------------------------------------------------------------------------- loc_6487A: ; CODE XREF: sub_647F4+4Cj lea eax, [ebp+var_C] mov edx, [ebp+arg_4] mov dl, [edx+ebx-1] call unknown_libname_31 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov edx, [ebp+var_C] mov eax, esi call @System@@LStrCat$qqrv ; System::__linkproc__ LStrCat(void) loc_64893: ; CODE XREF: sub_647F4+84j inc ebx cmp ebx, [ebp+var_8] jbe short loc_64837 loc_64899: ; CODE XREF: sub_647F4+41j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_648BE loc_648A6: ; CODE XREF: sub_647F4+C8j lea eax, [ebp+var_C] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) lea eax, [ebp+arg_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_648B7: ; DATA XREF: sub_647F4+1Co jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_648A6 ; --------------------------------------------------------------------------- loc_648BE: ; CODE XREF: sub_647F4+C2j ; DATA XREF: sub_647F4+ADo pop edi pop esi pop ebx mov esp, ebp pop ebp retn 8 sub_647F4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_648C8 proc near ; DATA XREF: CODE:000654A8o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_648ED push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_676DC xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_648F4 loc_648EC: ; CODE XREF: sub_648C8+2Aj retn ; --------------------------------------------------------------------------- loc_648ED: ; DATA XREF: sub_648C8+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_648EC ; --------------------------------------------------------------------------- loc_648F4: ; CODE XREF: sub_648C8:loc_648ECj ; DATA XREF: sub_648C8+1Fo pop ebp retn sub_648C8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_648F8 proc near ; DATA XREF: CODE:000654A4o sub ds:dword_676DC, 1 retn sub_648F8 endp ; =============== S U B R O U T I N E ======================================= sub_64900 proc near ; CODE XREF: sub_64918+1A2p lea edx, [eax+18h] movzx eax, word ptr [eax+14h] add edx, eax mov eax, edx retn sub_64900 endp ; =============== S U B R O U T I N E ======================================= sub_6490C proc near ; CODE XREF: sub_64918+1F0p shr eax, 1Dh mov eax, ds:dword_660A0[eax*4] retn sub_6490C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64918 proc near ; CODE XREF: sub_65320+D0p var_148 = dword ptr -148h var_A4 = dword ptr -0A4h var_98 = dword ptr -98h var_7C = dword ptr -7Ch var_4C = word ptr -4Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_28 = dword ptr -28h var_21 = byte ptr -21h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_18 = byte ptr -18h var_14 = byte ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = byte ptr 8 push ebp mov ebp, esp add esp, 0FFFFFEB8h push ebx push esi push edi mov [ebp+var_C], ecx mov [ebp+var_8], edx mov [ebp+var_4], eax mov eax, [ebp+var_8] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) mov eax, [ebp+var_C] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) xor eax, eax push ebp push offset loc_64BD6 push dword ptr fs:[eax] mov fs:[eax], esp xor ebx, ebx lea eax, [ebp+var_38] xor ecx, ecx mov edx, 10h call sub_63AA4 lea eax, [ebp+var_7C] xor ecx, ecx mov edx, 44h call sub_63AA4 mov [ebp+var_7C], 44h xor eax, eax mov al, [ebp+arg_0] mov [ebp+var_4C], ax lea eax, [ebp+var_38] push eax lea eax, [ebp+var_7C] push eax push 0 push 0 push 4 push 0 push 0 push 0 mov eax, [ebp+var_C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, ds:off_660DC mov eax, [eax] call eax test eax, eax jz loc_64BBB mov [ebp+var_21], 1 xor eax, eax push ebp push offset loc_64BB4 push dword ptr fs:[eax] mov fs:[eax], esp mov [ebp+var_148], 10002h lea eax, [ebp+var_148] push eax mov eax, [ebp+var_34] push eax mov eax, ds:off_660FC mov eax, [eax] call eax test eax, eax jz loc_64B7F lea eax, [ebp+var_14] push eax push 4 lea eax, [ebp+var_10] push eax mov eax, [ebp+var_A4] add eax, 8 push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_66118 mov eax, [eax] call eax test eax, eax jz loc_64B7F mov eax, [ebp+var_10] push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_660F8 mov eax, [eax] call eax test eax, eax jb loc_64B7F cmp [ebp+var_4], 0 jz loc_64B7F mov eax, [ebp+var_4] mov eax, [eax+3Ch] add eax, [ebp+var_4] mov [ebp+var_20], eax mov edi, [ebp+var_38] sub edi, 0Ah mov eax, [ebp+var_20] mov ebx, [eax+50h] sub ebx, 1E240h mov eax, [ebp+var_20] mov esi, [eax+34h] sub esi, 1566h push 4 push 3000h add ebx, 1E240h push ebx add esi, 1566h push esi add edi, 0Ah push edi mov eax, ds:off_66104 mov eax, [eax] call eax mov [ebp+var_10], eax cmp [ebp+var_10], 0 jz loc_64B7F lea eax, [ebp+var_18] push eax mov eax, [ebp+var_20] mov eax, [eax+54h] push eax mov eax, [ebp+var_4] push eax mov eax, [ebp+var_10] push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_660F4 mov eax, [eax] call eax test eax, eax jz loc_64B7F mov eax, [ebp+var_20] call sub_64900 mov esi, eax mov eax, [ebp+var_20] movzx eax, word ptr [eax+6] dec eax test eax, eax jb short loc_64B2E inc eax mov [ebp+var_28], eax xor ebx, ebx loc_64AD3: ; CODE XREF: sub_64918+214j lea eax, [ebp+var_18] push eax lea edi, [ebx+ebx*4] mov eax, [esi+edi*8+10h] push eax mov eax, [esi+edi*8+14h] add eax, [ebp+var_4] push eax mov eax, [esi+edi*8+0Ch] add eax, [ebp+var_10] push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_660F4 mov eax, [eax] call eax test eax, eax jz short loc_64B28 lea eax, [ebp+var_1C] push