; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; ; +-------------------------------------------------------------------------+ ; | This file is generated by The Interactive Disassembler (IDA) | ; | Copyright (c) 2007 by DataRescue sa/nv, <ida@datarescue.com> | ; | Licensed to: 48-377D-7114-93 SRI International, 1 computer, std, 11/2007 | ; +-------------------------------------------------------------------------+ ; ; Input MD5 : F1385EF96986148C97D1E34DD345A013 ; File Name : u:\work\f1385ef96986148c97d1e34dd345a013_orig.exe ; Format : Portable executable for 80386 (PE) ; Imagebase : 400000 ; Section 1. (virtual address 00001000) ; Virtual size : 00005800 ( 22528.) ; Section size in file : 00005800 ( 22528.) ; Offset to raw data for section: 00000400 ; Flags 60000020: Text Executable Readable ; Alignment : default .686p .mmx .model flat ; =========================================================================== ; Segment type: Pure code ; Segment permissions: Read/Execute CODE segment para public 'CODE' use32 assume cs:CODE ;org 401000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing ; [00000006 BYTES: COLLAPSED FUNCTION CloseHandle. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION CreateFileA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetFileType. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetFileSize. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetStdHandle. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION RaiseException. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION ReadFile. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION RtlUnwind. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION SetEndOfFile. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION SetFilePointer. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION UnhandledExceptionFilter. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION WriteFile. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION CharNextA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION ExitProcess. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION MessageBoxA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION FreeLibrary. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetCommandLineA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetLastError. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetLocaleInfoA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetModuleFileNameA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetStartupInfoA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetThreadLocale. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION MultiByteToWideChar. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION RegCloseKey. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION RegOpenKeyExA. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION RegQueryValueExA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION SysAllocStringLen. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION SysFreeString. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetCurrentThreadId. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetVersion. PRESS KEYPAD "+" TO EXPAND] align 10h ; =============== S U B R O U T I N E ======================================= sub_4010F0 proc near ; CODE XREF: sub_404274+71p var_1C = byte ptr -1Ch var_18 = word ptr -18h push ebx add esp, 0FFFFFFBCh mov ebx, 0Ah push esp ; lpStartupInfo call GetStartupInfoA ; GetStartupInfoA test [esp+48h+var_1C], 1 jz short loc_40110B movzx ebx, [esp+48h+var_18] loc_40110B: ; CODE XREF: sub_4010F0+14j mov eax, ebx add esp, 44h pop ebx retn sub_4010F0 endp ; --------------------------------------------------------------------------- align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LocalAlloc. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LocalFree. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION VirtualAlloc. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION VirtualFree. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION InitializeCriticalSection. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION EnterCriticalSection. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LeaveCriticalSection. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION DeleteCriticalSection. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= sub_401154 proc near ; CODE XREF: sub_4011E0+9p var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 push ebx add esp, 0FFFFFFF4h mov ebx, offset dword_4085D0 cmp dword ptr [ebx], 0 jnz short loc_4011BB push 644h ; uBytes push 0 ; uFlags call LocalAlloc ; LocalAlloc mov [esp+10h+var_8], eax cmp [esp+10h+var_8], 0 jnz short loc_401180 xor eax, eax mov [esp+10h+var_10], eax jmp short loc_4011D0 ; --------------------------------------------------------------------------- loc_401180: ; CODE XREF: sub_401154+23j mov eax, [esp+10h+var_8] mov edx, ds:dword_4085CC mov [eax], edx mov eax, [esp+10h+var_8] mov ds:dword_4085CC, eax xor eax, eax loc_401197: ; CODE XREF: sub_401154+65j mov edx, eax add edx, edx mov ecx, [esp+10h+var_8] lea edx, [ecx+edx*8+4] mov [esp+10h+var_C], edx mov edx, [esp+10h+var_C] mov ecx, [ebx] mov [edx], ecx mov edx, [esp+10h+var_C] mov [ebx], edx inc eax cmp eax, 64h jnz short loc_401197 loc_4011BB: ; CODE XREF: sub_401154+Cj mov eax, [ebx] mov [esp+10h+var_C], eax mov eax, [esp+10h+var_C] mov eax, [eax] mov [ebx], eax mov eax, [esp+10h+var_C] mov [esp+10h+var_10], eax loc_4011D0: ; CODE XREF: sub_401154+2Aj mov eax, [esp+10h+var_10] add esp, 0Ch pop ebx retn sub_401154 endp ; =============== S U B R O U T I N E ======================================= sub_4011D8 proc near ; CODE XREF: sub_40195C+34p ; sub_40195C+3Ep ... mov [eax], eax mov [eax+4], eax retn sub_4011D8 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4011E0 proc near ; CODE XREF: sub_401270+71p ; sub_4012F8+96p ... var_10 = dword ptr -10h var_C = dword ptr -0Ch push ebx push esi add esp, 0FFFFFFF8h mov esi, edx mov ebx, eax call sub_401154 mov [esp+10h+var_C], eax cmp [esp+10h+var_C], 0 jnz short loc_4011FD xor eax, eax jmp short loc_401237 ; --------------------------------------------------------------------------- loc_4011FD: ; CODE XREF: sub_4011E0+17j mov eax, [esi] mov edx, [esp+10h+var_C] mov [edx+8], eax mov eax, [esi+4] mov edx, [esp+10h+var_C] mov [edx+0Ch], eax mov eax, [ebx] mov [esp+10h+var_10], eax mov eax, [esp+10h+var_C] mov edx, [esp+10h+var_10] mov [eax], edx mov eax, [esp+10h+var_C] mov [eax+4], ebx mov eax, [esp+10h+var_10] mov edx, [esp+10h+var_C] mov [eax+4], edx mov eax, [esp+10h+var_C] mov [ebx], eax mov al, 1 loc_401237: ; CODE XREF: sub_4011E0+1Bj pop ecx pop edx pop esi pop ebx retn sub_4011E0 endp ; =============== S U B R O U T I N E ======================================= sub_40123C proc near ; CODE XREF: sub_401270+37p ; sub_401270+56p ... var_8 = dword ptr -8 var_4 = dword ptr -4 add esp, 0FFFFFFF8h mov edx, [eax+4] mov [esp+8+var_8], edx mov edx, [eax] mov [esp+8+var_4], edx mov edx, [esp+8+var_8] mov ecx, [esp+8+var_4] mov [edx], ecx mov edx, [esp+8+var_4] mov ecx, [esp+8+var_8] mov [edx+4], ecx mov edx, ds:dword_4085D0 mov [eax], edx mov ds:dword_4085D0, eax pop ecx pop edx retn sub_40123C endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401270 proc near ; CODE XREF: sub_4016DC+80p ; sub_401784+78p ... var_14 = dword ptr -14h push ebx push esi push edi push ebp add esp, 0FFFFFFF8h mov ebx, ecx mov esi, eax mov edi, esp mov eax, [esi] mov [edi], eax mov eax, [edx] mov [ebx], eax mov eax, [edx+4] mov [ebx+4], eax loc_40128B: ; CODE XREF: sub_401270+6Bj mov eax, [edi] mov eax, [eax] mov [esp+18h+var_14], eax mov edx, [edi] mov edx, [edx+8] mov ecx, edx mov ebp, [edi] add ecx, [ebp+0Ch] mov eax, [ebx] cmp ecx, eax jnz short loc_4012BD mov eax, [edi] call sub_40123C mov eax, [edi] mov eax, [eax+8] mov [ebx], eax mov eax, [edi] mov eax, [eax+0Ch] add [ebx+4], eax jmp short loc_4012D3 ; --------------------------------------------------------------------------- loc_4012BD: ; CODE XREF: sub_401270+33j add eax, [ebx+4] cmp edx, eax jnz short loc_4012D3 mov eax, [edi] call sub_40123C mov eax, [edi] mov eax, [eax+0Ch] add [ebx+4], eax loc_4012D3: ; CODE XREF: sub_401270+4Bj ; sub_401270+52j mov eax, [esp+18h+var_14] mov [edi], eax cmp esi, [edi] jnz short loc_40128B mov edx, ebx mov eax, esi call sub_4011E0 test al, al jnz short loc_4012EE xor eax, eax mov [ebx], eax loc_4012EE: ; CODE XREF: sub_401270+78j pop ecx pop edx pop ebp pop edi pop esi pop ebx retn sub_401270 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4012F8 proc near ; CODE XREF: sub_4018C8+82p ; sub_401D4C+ABp var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h push ebx push esi push edi push ebp add esp, 0FFFFFFF0h mov [esp+20h+var_20], eax mov esi, esp mov eax, [esi] mov [esp+20h+var_14], eax loc_40130A: ; CODE XREF: sub_4012F8+B3j mov ecx, [edx] mov eax, [esi] mov eax, [eax+8] cmp ecx, eax jb loc_40139F mov ebx, eax mov edi, [esi] add ebx, [edi+0Ch] mov edi, ecx add edi, [edx+4] cmp ebx, edi jb short loc_40139F cmp ecx, eax jnz short loc_40134E mov eax, [edx+4] mov ecx, [esi] add [ecx+8], eax mov eax, [edx+4] mov edx, [esi] sub [edx+0Ch], eax mov eax, [esi] cmp dword ptr [eax+0Ch], 0 jnz short loc_40139B mov eax, [esi] call sub_40123C jmp short loc_40139B ; --------------------------------------------------------------------------- loc_40134E: ; CODE XREF: sub_4012F8+33j mov ebx, eax mov edi, [esi] add ebx, [edi+0Ch] mov edi, ecx add edi, [edx+4] cmp ebx, edi jnz short loc_401368 mov eax, [edx+4] mov edx, [esi] sub [edx+0Ch], eax jmp short loc_40139B ; --------------------------------------------------------------------------- loc_401368: ; CODE XREF: sub_4012F8+64j mov ebx, [edx] add ebx, [edx+4] mov [esp+20h+var_1C], ebx mov edi, [esi] mov edi, [edi+8] mov ebp, [esi] add edi, [ebp+0Ch] sub edi, ebx mov [esp+20h+var_18], edi sub ecx, eax mov eax, [esi] mov [eax+0Ch], ecx lea edx, [esp+20h+var_1C] mov eax, [esi] call sub_4011E0 test al, al jnz short loc_40139B xor eax, eax jmp short loc_4013B3 ; --------------------------------------------------------------------------- loc_40139B: ; CODE XREF: sub_4012F8+4Bj ; sub_4012F8+54j ... mov al, 1 jmp short loc_4013B3 ; --------------------------------------------------------------------------- loc_40139F: ; CODE XREF: sub_4012F8+1Bj ; sub_4012F8+2Fj mov eax, [esi] mov eax, [eax] mov [esi], eax mov eax, [esi] cmp eax, [esp+20h+var_14] jnz loc_40130A xor eax, eax loc_4013B3: ; CODE XREF: sub_4012F8+A1j ; sub_4012F8+A5j add esp, 10h pop ebp pop edi pop esi pop ebx retn sub_4012F8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4013BC proc near ; CODE XREF: sub_4016DC+6Ep push ebx push esi push edi mov ebx, edx mov esi, eax cmp esi, 100000h jge short loc_4013D2 mov esi, 100000h jmp short loc_4013DE ; --------------------------------------------------------------------------- loc_4013D2: ; CODE XREF: sub_4013BC+Dj add esi, 0FFFFh and esi, 0FFFF0000h loc_4013DE: ; CODE XREF: sub_4013BC+14j mov [ebx+4], esi push 1 ; flProtect push 2000h ; flAllocationType push esi ; dwSize push 0 ; lpAddress call VirtualAlloc ; VirtualAlloc mov edi, eax mov [ebx], edi test edi, edi jz short loc_40141B mov edx, ebx mov eax, offset dword_4085D4 call sub_4011E0 test al, al jnz short loc_40141B push 8000h ; dwFreeType push 0 ; dwSize mov eax, [ebx] push eax ; lpAddress call VirtualFree ; VirtualFree xor eax, eax mov [ebx], eax loc_40141B: ; CODE XREF: sub_4013BC+3Aj ; sub_4013BC+4Aj pop edi pop esi pop ebx retn sub_4013BC endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401420 proc near ; CODE XREF: sub_401784+62p ; sub_401784+A9p push ebx push esi push edi push ebp mov ebx, ecx mov esi, edx mov ebp, eax mov dword ptr [ebx+4], 100000h push 4 ; flProtect push 2000h ; flAllocationType push 100000h ; dwSize push ebp ; lpAddress call VirtualAlloc ; VirtualAlloc mov edi, eax mov [ebx], edi test edi, edi jnz short loc_40146A add esi, 0FFFFh and esi, 0FFFF0000h mov [ebx+4], esi push 4 ; flProtect push 2000h ; flAllocationType push esi ; dwSize push ebp ; lpAddress call VirtualAlloc ; VirtualAlloc mov [ebx], eax loc_40146A: ; CODE XREF: sub_401420+29j cmp dword ptr [ebx], 0 jz short loc_401492 mov edx, ebx mov eax, offset dword_4085D4 call sub_4011E0 test al, al jnz short loc_401492 push 8000h ; dwFreeType push 0 ; dwSize mov eax, [ebx] push eax ; lpAddress call VirtualFree ; VirtualFree xor eax, eax mov [ebx], eax loc_401492: ; CODE XREF: sub_401420+4Dj ; sub_401420+5Dj pop ebp pop edi pop esi pop ebx retn sub_401420 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401498 proc near ; CODE XREF: sub_4016DC+95p ; sub_401784+90p ... var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h push ebx push esi push edi push ebp add esp, 0FFFFFFE8h mov edi, ecx mov esi, esp mov [esp+28h+var_20], 0FFFFFFFFh xor ecx, ecx mov [esp+28h+var_1C], ecx mov [esp+28h+var_18], eax add edx, [esp+28h+var_18] mov [esp+28h+var_14], edx mov eax, ds:dword_4085D4 mov [esi], eax jmp short loc_401531 ; --------------------------------------------------------------------------- loc_4014C6: ; CODE XREF: sub_401498+A0j mov eax, [esi] mov eax, [eax] mov [esp+28h+var_24], eax mov eax, [esi] mov ebx, [eax+8] cmp ebx, [esp+28h+var_18] jb short loc_40152B mov eax, ebx mov edx, [esi] add eax, [edx+0Ch] cmp eax, [esp+28h+var_14] ja short loc_40152B cmp ebx, [esp+28h+var_20] jnb short loc_4014F0 mov [esp+28h+var_20], ebx loc_4014F0: ; CODE XREF: sub_401498+52j mov eax, [esi] mov ebp, [eax+8] mov eax, [esi] add ebp, [eax+0Ch] cmp ebp, [esp+28h+var_1C] jbe short loc_401504 mov [esp+28h+var_1C], ebp loc_401504: ; CODE XREF: sub_401498+66j push 8000h ; dwFreeType push 0 ; dwSize mov eax, [esi] mov eax, [eax+8] push eax ; lpAddress call VirtualFree ; VirtualFree test eax, eax jnz short loc_401524 mov ds:dword_4085B0, 1 loc_401524: ; CODE XREF: sub_401498+80j mov eax, [esi] call sub_40123C loc_40152B: ; CODE XREF: sub_401498+3Fj ; sub_401498+4Cj mov eax, [esp+28h+var_24] mov [esi], eax loc_401531: ; CODE XREF: sub_401498+2Cj mov eax, offset dword_4085D4 cmp eax, [esi] jnz short loc_4014C6 xor eax, eax mov [edi], eax cmp [esp+28h+var_1C], 0 jz short loc_401556 mov eax, [esp+28h+var_20] mov [edi], eax mov eax, [esp+28h+var_1C] sub eax, [esp+28h+var_20] mov [edi+4], eax loc_401556: ; CODE XREF: sub_401498+ABj add esp, 18h pop ebp pop edi pop esi pop ebx retn sub_401498 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame fpd=18h sub_401560 proc near ; CODE XREF: sub_4016DC+35p ; sub_401784+100p var_3C = dword ptr -3Ch var_38 = byte ptr -38h var_34 = byte ptr -34h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_18 = dword ptr -18h push ebx push esi push edi push ebp add esp, 0FFFFFFE8h mov ebx, ecx mov [esp+24h+var_3C], edx lea esi, [esp+24h+var_34] lea edi, [esp+24h+var_38] lea ebp, [esp+0Ch] mov edx, eax mov ecx, edx and ecx, 0FFFFF000h mov [esp+24h+var_2C], ecx add edx, [esp+24h+var_3C] add edx, 0FFFh and edx, 0FFFFF000h mov [esp+24h+var_28], edx mov eax, [esp+24h+var_2C] mov [ebx], eax mov eax, [esp+24h+var_28] sub eax, [esp+24h+var_2C] mov [ebx+4], eax mov eax, ds:dword_4085D4 mov [edi], eax jmp short loc_40160E ; --------------------------------------------------------------------------- loc_4015B3: ; CODE XREF: sub_401560+B5j mov eax, [edi] mov eax, [eax+8] mov [esi], eax mov eax, [edi] mov eax, [eax+0Ch] add eax, [esi] mov [ebp+18h+var_18], eax mov eax, [esi] cmp eax, [esp+24h+var_2C] jnb short loc_4015D2 mov eax, [esp+24h+var_2C] mov [esi], eax loc_4015D2: ; CODE XREF: sub_401560+6Aj mov eax, [ebp+18h+var_18] cmp eax, [esp+24h+var_28] jbe short loc_4015E2 mov eax, [esp+24h+var_28] mov [ebp+18h+var_18], eax loc_4015E2: ; CODE XREF: sub_401560+79j mov eax, [esi] cmp eax, [ebp+18h+var_18] jnb short loc_401608 push 4 ; flProtect push 1000h ; flAllocationType mov eax, [ebp+18h+var_18] sub eax, [esi] push eax ; dwSize mov eax, [esi] push eax ; lpAddress call VirtualAlloc ; VirtualAlloc test eax, eax jnz short loc_401608 xor eax, eax mov [ebx], eax jmp short loc_401617 ; --------------------------------------------------------------------------- loc_401608: ; CODE XREF: sub_401560+87j ; sub_401560+A0j mov eax, [edi] mov eax, [eax] mov [edi], eax loc_40160E: ; CODE XREF: sub_401560+51j mov eax, offset dword_4085D4 cmp eax, [edi] jnz short loc_4015B3 loc_401617: ; CODE XREF: sub_401560+A6j add esp, 18h pop ebp pop edi pop esi pop ebx retn sub_401560 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401620 proc near ; CODE XREF: sub_4018C8+36p var_28 = dword ptr -28h var_24 = byte ptr -24h var_20 = byte ptr -20h var_1C = byte ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h push ebx push esi push edi push ebp add esp, 0FFFFFFE8h mov [esp+28h+var_28], edx lea esi, [esp+28h+var_20] lea edi, [esp+28h+var_24] lea ebx, [esp+28h+var_1C] mov edx, eax mov ebp, edx add ebp, 0FFFh and ebp, 0FFFFF000h mov [esp+28h+var_18], ebp add edx, [esp+28h+var_28] and edx, 0FFFFF000h mov [esp+28h+var_14], edx mov eax, [esp+28h+var_18] mov [ecx], eax mov eax, [esp+28h+var_14] sub eax, [esp+28h+var_18] mov [ecx+4], eax mov eax, ds:dword_4085D4 mov [edi], eax jmp short loc_4016C9 ; --------------------------------------------------------------------------- loc_401671: ; CODE XREF: sub_401620+B0j mov eax, [edi] mov eax, [eax+8] mov [esi], eax mov eax, [edi] mov eax, [eax+0Ch] add eax, [esi] mov [ebx], eax mov eax, [esi] cmp eax, [esp+28h+var_18] jnb short loc_40168F mov eax, [esp+28h+var_18] mov [esi], eax loc_40168F: ; CODE XREF: sub_401620+67j mov eax, [ebx] cmp eax, [esp+28h+var_14] jbe short loc_40169D mov eax, [esp+28h+var_14] mov [ebx], eax loc_40169D: ; CODE XREF: sub_401620+75j mov eax, [esi] cmp eax, [ebx] jnb short loc_4016C3 push 4000h ; dwFreeType mov eax, [ebx] sub eax, [esi] push eax ; dwSize mov eax, [esi] push eax ; lpAddress call VirtualFree ; VirtualFree test eax, eax jnz short loc_4016C3 mov ds:dword_4085B0, 2 loc_4016C3: ; CODE XREF: sub_401620+81j ; sub_401620+97j mov eax, [edi] mov eax, [eax] mov [edi], eax loc_4016C9: ; CODE XREF: sub_401620+4Fj mov eax, offset dword_4085D4 cmp eax, [edi] jnz short loc_401671 add esp, 18h pop ebp pop edi pop esi pop ebx retn sub_401620 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4016DC proc near ; CODE XREF: sub_401FD8+Bp var_18 = dword ptr -18h push ebx push esi push edi push ebp add esp, 0FFFFFFF4h mov ebx, edx mov esi, eax mov edi, esp mov ebp, offset dword_4085E4 add esi, 3FFFh and esi, 0FFFFC000h loc_4016FA: ; CODE XREF: sub_4016DC+8Aj mov eax, [ebp+0] mov [edi], eax jmp short loc_401742 ; --------------------------------------------------------------------------- loc_401701: ; CODE XREF: sub_4016DC+68j mov eax, [edi] cmp esi, [eax+0Ch] jg short loc_40173C mov ecx, ebx mov eax, [edi] mov eax, [eax+8] mov edx, esi call sub_401560 cmp dword ptr [ebx], 0 jz short loc_40177A mov eax, [ebx+4] mov edx, [edi] add [edx+8], eax mov eax, [ebx+4] mov edx, [edi] sub [edx+0Ch], eax mov eax, [edi] cmp dword ptr [eax+0Ch], 0 jnz short loc_40177A mov eax, [edi] call sub_40123C jmp short loc_40177A ; --------------------------------------------------------------------------- loc_40173C: ; CODE XREF: sub_4016DC+2Aj mov eax, [edi] mov eax, [eax] mov [edi], eax loc_401742: ; CODE XREF: sub_4016DC+23j cmp ebp, [edi] jnz short loc_401701 mov edx, ebx mov eax, esi call sub_4013BC cmp dword ptr [ebx], 0 jz short loc_40177A lea ecx, [esp+1Ch+var_18] mov edx, ebx mov eax, ebp call sub_401270 cmp [esp+1Ch+var_18], 0 jnz short loc_4016FA lea ecx, [esp+1Ch+var_18] mov edx, [ebx+4] mov eax, [ebx] call sub_401498 xor eax, eax mov [ebx], eax loc_40177A: ; CODE XREF: sub_4016DC+3Dj ; sub_4016DC+55j ... add esp, 0Ch pop ebp pop edi pop esi pop ebx retn sub_4016DC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401784 proc near ; CODE XREF: sub_402004+10p var_28 = dword ptr -28h var_24 = byte ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h push ebx push esi push edi push ebp add esp, 0FFFFFFE8h mov [esp+28h+var_28], ecx mov edi, edx mov ebx, eax lea esi, [esp+28h+var_24] mov ebp, offset dword_4085E4 add edi, 3FFFh and edi, 0FFFFC000h loc_4017A7: ; CODE XREF: sub_401784+82j ; sub_401784+C9j mov eax, [ebp+0] mov [esi], eax jmp short loc_4017B4 ; --------------------------------------------------------------------------- loc_4017AE: ; CODE XREF: sub_401784+39j mov eax, [esi] mov eax, [eax] mov [esi], eax loc_4017B4: ; CODE XREF: sub_401784+28j cmp ebp, [esi] jz short loc_4017BF mov eax, [esi] cmp ebx, [eax+8] jnz short loc_4017AE loc_4017BF: ; CODE XREF: sub_401784+32j mov eax, [esi] cmp ebx, [eax+8] jnz short loc_401825 mov eax, [esi] cmp edi, [eax+0Ch] jle loc_40186D mov eax, [esi] mov edx, edi sub edx, [eax+0Ch] mov eax, [esi] mov eax, [eax+8] mov ecx, [esi] add eax, [ecx+0Ch] lea ecx, [esp+28h+var_20] call sub_401420 cmp [esp+28h+var_20], 0 jz short loc_401825 lea ecx, [esp+28h+var_18] lea edx, [esp+28h+var_20] mov eax, ebp call sub_401270 cmp [esp+28h+var_18], 0 jnz short loc_4017A7 lea ecx, [esp+28h+var_18] mov edx, [esp+28h+var_1C] mov eax, [esp+28h+var_20] call sub_401498 mov eax, [esp+28h+var_28] xor edx, edx mov [eax], edx jmp loc_4018BF ; --------------------------------------------------------------------------- loc_401825: ; CODE XREF: sub_401784+40j ; sub_401784+6Cj lea ecx, [esp+28h+var_20] mov edx, edi mov eax, ebx call sub_401420 cmp [esp+28h+var_20], 0 jz short loc_40186D lea ecx, [esp+28h+var_18] lea edx, [esp+28h+var_20] mov eax, ebp call sub_401270 cmp [esp+28h+var_18], 0 jnz loc_4017A7 lea ecx, [esp+28h+var_18] mov edx, [esp+28h+var_1C] mov eax, [esp+28h+var_20] call sub_401498 mov eax, [esp+28h+var_28] xor edx, edx mov [eax], edx jmp short loc_4018BF ; --------------------------------------------------------------------------- loc_40186D: ; CODE XREF: sub_401784+47j ; sub_401784+B3j mov eax, [esi] mov ebp, [eax+8] cmp ebx, ebp jnz short loc_4018B8 mov eax, [esi] cmp edi, [eax+0Ch] jg short loc_4018B8 mov ecx, [esp+28h+var_28] mov eax, ebp mov edx, edi call sub_401560 mov eax, [esp+28h+var_28] cmp dword ptr [eax], 0 jz short loc_4018BF mov eax, [esp+28h+var_28] mov eax, [eax+4] mov edx, [esi] add [edx+8], eax mov eax, [esp+28h+var_28] mov eax, [eax+4] mov edx, [esi] sub [edx+0Ch], eax mov eax, [esi] cmp dword ptr [eax+0Ch], 0 jnz short loc_4018BF mov eax, [esi] call sub_40123C jmp short loc_4018BF ; --------------------------------------------------------------------------- loc_4018B8: ; CODE XREF: sub_401784+F0j ; sub_401784+F7j mov eax, [esp+28h+var_28] xor edx, edx mov [eax], edx loc_4018BF: ; CODE XREF: sub_401784+9Cj ; sub_401784+E7j ... add esp, 18h pop ebp pop edi pop esi pop ebx retn sub_401784 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4018C8 proc near ; CODE XREF: sub_401D4C+5Bp ; sub_401D4C+6Cp var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 push ebx add esp, 0FFFFFFE8h mov ebx, ecx lea ecx, [eax+3FFFh] and ecx, 0FFFFC000h mov [esp+1Ch+var_1C], ecx add edx, eax and edx, 0FFFFC000h mov [esp+1Ch+var_18], edx mov eax, [esp+1Ch+var_18] cmp eax, [esp+1Ch+var_1C] jbe short loc_401951 mov ecx, ebx mov edx, [esp+1Ch+var_18] sub edx, [esp+1Ch+var_1C] mov eax, [esp+1Ch+var_1C] call sub_401620 lea ecx, [esp+1Ch+var_14] mov edx, ebx mov eax, offset dword_4085E4 call sub_401270 mov ebx, [esp+1Ch+var_14] test ebx, ebx jz short loc_40193A lea ecx, [esp+1Ch+var_C] mov edx, [esp+1Ch+var_10] mov eax, ebx call sub_401498 mov eax, [esp+1Ch+var_C] mov [esp+1Ch+var_14], eax mov eax, [esp+1Ch+var_8] mov [esp+1Ch+var_10], eax loc_40193A: ; CODE XREF: sub_4018C8+51j cmp [esp+1Ch+var_14], 0 jz short loc_401955 lea edx, [esp+1Ch+var_14] mov eax, offset dword_4085E4 call sub_4012F8 jmp short loc_401955 ; --------------------------------------------------------------------------- loc_401951: ; CODE XREF: sub_4018C8+28j xor eax, eax mov [ebx], eax loc_401955: ; CODE XREF: sub_4018C8+77j ; sub_4018C8+87j add esp, 18h pop ebx retn sub_4018C8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40195C proc near ; CODE XREF: sub_4021B8+12p ; sub_402364+19p ... var_4 = dword ptr -4 ; FUNCTION CHUNK AT 0040358C SIZE 00000036 BYTES push ebp mov ebp, esp push ecx xor edx, edx push ebp push offset loc_401A24 push dword ptr fs:[edx] mov fs:[edx], esp push offset CriticalSection ; lpCriticalSection call InitializeCriticalSection ; InitializeCriticalSection cmp ds:byte_408035, 0 jz short loc_40198B push offset CriticalSection ; lpCriticalSection call EnterCriticalSection loc_40198B: ; CODE XREF: sub_40195C+23j mov eax, offset dword_4085D4 call sub_4011D8 mov eax, offset dword_4085E4 call sub_4011D8 mov eax, offset dword_408610 call sub_4011D8 push 0FF8h ; uBytes push 0 ; uFlags call LocalAlloc ; LocalAlloc mov ds:hMem, eax cmp ds:hMem, 0 jz short loc_401A03 mov eax, 3 loc_4019C8: ; CODE XREF: sub_40195C+7Ej mov edx, ds:hMem xor ecx, ecx mov [edx+eax*4-0Ch], ecx inc eax cmp eax, 401h jnz short loc_4019C8 mov [ebp+var_4], offset dword_4085F4 mov eax, [ebp+var_4] mov edx, [ebp+var_4] mov [eax+4], edx mov eax, [ebp+var_4] mov edx, [ebp+var_4] mov [eax], edx mov eax, [ebp+var_4] mov ds:dword_408600, eax mov ds:byte_4085AC, 1 loc_401A03: ; CODE XREF: sub_40195C+65j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_401A2B loc_401A10: ; CODE XREF: sub_40195C+CDj cmp ds:byte_408035, 0 jz short loc_401A23 push offset CriticalSection ; lpCriticalSection call LeaveCriticalSection loc_401A23: ; CODE XREF: sub_40195C+BBj retn ; --------------------------------------------------------------------------- loc_401A24: ; DATA XREF: sub_40195C+7o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_401A10 ; --------------------------------------------------------------------------- loc_401A2B: ; CODE XREF: sub_40195C:loc_401A23j ; DATA XREF: sub_40195C+AFo mov al, ds:byte_4085AC pop ecx pop ebp retn sub_40195C endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_401A34 proc near ; CODE XREF: sub_404220+37p var_8 = dword ptr -8 hMem = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF8h cmp ds:byte_4085AC, 0 jz loc_401B2F xor eax, eax push ebp push offset loc_401B28 push dword ptr fs:[eax] mov fs:[eax], esp cmp ds:byte_408035, 0 jz short loc_401A68 push offset CriticalSection ; lpCriticalSection call EnterCriticalSection loc_401A68: ; CODE XREF: sub_401A34+28j mov ds:byte_4085AC, 0 mov eax, ds:hMem push eax ; hMem call LocalFree ; LocalFree xor eax, eax mov ds:hMem, eax mov eax, ds:dword_4085D4 mov [ebp+var_8], eax jmp short loc_401AA6 ; --------------------------------------------------------------------------- loc_401A8B: ; CODE XREF: sub_401A34+7Aj push 8000h ; dwFreeType push 0 ; dwSize mov eax, [ebp+var_8] mov eax, [eax+8] push eax ; lpAddress call VirtualFree ; VirtualFree mov eax, [ebp+var_8] mov eax, [eax] mov [ebp+var_8], eax loc_401AA6: ; CODE XREF: sub_401A34+55j mov eax, offset dword_4085D4 cmp eax, [ebp+var_8] jnz short loc_401A8B mov eax, offset dword_4085D4 call sub_4011D8 mov eax, offset dword_4085E4 call sub_4011D8 mov eax, offset dword_408610 call sub_4011D8 mov eax, ds:dword_4085CC mov [ebp+hMem], eax cmp [ebp+hMem], 0 jz short loc_401AFD loc_401ADC: ; CODE XREF: sub_401A34+C7j mov eax, [ebp+hMem] mov eax, [eax] mov ds:dword_4085CC, eax mov eax, [ebp+hMem] push eax ; hMem call LocalFree ; LocalFree mov eax, ds:dword_4085CC mov [ebp+hMem], eax cmp [ebp+hMem], 0 jnz short loc_401ADC loc_401AFD: ; CODE XREF: sub_401A34+A6j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_401B2F loc_401B0A: ; CODE XREF: sub_401A34+F9j cmp ds:byte_408035, 0 jz short loc_401B1D push offset CriticalSection ; lpCriticalSection call LeaveCriticalSection loc_401B1D: ; CODE XREF: sub_401A34+DDj push offset CriticalSection ; lpCriticalSection call DeleteCriticalSection retn ; --------------------------------------------------------------------------- loc_401B28: ; DATA XREF: sub_401A34+16o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_401B0A ; --------------------------------------------------------------------------- loc_401B2F: ; CODE XREF: sub_401A34+Dj ; sub_401A34+F3j ; DATA XREF: ... pop ecx pop ecx pop ebp retn sub_401A34 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401B34 proc near ; CODE XREF: sub_401C94+6Bp ; sub_401D0C+25p ... var_C = dword ptr -0Ch