; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 8BEF2F9170F9D556E34B6C22487C23D9 ; File Name : u:\work\8bef2f9170f9d556e34b6c22487c23d9_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 60000 ; Section 1. (virtual address 00001000) ; Virtual size : 0000458C ( 17804.) ; Section size in file : 0000458C ( 17804.) ; Offset to raw data for section: 00001000 ; Flags 60000020: Text Executable Readable ; Alignment : default ; OS type : MS Windows ; Application type: ; Application type: Executable DLL 32bit .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Execute CODE segment para public 'CODE' use32 assume cs:CODE ;org 61000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61000 proc near ; CODE XREF: unknown_libname_30+39p ; unknown_libname_30+54p jmp ds:dword_680F0 sub_61000 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61008 proc near ; CODE XREF: unknown_libname_15+14p ; unknown_libname_16+16p ... jmp ds:dword_680EC sub_61008 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61010 proc near ; CODE XREF: System::__linkproc__ HandleAnyException(void)+D2p ; CODE:00062F08p ; DATA XREF: ... jmp ds:dword_680E8 sub_61010 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61018 proc near ; CODE XREF: System::__linkproc__ HandleAnyException(void)+6Ap ; System::__linkproc__ HandleAnyException(void)+A7p ... jmp ds:dword_680E4 sub_61018 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61020 proc near ; CODE XREF: unknown_libname_30+3Fp ; unknown_libname_30+5Ap jmp ds:dword_680E0 sub_61020 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61028 proc near ; CODE XREF: System::__linkproc__ Halt0(void)+C3p jmp ds:dword_680DC sub_61028 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61030 proc near ; CODE XREF: unknown_libname_30+78p jmp ds:dword_680FC sub_61030 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61038 proc near ; CODE XREF: System::__linkproc__ Halt0(void)+8Bp jmp ds:dword_680D8 sub_61038 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61040 proc near ; CODE XREF: System::initialization(void)+67p jmp ds:dword_680D4 sub_61040 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61048 proc near ; CODE XREF: unknown_libname_36+26p jmp ds:dword_680D0 sub_61048 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61050 proc near ; CODE XREF: unknown_libname_1+Ap jmp ds:dword_680CC sub_61050 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61058 proc near ; CODE XREF: System::initialization(void):loc_63868p ; System::initialization(void):loc_63879p jmp ds:dword_680C8 sub_61058 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61060 proc near ; CODE XREF: unknown_libname_13+6Bp jmp ds:dword_6810C sub_61060 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61068 proc near ; CODE XREF: unknown_libname_13+22p jmp ds:dword_68108 sub_61068 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61070 proc near ; CODE XREF: unknown_libname_13+55p jmp ds:dword_68104 sub_61070 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61078 proc near ; CODE XREF: System::initialization(void):loc_63888p jmp ds:dword_680C4 sub_61078 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_61080 proc near ; CODE XREF: System::initialization(void)+7Bp ; System::initialization(void)+8Cp jmp ds:dword_680C0 sub_61080 endp ; --------------------------------------------------------------------------- align 4 ; [00000022 BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_610AC proc near ; CODE XREF: System::_16449+15p ; System::_16463+54p jmp ds:dword_680BC sub_610AC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_610B4 proc near ; CODE XREF: System::_16464+41p ; System::_16464+B6p jmp ds:dword_680B8 sub_610B4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_610BC proc near ; CODE XREF: unknown_libname_2+2Fp ; unknown_libname_3+1Ep ... jmp ds:dword_680B4 sub_610BC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_610C4 proc near ; CODE XREF: unknown_libname_2+56p ; unknown_libname_3+69p ... jmp ds:dword_680B0 sub_610C4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_610CC proc near ; CODE XREF: System::_16463+17p jmp ds:dword_680AC sub_610CC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_610D4 proc near ; CODE XREF: System::_16463+2Ap ; System::_16464+2Fp ... jmp ds:dword_680A8 sub_610D4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_610DC proc near ; CODE XREF: System::_16463+C2p ; System::_16464+E4p ... jmp ds:dword_680A4 sub_610DC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_610E4 proc near ; CODE XREF: System::_16464+EEp jmp ds:dword_680A0 sub_610E4 endp ; --------------------------------------------------------------------------- align 4 ; [00000084 BYTES: COLLAPSED FUNCTION System::_16449. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_61170 proc near ; CODE XREF: System::_16463+34p ; System::_16463+3Ep ... mov [eax], eax mov [eax+4], eax retn sub_61170 endp ; --------------------------------------------------------------------------- align 4 ; [0000005C BYTES: COLLAPSED FUNCTION System::_16451. PRESS KEYPAD "+" TO EXPAND] ; [00000032 BYTES: COLLAPSED FUNCTION System::_16452. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000085 BYTES: COLLAPSED FUNCTION System::_16453. PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000C3 BYTES: COLLAPSED FUNCTION System::_16454. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000063 BYTES: COLLAPSED FUNCTION unknown_libname_2. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000077 BYTES: COLLAPSED FUNCTION unknown_libname_3. PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000C6 BYTES: COLLAPSED FUNCTION System::_16457. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000BF BYTES: COLLAPSED FUNCTION System::_16458. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000BA BYTES: COLLAPSED FUNCTION System::_16459. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000A6 BYTES: COLLAPSED FUNCTION System::_16460. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000143 BYTES: COLLAPSED FUNCTION System::_16461. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000092 BYTES: COLLAPSED FUNCTION System::_16462. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000D7 BYTES: COLLAPSED FUNCTION System::_16463. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000FF BYTES: COLLAPSED FUNCTION System::_16464. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000091 BYTES: COLLAPSED FUNCTION System::_16465. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000042 BYTES: COLLAPSED FUNCTION System::_16466. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000003C BYTES: COLLAPSED FUNCTION System::_16467. PRESS KEYPAD "+" TO EXPAND] ; [00000022 BYTES: COLLAPSED FUNCTION unknown_libname_4. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000028 BYTES: COLLAPSED FUNCTION unknown_libname_5. PRESS KEYPAD "+" TO EXPAND] ; [00000078 BYTES: COLLAPSED FUNCTION System::_16470. PRESS KEYPAD "+" TO EXPAND] ; [0000003D BYTES: COLLAPSED FUNCTION System::_16471. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000BC BYTES: COLLAPSED FUNCTION System::_16472. PRESS KEYPAD "+" TO EXPAND] ; [000000F7 BYTES: COLLAPSED FUNCTION System::_16473. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000004A BYTES: COLLAPSED FUNCTION unknown_libname_6. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000089 BYTES: COLLAPSED FUNCTION unknown_libname_7. PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000002B BYTES: COLLAPSED FUNCTION unknown_libname_8. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000031 BYTES: COLLAPSED FUNCTION unknown_libname_9. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000035 BYTES: COLLAPSED FUNCTION System::_16478. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000148 BYTES: COLLAPSED FUNCTION System::_16479. PRESS KEYPAD "+" TO EXPAND] ; [000001AB BYTES: COLLAPSED FUNCTION System::SysGetMem(int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [000001D6 BYTES: COLLAPSED FUNCTION System::SysFreeMem(void *). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000203 BYTES: COLLAPSED FUNCTION System::_16482. PRESS KEYPAD "+" TO EXPAND] align 4 ; [000000C9 BYTES: COLLAPSED FUNCTION System::SysReallocMem(void *,int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002D BYTES: COLLAPSED FUNCTION System::__linkproc__ GetMem(int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000020 BYTES: COLLAPSED FUNCTION System::__linkproc__ FreeMem(void *). PRESS KEYPAD "+" TO EXPAND] ; [0000004D BYTES: COLLAPSED FUNCTION System::__linkproc__ ReallocMem(void *&,int). PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_62844 proc near ; CODE XREF: unknown_libname_10+42p ; unknown_libname_24+97p mov ds:dword_66004, edx call sub_632C8 sub_62844 endp ; --------------------------------------------------------------------------- retn ; [00000047 BYTES: COLLAPSED FUNCTION unknown_libname_10. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- pop esi pop ebx retn ; --------------------------------------------------------------------------- align 4 ; [0000000B BYTES: COLLAPSED FUNCTION System::Error(System::TRuntimeError). PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; [00000010 BYTES: COLLAPSED FUNCTION unknown_libname_11. PRESS KEYPAD "+" TO EXPAND] ; [00000040 BYTES: COLLAPSED FUNCTION System::Move(void *,void *,int). PRESS KEYPAD "+" TO EXPAND] ; [00000056 BYTES: COLLAPSED FUNCTION System::__linkproc__ Close(System::TTextRec &). PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000D1 BYTES: COLLAPSED FUNCTION System::__linkproc__ ValLong(System::AnsiString,int &). PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_62A24 proc near ; CODE XREF: unknown_libname_12+5p ; unknown_libname_12+11p jmp ds:dword_680F8 sub_62A24 endp ; --------------------------------------------------------------------------- align 4 ; [0000002F BYTES: COLLAPSED FUNCTION unknown_libname_12. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000097 BYTES: COLLAPSED FUNCTION unknown_libname_13. PRESS KEYPAD "+" TO EXPAND] align 4 aSoftwareBorlan db 'SOFTWARE\Borland\Delphi\RTL',0 ; DATA XREF: unknown_libname_13+18o aFpumaskvalue db 'FPUMaskValue',0 ; DATA XREF: unknown_libname_13+4Co align 10h ; [0000000A BYTES: COLLAPSED FUNCTION unknown_libname_14. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000000C BYTES: COLLAPSED FUNCTION System::TObject::Free(void). PRESS KEYPAD "+" TO EXPAND] ; [0000001B BYTES: COLLAPSED FUNCTION unknown_libname_15. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000021 BYTES: COLLAPSED FUNCTION unknown_libname_16. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000015 BYTES: COLLAPSED CHUNK OF FUNCTION unknown_libname_18. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000011 BYTES: COLLAPSED FUNCTION unknown_libname_18. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000001E BYTES: COLLAPSED FUNCTION unknown_libname_19. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000027 BYTES: COLLAPSED FUNCTION unknown_libname_20. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000001C BYTES: COLLAPSED FUNCTION unknown_libname_21. PRESS KEYPAD "+" TO EXPAND] ; [0000001E BYTES: COLLAPSED FUNCTION unknown_libname_22. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000012A BYTES: COLLAPSED FUNCTION System::__linkproc__ HandleAnyException(void). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000036 BYTES: COLLAPSED CHUNK OF FUNCTION System::_16463. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000051 BYTES: COLLAPSED FUNCTION System::__linkproc__ RaiseAgain(void). PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000002F BYTES: COLLAPSED FUNCTION System::__linkproc__ DoneExcept(void). PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; [00000015 BYTES: COLLAPSED FUNCTION System::__linkproc__ TryFinallyExit(void). PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; [0000009C BYTES: COLLAPSED FUNCTION unknown_libname_24. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- pop ebp retn 4 ; --------------------------------------------------------------------------- unknown_libname_25: ; DATA XREF: unknown_libname_26+Do mov eax, [esp+4] ; BDS 2005-2006 and Delphi6-7 Visual Component Library test dword ptr [eax+4], 6 jnz loc_62F62 cmp ds:byte_66010, 0 ja short loc_62EF1 lea eax, [esp+4] push eax call sub_61018 ; UnhandledExceptionFilter cmp eax, 0 jz short loc_62F62 loc_62EF1: ; CODE XREF: CODE:00062EE0j mov eax, [esp+4] cld call unknown_libname_14 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov edx, [esp+8] push 0 push eax push offset loc_62F0E push edx call ds:off_67014 loc_62F0E: ; DATA XREF: CODE:00062F02o mov ebx, [esp+4] cmp dword ptr [ebx], 0EEDFADEh mov edx, [ebx+14h] mov eax, [ebx+18h] jz short loc_62F3D mov edx, ds:dword_6700C test edx, edx jz unknown_libname_24 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov eax, ebx call edx ; dword_6700C test eax, eax jz unknown_libname_24 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov edx, [ebx+0Ch] loc_62F3D: ; CODE XREF: CODE:00062F1Ej call unknown_libname_22 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov ecx, ds:dword_67004 test ecx, ecx jz short loc_62F4E call ecx ; dword_67004 loc_62F4E: ; CODE XREF: CODE:00062F4Aj mov ecx, [esp+4] mov eax, 0D9h mov edx, [ecx+14h] mov [esp], edx jmp sub_632D4 ; --------------------------------------------------------------------------- loc_62F62: ; CODE XREF: CODE:00062ED3j ; CODE:00062EEFj xor eax, eax retn ; --------------------------------------------------------------------------- align 4 ; [0000001D BYTES: COLLAPSED FUNCTION unknown_libname_26. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000028 BYTES: COLLAPSED FUNCTION unknown_libname_27. PRESS KEYPAD "+" TO EXPAND] ; [00000070 BYTES: COLLAPSED FUNCTION System::_16720. PRESS KEYPAD "+" TO EXPAND] ; [00000070 BYTES: COLLAPSED FUNCTION System::_16722. PRESS KEYPAD "+" TO EXPAND] ; [00000040 BYTES: COLLAPSED FUNCTION System::__linkproc__ StartExe(System::PackageInfoTable *,System::TLibModule *). PRESS KEYPAD "+" TO EXPAND] ; [0000005A BYTES: COLLAPSED FUNCTION unknown_libname_28. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002D BYTES: COLLAPSED FUNCTION unknown_libname_29. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; [0000007F BYTES: COLLAPSED FUNCTION unknown_libname_30. PRESS KEYPAD "+" TO EXPAND] align 4 _str___ dd 0FFFFFFFFh ; _top ; DATA XREF: unknown_libname_30+4Do dd 2 ; Len db 0Dh,0Ah,0 ; Text align 4 ; [000000DA BYTES: COLLAPSED FUNCTION System::__linkproc__ Halt0(void). PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- pop edx pop ebp pop edi pop esi pop ebx retn ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_632C8 proc near ; CODE XREF: sub_62844+6p sub_632D4+6j mov ds:dword_66000, eax call @System@@Halt0$qqrv ; System::__linkproc__ Halt0(void) sub_632C8 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_632D4 proc near ; CODE XREF: CODE:00062F5Dj ; unknown_libname_37+1Ap ... pop ds:dword_66004 jmp sub_632C8 sub_632D4 endp ; sp-analysis failed ; --------------------------------------------------------------------------- retn ; [00000023 BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrClr(void *). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002F BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrArrayClr(void *,int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000043 BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrAsg(void *,void *). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002B BYTES: COLLAPSED FUNCTION System::__linkproc__ NewAnsiString(int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000002E BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrFromPCharLen(System::AnsiString &,char *,int). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000000F BYTES: COLLAPSED FUNCTION unknown_libname_31. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000017 BYTES: COLLAPSED FUNCTION unknown_libname_32. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_633FC proc near ; CODE XREF: sub_63AD8+Fp sub_63BF4+Cp ... test eax, eax jz short locret_63403 mov eax, [eax-4] locret_63403: ; CODE XREF: sub_633FC+2j retn sub_633FC endp ; [00000044 BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrCat(void). PRESS KEYPAD "+" TO EXPAND] ; [000000A2 BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrCmp(void). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000000F BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrAddRef(void *). PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000000C BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrToPChar(System::AnsiString). PRESS KEYPAD "+" TO EXPAND] ; [00000041 BYTES: COLLAPSED FUNCTION unknown_libname_33. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000005 BYTES: COLLAPSED FUNCTION j_unknown_libname_33. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; [00000045 BYTES: COLLAPSED FUNCTION unknown_libname_34. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000062 BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrSetLength(void). PRESS KEYPAD "+" TO EXPAND] align 10h loc_63600: ; DATA XREF: System::initialization(void)+2Fo ; BSS:off_67000o mov al, 11h jmp @System@Error$qqr20System@TRuntimeError ; System::Error(System::TRuntimeError) ; --------------------------------------------------------------------------- retn ; [0000005A BYTES: COLLAPSED FUNCTION unknown_libname_35. PRESS KEYPAD "+" TO EXPAND] align 4 ; [0000000E BYTES: COLLAPSED FUNCTION System::RegisterModule(System::TLibModule *). PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000084 BYTES: COLLAPSED FUNCTION System::UnregisterModule(System::TLibModule *). PRESS KEYPAD "+" TO EXPAND] ; [00000074 BYTES: COLLAPSED FUNCTION unknown_libname_36. PRESS KEYPAD "+" TO EXPAND] ; [00000053 BYTES: COLLAPSED FUNCTION System::Finalization(void). PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000D3 BYTES: COLLAPSED FUNCTION System::initialization(void). PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63894 proc near ; CODE XREF: Sysinit::__linkproc__ InitExe(void *)+Cp jmp ds:dword_68120 sub_63894 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_6389C proc near ; CODE XREF: sub_638B4+3p jmp ds:dword_6811C sub_6389C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_638A4 proc near ; CODE XREF: Sysinit::__linkproc__ GetTls(void)+25p ; Sysinit::__linkproc__ GetTls(void)+36p jmp ds:dword_68118 sub_638A4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_638AC proc near ; CODE XREF: unknown_libname_37+3Dp jmp ds:dword_68114 sub_638AC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_638B4 proc near ; CODE XREF: unknown_libname_37+21p push eax push 40h call sub_6389C ; LocalAlloc retn sub_638B4 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_638C0 proc near ; CODE XREF: unknown_libname_37+1p mov eax, 8 retn sub_638C0 endp ; --------------------------------------------------------------------------- align 4 ; [00000044 BYTES: COLLAPSED FUNCTION unknown_libname_37. PRESS KEYPAD "+" TO EXPAND] ; [00000040 BYTES: COLLAPSED FUNCTION Sysinit::__linkproc__ GetTls(void). PRESS KEYPAD "+" TO EXPAND] ; [0000000B BYTES: COLLAPSED FUNCTION unknown_libname_38. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000041 BYTES: COLLAPSED FUNCTION Sysinit::__linkproc__ InitExe(void *). PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_6399C proc near ; DATA XREF: CODE:00065470o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_639C1 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_67654 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_639C8 loc_639C0: ; CODE XREF: sub_6399C+2Aj retn ; --------------------------------------------------------------------------- loc_639C1: ; DATA XREF: sub_6399C+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_639C0 ; --------------------------------------------------------------------------- loc_639C8: ; CODE XREF: sub_6399C:loc_639C0j ; DATA XREF: sub_6399C+1Fo pop ebp retn sub_6399C endp ; --------------------------------------------------------------------------- align 4 loc_639CC: ; DATA XREF: CODE:off_6546Co sub ds:dword_67654, 1 retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_639D4 proc near ; DATA XREF: CODE:00065480o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_639F9 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_6765C xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63A00 loc_639F8: ; CODE XREF: sub_639D4+2Aj retn ; --------------------------------------------------------------------------- loc_639F9: ; DATA XREF: sub_639D4+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_639F8 ; --------------------------------------------------------------------------- loc_63A00: ; CODE XREF: sub_639D4:loc_639F8j ; DATA XREF: sub_639D4+1Fo pop ebp retn sub_639D4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_63A04 proc near ; DATA XREF: CODE:0006547Co sub ds:dword_6765C, 1 retn sub_63A04 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A0C proc near ; CODE XREF: CODE:000654E6p jmp ds:dword_68128 sub_63A0C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A14 proc near ; CODE XREF: CODE:0006551Ap jmp ds:dword_68154 sub_63A14 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A1C proc near ; CODE XREF: sub_64D4C+16p jmp ds:dword_68150 sub_63A1C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A24 proc near ; CODE XREF: CODE:0006550Ap jmp ds:dword_6814C sub_63A24 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A2C proc near ; CODE XREF: CODE:000654EBp jmp ds:dword_68148 sub_63A2C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A34 proc near ; CODE XREF: sub_64C20+23p jmp ds:dword_68144 sub_63A34 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A3C proc near ; CODE XREF: sub_63DC0+C0p ; sub_63DC0+2BEp jmp ds:dword_68140 sub_63A3C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A44 proc near ; CODE XREF: sub_63DC0+45p ; sub_63DC0+6Dp ... jmp ds:dword_6813C sub_63A44 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A4C proc near ; CODE XREF: CODE:00065511p jmp ds:dword_68138 sub_63A4C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A54 proc near ; CODE XREF: CODE:000654FDp jmp ds:dword_68134 sub_63A54 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A5C proc near ; CODE XREF: CODE:000654F6p jmp ds:dword_68130 sub_63A5C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_63A64 proc near ; CODE XREF: CODE:0006552Ap jmp ds:dword_6815C sub_63A64 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63A6C proc near ; DATA XREF: CODE:00065488o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_63A91 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_67660 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63A98 loc_63A90: ; CODE XREF: sub_63A6C+2Aj retn ; --------------------------------------------------------------------------- loc_63A91: ; DATA XREF: sub_63A6C+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_63A90 ; --------------------------------------------------------------------------- loc_63A98: ; CODE XREF: sub_63A6C:loc_63A90j ; DATA XREF: sub_63A6C+1Fo pop ebp retn sub_63A6C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_63A9C proc near ; DATA XREF: CODE:00065484o sub ds:dword_67660, 1 retn sub_63A9C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63AA4 proc near ; CODE XREF: sub_63B64+7p ; sub_647F4+7Ep ... var_9 = byte ptr -9 var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF4h