eax mov eax, [esi+edi*8+24h] call sub_6490C push eax mov eax, [esi+edi*8+8] push eax mov eax, [esi+edi*8+0Ch] add eax, [ebp+var_10] push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_66114 mov eax, [eax] call eax loc_64B28: ; CODE XREF: sub_64918+1E6j inc ebx dec [ebp+var_28] jnz short loc_64AD3 loc_64B2E: ; CODE XREF: sub_64918+1B3j lea eax, [ebp+var_18] push eax push 4 lea eax, [ebp+var_10] push eax mov eax, [ebp+var_A4] add eax, 8 push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_660F4 mov eax, [eax] call eax test eax, eax jz short loc_64B7F mov eax, [ebp+var_20] mov eax, [eax+28h] add eax, [ebp+var_10] mov [ebp+var_98], eax lea eax, [ebp+var_148] push eax mov eax, [ebp+var_34] push eax mov eax, ds:off_660D0 mov eax, [eax] call eax cmp eax, 1 sbb eax, eax inc eax mov [ebp+var_21], al loc_64B7F: ; CODE XREF: sub_64918+CCj ; sub_64918+F5j ... xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64BBB loc_64B8C: ; CODE XREF: sub_64918+2A1j cmp [ebp+var_21], 0 jnz short loc_64BA3 push 0 mov eax, [ebp+var_38] push eax mov eax, ds:off_660CC mov eax, [eax] call eax jmp short loc_64BB0 ; --------------------------------------------------------------------------- loc_64BA3: ; CODE XREF: sub_64918+278j mov eax, [ebp+var_34] push eax mov eax, ds:off_660EC mov eax, [eax] call eax loc_64BB0: ; CODE XREF: sub_64918+289j mov bl, [ebp+var_21] retn ; --------------------------------------------------------------------------- loc_64BB4: ; DATA XREF: sub_64918+A1o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64B8C ; --------------------------------------------------------------------------- loc_64BBB: ; CODE XREF: sub_64918+94j ; DATA XREF: sub_64918+26Fo xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64BDD loc_64BC8: ; CODE XREF: sub_64918+2C3j lea eax, [ebp+var_C] mov edx, 2 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_64BD6: ; DATA XREF: sub_64918+28o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64BC8 ; --------------------------------------------------------------------------- loc_64BDD: ; CODE XREF: sub_64918+2BDj ; DATA XREF: sub_64918+2ABo mov eax, ebx pop edi pop esi pop ebx mov esp, ebp pop ebp retn 4 sub_64918 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64BE8 proc near ; DATA XREF: CODE:000654B0o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_64C0D push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_676E0 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64C14 loc_64C0C: ; CODE XREF: sub_64BE8+2Aj retn ; --------------------------------------------------------------------------- loc_64C0D: ; DATA XREF: sub_64BE8+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64C0C ; --------------------------------------------------------------------------- loc_64C14: ; CODE XREF: sub_64BE8:loc_64C0Cj ; DATA XREF: sub_64BE8+1Fo pop ebp retn sub_64BE8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_64C18 proc near ; DATA XREF: CODE:000654ACo sub ds:dword_676E0, 1 retn sub_64C18 endp ; =============== S U B R O U T I N E ======================================= sub_64C20 proc near ; CODE XREF: sub_64F00+22p ; sub_65320+C5p Filename = byte ptr -10Ch push ebx add esp, 0FFFFFEF8h mov ebx, eax mov eax, esp xor ecx, ecx mov edx, 105h call sub_63AA4 push 104h ; nSize lea eax, [esp+110h+Filename] push eax ; lpFilename push 0 ; hModule call GetModuleFileNameA ; GetModuleFileNameA mov eax, ebx mov edx, esp mov ecx, 105h call unknown_libname_32 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov eax, ebx mov edx, [ebx] call @System@@LStrAsg$qqrpvpxv ; System::__linkproc__ LStrAsg(void *,void *) add esp, 108h pop ebx retn sub_64C20 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64C68 proc near ; CODE XREF: sub_65008+33p var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ebx mov [ebp+var_4], eax mov eax, [ebp+var_4] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) xor eax, eax push ebp push offset loc_64CBD push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+var_4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, ds:off_660C0 mov eax, [eax] call eax cmp eax, 0FFFFFFFFh jz short loc_64CA1 test al, 10h jnz short loc_64CA5 loc_64CA1: ; CODE XREF: sub_64C68+33j xor ebx, ebx jmp short loc_64CA7 ; --------------------------------------------------------------------------- loc_64CA5: ; CODE XREF: sub_64C68+37j mov bl, 1 loc_64CA7: ; CODE XREF: sub_64C68+3Bj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64CC4 loc_64CB4: ; CODE XREF: sub_64C68+5Aj lea eax, [ebp+var_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_64CBD: ; DATA XREF: sub_64C68+13o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64CB4 ; --------------------------------------------------------------------------- loc_64CC4: ; CODE XREF: sub_64C68+54j ; DATA XREF: sub_64C68+47o mov eax, ebx pop ebx pop ecx pop ebp retn sub_64C68 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64CCC proc near ; CODE XREF: sub_64D8C+1Fp var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx xor edx, edx mov [ebp+var_4], edx mov ebx, eax xor eax, eax push ebp push offset loc_64D3D push dword ptr fs:[eax] mov fs:[eax], esp mov [ebp+var_8], 0FDh lea eax, [ebp+var_4] mov edx, 0FEh call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) lea eax, [ebp+var_8] push eax mov eax, [ebp+var_4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, ds:off_660C4 mov