var_8 = dword ptr -8 push ebx add esp, 0FFFFFFF8h cmp eax, ds:dword_408600 jnz short loc_401B49 mov edx, [eax+4] mov ds:dword_408600, edx loc_401B49: ; CODE XREF: sub_401B34+Aj mov edx, [eax+4] mov [esp+0Ch+var_C], edx mov edx, [eax+8] cmp edx, 1000h jg short loc_401BA8 cmp eax, [esp+0Ch+var_C] jnz short loc_401B76 test edx, edx jns short loc_401B66 add edx, 3 loc_401B66: ; CODE XREF: sub_401B34+2Dj sar edx, 2 mov eax, ds:hMem xor ecx, ecx mov [eax+edx*4-0Ch], ecx jmp short loc_401BC1 ; --------------------------------------------------------------------------- loc_401B76: ; CODE XREF: sub_401B34+29j test edx, edx jns short loc_401B7D add edx, 3 loc_401B7D: ; CODE XREF: sub_401B34+44j sar edx, 2 mov ecx, ds:hMem mov ebx, [esp+0Ch+var_C] mov [ecx+edx*4-0Ch], ebx mov eax, [eax] mov [esp+0Ch+var_8], eax mov eax, [esp+0Ch+var_C] mov edx, [esp+0Ch+var_8] mov [eax], edx mov eax, [esp+0Ch+var_8] mov edx, [esp+0Ch+var_C] mov [eax+4], edx jmp short loc_401BC1 ; --------------------------------------------------------------------------- loc_401BA8: ; CODE XREF: sub_401B34+24j mov eax, [eax] mov [esp+0Ch+var_8], eax mov eax, [esp+0Ch+var_C] mov edx, [esp+0Ch+var_8] mov [eax], edx mov eax, [esp+0Ch+var_8] mov edx, [esp+0Ch+var_C] mov [eax+4], edx loc_401BC1: ; CODE XREF: sub_401B34+40j ; sub_401B34+72j pop ecx pop edx pop ebx retn sub_401B34 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401BC8 proc near ; CODE XREF: sub_401D4C+Fp push ebx push ecx mov ecx, esp mov edx, ds:dword_408610 mov [ecx], edx jmp short loc_401BEE ; --------------------------------------------------------------------------- loc_401BD6: ; CODE XREF: sub_401BC8+2Dj mov edx, [ecx] mov edx, [edx+8] cmp eax, edx jb short loc_401BE8 mov ebx, [ecx] add edx, [ebx+0Ch] cmp eax, edx jb short loc_401C05 loc_401BE8: ; CODE XREF: sub_401BC8+15j mov edx, [ecx] mov edx, [edx] mov [ecx], edx loc_401BEE: ; CODE XREF: sub_401BC8+Cj mov edx, offset dword_408610 cmp edx, [ecx] jnz short loc_401BD6 mov ds:dword_4085B0, 3 xor eax, eax mov [ecx], eax loc_401C05: ; CODE XREF: sub_401BC8+1Ej mov eax, [ecx] pop edx pop ebx retn sub_401BC8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401C0C proc near ; CODE XREF: sub_401D4C+7Ep ; sub_401F4C+68p var_8 = dword ptr -8 push ebx push ecx mov ecx, edx sub ecx, 4 lea ebx, [ecx+eax] mov [esp+8+var_8], ebx cmp edx, 10h jl short loc_401C31 mov edx, [esp+8+var_8] mov dword ptr [edx], 80000007h mov edx, ecx call sub_401E08 pop edx pop ebx retn ; --------------------------------------------------------------------------- loc_401C31: ; CODE XREF: sub_401C0C+10j cmp edx, 4 jl short loc_401C45 mov ecx, edx or ecx, 80000002h mov [eax], ecx mov eax, [esp+8+var_8] mov [eax], ecx loc_401C45: ; CODE XREF: sub_401C0C+28j pop edx pop ebx retn sub_401C0C endp ; =============== S U B R O U T I N E ======================================= sub_401C48 proc near ; CODE XREF: sub_401C6C+Dp ; sub_401F00+36p ... inc ds:dword_40859C mov edx, eax sub edx, 4 mov edx, [edx] and edx, 7FFFFFFCh sub edx, 4 add ds:dword_4085A0, edx call sub_402364 retn sub_401C48 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401C6C proc near ; CODE XREF: sub_401D4C+A0p cmp edx, 0Ch jl short loc_401C7F or edx, 2 mov [eax], edx add eax, 4 call sub_401C48 retn ; --------------------------------------------------------------------------- loc_401C7F: ; CODE XREF: sub_401C6C+3j cmp edx, 4 jl short loc_401C8E mov ecx, edx or ecx, 80000002h mov [eax], ecx loc_401C8E: ; CODE XREF: sub_401C6C+16j add eax, edx and dword ptr [eax], 0FFFFFFFEh retn sub_401C6C endp ; =============== S U B R O U T I N E ======================================= sub_401C94 proc near ; CODE XREF: sub_401F4C+36p var_C = dword ptr -0Ch push ebx push esi push ecx mov edx, eax sub edx, 4 mov edx, [edx] mov ecx, edx and ecx, 80000002h cmp ecx, 80000002h jz short loc_401CB8 mov ds:dword_4085B0, 4 loc_401CB8: ; CODE XREF: sub_401C94+18j mov ebx, edx and ebx, 7FFFFFFCh sub eax, ebx mov ecx, eax xor edx, [ecx] test edx, 0FFFFFFFEh jz short loc_401CD8 mov ds:dword_4085B0, 5 loc_401CD8: ; CODE XREF: sub_401C94+38j test byte ptr [ecx], 1 jz short loc_401D06 mov edx, eax sub edx, 0Ch mov esi, [edx+8] sub eax, esi mov [esp+0Ch+var_C], eax mov eax, [esp+0Ch+var_C] cmp esi, [eax+8] jz short loc_401CFC mov ds:dword_4085B0, 6 loc_401CFC: ; CODE XREF: sub_401C94+5Cj mov eax, [esp+0Ch+var_C] call sub_401B34 add ebx, esi loc_401D06: ; CODE XREF: sub_401C94+47j mov eax, ebx pop edx pop esi pop ebx retn sub_401C94 endp ; =============== S U B R O U T I N E ======================================= sub_401D0C proc near ; CODE XREF: sub_401F4C+4Fp var_C = dword ptr -0Ch push ebx push esi push ecx mov ebx, eax xor esi, esi mov eax, [ebx] test eax, 80000000h jz short loc_401D27 and eax, 7FFFFFFCh add esi, eax add ebx, eax mov eax, [ebx] loc_401D27: ; CODE XREF: sub_401D0C+Ej test al, 2 jnz short loc_401D43 mov [esp+0Ch+var_C], ebx mov eax, [esp+0Ch+var_C] call sub_401B34 mov eax, [esp+0Ch+var_C] mov eax, [eax+8] add esi, eax add ebx, eax and dword ptr [ebx], 0FFFFFFFEh loc_401D43: ; CODE XREF: sub_401D0C+1Dj mov eax, esi pop edx pop esi pop ebx retn sub_401D0C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401D4C proc near ; CODE XREF: sub_401E08+A7p var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h push ebx push esi push edi push ebp add esp, 0FFFFFFF4h mov esi, edx mov ebp, eax xor ebx, ebx mov eax, ebp call sub_401BC8 mov [esp+1Ch+var_14], eax cmp [esp+1Ch+var_14], 0 jz loc_401DFE mov eax, [esp+1Ch+var_14] mov edi, [eax+8] mov eax, edi mov edx, [esp+1Ch+var_14] add eax, [edx+0Ch] mov edx, eax lea ecx, [esi+ebp] sub edx, ecx cmp edx, 0Ch jg short loc_401D8F mov esi, eax sub esi, ebp loc_401D8F: ; CODE XREF: sub_401D4C+3Dj mov eax, ebp sub eax, edi cmp eax, 0Ch jge short loc_401DAE mov eax, [esp+1Ch+var_14] mov edx, ebp sub edx, [eax+8] add edx, esi mov ecx, esp mov eax, edi call sub_4018C8 jmp short loc_401DBD ; --------------------------------------------------------------------------- loc_401DAE: ; CODE XREF: sub_401D4C+4Aj mov ecx, esp mov edx, esi sub edx, 4 lea eax, [ebp+4] call sub_4018C8 loc_401DBD: ; CODE XREF: sub_401D4C+60j mov edi, [esp+1Ch+var_1C] test edi, edi jz short loc_401DFE mov edx, edi sub edx, ebp mov eax, ebp call sub_401C0C mov edx, [esp+1Ch+var_14] mov edx, [edx+8] mov ecx, [esp+1Ch+var_14] add edx, [ecx+0Ch] mov eax, edi add eax, [esp+1Ch+var_18] cmp edx, eax jbe short loc_401DF1 lea edx, [esi+ebp] sub edx, eax call sub_401C6C loc_401DF1: ; CODE XREF: sub_401D4C+99j mov edx, esp mov eax, [esp+1Ch+var_14] call sub_4012F8 mov bl, 1 loc_401DFE: ; CODE XREF: sub_401D4C+1Dj ; sub_401D4C+76j mov eax, ebx add esp, 0Ch pop ebp pop edi pop esi pop ebx retn sub_401D4C endp ; =============== S U B R O U T I N E ======================================= sub_401E08 proc near ; CODE XREF: sub_401C0C+1Dp ; sub_402070+EEp ... var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch push ebx push esi add esp, 0FFFFFFF4h mov ebx, edx mov esi, eax mov [esp+14h+var_14], esi mov eax, [esp+14h+var_14] mov [eax+8], ebx mov eax, [esp+14h+var_14] add eax, ebx sub eax, 0Ch mov [eax+8], ebx cmp ebx, 1000h jg short loc_401EA3 mov eax, ebx test eax, eax jns short loc_401E36 add eax, 3 loc_401E36: ; CODE XREF: sub_401E08+29j sar eax, 2 mov edx, ds:hMem mov edx, [edx+eax*4-0Ch] mov [esp+14h+var_10], edx cmp [esp+14h+var_10], 0 jnz short loc_401E71 mov edx, ds:hMem mov ecx, [esp+14h+var_14] mov [edx+eax*4-0Ch], ecx mov eax, [esp+14h+var_14] mov edx, [esp+14h+var_14] mov [eax+4], edx mov eax, [esp+14h+var_14] mov edx, [esp+14h+var_14] mov [eax], edx jmp loc_401EF9 ; --------------------------------------------------------------------------- loc_401E71: ; CODE XREF: sub_401E08+44j mov eax, [esp+14h+var_10] mov eax, [eax] mov [esp+14h+var_C], eax mov eax, [esp+14h+var_14] mov edx, [esp+14h+var_10] mov [eax+4], edx mov eax, [esp+14h+var_14] mov edx, [esp+14h+var_C] mov [eax], edx mov eax, [esp+14h+var_10] mov edx, [esp+14h+var_14] mov [eax], edx mov eax, [esp+14h+var_C] mov edx, [esp+14h+var_14] mov [eax+4], edx jmp short loc_401EF9 ; --------------------------------------------------------------------------- loc_401EA3: ; CODE XREF: sub_401E08+23j cmp ebx, 3C00h jl short loc_401EB8 mov edx, ebx mov eax, esi call sub_401D4C test al, al jnz short loc_401EF9 loc_401EB8: ; CODE XREF: sub_401E08+A1j mov eax, ds:dword_408600 mov [esp+14h+var_10], eax mov eax, [esp+14h+var_14] mov ds:dword_408600, eax mov eax, [esp+14h+var_10] mov eax, [eax] mov [esp+14h+var_C], eax mov eax, [esp+14h+var_14] mov edx, [esp+14h+var_10] mov [eax+4], edx mov eax, [esp+14h+var_14] mov edx, [esp+14h+var_C] mov [eax], edx mov eax, [esp+14h+var_10] mov edx, [esp+14h+var_14] mov [eax], edx mov eax, [esp+14h+var_C] mov edx, [esp+14h+var_14] mov [eax+4], edx loc_401EF9: ; CODE XREF: sub_401E08+64j ; sub_401E08+99j ... add esp, 0Ch pop esi pop ebx retn sub_401E08 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_401F00 proc near ; CODE XREF: sub_401F4C+Fp ; sub_402364+11Dp ... cmp ds:dword_408604, 0 jle short locret_401F49 cmp ds:dword_408604, 0Ch jge short loc_401F1E mov ds:dword_4085B0, 7 jmp short locret_401F49 ; --------------------------------------------------------------------------- loc_401F1E: ; CODE XREF: sub_401F00+10j mov eax, ds:dword_408604 or eax, 2 mov edx, ds:dword_408608 mov [edx], eax mov eax, ds:dword_408608 add eax, 4 call sub_401C48 xor eax, eax mov ds:dword_408608, eax xor eax, eax mov ds:dword_408604, eax locret_401F49: ; CODE XREF: sub_401F00+7j ; sub_401F00+1Cj retn sub_401F00 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401F4C proc near ; CODE XREF: sub_401FD8+18p ; sub_402004+1Dp var_1C = byte ptr -1Ch var_14 = dword ptr -14h var_10 = dword ptr -10h push ebx push esi push edi add esp, 0FFFFFFF0h mov esi, eax lea edi, [esp+1Ch+var_1C] movsd movsd mov edi, esp call sub_401F00 lea ecx, [esp+1Ch+var_14] mov edx, edi mov eax, offset dword_408610 call sub_401270 mov ebx, [esp+1Ch+var_14] test ebx, ebx jnz short loc_401F7C xor eax, eax jmp short loc_401FCE ; --------------------------------------------------------------------------- loc_401F7C: ; CODE XREF: sub_401F4C+2Aj mov eax, [edi] cmp ebx, eax jnb short loc_401F8C call sub_401C94 sub [edi], eax add [edi+4], eax loc_401F8C: ; CODE XREF: sub_401F4C+34j mov eax, [edi] add eax, [edi+4] mov esi, ebx add esi, [esp+1Ch+var_10] cmp eax, esi jnb short loc_401FA3 call sub_401D0C add [edi+4], eax loc_401FA3: ; CODE XREF: sub_401F4C+4Dj mov eax, [edi] add eax, [edi+4] cmp esi, eax jnz short loc_401FBD sub eax, 4 mov edx, 4 call sub_401C0C sub dword ptr [edi+4], 4 loc_401FBD: ; CODE XREF: sub_401F4C+5Ej mov eax, [edi] mov ds:dword_408608, eax mov eax, [edi+4] mov ds:dword_408604, eax mov al, 1 loc_401FCE: ; CODE XREF: sub_401F4C+2Ej add esp, 10h pop edi pop esi pop ebx retn sub_401F4C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_401FD8 proc near ; CODE XREF: sub_402070+76p var_C = dword ptr -0Ch push ebx add esp, 0FFFFFFF8h mov ebx, eax mov edx, esp lea eax, [ebx+4] call sub_4016DC cmp [esp+0Ch+var_C], 0 jz short loc_401FF9 mov eax, esp call sub_401F4C test al, al jnz short loc_401FFD loc_401FF9: ; CODE XREF: sub_401FD8+14j xor eax, eax jmp short loc_401FFF ; --------------------------------------------------------------------------- loc_401FFD: ; CODE XREF: sub_401FD8+1Fj mov al, 1 loc_401FFF: ; CODE XREF: sub_401FD8+23j pop ecx pop edx pop ebx retn sub_401FD8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402004 proc near ; CODE XREF: sub_40253C+1C3p var_10 = dword ptr -10h push ebx push esi add esp, 0FFFFFFF8h mov esi, edx mov ebx, eax mov ecx, esp lea edx, [esi+4] mov eax, ebx call sub_401784 cmp [esp+10h+var_10], 0 jz short loc_40202A mov eax, esp call sub_401F4C test al, al jnz short loc_40202E loc_40202A: ; CODE XREF: sub_402004+19j xor eax, eax jmp short loc_402030 ; --------------------------------------------------------------------------- loc_40202E: ; CODE XREF: sub_402004+24j mov al, 1 loc_402030: ; CODE XREF: sub_402004+28j pop ecx pop edx pop esi pop ebx retn sub_402004 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402038 proc near ; CODE XREF: sub_402070+68p push ecx mov edx, esp xor ecx, ecx mov [edx], ecx test eax, eax jns short loc_402046 add eax, 3 loc_402046: ; CODE XREF: sub_402038+9j sar eax, 2 cmp eax, 400h jg short loc_402069 loc_402050: ; CODE XREF: sub_402038+2Fj mov ecx, ds:hMem mov ecx, [ecx+eax*4-0Ch] mov [edx], ecx cmp dword ptr [edx], 0 jnz short loc_402069 inc eax cmp eax, 401h jnz short loc_402050 loc_402069: ; CODE XREF: sub_402038+16j ; sub_402038+27j mov eax, [edx] pop edx retn sub_402038 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402070 proc near ; CODE XREF: sub_4021B8+173p var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = byte ptr -14h push ebx push esi push edi push ebp add esp, 0FFFFFFF4h mov ebx, eax lea esi, [esp+1Ch+var_14] mov edi, offset dword_408600 mov ebp, offset dword_408604 loc_402087: ; CODE XREF: sub_402070+8Cj mov eax, ds:dword_4085F8 mov [esi], eax mov eax, [esi] cmp ebx, [eax+8] jle loc_402144 mov eax, [edi] mov [esi], eax mov eax, [esi] mov eax, [eax+8] cmp ebx, eax jle loc_402144 mov edx, [esi] mov [edx+8], ebx loc_4020AF: ; CODE XREF: sub_402070+4Bj mov edx, [esi] mov edx, [edx+4] mov [esi], edx mov edx, [esi] cmp ebx, [edx+8] jg short loc_4020AF mov edx, [edi] mov [edx+8], eax mov eax, [esi] cmp eax, [edi] jz short loc_4020CE mov eax, [esi] mov [edi], eax jmp short loc_402144 ; --------------------------------------------------------------------------- loc_4020CE: ; CODE XREF: sub_402070+56j cmp ebx, 1000h jg short loc_4020E4 mov eax, ebx call sub_402038 mov [esi], eax cmp dword ptr [esi], 0 jnz short loc_402144 loc_4020E4: ; CODE XREF: sub_402070+64j mov eax, ebx call sub_401FD8 test al, al jnz short loc_4020F9 xor eax, eax mov [esp+1Ch+var_1C], eax jmp loc_4021AD ; --------------------------------------------------------------------------- loc_4020F9: ; CODE XREF: sub_402070+7Dj cmp ebx, [ebp+0] jg short loc_402087 sub [ebp+0], ebx cmp dword ptr [ebp+0], 0Ch jge short loc_40210F add ebx, [ebp+0] xor eax, eax mov [ebp+0], eax loc_40210F: ; CODE XREF: sub_402070+95j mov eax, ds:dword_408608 mov [esp+1Ch+var_18], eax add ds:dword_408608, ebx mov eax, ebx or eax, 2 mov edx, [esp+1Ch+var_18] mov [edx], eax mov eax, [esp+1Ch+var_18] add eax, 4 mov [esp+1Ch+var_1C], eax inc ds:dword_40859C sub ebx, 4 add ds:dword_4085A0, ebx jmp short loc_4021AD ; --------------------------------------------------------------------------- loc_402144: ; CODE XREF: sub_402070+23j ; sub_402070+34j ... mov eax, [esi] call sub_401B34 mov eax, [esi] mov edx, [eax+8] mov eax, edx sub eax, ebx cmp eax, 0Ch jl short loc_402165 mov edx, [esi] add edx, ebx xchg eax, edx call sub_401E08 jmp short loc_402183 ; --------------------------------------------------------------------------- loc_402165: ; CODE XREF: sub_402070+E7j mov ebx, edx mov eax, [esi] cmp eax, [edi] jnz short loc_402174 mov eax, [esi] mov eax, [eax+4] mov [edi], eax loc_402174: ; CODE XREF: sub_402070+FBj mov eax, [esi] add eax, ebx mov [esp+1Ch+var_18], eax mov eax, [esp+1Ch+var_18] and dword ptr [eax], 0FFFFFFFEh loc_402183: ; CODE XREF: sub_402070+F3j mov eax, [esi] mov [esp+1Ch+var_18], eax mov eax, ebx or eax, 2 mov edx, [esp+1Ch+var_18] mov [edx], eax mov eax, [esp+1Ch+var_18] add eax, 4 mov [esp+1Ch+var_1C], eax inc ds:dword_40859C sub ebx, 4 add ds:dword_4085A0, ebx loc_4021AD: ; CODE XREF: sub_402070+84j ; sub_402070+D2j mov eax, [esp+1Ch+var_1C] add esp, 0Ch pop ebp pop edi pop esi pop ebx retn sub_402070 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4021B8 proc near ; CODE XREF: sub_402740+5Dp ; sub_40280C+Ap ... var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFECh push ebx mov ebx, eax cmp ds:byte_4085AC, 0 jnz short loc_4021D3 call sub_40195C test al, al jz short loc_4021DB loc_4021D3: ; CODE XREF: sub_4021B8+10j cmp ebx, 7FFFFFF8h jle short loc_4021E5 loc_4021DB: ; CODE XREF: sub_4021B8+19j xor eax, eax mov [ebp+var_4], eax jmp loc_40235B ; --------------------------------------------------------------------------- loc_4021E5: ; CODE XREF: sub_4021B8+21j xor edx, edx push ebp push offset loc_402354 push dword ptr fs:[edx] mov fs:[edx], esp cmp ds:byte_408035, 0 jz short loc_402206 push offset CriticalSection ; lpCriticalSection call EnterCriticalSection loc_402206: ; CODE XREF: sub_4021B8+42j add ebx, 7 and ebx, 0FFFFFFFCh cmp ebx, 0Ch jge short loc_402216 mov ebx, 0Ch loc_402216: ; CODE XREF: sub_4021B8+57j cmp ebx, 1000h jg loc_4022CE mov eax, ebx test eax, eax jns short loc_40222B add eax, 3 loc_40222B: ; CODE XREF: sub_4021B8+6Ej sar eax, 2 mov edx, ds:hMem mov edx, [edx+eax*4-0Ch] mov [ebp+var_8], edx cmp [ebp+var_8], 0 jz loc_4022CE mov edx, [ebp+var_8] add edx, ebx mov [ebp+var_14], edx mov edx, [ebp+var_14] and dword ptr [edx], 0FFFFFFFEh mov edx, [ebp+var_8] mov edx, [edx+4] mov [ebp+var_10], edx mov edx, [ebp+var_10] cmp edx, [ebp+var_8] jnz short loc_402272 mov edx, ds:hMem xor ecx, ecx mov [edx+eax*4-0Ch], ecx jmp short loc_402298 ; --------------------------------------------------------------------------- loc_402272: ; CODE XREF: sub_4021B8+AAj mov edx, ds:hMem mov ecx, [ebp+var_10] mov [edx+eax*4-0Ch], ecx mov eax, [ebp+var_8] mov eax, [eax] mov [ebp+var_C], eax mov eax, [ebp+var_C] mov edx, [ebp+var_10] mov [eax+4], edx mov eax, [ebp+var_10] mov edx, [ebp+var_C] mov [eax], edx loc_402298: ; CODE XREF: sub_4021B8+B8j mov eax, [ebp+var_8] mov [ebp+var_14], eax mov eax, [ebp+var_8] mov eax, [eax+8] or eax, 2 mov edx, [ebp+var_14] mov [edx], eax mov eax, [ebp+var_14] add eax, 4 mov [ebp+var_4], eax inc ds:dword_40859C sub ebx, 4 add ds:dword_4085A0, ebx call sub_403648 jmp loc_40235B ; --------------------------------------------------------------------------- loc_4022CE: ; CODE XREF: sub_4021B8+64j ; sub_4021B8+87j cmp ebx, ds:dword_408604 jg short loc_402329 sub ds:dword_408604, ebx cmp ds:dword_408604, 0Ch jge short loc_4022F2 add ebx, ds:dword_408604 xor eax, eax mov ds:dword_408604, eax loc_4022F2: ; CODE XREF: sub_4021B8+12Bj mov eax, ds:dword_408608 mov [ebp+var_14], eax add ds:dword_408608, ebx mov eax, ebx or eax, 2 mov edx, [ebp+var_14] mov [edx], eax mov eax, [ebp+var_14] add eax, 4 mov [ebp+var_4], eax inc ds:dword_40859C sub ebx, 4 add ds:dword_4085A0, ebx call sub_403648 jmp short loc_40235B ; --------------------------------------------------------------------------- loc_402329: ; CODE XREF: sub_4021B8+11Cj mov eax, ebx call sub_402070 mov [ebp+var_4], eax xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_40235B loc_402340: ; CODE XREF: sub_4021B8+1A1j cmp ds:byte_408035, 0 jz short loc_402353 push offset CriticalSection ; lpCriticalSection call LeaveCriticalSection loc_402353: ; CODE XREF: sub_4021B8+18Fj retn ; --------------------------------------------------------------------------- loc_402354: ; DATA XREF: sub_4021B8+30o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_402340 ; --------------------------------------------------------------------------- loc_40235B: ; CODE XREF: sub_4021B8+28j ; sub_4021B8+111j ... mov eax, [ebp+var_4] pop ebx mov esp, ebp pop ebp retn sub_4021B8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402364 proc near ; CODE XREF: sub_401C48+1Cp ; sub_402740+8Dp ... var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF0h push ebx mov ebx, eax xor eax, eax mov ds:dword_4085B0, eax cmp ds:byte_4085AC, 0 jnz short loc_40239C call sub_40195C test al, al jnz short loc_40239C mov ds:dword_4085B0, 8 mov [ebp+var_4], 8 jmp loc_402532 ; --------------------------------------------------------------------------- loc_40239C: ; CODE XREF: sub_402364+17j ; sub_402364+20j xor edx, edx push ebp push offset loc_40252B push dword ptr fs:[edx] mov fs:[edx], esp cmp ds:byte_408035, 0 jz short loc_4023BD push offset CriticalSection ; lpCriticalSection call EnterCriticalSection loc_4023BD: ; CODE XREF: sub_402364+4Dj mov [ebp+var_8], ebx mov eax, [ebp+var_8] sub eax, 4 mov [ebp+var_8], eax mov eax, [ebp+var_8] mov ebx, [eax] test bl, 2 jnz short loc_4023E2 mov ds:dword_4085B0, 9 jmp loc_402502 ; --------------------------------------------------------------------------- loc_4023E2: ; CODE XREF: sub_402364+6Dj dec ds:dword_40859C mov eax, ebx and eax, 7FFFFFFCh sub eax, 4 sub ds:dword_4085A0, eax test bl, 1 jz short loc_402450 mov eax, [ebp+var_8] sub eax, 0Ch mov eax, [eax+8] cmp eax, 0Ch jl short loc_402412 test eax, 80000003h jz short loc_402421 loc_402412: ; CODE XREF: sub_402364+A5j mov ds:dword_4085B0, 0Ah jmp loc_402502 ; --------------------------------------------------------------------------- loc_402421: ; CODE XREF: sub_402364+ACj mov edx, [ebp+var_8] sub edx, eax mov [ebp+var_10], edx mov edx, [ebp+var_10] cmp eax, [edx+8] jz short loc_402440 mov ds:dword_4085B0, 0Ah jmp loc_402502 ; --------------------------------------------------------------------------- loc_402440: ; CODE XREF: sub_402364+CBj add ebx, eax mov eax, [ebp+var_10] mov [ebp+var_8], eax mov eax, [ebp+var_10] call sub_401B34 loc_402450: ; CODE XREF: sub_402364+97j and ebx, 7FFFFFFCh mov eax, [ebp+var_8] add eax, ebx mov [ebp+var_C], eax mov eax, [ebp+var_C] cmp eax, ds:dword_408608 jnz short loc_402495 sub ds:dword_408608, ebx add ds:dword_408604, ebx cmp ds:dword_408604, 3C00h jle short loc_402486 call sub_401F00 loc_402486: ; CODE XREF: sub_402364+11Bj xor eax, eax mov [ebp+var_4], eax call sub_403648 jmp loc_402532 ; --------------------------------------------------------------------------- loc_402495: ; CODE XREF: sub_402364+103j mov eax, [ebp+var_C] mov eax, [eax] test al, 2 jz short loc_4024BC and eax, 7FFFFFFCh cmp eax, 4 jge short loc_4024B4 mov ds:dword_4085B0, 0Bh jmp short loc_402502 ; --------------------------------------------------------------------------- loc_4024B4: ; CODE XREF: sub_402364+142j mov eax, [ebp+var_C] or dword ptr [eax], 1 jmp short loc_4024F8 ; --------------------------------------------------------------------------- loc_4024BC: ; CODE XREF: sub_402364+138j mov eax, [ebp+var_C] mov [ebp+var_10], eax mov eax, [ebp+var_10] cmp dword ptr [eax+4], 0 jz short loc_4024DC mov eax, [ebp+var_10] cmp dword ptr [eax], 0 jz short loc_4024DC mov eax, [ebp+var_10] cmp dword ptr [eax+8], 0Ch jge short loc_4024E8 loc_4024DC: ; CODE XREF: sub_402364+165j ; sub_402364+16Dj mov ds:dword_4085B0, 0Bh jmp short loc_402502 ; --------------------------------------------------------------------------- loc_4024E8: ; CODE XREF: sub_402364+176j mov eax, [ebp+var_10] mov eax, [eax+8] add ebx, eax mov eax, [ebp+var_10] call sub_401B34 loc_4024F8: ; CODE XREF: sub_402364+156j mov edx, ebx mov eax, [ebp+var_8] call sub_401E08 loc_402502: ; CODE XREF: sub_402364+79j ; sub_402364+B8j ... mov eax, ds:dword_4085B0 mov [ebp+var_4], eax xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_402532 loc_402517: ; CODE XREF: sub_402364+1CCj cmp ds:byte_408035, 0 jz short loc_40252A push offset CriticalSection ; lpCriticalSection call LeaveCriticalSection loc_40252A: ; CODE XREF: sub_402364+1BAj retn ; --------------------------------------------------------------------------- loc_40252B: ; DATA XREF: sub_402364+3Bo jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_402517 ; --------------------------------------------------------------------------- loc_402532: ; CODE XREF: sub_402364+33j ; sub_402364+12Cj ... mov eax, [ebp+var_4] pop ebx mov esp, ebp pop ebp retn sub_402364 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40253C proc near ; CODE XREF: sub_402740+4Dp var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h push ebx push esi push edi push ebp add esp, 0FFFFFFF4h mov ebx, edx add ebx, 7 and ebx, 0FFFFFFFCh cmp ebx, 0Ch jge short loc_402555 mov ebx, 0Ch loc_402555: ; CODE XREF: sub_40253C+12j sub eax, 4 mov [esp+1Ch+var_1C], eax mov eax, [esp+1Ch+var_1C] mov esi, [eax] and esi, 7FFFFFFCh mov eax, [esp+1Ch+var_1C] add eax, esi mov [esp+1Ch+var_18], eax cmp esi, ebx jnz short loc_40257A mov al, 1 jmp loc_402737 ; --------------------------------------------------------------------------- loc_40257A: ; CODE XREF: sub_40253C+35j cmp esi, ebx jle loc_402612 mov ebp, esi sub ebp, ebx mov edx, [esp+1Ch+var_18] cmp edx, ds:dword_408608 jnz short loc_4025BE sub ds:dword_408608, ebp add ds:dword_408604, ebp cmp ds:dword_408604, 0Ch jge loc_40271A add ds:dword_408608, ebp sub ds:dword_408604, ebp mov ebx, esi jmp loc_40271A ; --------------------------------------------------------------------------- loc_4025BE: ; CODE XREF: sub_40253C+54j mov [esp+1Ch+var_18], eax mov eax, [esp+1Ch+var_18] test byte ptr [eax], 2 jnz short loc_4025E3 mov eax, [esp+1Ch+var_18] mov [esp+1Ch+var_14], eax mov eax, [esp+1Ch+var_14] add ebp, [eax+8] mov eax, [esp+1Ch+var_14] call sub_401B34 loc_4025E3: ; CODE XREF: sub_40253C+8Dj cmp ebp, 0Ch jl short loc_40260B mov eax, [esp+1Ch+var_1C] add eax, ebx mov [esp+1Ch+var_18], eax or ebp, 2 mov eax, [esp+1Ch+var_18] mov [eax], ebp mov eax, [esp+1Ch+var_18] add eax, 4 call sub_401C48 jmp loc_40271A ; --------------------------------------------------------------------------- loc_40260B: ; CODE XREF: sub_40253C+AAj mov ebx, esi jmp loc_40271A ; --------------------------------------------------------------------------- loc_402612: ; CODE XREF: sub_40253C+40j ; sub_40253C+1D5j mov edi, ebx sub edi, esi mov eax, [esp+1Ch+var_18] cmp eax, ds:dword_408608 jnz short loc_402687 cmp edi, ds:dword_408604 jg short loc_402679 sub ds:dword_408604, edi add ds:dword_408608, edi cmp ds:dword_408604, 0Ch jge short loc_402657 mov eax, ds:dword_408604 add ds:dword_408608, eax add ebx, ds:dword_408604 xor eax, eax mov ds:dword_408604, eax loc_402657: ; CODE XREF: sub_40253C+101j mov eax, ebx sub eax, esi add ds:dword_4085A0, eax mov eax, [esp+1Ch+var_1C] mov eax, [eax] and eax, 80000003h or ebx, eax mov eax, [esp+1Ch+var_1C] mov [eax], ebx mov al, 1 jmp loc_402737 ; --------------------------------------------------------------------------- loc_402679: ; CODE XREF: sub_40253C+ECj call sub_401F00 mov eax, [esp+1Ch+var_1C] add eax, esi mov [esp+1Ch+var_18], eax loc_402687: ; CODE XREF: sub_40253C+E4j mov eax, [esp+1Ch+var_18] test byte ptr [eax], 2 jnz short loc_4026DF mov eax, [esp+1Ch+var_18] mov [esp+1Ch+var_14], eax mov edx, [esp+1Ch+var_14] mov ebp, [edx+8] cmp edi, ebp jle short loc_4026AD add eax, ebp mov [esp+1Ch+var_18], eax sub edi, ebp jmp short loc_4026DF ; --------------------------------------------------------------------------- loc_4026AD: ; CODE XREF: sub_40253C+165j mov eax, [esp+1Ch+var_14] call sub_401B34 sub ebp, edi cmp ebp, 0Ch jl short loc_4026CB mov eax, [esp+1Ch+var_1C] add eax, ebx mov edx, ebp call sub_401E08 jmp short loc_40271A ; --------------------------------------------------------------------------- loc_4026CB: ; CODE XREF: sub_40253C+17Fj add ebx, ebp mov eax, [esp+1Ch+var_1C] add eax, ebx mov [esp+1Ch+var_18], eax mov eax, [esp+1Ch+var_18] and dword ptr [eax], 0FFFFFFFEh jmp short loc_40271A ; --------------------------------------------------------------------------- loc_4026DF: ; CODE XREF: sub_40253C+152j ; sub_40253C+16Fj mov eax, [esp+1Ch+var_18] mov eax, [eax] test eax, 80000000h jz short loc_402716 and eax, 7FFFFFFCh add eax, [esp+1Ch+var_18] mov [esp+1Ch+var_18], eax mov edx, edi mov eax, [esp+1Ch+var_18] call sub_402004 test al, al jz short loc_402716 mov eax, [esp+1Ch+var_1C] add eax, esi mov [esp+1Ch+var_18], eax jmp loc_402612 ; --------------------------------------------------------------------------- loc_402716: ; CODE XREF: sub_40253C+1AEj ; sub_40253C+1CAj xor eax, eax jmp short loc_402737 ; --------------------------------------------------------------------------- loc_40271A: ; CODE XREF: sub_40253C+69j ; sub_40253C+7Dj ... mov eax, ebx sub eax, esi add ds:dword_4085A0, eax mov eax, [esp+1Ch+var_1C] mov eax, [eax] and eax, 80000003h or ebx, eax mov eax, [esp+1Ch+var_1C] mov [eax], ebx mov al, 1 loc_402737: ; CODE XREF: sub_40253C+39j ; sub_40253C+138j ... add esp, 0Ch pop ebp pop edi pop esi pop ebx retn sub_40253C endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402740 proc near ; CODE XREF: sub_40285C+Dp ; DATA XREF: DATA:off_407034o var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx push esi mov esi, edx mov ebx, eax cmp ds:byte_4085AC, 0 jnz short loc_402768 call sub_40195C test al, al jnz short loc_402768 xor eax, eax mov [ebp+var_4], eax jmp loc_402800 ; --------------------------------------------------------------------------- loc_402768: ; CODE XREF: sub_402740+13j ; sub_402740+1Cj xor edx, edx push ebp push offset loc_4027F9 push dword ptr fs:[edx] mov fs:[edx], esp cmp ds:byte_408035, 0 jz short loc_402789 push offset CriticalSection ; lpCriticalSection call EnterCriticalSection loc_402789: ; CODE XREF: sub_402740+3Dj mov edx, esi mov eax, ebx call sub_40253C test al, al jz short loc_40279B mov [ebp+var_4], ebx jmp short loc_4027D8 ; --------------------------------------------------------------------------- loc_40279B: ; CODE XREF: sub_402740+54j mov eax, esi call sub_4021B8 mov [ebp+var_8], eax mov eax, ebx sub eax, 4 mov eax, [eax] and eax, 7FFFFFFCh sub eax, 4 cmp esi, eax jge short loc_4027BA mov eax, esi loc_4027BA: ; CODE XREF: sub_402740+76j cmp [ebp+var_8], 0 jz short loc_4027D2 mov edx, [ebp+var_8] mov ecx, ebx xchg eax, ecx call sub_40296C mov eax, ebx call sub_402364 loc_4027D2: ; CODE XREF: sub_402740+7Ej mov eax, [ebp+var_8] mov [ebp+var_4], eax loc_4027D8: ; CODE XREF: sub_402740+59j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_402800 loc_4027E5: ; CODE XREF: sub_402740+BEj cmp ds:byte_408035, 0 jz short loc_4027F8 push offset CriticalSection ; lpCriticalSection call LeaveCriticalSection loc_4027F8: ; CODE XREF: sub_402740+ACj retn ; --------------------------------------------------------------------------- loc_4027F9: ; DATA XREF: sub_402740+2Bo jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_4027E5 ; --------------------------------------------------------------------------- loc_402800: ; CODE XREF: sub_402740+23j ; sub_402740:loc_4027F8j ; DATA XREF: ... mov eax, [ebp+var_4] pop esi pop ebx pop ecx pop ecx pop ebp retn sub_402740 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40280C proc near ; CODE XREF: sub_403BB0+Cp ; sub_405074+143Ap var_8 = dword ptr -8 push ebx push ecx mov ebx, eax test ebx, ebx jle short loc_40282E mov eax, ebx call ds:off_40702C mov [esp+8+var_8], eax cmp [esp+8+var_8], 0 jnz short loc_402833 mov al, 1 call sub_402904 ; --------------------------------------------------------------------------- jmp short loc_402833 ; --------------------------------------------------------------------------- loc_40282E: ; CODE XREF: sub_40280C+6j xor eax, eax mov [esp+8+var_8], eax loc_402833: ; CODE XREF: sub_40280C+17j ; sub_40280C+20j mov eax, [esp+8+var_8] pop edx pop ebx retn sub_40280C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40283C proc near ; CODE XREF: sub_403B18+1Cp ; sub_403B3C+21p ... push ebx test eax, eax jz short loc_402856 call ds:off_407030 mov ebx, eax test ebx, ebx jz short loc_402858 mov al, 2 call sub_402904 ; --------------------------------------------------------------------------- jmp short loc_402858 ; --------------------------------------------------------------------------- loc_402856: ; CODE XREF: sub_40283C+3j xor ebx, ebx loc_402858: ; CODE XREF: sub_40283C+Fj ; sub_40283C+18j mov eax, ebx pop ebx retn sub_40283C endp ; =============== S U B R O U T I N E ======================================= sub_40285C proc near ; CODE XREF: sub_403EE4+22p mov ecx, [eax] test ecx, ecx jz short loc_402894 test edx, edx jz short loc_40287E push eax mov eax, ecx call ds:off_407034 pop ecx or eax, eax jz short loc_40288D mov [ecx], eax retn ; --------------------------------------------------------------------------- loc_402877: ; CODE XREF: sub_40285C+2Ej mov al, 2 jmp sub_402904 ; --------------------------------------------------------------------------- loc_40287E: ; CODE XREF: sub_40285C+8j mov [eax], edx mov eax, ecx call ds:off_407030 or eax, eax jnz short loc_402877 retn ; --------------------------------------------------------------------------- loc_40288D: ; CODE XREF: sub_40285C+16j ; sub_40285C+48j mov al, 1 jmp sub_402904 ; --------------------------------------------------------------------------- loc_402894: ; CODE XREF: sub_40285C+4j test edx, edx jz short locret_4028A8 push eax mov eax, edx call ds:off_40702C pop ecx or eax, eax jz short loc_40288D mov [ecx], eax locret_4028A8: ; CODE XREF: sub_40285C+3Aj retn sub_40285C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_4028AC proc near ; CODE XREF: sub_4028B8+42p ; CODE:004036F7p mov ds:dword_407004, edx call sub_403B00 sub_4028AC endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_4028B8 proc near ; CODE XREF: sub_402904+6j push ebx push esi mov esi, edx mov ebx, eax and bl, 7Fh cmp ds:dword_408008, 0 jz short loc_4028D4 mov edx, esi mov eax, ebx call ds:dword_408008 loc_4028D4: ; CODE XREF: sub_4028B8+10j test bl, bl jnz short loc_4028E5 call sub_4043D8 mov ebx, [eax+4] jmp short loc_4028F4 ; --------------------------------------------------------------------------- loc_4028E5: ; CODE XREF: sub_4028B8+1Ej cmp bl, 18h ja short loc_4028F4 xor eax, eax mov al, bl mov bl, ds:byte_407038[eax] loc_4028F4: ; CODE XREF: sub_4028B8+2Bj ; sub_4028B8+30j xor eax, eax mov al, bl mov edx, esi call sub_4028AC sub_4028B8 endp ; --------------------------------------------------------------------------- pop esi pop ebx retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_402904 proc near ; CODE XREF: sub_40280C+1Bp ; sub_40283C+13p ... and eax, 7Fh mov edx, [esp+0] jmp sub_4028B8 sub_402904 endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_402910 proc near ; CODE XREF: sub_405074+E50p ; sub_405074+1255p ... push eax push edx push ecx call sub_4043D8 cmp dword ptr [eax+4], 0 pop ecx pop edx pop eax jnz short loc_402925 retn ; --------------------------------------------------------------------------- loc_402925: ; CODE XREF: sub_402910+12j xor eax, eax jmp sub_402904 sub_402910 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402930 proc near ; CODE XREF: sub_402940+5p ; sub_402B80+4Ep ... push ebx mov ebx, eax call sub_4043D8 mov [eax+4], ebx pop ebx retn sub_402930 endp ; =============== S U B R O U T I N E ======================================= sub_402940 proc near ; CODE XREF: sub_403008+17p call GetLastError call sub_402930 retn sub_402940 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40294C proc near ; CODE XREF: sub_405074+125Ap push ebx call sub_4043D8 mov ebx, [eax+4] call sub_4043D8 xor edx, edx mov [eax+4], edx mov eax, ebx pop ebx retn sub_40294C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40296C proc near ; CODE XREF: sub_402740+86p ; sub_402E3C+4Fp ... push esi push edi mov esi, eax mov edi, edx mov eax, ecx cmp edi, esi ja short loc_40298B jz short loc_4029A9 sar ecx, 2 js short loc_4029A9 rep movsd mov ecx, eax and ecx, 3 rep movsb pop edi pop esi retn ; --------------------------------------------------------------------------- loc_40298B: ; CODE XREF: sub_40296C+Aj lea esi, [ecx+esi-4] lea edi, [ecx+edi-4] sar ecx, 2 js short loc_4029A9 std rep movsd mov ecx, eax and ecx, 3 add esi, 3 add edi, 3 rep movsb cld loc_4029A9: ; CODE XREF: sub_40296C+Cj ; sub_40296C+11j ... pop edi pop esi retn sub_40296C endp ; =============== S U B R O U T I N E ======================================= sub_4029AC proc near ; CODE XREF: sub_402B10+44p var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = byte ptr -14h push ebx push esi push edi push ebp add esp, 0FFFFFFE8h mov [esp+28h+var_24], edx mov [esp+28h+var_28], eax mov esi, esp lea edi, [esp+28h+var_14] jmp short loc_4029CC ; --------------------------------------------------------------------------- loc_4029C2: ; CODE XREF: sub_4029AC+2Bj mov eax, [esi] push eax ; lpsz call CharNextA ; CharNextA mov [esi], eax loc_4029CC: ; CODE XREF: sub_4029AC+14j ; sub_4029AC+3Fj mov eax, [esi] mov bl, [eax] test bl, bl jz short loc_4029D9 cmp bl, 20h jbe short loc_4029C2 loc_4029D9: ; CODE XREF: sub_4029AC+26j mov eax, [esi] cmp byte ptr [eax], 22h jnz short loc_4029ED mov eax, [esi] cmp byte ptr [eax+1], 22h jnz short loc_4029ED add dword ptr [esi], 2 jmp short loc_4029CC ; --------------------------------------------------------------------------- loc_4029ED: ; CODE XREF: sub_4029AC+32j ; sub_4029AC+3Aj xor ebp, ebp mov eax, [esi] mov [esp+28h+var_1C], eax jmp short loc_402A52 ; --------------------------------------------------------------------------- loc_4029F7: ; CODE XREF: sub_4029AC+ABj mov eax, [esi] cmp byte ptr [eax], 22h jnz short loc_402A3E mov eax, [esi] push eax ; lpsz call CharNextA ; CharNextA mov [esi], eax jmp short loc_402A1E ; --------------------------------------------------------------------------- loc_402A0A: ; CODE XREF: sub_4029AC+7Dj mov eax, [esi] push eax ; lpsz call CharNextA ; CharNextA mov [edi], eax mov eax, [edi] sub eax, [esi] add ebp, eax mov eax, [edi] mov [esi], eax loc_402A1E: ; CODE XREF: sub_4029AC+5Cj mov eax, [esi] mov bl, [eax] test bl, bl jz short loc_402A2B cmp bl, 22h jnz short loc_402A0A loc_402A2B: ; CODE XREF: sub_4029AC+78j mov eax, [esi] cmp byte ptr [eax], 0 jz short loc_402A52 mov eax, [esi] push eax ; lpsz call CharNextA ; CharNextA mov [esi], eax jmp short loc_402A52 ; --------------------------------------------------------------------------- loc_402A3E: ; CODE XREF: sub_4029AC+50j mov eax, [esi] push eax ; lpsz call CharNextA ; CharNextA mov [edi], eax mov eax, [edi] sub eax, [esi] add ebp, eax mov eax, [edi] mov [esi], eax loc_402A52: ; CODE XREF: sub_4029AC+49j ; sub_4029AC+84j ... mov eax, [esi] cmp byte ptr [eax], 20h ja short loc_4029F7 mov eax, [esp+28h+var_24] mov edx, ebp call sub_403EE4 mov eax, [esp+28h+var_1C] mov [esi], eax mov eax, [esp+28h+var_24] mov eax, [eax] mov [esp+28h+var_18], eax xor ebp, ebp jmp short loc_402AF3 ; --------------------------------------------------------------------------- loc_402A78: ; CODE XREF: sub_4029AC+14Cj mov eax, [esi] cmp byte ptr [eax], 22h jnz short loc_402ACF mov eax, [esi] push eax ; lpsz call CharNextA ; CharNextA mov [esi], eax jmp short loc_402AAF ; --------------------------------------------------------------------------- loc_402A8B: ; CODE XREF: sub_4029AC+10Ej mov eax, [esi] push eax ; lpsz call CharNextA ; CharNextA mov [edi], eax mov eax, [esi] cmp eax, [edi] jnb short loc_402AAF loc_402A9B: ; CODE XREF: sub_4029AC+101j mov eax, [esi] mov al, [eax] mov edx, [esp+28h+var_18] mov [edx+ebp], al inc dword ptr [esi] inc ebp mov eax, [esi] cmp eax, [edi] jb short loc_402A9B loc_402AAF: ; CODE XREF: sub_4029AC+DDj ; sub_4029AC+EDj mov eax, [esi] mov bl, [eax] test bl, bl jz short loc_402ABC cmp bl, 22h jnz short loc_402A8B loc_402ABC: ; CODE XREF: sub_4029AC+109j mov eax, [esi] cmp byte ptr [eax], 0 jz short loc_402AF3 mov eax, [esi] push eax ; lpsz call CharNextA ; CharNextA mov [esi], eax jmp short loc_402AF3 ; --------------------------------------------------------------------------- loc_402ACF: ; CODE XREF: sub_4029AC+D1j mov eax, [esi] push eax ; lpsz call CharNextA ; CharNextA mov [edi], eax mov eax, [esi] cmp eax, [edi] jnb short loc_402AF3 loc_402ADF: ; CODE XREF: sub_4029AC+145j mov eax, [esi] mov al, [eax] mov edx, [esp+28h+var_18] mov [edx+ebp], al inc dword ptr [esi] inc ebp mov eax, [esi] cmp eax, [edi] jb short loc_402ADF loc_402AF3: ; CODE XREF: sub_4029AC+CAj ; sub_4029AC+115j ... mov eax, [esi] cmp byte ptr [eax], 20h ja loc_402A78 mov eax, [esi] mov [esp+28h+var_20], eax mov eax, [esp+28h+var_20] add esp, 18h pop ebp pop edi pop esi pop ebx retn sub_4029AC endp ; =============== S U B R O U T I N E ======================================= sub_402B10 proc near ; CODE XREF: sub_405074+148Ap var_114 = dword ptr -114h Filename = byte ptr -110h push ebx push esi add esp, 0FFFFFEF4h mov ebx, edx mov esi, eax mov eax, ebx call sub_403B18 test esi, esi jnz short loc_402B47 push 105h ; nSize lea eax, [esp+118h+Filename] push eax ; lpFilename push 0 ; hModule call GetModuleFileNameA ; GetModuleFileNameA mov ecx, eax lea edx, [esp+114h+Filename] mov eax, ebx call sub_403BDC jmp short loc_402B68 ; --------------------------------------------------------------------------- loc_402B47: ; CODE XREF: sub_402B10+15j call GetCommandLineA ; GetCommandLineA mov [esp+114h+var_114], eax loc_402B4F: ; CODE XREF: sub_402B10+56j mov edx, ebx mov eax, [esp+114h+var_114] call sub_4029AC mov [esp+114h+var_114], eax test esi, esi jz short loc_402B68 cmp dword ptr [ebx], 0 jz short loc_402B68 dec esi jmp short loc_402B4F ; --------------------------------------------------------------------------- loc_402B68: ; CODE XREF: sub_402B10+35j ; sub_402B10+4Ej ... add esp, 10Ch pop esi pop ebx retn sub_402B10 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402B74 proc near ; CODE XREF: sub_40476C+81p var_8 = qword ptr -8 sub esp, 8 fistp [esp+8+var_8] wait pop eax pop edx retn sub_402B74 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402B80 proc near ; CODE XREF: sub_402BD8+4p push ebx push esi mov esi, edx mov ebx, eax mov ax, [ebx+4] cmp ax, 0D7B0h jb short loc_402B96 cmp ax, 0D7B3h jbe short loc_402B9D loc_402B96: ; CODE XREF: sub_402B80+Ej mov ebx, 66h jmp short loc_402BC8 ; --------------------------------------------------------------------------- loc_402B9D: ; CODE XREF: sub_402B80+14j cmp ax, 0D7B0h jz short loc_402BAA mov eax, ebx call sub_402F58 loc_402BAA: ; CODE XREF: sub_402B80+21j mov [ebx+4], si cmp byte ptr [ebx+48h], 0 jnz short loc_402BC1 cmp dword ptr [ebx+18h], 0 jnz short loc_402BC1 mov dword ptr [ebx+18h], offset loc_402C90 loc_402BC1: ; CODE XREF: sub_402B80+32j ; sub_402B80+38j mov eax, ebx call dword ptr [ebx+18h] mov ebx, eax loc_402BC8: ; CODE XREF: sub_402B80+1Bj test ebx, ebx jz short loc_402BD3 mov eax, ebx call sub_402930 loc_402BD3: ; CODE XREF: sub_402B80+4Aj mov eax, ebx pop esi pop ebx retn sub_402B80 endp ; =============== S U B R O U T I N E ======================================= sub_402BD8 proc near ; CODE XREF: sub_405074+E4Bp mov dx, 0D7B2h call sub_402B80 retn sub_402BD8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402BE4 proc near ; DATA XREF: CODE:00402CC0o push ebx mov ebx, eax xor eax, eax mov [ebx+10h], eax xor eax, eax mov [ebx+0Ch], eax push 0 ; lpOverlapped lea eax, [ebx+10h] push eax ; lpNumberOfBytesRead mov eax, [ebx+8] push eax ; nNumberOfBytesToRead mov eax, [ebx+14h] push eax ; lpBuffer mov eax, [ebx] push eax ; hFile call ReadFile ; ReadFile test eax, eax jnz short loc_402C19 call GetLastError cmp eax, 6Dh jnz short loc_402C1B xor eax, eax pop ebx retn ; --------------------------------------------------------------------------- loc_402C19: ; CODE XREF: sub_402BE4+25j xor eax, eax loc_402C1B: ; CODE XREF: sub_402BE4+2Fj pop ebx retn sub_402BE4 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402C20 proc near ; DATA XREF: CODE:00402CF7o ; CODE:00402DC7o ... xor eax, eax retn sub_402C20 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402C24 proc near ; DATA XREF: CODE:loc_402CE9o ; CODE:00402E0Fo NumberOfBytesWritten= dword ptr -0Ch push ebx push esi push ecx mov ebx, eax mov esi, [ebx+0Ch] test esi, esi jnz short loc_402C34 xor eax, eax jmp short loc_402C5A ; --------------------------------------------------------------------------- loc_402C34: ; CODE XREF: sub_402C24+Aj push 0 ; lpOverlapped lea eax, [esp+10h+NumberOfBytesWritten] push eax ; lpNumberOfBytesWritten push esi ; nNumberOfBytesToWrite mov eax, [ebx+14h] push eax ; lpBuffer mov eax, [ebx] push eax ; hFile call WriteFile ; WriteFile test eax, eax jnz short loc_402C53 call GetLastError jmp short loc_402C55 ; --------------------------------------------------------------------------- loc_402C53: ; CODE XREF: sub_402C24+26j xor eax, eax loc_402C55: ; CODE XREF: sub_402C24+2Dj xor edx, edx mov [ebx+0Ch], edx loc_402C5A: ; CODE XREF: sub_402C24+Ej pop edx pop esi pop ebx retn sub_402C24 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402C60 proc near ; CODE XREF: sub_402C70+Bp ; sub_403008+Ep push ebx mov ebx, eax push ebx ; hObject call CloseHandle ; CloseHandle dec eax setz al pop ebx retn sub_402C60 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402C70 proc near ; DATA XREF: CODE:loc_402CF0o push ebx mov ebx, eax mov word ptr [ebx+4], 0D7B0h mov eax, [ebx] call sub_402C60 test al, al jnz short loc_402C8B call GetLastError pop ebx retn ; --------------------------------------------------------------------------- loc_402C8B: ; CODE XREF: sub_402C70+12j xor eax, eax pop ebx retn sub_402C70 endp ; --------------------------------------------------------------------------- align 10h loc_402C90: ; DATA XREF: sub_402B80+3Ao ; sub_402E3C+35o push esi mov esi, eax xor eax, eax mov [esi+0Ch], eax mov [esi+10h], eax mov ax, [esi+4] sub eax, 0D7B1h jz short loc_402CB1 dec eax jz short loc_402CC9 dec eax jz short loc_402CDA jmp loc_402E18 ; --------------------------------------------------------------------------- loc_402CB1: ; CODE XREF: CODE:00402CA4j mov eax, 80000000h mov edx, 1 mov ecx, 3 mov dword ptr [esi+1Ch], offset sub_402BE4 jmp short loc_402CF0 ; --------------------------------------------------------------------------- loc_402CC9: ; CODE XREF: CODE:00402CA7j mov eax, 40000000h mov edx, 1 mov ecx, 2 jmp short loc_402CE9 ; --------------------------------------------------------------------------- loc_402CDA: ; CODE XREF: CODE:00402CAAj mov eax, 0C0000000h mov edx, 1 mov ecx, 3 loc_402CE9: ; CODE XREF: CODE:00402CD8j mov dword ptr [esi+1Ch], offset sub_402C24 loc_402CF0: ; CODE XREF: CODE:00402CC7j mov dword ptr [esi+24h], offset sub_402C70 mov dword ptr [esi+20h], offset sub_402C20 cmp byte ptr [esi+48h], 0 jz loc_402DBA push 0 push 80h push ecx push 0 push edx push eax lea eax, [esi+48h] push eax call CreateFileA ; CreateFileA cmp eax, 0FFFFFFFFh jz loc_402E2E mov [esi], eax cmp word ptr [esi+4], 0D7B3h jnz loc_402DF7 dec word ptr [esi+4] push 0 push dword ptr [esi] call GetFileSize ; GetFileSize inc eax jz loc_402E2E sub eax, 81h jnb short loc_402D51 xor eax, eax loc_402D51: ; CODE XREF: CODE:00402D4Dj push 0 push 0 push eax push dword ptr [esi] call SetFilePointer ; SetFilePointer inc eax jz loc_402E2E push 0 mov edx, esp push 0 push edx push 80h lea edx, [esi+14Ch] push edx push dword ptr [esi] call ReadFile ; ReadFile pop edx dec eax jnz loc_402E2E xor eax, eax loc_402D88: ; CODE XREF: CODE:00402D97j cmp eax, edx jnb short loc_402DF7 cmp byte ptr [esi+eax+14Ch], 0Eh jz short loc_402D99 inc eax jmp short loc_402D88 ; --------------------------------------------------------------------------- loc_402D99: ; CODE XREF: CODE:00402D94j push 2 push 0 sub eax, edx push eax push dword ptr [esi] call SetFilePointer ; SetFilePointer inc eax jz loc_402E2E push dword ptr [esi] call SetEndOfFile ; SetEndOfFile dec eax jnz short loc_402E2E jmp short loc_402DF7 ; --------------------------------------------------------------------------- loc_402DBA: ; CODE XREF: CODE:00402D02j lea eax, [esi+14Ch] mov dword ptr [esi+8], 80h mov dword ptr [esi+24h], offset sub_402C20 mov [esi+14h], eax cmp word ptr [esi+4], 0D7B2h jz short loc_402DDD push 0FFFFFFF6h jmp short loc_402DEB ; --------------------------------------------------------------------------- loc_402DDD: ; CODE XREF: CODE:00402DD7j cmp esi, offset dword_4083D0 jnz short loc_402DE9 push 0FFFFFFF4h jmp short loc_402DEB ; --------------------------------------------------------------------------- loc_402DE9: ; CODE XREF: CODE:00402DE3j push 0FFFFFFF5h loc_402DEB: ; CODE XREF: CODE:00402DDBj ; CODE:00402DE7j call GetStdHandle ; GetStdHandle cmp eax, 0FFFFFFFFh jz short loc_402E2E mov [esi], eax loc_402DF7: ; CODE XREF: CODE:00402D2Ej ; CODE:00402D8Aj ... cmp word ptr [esi+4], 0D7B1h jz short loc_402E16 push dword ptr [esi] call GetFileType ; GetFileType test eax, eax jz short loc_402E1A cmp eax, 2 jnz short loc_402E16 mov dword ptr [esi+20h], offset sub_402C24 loc_402E16: ; CODE XREF: CODE:00402DFDj ; CODE:00402E0Dj xor eax, eax loc_402E18: ; CODE XREF: CODE:00402CACj ; CODE:00402E2Cj ... pop esi retn ; --------------------------------------------------------------------------- loc_402E1A: ; CODE XREF: CODE:00402E08j push dword ptr [esi] call CloseHandle ; CloseHandle mov word ptr [esi+4], 0D7B0h mov eax, 69h jmp short loc_402E18 ; --------------------------------------------------------------------------- loc_402E2E: ; CODE XREF: CODE:00402D20j ; CODE:00402D42j ... mov word ptr [esi+4], 0D7B0h call GetLastError jmp short loc_402E18 ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_402E3C proc near ; CODE XREF: sub_405074+E41p ; sub_405074+1240p push ebx push esi mov esi, edx mov ebx, eax mov eax, ebx xor ecx, ecx mov edx, 14Ch call sub_402FCC lea eax, [ebx+14Ch] mov [ebx+14h], eax mov word ptr [ebx+4], 0D7B0h xor eax, eax mov al, ds:byte_407020 mov [ebx+6], ax mov dword ptr [ebx+8], 80h mov dword ptr [ebx+18h], offset loc_402C90 mov eax, esi call sub_403C8C push eax mov eax, esi call sub_403E8C lea edx, [ebx+48h] pop ecx call sub_40296C mov eax, esi call sub_403C8C mov byte ptr [ebx+eax+48h], 0 xor eax, eax pop esi pop ebx retn sub_402E3C endp ; --------------------------------------------------------------------------- align 4 loc_402EA4: ; DATA XREF: sub_402F38+Do jmp ds:__imp_WriteFile ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402EAC proc near ; CODE XREF: sub_402F38+14p var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch arg_8 = dword ptr 10h arg_C = dword ptr 14h push ebp mov ebp, esp push ecx push ebx push esi push edi mov esi, ecx mov edi, edx mov ebx, eax mov eax, [ebp+arg_8] movzx edx, word ptr [ebx+4] and edx, eax cmp eax, edx jnz short loc_402F1E push 0 lea eax, [ebp+var_4] push eax mov eax, [ebx+8] imul esi push eax push edi mov eax, [ebx] push eax call [ebp+arg_4] test eax, eax jnz short loc_402EEE call GetLastError call sub_402930 xor eax, eax mov [ebp+var_4], eax jmp short loc_402F2D ; --------------------------------------------------------------------------- loc_402EEE: ; CODE XREF: sub_402EAC+2Fj mov eax, [ebp+var_4] xor edx, edx div dword ptr [ebx+8] mov [ebp+var_4], eax mov eax, [ebp+arg_C] test eax, eax jz short loc_402F0A mov eax, [ebp+arg_C] mov edx, [ebp+var_4] mov [eax], edx jmp short loc_402F2D ; --------------------------------------------------------------------------- loc_402F0A: ; CODE XREF: sub_402EAC+52j cmp esi, [ebp+var_4] jz short loc_402F2D mov eax, [ebp+arg_0] call sub_402930 xor eax, eax mov [ebp+var_4], eax jmp short loc_402F2D ; --------------------------------------------------------------------------- loc_402F1E: ; CODE XREF: sub_402EAC+18j mov eax, 67h call sub_402930 xor eax, eax mov [ebp+var_4], eax loc_402F2D: ; CODE XREF: sub_402EAC+40j ; sub_402EAC+5Cj ... mov eax, [ebp+var_4] pop edi pop esi pop ebx pop ecx pop ebp retn 10h sub_402EAC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_402F38 proc near ; CODE XREF: sub_405074+1290p arg_0 = dword ptr 8 push ebp mov ebp, esp push ebx mov ebx, [ebp+arg_0] push ebx push 0D7B2h push offset loc_402EA4 push 65h call sub_402EAC pop ebx pop ebp retn 4 sub_402F38 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402F58 proc near ; CODE XREF: sub_402B80+25p ; sub_404220+1Ep ... push ebx push esi mov ebx, eax xor esi, esi mov ax, [ebx+4] cmp ax, 0D7B1h jb short loc_402F97 cmp ax, 0D7B3h ja short loc_402F97 and ax, 0D7B2h cmp ax, 0D7B2h jnz short loc_402F7F mov eax, ebx call dword ptr [ebx+1Ch] mov esi, eax loc_402F7F: ; CODE XREF: sub_402F58+1Ej test esi, esi jnz short loc_402F8A mov eax, ebx call dword ptr [ebx+24h] mov esi, eax loc_402F8A: ; CODE XREF: sub_402F58+29j test esi, esi jz short loc_402FA9 mov eax, esi call sub_402930 jmp short loc_402FA9 ; --------------------------------------------------------------------------- loc_402F97: ; CODE XREF: sub_402F58+Ej ; sub_402F58+14j cmp ebx, offset dword_408038 jz short loc_402FA9 mov eax, 67h call sub_402930 loc_402FA9: ; CODE XREF: sub_402F58+34j ; sub_402F58+3Dj ... mov eax, esi pop esi pop ebx retn sub_402F58 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_402FB0 proc near ; CODE XREF: sub_404924+1Fp push ebx mov bl, [edx] cmp cl, bl jbe short loc_402FB9 mov ecx, ebx loc_402FB9: ; CODE XREF: sub_402FB0+5j mov [eax], cl inc edx inc eax and ecx, 0FFh xchg eax, edx call sub_40296C pop ebx retn sub_402FB0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402FCC proc near ; CODE XREF: sub_402E3C+Fp ; sub_404A60+43p ... push edi mov edi, eax mov ch, cl mov eax, ecx shl eax, 10h mov ax, cx mov ecx, edx sar ecx, 2 js short loc_402FE9 rep stosd mov ecx, edx and ecx, 3 rep stosb loc_402FE9: ; CODE XREF: sub_402FCC+12j pop edi retn sub_402FCC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_402FEC proc near ; CODE XREF: sub_404ED8+2Bp ; sub_405074+C2p ... push ebx xor ebx, ebx imul edx, ds:dword_407008[ebx], 8088405h inc edx mov ds:dword_407008[ebx], edx mul edx mov eax, edx pop ebx retn sub_402FEC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403008 proc near ; DATA XREF: sub_403030+35o push ebx push esi mov ebx, eax mov word ptr [ebx+4], 0D7B0h xor esi, esi mov eax, [ebx] call sub_402C60 test al, al jnz short loc_403029 call sub_402940 mov esi, 1 loc_403029: ; CODE XREF: sub_403008+15j mov eax, esi pop esi pop ebx retn sub_403008 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403030 proc near ; CODE XREF: sub_403110+5p push ebx push esi push edi mov esi, edx mov edi, ecx xor edx, edx mov ebx, eax mov dx, [eax+4] sub edx, 0D7B0h jz short loc_40305C cmp edx, 3 ja loc_4030F2 call dword ptr [ebx+24h] test eax, eax jz short loc_40305C call sub_402930 loc_40305C: ; CODE XREF: sub_403030+15j ; sub_403030+25j mov word ptr [ebx+4], 0D7B3h mov [ebx+8], esi mov dword ptr [ebx+24h], offset sub_403008 mov dword ptr [ebx+1Ch], offset sub_402C20 cmp byte ptr [ebx+48h], 0 jz short loc_4030D9 mov eax, 0C0000000h mov dl, ds:byte_40700C and edx, 70h shr edx, 2 mov edx, ds:dword_407054[edx] mov ecx, 2 sub edi, 3 jz short loc_4030BB mov ecx, 3 inc edi jz short loc_4030BB mov eax, 40000000h inc edi mov word ptr [ebx+4], 0D7B2h jz short loc_4030BB mov eax, 80000000h mov word ptr [ebx+4], 0D7B1h loc_4030BB: ; CODE XREF: sub_403030+68j ; sub_403030+70j ... push 0 ; hTemplateFile push 80h ; dwFlagsAndAttributes push ecx ; dwCreationDisposition push 0 ; lpSecurityAttributes push edx ; dwShareMode push eax ; dwDesiredAccess lea eax, [ebx+48h] push eax ; lpFileName call CreateFileA ; CreateFileA loc_4030D0: ; CODE XREF: sub_403030+C0j cmp eax, 0FFFFFFFFh jz short loc_4030F9 mov [ebx], eax jmp short loc_403109 ; --------------------------------------------------------------------------- loc_4030D9: ; CODE XREF: sub_403030+47j mov dword ptr [ebx+24h], offset sub_402C20 cmp edi, 3 jz short loc_4030E9 push 0FFFFFFF6h jmp short loc_4030EB ; --------------------------------------------------------------------------- loc_4030E9: ; CODE XREF: sub_403030+B3j push 0FFFFFFF5h ; nStdHandle loc_4030EB: ; CODE XREF: sub_403030+B7j call GetStdHandle ; GetStdHandle jmp short loc_4030D0 ; --------------------------------------------------------------------------- loc_4030F2: ; CODE XREF: sub_403030+1Aj mov eax, 66h jmp short loc_403104 ; --------------------------------------------------------------------------- loc_4030F9: ; CODE XREF: sub_403030+A3j mov word ptr [ebx+4], 0D7B0h call GetLastError loc_403104: ; CODE XREF: sub_403030+C7j call sub_402930 loc_403109: ; CODE XREF: sub_403030+A7j pop edi pop esi pop ebx retn sub_403030 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403110 proc near ; CODE XREF: sub_405074+1250p mov ecx, 3 call sub_403030 retn sub_403110 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40311C proc near ; CODE XREF: sub_40317C+4p var_26 = byte ptr -26h var_24 = byte ptr -24h var_10 = dword ptr -10h push ebx push esi push edi push edx sub esp, 14h mov edi, ecx mov esi, eax cdq xor eax, edx sub eax, edx mov ecx, 0Ah xor ebx, ebx loc_403133: ; CODE XREF: sub_40311C+24j xor edx, edx div ecx add edx, 30h mov [esp+ebx+24h+var_24], dl inc ebx test eax, eax jnz short loc_403133 test esi, esi jge short loc_40314B mov [esp+ebx+24h+var_24], 2Dh inc ebx loc_40314B: ; CODE XREF: sub_40311C+28j mov [edi], bl inc edi mov ecx, [esp+24h+var_10] cmp ecx, 0FFh jle short loc_40315F mov ecx, 0FFh loc_40315F: ; CODE XREF: sub_40311C+3Cj sub ecx, ebx jle short loc_40316A add [edi-1], cl mov al, 20h rep stosb loc_40316A: ; CODE XREF: sub_40311C+45j ; sub_40311C+56j mov al, [esp+ebx-1] mov [edi], al inc edi dec ebx jnz short loc_40316A add esp, 18h pop edi pop esi pop ebx retn sub_40311C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40317C proc near ; CODE XREF: sub_404924+12p mov ecx, edx xor edx, edx call sub_40311C retn sub_40317C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403188 proc near ; CODE XREF: sub_4041AC+41p push ebx push esi push edi mov esi, eax push eax test eax, eax jz short loc_4031FE xor eax, eax xor ebx, ebx mov edi, 0CCCCCCCh loc_40319B: ; CODE XREF: sub_403188+19j mov bl, [esi] inc esi cmp bl, 20h jz short loc_40319B mov ch, 0 cmp bl, 2Dh jz short loc_40320C cmp bl, 2Bh jz short loc_40320E loc_4031AF: ; CODE XREF: sub_403188+89j cmp bl, 24h jz short loc_403213 cmp bl, 78h jz short loc_403213 cmp bl, 58h jz short loc_403213 cmp bl, 30h jnz short loc_4031D6 mov bl, [esi] inc esi cmp bl, 78h jz short loc_403213 cmp bl, 58h jz short loc_403213 test bl, bl jz short loc_4031F4 jmp short loc_4031DA ; --------------------------------------------------------------------------- loc_4031D6: ; CODE XREF: sub_403188+39j test bl, bl jz short loc_403207 loc_4031DA: ; CODE XREF: sub_403188+4Cj ; sub_403188+6Aj sub bl, 30h cmp bl, 9 ja short loc_403207 cmp eax, edi ja short loc_403207 lea eax, [eax+eax*4] add eax, eax add eax, ebx mov bl, [esi] inc esi test bl, bl jnz short loc_4031DA loc_4031F4: ; CODE XREF: sub_403188+4Aj dec ch jz short loc_403201 test eax, eax jge short loc_403250 jmp short loc_403207 ; --------------------------------------------------------------------------- loc_4031FE: ; CODE XREF: sub_403188+8j ; sub_403188+95j inc esi jmp short loc_403207 ; --------------------------------------------------------------------------- loc_403201: ; CODE XREF: sub_403188+6Ej neg eax jle short loc_403250 js short loc_403250 loc_403207: ; CODE XREF: sub_403188+50j ; sub_403188+58j ... pop ebx sub esi, ebx jmp short loc_403253 ; --------------------------------------------------------------------------- loc_40320C: ; CODE XREF: sub_403188+20j inc ch loc_40320E: ; CODE XREF: sub_403188+25j mov bl, [esi] inc esi jmp short loc_4031AF ; --------------------------------------------------------------------------- loc_403213: ; CODE XREF: sub_403188+2Aj ; sub_403188+2Fj ... mov edi, 0FFFFFFFh mov bl, [esi] inc esi test bl, bl jz short loc_4031FE loc_40321F: ; CODE XREF: sub_403188+C0j cmp bl, 61h jb short loc_403227 sub bl, 20h loc_403227: ; CODE XREF: sub_403188+9Aj sub bl, 30h cmp bl, 9 jbe short loc_40323A sub bl, 11h cmp bl, 5 ja short loc_403207 add bl, 0Ah loc_40323A: ; CODE XREF: sub_403188+A5j cmp eax, edi ja short loc_403207 shl eax, 4 add eax, ebx mov bl, [esi] inc esi test bl, bl jnz short loc_40321F dec ch jnz short loc_403250 neg eax loc_403250: ; CODE XREF: sub_403188+72j ; sub_403188+7Bj ... pop ecx xor esi, esi loc_403253: ; CODE XREF: sub_403188+82j mov [edx], esi pop edi pop esi pop ebx retn sub_403188 endp ; --------------------------------------------------------------------------- align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetKeyboardType. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= sub_403264 proc near ; CODE XREF: sub_404274+39p push ebx xor ebx, ebx push 0 ; nTypeFlag call GetKeyboardType ; GetKeyboardType cmp eax, 7 jnz short loc_40328F push 1 ; nTypeFlag call GetKeyboardType ; GetKeyboardType and eax, 0FF00h cmp eax, 0D00h jz short loc_40328D cmp eax, 400h jnz short loc_40328F loc_40328D: ; CODE XREF: sub_403264+20j mov bl, 1 loc_40328F: ; CODE XREF: sub_403264+Dj ; sub_403264+27j mov eax, ebx pop ebx retn sub_403264 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403294 proc near ; CODE XREF: sub_404274+42p cbData = dword ptr -0Ch Data = byte ptr -8 hKey = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF4h movzx eax, ds:word_407010 mov dword ptr [ebp+Data], eax lea eax, [ebp+hKey] push eax ; phkResult push 1 ; samDesired push 0 ; ulOptions push offset SubKey ; "SOFTWARE\\Borland\\Delphi\\RTL" push 80000002h ; hKey call RegOpenKeyExA ; RegOpenKeyExA test eax, eax jnz short loc_40330C xor eax, eax push ebp push offset loc_403305 push dword ptr fs:[eax] mov fs:[eax], esp mov [ebp+cbData], 4 lea eax, [ebp+cbData] push eax ; lpcbData lea eax, [ebp+Data] push eax ; lpData push 0 ; lpType push 0 ; lpReserved push offset ValueName ; "FPUMaskValue" mov eax, [ebp+hKey] push eax ; hKey call RegQueryValueExA ; RegQueryValueExA xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_40330C loc_4032FB: ; CODE XREF: sub_403294+76j mov eax, [ebp+hKey] push eax ; hKey call RegCloseKey ; RegCloseKey retn ; --------------------------------------------------------------------------- loc_403305: ; DATA XREF: sub_403294+2Eo jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_4032FB ; --------------------------------------------------------------------------- loc_40330C: ; CODE XREF: sub_403294+29j ; sub_403294+70j ; DATA XREF: ... mov ax, ds:word_407010 and ax, 0FFC0h mov dx, word ptr [ebp+Data] and dx, 3Fh or ax, dx mov ds:word_407010, ax mov esp, ebp pop ebp retn sub_403294 endp ; --------------------------------------------------------------------------- align 4 ; char SubKey[] SubKey db 'SOFTWARE\Borland\Delphi\RTL',0 ; DATA XREF: sub_403294+18o ; char ValueName[] ValueName db 'FPUMaskValue',0 ; DATA XREF: sub_403294+4Co align 4 ; =============== S U B R O U T I N E ======================================= sub_403358 proc near ; CODE XREF: sub_4037E8-368p ; CODE:0040372Ep ... fninit wait fldcw ds:word_407010 retn sub_403358 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403364 proc near ; CODE XREF: CODE:0040357Fj ; sub_4035C4+30p ... test eax, eax jz short locret_40336F mov dl, 1 mov ecx, [eax] call dword ptr [ecx-4] locret_40336F: ; CODE XREF: sub_403364+2j retn sub_403364 endp ; =============== S U B R O U T I N E ======================================= sub_403370 proc near ; CODE XREF: sub_4035C4+35p cmp ds:byte_407014, 1 jbe short locret_40338A push 0 push 0 push 0 push 0EEDFADFh call ds:dword_408010 locret_40338A: ; CODE XREF: sub_403370+7j retn sub_403370 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40338C proc near ; CODE XREF: sub_4037E8-33Bp cmp ds:byte_407014, 0 jz short locret_4033AC push eax push eax push edx push esp push 2 push 0 push 0EEDFAE4h call ds:dword_408010 add esp, 8 pop eax locret_4033AC: ; CODE XREF: sub_40338C+7j retn sub_40338C endp ; --------------------------------------------------------------------------- align 10h ; START OF FUNCTION CHUNK FOR sub_4033C8 loc_4033B0: ; CODE XREF: sub_4033C8+Bj push esp push 1 push 0 push 0EEDFAE0h call ds:dword_408010 add esp, 4 pop eax retn ; END OF FUNCTION CHUNK FOR sub_4033C8 ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4033C8 proc near ; CODE XREF: sub_4037E8-28Bp ; FUNCTION CHUNK AT 004033B0 SIZE 00000015 BYTES cmp ds:byte_407014, 1 jbe short locret_4033D8 push eax push ebx jmp loc_4033B0 ; --------------------------------------------------------------------------- locret_4033D8: ; CODE XREF: sub_4033C8+7j retn sub_4033C8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4033DC proc near ; CODE XREF: sub_4033FC+Cp test ecx, ecx jz short locret_4033F9 mov eax, [ecx+1] cmp byte ptr [ecx], 0E9h jz short loc_4033F4 cmp byte ptr [ecx], 0EBh jnz short locret_4033F9 movsx eax, al inc ecx inc ecx jmp short loc_4033F7 ; --------------------------------------------------------------------------- loc_4033F4: ; CODE XREF: sub_4033DC+Aj add ecx, 5 loc_4033F7: ; CODE XREF: sub_4033DC+16j add ecx, eax locret_4033F9: ; CODE XREF: sub_4033DC+2j ; sub_4033DC+Fj retn sub_4033DC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4033FC proc near ; CODE XREF: sub_40195C+1C55p cmp ds:byte_407014, 1 jbe short locret_403422 push eax push edx push ecx call sub_4033DC push ecx push esp push 1 push 0 push 0EEDFAE1h call ds:dword_408010 pop ecx pop ecx pop edx pop eax locret_403422: ; CODE XREF: sub_4033FC+7j retn sub_4033FC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403424 proc near ; CODE XREF: sub_403618+28p cmp ds:byte_407014, 1 jbe short locret_40343F push edx push esp push 1 push 0 push 0EEDFAE2h call ds:dword_408010 pop edx locret_40343F: ; CODE XREF: sub_403424+7j retn sub_403424 endp ; =============== S U B R O U T I N E ======================================= sub_403440 proc near ; CODE XREF: CODE:loc_403775p push eax push edx cmp ds:byte_407014, 1 jbe short loc_40345B push esp push 2 push 0 push 0EEDFAE3h call ds:dword_408010 loc_40345B: ; CODE XREF: sub_403440+9j pop edx pop eax retn sub_403440 endp ; --------------------------------------------------------------------------- align 10h ; START OF FUNCTION CHUNK FOR sub_4037E8 loc_403460: ; CODE XREF: sub_4037E8:loc_40383Dj ; sub_403858:loc_4038ADj ... mov eax, [esp-4+ExceptionInfo.ExceptionRecord] test dword ptr [eax+4], 6 jnz loc_403584 cmp dword ptr [eax], 0EEDFADEh mov edx, [eax+18h] mov ecx, [eax+14h] jz short loc_4034ED cld call sub_403358 mov edx, ds:dword_40800C test edx, edx jz loc_403584 call edx ; dword_40800C test eax, eax jz loc_403584 mov edx, [esp-4+arg_8] mov ecx, [esp-4+ExceptionInfo.ExceptionRecord] cmp dword ptr [ecx], 0EEFFACEh jz short loc_4034E4 call sub_40338C cmp ds:byte_407018, 0 jbe short loc_4034E4 cmp ds:byte_407014, 0 ja short loc_4034E4 lea ecx, [esp-4+ExceptionInfo] push eax push ecx ; ExceptionInfo call UnhandledExceptionFilter ; UnhandledExceptionFilter cmp eax, 0 pop eax jz loc_403584 mov edx, eax mov eax, [esp-4+ExceptionInfo.ExceptionRecord] mov ecx, [eax+0Ch] jmp short loc_403514 ; --------------------------------------------------------------------------- loc_4034E4: ; CODE XREF: sub_4037E8-33Dj ; sub_4037E8-32Fj ... mov edx, eax mov eax, [esp-4+ExceptionInfo.ExceptionRecord] mov ecx, [eax+0Ch] loc_4034ED: ; CODE XREF: sub_4037E8-36Bj cmp ds:byte_407018, 1 jbe short loc_403514 cmp ds:byte_407014, 0 ja short loc_403514 push eax lea eax, [esp+ExceptionInfo] push edx push ecx push eax ; ExceptionInfo call UnhandledExceptionFilter ; UnhandledExceptionFilter cmp eax, 0 pop ecx pop edx pop eax jz short loc_403584 loc_403514: ; CODE XREF: sub_4037E8-306j ; sub_4037E8-2F4j ... or dword ptr [eax+4], 2 push ebx xor ebx, ebx push esi push edi push ebp mov ebx, fs:[ebx] push ebx push eax push edx push ecx mov edx, [esp+1Ch+ExceptionInfo.ContextRecord] push 0 push eax push offset loc_403538 push edx call ds:dword_408014 loc_403538: ; DATA XREF: sub_4037E8-2BCo mov edi, [esp+2Ch+var_4] call sub_4043D8 push dword ptr [eax+0] mov [eax+0], esp mov ebp, [edi+8] mov ebx, [edi+4] mov dword ptr [edi+4], offset sub_403564 add ebx, 5 call sub_4033C8 jmp ebx ; END OF FUNCTION CHUNK FOR sub_4037E8 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403564 proc near ; DATA XREF: sub_4037E8-295o jmp loc_40358C sub_403564 endp ; --------------------------------------------------------------------------- call sub_4043D8 mov ecx, [eax+0] mov edx, [ecx] mov [eax+0], edx mov eax, [ecx+8] jmp sub_403364 ; --------------------------------------------------------------------------- ; START OF FUNCTION CHUNK FOR sub_4037E8 loc_403584: ; CODE XREF: sub_4037E8-37Dj ; sub_4037E8-35Bj ... mov eax, 1 retn ; END OF FUNCTION CHUNK FOR sub_4037E8 ; --------------------------------------------------------------------------- align 4 ; START OF FUNCTION CHUNK FOR sub_40195C loc_40358C: ; CODE XREF: sub_40195C:loc_401A24j ; sub_401A34:loc_401B28j ... mov eax, [esp+4] mov edx, [esp+8] test dword ptr [eax+4], 6 jz short loc_4035BC mov ecx, [edx+4] mov dword ptr [edx+4], offset loc_4035BC push ebx push esi push edi push ebp mov ebp, [edx+8] add ecx, 5 call sub_4033FC call ecx pop ebp pop edi pop esi pop ebx loc_4035BC: ; CODE XREF: sub_40195C+1C3Fj ; DATA XREF: sub_40195C+1C44o mov eax, 1 retn ; END OF FUNCTION CHUNK FOR sub_40195C ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4035C4 proc near ; CODE XREF: sub_4037E8+5Fp ; sub_403858+5Fp arg_2C = dword ptr 30h mov eax, [esp+arg_2C] mov dword ptr [eax+4], offset loc_40360F call sub_4043D8 mov edx, [eax+0] mov ecx, [edx] mov [eax+0], ecx mov eax, [edx+0Ch] and dword ptr [eax+4], 0FFFFFFFDh cmp dword ptr [eax], 0EEDFADEh jz short loc_4035FE mov eax, [edx+8] call sub_403364 call sub_403370 loc_4035FE: ; CODE XREF: sub_4035C4+2Bj xor eax, eax add esp, 14h mov edx, fs:[eax] pop ecx mov edx, [edx] mov [ecx], edx pop ebp pop edi pop esi pop ebx loc_40360F: ; DATA XREF: sub_4035C4+4o mov eax, 1 retn sub_4035C4 endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403618 proc near ; CODE XREF: sub_4037E8+64p ; sub_403858+64p ... arg_2C = dword ptr 30h call sub_4043D8 mov edx, [eax+0] mov ecx, [edx] mov [eax+0], ecx mov eax, [edx+8] call sub_403364 pop edx mov esp, [esp-4+arg_2C] xor eax, eax pop ecx mov fs:[eax], ecx pop eax pop ebp call sub_403424 jmp edx sub_403618 endp ; sp-analysis failed ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_403648 proc near ; CODE XREF: sub_4021B8+10Cp ; sub_4021B8+16Ap ... arg_0 = dword ptr 4 arg_4 = dword ptr 8 xor edx, edx mov ecx, [esp+arg_4] mov eax, [esp+arg_0] add ecx, 5 mov fs:[edx], eax call ecx retn 0Ch sub_403648 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 10h loc_403660: ; CODE XREF: CODE:00403760j ; CODE:0040376Cj push ebp mov ebp, esp mov edx, [ebp+8] mov eax, [edx] cmp eax, 0C0000092h jg short loc_40369B jz short loc_4036CD cmp eax, 0C000008Eh jg short loc_40368D jz short loc_4036D1 sub eax, 0C0000005h jz short loc_4036DD sub eax, 87h jz short loc_4036C5 dec eax jz short loc_4036D9 jmp short loc_4036ED ; --------------------------------------------------------------------------- loc_40368D: ; CODE XREF: CODE:00403676j add eax, 3FFFFF71h sub eax, 2 jb short loc_4036CD jz short loc_4036C9 jmp short loc_4036ED ; --------------------------------------------------------------------------- loc_40369B: ; CODE XREF: CODE:0040366Dj cmp eax, 0C0000096h jg short loc_4036B3 jz short loc_4036E1 sub eax, 0C0000093h jz short loc_4036D9 dec eax jz short loc_4036C1 dec eax jz short loc_4036D5 jmp short loc_4036ED ; --------------------------------------------------------------------------- loc_4036B3: ; CODE XREF: CODE:004036A0j sub eax, 0C00000FDh jz short loc_4036E9 sub eax, 3Dh jz short loc_4036E5 jmp short loc_4036ED ; --------------------------------------------------------------------------- loc_4036C1: ; CODE XREF: CODE:004036ACj mov al, 0C8h jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036C5: ; CODE XREF: CODE:00403686j mov al, 0C9h jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036C9: ; CODE XREF: CODE:00403697j mov al, 0CDh jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036CD: ; CODE XREF: CODE:0040366Fj ; CODE:00403695j mov al, 0CFh jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036D1: ; CODE XREF: CODE:00403678j mov al, 0C8h jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036D5: ; CODE XREF: CODE:004036AFj mov al, 0D7h jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036D9: ; CODE XREF: CODE:00403689j ; CODE:004036A9j mov al, 0CEh jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036DD: ; CODE XREF: CODE:0040367Fj mov al, 0D8h jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036E1: ; CODE XREF: CODE:004036A2j mov al, 0DAh jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036E5: ; CODE XREF: CODE:004036BDj mov al, 0D9h jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036E9: ; CODE XREF: CODE:004036B8j mov al, 0CAh jmp short loc_4036EF ; --------------------------------------------------------------------------- loc_4036ED: ; CODE XREF: CODE:0040368Bj ; CODE:00403699j ... mov al, 0FFh loc_4036EF: ; CODE XREF: CODE:004036C3j ; CODE:004036C7j ... and eax, 0FFh mov edx, [edx+0Ch] call sub_4028AC ; --------------------------------------------------------------------------- pop ebp retn 4 ; --------------------------------------------------------------------------- loc_403700: ; DATA XREF: sub_4037A0+Do mov eax, [esp+4] test dword ptr [eax+4], 6 jnz loc_40379A cmp ds:byte_407014, 0 ja short loc_403729 lea eax, [esp+4] push eax call UnhandledExceptionFilter ; UnhandledExceptionFilter cmp eax, 0 jz short loc_40379A loc_403729: ; CODE XREF: CODE:00403718j mov eax, [esp+4] cld call sub_403358 mov edx, [esp+8] push 0 push eax push offset loc_403746 push edx call ds:dword_408014 loc_403746: ; DATA XREF: CODE:0040373Ao mov ebx, [esp+4] cmp dword ptr [ebx], 0EEDFADEh mov edx, [ebx+14h] mov eax, [ebx+18h] jz short loc_403775 mov edx, ds:dword_40800C test edx, edx jz loc_403660 mov eax, ebx call edx ; dword_40800C test eax, eax jz loc_403660 mov edx, [ebx+0Ch] loc_403775: ; CODE XREF: CODE:00403756j call sub_403440 mov ecx, ds:dword_408004 test ecx, ecx jz short loc_403786 call ecx ; dword_408004 loc_403786: ; CODE XREF: CODE:00403782j mov ecx, [esp+4] mov eax, 0D9h mov edx, [ecx+14h] mov [esp], edx jmp sub_403B0C ; --------------------------------------------------------------------------- loc_40379A: ; CODE XREF: CODE:0040370Bj ; CODE:00403727j xor eax, eax retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4037A0 proc near ; CODE XREF: sub_4038C8+2Ep xor edx, edx lea eax, [ebp-0Ch] mov ecx, fs:[edx] mov fs:[edx], eax mov [eax], ecx mov dword ptr [eax+4], offset loc_403700 mov [eax+8], ebp mov ds:dword_408624, eax retn sub_4037A0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4037C0 proc near ; CODE XREF: sub_403A20:loc_403AB0p xor edx, edx mov eax, ds:dword_408624 test eax, eax jz short locret_4037E7 mov ecx, fs:[edx] cmp eax, ecx jnz short loc_4037DA mov eax, [eax] mov fs:[edx], eax retn ; --------------------------------------------------------------------------- loc_4037D8: ; CODE XREF: sub_4037C0+21j mov ecx, [ecx] loc_4037DA: ; CODE XREF: sub_4037C0+10j cmp ecx, 0FFFFFFFFh jz short locret_4037E7 cmp [ecx], eax jnz short loc_4037D8 mov eax, [eax] mov [ecx], eax locret_4037E7: ; CODE XREF: sub_4037C0+9j ; sub_4037C0+1Dj retn sub_4037C0 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __cdecl sub_4037E8(struct _EXCEPTION_POINTERS ExceptionInfo, int) sub_4037E8 proc near ; CODE XREF: sub_4037E8+5Ap ; sub_403858+5Ap ... var_8 = dword ptr -8 var_4 = dword ptr -4 ExceptionInfo = _EXCEPTION_POINTERS ptr 8 arg_8 = dword ptr 10h ; FUNCTION CHUNK AT 00403460 SIZE 00000104 BYTES ; FUNCTION CHUNK AT 00403584 SIZE 00000006 BYTES push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx push esi push edi mov esi, offset dword_408620 mov eax, [esi+8] test eax, eax jz short loc_403851 mov ebx, [esi+0Ch] mov eax, [eax+4] mov [ebp+var_4], eax xor eax, eax push ebp push offset loc_40383D push dword ptr fs:[eax] mov fs:[eax], esp test ebx, ebx jle short loc_403833 loc_403818: ; CODE XREF: sub_4037E8+49j dec ebx mov [esi+0Ch], ebx mov eax, [ebp+var_4] mov eax, [eax+ebx*8+4] mov [ebp+var_8], eax cmp [ebp+var_8], 0 jz short loc_40382F call [ebp+var_8] loc_40382F: ; CODE XREF: sub_4037E8+42j test ebx, ebx jg short loc_403818 loc_403833: ; CODE XREF: sub_4037E8+2Ej xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx jmp short loc_403851 ; --------------------------------------------------------------------------- loc_40383D: ; DATA XREF: sub_4037E8+21o jmp loc_403460 ; --------------------------------------------------------------------------- call sub_4037E8 call sub_4035C4 call sub_403618 loc_403851: ; CODE XREF: sub_4037E8+13j ; sub_4037E8+53j pop edi pop esi pop ebx pop ecx pop ecx pop ebp retn sub_4037E8 endp ; sp-analysis failed ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_403858 proc near ; CODE XREF: sub_4038C8+3Ap var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx push esi push edi mov edi, offset dword_408620 mov eax, [edi+8] test eax, eax jz short loc_4038C1 mov esi, [eax] xor ebx, ebx mov eax, [eax+4] mov [ebp+var_4], eax xor eax, eax push ebp push offset loc_4038AD push dword ptr fs:[eax] mov fs:[eax], esp cmp esi, ebx jle short loc_4038A3 loc_403889: ; CODE XREF: sub_403858+49j mov eax, [ebp+var_4] mov eax, [eax+ebx*8] mov [ebp+var_8], eax inc ebx mov [edi+0Ch], ebx cmp [ebp+var_8], 0 jz short loc_40389F call [ebp+var_8] loc_40389F: ; CODE XREF: sub_403858+42j cmp esi, ebx jg short loc_403889 loc_4038A3: ; CODE XREF: sub_403858+2Fj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx jmp short loc_4038C1 ; --------------------------------------------------------------------------- loc_4038AD: ; DATA XREF: sub_403858+22o jmp loc_403460 ; --------------------------------------------------------------------------- call sub_4037E8 call sub_4035C4 call sub_403618 loc_4038C1: ; CODE XREF: sub_403858+13j ; sub_403858+53j pop edi pop esi pop ebx pop ecx pop ecx pop ebp retn sub_403858 endp ; =============== S U B R O U T I N E ======================================= sub_4038C8 proc near ; CODE XREF: sub_404424+3Ap mov ds:dword_408010, offset RaiseException mov ds:dword_408014, offset RtlUnwind mov ds:dword_408628, eax xor eax, eax mov ds:dword_40862C, eax mov ds:dword_408630, edx mov eax, [edx+4] mov ds:dword_40801C, eax call sub_4037A0 mov ds:byte_408024, 0 call sub_403858 retn sub_4038C8 endp ; =============== S U B R O U T I N E ======================================= sub_403908 proc near ; CODE XREF: sub_403A20+34p push ebx push esi push edi mov esi, offset Text ; "Runtime error at 00000000" mov cl, 10h mov ebx, ds:uExitCode loc_403918: ; CODE XREF: sub_403908+33j mov eax, ebx mov edi, 0Ah cdq idiv edi add dl, 30h xor eax, eax mov al, cl mov [esi+eax], dl mov eax, ebx mov ebx, 0Ah cdq idiv ebx mov ebx, eax dec ecx test ebx, ebx jnz short loc_403918 mov cl, 1Ch mov eax, ds:dword_407004 loc_403944: ; CODE XREF: sub_403908+54j mov edx, eax and edx, 0Fh mov dl, ds:byte_40709C[edx] xor ebx, ebx mov bl, cl mov [esi+ebx], dl shr eax, 4 dec ecx test eax, eax jnz short loc_403944 pop edi pop esi pop ebx retn sub_403908 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403964 proc near ; CODE XREF: sub_403A20+A4p xor eax, eax xchg eax, ds:uExitCode neg eax sbb eax, eax inc eax mov edi, offset dword_408620 mov ebx, [edi+18h] mov ebp, [edi+14h] push dword ptr [edi+1Ch] push dword ptr [edi+20h] mov esi, [edi] mov ecx, 0Bh rep movsd pop edi pop esi leave retn 0Ch sub_403964 endp ; sp-analysis failed ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403994 proc near ; CODE XREF: sub_403A20+39p NumberOfBytesWritten= dword ptr -4 push ecx cmp ds:byte_408034, 0 jz short loc_4039F5 cmp ds:word_408208, 0D7B2h jnz short loc_4039BD cmp ds:dword_408210, 0 jbe short loc_4039BD mov eax, offset dword_408204 call ds:dword_408220 loc_4039BD: ; CODE XREF: sub_403994+13j ; sub_403994+1Cj push 0 ; lpOverlapped lea eax, [esp+8+NumberOfBytesWritten] push eax ; lpNumberOfBytesWritten push 1Eh ; nNumberOfBytesToWrite push offset Text ; "Runtime error at 00000000" push 0FFFFFFF5h ; nStdHandle call GetStdHandle ; GetStdHandle push eax ; hFile call WriteFile ; WriteFile push 0 ; lpOverlapped lea eax, [esp+8+NumberOfBytesWritten] push eax ; lpNumberOfBytesWritten push 2 ; nNumberOfBytesToWrite push offset dword_403A1C ; lpBuffer push 0FFFFFFF5h ; nStdHandle call GetStdHandle ; GetStdHandle push eax ; hFile call WriteFile ; WriteFile pop edx retn ; --------------------------------------------------------------------------- loc_4039F5: ; CODE XREF: sub_403994+8j cmp ds:byte_40701C, 0 jnz short loc_403A11 push 0 ; uType push offset Caption ; "Error" push offset Text ; "Runtime error at 00000000" push 0 ; hWnd call MessageBoxA ; MessageBoxA loc_403A11: ; CODE XREF: sub_403994+68j pop edx retn sub_403994 endp ; --------------------------------------------------------------------------- align 4 dd 0FFFFFFFFh, 2 dword_403A1C dd 0A0Dh ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn ; int __fastcall sub_403A20(struct _EXCEPTION_POINTERS ExceptionInfo) sub_403A20 proc near ; CODE XREF: sub_403B00+5p ; sub_405074+1724p var_14 = dword ptr -14h ExceptionInfo = _EXCEPTION_POINTERS ptr 4 push ebx push esi push edi push ebp push ecx ; ExceptionInfo mov ebx, offset dword_408620 mov esi, offset dword_408030 cmp byte ptr [ebx+28h], 0 jnz short loc_403A4B cmp dword ptr [esi], 0 jz short loc_403A4B loc_403A3A: ; CODE XREF: sub_403A20+29j mov eax, [esi] mov [esp+14h+var_14], eax xor eax, eax mov [esi], eax call [esp+14h+var_14] cmp dword ptr [esi], 0 jnz short loc_403A3A loc_403A4B: ; CODE XREF: sub_403A20+13j ; sub_403A20+18j cmp ds:dword_407004, 0 jz short loc_403A65 call sub_403908 call sub_403994 xor eax, eax mov ds:dword_407004, eax loc_403A65: ; CODE XREF: sub_403A20+32j ; sub_403A20+D5j cmp byte ptr [ebx+28h], 2 jnz short loc_403A79 cmp ds:uExitCode, 0 jnz short loc_403A79 xor eax, eax mov [ebx+0Ch], eax loc_403A79: ; CODE XREF: sub_403A20+49j ; sub_403A20+52j call sub_4037E8 cmp byte ptr [ebx+28h], 1 jbe short loc_403A8D cmp ds:uExitCode, 0 jz short loc_403AB0 loc_403A8D: ; CODE XREF: sub_403A20+62j mov edi, [ebx+10h] test edi, edi jz short loc_403AB0 mov eax, edi call sub_404128 mov ebp, [ebx+10h] mov esi, [ebp+10h] cmp esi, [ebp+4] jz short loc_403AB0 test esi, esi jz short loc_403AB0 push esi ; hLibModule call FreeLibrary ; FreeLibrary loc_403AB0: ; CODE XREF: sub_403A20+6Bj ; sub_403A20+72j ... call sub_4037C0 cmp byte ptr [ebx+28h], 1 jnz short loc_403ABE call dword ptr [ebx+24h] loc_403ABE: ; CODE XREF: sub_403A20+99j cmp byte ptr [ebx+28h], 0 jz short loc_403AC9 call sub_403964 loc_403AC9: ; CODE XREF: sub_403A20+A2j cmp dword ptr [ebx], 0 jnz short loc_403AE8 cmp ds:dword_408018, 0 jz short loc_403ADD call ds:dword_408018 loc_403ADD: ; CODE XREF: sub_403A20+B5j mov eax, ds:uExitCode push eax ; uExitCode call ExitProcess ; ExitProcess ; --------------------------------------------------------------------------- loc_403AE8: ; CODE XREF: sub_403A20+ACj mov eax, [ebx] mov esi, eax mov edi, ebx mov ecx, 0Bh rep movsd jmp loc_403A65 sub_403A20 endp ; sp-analysis failed ; --------------------------------------------------------------------------- pop edx pop ebp pop edi pop esi pop ebx retn ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_403B00 proc near ; CODE XREF: sub_4028AC+6p ; sub_403B0C+6j mov ds:uExitCode, eax call sub_403A20 sub_403B00 endp ; sp-analysis failed ; --------------------------------------------------------------------------- db 0C3h ; ц align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_403B0C proc near ; CODE XREF: CODE:00403795j ; sub_404388+1Bp ... pop ds:dword_407004 jmp sub_403B00 sub_403B0C endp ; sp-analysis failed ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_403B18 proc near ; CODE XREF: sub_402B10+Ep ; sub_403BDC+23p ... mov edx, [eax] test edx, edx jz short locret_403B3A mov dword ptr [eax], 0 mov ecx, [edx-8] dec ecx jl short locret_403B3A lock dec dword ptr [edx-8] jnz short locret_403B3A push eax lea eax, [edx-8] call sub_40283C pop eax locret_403B3A: ; CODE XREF: sub_403B18+4j ; sub_403B18+10j ... retn sub_403B18 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403B3C proc near ; CODE XREF: sub_4045B8+77p ; sub_40476C+18Dp ... push ebx push esi mov ebx, eax mov esi, edx loc_403B42: ; CODE XREF: sub_403B3C+2Aj mov edx, [ebx] test edx, edx jz short loc_403B62 mov dword ptr [ebx], 0 mov ecx, [edx-8] dec ecx jl short loc_403B62 lock dec dword ptr [edx-8] jnz short loc_403B62 lea eax, [edx-8] call sub_40283C loc_403B62: ; CODE XREF: sub_403B3C+Aj ; sub_403B3C+16j ... add ebx, 4 dec esi jnz short loc_403B42 pop esi pop ebx retn sub_403B3C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403B6C proc near ; CODE XREF: sub_403C94+8j ; sub_403CD8+6j ... test edx, edx jz short loc_403B94 mov ecx, [edx-8] inc ecx jg short loc_403B90 push eax push edx mov eax, [edx-4] call sub_403BB0 mov edx, eax pop eax push edx mov ecx, [eax-4] call sub_40296C pop edx pop eax jmp short loc_403B94 ; --------------------------------------------------------------------------- loc_403B90: ; CODE XREF: sub_403B6C+8j lock inc dword ptr [edx-8] loc_403B94: ; CODE XREF: sub_403B6C+2j ; sub_403B6C+22j xchg edx, [eax] test edx, edx jz short locret_403BAE mov ecx, [edx-8] dec ecx jl short locret_403BAE lock dec dword ptr [edx-8] jnz short locret_403BAE lea eax, [edx-8] call sub_40283C locret_403BAE: ; CODE XREF: sub_403B6C+2Cj ; sub_403B6C+32j ... retn sub_403B6C endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_403BB0 proc near ; CODE XREF: sub_403B6C+Fp ; sub_403BDC+Bp ... test eax, eax jle short loc_403BD8 push eax add eax, 0Ah and eax, 0FFFFFFFEh push eax call sub_40280C pop edx mov word ptr [edx+eax-2], 0 add eax, 8 pop edx mov [eax-4], edx mov dword ptr [eax-8], 1 retn ; --------------------------------------------------------------------------- loc_403BD8: ; CODE XREF: sub_403BB0+2j xor eax, eax retn sub_403BB0 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403BDC proc near ; CODE XREF: sub_402B10+30p ; sub_403C28+8p ... push ebx push esi push edi mov ebx, eax mov esi, edx mov edi, ecx mov eax, edi call sub_403BB0 mov ecx, edi mov edi, eax test esi, esi jz short loc_403BFD mov edx, eax mov eax, esi call sub_40296C loc_403BFD: ; CODE XREF: sub_403BDC+16j mov eax, ebx call sub_403B18 mov [ebx], edi pop edi pop esi pop ebx retn sub_403BDC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame ; int __fastcall sub_403C0C(LPCSTR lpMultiByteStr, int cchWideChar, int cbMultiByte) sub_403C0C proc near ; CODE XREF: sub_403F90+3Bp ; sub_403F90+69p cbMultiByte = dword ptr 8 push ebp mov ebp, esp push edx ; cchWideChar push eax ; lpWideCharStr mov eax, [ebp+cbMultiByte] push eax ; cbMultiByte push ecx ; lpMultiByteStr push 0 ; dwFlags mov eax, ds:CodePage push eax ; CodePage call MultiByteToWideChar ; MultiByteToWideChar pop ebp retn 4 sub_403C0C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403C28 proc near ; CODE XREF: sub_4045B8+3Fp ; sub_40476C+130p ... push edx mov edx, esp mov ecx, 1 call sub_403BDC pop edx retn sub_403C28 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403C38 proc near ; CODE XREF: sub_405074+9EBp ; sub_405074+AA0p ... xor ecx, ecx test edx, edx jz short loc_403C5F push edx loc_403C3F: ; CODE XREF: sub_403C38+1Dj cmp cl, [edx] jz short loc_403C5A cmp cl, [edx+1] jz short loc_403C59 cmp cl, [edx+2] jz short loc_403C58 cmp cl, [edx+3] jz short loc_403C57 add edx, 4 jmp short loc_403C3F ; --------------------------------------------------------------------------- loc_403C57: ; CODE XREF: sub_403C38+18j inc edx loc_403C58: ; CODE XREF: sub_403C38+13j inc edx loc_403C59: ; CODE XREF: sub_403C38+Ej inc edx loc_403C5A: ; CODE XREF: sub_403C38+9j mov ecx, edx pop edx sub ecx, edx loc_403C5F: ; CODE XREF: sub_403C38+4j jmp sub_403BDC sub_403C38 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403C68 proc near ; CODE XREF: sub_404924+28p xor ecx, ecx mov cl, [edx] inc edx jmp sub_403BDC sub_403C68 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403C74 proc near ; CODE XREF: sub_4041AC+36p ; sub_404ED8+7Bp push edi push eax push ecx mov edi, edx xor eax, eax repne scasb jnz short loc_403C81 not ecx loc_403C81: ; CODE XREF: sub_403C74+9j pop eax add ecx, eax pop eax pop edi jmp sub_403BDC sub_403C74 endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_403C8C proc near ; CODE XREF: sub_402E3C+3Ep ; sub_402E3C+56p ... test eax, eax jz short locret_403C93 mov eax, [eax-4] locret_403C93: ; CODE XREF: sub_403C8C+2j retn sub_403C8C endp ; =============== S U B R O U T I N E ======================================= sub_403C94 proc near ; CODE XREF: sub_403CD8+1Dj ; sub_403CD8+6Ej ... test edx, edx jz short locret_403CD7 mov ecx, [eax] test ecx, ecx jz sub_403B6C push ebx push esi push edi mov ebx, eax mov esi, edx mov edi, [ecx-4] mov edx, [esi-4] add edx, edi cmp esi, ecx jz short loc_403CCC call sub_403EE4 mov eax, esi mov ecx, [esi-4] loc_403CBF: ; CODE XREF: sub_403C94+41j mov edx, [ebx] add edx, edi call sub_40296C pop edi pop esi pop ebx retn ; --------------------------------------------------------------------------- loc_403CCC: ; CODE XREF: sub_403C94+1Fj call sub_403EE4 mov eax, [ebx] mov ecx, edi jmp short loc_403CBF ; --------------------------------------------------------------------------- locret_403CD7: ; CODE XREF: sub_403C94+2j retn sub_403C94 endp ; =============== S U B R O U T I N E ======================================= sub_403CD8 proc near ; CODE XREF: sub_405074+B3Ap ; sub_405074+BB1p ... test edx, edx jz short loc_403D3D test ecx, ecx jz sub_403B6C cmp edx, [eax] jz short loc_403D44 cmp ecx, [eax] jz short loc_403CFA push eax push ecx call sub_403B6C pop edx pop eax jmp sub_403C94 ; --------------------------------------------------------------------------- loc_403CFA: ; CODE XREF: sub_403CD8+12j push ebx push esi push edi mov ebx, edx mov esi, ecx push eax mov eax, [ebx-4] add eax, [esi-4] call sub_403BB0 mov edi, eax mov edx, eax mov eax, ebx mov ecx, [ebx-4] call sub_40296C mov edx, edi mov eax, esi mov ecx, [esi-4] add edx, [ebx-4] call sub_40296C pop eax mov edx, edi test edi, edi jz short loc_403D34 dec dword ptr [edi-8] loc_403D34: ; CODE XREF: sub_403CD8+57j call sub_403B6C pop edi pop esi pop ebx retn ; --------------------------------------------------------------------------- loc_403D3D: ; CODE XREF: sub_403CD8+2j mov edx, ecx jmp sub_403B6C ; --------------------------------------------------------------------------- loc_403D44: ; CODE XREF: sub_403CD8+Ej mov edx, ecx jmp sub_403C94 sub_403CD8 endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_403D4C proc near ; CODE XREF: sub_405074+D8Cp ; sub_405074+E31p ... var_14 = dword ptr -14h push ebx push esi push edi push edx push eax mov ebx, edx xor edi, edi mov ecx, [esp+edx*4+14h] test ecx, ecx jz short loc_403D69 cmp [eax], ecx jnz short loc_403D69 mov edi, ecx mov eax, [ecx-4] dec edx jmp short loc_403D6B ; --------------------------------------------------------------------------- loc_403D69: ; CODE XREF: sub_403D4C+Fj ; sub_403D4C+13j xor eax, eax loc_403D6B: ; CODE XREF: sub_403D4C+1Bj ; sub_403D4C+31j mov ecx, [esp+edx*4+14h] test ecx, ecx jz short loc_403D7C add eax, [ecx-4] cmp edi, ecx jnz short loc_403D7C xor edi, edi loc_403D7C: ; CODE XREF: sub_403D4C+25j ; sub_403D4C+2Cj dec edx jnz short loc_403D6B test edi, edi jz short loc_403D9A mov edx, eax mov eax, [esp+14h+var_14] mov esi, [edi-4] call sub_403EE4 mov edi, [esp+14h+var_14] push dword ptr [edi] add esi, [edi] dec ebx jmp short loc_403DA2 ; --------------------------------------------------------------------------- loc_403D9A: ; CODE XREF: sub_403D4C+35j call sub_403BB0 push eax mov esi, eax loc_403DA2: ; CODE XREF: sub_403D4C+4Cj ; sub_403D4C+6Bj mov eax, [esp+ebx*4+18h] mov edx, esi test eax, eax jz short loc_403DB6 mov ecx, [eax-4] add esi, ecx call sub_40296C loc_403DB6: ; CODE XREF: sub_403D4C+5Ej dec ebx jnz short loc_403DA2 pop edx pop eax test edi, edi jnz short loc_403DCB test edx, edx jz short loc_403DC6 dec dword ptr [edx-8] loc_403DC6: ; CODE XREF: sub_403D4C+75j call sub_403B6C loc_403DCB: ; CODE XREF: sub_403D4C+71j pop edx pop edi pop esi pop ebx pop eax lea esp, [esp+edx*4] jmp eax sub_403D4C endp ; sp-analysis failed ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403DD8 proc near ; CODE XREF: sub_405074+D04p ; sub_405074+E8Dp ... push ebx push esi push edi mov esi, eax mov edi, edx cmp eax, edx jz loc_403E76 test esi, esi jz short loc_403E53 test edi, edi jz short loc_403E5A mov eax, [esi-4] mov edx, [edi-4] sub eax, edx ja short loc_403DFB add edx, eax loc_403DFB: ; CODE XREF: sub_403DD8+1Fj push edx shr edx, 2 jz short loc_403E27 loc_403E01: ; CODE XREF: sub_403DD8+45j mov ecx, [esi] mov ebx, [edi] cmp ecx, ebx jnz short loc_403E61 dec edx jz short loc_403E21 mov ecx, [esi+4] mov ebx, [edi+4] cmp ecx, ebx jnz short loc_403E61 add esi, 8 add edi, 8 dec edx jnz short loc_403E01 jmp short loc_403E27 ; --------------------------------------------------------------------------- loc_403E21: ; CODE XREF: sub_403DD8+32j add esi, 4 add edi, 4 loc_403E27: ; CODE XREF: sub_403DD8+27j ; sub_403DD8+47j pop edx and edx, 3 jz short loc_403E4F mov ecx, [esi] mov ebx, [edi] cmp cl, bl jnz short loc_403E76 dec edx jz short loc_403E4F cmp ch, bh jnz short loc_403E76 dec edx jz short loc_403E4F and ebx, 0FF0000h and ecx, 0FF0000h cmp ecx, ebx jnz short loc_403E76 loc_403E4F: ; CODE XREF: sub_403DD8+53j ; sub_403DD8+5Ej ... add eax, eax jmp short loc_403E76 ; --------------------------------------------------------------------------- loc_403E53: ; CODE XREF: sub_403DD8+11j mov edx, [edi-4] sub eax, edx jmp short loc_403E76 ; --------------------------------------------------------------------------- loc_403E5A: ; CODE XREF: sub_403DD8+15j mov eax, [esi-4] sub eax, edx jmp short loc_403E76 ; --------------------------------------------------------------------------- loc_403E61: ; CODE XREF: sub_403DD8+2Fj ; sub_403DD8+3Cj pop edx cmp cl, bl jnz short loc_403E76 cmp ch, bh jnz short loc_403E76 shr ecx, 10h shr ebx, 10h cmp cl, bl jnz short loc_403E76 cmp ch, bh loc_403E76: ; CODE XREF: sub_403DD8+9j ; sub_403DD8+5Bj ... pop edi pop esi pop ebx retn sub_403DD8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403E7C proc near ; CODE XREF: sub_404658+Fp ; sub_40476C+20p ... test eax, eax jz short locret_403E8A mov edx, [eax-8] inc edx jle short locret_403E8A lock inc dword ptr [eax-8] locret_403E8A: ; CODE XREF: sub_403E7C+2j ; sub_403E7C+8j retn sub_403E7C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403E8C proc near ; CODE XREF: sub_402E3C+46p ; sub_404A60+7Ep ... test eax, eax jz short loc_403E92 retn ; --------------------------------------------------------------------------- byte_403E91 db 0 ; DATA XREF: sub_403E8C:loc_403E92o ; --------------------------------------------------------------------------- loc_403E92: ; CODE XREF: sub_403E8C+2j mov eax, offset byte_403E91 retn sub_403E8C endp ; =============== S U B R O U T I N E ======================================= sub_403E98 proc near ; CODE XREF: sub_403EDCj mov edx, [eax] test edx, edx jz short loc_403ED6 mov ecx, [edx-8] dec ecx jz short loc_403ED6 push ebx mov ebx, eax mov eax, [edx-4] call sub_403BB0 mov edx, eax mov eax, [ebx] mov [ebx], edx push eax mov ecx, [eax-4] call sub_40296C pop eax mov ecx, [eax-8] dec ecx jl short loc_403ED3 lock dec dword ptr [eax-8] jnz short loc_403ED3 lea eax, [eax-8] call sub_40283C loc_403ED3: ; CODE XREF: sub_403E98+2Bj ; sub_403E98+31j mov edx, [ebx] pop ebx loc_403ED6: ; CODE XREF: sub_403E98+4j ; sub_403E98+Aj mov eax, edx retn sub_403E98 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: thunk sub_403EDC proc near ; CODE XREF: sub_404658+34p ; sub_404658+6Ap ... jmp sub_403E98 sub_403EDC endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403EE4 proc near ; CODE XREF: sub_4029AC+B3p ; sub_403C94+21p ... push ebx push esi push edi mov ebx, eax mov esi, edx xor edi, edi test edx, edx jle short loc_403F39 mov eax, [ebx] test eax, eax jz short loc_403F1A cmp dword ptr [eax-8], 1 jnz short loc_403F1A sub eax, 8 add edx, 9 push eax mov eax, esp call sub_40285C pop eax add eax, 8 mov [ebx], eax mov [eax-4], esi mov byte ptr [esi+eax], 0 jmp short loc_403F42 ; --------------------------------------------------------------------------- loc_403F1A: ; CODE XREF: sub_403EE4+11j ; sub_403EE4+17j mov eax, edx call sub_403BB0 mov edi, eax mov eax, [ebx] test eax, eax jz short loc_403F39 mov edx, edi mov ecx, [eax-4] cmp ecx, esi jl short loc_403F34 mov ecx, esi loc_403F34: ; CODE XREF: sub_403EE4+4Cj call sub_40296C loc_403F39: ; CODE XREF: sub_403EE4+Bj ; sub_403EE4+43j mov eax, ebx call sub_403B18 mov [ebx], edi loc_403F42: ; CODE XREF: sub_403EE4+34j pop edi pop esi pop ebx retn sub_403EE4 endp ; --------------------------------------------------------------------------- align 4 ; START OF FUNCTION CHUNK FOR sub_403F50 loc_403F48: ; CODE XREF: sub_403F50+Ej ; sub_40401C+12j mov al, 1 jmp sub_402904 ; END OF FUNCTION CHUNK FOR sub_403F50 ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= sub_403F50 proc near ; CODE XREF: sub_40406C+12p ; FUNCTION CHUNK AT 00403F48 SIZE 00000007 BYTES test eax, eax jz short locret_403F64 push eax ; ui push 0 ; strIn call SysAllocStringLen test eax, eax jz loc_403F48 locret_403F64: ; CODE XREF: sub_403F50+2j retn sub_403F50 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403F68 proc near ; CODE XREF: sub_40406C+3Ep xchg edx, [eax] test edx, edx jz short locret_403F74 push edx ; bstrString call SysFreeString locret_403F74: ; CODE XREF: sub_403F68+4j retn sub_403F68 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_403F78 proc near ; CODE XREF: sub_403F90+1Bp ; sub_40401C+2j ... mov edx, [eax] test edx, edx jz short locret_403F8C mov dword ptr [eax], 0 push eax push edx ; bstrString call SysFreeString pop eax locret_403F8C: ; CODE XREF: sub_403F78+4j retn sub_403F78 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; int __fastcall sub_403F90(int cbMultiByte) sub_403F90 proc near ; CODE XREF: sub_404040:loc_404049j lpMultiByteStr = dword ptr -1014h strIn = word ptr -1010h push ebx push esi push edi push ebp add esp, 0FFFFF004h push eax add esp, 0FFFFFFFCh mov esi, ecx mov [esp+1014h+lpMultiByteStr], edx mov edi, eax test esi, esi jg short loc_403FB2 mov eax, edi call sub_403F78 jmp short loc_40400F ; --------------------------------------------------------------------------- loc_403FB2: ; CODE XREF: sub_403F90+17j lea ebp, [esi+1] cmp ebp, 7FFh jge short loc_403FE5 push esi ; cbMultiByte lea eax, [esp+1018h+strIn] mov ecx, [esp+1018h+lpMultiByteStr] ; lpMultiByteStr mov edx, 7FFh ; cchWideChar call sub_403C0C mov ebx, eax test ebx, ebx jle short loc_403FE5 lea edx, [esp+1014h+strIn] ; strIn mov eax, edi mov ecx, ebx ; ui call sub_40401C jmp short loc_40400F ; --------------------------------------------------------------------------- loc_403FE5: ; CODE XREF: sub_403F90+2Bj ; sub_403F90+44j mov ebx, ebp mov eax, edi mov edx, ebx call sub_40406C push esi ; cbMultiByte mov eax, [edi] mov ecx, [esp+1018h+lpMultiByteStr] ; lpMultiByteStr mov edx, ebx ; cchWideChar call sub_403C0C mov ebx, eax test ebx, ebx jge short loc_404006 xor ebx, ebx loc_404006: ; CODE XREF: sub_403F90+72j mov eax, edi mov edx, ebx call sub_40406C loc_40400F: ; CODE XREF: sub_403F90+20j ; sub_403F90+53j add esp, 1004h pop ebp pop edi pop esi pop ebx retn sub_403F90 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; int __fastcall sub_40401C(UINT ui, OLECHAR *strIn) sub_40401C proc near ; CODE XREF: sub_403F90+4Ep test ecx, ecx jz sub_403F78 push eax push ecx ; ui push edx ; strIn call SysAllocStringLen test eax, eax jz loc_403F48 pop edx push dword ptr [edx] ; bstrString mov [edx], eax call SysFreeString retn sub_40401C endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_404040 proc near ; CODE XREF: sub_405074+115p ; sub_405074+162p ... xor ecx, ecx test edx, edx jz short loc_404049 mov ecx, [edx-4] loc_404049: ; CODE XREF: sub_404040+4j jmp sub_403F90 sub_404040 endp ; --------------------------------------------------------------------------- retn ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_404050 proc near ; CODE XREF: sub_405074+11Dp ; sub_405074+16Ap ... test eax, eax jz short loc_404058 retn ; --------------------------------------------------------------------------- align 2 word_404056 dw 0 ; DATA XREF: sub_404050:loc_404058o ; --------------------------------------------------------------------------- loc_404058: ; CODE XREF: sub_404050+2j mov eax, offset word_404056 retn sub_404050 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_404060 proc near ; CODE XREF: sub_40406C+1Cp test eax, eax jz short locret_404069 mov eax, [eax-4] shr eax, 1 locret_404069: ; CODE XREF: sub_404060+2j retn sub_404060 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40406C proc near ; CODE XREF: sub_403F90+5Bp ; sub_403F90+7Ap var_C = dword ptr -0Ch push ebx push esi push ecx mov ebx, edx mov esi, eax xor eax, eax mov [esp+0Ch+var_C], eax test ebx, ebx jle short loc_4040A5 mov eax, ebx call sub_403F50 mov [esp+0Ch+var_C], eax mov eax, [esi] call sub_404060 test eax, eax jle short loc_4040A5 cmp ebx, eax jge short loc_404097 mov eax, ebx loc_404097: ; CODE XREF: sub_40406C+27j mov ecx, eax add ecx, ecx mov edx, [esp+0Ch+var_C] mov eax, [esi] call sub_40296C loc_4040A5: ; CODE XREF: sub_40406C+Ej ; sub_40406C+23j mov eax, esi mov edx, [esp+0Ch+var_C] call sub_403F68 pop edx pop esi pop ebx retn sub_40406C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn sub_4040B4 proc near ; DATA XREF: sub_404274+2Fo mov al, 11h jmp sub_402904 sub_4040B4 endp ; --------------------------------------------------------------------------- retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4040BC proc near ; CODE XREF: sub_404128+1Dp var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx push esi push edi mov [ebp+var_4], eax mov eax, ds:dword_407028 mov [ebp+var_8], eax cmp [ebp+var_8], 0 jz short loc_40410F loc_4040D6: ; CODE XREF: sub_4040BC+51j xor eax, eax push ebp push offset loc_4040F7 push dword ptr fs:[eax] mov fs:[eax], esp mov ebx, [ebp+var_8] mov eax, [ebp+var_4] call dword ptr [ebx+4] xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx jmp short loc_404101 ; --------------------------------------------------------------------------- loc_4040F7: ; DATA XREF: sub_4040BC+1Do jmp loc_403460 ; --------------------------------------------------------------------------- call sub_403618 loc_404101: ; CODE XREF: sub_4040BC+39j mov eax, [ebp+var_8] mov eax, [eax] mov [ebp+var_8], eax cmp [ebp+var_8], 0 jnz short loc_4040D6 loc_40410F: ; CODE XREF: sub_4040BC+18j pop edi pop esi pop ebx pop ecx pop ecx pop ebp retn sub_4040BC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404118 proc near ; CODE XREF: sub_404418+5p mov edx, ds:dword_407024 mov [eax], edx mov ds:dword_407024, eax retn sub_404118 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404128 proc near ; CODE XREF: sub_403A20+76p var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF8h mov [ebp+var_4], eax xor eax, eax push ebp push offset loc_4041A1 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+var_4] mov eax, [eax+4] call sub_4040BC xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4041A8 loc_404157: ; CODE XREF: sub_404128+7Ej mov eax, [ebp+var_4] cmp eax, ds:dword_407024 jnz short loc_40416E mov eax, [ebp+var_4] mov eax, [eax] mov ds:dword_407024, eax jmp short loc_4041A0 ; --------------------------------------------------------------------------- loc_40416E: ; CODE XREF: sub_404128+38j mov eax, ds:dword_407024 mov [ebp+var_8], eax cmp [ebp+var_8], 0 jz short loc_4041A0 loc_40417C: ; CODE XREF: sub_404128+76j mov eax, [ebp+var_8] mov eax, [eax] cmp eax, [ebp+var_4] jnz short loc_404192 mov eax, [ebp+var_4] mov eax, [eax] mov edx, [ebp+var_8] mov [edx], eax jmp short loc_4041A0 ; --------------------------------------------------------------------------- loc_404192: ; CODE XREF: sub_404128+5Cj mov eax, [ebp+var_8] mov eax, [eax] mov [ebp+var_8], eax cmp [ebp+var_8], 0 jnz short loc_40417C loc_4041A0: ; CODE XREF: sub_404128+44j ; sub_404128+52j ... retn ; --------------------------------------------------------------------------- loc_4041A1: ; DATA XREF: sub_404128+Co jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404157 ; --------------------------------------------------------------------------- loc_4041A8: ; CODE XREF: sub_404128:loc_4041A0j ; DATA XREF: sub_404128+2Ao pop ecx pop ecx pop ebp retn sub_404128 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4041AC proc near ; CODE XREF: sub_404274+ADp ; sub_404274+BEp var_10 = dword ptr -10h LCData = byte ptr -0Bh var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFF0h push ebx xor edx, edx mov [ebp+var_10], edx xor edx, edx push ebp push offset loc_404212 push dword ptr fs:[edx] mov fs:[edx], esp push 7 ; cchData lea edx, [ebp+LCData] push edx ; lpLCData push 1004h ; LCType push eax ; Locale call GetLocaleInfoA ; GetLocaleInfoA lea eax, [ebp+var_10] lea edx, [ebp+LCData] mov ecx, 7 call sub_403C74 mov eax, [ebp+var_10] lea edx, [ebp+var_4] call sub_403188 mov ebx, eax cmp [ebp+var_4], 0 jz short loc_4041FC xor ebx, ebx loc_4041FC: ; CODE XREF: sub_4041AC+4Cj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404219 loc_404209: ; CODE XREF: sub_4041AC+6Bj lea eax, [ebp+var_10] call sub_403B18 retn ; --------------------------------------------------------------------------- loc_404212: ; DATA XREF: sub_4041AC+Fo jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404209 ; --------------------------------------------------------------------------- loc_404219: ; CODE XREF: sub_4041AC+65j ; DATA XREF: sub_4041AC+58o mov eax, ebx pop ebx mov esp, ebp pop ebp retn sub_4041AC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404220 proc near ; DATA XREF: CODE:00405018o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_40426A push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_4085A4 jnz short loc_40425C mov eax, offset dword_408038 call sub_402F58 mov eax, offset dword_408204 call sub_402F58 mov eax, offset dword_4083D0 call sub_402F58 call sub_401A34 loc_40425C: ; CODE XREF: sub_404220+17j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404271 loc_404269: ; CODE XREF: sub_404220+4Fj retn ; --------------------------------------------------------------------------- loc_40426A: ; DATA XREF: sub_404220+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404269 ; --------------------------------------------------------------------------- loc_404271: ; CODE XREF: sub_404220:loc_404269j ; DATA XREF: sub_404220+44o pop ebp retn sub_404220 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404274 proc near ; DATA XREF: CODE:00405014o sub ds:dword_4085A4, 1 jnb locret_404346 mov ds:byte_40700C, 2 mov ds:dword_408010, offset RaiseException mov ds:dword_408014, offset RtlUnwind mov ds:byte_408036, 2 mov ds:dword_408000, offset sub_4040B4 call sub_403264 test al, al jz short loc_4042BB call sub_403294 loc_4042BB: ; CODE XREF: sub_404274+40j call sub_403358 mov ds:word_40803C, 0D7B0h mov ds:word_408208, 0D7B0h mov ds:word_4083D4, 0D7B0h call GetCommandLineA ; GetCommandLineA mov ds:dword_40802C, eax call sub_4010F0 mov ds:dword_408028, eax call GetVersion ; GetVersion and eax, 80000000h cmp eax, 80000000h jz short loc_40432D call GetVersion ; GetVersion and eax, 0FFh cmp ax, 4 jbe short loc_40431C mov ds:CodePage, 3 jmp short loc_40433C ; --------------------------------------------------------------------------- loc_40431C: ; CODE XREF: sub_404274+9Aj call GetThreadLocale ; GetThreadLocale call sub_4041AC mov ds:CodePage, eax jmp short loc_40433C ; --------------------------------------------------------------------------- loc_40432D: ; CODE XREF: sub_404274+8Aj call GetThreadLocale ; GetThreadLocale call sub_4041AC mov ds:CodePage, eax loc_40433C: ; CODE XREF: sub_404274+A6j ; sub_404274+B7j call GetCurrentThreadId ; GetCurrentThreadId mov ds:dword_408020, eax locret_404346: ; CODE XREF: sub_404274+7j retn sub_404274 endp ; --------------------------------------------------------------------------- align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetModuleHandleA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION LocalAlloc_0. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION TlsGetValue. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION TlsSetValue. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= sub_404368 proc near ; CODE XREF: sub_404388+22p var_8 = dword ptr -8 push ebx push ecx mov ebx, eax push ebx ; uBytes push 40h ; uFlags call LocalAlloc_0 mov [esp+8+var_8], eax mov eax, [esp+8+var_8] pop edx pop ebx retn sub_404368 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_404380 proc near ; CODE XREF: sub_404388+2p mov eax, 8 retn sub_404380 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404388 proc near ; CODE XREF: sub_4043D8:loc_4043F2p var_8 = dword ptr -8 push ebx push ecx call sub_404380 mov ebx, eax test ebx, ebx jz short loc_4043D3 cmp ds:TlsIndex, 0FFFFFFFFh jnz short loc_4043A8 mov eax, 0E2h call sub_403B0C ; --------------------------------------------------------------------------- loc_4043A8: ; CODE XREF: sub_404388+14j mov eax, ebx call sub_404368 mov [esp+8+var_8], eax cmp [esp+8+var_8], 0 jnz short loc_4043C4 mov eax, 0E2h call sub_403B0C ; --------------------------------------------------------------------------- jmp short loc_4043D3 ; --------------------------------------------------------------------------- loc_4043C4: ; CODE XREF: sub_404388+2Ej mov eax, [esp+8+var_8] push eax ; lpTlsValue mov eax, ds:TlsIndex push eax ; dwTlsIndex call TlsSetValue ; TlsSetValue loc_4043D3: ; CODE XREF: sub_404388+Bj ; sub_404388+3Aj pop edx pop ebx retn sub_404388 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4043D8 proc near ; CODE XREF: sub_4028B8+20p ; sub_402910+3p ... mov cl, ds:byte_40864C mov eax, ds:TlsIndex test cl, cl jnz short loc_40440D mov edx, large fs:2Ch mov eax, [edx+eax*4] retn ; --------------------------------------------------------------------------- loc_4043F2: ; CODE XREF: sub_4043D8+3Dj call sub_404388 mov eax, ds:TlsIndex push eax ; dwTlsIndex call TlsGetValue ; TlsGetValue test eax, eax jz short loc_404407 retn ; --------------------------------------------------------------------------- loc_404407: ; CODE XREF: sub_4043D8+2Cj mov eax, ds:dword_408658 retn ; --------------------------------------------------------------------------- loc_40440D: ; CODE XREF: sub_4043D8+Dj push eax ; dwTlsIndex call TlsGetValue ; TlsGetValue test eax, eax jz short loc_4043F2 retn sub_4043D8 endp ; =============== S U B R O U T I N E ======================================= sub_404418 proc near ; CODE XREF: sub_404424+2Ep mov eax, offset dword_4070B0 call sub_404118 retn sub_404418 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404424 proc near ; CODE XREF: sub_405074+18p push ebx mov ebx, eax xor eax, eax mov ds:TlsIndex, eax push 0 ; lpModuleName call GetModuleHandleA ; GetModuleHandleA mov ds:dword_408650, eax mov eax, ds:dword_408650 mov ds:dword_4070B4, eax xor eax, eax mov ds:dword_4070B8, eax xor eax, eax mov ds:dword_4070BC, eax call sub_404418 mov edx, offset dword_4070B0 mov eax, ebx call sub_4038C8 pop ebx retn sub_404424 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404468 proc near ; DATA XREF: CODE:00405010o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_40448D push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_408654 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404494 loc_40448C: ; CODE XREF: sub_404468+2Aj retn ; --------------------------------------------------------------------------- loc_40448D: ; DATA XREF: sub_404468+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_40448C ; --------------------------------------------------------------------------- loc_404494: ; CODE XREF: sub_404468:loc_40448Cj ; DATA XREF: sub_404468+1Fo pop ebp retn sub_404468 endp ; --------------------------------------------------------------------------- align 4 loc_404498: ; DATA XREF: CODE:off_40500Co sub ds:dword_408654, 1 retn ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4044A0 proc near ; DATA XREF: CODE:00405020o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_4044C5 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_40865C xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4044CC loc_4044C4: ; CODE XREF: sub_4044A0+2Aj retn ; --------------------------------------------------------------------------- loc_4044C5: ; DATA XREF: sub_4044A0+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_4044C4 ; --------------------------------------------------------------------------- loc_4044CC: ; CODE XREF: sub_4044A0:loc_4044C4j ; DATA XREF: sub_4044A0+1Fo pop ebp retn sub_4044A0 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_4044D0 proc near ; DATA XREF: CODE:0040501Co sub ds:dword_40865C, 1 retn sub_4044D0 endp ; [00000006 BYTES: COLLAPSED FUNCTION RegOpenKeyA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION ExitProcess_0. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION GetFileAttributesA. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION GetTickCount. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION OpenProcess. PRESS KEYPAD "+" TO EXPAND] align 10h ; [00000006 BYTES: COLLAPSED FUNCTION MessageBoxA_0. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404508 proc near ; DATA XREF: CODE:00405028o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_40452D push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_408660 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404534 loc_40452C: ; CODE XREF: sub_404508+2Aj retn ; --------------------------------------------------------------------------- loc_40452D: ; DATA XREF: sub_404508+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_40452C ; --------------------------------------------------------------------------- loc_404534: ; CODE XREF: sub_404508:loc_40452Cj ; DATA XREF: sub_404508+1Fo pop ebp retn sub_404508 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404538 proc near ; DATA XREF: CODE:00405024o sub ds:dword_408660, 1 retn sub_404538 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404540 proc near ; DATA XREF: CODE:00405030o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_404565 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_408664 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_40456C loc_404564: ; CODE XREF: sub_404540+2Aj retn ; --------------------------------------------------------------------------- loc_404565: ; DATA XREF: sub_404540+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404564 ; --------------------------------------------------------------------------- loc_40456C: ; CODE XREF: sub_404540:loc_404564j ; DATA XREF: sub_404540+1Fo pop ebp retn sub_404540 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= sub_404570 proc near ; DATA XREF: CODE:0040502Co sub ds:dword_408664, 1 retn sub_404570 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404578 proc near ; DATA XREF: CODE:00405038o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_40459D push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_408668 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4045A4 loc_40459C: ; CODE XREF: sub_404578+2Aj retn ; --------------------------------------------------------------------------- loc_40459D: ; DATA XREF: sub_404578+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_40459C ; --------------------------------------------------------------------------- loc_4045A4: ; CODE XREF: sub_404578:loc_40459Cj ; DATA XREF: sub_404578+1Fo pop ebp retn sub_404578 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_4045A8 proc near ; DATA XREF: CODE:00405034o sub ds:dword_408668, 1 retn sub_4045A8 endp ; [00000006 BYTES: COLLAPSED FUNCTION RtlDecompressBuffer. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4045B8 proc near ; CODE XREF: sub_405074+60p ; sub_405074+EFp ... var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp push 0 push 0 push 0 push ebx push esi push edi mov ebx, edx test ebx, ebx js short loc_4045D4 shr ebx, 2 loc_4045CD: ; CODE XREF: sub_4045B8+1Aj mov esi, [eax+ebx*4] dec ebx push esi jns short loc_4045CD loc_4045D4: ; CODE XREF: sub_4045B8+10j mov eax, esp mov [ebp+var_4], ecx mov esi, eax xor eax, eax push ebp push offset loc_404635 push dword ptr fs:[eax] mov fs:[eax], esp xor edi, edi jmp short loc_404608 ; --------------------------------------------------------------------------- loc_4045ED: ; CODE XREF: sub_4045B8+55j cmp bl, 1 jz short loc_404607 lea eax, [ebp+var_C] mov edx, ebx call sub_403C28 mov edx, [ebp+var_C] lea eax, [ebp+var_8] call sub_403C94 loc_404607: ; CODE XREF: sub_4045B8+38j inc edi loc_404608: ; CODE XREF: sub_4045B8+33j mov bl, [esi+edi] test bl, bl jnz short loc_4045ED mov eax, [ebp+var_4] mov edx, [ebp+var_8] call sub_403B6C xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_40463C loc_404627: ; CODE XREF: sub_4045B8+82j lea eax, [ebp+var_C] mov edx, 2 call sub_403B3C retn ; --------------------------------------------------------------------------- loc_404635: ; DATA XREF: sub_4045B8+26o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404627 ; --------------------------------------------------------------------------- loc_40463C: ; CODE XREF: sub_4045B8+7Cj ; DATA XREF: sub_4045B8+6Ao mov edi, [ebp+var_18] mov esi, [ebp+var_14] mov ebx, [ebp+var_10] mov esp, ebp pop ebp retn sub_4045B8 endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_40464C proc near ; CODE XREF: sub_404658+25p test eax, eax jz short locret_404655 sub eax, 4 mov eax, [eax] locret_404655: ; CODE XREF: sub_40464C+2j retn sub_40464C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404658 proc near ; CODE XREF: sub_405074+118Fp ; sub_405074+141Bp var_8 = dword ptr -8 var_4 = dword ptr -4 arg_0 = dword ptr 8 arg_4 = dword ptr 0Ch push ebp mov ebp, esp add esp, 0FFFFFFF8h push ebx push esi push edi mov esi, [ebp+arg_0] mov eax, [ebp+arg_4] call sub_403E7C xor eax, eax push ebp push offset loc_404708 push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+arg_4] call sub_40464C mov ebx, eax cmp ebx, 4 jbe short loc_4046EB lea eax, [ebp+arg_4] call sub_403EDC mov [ebp+var_8], eax mov eax, [ebp+var_8] mov edx, [eax] mov eax, esi call sub_403EE4 mov eax, [ebp+var_8] cmp dword ptr [eax], 80000h jbe short loc_4046B2 mov edi, 2 jmp short loc_4046B7 ; --------------------------------------------------------------------------- loc_4046B2: ; CODE XREF: sub_404658+51j mov edi, 2 loc_4046B7: ; CODE XREF: sub_404658+58j lea eax, [ebp+var_4] push eax sub ebx, 4 push ebx lea eax, [ebp+arg_4] call sub_403EDC add eax, 4 push eax mov eax, [ebp+var_8] mov eax, [eax] push eax mov eax, esi call sub_403EDC push eax push edi call RtlDecompressBuffer ; RtlDecompressBuffer mov eax, esi mov edx, [ebp+var_4] call sub_403EE4 jmp short loc_4046F2 ; --------------------------------------------------------------------------- loc_4046EB: ; CODE XREF: sub_404658+2Fj mov eax, esi call sub_403B18 loc_4046F2: ; CODE XREF: sub_404658+91j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_40470F loc_4046FF: ; CODE XREF: sub_404658+B5j lea eax, [ebp+arg_4] call sub_403B18 retn ; --------------------------------------------------------------------------- loc_404708: ; DATA XREF: sub_404658+17o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_4046FF ; --------------------------------------------------------------------------- loc_40470F: ; CODE XREF: sub_404658+AFj ; DATA XREF: sub_404658+A2o pop edi pop esi pop ebx pop ecx pop ecx pop ebp retn 8 sub_404658 endp ; =============== S U B R O U T I N E ======================================= sub_404718 proc near ; CODE XREF: sub_405074+913p ; sub_405074+A25p ... var_C = dword ptr -0Ch push ebx push esi push ecx mov esi, eax push 2 push edx mov eax, ds:dword_408650 push eax call ds:dword_40866C mov ebx, eax push ebx mov eax, ds:dword_408650 push eax call ds:dword_408670 mov [esi], eax push ebx mov eax, ds:dword_408650 push eax call ds:dword_408674 mov ebx, eax push ebx call ds:dword_408678 mov [esp+0Ch+var_C], eax cmp [esp+0Ch+var_C], 0 jz short loc_404763 push ebx call ds:dword_40867C loc_404763: ; CODE XREF: sub_404718+42j mov eax, [esp+0Ch+var_C] pop edx pop esi pop ebx retn sub_404718 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40476C proc near ; CODE XREF: sub_405074+112Ep ; sub_405074+13BAp var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_11 = byte ptr -11h var_10 = dword ptr -10h var_C = dword ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFFD4h push ebx push esi push edi xor ebx, ebx mov [ebp+var_2C], ebx mov [ebp+var_28], ebx mov [ebp+var_18], ebx mov [ebp+var_C], ecx mov [ebp+var_8], edx mov [ebp+var_4], eax mov eax, [ebp+var_4] call sub_403E7C mov eax, [ebp+var_8] call sub_403E7C xor eax, eax push ebp push offset loc_404914 push dword ptr fs:[eax] mov fs:[eax], esp xor esi, esi lea eax, [ebp+var_18] call sub_403B18 mov eax, [ebp+var_8] call sub_403C8C test eax, eax jle short loc_4047D8 mov [ebp+var_20], eax mov ebx, 1 loc_4047C5: ; CODE XREF: sub_40476C+6Aj mov eax, [ebp+var_8] movzx eax, byte ptr [eax+ebx-1] cdq idiv ebx xor esi, edx inc ebx dec [ebp+var_20] jnz short loc_4047C5 loc_4047D8: ; CODE XREF: sub_40476C+4Fj cmp esi, 0FFh jle short loc_4047FC loc_4047E0: ; CODE XREF: sub_40476C+8Ej sar esi, 1 jns short loc_4047E7 adc esi, 0 loc_4047E7: ; CODE XREF: sub_40476C+76j mov [ebp+var_24], esi fild [ebp+var_24] call sub_402B74 mov esi, eax cmp esi, 0FFh jg short loc_4047E0 loc_4047FC: ; CODE XREF: sub_40476C+72j mov eax, [ebp+var_4] call sub_403C8C test eax, eax jle loc_4048D9 mov [ebp+var_20], eax mov ebx, 1 loc_404814: ; CODE XREF: sub_40476C+167j mov eax, [ebp+var_8] call sub_403C8C push eax mov eax, ebx pop edx mov ecx, edx cdq idiv ecx mov [ebp+var_1C], edx inc [ebp+var_1C] mov eax, [ebp+var_4] call sub_403C8C xor eax, ebx mov edx, [ebp+var_8] mov ecx, [ebp+var_1C] movzx edx, byte ptr [edx+ecx-1] mov ecx, edx cdq idiv ecx mov [ebp+var_10], edx inc [ebp+var_10] mov eax, ebx cdq idiv [ebp+var_10] mov eax, esi xor dl, al mov eax, [ebp+var_4] mov al, [eax+ebx-1] mov ecx, ebx and ecx, 8000007Fh jns short loc_40486B dec ecx or ecx, 0FFFFFF80h inc ecx loc_40486B: ; CODE XREF: sub_40476C+F8j xor al, cl mov ecx, [ebp+var_8] mov edi, [ebp+var_1C] movzx ecx, byte ptr [ecx+edi-1] add ecx, ecx shr ecx, 2 xor al, cl xor dl, al mov [ebp+var_11], dl mov eax, ebx and eax, 80000001h jns short loc_404892 dec eax or eax, 0FFFFFFFEh inc eax loc_404892: ; CODE XREF: sub_40476C+11Fj test eax, eax jnz short loc_4048AE lea eax, [ebp+var_28] mov dl, [ebp+var_11] call sub_403C28 mov edx, [ebp+var_28] lea eax, [ebp+var_18] call sub_403C94 jmp short loc_4048CF ; --------------------------------------------------------------------------- loc_4048AE: ; CODE XREF: sub_40476C+128j lea eax, [ebp+var_2C] xor edx, edx mov dl, [ebp+var_11] push edx mov edx, 0FFh pop ecx sub edx, ecx call sub_403C28 mov edx, [ebp+var_2C] lea eax, [ebp+var_18] call sub_403C94 loc_4048CF: ; CODE XREF: sub_40476C+140j inc ebx dec [ebp+var_20] jnz loc_404814 loc_4048D9: ; CODE XREF: sub_40476C+9Aj mov eax, [ebp+var_C] mov edx, [ebp+var_18] call sub_403B6C xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_40491B loc_4048F1: ; CODE XREF: sub_40476C+1ADj lea eax, [ebp+var_2C] mov edx, 2 call sub_403B3C lea eax, [ebp+var_18] call sub_403B18 lea eax, [ebp+var_8] mov edx, 2 call sub_403B3C retn ; --------------------------------------------------------------------------- loc_404914: ; DATA XREF: sub_40476C+30o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_4048F1 ; --------------------------------------------------------------------------- loc_40491B: ; CODE XREF: sub_40476C+1A7j ; DATA XREF: sub_40476C+180o pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_40476C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404924 proc near ; CODE XREF: sub_405074+A02p ; sub_405074+AB7p ... var_108 = byte ptr -108h push ebx push esi add esp, 0FFFFFEF4h mov esi, edx mov ebx, eax lea edx, [esp+114h+var_108] mov eax, ebx call sub_40317C lea edx, [esp+114h+var_108] mov eax, esp mov cl, 0Bh call sub_402FB0 mov eax, esi mov edx, esp call sub_403C68 add esp, 10Ch pop esi pop ebx retn sub_404924 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_40495C proc near ; CODE XREF: sub_405074+969p ; sub_405074+990p ... var_108 = dword ptr -108h var_104 = byte ptr -104h var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFEF8h push ebx push esi push edi xor ecx, ecx mov [ebp+var_108], ecx mov [ebp+var_4], ecx mov esi, eax lea edi, [ebp+var_104] mov ecx, 40h rep movsd mov edi, edx xor eax, eax push ebp push offset loc_4049E8 push dword ptr fs:[eax] mov fs:[eax], esp xor esi, esi jmp short loc_4049B2 ; --------------------------------------------------------------------------- loc_404996: ; CODE XREF: sub_40495C+5Fj lea eax, [ebp+var_108] mov edx, ebx call sub_403C28 mov edx, [ebp+var_108] lea eax, [ebp+var_4] call sub_403C94 inc esi loc_4049B2: ; CODE XREF: sub_40495C+38j mov bl, [ebp+esi+var_104] test bl, bl jnz short loc_404996 mov eax, edi mov edx, [ebp+var_4] call sub_403B6C xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_4049EF loc_4049D4: ; CODE XREF: sub_40495C+91j lea eax, [ebp+var_108] call sub_403B18 lea eax, [ebp+var_4] call sub_403B18 retn ; --------------------------------------------------------------------------- loc_4049E8: ; DATA XREF: sub_40495C+2Bo jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_4049D4 ; --------------------------------------------------------------------------- loc_4049EF: ; CODE XREF: sub_40495C+8Bj ; DATA XREF: sub_40495C+73o pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_40495C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_4049F8 proc near ; DATA XREF: CODE:00405040o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_404A1D push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_4086C4 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404A24 loc_404A1C: ; CODE XREF: sub_4049F8+2Aj retn ; --------------------------------------------------------------------------- loc_404A1D: ; DATA XREF: sub_4049F8+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404A1C ; --------------------------------------------------------------------------- loc_404A24: ; CODE XREF: sub_4049F8:loc_404A1Cj ; DATA XREF: sub_4049F8+1Fo pop ebp retn sub_4049F8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404A28 proc near ; DATA XREF: CODE:0040503Co sub ds:dword_4086C4, 1 retn sub_404A28 endp ; =============== S U B R O U T I N E ======================================= sub_404A30 proc near ; CODE XREF: sub_404A60+24Fp add edx, eax mov eax, edx retn sub_404A30 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404A38 proc near ; CODE XREF: sub_404A60+10Bp push edx push eax mov eax, ds:off_407DC8 mov eax, [eax] call eax retn sub_404A38 endp ; =============== S U B R O U T I N E ======================================= sub_404A44 proc near ; CODE XREF: sub_404A60+18Ap var_4 = dword ptr -4 push ecx movzx edx, dx add edx, eax mov [esp+4+var_4], edx mov eax, [esp+4+var_4] pop edx retn sub_404A44 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404A54 proc near ; CODE XREF: sub_404A60+1E6p shr eax, 1Dh mov eax, ds:dword_407D64[eax*4] retn sub_404A54 endp ; --------------------------------------------------------------------------- align 10h ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404A60 proc near ; CODE XREF: sub_405074+149Ap var_218 = dword ptr -218h var_214 = dword ptr -214h var_1B4 = dword ptr -1B4h var_1B0 = dword ptr -1B0h var_14C = dword ptr -14Ch var_A8 = dword ptr -0A8h var_9C = dword ptr -9Ch var_80 = dword ptr -80h var_50 = word ptr -50h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_1D = byte ptr -1Dh var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = byte ptr -14h var_10 = byte ptr -10h var_C = byte ptr -0Ch var_8 = dword ptr -8 var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFEB4h push ebx push esi push edi mov [ebp+var_4], edx mov edi, eax mov eax, [ebp+var_4] call sub_403E7C xor eax, eax push ebp push offset loc_404D2B push dword ptr fs:[eax] mov fs:[eax], esp mov [ebp+var_28], 8 xor eax, eax mov [ebp+var_24], eax mov esi, 1 lea eax, [ebp+var_3C] mov ecx, [ebp+var_24] mov edx, 10h call sub_402FCC lea eax, [ebp+var_80] mov ecx, [ebp+var_24] mov edx, 44h call sub_402FCC mov [ebp+var_80], 44h mov [ebp+var_50], 1 lea eax, [ebp+var_3C] push eax lea eax, [ebp+var_80] push eax push 0 push 0 push 4 push 0 push 0 push 0 push 0 mov eax, [ebp+var_4] call sub_403E8C push eax mov eax, ds:off_407DD4 mov eax, [eax] call eax test eax, eax jz loc_404D15 mov [ebp+var_1D], 1 xor eax, eax push ebp push offset loc_404D0E push dword ptr fs:[eax] mov fs:[eax], esp mov [ebp+var_14C], 10002h lea eax, [ebp+var_14C] push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_407DE8 mov eax, [eax] call eax test eax, eax jz loc_404CD7 lea eax, [ebp+var_C] push eax push 4 lea eax, [ebp+var_8] push eax mov eax, [ebp+var_A8] xor edx, edx push edx push eax mov eax, [ebp+var_28] cdq add eax, [esp+1B4h+var_1B4] adc edx, [esp+1B4h+var_1B0] add esp, 8 push eax mov eax, [ebp+var_3C] push eax mov eax, ds:off_407E38 mov eax, [eax] call eax test eax, eax jz loc_404CD7 mov edx, [ebp+var_8] mov eax, [ebp+var_3C] call sub_404A38 cmp eax, [ebp+var_24] jl loc_404CD7 test edi, edi jz loc_404CD7 mov eax, [edi+3Ch] add eax, edi mov [ebp+var_18], eax push 4 push 3000h mov eax, [ebp+var_18] mov eax, [eax+50h] push eax mov eax, [ebp+var_18] mov eax, [eax+34h] push eax mov eax, [ebp+var_3C] push eax mov eax, ds:off_407E08 mov eax, [eax] call eax mov [ebp+var_8], eax cmp [ebp+var_8], 0 jz loc_404CD7 lea eax, [ebp+var_10] push eax mov eax, [ebp+var_18] mov eax, [eax+54h] push eax push edi mov eax, [ebp+var_8] push eax mov eax, [ebp+var_3C] push eax mov eax, ds:off_407DBC mov eax, [eax] call eax test eax, eax jz loc_404CD7 mov eax, [ebp+var_18] mov dx, [eax+14h] mov eax, [ebp+var_18] add eax, 18h call sub_404A44 mov [ebp+var_1C], eax mov ebx, [ebp+var_24] mov eax, [ebp+var_18] movzx eax, word ptr [eax+6] sub eax, esi sub eax, ebx jb short loc_404C72 inc eax mov [ebp+var_2C], eax loc_404C06: ; CODE XREF: sub_404A60+210j lea eax, [ebp+var_10] push eax lea esi, [ebx+ebx*4] mov eax, [ebp+var_1C] mov eax, [eax+esi*8+10h] push eax mov eax, [ebp+var_1C] mov eax, [eax+esi*8+14h] add eax, edi push eax mov eax, [ebp+var_1C] mov eax, [eax+esi*8+0Ch] add eax, [ebp+var_8] push eax mov eax, [ebp+var_3C] push eax mov eax, ds:off_407DBC mov eax, [eax] call eax test eax, eax jz short loc_404C6C lea eax, [ebp+var_14] push eax mov eax, [ebp+var_1C] mov eax, [eax+esi*8+24h] call sub_404A54 push eax mov eax, [ebp+var_1C] mov eax, [eax+esi*8+8] push eax mov eax, [ebp+var_1C] mov eax, [eax+esi*8+0Ch] add eax, [ebp+var_8] push eax mov eax, [ebp+var_3C] push eax mov eax, ds:off_407E10 mov eax, [eax] call eax loc_404C6C: ; CODE XREF: sub_404A60+1D9j inc ebx dec [ebp+var_2C] jnz short loc_404C06 loc_404C72: ; CODE XREF: sub_404A60+1A0j lea eax, [ebp+var_10] push eax push 4 lea eax, [ebp+var_8] push eax mov eax, [ebp+var_A8] xor edx, edx push edx push eax mov eax, [ebp+var_28] cdq add eax, [esp+218h+var_218] adc edx, [esp+218h+var_214] add esp, 8 push eax mov eax, [ebp+var_3C] push eax mov eax, ds:off_407DBC mov eax, [eax] call eax test eax, eax jz short loc_404CD7 mov eax, [ebp+var_18] mov edx, [eax+28h] mov eax, [ebp+var_8] call sub_404A30 mov [ebp+var_9C], eax lea eax, [ebp+var_14C] push eax mov eax, [ebp+var_38] push eax mov eax, ds:off_407E80 mov eax, [eax] call eax cmp eax, 1 sbb eax, eax inc eax mov [ebp+var_1D], al loc_404CD7: ; CODE XREF: sub_404A60+C7j ; sub_404A60+FFj ... xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404D15 loc_404CE4: ; CODE XREF: sub_404A60+2B3j cmp [ebp+var_1D], 0 jnz short loc_404CFD mov eax, [ebp+var_24] push eax mov eax, [ebp+var_3C] push eax mov eax, ds:off_407E7C mov eax, [eax] call eax jmp short loc_404D0A ; --------------------------------------------------------------------------- loc_404CFD: ; CODE XREF: sub_404A60+288j mov eax, [ebp+var_38] push eax mov eax, ds:off_407DB4 mov eax, [eax] call eax loc_404D0A: ; CODE XREF: sub_404A60+29Bj mov bl, [ebp+var_1D] retn ; --------------------------------------------------------------------------- loc_404D0E: ; DATA XREF: sub_404A60+9Co jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404CE4 ; --------------------------------------------------------------------------- loc_404D15: ; CODE XREF: sub_404A60+8Fj ; DATA XREF: sub_404A60+27Fo xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404D32 loc_404D22: ; CODE XREF: sub_404A60+2D0j lea eax, [ebp+var_4] call sub_403B18 retn ; --------------------------------------------------------------------------- loc_404D2B: ; DATA XREF: sub_404A60+1Co jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404D22 ; --------------------------------------------------------------------------- loc_404D32: ; CODE XREF: sub_404A60+2CAj ; DATA XREF: sub_404A60+2BDo mov eax, ebx pop edi pop esi pop ebx mov esp, ebp pop ebp retn sub_404A60 endp ; sp-analysis failed ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404D3C proc near ; DATA XREF: CODE:00405048o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_404D61 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_4086C8 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404D68 loc_404D60: ; CODE XREF: sub_404D3C+2Aj retn ; --------------------------------------------------------------------------- loc_404D61: ; DATA XREF: sub_404D3C+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404D60 ; --------------------------------------------------------------------------- loc_404D68: ; CODE XREF: sub_404D3C:loc_404D60j ; DATA XREF: sub_404D3C+1Fo pop ebp retn sub_404D3C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404D6C proc near ; DATA XREF: CODE:00405044o sub ds:dword_4086C8, 1 retn sub_404D6C endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404D74 proc near ; DATA XREF: CODE:00405058o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_404D99 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_4086CC xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404DA0 loc_404D98: ; CODE XREF: sub_404D74+2Aj retn ; --------------------------------------------------------------------------- loc_404D99: ; DATA XREF: sub_404D74+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404D98 ; --------------------------------------------------------------------------- loc_404DA0: ; CODE XREF: sub_404D74:loc_404D98j ; DATA XREF: sub_404D74+1Fo pop ebp retn sub_404D74 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404DA4 proc near ; DATA XREF: CODE:00405054o sub ds:dword_4086CC, 1 retn sub_404DA4 endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404DAC proc near ; DATA XREF: CODE:00405050o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_404DD1 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_4086D0 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404DD8 loc_404DD0: ; CODE XREF: sub_404DAC+2Aj retn ; --------------------------------------------------------------------------- loc_404DD1: ; DATA XREF: sub_404DAC+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404DD0 ; --------------------------------------------------------------------------- loc_404DD8: ; CODE XREF: sub_404DAC:loc_404DD0j ; DATA XREF: sub_404DAC+1Fo pop ebp retn sub_404DAC endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404DDC proc near ; DATA XREF: CODE:0040504Co sub ds:dword_4086D0, 1 retn sub_404DDC endp ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404DE4 proc near ; DATA XREF: CODE:00405060o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_404E09 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_4086D4 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404E10 loc_404E08: ; CODE XREF: sub_404DE4+2Aj retn ; --------------------------------------------------------------------------- loc_404E09: ; DATA XREF: sub_404DE4+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404E08 ; --------------------------------------------------------------------------- loc_404E10: ; CODE XREF: sub_404DE4:loc_404E08j ; DATA XREF: sub_404DE4+1Fo pop ebp retn sub_404DE4 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404E14 proc near ; DATA XREF: CODE:0040505Co sub ds:dword_4086D4, 1 retn sub_404E14 endp ; [00000006 BYTES: COLLAPSED FUNCTION LdrGetProcedureAddress. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION LdrLoadDll. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION RtlInitString. PRESS KEYPAD "+" TO EXPAND] align 4 ; [00000006 BYTES: COLLAPSED FUNCTION RtlInitUnicodeString. PRESS KEYPAD "+" TO EXPAND] align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404E3C proc near ; DATA XREF: CODE:00405068o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_404E61 push dword ptr fs:[eax] mov fs:[eax], esp inc ds:dword_4086D8 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404E68 loc_404E60: ; CODE XREF: sub_404E3C+2Aj retn ; --------------------------------------------------------------------------- loc_404E61: ; DATA XREF: sub_404E3C+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404E60 ; --------------------------------------------------------------------------- loc_404E68: ; CODE XREF: sub_404E3C:loc_404E60j ; DATA XREF: sub_404E3C+1Fo pop ebp retn sub_404E3C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= sub_404E6C proc near ; DATA XREF: CODE:00405064o sub ds:dword_4086D8, 1 retn sub_404E6C endp ; =============== S U B R O U T I N E ======================================= sub_404E74 proc near ; CODE XREF: sub_405074+125p ; sub_405074+172p ... var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h var_10 = byte ptr -10h push ebx push esi push edi add esp, 0FFFFFFF0h mov edi, ecx mov esi, edx xor edx, edx mov [esp+1Ch+var_1C], edx push eax push ebx call RtlInitUnicodeString ; RtlInitUnicodeString lea eax, [esp+1Ch+var_18] push eax push ebx push 0 push 0 call LdrLoadDll ; LdrLoadDll test eax, eax jnz short loc_404ECB push esi lea eax, [esp+20h+var_10] push eax call RtlInitString ; RtlInitString lea eax, [esp+1Ch+var_14] push eax movzx eax, di push eax lea eax, [esp+24h+var_10] push eax mov eax, [esp+28h+var_18] push eax call LdrGetProcedureAddress ; LdrGetProcedureAddress test eax, eax jnz short loc_404ECB mov eax, [esp+1Ch+var_14] mov [esp+1Ch+var_1C], eax loc_404ECB: ; CODE XREF: sub_404E74+27j ; sub_404E74+4Ej mov eax, [esp+1Ch+var_1C] add esp, 10h pop edi pop esi pop ebx retn sub_404E74 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404ED8 proc near ; CODE XREF: sub_405074+CB7p ; sub_405074+F10p ... var_109 = byte ptr -109h var_4 = dword ptr -4 push ebp mov ebp, esp add esp, 0FFFFFEF4h push ebx push esi mov esi, edx mov [ebp+var_4], eax mov eax, [ebp+var_4] call sub_403E7C xor eax, eax push ebp push offset loc_404F6E push dword ptr fs:[eax] mov fs:[eax], esp mov eax, 64h call sub_402FEC lea eax, [ebp+var_109] xor ecx, ecx mov edx, 105h call sub_402FCC mov ebx, 105h push ebx lea eax, [ebp+var_109] push eax mov eax, [ebp+var_4] call sub_403E8C push eax mov eax, ds:off_407E40 mov eax, [eax] call eax mov ebx, eax mov eax, esi call sub_403B18 test ebx, ebx jbe short loc_404F58 mov eax, esi lea edx, [ebp+var_109] mov ecx, 105h call sub_403C74 loc_404F58: ; CODE XREF: sub_404ED8+6Cj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404F75 loc_404F65: ; CODE XREF: sub_404ED8+9Bj lea eax, [ebp+var_4] call sub_403B18 retn ; --------------------------------------------------------------------------- loc_404F6E: ; DATA XREF: sub_404ED8+1Bo jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404F65 ; --------------------------------------------------------------------------- loc_404F75: ; CODE XREF: sub_404ED8+95j ; DATA XREF: sub_404ED8+88o pop esi pop ebx mov esp, ebp pop ebp retn sub_404ED8 endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404F7C proc near ; CODE XREF: sub_405074+D97p var_4 = dword ptr -4 push ebp mov ebp, esp push ecx push ebx mov [ebp+var_4], eax mov eax, [ebp+var_4] call sub_403E7C xor eax, eax push ebp push offset loc_404FCD push dword ptr fs:[eax] mov fs:[eax], esp mov eax, [ebp+var_4] call sub_403E8C push eax ; lpFileName call GetFileAttributesA ; GetFileAttributesA test al, 10h jnz short loc_404FB1 cmp eax, 0FFFFFFFFh jnz short loc_404FB5 loc_404FB1: ; CODE XREF: sub_404F7C+2Ej xor ebx, ebx jmp short loc_404FB7 ; --------------------------------------------------------------------------- loc_404FB5: ; CODE XREF: sub_404F7C+33j mov bl, 1 loc_404FB7: ; CODE XREF: sub_404F7C+37j xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_404FD4 loc_404FC4: ; CODE XREF: sub_404F7C+56j lea eax, [ebp+var_4] call sub_403B18 retn ; --------------------------------------------------------------------------- loc_404FCD: ; DATA XREF: sub_404F7C+13o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404FC4 ; --------------------------------------------------------------------------- loc_404FD4: ; CODE XREF: sub_404F7C+50j ; DATA XREF: sub_404F7C+43o mov eax, ebx pop ebx pop ecx pop ebp retn sub_404F7C endp ; --------------------------------------------------------------------------- align 4 ; =============== S U B R O U T I N E ======================================= ; Attributes: bp-based frame sub_404FDC proc near ; DATA XREF: CODE:00405070o push ebp mov ebp, esp xor eax, eax push ebp push offset loc_404FFB push dword ptr fs:[eax] mov fs:[eax], esp xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_405002 loc_404FFA: ; CODE XREF: sub_404FDC+24j retn ; --------------------------------------------------------------------------- loc_404FFB: ; DATA XREF: sub_404FDC+6o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_404FFA ; --------------------------------------------------------------------------- loc_405002: ; CODE XREF: sub_404FDC:loc_404FFAj ; DATA XREF: sub_404FDC+19o pop ebp retn sub_404FDC endp ; --------------------------------------------------------------------------- dword_405004 dd 0Dh dd offset off_40500C off_40500C dd offset loc_404498 ; DATA XREF: CODE:00405008o dd offset sub_404468 dd offset sub_404274 dd offset sub_404220 dd offset sub_4044D0 dd offset sub_4044A0 dd offset sub_404538 dd offset sub_404508 dd offset sub_404570 dd offset sub_404540 dd offset sub_4045A8 dd offset sub_404578 dd offset sub_404A28 dd offset sub_4049F8 dd offset sub_404D6C dd offset sub_404D3C dd offset sub_404DDC dd offset sub_404DAC dd offset sub_404DA4 dd offset sub_404D74 dd offset sub_404E14 dd offset sub_404DE4 dd offset sub_404E6C dd offset sub_404E3C align 10h dd offset sub_404FDC ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn bp-based frame sub_405074 proc near ; CODE XREF: start+5j ; DATA XREF: starto var_25C = dword ptr -25Ch var_258 = dword ptr -258h var_254 = dword ptr -254h var_250 = dword ptr -250h var_24C = dword ptr -24Ch var_248 = dword ptr -248h var_244 = dword ptr -244h var_240 = dword ptr -240h var_23C = dword ptr -23Ch var_238 = dword ptr -238h var_234 = dword ptr -234h var_230 = dword ptr -230h var_22C = dword ptr -22Ch var_228 = dword ptr -228h var_224 = dword ptr -224h var_220 = dword ptr -220h var_21C = dword ptr -21Ch var_218 = dword ptr -218h var_214 = dword ptr -214h var_210 = dword ptr -210h var_20C = dword ptr -20Ch var_208 = dword ptr -208h var_204 = dword ptr -204h var_200 = dword ptr -200h var_1FC = dword ptr -1FCh var_1F8 = dword ptr -1F8h var_1F4 = dword ptr -1F4h var_1F0 = dword ptr -1F0h var_1EC = dword ptr -1ECh var_1E8 = dword ptr -1E8h var_1E4 = dword ptr -1E4h var_1E0 = dword ptr -1E0h var_1DC = dword ptr -1DCh var_1D8 = dword ptr -1D8h var_1D4 = dword ptr -1D4h var_1D0 = dword ptr -1D0h var_1CC = dword ptr -1CCh var_1C8 = dword ptr -1C8h var_1C4 = dword ptr -1C4h var_1C0 = dword ptr -1C0h var_1BC = dword ptr -1BCh var_1B8 = dword ptr -1B8h var_1B4 = dword ptr -1B4h var_1B0 = dword ptr -1B0h var_1AC = dword ptr -1ACh var_1A8 = dword ptr -1A8h var_1A4 = dword ptr -1A4h var_1A0 = dword ptr -1A0h var_19C = dword ptr -19Ch var_198 = dword ptr -198h var_194 = dword ptr -194h var_190 = dword ptr -190h var_18C = dword ptr -18Ch var_188 = dword ptr -188h var_184 = dword ptr -184h var_180 = dword ptr -180h var_17C = dword ptr -17Ch var_178 = dword ptr -178h var_174 = dword ptr -174h var_170 = dword ptr -170h var_16C = dword ptr -16Ch var_168 = dword ptr -168h var_164 = dword ptr -164h var_160 = dword ptr -160h var_15C = dword ptr -15Ch var_158 = dword ptr -158h var_154 = dword ptr -154h var_150 = dword ptr -150h var_14C = dword ptr -14Ch var_148 = dword ptr -148h var_144 = dword ptr -144h var_140 = dword ptr -140h var_13C = dword ptr -13Ch var_138 = dword ptr -138h var_134 = dword ptr -134h var_130 = dword ptr -130h var_12C = dword ptr -12Ch var_128 = dword ptr -128h var_124 = dword ptr -124h var_120 = dword ptr -120h var_11C = dword ptr -11Ch var_118 = dword ptr -118h var_114 = dword ptr -114h var_110 = dword ptr -110h var_10C = dword ptr -10Ch var_108 = dword ptr -108h var_104 = dword ptr -104h var_100 = dword ptr -100h var_FC = dword ptr -0FCh var_F8 = dword ptr -0F8h var_F4 = dword ptr -0F4h var_F0 = dword ptr -0F0h var_EC = dword ptr -0ECh var_E8 = dword ptr -0E8h var_E4 = dword ptr -0E4h var_E0 = dword ptr -0E0h var_DC = dword ptr -0DCh var_D8 = dword ptr -0D8h var_D4 = dword ptr -0D4h var_D0 = dword ptr -0D0h var_CC = dword ptr -0CCh var_C8 = dword ptr -0C8h var_C4 = dword ptr -0C4h var_C0 = dword ptr -0C0h var_BC = dword ptr -0BCh var_B8 = dword ptr -0B8h var_B4 = dword ptr -0B4h var_B0 = dword ptr -0B0h var_AC = dword ptr -0ACh var_A8 = dword ptr -0A8h var_A4 = dword ptr -0A4h var_A0 = dword ptr -0A0h var_9C = dword ptr -9Ch var_98 = dword ptr -98h var_94 = dword ptr -94h var_90 = dword ptr -90h var_8C = dword ptr -8Ch var_88 = dword ptr -88h var_84 = dword ptr -84h var_80 = dword ptr -80h var_7C = dword ptr -7Ch var_78 = dword ptr -78h var_74 = dword ptr -74h var_70 = dword ptr -70h var_6C = dword ptr -6Ch var_68 = dword ptr -68h var_64 = dword ptr -64h var_60 = dword ptr -60h var_5C = dword ptr -5Ch var_58 = dword ptr -58h var_54 = dword ptr -54h var_50 = dword ptr -50h var_4C = dword ptr -4Ch var_48 = dword ptr -48h var_44 = dword ptr -44h var_40 = dword ptr -40h var_3C = dword ptr -3Ch var_38 = dword ptr -38h var_34 = dword ptr -34h var_30 = dword ptr -30h var_2C = dword ptr -2Ch var_28 = dword ptr -28h var_24 = dword ptr -24h var_20 = dword ptr -20h var_1C = dword ptr -1Ch var_18 = dword ptr -18h var_14 = dword ptr -14h push ebp mov ebp, esp mov ecx, 4Bh loc_40507C: ; CODE XREF: sub_405074+Dj push 0 push 0 dec ecx jnz short loc_40507C push ecx push ebx push esi push edi mov eax, offset dword_405004 call sub_404424 mov esi, ds:off_407DA0 xor eax, eax push ebp push offset loc_40678B push dword ptr fs:[eax] mov fs:[eax], esp push 0DEADC0D4h ; dwProcessId push 0 ; bInheritHandle push 1 ; dwDesiredAccess call OpenProcess ; OpenProcess not eax test eax, eax jnz short loc_4050C2 push 0 ; uExitCode call ExitProcess_0 mov bl, 1 loc_4050C2: ; CODE XREF: sub_405074+43j push offset phkResult ; phkResult lea ecx, [ebp+var_14] mov eax, ds:off_407DC0 mov edx, 27h call sub_4045B8 mov eax, [ebp+var_14] call sub_403E8C push eax ; lpSubKey push 80000001h ; hKey call RegOpenKeyA ; RegOpenKeyA not eax test eax, eax jnz short loc_4050FB push 0 ; uExitCode call ExitProcess_0 mov bl, 1 loc_4050FB: ; CODE XREF: sub_405074+7Cj cmp bl, 1 jnz short loc_405118 loc_405100: ; CODE XREF: sub_405074+A2j push 29Ah ; uType push 0 ; lpCaption push 0 ; lpText push 29Ah ; hWnd call MessageBoxA_0 cmp bl, 1 jz short loc_405100 loc_405118: ; CODE XREF: sub_405074+8Aj mov eax, offset dword_409094 mov edx, offset dword_4067A8 call sub_403B6C mov eax, offset dword_409094 call sub_403B18 mov eax, 64h call sub_402FEC mov eax, 64h call sub_402FEC xor eax, eax mov ds:hWnd, eax mov ds:dword_40907C, 1 lea ecx, [ebp+var_18] mov eax, ds:off_407E14 mov edx, 8Dh call sub_4045B8 mov eax, [ebp+var_18] call sub_403E8C push eax lea ecx, [ebp+var_20] mov eax, ds:off_407DF8 mov edx, 6Fh call sub_4045B8 mov edx, [ebp+var_20] lea eax, [ebp+var_1C] call sub_404040 mov eax, [ebp+var_1C] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DC8 mov [edx], eax lea ecx, [ebp+var_24] mov eax, ds:off_407DF0 mov edx, 77h call sub_4045B8 mov eax, [ebp+var_24] call sub_403E8C push eax lea ecx, [ebp+var_2C] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_2C] lea eax, [ebp+var_28] call sub_404040 mov eax, [ebp+var_28] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407E2C mov [edx], eax lea ecx, [ebp+var_30] mov eax, ds:off_407E54 mov edx, 79h call sub_4045B8 mov eax, [ebp+var_30] call sub_403E8C push eax lea ecx, [ebp+var_38] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_38] lea eax, [ebp+var_34] call sub_404040 mov eax, [ebp+var_34] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DB0 mov [edx], eax lea ecx, [ebp+var_3C] mov eax, ds:off_407E4C mov edx, 75h call sub_4045B8 mov eax, [ebp+var_3C] call sub_403E8C push eax lea ecx, [ebp+var_44] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_44] lea eax, [ebp+var_40] call sub_404040 mov eax, [ebp+var_40] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DA8 mov [edx], eax lea ecx, [ebp+var_48] mov eax, ds:off_407E50 mov edx, 75h call sub_4045B8 mov eax, [ebp+var_48] call sub_403E8C push eax lea ecx, [ebp+var_50] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_50] lea eax, [ebp+var_4C] call sub_404040 mov eax, [ebp+var_4C] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DAC mov [edx], eax lea ecx, [ebp+var_54] mov eax, ds:off_407E70 mov edx, 75h call sub_4045B8 mov eax, [ebp+var_54] call sub_403E8C push eax lea ecx, [ebp+var_5C] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_5C] lea eax, [ebp+var_58] call sub_404040 mov eax, [ebp+var_58] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DD0 mov [edx], eax lea ecx, [ebp+var_60] mov eax, ds:off_407DCC mov edx, 7Ch call sub_4045B8 mov eax, [ebp+var_60] call sub_403E8C push eax lea ecx, [ebp+var_68] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_68] lea eax, [ebp+var_64] call sub_404040 mov eax, [ebp+var_64] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407D94 mov [edx], eax lea ecx, [ebp+var_6C] mov eax, ds:off_407E48 mov edx, 81h call sub_4045B8 mov eax, [ebp+var_6C] call sub_403E8C push eax lea ecx, [ebp+var_74] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_74] lea eax, [ebp+var_70] call sub_404040 mov eax, [ebp+var_70] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407E08 mov [edx], eax lea ecx, [ebp+var_78] mov eax, ds:off_407E58 mov edx, 85h call sub_4045B8 mov eax, [ebp+var_78] call sub_403E8C push eax lea ecx, [ebp+var_80] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_80] lea eax, [ebp+var_7C] call sub_404040 mov eax, [ebp+var_7C] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407E10 mov [edx], eax lea ecx, [ebp+var_84] mov eax, ds:off_407E00 mov edx, 8Ah call sub_4045B8 mov eax, [ebp+var_84] call sub_403E8C push eax lea ecx, [ebp+var_8C] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_8C] lea eax, [ebp+var_88] call sub_404040 mov eax, [ebp+var_88] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DBC mov [edx], eax lea ecx, [ebp+var_90] mov eax, ds:off_407E6C mov edx, 87h call sub_4045B8 mov eax, [ebp+var_90] call sub_403E8C push eax lea ecx, [ebp+var_98] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_98] lea eax, [ebp+var_94] call sub_404040 mov eax, [ebp+var_94] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407E38 mov [edx], eax lea ecx, [ebp+var_9C] mov eax, ds:off_407E30 mov edx, 85h call sub_4045B8 mov eax, [ebp+var_9C] call sub_403E8C push eax lea ecx, [ebp+var_A4] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_A4] lea eax, [ebp+var_A0] call sub_404040 mov eax, [ebp+var_A0] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DE8 mov [edx], eax lea ecx, [ebp+var_A8] mov eax, ds:off_407D9C mov edx, 85h call sub_4045B8 mov eax, [ebp+var_A8] call sub_403E8C push eax lea ecx, [ebp+var_B0] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_B0] lea eax, [ebp+var_AC] call sub_404040 mov eax, [ebp+var_AC] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407E80 mov [edx], eax lea ecx, [ebp+var_B4] mov eax, ds:off_407E18 mov edx, 81h call sub_4045B8 mov eax, [ebp+var_B4] call sub_403E8C push eax lea ecx, [ebp+var_BC] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_BC] lea eax, [ebp+var_B8] call sub_404040 mov eax, [ebp+var_B8] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DD4 mov [edx], eax lea ecx, [ebp+var_C0] mov eax, ds:off_407DF4 mov edx, 7Eh call sub_4045B8 mov eax, [ebp+var_C0] call sub_403E8C push eax lea ecx, [ebp+var_C8] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_C8] lea eax, [ebp+var_C4] call sub_404040 mov eax, [ebp+var_C4] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DB4 mov [edx], eax lea ecx, [ebp+var_CC] mov eax, ds:off_407D98 mov edx, 86h call sub_4045B8 mov eax, [ebp+var_CC] call sub_403E8C push eax lea ecx, [ebp+var_D4] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_D4] lea eax, [ebp+var_D0] call sub_404040 mov eax, [ebp+var_D0] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407E7C mov [edx], eax lea ecx, [ebp+var_D8] mov eax, ds:off_407E20 mov edx, 31h call sub_4045B8 mov eax, [ebp+var_D8] call sub_403E8C push eax lea ecx, [ebp+var_E0] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_E0] lea eax, [ebp+var_DC] call sub_404040 mov eax, [ebp+var_DC] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DDC mov [edx], eax lea ecx, [ebp+var_E4] mov eax, ds:off_407DFC mov edx, 31h call sub_4045B8 mov eax, [ebp+var_E4] call sub_403E8C push eax lea ecx, [ebp+var_EC] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_EC] lea eax, [ebp+var_E8] call sub_404040 mov eax, [ebp+var_E8] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DB8 mov [edx], eax lea ecx, [ebp+var_F0] mov eax, ds:off_407DC4 mov edx, 25h call sub_4045B8 mov eax, [ebp+var_F0] call sub_403E8C push eax lea ecx, [ebp+var_F8] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_F8] lea eax, [ebp+var_F4] call sub_404040 mov eax, [ebp+var_F4] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407D8C mov [edx], eax lea ecx, [ebp+var_FC] mov eax, ds:off_407E74 mov edx, 3Dh call sub_4045B8 mov eax, [ebp+var_FC] call sub_403E8C push eax lea ecx, [ebp+var_104] mov eax, esi mov edx, 77h call sub_4045B8 mov edx, [ebp+var_104] lea eax, [ebp+var_100] call sub_404040 mov eax, [ebp+var_100] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407E40 mov [edx], eax lea ecx, [ebp+var_108] mov eax, ds:off_407E24 mov edx, 33h call sub_4045B8 mov eax, [ebp+var_108] call sub_403E8C push eax lea ecx, [ebp+var_110] mov eax, ds:off_407E64 mov edx, 2Fh call sub_4045B8 mov edx, [ebp+var_110] lea eax, [ebp+var_10C] call sub_404040 mov eax, [ebp+var_10C] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DE0 mov [edx], eax lea ecx, [ebp+var_114] mov eax, ds:off_407E44 mov edx, 23h call sub_4045B8 mov eax, [ebp+var_114] call sub_403E8C push eax lea ecx, [ebp+var_11C] mov eax, ds:off_407E1C mov edx, 1Dh call sub_4045B8 mov edx, [ebp+var_11C] lea eax, [ebp+var_118] call sub_404040 mov eax, [ebp+var_118] call sub_404050 xor ecx, ecx pop edx call sub_404E74 mov edx, ds:off_407DA4 mov [edx], eax mov eax, ds:dword_409098 push eax mov eax, ds:off_407D94 mov eax, [eax] call eax push edi mov eax, ds:off_407D94 mov eax, [eax] call eax push 0DEADC0D4h push 0 push 1 mov eax, ds:off_407D8C mov eax, [eax] call eax not eax test eax, eax jnz short loc_40591F push 0 ; uExitCode call ExitProcess_0 loc_40591F: ; CODE XREF: sub_405074+8A2j push offset phkResult lea ecx, [ebp+var_120] mov eax, ds:off_407DC0 mov edx, 27h call sub_4045B8 mov eax, [ebp+var_120] call sub_403E8C push eax push 80000001h mov eax, ds:off_407DA4 mov eax, [eax] call eax not eax test eax, eax jnz short loc_405960 push 0 ; uExitCode call ExitProcess_0 loc_405960: ; CODE XREF: sub_405074+8E3j lea ecx, [ebp+var_124] mov eax, ds:off_407E3C mov edx, 15h call sub_4045B8 mov eax, [ebp+var_124] call sub_403E8C mov edx, eax mov eax, offset dword_408AFC call sub_404718 mov ds:dword_408AF8, eax mov edx, offset dword_4086E0 mov eax, ds:dword_408AF8 mov ecx, ds:dword_408AFC call sub_40296C cmp ds:byte_4087F2, 0 jz short loc_4059F9 push 0 ; uType lea ecx, [ebp+var_128] mov eax, ds:off_407E60 mov edx, 1Eh call sub_4045B8 mov eax, [ebp+var_128] call sub_403E8C push eax ; lpCaption lea edx, [ebp+var_12C] mov eax, offset byte_4089F3 call sub_40495C mov eax, [ebp+var_12C] call sub_403E8C push eax ; lpText mov eax, ds:hWnd push eax ; hWnd call MessageBoxA_0 loc_4059F9: ; CODE XREF: sub_405074+939j lea edx, [ebp+var_130] mov eax, offset dword_4086E4 call sub_40495C mov edx, [ebp+var_130] mov eax, offset dword_409088 call sub_403B6C mov ds:dword_40908C, 1 loc_405A23: ; CODE XREF: sub_405074+14CBj mov eax, ds:hWnd mov ds:dword_409084, eax mov eax, offset dword_4086DC call sub_403B18 lea ecx, [ebp+var_138] mov eax, ds:off_407E04 mov edx, 15h call sub_4045B8 mov eax, [ebp+var_138] call sub_403E8C mov edx, eax lea eax, [ebp+var_134] call sub_403C38 lea eax, [ebp+var_134] push eax lea edx, [ebp+var_13C] mov eax, ds:dword_40908C call sub_404924 mov edx, [ebp+var_13C] pop eax call sub_403C94 mov eax, [ebp+var_134] call sub_403E8C mov edx, eax mov eax, offset dword_409084 call sub_404718 mov ds:dword_408AF4, eax mov eax, offset dword_4086DC mov edx, ds:dword_409084 call sub_403EE4 cmp ds:dword_408AF4, 0 jz loc_406545 mov eax, offset dword_4086DC call sub_403EDC mov edx, ds:dword_40907C lea eax, [eax+edx-1] push eax mov eax, ds:dword_4086DC call sub_403C8C mov ecx, eax mov eax, ds:dword_408AF4 pop edx call sub_40296C lea ecx, [ebp+var_144] mov eax, ds:off_407E0C mov edx, 16h call sub_4045B8 mov eax, [ebp+var_144] call sub_403E8C mov edx, eax lea eax, [ebp+var_140] call sub_403C38 lea eax, [ebp+var_140] push eax lea edx, [ebp+var_148] mov eax, ds:dword_40908C call sub_404924 mov edx, [ebp+var_148] pop eax call sub_403C94 mov eax, [ebp+var_140] call sub_403E8C mov edx, eax mov eax, offset dword_408F2C call sub_404718 mov ds:dword_408F10, eax mov edx, offset dword_408B00 mov eax, ds:dword_408F10 mov ecx, ds:dword_408F2C call sub_40296C lea edx, [ebp+var_14C] mov eax, offset dword_408B00 call sub_40495C mov edx, [ebp+var_14C] mov eax, offset dword_408F00 call sub_403B6C lea edx, [ebp+var_154] mov eax, ds:dword_40908C call sub_404924 mov ecx, [ebp+var_154] lea eax, [ebp+var_150] mov edx, offset dword_4067B4 call sub_403CD8 mov eax, [ebp+var_150] call sub_403E8C mov edx, eax mov eax, offset dword_408F28 call sub_404718 mov ds:dword_408F14, eax mov edx, offset dword_408C00 mov eax, ds:dword_408F14 mov ecx, ds:dword_408F28 call sub_40296C lea edx, [ebp+var_158] mov eax, offset dword_408C00 call sub_40495C mov edx, [ebp+var_158] mov eax, offset dword_408F04 call sub_403B6C lea edx, [ebp+var_160] mov eax, ds:dword_40908C call sub_404924 mov ecx, [ebp+var_160] lea eax, [ebp+var_15C] mov edx, offset dword_4067C0 call sub_403CD8 mov eax, [ebp+var_15C] call sub_403E8C mov edx, eax mov eax, offset dword_408F20 call sub_404718 mov ds:dword_408F18, eax mov edx, offset dword_408D00 mov eax, ds:dword_408F18 mov ecx, ds:dword_408F20 call sub_40296C lea edx, [ebp+var_164] mov eax, offset dword_408D00 call sub_40495C mov edx, [ebp+var_164] mov eax, offset dword_408F08 call sub_403B6C lea edx, [ebp+var_16C] mov eax, ds:dword_40908C call sub_404924 mov ecx, [ebp+var_16C] lea eax, [ebp+var_168] mov edx, offset dword_4067CC call sub_403CD8 mov eax, [ebp+var_168] call sub_403E8C mov edx, eax mov eax, offset dword_408F24 call sub_404718 mov ds:dword_408F1C, eax mov edx, offset dword_408E00 mov eax, ds:dword_408F1C mov ecx, ds:dword_408F24 call sub_40296C lea edx, [ebp+var_170] mov eax, offset dword_408E00 call sub_40495C mov edx, [ebp+var_170] mov eax, offset dword_408F0C call sub_403B6C lea ecx, [ebp+var_17C] mov eax, ds:off_407E28 mov edx, 16h call sub_4045B8 mov eax, [ebp+var_17C] call sub_403E8C mov edx, eax lea eax, [ebp+var_178] call sub_403C38 mov eax, [ebp+var_178] lea edx, [ebp+var_174] call sub_404ED8 mov edx, [ebp+var_174] mov eax, offset dword_409268 call sub_403B6C lea ecx, [ebp+var_184] mov eax, ds:off_407E84 mov edx, 1Ah call sub_4045B8 mov eax, [ebp+var_184] call sub_403E8C mov edx, eax lea eax, [ebp+var_180] call sub_403C38 mov edx, [ebp+var_180] mov eax, ds:dword_408F0C call sub_403DD8 jz loc_405EC9 push ds:dword_409268 lea ecx, [ebp+var_190] mov eax, ds:off_407DD8 mov edx, 15h call sub_4045B8 mov eax, [ebp+var_190] call sub_403E8C mov edx, eax lea eax, [ebp+var_18C] call sub_403C38 push [ebp+var_18C] push ds:dword_408F0C lea ecx, [ebp+var_198] mov eax, ds:off_407D84 mov edx, 11h call sub_4045B8 mov eax, [ebp+var_198] call sub_403E8C mov edx, eax lea eax, [ebp+var_194] call sub_403C38 push [ebp+var_194] lea eax, [ebp+var_188] mov edx, 4 call sub_403D4C mov eax, [ebp+var_188] call sub_404F7C test al, al jz short loc_405E1B mov ds:byte_40926C, 1 loc_405E1B: ; CODE XREF: sub_405074+D9Ej cmp ds:byte_40926C, 0 jnz loc_406545 push ds:dword_409268 lea ecx, [ebp+var_1A4] mov eax, ds:off_407DD8 mov edx, 15h call sub_4045B8 mov eax, [ebp+var_1A4] call sub_403E8C mov edx, eax lea eax, [ebp+var_1A0] call sub_403C38 push [ebp+var_1A0] push ds:dword_408F0C lea ecx, [ebp+var_1AC] mov eax, ds:off_407D84 mov edx, 11h call sub_4045B8 mov eax, [ebp+var_1AC] call sub_403E8C mov edx, eax lea eax, [ebp+var_1A8] call sub_403C38 push [ebp+var_1A8] lea eax, [ebp+var_19C] mov edx, 4 call sub_403D4C mov edx, [ebp+var_19C] mov eax, offset dword_40909C call sub_402E3C mov eax, offset dword_40909C call sub_402BD8 call sub_402910 loc_405EC9: ; CODE XREF: sub_405074+D09j lea ecx, [ebp+var_1B4] mov eax, ds:off_407E84 mov edx, 1Ah call sub_4045B8 mov eax, [ebp+var_1B4] call sub_403E8C mov edx, eax lea eax, [ebp+var_1B0] call sub_403C38 mov edx, [ebp+var_1B0] mov eax, ds:dword_408F00 call sub_403DD8 jz loc_406384 lea ecx, [ebp+var_1BC] mov eax, ds:off_407E34 mov edx, 22h call sub_4045B8 mov eax, [ebp+var_1BC] call sub_403E8C mov edx, eax lea eax, [ebp+var_1B8] call sub_403C38 mov edx, [ebp+var_1B8] mov eax, ds:dword_408F00 call sub_403DD8 jnz short loc_405F99 lea ecx, [ebp+var_1C8] mov eax, ds:off_407E78 mov edx, 2Dh call sub_4045B8 mov eax, [ebp+var_1C8] call sub_403E8C mov edx, eax lea eax, [ebp+var_1C4] call sub_403C38 mov eax, [ebp+var_1C4] lea edx, [ebp+var_1C0] call sub_404ED8 mov edx, [ebp+var_1C0] mov eax, offset dword_408F00 call sub_403B6C loc_405F99: ; CODE XREF: sub_405074+ED5j lea ecx, [ebp+var_1D0] mov eax, ds:off_407D90 mov edx, 1Eh call sub_4045B8 mov eax, [ebp+var_1D0] call sub_403E8C mov edx, eax lea eax, [ebp+var_1CC] call sub_403C38 mov edx, [ebp+var_1CC] mov eax, ds:dword_408F00 call sub_403DD8 jnz loc_40605F lea ecx, [ebp+var_1D8] mov eax, ds:off_407DE4 mov edx, 2Bh call sub_4045B8 mov eax, [ebp+var_1D8] call sub_403E8C mov edx, eax lea eax, [ebp+var_1D4] call sub_403C38 mov eax, [ebp+var_1D4] push eax lea ecx, [ebp+var_1E4] mov eax, ds:off_407E78 mov edx, 2Dh call sub_4045B8 mov eax, [ebp+var_1E4] call sub_403E8C mov edx, eax lea eax, [ebp+var_1E0] call sub_403C38 mov eax, [ebp+var_1E0] lea edx, [ebp+var_1DC] call sub_404ED8 mov edx, [ebp+var_1DC] mov eax, offset dword_408F00 pop ecx call sub_403CD8 loc_40605F: ; CODE XREF: sub_405074+F62j lea ecx, [ebp+var_1EC] mov eax, ds:off_407E68 mov edx, 1Fh call sub_4045B8 mov eax, [ebp+var_1EC] call sub_403E8C mov edx, eax lea eax, [ebp+var_1E8] call sub_403C38 mov edx, [ebp+var_1E8] mov eax, ds:dword_408F00 call sub_403DD8 jnz short loc_4060EC lea ecx, [ebp+var_1F8] mov eax, ds:off_407D88 mov edx, 21h call sub_4045B8 mov eax, [ebp+var_1F8] call sub_403E8C mov edx, eax lea eax, [ebp+var_1F4] call sub_403C38 mov eax, [ebp+var_1F4] lea edx, [ebp+var_1F0] call sub_404ED8 mov edx, [ebp+var_1F0] mov eax, offset dword_408F00 call sub_403B6C loc_4060EC: ; CODE XREF: sub_405074+1028j lea ecx, [ebp+var_200] mov eax, ds:off_407E28 mov edx, 16h call sub_4045B8 mov eax, [ebp+var_200] call sub_403E8C mov edx, eax lea eax, [ebp+var_1FC] call sub_403C38 mov edx, [ebp+var_1FC] mov eax, ds:dword_408F00 call sub_403DD8 jnz short loc_40613B mov eax, offset dword_408F00 mov edx, ds:dword_409268 call sub_403B6C loc_40613B: ; CODE XREF: sub_405074+10B5j lea ecx, [ebp+var_208] mov eax, ds:off_407E84 mov edx, 1Ah call sub_4045B8 mov eax, [ebp+var_208] call sub_403E8C mov edx, eax lea eax, [ebp+var_204] call sub_403C38 mov edx, [ebp+var_204] mov eax, ds:dword_408F04 call sub_403DD8 jz short loc_4061B7 mov eax, ds:dword_409088 call sub_403E8C mov edx, eax lea eax, [ebp+var_210] call sub_403C38 mov edx, [ebp+var_210] lea ecx, [ebp+var_20C] mov eax, ds:dword_4086DC call sub_40476C mov edx, [ebp+var_20C] mov eax, offset dword_4086DC call sub_403B6C loc_4061B7: ; CODE XREF: sub_405074+1104j lea ecx, [ebp+var_218] mov eax, ds:off_407E84 mov edx, 1Ah call sub_4045B8 mov eax, [ebp+var_218] call sub_403E8C mov edx, eax lea eax, [ebp+var_214] call sub_403C38 mov edx, [ebp+var_214] mov eax, ds:dword_408F08 call sub_403DD8 jz short loc_406218 mov eax, ds:dword_4086DC push eax lea eax, [ebp+var_21C] push eax call sub_404658 mov edx, [ebp+var_21C] mov eax, offset dword_4086DC call sub_403B6C loc_406218: ; CODE XREF: sub_405074+1180j push ds:dword_408F00 lea ecx, [ebp+var_224] mov eax, ds:off_407DD8 mov edx, 15h call sub_4045B8 mov eax, [ebp+var_224] call sub_403E8C mov edx, eax lea eax, [ebp+var_220] call sub_403C38 push [ebp+var_220] call GetTickCount ; GetTickCount lea edx, [ebp+var_228] call sub_404924 push [ebp+var_228] lea ecx, [ebp+var_230] mov eax, ds:off_407DEC mov edx, 21h call sub_4045B8 mov eax, [ebp+var_230] call sub_403E8C mov edx, eax lea eax, [ebp+var_22C] call sub_403C38 push [ebp+var_22C] mov eax, offset dword_408F00 mov edx, 4 call sub_403D4C mov edx, ds:dword_408F00 mov eax, offset dword_408F30 call sub_402E3C mov edx, ds:dword_40907C mov eax, offset dword_408F30 call sub_403110 call sub_402910 call sub_40294C cmp eax, ds:hWnd jnz short loc_40631D push 0 mov eax, offset dword_4086DC call sub_403EDC mov edx, ds:dword_40907C lea eax, [eax+edx-1] push eax mov eax, ds:dword_4086DC call sub_403C8C mov ecx, eax mov eax, offset dword_408F30 pop edx call sub_402F38 call sub_402910 mov eax, offset dword_408F30 call sub_402F58 call sub_402910 loc_40631D: ; CODE XREF: sub_405074+1265j xor eax, eax push ebp push offset loc_40637A push dword ptr fs:[eax] mov fs:[eax], esp mov eax, ds:dword_40907C push eax push 0 push 0 mov eax, ds:dword_408F00 call sub_403E8C push eax lea ecx, [ebp+var_234] mov eax, ds:off_407E5C mov edx, 1Bh call sub_4045B8 mov eax, [ebp+var_234] call sub_403E8C push eax mov eax, ds:hWnd push eax mov eax, ds:off_407DE0 mov eax, [eax] call eax xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx jmp short loc_406384 ; --------------------------------------------------------------------------- loc_40637A: ; DATA XREF: sub_405074+12ACo jmp loc_403460 ; --------------------------------------------------------------------------- call sub_403618 loc_406384: ; CODE XREF: sub_405074+E92j ; sub_405074+1304j lea ecx, [ebp+var_23C] mov eax, ds:off_407E84 mov edx, 1Ah call sub_4045B8 mov eax, [ebp+var_23C] call sub_403E8C mov edx, eax lea eax, [ebp+var_238] call sub_403C38 mov edx, [ebp+var_238] mov eax, ds:dword_408F00 call sub_403DD8 jnz loc_406532 lea ecx, [ebp+var_244] mov eax, ds:off_407E84 mov edx, 1Ah call sub_4045B8 mov eax, [ebp+var_244] call sub_403E8C mov edx, eax lea eax, [ebp+var_240] call sub_403C38 mov edx, [ebp+var_240] mov eax, ds:dword_408F04 call sub_403DD8 jz short loc_406443 mov eax, ds:dword_409088 call sub_403E8C mov edx, eax lea eax, [ebp+var_24C] call sub_403C38 mov edx, [ebp+var_24C] lea ecx, [ebp+var_248] mov eax, ds:dword_4086DC call sub_40476C mov edx, [ebp+var_248] mov eax, offset dword_4086DC call sub_403B6C loc_406443: ; CODE XREF: sub_405074+1390j lea ecx, [ebp+var_254] mov eax, ds:off_407E84 mov edx, 1Ah call sub_4045B8 mov eax, [ebp+var_254] call sub_403E8C mov edx, eax lea eax, [ebp+var_250] call sub_403C38 mov edx, [ebp+var_250] mov eax, ds:dword_408F08 call sub_403DD8 jz short loc_4064A4 mov eax, ds:dword_4086DC push eax lea eax, [ebp+var_258] push eax call sub_404658 mov edx, [ebp+var_258] mov eax, offset dword_4086DC call sub_403B6C loc_4064A4: ; CODE XREF: sub_405074+140Cj mov eax, ds:dword_4086DC call sub_403C8C call sub_40280C mov ds:dword_408AF4, eax mov eax, offset dword_4086DC call sub_403EDC mov edx, ds:dword_40907C lea eax, [eax+edx-1] push eax mov eax, ds:dword_4086DC call sub_403C8C mov ecx, eax mov edx, ds:dword_408AF4 pop eax call sub_40296C xor eax, eax push ebp push offset loc_40652B push dword ptr fs:[eax] mov fs:[eax], esp lea edx, [ebp+var_25C] mov eax, ds:hWnd call sub_402B10 mov edx, [ebp+var_25C] mov eax, ds:dword_408AF4 call sub_404A60 xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_406532 loc_406520: ; CODE XREF: sub_405074+14BCj mov eax, ds:dword_408AF4 call sub_40283C retn ; --------------------------------------------------------------------------- loc_40652B: ; DATA XREF: sub_405074+1474o jmp loc_40358C ; --------------------------------------------------------------------------- jmp short loc_406520 ; --------------------------------------------------------------------------- loc_406532: ; CODE XREF: sub_405074+134Dj ; sub_405074+14B6j ; DATA XREF: ... inc ds:dword_40908C cmp ds:dword_40908C, 0Bh jnz loc_405A23 loc_406545: ; CODE XREF: sub_405074+A46j ; sub_405074+DAEj xor eax, eax pop edx pop ecx pop ecx mov fs:[eax], edx push offset loc_406795 loc_406552: ; CODE XREF: sub_405074+171Cj lea eax, [ebp+var_25C] mov edx, 51h call sub_403B3C lea eax, [ebp+var_118] call sub_403F78 lea eax, [ebp+var_114] mov edx, 2 call sub_403B3C lea eax, [ebp+var_10C] call sub_403F78 lea eax, [ebp+var_108] mov edx, 2 call sub_403B3C lea eax, [ebp+var_100] call sub_403F78 lea eax, [ebp+var_FC] mov edx, 2 call sub_403B3C lea eax, [ebp+var_F4] call sub_403F78 lea eax, [ebp+var_F0] mov edx, 2 call