mov [ebp+var_9], cl mov [ebp+var_8], edx mov [ebp+var_4], eax mov ecx, [ebp+var_4] nop push esi nop mov esi, [ebp+var_8] nop loc_63ABD: ; CODE XREF: sub_63AA4+29j nop db 3Eh mov al, [ecx] nop mov al, [ebp+var_9] nop db 3Eh mov [ecx], al nop inc ecx nop dec esi jnz short loc_63ABD nop pop esi mov esp, ebp pop ebp retn sub_63AA4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_63AD8 proc near ; CODE XREF: sub_63C30+15p var_1C = dword ptr -1Ch var_18 = byte ptr -18h var_17 = byte ptr -17h var_14 = dword ptr -14h push ebx push esi push edi push ebp add esp, 0FFFFFFF4h mov [esp+1Ch+var_1C], edx mov edi, eax mov eax, [esp+1Ch+var_1C] call sub_633FC mov [esp+1Ch+var_14], eax mov byte ptr [edi+100h], 0 mov byte ptr [edi+101h], 0 xor edx, edx mov eax, edi loc_63B02: ; CODE XREF: sub_63AD8+30j mov [eax], dl inc edx inc eax test dl, dl jnz short loc_63B02 xor eax, eax xor esi, esi mov dl, 0 mov ecx, edi loc_63B12: ; CODE XREF: sub_63AD8+82j cmp esi, [esp+1Ch+var_14] jge short loc_63B24 mov ebx, [esp+1Ch+var_1C] mov bl, [ebx+esi] mov [esp+1Ch+var_17], bl jmp short loc_63B29 ; --------------------------------------------------------------------------- loc_63B24: ; CODE XREF: sub_63AD8+3Ej mov [esp+1Ch+var_17], 0 loc_63B29: ; CODE XREF: sub_63AD8+4Aj inc esi cmp esi, [esp+1Ch+var_14] jl short loc_63B32 xor esi, esi loc_63B32: ; CODE XREF: sub_63AD8+56j mov bl, [ecx] add bl, [esp+1Ch+var_17] add al, bl mov bl, [ecx] mov [esp+1Ch+var_18], bl xor ebx, ebx mov bl, al mov bl, [edi+ebx] mov [ecx], bl xor ebx, ebx mov bl, al lea ebp, [edi+ebx] mov bl, [esp+1Ch+var_18] mov [ebp+0], bl inc ecx dec dl jnz short loc_63B12 add esp, 0Ch pop ebp pop edi pop esi pop ebx retn sub_63AD8 endp ; =============== S U B R O U T I N E ======================================= sub_63B64 proc near ; CODE XREF: sub_63C30+4Ap xor ecx, ecx mov edx, 102h call sub_63AA4 retn sub_63B64 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63B74 proc near ; CODE XREF: sub_63BF4+31p var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx push ebx push esi push edi mov ebx, [ebp+arg_0] dec ebx test ebx, ebx jl short loc_63BEA inc ebx mov [ebp+var_4], ebx mov esi, edx loc_63B89: ; CODE XREF: sub_63B74+74j inc byte ptr [eax+100h] xor edx, edx mov dl, [eax+100h] mov dl, [eax+edx] add [eax+101h], dl xor ebx, ebx mov bl, [eax+101h] mov bl, [eax+ebx] push ebx xor ebx, ebx mov bl, [eax+100h] lea edi, [eax+ebx] pop ebx mov [edi], bl xor ebx, ebx mov bl, [eax+101h] mov [eax+ebx], dl xor ebx, ebx mov bl, [eax+100h] add dl, [eax+ebx] and edx, 0FFh mov dl, [eax+edx] xor dl, [esi] and edx, 0FFh mov [ecx], dl inc ecx inc esi dec [ebp+var_4] jnz short loc_63B89 loc_63BEA: ; CODE XREF: sub_63B74+Dj pop edi pop esi pop ebx pop ecx pop ebp retn 4 sub_63B74 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_63BF4 proc near ; CODE XREF: sub_63C30+32p push ebx push esi push edi push ebp mov edi, ecx mov esi, edx mov ebp, eax mov eax, esi call sub_633FC mov ebx, eax mov eax, edi mov edx, ebx call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) push ebx mov eax, edi call j_unknown_libname_33 push eax mov eax, esi call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) mov edx, eax mov eax, ebp pop ecx call sub_63B74 pop ebp pop edi pop esi pop ebx retn sub_63BF4 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63C30 proc near ; CODE XREF: sub_63DC0+37p ; sub_63DC0+5Fp ... var_102 = byte ptr -102h push ebp mov ebp, esp add esp, 0FFFFFEFCh push ebx push esi mov esi, ecx mov ebx, eax lea eax, [ebp+var_102] call sub_63AD8 xor eax, eax push ebp push offset loc_63C80 push dword ptr fs:[eax] mov fs:[eax], esp mov ecx, esi lea eax, [ebp+var_102] mov edx, ebx call sub_63BF4 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63C87 loc_63C74: ; CODE XREF: sub_63C30+55j lea eax, [ebp+var_102] call sub_63B64 retn ; --------------------------------------------------------------------------- loc_63C80: ; DATA XREF: sub_63C30+1Do jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_63C74 ; --------------------------------------------------------------------------- loc_63C87: ; CODE XREF: sub_63C30+4Fj ; DATA XREF: sub_63C30+3Fo pop esi pop ebx mov esp, ebp pop ebp retn sub_63C30 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63C90 proc near ; DATA XREF: CODE:00065490o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_63CB5 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_67664 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63CBC loc_63CB4: ; CODE XREF: sub_63C90+2Aj retn ; --------------------------------------------------------------------------- loc_63CB5: ; DATA XREF: sub_63C90+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_63CB4 ; --------------------------------------------------------------------------- loc_63CBC: ; CODE XREF: sub_63C90:loc_63CB4j ; DATA XREF: sub_63C90+1Fo pop ebp retn sub_63C90 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_63CC0 proc near ; DATA XREF: CODE:0006548Co sub ds:dword_67664, 1 retn sub_63CC0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63CC8 proc near ; DATA XREF: CODE:00065498o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_63CED push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_67668 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63CF4 loc_63CEC: ; CODE XREF: sub_63CC8+2Aj retn ; --------------------------------------------------------------------------- loc_63CED: ; DATA XREF: sub_63CC8+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_63CEC ; --------------------------------------------------------------------------- loc_63CF4: ; CODE XREF: sub_63CC8:loc_63CECj ; DATA XREF: sub_63CC8+1Fo pop ebp retn sub_63CC8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_63CF8 proc near ; DATA XREF: CODE:00065494o sub ds:dword_67668, 1 retn sub_63CF8 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63D00 proc near ; CODE XREF: sub_63D8C+Ap var_C = dword ptr -0Ch var_5 = byte ptr -5 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF4h push ebx push esi push edi xor ecx, ecx mov [ebp+var_C], ecx mov esi, edx mov [ebp+var_4], eax mov eax, [ebp+var_4] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) xor eax, eax push ebp push offset loc_63D7E push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+var_4] call sub_633FC mov ebx, eax test ebx, ebx jle short loc_63D60 mov edi, 1 loc_63D3C: ; CODE XREF: sub_63D00+5Ej mov eax, [ebp+var_4] mov al, [eax+edi-1] mov [ebp+var_5], al lea eax, [ebp+var_C] mov dl, [ebp+var_5] dec edx call unknown_libname_31 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov edx, [ebp+var_C] mov eax, esi call @System@@LStrCat$qqrv ; System::__linkproc__ LStrCat(void) inc edi dec ebx jnz short loc_63D3C loc_63D60: ; CODE XREF: sub_63D00+35j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_63D85 loc_63D6D: ; CODE XREF: sub_63D00+83j lea eax, [ebp+var_C] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) lea eax, [ebp+var_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_63D7E: ; DATA XREF: sub_63D00+1Eo jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_63D6D ; --------------------------------------------------------------------------- loc_63D85: ; CODE XREF: sub_63D00+7Dj ; DATA XREF: sub_63D00+68o pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_63D00 endp ; =============== S U B R O U T I N E ======================================= sub_63D8C proc near ; CODE XREF: sub_63DC0+27p ; sub_63DC0+4Fp ... push ebx mov ebx, eax mov edx, ebx mov eax, offset _str_0i__JkX7_zb6A8@.Text call sub_63D00 pop ebx retn sub_63D8C endp ; --------------------------------------------------------------------------- align 10h _str_0i__JkX7_zb6A8@ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63D8C+5o dd 23 ; Len db '0i][JkX7[zb6A8@o1&=vur]',0; Text ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_63DC0 proc near ; CODE XREF: CODE:loc_6553Ep var_100 = dword ptr -100h var_FC = dword ptr -0FCh var_F8 = dword ptr -0F8h var_F4 = dword ptr -0F4h var_F0 = dword ptr -0F0h var_EC = dword ptr -0ECh var_E8 = dword ptr -0E8h var_E4 = dword ptr -0E4h var_E0 = dword ptr -0E0h var_DC = dword ptr -0DCh var_D8 = dword ptr -0D8h var_D4 = dword ptr -0D4h var_D0 = dword ptr -0D0h var_CC = dword ptr -0CCh var_C8 = dword ptr -0C8h var_C4 = dword ptr -0C4h var_C0 = dword ptr -0C0h var_BC = dword ptr -0BCh var_B8 = dword ptr -0B8h var_B4 = dword ptr -0B4h var_B0 = dword ptr -0B0h var_AC = dword ptr -0ACh var_A8 = dword ptr -0A8h var_A4 = dword ptr -0A4h var_A0 = dword ptr -0A0h var_9C = dword ptr -9Ch var_98 = dword ptr -98h var_94 = dword ptr -94h var_90 = dword ptr -90h var_8C = dword ptr -8Ch var_88 = dword ptr -88h var_84 = dword ptr -84h var_80 = dword ptr -80h var_7C = dword ptr -7Ch var_78 = dword ptr -78h var_74 = dword ptr -74h var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp mov ecx, 20h loc_63DC8: ; CODE XREF: sub_63DC0+Dj push 0 push 0 dec ecx jnz short loc_63DC8 push ebx push esi mov esi, offset dword_67688 xor eax, eax push ebp push offset loc_643EB push dword ptr fs:[eax] mov fs:[eax], esp lea eax, [ebp+var_10] call sub_63D8C mov edx, [ebp+var_10] lea ecx, [ebp+var_C] mov eax, offset _str_e____8__V_2_.Text call sub_63C30 mov eax, [ebp+var_C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax call sub_63A44 ; LoadLibraryA mov ebx, eax lea eax, [ebp+var_18] call sub_63D8C mov edx, [ebp+var_18] lea ecx, [ebp+var_14] mov eax, offset _str_o_______V_2_.Text call sub_63C30 mov eax, [ebp+var_14] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax call sub_63A44 ; LoadLibraryA mov [ebp+var_8], eax lea eax, [ebp+var_20] call sub_63D8C mov edx, [ebp+var_20] lea ecx, [ebp+var_1C] mov eax, offset _str______z_u_.Text call sub_63C30 mov eax, [ebp+var_1C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax call sub_63A44 ; LoadLibraryA mov [ebp+var_4], eax lea eax, [ebp+var_28] call sub_63D8C mov edx, [ebp+var_28] lea ecx, [ebp+var_24] mov eax, offset _str_I______X_____h.Text call sub_63C30 mov eax, [ebp+var_24] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call sub_63A3C ; GetProcAddress mov [esi], eax lea eax, [ebp+var_30] call sub_63D8C mov edx, [ebp+var_30] lea ecx, [ebp+var_2C] mov eax, offset _str_X____5_I_____oH.Text call sub_63C30 mov eax, [ebp+var_2C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_6768C, eax lea eax, [ebp+var_38] call sub_63D8C mov edx, [ebp+var_38] lea ecx, [ebp+var_34] mov eax, offset _str______1_q__?