eax, [eax] call eax lea eax, [ebp+var_4] mov edx, [ebp+var_8] call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) mov eax, ebx mov edx, [ebp+var_4] call @System@@LStrAsg$qqrpvpxv ; System::__linkproc__ LStrAsg(void *,void *) xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64D44 loc_64D34: ; CODE XREF: sub_64CCC+76j lea eax, [ebp+var_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_64D3D: ; DATA XREF: sub_64CCC+11o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64D34 ; --------------------------------------------------------------------------- loc_64D44: ; CODE XREF: sub_64CCC+70j ; DATA XREF: sub_64CCC+63o pop ebx pop ecx pop ecx pop ebp retn sub_64CCC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_64D4C proc near ; CODE XREF: sub_64D8C+4Ep var_108 = dword ptr -108h Buffer = byte ptr -104h push ebx add esp, 0FFFFFEFCh mov ebx, eax mov [esp+108h+var_108], 100h push esp ; nSize lea eax, [esp+10Ch+Buffer] push eax ; lpBuffer call GetComputerNameA ; GetComputerNameA test eax, eax jz short loc_64D7D mov eax, ebx lea edx, [esp+108h+Buffer] mov ecx, 100h call unknown_libname_32 ; BDS 2005-2006 and Delphi6-7 Visual Component Library jmp short loc_64D84 ; --------------------------------------------------------------------------- loc_64D7D: ; CODE XREF: sub_64D4C+1Dj mov eax, ebx call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) loc_64D84: ; CODE XREF: sub_64D4C+2Fj add esp, 104h pop ebx retn sub_64D4C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64D8C proc near ; CODE XREF: sub_65238+9p var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp xor ecx, ecx push ecx push ecx push ecx push ecx push ecx push ecx push ebx xor eax, eax push ebp push offset loc_64E23 push dword ptr fs:[eax] mov fs:[eax], esp xor ebx, ebx lea eax, [ebp+var_4] call sub_64CCC mov eax, [ebp+var_4] push eax lea eax, [ebp+var_C] call sub_63D8C mov edx, [ebp+var_C] lea ecx, [ebp+var_8] mov eax, offset _str______5__.Text call sub_63C30 mov edx, [ebp+var_8] pop eax call @System@@LStrCmp$qqrv ; System::__linkproc__ LStrCmp(void) jnz short loc_64E08 lea eax, [ebp+var_10] call sub_64D4C mov eax, [ebp+var_10] push eax lea eax, [ebp+var_18] call sub_63D8C mov edx, [ebp+var_18] lea ecx, [ebp+var_14] mov eax, offset dword_64E50 call sub_63C30 mov edx, [ebp+var_14] pop eax call @System@@LStrCmp$qqrv ; System::__linkproc__ LStrCmp(void) jnz short loc_64E08 mov bl, 1 loc_64E08: ; CODE XREF: sub_64D8C+49j ; sub_64D8C+78j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64E2A loc_64E15: ; CODE XREF: sub_64D8C+9Cj lea eax, [ebp+var_18] mov edx, 6 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_64E23: ; DATA XREF: sub_64D8C+Fo jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64E15 ; --------------------------------------------------------------------------- loc_64E2A: ; CODE XREF: sub_64D8C+96j ; DATA XREF: sub_64D8C+84o mov eax, ebx pop ebx mov esp, ebp pop ebp retn sub_64D8C endp ; --------------------------------------------------------------------------- align 4 _str______5__ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_64D8C+36o dd 8 ; Len db '[5|',0 ; Text align 4 dd 0FFFFFFFFh unknown_libname_44 dd 0Ch dword_64E50 dd 0B4C3C04Dh, 4BAC00CCh, 0A13E736h, 0; [0000008C BYTES: COLLAPSED FUNCTION sub_64E60. PRESS KEYPAD "+" TO EXPAND] _str_M______L___ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_64E60+4Ao dd 11 ; Len db 'M:L',0Bh,',',0; Text ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64F00 proc near ; CODE XREF: sub_65238+1Bp var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp mov ecx, 4 loc_64F08: ; CODE XREF: sub_64F00+Dj push 0 push 0 dec ecx jnz short loc_64F08 push ecx push ebx xor eax, eax push ebp push offset loc_64FCC push dword ptr fs:[eax] mov fs:[eax], esp lea eax, [ebp+var_4] call sub_64C20 lea eax, [ebp+var_C] call sub_63D8C mov edx, [ebp+var_C] lea ecx, [ebp+var_8] mov eax, offset _str_M____8_7___.Text call sub_63C30 mov edx, [ebp+var_8] mov eax, [ebp+var_4] call @System@@LStrCmp$qqrv ; System::__linkproc__ LStrCmp(void) jnz short loc_64F4E xor ebx, ebx loc_64F4E: ; CODE XREF: sub_64F00+4Aj lea eax, [ebp+var_18] call sub_63D8C mov edx, [ebp+var_18] lea ecx, [ebp+var_14] mov eax, offset _str_M____9_u___7_.Text call sub_63C30 mov eax, [ebp+var_14] push eax lea eax, [ebp+var_1C] call sub_63D8C mov edx, [ebp+var_1C] lea ecx, [ebp+var_10] pop eax call sub_63C30 mov eax, [ebp+var_10] push eax lea eax, [ebp+var_24] call sub_63D8C mov edx, [ebp+var_24] lea ecx, [ebp+var_20] mov eax, [ebp+var_4] call sub_63C30 mov eax, [ebp+var_20] pop edx call unknown_libname_34 ; BDS 2005-2006 and Delphi6-7 Visual Component Library test eax, eax jz short loc_64FA7 xor ebx, ebx loc_64FA7: ; CODE XREF: sub_64F00+A3j test ebx, ebx jnz short loc_64FAF mov bl, 1 jmp short loc_64FB1 ; --------------------------------------------------------------------------- loc_64FAF: ; CODE XREF: sub_64F00+A9j xor ebx, ebx loc_64FB1: ; CODE XREF: sub_64F00+ADj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64FD3 loc_64FBE: ; CODE XREF: sub_64F00+D1j lea eax, [ebp+var_24] mov edx, 9 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_64FCC: ; DATA XREF: sub_64F00+14o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64FBE ; --------------------------------------------------------------------------- loc_64FD3: ; CODE XREF: sub_64F00+CBj ; DATA XREF: sub_64F00+B9o mov eax, ebx pop ebx mov