sub_403B3C lea eax, [ebp+var_E8] call sub_403F78 lea eax, [ebp+var_E4] mov edx, 2 call sub_403B3C lea eax, [ebp+var_DC] call sub_403F78 lea eax, [ebp+var_D8] call sub_403B18 lea eax, [ebp+var_D0] call sub_403F78 lea eax, [ebp+var_CC] call sub_403B18 lea eax, [ebp+var_D4] call sub_403B18 lea eax, [ebp+var_C8] call sub_403B18 lea eax, [ebp+var_C4] call sub_403F78 lea eax, [ebp+var_C0] mov edx, 2 call sub_403B3C lea eax, [ebp+var_B8] call sub_403F78 lea eax, [ebp+var_B4] mov edx, 2 call sub_403B3C lea eax, [ebp+var_AC] call sub_403F78 lea eax, [ebp+var_A8] mov edx, 2 call sub_403B3C lea eax, [ebp+var_A0] call sub_403F78 lea eax, [ebp+var_9C] mov edx, 2 call sub_403B3C lea eax, [ebp+var_94] call sub_403F78 lea eax, [ebp+var_90] mov edx, 2 call sub_403B3C lea eax, [ebp+var_88] call sub_403F78 lea eax, [ebp+var_84] mov edx, 2 call sub_403B3C lea eax, [ebp+var_7C] call sub_403F78 lea eax, [ebp+var_78] mov edx, 2 call sub_403B3C lea eax, [ebp+var_70] call sub_403F78 lea eax, [ebp+var_6C] mov edx, 2 call sub_403B3C lea eax, [ebp+var_64] call sub_403F78 lea eax, [ebp+var_60] mov edx, 2 call sub_403B3C lea eax, [ebp+var_58] call sub_403F78 lea eax, [ebp+var_54] mov edx, 2 call sub_403B3C lea eax, [ebp+var_4C] call sub_403F78 lea eax, [ebp+var_48] mov edx, 2 call sub_403B3C lea eax, [ebp+var_40] call sub_403F78 lea eax, [ebp+var_3C] mov edx, 2 call sub_403B3C lea eax, [ebp+var_34] call sub_403F78 lea eax, [ebp+var_30] mov edx, 2 call sub_403B3C lea eax, [ebp+var_28] call sub_403F78 lea eax, [ebp+var_24] mov edx, 2 call sub_403B3C lea eax, [ebp+var_1C] call sub_403F78 lea eax, [ebp+var_18] mov edx, 2 call sub_403B3C retn ; --------------------------------------------------------------------------- loc_40678B: ; DATA XREF: sub_405074+26o jmp loc_40358C ; --------------------------------------------------------------------------- jmp loc_406552 ; --------------------------------------------------------------------------- loc_406795: ; CODE XREF: sub_405074+1716j ; DATA XREF: sub_405074+14D9o pop edi pop esi pop ebx call sub_403A20 sub_405074 endp ; --------------------------------------------------------------------------- align 10h dd 0FFFFFFFFh, 3 dword_4067A8 dd 6C696Eh, 0FFFFFFFFh, 1dword_4067B4 dd 45h, 0FFFFFFFFh, 1dword_4067C0 dd 51h, 0FFFFFFFFh, 1dword_4067CC dd 52h ; =============== S U B R O U T I N E ======================================= ; Attributes: noreturn public start start proc near push offset sub_405074 retn start endp ; --------------------------------------------------------------------------- align 40h CODE ends ; Section 2. (virtual address 00007000) ; Virtual size : 00000E88 ( 3720.) ; Section size in file : 00001000 ( 4096.) ; Offset to raw data for section: 00005C00 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read/Write DATA segment para public 'DATA' use32 assume cs:DATA ;org 407000h ; UINT uExitCode uExitCode dd 0 ; DATA XREF: sub_403908+Ar ; sub_403964+2w ... dword_407004 dd 0 ; sub_403908+37r ... dword_407008 dd 0 ; sub_402FEC+Ew byte_40700C db 2 ; DATA XREF: sub_403030+4Er ; sub_404274+Dw db 8Dh, 40h, 0 word_407010 dw 1332h ; DATA XREF: sub_403294+6r ; sub_403294:loc_40330Cr ... dw 0C08Bh byte_407014 db 0 ; DATA XREF: sub_403370r sub_40338Cr ... db 8Dh, 40h, 0 byte_407018 db 0 ; DATA XREF: sub_4037E8-336r ; sub_4037E8:loc_4034EDr db 8Dh, 40h, 0 byte_40701C db 0 ; DATA XREF: sub_403994:loc_4039F5r db 8Dh, 40h, 0 byte_407020 db 1 ; DATA XREF: sub_402E3C+25r db 8Dh, 40h, 0 dword_407024 dd 0 dword_407028 dd 0 off_40702C dd offset sub_4021B8 ; DATA XREF: sub_40280C+Ar ; sub_40285C+3Fr off_407030 dd offset sub_402364 ; DATA XREF: sub_40283C+5r ; sub_40285C+26r off_407034 dd offset sub_402740 ; DATA XREF: sub_40285C+Dr byte_407038 db 0 ; DATA XREF: sub_4028B8+36r aRsu db 'клхивохмншьзыйэщчъЮАЦ',0 aFxn@ db 'ДЕ█@',0 dword_407054 dd 3 dd 0 dd 1, 2, 3, 3 dup(0) ; char Caption[] Caption db 'Error',0 ; DATA XREF: sub_403994+6Co dw 0C08Bh ; char Text[] Text db 'Runtime error at 00000000',0 ; DATA XREF: sub_403908+3o ; sub_403994+32o ... dw 0C08Bh byte_40709C db 30h ; DATA XREF: sub_403908+41r db 31h, 32h, 33h dd 37363534h, 42413938h, 46454443h ; DWORD TlsIndex TlsIndex dd 0FFFFFFFFh ; DATA XREF: sub_404388+Dr ; sub_404388+40r ... dword_4070B0 dd 0 ; sub_404424+33o dword_4070B4 dd 0 dword_4070B8 dd 0 dword_4070BC dd 0 dd 2 dup(0) dword_4070C8 dd 1010146h, 17h dup(1010101h), 16E0169h, 1520164h, 1730165h ; DATA XREF: DATA:off_407DF0o dd 175016Fh, 1630172h, 410165h dword_407140 dd 1010153h, 17h dup(1010101h), 17A0169h, 16F0165h, 1520166h ; DATA XREF: DATA:off_407E54o dd 1730165h, 175016Fh, 1630172h, 0C08B0065h dword_4071BC dd 101014Ch, 12h dup(1010101h), 1016F01h, 4 dup(1010101h) ; DATA XREF: DATA:off_407E4Co dd 1610101h, 1520164h, 1730165h, 175016Fh, 1630172h, 0C08B0065h dword_407234 dd 101014Ch, 12h dup(1010101h), 1016F01h, 4 dup(1010101h) ; DATA XREF: DATA:off_407E50o dd 1630101h, 152016Bh, 1730165h, 175016Fh, 1630172h, 0C08B0065h dword_4072AC dd 1010146h, 12h dup(1010101h), 1017201h, 4 dup(1010101h) ; DATA XREF: DATA:off_407E70o dd 1010165h, 1520165h, 1730165h, 175016Fh, 1630172h, 0C08B0065h dword_407324 dd 101016Eh, 12h dup(1010101h), 1010174h, 4 dup(1010101h) ; DATA XREF: DATA:off_407DF8o dd 1640101h, 16C016Ch, 164012Eh, 6C016Ch dword_407394 dd 101015Ah, 18h dup(1010101h), 1770101h, 16E0155h, 161016Dh ; DATA XREF: DATA:off_407E14o dd 1560170h, 65016901h, 4F017701h, 53016601h, 63016501h dd 69017401h, 6E016F01h, 0C08B0001h dword_407424 dd 1010156h, 0Dh dup(1010101h), 1010169h, 0Bh dup(1010101h) ; DATA XREF: DATA:off_407E48o dd 1740172h, 1610175h, 141016Ch, 6C016C01h, 63016F01h dd 78014501h, 0C08B0001h dword_4074A8 dd 1010156h, 0Fh dup(1010101h), 1690101h, 8 dup(1010101h) ; DATA XREF: DATA:off_407E58o dd 72010101h, 1740101h, 1610175h, 150016Ch, 6F017201h dd 65017401h, 74016301h, 78014501h, 0C08B0001h dword_407530 dd 1010157h, 18h dup(1010101h), 1017201h, 74010169h, 50016501h ; DATA XREF: DATA:off_407E00o dd 6F017201h, 1630101h, 1730165h, 14D0173h, 16D0165h, 172016Fh dd 90000179h dword_4075BC dd 1010152h, 17h dup(1010101h), 1650101h, 1610101h, 1640101h ; DATA XREF: DATA:off_407E6Co dd 1720150h, 163016Fh, 73016501h, 4D017301h, 6D016501h dd 72016F01h, 17901h dword_407644 dd 1010147h, 0Fh dup(1010101h), 65010101h, 8 dup(1010101h) ; DATA XREF: DATA:off_407E30o dd 1740101h, 1015401h, 1720168h, 1610165h, 1430164h, 16E016Fh dd 1650174h, 1740178h, 0C08B0001h dword_4076CC dd 1010153h, 0Fh dup(1010101h), 65010101h, 8 dup(1010101h) ; DATA XREF: DATA:off_407D9Co dd 1010174h, 1010154h, 1720168h, 1610165h, 1430164h, 16E016Fh dd 1650174h, 74010178h, 0C08B0001h dword_407754 dd 1010143h, 0Fh dup(1010101h), 72010101h, 8 dup(1010101h) ; DATA XREF: DATA:off_407E18o dd 1010165h, 1010161h, 1650174h, 1720150h, 163016Fh, 1730165h dd 41010173h, 0C08B0001h dword_4077D8 dd 1010152h, 10h dup(1010101h), 1730165h, 7 dup(1010101h) ; DATA XREF: DATA:off_407DF4o dd 75010101h, 6D010101h, 65010101h, 68015401h, 65017201h dd 64016101h, 90000101h dword_407858 dd 1010154h, 10h dup(1010101h), 1010165h, 7 dup(1010101h) ; DATA XREF: DATA:off_407D98o dd 6D017201h, 1010101h, 6E010169h, 74016101h, 50016501h dd 6F017201h, 1630101h, 1730165h, 90000173h dword_4078E0 dd 1010146h, 0Fh dup(1010101h), 72010101h, 1650101h, 7 dup(1010101h) ; DATA XREF: DATA:off_407DCCo dd 65010101h, 1014C01h, 1690101h, 72016201h, 72016101h dd 1017901h, 408D00h dword_407960 dd 101016Bh, 14h dup(1010101h), 1650101h, 16E0172h, 2 dup(1010101h) ; DATA XREF: DATA:off_407DA0o dd 1650101h, 1016C01h, 1320133h, 164012Eh, 6C016Ch dword_4079D8 dd 1010153h, 4 dup(1010101h), 16F0101h, 1010101h, 1740166h ; DATA XREF: DATA:off_407DC0o dd 1610177h, 650172h dword_407A00 dd 101014Dh, 6 dup(1010101h), 1650101h, 1730173h, 1670161h ; DATA XREF: DATA:off_407E20o dd 1420165h, 178016Fh, 0C08B0041h dword_407A34 dd 1010145h, 6 dup(1010101h), 1780101h, 1740169h, 1720150h ; DATA XREF: DATA:off_407DFCo dd 163016Fh, 1730165h, 0C08B0073h dword_407A68 dd 1010149h, 4 dup(1010101h), 16E0101h, 66010101h, 90006F01h ; DATA XREF: DATA:off_407E60o dword_407A88 dd 101004Ch, 4 dup(1010101h), 0C08B0101hdword_407AA0 dd 1010058h, 4 dup(1010101h), 0C08B0101hdword_407AB8 dd 1010143h, 4 dup(1010101h), 90000101hdword_407AD0 dd 101014Fh, 5 dup(1010101h), 90000101hdword_407AEC dd 101016Fh, 1017001h, 4 dup(1010101h), 6E0165h ; DATA XREF: DATA:off_407E5Co dword_407B08 dd 101015Ch, 4 dup(1010101h), 0C08B0001hdword_407B20 dd 1010153h, 6 dup(1010101h), 1650168h, 16C016Ch, 1780145h ; DATA XREF: DATA:off_407E24o dd 1630165h, 1740175h, 410165h dword_407B54 dd 1010173h, 6 dup(1010101h), 1650168h, 16C016Ch, 1320133h ; DATA XREF: DATA:off_407E64o dd 164012Eh, 6C016Ch dword_407B84 dd 101012Eh, 6 dup(1010101h), 1780165h, 0C08B0065h ; DATA XREF: DATA:off_407DECo dword_407BA8 dd 1010153h, 6 dup(1010101h), 1730179h, 1650174h, 152016Dh ; DATA XREF: DATA:off_407E78o dd 16F016Fh, 0C08B0074h dword_407BD8 dd 101015Ch, 6 dup(1010101h), 1790153h, 1740173h, 16D0165h ; DATA XREF: DATA:off_407DE4o dd 320133h dword_407C04 dd 1010154h, 6 dup(1010101h), 14D0145h, 0C08B0050h ; DATA XREF: DATA:off_407D88o dword_407C28 dd 1010157h, 4 dup(1010101h), 69010101h, 64016E01h, 77016F01h ; DATA XREF: DATA:off_407E34o dd 90007301h dword_407C4C dd 1010153h, 4 dup(1010101h), 73010179h, 65017401h, 90006D01h ; DATA XREF: DATA:off_407D90o dword_407C6C dd 1010154h, 5 dup(1010101h), 1650101h, 70016Dh ; DATA XREF: DATA:off_407E68o dword_407C8C dd 1010147h, 3 dup(1010101h), 1650101h, 1450174h, 176016Eh ; DATA XREF: DATA:off_407E74o dd 1720169h, 16E016Fh, 165016Dh, 174016Eh, 1610156h, 1690172h dd 1620161h, 165016Ch, 0C08B0041h dword_407CCC dd 101014Fh, 3 dup(1010101h), 1700101h, 16E0165h, 1720150h ; DATA XREF: DATA:off_407DC4o dd 163016Fh, 1730165h, 0C08B0073h dword_407CF4 dd 1010152h, 1010101h, 1010165h, 1010101h, 1670101h, 170014Fh ; DATA XREF: DATA:off_407E44o dd 16E0165h, 165014Bh, 410179h dword_407D18 dd 1010161h, 1640101h, 2 dup(1010101h), 1017601h, 1700161h ; DATA XREF: DATA:off_407E1Co dd 1330169h, 0C08B0032h dword_407D38 dd 1010141h, 70017001h, 1010101h, 1440101h, 74016101h ; DATA XREF: DATA:off_407E28o dd 90006101h dword_407D50 dd 101012Eh, 1740101h, 1010178h, 74010101h, 0C08B0001h ; DATA XREF: DATA:off_407D84o dword_407D64 dd 1 dd 10h, 2, 20h, 4, 40h, 4, 40h off_407D84 dd offset dword_407D50 ; DATA XREF: sub_405074+D54r ; sub_405074+DF9r off_407D88 dd offset dword_407C04 ; DATA XREF: sub_405074+1030r off_407D8C dd offset dword_4086BC ; DATA XREF: sub_405074+748r ; sub_405074+895r off_407D90 dd offset dword_407C4C ; DATA XREF: sub_405074+F2Br off_407D94 dd offset dword_408684 ; DATA XREF: sub_405074+2F8r ; sub_405074+879r ... off_407D98 dd offset dword_407858 ; DATA XREF: sub_405074+5DAr off_407D9C dd offset dword_4076CC ; DATA XREF: sub_405074+4BDr off_407DA0 dd offset dword_407960 ; DATA XREF: sub_405074+1Dr off_407DA4 dd offset dword_4086C0 ; DATA XREF: sub_405074+86Br ; sub_405074+8D6r off_407DA8 dd offset dword_408674 ; DATA XREF: sub_405074+211r off_407DAC dd offset dword_408678 ; DATA XREF: sub_405074+25Er off_407DB0 dd offset dword_408670 ; DATA XREF: sub_405074+1C4r off_407DB4 dd offset dword_4086A4 ; DATA XREF: sub_404A60+2A1r ; sub_405074+5CCr off_407DB8 dd offset dword_4086B0 ; DATA XREF: sub_405074+6E9r off_407DBC dd offset dword_408680 ; DATA XREF: sub_404A60+16Cr ; sub_404A60+1CEr ... off_407DC0 dd offset dword_4079D8 ; DATA XREF: sub_405074+56r ; sub_405074+8B6r off_407DC4 dd offset dword_407CCC ; DATA XREF: sub_405074+6F7r off_407DC8 dd offset dword_408690 ; DATA XREF: sub_404A38+2r ; sub_405074+12Ar off_407DCC dd offset dword_4078E0 ; DATA XREF: sub_405074+2B6r off_407DD0 dd offset dword_40867C ; DATA XREF: sub_405074+2ABr off_407DD4 dd offset dword_4086A0 ; DATA XREF: sub_404A60+84r ; sub_405074+56Dr off_407DD8 dd offset dword_407B08 ; DATA XREF: sub_405074+D1Br ; sub_405074+DC0r ... off_407DDC dd offset dword_4086AC ; DATA XREF: sub_405074+68Ar off_407DE0 dd offset dword_4086B4 ; DATA XREF: sub_405074+809r ; sub_405074+12F3r off_407DE4 dd offset dword_407BD8 ; DATA XREF: sub_405074+F6Er off_407DE8 dd offset dword_408698 ; DATA XREF: sub_404A60+BCr ; sub_405074+4AFr off_407DEC dd offset dword_407B84 ; DATA XREF: sub_405074+11F9r off_407DF0 dd offset dword_4070C8 ; DATA XREF: sub_405074+135r off_407DF4 dd offset dword_4077D8 ; DATA XREF: sub_405074+57Br off_407DF8 dd offset dword_407324 ; DATA XREF: sub_405074+100r off_407DFC dd offset dword_407A34 ; DATA XREF: sub_405074+698r off_407E00 dd offset dword_407530 ; DATA XREF: sub_405074+3A0r off_407E04 dd offset dword_407A88 ; DATA XREF: sub_405074+9C9r off_407E08 dd offset dword_408688 ; DATA XREF: sub_404A60+142r ; sub_405074+345r off_407E0C dd offset dword_407AB8 ; DATA XREF: sub_405074+A7Er off_407E10 dd offset dword_40868C ; DATA XREF: sub_404A60+203r ; sub_405074+392r off_407E14 dd offset dword_407394 ; DATA XREF: sub_405074+E5r off_407E18 dd offset dword_407754 ; DATA XREF: sub_405074+51Cr off_407E1C dd offset dword_407D18 ; DATA XREF: sub_405074+838r off_407E20 dd offset dword_407A00 ; DATA XREF: sub_405074+639r off_407E24 dd offset dword_407B20 ; DATA XREF: sub_405074+7B5r off_407E28 dd offset dword_407D38 ; DATA XREF: sub_405074+C84r ; sub_405074+107Er off_407E2C dd offset dword_40866C ; DATA XREF: sub_405074+177r off_407E30 dd offset dword_407644 ; DATA XREF: sub_405074+45Er off_407E34 dd offset dword_407C28 ; DATA XREF: sub_405074+E9Er off_407E38 dd offset dword_408694 ; DATA XREF: sub_404A60+F4r ; sub_405074+450r off_407E3C dd offset dword_407AA0 ; DATA XREF: sub_405074+8F2r off_407E40 dd offset dword_4086B8 ; DATA XREF: sub_404ED8+58r ; sub_405074+7A7r off_407E44 dd offset dword_407CF4 ; DATA XREF: sub_405074+817r off_407E48 dd offset dword_407424 ; DATA XREF: sub_405074+303r off_407E4C dd offset dword_4071BC ; DATA XREF: sub_405074+1CFr off_407E50 dd offset dword_407234 ; DATA XREF: sub_405074+21Cr off_407E54 dd offset dword_407140 ; DATA XREF: sub_405074+182r off_407E58 dd offset dword_4074A8 ; DATA XREF: sub_405074+350r off_407E5C dd offset dword_407AEC ; DATA XREF: sub_405074+12D2r off_407E60 dd offset dword_407A68 ; DATA XREF: sub_405074+943r off_407E64 dd offset dword_407B54 ; DATA XREF: sub_405074+7D6r off_407E68 dd offset dword_407C6C ; DATA XREF: sub_405074+FF1r off_407E6C dd offset dword_4075BC ; DATA XREF: sub_405074+3FFr off_407E70 dd offset dword_4072AC ; DATA XREF: sub_405074+269r off_407E74 dd offset dword_407C8C ; DATA XREF: sub_405074+756r off_407E78 dd offset dword_407BA8 ; DATA XREF: sub_405074+EDDr ; sub_405074+FA2r off_407E7C dd offset dword_4086A8 ; DATA XREF: sub_404A60+292r ; sub_405074+62Br off_407E80 dd offset dword_40869C ; DATA XREF: sub_404A60+265r ; sub_405074+50Er off_407E84 dd offset dword_407AD0 ; DATA XREF: sub_405074+CD2r ; sub_405074+E5Br ... align 200h DATA ends ; Section 3. (virtual address 00008000) ; Virtual size : 00001271 ( 4721.) ; Section size in file : 00000000 ( 0.) ; Offset to raw data for section: 00006C00 ; Flags C0000000: Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Regular ; Segment permissions: Read/Write BSS segment para public '' use32 assume cs:BSS ;org 408000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing dword_408000 dd ? dword_408004 dd ? dword_408008 dd ? ; sub_4028B8+16r dword_40800C dd ? ; CODE:00403758r dword_408010 dd ? ; sub_40338C+16r ... dword_408014 dd ? ; CODE:00403740r ... dword_408018 dd ? ; sub_403A20+B7r dword_40801C dd ? dword_408020 dd ? byte_408024 db ? ; DATA XREF: sub_4038C8+33w align 4 dword_408028 dd ? dword_40802C dd ? dword_408030 dd ? byte_408034 db ? ; DATA XREF: sub_403994+1r byte_408035 db ? ; DATA XREF: sub_40195C+1Cr ; sub_40195C:loc_401A10r ... byte_408036 db ? ; DATA XREF: sub_404274+28w align 4 dword_408038 dd ? ; sub_404220+19o word_40803C dw ? ; DATA XREF: sub_404274+4Cw align 10h dd 71h dup(?) dword_408204 dd ? ; sub_404220+23o word_408208 dw ? ; DATA XREF: sub_403994+Ar ; sub_404274+55w align 10h dword_408210 dd ? align 10h dword_408220 dd ? dd 6Bh dup(?) dword_4083D0 dd ? ; sub_404220+2Do word_4083D4 dw ? ; DATA XREF: sub_404274+5Ew align 4 dd 71h dup(?) dword_40859C dd ? ; sub_402070+C3w ... dword_4085A0 dd ? ; sub_402070+CCw ... dword_4085A4 dd ? ; sub_404274w ; UINT CodePage CodePage dd ? ; DATA XREF: sub_403C0C+Cr ; sub_404274+9Cw ... byte_4085AC db ? ; DATA XREF: sub_40195C+A0w ; sub_40195C:loc_401A2Br ... align 10h dword_4085B0 dd ? ; sub_401620+99w ... ; struct _RTL_CRITICAL_SECTION CriticalSection CriticalSection _RTL_CRITICAL_SECTION <?> ; DATA XREF: sub_40195C+12o ; sub_40195C+25o ... dword_4085CC dd ? ; sub_401154+3Cw ... dword_4085D0 dd ? ; sub_40123C+22r ... dword_4085D4 dd ? ; sub_401420+51o ... dd 3 dup(?) dword_4085E4 dd 4 dup(?) ; sub_401784+12o ... dword_4085F4 dd ? dword_4085F8 dd ? align 10h dword_408600 dd ? ; sub_401B34+4r ... dword_408604 dd ? dword_408608 dd ? ; sub_401F00+2Er ... ; HLOCAL hMem hMem dd ? ; DATA XREF: sub_40195C+59w ; sub_40195C+5Er ... dword_408610 dd ? ; sub_401A34+90o ... align 10h dword_408620 dd ? ; sub_403858+9o ... dword_408624 dd ? ; sub_4037C0+2r dword_408628 dd ? dword_40862C dd ? dword_408630 dd ? dd 6 dup(?) byte_40864C db ? ; DATA XREF: sub_4043D8r align 10h dword_408650 dd ? ; sub_404424+16r ... dword_408654 dd ? ; CODE:loc_404498w dword_408658 dd ? dword_40865C dd ? ; sub_4044D0w dword_408660 dd ? ; sub_404538w dword_408664 dd ? ; sub_404570w dword_408668 dd ? ; sub_4045A8w dword_40866C dd ? ; DATA:off_407E2Co dword_408670 dd ? ; DATA:off_407DB0o dword_408674 dd ? ; DATA:off_407DA8o dword_408678 dd ? ; DATA:off_407DACo dword_40867C dd ? ; DATA:off_407DD0o dword_408680 dd ? dword_408684 dd ? dword_408688 dd ? dword_40868C dd ? dword_408690 dd ? dword_408694 dd ? dword_408698 dd ? dword_40869C dd ? dword_4086A0 dd ? dword_4086A4 dd ? dword_4086A8 dd ? dword_4086AC dd ? dword_4086B0 dd ? dword_4086B4 dd ? dword_4086B8 dd ? dword_4086BC dd ? dword_4086C0 dd ? dword_4086C4 dd ? ; sub_404A28w dword_4086C8 dd ? ; sub_404D6Cw dword_4086CC dd ? ; sub_404DA4w dword_4086D0 dd ? ; sub_404DDCw dword_4086D4 dd ? ; sub_404E14w dword_4086D8 dd ? ; sub_404E6Cw dword_4086DC dd ? ; sub_405074+A2Fo ... dword_4086E0 dd ? dword_4086E4 dd 43h dup(?) db 2 dup(?) byte_4087F2 db ? ; DATA XREF: sub_405074+932r align 4 dd 7Fh dup(?) db 3 dup(?) byte_4089F3 db ? ; DATA XREF: sub_405074+964o dd 40h dup(?) dword_408AF4 dd ? ; sub_405074+A3Fr ... dword_408AF8 dd ? ; sub_405074+922r dword_408AFC dd ? ; sub_405074+927r dword_408B00 dd 40h dup(?) ; sub_405074+AFFo dword_408C00 dd 40h dup(?) ; sub_405074+B76o dword_408D00 dd 40h dup(?) ; sub_405074+BEDo dword_408E00 dd 40h dup(?) ; sub_405074+C64o dword_408F00 dd ? ; sub_405074+E88r ... dword_408F04 dd ? ; sub_405074+10FAr ... dword_408F08 dd ? ; sub_405074+1176r ... dword_408F0C dd ? ; sub_405074+CFFr ... dword_408F10 dd ? ; sub_405074+AE9r dword_408F14 dd ? ; sub_405074+B60r dword_408F18 dd ? ; sub_405074+BD7r dword_408F1C dd ? ; sub_405074+C4Er dword_408F20 dd ? ; sub_405074+BDCr dword_408F24 dd ? ; sub_405074+C53r dword_408F28 dd ? ; sub_405074+B65r dword_408F2C dd ? ; sub_405074+AEEr dword_408F30 dd 53h dup(?) ; sub_405074+124Bo ... dword_40907C dd ? ; sub_405074+A56r ... ; HWND hWnd hWnd dd ? ; DATA XREF: sub_405074+D3w ; sub_405074+97Ar ... dword_409084 dd ? ; sub_405074+A20o ... dword_409088 dd ? ; sub_405074+1106r ... dword_40908C dd ? ; sub_405074+9FDr ... ; HKEY phkResult phkResult dd ? ; DATA XREF: sub_405074:loc_4050C2o ; sub_405074:loc_40591Fo dword_409094 dd ? ; sub_405074+B3o dword_409098 dd ? dword_40909C dd 73h dup(?) ; sub_405074+E46o dword_409268 dd ? ; sub_405074+D0Fr ... byte_40926C db ? ; DATA XREF: sub_405074+DA0w ; sub_405074:loc_405E1Br align 200h BSS ends ; ; Imports from kernel32.dll ; ; Section 4. (virtual address 0000A000) ; Virtual size : 000005FC ( 1532.) ; Section size in file : 00000600 ( 1536.) ; Offset to raw data for section: 00006C00 ; Flags C0000040: Data Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Externs ; _idata ; void __stdcall DeleteCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn __imp_DeleteCriticalSection:dword ; DATA XREF: DeleteCriticalSectionr ; void __stdcall LeaveCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn __imp_LeaveCriticalSection:dword ; DATA XREF: LeaveCriticalSectionr ; void __stdcall EnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn __imp_EnterCriticalSection:dword ; DATA XREF: EnterCriticalSectionr ; void __stdcall InitializeCriticalSection(LPCRITICAL_SECTION lpCriticalSection) extrn __imp_InitializeCriticalSection:dword ; DATA XREF: InitializeCriticalSectionr ; BOOL __stdcall VirtualFree(LPVOID lpAddress, SIZE_T dwSize, DWORD dwFreeType) extrn __imp_VirtualFree:dword ; DATA XREF: VirtualFreer ; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect) extrn __imp_VirtualAlloc:dword ; DATA XREF: VirtualAllocr ; HLOCAL __stdcall LocalFree(HLOCAL hMem) extrn __imp_LocalFree:dword ; DATA XREF: LocalFreer ; HLOCAL __stdcall LocalAlloc(UINT uFlags, SIZE_T uBytes) extrn __imp_LocalAlloc:dword ; DATA XREF: LocalAllocr ; DWORD __stdcall GetVersion() extrn __imp_GetVersion:dword ; DATA XREF: GetVersionr ; DWORD __stdcall GetCurrentThreadId() extrn __imp_GetCurrentThreadId:dword ; DATA XREF: GetCurrentThreadIdr ; int __stdcall MultiByteToWideChar(UINT CodePage, DWORD dwFlags, LPCSTR lpMultiByteStr, int cbMultiByte, LPWSTR lpWideCharStr, int cchWideChar) extrn __imp_MultiByteToWideChar:dword ; DATA XREF: MultiByteToWideCharr ; LCID __stdcall GetThreadLocale() extrn __imp_GetThreadLocale:dword ; DATA XREF: GetThreadLocaler ; void __stdcall GetStartupInfoA(LPSTARTUPINFOA lpStartupInfo) extrn __imp_GetStartupInfoA:dword ; DATA XREF: GetStartupInfoAr ; DWORD __stdcall GetModuleFileNameA(HMODULE hModule, LPCH lpFilename, DWORD nSize) extrn __imp_GetModuleFileNameA:dword ; DATA XREF: GetModuleFileNameAr ; int __stdcall GetLocaleInfoA(LCID Locale, LCTYPE LCType, LPSTR lpLCData, int cchData) extrn __imp_GetLocaleInfoA:dword ; DATA XREF: GetLocaleInfoAr ; DWORD __stdcall GetLastError() extrn __imp_GetLastError:dword ; DATA XREF: GetLastErrorr ; LPSTR __stdcall GetCommandLineA() extrn __imp_GetCommandLineA:dword ; DATA XREF: GetCommandLineAr ; BOOL __stdcall FreeLibrary(HMODULE hLibModule) extrn __imp_FreeLibrary:dword ; DATA XREF: FreeLibraryr ; void __stdcall ExitProcess(UINT uExitCode) extrn __imp_ExitProcess:dword ; DATA XREF: ExitProcessr ; BOOL __stdcall WriteFile(HANDLE hFile, LPCVOID lpBuffer, DWORD nNumberOfBytesToWrite, LPDWORD lpNumberOfBytesWritten, LPOVERLAPPED lpOverlapped) extrn __imp_WriteFile:dword ; DATA XREF: WriteFiler ; CODE:loc_402EA4r ; LONG __stdcall UnhandledExceptionFilter(struct _EXCEPTION_POINTERS *ExceptionInfo) extrn __imp_UnhandledExceptionFilter:dword ; DATA XREF: UnhandledExceptionFilterr ; DWORD __stdcall SetFilePointer(HANDLE hFile, LONG lDistanceToMove, PLONG lpDistanceToMoveHigh, DWORD dwMoveMethod) extrn __imp_SetFilePointer:dword ; DATA XREF: SetFilePointerr ; BOOL __stdcall SetEndOfFile(HANDLE hFile) extrn __imp_SetEndOfFile:dword ; DATA XREF: SetEndOfFiler extrn __imp_RtlUnwind:dword ; DATA XREF: RtlUnwindr ; BOOL __stdcall ReadFile(HANDLE hFile, LPVOID lpBuffer, DWORD nNumberOfBytesToRead, LPDWORD lpNumberOfBytesRead, LPOVERLAPPED lpOverlapped) extrn __imp_ReadFile:dword ; DATA XREF: ReadFiler ; void __stdcall RaiseException(DWORD dwExceptionCode, DWORD dwExceptionFlags, DWORD nNumberOfArguments, const ULONG_PTR *lpArguments) extrn __imp_RaiseException:dword ; DATA XREF: RaiseExceptionr ; HANDLE __stdcall GetStdHandle(DWORD nStdHandle) extrn __imp_GetStdHandle:dword ; DATA XREF: GetStdHandler ; DWORD __stdcall GetFileSize(HANDLE hFile, LPDWORD lpFileSizeHigh) extrn __imp_GetFileSize:dword ; DATA XREF: GetFileSizer ; DWORD __stdcall GetFileType(HANDLE hFile) extrn __imp_GetFileType:dword ; DATA XREF: GetFileTyper ; HANDLE __stdcall CreateFileA(LPCSTR lpFileName, DWORD dwDesiredAccess, DWORD dwShareMode, LPSECURITY_ATTRIBUTES lpSecurityAttributes, DWORD dwCreationDisposition, DWORD dwFlagsAndAttributes, HANDLE hTemplateFile) extrn __imp_CreateFileA:dword ; DATA XREF: CreateFileAr ; BOOL __stdcall CloseHandle(HANDLE hObject) extrn __imp_CloseHandle:dword ; DATA XREF: CloseHandler ; ; Imports from user32.dll ; ; int __stdcall GetKeyboardType(int nTypeFlag) extrn __imp_GetKeyboardType:dword ; DATA XREF: GetKeyboardTyper ; int __stdcall MessageBoxA(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) extrn __imp_MessageBoxA:dword ; DATA XREF: MessageBoxAr ; LPSTR __stdcall CharNextA(LPCSTR lpsz) extrn __imp_CharNextA:dword ; DATA XREF: CharNextAr ; ; Imports from advapi32.dll ; ; LSTATUS __stdcall RegQueryValueExA(HKEY hKey, LPCSTR lpValueName, LPDWORD lpReserved, LPDWORD lpType, LPBYTE lpData, LPDWORD lpcbData) extrn __imp_RegQueryValueExA:dword ; DATA XREF: RegQueryValueExAr ; LSTATUS __stdcall RegOpenKeyExA(HKEY hKey, LPCSTR lpSubKey, DWORD ulOptions, REGSAM samDesired, PHKEY phkResult) extrn __imp_RegOpenKeyExA:dword ; DATA XREF: RegOpenKeyExAr ; LSTATUS __stdcall RegCloseKey(HKEY hKey) extrn __imp_RegCloseKey:dword ; DATA XREF: RegCloseKeyr ; ; Imports from oleaut32.dll ; ; void __stdcall SysFreeString(BSTR bstrString) extrn __imp_SysFreeString:dword ; DATA XREF: SysFreeStringr ; BSTR __stdcall SysAllocStringLen(const OLECHAR *strIn, UINT ui) extrn __imp_SysAllocStringLen:dword ; DATA XREF: SysAllocStringLenr ; ; Imports from kernel32.dll ; ; BOOL __stdcall TlsSetValue(DWORD dwTlsIndex, LPVOID lpTlsValue) extrn __imp_TlsSetValue:dword ; DATA XREF: TlsSetValuer ; LPVOID __stdcall TlsGetValue(DWORD dwTlsIndex) extrn __imp_TlsGetValue:dword ; DATA XREF: TlsGetValuer ; HLOCAL __stdcall LocalAlloc_0(UINT uFlags, SIZE_T uBytes) extrn __imp_LocalAlloc_0:dword ; DATA XREF: LocalAlloc_0r ; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName) extrn __imp_GetModuleHandleA:dword ; DATA XREF: GetModuleHandleAr ; ; Imports from advapi32.dll ; ; LSTATUS __stdcall RegOpenKeyA(HKEY hKey, LPCSTR lpSubKey, PHKEY phkResult) extrn __imp_RegOpenKeyA:dword ; DATA XREF: RegOpenKeyAr ; ; Imports from kernel32.dll ; ; HANDLE __stdcall OpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId) extrn __imp_OpenProcess:dword ; DATA XREF: OpenProcessr ; DWORD __stdcall GetTickCount() extrn __imp_GetTickCount:dword ; DATA XREF: GetTickCountr ; DWORD __stdcall GetFileAttributesA(LPCSTR lpFileName) extrn __imp_GetFileAttributesA:dword ; DATA XREF: GetFileAttributesAr ; void __stdcall ExitProcess_0(UINT uExitCode) extrn __imp_ExitProcess_0:dword ; DATA XREF: ExitProcess_0r ; ; Imports from user32.dll ; ; int __stdcall MessageBoxA_0(HWND hWnd, LPCSTR lpText, LPCSTR lpCaption, UINT uType) extrn __imp_MessageBoxA_0:dword ; DATA XREF: MessageBoxA_0r ; ; Imports from ntdll.dll ; extrn __imp_RtlDecompressBuffer:dword ; DATA XREF: RtlDecompressBufferr ; ; Imports from ntdll.dll ; extrn __imp_RtlInitUnicodeString:dword ; DATA XREF: RtlInitUnicodeStringr extrn __imp_RtlInitString:dword ; DATA XREF: RtlInitStringr extrn __imp_LdrLoadDll:dword ; DATA XREF: LdrLoadDllr extrn __imp_LdrGetProcedureAddress:dword ; DATA XREF: LdrGetProcedureAddressr ; Section 5. (virtual address 0000B000) ; Virtual size : 00000008 ( 8.) ; Section size in file : 00000000 ( 0.) ; Offset to raw data for section: 00007200 ; Flags C0000000: Readable Writable ; Alignment : default ; =========================================================================== ; Segment type: Regular ; Segment permissions: Read/Write _tls segment para public '' use32 assume cs:_tls ;org 40B000h assume es:nothing, ss:nothing, ds:CODE, fs:nothing, gs:nothing TlsStart dd 2 dup(?) ; DATA XREF: .rdata:TlsDirectoryo TlsEnd dd 7Eh dup(?) ; DATA XREF: .rdata:TlsEnd_ptro _tls ends ; Section 6. (virtual address 0000C000) ; Virtual size : 00000018 ( 24.) ; Section size in file : 00000200 ( 512.) ; Offset to raw data for section: 00007200 ; Flags 50000040: Data Shareable Readable ; Alignment : default ; =========================================================================== ; Segment type: Pure data ; Segment permissions: Read _rdata segment para public 'DATA' use32 assume cs:_rdata ;org 40C000h TlsDirectory dd offset TlsStart TlsEnd_ptr dd offset TlsEnd TlsIndex_ptr dd offset TlsIndex TlsCallbacks_ptr dd offset TlsSizeOfZeroFill TlsSizeOfZeroFill dd 0 ; DATA XREF: .rdata:TlsCallbacks_ptro TlsCharacteristics dd 0 align 200h _rdata ends end start