_.Text call sub_63C30 mov eax, [ebp+var_34] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_6766C, eax lea eax, [ebp+var_40] call sub_63D8C mov edx, [ebp+var_40] lea ecx, [ebp+var_3C] mov eax, offset _str________x__1___u.Text call sub_63C30 mov eax, [ebp+var_3C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67670, eax lea eax, [ebp+var_48] call sub_63D8C mov edx, [ebp+var_48] lea ecx, [ebp+var_44] mov eax, offset _str________z_____vb.Text call sub_63C30 mov eax, [ebp+var_44] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67678, eax lea eax, [ebp+var_50] call sub_63D8C mov edx, [ebp+var_50] lea ecx, [ebp+var_4C] mov eax, offset _str_I______x__1___u.Text call sub_63C30 mov eax, [ebp+var_4C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_6767C, eax lea eax, [ebp+var_58] call sub_63D8C mov edx, [ebp+var_58] lea ecx, [ebp+var_54] mov eax, offset _str_M____1_k_____Z.Text call sub_63C30 mov eax, [ebp+var_54] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67680, eax lea eax, [ebp+var_60] call sub_63D8C mov edx, [ebp+var_60] lea ecx, [ebp+var_5C] mov eax, offset _str_Y______v_______.Text call sub_63C30 mov eax, [ebp+var_5C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67684, eax lea eax, [ebp+var_68] call sub_63D8C mov edx, [ebp+var_68] lea ecx, [ebp+var_64] mov eax, offset _str_X____5_X__1__c.Text call sub_63C30 mov eax, [ebp+var_64] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67674, eax lea eax, [ebp+var_70] call sub_63D8C mov edx, [ebp+var_70] lea ecx, [ebp+var_6C] mov eax, offset dword_64530 call sub_63C30 mov eax, [ebp+var_6C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_4] push eax call dword ptr [esi] mov ds:dword_67690, eax lea eax, [ebp+var_78] call sub_63D8C mov edx, [ebp+var_78] lea ecx, [ebp+var_74] mov eax, offset _str_Z______m_______.Text call sub_63C30 mov eax, [ebp+var_74] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676AC, eax lea eax, [ebp+var_80] call sub_63D8C mov edx, [ebp+var_80] mov eax, offset _str________x__1___u.Text lea ecx, [ebp+var_7C] call sub_63C30 mov eax, [ebp+var_7C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67670, eax lea eax, [ebp+var_88] call sub_63D8C mov edx, [ebp+var_88] lea ecx, [ebp+var_84] mov eax, offset _str______7_t_____Yx.Text call sub_63C30 mov eax, [ebp+var_84] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_4] push eax call sub_63A3C ; GetProcAddress mov ds:dword_676C8, eax lea eax, [ebp+var_90] call sub_63D8C mov edx, [ebp+var_90] lea ecx, [ebp+var_8C] mov eax, offset _str_H____1_v_____.Text call sub_63C30 mov eax, [ebp+var_8C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67694, eax lea eax, [ebp+var_98] call sub_63D8C mov edx, [ebp+var_98] lea ecx, [ebp+var_94] mov eax, offset _str_B____1_v____.Text call sub_63C30 mov eax, [ebp+var_94] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_67698, eax lea eax, [ebp+var_A0] call sub_63D8C mov edx, [ebp+var_A0] lea ecx, [ebp+var_9C] mov eax, offset _str_B____1_v_____0.Text call sub_63C30 mov eax, [ebp+var_9C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_6769C, eax lea eax, [ebp+var_A8] call sub_63D8C mov edx, [ebp+var_A8] lea ecx, [ebp+var_A4] mov eax, offset _str______2________.Text call sub_63C30 mov eax, [ebp+var_A4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676A0, eax lea eax, [ebp+var_B0] call sub_63D8C mov edx, [ebp+var_B0] lea ecx, [ebp+var_AC] mov eax, offset _str_K______z___.Text call sub_63C30 mov eax, [ebp+var_AC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676B4, eax lea eax, [ebp+var_B8] call sub_63D8C mov edx, [ebp+var_B8] lea ecx, [ebp+var_B4] mov eax, offset _str_H____1_v____.Text call sub_63C30 mov eax, [ebp+var_B4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676B0, eax lea eax, [ebp+var_C0] call sub_63D8C mov edx, [ebp+var_C0] lea ecx, [ebp+var_BC] mov eax, offset _str_H______k___.Text call sub_63C30 mov eax, [ebp+var_BC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676A8, eax lea eax, [ebp+var_C8] call sub_63D8C mov edx, [ebp+var_C8] lea ecx, [ebp+var_C4] mov eax, offset _str_I____8_X_____ny.Text call sub_63C30 mov eax, [ebp+var_C4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676B8, eax lea eax, [ebp+var_D0] call sub_63D8C mov edx, [ebp+var_D0] lea ecx, [ebp+var_CC] mov eax, offset _str_I____1_W____.Text call sub_63C30 mov eax, [ebp+var_CC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax call dword ptr [esi] mov ds:dword_676BC, eax lea eax, [ebp+var_D8] call sub_63D8C mov edx, [ebp+var_D8] lea ecx, [ebp+var_D4] mov eax, offset _str_I____9_l_____vh.Text call sub_63C30 mov eax, [ebp+var_D4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax call dword ptr [esi] mov ds:dword_676C4, eax lea eax, [ebp+var_E0] call sub_63D8C mov edx, [ebp+var_E0] lea ecx, [ebp+var_DC] mov eax, offset _str_I____0_u__?__wh.Text call sub_63C30 mov eax, [ebp+var_DC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676C0, eax lea eax, [ebp+var_E8] call sub_63D8C mov edx, [ebp+var_E8] lea ecx, [ebp+var_E4] mov eax, offset _str_K____1_v_____z_.Text call sub_63C30 mov eax, [ebp+var_E4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push ebx call dword ptr [esi] mov ds:dword_676A4, eax lea eax, [ebp+var_F0] call sub_63D8C mov edx, [ebp+var_F0] lea ecx, [ebp+var_EC] mov eax, offset _str______1_R___.Text call sub_63C30 mov eax, [ebp+var_EC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax call dword ptr [esi] mov ds:dword_676CC, eax lea eax, [ebp+var_F8] call sub_63D8C mov edx, [ebp+var_F8] lea ecx, [ebp+var_F4] mov eax, offset _str______1____2___u.Text call sub_63C30 mov eax, [ebp+var_F4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax call dword ptr [esi] mov ds:dword_676D0, eax lea eax, [ebp+var_100] call sub_63D8C mov edx, [ebp+var_100] lea ecx, [ebp+var_FC] mov eax, offset _str_________3__.Text call sub_63C30 mov eax, [ebp+var_FC] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax call dword ptr [esi] mov ds:dword_676D4, eax push ebx call ds:dword_676A8 ; FreeLibrary mov eax, [ebp+var_8] push eax call ds:dword_676A8 ; FreeLibrary mov eax, [ebp+var_4] push eax call ds:dword_676A8 ; FreeLibrary xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_643F2 loc_643DA: ; CODE XREF: sub_63DC0+630j lea eax, [ebp+var_100] mov edx, 3Eh call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_643EB: ; DATA XREF: sub_63DC0+19o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_643DA ; --------------------------------------------------------------------------- loc_643F2: ; CODE XREF: sub_63DC0+62Aj ; DATA XREF: sub_63DC0+615o pop esi pop ebx mov esp, ebp pop ebp retn sub_63DC0 endp ; --------------------------------------------------------------------------- _str_e____8__V_2_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+32o dd 12 ; Len db 'e8+V2#',0 ; Text align 10h _str_o_______V_2_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+5Ao dd 12 ; Len db 'o=+V2#',0 ; Text align 4 _str______z_u_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+83o dd 9 ; Len db '`zu',14h,0 ; Text align 4 _str_I______X_____h dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+ACo dd 14 ; Len db 'I;X',1Ch,',*h',0; Text align 4 _str_X____5_I_____oH dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+D5o dd 16 ; Len db 'X5I',0Ah ; Text db '**oH)',0 ; Text align 10h _str______1_q__?_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+FEo dd 12 ; Len db '\1q',0Ah ; Text db '?+',0 ; Text align 4 _str________x__1___u dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+127o ; sub_63DC0+26Fo dd 16 ; Len db ']&x',1Ch,'1!~u%',0; Text align 4 _str________z_____vb dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+150o dd 17 ; Len db '\&z',1Dh,'-',2,'vb#',0; Text align 10h _str_I______x__1___u dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+179o dd 16 ; Len db 'I&x',1Ch,'1!~u%',0; Text align 4 _str_M____1_k_____Z dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+1A2o dd 14 ; Len db 'M1k',17h,';<Z',0; Text align 4 ; str_Y______v_____ _str_Y______v_______ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+1CBo dd 18 ; Len db 'Y',4,'v',1Bh,'-<~`>k',0; Text align 10h _str_X____5_X__1__c dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+1F4o dd 14 ; Len db 'X5X',14h,'1,c',0; Text align 4 dd 0FFFFFFFFh, 14h dword_64530 dd 8ADBF854h, 4F9935F4h, 29C311h, 326848CAh, 14DC7B93h ; DATA XREF: sub_63DC0+21Do dd 0 _str_Z______m_______ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+249o dd 16 ; Len db 'Z:m',1Dh,', ~~"',0; Text align 4 _str______7_t_____Yx dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+2A4o dd 19 ; Len db '\7t',8,';<Yx7w',0; Text _str_H____1_v_____ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+2DFo dd 13 ; Len db 'H1v',0Dh,'=*',0; Text align 4 _str_B____1_v____ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+314o dd 12 ; Len db 'B1v',0Dh,'=*',0; Text align 10h _str_B____1_v_____0 dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+349o dd 12 ; Len db 'B1v',0Dh,'=*',0; Text align 4 _str______2________ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+37Eo dd 14 ; Len db ']2|',0Bh,'+=~',0; Text align 10h _str_K______z___ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+3B3o dd 11 ; Len db 'K&z',1Dh,'-',0; Text _str_H____1_v____ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+3E8o dd 12 ; Len db 'H1v',0Dh,'=*',0; Text align 4 _str_H______k___ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+41Do dd 11 ; Len db 'H=k',19h,'',27h,0; Text _str_I____8_X_____ny dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+452o dd 18 ; Len db 'I8X',0Ch,',&ny4S',0; Text align 4 _str_I____1_W____ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+487o dd 12 ; Len db 'I1W',19h,';',0Eh,0; Text align 4 ; _l_____vh::str_I__(void) _str_I____9_l_____vh dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+4BFo dd 16 ; Len db 'I9l',0Ch,',',1,'vh',10h,0; Text align 10h _str_I____0_u__?__wh dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+4F7o dd 16 ; Len db 'I0u',1Dh,'?!wh',10h,0; Text align 4 _str_K____1_v_____z_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+52Co dd 18 ; Len db 'K1v',0Dh,'=*z`4S',0; Text align 4 _str______1_R___ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+561o dd 11 ; Len db '\1R',1Dh,'',1Fh,0; Text _str______1____2___u dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+599o dd 16 ; Len db '\1`.2:^u',10h,0; Text align 4 _str_________3__ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_63DC0+5D1o dd 11 ; Len db '\;|3',27h,0 ; Text ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_646EC proc near ; DATA XREF: CODE:000654A0o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_64711 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_676D8 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64718 loc_64710: ; CODE XREF: sub_646EC+2Aj retn ; --------------------------------------------------------------------------- loc_64711: ; DATA XREF: sub_646EC+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64710 ; --------------------------------------------------------------------------- loc_64718: ; CODE XREF: sub_646EC:loc_64710j ; DATA XREF: sub_646EC+1Fo pop ebp retn sub_646EC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_6471C proc near ; DATA XREF: CODE:0006549Co sub ds:dword_676D8, 1 retn sub_6471C endp ; [0000000A BYTES: COLLAPSED FUNCTION System::__linkproc__ LStrLen(System::AnsiString). PRESS KEYPAD "+" TO EXPAND] align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64730 proc near ; CODE XREF: sub_65320+96p var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx push esi push edi mov esi, [ebp+arg_0] mov eax, [ebp+arg_4] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) xor eax, eax push ebp push offset loc_647E1 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+arg_4] call @System@@LStrLen$qqrx17System@AnsiString ; System::__linkproc__ LStrLen(System::AnsiString) mov ebx, eax cmp ebx, 4 jbe short loc_647C4 lea eax, [ebp+arg_4] call j_unknown_libname_33 mov edi, eax mov edx, [edi] mov eax, esi call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) cmp dword ptr [edi], 80000h jbe short loc_64785 mov [ebp+var_8], 2 jmp short loc_6478C ; --------------------------------------------------------------------------- loc_64785: ; CODE XREF: sub_64730+4Aj mov [ebp+var_8], 102h loc_6478C: ; CODE XREF: sub_64730+53j lea eax, [ebp+var_4] push eax sub ebx, 4 push ebx lea eax, [ebp+arg_4] call j_unknown_libname_33 add eax, 4 push eax mov eax, [edi] push eax mov eax, esi call j_unknown_libname_33 push eax mov eax, [ebp+var_8] push eax mov eax, ds:off_660E4 mov eax, [eax] call eax mov eax, esi mov edx, [ebp+var_4] call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) jmp short loc_647CB ; --------------------------------------------------------------------------- loc_647C4: ; CODE XREF: sub_64730+2Fj mov eax, esi call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) loc_647CB: ; CODE XREF: sub_64730+92j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_647E8 loc_647D8: ; CODE