esp, ebp pop ebp retn sub_64F00 endp ; --------------------------------------------------------------------------- align 4 _str_M____8_7___ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_64F00+35o dd 11 ; Len db 'M҂87',1Dh,';',0; Text _str_M____9_u___7_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_64F00+5Co dd 13 ; Len db 'Mҗ9u',1Dh,';7',0; Text align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_65008 proc near ; CODE XREF: sub_65238+36p var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push 0 push 0 push ebx xor eax, eax push ebp push offset loc_65061 push dword ptr fs:[eax] mov fs:[eax], esp xor ebx, ebx lea eax, [ebp+var_8] call sub_63D8C mov edx, [ebp+var_8] lea ecx, [ebp+var_4] mov eax, offset _str_M______k_____wh.Text call sub_63C30 mov eax, [ebp+var_4] call sub_64C68 test al, al jz short loc_65046 mov bl, 1 loc_65046: ; CODE XREF: sub_65008+3Aj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_65068 loc_65053: ; CODE XREF: sub_65008+5Ej lea eax, [ebp+var_8] mov edx, 2 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_65061: ; DATA XREF: sub_65008+Bo jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_65053 ; --------------------------------------------------------------------------- loc_65068: ; CODE XREF: sub_65008+58j ; DATA XREF: sub_65008+46o mov eax, ebx pop ebx pop ecx pop ecx pop ebp retn sub_65008 endp ; --------------------------------------------------------------------------- align 10h _str_M______k_____wh dd 0FFFFFFFFh ; _top ; DATA XREF: sub_65008+26o dd 42 ; Len db 'MҴ;k',19h,'~',9,'wh"B',8,'',0Dh,'D',0Bh,'7Ī',0Fh,12h,'T2=[ۗѾ',0; Text align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_650A4 proc near ; CODE XREF: sub_65238+3Fp var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push 0 push 0 push ebx xor eax, eax push ebp push offset loc_65107 push dword ptr fs:[eax] mov fs:[eax], esp xor ebx, ebx lea eax, [ebp+var_8] call sub_63D8C mov edx, [ebp+var_8] lea ecx, [ebp+var_4] mov eax, offset _str______8_7__2.Text call sub_63C30 mov eax, [ebp+var_4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, ds:off_660D8 mov eax, [eax] call eax test eax, eax jz short loc_650EC mov bl, 1 loc_650EC: ; CODE XREF: sub_650A4+44j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_6510E loc_650F9: ; CODE XREF: sub_650A4+68j lea eax, [ebp+var_8] mov edx, 2 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_65107: ; DATA XREF: sub_650A4+Bo jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_650F9 ; --------------------------------------------------------------------------- loc_6510E: ; CODE XREF: sub_650A4+62j ; DATA XREF: sub_650A4+50o mov eax, ebx pop ebx pop ecx pop ecx pop ebp retn sub_650A4 endp ; --------------------------------------------------------------------------- align 4 _str______8_7__2 dd 0FFFFFFFFh ; _top ; DATA XREF: sub_650A4+26o dd 11 ; Len db ']87',1Ch,'2',0; Text ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_6512C proc near ; CODE XREF: CODE:00065544p var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = byte ptr -10h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp xor ecx, ecx push ecx push ecx push ecx push ecx push ecx push ecx push ecx push ecx push ebx xor eax, eax push ebp push offset loc_651F6 push dword ptr fs:[eax] mov fs:[eax], esp mov bl, 1 lea eax, [ebp+var_8] push eax lea eax, [ebp+var_18] call sub_63D8C mov edx, [ebp+var_18] lea ecx, [ebp+var_14] mov eax, offset _str_M______9__0__GQ.Text call sub_63C30 mov eax, [ebp+var_14] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push 80000001h mov eax, ds:off_660E8 mov eax, [eax] call eax test eax, eax jnz short loc_651D3 nop lea eax, [ebp+var_C] push eax mov eax, [ebp+var_4] push eax lea eax, [ebp+var_10] push eax push 0 lea eax, [ebp+var_20] call sub_63D8C mov edx, [ebp+var_20] lea ecx, [ebp+var_1C] mov eax, offset _str_L______l__.Text call sub_63C30 mov eax, [ebp+var_1C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax mov eax, ds:off_660C8 mov eax, [eax] call eax test eax, eax jnz short loc_651C5 nop xor ebx, ebx loc_651C5: ; CODE XREF: sub_6512C+94j mov eax, [ebp+var_8] push eax mov eax, ds:off_66100 mov eax, [eax] call eax nop loc_651D3: ; CODE XREF: sub_6512C+53j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_651FD loc_651E0: ; CODE XREF: sub_6512C+CFj lea eax, [ebp+var_20] mov edx, 4 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) lea eax, [ebp+var_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_651F6: ; DATA XREF: sub_6512C+11o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_651E0 ; --------------------------------------------------------------------------- loc_651FD: ; CODE XREF: sub_6512C+C9j ; DATA XREF: sub_6512C+AFo mov eax, ebx pop ebx mov esp, ebp pop ebp retn sub_6512C endp ; --------------------------------------------------------------------------- _str_M______9__0__GQ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_6512C+30o dd 21 ; Len db 'M;9(0*GQ',12h,'~',8,'',0; Text align 4 _str_L______l__ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_6512C+72o dd 10 ; Len db 'L&l',16h,'',0 ; Text align 4 ; =============== S U B R O U T I N E ======================================= sub_65238 proc near ; CODE XREF: CODE:00065559p nop sidt fword ptr ds:byte_676E8 nop call sub_64D8C cmp al, 1 jz short loc_65280 call sub_64E60 cmp al, 1 jz short loc_65280 call sub_64F00 cmp al, 1 jz short loc_65280 cmp ds:byte_676E8+5, 0FFh jz short loc_65280 cmp ds:byte_676E8+5, 0E8h jz short loc_65280 call sub_65008 cmp al, 1 jz short loc_65280 call sub_650A4 cmp al, 1 jnz short locret_6528B loc_65280: ; CODE XREF: sub_65238+10j ; sub_65238+19j ... push 0 mov eax, ds:off_660F0 mov eax, [eax] call eax locret_6528B: ; CODE XREF: sub_65238+46j retn sub_65238 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_6528C proc near ; DATA XREF: CODE:000654B8o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_652B1 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_676E4 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_652B8 loc_652B0: ; CODE XREF: sub_6528C+2Aj retn ; --------------------------------------------------------------------------- loc_652B1: ; DATA XREF: sub_6528C+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_652B0 ; --------------------------------------------------------------------------- loc_652B8: ; CODE XREF: sub_6528C:loc_652B0j ; DATA XREF: sub_6528C+1Fo pop ebp retn sub_6528C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_652BC proc near ; DATA XREF: CODE:000654B4o sub ds:dword_676E4, 1 retn sub_652BC endp ; =============== S U B R O U T I N E ======================================= sub_652C4 proc near ; CODE XREF: sub_65320+24p push ebx push esi mov esi, eax push 0Ah push edx mov eax, ds:dword_67650 push eax mov eax, ds:off_660D4 mov eax, [eax] call eax mov ebx, eax push ebx mov eax, ds:dword_67650 push eax mov eax, ds:off_66110 mov eax, [eax] call eax mov [esi], eax push ebx mov eax, ds:dword_67650 push eax mov eax, ds:off_66108 mov eax, [eax] call eax mov ebx, eax push ebx mov eax, ds:off_6610C mov eax, [eax] call eax mov esi, eax test esi, esi jz short loc_6531A push ebx mov eax, ds:off_6611C mov eax, [eax] call eax loc_6531A: ; CODE XREF: sub_652C4+4Aj mov eax, esi pop esi pop ebx retn sub_652C4 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_65320 proc near ; DATA XREF: CODE:00065560o var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_8 = dword ptr 10h push ebp mov ebp, esp xor ecx, ecx push ecx push ecx push ecx push ecx push ecx push ebx xor eax, eax push ebp push offset loc_6541F push dword ptr fs:[eax] mov fs:[eax], esp or ebx, 0FFFFFFFFh mov eax, offset dword_676F4 mov edx, [ebp+arg_8] call sub_652C4 mov ds:dword_676F0, eax cmp ds:dword_676F0, 0 jz loc_653F9 mov eax, offset dword_676F8 mov edx, ds:dword_676F4 call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) mov eax, offset dword_676F8 call j_unknown_libname_33 mov edx, eax mov eax, ds:dword_676F0 mov ecx, ds:dword_676F4 call @System@Move$qqrpxvpvi ; System::Move(void *,void *,int) lea eax, [ebp+var_8] call sub_63D8C mov edx, [ebp+var_8] lea ecx, [ebp+var_4] mov eax, ds:dword_676F8 call sub_63C30 mov edx, [ebp+var_4] mov eax, offset dword_676F8 call @System@@LStrAsg$qqrpvpxv ; System::__linkproc__ LStrAsg(void *,void *) mov eax, ds:dword_676F8 push eax lea eax, [ebp+var_10] push eax call sub_64730 mov eax, [ebp+var_10] push eax lea eax, [ebp+var_C] push eax call sub_647F4 mov edx, [ebp+var_C] mov eax, offset dword_676F8 call @System@@LStrAsg$qqrpvpxv ; System::__linkproc__ LStrAsg(void *,void *) push 0 mov eax, offset dword_676F8 call j_unknown_libname_33 push eax lea eax, [ebp+var_14] call sub_64C20 mov edx, [ebp+var_14] xor ecx, ecx pop eax call sub_64918 test al, al jmp short loc_65404 ; --------------------------------------------------------------------------- loc_653F9: ; CODE XREF: sub_65320+35j push 0 mov eax, ds:off_660F0 mov eax, [eax] call eax loc_65404: ; CODE XREF: sub_65320+D7j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_65426 loc_65411: ; CODE XREF: sub_65320+104j lea eax, [ebp+var_14] mov edx, 5 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_6541F: ; DATA XREF: sub_65320+Eo jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_65411 ; --------------------------------------------------------------------------- loc_65426: ; CODE XREF: sub_65320+FEj ; DATA XREF: sub_65320+ECo mov eax, ebx pop ebx mov esp, ebp pop ebp retn 10h sub_65320 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_65430 proc near ; DATA XREF: CODE:000654C0o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_65459 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, offset dword_676F8 call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_65460 loc_65458: ; CODE XREF: sub_65430+2Ej retn ; --------------------------------------------------------------------------- loc_65459: ; DATA XREF: sub_65430+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_65458 ; --------------------------------------------------------------------------- loc_65460: ; CODE XREF: sub_65430:loc_65458j ; DATA XREF: sub_65430+23o pop ebp retn sub_65430 endp ; --------------------------------------------------------------------------- align 4 dword_65464 dd 0Bh dd offset off_6546C off_6546C dd offset loc_639CC ; DATA XREF: CODE:00065468o dd offset sub_6399C dd offset @System@initialization$qqrv ; System::initialization(void) dd offset @System@Finalization$qqrv ; System::Finalization(void) dd offset sub_63A04 dd offset sub_639D4 dd offset sub_63A9C dd offset sub_63A6C dd offset sub_63CC0 dd offset sub_63C90 dd offset sub_63CF8 dd offset sub_63CC8 dd offset sub_6471C dd offset sub_646EC dd offset sub_648F8 dd offset sub_648C8 dd offset sub_64C18 dd offset sub_64BE8 dd offset sub_652BC dd offset