XREF: sub_64730+B6j lea eax, [ebp+arg_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_647E1: ; DATA XREF: sub_64730+17o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_647D8 ; --------------------------------------------------------------------------- loc_647E8: ; CODE XREF: sub_64730+B0j ; DATA XREF: sub_64730+A3o pop edi pop esi pop ebx pop ecx pop ecx pop ebp retn 8 sub_64730 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_647F4 proc near ; CODE XREF: sub_65320+A3p var_C = dword ptr -0Ch var_8 = dword ptr -8 var_1 = byte ptr -1 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp add esp, 0FFFFFFF4h push ebx push esi push edi xor eax, eax mov [ebp+var_C], eax mov esi, [ebp+arg_0] mov eax, [ebp+arg_4] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) xor eax, eax push ebp push offset loc_648B7 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, esi call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) mov eax, [ebp+arg_4] call @System@@LStrLen$qqrx17System@AnsiString ; System::__linkproc__ LStrLen(System::AnsiString) mov [ebp+var_8], eax mov ebx, 1 cmp ebx, [ebp+var_8] ja short loc_64899 loc_64837: ; CODE XREF: sub_647F4+A3j mov eax, [ebp+arg_4] mov al, [eax+ebx-1] test al, al jnz short loc_6487A mov eax, [ebp+arg_4] mov al, [eax+ebx] mov [ebp+var_1], al mov eax, [esi] call @System@@LStrLen$qqrx17System@AnsiString ; System::__linkproc__ LStrLen(System::AnsiString) mov edi, eax xor edx, edx mov dl, [ebp+var_1] add edx, edi mov eax, esi call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) mov eax, esi call j_unknown_libname_33 add eax, edi xor edx, edx mov dl, [ebp+var_1] xor ecx, ecx call sub_63AA4 inc ebx jmp short loc_64893 ; --------------------------------------------------------------------------- loc_6487A: ; CODE XREF: sub_647F4+4Cj lea eax, [ebp+var_C] mov edx, [ebp+arg_4] mov dl, [edx+ebx-1] call unknown_libname_31 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov edx, [ebp+var_C] mov eax, esi call @System@@LStrCat$qqrv ; System::__linkproc__ LStrCat(void) loc_64893: ; CODE XREF: sub_647F4+84j inc ebx cmp ebx, [ebp+var_8] jbe short loc_64837 loc_64899: ; CODE XREF: sub_647F4+41j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_648BE loc_648A6: ; CODE XREF: sub_647F4+C8j lea eax, [ebp+var_C] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) lea eax, [ebp+arg_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_648B7: ; DATA XREF: sub_647F4+1Co jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_648A6 ; --------------------------------------------------------------------------- loc_648BE: ; CODE XREF: sub_647F4+C2j ; DATA XREF: sub_647F4+ADo pop edi pop esi pop ebx mov esp, ebp pop ebp retn 8 sub_647F4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_648C8 proc near ; DATA XREF: CODE:000654A8o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_648ED push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_676DC xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_648F4 loc_648EC: ; CODE XREF: sub_648C8+2Aj retn ; --------------------------------------------------------------------------- loc_648ED: ; DATA XREF: sub_648C8+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_648EC ; --------------------------------------------------------------------------- loc_648F4: ; CODE XREF: sub_648C8:loc_648ECj ; DATA XREF: sub_648C8+1Fo pop ebp retn sub_648C8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_648F8 proc near ; DATA XREF: CODE:000654A4o sub ds:dword_676DC, 1 retn sub_648F8 endp ; =============== S U B R O U T I N E ======================================= sub_64900 proc near ; CODE XREF: sub_64918+1A2p lea edx, [eax+18h] movzx eax, word ptr [eax+14h] add edx, eax mov eax, edx retn sub_64900 endp ; =============== S U B R O U T I N E ======================================= sub_6490C proc near ; CODE XREF: sub_64918+1F0p shr eax, 1Dh mov eax, ds:dword_660A0[eax*4] retn sub_6490C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64918 proc near ; CODE XREF: sub_65320+D0p var_148 = dword ptr -148h var_A4 = dword ptr -0A4h var_98 = dword ptr -98h var_7C = dword ptr -7Ch var_4C = word ptr -4Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_28 = dword ptr -28h var_21 = byte ptr -21h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_18 = byte ptr -18h var_14 = byte ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = byte ptr 8 push ebp mov ebp, esp add esp, 0FFFFFEB8h push ebx push esi push edi mov [ebp+var_C], ecx mov [ebp+var_8], edx mov [ebp+var_4], eax mov eax, [ebp+var_8] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) mov eax, [ebp+var_C] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) xor eax, eax push ebp push offset loc_64BD6 push dword ptr fs:[eax] mov fs:[eax], esp xor ebx, ebx lea eax, [ebp+var_38] xor ecx, ecx mov edx, 10h call sub_63AA4 lea eax, [ebp+var_7C] xor ecx, ecx mov edx, 44h call sub_63AA4 mov [ebp+var_7C], 44h xor eax, eax mov al, [ebp+arg_0] mov [ebp+var_4C], ax lea eax, [ebp+var_38] push eax lea eax, [ebp+var_7C] push eax push 0 push 0 push 4 push 0 push 0 push 0 mov eax, [ebp+var_C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, ds:off_660DC mov eax, [eax] call eax test eax, eax jz loc_64BBB mov [ebp+var_21], 1 xor eax, eax push ebp push offset loc_64BB4 push dword ptr fs:[eax] mov fs:[eax], esp mov [ebp+var_148], 10002h lea eax, [ebp+var_148] push eax mov eax, [ebp+var_34] push eax mov eax, ds:off_660FC mov eax, [eax] call eax test eax, eax jz loc_64B7F lea eax, [ebp+var_14] push eax push 4 lea eax, [ebp+var_10] push eax mov eax, [ebp+var_A4] add eax, 8 push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_66118 mov eax, [eax] call eax test eax, eax jz loc_64B7F mov eax, [ebp+var_10] push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_660F8 mov eax, [eax] call eax test eax, eax jb loc_64B7F cmp [ebp+var_4], 0 jz loc_64B7F mov eax, [ebp+var_4] mov eax, [eax+3Ch] add eax, [ebp+var_4] mov [ebp+var_20], eax mov edi, [ebp+var_38] sub edi, 0Ah mov eax, [ebp+var_20] mov ebx, [eax+50h] sub ebx, 1E240h mov eax, [ebp+var_20] mov esi, [eax+34h] sub esi, 1566h push 4 push 3000h add ebx, 1E240h push ebx add esi, 1566h push esi add edi, 0Ah push edi mov eax, ds:off_66104 mov eax, [eax] call eax mov [ebp+var_10], eax cmp [ebp+var_10], 0 jz loc_64B7F lea eax, [ebp+var_18] push eax mov eax, [ebp+var_20] mov eax, [eax+54h] push eax mov eax, [ebp+var_4] push eax mov eax, [ebp+var_10] push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_660F4 mov eax, [eax] call eax test eax, eax jz loc_64B7F mov eax, [ebp+var_20] call sub_64900 mov esi, eax mov eax, [ebp+var_20] movzx eax, word ptr [eax+6] dec eax test eax, eax jb short loc_64B2E inc eax mov [ebp+var_28], eax xor ebx, ebx loc_64AD3: ; CODE XREF: sub_64918+214j lea eax, [ebp+var_18] push eax lea edi, [ebx+ebx*4] mov eax, [esi+edi*8+10h] push eax mov eax, [esi+edi*8+14h] add eax, [ebp+var_4] push eax mov eax, [esi+edi*8+0Ch] add eax, [ebp+var_10] push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_660F4 mov eax, [eax] call eax test eax, eax jz short loc_64B28 lea eax, [ebp+var_1C] push eax mov eax, [esi+edi*8+24h] call sub_6490C push eax mov eax, [esi+edi*8+8] push eax mov eax, [esi+edi*8+0Ch] add eax, [ebp+var_10] push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_66114 mov eax, [eax] call eax loc_64B28: ; CODE XREF: sub_64918+1E6j inc ebx dec [ebp+var_28] jnz short loc_64AD3 loc_64B2E: ; CODE XREF: sub_64918+1B3j lea eax, [ebp+var_18] push eax push 4 lea eax, [ebp+var_10] push eax mov eax, [ebp+var_A4] add eax, 8 push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_660F4 mov eax, [eax] call eax test eax, eax jz short loc_64B7F mov eax, [ebp+var_20] mov eax, [eax+28h] add eax, [ebp+var_10] mov [ebp+var_98], eax lea eax, [ebp+var_148] push eax mov eax, [ebp+var_34] push eax mov eax, ds:off_660D0 mov eax, [eax] call eax cmp eax, 1 sbb eax, eax inc eax mov [ebp+var_21], al loc_64B7F: ; CODE XREF: sub_64918+CCj ; sub_64918+F5j ... xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64BBB loc_64B8C: ; CODE XREF: sub_64918+2A1j cmp [ebp+var_21], 0 jnz short loc_64BA3 push 0 mov eax, [ebp+var_38] push eax mov eax, ds:off_660CC mov eax, [eax] call eax jmp short loc_64BB0 ; --------------------------------------------------------------------------- loc_64BA3: ; CODE XREF: sub_64918+278j mov eax, [ebp+var_34] push eax mov eax, ds:off_660EC mov eax, [eax] call eax loc_64BB0: ; CODE XREF: sub_64918+289j mov bl, [ebp+var_21] retn ; --------------------------------------------------------------------------- loc_64BB4: ; DATA XREF: sub_64918+A1o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64B8C ; --------------------------------------------------------------------------- loc_64BBB: ; CODE XREF: sub_64918+94j ; DATA XREF: sub_64918+26Fo xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64BDD loc_64BC8: ; CODE XREF: sub_64918+2C3j lea eax, [ebp+var_C] mov edx, 2 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_64BD6: ; DATA XREF: sub_64918+28o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64BC8 ; --------------------------------------------------------------------------- loc_64BDD: ; CODE XREF: sub_64918+2BDj ; DATA XREF: sub_64918+2ABo mov eax, ebx pop edi pop esi pop ebx mov esp, ebp pop ebp retn 4 sub_64918 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64BE8 proc near ; DATA XREF: CODE:000654B0o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_64C0D push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_676E0 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64C14 loc_64C0C: ; CODE XREF: sub_64BE8+2Aj retn ; --------------------------------------------------------------------------- loc_64C0D: ; DATA XREF: sub_64BE8+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64C0C ; --------------------------------------------------------------------------- loc_64C14: ; CODE XREF: sub_64BE8:loc_64C0Cj ; DATA XREF: sub_64BE8+1Fo pop ebp retn sub_64BE8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_64C18 proc near ; DATA XREF: CODE:000654ACo sub ds:dword_676E0, 1 retn sub_64C18 endp ; =============== S U B R O U T I N E ======================================= sub_64C20 proc near ; CODE XREF: sub_64F00+22p ; sub_65320+C5p var_10C = byte ptr -10Ch push ebx add esp, 0FFFFFEF8h mov ebx, eax mov eax, esp xor ecx, ecx mov edx, 105h call sub_63AA4 push 104h lea eax, [esp+110h+var_10C] push eax push 0 call sub_63A34 ; GetModuleFileNameA mov eax, ebx mov edx, esp mov ecx, 105h call unknown_libname_32 ; BDS 2005-2006 and Delphi6-7 Visual Component Library mov eax, ebx mov edx, [ebx] call @System@@LStrAsg$qqrpvpxv ; System::__linkproc__ LStrAsg(void *,void *) add esp, 108h pop ebx retn sub_64C20 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64C68 proc near ; CODE XREF: sub_65008+33p var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ebx mov [ebp+var_4], eax mov eax, [ebp+var_4] call @System@@LStrAddRef$qqrpv ; System::__linkproc__ LStrAddRef(void *) xor eax, eax push ebp push offset loc_64CBD push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+var_4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, ds:off_660C0 mov eax, [eax] call eax cmp eax, 0FFFFFFFFh jz short loc_64CA1 test al, 10h jnz short loc_64CA5 loc_64CA1: ; CODE XREF: sub_64C68+33j xor ebx, ebx jmp short loc_64CA7 ; --------------------------------------------------------------------------- loc_64CA5: ; CODE XREF: sub_64C68+37j mov bl, 1 loc_64CA7: ; CODE XREF: sub_64C68+3Bj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64CC4 loc_64CB4: ; CODE XREF: sub_64C68+5Aj lea eax, [ebp+var_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_64CBD: ; DATA XREF: sub_64C68+13o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64CB4 ; --------------------------------------------------------------------------- loc_64CC4: ; CODE XREF: sub_64C68+54j ; DATA XREF: sub_64C68+47o mov eax, ebx pop ebx pop ecx pop ebp retn sub_64C68 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64CCC proc near ; CODE XREF: sub_64D8C+1Fp var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx xor edx, edx mov [ebp+var_4], edx mov ebx, eax xor eax, eax push ebp push offset loc_64D3D push dword ptr fs:[eax] mov fs:[eax], esp mov [ebp+var_8], 0FDh lea eax, [ebp+var_4] mov edx, 0FEh call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) lea eax, [ebp+var_8] push eax mov eax, [ebp+var_4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, ds:off_660C4 mov eax, [eax] call eax lea eax, [ebp+var_4] mov edx, [ebp+var_8] call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) mov eax, ebx mov edx, [ebp+var_4] call @System@@LStrAsg$qqrpvpxv ; System::__linkproc__ LStrAsg(void *,void *) xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64D44 loc_64D34: ; CODE XREF: sub_64CCC+76j lea eax, [ebp+var_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_64D3D: ; DATA XREF: sub_64CCC+11o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64D34 ; --------------------------------------------------------------------------- loc_64D44: ; CODE XREF: sub_64CCC+70j ; DATA XREF: sub_64CCC+63o pop ebx pop ecx pop ecx pop ebp retn sub_64CCC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_64D4C proc near ; CODE XREF: sub_64D8C+4Ep var_108 = dword ptr -108h var_104 = byte ptr -104h push ebx add esp, 0FFFFFEFCh mov ebx, eax mov [esp+108h+var_108], 100h push esp lea eax, [esp+10Ch+var_104] push eax call sub_63A1C ; GetComputerNameA test eax, eax jz short loc_64D7D mov eax, ebx lea edx, [esp+108h+var_104] mov ecx, 100h call unknown_libname_32 ; BDS 2005-2006 and Delphi6-7 Visual Component Library jmp short loc_64D84 ; --------------------------------------------------------------------------- loc_64D7D: ; CODE XREF: sub_64D4C+1Dj mov eax, ebx call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) loc_64D84: ; CODE XREF: sub_64D4C+2Fj add esp, 104h pop ebx retn sub_64D4C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64D8C proc near ; CODE XREF: sub_65238+9p var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp xor ecx, ecx push ecx push ecx push ecx push ecx push ecx push ecx push ebx xor eax, eax push ebp push offset loc_64E23 push dword ptr fs:[eax] mov fs:[eax], esp xor ebx, ebx lea eax, [ebp+var_4] call sub_64CCC mov eax, [ebp+var_4] push eax lea eax, [ebp+var_C] call sub_63D8C mov edx, [ebp+var_C] lea ecx, [ebp+var_8] mov eax, offset _str______5__.Text call sub_63C30 mov edx, [ebp+var_8] pop eax call @System@@LStrCmp$qqrv ; System::__linkproc__ LStrCmp(void) jnz short loc_64E08 lea eax, [ebp+var_10] call sub_64D4C mov eax, [ebp+var_10] push eax lea eax, [ebp+var_18] call sub_63D8C mov edx, [ebp+var_18] lea ecx, [ebp+var_14] mov eax, offset dword_64E50 call sub_63C30 mov edx, [ebp+var_14] pop eax call @System@@LStrCmp$qqrv ; System::__linkproc__ LStrCmp(void) jnz short loc_64E08 mov bl, 1 loc_64E08: ; CODE XREF: sub_64D8C+49j ; sub_64D8C+78j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64E2A loc_64E15: ; CODE XREF: sub_64D8C+9Cj lea eax, [ebp+var_18] mov edx, 6 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_64E23: ; DATA XREF: sub_64D8C+Fo jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64E15 ; --------------------------------------------------------------------------- loc_64E2A: ; CODE XREF: sub_64D8C+96j ; DATA XREF: sub_64D8C+84o mov eax, ebx pop ebx mov esp, ebp pop ebp retn sub_64D8C endp ; --------------------------------------------------------------------------- align 4 _str______5__ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_64D8C+36o dd 8 ; Len db '[5|',0 ; Text align 4 dd 0FFFFFFFFh unknown_libname_44 dd 0Ch dword_64E50 dd 0B4C3C04Dh, 4BAC00CCh, 0A13E736h, 0; [0000008C BYTES: COLLAPSED FUNCTION sub_64E60. PRESS KEYPAD "+" TO EXPAND] _str_M______L___ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_64E60+4Ao dd 11 ; Len db 'M:L',0Bh,',',0; Text ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_64F00 proc near ; CODE XREF: sub_65238+1Bp var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp mov ecx, 4 loc_64F08: ; CODE XREF: sub_64F00+Dj push 0 push 0 dec ecx jnz short loc_64F08 push ecx push ebx xor eax, eax push ebp push offset loc_64FCC push dword ptr fs:[eax] mov fs:[eax], esp lea eax, [ebp+var_4] call sub_64C20 lea eax, [ebp+var_C] call sub_63D8C mov edx, [ebp+var_C] lea ecx, [ebp+var_8] mov eax, offset _str_M____8_7___.Text call sub_63C30 mov edx, [ebp+var_8] mov eax, [ebp+var_4] call @System@@LStrCmp$qqrv ; System::__linkproc__ LStrCmp(void) jnz short loc_64F4E xor ebx, ebx loc_64F4E: ; CODE XREF: sub_64F00+4Aj lea eax, [ebp+var_18] call sub_63D8C mov edx, [ebp+var_18] lea ecx, [ebp+var_14] mov eax, offset _str_M____9_u___7_.Text call sub_63C30 mov eax, [ebp+var_14] push eax lea eax, [ebp+var_1C] call sub_63D8C mov edx, [ebp+var_1C] lea ecx, [ebp+var_10] pop eax call sub_63C30 mov eax, [ebp+var_10] push eax lea eax, [ebp+var_24] call sub_63D8C mov edx, [ebp+var_24] lea ecx, [ebp+var_20] mov eax, [ebp+var_4] call sub_63C30 mov eax, [ebp+var_20] pop edx call unknown_libname_34 ; BDS 2005-2006 and Delphi6-7 Visual Component Library test eax, eax jz short loc_64FA7 xor ebx, ebx loc_64FA7: ; CODE XREF: sub_64F00+A3j test ebx, ebx jnz short loc_64FAF mov bl, 1 jmp short loc_64FB1 ; --------------------------------------------------------------------------- loc_64FAF: ; CODE XREF: sub_64F00+A9j xor ebx, ebx loc_64FB1: ; CODE XREF: sub_64F00+ADj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_64FD3 loc_64FBE: ; CODE XREF: sub_64F00+D1j lea eax, [ebp+var_24] mov edx, 9 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_64FCC: ; DATA XREF: sub_64F00+14o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_64FBE ; --------------------------------------------------------------------------- loc_64FD3: ; CODE XREF: sub_64F00+CBj ; DATA XREF: sub_64F00+B9o mov eax, ebx pop ebx mov esp, ebp pop ebp retn sub_64F00 endp ; --------------------------------------------------------------------------- align 4 _str_M____8_7___ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_64F00+35o dd 11 ; Len db 'M҂87',1Dh,';',0; Text _str_M____9_u___7_ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_64F00+5Co dd 13 ; Len db 'Mҗ9u',1Dh,';7',0; Text align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_65008 proc near ; CODE XREF: sub_65238+36p var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push 0 push 0 push ebx xor eax, eax push ebp push offset loc_65061 push dword ptr fs:[eax] mov fs:[eax], esp xor ebx, ebx lea eax, [ebp+var_8] call sub_63D8C mov edx, [ebp+var_8] lea ecx, [ebp+var_4] mov eax, offset _str_M______k_____wh.Text call sub_63C30 mov eax, [ebp+var_4] call sub_64C68 test al, al jz short loc_65046 mov bl, 1 loc_65046: ; CODE XREF: sub_65008+3Aj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_65068 loc_65053: ; CODE XREF: sub_65008+5Ej lea eax, [ebp+var_8] mov edx, 2 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_65061: ; DATA XREF: sub_65008+Bo jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_65053 ; --------------------------------------------------------------------------- loc_65068: ; CODE XREF: sub_65008+58j ; DATA XREF: sub_65008+46o mov eax, ebx pop ebx pop ecx pop ecx pop ebp retn sub_65008 endp ; --------------------------------------------------------------------------- align 10h _str_M______k_____wh dd 0FFFFFFFFh ; _top ; DATA XREF: sub_65008+26o dd 42 ; Len db 'MҴ;k',19h,'~',9,'wh"B',8,'',0Dh,'D',0Bh,'7Ī',0Fh,12h,'T2=[ۗѾ',0; Text align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_650A4 proc near ; CODE XREF: sub_65238+3Fp var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push 0 push 0 push ebx xor eax, eax push ebp push offset loc_65107 push dword ptr fs:[eax] mov fs:[eax], esp xor ebx, ebx lea eax, [ebp+var_8] call sub_63D8C mov edx, [ebp+var_8] lea ecx, [ebp+var_4] mov eax, offset _str______8_7__2.Text call sub_63C30 mov eax, [ebp+var_4] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, ds:off_660D8 mov eax, [eax] call eax test eax, eax jz short loc_650EC mov bl, 1 loc_650EC: ; CODE XREF: sub_650A4+44j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_6510E loc_650F9: ; CODE XREF: sub_650A4+68j lea eax, [ebp+var_8] mov edx, 2 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_65107: ; DATA XREF: sub_650A4+Bo jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_650F9 ; --------------------------------------------------------------------------- loc_6510E: ; CODE XREF: sub_650A4+62j ; DATA XREF: sub_650A4+50o mov eax, ebx pop ebx pop ecx pop ecx pop ebp retn sub_650A4 endp ; --------------------------------------------------------------------------- align 4 _str______8_7__2 dd 0FFFFFFFFh ; _top ; DATA XREF: sub_650A4+26o dd 11 ; Len db ']87',1Ch,'2',0; Text ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_6512C proc near ; CODE XREF: CODE:00065544p var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = byte ptr -10h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp xor ecx, ecx push ecx push ecx push ecx push ecx push ecx push ecx push ecx push ecx push ebx xor eax, eax push ebp push offset loc_651F6 push dword ptr fs:[eax] mov fs:[eax], esp mov bl, 1 lea eax, [ebp+var_8] push eax lea eax, [ebp+var_18] call sub_63D8C mov edx, [ebp+var_18] lea ecx, [ebp+var_14] mov eax, offset _str_M______9__0__GQ.Text call sub_63C30 mov eax, [ebp+var_14] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax push 80000001h mov eax, ds:off_660E8 mov eax, [eax] call eax test eax, eax jnz short loc_651D3 nop lea eax, [ebp+var_C] push eax mov eax, [ebp+var_4] push eax lea eax, [ebp+var_10] push eax push 0 lea eax, [ebp+var_20] call sub_63D8C mov edx, [ebp+var_20] lea ecx, [ebp+var_1C] mov eax, offset _str_L______l__.Text call sub_63C30 mov eax, [ebp+var_1C] call @System@@LStrToPChar$qqrx17System@AnsiString ; System::__linkproc__ LStrToPChar(System::AnsiString) push eax mov eax, [ebp+var_8] push eax mov eax, ds:off_660C8 mov eax, [eax] call eax test eax, eax jnz short loc_651C5 nop xor ebx, ebx loc_651C5: ; CODE XREF: sub_6512C+94j mov eax, [ebp+var_8] push eax mov eax, ds:off_66100 mov eax, [eax] call eax nop loc_651D3: ; CODE XREF: sub_6512C+53j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_651FD loc_651E0: ; CODE XREF: sub_6512C+CFj lea eax, [ebp+var_20] mov edx, 4 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) lea eax, [ebp+var_4] call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) retn ; --------------------------------------------------------------------------- loc_651F6: ; DATA XREF: sub_6512C+11o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_651E0 ; --------------------------------------------------------------------------- loc_651FD: ; CODE XREF: sub_6512C+C9j ; DATA XREF: sub_6512C+AFo mov eax, ebx pop ebx mov esp, ebp pop ebp retn sub_6512C endp ; --------------------------------------------------------------------------- _str_M______9__0__GQ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_6512C+30o dd 21 ; Len db 'M;9(0*GQ',12h,'~',8,'',0; Text align 4 _str_L______l__ dd 0FFFFFFFFh ; _top ; DATA XREF: sub_6512C+72o dd 10 ; Len db 'L&l',16h,'',0 ; Text align 4 ; =============== S U B R O U T I N E ======================================= sub_65238 proc near ; CODE XREF: CODE:00065559p nop sidt fword ptr ds:byte_676E8 nop call sub_64D8C cmp al, 1 jz short loc_65280 call sub_64E60 cmp al, 1 jz short loc_65280 call sub_64F00 cmp al, 1 jz short loc_65280 cmp ds:byte_676E8+5, 0FFh jz short loc_65280 cmp