sub_6528C align 10h dd offset sub_65430 ; --------------------------------------------------------------------------- public start start: push ebp mov ebp, esp add esp, 0FFFFFFF0h mov eax, offset dword_65464 call @Sysinit@@InitExe$qqrpv ; Sysinit::__linkproc__ InitExe(void *) xor eax, eax push ebp push offset loc_65580 push dword ptr fs:[eax] mov fs:[eax], esp push 0 push 0 call SetThreadToken ; SetThreadToken call GetLastError push 0 push 0 push 0 call SetTapeParameters ; SetTapeParameters push 0 call SetEvent ; SetEvent push 0 push 0 push 0 push 0 call GetFileTime ; GetFileTime push 0 call ResetEvent ; ResetEvent push 0 push 0 call FlushViewOfFile ; FlushViewOfFile push 0 push 0 push 0 push 0FFFFFFFh call MessageBoxA_0 test eax, eax jz short loc_6553E push 0 mov eax, ds:off_660F0 mov eax, [eax] call eax loc_6553E: ; CODE XREF: CODE:00065531j call sub_63DC0 nop call sub_6512C test al, al jz short loc_65558 push 0 mov eax, ds:off_660F0 mov eax, [eax] call eax loc_65558: ; CODE XREF: CODE:0006554Bj nop call sub_65238 push 0 push offset sub_65320 push 0Ah push 0 mov eax, ds:off_660E0 mov eax, [eax] call eax xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_65587 loc_6557F: ; CODE XREF: CODE:00065585j retn ; --------------------------------------------------------------------------- loc_65580: ; DATA XREF: CODE:000654D7o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_6557F ; --------------------------------------------------------------------------- loc_65587: ; CODE XREF: CODE:loc_6557Fj ; DATA XREF: CODE:0006557Ao call @System@@Halt0$qqrv ; System::__linkproc__ Halt0(void) ; --------------------------------------------------------------------------- align 80h CODE ends ; Section 2. (virtual address 00006000) ; Virtual size : 00000120 ( 288.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00004A00 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write DATA segment para public 'DATA' use32 assume cs:DATA ;org 66000h ; UINT uExitCode uExitCode dd 0 ; DATA XREF: unknown_libname_28+Ar ; unknown_libname_29+2w ... dword_66004 dd 0 ; unknown_libname_28+37r ... byte_66008 db 2 ; DATA XREF: System::initialization(void)+Dw db 8Dh, 40h, 0 word_6600C dw 1332h ; DATA XREF: unknown_libname_13+6r ; unknown_libname_13:loc_62AD4r ... dw 0C08Bh byte_66010 db 0 ; DATA XREF: unknown_libname_15r ; unknown_libname_16r ... db 8Dh, 40h, 0 byte_66014 db 0 ; DATA XREF: System::__linkproc__ HandleAnyException(void)+52r ; System::__linkproc__ HandleAnyException(void):loc_62CB5r db 8Dh, 40h, 0 byte_66018 db 0 ; DATA XREF: unknown_libname_30:loc_631BDr db 8Dh, 40h, 0 dword_6601C dd 0 ; System::RegisterModule(System::TLibModule *)+8w ... dword_66020 dd 0 off_66024 dd offset @System@SysGetMem$qqri ; DATA XREF: System::__linkproc__ GetMem(int)+Ar ; System::__linkproc__ ReallocMem(void *&,int)+3Fr ; System::SysGetMem(int) off_66028 dd offset @System@SysFreeMem$qqrpv ; DATA XREF: System::__linkproc__ FreeMem(void *)+5r ; System::__linkproc__ ReallocMem(void *&,int)+26r ; System::SysFreeMem(void *) off_6602C dd offset @System@SysReallocMem$qqrpvi ; DATA XREF: System::__linkproc__ ReallocMem(void *&,int)+Dr ; System::SysReallocMem(void *,int) byte_66030 db 0 ; DATA XREF: unknown_libname_10+36r aRsu db '',0 aFxn@ db '@',0 ; char Caption[] Caption db 'Error',0 ; DATA XREF: unknown_libname_30+6Co dw 0C08Bh ; char Text[] Text db 'Runtime error at 00000000',0 ; DATA XREF: unknown_libname_28+3o ; unknown_libname_30+32o ... dw 0C08Bh byte_66074 db 30h ; DATA XREF: unknown_libname_28+41r db 31h, 32h, 33h dd 37363534h, 42413938h, 46454443h ; DWORD TlsIndex TlsIndex dd 0FFFFFFFFh ; DATA XREF: unknown_libname_37+Cr ; unknown_libname_37+37r ... dword_66088 dd 0 ; Sysinit::__linkproc__ InitExe(void *)+33o dword_6608C dd 0 dword_66090 dd 0 dword_66094 dd 0 align 10h dword_660A0 dd 1 dd 10h, 2, 20h, 4, 40h, 4, 40h off_660C0 dd offset dword_676B8 ; DATA XREF: sub_64C68+27r off_660C4 dd offset dword_676BC ; DATA XREF: sub_64CCC+3Dr ; sub_64E60+33r off_660C8 dd offset dword_676D0 ; DATA XREF: sub_6512C+89r off_660CC dd offset dword_676AC ; DATA XREF: sub_64918+280r off_660D0 dd offset dword_67670 ; DATA XREF: sub_64918+255r off_660D4 dd offset dword_67694 ; DATA XREF: sub_652C4+Dr off_660D8 dd offset dword_676C0 ; DATA XREF: sub_650A4+39r off_660DC dd offset dword_67680 ; DATA XREF: sub_64918+89r off_660E0 dd offset dword_676A4 ; DATA XREF: CODE:00065569r off_660E4 dd offset dword_676C8 ; DATA XREF: sub_64730+7Fr off_660E8 dd offset dword_676CC ; DATA XREF: sub_6512C+48r off_660EC dd offset dword_6766C ; DATA XREF: sub_64918+28Fr off_660F0 dd offset dword_676B4 ; DATA XREF: sub_65238+4Ar ; sub_65320+DBr ... off_660F4 dd offset dword_67684 ; DATA XREF: sub_64918+18Er ; sub_64918+1DBr ... off_660F8 dd offset dword_67690 ; DATA XREF: sub_64918+103r off_660FC dd offset dword_6767C ; DATA XREF: sub_64918+C1r off_66100 dd offset dword_676D4 ; DATA XREF: sub_6512C+9Dr off_66104 dd offset dword_67674 ; DATA XREF: sub_64918+161r off_66108 dd offset dword_6769C ; DATA XREF: sub_652C4+31r off_6610C dd offset dword_67698 ; DATA XREF: sub_652C4+3Dr off_66110 dd offset dword_676A0 ; DATA XREF: sub_652C4+1Fr off_66114 dd offset dword_6768C ; DATA XREF: sub_64918+207r off_66118 dd offset dword_67678 ; DATA XREF: sub_64918+EAr off_6611C dd offset dword_676B0 ; DATA XREF: sub_652C4+4Dr align 100h DATA ends ; Section 3. (virtual address 00007000) ; Virtual size : 000006FD ( 1789.) ; Section size in file : 00000000 ( 0.) ; Offset to raw data for section: 00004C00 ; Flags C0000000: Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Regular ; Segment permissions: Read/Write BSS segment para public '' use32 assume cs:BSS ;org 67000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing dword_67000 dd ? dword_67004 dd ? dword_67008 dd ? ; unknown_libname_10+16r dword_6700C dd ? ; CODE:00062F20r dword_67010 dd ? ; unknown_libname_16+16r ... dword_67014 dd ? ; CODE:00062F08r ... dword_67018 dd ? ; System::__linkproc__ Halt0(void)+B7r dword_6701C dd ? dword_67020 dd ? byte_67024 db ? ; DATA XREF: System::__linkproc__ StartExe(System::PackageInfoTable *,System::TLibModule *)+33w align 4 dword_67028 dd ? dword_6702C dd ? dword_67030 dd ? byte_67034 db ? ; DATA XREF: unknown_libname_30+1r byte_67035 db ? ; DATA XREF: System::_16463+1Cr ; System::_16463:loc_619A8r ... byte_67036 db ? ; DATA XREF: System::initialization(void)+28w align 4 dword_67038 dd ? ; System::Finalization(void)+19o word_6703C dw ? ; DATA XREF: System::initialization(void)+4Cw align 10h dd 71h dup(?) dword_67204 dd ? ; System::Finalization(void)+23o word_67208 dw ? ; DATA XREF: unknown_libname_30+Ar ; System::initialization(void)+55w align 10h dword_67210 dd ? align 10h dword_67220 dd ? dd 6Bh dup(?) dword_673D0 dd ? word_673D4 dw ? ; DATA XREF: System::initialization(void)+5Ew align 4 dd 71h dup(?) dword_6759C dd ? ; System::_16479+C3w ... dword_675A0 dd ? ; System::_16479+CCw ... dword_675A4 dd ? ; System::initialization(void)w dword_675A8 dd ? ; System::initialization(void)+B2w ... byte_675AC db ? ; DATA XREF: System::_16463+A0w ; System::_16463:loc_619C3r ... align 10h dword_675B0 dd ? ; System::_16459+99w ... ; struct _RTL_CRITICAL_SECTION CriticalSection CriticalSection _RTL_CRITICAL_SECTION <?> ; DATA XREF: System::_16463+12o ; System::_16463+25o ... dword_675CC dd ? ; System::_16449+3Cw ... dword_675D0 dd ? ; System::_16452+22r ... dword_675D4 dd ? ; unknown_libname_3+51o ... dd 3 dup(?) dword_675E4 dd 4 dup(?) ; System::_16461+12o ... dword_675F4 dd ? dword_675F8 dd ? align 10h dword_67600 dd ? ; System::_16465+4r ... dword_67604 dd ? ; unknown_libname_6+9r ... dword_67608 dd ? ; unknown_libname_6+2Er ... ; HLOCAL hMem hMem dd ? ; DATA XREF: System::_16463+59w ; System::_16463+5Er ... dword_67610 dd ? ; System::_16464+90o ... align 10h dword_67620 dd ? ; System::_16722+9o ... dword_67624 dd ? ; unknown_libname_27+2r dword_67628 dd ? dword_6762C dd ? dword_67630 dd ? dd 6 dup(?) byte_6764C db ? ; DATA XREF: Sysinit::__linkproc__ GetTls(void)r align 10h dword_67650 dd ? ; Sysinit::__linkproc__ InitExe(void *)+16r ... dword_67654 dd ? ; CODE:loc_639CCw dword_67658 dd ? dword_6765C dd ? dword_67660 dd ? dword_67664 dd ? dword_67668 dd ? dword_6766C dd ? ; DATA:off_660ECo dword_67670 dd ? ; sub_63DC0+288w ... dword_67674 dd ? ; DATA:off_66104o dword_67678 dd ? ; DATA:off_66118o dword_6767C dd ? ; DATA:off_660FCo dword_67680 dd ? ; DATA:off_660DCo dword_67684 dd ? ; DATA:off_660F4o dword_67688 dd ? dword_6768C dd ? ; DATA:off_66114o dword_67690 dd ? ; DATA:off_660F8o dword_67694 dd ? ; DATA:off_660D4o dword_67698 dd ? ; DATA:off_6610Co dword_6769C dd ? ; DATA:off_66108o dword_676A0 dd ? ; DATA:off_66110o dword_676A4 dd ? ; DATA:off_660E0o dword_676A8 dd ? ; sub_63DC0+5F3r ... dword_676AC dd ? ; DATA:off_660CCo dword_676B0 dd ? ; DATA:off_6611Co dword_676B4 dd ? ; DATA:off_660F0o dword_676B8 dd ? ; DATA:off_660C0o dword_676BC dd ? ; DATA:off_660C4o dword_676C0 dd ? ; DATA:off_660D8o dword_676C4 dd ? dword_676C8 dd ? ; DATA:off_660E4o dword_676CC dd ? ; DATA:off_660E8o dword_676D0 dd ? ; DATA:off_660C8o dword_676D4 dd ? ; DATA:off_66100o dword_676D8 dd ? dword_676DC dd ? dword_676E0 dd ? dword_676E4 dd ? byte_676E8 db 6 dup(?) ; DATA XREF: sub_65238+1w ; sub_65238+24r ... align 10h dword_676F0 dd ? ; sub_65320+2Er ... dword_676F4 dd ? ; sub_65320+40r ... dword_676F8 dd ? ; sub_65320+4Bo ... align 200h BSS ends ; ; Imports from kernel32.dll ; ; Section 4. (virtual address 00008000) ; Virtual size : 00000496 ( 1174.) ; Section size in file : 00000600 ( 1536.) ; Offset to raw data for section: 00004C00 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Externs ; _idata ; void __stdcall DeleteCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn __imp_DeleteCriticalSection:dword ; DATA XREF: DeleteCriticalSectionr ; void __stdcall LeaveCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn __imp_LeaveCriticalSection:dword ; DATA XREF: LeaveCriticalSectionr ; void __stdcall EnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn __imp_EnterCriticalSection:dword ; DATA XREF: EnterCriticalSectionr ; void __stdcall InitializeCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn __imp_InitializeCriticalSection:dword ; DATA XREF: InitializeCriticalSectionr ; BOOL __stdcall VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType) extrn __imp_VirtualFree:dword ; DATA XREF: VirtualFreer ; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) extrn __imp_VirtualAlloc:dword ; DATA XREF: VirtualAllocr ; HLOCAL __stdcall LocalFree(HLOCAL hMem) extrn __imp_LocalFree:dword ; DATA XREF: LocalFreer ; HLOCAL __stdcall LocalAlloc(UINT uFlags, SIZE_T uBytes) extrn __imp_LocalAlloc:dword ; DATA XREF: LocalAllocr ; DWORD GetVersion(void) extrn __imp_GetVersion:dword ; DATA XREF: GetVersionr ; DWORD