ds:byte_676E8+5, 0E8h jz short loc_65280 call sub_65008 cmp al, 1 jz short loc_65280 call sub_650A4 cmp al, 1 jnz short locret_6528B loc_65280: ; CODE XREF: sub_65238+10j ; sub_65238+19j ... push 0 mov eax, ds:off_660F0 mov eax, [eax] call eax locret_6528B: ; CODE XREF: sub_65238+46j retn sub_65238 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_6528C proc near ; DATA XREF: CODE:000654B8o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_652B1 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_676E4 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_652B8 loc_652B0: ; CODE XREF: sub_6528C+2Aj retn ; --------------------------------------------------------------------------- loc_652B1: ; DATA XREF: sub_6528C+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_652B0 ; --------------------------------------------------------------------------- loc_652B8: ; CODE XREF: sub_6528C:loc_652B0j ; DATA XREF: sub_6528C+1Fo pop ebp retn sub_6528C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_652BC proc near ; DATA XREF: CODE:000654B4o sub ds:dword_676E4, 1 retn sub_652BC endp ; =============== S U B R O U T I N E ======================================= sub_652C4 proc near ; CODE XREF: sub_65320+24p push ebx push esi mov esi, eax push 0Ah push edx mov eax, ds:dword_67650 push eax mov eax, ds:off_660D4 mov eax, [eax] call eax mov ebx, eax push ebx mov eax, ds:dword_67650 push eax mov eax, ds:off_66110 mov eax, [eax] call eax mov [esi], eax push ebx mov eax, ds:dword_67650 push eax mov eax, ds:off_66108 mov eax, [eax] call eax mov ebx, eax push ebx mov eax, ds:off_6610C mov eax, [eax] call eax mov esi, eax test esi, esi jz short loc_6531A push ebx mov eax, ds:off_6611C mov eax, [eax] call eax loc_6531A: ; CODE XREF: sub_652C4+4Aj mov eax, esi pop esi pop ebx retn sub_652C4 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_65320 proc near ; DATA XREF: CODE:00065560o var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_8 = dword ptr 10h push ebp mov ebp, esp xor ecx, ecx push ecx push ecx push ecx push ecx push ecx push ebx xor eax, eax push ebp push offset loc_6541F push dword ptr fs:[eax] mov fs:[eax], esp or ebx, 0FFFFFFFFh mov eax, offset dword_676F4 mov edx, [ebp+arg_8] call sub_652C4 mov ds:dword_676F0, eax cmp ds:dword_676F0, 0 jz loc_653F9 mov eax, offset dword_676F8 mov edx, ds:dword_676F4 call @System@@LStrSetLength$qqrv ; System::__linkproc__ LStrSetLength(void) mov eax, offset dword_676F8 call j_unknown_libname_33 mov edx, eax mov eax, ds:dword_676F0 mov ecx, ds:dword_676F4 call @System@Move$qqrpxvpvi ; System::Move(void *,void *,int) lea eax, [ebp+var_8] call sub_63D8C mov edx, [ebp+var_8] lea ecx, [ebp+var_4] mov eax, ds:dword_676F8 call sub_63C30 mov edx, [ebp+var_4] mov eax, offset dword_676F8 call @System@@LStrAsg$qqrpvpxv ; System::__linkproc__ LStrAsg(void *,void *) mov eax, ds:dword_676F8 push eax lea eax, [ebp+var_10] push eax call sub_64730 mov eax, [ebp+var_10] push eax lea eax, [ebp+var_C] push eax call sub_647F4 mov edx, [ebp+var_C] mov eax, offset dword_676F8 call @System@@LStrAsg$qqrpvpxv ; System::__linkproc__ LStrAsg(void *,void *) push 0 mov eax, offset dword_676F8 call j_unknown_libname_33 push eax lea eax, [ebp+var_14] call sub_64C20 mov edx, [ebp+var_14] xor ecx, ecx pop eax call sub_64918 test al, al jmp short loc_65404 ; --------------------------------------------------------------------------- loc_653F9: ; CODE XREF: sub_65320+35j push 0 mov eax, ds:off_660F0 mov eax, [eax] call eax loc_65404: ; CODE XREF: sub_65320+D7j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_65426 loc_65411: ; CODE XREF: sub_65320+104j lea eax, [ebp+var_14] mov edx, 5 call @System@@LStrArrayClr$qqrpvi ; System::__linkproc__ LStrArrayClr(void *,int) retn ; --------------------------------------------------------------------------- loc_6541F: ; DATA XREF: sub_65320+Eo jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_65411 ; --------------------------------------------------------------------------- loc_65426: ; CODE XREF: sub_65320+FEj ; DATA XREF: sub_65320+ECo mov eax, ebx pop ebx mov esp, ebp pop ebp retn 10h sub_65320 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_65430 proc near ; DATA XREF: CODE:000654C0o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_65459 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, offset dword_676F8 call @System@@LStrClr$qqrpv ; System::__linkproc__ LStrClr(void *) xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_65460 loc_65458: ; CODE XREF: sub_65430+2Ej retn ; --------------------------------------------------------------------------- loc_65459: ; DATA XREF: sub_65430+6o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_65458 ; --------------------------------------------------------------------------- loc_65460: ; CODE XREF: sub_65430:loc_65458j ; DATA XREF: sub_65430+23o pop ebp retn sub_65430 endp ; --------------------------------------------------------------------------- align 4 dword_65464 dd 0Bh ; BSS:off_67628o dd offset off_6546C off_6546C dd offset loc_639CC ; DATA XREF: CODE:00065468o dd offset sub_6399C dd offset @System@initialization$qqrv ; System::initialization(void) dd offset @System@Finalization$qqrv ; System::Finalization(void) dd offset sub_63A04 dd offset sub_639D4 dd offset sub_63A9C dd offset sub_63A6C dd offset sub_63CC0 dd offset sub_63C90 dd offset sub_63CF8 dd offset sub_63CC8 dd offset sub_6471C dd offset sub_646EC dd offset sub_648F8 dd offset sub_648C8 dd offset sub_64C18 dd offset sub_64BE8 dd offset sub_652BC dd offset sub_6528C align 10h dd offset sub_65430 ; --------------------------------------------------------------------------- public start start: push ebp mov ebp, esp add esp, 0FFFFFFF0h mov eax, offset dword_65464 call @Sysinit@@InitExe$qqrpv ; Sysinit::__linkproc__ InitExe(void *) xor eax, eax push ebp push offset loc_65580 push dword ptr fs:[eax] mov fs:[eax], esp push 0 push 0 call sub_63A0C ; SetThreadToken call sub_63A2C ; RtlGetLastWin32Error push 0 push 0 push 0 call sub_63A5C ; SetTapeParameters push 0 call sub_63A54 ; SetEvent push 0 push 0 push 0 push 0 call sub_63A24 ; GetFileTime push 0 call sub_63A4C ; ResetEvent push 0 push 0 call sub_63A14 ; FlushViewOfFile push 0 push 0 push 0 push 0FFFFFFFh call sub_63A64 ; MessageBoxA test eax, eax jz short loc_6553E push 0 mov eax, ds:off_660F0 mov eax, [eax] call eax loc_6553E: ; CODE XREF: CODE:00065531j call sub_63DC0 nop call sub_6512C test al, al jz short loc_65558 push 0 mov eax, ds:off_660F0 mov eax, [eax] call eax loc_65558: ; CODE XREF: CODE:0006554Bj nop call sub_65238 push 0 push offset sub_65320 push 0Ah push 0 mov eax, ds:off_660E0 mov eax, [eax] call eax xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_65587 loc_6557F: ; CODE XREF: CODE:00065585j retn ; --------------------------------------------------------------------------- loc_65580: ; DATA XREF: CODE:000654D7o jmp unknown_libname_23 ; BDS 2005-2006 and Delphi6-7 Visual Component Library ; --------------------------------------------------------------------------- jmp short loc_6557F ; --------------------------------------------------------------------------- loc_65587: ; CODE XREF: CODE:loc_6557Fj ; DATA XREF: CODE:0006557Ao call @System@@Halt0$qqrv ; System::__linkproc__ Halt0(void) ; --------------------------------------------------------------------------- dd 1Dh dup(?) CODE ends ; Section 2. (virtual address 00006000) ; Virtual size : 00000120 ( 288.) ; Section size in file : 00000120 ( 288.) ; Offset to raw data for section: 00006000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write DATA segment para public 'DATA' use32 assume cs:DATA ;org 66000h dword_66000 dd 0 ; unknown_libname_29+2w ... dword_66004 dd 0 ; unknown_libname_28+37r ... byte_66008 db 2 ; DATA XREF: System::initialization(void)+Dw db 8Dh, 40h, 0 word_6600C dw 1332h ; DATA XREF: unknown_libname_13+6r ; unknown_libname_13:loc_62AD4r ... dw 0C08Bh byte_66010 db 0 ; DATA XREF: unknown_libname_15r ; unknown_libname_16r ... db 8Dh, 40h, 0 byte_66014 db 0 ; DATA XREF: System::__linkproc__ HandleAnyException(void)+52r ; System::__linkproc__ HandleAnyException(void):loc_62CB5r db 8Dh, 40h, 0 byte_66018 db 0 ; DATA XREF: unknown_libname_30:loc_631BDr db 8Dh, 40h, 0 off_6601C dd offset dword_66088 ; DATA XREF: System::RegisterModule(System::TLibModule *)r ; System::RegisterModule(System::TLibModule *)+8w ... dword_66020 dd 0 off_66024 dd offset @System@SysGetMem$qqri ; DATA XREF: System::__linkproc__ GetMem(int)+Ar ; System::__linkproc__ ReallocMem(void *&,int)+3Fr ; System::SysGetMem(int) off_66028 dd offset @System@SysFreeMem$qqrpv ; DATA XREF: System::__linkproc__ FreeMem(void *)+5r ; System::__linkproc__ ReallocMem(void *&,int)+26r ; System::SysFreeMem(void *) off_6602C dd offset @System@SysReallocMem$qqrpvi ; DATA XREF: System::__linkproc__ ReallocMem(void *&,int)+Dr ; System::SysReallocMem(void *,int) byte_66030 db 0 ; DATA XREF: unknown_libname_10+36r aRsu db '',0 aFxn@ db '@',0 aError db 'Error',0 ; DATA XREF: unknown_libname_30+6Co dw 0C08Bh aRuntimeErrorAt db 'Runtime error at 00000000',0 ; DATA XREF: unknown_libname_28+3o ; unknown_libname_30+32o ... dw 0C08Bh byte_66074 db 30h ; DATA XREF: unknown_libname_28+41r db 31h, 32h, 33h dd 37363534h, 42413938h, 46454443h TlsIndex dd 0 ; DATA XREF: unknown_libname_37+Cr ; unknown_libname_37+37r ... dword_66088 dd 0 ; Sysinit::__linkproc__ InitExe(void *)+33o ... dword_6608C dd 60000h dword_66090 dd 0 dword_66094 dd 0 align 10h dword_660A0 dd 1 dd 10h, 2, 20h, 4, 40h, 4, 40h off_660C0 dd offset dword_676B8 ; DATA XREF: sub_64C68+27r off_660C4 dd offset dword_676BC ; DATA XREF: sub_64CCC+3Dr ; sub_64E60+33r off_660C8 dd offset dword_676D0 ; DATA XREF: sub_6512C+89r off_660CC dd offset dword_676AC ; DATA XREF: sub_64918+280r off_660D0 dd offset dword_67670 ; DATA XREF: sub_64918+255r off_660D4 dd offset dword_67694 ; DATA XREF: sub_652C4+Dr off_660D8 dd offset dword_676C0 ; DATA XREF: sub_650A4+39r off_660DC dd offset dword_67680 ; DATA XREF: sub_64918+89r off_660E0 dd offset dword_676A4 ; DATA XREF: CODE:00065569r off_660E4 dd offset dword_676C8 ; DATA XREF: sub_64730+7Fr off_660E8 dd offset dword_676CC ; DATA XREF: sub_6512C+48r off_660EC dd offset dword_6766C ; DATA XREF: sub_64918+28Fr off_660F0 dd offset dword_676B4 ; DATA XREF: sub_65238+4Ar ; sub_65320+DBr ... off_660F4 dd offset dword_67684 ; DATA XREF: sub_64918+18Er ; sub_64918+1DBr ... off_660F8 dd offset dword_67690 ; DATA XREF: sub_64918+103r off_660FC dd offset dword_6767C ; DATA XREF: sub_64918+C1r off_66100 dd offset dword_676D4 ; DATA XREF: sub_6512C+9Dr off_66104 dd offset dword_67674 ; DATA XREF: sub_64918+161r off_66108 dd offset dword_6769C ; DATA XREF: sub_652C4+31r off_6610C dd offset dword_67698 ; DATA XREF: sub_652C4+3Dr off_66110 dd offset dword_676A0 ; DATA XREF: sub_652C4+1Fr off_66114 dd offset dword_6768C ; DATA XREF: sub_64918+207r off_66118 dd offset dword_67678 ; DATA XREF: sub_64918+EAr off_6611C dd offset dword_676B0 ; DATA XREF: sub_652C4+4Dr align 100h DATA ends ; Section 3. (virtual address 00007000) ; Virtual size : 000006FD ( 1789.) ; Section size in file : 000006FD ( 1789.) ; Offset to raw data for section: 00007000 ; Flags C0000000: Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Regular ; Segment permissions: Read/Write BSS segment para public '' use32 assume cs:BSS ;org 67000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing off_67000 dd offset loc_63600 ; DATA XREF: System::initialization(void)+2Fw dword_67004 dd 0 dword_67008 dd 0 ; unknown_libname_10+16r dword_6700C dd 0 ; CODE:00062F20r off_67010 dd offset sub_61008 ; DATA XREF: unknown_libname_15+14r ; unknown_libname_16+16r ... off_67014 dd offset sub_61010 ; DATA XREF: System::__linkproc__ HandleAnyException(void)+D2r ; CODE:00062F08r ... dword_67018 dd 0 ; System::__linkproc__ Halt0(void)+B7r dword_6701C dd 60000h dword_67020 dd 750h byte_67024 db 0 ; DATA XREF: System::__linkproc__ StartExe(System::PackageInfoTable *,System::TLibModule *)+33w align 4 dword_67028 dd 0Ah dword_6702C dd 182340h dword_67030 dd 0 byte_67034 db 0 ; DATA XREF: unknown_libname_30+1r byte_67035 db 0 ; DATA XREF: System::_16463+1Cr ; System::_16463:loc_619A8r ... byte_67036 db 2 ; DATA XREF: System::initialization(void)+28w align 4 dword_67038 dd 0 ; System::Finalization(void)+19o word_6703C dw 0D7B0h ; DATA XREF: System::initialization(void)+4Cw align 10h dd 71h dup(0) dword_67204 dd 0 ; System::Finalization(void)+23o word_67208 dw 0D7B0h ; DATA XREF: unknown_libname_30+Ar ; System::initialization(void)+55w align 10h dword_67210 dd 0 align 10h dword_67220 dd 0 dd 6Bh dup(0) dword_673D0 dd 0 word_673D4 dw 0D7B0h ; DATA XREF: System::initialization(void)+5Ew align 4 dd 71h dup(0) dword_6759C dd 1 ; System::_16479+C3w ... dword_675A0 dd 40h ; System::_16479+CCw ... dword_675A4 dd 0FFFFFFFFh ; System::initialization(void)w dword_675A8 dd 3 ; System::initialization(void)+B2w ... byte_675AC db 1 ; DATA XREF: System::_16463+A0w ; System::_16463:loc_619C3r ... align 10h dword_675B0 dd 0 ; System::_16459+99w ... dword_675B4 dd 7C97CB20h, 0FFFFFFFFh, 4 dup(0) ; System::_16463+25o ... dword_675CC dd 184DF0h ; System::_16449+3Cw ... dword_675D0 dd 1853F4h ; System::_16452+22r ... dword_675D4 dd 185404h ; unknown_libname_3+51o ... dd 185404h, 2 dup(0) dword_675E4 dd 2 dup(185414h), 2 dup(0) ; System::_16461+12o ... dword_675F4 dd 840044h dword_675F8 dd 840044h align 10h dword_67600 dd 840044h ; System::_16465+4r ... dword_67604 dd 0 ; unknown_libname_6+9r ... dword_67608 dd 0 ; unknown_libname_6+2Er ... dword_6760C dd 183DF0h ; System::_16463+5Er ... dword_67610 dd 185424h ; System::_16464+90o ... dd 185424h, 2 dup(0) dword_67620 dd 0 ; System::_16722+9o ... dword_67624 dd 17FFB4h ; unknown_libname_27+2r off_67628 dd offset dword_65464 ; DATA XREF: System::__linkproc__ StartExe(System::PackageInfoTable *,System::TLibModule *)+14w dword_6762C dd 0Bh off_67630 dd offset dword_66088 ; DATA XREF: System::__linkproc__ StartExe(System::PackageInfoTable *,System::TLibModule *)+20w dd 6 dup(0) byte_6764C db 0 ; DATA XREF: Sysinit::__linkproc__ GetTls(void)r align 10h dword_67650 dd 60000h ; Sysinit::__linkproc__ InitExe(void *)+16r ... dword_67654 dd 0FFFFFFFFh ; CODE:loc_639CCw dword_67658 dd 0 dword_6765C dd 0FFFFFFFFh dword_67660 dd 0FFFFFFFFh dword_67664 dd 0FFFFFFFFh dword_67668 dd 0FFFFFFFFh dword_6766C dd 7C8328F7h ; resolved to->KERNEL32.ResumeThread ; DATA:off_660ECo dword_67670 dd 7C862A69h ; resolved to->KERNEL32.SetThreadContext ; sub_63DC0+288w ... dword_67674 dd 7C809A72h ; resolved to->KERNEL32.VirtualAllocEx ; DATA:off_66104o dword_67678 dd 7C8021CCh ; resolved to->KERNEL32.ReadProcessMemory ; DATA:off_66118o dword_6767C dd 7C83970Dh ; resolved to->KERNEL32.GetThreadContext ; DATA:off_660FCo dword_67680 dd 7C802367h ; resolved to->KERNEL32.CreateProcessA ; DATA:off_660DCo dword_67684 dd 7C80220Fh ; resolved to->KERNEL32.WriteProcessMemory ; DATA:off_660F4o dword_67688 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddressdword_6768C dd 7C801A5Dh ; resolved to->KERNEL32.VirtualProtectEx ; DATA:off_66114o dword_67690 dd 7C90E960h ; resolved to->NTDLL.ZwUnmapViewOfSection ; DATA:off_660F8o dword_67694 dd 7C80BE89h ; resolved to->KERNEL32.FindResourceA ; DATA:off_660D4o dword_67698 dd 7C80CC97h ; resolved to->KERNEL32.SetHandleCount ; DATA:off_6610Co dword_6769C dd 7C809FB5h ; resolved to->KERNEL32.LoadResource ; DATA:off_66108o dword_676A0 dd 7C80BC69h ; resolved to->KERNEL32.SizeofResource ; DATA:off_66110o dword_676A4 dd 7C85F229h ; resolved to->KERNEL32.EnumResourceNamesA ; DATA:off_660E0o dword_676A8 dd 7C80ABDEh ; resolved to->KERNEL32.FreeLibrary ; sub_63DC0+5F3r ... dword_676AC dd 7C801E16h ; resolved to->KERNEL32.TerminateProcess ; DATA:off_660CCo dword_676B0 dd 7C8260C2h ; resolved to->KERNEL32.FreeResource ; DATA:off_6611Co dword_676B4 dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcess ; DATA:off_660F0o dword_676B8 dd 7C81153Ch ; resolved to->KERNEL32.GetFileAttributesA ; DATA:off_660C0o dword_676BC dd 77DFD4C9h ; resolved to->ADVAPI32.GetUserNameA ; DATA:off_660C4o dword_676C0 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleA ; DATA:off_660D8o dword_676C4 dd 0 dword_676C8 dd 7C961329h ; resolved to->NTDLL.RtlDecompressBuffer ; DATA:off_660E4o dword_676CC dd 77DFC41Bh ; resolved to->ADVAPI32.RegOpenKeyA ; DATA:off_660E8o dword_676D0 dd 77DD7883h ; resolved to->ADVAPI32.RegQueryValueExA ; DATA:off_660C8o dword_676D4 dd 77DD6BF0h ; resolved to->ADVAPI32.RegCloseKey ; DATA:off_66100o dword_676D8 dd 0FFFFFFFFh dword_676DC dd 0FFFFFFFFh dword_676E0 dd 0FFFFFFFFh dword_676E4 dd 0FFFFFFFFh byte_676E8 db 0FFh, 7, 0, 80h, 0C1h, 0FFh ; DATA XREF: sub_65238+1w ; sub_65238+24r ... align 10h dword_676F0 dd 0 ; sub_65320+2Er ... dword_676F4 dd 0 ; sub_65320+40r ... dword_676F8 dd 0 ; sub_65320+4Bo ... align 200h BSS ends ; Section 4. (virtual address 00008000) ; Virtual size : 00000496 ( 1174.) ; Section size in file : 00000496 ( 1174.) ; Offset to raw data for section: 00008000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata segment para public 'DATA' use32 assume cs:_idata ;org 68000h dd 3 dup(0) dd 8164h, 80A0h, 3 dup(0) dd 82ECh, 80F8h, 3 dup(0) dd 8318h, 8104h, 3 dup(0) dd 8358h, 8114h, 3 dup(0) dd 83A4h, 8128h, 3 dup(0) dd 83C4h, 8130h, 3 dup(0) dd 847Ch, 815Ch, 5 dup(0) dword_680A0 dd 7C91188Ah ; resolved to->NTDLL.RtlDeleteCriticalSectiondword_680A4 dd 7C9010EDh ; resolved to->NTDLL.RtlLeaveCriticalSectiondword_680A8 dd 7C901005h ; resolved to->NTDLL.RtlEnterCriticalSectiondword_680AC dd 7C809EF1h ; resolved to->KERNEL32.InitializeCriticalSectiondword_680B0 dd 7C809AE4h ; resolved to->KERNEL32.VirtualFreedword_680B4 dd 7C809A51h ; resolved to->KERNEL32.VirtualAllocdword_680B8 dd 7C80992Fh ; resolved to->KERNEL32.LocalFreedword_680BC dd 7C80998Dh ; resolved to->KERNEL32.LocalAllocdword_680C0 dd 7C8111DAh ; resolved to->KERNEL32.GetVersiondword_680C4 dd 7C809728h ; resolved to->KERNEL32.GetCurrentThreadIddword_680C8 dd 7C80A415h ; resolved to->KERNEL32.GetThreadLocaledword_680CC dd 7C801EEEh ; resolved to->KERNEL32.GetStartupInfoAdword_680D0 dd 7C80D262h ; resolved to->KERNEL32.GetLocaleInfoAdword_680D4 dd 7C812F1Dh ; resolved to->KERNEL32.GetCommandLineAdword_680D8 dd 7C80ABDEh ; resolved to->KERNEL32.FreeLibrarydword_680DC dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcessdword_680E0 dd 7C810D87h ; resolved to->KERNEL32.WriteFiledword_680E4 dd 7C862E2Ah ; resolved to->KERNEL32.UnhandledExceptionFilterdword_680E8 dd 7C937A40h ; resolved to->NTDLL.RtlUnwinddword_680EC dd 7C812A09h ; resolved to->KERNEL32.RaiseExceptiondword_680F0 dd 7C812F39h ; resolved to->KERNEL32.GetStdHandle align 8 dword_680F8 dd 7E43119Bh ; resolved to->USER32.GetKeyboardTypedword_680FC dd 7E45058Ah ; resolved to->USER32.MessageBoxA dd 0 dword_68104 dd 77DD7883h ; resolved to->ADVAPI32.RegQueryValueExAdword_68108 dd 77DD761Bh ; resolved to->ADVAPI32.RegOpenKeyExAdword_6810C dd 77DD6BF0h ; resolved to->ADVAPI32.RegCloseKey dd 0 dword_68114 dd 7C809BC5h ; resolved to->KERNEL32.TlsSetValuedword_68118 dd 7C809740h ; resolved to->KERNEL32.TlsGetValuedword_6811C dd 7C80998Dh ; resolved to->KERNEL32.LocalAllocdword_68120 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleA align 8 dword_68128 dd 77DD7E3Dh ; resolved to->ADVAPI32.SetThreadToken align 10h dword_68130 dd 7C86B1EEh ; resolved to->KERNEL32.SetTapeParametersdword_68134 dd 7C80A017h ; resolved to->KERNEL32.SetEventdword_68138 dd 7C80A03Bh ; resolved to->KERNEL32.ResetEventdword_6813C dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryAdword_68140 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddressdword_68144 dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameAdword_68148 dd 7C910331h ; resolved to->NTDLL.RtlGetLastWin32Errordword_6814C dd 7C831C45h ; resolved to->KERNEL32.GetFileTimedword_68150 dd 7C8216A4h ; resolved to->KERNEL32.GetComputerNameAdword_68154 dd 7C835971h ; resolved to->KERNEL32.FlushViewOfFile dd 0 dword_6815C dd 7E45058Ah ; resolved to->USER32.MessageBoxA dd 0 aKernel32_dll db 'kernel32.dll',0 align 4 aDeletecritical db 'DeleteCriticalSection',0 align 4 aLeavecriticals db 'LeaveCriticalSection',0 align 4 aEntercriticals db 'EnterCriticalSection',0 align 4 aInitializecrit db 'InitializeCriticalSection',0 align 4 aVirtualfree db 'VirtualFree',0 dd 69560000h, 61757472h, 6C6C416Ch, 636Fh, 6F4C0000h, 466C6163h dd 656572h, 6F4C0000h, 416C6163h, 636F6C6Ch, 0 aGetversion db 'GetVersion',0 align 4 dd 65470000h, 72754374h, 746E6572h, 65726854h, 64496461h dd 0 aGetthreadlocal db 'GetThreadLocale',0 dd 65470000h, 61745374h, 70757472h, 6F666E49h, 41h, 4C746547h dd 6C61636Fh, 666E4965h, 416Fh, 65470000h, 6D6F4374h, 646E616Dh dd 656E694Ch, 41h, 65657246h, 7262694Ch, 797261h, 78450000h dd 72507469h, 7365636Fh, 73h, 74697257h, 6C694665h, 65h dd 61686E55h, 656C646Eh, 63784564h, 69747065h, 69466E6Fh dd 7265746Ch, 0 aRtlunwind db 'RtlUnwind',0 align 4 aRaiseexception db 'RaiseException',0 align 4 dd 65470000h, 64745374h, 646E6148h, 656Ch, 72657375h, 642E3233h dd 6C6Ch, 65470000h, 79654B74h, 72616F62h, 70795464h, 65h dd 7373654Dh, 42656761h, 41786Fh, 61766461h, 32336970h dd 6C6C642Eh, 0 aRegqueryvaluee db 'RegQueryValueExA',0 align 4 aRegopenkeyexa db 'RegOpenKeyExA',0 align 4 aRegclosekey db 'RegCloseKey',0 aKernel32_dll_0 db 'kernel32.dll',0 align 4 aTlssetvalue db 'TlsSetValue',0 dd 6C540000h, 74654773h, 756C6156h, 65h, 61636F4Ch, 6C6C416Ch dd 636Fh, 65470000h, 646F4D74h, 48656C75h, 6C646E61h, 4165h dd 61766461h, 32336970h, 6C6C642Eh, 0 aSetthreadtoken db 'SetThreadToken',0 align 4 aKernel32_dll_1 db 'kernel32.dll',0 align 4 aSettapeparamet db 'SetTapeParameters',0 align 4 aSetevent db 'SetEvent',0 align 4 aResetevent db 'ResetEvent',0 align 10h dd 6F4C0000h, 694C6461h, 72617262h, 4179h, 65470000h, 6F725074h dd 64644163h, 73736572h, 0 aGetmodulefilen db 'GetModuleFileNameA',0 align 4 dd 65470000h, 73614C74h, 72724574h, 726Fh, 65470000h, 6C694674h dd 6D695465h, 65h, 43746547h, 75706D6Fh, 4E726574h, 41656D61h dd 0 aFlushviewoffil db 'FlushViewOfFile',0 aUser32_dll db 'user32.dll',0 align 4 dd 654D0000h, 67617373h, 786F4265h db 41h, 0 align 200h _idata ends ; Section 5. (virtual address 00009000) ; Virtual size : 00000008 ( 8.) ; Section size in file : 00000008 ( 8.) ; Offset to raw data for section: 00009000 ; Flags C0000000: Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Regular ; Segment permissions: Read/Write _tls segment para public '' use32 assume cs:_tls ;org 69000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing TlsStart dd 2 dup(0) ; DATA XREF: .rdata:TlsDirectoryo TlsEnd dd 7Eh dup(?) ; DATA XREF: .rdata:TlsEnd_ptro _tls ends ; Section 6. (virtual address 0000A000) ; Virtual size : 00000024 ( 36.) ; Section size in file : 00000024 ( 36.) ; Offset to raw data for section: 0000A000 ; Flags 50000040: Data Shareable Readable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read _rdata segment para public 'DATA' use32 assume cs:_rdata ;org 6A000h TlsDirectory dd offset TlsStart TlsEnd_ptr dd offset TlsEnd TlsIndex_ptr dd offset TlsIndex TlsCallbacks_ptr dd offset TlsSizeOfZeroFill TlsSizeOfZeroFill dd 0 ; DATA XREF: .rdata:TlsCallbacks_ptro TlsCharacteristics dd 0 aApplication db 'Application',0 align 200h _rdata ends ; Section 9. (virtual address 0001F000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0001E600 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 7F000h align 2000h _idata2 ends end start