GetCurrentThreadId(void) extrn __imp_GetCurrentThreadId:dword ; DATA XREF: GetCurrentThreadIdr ; LCID GetThreadLocale(void) extrn __imp_GetThreadLocale:dword ; DATA XREF: GetThreadLocaler ; void __stdcall GetStartupInfoA(LPSTARTUPINFOA lpStartupInfo) extrn __imp_GetStartupInfoA:dword ; DATA XREF: GetStartupInfoAr ; int __stdcall GetLocaleInfoA(LCID Locale, LCTYPE LCType, LPSTR lpLCData, int cchData) extrn __imp_GetLocaleInfoA:dword ; DATA XREF: GetLocaleInfoAr ; LPSTR GetCommandLineA(void) extrn __imp_GetCommandLineA:dword ; DATA XREF: GetCommandLineAr ; BOOL __stdcall FreeLibrary(HMODULE hLibModule) extrn __imp_FreeLibrary:dword ; DATA XREF: FreeLibraryr ; void __stdcall ExitProcess(UINT uExitCode) extrn __imp_ExitProcess:dword ; DATA XREF: ExitProcessr ; BOOL __stdcall WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped) extrn __imp_WriteFile:dword ; DATA XREF: WriteFiler ; LONG __stdcall UnhandledExceptionFilter(struct _EXCEPTION_POINTERS *ExceptionInfo) extrn __imp_UnhandledExceptionFilter:dword ; DATA XREF: UnhandledExceptionFilterr extrn RtlUnwind:dword ; DATA XREF: CODE:loc_61010r ; void __stdcall RaiseException(DWORD dwExceptionCode, DWORD dwExceptionFlags, DWORD nNumberOfArguments, const ULONG_PTR *lpArguments) extrn RaiseException:dword ; DATA XREF: CODE:loc_61008r ; HANDLE __stdcall GetStdHandle(DWORD nStdHandle) extrn __imp_GetStdHandle:dword ; DATA XREF: GetStdHandler ; ; Imports from user32.dll ; ; int __stdcall GetKeyboardType(int nTypeFlag) extrn __imp_GetKeyboardType:dword ; DATA XREF: GetKeyboardTyper ; int __stdcall MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) extrn __imp_MessageBoxA:dword ; DATA XREF: MessageBoxAr ; ; Imports from advapi32.dll ; ; LONG __stdcall RegQueryValueExA(HKEY hKey, LPCSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData) extrn __imp_RegQueryValueExA:dword ; DATA XREF: RegQueryValueExAr ; LONG __stdcall RegOpenKeyExA(HKEY hKey, LPCSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult) extrn __imp_RegOpenKeyExA:dword ; DATA XREF: RegOpenKeyExAr ; LONG __stdcall RegCloseKey(HKEY hKey) extrn __imp_RegCloseKey:dword ; DATA XREF: RegCloseKeyr ; ; Imports from kernel32.dll ; ; BOOL __stdcall TlsSetValue(DWORD dwTlsIndex, LPVOID lpTlsValue) extrn __imp_TlsSetValue:dword ; DATA XREF: TlsSetValuer ; LPVOID __stdcall TlsGetValue(DWORD dwTlsIndex) extrn __imp_TlsGetValue:dword ; DATA XREF: TlsGetValuer ; HLOCAL __stdcall LocalAlloc_0(UINT uFlags, SIZE_T uBytes) extrn __imp_LocalAlloc_0:dword ; DATA XREF: LocalAlloc_0r ; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName) extrn __imp_GetModuleHandleA:dword ; DATA XREF: GetModuleHandleAr ; ; Imports from advapi32.dll ; ; BOOL __stdcall SetThreadToken(PHANDLE Thread, HANDLE Token) extrn __imp_SetThreadToken:dword ; DATA XREF: SetThreadTokenr ; ; Imports from kernel32.dll ; ; DWORD __stdcall SetTapeParameters(HANDLE hDevice, DWORD dwOperation, LPVOID lpTapeInformation) extrn __imp_SetTapeParameters:dword ; DATA XREF: SetTapeParametersr ; BOOL __stdcall SetEvent(HANDLE hEvent) extrn __imp_SetEvent:dword ; DATA XREF: SetEventr ; BOOL __stdcall ResetEvent(HANDLE hEvent) extrn __imp_ResetEvent:dword ; DATA XREF: ResetEventr ; HMODULE __stdcall LoadLibraryA(LPCSTR lpLibFileName) extrn __imp_LoadLibraryA:dword ; DATA XREF: LoadLibraryAr ; FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName) extrn __imp_GetProcAddress:dword ; DATA XREF: GetProcAddressr ; DWORD __stdcall GetModuleFileNameA(HMODULE hModule, LPSTR lpFilename, DWORD nSize) extrn __imp_GetModuleFileNameA:dword ; DATA XREF: GetModuleFileNameAr ; DWORD GetLastError(void) extrn __imp_GetLastError:dword ; DATA XREF: GetLastErrorr ; BOOL __stdcall GetFileTime(HANDLE hFile, LPFILETIME lpCreationTime, LPFILETIME lpLastAccessTime, LPFILETIME lpLastWriteTime) extrn __imp_GetFileTime:dword ; DATA XREF: GetFileTimer ; BOOL __stdcall GetComputerNameA(LPSTR lpBuffer, LPDWORD nSize) extrn __imp_GetComputerNameA:dword ; DATA XREF: GetComputerNameAr ; BOOL __stdcall FlushViewOfFile(LPCVOID lpBaseAddress, SIZE_T dwNumberOfBytesToFlush) extrn __imp_FlushViewOfFile:dword ; DATA XREF: FlushViewOfFiler ; ; Imports from user32.dll ; ; int __stdcall MessageBoxA_0(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) extrn __imp_MessageBoxA_0:dword ; DATA XREF: MessageBoxA_0r ; Section 5. (virtual address 00009000) ; Virtual size : 00000008 ( 8.) ; Section size in file : 00000000 ( 0.) ; Offset to raw data for section: 00005200 ; Flags C0000000: Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Regular ; Segment permissions: Read/Write _tls segment para public '' use32 assume cs:_tls ;org 69000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing TlsStart dd 2 dup(?) ; DATA XREF: .rdata:TlsDirectoryo TlsEnd dd 7Eh dup(?) ; DATA XREF: .rdata:TlsEnd_ptro _tls ends ; Section 6. (virtual address 0000A000) ; Virtual size : 00000024 ( 36.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00005200 ; Flags 50000040: Data Shareable Readable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read _rdata segment para public 'DATA' use32 assume cs:_rdata ;org 6A000h TlsDirectory dd offset TlsStart TlsEnd_ptr dd offset TlsEnd TlsIndex_ptr dd offset TlsIndex TlsCallbacks_ptr dd offset TlsSizeOfZeroFill TlsSizeOfZeroFill dd 0 ; DATA XREF: .rdata:TlsCallbacks_ptro TlsCharacteristics dd 0 aApplication db 'Application',0 align 200h _rdata ends end start